feat(cli): wire URL-referenced harness resources into fullsend run

[ggallen]

Summary

• Integrates the resource resolver (PR feat: add resource resolver for URL-referenced harness resources #1623) into fullsend run so URL-referenced declarative resources (agent, policy, skills) are fetched, cached, and validated end-to-end
• Adds --offline flag to reject network fetches and use only cached resources
• Adds HasURLReferences() helper to skip resolution logic entirely for local-only harnesses (zero behavioral change for existing users)
• Inserts validation and resolution between ResolveRelativeTo and ValidateFilesExist: ValidateResourceTypes → ValidateAllowedRemoteResources → ResolveHarness

This is PR 8 — the final PR for Phase 1 of universal harness access (ADR-0038).

Depends on: #1623 (merged)

Test plan

• HasURLReferences() table-driven tests (local-only, URL agent, URL policy, URL skill)
• --offline flag registration test
• go test ./... — all existing and new tests pass
• go vet ./... — clean
• Pre-commit hooks pass
• Manual: run an existing local-only harness — verify no behavioral change
• Manual: create a harness with URL-referenced agent + allowed_remote_resources — verify fetch, cache, and execution
• Manual: fullsend run --offline with URL harness — verify cache miss fails, cache hit succeeds

🤖 Generated with Claude Code

[github-actions]

Site preview

Preview: https://4d43f95d-site.fullsend-ai.workers.dev

Commit: 533b86bae9a4b60d2addd22d0dbe518f0705189c

[fullsend-ai-review]

Review

Findings

Low

• [documentation-accuracy] internal/harness/harness.go:427 — The ValidateFilesExist godoc now correctly documents the caller contract: ResolveRelativeTo first, then resolve.ResolveHarness. This matches the actual call order in run.go (ResolveRelativeTo at line 107 → URL resolution block at line 114 → ValidateFilesExist at line 139). The prior review's finding that the documented order was inverted was itself incorrect — the godoc is accurate.

• [edge-case] internal/harness/harness.go:431 — The IsURL(path) guard in ValidateFilesExist is defense-in-depth that never fires in the current runAgent flow: when HasURLReferences() is true, ResolveHarness replaces all URL fields with local cache paths before ValidateFilesExist runs; when HasURLReferences() is false, no URLs exist. The guard is harmless and appropriate as a safety net against future callers violating the ordering contract.

Info

• [sub-agent-failure] N/A — The intent-coherence, style-conventions, and docs-currency sub-agents did not return findings: the sonnet model was unavailable on this deployment. These are sonnet-tier dimensions; the opus-tier correctness and security reviews completed successfully.

Previous run

Review

Findings

Low

• [documentation-accuracy] internal/harness/harness.go:427 — The updated ValidateFilesExist godoc states callers must invoke resolve.ResolveHarness first, then ResolveRelativeTo, but the actual call order in run.go is the reverse: ResolveRelativeTo runs first (making relative local paths absolute while passing URLs through unchanged), then ResolveHarness replaces URL-valued fields with local cache paths. Both orderings work correctly at runtime because ResolveRelativeTo skips URL values and ResolveHarness only touches URL values, but the documented contract is backwards and could mislead future callers. See also: [edge-case] finding at this location.

• [edge-case] internal/harness/harness.go:431 — The IsURL(path) guard in ValidateFilesExist is defense-in-depth that never fires in the current runAgent flow (since ResolveHarness already replaces URLs with local cache paths). The ordering contract is now documented in the godoc (addressing the prior review's finding), though the documented order is inverted (see [documentation-accuracy] above).

Info

• [sub-agent-failure] N/A — The intent-coherence and style-conventions sub-agents did not return findings: the sonnet model was unavailable on this deployment. These are sonnet-tier dimensions; the opus-tier correctness and security reviews completed successfully.

Previous run (2)

Review

Findings

Low

• [edge-case] internal/harness/harness.go:431 — The IsURL(path) guard added to ValidateFilesExist's inner check closure is defense-in-depth: in the current runAgent flow, ResolveHarness has already replaced all URL-valued fields with local cache paths before ValidateFilesExist runs, so the guard never fires. This is fine, but the ordering contract (callers must call ResolveHarness before ValidateFilesExist when URL references are present) is not documented in the ValidateFilesExist godoc. Consider adding a note to prevent future callers from relying on the IsURL skip as a substitute for resolution.

Info

• [sub-agent-failure] The intent-coherence, style-conventions, and docs-currency sub-agents did not return findings: the sonnet model was unavailable on this deployment. These dimensions were not evaluated in this review run.

Previous run (3)

Review

Findings

Info

• [test-coverage] internal/cli/run_test.go:84 — The --offline flag test verifies flag registration only. The full pipeline in runAgent (HasURLReferences → org config load → ValidateAllowedRemoteResources → ResolveHarness) has no integration-level test coverage in this package. Individual components are well-tested in their own packages. No test integrity concerns — existing tests were not weakened.

• [edge-case] internal/cli/run.go:114 — When HasURLReferences() returns true but the harness has an empty AllowedRemoteResources list, ValidateAllowedRemoteResources succeeds (no entries to validate), then resolveURL fails with "is not in allowed_remote_resources." The error is correct and clear; the failure path is slightly indirect but functionally sound.

• [sub-agent-failure] N/A — The style-conventions and intent-coherence sub-agents did not return findings: model claude-sonnet-4-5@20250929 unavailable on vertex deployment. These are sonnet-tier dimensions; the opus-tier correctness and security reviews completed successfully.

Previous run (4)

Review

Findings

Low

• [redundant-validation] internal/cli/run.go:114 — ValidateResourceTypes() is called explicitly after ResolveRelativeTo, but it was already called during harness.Load() → Validate() (harness.go:273). The duplicate call is idempotent and harmless but unnecessary since ResolveRelativeTo does not change URL-ness of fields.

• [error-handling] internal/cli/run.go:126 — When HasURLReferences() is true but config.yaml does not exist (e.g., per-repo installation without centralized config), os.ReadFile produces a generic "no such file or directory" error. A targeted message explaining that URL-referenced resources require an org-level config.yaml with allowed_remote_resources would improve the user experience.

Info

• [test-coverage] internal/cli/run_test.go:84 — The new --offline flag test verifies registration only. The full pipeline in runAgent (ValidateResourceTypes → HasURLReferences → org config load → ValidateAllowedRemoteResources → ResolveHarness) has no integration-level test coverage in this package. Individual components are well-tested in their own packages. No test integrity concerns — existing tests were not weakened.

• [sub-agent-failure] N/A — The style-conventions, intent-coherence, and docs-currency sub-agents did not return findings: model claude-sonnet-4-5@20250929 unavailable on vertex deployment. These are sonnet-tier dimensions; the opus-tier correctness and security reviews completed successfully.

Previous run (5)

Review

Findings

No findings.