harness9

The deciding trait is how it feels to sit in front of. Output streams as it arrives, running tools show a spinner rather than silence, completion works where you reflexively press tab, and the screen changes shape between greeting you and working with you. None of that appears on a feature comparison and all of it decides whether you open the thing tomorrow.

What it is not is remarkable underneath. The agent behaviour is the category standard. Pick it for the hours you will spend looking at it. Pick another if you never will.

The boundary is drawn in one place and there are two doors. Registered tools execute in a container, which is the right default, while an escape prefix runs a command directly and the database of everything the agent learned sits on the host filesystem. An attacker or a confused model does not have to defeat the container; it can decline to use it.

What it does right is choosing containment as the default at all, which most projects of this size skip entirely and describe as lightweight.

1. The three concerns listed are exactly the ones that break long sessions, and stating them as first-order problems is more useful than another list of supported models. 2. Running tools concurrently is a genuine efficiency choice with a genuine cost, since two tools touching the same working tree can interleave, and the row records no ordering guarantee or conflict rule.

2. Nothing is measured. Recovery and timeout behaviour are precisely the properties a short benchmark could demonstrate cheaply, and none is offered, so the claims stay claims.

Quality and viability are separate questions and this answers only the first. The craft is evident and the measured uptake is nothing, which is the most common outcome for good tools in a crowded category: being better is not distribution. There is nothing to price, nobody to bill, and no organisation whose survival would carry it.

Moat: none. Likely acquirer: none; the ideas get absorbed, the repository stays where it is. Likely path: eighteen months of commits, then a maintenance note. Position: use it, own your fork early.

Data never leaving the host is the answer I usually spend a month extracting from a vendor. It also means sixty separate stores of what agents did, with no central view, so an investigation requires collecting evidence desk by desk and retention policy is whatever each engineer's disk does.

There is no identity layer, no directory sync and no unattended mode, so this stays a personal tool rather than a controlled stage in delivery. Nothing to license across the team, model spend only. Approved with conditions: managed installation, and a stated policy for the local records.

Reading the instructions file the rest of my toolchain already reads is a small decision that saves a real annoyance, because my steering lives in one place and every agent I try inherits it. The permissive licence and a Go source tree mean patching it is an evening, not a project.

The omissions are the usual two. My own weights are not a supported destination, so the model always comes from somebody's API, and there is no protocol port for the servers I run. Fixable in a fork, which is the point of the licence.