fix(dsh-hub): make the harness plugin actually load on dsh

[stvlynn]

Audit

The dsh-hub plugin was shaped like a real DeepSeek Harness bundle (apply + inject: ['tools'] + defineTool + dsh.bundle.patch), but it could not accurately run on dsh as documented.

What already matched the harness

• Plugin entry: named apply, inject = ['tools'], ctx.tools.register(defineTool(...))
• Bundle manifest: dsh.bundle.patch → cordis.patch.yml inserting name: dsh-hub
• Tool DSL: parameters, output.schema: { type: 'json' }, output.render, exec.signal
• Peer deps on @deepseek-ai/cordis and @deepseek-ai/dsh-tools (host copy, not bundled)
• Self-contained prepare + tsdown (git-install build, turtle-ui pattern)
• $DSH_HOME then ~/.dsh; skills under $DSH_HOME/skills; presets under $DSH_HOME/.agent-presets
• MCP rows use @deepseek-ai/dsh-mcp-client
• Install-plan DTO (profile, step types) matches what the plugin executes
• Device client id dsh-hub-plugin matches Better Auth validateClient

What blocked a real dsh install

1. Wrong git spec. github:stvlynn/dsh.fish#main installs the repo root (dsh-fish), which has no dsh.bundle. dsh plugin add would warn and activate no layer. The bundle is packages/dsh-plugin-hub.
2. Config was a plain object. Cordis requires a Standard Schema (~standard). Official docs: do not export a plain object as Config.
3. packageSpec dropped subdirectory paths. A submitted monorepo bundle would still install the root.
4. Device approval never claimed the code. Better Auth 1.6 refuses POST /device/approve until GET /device binds the code to the session (DEVICE_CODE_NOT_CLAIMED).
5. Login blocked before the model saw the URL. execute polled until approval, so the tool result (code + URL) never reached the agent transcript in time.
6. Empty profile patch []. Appending - insert: after a fresh profile’s [] is invalid YAML.

Fixes

• Install spec is now github:stvlynn/dsh.fish#path:packages/dsh-plugin-hub (README, site, ADR).
• Config is a Standard Schema with defaults for baseUrl and targetProfile.
• packageSpec emits pnpm’s #<commit>&path:<dir> selector.
• Device page claims the code via GET /device before showing Authorize/Deny.
• hub_account login is two calls: first returns the code/URL; second polls.
• Profile patch writer replaces [] instead of concatenating after it.
• Absolute verification URIs; cooperative timeoutMs on install and login.

Remaining limits (not blockers for loading)

• GitHub topic crawl still only reads the root package.json, so this bundle is not auto-indexed. Submit github:stvlynn/dsh.fish/packages/dsh-plugin-hub.
• targetProfile: current falls back to web unless DSH_PROFILE is set; the launcher does not document that env var.
• First git install still needs pnpm allowBuilds: dsh-hub: true (harness-required for prepare).

Test plan

• pnpm --filter dsh-hub run test (16 tests)
• pnpm --filter @dsh-fish/backend run test (60 tests)
• Plugin / backend / frontend typecheck
• dsh plugin --profile web add github:stvlynn/dsh.fish#path:packages/dsh-plugin-hub on a real harness, allow the build, restart, call hub_search

  

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	dsh-fish	76954eb	Commit Preview URL Branch Preview URL	Aug 16 2026, 09:29 AM

[xianjianlf2]

Opened a stacked PR to fix the failing CI setup step: #25

The check job fails before install because pnpm/action-setup@v4 receives both version: 9 from the workflow and packageManager: pnpm@9.0.0 from package.json. The stacked PR removes the workflow-level version so the action uses package.json as the single source of truth.

Validated locally:

• pnpm install --frozen-lockfile
• pnpm --filter @dsh-fish/frontend exec react-router typegen
• pnpm run typecheck
• pnpm run test
• pnpm run build