@agntn/harnesses 0.0.1 → 0.1.1

package/dist/_chunks/agents-sync.mjs

@@ -1,13 +1,20 @@
+import { addAbortListener } from "node:events";
 import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, renameSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
-import { execFileSync, spawn } from "node:child_process";
-import { basename, dirname, isAbsolute, join, normalize, resolve, sep } from "node:path";
+import { execFile, execFileSync, spawn } from "node:child_process";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { basename, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
 import os, { homedir } from "node:os";
 import { stripVTControlCharacters } from "node:util";
 import { parse } from "smol-toml";
+const PATH_MARKERS = /^~(?=\/|$)|\$\{HOME\}|\$\{PROJECT_ROOT\}|%([^%]+)%/g;
 function resolvePathTemplate(template, options = {}) {
 	const homeDir = options.homeDir ?? os.homedir();
 	const projectRoot = options.projectRoot ?? process.cwd();
-	return template.replace(/^~(?=\/|$)/, homeDir).replaceAll("${HOME}", homeDir).replaceAll("${PROJECT_ROOT}", projectRoot).replaceAll(/%([^%]+)%/g, (match, name) => process.env[name] ?? match);
+	return template.replaceAll(PATH_MARKERS, (match, name) => {
+		if (match === "${PROJECT_ROOT}") return projectRoot;
+		if (name === void 0) return homeDir;
+		return process.env[name] ?? match;
+	});
 }
 function agntnConfigDir(options = {}) {
 	const base = process.env.XDG_CONFIG_HOME && process.env.XDG_CONFIG_HOME !== "" ? process.env.XDG_CONFIG_HOME : join(options.homeDir ?? os.homedir(), ".config");
@@ -53,13 +60,75 @@ function invocationTemplate(invocation, mode) {
 		case "agentStructured": return invocation.jsonArgs;
 	}
 }
+function invocationRetryHint(invocation, mode, options) {
+	const withoutStructured = requestedInvocationMode({
+		...options,
+		structured: false
+	});
+	if (options.structured === true) {
+		if (invocationTemplate(invocation, withoutStructured)) return "; retry with structured: false";
+		const alternateWithoutStructured = ALTERNATE_INVOCATION_MODE[withoutStructured];
+		if (alternateWithoutStructured !== void 0 && invocationTemplate(invocation, alternateWithoutStructured)) return `; retry with structured: false and tools: ${!options.tools}`;
+	}
+	const alternateMode = ALTERNATE_INVOCATION_MODE[mode];
+	return (alternateMode === void 0 ? void 0 : invocationTemplate(invocation, alternateMode)) ? INVOCATION_RETRY_HINT[mode] ?? "" : "";
+}
+function compareVersions(a, b) {
+	const [aBase = "", aPre] = a.split("-", 2);
+	const [bBase = "", bPre] = b.split("-", 2);
+	const left = aBase.split(".").map(Number);
+	const right = bBase.split(".").map(Number);
+	for (let i = 0; i < Math.max(left.length, right.length); i++) {
+		const diff = (left[i] ?? 0) - (right[i] ?? 0);
+		if (diff !== 0) return diff;
+	}
+	return Number(aPre === void 0) - Number(bPre === void 0);
+}
 function buildInvocationArgs(template, prompt, modelArgs, model) {
-	const args = template.map((arg) => arg.replaceAll("{prompt}", prompt));
-	if (model !== void 0 && modelArgs) args.push(...modelArgs.map((arg) => arg.replaceAll("{model}", model)));
+	const args = template.map((arg) => arg.replaceAll("{prompt}", () => prompt));
+	if (model !== void 0 && modelArgs) args.push(...modelArgs.map((arg) => arg.replaceAll("{model}", () => model)));
 	return args;
 }
+function signalProcessGroup(pid, signal) {
+	try {
+		process.kill(-pid, signal);
+	} catch (error) {
+		if (!(error instanceof Error && "code" in error && error.code === "ESRCH")) throw error;
+	}
+}
+async function terminateCommand(pid) {
+	if (process.platform === "win32") {
+		await new Promise((resolve, reject) => {
+			execFile(join(process.env.SystemRoot ?? "C:\\Windows", "System32", "taskkill.exe"), [
