Fix DeepSeek Harness DSH plugin errors: load, ESM, Web UI

Plugin errors, Web UI issues, and session/cache problems in DeepSeek Harness almost always live in three areas: the plugin package itself (ESM, inject, package renames), the web interface and runtime environment (workspace, crypto context, remote access), and session data that is corrupted or mismatched (log gaps, cache invalidation). Match your error text below, fix it, and if it is not resolved, upgrade to rc.7/rc.8 first — recent official releases fixed many of these defects, and plenty of "UI glitches" are actually old-version bugs.

Plugin errors: not loading, ERR_REQUIRE_ESM, missing inject, and package renames

Plugin errors concentrate on package format and dependencies: missing manifests, ESM compatibility, inject declarations, package renames, and duplicate instances. These come from the community-run collection (source).

ERR_REQUIRE_ESM: CommonJS required an ESM-only package

ERR_REQUIRE_ESM means CommonJS code used require() on a package that only ships ESM exports. Usually a packaging mistake by the plugin author:

1. Confirm Node is LTS (20+): run node --version — v20.x or newer is recommended for full ESM support;
2. Restart dsh web so the plugin reloads: press Ctrl+C, then run dsh web;
3. If it still fails, it is the package itself — report it to the author so they ship compatible exports (CJS and ESM), or switch to an alternative. Check the changelog on the DSH Plugin Hub plugin page.

cannot get property "systemPrompt" without inject

This error means plugin code read a service such as systemPrompt before its dependency (inject) was declared — the injection had not happened yet. A plugin bug:

1. Confirm the plugin is on its latest version (old versions commonly hit this) — check Settings → Plugin Center for an update, install it if one exists, and restart dsh web;
2. If it still errors after updating, report it to the author so they add the inject declaration;
3. Temporary workaround: disable the plugin per how to disable a plugin without uninstalling, then restart dsh web — if the error goes away and everything else works, the plugin is confirmed as the cause.

@deepseek-ai/dsh-type-meta not found: the package was renamed

The official package @deepseek-ai/dsh-type-meta was renamed to @deepseek-ai/dsh-typert-protocol (official rename ledger, 2026-08-11 — the package owns the Typert Remote protocol, decorators, bindings, and codecs, now under packages/typert/protocol (source)). The real cause of the "not found" error is the rename, not an unpublished dependency:

1. Update the plugin / profile dependency that uses it — replace @deepseek-ai/dsh-type-meta with @deepseek-ai/dsh-typert-protocol in the profile's package.json, then reinstall:
   bash

   pnpm install
   

   Expected: dependency resolution no longer reports Cannot find module '@deepseek-ai/dsh-type-meta';
2. Or update dsh and the affected plugins to a version that includes the rename (after rc.7): npm update -g @deepseek-ai/dsh;
3. If you installed an older bundle, reinstall so dependencies resolve to the new name;
4. Restart dsh web — the original error disappearing means it is fixed.

reading 'prepare' of undefined: duplicate instances of a tool package

reading 'prepare' of undefined usually comes from a tool package such as dsh-tools being installed twice, with peer dependencies not deduplicated. Reported by users running dsh in practice:

1. Confirm @deepseek-ai/dsh-tools appears only once in the profile's package.json:
   bash

   grep -c '"@deepseek-ai/dsh-tools"' <profile-dir>/package.json
   

   An output of 1 is normal; more than 1 means it was installed twice;
2. If it appears twice, uninstall and reinstall the related plugin in Settings → Plugin Center so pnpm hoists the peer dependency to a single instance;
3. Restart dsh web (Ctrl+C, then dsh web) — no more reading 'prepare' of undefined means it is fixed.

duplicate loader entry id: a bundle is hoisted twice

duplicate loader entry id means the same plugin layer is declared twice (the bundle was hoisted into two copies). Reported by users running dsh in practice:

1. Open the profile's package.json (or the dsh config file), find dsh.profile.bundles, and remove the duplicated entry so it is listed once;
2. Save, then run pnpm install to sync dependencies with the declaration;
3. Restart dsh web (Ctrl+C, then dsh web) — no more duplicate loader entry id means it is fixed.

