How to Upgrade DeepSeek Harness Safely (rc.6 to 0.1.1-rc.1)

DeepSeek Harness (dsh) shipped three npm releases in five days — 0.1.0-rc.6, rc.7, rc.8, and 0.1.1-rc.1 — because it's still a developer preview, and each of those releases carries at least one compatibility break. The two that matter most: since rc.8, session data moved to a new SQLite storage format, and any plugin registering a keyed settings slot now needs an explicit options.key. This guide walks through what changed in each release, what to do before you run the upgrade, and a checklist to confirm nothing silently broke afterward.

Version timeline: what changed in each release

Version	Date	Headline changes
0.1.0-rc.6	2026-08-13	Previous known baseline (per npm registry timestamps)
0.1.0-rc.7	2026-08-17	Plugins can register their own settings cards; Codex/Claude Code subagent tasks wired into the Job Panel; MCP/ACP persistent image attachments; fixes for minimal-mode bash lockups, history pagination stack overflow, max-tokens truncation breaking sessions; node-pty bumped to 1.2 beta; "Code mode" renamed "PTC mode"
0.1.0-rc.8	2026-08-19	Multimodal input expanded (/goal//plan accept image+text, @ mentions can reference files and sessions); Claude Code/Codex subagents installable as Profile Bundles with non-interactive permission mode and multiple named instances; Windows PTY persistent PowerShell sessions; breaking: SQLite storage format changed, keyed settings slots now require options.key
0.1.1-rc.1	2026-08-21	DeepSeek-V4-Flash-Vision-Exp model adapter; Bubblewrap sandbox fix for a /proc/<pid>/root restriction bypass; Markdown table auto-fit, cache-hit-rate display precision; ask_user_question gains multiline input and Shift+Enter

That's roughly one release every two days. If you last touched dsh around rc.6, you're jumping three releases and both breaking changes at once — worth reading the next two sections before you run the install command.

Before you upgrade: two things to do first

1. Back up your session data. Community members upgrading rc.6 → rc.8 flagged that dsh's session storage moved to a new SQLite format starting with rc.8 (community-reported, Discussions #3691). Back up your entire $DSH_HOME directory (default ~/.dsh) before upgrading across that boundary — this is the same directory that holds your profiles, credentials, and session history, so a full copy is cheap insurance against a format migration going sideways.

2. Record your profile's current plugin list. Each profile's installed plugins live in $DSH_HOME/profiles/<name>/package.json, specifically the dsh.profile.bundles list plus that profile's npm dependencies. Copy that file (or just git diff it if your profile directory is version-controlled) before you upgrade, so you have a known-good reference to compare against if a plugin panel disappears or throws after the upgrade.

Breaking change deep dive: keyed slots now require options.key

Starting with rc.8, any plugin that registers a settings.plugin.item keyed slot — a settings UI element that needs a stable identity across renders, typically used for per-item configuration lists — must pass an explicit options.key. Slots that previously worked without one will now fail to render or throw at startup.

Two real plugins were named as affected in community reports: dsh-vision-router and dsh-smart-route. If you run either, check for an updated release before you upgrade dsh itself.

If you're a plugin user: after upgrading, open Settings → Plugins and look for any card that's blank, shows a console error, or is missing entirely compared to your pre-upgrade list from step 2 above. That's the signature of this break. Check the plugin's repo for a newer version; if none exists yet, either pin dsh to your previous rc until the plugin catches up, or file an issue pointing the author at this discussion thread.

If you're a plugin author: any settings.plugin.item slot in your plugin's registration needs an options.key added now, not later — rc.8 already shipped, and 0.1.1-rc.1 builds on top of it. This is a small, mechanical fix, but skipping it silently breaks your plugin's settings UI for every user on rc.8+.

Known upgrade pitfalls and fixes

Three install-time issues showed up repeatedly in community reports this week. None are official DeepSeek documentation — treat them as field-tested workarounds, not guaranteed fixes.

npm install runs out of memory on low-RAM machines. A community member upgrading rc.6 → rc.8 hit a V8 heap OOM during npm install (community-reported, Discussions #3691). Raising Node's heap ceiling worked around it:

NODE_OPTIONS=--max-old-space-size=6144 npx @deepseek-ai/dsh@0.1.1-rc.1 web

Native dependency build scripts get blocked. dsh pulls in native modules — node-pty, koffi, @deepseek-ai/dsh-subprocess-local — that run install-time build scripts. pnpm 10 blocks dependency lifecycle scripts by default as a supply-chain-attack mitigation, so those builds are silently skipped unless you approve them explicitly (per pnpm's own docs). If dsh install completes but native features (terminal PTY, folder picker, subprocess execution) don't work, run:

pnpm approve-builds

and approve the flagged packages. Community members hitting this after upgrading (Discussions #3691) attributed the friction to exactly this mechanism.

