dsh-openwiki

RPC_HEADER is the constant string 'x-dsh-openwiki', so the 'auth' is a publicly known token. Anyone able to reach the harness web server (any local process, or a remote peer if the server is not loopback-bound) can invoke the whole handler registry: runtime/install (global npm install), model/env (raw secrets), kb/import and kb/delete (writes/deletes executed with real user permissions), job/start (spawns the CLI with the user's API keys in env). Same-origin client code (or an XSS in the harness UI) also bypasses the DSH fs sandbox through these methods.

MANAGED_ENV_KEYS includes OPENAI_COMPATIBLE_API_KEY / ANTHROPIC_API_KEY / GEMINI_API_KEY / OPENROUTER_API_KEY, and the function comment says 'values masked for secrets' but no masking happens. `rpc.handle('openwiki/model/env', async () => readOpenWikiEnvStatus())` therefore hands the plaintext provider keys back to any RPC caller (see the weak header auth), and the keys also sit in a plaintext file written with default fs.writeFileSync permissions via the node fallback.

nodeWriteFile/nodeRemoveFile and the applyEnvUpdates fallback build `node -e` code paths that write to ~/.openwiki/.env and to any registered workspace's openwiki-kb tree regardless of workspace-write restrictions. Content is attacker-controllable via the kb/import RPC and delete is recursive; blast radius is limited by safeImportName (no '..', no absolute paths, no control chars), so an RPC caller can overwrite/delete files only inside <workspace>/openwiki-kb/source/files and rewrite the credential file.

ensure() is invoked unconditionally on apply (`void ensure().then(...)`), so the first load of the plugin fetches and globally installs a third-party package (and runs its install scripts) with the user's permissions if the CLI is absent; the CLI is then spawned with the user's provider API keys in its env. Supply-chain compromise of that npm package becomes host code execution without any prompt.

Any call to openwiki/workspaces (i.e. opening the panel) calls maybeDefaultAutoUpdate(), which starts a 15s `git rev-parse --verify HEAD` poll per workspace and, on HEAD change, `await startJob({ workspaceId, mode: 'update', ... })` — regenerating wiki pages with the user's model credentials and rewriting files in the workspace without an explicit opt-in.