Prefer the published pathnpx @deepseek-ai/dsh web for normal use; source deployment is for repository work.

Six gates. Keep their evidence separate.

01RuntimeNode engine, platform, architecture, libc.
02Package managerCorepack honors the pinned pnpm version.
03Workspace graphInstall and resolve from repository root.
04Native ABIBuild scripts complete for this execution world.
05LauncherWrapper anchors cwd, then calls pnpm dsh.
06AccessLoopback behind authenticated transport.

Route the first failure.

engine / zstdNode versionVerify the binary actually executed.
ABI / addon loadNative artifactCheck platform and lifecycle scripts.
workspace package missingLink graphReinstall at root; do not mask with hoisting.
tsx missing outside repoResolution anchorDelegate through the root pnpm script.
HMR internalsSource loaderUse the focused capability diagnosis.
remote device cannot connectNetwork topologyKeep loopback; add a secure tunnel.
Reject convenient-looking drift
  • --ignore-scripts as normal install
  • --shamefully-hoist as link repair
  • hardcoded .pnpm paths
  • secrets inside wrapper scripts

Remote access is a security decision.

NAS Host127.0.0.1:3080Agent tools stay off the LAN.
⇄
Guarded transportSSH tunnel or authenticated TLS proxyIdentity, encryption, allowlist.
⇄
OperatorLocal browserBrowse picker for unattended Host.

Ten deployment gates.

  1. Pinned Node resolves.
  2. Pinned pnpm resolves.
  3. Platform matches artifacts.
  4. Root install is clean.
  5. Full build succeeds.
  6. Wrapper anchors cwd.
  7. No embedded secrets.
  8. Loopback stays private.
  9. Agent probe completes.
  10. Restart reopens Session.