feat(agents): add dsh as the 8th agent by lroolle · Pull Request #559 · thevibeworks/deva

lroolle · 2026-08-14T05:11:20Z

Wraps dsh (deepseek-ai/deepseek-harness, npm @deepseek-ai/dsh, launched 2026-08-13) as deva.sh dsh.

Contract, verified against the repo source and a local install (not the issue text where it drifted):

DSH_HOME defaults to ~/.dsh (the issue's ~/n worry was a docs misread). deva pins DSH_HOME=/home/deva/.dsh anyway -- developer preview, defaults can move.
Auth: default credentials mounts ~/.dsh rw (.credentials.yaml, settings.yaml, profiles/ with container-built pnpm trees, skills/). --auth-with api-key passes DEEPSEEK_API_KEY as env, mounts nothing. dsh resolves inherited env BEFORE .credentials.yaml -- the reverse of pi -- so the injected key always decides billing, no blank overlay is needed, and a host DEEPSEEK_API_KEY is scrubbed from credentials-mode runs where it would silently outrank the mounted credentials.
YOLO: DSH_PERMISSION_MODE=danger-full-access (sandbox off, approval never). Env is the only switch; dsh scrubs DSH_* from project-discovered env (.env, BASH_ENV), so only deva's -e injection counts -- which is exactly the posture we want.
No auto-updater exists (plain npm, no phone-home): nothing to neutralize.
Pin: DSH_VERSION=0.1.0-rc.6 through versions.env / Dockerfiles / Makefile / pin scripts / CI / nightly / release. Pinned hard on purpose; nightly-images tracks drift.
Skills interop: dsh reads ~/.agents/skills + /.agents/skills, the dirs deva already wires for claude. One skills dir, two agents.
Held back on purpose: plugins/marketplace surface (manifest format broke pre-launch); --trace (no cctrace dsh profile).

Test plan (from #556):

scripts/test-dsh-auth.sh: 13 hermetic dry-run asserts (credentials mount, api-key env travel + redaction + no-mount, host-key scrub, --trace reject + passthrough, missing-key error) -- 13/13 local
existing agent auth tests stay green (pi/kimi/opencode/help/mount-shape/version-targets all pass locally)
CI smoke deva.sh dsh -Q -- --version wired
skills interop smoke: manual, post-merge image build

🤖 Generated with Claude Code

- go 1.26.5 -> 1.26.6 - claude-code 2.1.226 -> 2.1.232 - cctrace 0.38.1 -> 0.40.0 - gemini-cli 0.54.4 -> 0.55.1 - grok-cli 1.0.0 -> 1.0.3 - kimi-code 0.34.0 -> 0.36.0 - opencode 1.18.15 -> 1.18.18 - ccx v0.14.0 -> v0.15.0 - cloakbrowser 0.5.6 -> 0.5.7 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- agents/dsh.sh: default credentials mounts ~/.dsh rw; api-key passes DEEPSEEK_API_KEY as env, mounts nothing -- dsh resolves env BEFORE .credentials.yaml (reverse of pi), so no blank overlay and the host key is scrubbed from credentials mode where it would outrank the mounted credentials - unattended posture: DSH_PERMISSION_MODE=danger-full-access (env is the only switch; dsh scrubs DSH_* from project-discovered env, so only deva's injection counts); DSH_HOME pinned to /home/deva/.dsh (developer preview, defaults can move; the issue's ~/n worry was a docs misread -- real default is ~/.dsh) - deva.sh registration: auth tag, dsh_version label, canonical .dsh mounts, autolink, status walk, env scrub, config-home scaffolding - pin DSH_VERSION=0.1.0-rc.6 (@deepseek-ai/dsh) through versions.env, Dockerfiles, Makefile, install/pin/resolve/upgrade scripts, CI, nightly-images, release workflows; no updater exists, nothing to neutralize - scripts/test-dsh-auth.sh: 13 hermetic dry-run asserts, wired into CI - skills interop: dsh reads ~/.agents/skills + <project>/.agents/skills (already wired for claude); plugins surface held back on purpose (manifest format in flux) Close#556 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:2612f86677

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-14T05:14:12Z

 [ -d "$CONFIG_HOME/.pi" ] || mkdir -p "$CONFIG_HOME/.pi"
 ;;
+ dsh)
+ [ -d "$CONFIG_HOME/.dsh" ] || mkdir -p "$CONFIG_HOME/.dsh"


