agent-harness 0.28.2 → 0.28.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e26544498cd552f3992c81ebe33b869b51daf38e199c6f0cdc733437f39f531
-  data.tar.gz: 55d5a1527f9ef1c208706dbfccbce73246751a329f87ff64a514e14301d81283
+  metadata.gz: 8d0d7ed4f6ef8391d0b495868dd13f0fbfb84ee496c63ccabdd2900bba04f3d0
+  data.tar.gz: 0c8dd8c73feee507a47397dce38c1575889d25413cf4fb93fe66407e736f18c0
 SHA512:
-  metadata.gz: 9fd530fe7ab66107b79b776d170523d9095212b0988f6b2e8e5a160b792927f758b951faf1c4a5ef2fa2035d86d2ab8a1d60185c4f0631bb3c66d0d7740153bd
-  data.tar.gz: 8b4f298b243c6185965633e41b0f629648ae308ab8d2acd62f47a73256e1cac22398cc77442b28ca69d8b77afd933415a45e678bf60a1744007d1151db0d3961
+  metadata.gz: f22bd0d258e06b594fd56a2cb523f6823d975988002f9b50338b0e46d1ebabd478c90f43fd3acaae8dced8842635c249e8d7b27a02fad45e528fc060b59143c1
+  data.tar.gz: 6d8b8f987d8fb747c134743729ed47c105bb4ba0689c350bd8868674c07a3da17df84cfe6a64a137403b022032800fb21477a7319d02820ee996fe5f8b3bd367

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.28.2"
+  ".": "0.28.4"
 }

data/CHANGELOG.md

@@ -6,6 +6,20 @@
 * **auth:** add provider-owned PKCE code-exchange API for Claude OAuth (`AgentHarness::Authentication.exchange_code`). Takes an authorization code plus PKCE verifier (and `redirect_uri`/`client_id`), posts an `authorization_code` grant to the Claude token endpoint, and persists the resulting access/refresh tokens in the native `claudeAiOauth` shape. Adds `exchange_code_supported?` and a `code_exchange` key to `auth_capabilities` ([#266](https://github.com/viamin/agent-harness/issues/266)).
 
 
+## [0.28.4](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.3...agent-harness/v0.28.4) (2026-07-10)
+
+
+### Bug Fixes
+
+* Codex model_compatibility returns 'unknown' for models definitively unsupported with subscription auth (e.g. gpt-5.5-pro) ([#287](https://github.com/viamin/agent-harness/issues/287)) ([a6f87ce](https://github.com/viamin/agent-harness/commit/a6f87ce07a2514e069559d57d8496dd323bd0891))
+
+## [0.28.3](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.2...agent-harness/v0.28.3) (2026-07-10)
+
+
+### Bug Fixes
+
+* Kilocode: default external_directory permission blocks /tmp scratch files, silently killing non-interactive runs ([#285](https://github.com/viamin/agent-harness/issues/285)) ([d703c0a](https://github.com/viamin/agent-harness/commit/d703c0abb7b91fb7a5ba8081e612486edff5e8f5))
+
 ## [0.28.2](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.1...agent-harness/v0.28.2) (2026-07-10)
 
 

data/lib/agent_harness/model_compatibility.rb

@@ -31,12 +31,21 @@ module AgentHarness
     # result. Distinct from :unknown_model — the runner *does* know the
     # model; it just cannot confirm the installed CLI is new enough.
     UNKNOWN_CLI_VERSION_REASON = :cli_version_unknown
+    # Issued when the runner needs an auth mode to answer definitively for
+    # an auth-gated model but the caller did not supply one. Pairs with
+    # :supported_auth_modes on the result details. Distinct from
+    # :unknown_model — the runner *does* know the model; it just cannot
+    # confirm the requested auth mode is allowed for it.
+    UNKNOWN_AUTH_MODE_REASON = :auth_mode_unknown
     # Issued when the runner supports the model but the installed CLI is too
     # old. Pairs with :minimum_cli_version on the result.
     UNSUPPORTED_CLI_VERSION_REASON = :cli_version_too_old
     # Issued when the runner supports the model but the requested auth mode
     # is not part of the runner's contract for it.
     UNSUPPORTED_AUTH_MODE_REASON = :auth_mode_not_supported
+    # Issued when the runner accepts the requested auth mode generally, but
+    # the specific model is not available under that auth mode.
+    UNSUPPORTED_AUTH_MODE_FOR_MODEL_REASON = :unsupported_auth_mode_for_model
     # Default supported reason.
     SUPPORTED_REASON = :supported
 

