@agent-native/core 0.157.5 → 0.157.7

package/dist/config.js

@@ -30,6 +30,7 @@ export function normalizeAgentNativeConfig(input, source = "agent-native config"
     const instructionsValue = input.instructions;
     const translationsValue = input.translations;
     const changelogValue = input.changelog;
+    const harnessValue = input.harness;
     const normalized = {
         ...(input.version === undefined
             ? {}
@@ -57,6 +58,9 @@ export function normalizeAgentNativeConfig(input, source = "agent-native config"
     if (changelogValue !== undefined) {
         normalized.changelog = normalizeChangelogConfig(changelogValue, `${source}.changelog`);
     }
+    if (harnessValue !== undefined) {
+        normalized.harness = normalizeHarnessConfig(harnessValue, `${source}.harness`);
+    }
     return normalized;
 }
 export function mergeAgentNativeConfigs(base, override) {
@@ -128,6 +132,7 @@ export function mergeAgentNativeConfigs(base, override) {
                 ...override.changelog,
             }
             : undefined,
+        harness: mergeHarnessSettings(base.harness, override.harness),
     };
 }
 export function resolveAgentNativeConfig(input, context) {
@@ -254,6 +259,47 @@ function normalizeChangelogConfig(value, source) {
     }
     return value.enabled === undefined ? {} : { enabled: value.enabled };
 }
+function normalizeHarnessConfig(value, source) {
+    if (typeof value === "boolean")
+        return value;
+    if (!isRecord(value)) {
+        throw new Error(`${source} must be a boolean or object`);
+    }
+    if ("enabled" in value || "ui" in value) {
+        throw new Error(`${source} must be true or an object with runtimes`);
+    }
+    const runtimes = value.runtimes;
+    if (runtimes !== undefined) {
+        if (!Array.isArray(runtimes) ||
+            runtimes.some((runtime) => !isAgentNativeHarnessRuntime(runtime))) {
+            throw new Error(`${source}.runtimes must contain only "claude-code", "codex", "pi", or "opencode"`);
+        }
+    }
+    return {
+        ...(runtimes === undefined
+            ? {}
+            : { runtimes: [...new Set(runtimes)] }),
+    };
+}
+function mergeHarnessSettings(base, override) {
+    if (override === undefined)
+        return base;
+    if (typeof override === "boolean")
+        return override;
+    if (typeof base !== "object" || base === null)
+        return override;
+    if (base.runtimes === undefined && override.runtimes === undefined) {
+        return {};
+    }
+    return {
+        runtimes: [
+            ...new Set([
+                ...(base.runtimes ?? []),
+                ...(override.runtimes ?? []),
+            ]),
+        ],
+    };
+}
 function normalizeRelativeFilePath(value, source) {
     const normalized = value.trim().replaceAll("\\", "/");
     if (!normalized ||
@@ -286,6 +332,12 @@ function isFirstRunMode(value) {
         value === "connect" ||
         value === "connect-and-integrations");
 }
+function isAgentNativeHarnessRuntime(value) {
+    return (value === "claude-code" ||
+        value === "codex" ||
+        value === "pi" ||
+        value === "opencode");
+}
 function isRecord(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }

