kingcharleslzy-ai/dsh-purge

Review signals: 1 hardcoded secret.

Gitleaks found a possible hardcoded secret; value withheld. skills/redteam/cn-proxy-pool.md

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

[
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "npm",
        "ci"
      ],
      "kind": "cli",
      "returncode": 0,
      "stdout": "\nadded 4 packages, and audited 5 packages in 3s\n\n1 package is looking for funding\n  run `npm fund` for details\n\nfound 0 vulnerabilities",
      "stderr": "",
      "needs_credentials": false,
      "needs_browser": false,
      "scope": "partial: install"
    },
    "check": "install",
    "optional": false
  }
]

• Status identifies host compatibility and reports backup state.: Real input produced the expected result: "level": "no-host"

  Source: `purge-community status` | 宿主路径与计数

  Input: status with no DSH host installed

  Expected: Reports no-host compatibility and an empty backups list.

  Command: node bin/community.js status

  Observed: "level": "no-host", "message": "未定位到宿主 @deepseek-ai 目录。官方桌面版点「应用」会解开 app.asar 后重启并自动继续。" }, "backups": [] }

Examples

• README common command selfcheck JSON: Ran the documented equivalent node bin/community.js selfcheck --json; it returned exit 1 and state broken because the guest has no DSH host installation.

  Source: README.md / 常用命令

  Expected: documented command completes successfully

  Observed: Ran the documented equivalent node bin/community.js selfcheck --json; it returned exit 1 and state broken because the guest has no DSH host installation.

Local or hosted: local

purge-community status and selfcheck

pwd; rg --files -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'Makefile' -g '.github/workflows/**' -g 'requirements*.txt' -g 'AGENTS.md' | head -80; git status --short; git rev-parse HEAD 2>/dev/null; python3 --version; sed -n '1,240p' README.md
find . -maxdepth 3 -type f | head -80; command -v node || true; node --version 2>&1 || true; command -v npm || true; npm --version 2>&1 || true; id -u; command -v sudo || true; sed -n '1,200p' AGENTS.md; cat package.json 2>/dev/null
npm ci
node bin/community.js status
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["node","bin/community.js","status"],"cwd":"<guest-path>","expected_text":"\"level\": \"no-host\""}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Status identifies host compatibility and reports backup state.","source":"`purge-community status` | 宿主路径与计数","input":"status with no DSH host installed","expected":"Reports no-host compatibility and an empty backups list.","probe_kind":"cli","argv":["node","bin/community.js","status"],"expected_text":"\"level\": \"no-host\"","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"README common command selfcheck JSON","source":"README.md / 常用命令","input":"--json","expected":"JSON selfcheck output","argv":["node","bin/community.js","selfcheck","--json"],"cwd":"<guest-path>","expected_text":"\"layers\""}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README and package entry points: the product is a host plugin and CLI, with status/selfcheck commands and optional update checks; no product cron, scheduler, loop, webhook, --once, or --now cycle was identified."}
EOF
node bin/community.js selfcheck --json > <guest-path> 2>&1; head -c 300 <guest-path>; cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"purge-community status","operation_scope":"Node 22 runtime; no DSH host installed","steps":["npm ci","node bin/community.js status"],"deviations":["Host compatibility reports no-host because the disposable Linux VM has no DSH host instance."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["node","bin/community.js","status"],"cwd":"<guest-path>","expected_text":"\"level\": \"no-host\"","checks":[{"check":"install","argv":["npm","ci"],"cwd":"<guest-path>"}]}
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"README common command selfcheck JSON","source":"README.md / 常用命令","reason":"Ran the documented equivalent node bin/community.js selfcheck --json; it returned exit 1 and state broken because the guest has no DSH host installation."}]
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"blocked","fault_owner":"prerequisite","operation":"purge-community status and selfcheck","operation_scope":"Node 22 CLI on Linux; DSH host installation is required for a healthy selfcheck","steps":["npm ci","node bin/community.js status","node bin/community.js selfcheck --json"],"deviations":["No DSH host installation exists in the disposable VM; documented selfcheck reports broken with host/runtime checks unavailable."],"stuck_step":"Full host selfcheck","main_blocker":"DSH host is not installed or initialized in the guest.","plain_failure":"Selfcheck reports broken because no DSH host is present. Status runs and reports no-host.","suggested_fix":"Run in a Linux environment with an initialized DSH CLI/Web profile or DSH Desktop host."}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay