tt-a1i/archify#integrations/deepseek-harness

Community DeepSeek Harness integration for Archify. This is not an official DeepSeek product and does not imply DeepSeek endorsement.

The currently published npm package is v0.1.0, with experimental compatibility for developer-preview @deepseek-ai/dsh@0.1.0-rc.6 on Node.js ^22.19.0 || >=24.0.0. It bundles Archify Skill 2.14.0. It is not a stable cross-version guarantee.

The pending v1.0.0 release candidate is prepared for the explicitly supported developer-preview @deepseek-ai/dsh@0.1.2-rc.1. It is not published or available as an npm install yet. The 1.0 adapter contract covers this exact DSH host version; it does not make the host stable or guarantee compatibility with other DSH versions. It is a Skill-only bundle: it inserts one filesystem Skill provider named archify-plugin and exposes Archify 3.0.1, pinned to stable main commit 7158026e852f3aa6578c741e673b46d7878c92c1. This snapshot includes the Skill installation fix from #704, which landed after the v3.0.1 tag; it is not a byte-for-byte copy of that tag. The packaged package.json and skill-release.json both declare 3.0.1. Compared with the published plugin 0.1.0, it includes the Archify 3.x authoring and delivery flow, authored brand marks, Workflow schema v2, Viewer localization, and update awareness.

release.json records the immutable Skill source commit, Skill version, and DSH version used by acceptance. Packaging uses the canonical clean-Skill stager against that commit, preserving license notices and excluding development files. Adapter version 0.1.0 and its archify-dsh-v0.1.0 tag remain unchanged; reproduce that old release by checking out its tag first.

The adapter registers no native render/validate/deliver tools, custom Web client, Produced Files chips, telemetry, credentials handling, background services, or install hooks. The pending v1.0.0 Skill includes an optional, notification-only stable Archify update checker; it never upgrades the plugin. Authored remote brand assets may also use the Skill's bounded network path. The adapter itself makes no network requests.

Patch execution boundary

The cordis.patch.yml file is configuration consumed by the DSH host. Its bundledSkillDir value uses the host loader's !!js expression to resolve the installed package's skills directory when the entry is activated. This expression runs in the DSH host process, outside the agent sandbox; it is not an inert YAML value and should be treated as host-loaded code.

The current expression is intentionally limited to Node's built-in path and module helpers for package resolution. It does not fetch data, read credentials, spawn processes, or register another permission path. The normal lib/index.js resolver documents the same package-root logic, but the filesystem provider is mounted directly by the patch, so that module is not the activation hook for this bundle. Keep the published install exact-pinned and review any patch change as host-process code.

Install

Use the prebuilt npm package with an exact version. Do not install from Git source.

dsh plugin --profile web add @tt-a1i/archify-dsh@0.1.0

Upgrade

The 1.0.0 release gate covers both a clean installation and upgrading the published plugin 0.1.0 to the candidate in the same isolated profile on @deepseek-ai/dsh@0.1.2-rc.1. The older host 0.1.0-rc.6 is not a supported 1.0 target: update the host separately before upgrading the plugin. The Node requirement remains ^22.19.0 || >=24.0.0; the three-platform release gate runs on Node 22. See the adapter changelog for the bundled Archify change.

Run the same exact-version install command above in each profile that uses Archify. Updating DSH itself or the Archify repository does not update an already installed plugin.

Do not use dsh plugin add tt-a1i/archify: the repository root is not a DSH package and has no bundle metadata (see #341). For an npm download problem, a locally downloaded, integrity-verified .tgz can be passed to dsh plugin --profile web add /absolute/path/to/package.tgz.

Host activation configuration

The bundle's cordis.patch.yml contains a !!js expression that DSH evaluates during host activation. Its current purpose is limited to resolving the installed @tt-a1i/archify-dsh package from the profile baseUrl and locating its packaged skills directory. The expression does not itself make network requests or handle credentials, but it is evaluated host-process code rather than entirely declarative data. Review the patch when upgrading, and keep the exact-version install guidance above.

Release maintenance

Every Archify release records a sync or deferral decision in the DSH synchronization checklist. Plugin and Archify versions are independent.

On a release branch, bump package.json, update release.json with the full source commit and matching Skill/DSH versions, and prepare PACKAGE_README.md, which is staged as the npm package’s README.md. This repository README tracks publication status separately. The pack command reads adapter files and release metadata from the current adapter Git HEAD blob: commit those changes before packing; working-tree edits are not package inputs. Run:

node --test integrations/deepseek-harness/test/*.test.mjs
node integrations/deepseek-harness/scripts/distribution-acceptance.mjs
node integrations/deepseek-harness/scripts/pack.mjs --out /tmp/archify-dsh.tgz --json

Distribution acceptance requires Node 22 for the canonical ZIP regression check and pnpm 10. It installs the real pinned DSH runtime and tarball in temporary profiles, checks discovery and loading, runs doctor and demo through the installed CLI, and checks uninstall. It also installs an integrity-pinned published 0.1.0 tarball, upgrades that same profile to the candidate, checks both Skill identities and loading, exercises the upgraded CLI, and verifies removal preserves the base profile. The full source-version package smoke runs on a temporary copy of the installed Skill because it rewrites bundled examples; the copy preserves pnpm store hard links in the actual installation. Release CI runs this on Linux, macOS, and Windows. Publish only the tested tarball as a new version; tag the corresponding adapter commit as archify-dsh-v<version>. After v1.0.0 is published and publicly verified, switch the public install examples to @1.0.0. Rebuilding a released adapter uses its tag and recorded Skill commit, not a moving branch.

Invoke

Ask DSH to load Archify by name:

Use the archify skill to map this repository's runtime architecture.
Show 8–12 core components, one primary path, external dependencies, and trust boundaries.
Put supporting detail in cards instead of adding more edges.
After delivery, return the exact workspace paths of the specification JSON and the HTML artifact.

Archify then runs through DSH's ordinary Skill, shell, and filesystem paths. Generated JSON and HTML are normal workspace files.

Produced Files limitation

Files created by shell commands do not automatically appear in the Web Produced Files strip. Ask the agent to return the exact workspace paths of the specification JSON and the HTML artifact, then open those files from the workspace.

Uninstall

dsh plugin --profile web remove @tt-a1i/archify-dsh

The standard plugin command removes the adapter dependency and bundle layer. The base profile remains usable.

Security posture

• The adapter has no telemetry, network client, credentials handling, or background service
• No prepare, install, or postinstall scripts
• Host-loaded adapter code does not spawn processes or open a second permission path
• Package resolution, provider load, and composition errors fail during normal DSH boot