RedMirror Reflection now runs inside DeepSeek’s harness

RedMirror Reflection 0.4.0 plugs into deepseek-harness (dsh), DeepSeek’s open coding-agent harness, with a single command. Once wired in, the small open model you already run in dsh can find real security bugs and prove each one, because a compiled kernel, not the model, verifies every finding with a reachable attack path.

RedMirror Reflection 0.4.0 plugs into deepseek-harness (dsh), DeepSeek’s open coding-agent harness. One command wires it in, and the agent you run there can find real security bugs and prove each one before they ship. No new plumbing: RedMirror is a single binary that speaks the same tool protocol dsh already loads.

How do you wire RedMirror in with one command?

Install the binary, activate your licence, and point RedMirror at your harness:

$ curl -fsSL https://dist.redmirror.io/install.sh | sh
$ redmirror-reflect license activate <your-token>
$ redmirror-reflect init dsh        # wires RedMirror into deepseek-harness

That writes a small overlay dsh loads at startup and drops in the RedMirror skill, so your agent gains the reflection tools as first-class tools. Then you launch dsh and ask, in plain language, for a proof rather than an opinion:

$ dsh --profile headless --patch .dsh/reflection.cordis.yml \
      "find and prove a security bug in this checkout"

What does a run look like?

We gave a cheap model a plain brief and let it vibecode a checkout API: a cart, add-item, apply-coupon, confirm-and-charge. It runs, and on the happy path it’s perfect. Here is the coupon handler it wrote:

// checkout.js  (the vibecoded version)
const coupons = { SAVE10:{type:'percent',value:10}, SAVE20:{type:'percent',value:20},
                  TENOFF:{type:'flat',value:1000} };            // $10 off

function applyCoupon(id, code) {
  const c = carts[id]; if (!c || c.paid) return;
  const d = coupons[code]; if (!d) return;
  c.coupon = code;                                 // no check whether one is already applied
  const off = d.type === 'percent'
    ? Math.floor(c.totalCents * d.value / 100)
    : d.value;                                     // a flat coupon can be larger than the total
  c.totalCents = c.totalCents - off;               // no floor, so the total can go below zero
}

Nothing jumps out. So, running inside dsh (driven by a small open model, the kind you can host yourself), we asked RedMirror to state the invariants a payment flow must hold and prove whether they can break. It modelled the cart as a state machine and a compiled kernel searched every reachable state for a way in. Two invariants, both refuted, each with the exact sequence of calls that reaches the bad state:

Invariant 1: a cart carries at most one coupon. Verdict: REFUTED.
Reachable path: newCart(id) → applyCoupon(id, "SAVE10") → applyCoupon(id, "SAVE20"). The handler assigns the coupon without checking for an existing one, so they stack.

Invariant 2: the charged total is never negative. Verdict: REFUTED.
Reachable path: newCart(id) → addItem(id, 500) → applyCoupon(id, "TENOFF"). The flat $10 coupon is subtracted with no floor, so on a $5 cart the charged total lands at −$5, a checkout that charges a negative amount.

# RedMirror Reflection inside deepseek-harness (dsh)

$ redmirror-reflect init dsh
reflection: installed the flow for deepseek-harness (dsh).
  tools  ->  .dsh/reflection.cordis.yml      (Cordis overlay: mounts reflection via dsh-mcp-client)
  skill  ->  .dsh/skills/reflection/SKILL.md (auto-discovered by dsh's skill provider)
Launch dsh with the overlay so it picks up the reflection server:
  dsh --profile headless --patch "$PWD/.dsh/reflection.cordis.yml" "find and prove a security bug"

$ dsh --profile headless --patch .dsh/reflection.cordis.yml \
      --patch openrouter.cordis.yml "prove any checkout bug in checkout.js"

## Security Analysis of checkout.js

Using RedMirror reflection tools, I confirmed two vulnerabilities in checkout.js:

### 1. Cart can hold more than one coupon
  Reachable sequence:
    newCart('test')              -> { totalCents: 0, coupon: null }
    applyCoupon('test','SAVE10')  -> { coupon: 'SAVE10' }
    applyCoupon('test','SAVE20')  -> { coupon: 'SAVE20' }   (overwritten)
  Violates: "a cart carries at most ONE coupon."

### 2. Cart can be charged a negative total
  Reachable sequence:
    newCart('test')              -> { totalCents: 0 }
    addItem('test', 500)         -> { totalCents: 500 }   ($5.00)
    applyCoupon('test','TENOFF')  -> subtract 1000 -> { totalCents: -500 }  (-$5.00)
  Violates: "the charged total is never negative."

Both confirmed by the kernel with concrete attack paths.

$ grep -oE "REFUTED|GROUNDED" .redmirror-reflect/session.jsonl | sort | uniq -c
      2 GROUNDED

The agent reported only what the kernel confirmed, each with a replayable path. Not a hunch, a proof. Fix both by rejecting a second coupon and flooring the total at zero, and RedMirror re-checks and comes back clean.

Why is it a one-liner?

dsh is built so that everything is a plugin. RedMirror is a single binary that runs as a tool server your agent connects to, so wiring it in is configuration, not code. And because the proving is done by the kernel, not the model, it works with whatever model you already run in dsh. You do not need a frontier model to get a trustworthy finding: a small local or open model proposes, and a compiler signs off. Your code and your model never leave your machine.

Frequently asked questions