dsh-daemon

dsh daemon: register the DeepSeek Harness web server (dsh web) as an auto-start, self-healing background service (LaunchAgent / systemd / cron + watchdog)

PluginAutomationNetworkWeb search

Verification

L2 · Structured

Security

High

Health

Active

Trust

Silver

What it does

dsh daemon: register the DeepSeek Harness web server (dsh web) as an auto-start, self-healing background service (LaunchAgent / systemd / cron + watchdog)

Installation

dsh plugin --profile web add github:chenkai2/dsh-daemon

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH Version	Status
not stated	Declared — not tested

Requirements

• Node.js: not stated
• DSH: declared "not stated"
• External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN3 FILES

5079b1

Security reviewAutomated review · daily

HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

3 critical·9 warning·8 info·3 files scanned

shell ×2code-exec ×1

Version binding

plugin version0.1.11dsh manifest

scanned commit5079b1ca6d442026-08-19

latest commit5079b1ca6d44

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High3 critical · 9 warning · 8 info

• Static heuristic scan: done (3 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 12 / 12

criticalChild process module usage (Node.js)lib/index.js:294
'const CP = require(\'node:child_process\');\n' +
criticalShell command execution (exec / execSync)lib/index.js:546
' const out = CP.execFileSync(\'netstat\', [\'-ano\'], { encoding: \'utf8\' });\n' +
criticalShell command execution (exec / execSync)lib/index.js:552
' const out = CP.execFileSync(\'lsof\', [\'-ti\', \':\' + PORT], { encoding: \'utf8\' });\n' +
warningHTTP request to a raw IP addresslib/index.js:307
'const HEALTH_URL = \'http://127.0.0.1:\' + PORT + \'/health\';\n' +
warningHTTP request to a raw IP addresslib/index.js:324
'const ACTIVITY_URL = \'http://127.0.0.1:\' + PORT + \'/dsh-daemon/activity\';\n' +
warningHTTP request to a raw IP addresslib/index.js:807
' out=$(curl -s -X POST -H "Content-Type: application/json" -d "{\\"cmd\\":\\"$1\\"}" "http://127.0.0.1:${PORT}/dsh-daemon/command")\n' +
warningFilesystem write operationslib/index.js:339
' FS.appendFileSync(WATCHDOG_LOG, line);\n' +
warningFilesystem write operationslib/index.js:371
' if (child.pid) { try { FS.writeFileSync(WEB_PID, String(child.pid)); } catch (e) {} }\n' +
warningFilesystem write operationslib/index.js:403
' try { FS.writeFileSync(UPDATE_CHECK, JSON.stringify(state)); } catch (e) {}\n' +
warningDownloads a file from the networklib/index.js:1084
? 'curl.exe -s -o NUL -w "%{http_code}" --max-time 5 http://127.0.0.1:' + port + '/health'
warningDownloads a file from the networklib/index.js:1085
: "curl -s -o /dev/null -w '%{http_code}' --max-time 5 http://127.0.0.1:" + port + '/health');
warningDownloads a file from the networklib/index.js:1124
? 'curl.exe -s -o NUL -w "%{http_code}" --max-time 5 http://127.0.0.1:' + port + '/health'

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-18 · activity: Active

• Repo created: 2026-08-19

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/chenkai2/dsh-daemon