Source Install and Local Run

Upstream fact

The checked-out root package is 0.1.2-alpha.4, uses ESM, requires Node ^22.19.0 || >=24.0.0, and pins pnpm@11.7.0. The supported source launcher is pnpm dsh; production Web execution needs a separate completed build.

Loca decision

A source-preview run belongs in a disposable or dedicated environment. The public service never runs from the operator account or directly from /home/loca; it uses the isolated runtime described in Service and Updates.

Prerequisites

• A Node release accepted by the root engines.node constraint.
• pnpm 11.7.0, selected from the root packageManager field, with a pnpm shim available on PATH.
• The upstream checkout at /home/loca/dev/deepseek-harness.
• A test workspace containing no sensitive credentials or irreplaceable data.

Install and build

The build script launches bare pnpm for later phases, so wrapping only the first command as corepack pnpm ... is insufficient. Create a persistent operator-local Corepack shim directory and put it on PATH:

mkdir -p \"$HOME/.local/bin\"
corepack enable --install-directory \"$HOME/.local/bin\" pnpm
export PATH=\"$HOME/.local/bin:$PATH\"

Then run from the repository root:

cd /home/loca/dev/deepseek-harness
pnpm install --frozen-lockfile
pnpm run build

The root packageManager field selects pnpm 11.7.0. Keep the shim directory on PATH for every build phase.

pnpm run build prepares package and frontend artifacts. pnpm dsh consumes those artifacts; it does not rebuild them and does not check whether an existing frontend bundle is fresh.

Build again after switching revisions or whenever package or frontend artifacts may have changed.

Exact local Web launch

Stop deek.service before using this command on the deployment host; the local preview and service intentionally reserve the same port.

cd /home/loca/dev/deepseek-harness
pnpm dsh web --host 127.0.0.1 --port 52320 --no-open

Expected behavior:

• The process listens on http://127.0.0.1:52320 only.
• --no-open suppresses the default-browser handoff.
• The process prints a launch URL containing a per-process browser token. Treat that entire URL as a secret.
• --host 0.0.0.0 is intentionally unsupported upstream; do not try to bypass that refusal.
• The first Ctrl+C begins graceful shutdown. A second signal forces exit.

The local command does not need --trusted-host because the browser uses the canonical loopback authority. The public service adds only the exact public authority deek.loca.zone; it does not add a wildcard.

Open the browser safely

1. Use the launch URL only in a browser on the same trusted machine.
2. Allow the root request to exchange the query token for an HttpOnly, host-only, SameSite=Strict cookie.
3. Confirm that the browser removes the token from the URL after the exchange.
4. Never paste the URL into shell history, chat, tickets, documentation, screenshots, or shared logs.

The cookie is bound to the browser authority. A cookie created for 127.0.0.1:52320 is not the credential for deek.loca.zone.

Update a source checkout

After reviewing and selecting an upstream revision:

cd /home/loca/dev/deepseek-harness
pnpm install --frozen-lockfile
pnpm run build

Then exercise the exact local launch above in an isolated workspace. Do not point deek.service at the mutable checkout. Promotion into /opt/deek/app, state backup, restart, verification, and rollback belong to the service update procedure.

Continue

• Configure the first provider and create a session
• Understand the runtime boundary
• Inspect configuration and data paths