dsh-top

by glenngit

0 UI 增强github 检测到 manifest package.json#dsh收录于 08-17

dsh Web GUI 系统监控工具：浮动可折叠面板内实时展示 CPU、内存、磁盘、网络与 top 进程

System monitoring tool for the dsh web GUI: live CPU, RAM, disk, network, and top processes in a floating, collapsible panel.

安装

$ dsh plugin --profile web add github:glenngit/dsh-top

GitHub 源码安装：首次需按提示配置 allowBuilds 构建授权后重试

安装与环境配置指引、插件开发教程见 DSH 中文社区文档 ↗

安装即在你的机器上以你的权限运行第三方代码——它可读写文件、使用凭据、访问网络，DSH 的工具审批不会为插件代码加沙箱。「检测到 manifest」仅代表发现 dsh.bundle / dsh.plugin 清单，不构成兼容性或安全审查；安装前请审阅源码，不熟悉的插件先在不含密钥的环境试用。

A plugin for the DeepSeek Harness (DSH) web GUI: a system monitoring tool that shows live system stats in a floating, collapsible panel pinned to the top-right corner.

Features

CPU — live utilisation (computed from /proc/stat deltas) + core count
MEM — used / total with percentage bar
DISK — used / total with percentage bar
NETWORK — download / upload throughput (computed from /proc/net/dev byte deltas)
Top 6 processes — PID, name, CPU%, MEM%
Dark color-coded palette (cyan CPU, magenta RAM, yellow disk, blue/green network), monospace
Draggable via the title bar, collapsible via the – / + button
Transient monitor processes (ps, awk, head, …) are filtered out of the top-processes list

How it works

Part	File	What it does
Host half	`lib/index.js`	Registers `GET /api/dsh-top-stats`; reads CPU, memory, disk, network and top processes with read-only `/proc` + `ps` + `df` reads.
Browser half	`lib/client.js`	`dsh.client` web bundle; registers the panel into the frame-wide `shell.overlay` slot; polls every 2 s.
Composition	`cordis.patch.yml`	The `dsh.bundle` patch layer that inserts the loader entry.

Security

Because it is a system monitor, the host half reads host-wide process, CPU, memory and disk state. To do that it invokes the fixed read-only binaries cat, ps and df via execFileSync with a static argv array (never a shell string), so there is no shell-injection surface and no attacker-controlled input. No data leaves the host, no credentials are read, and every read is read-only.

dsh.so's static scanner flags the node:child_process import as "critical". That is a heuristic signal on the mere presence of process access — not a vulnerability. Process access is intrinsic to a monitoring tool; review the (small) source yourself: the commands are hard-coded, read-only, and argument-confined.