@zhangmaorongXL/dsh-xl-free-model

apply() unconditionally calls ensureCliBinary() at load; when cli/node_modules/.../opencode.exe is absent the plugin fetches the tarball from registry.npmjs.org, extracts it with `tar`, copies opencode.exe into the plugin directory and later runs it via `spawn(CLI_PATH, ["serve", ...])` in proxy.cjs. There is no hash/signature verification and no user consent, so a compromised registry, MITM (no pinning beyond TLS) or a tampered tarball yields silent arbitrary code execution inside the user's dsh process context.

When the direct download fails, `spawn(npmCmd, ["install"], { cwd: CLI_DIR, shell: true })` runs without --ignore-scripts, and the dependency uses the caret range ^1.19.0. Any newly published minor version — including its postinstall scripts — is installed and later executed automatically, with the plugin's privileges, at the next plugin load.

The proxy authenticates to the user's OpenCode desktop backend by reading that process's environment block (PEB) through peb_env.ps1, invoked with execution policy bypassed. The script itself was not available for review (not harvested), so a hidden code-evaluation-and-exfiltration-capable PowerShell path runs with the user's privileges; its only visible use is to obtain a credential that is otherwise meant to be private to OpenCode.

All /v1/* responses and OPTIONS replies carry `access-control-allow-origin: *` (proxy.cjs line 608) and checkAuth() returns true whenever proxy.config.json has no apiKey, so /v1/chat/completions can be driven by any local process — and, subject to browser private-network rules/DNS rebinding, by web pages — against the user's OpenCode backend in the user's workspace (the proxy always sends `directory=<dsh cwd>`), consuming quota and using the user's authenticated free-tier session. /health is also unauthenticated and discloses the backend URL and CLI path.

The bearer token guarding the loopback proxy is a literal in a client bundle that ships to the browser and is also rendered in the settings page (`h("dd", null, API_KEY)`), so it is not a secret. Combined with the proxy's wildcard CORS it means the only barrier against local drive-by use of the proxy is a publicly readable constant; the same value is what proxy.config.json installs on every machine.