# DeepSeek Harness

> Source: https://aiwiki.ai/wiki/deepseek_harness
> Updated: 2026-11-04
> Fact-checked: 2026-10-18
> Categories: AI Agents, Chinese AI, Developer Tools, Open Source AI
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) - attribute to "AI Wiki (aiwiki.ai)"
> Cite as: AI Wiki. "DeepSeek Harness." aiwiki.ai, 4 Nov 2026. https://aiwiki.ai/wiki/deepseek_harness
> From AI Wiki (https://aiwiki.ai), the free encyclopedia of artificial intelligence. Reuse freely with attribution.

**DeepSeek Harness** is an open-source [AI agent](https://aiwiki.ai/wiki/ai_agents) [harness](https://aiwiki.ai/wiki/harness) developed by [DeepSeek](https://aiwiki.ai/wiki/deepseek). Also called **dsh**, it supplies the software around a [language model](https://aiwiki.ai/wiki/language_model): the agent loop, tools, sessions, filesystems, permission controls, orchestration, and user interfaces. DeepSeek announced version 0.1 as a developer preview on August 13, 2026.[1][2]

<figure class="w-56">
<img src="/images/wd-2026-10-28-deepseek-logo-68446eb379e3-tile.png" alt="DeepSeek logo" width="480" height="154" />
<figcaption>DeepSeek logo. DeepSeek, via <a href="https://commons.wikimedia.org/wiki/File:DeepSeek_logo.svg">Wikimedia Commons</a>, <a href="http://opensource.org/licenses/mit-license.php">MIT</a>.</figcaption>
</figure>

Harness is not a language model and does not include downloadable DeepSeek model weights. A working agent still needs access to a configured model endpoint. The project ships a DeepSeek adapter, but its Web configuration also supports other catalog providers and custom OpenAI-compatible endpoints.[5] The Harness source is licensed under the [MIT License](https://aiwiki.ai/wiki/mit_license); separately accessed models and services retain their own terms.[16]

DeepSeek Harness is available in a worldwide public preview, including desktop downloads and the open-source Web launcher.[31] The repository still warns of compatibility-breaking changes.[2] Version **v0.2.1-rc.2**, published on October 17, 2026, added support for [DeepSeek-V4.1-Flash](https://aiwiki.ai/wiki/deepseek_v4_1_flash)-1017, a model update that DeepSeek says was optimized for Harness.[43][46][48] The **v0.2.2-rc.1** prerelease followed on November 4, 2026, adding interface and plugin-management improvements and raising the minimum supported Node.js version to 24.9.[64]

## Release and distribution

DeepSeek's launch post described Harness v0.1 as an opening of the codebase to agent-harness developers and summarized its design as making every major capability a replaceable plugin.[1] The official repository provides source code, documentation, Web and headless profile templates, examples, and development tooling. It does not publish model weights as part of the Harness release.[2]

Registry metadata provides more precise package versions than the product-level v0.1 name. At 19:37 UTC on August 21, 2026, npm's **latest** and **next** tags both pointed to **@deepseek-ai/dsh 0.1.1-rc.2**, published at 12:42:19 UTC. PyPI listed **deepseek-harness-sdk 0.1.1rc1**, uploaded at 07:16:01 UTC. The two registries therefore exposed different current artifacts, and both remained pre-releases.[3][8]

| Distribution record on August 21, 2026 | Candidate at that date | Publication record |
|---|---|---|
| npm **@deepseek-ai/dsh** | **0.1.1-rc.2** | August 21 at 12:42:19 UTC [3] |
| PyPI **deepseek-harness-sdk** | **0.1.1rc1** | August 21 at 07:16:01 UTC [8] |
| [GitHub](https://aiwiki.ai/wiki/github) source tag | **dsh-v0.1.1-rc.2** at commit **b150a551** | August 21 at 12:35:08 UTC [24] |

The npm history after rc6 contains rc7 on August 17, rc8 on August 19, and two 0.1.1 candidates on August 21. PyPI advanced through 0.1.0rc7 to 0.1.1rc1 without publishing matching entries for every npm candidate. [GitHub](https://aiwiki.ai/wiki/github)'s formal prerelease entries began with rc7. Product version 0.1, npm package versions, PyPI package versions, and tagged source releases are related but distinct records.[3][8][19][21][22][23][24]

| Installation path | Documented command or package | Runtime requirements |
|---|---|---|
| Published Web launcher | npx @deepseek-ai/dsh web | Node.js 24.9+ in the v0.2.2-rc.1 package metadata [70] |
| Source checkout | pnpm install, pnpm run build, pnpm dsh web | Node.js 24.9+, Corepack pnpm 11.28.5, Git 2.26+ [65] |
| Python SDK | python -m pip install deepseek-harness-sdk | Python 3.10+ and a supported bundled runtime platform |

The v0.2.2-rc.1 contributor guide and CLI package metadata both require Node.js 24.9 or newer. Continuous integration covers 24.9, the latest Node.js 24 release, and Node.js 26. The source build also requires Node.js TypeScript type stripping. A real DeepSeek-backed run needs an API credential, while framework tests and some tutorials can run without one.[65][70]

The current [Python](https://aiwiki.ai/wiki/python) quickstart lists Linux x64 or arm64, macOS 14 or newer on arm64, and Windows x64. It requires Python 3.10 or newer, Git, a compatible API endpoint and credential, and isolated workspace and Harness-home directories. The SDK includes a matching runtime and does not need system Node.js for ordinary execution.[38]

