Agent Runtime Brief · 2026-08-18
An open-source agent runtime released on 13 August 2026. It is not a new model, and it is not a drop-in Claude Code. The line that matters is Everything is a plugin.
Claude Code and Codex are finished coding agents: install them and they work. You extend them from the outside. dsh is a framework for assembling an agent runtime. The model, the tools, the sandbox, the session, and even the agent loop are replaceable plugins. It will disappoint you as a Claude Code swap. It fits if you were about to write a harness yourself.
Underneath is the Cordis microkernel: it mounts plugins, resolves dependencies, and moves events. It holds no business logic. A running instance starts from an empty plugin tree, then stacks bundles, a profile, user patches, and CLI overlays. The usual start is npx @deepseek-ai/dsh web. The local UI is at 127.0.0.1:3080. There is also a headless one-shot runner. There is no bundled TUI.
The core rule is Model-visible means logged. System prompts, reasoning, tool calls and results, sub-agent scheduling, and context injections must be rebuildable from an append-only session log. Fork, resume, search, and replay all use that same stream.
Full toolset: file edits, shell, search, skills, plans, goals, sub-agents, workflows.
The model writes TypeScript to batch several tool calls and cut round-trips.
Only bash and str_replace_editor, so the harness interferes less with model evals.
Runtime introspection. Try plugins in memory and compose a new preset. The sharpest mode, and the riskiest.
| Point | Why it matters | Who actually needs it |
|---|---|---|
| You own the runtime | MIT source. The docs say there is no privileged core to patch. Loop, sandbox, and UI can all be swapped without forking a closed product. | Platform teams building an internal agent product |
| A request can be rebuilt | The prompt, tool schema, and injected context the model actually saw live in the log. When step forty goes wrong, you can return to that moment instead of guessing. | Evals, audits, long-run debugging |
| Capability seam | A capability splits into Definition / Provider / Consumer. Point the sandbox at a remote host and Bash, PTY, and LSP can move with it. The tool schema can stay the same. | Enterprises that need their own permissions, storage, and telemetry |
| A sub-agent is a provider | Claude Code or Codex can run as an execution node. The question becomes who orchestrates whom, not which one you must pick. | Multi-agent setups and mixed-vendor strategy |
| Cost on long jobs | The harness is free to run. It is shaped around DeepSeek V4: long context, lower unit price. On a multi-hour repo walk, that gap adds up. | Teams that can use DeepSeek models and watch token spend |
| The runtime can extend itself | Optional cordis_define / cordis_run lets the agent write and hot-load a plugin mid-session. Closed agents cannot do this. | Research and experiments. Leave it off in production. |
| Risk | What is true today | What it costs you |
|---|---|---|
| Not a production product | The README says, in capitals, THERE WILL BE COMPATIBILITY-BREAKING CHANGES. npm is still 0.1.x RC. Issues are off. Feedback goes to Discussions. | Plugins, profiles, and internal wrappers may break on the next release |
| Rougher first hour | Web UI and headless only. No tmux/ssh TUI. No importer for CLAUDE.md. Existing skills and hooks do not port. | Daily coding teams will feel it is unfinished |
| Safety is yours | The default sandbox is mostly about files. Network and process visibility need extra setup. Community plugins are unaudited and run in-process. Session logs are plain text, including prompts and tool results. | Compliance reviews will stall. Treat .sessions as a secret log. |
| Model-neutral is architecture, not equal results | Adapters can point at OpenAI-compatible endpoints. V4 was post-trained on this harness. Other models get generic tool-calling without that fit. | Swapping in Claude or GPT does not replay V4’s behavior on dsh |
| Plugin tax | Cordis + pnpm + about 80 plugins. The community layer is days old. HN already mentions hangs, missing timeouts, and memory pressure from concurrent sub-agents. | You stop using a product and start operating a framework |
| No compliance packet | No SOC 2 or ISO material for procurement. Revenue still sits on the API. Peak/off-peak pricing for V4 began on 16 August 2026. Peak output is about 4.5× the old rate. | Buying and cost forecasts are still unstable |
Ranked by real overlap, not by stars. 1–3 are finished coding agents. 4–5 are closer to the kind of harness dsh actually is.