+				"/PID",
+				String(pid),
+				"/T",
+				"/F"
+			], {
+				windowsHide: true,
+				timeout: 2e3,
+				killSignal: "SIGKILL"
+			}, (error) => error ? reject(error) : resolve());
+		});
+		return;
+	}
+	signalProcessGroup(pid, "SIGTERM");
+	await setTimeout$1(500);
+	signalProcessGroup(pid, "SIGKILL");
+}
 function executeCommand(command, args, options) {
 	return new Promise((resolve, reject) => {
+		let stdout = "";
+		let stderr = "";
+		let stopped;
+		let settled = false;
+		let timer;
+		let abortListener;
+		if (options.signal?.aborted) {
+			stopped = "abort";
+			finish(null);
+			return;
+		}
 		const child = spawn(command, args, {
 			cwd: options.cwd,
 			env: options.env ? {
@@ -70,36 +139,60 @@ function executeCommand(command, args, options) {
 				"ignore",
 				"pipe",
 				"pipe"
-			]
+			],
+			detached: process.platform !== "win32" && (Boolean(options.timeoutMs) || options.signal !== void 0)
 		});
-		let stdout = "";
-		let stderr = "";
-		let timedOut = false;
-		const timer = options.timeoutMs ? setTimeout(() => {
-			timedOut = true;
-			child.kill("SIGTERM");
-		}, options.timeoutMs) : void 0;
+		if (options.timeoutMs) timer = setTimeout(() => stop("timeout"), options.timeoutMs);
+		if (options.signal) abortListener = addAbortListener(options.signal, () => stop("abort"));
 		child.stdout.on("data", (chunk) => {
 			stdout += chunk.toString("utf8");
 		});
 		child.stderr.on("data", (chunk) => {
 			stderr += chunk.toString("utf8");
 		});
-		child.on("error", (error) => {
-			if (timer) clearTimeout(timer);
-			reject(error);
-		});
+		child.on("error", fail);
 		child.on("close", (code) => {
+			if (stopped === void 0) finish(code);
+		});
+		function cleanup() {
 			if (timer) clearTimeout(timer);
+			abortListener?.[Symbol.dispose]();
+		}
+		function fail(error) {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			reject(error);
+		}
+		function stop(reason) {
+			if (settled || stopped !== void 0) return;
+			stopped = reason;
+			cleanup();
+			if (child.pid === void 0) return;
+			terminateCommand(child.pid).then(() => {
+				child.stdout.destroy();
+				child.stderr.destroy();
+				finish(null);
+			}, (error) => {
+				child.stdout.destroy();
+				child.stderr.destroy();
+				fail(error);
+			});
+		}
+		function finish(code) {
+			if (settled) return;
+			settled = true;
+			cleanup();
 			resolve({
 				command,
 				args: [...args],
 				stdout,
 				stderr,
-				exitCode: timedOut ? null : code,
-				timedOut
+				exitCode: stopped === void 0 ? code : null,
+				timedOut: stopped === "timeout",
+				aborted: stopped === "abort"
 			});
-		});
+		}
 	});
 }
 var Harness = class {
@@ -168,9 +261,7 @@ var Harness = class {
 		if (options.model !== void 0 && !this.invocation.modelArgs) return `Harness ${this.id} does not support model selection`;
 		const mode = requestedInvocationMode(options);
 		if (invocationTemplate(this.invocation, mode)) return null;
-		const alternateMode = ALTERNATE_INVOCATION_MODE[mode];
-		const retry = (alternateMode === void 0 ? void 0 : invocationTemplate(this.invocation, alternateMode)) ? INVOCATION_RETRY_HINT[mode] ?? "" : "";
-		return `Harness ${this.id} has no ${INVOCATION_MODE_DESCRIPTION[mode]} invocation${retry}`;
+		return `${`Harness ${this.id} has no ${INVOCATION_MODE_DESCRIPTION[mode]} invocation`}${invocationRetryHint(this.invocation, mode, options)}`;
 	}
 	invoke(prompt, options = {}) {
 		const invocationOptions = {
@@ -181,8 +272,19 @@ var Harness = class {
 		};
 		const built = this.buildInvocation(prompt, invocationOptions);
 		if (!built) return Promise.reject(new Error(this.invocationError(invocationOptions) ?? "Invalid invocation"));