Autolink the legacy dsh home before scaffolding
On a first normal deva.sh dsh run where ~/.dsh already contains credentials but ~/.config/deva/dsh does not exist, this creates ~/.config/deva/dsh/.dsh before autolink_legacy_into_deva_root runs. The later autolink therefore refuses to replace it with a symlink, and the centralized mount walker mounts the new empty directory instead of the existing credentials, forcing the user to authenticate again. Skip this scaffold when the legacy home exists or perform it after autolinking.
Useful? React with 👍 / 👎.

Copilot

Pull request overview

Adds DeepSeek Harness (@deepseek-ai/dsh) as a first-class deva.sh agent (deva.sh dsh), wiring its auth/mount/permission model into deva’s existing container-as-sandbox contract and pinning the CLI version across build/release automation.

Changes:

Register dsh as a new agent with credentials (mount ~/.dsh) and api-key (env-only DEEPSEEK_API_KEY) auth flows, plus DSH_PERMISSION_MODE + pinned DSH_HOME.
Pin DSH_VERSION end-to-end (versions/env, Dockerfiles, Makefile, pin/upgrade scripts, CI, nightly, release).
Add docs + a dedicated auth wiring smoke test (scripts/test-dsh-auth.sh) and update public-facing agent lists.

Reviewed changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
versions.env	Adds `DSH_VERSION` and bumps multiple pinned tool versions.
scripts/version-upgrade.sh	Adds `dsh` to upgrade tooling selection and build-arg propagation.
scripts/version-pins.sh	Includes `DSH_VERSION` in pin variable set and emitted pin output.
scripts/update-version-pins.sh	Adds npm pin resolution for `@deepseek-ai/dsh`.
scripts/test-install-agent-tooling.sh	Extends fake-bin install test to include `dsh` and `DSH_VERSION`.
scripts/test-dsh-auth.sh	New hermetic dry-run test validating dsh auth/mount/env/trace behavior.
scripts/resolve-tool-versions.sh	Adds `dsh` to resolved version outputs.
scripts/release-utils.sh	Registers `dsh` in the tool registry metadata used by release tooling.
scripts/install-agent-tooling.sh	Installs `@deepseek-ai/dsh` in images and verifies `dsh --version`.
README.zh-CN.md	Updates marketing copy + examples to include `dsh`.
README.md	Updates marketing copy + examples to include `dsh`.
Makefile	Adds `DSH_VERSION`, build args, and help output integration.
llms.txt	Updates agent list to include `dsh` (but contains a now-stale “six agents” line).
install.sh	Installs the new `agents/dsh.sh` wrapper.
docs/troubleshooting.md	Adds `.dsh` to “empty home dir” troubleshooting list.
docs/quick-start.md	Includes `agents/dsh.sh` and adds quick-start for `DEEPSEEK_API_KEY` mode.
docs/philosophy.md	Updates agent list to include `dsh`.
docs/index.md	Updates overview agent list to include `dsh`.
docs/how-it-works.md	Documents dsh home layout + auth behavior (env precedence, no overlay).
docs/authentication.md	Adds full dsh auth docs for credentials vs api-key modes.
docs/advanced-usage.md	Updates `--trace` rejection docs to include dsh.
Dockerfile.rust	Adds `ARG/LABEL` for `DSH_VERSION`.
Dockerfile	Adds `ARG/LABEL` for `DSH_VERSION`.
deva.sh	Registers `dsh` across help, tagging, env filtering, mount canonicalization, autolink, status output, and fallback mounts.
DEV-LOGS.md	Adds a dev log entry documenting the dsh integration decisions.
CHANGELOG.md	Adds release notes entry for the new dsh agent and its auth/mount contract.
agents/shared_auth.sh	Adds `dsh` supported auth methods and default (`credentials`).
agents/dsh.sh	New agent wrapper implementing dsh-specific auth, env, mount, and trace handling.
.github/workflows/release.yml	Propagates `dsh_version` through release build/notes and build args.
.github/workflows/nightly-images.yml	Adds `dsh_version` to nightly image resolution + build args.
.github/workflows/ci.yml	Adds `DSH_VERSION` build arg, `dsh --version` smoke, and dsh auth test step.
.deva.example	Updates hybrid agent setup docs to include `dsh`.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+> Docker-first launcher for AI coding agents — Claude Code, Codex, Gemini, Grok, Kimi, opencode, pi, and dsh.
 > The container is the sandbox, mounts are the explicit contract, and one warm
 > project container serves all six agents. A bash script, not a framework. MIT.


