
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
dsh-capture-window
Advanced tools
把一条「发散想法」投进一个安静的独立新会话,不触碰主线上下文、不切主线视图。
Ctrl+Shift+K 或右下角「⚡ 捕获」浮标呼出,可拖拽,深色模式适配。dsh-capture/
├── src/host/index.ts host 引擎:/recall 命令(近10条压缩 → 新建会话 → inject+followup)
├── src/client/index.ts 捕获窗 + 对话视图(官方 connection.api 数据层)
├── tsconfig.json host 编译(tsc → lib/index.js)
├── tsdown.config.mjs client 打包(→ dist/client.cjs)
└── install.ps1 构建/安装/接线/重启提示
main: lib/index.js),由 cordis 插件 loader 加载。注册 /recall 命令,负责压缩、建会话、注入上下文(这些需要 host 侧的 llm.stream 与 agent.inject)。dsh.client 声明 + exports["./client"](dist/client.cjs),走官方 ctx.connection.api(sessions.history/prompt/models/selectModel、llm.*、events.host/mux)与 connection.rpc(选择模式由 host 侧过滤消息,避免下发 chunk 碎片),无私有 harness RPC。dsh plugin --profile web add dsh-capture-window
(dsh 即 npx @deepseek-ai/dsh。)装完重启 npx @deepseek-ai/dsh web,按 Ctrl+Shift+K 呼出捕获窗。
原理:本包声明了
dsh.bundle.patch,dsh plugin add会自动把它注册进dsh.profile.bundles,无需手动改cordis.patch.yml。
cd dsh-capture
.\install.ps1
脚本会:装依赖 → tsc 构建 host → tsdown 构建 client → pnpm add 装进 ~/.dsh/profiles/web → 在 cordis.patch.yml 追加插件行 → 提示重启。
plugin/recall 来源(非回复 prelude)。FAQs
旁路捕获窗 + /recall 引擎:把想法投进一个安静的独立新会话,压缩当前会话最近 10 句作为背景(不进主线上下文、不切主线视图)
The npm package dsh-capture-window receives a total of 0 weekly downloads. As such, dsh-capture-window popularity was classified as not popular.
We found that dsh-capture-window demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.