
Security News
Rust 1.100 Will Add Dependency Cooldowns to Cargo
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.
dsh-ui-attention
Advanced tools
DSH web attention alerts: browser notification, beep, and tab-title flash when the page is not on top (questions, approvals, finished turns)
Repository: https://github.com/LeeKai233/dsh-ui-attention — npm: https://www.npmjs.com/package/dsh-ui-attention
Browser attention alerts for the DeepSeek Harness (DSH) web UI. Whenever the DSH page is not on top — the tab is hidden, the window is minimized, or another application covers it (document.hidden or !document.hasFocus()) — and something happens, this plugin fires:
(!) prefix alternating) while pending work awaits.It alerts on two event kinds: pending interactions (an ask_user_question
question, a plan waiting for approval, or a tool approval) and finished
turns (any session's turn ending), each once per turn with the session title
in the body. While the page is on top and focused, everything stays quiet.
It is a dual-face DSH plugin (dsh.client, platform web) shipped as a tiny
bundle: installing it composes it automatically.
dsh plugin --profile web add dsh-ui-attention
# restart dsh web once so the new bundle layer applies
dsh web
Or from a local checkout:
dsh plugin --profile web add file:/path/to/dsh-ui-attention
Then restart dsh web once: the bundle layer (and the plugin's Host half,
which registers the ui-attention settings namespace) applies at boot.
dsh pluginAs an ALTERNATIVE (not in addition!) to the bundle route, you can copy the
package into ~/.dsh/profiles/web/node_modules/ and insert the row into the
profile patch layer (~/.dsh/profiles/web/cordis.patch.yml):
- insert:
- id: ui-attention
name: "dsh-ui-attention"
Do not do both.
insertrows are not deduplicated by id across layers: the sameid: ui-attentioncoming from the bundle patch AND the profile patch makes the loader refuse to boot withduplicate loader entry id: ui-attention. Pick exactly one composition route.
default, the
row shows an enable hint and the plugin falls back to sound + title flash.The five switches (all default true) persist in the browser under the localStorage key dsh-ui-attention.settings:
| Field | Meaning |
|---|---|
| enabled | Master switch: popup, sound, and title flash all stay quiet when false |
| sound | Play the WebAudio beep |
| titleFlash | Flash the tab title while pending work is hidden |
| onlyWhenHidden | Applies to the CURRENT session: stay quiet while on top; other sessions always alert (false alerts even the current session on top) |
| notifyOnDone | Pop up and beep when a session's turn finishes |
Why browser-local instead of the Host settings document: the rc.6 web API gateway only exposes a hardcoded allowlist of settings namespaces to the browser (WEB_SETTINGS_NAMESPACES in packages/host/apiproxy/src/api-proxy.ts) and answers settings-not-exposed for anything else — exposing third-party namespaces via settings.register() is documented as deferred work. The Host node half still registers the ui-attention namespace server-side so the section lights up automatically once that upstream limitation is lifted.
ask_user_question), plan approvals
(plan-review intent), tool/command approvals (approval/requested), and
finished turns (any session's running flip).dsh --profile web)Published on npm as dsh-ui-attention (MIT). Future versions:
npm version patch # or minor / major
pnpm bundle && pnpm test
npm publish # --otp=<code> when the account enforces 2FA
The tarball ships the prebuilt lib/ plus the bundle patch, so consumers never need a build step.
pnpm install
pnpm test # vitest, TDD suite (T1-T17) + built-artifact smoke
pnpm bundle # tsdown -> lib/index.js (host) + lib/client.js (browser)
Architecture: attention-engine.ts is a pure state machine over the session
list (pending-interaction statuses plus running-edge turn-finished detection,
baseline seeding, per-turn dedupe, page-not-on-top gating); notifications.ts,
beep.ts, and title-flash.ts are the injectable platform wires;
client/index.ts assembles them over ctx.sessions.list and the
settings.general.item slot, persisting the switches in localStorage via the
runtime snapshot-store engine. The Host node half registers the
ui-attention settings namespace for future compatibility.
dsh plugin --profile web remove dsh-ui-attention
# plus: remove any manual `ui-attention` insert row from ~/.dsh/profiles/web/cordis.patch.yml
# then restart dsh web
MIT
FAQs
DSH web attention alerts: browser notification, beep, and tab-title flash when the page is not on top (questions, approvals, finished turns)
We found that dsh-ui-attention demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.