package/dist/deploy/build.js

@@ -2918,14 +2918,34 @@ export function bundleYjsRuntimeForServerlessOutput(serverDir, projectCwd) {
     });
     return bareImports;
 }
-// Netlify's hard limit is 250MB unzipped per function; a bundle this far under
-// it still leaves room for growth, and today's server functions land near 70MB
-// once the dead weight is out. Apps that legitimately ship the browser runtime
-// get its ~85MB on top, so the budget stays a regression signal rather than a
-// tax on Chromium-backed templates.
+// Netlify's hard limit is 250MB unzipped per function; keep 10MB of headroom
+// for packaging variance so a passing guard does not sit on the platform edge.
 const NETLIFY_FUNCTION_SIZE_BUDGET_BYTES = 120 * 1024 * 1024;
+const NETLIFY_FUNCTION_HARD_LIMIT_BYTES = 240 * 1024 * 1024;
 const NETLIFY_BROWSER_RUNTIME_SIZE_ALLOWANCE_BYTES = 100 * 1024 * 1024;
-function reportNetlifyFunctionSizes(projectCwd, internalDir, failures) {
+// Clips intentionally ships ffmpeg-static for server-side frame extraction,
+// WebM seekability, filmstrips, and audio-only transcription. Keep that known
+// runtime payload separate from the ordinary bundle-growth budget.
+const NETLIFY_FFMPEG_RUNTIME_SIZE_ALLOWANCE_BYTES = 80 * 1024 * 1024;
+function hasBundledFfmpegStaticRuntime(functionDir) {
+    if (!fs.existsSync(functionDir))
+        return false;
+    const binaryName = FFMPEG_STATIC_BINARY_NAMES[0];
+    return fs.existsSync(path.join(functionDir, "node_modules", FFMPEG_STATIC_PACKAGE_NAME, binaryName));
+}
+function hasBundledServerlessBrowserRuntime(functionDir) {
+    return fs.existsSync(path.join(functionDir, "node_modules", "@sparticuz", "chromium", "bin", "chromium.br"));
+}
+function netlifyFunctionSizeBudget(functionDir) {
+    const allowance = (hasBundledServerlessBrowserRuntime(functionDir)
+        ? NETLIFY_BROWSER_RUNTIME_SIZE_ALLOWANCE_BYTES
+        : 0) +
+        (hasBundledFfmpegStaticRuntime(functionDir)
+            ? NETLIFY_FFMPEG_RUNTIME_SIZE_ALLOWANCE_BYTES
+            : 0);
+    return Math.min(NETLIFY_FUNCTION_SIZE_BUDGET_BYTES + allowance, NETLIFY_FUNCTION_HARD_LIMIT_BYTES);
+}
+function reportNetlifyFunctionSizes(internalDir, failures) {
     if (!fs.existsSync(internalDir))
         return;
     const functions = fs
@@ -2947,11 +2967,8 @@ function reportNetlifyFunctionSizes(projectCwd, internalDir, failures) {
     console.log(`[deploy] Netlify functions: ${functions.length} (${functions
         .map((fn) => `${fn.name} ${toMb(fn.size)}MB`)
         .join(", ")}) — ${toMb(total)}MB uploaded in total.`);
-    const budget = NETLIFY_FUNCTION_SIZE_BUDGET_BYTES +
-        (findServerlessBrowserRuntimeConsumer(projectCwd)
-            ? NETLIFY_BROWSER_RUNTIME_SIZE_ALLOWANCE_BYTES
-            : 0);
     for (const fn of functions) {
+        const budget = netlifyFunctionSizeBudget(fn.dir);
         if (fn.size <= budget)
             continue;
         // node_modules is always the biggest child and names nothing useful; the
@@ -3113,7 +3130,7 @@ export function assertSingleTemplateNetlifyBuildOutput(projectCwd) {
             }
         }
     }
-    reportNetlifyFunctionSizes(projectCwd, internalDir, failures);
+    reportNetlifyFunctionSizes(internalDir, failures);
     if (failures.length > 0) {
         throw new Error("[deploy] Netlify deploy guard failed; refusing to publish an output " +
             "that would likely serve Netlify 404s or blow the function size limit:\n" +

package/dist/extensions/actions.js

@@ -1242,6 +1242,27 @@ async function summarizeExtensionForAgentRead(row, hiddenIds, includeContent, fo
     const fingerprint = contentFingerprint(row.content);
     if (contentQuery) {
         const summary = await summarizeExtension(row, hiddenIds, false);
+        // The whole-body read below is deduped per run, but this branch returned
+        // above it, so a repeated excerpt request re-sent bytes already in context.
+        // One production turn spent 48 of 110 reads re-fetching the same spans.
+        const excerptCtx = getRequestRunContext();
+        const excerpts = excerptCtx
+            ? (excerptCtx.extensionExcerptReads ??= {})
+            : undefined;
+        const excerptKey = `${row.id}:${fingerprint}:${contentContextChars}:${contentQuery}`;
+        if (excerpts?.[excerptKey]) {
+            return {
+                ...summary,
+                contentOmitted: {
+                    reason: "identical-excerpt-already-returned-this-run",
+                    contentHash: fingerprint,
+                    contentLength: row.content.length,
+                    next: 'These exact excerpts were already returned earlier in this run and the body has not changed. Use them to call update-extension with operation="edit"; use a different contentQuery only for a source area you have not read yet.',
+                },
+            };
+        }
+        if (excerpts)
+            excerpts[excerptKey] = true;
         return {
             ...summary,
             contentMatches: findExtensionContentMatches(row.content, contentQuery, contentContextChars),
@@ -1266,7 +1287,7 @@ async function summarizeExtensionForAgentRead(row, hiddenIds, includeContent, fo
                 contentHash: fingerprint,
                 contentLength: row.content.length,
                 inlineContentLimit: LARGE_EXTENSION_INLINE_CONTENT_MAX_CHARS,
-                next: "Call get-extension again with contentQuery set to the relevant function, variable, section marker, or literal text. Use forceContent=true only for a broad rewrite that truly needs the entire body.",
+                next: `Call get-extension again with contentQuery set to the relevant function, variable, section marker, or literal text. If you expect to read more than about three separate areas of this ${row.content.length}-char body, call get-extension once with forceContent=true instead — repeated excerpt reads of the same file cost more context than one whole read.`,
             },
         };
     }

