donsetch-dsh

First-class DonSeTch web access for DeepSeek Harness (dsh). One install line, and every dsh agent gets the full DonSeTch suite: fetch, search, and crawl with browser-grade stealth, keyless engines, BYOK providers, and an auto-updating native binary. No API key required to start.

Install

dsh plugin --profile web add github:dondai44423/donsetch-dsh

Restart dsh web (bundle plugins activate on the next boot). On first start the plugin downloads the correct DonSeTch binary for your platform from GitHub Releases, verifies its SHA256 against the release sidecar, and registers the tools. That is the whole setup: no API key, no config file.

Add the dsh-plugin topic to your repo mentions: this repo is already on it. The plugin also works in headless profiles:

npx @deepseek-ai/dsh --profile headless "research the latest donsetch release notes"

What you get

• donsetch_web_fetch: one URL to full markdown, browser-grade rendering and stealth where needed
• donsetch_web_search: keyless engines out of the box, or your own keys via BYOK providers (Exa, Tavily, Serper, SerpApi, SerpBase, Bright Data, TinyFish, plus plugin adapters)
• donsetch_web_crawl: whole-site crawling with sitemap discovery
• donsetch_status: self-diagnostics (degraded daemons get one automatically)
• Native web_search: the harness's own web_search tool routes through DonSeTch (the bundle patch selects the donsetch search provider), so ordinary searches work with no DeepSeek API key

The tools are registered in-process on the harness tool registry, not as mcp__* imports, so they flow through dsh's permission, timeout, and cancellation pipeline like any native tool, and they show call/result cards in the Web workbench.

Why it is not just an MCP config

dsh ships a built-in MCP client. Pointing it at donsetch mcp works, but this plugin is the first-class version:

	built-in MCP config	this plugin
Install	you write a config row	one plugin add
Binary download + SHA256 verify	manual install	automatic
Auto-updates with donsetch releases	never	yes, throttled, swappable between calls
Tool names	mcp__donsetch__...	donsetch_...
Config changes from the CLI	restart everything	live daemon restart on config file change
Workbench cards	generic	per-tool call/result summaries
Status + doctor for the agent	none	donsetch_status
Harness schema contract	none	parameters comply with the enforced raw JSON Schema contract
Correctness gate in CI	none	the plugin runs inside a real dsh ToolRuntime on every push

How customization works

The plugin uses the exact same config file the standard DonSeTch CLI uses, so every part of DonSeTch's normal customization applies unchanged:

donsetch keys add exa <key>         # add a provider key
donsetch keys default exa           # switch default provider
donsetch doctor                     # engine diagnostics
donsetch mcp ...                    # identical surface elsewhere

CLI changes land in the live dsh plugin within seconds: the plugin watches the config file and swaps the daemon without a dsh restart.

Configuration

All defaults are sensible; the plugin works with zero configuration. Options come from the bundle patch (edit $DSH_HOME/cordis.patch.yml to override) plus environment variables.

option	default	description
toolPrefix	donsetch	Model-facing tool name prefix, [A-Za-z0-9_]{1,16}
channel	stable	Update channel: stable (releases) or latest (includes prereleases)
autoUpdate	true	Check GitHub Releases and swap in newer verified binaries between calls
updateIntervalHours	24	Minimum gap between update checks
callTimeoutMs	180000	Per-tool-call timeout
bootTimeoutMs	20000	Daemon initialize + tools/list timeout
fallbackToPath	true	Use a donsetch already on PATH when the download fails (degraded mode, told honestly in donsetch_status)
pinnedVersion	current	donsetch release a fresh install pins (floor, not ceiling)

Environment: DONSETCH_DSH_PREFIX, DONSETCH_DSH_CHANNEL, DONSETCH_DSH_AUTOUPDATE=off, DONSETCH_BIN (path to a local donsetch binary), DONSETCH_DSH_CACHE_DIR.

Patch-layer example ($DSH_HOME/cordis.patch.yml, later layers win):

- override:
    - id: donsetch
      config:
        toolPrefix: web
        autoUpdate: false

Updates

Two-layer update story. The plugin glue is a bundle: re-running dsh plugin add against a newer pin (or letting the repository panel track the branch) keeps it current. The donsetch binary updates itself: on a throttled schedule it checks GitHub Releases on your channel, and when a newer release appears it downloads, SHA256-verifies against the release sidecar, and swaps the daemon between in-flight calls. A failed verify aborts the install and keeps the current binary; nothing partial ever replaces a working daemon.

The baseline DonSeTch pin auto-tracks published releases every 6 hours.

Reliability notes

• The daemon runs supervised (donsetch mcp --supervised), so crashes restart transparently and the next tool call revives cleanly.
• Cancellations reach the real daemon (notifications/cancelled), the in-flight fetch or crawl actually stops.
• Plugin unload kills the daemon: hot-reload leaves no orphan processes.
• Downloads are atomic: temp dir, hash check, rename into place, stale dirs removed.
• The update check never blocks tool service and never runs a paid query.
• A url that is a string beginning with [ (a batch array serialized into one scalar) is rejected before the daemon with an error that names the shape and the fix, instead of the binary's url must be http(s), which never mentions arrays. It is rejected, not coerced: the schema has one encoding for one URL and one for a batch, and silently accepting a third hides the mistake from the caller.

Compatibility

Developer preview caveat: DeepSeek Harness is iterating fast and its APIs are moving. This plugin pins no host-train imports at all (it talks to the harness only through the ctx handed to apply()), which keeps it installable across harness updates. Verified against:

harness	npm dsh	dsh-tools
DeepSeek Harness 0.1.1-rc.2 (npm latest)	@deepseek-ai/dsh	0.1.x train
DeepSeek Harness 0.1.2-alpha.1 (source docs)	source	0.1.x train
DeepSeek Harness 0.2.1-rc.5 (packed-plugin install and profile composition)	@deepseek-ai/dsh	registry tests remain on the 0.1.x train

Node ^22.19.0 || >=24.0.0 (the harness requirement).

The fresh-install smoke uses dsh 0.2.1-rc.5 and pnpm 10.20.0 on Windows. Profile composition also works locally on Linux with that host; the older Linux pty-prebuild limitation does not apply to this composition check. Install pnpm on PATH before using dsh plugin add; dsh does not bundle it.

Troubleshooting

Tools are missing in a session. Ask the agent to call donsetch_status, or check the plugin log lines ([donsetch] ...) on the dsh host. The status tool reports the daemon state, binary version, last boot error, and the donsetch doctor output.

First install failed. Offline? The plugin falls back to a donsetch on PATH (degraded, told honestly). To pin a local binary instead, set DONSETCH_BIN=/path/to/donsetch.

I want the old-version binary. Delete the versioned dir under ~/.cache/donsetch/dsh/bin/ and the plugin reinstalls the pinned release.

A call says "url looks like a stringified array". The caller meant a batch and sent "[A, B]", one string. A batch is a real JSON array (["A", "B"]); anything else is one http(s) URL or handle per call. The guard rejects before the daemon, so nothing was fetched.

Development

npm install
npm test        # typecheck + build + unit/integration suite (fake daemon harness)
npm run live    # real donsetch binary: handshake + tools/list + fetch + search
npm run lint    # house style (no em-dashes in shipped text)

dist/ is committed on purpose: git installs then skip build scripts entirely and dsh users never see the pnpm 10 allowBuilds prompt.

The repo is structured like donsetch itself: project.md + status.md are private working docs, gitignored, updated after every finished task.

License

AGPL-3.0-only, matching DonSeTch. See donsetch.