This project is pre-1.0. The only supported line is 0.1.x on the main branch. Fixes land on main; there are no maintenance branches and no backports to older pre-1.0 versions.

Report privately through GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. That channel is private between you and the maintainer; a public issue is not a substitute, because a public issue discloses the problem before there is a fix.

Please include what you need to make the report actionable: the affected version or commit, the smallest reproduction you have, and what you believe the impact is. A rough reproduction is more useful than a perfect one that never arrives.

This is a small project with one maintainer, and the honest expectation is sized to that:

• Acknowledgement within a few days of the report.
• An assessment — whether it is a security issue, what the impact is, and whether a fix is coming — shortly after that.
• A fix as soon as it can be written and tested. There is no response-time SLA and no bug bounty.

If you get no acknowledgement after about a week, it is reasonable to assume the report was missed rather than ignored, and to follow up on the same private report.

dsh-mux spawns local coding CLIs on behalf of a DSH session. A few behaviours are deliberate; weakening any of them is a security issue rather than a bug.

User text is written to the child process stdin and never placed on the argument vector. That keeps prompts out of ps listings and shell history for the child invocation. An adapter change that moves the prompt into argv is a security issue.

Timeouts, empty stdout, unknown CLI ids, and over-cap output produce clear errors. A turn is never left hanging as a silent success. Stop sends SIGTERM → SIGKILL to the running child.

Default ceilings (10 minutes wall time, 1 MiB combined stdout+stderr) are enforced in src/run.ts. A path that spends unbounded time or buffer before consulting the ceiling is a bug worth reporting.

Deleting a mux thread removes the JSON record under the profile data dir. It does not delete the target CLI's own session files on disk. That separation is intentional so a mux cleanup cannot wipe another tool's history.

The host plugin and remote service run inside the DeepSeek Harness process. They inherit that process's trust boundary (profile token, workspace paths). Do not treat remote.mux.send as an unauthenticated public API — it is a harness-mounted remote behind the same auth as every other controller.

• Fixture CLI (docker/fixtures/claude) is a test double. It is not a real model endpoint and is not shipped as a product binary.
• Upstream CLI behaviour (Claude Code, Cursor, …) is owned by those projects. Report issues in their trackers unless dsh-mux mis-invokes them.
• Harness directory picker / first-run UI failures inside Docker are harness or environment issues unless dsh-mux itself breaks the wire path (covered by scripts/drive.py).

• One process per turn, not a live PTY. Resume is by session id. There is no bidirectional interactive TTY multiplexing.
• Output is capped and decoded as text. Binary or extremely wide streams are truncated at the ceiling; that is a resource guard, not a parser bug.
• opencode is tracked as missing until its binary appears on PATH. Discovery reporting it missing is expected.