
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
dsh-filemenu
Advanced tools
Right-click context menus for the DeepSeek Harness (DSH) web UI: open files, reveal in Explorer/Finder, open in a detected editor, copy paths; workspace/session context menus. 对话文件右键菜单插件。
English | 中文
Right-click context menus for the DeepSeek Harness (DSH) web UI.
Files produced in a conversation, inline file references, sidebar workspace (project) rows and session rows — open them, reveal them in the OS file manager, open them in a detected editor, or copy their paths. The menu items follow the conventions of the latest Codex desktop apps.
Built as a dynamic Cordis plugin — purely additive, never replaces a shipped UI seat, and every side effect is removed when the plugin stops.
D:\\dayu\\XMDJ\\frontend\\voter-web\\dist),canOpenPath (headless Linux hosts hide them).DshFileMenu ships as a dynamic Cordis plugin: two plain-JavaScript files, one Host half and one Client half. A dynamic plugin is defined and activated inside a session and takes effect immediately.
Get the two plugin files:
plugin/host.js — the Host halfplugin/client.js — the Client halfOpen any session in the DSH web UI and ask the agent to install it:
请安装 dsh-filemenu:用
cordis_define(kind: new,idPrefix: file)创建插件,code.host填入plugin/host.js的完整内容,code.client填入plugin/client.js的完整内容,然后cordis_run(mode: run)激活。
(Equivalent English instruction: create with cordis_define — kind: new, idPrefix: file, code.host = the full content of plugin/host.js, code.client = the full content of plugin/client.js — then activate with cordis_run, mode: run.)
Approve the first activation. The Client half asks for authorization in the Run card — click Allow (double-check also trusts future versions). Without approval the plugin stays awaiting-approval.
Done. Right-click a produced file, a workspace row, or a session row to verify.
Note: dynamic plugins are process-local. After the Harness restarts you need to define and run them again (Option B makes the plugin persistent).
DshFileMenu is shipped in the standard package shape (dsh.bundle / dsh.client declarations), so it can be installed as a permanent profile plugin that survives restarts:
# from the repository checkout
dsh plugin --profile <profile> add .
Which
<profile>? The DSH Desktop app runs thedesktopprofile →--profile desktop. A standalone web-server deployment runsdsh weband uses thewebprofile →--profile web. Check~/.dsh/profiles/for your active profiles.
Install steps (do these in order):
dsh plugin --profile desktop add . — this runs pnpm add in the profile directory and auto-mounts the package because its package.json declares dsh.bundle (the cordis.patch.yml row) and dsh.client (the browser half, served at /plugins/dsh-filemenu/client.js).dsh plugin --profile desktop remove dsh-filemenu, update dsh-filemenu, why dsh-filemenu (any pnpm argument is forwarded verbatim).Published to npm (
dsh-filemenu@1.1.6) —dsh plugin --profile desktop add dsh-filemenuinstalls directly from the registry. A local checkout (add .) also works. Prerequisite:pnpmonPATH(the CLI forwards to it).
If you run the Harness from source, a patch overlay also works (see the official Your first plugin tutorial):
pnpm dsh web --patch ./cordis.patch.yml
References: official plugin docs, deepseek-harness-plugins collection, dsh-market.
archiveSession API is called.inject: ['webServer']; the /dsh-filemenu/rpc route now waits for the web server before registering.dsh.bundle, dsh.client, cordis.patch.yml, a standard __ModuleLoader__ Client bundle and Host HTTP RPC.dsh-filemenu@1.1.0 to npm.Right-click the target; the menu appears exactly at the cursor.
