Huanqi Cao
1d56bd5628
A denial this backend cannot explain — the confined child cannot open an object it was granted, or provisioning itself fails with Win32 5 — reached the user as a bare "Access is denied". The README documented both causes but shipped no way to tell them apart. Add the `diagnose-windows-sandbox-acl` skill. Its script reads unless a repair switch is passed, and classifies the failing path and its ancestors before anything changes; its two repair modes are the only supported ACL edits. `-Fix` removes a foreign package-SID allow ACE, and `-GrantFullControl` supplies the WRITE_DAC/WRITE_OWNER pair the mandatory-label write needs without ever changing an owner. Both require `-AllowRoot`, refuse a target outside it, and refuse to run together. `dsh-sandbox-local` registers the skill on Windows through `ctx.inject(['skills'], ...)`, so the skill registry stays optional and the sandbox never depends on it. The assets ship in this package's `files` list, which the workspace-constraints gate now pins alongside the runner and emitted-type entries. Tests cover the script's verdicts (foreign ACE, healthy object, inert capability SID, inert DENY ACE), its surgical removal, the grant's owner invariant, and both refusals; the catalog spec covers registration and disposal.
DeepSeek Harness
English | 中文
DeepSeek Harness (dsh) is an open-source agent harness developed by DeepSeek AI.
It is built on an everything-is-a-plugin architecture and powered by Cordis, whose design is described in A Programming Paradigm for Spatiotemporal Composability.
Documentation: https://deepseek-harness.github.io/deepseek-harness/
Developer preview
DeepSeek Harness is in developer preview and iterating rapidly. THERE WILL BE COMPATIBILITY-BREAKING CHANGES.
Review the safety notice before running the project.
Run
Run from npm
Install Node.js, then run:
npx @deepseek-ai/dsh web
The command starts the Web UI at http://127.0.0.1:3080 by default and opens it in the default browser for a local launch. An SSH launch only prints the host URL because the SSH client or editor owns the local forwarded address. Pass --no-open to run the server without opening a browser. See Web UI guide.
Run from source
To run from a repository checkout:
git clone https://github.com/deepseek-ai/deepseek-harness.git
cd deepseek-harness
pnpm install
pnpm run build
pnpm dsh web
pnpm run build prepares the repository artifacts. pnpm dsh web uses those built artifacts without rebuilding.
Community and support
- Submit feedback or bug reports through GitHub Discussions.
- Add the
dsh-plugintopic to your plugin repository for discoverability. - Join DeepSeek Harness Discord community.
Contributing
See CONTRIBUTING.md.
Development
Start with the development guide and architecture documentation.
pnpm run dev:web builds, serves, and rebuilds client bundles on source edits in one terminal, and make help lists the matching Make targets for Web and Desktop; the guide's application commands section owns the full table.
For agents, follow AGENTS.md.
Citation
@misc{deepseek-harness2026,
title={DeepSeek Harness: Everything is a Plugin},
author={DeepSeek-AI},
year={2026},
publisher={GitHub},
howpublished={\url{https://github.com/deepseek-ai/deepseek-harness}},
}
License
Third-party dependencies and their licenses are disclosed in THIRD_PARTY_NOTICES.md.