Working notes for people who install, review, and write Cordis plugins for DeepSeek Harness — an everything-is-a-plugin agent runtime.
Developer notes · Not affiliated with DeepSeek AInpx @deepseek-ai/dsh web → http://127.0.0.1:3080Assemble a minimal tools/runtime/UI stack, pin versions, dump-config diffs, and keep Discover from becoming a junk drawer.
Plain-language takeaways from public 2026 Harness security discussions, plus a defensive install checklist.
Compare install paths, feedback loops, dependency intuition, and the uninstall/patch mismatch that confuses newcomers.
Isolated DSH_HOME, start the Web UI, install one bundle, verify with dump-config, restart, and dodge common pitfalls.
A map of Cordis, profiles, bundles, and why almost every Harness capability is a replaceable plugin row.