dsh-superagent (DeepSeek) vs Parallax

dsh-superagent (DeepSeek) 61

Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (off, observe, auto), admission cells, Source states, health states and listen (12). A worked curl example, refusals as 400, 404, 409 and 500 with issues, setup or code, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an engines.dsh range, but no changelog or tags were found (2).

Parallax 29

The review API has no OpenAPI or endpoint reference. Endpoints appear only in curl examples, and the base URL $PARALLAX_URL is not published (0). conifer.build/llms.txt covers the gateway in detail and Parallax in two lines that point to the docs (5). The docs explain sessions, sweeps, evidence states, memory and retention at length, but nothing documents the app, Captain, fallback or fast merge (8). parallax.yml keys are listed with allowed values (deliver: proven-only, review: off, severity floors, sweep modes), but request and response shapes for the API are not (5). curl examples, sample sweep lines and a table of skip reasons with the fix for each (8). Paths sit under /v1, with no changelog for Parallax (3).

dsh-superagent (DeepSeek) 15

Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (private: true in package.json, and the registry has no dsh-superagent). It installs from a git clone with pnpm install && pnpm build on top of @deepseek-ai/dsh@0.2.1-rc.3, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and pnpm check runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).

Parallax 40

Read as local software, because the launched product is the app the owner runs. A signed and notarised universal DMG for macOS 12 or later and Linux tarballs for x86-64 and arm64 on GitHub Releases, with SHA256SUMS and an install script. No package registry (20). The release repository holds a README and binaries only, with no public CI or tests (0). We could not read its issues, because our GitHub access refused the issue pages, so the issue record is unchecked and scored absent (0). Semver tags v1.0.0 to v1.0.2, but no release notes or changelog we could read (5). Version 1.0.2 (15). The hosted review service has no status page and no published rate limits. conifer.build/uptime covers upstream model providers only.

dsh-superagent (DeepSeek) 67

Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's standard with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of blocked or failed, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix agent/), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).

Parallax 42

Scored on the review API and the hooks, the only parts an agent touches. The session-start brief is cut at 6,000 characters, memory per review call at 12,000, and lesson_cap sets 1 to 20 lessons per person (8). repo filters on recall and brief, brain=true on the ledger, no documented pagination (4). Skip reasons such as capture_commit_missing and test_configuration_missing each come with a fix, but HTTP error codes for the API are not documented (12). A session is swept once per capture mark, retries use no extra credit, and a fix PR is reused and never reopened or merged by Parallax (14). No SDK for Parallax, and capture of every repository is the default (4).

dsh-superagent (DeepSeek) 34

Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm latest is 0.2.1-rc.5 (29 October 2026) (4).

Parallax 56

v1.0.2 on 16 October 2026 (30). Three releases, v1.0.0 to v1.0.2, on 15 and 16 October 2026 (20). Closed service. No public changelog. Support through a GitHub issues link, a Discord server and email, none of which we could check for replies (3). No Parallax SDK and nothing in the MCP registry. Conifer's SDK is for the gateway (0). Signed builds with checksums and a self-updater, with no CI to inspect (3).

dsh-superagent (DeepSeek) 33

Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The superagent profile is created from DSH's Web template, and DSH documents that shipped profiles mount session-log-deepseek, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and GH_TOKEN and GITHUB_TOKEN are removed from git (8). Both presets run danger-full-access without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, observe default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).

Parallax 43

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Once installed, capture uploads transcripts, tool calls with results and source snapshots from every repository on the machine unless a local allowlist is set first, and the app updates itself by default. Uploads stop with PARALLAX_STORE_UPLOAD=off and the token is revocable (8). Proofs run in a throwaway cloud copy, automatic PR review is off by default and Parallax never merges its own fix PR. What Captain may do to a running agent is not documented (10). Reviewers read untrusted transcripts and code with no documented mitigation. Lessons injected into the agent come only from verified outcomes and maintainer replies, never bots, and the brief labels everything else as cited fact (8). Recall receipts, per-injection records, sweep lines, the review ledger and GET /v1/calibration (12). No security.txt, bug bounty, SOC 2 or advisories. The privacy policy names a contact for security reports with a two-business-day reply and lists encryption and row-level security (5).

dsh-superagent (DeepSeek) 40

Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run auth login for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.

Parallax 30

No x402, MPP or L402 (0). Parallax episode credit prices are read from the account after sign-in. Gateway token prices are public at GET /v1/catalog with no key, which covers Conifer credit spent by agents (10). $50 of Conifer credit and 5 free episodes on GitHub sign-up, with no card mentioned, and agents can run on the owner's own Claude and Codex subscriptions (20). A person has to download the app, sign in and install the GitHub App, so no autonomous onboarding (0).