deepseek-harness/docs/cli-help.md

dsh CLI help

This reference contains complete help for the launcher, subcommands, and shipped profiles. Identical help appears once with every invocation listed. Help output retains its original language.

Run pnpm run gen-cli-help to regenerate; run pnpm run verify-cli-help to check freshness.

Contents

• dsh
• dsh plugin
• dsh acp
• dsh headless
• dsh sdk
• dsh sdk-minimal
• dsh web

dsh

Invocations: dsh --help

Usage: dsh [--profile] <name> [options] [app-args...]
       dsh plugin --profile <name> <pnpm-args...>

dsh: boot a DeepSeek Harness profile — an ordered stack of plugin-bundle patch
layers under your own overrides.

Arguments:
  args                           arguments for the booted profile's app (see:
                                 dsh --profile <name> --help)

Options:
  -V, --version                  output the version number
  --profile <name>               the profile under $DSH_HOME/profiles to boot
  --from-default-profile <name>  replace a custom profile with a fresh copy of a
                                 shipped profile template
  --patch <path>                 extra patch-list overlay applied after the
                                 profile layer (repeatable)
  --dump-config                  print the composed profile tree and exit
  --dump-config-schema           print JSON Schema for profile entries and
                                 patches without mounting
  --dump-default-config          print the profile tree without its user layer
                                 or --patch overlays and exit

Examples:
  dsh web                                   boot the web profile (same as: dsh --profile web)
  dsh rescue --from-default-profile web
                                            recreate rescue from the shipped web template, then boot it
  dsh headless "run the tests"              answer one task, print the result, and exit
  dsh tui --patch ./extra.yml               boot a custom profile with one extra overlay
  dsh tui --resume <session>                arguments after the launcher flags reach the app
  dsh web --help                            the web app's own flags and help
  dsh plugin --profile tui add <package>    install a plugin into the tui profile

dsh plugin

Invocations: dsh plugin --help

Usage: dsh plugin [options] [args...]

manage a profile's plugins by forwarding the remaining arguments to pnpm in the
profile directory

Arguments:
  args              pnpm arguments, forwarded verbatim (add <pkg>, remove <pkg>,
                    why <pkg>, ...)

Options:
  --profile <name>  the profile whose plugins to manage (initialized on first
                    use)
  -h, --help        show this help

dsh acp

Invocations: dsh acp --help, dsh --profile acp --help

Usage: dsh --profile acp [options]

Serve automation clients over Agent Client Protocol stdio.

Options:
  -h, --help  show this help

Example:
  dsh --profile acp     serve ACP until the client disconnects

dsh headless

Invocations: dsh headless --help, dsh --profile headless --help

Usage: dsh --profile headless [options] [task...]

Answer one task and exit; the answer goes to stdout and diagnostics to stderr.

Arguments:
  task                        the task text; multiple words are joined by
                              spaces, and `-` reads stdin

Options:
  --json                      write newline-delimited run events to stdout
                              instead of the final message
  --session-id <id>           adopt the persisted Session with this id; an
                              unknown id is an error
  --permission-mode <preset>  select a configured permission preset for this
                              task, including on resume
  --approval-policy <policy>  set approval behavior after selecting the
                              permission preset (choices: "ask", "never")
  --add-dir <path>            allow an additional physical absolute directory
                              under workspace-write (repeatable)
  -h, --help                  show this help

Examples:
  dsh --profile headless "run the tests"          answer one task and exit
  echo "run the tests" | dsh --profile headless   read the task from stdin
  dsh --profile headless --json "run the tests"   emit machine-readable run events
  dsh --profile headless --session-id session-… "continue"   resume an existing Session
  dsh --profile headless --permission-mode workspace-write --add-dir /repo/.git "commit the fix"
                                                        grant shared Git metadata for this task

dsh sdk

Invocations: dsh sdk --help, dsh --profile sdk --help

Usage: dsh --profile sdk [options]

Serve DeepSeek Harness SDK clients over stdio JSON-RPC.

Options:
  -h, --help  show this help

Example:
  dsh --profile sdk     serve one SDK runtime until its client disconnects

dsh sdk-minimal

Invocations: dsh sdk-minimal --help, dsh --profile sdk-minimal --help

Usage: dsh --profile sdk-minimal [options]

Serve DeepSeek Harness SDK clients over stdio JSON-RPC.

Options:
  -h, --help  show this help

Example:
  dsh --profile sdk-minimal     serve one SDK runtime until its client disconnects

dsh web

Invocations: dsh web --help, dsh --profile web --help

Usage: dsh --profile web [options]

Serve the DeepSeek Harness browser UI.

Options:
  --host <host>                  bind address: one concrete IPv4 or IPv6 literal
                                 of a local interface; wildcard addresses are
                                 rejected
  --no-open                      do not open the Web UI in the default browser
  --port <port>                  listen port; pass 0 to let the OS pick a free
                                 one
  --public-url <url>             advertise this HTTP(S) root in the printed,
                                 opened, runtime-context, and DSH_WEB_URL forms;
                                 grants no trust
  --trusted-host <authority...>  extra authority the /api browser-trust fence
                                 accepts (host or host:port; repeatable)
  --tls-cert <file>              PEM server certificate chain; requires
                                 --tls-key
  --tls-key <file>               unencrypted PEM private key; requires
                                 --tls-cert
  -h, --help                     show this help

Examples:
  dsh --profile web                          serve on the composed host and port
  dsh --profile web --no-open                serve without opening a browser
  dsh --profile web --port 8080              serve on another port
  dsh --profile web --host 10.0.0.7          bind one local interface address
  dsh --profile web --public-url https://app.example/ui/ --trusted-host app.example
                                             advertise a prefix-stripping HTTPS proxy entry and admit its authority
  dsh --profile web --tls-cert ./server-chain.pem --tls-key ./server-key.pem
                                             serve HTTPS with an existing certificate and key