Changelog

What changed in each Delorun version, newest first, and how Delorun differs from DeepSeek Harness. The entries are in English.

Delorun compared with DeepSeek Harness dsh-v0.2.2-rc.3

This is everything that differs from DeepSeek Harness dsh-v0.2.2-rc.3 in the latest assembled version.

Install and update

  • delorun changes edit-harness makes your own copy of the installed Delorun's program files and prints its folder. Each file you save, add or delete there is a change to Delorun itself, listed in delorun changes list. With protection off, the default, the next delorun start applies it without review, says so, and undo takes it back; with protection on it waits for your review, and show, apply, discard and undo decide it as they decide a plugin's change, at a terminal. An applied change runs from Delorun's next start, beside the installed release, which is never edited and is checked at every start as before; delorun changes edit-harness --discard takes every change to Delorun itself back, even from a copy Delorun can no longer read, and the next start runs the installed release unchanged. A release too large for Delorun to read your copy of is refused before anything is copied. When Delorun fails to start right after such a change, including when a changed file stops Delorun before it starts, it starts once more without it and names it; when it does not start without it either, it names delorun changes undo <id> and delorun changes edit-harness --discard. Safe mode runs the installed release without any of your changes to it. delorun verify and delorun doctor list the files you changed and never report a pass when the files Delorun would run with your changes differ from what you applied.
  • Installing Delorun with npx delorun downloads the release it publishes, checks every file against the signed manifest and the public release log, and refuses to install anything that does not match. The runtime it installs is kept and reused, so starting Delorun again needs no network.
  • --release is refused, with both versions named, when a runtime is already installed, instead of being ignored. -- ends the launcher's own options, so the runtime keeps its own --release and --profile.
  • An install whose download fills the disk stops with the launcher's own message instead of a raw file-system error.
  • Installing Delorun with npx delorun now prints one line for each step it takes: which release it found, that the signature checked out, whether the public release log agreed, the size of the download, and the install itself. If the release log or its witness cannot be reached, has not cosigned the log's latest checkpoint, or only cosigned it long ago, the install says why, warns that the release has not been checked against the log, goes on with the release's signature, and checks again at the next connection. A log or witness that answers and disagrees with the release, or whose cosignature does not verify, still stops the install.
  • Running npx delorun on a Node older than the one Delorun needs now stops at once with one line that names the version Delorun needs and where to get it, instead of failing with an error from inside the program.
  • When the installed Delorun fails its start check because its files changed, the launcher says so in one line and, if the version before your last update is still installed and intact, starts that version's delorun recover rollback to take you back; otherwise it stops with the reason as before.
  • Unpacking the runtime writes several files at once while it reads the archive, so installing or updating Delorun spends about half as long unpacking: about 9 seconds instead of 18 for a full-size runtime on a busy computer.
  • Delorun 0.1.0 runs on Linux (x64 and arm64) and on Windows through WSL2. A release publishes runtimes for Linux x64 and Linux arm64 only. Running npx delorun or delorun update on native Windows stops before downloading anything and says Delorun 0.1.0 runs in WSL2, with a link to the guide's WSL2 steps. On a Mac it stops the same way and says macOS joins in a later release. A computer whose platform a release does not list still stops with PLATFORM_NOT_RELEASED.
  • delorun verify checks the installed release: its files against the signed manifest, the manifest's signature and timestamp, and the release's entry in the public transparency log, in a tree the log and a witness both signed. It trusts only the release root the launcher shipped and the roots an install walked from it, prints one line per check with a summary that says it is not a full verification of Delorun, and exits 1 when a check fails or the release signature could not be confirmed for a reason other than an unreachable log. It also names the directory of the launcher's roots it trusted and the release channel and log the installing launcher recorded. --json prints the same report for a machine, and --offline skips the log.
  • The installer, the launcher's start and delorun verify run one release-log check and keep one record of the newest log checkpoint they verified. A log that cannot be reached, answers with an error or is not signed by the log's key leaves the release unchecked and never stops a start; a log that is signed and then contradicts an earlier checkpoint, serves a broken proof or carries an invalid witness signature stops the start and names delorun verify. The check gives up after 90 seconds, and a running Delorun retries an unchecked release every 15 minutes.
  • A checkpoint stored by an earlier install is kept as the rollback floor only when the log proves it a prefix of its latest checkpoint; otherwise it is replaced, and the check says so instead of resetting the floor silently. delorun verify says since when a release has stayed unchecked.
  • npx delorun@latest repair replaces a program that will not start with a verified release and keeps your chats, settings, keys, devices and trust records. It asks you first in a terminal, refuses while Delorun runs, refuses to put an older release over chats a newer release wrote, and keeps the old program in runtimes.set-aside-<time>/, which delorun recover status lists. --restore-copy, --from and --reset-trust cover the harder cases. Each start now records which release wrote your data in data-format.json.
  • delorun update lists each change you made to Delorun itself and says whether it carries over to the new release. A change carries as it is when the new release left that file alone. When the new release changed the file without touching your lines, the two merge into a file neither had: delorun update prints its diff against the new release's file, and only you confirm it, not --yes. When the two overlap, the new release's file runs and yours is kept beside it as <file>.mine in your copy of the new release, and --yes does not confirm such an update either. An update refuses while changes to Delorun itself wait for your review, or when your copy of Delorun cannot be read, naming delorun changes edit-harness --discard and delorun changes list; it refuses before switching when what it would do with your changes no longer matches the report you confirmed, and asks you to run delorun update again. Going back to the previous release runs your changes to it again.
  • delorun update --from <folder or https address> installs a release from files you downloaded from its release page when the release channel cannot be reached. It checks signatures, the release log and digests like a channel update. If the channel cannot confirm the release is current, it asks first in a terminal; --yes and a missing terminal refuse. A release below the one you run is refused. npx delorun@latest repair --release <older> --from <folder> asks in the same way. A repair now marks the whole home while it runs, so no Delorun starts meanwhile, not even for a new profile, and cannot run the program being set aside. A start during a repair says "Delorun is being repaired; wait for it to finish".
  • Delorun tells you when a newer release exists: once a day, and at start when a day has passed, it checks your release channel's signed files and, when a newer release is out, prints one line in the terminal and shows a quiet notice in the studio's sidebar with the new version, whether it is a security fix, how many of your plugins it would turn off, and the command to run. Nothing is downloaded or installed until you run delorun update, and you can dismiss the notice for that version.
  • The check sends nothing about you or your plugins; the release hosts see your computer's address. Setup asks whether to check for new releases under More settings, and delorun setup privacy, --no-update-check and an answers document's updateCheck turn it off; turned off in setup, it makes no request at all, not even at the first start. Turn it off later in Settings → General → Updates, and run it yourself any time with delorun update --check. delorun update --report shows everything an update would change, plugin by plugin, without applying it.
  • delorun update fetches the newest release on your channel, checks it, shows what it would change in your profile before anything changes, and applies it once you confirm. Running chats finish first, and an update whose new version fails its health check goes back on its own and names the check it failed; a plugin the report disables does not count as a failure when its rows are gone, and neither does a Docker socket that appeared, or a Docker context you switched, since Delorun started; a new version whose sandbox would protect less than the one it replaces goes back too. Updates come from the channel the launcher that installed Delorun was built for; no environment variable or setting moves it. Delorun keeps your profile's history with git, so an update and a rollback say so and stop before they fetch or change anything when git is not installed. A release that does not verify, a release channel that cannot be reached, or an update the home process could not finish, ends with a sentence that says what happened and what you can do.
  • While an update or delorun stop waits for running chats to finish, a new message starts no turn: the chat shows that Delorun is updating and that the message was not sent, so you send it again once Delorun is back, and the wait ends once the running chats end. Background jobs count as running chats, and stopping with --now cancels them too.
  • Before an update applies, Delorun works out what the new release would change in the person's profile: each plugin it would disable or remove and why, judged exactly as Delorun judges a plugin when it installs or starts one, so a plugin that names its DeepSeek Harness versions only through its peer dependencies is not shown as kept when the next start would turn it off, each bundle that leaves the bundle list or cannot load, and each row and Include that loads a plugin the update disables. The report marks every prediction it could not fully make from metadata it could read, so those are never counted as safe, and it shows both the CLI home's and the desktop Host's versions and update states, because the two update independently. Nothing applies until the person confirms, and delorun update --yes will not confirm a report that disables or removes anything or rests on metadata Delorun could not read.
  • When an update changes the format of your chat data, the report says so and Delorun copies your chats and workspaces first, unless you choose to continue without the copy. Going back restores that copy and keeps the chats written since in a set-aside folder; nothing is deleted.
  • delorun recover status says whether your last update committed, was rolled back or has not committed, lists the update you can go back from and every kept copy and set-aside folder with its size, delorun recover rollback goes back, --profile-only restores only your profile, and delorun recover discard removes a kept folder you no longer need. Delorun's home log records each step of a rollback as it records an update's, so delorun logs home shows where a slow rollback spent its time.
  • An update or a rollback checks every release against the release roots of the launcher that started Delorun, so a root file replaced under the home is not trusted; a Delorun started without its launcher refuses to update or roll back and says to start it with the launcher. A studio that takes long to shut down for an update is waited for instead of ending Delorun in the middle of the switch, and one that does not shut down ends the update with nothing changed and Delorun running again.
  • Contributors can measure where a person waits on Delorun with pnpm run benchmark:delorun: install and setup, start and stop, the everyday commands, delorun update, update --check and rollbacks step by step, recovery, export, import and the trash, plugins, a chat turn without a model, and the studio in a headless browser, all on local releases in throwaway homes with no network, with a mode that fails when a step exceeds its recorded ceiling.
  • The studio's update card has a What's new button that opens the release's notes. The notes show only after their length and SHA-256 match the signed release manifest and their text passes the same plain-text checks as the release summary.
  • delorun update --report and delorun update show, under a plugin the update turns off because its DeepSeek Harness version range excludes the new release, the command that accepts the risk for that exact version and say that the health check after the switch rolls the update back if the plugin then fails to load. A new guide page, "Update Delorun with many plugins", walks through saving, checking, updating and going back.
  • Fixed: delorun recover discard runtimes.set-aside-<time> removes the program store that delorun repair set aside. It stopped with a permission error because the installed program's folders are read-only.
  • Fixed: delorun repair refuses to start an older program over chats when the home records which release wrote them and the release's data formats cannot be compared (DATA_UNREADABLE), and --restore-copy refuses a copy whose formats are newer than the release reads (DATA_COPY_NEWER). A restored copy's facts become the home's data-format record. A release signed by a local release build is refused from a --from folder as well when the launcher trusts the production keys, and repair reads the floor from the channel the home installed from.
  • Fixed: When a repair was killed during its download, the next start or repair names the set-aside program store (runtimes.set-aside-*) and prints the command that puts the old programs back.
  • Fixed: delorun update --from with a folder that does not exist now says the folder does not exist and that nothing was installed, instead of reporting a failed download.
  • Fixed: An update that fails its health check rolls back on its own even when the new release was stopped while it wrote a profile lock file.
  • Security: Starting an installed runtime does not trust a release root merely because a file under ~/.delorun/trust/ names a newer version: the launcher keeps the root chain the install walked, checks that it leads from a root the launcher carries, and otherwise stops and offers a reinstall. It starts a runtime only when the release root the home stored is one the launcher ships.
  • Security: An installed runtime is made read-only before its files are hashed, so nothing can change a file between its check and the mode that protects it.
  • Security: The runtime starts without the NODE_OPTIONS, NODE_PATH, LD_*, DYLD_*, NODE_EXTRA_CA_CERTS and NODE_TLS_REJECT_UNAUTHORIZED variables that the shell passed in, so the shell that started delorun cannot stand between the runtime and the connections it verifies. A profile name that would leave the Delorun home is refused before anything is read.
  • Security: The release-log check accepts every consistency proof the log serves and refuses only one that does not reproduce both tree roots. It also refuses a bundle that names a different manifest file than the release's own, a release version that is not a version, and a checkpoint that no listed witness has signed, even when the trusted root carries no witness requirement of its own. A log entry whose signing key cannot be read says why in its refusal.
  • Security: The Linux runtime's sandbox launcher and file-lock addon are compiled from the release's own tagged source in a pinned toolchain without network access, so a rebuild of the release reproduces them byte for byte, signing covers them and the release's software bill of materials names the compiler packages that built them.
  • Security: A Delorun release and its freshness timestamps are signed only with keys the public repository records as Delorun's production keys, so nothing is signed until those keys are recorded. A release is signed only when its version tag carries the signature of a release signer that the release branch of the public repository lists, not a local copy of that list, and the tagged code is on the release branch, and only when the delorun npm package it records, by name, version and checksum, is the package the release built. Until install scripts are rebuilt and compared like the rest of a release, no release lists one.
  • Security: A test release built on someone's own computer can never be signed with Delorun's real release keys, so a launcher that trusts Delorun's releases never accepts one.
  • Security: Each start checks the installed release under the newest release root the launcher ships, never an older root the home stored, so a signing key a newer root revoked stops the start. The launcher passes on no DELORUN_LAUNCHER_ setting it inherited.
  • Security: A start stops when the release-log bundle kept beside an installed release is missing, instead of starting with a warning; the message names the missing file and offers delorun recover rollback or putting the file back, and delorun verify fails on it as before.
  • Security: A launcher that installs from Delorun's published release channel refuses a release that the local release tool built.
  • Security: delorun update never moves to a release lower than the one running: a channel or a request that names a lower release is refused before anything is downloaded, and delorun recover rollback stays the only way back.
  • Security: The update report says when the release log could not be reached as the release was installed, instead of showing its log check as passed, and delorun update --yes does not confirm such a release.

Setup

  • The delorun command keeps your data in your own Delorun home, ~/.delorun or the directory DELORUN_HOME names, readable only by you, and never touches DeepSeek Harness's ~/.dsh. Its first run sets up the command-line profile; after that it starts Delorun in your terminal and opens the studio. Only one Delorun runs per profile.
  • If the profile's cordis.patch.yml sets the sandbox row's runnerCommand or runnerFailureSignatures, delorun start refuses with an error naming them and asking for their removal: your home's protection runs through the sandbox's built-in runner selection.
  • delorun import-home copies your DeepSeek Harness home, ~/.dsh or the folder --from names, into your Delorun home. It only reads ~/.dsh, which stays exactly as it was. After one yes it copies your chats, exactly as they were saved, the images and files they refer to, and your workspace list.
  • Then it asks about each of these on its own, and each starts on no: your profiles, your settings, your AGENTS.md instructions, your skills and your DeepSeek key. It shows each before it asks: each profile's plugins as carried, to install, added or not carried, the exact settings that would land, the first lines of your instructions, each skill's description, and your stored keys by name and never by value. --dry-run shows the preview and writes nothing.
  • Only settings that change how Delorun looks and your default model by name carry over: your theme and fonts, how chats and the composer show things, and your language. Every other setting is held back even after a yes, because it could run code, send your requests or key elsewhere, or switch off a protection; the preview lists each with the reason, and the import writes them where nothing reads them. A profile lands with its plugin list alone: no install script, lockfile, build approval or plugin from a path. A profile named headless stays behind, because delorun headless sets up its own, and so does a profile whose name Delorun can't start, such as one with a capital letter or a dot.
  • Setup asks "Copy your DeepSeek Harness chats, attachments and workspace list?" after its preview when ~/.dsh exists and your Delorun home has no chats yet, starting on no, and copies only those. delorun import-home copies the rest.
  • The preview lists every workspace with its folder. A workspace in your home folder itself, a hidden folder of it such as .ssh, the root of your disk or a Harness home stays behind with its chats, and so does a chat that works outside its workspace's folder or stopped in the middle of a turn. Before each question the import shows the whole text that would land, a page at a time.
  • A chat that ran with full access in DeepSeek Harness opens on the safer preset until you allow full access for its workspace in Delorun.
  • The import refuses a Delorun home that already holds chats unless you add --merge, and never overwrites a chat, attachment or workspace. Links, pipes, other drives, files linked to something outside ~/.dsh, attachments whose content does not match their name, and names DeepSeek Harness does not write are never followed or copied; no plugin, script or install runs; it copies at most 4 GiB unless --max-size gives more; and if your computer stops during an import, the next start of Delorun removes the part it had copied.
  • After the import, delorun plugin --profile <name> install installs each profile's plugins; the import prints the command for every profile that needs it, and a plugin's install script runs only after you approve it.
  • delorun setup asks which model provider Delorun uses: Anthropic, DeepSeek, Google Gemini, Groq, Mistral, Moonshot AI, OpenAI, OpenRouter, Together AI, xAI or any OpenAI-compatible endpoint, listed by name, or none for now, which changes no provider setting and says which model new chats still start on. DeepSeek works without any extra install, and so does every other provider in the list.
  • For each provider setup asks where its key comes from, typed now or read from the provider's variable at each start, and the model new chats start on, beginning on a current general model of that provider; an OpenAI-compatible endpoint also takes its base URL, without a user name, password, query or fragment and with a warning for plain http to another computer, and its model id. Setup keeps DeepSeek's default model and asks the model of every other provider; delorun setup key asks it for DeepSeek too.
  • A typed key is checked with one request for the provider's model list, or OpenRouter's key details, to the provider's own address, never a completion; a failed check says why and lets you enter the key again or continue with the key marked not verified.
  • delorun setup --yes sets up no provider unless --provider <id> names one, with --model, --base-url for an OpenAI-compatible endpoint and --key-env for another variable, and says how to add one when none is named. delorun setup key takes the same flags on a profile that is set up and asks nothing. A key is never taken from the command line.
  • Setup writes what the studio's Settings → Models and the model picker save, so the studio shows the provider and model setup chose; DeepSeek with its own variable and default model leaves the profile as DeepSeek Harness composes it.
  • You can run setup again if you change your mind. delorun setup on a finished setup, in a terminal, asks every question again with your current choices selected, keeps your saved key, marks the answers you change and writes only those. In the studio, Settings → General → Run setup again opens the first-run steps on your current choices.
  • delorun setup asks the model provider with its key and how careful prompts should be, and its More settings choice asks whether Delorun keeps running in the background and the profile's name and port. Changes protection is asked there too: it holds changes to your plugins and to Delorun itself for your review, and setup never turns it off. A typed key is checked with one live request to the provider before it is stored, and a failed check says why and lets you enter the key again or continue. Every question can return to the one before it, and a review screen lists the answers before anything is written.
  • "Ask me first" and "Ask less (like DeepSeek Harness)" take effect: they set Delorun's consent and permission defaults to their Delorun or stock values in the new profile.
  • delorun setup <section> runs one section again, and delorun setup --list lists them.
  • A terminal setup ends by printing the next steps and starts nothing; delorun starts Delorun in the background, which keeps running after the terminal closes, with the commands delorun status, delorun logs --follow and delorun stop.
  • delorun setup --yes applies every default; delorun setup --config <file> applies an answers document. Neither form turns on reach or credential forwarding, and --check-key checks the key with one live request.
  • delorun setup does not ask about the two upstream opt-ins, desktop analytics and DeepSeek's session-log upload. Both stay off, and Settings → Privacy changes them.
  • An interrupted setup resumes at the step it did not finish, and a finished setup is left unchanged.
  • Setup from a source checkout adds Delorun's bundle to the new profile, so the Privacy section in Settings loads on the first start without a manual step.
  • The studio's first minute is one short guide that ends in a chat. Welcome sets the language, shows the preview notice and tests each model key with the provider's free model list, so nothing is spent; you can add or change a provider without leaving the guide. Look shows a small chat in the colours you pick. Agents offers Claude Code and Codex, says whether each is signed in on this computer, and asks you to confirm what adding one means: when an agent starts from a chat Delorun asks on this computer first unless you allowed it for that workspace, a phone cannot answer, read-only chats never start one, runs stay in the chat's workspace and stop after 30 minutes, and Settings → External agents revokes it; it runs outside Delorun's sandbox with its own sign-in and billing. Recommended plugins puts the plugins that fit your setup first. Phone access, while it is off, checks Tailscale step by step and gives the commands to copy. Workspace opens your first chat in the default workspace, a folder you choose, or a repository cloned from Git; a clone never asks for a password, refuses an address with a sign-in in it, runs none of your Git hooks or filters, shows its progress and says why it failed. Ready lists what you set and opens the chat with starting prompts that fit the folder and fill in the message box for you to send. The studio's own notice about a missing default workspace waits while the guide is open. Settings → General → Getting started shows the guide again. With no working model key, a calm line above the message box says "Add a model key to start chatting" and opens Settings → Models; the studio no longer opens upstream's "Add an API key" dialog.
  • Delorun's package scope, home folder and environment variables are named Delorun: @delorun/…, ~/.delorun and DELORUN_*.
  • delorun setup opens with "How will you use Delorun?": just me on this computer, also from my phone or another device, or scripts and automation. The answer sets the defaults and decides which questions come next, so most people answer three: the model provider and its key, and how much Delorun asks. The review screen lists every answer, including the release check and the prompts answer, and its More settings choice asks the rest. This replaces the Quick or Full choice.
  • Every choice shows what it does, who it suits and how to change it later, and the recommended one is marked. The prompts choices are Ask me first, Ask less (like DeepSeek Harness) and Never ask (dangerous), which stays the third option with its two confirmations.
  • Each provider's key question names the provider's key page where one is known, says what an environment variable is, and warns at once, with the fix, when the variable you pick is not set in your terminal.
  • Setup ends by printing the next steps and starts nothing: delorun to start and open the studio, the install guide's section on your first chat, and delorun setup <section> to change an answer. Ctrl-C exits with code 130 and says nothing was saved. Choosing Back at the dangerous-mode confirmation returns to the prompts question.
  • An answers document may carry "useCase": "local" | "remote" | "automation"; without it, local is used. An answers record written by an earlier setup, with or without a Quick or Full mode, still reads.
  • Fixed: Setup ends by saying once that Delorun is running in the background, and the review screen says when the key check failed and the key is not verified.
  • Fixed: In a source checkout, the package manager's output while Delorun links its parts into the profile goes to the home process's log, and the terminal shows one progress line.
  • Fixed: delorun status prints the studio's address, without any token, and "Run delorun open to open the studio in your browser."
  • Security: delorun setup installs the delorun command at the exact version of the launcher you ran, npm install -g delorun@<version>, never whatever version npm serves as newest, and offers no install when that version is unknown. delorun verify prints the launcher's version with the integrity the signed release lists for it, which you compare with npm view delorun@<version> dist.integrity as the Trust page describes.

