DeepSeek Harness

DeepSeek Harness is an open-source AI agent harness developed by DeepSeek. Also called dsh, it supplies the software around a language model: the agent loop, tools, sessions, filesystems, permission controls, orchestration, and user interfaces. DeepSeek announced version 0.1 as a developer preview on August 13, 2026.^[1][2]

Harness is not a language model and does not include downloadable DeepSeek model weights. A working agent still needs access to a configured model endpoint. The project ships a DeepSeek adapter, but its Web configuration also supports other catalog providers and custom OpenAI-compatible endpoints.^[5] The Harness source is licensed under the MIT License; separately accessed models and services retain their own terms.^[16]

DeepSeek Harness is available in a worldwide public preview, including desktop downloads and the open-source Web launcher.^[31] The repository still warns of compatibility-breaking changes.^[2] Its October releases include v0.2.1-alpha.2, published on October 9, 2026 and labeled a prerelease.^[36]

Release and distribution

DeepSeek's launch post described Harness v0.1 as an opening of the codebase to agent-harness developers and summarized its design as making every major capability a replaceable plugin.^[1] The official repository provides source code, documentation, Web and headless profile templates, examples, and development tooling. It does not publish model weights as part of the Harness release.^[2]

Registry metadata provides more precise package versions than the product-level v0.1 name. At 19:37 UTC on August 21, 2026, npm's latest and next tags both pointed to @deepseek-ai/dsh 0.1.1-rc.2, published at 12:42:19 UTC. PyPI listed deepseek-harness-sdk 0.1.1rc1, uploaded at 07:16:01 UTC. The two registries therefore exposed different current artifacts, and both remained pre-releases.^[3][8]

The npm history after rc6 contains rc7 on August 17, rc8 on August 19, and two 0.1.1 candidates on August 21. PyPI advanced through 0.1.0rc7 to 0.1.1rc1 without publishing matching entries for every npm candidate. GitHub's formal prerelease entries began with rc7. Product version 0.1, npm package versions, PyPI package versions, and tagged source releases are related but distinct records.^{[3][8][19][21][22][23][24]}

The exact Node.js floor in the table belongs to the source-contributor workflow. The published npm metadata did not declare an engines field when checked, so the contributor floor should not be presented as a verified npm package constraint.^[3][4] Continuous integration covers Node.js 22.19, 24, and 26. A real DeepSeek-backed run also needs an API credential, while framework tests and some tutorials can run without one.^[4]

The current Python quickstart lists Linux x64 or arm64, macOS 14 or newer on arm64, and Windows x64. It requires Python 3.10 or newer, Git, a compatible API endpoint and credential, and isolated workspace and Harness-home directories. The SDK includes a matching runtime and does not need system Node.js for ordinary execution.^[38]

Desktop and October preview releases

DeepSeek announced the v0.2 desktop preview on September 30, 2026.^[32] Its October 2 announcement confirmed macOS and Windows desktop downloads and directed Linux users to the @deepseek-ai/dsh npm package.^[33]

The desktop release's bundled command manages plugins without a separate Node.js or pnpm installation.^[34] These are preview releases, not a declaration of stable compatibility.^[2][36]

Desktop application

The desktop interface combines conversations with a sidebar for inspecting generated files and code changes. DeepSeek describes support for document, spreadsheet, PDF and slide work alongside programming tasks. Results can be previewed and revised through follow-up instructions.^[31][32]

Its plugin manager accepts package names and exposes installation, disabling, removal and source information. In experimental Creator mode, the agent can build a plugin from a natural-language request and make it available in the running application. The desktop announcement describes those plugins as persistent after creation; this is an extension mechanism rather than evidence that generated plugins are safe.^[32][40]

The desktop carrier is an Electron application that includes its own production dsh runtime. It uses a reserved desktop profile and packaged Web assets. Desktop and the npm launcher share product data but maintain separate packages, activation state and lockfiles. The desktop host normally chooses an operating-system-assigned port, whereas the Web launcher's default remains 127.0.0.1:3080.^[9]

Interfaces

The Web launcher provides a local browser application. Running dsh web serves it at 127.0.0.1:3080 unless configured otherwise. The invoking directory is the default filesystem location, but a fresh Web UI has no active workspace until the user adds and selects one. Once configured, the agent can inspect and edit files, run commands, delegate work, and maintain a plan. The interface asks for approval when an operation exceeds the active permission policy.^[2][5]

