
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
dsh-voice-kit
Advanced tools
Voice input (Web Speech API) and read-aloud (speechSynthesis) for the DeepSeek Harness web GUI — DSH 语音输入 + 回复朗读套件
Voice input and read-aloud for the DeepSeek Harness web GUI.
Status: v0.4.0, published on npm —
pnpm typecheckpasses, 239 unit tests pass,pnpm buildemits the ecosystem-standard closure-factory bundle (host half + browser half). Verified inside a real DSH Desktop profile. Install:dsh plugin add dsh-voice-kit.
Esc cancels; stop anytime.msedge-tts and cached; connects through the system proxy
tunnel automatically on censored networks.audio/speech; direct from mainland China, no proxy needed) — reuses the
same credential you already set up for speech recognition.# from npm (recommended)
dsh plugin add dsh-voice-kit
# or from a local checkout
dsh plugin --profile desktop add link:/path/to/dsh-voice-kit
Restart DSH Desktop and refresh the web GUI.
Open Settings → Voice → Read aloud:
💡 Cloud TTS and recognition share one credential: configure voice input first and read-aloud needs nothing more.
Open the 🎤 in the composer:
Esc) to stop; the transcript is
appended to the draft.| Problem | Fix |
|---|---|
| No audio | Check the engine is reachable; Microsoft needs a proxy, cloud needs a key, system always works |
| Long text starts slowly | Optimized to ~1s to first audio; update to 0.4.0 if slower |
| Key shows "saved" but no effect | Key lives host-side; restart and press "Play test" again |
| No transcript on voice input | Confirm host-side recognition is configured |
# from npm (after publish)
dsh plugin add dsh-voice-kit
# or from a local checkout (development)
dsh plugin --profile desktop add link:/path/to/dsh-voice-kit
Restart the harness, refresh the web GUI.
pnpm install
pnpm typecheck # tsc --noEmit
pnpm test # vitest (markdown stripping / chunking / concurrent prefetch)
pnpm build # tsdown → lib/index.js (host) + lib/client.js (browser)
Build pipeline is the ecosystem-standard closure-factory bundle
(window.__ModuleLoader__.load) driven by shared/tsdown.client.ts
(adapted from the official DeepSeek Harness packages/client/tsdown.client.ts,
MIT; libExternal option from the dsh-web-ui family bucket, Apache-2.0).
MIT. The bundled shared/tsdown.client.ts adapts official DSH build tooling
(MIT) plus the dsh-web-ui libExternal option (Apache-2.0); see the file header.
FAQs
Voice input (Web Speech API) and read-aloud (speechSynthesis) for the DeepSeek Harness web GUI — DSH 语音输入 + 回复朗读套件
The npm package dsh-voice-kit receives a total of 0 weekly downloads. As such, dsh-voice-kit popularity was classified as not popular.
We found that dsh-voice-kit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.