Install verification: runtime verified (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →
What it doesAI
Linux native desktop integration for DeepSeek Harness: XDG desktop entry, borderless standalone window, and auto service shutdown on close.
- Adds an XDG desktop entry so the app launches like a native Linux program
- Runs DeepSeek Harness in a borderless standalone window
- Automatically stops the background service when the window is closed
Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.
Installation
dsh plugin --profile web add dsh-linux-integrationInstall method: npm · runtime verified (L5)
Verification & Compatibility
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
○ The author declares no dsh version requirement — install is not blocked by version.
| plugin ＼ dsh | dsh 0.2.1-rc.2 current | dsh 0.2.1-alpha.4 | dsh 0.2.1-alpha.2 |
|---|---|---|---|
| 0.7.0 | ✓ | ✓ | ✓ |
| v0.7.0 | · | · | · |
0.7.0npm✓ 3 runtime-verified2026-10-20
dsh-linux-integration
✓dsh 0.2.1-rc.2current2026-10-20L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: npm · dsh-linux-integration@0.7.0
ID: dsh-linux-integration@0.7.0@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-20 · expires: 2026-10-27
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.2.1-alpha.42026-10-18L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: npm · dsh-linux-integration@0.7.0
ID: dsh-linux-integration@0.7.0@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-18 · expires: 2026-10-25
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.2.1-alpha.22026-10-15L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.2
- • Plugin artifact: npm · dsh-linux-integration@0.7.0
ID: dsh-linux-integration@0.7.0@dsh0.2.1-alpha.2 · profile: l3-fullscan
Issued: 2026-10-15 · expires: 2026-10-22
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
v0.7.0github2026-10-14
https://github.com/ffyfox/dsh-linux-integration
No runtime install test for this version (static scan only) — compatibility unknown, never assumed.
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-linux-integration/)``[](https://www.dsh.so/artifact/dsh-linux-integration/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low, dynamic low — stricter wins → overall low.
v0.7.0dsh manifest0.7.0npm2026-10-210.7.0same versionclean · npmVet is an AST static scan (npm artifact or git source).
show static findings (12)
- criticalshellExec · shell
src/gnome.js:216const out = exec('gdctl', ['show'], { encoding: 'utf8', timeout: 5000, env }) - criticalshellExec · shell
src/gnome.js:234const out = exec('gsettings', ['get', MUTTER_SCHEMA, AUTO_MAXIMIZE_KEY], { - criticalshellExec · shell
src/hyprland.js:96const out = exec('Hyprland', ['--version-json'], { encoding: 'utf8', timeout: 5000, env }) - criticalshellExec · shell
src/hyprland.js:264const out = exec('Hyprland', ['--verify-config', '-c', file], { encoding: 'utf8', timeout: 15000, env }) - criticalshellExec · shell
src/hyprland.js:300exec('hyprctl', ['reload'], { stdio: 'ignore', timeout: 5000, env }) - warningchildProcess · code-exec
src/cli.js:448const child = spawn(paths.launcherFile, [], { detached: true, stdio: 'ignore' }) - warningfsWrite · files
src/config.js:261fs.writeFileSync(tmp, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 }) - warningfsWrite · files
src/hyprland.js:204fs.writeFileSync(file, updated, { mode: 0o600 }) - warningfsWrite · files
src/hyprland.js:233fs.writeFileSync(file, updated, { mode: 0o600 }) - warningfsWrite · files
src/hyprland.js:263fs.writeFileSync(file, `${block}\n`) - warningshellExec · shell
src/kwin.js:250execFileSync(cmd, args, { stdio: 'ignore', timeout: 5000 }) - warningfsWrite · files
src/kwin.js:181fs.writeFileSync(file, updated, { mode: 0o600 })
show 2 audit findings
- lowRuntime dir falls back to a predictable /tmp path when XDG_RUNTIME_DIR is unset
src/paths.js:128When XDG_RUNTIME_DIR is absent (non-systemd or unusual login), the token-bearing runtime.env / runtime.json and the log file live under a name an local attacker can predict and pre-create. mkdirSync(recursive:true, mode:0o700) does not fix the mode of a pre-existing directory, so the attacker would own the parent directory and could delete/replace the files (e.g. point the launcher at a different URL) or plant a symlink where runtime.env.tmp-<pid> is about to be written. Normal systemd sessions (XDG_RUNTIME_DIR=/run/user/<uid>) are unaffected.
- lowZombie-process check in isProcessAlive is unreachable dead code
src/runtime.js:144Both branches of the try/catch return, so the /proc/<pid>/stat state==='Z' check is never executed, contradicting the documented intent. A zombie dsh process is therefore reported as alive: `dsh-lxi stop` waits 10 s + 3 s and then reports '进程在 SIGKILL 之后仍然存在', and inspectRuntime can treat a stale runtime record as fresh. Robustness/UX issue only — no privilege or data-exposure impact.
Refuted the heuristic warn: every subprocess, file and socket use is fixed-command and confined to user-owned paths; only two low-severity robustness issues.
Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-10-05 · activity: Active
• Repo created: 2026-09-20
• Stars: ★ 1 · Forks: 0
• Health: Active — committed within last 30 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).