dsh.so
EN
English中文
@xichen-62/dsh-power-menu avatar

@xichen-62/dsh-power-menu

DSH Desktop 右上角电源菜单：关闭 / 重启整个应用。Windows only, MIT.

PluginDesktop
Verification
L5 · Run tested
Verified
Risk
LowRisk
Health
Active
Trust
Gold

Install verification: runtime verified (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →

Install verification badge dsh 0.2.1-rc.2

What it does

DSH Desktop 右上角电源菜单：关闭 / 重启整个应用。Windows only, MIT.

Installation

dsh plugin --profile web add github:xichen-62/dsh-power-menu
verified

Install method: GitHub · runtime verified (L5)

Verification & Compatibility

Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.

External credentials (plugin-level): none detected

Declared DSH compatibilityfrom package.json · peerDependencies
author declared no dsh version requirement

○ The author declares no dsh version requirement — install is not blocked by version.

Install compatibility matrix (rows = plugin versions〔latest 5〕, columns = dsh versions〔latest 5〕)
At-a-glance → evidence in the cards below
plugin ＼ dshdsh 0.2.1-rc.2dsh 0.2.1-alpha.4
v0.1.17··
Install compatibility (by plugin version, dsh versions within)
Legend:✓ L5 runtime verified○ ecosystem plugin◼ ecosystem app✗ failed
v0.1.17github2026-10-21

https://github.com/xichen-62/dsh-power-menu

No runtime install test for this version (static scan only) — compatibility unknown, never assumed.

Only the latest 3 published versions are shown; source-snapshot (commit hash) groups, unstated groups and older versions are omitted — the full archive stays in the data layer (snapshot/unstated groups appear only when a plugin has no published version).

Author badges

Embed the official badges in your README to showcase security & install-test status:

dsh.so risk
`[![dsh.so risk](https://www.dsh.so/badge/dsh-power-menu.svg)](https://www.dsh.so/artifact/dsh-power-menu/)`
dsh 0.2.1-rc.2 install verified
`[![dsh.so install · dsh 0.2.1-rc.2](https://www.dsh.so/badge/install/dsh-power-menu@0.2.1-rc.2.svg)](https://www.dsh.so/artifact/dsh-power-menu/)`

Security Report

Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.

dsh-power-menuAutomated review · daily

Static low, dynamic low — stricter wins → overall low.

static low→dynamic low→overall low
0 critical·0 high
lowoverall · low
1static scan · vet primaryvet AST static analysis (npm artifact or git source)
Version binding
plugin versionv0.1.17dsh manifest
scanned versionv0.1.17git2026-10-21
current versionv0.1.17same version
vet verdictclean · git

Vet is an AST static scan (npm artifact or git source).

show static findings (8)
  • warningchildProcess · code-execlib/helper.cjs:240

    const child = spawn(copiedCmd, ['/d', '/c', 'exit', '0'], {

  • warningchildProcess · code-execlib/helper.cjs:298

    const child = spawn(shell, ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded], {

  • warningchildProcess · code-execlib/helper.cjs:444

    child = spawn(exe, [], {

  • warningshellExec · shelllib/helper.cjs:89

    execFileSync('taskkill', ['/PID', String(pid), '/F'], { stdio: 'ignore', windowsHide: true })

  • warningshellExec · shelllib/helper.cjs:344

    const out = execFileSync(shell, ['-NoProfile', '-NonInteractive', '-Command', script], {

  • warningfsWrite · fileslib/helper.cjs:70

    fs.appendFileSync(LOG_PATH, `[${new Date().toISOString()}] ${line}\n`, 'utf8')

  • warningfsWrite · fileslib/helper.cjs:233

    fs.writeFileSync(jsonPath, JSON.stringify(payload), 'utf8')

  • warningchildProcess · code-execlib/index.js:162

    const helper = spawn(process.execPath, [HELPER, handoffPath], {

2dynamic auditmodel reads redacted source context · never executes plugin code
highest gradelow
merged intooverall low
audited at2026-10-19
findings0 critical·0 high

Destructive shutdown/restart routes are double-fenced (loopback socket + Host + Origin) and only act in the desktop build; taskkill/spawn use internally-derived PIDs and process.execPath, not request input.

Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.

Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.

Activity

Last commit 2026-10-20 · activity: Active

• Repo created: 2026-10-17

• Stars: ★ 12 · Forks: 2

• Health: Active — committed within last 30 days

Source

GitHub: github.com/xichen-62/dsh-power-menu

Was this page helpful?