@ai-sdk/harness 0.0.0-6b196531-20260710185421

package/dist/index.d.ts

@@ -0,0 +1,1587 @@
+import * as _ai_sdk_provider_utils from '@ai-sdk/provider-utils';
+import { Experimental_SandboxSession, UserModelMessage, ToolSet, FlexibleSchema, Tool } from '@ai-sdk/provider-utils';
+import { z } from 'zod/v4';
+import * as _ai_sdk_provider from '@ai-sdk/provider';
+import { JSONValue, LanguageModelV4ToolCall, LanguageModelV4ToolApprovalRequest, LanguageModelV4ToolResult, LanguageModelV4FinishReason, LanguageModelV4Usage, SharedV4ProviderMetadata, JSONSchema7, AISDKError } from '@ai-sdk/provider';
+
+/**
+ * One file to write into the sandbox as part of an adapter's bootstrap recipe.
+ * Paths should live under {@link HarnessV1Bootstrap.bootstrapDir}.
+ */
+interface HarnessV1BootstrapFile {
+    readonly path: string;
+    readonly content: string;
+}
+/**
+ * One command to run in the sandbox as part of an adapter's bootstrap recipe.
+ * Commands run sequentially after all files have been written; a non-zero exit
+ * aborts the bootstrap.
+ */
+interface HarnessV1BootstrapCommand {
+    readonly command: string;
+    readonly workingDirectory?: string;
+}
+/**
+ * Adapter-owned bootstrap recipe. The adapter declares the files and commands
+ * needed to set up its bridge inside any sandbox. The harness framework hashes
+ * the recipe into an identity used by sandbox providers for snapshot-based
+ * reuse, and applies the recipe idempotently before the bridge spawns.
+ */
+interface HarnessV1Bootstrap {
+    /**
+     * Stable id of the adapter that owns this recipe. Conventionally matches
+     * {@link HarnessV1.harnessId}. Contributes to the recipe hash.
+     */
+    readonly harnessId: string;
+    /**
+     * Absolute path inside the sandbox where this recipe writes its state.
+     * The marker file lives directly under it. Files declared in {@link files}
+     * should also use this prefix so an adapter upgrade can sweep stale state
+     * by clearing the directory.
+     */
+    readonly bootstrapDir: string;
+    /** Files to write into the sandbox before any command runs. */
+    readonly files: ReadonlyArray<HarnessV1BootstrapFile>;
+    /** Commands to run after files are written, in order. */
+    readonly commands: ReadonlyArray<HarnessV1BootstrapCommand>;
+}
+
+/**
+ * Network sandbox session returned by `HarnessV1SandboxProvider.createSession()`. The
+ * harness keeps this for the lifetime of a session. It is itself a
+ * {@link SandboxSession} (file I/O, exec, spawn) and adds the infra surface on
+ * top: port resolution, lifecycle, and network-policy mutation.
+ *
+ * Code that should only touch the filesystem and spawn processes receives the
+ * reduced view from {@link HarnessV1NetworkSandboxSession.restricted}, never the
+ * network sandbox session itself — so it cannot stop the sandbox or change its
+ * network policy.
+ */
+interface HarnessV1NetworkSandboxSession extends Experimental_SandboxSession {
+    /**
+     * Stable identifier for the underlying sandbox resource. Used by the
+     * harness session manager as the durable lookup key for cross-process
+     * resume — the framework persists this on lifecycle state so a future
+     * process can call `HarnessV1SandboxProvider.resume?({ sessionId })` and
+     * reach the same resource. Providers populate it from their native
+     * identifier (Vercel: the sandbox name; just-bash: a UUID minted at
+     * create time).
+     */
+    readonly id: string;
+    /**
+     * The sandbox's default working directory — the absolute path that
+     * `run`/`spawn` resolve relative commands against when no `workingDirectory`
+     * is given. Read from the live sandbox (it is provider-specific and
+     * configurable at create time: Vercel defaults to `/vercel/sandbox`,
+     * just-bash to `/home/user`), never hardcoded.
+     *
+     * The framework composes each session's working directory underneath this
+     * path (`<defaultWorkingDirectory>/<harnessId>-<sessionId>`) so adapters do
+     * not bake a provider-specific base into their own paths.
+     */
+    readonly defaultWorkingDirectory: string;
+    /** Ports the sandbox exposes; resolvable to public URLs via `getPortUrl`. */
+    readonly ports: ReadonlyArray<number>;
+    /**
+     * Resolve a publicly-reachable URL for a sandbox-exposed port. Bridge-backed
+     * adapters call this to open their WebSocket to the in-sandbox bridge.
+     */
+    readonly getPortUrl: (options: {
+        port: number;
+        protocol?: 'http' | 'https' | 'ws';
+    }) => PromiseLike<string>;
+    /** Stop the sandbox. Idempotent. */
+    readonly stop: () => PromiseLike<void>;
+    /**
+     * Destroy/delete the sandbox resource when supported. Optional because some
+     * providers only have a stop/dispose concept. Implementations must handle
+     * both a still-running sandbox and a previously stopped sandbox.
+     */
+    readonly destroy?: () => PromiseLike<void>;
+    /**
+     * Update the sandbox's outbound network policy. Optional — implementations
+     * without a local enforcement primitive (e.g. just-bash) omit this. Callers
+     * use optional-call (`sandboxSession.setNetworkPolicy?.(policy)`); a
+     * missing implementation is a no-op.
+     */
+    readonly setNetworkPolicy?: (policy: HarnessV1NetworkPolicy) => PromiseLike<void>;
+    /**
+     * Replace the set of ports exposed by the sandbox. Full-replacement
+     * semantics: ports omitted from the array are deregistered. Optional —
+     * implementations that cannot expose ports (e.g. just-bash) omit this.
+     */
+    readonly setPorts?: (ports: ReadonlyArray<number>, options?: {
+        abortSignal?: AbortSignal;
+    }) => PromiseLike<void>;
+    /**
+     * Reduced view of this session, typed as the bare {@link SandboxSession}
+     * (file I/O, exec, spawn) — nothing that could stop the sandbox or change
+     * its network policy. Pass this to user-tool `execute()` calls and other
+     * code that must not reach the infra surface.
+     *
+     * The returned object points at exactly the same underlying sandbox
+     * resource as the network sandbox session it was produced from; it is only a
+     * narrower surface over the same resource, not a separate sandbox.
+     */
+    readonly restricted: () => Experimental_SandboxSession;
+}
+/**
+ * Outbound network policy applied by the sandbox runtime.
+ *
+ * `'allow-all'` and `'deny-all'` are convenience presets. `'custom'` is an
+ * allow-list with an optional CIDR deny-list that takes precedence:
+ *
+ * - Reachable hosts are the union of `allowedHosts` and `allowedCIDRs`.
+ * - `deniedCIDRs` wins over both, useful for blocking cloud-metadata IPs while
+ *   otherwise allowing broad access.
+ *
+ * The two `'custom'` branches share the same discriminator but each requires
+ * a different allow field. Specifying `'custom'` with only `deniedCIDRs`
+ * (deny-only) is rejected at compile time — functionally it would be
+ * equivalent to `'deny-all'`.
+ */
+type HarnessV1NetworkPolicy = {
+    mode: 'allow-all';
+} | {
+    mode: 'deny-all';
+} | {
+    mode: 'custom';
+    allowedHosts: ReadonlyArray<string>;
+    allowedCIDRs?: ReadonlyArray<string>;
+    deniedCIDRs?: ReadonlyArray<string>;
+} | {
+    mode: 'custom';
+    allowedHosts?: ReadonlyArray<string>;
+    allowedCIDRs: ReadonlyArray<string>;
+    deniedCIDRs?: ReadonlyArray<string>;
+};
+
+/** Severity of a diagnostic, ordered most → least severe. */
+declare const harnessV1DebugLevelSchema: z.ZodEnum<{
+    error: "error";
+    warn: "warn";
+    info: "info";
+    debug: "debug";
+    trace: "trace";
+}>;
+type HarnessV1DebugLevel = z.infer<typeof harnessV1DebugLevelSchema>;
+/**
+ * Per-session diagnostics configuration the framework hands an adapter (and the
+ * host sends on `start.debug`). When absent or `enabled` is false the adapter
+ * captures and emits nothing. `subsystems` filters structured events by dotted
+ * prefix; console capture is independent of the subsystem filter.
