deepseek-cli-mode 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -0,0 +1,28 @@
+# Changelog
+
+## 1.0.1 — security fixes
+
+Fixes from an independent security audit (Cloudflare `security-audit` skill, quick profile).
+
+### Fixed
+
+- **Repository-local runtime execution (Medium).** `resolveDshBin()` no longer considers
+  `process.cwd()/node_modules/@deepseek-ai/dsh` or a cwd-based `require` resolution. Running `deepseek` inside an
+  untrusted repository can no longer execute that repository's own Harness copy. A project-local runtime is available
+  only with the explicit `DSH_CLI_ALLOW_LOCAL=1` opt-in, and the resolved package's manifest must declare
+  `name: "@deepseek-ai/dsh"`.
+- **One-shot plan-review auto-approval (Medium).** Non-interactive runs no longer select the first option of a
+  question. They now answer with a refusal, which keeps plan mode active instead of approving a plan no human
+  reviewed.
+- **Terminal escape injection (Medium).** Model- and repository-derived text (assistant output, tool-call previews,
+  todo items, reasoning, question fields, error messages, and the one-shot answer) is stripped of C0/C1 control
+  characters before it reaches the terminal.
+
+### Changed
+
+- `DSH_CLI_ALLOW_LOCAL=1` is a new opt-in for executing a runtime installed inside the current project.
+
+## 1.0.0 — first public release
+
+- Interactive terminal mode for DeepSeek Harness: streaming, tools, approvals, plan mode, goals, compaction, skills,
+  jobs, todos, subagents, image/file attachments, session resume, and `/export`.

package/README.md

@@ -152,6 +152,7 @@ when a tool wants to leave the workspace or act outside the sandbox policy.
 | `DSH_HOME` | `~/.dsh` | Harness home (profiles, sessions, credentials) |
 | `DEEPSEEK_API_KEY` | stored key | API key override |
 | `DSH_CLI_DSH_BIN` | auto-detected | explicit path to `@deepseek-ai/dsh/lib/bin.js` |
+| `DSH_CLI_ALLOW_LOCAL` | unset | `1` allows executing a dsh installed inside the current project; leave unset in untrusted repositories |
 | `DSH_PERMISSION_MODE` | `workspace-write` | `read-only` \| `workspace-write` \| `danger-full-access` |
 | `DSH_CLI_REASONING` | unset | `1` streams reasoning text instead of collapsing it |
 | `DSH_CLI_YES` | unset | `1` auto-approves tool actions (same as `--yes`) |

package/bin/deepseek.js

@@ -89,15 +89,17 @@ function resolveDshBin() {
     process.env.npm_config_prefix ? join(process.env.npm_config_prefix, "node_modules", "@deepseek-ai", "dsh", "lib", "bin.js") : undefined,
     join(homedir(), "node_modules", "@deepseek-ai", "dsh", "lib", "bin.js"),
     join(homedir(), ".npm-global", "node_modules", "@deepseek-ai", "dsh", "lib", "bin.js"),
-    join(process.cwd(), "node_modules", "@deepseek-ai", "dsh", "lib", "bin.js"),
   ].filter(Boolean);
-  for (const candidate of candidates) if (existsSync(candidate)) return candidate;
-  // Resolve like a normal import from this package, then from the cwd.
-  for (const req of [requireFromHere, createRequire(join(process.cwd(), "resolve-dsh.js"))]) {
-    try {
-      return req.resolve("@deepseek-ai/dsh/lib/bin.js");
-    } catch {}
+  // A project-local runtime is OPT-IN: running the CLI inside an untrusted
+  // repository must never execute repository-supplied code implicitly.
+  if (process.env.DSH_CLI_ALLOW_LOCAL === "1") {
+    candidates.push(join(process.cwd(), "node_modules", "@deepseek-ai", "dsh", "lib", "bin.js"));
   }
+  for (const candidate of candidates) if (existsSync(candidate)) return candidate;
+  // Resolve only from this package's own module graph (never from cwd).
+  try {
+    return requireFromHere.resolve("@deepseek-ai/dsh/lib/bin.js");
+  } catch {}
   // Last resort: ask npm where its global root is (covers custom prefixes).
   try {
     const npmCli = join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
@@ -208,7 +210,21 @@ if (dshBin === undefined) {
   process.exit(1);
 }
 
