# Security model

## Trust zones

The DSH Host and configured workspace are privileged. The target application, its dependencies, DOM, Console, Network, response headers, screenshot pixels and error messages are untrusted. The Web client is a caller, not a process authority.

## Process controls

- Run profiles originate in bounded detector output; RPC/tools cannot provide arbitrary commands.
- cwd is canonicalized and must remain inside the active workspace after symlink resolution.
- argv is passed to `ctx.subprocess`; no shell interpolation is used.
- Environment additions are plugin-controlled. DSH subprocess scrubs inherited credential variables.
- A Windows adapter recognizes only standard npm/pnpm/Yarn JavaScript entrypoints and fails closed.
- Port conflict never authorizes killing a listener. Adopted sessions are unowned.
- stop/dispose terminates and joins owned trees with DSH's bounded escalation.
- stdout/stderr and projected logs are tail-bounded and redacted.

## Browser controls

- Top-level target is credential-free HTTP(S), literal loopback, and fixed to the managed origin.
- Every HTTP(S) request is paused at Chromium Request stage. Same-origin traffic continues; an external hostname needs an explicit exact/wildcard allowlist entry and a bounded DNS result containing no private/reserved address.
- Redirects create another paused request and are checked before send.
- Cross-origin WebSocket is closed; same-origin HMR remains direct.
- Service workers are blocked to avoid hidden/stale request paths. WebRTC and WebTransport globals are disabled in the verification page.
- Each Preview Session has a separate BrowserContext, cookies and storage. Contexts have concurrency and idle limits.
- No Agent-facing arbitrary evaluate exists.

The browser gate is defense-in-depth for a development verifier, not a general secure browser sandbox. Explicitly allowlisting a public domain authorizes application traffic to that domain; DNS is rechecked per request but DNS resolution and Chromium connection are separate operations. Keep `allowedHosts` empty unless the target genuinely requires a public API.

## Preview and RPC

- RPC is registered with DSH loopback authority.
- Host operations resolve the DSH subject and Preview ownership; IDs are opaque random values.
- Client controls invoke Host RPC and cannot spawn or inspect arbitrary processes.
- The direct iframe retains target CSP/XFO. There is no header-stripping/open proxy.
- A remote DSH Host cannot make local-browser `localhost` equivalent; UI marks the topology and falls back.

## Evidence controls

- Image bytes and dimensions, DOM nodes/text, diagnostic counts/message lengths, report JSON and retained run groups are bounded.
- Evidence paths are canonicalized under one root. Pre-existing symlink/junction session paths and traversal are rejected.
- JSON report writes are atomic. Retention removes only validated evidence files inside the session directory.
- URL credentials and common token/key/secret/password/cookie/authorization patterns are redacted best-effort; Network response bodies are never captured.
- Screenshot pixels and application text can still contain secrets. Protect the evidence root as developer data.

## Prompt injection

Page-derived text is returned with an explicit trust notice. Tool/System Prompt guidance says it is evidence, never instruction. The plugin does not execute instructions found in DOM, Console, Network or images and does not expose page script evaluation.

## Approval boundary

Model-requested start/restart remains a DSH Tool execution and participates in the public permission/approval pipeline. UI and RPC do not bypass Host-side validation. Installing the plugin authorizes its declared Host service; it does not authorize arbitrary internet plugin discovery or installation.