
Security News
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
dsh-session-search-plus
Advanced tools
DSH 会话搜索框增强:自建高速内存索引(持久化增量缓存,热启动 ~90ms)+ /api/search-plus 路由,接管官方侧栏搜索框(vscode 风格 Aa/ab/.*/fz 模式开关、多命中下拉、锚点跳转高亮)
中文:README.zh.md
In-place upgrade of the official DSH sidebar search box: a private in-memory index answers in milliseconds, and the search UI follows VS Code.
Aa case-sensitive,
ab whole word (pnpm no longer hits npm), .* regex, fz fuzzy
subsequence. ab stacks with .* (the pattern is wrapped in \b); fz is
exclusive with ab / .*. All off by default (plain substring).▾ N at the end of the row; expand to list every hit (up to 8,
identical snippets deduped). Several dropdowns can stay open at once. The
clicked hit row takes the selection background (the session header does not);
that dropdown's indent guide stays on; hovering the result list reveals the
guides on the other open dropdowns.The official expand animation, in-place results replacing the session list, and Esc / outside-click collapse stay as they are.
The stock sidebar search box is the entry; there is no extra panel.
Aa / ab / .* / fz at the right end of the input when needed.
With fz on there is usually no contiguous string to mark in the page, so
the view only scrolls near the hit.▾ N on a multi-hit session and click a row to jump to that message.src/index.ts): builds the in-memory index at boot, then keeps
it incremental through the session/event feed with (sessionId, seq)
deduplication. Serves
POST /api/search-plus/query (substring / fuzzy subsequence / regex, with
case and whole-word flags, per-session windowed snippets and match offsets).
Host-half changes need a dsh restart.src/doc-cache.ts): the boot build reads the cache first,
then reconciles it against listSnapshots() — one cheap change token per
session. An unchanged revision reuses cached documents with zero log reads; a
changed or uncached session is re-read; a session gone from disk is dropped.
The cache is republished by atomic write once the build finishes.src/doc-scan.ts): scans each session's verbatim
artifact line by line, skipping packed storage rows such as text-chunks.
That avoids all delta unpacking the logical read path performs (on this
machine 232k physical lines expand to 1.79M logical events, none of which the
index needs).src/client/): a fork of official
@deepseek-ai/dsh-client-ui-workspace@0.1.0-rc.6 WorkspaceBrowser. Unmodified
regions stay byte-identical to the official bundle; every change is marked
// [search-plus]. An official upgrade requires re-porting against the new
baseline. Content queries go to /api/search-plus/query; title matching
stays on the client. A page reload only picks up the frontend.Boot warmup of the official index lives in the sibling dsh-session-search-warmup: it commits the official SQLite FTS5 index during the quiet boot window so the official search surface this plugin does not take over (rail mode, fallback paths) works on first query. The two compose; neither requires the other.
dsh plugin --profile web add dsh-session-search-plus
Or manually: add this package to the web profile's dsh.profile.bundles,
install dependencies, restart dsh web.
Do not also insert a session-search-plus row into
~/.dsh/profiles/web/cordis.patch.yml — the loader refuses duplicate insert
ids. The fork replaces the official search slots, so the profile must also
disable the official ui-workspace row (same cordis.patch.yml).
dsh --profile web --dump-config # shows the session-search-plus row
After boot, watch the host log for:
[search-plus] content index ready: N docs, A sessions from cache, B re-read in Xms
On the first boot A is 0 (cold build). On any later restart with no session
changes, A equals the session count, B is 0, and the time drops to
hundreds of milliseconds. Then type into the sidebar search box: content hits
with colored snippets and per-session dropdowns confirm the takeover.
Both keys are optional and rarely need changing:
| Key | Default | Meaning |
|---|---|---|
cachePath | <harness home>/session-search-plus-cache.json.zstd | Cache file location |
rawScan | true | Read verbatim artifacts. Set false to force the logical event read (~6x slower); only needed if the harness changes how storage rows are packed |
The cache file is around 240 KB and safe to delete at any time — the next boot rebuilds it. Corruption, a version mismatch, or a failed write all degrade to a cold build without affecting startup.
dsh plugin --profile web remove dsh-session-search-plus
Restart dsh and restore the official ui-workspace row that the profile had
disabled. Sidebar search returns to the stock implementation.
fz defaults off: a fuzzy subsequence hit may contain no contiguous query
string, so the page has nothing to mark.pnpm install
pnpm bundle
pnpm test
FAQs
DSH 会话搜索框增强:自建高速内存索引(持久化增量缓存,热启动 ~90ms)+ /api/search-plus 路由,接管官方侧栏搜索框(vscode 风格 Aa/ab/.*/fz 模式开关、多命中下拉、锚点跳转高亮)
We found that dsh-session-search-plus demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.