DeepSeek Harness

The only documented export is a per-session ZIP (session log, sub-sessions, attachments) downloaded through the browser. There is no import, restore or backup command, and no documented procedure for copying $DSH_HOME to another host. Session folders are keyed by absolute working-directory paths.

• session-log-export README
• CLI README (command table)
• session-persistence-jsonl README (path layout)

All state classes live in owner-held files under $DSH_HOME and nothing stays only with the provider: - sessions, KV storage, profile patches, .credentials.yaml, attachments, skills and AGENTS.md - integrations use API keys or owner-generated webhook secrets, not provider OAuth clients The documented export omits settings, credentials, skills, instructions and workspaces, and there is no restore route. The fail definition (classes held by the provider, or text-only export) is not met, so the test stays partial under G1.

• base bundle patch (storage paths)
• Configure models guide
• GitHub review guide

The runtime is MIT-licensed, with no licence key, login, remote-config fetch or update check in the CLI/Web path; the official build profile only embeds version strings. DeepSeek endpoints are all configurable or replaceable: - model API - default web_search provider (Exa and Perplexity plugins exist) - OTel collector (DSH_TELEMETRY_OTLP_URL, or disable) This is a desk grade; the provider-blocked run is hands-on.

• LICENSE
• base bundle patch
• client-build-environment.ts

Other providers are supported, and custom OpenAI Chat, OpenAI Responses and Anthropic Messages endpoints work at any base URL, including self-hosted ones. Capabilities are model-neutral: titles and compaction use the session route, and vision works for any model declared image-capable. However, there is no documented minimum model contract, no text-based tool-calling fallback, and no local open-weight model is named or tested (G12).

• Configure models guide
• llm-pi-ai README
• pi-ai provider e2e workflow

All agent state is kept locally under $DSH_HOME on the owner's machine, with no hosted account or sync. Termination of a DeepSeek account ends only model access and does not remove the owner's copy.

• home-paths README
• Desktop README (shared $DSH_HOME)

State is kept in open formats: - session logs are JSONL (zstd-compressed by default) with a public event catalog and JSON schema - KV storage is JSON - credentials and config are YAML - no encryption The catalog marks some fields as opaque: replayState, ReplayEnvelope.response, tool-private meta, and provider thinking signatures. Storage-domain schemas exist only as zod definitions in source.

• persistence catalog
• persistence schema
• session-persistence-jsonl README

The following are visible to the owner: - system prompt, dynamic context and compaction summaries are logged as session events - the per-request header with config and full tool schemas is logged, and the Trajectory view shows per-request system prompt and tools - `dsh --dump-config` shows every layer - DeepSeek's docs document what the `deepseek-flash` alias resolves to One shortfall is counted under G12: no public evidence settles whether the hosted API adds server-side context. Unevaluated `!!js` config expressions are recorded but not counted.

• System prompt subsystem
• ui-trajectory README
• CLI reference (--dump-config)
• DeepSeek API models & pricing

DeepSeek receives and holds several kinds of data about the owner's use: - by default, the uploaded session log: working directory, prompts, user and assistant content, tool arguments and results, feedback - request headers carrying a stable anonymous installation UUID and the plugin inventory - feedback-triggered OTel uploads of the session prefix DeepSeek's privacy policy gives only an 'as long as necessary' retention, and nothing lets the owner view that data item by item.

• DeepSeek LLM API wire extensions
• session-telemetry-otel README
• DeepSeek Privacy Policy

No paid placement or sponsored tools were found in source. The first-party defaults (DeepSeek model, DeepSeek-hosted web search) are disclosed in config and replaceable, and the plugin registry is plain npm with no ranking. The absence of steering in the hosted search and model results rests on no binding commitment.

• base bundle patch (web search default)
• plugin-manager registry.ts

The append-only session log records the following, and a tool does not run until its checkpoint write succeeds: - tool calls with full arguments - PTC sub-calls, subagents as child sessions, workflows - approvals and hooks One shortfall: by default, tool results over 12,500 tokens are replaced in the log by a head/tail preview. The full output goes to a temp spill file that is deleted after 30 days.

• persistence catalog (tool/call)
• session-checkpoint-policy README
• spill-policy README
• spill-local README

The session log has no hash chain, signatures or anchoring. The only integrity data is zstd's per-frame content checksum, which detects corruption but not deliberate edits. The SHA-256 values in the docs are schema-type fingerprints, not record integrity.

• session-persistence-jsonl zstd.ts
• persistence catalog

In the default workspace-write sandbox, writable roots are the workspace and temp directories, so ~/.dsh/sessions is normally out of reach. This protection is incidental rather than an explicit deny. It fails if the workspace contains $DSH_HOME, for example a workspace at the home directory, and the linked spill files sit in writable temp.

