# deepseek-harness-everything-is-a-plugin-2026-08-13

## Veille

Official product page from **DeepSeek**, published on **August 13, 2026**, **unsigned**, ~450 words, announcing the *developer preview* release of **DeepSeek Harness** (`dsh`) — a coding-agent harness **open source under the MIT license**, whose repository opened the same day. A three-word thesis, repeated in the title and in the repository description: *« Everything is a plugin »*, paired with a second promise, *« Every run is traceable »*. The page states the equation *« AGENT = MODEL + HARNESS »* and lists the pluggable capabilities — *« models, tools, skills, sessions, sandboxes, storage, loops, scheduling, and the UI »*. Four modes ship: **Standard** (full coding agent), **Code** (tools exposed via the *Code Mode SDK*, letting the model compose multi-step operations inside a TypeScript program), **Minimal** (*« two-tool coding agent with persistent bash and str_replace_editor »*, explicitly *« for benchmarking models in a minimal environment »*), and **Creator** (runtime inspection, in-memory plugin testing). The technical substance sits in the repository, not on the page: `docs/architecture.md` states a logging invariant — *« Model-visible means logged. Anything that reaches a model request must be reconstructable from the log, and a runtime invariant asserts it »* — and states that *« there is no privileged core to patch »*. The technical core is not DeepSeek's own: DSH is built on **Cordis** (the `cordiverse` project, a third party), **vendored** into `vendor/` with a manifest and a sync procedure, and the page places the *« Cordis paper »* at the same navigation level as "GitHub" and "Developer docs". Two LLM adapters ship — `dsh-llm-deepseek` and `dsh-llm-pi-ai`, a generic multi-provider adapter. The repository warns in capitals: *« THERE WILL BE COMPATIBILITY-BREAKING CHANGES »*, and `CLAUDE.md` specifies that `SESSION_FORMAT_VERSION` stays at `0` *« with no compatibility promise »*, with backends rejecting old on-disk formats. Timeline: DSH ships on the day **DeepSeek-V4-Pro reaches GA**, three days before a new API pricing schedule takes effect on **August 16, 2026 at 16:00 UTC**, with peak/off-peak rates and an off-peak discount of **−50%**.

## Titre Article

DeepSeek Harness developer preview: Everything is a plugin

## Date

2026-08-13

## URL

https://deepseek.com/harness/en/

## Keywords

DeepSeek Harness, dsh, agent harness, agent harness, everything is a plugin, Cordis, cordiverse, spatiotemporal composability, vendoring, plugin, mounting and unmounting, reversible effects, typed services, shared context, profile, bundle, dsh-base, dsh-web-app, dsh-headless, dump-config, MIT license, open source, developer preview, breaking changes, SESSION_FORMAT_VERSION, append-only session log, SessionEvent, deriveMessages, model-visible means logged, runtime invariant, traceability, replay, resume, fork, turn, step, agent/pre-step, llm/stream, tools/execute, waterfall, capability seam, capability seam, Service Definition, Service Provider, LLM adapter, dsh-llm-deepseek, dsh-llm-pi-ai, OpenAI-compatible gateway, Standard mode, mode Code, mode Minimal, Creator mode, Code Mode SDK, str_replace_editor, persistent bash, subagent, workflow, compaction, skill, MCP, ACP, LSP, E2B, sandbox, hooks, DeepSeek-V4-Pro, GA, OpenAI Responses API, Codex, peak/off-peak pricing, Safe Use Policy, prompt injection, Claude Code, CLAUDE.md, AGENTS.md, benchmarking harness, BENCHMARK.md

## Authors

**DeepSeek** (DeepSeek AI, laboratoire chinois), en tant qu'institution. Page produit **non signée** : aucun auteur, aucun ingénieur mis en avant, aucun billet de blog ni papier technique associé. Le « nous » n'apparaît qu'une fois, en dernière phrase — *« We look forward to exploring the limits of intelligence with developers worldwide »*. Publiée le **13 août 2026**. La page est rendue en JavaScript : `curl` sur l'URL renvoie **HTTP 202 avec un corps vide**, le texte n'existant qu'après exécution du bundle. Deux documents de politique sont liés en pied de page — *Safe Use Policy* et *Data Processing Statement*.

