feat(studio): add managed Harness Sidecar integration

Author: yanan.zhangyn

.github/workflows/harness-sidecar-release-gate.yaml

@@ -0,0 +1,87 @@
+name: Harness Sidecar Release Gate
+
+on:
+  workflow_call:
+  push:
+    paths:
+      - '.github/workflows/harness-sidecar-release-gate.yaml'
+      - 'frontend/**'
+      - 'tests/cli/test_generated_agent_harness_sidecar.py'
+      - 'tests/cli/test_managed_sidecar_source.py'
+      - 'tests/cli/test_generated_agent_backend_codegen_extended.py'
+      - 'tests/cli/test_studio_rbac.py'
+      - 'tests/extensions/harness/**'
+      - 'tests/integrations/agentkit/test_app.py'
+      - 'veadk/cli/generated_agent_codegen.py'
+      - 'veadk/cli/cli_frontend.py'
+      - 'veadk/cli/managed_sidecar_source.py'
+      - 'veadk/extensions/harness/**'
+      - 'veadk/integrations/agentkit/app.py'
+      - 'pyproject.toml'
+  pull_request:
+    paths:
+      - '.github/workflows/harness-sidecar-release-gate.yaml'
+      - 'frontend/**'
+      - 'tests/cli/test_generated_agent_harness_sidecar.py'
+      - 'tests/cli/test_managed_sidecar_source.py'
+      - 'tests/cli/test_generated_agent_backend_codegen_extended.py'
+      - 'tests/cli/test_studio_rbac.py'
+      - 'tests/extensions/harness/**'
+      - 'tests/integrations/agentkit/test_app.py'
+      - 'veadk/cli/generated_agent_codegen.py'
+      - 'veadk/cli/cli_frontend.py'
+      - 'veadk/cli/managed_sidecar_source.py'
+      - 'veadk/extensions/harness/**'
+      - 'veadk/integrations/agentkit/app.py'
+      - 'pyproject.toml'
+
+permissions:
+  contents: read
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.17.0
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install Python test dependencies
+        run: python -m pip install -e '.[dev]'
+
+      - name: Enforce public Python Sidecar coverage above 90 percent
+        run: |
+          python -m pytest -q \
+            tests/extensions/harness/test_studio_sidecar.py \
+            tests/extensions/harness/test_sidecar_public_api.py \
+            tests/extensions/harness/test_extension.py \
+            tests/cli/test_generated_agent_harness_sidecar.py \
+            tests/cli/test_managed_sidecar_source.py \
+            tests/integrations/agentkit/test_app.py \
+            tests/cli/test_studio_rbac.py::test_sidecar_deployment_uses_agentkit_cli_structured_release \
+            tests/cli/test_generated_agent_backend_codegen_extended.py::test_generated_agent_sidecar_debug_uses_runtime_apig_and_active_plan \
+            --cov=. --cov-branch --cov-report= --cov-fail-under=0
+          python -m coverage report \
+            --include='*/veadk/extensions/harness/sidecar.py' \
+            --fail-under=91 --show-missing
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: npm ci --ignore-scripts
+
+      - name: Enforce public Studio Sidecar coverage above 90 percent
+        working-directory: frontend
+        run: npm run test:harness-sidecar-coverage
+
+      - name: Verify frontend Sidecar integration
+        working-directory: frontend
+        run: npm test

.github/workflows/publish-studio-release.yaml

@@ -39,10 +39,17 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  harness-sidecar-release-gate:
+    if: >-
+      github.repository == 'volcengine/veadk-python' &&
+      (github.event_name == 'pull_request' || github.ref == 'refs/heads/main')
+    uses: ./.github/workflows/harness-sidecar-release-gate.yaml
+
   verify:
     if: >-
       github.repository == 'volcengine/veadk-python' &&
       (github.event_name == 'pull_request' || github.ref == 'refs/heads/main')
+    needs: harness-sidecar-release-gate
     runs-on: ubuntu-latest
     timeout-minutes: 45
 

