{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"hust-open-atom-club-oh-dsh","slug":"hust-open-atom-club-oh-dsh","rank":39,"url":"https://github.com/hust-open-atom-club/oh-dsh","name":"hust-open-atom-club/oh-dsh","category":"dev","description":{"zh":"社区发行版：TUI、桌面端与 Web UI 统一体验，分层安装、一步到位。","en":"Community distribution: TUI, desktop, and Web UI as one bundle with layered installation."},"stars":256,"starsCheckedAt":"2026-08-21","repository":{"owner":"hust-open-atom-club","repo":"oh-dsh","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:hust-open-atom-club/oh-dsh","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/hust-open-atom-club/oh-dsh/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"hust-open-atom-club-oh-dsh","slug":"hust-open-atom-club-oh-dsh","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:20:03.776Z","scanStatus":"static-complete","verdict":"caution","score":89,"commit":"49a1bd0aa4f98487d8120de590864414b9cbdee1","commitDate":"2026-08-22T10:59:51+08:00","artifactDigest":"sha256:2a6c105be6df18a90d3452eac80012e153979137d892ee31e0bd1580b8f4fb6d","downloadUrl":"https://github.com/hust-open-atom-club/oh-dsh/archive/49a1bd0aa4f98487d8120de590864414b9cbdee1.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:hust-open-atom-club/oh-dsh","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@oh-dsh/desktop","packageVersion":"0.1.7","bundle":{"patch":"./dist/cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime","@oh-dsh/desktop-frame","@oh-dsh/panel-controls","@oh-dsh/pinned-summary","@oh-dsh/sidebar","@oh-dsh/plugin-marketplace"],"platform":"web","immediately":true},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"@oh-dsh/desktop","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"dist/cordis.patch.yml","inserts":[{"id":"oh-desktop-frame","name":"@oh-dsh/desktop-frame","path":"cordis.patch.yml","disabled":false},{"id":"oh-desktop","name":"@oh-dsh/desktop","path":"cordis.patch.yml","disabled":false},{"id":"oh-better-sidebar-runtime","name":"@oh-dsh/better-sidebar-runtime","path":"cordis.patch.yml","disabled":false},{"id":"oh-vision","name":"@oh-dsh/vision","path":"cordis.patch.yml","disabled":false},{"id":"oh-skins","name":"@oh-dsh/skins","path":"cordis.patch.yml","disabled":false},{"id":"oh-sidebar","name":"@oh-dsh/sidebar","path":"cordis.patch.yml","disabled":false},{"id":"oh-panel-controls","name":"@oh-dsh/panel-controls","path":"cordis.patch.yml","disabled":false},{"id":"oh-pinned-summary","name":"@oh-dsh/pinned-summary","path":"cordis.patch.yml","disabled":false},{"id":"oh-plugin-marketplace","name":"@oh-dsh/plugin-marketplace","path":"cordis.patch.yml","disabled":false},{"id":"oh-tui","name":"@oh-dsh/tui","path":"plugins/tui/cordis.patch.yml","disabled":false},{"id":"oh-plugin-marketplace","name":"@oh-dsh/plugin-marketplace","path":"plugins/tui/cordis.patch.yml","disabled":false},{"id":"oh-skins","name":"@oh-dsh/skins","path":"plugins/tui/cordis.patch.yml","disabled":false},{"id":"oh-vision","name":"@oh-dsh/vision","path":"plugins/tui/cordis.patch.yml","disabled":false},{"id":"oh-tui-marketplace","name":"@oh-dsh/tui-marketplace","path":"plugins/tui/cordis.patch.yml","disabled":false},{"id":"oh-tui-renderer","name":"@deepseek-harness-tui/dsh-tui","path":"plugins/tui/cordis.patch.yml","disabled":false},{"id":"oh-web","name":"@oh-dsh/web","path":"web/cordis.patch.yml","disabled":false},{"id":"oh-better-sidebar-runtime","name":"@oh-dsh/better-sidebar-runtime","path":"web/cordis.patch.yml","disabled":false},{"id":"oh-vision","name":"@oh-dsh/vision","path":"web/cordis.patch.yml","disabled":false},{"id":"oh-skins","name":"@oh-dsh/skins","path":"web/cordis.patch.yml","disabled":false},{"id":"oh-pinned-summary","name":"@oh-dsh/pinned-summary","path":"web/cordis.patch.yml","disabled":false},{"id":"oh-sidebar","name":"@oh-dsh/sidebar","path":"web/cordis.patch.yml","disabled":false},{"id":"oh-panel-controls","name":"@oh-dsh/panel-controls","path":"web/cordis.patch.yml","disabled":false},{"id":"oh-plugin-marketplace","name":"@oh-dsh/plugin-marketplace","path":"web/cordis.patch.yml","disabled":false}],"overrides":[{"id":"webserver","tier":"normal","mode":"override","disabled":false,"replacesImplementation":false,"name":null,"keys":["host","port"],"path":"cordis.patch.yml"},{"id":"web-runtime","tier":"normal","mode":"override","disabled":false,"replacesImplementation":false,"name":null,"keys":["printUrl","surfaceContext","trustedHosts"],"path":"cordis.patch.yml"},{"id":"ui-layout","tier":"normal","mode":"override","disabled":true,"replacesImplementation":false,"name":null,"keys":[],"path":"cordis.patch.yml"},{"id":"cc-tui","tier":"normal","mode":"override","disabled":true,"replacesImplementation":false,"name":null,"keys":[],"path":"plugins/tui/cordis.patch.yml"},{"id":"dsh-tui","tier":"normal","mode":"override","disabled":true,"replacesImplementation":false,"name":null,"keys":[],"path":"plugins/tui/cordis.patch.yml"}],"jsExpressions":11,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","session","subprocess","telemetry"],"outboundHosts":[{"host":"open.bigmodel.cn","count":2},{"host":"oh-dsh-preview.internal","count":1},{"host