DeepSeek Harness 指南

旧版 Node 上安装失败

Answer first: DeepSeek Harness needs Node.js ^22.19.0 or >=24.0.0. Older runtimes fail at npx, sometimes with a node-domexception warning.

1. 运行 node -v and confirm the range.
2. Install a current 22.19+ or 24+ build from the Node distributor you already use.
3. Open a new terminal so PATH updates.
4. 重试 npx @deepseek-ai/[email protected] web.

0.1.2-rc.1 also fixes startup and HMR on Node 24.0-24.11.1. Version pins live on the download page.

dsh web 在端口 3080 上报 EACCES

Answer first: on Windows this is usually Hyper-V, WSL2, or Docker reserving the port, not a file-permission bug.

1. Read the reserved-range output from the host. If 3080 sits in that range, do not chmod anything.
2. Stop the consumer (Hyper-V switch, WSL2, Docker) or pick another port with the current dsh flag from your version notes.
3. Confirm the printed URL is still loopback. Do not bind the UI to a public interface.
4. If the page loads but APIs return 403, you are off the trusted Host list. Stay on 127.0.0.1.

Windows 沙箱 ACL 修复

Answer first: @deepseek-ai/dsh-sandbox-windows-acl can lock the creator out of a TEMP directory under C:\Windows\Temp, or fail SetNamedSecurityInfoW error 5 on a workspace owned by BUILTIN\Administrators.

1. Check whether machine-level TMP/TEMP is C:\Windows\Temp and whether your user override is empty.
2. Set HKCU TMP and TEMP to a folder you own, for example under your profile. Restart the terminal.
3. Create a workspace whose owner is your user, not Administrators. Avoid drive roots such as D:\.
4. Retry a sandboxed pwsh call. If only danger-full-access works, you still have an ACL problem, not a model problem.

Clearing the Windows Temp folder after a grant can permanently break workspace-write until you recreate temp policy. See sandbox 策略 and sandbox limits.

workspace-invalid-path on Chinese folder names

Answer first: the Win32 folder picker can truncate paths containing characters such as 开 or 一, so dsh sees ENOENT.

1. 0.1.2-rc.1 includes a fix for this truncation. Pin that version if you still run 0.1.1-rc.2.
2. If you cannot upgrade yet, pick a workspace path using ASCII names.
3. Do not select a drive root. session.create fails with EPERM there and New Session stays blank.

ERR_MODULE_NOT_FOUND after a pnpm install

Answer first: installing the published CLI with pnpm is the usual trigger for failed loader entry ui-plan and missing @deepseek-ai/cordis-plugin-group.

1. Use npx or npm for the published package.
2. Use pnpm only inside a source checkout after pnpm install and pnpm run build.
3. If a plugin add pulled latest 0.0.1-rc.1 while the CLI is 0.1.1-rc.2, pin the plugin version to the CLI train.

SEC_E_NO_CREDENTIALS inside the Windows sandbox

Answer first: the sandbox can break Schannel HTTPS (curl, PowerShell, .NET) while plain HTTP and OpenSSL clients still work.

1. Reproduce outside the sandbox. If HTTPS works there, the host cert store is fine.
2. Prefer clients that do not use Schannel for the sandboxed step, or run that fetch outside workspace-write confinement after an explicit approval.
3. Do not treat this as proof that the file policy is off. Network is outside SandboxMode.

Upgrade hides session titles or blocks startup

Answer first: 0.1.2-alpha.5 and 0.1.2-rc.1 fix a regression when upgrading from 0.1.1-rc.2 or 0.1.2-alpha.3.

1. Pin 0.1.2-rc.1 if you need the 0.1.2 line.
2. If you must export SQLite session data, do it on a build older than 0.1.2-alpha.3. The backend was removed; files were not deleted.
3. Keep DSH_HOME disposable while you test an upgrade.

杀毒软件警告

Answer first: dsh is a signed npm package that starts Node and may spawn shells. Heuristic scanners flag that pattern.

1. Confirm you launched @deepseek-ai/dsh, not a lookalike name.
2. Compare the installed tarball shasum with the values on SHA 与签名说明.
3. Restore quarantined Node or temp folders only after that check.

首次运行的最佳做法

1. Start in an empty disposable directory, not your home folder or a client monorepo.
2. Keep workspace-write and ask. Do not begin with danger-full-access.
3. Pin the version. Unpinned npx follows latest, which is still 0.1.1-rc.2.
4. Review plugins, MCP servers, Skills, and Hooks before they execute.
5. Keep credentials out of the workspace if a same-user process reading them is unacceptable. The file sandbox restricts writes, not reads.

下载 DeepSeek Harness