《sofagent》：用 DeepSeek Harness 給 AI 程式設計智能體立規矩、留痕、可復原｜安裝指南 - DeepSeek Harness 外掛介紹與一鍵安裝指令

MIT 協定的開源 FDE Harness 治理層：9 個 DeepSeek Harness 原生外掛，對每一次 AI 變更做審計、留痕、快照，讓 AI 幹活守規矩、出事能回溯。

DSH 整合

原生執行環境

作者聲明

安全稽核

未稽核

最後核實

2026-09-03

授權條款

MIT

01它能幫你完成什麼？

Govern every change your AI coding agent makes inside DeepSeek Harness — gate edits, record an audit trail, and snapshot before commit
A forced audit on each commit (24 git-diff rules: secret-leak, cross-boundary, injection detection) with hard evidence, an immutable audit log, and one-click rollback to any snapshot
Solo founders and small teams running DeepSeek Harness (DSH) who want AI work constrained, traceable and recoverable
61b5cb73cffc…
Onboard AI nodes into your business with the FDE method — map workflow, build the dual ontology, deploy and continuously govern
Enterprise profile, AI-node plan with annual savings, and three-layer deliverables (docs + Skill + runtime) that run inside your DSH agent
FDE / deployment engineers and small businesses adopting AI without a dedicated platform team
61b5cb73cffc…

先決條件

Node.js ≥ 18 (required for the full `bash bootstrap.sh` install)
Install on the device that runs your AI agent (enterprise machine), not the FDE's own laptop
A git repository to audit

安裝步驟

01
$ npx -y -p @sofagent/audit sofagent-audit
02
$ curl -fsSL https://raw.githubusercontent.com/KongFangXun/sofagent/refs/tags/v1.4.3/bootstrap.sh -o bootstrap.sh
03
less bootstrap.sh # review the script before running
04
bash bootstrap.sh && rm bootstrap.sh
05
sofagent-audit --init # install git hook for per-commit audit
06
sofagent-audit --doctor # verify environment (optional)

驗證整合成功

DSH 整合原生執行環境

DeepSeek Harness 原生執行期外掛：9 款 `cordis-plugin-sofagent-*` 以最深的「外掛級」檔位掛載進 DeepSeek Harness（Cordis）執行期

Zero-config audit
any git repository's latest commit→audit result against 24 git-diff rules (quick default 17 + 7 extended via config): secret-leak / cross-boundary / injection detection with hard evidence
61b5cb73cffc…61b5cb73cffc…
Constraint injection (4-layer)
your enterprise constraints at agent startup→four-layer constraint injection into the DeepSeek Harness agent
constraints are advisory — an agent may skip them; only the audit is mandatory
61b5cb73cffc…61b5cb73cffc…
Snapshot rollback (回溯)
each audited change→an automatic snapshot archive; one-click restore to any snapshot
61b5cb73cffc…

適合

Solo founders and small teams running DeepSeek Harness (DSH) who want AI work constrained, traceable and recoverable
FDE / deployment engineers and small businesses adopting AI without a dedicated platform team

不適合

config.yml is not fail-closed by default — rules can be tampered with / bypassed by the agent, and multi-tenant isolation is not yet implemented. For strong compliance use CI as a backstop and lock the file (`chmod 444 .sofagent/config.yml`); do not run the single-machine default in production.
Designed for a single machine / single user; multiple agents share one knowledge base and audit history, and multi-tenant isolation is in the roadmap. task/logs are stored in plaintext (static encryption not yet wired).

config.yml is not fail-closed by default — rules can be tampered with / bypassed by the agent, and multi-tenant isolation is not yet implemented. For strong compliance use CI as a backstop and lock the file (`chmod 444 .sofagent/config.yml`); do not run the single-machine default in production.
Designed for a single machine / single user; multiple agents share one knowledge base and audit history, and multi-tenant isolation is in the roadmap. task/logs are stored in plaintext (static encryption not yet wired).

2026-06-182026-09-02v1.4.3

MIT · actively maintained (latest release v1.4.3, 2026-09-01)