dsh.so
EN
English中文
DSH-P2M avatar

DSH-P2M

DSH 冲突管家（P2M）：自动拦截会让 DSH 闪退的同名服务注册/版本漂移等冲突，按用时排序、隔离肇事插件。DSH Plugin Conflict Manager: pre-empts crash-causing conflicts (duplicate service registration, version drift), usage-ranked, isolates offenders.

PluginDeveloper
Verification
L5 · Run tested
Verified
Risk
LowRisk
Health
Stable
Trust
Gold

Install verification: runtime verified (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →

Install verification badge dsh 0.2.1-rc.2Install verification badge dsh 0.2.0-rc.2Install verification badge dsh 0.2.0-rc.1Install verification badge dsh 0.1.7-rc.2Install verification badge dsh 0.1.5-rc.2Install verification badge dsh 0.1.2-rc.1

What it doesAI

A plugin manager & conflict resolver for the DSH harness, unifying plugin management and sorting plugins by usage time.

  • Unified plugin management for DSH harness
  • Resolves plugin conflicts automatically
  • Sorts plugins by usage time
developerAI

Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.

Installation

dsh plugin --profile web add github:GiantAxeint/DSH-P2M
verified

Install method: GitHub · runtime verified (L5)

Verification & Compatibility

Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.

External credentials (plugin-level): none detected

Declared DSH compatibilityfrom package.json · peerDependencies
author declared no dsh version requirement

○ The author declares no dsh version requirement — install is not blocked by version.

Install compatibility matrix (rows = plugin versions〔latest 5〕, columns = dsh versions〔latest 5〕)
At-a-glance → evidence in the cards below
plugin ＼ dshdsh 0.2.1-rc.2
current
dsh 0.2.1-alpha.4dsh 0.2.1-alpha.2dsh 0.2.0-rc.2dsh 0.2.0-rc.1
d0bf0d✓✓✓✓✓
Install compatibility (by plugin version, dsh versions within)
Legend:✓ L5 runtime verified○ ecosystem plugin◼ ecosystem app✗ failed
d0bf0dgithub✓ 13 runtime-verified◐ 1 testing2026-10-19

https://github.com/GiantAxeint/DSH-P2M

✓dsh 0.2.1-rc.2current2026-10-19L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.2.1-rc.2
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.2.1-rc.2

ID: dsh-p2m@d0bf0d@dsh0.2.1-rc.2 · profile: l4-sandbox

Issued: 2026-10-19 · expires: 2026-10-26

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-19
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.2s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-19
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.2s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-19
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.2s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-19
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 506ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-10-19
ready line dsh web: http://127.0.0.1:51030/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-10-19
path / · HTTP 200 · took 506ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-10-19
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓dsh 0.2.1-alpha.42026-10-16L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.2.1-alpha.4
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.2.1-alpha.4

ID: dsh-p2m@d0bf0d@dsh0.2.1-alpha.4 · profile: l4-sandbox

Issued: 2026-10-16 · expires: 2026-10-23

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-16
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.3s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-16
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.3s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-16
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.3s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-16
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 739ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-10-16
ready line dsh web: http://127.0.0.1:53463/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-10-16
path / · HTTP 200 · took 739ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-10-16
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓dsh 0.2.1-alpha.22026-10-10L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.2.1-alpha.2
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.2.1-alpha.2

ID: dsh-p2m@d0bf0d@dsh0.2.1-alpha.2 · profile: l4-sandbox

Issued: 2026-10-10 · expires: 2026-10-17

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-10
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 1.5s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-10
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 1.5s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-10
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 1.5s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-10
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 501ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-10-10
ready line dsh web: http://127.0.0.1:57759/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-10-10
path / · HTTP 200 · took 501ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-10-10
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓dsh 0.2.0-rc.22026-10-08L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.2.0-rc.2
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.2.0-rc.2

ID: dsh-p2m@d0bf0d@dsh0.2.0-rc.2 · profile: l4-sandbox

Issued: 2026-10-08 · expires: 2026-10-15

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-08
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 4.4s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-08
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 4.4s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-08
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 4.4s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-08
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 319ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-10-08
ready line dsh web: http://127.0.0.1:64276/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-10-08
path / · HTTP 200 · took 319ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-10-08
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓dsh 0.2.0-rc.12026-09-29L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.2.0-rc.1
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.2.0-rc.1

