Skillget

lodestar

skill
Security Audit
Fail
Health Warn
  • License — License: MIT
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Low visibility — Only 9 GitHub stars
Code Fail
  • child_process — Shell command execution capability in cli.ts
  • execSync — Synchronous shell command execution in cli.ts
  • Hardcoded secret — Potential hardcoded credential in cli.ts
  • process.env — Environment variable access in config.ts
  • execSync — Synchronous shell command execution in daemon.ts
  • process.env — Environment variable access in daemon.ts
  • network request — Outbound network request in daemon.ts
  • process.env — Environment variable access in email-worker.ts
  • network request — Outbound network request in email-worker.ts
  • process.env — Environment variable access in env-bootstrap.ts
  • process.env — Environment variable access in feishu-mcp.ts
  • network request — Outbound network request in feishu-mcp.ts
Permissions Pass
  • Permissions — No dangerous permissions requested
Purpose
This tool acts as a bridge connecting the Claude Code CLI to Feishu (Lark) and email, allowing users to manage autonomous digital employees, monitor ongoing AI sessions, and approve permissions via a chat interface.

Security Assessment
The overall security risk is rated as High. The scan detected multiple instances of synchronous shell command execution (`execSync`) within the codebase, specifically in `daemon.ts` and `project-lock.ts`. If an attacker successfully injects a malicious prompt or compromises an incoming message, these synchronous executions could allow arbitrary command execution on the host server. Additionally, the tool requires outbound network requests, file system access, and environment variable access to facilitate its core messaging and monitoring functions. While no hardcoded secrets or explicitly dangerous permissions were found, the execution flaws pose a significant threat.

Quality Assessment
The project is very new and currently has low community visibility with only 9 GitHub stars, meaning it has not been broadly tested or vetted by a wide audience. However, the repository is under active development (last push was today), and the code is legally unencumbered under the standard MIT license. The README is comprehensive and clearly documents the tool's constraints, noting that the underlying Claude channel feature is not yet fully public.

Verdict
Use with caution — the tool is highly useful for remote AI management but poses significant security risks due to its use of `execSync`.
SUMMARY

一人公司最佳实践，不止是claude的飞书channel，更是你的带领数字员工的管理工具

README.md

English | 中文

夜航星 Lodestar

夜航星 (Lodestar) v2

DeepSeek TUI 迁移版

夜航星已从 Claude Code 迁移至 DeepSeek TUI。核心交互逻辑由 Runtime API + SSE 事件流替代了原有的 tmux spawn + JSONL 文件 IPC。飞书群的协作体验保持不变。

飞书 (Lark) 协作通道，用于 DeepSeek TUI — 在飞书群里和 DeepSeek 协作，会话持久化、多项目并行、7×24 可用。

项目哲学

AI 不是帮手，是倍率。它放大的不是体力，是你——你的直觉、判断和品味，每一样都被乘以一个你以前不敢想的系数。最终走多远，取决于被放大的你有多强。

夜航星让这件事真正发生：在你思考的地方接住想法，在你转身之后继续把它推向终点。一个群，一个项目，一段不熄灯的对话。你醒着它在听，你睡了它还在跑。

核心功能

  • Markdown 卡片渲染 — 标题、列表、代码块自动转为飞书富文本卡片
  • 实时反馈 — 👌→✅ 表情追踪消息进度，输出流式转发到群里
  • 权限审批卡片 — 一键批准或拒绝，群里点按钮就能远程授权
  • 图片与文件双向传输 — 截图发给 DeepSeek，DeepSeek 也能传文件回来
  • 会话管理 — 发 hi 开工，restart / kill / clear 随时管控
  • 邮件通道 — 受控协作入口：白名单准入、预算上限、权限隔离
  • 状态仪表盘 — 赛博朋克风格监控面板，所有会话一目了然
  • 可靠性保障 — WS 指数退避重连、断线自动恢复、7×24 无人值守

安装

npm i -g @leviyuan/lodestar
lodestar configure               # 生成 ~/.deepseek/lodestar.toml
vi ~/.deepseek/lodestar.toml     # 填入飞书凭证
lodestar daemon                  # 启动

配置文件 ~/.deepseek/lodestar.toml：

[feishu]
app_id = "cli_xxxxxxxxxxxxxxxx"
app_secret = "your_app_secret_here"

[runtime]
port = 7878
api_token = "your_token_here"

前置：deepseek serve --http 已运行：

DEEPSEEK_RUNTIME_TOKEN=lodestar-runtime-token-v2 deepseek serve --http --port 7878

指令

指令 作用
hi 创建或查看会话状态
restart 重启会话（fork 保留上下文）
kill 关闭会话（archive）
clear 清空上下文（新建 thread）
ls [path] 查看项目目录树
普通消息 注入为 turn，DeepSeek 处理后回复

CLI 命令

命令 作用
lodestar daemon 启动守护进程
lodestar mcp 单独启动 MCP server（调试用）
lodestar configure 生成配置文件
lodestar status 查看运行状态

架构

飞书服务器
    │ WebSocket
    ▼
daemon.ts (消息路由进程)
    │
    ├── Lark WS Client  (指数退避重连)
    ├── RuntimeApiClient ────HTTP──┐
    ├── MessageQueue              │
    ├── SseEventHandler ←──SSE────┤
    │                             │
    │  hi    → POST /v1/threads   │
    │  restart → fork + archive   │
    │  kill   → archive           │
    │  clear  → archive + new     │
    └─────────────────────────────┼── localhost:7878
                                  ▼
                    ┌──────────────────────────┐
                    │ deepseek serve --http     │
                    │ Runtime API               │
                    │                           │
                    │ 加载 feishu MCP server    │
                    └──────────────────────────┘

仓库

许可证

MIT

Reviews (0)

No results found