Connect DeepSeek Harness to WhatsApp: dsh-im tutorial

Quick start

If DSH is already installed, start at step 1. The end result is a message entering local DSH, a completed DSH task, and a reply returning to the same platform.

1. Install dsh-im.
2. Restart dsh web and open Settings → IM Bot.
3. Choose WhatsApp and complete QR or credential binding.
4. Send /status, then send a read-only task.

Step 1 — install dsh-im

Run this on the same computer where DSH is installed. The author recommends the published npm release.

dsh plugin --profile web add -w @xmanrui/dsh-im

After it finishes, restart the Web Profile:

dsh web

If the terminal cannot find dsh, prefix the command with npx @deepseek-ai/dsh. Do not use the GitHub-source install by default; use it only for unreleased code:

npx -y github:xmanrui/dsh-im install

Refresh the browser and open Settings → IM Bot. Full instructions: dsh-im README.

Step 2 — connect WhatsApp

WhatsApp uses dsh-im's WhatsApp Web linked-device flow. By default, only the account's self-chat triggers DSH.

1. Open DSH Settings → IM Bot → WhatsApp and display the QR code.
2. On the phone, open WhatsApp Settings → Linked devices → Link a device.
3. Scan the QR code on the DSH page and wait for the card to show online.
4. Keep self-only enabled and test in WhatsApp's Message yourself chat first.

This is a linked-device route, not the Meta WhatsApp Business Cloud API. Platform reference: WhatsApp linked devices.

Step 3 — send the first task

In WhatsApp's Message yourself chat, send these three messages in order. The first checks the connection, the second clears the old session, and the third runs a read-only task.

/status
/new
只读任务：列出当前工作区根目录的文件名，不要修改任何文件。

1. `/status` should return the connection status between the Bot and DSH.
2. The third message should receive a final reply and create a new Session in DSH Web.
3. Repeat once with an unauthorized account and confirm that it does not trigger a task.

WhatsApp troubleshooting

Security

• Tokens, App Secrets, QR sessions and the WhatsApp auth directory are credentials. Never commit or publish them.
• Start with a workspace that has no production secrets and keep access minimal. An IM message can trigger local files, commands and tools.
• dsh-im is a community plugin. Re-read its README and changelog before upgrades; it is not an official platform integration.
• WhatsApp Web/Baileys is not the Cloud API. Assess account and protocol risk before business-critical use.