Inside the DeepSeek Harness
A 16-part deep dive into a second production agent harness — DeepSeek's dsh — from the plugin foundation down to real production incidents, read against the Agent Harness series: two teams, two answers to the same problems.
All Parts
DeepSeek Harness: Inside the Open-Source Claude Code Rival (Part 1)
DeepSeek open-sourced its Claude Code rival and hiked V4-Pro pricing in the same week. Real code, a head-to-head comparison, and the plugin architecture.
DeepSeek Harness: Composing an App From YAML, Not Code (Part 2)
How a running DeepSeek Harness process is assembled from YAML — profiles, bundles, patch layers, hot-reload, real code.
DeepSeek Harness: Scope — Why a Live Agent Is the Key of Its Own Registration (Part 3)
How DeepSeek Harness gives one agent its own tools and persona without forking config — a running Agent object literally is its own registration key.
Tool Execution in DeepSeek Harness: Guards and Approval (Part 4)
From tool/call to tool/result: the eight-stage pipeline DeepSeek Harness runs every tool call through, and why its guards can only say no.
DeepSeek Harness: Capability Seams — Making Bash Swappable for Sandboxed Bash (Part 5)
The 3-role pattern behind DeepSeek Harness's ~85 capability seams — and why swapping local bash for sandboxed bash touches exactly one config row.
The Session Log: DeepSeek Harness's Enforced Invariant (Part 6)
In DeepSeek Harness, model-visible means logged — a real runtime check on the session log that fails the request the moment log and model diverge.
DeepSeek Harness: Persistence and Compaction — Crash-Safe by Construction (Part 7)
What happens when DeepSeek Harness crashes mid-write — real JSONL/SQLite recovery code, and why compaction never rewrites the session log.
DeepSeek Harness: Waterfalls — The One Event Pattern That Runs Everything (Part 8)
The real ~10-line waterfall() implementation that retry, compaction, approval, and every other policy decision in DeepSeek Harness quietly runs through.
DeepSeek Harness: The Agent Loop — Turns, Steps, and a Real Cancellation Bug (Part 9)
Inside DeepSeek Harness's agent loop: a real, issue-numbered bug where a wake message could silently vanish during cancellation.
DeepSeek Harness: The LLM Layer — One Message Format, Every Surface (Part 10)
DeepSeek Harness's LLM adapter seam — one message shape, one streaming fold, and a retry counter that's derived from the log instead of kept in memory.
DeepSeek Harness: Subagents and Workflows — Composing Agents From Agents (Part 11)
How DeepSeek Harness spawns, forks, and delegates to child agents — and keeps a strict line between what a child said and what the runtime reported about it.
DeepSeek Harness: Defense in Depth — Sandboxing and Four Real Incidents (Part 12)
DeepSeek Harness's real bwrap/Landlock/Seatbelt/Windows-ACL sandbox chain — and four dated production incidents, with root causes, that shipped and got fixed.
DeepSeek Harness: Three Surfaces, One Spine — Web, Typert RPC, and SDK/ACP (Part 13)
How a browser, a typed RPC client, and an external SDK all reach the same running DeepSeek Harness process through one generated RPC layer.
Engineering Rigor: DeepSeek Harness's Verification Gate (Part 14)
The real coverage gates, test philosophy, and contributor rules behind DeepSeek Harness — including why 178 green tests still missed a real production bug.
DeepSeek Harness: What a Second Production Harness Teaches (Part 15)
DeepSeek Harness vs. Claude Code, problem by problem — six ideas worth stealing, and a Guides-vs-Sensors lens for auditing either one.
DeepSeek Harness: Agent Presets as Data, Not Code (Part 16)
DeepSeek Harness turned agent modes into directories, not classes — the design behind 300+ plugins in a day, vs. Claude Code's hardcoded agent types.