
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
Cubox sync for DeepSeek Harness: scheduled sync of your bookmarks, aggregated annotations, an AI daily brief, and a flomo annotation digest with a local dedup ledger — agent tools plus a web settings panel
English | 中文
Cubox sync for DeepSeek Harness: scheduled sync of your Cubox collection, with an AI daily brief generated from your own prompt template and written straight into Obsidian — via the same /c/api/cli endpoints the official cubox-cli uses. Agent tools plus a web settings panel.
~/.dsh/dsh-cubox-cache.json) every N minutes (default 60, configurable; 0 disables the timer). Manual sync anytime with cubox_sync.{collection} is replaced with the formatted collection for the sync window: title / source / summary / annotations). When an LLM key is configured, every sync generates a brief into the output dir — 今日收藏简报-YYYY-MM-DD.md for a 1-day sync, 最近N日收藏简报-YYYY-MM-DD.md for wider windows (each window gets its own file).outputDir and optionally keep one markdown file per card (frontmatter + title + description + Cubox/original links + annotations, same layout as the official Cubox Obsidian plugin). Toggle exportCards off to write only the AI brief.cubox_cards filters by keyword, time window, annotated/starred/read status.~/.dsh/dsh-flomo.json credentials (no new secret), keeps a local dedup ledger (~/.dsh/.cubox-flomo-annotations-sent) so nothing is pushed twice, only pushes annotations older than N minutes (default 60) to avoid half-typed notes, replaces every ASCII # in the body with the full-width # (#123 still reads as #123; flomo only turns an ASCII #word into a tag) and appends only the configured tag, auto-splits long digests across memos, and can target flomo / local markdown / Notion with an optional LLM rewrite ({digest} prompt).cubox_config / cubox_status / cubox_flomo; credentials persist to ~/.dsh/dsh-cubox.json (mode 0600), secrets never echoed.# after publishing to GitHub (repo tagged with the `dsh-plugin` topic)
dsh plugin --profile web add github:zhengjy01/dsh-cubox
# local development
dsh plugin --profile web add link:/path/to/dsh-cubox
Restart dsh web. The plugin ships pre-built — lib/index.js is plain ESM.
Current release: v0.2.0 (Releases · npm).
Open Cubox preferences → Extensions & Automation → API Extension → enable it and copy your unique link (e.g. https://cubox.pro/c/api/save/abcd12345).
Give the link to the plugin — either in the settings panel (Settings → Cubox), or just ask the agent:
帮我配置 Cubox,API 链接是 https://cubox.pro/c/api/save/abcd12345
The agent calls cubox_config to persist it. cubox.pro is the default server; cubox.cc is the international instance (auto-detected from the link).
(Optional) Set the export dir + AI brief: choose the local folder, paste an OpenAI-compatible API key (DeepSeek by default), and edit the prompt template. {collection} is replaced with today's collection list.
Then:
同步一下今天的收藏 → cubox_sync (days=1)
查一下收藏里关于 LLM 的文章 → cubox_cards (keyword="LLM")
The API link and the LLM key are credentials — anyone holding them can read (and modify) your Cubox data or spend your LLM quota. They are stored in
~/.dsh/dsh-cubox.json(mode 0600). To rotate, refresh in the Cubox API-extension page, then re-configure.
| Tool | Purpose |
|---|---|
cubox_status | Connection & cache status |
cubox_config | Set / clear apiLink, server, token, syncMinutes, outputDir, exportCards, llm*, plus the digest options flomoEnabled / exportDest / flomoTag / flomoMinAgeMinutes / usePrompt / exportPrompt / notion* |
cubox_sync | Pull the last N days (default today) into the local cache + export markdown + AI brief + digest push |
cubox_cards | Query the collection (keyword / days / annotated / starred / read) |
cubox_flomo | Push new / changed annotations to flomo now (days window / force bypass min age / tag override) |
/c/api/cli/* family (same endpoints as the official cubox-cli).FAQs
Cubox sync for DeepSeek Harness: scheduled sync of your bookmarks, aggregated annotations, an AI daily brief, and a flomo annotation digest with a local dedup ledger — agent tools plus a web settings panel
The npm package dsh-cubox receives a total of 118 weekly downloads. As such, dsh-cubox popularity was classified as not popular.
We found that dsh-cubox demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.