dsh-npm

NPM registry management for DeepSeek Harness: query package info, list versions, search the registry, publish packages, and mark packages deprecated — straight from the agent.

• Query tools hit the npm registry JSON API directly (no local npm needed, no auth for public packages).
• Publish / deprecate shell out to the local npm CLI and reuse your own ~/.npmrc credentials — or an optional token you configure in the plugin.

Tools

Tool	Purpose
npm_status	Plugin status: effective registry, token presence, local npm CLI availability, config path
npm_config	Configure registry base URL and/or auth token (stored in ~/.dsh/dsh-npm.json, mode 0600); reset: true clears
npm_info	Package metadata: latest version, dist-tags, description, author, license, homepage, repository, timestamps, dependency summary
npm_versions	All published versions with publish dates (dist-tags.latest pinned first) — check before publishing
npm_search	Registry search by keywords (name, description, author, score)
npm_publish	Real npm publish — supports dir, tag, access, otp, registry, dryRun, force
npm_deprecate	Mark a package/version as deprecated (real registry write, use carefully)

Compatibility

Requires DeepSeek Harness ≥ 0.1.5-rc.1 (declared as dsh.engines.dsh in the package manifest, so the DSH plugin marketplace can report it) and is verified against 0.1.5-rc.1. This build carries the DSH 0.1.5 adaptations: the strict tool-result contract (lossless-JSON snapshot, additionalProperties: false schema validation, and output.render returning ContentBlock[]) plus executable resolution that survives a launchd-started host whose PATH is only /usr/bin:/bin.

Install

# from npm (published package)
dsh plugin --profile web add dsh-npm

# or local development
dsh plugin --profile web add link:/path/to/dsh-npm

# after publishing to GitHub (repo tagged with the `dsh-plugin` topic)
dsh plugin --profile web add github:zhengjy01/dsh-npm

Restart the DSH web service afterwards (no hot reload).

Web settings panel

The plugin ships a NPM panel in the web settings page (设置 → NPM): configure registry/token visually (token is masked, stored at mode 0600), plus quick package lookup (npm_info) and registry search (npm_search) without touching the CLI. Host routes: /api/dsh-npm/config, /api/dsh-npm/info, /api/dsh-npm/search (loopback-only).

Auth model

• Querying public packages: no configuration needed.
• Publishing: the npm publish subprocess reads your normal ~/.npmrc (npm login once and you are done).
• Token: optionally set via npm_config (token=…); it is stored in ~/.dsh/dsh-npm.json (mode 0600), injected into publish/deprecate through a temporary userconfig file (never on the command line or in logs), and used as a Bearer token for private-package queries. It is never echoed in tool output (masked only).
• Registry: defaults to https://registry.npmjs.org/; override per-call (registry arg) or globally (npm_config registry=…) — useful for private registries / mirrors.

Safety notes

• npm_publish really uploads to the registry. Before publishing, check the version does not exist yet with npm_info / npm_versions, and prefer dryRun: true first.
• force: true overrides an already-published version (npm blocks it by default) — dangerous.
• npm_deprecate writes a permanent deprecation message shown to every installer.

Development

pnpm install
pnpm build      # tsc declarations + tsdown bundle → dist/index.mjs
pnpm test       # smoke tests (store round-trip, real registry queries, publish --dry-run)

License

MIT