# DeepSeek-Reasonix Limitations: Context Windows, Sandboxes, and Configuration Constraints

> Discover DeepSeek-Reasonix limitations including context window constraints, sandbox restrictions, and configuration limits. Learn how to navigate these boundaries for optimal performance.

- Repository: [YHH/DeepSeek-Reasonix](https://github.com/esengine/DeepSeek-Reasonix)
- Tags: deep-dive
- Published: 2026-06-26

---

**DeepSeek-Reasonix imposes hard boundaries on context length (compaction at ~80% of 1M tokens), step execution limits, file-system sandboxing, and plugin transports, with certain security-critical settings restricted to user-global configuration only.**

DeepSeek-Reasonix is a Go-based coding agent that automates software engineering tasks through LLM-driven tool execution. While powerful, the system enforces specific architectural constraints around memory management, security isolation, and extensibility that users must understand to avoid runtime failures. These limitations are explicitly defined in [`docs/SPEC.md`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/docs/SPEC.md) and enforced across the codebase from [`internal/agent/agent.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/internal/agent/agent.go) to [`internal/sandbox/sandbox.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/internal/sandbox/sandbox.go).

## Context Window and Automatic Compaction

DeepSeek-Reasonix enforces a default `context_window` of 1,000,000 tokens per provider configuration. When accumulated prompts exceed approximately 80% of this threshold, the system triggers automatic compaction implemented in [`internal/agent/agent.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/internal/agent/agent.go). This process irreversibly summarizes older messages into compressed archives, removing the originals from the active session context to free token budget. While raw JSONL archives persist on disk for audit purposes, the granular message history cannot be restored without terminating the current session and starting fresh.

The built-in `history` and `memory` tools rely on **BM25** indexing over these archived JSONL files. This imposes critical constraints: large binary blobs are never indexed, retrieval is limited to the specific fields included in the index, and very old sessions may be pruned according to user-configurable retention policies, potentially creating gaps in historical context.

## Execution Step Limits and Global Constraints

The executor and planner operate under hard caps defined by `agent.max_steps` and `agent.planner_max_steps`. While defaults of `0` indicate unlimited execution, users can enforce finite boundaries to prevent runaway tool-call loops. According to [`docs/SPEC.md`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/docs/SPEC.md), these limits are strictly **user/global only**, configured in `~/.reasonix/config.toml` and parsed by [`cmd/reasonix/main.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/cmd/reasonix/main.go). They cannot be overridden by project-level [`reasonix.toml`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/reasonix.toml) files, preventing malicious or accidental modifications to execution boundaries within shared repositories.

## File System and Sandbox Security Boundaries

File-mutating tools—including `write_file`, `edit_file`, and `bash` with redirection—are confined to the **workspace root** (defaulting to the current working directory) plus any paths explicitly listed under `sandbox.allow_write`. This Phase 0 confinement is implemented in [`internal/sandbox/sandbox.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/internal/sandbox/sandbox.go).

The permission layer in [`internal/permission/permission.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/internal/permission/permission.go) operates on a strict hierarchy: **deny** rules override **ask** and **allow** policies unconditionally. Even when permissions mode is set to `"allow"`, explicitly denied patterns remain blocked.

### OS-Level Sandbox Gaps

While macOS leverages the Seatbelt sandbox for Bash execution, Linux and Windows lack comparable Phase 1 OS-level isolation. On these platforms, the system falls back to Phase 0 path confinement only, leaving Bash operations more vulnerable to host-system side effects. This architecture is documented in [`docs/SPEC.md`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/docs/SPEC.md) as a known roadmap limitation, with Bubblewrap or Landlock support listed as future Phase 1 implementations.

## Plugin Transport and Integration Limits

The plugin system in [`internal/plugin/plugin.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/internal/plugin/plugin.go) prioritizes **stdio** transport as the stable, first-class integration method. HTTP plugins remain experimental, and the legacy `sse` transport is deprecated—attempting to configure it returns an explicit error. Additionally, remote authentication mechanisms such as OAuth 2.0 or token refresh are not yet implemented, limiting integration with authenticated remote services.

## Two-Model Collaboration Architecture

When `agent.planner_model` specifies a different provider than the executor, [`internal/agent/agent.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/internal/agent/agent.go) instantiates a `Coordinator` that runs both models in **isolated sessions**. The system cannot switch models mid-session without breaking cache-stable prefixes, forcing mixed-model workflows to span two distinct sessions with separate context windows and message histories.

