DeepSeek Harness on Android: an AI agent that drives the phone without root

An APK wrapper around the DeepSeek Harness engine

This repository packages the DeepSeek Harness engine as an Android application you can install directly, with the package name com.deepseek.harness, so there is no Termux setup and no command to type. The upstream engine is the @deepseek-ai/dsh package, and the version carried by the current release is 0.2.1-rc.2, described as the current upstream next tag. The plugin ecosystem and the RPC API of the engine are preserved, and the front end uses the engine's own interface. The repository itself is a Java Android application with the wrapper, console, plugins and tooling all in one tree, alongside directories for console themes, engine patches, plugins and tools. The homepage is dshaa.xin, and the licence is MIT. What the wrapper adds over running the engine elsewhere is the ability to reach Android's own privileges from inside the agent loop. Installing it means downloading the APK from the project releases page and installing it on the device; there is no command to run and no Termux environment to set up, and the documentation points at the releases page for the full instructions. The releases also carry several build variants, and the newest one is described as the official and Lite coexisting build with a compatibility build, so pick the package that matches the device before installing.

Three privilege channels, and the agent picks between them

The design decision that defines this project is that privilege is layered rather than all or nothing. Root is preferred: if the device is rooted, commands go through the su channel. Where root is absent, Shizuku provides the path to a system shell, and the routing between them is automatic rather than a setting you toggle per task. The Shizuku path was reworked in a later version so that privileged command execution goes through the Shizuku API inside the app process, with a local route and random token authentication, replacing an earlier rish subprocess approach that produced intermittent timeouts on phones. The third channel needs no privilege at all: an accessibility screen assistant lets the agent read the screen, tap, type, scroll and take accessibility screenshots. Without any of these, the app still works for file reading, preview and editing, which only need the all files access permission, and the agent guides you to authorise when a privileged action is needed.

The browser plugin works from DOM snapshots, not screenshots

The AI browser is the part of the system that most changes what an agent can do on a phone. Given an address, the agent opens the page, reads a structured element table that includes stable references, finds the right item, clicks or types, confirms the click landed, and then reads the body text. The positioning comes from semantic DOM snapshots rather than guessing from pixels, and each reference is an element identity fingerprint that stays stable across snapshots. A snapshot option supports true diffing, so a page that has not changed costs only a few dozen tokens. The tool set has ten entries, covering opening, snapshotting, finding, clicking, typing, reading, navigation, scrolling and tab management, and only http and https are allowed, with access to the local loopback address prohibited. The browser runs in a separate process since a later version, so a page that crashes does not take down the console or the engine, and multiple tabs are supported, with a reference from one tab blocked when you try to use it in another.

The console keeps a self-check ledger and a rescue path

The app opens into its own console before the engine starts, with pages for extraction, permissions, plugin toggles and logs, so you are not waiting on an engine boot to see what is happening. A kernel self-check ships a manifest of every engine file with its path, size and sha256, and a quick check reports which file is missing or altered, with a full checksum pass available as well. Every check and every repair is written to a JSON ledger in the heal-ledger directory, so what was changed and on what basis stays inspectable. The self-check is read only, and cleanup touches only stale dsh entries inside the engine's own @deepseek-ai namespace, never user data or third party plugins. A rescue page offers a safe mode start and exit that bypasses the user layer without touching sessions or credentials, plus a full data export and restore from backup for moving to a new phone.

Local services demand a token and the engine can be patched without losing work

Four local services bound to the loopback interface, covering notifications, accessibility, the virtual screen bridge and the virtual screen core, all require a token and refuse to serve without one. The virtual screen jar additionally carries a sha256 check against the bundled package and refuses to start if it was altered, re-extracting itself in that case. A separate feature lets you keep modifications you made to engine files: the console saves your edits as patches, replays them after every official sync on startup, and can restore the shipped files exactly. The baseline for deciding what counts as your change is the factory state rather than the shipped manifest, so files the app itself modifies at runtime are not misread as your edits. Only source, configuration and images are collected, nothing compiled, and a failed replay never stops the engine from starting.

The virtual screen runs an app without taking over yours

The vscreen plugin lets the agent create a virtual display separate from the main screen, launch an application into it and interact with it there while your own screen stays usable. A floating window shows the virtual screen live as an H.264 video stream, and it can be dragged and pinch zoomed, so you can watch what the agent is doing. This implementation was ported from an open source project called Operit, and the third party notices file records the LGPL-3.0 licence of that project. The plugin returns the package, component and display id it launched, and it computes screen change from sha256 hashes of screenshots taken before and after, so a command that succeeded without changing the picture is reported honestly. The screenshot tool can wait for the first frame and returns a specific error code for a display that does not exist, has not rendered, or has not produced a frame.

The terminal is the honest weak spot

A terminal tab existed for a long time and was basically unusable, and the project lists the three root causes it fixed. The terminal would not open, because the default shell pointed at a Termux path that does not exist, the process check did not recognise android, the backend depended on a native node-pty, and the bash wrapper script injected by the app was given a bash specific rc file. The keyboard would drop out because a hidden zero size xterm input field was mistaken for an attempt to steal focus. Typed characters never reached the screen because an ordinary pipe was used to fake a pseudo terminal, which produced no prompt, no echo and full buffering. Commands now execute and output returns, but the project is explicit that a phone has no real pseudo terminal, that resize is a no-op and that there is no job control. Read that caveat as the boundary of the whole approach.

Python, npm and plugin sources turn the agent into a small build host

The environment shipped inside the app is more than a chat window with a shell. Python 3.14.6 with pip is bundled, and virtual environments work, so the agent can write and run scripts for data processing, parsing and statistics without any installation step on your part. npm and npx 11.20.0 are bundled too, and node packages the agent installs produce command line tools that actually execute, with the adaptation for the fact that Android has no /usr/bin/env. Plugins can be loaded from a local directory, a package name or a GitHub address, and pnpm and git 2.55.0 are included, with the certificate chain for curl and git fixed at startup by composing a bundle from the system trust store. Data survives uninstalls, because the engine root is externalised to a directory on external storage so a reinstall or upgrade does not wipe the agent's runtime changes. The compatibility build goes further and embeds GeckoView instead of relying on the system WebView, which lets older devices with an old Chromium run, at the cost of roughly 250MB of size and a higher minimum SDK of 26.

Editorial conclusion

Adopt this APK if you want an on-device AI agent that can install apps, drive the screen and edit files on an Android phone, and if you are willing to grant Shizuku, root or accessibility access. Do not adopt it for the terminal, since the project states plainly that there is no real pseudo terminal, that resize does nothing and that job control is absent, and do not expect the browser plugin to reach anything other than http and https origins because loopback access is blocked by design. Before installing, read the releases page for the variant you want, since official and Lite packages coexist, and check the third party notices file, because the virtual screen implementation is ported from a project under a different licence.

Frequently asked questions

Official sources

1. License: MIT
2. Project website
3. README
4. Releases
5. woaiys3/deepseek-harness-android-app on GitHub