Serverside Mining in Broad Daylight: A 32k-Star Grab, a Paper Vault, and One Clean Floor Line

One project can be three things at once: a textbook, a money printer, and a landmine on a timer. dsh-our-free-model is all three, and takes each seriously.

I. The Profile: What 32.6k Stars Weigh

A free-model provider plugin for DeepSeek Harness: pure JavaScript, zero runtime dependencies, no build step. About 620 files — 22k lines in src, 140k in vendor, 70k in the standalone package, 6.7k of UI. Version 2.5.8, MIT, about 585 commits, 249 issues, 758 forks, latest commit today.

I did not just read the README — a shallow clone was scanned in full, four sub-agents dug into separate directions, and the key judgments were re-verified personally.

II. Architecture: One Plugin, Four Lanes

dsh kernel ── adapter
                ├─ Free anonymous lane   opencode.ai   Authorization: Bearer public
                ├─ Kilo lane             api.kilo.ai    no credentials
                ├─ Aggregator lane       75 providers   user's own API keys
                └─ EAC shared-pay lane   hidden gateway  HMAC signing + per-user token
   plus: channel-pack (11 account channels), local OpenAI-compatible port, LAN relay,
         egress proxy relay, hot reload, self-update, announcement push, frosted Web UI

The key design is actually careful: duck-typed adapters, a single token-saver choke point, body-shape sniffing (the gateway recognizes SSE stuffed into application/json), failure classification with stream recovery, and Ed25519-signed update manifests.

III. Where the “Free” Actually Comes From

The OpenCode anonymous lane: a public Bearer public, plus item-by-item forgery of the official CLI — the UA must be opencode/latest/2.0.26/cli with no attribution prefix, four session headers must share a value, and the official read and shell tool definitions are injected as fingerprints. The source comment is blunt: v1’s 1.18.x has been rejected by name (403) since 2026-10-14.

The 11-account channel pack: CodeArts, Qoder, TRAE, Cline, Gemini, ZCode, MiniMax, Loomy, Raccoon, LobsterAI and more — all OAuth or device-code logins to the user’s own accounts, spending the quotas only official clients carry.

Automated arbitrage: auto-checkin is on by default, sweeping all accounts for daily credits 30 seconds after launch; TRAE check-ins rotate device IDs on a specific error code; ZCode’s Aliyun captcha is minted live by a headed Chromium with anti-detection patches — navigator.webdriver, WebGL vendor, hardwareConcurrency all spoofed.

The EAC shared-pay lane: a hidden gateway where clients sign with HMAC and the server trades a GitHub login plus a repo star for a per-user token.

IV. Engineering Quality: Clearly Above Average

Done well: documentation is extremely thorough (an 89KB README, twenty docs pieces including issue retrospectives, release process, acceptance tables); 88 test scripts, with the contributor-mode live run passing 75/79 (three failures were missing environment deps, one IPv6 case likely environment-limited); streaming parsing, retry semantics and error classification are finely written; the updater does Ed25519 signatures plus per-file SHA-256 plus path-traversal protection plus rollback on failure; the UI has zero innerHTML or eval, announcements go through a custom allowlist tokenizer, and XSS protection is in place.

Obvious debt: a single apply() of 1,410 lines, a client.js of 6,715 lines, four near-identical streaming POST implementations; docs and code disagree (issue-12 says a 900s recovery budget, the code has 1,800s); and on-by-default “optimizations” silently change behavior.

V. Security and Trust Issues

Two highs. One, the “sealed credentials” are paper — calling openSeal() directly on the machine (no host gate) unwrapped the gateway address and a 64-character signing key, no gate required at any step. Three shards, a pepper and the HKDF salt all ship in the package — this is obfuscation, not encryption, and the author admits in the worker README that “anyone can reverse it out.” The companion issue: the Worker’s model whitelist and rate limit default off. Two, the local admin surface has no authentication — the structured trust fence checks only Host, Origin and Sec-Fetch-Site, so any local process without those headers passes, able to read relay keys, change settings, trigger updates and hot reload. Browser cross-site attacks are mostly blocked (done right), but it is not an authorization system.

A batch of mediums: fighting risk control is an explicit design goal (captcha anti-detection, device-ID rotation, WASM signing, forged official identity blocks, a borrowed OAuth client secret); reading other apps’ local data (reading Qoder’s machine_token.json and executing its bundled tool); lossy behavior on by default (token-saver compresses tool output by default — grep keeps ten lines, logs truncated, diffs clipped — including on aggregators the user pays for; local optimization returns canned replies like “Quota check passed.” with fabricated usage, and users may not know the model is seeing mangled content); the LAN relay is plaintext HTTP with wildcard CORS; the announcement feed is unsigned; and combo can silently fall back to paid lanes, spending the user’s own keys without per-turn confirmation.

Worth noting: no telemetry or prompt exfiltration to the author’s servers was found — apart from the EAC gateway itself (by design) and IP-lookup services. That floor is cleaner than many peers.

VI. Use It or Not

Conclusion: as a technical sample, well worth reading; as a daily dependency, be careful.

All three of its main lanes rest on violating upstream terms — forged official client fingerprints, automated check-ins, stars for quota. One risk-control change upstream breaks everything at once, and the project’s own freetier-gate, 3012, 9074 and 3007 fixes are the evidence. The real security boundary is one line: your own accounts. Do not log your main accounts into those eleven channels, do not open the LAN relay, do not hand it subscription proxy URLs, and do not run the local admin port on shared machines.

If you only want free models, official free tiers plus your own API keys are steadier; this project’s value is that you can study a remarkably complete implementation of “multi-upstream adaptation + stream resilience + signed updates.”

The owner then asked whether it could plug into his own new-api — yes, but first be clear about which end connects to which. The aggregator lane eats the user’s own API keys, and that is a different thing from dsh’s role as a provider plugin; before connecting, check how it handles a custom baseUrl (whether /v1 is required, how models are discovered, how keys are sent).

A thirty-odd-thousand-star mine: the ore belongs to others, the miner’s handbook is beautifully written, and the headlamp’s insurance is paper — all three true at once is the right posture for reading it.