Model setup is separate from starting the server. The Models settings page stores API keys in $DSH_HOME/.credentials.yaml and returns a redacted descriptor rather than the secret. It supports catalog providers and custom APIs using OpenAI Chat Completions, OpenAI Responses or Anthropic Messages. Provider changes apply to the next request without a server restart; manually entered models need explicit input-type declarations when they accept images. OAuth model-provider sign-in is not supported by this settings flow.^[39]

The deepseek-official adapter's 0.1.1-rc.2 catalog included DeepSeek-V4-Flash-Vision-Exp with text and image input; unlisted identifiers passed through as text-only routes in that release.^[25]

In rc2, that adapter preprocesses an image to the selected model's configured limits, normally uploads the derived bytes through the DeepSeek Files API, and can reuse a valid uploaded-file mapping. If file-id resolution fails, it rebuilds the request with inline base64 versions of the retained images. This path supports image input only; it does not support direct external image URLs or assistant image output.^[24][25]

The headless profile is a one-task alternative. The command dsh --profile headless "job" creates a persisted session, runs until the agent becomes idle, prints the final non-empty assistant response, and exits. It opens no HTTP server and has no interactive follow-up channel. Both Web and headless profiles initialize from shipped templates on first use. The current architecture also documents sdk, sdk-minimal and acp templates.^[4][9]

For programmatic use, the Python SDK starts a bundled Harness runtime and communicates with it over JSON-RPC through standard input and output. The DeepSeekHarness class can reuse that subprocess across calls, and a repeated session identifier continues the same durable session and persistent shell state. A source checkout also includes ACP and JSON-RPC demonstrations, but those are development or automation examples rather than additional default interactive profiles.^[4][7]

Plugin architecture

Harness is built on Cordis, a TypeScript meta-framework vendored into the repository. Cordis provides a shared context of named services. A plugin requests services such as tools, model access, or sessions by context key instead of importing a fixed implementation. Required services are declared through injection, typed events carry communication, and registrations are tracked so they can be reversed when a plugin unloads.^[9][10]

This design applies to product components, not just third-party extensions. The model adapter, tool registry, session log, agent loop, persistence, filesystem, sandbox policy, approvals, settings, credentials, telemetry, and Web surface are mounted as plugins. The architecture documentation says there is no privileged core that an extension must patch. Replacing a component is instead a configuration operation within the Cordis tree.^[9]

A running Harness is assembled from profiles and bundles:

• A bundle is an npm package that contributes a Cordis configuration patch.
• A profile is a runnable composition that lists bundles in order and stores user overrides.
• dsh-base is the shared first layer of the Web, headless, SDK and ACP profiles and provides the common agent, tool, persistence, model, permission, and settings components. The sdk-minimal profile instead supplies its own standalone tree.^[9]
• The Web and headless bundles add their respective interfaces.
• Profile, home-level, and command-line patch layers can replace earlier configuration rows by identifier.^[9][12]

The smallest extension is a TypeScript module exporting an apply function that receives the Cordis context. Object and service-class forms are also supported. Plugins can register tools, listeners, prompt sections, model adapters, providers, and other services. Context-managed registrations are cleaned up on unload, while arbitrary resources can supply an explicit disposer.^[10][12]

Packaged plugins declare a dsh.bundle manifest in package.json and point it at a patch file. The launcher manages out-of-tree dependencies through dsh plugin --profile, which forwards package operations to pnpm inside the selected profile. The official documentation suggests the dsh-plugin GitHub topic for discovery, but it does not describe a curated or security-reviewed marketplace.^[2][12]

One published third-party example is BrowserSkill, Tencent's MIT-licensed bridge that lets agents drive the user's own logged-in Chrome or Edge browser, whose repository carries the dsh-plugin topic. It ships a first-class dsh plugin on npm, @wxg-prc-cpg/browser-skill-dsh-plugin, installed with dsh plugin --profile web add @wxg-prc-cpg/browser-skill-dsh-plugin (substituting the profile name) and started with dsh --profile web. The plugin injects six native browser_* tools (browser_session, browser_page, browser_inspect, browser_interact, browser_tabs and browser_assist), runs the separately installed bsk command-line tool on the agent's behalf, and bundles the browser-skill skill so no separate skill installation is needed. Browser sessions appear as a live view in the Web UI, in a Browser Skill tab of the native right sidebar when that is available and otherwise in a floating panel. By default the tool schemas enter the system prompt only after the skill is invoked (lazyTools), concurrent sessions are capped at five, and the plugin only sees sessions it created, even when the bsk daemon is shared with other programs. Configuration lives in an id: browserskill entry of the profile's cordis.patch.yml. Installed plugins do not update automatically; the maintainers document dsh plugin --profile web update @wxg-prc-cpg/browser-skill-dsh-plugin --latest followed by a profile restart. The plugin's first npm version, 0.1.0, was published on August 17, 2026, four days after the Harness announcement; 0.2.1 was the npm latest tag on September 16, 2026, and from 0.2.0 the plugin shares one version number with the BrowserSkill CLI and extension.^[28][29][30]

