dsh-superagent (DeepSeek) vs OpenAI Codex

dsh-superagent (DeepSeek) 34

Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm latest is 0.2.1-rc.5 (29 October 2026) (4).

OpenAI Codex 87

0.163.0 on 15 October 2026 (30). 35 stable release tags between 21 July and 15 October, from 0.145.0 to 0.163.0 (20). Issues are labelled by surface, platform and cause, but over 5,000 stay open and a workflow closes stale contributor pull requests, per the 1 October check, not re-read on 17 October (12). TypeScript and Python SDKs are in the same repository and built in CI (15). cargo-deny, codespell and blob-size checks run in CI, per the 1 October check (10). 30 + 20 + 12 + 15 + 10 = 87.

dsh-superagent (DeepSeek) 33

Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The superagent profile is created from DSH's Web template, and DSH documents that shipped profiles mount session-log-deepseek, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and GH_TOKEN and GITHUB_TOKEN are removed from git (8). Both presets run danger-full-access without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, observe default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).

OpenAI Codex 82

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Anonymous usage and health metrics on by default, described as free of personal data, with [analytics] enabled = false, and feedback collection on by default with its own switch, both confirmed on 17 October. Credentials are a ChatGPT login or an API key (20). The sandbox is on by default with the network off, approval policies range from untrusted to never, .git, .agents and .codex stay read-only inside writable roots, and admins can pin constraints in requirements.toml (19). Network off by default locally. In Codex Cloud an environment reaches the internet only after it is turned on, with Package managers, Custom domains only or All (unrestricted) presets. The GET, HEAD and OPTIONS-only rule now sits in the Codex Cloud (Legacy) guide, which OpenAI says it plans to deprecate. The docs keep a worked example of prompt-injection exfiltration (14). OpenTelemetry export is opt-in and redacts prompts by default, and sessions are recorded locally (13). Bugcrowd programme, SECURITY.md and a valid security.txt on openai.com, per the 1 October check. OSV lists the same two advisories for @openai/codex on 17 October (GHSA-w5fx-fh39-j5rw of September 2025 and GHSA-xrxf-jgv3-qmrm, CVE-2025-61260, of April 2026), and the critical CVE-2025-61260 came through Check Point and NVD rather than an OpenAI advisory (16). SOC 2 isn't scored on the framework reading. 20 + 19 + 14 + 13 + 16 = 82.

dsh-superagent (DeepSeek) 15

Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (private: true in package.json, and the registry has no dsh-superagent). It installs from a git clone with pnpm install && pnpm build on top of @deepseek-ai/dsh@0.2.1-rc.3, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and pnpm check runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).

OpenAI Codex 55

Local-package reading. npm (node 16 or newer, 0.163.0 on 17 October) with per-platform binaries for macOS, Linux and Windows on x64 and arm64, Homebrew and standalone installers, and a signed PowerShell installer since 0.162.0 (20). Public CI, with rust-ci and a blocking-ci workflow that runs on every push to main, and the 10 rust-ci runs on main that our reader showed all passed, per the 1 October check, not re-read on 17 October as GitHub's pages weren't reachable (20). Over 5,000 open issues and 169 open pull requests, labelled by surface and platform, with crash and regression reports among recent ones, per the 1 October check, not re-read on 17 October (10). 0.x minors every few days, and release notes are still sorted under headings for additions, fixes, documentation and chores, with no breaking-change section (5). 0.163.0, pre-1.0 (0). 20 + 20 + 10 + 5 + 0 = 55. OpenAI's status feed lists Codex incidents since 1 October, among them elevated Codex Cloud errors posted on 6 October and degraded GPT-6.1 Sol in the CLI and other clients on 13 October. The local-package reading doesn't score them.

dsh-superagent (DeepSeek) 52

MIT, Copyright (c) 2026 DeepSeek Harness Team (30). The prototype has no data statement of its own. DeepSeek Harness's privacy policy (last updated 20 September 2026) names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., says session logs are collected with official model services and may be used to train models with a right to opt out, and says custom model services aren't stored server-side. It agrees with DSH's session-log README, but neither is referred to from the prototype (12). No deprecation policy. The README says the published code differs from DeepSeek's internal version, and docs/006 warns that database migrations are one-way (3). Telemetry and the session-log upload are disclosed with opt-outs in DSH's own reference pages, not in this repository (6).

OpenAI Codex 85

Apache-2.0 for the CLI and SDKs (30). The config docs say analytics are anonymous and exclude prompts, and the pricing page says cloud use needs a plan, but the retention terms for Codex Cloud tasks and the ChatGPT data controls weren't read on 1 or 17 October (12). The changelog at learn.chatgpt.com dates model retirements ahead of time with replacements (GPT-5.4 and GPT-5.4 mini announced on 31 July for 31 August, GPT-5.5 announced on 14 September for 14 October 2026), and the Feature Maturity page says stable removals typically go through a deprecation process. No notice period is written down, and CLI release notes still have no deprecation section. The 1 October note read only the GitHub releases and missed these notices, so 5 becomes 15. Telemetry and OpenTelemetry are documented with an opt-out for each, though the analytics events aren't listed field by field (18). 30 + 12 + 15 + 18 = 75.

dsh-superagent (DeepSeek) 61

Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (off, observe, auto), admission cells, Source states, health states and listen (12). A worked curl example, refusals as 400, 404, 409 and 500 with issues, setup or code, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an engines.dsh range, but no changelog or tags were found (2).

OpenAI Codex 90

Framework reading. A JSON Schema for config.toml in the repository (codex-rs/core/config.schema.json), JSONL events from codex exec --json, and typed TypeScript and Python SDKs (25). llms.txt at learn.chatgpt.com with a Markdown twin for every page, re-read on 17 October (10). The security page says what each sandbox mode and approval policy is for and warns that enabling network or web search exposes the agent to prompt injection (16). Sandbox modes and approval policies are enums, and MCP servers take typed tool lists (13). Examples throughout, and --output-schema validates the final message. The non-interactive page names the event types, turn.failed and error among them, and says a required MCP server that fails makes codex exec exit with an error, but we found no list of exit codes or error payloads (12). Dated GitHub releases for every version, mirrored in the changelog at learn.chatgpt.com (14). 25 + 10 + 16 + 13 + 12 + 14 = 90.

dsh-superagent (DeepSeek) 40

Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run auth login for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.

OpenAI Codex 60

Harness reading of the published rubric. No payment protocol (0). Plan prices and API token prices are public without a login, and the pricing page gives per-plan message ranges, confirmed on 17 October (20). ChatGPT Free and Go include Codex, and Free needs no card (20). --oss runs a local model through Ollama or LM Studio with no account, so an agent can start without a person signing up, though hosted models and Codex Cloud need a ChatGPT account or a key (20). 0 + 20 + 20 + 20 = 60.