soia-env-deepcode-cli-install

Install and verify lessweb/deepcode-cli(command deepcode, npm package @vegamo/deepcode-cli). It is a community open-source Agent CLI optimized for DeepSeek models, not HKUDS, Snyk, or any other DeepCode product with the same name.

Customer-readable description

What this skill can do

Customer wants	Skill will do	Customer can see
Install Deep Code	Verify project identity, Node.js 22, and npm, then install the upstream package	Version, source, installation and configuration directories
Check or update	Compare versions from official npm metadata; after explicit authorization, update along npm	Updatable status or "updated"
Configure DeepSeek	Check non-secret model and address settings, protect the API key	Configuration location and next steps for local security configuration
Command unavailable	Check PATH, npm global directory, and commands with the same name	Blocking cause and fix

How the customer uses it

Customer says "Install Deep Code CLI"; the Agent first confirms the target is lessweb/deepcode-cli, the customer does not need to operate the terminal.
The Agent performs a read-only check of deepcode, Node.js, npm, the actual package source, and version, then shows the plan.
An install request only authorizes installing a missing CLI; an existing version is not updated by default. A vague "update" only shows the version; only an explicit "update to latest" performs the update.
When running requires model credentials, the customer creates or manages the key themselves on the official DeepSeek platform; the key must not be sent into the chat. The Agent only guides protected local input or uses the customer's existing secure credential injection.
After completion, verify the version, help command, and one side-effect-free startup; when credentials are not configured, truthfully write "installed, awaiting local configuration" and do not falsely report that it runs normally.

First-time configuration and real verification

~/.deepcode is only the default data directory; you must check both the directory and ~/.deepcode/settings.json. The existence of the directory does not mean the API key has been configured.
The first launch of deepcode initializes some local runtime state, but does not generate for the customer a settings.jsoncontaining the API key; real acceptance has already verified that, without a key, the CLI will clearly prompt API key not found。
The customer logs in at DeepSeek API Keys and creates an API key. The customer fills it in only on the local machine and does not send the key to the Agent.
The customer creates on the local machine ~/.deepcode/settings.json, the minimal non-secret structure is as follows;API_KEY is replaced only on the customer's local machine:
```
{
  "env": {
    "MODEL": "deepseek-v4-pro",
    "BASE_URL": "https://api.deepseek.com",
    "API_KEY": "<仅在本机填写>"
  }
}
```
The Agent rechecks config_status、config_file_status, then starts deepcode for one side-effect-free verification; only if the actual request succeeds is the running status written as "normal."

Dependencies and installation

Dependency	Type	How to handle when missing
Node.js 22+ and npm	Hard dependency	Call `soia-env-node-install` to install a compatible stable version; do not force-install with an old Node
Network diagnostics	Optional prerequisite	When npm, GitHub, or the DeepSeek API is unreachable, call `soia-env-network-diagnose`
DeepSeek/compatible provider credentials	Runtime dependencies	Customer's local security configuration, not sent to chat or logs
HKUDS/DeepCode、Snyk DeepCode	Not a dependency	Same name but not the target of this skill, mixing is prohibited

For identity, package name and configuration facts see official-sources.md。

Standard procedure

Run python3 scripts/inspect_cli.py --json, read-only detection of deepcode, version, path, npm source,~/.deepcode directory and settings.json 's actual existence status.
Read the actual node --version and npm global package source; if Node.js is below 22, report the blocker first and do not run the installation package.
Run python3 scripts/check_latest.py --json, read from official npm metadata the @vegamo/deepcode-cli latest version.
If the command is provided by another package, write "Blocked: same-name command source mismatch", do not overwrite. If the upstream package is installed and working, write "Installed", do not update by default.
When not installed, the Agent runs npm install -g @vegamo/deepcode-cli; if the npm global directory requires administrator privileges, first provide a user-level alternative and confirm, do not default to sudo。
Only when explicitly updating to the latest, run npm install -g @vegamo/deepcode-cli@latest. Record the old version and npm prefix, do not switch to a Git repository development install.
Verify the --version、--help of the same absolute path and the npm package identity. When the customer requests installation/configuration or real testing and the configuration is missing, the Agent starts once deepcode to initialize the running state; if the CLI returns API key not found, stop at configuration guidance, do not falsely report success. When credentials are already securely configured, then do a side-effect-free startup; otherwise write the running state as "Unverified".
Recheck version and directory, use scripts/render_status.py to output one line of customer status.

