Preface¶

DeepSeek Harness (dsh) treats models, tools, sandboxes, sessions, and interfaces as replaceable Cordis plugins. During the developer preview phase, adding Bundles to a Profile is convenient, but problems usually arise later: evidence scattered across browser bookmarks and chat logs, different tasks competing for the same context, not knowing what’s inside a bundle before installing it, and which Bundles will break after an RC upgrade. Even after modifying and rolling back cordis.patch.yml, there is no verifiable plan to follow.

The community catalog categorizes such capabilities under “Tools & Capabilities”. The dsh-toolbox approach packages product research, context switching, plugin preflight, and compatibility monitoring into four native Bundles, then uses a console running outside the Harness process to view Profiles, perform health checks, preview changes, and roll back. This article is organized after cross-checking with the catalog page, GitHub repository README, package.json, and LICENSE.

Two things need to be clarified first. The official repository for DeepSeek Harness is deepseek-ai/deepseek-harness, with the core concept of “everything is a plugin”. The community plugin catalog deepseek-harness-plugin.com is an independent site with no official affiliation to DeepSeek / Fang, and should not be treated as an official app store. The README for dsh-toolbox also clearly states that the project is independently developed and has no affiliation or endorsement relationship with DeepSeek.

What is this¶

dsh-toolbox is a supporting tool for DeepSeek Harness designed for individual local workflows, maintained by HiWhaleW, with source code at HiWhaleW/dsh-toolbox. It is categorized under “Tools & Capabilities” on the catalog page. As of 2026-08-17, both the catalog page and GitHub repository have 26 stars. The repository version is 0.2.1, and the primary language is JavaScript.

It does not aim to build another chat skin, but solves the following problems:
- Collect public web pages or pasted text into traceable research evidence, and export Markdown / HTML reports
- Route tasks to isolated runtime contexts that can be rolled back after activation
- Perform static checks on package semantics, capability signals, SBOM, and fingerprints of local Bundles before installation
- Take compatibility snapshots against target runtimes, and review differences before upgrading
- View Profiles, plan Bundle changes, back up, and roll back outside the Harness process

Four functional packages run as native DSH Profile Bundles; the fifth item, DSH Switchboard, is deliberately placed outside the current Harness process. The reason given in the README is straightforward: a running plugin should not modify the configuration that started it.

Source code for versions 0.2.1 and later uses the PolyForm Noncommercial License 1.0.0, which permits personal learning, research, experimentation, education, and non-commercial uses as defined in the license text, commercial use is not allowed. The SPDX fields on the catalog page and GitHub show NOASSERTION, because this license is not in GitHub’s common SPDX list; the original LICENSE text in the repository shall prevail. Earlier copies distributed under the MIT license remain bound by their original authorization terms.

Core Features¶

The repository splits its capabilities into five packages. The first four can be installed independently, and the fifth is a locally hosted control plane distributed via source code, and is currently not an npm dependency of any DSH Profile.

The four Bundles total 31 tools. The release checklist in SECURITY.md also requires loading the four packaged Bundles in an isolated DSH_HOME, verifying --dump-config, all 31 tool registrations, and native runtime contexts.

Product Research Workbench¶

product-research-workbench collects pasted text and public web pages into evidence cards, clusters pain points, scores opportunities, and generates reports. Extraction and clustering use local deterministic rules, without calling a model again. URL imports only send GET requests to unauthenticated public http(s) pages, and by default block loopback, private network, link-local, metadata, and other non-public addresses. Authenticated crawling, browser cookies, CAPTCHA bypass, and social media scraping are outside the scope of the MVP.

The default data directory is ~/.local/share/dsh-toolbox/product-research-workbench. Reports can be exported as both Markdown and self-contained HTML, with no remote scripts loaded in the HTML. research_export does not include source content by default; only when explicitly enabling includeSourceContent=true will the original text be included in recoverable JSON backups.

Context Switchboard¶

context-switchboard saves context configurations with keywords, guidelines, resource pointers, and token budgets, performs deterministic routing by task, and injects an isolated runtime context snapshot via DSH’s native systemPrompt.context() registry. The current full package materializes into a snapshot in the session and replaces the previous one, rather than accumulating indefinitely. It does not replace deployment personas, sandbox policies, or approval policies. Resource pointers are only labels, and plugins will not automatically open these paths.

The recommended workflow is: context_profile_save → context_route → context_activate → context_current / context_history → context_rollback.

