Introduction¶

The configuration of DeepSeek Harness (DSH) is jointly determined by the profile and the selected plugin bundles. When a plugin behaves abnormally during the startup phase, the common result is a repeatedly crashing process or a window stuck on loading. The recovery dialog built into Harness only appears during crashes, and the option is “Disable all third-party plugins and restart after backing up the patch” — which often results in uninstalling all third-party bundles and removing the entire patch layer. Most of the time, you only want to disable the one plugin you just touched.

dsh-safe (GitHub: osman3n/dsh-safe, maintainer osman3n, community category admin-security) directly edits the profile file from the terminal when the application is closed, without relying on Harness being able to start up from a crash state; in a Healthy session, you can also view status and take snapshots before changes via tools exposed by the plugin.

What is this¶

In one sentence: dsh-safe is an out-of-band safety net for DSH plugins; the same package contains installable Harness bundles as well as a standalone CLI and a local recovery page.

It solves the problem of how to selectively disable bundles, roll back from snapshots, and perform test boots without modifying the real profile when the profile cannot start due to plugin issues.

Core Features¶

Out-of-band CLI and Recovery UI¶

When DeepSeek Harness is not running, crashed, or frozen, execute dsh-safe.cmd (or node dsh-safe.mjs) in the repository’s tools/dsh-safe directory. It depends on Node.js 22+. The README indicates that the recovery CLI targets Windows (using tasklist, cmd.exe, and desktop executables); Harness internal tools are standard Node, usable in the Harness environment.

Common entry points:

dsh-safe.cmd status              :: Current profile path, recent installations and crash clues
dsh-safe.cmd plugins             :: Numbered list + installed but deselected bundles
dsh-safe.cmd try                 :: Clone profile to a temporary name, start in an isolated DSH_HOME, probe web services, then delete the clone; real profile remains read-only
dsh-safe-ui.cmd                  :: Open local recovery page in browser (still usable when app is down)

The recovery page listens on 127.0.0.1, displaying recent startup failure evidence, a list of optional plugins, snapshots, test boots, and actions like “Launch Harness”; watch can automatically open this page when new crashes or startup failure logs appear.

Snapshots and Rollback¶

snapshot copies package.json, cordis.yml, and cordis.patch.yml to $DSH_HOME/safety/snapshots/<id>/, optionally with -l label. restore takes a snapshot of the current state first before writing the selected snapshot; if no id is provided, it restores the most recent one.

Recommended before risky operations:

dsh-safe.cmd snapshot -l before-thing-x

Selective Disable / Enable¶

disable / enable support bundle names or entry ids (e.g., include:workflow-kit), and --dry-run can be used for preview. Core bundles (@deepseek-ai/dsh-base, @deepseek-ai/dsh-web-app) are protected by default and will not be disabled unless --force is specified.

recover reads the latest startup logs to explain which plugin failed. recover --pick --apply allows interactive selection and application. recover --safe-mode --apply keeps only dsh-base and dsh-web-app (the core profile remains).

Try and Open¶

try: Clones the current profile to a temporary name, starts it in an isolated DSH_HOME, probes web services, and then deletes the clone; the real profile remains read-only.

open: Performs a flow similar to try; if startup fails, it automatically maps and disables suspected plugins before retrying, and then launches the official application.

Harness Internal Tools (Healthy Session)¶

After installation as a plugin, the model can call tools implemented in common with the CLI:

The README explicitly states: Disabling and recovery must be completed via CLI when the application is closed; when Harness cannot start, any in-harness logic within the package cannot serve as a recovery path.

If the local plugin git-autobackup exists in the environment, before the user performs batch backups, this plugin can automatically write a snapshot tagged as auto-backup via the Cordis event git-autobackup/before-run (the two plugins have no import dependencies).

Installation and Activation¶

Install as a DSH plugin (adds the two tools mentioned above to Healthy sessions; CLI files are distributed with the package, recovery commands remain usable after closing the app):

dsh plugin --profile desktop add github:osman3n/dsh-safe

Restart DeepSeek Harness after installation; dsh-safe should appear in the plugin manager. Current version in package.json is 0.2.3, license MIT.

When using the CLI independently, the README states there are no separate installation steps: simply run dsh-safe.cmd after entering the tools/dsh-safe directory in the repository (the user’s method of obtaining source code is not covered in this article; under task constraints, “using git clone” is described as the standard path).

Typical Usage¶

Crash on Startup (Host process exited)¶

Unless you really want to clear all third-party bundles, do not click the built-in “Disable third-party plugins”:

dsh-safe.cmd recover --pick --apply
dsh-safe.cmd open

Stuck on Loading, No Crash Dialog¶

First check the abnormal plugin in the logs that failed to apply, then disable it interactively:

dsh-safe.cmd recover
dsh-safe.cmd recover --pick --apply

Newly Installed Plugin Causing Issues¶

dsh-safe.cmd status
dsh-safe.cmd plugins
dsh-safe.cmd disable @scope/package-name

Verify Before Changing Config¶

dsh-safe.cmd try

Disabled the Wrong Plugin¶

dsh-safe.cmd snapshots
dsh-safe.cmd restore <id>

Applicable Scenarios and Notes¶

Suitable for: DSH desktop profile users who frequently try installing community plugins, need to roll back or troubleshoot at the bundle granularity; especially when recovery methods that can decouple from Harness are needed on Windows.

Notes:

1. Plugins and CLI read/write $DSH_HOME and the profile with your current user permissions; please check the GitHub repository source code and MIT license yourself before installing or using to ensure it meets your security requirements.
2. The community plugin directory SkillHub entry has no official affiliation with DeepSeek or Magic (Huanfang); the DSH ecosystem emphasizes “everything is a plugin,” and the recovery tool itself is also an optional bundle.
3. The built-in full disable third-party solution is still a “bet it all” (risky) approach; the value of dsh-safe lies in snapshots, single disable, try/open, and the recovery UI, limiting the scope of changes to a step you can clearly explain.

Conclusion¶

When a profile is crippled by a single plugin, modifying configuration, taking snapshots, and test booting from a closed terminal is more controllable than relying on the crash dialog. Directory page: https://www.skillhub.cn/plugins/osman3n/dsh-safe; Source code and command documentation: https://github.com/osman3n/dsh-safe.