DeepSeek Harness (dsh)

Install methods

• Not wired: agentseam records this agent but has no adapter for its hooks, so chock has nothing to wire.

Evidence wanted

Chock has not seen this agent run its hooks yet. If you use it, you can help: agentseam issue #189

What it can enforce

Tier

unadapted

Grade before a tool runs

none

Fail mode before a tool runs

n/a

Basis

vendor-docs

Recorded

2026-10-11

Ask support

The engine records no ask claim for this agent.

Hook timeout

The engine records no timeout for this agent.

Test status

• No row in the engine's list of live tests for this agent.

Known limits

Unadapted, not none: DeepSeek Harness has no hook surface of its own. Its documented command hooks are two experimental bridge plugins, switched off by default, that replay an existing Claude Code or Codex hooks.json. Through the Claude Code bridge the payload is Claude-shaped and carries transcript_path (always empty), one of the markers agentseam uses to recognise Claude Code, so detect() reads a dsh payload as claude_code (measured 2026-10-11) and no dsh adapter could claim it without a value-based probe, which is a core change. In that case a deny is honoured, because the bridge reads hookSpecificOutput.permissionDecision, but a transform is not: the bridge logs updatedInput as ignored and runs the original input, which is the silent pass the one rule forbids. dsh's own tools are lowercase read, write and edit, which are not in Claude Code's tool lists, so write policies would not see those calls as writes. Fail mode is open (any exit but 2 proceeds). dsh is not a supported target: do not point its bridge at an agentseam-installed .claude/settings.json and treat the result as a gate. Security caveat: CVE-2026-82533 (CNA VulnCheck, published 2026-09-08, CVSS 4.0 9.4): before 0.1.2-alpha.1, the loopback control API at 127.0.0.1:3080 trusted a client-supplied loopback Host header instead of the real connection origin, so a sandboxed tool process could call it to switch itself to danger-full-access with approvals off; fixed in 0.1.2-alpha.1. dsh also speaks ACP (dsh-acp), a client-agent protocol, not a hook surface. Instruction files reach it through AGENTS.md. Evidence wanted (to test or overturn this row): https://github.com/open-coder-ai/agentseam/issues/189