harness-deploy

Deploy supported coding-agent harnesses on TrueFoundry.

Supported harnesses:

hermes-agent
claude-code
codex
pi
goose

This repo stays intentionally small:

• one operator skill: skills/harness-deploy
• one TrueFoundry deployment path under harnesses/*/deployments/truefoundry
• one Docker image definition per supported runtime
• optional local UI/API in ui/ for agent records, previews, and deploy plans
• generated local agent state in agents/, ignored by Git

Install

Prerequisites: git, Node.js 22+, npm, and Docker for the optional local Hermes image check.

npx skills add mnvsk97/harness-deploy --yes

Then ask Codex to deploy a supported harness:

Deploy Hermes Agent to TrueFoundry.
Deploy Codex to TrueFoundry.
Deploy Goose to TrueFoundry.

Configure

cp .env.example .env

Fill only local .env values. Do not commit secrets.

Required values:

TFY_HOST
TFY_API_KEY
TFY_WORKSPACE_FQN
TFY_SECRET_TENANT
HARNESS_API_HOST
HARNESS_RUNTIME_HOST
HARNESS_MODEL

Runtime credentials belong in TrueFoundry SecretGroups. Rendered manifests use tfy-secret://... references, not raw secret values.

Operate

The skill reads .env, renders manifests under agents/, applies TrueFoundry resources, waits for rollout, and runs smoke tests.

The optional UI is only a thin local control surface:

cd ui
npm install
npm run api
npm run dev

Open http://127.0.0.1:5174; the API listens on http://127.0.0.1:8787. The UI prepares plans, but the skill owns platform apply, rollout checks, and live smoke tests.

Verify Hermes Locally

bash harnesses/hermes-agent/deployments/truefoundry/local-docker-smoke.sh

Without TFY Gateway credentials, this checks /health and /v1/models. With gateway credentials, it also runs the chat smoke test.

Source Layout

skills/harness-deploy/
harnesses/<harness>/harness.yaml
harnesses/<harness>/<image-dir>/Dockerfile
harnesses/<harness>/deployments/truefoundry/
ui/

The ui/ folder uses TypeScript for both the Vite/React frontend and the Hono local API/job runner. Production runs the compiled server from ui/dist-server/.

Safety

• Use TFY LLM Gateway for models.
• Use TFY MCP Gateway for tools.
• Use TrueFoundry SecretGroups for secrets.
• Use Daytona for terminal/code execution.
• Do not run untrusted terminal/code execution inside Hermes or the control API.
• Keep replicas: 1 while state is file-backed.