DeepSeek Harness 0.2.2: File-Safety Check Is Off by Default

Two days after DeepSeek showed off Creator Mode, the part of Harness that matters most to anyone running it is quieter: its defaults moved. The open-source repository now reads version 0.2.2-rc.1, and a handful of changes in it decide how much the agent can do to your machine before anything stops it.

Harness is DeepSeek's open-source agent runtime, the layer that lets a model work with files, a terminal, plugins and sessions. Creator Mode, shown on Nov. 2, lets the agent write and install its own plugins from a plain-language request. I read the project's public repository, including its upgrade guides and package docs, to see what changed around that headline.

The safety check that shipped switched off

The most useful find is in the upgrade guide titled "Filesystem mutations no longer require a prior read by default." In 0.2.2-alpha.2, the base setup mounted a policy that made the write tool refuse to overwrite a file the model hadn't read, and made edit refuse a file that had changed since the model last saw it. According to the guide, that row now ships disabled: true. Writes overwrite and edits replace text unconditionally.

What stays: sandbox confinement, review capture and file-observation events, the guide says. A newer apply_patch tool, which applies changes on context match alone, was added at the same time.

The repository's tool catalog confirms the shipped compositions leave the policy off "unless a deployment enables it." To get the old behavior back, add this to the profile's cordis.patch.yml:

`` - id: fs-observation-policy disabled: false ``

Then run dsh --profile <profile> --dump-config and confirm the row shows disabled: false. The guide's own test: with the policy on, editing an unread file fails with FS_NOT_OBSERVED.

Why it matters: that check is the cheap defense against an agent clobbering a file it only half understands, which is exactly the risk when a model is writing its own plugins.

Handing work to Codex and Claude Code

An experimental package adds a subagent_oar tool that delegates one standalone text task to a locally installed Codex or Claude Code CLI. The package's README lists the catches. The native CLIs run with whatever permissions you configure, and the example profile sets Codex to a workspace-write sandbox and Claude Code to dontAsk with permission prompts off.

The README also says Harness's own subprocess sandbox and cleanup don't apply to those processes, that there's no resume or progress stream, and that changes made before a cancellation stay in place. For Claude, a profile with no permission-mode argument inherits a permission bypass default. Only Codex and Claude Code have end-to-end coverage.

If you already trust those two CLIs, it's a handy bridge. It also means an unattended chain of agents with no approval screen anywhere.

Smaller changes that can break an update

The root package.json now asks for Node.js >=24.9.0, so older installs need a runtime upgrade first. Separately, an older upgrade guide (filed under 0.2.1-rc.2) says the HTTP fetch provider no longer rejects non-public destinations, so a deployment has to limit what the agent can reach on its own network.

Plugins from strangers

Harness can browse third-party plugin indexes through an experimental "Custom plugin indexes" bundle, and Creator Mode can search them. The plugin index docs are blunt: an index chooses each plugin's title, description, author and source, and Harness "checks the file format but not those claims." An install asks for confirmation and shows the npm package or Git commit, and that confirmation is the only gate.

What's still unverified

The repo's own SAFETY.md says Harness is experimental developer-preview software that "has not undergone a security audit" and can run model-generated code. The five-minute Pomodoro demo is the team's own, not an independent measurement. I couldn't open the project's GitHub Releases page or its X posts, so release-note wording and any community reaction there are unchecked here.

Three checks on your own machine

Check three things: your Node version, whether you want the read-before-write row back on, and whether any profile delegates to Codex or Claude Code with prompts off. For the design thinking behind all this, see our look at the always-on Super-agent proposal.

Source: deepseek-ai/deepseek-harness on GitHub

deepseek deepseek harness ai agents creator mode

AI

About the author

AI Briefing Daily Editorial. The editorial desk of AI Briefing Daily, an independent publication covering artificial intelligence. Every story is researched against primary sources, checked by hand and reviewed by a person before publication.