.github/workflows/publish-tag-to-pypi.yaml

@@ -5,7 +5,11 @@ on:
   workflow_dispatch:
 
 jobs:
+  harness-sidecar-release-gate:
+    uses: ./.github/workflows/harness-sidecar-release-gate.yaml
+
   build:
+    needs: harness-sidecar-release-gate
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/push-preview-image-to-vecr.yaml

@@ -24,7 +24,12 @@ on:
   workflow_dispatch:
 
 jobs:
+  harness-sidecar-release-gate:
+    if: github.repository == 'volcengine/veadk-python'
+    uses: ./.github/workflows/harness-sidecar-release-gate.yaml
+
   build-and-push:
+    needs: harness-sidecar-release-gate
     runs-on: ubuntu-latest
 
     # To avoid forked repo execute this workflow
@@ -64,4 +69,4 @@ jobs:
             --push \
             --cache-from=type=gha \
             --cache-to=type=gha,mode=max \
-            .
+            .

.github/workflows/push-stable-image-to-vecr.yaml

@@ -22,7 +22,12 @@ on:
   workflow_dispatch:
 
 jobs:
+  harness-sidecar-release-gate:
+    if: github.repository == 'volcengine/veadk-python'
+    uses: ./.github/workflows/harness-sidecar-release-gate.yaml
+
   build-and-push:
+    needs: harness-sidecar-release-gate
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -67,4 +72,4 @@ jobs:
             --push \
             --cache-from=type=gha \
             --cache-to=type=gha,mode=max \
-            .
+            .

.gitignore

@@ -45,6 +45,7 @@ htmlcov/
 .cache
 nosetests.xml
 coverage.xml
+coverage/
 *.cover
 *.py,cover
 .hypothesis/

frontend/README.md

@@ -130,17 +130,22 @@ server that `veadk frontend` launches — no separate backend.
   instead of credentials. Long descriptions, names, component summaries, IDs,
   and environment values stay inside the scrollable panel.
 - **Custom-agent workbench**: configure an agent with a rich Markdown
-  system-prompt editor (including heading and list shortcuts), then debug with
-  expandable, copyable runner error details, per-result Trace inspection, and
-  review. The lifecycle follows Architecture, Debug, Environment, and Publish.
-  The Environment step can optionally add the official Lark CLI and GitHub CLI
-  to the cloud runtime. Selecting either tool generates an inspectable
-  provider-specific Dockerfile with pinned releases, amd64/arm64 assets, and
-  SHA-256 verification. Advanced configuration can edit that Dockerfile
-  directly or restore the provider-specific generated version; selecting
-  neither and leaving the Dockerfile unchanged keeps AgentKit's default image
-  build. Credentials are never written into the generated Dockerfile.
-  In-progress drafts are stored only in the current browser and scoped
+  system-prompt editor (including heading and list shortcuts), choose Harness
+  Sidecar optimizations, then debug with expandable, copyable runner error
+  details and per-result Trace inspection. The workbench order is `架构` →
+  `优化` → `调试` → `环境` → `发布`. On the optimization page, `自定义`
+  appears first and starts with no components, while `运维场景` applies the
+  `ops` component combination. Component checkboxes remain editable and an empty
+  selection keeps Sidecar disabled. The Environment step can optionally add the
+  official Lark CLI, GitHub CLI, and Pandoc to the cloud runtime. Selecting a
+  tool generates an inspectable provider-specific Dockerfile with pinned
+  releases, amd64/arm64 assets, and SHA-256 verification. Advanced configuration
+  can edit that Dockerfile directly or restore the generated version; selecting
+  no tool and leaving the Dockerfile unchanged keeps AgentKit's default image
+  build. Credentials are never written into the generated Dockerfile. Published
+  Agent details display the saved Sidecar scenario and selected components as
+  read-only information. In-progress drafts are stored only in the current
+  browser and scoped
   to the signed-in user. MCP tokens are converted to Runtime environment
   variables: generated source retains only the `${ENV_NAME}` reference, while
   YAML and browser drafts preserve the corresponding environment value.