diff --git a/.oh/cli/src/__tests__/harness-catalog.test.ts b/.oh/cli/src/__tests__/harness-catalog.test.ts index 2b3290c0..b35a49ce 100644 --- a/.oh/cli/src/__tests__/harness-catalog.test.ts +++ b/.oh/cli/src/__tests__/harness-catalog.test.ts @@ -68,7 +68,6 @@ describe("harness catalog", () => { it("covers all four optional harnesses", () => { expect(optional.map((h) => h.id).sort()).toEqual([ - "deepagents", "grok-build", "hermes", "opencode", diff --git a/.oh/cli/src/__tests__/harness.test.ts b/.oh/cli/src/__tests__/harness.test.ts index acbde334..91918d75 100644 --- a/.oh/cli/src/__tests__/harness.test.ts +++ b/.oh/cli/src/__tests__/harness.test.ts @@ -166,7 +166,7 @@ describe("help", () => { it("names every installable harness so `` is discoverable", () => { const help = captureStdout(printHarnessHelp); - for (const id of ["claude-code", "codex", "pi", "opencode", "grok-build", "deepagents", "hermes", "t3code"]) { + for (const id of ["claude-code", "codex", "pi", "opencode", "grok-build", "hermes", "t3code"]) { expect(help).toContain(id); } }); @@ -289,19 +289,6 @@ describe("runHarnessInstall against the container", () => { ); }); - it("installs deepagents as the sandbox user, not root", async () => { - const root = makeRepo(); - const { calls, run } = makeRunner((c, a) => { - if (isInspect(c, a)) return running; - if (isExecOf(c, a, "--version")) return { status: 1, stdout: "", stderr: "" }; - return undefined; - }); - - await runHarnessInstall("deepagents", { cwd: root, run }, makeIo().io); - const install = execCalls(calls).find((c) => c.args.includes("deepagents-cli")); - expect(install!.args[install!.args.indexOf("-u") + 1]).toBe("sandbox"); - }); - it("is a no-op when the binary is already present", async () => { const root = makeRepo(); const { calls, run } = makeRunner((c, a) => (isInspect(c, a) ? running : undefined)); diff --git a/.oh/cli/src/__tests__/init.test.ts b/.oh/cli/src/__tests__/init.test.ts index f74bf689..a06ab547 100644 --- a/.oh/cli/src/__tests__/init.test.ts +++ b/.oh/cli/src/__tests__/init.test.ts @@ -476,7 +476,6 @@ describe("runInit", () => { expect(config.install).toEqual({ opencode: false, grokBuild: false, - deepagents: false, hermes: false, agentBrowser: false, }); diff --git a/.oh/cli/src/commands/init.ts b/.oh/cli/src/commands/init.ts index c1db4fd7..d313a55b 100644 --- a/.oh/cli/src/commands/init.ts +++ b/.oh/cli/src/commands/init.ts @@ -653,9 +653,6 @@ const ENV_TO_CONFIG: Record = { INSTALL_GROK_BUILD: (c, v) => { section(c, "install").grokBuild = asBool(v); }, - INSTALL_DEEPAGENTS: (c, v) => { - section(c, "install").deepagents = asBool(v); - }, INSTALL_HERMES: (c, v) => { section(c, "install").hermes = asBool(v); }, @@ -777,7 +774,6 @@ async function runWizard( prompt.step(2, 5, "Optional installs"); const installs: { key: string; field: string; desc: string }[] = [ { key: "opencode", field: "opencode", desc: "OpenCode TUI coding agent" }, - { key: "deepagents", field: "deepagents", desc: "DeepAgents multi-agent runtime" }, { key: "hermes", field: "hermes", desc: "Hermes CLI + runtime (build arg + runtime)" }, { key: "grok_build", field: "grokBuild", desc: "Grok build tooling" }, { key: "agent_browser", field: "agentBrowser", desc: "agent-browser + Chromium (~1 GB)" }, diff --git a/.oh/cli/src/lib/__tests__/config-render.test.ts b/.oh/cli/src/lib/__tests__/config-render.test.ts index ce0d3a0e..a8df288f 100644 --- a/.oh/cli/src/lib/__tests__/config-render.test.ts +++ b/.oh/cli/src/lib/__tests__/config-render.test.ts @@ -57,7 +57,8 @@ describe("renderComposeEnv", () => { expect(text).toContain("GIT_USER_EMAIL=ada@example.com"); expect(text).toContain("INSTALL_OPENCODE=false"); expect(text).toContain("INSTALL_GROK_BUILD=false"); - expect(text).toContain("INSTALL_DEEPAGENTS=false"); + // #910: deepagents is retired; the key must no longer be rendered. + expect(text).not.toContain("INSTALL_DEEPAGENTS"); expect(text).toContain("INSTALL_HERMES=false"); expect(text).toContain("INSTALL_AGENT_BROWSER=false"); expect(text).toContain("DOCKER_SOCKET=true"); diff --git a/.oh/cli/src/lib/config-render.ts b/.oh/cli/src/lib/config-render.ts index 276b28b3..44a1f590 100644 --- a/.oh/cli/src/lib/config-render.ts +++ b/.oh/cli/src/lib/config-render.ts @@ -1,7 +1,13 @@ import type { OhConfig } from "./oh-config.js"; import { isSecretKey } from "./secrets.js"; -const RETIRED_KEYS = ["WORKTREES_DIR", "PROJECTS_DIR", "CRONS_DIR", "OH_PROJECT_ROOT"] as const; +const RETIRED_KEYS = [ + "WORKTREES_DIR", + "PROJECTS_DIR", + "CRONS_DIR", + "OH_PROJECT_ROOT", + "INSTALL_DEEPAGENTS", +] as const; export interface RenderedVar { key: string; @@ -24,7 +30,6 @@ export function renderComposeVars(config: OhConfig): RenderedVar[] { put("INSTALL_OPENCODE", config.install?.opencode); put("INSTALL_GROK_BUILD", config.install?.grokBuild); - put("INSTALL_DEEPAGENTS", config.install?.deepagents); put("INSTALL_HERMES", config.install?.hermes); put("INSTALL_AGENT_BROWSER", config.install?.agentBrowser); diff --git a/.oh/cli/src/lib/env-file.ts b/.oh/cli/src/lib/env-file.ts index d06293a5..e1e09d75 100644 --- a/.oh/cli/src/lib/env-file.ts +++ b/.oh/cli/src/lib/env-file.ts @@ -25,7 +25,6 @@ function stripQuotes(s: string): string { export const INSTALL_FIELDS: Record = { opencode: "install.opencode", grok_build: "install.grokBuild", - deepagents: "install.deepagents", hermes: "install.hermes", agent_browser: "install.agentBrowser", }; @@ -34,7 +33,6 @@ export const CONFIG_FIELD_BY_ENV_KEY: Record = { DOCKER_SOCKET: "access.dockerSocket", INSTALL_OPENCODE: INSTALL_FIELDS.opencode, INSTALL_GROK_BUILD: INSTALL_FIELDS.grok_build, - INSTALL_DEEPAGENTS: INSTALL_FIELDS.deepagents, INSTALL_HERMES: INSTALL_FIELDS.hermes, INSTALL_AGENT_BROWSER: INSTALL_FIELDS.agent_browser, }; diff --git a/.oh/cli/src/lib/harnesses/catalog.ts b/.oh/cli/src/lib/harnesses/catalog.ts index c677d52c..3975e173 100644 --- a/.oh/cli/src/lib/harnesses/catalog.ts +++ b/.oh/cli/src/lib/harnesses/catalog.ts @@ -102,17 +102,6 @@ export const HARNESS_CATALOG: readonly HarnessEntry[] = [ docsPath: "docs/harnesses/grok-build.md", kind: "optional", }, - { - id: "deepagents", - title: "DeepAgents", - binary: "deepagents", - harnessKey: "deepagents", - installArgv: ["uv", "tool", "install", "deepagents-cli"], - installUser: "sandbox", - verifyArgv: ["deepagents", "--version"], - docsPath: "docs/harnesses/deepagents.md", - kind: "optional", - }, { id: "hermes", title: "Hermes", diff --git a/.oh/cli/src/lib/oh-config.ts b/.oh/cli/src/lib/oh-config.ts index f09caac4..4014f8d4 100644 --- a/.oh/cli/src/lib/oh-config.ts +++ b/.oh/cli/src/lib/oh-config.ts @@ -36,7 +36,6 @@ export interface GitIdentity { export interface InstallFlags { opencode?: boolean; grokBuild?: boolean; - deepagents?: boolean; hermes?: boolean; agentBrowser?: boolean; } @@ -126,7 +125,6 @@ export function defaultOhConfig(name: string): OhConfig { install: { opencode: false, grokBuild: false, - deepagents: false, hermes: false, agentBrowser: false, }, @@ -222,7 +220,7 @@ export function validateOhConfig(value: unknown): OhConfig { const install = expectSection(record, "install"); if (install) { - for (const key of ["opencode", "grokBuild", "deepagents", "hermes", "agentBrowser"]) { + for (const key of ["opencode", "grokBuild", "hermes", "agentBrowser"]) { expectBoolean(install, key, "install."); } } @@ -349,7 +347,6 @@ export const OH_CONFIG_FIELDS: readonly OhConfigField[] = [ { path: "git.userEmail", type: "string" }, { path: "install.opencode", type: "boolean" }, { path: "install.grokBuild", type: "boolean" }, - { path: "install.deepagents", type: "boolean" }, { path: "install.hermes", type: "boolean" }, { path: "install.agentBrowser", type: "boolean" }, { path: "access.ssh", type: "boolean" }, diff --git a/.oh/evals/RESULTS.md b/.oh/evals/RESULTS.md index 880cf73a..25105ddf 100644 --- a/.oh/evals/RESULTS.md +++ b/.oh/evals/RESULTS.md @@ -6,108 +6,108 @@ probe id; git history is the time series.