+ */
+declare const harnessV1DebugConfigSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    level: z.ZodOptional<z.ZodEnum<{
+        error: "error";
+        warn: "warn";
+        info: "info";
+        debug: "debug";
+        trace: "trace";
+    }>>;
+    subsystems: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type HarnessV1DebugConfig = z.infer<typeof harnessV1DebugConfigSchema>;
+/**
+ * A diagnostic as emitted by a harness adapter. Structurally identical to the
+ * host-facing `HarnessDiagnostic` today, but kept separate: this is the spec's
+ * emission shape, that is the external consumption shape.
+ */
+type HarnessV1Diagnostic = {
+    /** Severity. */
+    readonly level: HarnessV1DebugLevel;
+    /** Human-readable line (console capture) or message (structured event). */
+    readonly message: string;
+    /** Dotted subsystem (`sandbox.log.<source>` for console capture). */
+    readonly subsystem: string;
+    /** `'log'` = captured console line; `'event'` = structured emission. */
+    readonly kind: 'log' | 'event';
+    /** Originating source label (console capture). */
+    readonly source?: string;
+    /** Which standard stream the line came from (console capture). */
+    readonly stream?: 'stdout' | 'stderr';
+    /** Structured attributes (structured events only). */
+    readonly attrs?: Record<string, unknown>;
+    /** Error payload (structured events only). */
+    readonly error?: {
+        name?: string;
+        message: string;
+        stack?: string;
+    };
+    /** The harness session this diagnostic originated from. */
+    readonly sessionId?: string;
+    /** Emission time (epoch ms). */
+    readonly timestamp: number;
+};
+
+/**
+ * Diagnostics wiring the framework hands to an adapter's `doStart`. `report` is
+ * the general emission sink: a bridge adapter normalizes each wire frame into a
+ * `HarnessV1Diagnostic` (via `harnessV1DiagnosticFromBridgeFrame`) and calls it;
+ * a non-bridge adapter constructs a `HarnessV1Diagnostic` from its host-side
+ * logs/errors and calls it directly. `debug` gates what the adapter emits.
+ * Absent when the consumer has not enabled diagnostics.
+ */
+type HarnessV1Observability = {
+    /** Per-session debug config gating what the adapter captures/emits. */
+    readonly debug?: HarnessV1DebugConfig;
+    /** General emission sink — any adapter reports a `HarnessV1Diagnostic` here. */
+    readonly report?: (diagnostic: HarnessV1Diagnostic) => void;
+};
+
+/**
+ * Baseline permission mode for adapter-native built-in tools.
+ *
+ * Custom host-executed tools are not controlled by this setting. They use
+ * `HarnessAgentSettings.toolApproval`, similar to AI SDK's per-tool approval
+ * status map.
+ */
+type HarnessV1PermissionMode = 'allow-reads' | 'allow-edits' | 'allow-all';
+
+/**
+ * Prompt shape passed to `HarnessV1Session.doPromptTurn`.
+ *
+ * A harness session represents an ongoing third-party agent runtime that
+ * owns its own conversation history. Each prompt turn carries only the
+ * fresh user input for that turn, either as a plain string or as a single
+ * `UserModelMessage`.
+ */
+type HarnessV1Prompt = string | UserModelMessage;
+
+/**
+ * Bidirectional control surface returned by `doPromptTurn`.
+ *
+ * The host uses these methods to feed asynchronous responses back to the
+ * adapter while a turn is running. All methods are optional except those
+ * the adapter actively supports (host-executed tools require
+ * `submitToolResult`; approvals require `submitToolApproval`; mid-turn
+ * messages require `submitUserMessage`).
+ */
+type HarnessV1PromptControl = {
+    /**
+     * Provide a result for a `tool-call` the adapter emitted. The adapter
+     * forwards the result to the underlying runtime so the model can continue.
+     */
+    submitToolResult(input: {
+        toolCallId: string;
+        output: unknown;
+        isError?: boolean;
+    }): PromiseLike<void>;
+    /**
+     * Respond to a `tool-approval-request` the adapter emitted.
+     */
+    submitToolApproval?(input: {
+        approvalId: string;
+        approved: boolean;
+        reason?: string;
+    }): PromiseLike<void>;
+    /**
+     * Inject a fresh user message into a turn that is still in flight.
+     * Supported only by runtimes that accept interactive input.
+     */
+    submitUserMessage?(text: string): PromiseLike<void>;
+    /**
+     * Resolves when the adapter has finished the turn (success or failure).
+     * Rejects with the underlying error when the turn fails.
+     */
+    readonly done: PromiseLike<void>;
+};
+
+type HarnessV1PendingToolApproval = {
+    readonly approvalId: string;
+    readonly toolCallId: string;
+    readonly toolName: string;
+    readonly input: string;
+    readonly kind: 'builtin' | 'custom';
+    readonly providerExecuted?: boolean;
+    readonly nativeName?: string;
+};
+type HarnessV1LifecycleStateBase = {
+    /**
+     * Identifier of the harness that produced this state. Used by adapters to
+     * refuse mismatched payloads.
+     */
+    readonly harnessId: string;
+    /**
+     * Spec version of the harness that produced this state.
+     */
+    readonly specificationVersion: 'harness-v1';
+    /**
+     * Adapter-defined payload. May be persisted as JSON; the adapter is
+     * responsible for any necessary encoding.
+     */
+    readonly data: JSONValue;
+};
+/**
+ * Opaque payload returned by between-turn session lifecycle methods and
+ * accepted by a future `HarnessV1.doStart({ resumeFrom })` to resume the same
+ * underlying session before starting a new turn.
+ */
+type HarnessV1ResumeSessionState = HarnessV1LifecycleStateBase & {
+    readonly type: 'resume-session';
+    /**
+     * Optional unfinished-turn state. When present, the session must be resumed
+     * before the turn is continued.
+     */
+    readonly continueFrom?: HarnessV1ContinueTurnState;
+};
+/**
+ * Opaque payload returned by `doSuspendTurn` and accepted by a future
+ * `HarnessV1.doStart({ continueFrom })` to reconnect to the same session before
+ * continuing the interrupted turn.
+ */
+type HarnessV1ContinueTurnState = HarnessV1LifecycleStateBase & {
+    readonly type: 'continue-turn';
+    /**
+     * Framework-owned pending approval records. These are intentionally outside
+     * adapter-defined `data` so callers can persist the entire lifecycle payload
+     * without the harness framework owning storage.
+     */
+    readonly pendingToolApprovals?: readonly HarnessV1PendingToolApproval[];
+};
+type HarnessV1LifecycleState = HarnessV1ResumeSessionState | HarnessV1ContinueTurnState;
+
+/**
+ * A self-contained instruction bundle the underlying runtime can load into
+ * its context. Adapters decide how to surface skills to the runtime.
+ */
+type HarnessV1Skill = {
+    /** Stable identifier for the skill (kebab-case slug). */
+    readonly name: string;
+    /**
+     * Short, model-facing description. This is what the runtime sees to
+     * decide whether the skill is relevant.
+     */
+    readonly description: string;
+    /** Full skill content the model loads when the skill is active. */
+    readonly content: string;
+    /**
+     * Additional files that belong to this skill. Adapters with native skill
+     * directories materialize these next to `SKILL.md`; adapters without native
+     * skill files include them with the skill content.
+     */
+    readonly files?: ReadonlyArray<HarnessV1SkillFile>;
+};
+type HarnessV1SkillFile = {
+    /**
+     * Skill-relative POSIX path, for example `reference.md` or
+     * `references/codes.md`. Absolute paths and `..` segments are rejected by
+     * adapters before writing.
+     */
+    readonly path: string;
+    /** UTF-8 text content for the file. */
+    readonly content: string;
+};
+
+/**
+ * Warning emitted by a harness adapter during a call.
+ *
+ * Surfaces non-fatal issues such as unsupported options or quirks of the
+ * underlying agent runtime. Mirrors the shape of `SharedV4Warning` but lives
+ * in the harness namespace.
+ */
+type HarnessV1CallWarning = {
+    type: 'unsupported-setting';
+    setting: string;
+    details?: string;
+} | {
+    type: 'unsupported-tool';
+    tool: string;
+    details?: string;
+} | {
+    type: 'other';
+    message: string;
+};
+
+/**
+ * Adapter-namespaced opaque data attached to harness events.
+ *
+ * Mirrors the `providerMetadata` pattern from `@ai-sdk/provider`, but lives
+ * in the harness namespace because a harness is a peer concept to a
+ * provider, not a kind of provider.
+ *
+ * Keys are harness ids (e.g. `'claude-code'`). Inner values are arbitrary
+ * JSON-serializable data the adapter chooses to surface to callers.
