Junie CLI vs Orca

Junie CLI 33

Local-package reading, the same as the other closed-source harnesses. Install scripts for macOS, Linux and Windows on x86-64 and ARM64, a Homebrew tap and npm, with SHA-256 sums checked against the release feed (update-info.jsonl, read from a clone on 4 November), but the script carries on without a sum for an unlisted version and npm sat five weeks behind at 3110.7.0 on 18 October (17). No public CI or test suite. No source is published and the repository has no workflow files, per a clone on 4 November (0). Crash and regression line 0. The 18 October counts came from shields.io badges and YouTrack's JSON API, both struck in this run, and no first-hand reading of the GitHub tracker or YouTrack is possible today (github.com pages refused, JetBrains hosts paused). What's New dates every build, but entries are one line and no breaking change is called out, and versions are a date plus a build number, per the 18 October check (6). JetBrains said Junie left Beta on 17 June 2026, but the headless page dated 15 October still calls the CLI an EAP, per the 18 October check (10). 17+0+0+6+10 = 33.

Orca 58

Local software. Desktop and mobile builds and a Homebrew cask (20). Unit, end-to-end and platform test workflows; pass state not read (15). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Tags to v1.4.251, no changelog file (8). Version 1.4 (15). 20 + 15 + 0 + 8 + 15 = 58.

Junie CLI 77

Proprietary, with clear terms. The JetBrains AI Terms of Service (version 2.1, effective 30 September 2025) name AI Assistant and Junie, though the Junie EAP terms from December 2024 still call Junie a plugin (15). The terms rule out training on inputs without consent and list AI subcontractors with 30 days' notice of new ones (page updated 29 September 2026, naming OpenAI, Google, Anthropic and SpaceXAI for Junie). The AI FAQ says nothing persists unless detailed data collection is on, retained up to a year, and that it's on by default for non-commercial licences. Security monitoring keeps data for an unstated limited period (22). The terms promise 30 days' email notice before JetBrains AI is discontinued, but Junie Lite's model may change without notice and model aliases change without a stated period (10). A per-run override for anonymous statistics is documented, with no stated default and no list of what is sent (10). 15+22+10+10 = 57. Per the 18 October check, not re-read on 4 November, because JetBrains' website terms bar robots and data mining on its sites.

Orca 54

MIT (30). Privacy and telemetry docs on the site (not read) (18 of 30). No deprecation policy (5). Disclosed with an opt-out (15 of 20). 30 + 18 + 5 + 15 = 68.

Junie CLI 55

Framework reading, adapted to a harness driven by a pipeline. MCP tools can be allowed per server prefix, and default MCP, skill, agent and config locations can each be switched off, with no deferred tool loading found (15). text, json and json-stream output and --json-output-file. Remote mode mentions a step limit, but no turn, time or spend cap for a headless run was documented (10). No exit codes. A Stop hook can end a task with a failure status, and StopFailure names the failure category (8). Sessions resume with --session-id or --resume, and worktrees isolate parallel sessions (14). One command with --auth and a dynamically chosen default model, a GitHub Action and GitLab CI, and no SDK (8). 15+10+8+14+8 = 55. Per the 18 October check, not re-read on 4 November, because JetBrains' website terms bar robots and data mining on its sites.

Orca 70

Harness reading. An orchestrator agent that splits work across workers in their own workspaces, chat or raw CLI, a browser and a CLI in one app (70).

Junie CLI 56

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. A browser login, a long-lived Junie API key with no scopes we found, or provider keys passed as flags or environment variables. The CLI's statistics default isn't stated (13). The allowlist asks before terminal commands, MCP tools, edits outside the project, reads outside it and secret files, and checks every part of chained, nested and multi-line commands. Brave mode is interactive only. Sandbox mode limits writes and hides ~/.ssh, but it's EAP-only, off by default, missing on Windows, and leaves the network open by default (12). Interactive runs keep an untrusted project's MCP servers, hooks and skills unloaded and a project can't widen the sandbox, but one-shot, piped, ACP and Gateway runs trust every project by design, and the docs say to run them only in trusted projects (9). /usage shows per-session cost and sessions are stored, and PreToolUse hooks in batch runs can log or block tools, but they're EAP, and no audit log for the CLI was found (7). A coordinated disclosure policy (updated 10 October 2026) and a security.txt contact, CVEs JetBrains publishes as a CVE numbering authority (three for Junie in cvelistV5) and a fixed-issues page, discretionary rewards with no formal bounty, and SOC 2 per the Junie homepage. The repository has no SECURITY.md, per a clone on 4 November (15). The docs, policy and homepage readings are per the 18 October check, not re-read on 4 November, because JetBrains' website terms bar robots and data mining on its sites. 13+12+9+7+15 = 56.

Orca 43

Harness reading. Anonymous usage data with an opt-out, per the README's link to its telemetry docs (15 of 30). Worktrees per agent and a sandboxed Linux build (12 of 20). No prompt-injection guidance (5). No audit log (5). A dependency-security workflow (6 of 20). 15 + 12 + 5 + 5 + 6 = 43.

Junie CLI 64

Release 26.11.3 (build 3959.5) added to the release feed on 3 November 2026, read from a clone of JetBrains/junie (30). The release channel added 30 builds between 6 August and 3 November, from 2651.3 on 11 August to 3959.5, and the repository has 1,032 tags created in that window, most of them nightly builds (20). Responsiveness 5 of 25. The 18 October counts of the GitHub tracker and YouTrack came from shields.io badges and YouTrack's JSON API, both struck, so what is left is the dated What's New page and a Discord server, per the 18 October check, with replies unread (5). No SDK and no registry entry. The GitHub Action is at v1 and GitLab CI is documented, and ACP is kept current, per the 18 October check (6). Closed source with no workflow files in the repository, so no CI or dependency health to read. The installer checks sums, and npm sat five weeks behind the release feed on 18 October (3). 30+20+5+6+3 = 64.

Orca 75

Tags to v1.4.251 and commits on 6 November 2026 (30). Many releases in 90 days (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Current builds (15). Extensive CI (10). 30 + 20 + 0 + 15 + 10 = 75.