-const dshVersion = readVersion(join(dshBin, "..", "..", "package.json"));
+// Verify the resolved package really is the Harness runtime before executing
+// it. This blocks a path that merely exists at a trusted prefix but is not dsh.
+let dshManifest;
+try {
+  dshManifest = JSON.parse(readFileSync(join(dshBin, "..", "..", "package.json"), "utf8"));
+} catch {}
+if (dshManifest?.name !== "@deepseek-ai/dsh") {
+  console.error(
+    `deepseek: resolved ${dshBin} is not @deepseek-ai/dsh (found ${JSON.stringify(dshManifest?.name ?? "no manifest")}).\n` +
+      "  Point DSH_CLI_DSH_BIN at a real @deepseek-ai/dsh/lib/bin.js."
+  );
+  process.exit(1);
+}
+
+const dshVersion = String(dshManifest.version ?? "0.0.0");
 if (compareVersions(dshVersion, DSH_MIN) < 0) {
   console.error(
     `deepseek: @deepseek-ai/dsh ${dshVersion} is too old for this CLI (needs >= ${DSH_MIN}).\n` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepseek-cli-mode",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Terminal (CLI) mode for DeepSeek Harness — an interactive, Claude Code-style coding agent for your shell.",
   "type": "module",
   "main": "index.js",
@@ -13,6 +13,7 @@
     "bin",
     "runner",
     "docs",
+    "CHANGELOG.md",
     "index.js",
     "README.md"
   ],

package/runner/runner.js

@@ -73,6 +73,16 @@ function formatTokens(n) {
   return String(n);
 }
 
+// C0/C1 control characters (except newline and tab). Model- and
+// repository-derived text must never reach the terminal verbatim: ESC/OSC/CSI
+// sequences enable title spoofing, clipboard writes, and forged prompts.
+const CONTROL_CHARS = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g;
+
+/** Strip terminal control characters from untrusted text. */
+function sanitize(text) {
+  return String(text).replace(CONTROL_CHARS, "");
+}
+
 // ---------------------------------------------------------------------------
 // Markdown-lite line formatter (tty only; piped output stays raw)
 // ---------------------------------------------------------------------------
@@ -123,16 +133,16 @@ function previewToolCall(name, rawArgs) {
   try {
     args = JSON.parse(rawArgs);
   } catch {
-    return truncate(rawArgs ?? "", 80);
+    return sanitize(truncate(rawArgs ?? "", 80));
   }
   if (args === null || typeof args !== "object") return "";
   const pick = args.path ?? args.file_path ?? args.filePath ?? args.command ?? args.cmd
     ?? args.pattern ?? args.query ?? args.url ?? args.description ?? args.task ?? args.id;
   if (typeof pick !== "string") {
     const json = JSON.stringify(args);
-    return json && json !== "{}" ? truncate(json, 80) : "";
+    return json && json !== "{}" ? sanitize(truncate(json, 80)) : "";
   }
-  return truncate(pick.replace(/\s+/g, " "), 90);
+  return sanitize(truncate(pick.replace(/\s+/g, " "), 90));
 }
 
 // ---------------------------------------------------------------------------
@@ -164,7 +174,7 @@ function createRenderer({ write, capture }) {
 
