razzou-harness 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 The notable changes in each release of razzou-harness. Before 1.0, a new minor version
 may change how a project is set up, and its notes say how.
 
+## 0.4.1 (2026-11-08)
+
+**Upgrading a project from 0.4.0:** install the new version, then rebuild the agents'
+image with `harness doctor --build-images`: its tag follows the harness's version. A
+project's network stays as its `harness/config.json` lists it; for every bundle, set
+`"bundles": ["all"]`.
+
+- **Every network bundle by default.** `"all"` in `network.bundles` stands for every
+  bundle, those later versions add included, and it is the default: `harness init`
+  writes it, and `harness setup` no longer asks which bundles the stack needs. The
+  sandboxes of every role reach every bundle's package registries and documentation,
+  read-only. A project narrows it by listing bundles. An unknown bundle now fails when
+  the config is read, not when a sandbox is made.
+- **Third-party APIs**, in `network.apis`: the hosts the code may call with any method,
+  like a payment provider's test API. With `"key": "STRIPE_API_KEY"`, `harness doctor`
+  asks for the API's key at a hidden prompt and stores it in an OpenShell provider of
+  its own; every sandbox gets it, and holds a placeholder in that variable, which
+  OpenShell replaces with the key on requests to that host alone, in headers and URLs,
+  not in request bodies. While a key isn't stored on the machine, no new attempt
+  starts: the pipeline pauses and says so.
+
 ## 0.4.0 (2026-11-08)
 
 **Upgrading a project from 0.3.x:** install the new version, then rebuild the agents'

package/README.md

@@ -134,9 +134,9 @@ such as the Harness.io CLI, comes first on the PATH.
 
 `harness setup` does every step it can and asks only for what is yours: a `gh` login,
 the token from `claude setup-token` at a hidden prompt, two clicks on GitHub for the
-App, since GitHub creates and installs Apps only in the browser, three questions (your
-stack's network bundles, AWS or not, the hours of your time), and, with AWS, the role
-ARNs from your bootstrap and the gateway key. In order, it logs you in to `gh`; creates
+App, since GitHub creates and installs Apps only in the browser, two questions (AWS or
+not, the hours of your time), and, with AWS, the role ARNs from your bootstrap and the
+gateway key. In order, it logs you in to `gh`; creates
 the repository on GitHub if the project has no remote; creates the App from its
 manifest when this machine has none, and waits for you to install it; writes the
 harness's files; asks the questions and writes `harness/config.json`, with the
@@ -169,9 +169,10 @@ from a sandbox like an agent's and from outside, everything that must be refused
 writes and secret reads, other projects' state, `git push`, unlisted hosts and the
 metadata address, a workflow pushed by the App, a merge without your approval.
 
-`harness init` lets the sandboxes reach only the `core` network bundle. Add your
-stack's bundles, such as `node` for npm, in `harness/config.json` (see
-[Configuration](#configuration)).
+`harness init` lets the sandboxes reach every network bundle: the package registries
+and documentation of each stack, read-only. To narrow it, list fewer bundles in
+`harness/config.json`; to let the code call a third-party API, add it under
+`network.apis` (see [Configuration](#configuration)).
 
