@agntk/agent-harness 0.1.3 → 0.1.5

package/dist/{config-WVMRUOCA.js → config-2O6S2YJO.js}

@@ -3,11 +3,11 @@
 import {
   loadConfig,
   writeDefaultConfig
-} from "./chunk-CHJ5GNZC.js";
-import "./chunk-4CWAGBNS.js";
+} from "./chunk-EC42HQQH.js";
+import "./chunk-4TQQZILG.js";
 import "./chunk-ZZJOFKAT.js";
 export {
   loadConfig,
   writeDefaultConfig
 };
-//# sourceMappingURL=config-WVMRUOCA.js.map
+//# sourceMappingURL=config-2O6S2YJO.js.map

package/dist/config-LLQZYN2Q.js

@@ -0,0 +1,11 @@
+import {
+  loadConfig,
+  writeDefaultConfig
+} from "./chunk-XVFVTDE6.js";
+import "./chunk-RPBC2QOA.js";
+import "./chunk-DGUM43GV.js";
+export {
+  loadConfig,
+  writeDefaultConfig
+};
+//# sourceMappingURL=config-LLQZYN2Q.js.map

package/dist/{context-loader-3ORBPMHJ.js → context-loader-XCZ5EXNG.js}

@@ -2,12 +2,12 @@
 
 import {
   buildSystemPrompt
-} from "./chunk-UWQTZMNI.js";
-import "./chunk-UPLBF4RZ.js";
+} from "./chunk-7GZ4D6V6.js";
+import "./chunk-2UVWCTAY.js";
 import "./chunk-BSKDOFRT.js";
-import "./chunk-4CWAGBNS.js";
+import "./chunk-4TQQZILG.js";
 import "./chunk-ZZJOFKAT.js";
 export {
   buildSystemPrompt
 };
-//# sourceMappingURL=context-loader-3ORBPMHJ.js.map
+//# sourceMappingURL=context-loader-XCZ5EXNG.js.map

package/dist/{conversation-QDEIDQPH.js → conversation-OPLE23IM.js}

@@ -4,19 +4,19 @@ import {
   Conversation,
   parseJsonlContext,
   parseLegacyContext
-} from "./chunk-MPZ3BPUI.js";
-import "./chunk-UWQTZMNI.js";
+} from "./chunk-UMXPOYZR.js";
+import "./chunk-7GZ4D6V6.js";
 import "./chunk-DTTXPHFW.js";
 import "./chunk-Z2PUCXTZ.js";
-import "./chunk-UPLBF4RZ.js";
+import "./chunk-2UVWCTAY.js";
 import "./chunk-BSKDOFRT.js";
 import "./chunk-IZ6UZ3ZL.js";
-import "./chunk-CHJ5GNZC.js";
-import "./chunk-4CWAGBNS.js";
+import "./chunk-EC42HQQH.js";
+import "./chunk-4TQQZILG.js";
 import "./chunk-ZZJOFKAT.js";
 export {
   Conversation,
   parseJsonlContext,
   parseLegacyContext
 };
-//# sourceMappingURL=conversation-QDEIDQPH.js.map
+//# sourceMappingURL=conversation-OPLE23IM.js.map

package/dist/{delegate-VJCJLYEK.js → delegate-ZJCIADNN.js}

@@ -7,16 +7,16 @@ import {
   findAgent,
   listAgents,
   loadAgentDocs
-} from "./chunk-YUFNYN2H.js";
-import "./chunk-DA7IKHC4.js";
+} from "./chunk-PTQ37NRI.js";
+import "./chunk-NOJW5KG2.js";
 import "./chunk-DTTXPHFW.js";
 import "./chunk-Z2PUCXTZ.js";
-import "./chunk-XTBKL5BI.js";
-import "./chunk-UPLBF4RZ.js";
+import "./chunk-2ENYRENZ.js";
+import "./chunk-2UVWCTAY.js";
 import "./chunk-BSKDOFRT.js";
 import "./chunk-IZ6UZ3ZL.js";
-import "./chunk-CHJ5GNZC.js";
-import "./chunk-4CWAGBNS.js";
+import "./chunk-EC42HQQH.js";
+import "./chunk-4TQQZILG.js";
 import "./chunk-ZZJOFKAT.js";
 export {
   buildAgentPrompt,
@@ -26,4 +26,4 @@ export {
   listAgents,
   loadAgentDocs
 };
-//# sourceMappingURL=delegate-VJCJLYEK.js.map
+//# sourceMappingURL=delegate-ZJCIADNN.js.map

