dsh.so
EN
English中文
dsh-ptc-plus avatar

dsh-ptc-plus

A session-bound agent-native REPL for DeepSeek Harness PTC mode.

PluginTerminalStorageTerminal / Shell
Verification
L2 · Structured
Security
Medium
Health
Active
Trust
Silver

What it doesAI

A session-bound agent-native REPL and transport recovery layer for DeepSeek Harness PTC mode, preserving direct Node.js/OS access.

  • Session-bound agent-native REPL
  • Transport recovery layer for PTC mode
  • Preserves direct Node.js and OS access

AI-generated from the repo README — for reference only.

Installation

dsh plugin --profile web add github:muyuanjin/dsh-ptc-plus

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SO AUDITMEDIUM49b72f
Security reviewAutomated review · daily
MEDIUM

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

3 critical·5 warning·5 info·13 files scanned
code-exec ×3
Version binding
plugin version0.1.0dsh manifest
scanned commit49b72f99c1b32026-08-20
latest commit49b72f99c1b3

The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Second-opinion scan (vet · parallel evaluation)
vet: clean

vet verdict: vet: clean · score 81

  • R10 · info [heuristic] — 依赖清单：4 项（@babel/code-frame, @deepseek-ai/schemastery, acorn, yaml，供 LLM 审计供应链；已知漏洞核对见后续 OSV 精确版本查询（网络失败静默降级））
  • R9 · info [heuristic] — 循环内 += 累加（字符串拼接可能 O(n²)）
  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.stdout
  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.stderr
  • R3 · info [certain] — 裸 process 引用（可能为 typeof 探测）

vet is advisory and does not change dsh’s four-tier level.

Risk: Medium3 critical · 5 warning · 5 info

• Static heuristic scan: done (13 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 8 / 8

  • criticalDynamic code execution via eval()internal/kernel-worker.js:251
    server.eval(program + CELL_FRAME_SUFFIX, context, 'ptc-plus-repl', finish)
  • criticalChild process module usage (Node.js)scripts/ab-headless-trajectories.mjs:1
    import { execFileSync, spawn } from 'node:child_process'
  • criticalChild process module usage (Node.js)scripts/expensive-headless-acceptance.mjs:1
    import { execFileSync, spawn } from 'node:child_process'
  • warningShell command execution (exec / execSync)scripts/ab-headless-trajectories.mjs:71
    return execFileSync('pwsh.exe', ['-NoLogo', '-NoProfile', '-Command', command], { encoding: 'utf8' }).trim()
  • warningShell command execution (exec / execSync)scripts/ab-headless-trajectories.mjs:215
    return execFileSync('zstd', ['-q', '-d', '-c', file], {
  • warningShell command execution (exec / execSync)scripts/ab-headless-trajectories.mjs:707
    dshVersion: execFileSync('pwsh.exe', ['-NoLogo', '-NoProfile', '-Command', 'dsh --version'], { encoding: 'utf8' }).trim(),
  • warningShell command execution (exec / execSync)scripts/expensive-headless-acceptance.mjs:99
    return execFileSync('pwsh.exe', ['-NoLogo', '-NoProfile', '-Command', command], { encoding: 'utf8' }).trim()
  • warningShell command execution (exec / execSync)scripts/expensive-headless-acceptance.mjs:172
    return execFileSync('zstd', ['-q', '-d', '-c', file], {

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-20 · activity: Active

• Repo created: 2026-08-20

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/muyuanjin/dsh-ptc-plus

Was this page helpful?