 ## Your first module
 
@@ -432,14 +433,14 @@ through an `Arch:` pull request, or a commit of your own on `main`.
 
 ```json
 {
-  "harnessVersion": "0.4.0",
+  "harnessVersion": "0.4.1",
   "project": { "name": "shop", "repo": "<org>/shop", "bot": "<org>-harness[bot]" },
   "roles": {
     "architect": { "model": "claude-opus-5-5", "effort": "max" },
     "manager": { "model": "claude-opus-5-5", "effort": "high" },
     "developer": { "model": "claude-opus-5-5", "effort": "xhigh", "attemptTimeoutMinutes": 90, "maxAttempts": 2 }
   },
-  "network": { "bundles": ["core", "node"], "extraHosts": [] },
+  "network": { "bundles": ["all"], "apis": [{ "host": "api.stripe.com", "key": "STRIPE_API_KEY" }] },
   "checks": [{ "id": "unit", "run": "npm test", "phase": "pre-merge" }]
 }
 ```
@@ -452,8 +453,9 @@ through an `Arch:` pull request, or a commit of your own on `main`.
 | `roles.<role>.effort` | `max`, `high`, `xhigh` | Claude Code's `--effort`; `null` for a model without effort levels, such as Haiku |
 | `roles.developer.attemptTimeoutMinutes` | 120 | An attempt's deadline |
 | `roles.developer.maxAttempts` | 2 | Attempts per feature before it is escalated to you |
-| `network.bundles` | `["core"]` | The hosts sandboxes reach, by bundle: `core`, `node`, `python`, `aws`, `terraform`, `go`, `rust`, `jvm`, `opentofu`, `browsers`. The Architect gets them all. |
+| `network.bundles` | `["all"]` | The hosts sandboxes reach directly, read-only, by bundle: `core`, `node`, `python`, `aws`, `terraform`, `go`, `rust`, `jvm`, `opentofu`, `browsers`, or `all` for every one, those later versions add included. The Architect gets them all. |
 | `network.extraHosts` | `[]` | More hosts, read-only |
+| `network.apis` | `[]` | Third-party APIs the code may call with any method, like a payment provider's test API: `{ "host": "api.stripe.com" }`, with `"key": "STRIPE_API_KEY"` for one that needs a key. `harness doctor` asks for the key at a hidden prompt and stores it in OpenShell; in a sandbox the variable holds a placeholder, which OpenShell replaces with the key on requests to that host alone, in headers and URLs, not in request bodies. CI gets no key. |
 | `checks` | `[]` | Checks that every feature must keep passing, such as `npm run lint` |
 | `protect.files`, `protect.jsonFields` | none | More protected files, as paths or globs (`scripts/*.sh`, `docs/`, `**/Makefile`), and protected JSON fields by file, like `{"tsconfig.json": ["/compilerOptions/strict"]}` |
 | `sandbox.image` | `razzou-harness/agent:<version>` | The agents' image, tagged with the harness's version, which `harness doctor --build-images` builds |
@@ -581,7 +583,8 @@ RDS, `manage_master_user_password`); anything else uses write-only arguments.
 
 What agents can't do, and what stops them:
 - **Hold credentials.** Sandboxes hold placeholders. The OpenShell proxy adds the Claude
-  token on `api.anthropic.com` only, and signs AWS requests with the read-only role.
+  token on `api.anthropic.com` only, each key of `network.apis` on its API's host only,
+  and signs AWS requests with the read-only role.
 - **Reach the host.** Each agent runs in its own container, with no host folder mounted;
   code moves in and out as git bundles. The host never runs code or git hooks that an
   agent wrote.
@@ -594,7 +597,8 @@ What agents can't do, and what stops them:
   They change only through an Arch PR you merge, or your own commits.
 - **Change AWS.** A read-only role with explicit denies, and applies only in CI after
   your merge.
-- **Go anywhere online.** Sandboxes reach listed hosts, read-only. Other pages go
+- **Go anywhere online.** Sandboxes reach listed hosts, read-only, and the APIs in
+  `network.apis` with any method; OpenShell has no rule for every host. Other pages go
   through `web_read`: GET only, public addresses only, never this machine's own
   addresses or the networks it is on (IPv6 included), checked again after every
   redirect, within 75 seconds and 2 MB, decompressed.

