Fix "allowBuilds" hint when DSH plugin add Git fails

When dsh plugin add fails on a Git install and then tells you to edit allowBuilds, the hint is often wrong — the CLI only checks whether the command looks like a Git address, not whether you actually failed on the network or on build policy. Read pnpm's original error first, then decide whether to touch allowBuilds. For network failures, editing it does nothing.

DSH plugin add fails yet shows an allowBuilds hint: symptom and cause

The typical case is a Git install like dsh plugin --profile <name> add git+https://…: pnpm fails before it even fetches the repository, yet DSH follows up with "Git-hosted plugins build through prepare, please edit allowBuilds." A user reproduced this (see the discussion), on DSH 0.1.1-rc.2 / Node 24 / Windows:

1. Run dsh plugin --profile web add git+https://github.com/your-repo.git;
2. pnpm first prints ERR_PNPM_GIT_FETCH_FAILED and Failed to connect to github.com port 443: Timed out;
3. DSH then suggests editing allowBuilds — but the repository was never downloaded and no prepare step ever ran.

The key point: pnpm's own error output is not swallowed (the install subprocess streams stderr as-is), so the error code is your only reliable guide. The allowBuilds hint, on the other hand, is chosen by the DSH CLI's own logic: it only tests whether an argument matches a Git shape (git+ / github: / .git), reading neither the exit code nor any ERR_PNPM_* code — so a network failure gets labeled as a build-policy problem (see plugin.ts).

How to tell a network failure from a build-policy failure

The only way to tell them apart is the pnpm error code. The two groups map to two completely different fixes:

The inverse case is worth knowing too: a plain npm package that fails on build policy gets no hint at all. For example, when a dependency chain (pi-ai → genai client → protobufjs) carries an install script that pnpm blocks, the first error is ERR_PNPM_IGNORED_BUILDS — but because the command was not Git-shaped, the hint is suppressed. The user who most needs the allowBuilds sentence never sees it.

DSH plugin install retry: fix the network for network failures, edit allowBuilds only for build policy

Network failures: fix the connection, then retry — do not edit allowBuilds. Follow these steps:

1. Check basic connectivity — it should return an HTTP status line (200 or 3xx). A timeout or failure confirms a network problem:

curl -I --max-time 10 https://github.com

2. Check your proxy: the DSH install subprocess reads the system proxy and the HTTPS_PROXY environment variable — make sure the browser can open GitHub and the system proxy is working, then verify the proxy config in your environment:

env | grep -i proxy

3. Retry after the network is restored — the install succeeds once the pnpm error is gone:

dsh plugin --profile <name> add git+https://github.com/your-repo.git

4. On networks that cannot reach github.com at all, use an npm mirror or a reachable repository mirror, or install the npm distribution of the plugin instead.

Build-policy failures: this is when allowBuilds actually matters. Only when you see ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED or ERR_PNPM_IGNORED_BUILDS should you follow DSH's hint, add the package to the allowBuilds whitelist, save, and re-run the install.

Fix status: the DeepSeek Harness patch is ready and waiting for maintainers

The false positive has been traced to its root cause and fixed in a community patch; the branch is waiting to be merged upstream. Author adoresever rewrote the hint gate to key on ERR_PNPM_* codes:

1. The allowBuilds guidance is shown only when stderr contains ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED or ERR_PNPM_IGNORED_BUILDS;
2. Network failures such as ERR_PNPM_GIT_FETCH_FAILED no longer trigger the hint;
3. Built-CLI regression coverage passes 19/19 across Git fetch failure, Git prepare-policy failure and registry-spec ignored-build failure;
4. External PR creation is restricted on the upstream repo, so the patch is ready for a maintainer to pull or cherry-pick — until then, reading the error code as shown above is the reliable workaround.

Command-line plugin installs most often break at the "source + network" step, and the false hint can send you off editing allowBuilds for nothing. If you would rather not wrestle with these errors, the DeepSeek Harness desktop app ships with the official DSH Plugin Hub plugin center (dsh-plugin.org) — browse visually, install/uninstall/update in one click, with a confirm dialog and system logs so you can see exactly which step failed.

Notes

1. Fix the network first; do not edit allowBuilds for network failures — it will not help and it widens your security whitelist.
2. Judge by pnpm's original error code, not by the allowBuilds hint above it.
3. Until the patch lands, watch the DeepSeek Harness release notes to see when the fix is included.

Sources: Discussion #4702, apps/cli/src/plugin.ts, patch branch fix/plugin-build-policy-diagnostic