{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"lninghaha-dsh-coding-subscription-oauth","slug":"lninghaha-dsh-coding-subscription-oauth","rank":374,"url":"https://github.com/lninghaha/dsh-coding-subscription-oauth","name":"lninghaha/dsh-coding-subscription-oauth","category":"model","description":{"zh":"编码订阅 OAuth，支持 SuperGrok / Grok Build、ChatGPT Plus Codex、Kimi Code、Claude Code，并提供可选 loopback OpenAI/Anthropic 网关：本地登录无需粘贴 token，支持 AUTH 刷新重试、grok-4.6 xhigh，并可与 API-key 路由共存。","en":"Coding-subscription OAuth for SuperGrok/Grok Build, ChatGPT Plus Codex, Kimi Code and Claude Code, plus an opt-in loopback OpenAI/Anthropic gateway: local login without pasting tokens, AUTH refresh-and-retry, grok-4.6 xhigh, and API-key route coexistence."},"stars":7,"starsCheckedAt":"2026-08-21","repository":{"owner":"lninghaha","repo":"dsh-coding-subscription-oauth","requestedRef":null,"subpath":""},"npm":"dsh-coding-subscription-oauth","downloads":1300,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-coding-subscription-oauth","tarball":null,"added":"2026-08-18","page":"https://awesome-dsh-plugin.com/p/lninghaha/dsh-coding-subscription-oauth/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"lninghaha-dsh-coding-subscription-oauth","slug":"lninghaha-dsh-coding-subscription-oauth","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:24:18.793Z","scanStatus":"static-complete","verdict":"caution","score":84,"commit":"df2590a7d3b74e0e17e9dc6a4e78333d8f204f94","commitDate":"2026-08-22T02:20:34Z","artifactDigest":"sha256:1b288fd11ea5b4a4c8ecbe94cb265e57cdbbc5e359499cba4441664716c8d29b","downloadUrl":"https://github.com/lninghaha/dsh-coding-subscription-oauth/archive/df2590a7d3b74e0e17e9dc6a4e78333d8f204f94.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-coding-subscription-oauth","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-coding-subscription-oauth","packageVersion":"0.5.8","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-locale"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-atomic-write","@deepseek-ai/dsh-attachment","@deepseek-ai/dsh-credentials","@deepseek-ai/dsh-home-paths","@deepseek-ai/dsh-host-webserver","@deepseek-ai/dsh-invariants","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-llm-pi-ai","@deepseek-ai/dsh-tools","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-coding-subscription-oauth","manifestName":"dsh-coding-subscription-oauth","nameMatch":true,"npm":{"name":"dsh-coding-subscription-oauth","latestVersion":"0.5.6","publishedAt":"2026-08-19T15:04:53.732Z","createdAt":"2026-08-17T15:22:39.518Z","versionCount":7,"maintainers":1,"repository":"git+https://github.com/lninghaha/dsh-coding-subscription-oauth.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"llm-grok-build-oauth","name":"dsh-coding-subscription-oauth","path":"cordis.patch.yml","disabled":false}],"overrides":[{"id":"agent-default-model","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":false,"name":null,"keys":["provider","model"],"path":"cordis.patch.yml"}],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","subprocess","telemetry"],"outboundHosts":[{"host":"chatgpt.com","count":12},{"host":"api.x.ai","count":6},{"host":"auth.x.ai","count":3},{"host":"cli-chat-proxy.grok.com","count":3},{"host":"api.openai.com","count":2},{"host":"preview.invalid","count":1},{"host":"gateway.invalid","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"docker/preview-entrypoint.mjs","pathClass":"source","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d54de33872aeab818c3c3546"},{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"medium","confidence":"high","layer":"static","path":"docker/preview-proxy.mjs","pathClass":"source","line":22,"evidence":"Buffer.from(left); const rightBuffer = Buffer.from(right); return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer); } function cookieVal","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行","hash":"7f91b68624d2dfda86a0d93a","review":{"verdict":"functional","reason":"equalSecret仅用Buffer.from构造缓冲区后配合timingSafeEqual做恒定时间字符串比较，用于校验preview_token/cookie，无解码后执行行为，规则误判","model":"sonnet@p2","reviewedAt":"2026-08-21T11:25:43.681Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/release.mjs","pathClass":"source","line":8,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"da255add70b9c2fff16c114d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/release.mjs","pathClass":"source","line":8,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f735a4f41f7179ccfa16f964"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/bin.ts","pathClass":"source","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"e5f57a936879f043deca7e6d"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"docker/preview-entrypoint.mjs","pathClass":"source","line":100,"evidence":"credential access at line 100 + outbound network at line 144","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"506bef9cbcb65703e0a453e5","review":{"verdict":"functional","reason":"第100行读取的是本地生成的DSH_PREVIEW_TOKEN（预览代理专用一次性令牌，写入0o600文件），非OAuth凭据外发，属preview server本地鉴权功能所需","model":"sonnet@p2","reviewedAt":"2026-08-21T11:25:43.681Z"}},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"high","path":"cordis.patch.yml","line":4,"evidence":"override: id=agent-default-model config[provider,model]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"改写配置 agent-default-model","layer":"dsh-semantics","pathClass":"cordis","hash":"c8355784005241a6b34ff1e2"}],"counts":{"critical":0,"high":0,"medium":3,"low":4},"rawCounts":{"critical":0,"high":0,"medium":3,"low":4},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":201,"bytesScanned":1842651,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"test-example-docs":41,"markdown":16,"data":7,"cordis":1,"source":132,"script":1,"manifest":1,"yaml":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:24:18.793Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:24:18.793Z","commit":"df2590a7d3b74e0e17e9dc6a4e78333d8f204f94","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T13:16:54.411Z","commit":"c50ebda48b553a7d01603350ba34c46e51a698fc","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:25:43.680Z","commit":"c50ebda48b553a7d01603350ba34c46e51a698fc","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:54:21.690Z","commit":"c50ebda48b553a7d01603350ba34c46e51a698fc","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"commit-change","from":"c50ebda48b553a7d01603350ba34c46e51a698fc","to":"df2590a7d3b74e0e17e9dc6a4e78333d8f204f94","commit":"df2590a7d3b74e0e17e9dc6a4e78333d8f204f94","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:24:18.793Z"},{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"c50ebda48b553a7d01603350ba34c46e51a698fc","policyVersion":"HT-DSH-0.2.2","at":"2026-08-21T13:16:54.411Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"c50ebda48b553a7d01603350ba34c46e51a698fc","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:25:43.680Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"c50ebda48b553a7d01603350ba34c46e51a698fc","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:54:21.690Z"}]}