{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"wnjxyk-dsh-codex-oauth","slug":"wnjxyk-dsh-codex-oauth","rank":232,"url":"https://github.com/WNJXYK/dsh-codex-oauth","name":"WNJXYK/dsh-codex-oauth","category":"model","description":{"zh":"在 DeepSeek Harness 中使用 ChatGPT/Codex 订阅接入 GPT 模型、图像生成与 Web 搜索，并支持订阅额度显示、模型与功能控制，以及浏览器或设备码 OAuth 登录。","en":"Use a ChatGPT/Codex subscription in DeepSeek Harness with GPT models, image generation, web search, subscription quota reporting, model and feature controls, and browser or device-code OAuth sign-in."},"stars":13,"starsCheckedAt":"2026-08-21","repository":{"owner":"WNJXYK","repo":"dsh-codex-oauth","requestedRef":null,"subpath":""},"npm":"@wnjxyk/dsh-codex-oauth","downloads":612,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add @wnjxyk/dsh-codex-oauth","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/WNJXYK/dsh-codex-oauth/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"wnjxyk-dsh-codex-oauth","slug":"wnjxyk-dsh-codex-oauth","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-21T13:16:35.564Z","scanStatus":"static-complete","verdict":"caution","score":90,"commit":"06bc69cea6e92f86c59c50d41d785303d38bf51d","commitDate":"2026-08-16T01:22:57+08:00","artifactDigest":"sha256:647449b13f5bc3d28f04642e084bb49538d5afe9d4c9cda7b918e1f5aba5c094","downloadUrl":"https://github.com/WNJXYK/dsh-codex-oauth/archive/06bc69cea6e92f86c59c50d41d785303d38bf51d.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add @wnjxyk/dsh-codex-oauth","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@wnjxyk/dsh-codex-oauth","packageVersion":"0.4.2","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-ui-conversation","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-client-ui-tool"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"@wnjxyk/dsh-codex-oauth","manifestName":"@wnjxyk/dsh-codex-oauth","nameMatch":true,"npm":{"name":"@wnjxyk/dsh-codex-oauth","latestVersion":"0.4.2","publishedAt":"2026-08-15T17:24:29.351Z","createdAt":"2026-08-15T12:19:27.903Z","versionCount":3,"maintainers":1,"repository":"git+https://github.com/WNJXYK/dsh-codex-oauth.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"attested","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-codex-oauth","name":"@wnjxyk/dsh-codex-oauth","path":"cordis.patch.yml","disabled":false},{"id":"codex-web-search","name":"@wnjxyk/dsh-codex-oauth/web-search","path":"cordis.patch.yml","disabled":false},{"id":"codex-image-tool","name":"@wnjxyk/dsh-codex-oauth/image-tool","path":"cordis.patch.yml","disabled":false}],"overrides":[{"id":"llm-pi-ai","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":false,"name":null,"keys":["providers"],"path":"cordis.patch.yml"}],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["browser-ui","credentials","environment","filesystem","host-bundle","network"],"outboundHosts":[{"host":"api.openai.com","count":3},{"host":"chatgpt.com","count":2},{"host":"auth.openai.com","count":1}],"findings":[{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"high","confidence":"low","layer":"static","path":"scripts/smoke.mjs","pathClass":"source","line":87,"evidence":"Buffer.from( JSON.stringify({ \"https://api.openai.com/auth\": { chatgpt_account_id: accountId } }), ).toString(\"base64url\"); return `${header}.${payload}.sig`; } const { OpenAICodex","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行","hash":"aff9094fecd93dfaef488e46","review":{"verdict":"placeholder","reason":"该代码位于 scripts/smoke.mjs 测试脚本，makeJwt 仅用 base64url 编码构造本地 mock 服务器所需的测试 JWT，不涉及远程载荷或运行时执行。","model":"sonnet","reviewedAt":"2026-08-21T10:50:30.334Z"}},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"scripts/tools.mjs","pathClass":"source","line":322,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"bcd70d76d07cdc02a4ab92a9","review":{"verdict":"placeholder","reason":"scripts/tools.mjs 是仅用于 npm test 的开发期冒烟测试脚本，未列入 package.json 的 files 字段，不会随插件发布或在运行时执行，vm.runInNewContext 仅用于测试自身 client.js 是否正确导出模块，不涉及远程/不可信代码。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:22:06.463Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":327,"evidence":"credential access at line 327 + outbound network at line 519","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"17c1470a4967f989e932e20d","review":{"verdict":"functional","reason":"Service.init 中获取到 OAuth bearerToken 后调用 ctx.credentials.set(TOKEN_REF, token) 存入宿主凭据服务，是 OAuth 插件将用户自己登录取得的 Codex 令牌持久化以供后续调用 OpenAI/Codex API 的必要步骤，符合插件声明用途。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:22:06.463Z"}},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"high","path":"cordis.patch.yml","line":5,"evidence":"override: id=llm-pi-ai config[providers]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"改写配置 llm-pi-ai","layer":"dsh-semantics","pathClass":"cordis","hash":"50d426dd619441e365624c2c"}],"counts":{"critical":0,"high":0,"medium":2,"low":0},"rawCounts":{"critical":0,"high":2,"medium":2,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":16,"bytesScanned":134917,"truncated":false,"lockfiles":[],"pathClasses":{"test-example-docs":3,"markdown":2,"cordis":1,"source":9,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-21T13:16:35.564Z","summary":null,"intentMatch":null,"findingsReviewed":3,"findingsCandidates":3,"fromCache":3,"usage":null}},"timeline":[{"scannedAt":"2026-08-21T13:16:35.564Z","commit":"06bc69cea6e92f86c59c50d41d785303d38bf51d","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T13:16:14.554Z","commit":"06bc69cea6e92f86c59c50d41d785303d38bf51d","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:22:06.463Z","commit":"06bc69cea6e92f86c59c50d41d785303d38bf51d","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:50:30.334Z","commit":"06bc69cea6e92f86c59c50d41d785303d38bf51d","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"06bc69cea6e92f86c59c50d41d785303d38bf51d","policyVersion":"HT-DSH-0.2.2","at":"2026-08-21T13:16:14.554Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"06bc69cea6e92f86c59c50d41d785303d38bf51d","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:22:06.463Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"06bc69cea6e92f86c59c50d41d785303d38bf51d","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:50:30.334Z"}]}