":"oh-dsh.internal","count":1},{"host":"www.npmjs.com","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":".agents/skills/record-browser-gif/scripts/encode_gif.py","pathClass":"source","line":70,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"84173adf6db0cea6b2a5ab3e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":".agents/skills/record-browser-gif/scripts/encode_gif.py","pathClass":"source","line":236,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"84173adf6db0cea6b2a5ab3e"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"plugins/pinned-summary/src/client.ts","pathClass":"source","line":292,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"266209ba4a7f56e0919f84d0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"plugins/plugin-marketplace/src/host/platform.ts","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7d98c3fbced3aa79de2391c8"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"plugins/plugin-marketplace/src/host/surface.ts","pathClass":"source","line":132,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d160a649e832a64e3a67365c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"plugins/plugin-marketplace/src/host/surface.ts","pathClass":"source","line":132,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ef41310bd1ab32294028eba1"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"plugins/sidebar/src/git-workspace.ts","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1ae5924b01a9c8fb92fdcccf"},{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"plugins/tui/cordis.patch.yml","pathClass":"cordis","line":31,"evidence":"!!js process.env.OH_DSH_TUI_SESSION_ID ?? undefined","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"18127c21079d5ea00d9c5b7c"},{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"plugins/tui/cordis.patch.yml","pathClass":"cordis","line":32,"evidence":"!!js process.env.OH_DSH_TUI_PROVIDER ?? 'deepseek-official'","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"a0f69a5d15a214b689f4a04f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/after-pack.cjs","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ae3aeb4632c689274416acd0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/after-pack.cjs","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"bc472e61b7c5a7283aa6cc7c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-dsh.mjs","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"38ec1a530254d0ff5ad0b461"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-dsh.mjs","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"14a4d844c4178b70734d6a95"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-linux.mjs","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"cf158c19aaaadb4832b31a58"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-linux.mjs","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"32ab5ef4fff50039f51902ac"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-mac.mjs","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"8658a32c56f3b3397484d82c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-mac.mjs","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4bc9adad750644a898b5dbed"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-tui.mjs","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"9d99fb2ac297ed82040c6dc3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-tui.mjs","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"9d110806f656ca94b8b6c1af"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-web.mjs","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"fc53699c4a12602851c0c4ea"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-web.mjs","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"53c6f679eca4263cec6f0133"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-windows.mjs","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4da1aa4f2c64784508e06d73"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-windows.mjs","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f9a915d9935051829f6fded8"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/dsh-source.mjs","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"e524bd19e42781e00ef97922"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/dsh-source.mjs","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ba317ef4b0142ac99867c515"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/install-mac.mjs","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1b61f3aebf1b00e66b58a0a7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/smoke-runtime.mjs","pathClass":"source","line":2,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"29dd7de0cc041280bba817ba"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/smoke-runtime.mjs","pathClass":"source","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0a93d47c5d7124f4dc834aae"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/smoke-web.mjs","pathClass":"source","line":2,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f0e2887c9528ef4e16f6f267"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/smoke-web.mjs","pathClass":"source","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