dsh-clock

When no webServer service exists, startStandaloneServer exposes the full route table on 127.0.0.1:4801+. handle() has no authentication, no Origin/Host check, and nodeHandler parses JSON from ANY POST body regardless of Content-Type (text/plain simple requests pass preflight-free). A malicious local process, or a web page the user merely visits (form/sendBeacon CSRF), can POST /api/clock/alarms with an attacker-chosen keyword/note/label and a target sessionId, then POST /api/clock/tick to deliver it: alarm text is injected verbatim into the target conversation as a pseudo-timer message (src/ho

Runs a synchronously blocking (45s timeout) powershell.exe with execution policy bypassed from ClockScheduler.resync(), which is re-derived on every alarm mutation. The script content is fixed and all interpolated values are numeric (localIso(at), tickUrl(port)) or psQuote()-escaped, so no attacker-controlled string reaches the shell; the residual risk is the bypassed policy plus blocking/unbounded task re-registration triggered through the HTTP API.

apiBase() accepts any port in the range that returns an ok /state and caches it; call() then POSTs JSON bodies (sessionId, keyword, note) to that base and renders its /state. If another local application already holds port 4801, the plugin's own server walks to 4802 while the panel happily talks to the foreign process, which can read alarm payloads and feed forged state/session titles into the UI. Exploitation still requires local code execution.

The model-facing tool returns all persisted alarms (including other sessions' sessionId, keyword, note, label and error text) and allows cancel by arbitrary id, so an agent in one conversation can enumerate and cancel wakes belonging to a different conversation. Impact is bounded because alarm content is user/agent-authored and no credentials are stored.

The wake path the HTTP routes and timers delegate to (claimDue, deliver, fireOne, state, schedulerState) and the panel component src/client/panel.tsx are referenced but not present in the supplied tree, so the idempotency/dedupe claims, the session-target validation and the panel rendering cannot be verified; the plugin as submitted would not build. Any hidden behaviour in those modules is unaudited.