Installed but not activated / Failed to load plugins / allowBuilds prompt

These overlap with dedicated articles — follow the links:

• Installed but not activated (missing dsh.bundle) → the safe-install guide
• Failed to load plugins fatal screen → DSH plugin not loading
• allowBuilds build-authorization prompt → local directory & source install

dsh-plugin-hub · Plugin Center

Web UI and runtime issues: greyed send button, crypto.randomUUID, remote access

Web UI errors fall into two buckets: interface state problems (no workspace, broken composer rendering) and runtime-environment problems (non-secure context, remote-access limits). These come from the community-run collection (source).

The send button stays greyed out

A greyed send button usually means no workspace is selected — without a workspace the agent has no directory to operate on, so sending is disabled. Fix:

1. Pick or create a workspace directory at the top of the Web UI;
2. The send button should become clickable and the input box should accept text afterwards;
3. If it is still greyed out, refresh the page (F5);
4. If that does not help, confirm the background dsh web process is fresh — a stale process holding the port can leave the UI talking to an old instance. Check with lsof -i :3080 (macOS/Linux), stop the old process, and restart; see the 127.0.0.1:3080 connection refused article.

Skills work in the CLI but not in the Web UI

Users have reported: skills work in the command line but cannot be found or invoked in the Web UI. The official dsh-base layer includes skill plugins such as skill-filesystem and tool-skill (source), but different agent presets expose different skill sets (official tests cover standard and minimal skill assemblies), so the skills available in the Web UI and the CLI may differ:

1. Check in the Web UI's skill manager (Settings → Skills) whether the target skill is enabled; turn it on if not;
2. Review the agent preset used by the current profile: run dsh --dump-config to see the preset field, switch to a preset that exposes more skills, and restart dsh web;
3. If it still fails, use the CLI (dsh command line) as the fallback and report the Web UI / CLI skill mismatch to the plugin repository.

crypto.randomUUID is not a function

Browsers disable Web Crypto capabilities under plain http (a non-secure context), so crypto.randomUUID does not exist. Users who ran into this confirmed it is tied to the access protocol:

1. Access the Web UI over http://localhost:3080 (localhost counts as a secure context) instead of plain-http addresses such as http://192.168.x.x;
2. After switching, refresh the page, open DevTools with F12, and run crypto.randomUUID() in the Console — a UUID string means it is fixed;
3. For remote access, expose the page through a TLS reverse proxy (for example Caddy or Nginx with HTTPS) so the browser is in a secure context;
4. Locally, localhost alone avoids the issue.

The Composer input box disappears

A missing Composer (input area) usually follows corrupted markdown image references in history — the render pipeline throws and the input component never mounts. Reported by users running dsh in practice:

1. Refresh the page (F5) to reload first and see if the input box comes back;
2. If it recurs, remove the message with the broken image reference in that session, or start a new session;
3. If it happens often, check whether it is an old-version defect — update to rc.7+ and retry (npm update -g @deepseek-ai/dsh).

/api/commands/list returns 404

A 404 from /api/commands/list after installing a new plugin usually means the plugin's registered routes have not taken effect. Fix:

1. Restart dsh web: press Ctrl+C, then run dsh web;
2. Confirm the plugin is actually activated (see "installed but not activated" above); resolve activation first if it is not;
3. After the restart, visit http://localhost:3080/api/commands/list in the browser — it should return 200 with JSON data instead of 404.

Skill menu prefix-matching limits

The skill menu matches skill names by prefix, so long prefixes or mixed Chinese/English input can miss. Reported by users running dsh in practice:

1. Type just the core few characters of the skill name (the name itself, not the full name with a version);
2. Avoid pasting full names with version numbers or long descriptions;
3. When matching fails, select the skill in the skill dropdown before chatting, or call it from the CLI with the matching dsh command.

