DeepSeek Harness Quickstart: npx @deepseek-ai/dsh web

The command you actually run

After Node.js is on PATH, the public quick start is:

npx @deepseek-ai/dsh web

That package name matters. Typos in the npm scope waste an afternoon. The Web UI commonly binds http://127.0.0.1:3080/. Keep the terminal open; killing it stops the server.

Upstream documents Node ^22.19.0 or >=24.0.0. Older 18/20 trees often fail the engines check halfway through the download. Run node -v in the same shell as npx — nvm and fnm do not help if you picked a version in another window.

OS notes without pretending we ship installers

• Windows: install LTS (winget or nodejs.org), reopen the terminal, cd into the project folder, then npx. Starting from the repo you care about makes the default workspace less surprising. For PATH, PowerShell vs Git Bash, Controlled Folder Access, and WSL path traps, see DeepSeek Harness on Windows.
• macOS: official pkg or Homebrew. Do not grant Full Disk Access “just in case” on day one — PATH, TCC, and Silicon/Intel notes: DeepSeek Harness on macOS.
• Linux / WSL: nvm or distro Node 22/24. Do not run the agent as root. On WSL keep the workspace on the Linux filesystem.

The full one-liners live on the install page. This article is the narrative; that page is the checklist.

After the UI opens

1. Settings → Model (wording varies by preview build). Paste a DeepSeek platform key. This site never issues keys. Local UI is not local inference by default.
2. Choose a disposable workspace. Your entire home directory is the wrong first target.
3. Send a low-risk prompt: list top-level files, summarize README in five bullets. Watch tool calls. If the agent reaches for delete or broad chmod, stop.

Headless and CLI paths exist for CI later — operator notes for DeepSeek Harness headless, --json, and --session-id are in Run DeepSeek Harness headless. First hour still belongs in the browser so you can see Trajectory-style traces.

When it fails

npx timeouts, stale caches, missing pnpm (plugin add often shells out to pnpm), port 3080 taken, credentials file modes on Unix, macOS TCC blocks — those are catalogued on Troubleshoot, not guessed in a blog comment. For a decision-tree walkthrough of the same failures (Node engines → npx fetch → port 3080 → keys), read Fix npx and port 3080. Mirror lag is real: retry with the official npm registry.

Source install is a different job

Contributors clone deepseek-ai/deepseek-harness, then pnpm install, pnpm run build, pnpm dsh web. Use that when you are writing Cordis plugins, not when you only wanted to see the UI. Mixing the two mental models is how people paste pnpm errors into npx threads.

Next: modes so you do not load Creative experiments on a work repo, and community plugins only after the first loop is boringly successful.

A first-hour script that does not require heroics

1. node -v in the same window you will use for npx. If it is 18 or 20, stop and install 22.19+ or 24+.
2. cd into a clone you can throw away. Copy secrets out of it first.
3. Run npx @deepseek-ai/dsh web and wait until the terminal prints a local URL. Do not Ctrl+C “to see if it worked.”
4. Open http://127.0.0.1:3080/ — not a random cloud tunnel unless you understand who can reach it.
5. Paste the platform key in settings. Confirm the UI is not advertising local weights unless you installed that stack yourself.
6. Prompt: “List the top-level files and quote the first heading of README.” Watch the tool list. If it asks to delete or chmod broadly, refuse.

That is enough to decide whether the preview is worth a second hour. It is not enough to point at a monorepo that pays people.

npx versus a global install

A global npm i -g can look convenient and then surprise you when two terminals resolve different majors. The documented quick start is npx against the scoped package. Pin the version in notes when you file a bug: “rc.N on Node 22.19.0, Windows 11, workspace D:\scratch\demo”. Upstream cannot debug “it failed.”

If corporate proxy MITM breaks the npm registry, you will see timeouts that look like product bugs. The troubleshoot page covers mirrors and caches; this article will not invent a proxy how-to for every PAC file.

What “success” looks like

You can explain, in one sentence, which folder the agent may touch. You can open a session inspector and point at a tool result. You have not installed a skin marketplace, a “free overlay,” or three GitHub topics in the same sitting. When that is true, graduate to modes and maybe one curated plugin — still as software, still with an unload path.