⚠️ This repository has been renamed: ArimaKana-Akane/dsh-sakurafrp — click to visit the new location. Everything below is preserved as originally indexed.
Install verification: runtime verified (L5) · tested on dsh 0.2.0-rc.2 · last checked Install verification details →
What it doesAI
Manage the SakuraFrp phone-to-desktop link from the DSH UI: status, gateway toggle, pairing QR, devices, and self-heal.
- Shows status of the SakuraFrp phone-desktop link
- Toggle the gateway on or off from the DSH UI
- Pairing QR code, device list, and self-heal
Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.
Installation
dsh plugin --profile web add github:ankhishtar2-lang/dsh-sakurafrpInstall method: GitHub · runtime verified (L5) · verified on dsh 0.2.0-rc.2
Verification & Compatibility
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
○ The author declares no dsh version requirement — install is not blocked by version.
| plugin ＼ dsh | dsh 0.2.0-rc.2 | dsh 0.2.0-rc.1 | dsh 0.1.7-rc.2 | dsh 0.1.7-rc.1 | dsh 0.1.7-alpha.2 |
|---|---|---|---|---|---|
| f7669a | ✓ | ✓ | ✓ | ○ | ✓ |
f7669agithub✓ 8 runtime-verified2026-10-08
https://github.com/ankhishtar2-lang/dsh-sakurafrp
✓dsh 0.2.0-rc.22026-10-08L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.0-rc.2
- • Plugin artifact: github · https://github.com/ankhishtar2-lang/dsh-sakurafrp (version unstated)
ID: dsh-sakurafrp@f7669a@dsh0.2.0-rc.2 · profile: l4-sandbox
Issued: 2026-10-08 · expires: 2026-10-15
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.2.0-rc.12026-09-29L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.0-rc.1
- • Plugin artifact: github · https://github.com/ankhishtar2-lang/dsh-sakurafrp (version unstated)
ID: dsh-sakurafrp@f7669a@dsh0.2.0-rc.1 · profile: l4-sandbox
Issued: 2026-09-29 · expires: 2026-10-06
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.1.7-rc.22026-09-25L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.1.7-rc.2
- • Plugin artifact: github · https://github.com/ankhishtar2-lang/dsh-sakurafrp (version unstated)
ID: dsh-sakurafrp@f7669a@dsh0.1.7-rc.2 · profile: l4-sandbox
Issued: 2026-09-25 · expires: 2026-10-02
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.7-rc.12026-09-23not tested
- • Node.js: v24.14.0
- • DSH: 0.1.7-rc.1
- • Plugin artifact: github · https://github.com/ankhishtar2-lang/dsh-sakurafrp (version unstated)
ID: dsh-sakurafrp@f7669a@dsh0.1.7-rc.1 · profile: l4-sandbox
Issued: 2026-09-23 · expires: 2026-09-30
View checks & evidence
This level was not executed in this scan.
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.1.7-alpha.22026-09-23L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.1.7-alpha.2
- • Plugin artifact: github · https://github.com/ankhishtar2-lang/dsh-sakurafrp (version unstated)
ID: dsh-sakurafrp@f7669a@dsh0.1.7-alpha.2 · profile: l4-sandbox
Issued: 2026-09-23 · expires: 2026-09-30
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.1.6-alpha.22026-09-20L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.2
- • Plugin artifact: github · https://github.com/ankhishtar2-lang/dsh-sakurafrp (version unstated)
ID: dsh-sakurafrp@f7669a@dsh0.1.6-alpha.2 · profile: l3-fullscan
Issued: 2026-09-20 · expires: 2026-09-27
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.1.6-alpha.12026-09-17L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.1
- • Plugin artifact: github · https://github.com/ankhishtar2-lang/dsh-sakurafrp (version unstated)
ID: dsh-sakurafrp@f7669a@dsh0.1.6-alpha.1 · profile: l4-sandbox
Issued: 2026-09-17 · expires: 2026-09-24
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.1.5-rc.22026-09-12L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.1.5-rc.2
- • Plugin artifact: github · https://github.com/ankhishtar2-lang/dsh-sakurafrp (version unstated)
ID: dsh-sakurafrp@f7669a@dsh0.1.5-rc.2 · profile: l4-sandbox
Issued: 2026-09-12 · expires: 2026-09-19
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓prehistory2026-10-04L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: unknown
- • Plugin artifact: github · https://github.com/ankhishtar2-lang/dsh-sakurafrp (version unstated)
ID: dsh-sakurafrp@f7669a@dshunknown · profile: l4-sandbox
Issued: 2026-10-04 · expires: 2026-10-11
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-sakurafrp/)``[](https://www.dsh.so/artifact/dsh-sakurafrp/)``[](https://www.dsh.so/artifact/dsh-sakurafrp/)``[](https://www.dsh.so/artifact/dsh-sakurafrp/)``[](https://www.dsh.so/artifact/dsh-sakurafrp/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low; dynamic low (authoritative when present) → overall low.
