agent-harness 0.28.3 → 0.28.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d913e0f2d865b5da590d18bd9b1a62dfc6c2620996c374b844eaff5401b040b2
-  data.tar.gz: ef5f41a73da2695a54ca6a8a4c30b169c6c17ec284c5ea718b2cb0eb60edaf9d
+  metadata.gz: 0e59433136b9fefab1e54397b752f0843b05db3b4f26dfd27a3607650ff3b4ad
+  data.tar.gz: 6043894c347081129f4486795bcb6d0d1f95750ac980dabe464e889ee0266bd2
 SHA512:
-  metadata.gz: '0838d91fa198bed8eac755a4e8204afbf788c583f4beb6b9e5535337f4b332fe23f9cfb6fc897464002808032c66846f775abafcd6accd967609b89117a25d01'
-  data.tar.gz: 8d8e3670c0ae6936ed508851de2693a13a4fb17207ec6105e6f4128857b226beb6de6a75638c177c15a933b3fb8d654988a48d3e7c61c8cffa3a765246deb5b8
+  metadata.gz: 480f739434416487cef969aa1f21bbb772d5694099418468604c41be315da9f0cbe8d2167bfb2c3e9f9620cb62d162b725ac414959b5e9cd3723c867265a6625
+  data.tar.gz: 9d625423fd5a2956567626074c66479d951b3d4988684fb8da12b414b3500bd4535050e6fef33e46e0c84792b6bb2599b58a2a757b07d9ef0879971d967aacb3

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.28.3"
+  ".": "0.28.5"
 }

data/CHANGELOG.md

@@ -6,6 +6,20 @@
 * **auth:** add provider-owned PKCE code-exchange API for Claude OAuth (`AgentHarness::Authentication.exchange_code`). Takes an authorization code plus PKCE verifier (and `redirect_uri`/`client_id`), posts an `authorization_code` grant to the Claude token endpoint, and persists the resulting access/refresh tokens in the native `claudeAiOauth` shape. Adds `exchange_code_supported?` and a `code_exchange` key to `auth_capabilities` ([#266](https://github.com/viamin/agent-harness/issues/266)).
 
 
+## [0.28.5](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.4...agent-harness/v0.28.5) (2026-07-10)
+
+
+### Bug Fixes
+
+* Kilocode/OpenCode: external_directory permission also blocks ~/.config and ~/.local/share paths, not just /tmp ([#290](https://github.com/viamin/agent-harness/issues/290)) ([7042f57](https://github.com/viamin/agent-harness/commit/7042f572e5723120159c96b735906edeede6ef76))
+
+## [0.28.4](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.3...agent-harness/v0.28.4) (2026-07-10)
+
+
+### Bug Fixes
+
+* Codex model_compatibility returns 'unknown' for models definitively unsupported with subscription auth (e.g. gpt-5.5-pro) ([#287](https://github.com/viamin/agent-harness/issues/287)) ([a6f87ce](https://github.com/viamin/agent-harness/commit/a6f87ce07a2514e069559d57d8496dd323bd0891))
+
 ## [0.28.3](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.2...agent-harness/v0.28.3) (2026-07-10)
 
 

data/lib/agent_harness/model_compatibility.rb

@@ -31,12 +31,21 @@ module AgentHarness
     # result. Distinct from :unknown_model — the runner *does* know the
     # model; it just cannot confirm the installed CLI is new enough.
     UNKNOWN_CLI_VERSION_REASON = :cli_version_unknown
+    # Issued when the runner needs an auth mode to answer definitively for
+    # an auth-gated model but the caller did not supply one. Pairs with
+    # :supported_auth_modes on the result details. Distinct from
+    # :unknown_model — the runner *does* know the model; it just cannot
+    # confirm the requested auth mode is allowed for it.
+    UNKNOWN_AUTH_MODE_REASON = :auth_mode_unknown
     # Issued when the runner supports the model but the installed CLI is too
     # old. Pairs with :minimum_cli_version on the result.
     UNSUPPORTED_CLI_VERSION_REASON = :cli_version_too_old
     # Issued when the runner supports the model but the requested auth mode
     # is not part of the runner's contract for it.
     UNSUPPORTED_AUTH_MODE_REASON = :auth_mode_not_supported
+    # Issued when the runner accepts the requested auth mode generally, but
+    # the specific model is not available under that auth mode.
+    UNSUPPORTED_AUTH_MODE_FOR_MODEL_REASON = :unsupported_auth_mode_for_model
     # Default supported reason.
     SUPPORTED_REASON = :supported
 

data/lib/agent_harness/providers/codex.rb

@@ -27,9 +27,11 @@ module AgentHarness
       # instead of relying on whichever model the CLI's default points at.
       DEFAULT_COMPATIBLE_MODEL_ID = "gpt-5-codex"
 
