dsh-lark-bot 0.14.0 → 0.15.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +134 -101
- package/SECURITY.md +15 -0
- package/package.json +12 -4
package/README.md
CHANGED
|
@@ -1,3 +1,6 @@
|
|
|
1
|
+
> [!CAUTION]
|
|
2
|
+
> **⚠️ 仅认准官方渠道 / Official channels only：** 唯一官方仓库 [PlutoKeating/dsh-lark-bot](https://github.com/PlutoKeating/dsh-lark-bot)，唯一官方 npm 包 `dsh-lark-bot`（同源双包 `dsh-feishu-bot`，维护者 `plutokeating`）。**本项目从不提供 Windows 可执行文件（.exe），也没有任何“下载即运行”的安装包**——任何以本项目名义提供 exe / “下载后双击运行”的页面、仓库或第三方分发渠道均为**假冒 / 恶意来源**，请勿下载或运行。官方安装唯一命令：`npx dsh-lark-bot@latest setup --profile dsh-lark`。仿冒仓库取证与完整双语声明见文末「假冒仓库警告」及 [docs/security/2026-08-17-impostor-repo-evidence/](docs/security/2026-08-17-impostor-repo-evidence/README.md)。
|
|
3
|
+
|
|
1
4
|
<h1 align="center">dsh-lark-bot</h1>
|
|
2
5
|
|
|
3
6
|
<p align="center">
|
|
@@ -11,6 +14,9 @@
|
|
|
11
14
|
<img src="https://img.shields.io/badge/License-AGPLv3-blue" alt="License">
|
|
12
15
|
<img src="https://img.shields.io/badge/status-released-blue" alt="Status">
|
|
13
16
|
<a href="https://dshfind.com/zh/plugins/PlutoKeating/dsh-lark-bot?ref=badge"><img src="https://dshfind.com/api/badge/PlutoKeating/dsh-lark-bot?lang=zh" alt="dshfind"></a>
|
|
17
|
+
<a href="https://dshbase.com/zh/plugins/dsh-lark-bot"><img src="https://dshbase.com/badges/dsh-lark-bot.svg" alt="dshbase 实测可装"></a>
|
|
18
|
+
<a href="https://github.com/PlutoKeating/dsh-lark-bot/releases"><img src="https://img.shields.io/github/v/release/PlutoKeating/dsh-lark-bot?sort=semver&label=latest%20release" alt="Latest release"></a>
|
|
19
|
+
<a href="https://github.com/PlutoKeating/dsh-lark-bot/commits/main"><img src="https://img.shields.io/github/commits-since/PlutoKeating/dsh-lark-bot/v0.7.0?label=commits%20since%20v0.7.0" alt="Commits since v0.7.0"></a>
|
|
14
20
|
</p>
|
|
15
21
|
|
|
16
22
|
<br>
|
|
@@ -25,109 +31,71 @@
|
|
|
25
31
|
|
|
26
32
|
</div>
|
|
27
33
|
|
|
28
|
-
<
|
|
34
|
+
<p align="center">
|
|
35
|
+
🌐 官网落地页 <a href="https://dsh-lark-bot.arr2018.dpdns.org">dsh-lark-bot.arr2018.dpdns.org</a>
|
|
36
|
+
· 备用 <a href="https://plutokeating.github.io/dsh-lark-bot/">GitHub Pages</a>
|
|
37
|
+
</p>
|
|
29
38
|
|
|
30
|
-
|
|
39
|
+
---
|
|
31
40
|
|
|
32
|
-
|
|
41
|
+
## 场景 | The Problem
|
|
33
42
|
|
|
34
|
-
|
|
43
|
+
**你的 DeepSeek Harness 只能“贴身”用？** dsh 跑在本机，每次看进度、改任务都得回到电脑前；离开工位后任务卡住、跑偏甚至 dsh 崩了，你都收不到任何消息——回来才发现白等半天。
|
|
35
44
|
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
**用在什么场景？** 你在飞书 / Lark（私聊、群聊、话题）里指挥本机 DeepSeek Harness（`dsh`）
|
|
39
|
-
coding agent：发消息就收流式卡片与工具调用过程，把项目工作区、并行任务、会话归档都收进同一
|
|
40
|
-
个协作流。适合需要多项目隔离、角色分工、并行任务与故障自愈的开发者与团队。
|
|
41
|
-
|
|
42
|
-
**Where does it fit?** Drive your local DeepSeek Harness (`dsh`) coding agent from Feishu /
|
|
43
|
-
Lark — DMs, group chats and topics — with streaming cards, isolated project workspaces,
|
|
44
|
-
parallel tasks, session archival and self-healing when things break.
