Two weeks with DeepSeek Harness: five plugins that bend an AI client to your own toolchain
AI coding clients that lock tools and memory behind platform walls force developers to re-enter data and re-implement scripts for every model switch. DSH's plugin model, with Git-backed memory and no-kernel extension points, shows a path where your agent's capabilities travel as plain npm packages and Markdown files you already own.
DeepSeek Harness (DSH) ships as a desktop app whose agent loop is a single package, dsh-agent-loop, with everything else pluggable. Its README instructs writers to put new behaviors in plugins rather than rewrite the kernel. That philosophy held up under a two-week test: five MIT-licensed plugins now cover long-term memory stored as Markdown in a user's own Git repo (dsh-memory-git), a full Git panel in the sidebar (dsh-git), turning DSH into an MCP server for Claude Desktop and Cursor (dsh-ai-chat-mcp), macOS automation (dsh-automation), and a Windows equivalent with PowerShell and UI Automation (dsh-computer-use). All install by package name without config changes.
The plugin system rests on Cordis, a TypeScript framework providing dependency injection and lifecycle management. Four extension points emerged: Host plugins register tools via ctx.tools.register with plain JSON Schema; Client plugins inject into pre-declared UI slots; Skills are on-demand manuals that load only when needed to save context; and MCP works both ways — DSH can consume external MCP services or serve its own. Sandboxing has three tiers (read-only, workspace-write, danger-full-access), and sensitive operations require approval, while sub-agents isolate large tasks.
Boundaries show up quickly. The capability surface is almost unlimited because plugins are full-permission Node code, but the interaction surface only allows slot injection — core layout and streaming protocol stay closed. Plugins can't be distributed as standalone products. Trust is the hardest limit: a Host plugin runs unsandboxed, so installing third-party code is running arbitrary code. Tool descriptions also bloat context, which is why Skills load lazily. One process hosts everything, so a crashing plugin drags down the app.
The 'self-evolution' claim DSH makes isn't about the model rewriting itself; it's about capabilities persisting as files — plugins in a repo, memory in Git, skills as Markdown — which outlive any single client.
The three-layer abstraction (definition, provider, consumer) is what makes the no-kernel promise credible; swapping a sandbox implementation doesn't force changes in any calling tool.
Treating a plugin as full-permission Node code is both a feature and a liability: extension power scales without ceiling, but trust scales to the same degree.
The real bottleneck for tool-heavy agents is context, not capability; Skills' lazy loading is the workaround that keeps the model from drowning in descriptions.
DSH's plugin model resembles VS Code's extension model more than a browser engine — you can grow tools inside a fixed shell, but you can't grow a new shell.
The author's two-week emphasis on verifying AI-written code around system permissions suggests that agentic coding still requires human judgement at boundaries.