Studio

  • Picking Full access in a chat whose folder does not have full access shows what it means before anything changes: one sentence on what agents can then do, one on the risk, and under Details the folder and what full access reaches: your files, Delorun's home with its keys and tokens, the Docker supervisor and Delorun's update channel. It is the only dialog the permission control shows for Full access, and it asks you to tick that you understand the risks before Allow full access is enabled. Allow full access records your answer and switches the chat; Cancel leaves it in the sandbox. In a folder that already has full access, or a chat without a folder, the same dialog asks "Switch this chat to full access?" with the same tick and records nothing.
  • When an agent asks to run something outside the sandbox, its approval card has three buttons: Reject, Allow once, and Allow for this chat. Allow for this chat switches the chat to the permission the request asked for, so later commands in the chat run without asking, and allows the request. For full access it shows the same single dialog first, and Cancel leaves the request waiting. You lower the permission again in the composer. A chat already at or above the requested permission shows only Allow once. Once you rejected the request, or it ended, the button is greyed out and switches nothing, also when you confirm the dialog it opened. If the switch is refused, the request stays waiting and the reason shows under the buttons.
  • Settings, Permissions lists everything you allowed, each with a one-click Revoke. Full access lists the folders that have it, where new chats start with full access; revoking puts the folder's open full-access chats back on the safer permission within a second, in every running profile, and the other folders sit behind a disclosure where you can allow it. MCP servers lists the local servers waiting for your OK, with what changed (a new server, or its command, arguments, folder or which environment variables changed since you allowed it, or the file or folder it points to changed), the servers you declined or revoked, which stay stopped and quiet until you allow them, and the servers you allowed, each remembered on its own; revoking one stops it until you allow it again. Each answer's result shows under the section's introduction.
  • Review on a waiting MCP server says what allowing it does, the exact file it runs and the folder it runs in, and its risk, what changed, and under Details its command, arguments, folder, the file, command shell and folder they point to, and environment variables, showing a value only for variables that change what runs, such as PATH, NODE_OPTIONS or LD_PRELOAD. Allow and start starts it without restarting Delorun, and if the file or folder changed since you looked, nothing is allowed and the review shows the new one; Decline keeps it stopped.
  • When an MCP server waits for your OK, a notice names it, and "Review and allow this server" opens its review, then the next waiting server's.
  • These answers are given only on the home's own computer. On a phone or another device, the approval card, the notice, Settings, Permissions and the full-access explanation say to approve at your computer and offer no button; the phone sees only the names of the waiting servers. With "Ask less (like DeepSeek Harness)" prompts, Settings, Permissions says the profile does not ask, and the permission picker switches as DeepSeek Harness does.
  • The sidebar's Plugins page offers a cost meter, under Components on the Delorun studio page: turn it on and each chat shows an estimate of what it has cost under the composer, and the breakdown names each model's requests, tokens and cost, with the chats a chat started added up under it.
  • You can bring the chats you had on chat.deepseek.com into Delorun. Export them from the website, turn on DeepSeek chat import under Plugins, More, then upload the file with the button beside New session; the first-run guide's Recommended plugins step offers the same switch. The plugin is off until you turn it on, and only you at the computer can import.
  • The first-run guide's Recommended plugins step now also offers the Thinking tab and the cost meter. Both are off until you press Turn on, and each starts at once, with no restart. They stay under Plugins → Delorun studio → Components too.
  • When the studio cannot start because a plugin fails to load or the page does not open within 30 seconds, and always at /recovery, a recovery screen shows what failed and your recent changes, and lets you turn off a plugin, undo a change or start in safe mode, in English or Chinese. These actions work only in a browser on the computer Delorun runs on; a remote session can read the screen and is told "This needs you at your computer."
  • Settings lists Changes under Data, after Trash, so the review of plugin and harness changes is one click from the navigation.
  • Settings has a Setup versions page that lists the versions Delorun keeps of your setup, newest first, with the current one marked and what made each: an update, a save by you or a switch. Save this setup, with an optional name, keeps a version; What changes shows, in plain words, which plugins, bundles, settings and version exemptions switching to a version would change; Switch to this version saves your current setup as a version first, so switching back is switching to that version, and then tells you to restart Delorun to run it. The page uses the same history as delorun recover. Saving and switching work only in the studio on your computer: a phone or other device sees the list and the changes and is told to do it at your computer.
  • In the studio's collapsed sidebar, moving the pointer to the rail — or to the left edge where the desktop hides the rail — opens the full sidebar over the page after a short pause, without moving what you are reading and without pinning it open. It closes again a moment after the pointer leaves (moving back in keeps it open), on Escape, or when keyboard focus leaves it, and hovering one of the rail's own controls never opens it, so every rail click still does what it did.
  • A Changes section in Settings lists the changes to your plugins that wait for your review, the changes a failed start left out, your agent's plugin requests and your recent changes. Review shows a change's folder, its files, a summary of what it can do with the reminder that the summary helps you read the change and is not a protection, the files the diff does not show, and the diff; Apply asks a second time and names what the summary found when it flagged anything. Discard, Undo and Apply again work from the same section, Start working loads a plugin's edits live, and Done shows the folder's version with its diff and approves exactly that version. An agent's plugin request can be applied there after a second confirmation that says Delorun cannot show what it installs before it runs. The section shows the protection setting with the terminal command that changes it, and with protection off says that changes load without your review, and your changes to Delorun itself with their diff and the terminal command that decides each. While a work session lasts, a badge at the foot of the sidebar names the plugin. A browser that is not on the computer Delorun runs on sees everything with every action disabled and "This needs you at your computer."
  • The studio opens in Delorun's look: a softer palette with a choice of accents and themes, Delorun's typefaces, a density and a contrast setting, under Settings → Appearance, and a Conversation page for how chats are displayed. One switch in Settings → General → Look turns every Delorun addition to the studio off and shows the stock DeepSeek Harness look; with the stock look, one row under Settings → General turns the Delorun look back on.
  • A profile set up with an earlier Delorun turns to the Delorun look at its next start; one switch in Settings → General → Look turns it back to the stock look.
  • Under the Delorun look, a new chat's empty screen shows the Delorun wordmark above its headline.
  • Under the Delorun look, the page shown while the studio loads names Delorun instead of HARNESS.
  • The sidebar lists chats as cards with their status, sorted with pinned chats first, with search, a workspace filter, Alt and a digit to jump to one of the first nine chats, and an undo for each change you make from the list. Each workspace can have its own icon (letters, a glyph, an emoji or a generated pattern, in its own colour and shape), and the top of the sidebar can show header art, drawn in full behind the white name and sidebar button, which a thin dark edge keeps readable on any scene; both are chosen under Settings → Sidebar. Plugins, Automation tasks and More sit as icon buttons in the sidebar's bottom row, beside Settings.
  • The sidebar's Plugins page offers a Thinking tab, under Components on the Delorun studio page: turn it on and the right sidebar can show the model's reasoning and reply one word at a time as it writes them, at a pace you choose, with a delay behind the model if you like.
  • The studio's sidebar foot shows how much of this Delorun was checked: a small badge reads verified only when every runtime file was hashed by a full check and the release log, the plugins and your changes all check out, reads "Checked at start" after an ordinary start, which hashes only part of the runtime, turns red for a failed check and amber for an unknown release, an unchecked release log, a plugin changed after its install or a critical advisory, and shows your own changes, including those waiting for your review, as a plain count. It opens a panel with the four rows, their details, and Check now, which runs delorun verify through the launcher, so every runtime file is hashed before the check runs, and shows how long it has run. A phone or laptop you approved for remote access sees the panel read-only; Check now runs only on the computer Delorun runs on. The panel says that these checks run with your access, so a program running as you can change them.
  • Settings opens as one larger panel with its pages grouped by topic and a search field that finds pages and settings by name, in English and Chinese. A section from a plugin that the grouping does not name appears under More.
  • The Ready step of onboarding shows the look and the workspace in the normal text colour, so green marks only what is working. On a phone the starter prompts in a new chat sit under their label at the width of the message box.
  • Settings is arranged in five groups. General holds a General page (language, look, updates with the release check and the current versions, keyboard shortcuts, getting started and the coding view), Appearance (colours, then text and density), Sidebar, a Conversation page for how chats are displayed, and Chat (composer, links and usage). Agent holds Models, Modes, Tools and Plugins; Safety holds Permissions (new chats, full access and MCP servers), External agents (the switch that asks before an external agent runs, its run time limit and the agents you allowed), Network and Privacy; then come Devices, and Data with Trash and About, which now lists the licences and project links.
  • Every Settings page uses sentence-case headings, two- and three-way choices are segmented controls that work as radio buttons, and Thinking under Conversation is a menu.
  • A third-party plugin can give its Settings sections a group of its own, titled with the plugin's name; sections nothing places appear under Other.
  • The studio's sidebar shows Delorun's hex jack mark, its centre in your accent colour, and the product name, Delorun, as its brand. The DeepSeek Harness mark and name no longer appear in Delorun's studio.
  • The studio's preview notice is Delorun's own. It says that Delorun is a pre-release community fork of DeepSeek Harness, built independently of DeepSeek. The browser tab title and the home-screen name read Delorun.
  • A sign-in link you tap in a message or on a web page now signs you in, and a browser that loads the link ahead of time no longer uses it up. A link already used or past its minute still fails.
  • Onboarding on a phone shows a welcome line, a one-line note in place of the computer's phone access steps, a shorter key field hint that says where the key comes from, and larger tap targets. Onboarding and the greeting say Delorun.
  • The studio no longer asks for the update notice when the release check is off, so the browser console stays clean.
  • The Plugins page's install guide names delorun plugin add and delorun plugin remove, the commands Delorun has, and asks for the full path of a plugin's folder, which is the only kind of folder path the studio can install from.
  • The npm mirror switch moved from Settings, Privacy to Settings, Plugins, under the heading Plugin downloads, with shorter copy. It shows nothing when the profile does not load the plugin install check.
  • On a phone the attach and send buttons in the message box have a 44 px tap area, the Settings tab strip fades at the edge that has more tabs, and the key field's Apply button is neutral in onboarding so Continue is the one primary button.
  • On a touch screen the Settings tabs, the Close and Open configuration file buttons and the API key field are 44 px tall, and text fields use a 16 px font so the page does not zoom when one is focused. Desktop sizes are unchanged.
  • Settings: the Modes captions are sentence-case headings, the opening sentences of Devices and Network line up with the other panes, and the Devices terminal switch sits beside its label.
  • The plugins step of onboarding names a plugin in words, never by its package id, while its title is still loading.
  • Fixed: The browser tab is titled "Delorun", not "DSH Local Build", and the studio's stored look is applied before the first paint, with no flash of the stock sidebar.
  • Fixed: After you trash the chat that is open, the main pane shows a new chat and the keyboard returns to the message box.
  • Fixed: The guide's option chips are one labelled group you move through with the arrow keys, and its two "Add" buttons have distinct names. The page has a main landmark, "Search chats" and the message box show a focus ring, "Reconnecting..." is announced politely, and Escape closes the phone-width sidebar drawer.
  • Fixed: The studio you open on the computer that runs it no longer reads "Disconnected" when that computer has no network, such as with Wi-Fi off. It stays connected, because it never needed the network, and it no longer makes a request that only a phone or other device could use, which showed as a failed request in the browser's console.
  • Removed: Delorun's setup no longer offers DeepSeek account sign-in, the account entry in the menu is gone, and so are the account's Usage and Top-up pages. Use your own DeepSeek API key, which Delorun's model settings still accept. The account pages stay in upstream's code and are not reachable from Delorun's default setup.

Chats and workspaces

  • delorun export <chat-or-workspace> --out <file> writes a chat, or a workspace with its chats and their attachments, as an archive signed by your home. It warns about secrets it finds in the chat history, naming each by kind and never by value, and writes nothing until you confirm.
  • delorun import <file> checks the whole archive before it writes anything, shows who signed it and what it holds, and imports it after you confirm. An archive whose signature does not verify, whose bytes disagree with its manifest, whose paths leave the destination, that holds a link, or that is past its size or compression limits is refused; an archive from a home you do not know is imported only after you type its key's fingerprint, and an unsigned one only after you accept it unverified. Imported chats are kept apart and stay out of every model request.
  • Importing an archive brings a person's exported chats, attachments and workspaces into the home in one step that writes nothing until the whole archive has been checked: a path that climbs out of the destination, an absolute path, a link, a device, an archive past its size or compression limits and an archive whose bytes disagree with its manifest are all refused before anything is staged. The import states whether the archive's signature is verified, and shows the customisation the archive carries as a diff before any row is applied; an export warns about the secrets it finds in chat history before it writes the file.
  • An archive that hides a configuration expression behind JSON escapes is refused, so a customisation value that reads as a tagged expression is caught after it is decoded as well as in the file's raw text.
  • An archive with two entries whose names are the same word written in different Unicode forms is refused, because both would land on one file.
  • A new Delorun home has a default workspace on every platform: Delorun/default-workspace in your documents folder when the computer reports one that is not your home folder, otherwise Delorun directly in your home folder. delorun start picks the folder, and it is created when the studio first needs it. Restating the workspace-controller row in the profile's cordis.patch.yml with your own defaultWorkspaceDirectory chooses another folder.
  • A chat can be snoozed until later or settled when it is done, from its menu or its card; it moves to a folded Snoozed or Settled shelf at the bottom of the chat list and comes back when its snooze ends or when you send it a message. The snooze times and an optional rule that settles chats left idle for some days are set under Settings → Sidebar. The states are kept on your computer and never reach the model.
  • Deleting a chat or a workspace now moves it to the trash: "Move to trash" in a chat's or a workspace's menu archives its chats, stops their running work and takes them out of the sidebar. The new Trash section in Settings lists what was deleted with the days each item has left, restores an item where it was, and deletes one or every item forever from every place Delorun keeps it, with an offer to clear the operational logs at once. Items older than 30 days are deleted when Delorun starts. delorun trash list, restore, purge and empty do the same from the terminal while Delorun is stopped.
  • Trash deletes a chat or a workspace into a 30-day retention, restores it before the retention ends, and purges it from every store that holds its content: the full-text index, the session generations, the attachments, the spill files and the browser drafts. It offers to clear the affected process logs, current and rotated, at once.
  • Permanently deleting a chat also removes the copy the session list keeps for it, so the chat's title, first message, plan, goal and todos no longer stay on disk after the purge.
  • A folder you open now starts on the safer permission, so a chat can write inside it and asks before doing more; turning on full access for a folder takes one answer covering that folder, and a chat whose folder was never answered stays in the sandbox even when something tries to switch it.
  • Choosing the safer permission for a folder again withdraws that folder's full-access answer, so turning full access back on asks once more, and puts the folder's other open full-access chats back on the safer permission within a second, in every running profile. A chat picking full access after another profile or delorun workspace full-access withdrew it asks again.
  • Fixed: A code run whose execution process ends on its own now reports that process's own exit status every time. A busy machine no longer replaces it with the termination signal we sent to a process that was already stopping.
  • Fixed: A damaged workspace list no longer leaves the studio empty. Delorun starts with every workspace record it can read, sets the rest aside in a dated file next to the list (it never deletes one), and logs where it is. It also keeps the previous good copy of the list, delorun doctor checks the list, and delorun recover workspaces brings the previous copy back after asking you. See [The workspace list](../../docs/guide/troubleshooting.md#the-workspace-list).
  • Fixed: The agent can rename a workspace with the new rename_workspace tool, after you allow it, instead of editing files by hand.
  • Fixed: When some workspace records were set aside, the studio says so above the message box, names the file and points to delorun doctor; you can dismiss it. A rename_workspace call in a chat shows the old and new name, or why it was refused.