|
|
45
|
-
|
|
46
|
-
**功能亮点（以下六项为 dsh-lark-bot 全网独有组合）| Highlights (exclusive to dsh-lark-bot)**：
|
|
47
|
-
|
|
48
|
-
- 🆘 **Guardian 安全网守护 —— “永远叫得应”**：DSH 进程一崩，其他方案的机器人就变成死号，只能回
|
|
49
|
-
服务器手动重启；dsh-lark-bot 的守护进程在 DSH 崩溃后**仍然会在飞书回复你**——告诉你引擎已挂、
|
|
50
|
-
可进入仅核心安全模式，直接在飞书对话里发控制信号把它重启。**唯一“出故障时用户不会失联”的项目。**
|
|
51
|
-
*When DSH crashes, this bot still answers in Feishu: enter core-only safe mode and send a
|
|
52
|
-
control signal to restart it. The only project where users never lose contact.*
|
|
53
|
-
- 👥 **多角色 Agent —— “一个机器人，一整个团队”**：在飞书里用 `/role` 切换或指派 PM / 开发 /
|
|
54
|
-
文档等角色，每个角色有持久化的人设、模型偏好与规则。
|
|
55
|
-
*Switch or assign PM / dev / docs personas in chat with `/role` — each with its own
|
|
56
|
-
persisted persona. One bot, a whole team.*
|
|
57
|
-
- ⚡ **并行多任务 —— “不用排队”**：同一群里可以**同时跑多个任务**，各自会话隔离；其他方案同聊
|
|
58
|
-
串行，上一个没跑完下一个只能等。
|
|
59
|
-
*Run multiple tasks in the same chat simultaneously with isolated sessions — no queueing.*
|
|
60
|
-
- 🗂 **会话归档与清理 —— “会话列表不会烂掉”**：`/archive` 归档旧任务、`/retention` 配置自动保留
|
|
61
|
-
策略；长期使用也不会越积越多。
|
|
62
|
-
*Archive old tasks and auto-prune with retention policies — your session list stays clean.*
|
|
63
|
-
- 📣 **跨会话主动通知 + @人 —— “活干完了它会来找你”**：Agent 在 A 群跑完任务，可以**主动发消息到
|
|
64
|
-
B 群或私聊并 @ 你**；而不是“你问它答”。
|
|
65
|
-
*Agents proactively report to other chats or DMs and @mention you when work finishes.*
|
|
66
|
-
- 🔑 **对话内管理模型和密钥 —— “不用离开飞书”**：`/providers` `/provider` `/key` 直接在聊天里
|
|
67
|
-
查看、切换供应商、热更新密钥，全程闭环。
|
|
68
|
-
*View providers, switch vendors and hot-update API keys entirely in chat — no server-side
|
|
69
|
-
edits.*
|
|
45
|
+
**dsh-lark-bot 把遥控器装进你的飞书**：在私聊、群聊、话题里直接指挥本机 dsh coding agent，流式卡片实时看思考与工具调用；任务完成主动推送到你所在的任何群并 @ 你；即使 dsh 崩溃下线，飞书里依然叫得应——发 `/safemode` 进入仅核心安全模式，直接在聊天里定位问题、重启引擎。**这是唯一“dsh 挂了你不会失联”的桥接方案。**
|
|
70
46
|
|
|
71
|
-
|
|
47
|
+
*Tired of being chained to your desk to drive DeepSeek Harness? dsh-lark-bot turns Feishu / Lark into the remote control for your local coding agent: drive it from your phone, watch streaming cards, get proactive notifications, and keep a safety-net guardian that still answers in Feishu — and can restart the engine — even when dsh is down.*
|
|
72
48
|
|
|
73
|
-
##
|
|
49
|
+
## 能做什么 | What you get
|
|
74
50
|
|
|
75
|
-
|
|
51
|
+
**基础能力 / Core**：
|
|
76
52
|
|
|
77
|
-
|
|
78
|
-
|
|
53
|
+
- 私聊、群聊、话题（thread）里指挥本机 dsh coding agent，图片 / 文本文件直接发给 bot 即可；
|
|
54
|
+
- 流式卡片实时展示思考、工具调用与结果，支持交互按钮（停止 / 审批 / 问答卡）；
|
|
55
|
+
- 会话自动归档与保留策略；Git 仓库内为每个会话自动创建隔离 worktree 项目工作区，多项目互不干扰。
|
|
79
56
|
|
|
80
|
-
|
|
81
|
-
profile, and dsh loads the bridge engine as a standard plugin on boot (the package declares
|
|
82
|
-
`dsh.bundle.patch`, so `dsh plugin add` works directly).