package/dist/hosted-harness/actions/get-hosted-harness-config.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("../../action.js").ActionDefinition<Record<string, never>, import("../../server/hosted-harness-policy.js").HostedHarnessPolicy>;
+export default _default;

package/dist/hosted-harness/actions/get-hosted-harness-config.js

@@ -0,0 +1,13 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { hostedHarnessStatusForClient, resolveHostedHarnessPolicy, } from "../../server/hosted-harness-policy.js";
+export default defineAction({
+    description: "Return whether this app's hosted tools-only harness is enabled for the current organization and which runtimes are available.",
+    schema: z.object({}),
+    http: { method: "GET" },
+    agentTool: false,
+    run: async (_args, context) => hostedHarnessStatusForClient(await resolveHostedHarnessPolicy({
+        orgId: context?.orgId,
+        userEmail: context?.userEmail,
+    })),
+});

package/dist/hosted-harness/actions/set-hosted-harness-enabled.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    enabled: boolean;
+}, import("../../server/hosted-harness-policy.js").HostedHarnessPolicy>;
+export default _default;

package/dist/hosted-harness/actions/set-hosted-harness-enabled.js

@@ -0,0 +1,32 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { HOSTED_HARNESS_ORG_SETTING_KEY } from "../../agent/harness/hosted.js";
+import { getOrgRoleForEmail } from "../../mcp/actions/service-token-access.js";
+import { canManageOrg } from "../../org/permissions.js";
+import { hostedHarnessStatusForClient, resolveHostedHarnessPolicy, } from "../../server/hosted-harness-policy.js";
+import { putOrgSetting } from "../../settings/org-settings.js";
+export default defineAction({
+    description: "Enable or disable the hosted tools-only harness for the current organization. Organization owners and admins only.",
+    schema: z.object({ enabled: z.boolean() }),
+    http: { method: "POST" },
+    agentTool: false,
+    run: async (args, context) => {
+        const email = context?.userEmail?.trim().toLowerCase();
+        const orgId = context?.orgId?.trim();
+        if (!email)
+            throw new Error("Sign in to manage hosted harnesses.");
+        if (!orgId)
+            throw new Error("Select an organization to manage harnesses.");
+        const role = await getOrgRoleForEmail(orgId, email);
+        if (!canManageOrg(role)) {
+            throw new Error("Only organization owners and admins can manage hosted harnesses.");
+        }
+        await putOrgSetting(orgId, HOSTED_HARNESS_ORG_SETTING_KEY, {
+            enabled: args.enabled,
+        });
+        return hostedHarnessStatusForClient(await resolveHostedHarnessPolicy({
+            orgId,
+            userEmail: email,
+        }));
+    },
+});

package/dist/localization/default-messages.d.ts

@@ -733,6 +733,9 @@ declare const messages: {
         statusDone: string;
         statusFailed: string;
         statusStopped: string;
+        statusNeedsApproval: string;
+        statusNeedsInput: string;
+        statusPaused: string;
         updatedJustNow: string;
         finishedJustNow: string;
         updatedMinutes: string;
@@ -743,7 +746,7 @@ declare const messages: {
         finishedDate: string;
     };
     agentTask: {
-        backgroundTask: string;
+        spawnedAgent: string;
         stop: string;
         openThread: string;
     };

package/dist/localization/default-messages.js

@@ -739,6 +739,9 @@ const messages = {
         statusDone: "Done",
         statusFailed: "Failed",
         statusStopped: "Stopped",
+        statusNeedsApproval: "Needs approval",
+        statusNeedsInput: "Needs input",
+        statusPaused: "Paused",
         updatedJustNow: "Updated just now",
         finishedJustNow: "Finished just now",
         updatedMinutes: "Updated {{count}}m ago",
@@ -749,8 +752,8 @@ const messages = {
         finishedDate: "Finished {{date}}",
     },
     agentTask: {
-        backgroundTask: "Background task",
-        stop: "Stop background task",
+        spawnedAgent: "Spawned agent",
+        stop: "Stop spawned agent",
         openThread: "Open task thread",
     },
     codeRequired: {

