deepseek-ai/deepseek-harness
DeepSeek Harness: Everything is a Plugin.
How deepseek-harness is put together
deepseek-harness ('dsh') is a large pnpm-workspace monorepo implementing an AI agent harness: a Node.js/TypeScript CLI (apps/cli, bin 'dsh') that boots agent profiles, plugins, tools, sessions, and a browser UI, plus a React/Vite web frontend (apps/web) whose dist is served by the CLI's 'dsh web' command. The runtime is composed almost entirely from first-party '@deepseek-ai/dsh-*' and '@deepseek-ai/cordis-*' workspace packages organized by domain (agent loop, LLM adapters, tools, shell/sandbox, session persistence, MCP/ACP clients, subagents, workflows). A native Landlock-based confinement runner (native/landlock-run) provides Linux sandboxing alongside Windows ACL sandbox packages, and python/sdk-runtime defines a deployable dependency closure for a Python-facing JSON-RPC SDK runtime. Data flows from user commands through the cordis plugin loader into the agent loop, which invokes tool packages (bash/pwsh/fs/web/subagents), persists sessions as JSONL or SQLite, and talks to LLM providers (DeepSeek, pi-ai) or a mock server.
Languages
Frameworks
Datastores
Infrastructure
Major components
CLI application (apps/cli, @deepseek-ai/dsh)
Entry binary providing profile boot, plugin management, command surface (compact/goal/plan-mode/persona/skills/jobs), and the 'dsh web' alias serving the built frontend.
Web frontend (apps/web, @deepseek-ai/dsh-web-frontend)
Vite-built React client shell over @deepseek-ai/dsh-client-web libraries, producing dist/ consumed by the CLI's web server.
Sandboxing layer
native/landlock-run (Linux Landlock confinement runner shipped as prebuilt native addon) plus packages for sandbox policy, fs-sandbox, bash-sandbox, pwsh-sandbox, and Windows ACL enforcement.
Shell & subprocess execution
Packages for local bash/pwsh terminals (persistent shells), subprocess spawning/inspection, and shell environment resolution.
Agent core & LLM adapters
Agent loop/spine, system prompts, token metering, compaction, retry, and provider adapters (dsh-llm-deepseek, dsh-llm-pi-ai) plus an LLM mock server for keyless tests.
Tool suite
Model-invocable tools: bash/pwsh (incl. persistent variants), file edit/search, str-replace-editor, web fetch/search (DeepSeek/Exa/Perplexity), subagents, todo, jobs, skills, workflow, ask-user.
Session & persistence
Session state, projection/query, checkpoint policy, and durable storage backends (JSONL and SQLite persistence plus spill/attachment handling).
Integration protocols & plugin system
MCP client, ACP (Agent Client Protocol) subagents, JSON-RPC SDK server, hooks (Claude Code/Codex compatible), and the cordis plugin loader/HMR/include/timer plugins.
A large week (393 commits) centered on unifying the image handling pipeline, shipping release candidate 0.1.1-rc.2, and cleaning up image-related tests and docs.
3 weeksWeek of 2026-08-17
Week of 2026-08-17latest
A large week (393 commits) centered on unifying the image handling pipeline, shipping release candidate 0.1.1-rc.2, and cleaning up image-related tests and docs.
Week of 2026-08-10
A focused week adding provider sign-in with durable credentials and making the Web UI open automatically by default.
Week of 2026-08-03
A quiet week with a single security-minded fix isolating processes inside the sandbox.
The last few weeks show a heavy push on how images and attachments flow through the system, culminating in a unified image request pipeline, a canonical image storage format, and two release candidates (0.1.1-rc.1 and rc.2). Alongside that, the team added human-in-the-loop sign-in for AI providers with durable credential storage, made the Web UI open by default, and shipped small reliability fixes like sandbox isolation and timeout decoupling.
Week by week
2026-08-17A large week (393 commits) centered on unifying the image handling pipeline, shipping release candidate 0.1.1-rc.2, and cleaning up image-related tests and docs.latest6 changes
Feature
Unified image request pipeline
Master and Files-based image requests now go through one shared pipeline instead of separate code paths.
Feature
Canonical image storage
Saved images are stored in one deterministic canonical encoding so behavior is consistent across runs.
Feature
read_image reports scaling info
The read_image tool now tells you the downscaled dimensions and coordinate scale when images are resized.
Fix
Decoupled files and stream timeouts
File operations and streaming responses now have independent timeouts so one slow path doesn't break the other.
Fix
Fallback when Files resolution fails
If the DeepSeek Files API can't resolve an attachment, the system falls back gracefully instead of failing outright.
Chore
Release 0.1.1-rc.2
Cut the second release candidate of version 0.1.1 after stabilizing tests and reverting a problematic permission change.
2026-08-10A focused week adding provider sign-in with durable credentials and making the Web UI open automatically by default.6 changes
Feature
Sign in to AI providers
Users can now actively sign in to a provider rather than having it silently withheld.
Feature
Human-assisted credential flow
When a credential is needed, the system asks the human to provide it through a guided authorization flow.
Feature
Durable credential records
Credentials are stored as lasting records alongside references so they survive restarts.
Docs
Authorization decisions documented
Design decisions about credential records and the sign-in flow were written down for future reference.
Feature
Web UI opens by default
Both the web and command-line interfaces now launch the ready Web UI automatically.
Chore
Writer-lock wait limit
Atomic file writes now state an explicit per-call limit on how long they'll wait for a lock.
2026-08-03A quiet week with a single security-minded fix isolating processes inside the sandbox.1 change
Fix
Sandbox PID namespace isolation
Bubblewrap sandboxes now isolate process IDs so programs inside the sandbox can't see or affect processes outside it.
Dependencies and code review
Dependency advisories
Security Watch
1 vulnerable package (2 advisories) across 35 scanned dependencies.
js-yaml 4.2.0
2 advisories. Fixed in 3.15.0.
How it can be abusedAnyone who runs dsh on a YAML file they did not write themselves, such as an agent profile or plugin manifest downloaded from a repo or shared by someone else, can be hit. A maliciously crafted file makes the parser spin through merge keys or omap entries so the CLI hangs and burns CPU until killed, freezing whatever session was starting.
- highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
- highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required