feat: add project-composable DeepSeek Harness microVMs

Share the live project cwd, DSH home and skills read-write while running guest root behind rootless QEMU and Bubblewrap. Reuse project toolchains, expose configurable SSH-forwarded web access, and launch the latest official DSH. Include the project template, operating guide, offline boot and mount tests, and shell checks.
2026-09-06 12:45:36 -05:00
parent 221e0b33cc
commit 35ca88d517
14 changed files with 1219 additions and 0 deletions
@@ -0,0 +1,27 @@
+# Project + DeepSeek Harness microVM
+
+`project.nix` is the shared toolchain for `nix develop` and the guest.
+`flake.nix` sets RAM, vCPUs and networking. Run from the project directory:
+
+```sh
+nix run .#agent               # boots with cwd mounted read-write at its original path
+# Another terminal in the same directory:
+nix run .#agent -- url        # private browser login URL
+nix run .#agent -- ssh        # root shell, starting in the same project cwd
+nix run .#agent -- stop
+```
+
+`$DSH_HOME` (default `~/.dsh`) and `${DSH_AGENTS_HOME:-~/.agents}/skills` are
+also mounted **read-write**. No other home directories or host sockets are shared.
+The first run creates missing DSH/skills directories. Existing DSH home must be
+private (`chmod 700 ~/.dsh`). Credentials, settings, profiles and skills are live
+shared files, not copied into the Nix store. Select the project's original
+absolute path in the DSH UI; `/workspace` is also an alias.
+
+DSH resolves `@deepseek-ai/dsh@latest` inside the VM on startup. Nix packages
+follow the rolling Nixpkgs input: `nix flake update`, then restart the VM.
+
+See `/etc/nix/AGENT-VM.md` for the full guide and security boundaries. The reusable
+input lives at `/etc/nix/agent-vm`; replace the local input with your Git remote
+when sharing this project. Keep backups: the agent can modify/delete the mounted
+project and its shared DSH configuration/credentials/skills.