supply chain

Supply chain and security

How harnessed treats third-party agent tooling, and where credentials are allowed to exist. This page used to be the "Supply chain & security" section of the README.

• pnpm everywhere. Every JavaScript install (global, per-recipe, hatago's bundled servers) uses pnpm, never npm or npx. pnpm dlx replaces npx. A managed supply-chain config applies minimumReleaseAge cooldowns and lifecycle-script default-deny. Recipe validation flags raw npm / npx and points at the pnpm equivalent (design rationale).
• In-image supply-chain scan (advisory). The derived image's final layer runs snyk (over mise node globals and recipe installs, via a synthesized manifest; token-gated by a build secret, warn-skips without one), plus credential-free osv-scanner (recipe lockfiles) and pip-audit (the Python env). It reports a compact severity summary and writes scan-report.json. It does not fail the build. harnessed installs third-party agent tooling whose dependency trees always carry open advisories; a hard gate would block every build on code you do not control. Visibility is the deliverable.
• Opt-in secrets. varlock + 1Password resolve op:// refs as env only (never a profile, image layer, or repo file): into the pod for container-run, into the agent process for host-run. Copy .env.schema.example to ~/.config/harnessed/.env.schema to turn it on. See secrets.
• Nightly re-scan. A systemd user timer re-runs osv-scanner online against installed images so a CVE disclosed after build still surfaces. Setup, including the loginctl enable-linger prerequisite, is in troubleshooting.
• Secrets and auth referenced, never baked. Claude OAuth, scanner tokens, and 1Password secrets reach the instance as env or read-only mounts, never an image layer.
• Pinned downloads. No @latest, no --branch main. The build rejects them. harnessed update finds outdated pins and offers to bump them, with a pnpm-style minimumReleaseAge window (default 7 days) so a release younger than the window is not offered. See pin management.

Scanner tokens (for example SNYK_TOKEN) are read from the environment. There is no harnessed auth command.

All examples in the repo use placeholder values only (op(op://Private/Snyk/credential), dummy tokens), never real credentials.