api-relay-audit
toby-bridges
Local security audit for AI API relays and LLM proxies: detects prompt injection, model substitution, tool-call rewriting, SSE anomalies, error leakage, and Web3 wallet risks.
PROJECT TOPICS
INSTALL REFERENCE
dsh plugin --profile web add github:9087/dsh-diff-approval
该命令指向仓库当前默认分支;尚无绑定当前 commit 的完整验证结果。
PROJECT README
English | 中文
A DeepSeek Harness (DSH) plugin for pending-change review: it automatically tracks every successful edit, write, and editor (str_replace_editor) mutation, folds them into a single pending list in the sidebar where each file's diff can be reviewed and kept/reverted — and it can also import the workspace's version-control repository's local changes (Git / SVN / Perforce) in one click.

The panel also collapses its file list into a floating card; while floating, each of its four edges — the left sidebar, the header above, the right sidebar, the composer below — can be chosen to be covered (all four is what used to be fullscreen, and covering nothing is a plain floating card), and it can dock as a tab in the right sidebar:
Two entries open it: the row at the sidebar foot, and a button in the Session header's right-hand controls — the cluster the app keeps its own per-session actions in (where "Download session log" lives) — so the review stays one click away with the sidebar collapsed or hidden.
| Collapsed file list | Covering everything |
|---|---|
![]() |
![]() |
For Markdown files, the source-line diff can also be shown as a rendered before/after preview:

Ctrl+F, step with F3 / Shift+F3) that highlights matched words. Rows are virtualized, so huge files stay smooth.Ctrl+↑/↓ (or the previous/next buttons) — the focused block flashes, navigation is anchored to the scroll position and wraps at the top/bottom. Hover a block to Keep or Revert just that block from a small actions frame that also shows its position (e.g. "2/5"); after a single-block decision, focus advances to the next block. The lead rows left above the jumped-to block are configurable in settings.Ctrl+Z / Ctrl+Shift+Z (rebindable in Shortcuts; Ctrl+Y remains an alias), active while the panel is open — text inputs keep their own editing.Ctrl+D (configurable in settings) toggles the review panel from anywhere and Esc closes it; the panel is also one click away from the sidebar-foot row and from a button in the Session header beside the app's own controls; Ctrl+Tab / Ctrl+Shift+Tab cycle through the pending files.(file:line) / (file:start-end) reference; click it (or press Ctrl+L) to copy, and with the setting on it auto-pastes into the composer and focuses it. References in the composer and queued messages are auto-aligned when the referenced file changes: surviving lines re-map to their new range, and a fully-removed line becomes (file:LINE_MISSING).Preview / Source). The preview content max width is configurable.git diff HEAD view), plus deleted files and, opt-in, files the VCS has never seen (untracked / unversioned). The VCS root is found by walking up from the workspace, so a workspace inside a subdirectory works too.<dshHome>/diff-approval/workspaces/<workspaceId>.json and survives restarts — unhandled changes are still there when you come back, even in a fresh session.If dsh is on your PATH:
dsh plugin --profile web add dsh-diff-approval
Or, if you run the harness through npx (e.g. npx @deepseek-ai/dsh web):
npx @deepseek-ai/dsh plugin --profile web add dsh-diff-approval
or manually: add the package to your profile's package.json dependencies and insert this row into the profile's cordis.patch.yml:
- insert:
- id: diff-approval
name: dsh-diff-approval
# Optional: relocate durable pending state (defaults to
# <dshHome>/diff-approval/workspaces).
# config:
# storageDir: ~/dsh-pending
Then restart dsh web.
edit / write / editor (str_replace_editor) calls are recorded automatically.edit, write, and str_replace_editor editor calls) are recorded automatically. Deletions made outside these tools (e.g. shell rm) are sensed only for tracked files: the entry turns "File is gone" and its Revert restores the file.PATH. Including files version control has not seen (default off) scans the whole workspace, which can be slow on large trees.dsh-footer-order plugin when it is present.corepack pnpm install
pnpm run typecheck # tsc over both faces
pnpm run build # emits lib/index.js and lib/client.js
pnpm test
pnpm run fonts:check # the bundled code font: 138 slices, every range covered exactly once
pnpm run fonts:plan # what a page actually downloads, by how many hanzi it shows
The bundled font is JetBrains Maple Mono (SIL OFL 1.1), subset and sliced by scripts/fonts — see assets/fonts/README.md for the pipeline, the licence and what the slices cost.
A file: profile install copies what the package's files list named at install time, so a checkout whose list grew needs a refresh before the host can hand the new files out:
npx @deepseek-ai/dsh plugin --profile web install # then restart `dsh web`
Only the client half reloads on its own (its bundle is watched), so a client change shows up on a page refresh while a host-half change — like the route that serves the font — waits for the restart.
CLASSIFICATION EVIDENCE
系统优先读取 GitHub Topics,再与站内分类词典和词根规则比对。当前命中: ai-coding、approval。