security: upgrade DeepSeek Harness past CVE-2026-82533 #16

New issue

Open

opened 2026-09-09 14:37:26 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-09 14:37:26 +00:00

Owner

Summary

AgentProlog master currently pins the DeepSeek Harness 0.1.1-rc.2 release train in packages/agentprolog/package.json, pnpm-lock.yaml, and packages/agentprolog/src/compatibility.ts.

CVE-2026-82533 affects DeepSeek Harness 0.1.1-rc.2 and earlier. A sandboxed coding agent could reach the Harness local control plane and mutate its own session to danger-full-access, disabling the file sandbox and approval prompts. The upstream fix adds authenticated access to the Harness control plane.

Required fix

Pin all @deepseek-ai/dsh-* direct dependencies used by AgentProlog to 0.1.2-rc.1 (or a later explicitly reviewed fixed release).
Update the lockfile to the same exact release train; do not use floating latest dist-tags.
Update SUPPORTED_HARNESS to version 0.1.2-rc.1 and upstream tag commit a66e4702047846cdaa10c66c9d3df3951f5ea70d (dsh-v0.1.2-rc.1).
Keep the host identity check fail-closed before plugin publication/startup.
Build, typecheck, unit test, headless integration test, and nix flake check on the upgraded train.
Document CVE-2026-82533 in the compatibility/security notes.

Acceptance criteria

No 0.1.1-rc.2 DeepSeek Harness packages remain in the AgentProlog dependency graph.
0.1.1-rc.2 host identity is rejected before runtime/plugin activation.
0.1.2-rc.1 + commit a66e4702047846cdaa10c66c9d3df3951f5ea70d is accepted.
Existing mode routing, AgentFactory, sidecar protocol, and TUI integration tests remain green.
Exact dependency pins are used because DeepSeek plugin dist-tags are not a reliable security boundary.

References

CVE-2026-82533
DeepSeek Harness fixed tag: dsh-v0.1.2-rc.1 / a66e4702047846cdaa10c66c9d3df3951f5ea70d

## Summary AgentProlog `master` currently pins the DeepSeek Harness 0.1.1-rc.2 release train in `packages/agentprolog/package.json`, `pnpm-lock.yaml`, and `packages/agentprolog/src/compatibility.ts`. CVE-2026-82533 affects DeepSeek Harness 0.1.1-rc.2 and earlier. A sandboxed coding agent could reach the Harness local control plane and mutate its own session to `danger-full-access`, disabling the file sandbox and approval prompts. The upstream fix adds authenticated access to the Harness control plane. ## Required fix - Pin all `@deepseek-ai/dsh-*` direct dependencies used by AgentProlog to `0.1.2-rc.1` (or a later explicitly reviewed fixed release). - Update the lockfile to the same exact release train; do not use floating `latest` dist-tags. - Update `SUPPORTED_HARNESS` to version `0.1.2-rc.1` and upstream tag commit `a66e4702047846cdaa10c66c9d3df3951f5ea70d` (`dsh-v0.1.2-rc.1`). - Keep the host identity check fail-closed before plugin publication/startup. - Build, typecheck, unit test, headless integration test, and `nix flake check` on the upgraded train. - Document CVE-2026-82533 in the compatibility/security notes. ## Acceptance criteria 1. No `0.1.1-rc.2` DeepSeek Harness packages remain in the AgentProlog dependency graph. 2. `0.1.1-rc.2` host identity is rejected before runtime/plugin activation. 3. `0.1.2-rc.1` + commit `a66e4702047846cdaa10c66c9d3df3951f5ea70d` is accepted. 4. Existing mode routing, AgentFactory, sidecar protocol, and TUI integration tests remain green. 5. Exact dependency pins are used because DeepSeek plugin dist-tags are not a reliable security boundary. ## References - CVE-2026-82533 - DeepSeek Harness fixed tag: `dsh-v0.1.2-rc.1` / `a66e4702047846cdaa10c66c9d3df3951f5ea70d`

nsaspy added the

security

label

2026-09-09 14:37:26 +00:00