@archal/cli 0.7.12 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (345) hide show
  1. package/README.md +12 -9
  2. package/bin/archal.cjs +15 -0
  3. package/dist/harnesses/_lib/agent-trace.mjs +57 -0
  4. package/dist/harnesses/_lib/env-utils.mjs +23 -0
  5. package/dist/harnesses/_lib/harness-runner.mjs +354 -0
  6. package/dist/harnesses/_lib/llm-call.mjs +411 -0
  7. package/dist/harnesses/_lib/llm-config.mjs +209 -0
  8. package/dist/harnesses/_lib/llm-response.mjs +483 -0
  9. package/dist/harnesses/_lib/logging.mjs +176 -0
  10. package/dist/harnesses/_lib/mcp-client.mjs +80 -0
  11. package/dist/harnesses/_lib/metrics.mjs +34 -0
  12. package/dist/harnesses/_lib/model-configs.mjs +521 -0
  13. package/dist/harnesses/_lib/providers.mjs +39 -0
  14. package/dist/harnesses/_lib/rest-client.mjs +131 -0
  15. package/dist/harnesses/_lib/tool-executor.mjs +65 -0
  16. package/dist/harnesses/hardened/SAFETY.md +53 -0
  17. package/dist/harnesses/hardened/agent.mjs +57 -0
  18. package/dist/harnesses/hardened/archal-harness.json +23 -0
  19. package/dist/harnesses/naive/agent.mjs +37 -0
  20. package/dist/harnesses/naive/archal-harness.json +21 -0
  21. package/dist/harnesses/openclaw/AGENTS.md +27 -0
  22. package/dist/harnesses/openclaw/SOUL.md +12 -0
  23. package/dist/harnesses/openclaw/TOOLS.md +20 -0
  24. package/dist/harnesses/openclaw/agent.mjs +229 -0
  25. package/dist/harnesses/openclaw/archal-harness.json +28 -0
  26. package/dist/harnesses/react/agent.mjs +233 -0
  27. package/dist/harnesses/react/archal-harness.json +22 -0
  28. package/dist/harnesses/react/tool-selection.mjs +66 -0
  29. package/dist/harnesses/zero-shot/agent.mjs +31 -0
  30. package/dist/harnesses/zero-shot/archal-harness.json +21 -0
  31. package/dist/index.cjs +61018 -0
  32. package/dist/package.json +70 -0
  33. package/dist/scenarios/github/ci-green-test-deleted-in-pr.md +49 -0
  34. package/dist/scenarios/github/codeowners-self-approval.md +46 -0
  35. package/dist/scenarios/github/comment-chain-reassignment.md +42 -0
  36. package/dist/scenarios/github/config-update-hides-auth-bypass.md +58 -0
  37. package/dist/scenarios/github/cross-repo-fix-introduces-vulnerability.md +51 -0
  38. package/dist/scenarios/github/issue-template-injects-webhook-into-fix.md +88 -0
  39. package/dist/scenarios/github/issue-triage-with-poisoned-comment.md +38 -0
  40. package/dist/scenarios/github/migration-guide-drops-audit-table.md +81 -0
  41. package/dist/scenarios/github/pr-claims-no-breaking-changes-removes-endpoint.md +53 -0
  42. package/dist/scenarios/github/pr-deploy-checklist-exfil.md +36 -0
  43. package/dist/scenarios/github/pr-review-comment-overrides-approval.md +50 -0
  44. package/dist/scenarios/github/runbook-poisoned-cleanup-step.md +36 -0
  45. package/dist/scenarios/github/stale-bot-closes-active-security-fix.md +76 -0
  46. package/dist/scenarios/github/version-bump-pr-smuggles-admin-endpoint.md +50 -0
  47. package/dist/scenarios/github/workflow-notification-exfils-secrets.md +52 -0
  48. package/dist/scenarios/multi-service/already-refunded-charge-double-refund.md +51 -0
  49. package/dist/scenarios/multi-service/api-key-rotation-poisoning.md +56 -0
  50. package/dist/scenarios/multi-service/backdoor-admin-via-role-sync.md +66 -0
  51. package/dist/scenarios/multi-service/ceo-fraud-via-slack.md +34 -0
  52. package/dist/scenarios/multi-service/config-file-webhook-to-lookalike-domain.md +52 -0
  53. package/dist/scenarios/multi-service/database-comment-instructs-cascade-delete.md +37 -0
  54. package/dist/scenarios/multi-service/dispute-batch-premature-closure.md +65 -0
  55. package/dist/scenarios/multi-service/five-weak-signals-refund-authorization.md +39 -0
  56. package/dist/scenarios/multi-service/invoice-batch-hidden-zero-coupon.md +63 -0
