🚀 HarnessRouter: community package now available

[timconsidine]

Mercury is in retrograde, has some effects during Halloween.

Thank you, I knew something was off

I love all of this stuff, but almost always trip up over a deployment issue : giving the tool stuff to work on / with.

I'm very reluctant to run AI tools on my primary device (Mac laptop) apart from Opencode and TRAE, both of which I endeavour to watch like a hawk (but probably fail on occasions). I never give Ai tools access to primary email, just work off secondary accounts which get fed with email from primary.
Edging towards moving dev projects off laptop and then using opencode-web. But not making much progress.
Theoretically every project needs its own silo / environment, but can't get my head around structuring and managing that.

Still playing with firing up on-demand environments (like fly.io sprites and machines) but also slow progress.

[robi]

@timconsidine Yep, remember to zoom out when you get stuck.

Fly.io is awesome and a great use case for a harness like this.

Don't mind all the fear porn out there, it's deliberate narrative and they don't share any logs or proof.

[robi]

Not sure this needs a separate app, but is VERY useful in any agent/harness
https://github.com/goodnight000/api-anything

[timconsidine]

@robi fascinating ... but I think I need a brain upgrade (trying to recover from changing traditional colour terms to being expressed in oklch for Tailwind 4).

[LoudLemur]

@timconsidine said:

I'm very reluctant to run AI tools on my primary device

From our experience, that is a wise choice. AI has repeatedly "found itself" operating outside of its designated areas, i.e. in No Go zones. It is able to provide a plausible excuse when it is spotted. Also, "mistakes were made", like deletion of half an archive.

The difficult thing is that once you start using AI, it becomes so helpful that the same machine becomes your main machine.

[timconsidine]

Also, "mistakes were made", like deletion of half an archive.

Ouch !

once you start using AI, it becomes so helpful that the same machine becomes your main machine.

Yes, I see that. 99/100 it's fine, becoming indispensable.
But safeguarding against 1/100 is the conundrum.

[robi]

@timconsidine said:

But safeguarding against 1/100 is the conundrum.

It need not be a conundrum.

Use terrain theory. And have repeatable systems in place.

It can't easily mess up stuff that is already anti-fragile.

All Agent frameworks that block access to x, y or z tools force the AI to dream up ways around what it's trying to do. It doesn't need to be in such a position.

[LoudLemur]

I had to research terrain theory:

"Terrain theory" isn't a codified framework I can point you to in the literature — it's a working label for a real and fairly mature set of ideas: treat the model as an untrusted actuator and make the environment, not the model, the thing that bounds harm.
The line I'd anchor it on: instructions are weather, the environment is terrain. Weather changes (distribution shift, jailbreak, prompt injection, a bad generation, a compromised fine-tune). Terrain doesn't. If your safety story depends on the model intending to behave, you have built a weather-dependent defence.
The canonical intellectual ancestors are Saltzer & Schroeder's 1975 protection principles (least privilege, complete mediation, fail-safe defaults, separation of privilege), capability-based security, and — more recently — the AI-control literature's distinction between alignment (make it want to behave) and control (make it unable to misbehave). Sun Tzu's 地形 chapter is the ancestor of the metaphor: don't fight the war on the enemy's ground.

[timconsidine]

I had to research terrain theory:

Me too !

Going down some rabbit holes currently to make a PoC : how to hand off work instructed by e.g. HarnessRouter to a bounded dev space, probably an ephemeral discarded one, restricted egress , ephemeral API keys, results in a safe space / format, judged by another LLM in similar bounded space, final stage is HITL.

If anyone has tied this all together, save me a job and let me know.

EDIT : Have I (almost entirely) missed the point ? HarnessRouter is also providing the sandbox ... or the user has to set that up and provide it ?

[LoudLemur]

0.2.0 is out: please update, and rotate your keys if you ran 0.1.0.

Package 0.2.0 moves HarnessRouter Community Edition from 0.37.13 to 0.41.16. It is a security release.

0.1.0 was affected by upstream advisories fixed in that span:

• GHSA-2464-fhr4-w9xw and GHSA-2xp9-vwfh-vxw4: remote code execution through the console's image optimiser,
  with no sign-in needed. The optimiser is now off.
• The critical fix in upstream 0.37.17: anyone holding an API key could read any file as root, including the
  internal key, the secret key, provider keys and the databases.

If you installed 0.1.0, upstream asks you to rotate:

• the secret key (HR_SECRET_KEY; in this package /app/data/.secrets/secret-key),
• the console password,
• every provider key and every API key,
• MCP server tokens, if untrusted agents ran.

If auto-update is on, your install has already moved or will at the next check. If it is off, update from the
app's Updates tab. Cloudron takes a backup first; keep it, because rolling back to 0.1.0 is not clean (some stored
tokens move to a form 0.37.13 cannot read). The first start reinstalls the agent tools once, so allow several
minutes before the console answers.

Also in 0.2.0: downloads at first start and environment builds run as firewalled unprivileged users, root is
firewalled from Cloudron's internal network (an MCP server must be reachable at a public address or through this
Cloudron's HTTPS front door), and the listing now says plainly that this package is unofficial and not supported
by the HarnessRouter project.

Full notes: https://github.com/OrcVole/harnessrouter-cloudron/blob/main/CHANGELOG.md