ID: dsh-p2m@d0bf0d@dsh0.2.0-rc.1 · profile: l4-sandbox

Issued: 2026-09-29 · expires: 2026-10-06

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-29
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 4.1s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-29
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 4.1s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-29
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 4.1s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-29
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 37ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-09-29
ready line dsh web: http://127.0.0.1:51632/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-09-29
path / · HTTP 200 · took 37ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-09-29
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓dsh 0.1.7-rc.22026-09-25L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.1.7-rc.2
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.1.7-rc.2

ID: dsh-p2m@d0bf0d@dsh0.1.7-rc.2 · profile: l4-sandbox

Issued: 2026-09-25 · expires: 2026-10-02

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-25
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.4s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-25
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.4s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-25
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.4s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-25
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 257ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-09-25
ready line dsh web: http://127.0.0.1:60884/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-09-25
path / · HTTP 200 · took 257ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-09-25
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

○dsh 0.1.7-rc.12026-09-23not tested
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.1.7-rc.1
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Unknown
L5 runtime
Not tested
This dsh version × artifact combination was not tested — no conclusion drawn
not tested

ID: dsh-p2m@d0bf0d@dsh0.1.7-rc.1 · profile: l4-sandbox

Issued: 2026-09-23 · expires: 2026-09-30

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested? Unknown
Sandbox install verdict? Unknown
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-23
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome unknown
L5 · Run tested– Not tested

This level was not executed in this scan.

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

◐dsh 0.1.7-alpha.22026-09-23L4 · testing (install passed, runtime untested)
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.1.7-alpha.2
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Not tested
Sandbox install passed (L4) — installs; runtime smoke (L5) untested, unknown whether it runs
L4 · testing (install passed, runtime untested)

ID: dsh-p2m@d0bf0d@dsh0.1.7-alpha.2 · profile: l4-sandbox

Issued: 2026-09-23 · expires: 2026-09-30

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-23
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 5.0s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-23
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 5.0s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-23
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 5.0s
L5 · Run tested– Not tested

This level was not executed in this scan.

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓dsh 0.1.6-alpha.22026-09-20L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.1.6-alpha.2
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.1.6-alpha.2

ID: dsh-p2m@d0bf0d@dsh0.1.6-alpha.2 · profile: l4-sandbox

Issued: 2026-09-20 · expires: 2026-09-27

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-20
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.3s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-20
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.3s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-20
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.3s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-20
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 44ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-09-20
ready line dsh web: http://127.0.0.1:60903/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-09-20
path / · HTTP 200 · took 44ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-09-20
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓dsh 0.1.6-alpha.12026-09-17L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.1.6-alpha.1
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.1.6-alpha.1

ID: dsh-p2m@d0bf0d@dsh0.1.6-alpha.1 · profile: l4-sandbox

Issued: 2026-09-17 · expires: 2026-09-24

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-17
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 3.2s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-17
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 3.2s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-17
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 3.2s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-17
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 18ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-09-17
ready line dsh web: http://127.0.0.1:53681/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-09-17
path / · HTTP 200 · took 18ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-09-17
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓dsh 0.1.5-rc.22026-09-11L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.1.5-rc.2
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.1.5-rc.2

ID: dsh-p2m@d0bf0d@dsh0.1.5-rc.2 · profile: l4-sandbox

Issued: 2026-09-11 · expires: 2026-09-18

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-11
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.2s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-11
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.2s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-11
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.2s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-11
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 20ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-09-11
ready line dsh web: http://127.0.0.1:62694/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-09-11
path / · HTTP 200 · took 20ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-09-11
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓dsh 0.1.3-alpha.22026-09-08L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.1.3-alpha.2
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.1.3-alpha.2

ID: dsh-p2m@d0bf0d@dsh0.1.3-alpha.2 · profile: l4-sandbox

Issued: 2026-09-08 · expires: 2026-09-15

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-08
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.6s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-08
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.6s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-08
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.6s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-08
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 131ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-09-08
ready line dsh web: http://127.0.0.1:65386/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-09-08
path / · HTTP 200 · took 131ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-09-08
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓dsh 0.1.3-alpha.12026-09-07L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.1.3-alpha.1
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.1.3-alpha.1

ID: dsh-p2m@d0bf0d@dsh0.1.3-alpha.1 · profile: l4-sandbox

Issued: 2026-09-07 · expires: 2026-09-14

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-07
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.4s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-07
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.4s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-07
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.4s
L5 · Run tested✓ Passed

active in loader tree (151 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-07
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 75ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-09-07
ready line dsh web: http://127.0.0.1:64251/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-09-07
path / · HTTP 200 · took 75ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-09-07
verdict active · entries 151
match: include:p2m · dsh-p2m · phase active
phases: active 123 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓dsh 0.1.2-rc.12026-09-05L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: 0.1.2-rc.1
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M#d0bf0d
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for dsh 0.1.2-rc.1