-      # Known CLI-gated model facts. Each entry expresses the minimum Codex
-      # CLI version required to drive that model. Keep entries here only when
-      # the requirement is durable runner contract knowledge — not
+      # Known CLI-gated model facts. Each entry may express a minimum Codex
+      # CLI version required to drive the model, and/or auth-mode
+      # restrictions that are part of the durable runner contract. Keep
+      # entries here only when the requirement is durable runner contract
+      # knowledge — not
       # provider-side experiments or one-off CLI defaults.
       #
       # The +gpt-5.5+ entry tracks the failure class observed in
@@ -37,7 +39,8 @@ module AgentHarness
       # CLI builds (e.g. 0.115.x) could not drive the +gpt-5.5+ family.
       MODEL_COMPATIBILITY_FACTS = {
         "gpt-5.5" => {minimum_cli_version: "0.116.0"},
-        "gpt-5.5-codex" => {minimum_cli_version: "0.116.0"}
+        "gpt-5.5-codex" => {minimum_cli_version: "0.116.0"},
+        "gpt-5.5-pro" => {auth_modes: [:api_key].freeze}
       }.each_value(&:freeze).freeze
 
       # Models that the runner contract considers supported on every Codex
@@ -276,16 +279,25 @@ module AgentHarness
         #
         # Returns an {AgentHarness::ModelCompatibility::Result} for the
         # combination of +model_id+, +auth_mode+, and installed
-        # +cli_version+. The contract surfaces three concrete outcomes:
+        # +cli_version+. The contract surfaces these concrete outcomes:
         #
-        # 1. **Supported** — the model is in {BASELINE_SUPPORTED_MODELS} (or
-        #    a known CLI-gated model whose minimum CLI version is met).
-        # 2. **Unsupported due to CLI version** — the model is known to need
+        # 1. **Supported** — the model is in {BASELINE_SUPPORTED_MODELS}, or
+        #    a known CLI-gated model whose stated restrictions are met (a
+        #    minimum Codex CLI version and/or an auth-mode restriction; some
+        #    gated models express only one of these).
+        # 2. **Unsupported due to auth mode** — the requested auth mode is
+        #    not accepted by the runner at all, or is not available for the
+        #    specific model (e.g. an api-key-only model requested with
+        #    subscription auth).
+        # 3. **Unsupported due to CLI version** — the model is known to need
         #    a newer Codex CLI than was supplied; the result carries
         #    +:minimum_cli_version+ so callers can act on it.
-        # 3. **Unknown / dynamic** — the model is not in this static
-        #    contract. Callers must treat this as "ask the provider" rather
-        #    than as approval.
+        # 4. **Unknown / dynamic** — the model is not in this static
+        #    contract, or a gated model was queried without the gating input
+        #    needed to answer definitively (an auth mode for an
+        #    auth-restricted model, or an installed CLI version for a
+        #    version-gated model). Callers must treat this as "ask the
+        #    provider" rather than as approval.
         #
         # @param model_id [String, Symbol]
         # @param auth_mode [Symbol, nil] :api_key or :subscription
@@ -312,42 +324,94 @@ module AgentHarness
 
