DeepSeek Harness

An open-source harness for building, running and extending agents, in which every capability — models, tools, skills, sessions, sandboxes, storage, the loop, scheduling and the UI — is a plugin composed at boot from ordered configuration layers. Nothing is privileged: the model adapter, the tool registry, the session log and the agent loop are all replaceable without touching the source, and every run is written to an append-only session log that resume, fork, search and replay all read from. The same plugin tree launches as a web UI through npx, as a desktop app DeepSeek began shipping at the end of September 2026, and as headless, SDK and ACP profiles.

Who built itThe Hangzhou lab behind the R1 reasoning model, founded in July 2023 by Liang Wenfeng out of the quantitative fund High-Flyer and the GPU clusters he had already bought for it; its own product pages name the company as 「杭州深度求索人工智能基础技术研究有限公司」. Harness is the first thing it has shipped that is a framework rather than a model, and it arrives attached to the most active piece of folklore in Chinese AI — its founder’s standing as a human meme.

1. 01

   Three weeks to two hundred thousand stars

   DeepSeek Harness went public on 2026-08-13, the same day V4 Pro reached general availability, and it did not arrive quietly. A TMTPost column measured the climb against OpenClaw, which had taken roughly three months to reach two hundred thousand stars; Harness reached the same mark in under three weeks. A finance piece on 2026-08-21 put it at 175,000. By 2026-09-29 GitHub reports 239,698 stars, 28,788 forks and 1,040 watchers on MIT-licensed TypeScript — which is, on this project, the least interesting number available. The repository itself was created at 2026-08-13T11:56:32Z, the day it went public. The history underneath is the interesting one: the oldest commit is dated 2026-06-10, two months before any of it could be seen, and the repository has since accumulated 20,470 commits from 41 contributors, 8,297 of them in July 2026 alone. Twenty-four releases are tagged, every single one is a pre-release, and they run from dsh-v0.1.0-rc.7 on 2026-08-17 to dsh-v0.2.0-rc.2 on 2026-09-29 — a version number that has not reached 1.0 in public. Issues are switched off; bugs go to Discussions, so the public record of what is broken is a forum thread rather than a tracker, and that decides what anyone outside the company can know.

2. 02

   The plugin boundary is drawn further in than anyone else draws it

   Cordis is the kernel, and it is not a thing written for this launch — it is an existing open-source project in the cordiverse organisation with its own design paper, arXiv 2608.25512, on spatiotemporal composability. The architecture document states the arrangement plainly: plugins contribute services, typed events and reversible effects to a shared context, and every part of the product is a plugin, including the model adapter, the tool registry, the session log, and the agent loop itself. The sentence that follows is the one to read twice: there is no privileged core to patch. Registrations are effects that unwind when their plugin unloads, so the kernel’s whole job is mounting, unmounting and dependencies, and the capabilities live in the plugins. A running harness is then a plugin tree composed at boot from ordered layers. A profile is a named composition stored in the Harness home, listing the bundles it stacks; web, headless, sdk, sdk-minimal and acp ship as templates. A bundle is a distribution format for configuration rows. Layers apply in sequence — the profile’s bundles in their listed order, then the profile’s own patch file, then the home-level one, then any command-line overlay — and a patch targets a row by id and replaces its whole config. dsh --profile web --dump-config prints the tree the machine actually booted, and any row in that output can be replaced by a patch of your own. An Alibaba Cloud community write-up found the better metaphor: other projects open the room, DeepSeek published the drawings to the load-bearing wall.

