hyqibot/DeepSeek-Harness-Token-Free
C3A token-free desktop client for the DeepSeek Harness，enjoy！为 DeepSeek Harness (DSH) 生态打造的全免Token费的桌面端 ，极简极易。内置多模态+顶尖工具链能力的大模型 HYQi（Flash / Image / Video）：生图+生视频均免token费，无需API。有疑问可从Readme处二维码进社区交流，
★ 10+ · hyqibot/DeepSeek-Harness-Token-Free source on GitHub · this plugin in the registry
hyqibot/DeepSeek-Harness-Token-Free is a DeepSeek Harness plugin rated C3 — powerful capability combined with sensitive behavior. It patches the dsh runtime, can spawn subprocesses, executes system commands, decodes base64 in development tooling the package does not ship.
Installable plugin — declares a dsh.bundle manifest
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| patches the dsh runtime | runtime_patch | ./cordis.patch.yml |
| can spawn subprocesses | subprocess_service | inject: subprocess |
| executes system commands | exec | ×18 in authored code, e.g. scripts/verify-layout.mjs:1, scripts/verify-layout.mjs:1 |
| decodes base64 in development tooling the package does not ship | base64_decode_tooling | ×1 in development tooling the package does not ship, e.g. dsh-plugin-desktop/scripts/release-preflight.ts:55 |
| starts a network server | net_server | ×2 in authored code, e.g. dsh-plugin-desktop/src/channel-mobile-http.ts:40, dsh-plugin-desktop/src/zero-token-gateway.ts:57 |
| reads credential-class env vars | token_env | CC_HAHA_WEBAUTH_NODE, CC_HAHA_WEBAUTH_RUNNER_BUNDLE, COPAW_ZERO_TOKEN_KEEPALIVE, COPAW_ZERO_TOKEN_PYTHON, DSH_ZERO_TOKEN_NODE, GH_TOKEN |
Services it injects
appExit credentials desktopChannels desktopPnpm desktopPnpmBootstrap desktopProfiles desktopRuntime llm sessions settings slots subprocess theme webRuntime webServer
Hooks it attaches
settings/updated theme/change
Outbound domains
electronjs.org chat.deepseek.com api.telegram.org license.hyqibot.com hyqibot.com git-scm.com discord.com open.feishu.cn ilinkai.weixin.qq.com api.deepseek.com
Environment variables it reads
USERPROFILE DSH_TELEMETRY_DISABLED CC_HAHA_WEBAUTH_NODE DSH_ZERO_TOKEN_NODE Path COPAW_ZERO_TOKEN_PYTHON CONDA_PREFIX PYTHONPATH NODE_TLS_REJECT_UNAUTHORIZED COPAW_INSECURE_TLS
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.