Credential configuration boundaries

Upstream allows writing values in settings.json 's env.API_KEY , but a plain JSON file is not the preferred credential store; the skill must not write the key into public configuration, project files, logs or receipts on behalf of the customer.
Prefer the customer's existing local secure injection or protected user-level credential solution; if the product's capabilities force the use of a credential file, explain the risks first, restrict it to the user configuration directory and set it readable only by the current user.
The customer does not provide the key in chat. The Agent does not read the key content, only verifies the result category of "whether it exists/whether it can authenticate".
Project .deepcode/settings.json may enter Git; any key written into project configuration is rejected without exception.

Customer status list (mandatory)

The reply must start with the following ten-column table, outputting only one row Deep Code CLI：

Skill	Current status	Current version	Latest version	Running status	Installation method	Installation directory	Configuration file directory	Update time	Handling result
Deep Code CLI	<Installed/Not installed/Blocked>	<version or not obtained>	<version or not obtained>	<Normal/Abnormal/Unverified>	<npm global install/not obtained>	<directory or not obtained>	<directory or not obtained>		<Installed/Already latest/Updatable, not executed/Awaiting confirmation whether to update to latest/Updated/Awaiting local configuration/Blocked: reason>

When the user only asks about Deep Code CLI, do not add Node.js, npm, DeepSeek model, or other skill lines; Node.js is only compressed into the blocking case 处理结果。
更新时间 is generated after final verification; directories use ~ relative paths to avoid usernames.
When already updated, 当前状态 still writes "installed". When sources do not match, do not write "installed" based on the command name alone.
If obtaining the latest version fails, write "not obtained"; do not guess.
config_status=未创建 or config_file_status=未创建 , the result must state "waiting for first-time configuration" and provide the DeepSeek API Keys entry point and the local configuration file location; do not report only one default directory.

Intermediate states of installation and update

When actually installing or updating, generate a random run_id, and at each actual stage immediately call scripts/record_install_progress.py, displaying in sync the check, plan, waiting for confirmation, install/update, verification, and final state. Read-only checks do not create state.

Stage	Current status	Update time	Result
<check/plan/waiting for confirmation/install or update/verification/completed or failed>	<in progress/waiting/completed/failed/blocked>		<redacted result>

The update execution and verification stages must carry the customer's explicit authorization marker for the latest version. Records only store fixed result codes and times; they do not store npm output bodies, API keys, accounts, full command text, or private paths.

Permissions and rollback

Prefer a user-level npm prefix; do not default to using sudo. Modifying PATH/profile, overwriting a command with the same name, or system-wide installation requires prior confirmation.
Before updating, record the old version and package identity; on failure, keep the old installation and do not automatically uninstall, downgrade, or delete configuration.
Installation must not rewrite the project package.json or lockfile.

Private information and intermediate data

API keys remain in a customer-approved secure local location; SOIA configuration, audit state, and receipts do not store secrets.
Non-secret settings may remain in ~/.deepcode/settings.json; project configuration stores only committable non-secret settings.
Machine change stage records are written to user-private state; version checks are stateless by default.
Do not record tokens, keys, accounts, prompts, code content, response bodies, or customer-private absolute paths.
deepcode has no independent login command to replace OAuth; the key action for first-time configuration is for the customer to apply for a DeepSeek API key, fill in settings.jsonlocally, and then have the Agent re-verify.

Logs and completion receipt

The final receipt contains a fixed ten-column table, package identity, whether Node.js is satisfied, verification items, and whether the customer still needs to configure credentials locally. Normal dependencies are not expanded into extra rows.

Forward testing

Use a temporary fake deepcode to cover missing, normal, incorrect package source, and version anomalies; mock the latest npm version; verify the Node.js 22 gate, ten-column list, path redaction, no update by default, and the explicit authorization gate.

Install the entire domain (Claude Code and Codex share the same domain plugin):

claude plugin marketplace add soia-team/soia-open-skills
claude plugin install soia-env@soia

Install only this one skill:

npx skills add soia-team/soia-open-env-skills -g -a '*' -s soia-env-deepcode-cli-install -y

WorkBuddy 's loading unit is role-based experts rather than plugins,npx skills add -a '*' cannot cover it, so it needs to be installed separately; see docs/install/workbuddy.md。