dsh-macos-desktop

dsh-macos-desktop 把 DSH 的 Web 界面变成一个 macOS 桌面：左侧桌面（多窗口/文件/回收站/便签/Spotlight/天气/深色模式）+ 右侧原生对话（主题化），内置终端、文档(Word/PDF/PPT)、浏览器、知识库、番茄钟、截图、AI 生图与「用 AI 看图」，通过官方 shell.overlay 挂载、卸载即恢复

PluginVisionBrowserTerminalDesktopWeb searchTerminal / ShellVision / OCR

Verification

L2 · Structured

Security

High

Health

Active

Trust

Silver

What it does

Installation

dsh plugin --profile web add dsh-macos-desktop

Install method: npm · not yet tested in container (L3+)

Compatibility

DSH Version	Status
not stated	Declared — not tested

Requirements

• Node.js: not stated
• DSH: declared "not stated"
• External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN6 FILES

c56f30

Security reviewAutomated review · daily

HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

3 critical·0 warning·15 info·6 files scanned

shell ×3

Version binding

scanned commitc56f308014b82026-08-17

latest commitc56f308014b8

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High3 critical · 0 warning · 15 info

• Static heuristic scan: done (6 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

Scan findings · 12

criticalShell command execution (exec / execSync)lib/client.js:1212
function exec(cmd) { document.execCommand(cmd, false, null); editorRef.current && editorRef.current.focus() }
criticalShell command execution (exec / execSync)lib/client.js:1269
createElement('button', { className: 'dsm-btn-primary', onMouseDown: function (e) { e.preventDefault(); exec('bold') }, title: '加粗' }, 'B'),
criticalShell command execution (exec / execSync)lib/client.js:1270
createElement('button', { className: 'dsm-btn-primary', onMouseDown: function (e) { e.preventDefault(); exec('italic') }, title: '斜体' }, 'I'
infoUses localStoragelib/client.js:462
var raw = localStorage.getItem(SETTINGS_KEY)
infoUses localStoragelib/client.js:467
function saveSettings(s) { try { localStorage.setItem(SETTINGS_KEY, JSON.stringify(s)) } catch {} }
infoUses localStoragelib/client.js:1160
function loadBookmarks() { try { var b = JSON.parse(localStorage.getItem('dsh-macos-desktop/bookmarks')); return Array.isArray(b) ? b : DEFA
infoMakes network requests (fetch / axios)lib/client.js:426
return fetch('/dsh-macos-desktop' + path, init)
infoMakes network requests (fetch / axios)lib/client.js:784
fetch(geoUrl).then(function (r) { return r.json() }).then(function (g) {
infoMakes network requests (fetch / axios)lib/client.js:789
return fetch(fUrl).then(function (r) { return r.json() }).then(function (d) {
infowindow.open() navigationlib/client.js:1180
function externalOpen(url) { var u = url || (t && t.url) || ''; if (!u) return; if (window.confirm('在系统浏览器打开：' + u + ' ？')) window.open(u, '
infowindow.open() navigationlib/client.js:1288
createElement('button', { className: 'dsm-btn-primary', onClick: function () { window.open(fileUrl(path), '_blank') } }, '在新窗口打开'),
infowindow.open() navigationlib/client.js:1457
createElement('button', { className: 'dsm-btn-primary default', onClick: function () { window.open(fileUrl(props.path), '_blank') } }, '下载 /

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-16 · activity: Active

• Repo created: 2026-08-17

• Stars: ★ 4 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/Taylor-Cat/dsh-macos-desktop