package/dist/daemon/items.js

@@ -263,7 +263,7 @@ function refusedLines(attempt, failed) {
         ...shown.map((d) => `- ${d.target} ${d.program ? `from ${d.program}` : '(a DNS query)'}, ${d.count} time${d.count === 1 ? '' : 's'}: ${d.reason.replace(/_/g, ' ')}`),
         ...(refused.length > shown.length ? [`- and ${refused.length - shown.length} more`] : []),
         ...(failed
-            ? ["A sandbox reaches only the hosts of network.bundles and network.extraHosts in harness/config.json, and the next attempt meets the same policy. If the feature can do without a host, give the way around it in your guidance. If it can't, ask_owner to allow the host, with blocking: true when no attempt can succeed without it: only the owner widens the policy."]
+            ? ["A sandbox reaches only the hosts of network.bundles, network.extraHosts and network.apis in harness/config.json, and the next attempt meets the same policy. If the feature can do without a host, give the way around it in your guidance. If it can't, ask_owner to allow the host, with blocking: true when no attempt can succeed without it: only the owner widens the policy."]
             : []),
     ];
 }

package/dist/daemon/orchestrator.js

@@ -15,7 +15,7 @@ import { rulesProblems } from '../github/setup.js';
 import { toolsManifest } from '../roles.js';
 import { PROJECT_LABEL } from '../sandbox/driver.js';
 import { BUNDLES } from '../sandbox/allowlist.js';
-import { buildPolicy } from '../sandbox/policy.js';
+import { apiProviderName, buildPolicy } from '../sandbox/policy.js';
 import { Denials, LOG_LINES } from '../sandbox/refusals.js';
 import { EventStore } from '../state/events.js';
 import { activeAttempts, apply, countedAttempts, featureKey, interruptions, isActive, managersOf, planKey, planMerged, project, writeSnapshot, } from '../state/state.js';
@@ -75,6 +75,8 @@ export class Orchestrator {
     stepErrors = { key: '', count: 0 };
     /** When the left-over sandboxes are next deleted: at the first pass, then every hour. */
     nextSweep = 0;
+    /** The gateway's providers, read at most once a minute, for the keys of the project's APIs. */
+    providerNames;
     /** Errors in a row of each plan's step, and when it is tried again: one plan that keeps failing never stops the others. */
     planErrors = new Map();
     /** The heads of Arch and Fix PRs already given the reviewers' statuses as "not reviewed". */
@@ -262,10 +264,11 @@ export class Orchestrator {
         this.record({ type: 'PIPELINE_PAUSED', payload: { reason, ...(until ? { until } : {}) } });
         return true;
     }
-    /** The owner lifts a pause. */
+    /** The owner lifts a pause. An API key stored meanwhile counts at once. */
     resume() {
         if (!this.state.pipeline.paused)
             return false;
+        this.providerNames = undefined;
         this.record({ type: 'PIPELINE_RESUMED', payload: {} });
         this.kick();
         return true;
@@ -430,6 +433,8 @@ export class Orchestrator {
             return 'progress';
         if (paused)
             return 'wait';
+        if (await this.apiKeysMissing())
+            return 'wait';
         // Manual builds one feature at a time, and looks at nothing else while it runs. Swarm starts
         // more while others run, up to its limit, and follows its other plans meanwhile (v3 §6.2).
         const swarm = this.state.mode === 'swarm';
@@ -438,6 +443,32 @@ export class Orchestrator {
             return 'wait';
         return this.scheduleNext(active.length, limit);
     }
+    /**
+     * An API of the design whose key isn't stored on this machine pauses the pipeline, with
+     * what to do: every new sandbox carries the API's provider, and OpenShell refuses one
+     * that doesn't exist. A design change that adds an API leads here.
+     */
+    async apiKeysMissing() {
+        const keyed = this.design.config.network.apis.filter((api) => api.key);
+        if (keyed.length === 0)
+            return false;
+        if (!this.providerNames || this.now() - this.providerNames.at >= 60_000) {
+            try {
+                this.providerNames = { at: this.now(), names: await this.driver.providers() };
+            }
+            catch (error) {
+                // The gateway's trouble shows elsewhere; this check doesn't hold the pipeline for it.
+                this.log(`the providers could not be listed: ${error.message}`);
+                return false;
+            }
+        }
+        const project = this.design.config.project.name;
+        const missing = keyed.filter((api) => !this.providerNames.names.includes(apiProviderName(project, api.host)));
+        if (missing.length === 0)
+            return false;
+        this.pausePipeline(`no key stored on this machine for ${missing.map((api) => api.host).join(', ')}: run \`harness doctor\` in a terminal, which asks for it, then resume`);
+        return true;
+    }
     /** One attempt's next step. An error counts against this attempt alone, and interrupts it past the limit. */
     async stepAttempt(feature, attempt) {
         try {
@@ -1724,12 +1755,16 @@ export class Orchestrator {
      * A sandbox's providers, policy and settings. Agents get Claude; with AWS in the
      * project, they and the checks that need it also get the view role, which OpenShell
      * holds and signs with (§12.1). A provider is only attached where its endpoints are.
+     * Every sandbox gets the keys of the project's APIs, for the code it runs.
      */
     access(options) {
         const aws = options.aws ? this.design.config.aws : undefined;
         const limits = this.state.sandboxLimits;
+        const project = this.design.config.project.name;
+        // The keys of the project's APIs, which OpenShell adds on requests to their hosts alone.
+        const apiKeys = this.design.config.network.apis.flatMap((api) => (api.key ? [apiProviderName(project, api.host)] : []));
         return {
-            providers: [...(options.claude ? [this.design.config.sandbox.claudeProvider] : []), ...(aws ? [aws.provider] : [])],
+            providers: [...(options.claude ? [this.design.config.sandbox.claudeProvider] : []), ...(aws ? [aws.provider] : []), ...apiKeys],
             policyFile: this.policyFile({ allBundles: options.allBundles ?? false, aws: aws !== undefined }),
             env: this.sandboxEnv(),
             // Every sandbox the daemon makes says whose it is: the dashboard tells them from other projects'.

