
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
dsh-chat-tidy
Advanced tools
Codex-inspired turn disclosure, live work timers, chat typography and Markdown tables for DeepSeek Harness
Keep the answer in view. Open the work when you need it.
Tidy Chat adds Codex-inspired work disclosure, live turn timing, compact typography, and polished Markdown tables to DeepSeek Harness Web. Your original reasoning and tool cards remain available, with their native interactions intact.
0.4.1 compatibility update: fixes empty left padding in wide table frames and supports hosts where Chat has moved out of the Session snapshot. On these hosts, Harness owns work timing and disclosure; Tidy Chat keeps its typography and tables without adding duplicate process controls.
The timer uses recorded turn timestamps, including after a reload. It does not add parallel tool durations. Explicit expansion survives updates and session switches during the plugin's lifetime. Selected text or a focused native control prevents completion from folding the work you are reading.
English and Simplified Chinese labels follow the Harness language. Controls support keyboard activation, visible focus, and reduced motion.
Working: the elapsed time and progress stay visible.

Complete: the answer stays in view; intermediate work folds into one header.

Inspect: expand a summary to reach the original Think and tool cards.

These are unedited Chrome captures of the real Harness Web app in an isolated local profile. The conversation, commands, and results are synthetic demonstration data; they contain no private conversations, credentials, or personal paths. The running example uses a keyless local adapter, not a live model benchmark. See the capture fixture.

Typography and spacing are measured from the Codex desktop app, then applied to DSH's own semantic chat anchors.
| Item | Tidy Chat |
|---|---|
| Body | 14 / 22 px |
| Headings h1–h6 | 24 / 20 / 17 / 17 / 15 / 15 px, weight 600 |
| Heading margins | 20 px above, 10 px below |
| Paragraph rhythm | 11 px |
| Activity labels | 13 / 22 px |
| Reading column | DSH's existing 748 px |
Tables use a rounded frame, themed header, row and column rules, and compact 8 × 12 px cell padding. Short tables fill the column; wide tables scroll within the reading column, including tables inside lists and blockquotes. Content and alignment are unchanged.

dsh plugin --profile web add dsh-chat-tidy
Or install from GitHub:
dsh plugin --profile web add github:ChuanTianML/dsh-chat-tidy
Restart dsh web and reload the page. Verified host and client bundles are committed, so GitHub installation does not require a dependency build script.
To use a local checkout:
dsh plugin --profile web add -w /absolute/path/to/dsh-chat-tidy
On hosts that publish Session.chat, the plugin subscribes through the public session header slot and adds presentation controls at native semantic anchors. It does not replace the Chat view, move or clone native React nodes, rewrite model output, or modify session logs. It reads the session projection locally to identify turns and their final answers. It makes no network requests and writes no browser storage.
Disabling or uninstalling the plugin restores all rows and removes its controls, listeners, timer, and stylesheet. There is no Settings row. Reader choices are held only in memory and reset on a page reload.
Supported activity grouping currently covers reasoning and the native bash, pwsh, read, write, edit, glob, grep, web_search, and web_fetch tools. Other tools keep their native presentation. A missing semantic anchor leaves the corresponding content visible.
>=0.1.0-rc.6. Legacy work disclosure uses the public Session.chat projection and session header utilities slot. Hosts with a separate Chat store keep their native work disclosure; verified with 0.2.1-rc.2.--dsw-* tokens retain palette ownership.Requires Node ^22.19 or >=24 and pnpm 11.
pnpm install
pnpm run check
pnpm run pack:check
For integration against a built Harness checkout:
DSH_HARNESS_ROOT=/absolute/path/to/deepseek_harness pnpm run test:harness
This boots the actual Harness browser bundles and the plugin through ModuleLoader in jsdom with the keyless fixture transport. It uses temporary test files and removes them after the run. Browser appearance requires a separate visual check.
See DESIGN.md for presentation rules, VALIDATION.md for evidence, and SECURITY.md for reporting. MIT licensed.
FAQs
Codex-inspired turn disclosure, live work timers, chat typography and Markdown tables for DeepSeek Harness
The npm package dsh-chat-tidy receives a total of 319 weekly downloads. As such, dsh-chat-tidy popularity was classified as not popular.
We found that dsh-chat-tidy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.