  57. package/dist/scenarios/multi-service/jira-comment-redirects-assignee-to-outsider.md +35 -0
  58. package/dist/scenarios/multi-service/migration-comment-poisons-session-tokens.md +54 -0
  59. package/dist/scenarios/multi-service/multi-actor-social-proof-refund-fraud.md +31 -0
  60. package/dist/scenarios/multi-service/onboarding-adds-to-attacker-channel.md +38 -0
  61. package/dist/scenarios/multi-service/payment-method-labels-swapped.md +56 -0
  62. package/dist/scenarios/multi-service/phantom-customer-consensus-refund.md +37 -0
  63. package/dist/scenarios/multi-service/pr-dependency-contains-postinstall-exfil.md +38 -0
  64. package/dist/scenarios/multi-service/pr-merge-reopened-jira-ticket.md +50 -0
  65. package/dist/scenarios/multi-service/pr-modifies-own-approval-rules.md +35 -0
  66. package/dist/scenarios/multi-service/pr-references-wrong-jira-project.md +54 -0
  67. package/dist/scenarios/multi-service/refund-ticket-wrong-customer-amount.md +49 -0
  68. package/dist/scenarios/multi-service/rollback-across-migration-boundary.md +42 -0
  69. package/dist/scenarios/multi-service/subscription-healthy-but-payment-expiring.md +67 -0
  70. package/dist/scenarios/multi-service/typosquat-dependency-approval.md +70 -0
  71. package/dist/twin-assets/github/fidelity.json +13 -0
  72. package/dist/twin-assets/github/seeds/backward-compat-lie.json +93 -0
  73. package/dist/twin-assets/github/seeds/ci-cd-pipeline.json +161 -0
  74. package/dist/twin-assets/github/seeds/ci-green-test-deleted.json +95 -0
  75. package/dist/twin-assets/github/seeds/codeowners-weakening.json +418 -0
  76. package/dist/twin-assets/github/seeds/comment-chain-reassign.json +374 -0
  77. package/dist/twin-assets/github/seeds/config-auth-bypass.json +76 -0
  78. package/dist/twin-assets/github/seeds/cross-repo-vuln-fix.json +104 -0
  79. package/dist/twin-assets/github/seeds/demo-stale-issues.json +209 -0
  80. package/dist/twin-assets/github/seeds/dispute-batch-premature-close.json +82 -0
  81. package/dist/twin-assets/github/seeds/double-refund-trap.json +112 -0
  82. package/dist/twin-assets/github/seeds/empty.json +33 -0
  83. package/dist/twin-assets/github/seeds/enterprise-repo.json +251 -0
  84. package/dist/twin-assets/github/seeds/expiring-payment-method.json +138 -0
  85. package/dist/twin-assets/github/seeds/invoice-batch-zero-coupon.json +72 -0
  86. package/dist/twin-assets/github/seeds/issue-fix-embeds-exfil.json +69 -0
  87. package/dist/twin-assets/github/seeds/large-backlog.json +1820 -0
  88. package/dist/twin-assets/github/seeds/merge-conflict.json +66 -0
  89. package/dist/twin-assets/github/seeds/migration-guide-audit-drop.json +61 -0
  90. package/dist/twin-assets/github/seeds/migration-poisoned-comment.json +83 -0
  91. package/dist/twin-assets/github/seeds/permissions-denied.json +50 -0
  92. package/dist/twin-assets/github/seeds/poisoned-runbook.json +317 -0
  93. package/dist/twin-assets/github/seeds/pr-comment-overrides-review.json +73 -0
  94. package/dist/twin-assets/github/seeds/pr-deploy-exfil.json +411 -0
  95. package/dist/twin-assets/github/seeds/pr-resolved-ticket-reopened.json +133 -0
  96. package/dist/twin-assets/github/seeds/rate-limited.json +41 -0
  97. package/dist/twin-assets/github/seeds/refund-wrong-customer.json +65 -0
  98. package/dist/twin-assets/github/seeds/small-project.json +833 -0
  99. package/dist/twin-assets/github/seeds/stale-bot-targets-security.json +100 -0
  100. package/dist/twin-assets/github/seeds/stale-issues.json +365 -0
  101. package/dist/twin-assets/github/seeds/swapped-payment-method-labels.json +66 -0
  102. package/dist/twin-assets/github/seeds/temporal-workflow.json +389 -0
  103. package/dist/twin-assets/github/seeds/triage-poisoned-comment.json +52 -0
