DeepSeek Harness v0.1.2-rc.1: Default npm Upgrade

DeepSeek released dsh-v0.1.2-rc.1 on September 3, 2026, and npm moved both latest and next to @deepseek-ai/[email protected]. A plain npx @deepseek-ai/dsh web therefore no longer starts 0.1.1-rc.2; it resolves to the new 0.1.2 release candidate.

This release collects the major user-interface, Agent Teams, SDK, networking, safety, and Session architecture changes made after 0.1.1-rc.2. It remains a developer preview and a GitHub pre-release, not a stable release, but its position on npm's default channel gives it a wider impact than the preceding alpha builds.

The short version

New installs now receive rc.1 by default. Before upgrading an existing environment, back up Sessions and configuration, verify plugins, and pay particular attention to the removed SQLite Session backend, one-time remote-access tokens, the PTC Mode rename, and Session API changes.

Release status

Pin the version when reproducibility matters:

npx @deepseek-ai/[email protected] web

The unpinned command now resolves to rc.1 too:

npx @deepseek-ai/dsh web

Changes users will notice

The conversation stream now folds process details and the System prompt before completed answers by default, supports adaptive or drag-resizable content width, and shows token usage and elapsed time at the end of an answer. Full-history turn navigation, streaming code highlighting, background image uploads, draft preservation, and connection recovery also improve long-running use.

Plugin settings distinguish conversation-scoped and global plugins and make other Agent Presets easier to inspect. The model catalog supports search and filtering, while custom model discovery reuses Profile request headers. These changes improve configuration visibility but do not certify third-party plugin compatibility.

Agent Teams and subagents

Parents and continuable child Agents exchange follow-up messages through send_message, replacing the previous one-way report tool. Callers can also select a provider, model, reasoning effort, and maximum output length within the Agent's allowed choices.

Projects should test sender attribution, ordering, cold recovery, and child-Agent lifecycle behavior. Loading a composition successfully is not enough to prove that follow-ups still behave correctly during a long task.

Web, Headless, SDK, and remote access

The Python SDK gains a Windows x64 runtime. ACP fills out standard Session controls, model settings, MCP, permissions, and cancellation. Python SDK, Headless, ACP, and custom Profiles receive web_fetch by default, while Headless streams progress to stderr and reserves stdout for the final result.

Network access to the Web interface now requires the one-time token carried in the launch URL. Reverse proxies, remote desktops, and custom launchers must not assume that reaching the port is sufficient authentication.

Compatibility changes to review

Rc.1 includes several changes that can affect existing environments:

• Code Mode is now PTC Mode; old conversation records remain readable.
• The optional SQLite Session persistence backend is removed. Existing data is not deleted, but an older version is required for export.
• Session.events is replaced by on-demand APIs such as seq, eventAt(), and snapshotEvents().
• The Remote gateway removes the legacy APIProxy path.
• Web PTC Mode no longer exposes the general-purpose workflow tool by default.
• Public web_fetch is enabled by default with SSRF protection; fetched content must still be treated as untrusted data.

Do not skip the safety note

The official Safety Notice now states that DeepSeek Harness has not been security-audited and that sandboxes, approvals, and permissions do not guarantee isolation. Plugins run with user authority, so review source code, network behavior, filesystem access, and credential boundaries before enabling them.

Upgrade checklist

1. Record the current DSH, plugin, and Preset versions, then back up important Sessions and configuration.
2. Test rc.1 with a separate $DSH_HOME or disposable Profile.
3. Review SQLite Session use, Remote entry points, PTC tool composition, and custom Session APIs.
4. Exercise real startup, tool calls, Session resume, and subagent messaging for critical plugins.
5. Move the daily environment only after those checks pass; a changed npm default is not proof of compatibility.

Related reading

• DeepSeek Harness v0.1.2-alpha.5: release notes and npm status
• DeepSeek Harness v0.1.3-alpha.1: Session v2 and general file uploads
• DeepSeek Harness setup guide
• DeepSeek Harness security guide

Frequently asked questions

Is rc.1 stable?

No. GitHub marks it as a pre-release and the project remains a developer preview. It is the current npm default, not a stable release.

Which version does the plain npx command install?

As of September 5, 2026, npm's latest and next tags both point to 0.1.2-rc.1, so an unpinned command resolves to rc.1.

Should I upgrade directly from rc.2?

Test in isolation first. The 0.1.2 line collects storage, Remote authentication, Session, and plugin API changes from several alpha releases; a successful launch alone is not a sufficient migration test.