
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
DSH 小精灵插件:页面悬浮一只缓慢游动的半透明 DeepSeek 鲸鱼(官方 favicon 轮廓 + 蓝紫绿渐变),点击打开可拖动/最小化的临时聊天浮窗;默认跟随会话模型,支持插件内单独配置 OpenAI 兼容模型,流式输出、复制、清空。
English | 中文
A DeepSeek whale elf that lives on your DSH page. A translucent, slowly drifting whale (rendered from the official DeepSeek favicon path, tinted blue → purple → green) hovers at the edge of the viewport; click it to open a lightweight, draggable chat window that never touches your session history.
— to minimize back to the elfweb or desktop profile^22.19.0 or >=24.0.0 (only needed to build from source)The bundle entry (
id: elf) is self-declared by this package'scordis.patch.yml— no manual patch file is needed.
dsh plugin --profile desktop add dsh-elf
Restart DSH (quit fully and reopen), then a fresh page shows the elf at the bottom-right.
git clone https://github.com/winditer/dsh-elf.git dsh-elf && cd dsh-elf
npm install
npm run build # produces dist/client.js
dsh plugin --profile desktop add . # links the workspace into the profile by package name
Or install by hand: in the target profile's package.json (e.g. ~/.dsh/profiles/desktop/package.json):
{
"dependencies": {
"dsh-elf": "link:/absolute/path/to/dsh-elf"
// ...
},
"dsh": {
"profile": {
"bundles": [ /* ... */, "dsh-elf" ]
}
}
}
then pnpm install inside the profile directory and restart DSH.
Remove dsh-elf from the profile's dependencies and dsh.profile.bundles, then clean up the installed link (rm -rf <profile>/node_modules/dsh-elf or pnpm --filter dsh-elf remove --dir <profile>).
dsh-elf:orb); click (without dragging) to open the chat window⚙ configuration · — minimize · 清空 clearEnter sends, Shift+Enter inserts a newline; hover a message and click 📋 to copyOpen ⚙ in the chat header:
| Setting | Meaning |
|---|---|
| 跟随会话默认 (follow) | On: use the harness's session-default model automatically. Off: enable the fields below |
| 提供方 (provider) | Preset for the OpenAI-compatible base URL |
| API 地址 / API Key / 模型 | Base URL, key, and model name for the custom route |
| reasoning | Optional reasoning_effort (high / medium / low) for compatible models |
Settings are saved in the browser's localStorage (dsh-elf:cfg) together with chat history, positions and window mode (dsh-elf:chat / dsh-elf:orb / dsh-elf:win / dsh-elf:mode).
Two halves, one package:
lib/index.js (= src/host.js). Registers a JSON API at /dsh-elf/api through the harness webServer service; runs the session-default chat via llm.stream; chats live in an in-memory Map that is cleared when the plugin unloads.src/client.js, bundled to dist/client.js (esbuild, wrapped in __ModuleLoader__.load({ id: "dsh-elf", … }); the id must equal the installed package name). Renders into the shell.overlay slot, talks to the host with fetch POSTs.All endpoints are POST /dsh-elf/api/<method>; every response is { ok: true, value } or { ok: false, error }.
| Method | Body | Returns |
|---|---|---|
elf.sessionModel | {} | { available, provider?, model?, reasoningEffort? } — the session's default model |
elf.chat.start | { messages: [{ role, text }] } | { ok, chatId } or { ok: false, error } |
elf.chat.poll | { chatId } | { ok, done, text, error? } — accumulated text while streaming; done: true at the end |
elf.chat.close | { chatId } | { ok } |
Protocol details: only POST is accepted (405 otherwise); the body is JSON with a 1 MB cap (413); unknown methods return 404.
localStorage), never on disk or over the wire to anything but the endpoint you configured.npm run build # esbuild: src/client.js → dist/client.js (__ModuleLoader__ bundle)
npm run check # node --check on both halves
npm test # node --test (host mount regression + client bundle guards)
src/client.js Client half (shell.overlay, plain browser timers, fetch → /dsh-elf/api)
src/host.js Host half source (= lib/index.js, the Node entry)
lib/index.js Package main — host half, loaded by the DSH host runtime
dist/client.js Built client bundle (__ModuleLoader__ format, load id = dsh-elf)
cordis.patch.yml Bundle entry declaration (insert: { id: elf, name: dsh-elf })
scripts/build.mjs Build script (esbuild + bundle wrapper)
test/ node:test suites
assets/ Logo / whale artwork
Bundle id must equal the package name — arrive() throws bundle loaded without registering <id> otherwise. scripts/build.mjs hardcodes the correct id.
Profile bundles don't get the cordis timer service — that service is installed only for dynamic cordis-runner packages. Use plain browser setInterval/setTimeout (disposed in React effect cleanup), exactly like the sibling dshmarket bundle.
Prefer link: over file: when installing a workspace copy — file: copies files, so edits/rebuilds go stale.
Client changes go live on page refresh (bundle rev is content-hashed); host changes require a full DSH restart.
Fresh publishes can trip the profile's minimumReleaseAge policy — if the profile enforces pnpm's release-age supply-chain check, a version published less than ~24 h ago fails dsh plugin … add <pkg> with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION. Add the exact name@version to minimumReleaseAgeExclude in the profile's pnpm-workspace.yaml (and keep the entry current when you release a new version):
minimumReleaseAgeExclude:
- dsh-elf@2.2.1
FAQs
DSH 小精灵插件:页面悬浮一只缓慢游动的半透明 DeepSeek 鲸鱼(官方 favicon 轮廓 + 蓝紫绿渐变),点击打开可拖动/最小化的临时聊天浮窗;默认跟随会话模型,支持插件内单独配置 OpenAI 兼容模型,流式输出、复制、清空。
We found that dsh-elf demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.