We Verified DeepSeek Harness Line by Line: It's Not "Rewritten from Leaked Code" — But the Commit History Hides Another Story

On the day DeepSeek Harness was open-sourced, a claim began circulating in Chinese-speaking communities: that the framework "looks like" it was rewritten from code leaked by a certain American lab. Rather than answering from a stance, we pulled down both codebases and conducted a reproducible forensic analysis — anyone can rerun every number on their own machine. The conclusion is clear: it is not. And it was precisely while confirming that it was "clean" that another set of facts surfaced.

Let me first explain how we did it, because the method matters more than the conclusion. When determining whether one codebase was derived from another, the most forgery-resistant evidence is string literals. Variable names can be minified or batch-renamed, but strings such as system prompts, tool descriptions, and error messages — once carried over, are nearly impossible to wipe out completely. We took the publicly released npm package of Claude Code (version 1.0.98, full 8.8MB bundle), extracted string literals of no fewer than 40 characters, and obtained 28,086 deduplicated results. Applying the same treatment to all TypeScript source of DeepSeek Harness yielded 17,589 strings. The intersection of the two sets is 0. Even when we relaxed the threshold to 25 characters, the intersection remained 0. In other words, there is not a single moderately long string shared between the two codebases. If dsh had been "adapted" from it, no matter how heavily modified, it would be nearly impossible for even one prompt or one error message to survive.

The second piece of evidence is the version history.

The git repository of DeepSeek Harness has 12,293 commits and has never been squashed — the history is fully laid open. The first commit is only 48 lines, initializing the README and configuration. The only large-scale code import in the entire history is the fourth commit, whose title says it unmistakably: "Vendor Cordis framework packages as source" (bringing the Cordis framework in as source), 6,659 lines. After that came tens of thousands of incremental commits at the scale of a few hundred to a thousand lines, interspersed with lint rules, test coverage gates, and architecture reviews. A project started from stolen code would not look like this: such a history would either be compressed into a single opaque initial commit, or contain an anonymous, tens-of-thousands-of-lines code dump. Neither exists here.

The third piece of evidence concerns the origin of its framework.

dsh's plugin kernel comes from Cordis — an independent open-source framework (MIT license) that predates dsh, belonging to the Koishi ecosystem lineage. Their vendor/README.md documents every package introduced, the corresponding upstream repository and commit SHA, and each local modification. We checked out Cordis at its registered upstream commit 56b3d4f7 and diffed file by file: the differences are only import path renames, additional JSDoc comments, and a 416-line "lifecycle hardening" in fiber.ts — which corresponds exactly to the sixth item in their own modification log. The documentation does not lie. Even more telling: Cordis's author himself (GitHub username Shigma) is on dsh's contributor list. The impression that it "looks like some mature framework" comes from exactly this — DeepSeek took the people and framework of the Cordis lineage directly as its foundation, with no need to steal anyone's code.

At this point, the hypothesis of "plagiarizing leaked code" has been falsified. But having reached this stage of the forensics, another set of facts has surfaced at the same time — and it is documented.

In the very first commit of this repository, there is already a file named CLAUDE.md, with a symlink pointing to AGENTS.md — this is the standard configuration that Claude Code reads for project conventions. In other words, from day one, the project was built for Claude Code. In the history, 1,760 commits have titles with the codex/ prefix, consisting mainly of branch merges — codex/ is the branch naming convention of OpenAI Codex, and a large number of refactorings were merged in from branches generated by Codex. The eleventh commit even reads "fix issues found in the second round of Codex review" — Codex also doubled as reviewer. In July alone, the repository produced 8,273 commits. The most direct piece of evidence: the official CI workflow pi-ai-provider-e2e.yml mounts a secret named ANTHROPIC_API_KEY_EXTERNAL, and the default test model is claude-opus-4-8. This is not some engineer installing a command-line tool on their own machine; within the company's continuous integration pipeline, a pathway was designed that holds an Anthropic production key.

The scale also shows the weight of this toolset: dsh's self-developed portion is about 450,000 lines (packages source 199,065 lines, tests 230,642 lines, apps 23,824 lines), while the vendored open-source framework is only 6,550 lines — about 1.4% of the entire TypeScript codebase. A team of named engineers ran multiple parallel sessions of Claude Code and Codex to write a 450,000-line harness in just over two months, with humans responsible for architecture, review, and coverage gates. This development approach is itself efficient, and it is what many teams use today.

The problem lies elsewhere, and it must be stated precisely. DeepSeek is a company with wholly Chinese ownership. Anthropic's terms of service, effective since September 2025, explicitly prohibit entities with more than 50% Chinese ownership from using Claude, applicable globally; OpenAI's services likewise list China among unsupported regions. In other words, the two tools that dsh depended on to be built are precisely the ones that entities like DeepSeek are prohibited from using under vendor terms. This is a breach of contract, not a violation of law — circumventing access does not violate US or Chinese law, and the consequence is account termination rather than legal liability. But a Chinese frontier lab that has been explicitly named in such bans using a competitor's tools as core production infrastructure, and leaving the traces in a public repository, is itself something worth seeing.

Two things that are easily conflated need to be clarified at the same time. First, "the team used Claude Code to develop dsh" — the breaching party on this point is clear, and it is DeepSeek itself. Second, "dsh ships subagent-claude-code built in" — this merely lets dsh invoke Claude Code as a callable subagent, and overseas users bringing their own legitimate Claude accounts is entirely proper, which is a different matter from the former. Conflating the two plays right into the other side's hands. In addition, the naming of ANTHROPIC_API_KEY_EXTERNAL can be pointed out, but it should not be over-interpreted. The repository removed the local .claude/launch.json from version control five days before the public release (2026-08-08); this is a routine cleanup of local configuration, and CLAUDE.md was kept all along — they were not hiding its use.

We are releasing all of our forensic scripts along with this report. String intersection, commit statistics, code scale, vendor comparison — anyone can rerun them on their own machine and arrive at the same numbers. This is also our only requirement for this story: don't trust our position, reproduce our data.

Evidence list:

Confirmed (locally reproducible)

• Zero string intersection: Claude Code 1.0.98 bundle has 28,086 long strings (≥40 characters) × dsh's 17,589 strings; the intersection is 0 at both the ≥40 and ≥25 character thresholds.
• Complete git history with no squash: 12,293 commits; first commit is 48 lines; the only large-scale import is the 4th commit, "Vendor Cordis framework packages as source" (6,659 lines).
• Vendored Cordis is cross-verifiable: pinned to upstream commit 56b3d4f7, the diff consists only of import renames + JSDoc + 416 lines of hardening in fiber.ts, matching their self-recorded modification log item by item; Cordis author Shigma is in the contributor list.
• Production process chain: CLAUDE.md→AGENTS.md symlink from the first commit; 1,760 codex/ branch commits; 8,273 commits in July; official CI pi-ai-provider-e2e.yml holds ANTHROPIC_API_KEY_EXTERNAL, with claude-opus-4-8 as default.
• Code scale: ~450,000 self-developed lines vs 6,550 vendored lines (~1.4%); dependency table includes @anthropic-ai/sdk and @anthropic-ai/claude-agent-sdk.

Confirmed (official documents)

• Anthropic's "Updating restrictions of sales to unsupported regions" (effective 2025-09-05): entities with >50% Chinese ownership are globally prohibited.
• DeepSeek's official API documentation provides a Claude Code integration guide (ANTHROPIC_BASE_URL=https://api.deepseek.com/anthropic) — confirming the interoperability relationship in reverse.