{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"loadingvx-deepseek-harness-workbench-plugin","slug":"loadingvx-deepseek-harness-workbench-plugin","rank":150,"url":"https://github.com/loadingvx/deepseek-harness-workbench-plugin","name":"loadingvx/deepseek-harness-workbench-plugin","category":"ui","description":{"zh":"为 Web UI 补齐缺失的 IDE 工作台：对话页可拖拽三栏（对话 / 编辑器 / 文件与 Git），多标签编辑（保存、新建、路径面包屑、行内 diff）、工作区 Terminal、文件树（按名筛选、用外部编辑器打开）、源代码管理（暂存/提交/推送/拉取、分支切换、提交图）、状态栏，以及 git_* 模型工具。","en":"Fills in the Web UI's missing IDE workbench: resizable chat / editor / files-and-Git columns in Conversation, multi-tab file editing with save and new-file, workspace Terminal, a file tree with name filter and open-in-external-editor, SCM (stage/commit/push/pull, branch switch, Git graph, inline diffs), a status bar, and git_* model tools."},"stars":26,"starsCheckedAt":"2026-08-21","repository":{"owner":"loadingvx","repo":"deepseek-harness-workbench-plugin","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:loadingvx/deepseek-harness-workbench-plugin","tarball":null,"added":"2026-08-15","page":"https://awesome-dsh-plugin.com/p/loadingvx/deepseek-harness-workbench-plugin/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"loadingvx-deepseek-harness-workbench-plugin","slug":"loadingvx-deepseek-harness-workbench-plugin","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:21:33.296Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"2398bd158a78b6ffbdbd1ca55ce2a74acda2b78a","commitDate":"2026-08-21T22:18:38+08:00","artifactDigest":"sha256:ec237194b269f967a396710e5d527800a51d63dfec68a877cff15c6f3f68a280","downloadUrl":"https://github.com/loadingvx/deepseek-harness-workbench-plugin/archive/2398bd158a78b6ffbdbd1ca55ce2a74acda2b78a.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:loadingvx/deepseek-harness-workbench-plugin","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-workbench-plugin","packageVersion":"0.1.27","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web","inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-tool","@deepseek-ai/dsh-client-ui-conversation","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-ui-input-trigger"]},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-tools"]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-workbench-plugin","nameMatch":null,"npm":{"name":"dsh-workbench-plugin","latestVersion":"0.1.26","publishedAt":"2026-08-21T02:27:02.270Z","createdAt":"2026-08-15T08:48:14.982Z","versionCount":27,"maintainers":1,"repository":null,"hasInstallScripts":false,"deprecated":false},"repositoryMatch":"missing","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"workbench","name":"dsh-workbench-plugin","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","session","subprocess"],"outboundHosts":[{"host":"api.deepseek.com","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"89dedaa9e6429e9e52b8af60"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":4643,"evidence":"credential access at line 4643 + outbound network at line 1927","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"350bc62a312ac1f200982be0","review":{"verdict":"functional","reason":"resolveApiKey按用户设置的apiKeyEnv经ctx.credentials.resolve取密钥，仅用于连接connectionFor返回的用户配置baseURL(DeepSeek/兼容provider)，属于模型工具调用LLM API的必要凭据获取逻辑。","model":"sonnet","reviewedAt":"2026-08-22T08:21:33.296Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":1},"rawCounts":{"critical":0,"high":0,"medium":1,"low":1},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":11,"bytesScanned":391671,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":8,"cordis":1,"source":1,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:21:33.296Z","summary":"该插件为DSH Web UI提供IDE式工作台（三栏布局、编辑器、终端、Git面板）及git_*模型工具，命中代码在调用LLM相关功能时按用户settings中配置的apiKeyEnv名解析凭据，且目标baseURL同样来自用户设置，未见发往未声明第三方地址，属声明功能的正常组成部分。","intentMatch":"consistent","findingsReviewed":1,"findingsCandidates":1,"fromCache":0,"usage":{"inputTokens":8,"outputTokens":1911,"costUsd":0.0474194,"durationMs":21512}}},"timeline":[{"scannedAt":"2026-08-22T08:21:33.296Z","commit":"2398bd158a78b6ffbdbd1ca55ce2a74acda2b78a","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:20:54.410Z","commit":"b007826a80d8cc93affc68bbd4908a4b576b9b6e","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:48:52.639Z","commit":"b007826a80d8cc93affc68bbd4908a4b576b9b6e","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"pass","to":"caution","commit":"2398bd158a78b6ffbdbd1ca55ce2a74acda2b78a","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:21:33.296Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"b007826a80d8cc93affc68bbd4908a4b576b9b6e","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:20:54.410Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"b007826a80d8cc93affc68bbd4908a4b576b9b6e","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:48:52.639Z"}]}