Safety and privacy

  • With changes protection on, before the agent first writes to the folder of a plugin you approved, the chat asks you, names the plugin and shows the diff, because the agent is changing what your harness runs; once you allow it, the rest of that chat's writes to the plugin go ahead, and what it wrote still waits for your review in delorun changes. A link or a .. in the path asks the same way.
  • With changes protection on, when the agent asks to install, update or remove a plugin, nothing is installed or removed: the request waits in delorun changes and the studio's Changes section for you to apply or discard it at your computer, and the agent is told so. With protection off, the default, the agent's plugin requests run as in DeepSeek Harness and a plugin it installs from a folder is recorded as loaded without review. Applying a plugin from a folder adds it with nothing loaded, and its content waits for your review as its own change.
  • With setup's Dangerous answer on, a phone or browser signed in over remote access, with its unlock running, can do what the computer does: change the settings and plugin rows the computer alone changes with the other answers, run any slash command, loosen the permission new chats start in, answer the questions for MCP servers, external agents and a workspace's network, give the approvals that reserve full access, use terminals, save or remove provider keys (a saved key is never sent back), open a chat's folder in an application on the computer, and read files outside the chat's workspace. A workspace's full access that a device turns on ends with the mode, while what you set at the computer stays. Only the computer turns the mode on, approves a new device or an unlock, removes a device, changes the remote-access settings or signs a device in. Settings, Permissions now shows delorun setup prompts as code in the Dangerous mode card.
  • With setup's Dangerous answer on, any chat can switch to full access with no dialog and no per-workspace consent, from the studio at the computer, a phone signed in over remote access, a scheduled task, a bot or delorun headless. Settings, Permissions shows a card with the date and a Turn off button, which also works from a remote studio, and a small "Dangerous mode" badge under the sidebar logo opens it. New chats still start on Workspace Write unless the workspace's default says otherwise.
  • Before an external agent such as Claude Code or Codex runs, Delorun asks you at the home's own computer, saying that it runs outside the sandbox, can reach your files and Delorun's home, and uses your own account. A phone signed in over remote access cannot answer.
  • "Allow for this workspace" on the approval card, or delorun workspace external-agents <folder> <agent> on, lets an agent start there without asking; Settings, External agents and delorun workspace external-agents <folder> <agent> off revoke it.
  • A read-only chat and a chat without a workspace folder never start an external agent, a run cannot start outside the chat's workspace, the question names the folder the agent runs in, and each run stops after 30 minutes. A full-access chat and delorun headless cannot ask, so they start an agent only where you allowed it for the workspace.
  • The model can no longer install or turn on an external-agent plugin, such as Claude Code, Codex or the ACP one, through plugin management.
  • Settings, External agents has its own switch, Ask before external agents run, on by default, and the run time limit, from 1 to 1440 minutes. Setup's prompts answer does not change either, and only the home's own computer can turn the question off.
  • A Privacy page in Settings states that Delorun has no telemetry of its own and turns DeepSeek's session-log upload and desktop analytics on, after showing what each sends and where, or off again.
  • Commands the model runs can read, and run scripts in, the approved copies of your profile's plugins, so a plugin that hands the agent the path of its own tool works. They still cannot write those copies, and they cannot read a plugin change that is waiting for your review, another profile's copies or the rest of Delorun's home.
  • With setup's Dangerous answer on, the permission new chats start in and the external-agent consent that a phone loosened are set back when the mode ends, unless you changed them at your computer since.
  • A terminal opened or attached from a phone or browser always needs that device unlocked: setup's Dangerous answer, a full-access workspace and the old Terminal from phone without unlock switch no longer waive the unlock. The switch is gone from Settings, Devices; a home that still has it set keeps working and ignores the old setting. A phone with a terminal, or prompting a chat in a full-access workspace, has the computer's authority, so treat an unlocked phone as the computer.
  • A Delorun that keeps running for weeks now deletes expired log records itself, at the first hourly check after they are 14 days old, instead of waiting for you to run a delorun command.
  • Delorun's log now removes more of what it holds: the keys it loads from the credentials file, .env files and the environment, keys you set later from the studio or a phone, the studio's signing secret, session tokens, owner codes, pairing codes and the home key. Records of a chat's turn carry its session id and turn number, so delorun logs --session and --turn find them.
  • Delorun's log labels messages from upstream and other code it does not own as captured, because they can quote your chats. Delorun's log now also removes the elevation codes you type at the computer and the keys in your .env files, and it keeps a replaced or deleted provider key hidden, since the provider still accepts it until you revoke it.
  • DeepSeek's session-log upload and DeepSeek Harness's desktop analytics are off until you turn them on.
  • The threat model, the execution-vectors page, the contracts and the package READMEs now state only the protections the code provides, and where each applies: Delorun's confinement, consents, fetch guard and privacy defaults apply to the profile that delorun and delorun start run, not to delorun headless, delorun plugin or the desktop app, and on Windows the sandbox confines writes only. Each contract page opens with what is built, and protections that are not built, such as reach, Docker workspaces, the plugin revocation list and most delorun verify checks, are described as design pages instead.
  • Fixed: A chat never turns a plugin on at any protection level: with protection off, undo and restore in the plugin manager, and a turn-on whose enabled is not the boolean false, now wait for you at the computer, as an install already did.
  • Security: Programs the agent starts no longer inherit a web address that carries a token, such as https://<token>@host or an error-reporting address with its key, or the variables that point at Kubernetes or Kerberos credentials, a MySQL password or a passphrase. An agent socket listed in PATH or a similar search list now drops only that entry, so the rest of PATH still reaches the program. An address that names only a user, such as postgres://user@db/app, is not passed on either, because a token in that place looks the same; pass such a value to the program explicitly.
  • Security: A model-authored write to a skill, a preset, or a workspace's AGENTS.md asks for an approval that names the instruction-layer effect, because these instructions load in every future chat, and shows the diff, on every permission preset including full access. It also asks for a write through a linked folder or file, through a hard link to the file itself, for a differently capitalised name on a disk that ignores letter case, and for a write to the profile and home configuration files that hold presets.
  • Security: An MCP server that would run as a local command is held until its command is accepted: the exact command with its arguments, its working folder and its environment variables, and the program and folder they lead to on this computer, with the command shell that runs a Windows .cmd file, are checked before the server starts. A command that has not been accepted keeps the server stopped and asks again; an accepted command starts that exact program without asking until any of these change, including the folder Delorun runs in, its PATH or its COMSPEC. A .env file can no longer set COMSPEC or PATHEXT. The request names the environment variables without their values. The check holds whatever order the settings list the server and the consent in, and a command accepted by an earlier build is asked about again.
  • Security: Approving a scheduled task names the recurrence it arms, the chat its deliveries reach and the permission preset that chat runs under, and a due delivery refuses, pausing the task, when that chat no longer runs the preset the task was approved under. The approval also names the task, the start of its message and the chat by its title, and for a new chat the folder it opens in and the preset that chat will really start with, such as its workspace's; the task is then held to the preset you were shown. Every occurrence is checked, a task that opens a new chat is checked before the chat exists, so a refused delivery leaves no empty chat behind, and a reminder still waiting from before a restart is checked again before it runs. When the check cannot give a clear answer, nothing is delivered: an answer it does not recognise refuses, and a check that fails keeps the task waiting and reports the failure instead of delivering.
  • Security: A .env file in a folder you work in can no longer set OPENSSL_CONF, GCONV_PATH, NODE_ICU_DATA, LD_* or the other variables Delorun's launcher removes before it starts the runtime.
  • Security: web_fetch refuses to reach loopback, link-local, private-network, carrier-grade NAT (the range a tailnet and its API use), multicast and reserved addresses, and the address that names no destination at all, before it opens a connection. An IPv6 address that reaches an IPv4 address (mapped, compatible or translated for a network without IPv4) is judged as the IPv4 address it stands for.
  • Security: Delorun's profiles turn that protection on; a stock configuration keeps its old behaviour.
  • Security: web_fetch connects only to the addresses it checked. A name that answers differently when the connection opens than when it was checked can no longer send the fetch to another address.
  • Security: A chat can no longer use the plugin manager to switch off, reconfigure or remove Delorun's consent and guard plugins, the update check or the sandbox, even under full access, so one chat cannot turn these protections off for every workspace. The Plugins page shows them as locked too; you change them by editing your profile's configuration.
  • Security: In a task run with delorun headless with changes protection on, an agent's request to install, update or remove a plugin no longer runs: it waits in delorun changes for you to apply or discard it at your computer, as in the studio. Its first write to the folder of a plugin you approved asks for your approval, which nothing in a one-shot run can give, so the write is refused.
  • Security: A task run with delorun headless now runs under Delorun's guards, as the studio does. Web fetches of private, loopback and link-local addresses are refused, and a write to a skill, a preset or an AGENTS.md, a new stdio MCP server and a scheduled follow-up are refused, because nothing in a one-shot run can answer the approval they need. The task's model cannot turn these guards off through plugin management.
  • Security: Full access in a headless task is refused unless you turned on full access for that folder, with delorun workspace full-access <folder> on or in the studio. A request for it with --permission-mode (danger-full-access or a preset of yours that selects it) or DSH_PERMISSION_MODE=danger-full-access is refused before anything starts, with a message that names the folder and the command that grants it; any other way of switching to full access during the task is refused by the same consent inside Delorun.
  • Security: DeepSeek's session-log upload is off by default in a headless task, as in the studio, and the feedback telemetry exporter is off.
  • Security: The task starts only after Delorun has checked that these protections are active. If the headless setup lost them, delorun headless stops and says how to restore them: remove profiles/headless/delorun-migrations.json or the profiles/headless folder in your Delorun home.
  • Security: Delorun refuses to use a home folder or secret file that other users on your computer could read, and prints the chmod command that fixes it.
  • Security: Spilled tool output lives in the home's own spill/ folder instead of the shared temporary folder, so the rule that keeps a confined command out of your home keeps it out of your spilled output too; the temporary folder is used only for a home that cannot hold it.
  • Security: The home's .env file is read only when it is your own file, readable by you alone, and a real file rather than a link; one that is not stops the start with the exact command that fixes it (chmod 600 <file>), as the credentials file already does, so another local user cannot choose what your sessions load.
  • Security: The anonymous id file is created readable by you alone, and the home directory the harness creates for it is private to you.
  • Security: MCP servers can no longer use a stored credential to change what a reviewed start runs. A ${credential:NAME} in a server's command, folder or a variable that changes what runs (PATH, NODE_OPTIONS, LD_PRELOAD, PYTHONPATH and the like) is refused when the server loads, and an argument that is only a credential and would start with - is refused at start. The review shows templated arguments as written, with a note that they are filled from stored credentials.
  • Security: An MCP server you allowed asks again before it starts if the program it runs, or a script file its arguments name, changed since you allowed it: Delorun remembers the contents of the program and of a file an argument names, such as the server.js of node server.js, the ./hook.js of --import=./hook.js or the file a node_modules/.bin link points to. If one of them is rewritten or a link points elsewhere, Delorun asks you again before the server starts, at startup and also when the server restarts after it stopped, and shows "A file it runs changed since you allowed it". The server starts from the file the link pointed to when it was checked, under the name you configured, so a virtual environment's python still finds its virtual environment, and the review shows that file when the command is a link. Files the program loads by itself, such as other modules of a package, and code that npx or uvx downloads are not covered, so the review also names the folder and files of the server that your chats can write to.
  • Security: The list of files a turn changed is now read without running any program that the repository's settings, attributes or hooks name, such as a file-system monitor, a filter or a hook, so a command the agent ran cannot plant one there to run later with your full access. The git commands that read it also run inside the chat's sandbox, with no more access than the agent's own commands, and a git older than 2.31 is no longer used for the list. Its working copies now live in your user cache folder, which the sandbox does not open to the agent's commands, instead of the temporary folder, and nothing is copied there while a workspace or extra folder of any chat contains it.
  • Security: The sandbox keeps confined commands from reading or writing Delorun's home and from connecting to the sockets of Delorun's own services and of Docker, where the platform enforces it. A writable workspace that contains the home is refused for commands, and the file tools refuse to read, search or write inside it. A key file there stays out of reach of a command the agent runs.
  • Security: Searching the machine with glob or grep no longer reaches Delorun's home: a search over a folder that contains it lists none of the home's files and prints none of their matched lines, so a pattern or a word that matched a key file there finds nothing. The search runs in the same sandbox as the agent's commands, so a folder the agent swaps for a link to the home while a search runs shows nothing of it either, and where the sandbox cannot run, the search fails instead of running unprotected. A session under full access still searches everywhere it reaches.
  • Security: Reading, editing, writing, creating or deleting a file with read, read_image, str_replace_editor, edit, write or apply_patch fails instead of reaching a file in Delorun's home when a folder on its path is swapped for a link to the home between the check and the change.
  • Security: Tool output too long for a chat is saved in Delorun's home, where read and grep in that chat can open it as the chat's notice says, while other chats and the commands the agent runs cannot. When the home cannot hold it, the output stays in the chat rather than going to a temporary folder those commands could read.
  • Security: The model can no longer offer you a file from Delorun's home as a deliverable: presenting a file inside the home, or through a link that leads into it, is refused before the file is looked at, as opening it already was. A session under full access can still present any file it reaches.
  • Security: The sandbox records which of these rules each platform cannot enforce: Linux cannot block socket connections, and Windows does not limit reads.
  • Security: The Linux sandbox launcher refuses a grant path that names a symbolic link in any part and does not run the command, so a path swapped for a link after it was checked cannot widen what a command may touch.
  • Security: Under WSL, a command the agent runs in the sandbox can no longer start a Windows program through WSL's interop, by its path, by name or as a copy. Where the sandbox cannot use bubblewrap, its fallback cannot block this, so it refuses to run commands under WSL rather than leave this way out open.
  • Security: Under WSL, and on any other virtual machine whose system offers it, a command the agent runs in the sandbox can no longer open the virtual-machine connection to the host, which WSL's interop runs over. The sandbox also turns off io_uring for those commands, which could open that connection another way, so a program that needs io_uring fails there. A 32-bit program that opens network connections the old way cannot open any.
  • Security: A command the agent runs in the sandbox can no longer leave it through your session's services: it cannot start a program with systemd-run --user or through the session bus, reach the system bus, a tmux or screen server or the X server, or use your gpg-agent, keyring or the ssh-agent SSH_AUTH_SOCK names, because the sandbox hides their sockets. Where the sandbox cannot use bubblewrap, its fallback cannot hide them, so it refuses to run commands on a machine that has them rather than leave this way out open. A desktop's X server and a session bus started by dbus-launch can also listen on sockets no file names, which the sandbox does not hide.
  • Security: A command the agent runs in the sandbox can no longer reach Docker Desktop's control sockets under WSL or on Linux, through which it could change Docker Desktop's settings and act on containers, or the local control socket of Tailscale.
  • Security: A read-only command the agent runs in the sandbox now sees an empty /tmp, apart from a workspace that lies in it, as a command that may write already did, so it can no longer reach the sockets other programs keep in /tmp. A glob or grep search rooted elsewhere in /tmp finds nothing. With bubblewrap, io_uring is now off for confined commands on any machine with these session services, not only under WSL.
  • Security: A plugin's key, a setting the plugin marks as secret such as the DeepSeek API key of web search, is never saved into your profile's settings files, which the profile history keeps in git: saving one from Settings or through the agent is refused with where to put it instead, and the history saves no version that holds one, while it still lists your versions and undo and restore still work.
  • Security: If a settings file already holds such a key, the next start moves it into the credentials file and points the plugin at it, telling you which file and setting changed and never showing the key; a key Delorun cannot move, because the setting has no place to name a stored key, stays and every start tells you how to move it. If an earlier Delorun already saved a key in the profile history, replace it with a new one.
  • Security: A damaged or hostile session log can no longer expand a single compressed frame without a limit; a frame that would grow past 64 MiB is reported as corrupt instead of exhausting memory.
  • Security: A session log that another process was migrating at the same time is accepted only when its contents decode to the same chat plus a valid append, not merely when its first bytes match.
  • Security: delorun setup stores the model key through a new file that only you can read and that replaces the credentials file in one step, while it holds the same lock as the studio's own writes to that file; a left-over or planted temporary file never receives the key, and an interrupted write leaves the credentials file as it was.
  • Security: A start now checks which plugin runs each protection, not only that a row with its name is on: a patch or a plugin that adds a second sandbox row or a second copy of one of Delorun's guard rows under another plugin is refused, naming the file, safe mode never skips one of them, and once the studio has started each protection's service must come from its own plugin.
  • Security: No chat turn in the studio reaches the model until the start has checked the running studio's protections; a turn sent before that waits, and is refused if the start is refused.
  • Security: A .env file in the folder you run delorun from, or in Delorun's home, can no longer set a DELORUN_ setting such as the launcher's release roots; Delorun refuses to start and names the file.
  • Security: When the release you updated to fails its start check, only delorun, delorun start and delorun recover rollback, with nothing after --, start the release before it to roll back; any other command, delorun verify and delorun stop included, is refused with what failed and delorun recover rollback as the way back, and changes nothing.
  • Security: An update checks again, right before it stops Delorun for the switch, that no other profile's Delorun or delorun headless started using your chats since it began, and stops without changing anything if one did.
  • Security: The profile names headless, data-users, node_modules and desktop, and the Windows device names such as con and nul, are reserved: delorun, delorun plugin, delorun logs, the launcher and setup refuse them and say why, and delorun plugin and delorun logs refuse a command line that names two different profiles.
  • Security: A Delorun running in another container or sandbox that shares your home now counts as running, so its home lock is never taken over as if it had stopped.
  • Security: Delorun checks every start against the protections it promises before anything runs, and again once the studio has started: the sandbox protects Delorun's home, Delorun's consent and guard plugins are on, and your prompts answer is the one setup recorded. A patch, your home's own cordis.patch.yml included, that turns one of them off or points the sandbox at its own runner stops the start with the file to fix, or delorun recover safe-mode to start without your plugins.
  • Security: delorun headless now runs its task under the same sandbox protection of Delorun's home as the studio, and refuses --profile, --patch and --from-default-profile.
  • Security: delorun refuses to start when your command-line profile cannot load Delorun's own bundle, and prints how to fix it, instead of starting with DeepSeek Harness's defaults, which upload session logs to DeepSeek.
  • Security: delorun stops and tells you how to fix it when one of Delorun's own plugins, such as the Privacy section in Settings, fails to load, instead of running without it.
  • Security: delorun stop --now now ends a Delorun that does not answer or does not exit, with SIGTERM and then SIGKILL, but only after it confirms the process is the one holding the profile's lock; a process it cannot confirm is never signalled, and the command says which process to check. On Windows it never signals.
  • Security: A start that Delorun refuses after the studio has booted now stops that studio itself and always reports why with a non-zero exit, instead of letting the process end early, sometimes with code 0, before the refusal and the recovery of an interrupted update had run.
  • Security: Refusals and unexpected failures are printed in the same what, why and what-you-can-do form with secrets such as API keys redacted, and an unexpected failure's full detail goes to the home process's log instead of a stack trace on the terminal.
  • Security: delorun recover rollback with no Delorun running now counts as the only user of your chats while it runs, so another profile's Delorun cannot start in the middle of it; delorun plugin now counts as a user of your chats while it runs.
  • Security: The record of Delorun's one-time profile changes now lives with the profile, and an unreadable record makes Delorun skip the changes and say so, so a change you undid is not made again.
  • Security: A link that signs you in to the studio now works once and only for one minute, so a copy of it left in your terminal's scrollback, your shell history, your browser history or another program's command line can no longer be used to sign in after you have opened it. Run delorun open to open the studio in your browser at any time; delorun open --print prints a fresh link instead, for a computer without a browser or one you reach through an SSH port forward, and --port makes it for a forwarded port other than the studio's own. A link works only at the address it names, and opened at another address it says which one it was made for. Starting Delorun prints the studio's address without a link, and an old link tells you to run delorun open.
  • Security: With the fetch protection on, web_fetch judges an address written into the URL as an IPv6 literal, such as http://[2001:db8::1]/, like any other address: a public one is fetched, and a loopback or link-local one, such as http://[::1]/ or http://[fe80::1]/, is refused. Every IPv6 literal had been refused, public ones included.
  • Security: Your home folder itself, a filesystem root, the Delorun home, DeepSeek Harness's ~/.dsh home and any folder that contains one of them cannot be a workspace. The guide's folder chooser and the workspaces plugin refuse them and say why and what to choose instead.
  • Security: Each workspace has a network setting for the commands the model runs in the sandbox: open, as before and by default; allowlist, where commands reach only the hosts you list, through an egress proxy that never looks up an unlisted name and refuses a listed name that points at a private, loopback or link-local address; or off, with no network at all. web_fetch follows the same setting. Choose it in Settings, Network, at the computer that runs Delorun; a change that lets commands reach more asks you to confirm it.
  • Security: An allowlist entry allows ports 80 and 443; write host:port, such as github.com:22, to allow another port. Under allowlist and off, commands also cannot reach the services that look names up or send traffic for them: systemd-resolved, nscd, avahi, the system D-Bus, snapd, CUPS and Tailscale's daemon. Other sockets stay reachable, such as an ssh connection you keep open or gpg's dirmngr under your home folder.
  • Security: The setting holds on Linux with bubblewrap, WSL2 included. Where the sandbox cannot enforce it (Landlock alone, or any platform other than Linux), a workspace set to allowlist or off runs no commands instead of running them with your network.
  • Security: A new guide page, "Prompt injection and data exfiltration", explains what each setting closes and what stays open whatever you choose: commands under full access, plugins and MCP servers, plugins the model writes, web_search, images and links in replies, files you share later, and a command that reaches a program outside the sandbox through a socket the sandbox does not hide, such as one in your home folder.
  • Removed: Feedback no longer goes to DeepSeek. Delorun's studio hides the feedback buttons and the /feedback command, and it sends no session-log prefix to DeepSeek's feedback collector.

