{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"litestartup-com-dsh-api-gateway","slug":"litestartup-com-dsh-api-gateway","rank":791,"url":"https://github.com/litestartup-com/dsh-api-gateway","name":"litestartup-com/dsh-api-gateway","category":"remote","description":{"zh":"为第三方客户端提供 REST + SSE 网关：API 密钥鉴权、token 流式回包、会话工作区分组，并可接管 GUI 会话继续对话。","en":"REST + SSE gateway exposing running Harness sessions to third-party clients: API-key auth, token streaming, workspace grouping, and adopting GUI sessions to keep chatting."},"stars":3,"starsCheckedAt":"2026-08-21","repository":{"owner":"litestartup-com","repo":"dsh-api-gateway","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:litestartup-com/dsh-api-gateway","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/litestartup-com/dsh-api-gateway/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"litestartup-com-dsh-api-gateway","slug":"litestartup-com-dsh-api-gateway","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:28:40.435Z","scanStatus":"static-complete","verdict":"pass","score":100,"commit":"3b1213203d77c3fd1474fd3ef71cbea3372a02e8","commitDate":"2026-08-20T02:59:53+08:00","artifactDigest":"sha256:27dca0336d38b26c54e5ffc4138f364cdc4c2a30bc283ca6604ee40de4ba4fa7","downloadUrl":"https://github.com/litestartup-com/dsh-api-gateway/archive/3b1213203d77c3fd1474fd3ef71cbea3372a02e8.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:litestartup-com/dsh-api-gateway","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-api-gateway","packageVersion":"0.1.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web","inject":["@deepseek-ai/dsh-client-connection","@deepseek-ai/dsh-api-remotes","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-runtime"]},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-agent","@deepseek-ai/dsh-agent-loop","@deepseek-ai/dsh-api-remotes","@deepseek-ai/dsh-client-connection","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-host-webserver","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-session","@deepseek-ai/dsh-settings","@deepseek-ai/schemastery"]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-api-gateway","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-api-gw","name":"dsh-api-gateway","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","session","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"high","confidence":"low","layer":"static","path":"scripts/smoke.mjs","pathClass":"source","line":41,"evidence":"credential access at line 41 + outbound network at line 25","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"ff6fdfc89480bc77cc2a46db","review":{"verdict":"placeholder","reason":"开发者本地手动运行的烟雾测试脚本，key来自环境变量或本地/key接口自签发，仅请求用户配置的DSH_AGW_BASE（默认本地网关），不随插件运行时执行，无凭据外泄风险。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:30:37.444Z"}}],"counts":{"critical":0,"high":0,"medium":0,"low":0},"rawCounts":{"critical":0,"high":1,"medium":0,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":17,"bytesScanned":274590,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"test-example-docs":2,"markdown":2,"cordis":1,"source":8,"yaml":2,"manifest":1,"data":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:28:40.435Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:28:40.435Z","commit":"3b1213203d77c3fd1474fd3ef71cbea3372a02e8","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:30:37.444Z","commit":"3b1213203d77c3fd1474fd3ef71cbea3372a02e8","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:59:42.182Z","commit":"3b1213203d77c3fd1474fd3ef71cbea3372a02e8","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"3b1213203d77c3fd1474fd3ef71cbea3372a02e8","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:28:40.435Z"},{"kind":"verdict-change","from":"review","to":"pass","commit":"3b1213203d77c3fd1474fd3ef71cbea3372a02e8","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:30:37.444Z"},{"kind":"first-scan","from":null,"to":"review","commit":"3b1213203d77c3fd1474fd3ef71cbea3372a02e8","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:59:42.182Z"}]}