Emdash vs mini-swe-agent

Emdash 70

v1.2.11 on 6 November 2026 (30). v1.2.9, v1.2.10 and v1.2.11 within two weeks (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Current installers and Homebrew cask (15). Release workflows, no test CI (5). 30 + 20 + 0 + 15 + 5 = 70.

mini-swe-agent 32

2.4.6 on PyPI on 2026-07-23, 104 days before this check, and still the newest tag (10). No release in the 90 days to 4 November (0). Main hasn't moved since 3 September (three commits since 23 July, one from pre-commit-ci). Outside fixes were merged within days through July, but no pull request has been merged since #917 (17 August), 77 of the 85 pull requests numbered after it still carry open merge refs on the git remote, and maintainer reply times couldn't be read; the 18 October shields.io counts are struck (5). The Python library ships in the same package as the CLI and is current (10). Dependabot and pre-commit-ci run, and CI workflows exist with their current state unconfirmed (7).

Emdash 38

Harness reading. Telemetry is described as optional and disabled in Settings or with TELEMETRY_ENABLED=false, which reads as on by default (15 of 30). Worktree per task and remote machines over SSH (10 of 20). No prompt-injection guidance (5). No audit log (5). No security policy file found (3). 15 + 10 + 5 + 5 + 3 = 38.

mini-swe-agent 58

Harness reading of the framework checklist, used for every harness in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry in mini's own source, and prompts go only to the configured provider. LiteLLM's own network behaviour wasn't checked (28). The CLI asks before each command by default, with regex whitelists and -y to skip, but the Python DefaultAgent never asks, the default local environment has no isolation and passes the full host environment to every command, and the experimental bubblewrap sandbox leaks host variables and shares the network (CVE-2026-108592). Docker forwards no host variables unless listed (8). No prompt-injection guidance found (2). A full trajectory of every command and output saved as JSON after each step, and a trajectory inspector (13). A security policy (docs/SECURITY.md) naming four maintainers to contact by email, with no response time, which meets the disclosure-policy reading at 7 as for cowagent and tokenrip. No bounty or advisory page, and CVE-2026-108592 (VulnCheck, 10 October) still has no fix in any release or on main. Compromised LiteLLM 1.82.7 and 1.82.8 are excluded in the dependency pins since 24 March 2026 (#794) (7).

Emdash 55

Harness reading. Issue intake from Linear, GitHub, Jira and others, diff review, pull requests and CI checks in one place, local or over SSH (55).

mini-swe-agent 69

Harness reading of the framework line, scored on what an agent or pipeline driving it has to supply. One bash tool and a short system prompt, with output over 10,000 characters cut to its first and last 5,000, but no compaction of a long history (22). Step, cost and wall-time limits, global call and cost limits by environment variable, and a 30-second timeout per command (18). The trajectory JSON records Submitted, LimitsExceeded, TimeExceeded or RepeatedFormatError, but stdout is human-readable only and these aren't process exit codes (12). Model calls retry ten times with exponential backoff, and the trajectory is saved after every step, but there's no resume and no undo (8). Python bindings only. An unattended mini run needs -y, --exit-immediately and MSWEA_CONFIGURED, the last found only in the source (9). No MCP client, ACP or server mode.

Emdash 55

Local software. Homebrew cask and installers for macOS, Windows and Linux (20). A code-consistency check and release workflows; no test workflow found (10). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Stable tags to v1.2.11, release notes on GitHub (10). Version 1.2.11 (15). 20 + 10 + 0 + 10 + 15 = 55.

mini-swe-agent 65

Read as a local package, graded on 2.4.6, the release pip install mini-swe-agent installs, and still the newest tag on 4 November 2026. One official PyPI package with Python 3.10 or newer stated (20). A pytest workflow runs on every push to main with Podman, bubblewrap and Apptainer installed, 41 test files and Codecov coverage, but GitHub's pages refused this run, so whether main passes is unconfirmed (15). Issue counts and types couldn't be read (the 18 October counts came from shields.io, a third-party copy, and are struck). The git remote shows outside bug fixes merged through 22 July, such as #915, #896 and #886, and nothing merged into main since apart from a pre-commit update on 17 August, while 77 of the 85 pull requests numbered after #917 still carry open merge refs (10). Versions follow semver and v2's breaking changes came with a migration guide, but there's no changelog file and tags carry only a version bump (8). 2.4.6, past 1.0, though the PyPI classifier still says 3 - Alpha (12).