Yichen Jiang
9f996be8e3
Five findings from the #939 review, each reproduced before being fixed. **Configuration reads are as privileged as writes.** `settings.describe` returns every exposed namespace's configuration and `credentials.describe` reports whether an arbitrary environment-variable name is configured and from where — reconnaissance no anonymous caller should have. Both join PRIVILEGED_METHODS, so the whole configuration plane is loopback-only until real authentication exists; `trustedHosts` was never authentication. The model catalog stays reachable: it carries no endpoints or key state, and a LAN client's model picker legitimately needs it. Asserted over a real HTTP server, because the Host header a browser actually sends is what decides this. **The proxy serves only namespaces a registered model provider addresses.** The settings seam is general — any plugin may register one — but the Web configuration plane is the model-provider surface. Without the gate, every future `settings.register()` would silently become remotely readable and writable configuration. An unregistered namespace and an unexposed one answer identically, so no caller can enumerate the registry one probe at a time. **Path-addressed writes replace the redacted-document rebuild.** The editor reads the REDACTED descriptor, so rebuilding a section from it and replacing wholesale deleted every literal secret the wire never returned — reproduced as `{baseURL, reasoning}` in, stored `apiKey` gone out. `settings.mutate` applies set/unset ops to the section as it stands at the front of the seam's write queue, and the client names only fields it can see, so an unseen secret is untouched by construction rather than by care. P2s in the same pass: `llm/adapters-updated` now contains async listener rejections (an uncontained one escaped as unhandledRejection, contradicting the documented "observer failures are contained"); llm-deepseek's retry-policy swap uses the atomic `registration.replace` instead of dispose-then-register, which published `[]` then `["deepseek-official"]` so an observer saw the provider disappear and come back; and a transport rejection no longer strands the page in `loading` or a card in `busy`, with removal failures surfaced on the page banner instead of swallowed.
DeepSeek Harness
English | 中文
DeepSeek Harness (dsh) is an open-source coding agent built on the DeepSeek Harness SDK.
It uses an architecture where everything is a plugin.
Install
Install dsh with one command:
curl -fsSL https://raw.githubusercontent.com/deepseek-harness/deepseek-harness/master/scripts/install.sh | sh
The installer requires git and Node ^22.19 || >=24, offers to install pnpm when it is missing, and prompts for a DeepSeek API key.
The installer keeps every checkout under ~/.dsh/source: the master clone at ~/.dsh/source/master and each install's staging checkout as a git worktree ~/.dsh/source/staging-<timestamp>. The stable symlink ~/.dsh/source/current points at the active staging worktree, and dsh in ~/.local/bin links to current/bin/dsh, so an upgrade repoints one symlink and the dsh on PATH never moves. Re-running the command adds a fresh staging worktree from an updated master and repoints current at it. See scripts/install.sh for alternate install locations and other options.
Use DeepSeek Harness
Web UI
For the recommended local interface, build the frontend after installation and after each update, then start the Web UI. Resolve the running checkout from the dsh launcher so the command holds regardless of which staging worktree is current (the launcher resolves through the stable current symlink):
dsh_bin=$(cd "$(dirname "$(command -v dsh)")" && pwd -P)/$(basename "$(command -v dsh)")
while [ -L "$dsh_bin" ]; do
link=$(readlink "$dsh_bin")
case $link in /*) dsh_bin=$link ;; *) dsh_bin=$(cd "$(dirname "$dsh_bin")" && cd "$(dirname "$link")" && pwd -P)/$(basename "$link") ;; esac
done
dsh_dir=$(cd "$(dirname "$dsh_bin")/.." && pwd -P)
pnpm --dir "$dsh_dir" run build && pnpm --dir "$dsh_dir" run build:web
dsh web
The Web UI is served at http://127.0.0.1:3080 by default.
TUI
Start the full-screen terminal interface:
dsh
Headless
Run one task, print the final answer, and exit:
dsh -p "summarize this workspace"
Why DeepSeek Harness
Built-in capabilities cover file reading, editing, and search; shell execution; reusable skills; task tracking; subagents and workflows; persistent sessions; and context compaction. The TUI also includes Plan Mode.
- Everything is a plugin. Models, tools, policies, storage, context management, and interfaces are composable Cordis plugins, so deployments can extend or replace behavior without forking the agent loop. See the architecture for the underlying design.
- Code Mode (opt-in). It exposes a
run_codetool and a generated TypeScript SDK; only program output re-enters model context. See Code Mode. - Self-referential Cordis tools are opt-in. They let the agent inspect its live runtime and mount or unmount plugins while it runs. See the Cordis tools.
Community
Follow DeepSeek Harness on Twitter for project updates.
Development
pnpm install
pnpm run test:coverage
Start with the development guide and read the architecture before changing packages.
For agents, follow AGENTS.md.
DeepSeek Harness is currently pre-release.