# Every harness dejima supports, and every one under assessment, so a session
# working on this repo can run and test the integration rather than reason
# about it. A harness dejima claims to support and cannot exercise here is one
# whose guards are asserted rather than observed.
#
# claude-code is not listed: like every supported harness it installs from its
# own manifest's `install` spec, into a layer of its own above the base image.
# Nothing here has to name it.
npm:opencode-ai

# The second supported harness. Listed here even though it installs from its
# own manifest like claude-code does, because that spec only puts it in the
# image when it is the SELECTED harness - and a session working on dejima runs
# one harness while needing to exercise the other.
#
# Needs AVX2: its CLI is a Bun-embedded compiled binary and Bun's default build
# requires it, so a VM whose CPU model is x86-64-v2-AES - Proxmox's default for
# new guests - gets SIGILL before any output, and no baseline build is
# published. x86-64-v3 or better is the requirement, and it is a property of
# the VM rather than of dejima. See docs/development.md, "Worked example:
# Cline".
#
# No allowed-domains entry accompanies this, unlike opencode: Cline fetches no
# provider catalogue at startup. Its own hosted endpoints (api.cline.bot,
# app.cline.bot, otel.cline.bot) are deliberately absent for the same reason
# the model API is - a name granted by being written here is a name nobody
# reviewed, and the point is to point it at an endpoint of our choosing.
npm:cline

apt:tmux
apt:bats

# What `bats --jobs` needs. CI runs every suite with
# `--jobs $(nproc) --no-parallelize-across-files`, so without this a sandbox
# cannot run the suites the way they are actually run - and the failure is
# quiet in the worst way: bats exits with "Cannot execute N jobs without GNU
# parallel" and produces no test output at all, so a check that greps for
# `not ok` reads a suite that never ran as a suite that passed.
#
# Debian's `parallel` IS GNU parallel. moreutils ships a different binary of
# the same name and conflicts with it; bats needs this one.
apt:parallel
# The other half of what CI runs. The CI job installs it itself, so without
# this line a sandbox is the one place the gate cannot be run at all - and a
# base image that happens to carry it is not a guarantee, as one that stopped
# carrying it demonstrated.
apt:shellcheck
