dsh-enforce-package-manager
English | 中文
Your repo uses pnpm, and the agent types npm install zod. Now you've got a package-lock.json sitting next to pnpm-lock.yaml, and a dependency that pnpm doesn't know about. On the Python side it's pip install requests in a uv project. The package lands in the venv, never reaches pyproject.toml, and vanishes on the next uv sync.
This DeepSeek Harness plugin works out which package manager the project uses. If the agent reaches for a different one, the command is stopped and the model gets the right command, already translated:
dsh-enforce-package-manager blocked `npm install zod --save-dev`: this project uses pnpm,
not npm ("packageManager": "pnpm@…" in /work/app/package.json). Mixing package managers
creates a second lockfile, ignores the existing one, and can install different versions.
Run this instead:
pnpm add -D zod
The model usually just runs the suggested line next.
Install
dsh plugin --profile web add dsh-enforce-package-manager
That's the web profile, the browser UI you start with dsh web. If you run DSH another way, use headless (scripts and CI) or acp (editor integrations) instead. Each profile keeps its own plugin list, so add it to every profile you use. Nothing else to set up. Remove it with dsh plugin --profile web remove dsh-enforce-package-manager.
From a clone
To try local changes, build a tarball and install that:
git clone https://github.com/acus9345/dsh-enforce-package-manager
cd dsh-enforce-package-manager
npm install
npm pack
dsh plugin --profile web add ./dsh-enforce-package-manager-0.2.0.tgz
How it detects the project's manager
It starts in the directory the command will run in, following any cd earlier in the same command line. From there it walks up and stops at the first directory that answers the question. It never goes above the git root, or above the folder you started DSH in when there's no git repo, so a stray lockfile in your home folder doesn't count.
For JavaScript, a packageManager field in package.json wins. After that it looks for a single lockfile: pnpm-lock.yaml, yarn.lock, bun.lock / bun.lockb or package-lock.json. If it finds lockfiles from two different managers, it doesn't guess and stays out of the way.
For Python it looks for uv.lock, poetry.lock, pdm.lock, Pipfile, or a [tool.poetry] / [tool.uv] / [tool.pdm] section in pyproject.toml. A project with only requirements.txt has no manager to enforce, so pip is left alone there.
What gets translated
| The agent runs | In a pnpm project | In a uv project |
|---|
npm install | pnpm install | |
npm ci | pnpm install --frozen-lockfile | |
npm i -D vitest | pnpm add -D vitest | |
yarn add zod | pnpm add zod | |
npm uninstall left-pad | pnpm remove left-pad | |
pip install httpx | | uv add httpx |
python -m pip install -e . | | uv sync |
pip uninstall httpx | | uv remove httpx |
The same goes for yarn, bun and npm projects, and for poetry (poetry add), pipenv (pipenv install) and pdm (pdm add).
Folder and workspace options carry over too. npm i -w web react becomes pnpm --filter web add react (or yarn workspace web add react), and npm install --prefix api becomes pnpm -C api install.
On Windows, where DSH runs commands through PowerShell, the same checks apply to npm.cmd, pip.exe, full program paths and Set-Location.
It only cares about commands that change the project's dependencies. npm run build, npm test, npx vitest and global installs (npm i -g ...) pass, because they don't touch the project's lockfile. On the Python side, pip install --user ... and upgrading the installers themselves (pip install -U pip, pip install uv) are left alone for the same reason.
Settings
The easy way: open Plugins in DSH's sidebar, click dsh-enforce-package-manager, change what you want and press Save. It applies to the next tool call, no restart needed.
Or add a row like this to ~/.dsh/profiles/<profile>/cordis.patch.yml, or to ~/.dsh/cordis.patch.yml for every profile. Keys you leave out keep their defaults.
- id: enforce-package-manager
config:
mode: deny # or `ask` to approve mismatches yourself
javascript: true # false: don't police npm/pnpm/yarn/bun
python: true # false: don't police pip
shellTools: [bash, pwsh] # pwsh is the shell DSH uses on Windows
Development
npm install
npm test # detection and translation unit tests
npm run test:e2e # real dsh runs against a scripted local model, no API key needed
The install test runs dsh plugin add, which needs pnpm on your PATH.
MIT licensed. Written by acus9345. Bug reports and ideas are welcome in the issues.
