dsh-artifact-index

The DSH Artifacts sidebar is a purely front-end viewer. After installing dsh-better-sidebar and dsh-artifacts, the tab loads and polls an external index endpoint for its data. Without that endpoint the sidebar stably displays a 404 error. This plugin is the missing backend half: it mounts the /report/ route on DSH's built-in web server, returns the exact JSON shape the upstream client expects, and streams artifact file bytes into its iframe on each request. Zero third-party runtime dependencies, strictly read-only, no telemetry, no outbound network calls, and no lifecycle install scripts.

Security is treated as an untrusted-input problem. A double realpath check blocks symlink escapes at both ends, only single-segment file names are accepted and percent-encoded traversal sequences are intercepted, an extension whitelist gates what can be served, and a tiered Content-Security-Policy is applied to HTML, SVG, and XML responses. Host and Sec-Fetch-Site headers form an origin gate that rejects cross-site reads of the local port. A final stat before delivery closes the stat-then-read race window so a file cannot be swapped between the size check and the actual read.

Built for DSH Desktop users who already have the Artifacts tab in their sidebar but keep seeing the 404, this plugin closes the gap with a read-only, single-directory listing. There is no extra service to install and no daemon to manage. Configuration is a single mount row in cordis.patch.yml covering the index directory, item and byte caps, CSP level, and optional trusted hosts. After restarting DSH and opening a new session, the Artifacts tab is populated with documents and images from your chosen directory.