Blog · Analysis
Claude Code, Codex, and DeepSeek Harness: three answers to one question — who holds control
August 30, 2026 · dshbase · rewritten field note
Rewritten and expanded from a WeChat article by 洋说Ai (2026-08-30) comparing the official docs of Claude Code, Codex and DeepSeek Harness.
Source clue (WeChat via Sogou; not a verbatim reprint) — Rewritten and expanded from a WeChat article by 洋说Ai (2026-08-30) comparing the official docs of Claude Code, Codex and DeepSeek Harness.
Give an agent one sentence — patch the payment module, add tests, hand it to a human for review — and three products built for exactly this diverge immediately. Which files matter? Should retrieval be delegated? Who draws the permission boundary, and can the trail be reconstructed after a failure? A circulating WeChat piece by 洋说AI lined up the official docs of Claude Code, Codex, and DeepSeek Harness and found all seven capability rows filled in for all three. The table says what they have. It does not say why they look different. This post takes a stab at the why, from the angle we care about: where does control actually live.
Three places to spend complexity
Claude Code spends it on how work is organised. Project facts that hold every session go into CLAUDE.md; procedures used only sometimes — release checklists, review steps — become Skills loaded on demand, keeping the main context lean. Subagents earn their keep through isolation, not roleplay: noisy search and trial-and-error stay in a side context, and the parent receives only the conclusion. Calling one of them "senior architect" adds a prompt persona, not a boundary. Hooks then take over where suggestions end: formatting after edits, blocking sensitive files, capturing execution records — these fire because the system guarantees them, not because the model remembered to.
Codex spends it on boundaries. Its split between sandbox and approval is the most operationally useful idea of the three. The sandbox decides what the process can technically touch — writable directories, network, protected paths; approval decides which actions must wait for a human or a policy. Crucially, git, package managers, and test runners spawned mid-task inherit the same boundary; renaming a tool does not open a side door. Prompting a model to "be careful with commands" is a request. A sandbox makes the same thing a law of physics.
DeepSeek Harness spends it on removability. In its Developer Preview, model adapters, tools, skills, sessions, sandbox backends, and even the agent loop itself are plugins over the Cordis microkernel, which handles nothing but load, unload, and dependency order. Services are injected through a shared context, effects are reversible, and a tool that depends on a file-system service never learns whether it is talking to a local directory or a container. The append-only session log records prompts, reasoning, tool calls, and injections as one event stream, so resume, fork, search, and replay are all queries over the same data — which is, from an auditing standpoint, the most interesting property in the whole design.
The cost of each bargain
- Claude Code's system is closed: you adopt its conventions wholesale and get a polished product in return.
- Codex's boundary is firm but assumes a single execution posture — your machine, its sandbox rules.
- Harness's freedom is expensive. Context, Provider, Effect, Bundle, Profile — the learning curve is real, and a runtime where everything can be swapped makes configuration drift and version coupling your problem. The trade is worth it only if you genuinely need multiple loops, sandboxes, or model backends in one system.
What an installer should check first
If you run DSH from this catalog, the architecture review reduces to three questions per plugin you add: which context does it mutate, can uninstalling prove it reverted everything, and does anything it registers land in the session log. Those are exactly the seams where the reversible-side-effects promise is either honoured or quietly broken. The same lens applies to the other two: Claude Code earns trust when hooks, not hopes, guard sensitive paths; Codex earns it when every spawned child stays inside the box.
These three schools are converging — Claude Code is growing finer permissions, Codex grew skills and plugins, Harness ships a complete coding-agent mode. When we compare the next wave of agent products, the interesting question is no longer how many models they support. It is what the model may decide alone, what the program enforces regardless, where a human is forced into the loop, and how much of a failed run you can replay afterwards.
On dshbase
Before installing random GitHub plugins, check the verified directory and audit notes.