package/dist/design/schemas.js

@@ -1,5 +1,6 @@
 import { readFileSync } from 'node:fs';
 import { z } from 'zod';
+import { ALL_BUNDLES, BUNDLES } from '../sandbox/allowlist.js';
 import { canonicalJson, sha256 } from '../util.js';
 /** The agents' image is tagged with the harness's version, which may change what goes into it: `harness doctor --build-images` builds it. */
 const AGENT_IMAGE = `razzou-harness/agent:${JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version}`;
@@ -71,6 +72,14 @@ export function featureDependency(planId, dep) {
     const [a, b] = dep.split('/');
     return b === undefined ? { plan: planId, feature: a } : { plan: a, feature: b };
 }
+/** Variables the harness, OpenShell or the system set in a sandbox: an API's key can't take one of their names. */
+const RESERVED_VARIABLES = /^(AWS_|CLAUDE_|OPENSHELL_|HARNESS_|SSL_|NODE_|NPM_)|^(PATH|HOME|USER|SHELL|LANG|TERM|PWD|TMPDIR|REQUESTS_CA_BUNDLE|CURL_CA_BUNDLE|DISABLE_AUTOUPDATER|CHECKPOINT_DISABLE|MCP_TOOL_TIMEOUT)$/;
+/** A third-party API of `network.apis`: an exact host, and the variable its key is read from, if it has one. */
+const ApiSchema = z.object({
+    host: z.string().regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/, 'a host name, like api.stripe.com'),
+    key: z.string().regex(/^[A-Z][A-Z0-9_]*$/, 'a variable name in capitals, like STRIPE_API_KEY')
+        .refine((name) => !RESERVED_VARIABLES.test(name), 'a variable the harness, OpenShell or the system sets; pick another name, like STRIPE_API_KEY').optional(),
+}).strict();
 export const ConfigSchema = z.object({
     harnessVersion: z.string(),
     project: z.object({
@@ -117,8 +126,18 @@ export const ConfigSchema = z.object({
         .prefault({}),
     network: z
         .object({
-        bundles: z.array(z.string()).default(['core']),
+        /** The hosts sandboxes reach directly, read-only, by bundle; `all`, the default, is every bundle. */
+        bundles: z.array(z.string().refine((name) => name === ALL_BUNDLES || name in BUNDLES, `a bundle: ${ALL_BUNDLES}, ${Object.keys(BUNDLES).join(', ')}`)).default([ALL_BUNDLES]),
         extraHosts: z.array(z.string()).default([]),
+        /**
+         * Third-party APIs sandboxes may call with any method, like a payment provider's test
+         * API. `key` names the variable the project's code reads the API's key from: in a
+         * sandbox it holds a placeholder, which OpenShell replaces with the key on requests to
+         * the host alone. `harness doctor` stores the key, at a hidden prompt.
+         */
+        apis: z.array(ApiSchema).default([])
+            .refine((apis) => new Set(apis.map((a) => a.host)).size === apis.length, 'each host once')
+            .refine((apis) => { const keys = apis.flatMap((a) => (a.key ? [a.key] : [])); return new Set(keys).size === keys.length; }, 'each key once'),
     })
         .prefault({}),
     checks: z.array(CheckSchema).default([]),

