feat(agents): add dsh as the 8th agent - #559
Merged
Merged
Conversation
- go 1.26.5 -> 1.26.6 - claude-code 2.1.226 -> 2.1.232 - cctrace 0.38.1 -> 0.40.0 - gemini-cli 0.54.4 -> 0.55.1 - grok-cli 1.0.0 -> 1.0.3 - kimi-code 0.34.0 -> 0.36.0 - opencode 1.18.15 -> 1.18.18 - ccx v0.14.0 -> v0.15.0 - cloakbrowser 0.5.6 -> 0.5.7 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- agents/dsh.sh: default credentials mounts ~/.dsh rw; api-key passes DEEPSEEK_API_KEY as env, mounts nothing -- dsh resolves env BEFORE .credentials.yaml (reverse of pi), so no blank overlay and the host key is scrubbed from credentials mode where it would outrank the mounted credentials - unattended posture: DSH_PERMISSION_MODE=danger-full-access (env is the only switch; dsh scrubs DSH_* from project-discovered env, so only deva's injection counts); DSH_HOME pinned to /home/deva/.dsh (developer preview, defaults can move; the issue's ~/n worry was a docs misread -- real default is ~/.dsh) - deva.sh registration: auth tag, dsh_version label, canonical .dsh mounts, autolink, status walk, env scrub, config-home scaffolding - pin DSH_VERSION=0.1.0-rc.6 (@deepseek-ai/dsh) through versions.env, Dockerfiles, Makefile, install/pin/resolve/upgrade scripts, CI, nightly-images, release workflows; no updater exists, nothing to neutralize - scripts/test-dsh-auth.sh: 13 hermetic dry-run asserts, wired into CI - skills interop: dsh reads ~/.agents/skills + <project>/.agents/skills (already wired for claude); plugins surface held back on purpose (manifest format in flux) Close #556 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2612f86677
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [ -d "$CONFIG_HOME/.pi" ] || mkdir -p "$CONFIG_HOME/.pi" | ||
| ;; | ||
| dsh) | ||
| [ -d "$CONFIG_HOME/.dsh" ] || mkdir -p "$CONFIG_HOME/.dsh" |
There was a problem hiding this comment.
On a first normal deva.sh dsh run where ~/.dsh already contains credentials but ~/.config/deva/dsh does not exist, this creates ~/.config/deva/dsh/.dsh before autolink_legacy_into_deva_root runs. The later autolink therefore refuses to replace it with a symlink, and the centralized mount walker mounts the new empty directory instead of the existing credentials, forcing the user to authenticate again. Skip this scaffold when the legacy home exists or perform it after autolinking.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
Adds DeepSeek Harness (@deepseek-ai/dsh) as a first-class deva.sh agent (deva.sh dsh), wiring its auth/mount/permission model into deva’s existing container-as-sandbox contract and pinning the CLI version across build/release automation.
Changes:
- Register
dshas a new agent withcredentials(mount~/.dsh) andapi-key(env-onlyDEEPSEEK_API_KEY) auth flows, plusDSH_PERMISSION_MODE+ pinnedDSH_HOME. - Pin
DSH_VERSIONend-to-end (versions/env, Dockerfiles, Makefile, pin/upgrade scripts, CI, nightly, release). - Add docs + a dedicated auth wiring smoke test (
scripts/test-dsh-auth.sh) and update public-facing agent lists.
