Add DeepSeek Harness

harnesses/README.md

@@ -1,7 +1,5 @@
 # Harness catalog
 
-No harnesses have been contributed yet.
-
 Each directory here contains one independently maintained experiment. Read its
 README for owners, setup, compatibility, and limitations. These are experimental
 integrations; a passing build is not a runtime compatibility guarantee.
@@ -11,6 +9,7 @@ its maintainers.
 
 | Harness | Integration | Maintainers |
 | --- | --- | --- |
+| [DeepSeek Harness](deepseek/README.md) | DSH through ACP and kagent BYO/A2A | @Jacob953 |
 
 Start with the [contribution guide](../CONTRIBUTING.md) and
 [template](../templates/harness/README.md).

harnesses/deepseek/.dockerignore

@@ -0,0 +1,9 @@
+**/.git
+**/.env
+**/.env.*
+**/node_modules
+bin
+*.test
+*.out
+**/*.pem
+**/*.key

harnesses/deepseek/.gitignore

@@ -0,0 +1,4 @@
+/node_modules/
+/bin/
+*.test
+*.out

harnesses/deepseek/.golangci.yaml

@@ -0,0 +1,158 @@
+# Adapted from kagent go/.golangci.yaml (Apache-2.0). Optional development checks.
+version: "2"
+run:
+  go: "1.27"
+  timeout: 10m
+  allow-parallel-runners: true
+linters:
+  default: none
+  enable:
+    - asasalint
+    - asciicheck
+    - bidichk
+    - copyloopvar
+    - depguard
+    - dogsled
+    - forbidigo
+    - goprintffuncname
+    - govet
+    - importas
+    - ineffassign
+    - iotamixing
+    - loggercheck
+    - makezero
+    - misspell
+    - modernize
+    - nakedret
+    - nolintlint
+    - staticcheck
+    - sloglint
+    - unused
+    - whitespace
+  settings:
+    depguard:
+      rules:
+        forbid-pkg-errors:
+          deny:
+            - pkg: sort
+              desc: Should be replaced with slices package
+        structured-logging:
+          files:
+            - $all
+            - "!**/pkg/logging/**"
+          deny:
+            - pkg: github.com/go-logr/logr
+              desc: Use log/slog; adapters belong in pkg/logging
+            - pkg: github.com/go-logr/zapr
+              desc: Use log/slog
+            - pkg: go.uber.org/zap
+              desc: Use log/slog
+    govet:
+      disable:
+        - fieldalignment
+        - shadow
+      enable-all: true
+    forbidigo:
+      analyze-types: true
+      forbid:
+        - pattern: ^log\.(Fatal|Fatalf|Fatalln|Print|Printf|Println|Panic|Panicf|Panicln)$
+          msg: Use log/slog with the shared logging package
+        - pattern: ^os\.(Getenv|LookupEnv)$
+          msg: Use a registered accessor from core/pkg/env for configurable settings
+    importas:
+      alias:
+        - pkg: k8s.io/api/core/v1
+          alias: corev1
+        - pkg: k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1
+          alias: apiextensionsv1
+        - pkg: k8s.io/apimachinery/pkg/apis/meta/v1
+          alias: metav1
+        - pkg: k8s.io/apimachinery/pkg/api/errors
+          alias: apierrors
+        - pkg: k8s.io/apimachinery/pkg/util/errors
+          alias: kerrors
+      no-unaliased: true
+    loggercheck:
+      require-string-key: true
+      no-printf-like: true
+    modernize:
+      disable:
+        - omitzero
+        - embedlit
+        - errorsastype
+        - stringscut
+    sloglint:
+      no-mixed-args: true
+      no-global: all
+      context: scope
+      static-msg: true
+      msg-style: lowercased
+      key-naming-case: snake
+    revive:
+      rules:
+        # The following rules are recommended https://github.com/mgechev/revive#recommended-configuration
+        - name: blank-imports
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: dot-imports
+        - name: error-return
+        - name: error-strings
+        - name: error-naming
+        - name: exported
+        - name: if-return
+        - name: increment-decrement
+        - name: var-naming
+        - name: var-declaration
+        - name: range
+        - name: receiver-naming
+        - name: time-naming
+        - name: unexported-return
+        - name: indent-error-flow
+        - name: errorf
+        - name: superfluous-else
+        - name: unreachable-code
+        - name: redefines-builtin-id
+        #
+        # Rules in addition to the recommended configuration above.
+        #
+        - name: bool-literal-in-expr
+        - name: constant-logical-expr
+  exclusions:
+    generated: strict
+    paths:
+      - zz_generated.*\.go$
+      - .*conversion.*\.go$
+    rules:
+      - linters:
+          - forbidigo
+        text: Use a registered accessor from core/pkg/env
+        path: '(^|/)core/pkg/env/'
+      - linters:
+          - forbidigo
+        text: Use a registered accessor from core/pkg/env
+        # Unit tests may inspect process state; core/test E2E settings use the registry.
+        path: '_test\.go$'
+      # ST1005 allows proper nouns, but treats single-word Title Case as a sentence start.
+      - linters:
+          - staticcheck
+        text: "error strings should not be capitalized"
+        source: '"(Claude|Codex)'
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+formatters:
+  enable:
+    - gci
+    - gofmt
+  settings:
+    gci:
+      custom-order: true
+      sections:
+        - standard
+        - default
+        - prefix(github.com/kagent-dev)
+  exclusions:
+    generated: strict
+    paths:
+      - zz_generated.*\.go$
+      - .*conversion.*\.go$