3. 03

   Agent = Model + Harnessrevised 2026-09-29

   DeepSeek framed it that way at launch: the model is the soul of an agent; a harness is what lets an agent understand its environment, use tools, and keep working in real-world settings. The capability list is the same one the architecture document gives — models, tools, skills, sessions, sandboxes, storage, loops, scheduling and the UI — and the claim is that each is a plugin, so a change of model is a change of configuration. Four runtime modes ship as compositions of those same plugins rather than as separate products. Standard mode is the full coding agent: file editing, shell, file and web search, skills, planning, goals, subagents, workflows. Code mode, called PTC internally, keeps all of that but exposes the tools through a Code Mode SDK, so the model orchestrates several rounds of tool calls inside one TypeScript program. Minimal mode reduces the agent to two tools, a persistent bash and a string-replacing file editor, and its stated purpose is benchmarking models in a minimal environment — it exists so that a model can be measured without the harness flattering it. Creator mode is Standard plus runtime inspection and in-memory Cordis plugin experiments, and its stated purpose is authoring new agent presets. The locally installed build, 0.1.5-rc.1, resolves to roughly seventy @deepseek-ai/dsh-* packages: tool packages for bash, filesystem, search, PowerShell, jobs, goals, skills, subagents, task lists and web; compaction, sandbox and policy packages; several LLM adapters; a session stack with persistence, query, checkpoints and projections; and a pair of bridges for Claude Code and Codex hooks, which is why those two names appear in this record’s stack.

4. 04

   Everything is a plugin; every run is traceable

   The second half of the slogan is the one that costs engineering. Everything the model sees is written to an append-only session log — system prompts, reasoning, tool calls and their results, subagent scheduling, and every context injection — and a Trajectory view lets you inspect those records by source. Resume, fork, search and replay all operate on that same event stream rather than on separate machinery, which is the kind of decision that looks obvious afterwards and is not obvious beforehand; the repository’s own agent notes carry one titled event-sourced-sessions. The durability rule attached to it is stricter than most products bother with: released session data is never moved, overwritten or deleted, an adjacent migration may only add a version-named successor, SQLite schema versions increase monotonically, and every externally perceptible breaking change is recorded in an upgrade guide at the moment it happens. For a system whose entire pitch is that you can rearrange its parts, an invariant saying that yesterday’s transcripts will still open is what makes rearranging them safe.

5. 05

   Contributions arrive as plugins, not pull requests

   The contributing guide contains a sentence few projects will print: we are sorry that we cannot accept external pull requests at the moment. What it asks for instead is bug reports and upvotes in Discussions, plugins published under the dsh-plugin topic, blog posts and how-to guides, and answers to other people’s questions. Then it makes the claim that the rest of the design implies: we do not believe that packages in the official repository are inherently more important than packages created by the community — consider this repository an idea, an official showcase, and a source of inspiration, but not a mandate. It signs off with three words: Into the unknown. The product page’s Community plugins link does not go to a curated registry; it goes to a GitHub topic page. The documentation culture behind it is unusually formal. Under .agents/notes/ sit 2,444 markdown files, 1,220 of them Chinese. An Agent Note encodes its lifecycle and its class in its path and moves between folders as its status changes; notes in implemented/ are kept current with what actually shipped, and a rejected/ note is kept only while its rationale still prevents a tempting mistake, otherwise deleted as a complete set. Every public document ships as three files — .md, .zh.md and an .i18n.yaml. AGENTS.md runs to 17,942 bytes and covers layout, commands, secrets, conventions and a vendoring policy; CLAUDE.md is a nine-byte symlink to it. There are eight separate vitest configurations, a lefthook hook file, a copy-paste detector, a 12-kilobyte linter config, a 49-kilobyte base tsconfig, and continuous integration on both GitHub Actions and GitLab.

6. 06

   Which half of the audience you are in decides what you see

   Two weeks after launch, an Alibaba Cloud developer-community post tried to explain a split and refused the easy framing. Domestic complaints ran to slow, token-hungry and not intuitive; overseas developers were reading the architecture, rewriting plugins and swapping the loop. The author’s argument is that the line is not between countries but between two kinds of buyer: one wants a trained employee who can start work on Monday, the other wants a company substrate where they choose the staff, the tools and the process. Both are correct readings of the same object, because one is evaluating a finished thing and the other is studying how the thing was made. The community work he cites as evidence is specific: plugins that generate session titles, a Git Worktree integration, a live cost balance in the interface, cross-instance agent collaboration appearing in Discussions, and rebuilt Web UIs, task boards and desktop clients. He also reports the measurements going the other way in the same breath — slow, expensive in tokens, unclear docs — with users conceding that the harness squeezes DeepSeek hard, at a 99% cache hit rate. His line about early signals is the one worth keeping: a good sign for an open project is not that everybody says it is perfect, but that somebody could not stop themselves from changing it. His warning is the one that matters more — a third-party plugin runs with your own machine’s privileges, reading files, reaching the network and touching credentials, and an open-source community is not an app store, so appearing in a list is not a security audit.