+		const versionError = this.readOnlyVersionError(invocationOptions);
+		if (versionError) return Promise.reject(new Error(versionError));
 		return executeCommand(built.command, built.args, options);
 	}
+	readOnlyVersionError(options) {
+		const floor = this.invocation?.readOnlyMinVersion;
+		if (floor === void 0 || options.readOnly !== true) return null;
+		const installed = this.version;
+		const error = `Harness ${this.id} requires version ${floor} or newer for read-only runs`;
+		if (installed === null) return `${error}; installed version unknown`;
+		if (compareVersions(installed, floor) < 0) return `${error}; installed ${installed}`;
+		return null;
+	}
 	buildModelListInvocation(search) {
 		if (!this.modelListing) return null;
 		const command = this.binaries[0];
@@ -191,7 +293,7 @@ var Harness = class {
 		if (!template) return null;
 		return {
 			command,
-			args: template.map((arg) => arg.replaceAll("{search}", search ?? ""))
+			args: template.map((arg) => arg.replaceAll("{search}", () => search ?? ""))
 		};
 	}
 	async listModels(options = {}) {
@@ -200,7 +302,7 @@ var Harness = class {
 		const result = await executeCommand(built.command, built.args, options);
 		return {
 			...result,
-			models: !result.timedOut && result.exitCode === 0 ? this.parseModelListingOutput(result.stdout) : []
+			models: !result.timedOut && !result.aborted && result.exitCode === 0 ? this.parseModelListingOutput(result.stdout) : []
 		};
 	}
 	parseModelListingOutput(_stdout) {
@@ -531,9 +633,26 @@ var Claude = class extends Harness {
 			"--tools",
 			""
 		],
+		readOnlyArgs: [
+			"-p",
+			"{prompt}",
+			"--strict-mcp-config",
+			"--tools",
+			"Read,Glob,Grep"
+		],
+		readOnlyJsonArgs: [
+			"-p",
+			"--output-format",
+			"json",
+			"{prompt}",
+			"--strict-mcp-config",
+			"--tools",
+			"Read,Glob,Grep"
+		],
+		readOnlyMinVersion: "2.1.175",
 		modelArgs: ["--model", "{model}"],
 		level: "official",
-		note: "Headless print mode; add --output-format json for structured output."
+		note: "Headless print mode; add --output-format json for structured output. Read-only runs keep the built-in Read, Glob and Grep tools and --strict-mcp-config drops every configured MCP server, so no write tool exists whatever permission mode the settings carry; verified on 2.1.175 and 2.1.268. --permission-mode plan does not qualify: its shell commands run through the auto mode classifier, which let a file write through."
 	};
 	mcpConfigs = [{
 		path: "~/.claude.json",
@@ -691,20 +810,27 @@ var Codex = class extends Harness {
 	commands = [];
 	hooks = [];
 	invocation = {
-		args: ["exec", "{prompt}"],
+		args: [
+			"exec",
+			"--skip-git-repo-check",
+			"{prompt}"
+		],
 		jsonArgs: [
 			"exec",
+			"--skip-git-repo-check",
 			"--json",
 			"{prompt}"
 		],
 		readOnlyArgs: [
 			"exec",
+			"--skip-git-repo-check",
 			"--sandbox",
 			"read-only",
 			"{prompt}"
 		],
 		readOnlyJsonArgs: [
 			"exec",
+			"--skip-git-repo-check",
 			"--sandbox",
 			"read-only",
 			"--json",
@@ -1069,7 +1195,7 @@ var Gemini = class extends Harness {
 var GitHubCopilot = class extends Harness {
 	id = "github-copilot";
 	name = "GitHub Copilot";
-	binaries = [];
+	binaries = ["copilot"];
 	capabilities = {
 		mcp: true,
 		vision: true,
@@ -1247,9 +1373,24 @@ var Grok = class extends Harness {
 			"--output-format",
 			"json"
 		],
+		readOnlyArgs: [
+			"-p",
+			"{prompt}",
+			"--sandbox",
+			"read-only"
+		],
+		readOnlyJsonArgs: [
+			"-p",
+			"{prompt}",
+			"--sandbox",
+			"read-only",
+			"--output-format",
+			"json"
+		],
+		readOnlyMinVersion: "1.0.13",
 		modelArgs: ["--model", "{model}"],
 		level: "official",
-		note: "-p is short for --single; add --output-format json for structured output."
