DeepSeek-Reasonix Limitations: Context Windows, Sandboxes, and Configuration Constraints

DeepSeek-Reasonix imposes hard boundaries on context length (compaction at ~80% of 1M tokens), step execution limits, file-system sandboxing, and plugin transports, with certain security-critical settings restricted to user-global configuration only.

DeepSeek-Reasonix is a Go-based coding agent that automates software engineering tasks through LLM-driven tool execution. While powerful, the system enforces specific architectural constraints around memory management, security isolation, and extensibility that users must understand to avoid runtime failures. These limitations are explicitly defined in docs/SPEC.md and enforced across the codebase from internal/agent/agent.go to internal/sandbox/sandbox.go.

Context Window and Automatic Compaction

DeepSeek-Reasonix enforces a default context_window of 1,000,000 tokens per provider configuration. When accumulated prompts exceed approximately 80% of this threshold, the system triggers automatic compaction implemented in internal/agent/agent.go. This process irreversibly summarizes older messages into compressed archives, removing the originals from the active session context to free token budget. While raw JSONL archives persist on disk for audit purposes, the granular message history cannot be restored without terminating the current session and starting fresh.

The built-in history and memory tools rely on BM25 indexing over these archived JSONL files. This imposes critical constraints: large binary blobs are never indexed, retrieval is limited to the specific fields included in the index, and very old sessions may be pruned according to user-configurable retention policies, potentially creating gaps in historical context.

Execution Step Limits and Global Constraints

The executor and planner operate under hard caps defined by agent.max_steps and agent.planner_max_steps. While defaults of 0 indicate unlimited execution, users can enforce finite boundaries to prevent runaway tool-call loops. According to docs/SPEC.md, these limits are strictly user/global only, configured in ~/.reasonix/config.toml and parsed by cmd/reasonix/main.go. They cannot be overridden by project-level reasonix.toml files, preventing malicious or accidental modifications to execution boundaries within shared repositories.

File System and Sandbox Security Boundaries

File-mutating tools—including write_file, edit_file, and bash with redirection—are confined to the workspace root (defaulting to the current working directory) plus any paths explicitly listed under sandbox.allow_write. This Phase 0 confinement is implemented in internal/sandbox/sandbox.go.

The permission layer in internal/permission/permission.go operates on a strict hierarchy: deny rules override ask and allow policies unconditionally. Even when permissions mode is set to "allow", explicitly denied patterns remain blocked.

OS-Level Sandbox Gaps

While macOS leverages the Seatbelt sandbox for Bash execution, Linux and Windows lack comparable Phase 1 OS-level isolation. On these platforms, the system falls back to Phase 0 path confinement only, leaving Bash operations more vulnerable to host-system side effects. This architecture is documented in docs/SPEC.md as a known roadmap limitation, with Bubblewrap or Landlock support listed as future Phase 1 implementations.

Plugin Transport and Integration Limits

The plugin system in internal/plugin/plugin.go prioritizes stdio transport as the stable, first-class integration method. HTTP plugins remain experimental, and the legacy sse transport is deprecated—attempting to configure it returns an explicit error. Additionally, remote authentication mechanisms such as OAuth 2.0 or token refresh are not yet implemented, limiting integration with authenticated remote services.

Two-Model Collaboration Architecture

When agent.planner_model specifies a different provider than the executor, internal/agent/agent.go instantiates a Coordinator that runs both models in isolated sessions. The system cannot switch models mid-session without breaking cache-stable prefixes, forcing mixed-model workflows to span two distinct sessions with separate context windows and message histories.

Dependency and Configuration Hierarchy Restrictions

Certain security-critical fields—including step limits, sandbox roots, and permission mode—are restricted to user-global configuration only. As parsed in cmd/reasonix/main.go, these values cannot be overridden by project-level reasonix.toml files, ensuring consistent security postures across different working directories.

The build system also imposes strict dependency constraints. The binary restricts imports to the Go standard library plus a single pure-Go TOML parser. Any third-party addition must be lightweight and pure-Go; otherwise, the single-binary, cross-compile promise documented in docs/SPEC.md is compromised.

Configuration Examples for Working Within Limits

The following configurations demonstrate how to operate within DeepSeek-Reasonix's architectural constraints.

Limiting Tool-Call Steps Globally

Step limits must be set in the user-global configuration file, not project-level files:

# ~/.reasonix/config.toml

[agent]
max_steps = 20          # executor limited to 20 tool-call rounds

planner_max_steps = 5   # planner limited to 5 read-only rounds

Configuring File System Confinement

Restrict file-mutating tools to specific directories:

[sandbox]
workspace_root = "./my-project"   # restrict all file-mutating tools here

allow_write = ["/tmp"]            # additional safe write locations

Denying Dangerous Bash Commands

Use explicit deny rules that override all other permission modes:

[permissions]
mode = "ask"
deny = ["Bash(rm -rf*)", "Bash(git push*)"]   # hard-blocked in every mode

allow = ["Bash(go test:*)"]

Enabling Two-Model Collaboration

Configure separate planner and executor models to run in isolated sessions:

[agent]
planner_model = "deepseek-pro"   # separate Low-freq planner

Adding a StdIO Plugin

Register stable plugins using stdio transport:

[[plugins]]
name = "example"
command = "reasonix-plugin-example"
args = []
type = "stdio"  # default and recommended transport

Summary

DeepSeek-Reasonix operates within clearly defined boundaries that affect scalability, security, and extensibility:

• Context management triggers irreversible compaction at ~80% of the 1M token window, with BM25 indexing limitations on archived data.
• Execution control enforces step limits through user-global configuration only, preventing project-level overrides.
• Security isolation confines file operations to the workspace root plus explicit allow-lists, with OS-level sandboxing only available on macOS.
• Integration constraints limit stable plugin support to stdio transport, with HTTP experimental and remote authentication unimplemented.
• Architecture limits require two-model workflows to use isolated sessions and restrict dependencies to the Go standard library plus pure-Go TOML parsing.

Frequently Asked Questions

Can I override step limits in my project's reasonix.toml?

No. According to docs/SPEC.md, fields including agent.max_steps and agent.planner_max_steps are explicitly marked as user/global only. These values must be configured in ~/.reasonix/config.toml and are parsed by cmd/reasonix/main.go at startup. This restriction prevents malicious repositories from disabling execution boundaries or causing unexpected resource consumption by allowing unlimited steps.

What happens when DeepSeek-Reasonix reaches its context limit?

When the accumulated prompt exceeds approximately 80% of the configured context_window (default 1,000,000 tokens), internal/agent/agent.go triggers automatic compaction. The system summarizes older messages and archives the originals to JSONL on disk, freeing context space. This process is irreversible for the active session; once compacted, the detailed message history cannot be restored without starting a new session.

Does DeepSeek-Reasonix provide OS-level sandboxing on Linux?

No. As of the current implementation documented in docs/SPEC.md, Phase 1 OS-level sandboxing for Bash is only available on macOS via the Seatbelt framework. Linux and Windows implementations rely on Phase 0 path confinement implemented in internal/sandbox/sandbox.go, which restricts file operations but does not jail the process at the OS level. Bubblewrap or Landlock support is listed as a future roadmap item.

Can I use HTTP-based plugins for remote tool integration?

HTTP plugins are supported but remain experimental according to docs/SPEC.md and internal/plugin/plugin.go. The system treats stdio as the first-class transport. Additionally, the legacy sse transport is deprecated and will return an error if configured. Remote authentication mechanisms including OAuth 2.0 flows are not yet implemented, limiting HTTP plugin usability with authenticated endpoints.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}