{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"photon-hq-dsh-imessage","slug":"photon-hq-dsh-imessage","rank":377,"url":"https://github.com/photon-hq/dsh-imessage","name":"photon-hq/dsh-imessage","category":"notify","description":{"zh":"通过 Photon 接入 DeepSeek Harness 的双向 iMessage 通道：按发件人白名单路由，支持会话命令、聊天内审批与提问，并提供用于设备授权和托管号码设置的 Settings 页面。","en":"Two-way iMessage channel for DeepSeek Harness over Photon: sender allowlisting, session commands, in-chat approvals and questions, and a Settings page for device authorization and hosted-line setup."},"stars":7,"starsCheckedAt":"2026-08-21","repository":{"owner":"photon-hq","repo":"dsh-imessage","requestedRef":null,"subpath":""},"npm":"dsh-imessage","downloads":738,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-imessage","tarball":null,"added":"2026-08-19","page":"https://awesome-dsh-plugin.com/p/photon-hq/dsh-imessage/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"photon-hq-dsh-imessage","slug":"photon-hq-dsh-imessage","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:24:19.024Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"a644183adf332bff12b2fe359b3326ca1c066846","commitDate":"2026-08-19T02:12:02Z","artifactDigest":"sha256:c4612aad9945096fb912c6ae0dd5cc31c62d6b33ae4f275cf01dd54cf818690f","downloadUrl":"https://github.com/photon-hq/dsh-imessage/archive/a644183adf332bff12b2fe359b3326ca1c066846.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-imessage","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-imessage","packageVersion":"0.2.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-api-gateway","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-settings"],"platform":"web"},"lifecycleScripts":{"prepare":"npm run build"},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-agent","@deepseek-ai/dsh-agent-default-model","@deepseek-ai/dsh-agent-presets","@deepseek-ai/dsh-api-gateway","@deepseek-ai/dsh-api-remotes","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-credentials","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-session","@deepseek-ai/dsh-session-persistence","@deepseek-ai/dsh-settings","@deepseek-ai/dsh-storage-domain","@deepseek-ai/dsh-tools","@deepseek-ai/dsh-typert-protocol","@deepseek-ai/dsh-user-approval","@deepseek-ai/dsh-user-questions","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-imessage","manifestName":"dsh-imessage","nameMatch":true,"npm":{"name":"dsh-imessage","latestVersion":"0.2.0","publishedAt":"2026-08-19T02:12:55.658Z","createdAt":"2026-08-17T22:14:50.552Z","versionCount":5,"maintainers":1,"repository":"git+https://github.com/photon-hq/dsh-imessage.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"attested","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-imessage","name":"dsh-imessage","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","session","subprocess","telemetry"],"outboundHosts":[{"host":"app.photon.codes","count":1}],"findings":[{"id":"HT-INSTALL-002","title":"Git 安装会触发 prepare 构建脚本","severity":"medium","confidence":"low","layer":"supply-chain","path":"package.json","pathClass":"manifest","line":93,"evidence":"\"prepare\": \"npm run build\"","remediation":"发布预构建制品（npm 或 GitHub Release tarball），并记录源码与发布包的一致性证明。","note":"该插件以 npm/tarball 预构建方式分发，prepare 不在用户机器上执行","hash":"d28b218339321374f2793b3b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/profile-smoke.mjs","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"6ef3f66ff5f0c5ecf977130b"},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"medium","confidence":"medium","path":"package-lock.json","pathClass":"manifest","line":1,"evidence":"@opentelemetry/core@2.7.1 GHSA-8988-4f7v-96qf (CVE-2026-54285) fixed in 2.8.0","remediation":"升级 @opentelemetry/core 至 2.8.0 或更高版本。","layer":"vulnerability","hash":"868cc2fade43c17a670c98cb"}],"counts":{"critical":0,"high":0,"medium":1,"low":1},"rawCounts":{"critical":0,"high":0,"medium":2,"low":1},"vulnerabilities":[{"id":"GHSA-8988-4f7v-96qf","aliases":["CVE-2026-54285"],"package":"@opentelemetry/core","version":"2.7.1","severity":"medium","fixed":"2.8.0","summary":"OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation"}],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":58,"bytesScanned":850414,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":17,"markdown":2,"data":5,"cordis":1,"manifest":1,"source":32}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:24:19.024Z","commit":"a644183adf332bff12b2fe359b3326ca1c066846","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:27:44.281Z","commit":"a644183adf332bff12b2fe359b3326ca1c066846","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:56:42.091Z","commit":"a644183adf332bff12b2fe359b3326ca1c066846","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"a644183adf332bff12b2fe359b3326ca1c066846","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:24:19.024Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"a644183adf332bff12b2fe359b3326ca1c066846","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:27:44.281Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"a644183adf332bff12b2fe359b3326ca1c066846","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:56:42.091Z"}]}