Yichen Jiang
8c2970e70e
Review found five real defects in the configuration-source work, all confirmed against the code rather than argued: 1. The note claimed --config outranks settings.yaml. It does not: the settings seam registers a plugin's cordis entry config as the `base` layer and the user section layers over it, and the seam cannot tell a shipped value from a --config one. The note now states shipped reality and names --config-replace as the lever for a deployment that must win. Separately, a literal `apiKey` in settings outranked both the environment and .credentials.yaml — the field is removed, so configuration carries a reference and nothing else. 2. DEEPSEEK_SEARCH_BASE_URL was functionally deleted: the shipped inline went away without the provider learning to read it. It now resolves from the environment snapshot, as the README always claimed. 3. The bootstrap deny list missed the interpreter start-up hooks. BASH_ENV is the sharpest: `bash -c` sources it on every bash tool call, so a project .env could run a file of its choosing before every command. The list now covers BASH_ENV and its per-language siblings, the Git hook commands, and the remaining preload and CA variables, organised by what a variable does rather than which runtime owns it. 4. YAML parse errors quoted the offending source line — which in a credentials document is the secret — into boot stderr and the watcher's logger. Only the error code and position are reported now, in credentials-local and settings-local alike, pinned by a test that asserts the secret is absent. 5. 0600 governed only files the harness wrote. A hand-created 0644 document was read normally. POSIX now checks the mode before reading contents, at boot and on every reload; Windows has no mode to inspect and is skipped rather than faked. The project a session is launched in is trusted by default, with no prompt and no stored trust record: it may supply its own endpoint, ordinary variables, and a key ranked below the managed store. Trust stops at the harness itself — a discovered file still cannot set DSH_PERMISSION_MODE, PATH, BASH_ENV, or the rest, because those take effect with no user action, before any turn, outside the permission policy and the sandbox.
DeepSeek Harness
English | 中文
DeepSeek Harness (dsh) is an open-source coding agent built on the DeepSeek Harness SDK.
It uses an architecture where everything is a plugin.
Internal testing notice
感谢您愿意拨冗试用 DeepSeek Harness。当前版本仍处于内部测试阶段，功能仍待完善，体验难免有些粗糙。
“如切如磋，如琢如磨。” 产品的成长，离不开一次次真实的碰撞与坦诚的反馈。您在真实使用中发现的问题，也可能促使我们重新审视，甚至推翻已有的设计。
为了帮助我们更准确地还原您真实使用中的问题，内测版本默认会上传所有 Session Log；如需关闭，可以设置环境变量 DSH_TELEMETRY_DISABLED=1。另外，如果您有任何反馈与建议，请在企业微信群中留言告诉我们。每一条反馈，都会帮助我们把它打磨得更好。
Install
Clone the repository, then run the installer:
git clone <repo-url>
cd deepseek-harness
scripts/install.sh
The installer requires git and Node ^22.19 || >=24, offers to install pnpm when it is missing, prompts for a DeepSeek API key, then lets you launch the Web UI or TUI. Choosing Web UI builds the required repository artifacts first.
The installer keeps every checkout under ~/.dsh/source: the master clone at ~/.dsh/source/master and each install's staging checkout as a git worktree ~/.dsh/source/staging-<timestamp>. The stable symlink ~/.dsh/source/current points at the active staging worktree, and dsh in ~/.local/bin links to current/bin/dsh, so an upgrade repoints one symlink and the dsh on PATH never moves. Re-running the command adds a fresh staging worktree from an updated master and repoints current at it. See scripts/install.sh for alternate install locations and other options.
Use DeepSeek Harness
Web UI
For the recommended local interface, choose Web UI when the installer finishes. To start it later, or after updating the active checkout, build the repository and run:
(cd ~/.dsh/source/current && pnpm run build)
dsh web
The path above is the installer's default. If you set DSH_SOURCE or DSH_CURRENT, or reused an existing checkout, replace ~/.dsh/source/current with that checkout path; see scripts/install.sh for details. The Web UI is served at http://127.0.0.1:3080 by default.
TUI
Start the full-screen terminal interface:
dsh
Headless
Run one task, print the final answer, and exit:
dsh -p "summarize this workspace"
Automation and SDKs
From a source checkout with DEEPSEEK_API_KEY in the environment or its root .env, start the ACP automation server:
pnpm run demo:acp
The Python SDK drives a bundled JSON-RPC runtime. The examples cover the runnable headless, ACP, JSON-RPC, Code Mode, and self-referential compositions.
Why DeepSeek Harness
Built-in capabilities cover file reading, editing, and search; shell and persistent PTY execution; reusable skills; task tracking, goals, plans, todos, and background tasks; subagents and workflows; sandboxing and approvals; settings and credentials; persistent, resumable, forkable, and queryable sessions; LSP and web access; context compaction; and telemetry. Each composition selects the subset appropriate to its surface. The TUI and Web UI both include Plan Mode.
- Everything is a plugin. Models, tools, policies, storage, context management, and interfaces are composable Cordis plugins, so deployments can extend or replace behavior without forking the agent loop. See the architecture for the underlying design.
- Runs are reconstructable. Anything visible to the model is logged in the authoritative session stream; persistence, resume/fork/query, replay, telemetry, and UIs derive from the same events. See the session-log architecture.
- Code Mode (opt-in). It exposes a
run_codetool and a generated TypeScript SDK; only program output re-enters model context. See Code Mode. - Self-referential Cordis tools are opt-in. They let the agent inspect its live runtime and mount or unmount plugins while it runs. See the Cordis tools.
Community
Follow DeepSeek Harness on Twitter for project updates.
Development
pnpm install
pnpm run test:coverage
Start with the development guide and read the architecture before changing packages.
For agents, follow AGENTS.md.
DeepSeek Harness is currently in internal testing.
License
Third-party dependencies and their licenses are disclosed in THIRD_PARTY_NOTICES.md.