
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
dsh-connect-web
Advanced tools
Web channel adapter for dsh-connect: mirrors Feishu conversations to DSH Web GUI
English | 中文
Web channel adapter for dsh-connect: tracks which conversations are mirrored into the DSH Web GUI. It monitors the binding route store for chats whose session has been mirrored (webMirrorSessionId set — auto-created by dsh-connect for every new chat) so the GUI can open the shared session.
BindingStore (via onChange events plus a fallback poll) and records each mirrored session: isSessionMirrored(sessionId) and getMirrorSource(sessionId) ("channel:chatKey").web runner and burn a real agent turn for nothing.sendText / sendCard / streamText / promptChoice / closeMenu exist only to satisfy the ChannelAdapter interface. The Web GUI renders the agent's session events directly from DSH's shared session store, not from adapter calls.lockOwner in the binding) is enforced only on the Feishu side by dsh-connect. The Web GUI reads mirrored sessions directly and is write-always from this repository's perspective; that asymmetry cannot be fixed from this package.dsh plugin --profile web add dsh-connect dsh-connect-web
Requires the dsh-connect service to be loaded first (it is declared via inject: ["connect"]), and reads the binding store through dsh-connect's public bindingStore getter (typed via the dsh-connect/binding export subpath).
The plugins register themselves via their bundle manifests, so only override their config — do not insert them again (duplicate ids crash dsh at boot):
- id: connect
name: dsh-connect
- id: connect-web
name: dsh-connect-web
config:
# pollIntervalMs: 1000 # fallback mirror scan interval (default 1000)
| Key | Default | Description |
|---|---|---|
pollIntervalMs | 1000 | Fallback polling interval (ms) for detecting new mirror sessions when change events are missed |
class WebAdapter implements ChannelAdapter {
readonly id = "web";
isSessionMirrored(sessionId: string): boolean; // is this DSH session mirrored from a chat?
getMirrorSource(sessionId: string): string | undefined; // "channel:chatKey" of the source chat
// sendText / sendCard / streamText / promptChoice / closeMenu — contract no-ops
}
dsh-connect: if the connect service or its bindingStore is unavailable, mirror detection is disabled (a warning is logged).MIT
FAQs
Web channel adapter for dsh-connect: mirrors Feishu conversations to DSH Web GUI
We found that dsh-connect-web demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.