dsh-desktop

Cross-platform desktop client for DeepSeek Harness (dsh web), built with Tauri — the CLI's web UI in a native window, sharing the same session data.

PluginDesktopBrowserTerminalDataWeb searchTerminal / Shell

Verification

L2 · Structured

Security

High

Health

Active

Trust

Silver

What it does

Cross-platform desktop client for DeepSeek Harness (dsh web), built with Tauri — the CLI's web UI in a native window, sharing the same session data.

Installation

dsh plugin --profile web add dsh-desktop-24

Install method: npm · not yet tested in container (L3+)

Compatibility

DSH Version	Status
not stated	Declared — not tested

Requirements

• Node.js: not stated
• DSH: declared "not stated"
• External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN12 FILES

e8d278

Security reviewAutomated review · daily

HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

5 critical·7 warning·8 info·12 files scanned

code-exec ×4shell ×1

Version binding

plugin version0.1.0

scanned commite8d278f995032026-08-17

latest commite8d278f99503

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High5 critical · 7 warning · 8 info

• Static heuristic scan: done (12 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

Scan findings · 12

infoReads process.envscripts/boot-trace/esm-hook.mjs:9
const trace = process.env.DSH_BOOT_TRACE;
infoReads process.envscripts/boot-trace/preload.cjs:13
const trace = process.env.DSH_BOOT_TRACE;
criticalChild process module usage (Node.js)scripts/bundle-runtime.mjs:22
import { execFileSync, spawn } from 'node:child_process';
criticalShell command execution (exec / execSync)scripts/bundle-runtime.mjs:124
execFileSync(process.execPath, [npmCli(), 'install', '--omit=dev', '--no-audit', '--no-fund'], {
warningShell command execution (exec / execSync)scripts/bundle-runtime.mjs:247
execFileSync('taskkill', ['/T', '/F', '/PID', String(child.pid)], { stdio: 'ignore' });
infoReads process.envscripts/bundle-runtime.mjs:209
env: { ...process.env, DSH_HOME: join(home, 'home'), DSH_BOOT_TRACE: trace },
warningDownloads a file from the networkscripts/install-deps.sh:270
curl -fsSL --connect-timeout 30 -o "$out" "$url" &
warningDownloads a file from the networkscripts/install-deps.sh:272
wget -q -O "$out" "$url" &
infoMakes network requests (fetch / axios)scripts/install-deps.sh:260
fetch() {
criticalDynamic code execution via eval()src-tauri/src/controls.rs:128
let _ = window.eval(&format!(
warningHTTP request to a raw IP addresssrc-tauri/src/controls.rs:24
//! granting IPC to `http://127.0.0.1:*`, which is to say to every line of
infoHardcoded IP addresssrc-tauri/src/controls.rs:24
//! granting IPC to `http://127.0.0.1:*`, which is to say to every line of

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-17 · activity: Active

• Repo created: 2026-08-17

• Stars: ★ 5 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/MochiNek0/dsh-desktop