Missed in the dsh commit: tests/test_release_utils.sh pins the registry tool lists; 70/70 again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 33 out of 33 changed files in this pull request and generated no new comments.

Suppressed comments (1)

llms.txt:5

The llms.txt tagline still says the warm container “serves all six agents”, but the PR adds dsh as the 8th agent. This should be updated to avoid misleading downstream consumers of llms.txt.

> Docker-first launcher for AI coding agents — Claude Code, Codex, Gemini, Grok, Kimi, opencode, pi, and dsh.
> The container is the sandbox, mounts are the explicit contract, and one warm
> project container serves all six agents. A bash script, not a framework. MIT.

The hermetic fake registry hard-errors on unknown URLs by design; dsh needed dist-tags + packument fixtures, an image-label current for the outage fallback, and its pin in the written-pins assert. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated no new comments.

Suppressed comments (2)

llms.txt:5

This description still says the warm project container serves "all six agents", but the doc now lists 8 agents (including dsh). This is now internally inconsistent.

> Docker-first launcher for AI coding agents — Claude Code, Codex, Gemini, Grok, Kimi, opencode, pi, and dsh.
> The container is the sandbox, mounts are the explicit contract, and one warm
> project container serves all six agents. A bash script, not a framework. MIT.

scripts/test-dsh-auth.sh:67

The mount-absence assertions include a trailing quote in the needle (":/home/deva/.dsh"") but deva.sh --dry-run prints docker args without quoting. This can let the test pass even if a ~/.dsh mount regresses into api-key mode.

want_absent "no ~/.dsh mount in api-key mode" ":/home/deva/.dsh\"" "$apikey_out"
echo "=== dsh api-key: no mount on the hybrid config-root path either ==="
hybrid_apikey_out="$(DEEPSEEK_API_KEY=sk-ds-test-1234 run_dry dsh --auth-with api-key --dry-run || true)"
want_absent "hybrid layout: no ~/.dsh mount in api-key mode" ":/home/deva/.dsh\"" "$hybrid_apikey_out"

lroolleand others added 2 commits August 13, 2026 21:56

CopilotAI lite review requested due to automatic review settings August 14, 2026 05:11

Copilotstarted reviewing on behalf of lroolle August 14, 2026 05:11 View session

chatgpt-codex-connectorBot reviewed Aug 14, 2026
View reviewed changes

CopilotAI reviewed Aug 14, 2026
View reviewed changes

lroolle mentioned this pull request Aug 14, 2026
feat(agents): add cursor as the 9th agent #560
Merged
4 tasks

test(release-utils): dsh joins the agent/main tool lists
3616de0
Missed in the dsh commit: tests/test_release_utils.sh pins the registry tool lists; 70/70 again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CopilotAI review requested due to automatic review settings August 14, 2026 05:22

Copilotstarted reviewing on behalf of lroolle August 14, 2026 05:22 View session

CopilotAI reviewed Aug 14, 2026
View reviewed changes

CopilotAI review requested due to automatic review settings August 14, 2026 05:32

Copilotstarted reviewing on behalf of lroolle August 14, 2026 05:33 View session

CopilotAI reviewed Aug 14, 2026
View reviewed changes

lroolle merged commit 8313619 into mainAug 14, 2026
6 checks passed

lroolle deleted the feat/dsh-agent-556 branch August 14, 2026 05:42

Navigation Menu

Uh oh!

feat(agents): add dsh as the 8th agent - #559

feat(agents): add dsh as the 8th agent#559
lroolle merged 4 commits into
mainfrom
feat/dsh-agent-556

lroolle commented Aug 14, 2026

Uh oh!

chatgpt-codex-connectorBot left a comment

Uh oh!

chatgpt-codex-connectorBotAug 14, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

CopilotAI left a comment

Uh oh!

CopilotAI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

lroolle commented Aug 14, 2026

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connectorBotAug 14, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants