dsh-lark-bot 0.14.0 → 0.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +56 -20
- package/SECURITY.md +15 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,3 +1,27 @@
|
|
|
1
|
+
> [!CAUTION]
|
|
2
|
+
> **⚠️ 官方渠道声明 · Official channels only**
|
|
3
|
+
>
|
|
4
|
+
> 唯一官方仓库是 [PlutoKeating/dsh-lark-bot](https://github.com/PlutoKeating/dsh-lark-bot)；唯一官方 npm 包是
|
|
5
|
+
> `dsh-lark-bot`（同源双包 `dsh-feishu-bot`，维护者 `plutokeating`）。**本项目从不提供 Windows 可执行文件
|
|
6
|
+
> （.exe），也没有任何“下载即运行”的安装包。** 任何以本项目名义提供 exe / “下载后双击运行”的页面、仓库或
|
|
7
|
+
> 第三方分发渠道（例如 `tarraencompassing61/dsh-lark-bot` 这类仿冒仓库）均为**假冒 / 恶意来源**——请勿下载
|
|
8
|
+
> 或运行其中的任何附件。官方安装唯一命令：
|
|
9
|
+
>
|
|
10
|
+
> `npx dsh-lark-bot@latest setup --profile dsh-lark`
|
|
11
|
+
>
|
|
12
|
+
> The **only official repository** is [PlutoKeating/dsh-lark-bot](https://github.com/PlutoKeating/dsh-lark-bot);
|
|
13
|
+
> the **only official npm packages** are `dsh-lark-bot` and `dsh-feishu-bot` (maintainer `plutokeating`).
|
|
14
|
+
> **This project never ships Windows executables (.exe) or any “download-and-run” installer.** Any page,
|
|
15
|
+
> repository, or third-party channel offering such downloads under this project’s name (including impostor
|
|
16
|
+
> repositories like `tarraencompassing61/dsh-lark-bot`) is a **counterfeit / malicious source** — do not download
|
|
17
|
+
> or execute anything from it. The only official install command:
|
|
18
|
+
>
|
|
19
|
+
> `npx dsh-lark-bot@latest setup --profile dsh-lark`
|
|
20
|
+
>
|
|
21
|
+
> 仿冒仓库停留在 v0.7.0 快照；正版版本差距见上方徽章。Evidence:
|
|
22
|
+
> [docs/security/2026-08-17-impostor-repo-evidence/](docs/security/2026-08-17-impostor-repo-evidence/README.md) ·
|
|
23
|
+
> Official download page: [docs/DOWNLOAD.md](docs/DOWNLOAD.md)
|
|
24
|
+
|
|
1
25
|
<h1 align="center">dsh-lark-bot</h1>
|
|
2
26
|
|
|
3
27
|
<p align="center">
|
|
@@ -11,6 +35,8 @@
|
|
|
11
35
|
<img src="https://img.shields.io/badge/License-AGPLv3-blue" alt="License">
|
|
12
36
|
<img src="https://img.shields.io/badge/status-released-blue" alt="Status">
|
|
13
37
|
<a href="https://dshfind.com/zh/plugins/PlutoKeating/dsh-lark-bot?ref=badge"><img src="https://dshfind.com/api/badge/PlutoKeating/dsh-lark-bot?lang=zh" alt="dshfind"></a>
|
|
38
|
+
<a href="https://github.com/PlutoKeating/dsh-lark-bot/releases"><img src="https://img.shields.io/github/v/release/PlutoKeating/dsh-lark-bot?sort=semver&label=latest%20release" alt="Latest release"></a>
|
|
39
|
+
<a href="https://github.com/PlutoKeating/dsh-lark-bot/commits/main"><img src="https://img.shields.io/github/commits-since/PlutoKeating/dsh-lark-bot/v0.7.0?label=commits%20since%20v0.7.0" alt="Commits since v0.7.0"></a>
|
|
14
40
|
</p>
|
|
15
41
|
|
|
16
42
|
<br>
|
|
@@ -675,6 +701,7 @@ pnpm ci:local
|
|
|
675
701
|
pnpm release:check # ci:local + 上游一致性检查 | ci:local + upstream consistency check
|
|
676
702
|
pnpm compat:probe # 临时 DSH_HOME 安装锁定版 dsh，跑真实 SDK 握手 | installs pinned dsh into a temp DSH_HOME and runs a real SDK handshake
|
|
677
703
|
pnpm dsh:upstream # 对比 npm 上游 stable 与锁定矩阵 | compares npm upstream stable with the pinned matrix
|
|
704
|
+
pnpm security:monitor # 假冒仓库与仿冒包监控（建议每周）| impostor-repo & npm copycat monitor (recommended weekly)
|
|
678
705
|
```
|
|
679
706
|
|
|
680
707
|
开发规范见 [`AGENTS.md`](AGENTS.md)，模块契约见 [`docs/API.md`](docs/API.md)，架构见 [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md)。
|
|
@@ -857,34 +884,28 @@ and relaunches the full profile on `/safemode exit`.
|
|
|
857
884
|
|
|
858
885
|
## 社区收录情况 | Community Listings
|
|
859
886
|
|
|
860
|
-
> 本项目的社区收录 / 推荐状态，随提交的更新请求持续维护。截至 v0.
|
|
861
|
-
> Community listing & recommendation status, kept current as update requests land. As of v0.
|
|
887
|
+
> 本项目的社区收录 / 推荐状态，随提交的更新请求持续维护。截至 v0.14.0（2026-08-17 复核）：
|
|
888
|
+
> Community listing & recommendation status, kept current as update requests land. As of v0.14.0 (re-verified 2026-08-17):
|
|
862
889
|
|
|
863
890
|
| 平台 Platform | 状态 Status | 说明 Notes |
|
|
864
891
|
| :--- | :--- | :--- |
|
|
865
|
-
| [awesome-dsh-plugins](https://github.com/AdamPlatin123/awesome-dsh-plugins) | ✅ 已收录 · 运行级可用<br>Listed · runtime-verified | 社区榜单标注 `✅
|
|
866
|
-
| [dshfind](https://dshfind.com/zh/plugins/PlutoKeating/dsh-lark-bot) | ✅ 已收录 ·
|
|
867
|
-
| [omdsh-dev/community](https://github.com/orgs/omdsh-dev/discussions/11) | ✅
|
|
892
|
+
| [awesome-dsh-plugins](https://github.com/AdamPlatin123/awesome-dsh-plugins) | ✅ 已收录 · 运行级可用<br>Listed · runtime-verified | 社区榜单标注 `✅ 运行级可用`（agent 实测通过）；收录条目 v0.8.0 经 [PR #127](https://github.com/AdamPlatin123/awesome-dsh-plugins/pull/127) 合并，榜单行同步 [issue #139](https://github.com/AdamPlatin123/awesome-dsh-plugins/issues/139) 已关闭；数据刷新至 v0.14.0 待跟进<br>Shown as `✅ 运行级可用` (agent-tested); v0.8.0 entry merged via [PR #127](https://github.com/AdamPlatin123/awesome-dsh-plugins/pull/127); leaderboard sync [#139](https://github.com/AdamPlatin123/awesome-dsh-plugins/issues/139) closed; refresh to v0.14.0 pending |
|
|
893
|
+
| [dshfind](https://dshfind.com/zh/plugins/PlutoKeating/dsh-lark-bot) | ✅ 已收录 · 详情页在线<br>Listed · detail page live | 条目名称修正 [issue #2](https://github.com/hikariming/dshfind/issues/2) 已关闭；v0.10.1 数据刷新 [issue #6](https://github.com/hikariming/dshfind/issues/6) 待处理；v0.14.0 刷新待跟进；顶部徽章 / 展示卡来自 dshfind<br>Entry name fixed ([issue #2](https://github.com/hikariming/dshfind/issues/2) closed); v0.10.1 refresh ([issue #6](https://github.com/hikariming/dshfind/issues/6)) pending; v0.14.0 refresh pending; the header badge / card comes from dshfind |
|
|
894
|
+
| [omdsh-dev/community](https://github.com/orgs/omdsh-dev/discussions/11) | ✅ 收录申请通过 · 讨论活跃<br>Accepted · discussion active | `[Plugin]` 收录申请（Discussion #11）已通过并持续维护，最新更新说明 v0.10.2；v0.14.0 更新待跟进<br>`[Plugin]` submission (Discussion #11) accepted and active, latest notes v0.10.2; v0.14.0 update pending |
|
|
868
895
|
|
|
869
|
-
**更新请求进度 / Update request status
|
|
896
|
+
**更新请求进度 / Update request status（截至 2026-08-17 复核 | as of 2026-08-17）**：
|
|
870
897
|
|
|
871
|
-
- awesome-dsh-plugins
|
|
872
|
-
- dshfind
|
|
873
|
-
