agent-harness 0.28.1 → 0.28.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b96455925e7c106c8209663155c2a03e424119a29da0b5a646d3e4ccafc49e5
-  data.tar.gz: 86ccd871badbfa21eec7f42f948c9756f7651b0619a5cb2f1cbc2766c0ae5ee7
+  metadata.gz: d913e0f2d865b5da590d18bd9b1a62dfc6c2620996c374b844eaff5401b040b2
+  data.tar.gz: ef5f41a73da2695a54ca6a8a4c30b169c6c17ec284c5ea718b2cb0eb60edaf9d
 SHA512:
-  metadata.gz: 03b0f75fb46ab71d2602230e86add7e3ab7d00da531dc94264e544077c197ec5df85f113edad09213a8b9683caf156141566f8e3ff6ffd98ddb7c5ff8815a746
-  data.tar.gz: 32df3df874d30e2ef7e072b4c55042766c3ac0bb3a64d77460c084d3e848ce598004be166f114c9c7cbc451b4b7390177110866a2a981661f3ce8abb5d58d2d8
+  metadata.gz: '0838d91fa198bed8eac755a4e8204afbf788c583f4beb6b9e5535337f4b332fe23f9cfb6fc897464002808032c66846f775abafcd6accd967609b89117a25d01'
+  data.tar.gz: 8d8e3670c0ae6936ed508851de2693a13a4fb17207ec6105e6f4128857b226beb6de6a75638c177c15a933b3fb8d654988a48d3e7c61c8cffa3a765246deb5b8

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.28.1"
+  ".": "0.28.3"
 }

data/CHANGELOG.md

@@ -6,6 +6,20 @@
 * **auth:** add provider-owned PKCE code-exchange API for Claude OAuth (`AgentHarness::Authentication.exchange_code`). Takes an authorization code plus PKCE verifier (and `redirect_uri`/`client_id`), posts an `authorization_code` grant to the Claude token endpoint, and persists the resulting access/refresh tokens in the native `claudeAiOauth` shape. Adds `exchange_code_supported?` and a `code_exchange` key to `auth_capabilities` ([#266](https://github.com/viamin/agent-harness/issues/266)).
 
 
+## [0.28.3](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.2...agent-harness/v0.28.3) (2026-07-10)
+
+
+### Bug Fixes
+
+* Kilocode: default external_directory permission blocks /tmp scratch files, silently killing non-interactive runs ([#285](https://github.com/viamin/agent-harness/issues/285)) ([d703c0a](https://github.com/viamin/agent-harness/commit/d703c0abb7b91fb7a5ba8081e612486edff5e8f5))
+
+## [0.28.2](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.1...agent-harness/v0.28.2) (2026-07-10)
+
+
+### Bug Fixes
+
+* Kilocode: default external_directory permission blocks /tmp scratch files, silently killing non-interactive runs ([#283](https://github.com/viamin/agent-harness/issues/283)) ([1ad518f](https://github.com/viamin/agent-harness/commit/1ad518f5c135c5c95d161b9d41a799692f470f76))
+
 ## [0.28.1](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.0...agent-harness/v0.28.1) (2026-07-08)
 
 

data/lib/agent_harness/providers/kilocode.rb

@@ -13,6 +13,18 @@ module AgentHarness
       DEFAULT_VERSION = "7.1.3"
       SUPPORTED_VERSION_REQUIREMENT = "= #{DEFAULT_VERSION}"
       STRUCTURED_EVENT_TYPES = %w[text error step_finish result usage].freeze
+      # Kilo CLI (an OpenCode fork) ships the same external_directory
+      # permission category as OpenCode, defaulting to "ask" for anything
+      # outside the project dir. In non-interactive execution there is no
+      # human to answer the prompt, so reads of scratch files under /tmp are
+      # auto-rejected and the agent silently loses access to its own scratch
+      # output, killing the run without a recoverable error. This default rule
+      # broadens the allowlist to all of /tmp so the agent can read back files
+      # it (or its sub-agents) wrote there. See #282 (precedent: #277/#280).
+      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN = "/tmp/**"
+      DEFAULT_PERMISSION_CONFIG = {
+        "external_directory" => {DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN => "allow"}
+      }.freeze
       USAGE_EVENT_TYPES = %w[result usage].freeze
       TOKEN_USAGE_KEYS = %w[
         input_tokens
@@ -170,8 +182,9 @@ module AgentHarness
         provider_name = options[:provider_name] || "openai"
         model_id = options[:model_id]
 
