PocketHarness: a tiny coding-agent harness in one C++ binary for Linux

How do I install PocketHarness?

git clone https://github.com/yunusemrejr/pocketharness
cd pocketharness
./install.sh        # builds, tests, installs to ~/.local/bin/pocket

Or manually: make && make test && make install. Then verify with command -v pocket, pocket --version and pocket --help. The requirements are g++ (C++20), make and curl, with no bundled third-party code. Chrome or Chromium, FFmpeg with H.264 encoding, and a llama.cpp llama-server with a GGUF file are optional, for screenshots, video export and the free local judge.

What is the loop at the centre of it?

terminal → agent loop → model provider → optional tool call → Linux/filesystem → result → agent loop

Everything else is a small native function hung on that loop. General-purpose work is delegated to Linux rather than wrapped: curl for HTTPS, Chrome for screenshots, FFmpeg for video and llama.cpp for the local judge.

Which tools does the model get?

Exactly five: read, write, edit, bash and skill. There are intentionally no tools for git, grep, find, curl, npm, python, compilers, test runners, todos, memory or background jobs; the model uses normal programs through bash. The README's reason is that every wrapper would add another schema, authority boundary, test surface and context cost.

How does it limit what the agent can do?

Safety is enforced by the harness and the Linux kernel, not by asking the model to behave. The README lists openat2 path containment, Landlock confinement of every model command, NO_NEW_PRIVS so there is no sudo or setuid gain, and a refusal to run as root unless --allow-root is given. By default the workspace is readable and writable, while $HOME, ~/.ssh and other repositories are not accessible. Model bash has network access by default; --offline denies it.

What does it deliberately leave out?

The README's "anti-goals" rule out an extension or plugin API, event bus, MCP, dependency graph, swarms, a subagent or workflow framework, an embedded browser runtime, a vector database, telemetry, capability registries, wrappers for Linux commands and dependency-injection frameworks. It links no libcurl, Boost, ncurses or OpenSSL, uses no SQLite, and contains no second language.