| # | Product | What it is | License / maturity | Stars | Versus dsh |
|---|---|---|---|---|---|
| 1 | Claude Code | Anthropic’s finished agent. CLI / IDE / Desktop / Web, plus CLAUDE.md, skills, hooks, MCP, and sub-agents. The default for long autonomous work. | Proprietary · GA since May 2025 | 142k | Ceiling on polish and stability. dsh wins on a replaceable core. It loses on “can this ship today.” |
| 2 | OpenAI Codex | OpenAI’s finished agent. Rust CLI plus IDE, desktop, and cloud. Strong kernel-level sandbox and a tight fit with GPT. | CLI is Apache-2.0 · GA | 107k | Same layer as Claude Code. Harder isolation. dsh is more open and more recomposable. |
| 3 | OpenCode | The most-starred open-source coding agent. 75+ model providers, TUI + desktop + IDE, Build/Plan modes, optional LSP diagnostics. | MIT · usable in production | 198k | Want an open Claude Code? Start here, not with dsh. dsh is about owning the runtime. |
| 4 | Pi | A minimal terminal harness from Earendil / Mario Zechner and Armin Ronacher. Default tools: read, write, edit, bash. Extensions sit around the loop. Very short system prompt. | MIT · actively iterated | ~54k | Closest peer. Pi keeps a small core. dsh makes the core itself a plugin. Ronacher said dsh made him revisit his own choices. |
| 5 | Goose | Block’s general-purpose agent, under Linux Foundation AAIF governance. Plan-first, deep MCP, not only coding. Built for enterprise automation. | Apache-2.0 · foundation-governed | 53k | Stronger governance and cross-domain orchestration. dsh is more of a composable coding-runtime kernel. |
Stars for Claude Code, Codex, OpenCode, Goose, and dsh are from GitHub on 18 August 2026. Pi is an approximate figure from contemporaneous comparisons. OpenHands, at about 84k stars, is the closest runner-up: a sandboxed autonomous coding runtime, not a plugin microkernel.
| Dimension | dsh | Claude Code | Codex | OpenCode | Pi | Goose |
|---|---|---|---|---|---|---|
| What it is | Framework you assemble | Finished agent | Finished agent | Finished OSS agent | Minimal harness | General-purpose agent |
| How you extend it | Cordis plugins, including the loop | Skills / hooks / MCP | AGENTS.md / MCP | Custom agents / MCP | TS extensions around the loop | MCP / recipes |
| Models | Plugin; native fit for V4 | Anthropic first | OpenAI first | 75+ providers, most neutral | Multi-provider, light | Multi-model config |
| Default observability | Plaintext append-only event stream | Local transcript + rewind | Per-surface session | Session and TUI trace | JSONL session tree | Plan and recipe traces |
| Default surface | Web :3080 / headless | Terminal first, many surfaces | Terminal + IDE + cloud | TUI + desktop + IDE | Terminal | Terminal / desktop |
| Production-ready now | No, the project says so | Yes | Yes | Yes | Depends on the team | Already used in enterprises |
If the team already lives in Claude Code or Codex, needs a vendor for compliance, or needs a public bug queue at 2 a.m., do not migrate. dsh has no importer and no matching vendor duty.
If you want open source, model choice, and a TUI or IDE, start with OpenCode, not a five-day-old preview.
You were going to build a harness anyway. You need sandbox, storage, or approval on internal systems. You need to replay what the model saw. Or you want Claude Code and Codex as child agents.
Keep the sandbox read-only. Point it at your own endpoint. Treat .sessions as a secret log. Turn off dynamic cordis_* tools. Use a disposable branch. Do not move production yet.