### September 0.1.x releases

GitHub lists further prereleases in the 0.1.2, 0.1.3, 0.1.5, 0.1.6 and 0.1.7 lines between August 27 and September 24, 2026; it has no 0.1.4 tag.[19] Selected candidates:

| Release | Date | Selected documented changes |
|---|---|---|
| v0.1.5-rc.1 | September 10, 2026 | DeepSeek adapter adds **DeepSeek-V41-Flash** (**deepseek-flash**) with text and image input, used by default for new sessions unless a configuration names another model; uploads of arbitrary file types; a tabbed right sidebar with Markdown, code, HTML, PDF and image previews [51] |
| v0.1.7-rc.1 | September 23, 2026 | Web sidebar terminals; [Model Context Protocol](https://aiwiki.ai/wiki/model_context_protocol) resource discovery; headless input from standard input, **--session-id** resume and **--json** event output; remote workspaces over SSH; experimental [computer use](https://aiwiki.ai/wiki/computer_use) and Auto review mode; Word, Excel, PowerPoint, CSV and TSV previews [52] |

The 0.1.5-rc.1 model change coincided with DeepSeek's September 10 release of DeepSeek-V4.1-Flash on its API under the **deepseek-flash** model name.[50][51]

### Desktop and October preview releases

DeepSeek announced the **v0.2 desktop preview** on September 30, 2026.[32] Its October 2 announcement confirmed macOS and Windows desktop downloads and directed Linux users to the **@deepseek-ai/dsh** npm package.[33]

| Release | Date | Selected documented changes |
|---|---|---|
| v0.2.0-rc.1 | September 28, 2026 | Automation tasks moved into an optional plugin bundle; DeepSeek account models can search the web without an additional API key; a Windows sandbox permission-diagnosis skill [53] |
| v0.2.0-rc.2 | September 29, 2026 | Bundled dsh command for macOS and Windows Desktop; installation through the Manage dsh command menu item [34] |
| v0.2.1-alpha.1 | October 3, 2026 | Experimental Claude Code Mods compatibility layer, plugin-creation entry, built-in Web automation tasks, and optional Developer Tools bundle [35] |
| v0.2.1-alpha.2 | October 9, 2026 | Experimental Git Worktrees and reasoning-translation plugins, working-directory tools and SDK APIs, and on-demand installation of Claude Code and Codex bundles [36] |
| v0.2.1-alpha.3 | October 14, 2026 | DeepSeek account sign-in when Web is reached over local HTTP; masking of keys and tokens detected in sent messages; image reading and automatic compaction in Minimal mode, plus a manual **/compact** command [54] |
| v0.2.1-alpha.4 | October 15, 2026 | Per-model reasoning levels for custom API models in the UI; plugin discovery from custom plugin index sources; **engines.dsh** used first for third-party plugin compatibility [55] |
| v0.2.1-alpha.5 | October 16, 2026 | Bug fixes, plus a slot that lets plugins relabel models in the composer's model selector [56] |
| v0.2.1-rc.1 | October 17, 2026 | First candidate of the 0.2.1 series, summarizing changes since v0.2.0-rc.2; also SSH helper runtimes, a **--public-url** option, native HTTPS through **--tls-cert** and **--tls-key**, and a general-purpose default SDK persona [42] |
| v0.2.1-rc.2 | October 17, 2026 | Support for DeepSeek-V4.1-Flash-1017; optional use of the DeepSeek Search and Fetch APIs from Web Search settings [43] |

The desktop release's bundled command manages plugins without a separate Node.js or pnpm installation.[34] These are preview releases, not a declaration of stable compatibility.[2][36]

Registry tags lag and diverge from the GitHub list. When checked on October 18, 2026, npm's **latest** tag for **@deepseek-ai/dsh** still pointed to **0.2.0-rc.2**, while **next** pointed to **0.2.1-rc.2** (published at 08:36:31 UTC on October 17) and **alpha** to **0.2.1-alpha.5**. PyPI's newest **deepseek-harness-sdk** upload was **0.2.1rc2**, at 14:48:59 UTC on October 17; it had no uploads between 0.1.5rc1 on September 10 and that release.[44][45] No GitHub tag or npm version named plain 0.2.1 existed at that time, although the DeepSeek Harness account's announcement post referred to "Today's DeepSeek Harness 0.2.1 release".[43][44][46]

On the same date, GitHub's repository record reported about 253,000 stars and 30,400 forks, with the topics **ai-agents**, **cordis**, **dsh** and **dsh-plugin**.[59]

### Late October and November releases

Further candidates followed the October 17 model update. Each entry below remains a prerelease rather than a stable compatibility guarantee.[64][66][67][68]

| Release | Date | Selected documented changes |
|---|---|---|
| v0.2.1-rc.3 | October 23, 2026 | More menus in the sidebar and conversation views for discovering and creating plugins; preservation of unsent new-session drafts; dynamic model-list updates for API-key users [66] |
| v0.2.1-rc.4 | October 28, 2026 | Fix for diagnostic output leaking into standard output in ACP mode [67] |
| v0.2.1-rc.5 | October 30, 2026 | Improved display of thinking content in conversations [68] |
| v0.2.2-rc.1 | November 4, 2026 | Phone and tablet layouts, conversation export as Markdown, third-party plugin updates with attempted rollback after failed hot updates, and experimental Change requests and worktrees and per-step statistics [64] |

