Dao Code
A DeepSeek V4 terminal coding assistant that uses cache-aware context and self-correction for lower-cost long-running work.
Per-dimension scores and reasoning
Evidence shows permission gates, approval, sensitive target protection, dangerous command blocking, secret scanning, SSRF protection, directory trust, audit logging, but some mechanisms (e.g., secret scanning, SSRF) are only declared in SECURITY.md, not verified in code. Data flow transparency is insufficient: no detailed explanation of how data is transmitted, stored, and deleted. Dependency security: npm audit warnings are all from dev toolchain, but no vulnerability scan results for runtime dependencies. External effects: approval gate and sandbox option exist, but sandbox is not enabled by default. Rollback: shadow-git checkpoints exist, but reliability of recovery is not explained. Source attribution: author is tigicion, but identity not verified.
Self-consistency: README, SECURITY.md, package.json are consistent, but version numbers are inconsistent (README says v0.3.0, package.json 0.4.17). Dependency availability: dependency list is complete, but availability of all dependencies not verified. Failure messages: no examples of error handling or user prompts.
Audience and scenarios: aimed at developers, supports multiple installation methods and usage modes. Capability boundaries: tools and permission modes are clearly listed, but not all limitations are explained. Trigger precision: commands and configuration are described clearly, but no detailed examples. Environment fit: supports multiple platforms, but no special considerations for Windows.
Information architecture: README structure is clear, but lacks detailed API documentation. Install notes: multiple installation methods provided, but not verified. Naming stability: command name `dao` is stable, but version numbers are inconsistent. Examples and FAQ: examples exist, but no FAQ. Known limitations: not explicitly listed. License: MIT, but copyright year is 2026. Versioning and changelog: CHANGELOG.md exists, but content not provided. Maintenance responsibility: maintainers or contribution guidelines not clearly stated.
Output usability: rich features provided, but actual output not verified. Marginal value: cost advantage over Claude Code, but not independently verified. Cost-benefit: cost data provided, but not independently verified.
Claim traceability: cost data claims traceable to evals/runs, but specific logs not provided. Cross-source corroboration: no third-party verification. Fact-inference separation: some claims (e.g., cost comparison) do not clearly distinguish facts from inferences.
- Version inconsistency: README claims v0.3.0, but package.json is 0.4.17, which may cause confusion.
- Security mechanisms (e.g., secret scanning, SSRF protection) are only declared in SECURITY.md, not verified in code; actual effectiveness unknown.
- Dependency security: npm audit warnings are all from dev toolchain, but no vulnerability scan results for runtime dependencies.
- Sandbox (DAO_SANDBOX) is not enabled by default; users need to enable it for enhanced security.
- Cost data claims traceability, but specific logs are not provided, so independent verification is not possible.
What does this agent do, and when should you use it?
Dao Code is a TypeScript terminal coding assistant invoked as `dao` and built around DeepSeek V4's 1M context window. Its Ink TUI sends requests through an agent loop that streams model output, approves requested actions, and iterates over code and command results. The repository documents 24 tools plus persistent memory, reflection, compaction, session recovery, shadow-Git checkpoints, and Definition-of-Done verification for longer tasks. It ships as platform binaries, an npm package, or source, while live model operation requires the DeepSeek API; it also supports MCP, Skills, Hooks, and Claude Code-compatible configuration formats.
A user submits work through interactive dao or one-shot dao "task"; src/agent/loop.ts calls streamChat and streams reasoning and responses. When the model requests actions, it can inspect a project with read_file, list_dir, grep_files, and file_search; change files with write_file, edit_file, multi_edit, and notebook_edit; and run foreground or background commands through exec_shell, subject to the approval gate for writes and execution. It can maintain a task table with todo_write, run a /dod acceptance command via verify_done, access persistent facts with memory_read and memory_write, and orchestrate work through agent, task_send, and message_parent. Session data is written under .dao/sessions/, oversized results can spill into .dao/spill/, and /restore uses the separate .dao/shadow.git snapshot store to undo the most recent turn.
- A developer with a DeepSeek API key who wants a local-terminal assistant to inspect a repository, edit code, and run its tests.
- An engineer handling a long implementation or debugging task who wants persistent todos, automatic compaction, and a
/dodcommand for executable acceptance checks. - A team that needs controls over file writes and shell execution, using
allow,ask, anddenyrules in.dao/settings.json. - A Claude Code user who wants to reuse
settings.json,SKILL.md,hooks.json, ormcp.jsonconventions in a DeepSeek-driven terminal workflow. - A developer splitting investigation or implementation into parallel, background, or worktree-isolated subagent tasks.
What are this agent's strengths and limitations?
- It is designed around DeepSeek prefix caching: byte-stable prefixes and cache-reusing forks for reflection and memory, with
/costexposing hit rate and spend. - Layered
allow/ask/denypermissions, an approval gate, and per-segment compound-command checks provide concrete controls over edits and shell execution. - Its long-task features are explicit: event-log recovery, separate shadow-Git snapshots, todo reinjection, stuck detection, and executable Definition-of-Done checks.
- It supports Skills, MCP, Hooks, custom subagents, and slash commands, while documenting compatibility with several Claude Code configuration formats.
- The documented core model path is DeepSeek V4; the repository does not document adapters for OpenAI, Anthropic, or other model providers.
- Working coding sessions depend on a DeepSeek API key and network access for model calls.
--yoloand/yoloauto-approve actions. Deny rules still apply, but permission configuration remains an adoption responsibility.- The published cost and evaluation figures come from seven specified real open-source bug-fix tasks and contemporaneous pricing, not a general cost guarantee.
How do you install or deploy this agent?
Download the matching platform binary from Releases, or run curl -fsSL https://raw.githubusercontent.com/tigicion/dao-code/master/install.sh | sh. For npm installation, Node.js 20 or later is required: use npx dao-code to try it or npm i -g dao-code to install the dao command. To build from source, run git clone https://github.com/tigicion/dao-code.git && cd dao-code, then npm install && npm run build && npm link. On first launch, dao prompts for a DeepSeek API key and saves it in ~/.dao/config.json.
How do you use this agent?
Start an interactive session with dao. For a headless one-shot invocation, use dao --api-key sk-xxx --provider deepseek "tell me a joke". In a session, /init generates DAO.md, /mode changes permission behavior, /cost shows token and cache usage, and /compact compresses the conversation; dao -c resumes the most recent interrupted session. To set an executable completion criterion, run /dod <command>; verify_done treats exit code 0 as completion.
How does this agent compare with similar options?
Dao Code positions its interaction and extension conventions alongside Claude Code while targeting DeepSeek V4. It states that Claude Code-format settings.json, SKILL.md, hooks.json, and mcp.json work with automatic tool-name mapping; for the same seven recorded task token traces, it reports DeepSeek costs of roughly 1/30 of Claude Opus 4.8 and 1/18 of Claude Sonnet 4.6.
FAQ
What credentials does it need?
--api-key with --provider deepseek.Can it modify files or run commands without approval?
default, acceptEdits, auto, and plan modes plus allow/ask/deny rules adjust that behavior; --yolo enables automatic approval.What happens if a long task crashes?
.dao/sessions/<id>/; dao -c resumes the latest session. /restore can revert the last turn from .dao/shadow.git without rewriting the repository's own Git history.