Frontend · JavaScript · AI Programming

DeepSeek Ships a Web-Based Agent Runner, and pnpm 12 Hits RC in Rust

By 晓得迷路了 · Aug 17, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

DeepSeek Harness signals that Chinese AI labs are now shipping agent tooling built on web-first, plugin-based architectures rather than copying terminal-centric workflows. The pnpm 12 RC means teams can adopt a faster Rust-based package manager without touching their lockfiles or CI scripts.

Summary

DeepSeek released Harness, an open-source agent framework that competes directly with Claude Code but swaps the CLI for a web UI. Every feature ships as a plugin on top of Cordis, an existing Node plugin system whose original author DeepSeek has now hired. The project pulled in 30,000 GitHub stars on launch day.

pnpm 12 is now in RC, rewritten in Rust while preserving full backward compatibility with pnpm 11 commands, arguments, config, and lockfile format. Only four documented differences exist between versions. Separately, a 12-year-old weak PRNG in crypto-js versions before 4.0.0 has been exploited to steal wallet keys.

React Native 0.87 converts its public JS API to strict-mode TypeScript with types generated from source, and Deno 2.9.5 adds an experimental QuickJS backend for compiled binaries. On the tooling side, vlt 1.0 launches as an npm replacement with 60-plus CSS-like selectors for querying dependency graphs, half of them security-focused.

Takeaways

— DeepSeek Harness is a Node-based agent runtime that operates through a web interface, not a terminal, and implements all functionality as plugins on the Cordis system.

— DeepSeek hired the original author of Cordis to build Harness's plugin layer.

— pnpm 12 RC is a full Rust rewrite that keeps pnpm 11's commands, arguments, config, and lockfile format intact; only four documented differences exist.

— A weak PRNG in crypto-js versions before 4.0.0 (released 2020) was exploited to steal crypto wallet keys after sitting in the codebase for 12 years.

— React Native 0.87 ships strict-mode TypeScript APIs with types generated directly from the framework's source code.

— Deno 2.9.5 adds an experimental QuickJS backend to deno compile and deno desktop.

— vlt 1.0 replaces npm and introduces vlt query, which uses 60-plus CSS-like selectors to inspect dependency graphs, with roughly half targeting security checks.

— TanStack Table v9 adopts a tree-shakable architecture and migrates state management to TanStack Store for fine-grained reactivity and lower memory on large datasets.

— hucre 1.0 is a zero-dependency, tree-shakable spreadsheet engine under MIT that handles images, hyperlinks, password protection, and pivot tables.

Conclusions

DeepSeek hiring Cordis's original author to build Harness's plugin layer is a concrete signal that agent frameworks are being treated as serious platform investments, not experiments.

pnpm's Rust rewrite with full backward compatibility sets a high bar for migration strategy: the team prioritized not breaking existing workflows over chasing new features in the RC.

A 12-year-old PRNG bug in crypto-js that only now led to wallet thefts illustrates how cryptographic weaknesses in widely depended-upon libraries can lie dormant until the incentive to exploit them becomes large enough.

vlt's CSS-selector approach to dependency queries is a genuinely novel interface for package management, turning what is normally a CLI flag memorization problem into a composable query language.

Concepts & terms

Cordis

An existing Node.js plugin system that DeepSeek Harness uses as its foundation. All Harness features are implemented as Cordis plugins, and DeepSeek hired Cordis's original author.

PRNG (Pseudo-Random Number Generator)

An algorithm that generates sequences of numbers approximating random properties. The weak PRNG in crypto-js before v4.0.0 produced predictable outputs, making keys generated with it vulnerable to theft.

Tree-Shaking

A build optimization that eliminates unused code from the final bundle. TanStack Table v9 and hucre 1.0 both advertise tree-shakable architectures, meaning you only ship the parts you actually import.

QuickJS

A small, embeddable JavaScript engine. Deno 2.9.5 adds it as an experimental backend for compiled binaries, offering a lighter alternative to V8 for certain deployment scenarios.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