Reach

  • Remote access: delorun reach on tailscale lets you open the studio from your phone or another device over your own Tailscale tailnet, at https://<computer>.<tailnet>.ts.net. It is off until you turn it on, also from the remote access section of delorun setup's Full mode, and delorun reach off turns it off. delorun reach status shows whether it is on and ready.
  • A device can open your chats only after you approve it at your computer: run delorun devices approve or choose Add a device in Settings → Devices, then type the 8-digit code the device shows. The device's sign-in page walks you through these steps in English or Chinese, light or dark, shows the code large with the time left, and says what to do next when approval is closed, the code expired or was cancelled, too many devices are waiting, the computer can't be reached, or the browser can't keep a sign-in key. delorun devices list lists approved devices, and delorun devices remove or Remove in Settings → Devices signs a device out at once.
  • An approved phone can do what you do at your computer with your chats and workspaces: read and reply to chats, start one in a workspace you have with any of your presets, read the files of its own workspace and its changes, see which plugins are installed, rename, pin, archive and reorder chats and workspaces, move a workspace to the trash, set goals, schedule follow-ups, choose the model, answer ordinary prompts and stop a run. A preset you choose on the phone decides the tools a chat runs with but grants no access by itself: a workspace's full access and every approval prompt are still answered at the computer. Credentials, your account, granting full access, and devices and remote access always stay at your computer. A remote session ends after 12 hours in which the phone sent nothing and 14 days after sign-in, and its open connections close then.
  • A few sensitive actions on a phone need a short unlock you approve at your computer: changing settings, running the slash commands that change only the chat (/compact, /export, /goal, /permission and /plan), installing or changing plugins other than Delorun's own guards, opening a terminal, starting a chat in a folder that is not one of your workspaces and adding a workspace. The phone says the action needs a quick unlock and shows an 8-digit code; type it in Settings → Devices on your computer or with delorun devices elevate. While unlocked the phone shows until when, with Lock now; an unlock lasts 15 minutes, never extends, and ends early when you lock it on either side or the phone's session ends. Even unlocked, a phone cannot loosen the permission new chats start in, for example toward full access; it can still make it stricter.
  • delorun reach on tailscale refuses while Tailscale Funnel is on for the address, and Delorun stops serving if Funnel is turned on later.
  • A phone signed in to Tailscale as the same user as your computer can now ask to pair without an approval window. The studio at your computer shows the request with Enter code and Decline; you type the 8-digit code the phone shows, as before, and the code is still required. delorun setup reach lets any device on your tailnet ask instead, and delorun reach status says who may ask. The pairing settings in the @delorun/home-auth row also set how the request is shown, the approval window and request lifetimes, and how many requests one Tailscale user may have waiting. Settings → Devices shows and changes these choices at your computer.
  • Turning remote access on or off applies to the Delorun that is running, which says whether the address is ready instead of asking you to restart; delorun reach status shows the live state.
  • delorun reach on checks that your Tailscale user may serve before it turns anything on, and names the one command to run when it may not.
  • delorun start --background starts Delorun detached from the terminal whatever setup answered, and a start that stays in the terminal says how to run it in the background next time.
  • delorun reach on tailscale asks "This changes Tailscale on this computer … Continue? (y/N)" in a terminal before it changes anything. --yes skips the question. Without a terminal and without --yes it changes nothing and says to add --yes.
  • Opening your remote address, or a page of it, on a device that is not signed in takes you to the sign-in page instead of showing an error, and back to that page once you sign in.
  • Security: A device reads only the files whose real location lies inside its chat's workspace: a link inside the workspace that leads elsewhere, and Delorun's own folder, are refused.

Plugins

  • A plugin you link from a folder runs from a copy of its content kept in the Delorun home. With protection on, edits in the folder wait for your review and break nothing that is running; with protection off, the default, they load without review and are recorded. Plugins linked before this release are approved as they are at the first start, which says so once.
  • Changes protection is off by default, so you change your harness freely: a plugin you link from a folder loads your saved edits at each start and, while Delorun runs, each time you save a file in its folder, without a work session. Each load is recorded as a change that loaded without review, which delorun changes list shows and delorun changes undo takes back, and content you undid does not load again until you save something else. A saved version that fails to load goes back to what ran before and is not tried again until you save again. delorun changes protection on makes changes wait for your review instead, and takes effect without a restart.
  • A composition can forbid embedded code in its own patch files: with refuseCode on, loading refuses !!js expressions and patch insert rows and fails with an error naming the file and where the code sits. The switch is off, which changes nothing.
  • Settings, Plugins has Create a plugin: name a plugin, choose what it adds and a workspace, and Delorun writes the starting files into the workspace's plugins folder, the same files delorun plugin new writes. Turn on lists the plugin in Changes for your review at the computer, also in dangerous mode; a phone or another device is told to do this at your computer.
  • Ask the agent in a chat for a plugin and it makes one in the chat's workspace, under plugins/<name>, with the new delorun-plugin-authoring skill. It cannot turn the plugin on, at any protection level and in any chat access; that stays your step at the computer. Once the plugin is on, later edits to its files wait for your review when changes protection is on, and reload live, logged as loaded without review, when it is off, the default.
  • The review of a plugin change warns when the plugin answers approval prompts itself, which can give grants you keep to your computer, and when it installs, removes, updates or loads plugins itself, outside the install check. Both are warnings to read, not blocks.
  • Fixed: The Changes and instruction-consent plugins load when Delorun runs its TypeScript sources directly; they failed to import and left the studio without Changes.
  • Security: Installing a plugin checks it and every package it brings before any of its files are fetched or any install script runs: a package without an integrity hash, a git source not pinned to a full commit, a registry or download URL that is plain http, a known GitHub advisory, a version published in the last 24 hours and a name close to one you already have are each shown where you install it, on the Plugins page and in delorun plugin's output. A known critical advisory stops the installation until you choose to install it anyway, with "Install anyway" or --allow-advisory <id>; everything else only warns. When the advisory or publish-time lookup cannot run, you are told so. Scopes and git owners you trust can be listed so their plugins show only critical advisories; linked and local plugin folders are not checked.
  • Security: Delorun records every file of each plugin it installs, checks them at every start and fully in delorun verify, and warns when a plugin changed since it was installed. Installed plugins get their own copies of their files, so an edit to pnpm's shared store no longer reaches them.
  • Security: Plugins no longer fall back to the npmmirror registry unless you turn it on, in Settings → Privacy or with delorun plugin mirror on, and a package installed under the name of one of Delorun's own components cannot stand in for it.

Commands

  • delorun changes lists the changes to your plugins, those that loaded without review and those that wait for your review, and shows each with its files, a diff and a summary of what it can do. apply, discard and undo decide about one change after you confirm in a terminal, with a second confirmation when the change runs commands, opens network connections or does anything else the summary names. A running Delorun loads an applied change at once and goes back to what ran before when it fails to load. off and on turn one plugin off and on again, and protection on makes changes wait for your review, which protection off, the default, ends; each says what it means, asks, and applies without a restart. work <plugin> [--for <minutes>] loads every edit you save in a plugin's folder live for up to two hours, or the minutes you give up to eight hours, going back to the last version that loaded when an edit fails to load. done <plugin> shows the folder's version with its files and diff and approves exactly that version as one change; a session that ends without you, when Delorun stops or its time is up, approves nothing and leaves the folder's content waiting for your review. delorun status names an open work session and when it ends. With protection on, a plugin you link with delorun plugin --profile default add link:<folder>, or bring back with a restore or undo, loads nothing from its folder until you apply its content, also while Delorun runs; the approved copy includes the plugin's installed packages; and a plugin folder Delorun cannot read no longer stops Delorun from starting. When Delorun fails to start right after you applied a change to a plugin or turned one on, it starts once more without that change, names it with delorun changes apply <id> and undo <id> at every start, in delorun changes list and in delorun doctor, and rewrites none of your files; when it fails again it points to delorun recover safe-mode.
  • Every delorun command answers --help (and -h, and delorun help <command>) with a short usage, its options and its exit codes, and exits 0 without starting anything. A wrong option now says which option and points to delorun <command> --help, and delorun help ends with a short list of the words the commands use: home, profile, studio, workspace, full access and reach.
  • delorun start starts Delorun in the background, so you can close the terminal, and waits until it is running; delorun start --foreground runs it in your terminal. delorun start --patch <file> applies a patch file over your profile for that start only, as dsh --patch does, and Delorun's own checks still apply to it; --inspect lets a debugger attach to Delorun while you work on a plugin, after you confirm, since any process on the computer, the agent's sandboxed commands included, can then run code as Delorun; --inspect --yes confirms without a terminal, safe mode refuses it, and delorun status shows it while it is open. delorun on its own does the same and opens the studio, then prints the studio's address and how to see, follow and stop Delorun; if you chose during setup not to run Delorun in the background, or pass --foreground, it runs in your terminal.
  • delorun stop stops Delorun once running chats end, or at once with --now.
  • delorun status shows the home and profile in use, whether Delorun is running, its process, runtime version and running chats, or prints them as JSON with --json.
  • delorun plugin and delorun headless work as their dsh counterparts do, inside your Delorun home; an installed Delorun runs plugin operations with the pnpm it carries, so you do not need pnpm on your computer. delorun plugin works on your Delorun profile without --profile. When pnpm refuses to run a package's build, as it does for a plugin installed from git, delorun plugin asks whether to allow that one package's build and tries again; --allow-build <name> allows it without asking, and nothing allows every build at once.
  • When a delorun command or the launcher stops on a failure, it says what Delorun did, why, with the error's code and the file or detail concerned, and what you can do next, naming your --profile; it never prints a stack trace.
  • delorun workspace full-access <folder> on turns on full access for a folder after showing what it means and asking you to confirm at a terminal; off turns it off, and without a folder the command lists the folders with full access. Every running studio counts the change within a second, whichever profile it runs, and after off the command names the profiles where Delorun runs; a change made at the same moment by a studio is never lost. delorun headless in that folder can then run with full access.
  • delorun mcp list shows the local MCP servers Delorun is holding, what changed since you allowed each (a new server; its command, arguments, working directory or environment variables changed, naming the variables that changed; its command or folder now points to a different file or folder on this computer; the acceptance list could not be read; or, for a server you allowed before Delorun remembered each server separately, a one-time review) the exact file that runs and the folder it runs in (on Windows also the command shell that runs a .cmd or .bat file), and why it waits, and whether you declined or revoked it, then the servers you allowed and when you allowed each. Each server is allowed on its own, so two servers started with npx never share an answer. Values of environment variables stay hidden, except for the ones that change what runs, such as PATH and NODE_OPTIONS. delorun mcp accept <server> shows the server's command and starts it after you confirm at a terminal, and delorun mcp decline <server> keeps it stopped until its command or settings change.
  • delorun mcp revoke <server> shows an allowed server, and after you confirm at a terminal withdraws it and stops it; it stays stopped until its command or settings change or you accept it again, and your other servers stay allowed.
  • delorun doctor checks Docker, the format of the key of the provider new chats start on, the Delorun home's permissions and whether the studio's port is free, and says whether the running release was checked against the release log: verified, refused, or unchecked with how long it has been and why, and what the last check for a newer release found. It sends nothing to the provider and starts no container.
  • delorun doctor checks the port the profile's studio uses, and a port held by this home's own Delorun is reported as in use by Delorun, not as a failure.
  • On Linux, delorun doctor checks whether bubblewrap can sandbox commands. Where it cannot, every sandboxed command is refused on a machine with a login session; the line says why, and where Ubuntu's AppArmor restriction on user namespaces blocks it, points to how to allow bubblewrap alone.
  • delorun doctor accepts a studio port of 0, which asks the system for a free port at each start, and prints no YAML warning for a profile that holds a !!js expression.
  • delorun doctor checks Docker, the DeepSeek API key's format, the Delorun home's permissions and whether the studio's port is free, and says whether the running release was checked against the release log: verified, refused, or unchecked with how long it has been and why, and what the last check for a newer release found. It sends nothing to DeepSeek and starts no container.
  • delorun doctor checks your plugins: it lists what is installed in your profile, where each plugin came from and whether it is turned on, and warns or fails when a plugin needs another Delorun or DeepSeek Harness version, is hidden by a plugin Delorun ships under the same name, is turned on but not installed, did not load at the last start, or is left out because Delorun is in safe mode. It reads files only and runs no plugin code.
  • Delorun's own processes keep operational logs at fixed locations under your Delorun home. Every record is redacted before it is written, so keys, tokens and cookie values Delorun loads never reach a log; logs rotate at 10 MiB, keep 5 files, and are deleted 14 days after they were written while Delorun runs. Your chats' session logs are not touched.
  • delorun logs lists every log's location and shows a log's recent records, filtered by chat, turn or age, follows new records, prints the stored JSON, and clears or prunes logs on request.
  • delorun plugin asks before it runs a build pnpm refused, such as the prepare script of a plugin installed from git, or takes --allow-build <name> for one package. The question starts on no, and nothing allows every build. With Delorun's install check on, only the installation runs again, on the lockfile the check read; a lockfile that differs from it is refused and the profile put back.
  • delorun plugin dev <folder> links a plugin you are writing into your profile and keeps the running studio loading its latest code each time you save, building it first when it has a build script, until you press Ctrl+C; the plugin stays installed afterwards.
  • delorun plugin new <name> creates a plugin folder that builds and installs on the running release: a tool for the agent, an agent preset, a page in the studio's Settings, or a bundle that changes other plugins' settings, chosen with --kind. It prints the next commands: build the plugin, check it with delorun plugin check, and add it to your profile.
  • delorun recover shows where your profile stands and offers the way back: roll back to the last saved snapshot of the profile, or restore any earlier saved version. Both list the plugins, build approvals and version exemptions they bring back before anything is written, and a plugin version that has been revoked comes back turned off, with the reason shown.
  • delorun recover --safe-mode makes the next start leave out the third-party bundles and the rows that load them, so a plugin that cannot start no longer keeps the home from opening. The profile itself is untouched, with every row, setting and ejected plugin still there, and delorun recover --exit-safe-mode loads all of it again.
  • A restore or a rollback keeps Delorun's own records in the profile, its version exemptions, its safety record and the last update report, when the saved version does not hold them, instead of removing them. It waits for the plugin manager while that is changing the profile, and refuses with nothing changed if the manager does not finish within two minutes.
  • Under WSL, delorun open and delorun start --open hand the studio's link to the browser BROWSER names when it is set, and to the Windows default browser only when it is not; delorun open --print prints the link and opens nothing.
  • delorun verify lists what this Delorun runs: the release's version, commit and digests, the trusted root and its key, the launcher that started it, when every runtime file was last hashed and what the start check did, the plugins with where each came from, your changes, the rows your patch layers add with their !!js count, the skill folders including ~/.agents, and the MCP servers. --json carries the same list under bill. A part Delorun cannot check yet says so instead of reading as a pass.
  • The messages delorun setup prints, the studio's starter prompts and the chat refusals use British English, such as "catalogue", "summarise" and "organise", and a check keeps American spellings out of Delorun's own text.
  • Command output says "Delorun", not "Delorun", in sentences and drops internal labels: delorun logs heads its list "Logs under …" and no longer lists a relay you may not run, delorun verify lists the checks it runs and says in one line how many more Delorun does not include, and delorun reach status says whether remote access is on or off and how to turn it on.
  • delorun status prints whether Delorun is running, the studio address, the version and the running chats. The process id, the start id, the home folder and the profile appear with --verbose, and --json still carries them.
  • delorun start that fails says "Delorun did not start", points to delorun logs and delorun doctor, and when another program holds the studio's port it says so and offers delorun setup profile or port 0. delorun import-home without a DeepSeek Harness folder says there is none and offers --from. delorun workspace with no action says to choose full-access or external-agents.
  • delorun devices approve and delorun devices elevate stop at once, with a message, when they have no terminal to type the code in, instead of waiting for five minutes.
  • delorun --version prints "Delorun" on its first line, and delorun setup and the default workspace's message name Delorun too.
  • delorun plugin list on a new profile says "No plugins added to the profile default." instead of printing nothing, delorun plugin on a profile that does not exist yet says "delorun: initialized profile …" where it said "dsh: …", and delorun plugin with no arguments shows Delorun's usage, not pnpm's message. Its other lines also say "delorun:" where they said "dsh:": warnings, the failed-command line and the rejected-installation lines, and the hints name delorun plugin allow-version, the command that grants the exemption. <!-- us-spelling: quoted output -->
  • delorun open --print and other output piped into a reader that stops early, such as head -1, ends quietly with exit 0 instead of reporting "write EPIPE".
  • Each delorun command now loads only the code it needs, so delorun --version and delorun --help answer in a fraction of the time they took, and status, logs, trash and the other short commands start sooner too. What the commands print and the exit codes are the same.
  • delorun recover takes its action as a word: status, rollback, restore <version>, safe-mode and exit-safe-mode replace --rollback, --restore, --safe-mode and --exit-safe-mode.
  • delorun stop and updates now wait for chats that are still answering.
  • Every delorun command starts about 9 seconds sooner: on a full-size runtime the launcher's check takes under a second instead of about ten, because it compares each file with what it recorded after the file was last hashed, and hashes only the files that changed since. It still hashes every file at install, on delorun verify, and at least every 7 days; DELORUN_RUNTIME_FULL_CHECK_DAYS sets that interval from 0, every start, to 30 days. Disk corruption that leaves a file's metadata alone is found by that full check, not by the next start. On macOS, Windows, overlay file systems such as a container's, and network or other file systems whose timestamps the computer does not set itself, every start still hashes every file.
  • An update no longer reads every file of a runtime again: it hashes the new release's files as it writes them, and checks the running release before it starts and the new one before and after the switch the way every start does, so an update takes about 30 seconds less on a full-size runtime. An install no longer reads every file it has just written again.
  • delorun headless without the API key its model needs (DeepSeek's unless the profile selects another provider) stops at once and says which variable to set or run delorun setup key, instead of linking the profile first and ending in a provider error. Its progress line goes to standard error, so standard output holds only the answer, and delorun headless --help no longer touches the profile.
  • A chat turn that starts before Delorun's start check has finished no longer waits without a message: after 60 seconds the turn ends and says that the start check did not finish, that the message was not sent, and to start Delorun with delorun start and send it again; delorun status and delorun logs show what the start is doing. This only happens when Delorun was booted without delorun's own start, or when the start's check never completes.
  • delorun verify lists the plugin changes you approved, by name and folder, then apart from them the changes that loaded without review, with protection off or while it was off, then everything present that you did not approve: changes waiting for your review and anything Changes does not find as it keeps it. Its summary line then never reads as a plain pass, and it exits 1 only when something is not as Changes keeps it. A run from a source checkout or a development build says there is no signed release to compare its files with.
  • delorun doctor reports your changes: the protection setting, any plugin you are working on, and for each plugin you link from a folder whether it loaded at the last start, whether it runs the content you approved or content that loaded without review, the dsh and Delorun versions it requires and whether it changes a consent, a guard or the sandbox policy. When a plugin did not load or the start failed, it names the plugin and the change to undo.
  • Fixed: A write lock left behind by a process that was killed while taking over a dead writer's lock no longer blocks later writers: the leftover claim is removed after ten seconds.
  • Fixed: delorun update names why an automatic rollback did not finish. It blames the missing chat-data copy only when that is the reason, and otherwise says that going back stopped and where to look.
  • Security: The release an update starts no longer inherits variables that load code into Node, its loader or OpenSSL, such as NODE_OPTIONS or LD_PRELOAD, even when a .env file set them for the running release; the launcher already dropped them from every start.
  • Security: delorun verify hashes every runtime file before its own code runs, whatever the start check's record says, and then checks every file again. The record has no key, so a program running as you can rewrite it to hide a changed file, the runtime's Node and delorun itself included, from ordinary starts until the next full check, which comes at least every 7 days; delorun verify still finds it.

Compatibility

  • Delorun's own changes are carried onto a newer DeepSeek Harness release by a maintainer command, which stops with a report of what no longer applies instead of dropping a change.
  • Delorun records a checksum for each DeepSeek Harness file it edits, so the command notices when one of those files changed underneath it and refuses to carry a change that was edited after it was recorded.
  • delorun --version prints which Delorun this is and which DeepSeek Harness it runs on, one line each, and --json prints the same two as one line for scripts.
  • A plugin can say which Delorun versions it works with, and Delorun honours it: a plugin that asks for a newer Delorun than the one you run is refused at install and disabled at start, and the message tells you which Delorun you have and which DeepSeek Harness it runs on. A plugin that asks for nothing behaves exactly as before.
  • Settings names Delorun's version and, beneath it, the DeepSeek Harness version it runs on.
  • delorun plugin check <folder> tells a plugin author, without running the plugin, what its declared DeepSeek Harness and Delorun versions allow on the Delorun you run, what it leaves undeclared, and which Delorun range to declare to target this release; Delorun's documentation states what each Delorun version promises a plugin.
  • A script that changes something through a Host's HTTP API over plain HTTP at an address other than this computer's, such as a name in trustedHosts or the address the Host listens on, must send an Origin header naming that address, such as Origin: http://192.0.2.5:3080; without one the Host answers "forbidden", because a web page could send the same request. Requests on this computer, over HTTPS and from the studio itself are unaffected.
  • The Host answers "bad request" to a request with more than one Host header, on every address it serves, and holds a request for a path such as /x/../api/... to the same rules as one for /api/....
  • Fixed: A script, or the desktop app's own requests, that talks to a Delorun Host on the same computer with the Host's cookie is accepted again; the Host had answered "forbidden" to any request that changes something and states no origin. A request from a web page on another site or another local port is still refused.

