agent-harness 0.28.2 → 0.28.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e26544498cd552f3992c81ebe33b869b51daf38e199c6f0cdc733437f39f531
-  data.tar.gz: 55d5a1527f9ef1c208706dbfccbce73246751a329f87ff64a514e14301d81283
+  metadata.gz: d913e0f2d865b5da590d18bd9b1a62dfc6c2620996c374b844eaff5401b040b2
+  data.tar.gz: ef5f41a73da2695a54ca6a8a4c30b169c6c17ec284c5ea718b2cb0eb60edaf9d
 SHA512:
-  metadata.gz: 9fd530fe7ab66107b79b776d170523d9095212b0988f6b2e8e5a160b792927f758b951faf1c4a5ef2fa2035d86d2ab8a1d60185c4f0631bb3c66d0d7740153bd
-  data.tar.gz: 8b4f298b243c6185965633e41b0f629648ae308ab8d2acd62f47a73256e1cac22398cc77442b28ca69d8b77afd933415a45e678bf60a1744007d1151db0d3961
+  metadata.gz: '0838d91fa198bed8eac755a4e8204afbf788c583f4beb6b9e5535337f4b332fe23f9cfb6fc897464002808032c66846f775abafcd6accd967609b89117a25d01'
+  data.tar.gz: 8d8e3670c0ae6936ed508851de2693a13a4fb17207ec6105e6f4128857b226beb6de6a75638c177c15a933b3fb8d654988a48d3e7c61c8cffa3a765246deb5b8

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.28.2"
+  ".": "0.28.3"
 }

data/CHANGELOG.md

@@ -6,6 +6,13 @@
 * **auth:** add provider-owned PKCE code-exchange API for Claude OAuth (`AgentHarness::Authentication.exchange_code`). Takes an authorization code plus PKCE verifier (and `redirect_uri`/`client_id`), posts an `authorization_code` grant to the Claude token endpoint, and persists the resulting access/refresh tokens in the native `claudeAiOauth` shape. Adds `exchange_code_supported?` and a `code_exchange` key to `auth_capabilities` ([#266](https://github.com/viamin/agent-harness/issues/266)).
 
 
+## [0.28.3](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.2...agent-harness/v0.28.3) (2026-07-10)
+
+
+### Bug Fixes
+
+* Kilocode: default external_directory permission blocks /tmp scratch files, silently killing non-interactive runs ([#285](https://github.com/viamin/agent-harness/issues/285)) ([d703c0a](https://github.com/viamin/agent-harness/commit/d703c0abb7b91fb7a5ba8081e612486edff5e8f5))
+
 ## [0.28.2](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.1...agent-harness/v0.28.2) (2026-07-10)
 
 

data/lib/agent_harness/providers/kilocode.rb

@@ -13,6 +13,18 @@ module AgentHarness
       DEFAULT_VERSION = "7.1.3"
       SUPPORTED_VERSION_REQUIREMENT = "= #{DEFAULT_VERSION}"
       STRUCTURED_EVENT_TYPES = %w[text error step_finish result usage].freeze
+      # Kilo CLI (an OpenCode fork) ships the same external_directory
+      # permission category as OpenCode, defaulting to "ask" for anything
+      # outside the project dir. In non-interactive execution there is no
+      # human to answer the prompt, so reads of scratch files under /tmp are
+      # auto-rejected and the agent silently loses access to its own scratch
+      # output, killing the run without a recoverable error. This default rule
+      # broadens the allowlist to all of /tmp so the agent can read back files
+      # it (or its sub-agents) wrote there. See #282 (precedent: #277/#280).
+      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN = "/tmp/**"
+      DEFAULT_PERMISSION_CONFIG = {
+        "external_directory" => {DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN => "allow"}
+      }.freeze
       USAGE_EVENT_TYPES = %w[result usage].freeze
       TOKEN_USAGE_KEYS = %w[
         input_tokens
@@ -106,21 +118,6 @@ module AgentHarness
         end
       end
 