+ */
+type HarnessV1Metadata = Record<string, Record<string, JSONValue>>;
+
+/**
+ * One event emitted by a harness adapter during a prompt turn.
+ *
+ * Mirrors `LanguageModelV4StreamPart` on the variants it shares so a
+ * `HarnessAgent` can pipe events through to AI SDK consumers with minimal
+ * translation. Primitive types from the V4 spec (`LanguageModelV4ToolCall`,
+ * `LanguageModelV4ToolResult`, `LanguageModelV4ToolApprovalRequest`,
+ * `LanguageModelV4Usage`, `LanguageModelV4FinishReason`) are reused
+ * verbatim — type-compat tests assert this stays the case.
+ *
+ * The metadata field is named `harnessMetadata` (not `providerMetadata`)
+ * because a harness is a peer to a provider, not a kind of provider. The
+ * agent rebinds it when forwarding to AI SDK consumers.
+ */
+type HarnessV1StreamPart = {
+    type: 'stream-start';
+    warnings?: ReadonlyArray<HarnessV1CallWarning>;
+    /**
+     * The model the runtime actually resolved to for this turn, when the
+     * adapter learns it at stream start (e.g. Claude Code's `init` message
+     * reports the resolved/default model). Surfaced into telemetry as
+     * `gen_ai.request.model`. Omitted when the adapter doesn't know it here.
+     */
+    modelId?: string;
+} | {
+    type: 'text-start';
+    id: string;
+    harnessMetadata?: HarnessV1Metadata;
+} | {
+    type: 'text-delta';
+    id: string;
+    delta: string;
+    harnessMetadata?: HarnessV1Metadata;
+} | {
+    type: 'text-end';
+    id: string;
+    harnessMetadata?: HarnessV1Metadata;
+} | {
+    type: 'reasoning-start';
+    id: string;
+    harnessMetadata?: HarnessV1Metadata;
+} | {
+    type: 'reasoning-delta';
+    id: string;
+    delta: string;
+    harnessMetadata?: HarnessV1Metadata;
+} | {
+    type: 'reasoning-end';
+    id: string;
+    harnessMetadata?: HarnessV1Metadata;
+} | (LanguageModelV4ToolCall & {
+    nativeName?: string;
+}) | LanguageModelV4ToolApprovalRequest | LanguageModelV4ToolResult | {
+    type: 'finish-step';
+    finishReason: LanguageModelV4FinishReason;
+    usage: LanguageModelV4Usage;
+    harnessMetadata?: HarnessV1Metadata;
+} | {
+    type: 'finish';
+    finishReason: LanguageModelV4FinishReason;
+    totalUsage: LanguageModelV4Usage;
+    harnessMetadata?: HarnessV1Metadata;
+} | {
+    type: 'file-change';
+    event: 'create' | 'modify' | 'delete';
+    path: string;
+    harnessMetadata?: HarnessV1Metadata;
+} | {
+    type: 'compaction';
+    trigger: 'manual' | 'auto';
+    summary: string;
+    tokensBefore?: number;
+    tokensAfter?: number;
+    harnessMetadata?: HarnessV1Metadata;
+} | {
+    type: 'error';
+    error: unknown;
+} | {
+    type: 'raw';
+    rawValue: unknown;
+};
+declare const harnessV1StreamStartPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"stream-start">;
+    warnings: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodType<HarnessV1CallWarning, unknown, z.core.$ZodTypeInternals<HarnessV1CallWarning, unknown>>>>>;
+    modelId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const harnessV1TextStartPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"text-start">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>;
+declare const harnessV1TextDeltaPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"text-delta">;
+    id: z.ZodString;
+    delta: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>;
+declare const harnessV1TextEndPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"text-end">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>;
+declare const harnessV1ReasoningStartPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"reasoning-start">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>;
+declare const harnessV1ReasoningDeltaPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"reasoning-delta">;
+    id: z.ZodString;
+    delta: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>;
+declare const harnessV1ReasoningEndPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"reasoning-end">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>;
+declare const harnessV1ToolCallPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tool-call">;
+    toolCallId: z.ZodString;
+    toolName: z.ZodString;
+    input: z.ZodString;
+    providerExecuted: z.ZodOptional<z.ZodBoolean>;
+    dynamic: z.ZodOptional<z.ZodBoolean>;
+    providerMetadata: z.ZodOptional<z.ZodType<SharedV4ProviderMetadata, unknown, z.core.$ZodTypeInternals<SharedV4ProviderMetadata, unknown>>>;
+    nativeName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const harnessV1ToolApprovalRequestPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tool-approval-request">;
+    approvalId: z.ZodString;
+    toolCallId: z.ZodString;
+    providerMetadata: z.ZodOptional<z.ZodType<SharedV4ProviderMetadata, unknown, z.core.$ZodTypeInternals<SharedV4ProviderMetadata, unknown>>>;
+}, z.core.$strip>;
+declare const harnessV1ToolResultPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tool-result">;
+    toolCallId: z.ZodString;
+    toolName: z.ZodString;
+    result: z.ZodType<NonNullable<JSONValue>, unknown, z.core.$ZodTypeInternals<NonNullable<JSONValue>, unknown>>;
+    isError: z.ZodOptional<z.ZodBoolean>;
+    preliminary: z.ZodOptional<z.ZodBoolean>;
+    dynamic: z.ZodOptional<z.ZodBoolean>;
+    providerMetadata: z.ZodOptional<z.ZodType<SharedV4ProviderMetadata, unknown, z.core.$ZodTypeInternals<SharedV4ProviderMetadata, unknown>>>;
+}, z.core.$strip>;
+declare const harnessV1FinishStepPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"finish-step">;
+    finishReason: z.ZodType<LanguageModelV4FinishReason, unknown, z.core.$ZodTypeInternals<LanguageModelV4FinishReason, unknown>>;
+    usage: z.ZodType<LanguageModelV4Usage, unknown, z.core.$ZodTypeInternals<LanguageModelV4Usage, unknown>>;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>;
+declare const harnessV1FinishPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"finish">;
+    finishReason: z.ZodType<LanguageModelV4FinishReason, unknown, z.core.$ZodTypeInternals<LanguageModelV4FinishReason, unknown>>;
+    totalUsage: z.ZodType<LanguageModelV4Usage, unknown, z.core.$ZodTypeInternals<LanguageModelV4Usage, unknown>>;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>;
+declare const harnessV1FileChangePartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"file-change">;
+    event: z.ZodEnum<{
+        create: "create";
+        modify: "modify";
+        delete: "delete";
+    }>;
+    path: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>;
+declare const harnessV1ErrorPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"error">;
+    error: z.ZodUnknown;
+}, z.core.$strip>;
+declare const harnessV1RawPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"raw">;
+    rawValue: z.ZodUnknown;
+}, z.core.$strip>;
+/**
+ * Assembled discriminated union over every `HarnessV1StreamPart` variant. Left
+ * un-annotated so it keeps its precise inferred type — the protocol layer
+ * composes the individual member schemas, and the type test asserts the
+ * inferred union equals `HarnessV1StreamPart`.
