# Independent DSH Plugin Feasibility Report

## Decision

`dsh-godot-preview` can be implemented as an independently installable profile bundle without modifying DeepSeek Harness core source.

## Verified host extension points

The installed Harness 1.0.44 runtime exposes `@deepseek-ai/dsh-host-webserver`. Its `webServer` service supports exact and prefix route registration with lifecycle disposers. The installed `dsh-desktop-mcp-manager` demonstrates a third-party-style package that:

- exports a Host `apply` function;
- injects `webServer`;
- registers a same-origin JSON API;
- tears resources down with `ctx.effect`.

The implemented Godot plugin follows this pattern for `/api/godot-preview`; preview assets are served by its managed loopback-only server.

## Verified client extension points

Harness discovers browser bundles from packages that:

- declare `dsh.client` in `package.json`;
- export `./client`;
- ship a prebuilt `lib/client.js` factory registered through `window.__ModuleLoader__.load`.

The public `conversation.view` slot is used by installed packages including `dsh-agent-teams` and `dsh-desktop-schedules`. It renders in the existing details/right-hand area. The Godot plugin will register its preview view there instead of changing the shell layout.

## Verified installation model

The DSH CLI forwards `dsh plugin --profile <name> ...` to pnpm in the selected profile. Packages declaring `dsh.bundle.patch` are reconciled into `dsh.profile.bundles`. Therefore this repository ships `cordis.patch.yml` and declares it in `package.json`.

Development installs can use a local path; published installs can use a registry or approved marketplace package. Final users receive prebuilt Host and Client files and do not need the Harness source checkout or `pnpm run dev:web`.

## Client build requirement

A plain browser ESM bundle is insufficient. The published Client must register a lazy CommonJS factory with `window.__ModuleLoader__.load`. The repository's build script wraps an esbuild CommonJS bundle in this factory form.

## Godot availability

No `godot` or `godot4` executable is currently present on PATH. Per user instruction, the implementation did not download or install Godot. Automated validation uses a bounded fake Godot CLI fixture launched through Node with an explicit test-only argv prefix. The release path validates and uses a user-selected or PATH-discovered absolute Godot executable when one is available.

## Package-manager note

The machine's global `pnpm.cmd` currently points to a removed Hermes pnpm installation, while Corepack can run pnpm successfully. Repository development uses npm/Corepack without changing the user's global installation. The final plugin remains compatible with the normal DSH profile-plugin workflow on systems with a working pnpm command.

## Security conclusions

The independent implementation can retain the required boundaries:

- no Harness core modification;
- no bundled or silently downloaded Godot;
- explicit absolute executable plus argv, never `shell: true`;
- same-origin API protected by a plugin-specific header, loopback Host validation, and Origin validation;
- preview assets constrained to the managed output directory;
- no server, watcher, or Godot process while idle;
- complete lifecycle cleanup through the plugin fiber.

## Phase gate result

**Pass.** Public Host routes, client slots, client bundle discovery, and profile-bundle installation are all available. Implementation may proceed without expanding scope into Harness core changes.