razzou-harness 0.3.0 → 0.4.1

package/CHANGELOG.md

@@ -3,6 +3,71 @@
 The notable changes in each release of razzou-harness. Before 1.0, a new minor version
 may change how a project is set up, and its notes say how.
 
+## 0.4.1 (2026-11-08)
+
+**Upgrading a project from 0.4.0:** install the new version, then rebuild the agents'
+image with `harness doctor --build-images`: its tag follows the harness's version. A
+project's network stays as its `harness/config.json` lists it; for every bundle, set
+`"bundles": ["all"]`.
+
+- **Every network bundle by default.** `"all"` in `network.bundles` stands for every
+  bundle, those later versions add included, and it is the default: `harness init`
+  writes it, and `harness setup` no longer asks which bundles the stack needs. The
+  sandboxes of every role reach every bundle's package registries and documentation,
+  read-only. A project narrows it by listing bundles. An unknown bundle now fails when
+  the config is read, not when a sandbox is made.
+- **Third-party APIs**, in `network.apis`: the hosts the code may call with any method,
+  like a payment provider's test API. With `"key": "STRIPE_API_KEY"`, `harness doctor`
+  asks for the API's key at a hidden prompt and stores it in an OpenShell provider of
+  its own; every sandbox gets it, and holds a placeholder in that variable, which
+  OpenShell replaces with the key on requests to that host alone, in headers and URLs,
+  not in request bodies. While a key isn't stored on the machine, no new attempt
+  starts: the pipeline pauses and says so.
+
+## 0.4.0 (2026-11-08)
+
+**Upgrading a project from 0.3.x:** install the new version, then rebuild the agents'
+image with `harness doctor --build-images`, or run `harness setup`, which does it: the
+image's tag follows the harness's version. The doctor now removes the 0.3.0 image once
+no container uses it. Nothing else changes in a project.
+
+- A **Sandboxes** view in the dashboard lists the sandboxes on the OpenShell gateway:
+  this project's, with what each is for and whether anything still uses it, then the
+  others'. A left-over sandbox of this project, which a crash or a failed delete left,
+  can be deleted there; one in use, or another project's, can't. Selecting a sandbox
+  shows the network requests its policy refused, from its log: the program, the host,
+  why, and how often. The daemon labels the sandboxes it makes with the project's name
+  (`harness.project`) to tell them apart; a left-over sandbox from 0.3.0 or earlier has
+  no label, so it shows among the others.
+- The view shows what each sandbox uses of the machine now, its CPUs and memory against
+  its caps, and the total for every OpenShell sandbox, read from `docker stats` every
+  five seconds while the view is open.
+- **Caps on each sandbox**, set in the Sandboxes view: how many CPUs and how much memory
+  each new sandbox may use, so that Developers, check runs and reviewers in parallel
+  leave the machine usable. The daemon records them, and creates every sandbox with
+  them from then on; those already there keep theirs. There is no cap until you set one.
+- An attempt keeps the network requests its sandbox's policy refused. OpenShell keeps
+  only a sandbox's last 2,000 log lines, so the daemon reads the log every minute while
+  the Developer works, and once more before the sandbox goes. The attempt's card shows
+  them, and the Manager gets them with a failed attempt. A refused host is the
+  Manager's to resolve: it guides the next Developer around the host, or asks the owner
+  to allow it, since only the owner widens the network policy.
+
+Disk space:
+- The git bundles the daemon hands to sandboxes, each a copy of the plan branch's whole
+  history, are deleted once uploaded, and the ones it takes back once fetched. One was
+  kept for every attempt and every review, and never deleted, so `.harness/` grew with
+  each. The daemon deletes the ones earlier versions left in `.harness/modules/` when it
+  starts.
+- The daemon deletes this project's left-over sandboxes when it starts and every hour:
+  those the Sandboxes view offers to delete, so a delete that failed is tried again. It
+  spares an Architect's, which holds the owner's conversation with it.
+- `harness doctor --build-images` removes the agents' images the new one replaces, about
+  2 GB each, once no container uses them: the other versions' tags, and the untagged
+  images that building a tag again leaves. It also shows the size of Docker's build
+  cache, with `docker builder prune` to free it; that cache is shared with every other
+  build on the machine, so the doctor leaves it alone.
+
 ## 0.3.0 (2026-11-07)
 
 **Upgrading a project from 0.2.x:** install the new version, then run `harness setup`

package/README.md

@@ -134,9 +134,9 @@ such as the Harness.io CLI, comes first on the PATH.
 
