DSH 1.5 上下文治理：折叠工具结果、保持提示词缓存命中、接管宿主可写请求（不再需要 dsh-llm 文件补丁）。仅支持 DSH 1.5，后续会跟进更新。 / Context governance for DSH 1.5: folds tool results, keeps the prompt cache warm, takes over the writable-request path. DSH 1.5 only; newer releases will follow.
Install verification: runtime verified (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →
What it doesAI
Context governance plugin for DSH 1.5 that folds tool results, keeps prompt cache warm and cuts token cost.
- Folds tool results to shrink the context window
- Keeps the prompt cache warm to save token cost
- Takes over the writable-request path, no dsh-llm patch needed
Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.
Installation
dsh plugin --profile web add github:xiamubumu/dsh-context-reclaim#v1.1.0Install method: GitHub · runtime verified (L5)
Verification & Compatibility
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
○ The author declares no dsh version requirement — install is not blocked by version.
| plugin ＼ dsh | dsh 0.2.1-rc.2 current | dsh 0.2.1-alpha.4 | dsh 0.2.1-alpha.2 |
|---|---|---|---|
| v1.1.0 | ✓ | ✓ | · |
| v1.0.0 | · | · | ✓ |
v1.1.0github✓ 2 runtime-verified2026-10-20
https://github.com/xiamubumu/dsh-context-reclaim
✓dsh 0.2.1-rc.2current2026-10-20L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: github · https://github.com/xiamubumu/dsh-context-reclaim#v1.1.0
ID: dsh-context-reclaim@v1.1.0@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-20 · expires: 2026-10-27
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.2.1-alpha.42026-10-18L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: github · https://github.com/xiamubumu/dsh-context-reclaim#v1.1.0
ID: dsh-context-reclaim@v1.1.0@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-18 · expires: 2026-10-25
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
v1.0.0github✓ 1 runtime-verified2026-10-14
https://github.com/xiamubumu/dsh-context-reclaim
✓dsh 0.2.1-alpha.22026-10-14L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.2
- • Plugin artifact: github · https://github.com/xiamubumu/dsh-context-reclaim#v1.0.0
ID: dsh-context-reclaim@v1.0.0@dsh0.2.1-alpha.2 · profile: l4-sandbox
Issued: 2026-10-14 · expires: 2026-10-21
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-context-reclaim/)``[](https://www.dsh.so/artifact/dsh-context-reclaim/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low, dynamic medium — stricter wins → overall medium.
v1.1.0dsh manifestv1.1.0git2026-10-21v1.1.0same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (5)
- warningchildProcess · code-exec
index.js:4049childProcess.spawn('cmd', ['/c', 'start', '', target], { detached: true, stdio: 'ignore' }).unref() - warningchildProcess · code-exec
index.js:4051childProcess.spawn('open', [target], { detached: true, stdio: 'ignore' }).unref() - warningchildProcess · code-exec
index.js:4053childProcess.spawn('xdg-open', [target], { detached: true, stdio: 'ignore' }).unref() - warningnetIp · network
index.js:4012const url = new URL(req.url ?? '/', 'http://127.0.0.1') - warningshellExec · shell
verify.mjs:164execFileSync(process.execPath, ['--check', f], { stdio: 'pipe' })
show 4 audit findings
- mediumHot-patches ctx.llm.streamWithRegistration and spoofs markAgentLoopRequest on rewritten requests
index.jsEnabled by default (only DSH_RECLAIM_WRITABLE_REQUEST=0 disables it) and applied to every LLM call in the process, this replaces a core host service for all plugins and deliberately re-stamps requests with markAgentLoopRequest so downstream checks (isAgentLoopRequest, session-title) treat a plugin-modified copy as a genuine agent-loop request. The plugin also explicitly skips the host 'invariants' service check that would otherwise reject non-frozen loop requests, i.e. it works around a host integrity assertion. Any other plugin relying on request identity/frozen-ness now sees attacker-shaped
- lowUnauthenticated local HTTP routes disclose install paths and can spawn a browser process
index.jsThe routes are registered on the host web server without authentication. GET reveals absolute filesystem paths and which harness packages are patched; POST /open launches a desktop process. The Origin check only rejects when an Origin header is present and non-local, so any client that omits Origin (curl, non-browser local process, some same-site/navigated requests) passes. Command injection is prevented because the URL must be byte-identical to two hardcoded constants, so the impact is limited to disclosure plus unwanted browser launches.
- lowDebug env var DSH_RECLAIM_DUMP_SYSTEM writes full system prompt to a predictable temp directory
index.jsWhen enabled, the entire system prompt of every request (which can include workspace instructions, plugin catalogs and injected context) is persisted to <TEMP>/dsh-sysdump with sequential, predictable filenames, with no rotation, permission restriction or cleanup. Content persists after the session ends and is readable by any process running as the same user. Off by default, hence low.
- lowStartup log directs the user's agent to apply third-party binary patches that modify the harness files
index.jsThe plugin does not modify official files itself, but it prints guidance to fetch prompts from an external repository and hand them to an agent to patch node_modules of the running harness, and exposes a tgz download link in the HTTP response. This trains users into letting an agent execute untrusted third-party patch instructions with write access to the install directory. The content is disclosed and requires user action, hence low.
Context-rewriting plugin works, but it hot-patches the host LLM service and exposes unauthenticated local HTTP routes capable of spawning a browser.
Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-10-15 · activity: Active
• Repo created: 2026-10-14
• Stars: ★ 2 · Forks: 0
• Health: Active — committed within last 30 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).