{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"wloops-dsh-git-worktree","slug":"wloops-dsh-git-worktree","rank":675,"url":"https://github.com/wloops/dsh-git-worktree","name":"wloops/dsh-git-worktree","category":"git","description":{"zh":"Git Worktree Session Target：任务在隔离 Session 中运行，支持 Ready for Review、可撤回的 Local Preview、人工确认交付、环境保留与恢复，以及同一 Session 连续迭代。","en":"Git worktree Session Targets with isolated task sessions, Ready for Review, reversible Local Preview, human-confirmed delivery, environment retention and recovery, and same-session iteration."},"stars":3,"starsCheckedAt":"2026-08-21","repository":{"owner":"wloops","repo":"dsh-git-worktree","requestedRef":null,"subpath":""},"npm":"dsh-git-worktree","downloads":1342,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-git-worktree","tarball":null,"added":"2026-08-15","page":"https://awesome-dsh-plugin.com/p/wloops/dsh-git-worktree/","screenshots":["https://raw.githubusercontent.com/wloops/dsh-git-worktree/master/docs/screenshots/01-create-worktree.png","https://raw.githubusercontent.com/wloops/dsh-git-worktree/master/docs/screenshots/02-ready-for-review.png","https://raw.githubusercontent.com/wloops/dsh-git-worktree/master/docs/screenshots/03-local-preview.png","https://raw.githubusercontent.com/wloops/dsh-git-worktree/master/docs/screenshots/04-commit-confirmation.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"wloops-dsh-git-worktree","slug":"wloops-dsh-git-worktree","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:27:25.780Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"35a3d1dfc77a9e7b7c0ee7fbe8f56aefd0c46d0a","commitDate":"2026-08-20T21:45:29+08:00","artifactDigest":"sha256:e460dd79b3351d675cff430c019c06d4abe9435f1c08630a718d7c01cf83979f","downloadUrl":"https://github.com/wloops/dsh-git-worktree/archive/35a3d1dfc77a9e7b7c0ee7fbe8f56aefd0c46d0a.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-git-worktree","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-git-worktree","packageVersion":"0.4.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-conversation","@deepseek-ai/dsh-client-ui-tool","@deepseek-ai/dsh-api-gateway"],"platform":"web"},"lifecycleScripts":{"prepare":"pnpm run build"},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-git-worktree","manifestName":"dsh-git-worktree","nameMatch":true,"npm":{"name":"dsh-git-worktree","latestVersion":"0.4.0","publishedAt":"2026-08-20T14:32:53.904Z","createdAt":"2026-08-15T08:00:10.148Z","versionCount":8,"maintainers":1,"repository":"git+https://github.com/wloops/dsh-git-worktree.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-git-worktree","name":"dsh-git-worktree","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-INSTALL-002","title":"Git 安装会触发 prepare 构建脚本","severity":"medium","confidence":"low","layer":"supply-chain","path":"package.json","pathClass":"manifest","line":68,"evidence":"\"prepare\": \"pnpm run build\"","remediation":"发布预构建制品（npm 或 GitHub Release tarball），并记录源码与发布包的一致性证明。","note":"该插件以 npm/tarball 预构建方式分发，prepare 不在用户机器上执行","hash":"34d0fb2d8cc8e5494b8298cf"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/check-publish.mjs","pathClass":"source","line":7,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0abd5858e5599bb304b5ac24"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/check-publish.mjs","pathClass":"source","line":7,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ed072745fa87f3b36a4ea7ab"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"medium","confidence":"medium","layer":"static","path":"scripts/check-publish.mjs","pathClass":"source","line":156,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"e23f732012263c30f1143521","review":{"verdict":"functional","reason":"vm.runInNewContext 仅在发布前自检脚本 scripts/check-publish.mjs 中，于沙箱内执行插件自身构建出的 client bundle 以校验其正确调用 __ModuleLoader__.load 导出结构，非运行时对外部或用户输入执行代码。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:29:09.908Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/dev-dsh-lib.mjs","pathClass":"source","line":1,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0dae648f11f3ea471c53ad33"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/dev-dsh-lib.mjs","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"80558eadbef3279de6e455bd"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/console-host/review-diff.ts","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"47f6150d8b1afb7c6a95034f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/session-checkout-apply.ts","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a653d72177ae1e3661c5e3f1"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/client-bundle.test.ts","pathClass":"test-example-docs","line":28,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"90674fedd37630a44f08de1f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/console-host.test.ts","pathClass":"test-example-docs","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"01da1688ff58ca1be1a70c6d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/console-host.test.ts","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"6bc24d9d4cc97fe98250baee"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/dev-dsh.test.ts","pathClass":"test-example-docs","line":5,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"07ed8aaa18929783046c9901"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/dev-dsh.test.ts","pathClass":"test-example-docs","line":5,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"26e2b2311f3d93ea1588b140"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/session-checkout-apply.test.ts","pathClass":"test-example-docs","line":29,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"d516184f5511f196435de9b5"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/session-checkout-apply.test.ts","pathClass":"test-example-docs","line":29,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"54460d589f2486fdd9e5e1fa"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/session-checkout-module.test.ts","pathClass":"test-example-docs","line":5,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"6d068526fddb24a48f8762d2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/session-checkout-module.test.ts","pathClass":"test-example-docs","line":5,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"3914f6c3ad24f30171f49012"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/support/production-adapters.ts","pathClass":"test-example-docs","line":5,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"12f50068fa893ae5bb3c73e4"}],"counts":{"critical":0,"high":0,"medium":1,"low":6},"rawCounts":{"critical":0,"high":1,"medium":2,"low":15},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":92,"bytesScanned":1255799,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"test-example-docs":19,"markdown":11,"cordis":1,"manifest":1,"yaml":2,"source":57,"data":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:27:25.780Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:27:25.780Z","commit":"35a3d1dfc77a9e7b7c0ee7fbe8f56aefd0c46d0a","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:29:09.908Z","commit":"35a3d1dfc77a9e7b7c0ee7fbe8f56aefd0c46d0a","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:58:16.436Z","commit":"35a3d1dfc77a9e7b7c0ee7fbe8f56aefd0c46d0a","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"35a3d1dfc77a9e7b7c0ee7fbe8f56aefd0c46d0a","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:27:25.780Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"35a3d1dfc77a9e7b7c0ee7fbe8f56aefd0c46d0a","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:29:09.908Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"35a3d1dfc77a9e7b7c0ee7fbe8f56aefd0c46d0a","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:58:16.436Z"}]}