Toolchains | HarnessToolchains in the source-owned Harness documentation.Harnessreferenceharnessreferenceadopterdeveloperoperatorreference

Toolchains

Toolchain providers are discovered without executing probe commands. Dedicated tools run inside the declared substrate confinement and remain available when the generic run tool is not published. Custom specifications must be named explicitly with --toolchain-spec FILE.

`go`

Go through the installed GOROOT, with mutable caches in the workspace.

Project markers: go.mod, go.work.

Model context: go.version.

Tool	Parameters	Generic role	Effects	Description
`go_build`	`package: string`	`build`	process, filesystem, workspace write; high risk	Build Go packages with network and checksum lookup disabled.
`go_test`	`package: string`	`test`	process, filesystem, workspace write; high risk	Run Go tests with network and checksum lookup disabled.
`go_vet`	`package: string`	`check`	process, filesystem, workspace write; high risk	Run go vet with network and checksum lookup disabled.
`go_fmt_check`	`paths: workspace-path-list` (required)	`fmt_check`	process, filesystem; high risk	List explicitly named Go files that are not gofmt formatted.
`go_fmt`	`paths: workspace-path-list` (required)	`—`	process, filesystem, workspace write; high risk	Format only the explicitly named Go source files.
`go_bench`	`package: string`	`—`	process, filesystem, workspace write; high risk	Run Go benchmarks with network and checksum lookup disabled.
`go_run`	`args: string-list`, `package: string`	`—`	process, filesystem, workspace write; high risk	Build and run one Go package with network lookup disabled.
`go_fetch`	—	`—`	process, filesystem, workspace write; high risk	Resolve Go modules from already-present local data only.

`npm`

Root package.json scripts run with npm.

Project markers: package.json.

Tool	Parameters	Generic role	Effects	Description
`npm_run`	`args: string-list`, `script: enum` (required)	`—`	process, filesystem, workspace write; high risk	Run one statically discovered package.json script with npm.

`rust`

Rust through the installed rustup stable toolchain, locked and offline.

Project markers: Cargo.toml.

Model context: rust.version.

Tool	Parameters	Generic role	Effects	Description
`rust_check`	`package: string`, `release: boolean`	`check`	process, filesystem, workspace write; high risk	Type-check the Rust workspace with the locked dependency graph, offline.
`rust_build`	`package: string`, `release: boolean`	`build`	process, filesystem, workspace write; high risk	Build the Rust workspace with the locked dependency graph, offline.
`rust_test`	`package: string`, `release: boolean`	`test`	process, filesystem, workspace write; high risk	Run Rust tests with the locked dependency graph, offline.
`rust_clippy`	`package: string`, `release: boolean`	`—`	process, filesystem, workspace write; high risk	Run Clippy offline and deny warnings.
`rust_fmt_check`	—	`fmt_check`	process, filesystem; high risk	Check Rust formatting without changing source files.
`rust_fmt`	`paths: workspace-path-list` (required)	`—`	process, filesystem, workspace write; high risk	Format only the explicitly named Rust source files.
`rust_bench`	`package: string`, `release: boolean`	`—`	process, filesystem, workspace write; high risk	Run Rust benchmarks offline.
`rust_run`	`args: string-list`, `bin: string` (required), `package: string`, `release: boolean`	`—`	process, filesystem, workspace write; high risk	Build and run one named Rust binary offline.
`rust_fetch`	—	`—`	process, filesystem, workspace write; high risk	Resolve the locked Rust dependency graph from the local cache only.

`taskfile`

Statically discovered public Taskfile tasks.

Project markers: Taskfile.yml, Taskfile.yaml, taskfile.yml, taskfile.yaml.

Tool	Parameters	Generic role	Effects	Description
`taskfile_run`	`args: string-list`, `task: enum` (required)	`—`	process, filesystem, workspace write; high risk	Run one statically discovered public Taskfile task.

`yarn`

Root package.json scripts run with Yarn classic.

Project markers: package.json, yarn.lock.

Tool	Parameters	Generic role	Effects	Description
`yarn_run`	`args: string-list`, `script: enum` (required)	`—`	process, filesystem, workspace write; high risk	Run one statically discovered package.json script with Yarn.

Custom specifications

Use toolchains validate FILE, then pass the same file with --toolchain-spec FILE. Custom providers are additive: provider, tool, mount, and context key collisions refuse the entire file. Specifications use typed argv segments and cannot contain shell strings or executable discovery probes.

version: 1
toolchains:
  - name: example
    description: Example checker
    project:
      all: [example.lock]
    sandbox:
      programs: [example]
      env:
        HOME: "{workspace}"
        PATH: /usr/local/bin:/usr/bin:/bin
    tools:
      - name: example_test
        description: Run the example tests.
        role: test
        workspace-writes: true
        parameters:
          package: { kind: string }
        commands:
          - argv: [example, test, { option: { name: --package, arg: package } }]

Project markers and JSON/YAML values are read beneath the canonical workspace. Installation roots may come from a named environment directory, a home-relative directory, or a program found on PATH; each root declares required files and is mounted read-only beneath /toolchain. Context facts are bounded scalar reads and enter the prompt only with expose-to-model: true.

go​

npm​

rust​

taskfile​

yarn​

Custom specifications​