How DeepSeek Harness Enables Agents to Rewrite Themselves at Runtime

DeepSeek Harness is a locally run programming agent (dsh) that can read files, execute commands, modify code, and retrieve information, similar to Claude Code. Its key distinction is that every part—model integration, tool registry, session log, approval policy, and even the main loop—is implemented as a plugin.

Cordis, a dependency‑injection and reversible‑side‑effect kernel from the Koishi ecosystem, underpins this design. All dsh components are separate plugins that cooperate via services and events, and they can be freely combined at the configuration layer.

The system offers four modes: a fully featured standard mode, a PTC mode where the model generates code to orchestrate multi‑turn tool calls, a minimal mode with only a terminal and editor for benchmark runs, and a "creation mode". Creation mode provides a set of self‑referential Cordis tools that let the agent inspect the current plugin tree and dynamically mount or unmount temporary plugins—writing event listeners, registering new tools, providing services, and later removing them.

Self‑modifying agents face the challenge of cleanly removing listeners, connections, and services created during modification. dsh solves this by placing dynamic plugins into the existing plugin lifecycle, using Cordis's Context and Effect mechanisms that provide explicit cleanup paths.

The design is grounded in the paper "A Programming Paradigm for Spatiotemporal Composability" (https://github.com/cordiverse/paper). The paper argues that software engineering’s foundation is composition, but traditional composition is static—fixed at compile time. Dynamic composition lacks a solid theoretical basis, so industry resorts to coarse‑grained OS process restarts or container orchestration.

A VSCode case study illustrates the problem: extensions run in a shared process, lack a runtime unload mechanism, and rely on a deactivate hook that only runs at process termination, leading to incomplete cleanup and fragile dependency handling. Only a few extensions declare dependencies, and there is no structured contract for inter‑extension interaction.

The paper reifies the classic type‑system concepts of effect and coeffect as runtime mechanisms. An effect describes what a computation does to its environment; a coeffect describes what it requires. Both are made reversible: each side‑effect returns an inverse function, and these inverses are accumulated into a stack that is applied in LIFO order during unloading, restoring the prior context.

Two design choices are highlighted: the inverse function must be supplied at the moment the side‑effect is performed, not inferred later; and composite inverses are automatically derived from atomic inverses, eliminating the need for manual deactivation code.

React’s useEffect provides a similar cleanup pattern but is limited in composability—effects must be declared at the top level and cannot be async or nested. Cordis effects, by contrast, are freely composable and can execute asynchronously.

The paper adds two mechanisms: coeffect isolation, which maps a key to different values in different contexts for multi‑tenant or sandbox scenarios; and coeffect interception, which attaches metadata to dependency accesses without changing the underlying key, enabling dynamic permission adjustments without modifying providers or consumers.

Activation order (providers before consumers) is straightforward, but deactivation order (providers after all consumers) is difficult. The paper introduces an UNLOADING lifecycle state and guard conditions that prevent a provider from being removed while any consumer still resolves its key. This approach avoids deadlock, as proved by a progress theorem.

On a meta‑theoretical level, the paper defines a dynamic composition calculus with ten rules and four lifecycle states, handling non‑atomic transitions, inertia (asynchronous operations that must complete), and failure routing. Five theorems are proved: preservation, global time composability, global space composability, progress, and convergence (the system reaches the same final state as if all insertions and removals were applied atomically).

The conclusion points to future work on fully autonomous self‑evolving agent harnesses. The current creation mode is the first product incarnation but lacks robust sandboxing; language‑level access control cannot stop malicious plugins, so the trust level is set to shell access and disabled by default.