The November candidate also added an experimental **subagent_oar** tool plugin for delegating independent work to local Codex or Claude CLIs. The former standalone Git Worktrees entry moved into Change requests and worktrees. These optional extensions should be distinguished from default functionality.[64]

### DeepSeek-V4.1-Flash-1017 support

DeepSeek released **DeepSeek-V4.1-Flash-1017** on October 17, 2026, describing it as a minor update to DeepSeek-V4.1-Flash with stronger benchmark results, faster task completion and shorter outputs, available on its website, app and API. Weights were published on Hugging Face under the MIT License.[48][49] DeepSeek's announcement says the model is "Optimized for DeepSeek Harness, Tencent CodeBuddy, WorkBuddy, and more" and recommends Harness v0.2.1-rc.1 or later for the best experience with it.[47][48] The official Harness account went further, saying the model "was specifically optimized for @DeepSeekHarness during training" and claiming better task performance with shorter runtimes, less output and lower token costs.[46] These are DeepSeek's own claims. The model card's benchmark footnote names the [Claude Code](https://aiwiki.ai/wiki/claude_code) harness for Terminal-Bench 4.0 and the Mini-SWE-V2 harness for DeepSWE v1.1; it does not attribute any listed score to DeepSeek Harness.[49]

In the rc.2 source, the support is light at the Harness level. The bundled DeepSeek catalog keeps the model ID **deepseek-flash** and the name **DeepSeek-V4.1-Flash**, alongside **deepseek-v4-pro**.[61] A new Web plugin, **ui-deepseek-model-label-1017**, shows a temporary **1017** badge beside that name in the composer's model selector for the official API-key and DeepSeek account routes, without changing catalog names or request IDs; disabling it restores the plain names.[57] DeepSeek's September 10 release post said **deepseek-v4-pro** requests would route to V4.1-Flash from September 14, 2026 until V4.1-Pro launched, but DeepSeek withdrew that plan before the cutover: its change log says V4 Pro will continue to be served, and its pricing page lists **deepseek-v4-pro** as a separate model, DeepSeek-V4-Pro-0813.[50][62][63]

The same candidate added an opt-in switch, **Use the new Web Search API**, which points Harness's existing **web_search** and **web_fetch** tools at DeepSeek's dedicated Search and Fetch APIs. The switch defaults off; when it is off, Harness keeps search through the Messages API with local HTTP fetch. According to the design note, direct mode avoids the auxiliary model request that Messages search needs, and it sends up to 128 characters of the user's latest prompt with each query unless the **sendOriginalQuestion** option is disabled.[43][58] DeepSeek's release post priced each endpoint at $0.75 per 1,000 calls and said Search and Fetch calls through server-side tools in DeepSeek Harness, Claude Code and Codex were free for DeepSeek API users until billing starts at 16:00 UTC on October 31, 2026.[48] The promotion refers to server-side tool calls; Harness's design note for the direct mode prices the APIs per request and says the promotion does not by itself establish an exemption for Harness's direct calls.[58]

## Desktop application

The desktop interface combines conversations with a sidebar for inspecting generated files and code changes. DeepSeek describes support for document, spreadsheet, PDF and slide work alongside programming tasks. Results can be previewed and revised through follow-up instructions.[31][32]

Its plugin manager accepts package names and exposes installation, disabling, removal and source information. In experimental **Creator mode**, the agent can build a plugin from a natural-language request and make it available in the running application. The desktop announcement describes those plugins as persistent after creation; this is an extension mechanism rather than evidence that generated plugins are safe.[32][40]

The desktop carrier is an Electron application that includes its own production dsh runtime. It uses a reserved **desktop** profile and packaged Web assets. Desktop and the npm launcher share product data but maintain separate packages, activation state and lockfiles. The desktop host normally chooses an operating-system-assigned port, whereas the Web launcher's default remains **127.0.0.1:3080**.[9]

### Creator mode

Creator mode lets a user request a plugin through conversation to extend the interface, tools, or skills. The official product demonstration shows an agent inspecting the running plugin tree, writing a floating Pomodoro timer, installing its bundle, and checking the result. The plugin manager also provides a creation entry point.[31][42]

DeepSeek's November 2, 2026 demonstration presented examples including a design workspace, a sandbox game, and a three-dimensional language-model visualization.[69] Its accompanying prompt collection contains seven examples:[71]

| Example | Requested extension |
|---|---|
| Landmark gallery | A sidebar page displaying three-dimensional buildings |
| Transformer visualization | An interactive explanation of Transformer computations |
| Interface themes | Application-wide visual styles, including a pixelated theme |
| Poster workbench | Editable text and shader-background colors |
| Video workbench | Uploading, arranging, editing, and exporting clips |
| Paper reader | Paper upload, highlighting, notes, and questions about selected text |
| Conversation statistics | Usage, estimated costs, budgets, and activity displays |

These are demonstration prompts, not a specification of seven preinstalled applications. DeepSeek says some plugins needed several rounds of refinement, so pasting a single prompt may not reproduce the demonstrated result exactly.[71] Creator mode changes application components through executable plugins; it does not modify the underlying model's weights.[2][31]

