Install verification: runtime verified (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →
What it doesAI
A DSH host plugin that opens the DeepSeek Harness Web UI in its own standalone desktop window using Chromium --app mode.
- Turns the DSH Web UI into a standalone desktop app window
- Uses Chromium --app mode for a chrome-less app window
- Installs as a DSH host plugin
Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.
Installation
dsh plugin --profile web add github:MARIOMLY/dsh-desktop-appInstall method: GitHub · runtime verified (L5)
Verification & Compatibility
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
○ The author declares no dsh version requirement — install is not blocked by version.
| plugin ＼ dsh | dsh 0.2.1-rc.2 current | dsh 0.2.1-alpha.4 | dsh 0.2.1-alpha.2 |
|---|---|---|---|
| e5a520 | ✓ | ✓ | ✓ |
e5a520github✓ 3 runtime-verified2026-10-18
https://github.com/MARIOMLY/dsh-desktop-app
✓dsh 0.2.1-rc.2current2026-10-18L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: github · https://github.com/MARIOMLY/dsh-desktop-app (version unstated)
ID: dsh-desktop-app-4@e5a520@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-18 · expires: 2026-10-25
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.2.1-alpha.42026-10-16L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: github · https://github.com/MARIOMLY/dsh-desktop-app (version unstated)
ID: dsh-desktop-app-4@e5a520@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-16 · expires: 2026-10-23
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.2.1-alpha.22026-10-14L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.2
- • Plugin artifact: github · https://github.com/MARIOMLY/dsh-desktop-app (version unstated)
ID: dsh-desktop-app-4@e5a520@dsh0.2.1-alpha.2 · profile: l4-sandbox
Issued: 2026-10-14 · expires: 2026-10-21
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-desktop-app-4/)``[](https://www.dsh.so/artifact/dsh-desktop-app-4/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low, dynamic high — stricter wins → overall high.
v0.2.7dsh manifest0.2.7git2026-10-210.2.7same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (9)
- warningchildProcess · code-exec
lib/desktop.js:1028const launch = spawnSync( - warningchildProcess · code-exec
lib/desktop.js:1088const child = spawn(browser.browser.path, [`--app=${url}`], { detached: true, stdio: 'ignore' }) - warningshellExec · shell
lib/desktop.js:603const out = execFileSync( - warningshellExec · shell
lib/desktop.js:837const listing = execFileSync( - warningshellExec · shell
lib/desktop.js:852execFileSync('taskkill', ['/PID', String(pid), '/F'], { stdio: 'ignore' }) - warningnetIp · network
lib/desktop.js:691baseUrl: ctx?.baseUrl ?? `http://127.0.0.1:${port}/`, - warningnetIp · network
lib/desktop.js:727`${browser.browser.path} --app=http://127.0.0.1:${port}/`, - warningnetIp · network
lib/desktop.js:1087const url = ctx?.authenticatedUrl ?? ctx?.baseUrl ?? `http://127.0.0.1:${port}/` - warningnetIp · network
lib/index.js:51const baseUrl = `http://127.0.0.1:${port}/`
show 5 audit findings
- high`browser` tool argument accepts any existing executable and is spawned / persisted unvalidated
lib/desktop.js:1099resolveBrowser() (lib/desktop.js:135-138) returns the raw caller-supplied path as `{ id: 'custom', ... path: explicit }` whenever it contains a separator and existsSync() is true; there is no extension, signature or allow-list check. lib/index.js:71 forwards args.browser straight through. actionOpen then spawns that binary, and install/restart bake the same path into the launcher as `$browser = '<path>'` followed by `Start-Process -FilePath $browser -ArgumentList ('--app=' + $url)`, so a tool call such as desktop_app({action:'open'|'install', browser:'C:\\Users\\x\\AppData\\Local\\Temp\\evil.e
- medium`shortcutName` path traversal leads to arbitrary file deletion / .lnk overwrite
lib/desktop.js:910shortcutPath() (lib/desktop.js:181-183) is `join(resolveDesktopDir(), name)` with no sanitisation, so shortcutName='..\\..\\Documents\\important.docx' escapes the Desktop. actionRemove deletes whatever path results (`rmSync(shortcut, { force: true })`, force-silent, run when the file exists), and actionInstall passes the same path to createWindowsShortcut(), which overwrites an existing .lnk at that location. A prompt-injected agent call such as desktop_app({action:'remove', shortcutName:'../.../file'}) therefore deletes or replaces arbitrary files writable by the DSH user.
- lowDSH auth token stored in a plaintext file and exposed on the browser command line
lib/desktop.js:422The tokenised boot URL (which mints the auth cookie) is read out of server.log and written to ~/.dsh/desktop-app/tray-url.txt, and the same URL is passed as an argument on lines 427/1099 (`Start-Process -FilePath $browser -ArgumentList ('--app=' + $url)`, `spawn(..., [`--app=${url}`])`), where it is visible in process listings / WMI to any process running as the same user.
- lowExecutable tray-host assets are copied and started but absent from the audited source
lib/desktop.js:805installTrayHostFiles() copies tray-host.ps1/.cs/.cmd (and option.ico) from the package directory into ~/.dsh/desktop-app and launch.ps1 later runs tray-host.cmd hidden on every launch; those files are declared in package.json `files` but were not part of the harvested source, so their content (arbitrary PowerShell/C#) could not be reviewed and no static signal covers them.
- lowProcesses are force-killed by port ownership and by command-line pattern match
lib/desktop.js:856stopTrayHost() kills every powershell.exe whose command line merely contains 'tray-host', and the generated launcher/restart helper run Stop-Process -Force on whatever owns the configured port (lib/desktop.js:376, 519). If an unrelated process matches the pattern or holds that port, it is terminated without confirmation.
Tool args are unvalidated: `browser` may be any existing executable (spawned and persisted into the generated launcher) and `shortcutName` allows path traversal into rmSync/shortcut creation.
Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-09-14 · activity: Stable
• Repo created: 2026-09-12
• Stars: ★ 0 · Forks: 0
• Health: Stable — committed within 90 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).