DSH 0.1.3-alpha.1

Discover first, install only when authorized

Start with a short, copyable #NNNN task. The Agent resolves the record, stops when exact installation authority is missing, and verifies authorized installs before changing DSH.

Recommended · One instruction

Copy the reusable #NNNN task

Tell the Agent only the strict #NNNN. The pinned Skill discovers every record, but installation proceeds only for an explicitly authorized entry.

Please install DSH Themes #NNNN for me on DeepSeek Harness 0.1.3-alpha.1 built from official source commit d347e703908d0406b7a7ef80e3a0e594d86b2215.
Use this pinned Skill: https://github.com/LvvUP/dsh-themes-skills/blob/de956d98c80cf5ab60a78df0a534f9f29f348651/skills/dsh-theme-finder/SKILL.md
Resolve the exact number, check my installed version and the verified package, then install it. Explain required configuration, verify loading and keep removal or recovery instructions. If the number is retired or its package is not
verified, stop and explain the reason clearly.

Advanced manual installation and rollbackInspect the four-stage command track, Developer Preview boundary, verification, and exact rollback procedure.

Developer Preview boundary

DeepSeek Harness currently persists only light, dark, and system. A third-party Cordis theme needs a DSH restart and may need revalidation after an upstream change.

Inspect the web profile

Require the exact supported DSH version, then identify zero or one active @dsh-themes/* dependency before any mutation.

RUNNER=/absolute/path/to/dsh-theme-manager/scripts/run-dsh.mjs
node "$RUNNER" --version
node "$RUNNER" --profile web --dump-config
node "$RUNNER" plugin --profile web list --json

Verify and install

Use the whole-artifact digest from the catalog. Verify to a new absolute local path, remove the current theme only when present, then add the verified .tgz.

node <skill-dir>/scripts/fetch-and-verify.mjs --source <https-or-absolute-local-tgz> --sha256 <whole-artifact-sha256> --output <absolute-new-verified-tgz>

node <skill-dir>/scripts/run-dsh.mjs plugin --profile web remove "@dsh-themes/<current-slug>"
node <skill-dir>/scripts/run-dsh.mjs plugin --profile web add "<absolute-new-verified-tgz>" --save-exact

03
Dump config and restart
Before restart, require the expected Cordis bundle entry and exactly one direct @dsh-themes/* dependency. After restart, verify the browser plugin roster and computed token values. Redact unrelated dump-config values.
```
node <skill-dir>/scripts/run-dsh.mjs --profile web --dump-config
node <skill-dir>/scripts/run-dsh.mjs plugin --profile web list --json
```

Roll back by exact version

Re-verify the recorded previous artifact before removing the current theme. If the previous state was the built-in palette, remove the current theme and install nothing.

node <skill-dir>/scripts/fetch-and-verify.mjs --source <absolute-previous-theme.tgz> --sha256 <previous-whole-artifact-sha256> --output <absolute-new-rollback-copy.tgz>

node <skill-dir>/scripts/run-dsh.mjs plugin --profile web remove "@dsh-themes/<current-slug>"
node <skill-dir>/scripts/run-dsh.mjs plugin --profile web add "<absolute-new-rollback-copy.tgz>" --save-exact
node <skill-dir>/scripts/run-dsh.mjs --profile web --dump-config

Why themes are Cordis plugins

The DSH Web UI exposes ThemeRuntime as a client service. A generated client module registers through the Harness module loader, injects theme, and scopes its override through ctx.effect so Cordis can dispose it cleanly.

Tested DSH version: 0.1.3-alpha.1
Token catalog hash: fe38fdb18dae76f3cc93e3ca3a37bb1916f207180781b1aa8321ee2ddadcb926

Agent Skill safety contract

The included Skill never edits ~/.dsh directly. It checks the web profile, verifies the downloaded hash, removes the old @dsh-themes/* plugin, installs one exact package, dumps config, and records rollback state.

Keep a way back

Restart Harness when needed and check the result. The installation task keeps instructions to remove the item or restore your previous setup.