Extensible All the Way Down

On 13 August DeepSeek open-sourced its own coding-agent harness under MIT. The launch post was not the telling reaction. Armin Ronacher, a maintainer of Pi, a different harness entirely, said it was the first time I have been looking at something new in the space and felt quite inspired to revisit some of our choices@mitsuhiko

What inspired him is stated plainly in the architecture page: the model adapter, the tools, the session log and the agent loop itself are plugins, “so every part is replaceable from configuration. There is no privileged core to patch.”

The approval path is one of those parts. It runs as a waterfall where the first answer wins, so a plugin registered with prepend can answer every permission question before the built-in gate is asked. The one hard stop is the never policy, checked before the waterfall runs. And a plugin is an unsandboxed TypeScript module in the harness process, with no permission declaration.

That is a coherent design for a developer preview, not an oversight. It also means installing a plugin is closer to curl | sh than to adding an editor extension. The documented way to run it starts a Web UI on 127.0.0.1:3080 that nothing authenticates, and the request-trust module says so in its first comment: “this fence is not an auth layer.” On a shared machine, port 3080 is a shell.

The field argued about who extends the harness

The most widely read response was a Chinese-language essay setting DeepSeek’s design against Pi’s:

It casts Pi as subtraction, four tools and a system prompt under a thousand tokens, and DeepSeek as addition followed by shattering. Its sharpest claim is that DeepSeek’s agent can spot its own capability gap and write a plugin on the spot, while Pi’s extensions are static code a human installs.

The same reading travelled faster as a parable, Pi the sage who finds a few first principles and DSH the anxious packer: DSH 像一个害怕遗漏的普通人：看见什么重要，就往行囊里再塞一样东西。最后拥有了所有装备，却仍然不知道自己要去哪里。@alading22 In our rendering: whatever looks important goes in the bag, until it holds all the gear and still does not know where it is going. Someone who had spent the week writing up DSH’s internals answered from inside the bag: 「复杂度不是消失了，而是转移进了系统内部」@QuantumTransf, in our rendering, complexity did not disappear, it moved into the system. The same post says that for a plugin author it is not that complicated.

Pi’s author, Mario Zechner, answered that half directly: i know of no single extension that was written by a human.@badlogicgames Jeffrey Emanuel said the same thing the next day about his own orchestrator, ntm: The human isn’t the target user, the user is another agent. Why would you want to be messing around with it yourself? Then you’re the bottleneck again, just in a different way.@doodlestein Back in the thread, an hour after his first reply, Zechner declined the fight it wanted: both solve the same problem, just differently, with different trade-offs: self-modifying agents.@badlogicgames

A DeepSeek engineer replied to Ronacher in the same key, with a thank-you and a debt: DSH reused Pi's LLM adaptor package for connecting to non-DeepSeek models@tianyi

So the public argument settled about where it should. Two designs, different trade-offs, some shared code. What nobody in the thread asked is whether the component that refuses sits inside the part that can be extended.

Two other projects answered that question this week

Neither was in the argument.

Agent Zero fixed CVE-2026-4308, an SSRF in document query, in April. On 29 May the refactor that moved document query into a plugin gave it its own fetch code, which called the network directly. The safe fetcher stayed in the tree, uncalled. Eleven stable releases, v1.19 through v2.8, shipped without the fix before v2.9 restored it with one line under “Fixes”. The repository has no security advisory for the regression.

OMP, the Oh My Pi fork, made the point benignly. Its v17.3.6 tag lets an extension supply a writer that is consulted when the OS refuses a write with a permission error. The purpose is legitimate: a host that sandboxes the agent but offers a privileged channel. The brokered path resolves symlinks and identifies the session. Still, once a handler is registered, the OS denial is a suggestion and the handler’s allowlist is the filesystem boundary. It is at least a case somebody planned for. OMP’s maintainer, Can Bölük, who says he runs agents unsupervised on most fixes, put the failures in the other kind: slop mostly happens because you have bad fundamentals, i.e. an issue comes along and you need a whole refactor because it was not a scenario you thought of when actually architecting the thing and requires a lot of thinking which the agent decided to hack in instead.@_can1357

One lost a security fix by becoming a plugin. The other moved a security decision into one on purpose.

