A DSH plugin that turns the browser PWA shortcut you already have on your desktop into a real launcher: double-click starts dsh web silently and opens the app window, keeping the original icon. Adds restart and dsh self-update (with rollback) controls to the web UI. Windows only, MIT.
Install verification: runtime verified (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →
What it doesAI
Windows-only DSH plugin that turns your desktop PWA shortcut into a real launcher, silently starting dsh web and adding restart/self-update controls.
- Turns the existing PWA desktop shortcut into a real launcher, keeping the original icon
- Double-click silently starts dsh web and opens the app window
- Adds restart and dsh self-update (with rollback) controls to the web UI
Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.
Installation
dsh plugin --profile web add github:liudapeng0311/dsh-pwa-launcher#v1.11.0Install method: GitHub · runtime verified (L5)
Verification & Compatibility
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
○ The author declares no dsh version requirement — install is not blocked by version.
| plugin ＼ dsh | dsh 0.2.1-rc.2 current | dsh 0.2.1-alpha.4 | dsh 0.2.1-alpha.2 |
|---|---|---|---|
| v1.11.0 | ✓ | ✓ | ✓ |
v1.11.0github✓ 3 runtime-verified2026-10-19
https://github.com/liudapeng0311/dsh-pwa-launcher
✓dsh 0.2.1-rc.2current2026-10-19L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: github · https://github.com/liudapeng0311/dsh-pwa-launcher#v1.11.0
ID: dsh-pwa-launcher@v1.11.0@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-19 · expires: 2026-10-26
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.2.1-alpha.42026-10-16L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: github · https://github.com/liudapeng0311/dsh-pwa-launcher#v1.11.0
ID: dsh-pwa-launcher@v1.11.0@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-16 · expires: 2026-10-23
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.2.1-alpha.22026-10-14L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.2
- • Plugin artifact: github · https://github.com/liudapeng0311/dsh-pwa-launcher#v1.11.0
ID: dsh-pwa-launcher@v1.11.0@dsh0.2.1-alpha.2 · profile: l4-sandbox
Issued: 2026-10-14 · expires: 2026-10-21
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-pwa-launcher/)``[](https://www.dsh.so/artifact/dsh-pwa-launcher/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low, dynamic high — stricter wins → overall high.
v1.11.0dsh manifestv1.11.0git2026-10-21v1.11.0same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (5)
- warningchildProcess · code-exec
lib/index.js:175const child = spawn( - warningchildProcess · code-exec
lib/index.js:290const child = spawn('wscript.exe', ['//B', vbs], { - warningchildProcess · code-exec
lib/index.js:397const child = spawn('wscript.exe', ['//B', vbs, version], { - warningnetIp · network
lib/index.js:232const url = ctx.connection.authenticatedUrl(`http://127.0.0.1:${port}`) - warningnetIp · network
lib/index.js:319authUrl = ctx.connection.authenticatedUrl(`http://127.0.0.1:${port}`)
show 4 audit findings
- highUnauthenticated restart-status route returns the launch token; loopback gate is a no-op on 127.0.0.1 binds
lib/index.js:318Unlike /pwa-launcher/restart and /pwa-launcher/update-apply, this handler never calls ctx.connection.authorizeIndex; the only gate is a remoteAddress string check. Because the code documents that custom routes are matched before the framework's auth, any client that can open a TCP connection to the loopback port receives authUrl, which the plugin itself describes as a launch token that exchanges for a 30-day signed session cookie. On the default 127.0.0.1-only bind every caller satisfies isLoopback, so another local user or any local process on a shared machine can hijack the harness session (
- mediumLauncher PowerShell/VBS assets are executed with -ExecutionPolicy Bypass but are absent from the reviewed source
lib/index.js:178Every Windows start copies the package's assets/ tree into %LOCALAPPDATA%\DeepSeekHarness (overwriting whatever is there) and then executes scripts/shortcut.ps1 with execution policy bypassed; the web routes likewise run restart.vbs / update.vbs from that directory. Those .ps1/.vbs files are shipped by package.json ("files" includes "assets") but were not provided for review, so the behaviour actually executed with the user's full privileges at startup and on a button click cannot be verified here. The auto-recopy means whatever those files contain is refreshed from the package on each launch.
- lowupdate-check POST and update-dismiss bypass authorizeIndex and mutate server state unauthenticated
lib/index.js:353These routes are registered in the same pre-authorizeIndex namespace as restart-status but contain no auth check: any loopback client can rewrite the persisted update-dismiss.json ignore list, and can repeatedly trigger the POST /pwa-launcher/update-check path, which forces outbound HTTPS requests to the registry (with retries). Impact is limited to suppression/forcing of update notices and minor request amplification, but it shows the route namespace has no consistent auth model.
- lowLaunch token (30-day session credential) persisted in cleartext launcher.json
lib/index.js:486The authenticated URL containing the launch token is written to %LOCALAPPDATA%\DeepSeekHarness\launcher.json on every start (plaintext, no expiry handling), so the credential survives restarts and is readable by any process running as the same user (other DSH plugins, npm lifecycle scripts, backups). It is only mitigated by Windows profile ACLs, not by the plugin.
Unauthenticated /pwa-launcher/restart-status hands the launch token to any loopback client, and unreviewed PowerShell launcher assets run with ExecutionPolicy Bypass.
Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-09-23 · activity: Active
• Repo created: 2026-09-17
• Stars: ★ 0 · Forks: 0
• Health: Active — committed within last 30 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).