dsh-safe-download-files
用于 DeepSeek Harness 的安全公共 HTTP(S) 文件下载工具
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:Apoze/dsh-safe-download-files#a8c9cc38d3b719d969dd61b83c9a868bce3b84a0Safe Download Files 以 dsh-safe-download-files 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →A DeepSeek Harness plugin that exposes one model tool:
download_files({
directory?: string,
items: [{ url: string, file_name?: string }]
})
It safely downloads public files into the current DSH workspace. This is an unofficial community plugin.
Accepted content includes raster images, PDF, UTF-8 text/Markdown/CSV/JSON/XML, and common audio/video formats.
dsh plugin --profile web add "git+https://github.com/Apoze/dsh-safe-download-files.git#main"
This is a complete DSH bundle. Restart DSH after installation:
dsh --profile web --dump-config
dsh web
No manual Cordis entry is required.
| Limit | Value |
|---|---|
| Files per call | 100 |
| Concurrent downloads | 8 |
| File size | 25 MB |
| Total call size | 250 MB |
| Redirects | 5 |
| Timeout per file | 30 seconds |
| Tool timeout | 420 seconds |
Successful files are kept when another item in the same batch fails.
pnpm install --frozen-lockfile
pnpm test
The test suite covers SSRF, DNS pinning, redirect validation, MIME mismatch, path traversal, collisions, cancellation, size limits, and partial failures.
Version 0.1.1 uses the compiled Apoze dsh-safe-web-fetch 0.1.0-next.1 release (source commit 736e690cccd2d74126455633cd92fd252c35de08), pinned with a lockfile integrity hash. Its Undici 8.10.2 fixes the uncaught paused-parser EOF crash described in https://github.com/nodejs/undici/issues/5360. No runtime exception suppression or node_modules patching is used. Existing DNS pinning, private-address rejection, cancellation and size limits remain in force.