
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
dsh-claude-code
Advanced tools
DSH tool plugin: delegate a self-contained task to your local Claude Code subscription (via the official Claude Agent SDK).
一个 DeepSeek Harness 工具插件:把自包含的编码子任务委派给本地 Claude Code 订阅执行,结果回传给 DSH。DSH 是 leader,Claude Code 是 worker。
claude CLI,不提取任何 OAuth token,合规使用订阅。sessionId 传回,Claude Code 会记住之前的上下文,适合多轮迭代。# 方式一(最简单,自动接线):通过 dsh 插件命令安装
dsh plugin --profile web add dsh-claude-code
# 方式二:手动装进 profile
cd ~/.dsh/profiles
npm install dsh-claude-code
# 然后在 ~/.dsh/profiles/<你的profile>/cordis.patch.yml 里加上:
# - insert:
# - id: claude-code
# name: 'dsh-claude-code'
装完重启 dsh。插件自带 cordis.patch.yml(dsh.bundle manifest),dsh plugin add 会用它自动接线。
接线示例(带配置):
- insert:
- id: claude-code
name: 'dsh-claude-code'
config:
model: sonnet # sonnet | opus | haiku | 完整 id
permissionMode: acceptEdits # default | acceptEdits | bypassPermissions | plan | dontAsk
maxTurns: 100
timeoutMs: 600000
# 可选:claude 可执行文件路径(SDK 会自动从 PATH 探测,一般不用配)
# pathToClaudeCodeExecutable: /path/to/claude
| 字段 | 默认 | 说明 |
|---|---|---|
model | sonnet | Claude 模型别名或完整 id |
permissionMode | acceptEdits | Claude Code 权限模式。acceptEdits 自动放行文件编辑;bypassPermissions 完全免确认(需信任) |
maxTurns | 100 | 每次任务 Claude Code 最多跑多少轮 |
timeoutMs | 600000 | 单次调用的协作超时 |
cwd | DSH cwd | Claude Code 工作目录 |
allowedTools | 未设 | 允许的 Claude Code 内置工具名列表 |
pathToClaudeCodeExecutable | 自动 | claude 可执行文件路径 |
effort | high | 思考强度:low/medium/high/xhigh/max |
maxThinkingTokens | 未设 | 思考 token 预算上限 |
| 参数 | 说明 |
|---|---|
task(必填) | 自包含任务描述(目标、文件、约束、验收) |
cwd / model / permissionMode / maxTurns / allowedTools / effort / maxThinkingTokens | 覆盖插件配置 |
resume | 传上次返回的 sessionId,续接那个 Claude Code 会话(记住之前的上下文) |
返回:最终结果文本 + sessionId + token 用量 + 费用 + 用到的工具。
// 第一轮
{ "task": "修复 src/parser.ts 里 parse() 对空输入的崩溃,并加一个单元测试", "cwd": "/path/to/repo" }
// → { "ok": true, "output": "…", "sessionId": "abc-123" }
// 第二轮(迭代同一任务,带记忆)
{ "task": "上一步的修复里你漏了边界情况 X,补上并重跑测试", "resume": "abc-123" }
npm install --legacy-peer-deps
npm run build # tsc → lib/
npm run typecheck
npm login
npm publish # publishConfig.access 已设 public
发布后建议:GitHub 建仓库并给仓库打 dsh-plugin topic,即可出现在 github.com/topics/dsh-plugin。
cwd 与 permissionMode 收敛到信任范围。FAQs
DSH tool plugin: delegate a self-contained task to your local Claude Code subscription (via the official Claude Agent SDK).
We found that dsh-claude-code demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.