# DSH Melody Launcher
**A Windows desktop launcher and plugin manager for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)**
Download one executable and go: it manages DSH itself, plugins, your API key, and runtime configuration — no Node.js required up front.
[](https://github.com/rirko/dsh-melody-launcher/actions/workflows/ci.yml)
[](https://github.com/rirko/dsh-melody-launcher/releases/latest)
[](https://github.com/rirko/dsh-melody-launcher/releases)
[](https://github.com/rirko/dsh-melody-launcher/stargazers)
[](https://github.com/rirko/dsh-melody-launcher/issues)
[](https://www.electronjs.org/)
[](https://react.dev/)
[](https://www.typescriptlang.org/)
[](https://vite.dev/)
[](https://vitest.dev/)
[](https://nodejs.org/)
[](https://github.com/rirko/dsh-melody-launcher/releases/latest)
[简体中文](README.md) · **English**
---
## Table of Contents
- [What is this](#what-is-this)
- [Features](#features)
- [Quick Start](#quick-start)
- [User Guide](#user-guide)
- [DSH Detection and Installation](#dsh-detection-and-installation)
- [Portable Node.js Runtime](#portable-nodejs-runtime)
- [Data and Configuration](#data-and-configuration)
- [Security Design](#security-design)
- [Running from Source](#running-from-source)
- [Project Structure](#project-structure)
- [Roadmap](#roadmap)
- [FAQ](#faq)
- [Contributing](#contributing)
- [License](#license)
---
## What is this
**DSH Melody Launcher** is a Windows desktop application that pulls the download, deployment, plugin management, and startup of DeepSeek Harness (DSH) into a single GUI. Its interaction model is inspired by the Minecraft **HMCL / Melody-style launchers**: before anything actually starts, you settle runtime configuration, API key, plugin toggles, and load order in one place.
The problems it removes:
| What you used to do | With the launcher |
| --- | --- |
| Install Node.js → install npm → `npx @deepseek-ai/dsh` | Download one exe, click "Install DSH" |
| Hand-edit `.credentials.yaml` to add your API key | Type it in the UI; written automatically with `0600` permissions |
| Search GitHub for plugins, type `dsh plugin add` | Built-in search over the `dsh-plugin` topic, one-click install |
| Edit the profile's `package.json` to change load order | Reorder a list; the official profile is updated directly |
| Open a terminal, remember commands, watch output | One button to launch, live log panel |
> [!NOTE]
> **Modpack support is now available.** You can save, import, and export a set of plugins plus configuration as a reusable bundle. Contributors welcome — QQ: **1250104511**
---
## Features
### Deployment and Launch
- **Zero-prerequisite first run** — when no local DSH is detected, the home button switches to "Install DSH" and handles first-time deployment
- **Automatic Node.js provisioning** — works even without Node.js installed: downloads the official portable runtime, verifies it with SHA-256, and supports resuming interrupted downloads
- **Automatic pnpm provisioning** — installs a launcher-managed pnpm on the first plugin operation, with no global command required, and shares it across regular installs, modpacks, and AI-assisted installation
- **Multi-path DSH detection** — checks the launcher's runtime directory, the configured launch command, `PATH`, `%APPDATA%\npm`, and the system Node.js directory
- **Process lifecycle management** — start, stop, and stream live logs (stdout/stderr, leveled); stopping or exiting also cleans up companion processes launched by the app
- **Auto-open the web UI** — detects the local service URL from the log stream and opens it in your browser (optional)
### Unified Resource Market and Plugin Management
- **Unified discovery** — searches [`dsh-plugin`](https://github.com/topics/dsh-plugin), [`dsh-skill`](https://github.com/topics/dsh-skill), and `dsh-app`, then combines them in one catalog
- **Content-based classification** — topics are candidate sources only; repository inspection recognizes plugins, skills, application add-ons, agent presets, hybrid resources, DSH core, and invalid repositories
- **Type-routed installation** — plugins go to a DSH profile, skills and presets use their dedicated directories, and application add-ons get isolated runtimes with explicit user selection
- **Application add-on management** — supports runtime replacement, after-runtime companion, and standalone launch modes, with synchronized toggles for linked plugins
- **Meta-repository support** — expands Git submodule suites and installs components from pinned revisions or GitHub Release assets
- **Strict Skill validation** — validates directory `SKILL.md` bundles and flat Markdown skills, including required YAML frontmatter
- **Staged install progress** — `preparing → resolving → downloading → configuring → complete`, with percentage and live status text
- **Load order control** — reads and writes the official DSH profile directly to toggle plugins and reorder bundles
- **Disable ≠ uninstall** — disabling only removes a plugin from the ordered load list; local dependencies stay on disk and can be re-enabled at any time. Only an explicit uninstall deletes files
- **Core bundle protection** — the three core bundles (`@deepseek-ai/dsh-base`, `dsh-web-app`, `dsh-headless`) cannot be disabled — the main process rejects it — and the UI offers no uninstall action for them
- **Automatic build-script approval** — on pnpm's `ERR_PNPM_IGNORED_BUILDS`, approves build scripts scoped to the repository being installed and retries automatically
### Interface and Configuration
- **Dual-size window** — frameless design that switches between launcher mode (900×560) and manager mode (1380×860)
- **GitHub account login** — supports OAuth Device Flow and fine-grained tokens, encrypts credentials with Electron safe storage, and authenticates catalog, inspection, download, and update requests centrally
- **API management** — configure the DeepSeek API key or add custom OpenAI Completions, OpenAI Responses, and Anthropic Messages-compatible providers
- **Launcher self-update** — checks GitHub Releases on startup and can download and apply a new portable build from the app
- **Full runtime configuration** — `DSH_HOME`, profile name, working directory, launch executable and arguments are all editable in the UI
- **Portable** — the launcher itself needs no installation; a single exe
---
## Quick Start
### 1. Download
Grab the latest `DSH-Launcher-*-portable.exe` from [**Releases**](https://github.com/rirko/dsh-melody-launcher/releases/latest).
