dsh-superagent (DeepSeek) vs OpenHands

dsh-superagent (DeepSeek) 15

Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (private: true in package.json, and the registry has no dsh-superagent). It installs from a git clone with pnpm install && pnpm build on top of @deepseek-ai/dsh@0.2.1-rc.3, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and pnpm check runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).

OpenHands 83

Read as a local package. Official npm package @openhands/agent-canvas (Node 24 or later, plus uv), a Docker image on GHCR and openhands-sdk on PyPI (Python 3.12 or later) (20). The CI workflow passed on every run on main we loaded (25). 456 open issues and 395 open pull requests, with recent reports labelled by priority and ready-for-dev within a day or two, and a high-priority Cloud resume bug (#17664) open (18). Dated release notes for every Canvas version and a written SDK rule of at least five minor releases before a public API or REST contract is removed, but the Canvas CHANGELOG.md stops at 1.0.0-alpha.2 and the product was reshaped twice in a year, with the local GUI deprecated and the CLI left unmaintained (12). Canvas is 1.24 with a beta badge on its README, and the SDK is 1.50 (8). Judgement call on the last line, half credit for a 1.x release its maker still calls beta.

dsh-superagent (DeepSeek) 34

Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm latest is 0.2.1-rc.5 (29 October 2026) (4).

OpenHands 85

SDK 1.50.1 on 2026-09-30 and Agent Canvas 1.24.0 on 2026-09-25 (30). 21 Canvas releases since 2026-07-24 and 13 SDK tags in September (20). Issues are labelled by priority within a day or two, but 456 open issues and 395 open pull requests, and we couldn't see reply times (16). npm, PyPI and GHCR packages are current, but the openhands CLI on PyPI has been unmaintained since 2026-08-11 and still appears in the docs and on the pricing page (10). CI passes on main, and Dependabot, a security scan and an API-breakage check run on the SDK (9).

dsh-superagent (DeepSeek) 33

Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The superagent profile is created from DSH's Web template, and DSH documents that shipped profiles mount session-log-deepseek, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and GH_TOKEN and GITHUB_TOKEN are removed from git (8). Both presets run danger-full-access without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, observe default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).

OpenHands 66

Harness reading of the framework checklist, used for all five harnesses in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Agent Canvas sends a canvas_install event (platform, user agent, referrer, origin) to PostHog through z.openhands.dev on first use, before asking, then asks with the opt-in box already ticked. The Agent Server's exporter follows that consent, and AGENT_CANVAS_DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1 stops all of it (15). Confirmation policies (always, never, at or above a risk level) and a Docker sandbox per conversation exist, but Canvas starts with confirmation off and the npm install runs on the host with full filesystem access. We found no network egress controls. Local listeners bind to 127.0.0.1 with an injected session key (12). LLM, Invariant and GraySwan risk analysers and a policy-rail module, documented, all advisory (11). Conversation event logs, completion logs and OpenTelemetry tracing through Laminar (13). A valid security.txt with a responsible-disclosure policy, a Vanta-hosted trust page linked from pricing, and the git diff injection published as a GitHub advisory with a CVE. No bug bounty found (15).

dsh-superagent (DeepSeek) 61

Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (off, observe, auto), admission cells, Source states, health states and listen (12). A worked curl example, refusals as 400, 404, 409 and 500 with issues, setup or code, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an engines.dsh range, but no changelog or tags were found (2).

OpenHands 87

The Agent Server REST API has an OpenAPI 3.1 spec in the docs repository, the Cloud API has another, SDK models are Pydantic-typed and there's a TypeScript client (25). llms.txt at docs.openhands.dev, which leaves out the V0 pages on purpose (10). The docs have a when-to-use page and examples of good and bad task instructions, but the navigation still carries the deprecated local GUI, the unmaintained CLI and V0 reference beside Agent Canvas, which is a lot for a model to sort through (12). Confirmation policies, security analysers and MCP configs are discriminated Pydantic unions with validators (13). SDK examples are checked by a CI workflow and there are troubleshooting pages, but we found no error reference for the Agent Server (12). Dated release notes for each Canvas version in the docs, and GitHub releases per tag (15).

dsh-superagent (DeepSeek) 40

Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run auth login for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.

OpenHands 60

No payment protocol (0). Scored on OpenHands Cloud and its LLM provider. The docs publish per-token prices for the OpenHands LLM provider at provider rates with no markup, Cloud Individual is free, and Enterprise is priced by sales (20). The MIT stack is free and the pricing page mentions no card for the free plan (20). It runs any model through LiteLLM, local ones included, so an agent can install and run it with no signup (20). The price table lists 2025 models, so it may be stale.

dsh-superagent (DeepSeek) 52

MIT, Copyright (c) 2026 DeepSeek Harness Team (30). The prototype has no data statement of its own. DeepSeek Harness's privacy policy (last updated 20 September 2026) names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., says session logs are collected with official model services and may be used to train models with a right to opt out, and says custom model services aren't stored server-side. It agrees with DSH's session-log README, but neither is referred to from the prototype (12). No deprecation policy. The README says the published code differs from DeepSeek's internal version, and docs/006 warns that database migrations are one-way (3). Telemetry and the session-log upload are disclosed with opt-outs in DSH's own reference pages, not in this repository (6).

OpenHands 70

MIT across Canvas, SDK, tools and Agent Server (30). The privacy policy (effective 3 September 2025) doesn't separate the open-source stack from the Cloud service, keeps data as long as reasonably necessary, allows training on content from the Services and names PostHog and Google Analytics only in passing, with no subprocessor list (12). A written SDK deprecation runway of five minor releases, deprecated projects grouped in the docs, and the CLI's unmaintained notice in its README without a date on the page (15). The consent prompt calls the data anonymous and the Docker page documents AGENT_CANVAS_DISABLE_TELEMETRY, but no user-facing page mentions the install event sent before consent (10).