+ */
+declare const harnessV1StreamPartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"stream-start">;
+    warnings: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodType<HarnessV1CallWarning, unknown, z.core.$ZodTypeInternals<HarnessV1CallWarning, unknown>>>>>;
+    modelId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"text-start">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"text-delta">;
+    id: z.ZodString;
+    delta: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"text-end">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"reasoning-start">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"reasoning-delta">;
+    id: z.ZodString;
+    delta: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"reasoning-end">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"tool-call">;
+    toolCallId: z.ZodString;
+    toolName: z.ZodString;
+    input: z.ZodString;
+    providerExecuted: z.ZodOptional<z.ZodBoolean>;
+    dynamic: z.ZodOptional<z.ZodBoolean>;
+    providerMetadata: z.ZodOptional<z.ZodType<SharedV4ProviderMetadata, unknown, z.core.$ZodTypeInternals<SharedV4ProviderMetadata, unknown>>>;
+    nativeName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"tool-approval-request">;
+    approvalId: z.ZodString;
+    toolCallId: z.ZodString;
+    providerMetadata: z.ZodOptional<z.ZodType<SharedV4ProviderMetadata, unknown, z.core.$ZodTypeInternals<SharedV4ProviderMetadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"tool-result">;
+    toolCallId: z.ZodString;
+    toolName: z.ZodString;
+    result: z.ZodType<NonNullable<JSONValue>, unknown, z.core.$ZodTypeInternals<NonNullable<JSONValue>, unknown>>;
+    isError: z.ZodOptional<z.ZodBoolean>;
+    preliminary: z.ZodOptional<z.ZodBoolean>;
+    dynamic: z.ZodOptional<z.ZodBoolean>;
+    providerMetadata: z.ZodOptional<z.ZodType<SharedV4ProviderMetadata, unknown, z.core.$ZodTypeInternals<SharedV4ProviderMetadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"finish-step">;
+    finishReason: z.ZodType<LanguageModelV4FinishReason, unknown, z.core.$ZodTypeInternals<LanguageModelV4FinishReason, unknown>>;
+    usage: z.ZodType<LanguageModelV4Usage, unknown, z.core.$ZodTypeInternals<LanguageModelV4Usage, unknown>>;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"finish">;
+    finishReason: z.ZodType<LanguageModelV4FinishReason, unknown, z.core.$ZodTypeInternals<LanguageModelV4FinishReason, unknown>>;
+    totalUsage: z.ZodType<LanguageModelV4Usage, unknown, z.core.$ZodTypeInternals<LanguageModelV4Usage, unknown>>;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"file-change">;
+    event: z.ZodEnum<{
+        create: "create";
+        modify: "modify";
+        delete: "delete";
+    }>;
+    path: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"compaction">;
+    trigger: z.ZodEnum<{
+        manual: "manual";
+        auto: "auto";
+    }>;
+    summary: z.ZodString;
+    tokensBefore: z.ZodOptional<z.ZodNumber>;
+    tokensAfter: z.ZodOptional<z.ZodNumber>;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"error">;
+    error: z.ZodUnknown;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"raw">;
+    rawValue: z.ZodUnknown;
+}, z.core.$strip>]>;
+
+/**
+ * Description of a host-defined tool that the harness should make available
+ * to the underlying agent runtime.
+ *
+ * Adapters translate this into whatever shape their runtime expects (e.g.
+ * Claude Code's tool definitions, Codex CLI's tool config, an MCP server
+ * exposed to the runtime, …). The adapter does not execute the tool; when
+ * the runtime calls it, the adapter emits a `tool-call` event and waits for
+ * `submitToolResult` from the caller.
+ */
+type HarnessV1ToolSpec = {
+    /**
+     * Tool name the agent runtime sees. Must match the name on incoming
+     * `tool-call` events.
+     */
+    readonly name: string;
+    /**
+     * Human-readable description handed to the runtime, used to help the model
+     * decide when to call the tool.
+     */
+    readonly description?: string;
+    /**
+     * JSON Schema describing the expected input for the tool. Optional because
+     * some runtimes accept tools without schemas (free-form arguments).
+     */
+    readonly inputSchema?: JSONSchema7;
+};
+
+type HarnessV1BuiltinToolFiltering = {
+    mode: 'allow';
+    toolNames: string[];
+} | {
+    mode: 'deny';
+    toolNames: string[];
+};
+declare function isHarnessV1BuiltinToolIncluded(input: {
+    toolName: string;
+    toolFiltering: HarnessV1BuiltinToolFiltering | undefined;
+}): boolean;
+declare function getHarnessV1BuiltinToolFilteringDenialReason(input: {
+    toolName: string;
+}): string;
+
+/**
+ * Options passed to `HarnessV1.doStart`.
+ *
+ * `sandboxSession` and `sessionWorkDir` are coupled and always present. The
+ * framework creates the sandbox and per-session working directory before
+ * calling the adapter, so adapters never need to derive provider-specific paths.
+ */
+type HarnessV1StartOptions = {
+    /**
+     * Stable identifier for this harness session. Used as the underlying
+     * resource name where the adapter has a notion of a named session
+     * (sandbox name, native session id, …).
+     */
+    readonly sessionId: string;
+    /**
+     * Skills made available to the underlying runtime for the lifetime of
+     * the session. Adapters decide how to surface them.
+     */
+    readonly skills?: ReadonlyArray<HarnessV1Skill>;
+    /**
+     * Optional resume payload returned by a prior session lifecycle method. When
+     * provided, the adapter should resume the existing session before accepting a
+     * new prompt or continuing a nested unfinished turn.
+     */
+    readonly resumeFrom?: HarnessV1ResumeSessionState;
+    /**
+     * Optional continuation payload returned by `doSuspendTurn`, or nested in
+     * `resumeFrom`. When provided, the adapter should resume the existing session
+     * in a shape ready for `doContinueTurn` rather than for a fresh prompt.
+     */
+    readonly continueFrom?: HarnessV1ContinueTurnState;
+    /**
+     * Approval policy for built-in adapter-native tool use. Custom host-executed
+     * tools are approved by the framework before results are submitted back to
+     * the adapter.
+     */
+    readonly permissionMode?: HarnessV1PermissionMode;
+    /**
+     * Adapter-native built-in tools that should be available for this session.
+     * Custom host-executed tools are filtered by the framework before they reach
+     * the adapter.
+     */
+    readonly builtinToolFiltering?: HarnessV1BuiltinToolFiltering;
+    /**
+     * Signal that aborts startup. The adapter must propagate cancellation to
+     * any spawned processes or network calls.
+     */
+    readonly abortSignal?: AbortSignal;
+    /**
+     * Diagnostics wiring. The framework populates this; the adapter only
+     * forwards `observability.onDiagnostic` into its `SandboxChannel` and
+     * `observability.debug` into the bridge `start` message. Absent when the
+     * consumer has not enabled diagnostics.
+     */
+    readonly observability?: HarnessV1Observability;
+    /**
+     * Network sandbox session the adapter operates against. It is owned and
+     * lifecycled by `HarnessAgent`. Adapters call `restricted()` for the
+     * tool-safe filesystem/exec/spawn surface, and use the infra methods
+     * (`getPortUrl`, `ports`, `setNetworkPolicy`) for bridge wiring. Adapters
+     * must not call `stop()` themselves; the agent does that during cleanup.
+     */
+    readonly sandboxSession: HarnessV1NetworkSandboxSession;
+    /**
+     * Absolute path the adapter runs the agent in for this session. Composed by
+     * the framework as `<sandboxSession.defaultWorkingDirectory>/<harnessId>-<sessionId>`
+     * and created before `doStart`, so the adapter uses it directly instead of
+     * deriving its own provider-specific path.
+     */
+    readonly sessionWorkDir: string;
+};
+/**
+ * Options passed to `HarnessV1Session.doPromptTurn`.
+ */
+type HarnessV1PromptTurnOptions = {
+    /**
+     * Fresh input for this turn — either a plain string or a single
+     * `ModelMessage`. The harness session owns its own conversation history,
+     * so prior turns are never replayed across the contract.
+     */
+    readonly prompt: HarnessV1Prompt;
+    /**
+     * Host-defined tools to make available to the underlying runtime for this
+     * turn. The harness emits `tool-call` events when the runtime calls one
+     * and waits for `submitToolResult`.
+     */
+    readonly tools?: ReadonlyArray<HarnessV1ToolSpec>;
+    /**
+     * Free-form instructions for the session. The framework supplies the same
+     * value on every turn; the adapter is responsible for applying it once, by
+     * prepending it to the first user message of a fresh (non-resumed) session.
+     * On a resumed session the adapter must not re-apply it — the original first
+     * message already carried it and lives in the runtime's persisted history.
+     */
+    readonly instructions?: string;
+    /**
+     * Signal that aborts the in-flight turn. The adapter must cancel any
+     * underlying work and resolve `done` (with an error if appropriate).
+     */
+    readonly abortSignal?: AbortSignal;
+    /**
+     * Callback invoked once for each event the adapter produces during the
+     * turn. The adapter is responsible for the ordering and completeness of
+     * events. `done` resolves once the adapter has emitted all events for the
+     * turn (success or failure).
+     */
+    readonly emit: (event: HarnessV1StreamPart) => void;
+};
+/**
+ * Options passed to `HarnessV1Session.doContinueTurn`.
+ *
+ * Unlike `doPromptTurn`, there is no `prompt`: `doContinueTurn` continues the
+ * in-flight turn rather than starting a new one. It is used to continue a turn
+ * that was previously suspended temporarily, e.g. by the workflow slice loop.
+ */
+type HarnessV1ContinueTurnOptions = {
+    /**
+     * Host-defined tools to make available for the continued turn. Same shape
+     * as `doPromptTurn`'s `tools`. An adapter that purely attaches to a live turn
+     * may ignore them; an adapter that re-drives the turn (rerun) needs them.
+     */
+    readonly tools?: ReadonlyArray<HarnessV1ToolSpec>;
+    /**
+     * Signal that aborts the continued turn. The adapter must cancel any
+     * underlying work and resolve `done` (with an error if appropriate).