0.1.0-rc.1 (2026-11-14)

Install and update

  • delorun changes edit-harness makes your own copy of the installed Delorun's program files and prints its folder. Each file you save, add or delete there is a change to Delorun itself, listed in delorun changes list. With protection off, the default, the next delorun start applies it without review, says so, and undo takes it back; with protection on it waits for your review, and show, apply, discard and undo decide it as they decide a plugin's change, at a terminal. An applied change runs from Delorun's next start, beside the installed release, which is never edited and is checked at every start as before; delorun changes edit-harness --discard takes every change to Delorun itself back, even from a copy Delorun can no longer read, and the next start runs the installed release unchanged. A release too large for Delorun to read your copy of is refused before anything is copied. When Delorun fails to start right after such a change, including when a changed file stops Delorun before it starts, it starts once more without it and names it; when it does not start without it either, it names delorun changes undo <id> and delorun changes edit-harness --discard. Safe mode runs the installed release without any of your changes to it. delorun verify and delorun doctor list the files you changed and never report a pass when the files Delorun would run with your changes differ from what you applied.
  • Installing Delorun with npx delorun downloads the release it publishes, checks every file against the signed manifest and the public release log, and refuses to install anything that does not match. The runtime it installs is kept and reused, so starting Delorun again needs no network.
  • --release is refused, with both versions named, when a runtime is already installed, instead of being ignored. -- ends the launcher's own options, so the runtime keeps its own --release and --profile.
  • An install whose download fills the disk stops with the launcher's own message instead of a raw file-system error.
  • Installing Delorun with npx delorun now prints one line for each step it takes: which release it found, that the signature checked out, whether the public release log agreed, the size of the download, and the install itself. If the release log or its witness cannot be reached, has not cosigned the log's latest checkpoint, or only cosigned it long ago, the install says why, warns that the release has not been checked against the log, goes on with the release's signature, and checks again at the next connection. A log or witness that answers and disagrees with the release, or whose cosignature does not verify, still stops the install.
  • Running npx delorun on a Node older than the one Delorun needs now stops at once with one line that names the version Delorun needs and where to get it, instead of failing with an error from inside the program.
  • When the installed Delorun fails its start check because its files changed, the launcher says so in one line and, if the version before your last update is still installed and intact, starts that version's delorun recover rollback to take you back; otherwise it stops with the reason as before.
  • Unpacking the runtime writes several files at once while it reads the archive, so installing or updating Delorun spends about half as long unpacking: about 9 seconds instead of 18 for a full-size runtime on a busy computer.
  • Delorun 0.1.0 runs on Linux (x64 and arm64) and on Windows through WSL2. A release publishes runtimes for Linux x64 and Linux arm64 only. Running npx delorun or delorun update on native Windows stops before downloading anything and says Delorun 0.1.0 runs in WSL2, with a link to the guide's WSL2 steps. On a Mac it stops the same way and says macOS joins in a later release. A computer whose platform a release does not list still stops with PLATFORM_NOT_RELEASED.
  • delorun verify checks the installed release: its files against the signed manifest, the manifest's signature and timestamp, and the release's entry in the public transparency log, in a tree the log and a witness both signed. It trusts only the release root the launcher shipped and the roots an install walked from it, prints one line per check with a summary that says it is not a full verification of Delorun, and exits 1 when a check fails or the release signature could not be confirmed for a reason other than an unreachable log. It also names the directory of the launcher's roots it trusted and the release channel and log the installing launcher recorded. --json prints the same report for a machine, and --offline skips the log.
  • The installer, the launcher's start and delorun verify run one release-log check and keep one record of the newest log checkpoint they verified. A log that cannot be reached, answers with an error or is not signed by the log's key leaves the release unchecked and never stops a start; a log that is signed and then contradicts an earlier checkpoint, serves a broken proof or carries an invalid witness signature stops the start and names delorun verify. The check gives up after 90 seconds, and a running Delorun retries an unchecked release every 15 minutes.
  • A checkpoint stored by an earlier install is kept as the rollback floor only when the log proves it a prefix of its latest checkpoint; otherwise it is replaced, and the check says so instead of resetting the floor silently. delorun verify says since when a release has stayed unchecked.
  • npx delorun@latest repair replaces a program that will not start with a verified release and keeps your chats, settings, keys, devices and trust records. It asks you first in a terminal, refuses while Delorun runs, refuses to put an older release over chats a newer release wrote, and keeps the old program in runtimes.set-aside-<time>/, which delorun recover status lists. --restore-copy, --from and --reset-trust cover the harder cases. Each start now records which release wrote your data in data-format.json.
  • delorun update lists each change you made to Delorun itself and says whether it carries over to the new release. A change carries as it is when the new release left that file alone. When the new release changed the file without touching your lines, the two merge into a file neither had: delorun update prints its diff against the new release's file, and only you confirm it, not --yes. When the two overlap, the new release's file runs and yours is kept beside it as <file>.mine in your copy of the new release, and --yes does not confirm such an update either. An update refuses while changes to Delorun itself wait for your review, or when your copy of Delorun cannot be read, naming delorun changes edit-harness --discard and delorun changes list; it refuses before switching when what it would do with your changes no longer matches the report you confirmed, and asks you to run delorun update again. Going back to the previous release runs your changes to it again.
  • delorun update --from <folder or https address> installs a release from files you downloaded from its release page when the release channel cannot be reached. It checks signatures, the release log and digests like a channel update. If the channel cannot confirm the release is current, it asks first in a terminal; --yes and a missing terminal refuse. A release below the one you run is refused. npx delorun@latest repair --release <older> --from <folder> asks in the same way. A repair now marks the whole home while it runs, so no Delorun starts meanwhile, not even for a new profile, and cannot run the program being set aside. A start during a repair says "Delorun is being repaired; wait for it to finish".
  • Delorun tells you when a newer release exists: once a day, and at start when a day has passed, it checks your release channel's signed files and, when a newer release is out, prints one line in the terminal and shows a quiet notice in the studio's sidebar with the new version, whether it is a security fix, how many of your plugins it would turn off, and the command to run. Nothing is downloaded or installed until you run delorun update, and you can dismiss the notice for that version.
  • The check sends nothing about you or your plugins; the release hosts see your computer's address. Setup asks whether to check for new releases under More settings, and delorun setup privacy, --no-update-check and an answers document's updateCheck turn it off; turned off in setup, it makes no request at all, not even at the first start. Turn it off later in Settings → General → Updates, and run it yourself any time with delorun update --check. delorun update --report shows everything an update would change, plugin by plugin, without applying it.
  • delorun update fetches the newest release on your channel, checks it, shows what it would change in your profile before anything changes, and applies it once you confirm. Running chats finish first, and an update whose new version fails its health check goes back on its own and names the check it failed; a plugin the report disables does not count as a failure when its rows are gone, and neither does a Docker socket that appeared, or a Docker context you switched, since Delorun started; a new version whose sandbox would protect less than the one it replaces goes back too. Updates come from the channel the launcher that installed Delorun was built for; no environment variable or setting moves it. Delorun keeps your profile's history with git, so an update and a rollback say so and stop before they fetch or change anything when git is not installed. A release that does not verify, a release channel that cannot be reached, or an update the home process could not finish, ends with a sentence that says what happened and what you can do.
  • While an update or delorun stop waits for running chats to finish, a new message starts no turn: the chat shows that Delorun is updating and that the message was not sent, so you send it again once Delorun is back, and the wait ends once the running chats end. Background jobs count as running chats, and stopping with --now cancels them too.
  • Before an update applies, Delorun works out what the new release would change in the person's profile: each plugin it would disable or remove and why, judged exactly as Delorun judges a plugin when it installs or starts one, so a plugin that names its DeepSeek Harness versions only through its peer dependencies is not shown as kept when the next start would turn it off, each bundle that leaves the bundle list or cannot load, and each row and Include that loads a plugin the update disables. The report marks every prediction it could not fully make from metadata it could read, so those are never counted as safe, and it shows both the CLI home's and the desktop Host's versions and update states, because the two update independently. Nothing applies until the person confirms, and delorun update --yes will not confirm a report that disables or removes anything or rests on metadata Delorun could not read.
  • When an update changes the format of your chat data, the report says so and Delorun copies your chats and workspaces first, unless you choose to continue without the copy. Going back restores that copy and keeps the chats written since in a set-aside folder; nothing is deleted.
  • delorun recover status says whether your last update committed, was rolled back or has not committed, lists the update you can go back from and every kept copy and set-aside folder with its size, delorun recover rollback goes back, --profile-only restores only your profile, and delorun recover discard removes a kept folder you no longer need. Delorun's home log records each step of a rollback as it records an update's, so delorun logs home shows where a slow rollback spent its time.
  • An update or a rollback checks every release against the release roots of the launcher that started Delorun, so a root file replaced under the home is not trusted; a Delorun started without its launcher refuses to update or roll back and says to start it with the launcher. A studio that takes long to shut down for an update is waited for instead of ending Delorun in the middle of the switch, and one that does not shut down ends the update with nothing changed and Delorun running again.
  • Contributors can measure where a person waits on Delorun with pnpm run benchmark:delorun: install and setup, start and stop, the everyday commands, delorun update, update --check and rollbacks step by step, recovery, export, import and the trash, plugins, a chat turn without a model, and the studio in a headless browser, all on local releases in throwaway homes with no network, with a mode that fails when a step exceeds its recorded ceiling.
  • The studio's update card has a What's new button that opens the release's notes. The notes show only after their length and SHA-256 match the signed release manifest and their text passes the same plain-text checks as the release summary.
  • delorun update --report and delorun update show, under a plugin the update turns off because its DeepSeek Harness version range excludes the new release, the command that accepts the risk for that exact version and say that the health check after the switch rolls the update back if the plugin then fails to load. A new guide page, "Update Delorun with many plugins", walks through saving, checking, updating and going back.
  • Fixed: delorun recover discard runtimes.set-aside-<time> removes the program store that delorun repair set aside. It stopped with a permission error because the installed program's folders are read-only.
  • Fixed: delorun repair refuses to start an older program over chats when the home records which release wrote them and the release's data formats cannot be compared (DATA_UNREADABLE), and --restore-copy refuses a copy whose formats are newer than the release reads (DATA_COPY_NEWER). A restored copy's facts become the home's data-format record. A release signed by a local release build is refused from a --from folder as well when the launcher trusts the production keys, and repair reads the floor from the channel the home installed from.
  • Fixed: When a repair was killed during its download, the next start or repair names the set-aside program store (runtimes.set-aside-*) and prints the command that puts the old programs back.
  • Fixed: delorun update --from with a folder that does not exist now says the folder does not exist and that nothing was installed, instead of reporting a failed download.
  • Fixed: An update that fails its health check rolls back on its own even when the new release was stopped while it wrote a profile lock file.
  • Security: Starting an installed runtime does not trust a release root merely because a file under ~/.delorun/trust/ names a newer version: the launcher keeps the root chain the install walked, checks that it leads from a root the launcher carries, and otherwise stops and offers a reinstall. It starts a runtime only when the release root the home stored is one the launcher ships.
  • Security: An installed runtime is made read-only before its files are hashed, so nothing can change a file between its check and the mode that protects it.
  • Security: The runtime starts without the NODE_OPTIONS, NODE_PATH, LD_*, DYLD_*, NODE_EXTRA_CA_CERTS and NODE_TLS_REJECT_UNAUTHORIZED variables that the shell passed in, so the shell that started delorun cannot stand between the runtime and the connections it verifies. A profile name that would leave the Delorun home is refused before anything is read.
  • Security: The release-log check accepts every consistency proof the log serves and refuses only one that does not reproduce both tree roots. It also refuses a bundle that names a different manifest file than the release's own, a release version that is not a version, and a checkpoint that no listed witness has signed, even when the trusted root carries no witness requirement of its own. A log entry whose signing key cannot be read says why in its refusal.
  • Security: The Linux runtime's sandbox launcher and file-lock addon are compiled from the release's own tagged source in a pinned toolchain without network access, so a rebuild of the release reproduces them byte for byte, signing covers them and the release's software bill of materials names the compiler packages that built them.
  • Security: A Delorun release and its freshness timestamps are signed only with keys the public repository records as Delorun's production keys, so nothing is signed until those keys are recorded. A release is signed only when its version tag carries the signature of a release signer that the release branch of the public repository lists, not a local copy of that list, and the tagged code is on the release branch, and only when the delorun npm package it records, by name, version and checksum, is the package the release built. Until install scripts are rebuilt and compared like the rest of a release, no release lists one.
  • Security: A test release built on someone's own computer can never be signed with Delorun's real release keys, so a launcher that trusts Delorun's releases never accepts one.
  • Security: Each start checks the installed release under the newest release root the launcher ships, never an older root the home stored, so a signing key a newer root revoked stops the start. The launcher passes on no DELORUN_LAUNCHER_ setting it inherited.
  • Security: A start stops when the release-log bundle kept beside an installed release is missing, instead of starting with a warning; the message names the missing file and offers delorun recover rollback or putting the file back, and delorun verify fails on it as before.
  • Security: A launcher that installs from Delorun's published release channel refuses a release that the local release tool built.
  • Security: delorun update never moves to a release lower than the one running: a channel or a request that names a lower release is refused before anything is downloaded, and delorun recover rollback stays the only way back.
  • Security: The update report says when the release log could not be reached as the release was installed, instead of showing its log check as passed, and delorun update --yes does not confirm such a release.

Setup

  • The delorun command keeps your data in your own Delorun home, ~/.delorun or the directory DELORUN_HOME names, readable only by you, and never touches DeepSeek Harness's ~/.dsh. Its first run sets up the command-line profile; after that it starts Delorun in your terminal and opens the studio. Only one Delorun runs per profile.
  • If the profile's cordis.patch.yml sets the sandbox row's runnerCommand or runnerFailureSignatures, delorun start refuses with an error naming them and asking for their removal: your home's protection runs through the sandbox's built-in runner selection.
  • delorun import-home copies your DeepSeek Harness home, ~/.dsh or the folder --from names, into your Delorun home. It only reads ~/.dsh, which stays exactly as it was. After one yes it copies your chats, exactly as they were saved, the images and files they refer to, and your workspace list.
  • Then it asks about each of these on its own, and each starts on no: your profiles, your settings, your AGENTS.md instructions, your skills and your DeepSeek key. It shows each before it asks: each profile's plugins as carried, to install, added or not carried, the exact settings that would land, the first lines of your instructions, each skill's description, and your stored keys by name and never by value. --dry-run shows the preview and writes nothing.
  • Only settings that change how Delorun looks and your default model by name carry over: your theme and fonts, how chats and the composer show things, and your language. Every other setting is held back even after a yes, because it could run code, send your requests or key elsewhere, or switch off a protection; the preview lists each with the reason, and the import writes them where nothing reads them. A profile lands with its plugin list alone: no install script, lockfile, build approval or plugin from a path. A profile named headless stays behind, because delorun headless sets up its own, and so does a profile whose name Delorun can't start, such as one with a capital letter or a dot.
  • Setup asks "Copy your DeepSeek Harness chats, attachments and workspace list?" after its preview when ~/.dsh exists and your Delorun home has no chats yet, starting on no, and copies only those. delorun import-home copies the rest.
  • The preview lists every workspace with its folder. A workspace in your home folder itself, a hidden folder of it such as .ssh, the root of your disk or a Harness home stays behind with its chats, and so does a chat that works outside its workspace's folder or stopped in the middle of a turn. Before each question the import shows the whole text that would land, a page at a time.
  • A chat that ran with full access in DeepSeek Harness opens on the safer preset until you allow full access for its workspace in Delorun.
  • The import refuses a Delorun home that already holds chats unless you add --merge, and never overwrites a chat, attachment or workspace. Links, pipes, other drives, files linked to something outside ~/.dsh, attachments whose content does not match their name, and names DeepSeek Harness does not write are never followed or copied; no plugin, script or install runs; it copies at most 4 GiB unless --max-size gives more; and if your computer stops during an import, the next start of Delorun removes the part it had copied.
  • After the import, delorun plugin --profile <name> install installs each profile's plugins; the import prints the command for every profile that needs it, and a plugin's install script runs only after you approve it.
  • delorun setup asks which model provider Delorun uses: Anthropic, DeepSeek, Google Gemini, Groq, Mistral, Moonshot AI, OpenAI, OpenRouter, Together AI, xAI or any OpenAI-compatible endpoint, listed by name, or none for now, which changes no provider setting and says which model new chats still start on. DeepSeek works without any extra install, and so does every other provider in the list.
  • For each provider setup asks where its key comes from, typed now or read from the provider's variable at each start, and the model new chats start on, beginning on a current general model of that provider; an OpenAI-compatible endpoint also takes its base URL, without a user name, password, query or fragment and with a warning for plain http to another computer, and its model id. Setup keeps DeepSeek's default model and asks the model of every other provider; delorun setup key asks it for DeepSeek too.
  • A typed key is checked with one request for the provider's model list, or OpenRouter's key details, to the provider's own address, never a completion; a failed check says why and lets you enter the key again or continue with the key marked not verified.
  • delorun setup --yes sets up no provider unless --provider <id> names one, with --model, --base-url for an OpenAI-compatible endpoint and --key-env for another variable, and says how to add one when none is named. delorun setup key takes the same flags on a profile that is set up and asks nothing. A key is never taken from the command line.
  • Setup writes what the studio's Settings → Models and the model picker save, so the studio shows the provider and model setup chose; DeepSeek with its own variable and default model leaves the profile as DeepSeek Harness composes it.
  • You can run setup again if you change your mind. delorun setup on a finished setup, in a terminal, asks every question again with your current choices selected, keeps your saved key, marks the answers you change and writes only those. In the studio, Settings → General → Run setup again opens the first-run steps on your current choices.
  • delorun setup asks the model provider with its key and how careful prompts should be, and its More settings choice asks whether Delorun keeps running in the background and the profile's name and port. Changes protection is asked there too: it holds changes to your plugins and to Delorun itself for your review, and setup never turns it off. A typed key is checked with one live request to the provider before it is stored, and a failed check says why and lets you enter the key again or continue. Every question can return to the one before it, and a review screen lists the answers before anything is written.
  • "Ask me first" and "Ask less (like DeepSeek Harness)" take effect: they set Delorun's consent and permission defaults to their Delorun or stock values in the new profile.
  • delorun setup <section> runs one section again, and delorun setup --list lists them.
  • A terminal setup ends by printing the next steps and starts nothing; delorun starts Delorun in the background, which keeps running after the terminal closes, with the commands delorun status, delorun logs --follow and delorun stop.
  • delorun setup --yes applies every default; delorun setup --config <file> applies an answers document. Neither form turns on reach or credential forwarding, and --check-key checks the key with one live request.
  • delorun setup does not ask about the two upstream opt-ins, desktop analytics and DeepSeek's session-log upload. Both stay off, and Settings → Privacy changes them.
  • An interrupted setup resumes at the step it did not finish, and a finished setup is left unchanged.
  • Setup from a source checkout adds Delorun's bundle to the new profile, so the Privacy section in Settings loads on the first start without a manual step.
  • The studio's first minute is one short guide that ends in a chat. Welcome sets the language, shows the preview notice and tests each model key with the provider's free model list, so nothing is spent; you can add or change a provider without leaving the guide. Look shows a small chat in the colours you pick. Agents offers Claude Code and Codex, says whether each is signed in on this computer, and asks you to confirm what adding one means: when an agent starts from a chat Delorun asks on this computer first unless you allowed it for that workspace, a phone cannot answer, read-only chats never start one, runs stay in the chat's workspace and stop after 30 minutes, and Settings → External agents revokes it; it runs outside Delorun's sandbox with its own sign-in and billing. Recommended plugins puts the plugins that fit your setup first. Phone access, while it is off, checks Tailscale step by step and gives the commands to copy. Workspace opens your first chat in the default workspace, a folder you choose, or a repository cloned from Git; a clone never asks for a password, refuses an address with a sign-in in it, runs none of your Git hooks or filters, shows its progress and says why it failed. Ready lists what you set and opens the chat with starting prompts that fit the folder and fill in the message box for you to send. The studio's own notice about a missing default workspace waits while the guide is open. Settings → General → Getting started shows the guide again. With no working model key, a calm line above the message box says "Add a model key to start chatting" and opens Settings → Models; the studio no longer opens upstream's "Add an API key" dialog.
  • Delorun's package scope, home folder and environment variables are named Delorun: @delorun/…, ~/.delorun and DELORUN_*.
  • delorun setup opens with "How will you use Delorun?": just me on this computer, also from my phone or another device, or scripts and automation. The answer sets the defaults and decides which questions come next, so most people answer three: the model provider and its key, and how much Delorun asks. The review screen lists every answer, including the release check and the prompts answer, and its More settings choice asks the rest. This replaces the Quick or Full choice.
  • Every choice shows what it does, who it suits and how to change it later, and the recommended one is marked. The prompts choices are Ask me first, Ask less (like DeepSeek Harness) and Never ask (dangerous), which stays the third option with its two confirmations.
  • Each provider's key question names the provider's key page where one is known, says what an environment variable is, and warns at once, with the fix, when the variable you pick is not set in your terminal.
  • Setup ends by printing the next steps and starts nothing: delorun to start and open the studio, the install guide's section on your first chat, and delorun setup <section> to change an answer. Ctrl-C exits with code 130 and says nothing was saved. Choosing Back at the dangerous-mode confirmation returns to the prompts question.
  • An answers document may carry "useCase": "local" | "remote" | "automation"; without it, local is used. An answers record written by an earlier setup, with or without a Quick or Full mode, still reads.
  • Fixed: Setup ends by saying once that Delorun is running in the background, and the review screen says when the key check failed and the key is not verified.
  • Fixed: In a source checkout, the package manager's output while Delorun links its parts into the profile goes to the home process's log, and the terminal shows one progress line.
  • Fixed: delorun status prints the studio's address, without any token, and "Run delorun open to open the studio in your browser."
  • Security: delorun setup installs the delorun command at the exact version of the launcher you ran, npm install -g delorun@<version>, never whatever version npm serves as newest, and offers no install when that version is unknown. delorun verify prints the launcher's version with the integrity the signed release lists for it, which you compare with npm view delorun@<version> dist.integrity as the Trust page describes.