ID: dsh-p2m@d0bf0d@dsh0.1.2-rc.1 · profile: l3-fullscan

Issued: 2026-09-05 · expires: 2026-09-12

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-05
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.2s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-05
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.2s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-05
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 2.2s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-09-05
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 181ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-09-05
ready line dsh web: http://127.0.0.1:62011/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-09-05
path / · HTTP 200 · took 181ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-09-05
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

✓prehistory2026-10-05L5 · runtime verified
Environment & artifact
  • • Node.js: v24.14.0
  • • DSH: unknown
  • • Plugin artifact: github · https://github.com/GiantAxeint/DSH-P2M (version unstated)
Levels (L1–L3 plugin-level static archive · L4/L5 newest real verdicts for this combination)
L1 static
Passed
L2 static
Passed
L3 static
Passed
L4 sandbox
Passed
L5 runtime
Passed
Install + runtime smoke verified in the dsh sandbox — installs and runs
L5 · runtime verified · valid for prehistory

ID: dsh-p2m@d0bf0d@dshunknown · profile: l4-sandbox

Issued: 2026-10-05 · expires: 2026-10-12

View checks & evidence
L1 · Found✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L2 · Structured✓ Passed
Defaulted from L3✓ Passed
defaulted to passed — L3 install spec passed (full-registry L3 sweep policy)
L3 · Install spec✓ Passed
Install command parsed✓ Passed
Source: registry verification · Method: install spec parse · Captured 2026-10-18
DSH version declared✓ Passed
Source: registry verification · Method: DSH version declaration · Captured 2026-10-18
L4 · Install tested✓ Passed
Install executed in confined sandbox✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-05
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 3.8s
Install succeeded✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-05
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 3.8s
Installed artifact confirmed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-05
spec github:GiantAxeint/DSH-P2M · channel GitHub source · outcome ran · exit 0
check took: 3.8s
L5 · Run tested✓ Passed

active in loader tree (150 entries)

Sandbox install passed✓ Passed
Source: Windows ACL sandbox · Method: sandbox install run · Captured 2026-10-05
spec github:GiantAxeint/DSH-P2M · install mode reused L4 scratch
check took: 184ms
Web boot ready✓ Passed
Source: DSH runtime · Method: web boot · Captured 2026-10-05
ready line dsh web: http://127.0.0.1:59604/?token=…
HTTP endpoint served✓ Passed
Source: DSH runtime · Method: HTTP request · Captured 2026-10-05
path / · HTTP 200 · took 184ms
Plugin active in inventory✓ Passed
Source: DSH runtime · Method: plugin inventory query · Captured 2026-10-05
verdict active · entries 150
match: include:p2m · dsh-p2m · phase active
phases: active 122 · null 28

L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.

Author badges

Embed the official badges in your README to showcase security & install-test status:

dsh.so risk
`[![dsh.so risk](https://www.dsh.so/badge/dsh-p2m.svg)](https://www.dsh.so/artifact/dsh-p2m/)`
dsh 0.2.1-rc.2 install verified
`[![dsh.so install · dsh 0.2.1-rc.2](https://www.dsh.so/badge/install/dsh-p2m@0.2.1-rc.2.svg)](https://www.dsh.so/artifact/dsh-p2m/)`
dsh 0.2.0-rc.2 install verified
`[![dsh.so install · dsh 0.2.0-rc.2](https://www.dsh.so/badge/install/dsh-p2m@0.2.0-rc.2.svg)](https://www.dsh.so/artifact/dsh-p2m/)`
dsh 0.2.0-rc.1 install verified
`[![dsh.so install · dsh 0.2.0-rc.1](https://www.dsh.so/badge/install/dsh-p2m@0.2.0-rc.1.svg)](https://www.dsh.so/artifact/dsh-p2m/)`
dsh 0.1.7-rc.2 install verified
`[![dsh.so install · dsh 0.1.7-rc.2](https://www.dsh.so/badge/install/dsh-p2m@0.1.7-rc.2.svg)](https://www.dsh.so/artifact/dsh-p2m/)`
dsh 0.1.5-rc.2 install verified
`[![dsh.so install · dsh 0.1.5-rc.2](https://www.dsh.so/badge/install/dsh-p2m@0.1.5-rc.2.svg)](https://www.dsh.so/artifact/dsh-p2m/)`
dsh 0.1.2-rc.1 install verified
`[![dsh.so install · dsh 0.1.2-rc.1](https://www.dsh.so/badge/install/dsh-p2m@0.1.2-rc.1.svg)](https://www.dsh.so/artifact/dsh-p2m/)`

