Introduction¶

The DSH ecosystem emphasizes “everything is a plugin”, and the community directory is an independent site, not an official app store. dsh-omv is a vulnerability audit workbench for DeepSeek Harness, based on the public oh-my-vul API, providing a unified workbench around evidence maturity, Finding status, reproduction, deduplication, reporting, and disclosure.

What is this¶

dsh-omv is maintained by bx33661 under the MIT license. It installs into the DSH Web profile, providing evidence maturity, Finding ledger, evidence chain, Agent workflows, Campaign Runner, PoC lab, and workspace export capabilities around the vulnerability audit workflow.

Core Capabilities¶

The following introduces several groups of listed capabilities.

Evidence Maturity Dashboard: Uses five context dimensions instead of a single completion percentage.
Finding Ledger: Supports four types of Finding states: Candidate, confirmed, blocked, and archived.
Evidence Chain Check: View evidence paths via source → sink → guard.
One-click Agent Workflow: Covers audit, reproduction, deduplication, adversarial review, reporting, and disclosure.
Campaign Runner: Supports bounded concurrency, where each lane corresponds to a native DSH forked session, and provides pause/resume/cancel/retry and restart recovery.
Evidence and Reporting: Provides Provenance-aware Evidence Graph, stage-aware report conditions, and structured reproduction runs.
PoC Lab: Supports editable drafts, explicit approval, Docker isolation, /output/result.json, artifact hashes, provenance, and manual Evidence adoption.
Tools and Commands: Provides 29 model tools covering workspace quality, DSH lifecycle diagnostics, Finding, workflow, Campaign Runtime, evidence provenance, reproduction, PoC isolation, dedup, and search; also provides 19 durable /omv* commands, including omv-dedup and the Campaign Runtime command set.
Sync and Export: Supports SSE workspace synchronization with polling fallback; supports Protocol v2 payloads, additive ?protocol=1 compatibility, and full workspace export.

Installation and Enablement¶

First, confirm Node.js meets node >= 22. Below are three installation methods; choose one to execute.

Stable local install¶

First prepare dependencies and build artifacts, then install locally to the DSH Web profile:

cd /path/to/dsh-omv
npm install
npm run build
dsh plugin --profile web add .
dsh --profile web

Source development¶

When local development is needed, use link install and keep npm run dev running:

cd /path/to/dsh-omv
npm install
dsh plugin --profile web add link:.
npm run dev
dsh --profile web

If you previously used a regular local install, remove it first before switching to link install:

dsh plugin --profile web remove dsh-omv
dsh plugin --profile web add link:.

Packed install¶

Install a specific build using a tarball. npm pack will print the filename; use the actual filename printed:

cd /path/to/dsh-omv
npm install
npm pack --silent
dsh plugin --profile web add ./dsh-omv-<version>.tgz
dsh --profile web

After the steps above, verify the profile with the following command:

dsh --profile web --dump-config

The output should include the dsh-omv configuration layer.

Update and remove:

dsh plugin --profile web update dsh-omv
dsh plugin --profile web remove dsh-omv

Configuration¶

Override - id: dsh-omv in $DSH_HOME/profiles/web/cordis.patch.yml. Example:

- id: dsh-omv
  config:
    projectRoot: '/absolute/path/to/repository'
    apiPrefix: '/api/dsh-omv'
    allowMutations: true
    allowRemoteAccess: false
    activityLimit: 60
    refreshIntervalMs: 15000
    campaignConcurrency: 3
    watchDebounceMs: 90
    eventHeartbeatMs: 20000
    httpBodyLimitBytes: 262144

The patch replaces full configuration values, so you need to retain fields you still intend to use.

User preference persistence will use the native dsh-omv settings namespace if exposed by the Host; on DSH rc.6 it falls back to browser-local. Deployment-related configuration is still kept in Cordis Config.

Use Cases and Notes¶

dsh-omv is suitable for teams that need to integrate vulnerability audit evidence, Findings, reproduction, PoC, reporting, and disclosure processes into the DSH Web profile.

The default API is loopback-only: the client address must be 127.0.0.1 or ::1, and the Host header must be localhost, 127.0.0.1, or [::1].

If configured:

allowRemoteAccess: true

It will simultaneously disable the loopback and Host guards, and the entire API (including all mutation actions) will have no authentication.

The plugin runs with the permissions of the current dsh process. Before installing, please check the source code and the MIT license.

Conclusion¶

dsh-omv brings evidence maturity, Finding ledger, evidence chain, Agent workflows, Campaign Runner, PoC lab, and workspace export into a single DSH audit workbench.

Directory page: https://www.skillhub.cn/plugins/bx33661/dsh-omv

GitHub: https://github.com/bx33661/dsh-omv

dsh-omv: Evidence-First Vulnerability Auditing Workbench for DeepSeek Harness