dsh-superagent (DeepSeek) vs Rovo Dev CLI

dsh-superagent (DeepSeek) 34

Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm latest is 0.2.1-rc.5 (29 October 2026) (4).

Rovo Dev CLI 61

Atlassian's AtlasCode extension, which downloads the same Rovo Dev binary for the IDE, pinned build 202610.16.1b1 in its pre-release of 16 October 2026, and the Atlassian CLI repository served 1.3.39-stable on 23 September 2026. We didn't run the CLI to read the version it installs. Judgement call (30). AtlasCode pinned eight Rovo Dev builds between 23 July and 16 October 2026 (20). No public changelog for the builds. Support is through Atlassian Support and the community, where the Rovo Dev board was last active on 16 January 2026 (5). No SDK and no registry entry. The server-mode API is kept current for the IDE extension (3). The Homebrew formula carries checksums and the Linux repositories are signed. There's no public CI (3). 30+20+5+3+3 = 61.

dsh-superagent (DeepSeek) 40

Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run auth login for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.

Rovo Dev CLI 15

Harness reading of the published rubric, scored on the Rovo Dev subscription the CLI needs. No payment protocol (0). Rovo Dev Standard is $20 a developer a month with 2,000 credits and extra credits are $0.01, both public. The credit multiplier for each model is shown only inside the CLI, and a task is given only as a range (5 to 50 tasks per 2,000 credits), so a run's cost can't be worked out before signing up. Judgement call between the 10 for plan-only pricing and the full 20 (15). Rovo Dev Free gives 350 credits a month, but only on Jira Standard or Premium sites, which are paid plans, and the 30-day Standard trial excludes the CLI (0). An organisation admin activates Rovo Dev and the user creates an API token in a browser (0). 0+15+0+0 = 15.

dsh-superagent (DeepSeek) 15

Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (private: true in package.json, and the registry has no dsh-superagent). It installs from a git clone with pnpm install && pnpm build on top of @deepseek-ai/dsh@0.2.1-rc.3, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and pnpm check runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).

Rovo Dev CLI 35

Local-package reading, the same as the other closed-source harnesses. Rovo Dev ships inside the Atlassian CLI, which installs from a Homebrew tap with SHA-256 checksums, signed apt and yum repositories and curl downloads for macOS, Linux and Windows on amd64 and arm64, and Rovo Dev downloads itself on first use (20). No public CI or test suite, since the source isn't published (0). No public issue tracker. The Rovo Dev community board was last active on 16 January 2026, and bugs otherwise go to /feedback and Atlassian Support, so open crash reports can't be counted (8). Rovo Dev builds moved from 0.13.x to date-based versions such as 202604.30.2 and 202610.16.1b1, per AtlasCode's changelog and manifest, and have no public changelog, and the Atlassian CLI changelog stops at v1.3.15 while its repository serves 1.3.39 (2). Rovo Dev has been rolling out as a product since October 2025, but the version number carries no stability signal and Atlassian has announced that the standalone product will reach end of life. Judgement call (5). The CLI runs against Atlassian's hosted service, and the Rovo status page has no Rovo Dev component. 20+0+8+2+5 = 35.

dsh-superagent (DeepSeek) 61

Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (off, observe, auto), admission cells, Source states, health states and listen (12). A worked curl example, refusals as 400, 404, 409 and 500 with issues, setup or code, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an engines.dsh range, but no changelog or tags were found (2).

Rovo Dev CLI 45

Framework reading. Server mode lists its /v3 endpoints with request bodies, and an Atlassian engineering post of 27 October 2025 says Swagger docs are served at localhost:<port>/docs. That contract is only visible on a running server, and no schema for the SSE events or the config file was published (12). No llms.txt on support.atlassian.com or developer.atlassian.com, and no Markdown twins found (0). The tools page says what allow, ask and deny do, what YOLO mode skips and that MCP tools keep their permissions, and the settings page gives each default. Little says when not to use a mode (12). Permission levels, console output formats and tool names are enumerated in the settings reference with defaults (10). Server mode has curl, Python and JavaScript examples. No exit codes or error responses are documented beyond the post's note that a failed entitlement check disables every endpoint except healthcheck and shutdown (7). The API path is versioned (/v3), but there is no public changelog for Rovo Dev builds (4). 12+0+12+10+7+4 = 45.

dsh-superagent (DeepSeek) 33

Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The superagent profile is created from DSH's Web template, and DSH documents that shipped profiles mount session-log-deepseek, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and GH_TOKEN and GITHUB_TOKEN are removed from git (8). Both presets run danger-full-access without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, observe default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).

Rovo Dev CLI 48

Harness reading of the framework checklist, as for the other harnesses. 30 for credentials and what leaves the machine, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The CLI processes data on the device and sends prompts to Atlassian's models, whose providers don't retain or train on them, per the Rovo privacy page and the AI Terms. The scoped token the docs create carries about 50 scopes including write, delete and admin:repository:bitbucket, the pipelines guide asks for an unscoped token, and no telemetry description for the CLI was found (12). Writes and shell commands ask by default, reads are allowed, bash rules are regex, compound commands are split and file access stays in the workspace. There is no sandbox for customers (runInSandbox is macOS only and for internal users), --yolo skips file and shell prompts, and project-level skills in a cloned repository can list pre-approved tools. We found no workspace trust step (10). MCP server instructions go into the system prompt by default, with a per-server enable_instructions switch, and the MCP page says data isn't sent to third-party tools without the user's approval (7). Administrators can turn Rovo Dev on and off per organisation and site and see credit use. Logs stay local in ~/.rovodev/logs, and no audit log of CLI actions was found (5). security.txt is valid (Expires 2027-02-04), Atlassian runs a public Bugcrowd bug bounty and publishes its fix objectives. The rollout page says Rovo Dev hasn't been externally audited for ISO 27001 or SOC 2, and we didn't check whether the bounty scope names Rovo Dev (14). 12+10+7+5+14 = 48.

dsh-superagent (DeepSeek) 67

Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's standard with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of blocked or failed, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix agent/), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).

Rovo Dev CLI 53

Framework reading, adapted to a harness driven by a pipeline. Per-tool allow, ask and deny, allowedMcpServers and disabledMcpServers, tool lists on subagents and skills, and /prune to drop tool results from context (15). The console output format is markdown, simple or raw. No JSON output for acli rovodev run is documented, server mode streams JSON events, and no turn or spend cap exists beyond the credit allowance and /efficiency (10). No exit codes are documented. Server mode reports entitlement and credit failures, per the engineering post (6). Sessions persist with --restore, fork and rename. --worktree isolates a run with a lock and keeps the worktree when a non-interactive run leaves changes, and server mode has cancel and reset (15). Sensible defaults, but no SDK, and a run needs an API token, a Rovo Dev licence and an activated site (7). 15+10+6+15+7 = 53.