data/lib/agent_harness/providers/codex.rb

@@ -27,9 +27,11 @@ module AgentHarness
       # instead of relying on whichever model the CLI's default points at.
       DEFAULT_COMPATIBLE_MODEL_ID = "gpt-5-codex"
 
-      # Known CLI-gated model facts. Each entry expresses the minimum Codex
-      # CLI version required to drive that model. Keep entries here only when
-      # the requirement is durable runner contract knowledge — not
+      # Known CLI-gated model facts. Each entry may express a minimum Codex
+      # CLI version required to drive the model, and/or auth-mode
+      # restrictions that are part of the durable runner contract. Keep
+      # entries here only when the requirement is durable runner contract
+      # knowledge — not
       # provider-side experiments or one-off CLI defaults.
       #
       # The +gpt-5.5+ entry tracks the failure class observed in
@@ -37,7 +39,8 @@ module AgentHarness
       # CLI builds (e.g. 0.115.x) could not drive the +gpt-5.5+ family.
       MODEL_COMPATIBILITY_FACTS = {
         "gpt-5.5" => {minimum_cli_version: "0.116.0"},
-        "gpt-5.5-codex" => {minimum_cli_version: "0.116.0"}
+        "gpt-5.5-codex" => {minimum_cli_version: "0.116.0"},
+        "gpt-5.5-pro" => {auth_modes: [:api_key].freeze}
       }.each_value(&:freeze).freeze
 
       # Models that the runner contract considers supported on every Codex
@@ -276,16 +279,25 @@ module AgentHarness
         #
         # Returns an {AgentHarness::ModelCompatibility::Result} for the
         # combination of +model_id+, +auth_mode+, and installed
-        # +cli_version+. The contract surfaces three concrete outcomes:
+        # +cli_version+. The contract surfaces these concrete outcomes:
         #
-        # 1. **Supported** — the model is in {BASELINE_SUPPORTED_MODELS} (or
-        #    a known CLI-gated model whose minimum CLI version is met).
-        # 2. **Unsupported due to CLI version** — the model is known to need
+        # 1. **Supported** — the model is in {BASELINE_SUPPORTED_MODELS}, or
+        #    a known CLI-gated model whose stated restrictions are met (a
+        #    minimum Codex CLI version and/or an auth-mode restriction; some
+        #    gated models express only one of these).
+        # 2. **Unsupported due to auth mode** — the requested auth mode is
+        #    not accepted by the runner at all, or is not available for the
+        #    specific model (e.g. an api-key-only model requested with
+        #    subscription auth).
+        # 3. **Unsupported due to CLI version** — the model is known to need
         #    a newer Codex CLI than was supplied; the result carries
         #    +:minimum_cli_version+ so callers can act on it.
-        # 3. **Unknown / dynamic** — the model is not in this static
-        #    contract. Callers must treat this as "ask the provider" rather
-        #    than as approval.
+        # 4. **Unknown / dynamic** — the model is not in this static
+        #    contract, or a gated model was queried without the gating input
+        #    needed to answer definitively (an auth mode for an
+        #    auth-restricted model, or an installed CLI version for a
+        #    version-gated model). Callers must treat this as "ask the
+        #    provider" rather than as approval.
         #
         # @param model_id [String, Symbol]
         # @param auth_mode [Symbol, nil] :api_key or :subscription
@@ -312,42 +324,94 @@ module AgentHarness
 
