Files
deepseek-harness/examples/headless-agent
Tianyi Cui 0664b25cd9 fix(review): validate skill roots at mount and isolate provider default roots
ds-review-bot round 1 on the repository-plugin runtime:
- a manifest-declared skill root absent or non-directory in the installed
  package now fails the plugin load (skill-local treats a missing root as
  legitimately empty, which silently mounted a skill-less plugin)
- includeDefaultRoots: false no longer inherits $DSH_BUNDLED_SKILL_DIR, so
  isolated repository providers see only their explicit roots
- prepared wrapper baseUrl schema requires the file: scheme, failing hostile
  URLs at the declared validation boundary
- preparedPath reuses format.ts's isOutside; SERVER_NAME_PATTERN is exported
  and pinned equal to dsh-mcp-client's, with the restatement justified (the
  prepare bin keeps a zod-only module graph); the unexplained `as never`
  cast now carries its schemastery rationale
- the import-free wrapper assertion also rejects dynamic import(
- the headless fixture wrapper is regenerated by the real prepareDshPlugin
  and a drift test pins fixture == generator output
- prepareDshPlugin JSDoc states the non-atomic publish repair contract
2026-08-02 01:25:02 +08:00
..
2026-07-26 05:06:39 +08:00

headless-agent

English | 中文

Headless one-shot agent wiring: DeepSeek V4 + local bash and filesystem tools + subagent delegation + workflows and fresh-agent Ralph iteration + todo_write + JSONL persistence, with @deepseek-ai/dsh-cli-demo as the app front door.

Run it

# repo root .env (gitignored) or exported env:
#   DEEPSEEK_API_KEY=sk-…
#   DEEPSEEK_BASE_URL=https://…   # optional; defaults to the public API
pnpm run demo:headless "fix the failing test in this workspace"
pnpm run demo:headless --output-format json -- "summarize the implementation"
pnpm run demo:headless --output-format stream-json -- "run the focused tests"

Exactly one nonblank positional task is required; quote tasks containing spaces. There is no -p flag. text prints the last text-bearing assistant message, json prints one DSH-native result record, and stream-json emits the top-level session's canonical task-turn events before that record. Child sessions surface only through parent tool events and results.

Each invocation creates and persists a fresh session, runs all model and tool steps in one turn, flushes, disposes, and exits. This is non-interactive automation: there is no prompt, approval, resume, second turn, or stdin context. The configured tools can mutate the launch workspace, run commands, spawn child agents, and consume provider tokens.

Advanced and snapshot wiring

advanced.cordis.yml adds Code Mode and the Cordis tools to the shipped leaf. advanced.cordis.snapshot.yml replaces only the live LLM with replay. The tests under tests/ own the keyless real-Loader smoke, key-gated world-verified smoke, and the stream-json replay snapshot with its parent and child session fixtures.

The package-level CLI contract documents output records, exit status, cancellation, persistence, and model/token effects.