** Schema and exit-code semantics are i | probe | tier | last-run (UTC) | status | source | |-------|------|----------------|--------|--------| -| advisor-monitored-loop | A | 2026-08-31 17:17 | PASS | conversation 2026-06-19 (single-owner implementation workflow, issue #257) | -| agent-browser-cli | A | 2026-08-31 17:17 | PASS | retro lesson 2026-06-07 (agent-browser 0.8.5 CLI) | -| agents-identity-contract | A | 2026-08-31 17:17 | PASS | issue #854 — T3-style root identity, glossary, and skill-owned procedures | -| artifact-contract-audit | A | 2026-08-31 17:17 | PASS | issue #583/#645 — production /audit implementation Gate 1 behavior | -| audit-dispatcher-contract | A | 2026-08-31 17:17 | PASS | issue #645 — audit consolidation public taxonomy | -| audit-implementation-behavior | A | 2026-08-31 17:17 | PASS | issue #645 — implementation root/repo/browser behavior | -| audit-pr-acquire | A | 2026-08-31 17:17 | PASS | issue #645 — production PR acquisition behavior | -| audit-pr-classifier | A | 2026-08-31 17:17 | PASS | issue #645 — deterministic focused and queue PR classifier | -| audit-run-root-contract | A | 2026-08-31 17:17 | PASS | issue #645 — executable immutable audit root/run correlation | -| audit-shellcheck-coverage | A | 2026-08-31 17:17 | PASS | issue #645 — private audit scripts require release and CI lint coverage | -| audit-stale-references | A | 2026-08-31 17:17 | PASS | issue #645 — clean-breaking audit migration | -| boot-lint-glob | A | 2026-08-31 17:17 | PASS | issue #90, issue #120 | -| builder-skill-consolidation | A | 2026-08-31 17:17 | PASS | issue #643 — consolidate artifact builders behind one /builder dispatcher | -| capability-benchmark-schema | A | 2026-08-31 17:17 | PASS | issue #167 — capability benchmark instrument | -| cc-safety-net-wiring | A | 2026-08-31 17:17 | SKIPPED | .oh/tasks/cc-safety-net/prd.json US-007 2026-07-19 | -| changelog-entry-length | A | 2026-08-31 17:17 | PASS | conversation 2026-08-24 — CHANGELOG.md grew to 259KB of bullet prose because "one line" was unquantified | -| cleanup-tasks-scoped-guard | A | 2026-08-31 17:17 | PASS | issue #85 | -| cleanup-tasks-worktree-grooming | A | 2026-08-31 17:17 | PASS | issue #168; issue #327 | -| cli-publish-typecheck-scope | A | 2026-08-31 17:17 | PASS | release run 33271077312 — v0.5.0 pushed its GHCR image, then failed to publish | -| close-issues-on-development | A | 2026-08-31 17:17 | PASS | issue #841 (closing keywords never fire because the default branch is main) 2026-08-26 | -| codex-stale-response-retry | A | 2026-08-31 17:17 | PASS | issue #506 — Codex previous_response_not_found RCA | -| compose-config-path-parity | A | 2026-08-31 17:17 | PASS | PR #833 (remove harness.yaml — the wrapper and VS Code "Reopen in Container" paths must resolve the same service) 2026-08-26 | -| config-schema-parity | A | 2026-08-31 17:17 | PASS | PR #833 (one schema file — DOCKER_SOCKET, SANDBOX_SSH, OH_SANDBOX_IMAGE, OH_PULL_POLICY, SKIP_PNPM_INSTALL were consumed but undocumented); rewritten for the oh.json/secrets split by PR #887 | -| context-tier-size-budget | A | 2026-08-31 17:17 | PASS | .oh/tasks/spec-simplification/ (issue #816, US-007) — the always-on tier was 85,256 B | -| cron-claude-codex-fallback | A | 2026-08-31 17:17 | PASS | conversation 2026-06-12 (default Codex fallback for crons) | -| cron-watchdog | A | 2026-08-31 17:17 | PASS | issues #130/#453 (cron runtime watchdog + legacy system-cron reaping) 2026-06-19 | -| crons-directory-guide | A | 2026-08-31 17:17 | PASS | issue #874 | -| curl-bash-safe-alternatives | A | 2026-08-31 17:17 | PASS | vet-run/vet integration — public curl|bash examples need review-first alternatives | -| datasets-schema | A | 2026-08-31 17:17 | PASS | issue #196 — .oh/evals/datasets verifiable trajectory corpus (Repo2RLEnv-inspired) | -| debugmcp-availability | A | 2026-08-31 17:17 | SKIPPED | issue #297 — DebugMCP MCP debug-server availability | -| default-provisioning | A | 2026-08-31 17:17 | PASS | #902 — `oh harness install` must work from inside the sandbox, where | -| delegate-model-effort-policy | A | 2026-08-31 17:17 | PASS | conversation 2026-07-11 (delegate model inheritance and thinking policy) | -| devtcp-hook | A | 2026-08-31 17:17 | PASS | retro lesson 2026-06-10 (zsh /dev/tcp) | -| docker-inspect-env-guard | A | 2026-08-31 17:17 | PASS | operator directive 2026-08-08 (agents keep the docker socket, but must | -| docs-build-fast-path | A | 2026-08-31 17:17 | PASS | #455 — docs builds must stay out of fast harness/eval/release gates; #536 — docs site externalized to openharness-web; docs markdown relocated to docs/ | -| drift-check-cron-staleness-glob | A | 2026-08-31 17:17 | PASS | issue #98; issue #225 (restart-required cron frontmatter/config drift) | -| entrypoint-pnpm-manifest-fingerprint | A | 2026-08-31 17:17 | PASS | issue #521 (manifest-aware sandbox installs) 2026-07-01 | -| eval-ci-gate | A | 2026-08-31 17:17 | PASS | #103 — eval probe suite gated in CI | -| eval-gate | A | 2026-08-31 17:17 | PASS | retro lesson 2026-06-11 (eval-gate) | -| eval-results-atomic | A | 2026-08-31 17:17 | PASS | issue #83 (eval-results-atomic-write) | -| eval-runner-exit | A | 2026-08-31 17:17 | PASS | retro lesson 2026-06-11 (eval-runner-exit) #29 | -| eval-runs-once-per-cycle | A | 2026-08-31 17:17 | PASS | .oh/tasks/spec-simplification/ (issue #816, US-006) — /eval ran 3x per cycle on the | -| execution-target-contract | A | 2026-08-31 17:17 | PASS | issue #733 (ExecutionTarget contract + Docker Compose adapter) 2026-08-10 | -| get-oh-bootstrap | A | 2026-08-31 17:17 | PASS | get-oh.sh bootstrap — the Node-bootstrapping host-side path to the standalone `oh` CLI (also on npm as @mifune/openharness; see oh-npm-package.sh) | -| git-skill | A | 2026-08-31 17:17 | PASS | conversation 2026-06-15 — rules are not always supported; git workflow must be the /git skill | -| harness-audit-empty-output-gate | A | 2026-08-31 17:17 | PASS | issue #246 — /audit harness must fail closed on empty auditor outputs | -| harness-ci-core-paths | A | 2026-08-31 17:17 | PASS | #165 — core sandbox config files must trigger harness CI | -| harness-ci-hooks-paths | A | 2026-08-31 17:17 | PASS | issue #202 — credential/security hook changes must trigger harness CI | -| harness-yaml-migration | A | 2026-08-31 17:17 | PASS | PR #833 (migrate-harness-yaml.sh — append / uncomment-in-place / preserve / overwrite, plus a silent no-op second run) 2026-08-26 | -| health-check-docker-stats | A | 2026-08-31 17:17 | PASS | retro lesson 2026-06-10 (docker stats vs ps Size) | -| health-check-socket-degrade | A | 2026-08-31 17:17 | PASS | issue #762 (refs #756) — /health-check degrades to one statement, not nine failures | -| heartbeat-logging-contract | A | 2026-08-31 17:17 | PASS | issue #447 (heartbeat log append hardening) 2026-06-18 | -| image-seed-hygiene | A | 2026-08-31 17:17 | PASS | issue #900 (slim the sandbox image) 2026-08-30 | -| markitdown-wiki-ingest | A | 2026-08-31 17:17 | PASS | issue #649 — pinned local-document normalization contract for /wiki ingest | -| next-dev-prod | A | 2026-08-31 17:17 | SKIPPED | retro lesson 2026-06-04 | -| oh-compose-env-wiring | A | 2026-08-31 17:17 | PASS | issue #880 (oh as the only front door — oh.json is the non-secret config surface) | -| oh-config-surfaces | A | 2026-08-31 17:17 | REGRESSION | PR #887 (config split across two authored surfaces — a tracked oh.json and a secrets-only root dotenv — with nothing left under $HOME) | -| oh-destroy-guard | A | 2026-08-31 17:17 | PASS | issue #879 — `oh` becomes the only front door, so `make destroy` must | -| oh-devcontainer-restructure | A | 2026-08-31 17:17 | PASS | consolidate devcontainer — .oh/devcontainer/ folded back into .devcontainer/ | -| oh-home-mount | A | 2026-08-31 17:17 | PASS | issue #898 (single $HOME mount) 2026-08-30 | -| oh-image-only-deploy | A | 2026-08-31 17:17 | PASS | .oh/tasks/image-only-deploy/prd.json US-004 (issue #609, Flavor B image-only deploy) | -| oh-init-headless-config | A | 2026-08-31 17:17 | PASS | PR #827 (installer answers landed in the losing config file); retargeted to the .example.env template by PR #833, then to oh.json by PR #887 | -| oh-init-scaffold | A | 2026-08-31 17:17 | PASS | issue #531 Phase 2 | -| oh-lifecycle-surface | A | 2026-08-31 17:17 | PASS | issue #881 — the Makefile is retired and `oh` is the only front door | -| oh-npm-package | A | 2026-08-31 17:17 | PASS | npm publish path for the standalone `oh` CLI (@mifune/openharness) — alternative to get-oh.sh | -| oh-payload-manifest | A | 2026-08-31 17:17 | PASS | issue #531 follow-on (.oh payload manifest — oh update ships a declared allowlist) | -| oh-sandbox-image-mode | A | 2026-08-31 17:17 | PASS | conversation 2026-07-05 (basic Docker deployment — prebuilt-image mode) | -| oh-shipped-repo-overridable | A | 2026-08-31 17:17 | PASS | issue #531 follow-on (de-hardcode residual — shipped .oh shell scripts keep the upstream repo overridable) | -| oh-standalone-lifecycle | A | 2026-08-31 17:17 | PASS | issue #564 | -| oh-update | A | 2026-08-31 17:17 | PASS | issue #531 Phase 3 (oh update — upgrade only the .oh control plane) | -| operator-config-guard | A | 2026-08-31 17:17 | PASS | operator directives 2026-08-06 (.config/ and settings.local.json are operator-only) | -| pnpm-audit-ci-gate | A | 2026-08-31 17:17 | PASS | issue #171 — pnpm security audits must run in CI | -| post-bridge-publish-confirmation | A | 2026-08-31 17:17 | PASS | #523 — post-bridge live publishing requires an explicit final confirmation gate | -| prd-output-path-contract | A | 2026-08-31 17:17 | PASS | retro lesson 2026-06-19 | -| prompt-miner-schema-compat | A | 2026-08-31 17:17 | PASS | issue #253 — prompt-miner JSONL schema-drift guard | -| prompt-miner-symlink-entrypoint | A | 2026-08-31 17:17 | PASS | issue #663 — prompt-miner engine no-ops via the documented .claude/skills symlink | -| prompt-miner-weakness-record | A | 2026-08-31 17:17 | PASS | issue #580 — prompt-miner weakness-record (WH-xxx) cluster output | -| protected-path-deletion | A | 2026-08-31 17:17 | PASS | .oh/tasks/spec-simplification/ (issue #816, US-001) — the critique gate was deleted, | -| protected-paths-resolve | A | 2026-08-31 17:17 | PASS | issue #753 — .claude/protected-paths.txt named 7 paths that did not exist. | -| registry-portability-gate | A | 2026-08-31 17:17 | PASS | issue #758 | -| registry-portability | A | 2026-08-31 17:17 | SKIPPED | issue #758 | -| retro-deterministic-contract | A | 2026-08-31 17:17 | PASS | issue #443 — /retro deterministic output and self-contained helper contract | -| rl-delegation-write-worker | A | 2026-08-31 17:17 | PASS | retro lesson 2026-06-10 (rl-delegation) #57 | -| rlm-context-budget | A | 2026-08-31 17:17 | PASS | .oh/tasks/rlm-weighted-trajectories/prd.json US-006 | -| runtime-preflight-gate | A | 2026-08-31 17:17 | PASS | issue #806 § B1 (open sandbox.substrate vs sandbox.runtime selector); | -| sandbox-boot-guard-ci | A | 2026-08-31 17:17 | PASS | issue #449 (sandbox image build CI guard) 2026-06-19; | -| sandbox-node-base | A | 2026-08-31 17:17 | PASS | openharness#878 — oh as the only front door, T0 sandbox base image | -| skill-paths | A | 2026-08-31 17:17 | PASS | issue #43 — stale path references; extended by issue #69 — apps/->packages/ rename guard; extended by issue #870 — deleted .oh/agents/advisor.md | -| skills-dir-clean | A | 2026-08-31 17:17 | PASS | conversation 2026-06-29 — Pi parses every top-level `.md` in the skills | -| skills-task-tool-coupling | A | 2026-08-31 17:17 | PASS | council review 2026-08-29 (issue #886) — /delegate instructed Claude-Code-only | -| skills-vendored | A | 2026-08-31 17:17 | PASS | absorb .mifune submodule into .oh — the skills/agents/hooks pack is vendored | -| slack-admin-command-surface | A | 2026-08-31 17:17 | PASS | issue #354 — Slack bridge docs must distinguish Pi /msg-bridge commands from Slack DM admin text handlers | -| spec-family-contract | A | 2026-08-31 17:17 | PASS | issue #265; spec-simplification issue #816; workflow authority issue #854 | -| spec-ready-finalization | A | 2026-08-31 17:17 | PASS | issue #134; spec-simplification issue #816; workflow authority issue #854 | -| ste-checker-contract | A | 2026-08-31 17:17 | PASS | issue #750 PR audit — the /ste checker had four fail-open paths (unclosed | -| submitted-by-trailers | A | 2026-08-31 17:17 | PASS | conversation 2026-06-12 (commit attribution trailers); the single-owner | -| sync-skill-contract | A | 2026-08-31 17:17 | PASS | issue #331 — /sync dispatcher skill (bidirectional origin↔upstream sync) | -| tool-catalog-boundary | A | 2026-08-31 17:17 | PASS | agent-browser's exclusion from the harness catalog (#821) and the | -| version-parity | A | 2026-08-31 17:17 | PASS | conversation 2026-08-29 — the oh CLI became the only lifecycle door, so its | -| weigh-scorer-contract | A | 2026-08-31 17:17 | PASS | .oh/tasks/rlm-weighted-trajectories/prd.json US-003 (2026-06-27) | -| wiki-readme-index | A | 2026-08-31 17:17 | PASS | issue #132 — wiki README index drift guard | -| workflow-boundaries | A | 2026-08-31 17:17 | PASS | conversation 2026-06-19 (workflow consolidation, issue #259); authority moved to /spec in issue #854 | -| worktrees-layout | A | 2026-08-31 17:17 | PASS | issue #872 | +| advisor-monitored-loop | A | 2026-08-31 20:04 | PASS | conversation 2026-06-19 (single-owner implementation workflow, issue #257) | +| agent-browser-cli | A | 2026-08-31 20:04 | PASS | retro lesson 2026-06-07 (agent-browser 0.8.5 CLI) | +| agents-identity-contract | A | 2026-08-31 20:04 | PASS | issue #854 — T3-style root identity, glossary, and skill-owned procedures | +| artifact-contract-audit | A | 2026-08-31 20:04 | PASS | issue #583/#645 — production /audit implementation Gate 1 behavior | +| audit-dispatcher-contract | A | 2026-08-31 20:04 | PASS | issue #645 — audit consolidation public taxonomy | +| audit-implementation-behavior | A | 2026-08-31 20:04 | PASS | issue #645 — implementation root/repo/browser behavior | +| audit-pr-acquire | A | 2026-08-31 20:04 | PASS | issue #645 — production PR acquisition behavior | +| audit-pr-classifier | A | 2026-08-31 20:04 | PASS | issue #645 — deterministic focused and queue PR classifier | +| audit-run-root-contract | A | 2026-08-31 20:04 | PASS | issue #645 — executable immutable audit root/run correlation | +| audit-shellcheck-coverage | A | 2026-08-31 20:04 | PASS | issue #645 — private audit scripts require release and CI lint coverage | +| audit-stale-references | A | 2026-08-31 20:04 | PASS | issue #645 — clean-breaking audit migration | +| boot-lint-glob | A | 2026-08-31 20:04 | PASS | issue #90, issue #120 | +| builder-skill-consolidation | A | 2026-08-31 20:04 | PASS | issue #643 — consolidate artifact builders behind one /builder dispatcher | +| capability-benchmark-schema | A | 2026-08-31 20:04 | PASS | issue #167 — capability benchmark instrument | +| cc-safety-net-wiring | A | 2026-08-31 20:04 | SKIPPED | .oh/tasks/cc-safety-net/prd.json US-007 2026-07-19 | +| changelog-entry-length | A | 2026-08-31 20:04 | PASS | conversation 2026-08-24 — CHANGELOG.md grew to 259KB of bullet prose because "one line" was unquantified | +| cleanup-tasks-scoped-guard | A | 2026-08-31 20:04 | PASS | issue #85 | +| cleanup-tasks-worktree-grooming | A | 2026-08-31 20:04 | PASS | issue #168; issue #327 | +| cli-publish-typecheck-scope | A | 2026-08-31 20:04 | PASS | release run 33271077312 — v0.5.0 pushed its GHCR image, then failed to publish | +| close-issues-on-development | A | 2026-08-31 20:04 | PASS | issue #841 (closing keywords never fire because the default branch is main) 2026-08-26 | +| codex-stale-response-retry | A | 2026-08-31 20:04 | PASS | issue #506 — Codex previous_response_not_found RCA | +| compose-config-path-parity | A | 2026-08-31 20:04 | PASS | PR #833 (remove harness.yaml — the wrapper and VS Code "Reopen in Container" paths must resolve the same service) 2026-08-26 | +| config-schema-parity | A | 2026-08-31 20:04 | PASS | PR #833 (one schema file — DOCKER_SOCKET, SANDBOX_SSH, OH_SANDBOX_IMAGE, OH_PULL_POLICY, SKIP_PNPM_INSTALL were consumed but undocumented); rewritten for the oh.json/secrets split by PR #887 | +| context-tier-size-budget | A | 2026-08-31 20:04 | PASS | .oh/tasks/spec-simplification/ (issue #816, US-007) — the always-on tier was 85,256 B | +| cron-claude-codex-fallback | A | 2026-08-31 20:04 | PASS | conversation 2026-06-12 (default Codex fallback for crons) | +| cron-watchdog | A | 2026-08-31 20:04 | PASS | issues #130/#453 (cron runtime watchdog + legacy system-cron reaping) 2026-06-19 | +| crons-directory-guide | A | 2026-08-31 20:04 | PASS | issue #874 | +| curl-bash-safe-alternatives | A | 2026-08-31 20:04 | PASS | vet-run/vet integration — public curl|bash examples need review-first alternatives | +| datasets-schema | A | 2026-08-31 20:04 | PASS | issue #196 — .oh/evals/datasets verifiable trajectory corpus (Repo2RLEnv-inspired) | +| debugmcp-availability | A | 2026-08-31 20:04 | SKIPPED | issue #297 — DebugMCP MCP debug-server availability | +| default-provisioning | A | 2026-08-31 20:04 | PASS | #902 — `oh harness install` must work from inside the sandbox, where | +| delegate-model-effort-policy | A | 2026-08-31 20:04 | PASS | conversation 2026-07-11 (delegate model inheritance and thinking policy) | +| devtcp-hook | A | 2026-08-31 20:04 | PASS | retro lesson 2026-06-10 (zsh /dev/tcp) | +| docker-inspect-env-guard | A | 2026-08-31 20:04 | PASS | operator directive 2026-08-08 (agents keep the docker socket, but must | +| docs-build-fast-path | A | 2026-08-31 20:04 | PASS | #455 — docs builds must stay out of fast harness/eval/release gates; #536 — docs site externalized to openharness-web; docs markdown relocated to docs/ | +| drift-check-cron-staleness-glob | A | 2026-08-31 20:04 | PASS | issue #98; issue #225 (restart-required cron frontmatter/config drift) | +| entrypoint-pnpm-manifest-fingerprint | A | 2026-08-31 20:04 | PASS | issue #521 (manifest-aware sandbox installs) 2026-07-01 | +| eval-ci-gate | A | 2026-08-31 20:04 | PASS | #103 — eval probe suite gated in CI | +| eval-gate | A | 2026-08-31 20:04 | PASS | retro lesson 2026-06-11 (eval-gate) | +| eval-results-atomic | A | 2026-08-31 20:04 | PASS | issue #83 (eval-results-atomic-write) | +| eval-runner-exit | A | 2026-08-31 20:04 | PASS | retro lesson 2026-06-11 (eval-runner-exit) #29 | +| eval-runs-once-per-cycle | A | 2026-08-31 20:04 | PASS | .oh/tasks/spec-simplification/ (issue #816, US-006) — /eval ran 3x per cycle on the | +| execution-target-contract | A | 2026-08-31 20:04 | PASS | issue #733 (ExecutionTarget contract + Docker Compose adapter) 2026-08-10 | +| get-oh-bootstrap | A | 2026-08-31 20:04 | PASS | get-oh.sh bootstrap — the Node-bootstrapping host-side path to the standalone `oh` CLI (also on npm as @mifune/openharness; see oh-npm-package.sh) | +| git-skill | A | 2026-08-31 20:04 | PASS | conversation 2026-06-15 — rules are not always supported; git workflow must be the /git skill | +| harness-audit-empty-output-gate | A | 2026-08-31 20:04 | PASS | issue #246 — /audit harness must fail closed on empty auditor outputs | +| harness-ci-core-paths | A | 2026-08-31 20:04 | PASS | #165 — core sandbox config files must trigger harness CI | +| harness-ci-hooks-paths | A | 2026-08-31 20:04 | PASS | issue #202 — credential/security hook changes must trigger harness CI | +| harness-yaml-migration | A | 2026-08-31 20:04 | PASS | PR #833 (migrate-harness-yaml.sh — append / uncomment-in-place / preserve / overwrite, plus a silent no-op second run) 2026-08-26 | +| health-check-docker-stats | A | 2026-08-31 20:04 | PASS | retro lesson 2026-06-10 (docker stats vs ps Size) | +| health-check-socket-degrade | A | 2026-08-31 20:04 | PASS | issue #762 (refs #756) — /health-check degrades to one statement, not nine failures | +| heartbeat-logging-contract | A | 2026-08-31 20:04 | PASS | issue #447 (heartbeat log append hardening) 2026-06-18 | +| image-seed-hygiene | A | 2026-08-31 20:04 | PASS | issue #900 (slim the sandbox image) 2026-08-30 | +| markitdown-wiki-ingest | A | 2026-08-31 20:04 | PASS | issue #649 — pinned local-document normalization contract for /wiki ingest | +| next-dev-prod | A | 2026-08-31 20:04 | SKIPPED | retro lesson 2026-06-04 | +| oh-compose-env-wiring | A | 2026-08-31 20:04 | PASS | issue #880 (oh as the only front door — oh.json is the non-secret config surface) | +| oh-config-surfaces | A | 2026-08-31 20:04 | REGRESSION | PR #887 (config split across two authored surfaces — a tracked oh.json and a secrets-only root dotenv — with nothing left under $HOME) | +| oh-destroy-guard | A | 2026-08-31 20:04 | PASS | issue #879 — `oh` becomes the only front door, so `make destroy` must | +| oh-devcontainer-restructure | A | 2026-08-31 20:04 | PASS | consolidate devcontainer — .oh/devcontainer/ folded back into .devcontainer/ | +| oh-home-mount | A | 2026-08-31 20:04 | PASS | issue #898 (single $HOME mount) 2026-08-30 | +| oh-image-only-deploy | A | 2026-08-31 20:04 | PASS | .oh/tasks/image-only-deploy/prd.json US-004 (issue #609, Flavor B image-only deploy) | +| oh-init-headless-config | A | 2026-08-31 20:04 | PASS | PR #827 (installer answers landed in the losing config file); retargeted to the .example.env template by PR #833, then to oh.json by PR #887 | +| oh-init-scaffold | A | 2026-08-31 20:04 | PASS | issue #531 Phase 2 | +| oh-lifecycle-surface | A | 2026-08-31 20:04 | PASS | issue #881 — the Makefile is retired and `oh` is the only front door | +| oh-npm-package | A | 2026-08-31 20:04 | PASS | npm publish path for the standalone `oh` CLI (@mifune/openharness) — alternative to get-oh.sh | +| oh-payload-manifest | A | 2026-08-31 20:04 | PASS | issue #531 follow-on (.oh payload manifest — oh update ships a declared allowlist) | +| oh-sandbox-image-mode | A | 2026-08-31 20:04 | PASS | conversation 2026-07-05 (basic Docker deployment — prebuilt-image mode) | +| oh-shipped-repo-overridable | A | 2026-08-31 20:04 | PASS | issue #531 follow-on (de-hardcode residual — shipped .oh shell scripts keep the upstream repo overridable) | +| oh-standalone-lifecycle | A | 2026-08-31 20:04 | PASS | issue #564 | +| oh-update | A | 2026-08-31 20:04 | PASS | issue #531 Phase 3 (oh update — upgrade only the .oh control plane) | +| operator-config-guard | A | 2026-08-31 20:04 | PASS | operator directives 2026-08-06 (.config/ and