🚀 HarnessRouter: community package now available

[LoudLemur]

@timconsidine

Hey Tim, thanks for looking and commenting!

The problem. Coding agents like Claude Code, Codex and OpenCode are like very capable helpers who only work at a keyboard. You type to them in a terminal, they read files, run commands and write code. That works when you are sitting there. It doesn't work when your app or script wants to hand them a job.

What HarnessRouter does. It's a front desk for those helpers. Your program walks up to the desk and says "please do this task" through one standard API. HarnessRouter then:

• picks the helper you asked for (Codex, OpenCode or Claude Code);
• gives it a private room to work in (its own folder and its own user account);
• lets it think with whichever AI model you've connected;
• streams back what it's doing, and keeps a written record of everything it did.

Later you can come back and say "carry on from where you left off", and it picks up the same job.

Why that's useful. You can build things on top of agents without wiring each tool up yourself:

• a support tool that drafts replies;
• a script that reviews code every night;
• a feature in your own product that "does the task for the user".

One API covers every helper, and you can swap helpers or models without rewriting your code.

What the Cloudron package adds. These helpers can run commands, so you don't want them poking around your server. Our package keeps them fenced in:

• One room each. Every job runs as its own user and can't see the others.
• No keys in hand. The helpers never hold your real AI provider key. HarnessRouter holds it and passes requests along for them.
• Fenced off from your server. A firewall stops them reaching your other apps, your internal network or email. They can still reach the internet, which they need for models and code repositories.
• Cloudron housekeeping. You get backups, one-click updates and a generated password.

In one line: HarnessRouter turns "an AI agent in a terminal" into "an AI agent service your programs can call", and the Cloudron package makes running it on your own server reasonably safe.

[robi]

@timconsidine Mercury is in retrograde, has some effects during Halloween.

It's basically a Trae for many other Trae's and Hermes and OpenCode, etc...

Manage many, vs one at a time.

[timconsidine]

Mercury is in retrograde, has some effects during Halloween.

Thank you, I knew something was off

I love all of this stuff, but almost always trip up over a deployment issue : giving the tool stuff to work on / with.

I'm very reluctant to run AI tools on my primary device (Mac laptop) apart from Opencode and TRAE, both of which I endeavour to watch like a hawk (but probably fail on occasions). I never give Ai tools access to primary email, just work off secondary accounts which get fed with email from primary.
Edging towards moving dev projects off laptop and then using opencode-web. But not making much progress.
Theoretically every project needs its own silo / environment, but can't get my head around structuring and managing that.

Still playing with firing up on-demand environments (like fly.io sprites and machines) but also slow progress.

[robi]

@timconsidine Yep, remember to zoom out when you get stuck.

Fly.io is awesome and a great use case for a harness like this.

Don't mind all the fear porn out there, it's deliberate narrative and they don't share any logs or proof.

[robi]

Not sure this needs a separate app, but is VERY useful in any agent/harness
https://github.com/goodnight000/api-anything

[timconsidine]

@robi fascinating ... but I think I need a brain upgrade (trying to recover from changing traditional colour terms to being expressed in oklch for Tailwind 4).

[LoudLemur]

@timconsidine said:

I'm very reluctant to run AI tools on my primary device

From our experience, that is a wise choice. AI has repeatedly "found itself" operating outside of its designated areas, i.e. in No Go zones. It is able to provide a plausible excuse when it is spotted. Also, "mistakes were made", like deletion of half an archive.

The difficult thing is that once you start using AI, it becomes so helpful that the same machine becomes your main machine.

[timconsidine]

Also, "mistakes were made", like deletion of half an archive.

Ouch !

once you start using AI, it becomes so helpful that the same machine becomes your main machine.

Yes, I see that. 99/100 it's fine, becoming indispensable.
But safeguarding against 1/100 is the conundrum.

[robi]

@timconsidine said:

But safeguarding against 1/100 is the conundrum.

It need not be a conundrum.

Use terrain theory. And have repeatable systems in place.

It can't easily mess up stuff that is already anti-fragile.

All Agent frameworks that block access to x, y or z tools force the AI to dream up ways around what it's trying to do. It doesn't need to be in such a position.

[LoudLemur]

I had to research terrain theory:

"Terrain theory" isn't a codified framework I can point you to in the literature — it's a working label for a real and fairly mature set of ideas: treat the model as an untrusted actuator and make the environment, not the model, the thing that bounds harm.
The line I'd anchor it on: instructions are weather, the environment is terrain. Weather changes (distribution shift, jailbreak, prompt injection, a bad generation, a compromised fine-tune). Terrain doesn't. If your safety story depends on the model intending to behave, you have built a weather-dependent defence.
The canonical intellectual ancestors are Saltzer & Schroeder's 1975 protection principles (least privilege, complete mediation, fail-safe defaults, separation of privilege), capability-based security, and — more recently — the AI-control literature's distinction between alignment (make it want to behave) and control (make it unable to misbehave). Sun Tzu's 地形 chapter is the ancestor of the metaphor: don't fight the war on the enemy's ground.

[timconsidine]

I had to research terrain theory:

Me too !

Going down some rabbit holes currently to make a PoC : how to hand off work instructed by e.g. HarnessRouter to a bounded dev space, probably an ephemeral discarded one, restricted egress , ephemeral API keys, results in a safe space / format, judged by another LLM in similar bounded space, final stage is HITL.

If anyone has tied this all together, save me a job and let me know.

EDIT : Have I (almost entirely) missed the point ? HarnessRouter is also providing the sandbox ... or the user has to set that up and provide it ?