What npx @deepseek-ai/dsh web does: cache and install

npx @deepseek-ai/dsh web is the official way to get DeepSeek Harness's Web UI running in one line: npx fetches the newest package and runs dsh, web is an alias for dsh web (dsh --profile web), which boots the web app. Behind that command are three layers — an npm package, a profile-composition mechanism and a user data directory. This post explains each one: what it downloads, where data lives, why a global install is unnecessary, and whether it is really the same thing as npm global install or a source build.

In one sentence: npx folds download and start into one step

The core value of npx @deepseek-ai/dsh web is merging "download the package" and "start the app" into a single command. A traditional flow installs first, then starts; npx fetches the latest version each run and executes it immediately, so you always run the newest release without installing first.

That command breaks into three parts:

1. npx — the runner that ships with npm; it fetches and runs a package without a global install and without polluting your global environment (source).
2. @deepseek-ai/dsh — DeepSeek's official npm package; it is the Node application launcher for DeepSeek Harness, and the dsh command is the only supported Node launcher (source).
3. web — an alias for dsh web, equal to dsh --profile web, which boots the web app (the Web UI) (source).

The official Quickstart uses it the same way: start the Web UI per the root README, and the command prints its address (source).

Layer one: what the @deepseek-ai/dsh npm package is

@deepseek-ai/dsh is the launcher package for DeepSeek Harness; the dsh command you run comes from it. From npm metadata (source):

The dsh command does one thing: load the selected profile (an ordered stack of plugin-bundle patch layers) and hand the remaining arguments to the booted profile to parse. Command grammar lives in src/args.ts; src/bin.ts loads only the selected runner (source).

That "load only the selected runner" design is why npx @deepseek-ai/dsh web does not have to boot web, headless and sdk all at once — it starts only the one you name. Invalid commands, options from another mode, configuration errors and boot failures all exit nonzero, so you can branch on exit code in scripts.

Layer two: web is an alias for --profile web, a composition mechanism

web is not a separate app — it is an alias for --profile web; a profile composes several plugin bundles by layering patches in order. This is the key to understanding the command. Each profile directory that dsh boots holds a package.json (out-of-tree plugin dependencies plus the profile manifest dsh.profile, whose fields are an ordered bundles list and a patchReload lifecycle) and a cordis.patch.yml (your own patch layer) (source).

The Web UI is assembled from multiple bundles. The tree composes over an empty root, in order:

1. apply each bundle's patch in dsh.profile.bundles order;
2. then the profile's cordis.patch.yml;
3. then the home-level $DSH_HOME/cordis.patch.yml;
4. finally --patch overlays.

Bundles named in dsh.profile.bundles resolve from the dsh installation first (@deepseek-ai/dsh-base, @deepseek-ai/dsh-web-app, @deepseek-ai/dsh-headless, @deepseek-ai/dsh-sdk-app, @deepseek-ai/dsh-sdk-minimal, @deepseek-ai/dsh-acp-app), then from the profile's own node_modules, where pnpm installs out-of-tree plugins (source). The web, headless, sdk, sdk-minimal and acp profiles auto-initialize from shipped templates on first use; any other profile must be created via dsh plugin.

To see the composed config without booting, use --dump-default-config and --dump-config.

Layer three: where the data lives ($DSH_HOME and the cwd)

npx does not scatter user data globally; it concentrates it in $DSH_HOME (default ~/.dsh) and treats the directory where you launch dsh as the default workspace. This decides where your config, plugins and files are:

1. cwd = default workspace root — whichever directory you run npx @deepseek-ai/dsh web in becomes the default filesystem location (source). The Web UI does not select any workspace until you add one (source).
2. $DSH_HOME = user data directory — default ~/.dsh; profile dirs live at $DSH_HOME/profiles/<name>, and the home-level patch $DSH_HOME/cordis.patch.yml is also read (source).
3. npm cache directory — the fetched package is cached by npm, a different location from your user data directory.

So when removing packages or moving machines, what matters is your $DSH_HOME config and plugins, not the transient packages in the npx cache.

Why npx takes no global space and stays current

npx is designed not to install globally: it pulls the package into the cache, uses it and discards it, so it needs no global write permission and stays current automatically. That sidesteps two common pain points:

• No global permission — npm install -g writes to a system directory by default, and normal users often hit EACCES. npx avoids the system directory entirely, so no sudo.
• Always current — every npx @deepseek-ai/dsh web pulls the latest published package, so you never manually update the launcher.

The trade-off: you cannot type bare dsh commands in the terminal (it is not in the global bin). If you need dsh web, dsh plugin and so on, you need a global install. That is the essential npx-vs-global trade-off.

npx vs npm global install vs source build

All three run the same dsh, differing only in where it comes from; use npx daily, a global install to type bare commands, and a source build to follow dev builds. Side by side:

All three share the same profile-composition mechanism and $DSH_HOME data directory, so config, plugins and workspaces transfer between them with no data loss. A source build runs the TypeScript entry in the repo, forwarding every argument to pnpm dsh <args...> (source).

After launching: one-click plugins with DSH Plugin Hub

Launching is just the first step — DSH's power comes from plugins, and the easiest way to install them is Settings > Plugin market in DSH Plugin Hub. You can install one by one in the terminal with dsh plugin --profile web add <package>, but the mainstream route is installing DSH Plugin Hub and managing everything from its UI: install it with dsh plugin --profile web add dsh-plugin, restart dsh web, then open Settings > Plugin market, the DSH Plugin Hub market home — browse the catalog by category, with cards showing name, description, stars and last update:

Click any plugin to one-click install; a serial queue runs in the background with live progress, and most plugins take effect after a page refresh:

Now you understand what npx @deepseek-ai/dsh web does behind the scenes and how to wire up the plugin ecosystem. If you care about choosing among modes instead, see DeepSeek Harness run modes: web, headless and acp.

Sources: npm @deepseek-ai/dsh, dsh CLI README, official Quickstart