package/dist/{export-6GCYHEHQ.js → export-2HEAAOUF.js}

@@ -2,10 +2,10 @@
 
 import {
   loadConfig
-} from "./chunk-CHJ5GNZC.js";
+} from "./chunk-EC42HQQH.js";
 import {
   getPrimitiveDirs
-} from "./chunk-4CWAGBNS.js";
+} from "./chunk-4TQQZILG.js";
 import "./chunk-ZZJOFKAT.js";
 
 // src/runtime/export.ts
@@ -162,4 +162,4 @@ export {
   readBundle,
   writeBundle
 };
-//# sourceMappingURL=export-6GCYHEHQ.js.map
+//# sourceMappingURL=export-2HEAAOUF.js.map

package/dist/{graph-YUIPOSOO.js → graph-5MKRTC3J.js}

@@ -3,12 +3,12 @@
 import {
   buildDependencyGraph,
   getGraphStats
-} from "./chunk-274RV3YO.js";
-import "./chunk-UPLBF4RZ.js";
-import "./chunk-4CWAGBNS.js";
+} from "./chunk-GX2RCSFJ.js";
+import "./chunk-2UVWCTAY.js";
+import "./chunk-4TQQZILG.js";
 import "./chunk-ZZJOFKAT.js";
 export {
   buildDependencyGraph,
   getGraphStats
 };
-//# sourceMappingURL=graph-YUIPOSOO.js.map
+//# sourceMappingURL=graph-5MKRTC3J.js.map

package/dist/harness-ABKZWP47.js

@@ -0,0 +1,11 @@
+import {
+  createHarness
+} from "./chunk-MSO7DKBK.js";
+import "./chunk-XVFVTDE6.js";
+import "./chunk-RPBC2QOA.js";
+import "./chunk-FD55B3IO.js";
+import "./chunk-DGUM43GV.js";
+export {
+  createHarness
+};
+//# sourceMappingURL=harness-ABKZWP47.js.map

package/dist/{harness-WE4SLCML.js → harness-XSBQBY7T.js}

@@ -2,25 +2,25 @@
 
 import {
   createHarness
-} from "./chunk-YIJY5DBV.js";
+} from "./chunk-P74KXHA4.js";
 import "./chunk-AGAAFJEO.js";
 import "./chunk-5H34JPMB.js";
-import "./chunk-DA7IKHC4.js";
-import "./chunk-UWQTZMNI.js";
+import "./chunk-NOJW5KG2.js";
+import "./chunk-7GZ4D6V6.js";
 import "./chunk-UDZIS2AQ.js";
 import "./chunk-DTTXPHFW.js";
 import "./chunk-Z2PUCXTZ.js";
 import "./chunk-TAT6JU3X.js";
 import "./chunk-JKMGYWXB.js";
 import "./chunk-OC6YSTDX.js";
-import "./chunk-XTBKL5BI.js";
-import "./chunk-UPLBF4RZ.js";
+import "./chunk-2ENYRENZ.js";
+import "./chunk-2UVWCTAY.js";
 import "./chunk-BSKDOFRT.js";
 import "./chunk-IZ6UZ3ZL.js";
-import "./chunk-CHJ5GNZC.js";
-import "./chunk-4CWAGBNS.js";
+import "./chunk-EC42HQQH.js";
+import "./chunk-4TQQZILG.js";
 import "./chunk-ZZJOFKAT.js";
 export {
   createHarness
 };
-//# sourceMappingURL=harness-WE4SLCML.js.map
+//# sourceMappingURL=harness-XSBQBY7T.js.map