• sandbox roots.ts
• sandbox-local README

Source is available: - all required components are MIT source, with vendored Cordis - the native Landlock addon source is BSD-3, though it ships as prebuilt optional packages - the only closed dependency (Claude Agent SDK) sits in an optional, disabled subagent The npm publish job uses a token without `--provenance`, SLSA or sigstore, so a third party cannot tie the published build to the source.

• release-publish workflow
• scripts/release/publish.ts
• THIRD_PARTY_NOTICES

The only identity is a random anonymous installation UUID used to correlate telemetry and DeepSeek requests. It has no keypair, DID or signing, and actions are not attributable to it. The only other identity is the provider's DeepSeek platform account.

• anonymous-user-id README

Per-session changes are recorded as attributed events: model selection, permission and sandbox mode, preset, system-prompt snapshots, tool addition and removal. A session can be forked at any event. There is no history or rollback for global state (profile config, credentials, skills, AGENTS.md), and workspace file diffs cannot be reverted.

• session-controller README (fork atSeq)
• settings subsystem
• workspace-changes README

The owner can replace the whole system prompt through a preset persona with `complete: true`, adjust prompt prefix and suffix and plan-mode text in YAML, and edit AGENTS.md files; no default skills ship. Built-in tool descriptions for bash, read, write, edit and grep are hard-coded with no config field.

• system-prompt README
• persona README
• config catalog

The default Web offering has no built-in memory store the agent reuses across sessions; goals, todos and compaction are session-scoped. What does persist across sessions is plain files the owner can view, edit and delete: AGENTS.md instruction files and skill directories. Memory MCP servers are default-off examples.

• MCP memory guide
• goal subsystem
• skills subsystem

Owners can add any npm, git, tarball or local plugin, or MCP server, through `dsh plugin add` or the Plugins dialog without provider review. Built-in tools can be removed with documented profile-patch edits (`disabled: true`, or overriding a preset's plugin list).

• CLI reference
• ui-plugin-manager README
• standard preset patch

The owner can turn off the sandbox and approvals (danger-full-access preset), and can tune or disable the read-before-write check, the repeat-tool reminder and job caps. web_fetch's block on private and non-public destinations has no config switch.

• base bundle patch (sandbox/approval)
• web subsystem

The default model is the hosted alias `deepseek-flash`, whose target DeepSeek changes server-side; its docs show retired model names silently served by DeepSeek-V4.1-Flash. The documented launch `npx @deepseek-ai/dsh web` is unpinned, and no pin or pre-update notice is documented. Plugins do not auto-update.

• llm-deepseek README
• DeepSeek API models & pricing
• README (run)

Instruction sources are limited: the server binds to loopback with token auth, and schedules and webhooks are off; spend is treated as met under G11. Two limit dimensions are missing: - **Contact and egress:** web_fetch runs in every mode, and there is no per-domain allow or deny list. - **Data scope:** reads are not confined in any preset, so the agent can read .credentials.yaml.

• CLI reference (permission defaults)
• sandbox subsystem
• network proxy guide

Built-in gates cover a fixed set of classes: sandbox escalation, plugin_manager actions, and the ask/never mode. Gating an arbitrary tool needs a PreToolUse hook command (G3). In-process subagents run with approval `never`, so their asks are rejected rather than bypassed.

• approval subsystem
• hooks-claude-code README

Stop cancels the foreground turn and keeps queued input. Background jobs and continuable subagents need separate stops. Archiving a session stops all of its work, and the only global stop is killing the process.

• session-controller commands.ts
• jobs-local README
• ui-subagent README

By default (`enabled: true`) every official-API request carries the canonical session log. The only control is an opt-out switch labelled 'Help improve DeepSeek models and products'; DeepSeek's privacy policy lists training as a use, with opt-out only. Other flows: - one feedback click uploads the session prefix to a DeepSeek OTel collector; this can only be disabled by environment variable - data-term changes apply on notice

• session-log-deepseek src/index.ts (default true)
• ui-settings-session-log locales
• base bundle patch (OTel)
• DeepSeek Privacy Policy
• DeepSeek Open Platform Terms

Keys are stored in owner-held $DSH_HOME/.credentials.yaml. The UI is write-only for secrets and lets each provider credential be deleted. There is no single list of every credential: environment and .env credentials and the session-signing secret are not shown. Signing out of the DeepSeek account does not revoke the grant remotely.

• credentials subsystem
• deepseek-account-platform README

Sessions can be archived but never deleted, and there is no documented whole-agent deletion. No deletion route exists for session logs or OTel exports already uploaded to DeepSeek; withdrawing feedback exports a deletion event, not remote erasure.

• ui-workspace README (no session deletion)
• workspace README
• session-telemetry-otel README