7. 07

   The rheostat: a founder as the unit of measurement

   Chinese AI spent 2026 measuring DeepSeek’s output through its founder’s nickname. Liang Wenfeng was made 「梁圣」, Saint Liang, after R1 in January 2025; when V4 missed the promised mid-July window the title was revoked and he descended through 「梁叔」 and 「小梁」 to 「梁子」, 「梁鸽」, 「牢梁」 and 「小难梁」. A Phoenix Finance piece syndicated on 2026-08-07 compressed the whole cycle into one figure — his standing moves like a sliding rheostat, 「滑动变阻器」, drifting back and forth between markings — and called him one of the most active human memes in Chinese AI. The vocabulary it catalogued is dense: 「梁性循环」, a pun on the phrase for a virtuous cycle, describing the (dubious) story that the parent quant fund profits from retail traders to subsidise the model lab; 「梁白开」, for a release that felt like tap water; the couplet 「百万token三毛钱，梁圣恩情还不完」; and 「文锋丧胆」, a pun on an idiom about being terrified by the mere wind. On 2026-08-06 DeepSeek announced an API price increase, expected to be large, and when the new peak-and-off-peak pricing took effect on 2026-08-17 he became 「梁文谷」 — 「峰」 and 「谷」, peak and valley — with 「#DeepSeek也妥协了#」 trending. The harness shipped seven days after that announcement, and it bills against DeepSeek API credentials by default.

8. 08

   The remixes are real software, and so are the ad slots

   Within twenty-four hours of launch a site called DSH Meme Hub existed to collect the remixes. The best-known one makes the pun literal: a developer wired the rheostat to the harness itself, so that the reasoning-effort setting that buys success on harder tasks also slides the picture from 「梁子」 at low effort to 「梁圣」 at high — 「滑动变祖器」, resistance swapped for forebear. A dynamic version of it passed 1.5 million views on X. Another developer rebuilt the entire interface as a Chinese web portal from twenty years ago: a page-game advertising rail whose banner rotates every twenty seconds, feed advertisements threaded through the conversation pane, a lucky draw for V4 Pro access that is admitted to be fake, a wealth-god prize wheel, and a faithful reproduction of the close button whose X looks bigger than it is. The detail that turns it from a joke into engineering is that the ad slots are not fake. Any public repository carrying the dsh-plugin topic and updated within the last fortnight enters the recommendation rotation, clicking through opens the real project page, and the author takes submissions — a meme ad network with real inventory, routing traffic from one joke to the next. Someone else dressed the whole thing as QQ 2006, blue glass buttons, list-style messages, the nine-cell title bar and a QQ Show down the right-hand side. The official slogan is 「一切皆插件」 — everything is a plugin. The community’s is 「万物皆可整活」, everything can be messed with.

9. 09

   Someone pointed the harness at the meme

   On 2026-09-07 the 「蓝字计划」 column at TMTPost published a test that is more informative than most reviews. DeepSeek had shipped a vision model about a week after the harness, so the column handed the combination the six-panel 「滑动变祖器」 collage and, in the first round, gave it no context at all. It read the image correctly: six frames stitched horizontally, the same man with short black hair and thin glasses, dark suits in the first three panels, a dark turtleneck in the fourth and fifth, a red-and-gold robe and headdress in the sixth, and a summary of the arc as a person being progressively elevated and deified. Then the reporter supplied five titles for six panels, deliberately withholding the one in the middle. The model noticed the mismatch and filled it, proposing 「梁圣·升格」 and then 「梁煞」, and afterwards conceded that both had been invented to make the count come out. It also decided the subject was the late-Qing scholar Liang Qichao, on the strength of the surname. Fed a false framing in a later round — that the subject was an ancient figure deified for historical achievements — it declined to accept claims the image could not support. The column’s summary is the sharpest sentence written about this model so far: it was skeptical of the user and credulous about its own fabrication. The harness does ship web search and web fetch, and its default search service runs on DeepSeek API credentials and can be pointed elsewhere; but having a tool and having used it before answering are two different facts. The verdict: two hundred thousand stars show that the framework attracted attention, and being freely composable does not mean any given composition is dependable.

