DeepSeek's dsh-superagent: A Research Prototype That Turns 'Take Less Attention' Into Executable Rules
This prototype provides a working reference for how to constrain proactive AI agents in shared team repos, not just another coding agent with extra permissions. For engineers who have seen agents spam PRs and comments, the document set shows a concrete alternative: admit by whitelist, keep current work interruptible by humans, and let rules in prompts gate every proactive action.
dsh-superagent is a research prototype from DeepSeek's GitHub org, packaged as a plugin bundle for DeepSeek Harness (DSH). The agent watches a single GitHub repository and optionally Feishu, opens a Ticket when a permitted person @mentions it, works in an isolated Executor Session and directory, and replies in the original conversation, typically with a Pull Request. The code is immature, with a single commit and a README warning of bugs, but the value sits in nine numbered design documents that specify how a proactive agent should be restrained.
The core philosophy is "take as little human attention as possible, and give as much value as possible." It drives concrete mechanisms: a whitelist plus an admission table enforced by the host, an immutable Mandate per Ticket, observation-only proactive work by default, structured questions instead of free-text reports, a web panel that lists only items needing a human, and a stop based on impact rather than effort. External messages, comments, and documents are treated as data that never changes rules or authorization, which is also the defense against prompt injection.
The domain model runs Trigger to Eval to Ticket with explicit concepts for ownership of follow-up messages, hand-back, subscriptions, and context-only reads. Execution details cover concurrency with a reserved slot for human messages, background task limits, persistence-before-action for failure recovery, and merge decisions left to prompts rather than host logic. Auto-merge is off by default; teams must write delivery requirements before the agent merges anything.
The prototype's most reusable artifact is the documentation itself: a tightly ordered set that records rejected designs and their reasons, which many production projects skip.
Treating 'person' as a Source-specific identity rather than a cross-Source mapping keeps the domain model smaller and avoids a centralized identity store, at the cost of the agent needing prompt text to map accounts.
Putting the Policy block last in the system prompt is a practical cache-friendly trick, but it also means teams can change behavior without retraining or rewriting earlier prompt text.
The explicit line that external text is data, not authority, is a design stance against prompt injection that many agent frameworks should adopt.
Running the Executor under the operator's OS user with no approval makes the prototype unsuitable for production without significant hardening, despite the careful attention economics.