dsh-project-anchor

dsh-project-anchor keeps a solo, long-running DSH project attached to a user-approved Goal, one active Milestone, and a durable Turn checkpoint while leaving project judgment in on-demand Skills.

This is a GitHub-only public Preview tested against DeepSeek Harness 0.1.0-rc.6. The reviewed revision, CI, public-source installation, and private security-reporting route have been verified. npm publication is deliberately outside this route.

Install the pinned GitHub Preview

You need Node ^22.19.0 || >=24.11.0, pnpm on PATH, and DeepSeek Harness 0.1.0-rc.6. Open the current Preview release, copy its verified 40-character source commit, and use that exact value below:

npm install --global @deepseek-ai/dsh@0.1.0-rc.6
dsh --version
dsh plugin --profile web add github:KKLL2025/dsh-project-anchor#<FULL_COMMIT_SHA>

The first add is expected to stop before running the Git package's prepare build. Copy the complete dependency key printed by pnpm into the selected profile's pnpm-workspace.yaml; do not shorten it to the package name:

allowBuilds:
  '<EXACT_KEY_PRINTED_BY_PNPM>': true

Review the pinned source before granting that permission, then repeat the same add command and verify the installed dependency and composed bundle:

dsh plugin --profile web add github:KKLL2025/dsh-project-anchor#<FULL_COMMIT_SHA>
dsh plugin --profile web list dsh-project-anchor --depth 0
dsh --profile web --dump-config
dsh --profile web

Require dsh --version to print 0.1.0-rc.6 and the dependency list to include dsh-project-anchor. The config dump should contain exactly one # == dsh-project-anchor layer. If Web was already running, restart that DSH process after installation. The getting-started guide covers verification, removal, other profiles, and common failures.

Start a project

Use a normal project request that names the long-project Skill:

Use drive-large-project for this multi-session project: <describe the project and desired result>. Recover the repository's real state, choose one independently verifiable Milestone, carry it through validation, and finish the Turn with the Project Anchor checkpoint. Ask me before decisions that change product direction, permissions, spending, or public release.

When no current DSH Goal exists, a successful Skill load makes Project Anchor ask whether to enable its persistent continuity layer. Enabling it opens focused questions for the exact Goal and first Milestone; the plugin does not infer or rewrite either answer. When a suitable DSH Goal already exists, the same trigger offers an explicit reuse or resume choice instead of replacing that Goal.

For a later session, this shorter request is enough:

Continue this project with drive-large-project. Recover the current Goal, Project Anchor state, handoff, and repository facts; work only on the next unblocked Milestone, then validate and checkpoint it before ending the Turn.

What is included

The package carries byte-for-byte frozen copies of align-project-requirements, drive-large-project, and organize-ai-project-files. DSH lists their metadata, then loads a Skill body and its referenced resources only when selected. Project and user Skill roots keep their native precedence over these bundled defaults.

The native plugin remembers consent and the stable Goal association, exposes a checkpoint tool only while the Anchor is active, and derives Goal, Milestone, and Turn identity from live DSH state. Ordinary tools remain unrestricted. A missing checkpoint receives at most one short same-Turn repair attempt, avoiding an enforcement loop. Restart recovery leaves interrupted-Turn closure and Goal activation under DSH's native lifecycle.

Compatibility and limits

• Verified host: DeepSeek Harness 0.1.0-rc.6, source revision 47f943859bef60e4160492346772ded9b24f765a.
• DeepSeek Harness is in developer preview, so later releases may require plugin changes.
• GitHub source at the full commit recorded in the Preview release is the only public distribution path. The package remains unpublished to npm.
• A Git source install runs this package's prepare script only after pnpm's explicit allowBuilds approval. That is host code execution, so review the source and pin a full commit SHA. Do not install from a moving branch.
• A completed Goal is not replaced or reused. Headless activation without a question provider fails closed.
• Restart recovery has been tested with JSONL persistence in a separate Node.js process; OS power loss, torn writes, and cross-machine recovery are outside the current evidence.

Maintainer verification

npm run check
npm run smoke:onboarding
npm run smoke:consumer
npm run smoke:git-source
npm run rc:local

The onboarding smoke resolves the rc.6 CLI from DSH_ENTRY, a local/prepared installation, or npm's global root. It uses an isolated DSH_HOME to pack, install, list, compose, remove, and re-check the plugin without booting a profile or sending a prompt. The consumer smoke also boots fresh Web and headless profiles, validates both plugin fibers and the three frozen Skills, and sends no prompt. rc:local builds one candidate tarball and reuses that exact file in both paths before checking the local Git-source prepare route and writing an ignored machine-readable evidence manifest.

See the development contract for ownership, state-machine, validation, and safety boundaries. Release evidence is defined in the candidate gate; host-code and frozen-Skill trust boundaries are explicit in SECURITY.md. Contributors should start with CONTRIBUTING.md.