dsh-session-manager

DSH 会话功能增强插件（重命名/分支/归档）

PluginStorage

Verification

L1 · Found

Security

High

Health

Active

Trust

Unrated

What it does

DSH 会话功能增强插件（重命名/分支/归档）

Installation

dsh plugin --profile web add github:EIGHTfs/dsh-session-manager

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH Version	Status
not stated	Declared — not tested

Requirements

• Node.js: not stated
• DSH: declared "not stated"
• External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN15 FILES

d3376c

Security reviewAutomated review · daily

HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

1 critical·15 warning·20 info·15 files scanned

code-exec ×1

Version binding

plugin version1.10.0dsh manifest

scanned commitd3376c3705312026-08-19

latest commitd3376c370531

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High1 critical · 15 warning · 20 info

• Static heuristic scan: done (15 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 12 / 16

criticalChild process module usage (Node.js)validate-session.mjs:5
import { execFileSync } from "node:child_process";
warningHTTP request to a raw IP addresse2e-crash-continue.sh:19
curl -s --max-time 8 -X POST "http://127.0.0.1:${PORT}/api/$1" -H 'Content-Type: application/json' \
warningHTTP request to a raw IP addresse2e-crash-continue.sh:26
[ "$(curl -s -o /dev/null -w '%{http_code}' --max-time 3 http://127.0.0.1:${PORT}/ 2>/dev/null)" = "200" ] && return 0
warningHTTP request to a raw IP addresse2e-crash-continue.sh:52
SMOKE=$(curl -s --max-time 10 "http://127.0.0.1:${PORT}/api/session-manager/list")
warningDownloads a file from the networke2e-crash-continue.sh:26
[ "$(curl -s -o /dev/null -w '%{http_code}' --max-time 3 http://127.0.0.1:${PORT}/ 2>/dev/null)" = "200" ] && return 0
warningHTTP request to a raw IP addresse2e-detach.sh:15
rpc() { curl -s --max-time 10 -X POST "http://127.0.0.1:${PORT}/api/$1" -H 'Content-Type: application/json' -d "{\"type\":\"client-request\"
warningHTTP request to a raw IP addresse2e-detach.sh:21
[ "$(curl -s -o /dev/null -w '%{http_code}' --max-time 3 http://127.0.0.1:${PORT}/ 2>/dev/null)" = "200" ] && break
warningHTTP request to a raw IP addresse2e-detach.sh:31
curl -s --max-time 8 -X POST "http://127.0.0.1:${PORT}/api/session-manager/detach" -H 'Content-Type: application/json' -d '{"sessionId":"ses
warningDownloads a file from the networke2e-detach.sh:21
[ "$(curl -s -o /dev/null -w '%{http_code}' --max-time 3 http://127.0.0.1:${PORT}/ 2>/dev/null)" = "200" ] && break
warningHTTP request to a raw IP addresslib/group.js:256
const archRpc = await fetch(`http://127.0.0.1:${hostPort}/api/workspace.archiveSession`, {
warningHTTP request to a raw IP addresslib/group.js:277
const createRpc = await fetch(`http://127.0.0.1:${hostPort}/api/session.create`, {
warningHTTP request to a raw IP addresslib/group.js:301
const prompt = await fetch(`http://127.0.0.1:${hostPort}/api/session.prompt`, {

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-18 · activity: Active

• Repo created: 2026-08-19

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/EIGHTfs/dsh-session-manager