跪拜 Guibai
← All articles
Artificial Intelligence

DeepSeek Harness Turns the Agent Loop Itself Into a Plugin

By Pika ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Most agent frameworks hardcode the main loop and force extensions to patch a privileged core. DeepSeek Harness demonstrates a production architecture where the loop, tools, and adapters are all swappable plugins, which means teams can replace any piece without forking the framework or risking merge conflicts on upgrade.

Summary

DeepSeek Harness treats the agent loop, model adapters, tool registries, and session logs as replaceable plugins. There is no privileged core to patch; extension means hanging another plugin on the tree. The architecture rests on Cordis, a five-concept plugin framework that uses dependency injection to determine loading order and reversible effects to enable hot module replacement.

Every replaceable capability follows a three-role seam model: an abstract service definition, one or more concrete providers, and consumers that depend only on the abstract key. Swapping a shell or filesystem provider moves Bash, PTY, and LSP to a remote sandbox without touching any tool code. The session log is an append-only event stream—the model's conversation history is derived from it on the fly, making fork, resume, replay, and compaction operate on a single source of truth.

Tool execution runs through a guarded pipeline of waterfall hooks for pre-execution approval, execution wrapping, and post-execution result inspection. Built-in tools cover shell, filesystem, search, web, LSP, subagent delegation, workflow orchestration, background jobs, and session state, all backed by their respective capability seams.

Takeaways
Every capability—agent loop, model adapter, tool registry, session log—is a plugin with no privileged core to patch.
The Cordis plugin system uses dependency injection to determine loading order, not a hand-written boot sequence.
All registrations are reversible effects, so hot module replacement unloads and reloads plugins cleanly without leaks.
Capability seams split each replaceable ability into an abstract definition, concrete providers, and consumers that depend only on the abstract key.
Swapping a shell or filesystem provider moves Bash, PTY, and LSP to a remote sandbox without modifying any tool code.
The session log is an append-only event stream; model conversation history is derived from it, not stored separately.
Waterfall events provide wrapping middleware for interception, rewriting, and policy decisions across the entire tool pipeline.
Tool execution passes through pre-execute, execute, and post-execute waterfalls where hooks, approval, sandboxing, and result inspection live.
Profiles and bundles assemble the plugin tree at startup via YAML patches that can override, disable, or insert plugin lines.
Built-in tools cover shell, filesystem, search, web, LSP, subagent delegation, workflow orchestration, background jobs, and session state.
Conclusions

Making the agent loop itself a plugin is a genuine architectural inversion—most frameworks treat the loop as the fixed center and bolt capabilities onto it, but here the loop is just another service declaring its dependencies.

The 'model-visible means logged' invariant is a hard constraint that pays off across the system: it makes replay, fork, and compaction operate on a single event stream rather than reconciling separate state stores.

Waterfall middleware as the universal extension pattern avoids the common trap of having separate interception mechanisms for prompts, tool calls, and model requests, each with different APIs and ordering rules.

The three-role seam model formalizes what many frameworks do ad hoc—by requiring a definition, provider, and consumer for every replaceable capability, it prevents the silent coupling that happens when consumers import concrete implementations directly.

Vendoring Cordis and using YAML patches with JS expressions for assembly means the entire plugin tree is declaratively configurable and inspectable via --dump-config, which is rare in agent frameworks that typically hide their composition behind imperative code.

Concepts & terms
Cordis
A five-concept plugin framework (Plugin, Context, inject, Typed Event, Effect) that DeepSeek Harness builds on. Services occupy stable keys on a shared context, loading order is expressed through dependency declarations, and all registrations are reversible effects.
Capability Seam
A three-role pattern for replaceable capabilities: a Service Definition (abstract class occupying a context key), Service Providers (concrete implementations), and Consumers (code that depends only on the abstract key). Swapping a provider changes behavior without touching consumers.
Event-sourced Session
An append-only log of SessionEvent records that serves as the single source of truth for all agent interaction. Model conversation history is derived from the log via deriveMessages(), not stored separately, enabling replay, fork, and compaction on a unified event stream.
Waterfall Event
A Cordis event dispatch mode where listeners receive (...args, next) and act as wrapping middleware. Calling next() passes control to the next listener; not calling it short-circuits. Used throughout DeepSeek Harness for interception, rewriting, and policy decisions.
Profile and Bundle
The two-level assembly system for the plugin tree. A Bundle is an npm package declaring Cordis config lines; a Profile lists bundles to stack in order plus user overrides. YAML patches can replace, disable, or insert plugin lines, with last-write-wins semantics.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