For your users, not for you
Most agent harnesses assume the person running the harness is the user: a developer at a terminal, on their own machine. nativeharness is for developers building products, where the agent works for other people — many at once, isolated from one another, inside your app.Your process
A library, not a service. The harness, the workspaces and the sandboxes run on your
infrastructure. The only thing that leaves is what you send to the model you chose — with
a local model, not even that.
Your data
Each workspace is one of your users or projects, in your storage — and exports to a
portable directory you can import anywhere.
Your UI
The agent is an event stream your frontend renders. No UI is imposed.
Your users
Each gets their own sandbox, permissions, integrations and approvals.
Safe to put in front of people
- Every command runs in a sandbox, hydrated from the workspace and thrown away after.
- Containment is enforced in code. The agent refuses to let a model’s commands run on a provider that does not isolate — it will not construct, rather than warning.
- Approval is on effects. The harness reviews what a command did — the files it changed, the connectors it called — and can hold that for a person before anything is committed.
- Bash is the only tool, so there is one write path and every guard applies once.
Without a model
Harness needs no model until you ask for a turn. Sandboxed, versioned, auditable command
execution is useful on its own:
Next
Quickstart
Five minutes, from install to an agent working in a workspace.
How it works
Workspace, sandbox, bash, connectors, turn — on one page.
Your users
Actors, permissions, isolation and approvals.
Your UI
The event stream, and the HTTP binding your frontend talks to.
Connectors
Reach GitHub or your own API on a user’s behalf, without the credential entering the sandbox.
Controlling the turn
Subagents, plan mode, compaction, and the ceilings that stop a stuck turn.
Early. The specs are drafts, published before the implementation so they can be argued
with. The UI is the event protocol today, with reference components to come; storage ships
as SQLite, one file per workspace; and the connector machinery is built and tested, but no
connector ships yet.