dsh-superagent (DeepSeek) vs Qwen Code

dsh-superagent (DeepSeek) 15

Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (private: true in package.json, and the registry has no dsh-superagent). It installs from a git clone with pnpm install && pnpm build on top of @deepseek-ai/dsh@0.2.1-rc.3, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and pnpm check runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).

Qwen Code 69

Local-package reading. npm with engines node 22 or newer, Homebrew at 0.25.0 and a standalone installer, with stable, preview and nightly channels (20). Public CI, and of the 15 most recent completed CI runs on main on 8 October, 12 passed, 3 were cancelled and none failed, though two issues opened by automation the same day report a failed end-to-end test and a failed Java SDK job on main (22). 1,402 open issues and 334 open pull requests. The ten newest issues each had labels and one to five comments within the day, much of it from the project's own triage automation (15). The changelog states Keep a Changelog and semver and every release has a Breaking Changes heading, but breaking changes shipped in patch releases 0.23.4 and 0.24.1 (12). 0.25.0, pre-1.0 (0).

dsh-superagent (DeepSeek) 34

Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm latest is 0.2.1-rc.5 (29 October 2026) (4).

Qwen Code 88

0.25.0 on 5 October 2026 (30). 39 stable releases since 10 July, plus previews and nightlies (20). Issues are labelled and commented on within a day, largely by automation, against 1,402 open issues and 334 open pull requests (17). A TypeScript SDK released on 5 October, with the Python SDK last published to PyPI as a release candidate on 9 May 2026 and the Java SDK an alpha (11). CI, CodeQL, a monthly scorecard and Dependabot (10).

dsh-superagent (DeepSeek) 61

Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (off, observe, auto), admission cells, Source states, health states and listen (12). A worked curl example, refusals as 400, 404, 409 and 500 with issues, setup or code, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an engines.dsh range, but no changelog or tags were found (2).

Qwen Code 91

Framework reading. A settings.schema.json in the repository, a settings reference with the type and default of each key, and an OpenAPI file for the daemon's REST API (25). llms.txt on the docs site lists the pages with a line each, though it links to HTML and the Markdown path we tried returned 404 (8). The approval-mode page says when to use each mode and the sandbox page what each method and Seatbelt profile allows (15). Approval modes, sandbox backends, filesystem and network policies are enums (13). The headless page documents json and stream-json output, and exit codes 41, 42, 44, 52, 53, 55 and 130 are documented (15). A dated changelog generated from releases (15).

dsh-superagent (DeepSeek) 33

Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The superagent profile is created from DSH's Web template, and DSH documents that shipped profiles mount session-log-deepseek, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and GH_TOKEN and GITHUB_TOKEN are removed from git (8). Both presets run danger-full-access without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, observe default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).

Qwen Code 53

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Usage statistics are on by default, documented as tool names, model names, timings and configuration without prompts, responses, file contents or personal information, with a setting and an environment variable to turn them off. Credentials are API keys in environment variables or settings.json (15). Five approval modes with a read-only plan mode and allow, ask and deny rules, but the settings default is Auto, where an LLM classifier approves tool calls, folder trust is disabled by default and sandboxing is opt-in (10). A Linux tool sandbox with network: closed, --safe-mode and a stderr warning for yolo without a sandbox, but the default macOS Seatbelt profile allows network and we found no guidance on prompt injection in the pages read (7). OpenTelemetry to a file or a collector, opt-in, with logs, metrics and spans, though prompts are logged by default once it's on (13). SECURITY.md gives only an Alibaba Cloud console portal with no response time, the repository has no published advisories, no security.txt was found, and CodeQL and scorecard workflows run in CI (8).

dsh-superagent (DeepSeek) 40

Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run auth login for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.

Qwen Code 60

Self-hosted rule. No payment protocol (0). The CLI is free under Apache-2.0 with nothing to buy (20). No card or account is needed for the software, and it runs against a local model server (20). An agent can install and run it with no sign-up, given a model endpoint (20). Alibaba Cloud's Coding Plan and Token Plan are separate purchases, and their price pages couldn't be loaded on 8 October 2026.

dsh-superagent (DeepSeek) 67

Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's standard with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of blocked or failed, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix agent/), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).

Qwen Code 85

Framework reading, adapted to a harness driven by a pipeline. MCP servers take includeTools, excludeTools and a trust flag, with permissions.allow, ask and deny rules and --exclude-tools (20). Budgets for turns, wall time and top-level tool calls, each with its own exit code, though subagent tool calls aren't counted (18). Documented exit codes (18). --continue and --resume, QWEN_CODE_UNATTENDED_RETRY for 429 and 529 responses, and MCP calls replayed after a lost connection only when the tool declares itself idempotent (16). A TypeScript SDK on npm at 0.1.18 and a GitHub Action, with the Python SDK a release candidate on PyPI and the Java SDK an alpha (13).