|
|
57
|
+
**六项全网独有组合 / Six exclusive capabilities**：
|
|
83
58
|
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
59
|
+
- 🆘 **Guardian 安全网守护——“永远叫得应”**：DSH 崩溃后飞书仍会回复你，`/safemode` 进入仅核心安全模式直接重启。*The only project where users never lose contact.*
|
|
60
|
+
- 👥 **多角色 Agent——“一个机器人，一整个团队”**：`/role` 切换或指派 PM / 开发 / 文档等角色，每个角色独立人设、模型偏好与规则。
|
|
61
|
+
- ⚡ **并行多任务——“不用排队”**：同一群聊同时跑多个任务、会话隔离；其他方案只能串行排队。
|
|
62
|
+
- 🗂 **会话归档与清理——“会话列表不会烂掉”**：`/archive` 归档旧任务、`/retention` 配置自动保留策略。
|
|
63
|
+
- 📣 **跨会话主动通知 + @人——“活干完了它会来找你”**：A 群跑完任务主动推送到 B 群 / 私聊并 @ 你。
|
|
64
|
+
- 🔑 **对话内管理模型和密钥——“不用离开飞书”**：`/providers` `/provider` `/key` 直接查看、切换供应商、热更新密钥。
|
|
88
65
|
|
|
89
|
-
|
|
90
|
-
`dsh plugin --profile dsh-lark add dsh-lark-bot@<版本>`（版本号由当前包固定，避免 pnpm
|
|
91
|
-
裸名解析到旧版本），并**默认同时安装「安全网守护」**——系统级
|
|
92
|
-
常驻、dsh 全部下线后仍保留飞书救援入口（核心能力之一，见下文「安全网守护」一节）。
|
|
93
|
-
一条命令即完成全部安装。
|
|
66
|
+
## 30 秒上手 | Quick Start
|
|
94
67
|
|
|
95
|
-
|
|
96
|
-
standard `dsh plugin --profile dsh-lark add dsh-lark-bot@<version>` (pinned to the running
|
|
97
|
-
package so pnpm never resolves an outdated bare-name release), and **also installs the safety-net
|
|
98
|
-
guardian by default** — a system-level resident process that keeps the Feishu rescue entrance
|
|
99
|
-
alive even when dsh is fully down (one of the core features; see "Safety-net guardian" below).
|
|
100
|
-
One command installs everything.
|
|
68
|
+
**前置条件 / Prerequisites（先装好本体，再装遥控器）**：
|
|
101
69
|
|
|
102
|
-
|
|
70
|
+
1. **DeepSeek Harness（`dsh`）已安装并配置好 `DEEPSEEK_API_KEY`** —— dsh-lark-bot 是 dsh 的插件，dsh 才是 agent 本体，缺一不可；
|
|
71
|
+
2. **Node.js ≥ 22.19**（见 `package.json` engines）与一个飞书 / Lark 账号。
|
|
72
|
+
|
|
73
|
+
**三步上线 / Three steps**：
|
|
103
74
|
|
|
104
75
|
```bash
|
|
76
|
+
# ① 一键安装（无需先全局安装任何东西；自动装进 dsh profile，并默认同时安装「安全网守护」）
|
|
77
|
+
# ① One-command install (no prior global install; installs the safety-net guardian by default)
|
|
78
|
+
npx dsh-lark-bot@latest setup --profile dsh-lark
|
|
79
|
+
|
|
80
|
+
# ② 启动 / Start
|
|
105
81
|
dsh --profile dsh-lark
|
|
106
82
|
```
|
|
107
83
|
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
私聊直接发消息，群聊 / 话题里 `@bot`。常驻与守护由 dsh 自己负责。
|
|
111
|
-
|
|
112
|
-
On first boot the terminal prints a QR code: scan it with the Feishu / Lark app to create or
|
|
113
|
-
choose a PersonalAgent app. After binding, the bridge engine runs **inside the dsh process**
|
|
114
|
-
(Feishu channel, sessions/workspaces, cards, notify callback); message it directly in private
|
|
115
|
-
chat, or use `@bot` in groups/topics. dsh owns the daemon lifecycle.