           gated_fact = MODEL_COMPATIBILITY_FACTS[normalized_model_id]
           if gated_fact
-            minimum_version = gated_fact[:minimum_cli_version]
-            requirement = Gem::Requirement.new(">= #{minimum_version}")
-            comparable_version = comparable_cli_version(normalized_cli_version)
-
-            # A CLI-gated model without a comparable installed version must
-            # stay explicit. Returning :supported here would re-introduce the
-            # exact `gpt-5.5` failure class this contract is designed to
-            # prevent — a caller that cannot supply a version would get
-            # `supported? == true` and may still schedule a run onto an old
-            # CLI (e.g. 0.115.x). Surface :unknown with the requirement
-            # attached so callers can decide deliberately.
-            if comparable_version.nil?
+            supported_auth_modes = gated_fact[:auth_modes]
+            if normalized_auth_mode && supported_auth_modes && !supported_auth_modes.include?(normalized_auth_mode)
+              return AgentHarness::ModelCompatibility.build_result(
+                runner: provider_name,
+                model_id: normalized_model_id,
+                auth_mode: normalized_auth_mode,
+                cli_version: normalized_cli_version,
+                supported: false,
+                reason: AgentHarness::ModelCompatibility::UNSUPPORTED_AUTH_MODE_FOR_MODEL_REASON,
+                fallback_model_id: DEFAULT_COMPATIBLE_MODEL_ID,
+                source: :static_contract,
+                details: {supported_auth_modes: supported_auth_modes}
+              )
+            end
+
+            # An auth-gated model queried without an auth mode must stay
+            # explicit. Returning :supported here would re-introduce the
+            # exact permissive false-positive this contract is designed to
+            # prevent — `auth_mode` defaults to nil on the public API, so a
+            # caller that queries availability without an auth mode and
+            # treats `supported? == true` as approval could then schedule an
+            # api-key-only model (e.g. gpt-5.5-pro) under subscription. This
+            # mirrors the sibling CLI-version dimension below: when the
+            # gating input is missing, surface :unknown with the allowed
+            # auth modes attached so callers can decide deliberately.
+            if supported_auth_modes && normalized_auth_mode.nil?
               return AgentHarness::ModelCompatibility.unknown_result(
                 runner: provider_name,
                 model_id: normalized_model_id,
                 auth_mode: normalized_auth_mode,
                 cli_version: normalized_cli_version,
-                reason: AgentHarness::ModelCompatibility::UNKNOWN_CLI_VERSION_REASON,
-                minimum_cli_version: minimum_version,
-                cli_version_requirement: requirement.to_s,
+                reason: AgentHarness::ModelCompatibility::UNKNOWN_AUTH_MODE_REASON,
                 fallback_model_id: DEFAULT_COMPATIBLE_MODEL_ID,
-                source: :static_contract
+                source: :static_contract,
+                details: {supported_auth_modes: supported_auth_modes}
               )
             end
 