+		note: "-p is short for --single; add --output-format json for structured output. --sandbox read-only is kernel-enforced (Landlock, Seatbelt) regardless of the inherited permission mode and still allows writes to ~/.grok and temp dirs; verified on Linux with 1.0.13 and 1.0.25."
 	};
 	mcpConfigs = [{
 		path: "~/.grok/config.toml",
@@ -1576,21 +1717,9 @@ var Omp = class extends Harness {
 			"json",
 			"{prompt}"
 		],
-		noToolsArgs: [
-			"-p",
-			"--no-tools",
-			"{prompt}"
-		],
-		noToolsJsonArgs: [
-			"-p",
-			"--no-tools",
-			"--mode",
-			"json",
-			"{prompt}"
-		],
 		modelArgs: ["--model={model}"],
 		level: "official",
-		note: "Add --mode json for structured event output."
+		note: "Add --mode json for structured event output. --no-tools disables only OMP's bundled tools, so it cannot provide an advisor mode without tools."
 	};
 	mcpConfigs = [{
 		path: "~/.omp/agent/mcp.json",
@@ -1767,16 +1896,37 @@ const MODEL_HEADERS = [
 	"thinking",
 	"images"
 ];
-function parseTokenCount(value) {
+function parseTokenCount(value, harness) {
 	const match = /^(\d+(?:\.\d+)?)([KM])?$/.exec(value);
-	if (!match?.[1]) throw new Error(`Invalid Pi token count: ${JSON.stringify(value)}`);
+	if (!match?.[1]) throw new Error(`Invalid ${harness} token count: ${JSON.stringify(value)}`);
 	const multiplier = match[2] === "M" ? 1e6 : match[2] === "K" ? 1e3 : 1;
 	return Number(match[1]) * multiplier;
 }
-function parseBoolean(value, column) {
+function parseBoolean(value, column, harness) {
 	if (value === "yes") return true;
 	if (value === "no") return false;
-	throw new Error(`Invalid Pi ${column} value: ${JSON.stringify(value)}`);
+	throw new Error(`Invalid ${harness} ${column} value: ${JSON.stringify(value)}`);
+}
+function parsePiModelTable(stdout, harness) {
+	const lines = stripVTControlCharacters(stdout).split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	const first = lines[0];
+	if (!first) throw new Error(`Unexpected empty ${harness} model-list output`);
+	if (first.startsWith("No models available.") || first.startsWith("No models matching ")) return [];
+	const headers = first.split(/\s{2,}/);
+	if (headers.length !== MODEL_HEADERS.length || headers.some((value, i) => value !== MODEL_HEADERS[i])) throw new Error(`Unexpected ${harness} model-list header: ${JSON.stringify(first)}`);
+	return lines.slice(1).map((line) => {
+		const columns = line.split(/\s{2,}/);
+		const [provider, id, context, maxOutput, thinking, images] = columns;
+		if (columns.length !== MODEL_HEADERS.length || !provider || !id || !context || !maxOutput || !thinking || !images) throw new Error(`Unexpected ${harness} model-list row: ${JSON.stringify(line)}`);
+		return {
+			provider,
+			id,
+			contextWindow: parseTokenCount(context, harness),
+			maxOutputTokens: parseTokenCount(maxOutput, harness),
+			thinking: parseBoolean(thinking, "thinking", harness),
+			images: parseBoolean(images, "images", harness)
+		};
+	});
 }
 var Pi = class extends Harness {
 	id = "pi";
@@ -1883,6 +2033,20 @@ var Pi = class extends Harness {
 			"json",
 			"{prompt}"
 		],
+		readOnlyArgs: [
+			"-p",
+			"--tools",
+			"read,grep,find,ls",
+			"{prompt}"
+		],
+		readOnlyJsonArgs: [
+			"-p",
+			"--tools",
+			"read,grep,find,ls",
+			"--mode",
+			"json",
+			"{prompt}"
+		],
 		modelArgs: ["--model", "{model}"],
 		level: "official",
 		note: "Add --mode json for structured event output."