   const feed = (text) => {
     if (capture) return;
-    buffer += text;
+    buffer += sanitize(text);
     let index;
     while ((index = buffer.indexOf("\n")) !== -1) {
       const line = buffer.slice(0, index);
@@ -220,9 +230,10 @@ function createRenderer({ write, capture }) {
           streamedThisTurn = true;
           feed(chunk.text);
         } else if (chunk.type === "reasoning-delta") {
-          reasoning += chunk.text;
+          const safe = sanitize(chunk.text);
+          reasoning += safe;
           if (showReasoning && !capture) {
-            write(paint(ansi.dim, paint(ansi.italic, chunk.text)));
+            write(paint(ansi.dim, paint(ansi.italic, safe)));
             lineDirty = true;
           }
         }
@@ -242,7 +253,7 @@ function createRenderer({ write, capture }) {
         }
         case "tool/result": {
           if (data.error) {
-            write(paint(ansi.dim, paint(ansi.italic, `  ✗ ${data.error.name}: ${data.error.code}`)) + "\n");
+            write(paint(ansi.dim, paint(ansi.italic, `  ✗ ${sanitize(data.error.name)}: ${sanitize(data.error.code)}`)) + "\n");
           }
           break;
         }
@@ -279,7 +290,7 @@ function createRenderer({ write, capture }) {
                 : todo.status === "in_progress"
                   ? paint(ansi.yellow, "▸")
                   : paint(ansi.dim, "☐");
-            const content = todo.status === "completed" ? paint(ansi.dim, todo.content) : todo.content;
+            const content = todo.status === "completed" ? paint(ansi.dim, sanitize(todo.content)) : sanitize(todo.content);
             write(`    ${mark} ${content}\n`);
           }
           break;
@@ -290,7 +301,7 @@ function createRenderer({ write, capture }) {
           const kind = data.reason?.kind;
           lastTurnKind = kind;
           if (kind === "error") {
-            write(paint(ansi.red, `  ⚠ turn failed: ${data.reason.error?.message ?? "unknown error"}\n`));
+            write(paint(ansi.red, `  ⚠ turn failed: ${sanitize(data.reason.error?.message ?? "unknown error")}\n`));
           } else if (kind === "max-tokens") {
             write(paint(ansi.yellow, "  ⚠ hit the output-token ceiling\n"));
           } else if (kind === "aborted") {
@@ -743,15 +754,21 @@ async function run(ctx, options, exit) {
     const questions = request?.questions ?? [];
     for (const question of questions) {
       out("\n");
-      if (question.header) out(paint(ansi.bold, `  ${question.header}`) + "\n");
-      out(`  ${question.question}\n`);
-      if (question.detail) out(paint(ansi.dim, question.detail.replace(/^/gm, "  | ")) + "\n");
+      if (question.header) out(paint(ansi.bold, `  ${sanitize(question.header)}`) + "\n");
+      out(`  ${sanitize(question.question)}\n`);
+      if (question.detail) out(paint(ansi.dim, sanitize(question.detail).replace(/^/gm, "  | ")) + "\n");
       const options = question.options ?? [];
       options.forEach((option, index) => {
-        out(`   ${paint(ansi.cyan, String(index + 1))}) ${option.label}${option.description ? paint(ansi.dim, ` — ${option.description}`) : ""}\n`);
+        out(`   ${paint(ansi.cyan, String(index + 1))}) ${sanitize(option.label)}${option.description ? paint(ansi.dim, ` — ${sanitize(option.description)}`) : ""}\n`);
       });
       if (!interactive) {
-        answers.push({ id: question.id, selected: options[0] ? [options[0].label] : [], custom: options[0] ? undefined : "one-shot mode: no interactive answer" });
+        // A non-interactive run has no human: never synthesize consent. The
+        // plan-review gate in particular must stay closed.
+        const refusal =
+          question.intent?.kind === "plan-review"
+            ? "non-interactive run: plan review requires a human; staying in plan mode"
+            : "non-interactive run: this question needs an interactive terminal";
+        answers.push({ id: question.id, selected: [], custom: refusal });
         continue;
       }
       const answer = await ask(paint(ansi.green, options.length > 0 ? "  choose: " : "  answer: "));
@@ -1027,7 +1044,10 @@ async function run(ctx, options, exit) {
     }
     await runTurn(agent, task);
     const answer = renderer.lastAssistantText;
-    if (answer !== "") process.stdout.write(answer.endsWith("\n") ? answer : answer + "\n");
+    if (answer !== "") {
+      const safeAnswer = sanitize(answer);
+      process.stdout.write(safeAnswer.endsWith("\n") ? safeAnswer : safeAnswer + "\n");
+    }
     await shutdown(renderer.lastTurnKind === "completed" ? 0 : 1);
     return;
   }
@@ -1136,7 +1156,7 @@ async function run(ctx, options, exit) {
         case "/thinking": {
           const reasoning = renderer.lastReasoning;
           if (reasoning === "") out(paint(ansi.dim, "  no reasoning recorded yet\n"));
-          else out(paint(ansi.dim, paint(ansi.italic, reasoning)) + "\n");
+          else out(paint(ansi.dim, paint(ansi.italic, sanitize(reasoning))) + "\n");
           continue;
         }
         case "/image": {
@@ -1261,7 +1281,7 @@ async function run(ctx, options, exit) {
       }
     }
 
-    out("\n" + paint(ansi.green, "❯ ") + text + "\n\n");
+    out("\n" + paint(ansi.green, "❯ ") + sanitize(text) + "\n\n");
     await runTurn(agent, text);
   }