|
|
84
|
+
③ 首次启动终端打印二维码 → 飞书 / Lark App 扫码创建或选择 PersonalAgent 应用 → 绑定后私聊直接发消息，群聊 / 话题里 `@bot`。
|
|
85
|
+
*First boot prints a QR code: scan it with the Feishu / Lark app to bind a PersonalAgent app, then DM the bot directly or `@bot` in groups/topics.*
|
|
116
86
|
|
|
117
|
-
|
|
87
|
+
`setup` 会自动完成：定位本机 dsh → 预批准 pnpm 构建策略（protobufjs）→ 执行标准
|
|
88
|
+
`dsh plugin --profile dsh-lark add dsh-lark-bot@<版本>`（版本号由当前包固定）→ 默认安装「安全网守护」系统服务。
|
|
89
|
+
一条命令即完成全部安装。
|
|
118
90
|
|
|
119
|
-
|
|
120
|
-
|
|
91
|
+
> **无需公网 IP / 域名 / 服务器 / 内网穿透**（飞书 WebSocket 出站长连接），Linux / macOS / Windows 通用。
|
|
92
|
+
> 已有 PersonalAgent 应用时可跳过扫码（见「配置」）：`DSH_LARK_APP_ID=cli_xxx DSH_LARK_APP_SECRET=<secret> DSH_LARK_TENANT=feishu dsh --profile dsh-lark`
|
|
93
|
+
> 升级同样一条命令：`npx dsh-lark-bot@latest upgrade --profile dsh-lark --yes`
|
|
121
94
|
|
|
122
|
-
|
|
123
|
-
DSH_LARK_APP_ID=cli_xxx DSH_LARK_APP_SECRET=<secret> DSH_LARK_TENANT=feishu \
|
|
124
|
-
dsh --profile dsh-lark
|
|
125
|
-
```
|
|
95
|
+
## 完整使用方式 | Full usage
|
|
126
96
|
|
|
127
|
-
|
|
128
|
-
> Uninstall: `dsh plugin --profile dsh-lark remove dsh-lark-bot`.
|
|
97
|
+
### 常用命令 | Common commands
|
|
129
98
|
|
|
130
|
-
### 3. 基本使用 | Basic usage
|
|
131
99
|
|
|
132
100
|
在飞书里向 bot 发送普通消息即可开始工作，常用命令：
|
|
133
101
|
|
|
@@ -415,9 +383,53 @@ logs and troubleshooting.
|
|
|
415
383
|
|
|
416
384
|
---
|
|
417
385
|
|
|
386
|
+
## FAQ（典型用例与常见问题）| FAQ (use cases & common questions)
|
|
387
|
+
|
|
388
|
+
### 典型用例 | Typical use cases
|
|
389
|
+
|
|
390
|
+
**Q: 出门在外，想用手机指挥本机的 DeepSeek Harness？**
|
|
391
|
+
|
|
392
|
+
**A:** 可以。安装并扫码绑定后，用飞书手机 App 给机器人发消息即可指挥本机 dsh coding agent 读代码、跑命令、完成任务；任务完成还能跨会话主动推送并 @ 你。安装只需：`npx dsh-lark-bot@latest setup --profile dsh-lark` → `dsh --profile dsh-lark` → 飞书扫码 → 开聊。
|
|
393
|
+
|
|
394
|
+
*Q: Can I drive my local DeepSeek Harness from my phone? A: Yes — after the one-command install and a QR scan, message the bot from the Feishu app anywhere.*
|
|
395
|
+
|
|
396
|
+
**Q: 多个项目 / 多人协作，怎么隔离与分工？**
|
|
397
|
+
|
|
398
|
+
**A:** 每个会话自动落在独立的 git worktree（`~/.dsh-lark/profiles/<profile>/worktrees/<scope>/`），项目级 `AGENTS.md` 规则自动注入，多项目互不干扰；管理员用 `/role` 定义 PM / 开发 / 文档等角色并绑定到群，用 `/invite` 管理访问白名单；同一群内默认 2 个任务并行（`/concurrency` 调整），`/archive` + `/retention` 控制会话归档与保留。
|
|
399
|
+
|
|
400
|
+
*Q: How do I isolate projects and split work across a team? A: Per-session git worktrees, project AGENTS.md injection, /role personas, /invite allowlists and parallel runs keep everything isolated.*
|
|
401
|
+
|
|
402
|
+
**Q: dsh 崩溃 / 掉线后，飞书机器人还能用吗？**
|
|
403
|
+
|
|
404
|
+
