Repository navigation
dsh-plugin-security v0.4.6
Plugin security review for DeepSeek Harness, with dependency advisories, contextual evidence, AI-assisted review, and reversible enforcement.
Changes / 更新
- Fix settings RPC HTTP 404 and route lifecycle registration. / 修复设置页 RPC 404 及路由生命周期。
- Reduce false positives: capability matches are distinct from behavior evidence; remove A–F grading. / 分离能力记录与行为证据，降低误报，移除 A–F 评级。
- Restore disposition configuration and add searchable risk/whitelist tabs, per-plugin actions, exports, and compact statistics. / 恢复处置配置，完善搜索、风险与白名单 tab、逐项操作、导出及统计。
- Publish English and Chinese documentation, standard dsh bundle/client metadata, and shared protocol peer declarations. / 完善中英文文档与标准 dsh 包配置。
Install / 安装
dsh plugin --profile web add dsh-plugin-security@0.4.6Restart the host after upgrading. Requires the @deepseek-ai/dsh-typert-protocol@0.2.0-rc.2 host protocol. / 升级后重启宿主，协议依赖为 @deepseek-ai/dsh-typert-protocol@0.2.0-rc.2。
Scanning happens after plugins load. API matches are not malware verdicts, and automatic quarantine requires an unprotected target, enforcement mode, an enabled threshold, and a high-confidence malicious review. / 检查发生在插件加载后。API 匹配不等于恶意；自动隔离须满足非保护目标、强制处置模式、开启阈值及高置信度恶意审读结论。
Validation / 验证
91 tests passed locally and in GitHub Actions on Node.js 22 and 24. Verified isolated tarball imports, dsh profile installation, and the bundle configuration layer. / 本地及 Node.js 22、24 CI 均通过 91 项测试，并验证隔离安装、模块导入与 dsh 配置层。