package/dist/sandbox/allowlist.js

@@ -19,6 +19,12 @@ export const BUNDLES = {
     opentofu: read('registry.opentofu.org', 'opentofu.org'),
     browsers: read('cdn.playwright.dev', 'playwright.download.prss.microsoft.com'),
 };
+/** Every bundle, those later versions add included: what a project gets unless it lists fewer. */
+export const ALL_BUNDLES = 'all';
+/** The bundles a project's list names, `all` standing for every one. */
+export function bundleNames(names) {
+    return names.includes(ALL_BUNDLES) ? Object.keys(BUNDLES) : [...names];
+}
 /** Throws on a host OpenShell would reject, so a bad entry fails at load time rather than at sandbox creation. */
 export function checkHost(host) {
     const labels = host.split('.');

package/dist/sandbox/openshell.js

@@ -157,6 +157,21 @@ export class OpenShellDriver {
             throw new Error(`openshell logs failed: ${(result.stderr || result.stdout).trim().slice(0, 300)}`);
         return result.stdout;
     }
+    async providers() {
+        const names = [];
+        let token = '';
+        for (let page = 0; page < 20; page++) {
+            const result = await run(this.bin, ['provider', 'list', '--output', 'json', ...(token ? ['--page-token', token] : [])], { timeout: 30_000, killSignal: 'SIGKILL' });
+            if (result.code !== 0)
+                throw new Error(`openshell provider list failed: ${(result.stderr || result.stdout).trim().slice(0, 300)}`);
+            const listed = JSON.parse(result.stdout);
+            names.push(...(listed.providers ?? []).flatMap((p) => (typeof p.name === 'string' ? [p.name] : [])));
+            token = listed.next_page_token ?? '';
+            if (!token)
+                break;
+        }
+        return names;
+    }
     async gateway() {
         const result = await run(this.bin, ['status', '--output', 'json'], { timeout: 15_000, killSignal: 'SIGKILL' }).catch((error) => ({ code: 1, stdout: '', stderr: error.message }));
         if (result.code !== 0)