## Ton

**Profile**: a model lab's product launch page, in an abridged architecture-note register — short, declarative, no superlatives, no figures, no named competitor. Audience: **harness developers**, not end users; the address is explicit from the standfirst onward (*« for agent harness developers worldwide »*).

**Style**: the thesis fits in one noun phrase repeated verbatim — *« Everything is a plugin »* is the H1 title, the repository description, and the design section's heading; the list of pluggable capabilities is likewise repeated word for word in three places. There is a single metaphor across the whole page, anchored to the capitalized equation *« AGENT = MODEL + HARNESS »*: *« The model is the soul of an agent. »* The absence of any comparison is total — no Claude Code, no Codex, no Cline, no OpenCode, no benchmark, no price — and the closing call is addressed not to users but to contributors (*« Join the DSH plugin ecosystem »*). The admission of instability escalates depending on the medium: the page says *« remains in developer preview […] Its core plugins and APIs will continue to evolve »*, the repository says, in bold capitals, *« THERE WILL BE COMPATIBILITY-BREAKING CHANGES. »* The repository's prose belongs to a different register, dense and free of filler: *« There is no privileged core to patch »*, *« registrations are effects that unwind when their plugin unloads »*, *« Model-visible means logged »*, *« Seams are why one provider swap changes the whole product »*. It also contains this recommendation, which dates the document: *« We recommend using an agent to explore the codebase and understand its architecture. »*

**Marker phrases**:
- ***« Everything is a plugin »*** · ***« Every run is traceable »***
- ***« Agent = Model + Harness »*** · ***« The model is the soul of an agent »***
- ***« select, swap, or extend any capability in configuration without changing the DeepSeek Harness source code »***
- ***« Everything the model sees is recorded in an append-only session log »***
- ***« Resume, fork, search, and replay all operate on the same event stream »***
- ***« There is no privileged core to patch »*** (repository)
- ***« Model-visible means logged »*** (repository)
- ***« THERE WILL BE COMPATIBILITY-BREAKING CHANGES »*** (repository)

**Epistemic position**: an interested party that publishes its code. The page is unverifiable on essentially every count, but it also asserts almost nothing verifiable — it contains no benchmark, no comparison, no price, no version number, not even a mention of a specific DeepSeek model. The repository, by contrast, is testable claim by claim. That is where the evaluation shifts.