Release candidates after rc6 also changed the product-subagent and terminal surfaces. Rc7 connected Codex and Claude Code subagent tasks to the Job Panel. Rc8 made those providers separate optional Profile Bundles, added non-interactive permission modes and named instances, and added persistent PowerShell sessions to Windows PTY terminals in the product's Minimal preset.^[21][22] The main launcher does not include either product-subagent package. An operator must add the selected bundle to a profile, restart that profile, and enable its otherwise dormant provider through a preset tool row. The Python tutorial's separate minimal composition now selects persistent Bash on Linux or macOS and PowerShell on Windows.^[38]

Experimental Claude Code Mods compatibility

Version v0.2.1-alpha.1 introduced an experimental Claude Code Mods compatibility layer. The release notes describe its purpose as testing whether the Mods API's capabilities fit within Harness's plugin system. They explicitly distinguish this experiment from complete, practical compatibility for users.^[35]

Cordis design basis

Cordis is accompanied by the draft paper A Programming Paradigm for Spatiotemporal Composability. It defines temporal composability as the ability to reverse a component's effects when it is removed, and spatial composability as declaratively managing dependencies as the surrounding context changes. Cordis implements those ideas through tracked effects, dependency resolution, a declarative loader, configuration reconciliation, and hot module replacement.^[11]

The project initially published an August 13, 2026 draft.^[11] An arXiv version followed on August 26, 2026, authored by Yifan Shi, Wei Zhang and Tianyi Cui.^[41] The paper is the design rationale for Cordis, not an independent evaluation of Harness's task performance. The separate Cordis repository also says its API is not yet stable and may change without notice.^[20]

Agent loop and session state

The default loop distinguishes a step from a turn. A step consists of one model request and the tool calls that follow it. A turn can contain several steps when a tool result or queued input requires another request. Plugins can observe or intercept model requests, tool execution, and turn transitions through typed events.^[9]

Durable session events record user messages, assistant output, tool calls and results, and turn boundaries. The model-visible history is derived from that log, as are resume, fork, transcript, telemetry, and persistence features. This event-stream design reduces the need for each interface to maintain a separate copy of agent state, but it does not guarantee that every optional persistence plugin has identical durability properties.^[9]

The current sdk-minimal example is narrower than the main Web composition. Its default model-facing tool is a persistent platform-selected shell, and it stores uncompressed JSONL sessions without compaction. The bundled str_replace_editor is opt-in rather than part of the default tree. These limits describe that minimal profile, not every Harness deployment.^[38]

The published SDK requires an explicit Harness home through dsh_home or a non-empty DSH_HOME in the child environment. It deliberately does not discover the user's default ~/.dsh directory. Reusing both a Harness instance and session identifier continues the durable conversation; an isolated home and new identifier separate independent work.^[8]

Automation tasks

The desktop preview introduced an Automation tasks surface for scheduled work.^[32] Version v0.2.1-alpha.1 made automation part of Web itself: reminder tools are available in Standard, Creator and PTC modes, but not Minimal mode or subagents. Existing tasks survive removal of the retired experimental-bundle selection.^[35]

Reminders can use a delay, an absolute time, fixed intervals, daily or weekly local-time rules, or cron expressions with an explicit time zone. The Automation tasks page exposes active and inactive tasks, rule editing and saved delivery records. Those records acknowledge a message saved to the conversation inbox, not successful completion of the requested work.^[37]

Scheduling depends on the Host process running. Restarting delivers an overdue one-shot reminder or the latest missed occurrence of a recurring task. A stopped Host does not continue executing reminders. The documentation does not guarantee exactly-once delivery, and reminders do not create a new session for each occurrence.^[37]

Permissions and sandboxing

The shipped base profile configures new sessions for workspace-write with an ask approval policy unless an operator overrides the permission mode through the environment. It also defines read-only with approvals and danger-full-access without approvals as selectable presets.^[14]

