@boldblackai/harness 1.9.1 → 1.9.3

package/README.md

@@ -191,6 +191,8 @@ Each run starts the container with:
 - `--security-opt seccomp=...` — inline seccomp profile blocks `socket(AF_ALG)` to prevent kernel crypto API access (a known container escape vector)
 - Only your mounted directory (or single file with `-f`) is visible to the agent
 
+Running harness from your home directory is blocked by default, since that would mount all of `$HOME` into the container — exposing dotfiles, credentials, and SSH keys to the agent and giving it a noisy, unfocused workspace. If the resolved working directory equals your home, harness exits with an error. Pass `--mount-entire-home` to opt in for the rare case where mounting all of `$HOME` is genuinely intended. `--file` mode is unaffected (it mounts a single file, not the working directory).
+
 These hardening flags are docker-specific. Under `HARNESS_CONTAINER_RUNTIME=apple`, `--security-opt` is not applied (apple/container workloads are microVMs with their own guest kernel, so the seccomp profile's host-kernel role is subsumed by the VM boundary); capability restrictions remain. See [Container runtime](#container-runtime).
 
 ### Image verification
@@ -241,6 +243,7 @@ If an old `.harness/` directory exists in your working directory, harness will e
 | `--no-context-files` | `-nc` | Disable mounting global context files (`~/.agents/AGENTS.md`, `~/.claude/CLAUDE.md`) |
 | `--ephemeral` |       | Disable session persistence (implied by `-p` and piped stdin) |
 | `--local`     |       | Force local mode even with `-e` (use LM Studio / local defaults) |
+| `--mount-entire-home` | | Allow running from your home directory (mounts all of `$HOME` as the workspace) |
 | `--help`      | `-h`  | Show help |
 
 ### Environment variables

package/bin/harness.js

@@ -365,6 +365,7 @@ Options:
   --no-context-files     Disable mounting global context files (~/.agents/AGENTS.md, ~/.claude/CLAUDE.md); alias -nc
   --ephemeral            Disable session persistence (implied by -p and piped stdin)
   --local                Force local mode even with -e (use LM Studio / local defaults)
+  --mount-entire-home    Allow running from your home directory (mounts all of $HOME as the workspace)
   -h, --help             Show this help message
 
 Environment variables:
@@ -402,7 +403,7 @@ function getImage(agent) {
     return `${REGISTRY}:${tag}`;
 }
 const MINIMIST_OPTS = {
-    boolean: ["help", "h", "ephemeral", "local"],
+    boolean: ["help", "h", "ephemeral", "local", "mount-entire-home"],
     string: [
         "env-file",
         "e",
@@ -457,6 +458,7 @@ if (argv.help) {
 const noVerify = argv.verify === false;
 const noSkills = argv.skills === false;
 const noContextFiles = argv["context-files"] === false;
+const mountEntireHome = argv["mount-entire-home"] === true;
 const localMode = argv.local;
 const envFilePath = argv["env-file"] || null;
 const fileArg = argv.file || null;
@@ -483,6 +485,19 @@ if (fileArg && node_fs_1.default.statSync(fileArg).isDirectory()) {
     console.error(`harness: --file requires a file, not a directory: ${fileArg}`);
     process.exit(1);
 }
+// Guard against accidentally mounting the entire home directory as the
+// workspace. Running from $HOME mounts all dotfiles/credentials into the
+// container and gives the agent a noisy, unfocused workspace. Only relevant
+// when the cwd is what gets mounted (not --file mode). --mount-entire-home
+// is the explicit opt-in for the rare case where this is intended.
+if (!fileArg && !mountEntireHome) {
+    const resolvedCwd = node_fs_1.default.realpathSync(workspace);
+    const resolvedHome = node_fs_1.default.realpathSync(node_os_1.default.homedir());
+    if (resolvedCwd === resolvedHome) {
+        console.error(`harness: refusing to run from your home directory (${resolvedHome}).\nThis would mount your entire home into the container, exposing dotfiles and credentials.\nPass --mount-entire-home to proceed, or cd into a project directory first.`);
+        process.exit(1);
+    }
+}
 const volumeArgList = Array.isArray(argv.volumes)
     ? argv.volumes
     : argv.volumes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boldblackai/harness",
-  "version": "1.9.1",
+  "version": "1.9.3",
   "description": "Portable environment for running coding agents in a container",
   "bin": {
     "harness": "bin/harness.js"