dsh-superagent (DeepSeek) vs Harness²

dsh-superagent (DeepSeek) 33

Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The superagent profile is created from DSH's Web template, and DSH documents that shipped profiles mount session-log-deepseek, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and GH_TOKEN and GITHUB_TOKEN are removed from git (8). Both presets run danger-full-access without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, observe default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).

Harness² 44

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default and credentials, 20 for approvals and sandboxing, 15 for prompt-injection posture and network egress, 15 for audit and 20 for the security programme. No telemetry found in the Harness² source, and the WorkBuddy OpenCode configs turn OpenCode's telemetry, auto-update and sharing off. Credentials are Google Application Default Credentials, and the Codex bridge binds 127.0.0.1 by default with a generated key stored with mode 0600. Against that, executors inherit the whole shell environment (the editor channel drops only five Anthropic variables), and no .gitignore keeps a filled-in .env out of commits (20). Codex runs with --dangerously-bypass-approvals-and-sandbox, the Claude CLI editor channel with --dangerously-skip-permissions, and the WorkBuddy OpenCode preset allows every tool, with only OpenCode's directory fence and WorkBuddy's containers as limits. The README and setup guide say so (4). Executor network access is unrestricted by default. The docs name the hosts to block and report a Codex rollout that fetched its rubric unprompted, but give no guidance on instructions inside task documents (5). Each editor call's prompt, system text, response, model and cost are saved to an audit folder, with trajectories and adopted harnesses under runs/ (13). No SECURITY.md or security.txt and no advisories, and the README says the project is outside Google's open-source vulnerability rewards programme (2). 44 in all.

dsh-superagent (DeepSeek) 61

Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (off, observe, auto), admission cells, Source states, health states and listen (12). A worked curl example, refusals as 400, 404, 409 and 500 with issues, setup or code, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an engines.dsh range, but no changelog or tags were found (2).

Harness² 51

Framework reading. Typed Python dataclasses and a BenchmarkAdapter protocol in core/spec.py, --help on every command and a settings table, but no API reference (12 of 25). Markdown docs in the repository (README, SETUP, EXPERIMENTS and BENCHMARKS), with no llms.txt (5 of 10). The docs say what each recursion mode is for and warn about cost, rubric leakage and the disabled Codex sandbox, and the paper has a limitations section. Nothing says how to use it outside the three benchmarks (13 of 20). --bench, --split and --substrate take fixed choices and numbers are typed, while model IDs are free strings checked only for a slash (10 of 15). Every command has a worked example and ConfigError messages name the fix, but the quick start's cp .env.example .env fails because the file isn't shipped (8 of 15). Version 0.1.0 with no changelog (3 of 15). 51 in all.

dsh-superagent (DeepSeek) 67

Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's standard with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of blocked or failed, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix agent/), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).

Harness² 59

Framework reading, adapted to a harness that a pipeline drives. Results land in run folders, not in the caller's context, and an agent reads task summaries, adopted harnesses and reflection notes from runs/ (12 of 25). --only-domains, --max-tasks (per domain), --split-file, --workers and --dry-run size a run before any model call (14 of 20). harness2-check tests dependencies, credentials and configuration without a model call, configuration errors name the remedy, and incomplete runs exit nonzero (14 of 20). Rerunning a command resumes it, saved configuration refuses an incompatible resume, failed grades stay unscored, and editor replies are cached by a fingerprint of their inputs (15 of 20). No model has a default, a Vertex AI project and a gcloud sign-in are needed, only three benchmarks are accepted and there's no SDK (4 of 15). 59 in all.

dsh-superagent (DeepSeek) 15

Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (private: true in package.json, and the registry has no dsh-superagent). It installs from a git clone with pnpm install && pnpm build on top of @deepseek-ai/dsh@0.2.1-rc.3, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and pnpm check runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).

Harness² 20

Local-package reading. Not on PyPI (the release feed for harness2 answers 404). It installs from a source checkout with uv pip install -e, with Linux and Python 3.12 stated (the package allows 3.13), plus Node.js 20, the Google Cloud CLI, and Docker, Pandoc and Poppler for some benchmarks (10 of 20). No CI workflow in the repository. tests/test_workflow.py holds five unit tests over the deterministic demo, which needs no credentials (5 of 25). Six issues and 42 pull requests were open on 18 October, the pull requests mostly fixes by their titles, such as the missing .env.example, report failures, seeds lost between refinement and grading, and resume. None is merged and no issue is closed. Issue text and replies couldn't be read (5 of 25). No tags or changelog (0). Version 0.1.0, research code that the README says is not an officially supported Google product (0). 20 in all.