package/dist/index.d.ts

@@ -121,6 +121,21 @@ declare const HarnessConfigSchema: z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
         token: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>>>;
+    install: z.ZodDefault<z.ZodObject<{
+        allowed_licenses: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        on_unknown_license: z.ZodDefault<z.ZodEnum<{
+            allow: "allow";
+            warn: "warn";
+            prompt: "prompt";
+            block: "block";
+        }>>;
+        on_proprietary: z.ZodDefault<z.ZodEnum<{
+            allow: "allow";
+            warn: "warn";
+            prompt: "prompt";
+            block: "block";
+        }>>;
+    }, z.core.$loose>>;
 }, z.core.$loose>;
 type HarnessConfig = z.infer<typeof HarnessConfigSchema>;
 declare const CORE_PRIMITIVE_DIRS: readonly ["rules", "instincts", "skills", "playbooks", "workflows", "tools", "agents"];
@@ -3413,6 +3428,13 @@ interface UniversalInstallOptions {
     skipFix?: boolean;
     /** Additional tags to add */
     tags?: string[];
+    /**
+     * Override the license policy for THIS install only. Pass an SPDX id like
+     * "MIT" or "Apache-2.0" — the installer will treat the file as if its
+     * license were the override and skip the policy check entirely. Use only
+     * when you have written permission for the content. (Level 3 of 12.14.)
+     */
+    forceLicense?: string;
 }
 /**
  * Detect the format of a file based on its content and extension.

