
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
dsh-context-compression-improved
Advanced tools
> [dsh-context-compression-selector](https://github.com/WilliamShi666/dsh-context-compression-selector) 的改进版 fork——面向 DeepSeek Harness 的可审计工具结果上下文压缩选择器,新增正交的**代码骨架压缩门*。
An improved fork of dsh-context-compression-selector — an auditable tool-result context-compression selector for DeepSeek Harness — adding an orthogonal code-skeleton compression gate.
中文说明 · 日本語 · 한국어 · Français · Deutsch · Italiano · Русский · Español · Changelog · Installation guide
[!NOTE] What this fork adds on top of upstream 0.1.0:
- An orthogonal code-skeleton compression gate (
codeSkeleton.enabled, default off): the first exposure of an oversized fresh source-code tool result can keep a skeleton of imports and declarations — bodies elided, error lines kept — before the regular reducers run.- A settings toggle for that gate in the same selector settings section, independent of every compression profile.
- An ESLint baseline wired into CI, a
test:watchTDD loop, and documentation in English, Simplified Chinese, Japanese, and Korean.
[!IMPORTANT] This project supports DeepSeek models only. Lossless measurement and lossy compression depend on the bundled official DeepSeek tokenizers (
deepseek-v4-flash,deepseek-v4-pro,deepseek-v4-flash-vision-exp). Everything else fails open and keeps original tool results. See the upstream README for the full safety model.
[!TIP] Recommended: connect DeepSeek with your own API key via a custom Responses API endpoint. Prefer a custom OpenAI-compatible endpoint (
/v1/responses) over the official-account Messages API route: it does not go through the Anthropic-style message serialization, so requests never trip message-format issues ortool_use/tool_resultpairing validation (the official route's resume-replay 400s cannot be repaired from the plugin side), and you can switch endpoint nodes over time and keep existing sessions running.
0.1.0-rc.2 0.1.0-rc.3 0.1.0-rc.6 0.1.0-rc.7 0.1.0-rc.8 0.1.1-rc.1 0.1.1-rc.2 0.1.2-rc.1 0.1.5-rc.1 0.1.5-rc.2 0.1.5-rc.3 0.1.7-rc.1 0.1.7-rc.2 0.2.0-rc.1 0.2.0-rc.2 0.2.1-rc.1 0.2.1-rc.2 0.2.1-rc.3 0.2.1-rc.4 0.2.1-rc.5 (20 rc releases across lines 0.1.0 / 0.1.1 / 0.1.2 / 0.1.5 / 0.1.7 / 0.2.0 / 0.2.1)Long-running agent tasks accumulate a large amount of tool output. This community plugin adds selectable, auditable policies for reducing that tool-result context without modifying DeepSeek Harness core:
Every decision is recorded: stage, reducer, trigger, skip reason, and exact token counts where available.
When the gate is enabled, an oversized fresh source-code tool result (for example a large read_file) first tries a skeleton reduction: imports and type/function/class declarations are kept, function bodies are elided with a marker, and error lines inside elided bodies are preserved. If the skeleton cannot be produced or verified, the result falls back to the original head pruning — the gate can never make context worse.
Properties:
balanced, savings, cache-strict, adaptive, custom, off, native). All profiles get the gate.codeSkeleton: { enabled: false } until you turn it on.codeSkeleton must be exactly { enabled: boolean }; malformed values throw on the runtime side and show as unreadable in the browser UI.Choose a compression profile, set the Auto Compact trigger level, and toggle code-skeleton compression in the same settings section. The toggle saves on change and shows the saved state on reload.

While compression runs, the plugin gives you a live view of what it saves: a compression monitor panel — net/gross savings, offsets, context usage, cache-hit rate, cost estimate, and the turn-tail intent-summary state, with a per-session resume/disable override right in the panel — next to the session's context trend chart.

Context trend for a session under compression: per-step / per-turn token composition with a timing overlay; the scissors mark where reductions landed.

Savings are reported in three distinct semantics — never merged:
Stats persist in SQLite (~/.dsh/storages/dsh-context-compression/stats.sqlite) across host restarts; a missing driver or write failure degrades visibly (panel badge, in-memory fallback). Historical sessions are backfilled from on-disk behavior records (host sessionQuery service preferred, read-only session-log parsing as fallback — session files are never written). Records contain counts, sequence numbers, session identifiers, and enum component names only; original text and free-form text never enter the database. Delete the file to reset stats completely.
The /ccip command drives the panel in real time: rows stock|total|money on|off, mode compact|full, session <id|latest|off>, flush, backfill pause|resume|status.
Recommended: install from npm. One version covers every supported Harness line — latest carries the full 17-rc enum (0.1.0-rc.2 → 0.2.1-rc.2); the runtime picks per-line code paths on its own.
dsh plugin --profile web add dsh-context-compression-improved@latest
dsh --profile web --dump-config
From source (alternative — the internal package names intentionally stay upstream's):
git clone https://github.com/drscrewdriver/dsh-context-compression-improved.git
cd dsh-context-compression-improved
pnpm install --frozen-lockfile
pnpm build
Then pack the selector package and add it to a Harness profile — the full walkthrough, including verification and uninstall steps, is in the installation guide.
pnpm install --frozen-lockfile
pnpm lint # ESLint baseline (also enforced in CI)
pnpm typecheck # runtime + selector + tests tsc, plus the bundle step
pnpm test # full vitest suite
pnpm test:watch # TDD loop: write the failing regression first, then make it pass
pnpm build
pnpm verify:release
Contributions follow the upstream discipline: add the failing regression first, keep every production change inside this repository, and explain “triggered”, “enabled but skipped”, and fail-open evidence separately. See CONTRIBUTING.md.
0.1.0-rc.2 → 0.2.1-rc.2, seven lines) and the plugin uses public plugin and profile APIs only. The supported list is generated into the managed block above by scripts/sync-hosts.mjs from scripts/hosts.mjs.^22.19.0 || >=24 and pnpm 11.7.0.FAQs
> [dsh-context-compression-selector](https://github.com/WilliamShi666/dsh-context-compression-selector) 的改进版 fork——面向 DeepSeek Harness 的可审计工具结果上下文压缩选择器,新增正交的**代码骨架压缩门*。
The npm package dsh-context-compression-improved receives a total of 1,258 weekly downloads. As such, dsh-context-compression-improved popularity was classified as popular.
We found that dsh-context-compression-improved demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.