DSCODE

A terminal coding agent for macOS, built on DeepSeek Harness. Its premise is that sessions on one machine should be able to see each other: a session can read another’s transcript, hand over work with dscode send <session-id> --steer "review the change in parser.ts and reply", ask a side question through /btw in a read-only child that never touches the main conversation, or let /delegate <task> plan a task on a board and run the ready parts as child agents in isolated git worktrees. Approvals go to an independent reviewer by default (/permission auto-review) inside a workspace-write sandbox. Install with npm install -g @toddzheng024/dscode, then cd /path/to/project and run dscode; the first launch installs a pinned preset from the DSH Plugin Hub, and /login stores a DeepSeek API key in ~/.dscode/credentials.yaml with 0600 permissions. Homebrew (brew tap qiz029/tap && brew trust qiz029/tap && brew install dscode), a one-line installer and a source checkout are also supported. It needs macOS 14+, Node 22.19+ or 24+, Git and Chrome; dscode exec "prompt" runs a turn from a script.

Who built itThe repository lists exactly one contributor, the account qiz029, and all 123 commits are linked to it — authored as todd.zheng from toddzheng024@gmail.com. The MIT licence names Todd Zheng, and the package publishes under the npm scope @toddzheng024. This is a one-person project in the plain sense: no second contributor, no bot account, and no other public record of the builder in the material this record was written from.

1. 01

   Fourteen days, and twenty releases in the last nine of them

   The repository was created on 2026-09-11 at 09:40:02Z and its first commit arrived 59 seconds later — "Add DSCODE coding harness and npm Hub distribution". Its last commit, on 2026-09-25, is "Release 0.7.32: OpenCode Go account login and footer usage". Between those two points sit 123 commits, all of them in September 2026, and all from the same account. The releases are not spread across that fortnight: the first, v0.7.13, was published on 2026-09-17 and the last, v0.7.32, on 2026-09-25, so all twenty landed inside the final nine days, with at least one on every one of those days — four on 2026-09-18, four on 2026-09-19 and four on 2026-09-22 — and the closest pair, v0.7.26 and v0.7.27, twenty-six minutes apart. The release rules are the other half of the explanation: AGENTS.md makes a release a checklist rather than a version bump, with the notes file, a matching package.json version, a changelog entry and both READMEs shipping in the same change, and make attach refusing outright rather than publish without docs/releases/<version>.md. The tree carries 38 such files, from 0.2.0 to 0.7.32, against 20 tags and 20 releases — a gap the materials do not explain. Dates here are the API’s UTC timestamps.

2. 02

   What those nine days of releases were actually about

   The README’s "What’s new" section covers the last nine releases, and read end to end it is three threads rather than nine features. The first is work that runs with nobody watching: 0.7.24 lets an event start a session, with definitions in <state>/triggers/ and <workspace>/.dsh/triggers/, an event carrying only data under a required eventId, and trigger install writing a launchd LaunchAgent; 0.7.26 adds fresh and persistent session modes, durable cron and delay jobs and supervised script sources. The second is provider sign-in: 0.7.29 adds /account, which signs the DeepSeek route in through the system browser with a loopback callback, so a signed-in machine needs no DEEPSEEK_API_KEY; 0.7.31 brings OpenCode Go into /provider with its DeepSeek, GLM, Kimi, MiMo, LongCat, Hy and Space Bunny models; 0.7.32 replaces that route’s console API key with /opencode login and puts the subscription’s five-hour, weekly and monthly caps into the footer. The third is repair of the composition the whole project sits on: 0.7.27 fixes fresh Hub installation failing after the Harness composition generated an empty cordis.yml, and 0.7.28 moves the runtime from 0.1.5-rc.2 to 0.1.7-alpha.2 while renaming the permission preset auto to auto-review, because DSH now reserves auto for its own integration. Feature releases and repair releases are interleaved, and the repair releases are the small ones: a broken installer, a renamed flag, an upstream version bump.