package/dist/sandbox/policy.js

@@ -1,4 +1,4 @@
-import { BUNDLES, checkHost } from './allowlist.js';
+import { BUNDLES, bundleNames, checkHost } from './allowlist.js';
 /** Services whose endpoints don't follow `<service>.<region>.amazonaws.com`. Global ones sign for us-east-1. */
 const AWS_SERVICES = {
     iam: { hosts: () => ['iam.amazonaws.com'], signing: 'iam', global: true },
@@ -43,16 +43,21 @@ const BINARIES = ['/usr/local/bin/claude', '/usr/bin/bash', '/usr/bin/dash'];
  */
 export function buildPolicy(options) {
     const rules = [];
-    for (const name of options.bundles) {
+    for (const name of bundleNames(options.bundles)) {
         const bundle = BUNDLES[name];
         if (!bundle)
-            throw new Error(`unknown network bundle "${name}" (known: ${Object.keys(BUNDLES).join(', ')})`);
+            throw new Error(`unknown network bundle "${name}" (known: all, ${Object.keys(BUNDLES).join(', ')})`);
         rules.push(...bundle);
     }
     rules.push(...options.extraHosts.map((host) => ({ host, access: 'read' })));
     // A host's first rule wins: a bundle's, like github.com's with git, over an extra host's read-only one.
-    const unique = rules.filter((rule, i) => rules.findIndex((r) => r.host === rule.host) === i);
+    // An API's own rule wins over both, so a host listed as an API takes every method.
+    const apis = options.apis ?? [];
+    const apiHosts = new Set(apis.map((api) => api.host));
+    const unique = rules.filter((rule, i) => rules.findIndex((r) => r.host === rule.host) === i && !apiHosts.has(rule.host));
     unique.forEach((rule) => checkHost(rule.host));
+    apis.forEach((api) => checkHost(api.host));
+    const keyless = apis.filter((api) => !api.key);
     const binaries = BINARIES.map((path) => ({ path }));
     return {
         version: 1,
@@ -65,9 +70,39 @@ export function buildPolicy(options) {
             read_only_web: { endpoints: unique.filter((r) => r.access === 'read').map(readEndpoint), binaries },
             git_fetch: { endpoints: unique.filter((r) => r.access === 'git').map(gitEndpoint), binaries },
             ...(options.aws ? { aws_view: { endpoints: awsEndpoints(options.aws), binaries } } : {}),
+            ...(keyless.length > 0 ? { third_party_apis: { endpoints: keyless.map((api) => apiEndpoint(api.host)), binaries } } : {}),
         },
     };
 }
+/** A third-party API's host, open to every method: the project's code calls it as it would in production. */
+function apiEndpoint(host) {
+    return { host, port: 443, protocol: 'rest', enforcement: 'enforce', access: 'full' };
+}
+/**
+ * The OpenShell provider, and its profile, that hold a third-party API's key for a
+ * project. Providers are per machine, so the name says whose and which.
+ */
+export function apiProviderName(project, host) {
+    const safe = (text) => text.toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '');
+    return `api-${safe(project)}-${safe(host)}`;
+}
+/**
+ * The provider profile of a third-party API's key. A sandbox with the provider sees a
+ * placeholder in the variable, and OpenShell's proxy puts the key in its place on
+ * requests to the host alone: in any header, Basic auth included, and in the URL, but
+ * not in a request's body. The profile also opens the host to every method.
+ */
+export function apiProfile(project, api) {
+    return {
+        id: apiProviderName(project, api.host),
+        display_name: `${api.host} for ${project}`,
+        description: `The key of ${api.host} that the harness's sandboxes of ${project} use, as ${api.key}`,
+        category: 'other',
+        credentials: [{ name: 'key', description: `The key of ${api.host}`, env_vars: [api.key], required: true, auth_style: 'bearer', header_name: 'authorization' }],
+        endpoints: [{ host: api.host, port: 443, protocol: 'rest', access: 'full', enforcement: 'enforce' }],
+        binaries: BINARIES,
+    };
+}
 function readEndpoint(rule) {
     return {
         host: rule.host,

