{"slug": "deepseek-s-open-source-dsh-superagent-explained-who-can-give-it-work-and-what-it", "title": "DeepSeek's open-source dsh-superagent, explained: who can give it work, and what it can run", "summary": "DeepSeek published dsh-superagent, an MIT-licensed research prototype coding agent for a single GitHub repository that accepts requests from GitHub and optionally Feishu and replies with pull requests. DeepSeek says the prototype differs from its internal version, and its documentation sets the default accept mode to \"observe,\" which records what the agent would have done without running it, while each work item runs commands without approval as the operator's OS user. Only an allowed person who addresses the agent counts as an explicit request, bots can never make explicit requests, and proactive work requires a written rule before it can start.", "body_md": "# DeepSeek's open-source dsh-superagent, explained: who can give it work, and what it can run\n\nDeepSeek posted dsh-superagent, an MIT-licensed research prototype of a coding agent that takes requests from GitHub and Feishu and answers with pull requests. We read its authorization and execution docs and explain the permission model, the safe defaults, and the one line every operator should read before installing it.\n\n**This explains reporting by**\n\n[deepseek-ai/dsh-superagent-prototype on GitHub (MIT license)](https://github.com/deepseek-ai/dsh-superagent-prototype).\nRead the original first:\n\n[https://github.com/deepseek-ai/dsh-superagent-prototype](https://github.com/deepseek-ai/dsh-superagent-prototype)\n\n## In one minute\n\n- dsh-superagent is a coding agent for one GitHub repository, packaged for DeepSeek Harness. It listens to GitHub and, optionally, Feishu, and answers in the same conversation, for example with a pull request.\n- DeepSeek calls it a research prototype, not an official product, and says it differs from its internal version.\n- A request counts as explicit only when an allowed person addresses the agent. Bots can never make explicit requests.\n- Work nobody asked for needs a rule the team wrote, and the default mode, observe, only records what the agent would have done.\n- Each piece of work gets its own worker session and folder, and that worker runs commands without approval as the operator's OS user. Give it its own user or machine.\n\n## What it is\n\nThe repository describes a proactive coding agent for one GitHub repository. When an allowed person asks for work, it opens a work item, called a Ticket, does the work in its own session and folder, and replies where the request was made. A web panel lists only what needs a person.\n\nIts stated principle is to take as little human attention as possible and give as much value as possible. It confirms a request once, stays quiet while working, and writes again when a result is ready, a decision is needed, or it cannot finish.\n\nSetup is done by asking a coding agent to follow SETUP.md, one question at a time. The README does not name which model runs it.\n\n## Who can start work\n\nEach incoming message gets a strength.\n\n```\nexplicit      an allowed person addresses the agent,\n              or follows up on a thread that already has a Ticket\ninferred      an unlisted person follows up on a Ticket's thread;\n              a bot on the Source's bot list addresses the agent\nnot admitted  any other bot; anything the admission table ignores;\n              every inferred case while accept mode is off\n```\n\nEach Source has an admission table with safe defaults. An allowed person who does not address the agent: inferred. An unlisted person who addresses it: ignored. An unlisted person who does not address it: ignored.\n\nSetting the unlisted-and-addressed cell to explicit lets anyone in that chat request work by mentioning the agent. The docs suggest it for a dedicated support chat. It is also the setting to be most careful with.\n\n## Work nobody asked for\n\nProactive work needs a written rule, and the accept mode decides what happens.\n\n- off: nothing inferred becomes a candidate.\n- observe, the default: inferred candidates are assessed, and a yes is recorded as \"would accept\", but nothing runs.\n- auto: a positive assessment starts the work.\n\nExplicit requests work in every mode. The docs say to start in observe and switch to auto only after reviewing what it would have done.