DeepSeek coding agent has one prompt rule worth stealing

The DeepSeek coding agent went open source on 31 October, and DeepSeek says coding agents did much of the engineering. I cloned it and ran what I could. It installs in 8 seconds, 1,196 of its 1,197 tests pass, and it does nothing useful without a runtime and a model provider that I did not configure. The part worth stealing is not the code. It is one rule in the prompts: act only when asked, or when a written rule allows it.

I am Dominic, CTO at Trellis, where we build AI tools for Amazon sellers. We are small, so every useless bot message costs a real person’s attention. This repo hit a nerve.

What is the DeepSeek coding agent, exactly?

The repo is deepseek-ai/dsh-superagent-prototype. The README calls it “a proactive coding agent for one GitHub repository”, packaged as a bundle for DeepSeek Harness. It listens to GitHub, and optionally Feishu (the Lark chat app). When someone allowed asks for work, it opens a work item, works in its own session, and answers in the original conversation, for example with a pull request.

License is MIT. Read the first line of the README twice: “Research prototype for reference only, not an official DeepSeek product.” They also write that “much of the engineering” was “done by coding agents” and that it “may still contain bugs”.

On 2026-11-07 the GitHub API showed 20,365 stars, 2,371 forks and 0 open issues, up from 17,053 stars on 2026-11-04 — about 1,100 new stars a day. Be careful with that star count. The Hacker News submission had 11 points and 0 comments on 2026-11-04. I do not know where the stars came from, and I found nobody saying they run it in production. Here, stars measure the DeepSeek name, not adoption.

Does the “built by agents” code hold up?

I can check half of that claim. I cannot verify who wrote the code: the whole GitHub repo is one commit by “DeepSeek Harness Team”, 216 files, so there is no history to read, for me or for you. Only DeepSeek’s word supports “built by agents”.

But I can check if the code is any good. This is what I measured on a 4-core Linux box, no model key, no secrets:

• Install: pnpm install --frozen-lockfile took 7.8 seconds, with node_modules at 133 MB. Everything came from the public npm registry, no login.
• Size: 110 TypeScript files in src/ for 15,205 lines. The tests are 14,056 lines in 59 files. That is almost one line of test per line of code, not what I expect from a “vibe coded” repo.
• Dependencies: only 2 runtime ones (proper-lockfile and zod). Then 23 peer dependencies, all @deepseek-ai/* packages pinned to alpha versions, and 36 dev dependencies.
• Typecheck: passes in 23 seconds. Build: passes in 4.7 seconds.
• Tests: 1,196 of 1,197 passed in the first full run, in 128.8 seconds.

The one failure is in tests/sources.spec.ts, a Feishu test that expected the health state “error” and got “ready”. Run alone, 2 of that file’s 71 tests failed: one hit a 5,000 ms timeout, one was the same assertion. My guess is timing on a busy 4-core container, but I did not debug it, so it is only a guess. I will not say “all tests pass”, because they did not.

Still, a fresh clone that typechecks, builds and passes 99.9% of 1,197 tests with no secrets is a real signal. If your own repo cannot do that on a clean machine, the agent is not your first problem.

To reproduce, it is three commands: git clone, npx pnpm@11.7.0 install --frozen-lockfile, then npx pnpm@11.7.0 check.

What it needs before it handles one ticket

Everything above needed no key, and this is where the bill starts. The agent needs four things before it handles one ticket: the DSH runtime, a model provider, a GitHub identity and tmux. The SETUP file gets you there by asking your own coding agent one question at a time. Budget an hour.

The numbers to demand from anyone selling you this: cost per ticket, a sample of its pull requests, and noise per day. Nineteen thousand stars is a click, not a cost figure. When a post tells you “it works” or “it is cheap” after a week, ask for the per-ticket cost and the pull request link.

It is also a bundle for DeepSeek’s harness, not a standalone tool. The harness is MIT too, which is good. But “open” here means MIT code on top of a runtime you must adopt as well. On npm, @deepseek-ai/dsh-agent shows latest at 0.1.0-rc.6 and an alpha tag at 0.2.2-alpha.3. Pin everything if you try it.

The prompts are the product

The prompts/ folder has 15 files and about 7,500 words (counted with wc -w). The biggest are team/communication.md at 1,471 words, admission.md at 1,251, dispatch.md at 1,061 and work.md at 897. The docs/ folder adds 9 numbered documents and 28,320 words.

Read admission.md if you build agents. It treats all messages and repository files as untrusted data. It says the source message is a trigger, not the whole request. And it gives a nice example to ignore: someone says “maybe our app should show unread counts like theirs”. That is a preference, not a request. But “this button label is odd” followed by “just ‘Save’ would do” counts, because the concrete replacement shows intent.

Then the line: “Do not convert design debate into a ticket.” Mon Dieu, I wish every human project manager had that on a mug.

The rule worth stealing

The philosophy document opens with a principle: “Take as little human attention as possible, and give as much value as possible.” Then it gets practical:

• The agent “acts only when asked, or when a written rule allows it”. A request counts only if it comes from a person the team allowed: someone on an allowed list, or anyone in a conversation the team opened to requests. Work nobody asked for needs a rule the team wrote, and “starts in a mode that only records what the agent would have done”.
• It “speaks only when a person must act or can use a result”. It confirms once, stays quiet while it works, and writes again when a result is ready or when it cannot finish.
• It “reports honestly”: a failure is reported as a failure, and a limit is never bypassed to avoid asking.
• For the operator: “Start narrow.” Begin with a short allowed list and widen it “once what the agent would have done looks right”. If it is noisy, make the prompts “shorter and stricter, or pause it. Do not add more messages to explain the noise.”

The authorization doc backs this with a real mode. The default is observe: the agent assesses what it could do alone, records “would accept”, and accepts nothing. You read the recorded decisions, then switch to auto.

That is a shadow mode, and you do not need DeepSeek’s runtime to copy it.

What I would do this week

Here is what I would do with Claude Code, Codex or a homemade bot, without installing anything from DeepSeek:

1. Write the allowed list down. A short list of people whose requests the bot obeys, nobody else.
2. Put one line in the prompt: speak only when a person must act or can use a result.
3. Send anything proactive to a log file first, for a week. Read the “would have done” lines before the bot touches a pull request.

I have no before-and-after measure of noise for this, so I will not invent one. But reading a week of “would have done” lines is a cheap code review.

Should you adopt the DeepSeek coding agent?

If you want a ready-made agent for your repo this week, probably not. It is a research prototype, it needs a runtime and alpha packages, and I never saw it do a single task.

If you build agents, clone it anyway and read three things: docs/000-philosophy.md, prompts/admission.md, and the observe section of docs/002-authorization.md. That is one hour.

And to judge any “built by agents” repo, run the boring checks first, the same cost of checking generated code I wrote about in September: install on a clean machine, typecheck, build, run the tests, then count what is prose and what is code. Four numbers told me more than the star count did.