package/dist/setup/doctor.js

@@ -11,6 +11,7 @@ import { GitHubClient, loadAppCredentials } from '../github/app.js';
 import { checkApp } from '../github/setup.js';
 import { BUNDLES } from '../sandbox/allowlist.js';
 import { OpenShellDriver } from '../sandbox/openshell.js';
+import { apiProfile, apiProviderName } from '../sandbox/policy.js';
 import { run } from '../util.js';
 import { buildCache, removeOldAgentImages } from './images.js';
 import { probe, stateLocation } from './probe.js';
@@ -213,6 +214,7 @@ async function project(options, config, report) {
     }
     if (config.aws)
         await aws(options, config, report);
+    await apis(options, config, report);
     if (config.terraform) {
         const tf = config.terraform;
         for (const file of [tf.backendConfig, tf.varFile]) {
@@ -220,6 +222,70 @@ async function project(options, config, report) {
         }
     }
 }
+/** The project's third-party APIs: each key in an OpenShell provider, under the variable the config names. */
+async function apis(options, config, report) {
+    for (const api of config.network.apis) {
+        if (!api.key) {
+            report(ok('API', `${api.host}: every method, no key`));
+            continue;
+        }
+        const name = apiProviderName(config.project.name, api.host);
+        const keys = await providerKeys(name);
+        if (keys && keys.includes(api.key)) {
+            report(ok('API', `${api.host}: its key in ${name}, as ${api.key}`));
+            continue;
+        }
+        if (keys) {
+            report(fail('API', `${name} holds the key of ${api.host} as ${keys.join(', ') || 'nothing'}, but the config says ${api.key}`, `delete it with \`openshell provider delete ${name}\`, then run \`harness doctor\` in a terminal`));
+            continue;
+        }
+        if (!options.interactive) {
+            report(fail('API', `no key stored for ${api.host}`, 'run `harness doctor` in a terminal: it asks for the key'));
+            continue;
+        }
+        const secret = await askSecret(`The key of ${api.host}, which the project's code reads as ${api.key} (hidden, or Enter to skip): `);
+        if (!secret) {
+            report(fail('API', `no key stored for ${api.host}`, 'run `harness doctor` again with the key at hand'));
+            continue;
+        }
+        const problem = await storeApiKey(config.project.name, { host: api.host, key: api.key }, secret);
+        report(problem ? fail('API', `${api.host}: ${problem}`, 'fix it, then run `harness doctor` again') : ok('API', `${api.host}: key stored in ${name}`));
+    }
+}
+/** The variables a provider holds credentials under, or undefined when there is no such provider. */
+async function providerKeys(name, bin = 'openshell') {
+    const listed = await run(bin, ['provider', 'list', '--output', 'json']).catch(() => undefined);
+    if (listed?.code !== 0)
+        return undefined;
+    const provider = JSON.parse(listed.stdout).providers?.find((p) => p.name === name);
+    return provider ? provider.credential_keys ?? [] : undefined;
+}
+/**
+ * Stores an API's key in a new OpenShell provider, after importing the profile the
+ * harness writes for it (apiProfile). The key reaches `openshell` through its
+ * environment, never its arguments, which other users of the machine can read. Returns
+ * what went wrong, if anything.
+ */
+export async function storeApiKey(project, api, secret, bin = 'openshell') {
+    const name = apiProviderName(project, api.host);
+    const dir = mkdtempSync(join(tmpdir(), 'harness-api-'));
+    try {
+        const file = join(dir, `${name}.yaml`);
+        writeFileSync(file, `${JSON.stringify(apiProfile(project, api), null, 2)}\n`);
+        // A profile left by an earlier try, or written for another variable, gives way to this one.
+        await run(bin, ['profile', 'delete', name, '--global']).catch(() => undefined);
+        const imported = await run(bin, ['profile', 'import', '-f', file, '--global']);
+        if (imported.code !== 0)
+            return `openshell profile import: ${firstLine(imported.stderr || imported.stdout)}`;
+        const created = await run(bin, ['provider', 'create', '--name', name, '--type', name, '--credential', api.key, '--global-profile'], { env: { ...process.env, [api.key]: secret } });
+        if (created.code !== 0)
+            return `openshell provider create: ${firstLine(created.stderr || created.stdout)}`;
+        return undefined;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
 /** The AWS view role in OpenShell (§17.3, step 5): the gateway user's key, assuming the project's view role. */
 async function aws(options, config, report) {
     const provider = config.aws.provider;