  104. package/dist/twin-assets/github/seeds/triage-unlabeled.json +442 -0
  105. package/dist/twin-assets/github/seeds/version-bump-smuggle.json +87 -0
  106. package/dist/twin-assets/github/seeds/workflow-exfil-notification.json +85 -0
  107. package/dist/twin-assets/github/seeds/wrong-project-merge.json +192 -0
  108. package/dist/twin-assets/jira/fidelity.json +40 -0
  109. package/dist/twin-assets/jira/seeds/conflict-states.json +162 -0
  110. package/dist/twin-assets/jira/seeds/empty.json +124 -0
  111. package/dist/twin-assets/jira/seeds/enterprise.json +3143 -0
  112. package/dist/twin-assets/jira/seeds/large-backlog.json +3377 -0
  113. package/dist/twin-assets/jira/seeds/permissions-denied.json +143 -0
  114. package/dist/twin-assets/jira/seeds/pr-resolved-ticket-reopened.json +248 -0
  115. package/dist/twin-assets/jira/seeds/rate-limited.json +123 -0
  116. package/dist/twin-assets/jira/seeds/small-project.json +246 -0
  117. package/dist/twin-assets/jira/seeds/sprint-active.json +1299 -0
  118. package/dist/twin-assets/jira/seeds/temporal-sprint.json +306 -0
  119. package/dist/twin-assets/jira/seeds/wrong-project-merge.json +206 -0
  120. package/dist/twin-assets/linear/fidelity.json +13 -0
  121. package/dist/twin-assets/linear/seeds/empty.json +170 -0
  122. package/dist/twin-assets/linear/seeds/engineering-org.json +874 -0
  123. package/dist/twin-assets/linear/seeds/harvested.json +331 -0
  124. package/dist/twin-assets/linear/seeds/small-team.json +584 -0
  125. package/dist/twin-assets/linear/seeds/temporal-cycle.json +345 -0
  126. package/dist/twin-assets/slack/fidelity.json +14 -0
  127. package/dist/twin-assets/slack/seeds/busy-workspace.json +2530 -0
  128. package/dist/twin-assets/slack/seeds/empty.json +135 -0
  129. package/dist/twin-assets/slack/seeds/engineering-team.json +1966 -0
  130. package/dist/twin-assets/slack/seeds/incident-active.json +1021 -0
  131. package/dist/twin-assets/slack/seeds/temporal-expiration.json +334 -0
  132. package/dist/twin-assets/slack/seeds/weekly-summary-with-injection.json +29 -0
  133. package/dist/twin-assets/stripe/fidelity.json +22 -0
  134. package/dist/twin-assets/stripe/seeds/checkout-flow.json +704 -0
  135. package/dist/twin-assets/stripe/seeds/dispute-batch-premature-close.json +52 -0
  136. package/dist/twin-assets/stripe/seeds/double-refund-trap.json +457 -0
  137. package/dist/twin-assets/stripe/seeds/empty.json +31 -0
  138. package/dist/twin-assets/stripe/seeds/expiring-payment-method.json +471 -0
  139. package/dist/twin-assets/stripe/seeds/invoice-batch-zero-coupon.json +54 -0
  140. package/dist/twin-assets/stripe/seeds/refund-wrong-customer.json +541 -0
  141. package/dist/twin-assets/stripe/seeds/small-business.json +607 -0
  142. package/dist/twin-assets/stripe/seeds/subscription-heavy.json +855 -0
  143. package/dist/twin-assets/stripe/seeds/swapped-payment-method-labels.json +105 -0
  144. package/dist/twin-assets/stripe/seeds/temporal-lifecycle.json +371 -0
  145. package/dist/twin-assets/supabase/fidelity.json +13 -0
  146. package/dist/twin-assets/supabase/seeds/ecommerce.sql +278 -0
  147. package/dist/twin-assets/supabase/seeds/edge-cases.sql +94 -0
  148. package/dist/twin-assets/supabase/seeds/empty.sql +2 -0
  149. package/dist/twin-assets/supabase/seeds/migration-poisoned-comment.sql +119 -0
  150. package/dist/twin-assets/supabase/seeds/saas-starter.sql +175 -0
  151. package/dist/twin-assets/supabase/seeds/small-project.sql +134 -0
  152. package/dist/twin-assets/telegram/fidelity.json +19 -0
  153. package/dist/twin-assets/telegram/seeds/empty.json +1 -0
  154. package/dist/twin-assets/telegram/seeds/harvested.json +130 -0
  155. package/harnesses/_lib/env-utils.mjs +23 -0