@@ -1903,25 +2067,172 @@ var Pi = class extends Harness {
 		projectMarkers: [".pi"]
 	};
 	parseModelListingOutput(stdout) {
-		const lines = stripVTControlCharacters(stdout).split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-		const first = lines[0];
-		if (!first) throw new Error("Unexpected empty Pi model-list output");
-		if (first.startsWith("No models available.") || first.startsWith("No models matching ")) return [];
-		const headers = first.split(/\s{2,}/);
-		if (headers.length !== MODEL_HEADERS.length || headers.some((value, i) => value !== MODEL_HEADERS[i])) throw new Error(`Unexpected Pi model-list header: ${JSON.stringify(first)}`);
-		return lines.slice(1).map((line) => {
-			const columns = line.split(/\s{2,}/);
-			const [provider, id, context, maxOutput, thinking, images] = columns;
-			if (columns.length !== MODEL_HEADERS.length || !provider || !id || !context || !maxOutput || !thinking || !images) throw new Error(`Unexpected Pi model-list row: ${JSON.stringify(line)}`);
-			return {
-				provider,
-				id,
-				contextWindow: parseTokenCount(context),
-				maxOutputTokens: parseTokenCount(maxOutput),
-				thinking: parseBoolean(thinking, "thinking"),
-				images: parseBoolean(images, "images")
-			};
-		});
+		return parsePiModelTable(stdout, "Pi");
+	}
+};
+var PrimeAgent = class extends Harness {
+	id = "prime-agent";
+	name = "Prime Agent";
+	binaries = ["prime-agent"];
+	capabilities = {
+		mcp: true,
+		vision: true,
+		audio: false,
+		video: false,
+		tools: true,
+		streaming: true
+	};
+	config = [{
+		path: "~/.prime/agent/settings.json",
+		scope: "user",
+		level: "official",
+		note: "Config dir overridable with PRIME_AGENT_CODING_AGENT_DIR."
+	}, {
+		path: ".prime/agent/settings.json",
+		scope: "project",
+		level: "official"
+	}];
+	sessions = [{
+		path: "~/.prime/agent/sessions/<session-id>.jsonl",
+		scope: "data",
+		level: "official",
+		note: "Flat directory of JSONL transcripts whose header records the working directory; session ids are UUIDv7. Overridable with PRIME_AGENT_SESSION_DIR or --session-dir."
+	}, {
+		path: "~/.prime/agent/session-artifacts/<session-id>/",
+		scope: "data",
+		level: "official",
+		note: "Per-session Python kernel state, scheduled jobs, harness state and child session transcripts under sub-<id>/."
+	}];
+	persistence = [
+		{
+			format: "JSON",
+			level: "official",
+			note: "Settings, auth, telemetry, model cache and session artifact state files."
+		},
+		{
+			format: "JSONL",
+			level: "official",
+			note: "Session transcripts, the RLM spawn ledger and structured logs."
+		},
+		{
+			format: "dill",
+			level: "official",
+			note: "Pickled Python REPL state (kernel-state.dill) in session artifacts."
+		}
+	];
+	instructions = [
+		{
+			path: "AGENTS.md",
+			scope: "project",
+			level: "official",
+			note: "Loaded from parent directories and cwd; CLAUDE.md accepted as an alternative."
+		},
+		{
+			path: ".prime/agent/SYSTEM.md",
+			scope: "project",
+			level: "official",
+			note: "Replaces the default system prompt; APPEND_SYSTEM.md appends instead."