Studio

  • Picking Full access in a chat whose folder does not have full access shows what it means before anything changes: one sentence on what agents can then do, one on the risk, and under Details the folder and what full access reaches: your files, Delorun's home with its keys and tokens, the Docker supervisor and Delorun's update channel. It is the only dialog the permission control shows for Full access, and it asks you to tick that you understand the risks before Allow full access is enabled. Allow full access records your answer and switches the chat; Cancel leaves it in the sandbox. In a folder that already has full access, or a chat without a folder, the same dialog asks "Switch this chat to full access?" with the same tick and records nothing.
  • When an agent asks to run something outside the sandbox, its approval card has three buttons: Reject, Allow once, and Allow for this chat. Allow for this chat switches the chat to the permission the request asked for, so later commands in the chat run without asking, and allows the request. For full access it shows the same single dialog first, and Cancel leaves the request waiting. You lower the permission again in the composer. A chat already at or above the requested permission shows only Allow once. Once you rejected the request, or it ended, the button is greyed out and switches nothing, also when you confirm the dialog it opened. If the switch is refused, the request stays waiting and the reason shows under the buttons.
  • Settings, Permissions lists everything you allowed, each with a one-click Revoke. Full access lists the folders that have it, where new chats start with full access; revoking puts the folder's open full-access chats back on the safer permission within a second, in every running profile, and the other folders sit behind a disclosure where you can allow it. MCP servers lists the local servers waiting for your OK, with what changed (a new server, or its command, arguments, folder or which environment variables changed since you allowed it, or the file or folder it points to changed), the servers you declined or revoked, which stay stopped and quiet until you allow them, and the servers you allowed, each remembered on its own; revoking one stops it until you allow it again. Each answer's result shows under the section's introduction.
  • Review on a waiting MCP server says what allowing it does, the exact file it runs and the folder it runs in, and its risk, what changed, and under Details its command, arguments, folder, the file, command shell and folder they point to, and environment variables, showing a value only for variables that change what runs, such as PATH, NODE_OPTIONS or LD_PRELOAD. Allow and start starts it without restarting Delorun, and if the file or folder changed since you looked, nothing is allowed and the review shows the new one; Decline keeps it stopped.
  • When an MCP server waits for your OK, a notice names it, and "Review and allow this server" opens its review, then the next waiting server's.
  • These answers are given only on the home's own computer. On a phone or another device, the approval card, the notice, Settings, Permissions and the full-access explanation say to approve at your computer and offer no button; the phone sees only the names of the waiting servers. With "Ask less (like DeepSeek Harness)" prompts, Settings, Permissions says the profile does not ask, and the permission picker switches as DeepSeek Harness does.
  • The sidebar's Plugins page offers a cost meter, under Components on the Delorun studio page: turn it on and each chat shows an estimate of what it has cost under the composer, and the breakdown names each model's requests, tokens and cost, with the chats a chat started added up under it.
  • You can bring the chats you had on chat.deepseek.com into Delorun. Export them from the website, turn on DeepSeek chat import under Plugins, More, then upload the file with the button beside New session; the first-run guide's Recommended plugins step offers the same switch. The plugin is off until you turn it on, and only you at the computer can import.
  • The first-run guide's Recommended plugins step now also offers the Thinking tab and the cost meter. Both are off until you press Turn on, and each starts at once, with no restart. They stay under Plugins → Delorun studio → Components too.
  • When the studio cannot start because a plugin fails to load or the page does not open within 30 seconds, and always at /recovery, a recovery screen shows what failed and your recent changes, and lets you turn off a plugin, undo a change or start in safe mode, in English or Chinese. These actions work only in a browser on the computer Delorun runs on; a remote session can read the screen and is told "This needs you at your computer."
  • Settings lists Changes under Data, after Trash, so the review of plugin and harness changes is one click from the navigation.
  • Settings has a Setup versions page that lists the versions Delorun keeps of your setup, newest first, with the current one marked and what made each: an update, a save by you or a switch. Save this setup, with an optional name, keeps a version; What changes shows, in plain words, which plugins, bundles, settings and version exemptions switching to a version would change; Switch to this version saves your current setup as a version first, so switching back is switching to that version, and then tells you to restart Delorun to run it. The page uses the same history as delorun recover. Saving and switching work only in the studio on your computer: a phone or other device sees the list and the changes and is told to do it at your computer.
  • In the studio's collapsed sidebar, moving the pointer to the rail — or to the left edge where the desktop hides the rail — opens the full sidebar over the page after a short pause, without moving what you are reading and without pinning it open. It closes again a moment after the pointer leaves (moving back in keeps it open), on Escape, or when keyboard focus leaves it, and hovering one of the rail's own controls never opens it, so every rail click still does what it did.
  • A Changes section in Settings lists the changes to your plugins that wait for your review, the changes a failed start left out, your agent's plugin requests and your recent changes. Review shows a change's folder, its files, a summary of what it can do with the reminder that the summary helps you read the change and is not a protection, the files the diff does not show, and the diff; Apply asks a second time and names what the summary found when it flagged anything. Discard, Undo and Apply again work from the same section, Start working loads a plugin's edits live, and Done shows the folder's version with its diff and approves exactly that version. An agent's plugin request can be applied there after a second confirmation that says Delorun cannot show what it installs before it runs. The section shows the protection setting with the terminal command that changes it, and with protection off says that changes load without your review, and your changes to Delorun itself with their diff and the terminal command that decides each. While a work session lasts, a badge at the foot of the sidebar names the plugin. A browser that is not on the computer Delorun runs on sees everything with every action disabled and "This needs you at your computer."
  • The studio opens in Delorun's look: a softer palette with a choice of accents and themes, Delorun's typefaces, a density and a contrast setting, under Settings → Appearance, and a Conversation page for how chats are displayed. One switch in Settings → General → Look turns every Delorun addition to the studio off and shows the stock DeepSeek Harness look; with the stock look, one row under Settings → General turns the Delorun look back on.
  • A profile set up with an earlier Delorun turns to the Delorun look at its next start; one switch in Settings → General → Look turns it back to the stock look.
  • Under the Delorun look, a new chat's empty screen shows the Delorun wordmark above its headline.
  • Under the Delorun look, the page shown while the studio loads names Delorun instead of HARNESS.
  • The sidebar lists chats as cards with their status, sorted with pinned chats first, with search, a workspace filter, Alt and a digit to jump to one of the first nine chats, and an undo for each change you make from the list. Each workspace can have its own icon (letters, a glyph, an emoji or a generated pattern, in its own colour and shape), and the top of the sidebar can show header art, drawn in full behind the white name and sidebar button, which a thin dark edge keeps readable on any scene; both are chosen under Settings → Sidebar. Plugins, Automation tasks and More sit as icon buttons in the sidebar's bottom row, beside Settings.
  • The sidebar's Plugins page offers a Thinking tab, under Components on the Delorun studio page: turn it on and the right sidebar can show the model's reasoning and reply one word at a time as it writes them, at a pace you choose, with a delay behind the model if you like.
  • The studio's sidebar foot shows how much of this Delorun was checked: a small badge reads verified only when every runtime file was hashed by a full check and the release log, the plugins and your changes all check out, reads "Checked at start" after an ordinary start, which hashes only part of the runtime, turns red for a failed check and amber for an unknown release, an unchecked release log, a plugin changed after its install or a critical advisory, and shows your own changes, including those waiting for your review, as a plain count. It opens a panel with the four rows, their details, and Check now, which runs delorun verify through the launcher, so every runtime file is hashed before the check runs, and shows how long it has run. A phone or laptop you approved for remote access sees the panel read-only; Check now runs only on the computer Delorun runs on. The panel says that these checks run with your access, so a program running as you can change them.
  • Settings opens as one larger panel with its pages grouped by topic and a search field that finds pages and settings by name, in English and Chinese. A section from a plugin that the grouping does not name appears under More.
  • The Ready step of onboarding shows the look and the workspace in the normal text colour, so green marks only what is working. On a phone the starter prompts in a new chat sit under their label at the width of the message box.
  • Settings is arranged in five groups. General holds a General page (language, look, updates with the release check and the current versions, keyboard shortcuts, getting started and the coding view), Appearance (colours, then text and density), Sidebar, a Conversation page for how chats are displayed, and Chat (composer, links and usage). Agent holds Models, Modes, Tools and Plugins; Safety holds Permissions (new chats, full access and MCP servers), External agents (the switch that asks before an external agent runs, its run time limit and the agents you allowed), Network and Privacy; then come Devices, and Data with Trash and About, which now lists the licences and project links.
  • Every Settings page uses sentence-case headings, two- and three-way choices are segmented controls that work as radio buttons, and Thinking under Conversation is a menu.
  • A third-party plugin can give its Settings sections a group of its own, titled with the plugin's name; sections nothing places appear under Other.
  • The studio's sidebar shows Delorun's hex jack mark, its centre in your accent colour, and the product name, Delorun, as its brand. The DeepSeek Harness mark and name no longer appear in Delorun's studio.
  • The studio's preview notice is Delorun's own. It says that Delorun is a pre-release community fork of DeepSeek Harness, built independently of DeepSeek. The browser tab title and the home-screen name read Delorun.
  • A sign-in link you tap in a message or on a web page now signs you in, and a browser that loads the link ahead of time no longer uses it up. A link already used or past its minute still fails.
  • Onboarding on a phone shows a welcome line, a one-line note in place of the computer's phone access steps, a shorter key field hint that says where the key comes from, and larger tap targets. Onboarding and the greeting say Delorun.
  • The studio no longer asks for the update notice when the release check is off, so the browser console stays clean.
  • The Plugins page's install guide names delorun plugin add and delorun plugin remove, the commands Delorun has, and asks for the full path of a plugin's folder, which is the only kind of folder path the studio can install from.
  • The npm mirror switch moved from Settings, Privacy to Settings, Plugins, under the heading Plugin downloads, with shorter copy. It shows nothing when the profile does not load the plugin install check.
  • On a phone the attach and send buttons in the message box have a 44 px tap area, the Settings tab strip fades at the edge that has more tabs, and the key field's Apply button is neutral in onboarding so Continue is the one primary button.
  • On a touch screen the Settings tabs, the Close and Open configuration file buttons and the API key field are 44 px tall, and text fields use a 16 px font so the page does not zoom when one is focused. Desktop sizes are unchanged.
  • Settings: the Modes captions are sentence-case headings, the opening sentences of Devices and Network line up with the other panes, and the Devices terminal switch sits beside its label.
  • The plugins step of onboarding names a plugin in words, never by its package id, while its title is still loading.
  • Fixed: The browser tab is titled "Delorun", not "DSH Local Build", and the studio's stored look is applied before the first paint, with no flash of the stock sidebar.
  • Fixed: After you trash the chat that is open, the main pane shows a new chat and the keyboard returns to the message box.
  • Fixed: The guide's option chips are one labelled group you move through with the arrow keys, and its two "Add" buttons have distinct names. The page has a main landmark, "Search chats" and the message box show a focus ring, "Reconnecting..." is announced politely, and Escape closes the phone-width sidebar drawer.
  • Fixed: The studio you open on the computer that runs it no longer reads "Disconnected" when that computer has no network, such as with Wi-Fi off. It stays connected, because it never needed the network, and it no longer makes a request that only a phone or other device could use, which showed as a failed request in the browser's console.
  • Removed: Delorun's setup no longer offers DeepSeek account sign-in, the account entry in the menu is gone, and so are the account's Usage and Top-up pages. Use your own DeepSeek API key, which Delorun's model settings still accept. The account pages stay in upstream's code and are not reachable from Delorun's default setup.

Chats and workspaces

  • delorun export <chat-or-workspace> --out <file> writes a chat, or a workspace with its chats and their attachments, as an archive signed by your home. It warns about secrets it finds in the chat history, naming each by kind and never by value, and writes nothing until you confirm.
  • delorun import <file> checks the whole archive before it writes anything, shows who signed it and what it holds, and imports it after you confirm. An archive whose signature does not verify, whose bytes disagree with its manifest, whose paths leave the destination, that holds a link, or that is past its size or compression limits is refused; an archive from a home you do not know is imported only after you type its key's fingerprint, and an unsigned one only after you accept it unverified. Imported chats are kept apart and stay out of every model request.
  • Importing an archive brings a person's exported chats, attachments and workspaces into the home in one step that writes nothing until the whole archive has been checked: a path that climbs out of the destination, an absolute path, a link, a device, an archive past its size or compression limits and an archive whose bytes disagree with its manifest are all refused before anything is staged. The import states whether the archive's signature is verified, and shows the customisation the archive carries as a diff before any row is applied; an export warns about the secrets it finds in chat history before it writes the file.
  • An archive that hides a configuration expression behind JSON escapes is refused, so a customisation value that reads as a tagged expression is caught after it is decoded as well as in the file's raw text.
  • An archive with two entries whose names are the same word written in different Unicode forms is refused, because both would land on one file.
  • A new Delorun home has a default workspace on every platform: Delorun/default-workspace in your documents folder when the computer reports one that is not your home folder, otherwise Delorun directly in your home folder. delorun start picks the folder, and it is created when the studio first needs it. Restating the workspace-controller row in the profile's cordis.patch.yml with your own defaultWorkspaceDirectory chooses another folder.
  • A chat can be snoozed until later or settled when it is done, from its menu or its card; it moves to a folded Snoozed or Settled shelf at the bottom of the chat list and comes back when its snooze ends or when you send it a message. The snooze times and an optional rule that settles chats left idle for some days are set under Settings → Sidebar. The states are kept on your computer and never reach the model.
  • Deleting a chat or a workspace now moves it to the trash: "Move to trash" in a chat's or a workspace's menu archives its chats, stops their running work and takes them out of the sidebar. The new Trash section in Settings lists what was deleted with the days each item has left, restores an item where it was, and deletes one or every item forever from every place Delorun keeps it, with an offer to clear the operational logs at once. Items older than 30 days are deleted when Delorun starts. delorun trash list, restore, purge and empty do the same from the terminal while Delorun is stopped.
  • Trash deletes a chat or a workspace into a 30-day retention, restores it before the retention ends, and purges it from every store that holds its content: the full-text index, the session generations, the attachments, the spill files and the browser drafts. It offers to clear the affected process logs, current and rotated, at once.
  • Permanently deleting a chat also removes the copy the session list keeps for it, so the chat's title, first message, plan, goal and todos no longer stay on disk after the purge.
  • A folder you open now starts on the safer permission, so a chat can write inside it and asks before doing more; turning on full access for a folder takes one answer covering that folder, and a chat whose folder was never answered stays in the sandbox even when something tries to switch it.
  • Choosing the safer permission for a folder again withdraws that folder's full-access answer, so turning full access back on asks once more, and puts the folder's other open full-access chats back on the safer permission within a second, in every running profile. A chat picking full access after another profile or delorun workspace full-access withdrew it asks again.
  • Fixed: A code run whose execution process ends on its own now reports that process's own exit status every time. A busy machine no longer replaces it with the termination signal we sent to a process that was already stopping.
  • Fixed: A damaged workspace list no longer leaves the studio empty. Delorun starts with every workspace record it can read, sets the rest aside in a dated file next to the list (it never deletes one), and logs where it is. It also keeps the previous good copy of the list, delorun doctor checks the list, and delorun recover workspaces brings the previous copy back after asking you. See [The workspace list](../../docs/guide/troubleshooting.md#the-workspace-list).
  • Fixed: The agent can rename a workspace with the new rename_workspace tool, after you allow it, instead of editing files by hand.
  • Fixed: When some workspace records were set aside, the studio says so above the message box, names the file and points to delorun doctor; you can dismiss it. A rename_workspace call in a chat shows the old and new name, or why it was refused.

