@zhengcankai/deepseek-harness

Patched DeepSeek Harness CLI, runnable through npx.

Tracks upstream @deepseek-ai/dsh and @deepseek-ai/dsh-llm-deepseek at 0.1.5-rc.2 (bumped from 0.1.1-rc.2 in 0.1.6; all three remaining patches were re-verified against the pristine 0.1.5-rc.2 tarballs).

npx --yes @zhengcankai/deepseek-harness web --port 8080

Both bin names are provided:

npx @zhengcankai/deepseek-harness web
npx dsh-zck web

The wrapper applies three patches at startup (and also via postinstall):

1. content-visibility on @deepseek-ai/dsh-web-frontend (dist/index.html): injects a style that renders only viewport-near conversation rows, so very long sessions (hundreds of KB of text) stop freezing the browser on every streamed chunk.
2. content_filter as stop on @deepseek-ai/dsh-llm-deepseek: OpenAI- compatible upstreams legally return finish_reason=content_filter; dsh's default mapping turns unrecognized reasons into an error and aborts the whole turn. This patch maps it to a normal stop so the turn ends cleanly.
3. connection RPC webServer inject on @deepseek-ai/dsh-client-connection (added in 0.1.7): the RPC registry resolves owner.webServer inside an effect() fiber, which cordis 0.1.5 rejects with cannot get property "webServer" without inject. Any plugin that calls ctx.connection.rpc.handle() (e.g. dsh-funny-wiki panels) therefore failed to load and aborted the whole plugin tree. The patch wraps the registration in ctx.inject(['webServer']) — the same shape the core uses for its own /api route.

Three patches carried by 0.1.5 were dropped because upstream 0.1.5 fixed them natively (verified against the pristine 0.1.5-rc.2 source):

| Dropped patch | Upstream fix in 0.1.5 | |---|---| | empty tool-name overwrite | block.name = acceptIdentity(block.name, call.function?.name) | | privileged-methods loopback-only fence | isTrustedApiRequest(request, this.trustedHosts) | | serializeAssistant missing name field | name: block.name ?? "" |

Note: 0.1.5 requires a browser-session cookie. dsh web prints http://host:port/?token=...; opening that URL once mints an authority-bound signed cookie (30 days by default, cookieMaxAgeDays). Deployments reached through a domain/proxy need one such visit per authority.

Requires Node.js >= 22.19.