These modes describe filesystem effects only. The official sandbox specification explicitly excludes network access and process visibility from the policy vocabulary. A workspace-write session therefore should not be interpreted as a complete network or process-isolation boundary.^[13]

For confined shell commands, the local provider prefers Bubblewrap and then Landlock on Linux, uses Seatbelt on macOS, and uses an ACL restricted-token runner on Windows. If no intended backend is usable, the provider is designed to fail closed rather than silently execute without confinement. It reports enforcement as either full or partial. Older Landlock application binary interfaces and documented Windows ACL gaps are examples of partial enforcement, which callers needing an absolute boundary must not treat as full.^[13]

Version 0.1.1-rc.1 changed the Linux Bubblewrap profile by adding a private PID namespace before mounting a fresh /proc. The release notes describe the change as preventing confined processes from bypassing Bubblewrap restrictions through /proc//root.^[23][27] This is a fix to one runner, not a general network or process-isolation guarantee for every permission mode or backend.^[13]

Filesystem editing tools use a separate trusted-code containment check. Their documentation calls it a policy fence rather than a kernel boundary and acknowledges a narrowed but accepted race involving changes to ancestor symbolic links between checking and writing. Untrusted shell code is intended to pass through the process sandbox instead.^[15]

The Python tutorial's minimal composition is an exception to the Web default. It pins danger-full-access, so its platform-selected persistent shell can modify any path visible to the runtime. The tutorial recommends a disposable checkout or container. An explicitly enabled local editor also lacks workspace confinement in that composition.^[38]

Installing plugins creates another boundary. A plugin fetched from a Git host may run a prepare build script on the host if the user allowlists it in pnpm. That code executes at install time, outside the sandbox used for later agent commands. The official guide recommends reviewing the source and pinning a commit hash; publishing prebuilt artifacts avoids the build step but does not make an untrusted plugin safe.^[12]

Development status and limitations

The desktop preview does not remove the project's experimental status. The official safety notice says Harness has not undergone a security audit and must not be treated as secure or production-ready. Model-generated commands and untrusted plugins can damage files or disclose credentials. Sandboxing and approval controls reduce risk but do not guarantee isolation; the notice recommends least privilege, backups and disposable or dedicated environments.^[40]

The repository's benchmark file only explains how to run the Python minimal variant. It publishes no comparative Harness scores, so it does not support claims that dsh is faster, safer, or more capable than another agent system.^[17] Community reports and discussion comments may motivate tests, but they are not a substitute for controlled evaluations.

As of August 21, GitHub detected no SECURITY.md policy and listed no published security advisories for the repository.^[18] The absence of an advisory is not evidence that the code has no vulnerabilities. The project's explicit safety notice warns against using Harness as the sole security control for untrusted workloads.^[40]

These constraints make the developer preview most suitable for evaluation in controlled workspaces, with versions pinned, permission modes reviewed, and plugins treated as executable host code. They do not prevent production experimentation, but the official evidence does not justify describing the release as production stable.