3. 03

   A shell grown on a plugin host, and the price of the terminal

   DeepSeek Harness is the host, and the README describes the ordinary path on it: the first launch installs a pinned complete preset from the DSH Plugin Hub with no manual plugin assembly, and the launcher checks installed bundles and Harness dependencies against the recommended combination, printing one consolidated warning instead of editing dependencies or downgrading. Most of what DSCODE adds follows that model — 28 directories under plugins/, from plugins/triggers (26 files, 157 KB, its cli.mjs alone 30,629 bytes) down to one-file plugins like plugins/ultra/policy.mjs (6,114 bytes). The terminal is where the project leaves the plugin model: packages/tui is a vendored, modified copy of the interface, 79 files and 1,338 KB, and its own src/app.ts is 382,157 bytes, the largest code file in the tree. How it is carried is stated in the README: the bundle generates its modified modules at build time and never rewrites third-party sources on a user’s machine. That is why there is a cordis.patch.yml of 11,484 bytes inside the terminal package and another under config/, six scripts/patch-*.mjs files (the largest, patch-runtime.mjs, 23,335 bytes), and a whole document, docs/vendored-tui-upgrade.md (5,058 bytes), about taking a new upstream dsh-code release — a document whose stated limit is what only a smoke test catches. The tree is 515 files, and the largest directory in it by bytes is not code at all but assets/: two files, 3,504 KB, almost all of it the 3,585,589-byte demo GIF.

4. 04

   One contributor, 123 commits, and a directory of Chinese research notes

   Every one of the 123 commits is linked to the same GitHub account, qiz029, authored as todd.zheng from toddzheng024@gmail.com, and the contributor list has exactly one entry: qiz029 with 123 commits. What the history also records is how much of the work was done with a model in the loop — 43 of the 123 commits carry a co-author trailer, 26 for "Claude Fable 5.1", 14 for "Claude Opus 5 (1M context)", two for "Claude Opus 5.5" and one for "Claude Opus 5.5 (1M context)". The project’s own notes on building it are not in docs/, which AGENTS.md rules must be English; they are in research/, seven documents and 118 KB, written in Chinese, and their subjects are the project’s own problems: taking over the vendored terminal (dsh-code-vendor-接管-迁移笔记.md, 25,484 bytes, and dsh-code-1.2.0-迁移笔记.md, 14,319), whether to replace that terminal in-house (7,558 bytes), a comparison of four system prompts (22,905), a survey of context compaction (30,762), a design for complexity metrics an agent can maintain (12,663), and a code review of its own v0.7.8 listing optimisations and potential bugs (7,389). Beside them sits eval/: 711 KB under eval/compaction for context-compaction evaluation, carried by fixtures of 212,244 and 162,078 bytes, and 36 files under eval/continuation with twenty small check scripts.

5. 05

   What broke, and what the design records admit does not work

   The repository carries 1,009 stars, one fork and no issues and no pull requests at all, so the record of what went wrong lives in the tree rather than in bug reports. Some of it is in the release notes: 0.7.27 exists because the Harness composition generated an empty cordis.yml and fresh Hub installation failed; 0.7.28 broke its own users by renaming a permission preset, because DSH took the name auto; and 0.7.29 carries the admission that the host-plane workflow engine had to be disabled again after an upstream rename silently voided the patch that disabled it — a patch that stopped applying with nothing catching it. AGENTS.md adds two more: a publish job that dies after about thirty seconds at the credential check is usually a version conflict on npm rather than a missing secret, and a version already on npm from a different build cannot be re-tagged, so the version has to be bumped and a new tag cut; and make release, make verify and npm run doctor cannot run inside a dscode session, because the nested sandbox is refused, so the release gate has to be run from an ordinary terminal. The design records keep their own limits in writing: the trigger mechanism is "not an automatic retry engine", nothing consumes its runs.jsonl yet and the notifier transport is "undecided on purpose"; the agent-to-agent messaging design fixes a strict cancellation boundary at "before the claim", bounds every chain at a depth of 3, 8 new messages, one final reply, one hour, a 64,000-byte body, 100 unclaimed notes and 1 MiB per session, and says outright that it does not treat the same OS user as a security boundary, and that resisting a deliberate bypass needs sandbox isolation which the first version does not promise.