-      # Kilo CLI (an opencode fork) ships the same `external_directory`
-      # permission category as OpenCode, defaulting to `ask` for anything
-      # outside the project dir. In non-interactive execution there is no human
-      # to answer the resulting permission prompt, so reads/writes of scratch
-      # files under `/tmp/*` via the dedicated read/write/edit tools are
-      # auto-rejected — even though bash I/O to the same paths succeeds (shell
-      # redirection is not a tool call). The agent then silently loses access to
-      # its own scratch output and never completes the task. This default rule
-      # broadens the allowlist to all of `/tmp` so the agent can read back files
-      # it (or its sub-agents) wrote there.
-      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN = "/tmp/**"
-      DEFAULT_PERMISSION_RULE = {
-        "external_directory" => {DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN => "allow"}
-      }.freeze
-
       def name
         "kilocode"
       end
@@ -185,10 +182,9 @@ module AgentHarness
         provider_name = options[:provider_name] || "openai"
         model_id = options[:model_id]
 
-        config = {provider: {provider_name => {}}}
-        config[:model] = "#{provider_name}/#{model_id}" if model_id
-        config[:permission] = deep_dup(options[:permission]) if options[:permission]
-        apply_default_external_directory_permission(config)
+        config = {"provider" => {provider_name => {}}}
+        config["model"] = "#{provider_name}/#{model_id}" if model_id
+        apply_default_external_directory_permission(config, options)
 
         config.to_json
       end
@@ -219,6 +215,31 @@ module AgentHarness
         cmd
       end
 
+      # Materialize the permissive external_directory permission (and any other
+      # runtime config extras) to +~/.config/kilocode/kilo.json+ before the CLI
+      # boots. This is the runtime path that actually fixes #282: without it the
+      # permission lives only in {config_file_content}'s return value, which no
+      # execution caller invokes, so Kilo would boot with stock "ask" defaults
+      # and auto-reject /tmp reads in non-interactive runs. Mirrors the OpenCode
+      # precedent in #280.
+      def build_execution_preparation(options)
+        runtime = options[:provider_runtime]
+        return nil unless runtime
+
+        config_payload = kilocode_config_payload(runtime)
+        return nil unless config_payload
+
+        ExecutionPreparation.new(
+          file_writes: [
+            {
+              path: kilocode_config_path,
+              content: serialize_kilocode_config(config_payload),
+              mode: 0o600
+            }
+          ]
+        )
+      end
+
       def parse_response(result, duration:)
         output = result.stdout
         tokens = nil
@@ -349,12 +370,49 @@ module AgentHarness
 
       private
 
-      def apply_default_external_directory_permission(payload)
-        # Respect any caller-supplied `permission` block verbatim: if a caller
-        # takes responsibility for permission config, we do not override it.
-        return if payload.key?(:permission) || payload.key?("permission")
+      # Default-merge a permissive external_directory permission into the
+      # generated Kilo config unless the caller takes responsibility for
+      # permission config. A caller-supplied permission (passed via the
+      # +:permission+ option or already present on the config under the
+      # +"permission"+ key, e.g. from runtime metadata config extras) is
+      # honored verbatim and never overridden, and an invalid or empty
+      # caller permission is ignored in favor of the default rule.
+      def apply_default_external_directory_permission(config, options = {})
+        caller_permission = options[:permission] || options["permission"] || config["permission"]
+        if caller_permission.is_a?(Hash) && !caller_permission.empty?
+          config["permission"] = deep_dup(caller_permission)
+          return
+        end
+
+        config["permission"] = deep_dup(DEFAULT_PERMISSION_CONFIG)
+      end
+
+      def kilocode_config_path
+        "~/.config/kilocode/kilo.json"
+      end
 
-        payload[:permission] = deep_dup(DEFAULT_PERMISSION_RULE)
+      def kilocode_config_payload(runtime)
+        metadata = runtime.metadata
+        config_extras = metadata[:config] || metadata["config"] || {}
+        unless config_extras.is_a?(Hash)
+          raise ArgumentError,
+            "Kilocode runtime metadata config must be a Hash of provider-specific extras (got #{config_extras.class})"
+        end
+
+        payload = stringify_keys(config_extras)
+        payload["model"] = runtime.model if runtime.model
+        apply_default_external_directory_permission(payload)
+        payload.empty? ? nil : payload
+      end
+
+      def serialize_kilocode_config(payload)
+        JSON.pretty_generate(payload)
+      end
+
+      def stringify_keys(hash)
+        hash.each_with_object({}) do |(key, value), result|
+          result[key.to_s] = value
+        end
       end
 
       def heartbeat_hook_script(heartbeat_file_path)

data/lib/agent_harness/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AgentHarness
-  VERSION = "0.28.2"
+  VERSION = "0.28.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: agent-harness
 version: !ruby/object:Gem::Version
-  version: 0.28.2
+  version: 0.28.3
 platform: ruby
 authors:
 - Bart Agapinan