dsh-goal

resolveGiteaAuth() takes baseUrl from plugin options or the GITEA_BASE_URL environment variable (line 77) without requiring https, and the token itself comes from env or a credential file whose path is given by DSH_GITEA_CREDENTIALS (line 89). If an operator/环境 misconfigures baseUrl (e.g. plain http or an unintended host), the token is transmitted there in cleartext. Exploitation requires control over plugin config/env, which already implies control of the host process, so this is a hardening gap rather than a reachable credential-exfiltration path.

sessionIdOf() derives the session key used to look up and mutate per-session goal state from an unauthenticated request header (or ?sessionId= query at line 94). If the (non-harvested) lib/index.js exposes goal routes on the local webserver, any local caller/web page able to reach that port could read or mutate another session's goal data (titles, milestone notes, logs). Reachability could not be verified because the route file was not provided.

Unlike lib/engine-git-branch.js (which routes every cwd through getSafeCwd + allowedRoots), GitSnapshotManager only checks fs.existsSync(workspaceRoot) before running git rev-parse/tag/checkout in it (createSnapshot, rollback). Commands are still invoked without a shell and snapshot ids are sanitized, so the impact is limited to running git in an unexpected directory if workspaceRoot is ever influenced by goal/session data; callers live in the non-harvested lib/index.js, so this is unconfirmed.

The package's runtime entry (tool registration, webserver routes, service wiring) and its browser client are declared here but absent from the harvested files, so tool-call authorisation, route-level auth and the real callers passing workspaceRoot/cwd could not be reviewed. Findings above are therefore scoped to the provided modules.