dshbase
中文

Blog · Pulse

Community Pulse #2

August 25, 2026 · dshbase · a recurring report on the DeepSeek Harness community

This is the second edition of Community Pulse, our ongoing scan of the official deepseek-ai/deepseek-harness discussion board. We pull the live board through the GitHub GraphQL API and compress it into what matters. A lot changed in the eight days since #1 — the tenor of the board is noticeably less about "when do we get features" and more about "why won't it install." That shift is the story this month.

The snapshot

The repo now holds 4,404 discussions — up from 2,638 when we wrote issue #1, roughly +67% in a week. Zero open issues still holds; the board is where everything happens. Across the ~300 most recently active threads the category mix is General 148 · Ideas 55 · Q&A 52 · Show Your Plugins 44 · Announcements 1. Plugins are still the heart of the ecosystem, but this month the signal that dominates is a surprisingly mechanical one: installing the harness keeps hanging.

The headline: the install just stops

Between August 18 and August 25 a cluster of threads all describe the same shape — npx @deepseek-ai/dsh (or npm install) pegging the CPU and never returning:

  • #3786 is the loudest (18 upvotes): npx @deepseek-ai/dsh web sits in an infinite npm dependency-resolution loop — CPU 100%, zero network traffic, and switching registries doesn't help.
  • #4236 reproduces it on a fresh machine: npm install @deepseek-ai/dsh hangs in an infinite CPU loop on npm 10.9.8 during peer resolution.
  • #4379 and #982 are the "installation stuck / install failed" variants; #3970 frames it as overly heavy dependency resolution that "takes minutes."
  • #4121 hits a confusing first-run Need to install the following packages: @deepseek-ai/[email protected] npx prompt.

Whatever the precise root cause — peer-dep pressure, an oversized dependency graph, or an npx cache interaction — the perception is consistent: the first install, the moment that should be the easiest, is the moment that breaks. For an open tool competing on "one command to install any plugin," a hang at the entry gate is the worst failure mode there is. If you're hitting it, the working workarounds in the threads are pinning the release tag explicitly and pre-warming a clean registry cache; watch #3786 for the fix.

Feature radar: the model list is still a catalog snapshot

The strongest feature ask of the week is #3816 (17 upvotes): dsh serves model lists from a bundled pi-ai catalog snapshot rather than pulling them live from the gateway — so models that just appeared on OpenCode Go don't surface until a release ships. The community's workaround is to hand-declare an OpenAI-compatible model, but the ask is clear: stop making users wait for a catalog refresh to see a model that already works. This is the same "living vs. frozen" tension we flagged in issue #1, now on the model front instead of the plugin front.

The perennial network-remote wants are still alive: #76 (19 upvotes) keeps asking for headless start via --host 0.0.0.0.

Bug radar: subagent defaults, session edges, and a sandbox flare

  • Subagents inherit the wrong model. A small but sharp cluster: #455 and #4311 both report that subagents default to the parent's model at creation time (or an expired base default) rather than the model the session is currently on — so on a third-party provider session every subagent call explodes with "no API key." #4304 is the retry cousin: an OpenAI-compatible gateway that drops the stream mid-call reports finish_reason: network_error, gets misclassified as PI_AI_ERROR, and isn't retried.
  • Session edges persist. #4385 (Aug 24) finds tool/result events with an empty callId raising SessionPersistenceCorruptionError — a new entry in the session-corruption family from issue #1. #1550 is the load-side version: cold history loading fully materializes large/corrupt logs and blocks. #1886 flags that the tokenUsage projection never folds compaction/summary usage, so long sessions can under-report spend.
  • Sandbox escalation spam. #201 (7 upvotes) is a repeated "sandbox escalation to workspace-write is not strictly..." error piling up in logs — more noise than corruption, but it's drowning out real warnings for users.

Cost and performance

The billing conversation quietly moved from "prices" to "accurate accounting." #1886 is the current poster child — if compaction summary usage isn't folded into the token projection, the number people see on long sessions is wrong, and wrong numbers are how budget decisions go sideways (exactly the 7x-cost dynamic we wrote about in our cost piece). On the local-LLM side, #3157 asks for a larger default timeout in llm-pi-ai for local models, which are expected to be slow on first warm-up.

Ecosystem: the count war keeps escalating

Two numbers frame this month. dsh-hub.cc now advertises 7,000+ plugins (claiming 5,600+ in issue #1) — a +25% "growth" in eight days that is far more likely a (re)counting spree than an install boom. And a genuinely telling thread, #1597, is the community asking the inverse question: "DSH already has 1,700+ plugins — how do I quickly find the one that fits me?" That's the exact collision our verified directory exists for. Counting keeps getting easier; does it run keeps being the only number that matters. We added #2687 to the watch list too — a community plugin-marketplace project that layers lifecycle management, security gating, and one-click restart on top of the plugin ecosystem.

The standout new plugin of the week is dsh-vault, an encrypted credential vault — with 184 comments it's the busiest thread on the board right now. That demand signal is worth reading: as more agents run on shared machines and in CI, the community is explicitly mobilizing around storing secrets safely, not just running code. Expect vault/secret-management plugins to keep climbing.

What to watch next

  • The install hang has to be the top of the roadmap. An open harness whose identity is "one command" cannot have an entry gate that pegs the CPU. The resolution of #3786 / #4236 (likely a dependency-graph or peer-dep pruning) will do more for adoption than any feature.
  • Subagent model-inheritance — #455/#4311 — is the sharpest correctness bug; "works on default provider, breaks on yours" is a trust-killer for third-party model users.
  • Live model lists (#3816) and accurate session spend (#1886): both are "make the numbers real" fixes that compound in value as adoption grows.
  • Discovery is about to mean verification, not count. When one index claims 7,000+ and users are already lost at 1,700, the indexes that survive will be the ones that tell you whether a plugin installs and runs — the bet we're making at dshbase. See how we audit.

Community Pulse is a recurring report. Have a thread we should track, or a correction? Open an issue on the dshbase repo.

All articles →