@boldblackai/harness 1.9.0 → 1.9.1

package/README.md

@@ -174,7 +174,9 @@ npx @boldblackai/harness -a hermes -e .env -m anthropic/claude-sonnet-4-5 -p "ad
 npx @boldblackai/harness -a hermes -e .env -m openrouter/auto -p "add tests"
 ```
 
-Common keys: `ANTHROPIC_API_KEY`, `OPENROUTER_API_KEY`, `OPENAI_API_KEY`, `GOOGLE_API_KEY`, [and others](https://github.com/NousResearch/hermes-agent/blob/main/.env.example). LM Studio context length should be at least 64k tokens.
+Common keys: `ANTHROPIC_API_KEY`, `OPENROUTER_API_KEY`, `OPENAI_API_KEY`, `GOOGLE_API_KEY`, `GLM_API_KEY` (Z.AI), [and others](https://github.com/NousResearch/hermes-agent/blob/main/.env.example). LM Studio context length should be at least 64k tokens.
+
+**Multiple API keys in one env file.** With `--env-file`, each agent auto-detects a provider from the keys present. If the file contains keys for more than one provider (e.g. `OPENROUTER_API_KEY` and `GLM_API_KEY`), the agent may not pick the one you expect — `pi` and `opencode` follow their own detection order. For one-shot runs, use a single-provider env file, or select the agent and model explicitly (e.g. `harness -a hermes -e .env -m zai/glm-4.7 -p "..."`).
 
 ## Security model
 
@@ -256,15 +258,27 @@ By default harness runs images with `docker`. On macOS 26 / Apple Silicon you ca
 
 ```bash
 brew install container     # install Apple's container CLI (v1.0.0+)
-export HARNESS_CONTAINER_RUNTIME=apple
 container system start     # one-time: start the container system service
+container system kernel set --recommended --arch arm64   # one-time on Apple Silicon (required before first run)
+export HARNESS_CONTAINER_RUNTIME=apple
 harness -p "write me a fizzbuzz in Go"
 ```
 
+On arm64 Macs, `container system kernel set --recommended` is required — without it the first `harness` run fails with `default kernel not configured for architecture arm64`. See [apple/container](https://github.com/apple/container) for details.
+
 The value is **named, not boolean** (`apple` or `docker`, case-insensitive); any other value is a hard error. harness never auto-detects the runtime — you must opt in. Image verification (cosign + SLSA provenance) works identically under both runtimes; the verified-digest cache is keyed by digest, so a digest verified under one runtime is a cache hit under the other.
 
 **Security note.** Under `=apple`, harness does not apply the `--security-opt no-new-privileges` and `--security-opt seccomp=...` flags it uses under docker, because `apple/container` has no `--security-opt` option. This is not a security regression: each apple/container workload is a microVM with its own ephemeral guest kernel (Apple Virtualization framework), so the `block-af-alg.json` profile's host-kernel role — blocking `socket(AF_ALG)` — is subsumed by the VM boundary itself (hardware-assisted isolation, strictly stronger than a syscall filter). Capability restrictions (`--cap-drop=ALL --cap-add=NET_RAW`) **are** supported and stay on. Only `ro`/`readonly` is honored for volume options under the apple path (SELinux relabel flags like `:Z` are meaningless under macOS virtiofs).
 
+**Optional tuning — resource limits.** Apple's container CLI reads defaults from `~/.config/container/config.toml`. Create this file to control CPU and memory allocation for all containers (see [container-system-config.md](https://github.com/apple/container/blob/main/docs/container-system-config.md) for the full schema):
+
+```toml
+# example values; adjust to your machine
+[container]
+cpus = 8
+memory = "4g"
+```
+
 ### Agent-specific behavior
 
 - **pi** — `-m` is passed straight to the binary as `--model`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boldblackai/harness",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "Portable environment for running coding agents in a container",
   "bin": {
     "harness": "bin/harness.js"
@@ -25,9 +25,9 @@
     "lint:docker": "hadolint Dockerfile Dockerfile.opencode Dockerfile.hermes",
     "lint:actions": "actionlint",
     "format": "biome format --write .",
-    "test:e2e:cli": "node --test tests/e2e/cli.test.mjs",
-    "test:e2e": "node --test tests/e2e/cli.test.mjs",
-    "test:coverage": "node --experimental-test-coverage --test-coverage-include=\"src/**\" --test-coverage-lines=80 --test-coverage-functions=80 --test-coverage-branches=80 tests/e2e/cli.test.mjs"
+    "test:e2e:cli": "node --test tests/e2e/*.test.mjs",
+    "test:e2e": "node --test tests/e2e/*.test.mjs",
+    "test:coverage": "node --experimental-test-coverage --test-coverage-include=\"src/**\" --test-coverage-lines=80 --test-coverage-functions=80 --test-coverage-branches=80 tests/e2e/*.test.mjs"
   },
   "dependencies": {
     "minimist": "^1.2.8"