Reviewed changes
Copilot reviewed 32 out of 32 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| versions.env | Adds DSH_VERSION and bumps multiple pinned tool versions. |
| scripts/version-upgrade.sh | Adds dsh to upgrade tooling selection and build-arg propagation. |
| scripts/version-pins.sh | Includes DSH_VERSION in pin variable set and emitted pin output. |
| scripts/update-version-pins.sh | Adds npm pin resolution for @deepseek-ai/dsh. |
| scripts/test-install-agent-tooling.sh | Extends fake-bin install test to include dsh and DSH_VERSION. |
| scripts/test-dsh-auth.sh | New hermetic dry-run test validating dsh auth/mount/env/trace behavior. |
| scripts/resolve-tool-versions.sh | Adds dsh to resolved version outputs. |
| scripts/release-utils.sh | Registers dsh in the tool registry metadata used by release tooling. |
| scripts/install-agent-tooling.sh | Installs @deepseek-ai/dsh in images and verifies dsh --version. |
| README.zh-CN.md | Updates marketing copy + examples to include dsh. |
| README.md | Updates marketing copy + examples to include dsh. |
| Makefile | Adds DSH_VERSION, build args, and help output integration. |
| llms.txt | Updates agent list to include dsh (but contains a now-stale “six agents” line). |
| install.sh | Installs the new agents/dsh.sh wrapper. |
| docs/troubleshooting.md | Adds .dsh to “empty home dir” troubleshooting list. |
| docs/quick-start.md | Includes agents/dsh.sh and adds quick-start for DEEPSEEK_API_KEY mode. |
| docs/philosophy.md | Updates agent list to include dsh. |
| docs/index.md | Updates overview agent list to include dsh. |
| docs/how-it-works.md | Documents dsh home layout + auth behavior (env precedence, no overlay). |
| docs/authentication.md | Adds full dsh auth docs for credentials vs api-key modes. |
| docs/advanced-usage.md | Updates --trace rejection docs to include dsh. |
| Dockerfile.rust | Adds ARG/LABEL for DSH_VERSION. |
| Dockerfile | Adds ARG/LABEL for DSH_VERSION. |
| deva.sh | Registers dsh across help, tagging, env filtering, mount canonicalization, autolink, status output, and fallback mounts. |
| DEV-LOGS.md | Adds a dev log entry documenting the dsh integration decisions. |
| CHANGELOG.md | Adds release notes entry for the new dsh agent and its auth/mount contract. |
| agents/shared_auth.sh | Adds dsh supported auth methods and default (credentials). |
| agents/dsh.sh | New agent wrapper implementing dsh-specific auth, env, mount, and trace handling. |
| .github/workflows/release.yml | Propagates dsh_version through release build/notes and build args. |
| .github/workflows/nightly-images.yml | Adds dsh_version to nightly image resolution + build args. |
| .github/workflows/ci.yml | Adds DSH_VERSION build arg, dsh --version smoke, and dsh auth test step. |
| .deva.example | Updates hybrid agent setup docs to include dsh. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+3
to
5
| > Docker-first launcher for AI coding agents — Claude Code, Codex, Gemini, Grok, Kimi, opencode, pi, and dsh. | ||
| > The container is the sandbox, mounts are the explicit contract, and one warm | ||
| > project container serves all six agents. A bash script, not a framework. MIT. |
4 tasks
Missed in the dsh commit: tests/test_release_utils.sh pins the registry tool lists; 70/70 again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 33 out of 33 changed files in this pull request and generated no new comments.
Suppressed comments (1)
llms.txt:5
- The llms.txt tagline still says the warm container “serves all six agents”, but the PR adds dsh as the 8th agent. This should be updated to avoid misleading downstream consumers of llms.txt.
> Docker-first launcher for AI coding agents — Claude Code, Codex, Gemini, Grok, Kimi, opencode, pi, and dsh.
> The container is the sandbox, mounts are the explicit contract, and one warm
> project container serves all six agents. A bash script, not a framework. MIT.
The hermetic fake registry hard-errors on unknown URLs by design; dsh needed dist-tags + packument fixtures, an image-label current for the outage fallback, and its pin in the written-pins assert. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 34 out of 34 changed files in this pull request and generated no new comments.
Suppressed comments (2)
llms.txt:5
- This description still says the warm project container serves "all six agents", but the doc now lists 8 agents (including dsh). This is now internally inconsistent.
> Docker-first launcher for AI coding agents — Claude Code, Codex, Gemini, Grok, Kimi, opencode, pi, and dsh.
> The container is the sandbox, mounts are the explicit contract, and one warm
> project container serves all six agents. A bash script, not a framework. MIT.
scripts/test-dsh-auth.sh:67
- The mount-absence assertions include a trailing quote in the needle (":/home/deva/.dsh"") but
deva.sh --dry-runprints docker args without quoting. This can let the test pass even if a ~/.dsh mount regresses into api-key mode.
want_absent "no ~/.dsh mount in api-key mode" ":/home/deva/.dsh\"" "$apikey_out"
echo "=== dsh api-key: no mount on the hybrid config-root path either ==="
hybrid_apikey_out="$(DEEPSEEK_API_KEY=sk-ds-test-1234 run_dry dsh --auth-with api-key --dry-run || true)"
want_absent "hybrid layout: no ~/.dsh mount in api-key mode" ":/home/deva/.dsh\"" "$hybrid_apikey_out"
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wraps dsh (deepseek-ai/deepseek-harness, npm @deepseek-ai/dsh, launched 2026-08-13) as
deva.sh dsh.Close #556
Contract, verified against the repo source and a local install (not the issue text where it drifted):
credentialsmounts ~/.dsh rw (.credentials.yaml, settings.yaml, profiles/ with container-built pnpm trees, skills/).--auth-with api-keypasses DEEPSEEK_API_KEY as env, mounts nothing. dsh resolves inherited env BEFORE .credentials.yaml -- the reverse of pi -- so the injected key always decides billing, no blank overlay is needed, and a host DEEPSEEK_API_KEY is scrubbed from credentials-mode runs where it would silently outrank the mounted credentials.Test plan (from #556):
deva.sh dsh -Q -- --versionwired🤖 Generated with Claude Code