registry / @feiyang666/dsh-mobile-remote / 1.7.0

@feiyang666/dsh-mobile-remote@1.7.0

⚠ Under review

DeepSeek Harness mobile remote-control plugin: LAN/external remote control (QR / on-off toggle / remote-access password gate), rich telemetry (expandable device details, system CPU/memory/load, DSH app state: version/sessions/workspaces/plugins/models), r

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 223 KB of source, external domains: api.deepseekharness.desktop.cwj666.top, www.w3.org

Source & flagged code

7 flagged

lib/index.jsView file

Lines 14-54javascript

14//

15// 为什么命令行启动也能远程控制（不需要桌面端）：

16// 官方 CLI 出于安全拒绝 `--host 0.0.0.0`（见 dsh-web-app/startup.ts），但

17// 官方 `--patch <overlay>` / profile 的 cordis.patch.yml 配置层完整支持

18// `webserver.host: 0.0.0.0`，且 profile patch 由 app-boot 的 watchUserPatches

19// 通过 Cordis HMR 热重载。因此本插件在设置页切换开关 = 写入 / 移除 profile

20// patch 的 webserver 行，即可让 dsh 重新监听所有网卡——与桌面端 `--patch`

21// overlay 机制一致，官方 CLI 用户无需安装桌面端。

22//

23// 零运行时依赖（除 lib/qrcode.js 内联的 MIT QR 生成器）：

24// 不 import 任何 dsh-client / dsh-host 内部包，仅使用 Node 内置模块与

25// webServer 服务公开的 tapIndex / register 接口。

27import {

28 networkInterfaces, homedir, hostname, cpus, totalmem, freemem,

29 platform, release, arch, loadavg, uptime as osUptime,

30} from 'node:os'

31import { join, dirname } from 'node:path'

32import {

33 existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, rmSync,

34} from 'node:fs'

35import { spawn } from 'node:child_process'

36import qrcode from './qrcode.js'

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L34

37import {

38 startExternal, stopExternal, externalView,

39 autoRestoreExternal, loadPersistedState, DEFAULT_SERVER_BASE,

40 frpcLogTail,

41} from './external.js'

42import {

43 hasPassword, verifyPassword, setPassword,

44 isEnabled, login, verifyToken, revokeToken, clearSessions,

45} from './password.js'

47/** 插件名（loader 诊断用）。 */

48export const name = 'dsh-mobile-remote'

50/** 依赖 dsh-host-webserver 注入的 webServer 服务，保证 tapIndex / register 可用。 */

51export const inject = ['webServer']

53/** 移动端断点：与 DSH 原生 SIDEBAR_AUTO_COLLAPSE = 1024 对齐。 */

54const MOBILE_MAX_WIDTH = 1024

lib/external.jsView file

Lines 1-44javascript

1// dsh-mobile-remote — 外网隧道管理模块（host 侧）。

2//

3// 负责把"外网访问"做成一个开关：

4// - 从中转服务（dsh-update-server）通过绑定码换取 frpc 配置 + 外网链接

5// - 下载/定位 frpc 可执行文件，写入 frpc.toml 并启动子进程

6// - 写 profile 的 connection trustedHosts，放行外网域名（通过 /api 信任围栏）

7// - 心跳上报、状态查询、停止

8//

9// 运行时依赖：Node 内置模块 + `ws`（WebSocket 长连接接收中转服务状态推送，

10// 替代高频轮询；ws 依赖缺失时自动回退 HTTP 低频查询）。frpc 二进制由中转服务提供或用户本地放置。

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

7 flagged · loading source

lib/index.jsView file

@feiyang666/dsh-mobile-remote@1.7.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code