**A:** 能。`setup` 默认安装独立于 dsh 进程的「安全网守护」（systemd / LaunchAgent / Windows 启动项）。dsh 崩溃或无法启动时，守护自动接管飞书通道并先尝试自动重启完整 profile；仍失败时你直接发 `/safemode` 进入仅核心安全模式（官方核心 bundle，不加载任何第三方插件），在聊天里定位 / 修复问题，`/safemode exit` 重启完整 profile 并交还通道。全程不需要命令行。
|
|
405
|
+
|
|
406
|
+
*Q: Does the bot still work if dsh crashes? A: Yes — the guardian takes over the Feishu channel, and you can restart dsh from chat with /safemode.*
|
|
407
|
+
|
|
408
|
+
### 常见问题 | Common questions
|
|
409
|
+
|
|
410
|
+
**Q: DeepSeek Harness 怎么接入飞书？**
|
|
411
|
+
|
|
412
|
+
**A:** 安装 Node.js ≥ 22 与 DeepSeek Harness（已配置 `DEEPSEEK_API_KEY`），执行 `npx dsh-lark-bot@latest setup --profile dsh-lark`，再 `dsh --profile dsh-lark` 启动并用飞书 App 扫描终端二维码绑定 PersonalAgent 应用。私聊直接发消息，群聊 / 话题里 `@bot`。
|
|
413
|
+
|
|
414
|
+
**Q: 需要公网 IP、域名或服务器吗？**
|
|
415
|
+
|
|
416
|
+
**A:** 不需要。飞书通道使用 WebSocket 长连接（出站连接），本机在 NAT 后面也能用，免公网服务器、免域名、免内网穿透。
|
|
417
|
+
|
|
418
|
+
**Q: dsh-lark-bot 和其他 DeepSeek Harness 飞书插件（如 harness-lark）有什么区别？**
|
|
419
|
+
|
|
420
|
+
**A:** 功能组合最全：安全网守护（dsh 崩溃后飞书仍叫得应）、多角色 Agent、并行多任务、会话归档、跨会话主动通知、对话内模型 / 密钥管理六项合为一体；安装上是标准 dsh profile bundle，`npx dsh-lark-bot@latest setup` 一条命令装进 dsh profile，无需独立 Docker / 后台服务。
|
|
421
|
+
|
|
422
|
+
**Q: 项目从哪下载？会不会有假冒版本？**
|
|
423
|
+
|
|
424
|
+
**A:** 唯一官方仓库是 [github.com/PlutoKeating/dsh-lark-bot](https://github.com/PlutoKeating/dsh-lark-bot)，唯一官方 npm 包是 `dsh-lark-bot` / `dsh-feishu-bot`（维护者 `plutokeating`）。本项目从不提供 .exe 或“下载即运行”的安装包；任何以项目名义分发 exe 的仓库或页面都是假冒来源，请勿运行（详见文末「假冒仓库警告」）。
|
|
425
|
+
|
|
426
|
+
---
|
|
427
|
+
|
|
418
428
|
## 关键词 | Keywords
|
|
419
429
|
|
|
420
|
-
`dsh` · `deepseek` · `deepseek harness` · `feishu` · `lark` · `bridge` · `bot`
|
|
430
|
+
`dsh` · `deepseek` · `deepseek harness` · `feishu` · `lark` · `bridge` · `bot` ·
|
|
431
|
+
`chatbot` · `messaging` · `qrcode` · `typescript` · `feishu-bot` · `lark-bot` ·
|
|
432
|
+
`dsh-plugin` · `deepseek-harness` · `im-bridge` · `ai-agent` · `workspace` · `self-healing`
|
|
421
433
|
|
|
422
434
|
## 这是什么 | What it is
|
|
423
435
|
|
|
@@ -675,6 +687,7 @@ pnpm ci:local
|
|
|
675
687
|
pnpm release:check # ci:local + 上游一致性检查 | ci:local + upstream consistency check
|
|
676
688
|
pnpm compat:probe # 临时 DSH_HOME 安装锁定版 dsh，跑真实 SDK 握手 | installs pinned dsh into a temp DSH_HOME and runs a real SDK handshake
|
|
677
689
|
pnpm dsh:upstream # 对比 npm 上游 stable 与锁定矩阵 | compares npm upstream stable with the pinned matrix
|
|
690
|
+
pnpm security:monitor # 假冒仓库与仿冒包监控（建议每周）| impostor-repo & npm copycat monitor (recommended weekly)
|
|
678
691
|
```
|
|
679
692
|
|
|
680
693
|
开发规范见 [`AGENTS.md`](AGENTS.md)，模块契约见 [`docs/API.md`](docs/API.md)，架构见 [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md)。
|
|
@@ -857,34 +870,39 @@ and relaunches the full profile on `/safemode exit`.
