{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"wsl043-dsh-codex-subscription","slug":"wsl043-dsh-codex-subscription","rank":198,"url":"https://github.com/WSL043/dsh-codex-subscription","name":"WSL043/dsh-codex-subscription","category":"model","description":{"zh":"内置 ChatGPT OAuth 的 Codex 模型提供方：可切换订阅联网搜索，在设置页显示普通 Codex 与 Spark 独立额度；无需 API Key，也不需要另装 Codex。","en":"Built-in ChatGPT OAuth provider for Codex models, selectable subscription web search, backend quota for standard Codex and Spark, and a DSH settings UI; no API key or separate Codex installation required."},"stars":17,"starsCheckedAt":"2026-08-21","repository":{"owner":"WSL043","repo":"dsh-codex-subscription","requestedRef":null,"subpath":""},"npm":"dsh-codex-subscription","downloads":1595,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-codex-subscription","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/WSL043/dsh-codex-subscription/","screenshots":["https://raw.githubusercontent.com/WSL043/dsh-codex-subscription/main/docs/assets/settings-en.png","https://raw.githubusercontent.com/WSL043/dsh-codex-subscription/main/docs/assets/composer-quota-en.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"wsl043-dsh-codex-subscription","slug":"wsl043-dsh-codex-subscription","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:22:09.579Z","scanStatus":"static-complete","verdict":"pass","score":99,"commit":"22b8cf5a2eaf251d8b7fc6729c169ad7f6ce327b","commitDate":"2026-08-22T15:48:58+08:00","artifactDigest":"sha256:2f2fc4ceaf06729c2358626184aa7eac9ba33e0daa7356b055daa6d2bf77a750","downloadUrl":"https://github.com/WSL043/dsh-codex-subscription/archive/22b8cf5a2eaf251d8b7fc6729c169ad7f6ce327b.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-codex-subscription","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-codex-subscription","packageVersion":"1.2.2","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-api-remotes","@deepseek-ai/dsh-client-connection","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-conversation","@deepseek-ai/dsh-client-ui-model-selection","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-tool"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-api-remotes","@deepseek-ai/dsh-client-connection","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-conversation","@deepseek-ai/dsh-client-ui-model-selection","@deepseek-ai/dsh-client-ui-primitives","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-client-ui-tool","@deepseek-ai/dsh-credentials","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-llm-pi-ai","@deepseek-ai/dsh-settings","@deepseek-ai/dsh-tools","@deepseek-ai/dsh-web","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-codex-subscription","manifestName":"dsh-codex-subscription","nameMatch":true,"npm":{"name":"dsh-codex-subscription","latestVersion":"1.1.6","publishedAt":"2026-08-21T10:42:19.874Z","createdAt":"2026-08-16T22:51:12.178Z","versionCount":17,"maintainers":1,"repository":"git+https://github.com/WSL043/dsh-codex-subscription.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"attested","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"codex-subscription","name":"dsh-codex-subscription","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","subprocess","telemetry"],"outboundHosts":[{"host":"chatgpt.com","count":6},{"host":"auth.openai.com","count":2},{"host":"api.github.com","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":6,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"89dedaa9e6429e9e52b8af60"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/external-url.js","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"40424fdaf0044c75b9c69324"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/powershell-manager.test.mjs","pathClass":"test-example-docs","line":5,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"0b23c506f73da27f1695d5a4"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/powershell-manager.test.mjs","pathClass":"test-example-docs","line":5,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"3dc9342c6ec7a92bf0e51093"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/thin-installer.test.mjs","pathClass":"test-example-docs","line":5,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"53804a6984832846552c05bf"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/thin-installer.test.mjs","pathClass":"test-example-docs","line":5,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"7f51194dffb6cde577f35c4d"}],"counts":{"critical":0,"high":0,"medium":0,"low":2},"rawCounts":{"critical":0,"high":0,"medium":0,"low":6},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":55,"bytesScanned":770532,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"test-example-docs":24,"markdown":6,"data":1,"cordis":1,"script":2,"source":18,"manifest":1,"yaml":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:22:09.579Z","commit":"22b8cf5a2eaf251d8b7fc6729c169ad7f6ce327b","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:21:36.397Z","commit":"c1f20a8dedf69296ec4d4ba0b35285727c238c5e","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:49:45.750Z","commit":"a3dd1e303318088324db9977c25dc12e9f4f0d83","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"22b8cf5a2eaf251d8b7fc6729c169ad7f6ce327b","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:22:09.579Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"c1f20a8dedf69296ec4d4ba0b35285727c238c5e","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:21:36.397Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"a3dd1e303318088324db9977c25dc12e9f4f0d83","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:49:45.750Z"}]}