{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"wlj521-dsh-ui-tweaks","slug":"wlj521-dsh-ui-tweaks","rank":489,"url":"https://github.com/wlj521/dsh-ui-tweaks","name":"wlj521/dsh-ui-tweaks","category":"ui","description":{"zh":"从设置面板实时调教 DSH 网页对话界面：消息字体大小、Claude Desktop 风格 Markdown 表格、对话框宽度、可选时间线侧栏，以及带分支管理、逐文件 Diff 和提交推送功能的 GitBar。","en":"Live-tune the DSH Web conversation UI from Settings: message font size, Claude Desktop-style markdown tables, dialog width, an optional timeline rail, and a GitBar with branch management, per-file diff, and commit & push."},"stars":5,"starsCheckedAt":"2026-08-21","repository":{"owner":"wlj521","repo":"dsh-ui-tweaks","requestedRef":null,"subpath":""},"npm":"dsh-ui-tweaks","downloads":1361,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-ui-tweaks","tarball":null,"added":"2026-08-17","page":"https://awesome-dsh-plugin.com/p/wlj521/dsh-ui-tweaks/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"wlj521-dsh-ui-tweaks","slug":"wlj521-dsh-ui-tweaks","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:25:26.456Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"2933da2ad77ca5c88fb86f8e953051fe861ca22e","commitDate":"2026-08-22T09:12:00+08:00","artifactDigest":"sha256:4a3f8bb8b88a95db6f03760ce1e6fc4f8185f820e80c01ae7b7a6681e2ff8e8e","downloadUrl":"https://github.com/wlj521/dsh-ui-tweaks/archive/2933da2ad77ca5c88fb86f8e953051fe861ca22e.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-ui-tweaks","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-ui-tweaks","packageVersion":"0.8.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-ui-commands","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-conversation"],"platform":"web"},"lifecycleScripts":{"prepare":"tsc -p tsconfig.json && tsc -p tsconfig.client.json && node scripts/build-client.mjs"},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-commands","@deepseek-ai/dsh-client-ui-conversation","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-host-webserver","@deepseek-ai/dsh-session-projection","@deepseek-ai/dsh-settings","@deepseek-ai/dsh-storage-domain","@deepseek-ai/dsh-workspace","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-ui-tweaks","manifestName":"dsh-ui-tweaks","nameMatch":true,"npm":{"name":"dsh-ui-tweaks","latestVersion":"0.7.2","publishedAt":"2026-08-21T05:24:58.897Z","createdAt":"2026-08-15T08:47:40.706Z","versionCount":12,"maintainers":1,"repository":"git+https://github.com/wlj521/dsh-ui-tweaks.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"ui-tweaks","name":"dsh-ui-tweaks","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","mcp","network","session","subprocess"],"outboundHosts":[{"host":"mcp.example.com","count":1},{"host":"bellard.org","count":1}],"findings":[{"id":"HT-INSTALL-002","title":"Git 安装会触发 prepare 构建脚本","severity":"medium","confidence":"low","layer":"supply-chain","path":"package.json","pathClass":"manifest","line":52,"evidence":"\"prepare\": \"tsc -p tsconfig.json && tsc -p tsconfig.client.json && node scripts/build-client.mjs\"","remediation":"发布预构建制品（npm 或 GitHub Release tarball），并记录源码与发布包的一致性证明。","note":"该插件以 npm/tarball 预构建方式分发，prepare 不在用户机器上执行","hash":"c81e9bc36ff8a5f001035288"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/client/gitbar.tsx","pathClass":"source","line":2146,"evidence":"dangerouslySetInnerHTML","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"0a3783470435102f49f366d7"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/client/gitbar.tsx","pathClass":"source","line":2150,"evidence":"dangerouslySetInnerHTML","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"0a3783470435102f49f366d7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/git.ts","pathClass":"source","line":11,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"dcd6779348fa008e810ad551"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/git.ts","pathClass":"source","line":24,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"bdc87ed605fa8a9fcf276b39"}],"counts":{"critical":0,"high":0,"medium":2,"low":2},"rawCounts":{"critical":0,"high":0,"medium":3,"low":2},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":27,"bytesScanned":888136,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"markdown":2,"cordis":1,"manifest":1,"yaml":2,"source":18,"data":3}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:25:26.456Z","commit":"2933da2ad77ca5c88fb86f8e953051fe861ca22e","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:29:08.435Z","commit":"91cc60176cae0b473d6a9549ade9e0859a68acb5","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:58:16.761Z","commit":"91cc60176cae0b473d6a9549ade9e0859a68acb5","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"pass","to":"caution","commit":"2933da2ad77ca5c88fb86f8e953051fe861ca22e","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:25:26.456Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"91cc60176cae0b473d6a9549ade9e0859a68acb5","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:29:08.435Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"91cc60176cae0b473d6a9549ade9e0859a68acb5","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:58:16.761Z"}]}