## Interfaces

The Web launcher provides a local browser application. Running **dsh web** serves it at **127.0.0.1:3080** unless configured otherwise. The invoking directory is the default filesystem location, but a fresh Web UI has no active workspace until the user adds and selects one. Once configured, the agent can inspect and edit files, run commands, delegate work, and maintain a plan. The interface asks for approval when an operation exceeds the active permission policy.[2][5]

Model setup is separate from starting the server. The Models settings page stores API keys in **$DSH_HOME/.credentials.yaml** and returns a redacted descriptor rather than the secret. It supports catalog providers and custom APIs using OpenAI Chat Completions, OpenAI Responses or Anthropic Messages. Provider changes apply to the next request without a server restart; manually entered models need explicit input-type declarations when they accept images.[39] Providers without native key authentication, such as **openai-codex**, show no key field unless the profile names a credential reference, and a signed-in DeepSeek account supplies its own model list.[6] Since v0.2.1-alpha.3, Web and Desktop prefer saved credentials, while headless runs use environment variables and .env files by default and do not read saved keys.[54]

The **deepseek-official** adapter's **0.1.1-rc.2** catalog included **DeepSeek-V4-Flash-Vision-Exp** with text and image input; unlisted identifiers passed through as text-only routes in that release.[25]

In rc2, that adapter preprocesses an image to the selected model's configured limits, normally uploads the derived bytes through the DeepSeek Files API, and can reuse a valid uploaded-file mapping. If file-id resolution fails, it rebuilds the request with inline base64 versions of the retained images. This path supports image input only; it does not support direct external image URLs or assistant image output.[24][25]

The **headless** profile is a one-task alternative. The command **dsh --profile headless "job"** creates a persisted session, runs until the agent becomes idle, prints the final non-empty assistant response, and exits. It opens no HTTP server and has no interactive follow-up channel. Both Web and headless profiles initialize from shipped templates on first use. The current architecture also documents **sdk**, **sdk-minimal** and **acp** templates.[4][9]

For programmatic use, the Python SDK starts a bundled Harness runtime and communicates with it over JSON-RPC through standard input and output. The **DeepSeekHarness** class can reuse that subprocess across calls, and a repeated session identifier continues the same durable session and persistent shell state. A source checkout also includes ACP and JSON-RPC demonstrations, but those are development or automation examples rather than additional default interactive profiles.[4][7]

## Plugin architecture

Harness is built on Cordis, a [TypeScript](https://aiwiki.ai/wiki/typescript) meta-framework vendored into the repository. Cordis provides a shared context of named services. A [plugin](https://aiwiki.ai/wiki/plugins) requests services such as tools, model access, or sessions by context key instead of importing a fixed implementation. Required services are declared through injection, typed events carry communication, and registrations are tracked so they can be reversed when a plugin unloads.[9][10]

This design applies to product components, not just third-party extensions. The model adapter, tool registry, session log, agent loop, persistence, filesystem, sandbox policy, approvals, settings, credentials, telemetry, and Web surface are mounted as plugins. The architecture documentation says there is no privileged core that an extension must patch. Replacing a component is instead a configuration operation within the Cordis tree.[9]

A running Harness is assembled from profiles and bundles:

- A **bundle** is an npm package that contributes a Cordis configuration patch.
- A **profile** is a runnable composition that lists bundles in order and stores user overrides.
- **dsh-base** is the shared first layer of the Web, headless, SDK and ACP profiles and provides the common agent, tool, persistence, model, permission, and settings components. The **sdk-minimal** profile instead supplies its own standalone tree.[9]
- The Web and headless bundles add their respective interfaces.
- Profile, home-level, and command-line patch layers can replace earlier configuration rows by identifier.[9][12]

The smallest extension is a TypeScript module exporting an **apply** function that receives the Cordis context. Object and service-class forms are also supported. Plugins can register tools, listeners, prompt sections, model adapters, providers, and other services. Context-managed registrations are cleaned up on unload, while arbitrary resources can supply an explicit disposer.[10][12]

Packaged plugins declare a **dsh.bundle** manifest in package.json and point it at a patch file. The launcher manages out-of-tree dependencies through **dsh plugin --profile**, which forwards package operations to pnpm inside the selected profile. The official documentation suggests the **dsh-plugin** GitHub topic for discovery, but it does not describe a curated or security-reviewed marketplace.[2][12]

One published third-party example is [BrowserSkill](https://aiwiki.ai/wiki/browserskill), [Tencent](https://aiwiki.ai/wiki/tencent)'s MIT-licensed bridge that lets agents drive the user's own logged-in Chrome or Edge browser, whose repository carries the **dsh-plugin** topic. It ships a first-class dsh plugin on npm, **@wxg-prc-cpg/browser-skill-dsh-plugin**, installed with **dsh plugin --profile web add @wxg-prc-cpg/browser-skill-dsh-plugin** (substituting the profile name) and started with **dsh --profile web**. The plugin injects six native **browser_*** tools (**browser_session**, **browser_page**, **browser_inspect**, **browser_interact**, **browser_tabs** and **browser_assist**), runs the separately installed **bsk** command-line tool on the agent's behalf, and bundles the **browser-skill** skill so no separate skill installation is needed. Browser sessions appear as a live view in the Web UI, in a Browser Skill tab of the native right sidebar when that is available and otherwise in a floating panel. By default the tool schemas enter the [system prompt](https://aiwiki.ai/wiki/system_prompt) only after the skill is invoked (**lazyTools**), concurrent sessions are capped at five, and the plugin only sees sessions it created, even when the **bsk** daemon is shared with other programs. Configuration lives in an **id: browserskill** entry of the profile's **cordis.patch.yml**. Installed plugins do not update automatically; the maintainers document **dsh plugin --profile web update @wxg-prc-cpg/browser-skill-dsh-plugin --latest** followed by a profile restart. The plugin's first npm version, 0.1.0, was published on August 17, 2026, four days after the Harness announcement; 0.2.1 was the npm **latest** tag on September 16, 2026, and from 0.2.0 the plugin shares one version number with the BrowserSkill CLI and extension.[28][29][30]