           gated_fact = MODEL_COMPATIBILITY_FACTS[normalized_model_id]
           if gated_fact
-            minimum_version = gated_fact[:minimum_cli_version]
-            requirement = Gem::Requirement.new(">= #{minimum_version}")
-            comparable_version = comparable_cli_version(normalized_cli_version)
-
-            # A CLI-gated model without a comparable installed version must
-            # stay explicit. Returning :supported here would re-introduce the
-            # exact `gpt-5.5` failure class this contract is designed to
-            # prevent — a caller that cannot supply a version would get
-            # `supported? == true` and may still schedule a run onto an old
-            # CLI (e.g. 0.115.x). Surface :unknown with the requirement
-            # attached so callers can decide deliberately.
-            if comparable_version.nil?
+            supported_auth_modes = gated_fact[:auth_modes]
+            if normalized_auth_mode && supported_auth_modes && !supported_auth_modes.include?(normalized_auth_mode)
+              return AgentHarness::ModelCompatibility.build_result(
+                runner: provider_name,
+                model_id: normalized_model_id,
+                auth_mode: normalized_auth_mode,
+                cli_version: normalized_cli_version,
+                supported: false,
+                reason: AgentHarness::ModelCompatibility::UNSUPPORTED_AUTH_MODE_FOR_MODEL_REASON,
+                fallback_model_id: DEFAULT_COMPATIBLE_MODEL_ID,
+                source: :static_contract,
+                details: {supported_auth_modes: supported_auth_modes}
+              )
+            end
+
+            # An auth-gated model queried without an auth mode must stay
+            # explicit. Returning :supported here would re-introduce the
+            # exact permissive false-positive this contract is designed to
+            # prevent — `auth_mode` defaults to nil on the public API, so a
+            # caller that queries availability without an auth mode and
+            # treats `supported? == true` as approval could then schedule an
+            # api-key-only model (e.g. gpt-5.5-pro) under subscription. This
+            # mirrors the sibling CLI-version dimension below: when the
+            # gating input is missing, surface :unknown with the allowed
+            # auth modes attached so callers can decide deliberately.
+            if supported_auth_modes && normalized_auth_mode.nil?
               return AgentHarness::ModelCompatibility.unknown_result(
                 runner: provider_name,
                 model_id: normalized_model_id,
                 auth_mode: normalized_auth_mode,
                 cli_version: normalized_cli_version,
-                reason: AgentHarness::ModelCompatibility::UNKNOWN_CLI_VERSION_REASON,
-                minimum_cli_version: minimum_version,
-                cli_version_requirement: requirement.to_s,
+                reason: AgentHarness::ModelCompatibility::UNKNOWN_AUTH_MODE_REASON,
                 fallback_model_id: DEFAULT_COMPATIBLE_MODEL_ID,
-                source: :static_contract
+                source: :static_contract,
+                details: {supported_auth_modes: supported_auth_modes}
               )
             end
 
-            unless requirement.satisfied_by?(comparable_version)
+            minimum_version = gated_fact[:minimum_cli_version]
+            if minimum_version
+              requirement = Gem::Requirement.new(">= #{minimum_version}")
+              comparable_version = comparable_cli_version(normalized_cli_version)
+
+              # A CLI-gated model without a comparable installed version must
+              # stay explicit. Returning :supported here would re-introduce the
+              # exact `gpt-5.5` failure class this contract is designed to
+              # prevent — a caller that cannot supply a version would get
+              # `supported? == true` and may still schedule a run onto an old
+              # CLI (e.g. 0.115.x). Surface :unknown with the requirement
+              # attached so callers can decide deliberately.
+              if comparable_version.nil?
+                return AgentHarness::ModelCompatibility.unknown_result(
+                  runner: provider_name,
+                  model_id: normalized_model_id,
+                  auth_mode: normalized_auth_mode,
+                  cli_version: normalized_cli_version,
+                  reason: AgentHarness::ModelCompatibility::UNKNOWN_CLI_VERSION_REASON,
+                  minimum_cli_version: minimum_version,
+                  cli_version_requirement: requirement.to_s,
+                  fallback_model_id: DEFAULT_COMPATIBLE_MODEL_ID,
+                  source: :static_contract
+                )
+              end
+
+              unless requirement.satisfied_by?(comparable_version)
+                return AgentHarness::ModelCompatibility.build_result(
+                  runner: provider_name,
+                  model_id: normalized_model_id,
+                  auth_mode: normalized_auth_mode,
+                  cli_version: normalized_cli_version,
+                  supported: false,
+                  reason: AgentHarness::ModelCompatibility::UNSUPPORTED_CLI_VERSION_REASON,
+                  minimum_cli_version: minimum_version,
+                  cli_version_requirement: requirement.to_s,
+                  fallback_model_id: DEFAULT_COMPATIBLE_MODEL_ID,
+                  source: :static_contract
+                )
+              end
+
               return AgentHarness::ModelCompatibility.build_result(
                 runner: provider_name,
                 model_id: normalized_model_id,
                 auth_mode: normalized_auth_mode,
                 cli_version: normalized_cli_version,
-                supported: false,
-                reason: AgentHarness::ModelCompatibility::UNSUPPORTED_CLI_VERSION_REASON,
+                supported: true,
+                reason: AgentHarness::ModelCompatibility::SUPPORTED_REASON,
                 minimum_cli_version: minimum_version,
                 cli_version_requirement: requirement.to_s,
-                fallback_model_id: DEFAULT_COMPATIBLE_MODEL_ID,
                 source: :static_contract
               )
             end
@@ -359,8 +423,6 @@ module AgentHarness
               cli_version: normalized_cli_version,
               supported: true,
               reason: AgentHarness::ModelCompatibility::SUPPORTED_REASON,
-              minimum_cli_version: minimum_version,
-              cli_version_requirement: requirement.to_s,
               source: :static_contract
             )
           end