package/dist/setup/init.js

@@ -49,7 +49,7 @@ export async function init(options) {
         Object.assign(project, { repo, bot });
     else
         notes.push(repo ? 'No GitHub App on this machine yet: `harness setup` creates it, and sets project.repo and project.bot in harness/config.json.' : 'No GitHub remote found: the project stays local until you set project.repo and project.bot.');
-    write('harness/config.json', `${JSON.stringify({ harnessVersion: options.version, project, network: { bundles: ['core'] } }, null, 2)}\n`);
+    write('harness/config.json', `${JSON.stringify({ harnessVersion: options.version, project, network: { bundles: ['all'] } }, null, 2)}\n`);
     const owner = options.owner ?? ((await run('gh', ['api', 'user', '--jq', '.login']).catch(() => undefined))?.stdout.trim() || undefined);
     for (const [path, content] of ciFiles(options.packageDir, owner))
         write(path, content);

package/dist/setup/setup.js

@@ -4,7 +4,6 @@ import { computeLock, directoryReader } from '../ci/harness-ci.js';
 import { ConfigSchema, requiredChecks } from '../design/schemas.js';
 import { configDir, loadAppCredentials } from '../github/app.js';
 import { applyRepositoryRules, checkApp, createApp, installCi } from '../github/setup.js';
-import { BUNDLES } from '../sandbox/allowlist.js';
 import { run, sha256 } from '../util.js';
 import { doctor, granted } from './doctor.js';
 import { appBot, githubRepo, init } from './init.js';
@@ -32,13 +31,6 @@ export function fixFor(check) {
             return undefined;
     }
 }
-/** The bundles the owner named, besides core, that exist; unknown ones are reported. */
-export function parseBundles(answer) {
-    const named = answer.split(/[,\s]+/).map((b) => b.trim()).filter(Boolean);
-    const unknown = named.filter((b) => !(b in BUNDLES));
-    const bundles = ['core', ...named.filter((b) => b in BUNDLES && b !== 'core')];
-    return { bundles: [...new Set(bundles)], unknown };
-}
 /**
  * The OpenShell provider of the project's AWS view role. Providers are per machine: it is
  * named after the repository, or else after the folder and a hash of its path, so two
@@ -209,10 +201,11 @@ async function ownerLogin(options) {
     return login?.code === 0 ? login.stdout.trim() || undefined : undefined;
 }
 /**
- * The three questions (v4 §4), asked once: the stack's network bundles, AWS, and the
- * owner's hours. What they settle goes into harness/config.json, with the lock that
- * hashes it, and into .harness/setup.json for the daemon. The view role's ARN goes to
- * the doctor, which creates the AWS provider with it.
+ * The questions (v4 §4), asked once: AWS, and the owner's hours. The network needs none:
+ * a project gets every bundle unless its config lists fewer. What they settle goes into
+ * harness/config.json, with the lock that hashes it, and into .harness/setup.json for
+ * the daemon. The view role's ARN goes to the doctor, which creates the AWS provider
+ * with it.
  */
 async function askSettings(options) {
     const { projectDir, say, ask } = options;
@@ -221,18 +214,6 @@ async function askSettings(options) {
     const written = [];
     let changed = false;
     let viewRole;
-    const bundles = config.network?.bundles ?? ['core'];
-    if (bundles.length === 1 && bundles[0] === 'core') {
-        const others = Object.keys(BUNDLES).filter((b) => b !== 'core').join(', ');
-        const answer = await ask(`Which network bundles do the sandboxes need besides core, for your stack? (${others}; Enter for none) `);
-        const parsed = parseBundles(answer);
-        if (parsed.unknown.length > 0)
-            say(`unknown bundles, ignored: ${parsed.unknown.join(', ')}`);
-        if (parsed.bundles.length > 1) {
-            config.network = { ...(config.network ?? {}), bundles: parsed.bundles };
-            changed = true;
-        }
-    }
     if (!config.aws && /^y/i.test(await ask('Does this project deploy to AWS with Terraform? [y/N] '))) {
         say('The roles come from your bootstrap (see the README\'s AWS section); the key is asked for later, at a hidden prompt.');
         const region = (await ask('AWS region (like eu-west-1): ')).trim();