{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"linjiangxian0203-dsh-remote-tunnel","slug":"linjiangxian0203-dsh-remote-tunnel","rank":579,"url":"https://github.com/Linjiangxian0203/dsh-remote-tunnel","name":"Linjiangxian0203/dsh-remote-tunnel","category":"remote","description":{"zh":"远程主机隧道管理器：把 dsh web 跑在远程 Linux 服务器上（systemd 守护、免 root），本地经自动重连的 SSH 隧道访问；远程端口自动分配并在服务器登记留档，支持多人共用与 audit 审查。","en":"Remote host tunnel manager: runs dsh web on a remote Linux server (systemd supervision, no root needed) behind an auto-reconnecting SSH tunnel; allocates and registers remote ports on the server, multi-user safe, with an audit view."},"stars":4,"starsCheckedAt":"2026-08-21","repository":{"owner":"Linjiangxian0203","repo":"dsh-remote-tunnel","requestedRef":null,"subpath":""},"npm":"dsh-remote-tunnel","downloads":366,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-remote-tunnel","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/Linjiangxian0203/dsh-remote-tunnel/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"linjiangxian0203-dsh-remote-tunnel","slug":"linjiangxian0203-dsh-remote-tunnel","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:26:26.105Z","scanStatus":"static-complete","verdict":"pass","score":98,"commit":"05c61c50ce0dc4f4d0c0c6cf9490337e5613eb0b","commitDate":"2026-08-20T20:15:55+08:00","artifactDigest":"sha256:465f56ff72271492da8a1093aea5d172864cb3720733be5dafa1eae838cb4d12","downloadUrl":"https://github.com/Linjiangxian0203/dsh-remote-tunnel/archive/05c61c50ce0dc4f4d0c0c6cf9490337e5613eb0b.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-remote-tunnel","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-remote-tunnel","packageVersion":"0.1.1","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-cmdline"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-remote-tunnel","manifestName":"dsh-remote-tunnel","nameMatch":true,"npm":{"name":"dsh-remote-tunnel","latestVersion":"0.1.1","publishedAt":"2026-08-15T16:19:31.309Z","createdAt":"2026-08-15T13:59:39.532Z","versionCount":2,"maintainers":1,"repository":"git+https://github.com/Linjiangxian0203/dsh-remote-tunnel.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"remote-tunnel","name":"dsh-remote-tunnel","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":1,"clientPlatform":null,"parseErrors":[]},"capabilities":["credentials","environment","filesystem","host-bundle","subprocess"],"outboundHosts":[{"host":"deb.nodesource.com","count":1}],"findings":[{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"low","confidence":"high","layer":"dsh-semantics","path":"cordis.patch.yml","pathClass":"cordis","line":18,"evidence":"!!js dshHomePath('remote-tunnel')","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","hash":"d61198196032c4add3732ae9"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"scripts/bootstrap-remote.sh","pathClass":"script","line":4,"evidence":"curl -fsSL <this file> | sh","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","hash":"6d0d7e9e6ff463978c4286d7","review":{"verdict":"placeholder","reason":"该行位于脚本头部注释（# 开头），仅是给用户展示如何手动执行本脚本的用法说明，并非代码实际执行的语句。","model":"sonnet","reviewedAt":"2026-08-21T10:56:52.437Z"}},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"scripts/bootstrap-remote.sh","pathClass":"script","line":37,"evidence":"curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","hash":"44cb17db7d6a6bb004a7b9de","review":{"verdict":"placeholder","reason":"该 curl|bash 命令位于 die() 的错误提示字符串内，只在 Node 版本不足且无 sudo 时打印给用户看，作为手动修复建议，脚本本身不会执行它。","model":"sonnet","reviewedAt":"2026-08-21T10:56:52.437Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/local/ports.js","pathClass":"source","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"82440b04c5e68d866c434f2d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/manager.js","pathClass":"source","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"782c7c5c6fec1b6e47336215"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/ssh.js","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"9e14be3ce82458f90ddb1c34"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/mock-remote/ssh-shim.js","pathClass":"test-example-docs","line":10,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"526bfe5a2b67be27f85d6eba"}],"counts":{"critical":0,"high":0,"medium":0,"low":4},"rawCounts":{"critical":2,"high":0,"medium":0,"low":5},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":24,"bytesScanned":170413,"truncated":false,"lockfiles":[],"pathClasses":{"test-example-docs":5,"markdown":3,"cordis":1,"manifest":1,"script":1,"source":13}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:26:26.105Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:26:26.105Z","commit":"05c61c50ce0dc4f4d0c0c6cf9490337e5613eb0b","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:27:58.682Z","commit":"05c61c50ce0dc4f4d0c0c6cf9490337e5613eb0b","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:56:52.437Z","commit":"05c61c50ce0dc4f4d0c0c6cf9490337e5613eb0b","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"05c61c50ce0dc4f4d0c0c6cf9490337e5613eb0b","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:26:26.105Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"05c61c50ce0dc4f4d0c0c6cf9490337e5613eb0b","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:27:58.682Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"05c61c50ce0dc4f4d0c0c6cf9490337e5613eb0b","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:56:52.437Z"}]}