## Pense-betes

- **Date / source**: **August 13, 2026**, product page `deepseek.com/harness`, unsigned. Repository `deepseek-ai/deepseek-harness` opened the same day under **MIT**.
- **Key framing**: plugin-based composability is unremarkable in 2026; the distinctive element lies elsewhere, in `docs/architecture.md` rather than on the sales page. ### The logging invariant > *« **Model-visible means logged.** Anything that reaches a model request must be reconstructable from the log, and a runtime invariant asserts it. This is why a new model-visible input requires a new session event: extend `SessionEventMap` and render from the log. »* Three properties follow from this. It is an **executable constraint**, not a stated intention: the harness fails if context reaches the model without being written to the log. The log becomes the **source**, not a record of events — `deriveMessages()` projects the model's history from the stream, and *« Fork, resume, transcripts, telemetry, and persistence all derive from this stream »*, with no parallel state to fall out of sync. Finally, it is an engineering answer to the question every agentic-incident post-mortem asks: what did the agent actually see? An extractable criterion for anyone evaluating a harness: *is everything that reaches the model reconstructable from a single log, and is that property asserted at runtime?* ### Traceable is not archivable | Where | What is written | |---|---| | Product page | *« Every run is traceable »* — resume, fork, search, replay on the same stream | | `README.md` | *« THERE WILL BE COMPATIBILITY-BREAKING CHANGES. »* | | `CLAUDE.md` | *« `dsh-session` keeps `SESSION_FORMAT_VERSION` at `0` with no compatibility promise »* ; *« Backends reject old on-disk formats »* | Concretely: a session recorded today can become unreadable after an update, with the backend actively rejecting it rather than attempting a migration. The stance is deliberate and dated — *« Pre-release stance: foundation over blast radius. Remove this section at the first tagged release. With no external consumers, prefer the correct foundation over compatibility shims »*. Practical rule: do not base compliance, audit, or retention on DSH logs before the first tagged release; the marker to watch for is the disappearance of the *« Pre-release stance »* section from `CLAUDE.md`, which DeepSeek itself designates as the signal. ### The timeline | Date | Event | |---|---| | **August 13, 2026** | DSH published under MIT + **DeepSeek-V4-Pro reaches GA** (`DeepSeek-V4-Pro-0813`), native support for the **OpenAI Responses API**, optimized integration for **Codex** | | **August 16, 2026, 16:00 UTC** | New API pricing schedule: peak / off-peak rates, *« Off-peak rates are 50% lower than peak »* | | **August 14, 2026** | Z.ai announces GLM-5.3 with the same time-of-day pricing scheme — [[zai-glm-53-emergent-cyber-2026-08-14]] | The harness is given away, inference is made pricier: an MIT harness capable of routing to any provider only has value for DeepSeek if it generates token volume. Two caveats: the roughly 4.5× figure on V4-Pro output-token pricing comes from the press, not from the API announcement, which publishes only the principle and the −50%; and a schedule pegged to an Asian time zone shifts the real cost for a European team. ### « Everything is a plugin »: state of play on August 13 | Layer | What ships | Status | |---|---|---| | **Models** | `dsh-llm-deepseek` (route `deepseek-official`) and `dsh-llm-pi-ai`, a generic multi-provider adapter built on `@earendil-works/pi-ai` | held — *« an OpenAI-compatible gateway, a self-hosted server, or a provider newer than the installed catalog is configuration, not a code change »* | | **Execution / sandbox** | seams `ctx.fs`, `ctx.shell`, `ctx.subprocess`, `ctx.sandbox`; **E2B** POC | mechanism in place, one remote backend at POC stage | | **UI / distribution** | bundles `dsh-base`, `dsh-web-app`, `dsh-headless`; `web` and `headless` profiles | held | | **Agent loop** | `core/agent-loop` described as *« the default driver »* behind the `Agent` interface | held by construction | | **Third-party ecosystem** | `dsh-plugin` topic, "Community plugins" page | to watch — no ecosystem exists at day zero | The sentence that makes the promise credible is architectural: *« There is no privileged core to patch: you extend dsh by mounting a plugin beside the others, and registrations are effects that unwind when their plugin unloads. »* Operational corollary: *« Seams are why one provider swap changes the whole product. Filesystem and subprocess providers share one execution world, so pointing them at a remote sandbox moves Bash, PTY, and LSP with them, with no provider forks. »* A principle reusable outside DSH: a seam exists only if the three roles — Service Definition, Service Provider, Consumer — are designed together, *« one role alone is not a seam »*. Verification in one command: `dsh --profile web --dump-config` prints the tree that actually started, and *« any row it prints can be replaced by a patch of your own »*. ### Mode Minimal Shipped *« for benchmarking models in a minimal environment »*, with `BENCHMARK.md` pointing to the `jsonrpc-agent` variant of the Python SDK. The context clarifies the intent: the next day, a Chinese lab documented measuring its model and its competitors' models *« in Claude Code 2.1.207 »*, with a competitor's harness serving as shared measurement infrastructure. DSH ships the minimal benchmarking harness inside the product, under MIT. Caveat: as of August 13 no score has been published, and nothing indicates that a third party has adopted this harness. Underlying portability stakes: [[janakiram-agent-platform-portability-contract-2026-07-20]]. ### The core belongs to a third party DSH is built on **Cordis** (`cordiverse`, an independent project), whose design is published in a third-party paper — *A Programming Paradigm for Spatiotemporal Composability*. In the repository, Cordis is vendored (`vendor/cordis` and nine sibling modules: `cosmokit`, `hmr`, `loader`, `schemastery`, `timer`…) with a manifest and a sync procedure. Three readings hold simultaneously: DeepSeek credits its dependency rather than rebranding it; vendoring freezes the version and removes the availability dependency, at the cost of a sync burden to maintain; and the product's central argument rests on the intellectual property of a community project DeepSeek does not control. For anyone assessing DSH's staying power, the health of `cordiverse/cordis` is a variable at least as important as that of DeepSeek's own repository. ### The Safe Use Policy > *« Because Harness has the ability to run code and execute actions on your machine, it introduces unique security risks. Although most foundation models include **basic** safeguards against prompt injection, inherent risks remain […] In some cases, the Agent may execute commands embedded in content, even if those commands conflict with the assigned task. »* The recommended precautions form a usage doctrine applicable independently of DSH: a dedicated virtual machine; verifying outputs; not supplying sensitive or confidential information; requiring human approval for any operation with significant effects; breaking complex instructions into isolated operations, to *« reduce the risk that a single erroneous command affects multiple parts of the system simultaneously »*; installing only plugins, MCP servers, Skills, Hooks, and dependencies from trusted, reviewed sources. That last line stands in tension with the sales pitch: the attack surface grows with composability. See [[valente-zalewski-beyond-zero-enterprise-security-ai-era-2026-07-20]]. ### `turn` / `step` modeling, worth borrowing *« A **step** is one model request plus the tools it calls. A **turn** is zero or more steps: it opens before its first input is claimed and closes once nothing is owed. »* The complete flow is published: `turn/start` → `agent/pre-step` → `step/start` → `agent/request` → `llm/stream` → `tool/call*` → `tools/pre-execute|execute|post-execute` → `step/end` → `agent/turn-stopping` → `turn/end`, with three distinguished extension domains — *session events* (durable facts surviving a reload), *agent events* (interception of in-flight work), *capability events* (policy and adapters on a seam, *« without importing the loop »*). Two design details drawn from real operational experience: *« a rejected or empty first claim still closes a durable turn that spent no step, so the log records the attempt »* — the turn that did nothing is still logged, without which the rejection would be invisible to a post-mortem; and the distinction between **waterfall** (`agent/pre-step`, `agent/request`, `llm/stream`, `tools/*`, where listeners must call `next()`) **vs serial** (`agent/turn-stopping`, with no `next()`), which makes the delegation contract explicit per event. ### Repository detail The root tree of `deepseek-ai/deepseek-harness` contains `CLAUDE.md` (a verbatim copy of `AGENTS.md`), `.claude/skills`, and an `.agents` directory. An open source repository published in 2026 by a frontier lab documents its conventions for agents on the same footing as for humans: a repository standard worth adopting. ### Citation hygiene 1. **Distinguish the page from the repository.** The strong claims come from `docs/architecture.md`, `CLAUDE.md`, and package `README.md` files. Cite *« DSH's architecture documentation »*, never *« the launch page »*. 2. **120,060 stars and 11,831 forks in three days** (recorded on August 16, 2026 via the GitHub API) measure attention, not adoption, and are perishable. 3. **The rates are not in the archived announcement**: cite the peak/off-peak principle and the −50%, source the $/M figures elsewhere. 4. **« Open source » here means MIT and nothing more**: no open governance, no public roadmap, no compatibility commitment. Open code published by a vendor, not a community project — a distinction examined in [[mozilla-state-of-open-source-ai-2026-07]].

