<!-- Generated by scripts/gen-cli-help.ts — do not edit by hand.
     Run `pnpm run gen-cli-help` to regenerate. -->

# dsh CLI help

This reference contains complete help for the launcher, subcommands, and shipped profiles. Identical help appears once with every invocation listed. Help output retains its original language.

Run `pnpm run gen-cli-help` to regenerate; run `pnpm run verify-cli-help` to check freshness.

## Contents

- [`dsh`](#dsh)
- [`dsh plugin`](#dsh-plugin)
- [`dsh acp`](#dsh-acp)
- [`dsh headless`](#dsh-headless)
- [`dsh sdk`](#dsh-sdk)
- [`dsh sdk-minimal`](#dsh-sdk-minimal)
- [`dsh web`](#dsh-web)

<a id="dsh"></a>
## `dsh`

Invocations: `dsh --help`

```text
Usage: dsh [--profile] <name> [options] [app-args...]
       dsh plugin --profile <name> <pnpm-args...>

dsh: boot a DeepSeek Harness profile — an ordered stack of plugin-bundle patch
layers under your own overrides.

Arguments:
  args                           arguments for the booted profile's app (see:
                                 dsh --profile <name> --help)

Options:
  -V, --version                  output the version number
  --profile <name>               the profile under $DSH_HOME/profiles to boot
  --from-default-profile <name>  replace a custom profile with a fresh copy of a
                                 shipped profile template
  --patch <path>                 extra patch-list overlay applied after the
                                 profile layer (repeatable)
  --dump-config                  print the composed profile tree and exit
  --dump-config-schema           print JSON Schema for profile entries and
                                 patches without mounting
  --dump-default-config          print the profile tree without its user layer
                                 or --patch overlays and exit

Examples:
  dsh web                                   boot the web profile (same as: dsh --profile web)
  dsh rescue --from-default-profile web
                                            recreate rescue from the shipped web template, then boot it
  dsh headless "run the tests"              answer one task, print the result, and exit
  dsh tui --patch ./extra.yml               boot a custom profile with one extra overlay
  dsh tui --resume <session>                arguments after the launcher flags reach the app
  dsh web --help                            the web app's own flags and help
  dsh plugin --profile tui add <package>    install a plugin into the tui profile

```

<a id="dsh-plugin"></a>
## `dsh plugin`

Invocations: `dsh plugin --help`

```text
Usage: dsh plugin [options] [args...]

manage a profile's plugins by forwarding the remaining arguments to pnpm in the
profile directory

Arguments:
  args              pnpm arguments, forwarded verbatim (add <pkg>, remove <pkg>,
                    why <pkg>, ...)

Options:
  --profile <name>  the profile whose plugins to manage (initialized on first
                    use)
  -h, --help        show this help
```

<a id="dsh-acp"></a>
## `dsh acp`

Invocations: `dsh acp --help`, `dsh --profile acp --help`

```text
Usage: dsh --profile acp [options]

Serve automation clients over Agent Client Protocol stdio.

Options:
  -h, --help  show this help

Example:
  dsh --profile acp     serve ACP until the client disconnects

```

<a id="dsh-headless"></a>
## `dsh headless`

Invocations: `dsh headless --help`, `dsh --profile headless --help`

```text
Usage: dsh --profile headless [options] [task...]

Answer one task and exit; the answer goes to stdout and diagnostics to stderr.

Arguments:
  task                        the task text; multiple words are joined by
                              spaces, and `-` reads stdin

Options:
  --json                      write newline-delimited run events to stdout
                              instead of the final message
  --session-id <id>           adopt the persisted Session with this id; an
                              unknown id is an error
  --permission-mode <preset>  select a configured permission preset for this
                              task, including on resume
  --approval-policy <policy>  set approval behavior after selecting the
                              permission preset (choices: "ask", "never")
  --add-dir <path>            allow an additional physical absolute directory
                              under workspace-write (repeatable)
  -h, --help                  show this help

Examples:
  dsh --profile headless "run the tests"          answer one task and exit
  echo "run the tests" | dsh --profile headless   read the task from stdin
  dsh --profile headless --json "run the tests"   emit machine-readable run events
  dsh --profile headless --session-id session-… "continue"   resume an existing Session
  dsh --profile headless --permission-mode workspace-write --add-dir /repo/.git "commit the fix"
                                                        grant shared Git metadata for this task

```

<a id="dsh-sdk"></a>
## `dsh sdk`

Invocations: `dsh sdk --help`, `dsh --profile sdk --help`

```text
Usage: dsh --profile sdk [options]

Serve DeepSeek Harness SDK clients over stdio JSON-RPC.

Options:
  -h, --help  show this help

Example:
  dsh --profile sdk     serve one SDK runtime until its client disconnects

```

<a id="dsh-sdk-minimal"></a>
## `dsh sdk-minimal`

Invocations: `dsh sdk-minimal --help`, `dsh --profile sdk-minimal --help`

```text
Usage: dsh --profile sdk-minimal [options]

Serve DeepSeek Harness SDK clients over stdio JSON-RPC.

Options:
  -h, --help  show this help

Example:
  dsh --profile sdk-minimal     serve one SDK runtime until its client disconnects

```

<a id="dsh-web"></a>
## `dsh web`

Invocations: `dsh web --help`, `dsh --profile web --help`

```text
Usage: dsh --profile web [options]

Serve the DeepSeek Harness browser UI.

Options:
  --host <host>                  bind address: one concrete IPv4 or IPv6 literal
                                 of a local interface; wildcard addresses are
                                 rejected
  --no-open                      do not open the Web UI in the default browser
  --port <port>                  listen port; pass 0 to let the OS pick a free
                                 one
  --public-url <url>             advertise this HTTP(S) root in the printed,
                                 opened, runtime-context, and DSH_WEB_URL forms;
                                 grants no trust
  --trusted-host <authority...>  extra authority the /api browser-trust fence
                                 accepts (host or host:port; repeatable)
  --tls-cert <file>              PEM server certificate chain; requires
                                 --tls-key
  --tls-key <file>               unencrypted PEM private key; requires
                                 --tls-cert
  -h, --help                     show this help

Examples:
  dsh --profile web                          serve on the composed host and port
  dsh --profile web --no-open                serve without opening a browser
  dsh --profile web --port 8080              serve on another port
  dsh --profile web --host 10.0.0.7          bind one local interface address
  dsh --profile web --public-url https://app.example/ui/ --trusted-host app.example
                                             advertise a prefix-stripping HTTPS proxy entry and admit its authority
  dsh --profile web --tls-cert ./server-chain.pem --tls-key ./server-key.pem
                                             serve HTTPS with an existing certificate and key

```