dsh
| Repo | box/github.com/opencharly/pod-dsh:v2026.274.0638 |
Installs the deepseek-harness dsh CLI globally via npm and serves the
dsh web Web UI (port 3080) as a supervised service. The candy depends
on nodejs (>=22.19.0 — the dsh floor) and ships a package.json pinning
@deepseek-ai/dsh 0.1.7-rc.1, which the build installs globally under
NPM_CONFIG_PREFIX (~/.npm-global). The web app binds 127.0.0.1:3080
ONLY — dsh-web-app 0.1.7-rc.1 hard-rejects –host 0.0.0.0 (RCE
safety) — so a charly-owned entrypoint runs dsh web in the
background and exec’s a socat forwarder that listens on the
container’s eth0 (0.0.0.0:3081) and forwards to loopback. socat
cannot share port 3080 (Linux forbids a wildcard + loopback pair on
one port), so the published port (auto-allocated host port ->
container 3081) reaches the web UI on the pod substrate. Since
0.1.5-rc.x the web UI authenticates every request: each process mints
a random launch token and dsh web prints it in its
dsh web: http://127.0.0.1:3080/?token=... readiness line. The
entrypoint captures that token and persists it to
$DSH_HOME/web-token (on the dsh volume, so it survives the fresh
charly update rebuild), and the in-box checks authenticate with
curl "http://127.0.0.1:3080/?token=$(cat $DSH_HOME/web-token)".
Every fact is observable: the dsh binary at ~/.npm-global/bin/dsh,
the unpacked package, dsh --version/--help, node >= 22.19.0, the
running service, the persisted token file, and the HTTP 200 the
token-authenticated web UI answers on 127.0.0.1:3080.
Packages
Section titled “Packages”Installed on every distro:
socat
Services
Section titled “Services”dsh
Acceptance plan
Section titled “Acceptance plan”This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.
| Intent | Step |
|---|---|
run |
mkdir=${HOME}/.local/bin |
run |
copy=dsh-entrypoint |
check |
the dsh binary is installed into the npm global bin directory |
check |
the dsh package is unpacked under the npm global lib directory |
check |
running dsh –version exits cleanly and prints a semantic version |
check |
running dsh –help exits cleanly and lists the web and plugin commands |
check |
node is at least 22.19.0 (the deepseek-harness dsh floor) |
check |
the dsh service is running under the init system |
check |
the token-authenticated dsh web UI answers on 127.0.0.1:3080 in-box |
check |
the socat forwarder relays the token-authenticated dsh web UI on 127.0.0.1:3081 in-box |
check |
the published port reaches the dsh web UI and enforces its auth fence (401 without a token) |