settings.local.json are operator-only) | +| pnpm-audit-ci-gate | A | 2026-08-31 20:04 | PASS | issue #171 — pnpm security audits must run in CI | +| post-bridge-publish-confirmation | A | 2026-08-31 20:04 | PASS | #523 — post-bridge live publishing requires an explicit final confirmation gate | +| prd-output-path-contract | A | 2026-08-31 20:04 | PASS | retro lesson 2026-06-19 | +| prompt-miner-schema-compat | A | 2026-08-31 20:04 | PASS | issue #253 — prompt-miner JSONL schema-drift guard | +| prompt-miner-symlink-entrypoint | A | 2026-08-31 20:04 | PASS | issue #663 — prompt-miner engine no-ops via the documented .claude/skills symlink | +| prompt-miner-weakness-record | A | 2026-08-31 20:04 | PASS | issue #580 — prompt-miner weakness-record (WH-xxx) cluster output | +| protected-path-deletion | A | 2026-08-31 20:04 | PASS | .oh/tasks/spec-simplification/ (issue #816, US-001) — the critique gate was deleted, | +| protected-paths-resolve | A | 2026-08-31 20:04 | PASS | issue #753 — .claude/protected-paths.txt named 7 paths that did not exist. | +| registry-portability-gate | A | 2026-08-31 20:04 | PASS | issue #758 | +| registry-portability | A | 2026-08-31 20:04 | SKIPPED | issue #758 | +| retro-deterministic-contract | A | 2026-08-31 20:04 | PASS | issue #443 — /retro deterministic output and self-contained helper contract | +| rl-delegation-write-worker | A | 2026-08-31 20:04 | PASS | retro lesson 2026-06-10 (rl-delegation) #57 | +| rlm-context-budget | A | 2026-08-31 20:04 | PASS | .oh/tasks/rlm-weighted-trajectories/prd.json US-006 | +| runtime-preflight-gate | A | 2026-08-31 20:04 | PASS | issue #806 § B1 (open sandbox.substrate vs sandbox.runtime selector); | +| sandbox-boot-guard-ci | A | 2026-08-31 20:04 | PASS | issue #449 (sandbox image build CI guard) 2026-06-19; | +| sandbox-node-base | A | 2026-08-31 20:04 | PASS | openharness#878 — oh as the only front door, T0 sandbox base image | +| skill-paths | A | 2026-08-31 20:04 | PASS | issue #43 — stale path references; extended by issue #69 — apps/->packages/ rename guard; extended by issue #870 — deleted .oh/agents/advisor.md | +| skills-dir-clean | A | 2026-08-31 20:04 | PASS | conversation 2026-06-29 — Pi parses every top-level `.md` in the skills | +| skills-task-tool-coupling | A | 2026-08-31 20:04 | PASS | council review 2026-08-29 (issue #886) — /delegate instructed Claude-Code-only | +| skills-vendored | A | 2026-08-31 20:04 | PASS | absorb .mifune submodule into .oh — the skills/agents/hooks pack is vendored | +| slack-admin-command-surface | A | 2026-08-31 20:04 | PASS | issue #354 — Slack bridge docs must distinguish Pi /msg-bridge commands from Slack DM admin text handlers | +| spec-family-contract | A | 2026-08-31 20:04 | PASS | issue #265; spec-simplification issue #816; workflow authority issue #854 | +| spec-ready-finalization | A | 2026-08-31 20:04 | PASS | issue #134; spec-simplification issue #816; workflow authority issue #854 | +| ste-checker-contract | A | 2026-08-31 20:04 | PASS | issue #750 PR audit — the /ste checker had four fail-open paths (unclosed | +| submitted-by-trailers | A | 2026-08-31 20:04 | PASS | conversation 2026-06-12 (commit attribution trailers); the single-owner | +| sync-skill-contract | A | 2026-08-31 20:04 | PASS | issue #331 — /sync dispatcher skill (bidirectional origin↔upstream sync) | +| tool-catalog-boundary | A | 2026-08-31 20:04 | PASS | agent-browser's exclusion from the harness catalog (#821) and the | +| version-parity | A | 2026-08-31 20:04 | PASS | conversation 2026-08-29 — the oh CLI became the only lifecycle door, so its | +| weigh-scorer-contract | A | 2026-08-31 20:04 | PASS | .oh/tasks/rlm-weighted-trajectories/prd.json US-003 (2026-06-27) | +| wiki-readme-index | A | 2026-08-31 20:04 | PASS | issue #132 — wiki README index drift guard | +| workflow-boundaries | A | 2026-08-31 20:04 | PASS | conversation 2026-06-19 (workflow consolidation, issue #259); authority moved to /spec in issue #854 | +| worktrees-layout | A | 2026-08-31 20:04 | PASS | issue #872 | diff --git a/.oh/evals/probes/oh-home-mount.sh b/.oh/evals/probes/oh-home-mount.sh index a529c2e0..25682d0d 100755 --- a/.oh/evals/probes/oh-home-mount.sh +++ b/.oh/evals/probes/oh-home-mount.sh @@ -17,7 +17,7 @@ done fails=() RETIRED_VOLUMES=(claude-auth codex-auth pi-auth opencode-auth grok-auth - deepagents-auth herdr-data cloudflared-auth ssh-config config-dir + herdr-data cloudflared-auth ssh-config config-dir cc-safety-net oh_workspace) for compose in "$COMPOSE_PRIMARY" "$COMPOSE_IO"; do diff --git a/.oh/install/banner.sh b/.oh/install/banner.sh index 544f267f..fdf45196 100755 --- a/.oh/install/banner.sh +++ b/.oh/install/banner.sh @@ -107,18 +107,6 @@ if command -v grok >/dev/null 2>&1; then fi fi -deepagents_status="$status_x" -deepagents_detail="not installed — run: oh harness install deepagents" -if command -v deepagents >/dev/null 2>&1; then - if [ -s "${HOME}/.deepagents/.env" ] || [ -s "${HOME}/.deepagents/config.toml" ]; then - deepagents_status="$status_ok" - deepagents_detail="configured" - else - deepagents_status="$status_ok" - deepagents_detail="installed — configure ~/.deepagents/.env or run: deepagents" - fi -fi - hermes_status="$status_x" hermes_detail="not installed — run: oh harness install hermes" if command -v hermes >/dev/null 2>&1; then @@ -171,7 +159,6 @@ printf ' %-6s %-11s %s\n' "$codex_status" "codex" "$codex_detail" printf ' %-6s %-11s %s\n' "$opencode_status" "opencode" "$opencode_detail" printf ' %-6s %-11s %s\n' "$grok_status" "grok" "$grok_detail" printf ' %-6s %-11s %s\n' "$pi_status" "pi" "$pi_detail" -printf ' %-6s %-11s %s\n' "$deepagents_status" "deepagents" "$deepagents_detail" printf ' %-6s %-11s %s\n' "$hermes_status" "hermes" "$hermes_detail" [ -n "$dashboard_status" ] && printf ' %-6s %-11s %s\n' "$dashboard_status" "dashboard" "$dashboard_detail" printf ' %-6s %-11s %s\n' "$oh_status" "oh" "$oh_detail" @@ -179,7 +166,6 @@ printf '\n' shortcuts="claude · codex · pi" command -v opencode >/dev/null 2>&1 && shortcuts="$shortcuts · opencode" command -v grok >/dev/null 2>&1 && shortcuts="$shortcuts · grok" -command -v deepagents >/dev/null 2>&1 && shortcuts="$shortcuts · deepagents" command -v hermes >/dev/null 2>&1 && shortcuts="$shortcuts · hermes" printf ' Recovery commands: %s · tmux attach -t cron-system\n' "$shortcuts" printf '\n' diff --git a/.oh/scripts/install.sh b/.oh/scripts/install.sh index b8cf7050..765835fd 100644 --- a/.oh/scripts/install.sh +++ b/.oh/scripts/install.sh @@ -118,7 +118,7 @@ Env vars: same name is already running (default: refuse, so a live sandbox is never overwritten) INSTALL_HERMES=true Enable an optional agent non-interactively. Also: - INSTALL_OPENCODE, INSTALL_DEEPAGENTS, INSTALL_GROK_BUILD, + INSTALL_OPENCODE, INSTALL_GROK_BUILD, INSTALL_AGENT_BROWSER DOCKER_SOCKET=true Mount the host Docker socket into the sandbox non-interactively. OFF by default (socket access is @@ -438,7 +438,6 @@ _opt_install() { } _opt_install HERMES install.hermes "Hermes — Nous self-improving agent CLI" _opt_install OPENCODE install.opencode "OpenCode — OpenAI-OAuth terminal agent" -_opt_install DEEPAGENTS install.deepagents "DeepAgents — LangChain multi-provider agent" _opt_install GROK_BUILD install.grokBuild "Grok Build — xAI terminal agent" _opt_install AGENT_BROWSER install.agentBrowser "agent-browser + Chromium (~1 GB)" @@ -492,7 +491,6 @@ printf " ${CYAN}Optional capabilities${NC} (installed live — no rebuild)\n" printf " ──────────────────────────────────────\n" printf " oh harness install hermes — Hermes agent (then 'hermes setup'; optional dashboard)\n" printf " oh harness install opencode — OpenCode terminal agent\n" -printf " oh harness install deepagents — LangChain DeepAgents\n" printf " oh harness install grok-build — xAI Grok Build\n" printf " oh tool install agent-browser — headless Chromium for screenshots / previews (~1 GB)\n" printf " (each flips the matching install.