-            unless requirement.satisfied_by?(comparable_version)
+            minimum_version = gated_fact[:minimum_cli_version]
+            if minimum_version
+              requirement = Gem::Requirement.new(">= #{minimum_version}")
+              comparable_version = comparable_cli_version(normalized_cli_version)
+
+              # A CLI-gated model without a comparable installed version must
+              # stay explicit. Returning :supported here would re-introduce the
+              # exact `gpt-5.5` failure class this contract is designed to
+              # prevent — a caller that cannot supply a version would get
+              # `supported? == true` and may still schedule a run onto an old
+              # CLI (e.g. 0.115.x). Surface :unknown with the requirement
+              # attached so callers can decide deliberately.
+              if comparable_version.nil?
+                return AgentHarness::ModelCompatibility.unknown_result(
+                  runner: provider_name,
+                  model_id: normalized_model_id,
+                  auth_mode: normalized_auth_mode,
+                  cli_version: normalized_cli_version,
+                  reason: AgentHarness::ModelCompatibility::UNKNOWN_CLI_VERSION_REASON,
+                  minimum_cli_version: minimum_version,
+                  cli_version_requirement: requirement.to_s,
+                  fallback_model_id: DEFAULT_COMPATIBLE_MODEL_ID,
+                  source: :static_contract
+                )
+              end
+
+              unless requirement.satisfied_by?(comparable_version)
+                return AgentHarness::ModelCompatibility.build_result(
+                  runner: provider_name,
+                  model_id: normalized_model_id,
+                  auth_mode: normalized_auth_mode,
+                  cli_version: normalized_cli_version,
+                  supported: false,
+                  reason: AgentHarness::ModelCompatibility::UNSUPPORTED_CLI_VERSION_REASON,
+                  minimum_cli_version: minimum_version,
+                  cli_version_requirement: requirement.to_s,
+                  fallback_model_id: DEFAULT_COMPATIBLE_MODEL_ID,
+                  source: :static_contract
+                )
+              end
+
               return AgentHarness::ModelCompatibility.build_result(
                 runner: provider_name,
                 model_id: normalized_model_id,
                 auth_mode: normalized_auth_mode,
                 cli_version: normalized_cli_version,
-                supported: false,
-                reason: AgentHarness::ModelCompatibility::UNSUPPORTED_CLI_VERSION_REASON,
+                supported: true,
+                reason: AgentHarness::ModelCompatibility::SUPPORTED_REASON,
                 minimum_cli_version: minimum_version,
                 cli_version_requirement: requirement.to_s,
-                fallback_model_id: DEFAULT_COMPATIBLE_MODEL_ID,
                 source: :static_contract
               )
             end
@@ -359,8 +423,6 @@ module AgentHarness
               cli_version: normalized_cli_version,
               supported: true,
               reason: AgentHarness::ModelCompatibility::SUPPORTED_REASON,
-              minimum_cli_version: minimum_version,
-              cli_version_requirement: requirement.to_s,
               source: :static_contract
             )
           end

data/lib/agent_harness/providers/kilocode.rb

@@ -13,6 +13,18 @@ module AgentHarness
       DEFAULT_VERSION = "7.1.3"
       SUPPORTED_VERSION_REQUIREMENT = "= #{DEFAULT_VERSION}"
       STRUCTURED_EVENT_TYPES = %w[text error step_finish result usage].freeze
+      # Kilo CLI (an OpenCode fork) ships the same external_directory
+      # permission category as OpenCode, defaulting to "ask" for anything
+      # outside the project dir. In non-interactive execution there is no
+      # human to answer the prompt, so reads of scratch files under /tmp are
+      # auto-rejected and the agent silently loses access to its own scratch
+      # output, killing the run without a recoverable error. This default rule
+      # broadens the allowlist to all of /tmp so the agent can read back files
+      # it (or its sub-agents) wrote there. See #282 (precedent: #277/#280).
+      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN = "/tmp/**"
+      DEFAULT_PERMISSION_CONFIG = {
+        "external_directory" => {DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN => "allow"}
+      }.freeze
       USAGE_EVENT_TYPES = %w[result usage].freeze
       TOKEN_USAGE_KEYS = %w[
         input_tokens
@@ -106,21 +118,6 @@ module AgentHarness
         end
       end
 
-      # Kilo CLI (an opencode fork) ships the same `external_directory`
-      # permission category as OpenCode, defaulting to `ask` for anything
-      # outside the project dir. In non-interactive execution there is no human
-      # to answer the resulting permission prompt, so reads/writes of scratch
-      # files under `/tmp/*` via the dedicated read/write/edit tools are
-      # auto-rejected — even though bash I/O to the same paths succeeds (shell
-      # redirection is not a tool call). The agent then silently loses access to
-      # its own scratch output and never completes the task. This default rule
-      # broadens the allowlist to all of `/tmp` so the agent can read back files
-      # it (or its sub-agents) wrote there.
-      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN = "/tmp/**"
-      DEFAULT_PERMISSION_RULE = {
-        "external_directory" => {DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN => "allow"}
-      }.freeze
-
       def name
         "kilocode"
       end
@@ -185,10 +182,9 @@ module AgentHarness
         provider_name = options[:provider_name] || "openai"
         model_id = options[:model_id]
 