| Surface | Menu items |
|---|---|
| Produced-file chip / inline reference / tool-card link | Open · Open containing folder · Open in editor ▸ (detected editors) · Open with another program… · Copy path · Copy relative path |
| Sidebar workspace (project) row | Open containing folder · Open · Copy path |
| Sidebar session row | Open containing folder · Open · Copy path |
Platform behavior:
explorer /select,<path>); "Open" uses Invoke-Item; "Open with another program…" opens the system dialog (rundll32 shell32.dll,OpenAs_RunDLL).open -R; open uses open.xdg-open (desktop only).canOpenPath = false, e.g. remote web access or headless Linux), all OS-dependent items are disabled; copy items keep working.┌────────────────────────── Client (browser) ──────────────────────────┐
│ shell.overlay entry hosts the menu; document capture-phase │
│ `contextmenu` listener detects targets via stable DOM markers │
│ (data-produced-files-row / code button[title] / │
│ data-dsh-workspace-drop-target + role=treeitem rows) │
│ Targets are resolved from live sessions/workspaces snapshots. │
└───────────────┬──────────────────────────────────────────────┬────────┘
│ host.call (dynamic) / fetch (packaged RPC) │ client services
▼ ▼
┌────────────────────────── Host (Node) ────────────────────────┐
│ fs service resolves paths; subprocess service launches │
│ native commands; platform derived from processPath shape │
│ (the Host sandbox has no `process` global). │
└────────────────────────────────────────────────────────────────┘
Host RPCs:
| RPC / action | Purpose | Typical command |
|---|---|---|
open | Open with the default application | powershell Invoke-Item / open / xdg-open |
reveal | Reveal in the OS file manager | explorer.exe /select, / open -R / xdg-open |
editors | Detect installed editors + report host platform | PATH resolution + install-path probes |
openWith | Launch a detected editor with the file | <editor-exe> <path> |
openWithDialog | Windows "Open With" dialog | rundll32 shell32.dll,OpenAs_RunDLL |
The transport depends on the install form: the dynamic quick-install uses harness.handle (package-private RPC); the packaged form uses an HTTP RPC endpoint (POST /dsh-filemenu/rpc, registered on the webServer service, called with fetch). Both dispatch to the same actions above.
Editor detection resolves CLI names through subprocess.resolveExecutable (PATHEXT-aware on Windows — finds code.cmd etc.), traces a .cmd/.bat bin script back to the real GUI executable in its install directory, and probes known absolute install paths as a fallback.
EDITOR_SPECS table in plugin/host.js and mirror the entry in lib/index.js — each spec has commands (PATH-resolvable names), exeNames (GUI executables next to a bin/ script), and installs (absolute install paths).zh / en dictionaries in plugin/client.js.MENU_CSS (data-fm-theme="dark" block) in plugin/client.js.| Symptom | Check |
|---|---|
| Right-click does nothing | Is the plugin running (cordis_inspect_self)? Was the first Client activation approved? Try refreshing the page. Target a supported surface (produced chip / inline reference / workspace row / session row). |
| OS items are grayed out | canOpenPath = false — remote web access or a headless host cannot open paths natively. |
| Menu shows a red error | Read the message shown in the menu (e.g. sessions service unavailable); upgrade to the latest version if it references old field names. |
| Editor submenu is empty | The editor is not on PATH and not in a probed install location — add it to EDITOR_SPECS. |
| Menu does not follow the cursor | Use the latest version; earlier builds were missing the position: fixed styling. |
shell.overlay entry; all official slots (tool.call.toolview, conversation.chat.turnTail, the sidebar browser, …) are untouched.dsh plugin --profile desktop add dsh-filemenu) for the persistent npm package, or re-define the dynamic copy.dsh-filemenu/
├── README.md English documentation
├── README.zh-CN.md 中文文档
├── LICENSE MIT license
├── package.json package metadata (dsh.bundle / dsh.client declarations)
├── cordis.patch.yml composition row inserted by `dsh plugin add`
├── lib/
│ ├── index.js Host half — persistent profile plugin (webServer RPC)
│ └── client.js Client half — standard __ModuleLoader__ web bundle
└── plugin/
├── host.js Host half — dynamic quick-install copy (code.host)
└── client.js Client half — dynamic quick-install copy (code.client)
plugin/ holds the dynamic quick-install copies: plain JavaScript function bodies that return a Cordis plugin — no TypeScript, JSX, or bundler involved.lib/ holds the packaged halves used by Option B. lib/client.js is a standard web bundle (window.__ModuleLoader__.load, require('react'), manual stylesheet injection, fetch-based RPC).harness.handle / host.call; the packaged copy uses the HTTP RPC endpoint).Load the cordis-plugin-development skill in a DSH session for the full API surface used here (slots, harness, styles, theme).
Contributions are welcome — open an issue or a PR.
dsh plugin add) — v1.1.0dsh-filemenu@1.1.6)FAQs

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.