Architecture

Upstream structure

DeepSeek Harness is an ESM monorepo. Its runtime is composed rather than hard-wired:

• Typert extensions form a Loader tree.
• The Loader maps that tree into a Cordis service graph.
• An App is itself a Cordis plugin composed into the same context as the Host.
• Profiles select ordered Bundle patch layers, then user patch layers.
• Agent runtime packages provide sessions, model routing, tools, permissions, sandboxes, subagents, and persistence.
• Host plugins can optionally declare explicit Client plugins. Browser code receives only serializable client services; it does not directly import Host-only implementations.

The single Node launcher is dsh. dsh web selects the shipped Web profile, loads built Host and frontend artifacts, and serves the browser application.

Request and execution path

flowchart LR
  B[Authenticated browser] --> A[Authelia one_factor]
  A --> N[nginx at deek.loca.zone]
  N --> W[Web profile on 127.0.0.1:52320]
  W --> C[Cordis host and profile bundles]
  C --> G[Agent loop]
  G --> M[Model provider]
  G --> T[Tools and subagents]
  T --> X[Dedicated workspace]
  C --> S[DSH_HOME state]

The first two nodes and nginx are loca deployment layers. Upstream owns the Web profile, browser token exchange, Cordis graph, agent loop, providers, tools, and state services.

Browser boundary

Upstream separates browser bootstrap from API authentication:

1. the process generates a launch token;
2. GET / accepts that token and redirects to a clean URL;
3. the response sets an authority-bound, host-only, HttpOnly, SameSite=Strict cookie;
4. /api requires the cookie and an accepted Host authority;
5. static assets and non-/api routes remain public in the upstream server model.

Loca therefore gates the entire browser surface with Authelia and passes only the exact public authority through --trusted-host deek.loca.zone. Authelia identifies the human at the edge; the upstream cookie authenticates the browser process session.

Data boundary

flowchart TD
  R[Root-owned /opt/deek/app] --> P[deek.service]
  P --> H[DSH_HOME /var/lib/deek]
  H --> Q[Profiles and patches]
  H --> K[Managed credentials]
  H --> J[Session JSONL]
  H --> D[JSON storage domains]
  P --> W[/var/lib/deek/workspace]
  P -. blocked by ProtectHome .-> O[/home/loca]

/opt/deek/app is immutable to the process. /var/lib/deek is the persistent service state boundary. The workspace is intentionally writable and contains only material accepted for agent access. /home/loca is not visible.

Upstream workspace-write confines mutations to the selected workspace and platform temporary roots, but it does not confine reads or network access. Host mounts, environment, sockets, credentials, and outbound policy remain operator responsibilities.

Lifecycle boundaries

• pnpm run build creates required package and frontend artifacts.
• pnpm dsh launches without rebuilding or checking artifact freshness.
• Bundle membership is loaded at process start; add/remove/update requires restart.
• Valid profile/home patches can hot-reload when the profile declares patchReload: live.
• Provider/model settings apply on the next request.
• Existing sessions retain their recorded model after the first request.
• Service restart rotates the per-process launch token, but the cookie-signing secret persists in $DSH_HOME/.credentials.yaml; existing valid cookies survive unless the client-connection/browser-session credential is rotated or deleted before restart.

Trust summary

Component	Trust assumption
Authelia and nginx	Enforce the outer identity and loopback-only routing policy.
Harness Host and shipped Bundles	Trusted application code, still developer-preview and unaudited.
External Bundle	Fully trusted host code after explicit review.
MCP server command	Trusted executable outside the agent sandbox.
Model output	Untrusted; may propose or drive destructive actions.
Workspace content	Untrusted input deliberately exposed to the agent.
Provider key and state	High-sensitivity data; never part of runtime source or workspace.

See Verified Sources for the upstream documents supporting this map.