+		},
+		{
+			path: "~/.prime/agent/AGENTS.md",
+			scope: "user",
+			level: "official",
+			note: "Global user-level instructions; CLAUDE.md accepted as an alternative."
+		},
+		{
+			path: "~/.prime/agent/SYSTEM.md",
+			scope: "user",
+			level: "official",
+			note: "Global system prompt replacement; APPEND_SYSTEM.md appends instead."
+		}
+	];
+	skills = [
+		{
+			path: ".prime/agent/skills/",
+			scope: "project",
+			level: "official"
+		},
+		{
+			path: ".agents/skills/",
+			scope: "project",
+			level: "official",
+			note: "Also scanned in ancestor directories up to the Git repository root; root .md files are ignored there."
+		},
+		{
+			path: "~/.prime/agent/skills/",
+			scope: "user",
+			level: "official",
+			note: "Global user-level skills."
+		},
+		{
+			path: "~/.agents/skills/",
+			scope: "user",
+			level: "official",
+			note: "Shared skills directory; root .md files are ignored there."
+		}
+	];
+	commands = [{
+		path: ".prime/agent/prompts/",
+		scope: "project",
+		level: "official",
+		note: "Prompt templates invoked as slash commands."
+	}, {
+		path: "~/.prime/agent/prompts/",
+		scope: "user",
+		level: "official",
+		note: "Global user-level prompt templates."
+	}];
+	hooks = [];
+	invocation = {
+		args: ["-p", "{prompt}"],
+		jsonArgs: [
+			"-p",
+			"--mode",
+			"json",
+			"{prompt}"
+		],
+		noToolsArgs: [
+			"-p",
+			"--no-tools",
+			"{prompt}"
+		],
+		noToolsJsonArgs: [
+			"-p",
+			"--no-tools",
+			"--mode",
+			"json",
+			"{prompt}"
+		],
+		modelArgs: ["--model", "{model}"],
+		level: "official",
+		note: "Add --mode json for structured event output. No read-only mode: the only built-in tool is a Python REPL and the worker and kernel processes are not a security sandbox."
+	};
+	modelListing = {
+		args: ["model", "list"],
+		searchArgs: [
+			"model",
+			"list",
+			"{search}"
+		],
+		level: "official",
+		note: "Lists models with configured provider authentication; accepts an optional fuzzy search. --list-models was removed."
+	};
+	mcpConfigs = [{
+		path: "~/.prime/agent/settings.json",
+		scope: "user",
+		level: "official",
+		format: "json",
+		key: ["mcpServers"],
+		dialect: "prime",
+		note: "prime-agent mcp add/remove manage this map; project settings entries are ignored for execution. Stdio env values are {\"env\": \"NAME\"} references, written from \"${NAME}\" values; literals are refused because the kernel rejects them at connect time."
+	}];
+	agentsFile = "~/.prime/agent/AGENTS.md";
+	detection = {
+		envVars: ["PRIME_AGENT_KERNEL_OWNER_PID"],
+		projectMarkers: [".prime/agent"]
+	};
+	parseModelListingOutput(stdout) {
+		return parsePiModelTable(stdout, "Prime Agent");
 	}
 };
 const harnesses = [
@@ -1936,6 +2247,7 @@ const harnesses = [
 	MastraCode,
 	Omp,
 	OpenCode,
+	PrimeAgent,
 	Pi
 ];
 let registry;
@@ -2079,9 +2391,30 @@ function normalizeStandard(name, raw) {
 		enabled: booleanField(raw, "enabled")
 	});
 }
+const ENV_REFERENCE = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/;
+var McpEnvError = class extends Error {
+	name = "McpEnvError";
+};
+function envReference(value) {
+	return ENV_REFERENCE.exec(value)?.[1];
+}
+function primeEnv(value) {
+	if (!isObjectRecord(value) || Array.isArray(value)) return void 0;
+	const out = {};
+	for (const [key, raw] of Object.entries(value)) if (typeof raw === "string") out[key] = raw;
+	else if (isObjectRecord(raw) && typeof raw.env === "string") out[key] = `\${${raw.env}}`;
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+function normalizePrime(name, raw) {
+	return compact({
+		...normalizeStandard(name, raw),
+		env: primeEnv(raw.env)
+	});
+}
 function normalizeEntry(name, raw, dialect) {
