
Security News
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
@master0071/dsh-autoresearch
Advanced tools
Autonomous experiment loop for DeepSeek Harness: try an idea, benchmark it, keep improvements, revert regressions, repeat. init/run/log experiment tools over an append-only .auto/log.jsonl with auto-commit retention. Port of pi-autoresearch (karpathy/auto
自主实验循环:试一个想法 → 测量 → 留下改进、回退回归 → 重复。适用于任何可量化指标的优化目标(测试耗时、bundle 体积、构建时间、Lighthouse 分数)。移植自 pi-autoresearch(Pi 生态 7825★,源自 karpathy/autoresearch)。
状态:v0.1.5 已发布(npm:@master0071/dsh-autoresearch,本机 npm publish 发布;另见 CHANGELOG)。注意:无作用域包名 dsh-autoresearch 已被其他作者占用,故改用作用域包名;仓库不包含发布 workflow(GitHub Actions 仅保留 CI 质量门禁),发布流程见 docs/DEVELOPMENT.md。工具面与终端仪表盘已完备;Web 仪表盘与外层循环驱动器见 §里程碑。
experiment loop、benchmark optimization 均 0 命中,autoresearch 仅 1 个无关技能包——完全空白。tool-ralph、jobs、goal、subprocess),缺的只是产品封装。持久状态在 <workspace>/.auto/:prompt.md(本次优化会话的章程:目标、指标、方向)+ log.jsonl(只追加的实验史,永不改写)。
单 dispatch 工具 autoresearch,支持五个动作:
| action | 做什么 |
|---|---|
init | 写会话章程:名称、指标、单位、方向(越大越好/越小越好);生成含协议规则的结构化章程模板(0.1.3) |
run | 执行任意命令,计 wall-clock,留有界输出(支持配置 shell) |
log | 记录结果,自动提交 .auto 留存,判定 keep/revert(支持 autoRevert) |
status | 汇报 best/worst/趋势(支持 format: 'trend' / 'table' / 'full' 渲染终端报表) |
revert | 显式一键回退工作区改动至基线(排除 .auto/) |
关键取舍:
留优回退靠 git:每条实验自动 commit .auto,改进保留、回归支持通过 autoRevert: true 或 action: revert 自动恢复工作区代码——审计链完整,不发明自己的存储。
单工具 + action 分发:五个动词一个工具,控制每请求 schema 预算。
实验命令走 ctx.subprocess,支持指定 shell(pwsh/cmd/bash 等),共享沙箱策略,不自建执行器。
动态上下文注入(0.1.3):宿主提供 systemPrompt 服务时,自动向模型上下文挂载 autoresearch:status 状态快照(轮数/最优值),模型无需显式调 status 即可感知进度。
外层循环可选骑 tool-ralph(DSH 官方的认知循环工具),本插件只管实验记录与留存——关注点分离。
见 cordis.patch.yml,字段与默认值与 src/index.ts 的 Config 一一对应。
shell)。status format: 'trend'/'table'/'full');/autoresearch 循环命令、ralph 挂载与 Web 仪表盘待实施。每步先 npm run typecheck,行为验收走真实 dsh --patch 会话。
控制面事件写入 JSONL 台账(默认 ~/.dsh-autoresearch/traces.jsonl,tracePath 可配,超限自动轮转到 .1);实验数据本体在 <workspace>/.auto/log.jsonl(append-only,永不改写):
| 文件 | 内容 |
|---|---|
~/.dsh-autoresearch/traces.jsonl | init / run / experiment-logged / auto-commit-failed / auto-reverted / auto-revert-failed / workspace-reverted / revert-failed / error 控制面事件 |
<workspace>/.auto/log.jsonl | 实验记录(index/idea/command/value/unit/kept/timestamp) |
<workspace>/.auto/prompt.md | 优化会话章程 |
最小收集原则:run 命令只保留前 120 字符,输出内容不入台账。查看:Get-Content ~/.dsh-autoresearch/traces.jsonl。
git add -- .auto 再 commit,工作区其他已跟踪改动不受影响。run 按 experimentTimeoutMs(默认 10 分钟)强制终止并标注 (timed out),随后可 log 记录超时结果或重试。log.jsonl 只追加;init 幂等(已有日志时拒绝重复初始化),防止方向混杂;单行损坏会被自动跳过并告警,不影响后续 status/log(0.1.2)。cmd /c(非 Windows 为 sh -c);可通过配置 shell 指定 pwsh / bash 等,调用参数自动补齐(0.1.2)。docs/DEVELOPMENT.md 与 CHANGELOG.md。@deepseek-ai/dsh-subprocess、tool-ralph(见 deepseek-harness packages/)FAQs
Autonomous experiment loop for DeepSeek Harness: try an idea, benchmark it, keep improvements, revert regressions, repeat. init/run/log experiment tools over an append-only .auto/log.jsonl with auto-commit retention. Port of pi-autoresearch (karpathy/auto
We found that @master0071/dsh-autoresearch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.