+     */
+    readonly abortSignal?: AbortSignal;
+    /**
+     * Callback invoked once for each event the adapter produces while the
+     * continued turn runs. Same contract as `doPromptTurn`'s `emit`.
+     */
+    readonly emit: (event: HarnessV1StreamPart) => void;
+};
+/**
+ * Active harness session, returned by `HarnessV1.doStart`.
+ *
+ * A session is the unit of state continuity across multiple prompts (one
+ * sandbox, one conversation history, one running agent runtime). The host
+ * holds onto the session across `doPromptTurn` calls and ends the local
+ * instance via `doDetach`, `doStop`, or `doDestroy`.
+ */
+type HarnessV1Session = {
+    /**
+     * Stable identifier for this session. Same value the host passed in via
+     * `HarnessV1StartOptions.sessionId`.
+     */
+    readonly sessionId: string;
+    /**
+     * Whether this session was created from `resumeFrom` or `continueFrom`. Fresh
+     * sessions report `false`; resumed sessions report `true`.
+     */
+    readonly isResume: boolean;
+    /**
+     * The model id the underlying runtime is configured to use, if the adapter
+     * knows it (e.g. from its settings). Surfaced into telemetry as
+     * `gen_ai.request.model` and the trace span labels. Omitted when the adapter
+     * defers to the runtime's own default and has no concrete id.
+     */
+    readonly modelId?: string;
+    /**
+     * Run one prompt turn. Returns a control handle the host uses to feed
+     * tool results, approvals, and user messages back into the turn while it
+     * is in flight. The handle's `done` promise resolves when the turn ends.
+     */
+    doPromptTurn(options: HarnessV1PromptTurnOptions): PromiseLike<HarnessV1PromptControl>;
+    /**
+     * Request that the underlying runtime compact its context. The runtime owns
+     * the compaction — the harness neither implements nor schedules it; this is
+     * only the trigger. When compaction completes, the adapter surfaces a
+     * `compaction` stream part on the next/active turn.
+     *
+     * Required, but not every runtime can honour it: adapters whose transport
+     * exposes no manual compaction (e.g. Codex over `codex exec`, which still
+     * auto-compacts on its own) throw `HarnessCapabilityUnsupportedError`.
+     * `customInstructions`, when supported, steer the compaction summary.
+     */
+    doCompact(customInstructions?: string): PromiseLike<void>;
+    /**
+     * Continue the in-flight turn **without a new user prompt**, returning the
+     * same control surface as `doPromptTurn`. Used to keep consuming a turn that
+     * was interrupted at a process boundary (the workflow slice loop), after the
+     * session itself has been resumed via `doStart({ continueFrom })`:
+     *
+     *  - When the runtime's turn is still live and reachable (bridge `attach` /
+     *    `replay`), the adapter subscribes to its events and resolves `done` on
+     *    the turn's `finish` — **without** re-driving it. Lossless.
+     *  - When the live turn is gone (bridge respawned `rerun`, or a host-resident
+     *    runtime like Pi whose turn cannot survive its process), the adapter
+     *    re-drives the runtime's own thread from its persisted state. Lossy: work
+     *    in flight at the interruption is recomputed.
+     *
+     * Required on every adapter. The behaviour an adapter can guarantee follows
+     * from its architecture; the contract is uniform.
+     */
+    doContinueTurn(options: HarnessV1ContinueTurnOptions): PromiseLike<HarnessV1PromptControl>;
+    /**
+     * Gracefully freeze the active turn **at a precise cursor while keeping the
+     * runtime alive**, returning the continuation payload.
+     *
+     * This is the slice-boundary primitive. The adapter stops host-side
+     * consumption of the in-flight turn without telling the runtime to stop:
+     * for a bridge adapter it closes the host socket (the bridge keeps the turn
+     * running and accumulates events for replay) and resolves the active
+     * `doPromptTurn`/`doContinueTurn` `done` **cleanly** (not as an error) once buffered
+     * events have drained, so the cursor in the returned state equals the last
+     * event delivered to the host — guaranteeing the next slice's attach replays
+     * with no gap and no duplicate. A host-resident adapter (Pi) cannot keep its
+     * turn alive, so it persists what it can and the in-flight tail is recomputed
+     * on continue.
+     *
+     * Like `doDetach`, the sandbox/runtime is left running. Unlike `doDetach`,
+     * this is for an active turn at a slice boundary rather than a between-turn
+     * session handoff. Required on every adapter.
+     */
+    doSuspendTurn(): PromiseLike<HarnessV1ContinueTurnState>;
+    /**
+     * Detach from the underlying runtime without tearing it down, returning a
+     * payload the host can later pass to
+     * `HarnessV1.doStart({ resumeFrom })` to reconnect before a new turn. After
+     * `doDetach`, no further methods on this session instance may be called.
+     *
+     * Required. Adapters that cannot keep a live runtime parked still return the
+     * best resume session state they can while leaving the sandbox running.
+     */
+    doDetach(): PromiseLike<HarnessV1ResumeSessionState>;
+    /**
+     * Persist enough state to resume later, then stop the underlying runtime.
+     * After `doStop`, no further methods on this session instance may be called.
+     */
+    doStop(): PromiseLike<HarnessV1ResumeSessionState>;
+    /**
+     * Stop the underlying runtime without returning lifecycle state. After
+     * `doDestroy`, no further methods on this session instance may be called.
+     */
+    doDestroy(): PromiseLike<void>;
+};
+
+/**
+ * Versioned specification for a harness adapter — the integration point for
+ * one third-party coding-agent runtime (Claude Code, Codex, …).
+ *
+ * Modelled after `LanguageModelV4`: a tagged spec version, a small set of
+ * descriptive fields, and one entry-point method (`doStart`) that yields a
+ * session. There is intentionally no static "capabilities" object —
+ * optional features are signalled by the presence or absence of optional
+ * methods on the prompt-control handle. Adapters that cannot satisfy a request
+ * (manual compaction not supported, required port exposure unavailable, …)
+ * throw `HarnessCapabilityUnsupportedError` from the method that needs the
+ * capability.
+ */
+type HarnessV1<TBuiltinTools extends ToolSet = ToolSet> = {
+    /**
+     * Spec version this adapter implements. Always the literal `'harness-v1'`.
+     */
+    readonly specificationVersion: 'harness-v1';
+    /**
+     * Stable identifier for this harness, used as the key inside
+     * `HarnessV1Metadata` objects. Conventionally a kebab-case slug matching
+     * the package name (`'claude-code'`, `'codex'`).
+     */
+    readonly harnessId: string;
+    /**
+     * Tools the adapter's underlying runtime exposes natively, as a `ToolSet`
+     * keyed by what the bridge emits on `tool-call` events
+     * (`commonName ?? nativeName`). Each entry is a `HarnessV1BuiltinTool`
+     * (a `Tool` plus harness-specific `nativeName` / `commonName` metadata).
+     *
+     * The agent merges this with consumer-supplied user tools when validating
+     * inbound tool calls and when typing the consumer-facing stream.
+     */
+    readonly builtinTools: TBuiltinTools;
+    /**
+     * Whether the adapter can emit approval requests for built-in tools when
+     * `permissionMode` is not `'allow-all'`.
+     *
+     * Custom host-executed tool approvals are handled by `HarnessAgent`, so this
+     * only describes adapter-native tool approval support.
+     */
+    readonly supportsBuiltinToolApprovals?: boolean;
+    /**
+     * Whether the adapter can prevent its underlying runtime from seeing or
+     * calling inactive built-in tools for every tool in `builtinTools`.
+     *
+     * Adapters without native filtering can still support `activeTools` and
+     * `inactiveTools` for built-ins when `supportsBuiltinToolApprovals` is
+     * `true`: the framework routes inactive built-in tool calls through the
+     * approval path and auto-denies them before they execute.
+     */
+    readonly supportsBuiltinToolFiltering?: boolean;
+    /**
+     * Optional schema for the adapter-defined `data` payload returned by session
+     * lifecycle methods. When present, the adapter promises that exported state
+     * validated by this schema can be re-imported in a future
+     * `doStart({ resumeFrom })` or `doStart({ continueFrom })` call.
+     */
+    readonly lifecycleStateSchema?: FlexibleSchema<unknown>;
+    /**
+     * Optional bootstrap recipe. When defined, the harness session manager
+     * computes a stable identity from the recipe, passes it (along with a
+     * one-time recipe-application hook) to the sandbox provider, and applies
+     * the recipe idempotently after the provider returns the handle.