"9cdc8ed2b4d4faf2896ce345"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/stage-dsh.mjs","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f3a0e1b1f68cfbe15bba7e48"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/stage-dsh.mjs","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"9e846269d6b269cf402a9fc5"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/translation-pairing-git.ts","pathClass":"source","line":3,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"b38020614eceadcf22c77de7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/translation-pairing-git.ts","pathClass":"source","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ffbe8dfed7a1b432942b9cb3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/verify-archived-agent-notes.ts","pathClass":"source","line":3,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"2334824102f32aa1efdddbd9"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/verify-archived-agent-notes.ts","pathClass":"source","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7bb7cf3fbb0bf8c75edcadf4"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/cli.ts","pathClass":"source","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"93b630cc391cd66bd8db8ef7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/mac-bundle-migration.ts","pathClass":"source","line":18,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"94c9680418cd0a48f115352f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/runtime-lock.ts","pathClass":"source","line":14,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"de062560d3c9e75c3b26b519"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/runtime-lock.ts","pathClass":"source","line":14,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"8d4944cfcde5442e1bd1d8fc"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/runtime.ts","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"84e56b29561564e32a392b12"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/tui.ts","pathClass":"source","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"767d18006dcc3004b308082f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/version.ts","pathClass":"source","line":3,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"53e40f6be843400f6377a7b3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/version.ts","pathClass":"source","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a6469f4e232a7a7ff64876b7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/web.ts","pathClass":"source","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"bc716400eeea4732ddb8fd89"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/nix-collect-deps.test.ts","pathClass":"test-example-docs","line":5,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"03b8deb3c5d26ba0aa0da200"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/nix-collect-deps.test.ts","pathClass":"test-example-docs","line":5,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"bc38373c5f22c4f26d73f9b3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/tui.test.ts","pathClass":"test-example-docs","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"7d740b8a66917ccc3b87fe03"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/version.test.ts","pathClass":"test-example-docs","line":2,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"ce43a66159afed85892b5d8b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/version.test.ts","pathClass":"test-example-docs","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"6633207de584bbf540d235cd"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/workspace-tools.test.ts","pathClass":"test-example-docs","line":2,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"73154917805cc510c71c42e5"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/workspace-tools.test.ts","pathClass":"test-example-docs","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"5156e05c85f4a64f831575b4"}],"counts":{"critical":0,"high":0,"medium":3,"low":42},"rawCounts":{"critical":0,"high":0,"medium":3,"low":49},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":2370,"bytesScanned":13170087,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"markdown":1420,"test-example-docs":749,"data":4,"yaml":10,"source":160,"cordis":3,"i18n":7,"manifest":13,"script":2,"html":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:20:03.776Z","commit":"49a1bd0aa4f98487d8120de590864414b9cbdee1","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:18:28.712Z","commit":"007506581042c978db5d3283e28df5bf10f84619","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:46:14.632Z","commit":"007506581042c978db5d3283e28df5bf10f84619","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"49a1bd0aa4f98487d8120de590864414b9cbdee1","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:20:03.776Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"007506581042c978db5d3283e28df5bf10f84619","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:18:28.712Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"007506581042c978db5d3283e28df5bf10f84619","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:46:14.632Z"}]}