2026-08-13 开源的 Agent Runtime Framework（dsh），不是新模型，也不是开箱即用的 Claude Code 替代品。口号是 Everything is a plugin。
Claude Code、Codex 是成品 Coding Agent：装上就能干活，扩展发生在外围。dsh 是用来组装 Agent Runtime 的框架：模型、工具、沙箱、Session、甚至 Agent Loop 本身都是可替换插件。用它替换 Claude Code 会失望；用它替换「自己写一套 harness」才对口。
底层是 Cordis 微内核：只负责插件挂载、依赖和事件，不含业务逻辑。启动时从空插件树开始，由 Bundle、Profile、用户 Patch 和命令行 Overlay 层层组合。默认入口是 npx @deepseek-ai/dsh web，本地 Web UI 跑在 127.0.0.1:3080；另有 headless 一次性跑完退出。没有随包 TUI。
核心不变量是 Model-visible means logged：系统提示、思维链、工具调用与结果、子 Agent 调度、上下文注入都必须能从 append-only Session Log 重建。Fork、Resume、搜索、回放走同一条事件流。
完整工具集：文件编辑、shell、搜索、skills、规划、目标、子 Agent、工作流。
模型写 TypeScript 编排多步工具调用，减少来回 round-trip。
只留 bash 和 str_replace_editor，用来压低 harness 对模型评测的干扰。
运行时自省，内存里试验插件，拼出新 preset。最激进，也最危险。
| 点 | 为什么重要 | 谁会真正用到 |
|---|---|---|
| 运行时所有权 | MIT 源码；官方写明 There is no privileged core to patch。Loop、沙箱、UI 都能换，不用 fork 闭源产品。 | 平台工程、要做内部 Agent 产品的团队 |
| 请求可重建 | 模型当时真正看到的 prompt、tool schema、注入上下文都在日志里。调试第几十步走偏时，能回到当时的上下文，而不是猜。 | 评测、审计、长任务排障 |
| Capability Seam | 一个能力拆成 Definition / Provider / Consumer。换远端沙箱时，Bash、PTY、LSP 跟着走，模型看到的 tool schema 可以不变。 | 要接内部权限、存储、遥测的企业 |
| 子 Agent 是 Provider | Claude Code、Codex 可以被挂成执行节点，而不是只能二选一。竞争从「谁替代谁」变成「谁编排谁」。 | 多 Agent 编排、混合供应商策略 |
| 成本结构 | Harness 免费自跑；默认对齐 DeepSeek V4 的长上下文与低单价。长跑仓库遍历时，价差会放大。 | Token 预算敏感、可接受 DeepSeek 模型的团队 |
| 运行时可自扩展 | opt-in 的 cordis_define / cordis_run：Agent 能在会话中编写并热加载插件。闭源 agent 做不到。 | 研究、实验性 runtime；生产默认应关掉 |
| 风险 | 现状 | 影响 |
|---|---|---|
| 不是生产件 | README 大写警告 THERE WILL BE COMPATIBILITY-BREAKING CHANGES。npm 仍是 0.1.x RC。仓库 Issues 关闭，反馈走 Discussions。 | 插件、profile、内部封装都可能被下次发布打断 |
| 开箱体验落后 | 只有 Web + headless。没有 tmux/ssh 友好的 TUI。没有 CLAUDE.md 导入器，现有 skills/hooks 不能平移。 | 日常写代码团队会觉得「还没成品」 |
| 安全与治理自负 | 默认沙箱偏文件系统；网络和进程可见性要自己配。社区插件未经审计，和 agent 同进程。Session 明文落盘，含提示词与工具结果。 | 合规审查过不了；.sessions 应按机密日志管 |
| 模型中立是架构，不是效果 | Adapter 可换 OpenAI 兼容端点；V4 是在这套 harness 上后训练的。别的模型只有通用 tool-calling，没有同等优化。 | 换 Claude/GPT 不等于能复现 V4 在 dsh 上的表现 |
| 插件税 | Cordis + pnpm + ~80 插件。社区插件几天内涌现，生态还没经过生命周期考验。HN 上已有卡死、无超时、并发子 Agent 内存压力的讨论。 | 运维复杂度从「用产品」变成「养框架」 |
| 商业与合规空白 | 无 SOC 2 / ISO 材料可交采购。收入仍靠 API；2026-08-16 起 V4 峰谷计价，高峰输出价约为原价 4.5 倍。 | 企业采购、成本预测都还不稳定 |
