@boldblackai/harness 1.9.0 → 1.9.2

package/README.md

@@ -174,7 +174,9 @@ npx @boldblackai/harness -a hermes -e .env -m anthropic/claude-sonnet-4-5 -p "ad
 npx @boldblackai/harness -a hermes -e .env -m openrouter/auto -p "add tests"
 ```
 
-Common keys: `ANTHROPIC_API_KEY`, `OPENROUTER_API_KEY`, `OPENAI_API_KEY`, `GOOGLE_API_KEY`, [and others](https://github.com/NousResearch/hermes-agent/blob/main/.env.example). LM Studio context length should be at least 64k tokens.
+Common keys: `ANTHROPIC_API_KEY`, `OPENROUTER_API_KEY`, `OPENAI_API_KEY`, `GOOGLE_API_KEY`, `GLM_API_KEY` (Z.AI), [and others](https://github.com/NousResearch/hermes-agent/blob/main/.env.example). LM Studio context length should be at least 64k tokens.
+
+**Multiple API keys in one env file.** With `--env-file`, each agent auto-detects a provider from the keys present. If the file contains keys for more than one provider (e.g. `OPENROUTER_API_KEY` and `GLM_API_KEY`), the agent may not pick the one you expect — `pi` and `opencode` follow their own detection order. For one-shot runs, use a single-provider env file, or select the agent and model explicitly (e.g. `harness -a hermes -e .env -m zai/glm-4.7 -p "..."`).
 
 ## Security model
 
@@ -189,6 +191,8 @@ Each run starts the container with:
 - `--security-opt seccomp=...` — inline seccomp profile blocks `socket(AF_ALG)` to prevent kernel crypto API access (a known container escape vector)
 - Only your mounted directory (or single file with `-f`) is visible to the agent
 
+Running harness from your home directory is blocked by default, since that would mount all of `$HOME` into the container — exposing dotfiles, credentials, and SSH keys to the agent and giving it a noisy, unfocused workspace. If the resolved working directory equals your home, harness exits with an error. Pass `--mount-entire-home` to opt in for the rare case where mounting all of `$HOME` is genuinely intended. `--file` mode is unaffected (it mounts a single file, not the working directory).
+
 These hardening flags are docker-specific. Under `HARNESS_CONTAINER_RUNTIME=apple`, `--security-opt` is not applied (apple/container workloads are microVMs with their own guest kernel, so the seccomp profile's host-kernel role is subsumed by the VM boundary); capability restrictions remain. See [Container runtime](#container-runtime).
 
 ### Image verification
@@ -239,6 +243,7 @@ If an old `.harness/` directory exists in your working directory, harness will e
 | `--no-context-files` | `-nc` | Disable mounting global context files (`~/.agents/AGENTS.md`, `~/.claude/CLAUDE.md`) |
 | `--ephemeral` |       | Disable session persistence (implied by `-p` and piped stdin) |
 | `--local`     |       | Force local mode even with `-e` (use LM Studio / local defaults) |
+| `--mount-entire-home` | | Allow running from your home directory (mounts all of `$HOME` as the workspace) |
 | `--help`      | `-h`  | Show help |
 
 ### Environment variables
@@ -256,15 +261,27 @@ By default harness runs images with `docker`. On macOS 26 / Apple Silicon you ca
 
