dsh-headroom

The plugin writes HEADROOM_BASE_URL (`http://127.0.0.1:8787/v1`, line 12) into llm-deepseek.baseURL, so the host sends LLM requests including the DeepSeek Authorization header to port 8787. There is no shared secret or identity check: probeHealth treats any HTTP 200 response whose JSON parses as a healthy Headroom (lines 117-119), and startProxy then reports 'Headroom already running' (line 176) without spawning the real proxy. A local process that binds 8787 first therefore silently receives the user's API credentials for as long as the route stays switched.

run() is used by ensureInstalled with `[systemPython, "-m", "venv", venvDir()]` (line 155) and the pip argv (line 162), where venvDir() derives from homedir(). With shell:true on Windows, Node joins the argv into a single cmd.exe command line, so cmd metacharacters in an unusual home-directory path would be interpreted by the shell rather than passed literally. Precondition is a locally crafted user profile path, so the practical impact is limited to the same user.

stopProxy is platform-agnostic on the command channel, but its implementation only works on Windows: on Linux/macOS execFile('powershell') fails and the fallback `taskkill` (lines 240/244) also does not exist, yet the function still returns { ok: true, message: 'Headroom proxy stopped.' } (line 248) although the proxy keeps running. On Windows it first resolves whatever process owns port 8787 via Get-NetTCPConnection and kills it with `taskkill /PID <pid> /T /F` (line 240) without verifying that the process is actually Headroom; if the PID cannot be resolved it falls back to killing every proc

The /headroom-install command causes the host to fetch and execute `headroom-ai[proxy]` from PyPI with no version or hash pin (--disable-pip-version-check), and the resulting binary is later spawned detached with `env: { ...process.env }` (line 199), placing it in the path of every LLM request and its Authorization header. A future or compromised upstream release would therefore run and observe credentials on this machine. No malicious behaviour is present in the audited code itself.

mountHeadroomRoutes registers GET /headroom/status on the host webServer with no origin, token or session check (src/routes.ts documents 'No origin check needed for a pure read'). The handler proxies livez plus the raw /stats body, exposing proxy presence, version and token/cache usage counters. Exposure is bounded: the route is server-side, returns no Access-Control-Allow-Origin header, and leaks only low-sensitivity local metrics that a local client could also read directly on 8787.