 `harness setup` does every step it can and asks only for what is yours: a `gh` login,
 the token from `claude setup-token` at a hidden prompt, two clicks on GitHub for the
-App, since GitHub creates and installs Apps only in the browser, three questions (your
-stack's network bundles, AWS or not, the hours of your time), and, with AWS, the role
-ARNs from your bootstrap and the gateway key. In order, it logs you in to `gh`; creates
+App, since GitHub creates and installs Apps only in the browser, two questions (AWS or
+not, the hours of your time), and, with AWS, the role ARNs from your bootstrap and the
+gateway key. In order, it logs you in to `gh`; creates
 the repository on GitHub if the project has no remote; creates the App from its
 manifest when this machine has none, and waits for you to install it; writes the
 harness's files; asks the questions and writes `harness/config.json`, with the
@@ -169,9 +169,10 @@ from a sandbox like an agent's and from outside, everything that must be refused
 writes and secret reads, other projects' state, `git push`, unlisted hosts and the
 metadata address, a workflow pushed by the App, a merge without your approval.
 
-`harness init` lets the sandboxes reach only the `core` network bundle. Add your
-stack's bundles, such as `node` for npm, in `harness/config.json` (see
-[Configuration](#configuration)).
+`harness init` lets the sandboxes reach every network bundle: the package registries
+and documentation of each stack, read-only. To narrow it, list fewer bundles in
+`harness/config.json`; to let the code call a third-party API, add it under
+`network.apis` (see [Configuration](#configuration)).
 
 ## Your first module
 
@@ -261,7 +262,18 @@ behind a token. Its views:
 - **Project:** modules, proposals, plans and features, with attempts, findings, CI,
   deploys and `progress.txt`.
 - **Agents:** the Architect's terminal, the Manager's and the Developers' live
-  transcripts, a message box for the Manager, and a shell in any agent's sandbox.
+  transcripts, a message box for the Manager, and a shell in any agent's sandbox. An
+  attempt's card keeps the network requests its sandbox's policy refused.
+- **Sandboxes:** what runs on the OpenShell gateway. This project's sandboxes, with what
+  each is for, whether anything still uses it, and the CPUs and memory it uses now,
+  read from `docker stats` every five seconds. A left-over one, which a crash or a
+  failed delete left, has a button to delete it; the daemon deletes them itself when it
+  starts and every hour, except an Architect's. Select one to see the network requests
+  its policy refused, from its log: the program, the host, why, and how often. Then the
+  other projects' sandboxes, which the dashboard only lists, and the gateway's status.
+  Above them, the caps on each new sandbox: how many CPUs and how much memory it may
+  use, so that agents and checks in parallel leave the machine usable. There is no cap
+  until you set one.
 - **Events:** the event log, live, with a filter.
 
 The header pauses and resumes the pipeline: a pause lets what runs finish, and starts
@@ -421,14 +433,14 @@ through an `Arch:` pull request, or a commit of your own on `main`.
 
 ```json
 {
-  "harnessVersion": "0.3.0",
+  "harnessVersion": "0.4.1",
   "project": { "name": "shop", "repo": "<org>/shop", "bot": "<org>-harness[bot]" },
   "roles": {
     "architect": { "model": "claude-opus-5-5", "effort": "max" },
     "manager": { "model": "claude-opus-5-5", "effort": "high" },
     "developer": { "model": "claude-opus-5-5", "effort": "xhigh", "attemptTimeoutMinutes": 90, "maxAttempts": 2 }
   },
-  "network": { "bundles": ["core", "node"], "extraHosts": [] },
+  "network": { "bundles": ["all"], "apis": [{ "host": "api.stripe.com", "key": "STRIPE_API_KEY" }] },
   "checks": [{ "id": "unit", "run": "npm test", "phase": "pre-merge" }]
 }
 ```
@@ -441,8 +453,9 @@ through an `Arch:` pull request, or a commit of your own on `main`.
 | `roles.<role>.effort` | `max`, `high`, `xhigh` | Claude Code's `--effort`; `null` for a model without effort levels, such as Haiku |
 | `roles.developer.attemptTimeoutMinutes` | 120 | An attempt's deadline |
 | `roles.developer.maxAttempts` | 2 | Attempts per feature before it is escalated to you |
-| `network.bundles` | `["core"]` | The hosts sandboxes reach, by bundle: `core`, `node`, `python`, `aws`, `terraform`, `go`, `rust`, `jvm`, `opentofu`, `browsers`. The Architect gets them all. |
+| `network.bundles` | `["all"]` | The hosts sandboxes reach directly, read-only, by bundle: `core`, `node`, `python`, `aws`, `terraform`, `go`, `rust`, `jvm`, `opentofu`, `browsers`, or `all` for every one, those later versions add included. The Architect gets them all. |
 | `network.extraHosts` | `[]` | More hosts, read-only |
+| `network.apis` | `[]` | Third-party APIs the code may call with any method, like a payment provider's test API: `{ "host": "api.stripe.com" }`, with `"key": "STRIPE_API_KEY"` for one that needs a key. `harness doctor` asks for the key at a hidden prompt and stores it in OpenShell; in a sandbox the variable holds a placeholder, which OpenShell replaces with the key on requests to that host alone, in headers and URLs, not in request bodies. CI gets no key. |
 | `checks` | `[]` | Checks that every feature must keep passing, such as `npm run lint` |
 | `protect.files`, `protect.jsonFields` | none | More protected files, as paths or globs (`scripts/*.sh`, `docs/`, `**/Makefile`), and protected JSON fields by file, like `{"tsconfig.json": ["/compilerOptions/strict"]}` |
 | `sandbox.image` | `razzou-harness/agent:<version>` | The agents' image, tagged with the harness's version, which `harness doctor --build-images` builds |
@@ -570,7 +583,8 @@ RDS, `manage_master_user_password`); anything else uses write-only arguments.
 
