{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"openma-ai-deepseek-harness-tui-npm","slug":"openma-ai-deepseek-harness-tui-npm","rank":102,"url":"https://github.com/openma-ai/deepseek-harness-tui/tree/main/npm","name":"openma-ai/deepseek-harness-tui#npm","category":"ui","description":{"zh":"Rust/ratatui 终端客户端，直接使用 DSH SDK JSON-RPC 协议，支持独立运行或作为 profile bundle 加载。","en":"A Rust/ratatui terminal client that speaks the DSH SDK JSON-RPC protocol directly and runs standalone or as a profile bundle."},"stars":47,"starsCheckedAt":"2026-08-21","repository":{"owner":"openma-ai","repo":"deepseek-harness-tui","requestedRef":"main","subpath":"npm"},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:openma-ai/deepseek-harness-tui#path:/npm","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/openma-ai/deepseek-harness-tui--npm/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"openma-ai-deepseek-harness-tui-npm","slug":"openma-ai-deepseek-harness-tui-npm","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:20:51.650Z","scanStatus":"static-complete","verdict":"caution","score":93,"commit":"20f503a8596caf933d864ab86ecff859569c4bab","commitDate":"2026-08-22T16:06:12+08:00","artifactDigest":"sha256:b581519d4ce01803dda3ca54a190e343ee3f607b4e0387d417c922a08b8f5003","downloadUrl":"https://github.com/openma-ai/deepseek-harness-tui/archive/20f503a8596caf933d864ab86ecff859569c4bab.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:openma-ai/deepseek-harness-tui#path:/npm","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@openma/deepseek-harness-tui","packageVersion":"0.2.19","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"@openma/deepseek-harness-tui","nameMatch":null,"npm":{"name":"@openma/deepseek-harness-tui","latestVersion":"0.2.16","publishedAt":"2026-08-21T09:32:06.006Z","createdAt":"2026-08-13T18:22:16.137Z","versionCount":26,"maintainers":1,"repository":"git+https://github.com/openma-ai/Martty.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"mismatch","provenance":"attested","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"tui-client-plugins","name":"@openma/deepseek-harness-tui/client-plugin-registry","path":"cordis.patch.yml","disabled":false},{"id":"tui-acp-host","name":"@openma/deepseek-harness-tui/acp-host","path":"cordis.patch.yml","disabled":false},{"id":"tui-host-creator","name":"@openma/deepseek-harness-tui/creator-overlay","path":"cordis.patch.yml","disabled":false},{"id":"tui-runner","name":"@openma/deepseek-harness-tui/runner","path":"cordis.patch.yml","disabled":false},{"id":"tui-creator-overlay","name":"deepseek-harness-tui-creator-overlay","path":"creator/cordis.patch.yml","disabled":false}],"overrides":[{"id":"acp-plugin","tier":"normal","mode":"override","disabled":true,"replacesImplementation":false,"name":null,"keys":[],"path":"cordis.patch.yml"},{"id":"acp-server","tier":"normal","mode":"override","disabled":true,"replacesImplementation":false,"name":null,"keys":[],"path":"cordis.patch.yml"},{"id":"acp-bridge","tier":"normal","mode":"override","disabled":true,"replacesImplementation":false,"name":null,"keys":[],"path":"cordis.patch.yml"},{"id":"tui-creator-overlay","tier":"normal","mode":"override","disabled":true,"replacesImplementation":false,"name":null,"keys":[],"path":"cordis.patch.yml"}],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","environment","filesystem","host-bundle","mcp","network","subprocess","telemetry"],"outboundHosts":[{"host":"martty.sh","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"bin/dsh-tui.js","pathClass":"source","line":5,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"936874e5bc61c6021846f48d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"bin/dsh-tui.js","pathClass":"source","line":5,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"c21d5e53464d7af3fe6cc96f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/acp-client.js","pathClass":"source","line":9,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"eb2f105166500c0c42e14f07"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/acp-client.js","pathClass":"source","line":23,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"eb2f105166500c0c42e14f07"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/boot.js","pathClass":"source","line":39,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7d3e8234908f6e73f87dea7e"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"medium","confidence":"medium","layer":"static","path":"lib/client-run.js","pathClass":"source","line":47,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"37a61dd7ce9ccd2a5986ac18","review":{"verdict":"functional","reason":"new Function 用于加载 TUI 客户端插件的 clientCode 半部分，通过 reactTrap/hostFor/harnessTrap/requireTrap 等受限门面传参而非直接暴露真实全局对象，是插件运行时(tui-client-plugins/tui-runner)加载第三方客户端插件代码的核心机制。","model":"sonnet","reviewedAt":"2026-08-22T08:20:51.650Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/runner.js","pathClass":"source","line":10,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"793129f2fa386056e1489958"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/spawn-tui.js","pathClass":"source","line":8,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"37f76ea5da4059ec307ed7fa"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/spawn-tui.js","pathClass":"source","line":62,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"37f76ea5da4059ec307ed7fa"},{"id":"HT-IDENTITY-001","title":"npm 上存在同名包但指向其他仓库","severity":"low","confidence":"medium","path":"package.json","pathClass":"manifest","line":1,"evidence":"npm repository=git+https://github.com/openma-ai/Martty.git ≠ openma-ai/deepseek-harness-tui","remediation":"npm 上存在同名包但指向其它仓库；从源码安装时请使用 github: 引用并锁定 commit。","layer":"identity","hash":"c86c9d28fecae33300652131"}],"counts":{"critical":0,"high":0,"medium":1,"low":9},"rawCounts":{"critical":0,"high":0,"medium":1,"low":9},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":59,"bytesScanned":622249,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"markdown":2,"source":43,"cordis":2,"manifest":2,"data":10}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:20:51.650Z","summary":"该插件是 DSH 的 Rust/ratatui 终端客户端 UI 前端，cordis.patch.yml 显示其接管 ACP 传输并注入 tui-client-plugins、tui-acp-host、tui-runner 等宿主级组件，符合\"作为独立进程或 profile bundle 加载的终端客户端\"定位。命中的 new Function 用于执行\"Client Plugin Half\"代码，是其插件系统（允许第三方 TUI 客户端插件扩展主题/面板/命令）的必要实现，通过受限 trap 对象（reactTrap/harnessTrap/requireTrap 等）而非真实 Node 全局量传参，体现了有意的能力限制，但 new Function 本质上仍是动态代码执行，若上游插件市场引入恶意 clientCode 仍存在逃逸风险，用户应关注加载的第三方 Client Plugin 来源是否可信。","intentMatch":"consistent","findingsReviewed":1,"findingsCandidates":1,"fromCache":0,"usage":{"inputTokens":2,"outputTokens":1294,"costUsd":0.02853,"durationMs":17411}}},"timeline":[{"scannedAt":"2026-08-22T08:20:51.650Z","commit":"20f503a8596caf933d864ab86ecff859569c4bab","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:19:42.481Z","commit":"646b804040925be48ca62a788bec7f31e8b0949b","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T10:47:35.472Z","commit":"646b804040925be48ca62a788bec7f31e8b0949b","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"review","to":"caution","commit":"20f503a8596caf933d864ab86ecff859569c4bab","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:20:51.650Z"},{"kind":"verdict-change","from":"caution","to":"review","commit":"646b804040925be48ca62a788bec7f31e8b0949b","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:19:42.481Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"646b804040925be48ca62a788bec7f31e8b0949b","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:47:35.472Z"}]}