dsh-omv
OMV Audit Desk：面向 DeepSeek Harness、以证据为先的漏洞审计工作台
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:bx33661/dsh-omv#e8d3e488ec8ba0223f48d0d65dc61e8f1fc203e3Omv 以 dsh-omv 发布，当前版本为 1.0.7。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →
dsh-omv)An evidence-first vulnerability audit workbench for DeepSeek Harness, powered by the public oh-my-vul API.
中文文档 · Architecture · DSH integration guide
OMV Audit Desk full workbench overview
Full audit desk overview: workspace summary, findings, reproduction, evidence graph, and PoC lab.
OMV Audit Desk is the product name; dsh-omv remains the package id for upgrade compatibility. It is a dual-face, native DSH bundle:
cordis.patch.yml installs both faces into a DSH Web profile.source → sink → guard evidence-chain inspection/output/result.json, artifact hashes, provenance, and manual Evidence adoption/omv* commands, including omv-dedup and the Campaign Runtime settool.call.toolview card with expandable arguments/results and trajectory inspection, plus an evidence-first Agent system-prompt sectionomv Cordis service for other plugins, lifecycle diagnostics via omv_runtime_status, and typed dsh-omv/tool-result eventsdsh-omv settings namespace when the Host exposes it, with a browser-local fallback on DSH rc.6; deployment knobs remain in Cordis Config?protocol=1 compatibility, and complete workspace exportThere are two separate installation steps: npm install prepares this checkout's dependencies and build output; dsh plugin --profile web add ... installs the plugin into the DSH Web profile. Choose one of the following modes.
Use a local link when you need hot reload. The link points the profile at this checkout, while npm run dev watches src/ and lets DSH client-HMR refresh the open page.
cd /path/to/dsh-omv
npm install
dsh plugin --profile web add link:.
npm run dev
dsh --profile web
Keep npm run dev running while editing. React component state may reset according to DSH HMR behavior; this is not full page-state persistence. If the profile previously used a regular local install, switch it explicitly:
dsh plugin --profile web remove dsh-omv
dsh plugin --profile web add link:.
Use this mode when you want to run a fixed checkout without hot reload. After source changes, rebuild and add the local package again.
cd /path/to/dsh-omv
npm install
npm run build
dsh plugin --profile web add .
dsh --profile web
Use a tarball to transfer or install a specific build on another machine. npm pack prints a versioned filename; use the actual filename it prints. A tarball does not provide source hot reload.
cd /path/to/dsh-omv
npm install
npm pack --silent
dsh plugin --profile web add ./dsh-omv-<version>.tgz
dsh --profile web
Local checkouts and already-built tarballs do not need an extra pnpm allowBuilds entry. Update an installed package with dsh plugin --profile web update dsh-omv, or remove it with dsh plugin --profile web remove dsh-omv.
The Vulnerability audit entry opens or reuses the configured DSH Workspace. Every session then exposes a Vulnerability audit tab beside Chat and Trajectory. Verify the profile after installation with:
dsh --profile web --dump-config
The output should include the dsh-omv configuration layer. If source changes do not appear, confirm that the profile uses link:. and that npm run dev is still running.
Override the row in $DSH_HOME/profiles/web/cordis.patch.yml:
- id: dsh-omv
config:
projectRoot: '/absolute/path/to/repository'
apiPrefix: '/api/dsh-omv'
allowMutations: true
allowRemoteAccess: false
activityLimit: 60
refreshIntervalMs: 15000
campaignConcurrency: 3
watchDebounceMs: 90
eventHeartbeatMs: 20000
httpBodyLimitBytes: 262144
Relative projectRoot values resolve from the directory where DSH starts. A patch replaces the complete config value, so retain every field you still need.
127.0.0.1/::1 and the Host header must be localhost/127.0.0.1/[::1]. The Host check blocks browser DNS-rebinding pages from reading /export or forging /action mutations.allowRemoteAccess: true disables both guards, and the whole API (including every mutation action) has no authentication. Only enable it on a trusted network, behind your own auth proxy or network isolation.allowRemoteAccess: true to pass the Host check.Other plugins can consume the host capability without depending on the HTTP bridge:
import type { Context } from '@deepseek-ai/cordis'
export const inject = ['omv']
export function apply(ctx: Context) {
ctx.on('dsh-omv/tool-result', event => {
console.log(event.name, event.ok ? 'ok' : 'failed')
})
void ctx.omv.workbench.health()
}
See README.zh-CN.md for architecture, API, packaging, and configuration details. The implementation-to-guide checklist and follow-up iterations live in DSH-INTEGRATION.md.
MIT
The source is split across the DSH host entry, client pages, UI primitives, runtime adapters, and shared contracts; all tests live under tests/. See ARCHITECTURE.md. The repository keeps the full audit desk overview at omv-audit-desk-overview.png; build archives, local .omv data, continuation state, and internal planning notes are ignored.