Safety and privacy

  • With changes protection on, before the agent first writes to the folder of a plugin you approved, the chat asks you, names the plugin and shows the diff, because the agent is changing what your harness runs; once you allow it, the rest of that chat's writes to the plugin go ahead, and what it wrote still waits for your review in delorun changes. A link or a .. in the path asks the same way.
  • With changes protection on, when the agent asks to install, update or remove a plugin, nothing is installed or removed: the request waits in delorun changes and the studio's Changes section for you to apply or discard it at your computer, and the agent is told so. With protection off, the default, the agent's plugin requests run as in DeepSeek Harness and a plugin it installs from a folder is recorded as loaded without review. Applying a plugin from a folder adds it with nothing loaded, and its content waits for your review as its own change.
  • With setup's Dangerous answer on, a phone or browser signed in over remote access, with its unlock running, can do what the computer does: change the settings and plugin rows the computer alone changes with the other answers, run any slash command, loosen the permission new chats start in, answer the questions for MCP servers, external agents and a workspace's network, give the approvals that reserve full access, use terminals, save or remove provider keys (a saved key is never sent back), open a chat's folder in an application on the computer, and read files outside the chat's workspace. A workspace's full access that a device turns on ends with the mode, while what you set at the computer stays. Only the computer turns the mode on, approves a new device or an unlock, removes a device, changes the remote-access settings or signs a device in. Settings, Permissions now shows delorun setup prompts as code in the Dangerous mode card.
  • With setup's Dangerous answer on, any chat can switch to full access with no dialog and no per-workspace consent, from the studio at the computer, a phone signed in over remote access, a scheduled task, a bot or delorun headless. Settings, Permissions shows a card with the date and a Turn off button, which also works from a remote studio, and a small "Dangerous mode" badge under the sidebar logo opens it. New chats still start on Workspace Write unless the workspace's default says otherwise.
  • Before an external agent such as Claude Code or Codex runs, Delorun asks you at the home's own computer, saying that it runs outside the sandbox, can reach your files and Delorun's home, and uses your own account. A phone signed in over remote access cannot answer.
  • "Allow for this workspace" on the approval card, or delorun workspace external-agents <folder> <agent> on, lets an agent start there without asking; Settings, External agents and delorun workspace external-agents <folder> <agent> off revoke it.
  • A read-only chat and a chat without a workspace folder never start an external agent, a run cannot start outside the chat's workspace, the question names the folder the agent runs in, and each run stops after 30 minutes. A full-access chat and delorun headless cannot ask, so they start an agent only where you allowed it for the workspace.
  • The model can no longer install or turn on an external-agent plugin, such as Claude Code, Codex or the ACP one, through plugin management.
  • Settings, External agents has its own switch, Ask before external agents run, on by default, and the run time limit, from 1 to 1440 minutes. Setup's prompts answer does not change either, and only the home's own computer can turn the question off.
  • A Privacy page in Settings states that Delorun has no telemetry of its own and turns DeepSeek's session-log upload and desktop analytics on, after showing what each sends and where, or off again.
  • Commands the model runs can read, and run scripts in, the approved copies of your profile's plugins, so a plugin that hands the agent the path of its own tool works. They still cannot write those copies, and they cannot read a plugin change that is waiting for your review, another profile's copies or the rest of Delorun's home.
  • With setup's Dangerous answer on, the permission new chats start in and the external-agent consent that a phone loosened are set back when the mode ends, unless you changed them at your computer since.
  • A terminal opened or attached from a phone or browser always needs that device unlocked: setup's Dangerous answer, a full-access workspace and the old Terminal from phone without unlock switch no longer waive the unlock. The switch is gone from Settings, Devices; a home that still has it set keeps working and ignores the old setting. A phone with a terminal, or prompting a chat in a full-access workspace, has the computer's authority, so treat an unlocked phone as the computer.
  • A Delorun that keeps running for weeks now deletes expired log records itself, at the first hourly check after they are 14 days old, instead of waiting for you to run a delorun command.
  • Delorun's log now removes more of what it holds: the keys it loads from the credentials file, .env files and the environment, keys you set later from the studio or a phone, the studio's signing secret, session tokens, owner codes, pairing codes and the home key. Records of a chat's turn carry its session id and turn number, so delorun logs --session and --turn find them.
  • Delorun's log labels messages from upstream and other code it does not own as captured, because they can quote your chats. Delorun's log now also removes the elevation codes you type at the computer and the keys in your .env files, and it keeps a replaced or deleted provider key hidden, since the provider still accepts it until you revoke it.
  • DeepSeek's session-log upload and DeepSeek Harness's desktop analytics are off until you turn them on.
  • The threat model, the execution-vectors page, the contracts and the package READMEs now state only the protections the code provides, and where each applies: Delorun's confinement, consents, fetch guard and privacy defaults apply to the profile that delorun and delorun start run, not to delorun headless, delorun plugin or the desktop app, and on Windows the sandbox confines writes only. Each contract page opens with what is built, and protections that are not built, such as reach, Docker workspaces, the plugin revocation list and most delorun verify checks, are described as design pages instead.
  • Fixed: A chat never turns a plugin on at any protection level: with protection off, undo and restore in the plugin manager, and a turn-on whose enabled is not the boolean false, now wait for you at the computer, as an install already did.
  • Security: Programs the agent starts no longer inherit a web address that carries a token, such as https://<token>@host or an error-reporting address with its key, or the variables that point at Kubernetes or Kerberos credentials, a MySQL password or a passphrase. An agent socket listed in PATH or a similar search list now drops only that entry, so the rest of PATH still reaches the program. An address that names only a user, such as postgres://user@db/app, is not passed on either, because a token in that place looks the same; pass such a value to the program explicitly.
  • Security: A model-authored write to a skill, a preset, or a workspace's AGENTS.md asks for an approval that names the instruction-layer effect, because these instructions load in every future chat, and shows the diff, on every permission preset including full access. It also asks for a write through a linked folder or file, through a hard link to the file itself, for a differently capitalised name on a disk that ignores letter case, and for a write to the profile and home configuration files that hold presets.
  • Security: An MCP server that would run as a local command is held until its command is accepted: the exact command with its arguments, its working folder and its environment variables, and the program and folder they lead to on this computer, with the command shell that runs a Windows .cmd file, are checked before the server starts. A command that has not been accepted keeps the server stopped and asks again; an accepted command starts that exact program without asking until any of these change, including the folder Delorun runs in, its PATH or its COMSPEC. A .env file can no longer set COMSPEC or PATHEXT. The request names the environment variables without their values. The check holds whatever order the settings list the server and the consent in, and a command accepted by an earlier build is asked about again.
  • Security: Approving a scheduled task names the recurrence it arms, the chat its deliveries reach and the permission preset that chat runs under, and a due delivery refuses, pausing the task, when that chat no longer runs the preset the task was approved under. The approval also names the task, the start of its message and the chat by its title, and for a new chat the folder it opens in and the preset that chat will really start with, such as its workspace's; the task is then held to the preset you were shown. Every occurrence is checked, a task that opens a new chat is checked before the chat exists, so a refused delivery leaves no empty chat behind, and a reminder still waiting from before a restart is checked again before it runs. When the check cannot give a clear answer, nothing is delivered: an answer it does not recognise refuses, and a check that fails keeps the task waiting and reports the failure instead of delivering.
  • Security: A .env file in a folder you work in can no longer set OPENSSL_CONF, GCONV_PATH, NODE_ICU_DATA, LD_* or the other variables Delorun's launcher removes before it starts the runtime.
  • Security: web_fetch refuses to reach loopback, link-local, private-network, carrier-grade NAT (the range a tailnet and its API use), multicast and reserved addresses, and the address that names no destination at all, before it opens a connection. An IPv6 address that reaches an IPv4 address (mapped, compatible or translated for a network without IPv4) is judged as the IPv4 address it stands for.
  • Security: Delorun's profiles turn that protection on; a stock configuration keeps its old behaviour.
  • Security: web_fetch connects only to the addresses it checked. A name that answers differently when the connection opens than when it was checked can no longer send the fetch to another address.
  • Security: A chat can no longer use the plugin manager to switch off, reconfigure or remove Delorun's consent and guard plugins, the update check or the sandbox, even under full access, so one chat cannot turn these protections off for every workspace. The Plugins page shows them as locked too; you change them by editing your profile's configuration.
  • Security: In a task run with delorun headless with changes protection on, an agent's request to install, update or remove a plugin no longer runs: it waits in delorun changes for you to apply or discard it at your computer, as in the studio. Its first write to the folder of a plugin you approved asks for your approval, which nothing in a one-shot run can give, so the write is refused.
  • Security: A task run with delorun headless now runs under Delorun's guards, as the studio does. Web fetches of private, loopback and link-local addresses are refused, and a write to a skill, a preset or an AGENTS.md, a new stdio MCP server and a scheduled follow-up are refused, because nothing in a one-shot run can answer the approval they need. The task's model cannot turn these guards off through plugin management.
  • Security: Full access in a headless task is refused unless you turned on full access for that folder, with delorun workspace full-access <folder> on or in the studio. A request for it with --permission-mode (danger-full-access or a preset of yours that selects it) or DSH_PERMISSION_MODE=danger-full-access is refused before anything starts, with a message that names the folder and the command that grants it; any other way of switching to full access during the task is refused by the same consent inside Delorun.
  • Security: DeepSeek's session-log upload is off by default in a headless task, as in the studio, and the feedback telemetry exporter is off.
  • Security: The task starts only after Delorun has checked that these protections are active. If the headless setup lost them, delorun headless stops and says how to restore them: remove profiles/headless/delorun-migrations.json or the profiles/headless folder in your Delorun home.
  • Security: Delorun refuses to use a home folder or secret file that other users on your computer could read, and prints the chmod command that fixes it.
  • Security: Spilled tool output lives in the home's own spill/ folder instead of the shared temporary folder, so the rule that keeps a confined command out of your home keeps it out of your spilled output too; the temporary folder is used only for a home that cannot hold it.
  • Security: The home's .env file is read only when it is your own file, readable by you alone, and a real file rather than a link; one that is not stops the start with the exact command that fixes it (chmod 600 <file>), as the credentials file already does, so another local user cannot choose what your sessions load.
  • Security: The anonymous id file is created readable by you alone, and the home directory the harness creates for it is private to you.
  • Security: MCP servers can no longer use a stored credential to change what a reviewed start runs. A ${credential:NAME} in a server's command, folder or a variable that changes what runs (PATH, NODE_OPTIONS, LD_PRELOAD, PYTHONPATH and the like) is refused when the server loads, and an argument that is only a credential and would start with - is refused at start. The review shows templated arguments as written, with a note that they are filled from stored credentials.
  • Security: An MCP server you allowed asks again before it starts if the program it runs, or a script file its arguments name, changed since you allowed it: Delorun remembers the contents of the program and of a file an argument names, such as the server.js of node server.js, the ./hook.js of --import=./hook.js or the file a node_modules/.bin link points to. If one of them is rewritten or a link points elsewhere, Delorun asks you again before the server starts, at startup and also when the server restarts after it stopped, and shows "A file it runs changed since you allowed it". The server starts from the file the link pointed to when it was checked, under the name you configured, so a virtual environment's python still finds its virtual environment, and the review shows that file when the command is a link. Files the program loads by itself, such as other modules of a package, and code that npx or uvx downloads are not covered, so the review also names the folder and files of the server that your chats can write to.
  • Security: The list of files a turn changed is now read without running any program that the repository's settings, attributes or hooks name, such as a file-system monitor, a filter or a hook, so a command the agent ran cannot plant one there to run later with your full access. The git commands that read it also run inside the chat's sandbox, with no more access than the agent's own commands, and a git older than 2.31 is no longer used for the list. Its working copies now live in your user cache folder, which the sandbox does not open to the agent's commands, instead of the temporary folder, and nothing is copied there while a workspace or extra folder of any chat contains it.
  • Security: The sandbox keeps confined commands from reading or writing Delorun's home and from connecting to the sockets of Delorun's own services and of Docker, where the platform enforces it. A writable workspace that contains the home is refused for commands, and the file tools refuse to read, search or write inside it. A key file there stays out of reach of a command the agent runs.
  • Security: Searching the machine with glob or grep no longer reaches Delorun's home: a search over a folder that contains it lists none of the home's files and prints none of their matched lines, so a pattern or a word that matched a key file there finds nothing. The search runs in the same sandbox as the agent's commands, so a folder the agent swaps for a link to the home while a search runs shows nothing of it either, and where the sandbox cannot run, the search fails instead of running unprotected. A session under full access still searches everywhere it reaches.
  • Security: Reading, editing, writing, creating or deleting a file with read, read_image, str_replace_editor, edit, write or apply_patch fails instead of reaching a file in Delorun's home when a folder on its path is swapped for a link to the home between the check and the change.
  • Security: Tool output too long for a chat is saved in Delorun's home, where read and grep in that chat can open it as the chat's notice says, while other chats and the commands the agent runs cannot. When the home cannot hold it, the output stays in the chat rather than going to a temporary folder those commands could read.
  • Security: The model can no longer offer you a file from Delorun's home as a deliverable: presenting a file inside the home, or through a link that leads into it, is refused before the file is looked at, as opening it already was. A session under full access can still present any file it reaches.
  • Security: The sandbox records which of these rules each platform cannot enforce: Linux cannot block socket connections, and Windows does not limit reads.
  • Security: The Linux sandbox launcher refuses a grant path that names a symbolic link in any part and does not run the command, so a path swapped for a link after it was checked cannot widen what a command may touch.
  • Security: Under WSL, a command the agent runs in the sandbox can no longer start a Windows program through WSL's interop, by its path, by name or as a copy. Where the sandbox cannot use bubblewrap, its fallback cannot block this, so it refuses to run commands under WSL rather than leave this way out open.
  • Security: Under WSL, and on any other virtual machine whose system offers it, a command the agent runs in the sandbox can no longer open the virtual-machine connection to the host, which WSL's interop runs over. The sandbox also turns off io_uring for those commands, which could open that connection another way, so a program that needs io_uring fails there. A 32-bit program that opens network connections the old way cannot open any.
  • Security: A command the agent runs in the sandbox can no longer leave it through your session's services: it cannot start a program with systemd-run --user or through the session bus, reach the system bus, a tmux or screen server or the X server, or use your gpg-agent, keyring or the ssh-agent SSH_AUTH_SOCK names, because the sandbox hides their sockets. Where the sandbox cannot use bubblewrap, its fallback cannot hide them, so it refuses to run commands on a machine that has them rather than leave this way out open. A desktop's X server and a session bus started by dbus-launch can also listen on sockets no file names, which the sandbox does not hide.
  • Security: A command the agent runs in the sandbox can no longer reach Docker Desktop's control sockets under WSL or on Linux, through which it could change Docker Desktop's settings and act on containers, or the local control socket of Tailscale.
  • Security: A read-only command the agent runs in the sandbox now sees an empty /tmp, apart from a workspace that lies in it, as a command that may write already did, so it can no longer reach the sockets other programs keep in /tmp. A glob or grep search rooted elsewhere in /tmp finds nothing. With bubblewrap, io_uring is now off for confined commands on any machine with these session services, not only under WSL.
  • Security: A plugin's key, a setting the plugin marks as secret such as the DeepSeek API key of web search, is never saved into your profile's settings files, which the profile history keeps in git: saving one from Settings or through the agent is refused with where to put it instead, and the history saves no version that holds one, while it still lists your versions and undo and restore still work.
  • Security: If a settings file already holds such a key, the next start moves it into the credentials file and points the plugin at it, telling you which file and setting changed and never showing the key; a key Delorun cannot move, because the setting has no place to name a stored key, stays and every start tells you how to move it. If an earlier Delorun already saved a key in the profile history, replace it with a new one.
  • Security: A damaged or hostile session log can no longer expand a single compressed frame without a limit; a frame that would grow past 64 MiB is reported as corrupt instead of exhausting memory.
  • Security: A session log that another process was migrating at the same time is accepted only when its contents decode to the same chat plus a valid append, not merely when its first bytes match.
  • Security: delorun setup stores the model key through a new file that only you can read and that replaces the credentials file in one step, while it holds the same lock as the studio's own writes to that file; a left-over or planted temporary file never receives the key, and an interrupted write leaves the credentials file as it was.
  • Security: A start now checks which plugin runs each protection, not only that a row with its name is on: a patch or a plugin that adds a second sandbox row or a second copy of one of Delorun's guard rows under another plugin is refused, naming the file, safe mode never skips one of them, and once the studio has started each protection's service must come from its own plugin.
  • Security: No chat turn in the studio reaches the model until the start has checked the running studio's protections; a turn sent before that waits, and is refused if the start is refused.
  • Security: A .env file in the folder you run delorun from, or in Delorun's home, can no longer set a DELORUN_ setting such as the launcher's release roots; Delorun refuses to start and names the file.
  • Security: When the release you updated to fails its start check, only delorun, delorun start and delorun recover rollback, with nothing after --, start the release before it to roll back; any other command, delorun verify and delorun stop included, is refused with what failed and delorun recover rollback as the way back, and changes nothing.
  • Security: An update checks again, right before it stops Delorun for the switch, that no other profile's Delorun or delorun headless started using your chats since it began, and stops without changing anything if one did.
  • Security: The profile names headless, data-users, node_modules and desktop, and the Windows device names such as con and nul, are reserved: delorun, delorun plugin, delorun logs, the launcher and setup refuse them and say why, and delorun plugin and delorun logs refuse a command line that names two different profiles.
  • Security: A Delorun running in another container or sandbox that shares your home now counts as running, so its home lock is never taken over as if it had stopped.
  • Security: Delorun checks every start against the protections it promises before anything runs, and again once the studio has started: the sandbox protects Delorun's home, Delorun's consent and guard plugins are on, and your prompts answer is the one setup recorded. A patch, your home's own cordis.patch.yml included, that turns one of them off or points the sandbox at its own runner stops the start with the file to fix, or delorun recover safe-mode to start without your plugins.
  • Security: delorun headless now runs its task under the same sandbox protection of Delorun's home as the studio, and refuses --profile, --patch and --from-default-profile.
  • Security: delorun refuses to start when your command-line profile cannot load Delorun's own bundle, and prints how to fix it, instead of starting with DeepSeek Harness's defaults, which upload session logs to DeepSeek.
  • Security: delorun stops and tells you how to fix it when one of Delorun's own plugins, such as the Privacy section in Settings, fails to load, instead of running without it.
  • Security: delorun stop --now now ends a Delorun that does not answer or does not exit, with SIGTERM and then SIGKILL, but only after it confirms the process is the one holding the profile's lock; a process it cannot confirm is never signalled, and the command says which process to check. On Windows it never signals.
  • Security: A start that Delorun refuses after the studio has booted now stops that studio itself and always reports why with a non-zero exit, instead of letting the process end early, sometimes with code 0, before the refusal and the recovery of an interrupted update had run.
  • Security: Refusals and unexpected failures are printed in the same what, why and what-you-can-do form with secrets such as API keys redacted, and an unexpected failure's full detail goes to the home process's log instead of a stack trace on the terminal.
  • Security: delorun recover rollback with no Delorun running now counts as the only user of your chats while it runs, so another profile's Delorun cannot start in the middle of it; delorun plugin now counts as a user of your chats while it runs.
  • Security: The record of Delorun's one-time profile changes now lives with the profile, and an unreadable record makes Delorun skip the changes and say so, so a change you undid is not made again.
  • Security: A link that signs you in to the studio now works once and only for one minute, so a copy of it left in your terminal's scrollback, your shell history, your browser history or another program's command line can no longer be used to sign in after you have opened it. Run delorun open to open the studio in your browser at any time; delorun open --print prints a fresh link instead, for a computer without a browser or one you reach through an SSH port forward, and --port makes it for a forwarded port other than the studio's own. A link works only at the address it names, and opened at another address it says which one it was made for. Starting Delorun prints the studio's address without a link, and an old link tells you to run delorun open.
  • Security: With the fetch protection on, web_fetch judges an address written into the URL as an IPv6 literal, such as http://[2001:db8::1]/, like any other address: a public one is fetched, and a loopback or link-local one, such as http://[::1]/ or http://[fe80::1]/, is refused. Every IPv6 literal had been refused, public ones included.
  • Security: Your home folder itself, a filesystem root, the Delorun home, DeepSeek Harness's ~/.dsh home and any folder that contains one of them cannot be a workspace. The guide's folder chooser and the workspaces plugin refuse them and say why and what to choose instead.
  • Security: Each workspace has a network setting for the commands the model runs in the sandbox: open, as before and by default; allowlist, where commands reach only the hosts you list, through an egress proxy that never looks up an unlisted name and refuses a listed name that points at a private, loopback or link-local address; or off, with no network at all. web_fetch follows the same setting. Choose it in Settings, Network, at the computer that runs Delorun; a change that lets commands reach more asks you to confirm it.
  • Security: An allowlist entry allows ports 80 and 443; write host:port, such as github.com:22, to allow another port. Under allowlist and off, commands also cannot reach the services that look names up or send traffic for them: systemd-resolved, nscd, avahi, the system D-Bus, snapd, CUPS and Tailscale's daemon. Other sockets stay reachable, such as an ssh connection you keep open or gpg's dirmngr under your home folder.
  • Security: The setting holds on Linux with bubblewrap, WSL2 included. Where the sandbox cannot enforce it (Landlock alone, or any platform other than Linux), a workspace set to allowlist or off runs no commands instead of running them with your network.
  • Security: A new guide page, "Prompt injection and data exfiltration", explains what each setting closes and what stays open whatever you choose: commands under full access, plugins and MCP servers, plugins the model writes, web_search, images and links in replies, files you share later, and a command that reaches a program outside the sandbox through a socket the sandbox does not hide, such as one in your home folder.
  • Removed: Feedback no longer goes to DeepSeek. Delorun's studio hides the feedback buttons and the /feedback command, and it sends no session-log prefix to DeepSeek's feedback collector.