* flag in oh.json)\n" diff --git a/.oh/scripts/migrate-harness-yaml.sh b/.oh/scripts/migrate-harness-yaml.sh index ba30a3c2..c45b073b 100755 --- a/.oh/scripts/migrate-harness-yaml.sh +++ b/.oh/scripts/migrate-harness-yaml.sh @@ -26,7 +26,6 @@ BEGIN { envmap["git.user_email"] = "GIT_USER_EMAIL" envmap["install.opencode"] = "INSTALL_OPENCODE" envmap["install.grok_build"] = "INSTALL_GROK_BUILD" - envmap["install.deepagents"] = "INSTALL_DEEPAGENTS" envmap["install.hermes"] = "INSTALL_HERMES" envmap["install.agent_browser"] = "INSTALL_AGENT_BROWSER" envmap["hermes.dashboard"] = "HERMES_DASHBOARD" @@ -140,7 +139,6 @@ _field_for() { GIT_USER_EMAIL) printf 'git.userEmail string\n' ;; INSTALL_OPENCODE) printf 'install.opencode boolean\n' ;; INSTALL_GROK_BUILD) printf 'install.grokBuild boolean\n' ;; - INSTALL_DEEPAGENTS) printf 'install.deepagents boolean\n' ;; INSTALL_HERMES) printf 'install.hermes boolean\n' ;; INSTALL_AGENT_BROWSER) printf 'install.agentBrowser boolean\n' ;; HERMES_DASHBOARD) printf 'hermesDashboard.enabled boolean\n' ;; diff --git a/CHANGELOG.md b/CHANGELOG.md index b827f1de..f79e816f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,12 +13,13 @@ Update policy and release automation live in [`/git`](.claude/skills/git/SKILL.m - Shrink the sandbox image ~540 MB: drop build caches from the baked home seed, stage the seed once via a builder stage, and keep untracked build output out of the build context ([#900](https://github.com/mifunedev/openharness/issues/900)). - **BREAKING:** Stop baking Claude Code, Codex, and Pi into the image; boot installs them into the home mount, so a first boot needs network and runs 60-180s longer ([#904](https://github.com/mifunedev/openharness/issues/904)). - **BREAKING:** Stop baking Herdr and cloudflared into the image; both become `kind: "default"` tools installed into `~/.local/bin` at boot from a pinned, checksum-verified binary ([#906](https://github.com/mifunedev/openharness/issues/906)). -- **BREAKING:** Stop baking OpenCode, DeepAgents, Hermes, and Grok Build into the image; `oh harness install ` installs them into `~/.local` as the sandbox user ([#908](https://github.com/mifunedev/openharness/issues/908)). +- **BREAKING:** Stop baking OpenCode, Hermes, and Grok Build into the image; `oh harness install ` installs them into `~/.local` as the sandbox user ([#908](https://github.com/mifunedev/openharness/issues/908)). ### Removed - Remove the `BAKE_HARNESSES` and `AGENTS` build args along with the image bake they gated; the harness catalog is the only source of truth for what gets installed ([#904](https://github.com/mifunedev/openharness/issues/904)). - Remove Cloudflare's apt repository and its bookworm-suite pin from the image; Docker's is now the only third-party apt source ([#906](https://github.com/mifunedev/openharness/issues/906)). - Remove the four optional-harness build args and the dead `buildArg` catalog field; the `install.*` keys keep working and now drive boot provisioning ([#908](https://github.com/mifunedev/openharness/issues/908)). +- **BREAKING:** Retire the DeepAgents harness — `deepagents-cli` is deprecated upstream. `install.deepagents` is no longer a settable oh.json field ([#910](https://github.com/mifunedev/openharness/issues/910)). - **BREAKING:** Retire the `projectRoot` / `OH_PROJECT_ROOT` config knob — the checkout is fixed at `/home/sandbox/harness`, nested inside the home mount ([#898](https://github.com/mifunedev/openharness/issues/898)). ### Added diff --git a/README.md b/README.md index 6f9dc420..79bac09b 100644 --- a/README.md +++ b/README.md @@ -174,7 +174,6 @@ herdr # first command: open the primary interactive workspace # codex # OpenAI Codex CLI # pi # Pi Coding Agent # opencode # OpenCode (optional: oh harness install opencode) -# deepagents # LangChain DeepAgents (optional: oh harness install deepagents) # hermes # Nous Research Hermes (optional: oh harness install hermes) # grok # xAI Grok Build (optional: oh harness install grok-build) oh stop # stop the sandbox, keeping volumes @@ -216,7 +215,7 @@ the image-mode recipe. | | | |---|---| -| **Core agents** | Defaults: Claude Code, Codex, Pi. Optional: OpenCode, DeepAgents, Hermes, Grok Build | +| **Core agents** | Defaults: Claude Code, Codex, Pi. Optional: OpenCode, Hermes, Grok Build | | **Runtimes** | Node 22, pnpm, Bun, uv (Python) | | **DevOps** | Herdr, Docker CLI + Compose, GitHub CLI, cloudflared, tmux, croner | | **Browser** | agent-browser + Chromium (headless) | diff --git a/docs/README.md b/docs/README.md index 07f48165..29877e29 100644 --- a/docs/README.md +++ b/docs/README.md @@ -46,7 +46,6 @@ Open Harness vendors the shared skills/agents/hooks primitive pack directly into - [Codex](harnesses/codex.md) - [Pi](harnesses/pi.md) - [OpenCode](harnesses/opencode.md) -- [DeepAgents](harnesses/deepagents.md) - [Hermes](harnesses/hermes.md) - [Grok Build](harnesses/grok-build.md) - [T3 Code](harnesses/t3code.md) diff --git a/docs/configuration.md b/docs/configuration.md index 25babe7e..a4def2e1 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -56,14 +56,13 @@ to; `—` means the field is consumed by the `oh` CLI itself and never rendered. All off by default. `oh harness install ` flips the matching field and installs into the running sandbox with no rebuild. The four harness fields map -to `oh harness` names: `opencode`, `grok-build`, `deepagents`, `hermes`. +to `oh harness` names: `opencode`, `grok-build`, `hermes`. `agentBrowser` is not a harness — `oh tool install agent-browser` manages it. | Field | Type | Default | Compose variable | What it does | | --- | --- | --- | --- | --- | | `install.opencode` | boolean | `false` | `INSTALL_OPENCODE` | Install the OpenCode CLI into `~/.local` at boot. `oh harness install opencode` sets it and installs now. | | `install.grokBuild` | boolean | `false` | `INSTALL_GROK_BUILD` | Install the Grok Build CLI into `~/.local` at boot. `oh harness install grok-build` sets it and installs now. | -| `install.deepagents` | boolean | `false` | `INSTALL_DEEPAGENTS` | Install the DeepAgents CLI into `~/.local` at boot. `oh harness install deepagents` sets it and installs now. | | `install.hermes` | boolean | `false` | `INSTALL_HERMES` | Install the Hermes CLI into `~/.local` at boot and enable its runtime wiring (skill vendoring, `auth.json`). | | `install.agentBrowser` | boolean | `false` | `INSTALL_AGENT_BROWSER` | Install agent-browser and Chromium (about 1 GB). | diff --git a/docs/harnesses/deepagents.md b/docs/harnesses/deepagents.md deleted file mode 100644 index cb924d64..00000000 --- a/docs/harnesses/deepagents.md +++ /dev/null @@ -1,187 +0,0 @@ ---- -title: "DeepAgents" ---- - -# DeepAgents - -DeepAgents is LangChain's terminal coding agent. It runs interactive -conversational sessions and one-shot non-interactive tasks against multiple -LLM providers, with optional shell tool use gated by an explicit allow list. - -DeepAgents is an **optional supported runtime** in Open Harness. The default -agent set is Claude Code, Codex, and Pi; enable DeepAgents when its provider -mix or non-interactive shell-allow-list model is the right fit for a task. - -## Purpose - -- Multi-provider agent (Anthropic, OpenAI, etc.) configurable from a single - `~/.deepagents/.env` file. -- Non-interactive mode (`-n "$task"`) with explicit shell-allow-list gating, - suitable for bounded `/spec execute` worker tasks with a constrained default tool surface. -- Project-aware: optionally reads memory and skills from a repo-local - `.deepagents/` directory at the workspace root. - -## Install (optional) - -The shortest path is the CLI, which sets the `.devcontainer/.env` flag **and** -installs into the already-running sandbox without a rebuild: - -```bash -oh harness install deepagents -``` - -See [Harnesses Overview](./overview.md#installing-a-harness) for `--persist-only`, -`--no-persist`, and what happens when the sandbox is not running. - -### Manual path - -Enable DeepAgents in `.devcontainer/.env`: - -```yaml -install: - deepagents: true -``` - -Or set `INSTALL_DEEPAGENTS=true` in `.devcontainer/.env` (legacy). - -Either way the boot provisioner installs it on the next start — no rebuild: - -```bash -oh stop && oh sandbox -``` - -Open Harness installs the upstream CLI with `uv tool install` as the `sandbox` -user, which lands it in `~/.local/bin` inside the home mount: - -```bash -uv tool install deepagents-cli -``` - -The `deepagents` shim lands on `/usr/local/bin` so it is on PATH for the -`sandbox` user when the flag is enabled. - -Verify the install inside the sandbox: - -```bash -deepagents -v -``` - -If the command is not found, run `oh harness install deepagents` — it installs -into `~/.local/bin` in the running sandbox and sets `install.deepagents` so a -fresh home mount reinstalls it at boot. No rebuild is involved. - -## Authentication and provider keys - -DeepAgents reads provider API keys from `~/.deepagents/.env` and CLI -defaults from `~/.deepagents/config.toml`. The directory is persisted by -the single `/home/sandbox` mount by default, so credentials survive -container rebuilds. - -Create the env file on first use: - -```bash -mkdir -p ~/.deepagents -cat > ~/.deepagents/.env <<'EOF' -ANTHROPIC_API_KEY=sk-ant-... -OPENAI_API_KEY=sk-... -EOF -chmod 600 ~/.deepagents/.env -``` - -The sandbox banner reports DeepAgents as **installed** when `deepagents` is -on PATH and **configured** only when `~/.deepagents/.env` or -`~/.deepagents/config.toml` is non-empty — an empty mounted directory is -not treated as authenticated. - -## State persistence and repo-local `.deepagents/` - -Two separate directories carry DeepAgents state, with very different -durability and review semantics: - -| Path | Scope | Persistence | Notes | -|---|---|---|---| -| `~/.deepagents/` | Per-sandbox user state | Survives rebuilds via the `/home/sandbox` mount | Provider keys, model defaults, memory, skills, sessions live here. **Only place secrets here.** | -| `/.deepagents/` | Per-project | Whatever git decides | Project memory and skills the agent may load from the workspace root. **Treat as project data — follows normal `.gitignore` and code-review rules.** | - -A repo-local `.deepagents/` directory may be read by the agent and may be -committed to the repository — keep secrets and provider keys **only** in -`~/.deepagents/` or in ignored local files. Never commit a `.env` to the -repo-local `.deepagents/`. - -v1 of Open Harness persists only `/home/sandbox/.deepagents`; the -repo-local `.deepagents/` is project data subject to your repository's -ordinary git rules. - -## Common usage - -### Interactive - -Launch a conversational session: - -```bash -deepagents -``` - -Run inside a dedicated tmux session so the conversation survives shell -disconnects (per `.claude/rules/sandbox-processes.md`): - -```bash -tmux new-session -d -s agent-deepagents 'deepagents' -tmux attach -t agent-deepagents -``` - -### Non-interactive - -Pass a task with `-n` for a single execution. By default DeepAgents -**disables shell execution in non-interactive mode** unless an allow list -is configured via `-S`/`--shell-allow-list` or -`DEEPAGENTS_CLI_SHELL_ALLOW_LIST`. Open Harness defaults pick the -`recommended` allow list, never `all`: - -```bash -deepagents -y --shell-allow-list recommended -n "Summarize the changes on this branch" -q --no-stream -``` - -Flags: - -- `-y` — assume "yes" to confirmation prompts (the sandbox is the trust - boundary). -- `--shell-allow-list recommended` — allow only the curated safe shell - command set. **Do not default to `all`** — see the warning below. -- `-n "$task"` — non-interactive single task. -- `-q --no-stream` — quiet, buffered output for clean log capture. - -### `/spec execute` usage - -`/spec execute` owns implementation in one Advisor session. If DeepAgents is the chosen -provider for a bounded worker, run it directly with a task prompt; do not add a second -workflow or a provider-specific executor wrapper: - -```bash -deepagents -y --shell-allow-list recommended -q --no-stream --max-turns 25 -n "$task" -``` - -DeepAgents is never auto-selected. Keep its shell allow-list explicit and let the Advisor -validate the worker's result against the story acceptance criteria. - -> **`--shell-allow-list all` warning.** Choosing `--shell-allow-list all` -> grants unrestricted non-interactive shell -> execution. Combined with the mounted Docker socket (enabled by default -> in the base compose file), this can affect sibling containers or the -> host Docker daemon. Only use `all` for trusted tasks where -> you have accepted that risk explicitly. - -## Tips - -- Keep provider keys in `~/.deepagents/.env`. Never commit a repo-local - `.deepagents/.env`. -- Pair DeepAgents with a git worktree so its branch is isolated. -- Inspect non-interactive runs with `tmux attach -t agent-deepagents` (or - the Advisor-owned task session) to see live progress. - -## Upstream documentation - -- [DeepAgents documentation](https://docs.langchain.com/oss/python/deepagents/overview) -- [DeepAgents CLI overview](https://docs.langchain.com/oss/python/deepagents/cli/overview) -- [DeepAgents CLI configuration](https://docs.langchain.com/oss/python/deepagents/cli/configuration) -- [`langchain-ai/deepagents` on GitHub](https://github.com/langchain-ai/deepagents/tree/main/libs/cli) diff --git a/docs/harnesses/hermes.md b/docs/harnesses/hermes.md index f217257c..05940088 100644 --- a/docs/harnesses/hermes.md +++ b/docs/harnesses/hermes.md @@ -11,7 +11,7 @@ container sandboxing across multiple backends, and bridges to chat platforms (Telegram, Discord, Slack, WhatsApp, Signal, Email). Hermes is an **optional harness** in Open Harness. Install it with `oh harness install hermes` (or set `install.hermes` / `INSTALL_HERMES=true`, which the boot provisioner honours); it then sits alongside `claude`, `codex`, -`pi`, `opencode`, and `deepagents` as a sandbox CLI primitive. See the +`pi`, and `opencode` as a sandbox CLI primitive. See the upstream documentation below for canonical facts about Hermes. ## Purpose diff --git a/docs/harnesses/overview.md b/docs/harnesses/overview.md index a5849e68..16b7bc15 100644 --- a/docs/harnesses/overview.md +++ b/docs/harnesses/overview.md @@ -4,7 +4,7 @@ title: "Harnesses Overview" # Harnesses Overview -Open Harness provisions three agent CLIs into `~/.local` on first boot: **Claude Code** (default), **Codex**, and **Pi**. **OpenCode**, **DeepAgents**, **Hermes**, and **Grok Build** are optional — install one with `oh harness install `, which also sets its `install.