
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
dsh-rescue-toolbox
Advanced tools
DSH(DeepSeek Harness)因插件 fail-loud(一个插件坏了整个 DSH 起不来)而无法启动时的独立急救工具。
启动工具.bat 即可,浏览器操作,代码小白也能用。DSH 更新了插件 / 装了新插件之后突然启动崩溃(黑窗口一闪而过 / 网页打不开),多半是某条插件配置有问题。用它找出问题插件并禁用它,DSH 就能重新启动。
~/.dsh/profiles/*/cordis.patch.yml)中的插件条目,分三区展示:
- disable: 指令等不参与加载的条目,只读展示,防止误启用引发崩溃cordis.patch.yml.bak-时间戳),支持从任意备份点恢复双击 启动工具.bat,自动完成:检测 Node → 启动服务 → 打开浏览器 http://127.0.0.1:8765。
node server.mjs
# 然后浏览器打开 http://127.0.0.1:8765
npx dsh-rescue-toolbox
提示:
启动工具.bat为 GBK 编码,在中文版 Windows 上显示正常;英文版 Windows 下中文会乱码(可改用方式二/三)。
| 问题 | 处理 |
|---|---|
| 窗口提示"未找到 Node.js" | 先到 nodejs.org 安装 Node.js,再重新双击 |
| 浏览器打不开 / 连接被拒 | 确认窗口显示"工具箱已就绪",稍等片刻刷新 |
| 端口 8765 被占用 | 关闭其它工具箱实例后重试(服务只监听 127.0.0.1 本机) |
| 防火墙/安全软件提示 | 允许即可(仅本机回环访问,无网络风险) |
| 禁用后 DSH 还是起不来 | 用「恢复备份」还原,再逐个排查 |
dsh-rescue-toolbox/
├── server.mjs # 服务端(零依赖 Node,端口 8765)
├── 启动工具.bat # 双击启动脚本(GBK 编码,中文 Windows)
├── web/
│ ├── index.html # 界面
│ └── app.js # 前端逻辑
└── bin/
└── dsh-rescue-toolbox.mjs # npm 命令入口
DSH 的插件配置在 ~/.dsh/profiles/<profile>/cordis.patch.yml,加载器对坏插件是 fail-loud:某条插件 name 路径写错(如盘符路径缺 file:///)、指向的文件/包不存在,就会导致 DSH 整个无法启动。本工具逐条解析该文件并做最小诊断,把问题条目注释掉(# [已禁用])即可恢复启动;注释不删原内容,可随时还原。
MIT
FAQs
DSH 插件应急工具箱:DSH 因插件 fail-loud 无法启动时的独立急救工具(诊断问题插件 + 禁用 + 备份恢复)
The npm package dsh-rescue-toolbox receives a total of 0 weekly downloads. As such, dsh-rescue-toolbox popularity was classified as not popular.
We found that dsh-rescue-toolbox demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.