delegate-to-deepseek-harness

Delegate to DeepSeek Harness

Use DSH Relay to dispatch bounded analysis or workspace changes to a DeepSeek Harness model, keep wait_run until a terminal status whenever this task must consume the result, and independently verify that result. Sharing webUrl is not completion.

Permission mode

• Use start_review for analysis, diagnosis, research, comparison, planning, and code review. This is the default when no file change is requested and is fixed to read-only.
• Use start_run with permissionPreset: workspace-write only when the user explicitly delegates implementation or asks Harness to modify the registered workspace. Ordinary fixes, edits, refactors, tests, and generated workspace files belong in this mode.
• Do not use danger-full-access for ordinary workspace changes. Use it only when a necessary action is outside the registered workspace or otherwise requires that native preset, the action remains within the user's request, and the user has explicitly confirmed the elevated risk. Pass confirmedDangerousPermission: true only after that confirmation.
• A request to call Harness is not by itself authorization to edit files. Infer write authorization only from an implementation request such as “让 Harness 修复/修改/实现”, or obtain it before dispatch.

Required setup

• Read the target repository's AGENTS.md before dispatch.
• Prefer the official @deepseek-ai/dsh-relay bundle in the Harness web profile. External agents should launch dsh-relay-proxy, which discovers the active internal authority from $DSH_HOME/plugins/dsh-relay/<profile>/relay-endpoint.json; do not copy a bearer token into client configuration.
• Prefer DSH Relay MCP tools for service connection, model selection, prompt submission, status checks, cancellation, and result collection. Use Browser only to verify or present the Harness conversation.
• Invoke Relay operations only through the native MCP tools exposed by the installed plugin. Never generate or run temporary JavaScript/TypeScript files such as .tmp/harness-*-call.mjs, and never use node, PowerShell, Python, a terminal, or another shell client to call or poll Relay RPCs. Shell fallback bypasses the managed background transport and can open visible console windows on Windows.
• If the native Relay MCP tools are unavailable, stop the delegation attempt, diagnose or reinstall the plugin, and continue from a new Codex task after the updated plugin is loaded. Do not simulate missing tools with an ad hoc client process. Ordinary local verification commands may still run in the Codex terminal, but they must not be used as a Relay RPC transport.
• Do not impose a blanket offline restriction. Let Harness decide whether task-relevant public network research is needed, including public GitHub repositories, official documentation, and ordinary webpages. Keep research within the delegated scope, prefer primary sources, and require URLs for material external claims. Network research does not authorize account sign-in, credentials, private services, source uploads, external writes, messages, pushes, or broader filesystem permissions. If the selected Harness preset cannot access the network, report that limitation instead of escalating to danger-full-access solely for research.
• Route capability and permission needs back to the calling Codex agent for decision instead of treating them as absolute prohibitions or waiting indefinitely inside Harness. This includes deletion, file replacement, image or other media generation, tools unavailable in the selected preset, and operations requiring a different permission boundary. State the exact action, targets, reason, risk, and least-privilege alternative. The calling agent should resolve ordinary reversible in-scope actions under the user's existing authorization without asking again; escalate to the user only when platform policy requires it or the action is materially destructive, irreversible, credential- or private-account-sensitive, externally consequential, or outside the authorized scope.
• Treat an explicit request for Harness or a named Harness model to review the current or named registered workspace as authorization for Harness to read that in-scope workspace itself. The calling task sends only the authorized workspace, file or directory locations, review or implementation scope, acceptance criteria, and routing/permission metadata. Harness must read the files through its authorized workspace tools. Never read or serialize source merely to paste source text, diffs, file dumps, encoded source, or repository archives into task, text content, steer_run, or reply_run arguments. Do not ask for redundant per-file approval merely because the repository is private. This authorization excludes credentials, secrets, unrelated paths and edits.
• When the current conversation explicitly asks to use Harness, pass authorizationBasis: explicit-user-request to start_review, start_run, or reply_run. This is truthful evidence for Codex approval review; it does not broaden the workspace, task scope, permission preset, provider destination, or allowed external actions, and it cannot guarantee approval. Do not set it for inferred or background delegation.
• Separate the review subject from its supporting read context. When the review target is a plan or other document, Harness may search and read related implementation, tests, configuration, and architecture material inside the explicitly authorized contextReadScope to verify that document. reviewTargets is not a read whitelist. Set contextReadScope equal to the target paths only when the user explicitly requests a target-only review.
• Apply the same path-reference-only transfer contract to read-only and every write-capable permission mode. workspace-write authorizes Harness to modify only the named workspace paths; it does not authorize the calling agent to embed source text in task parameters. A generic request to call Harness remains read-only unless the user also requests implementation.
• Treat reviewTargets, contextReadScope, excludedPaths, and writeScope as task instructions in addition to Harness native permissions. They do not implement per-path filesystem isolation. The selected model may send content it reads to its configured provider; a loopback Relay address describes the control connection, not all downstream model processing.
• Exclude credentials, secrets, browser storage, model files, production data, unrelated user files, and direct modification of .git internals.
• Treat the Harness workspace registry, not host.describe.cwd, as the default routing authority. Explicit Relay roots remain an additional strict boundary.
• Preserve all pre-existing user changes. Record the initial worktree state before a write run so Harness changes can be distinguished from earlier edits.