
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
openharness-core-rule
Advanced tools
DSH plugin that injects the project's core underlying rules (分阶段/先问/UI 优先) as a high-priority system prompt and shows a「核心铁律」row in the web settings sidebar.
一个 DeepSeek Harness(dsh)插件:往系统提示词注入「核心底层要求 · 五条铁律」的高优先级规则 (分阶段完成、有问题先问、UI 优先、可见即验收、用户确认才算完成),并在 dsh 设置页侧边栏显示「核心铁律」一项。
ctx.systemPrompt.section({ name, order: 44, text }) 注入规范(真实逻辑);settings.section 槽,显示侧边栏项(写法与已发布的公开插件 openharness-reply-in-cn / openharness-rule-for-dsh-plugin 完全同构,仅 id/label 不同)。对使用者:注入的规则正文是自包含、环境无关的——就是本仓库
000-core-rule.md的完整内容,不依赖任何本地目录或私有资料。任何安装此插件的人都能读到同样明确、可执行的铁律。
src/host/index.ts)export const inject = ['systemPrompt'] // 申报依赖,否则 boot 崩
export const name = 'openharness-core-rule'
export function apply(ctx, config) {
if (config?.enabled === false) return // 可通过 patch 关闭
const disposer = ctx.systemPrompt.section({
name: 'openharness:core-rule',
order: 44, // persona(0) 之后、工具引导(100+)之前
text: (context) => (context.agent === undefined ? '' : <五条铁律正文>),
})
return () => disposer?.() // apply 返回 disposer,卸载时清理
}
order:44,落在 persona(0)之后、工具引导 section(100+)之前,与同层级的其它已安装 section(如 openharness-reply-in-cn 的 45、openharness-rule-for-dsh-plugin 的 46)互不影响。ruleText,完整对应仓库 000-core-rule.md 的五条铁律。context.agent 存在)才渲染,不污染非 agent 的 assemble 调用。验证注入是否生效:在对话框直接问「系统提示里有没有『核心底层要求』『UI 优先』这条」——模型能复述即注入成功。
src/client/index.ts)slots.inject('settings.section', () => slots.register(
{ name: 'settings.section', id: 'openharness-core-rule', order: 20, label: () => '核心铁律' },
Section,
))
settings.section 是 list 槽:多个插件同时注册不冲突、都会显示(与「中文回复」/「插件开发规范」并列)。openharness-reply-in-cn 同样式(同构写法,该插件已发布为公开 npm 包),只是 id/label 不同。这是调试中最隐蔽的坑之一(安装任何 DSH client 插件后漏看新项的最常见原因)。现象:client bundle 结构完全一致、进了 boot 图、rev 也更新了,但新加的侧边栏项就是看不到。
根因:
rev(内容哈希)缓存在 webview 内存里;后端重启、rev 变后,webview 仍用旧的,拿不到新插件/新 bundle。正确做法:
client.js?rev=<新>。lib/client.js 结构是否与已验证的一致 + boot 图是否引用它 + rev 是否更新 → 三者都对却看不到 → 先彻底重启 webview 再看。# 当前依赖目录(开发):
dsh plugin --profile web add ./openharness-core-rule
# 或发布后按名装:
dsh plugin --profile web add openharness-core-rule
装完彻底退出 app 重开(见上文缓存坑)。
pnpm install # 生成 node_modules(含 esbuild / typescript)
pnpm build # 产出 lib/index.js(host)+ lib/client.js(client)
package.json:
dsh.bundle.patch: ./cordis.patch.yml(插入插件行)dsh.client.platform: "web"(声明 client 半)exports["./client"] → lib/client.js(浏览器 bundle)main → lib/index.js(host)openharness-core-rule/
├── 000-core-rule.md # 规则正文源(五条铁律)
├── src/host/index.ts # 注入「核心底层要求」system-prompt section(order 44)
├── src/client/index.ts # 注册 settings.section 侧边栏项「核心铁律」
├── build.mjs # esbuild 双半打包
├── package.json # dsh bundle + client 声明 + exports
├── cordis.patch.yml # 插入插件行
└── tsconfig.json
FAQs
DSH plugin that injects the project's core underlying rules (分阶段/先问/UI 优先) as a high-priority system prompt and shows a「核心铁律」row in the web settings sidebar.
We found that openharness-core-rule demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.