 	if (dialect === "antigravity") return normalizeAntigravity(name, raw);
 	if (dialect === "opencode") return normalizeOpenCode(name, raw);
+	if (dialect === "prime") return normalizePrime(name, raw);
 	return normalizeStandard(name, raw);
 }
 function denormalizeAntigravity(server) {
@@ -2117,9 +2450,44 @@ function denormalizeStandard(server) {
 		enabled: server.enabled
 	});
 }
+function denormalizePrime(server) {
+	const env = server.env ? Object.fromEntries(Object.entries(server.env).map(([key, value]) => [key, { env: requirePrimeReference(server, key, value) }])) : void 0;
+	return compact({
+		...denormalizeStandard(server),
+		env
+	});
+}
+function requirePrimeReference(server, key, value) {
+	const reference = envReference(value);
+	if (reference === void 0) throw new McpEnvError(`${server.name}: Prime Agent takes only environment references in env; write ${key} as "\${NAME}" and export NAME where prime-agent runs`);
+	return reference;
+}
+function resolveEnvReferences(server, dialect) {
+	if (!server.env) return server;
+	if (dialect === "prime") {
+		for (const [key, value] of Object.entries(server.env)) requirePrimeReference(server, key, value);
+		return server;
+	}
+	const env = {};
+	for (const [key, value] of Object.entries(server.env)) {
+		const reference = envReference(value);
+		if (reference === void 0) {
+			env[key] = value;
+			continue;
+		}
+		const resolved = Object.hasOwn(process.env, reference) ? process.env[reference] : void 0;
+		if (typeof resolved !== "string") throw new McpEnvError(`${server.name}: env ${key} references ${reference}, which is not set in this environment`);
+		env[key] = resolved;
+	}
+	return {
+		...server,
+		env
+	};
+}
 function denormalizeEntry(server, dialect) {
 	if (dialect === "antigravity") return denormalizeAntigravity(server);
 	if (dialect === "opencode") return denormalizeOpenCode(server);
+	if (dialect === "prime") return denormalizePrime(server);
 	return denormalizeStandard(server);
 }
 function listingBase(entry, path) {
@@ -2256,15 +2624,16 @@ function removeTomlServer(path, key, name) {
 }
 function addMcpServer(harness, server, scope = "user", options = {}) {
 	const { entry, path } = writableConfig(harness, scope, options);
+	const resolved = resolveEnvReferences(server, entry.dialect);
 	if (entry.format === "toml") return {
 		path,
-		replaced: addTomlServer(path, entry.key, server)
+		replaced: addTomlServer(path, entry.key, resolved)
 	};
 	const root = JSON.parse(readIfExists$1(path) ?? "{}");
 	const map = drill(root, entry.key, "create");
 	if (!map) throw new Error(`Config at ${path} has a non-object at ${entry.key.join(".")}`);
 	const replaced = Object.hasOwn(map, server.name);
-	map[server.name] = denormalizeEntry(server, entry.dialect);
+	map[server.name] = denormalizeEntry(resolved, entry.dialect);
 	writeAtomically(path, `${JSON.stringify(root, null, 2)}\n`);
 	return {
 		path,
@@ -2406,7 +2775,7 @@ function canonical(server) {
 	return JSON.stringify(Object.fromEntries(Object.entries(server).sort(([a], [b]) => a.localeCompare(b))));
 }
 function expandHome(value, home) {
-	return value.replace(/^~(?=\/|$)/, home).replaceAll("${HOME}", home);
+	return value.replaceAll(/^~(?=\/|$)|\$\{HOME\}/g, () => home);
 }
 function expandServerHome(server, home) {
 	return compact({
@@ -2473,20 +2842,29 @@ function withdrawMasterServersFromExcludedHarness(harness, existing, masterNames
 function syncIncludedHarness(harness, master, existing, masterNames, initialPath, options) {
 	const results = [];
 	let path = initialPath;
-	for (const server of master.servers) {
-		if (existing.get(server.name) === canonical(server)) {
+	const { dialect } = writableConfig(harness, "user", options).entry;
+	for (const server of master.servers) try {
