DataAgent for DeepSeek Harness

Native Host plugin, React analysis workbench and a managed local Python sidecar. It uses DSH's own sessions and model loop. It does not start a second agent or an unauthenticated HTTP server. The existing DataAgent visual style is retained.

The local rc.24 candidate adds task-first intake, persistent local drafts, business authorization cards, a decision queue and bounded repair mandates. It accepts only provably equivalent SQL changes and fixed leading SELECT-keyword typo repairs automatically. General code or business changes require review. Task and planning model request limits are persistent; retries consume them. A follow-up message pauses the previous task and requests a revised task card. Specialist execution remains disabled pending shared-permission qualification; the main native DSH agent owns the work. Source and synthetic checks are not official desktop or real-model acceptance.

The rc.23 candidate reuses a safe DSH workspace for each analysis project and explicitly attaches each new analysis session to it. Existing sessions, grants and run outputs keep their separate identities. Old workspaces are retained; an existing safe project workspace is reused without moving its sessions. Windows packaged-app path aliases are accepted only when both project roots have the same nonzero filesystem directory identity. Matching names or copied directories do not grant access; project scope and internal link checks remain.

The rc.21 release narrows analysis tool schemas in a parsed outbound copy when other installed plugins add session-local team tools. Frozen native requests stay unchanged. Generic tools stay unavailable in analysis; ordinary DSH sessions retain their existing tools. The execution guard and final outbound validation remain in place.

Installation

This is a local release candidate, not evidence of an npm publication. After an explicitly approved public release, install dsh-plugin-dataagent through DSH's Plugins → Add plugin dialog. A local .tgz candidate can be installed through that same dialog for qualification. The distribution contains the Python core wheel, method resources and a fixed runtime manifest; users do not clone this repository or supply developer source paths.

The first supported release is official Windows x64 DSH 0.2.1-rc.3. The plugin checks actual runtime release metadata and required Host services. A graph commit is recorded, rather than compared with one development checkout. Unsupported versions remain blocked until separately qualified; version numbers alone do not prove security integration or installation acceptance.

After installation, choose 立即启用 (Enable now), or turn on dsh-plugin-dataagent in the installed plugin list, then restart DSH if prompted. DSH may resolve a newly published unversioned name to an older release during its dependency release-age observation period. Use the exact reviewed version when qualifying a release; do not disable the Host's supply-chain settings. On this Host, reinstalling a third-party plugin requires removing its package through Plugins first. This does not require deleting analysis data, private environments, sessions or results. Reopening an installed plugin requires no reinstallation. Installing a dependency alone does not enable its Host/Client bundle. In DataAgent, the model selector exposes the reasoning levels advertised by DSH; changing a level uses the native session selection and does not copy a key. Live reasoning is shown as a character count, without exposing or exporting its text.

First use

Open DataAgent, describe the task and choose 添加数据. A draft can be saved before the local runtime is ready. The first task offers a preparation card showing download origins, disk use and system impact; full hashes remain under details. Confirm preparation to continue the saved task. It downloads standalone Python 3.12.14 and locked Windows wheels into a private directory under the active DSH home's DataAgent profile. It never installs packages into DSH's interpreter, changes PATH, clones private data or copies model credentials. Verified downloads are reused after cancellation or restart. Failed checks are shown explicitly; no unverified environment is activated.

Preparation requires several GiB of free space and downloads only from fixed public software sources. Generated Python, Notebook and training code still requires an independent Docker Linux engine. Virtual environments do not provide a security sandbox. Missing Docker does not trigger host execution. Installing Docker/WSL or restarting Windows is a separate user-controlled system operation.

When the qualified Docker Desktop Linux engine is already available, choose 准备隔离环境 under 高级管理 → 设置 → 工具与运行环境 when a task needs it. SQL-only tasks do not require Docker preparation. Review the pinned Python base digest, five small context files, wheel hashes, fixed public sources, CLI/Buildx fingerprints and 6 GiB budget, then confirm the exact preview. This UI-only operation builds qdataagent-sandbox:1; it accepts no custom Dockerfile, path, image, code or shell arguments. It neither installs nor starts Docker and never changes system components. Preparation uses public Docker Hub (including HTTPS blob CDNs) and hash-locked PyPI wheels. Analysis containers still run with no network. The daemon has no domain firewall added by this plugin; disk prechecks cover the preparation/TEMP volumes, not independently the Docker VHD's internal capacity.

Cancel waits for the owned CLI and verifies the exact named Buildx history entry. Missing or damaged state, a changed engine, or unknown resource release blocks another build. Keep the lease and operation receipts for recovery; deleting the lease is not a supported retry. Restart never silently repeats a build.

The initial asset library is empty. Register the user's own approved local files or read-only database sources. Historical ten-project catalogs are an explicit local migration option, not data shipped to every user. Legacy developer profiles can retain their explicit interpreter/source paths for compatibility, but they are not the distributable installation path.

Safety and lifecycle

Plans, execution approval and model sharing are separate. Only authenticated interactive owner UI can prepare environments, approve plans or accept patches; the six model tools cannot approve themselves. DataAgent sessions use restricted tools and approved outbound envelopes. SQL remains controlled and read-only.

DataAgent reuses the model selected in the current DSH session and DSH's native authentication; it does not ask users to copy model credentials into the plugin. Integration with the official DSH 0.2.1-rc.3 DeepSeek Account adapter is implemented through native prepared calls and separately approved, bounded /models catalog requests. A limited real Windows Account-model flow has completed: the native model generated a plan and SQL, authenticated UI approved a reviewed revision, and local data checks, SQL, independent Decimal verification and HTML delivery succeeded. Human review corrected an unsupported business-definition claim; the model's SQL and execution steps were unchanged. Earlier failed model attempts remain recorded. This is not unattended semantic correctness or full Python/Notebook/training acceptance. Reports apply only to their approved input population and time window; differently filtered historical totals are not an interchangeable reference.

This candidate also fixes editing or restoring a model-generated plan whose required business fields are present only in the structured contract. Unrelated edits preserve those fields; explicitly clearing a required field blocks saving. The existing workbench layout and stylesheet are unchanged.

The official DeepSeek API-key Messages adapter and pi-ai custom routes remain supported under their existing restrictions: explicit openai-completions, an API-key reference, HTTP/SSE and no custom headers for pi-ai; an explicit base URL in DSH; and an approved sharing preview bound to the effective destination, including the Messages adapter's /v1 suffix. Other Account/OAuth and catalog authentication routes, federation, Anthropic, Responses and WebSocket paths remain blocked until separately verified. Ordinary DSH sessions retain their own provider behavior. Changing the selected model or destination requires a new sharing confirmation; local execution has its own plan approval. Analysis titles, compaction and other automatic model helpers cannot reuse an execution sharing grant. Attachments and local host identifiers are not sent.

The download preparer uses its own native HTTPS Agent and verified hashes; it does not replace DSH's global proxy dispatcher. If an active older transport reports dataagent_previous_transport_still_active_restart_required, stop its analysis jobs and restart DSH before enabling this candidate.

Disable/uninstall stops accepting tasks and requests resource cleanup. A local shutdown receipt records whether resources were actually released; process exit alone is not treated as success. User projects, evidence and deliverables stay in the plugin's persistent data directory. Re-enable reconciles unfinished state and does not blindly rerun completed work. Application upgrades require tested compatibility and backed-up schema migration; never edit DSH's application files.

payload/runtime-manifest.json is generated from the locked Windows dependency closure and a verified core wheel. npm pack runs a local payload/hash gate and never downloads dependencies. The MIT license covers this plugin's code; separate third-party notices and redistribution terms remain applicable.