feat: install pinned @deepseek-ai/dsh from npm in /dsh:setup - #5
Conversation
Replace git clone + pnpm build with an npm-prefix install of @deepseek-ai/dsh@0.1.0-rc.6. The cc profile adds the SDK JSON-RPC server plus its published peerDependencies, because profile self-heal cannot resolve @deepseek-ai/dsh-sdk-protocol. --harness still links a user-built checkout and no longer compiles it. --skip-build is removed. Co-authored-by: Gao Peiwen <gpw0426@hotmail.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d3530303f5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const probeBefore = probeProfile("cc", { mustContain: JSONRPC_PLUGIN, cwd }); | ||
| if (!probeBefore.ready) { |
There was a problem hiding this comment.
When npmPinStale causes a future /dsh:setup run to reinstall a newer CLI, an existing cc profile still makes this probe ready because probeProfile only checks that the JSON-RPC package name appears in --dump-config. The guarded plugin add is therefore skipped, leaving the SDK server and peers at their previous versions even though the CLI and compatibility pin were upgraded; reinstall the pinned profile specs whenever the npm pin is refreshed, not only when the package row is absent.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Agreed — --dump-config only proves the package name is present, so a pin bump skipped plugin add and left the SDK server/peers on the old versions.
Fixed in c93e836: whenever setup refreshes the npm CLI pin it re-adds the pinned SDK-server + peer specs, even if the profile already looks ready. Matching-pin reruns stay a no-op.
probeProfile only checks that the JSON-RPC package name appears in --dump-config, so a pin bump skipped plugin add and left the cc profile on the previous SDK-server/peer versions. Co-authored-by: Gao Peiwen <gpw0426@hotmail.com>
No-args setup now moves pre-npm harnessCheckout configs (and dshInstall: harness) onto the npm pin; only an explicit --harness keeps a checkout. sdkProfileVersion is written only after a successful plugin add so a failed refresh is retried. --harness errors when packages/sdk/server is missing instead of mixing in the npm SDK pin. Co-authored-by: Gao Peiwen <gpw0426@hotmail.com>
sdkProfileVersion is now npm:<pin> or harness:<realpath> and is compared on every setup so npm→harness and checkout A→B re-add the SDK server. /dsh:check treats a stale CLI pin or profile identity as not ready and adds nextSteps. Co-authored-by: Gao Peiwen <gpw0426@hotmail.com>
2 participants
Summary / 变更摘要
/dsh:setupno longergit clones DeepSeek Harness and runspnpm run build:lib. Default setup installs the pinned npm CLI into the plugin data directory and adds the SDK JSON-RPC server (plus that package's published peerDependencies) to theccprofile.This is required because:
@deepseek-ai/dshis on npm (0.1.0-rc.6); there is no0.1.0-rc.5tarball, so the old git SHA pin cannot be expressed as an npm version.@deepseek-ai/dsh-sdk-jsonrpc-serveris published separately and is outside the CLI dependency closure. Dist-tags are unsafe: on 2026-08-14 CLIlatest/nextwere0.1.0-rc.6while SDK-serverlatestwas still0.0.1-rc.5. Both packages are pinned to0.1.0-rc.6.dsh plugin addfails at boot (Cannot find package '@deepseek-ai/dsh-sdk-protocol'). The launcher's$DSH_HOME/profiles/node_modulesself-heal does not provide those peers. Setup therefore adds the server andHARNESS_SDK_JSONRPC_PEER_SPECS. Nested peer warnings remain; they did not blockinitialize.--harnessstill links a user-built checkout (no plugin-side compile).DSH_BINARY/ PATH skip the CLI install and still repair the profile from registry specs.Breaking / 破坏性变更
--skip-buildis removed.--harnessno longer runspnpm install/build:lib; the checkout must already be built.$CLAUDE_PLUGIN_DATA/npm), not a cloneddeepseek-harnessdirectory.0.1.0-rc.5(47f9438) to npm0.1.0-rc.6./dsh:setupmigrates a persisted source install to the npm pin. Pass--harnessagain to keep a checkout.Review follow-up
c93e836).8ae85fa):harnessCheckoutconfigs migrate to npm on no-args setup.sdkProfileVersionis written only after a successfulplugin add, so a failed refresh is retried;DSH_BINARY+ an already-ready profile also refreshes.--harnesserrors whenpackages/sdk/serveris missing (no silent npm SDK mix).3bbbad3):sdkProfileVersionis now a full identity (npm:0.1.0-rc.6orharness:+ checkout realpath). npm to--harnessand checkout A to B re-add the SDK server; identity is written only after a successfulplugin add./dsh:checktreats a stale npm CLI pin or profile identity as not ready (npm.ok/profile.ready/multiTurnReady) and addsnextStepsto rerun setup.Verification / 验证
npm test— 71/71 pass on Node v22.22.2 (setup e2e uses a fakenpm; CI has no network)initialize. Full broker-turn checklist not run (noDEEPSEEK_API_KEY).Safety and compatibility / 安全与兼容性
docs/dsh-compat.md, when applicable / 如涉及 DSH 假设，已更新兼容性契约Existing
--harness/DSH_BINARYusers: rerun/dsh:setup(pass--harnesswith your checkout path if you still want the source tree). Auto-cloned trees under the plugin data dir are no longer maintained;/dsh:setupwith no args installs the npm pin.Related issue / 关联 Issue
npm-first setup after
@deepseek-ai/dshpublished publicly.