{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"amlyczz-dsh-agy-link","slug":"amlyczz-dsh-agy-link","rank":369,"url":"https://github.com/amlyczz/dsh-agy-link","name":"amlyczz/dsh-agy-link","category":"model","description":{"zh":"将 Google Antigravity (agy CLI) 接入 DSH：无 API Key 使用 Gemini/Claude/GPT-OSS 订阅模型，支持流式对话、原生工具卡片、思考轮次注记及 Web 界面 Google OAuth 扫码登录。","en":"Google Antigravity (agy CLI) models for DSH — streaming chat with Gemini/Claude/GPT-OSS subscriptions, native tool cards, thinking turns, and in-GUI Google OAuth login."},"stars":7,"starsCheckedAt":"2026-08-21","repository":{"owner":"amlyczz","repo":"dsh-agy-link","requestedRef":null,"subpath":""},"npm":"dsh-agy-link","downloads":2602,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-agy-link","tarball":null,"added":"2026-08-20","page":"https://awesome-dsh-plugin.com/p/amlyczz/dsh-agy-link/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"amlyczz-dsh-agy-link","slug":"amlyczz-dsh-agy-link","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:24:14.119Z","scanStatus":"static-complete","verdict":"review","score":78,"commit":"a405b1c85b0e92c98fa26f73711c4a08d567eea4","commitDate":"2026-08-21T19:23:22+08:00","artifactDigest":"sha256:ee1fbd37ff3b2870a37f6d265e069896093b1ac8b031609da4afb93a392e5c72","downloadUrl":"https://github.com/amlyczz/dsh-agy-link/archive/a405b1c85b0e92c98fa26f73711c4a08d567eea4.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-agy-link","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-agy-link","packageVersion":"0.4.13","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["slots"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-commands","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-tools"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-agy-link","manifestName":"dsh-agy-link","nameMatch":true,"npm":{"name":"dsh-agy-link","latestVersion":"0.4.13","publishedAt":"2026-08-21T10:45:05.720Z","createdAt":"2026-08-19T04:55:08.400Z","versionCount":26,"maintainers":1,"repository":"git+ssh://git@github.com/amlyczz/dsh-agy-link.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"agy-link","name":"dsh-agy-link","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":6,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","subprocess","telemetry"],"outboundHosts":[{"host":"www.googleapis.com","count":7},{"host":"antigravity.google","count":3},{"host":"accounts.google.com","count":1},{"host":"oauth2.googleapis.com","count":1},{"host":"daily-cloudcode-pa.googleapis.com","count":1},{"host":"cloudcode-pa.googleapis.com","count":1},{"host":"daily-cloudcode-pa.sandbox.googleapis.com","count":1},{"host":"autopush-cloudcode-pa.sandbox.googleapis.com","count":1}],"findings":[{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"cordis.patch.yml","pathClass":"cordis","line":8,"evidence":"!!js \"process.env.DSH_AGY_ENABLED ?? 'true'\"","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"51ff12a0f05f4e59877d7294"},{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"cordis.patch.yml","pathClass":"cordis","line":9,"evidence":"!!js \"process.env.DSH_AGY_BIN ?? ''\"","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"41ca807053126fe32ab1ab17"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/host/oauth.ts","pathClass":"source","line":20,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"90aeef246c0bb14bb2874319"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/host/quota.ts","pathClass":"source","line":11,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"fbdda47f299abbd0089539a2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/host/quota.ts","pathClass":"source","line":11,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7d0d9c9aa554aaec3c4b1c24"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/host/runner.ts","pathClass":"source","line":5,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"af337059116f9fd11bdc6392"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/index.ts","pathClass":"source","line":7,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"165497e2a6660ef29786eb22"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/cross-platform.test.ts","pathClass":"test-example-docs","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"dc7c4c28c44f939ef365ac58"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/v02.test.ts","pathClass":"test-example-docs","line":6,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"6df9fa2ce6c822749efc4ac8"},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"pnpm-lock.yaml","pathClass":"manifest","line":1,"evidence":"ansi-regex@5.0.0 GHSA-93q8-gq69-wqmw (CVE-2021-3807) fixed in 6.0.1","remediation":"升级 ansi-regex 至 6.0.1 或更高版本。","layer":"vulnerability","hash":"863fd337e1f7ce67d14f7941","review":{"verdict":"unclear","reason":"pnpm-lock.yaml中根导入器的dependencies仅声明dsh-agency-agents与dsh-skills-manager两个运行时依赖，ansi-regex@5.0.0应为vite/tsx/jsdom等devDependencies链路的深层传递依赖，是否被打包进dist尚无法从当前片段确认，需查看完整lockfile及tsdown产物确认其是否影响运行时。","model":"sonnet","reviewedAt":"2026-08-21T10:49:49.641Z"}}],"counts":{"critical":0,"high":1,"medium":2,"low":5},"rawCounts":{"critical":0,"high":1,"medium":2,"low":7},"vulnerabilities":[{"id":"GHSA-93q8-gq69-wqmw","aliases":["CVE-2021-3807"],"package":"ansi-regex","version":"5.0.0","severity":"high","fixed":"6.0.1","summary":"Inefficient Regular Expression Complexity in chalk/ansi-regex"}],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":64,"bytesScanned":654703,"truncated":false,"lockfiles":["pnpm-lock.yaml","package-lock.json"],"pathClasses":{"test-example-docs":20,"markdown":10,"cordis":1,"data":2,"manifest":1,"yaml":1,"source":29}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:24:14.119Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:24:14.119Z","commit":"a405b1c85b0e92c98fa26f73711c4a08d567eea4","policyVersion":"HT-DSH-0.2.2","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:27:28.507Z","commit":"a405b1c85b0e92c98fa26f73711c4a08d567eea4","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T10:56:28.306Z","commit":"c6d9276b7a40f5cf87576992880e32c32926a75c","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"a405b1c85b0e92c98fa26f73711c4a08d567eea4","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:24:14.119Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"a405b1c85b0e92c98fa26f73711c4a08d567eea4","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:27:28.507Z"},{"kind":"first-scan","from":null,"to":"review","commit":"c6d9276b7a40f5cf87576992880e32c32926a75c","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:56:28.306Z"}]}