Plugin Preflight & Compatibility Radar¶

plugin-preflight is a read-only static scan. plugin_preflight_scan checks package manifests, patch semantics of Profile Bundles, packaged files, license declarations, lifecycle scripts, dependency names, symbolic links, file sizes, and capability signals in JS/TS, and outputs structured findings, SHA-256 fingerprints of packaged content, dependency SBOM, and Markdown. plugin_preflight_report then generates private Markdown / HTML audit reports. It does not execute scripts, install dependencies, follow symbolic links, or access the registry. Passing the scan does not guarantee security.

compatibility-radar reads local package.json files within allowed scopes, compares them against target runtimes, can save snapshots, and uses compatibility_diff / compatibility_report to review upgrade risks. It understands common version specifiers in current DSH plugins, including exact versions, comparators, caret, tilde, wildcards, and || ranges. The radar will not automatically upgrade software, nor check the registry in the background. Pre-release semver versions still require a real installation smoke test.

Switchboard: Out-of-Process Local Console¶

DSH Switchboard discovers Profiles under $DSH_HOME/profiles, parses ordered Bundle layers, calls Preflight and Radar, generates auditable change plans, uses the official dsh --profile <name> --dump-config for runtime validation, and stores backups and rollback receipts in SQLite. Read-only checks do not require dsh to be on the PATH; write operations or rollbacks require the CLI by default, as a successful dump-config run acts as a security gate.

The graphical interface starts after cloning the repository:

pnpm install --frozen-lockfile
pnpm switchboard:gui

Then open http://127.0.0.1:4173/. The service only listens on the local loopback address, reads $DSH_HOME/profiles, does not expose API credentials, and requires review before writing. The left sidebar has four working views: DSH Profiles, Plugins, Activity, Settings; the right sidebar displays recent activities permanently.

The repository README also provides an online interactive demo: https://dsh-toolbox.lisongyang0130.chatgpt.site . The online version only simulates health checks, Bundle toggles, change plans, activities, and rollbacks in the current browser’s memory, and resets on refresh. It will not connect to the visitor’s computer, read DSH Profiles, API credentials, or SQLite databases. The real DSH connection is only established after installing the local version.

Installation & Enablement¶

The installation command given on the catalog page is:

dsh plugin add github:HiWhaleW/dsh-toolbox

For reproducible installations, the catalog page recommends pinning a commit:

dsh plugin add github:HiWhaleW/dsh-toolbox#commit

Replace #commit with the actual hash. The plugin runs with the permissions of the current dsh process, and may execute code during installation. You should inspect the source repository and license before installing.

The root repository’s package.json is marked as a private workspace, and SECURITY.md states that no npm packages or GitHub Releases have been published yet. The README documents a verified portable workflow: first run npm pack on the four workspace packages, then add them to the same Profile individually. Packing itself does not execute plugin code, and does not require installing repository dependencies first.

Environment requirements are from the README:
- Node.js ^22.19.0 || >=24.0.0 (uses built-in node:sqlite)
- npm, for packaging local Bundles
- @deepseek-ai/dsh@0.1.0-rc.6
- A local DSH Profile you have permission to modify

Verified combinations include DeepSeek Harness 0.1.0-rc.6, DSH Tools 0.1.0-rc.6, Cordis 4.0.1, Node.js 24.x, and the declared 22.19+ range. If you do not have a pinned CLI installed locally yet:

npm install --global @deepseek-ai/dsh@0.1.0-rc.6
dsh --version

The five-minute installation (original workflow from the repository README, version number corresponds to 0.2.1):

git clone https://github.com/HiWhaleW/dsh-toolbox.git
cd dsh-toolbox

mkdir -p dist
npm pack --workspace @dsh-toolbox/product-research-workbench --pack-destination dist
npm pack --workspace @dsh-toolbox/context-switchboard --pack-destination dist
npm pack --workspace @dsh-toolbox/plugin-preflight --pack-destination dist
npm pack --workspace @dsh-toolbox/compatibility-radar --pack-destination dist

dsh plugin --profile toolbox add ./dist/dsh-toolbox-product-research-workbench-0.2.1.tgz
dsh plugin --profile toolbox add ./dist/dsh-toolbox-context-switchboard-0.2.1.tgz
dsh plugin --profile toolbox add ./dist/dsh-toolbox-plugin-preflight-0.2.1.tgz
dsh plugin --profile toolbox add ./dist/dsh-toolbox-compatibility-radar-0.2.1.tgz

dsh --profile toolbox --dump-config

The last command should show the four Bundle layers. Start the Profile later with:

dsh --profile toolbox

You can install only the required tarballs. None of the packages have install lifecycle scripts. You can also install from the checked-out path after running npm install in the repository root, but tarballs align better with npm packaging semantics and are the verified portable method in the documentation.