*` key so a fresh home mount reinstalls it at boot. No harness is baked into the image. **T3 Code** runs on demand via the `/t3` skill (or directly with `npx t3`) as a browser UI on port 3773, and **Prime Agent** installs on demand with `oh harness install prime-agent` — neither has an `INSTALL_*` key, because neither is ever baked into the image. Inside the sandbox, run `herdr` first, then launch whichever agent you prefer from its panes and switch between them at any time. Reserve tmux for Open Harness's managed/headless cron, gateway, and watchdog infrastructure. +Open Harness provisions three agent CLIs into `~/.local` on first boot: **Claude Code** (default), **Codex**, and **Pi**. **OpenCode**, **Hermes**, and **Grok Build** are optional — install one with `oh harness install `, which also sets its `install.*` key so a fresh home mount reinstalls it at boot. No harness is baked into the image. **T3 Code** runs on demand via the `/t3` skill (or directly with `npx t3`) as a browser UI on port 3773, and **Prime Agent** installs on demand with `oh harness install prime-agent` — neither has an `INSTALL_*` key, because neither is ever baked into the image. Inside the sandbox, run `herdr` first, then launch whichever agent you prefer from its panes and switch between them at any time. Reserve tmux for Open Harness's managed/headless cron, gateway, and watchdog infrastructure. Open Harness is the harness; the **agent** is your call. To go beyond the preinstalled options, install via `npm` / `pip` / `cargo` inside the sandbox or edit the Dockerfile. For Pi+Slack specifically, the recommended path is the `pi-messenger-bridge` npm package — see [Slack integration](../integrations/slack.md). The product surface is one developer, one project, one agent — not racing or stacking multiple CLIs against each other. @@ -51,7 +51,6 @@ The manual path still works: uncomment the key in `.devcontainer/.env` (or expor | [Codex](./codex.md) | OpenAI's CLI coding agent | `codex` | preinstalled | | [OpenCode](./opencode.md) | Terminal coding agent with OpenAI OAuth support | `opencode` | optional: `oh harness install opencode` | | [Pi](./pi.md) | Lightweight, customizable agent | `pi` | default | -| [DeepAgents](./deepagents.md) | LangChain's multi-provider terminal agent | `deepagents` | optional: `oh harness install deepagents` | | [Hermes](./hermes.md) | Nous Research's self-improving terminal agent | `hermes` | optional: `oh harness install hermes` | | [Grok Build](./grok-build.md) | xAI's proprietary Grok Build terminal agent | `grok` | optional: `oh harness install grok-build` | | [T3 Code](./t3code.md) | Browser UI over Claude/Codex/OpenCode (port 3773) | `/t3` or `npx t3` | on-demand | @@ -66,7 +65,6 @@ pi --version # Optional CLIs, present only after `oh harness install ` (or its install.* key): opencode --version # install.opencode: true -deepagents -v # install.deepagents: true hermes --version # install.hermes: true grok --version # install.grok_build: true @@ -82,7 +80,6 @@ Open Harness provisions Claude Code, Codex, and Pi into `~/.local` on first boot - **Codex**: run `codex login` (see [Codex](./codex.md)). - **OpenCode**: run `opencode auth login` (see [OpenCode](./opencode.md)). - **Pi**: configure provider keys via environment variables (see [Pi](./pi.md)). -- **DeepAgents**: write provider keys to `~/.deepagents/.env` (see [DeepAgents](./deepagents.md)). - **Hermes**: run `hermes setup` (see [Hermes](./hermes.md)). - **Grok Build**: run `grok login --device-auth` for headless/remote auth, `grok login` for interactive OAuth, or set `XAI_API_KEY` as a fallback (see [Grok Build](./grok-build.md)). Cached `~/.grok/auth.json` takes precedence over `XAI_API_KEY`. - **Prime Agent**: run `prime-agent`, then `/login` — OAuth for ChatGPT Plus/Pro (Codex), Claude Pro/Max, or GitHub Copilot; API keys via environment variables or the same `/login` flow. Credentials land in `~/.prime/agent/auth.json` (see [Prime Agent](./prime-agent.md)). diff --git a/docs/installation.md b/docs/installation.md index c9b45a9f..9de2ea32 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -311,7 +311,6 @@ Optional CLIs are excluded from the default image; `oh harness install ` f | OpenAI Codex | `codex` | OpenAI's coding agent (aliased to `codex --dangerously-bypass-approvals-and-sandbox`) | default | | Pi | `pi` | `@earendil-works/pi-coding-agent` — local-first coding agent (was `@mariozechner/pi-coding-agent`, now deprecated) | default | | OpenCode | `opencode` | `opencode-ai` — terminal coding agent with OpenAI OAuth support | optional: `oh harness install opencode` | -| DeepAgents | `deepagents` | LangChain's multi-provider terminal agent (`deepagents-cli` via `uv tool install`) | optional: `oh harness install deepagents` | | Hermes | `hermes` | Nous Research's self-improving agent CLI | optional: `oh harness install hermes` | | Grok Build | `grok` | xAI's proprietary Grok Build CLI (`@xai-official/grok@0.2.39`, Node >=20) | optional: `oh harness install grok-build` | | agent-browser | `agent-browser` | Headless Chromium for web-capable agents | optional: `oh tool install agent-browser` | diff --git a/docs/quickstart.md b/docs/quickstart.md index f7d4c20c..144cbf31 100644 --- a/docs/quickstart.md +++ b/docs/quickstart.md @@ -125,7 +125,7 @@ they live in the home mount, not the image, so `oh harness install ` upgrade them in place without a rebuild. A first boot on a fresh home mount therefore needs network access and takes a minute or two longer; the sandbox still comes up as a usable shell if the registry is unreachable, and you can retry with -`bash .oh/scripts/provision-defaults.sh`. OpenCode, DeepAgents, Hermes, and Grok +`bash .oh/scripts/provision-defaults.sh`. OpenCode, Hermes, and Grok Build are optional installs via `oh harness install `; T3 Code runs on demand via the `/t3` skill or direct `npx`. Authenticate at least one harness before use. @@ -142,7 +142,6 @@ or direct `npx`. Authenticate at least one harness before use. - **[Codex](./harnesses/codex.md)**: `codex login --device-auth` (device mode; or `/login` in-session) - **[OpenCode](./harnesses/opencode.md)**: `oh harness install opencode`, then run `opencode auth login` - **[Pi](./harnesses/pi.md)**: configure provider keys via environment variables -- **[DeepAgents](./harnesses/deepagents.md)**: `oh harness install deepagents`, then write provider keys to `~/.deepagents/.env` - **[Hermes](./harnesses/hermes.md)**: `oh harness install hermes`, then run `hermes setup` - **[Grok Build](./harnesses/grok-build.md)**: `oh harness install grok-build`, verify `grok --version`, then run `grok login --device-auth` (headless/remote) or `grok login` - **[T3 Code](./harnesses/t3code.md)**: authenticate one of Claude / Codex / OpenCode, then `/t3` or `npx t3` (browser UI on port 3773) @@ -189,7 +188,6 @@ lifecycle command.) "git": { "userName": "your-name", "userEmail": "you@example.com" }, "install": { "opencode": false, - "deepagents": false, "hermes": false, "grokBuild": false, "agentBrowser": false @@ -221,7 +219,6 @@ full field reference, and `oh config set ` to edit one field. | `git.userEmail` | Commit author email | | `install.agentBrowser` | Set `true` to install Chromium (~1 GB) | | `install.opencode` | Set `true` to include OpenCode in the sandbox image | -| `install.deepagents` | Set `true` to include DeepAgents in the sandbox image | | `install.hermes` | Set `true` to include Hermes in the sandbox image; state defaults to `~/harness/.hermes`, auth lives in `~/.hermes` | | `install.grokBuild` | Set `true` to include Grok Build in the sandbox image; all Grok user state lives in the persisted `~/.grok` volume | diff --git a/oh.json b/oh.json index c17aad65..91f571b9 100644 --- a/oh.json +++ b/oh.json @@ -7,7 +7,6 @@ "install": { "opencode": false, "grokBuild": false, - "deepagents": false, "hermes": false, "agentBrowser": false },