Verified Sources

Verification snapshot

Item	Value
Repository	deepseek-ai/deepseek-harness
Verified revision	4e84901e6471b79ec0338099867ebb4606d12bb5
Root package version	0.1.2-alpha.4
Verification date	2026-09-02

All upstream links below are pinned to that revision. Later master behavior may differ; update the evidence map and the affected guide pages together.

Install, status, and toolchain

• Root README
  • developer-preview warning;
  • source install and build sequence;
  • pnpm dsh web as the source run path;
  • build artifacts are prepared separately and consumed without rebuilding.
• Root package metadata
  • package version;
  • ESM module type;
  • Node engine range;
  • pnpm version;
  • build and dsh scripts.
• Safety notice
  • experimental and unaudited status;
  • command, plugin, process, credential, file, and network risks;
  • sandbox limitations and least-privilege guidance.

CLI, Web, and providers

• CLI application README
  • single supported launcher;
  • profile modes;
  • profile paths and composition;
  • source execution.
• CLI behavior reference
  • Web flags and defaults;
  • loopback and wildcard-host behavior;
  • --trusted-host browser-trust fence;
  • shutdown, workspace-write, telemetry, plugin lifecycle, and source-build contracts.
• Web UI guide
  • provider setup;
  • workspace selection;
  • first task and approval behavior.
• Provider configuration guide
  • Models-page onboarding;
  • write-only credential behavior;
  • credentials and settings paths;
  • model selection, compatibility fields, and provider error codes.
• Browser connection and authentication
  • per-process launch token;
  • root exchange and clean redirect;
  • authority-bound cookie properties;
  • /api and Host checks;
  • public static-route boundary.

Configuration, persistence, and plugins

• Harness home paths
  • configured-path, DSH_HOME, and ~/.dsh precedence;
  • path normalization and symbolic display behavior.
• Base Bundle patch
  • $DSH_HOME/sessions JSONL root;
  • $DSH_HOME/storages JSON storage root;
  • default in-memory session-content index;
  • feedback-gated upstream telemetry composition.
• JSONL session persistence
  • append-only event storage, sharding, checkpointing, compression, and implementation-owned layout.
• Plugin development overview
  • Cordis Host composition and explicit Client boundary.
• Bundle configuration guide
  • Bundle manifest shape and patch operators.
• Generated configuration catalog
  • source-derived accepted fields and defaults for shipped plugins.

Architecture

• Architecture guide
  • Typert Loader tree;
  • Cordis Host graph;
  • App composition;
  • Host/Client plugin boundary;
  • package-layer direction and service registry model.

Loca deployment decisions

These requirements are operator policy, not upstream promises:

• public hosts deek.loca.zone and wiki.deek.loca.zone;
• backend 127.0.0.1:52320;
• Authelia one_factor on the browser surface;
• deek.service with DynamicUser=yes and ProtectHome=true;
• root-owned immutable /opt/deek/app runtime copy;
• DSH_HOME=/var/lib/deek and workspace /var/lib/deek/workspace;
• telemetry hard opt-out;
• no visibility into /home/loca and no ad hoc live plugin changes.

The operator contract is maintained in Operations and Service and Updates. Deployment assets live under deploy/ in the source checkout; this vault does not duplicate or silently override them.

Update rule

When the deployed revision changes:

1. reread every pinned source above at the new revision;
2. update factual pages and the quickstart where behavior changed;
3. update the revision and version on this page and Reference;
4. rebuild the wiki only after internal links and secret-safety checks pass;
5. never preserve a superseded behavior as though it were current.