One Kernel. Modular capabilities. Verifiable execution.
v1.3.0 stable · Download for Windows · Apache-2.0
Created and maintained by Lee take.
DS Agent is a DeepSeek-first local Windows agent for everyday work. Describe the result you need in chat: it can organize office material, research with sources, work with local files, run durable automations, and control desktop apps when you approve—while keeping steps, evidence, permissions, verification, and recovery visible.
Under the hood, DS Agent is a local Agent Harness optimized for DeepSeek. The Harness gives model-backed work a durable, permissioned, and verifiable execution boundary on the local machine.
DS Agent began from a practical need: more colleagues were using DeepSeek in daily work, yet it was difficult to find an Agent specifically optimized for DeepSeek with strong local automation and a trustworthy execution boundary.
A real local v1.0.0 run: meeting notes become a ready-to-send execution checklist, with every run step visible and completed.
- Turn office input into action. Convert meeting notes, requirements, or rough material into structured checklists, plans, reports, and handoffs.
- Build evidence-backed briefings. Read selected local files or public web sources, preserve source links, and produce reviewable summaries.
- Keep recurring work running. Create one-time, daily, weekly, or monthly automations with persisted schedules, bounded retries, and recovery state.
- Use the desktop with control. Let DS Agent operate supported local apps only through explicit permissions, pre/post observation, and verification.
The key difference is that Memory, Automation, Computer Use, parallel Subagents, and Skills are not isolated plugins. They form one complete loop coordinated by the same DS Agent Kernel.
DS Agent uses a contract-first modular Harness architecture. New tools, connectors, workflows, Skills, and executors enter through shared contracts for permissions, resource locking, idempotency, evidence, audit, verification, and recovery. A module does not bypass the Kernel, and it does not need to rebuild a separate state machine or safety system.
flowchart TB
U["User goal"] --> P["DS Agent preflight and context"]
P --> D["DeepSeek<br/>understand · plan · analyze · synthesize"]
D --> K["DS Agent Kernel<br/>validate · approve · execute · verify · recover"]
K --> M["Memory and Soul"]
K --> A["Automation"]
K --> C["Computer Use"]
K --> S["Subagents"]
K --> SK["Skills and Connectors"]
K --> O["Evidence and Artifacts"]
M --> R["Reviewable result"]
A --> R
C --> R
S --> R
SK --> R
O --> R
DS Agent selects useful long-term memory instead of saving every conversation. Memory receipts explain what was used and why; feedback influences later retrieval; auditable background maintenance can update, merge, or archive memory. Soul keeps a user-approved identity, communication style, and collaboration preferences consistent across conversations.
Natural-language goals can run once, daily, weekly, or monthly. Schedules, trigger windows, run state, missed-run policy, and results are persisted so work can recover after restart. Resource locks, bounded retries, and idempotency checks prevent duplicate execution. A scheduled task never receives broader authority than an interactive task.
Desktop control follows a complete safety loop:
pre-observe → approve → revalidate → act once → post-observe → verify.
User takeover stops control, uncertain effects are not replayed automatically,
and computer control requires a one-shot approval plus a local in-memory unlock
code.
Complex work can be divided into bounded Research, Analysis, Production, and Review roles. Subagents use isolated context, resources, budgets, and staging; Review binds its decision to the exact production revision; the parent produces one final synthesis instead of flooding the main conversation.
DS Agent can turn suitable instructions into declarative Skills, validate and activation-test them, and keep a stable identity when they are updated. Installed Skills can be selected automatically when a task needs them. Source, integrity, permissions, trust state, execution plans, audit events, and disable/uninstall controls remain visible and enforceable.
DS Agent treats work as a goal-directed loop, not a single model reply:
goal → done-when contract → context → plan → permission → execution → evidence → verification → recovery
The Kernel persists run and review state, retries only bounded failed steps, and does not claim completion from model confidence alone. Local files, browser actions, Office artifacts, and Computer Use are complete only when observable evidence satisfies the task's completion criteria.