Security Report

Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.

dsh-p2mAutomated review · daily

Static low, dynamic medium — stricter wins → overall medium.

static low→dynamic medium→overall medium
0 critical·0 high
mediumoverall · medium
1static scan · vet primaryvet AST static analysis (npm artifact or git source)
Version binding
plugin versionv0.1.7dsh manifest
scanned version0.1.7git2026-10-21
current version0.1.7same version
vet verdictclean · git

Vet is an AST static scan (npm artifact or git source).

show static findings (10)
  • warningchildProcess · code-execlauncher/dsh-safe.mjs:285

    const child = spawn('cmd', args, { stdio: ['inherit', 'inherit', 'pipe'], windowsHide: false })

  • warningfsWrite · fileslauncher/dsh-safe.mjs:88

    fs.writeFileSync(tmp, GUARD_HEADER + body + '\n', 'utf8')

  • warningfsWrite · fileslauncher/dsh-safe.mjs:98

    fs.writeFileSync(fd, String(Date.now()))

  • warningfsWrite · fileslauncher/dsh-safe.mjs:134

    fs.appendFileSync(INCIDENT_FILE, JSON.stringify({ ts: Date.now(), source: 'launcher', ...entry }) + '\n', 'utf8')

  • warningchildProcess · code-execlib/dialog.js:75

    const child = spawn(

  • warningfsWrite · fileslib/state.js:44

    fs.appendFileSync(file, line + '\n', 'utf8')

  • warningchildProcess · code-execlib/trial.js:68

    const child = spawn(node, ['--input-type=module', '-e', PROBE_SOURCE], {

  • warningfsWrite · fileslib/util.js:36

    fs.writeFileSync(tmp, data, 'utf8')

  • warningfsWrite · fileslib/util.js:37

    if (mode) fs.chmodSync(tmp, mode)

  • warningfsWrite · fileslib/util.js:60

    fs.writeFileSync(fd, String(now()))

2dynamic auditmodel reads redacted source context · never executes plugin code
highest grademedium
merged intooverall medium
audited at2026-10-17
findings0 critical·0 high1 medium / 2 low hidden
show 3 audit findings
  • mediumBoot-crash attribution trusts raw stderr text, letting a failing plugin auto-disable another entrylauncher/dsh-safe.mjs:274

    The launcher decides which plugin to persistently disable (writes `disabled: true` into the shared plugin-guard.yml) from a regex over the accumulated stderr of the DSH child process. Any plugin that writes a line such as 'failed to apply loader entry <victim>' to stderr and then crashes the boot makes the launcher isolate <victim> instead, permanently disabling another (non-protected) plugin — a defense-bypass against the very failure mode p2m exists to handle. Only ids in PROTECTED (default: p2m) are spared.

  • lowGuard YAML rows are written with unquoted entry ids (possible loader-patch row injection)lib/guard.js:52

    Entry ids are interpolated into YAML without quoting or validation. If an id reaching mutateGuard/disableEntry contains a newline (ids ultimately come from loader patch files authored by plugin packages), the extra text becomes additional rows of plugin-guard.yml — a file DSH reloads as a loader patch — so rows for other entries (or an `insert` row naming an arbitrary module) can be injected. The launcher's own write path is safe because its id is regex-extracted without whitespace; reachability through lib/index.js (not provided in the harvest) could not be demonstrated, hence low.

  • lowLauncher passes env-derived paths to cmd.exe, which does not follow Node argument escapinglauncher/dsh-safe.mjs:285

    GUARD_FILE (process.env.DSH_P2M_GUARD_FILE), DSH_HOME/DSH_PROFILE (line 37-42) and APPDATA are interpolated into a cmd.exe command line. cmd.exe applies its own quoting rules, so a value containing quotes plus cmd metacharacters (e.g. `" & <cmd>`) can break out of the argument and run an extra command when the launcher starts. The precondition is control over the launcher's environment (normally the same user), so practical exploitability is limited.

P2M's guard/launcher logic is mostly defensive, but boot-crash attribution trusts raw stderr text and guard rows are serialized unquoted; no RCE or exfiltration found.

Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.

Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.

Activity

Last commit 2026-09-07 · activity: Stable

• Repo created: 2026-09-05

• Stars: ★ 1 · Forks: 0

• Health: Stable — committed within 90 days

Source

GitHub: github.com/GiantAxeint/DSH-P2M

Was this page helpful?