dsh

Recipe card from the charly-tools plugin (Images — the deployable catalog).

dsh – DeepSeek Harness CLI and web UI

Candy Properties

Property	Value
Install files	charly.yml, package.json, dsh-entrypoint
Depends	nodejs (>=22.19.0), supervisord
Port	3080 (web UI, loopback) / 3081 (socat forwarder)
Volume	~/.dsh (profiles + plugin data)

Environment Variables

Variable	Value
DSH_HOME	~/.dsh

Packages

RPM/DEB/PAC: socat (the loopback→eth0 forwarder)

The web UI is loopback-only — socat exposes it

dsh web binds 127.0.0.1:3080 only: dsh-web-app 0.1.0-rc.6 hard-rejects --host 0.0.0.0 (RCE safety). A container’s published port maps to the container’s eth0, not loopback — so the charly-owned dsh-entrypoint runs dsh web in the background and execs a socat forwarder (TCP-LISTEN:3081,fork,reuseaddr TCP:127.0.0.1:3080) that exposes the web app on eth0. socat cannot share port 3080 (Linux forbids a wildcard + loopback listener pair on one port), so the published port (auto-allocated host port → container 3081) reaches the web UI through socat. On the vm substrate the ssh -L forward targets loopback directly — socat just doesn’t hurt there.

Usage

charly.yml

my-image:
  candy:
    - dsh

Used In Boxes

• Composed on demand; requires a builder that declares the npm builder (the mcporter precedent).

Related Candies

• /charly-coder:nodejs – required runtime dependency (node >=22.19.0)
• /charly-tools:mcporter – sibling npm-global CLI candy

When to Use This Skill

Use when the user asks about:

• The deepseek-harness dsh CLI or web UI
• The dsh candy or the dsh: check verb
• The socat forwarder that exposes the loopback-bound web app

Related

• /charly-image:layer — candy authoring reference (charly.yml schema, task verbs, service declarations)
• /charly-check:check — declarative testing (check: block, charly check box, charly check live)