In v1.3.0, DeepSeek may propose a bounded GoalEnvelope, but only the local
Kernel can validate and freeze it. For the same queued task, the Kernel alone
derives the capability manifest, risk, and preview shown in one exact-task
authorization card. Approval creates only exact authority; it does not execute
a Tool, resume the task, or mark the Goal complete. Completion remains blocked
until locally authoritative verifier evidence covers every frozen done_when
condition and required artifact identity.
| Layer | Responsibility |
|---|---|
| DeepSeek | Open-ended understanding, planning, analysis, drafting, and synthesis. |
| DS Agent Kernel | Deterministic readiness, context packaging, policy, approval, execution, evidence, audit, verification, and recovery. |
DeepSeek proposes actions; DS Agent decides whether they are safe and allowed to run. The model never receives direct local authority and cannot approve its own high-risk action. See the full model boundary.
- Local files, folders, source-linked web research, browser actions, terminal diagnostics, screenshots, and permissioned desktop input.
- Markdown, HTML, lightweight PDF, Office-style artifacts, evidence receipts, reports, and portable work packages.
- Review, Recovery, durable checkpoints, stale-action rejection, and verified one-shot undo for supported local file changes.
- Microsoft/Google-shaped mail, calendar, sync, draft, mutation, and reconciliation contracts validated with offline adversarial fake providers.
Production Microsoft/Google account registration and live external-write authority remain disabled in v1.3.0. The release does not sign in to real accounts, send real email, or create, change, or cancel real calendar events.
The DS Agent Kernel and desktop command layer use Rust to keep local execution predictable, strongly typed, memory-safe, and low-overhead. Rust is especially valuable for concurrency, resource ownership, durable state transitions, credential isolation, and exact error handling. Tauri commands and the React UI remain thin; the Kernel and persistent projections own business state.
- Download the Windows x64 installer.
- Enter your own valid DeepSeek API key in onboarding and run the explicit balance/model verification. The key is stored locally with Windows DPAPI.
- Choose one local workspace and let the readiness doctor verify its managed directories and writability.
- Describe the result you want in chat. DS Agent requests additional permissions or prerequisites only when the task needs them.
A user-supplied DeepSeek API key is a required prerequisite. DS Agent does not bundle a shared key or bypass DeepSeek access requirements; use remains subject to DeepSeek's terms and account policies.
The v1.3.0 application executable and installer are Authenticode NotSigned.
Windows may display Unknown publisher or a Microsoft Defender SmartScreen
warning. Download only over HTTPS from this repository, verify the SHA-256 in
the GitHub Release, and read the installation guide
before running the installer.
DS Agent v1.3.0 is intentionally unsigned. The SignPath Foundation application
is submitted and approval is pending; no release is represented as signed.
If the project is accepted, signing starts with a later new version and does not
replace the immutable v1.1.0, v1.2.0, or v1.3.0 tag or asset. For releases accepted into the program:
Free code signing provided by SignPath.io, certificate by SignPath
Foundation. See the full code signing policy and
privacy policy.
npx pnpm@9.15.9 install
npx pnpm@9.15.9 test
npx pnpm@9.15.9 --filter @deepseek-agent-os/desktop tauri:devOn Windows, use a CARGO_TARGET_DIR without spaces for release builds, for
example D:\build-target\ds-agent-v1-release.
- Release: DS Agent v1.3.0
- Installer:
DS.Agent_1.3.0_x64-setup.exe - Integrity: verify the final byte size and SHA-256 published in the GitHub Release before running the installer.
- Onboarding: one user-supplied Key, Windows DPAPI storage, explicit DeepSeek balance/V4 model verification, secret-free readiness, and workspace doctor.
- Compatibility: existing workspace settings remain readable; environment-key operators require explicit verification; conversations and connector vaults are not rewritten.
- Goal contract: bounded model proposal, Kernel validation/freeze, read-only UI state, and fail-closed evidence coverage for every completion condition and required artifact.
- Task authorization: one Kernel-derived exact-task card with manifest/risk/ preview binding, one user decision, per-capability audit, and exact revocation; approval does not execute or resume the task.
- Installation
- DS Agent and DeepSeek boundary
- v1 architecture
- v1.3.0 release notes
- v1.2.0 release notes
- v1.1.0 release notes
- v1 completion audit
- Security · Privacy · Code signing policy · Contributing · License
DS Agent is an independent open-source project. It is not an official DeepSeek product and does not claim DeepSeek ownership, authorization, or endorsement. The DeepSeek name is used only to describe model compatibility and the project's DeepSeek-first design.
Search aliases: DS Agent, DSAgent, dsagent, DeepSeek Agent OS.