\n\n## Mandates: permission that can be taken back\n\nEvery accepted Ticket carries a Mandate recording why it was allowed: the rule, the sender, the policy version. Only three things change a Mandate: accept creates it, a person's stop withdraws it, and a failed check revokes it.\n\nBefore an ended Ticket resumes, the host checks the Mandate again. Remove a person from the allowed list and Tickets that rested on that person can fail the check. Messages, comments and quoted documents are inputs, the docs say; they cannot change permissions. That is the right line against prompt injection through an issue comment.\n\n## The line to read before installing\n\nFrom docs/003-execution.md: each Ticket gets a worker session named worker- plus the Ticket ID and its own folder under the execution root, by default the state directory's work folder. Executor sessions run commands without approval as the operator's OS user.\n\nSo the agent has whatever your user account has: SSH keys, cloud credentials, other repositories. Shell commands move to the background after 5 seconds, and background work gets at most 30 more minutes after a turn before jobs are killed.\n\nOur reading: the authorization model controls who can ask. It does not limit what a worker can touch once it runs. That part is on you.\n\n## A setup checklist\n\n- Run it as a dedicated OS user on a spare machine or VM with no personal keys.\n- Give its GitHub account access to the one repository only.\n- Start with a short allowed list and accept mode at observe, as the docs advise.\n- Leave the unlisted-and-addressed cell at ignore unless the chat is a closed team space.\n- Read what it posts in your name; the docs say the operator owns every message it sends.\n\n## Who is affected\n\n| Case | Status | \n|---|---|\n| Teams trying dsh-superagent | Research code. Review it, and isolate the worker user, before pointing it at a real repository. | \n| DeepSeek's internal version | Not public. The README says the published code differs from it and from the design article. | \n\n## What to do\n\n- Read docs/000, 002 and 003 before running SETUP.md.\n- Create a separate OS user or VM for the agent.\n- Keep accept mode on observe until you have read its recorded decisions.\n- Scope its GitHub token to one repository.\n\n## What is still unknown\n\n- Which model the agent uses by default. The README does not say.\n- How the published code differs from DeepSeek's internal version.\n- How well the authorization rules hold up against a determined prompt injection. We found no outside test.\n- Whether DeepSeek will keep maintaining it. It is labeled a research prototype.\n\n## Sources\n\n- [deepseek-ai/dsh-superagent-prototype on GitHub (MIT license)](https://github.com/deepseek-ai/dsh-superagent-prototype) — the original report\n- [dsh-superagent docs, 002 Authorization](https://github.com/deepseek-ai/dsh-superagent-prototype/blob/main/docs/002-authorization.md)\n- [dsh-superagent docs, 003 Execution](https://github.com/deepseek-ai/dsh-superagent-prototype/blob/main/docs/003-execution.md)\n- [dsh-superagent docs, 000 Philosophy](https://github.com/deepseek-ai/dsh-superagent-prototype/blob/main/docs/000-philosophy.md)\n\n[AI News Report](https://theainewsreport.com/)· every headline, every morning.", "url": "https://wpnews.pro/news/deepseek-s-open-source-dsh-superagent-explained-who-can-give-it-work-and-what-it", "canonical_source": "https://theainewsreport.com/2026-11-02-deepseek-dsh-superagent-permissions-explained.html", "published_at": "2026-11-02 15:29:39+00:00", "updated_at": "2026-11-02 15:52:33.549330+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "artificial-intelligence"], "entities": ["DeepSeek", "dsh-superagent", "DeepSeek Harness", "GitHub", "Feishu"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/deepseek-s-open-source-dsh-superagent-explained-who-can-give-it-work-and-what-it", "markdown": "https://wpnews.pro/news/deepseek-s-open-source-dsh-superagent-explained-who-can-give-it-work-and-what-it.md", "text": "https://wpnews.pro/news/deepseek-s-open-source-dsh-superagent-explained-who-can-give-it-work-and-what-it.txt", "jsonld": "https://wpnews.pro/news/deepseek-s-open-source-dsh-superagent-explained-who-can-give-it-work-and-what-it.jsonld"}}