DeepSeek Harness (dsh) vs Mirror CLI

DeepSeek Harness (dsh)

Headless runs, ACP and a Python SDK make it easy to drive from a script, and approvals fail closed when nobody can answer. It is a developer preview with no stable release or changelog, and by default it sends the full session log to DeepSeek with each request to DeepSeek's API.

Mirror CLI

Mirror CLI is Apache-2.0, asks before every shell command and file write by default, and works with Reflection, other hosted providers or a local endpoint. It is a one-day-old 0.1.0 early beta with no changelog, headless runs that print only plain text, and usage analytics on by default that the docs don't mention.

DeepSeek Harness (dsh)

1. Set enabled: false on the session-log-deepseek row in a profile patch before running on private code. Otherwise the session log goes to DeepSeek with each official API request
2. Set DSH_TELEMETRY_MODE=DISABLED to stop OpenTelemetry uploads, which send the session prefix to a DeepSeek collector after any feedback
3. Treat exit code 1 and the turn_end reason as failure. A --json stream can end with a final event for a failed run
4. Run in a disposable container or VM. The sandbox doesn't confine reads or network, and SAFETY.md says the project has had no security audit
5. Pin the version. npm latest (0.2.0-rc.2) and next (0.2.1-rc.2) differ, DeepSeek's changelog asks for 0.2.1-rc.1 or later, and the README warns of breaking changes

Mirror CLI

1. Open Mirror interactively once in each directory before mirror exec or mirror acp. Both refuse to run until the usage and folder notices are accepted
2. Pass --approval-mode auto to mirror exec only inside a container or VM. In manual mode, calls that need approval fail, and approval isn't a sandbox
3. Set --max-iterations on unattended runs. Turns are unlimited by default
4. Check the result with your own tests. exec returns 0 whenever it prints an answer
5. Never share logs recorded with --log-level debug. The docs say they contain request headers with the API key