2nd dokployH
db6aed0459
Codex confirmation-round finding: an OUTERMOST prepend pre-execute deny skips the runtime's own pre-execute clear, and the denied call still reaches post-execute — so a reused adapter-minted call id could promote an orphaned stage on the default accept path. The stage is now keyed by the ToolExecution OBJECT identity, the one token that provably ties a stage to one pipeline trip: only the execution whose own body staged can commit, whatever any call id says. The pre-execute clear is gone (one mechanism); the commit's mismatch drop is now the reachable primary guard. Repro test: orphaned stage + outer pre-execute deny with the same call id never promotes; a fresh valid call still captures. |
||
|---|---|---|
| .agents/skills | ||
| .claude | ||
| .github/workflows | ||
| docs | ||
| examples | ||
| packages | ||
| scripts | ||
| vendor | ||
| .gitignore | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| CONTEXT.md | ||
| eslint.config.mjs | ||
| knip.json | ||
| lefthook.yml | ||
| LICENSE | ||
| package.json | ||
| pnpm-lock.yaml | ||
| pnpm-workspace.yaml | ||
| README.i18n.yaml | ||
| README.md | ||
| README.zh.md | ||
| tsconfig.base.json | ||
| tsconfig.build.json | ||
| tsconfig.json | ||
| tsdown.config.ts | ||
| vitest.config.ts | ||
| vitest.e2e.config.ts | ||
| vitest.snapshot.config.ts | ||
DeepSeek Harness
English | 中文
The DeepSeek Harness SDK is a plugin-based SDK for building agent harnesses.
Development
This monorepo is built on the Cordis framework (vendored as source under vendor/), microkernel-style: everything is a plugin.
pnpm install
pnpm run test # vitest
pnpm run demo:repl # REPL agent demo (needs DEEPSEEK_API_KEY)
pnpm run demo:acp # ACP server agent demo (needs DEEPSEEK_API_KEY)
For humans, start with the development guide for local setup, hooks, environment variables, and quality gates, then read the architecture design and documentation graph index before package work. Local context lives in packages/ and vendor/.
For agents, follow AGENTS.md.