DeepSeek's Super-Agent Coding Agent Won't Act Unless Asked

It opened a work item, ran the job in its own session and its own directory, then answered back in the original conversation. With a pull request. Because an allowed teammate asked. That's the whole operating loop of dsh-superagent, DeepSeek's team coding agent prototype, and the asking part isn't a limitation. It's the pitch.

DeepSeek's own label for the thing is a "research prototype for reference only, not an official DeepSeek product," MIT-licensed and packaged as a bundle for DeepSeek's open agent runtime (GitHub README). It takes on coding work for a whole software team (The Next Web). Fine. But the permission structure, not whatever model sits underneath, is why this one deserves your evening.

What Is DeepSeek's Super-Agent Coding Agent?

The README describes itself in one line: a proactive coding agent for one GitHub repository, packaged as a bundle for DeepSeek's open agent runtime (GitHub). It listens to GitHub events and, if you want it to, to Feishu group chats as well (GitHub). That runtime is the one DeepSeek launched back in August, per i-scoop. And this bundle rides on it.

The work loop, spelled out, as every piece of it is a deliberate choice. When an allowed team member asks it for work, it opens a work item, runs in its own agent session and its own directory, then replies in the conversation where the request started, "for example with a pull request" (GitHub).

A web panel surfaces whatever needs a human.

Three of those choices outweigh any benchmark you'd care to name. One repository, so the blast radius is known before anything executes. An isolated session and directory, so the agent isn't stomping through your working tree while you're mid-edit. A pull request as the default reply. So review lives inside the output format instead of getting bolted on afterward.

How the Permission Rules Work

Most coding-agent marketing sells autonomy.

This README sells restraint, and it says so out loud. The stated goal is to "take as little human attention as possible. And give as much value as possible" (GitHub).

Here's the passage worth framing and hanging on a wall: "An agent that can act for a whole team can also waste a whole team's attention.

So it acts only when asked or when a rule the team wrote allows it.

And speaks only when someone must act or can use a result." Two constraints. When it may act, and when it may speak. Those are the correct two.

The press coverage contains a wrinkle that looks like a contradiction but isn't. On November 2, the Economic Times relayed a DeepSeek WeChat post saying the agent can watch developer group chats on its own and suggest fixes without anyone summoning it (Economic Times). Set that next to the README and it reconciles cleanly: proactivity is a permission, not a default. On its own initiative, the agent moves only inside boundaries the team's own rules define. The Next Web reads the release the same way, saying the aim is "to spare people the job of coordinating several AI agents and checking on them."

That's the part I'd underline for anyone running agents right now. The scarce resource isn't tokens or context windows. It's attention. The hours you spend checking output.

And an agent that talks constantly trains everybody to tune it out.

Is DeepSeek's Coding Agent Safe to Use?

Cold water time, since there's plenty to pour. DeepSeek labels the code a reference prototype, not an official product; coverage describes it as "a blueprint developers can study and test, not a finished product" (ShiftDelete). DeepSeek too says the public code differs from its internal version (The Next Web).

That last detail carries more weight than it usually gets.

You're not reading the agent DeepSeek runs internally. You're reading the version they chose to publish, which makes this a syllabus rather than a shipping tool. Anchor a business process to it and you've bet on code the authors have already told you isn't the real one.

The competitive angle is real but small.

Debby Wu reported for Bloomberg that DeepSeek is aiming the agent at Anthropic's Claude Code (The Next Web). A prototype aimed at a shipping product tells you where DeepSeek thinks the fight is: not raw model quality. But who owns the workflow around the model. Read it as a market signal, not a reason to switch tools this week.

Availability and Status

dsh-superagent is a reference prototype, not an official DeepSeek product.

It's released under the MIT license, and its install path is DeepSeek's open agent runtime itself.

The runtime launched in August. With GitHub events as the trigger and Feishu group chats as an optional extra. Study it, fork it, don't bet a pipeline on it.

FAQ: DeepSeek's Super-Agent Coding Agent

Is dsh-superagent free?

Yes, in the license sense. It ships under MIT, so the code is free to read, fork, and run. Free doesn't mean supported. There's no product behind it.

Can I use it in production?

No. DeepSeek's own words are "research prototype for reference only, not an official DeepSeek product," and the company says the published code differs from its internal version. Treat it as a syllabus, not a dependency.

How is it different from Claude Code?

Claude Code is a shipping product from Anthropic. dsh-superagent is a reference prototype that, per Bloomberg's Debby Wu, is nonetheless aimed at Claude Code. The design difference is governance: one repository, permission-first action, pull requests as the default output.

Is it an official DeepSeek product?

It isn't. The README says so in exactly those words, and the MIT license plus the reference-only framing back that up.

What is DeepSeek's agent runtime?

The open agent runtime DeepSeek launched in August, per i-scoop. dsh-superagent ships as a bundle for it, which makes the runtime the starting point for anyone poking at the code.

What to Steal From dsh-superagent

Don't run this thing on anything you care about. It's a prototype, and the public code isn't the internal version. Do steal the constraint list and bolt it onto whatever coding agent you already pay for.

Scope each agent to one repository, so the blast radius is known before kickoff.

Require an explicit ask from an allowed person. And have the agent open a work item so every request leaves a trail. Run the work in its own session and directory, never in yours. And make a pull request the default answer, delivered back where the request started.

Then write down, in your own words, the rules that authorize unrequested action.

Before you need them, not after. Give humans a single panel that shows only the items needing a person. And tune the agent to speak only when someone must act or can use a result.

For a solo operator the stakes go up, not down. You're the whole team, and the attention budget is entirely yours. The real cost of an agent isn't the API bill. It's the time spent verifying changes that didn't need verifying, multiplied across every week you keep the thing running.

One action item before you close the tab. Open the README, read the philosophy section, then answer two questions about the coding agent you already use: when it's allowed to act. And when it's allowed to speak. If either answer runs past one sentence, that's the next thing to fix. You didn't need a new model to find it.

Sources

- GitHub README. Dsh-superagent-prototype - The Next Web. DeepSeek super-agent open-source coding agent - i-scoop — DeepSeek super-agent - Economic Times — DeepSeek's coding agent is out in beta - ShiftDelete — DeepSeek coding agent