Flow
Server-side proxy
Browser -> POST /api/product-feature -> validate product user and tenant -> map feature_key to harness_id -> call HarnessRouter with HR_API_KEY -> return product-shaped stream or JSON
Why
- Keeps the HarnessRouter API key out of the browser.
- Lets the product enforce user and tenant ownership.
- Allows the product to sanitize progress events and generated previews.
- Preserves one stable UI contract even if the configured agent changes.
