What it does
DeepSeek Harness auth插件
Installation
dsh plugin --profile web add deepseek-harness-authInstall method: npm · not yet tested in container (L3+)
Compatibility
| DSH Version | Status |
|---|---|
| not stated | Declared — not tested |
Requirements
- • Node.js: not stated
- • DSH: declared "not stated"
- • External credentials: none detected
Security Report
Automated static scan, not manual review.
No critical findings, but warning-level issues were detected (file writes, remote imports, base64 decoding, downloads).
4464052fc1dc2026-08-164464052fc1dcThe scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.
Disclaimer: automated static analysis, not a security guarantee. Always review what you install.
• Static heuristic scan: done (15 files)
• Dependency vulnerabilities: requires deep audit (L3+)
• Permission sandboxing: requires runtime testing (L4+)
Scan findings · 12
- infoReads process.envsrc/cli.ts:109export function program(store = new AuthStateStore(process.env.DSH_AUTH_STATE_DIR || defaultStateDir())): Command {
- infoMakes network requests (fetch / axios)src/client/index.tsx:31await fetch('/auth/logout', { method: 'POST', headers: { 'X-DSH-Auth-Request': '1' } })
- infoMakes network requests (fetch / axios)src/client/index.tsx:60void fetch('/auth/account').then(async response => {
- infoMakes network requests (fetch / axios)src/client/index.tsx:82const response = await fetch('/auth/account/password', {
- infoHardcoded IP addresssrc/client/index.tsx:175<label className="dsh-auth-field"><span>{zh ? '免登录 IP / CIDR' : 'Login bypass IPs / CIDRs'}</span><textarea value={whitelistText} onChange={
- infoUses localStoragesrc/client/onboarding.ts:26try { acknowledged = localStorage.getItem(WELCOME_ACK_STORAGE_KEY) } catch {}
- infoUses localStoragesrc/client/onboarding.ts:51try { localStorage.setItem(WELCOME_ACK_STORAGE_KEY, fingerprint) } catch {}
- infoUses localStoragesrc/client/theme.ts:61localStorage.setItem(THEME_STORAGE_KEY, serialized)
- infoUses localStoragesrc/client/theme.ts:71try { last = localStorage.getItem(THEME_STORAGE_KEY) ?? undefined } catch {}
- infoUses localStoragesrc/html.ts:29const parsed = JSON.parse(localStorage.getItem(key) || 'null');
- infoHardcoded IP addresssrc/network.ts:25const value = rule.trim().toLowerCase() === 'localhost' ? '127.0.0.0/8' : rule.trim()
- warningHTTP request to a raw IP addresssrc/proxy.ts:471console.log(`dsh auth: ${publicBaseUrl ?? `http://127.0.0.1:${String(port)}`}`)
Heuristic static scan — may produce false positives. Review the source yourself before trusting.
Activity
Last commit 2026-08-16 · activity: Active
• Repo created: 2026-08-16
• Stars: ★ 5 · Forks: 0
• Health: Active — committed within last 30 days