Developer fixes broken plugin bundle by adopting DSH's native profile format

·4 views

A developer building a six-plugin bundle for the DeepSeek Harness (DSH) platform initially shipped a shell-command chain that failed due to double-slash URL errors causing 404s on every install. After consulting DSH's official documentation, they rebuilt the solution as a proper DSH profile — a single tarball containing a manifest that lists all six plugins — eliminating the need for string concatenation. Two additional obstacles emerged: pnpm blocked URL dependencies in sub-dependencies, resolved by moving them to the profile's top-level, and one plugin had a peer-dependency with no matching published version, prompting a mandatory member health audit step. The submission reviewer's rules were also updated to allow patches referencing declared dependencies, preserving the security boundary while removing a false positive. The final profile, just 417 bytes, successfully loaded all six plugins in a Docker sandbox from a single link.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

pdf-lib's default fonts silently drop non-Latin characters from generated PDFs

A developer discovered that pdf-lib, a popular Node.js PDF generation library, silently deletes non-Western characters such as Polish or Czech letters when using its built-in standard fonts. The default fonts rely on WinAnsi (Windows-1252) encoding, which only covers Western European Latin characters, leaving names like Łódź truncated without any error or log warning. A common workaround of stripping unsupported characters to prevent crashes makes the problem worse, as it causes data loss that is invisible in logs and only detectable by visually inspecting the output. The fix is to embed a TrueType or OpenType font using pdf-lib's fontkit plugin, which supports the full Unicode range. Developers are also advised to enable font subsetting to keep file sizes small and to cache font file reads in serverless environments to reduce latency.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why HTML Emails Break and How Developers Should Handle Images

HTML emails behave differently from web pages because once sent, they enter email clients that may block remote images, rewrite markup, or alter colors for dark mode. Unlike a web page, an email is a delivered document outside the sender's control, making remote image references an unreliable contract. Developers are advised to classify email visuals as critical, decorative, or essential before choosing an embedding strategy, rather than applying a blanket rule. Critical visuals should be embedded inline using a content identifier, while essential information like deadlines or warnings should always be expressed as real text rather than stored inside images. A sample implementation using ASP.NET Core demonstrates how a resolver can load trusted local assets and fall back to remote URLs when needed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Security Report Flags High Oracle Manipulation Risk in Hyperliquid's $6.5B Bridge

A DeFi security research team published a risk report on October 26, 2023, identifying critical vulnerabilities in the Hyperliquid Bridge, which holds over $6.54 billion in total value locked across Ethereum Mainnet and the Hyperliquid L2. The bridge's security model depends on a small set of authorized relayers to submit Merkle state roots, meaning a single compromised relayer key could allow submission of fraudulent withdrawal transactions. Researchers also noted that the bridge does not independently verify asset prices on-chain, instead trusting the L2's internal state, which introduces additional systemic risk. High-latency communication between Ethereum and Hyperliquid L2 was flagged as a further concern, as it creates windows for reorg-based manipulation if finality is not strictly enforced. The report assigned an overall risk score of 7.2 out of 10, classifying the findings as high severity and recommending a shift toward a more trustless architecture.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Zero-Trust Security Layer for Multi-Agent AI Systems Using Gemini and HMAC

A developer created a security framework called the Fortified Enterprise Agent Fleet to address privilege escalation risks in multi-agent AI architectures, submitting it to Google's All Things Agentic Hackathon. The system uses zero-trust principles to ensure that permissions can only narrow — never expand — as tasks are delegated from an orchestrator agent down to specialized worker agents. A Blast-Radius Firewall intercepts each delegated task and assigns a risk score based on the severity of the requested action, blocking and quarantining unauthorized operations instantly. Every delegation event, whether approved or blocked, is cryptographically signed using HMAC-SHA256 to create tamper-evident audit logs that can detect post-hoc manipulation. The stack is built on Gemini 1.5 Flash, Google's Agent Development Kit, and Google Cloud Run.

0 comments Read more at DEV Community