|
|
|
857
870
|
|
|
858
871
|
## 社区收录情况 | Community Listings
|
|
859
872
|
|
|
860
|
-
>
|
|
861
|
-
|
|
873
|
+
<div align="center">
|
|
874
|
+
|
|
875
|
+
<a href="https://dshfind.com/zh/plugins/PlutoKeating/dsh-lark-bot?ref=badge"><img src="https://dshfind.com/api/card/PlutoKeating/dsh-lark-bot?lang=zh" alt="dshfind" width="440"></a>
|
|
876
|
+
|
|
877
|
+
</div>
|
|
878
|
+
|
|
879
|
+
|
|
880
|
+
> 本项目的社区收录 / 推荐状态，随提交的更新请求持续维护。截至 v0.14.0（2026-08-17 复核）：
|
|
881
|
+
> Community listing & recommendation status, kept current as update requests land. As of v0.14.0 (re-verified 2026-08-17):
|
|
862
882
|
|
|
863
883
|
| 平台 Platform | 状态 Status | 说明 Notes |
|
|
864
884
|
| :--- | :--- | :--- |
|
|
865
|
-
| [awesome-dsh-plugins](https://github.com/AdamPlatin123/awesome-dsh-plugins) | ✅ 已收录 · 运行级可用<br>Listed · runtime-verified | 社区榜单标注 `✅
|
|
866
|
-
| [
|
|
867
|
-
| [
|
|
885
|
+
| [awesome-dsh-plugins](https://github.com/AdamPlatin123/awesome-dsh-plugins) | ✅ 已收录 · 运行级可用<br>Listed · runtime-verified | 社区榜单标注 `✅ 运行级可用`（agent 实测通过）；收录条目 v0.8.0 经 [PR #127](https://github.com/AdamPlatin123/awesome-dsh-plugins/pull/127) 合并，榜单行同步 [issue #139](https://github.com/AdamPlatin123/awesome-dsh-plugins/issues/139) 已关闭；数据刷新至 v0.14.0 待跟进<br>Shown as `✅ 运行级可用` (agent-tested); v0.8.0 entry merged via [PR #127](https://github.com/AdamPlatin123/awesome-dsh-plugins/pull/127); leaderboard sync [#139](https://github.com/AdamPlatin123/awesome-dsh-plugins/issues/139) closed; refresh to v0.14.0 pending |
|
|
886
|
+
| [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) | 📨 收录 PR 已提交 · 待合并<br>Submission PR open · awaiting merge | 7.2k+ star 的社区插件精选大榜（`dsh-plugin` 生态流量入口）；收录 PR [#1408](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/1408) 已提交，合并后回填状态<br>The 7.2k+ star curated plugin list (the ecosystem traffic hub); submission [PR #1408](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/1408) open, status backfilled after merge |
|
|
887
|
+
| [dshfind](https://dshfind.com/zh/plugins/PlutoKeating/dsh-lark-bot) | ✅ 已收录 · 详情页在线<br>Listed · detail page live | 条目名称修正 [issue #2](https://github.com/hikariming/dshfind/issues/2) 已关闭；v0.10.1 数据刷新 [issue #6](https://github.com/hikariming/dshfind/issues/6) 待处理；v0.14.0 刷新待跟进；顶部徽章 / 展示卡来自 dshfind<br>Entry name fixed ([issue #2](https://github.com/hikariming/dshfind/issues/2) closed); v0.10.1 refresh ([issue #6](https://github.com/hikariming/dshfind/issues/6)) pending; v0.14.0 refresh pending; the header badge / card comes from dshfind |
|
|
888
|
+
| [dshbase](https://dshbase.com/zh/plugins/dsh-lark-bot) | ✅ 已收录 · 实测可装<br>Listed · CI-verified | 中文插件目录（收录 1771+ 插件），自动化 CI 实测 `dsh plugin add` 可装可启动，标注 `✅ 已验证 · 实测可装`；顶部徽章来自 dshbase<br>Chinese plugin directory (1771+ plugins) with automated CI install verification, marked `✅ verified`; the header badge comes from dshbase |
|
|
889
|
+
| [omdsh-dev/community](https://github.com/orgs/omdsh-dev/discussions/11) | ✅ 收录申请通过 · 讨论活跃<br>Accepted · discussion active | `[Plugin]` 收录申请（Discussion #11）已通过并持续维护，最新更新说明 v0.10.2；v0.14.0 更新待跟进<br>`[Plugin]` submission (Discussion #11) accepted and active, latest notes v0.10.2; v0.14.0 update pending |
|
|
868
890
|
|
|
869
|
-
**更新请求进度 / Update request status
|
|
891
|
+
**更新请求进度 / Update request status（截至 2026-08-17 复核 | as of 2026-08-17）**：
|
|
870
892
|
|
|
871
|
-
- awesome-dsh-plugins
|
|
872
|
-
-
|
|
873
|
-
-
|
|
874
|
-
-
|
|
875
|
-
-
|
|
876
|
-
- omdsh-dev/community v0.10.1 更新说明：[Discussion #11 评论](https://github.com/orgs/omdsh-dev/discussions/11#discussioncomment-18034706) — ✅ 已发布
|
|
877
|
-
- omdsh-dev/community v0.10.2 更新说明：[Discussion #11 评论](https://github.com/orgs/omdsh-dev/discussions/11#discussioncomment-18034903) — ✅ 已发布
|
|
893
|
+
- awesome-dsh-plugins 收录条目 v0.8.0：[#127](https://github.com/AdamPlatin123/awesome-dsh-plugins/pull/127) — ✅ 已合并；榜单行同步：[#139](https://github.com/AdamPlatin123/awesome-dsh-plugins/issues/139) — ✅ 已关闭
