《sofagent》：用 DeepSeek Harness 给 AI 编程智能体立规矩、留痕、可回滚｜安装指南 - DeepSeek Harness 插件介绍与一键安装命令

MIT 协议的开源 FDE Harness 治理层：9 个 DeepSeek Harness 原生插件，对每一次 AI 改动做审计、留痕、快照，让 AI 干活守规矩、出事能回溯。

DSH 适配

原生运行时

作者声明

安全审计

未审计

最后核验

2026-09-03

许可证

MIT

01它能帮你完成什么？

Govern every change your AI coding agent makes inside DeepSeek Harness — gate edits, record an audit trail, and snapshot before commit
A forced audit on each commit (24 git-diff rules: secret-leak, cross-boundary, injection detection) with hard evidence, an immutable audit log, and one-click rollback to any snapshot
Solo founders and small teams running DeepSeek Harness (DSH) who want AI work constrained, traceable and recoverable
61b5cb73cffc…
Onboard AI nodes into your business with the FDE method — map workflow, build the dual ontology, deploy and continuously govern
Enterprise profile, AI-node plan with annual savings, and three-layer deliverables (docs + Skill + runtime) that run inside your DSH agent
FDE / deployment engineers and small businesses adopting AI without a dedicated platform team
61b5cb73cffc…

前置条件

Node.js ≥ 18 (required for the full `bash bootstrap.sh` install)
Install on the device that runs your AI agent (enterprise machine), not the FDE's own laptop
A git repository to audit

安装步骤

01
$ npx -y -p @sofagent/audit sofagent-audit
02
$ curl -fsSL https://raw.githubusercontent.com/KongFangXun/sofagent/refs/tags/v1.4.3/bootstrap.sh -o bootstrap.sh
03
less bootstrap.sh # review the script before running
04
bash bootstrap.sh && rm bootstrap.sh
05
sofagent-audit --init # install git hook for per-commit audit
06
sofagent-audit --doctor # verify environment (optional)

验证接入成功

DSH 适配原生运行时

DeepSeek Harness 原生运行时插件：9 款 `cordis-plugin-sofagent-*` 以最深的「插件级」档位挂载进 DeepSeek Harness（Cordis）运行时

Zero-config audit
any git repository's latest commit→audit result against 24 git-diff rules (quick default 17 + 7 extended via config): secret-leak / cross-boundary / injection detection with hard evidence
61b5cb73cffc…61b5cb73cffc…
Constraint injection (4-layer)
your enterprise constraints at agent startup→four-layer constraint injection into the DeepSeek Harness agent
constraints are advisory — an agent may skip them; only the audit is mandatory
61b5cb73cffc…61b5cb73cffc…
Snapshot rollback (回溯)
each audited change→an automatic snapshot archive; one-click restore to any snapshot
61b5cb73cffc…

适合

Solo founders and small teams running DeepSeek Harness (DSH) who want AI work constrained, traceable and recoverable
FDE / deployment engineers and small businesses adopting AI without a dedicated platform team

不适合

config.yml is not fail-closed by default — rules can be tampered with / bypassed by the agent, and multi-tenant isolation is not yet implemented. For strong compliance use CI as a backstop and lock the file (`chmod 444 .sofagent/config.yml`); do not run the single-machine default in production.
Designed for a single machine / single user; multiple agents share one knowledge base and audit history, and multi-tenant isolation is in the roadmap. task/logs are stored in plaintext (static encryption not yet wired).

config.yml is not fail-closed by default — rules can be tampered with / bypassed by the agent, and multi-tenant isolation is not yet implemented. For strong compliance use CI as a backstop and lock the file (`chmod 444 .sofagent/config.yml`); do not run the single-machine default in production.
Designed for a single machine / single user; multiple agents share one knowledge base and audit history, and multi-tenant isolation is in the roadmap. task/logs are stored in plaintext (static encryption not yet wired).

2026-06-182026-09-02v1.4.3

MIT · actively maintained (latest release v1.4.3, 2026-09-01)