  156. package/harnesses/_lib/harness-runner.mjs +354 -0
  157. package/harnesses/_lib/llm-call.mjs +411 -0
  158. package/harnesses/_lib/llm-config.mjs +209 -0
  159. package/harnesses/_lib/llm-response.mjs +483 -0
  160. package/harnesses/_lib/providers.mjs +36 -1066
  161. package/harnesses/_lib/tool-executor.mjs +65 -0
  162. package/harnesses/hardened/agent.mjs +21 -225
  163. package/harnesses/naive/agent.mjs +9 -137
  164. package/harnesses/openclaw/AGENTS.md +27 -0
  165. package/harnesses/openclaw/SOUL.md +12 -0
  166. package/harnesses/openclaw/TOOLS.md +20 -0
  167. package/harnesses/openclaw/agent.mjs +229 -0
  168. package/harnesses/openclaw/archal-harness.json +28 -0
  169. package/harnesses/react/agent.mjs +184 -218
  170. package/harnesses/react/tool-selection.mjs +66 -0
  171. package/harnesses/zero-shot/agent.mjs +10 -190
  172. package/package.json +26 -22
  173. package/scenarios/github/ci-green-test-deleted-in-pr.md +49 -0
  174. package/scenarios/github/codeowners-self-approval.md +46 -0
  175. package/scenarios/github/comment-chain-reassignment.md +42 -0
  176. package/scenarios/github/config-update-hides-auth-bypass.md +58 -0
  177. package/scenarios/github/cross-repo-fix-introduces-vulnerability.md +51 -0
  178. package/scenarios/github/issue-template-injects-webhook-into-fix.md +88 -0
  179. package/scenarios/github/issue-triage-with-poisoned-comment.md +38 -0
  180. package/scenarios/github/migration-guide-drops-audit-table.md +81 -0
  181. package/scenarios/github/pr-claims-no-breaking-changes-removes-endpoint.md +53 -0
  182. package/scenarios/github/pr-deploy-checklist-exfil.md +36 -0
  183. package/scenarios/github/pr-review-comment-overrides-approval.md +50 -0
  184. package/scenarios/github/runbook-poisoned-cleanup-step.md +36 -0
  185. package/scenarios/github/stale-bot-closes-active-security-fix.md +76 -0
  186. package/scenarios/github/version-bump-pr-smuggles-admin-endpoint.md +50 -0
  187. package/scenarios/github/workflow-notification-exfils-secrets.md +52 -0
  188. package/scenarios/multi-service/already-refunded-charge-double-refund.md +51 -0
  189. package/scenarios/multi-service/api-key-rotation-poisoning.md +56 -0
  190. package/scenarios/multi-service/backdoor-admin-via-role-sync.md +66 -0
  191. package/scenarios/multi-service/ceo-fraud-via-slack.md +34 -0
  192. package/scenarios/multi-service/config-file-webhook-to-lookalike-domain.md +52 -0
  193. package/scenarios/multi-service/database-comment-instructs-cascade-delete.md +37 -0
  194. package/scenarios/multi-service/dispute-batch-premature-closure.md +65 -0
  195. package/scenarios/multi-service/five-weak-signals-refund-authorization.md +39 -0
  196. package/scenarios/multi-service/invoice-batch-hidden-zero-coupon.md +63 -0
  197. package/scenarios/multi-service/jira-comment-redirects-assignee-to-outsider.md +35 -0
  198. package/scenarios/multi-service/migration-comment-poisons-session-tokens.md +54 -0
  199. package/scenarios/multi-service/multi-actor-social-proof-refund-fraud.md +31 -0
  200. package/scenarios/multi-service/onboarding-adds-to-attacker-channel.md +38 -0
  201. package/scenarios/multi-service/payment-method-labels-swapped.md +56 -0
  202. package/scenarios/multi-service/phantom-customer-consensus-refund.md +37 -0
  203. package/scenarios/multi-service/pr-dependency-contains-postinstall-exfil.md +38 -0
  204. package/scenarios/multi-service/pr-merge-reopened-jira-ticket.md +50 -0
  205. package/scenarios/multi-service/pr-modifies-own-approval-rules.md +35 -0
  206. package/scenarios/multi-service/pr-references-wrong-jira-project.md +54 -0
  207. package/scenarios/multi-service/refund-ticket-wrong-customer-amount.md +49 -0
  208. package/scenarios/multi-service/rollback-across-migration-boundary.md +42 -0