package/dist/index.js

@@ -37,7 +37,6 @@ import {
   listToolSummaries,
   loadAllPrimitives,
   loadAllPrimitivesWithErrors,
-  loadConfig,
   loadCosts,
   loadDirectory,
   loadDirectoryWithErrors,
@@ -67,15 +66,18 @@ import {
   validateMcpConfig,
   withFileLock,
   withFileLockSync,
-  writeDefaultConfig,
   writeSession
-} from "./chunk-GUJTBGVS.js";
+} from "./chunk-MSO7DKBK.js";
+import {
+  loadConfig,
+  writeDefaultConfig
+} from "./chunk-XVFVTDE6.js";
 import {
   CORE_PRIMITIVE_DIRS,
   FrontmatterSchema,
   HarnessConfigSchema,
   getPrimitiveDirs
-} from "./chunk-KFX54TQM.js";
+} from "./chunk-RPBC2QOA.js";
 import {
   generate,
   generateWithMessages,
@@ -366,7 +368,7 @@ function generateSystemMd(harnessDir, agentName) {
 async function generateCoreMd(agentName, purpose, options) {
   try {
     const { generate: generate2, getModel: getModel2 } = await import("./provider-LQHQX7Z7.js");
-    const { HarnessConfigSchema: HarnessConfigSchema2 } = await import("./types-WGDLSPO6.js");
+    const { HarnessConfigSchema: HarnessConfigSchema2 } = await import("./types-VRSXU4AM.js");
     const config = HarnessConfigSchema2.parse({
       agent: { name: agentName, version: "0.1.0" },
       model: {
@@ -11849,7 +11851,7 @@ function startServe(options) {
       return c.json({ error: "prompt is required" }, 400);
     }
     try {
-      const { createHarness: createHarness2 } = await import("./harness-LCHA3DWP.js");
+      const { createHarness: createHarness2 } = await import("./harness-ABKZWP47.js");
       const harness = createHarness2({
         dir: harnessDir,
         model: body.model,
@@ -12496,6 +12498,130 @@ async function resolveGithubCommitSha(url) {
     clearTimeout(timeout);
   }
 }
+var SIBLING_LICENSE_NAMES = [
+  "LICENSE",
+  "LICENSE.txt",
+  "LICENSE.md",
+  "COPYING",
+  "COPYING.txt"
+];
+function classifyLicenseText(text) {
+  const lower = text.toLowerCase();
+  if (lower.includes("all rights reserved")) {
+    return "PROPRIETARY";
+  }
+  if (lower.includes("mit license")) return "MIT";
+  if (lower.includes("apache license, version 2.0") || lower.includes("apache-2.0"))
+    return "Apache-2.0";
+  if (lower.includes("mozilla public license version 2.0") || lower.includes("mpl-2.0"))
+    return "MPL-2.0";
+  if (lower.includes("gnu affero general public license")) return "AGPL-3.0";
+  if (lower.includes("gnu lesser general public license")) {
+    if (lower.includes("version 3")) return "LGPL-3.0";
+    if (lower.includes("version 2")) return "LGPL-2.1";
+  }
+  if (lower.includes("gnu general public license")) {
+    if (lower.includes("version 3")) return "GPL-3.0";
+    if (lower.includes("version 2")) return "GPL-2.0";
+  }
+  if (lower.includes("isc license")) return "ISC";
+  if (lower.includes("cc0 1.0 universal") || lower.includes("cc0-1.0")) return "CC0-1.0";
+  if (lower.includes("creative commons attribution-sharealike 4.0")) return "CC-BY-SA-4.0";
+  if (lower.includes("creative commons attribution 4.0") || lower.includes("cc-by-4.0"))
+    return "CC-BY-4.0";
+  if (lower.includes("redistribution and use in source and binary forms") && lower.includes("neither the name of")) {
+    return "BSD-3-Clause";
+  }
+  if (lower.includes("redistribution and use in source and binary forms")) {
+    return "BSD-2-Clause";
+  }
+  if (lower.includes("this is free and unencumbered software released into the public domain")) {
+    return "Unlicense";
+  }
+  return "UNKNOWN";
+}
+function extractCopyright(text) {
+  const lines = text.split(/\r?\n/);
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (/^©\s*\d{4}/.test(trimmed) || /^copyright\b.*\d{4}/i.test(trimmed)) {
+      return trimmed;
+    }
+  }
+  return void 0;
+}
+async function fetchSiblingLicense(siblingUrl) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 5e3);
+  try {
+    const response = await fetch(siblingUrl, { signal: controller.signal });
+    if (!response.ok) return null;
+    return await response.text();
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function fetchGithubRepoLicense(owner, repo) {
+  const apiUrl = `https://api.github.com/repos/${owner}/${repo}/license`;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 5e3);
+  try {
+    const response = await fetch(apiUrl, {
+      signal: controller.signal,
+      headers: { "Accept": "application/vnd.github+json" }
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    const spdxId = data.license?.spdx_id;
+    if (!spdxId || spdxId === "NOASSERTION") return null;
+    let body;
+    if (data.content && data.encoding === "base64") {
+      try {
+        body = Buffer.from(data.content, "base64").toString("utf-8");
+      } catch {
+        body = void 0;
+      }
+    }
+    return { spdxId, htmlUrl: data.html_url ?? "", body };
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function detectLicense(sourceUrl) {
+  const match2 = sourceUrl.match(
+    /^https?:\/\/raw\.githubusercontent\.com\/([^/]+)\/([^/]+)\/([^/]+)\/(.+)$/
+  );
+  if (!match2) {
+    return { spdxId: "UNKNOWN" };
+  }
+  const [, owner, repo, ref, path] = match2;
+  const lastSlash = path.lastIndexOf("/");
+  const dir = lastSlash >= 0 ? path.slice(0, lastSlash) : "";
+  const dirPrefix = dir ? `${dir}/` : "";
+  for (const siblingName of SIBLING_LICENSE_NAMES) {
+    const siblingUrl = `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${dirPrefix}${siblingName}`;
+    const text = await fetchSiblingLicense(siblingUrl);
+    if (text) {
