Secrets in tool traces are a leak. My harness redacts tokens from every Claude GPT Cursor and Codex log before it leaves the box. Shipping agents means shipping the scrub.
@MilksandMatcha@claudeai@cerebras@communidiyi treating the coding agent as a possible attacker is the right threat model. secrets stay out of the context window or you already lost
This is the wrong approach
Running agents inside the sandbox is simple in theory
But in production, the sandbox's blast radius becomes your agent's blast radius
For example, with the DigitalOcean architecture:
- Sandbox crashes / OOMs β agent loop dies with it
- Disk fills up or env breaks β agent is bricked
- Exposing your own API as tools β needs extra infra
- Creds can't live in the sandbox β needs a whole credential proxy layer
- Sleeping sandbox can't wake itself for crons
- Updating agent code β updating the binary in every VM
- Monitoring β the sandbox has to report its own failures
Separate the harness from the sandbox instead:
- Run the harness in your backend
- Expose the sandbox as tools
- Keep creds, history, and permissions outside
- Wake the sandbox only when needed
Amp, Vercel Eve, Cloudflare Flue, Claude Managed Agents, and OpenAI's Agents SDK all use this architecture for a reason
I wrote more on why and how here: https://t.co/AEnHx0z4mx
Agent Harness 0.12 is out.
0.11 showed what your agents spend in tokens. 0.12 prices it in dollars, exports the ledger over OTLP, logs what every hook decided, and adds /land and /close-out so work runs from question to merged PR to a closed session.
https://t.co/qadCiIdy3A
An agent is simply a loop covering these states:
Discrete perception -> generate -> act
Nothing about this originates anything, it all works by the agent harness acting on this loop. If the loop doesn't fire, the agent doesn't do anything.
It's not rocket science.