 What agents can't do, and what stops them:
 - **Hold credentials.** Sandboxes hold placeholders. The OpenShell proxy adds the Claude
-  token on `api.anthropic.com` only, and signs AWS requests with the read-only role.
+  token on `api.anthropic.com` only, each key of `network.apis` on its API's host only,
+  and signs AWS requests with the read-only role.
 - **Reach the host.** Each agent runs in its own container, with no host folder mounted;
   code moves in and out as git bundles. The host never runs code or git hooks that an
   agent wrote.
@@ -583,7 +597,8 @@ What agents can't do, and what stops them:
   They change only through an Arch PR you merge, or your own commits.
 - **Change AWS.** A read-only role with explicit denies, and applies only in CI after
   your merge.
-- **Go anywhere online.** Sandboxes reach listed hosts, read-only. Other pages go
+- **Go anywhere online.** Sandboxes reach listed hosts, read-only, and the APIs in
+  `network.apis` with any method; OpenShell has no rule for every host. Other pages go
   through `web_read`: GET only, public addresses only, never this machine's own
   addresses or the networks it is on (IPv6 included), checked again after every
   redirect, within 75 seconds and 2 MB, decompressed.

package/dist/daemon/architects.js

@@ -56,7 +56,7 @@ export class Architects {
             throw new Error(`could not take the design: ${(result.stderr || result.stdout).trim()}`);
         const local = join(this.localDir(module.module), 'design.bundle');
         await o.driver.download(module.architect.sandbox, `${p.out}/design.bundle`, local);
-        return { head: await o.repo.fetchBundle(local, `refs/architect/${module.module}`) };
+        return { head: await o.fetchBundle(local, `refs/architect/${module.module}`) };
     }
     async syncModule(module) {
         const o = this.o;
@@ -93,7 +93,7 @@ export class Architects {
         const branch = `arch/${module.module}`;
         const reviewing = module.status === 'in_review' && (await o.repo.revParse(`refs/heads/${branch}`)) !== undefined;
         await o.repo.bundle(reviewing ? ['refs/heads/main', `refs/heads/${branch}`] : 'refs/heads/main', join(dir, 'main.bundle'));
-        await o.driver.upload(sandbox, join(dir, 'main.bundle'), p.harness);
+        await o.uploadBundle(sandbox, join(dir, 'main.bundle'), p.harness);
         const clone = await o.exec(sandbox, [
             `git clone --quiet --branch main ${sh(`${p.harness}/main.bundle`)} ${sh(p.work)}`,
             `cd ${sh(p.work)}`,
@@ -199,7 +199,7 @@ export class Architects {
         const p = o.paths(module.architect.sandbox);
         const local = join(this.localDir(module.module), 'arch.bundle');
         await o.repo.bundle(`refs/heads/arch/${module.module}`, local);
-        await o.driver.upload(module.architect.sandbox, local, p.harness);
+        await o.uploadBundle(module.architect.sandbox, local, p.harness);
         const result = await o.exec(module.architect.sandbox, [
             `cd ${sh(p.work)}`,
             `git fetch --quiet --force ${sh(`${p.harness}/arch.bundle`)} ${sh(`refs/heads/arch/${module.module}:refs/remotes/harness/arch`)}`,
@@ -252,7 +252,7 @@ export class Architects {
         await o.forge.fetchMain(o.repo);
         const local = join(this.localDir(module.module), 'main.bundle');
         await o.repo.bundle('refs/heads/main', local);
-        await o.driver.upload(module.architect.sandbox, local, p.harness);
+        await o.uploadBundle(module.architect.sandbox, local, p.harness);
         await o.exec(module.architect.sandbox, [
             `cd ${sh(p.work)}`,
             `git fetch --quiet --force ${sh(`${p.harness}/main.bundle`)} refs/heads/main:refs/heads/main`,

