The DeepSeek Harness (DSH) philosophy is “everything is a plugin,” but when using pnpm as the package manager, developers often encounter issues where build scripts are blocked during plugin installation or updates (such as ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED). Frequently testing the latest versions or installing new features makes maintaining the allowBuilds allowlist cumbersome. The dsh-pnpm-build-control plugin provides a unified switch in the DSH interface to control build approval, resolving this pain point.

Plugin Purpose

This is a DSH administration plugin used to uniformly toggle pnpm build-script approval for all configurations in the add-plugin dialog. It supports risk confirmation when first disabled and provides a command-line interface.

  • Owner: Han-1413141
  • Category: admin-security
  • License: MIT License

Core Features

  1. UI Toggle: Adds a “Build Script Approval” toggle to the plugin add dialog.
  2. Approval Control:
    • Enabled: All DSH configurations approve build scripts based on their original allowBuilds rules.
    • Disabled: All DSH configurations allow all dependencies to run build scripts, including GitHub plugins, new versions, and indirect dependencies.
  3. Underlying Modification: Modifies the pnpm-workspace.yaml file in each configuration directory and sets the dangerouslyAllowAllBuilds field.
  4. Status Viewing: Views the actual status of each configuration.
  5. Risk Confirmation: When approval is disabled for the first time, a risk explanation dialog is displayed and must be read and confirmed.
  6. Command-line Support: Provides status, off, and on commands.
  7. Compatibility Fix: Fixes the ambiguous-install error caused by repeatedly installing from the same Git address.

Installation and Activation

Requires Node.js >= 22.19. Install by running the following command in the DSH interface or command line:

dsh plugin --profile desktop add github:Han-1413141/dsh-pnpm-build-control

If you want the toggle to appear in the web configuration, replace desktop in the command with web. After installation, fully exit and reopen DSH to load the plugin.

Typical Usage

Scenario 1: Frequently Testing the Latest Version

When developers repeatedly install the latest test versions, disabling approval can prevent builds from being blocked due to version updates, without manually maintaining new-version allowlist entries.

Scenario 2: Installing New Features

When users install features from a new version, disabling approval allows necessary installation and build scripts to run.

Scenario 3: Fixing Git Installation Errors

When the same Git address is installed repeatedly, the plugin’s compatibility fix can be used to retrieve the latest commit.

Configuration and Risk

  • Scope: All DSH configurations under the current DSH_HOME.
  • File Modification: Disabling approval modifies the pnpm-workspace.yaml file in each configuration directory.
  • Risk Explanation: After approval is disabled, build scripts for all plugins and their dependencies will run with DSH’s current user permissions, capable of reading and writing files and accessing the network. Malicious or tampered dependencies could cause data leakage or execute malicious code.
  • First-Time Disable: You must click the “I understand the risks; disable approval” button; otherwise, the setting will not take effect.

Command-line Usage

The CLI must be invoked using the absolute path to lib/cli.js. The following is a Windows PowerShell example:

# 查看所有 DSH 配置的构建审批状态
node "$env:USERPROFILE\.dsh\profiles\desktop\node_modules\dsh-pnpm-build-control\lib\cli.js" status

# 关闭审批（首次执行需带 --accept-risk）
node "$env:USERPROFILE\.dsh\profiles\desktop\node_modules\dsh-pnpm-build-control\lib\cli.js" off --accept-risk

# 重新开启审批
node "$env:USERPROFILE\.dsh\profiles\desktop\node_modules\dsh-pnpm-build-control\lib\cli.js" on

Notes

  • Uninstall Does Not Revert Settings: Uninstalling the plugin does not automatically revert saved pnpm settings. If you need to restore approval, enable approval first and then uninstall.
  • Node.js Version: Ensure Node.js >= 22.19 is installed on the system.
  • Configuration Backup: Before making changes, the plugin automatically saves the original YAML content to DSH_HOME/pnpm-build-control/backups/.
  • Restart Required: After upgrading the plugin, fully exit DSH (including the tray-resident process) and reopen it to load the new module.

Ecosystem Context

DSH is a plugin-architecture-based development environment. The community directory is an independent site and has no official affiliation with DeepSeek / Huanfang.

  • GitHub Repository: https://github.com/Han-1413141/dsh-pnpm-build-control
  • Community Directory: https://www.skillhub.cn/plugins/Han-1413141/dsh-pnpm-build-control