按「用户会拿它跟 dsh 比」的实际重叠排序，而不是单纯按 GitHub 星标。第 1–3 名是成品 Coding Agent；第 4–5 名才是更接近 dsh 的可组装 harness。
| # | 产品 | 它是什么 | 许可 / 成熟度 | Stars | 相对 dsh |
|---|---|---|---|---|---|
| 1 | Claude Code | Anthropic 成品 agent。CLI / IDE / Desktop / Web，CLAUDE.md、skills、hooks、MCP、subagents。长任务与自主循环的行业默认。 | 专有 · GA 自 2025-05 | 14.2万 | 体验与稳定性上限。dsh 赢在可拆核心，输在今天能不能交付。 |
| 2 | OpenAI Codex | OpenAI 成品 agent。Rust CLI + IDE + Desktop + Cloud。强项是内核级沙箱和对 GPT 系列的原生打磨。 | CLI 为 Apache-2.0 · GA | 10.7万 | 和 Claude Code 同一层。安全隔离更硬；dsh 更开放、更可重组。 |
| 3 | OpenCode | 目前星标最高的开源 Coding Agent。75+ 模型供应商，TUI + Desktop + IDE，Build/Plan 双模式，LSP 诊断可回灌。 | MIT · 生产可用 | 19.8万 | 想要「开源版 Claude Code」应先看它，而不是 dsh。dsh 更深的是 runtime 所有权。 |
| 4 | Pi | Earendil / Mario Zechner + Armin Ronacher 的最小终端 harness。默认只有 read/write/edit/bash，扩展挂在 loop 外围。系统提示极短。 | MIT · 稳定迭代中 | ~5.4万 | 架构上最近的对手。Pi 保小核心；dsh 把核心也拆成插件。Ronacher 公开表示 dsh 让他回头审视自己的选择。 |
| 5 | Goose | Block 出品、Linux Foundation AAIF 治理的通用 agent。规划优先、MCP 深度、不只写代码，偏企业自动化。 | Apache-2.0 · 基金会治理 | 5.3万 | 治理和跨领域编排更强。dsh 更偏 Coding Runtime 的可组合内核。 |
Stars：Claude Code / Codex / OpenCode / Goose / dsh 来自 2026-08-18 GitHub 页面；Pi 为同期公开对比文中的约数。OpenHands 约 8.4 万星，是最接近的候补——更偏沙箱化自主开发运行时，而不是插件微内核。
| 维度 | dsh | Claude Code | Codex | OpenCode | Pi | Goose |
|---|---|---|---|---|---|---|
| 产品形态 | 组装用框架 | 成品 agent | 成品 agent | 成品 OSS agent | 最小 harness | 通用 agent |
| 扩展面 | Cordis 插件，含 Loop | Skills / hooks / MCP | AGENTS.md / MCP | 自定义 agent / MCP | TS 扩展挂在 loop 外 | MCP / recipes |
| 模型策略 | 插件；V4 原生优化 | Anthropic 为主 | OpenAI 为主 | 75+ 供应商，最中立 | 多供应商，轻量 | 多模型配置 |
| 默认可观测性 | 明文 append-only 事件流 | 本地 transcript + rewind | 分端 Session | 会话与 TUI 轨迹 | JSONL 会话树 | 规划与 recipe 轨迹 |
| 默认界面 | Web :3080 / headless | 终端优先，多端 | 终端 + IDE + Cloud | TUI + Desktop + IDE | 终端 | 终端 / Desktop |
| 现在能不能上生产 | 否，官方已声明 | 是 | 是 | 是 | 视团队承受度 | 企业已有落地 |
团队已经在 Claude Code 或 Codex 上沉淀了项目约定、要过合规、需要半夜能搜到 bug 队列——别迁。dsh 没有导入器，也没有对等的供应商责任。
只要开源、要换模型、要 TUI/IDE：优先 OpenCode，而不是刚发布五天的 dsh。
你本来就要自建 harness；需要把沙箱/存储/审批接到内部系统；审计要求「模型当时到底看到了什么」；或者要把 Claude Code / Codex 当子 Agent 编排。
用法建议：只读沙箱、指向自有 endpoint、把 .sessions 当机密日志、关闭动态 cordis_*，用一周可丢弃的分支试，不要迁生产。