|
|
894
|
+
- awesome-dsh-plugin 大榜收录：[#1408](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/1408) — 📨 已提交（2026-08-17，v0.15.0 数据）
|
|
895
|
+
- dshfind 条目名称修正 + v0.8.0 刷新：[#2](https://github.com/hikariming/dshfind/issues/2) — ✅ 已关闭；v0.10.1 刷新：[#6](https://github.com/hikariming/dshfind/issues/6) — 📨 待处理
|
|
896
|
+
- omdsh-dev/community 收录：[Discussion #11](https://github.com/orgs/omdsh-dev/discussions/11) — ✅ 通过，讨论活跃（最新更新说明 v0.10.2）
|
|
897
|
+
- 平台数据刷新至 v0.14.0 — ⏸ 暂缓提交（安全窗口内保持低调，见「假冒仓库警告」）
|
|
878
898
|
|
|
879
899
|
**Update requests**:
|
|
880
900
|
|
|
881
|
-
- awesome-dsh-plugins entry
|
|
882
|
-
-
|
|
883
|
-
-
|
|
884
|
-
-
|
|
885
|
-
-
|
|
886
|
-
- omdsh-dev/community v0.10.1 update: [Discussion #11 comment](https://github.com/orgs/omdsh-dev/discussions/11#discussioncomment-18034706) — ✅ posted
|
|
887
|
-
- omdsh-dev/community v0.10.2 update: [Discussion #11 comment](https://github.com/orgs/omdsh-dev/discussions/11#discussioncomment-18034903) — ✅ posted
|
|
901
|
+
- awesome-dsh-plugins v0.8.0 entry: [#127](https://github.com/AdamPlatin123/awesome-dsh-plugins/pull/127) — ✅ merged; leaderboard sync: [#139](https://github.com/AdamPlatin123/awesome-dsh-plugins/issues/139) — ✅ closed
|
|
902
|
+
- awesome-dsh-plugin listing: [#1408](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/1408) — 📨 submitted (2026-08-17, v0.15.0 data)
|
|
903
|
+
- dshfind name fix + v0.8.0 refresh: [#2](https://github.com/hikariming/dshfind/issues/2) — ✅ closed; v0.10.1 refresh: [#6](https://github.com/hikariming/dshfind/issues/6) — 📨 pending
|
|
904
|
+
- omdsh-dev/community listing: [Discussion #11](https://github.com/orgs/omdsh-dev/discussions/11) — ✅ accepted, discussion active (latest notes v0.10.2)
|
|
905
|
+
- Platform refresh to v0.14.0 — ⏸ deferred (staying low-key during the security window; see "Impostor warning" below)
|
|
888
906
|
|
|
889
907
|
**亮点跟进 / Highlights follow-ups**（六项独家能力与 issue #6 设计实现）：
|
|
890
908
|
|
|
@@ -898,6 +916,21 @@ and relaunches the full profile on `/safemode exit`.
|
|
|
898
916
|
- dshfind detail page: add the in-chat model/key management highlight: [#2 follow-up](https://github.com/hikariming/dshfind/issues/2#issuecomment-5301019067) — 📨 submitted
|
|
899
917
|
- omdsh six-exclusive-highlights summary (incl. the Guardian design): [Discussion #11 highlights comment](https://github.com/orgs/omdsh-dev/discussions/11#discussioncomment-18026370) — 📨 submitted
|
|
900
918
|
|
|
919
|
+
## 假冒仓库警告 | Impostor Repository Warning
|
|
920
|
+
|
|
921
|
+
> [!WARNING]
|
|
922
|
+
> 2026-08-17 发现假冒仓库 **`tarraencompassing61/dsh-lark-bot`**：非 fork 重新上传、114 个 commit 中
|
|
923
|
+
> 113 个作者为 PlutoKeating、删除全部 CI、关闭 Issues、Releases 为 0，却以“下载 Windows exe 双击运行”的
|
|
924
|
+
> SEO 诱饵 README 冒充官方分发。**本项目从不提供 exe，任何此类下载均为假冒 / 恶意来源。**
|
|
925
|
+
> On 2026-08-17 an impostor repository **`tarraencompassing61/dsh-lark-bot`** was found: re-uploaded as a
|
|
926
|
+
> non-fork with 113/114 commits authored by PlutoKeating, all CI deleted, Issues disabled, zero Releases,
|
|
927
|
+
> and a SEO-bait README offering “Windows exe download & run”. **This project never ships executables —
|
|
928
|
+
> treat any such download as counterfeit / malicious.**
|
|
929
|
+
>
|
|
930
|
+
> 取证存档 Evidence: [`docs/security/2026-08-17-impostor-repo-evidence/`](docs/security/2026-08-17-impostor-repo-evidence/README.md) ·
|
|
931
|
+
> 官方下载渠道 Official download: [`docs/DOWNLOAD.md`](docs/DOWNLOAD.md) ·
|
|
932
|
+
> 持续监控 Ongoing monitor: `pnpm security:monitor`
|
|
933
|
+
|
|
901
934
|
## 免责声明 | Disclaimer
|
|
902
935
|
|
|
903
936
|
> [!NOTE]
|
package/SECURITY.md
CHANGED
|
@@ -3,6 +3,21 @@
|
|
|
3
3
|
> dsh-lark-bot 把本机 DeepSeek Harness（`dsh`）暴露给飞书 / Lark IM。本文件说明威胁模型、
|
|
4
4
|
> 默认安全姿态与报告渠道。Security model for a bridge that exposes a local coding agent to Feishu / Lark.
