
Security News
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
dsh-desktop-only-plugin
Advanced tools
Tauri desktop host for an existing DeepSeek Harness Web profile
dsh-desktop-only-plugindsh-desktop-only-plugin adds a Tauri 2 native window to an existing DeepSeek Harness Web profile. It is a normal dsh.bundle: the selected profile keeps its other plugins, user patch layers, sessions, and settings. The native process owns only the window, finite native commands, and the lifecycle of the embedded Harness child; product HTTP, WebSocket, session, tool, and streaming traffic remain on the ordinary Harness Web transport.
Install the prebuilt plugin into the profile whose complete plugin tree the app should host:
dsh plugin --profile web add dsh-desktop-only-plugin
dsh desktop --profile web
Replace web with the profile name you use. Confirm the bundle layer before launching:
dsh --profile web --dump-config
The application embeds a platform Node executable and a production @deepseek-ai/dsh deployment, so the packaged app does not require Node on PATH. The app still serves the existing Web UI from an owner-local loopback port; it does not open an external browser.
The desktop-runtime row reports readiness only after the selected Web profile has settled and exposes an exact http://127.0.0.1:<port> origin. Disabling that row leaves the native launcher open in a disabled state and starts no Harness child. Removing the bundle invokes its beforeRemove hook before pnpm removes the package: the hook stops the owned launcher and removes the copied application, while leaving the user's patch file untouched. A copied application whose bundle is missing reports the missing state and can remove only its own artifact.
The launcher control socket is private and authenticated for one launch generation. It carries lifecycle messages only. The browser bridge exposes only minimize, toggle-maximize, close, and bounded notifications; it does not mirror sessions, tools, terminal output, or model streams.
This repository stores source and build scripts. Native launchers and embedded runtimes are generated and ignored by Git.
pnpm install
pnpm run build
pnpm test
pnpm run test:native
pnpm run build:launcher
DSH_RUNTIME_SOURCE=/path/to/DeepSeek-harness pnpm run build:runtime
pnpm pack
build:launcher uses the brand asset in assets/favicon.svg and builds the current platform. During this unreleased integration phase, build:runtime deploys a built Harness checkout given through DSH_RUNTIME_SOURCE and embeds the current Node executable. Once a published Harness version exposes both lib/bin.js and lib/profile-boot.js, use DSH_RUNTIME_VERSION=<version> instead.
The bundle currently supports macOS and Windows only. Build each platform on a matching host or CI runner: macOS produces launcher/darwin-<arch>/DeepSeek Harness.app; Windows produces launcher/win32-<arch>/dsh-desktop.exe with runtime/win32-<arch>/node.exe.
pnpm install
pnpm run build
pnpm test
pnpm run test:native
pnpm run build:launcher
$env:DSH_RUNTIME_SOURCE = 'C:\path\to\DeepSeek-harness'
pnpm run build:runtime
Release packaging combines the launcher/ and runtime/ directories from the macOS and Windows builds into one workspace. Run pnpm run verify:package-artifacts before pnpm pack; it refuses archives that omit either platform. Neither command builds Tauri or Harness, so end users only install prebuilt artifacts and do not need a local Node, Rust, or Tauri toolchain.
The repository's current dsh checkout must include the generic desktop bundle entry point and bundle lifecycle hook support. Those are Harness extension points; this package does not patch the Harness source tree.
MIT.
FAQs
Tauri desktop host for an existing DeepSeek Harness Web profile
We found that dsh-desktop-only-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.