1. Confirm DSH and the target profile
DSH ships Web and Headless profile templates, and community bundles can create other profiles. Start the official Web surface once if you have not initialized DSH, then choose the profile that should receive the plugin.
npx @deepseek-ai/dsh web2. Inspect the repository before installation
Read the package manifest, bundle patch, install scripts, license, release history, and open issues. Confirm the supported DSH version, profile, operating systems, required credentials, and any network, shell, browser, or filesystem access.
- Prefer a package or commit you can pin.
- Check whether built artifacts are included.
- Treat curl-to-shell commands and postinstall or prepare scripts as code execution.
- Use a dedicated test profile for unfamiliar projects.
3. Add the bundle to a profile
The official CLI forwards plugin-management arguments to pnpm inside the profile directory. A package declaring dsh.bundle is also appended to the profile bundle stack.
dsh plugin --profile web add <package-or-git-spec>4. Pin Git installations and review build permission
A Git dependency installs source rather than prebuilt output. Its prepare script may need to build the package, and pnpm 10 or newer blocks that script until the package is explicitly allowlisted.
dsh plugin --profile plugin-test add github:owner/repository#<commit-sha>5. Verify the effective configuration
Inspect the composed plugin tree without booting it. Confirm that the expected bundle layer and rows appear, with no unexpected services or unresolved modules.
dsh --profile web --dump-config6. Smoke-test and roll back
Boot the profile, run one low-risk task, verify logs and behavior, then test removal. A reversible installation is part of a reliable install path.
dsh plugin --profile web remove <package-name>DeepSeek Harness is in developer preview. Recheck official documentation and plugin evidence when the host version changes.
Official sources
These primary sources were used to verify the technical details in this guide.