harnesses/deepseek/Dockerfile

@@ -0,0 +1,51 @@
+# Build context: harnesses/deepseek/; no sibling checkout or credentials required.
+FROM --platform=$BUILDPLATFORM golang:1.27.0-bookworm@sha256:ded31c68586d2e49e760acc2e65a884b23d032e9bbbed0ae0c55abd3fcaf4452 AS builder
+ARG TARGETOS
+ARG TARGETARCH
+WORKDIR /workspace
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
+    go build -trimpath -o /kagent-dsh-byo ./cmd
+
+FROM node:24-bookworm-slim@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20 AS runtime-base
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    bash bubblewrap ca-certificates git ripgrep \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /opt/dsh
+# Commit the npm lockfile with this example; npm ci checks package integrity.
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
+    && ln -s /opt/dsh/node_modules/.bin/dsh /usr/local/bin/dsh \
+    && dsh --version \
+    && groupadd --gid 65532 kagent \
+    && useradd --uid 65532 --gid 65532 --no-create-home --home-dir /data kagent \
+    && mkdir -p /data/adapter /data/dsh/sessions /data/dsh/storages /data/workspace \
+    && chown -R 65532:65532 /data
+# Optional development target; excluded from the default production image.
+FROM golang:1.27.0-bookworm@sha256:ded31c68586d2e49e760acc2e65a884b23d032e9bbbed0ae0c55abd3fcaf4452 AS test-builder
+WORKDIR /workspace
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
+    mkdir /tests && for pkg in bridge config operations runtimeutil supervisor usage; do \
+      go test -race -c -o /tests/$pkg.test ./internal/$pkg || exit 1; \
+    done
+FROM runtime-base AS test
+COPY --from=test-builder /tests/ /tests/
+ENV DSH_TEST_BIN=/usr/local/bin/dsh
+USER 65532:65532
+WORKDIR /data/workspace
+ENTRYPOINT ["/tests/bridge.test"]
+
+FROM runtime-base AS production
+COPY --from=builder /kagent-dsh-byo /usr/local/bin/kagent-dsh-byo
+USER 65532:65532
+WORKDIR /data/workspace
+EXPOSE 80 8081
+LABEL org.opencontainers.image.source="https://github.com/kagent-dev/byo-ext"
+LABEL org.opencontainers.image.description="DeepSeek Harness reference integration for kagent BYO"
+ENTRYPOINT ["/usr/local/bin/kagent-dsh-byo"]