Reach

  • Remote access: delorun reach on tailscale lets you open the studio from your phone or another device over your own Tailscale tailnet, at https://<computer>.<tailnet>.ts.net. It is off until you turn it on, also from the remote access section of delorun setup's Full mode, and delorun reach off turns it off. delorun reach status shows whether it is on and ready.
  • A device can open your chats only after you approve it at your computer: run delorun devices approve or choose Add a device in Settings → Devices, then type the 8-digit code the device shows. The device's sign-in page walks you through these steps in English or Chinese, light or dark, shows the code large with the time left, and says what to do next when approval is closed, the code expired or was cancelled, too many devices are waiting, the computer can't be reached, or the browser can't keep a sign-in key. delorun devices list lists approved devices, and delorun devices remove or Remove in Settings → Devices signs a device out at once.
  • An approved phone can do what you do at your computer with your chats and workspaces: read and reply to chats, start one in a workspace you have with any of your presets, read the files of its own workspace and its changes, see which plugins are installed, rename, pin, archive and reorder chats and workspaces, move a workspace to the trash, set goals, schedule follow-ups, choose the model, answer ordinary prompts and stop a run. A preset you choose on the phone decides the tools a chat runs with but grants no access by itself: a workspace's full access and every approval prompt are still answered at the computer. Credentials, your account, granting full access, and devices and remote access always stay at your computer. A remote session ends after 12 hours in which the phone sent nothing and 14 days after sign-in, and its open connections close then.
  • A few sensitive actions on a phone need a short unlock you approve at your computer: changing settings, running the slash commands that change only the chat (/compact, /export, /goal, /permission and /plan), installing or changing plugins other than Delorun's own guards, opening a terminal, starting a chat in a folder that is not one of your workspaces and adding a workspace. The phone says the action needs a quick unlock and shows an 8-digit code; type it in Settings → Devices on your computer or with delorun devices elevate. While unlocked the phone shows until when, with Lock now; an unlock lasts 15 minutes, never extends, and ends early when you lock it on either side or the phone's session ends. Even unlocked, a phone cannot loosen the permission new chats start in, for example toward full access; it can still make it stricter.
  • delorun reach on tailscale refuses while Tailscale Funnel is on for the address, and Delorun stops serving if Funnel is turned on later.
  • A phone signed in to Tailscale as the same user as your computer can now ask to pair without an approval window. The studio at your computer shows the request with Enter code and Decline; you type the 8-digit code the phone shows, as before, and the code is still required. delorun setup reach lets any device on your tailnet ask instead, and delorun reach status says who may ask. The pairing settings in the @delorun/home-auth row also set how the request is shown, the approval window and request lifetimes, and how many requests one Tailscale user may have waiting. Settings → Devices shows and changes these choices at your computer.
  • Turning remote access on or off applies to the Delorun that is running, which says whether the address is ready instead of asking you to restart; delorun reach status shows the live state.
  • delorun reach on checks that your Tailscale user may serve before it turns anything on, and names the one command to run when it may not.
  • delorun start --background starts Delorun detached from the terminal whatever setup answered, and a start that stays in the terminal says how to run it in the background next time.
  • delorun reach on tailscale asks "This changes Tailscale on this computer … Continue? (y/N)" in a terminal before it changes anything. --yes skips the question. Without a terminal and without --yes it changes nothing and says to add --yes.
  • Opening your remote address, or a page of it, on a device that is not signed in takes you to the sign-in page instead of showing an error, and back to that page once you sign in.
  • Security: A device reads only the files whose real location lies inside its chat's workspace: a link inside the workspace that leads elsewhere, and Delorun's own folder, are refused.

Plugins

  • A plugin you link from a folder runs from a copy of its content kept in the Delorun home. With protection on, edits in the folder wait for your review and break nothing that is running; with protection off, the default, they load without review and are recorded. Plugins linked before this release are approved as they are at the first start, which says so once.
  • Changes protection is off by default, so you change your harness freely: a plugin you link from a folder loads your saved edits at each start and, while Delorun runs, each time you save a file in its folder, without a work session. Each load is recorded as a change that loaded without review, which delorun changes list shows and delorun changes undo takes back, and content you undid does not load again until you save something else. A saved version that fails to load goes back to what ran before and is not tried again until you save again. delorun changes protection on makes changes wait for your review instead, and takes effect without a restart.
  • A composition can forbid embedded code in its own patch files: with refuseCode on, loading refuses !!js expressions and patch insert rows and fails with an error naming the file and where the code sits. The switch is off, which changes nothing.
  • Settings, Plugins has Create a plugin: name a plugin, choose what it adds and a workspace, and Delorun writes the starting files into the workspace's plugins folder, the same files delorun plugin new writes. Turn on lists the plugin in Changes for your review at the computer, also in dangerous mode; a phone or another device is told to do this at your computer.
  • Ask the agent in a chat for a plugin and it makes one in the chat's workspace, under plugins/<name>, with the new delorun-plugin-authoring skill. It cannot turn the plugin on, at any protection level and in any chat access; that stays your step at the computer. Once the plugin is on, later edits to its files wait for your review when changes protection is on, and reload live, logged as loaded without review, when it is off, the default.
  • The review of a plugin change warns when the plugin answers approval prompts itself, which can give grants you keep to your computer, and when it installs, removes, updates or loads plugins itself, outside the install check. Both are warnings to read, not blocks.
  • Fixed: The Changes and instruction-consent plugins load when Delorun runs its TypeScript sources directly; they failed to import and left the studio without Changes.
  • Security: Installing a plugin checks it and every package it brings before any of its files are fetched or any install script runs: a package without an integrity hash, a git source not pinned to a full commit, a registry or download URL that is plain http, a known GitHub advisory, a version published in the last 24 hours and a name close to one you already have are each shown where you install it, on the Plugins page and in delorun plugin's output. A known critical advisory stops the installation until you choose to install it anyway, with "Install anyway" or --allow-advisory <id>; everything else only warns. When the advisory or publish-time lookup cannot run, you are told so. Scopes and git owners you trust can be listed so their plugins show only critical advisories; linked and local plugin folders are not checked.
  • Security: Delorun records every file of each plugin it installs, checks them at every start and fully in delorun verify, and warns when a plugin changed since it was installed. Installed plugins get their own copies of their files, so an edit to pnpm's shared store no longer reaches them.
  • Security: Plugins no longer fall back to the npmmirror registry unless you turn it on, in Settings → Privacy or with delorun plugin mirror on, and a package installed under the name of one of Delorun's own components cannot stand in for it.

Commands

  • delorun changes lists the changes to your plugins, those that loaded without review and those that wait for your review, and shows each with its files, a diff and a summary of what it can do. apply, discard and undo decide about one change after you confirm in a terminal, with a second confirmation when the change runs commands, opens network connections or does anything else the summary names. A running Delorun loads an applied change at once and goes back to what ran before when it fails to load. off and on turn one plugin off and on again, and protection on makes changes wait for your review, which protection off, the default, ends; each says what it means, asks, and applies without a restart. work <plugin> [--for <minutes>] loads every edit you save in a plugin's folder live for up to two hours, or the minutes you give up to eight hours, going back to the last version that loaded when an edit fails to load. done <plugin> shows the folder's version with its files and diff and approves exactly that version as one change; a session that ends without you, when Delorun stops or its time is up, approves nothing and leaves the folder's content waiting for your review. delorun status names an open work session and when it ends. With protection on, a plugin you link with delorun plugin --profile default add link:<folder>, or bring back with a restore or undo, loads nothing from its folder until you apply its content, also while Delorun runs; the approved copy includes the plugin's installed packages; and a plugin folder Delorun cannot read no longer stops Delorun from starting. When Delorun fails to start right after you applied a change to a plugin or turned one on, it starts once more without that change, names it with delorun changes apply <id> and undo <id> at every start, in delorun changes list and in delorun doctor, and rewrites none of your files; when it fails again it points to delorun recover safe-mode.
  • Every delorun command answers --help (and -h, and delorun help <command>) with a short usage, its options and its exit codes, and exits 0 without starting anything. A wrong option now says which option and points to delorun <command> --help, and delorun help ends with a short list of the words the commands use: home, profile, studio, workspace, full access and reach.
  • delorun start starts Delorun in the background, so you can close the terminal, and waits until it is running; delorun start --foreground runs it in your terminal. delorun start --patch <file> applies a patch file over your profile for that start only, as dsh --patch does, and Delorun's own checks still apply to it; --inspect lets a debugger attach to Delorun while you work on a plugin, after you confirm, since any process on the computer, the agent's sandboxed commands included, can then run code as Delorun; --inspect --yes confirms without a terminal, safe mode refuses it, and delorun status shows it while it is open. delorun on its own does the same and opens the studio, then prints the studio's address and how to see, follow and stop Delorun; if you chose during setup not to run Delorun in the background, or pass --foreground, it runs in your terminal.
  • delorun stop stops Delorun once running chats end, or at once with --now.
  • delorun status shows the home and profile in use, whether Delorun is running, its process, runtime version and running chats, or prints them as JSON with --json.
  • delorun plugin and delorun headless work as their dsh counterparts do, inside your Delorun home; an installed Delorun runs plugin operations with the pnpm it carries, so you do not need pnpm on your computer. delorun plugin works on your Delorun profile without --profile. When pnpm refuses to run a package's build, as it does for a plugin installed from git, delorun plugin asks whether to allow that one package's build and tries again; --allow-build <name> allows it without asking, and nothing allows every build at once.
  • When a delorun command or the launcher stops on a failure, it says what Delorun did, why, with the error's code and the file or detail concerned, and what you can do next, naming your --profile; it never prints a stack trace.
  • delorun workspace full-access <folder> on turns on full access for a folder after showing what it means and asking you to confirm at a terminal; off turns it off, and without a folder the command lists the folders with full access. Every running studio counts the change within a second, whichever profile it runs, and after off the command names the profiles where Delorun runs; a change made at the same moment by a studio is never lost. delorun headless in that folder can then run with full access.
  • delorun mcp list shows the local MCP servers Delorun is holding, what changed since you allowed each (a new server; its command, arguments, working directory or environment variables changed, naming the variables that changed; its command or folder now points to a different file or folder on this computer; the acceptance list could not be read; or, for a server you allowed before Delorun remembered each server separately, a one-time review) the exact file that runs and the folder it runs in (on Windows also the command shell that runs a .cmd or .bat file), and why it waits, and whether you declined or revoked it, then the servers you allowed and when you allowed each. Each server is allowed on its own, so two servers started with npx never share an answer. Values of environment variables stay hidden, except for the ones that change what runs, such as PATH and NODE_OPTIONS. delorun mcp accept <server> shows the server's command and starts it after you confirm at a terminal, and delorun mcp decline <server> keeps it stopped until its command or settings change.
  • delorun mcp revoke <server> shows an allowed server, and after you confirm at a terminal withdraws it and stops it; it stays stopped until its command or settings change or you accept it again, and your other servers stay allowed.
  • delorun doctor checks Docker, the format of the key of the provider new chats start on, the Delorun home's permissions and whether the studio's port is free, and says whether the running release was checked against the release log: verified, refused, or unchecked with how long it has been and why, and what the last check for a newer release found. It sends nothing to the provider and starts no container.
  • delorun doctor checks the port the profile's studio uses, and a port held by this home's own Delorun is reported as in use by Delorun, not as a failure.
  • On Linux, delorun doctor checks whether bubblewrap can sandbox commands. Where it cannot, every sandboxed command is refused on a machine with a login session; the line says why, and where Ubuntu's AppArmor restriction on user namespaces blocks it, points to how to allow bubblewrap alone.
  • delorun doctor accepts a studio port of 0, which asks the system for a free port at each start, and prints no YAML warning for a profile that holds a !!js expression.
  • delorun doctor checks Docker, the DeepSeek API key's format, the Delorun home's permissions and whether the studio's port is free, and says whether the running release was checked against the release log: verified, refused, or unchecked with how long it has been and why, and what the last check for a newer release found. It sends nothing to DeepSeek and starts no container.
  • delorun doctor checks your plugins: it lists what is installed in your profile, where each plugin came from and whether it is turned on, and warns or fails when a plugin needs another Delorun or DeepSeek Harness version, is hidden by a plugin Delorun ships under the same name, is turned on but not installed, did not load at the last start, or is left out because Delorun is in safe mode. It reads files only and runs no plugin code.
  • Delorun's own processes keep operational logs at fixed locations under your Delorun home. Every record is redacted before it is written, so keys, tokens and cookie values Delorun loads never reach a log; logs rotate at 10 MiB, keep 5 files, and are deleted 14 days after they were written while Delorun runs. Your chats' session logs are not touched.
  • delorun logs lists every log's location and shows a log's recent records, filtered by chat, turn or age, follows new records, prints the stored JSON, and clears or prunes logs on request.
  • delorun plugin asks before it runs a build pnpm refused, such as the prepare script of a plugin installed from git, or takes --allow-build <name> for one package. The question starts on no, and nothing allows every build. With Delorun's install check on, only the installation runs again, on the lockfile the check read; a lockfile that differs from it is refused and the profile put back.
  • delorun plugin dev <folder> links a plugin you are writing into your profile and keeps the running studio loading its latest code each time you save, building it first when it has a build script, until you press Ctrl+C; the plugin stays installed afterwards.
  • delorun plugin new <name> creates a plugin folder that builds and installs on the running release: a tool for the agent, an agent preset, a page in the studio's Settings, or a bundle that changes other plugins' settings, chosen with --kind. It prints the next commands: build the plugin, check it with delorun plugin check, and add it to your profile.
  • delorun recover shows where your profile stands and offers the way back: roll back to the last saved snapshot of the profile, or restore any earlier saved version. Both list the plugins, build approvals and version exemptions they bring back before anything is written, and a plugin version that has been revoked comes back turned off, with the reason shown.
  • delorun recover --safe-mode makes the next start leave out the third-party bundles and the rows that load them, so a plugin that cannot start no longer keeps the home from opening. The profile itself is untouched, with every row, setting and ejected plugin still there, and delorun recover --exit-safe-mode loads all of it again.
  • A restore or a rollback keeps Delorun's own records in the profile, its version exemptions, its safety record and the last update report, when the saved version does not hold them, instead of removing them. It waits for the plugin manager while that is changing the profile, and refuses with nothing changed if the manager does not finish within two minutes.
  • Under WSL, delorun open and delorun start --open hand the studio's link to the browser BROWSER names when it is set, and to the Windows default browser only when it is not; delorun open --print prints the link and opens nothing.
  • delorun verify lists what this Delorun runs: the release's version, commit and digests, the trusted root and its key, the launcher that started it, when every runtime file was last hashed and what the start check did, the plugins with where each came from, your changes, the rows your patch layers add with their !!js count, the skill folders including ~/.agents, and the MCP servers. --json carries the same list under bill. A part Delorun cannot check yet says so instead of reading as a pass.
  • The messages delorun setup prints, the studio's starter prompts and the chat refusals use British English, such as "catalogue", "summarise" and "organise", and a check keeps American spellings out of Delorun's own text.
  • Command output says "Delorun", not "Delorun", in sentences and drops internal labels: delorun logs heads its list "Logs under …" and no longer lists a relay you may not run, delorun verify lists the checks it runs and says in one line how many more Delorun does not include, and delorun reach status says whether remote access is on or off and how to turn it on.
  • delorun status prints whether Delorun is running, the studio address, the version and the running chats. The process id, the start id, the home folder and the profile appear with --verbose, and --json still carries them.
  • delorun start that fails says "Delorun did not start", points to delorun logs and delorun doctor, and when another program holds the studio's port it says so and offers delorun setup profile or port 0. delorun import-home without a DeepSeek Harness folder says there is none and offers --from. delorun workspace with no action says to choose full-access or external-agents.
  • delorun devices approve and delorun devices elevate stop at once, with a message, when they have no terminal to type the code in, instead of waiting for five minutes.
  • delorun --version prints "Delorun" on its first line, and delorun setup and the default workspace's message name Delorun too.
  • delorun plugin list on a new profile says "No plugins added to the profile default." instead of printing nothing, delorun plugin on a profile that does not exist yet says "delorun: initialized profile …" where it said "dsh: …", and delorun plugin with no arguments shows Delorun's usage, not pnpm's message. Its other lines also say "delorun:" where they said "dsh:": warnings, the failed-command line and the rejected-installation lines, and the hints name delorun plugin allow-version, the command that grants the exemption. <!-- us-spelling: quoted output -->
  • delorun open --print and other output piped into a reader that stops early, such as head -1, ends quietly with exit 0 instead of reporting "write EPIPE".
  • Each delorun command now loads only the code it needs, so delorun --version and delorun --help answer in a fraction of the time they took, and status, logs, trash and the other short commands start sooner too. What the commands print and the exit codes are the same.
  • delorun recover takes its action as a word: status, rollback, restore <version>, safe-mode and exit-safe-mode replace --rollback, --restore, --safe-mode and --exit-safe-mode.
  • delorun stop and updates now wait for chats that are still answering.
  • Every delorun command starts about 9 seconds sooner: on a full-size runtime the launcher's check takes under a second instead of about ten, because it compares each file with what it recorded after the file was last hashed, and hashes only the files that changed since. It still hashes every file at install, on delorun verify, and at least every 7 days; DELORUN_RUNTIME_FULL_CHECK_DAYS sets that interval from 0, every start, to 30 days. Disk corruption that leaves a file's metadata alone is found by that full check, not by the next start. On macOS, Windows, overlay file systems such as a container's, and network or other file systems whose timestamps the computer does not set itself, every start still hashes every file.
  • An update no longer reads every file of a runtime again: it hashes the new release's files as it writes them, and checks the running release before it starts and the new one before and after the switch the way every start does, so an update takes about 30 seconds less on a full-size runtime. An install no longer reads every file it has just written again.
  • delorun headless without the API key its model needs (DeepSeek's unless the profile selects another provider) stops at once and says which variable to set or run delorun setup key, instead of linking the profile first and ending in a provider error. Its progress line goes to standard error, so standard output holds only the answer, and delorun headless --help no longer touches the profile.
  • A chat turn that starts before Delorun's start check has finished no longer waits without a message: after 60 seconds the turn ends and says that the start check did not finish, that the message was not sent, and to start Delorun with delorun start and send it again; delorun status and delorun logs show what the start is doing. This only happens when Delorun was booted without delorun's own start, or when the start's check never completes.
  • delorun verify lists the plugin changes you approved, by name and folder, then apart from them the changes that loaded without review, with protection off or while it was off, then everything present that you did not approve: changes waiting for your review and anything Changes does not find as it keeps it. Its summary line then never reads as a plain pass, and it exits 1 only when something is not as Changes keeps it. A run from a source checkout or a development build says there is no signed release to compare its files with.
  • delorun doctor reports your changes: the protection setting, any plugin you are working on, and for each plugin you link from a folder whether it loaded at the last start, whether it runs the content you approved or content that loaded without review, the dsh and Delorun versions it requires and whether it changes a consent, a guard or the sandbox policy. When a plugin did not load or the start failed, it names the plugin and the change to undo.
  • Fixed: A write lock left behind by a process that was killed while taking over a dead writer's lock no longer blocks later writers: the leftover claim is removed after ten seconds.
  • Fixed: delorun update names why an automatic rollback did not finish. It blames the missing chat-data copy only when that is the reason, and otherwise says that going back stopped and where to look.
  • Security: The release an update starts no longer inherits variables that load code into Node, its loader or OpenSSL, such as NODE_OPTIONS or LD_PRELOAD, even when a .env file set them for the running release; the launcher already dropped them from every start.
  • Security: delorun verify hashes every runtime file before its own code runs, whatever the start check's record says, and then checks every file again. The record has no key, so a program running as you can rewrite it to hide a changed file, the runtime's Node and delorun itself included, from ordinary starts until the next full check, which comes at least every 7 days; delorun verify still finds it.

Compatibility

  • Delorun's own changes are carried onto a newer DeepSeek Harness release by a maintainer command, which stops with a report of what no longer applies instead of dropping a change.
  • Delorun records a checksum for each DeepSeek Harness file it edits, so the command notices when one of those files changed underneath it and refuses to carry a change that was edited after it was recorded.
  • delorun --version prints which Delorun this is and which DeepSeek Harness it runs on, one line each, and --json prints the same two as one line for scripts.
  • A plugin can say which Delorun versions it works with, and Delorun honours it: a plugin that asks for a newer Delorun than the one you run is refused at install and disabled at start, and the message tells you which Delorun you have and which DeepSeek Harness it runs on. A plugin that asks for nothing behaves exactly as before.
  • Settings names Delorun's version and, beneath it, the DeepSeek Harness version it runs on.
  • delorun plugin check <folder> tells a plugin author, without running the plugin, what its declared DeepSeek Harness and Delorun versions allow on the Delorun you run, what it leaves undeclared, and which Delorun range to declare to target this release; Delorun's documentation states what each Delorun version promises a plugin.
  • A script that changes something through a Host's HTTP API over plain HTTP at an address other than this computer's, such as a name in trustedHosts or the address the Host listens on, must send an Origin header naming that address, such as Origin: http://192.0.2.5:3080; without one the Host answers "forbidden", because a web page could send the same request. Requests on this computer, over HTTPS and from the studio itself are unaffected.
  • The Host answers "bad request" to a request with more than one Host header, on every address it serves, and holds a request for a path such as /x/../api/... to the same rules as one for /api/....
  • Fixed: A script, or the desktop app's own requests, that talks to a Delorun Host on the same computer with the Host's cookie is accepted again; the Host had answered "forbidden" to any request that changes something and states no origin. A request from a web page on another site or another local port is still refused.

From upstream

  • Based on DeepSeek Harness dsh-v0.2.2-rc.3.