-        config = {provider: {provider_name => {}}}
-        config[:model] = "#{provider_name}/#{model_id}" if model_id
+        config = {"provider" => {provider_name => {}}}
+        config["model"] = "#{provider_name}/#{model_id}" if model_id
+        apply_default_external_directory_permission(config, options)
 
         config.to_json
       end
@@ -202,6 +215,31 @@ module AgentHarness
         cmd
       end
 
+      # Materialize the permissive external_directory permission (and any other
+      # runtime config extras) to +~/.config/kilocode/kilo.json+ before the CLI
+      # boots. This is the runtime path that actually fixes #282: without it the
+      # permission lives only in {config_file_content}'s return value, which no
+      # execution caller invokes, so Kilo would boot with stock "ask" defaults
+      # and auto-reject /tmp reads in non-interactive runs. Mirrors the OpenCode
+      # precedent in #280.
+      def build_execution_preparation(options)
+        runtime = options[:provider_runtime]
+        return nil unless runtime
+
+        config_payload = kilocode_config_payload(runtime)
+        return nil unless config_payload
+
+        ExecutionPreparation.new(
+          file_writes: [
+            {
+              path: kilocode_config_path,
+              content: serialize_kilocode_config(config_payload),
+              mode: 0o600
+            }
+          ]
+        )
+      end
+
       def parse_response(result, duration:)
         output = result.stdout
         tokens = nil
@@ -332,6 +370,51 @@ module AgentHarness
 
       private
 
+      # Default-merge a permissive external_directory permission into the
+      # generated Kilo config unless the caller takes responsibility for
+      # permission config. A caller-supplied permission (passed via the
+      # +:permission+ option or already present on the config under the
+      # +"permission"+ key, e.g. from runtime metadata config extras) is
+      # honored verbatim and never overridden, and an invalid or empty
+      # caller permission is ignored in favor of the default rule.
+      def apply_default_external_directory_permission(config, options = {})
+        caller_permission = options[:permission] || options["permission"] || config["permission"]
+        if caller_permission.is_a?(Hash) && !caller_permission.empty?
+          config["permission"] = deep_dup(caller_permission)
+          return
+        end
+
+        config["permission"] = deep_dup(DEFAULT_PERMISSION_CONFIG)
+      end
+
+      def kilocode_config_path
+        "~/.config/kilocode/kilo.json"
+      end
+
+      def kilocode_config_payload(runtime)
+        metadata = runtime.metadata
+        config_extras = metadata[:config] || metadata["config"] || {}
+        unless config_extras.is_a?(Hash)
+          raise ArgumentError,
+            "Kilocode runtime metadata config must be a Hash of provider-specific extras (got #{config_extras.class})"
+        end
+
+        payload = stringify_keys(config_extras)
+        payload["model"] = runtime.model if runtime.model
+        apply_default_external_directory_permission(payload)
+        payload.empty? ? nil : payload
+      end
+
+      def serialize_kilocode_config(payload)
+        JSON.pretty_generate(payload)
+      end
+
+      def stringify_keys(hash)
+        hash.each_with_object({}) do |(key, value), result|
+          result[key.to_s] = value
+        end
+      end
+
       def heartbeat_hook_script(heartbeat_file_path)
         "touch #{Shellwords.escape(heartbeat_file_path)}"
       end

data/lib/agent_harness/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AgentHarness
-  VERSION = "0.28.1"
+  VERSION = "0.28.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: agent-harness
 version: !ruby/object:Gem::Version
-  version: 0.28.1
+  version: 0.28.3
 platform: ruby
 authors:
 - Bart Agapinan