Remote access shows a blank "Settings → Plugins"

Through a remote browser, the plugin management panel is blank — plugin management is bound to the local filesystem and dsh web listens on 127.0.0.1 by default. Reported by users running dsh in practice:

1. Go back to the machine running dsh and visit 127.0.0.1:3080 there — Settings → Plugins should list plugins normally;
2. Remote access is fine for viewing and chatting; install / uninstall plugins on the local machine — a blank plugin panel remotely is by design, not a fault;
3. The easiest local path is the plugin center in Settings — the community marketplace DSH Plugin Hub — for graphical plugin management.

dsh-plugin-hub · Installed Plugins

Session and cache issues: log corruption, KV cache drop, Failed to fetch

Session-restore errors come from corrupted or mismatched data: log gaps, system-prompt order drift, and malformed deltas. These come from the community-run collection (source).

Session log corrupted on restore (sequence gaps)

A restore-time corruption notice shows sequence gaps — records missing in the middle. Reported by users running dsh in practice:

1. Export the current session data first as a backup (use the Web UI export feature, or copy the session file elsewhere);
2. Start a new session so the log stops shifting;
3. Update to rc.7+ (npm update -g @deepseek-ai/dsh) — that release fixed stack overflow on large history and other session issues; if new sessions no longer report corruption, it was an old-version write defect.

KV cache hit rate drops after restore

After a restore the KV cache hit rate drops noticeably — usually the system-prompt order drifted, so cache keys no longer match. Reported by users running dsh in practice:

1. Let the session regenerate its system prompt once (for example switch the model away and back) to rebuild the cache — the hit rate should recover;
2. Or just start a new session so the cache rebuilds from scratch and the hit rate returns to normal;
3. If it happens often, check whether a plugin rewrites the system prompt mid-session — temporarily disable the suspicious plugin and test again.

History reports Failed to fetch (internal)

A Failed to fetch (internal) in the History panel usually comes from malformed streaming tool deltas breaking the frontend fetch. Fix:

1. Refresh the page (F5) and retry first — one-off malformed data usually recovers on refresh;
2. If it recurs, export the session data as a backup, then start a new session;
3. If the version is old, update first: npm update -g @deepseek-ai/dsh — rc.7 fixed persistent Bash lag, max-tokens truncation, and other defects that can produce malformed deltas; if new sessions stop recurring after the update, that was the cause.

Credential and model errors: quick reference

Credential and model errors (MISSING_CREDENTIAL, UNKNOWN_MODEL, 401 on fetching available models, maximum context length is 1048576 tokens) are not plugin problems — see the full guide fixing model errors and credentials. Fastest entry points:

Old-version defect fixes (update solves them)

Many "plugin / Web UI errors" are old-version bugs — update first, then debug. Recent official fixes (source):

1. v0.1.0-rc.7: fixed max-tokens truncation (long replies cut off), persistent Bash session lag, stack overflow on large-history pagination (page freezes with lots of history), and the Safari cursor misalignment (cursor jumping in the input box).
2. v0.1.0-rc.8: fixed model requests failing on oversized images / accumulated image payload in history, request-format differences with custom OpenAI-compatible gateways, auto-opening the browser for dsh web, and slimmer dependency downloads.
3. Update commands: npm update -g @deepseek-ai/dsh (global), npx @deepseek-ai/dsh@latest web (one-off), or git pull plus rebuild (source).

Notes

1. Match your error text first; do not uninstall things blindly.
2. For plugin errors, confirm the newest version and a single instance first.
3. For Web UI errors, confirm you are on localhost, not plain http.
4. For session errors, export data before touching the session to avoid secondary corruption.
5. Check the version before debugging: most UI glitches on versions older than rc.7 are solved by updating.

Source: dshbase troubleshooting, v0.1.0-rc.7 / v0.1.0-rc.8 Release Notes, packages/typert/protocol, apps/cli/composition.md