⚠️ This repository has been renamed: 7gzgn/dsh-restart-planner — click to visit the new location. Everything below is preserved as originally indexed.
Install verification: runtime verified (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →
What it does
Let the agent restart its own DSH host: schedule a self-restart, finish the turn first, then a detached helper stops and relaunches the app and reports what happened.
Installation
dsh plugin --profile web add github:7gzgn/dsh-self-restartInstall method: GitHub · runtime verified (L5)
Verification & Compatibility
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
○ The author declares no dsh version requirement — install is not blocked by version.
| plugin ＼ dsh | dsh 0.2.1-rc.2 current | dsh 0.2.1-alpha.4 |
|---|---|---|
| e50147 | ✓ | ○ |
e50147github✓ 1 runtime-verified2026-10-19
https://github.com/7gzgn/dsh-self-restart
✓dsh 0.2.1-rc.2current2026-10-19L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: github · https://github.com/7gzgn/dsh-self-restart (version unstated)
ID: dsh-self-restart-5@e50147@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-19 · expires: 2026-10-26
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.2.1-alpha.42026-10-18not tested
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: github · https://github.com/7gzgn/dsh-self-restart (version unstated)
ID: dsh-self-restart-5@e50147@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-18 · expires: 2026-10-25
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-self-restart-5/)``[](https://www.dsh.so/artifact/dsh-self-restart-5/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low, dynamic medium — stricter wins → overall medium.
v0.4.6dsh manifest0.4.6git2026-10-180.4.6same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (8)
- warningchildProcess · code-exec
lib/core.js:201const child = spawn(file, args, { detached: true, stdio: 'ignore', env }); - warningshellExec · shell
lib/core.js:45execFile(candidate, ['-NoProfile', '-NonInteractive', '-Command', 'exit 0'], - warningshellExec · shell
lib/core.js:139execFile(file, args, { - warningchildProcess · code-exec
lib/helper.mjs:359const child = spawn(argv[0], argv.slice(1), { - warningshellExec · shell
lib/helper.mjs:43const ppid = execFileSync('ps', ['-o', 'ppid=', '-p', String(pid)], { encoding: 'utf8' }).trim(); - warningshellExec · shell
lib/helper.mjs:44const comm = execFileSync('ps', ['-o', 'comm=', '-p', String(pid)], { encoding: 'utf8' }).trim(); - warningshellExec · shell
lib/helper.mjs:61const args = execFileSync('ps', ['-o', 'args=', '-p', String(pid)], { encoding: 'utf8' }).trim(); - warningnetIp · network
lib/index.js:258if (Number.isFinite(port) && port > 0) return `http://127.0.0.1:${port}`;
show 4 audit findings
- mediumAgent can schedule a host process-tree kill/relaunch by default without user confirmation
lib/core.js:333The self_restart tool is advertised to the model in the system prompt and its `confirm` option defaults to false (lib/plan.js normalizeConfirm: `input.confirm === true || (input.confirm === undefined && config.confirm === true)`). A model driven by indirect prompt injection (web page, repo file, tool output) can call action='schedule' and cause the detached helper to SIGTERM/SIGKILL the host and all its descendants, then relaunch it. The delay/quiet gates only defer the kill; they do not require human approval. Impact is host downtime and possible loss of unsaved non-session work.
- mediumModel-supplied relaunchCommand is forwarded unvalidated to the restart helper
lib/core.js:246The tool schema exposes `relaunchCommand` to the model as an override of the command used to bring the host back. The string is copied verbatim into the helper payload with no allow-list or validation. On POSIX helper.mjs it is only echoed (relaunchArgv becomes null and [targetExe] is spawned), but on Windows the relaunch is performed inside lib/helper.ps1, which is not part of the harvested sources; if that helper executes the override, a prompt-injected model could launch arbitrary code that survives the restart. The execution path could not be verified.
- lowModel-written restart reason is echoed verbatim into the system prompt
lib/index.jsThe `reason` argument supplied to the tool is persisted into last.json by the helper and, for 10 minutes after a successful restart, is interpolated unescaped into the systemPrompt section of every new process. Text that reached the model through untrusted content can therefore persist into the system prompt, and any local process able to write ~/.dsh/dsh-restart-planner/last.json can inject instructions into future sessions.
- lowWindows helper.ps1 is absent from the audited sources, leaving the primary path unreviewed
lib/core.js:71On Windows the plugin runs lib/helper.ps1 with ExecutionPolicy Bypass and hands it the full payload (including relaunchCommand and the allow marker check). That file was not part of the harvest, so the arm/Explorer handoff, the kill list construction, and how the relaunch command is executed could not be verified; only the POSIX implementation was reviewed.
Host-restart plugin: the model can trigger a gated host kill/relaunch without user confirmation and pass an unvalidated relaunchCommand; Windows helper.ps1 was not audited.
Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-10-18 · activity: Active
• Repo created: 2026-10-16
• Stars: ★ 0 · Forks: 0
• Health: Active — committed within last 30 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).