data/lib/agent_harness/providers/kilocode.rb

@@ -16,14 +16,23 @@ module AgentHarness
       # Kilo CLI (an OpenCode fork) ships the same external_directory
       # permission category as OpenCode, defaulting to "ask" for anything
       # outside the project dir. In non-interactive execution there is no
-      # human to answer the prompt, so reads of scratch files under /tmp are
-      # auto-rejected and the agent silently loses access to its own scratch
-      # output, killing the run without a recoverable error. This default rule
-      # broadens the allowlist to all of /tmp so the agent can read back files
-      # it (or its sub-agents) wrote there. See #282 (precedent: #277/#280).
-      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN = "/tmp/**"
+      # human to answer the prompt, so dedicated read/write/edit tool calls
+      # targeting paths outside the project dir are auto-rejected and the
+      # agent silently loses access to its own scratch output or its own
+      # config/data files, killing the run without a recoverable error.
+      #
+      # This default rule broadens the allowlist to all of /tmp (so the agent
+      # can read back files it or its sub-agents wrote there) and to the full
+      # agent home directory (so the agent can inspect/maintain its own
+      # config, cache, and data files such as ~/.config/kilocode,
+      # ~/.local/share/kilo, ~/.cache). The container is already isolated
+      # (Docker, non-root user) and the agent runs with --auto which approves
+      # everything inside the project dir. See #289 (precedent: #282/#277).
+      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS = ["/tmp/**", "/home/agent/**"].freeze
       DEFAULT_PERMISSION_CONFIG = {
-        "external_directory" => {DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN => "allow"}
+        "external_directory" => DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS
+          .to_h { |pattern| [pattern, "allow"] }
+          .freeze
       }.freeze
       USAGE_EVENT_TYPES = %w[result usage].freeze
       TOKEN_USAGE_KEYS = %w[

data/lib/agent_harness/providers/opencode.rb

@@ -13,10 +13,14 @@ module AgentHarness
       SUPPORTED_CLI_VERSION = "1.3.2"
       SUPPORTED_CLI_REQUIREMENT = Gem::Requirement.new(">= #{SUPPORTED_CLI_VERSION}", "< 1.4.0").freeze
       INSTALL_COMMAND_PREFIX = ["npm", "install", "-g", "--ignore-scripts"].freeze
+      # Allowlist of external_directory patterns auto-approved in
+      # non-interactive execution. See the DEFAULT_PERMISSION_RULE comment
+      # below for the rationale (precedent: #289/#282/#277/#280).
+      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS = ["/tmp/**", "/home/agent/**"].freeze
       DEFAULT_PERMISSION_CONFIG = {
-        "external_directory" => {
-          "/tmp/**" => "allow"
-        }
+        "external_directory" => DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS
+          .to_h { |pattern| [pattern, "allow"] }
+          .freeze
       }.freeze
       SUPPORTED_CLI_VERSIONS = [SUPPORTED_CLI_VERSION].freeze
       POSTINSTALL_COMMAND = "node $(npm root -g)/opencode-ai/postinstall.mjs"
@@ -132,13 +136,23 @@ module AgentHarness
       # `/tmp/opencode/*`, but its own sub-agent delegation pattern (e.g. the
       # Explore-Agent used to summarize large diffs/outputs) writes scratch
       # files to other `/tmp/*` paths. In non-interactive execution there is no
-      # human to approve the resulting permission prompt, so the agent silently
-      # loses access to its own scratch output and never completes the task.
-      # This default rule broadens the allowlist to all of `/tmp` so the agent
-      # can read back files it (or its sub-agents) wrote there.
-      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN = "/tmp/**"
+      # human to approve the resulting permission prompt, so dedicated
+      # read/write/edit tool calls targeting paths outside the project dir are
+      # auto-rejected and the agent silently loses access to its own scratch
+      # output (or its own config/data files) and never completes the task.
+      #
+      # This default rule broadens the allowlist (see
+      # DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS) to all of `/tmp` (so
+      # the agent can read back files it or its sub-agents wrote there) and to
+      # the full agent home directory (so the agent can inspect/maintain its
+      # own config, cache, and data files such as ~/.config/opencode,
+      # ~/.local/share/opencode, ~/.cache). The container is already isolated
+      # (Docker, non-root user) and the agent runs with --auto which approves
+      # everything inside the project dir. See #289 (precedent: #282/#277/#280).
       DEFAULT_PERMISSION_RULE = {
-        "external_directory" => {DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN => "allow"}
+        "external_directory" => DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS
+          .to_h { |pattern| [pattern, "allow"] }
+          .freeze
       }.freeze
 
       def name

data/lib/agent_harness/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AgentHarness
-  VERSION = "0.28.3"
+  VERSION = "0.28.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: agent-harness
 version: !ruby/object:Gem::Version
-  version: 0.28.3
+  version: 0.28.5
 platform: ruby
 authors:
 - Bart Agapinan