On August 13, 2026, DeepSeek released "DeepSeek Harness," an open-source AI agent execution framework, as a developer preview. Like models and tools, sessions and sandboxes are also treated as plugins. The agent loop and user interface are also subject to swapping. This separates the parts that determine an AI agent's behavior from a fixed product, turning them into components that can be reconfigured through configuration. That said, the official repository explicitly states that breaking changes are coming, so at this point it's a release for testing the design philosophy rather than a finished product.
From model to UI, swappable via configuration
What DeepSeek Harness turned into plugins isn't limited to connection points for external tools. The official site lists models, tools, and skills as swappable. Sessions and storage, as well as sandboxes, are also separated out, and the same mechanism has been applied to the execution loop, scheduling, and UI. According to the architecture documentation, in addition to model adapters and tool registries, session logs and the agent loop can also be replaced via configuration. Developers can swap existing plugins or add new capabilities without rewriting the Harness core itself.
At startup, multiple "bundles" are layered in sequence to assemble a named "profile." The base bundle contains model connections, tools, and persistence. The sandbox and approval policy, along with credentials and telemetry, are handled by the same layer. Web apps and headless execution are layered on top of that. Since the configuration lines at each layer can be replaced via patches, you can, for example, switch the local filesystem and process execution over to a remote sandbox all at once.
The official distribution includes four execution modes for different use cases.
| Mode | Primary role |
|---|---|
| Standard | A coding agent equipped with file operations, shell, and search, also capable of planning and using sub-agents |
| Code | Bundles multiple rounds of tool calls together from model-generated code |
| Minimal | Keeps only shell and file editing, for evaluating models in a minimal environment |
| Creator | Inspects the running configuration and tests Cordis plugins in memory to create new presets |
These four modes are not separate products. The fact that the same set of components can be launched in different configurations is itself a demonstration of the plugin design. With Node.js installed, you can launch the Web UI with npx @deepseek-ai/dsh web, and a method for building from the MIT-licensed source is also published.
Cordis undoes the attaching and detaching of components
When everything is split into components, there's an increased risk that removing a component leaves behind event listeners or timers, causing another component to lose its dependency. DeepSeek Harness handles this problem through the underlying meta-framework "Cordis." The accompanying paper, by Yifan Shi, Wei Zhang, and Tianyi Cui of Peking University and DeepSeek-AI, sets two conditions for dynamic configuration: "temporal composability," which rolls back side effects when a component is removed, and "spatial composability," which declares dependencies between components so they can track changes.
In Cordis, plugins register tools and event listeners through a context. Deregistration logic is tied to registration, and when unloading occurs, things are rolled back in reverse order of execution. For resources requiring individual cleanup, such as network connections, developers return a disposer via ctx.effect(). Plugins that use other services declare their dependency targets with inject, and Cordis waits to load them until the necessary services are in place.
The paper cites Visual Studio Code as a point of comparison. According to Marketplace data the authors collected on June 9, 2026, of the top 100 extensions by install count, 87 contained executable code, and only 7 declared dependencies on non-built-in extensions. VS Code's extension host cannot unload individual executable code on the spot; disabling or deletion requires restarting the host. What Cordis aims for is recovering side effects and dependencies at the feature level, instead of shutting down the entire process.
Reassembling execution from an append-only log
DeepSeek Harness also turned the agent's execution history into a swappable component. The system prompt and inference information received from connected sources are recorded in an append-only session log. Tool calls, results, and sub-agent assignments also go into the same log. Context injection is no exception. It establishes a runtime invariant stating that the content passed to the model must be reconstructable from the log, so the conversation display alone is not treated as the authoritative record of history.
A single model request and its accompanying tool execution are recorded as a "step," and a process consisting of multiple steps is recorded as a "turn." Resumption, branching, search, and replay are all derived from the same event sequence. Transcripts and telemetry don't maintain separate histories either. With this design, the meaning of execution records is more likely to be preserved even when the UI is swapped, and failed tool calls or context passed to the model can be traced within the same sequence.
Richer logging also expands the scope of information being stored. DeepSeek's data handling explanation states that input, model output, and session context are stored on the user's device by default. Tool execution results, file paths, and API keys are also included, and none of this is sent to servers without consent. However, if external models or web tools are configured, data may be sent to those connected destinations. The same applies to MCP services and external plugins. The local-first nature is not a guarantee that automatically localizes even the services it incorporates.
Three boundaries remaining in the release candidate
The package as released is a release candidate, and the official README warns of upcoming changes that will break API and configuration compatibility. What plugin authors should be tracking now is not the number of features, but at what stage service identifiers and event contracts will be locked down. Armin Ronacher, who leads development of the Pi agent, also commented on August 14 that while it isn't perfect, there's a freshness to it that makes you want to reconsider design choices in this field.
Cordis itself has boundaries to its guarantees. First, it can only roll back to the state that the framework can track. Data already sent externally, or files updated by third parties, cannot be automatically restored, and applications need to either delay transmission or provide compensating processes equivalent to deletion or refunds. Second, while dependency declarations can restrict access to services, isolating malicious code from the host environment requires a separate sandbox.
The third boundary is compatibility between plugins. The Cordis paper acknowledges that with independently developed components, problems remain where an interface with the same identifier changes across versions, and unrelated services conflict by using the same identifier. The current implementation handles version constraints via npm's peer dependencies, but it cannot enforce that providers actually adhere to semantic versioning.
The value of DeepSeek Harness will be measured not by differences in model performance, but by how safely the components that make up an agent can be swapped. Whether sessions can continue after a stable API is released and external plugins are attached or detached during runtime, and whether operators can verify the boundaries of permissions and logs, will determine whether this progresses from a design philosophy to a practical framework.