10. 10

    The unglamorous half

    The safe-use policy is 1,669 characters and does not oversell. It says the project is experimental and has not been security-audited; that it can execute model-generated code and commands, load third-party plugins, and reach the network, processes, credentials and files; that sandboxing and approval reduce risk but do not guarantee isolation; that it should be run least-privilege, preferably in a disposable virtual machine or container, with backups kept and plugins reviewed before loading; and that it comes with no warranty. The README calls it a developer preview in capitals and warns that there will be compatibility-breaking changes. The architecture document opens by telling you to read it before changing anything under packages/, assumes you already know Cordis, and recommends using an agent to explore the codebase — which is how this archive, whose own editor runs inside a locally installed 0.1.5-rc.1 of the harness, ended up reading it. The practical consequence of the default setup is money: the model adapter, the default search service and the browsing tools all run on DeepSeek API credentials, a harness multiplies the number of calls one task makes by orchestrating subagents, workflows and tool rounds, and the price of those credentials rose seven days before launch. Being able to replace every part from a config file is the feature; working out which arrangement is worth its bill is left, deliberately, to whoever is holding the configuration.

11. 11

    The product page stopped talking to developers

    The page was rewritten while this record was being written, and the rewrite is the news. At launch it was addressed to harness developers and led with the architecture — everything is a plugin, Agent = Model + Harness, four runtime modes. The version now served on www.deepseek.com leads with a download button. "DeepSeek Harness — Ready to use. Right now," it says, and the first screen carries exactly one action: a desktop build for Windows, with macOS on Apple silicon beside it, both served from download.deepseek.com. The companion download page says what the desktop app adds — it runs in the background and reads and writes local files, which is what makes long and complicated tasks practical — and notes that the release is still being iterated. The audience line moved with it: everyday tasks, coding, or your own harness, it starts here. Where the launch page spoke to people building harnesses, this one opens with organising files, analysing spreadsheets and drafting documents, and puts coding third. The footer changed too: the launch page linked a safe-use policy and a data-processing statement, the current one links a privacy policy and terms of use. The English page moved from /harness/en/ to /en/harness/, and the old address now answers with a two-word "Page moved" stub. One wrinkle worth recording for anyone following a link: the apex host and the www host are not the same build — while this record was open, deepseek.com/harness/ still served the launch page and www.deepseek.com/en/harness/ served the rewritten one. This record’s screenshot and its Open button both point at the rewritten page.

12. 12

    What the rewritten page actually demonstrates

    The page is now a feature tour, and several of its panels are the first public demonstration of things this record could previously describe only from the documentation. The plugin section shows Creator mode used as intended: the prompt is "Write a Pomodoro timer plugin for me", and the trace that follows is a complete agent run — load the cordis-plugin-development skill, read its SKILL.md, inspect nine inspect providers, query the runtime through Slots.listSubTree, write dsh-plugin-pomodoro-float/package.json at 35 lines and client.js at 638, then call plugin_manager · install_bundle, check that the plugin is live and stop. The page times it: five minutes and twenty-four seconds, ending on the line that the floating Pomodoro timer is built, installed and verified. A plugin list sits beside it — official, agent teams marked experimental, auto approval review, scheduled tasks, voice input, terminal, agent loop, subagents — with the new timer under Installed and a countdown actually running in the panel. A later section covers scheduled work: the same sentence about a Friday weekly report, and the schedule_create call it becomes, carrying a title, weekly, and {"time":"17:00:00","time_zone":"Asia/Shanghai","weekdays":[5]} — the scheduling package group this record saw in the dependency list, shown doing its job. Another panel previews outputs by file type: a Word document, an Excel sheet, an HTML page, TypeScript, Python, a PDF and a README, beside a diff for src/label.ts labelled review, turn 1. And the developer-tools section shows the trajectory view this record previously described from the architecture document: rounds, calls, filters for model, tool and system, per-call parameters, results and schema, and a timing block reporting a start time of 2026-08-12 17:30:52.637, a duration of 34 milliseconds, and the timing source as the session timestamp. The model chip in the mock interface reads DeepSeek-V41-Flash at High effort.