+      const spdxId = classifyLicenseText(text);
+      const copyright = extractCopyright(text);
+      return { spdxId, copyright, licenseSource: siblingUrl };
+    }
+  }
+  const repoLicense = await fetchGithubRepoLicense(owner, repo);
+  if (repoLicense) {
+    const copyright = repoLicense.body ? extractCopyright(repoLicense.body) : void 0;
+    return {
+      spdxId: repoLicense.spdxId,
+      copyright,
+      licenseSource: repoLicense.htmlUrl || void 0
+    };
+  }
+  return { spdxId: "UNKNOWN" };
+}
 async function recordProvenance(content, originalSource) {
   let parsed;
   try {
@@ -12513,10 +12639,51 @@ async function recordProvenance(content, originalSource) {
       data.source_commit = sha;
     }
   }
+  if (!data.license || !data.copyright || !data.license_source) {
+    const license = await detectLicense(originalSource);
+    if (!data.license) {
+      data.license = license.spdxId;
+    }
+    if (!data.copyright && license.copyright) {
+      data.copyright = license.copyright;
+    }
+    if (!data.license_source && license.licenseSource) {
+      data.license_source = license.licenseSource;
+    }
+  }
   data.installed_at = (/* @__PURE__ */ new Date()).toISOString();
   data.installed_by = `agent-harness@${getHarnessVersion()}`;
   return matter4.stringify(parsed.content, data);
 }
+function evaluateLicensePolicy(detected, policy, forceLicense) {
+  if (forceLicense) {
+    return {
+      action: "allow",
+      reason: `forced license override: ${forceLicense}`,
+      spdxId: forceLicense
+    };
+  }
+  const spdxId = detected.spdxId;
+  if (spdxId === "PROPRIETARY") {
+    return {
+      action: policy.on_proprietary,
+      reason: detected.licenseSource ? `proprietary content per ${detected.licenseSource}` : 'proprietary content (license text says "all rights reserved")',
+      spdxId
+    };
+  }
+  if (policy.allowed_licenses.includes(spdxId)) {
+    return {
+      action: "allow",
+      reason: `${spdxId} is in allowed_licenses`,
+      spdxId
+    };
+  }
+  return {
+    action: policy.on_unknown_license,
+    reason: spdxId === "UNKNOWN" ? "no LICENSE file found in source repo (per-file, repo root, or frontmatter)" : `${spdxId} is not in your allowed_licenses (config.yaml install.allowed_licenses)`,
+    spdxId
+  };
+}
 var VALID_TYPES2 = ["rule", "instinct", "skill", "playbook", "workflow", "tool", "agent"];
 var TYPE_DIRS2 = {
   rule: "rules",
@@ -12927,6 +13094,59 @@ async function universalInstall(harnessDir, source, options) {
   if (source.startsWith("http://") || source.startsWith("https://")) {
     finalContent = await recordProvenance(finalContent, source);
     result.fixes.push("Recorded provenance (source, installed_at, installed_by)");
+    try {
+      const { loadConfig: loadConfig2 } = await import("./config-LLQZYN2Q.js");
+      const config = loadConfig2(harnessDir);
+      const installPolicy = config.install;
+      const parsed = matter4(finalContent);
+      const detected = {
+        spdxId: typeof parsed.data.license === "string" ? parsed.data.license : "UNKNOWN",
+        copyright: typeof parsed.data.copyright === "string" ? parsed.data.copyright : void 0,
+        licenseSource: typeof parsed.data.license_source === "string" ? parsed.data.license_source : void 0
+      };
+      const decision = evaluateLicensePolicy(detected, installPolicy, options?.forceLicense);
+      if (decision.action === "block") {
+        result.errors.push(
+          `License policy blocked install: ${decision.reason}` + (detected.licenseSource ? ` (${detected.licenseSource})` : "") + `. To override, re-run with --force-license <SPDX> if you have written permission.`
+        );
+        return result;
+      }
+      if (decision.action === "warn") {
+        log.warn(
+          `[install] license policy warning: ${decision.reason}. Installing anyway (set install.on_unknown_license: block in config.yaml to refuse).`
+        );
+        result.fixes.push(`License policy: warned (${decision.spdxId})`);
+      }
+      if (decision.action === "prompt") {
+        if (process.stdin.isTTY && process.stdout.isTTY) {
+          const readline = await import("readline");
+          const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+          const question = `
+  \u26A0 License policy: ${decision.reason}
+  ${detected.licenseSource ? `License source: ${detected.licenseSource}
+  ` : ""}Install anyway? [y/N] `;
+          const answer = await new Promise((res) => rl.question(question, res));
+          rl.close();
+          if (!/^y(es)?$/i.test(answer.trim())) {
+            result.errors.push("License policy prompt declined by user");
+            return result;
+          }
+          result.fixes.push(`License policy: prompted, user accepted (${decision.spdxId})`);
+        } else {
+          result.errors.push(
+            `License policy requires interactive confirmation (${decision.reason}) but stdin/stdout is not a TTY. Re-run interactively, or pass --force-license <SPDX> if you have written permission.`
+          );
+          return result;
+        }
+      }
+      if (decision.action === "allow" && options?.forceLicense) {
+        result.fixes.push(`License policy: forced to ${decision.spdxId}`);
+      }
+    } catch (err) {
+      log.warn(
+        `[install] license policy check skipped: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
   }
   const tempDir = join32(tmpdir2(), "harness-install");
   mkdirSync16(tempDir, { recursive: true });