IAM.Agent: DeepSeek Harness plugins in Enterprise

Connect the official Plugin Manager, inspect tools and resume an ACP session.

Availability

This workflow requires the new source development build, not a published installer. The actual macOS application was checked with official DeepSeek Harness 0.2.0-rc.2. Enterprise uses an installed Community application root with separate private state. The 0.2.1-alpha.3 reference checkout does not replace the supported runtime. The capture shows the real application and a separate educational workspace, without customer data; catalog inspection did not call a model.

Connect a profile

  1. Install the supported Community archive in a separate empty directory using the service connection guide. Run npm ci, npm run doctor and npm run compatibility.
  2. In Enterprise open Settings → ACP → DeepSeek plugin host. Enter Node.js executable, Installed application root and Host workspace. The workspace must be inside the permitted native workspace.
  3. Leave Bind IAM.Router from native settings unchecked for plugin inspection. For model tasks, configure Router first, then check it and enter Router model. The key remains in native settings.
  4. Click Save DeepSeek host, then Inspect plugins. Check the actual counts and expandable Actual tools list. Saving and inspection do not start a model task.
Enterprise: actual DeepSeek plugin manager in the native development build;98 plugins and24 tools
Enterprise: actual DeepSeek plugin manager in the native development build;98 plugins and24 tools
2026-10-16 · Actual native development build and owned local profile. The98-plugin/24-tool inventory comes from the official DeepSeek runtime; Router binding is off. This capture does not qualify cloud task execution or a production installer.
  1. Saved host
  2. Save DeepSeek host
  3. Inspect plugins
  4. Exact package / SHA256

Change a package

Close this host’s active ACP sessions. In Exact package@version or absolute .tgz, enter an exact package version or a reviewed local archive; supply SHA256 (.tgz) for an archive. Click Install exact artifact. Plugin code runs with your OS user’s privileges; install only reviewed packages.

Removable bundles offer Disable, Enable and Remove bundle. Start a new runtime after a change and click Inspect plugins again. Version ranges, archive URLs and automatic incompatible-peer exemptions are refused.

For unknown or failed, inspect the actual versions and tools first. Only then select I reviewed this operation. The application never retries a package operation automatically and does not promise physical node_modules rollback after failure.

Sessions and recovery

Select the created profile in Live ACP sessions. Doctor checks the protocol without a model prompt; Open session opens a session. Sending a task is separate. Native Strict preserves approval requests for filesystem and terminal operations.

Resume in Session history fills the exact upstream session ID and workspace. Click Open session separately: the client uses the advertised session/resume or compatible session/load. Interrupted work stays unknown and is never resent automatically.

Changing the Router key, application, workspace or its .env blocks the old binding. Explicit Save DeepSeek host creates a new profile; old files remain, but plugins, keys and tasks are not transferred automatically. This macOS workflow does not qualify Windows process-tree cleanup or signed installer distribution.