package/dist/daemon/items.js

@@ -116,6 +116,7 @@ function reviewItem(o, feature, attempt) {
                 `The Developer reports done: ${attempt.summary ?? '(no summary)'}`,
                 ...(attempt.notes ? ['', `Its notes: ${attempt.notes}`] : []),
                 ...questionsAsked(attempt),
+                ...refusedLines(attempt, false),
                 '',
                 'Every check passed in a fresh sandbox:',
                 ...checkLines(attempt.checks ?? []),
@@ -155,6 +156,7 @@ function failureItem(o, feature, attempt) {
                     ? ['', `Its finding (${finding.category}): ${finding.summary}`, ...(finding.tried?.length ? [`Tried: ${finding.tried.join('; ')}`] : []), ...(finding.needs ? [`Needs: ${finding.needs}`] : [])]
                     : []),
                 ...questionsAsked(attempt),
+                ...refusedLines(attempt, true),
                 ...(failing.length ? ['', 'Failing checks:', ...checkLines(failing, true)] : []),
                 '',
                 head
@@ -245,6 +247,26 @@ function questionsAsked(attempt) {
         return [];
     return ['', 'Its questions:', ...asked.map((q) => `- ${clip(q.text, 500)} → ${q.answer === undefined ? '(unanswered)' : clip(q.answer, 500)}`)];
 }
+/**
+ * The requests the attempt's sandbox policy refused. A host the feature needs and the
+ * policy doesn't allow explains many failures; the Manager resolves it, around the host
+ * or with the owner, who alone widens the policy.
+ */
+function refusedLines(attempt, failed) {
+    const refused = attempt.refused ?? [];
+    if (refused.length === 0)
+        return [];
+    const shown = refused.slice(0, 12);
+    return [
+        '',
+        "Its sandbox's network policy refused:",
+        ...shown.map((d) => `- ${d.target} ${d.program ? `from ${d.program}` : '(a DNS query)'}, ${d.count} time${d.count === 1 ? '' : 's'}: ${d.reason.replace(/_/g, ' ')}`),
+        ...(refused.length > shown.length ? [`- and ${refused.length - shown.length} more`] : []),
+        ...(failed
+            ? ["A sandbox reaches only the hosts of network.bundles, network.extraHosts and network.apis in harness/config.json, and the next attempt meets the same policy. If the feature can do without a host, give the way around it in your guidance. If it can't, ask_owner to allow the host, with blocking: true when no attempt can succeed without it: only the owner widens the policy."]
+            : []),
+    ];
+}
 function checkLines(results, withOutput = false) {
     return results.flatMap((r) => {
         const verdict = r.exit === 0 ? 'passed' : r.timedOut ? 'timed out' : `exited ${r.exit}`;

package/dist/daemon/manager.js

@@ -132,7 +132,8 @@ export class Managers {
         await o.repo.bundle(`refs/heads/${branch}`, join(dir, 'clone.bundle'));
         copyFileSync(join(o.options.packageDir, 'roles', 'manager.md'), join(dir, 'manager.md'));
         writeFileSync(join(dir, 'settings.json'), managerSettings());
-        for (const file of ['clone.bundle', 'manager.md', 'settings.json'])
+        await o.uploadBundle(manager.sandbox, join(dir, 'clone.bundle'), p.harness);
+        for (const file of ['manager.md', 'settings.json'])
             await o.driver.upload(manager.sandbox, join(dir, file), p.harness);
         await o.uploadAgentFiles(manager.sandbox, 'manager', dir);
         const clone = await o.exec(manager.sandbox, `git clone --quiet --branch ${sh(branch)} ${sh(`${p.harness}/clone.bundle`)} ${sh(p.work)}`);
@@ -254,7 +255,7 @@ export class Managers {
         const local = join(this.localDir(manager), 'review.bundle');
         await o.repo.bundle([`refs/heads/${branch}`, ...(head && attemptRef ? [attemptRef] : [])], local);
         const p = this.paths(manager);
-        await o.driver.upload(manager.sandbox, local, p.harness);
+        await o.uploadBundle(manager.sandbox, local, p.harness);
         const result = await o.exec(manager.sandbox, [
             `cd ${sh(p.work)}`,
             `git fetch --quiet --force ${sh(`${p.harness}/review.bundle`)} '+refs/heads/*:refs/remotes/harness/*' '+refs/attempts/*:refs/remotes/harness/attempts/*'`,