|
|
5
5
|
|
|
6
|
+
## 官方分发渠道 · Official distribution channels
|
|
7
|
+
|
|
8
|
+
- **唯一官方仓库**：<https://github.com/PlutoKeating/dsh-lark-bot>
|
|
9
|
+
- **唯一官方 npm 包**：`dsh-lark-bot`（同源双包 `dsh-feishu-bot`），维护者 `plutokeating`
|
|
10
|
+
- **唯一安装命令**：`npx dsh-lark-bot@latest setup --profile dsh-lark`
|
|
11
|
+
- **Releases 资产**：仅两个 npm tarball（`dsh-lark-bot-<ver>.tgz` / `dsh-feishu-bot-<ver>.tgz`），
|
|
12
|
+
**从不发布 Windows/macOS 可执行文件**
|
|
13
|
+
- **校验承诺**：自本文档更新后的下一个 Release 起，每个发布资产随附 `<asset>.sha256` 校验文件；
|
|
14
|
+
安装/使用前请核对 SHA-256，不一致即视为被篡改，请勿安装并报告
|
|
15
|
+
- **假冒识别**：任何以本项目名义提供“下载即运行”二进制（尤其 .exe）、或使用仿冒仓库名/包名的分发
|
|
16
|
+
渠道均为**假冒 / 恶意来源**——请勿下载或运行，并截图按下方报告渠道反馈
|
|
17
|
+
- **取证存档**：假冒仓库 `tarraencompassing61/dsh-lark-bot` 的取证与处置约定见
|
|
18
|
+
`docs/security/2026-08-17-impostor-repo-evidence/`
|
|
19
|
+
- **持续监控**：`pnpm security:monitor`（假冒仓库活动 / npm 仿冒包 / 相似包名抢注），建议每周运行或挂 cron
|
|
20
|
+
|
|
6
21
|
## 威胁模型 · Threat model
|
|
7
22
|
|
|
8
23
|
- **凭据泄露**：飞书 `app_id` / `app_secret`、DeepSeek API key、会话内容可能在日志、卡片或进程环境中出现。
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "dsh-lark-bot",
|
|
3
|
-
"version": "0.
|
|
4
|
-
"description": "Bridge DeepSeek Harness (dsh) into Feishu / Lark
|
|
3
|
+
"version": "0.15.1",
|
|
4
|
+
"description": "把 DeepSeek Harness (dsh) 装进飞书/Lark 的 bot，扫码即用：流式卡片、项目工作区、并行任务、多角色 Agent、安全网守护。| Bridge DeepSeek Harness (dsh) into Feishu / Lark, scan-to-connect: streaming cards, project workspaces, parallel tasks, multi-role agents, safety-net guardian.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"packageManager": "pnpm@10.33.0",
|
|
7
7
|
"bin": {
|
|
@@ -92,15 +92,23 @@
|
|
|
92
92
|
"dsh",
|
|
93
93
|
"deepseek",
|
|
94
94
|
"deepseek harness",
|
|
95
|
+
"deepseek-harness 插件",
|
|
96
|
+
"deepseek harness 飞书",
|
|
95
97
|
"feishu",
|
|
98
|
+
"飞书",
|
|
99
|
+
"飞书机器人",
|
|
96
100
|
"lark",
|
|
97
101
|
"bridge",
|
|
98
102
|
"bot",
|
|
103
|
+
"扫码",
|
|
104
|
+
"scan to connect",
|
|
99
105
|
"typescript",
|
|
100
106
|
"chatbot",
|
|
101
|
-
"messaging",
|
|
102
107
|
"deepseek-harness",
|
|
103
|
-
"dsh-plugin"
|
|
108
|
+
"dsh-plugin",
|
|
109
|
+
"feishu-plugin",
|
|
110
|
+
"lark-integration",
|
|
111
|
+
"remote-coding"
|
|
104
112
|
],
|
|
105
113
|
"license": "AGPL-3.0",
|
|
106
114
|
"engines": {
|