## RésuméDe400mots

Product launch page published on **August 13, 2026** by **DeepSeek**, **unsigned**, for the *developer preview* release of **DeepSeek Harness** (`dsh`), a coding-agent harness **open source under the MIT license** whose repository opened the same day.

**What the page says.** Two promises, in four hundred words and without a single figure. **« Everything is a plugin »**: every capability — models, tools, skills, sessions, sandboxes, storage, loops, scheduling, interface — is a plugin **swappable through configuration, without modifying the source code**. **« Every run is traceable »**: everything the model sees is recorded in an **append-only session log** — system prompts, reasoning, tool calls and results, subagent scheduling, every context injection — and *« resume, fork, search and replay all operate on the same event stream »*. The core is **Cordis**, a vendored third-party framework, described in an external paper and credited prominently. Four execution modes ship: **Standard** (full tooling), **Code** (tools exposed via a TypeScript SDK to combine several operations into one program), **Minimal** (two tools, persistent bash and `str_replace_editor`, *« for benchmarking models in a minimal environment »*), and **Creator** (runtime inspection, in-memory plugin testing, composition of new modes). Getting started: `npx @deepseek-ai/dsh web`.

**What the page does not say.** The strongest claim sits in `docs/architecture.md`: ***« Model-visible means logged. Anything that reaches a model request must be reconstructable from the log, and a runtime invariant asserts it. »*** **A guarantee asserted at runtime**, not a display claim — this is the property that actually sets DSH apart, and it is absent from the marketing copy. The same repository supplies the rebuttal: `SESSION_FORMAT_VERSION` stays at **`0` with no compatibility promise**, *« backends reject old on-disk formats »*, and the README warns in capitals that there will be breaking changes. **Traceable today does not mean archivable tomorrow.**

**The business model is in the timeline.** DSH ships on the day of **DeepSeek-V4-Pro's GA** and **three days before** a new API pricing schedule (August 16, 16:00 UTC; off-peak rates at **−50%**). **Harness given away, inference made pricier** — the exact reverse of Anthropic's model.

**What checks out.** Swappability holds at least at the model layer: besides the DeepSeek adapter, **`dsh-llm-pi-ai`** makes any OpenAI-compatible gateway accessible *« by configuration, not by code change »*. And the mode Minimal ships the **benchmarking harness** inside the product — an attempt to wrest the definition of the benchmark away from Claude Code, even as DSH's own repository contains a `CLAUDE.md` and a `.claude/skills`.

