@7gzgn/dsh-restart-planner

The tool schema lets the model set relaunchCommand ('覆盖拉起命令'), which is embedded in the base64 payload handed to the helper. On the audited POSIX path the override is ignored for spawning (relaunchArgv is null, so the original executable is relaunched), but on Windows the value is consumed by lib/helper.ps1, which is executed with -ExecutionPolicy Bypass and is not part of the submitted source. If that script launches the string, a model whose context was poisoned (e.g. by a malicious repo/issue it read) can schedule a restart that starts an arbitrary program detached from the host's job objec

On Windows (the primary, actually exercised platform) every resolve/arm/run action runs an unaudited PowerShell script with execution policy disabled. That script holds all the privileged operations (ancestor resolution, process killing, relaunch, .lnk creation via Explorer). Its contents, and therefore the real confidentiality/integrity behaviour on Windows, cannot be verified from this submission; the packaged plugin would still ship it because package.json 'files' includes lib.

The schedule tool arg continuePrompt (or plugin config continuePrompt) is stored on disk and later replayed as a user-turn prompt into the recorded session on the next startup, with up to 6 retries. Text that was written once keeps getting injected until delivery succeeds; if the state directory is tampered with, arbitrary instructions are injected into the agent session at boot. Trust boundary is the same agent, so this is not privilege escalation, but it is a persistent prompt channel that outlives the process.