
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
dsh-model-select-plus
Advanced tools
A calmer model-selection popup for DeepSeek Harness: provider/model chip with a separate reasoning-level chip beside it, provider-grouped rows at the native 34px rhythm, search and pinned favorites, replacing the composer's default ModelSelect.
对 DeepSeek Harness 网页端 模型选择弹窗(composer 左下角 conversation.input.model 座位)的信息增强式重写,打包为一个可安装、可发布到 npm 的 dsh 插件。
供应商/模型,供应商 11px 次级色,超宽时先省略供应商、保住模型名;等级在旁边的独立芯片里。↑ / ↓ 移动、Enter 选择、Esc 关闭;等级菜单同样支持 ↑ / ↓ 与 Esc。打开时按触发按钮在视口内的剩余空间决定向上/向下弹,收敛高度并把左右夹在视口内;浅色与深色都走主题令牌(深色下分段控件的滑块改用 active 填充),所有图标为手绘 SVG,不用文字字符充当图标。
把本包加进 dsh profile 的依赖即可(配合 dsh.bundle.patch 自动挂载 host / client 双侧):
# 在 dsh profile 目录里
pnpm add dsh-model-select-plus
# 或
npm i dsh-model-select-plus
重启 dsh web 后,composer 的模型选择框即被替换。
.)通过 cordis.patch.yml 挂载,向宿主 webserver 注册
GET /plugins/dsh-model-select-plus/api/catalog 与 POST /plugins/dsh-model-select-plus/api/select。./client)由 dsh.client 注入加载,替换 conversation.input.model 占位(priority: -1)。两个 API 都调用宿主的 ctx.sessionController——这是 0.1.2 里取代已删除 apiProxy.sessions 的 Remote 服务,modelCatalog() 列出当前可路由的模型目录,selectModel() 经 llm.resolveCallConfig 校验后设置会话 Agent 的实时选择引用并保存默认模型。
浏览器 (client bundle)
└─ fetch /plugins/dsh-model-select-plus/api/{catalog,select}
└─ host plugin (ctx.webServer) → ctx.sessionController.{modelCatalog,selectModel}
(持久化插件避免动态插件的 harness/host 内建,采用与 plugin-dashboard 相同的 webserver+fetch 模式。)
pnpm install # workspace 安装
pnpm run build # esbuild 打包 src/client.js → lib/client.cjs,并拷贝 host 到 lib/
pnpm run smoke # 校验 lib/ 产物
lib/ 为构建产物、已被 .gitignore 忽略;npm publish 会在 prepublishOnly 阶段自动构建。
# 首次:登录
npm login
# 在包目录
npm publish
publishConfig 已设为 access: public + registry: https://registry.npmjs.org/。
MIT
FAQs
A calmer model-selection popup for DeepSeek Harness: provider/model chip with a separate reasoning-level chip beside it, provider-grouped rows at the native 34px rhythm, search and pinned favorites, replacing the composer's default ModelSelect.
We found that dsh-model-select-plus demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.