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,8 +75,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    id?: undefined;
     message?: undefined;
+    id?: undefined;
+    provider?: undefined;
     deleted?: undefined;
     providers: {
         id: string;
@@ -88,14 +89,13 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    provider?: undefined;
     found?: undefined;
     registered?: undefined;
     label?: undefined;
 } | {
-    id?: undefined;
     message?: undefined;
     count?: undefined;
+    id?: undefined;
     deleted?: undefined;
     providers?: undefined;
     found: boolean;
@@ -105,9 +105,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
 } | {
     message?: undefined;
     count?: undefined;
+    provider?: undefined;
     deleted?: undefined;
     providers?: undefined;
-    provider?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
@@ -115,8 +115,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
 } | {
     message?: undefined;
     count?: undefined;
-    providers?: undefined;
     provider?: undefined;
+    providers?: undefined;
     found?: undefined;
     deleted: boolean;
     id: string;
@@ -124,9 +124,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     label?: undefined;
 } | {
     count?: undefined;
+    provider?: undefined;
     deleted?: undefined;
     providers?: undefined;
-    provider?: undefined;
     found?: undefined;
     registered: boolean;
     id: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -313,7 +313,6 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
     }, {
         deleted?: undefined;
         id?: undefined;
-        provider?: undefined;
         providers: {
             id: string;
             label: string;
@@ -324,6 +323,7 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
+        provider?: undefined;
         found?: undefined;
         registered?: undefined;
         label?: undefined;
@@ -340,18 +340,18 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         message?: undefined;
     } | {
         deleted?: undefined;
-        provider?: undefined;
         providers?: undefined;
         count?: undefined;
+        provider?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
-        provider?: undefined;
         providers?: undefined;
         count?: undefined;
+        provider?: undefined;
         found?: undefined;
         deleted: boolean;
         id: string;
@@ -360,9 +360,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         message?: undefined;
     } | {
         deleted?: undefined;
-        provider?: undefined;
         providers?: undefined;
         count?: undefined;
+        provider?: undefined;
         found?: undefined;
         registered: boolean;
         id: string;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/action-discovery.js

@@ -529,6 +529,10 @@ export const ALWAYS_ON_CORE_ACTIONS = new Set([
     "revoke-org-service-token",
     "list-mcp-tools",
     "call-mcp-tool",
+    // Hosted harness capability/policy routes are UI-facing and deliberately
+    // never enter the model's action surface (`agentTool: false`).
+    "get-hosted-harness-config",
+    "set-hosted-harness-enabled",
 ]);
 export async function mergeCoreSharingActions(registry) {
     const entries = [
@@ -592,6 +596,14 @@ export async function mergeCoreSharingActions(registry) {
             "get-feature-flags",
             () => import("../feature-flags/actions/get-feature-flags.js"),
         ],
+        [
+            "get-hosted-harness-config",
+            () => import("../hosted-harness/actions/get-hosted-harness-config.js"),
+        ],
+        [
+            "set-hosted-harness-enabled",
+            () => import("../hosted-harness/actions/set-hosted-harness-enabled.js"),
+        ],
         [
             "list-feature-flags",
             () => import("../feature-flags/actions/list-feature-flags.js"),