+     *
+     * Adapters with no bootstrap needs omit this. Adapters that need to install
+     * deps or ship bridge files into the sandbox declare them here so the
+     * provider can cache the result across sessions via snapshots when
+     * supported.
+     */
+    readonly getBootstrap?: (options?: {
+        abortSignal?: AbortSignal;
+    }) => PromiseLike<HarnessV1Bootstrap>;
+    /**
+     * Start a fresh session, resume a parked session via `resumeFrom`, or resume
+     * an interrupted turn via `continueFrom`. The host then issues prompts against
+     * the returned session, ending with `doDetach`, `doStop`, or `doDestroy`.
+     */
+    doStart(options: HarnessV1StartOptions): PromiseLike<HarnessV1Session>;
+};
+
+/**
+ * Cross-harness vocabulary of common built-in tool names with their baseline
+ * input schemas. Adapters that declare a built-in with one of these
+ * `commonName`s must accept (at least) every input the baseline schema
+ * accepts. Extra optional fields are encouraged.
+ *
+ * Used both as runtime values (spread into `ToolSet`s for inspection) and as
+ * a vocabulary source — `HarnessV1BuiltinToolName` is derived from its keys.
+ */
+declare const HARNESS_V1_BUILTIN_TOOLS: {
+    readonly read: Tool<{
+        file_path: string;
+    }, unknown, _ai_sdk_provider_utils.Context>;
+    readonly write: Tool<{
+        file_path: string;
+        content: string;
+    }, unknown, _ai_sdk_provider_utils.Context>;
+    readonly edit: Tool<{
+        file_path: string;
+        old_string: string;
+        new_string: string;
+    }, unknown, _ai_sdk_provider_utils.Context>;
+    readonly bash: Tool<{
+        command: string;
+    }, unknown, _ai_sdk_provider_utils.Context>;
+    readonly grep: Tool<{
+        pattern: string;
+    }, unknown, _ai_sdk_provider_utils.Context>;
+    readonly glob: Tool<{
+        pattern: string;
+    }, unknown, _ai_sdk_provider_utils.Context>;
+    readonly webSearch: Tool<{
+        query: string;
+    }, unknown, _ai_sdk_provider_utils.Context>;
+};
+type HarnessV1BuiltinToolName = keyof typeof HARNESS_V1_BUILTIN_TOOLS;
+declare const HARNESS_V1_BUILTIN_TOOL_NAMES: ReadonlyArray<HarnessV1BuiltinToolName>;
+type HarnessV1BuiltinToolUseKind = 'readonly' | 'edit' | 'bash';
+/**
+ * A tool that the adapter's underlying runtime exposes natively. Extends the
+ * AI SDK `Tool` shape with two optional harness-specific fields:
+ *
+ *  - `nativeName`: the name as the underlying runtime knows it. Required
+ *    only when the tool's key in the harness's `builtinTools` is not the
+ *    native name — i.e. when the tool maps to a `commonName` (e.g. key
+ *    `'bash'` for Claude Code's native `'Bash'`). Tools without a common
+ *    equivalent are keyed by their native name directly, so `nativeName`
+ *    is redundant and omitted.
+ *  - `commonName`: cross-harness label drawn from
+ *    `HARNESS_V1_BUILTIN_TOOL_NAMES`. Set when the tool maps to a familiar
+ *    capability; consumers use it to recognize, e.g., that Claude Code's
+ *    `Bash` and Codex's `shell` are the same kind of tool.
+ *
+ * Always set both fields together via the `commonTool` helper, or neither
+ * (declare the tool with the AI SDK's `tool()` directly).
+ */
+type HarnessV1BuiltinTool<INPUT = unknown, OUTPUT = unknown> = Tool<INPUT, OUTPUT, any> & {
+    readonly nativeName?: string;
+    readonly commonName?: HarnessV1BuiltinToolName;
+    readonly toolUseKind?: HarnessV1BuiltinToolUseKind;
+};
+type InputOf<T> = T extends Tool<infer I, any, any> ? I : never;
+type StandardInputOf<N extends HarnessV1BuiltinToolName> = InputOf<(typeof HARNESS_V1_BUILTIN_TOOLS)[N]>;
+type SupersetCheck<TStandard, TAdapter, TOk> = TStandard extends TAdapter ? TOk : [
+    'ERROR: adapter input schema must be a superset of the standard schema',
+    {
+        expected: TStandard;
+        got: TAdapter;
+    }
+];
+/**
+ * Declare a built-in tool that maps to a cross-harness common name. The
+ * adapter's input schema must accept every input the standard schema for
+ * `commonName` accepts. Extra optional fields are encouraged.
+ *
+ * If the schema is missing a field the standard requires (or has an
+ * incompatible type), the return type collapses to a tagged error tuple,
+ * which fails the surrounding `as const satisfies ToolSet` assignment and
+ * surfaces a readable TypeScript error at the offending entry.
+ */
+declare function commonTool<TName extends HarnessV1BuiltinToolName, TInput>(commonName: TName, opts: {
+    readonly nativeName: string;
+    readonly toolUseKind?: HarnessV1BuiltinToolUseKind;
+    readonly description?: string;
+    readonly inputSchema: FlexibleSchema<TInput>;
+}): SupersetCheck<StandardInputOf<TName>, TInput, HarnessV1BuiltinTool<TInput>>;
+
+/**
+ * Provider that produces network sandbox sessions for harness sessions. Lives at
+ * module scope as a stable, synchronous object — analogous to
+ * `LanguageModelV4` providers, no I/O performed at construction. The actual
+ * sandbox is created (or wrapped) when `HarnessAgent` calls `createSession()`.
+ */
+interface HarnessV1SandboxProvider {
+    readonly specificationVersion: 'harness-sandbox-v1';
+    readonly providerId: string;
+    /**
+     * Pool of ports the consumer reserved on a caller-provided sandbox for
+     * concurrent harness sessions. The session manager leases one port per
+     * session and releases on stop or destroy.
+     *
+     * Only meaningful when the provider wraps a caller-provided sandbox
+     * (the caller pre-declared the ports). In create-new modes the provider
+     * mints a fresh sandbox per session, so no leasing is needed; providers
+     * leave this undefined.
+     */
+    readonly bridgePorts?: ReadonlyArray<number>;
+    readonly createSession: (options?: {
+        /**
+         * Stable per-session identifier. When supplied, the provider names the
+         * underlying resource deterministically so a future call to `resume`
+         * (potentially from a different process) can find the same sandbox.
+         * Omitted from prewarm and other paths that don't need a resumable
+         * resource — in that case the provider falls back to its native
+         * auto-naming.
+         */
+        sessionId?: string;
+        abortSignal?: AbortSignal;
+        /**
+         * Stable identity for snapshot-based reuse. Providers that support
+         * persistence/snapshots use this as part of the persistent sandbox
+         * name; subsequent calls with the same identity resume from snapshot.
+         *
+         * Ignored when the provider is wrapping a caller-provided sandbox.
+         */
+        identity?: string;
+        /**
+         * Called exactly once per identity, on fresh creation. Snapshot-capable
+         * providers wire this into the platform's one-time-setup hook so the
+         * side effects are baked into the snapshot. Providers without snapshot
+         * support run it immediately after fresh create.
+         *
+         * Not called when the provider is wrapping a caller-provided sandbox
+         * (the caller owns the sandbox; the framework applies its own
+         * idempotent bootstrap post-create instead).
+         */
+        onFirstCreate?: (session: Experimental_SandboxSession, opts: {
+            abortSignal?: AbortSignal;
+        }) => Promise<void>;
+    }) => PromiseLike<HarnessV1NetworkSandboxSession>;
+    /**
+     * Reattach to an existing sandbox previously created with the same
+     * `sessionId`. Optional — providers that cannot rehydrate by id (e.g.
+     * just-bash) omit this; the harness throws
+     * `HarnessCapabilityUnsupportedError` when resume is attempted against
+     * them.
+     *
+     * The provider derives the sandbox identifier from `sessionId` using the
+     * same deterministic naming scheme it used in `createSession`. Returns a
+     * network sandbox session bound to the existing resource.
+     */
+    readonly resumeSession?: (options: {
+        sessionId: string;
+        abortSignal?: AbortSignal;
+    }) => PromiseLike<HarnessV1NetworkSandboxSession>;
+}
+
+/**
+ * The subset of a host-defined tool that travels on the `start` message. The
+ * runtime only needs the name, description, and JSON-Schema input to surface
+ * the tool; `execute` stays on the host.