Release candidates after rc6 also changed the product-subagent and terminal surfaces. Rc7 connected Codex and [Claude Code](https://aiwiki.ai/wiki/claude_code) subagent tasks to the Job Panel. Rc8 made those providers separate optional Profile Bundles, added non-interactive permission modes and named instances, and added persistent PowerShell sessions to Windows PTY terminals in the product's Minimal preset.[21][22] The main launcher does not include either product-subagent package. An operator must add the selected bundle to a profile, restart that profile, and enable its otherwise dormant provider through a preset tool row. The Python tutorial's separate minimal composition now selects persistent Bash on Linux or macOS and PowerShell on Windows.[38]

### Experimental Claude Code Mods compatibility

Version **v0.2.1-alpha.1** introduced an experimental [Claude Code Mods](https://aiwiki.ai/wiki/claude_code_mods) compatibility layer. The release notes describe its purpose as testing whether the Mods API's capabilities fit within Harness's plugin system. They explicitly distinguish this experiment from complete, practical compatibility for users.[35]

## Super-agent architecture proposal

On November 1, 2026, the Harness team published *Exploring Super-agent Design: Towards a More Autonomous Agent System*. Its opening warning says the article discusses architectural ideas and does not describe existing Harness features. It targets continuous interaction across channels, concurrent tasks, proactive event handling, and persistent operation.[72]

The design separates a long-lived Router layer, which coordinates tasks and communicates with users, from Workers with isolated contexts that execute individual tasks. It filters incoming events through deterministic rules before using a model for semantic decisions. Subscriptions can send later events in an existing thread directly to its Worker, avoiding another routing call.[72]

Other proposed mechanisms include retrieving related objects through linked identifiers and summaries, asynchronous tool starts and completion events, and separating agent-loop compute from persistent session state and remote execution environments. An external Watchdog monitors failures and stalled work. The article notes that asynchronous task handling was already implemented in Harness but was not enabled by default.[72]

### Prototype and evaluation limits

A separate MIT-licensed repository, **dsh-superagent-prototype**, implements parts of this work as a Harness bundle for one GitHub repository, optionally connected to Feishu. It creates work items, runs work in separate sessions and directories, replies in the originating discussion, and provides a panel for matters requiring human attention. The README calls it research code rather than an official DeepSeek product. It differs from the internal implementation and does not implement every design in the article.[73]

The article's scheduling experiment used synthetic streams of about 300 messages, including about 20 work requests, and simulated coding with a tool that consumed time. Each design ran five times. The reported median and 95th-percentile task completion times were 12.4 and 15.7 minutes for Super-agent, compared with 20.4 and 29.5 minutes for the single-session baseline with a neutral delegation prompt. Cache-read token counts were higher for Super-agent, 23.2 million per run versus 6.1 million. These results measure coordination under that setup, not the quality or speed of actual software engineering.[72]

The authors identify unresolved issues in scaling, long-term memory, cross-agent permissions, security, and privacy. In particular, connecting a cloud agent to personal execution environments can expose private code and credentials if the agent is compromised. The prototype and design paper do not establish that a generally available, production-ready autonomous service has launched.[72][73]

## Cordis design basis

Cordis is accompanied by the draft paper *A Programming Paradigm for Spatiotemporal Composability*. It defines temporal composability as the ability to reverse a component's effects when it is removed, and spatial composability as declaratively managing dependencies as the surrounding context changes. Cordis implements those ideas through tracked effects, dependency resolution, a declarative loader, configuration reconciliation, and hot module replacement.[11]

The project initially published an August 13, 2026 draft.[11] An arXiv version followed on August 26, 2026, authored by Yifan Shi, Wei Zhang and Tianyi Cui.[41] The paper is the design rationale for Cordis, not an independent evaluation of Harness's task performance. The separate Cordis repository also says its API is not yet stable and may change without notice.[20]

## Agent loop and session state

The default loop distinguishes a **step** from a **turn**. A step consists of one model request and the tool calls that follow it. A turn can contain several steps when a tool result or queued input requires another request. Plugins can observe or intercept model requests, tool execution, and turn transitions through typed events.[9]

Durable session events record user messages, assistant output, tool calls and results, and turn boundaries. The model-visible history is derived from that log, as are resume, fork, transcript, telemetry, and persistence features. This event-stream design reduces the need for each interface to maintain a separate copy of agent state, but it does not guarantee that every optional persistence plugin has identical durability properties.[9]

The October Python tutorial's **sdk-minimal** example is narrower than the main Web composition. Its default model-facing tool is a persistent platform-selected shell, and it stores uncompressed JSONL sessions without compaction. The bundled **str_replace_editor** is opt-in rather than part of that tree.[38] Version v0.2.2-rc.1 added recovery-record saves before model requests and tool execution in sdk-minimal, stopping those operations if persistence fails.[64]

