deskbuddy@0.2.2

把 Claude Code、Codex 等 AI 编码智能体每个会话窗口的状态，实时同步到桌面硬件屏幕

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The inspected source supports normal CLI and agent-session integration behavior, with no install-time attack or concrete malicious behavior identified. Similarity scanner hints alone do not establish an attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The CLI’s explicit enable or install commands activate agent integrations; no npm install lifecycle hook is present.

Impact

No confirmed unauthorized configuration change, credential transfer, or other attack effect was established from the inspected source.

Mechanism

The inspected excerpts cover protected agent paths, transcript reading, explicit integration setup, question handling, and HMAC checks.

AI rationale

Evidence

package.jsondist/cli.jsdist/chunk-Z3ZNXSVC.jsdist/hook.cjshook/hook.cjsdist/cbchannel.cjshook/cbchannel.cjs

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no install lifecycle hook; `prepublishOnly` runs checks and builds artifacts for publishing.
The flagged CLI code protects agent configuration paths, and the chunk resolves settings paths without showing a write at the indicated location.
The flagged hook code reads transcript tails; the paired `cbchannel` files identify an explicit enable command for terminal session integration.
The runtime hints cover question-answer handling and HMAC validation; the flagged `node-pty` files are terminal library code.
The hook uses a package-aligned default API host.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

Source & flagged code

20 flagged

dist/deskbuddy-dsh.mjsView file

Lines 1-35javascript

1// DeskBuddy 的 DeepSeek Harness（dsh）原生插件（spec 2026-10-03-deskbuddy-deepseek-harness-design）。

2// `deskbuddy enable deepseek_harness` 往 $DSH_HOME/cordis.patch.yml 追加一条 insert，name 是本文件的绝对路径；

3// 本文件随 hook.cjs / gate.cjs 一起同步到 ~/.deskbuddy/，CLI 升级即生效。

4//

5// 做的事和 opencode.mjs 一样只有翻译：dsh 的 Cordis 事件 → cc-hook 同构输入，喂同目录的 hook.cjs（状态）和 gate.cjs（设备确认）。

6//

7// 实测依据（dsh 0.2.0-rc.2，10-03 spike）：

8// - CC hooks 兼容插件在 `dsh web` 下静默不加载，只能走原生插件

9// - approval/request、user-questions/request 是串行瀑布：不调 next() 就挡住了原生界面。

10// 抢答做法：把 req.signal 换成 AbortSignal.any([原 signal, 自己的])，再 next() 让原生界面照常弹，同时推设备，谁先回用谁；

11// 设备先答就 abort 自己那个 —— web 的卡片立即消失（next() 随之 reject，要接住）。原生先答就结束 gate 子进程，daemon 撤设备卡片

12// - 审批请求不带工具参数，靠 callId 从先到的 tool/call 事件里补

13//

14// 🔴 窗口兜底方向：任何失败都交给原生界面（只调 next()），绝不替用户表态。

16import { spawn } from 'node:child_process'

17import { randomUUID } from 'node:crypto'

High

Child Process

Package source references child process execution.

dist/deskbuddy-dsh.mjsView on unpkg · L15

18import { appendFileSync, chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs'

19import { homedir } from 'node:os'

20import { dirname, join } from 'node:path'

21import { fileURLToPath } from 'node:url'

23const HERE = dirname(fileURLToPath(import.meta.url))

24const HOOK = join(HERE, 'hook.cjs')

25const GATE = join(HERE, 'gate.cjs')

26export const TOOL = 'deepseek_harness'

27/** 会话标题事后变了的伪事件名（与 hook.cjs / src/core/title.ts 的 TITLE_EVENT 一致）：只改标题、补报 */

28export const TITLE_EVENT = 'DeskBuddyTitle'

30/** hook.cjs 自己有 2 秒上报超时，这里再兜一层：一次卡死不能堵住后面所有状态 */

31const HOOK_KILL_MS = 10 * 1000

32/** 工具调用参数缓存时长：tool/call 记下，随后的审批请求靠它显示真实命令 */

33const CALL_TTL_MS = 10 * 60 * 1000

35/** 下发信箱：心跳间隔、轮询间隔（与 src/core/dshMailbox.ts 的约定一致：心跳 5 秒内算新鲜、≤1 秒取信） */

dist/chunk-Z3ZNXSVC.jsView file

7041contains invisible/control Unicode U+202A (left-to-right embedding) if (/[\u0000-\u001f\u007f-\u009f<U+200B>-<U+200F><U+202A>-<U+202E><U+2066>-<U+2069><U+FEFF>]/.test(x)) return null;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-Z3ZNXSVC.jsView on unpkg · L7041

•Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/chunk-Z3ZNXSVC.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-Z3ZNXSVC.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = deskbuddy@0.2.1 matchedIdentity = npm:ZGVza2J1ZGR5:0.2.1 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-Z3ZNXSVC.jsView on unpkg

50Cross-file remote execution chain: dist/chunk-Z3ZNXSVC.js spawns dist/cli.js; helper contains network access plus dynamic code execution. L50: } L51: function restrictMode(p, mode, platform = process.platform) { L52: if (platform === "win32") return; ... L61: var MAX_FOCUS_IDLE_SECONDS = 600; L62: function defaultRemoteCwd(home = homedir()) { L63: return process.env.DESKBUDDY_DEFAULT_REMOTE_CWD || join(home, "DeskBuddy"); L64: } ... L104: } L105: var PROD_API_BASE = "https://api.shifengintelli.com"; L106: var TEST_API_BASE = "https://test-api.shifengintelli.com"; ... L139: try { L140: fileValue = JSON.parse(readFileSync(configPath(), "utf8")).apiBase;

dist/cbchannel.cjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2'use strict'

3// CodeBuddy Code（WorkBuddy 的命令行）终端会话的「设备授权中继」（spec 2026-10-09 terminal-approvals §2）。

4//

5// 装法：deskbuddy enable workbuddy 时写进 ~/.codebuddy/.mcp.json（用户级 MCP），CodeBuddy 每个进程起一份本脚本（stdio MCP）。

6// 原理：CodeBuddy 2.161.1 认 MCP 服务声明的 experimental 能力 `claude/channel` + `claude/channel/permission`，

7// 交互窗口弹授权框时把同一个请求广播给声明了权限中继的服务（notifications/claude/channel/permission_request），

8// 与本地框【竞速】：哪边先答算哪边（源码 HandleInterruptions：Promise.race([本地, channel])）。

9// 不需要 --channels 参数（没给就不设白名单），微信 / 企微桥用的就是这条路。

10// 本脚本只做转发：请求 → daemon（/gate，挂着等设备）→ 设备答了 → notifications/claude/channel/permission 回 CodeBuddy。

dist/cli.jsView file

5947import { homedir as homedir4 } from "os"; L5948: import { basename as basename7, dirname as dirname3, join as join14, resolve as resolve4 } from "path"; L5949: L5950: // src/daemon/qwenworkLang.ts L5951: import { execFile as execFile2 } from "child_process"; L5952: import { open } from "fs/promises"; ... L5959: function qwenworkUserDataDir() { L5960: const forced = process.env.DESKBUDDY_QWENWORK_DATA; L5961: if (forced) return forced;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L5947

25554cleanup(); L25555: process.stderr.write(`deskbuddy: \u542F\u52A8 ${real2.file} \u5931\u8D25\uFF1A${e.message} L25556: `); ... L25567: // src/wrap/codexLaunch.ts L25568: import { execFileSync as execFileSync4, spawn as spawn4 } from "child_process"; L25569: import { closeSync as closeSync13, mkdirSync as mkdirSync16, openSync as openSync13, readdirSync as readdirSync18, readFileSync as readFileSync25, rmSync as rmSync16, statSync as s... L25570: import { request as request2 } from "http"; L25571: import { createServer as createServer5 } from "net";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L25554

25554Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli.js L25554: cleanup(); L25555: process.stderr.write(`deskbuddy: \u542F\u52A8 ${real2.file} \u5931\u8D25\uFF1A${e.message} L25556: `); ... L25567: // src/wrap/codexLaunch.ts L25568: import { execFileSync as execFileSync4, spawn as spawn4 } from "child_process"; L25569: import { closeSync as closeSync13, mkdirSync as mkdirSync16, openSync as openSync13, readdirSync as readdirSync18, readFileSync as readFileSync25, rmSync as rmSync16, statSync as s... L25570: import { request as request2 } from "http"; L25571: import { createServer as createServer5 } from "net";

vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/wake.cjsView file

•matchType = normalized_sha256 matchedPackage = deskbuddy@0.2.0 matchedPath = dist/wake.cjs matchedIdentity = npm:ZGVza2J1ZGR5:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High