同类问题已有讨论，此贴关闭

[Kenner-95]

同类问题已有讨论，此贴关闭

[zoahdev]

This is the #1863 family again, and the framing matters: approval gates and workspace-write limits are consent/routing UX, not OS security boundaries. Delegating execution to a user-privileged external shell (explorer/start/open) sidesteps both ? the agent isn't running the command, the user's own context is.

Fix directions, in order of leverage:

1. OS-level sandbox, not just policy checks: workspace-write must map to a restricted token/container (Windows: CreateRestrictedToken direction ? see 在受限模式下dsh的pwsh工具在Windows上存在问题 #1789 ? so a "launched by the user's shell" process still runs without workspace-escape privileges). Policy interception alone cannot stop delegation.
2. High-risk tool whitelist: shell-launcher tools (explorer, start, open, rundll32, wscript) should be treated as terminal-surface and either disabled in sandboxed presets or gated at a different level than ordinary tools.
3. Session history integrity: conversation files are local JSONL with no authenticity check ? a process that can write them can rewrite the story. At minimum: checksums/permissions on session dirs (related: [Bug] 会话日志被外部删除后，下一回合 dsh 进程直接 fatal 退出 #1891 ? we staged a recreate-on-ENOENT patch there) and treat any md "handoff document" as untrusted input.
4. Document the threat model explicitly: opening an untrusted md/paste is equivalent to executing instructions; presets should say so (same recommendation as [插件安全边界] tools/pre-execute 在 ask 审批前已执行，可先完成独立 Node.js 子进程 #1863).

Happy to help spec a "shell-launcher risk" check for dsh-plugin-doctor's preflight (detect child_process + explorer/start/open invocation patterns) ? it fits the existing pre-execute-side-effects lint.

[zoahdev]

Toolized: dsh-plugin-doctor v1.11.0 adds a shell-launcher check to the default preflight ? warns when child_process usage invokes explorer/start/open/powershell/cmd surfaces (the #1923 bypass channel). Heuristic, review-aid, never a sandbox; tests-dir fixtures are skipped.

npx dsh-plugin-doctor check ./my-plugin --json
# ? shell-launcher: warn | src/index.ts (explorer.exe) ?

31/31 tests, doctor self-check exit 0 (its own cmd.exe wrapper shows as an honest WARN). Release: https://github.com/zoahdev/dsh-plugin-doctor/releases/tag/v1.11.0 ? the OS-level sandbox direction (#1789 restricted token) remains the real cure; this check makes the risky channel visible before shipping.