The published SDK requires an explicit Harness home through **dsh_home** or a non-empty **DSH_HOME** in the child environment. It deliberately does not discover the user's default **~/.dsh** directory. Reusing both a Harness instance and session identifier continues the durable conversation; an isolated home and new identifier separate independent work.[8]

## Automation tasks

The desktop preview introduced an Automation tasks surface for scheduled work.[32] Version **v0.2.1-alpha.1** made automation part of Web itself: reminder tools are available in Standard, Creator and PTC modes, but not Minimal mode or delegated subagents.[35] The v0.2.2-rc.1 guide describes a Host-wide task list with manual creation, direct editing, pause, resume, deletion, and Run now controls.[74]

A reminder contains an instruction, a start time and an RFC 5545 recurrence rule. It can deliver into an existing conversation, create one conversation and reuse it, or create a new conversation for every run. New-conversation targets use a selected workspace and preset. The interface retains unsaved drafts and checks task versions when saving concurrent edits.[74]

Scheduling depends on the Host process running. Restarting delivers an overdue one-shot reminder or only the latest missed occurrence of a recurring task. Closing the Host stops scheduling until it starts again. Saved delivery records confirm that the instruction reached a conversation inbox, not that the model completed the requested work. Exactly-once delivery is not guaranteed; a crash after inbox persistence can cause a repeated delivery.[74]

## Permissions and sandboxing

The shipped base profile configures new sessions for **workspace-write** with an **ask** approval policy unless an operator overrides the permission mode through the environment. It also defines **read-only** with approvals and **danger-full-access** without approvals as selectable presets.[14]

| Mode | Documented filesystem effect |
|---|---|
| read-only | Denies writes apart from required system sinks |
| workspace-write | Allows writes inside the canonical workspace and designated temporary areas |
| danger-full-access | Bypasses filesystem confinement |

These modes describe filesystem effects only. The official sandbox specification explicitly excludes network access and process visibility from the policy vocabulary. A workspace-write session therefore should not be interpreted as a complete network or process-isolation boundary.[13] Version v0.2.2-rc.1 also allows Web Fetch to reach non-public addresses; deployment operators must restrict network access separately.[64]

For confined shell commands, the local provider prefers Bubblewrap and then Landlock on Linux, uses Seatbelt on macOS, and uses an ACL restricted-token runner on Windows. If no intended backend is usable, the provider is designed to fail closed rather than silently execute without confinement. It reports enforcement as either full or partial. Older Landlock application binary interfaces and documented Windows ACL gaps are examples of partial enforcement, which callers needing an absolute boundary must not treat as full.[13]

Version 0.1.1-rc.1 changed the Linux Bubblewrap profile by adding a private PID namespace before mounting a fresh **/proc**. The release notes describe the change as preventing confined processes from bypassing Bubblewrap restrictions through **/proc/<pid>/root**.[23][27] This is a fix to one runner, not a general network or process-isolation guarantee for every permission mode or backend.[13]

Filesystem editing tools use a separate trusted-code containment check. Their documentation calls it a policy fence rather than a kernel boundary and acknowledges a narrowed but accepted race involving changes to ancestor symbolic links between checking and writing. Untrusted shell code is intended to pass through the process sandbox instead.[15]

The Python tutorial's minimal composition is an exception to the Web default. It pins **danger-full-access**, so its platform-selected persistent shell can modify any path visible to the runtime. The tutorial recommends a disposable checkout or container. An explicitly enabled local editor also lacks workspace confinement in that composition.[38]

Installing plugins creates another boundary. A plugin fetched from a Git host may run a **prepare** build script on the host if the user allowlists it in pnpm. That code executes at install time, outside the sandbox used for later agent commands. The official guide recommends reviewing the source and pinning a commit hash; publishing prebuilt artifacts avoids the build step but does not make an untrusted plugin safe.[12]

## Development status and limitations

The desktop preview does not remove the project's experimental status. The official safety notice says Harness has not undergone a security audit and must not be treated as secure or production-ready. Model-generated commands and untrusted plugins can damage files or disclose credentials. Sandboxing and approval controls reduce risk but do not guarantee isolation; the notice recommends least privilege, backups and disposable or dedicated environments.[40]

The repository's benchmark file only explains how to run the Python minimal variant. It publishes no comparative Harness scores, so it does not support claims that dsh is faster, safer, or more capable than another agent system.[17] Community reports and discussion comments may motivate tests, but they are not a substitute for controlled evaluations.

As of August 21, GitHub detected no SECURITY.md policy and listed no published security advisories for the repository.[18] A recheck on October 18, 2026 found no SECURITY.md at the repository root or in .github, and GitHub's advisories API returned an empty list.[60] The absence of an advisory is not evidence that the code has no vulnerabilities. The project's explicit safety notice warns against using Harness as the sole security control for untrusted workloads.[40]

These constraints make the developer preview most suitable for evaluation in controlled workspaces, with versions pinned, permission modes reviewed, and plugins treated as executable host code. They do not prevent production experimentation, but the official evidence does not justify describing the release as production stable.

