DeepSeek Harness (dsh)

Evidence shows: CI workflows explicitly set DSH_TELEMETRY_DISABLED=1 to prevent telemetry reporting, and web config rejects --host 0.0.0.0 to avoid remote code execution exposure, reflecting least privilege. User confirmation: no explicit user confirmation mechanism found, but config patches and hot reload may imply user actions. Data flow transparency: tests verify credentials not leaked to stdout/stderr, and config dump feature exists. Sensitive data handling: tests verify credential file permissions 0600 and Bearer token in request headers. Dependency security: uses pnpm lockfile and frozen install, but no vulnerability scanning evidence. External effects: tests verify network requests only to mock server, and telemetry disabled. Rollback: tests verify config reverts to default after patch removal. Source attribution: no explicit source attribution mechanism found, but third-party notices generation script exists. Deductions: user confirmation mechanism unclear, dependency vulnerability scanning evidence missing, source attribution unclear.

Evidence shows: tests cover argument parsing, lifecycle, hot reload, etc., and CI has multiple platforms and node versions, indicating good self-consistency. Dependency availability: uses pnpm workspaces and lockfile, but not all dependencies' availability verified. Failure messages: tests verify error messages contain specific info, e.g., '--host 0.0.0.0 is intentionally not supported yet for safety'. Deductions: dependency availability not fully verified, failure message coverage limited.

Evidence shows: supports multiple profiles (web, headless, tui, etc.), and tests cover different scenarios, indicating clear audience and scenarios. Capability boundaries: web config rejects wildcard host, indicating boundary control. Trigger precision: argument parsing tests verify precise routing. Environment fit: CI covers Linux, Windows, macOS, and multiple Node versions. Deductions: no explicit audience documentation found, capability boundary description limited.

Evidence shows: README and bilingual translation pairing record exist, information architecture clear. Install notes: package.json has install scripts and postinstall. Naming stability: version 0.1.0-rc.5 indicates pre-release. Examples and FAQ: tests have examples, but no FAQ found. Known limitations: no explicit known limitations document found. License: MIT license clear. Versioning changelog: no CHANGELOG found, but version numbers exist. Maintenance responsibility: CI and release scripts indicate clear maintenance responsibility. Deductions: missing FAQ, known limitations, and CHANGELOG.

Evidence shows: output usability: tests verify output format and content. Marginal value: plugin architecture and multiple profiles provide additional value. Cost benefit: CI and test coverage indicate reasonable investment. Deductions: no explicit performance or resource usage evaluation found.

Evidence shows: tests and CI provide verifiable evidence. Claim traceability: tests and documentation linked. Cross-source corroboration: CI and tests corroborate each other. Fact-inference separation: tests clearly distinguish expected and actual. Deductions: no independent third-party verification found.