dsh

Version	2026.243.0100
Repo	box/github.com/opencharly/pod-dsh:v2026.243.0410

Installs the deepseek-harness dsh CLI globally via npm and serves the dsh web Web UI (port 3080) as a supervised service. The candy depends on nodejs (>=22.19.0 — the dsh floor) and ships a package.json pinning @deepseek-ai/dsh 0.1.0-rc.6, which the build installs globally under NPM_CONFIG_PREFIX (~/.npm-global). The web app binds 127.0.0.1:3080 ONLY — dsh-web-app 0.1.0-rc.6 hard-rejects –host 0.0.0.0 (RCE safety) — so a charly-owned entrypoint runs dsh web in the background and exec’s a socat forwarder that listens on the container’s eth0 (0.0.0.0:3081) and forwards to loopback. socat cannot share port 3080 (Linux forbids a wildcard + loopback pair on one port), so the published port (auto-allocated host port -> container 3081) reaches the web UI on the pod substrate. Every fact is observable: the dsh binary at ~/.npm-global/bin/dsh, the unpacked package, dsh --version/--help, node >= 22.19.0, the running service, and the HTTP 200 the web UI answers on 127.0.0.1:3080.

Packages

Installed on every distro:

• socat

Services

• dsh

Acceptance plan

This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.

Intent	Step
run	mkdir=${HOME}/.local/bin
run	copy=dsh-entrypoint
check	the dsh binary is installed into the npm global bin directory
check	the dsh package is unpacked under the npm global lib directory
check	running dsh –version exits cleanly and prints a semantic version
check	running dsh –help exits cleanly and lists the web and plugin commands
check	node is at least 22.19.0 (the deepseek-harness dsh floor)
check	the dsh service is running under the init system
check	the dsh web UI answers HTTP 200 on 127.0.0.1:3080 in-box
check	the dsh web UI answers HTTP 200 through the published port (the socat forwarder)