## References

1. DeepSeek. *DeepSeek Harness v0.1 developer preview announcement*. August 13, 2026. https://x.com/deepseek_ai/status/2087887408440164663
2. DeepSeek. *DeepSeek Harness repository and README*. https://github.com/deepseek-ai/deepseek-harness
3. npm Registry. *@deepseek-ai/dsh package metadata*. Accessed August 21, 2026 at 19:37 UTC. https://registry.npmjs.org/%40deepseek-ai%2Fdsh
4. DeepSeek. *Development guide*. https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/development.md
5. DeepSeek. *Use the Web UI*. https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/guide/index.md
6. DeepSeek. *Configure models*. https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/guide/providers.md
7. DeepSeek. *Get started with the Python SDK*. https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/guide/python-sdk.md
8. Python Package Index. *DeepSeek Harness Python SDK*. Accessed August 21, 2026 at 19:37 UTC. https://pypi.org/project/deepseek-harness-sdk/
9. DeepSeek. *DeepSeek Harness Architecture*. https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/architecture.md
10. DeepSeek. *Cordis Primer*. https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/cordis-primer.md
11. Cordiverse. *A Programming Paradigm for Spatiotemporal Composability*. Draft of August 13, 2026. https://github.com/cordiverse/paper
12. DeepSeek. *Package and install a plugin*. https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md
13. DeepSeek. *Process Sandbox*. https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/subsystems/sandbox.md
14. DeepSeek. *dsh-base profile configuration*. https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/bundle/base/cordis.patch.yml
15. DeepSeek. *The sandbox-enforcing filesystem backend*. https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/fs/fs-sandbox/README.md
16. DeepSeek. *MIT License*. https://github.com/deepseek-ai/deepseek-harness/blob/master/LICENSE
17. DeepSeek. *Running benchmarks*. https://github.com/deepseek-ai/deepseek-harness/blob/master/BENCHMARK.md
18. GitHub. *Security overview for deepseek-ai/deepseek-harness*. Accessed August 21, 2026. https://github.com/deepseek-ai/deepseek-harness/security
19. GitHub. *Releases for deepseek-ai/deepseek-harness*. Accessed August 21, 2026. https://github.com/deepseek-ai/deepseek-harness/releases
20. Cordiverse. *Cordis repository*. Accessed August 14, 2026. https://github.com/cordiverse/cordis
21. DeepSeek. *DeepSeek Harness v0.1.0-rc.7 release notes*. August 17, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.0-rc.7
22. DeepSeek. *DeepSeek Harness v0.1.0-rc.8 release notes*. August 19, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.0-rc.8
23. DeepSeek. *DeepSeek Harness v0.1.1-rc.1 release notes*. August 21, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.1-rc.1
24. DeepSeek. *DeepSeek Harness v0.1.1-rc.2 release notes*. August 21, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.1-rc.2
25. DeepSeek. *DeepSeek model adapter reference at dsh-v0.1.1-rc.2*. https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/llm/llm-deepseek/README.md
26. DeepSeek. *Command-line behavior reference at dsh-v0.1.1-rc.2*. https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/apps/cli/reference/README.md
27. DeepSeek. *Bubblewrap profile source at dsh-v0.1.1-rc.1*. https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.1/packages/sandbox/sandbox-local/src/profiles.ts
28. Tencent. *BrowserSkill for DeepSeek Harness (plugin README)*. Accessed September 16, 2026. https://github.com/Tencent/BrowserSkill/blob/main/packages/dsh-plugin-browserskill/README.md
29. Tencent. *BrowserSkill repository README and CHANGELOG*. Accessed September 16, 2026. https://github.com/Tencent/BrowserSkill
30. npm Registry. *@wxg-prc-cpg/browser-skill-dsh-plugin package metadata*. Accessed September 16, 2026. https://registry.npmjs.org/%40wxg-prc-cpg%2Fbrowser-skill-dsh-plugin
31. DeepSeek. *DeepSeek Harness public-preview product page*. Accessed October 13, 2026. https://deepseek.com/en/harness/
32. DeepSeek Harness. *DeepSeek Harness for Desktop Is Here*. September 30, 2026. https://x.com/DeepSeekHarness/status/2105330281389662575
33. DeepSeek. *Desktop public-preview announcement*. October 2, 2026. https://x.com/deepseek_ai/status/2105915715241062644
34. DeepSeek. *DeepSeek Harness v0.2.0-rc.2 release notes*. September 29, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.0-rc.2
35. DeepSeek. *DeepSeek Harness v0.2.1-alpha.1 release notes*. October 3, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-alpha.1
36. DeepSeek. *DeepSeek Harness v0.2.1-alpha.2 release notes*. October 9, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-alpha.2
37. DeepSeek. *Schedule reminders*. Accessed October 13, 2026. https://deepseek-harness.github.io/deepseek-harness/en/guide/schedule
38. DeepSeek. *Get started with the Python SDK*. Accessed October 13, 2026. https://deepseek-harness.github.io/deepseek-harness/en/guide/python-sdk
39. DeepSeek. *Configure models*. Accessed October 13, 2026. https://deepseek-harness.github.io/deepseek-harness/en/guide/providers
40. DeepSeek. *Safety notice*. Accessed October 13, 2026. https://github.com/deepseek-ai/deepseek-harness/blob/master/SAFETY.md