npx hangs resolving dependencies. A separate, unresolved report describes npx @deepseek-ai/dsh web hanging indefinitely — 100% CPU, zero network traffic, switching npm registries doesn't help (community-reported, Discussions #3786). A newer Reddit report of the same symptom, with the install log stuck fetching @deepseek-ai/dsh-client-modules, got one suggested workaround: swap the package runner.

bunx @deepseek-ai/dsh@0.1.1-rc.1 web

This is unverified beyond a single community reply — if npx hangs for you, it's worth trying before digging into registry configuration.

Why 0.1.1-rc.1 is worth the upgrade

Beyond the version bump itself, three changes in 0.1.1-rc.1 are worth calling out:

• A real sandbox fix. The release patches a Bubblewrap sandbox bypass where a restricted process could escape confinement through /proc/<pid>/root. If you run dsh with anything less than danger-full-access, this closes a gap in the isolation you were relying on — see our permissions and sandbox guide for how the sandbox modes fit together, and Security & Permissions plugins that add extra hardening on top.
• Native vision support. dsh's model adapter now speaks to DeepSeek-V4-Flash-Vision-Exp directly, replacing the earlier OCR-plus-pixel-analysis workaround some models used to fake image understanding. Browse Vision, Voice & Multimodal plugins if you're building on top of this.
• Cache-hit-rate display precision. A small UI fix, but a meaningful one if you're trying to reason about DeepSeek's KV-cache pricing behavior from the Web UI rather than the API directly.

Pinning versions vs. riding latest

dsh has no changelog page or formal migration guide — npm's dist-tags and the GitHub Releases page are the only source of truth for what changed and what's currently latest. Two practical postures:

• Pin a version if you're running dsh in CI, a demo, or anything where reproducibility matters more than the newest feature: npx @deepseek-ai/dsh@0.1.1-rc.1 web.
• Wait for the next rc if you depend on a plugin that hasn't published a keyed-slot fix yet, or if you just upgraded and want the current release to settle before moving again — given the roughly two-day release cadence this week, waiting a few days rarely costs you much.

Post-upgrade verification checklist

Run through this after any upgrade, but especially after crossing the rc.8 storage-format boundary:

[ ] dsh web boots and the Web UI loads without console errors
[ ] Settings → Models still shows your saved API key
[ ] Settings → Plugins lists every previously installed plugin, no blank/error cards
[ ] A pre-upgrade session opens and its message history renders correctly
[ ] A new task sends, and tool calls stream in as expected

If a plugin panel is missing, revisit the keyed-slot section above before assuming something else broke.

FAQ

Do I need to back up before every dsh update?

Not every one — but definitely across the rc.6 → rc.8 boundary, since that's the release where the session storage format itself changed (community-reported, Discussions #3691). Backing up $DSH_HOME is cheap enough that it's worth doing before any multi-version jump.

What actually breaks between rc.6 and 0.1.1-rc.1?

The one confirmed, named breaking change is the keyed-slot options.key requirement introduced in rc.8. dsh doesn't publish a formal migration guide beyond its release notes and GitHub Discussions, so treat anything else as a smaller fix or feature addition rather than a hard break.

Is DeepSeek Harness safe to run in production yet?

It's still explicitly a developer preview with compatibility-breaking changes between releases. For a fuller picture of open security concerns and what's been patched, see our security checklist and state of DeepSeek Harness security.

How do I check which version I actually have installed?

dsh has no --version-style changelog of its own; npm's registry is the source of truth. Run npm view @deepseek-ai/dsh dist-tags to see what latest currently points to, or pin an explicit version in your launch command if you need to know exactly what you're running.

Should I upgrade right now or wait for the next release?

If none of your installed plugins are affected by the keyed-slot change and you don't need the vision model or sandbox fix immediately, there's no urgency — dsh has shipped a new rc roughly every two days this week, so waiting rarely means waiting long.

Next steps

Once you're upgraded, walk through the permissions and sandbox model to confirm you're running the isolation level you expect, and check what developers are saying in dsh's first two weeks for broader context on where the project stands. Browse the full plugin catalog at /plugins if you're looking to replace a plugin that hasn't caught up with the keyed-slot change yet, or start from Security & Permissions if the sandbox fix in 0.1.1-rc.1 has you auditing your setup more broadly.