+ */
+declare const harnessV1BridgeToolWireSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    inputSchema: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+type HarnessV1BridgeToolWire = z.infer<typeof harnessV1BridgeToolWireSchema>;
+declare const harnessV1BridgePermissionModeSchema: z.ZodEnum<{
+    "allow-all": "allow-all";
+    "allow-reads": "allow-reads";
+    "allow-edits": "allow-edits";
+}>;
+declare const harnessV1BridgeBuiltinToolFilteringSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    mode: z.ZodLiteral<"allow">;
+    toolNames: z.ZodArray<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    mode: z.ZodLiteral<"deny">;
+    toolNames: z.ZodArray<z.ZodString>;
+}, z.core.$strip>]>;
+/**
+ * Common fields of the inbound `start` message. Each adapter extends this with
+ * its runtime-specific configuration (e.g. `thinking`/`continue` for Claude
+ * Code, `reasoningEffort`/`webSearch`/`skills`/`resumeThreadId` for Codex) and
+ * assembles the final inbound union from the shared command members below.
+ *
+ * `debug` carries the general `HarnessV1DebugConfig` — diagnostics config is not
+ * a bridge concept, it just happens to ride the `start` frame for bridge-backed
+ * adapters.
+ */
+declare const harnessV1BridgeStartBaseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"start">;
+    prompt: z.ZodString;
+    tools: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        inputSchema: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>>>;
+    model: z.ZodOptional<z.ZodString>;
+    debug: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        level: z.ZodOptional<z.ZodEnum<{
+            error: "error";
+            warn: "warn";
+            info: "info";
+            debug: "debug";
+            trace: "trace";
+        }>>;
+        subsystems: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    permissionMode: z.ZodOptional<z.ZodEnum<{
+        "allow-all": "allow-all";
+        "allow-reads": "allow-reads";
+        "allow-edits": "allow-edits";
+    }>>;
+    builtinToolFiltering: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"allow">;
+        toolNames: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        mode: z.ZodLiteral<"deny">;
+        toolNames: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>]>>;
+}, z.core.$strip>;
+/**
+ * Sent the instant the bridge accepts an authenticated WS connection. The host
+ * waits for it before sending `start`/`resume`, because some sandbox runtimes
+ * complete the upstream WS handshake before the connection is wired through to
+ * the bridge process — anything sent in that gap is dropped. Carries the
+ * bridge's lifecycle `state` and highest emitted `seq` for reconnect.
+ */
+declare const harnessV1BridgeHelloSchema: z.ZodObject<{
+    type: z.ZodLiteral<"bridge-hello">;
+    state: z.ZodOptional<z.ZodString>;
+    lastSeq: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * The bridge's reply to an inbound `detach`. Carries the adapter-specific
+ * payload the host serializes into lifecycle state `data`.
+ */
+declare const harnessV1BridgeDetachSchema: z.ZodObject<{
+    type: z.ZodLiteral<"bridge-detach">;
+    data: z.ZodUnknown;
+}, z.core.$strip>;
+/**
+ * A resume coordinate the bridge proactively announces (e.g. Codex's thread id)
+ * so the host can cache it for a later resume without waiting for `detach`.
+ */
+declare const harnessV1BridgeThreadSchema: z.ZodObject<{
+    type: z.ZodLiteral<"bridge-thread">;
+    threadId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * One captured console line from inside the sandbox. The bridge line-buffers
+ * `process.stdout`/`process.stderr` and emits one of these per complete line.
+ * Routed host-side to the diagnostics sink, never to the consumer stream.
+ */
+declare const harnessV1BridgeSandboxLogSchema: z.ZodObject<{
+    type: z.ZodLiteral<"sandbox-log">;
+    source: z.ZodString;
+    stream: z.ZodEnum<{
+        stdout: "stdout";
+        stderr: "stderr";
+    }>;
+    line: z.ZodString;
+}, z.core.$strip>;
+/**
+ * A structured diagnostic an adapter emits from inside the bridge via
+ * `turn.bridgeLog(...)`. Gated by the session's debug level + subsystem filter.
+ */
+declare const harnessV1BridgeDebugEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"debug-event">;
+    level: z.ZodEnum<{
+        error: "error";
+        warn: "warn";
+        info: "info";
+        debug: "debug";
+        trace: "trace";
+    }>;
+    subsystem: z.ZodString;
+    message: z.ZodString;
+    attrs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    error: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        message: z.ZodString;
+        stack: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * Every frame a bridge can send to the host: the stream-part events plus the
+ * transport/control frames. This is the schema the host `SandboxChannel`
+ * validates inbound frames against.
+ */
+declare const harnessV1BridgeOutboundMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"stream-start">;
+    warnings: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodType<HarnessV1CallWarning, unknown, z.core.$ZodTypeInternals<HarnessV1CallWarning, unknown>>>>>;
+    modelId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"text-start">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"text-delta">;
+    id: z.ZodString;
+    delta: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"text-end">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"reasoning-start">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"reasoning-delta">;
+    id: z.ZodString;
+    delta: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"reasoning-end">;
+    id: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"tool-call">;
+    toolCallId: z.ZodString;
+    toolName: z.ZodString;
+    input: z.ZodString;
+    providerExecuted: z.ZodOptional<z.ZodBoolean>;
+    dynamic: z.ZodOptional<z.ZodBoolean>;
+    providerMetadata: z.ZodOptional<z.ZodType<_ai_sdk_provider.SharedV4ProviderMetadata, unknown, z.core.$ZodTypeInternals<_ai_sdk_provider.SharedV4ProviderMetadata, unknown>>>;
+    nativeName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"tool-approval-request">;
+    approvalId: z.ZodString;
+    toolCallId: z.ZodString;
+    providerMetadata: z.ZodOptional<z.ZodType<_ai_sdk_provider.SharedV4ProviderMetadata, unknown, z.core.$ZodTypeInternals<_ai_sdk_provider.SharedV4ProviderMetadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"tool-result">;
+    toolCallId: z.ZodString;
+    toolName: z.ZodString;
+    result: z.ZodType<NonNullable<_ai_sdk_provider.JSONValue>, unknown, z.core.$ZodTypeInternals<NonNullable<_ai_sdk_provider.JSONValue>, unknown>>;
+    isError: z.ZodOptional<z.ZodBoolean>;
+    preliminary: z.ZodOptional<z.ZodBoolean>;
+    dynamic: z.ZodOptional<z.ZodBoolean>;
+    providerMetadata: z.ZodOptional<z.ZodType<_ai_sdk_provider.SharedV4ProviderMetadata, unknown, z.core.$ZodTypeInternals<_ai_sdk_provider.SharedV4ProviderMetadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"finish-step">;
+    finishReason: z.ZodType<_ai_sdk_provider.LanguageModelV4FinishReason, unknown, z.core.$ZodTypeInternals<_ai_sdk_provider.LanguageModelV4FinishReason, unknown>>;
+    usage: z.ZodType<_ai_sdk_provider.LanguageModelV4Usage, unknown, z.core.$ZodTypeInternals<_ai_sdk_provider.LanguageModelV4Usage, unknown>>;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"finish">;
+    finishReason: z.ZodType<_ai_sdk_provider.LanguageModelV4FinishReason, unknown, z.core.$ZodTypeInternals<_ai_sdk_provider.LanguageModelV4FinishReason, unknown>>;
+    totalUsage: z.ZodType<_ai_sdk_provider.LanguageModelV4Usage, unknown, z.core.$ZodTypeInternals<_ai_sdk_provider.LanguageModelV4Usage, unknown>>;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"file-change">;
+    event: z.ZodEnum<{
+        create: "create";
+        modify: "modify";
+        delete: "delete";
+    }>;
+    path: z.ZodString;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"compaction">;
+    trigger: z.ZodEnum<{
+        manual: "manual";
+        auto: "auto";
+    }>;
+    summary: z.ZodString;
+    tokensBefore: z.ZodOptional<z.ZodNumber>;
+    tokensAfter: z.ZodOptional<z.ZodNumber>;
+    harnessMetadata: z.ZodOptional<z.ZodType<HarnessV1Metadata, unknown, z.core.$ZodTypeInternals<HarnessV1Metadata, unknown>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"error">;
+    error: z.ZodUnknown;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"raw">;
+    rawValue: z.ZodUnknown;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"bridge-hello">;
+    state: z.ZodOptional<z.ZodString>;
+    lastSeq: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"bridge-detach">;
+    data: z.ZodUnknown;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"bridge-thread">;
+    threadId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"bridge-interrupted">;
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"sandbox-log">;
+    source: z.ZodString;
+    stream: z.ZodEnum<{
+        stdout: "stdout";
+        stderr: "stderr";
+    }>;
+    line: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"debug-event">;
+    level: z.ZodEnum<{
+        error: "error";
+        warn: "warn";
+        info: "info";
+        debug: "debug";
+        trace: "trace";
+    }>;
+    subsystem: z.ZodString;
+    message: z.ZodString;
+    attrs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    error: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        message: z.ZodString;
+        stack: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>]>;
+type HarnessV1BridgeOutboundMessage = z.infer<typeof harnessV1BridgeOutboundMessageSchema>;
+type HarnessV1BridgeSandboxLog = z.infer<typeof harnessV1BridgeSandboxLogSchema>;
+type HarnessV1BridgeDebugEvent = z.infer<typeof harnessV1BridgeDebugEventSchema>;
+/**
+ * Normalize a bridge diagnostics wire frame into the transport-agnostic
+ * `HarnessV1Diagnostic` an adapter reports to the framework. A captured console
+ * line maps `stderr` → `warn` and `stdout` → `info`; a structured event passes
+ * its fields through. This is the seam where the bridge's serialization is
+ * lifted into the general emission shape every harness shares.