+		const resolved = resolveEnvReferences(server, dialect);
+		if (existing.get(server.name) === canonical(resolved)) {
 			results.push({
 				name: server.name,
 				action: "unchanged"
 			});
 			continue;
 		}
-		const written = addMcpServer(harness, server, "user", options);
+		const written = addMcpServer(harness, resolved, "user", options);
 		path = written.path;
 		results.push({
 			name: server.name,
 			action: written.replaced ? "replaced" : "added"
 		});
+	} catch (error) {
+		if (!(error instanceof McpEnvError)) throw error;
+		results.push({
+			name: server.name,
+			action: "skipped",
+			reason: error.message
+		});
 	}
 	for (const name of existing.keys()) {
 		if (masterNames.has(name)) continue;
@@ -2544,8 +2922,9 @@ function agentsConfigRecord(raw, configPath) {
 	if (typeof parsed !== "object" || parsed === null) throw new Error(`Agents config at ${configPath} is not an object`);
 	return parsed;
 }
-function agentsSource(value, defaultSource, options) {
-	if (typeof value !== "string") return defaultSource;
+function agentsSource(value, defaultSource, options, configPath) {
+	if (value === void 0) return defaultSource;
+	if (typeof value !== "string" || value.length === 0) throw new Error(`Agents config at ${configPath} has an invalid source: expected a path string`);
 	const expanded = resolvePathTemplate(value, options);
 	return isAbsolute(expanded) ? expanded : join(agntnConfigDir(options), expanded);
 }
@@ -2555,9 +2934,9 @@ function agentsExcludes(value, configPath) {
 	return value;
 }
 function companionPath(value, configPath) {
-	const normalized = normalize(value);
-	if (normalized === "." || normalized === ".." || normalized.startsWith(`..${sep}`) || isAbsolute(normalized)) throw new Error(`Agents config at ${configPath} has an unsafe companion path: ${JSON.stringify(normalized)}`);
-	return normalized.endsWith(sep) ? normalized.slice(0, -sep.length) : normalized;
+	const normalized = posix.normalize(value.replaceAll("\\", "/"));
+	if (normalized === "." || normalized === ".." || normalized.startsWith("../") || posix.isAbsolute(normalized) || win32.parse(value).root !== "") throw new Error(`Agents config at ${configPath} has an unsafe companion path: ${JSON.stringify(normalized)}`);
+	return normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
 }
 function comparablePath(path) {
 	return resolve(path).toLowerCase();
@@ -2581,7 +2960,7 @@ function readAgentsConfig(options = {}) {
 	if (raw === null) return defaults;
 	const record = agentsConfigRecord(raw, configPath);
 	return {
-		source: agentsSource(record.source, defaults.source, options),
+		source: agentsSource(record.source, defaults.source, options, configPath),
 		companions: agentsCompanions(record.companions, configPath),
 		excludes: agentsExcludes(record.excludes, configPath),
 		configPath
@@ -2714,6 +3093,6 @@ function syncAgentsFiles(harnesses, check = false, options = {}) {
 		targets: harnesses.map((harness) => syncTarget(harness, config, check, options))
 	};
 }
-export { Harness, addMcpServer, detectHarness, detectHarnessFromEnv, detectProjectHarnesses, getAllHarnesses, getHarness, isHarnessId, listHarnesses, listMcpServers, masterMcpPath, parseJsonc, readAgentsConfig, readMasterMcpServers, registerHarness, removeMcpServer, resolvePathTemplate, syncAgentsFiles, syncMcpServers };
+export { Harness, McpEnvError, addMcpServer, detectHarness, detectHarnessFromEnv, detectProjectHarnesses, getAllHarnesses, getHarness, isHarnessId, listHarnesses, listMcpServers, masterMcpPath, parseJsonc, readAgentsConfig, readMasterMcpServers, registerHarness, removeMcpServer, resolvePathTemplate, syncAgentsFiles, syncMcpServers };
 
 //# sourceMappingURL=agents-sync.mjs.map