package/dist/server/agent-chat-plugin.js

@@ -12,6 +12,7 @@ import { AGENT_CHAT_BACKGROUND_RUN_FIELD, AGENT_CHAT_PROCESS_RUN_PATH, backgroun
 import { resolveEngine, createAnthropicEngine, getStoredModelForEngine, normalizeModelForEngine, resolveDelegatedRunModel, getAgentEngineEntry, isAgentEnginePackageInstalled, isStoredEngineUsableForRequest, listAgentEngines, registerBuiltinEngines, } from "../agent/engine/index.js";
 import { SYSTEM_PROMPT_CACHE_SPLIT } from "../agent/engine/prompt-cache.js";
 import { PROVIDER_TO_ENV } from "../agent/engine/provider-env-vars.js";
+import { hostedHarnessSystemPrompt } from "../agent/harness/hosted.js";
 import { createProductionAgentHandler, actionsToEngineTools, executeAgentToolCall, filterActionsByAllowedNames, readPersistedActionSurface, toolCallCacheKey, getActiveRunForThreadAsync, abortRunDurably, abortTurnDurably, subscribeToRun, } from "../agent/production-agent.js";
 import { callerHasRunAccess, callerHasThreadAccess, } from "../agent/run-ownership.js";
 import { markTurnAborted, readBackgroundRunClaim } from "../agent/run-store.js";
@@ -44,6 +45,7 @@ import { captureError } from "./capture-error.js";
 import { getH3App, markDefaultPluginProvided, trackPluginInit, } from "./framework-request-handler.js";
 import { getOrigin } from "./google-oauth.js";
 import { readBody } from "./h3-helpers.js";
+import { loadHostedHarnessConfig } from "./hosted-harness-policy.js";
 import { startIntervalJob } from "./interval-job.js";
 import { getModelFamilyOverlay } from "./prompts/index.js";
 import { mountRealtimeVoiceRoutes } from "./realtime-voice.js";
@@ -309,6 +311,7 @@ export function createAgentChatPlugin(options) {
             // `/runs/active` reaps the requested run on demand, and the periodic
             // recovery sweep below handles abandoned runs with no connected client.
             const env = process.env.NODE_ENV;
+            const hostedHarnessConfig = await loadHostedHarnessConfig();
             // AGENT_MODE=production forces production agent constraints even in dev
             const canToggle = (env === "development" || env === "test") &&
                 process.env.AGENT_MODE !== "production";
@@ -2694,6 +2697,13 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     const codeEditingSurfaceRestriction = shouldBlockInProductCodeEditing(event)
                         ? APP_RENDERED_CHAT_NO_DIRECT_CODE_PROMPT
                         : "";
+                    const hostedHarnessRuntime = getRequestRunContext()?.hostedHarnessRuntime;
+                    const hostedHarnessPromptNote = hostedHarnessRuntime
+                        ? hostedHarnessSystemPrompt(hostedHarnessRuntime)
+                        : "";
+                    const requestProdCodeExecPromptNote = hostedHarnessRuntime
+                        ? ""
+                        : prodCodeExecPromptNote;
                     // Per-model overlay: nudge GPT/Gemini engines toward our behavioral norms.
                     const modelOverlay = resolveModelOverlay();
                     // Stable-first ordering: base prompt / schema / extra come before
@@ -2705,7 +2715,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     // `SYSTEM_PROMPT_CACHE_SPLIT` marks where the cacheable prefix ends,
                     // so everything after it can change without a cache write.
                     if (leanPrompt) {
-                        const leanRunPolicyPrompt = buildLeanRunPolicyPrompt(codeEditingSurfaceRestriction, prodCodeExecPromptNote);
+                        const leanRunPolicyPrompt = buildLeanRunPolicyPrompt(codeEditingSurfaceRestriction, `${requestProdCodeExecPromptNote}${hostedHarnessPromptNote ? `\n\n${hostedHarnessPromptNote}` : ""}`);
                         const resources = await loadResourcesForPrompt(owner, true, options?.appId, undefined, { disabledFrameworkGroups });
                         await emitContextXraySystemSections(event, {
                             frameworkPrompt: requestLeanPrompt.slice(0, Math.max(0, requestLeanPrompt.length - requestLeanActionsPrompt.length)),
@@ -2740,20 +2750,26 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         extra,
                         modelOverlay,
                         runtimeContext,
-                        additionalFramework: codeEditingSurfaceRestriction + prodCodeExecPromptNote,
+                        additionalFramework: codeEditingSurfaceRestriction +
+                            requestProdCodeExecPromptNote +
+                            (hostedHarnessPromptNote ? `\n\n${hostedHarnessPromptNote}` : ""),
                     });
                     return setSystemPromptOnContext(requestBasePrompt +
                         SYSTEM_PROMPT_CACHE_SPLIT +
                         resources +
                         schemaBlock +
                         codeEditingSurfaceRestriction +
-                        prodCodeExecPromptNote +
+                        requestProdCodeExecPromptNote +
+                        (hostedHarnessPromptNote
+                            ? `\n\n${hostedHarnessPromptNote}`
+                            : "") +
                         extra +
                         modelOverlay +
                         runtimeContext);
                 },
                 model: options?.model,
                 appId: options?.appId,
+                hostedHarnessConfig,
                 apiKey: options?.apiKey,
                 ...resolveInteractiveAgentRunOptions(options),
                 finalResponseGuard: options?.finalResponseGuard,
@@ -4692,9 +4708,13 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     // `prodHandler.systemPrompt` then steers source changes to a
                     // separate agent surface such as Builder or the dev frame.
                     const blockInProductCodeEditing = shouldBlockInProductCodeEditing(event);
+                    const hostedHarnessRequest = getHeader(event, "x-agent-native-hosted-harness") === "1";
                     const handler = ownerContext.anonymous && anonymousHandler
                         ? anonymousHandler
-                        : !blockInProductCodeEditing && currentDevMode && devHandler
+                        : !hostedHarnessRequest &&
+                            !blockInProductCodeEditing &&
+                            currentDevMode &&
+                            devHandler
                             ? devHandler
                             : prodHandler;
                     return handler(event);

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};