 ```bash
 brew install container     # install Apple's container CLI (v1.0.0+)
-export HARNESS_CONTAINER_RUNTIME=apple
 container system start     # one-time: start the container system service
+container system kernel set --recommended --arch arm64   # one-time on Apple Silicon (required before first run)
+export HARNESS_CONTAINER_RUNTIME=apple
 harness -p "write me a fizzbuzz in Go"
 ```
 
+On arm64 Macs, `container system kernel set --recommended` is required — without it the first `harness` run fails with `default kernel not configured for architecture arm64`. See [apple/container](https://github.com/apple/container) for details.
+
 The value is **named, not boolean** (`apple` or `docker`, case-insensitive); any other value is a hard error. harness never auto-detects the runtime — you must opt in. Image verification (cosign + SLSA provenance) works identically under both runtimes; the verified-digest cache is keyed by digest, so a digest verified under one runtime is a cache hit under the other.
 
 **Security note.** Under `=apple`, harness does not apply the `--security-opt no-new-privileges` and `--security-opt seccomp=...` flags it uses under docker, because `apple/container` has no `--security-opt` option. This is not a security regression: each apple/container workload is a microVM with its own ephemeral guest kernel (Apple Virtualization framework), so the `block-af-alg.json` profile's host-kernel role — blocking `socket(AF_ALG)` — is subsumed by the VM boundary itself (hardware-assisted isolation, strictly stronger than a syscall filter). Capability restrictions (`--cap-drop=ALL --cap-add=NET_RAW`) **are** supported and stay on. Only `ro`/`readonly` is honored for volume options under the apple path (SELinux relabel flags like `:Z` are meaningless under macOS virtiofs).
 
+**Optional tuning — resource limits.** Apple's container CLI reads defaults from `~/.config/container/config.toml`. Create this file to control CPU and memory allocation for all containers (see [container-system-config.md](https://github.com/apple/container/blob/main/docs/container-system-config.md) for the full schema):
+
+```toml
+# example values; adjust to your machine
+[container]
+cpus = 8
+memory = "4g"
+```
+
 ### Agent-specific behavior
 
 - **pi** — `-m` is passed straight to the binary as `--model`.

package/bin/harness.js

@@ -365,6 +365,7 @@ Options:
   --no-context-files     Disable mounting global context files (~/.agents/AGENTS.md, ~/.claude/CLAUDE.md); alias -nc
   --ephemeral            Disable session persistence (implied by -p and piped stdin)
   --local                Force local mode even with -e (use LM Studio / local defaults)
+  --mount-entire-home    Allow running from your home directory (mounts all of $HOME as the workspace)
   -h, --help             Show this help message
 
 Environment variables:
@@ -402,7 +403,7 @@ function getImage(agent) {
     return `${REGISTRY}:${tag}`;
 }
 const MINIMIST_OPTS = {
-    boolean: ["help", "h", "ephemeral", "local"],
+    boolean: ["help", "h", "ephemeral", "local", "mount-entire-home"],
     string: [
         "env-file",
         "e",
@@ -457,6 +458,7 @@ if (argv.help) {
 const noVerify = argv.verify === false;
 const noSkills = argv.skills === false;
 const noContextFiles = argv["context-files"] === false;
+const mountEntireHome = argv["mount-entire-home"] === true;
 const localMode = argv.local;
 const envFilePath = argv["env-file"] || null;
 const fileArg = argv.file || null;
@@ -483,6 +485,19 @@ if (fileArg && node_fs_1.default.statSync(fileArg).isDirectory()) {
     console.error(`harness: --file requires a file, not a directory: ${fileArg}`);
     process.exit(1);
 }
+// Guard against accidentally mounting the entire home directory as the
+// workspace. Running from $HOME mounts all dotfiles/credentials into the
+// container and gives the agent a noisy, unfocused workspace. Only relevant
+// when the cwd is what gets mounted (not --file mode). --mount-entire-home
+// is the explicit opt-in for the rare case where this is intended.
+if (!fileArg && !mountEntireHome) {
+    const resolvedCwd = node_fs_1.default.realpathSync(workspace);
+    const resolvedHome = node_fs_1.default.realpathSync(node_os_1.default.homedir());
+    if (resolvedCwd === resolvedHome) {
+        console.error(`harness: refusing to run from your home directory (${resolvedHome}).\nThis would mount your entire home into the container, exposing dotfiles and credentials.\nPass --mount-entire-home to proceed, or cd into a project directory first.`);
+        process.exit(1);
+    }
+}
 const volumeArgList = Array.isArray(argv.volumes)
     ? argv.volumes
     : argv.volumes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boldblackai/harness",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "Portable environment for running coding agents in a container",
   "bin": {
     "harness": "bin/harness.js"
@@ -25,9 +25,9 @@
     "lint:docker": "hadolint Dockerfile Dockerfile.opencode Dockerfile.hermes",
     "lint:actions": "actionlint",
     "format": "biome format --write .",
-    "test:e2e:cli": "node --test tests/e2e/cli.test.mjs",
-    "test:e2e": "node --test tests/e2e/cli.test.mjs",
-    "test:coverage": "node --experimental-test-coverage --test-coverage-include=\"src/**\" --test-coverage-lines=80 --test-coverage-functions=80 --test-coverage-branches=80 tests/e2e/cli.test.mjs"
+    "test:e2e:cli": "node --test tests/e2e/*.test.mjs",
+    "test:e2e": "node --test tests/e2e/*.test.mjs",
+    "test:coverage": "node --experimental-test-coverage --test-coverage-include=\"src/**\" --test-coverage-lines=80 --test-coverage-functions=80 --test-coverage-branches=80 tests/e2e/*.test.mjs"
   },
   "dependencies": {
     "minimist": "^1.2.8"