What became possible

The same week made the stack more portable, and that is the other half of this story.

DeepSeek’s harness runs OpenAI and Anthropic models on a supported, CI-tested path, and drives Codex and Claude Code as subagents. A lab shipping a harness that does not assume its own model is a bet that the durable layer is not the model. The adapter underneath is Pi’s, which is the debt the DeepSeek engineer was acknowledging.

The people writing plugins read the unsandboxed module as the opposite of a risk. One who had built some said that after a stretch of natural-language programming and Skills, DSH 似乎又把开发者拉回了那个熟悉的代码战场@verysmallwoods; in our rendering, DSH seems to pull developers back onto the familiar battlefield of code. Same surface, other half.

Claude Code 2.1.233 removed its todo and task-tracking tools on Opus 4.8, Sonnet 5, Fable 5 and newer models. This is Bitter Lesson Maxing, building where better models compound rather than erase your work, done by a vendor to itself: scaffolding the newer models no longer need, deleted. Anything that scored or watched TodoWrite goes quiet rather than failing; CLAUDE_CODE_ENABLE_TODO_TOOLS=1 brings it back.

Google began merging agent-written pull requests into Gemini CLI’s main branch. Eight titled [SSR Agent] Issue Fix merged in the window, with a human approving at least one of them, #28812. None is in a tag yet.

And Ronacher, two days after the launch, deleted his vendor-specific instruction files. Debugging a possible Pi regression in Claude Code, he found that telling it to read AGENTS.md files is works good enough.@mitsuhiko If a portable markdown file is what survives a change of harness, the plugin system is not what you carry. The file is.

The default install stopped moving

For operators, the week’s reference problem was which build they were actually on. A Hermes maintainer, debugging one user’s install, found it split in two: your hermes is v0.20.3 (today's release) but your gui is still on v0.17.0 version@Teknium

Codex published no stable release for ten days. Its default npm install has been 0.147.0 since 7 August while 422 commits and nineteen alpha builds piled up on 0.148.0. The work installs by name on the alpha tag; nobody lands there by default. Claude Code’s stable channel is designed to lag about a week and sits seven releases behind latest. That is the sharper case: the team that chose the careful path is the one without the fortnight’s permission fixes.

Breaking changes and security notes

DeepSeek Harness warns in capitals that compatibility-breaking changes are coming, and ships to one channel, a release candidate.

eve 0.38.0 replaces frontend stop with turn-targeted cancel. 0.39.0 removes glob and grep from the default tool set. What stop should stop was a live question that week. Peter Steinberger said he had just changed it in OpenClaw’s harness, asking If you press stop and 64 subagents are happily coding and modifying files - is that really what you want?@steipete

Paperclip changed its Docker latest tag from every default-branch merge to stable only.

Provider notes

Paperclip. Its first stable in 26 days, v2026.817.0, carried 315 commits. Master was already 176 commits past it the day it shipped, including a sandbox capability contract that fails closed. A release this late is a snapshot, not a catch-up.

Omnigent. v0.9.0 reverted owner-only approval, a change its own PR labels a security regression. A shared editor can again authorize tool calls that run with the owner’s credentials, eight days after delegation was a headline.

Gemini CLI. The preview channel is not ahead of stable: v0.56.0-preview.1 is v0.55.1 minus one OAuth fix. Six days of main-branch work, including the agent-written pull requests, is in no tag.

OpenHands. Passed 1.11.0 a second time without a collision, because the second one carries a v prefix.

DeepSeek Harness, Agent Zero, OMP, Codex, Claude Code, Hermes, OpenClaw, Pi. Covered above and in the brief. Antigravity, eve, heypi, Flue, Agent Flywheel. Nothing that changes the read.

Closing

Nobody needed to win the argument about plugins. On the last day of the window Pi posted sample code for event-interception extensions, adding guardrail permission gates that block or modify dangerous tool calls.@pidotdev Its example makes the agent ask before rm -rf. That is the question the week kept asking, answered in about twenty lines. A builder of agent infrastructure gave the operator’s version the same day: the number one rule is: never believe Agents will do as told.@fagamericano An instruction in AGENTS.md is not a vault. Extend everything, then decide which part cannot be extended, and put the refusal there.