Crush vs dsh-superagent (DeepSeek)

Crush 82

v0.98.1 on 9 October 2026 on npm (30). 20 npm releases in the 90 days to 18 October, 0.86.0 to 0.98.1 (20). About 2,100 pull requests closed against 375 open, and 828 issues closed against 482 open, per shields.io badge counts read on 18 October (our GitHub record), with 514 commits in the 90 days to 18 October and new contributors signing the CLA most days. Reply times couldn't be read (12). No SDK, as with other harnesses. npm, Homebrew, Winget, Scoop, apt, yum and NUR builds track releases, and the latest npm version matches the latest tag (12). Dependabot, a go mod tidy check in CI and scheduled security scans, with the current CI state unconfirmed (8).

dsh-superagent (DeepSeek) 34

Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm latest is 0.2.1-rc.5 (29 October 2026) (4).

Crush 54

Local-package reading. @charmland/crush on npm, a Homebrew tap, Winget, Scoop, AUR, Nix, FreeBSD pkg, Charm's apt and yum repositories and release binaries, with supported platforms named in the README (20). A public build workflow runs go test -race on Linux, macOS and Windows for every push to main, over 314 test files, but GitHub pages and the API answered 403 so the current state is unconfirmed, and a 6 October commit fixed intermittent CI failures on all three platforms (17). 482 open and 828 closed issues, and 375 open against about 2,100 closed pull requests, per shields.io badge counts read on 18 October (our GitHub record). Over a third of all issues are still open, and how many are crashes or regressions, and how fast they're answered, couldn't be read (10). Release notes are generated from commit messages, with no CHANGELOG file and no breaking-change headings found. The legacy JSON config is deprecated in favour of crushrc while still loading, and the config docs say not breaking the config API matters to the maintainers (7). v0.98.1, before 1.0, with no stability statement (0).

dsh-superagent (DeepSeek) 15

Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (private: true in package.json, and the registry has no dsh-superagent). It installs from a git clone with pnpm install && pnpm build on top of @deepseek-ai/dsh@0.2.1-rc.3, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and pnpm check runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).

Crush 52

Harness reading, scored on what an agent or pipeline driving crush run has to supply. About 20 built-in tools, any of which permissions deny hides, MCP servers take per-server disabled_tools, and skills can be turned off or kept out of the model's list. No lazy loading of MCP tools found (17). No turn, time or cost limit on crush run, and the only output controls are --quiet and --verbose (6). Errors come back as plain messages with a non-zero exit, such as the one for an unconfigured provider, with no documented codes and no JSON error record (8). --session and --continue resume a run, and crush session list, show, last, rename and delete take --json (13). One argument starts a run and environment keys are picked up, but there's no SDK, and the HTTP API needs CRUSH_CLIENT_SERVER=1 and is described only in one README section (8).

dsh-superagent (DeepSeek) 67

Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's standard with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of blocked or failed, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix agent/), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).

Crush 55

No payment protocol (0). Scored on Charm's Hyper provider. Its public provider file at hyper.charm.land/v1/provider lists per-million-token figures for 22 models without a login, but no pricing page confirms them as billed rates, and plan prices sit in a script-rendered app (15). The CLI is free to use and runs with your own provider key or a local model, so nothing needs a card (20). A local model through Ollama, llama.cpp or LM Studio, or an existing provider key in the environment, works with no Charm account, so an agent can install it and run a task without a person signing up (20).

dsh-superagent (DeepSeek) 40

Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run auth login for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.

Crush 44

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Usage metrics go to PostHog through data.charm.land by default, keyed to a hashed machine ID, aliased to the Hyper user ID after a Hyper login, and including error messages. The README says prompts and responses are never collected and names three opt-outs. The provider list is fetched from Catwalk at startup unless turned off, the update check only notifies, and provider keys stay local (15). The TUI asks before bash, edit, write, fetch, download and MCP calls, permissions deny hides tools and PreToolUse hooks can block calls. But crush run approves every permission request in its session automatically (internal/app/app.go), --yolo skips all prompts, and there's no sandbox, only a fixed refusal list for curl, wget, ssh, sudo, package managers and similar commands (7). No prompt-injection guidance found, and a project's .crushrc and $(...) in crush.json run as code at startup, which the README warns about (3). Logs in ./.crush/logs/crush.log with crush logs, sessions in a local database readable as JSON, and crush stats, with no OpenTelemetry export (9). The organisation's SECURITY.md gives an email address, CI runs CodeQL, Grype and govulncheck, releases are cosign-signed, and OSV (the GitHub Advisory Database's public mirror) and NVD list no vulnerability for Crush, rechecked in our GitHub record, which also finds no SECURITY.md in the repository. No security.txt and no bug bounty (10).

dsh-superagent (DeepSeek) 33

Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The superagent profile is created from DSH's Web template, and DSH documents that shipped profiles mount session-log-deepseek, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and GH_TOKEN and GITHUB_TOKEN are removed from git (8). Both presets run danger-full-access without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, observe default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).

Crush 59

FSL-1.1-MIT, source-available, barring competing commercial use and converting each release to MIT on its second anniversary. Code from before 30 May 2025 is MIT. Not an OSI licence today (20). No privacy policy or terms for Crush were found on charm.land, and Hyper's legal pages render by script and weren't read. The README says Hyper is zero-data-retention, while Hyper's own app says some plans aren't and that usage on them may train Hyper's models, so the statements don't agree (8). The JSON config is marked deprecated with no removal date, and no deprecation policy was found (6). The README discloses usage metrics, links the source, says prompts aren't collected and gives three opt-outs, but doesn't mention the alias to the Hyper account (15).

dsh-superagent (DeepSeek) 52

MIT, Copyright (c) 2026 DeepSeek Harness Team (30). The prototype has no data statement of its own. DeepSeek Harness's privacy policy (last updated 20 September 2026) names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., says session logs are collected with official model services and may be used to train models with a right to opt out, and says custom model services aren't stored server-side. It agrees with DSH's session-log README, but neither is referred to from the prototype (12). No deprecation policy. The README says the published code differs from DeepSeek's internal version, and docs/006 warns that database migrations are one-way (3). Telemetry and the session-log upload are disclosed with opt-outs in DSH's own reference pages, not in this repository (6).