References

1. ^1 ^2DeepSeek. *DeepSeek Harness v0.1 developer preview announcement*. August 13, 2026. x.com/...2087887408440164663
2. ^1 ^2 ^3 ^4 ^5 ^6DeepSeek. *DeepSeek Harness repository and README*. github.com/...deepseek-harness
3. ^1 ^2 ^3 ^4npm Registry. *@deepseek-ai/dsh package metadata*. Accessed August 21, 2026 at 19:37 UTC. registry.npmjs.org/%40deepseek-ai%2Fdsh
4. ^1 ^2 ^3 ^4DeepSeek. *Development guide*. github.com/...development.md
5. ^1 ^2DeepSeek. *Use the Web UI*. github.com/...guide
6. DeepSeek. *Configure models*. github.com/...providers.md
7. ^DeepSeek. *Get started with the Python SDK*. github.com/...python-sdk.md
8. ^1 ^2 ^3 ^4Python Package Index. *DeepSeek Harness Python SDK*. Accessed August 21, 2026 at 19:37 UTC. pypi.org/...deepseek-harness-sdk
9. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8DeepSeek. *DeepSeek Harness Architecture*. github.com/...architecture.md
10. ^1 ^2DeepSeek. *Cordis Primer*. github.com/...cordis-primer.md
11. ^1 ^2Cordiverse. *A Programming Paradigm for Spatiotemporal Composability*. Draft of August 13, 2026. github.com/...paper
12. ^1 ^2 ^3 ^4DeepSeek. *Package and install a plugin*. github.com/...publish.md
13. ^1 ^2 ^3DeepSeek. *Process Sandbox*. github.com/...sandbox.md
14. ^DeepSeek. *dsh-base profile configuration*. github.com/...cordis.patch.yml
15. ^DeepSeek. *The sandbox-enforcing filesystem backend*. github.com/...README.md
16. ^DeepSeek. *MIT License*. github.com/...LICENSE
17. ^DeepSeek. *Running benchmarks*. github.com/...BENCHMARK.md
18. ^GitHub. *Security overview for deepseek-ai/deepseek-harness*. Accessed August 21, 2026. github.com/...security
19. ^GitHub. *Releases for deepseek-ai/deepseek-harness*. Accessed August 21, 2026. github.com/...releases
20. ^Cordiverse. *Cordis repository*. Accessed August 14, 2026. github.com/...cordis
21. ^1 ^2DeepSeek. *DeepSeek Harness v0.1.0-rc.7 release notes*. August 17, 2026. github.com/...dsh-v0.1.0-rc.7
22. ^1 ^2DeepSeek. *DeepSeek Harness v0.1.0-rc.8 release notes*. August 19, 2026. github.com/...dsh-v0.1.0-rc.8
23. ^1 ^2DeepSeek. *DeepSeek Harness v0.1.1-rc.1 release notes*. August 21, 2026. github.com/...dsh-v0.1.1-rc.1
24. ^1 ^2 ^3DeepSeek. *DeepSeek Harness v0.1.1-rc.2 release notes*. August 21, 2026. github.com/...dsh-v0.1.1-rc.2
25. ^1 ^2DeepSeek. *DeepSeek model adapter reference at dsh-v0.1.1-rc.2*. github.com/...README.md
26. DeepSeek. *Command-line behavior reference at dsh-v0.1.1-rc.2*. github.com/...README.md
27. ^DeepSeek. *Bubblewrap profile source at dsh-v0.1.1-rc.1*. github.com/...profiles.ts
28. ^Tencent. *BrowserSkill for DeepSeek Harness (plugin README)*. Accessed September 16, 2026. github.com/...README.md
29. ^Tencent. *BrowserSkill repository README and CHANGELOG*. Accessed September 16, 2026. github.com/...BrowserSkill
30. ^npm Registry. *@wxg-prc-cpg/browser-skill-dsh-plugin package metadata*. Accessed September 16, 2026. registry.npmjs.org/...g%2Fbrowser-skill-dsh-plugin
31. ^1 ^2DeepSeek. *DeepSeek Harness public-preview product page*. Accessed October 13, 2026. deepseek.com/...harness
32. ^1 ^2 ^3 ^4DeepSeek Harness. *DeepSeek Harness for Desktop Is Here*. September 30, 2026. x.com/...2105330281389662575
33. ^DeepSeek. *Desktop public-preview announcement*. October 2, 2026. x.com/...2105915715241062644
34. ^1 ^2DeepSeek. *DeepSeek Harness v0.2.0-rc.2 release notes*. September 29, 2026. github.com/...dsh-v0.2.0-rc.2
35. ^1 ^2 ^3DeepSeek. *DeepSeek Harness v0.2.1-alpha.1 release notes*. October 3, 2026. github.com/...dsh-v0.2.1-alpha.1
36. ^1 ^2 ^3DeepSeek. *DeepSeek Harness v0.2.1-alpha.2 release notes*. October 9, 2026. github.com/...dsh-v0.2.1-alpha.2
37. ^1 ^2DeepSeek. *Schedule reminders*. Accessed October 13, 2026. deepseek-harness.github.io/...schedule
38. ^1 ^2 ^3 ^4DeepSeek. *Get started with the Python SDK*. Accessed October 13, 2026. deepseek-harness.github.io/...python-sdk
39. ^DeepSeek. *Configure models*. Accessed October 13, 2026. deepseek-harness.github.io/...providers
40. ^1 ^2 ^3DeepSeek. *Safety notice*. Accessed October 13, 2026. github.com/...SAFETY.md
41. ^Yifan Shi, Wei Zhang and Tianyi Cui. *A Programming Paradigm for Spatiotemporal Composability*. arXiv:2608.25512, submitted August 26, 2026. arxiv.org/...2608.25512