What it doesAI
Dsh host auto-update plugin: checks core updates, one-click silent update & restart, plus plugin compatibility diagnostics.
- Detects @deepseek-ai/dsh host updates across stable/beta/dev channels
- One-click silent npm update and restart, with major-version confirmation
- Profile plugin compatibility diagnostic with errors/warnings and fix hints
AI-generated from the repo README — for reference only.
Installation
dsh plugin --profile web add dsh-host-updateInstall method: npm · not yet tested in container (L3+)
Compatibility
| DSH Version | Status |
|---|---|
| not stated | Declared — not tested |
Requirements
- • Node.js: not stated
- • DSH: declared "not stated"
- • External credentials: none detected
Security Report
Automated static scan, not manual review.
Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.
shell ×3code-exec ×10.1.7dsh manifest1c797e4bf2b02026-08-201c797e4bf2b0The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.
Disclaimer: automated static analysis, not a security guarantee. Always review what you install.
vet verdict: vet: clean · score 87
vet is advisory and does not change dsh’s four-tier level.
• Static heuristic scan: done (5 files)
• Dependency vulnerabilities: requires deep audit (L3+)
• Permission sandboxing: requires runtime testing (L4+)
High-risk findings · 5 / 5
- criticalChild process module usage (Node.js)lib/index.js:5import { exec as execCb, execSync } from "node:child_process";
- criticalShell command execution (exec / execSync)lib/index.js:62const { stdout } = await exec(`npm view ${pkg} dist-tags --json`, { timeout: 10_000 });
- criticalShell command execution (exec / execSync)lib/index.js:122const { stdout } = execSync ? execSync(`npm ${arg} -g`, { encoding: "utf8", timeout: 5000 }) : { stdout: "" };
- criticalShell command execution (exec / execSync)lib/index.js:358const { stdout, stderr } = await exec(`npm i -g @deepseek-ai/dsh@${latest}`, { timeout: 120_000 });
- warningFilesystem write operationslib/index.js:46fs.writeFileSync(path, JSON.stringify(next, null, 2));
Heuristic static scan — may produce false positives. Review the source yourself before trusting.
Activity
Last commit 2026-08-20 · activity: Active
• Repo created: 2026-08-20
• Stars: ★ 0 · Forks: 0
• Health: Active — committed within last 30 days