dsh-npm-runner
DeepSeek Harness 插件：发现当前工作区中的 npm/pnpm/yarn/bun 脚本（不会进入 node_modules），并通过编辑器区域或会话标题中的紧凑控件在后台运行任意脚本。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-npm-runner@0.1.1Npm Runner 以 dsh-npm-runner 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →A DeepSeek Harness plugin that finds the npm scripts of the current workspace and runs any of them in the background.
node_modules — the workspace root manifest, plus the packages its workspaces field declares or its immediate subdirectories.pnpm, yarn, bun or npm, from the lockfiles present) in each package's own directory.DSH 0.1.5-rc.1 or newer, and Node.js 20 or newer.
dsh plugin --profile web add -w dsh-npm-runner
-w is not optional: the profile directory is a pnpm workspace root, and pnpm refuses an add there without it.
To track the repository instead of a release:
dsh plugin --profile web add -w github:nobu121/dsh-npm-runner
Update or remove:
dsh plugin --profile web update -w dsh-npm-runner
dsh plugin --profile web remove dsh-npm-runner
Restart DSH afterwards — a newly added bundle is picked up at profile boot, not by a page refresh.
Working on the plugin itself? dsh plugin --profile web add -w . from the checkout links the working tree instead of taking a snapshot.
| Session state | Where it appears |
|---|---|
| New session | Right-aligned on the workspace/mode row. |
| Conversation | In the header's action row, next to DSH's own background-task list. |
The control appears only when the current workspace has at least one script. Clicking it opens the script list:
Runs are also registered with DSH's own background-job registry, so they join the job list and the agent can read them with job_list / job_output / job_kill.
Stopping a run from the panel marks it as accounted for, so DSH does not inject a background job finished notice into the session for a stop you asked for — a run that ends on its own still notifies. Set registerJobs: false to keep runs private to the plugin's own list.
Optional, on the plugin row in the profile's cordis.patch.yml:
- id: npm-runner
name: 'dsh-npm-runner'
config:
maxPackages: 60 # packages reported per scan
maxJobs: 12 # retained runs; the oldest finished one is evicted first
maxRunning: 6 # concurrently live runs
bufferBytes: 65536 # retained output per run, in bytes
registerJobs: true # also register runs with DSH's background-job registry
jobScope: session # 'session' keeps a run inside its own conversation; 'global' shares it machine-wide
These routes start processes, so three limits apply: every request passes the same trust fence DSH's own gateway applies (loopback or a trusted Host, no cross-site, a matching Origin); the workspace comes from the Session rather than from the request; and a request cannot name a command — the client sends a directory and a script name, and the host re-reads that directory's own package.json and rebuilds <packageManager> run <name> itself. Runs start in the DSH host process, on the machine DSH runs on.
jobScope: 'session', a run does not appear there in another conversation, even one in the same workspace. The plugin's own list is the surface that matches by workspace.npm test # hermetic: scanner, runner, job bridge, host routes, client bundle
npm run test:e2e # really runs npm: the fixtures, the run lifecycle and the tree kill
examples/ holds a second package of runnable fixtures — a long-lived service, a streamer, a high-volume writer, a process tree, a failure and a working-directory probe. It is not published, and npm run test:e2e drives all of it through the plugin's own registry.
MIT