
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@ruihuahe/dsh-write-together
Advanced tools
Write Together is an author-led writing desk for DeepSeek Harness. It offers non-intrusive inline completion, reviewable story memory, a narrative timeline, and correctable style adaptation. AI suggestions never change a manuscript until the author explicitly accepts them.
Tab accepts it, Esc dismisses it, and continued typing cancels it.| Layer | Location | Authority and purpose |
|---|---|---|
| Manuscript | manuscript/*.md | The complete original prose and the only authority for current text. |
| Story canon | .write-together/project.sqlite | A compact, reviewable snapshot of currently effective facts. |
| Narrative graph | .write-together/project.sqlite | Source-linked entities, events, relations, and timeline changes; it preserves history instead of overwriting it. |
The same project database also records revisions, suggestions, reviews, style
profile versions, and task state. .write-together/search.sqlite is a derived
FTS5 index: it can be deleted and rebuilt without losing prose or settings.
pnpm install
portmux start
portmux supplies WRITE_TOGETHER_PORT and PORT. It is only a development
port allocator; the plugin always runs inside the official dsh web profile.
pnpm dev first builds the package, watches the static SPA output, links the
checkout into the dedicated profile, and launches the official DSH CLI. Vite
does not open a development server, so there is no second web listener.
For a bundle that has already been built, use pnpm dev -- --no-profile to
watch only the static bundle, or pnpm dev -- --skip-initial-build to avoid a
repeat full build. Host-code changes still require rebuilding and restarting
the official DSH profile.
The package ships a thin write-together CLI. It does not start a second web
server: it prepares a dedicated DSH profile, adds the in-box DSH web layer to
that profile, installs this exact plugin bundle, and then delegates the
long-lived process to the official dsh executable.
# After installing @ruihuahe/dsh-write-together globally or in a project:
write-together doctor
write-together start
# Keep the browser closed, choose an explicit port, or use a local tarball.
write-together start --no-open
write-together start --port 4318
write-together start --package ./ruihuahe-dsh-write-together-0.1.0.tgz
The port precedence is --port, then WRITE_TOGETHER_PORT, then PORT, then
0 (an operating-system-selected port). The write-together profile keeps
the official base and web bundles as profile layers; they are not fetched as
separate npm packages.
For checkout development, pnpm dev performs the same profile preparation and
uses the built local bundle. The lower-level node scripts/profile.mjs helper
remains available for development diagnostics, but the installed CLI is the
supported end-user entry point.
On Windows, you can also double-click start-write-together.cmd in the checkout
root. It checks for Node.js, builds the checkout once when lib/ is missing, and
then launches the checkout's CLI. Pass --no-open or --port 4318 when invoking
it from a terminal if needed.
Normal startup opens Write Together rather than the DSH root page. If the browser
temporarily remains on ordinary DSH, use the token-free /write-together/#/library
address printed by the terminal in that same tab.
For a local tarball, the launcher snapshots it by content hash under
DSH_HOME/write-together-artifacts/ before installation, so a repack using the
same version and filename cannot leave the profile on older bytes. Older
artifacts remain available for rollback.
--no-open prevents automatic browser launch but does not remove DSH's
one-time tokenized startup URL. Open the exact URL printed by dsh on the same
machine; DSH exchanges the token for a signed browser cookie and redirects to
a clean URL. Without --no-open, the CLI redirects that authenticated launch
to /write-together/bootstrap and opens the writing desk automatically.
Treat the startup URL as a credential: do not copy it into source control, issue reports, screenshots, or logs. The helper never reads, parses, stores, or rewrites this token.
Write Together stores the manuscript and its project data in the selected DSH workspace. It does not add cloud sync, a vector database, or model fine-tuning in v1. A configured model receives only the context assembled for the active completion, manually requested direction, or saved-text analysis; sources are kept with that context so the author can review the basis. Completion can be disabled, style learning can be paused or reset, and every AI result remains a suggestion until explicitly accepted.
The one-time DSH startup URL is a credential. Do not include it in source control, bug reports, screenshots, or logs.
Before an upgrade, copy both manuscript/ and .write-together/ from every
novel you care about. Run write-together start --package <new-package-or-tarball>
to install a new bundle into the dedicated profile, then restart DSH. Keep the
backup if a schema migration is involved; restoring the backup plus the
previous plugin tarball is the safe rollback path.
To remove the plugin from a profile, use the official profile command:
dsh plugin --profile write-together remove @ruihuahe/dsh-write-together
Removing a plugin or profile does not delete the novel directory. To recover,
restore the copied manuscript/ and .write-together/ folders, re-add the
plugin, and reopen the workspace. If only search.sqlite is damaged or absent,
use the in-app index rebuild; do not replace the manuscript to repair search.
pnpm run typecheck
pnpm test
pnpm run build
pnpm run pack:check
node scripts/dsh-test-smoke.mjs
node scripts/dsh-loader-smoke.mjs --package dist/ruihuahe-dsh-write-together-0.1.0.tgz --evidence .write-together-evidence/loader
dsh-test-smoke.mjs validates the external CLI, the versioned workflow
fixture, and a temporary control-plane run. Its JSON output explicitly says
control-plane-only: it is not evidence that Cordis loaded the plugin or that
the browser surface passed.
dsh-loader-smoke.mjs is the complementary real-host gate. It creates a
fresh temporary DSH_HOME, installs only the supplied tarball into a generated
profile, boots the actual DSH Cordis Loader, exchanges the launch credential
only in memory, and verifies the official root plus the authenticated
/write-together/ SPA route. It deletes the isolated home on completion. Its
JSON evidence never contains the token. Add --browser when the local DSH Web
checkout has Playwright available to collect a full-page screenshot, ARIA
snapshot, browser console, and failed-network receipt:
node scripts/dsh-loader-smoke.mjs --package dist/ruihuahe-dsh-write-together-0.1.0.tgz \
--browser --playwright-root E:/_workSpace/_Agents/deepseek-harness/apps/web \
--evidence .write-together-evidence/browser
The browser option is deliberately opt-in: production package dependencies do
not include Playwright. A missing local browser runtime fails loudly instead of
mislabeling a Loader-only run as browser-verified. The acceptance sequence and
remaining model-backed editor cases are tracked in
tests/dsh-integration-plan.md.
Each novel keeps authoritative Markdown under manuscript/. Structured state
lives in .write-together/project.sqlite; .write-together/search.sqlite is a
rebuildable search index.
FAQs
Author-led inline writing companion for DeepSeek Harness
The npm package @ruihuahe/dsh-write-together receives a total of 3 weekly downloads. As such, @ruihuahe/dsh-write-together popularity was classified as not popular.
We found that @ruihuahe/dsh-write-together demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.