{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"thewolfwalker-dsh-notifier","slug":"thewolfwalker-dsh-notifier","rank":92,"url":"https://github.com/THEWOLFWALKER/dsh-notifier","name":"THEWOLFWALKER/dsh-notifier","category":"notify","description":{"zh":"DSH 统一通知推送与远程控制：一个 `notify()` API 打通 25+ 渠道（Telegram / 钉钉 / 飞书 / 企业微信 / QQ 机器人 / WxPusher / PushPlus / Server 酱 / Bark / Discord / Slack / ntfy / webhook 等），timeSensitive / active / passive 分级路由并重试；五通道反向审批（Telegram 按钮 / 飞书卡片 / QQ / WxPusher / 微信 iLink）；QQ/钉钉/飞书官方扫码登录；本地 Web 管理台；多 agent 路由；系统桌面通知——以及**手机指挥中心**：在手机上发 `!status` / `!stop` / `!retry` 遥控 agent，通知带可操作按钮（查看结果 / 重试 / 日志，点击回调 agent）。密钥脱敏、工具限流、零运行时依赖。","en":"Unified notification & remote control for DSH: one `notify()` API, 25+ channels (Telegram / DingTalk / Feishu / WeCom / QQ bot / WxPusher / PushPlus / ServerChan / Bark / Discord / Slack / ntfy / webhook...), level routing (timeSensitive / active / passive) with tiered retry, multi-channel inbound approval (Telegram buttons, Feishu cards, QQ, WxPusher, WeChat iLink), official QR login for QQ/DingTalk/Feishu, a local web admin console, multi-agent routing, desktop notifications — and a mobile command center: `!status` / `!stop` / `!retry` agent control from your phone plus actionable notifications (view result / retry / logs buttons that call back into the agent). Secrets redacted, tool rate-limited, zero runtime deps — plus an open event source: other plugins can inject the notifier service (ctx.notifier) and subscribe to dsh-notifier/sent events, reusing notification without coupling — and an identity system (v0.7): pairing codes (/pair in any DM, first redeemer becomes owner), composite-key bindings, member roles, and a guided bootstrap state when the whitelist is empty."},"stars":55,"starsCheckedAt":"2026-08-21","repository":{"owner":"THEWOLFWALKER","repo":"dsh-notifier","requestedRef":null,"subpath":""},"npm":"dsh-notifier","downloads":6888,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-notifier","tarball":null,"added":"2026-08-15","page":"https://awesome-dsh-plugin.com/p/THEWOLFWALKER/dsh-notifier/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"thewolfwalker-dsh-notifier","slug":"thewolfwalker-dsh-notifier","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:20:46.641Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"cc4781e9939210b2d91b63f5448ccef40708a7c2","commitDate":"2026-08-18T17:14:50+08:00","artifactDigest":"sha256:745faf702bdf52adeda277b0e2df97391296e947d7c6d4049a70768400d3a2fc","downloadUrl":"https://github.com/THEWOLFWALKER/dsh-notifier/archive/cc4781e9939210b2d91b63f5448ccef40708a7c2.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-notifier","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-notifier","packageVersion":"0.8.4","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-notifier","manifestName":"dsh-notifier","nameMatch":true,"npm":{"name":"dsh-notifier","latestVersion":"0.8.4","publishedAt":"2026-08-18T08:55:11.324Z","createdAt":"2026-08-14T23:41:29.444Z","versionCount":14,"maintainers":1,"repository":"git+https://github.com/THEWOLFWALKER/dsh-notifier.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-notifier","name":"dsh-notifier","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","session","subprocess"],"outboundHosts":[{"host":"oapi.dingtalk.com","count":3},{"host":"qyapi.weixin.qq.com","count":3},{"host":"api.chanify.net","count":3},{"host":"api.telegram.org","count":3},{"host":"wxpusher.zjiecode.com","count":3},{"host":"open.feishu.cn","count":2},{"host":"www.pushplus.plus","count":2},{"host":"bots.qq.com","count":2},{"host":"api.sgroup.qq.com","count":2},{"host":"sctapi.ftqq.com","count":2},{"host":"ntfy.sh","count":2},{"host":"api2.pushdeer.com","count":2},{"host":"api.day.app","count":1},{"host":"mm.example.com","count":1},{"host":"mattermost.com","count":1},{"host":"api.pushover.net","count":1},{"host":"xizhi.qqoq.net","count":1},{"host":"qmsg.zendee.cn","count":1},{"host":"push.hellyw.com","count":1},{"host":"ilinkai.weixin.qq.com","count":1},{"host":"api.dingtalk.com","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/channel-login.mjs","pathClass":"source","line":13,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"2bae3f12da572c52a70aee27"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/adapters/desktop.mjs","pathClass":"source","line":25,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"8661679e33671ee38614c18e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/adapters/desktop.mjs","pathClass":"source","line":198,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"8661679e33671ee38614c18e"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/admin/ui.mjs","pathClass":"source","line":363,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"dd0c6918abf33858cb1170c5"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/admin/ui.mjs","pathClass":"source","line":368,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"dd0c6918abf33858cb1170c5"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/admin-server.test.mjs","pathClass":"test-example-docs","line":473,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"9c26fde9605ae7426c7dd991"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/desktop.test.mjs","pathClass":"test-example-docs","line":107,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"cb32a032d62f74f2ed3261b4"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/public.test.mjs","pathClass":"test-example-docs","line":460,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"603532326dbe02c670679877"}],"counts":{"critical":0,"high":0,"medium":2,"low":3},"rawCounts":{"critical":0,"high":1,"medium":2,"low":5},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":150,"bytesScanned":1820044,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":65,"markdown":14,"cordis":1,"data":1,"manifest":1,"source":68}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:20:46.641Z","commit":"cc4781e9939210b2d91b63f5448ccef40708a7c2","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:19:33.062Z","commit":"cc4781e9939210b2d91b63f5448ccef40708a7c2","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:47:24.042Z","commit":"cc4781e9939210b2d91b63f5448ccef40708a7c2","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"cc4781e9939210b2d91b63f5448ccef40708a7c2","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:20:46.641Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"cc4781e9939210b2d91b63f5448ccef40708a7c2","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:19:33.062Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"cc4781e9939210b2d91b63f5448ccef40708a7c2","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:47:24.042Z"}]}