+ */
+declare function harnessV1DiagnosticFromBridgeFrame(frame: HarnessV1BridgeSandboxLog | HarnessV1BridgeDebugEvent, context: {
+    sessionId?: string;
+    timestamp: number;
+}): HarnessV1Diagnostic;
+declare const harnessV1BridgeToolResultInboundSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tool-result">;
+    toolCallId: z.ZodString;
+    output: z.ZodUnknown;
+    isError: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+declare const harnessV1BridgeToolApprovalResponseInboundSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tool-approval-response">;
+    approvalId: z.ZodString;
+    approved: z.ZodBoolean;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const harnessV1BridgeUserMessageInboundSchema: z.ZodObject<{
+    type: z.ZodLiteral<"user-message">;
+    text: z.ZodString;
+}, z.core.$strip>;
+declare const harnessV1BridgeAbortInboundSchema: z.ZodObject<{
+    type: z.ZodLiteral<"abort">;
+}, z.core.$strip>;
+declare const harnessV1BridgeShutdownInboundSchema: z.ZodObject<{
+    type: z.ZodLiteral<"shutdown">;
+}, z.core.$strip>;
+/**
+ * Reconnect: after re-establishing the socket the host asks the bridge to
+ * replay every buffered event with `seq > lastSeenEventId`.
+ */
+declare const harnessV1BridgeResumeInboundSchema: z.ZodObject<{
+    type: z.ZodLiteral<"resume">;
+    lastSeenEventId: z.ZodNumber;
+}, z.core.$strip>;
+/**
+ * The bridge replies with `bridge-detach` carrying any cached resume payload,
+ * then exits.
+ */
+declare const harnessV1BridgeDetachInboundSchema: z.ZodObject<{
+    type: z.ZodLiteral<"detach">;
+}, z.core.$strip>;
+/**
+ * The inbound command members shared by every bridge adapter. Spread these
+ * alongside the adapter's own `start` schema to build the final inbound union:
+ * `z.discriminatedUnion('type', [adapterStartSchema, ...harnessV1BridgeInboundCommandSchemas])`.
+ */
+declare const harnessV1BridgeInboundCommandSchemas: readonly [z.ZodObject<{
+    type: z.ZodLiteral<"tool-result">;
+    toolCallId: z.ZodString;
+    output: z.ZodUnknown;
+    isError: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"tool-approval-response">;
+    approvalId: z.ZodString;
+    approved: z.ZodBoolean;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"user-message">;
+    text: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"abort">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"interrupt">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"shutdown">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"resume">;
+    lastSeenEventId: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"detach">;
+}, z.core.$strip>];
+/**
+ * The JSON line the bridge writes to stdout once its WebSocket server is bound,
+ * announcing the port the host should connect to.
+ */
+declare const harnessV1BridgeReadySchema: z.ZodObject<{
+    type: z.ZodLiteral<"bridge-ready">;
+    port: z.ZodNumber;
+}, z.core.$strip>;
+type HarnessV1BridgeReady = z.infer<typeof harnessV1BridgeReadySchema>;
+
+declare const symbol$1: unique symbol;
+/**
+ * Base error type for failures originating in or signalled by a harness
+ * adapter. Specific failure modes (e.g. unsupported capability) extend this
+ * class.
+ */
+declare class HarnessError extends AISDKError {
+    private readonly [symbol$1];
+    constructor({ message, cause }: {
+        message: string;
+        cause?: unknown;
+    });
+    static isInstance(error: unknown): error is HarnessError;
+}
+
+declare const symbol: unique symbol;
+/**
+ * Thrown when a caller asks the harness to do something the adapter (or the
+ * supplied sandbox) does not support, e.g. requesting manual compaction from
+ * an adapter that only auto-compacts, or invoking `getPortUrl` on a sandbox
+ * that does not expose one.
+ *
+ * The caller supplies the full human-readable message. Optional `harnessId`
+ * is recorded as structured context for tooling.
+ */
+declare class HarnessCapabilityUnsupportedError extends HarnessError {
+    private readonly [symbol];
+    readonly harnessId?: string;
+    constructor({ message, harnessId, cause, }: {
+        message: string;
+        harnessId?: string;
+        cause?: unknown;
+    });
+    static isInstance(error: unknown): error is HarnessCapabilityUnsupportedError;
+}
+
+export { HARNESS_V1_BUILTIN_TOOLS, HARNESS_V1_BUILTIN_TOOL_NAMES, HarnessCapabilityUnsupportedError, HarnessError, type HarnessV1, type HarnessV1Bootstrap, type HarnessV1BootstrapCommand, type HarnessV1BootstrapFile, type HarnessV1BridgeDebugEvent, type HarnessV1BridgeOutboundMessage, type HarnessV1BridgeReady, type HarnessV1BridgeSandboxLog, type HarnessV1BridgeToolWire, type HarnessV1BuiltinTool, type HarnessV1BuiltinToolFiltering, type HarnessV1BuiltinToolName, type HarnessV1BuiltinToolUseKind, type HarnessV1CallWarning, type HarnessV1ContinueTurnOptions, type HarnessV1ContinueTurnState, type HarnessV1DebugConfig, type HarnessV1DebugLevel, type HarnessV1Diagnostic, type HarnessV1LifecycleState, type HarnessV1Metadata, type HarnessV1NetworkPolicy, type HarnessV1NetworkSandboxSession, type HarnessV1Observability, type HarnessV1PendingToolApproval, type HarnessV1PermissionMode, type HarnessV1Prompt, type HarnessV1PromptControl, type HarnessV1PromptTurnOptions, type HarnessV1ResumeSessionState, type HarnessV1SandboxProvider, type HarnessV1Session, type HarnessV1Skill, type HarnessV1StartOptions, type HarnessV1StreamPart, type HarnessV1ToolSpec, commonTool, getHarnessV1BuiltinToolFilteringDenialReason, harnessV1BridgeAbortInboundSchema, harnessV1BridgeBuiltinToolFilteringSchema, harnessV1BridgeDebugEventSchema, harnessV1BridgeDetachInboundSchema, harnessV1BridgeDetachSchema, harnessV1BridgeHelloSchema, harnessV1BridgeInboundCommandSchemas, harnessV1BridgeOutboundMessageSchema, harnessV1BridgePermissionModeSchema, harnessV1BridgeReadySchema, harnessV1BridgeResumeInboundSchema, harnessV1BridgeSandboxLogSchema, harnessV1BridgeShutdownInboundSchema, harnessV1BridgeStartBaseSchema, harnessV1BridgeThreadSchema, harnessV1BridgeToolApprovalResponseInboundSchema, harnessV1BridgeToolResultInboundSchema, harnessV1BridgeToolWireSchema, harnessV1BridgeUserMessageInboundSchema, harnessV1DebugConfigSchema, harnessV1DebugLevelSchema, harnessV1DiagnosticFromBridgeFrame, harnessV1ErrorPartSchema, harnessV1FileChangePartSchema, harnessV1FinishPartSchema, harnessV1FinishStepPartSchema, harnessV1RawPartSchema, harnessV1ReasoningDeltaPartSchema, harnessV1ReasoningEndPartSchema, harnessV1ReasoningStartPartSchema, harnessV1StreamPartSchema, harnessV1StreamStartPartSchema, harnessV1TextDeltaPartSchema, harnessV1TextEndPartSchema, harnessV1TextStartPartSchema, harnessV1ToolApprovalRequestPartSchema, harnessV1ToolCallPartSchema, harnessV1ToolResultPartSchema, isHarnessV1BuiltinToolIncluded };