Introduction

In DeepSeek Harness (DSH) plugin development, AI-generated deliverables are usually presented as text. However, when a problem requires multi-step user interaction, parameter tuning, drag-and-drop decisions, or real-time fitting, pure text interaction is insufficient.

dsh-web-app aims to solve this. It transforms AI-generated deliverables from static text into interactive single-file HTML artifacts—utilities, mini-games, or control panels. These artifacts use a Git repository as the source of truth and are opened inline in a conversation through the /webapp command. After the user interacts with the page, results are returned to the model through fill-in templates, forming a human-and-machine relay workflow.

What It Is

dsh-web-app is a DSH client plugin. It allows developers to deploy single-file HTML applications to a local Git repository and run them seamlessly embedded in a DSH conversation stream via an iframe. The interaction process is invisible to the model, but the interaction results are injected into the session after user confirmation, prompting the model to continue decision-making.

Maintainer: frankshi2024.
License: MIT.

Core Features

The plugin provides the following core capabilities:

  • Automatic appearance after deployment: When the app is deployed or updated in the current turn, an experience card automatically appears at the end of the conversation; click “Try Now” to expand it.
  • Model-initiated card insertion: Through the dsh-web-app-show tool, an app card can be forcibly inserted in the middle of a conversation.
  • Zero model-call opening: /webapp is a pure UI command, and opening the app does not consume model tokens.
  • One-time ticket mechanism: Each load generates a unique loadId and token, which expire after 10 minutes. The token is written into the HTML when served and is never exposed in the URL, used for security verification.
  • Strict validation chain: When intercepting a callback, it validates event.source, ticket validity, and that the key set and types (TEXT/NUMBER/BOOLEAN/JSON) strictly match.
  • User confirmation by default: Before sending results back, it displays the fully rendered text to prevent accidental operations. This can be disabled in the configuration.
  • Same-turn deduplication: Within the same turn, if the flow is not interrupted and the payload is strictly identical, duplicate submissions are blocked.
  • Git as the source of truth: The app version is determined by branch + commit. After modifying the repository contents and committing, clicking “Refresh” on the card pulls the new version.
  • Fullscreen mode: Supports one-click fullscreen (press ESC to exit), suitable for complex interactions.
  • Layered Skills: Provides two skills: dsh-web-app-author (deploy/modify) and dsh-web-app-interpret (interpret callbacks).

Installation and Activation

Run the installation in the DSH profile directory (for example, ~/.dsh/profiles/<profile>):

pnpm add link:/path/to/dsh-web-app

After installation, add "dsh-web-app" to the dsh.profile.bundles array in that profile’s package.json file, then restart or hot-load the plugin.

Environment requirements: Node.js ^22.19.0 or >=24.0.0.

Typical Usage

  • Open an app: Type /webapp in the conversation to select an app, or use /webapp <name> to directly open a specified app.
  • Fullscreen operations: Click “Fullscreen” in the top-right corner of the card, or press ESC to exit.
  • Update the version: Modify the code in the local Git repository and run git commit, then click the “Refresh” button on the card.
  • Manage apps: Click the “Web Apps” icon in the sidebar to view the version, repository status, or delete the app.
  • Deploy a new app: Ask the AI to execute the dsh-web-app-author skill flow, or directly use the dsh-web-app-deploy tool.

Technical Details and Notes

  • Fill-in templates instead of source-code reading: The model consumes interaction results, not the process. When sending results back, use a predefined fill-in template (callback.template.md) to populate the user’s operation results, rather than reading the HTML source code.
  • Positioning comparison: If it is only simple structured form Q&A, GenUI form components (such as ask-user-question) are lighter. dsh-web-app is suitable for complex interactive artifacts, such as operations panels and travel decision trees.
  • Security model:
    • It runs in an iframe with sandbox="allow-scripts" and without allow-same-origin. The app cannot access cookies or the DOM, nor directly request /api.
    • The data channel uses the plugin’s own prefix routes.
    • Forged callbacks are intercepted by ticket validation and structural validation; user confirmation is the final safety net.
  • Peer dependencies: dsh-commands, dsh-tools, and dsh-host-webserver are hard-injected; if dsh-skill is missing, the plugin skips skills registration.

Summary

By combining Git repositories and single-file HTML, dsh-web-app realizes “interactive artifacts” in the DSH ecosystem. It addresses the limitations of AI text delivery, enabling complex interaction logic (such as parameter tuning and state switching) to be designed by the model, operated by the user, and driven by data.