AI coding tools
DeepSeek Harness 0.1.2 Alpha Enables Model Selection for Subagents, Completes ACP Permission and Cancellation Controls
The latest DeepSeek Harness release lets a primary agent select providers, models, reasoning effort, and output limits for subagents within its authorized scope. It also completes ACP interfaces for sessions, MCP, permissions, and cancellation. The release expands networking and external-model integrations, but the maintainers explicitly warn that its sandbox and approval mechanisms should not yet be considered secure isolation.
DeepSeek Harness 0.1.2-alpha.1 changes multi-agent model routing from fixed configuration to controlled runtime selection. When the relevant permissions are enabled, a primary agent can choose the provider, model, and reasoning effort for a subagent. Callers can also specify the maximum output length, while Claude Code and Codex subagents can use their own model configurations. This allows engineering teams to route planning, code changes, and quick queries to models at different cost and capability tiers without building a separate workflow for every combination.
On the interoperability layer, the release completes standard Agent Client Protocol capabilities for session control, model configuration, MCP, permissions, and cancellation. It also provides a Windows x64 runtime for the Python SDK. Headless mode now sends progress updates to stderr and writes only the final result to stdout, making it easier to integrate with shell pipelines and automated evaluations. The official DeepSeek adapter includes the names and versions of enabled plugin packages by default. This telemetry can be disabled, while incremental uploading of Session logs remains explicitly opt-in.
The security boundary has also changed in notable ways. The remote Web interface now requires a one-time token embedded in the launch URL. Public WebFetch is enabled by default and relies on built-in SSRF protections instead of requesting user approval for every operation. In PTC mode, SDK capabilities have been moved back inside `run_code`, preventing models from invoking them directly as ordinary tools. However, the maintainers have updated the security notice at the same time: the project has not undergone a security audit, and its sandbox, permissions, and approval mechanisms do not guarantee isolation. Deployers should still restrict files, networking, and credentials at the operating-system or container layer, and verify whether plugin authentication controls broaden privileges. This release remains an alpha. Areas to watch next include whether model-routing authorization produces auditable events, the test coverage of WebFetch protections, and compatibility among ACP clients.