플러그인

Runtime plugin firewall for sessions started through its launcher (the DSH Desktop app cannot be injected and is not covered): filesystem, network and subprocess calls plugins make are attributed to the plugin that made them and judged against what that plugin declares, so a plugin doing its declared job stays silent and leaving it is recorded. Attribution is best-effort, not a guarantee - uncovered calls fall back to host, never to another plugin. Also adds a pre-install health card (capability surface, red-line combinations, PASS/WARN/BLOCK), boundary judging, opt-in pre-execution blocking with a credential-exfil rule, update diff with a trial install in an isolated child process, SARIF/CSV audit export, and multi-source aggregation. Local-only storage, no telemetry; the optional webhook is off by default.

결정론적 코드 보안 검토: 40개 이상의 규칙, 시크릿 엔트로피 탐지, 스테이징된 diff 검토, SARIF 내보내기, 베이스라인 수용, SBOM-lite 의존성 인벤토리, 헬스 자가 점검.