Switchboard is currently a technical preview distributed via source code, run from the checked-out directory:

npm run switchboard -- detect
npm run switchboard -- profiles
npm run switchboard -- inspect toolbox
npm run switchboard -- health toolbox

Change commands follow a plan-first pattern: without --apply, only the plan is printed and no changes are written to disk.

npm run switchboard -- bundle disable toolbox @dsh-toolbox/context-switchboard
npm run switchboard -- bundle disable toolbox @dsh-toolbox/context-switchboard --apply
npm run switchboard -- history

It saves SHA-256 state fingerprints, atomic write backups, and SQLite receipts; expired plans will be rejected, and it will not force a rollback if the Profile has been manually modified by the user afterwards.

Typical Usage¶

The four Bundles register tools within DSH, and are not independent shell commands. You can call the tools directly by name to the assistant, or describe the goal and let dsh choose.

Recommended sequence for product research:

research_create → research_add_source → research_extract
→ research_evidence_add (optional manual correction)
→ research_analyze → research_report

Example prompt from the README:

Create a research project called "Local AI research workflows".
Import this pasted interview text, extract evidence, analyze the opportunities,
and generate both Markdown and HTML reports.

Example prompt for context switching:

Save a context profile named "DSH plugin development" with the keywords
"dsh", "cordis", and "plugin"; use a 1,200-token budget. Route this task,
activate the best profile, and show me the activation receipt.

Pre-installation preflight check:

Run plugin_preflight_scan on packages/context-switchboard and explain every
finding before I install it. Then create the Markdown and HTML audit report.

Compatibility snapshot:

Discover DSH bundles under packages, check them against DSH Tools 0.1.0-rc.6,
Cordis 4.0.1, and my current Node version, then save a compatibility snapshot.

Before upgrading DSH or Cordis versions, save another snapshot and use compatibility_diff or compatibility_report to check for regressions. The radar will not perform upgrades on your behalf.

The default data directories are under ~/.local/share/dsh-toolbox/, organized into subdirectories by component. Runtime databases, reports, exports, sessions, environment files, and cookies are excluded in the repository’s .gitignore, but you should still check the staging area before committing. Research reports and exports may contain original text, citations, URLs, local paths, or personal information, so you should review them before sharing externally.

Applicable Scenarios & Notes¶

This tool is suitable for the following people and scenarios:
- Running DeepSeek Harness locally, with more and more Profile Bundles installed, needing visual inspection and rollbackable changes
- Conducting product research and wanting to keep evidence, analysis, and reports in local SQLite instead of sending them to hosted backends
- Developing or reviewing community plugins, wanting to check package semantics, lifecycle scripts, and capability signals before installation
- Pinning to RC versions like 0.1.0-rc.6, and wanting to save compatibility snapshots before upgrading

Please note the following points, all from the catalog page or repository documentation:
1. The plugin runs with the permissions of the current dsh process. Installation may execute code. Inspect the source code and license before installing; pin a commit for reproducible installations.
2. This is an experimental MVP, for non-commercial use only. DeepSeek Harness is still in Developer Preview, and version upgrades may break Profile Bundle compatibility. Commercial products, paid services, commercial consulting deliverables, or internal business uses are not permitted per the license terms.
3. The online demo does not equal local data. The demo site only simulates operations in browser memory; real Profiles, backups, and SQLite databases only exist in the full local version.
4. Passing the preflight scan does not guarantee security. Static scans may miss transitive dependencies, obfuscated code, native modules, or runtime behavior. SBOMs are generated from manifests, not parsed dependency graphs.
5. The context package will not modify sandboxes or approvals. Imported context configurations should be reviewed as untrusted configurations before activation.
6. There are hard Node.js version requirements. You need ^22.19.0 || >=24.0.0. The Switchboard GUI binds to 127.0.0.1 and is not a multi-user authorization boundary; other processes under the same operating system user may still directly read Profiles or backups.
7. Reports may contain local paths. Screenshots, diagnostics, and HTML reports should be sanitized before sharing. For full boundary details, see the repository’s PRIVACY.md and SECURITY.md.

Summary¶

dsh-toolbox packages product research, context routing, plugin preflight, and compatibility monitoring into four local Bundles, then uses an out-of-process Switchboard to perform Profile health checks, change planning, and rollbacks. Data is stored in local SQLite by default, with no accounts, hosted backends, or telemetry. For users who are tinkering with DeepSeek Harness Profiles locally, it primarily fills the gaps of “being able to install them, roll back changes, and preview upgrades first”.

Related links:
- Catalog page: https://deepseek-harness-plugin.com/zh-CN/plugins/dsh-toolbox/
- GitHub: https://github.com/HiWhaleW/dsh-toolbox
- Online demo (browser memory only simulation): https://dsh-toolbox.lisongyang0130.chatgpt.site
- DeepSeek Harness official repository: https://github.com/deepseek-ai/deepseek-harness