41. Yifan Shi, Wei Zhang and Tianyi Cui. *A Programming Paradigm for Spatiotemporal Composability*. arXiv:2608.25512, submitted August 26, 2026. https://arxiv.org/abs/2608.25512
42. DeepSeek. *DeepSeek Harness v0.2.1-rc.1 release notes*. October 17, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-rc.1
43. DeepSeek. *DeepSeek Harness v0.2.1-rc.2 release notes*. October 17, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-rc.2
44. npm Registry. *@deepseek-ai/dsh package metadata*. Accessed October 18, 2026. https://registry.npmjs.org/%40deepseek-ai%2Fdsh
45. Python Package Index. *deepseek-harness-sdk release metadata*. Accessed October 18, 2026. https://pypi.org/pypi/deepseek-harness-sdk/json
46. DeepSeek Harness (@DeepSeekHarness). *Post on DeepSeek Harness 0.2.1 and DeepSeek-V4.1-Flash-1017*. October 17, 2026. https://x.com/DeepSeekHarness/status/2111376365497077958
47. DeepSeek (@deepseek_ai). *DeepSeek-V4.1-Flash-1017 announcement*. October 17, 2026. https://x.com/deepseek_ai/status/2111375640717033777
48. DeepSeek. *DeepSeek-V4.1-Flash-1017 Release*. DeepSeek API Docs, October 17, 2026. https://api-docs.deepseek.com/news/news261017
49. DeepSeek. *DeepSeek-V4.1-Flash-1017 model card*. Hugging Face. Accessed October 18, 2026. https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash-1017
50. DeepSeek. *DeepSeek-V4.1-Flash Release*. DeepSeek API Docs, September 10, 2026. https://api-docs.deepseek.com/news/news260910
51. DeepSeek. *DeepSeek Harness v0.1.5-rc.1 release notes*. September 10, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.5-rc.1
52. DeepSeek. *DeepSeek Harness v0.1.7-rc.1 release notes*. September 23, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.7-rc.1
53. DeepSeek. *DeepSeek Harness v0.2.0-rc.1 release notes*. September 28, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.0-rc.1
54. DeepSeek. *DeepSeek Harness v0.2.1-alpha.3 release notes*. October 14, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-alpha.3
55. DeepSeek. *DeepSeek Harness v0.2.1-alpha.4 release notes*. October 15, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-alpha.4
56. DeepSeek. *DeepSeek Harness v0.2.1-alpha.5 release notes*. October 16, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-alpha.5
57. DeepSeek. *@deepseek-ai/dsh-client-ui-deepseek-model-label-1017 package README at dsh-v0.2.1-rc.2*. https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.2.1-rc.2/packages/client/ui-deepseek-model-label-1017/README.md
58. DeepSeek. *Agent Note: Direct DeepSeek Search and Fetch APIs*. At dsh-v0.2.1-rc.2. https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.2.1-rc.2/.agents/notes/implemented/feature/2026-10-15-deepseek-search-fetch-api.md
59. GitHub. *deepseek-ai/deepseek-harness repository record (REST API)*. Accessed October 18, 2026. https://api.github.com/repos/deepseek-ai/deepseek-harness
60. GitHub. *Security advisories for deepseek-ai/deepseek-harness (REST API)*. Accessed October 18, 2026. https://api.github.com/repos/deepseek-ai/deepseek-harness/security-advisories
61. DeepSeek. *Default DeepSeek model catalog source at dsh-v0.2.1-rc.2*. https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.2.1-rc.2/packages/llm/llm-deepseek/src/models.ts
62. DeepSeek. *Change Log*, entry dated September 10, 2026 (as revised). DeepSeek API Docs. Accessed October 19, 2026. https://api-docs.deepseek.com/updates/
63. DeepSeek. *Models & Pricing*. DeepSeek API Docs. Accessed October 19, 2026. https://api-docs.deepseek.com/quick_start/pricing
64. DeepSeek. *DeepSeek Harness v0.2.2-rc.1 release notes*. November 4, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.2-rc.1
65. DeepSeek. *Development guide at dsh-v0.2.2-rc.1*. Accessed November 4, 2026. https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.2.2-rc.1/docs/development.md
66. DeepSeek. *DeepSeek Harness v0.2.1-rc.3 release notes*. October 23, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-rc.3
67. DeepSeek. *DeepSeek Harness v0.2.1-rc.4 release notes*. October 28, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-rc.4
68. DeepSeek. *DeepSeek Harness v0.2.1-rc.5 release notes*. October 30, 2026. https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-rc.5
69. DeepSeek Harness. *Creator Mode demonstration*. November 2, 2026. https://x.com/DeepSeekHarness/status/2117256196227019194
70. DeepSeek. *CLI package metadata at dsh-v0.2.2-rc.1*. https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.2.2-rc.1/apps/cli/package.json
71. DeepSeek. *DeepSeek Harness creator mode demo prompts*. Accessed November 4, 2026. https://cdn.deepseek.com/harness/dsh-creator-mode-prompt-collection-en.html
72. Yujia Qiao and the DeepSeek Harness team. *Exploring Super-agent Design: Towards a More Autonomous Agent System*. November 1, 2026. https://x.com/DeepSeekHarness/status/2116857257245987236
73. DeepSeek. *dsh-superagent-prototype repository and README*. Accessed November 4, 2026. https://github.com/deepseek-ai/dsh-superagent-prototype
74. DeepSeek. *Schedule reminders at dsh-v0.2.2-rc.1*. Accessed November 4, 2026. https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.2.2-rc.1/docs/user/guide/schedule.md