v1.1.0dsh manifest1.1.0git2026-10-081.1.0same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (10)
- warningchildProcess · code-exec
lib/index.js:330const child = spawn(cmd, args, { stdio: ['ignore', 'pipe', 'pipe'] }) - warningnetIp · network
lib/index.js:204return 'http://127.0.0.1:3080' - warningfsWrite · files
lib/index.js:131fs.appendFileSync(LOG_FILE, new Date().toISOString() + ' ' + msg + '\n', { mode: 0o600 }) - warningfsWrite · files
lib/index.js:284fs.writeFileSync(SUPPRESS_FILE, new Date().toISOString() + ' 用户主动关闭手机访问\n', { mode: 0o600 }) - warningnetIp · network
scripts/dsh-mobile-lan-watchdog.sh:22ADMIN="http://127.0.0.1:3080/api/mobile-access/lan/control" - warningnetIp · network
scripts/dsh-mobile-security-audit.sh:22LOOP="${DSH_MOBILE_LOOP:-http://127.0.0.1:3080}" - warningcurlDownload · network
scripts/dsh-mobile-security-audit.sh:35local code; code=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 12 "$ORIGIN$1") - warningcurlDownload · network
scripts/dsh-mobile-security-audit.sh:39local code; code=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 12 "$ORIGIN$1") - warningcurlDownload · network
scripts/dsh-mobile-security-audit.sh:85CODE=$(curl -sk -o /tmp/_audit_pair -w '%{http_code}' --max-time 15 -b "$CJ" -X POST \ - warningnetIp · network
scripts/legacy/dsh-mobile-pair.sh:38HOST_ADMIN="http://127.0.0.1:3080"
show 2 audit findings
- lowTLS certificate verification disabled for public-authority health probes
lib/index.js:234Probes to DSH_SAKURA_ORIGIN / DSH_SAKURA_AUTHORITIES accept any certificate, so an on-path attacker can spoof the /mobile-access/health reply and make the panel report a node as reachable or unreachable incorrectly. No cookies, tokens or credentials are sent on these probes, so the impact is limited to misleading status output; the host list comes from operator-set environment variables, not from request input.
- lowLegacy pairing helper leaves a QR image containing a live one-time pairing token on disk
scripts/legacy/dsh-mobile-pair.sh:33The generated PNG encodes the one-time pairing URL/token and is written with the process umask (typically 0644) and not deleted after use. During the token's short validity window, any local user or process able to read that file could pair a device. Requires the operator to run the manual legacy script; the token is one-time and short-lived, and the script already warns to delete the file.
Host-side plugin driving the dsh-mobile gateway over loopback; all mutating routes are loopback + desktop gated. Only two low-severity hardening gaps found.
Rule (2026-10-24): when a dynamic conclusion exists it is authoritative (it may raise or lower the level); without one, the static/vet fused tier applies. The audit never writes the exemption list (exemptions are manual only); a wrong conclusion is withdrawn by human review and the tier falls back to static/vet.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-09-13 · activity: Stable
• Repo created: 2026-09-11
• Stars: ★ 0 · Forks: 0
• Health: Stable — committed within 90 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).