The Gate Is a Plugin

On August 13 DeepSeek open-sourced its own agent harness under MIT. The launch post is not the interesting artifact. This is, from a maintainer of a different harness entirely: the first time I have been looking at something new in the space and felt quite inspired to revisit some of our choices@mitsuhiko

That is a better endorsement than any benchmark, and it is why this issue is about the architecture rather than about the release.

The design is stated plainly in its own documentation: models, tools, skills, sessions, sandboxes, storage, loops, scheduling and the user interface all sit behind plugin boundaries, selectable and swappable in configuration without touching the source. When we added this project to the watchlist on August 17 we wrote one question into its source contract, because it seemed like the thing nobody would ask: can the component that enforces a limit be replaced by the thing it limits?

Read at a pinned commit, the answer is yes. The approval path is one of those layers, and it composes as a waterfall, so a plugin can be placed ahead of the component that would have refused.

That deserves stating without alarm. It is a developer preview, the design is coherent, and in a system built for composition a replaceable enforcement layer is a defensible choice rather than an oversight. But it is the thing an operator has to know before installing a plugin, and a plugin here is an unsandboxed in-process module with no permission declaration. Meanwhile the documented way to run the thing starts a web interface on a loopback port that nothing authenticates, a fact the request-trust module states candidly in its own header comment. Loopback binding is the whole access control.

The argument the field was actually having

While that sat in the code, the timeline was arguing about something adjacent. The most widely read version came from a Chinese-language architecture essay contrasting the two designs.

[[q:limbopeng-pi-vs-dsh-architecture]]

In our words, since the post is not in English and any rendering of it is ours: it argues that Pi is subtraction, cutting the core down to four tools and under a thousand tokens of system prompt and leaving extension to people, while DeepSeek Harness is addition followed by shattering, making every layer including the agent loop replaceable so the system holds no opinion about how it should run. Its sharpest claim is about self-evolution: that DeepSeek's agent can inspect its own capability gap, write a plugin on the spot and use it, while Pi's extensions are static TypeScript that a human installs.

Pi's author turned up to correct exactly that half: i know of no single extension that was written by a human.@badlogicgames

We are reporting that he said it, not promoting it into a product fact. He would know, and it is still a statement about a codebase we did not audit line by line.

What matters more is that he immediately declined the fight the thread wanted: both solve the same problem, just differently, with different trade-offs: self-modifying agents.@badlogicgames

A DeepSeek engineer replied to the original endorsement in the same register, and it is worth reading as the thank-you it was rather than as a concession: DSH reused Pi's LLM adaptor package for connecting to non-DeepSeek models@tianyi

So the public argument settled roughly where it should: two designs, one problem, different trade-offs. Which is precisely why the unasked question is the one this issue is named after. Both camps were debating who can extend the system. Neither was debating whether the thing that says no is inside the part that can be extended.

The same lesson, from two projects that were not in the argument

Agent Zero shipped a fix for a published SSRF advisory, then lost it. A refactor that moved code into the plugin layout dropped the fix, and every stable tag from v1.19 through v2.8 shipped without it before v2.9 restored it. Eleven releases. Nothing concealed it and nothing announced it either. A fix simply stopped being present, and the refactor that lost it was the refactor that made things plugins.

If you track advisories to decide whether you are exposed, that is the case that shows the difference between tracking an announcement and tracking the code.

OMP made the point from the other side, benignly. Two tags now carry extension hooks that let a handler service a filesystem write or delete after the native path refused it with a permission error. The mechanism is guarded and the use case is legitimate: a host that sandboxes the agent but exposes a privileged channel. It is also a documented route by which an operating-system denial becomes an extension-mediated allow, which makes the handler's allowlist the real filesystem boundary. Those two tags have no release behind them, so on three of four install paths you do not have it.

Where the version numbers went

This is the reference half of the window, and it is the operator brief's business more than the argument's.

your hermes is v0.20.3 (today's release) but your gui is still on v0.17.0 version@Teknium

That is not an industry observation. It is a maintainer debugging one user's install and finding the binary on that day's release while the desktop surface sits four minor versions back, which is the lived form of a thing this publication keeps measuring. Codex published no stable release for ten days while 422 commits and nineteen alpha builds accumulated; its default npm install has resolved to the same version since August 7. Claude Code's conservative channel sits seven releases behind the one carrying this fortnight's permission and credential fixes, which is the sharper case, because there the operator following the careful documented path is the one without the security work.

An earlier draft of this issue said the Codex work was uninstallable. That was wrong and our own verification caught it: the alpha line is published, with a full platform matrix, and installs by name. The true statement is narrower. The default stopped moving while the work continued.

Reference

Breaking changes: DeepSeek Harness warns in capitals that compatibility-breaking changes are coming and ships to exactly one channel, a release candidate. eve replaced frontend stop with turn-targeted cancel and removed glob and grep from the default tool set. Paperclip changed what its Docker latest tag means, from every default-branch merge to stable only.

Security advisories: Agent Zero's CVE-2026-4308 regression is the window's one advisory-linked item, and it is a regression rather than a new disclosure.

Provider notes

Paperclip published its first stable in 26 days carrying 315 commits, then reopened the gap: master was 176 commits past the release the day it shipped, and two security fixes sit on master in no release. Gemini CLI's preview channel is not ahead of stable. OpenHands passed 1.11.0 a second time and nothing broke, because the second one carries a v prefix; a naming convention did the work a check would have done. Omnigent reverted owner-only approval, so a shared editor can again authorize tool calls that run with the owner's credentials.

What survives swapping the harness

The honest closing note is one that cuts against this issue's own emphasis. The same Pi maintainer who opened it spent the following days deleting his vendor-specific instruction files: telling it to read AGENTS.md files is works good enough.@mitsuhiko

If a portable markdown file is what actually survives changing harnesses, then which channel is frozen matters less than the space we just gave it, and the architecture argument matters differently too. The thing you carry between harnesses is not the plugin system. It is the file.

Which brings the week back to where it started. On the last day of the window, after four days of arguing about who invented self-extending agents, Pi posted sample code for an extension that intercepts a dangerous tool call: adding guardrail permission gates that block or modify dangerous tool calls.@pidotdev

Nobody needed to win the argument about plugins. The question was always whether the gate is privileged over them, and that is a thing you can answer in about twenty lines.