## Dependency and Configuration Hierarchy Restrictions

Certain security-critical fields—including step limits, sandbox roots, and permission mode—are restricted to **user-global configuration only**. As parsed in [`cmd/reasonix/main.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/cmd/reasonix/main.go), these values cannot be overridden by project-level [`reasonix.toml`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/reasonix.toml) files, ensuring consistent security postures across different working directories.

The build system also imposes strict dependency constraints. The binary restricts imports to the Go standard library plus a single pure-Go TOML parser. Any third-party addition must be lightweight and pure-Go; otherwise, the single-binary, cross-compile promise documented in [`docs/SPEC.md`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/docs/SPEC.md) is compromised.

## Configuration Examples for Working Within Limits

The following configurations demonstrate how to operate within DeepSeek-Reasonix's architectural constraints.

### Limiting Tool-Call Steps Globally

Step limits must be set in the user-global configuration file, not project-level files:

```toml

# ~/.reasonix/config.toml

[agent]
max_steps = 20          # executor limited to 20 tool-call rounds

planner_max_steps = 5   # planner limited to 5 read-only rounds

```

### Configuring File System Confinement

Restrict file-mutating tools to specific directories:

```toml
[sandbox]
workspace_root = "./my-project"   # restrict all file-mutating tools here

allow_write = ["/tmp"]            # additional safe write locations

```

### Denying Dangerous Bash Commands

Use explicit deny rules that override all other permission modes:

```toml
[permissions]
mode = "ask"
deny = ["Bash(rm -rf*)", "Bash(git push*)"]   # hard-blocked in every mode

allow = ["Bash(go test:*)"]

```

### Enabling Two-Model Collaboration

Configure separate planner and executor models to run in isolated sessions:

```toml
[agent]
planner_model = "deepseek-pro"   # separate Low-freq planner

```

### Adding a StdIO Plugin

Register stable plugins using stdio transport:

```toml
[[plugins]]
name = "example"
command = "reasonix-plugin-example"
args = []
type = "stdio"  # default and recommended transport

```

## Summary

DeepSeek-Reasonix operates within clearly defined boundaries that affect scalability, security, and extensibility:

- **Context management** triggers irreversible compaction at ~80% of the 1M token window, with BM25 indexing limitations on archived data.
- **Execution control** enforces step limits through user-global configuration only, preventing project-level overrides.
- **Security isolation** confines file operations to the workspace root plus explicit allow-lists, with OS-level sandboxing only available on macOS.
- **Integration constraints** limit stable plugin support to stdio transport, with HTTP experimental and remote authentication unimplemented.
- **Architecture limits** require two-model workflows to use isolated sessions and restrict dependencies to the Go standard library plus pure-Go TOML parsing.

## Frequently Asked Questions

### Can I override step limits in my project's reasonix.toml?

No. According to [`docs/SPEC.md`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/docs/SPEC.md), fields including `agent.max_steps` and `agent.planner_max_steps` are explicitly marked as user/global only. These values must be configured in `~/.reasonix/config.toml` and are parsed by [`cmd/reasonix/main.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/cmd/reasonix/main.go) at startup. This restriction prevents malicious repositories from disabling execution boundaries or causing unexpected resource consumption by allowing unlimited steps.

### What happens when DeepSeek-Reasonix reaches its context limit?

When the accumulated prompt exceeds approximately 80% of the configured `context_window` (default 1,000,000 tokens), [`internal/agent/agent.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/internal/agent/agent.go) triggers automatic compaction. The system summarizes older messages and archives the originals to JSONL on disk, freeing context space. This process is irreversible for the active session; once compacted, the detailed message history cannot be restored without starting a new session.

### Does DeepSeek-Reasonix provide OS-level sandboxing on Linux?

No. As of the current implementation documented in [`docs/SPEC.md`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/docs/SPEC.md), Phase 1 OS-level sandboxing for Bash is only available on macOS via the Seatbelt framework. Linux and Windows implementations rely on Phase 0 path confinement implemented in [`internal/sandbox/sandbox.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/internal/sandbox/sandbox.go), which restricts file operations but does not jail the process at the OS level. Bubblewrap or Landlock support is listed as a future roadmap item.

### Can I use HTTP-based plugins for remote tool integration?

HTTP plugins are supported but remain experimental according to [`docs/SPEC.md`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/docs/SPEC.md) and [`internal/plugin/plugin.go`](https://github.com/esengine/DeepSeek-Reasonix/blob/main/internal/plugin/plugin.go). The system treats stdio as the first-class transport. Additionally, the legacy `sse` transport is deprecated and will return an error if configured. Remote authentication mechanisms including OAuth 2.0 flows are not yet implemented, limiting HTTP plugin usability with authenticated endpoints.