> [!IMPORTANT]
> The portable build is **not signed with a commercial code-signing certificate**. Windows SmartScreen may warn about an unknown publisher on first run. After confirming the file came from this repository's Releases page, choose "More info → Run anyway".
### 2. First-time deployment
Open the launcher. If no local DSH is found, the home button reads **"Install DSH"** — click it to complete first-time deployment.
The whole flow requires **no pre-installed DSH, Node.js, npm, or npx** — the launcher provisions whatever is missing. Keep your network connection up; if a download is interrupted, clicking again resumes it.
### 3. Configure your API key
Enter your DeepSeek API key on the launch page. It is written to the official DSH credentials file at `$DSH_HOME/.credentials.yaml`.
### 4. Install Plugins or Skills (optional)
Open **Resource Market**, inspect a repository to identify its real type, and install the selected Plugin or Skill. Installed Plugins remain configurable under **Load Order**.
### 5. Launch
Return to the launch page and click **"Start DSH"**. Once the service is ready, the Harness web UI opens automatically.
---
## User Guide
The launcher has three main views:
### Load Order
Lists every bundle in the current profile. For each plugin you can:
- **Enable / disable** — the toggle adds or removes the plugin from the ordered load list; files stay on disk
- **Reorder** — load order determines override precedence; later entries load later
- **Uninstall** — actually removes the plugin from the current profile. Available for profile dependencies only; DSH's built-in core bundles have no uninstall action
> Changes take effect **the next time DSH starts**.
### Discover
Searches GitHub for repositories tagged with the `dsh-plugin` topic, showing stars, primary language, last update, and description. Click to install.
Search uses the anonymous GitHub API, which is rate limited. When the quota runs out the launcher says so explicitly — just retry later.
### Runtime and Logs
Shows DSH status, PID, start time, and service URL, plus a live log stream. Logs are split into `runtime` (DSH itself) and `plugin` (plugin operations) channels, at `info` / `error` / `success` levels.
---
## DSH Detection and Installation
On the discovery page, the launcher **specifically recognizes** this repository:
```text
deepseek-ai/deepseek-harness
```
It is not treated as an ordinary plugin; it goes through a dedicated installation path instead.
### Detection order
At startup, the launcher looks for an existing DSH installation in this order:
1. The launcher-managed runtime directory (`%APPDATA%\dsh-launcher\dsh-runtime`)
2. The currently configured launch command
3. The system `PATH`
4. `%APPDATA%\npm` (the Windows npm global directory)
5. The system Node.js installation directory
> [!TIP]
> A candidate only counts as a valid installation if it has **both** the official `@deepseek-ai/dsh` package manifest **and** a `dsh` executable — this prevents an unrelated program with the same name from being mistaken for DSH.
### Installation behaviour
| Situation | Behaviour |
| --- | --- |
| System installation detected | Used directly; nothing is reinstalled |
| Nothing detected | The home button becomes "Install DSH" and guides first-time deployment |
| Installation runs | `@deepseek-ai/dsh@latest` is installed via npm into the launcher's local runtime directory, and the launch command is switched to the local executable |
Once installation finishes, the home button changes from "Install DSH" to "Start DSH".
---
## Portable Node.js Runtime
When no Node.js is found on the system, the launcher provisions a portable runtime:
| Step | Details |
| --- | --- |
| **Source** | The official `https://nodejs.org/dist/`, currently pinned to `v24.19.0` |
| **Architecture** | Automatically matches `win-x64` or `win-arm64` |
| **Verification** | Downloads the official `SHASUMS256.txt` and compares SHA-256 byte for byte; on mismatch it re-downloads once, then aborts with an error |
| **Resume** | Uses HTTP `Range` requests, so an interrupted download continues where it stopped |
| **Extraction** | Extracts with the built-in Windows `tar.exe` into a staging directory, verifies completeness, then atomically renames into place |
| **Location** | `%APPDATA%\dsh-launcher\node-runtime\` |
> [!NOTE]
> Automatic runtime provisioning is **Windows only**. If Node.js is already installed, the launcher reuses it rather than downloading anything.
---
## Data and Configuration
The launcher **uses the official DSH profile structure directly**. It does not introduce a proprietary, incompatible plugin configuration format.
### File locations
| Content | Path |
| --- | --- |
| Launcher settings | `%APPDATA%\dsh-launcher\settings.json` |
| Local DSH runtime | `%APPDATA%\dsh-launcher\dsh-runtime\` |
| Portable Node.js runtime | `%APPDATA%\dsh-launcher\node-runtime\` |
| GitHub session (encrypted) | `%APPDATA%\dsh-launcher\github-auth.bin` |
| DSH credentials | `$DSH_HOME\.credentials.yaml` |
| DSH profile manifest | `$DSH_HOME\profiles\