-        config = {provider: {provider_name => {}}}
-        config[:model] = "#{provider_name}/#{model_id}" if model_id
-        config[:permission] = deep_dup(options[:permission]) if options[:permission]
-        apply_default_external_directory_permission(config)
+        config = {"provider" => {provider_name => {}}}
+        config["model"] = "#{provider_name}/#{model_id}" if model_id
+        apply_default_external_directory_permission(config, options)
 
         config.to_json
       end
@@ -219,6 +215,31 @@ module AgentHarness
         cmd
       end
 
+      # Materialize the permissive external_directory permission (and any other
+      # runtime config extras) to +~/.config/kilocode/kilo.json+ before the CLI
+      # boots. This is the runtime path that actually fixes #282: without it the
+      # permission lives only in {config_file_content}'s return value, which no
+      # execution caller invokes, so Kilo would boot with stock "ask" defaults
+      # and auto-reject /tmp reads in non-interactive runs. Mirrors the OpenCode
+      # precedent in #280.
+      def build_execution_preparation(options)
+        runtime = options[:provider_runtime]
+        return nil unless runtime
+
+        config_payload = kilocode_config_payload(runtime)
+        return nil unless config_payload
+
+        ExecutionPreparation.new(
+          file_writes: [
+            {
+              path: kilocode_config_path,
+              content: serialize_kilocode_config(config_payload),
+              mode: 0o600
+            }
+          ]
+        )
+      end
+
       def parse_response(result, duration:)
         output = result.stdout
         tokens = nil
@@ -349,12 +370,49 @@ module AgentHarness
 
       private
 
-      def apply_default_external_directory_permission(payload)
-        # Respect any caller-supplied `permission` block verbatim: if a caller
-        # takes responsibility for permission config, we do not override it.
-        return if payload.key?(:permission) || payload.key?("permission")
+      # Default-merge a permissive external_directory permission into the
+      # generated Kilo config unless the caller takes responsibility for
+      # permission config. A caller-supplied permission (passed via the
+      # +:permission+ option or already present on the config under the
+      # +"permission"+ key, e.g. from runtime metadata config extras) is
+      # honored verbatim and never overridden, and an invalid or empty
+      # caller permission is ignored in favor of the default rule.
+      def apply_default_external_directory_permission(config, options = {})
+        caller_permission = options[:permission] || options["permission"] || config["permission"]
+        if caller_permission.is_a?(Hash) && !caller_permission.empty?
+          config["permission"] = deep_dup(caller_permission)
+          return
+        end
+
+        config["permission"] = deep_dup(DEFAULT_PERMISSION_CONFIG)
+      end
+
+      def kilocode_config_path
+        "~/.config/kilocode/kilo.json"
+      end
 
-        payload[:permission] = deep_dup(DEFAULT_PERMISSION_RULE)
+      def kilocode_config_payload(runtime)
+        metadata = runtime.metadata
+        config_extras = metadata[:config] || metadata["config"] || {}
+        unless config_extras.is_a?(Hash)
+          raise ArgumentError,
+            "Kilocode runtime metadata config must be a Hash of provider-specific extras (got #{config_extras.class})"
+        end
+
+        payload = stringify_keys(config_extras)
+        payload["model"] = runtime.model if runtime.model
+        apply_default_external_directory_permission(payload)
+        payload.empty? ? nil : payload
+      end
+
+      def serialize_kilocode_config(payload)
+        JSON.pretty_generate(payload)
+      end
+
+      def stringify_keys(hash)
+        hash.each_with_object({}) do |(key, value), result|
+          result[key.to_s] = value
+        end
       end
 
       def heartbeat_hook_script(heartbeat_file_path)

data/lib/agent_harness/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AgentHarness
-  VERSION = "0.28.2"
+  VERSION = "0.28.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: agent-harness
 version: !ruby/object:Gem::Version
-  version: 0.28.2
+  version: 0.28.4
 platform: ruby
 authors:
 - Bart Agapinan