- omdsh-dev/community
|
|
874
|
-
-
|
|
875
|
-
- dshfind 数据刷新至 v0.10.2：[#6 跟进评论](https://github.com/hikariming/dshfind/issues/6#issuecomment-5304382647) — 📨 已提交
|
|
876
|
-
- omdsh-dev/community v0.10.1 更新说明：[Discussion #11 评论](https://github.com/orgs/omdsh-dev/discussions/11#discussioncomment-18034706) — ✅ 已发布
|
|
877
|
-
- omdsh-dev/community v0.10.2 更新说明：[Discussion #11 评论](https://github.com/orgs/omdsh-dev/discussions/11#discussioncomment-18034903) — ✅ 已发布
|
|
898
|
+
- awesome-dsh-plugins 收录条目 v0.8.0：[#127](https://github.com/AdamPlatin123/awesome-dsh-plugins/pull/127) — ✅ 已合并；榜单行同步：[#139](https://github.com/AdamPlatin123/awesome-dsh-plugins/issues/139) — ✅ 已关闭
|
|
899
|
+
- dshfind 条目名称修正 + v0.8.0 刷新：[#2](https://github.com/hikariming/dshfind/issues/2) — ✅ 已关闭；v0.10.1 刷新：[#6](https://github.com/hikariming/dshfind/issues/6) — 📨 待处理
|
|
900
|
+
- omdsh-dev/community 收录：[Discussion #11](https://github.com/orgs/omdsh-dev/discussions/11) — ✅ 通过，讨论活跃（最新更新说明 v0.10.2）
|
|
901
|
+
- 平台数据刷新至 v0.14.0 — ⏸ 暂缓提交（安全窗口内保持低调，见「假冒仓库警告」）
|
|
878
902
|
|
|
879
903
|
**Update requests**:
|
|
880
904
|
|
|
881
|
-
- awesome-dsh-plugins entry
|
|
882
|
-
- dshfind
|
|
883
|
-
- omdsh-dev/community listing
|
|
884
|
-
-
|
|
885
|
-
- dshfind data refresh to v0.10.2: [#6 follow-up](https://github.com/hikariming/dshfind/issues/6#issuecomment-5304382647) — 📨 submitted
|
|
886
|
-
- omdsh-dev/community v0.10.1 update: [Discussion #11 comment](https://github.com/orgs/omdsh-dev/discussions/11#discussioncomment-18034706) — ✅ posted
|
|
887
|
-
- omdsh-dev/community v0.10.2 update: [Discussion #11 comment](https://github.com/orgs/omdsh-dev/discussions/11#discussioncomment-18034903) — ✅ posted
|
|
905
|
+
- awesome-dsh-plugins v0.8.0 entry: [#127](https://github.com/AdamPlatin123/awesome-dsh-plugins/pull/127) — ✅ merged; leaderboard sync: [#139](https://github.com/AdamPlatin123/awesome-dsh-plugins/issues/139) — ✅ closed
|
|
906
|
+
- dshfind name fix + v0.8.0 refresh: [#2](https://github.com/hikariming/dshfind/issues/2) — ✅ closed; v0.10.1 refresh: [#6](https://github.com/hikariming/dshfind/issues/6) — 📨 pending
|
|
907
|
+
- omdsh-dev/community listing: [Discussion #11](https://github.com/orgs/omdsh-dev/discussions/11) — ✅ accepted, discussion active (latest notes v0.10.2)
|
|
908
|
+
- Platform refresh to v0.14.0 — ⏸ deferred (staying low-key during the security window; see "Impostor warning" below)
|
|
888
909
|
|
|
889
910
|
**亮点跟进 / Highlights follow-ups**（六项独家能力与 issue #6 设计实现）：
|
|
890
911
|
|
|
@@ -898,6 +919,21 @@ and relaunches the full profile on `/safemode exit`.