## GrapheDeConnaissance

- DeepSeek —publie→ DeepSeek Harness (TECHNOLOGIE, 0.98)
- DeepSeek Harness —est_instance_de→ Harness (CONCEPT, 0.97)
- DeepSeek Harness —est_basé_sur→ Cordis (TECHNOLOGIE, 0.98)
- Cordis —permet→ de faire contribuer des services, des événements typés et des effets réversibles à un contexte partagé, chaque enregistrement se dénouant au démontage de son plugin — « there is no privileged core to patch » (AFFIRMATION, 0.94)
- Cordis —est_basé_sur→ A Programming Paradigm for Spatiotemporal Composability (DOCUMENT, 0.92)
- tout est plugin —s_applique_à→ toute capacité d'agent — modèles, outils, skills, sessions, sandboxes, stockage, boucles, ordonnancement et interface — chacune sélectionnable, remplaçable ou extensible par configuration sans modifier le code source du harnais (AFFIRMATION, 0.96)
- DeepSeek Harness —utilise→ tout est plugin (CONCEPT, 0.97)
- log de session append-only —permet→ d'enregistrer tout ce que le modèle voit — prompts système, raisonnement, appels d'outils et résultats, ordonnancement des subagents et chaque injection de contexte — la reprise, le fork, la recherche et le replay opérant tous sur le même flux d'événements (AFFIRMATION, 0.95)
- DeepSeek Harness —utilise→ log de session append-only (CONCEPT, 0.97)
- log de session append-only —affirme_que→ tout ce qui atteint une requête modèle doit être reconstructible depuis le journal, un invariant runtime l'assurant — « Model-visible means logged » (CITATION, 0.94)
- log de session append-only —s_oppose_à→ l'archivage durable tant que SESSION_FORMAT_VERSION reste à 0 sans promesse de compatibilité et que les backends rejettent les anciens formats sur disque (AFFIRMATION, 0.9)
- DeepSeek Harness —s_oppose_à→ toute promesse de stabilité en préversion : le dépôt avertit en capitales qu'il y aura des changements cassant la compatibilité (AFFIRMATION, 0.95)
- couture de capacité —affirme_que→ une capacité substituable n'existe que si ses trois rôles sont conçus ensemble — Service Definition, Service Provider et Consumer — un seul rôle ne faisant pas une couture (AFFIRMATION, 0.93)
- couture de capacité —permet→ qu'un seul remplacement de fournisseur change tout le produit : systèmes de fichiers et sous-processus partageant un même monde d'exécution, les pointer vers un sandbox distant y déplace Bash, PTY et LSP sans fork de fournisseur (AFFIRMATION, 0.92)
- DeepSeek Harness —utilise→ couture de capacité (CONCEPT, 0.94)
- DeepSeek Harness —utilise→ pi-ai (TECHNOLOGIE, 0.93)
- pi-ai —permet→ de déclarer un gateway OpenAI-compatible, un serveur auto-hébergé ou un fournisseur plus récent que le catalogue installé comme de la configuration plutôt que comme un changement de code (AFFIRMATION, 0.92)
- mode Minimal —fait_partie_de→ DeepSeek Harness (TECHNOLOGIE, 0.96)
- mode Minimal —permet→ d'évaluer des modèles dans un environnement minimal réduit à deux outils, un bash persistant et str_replace_editor (AFFIRMATION, 0.94)
- mode Minimal —concurrence→ Claude Code (TECHNOLOGIE, 0.82)
- Claude Code —observé_dans→ le dépôt de DeepSeek Harness, qui embarque un CLAUDE.md et un répertoire .claude/skills aux côtés d'AGENTS.md (MESURE, 0.9)
- mode Code —fait_partie_de→ DeepSeek Harness (TECHNOLOGIE, 0.95)
- mode Code —permet→ d'exposer les outils via le Code Mode SDK pour que le modèle combine des opérations multi-étapes dans un seul programme TypeScript (AFFIRMATION, 0.93)
- DeepSeek —publie→ DeepSeek-V4-Pro (TECHNOLOGIE, 0.95)
- DeepSeek —affirme_que→ la nouvelle grille tarifaire de l'API entre en vigueur le 16 août 2026 à 16:00 UTC avec des tarifs heures pleines et heures creuses, les heures creuses étant 50 % moins chères que les heures pleines (MESURE, 0.92)
- DeepSeek Harness —permet→ de découpler la valeur du harnais de celle du modèle : publié sous MIT le jour même de la disponibilité générale de DeepSeek-V4-Pro et trois jours avant une hausse des tarifs d'API, il fonctionne comme produit d'appel vers l'inférence facturée (AFFIRMATION, 0.85)
- Safe Use Policy —affirme_que→ l'agent peut, dans certains cas, exécuter des commandes embarquées dans le contenu qu'il lit, même lorsque ces commandes entrent en conflit avec la tâche assignée (CITATION, 0.95)
- Safe Use Policy —recommande→ une machine virtuelle dédiée, la vérification des sorties, l'absence d'information confidentielle, une approbation humaine pour toute opération à effet significatif, le découpage des instructions complexes en opérations isolées, et de n'installer que des plugins, serveurs MCP, Skills et Hooks issus de sources fiables et revues (AFFIRMATION, 0.94)
- DeepSeek Harness —mesure→ 120 060 étoiles et 11 831 forks sur GitHub au 16 août 2026, soit trois jours après l'ouverture du dépôt — un signal d'attention et non d'adoption (MESURE, 0.88)

---
Canonical: https://www.thekb.eu/en/fiches/deepseek-harness-everything-is-a-plugin-2026-08-13/