|
|
|
898
919
|
- dshfind detail page: add the in-chat model/key management highlight: [#2 follow-up](https://github.com/hikariming/dshfind/issues/2#issuecomment-5301019067) — 📨 submitted
|
|
899
920
|
- omdsh six-exclusive-highlights summary (incl. the Guardian design): [Discussion #11 highlights comment](https://github.com/orgs/omdsh-dev/discussions/11#discussioncomment-18026370) — 📨 submitted
|
|
900
921
|
|
|
922
|
+
## 假冒仓库警告 | Impostor Repository Warning
|
|
923
|
+
|
|
924
|
+
> [!WARNING]
|
|
925
|
+
> 2026-08-17 发现假冒仓库 **`tarraencompassing61/dsh-lark-bot`**：非 fork 重新上传、114 个 commit 中
|
|
926
|
+
> 113 个作者为 PlutoKeating、删除全部 CI、关闭 Issues、Releases 为 0，却以“下载 Windows exe 双击运行”的
|
|
927
|
+
> SEO 诱饵 README 冒充官方分发。**本项目从不提供 exe，任何此类下载均为假冒 / 恶意来源。**
|
|
928
|
+
> On 2026-08-17 an impostor repository **`tarraencompassing61/dsh-lark-bot`** was found: re-uploaded as a
|
|
929
|
+
> non-fork with 113/114 commits authored by PlutoKeating, all CI deleted, Issues disabled, zero Releases,
|
|
930
|
+
> and a SEO-bait README offering “Windows exe download & run”. **This project never ships executables —
|
|
931
|
+
> treat any such download as counterfeit / malicious.**
|
|
932
|
+
>
|
|
933
|
+
> 取证存档 Evidence: [`docs/security/2026-08-17-impostor-repo-evidence/`](docs/security/2026-08-17-impostor-repo-evidence/README.md) ·
|
|
934
|
+
> 官方下载渠道 Official download: [`docs/DOWNLOAD.md`](docs/DOWNLOAD.md) ·
|
|
935
|
+
> 持续监控 Ongoing monitor: `pnpm security:monitor`
|
|
936
|
+
|
|
901
937
|
## 免责声明 | Disclaimer
|
|
902
938
|
|
|
903
939
|
> [!NOTE]
|
package/SECURITY.md
CHANGED
|
@@ -3,6 +3,21 @@
|
|
|
3
3
|
> dsh-lark-bot 把本机 DeepSeek Harness（`dsh`）暴露给飞书 / Lark IM。本文件说明威胁模型、
|
|
4
4
|
> 默认安全姿态与报告渠道。Security model for a bridge that exposes a local coding agent to Feishu / Lark.
|
|
5
5
|
|
|
6
|
+
## 官方分发渠道 · Official distribution channels
|
|
7
|
+
|
|
8
|
+
- **唯一官方仓库**：<https://github.com/PlutoKeating/dsh-lark-bot>
|
|
9
|
+
- **唯一官方 npm 包**：`dsh-lark-bot`（同源双包 `dsh-feishu-bot`），维护者 `plutokeating`
|
|
10
|
+
- **唯一安装命令**：`npx dsh-lark-bot@latest setup --profile dsh-lark`
|
|
11
|
+
- **Releases 资产**：仅两个 npm tarball（`dsh-lark-bot-<ver>.tgz` / `dsh-feishu-bot-<ver>.tgz`），
|
|
12
|
+
**从不发布 Windows/macOS 可执行文件**
|
|
13
|
+
- **校验承诺**：自本文档更新后的下一个 Release 起，每个发布资产随附 `<asset>.sha256` 校验文件；
|
|
14
|
+
安装/使用前请核对 SHA-256，不一致即视为被篡改，请勿安装并报告
|
|
15
|
+
- **假冒识别**：任何以本项目名义提供“下载即运行”二进制（尤其 .exe）、或使用仿冒仓库名/包名的分发
|
|
16
|
+
渠道均为**假冒 / 恶意来源**——请勿下载或运行，并截图按下方报告渠道反馈
|
|
17
|
+
- **取证存档**：假冒仓库 `tarraencompassing61/dsh-lark-bot` 的取证与处置约定见
|
|
18
|
+
`docs/security/2026-08-17-impostor-repo-evidence/`
|
|
19
|
+
- **持续监控**：`pnpm security:monitor`（假冒仓库活动 / npm 仿冒包 / 相似包名抢注），建议每周运行或挂 cron
|
|
20
|
+
|
|
6
21
|
## 威胁模型 · Threat model
|
|
7
22
|
|
|
8
23
|
- **凭据泄露**：飞书 `app_id` / `app_secret`、DeepSeek API key、会话内容可能在日志、卡片或进程环境中出现。
|
package/package.json
CHANGED