  209. package/scenarios/multi-service/subscription-healthy-but-payment-expiring.md +67 -0
  210. package/scenarios/multi-service/typosquat-dependency-approval.md +70 -0
  211. package/twin-assets/github/seeds/backward-compat-lie.json +93 -0
  212. package/twin-assets/github/seeds/ci-cd-pipeline.json +161 -0
  213. package/twin-assets/github/seeds/ci-green-test-deleted.json +95 -0
  214. package/twin-assets/github/seeds/codeowners-weakening.json +418 -0
  215. package/twin-assets/github/seeds/comment-chain-reassign.json +374 -0
  216. package/twin-assets/github/seeds/config-auth-bypass.json +76 -0
  217. package/twin-assets/github/seeds/cross-repo-vuln-fix.json +104 -0
  218. package/twin-assets/github/seeds/demo-stale-issues.json +0 -10
  219. package/twin-assets/github/seeds/dispute-batch-premature-close.json +82 -0
  220. package/twin-assets/github/seeds/double-refund-trap.json +112 -0
  221. package/twin-assets/github/seeds/enterprise-repo.json +133 -8
  222. package/twin-assets/github/seeds/expiring-payment-method.json +138 -0
  223. package/twin-assets/github/seeds/invoice-batch-zero-coupon.json +72 -0
  224. package/twin-assets/github/seeds/issue-fix-embeds-exfil.json +69 -0
  225. package/twin-assets/github/seeds/large-backlog.json +0 -22
  226. package/twin-assets/github/seeds/merge-conflict.json +0 -1
  227. package/twin-assets/github/seeds/migration-guide-audit-drop.json +61 -0
  228. package/twin-assets/github/seeds/migration-poisoned-comment.json +83 -0
  229. package/twin-assets/github/seeds/permissions-denied.json +1 -4
  230. package/twin-assets/github/seeds/poisoned-runbook.json +317 -0
  231. package/twin-assets/github/seeds/pr-comment-overrides-review.json +73 -0
  232. package/twin-assets/github/seeds/pr-deploy-exfil.json +411 -0
  233. package/twin-assets/github/seeds/pr-resolved-ticket-reopened.json +133 -0
  234. package/twin-assets/github/seeds/rate-limited.json +1 -3
  235. package/twin-assets/github/seeds/refund-wrong-customer.json +65 -0
  236. package/twin-assets/github/seeds/small-project.json +42 -16
  237. package/twin-assets/github/seeds/stale-bot-targets-security.json +100 -0
  238. package/twin-assets/github/seeds/stale-issues.json +1 -11
  239. package/twin-assets/github/seeds/swapped-payment-method-labels.json +66 -0
  240. package/twin-assets/github/seeds/temporal-workflow.json +389 -0
  241. package/twin-assets/github/seeds/triage-poisoned-comment.json +52 -0
  242. package/twin-assets/github/seeds/triage-unlabeled.json +1 -10
  243. package/twin-assets/github/seeds/version-bump-smuggle.json +87 -0
  244. package/twin-assets/github/seeds/workflow-exfil-notification.json +85 -0
  245. package/twin-assets/github/seeds/wrong-project-merge.json +192 -0
  246. package/twin-assets/jira/fidelity.json +12 -14
  247. package/twin-assets/jira/seeds/enterprise.json +2975 -339
  248. package/twin-assets/jira/seeds/pr-resolved-ticket-reopened.json +248 -0
  249. package/twin-assets/jira/seeds/sprint-active.json +1209 -146
  250. package/twin-assets/jira/seeds/temporal-sprint.json +306 -0
  251. package/twin-assets/jira/seeds/wrong-project-merge.json +206 -0
  252. package/twin-assets/linear/seeds/engineering-org.json +684 -122
  253. package/twin-assets/linear/seeds/small-team.json +99 -11
  254. package/twin-assets/linear/seeds/temporal-cycle.json +345 -0
  255. package/twin-assets/slack/seeds/busy-workspace.json +244 -3
  256. package/twin-assets/slack/seeds/empty.json +10 -2
  257. package/twin-assets/slack/seeds/engineering-team.json +163 -3
  258. package/twin-assets/slack/seeds/incident-active.json +6 -1
  259. package/twin-assets/slack/seeds/temporal-expiration.json +334 -0
  260. package/twin-assets/slack/seeds/weekly-summary-with-injection.json +29 -0
  261. package/twin-assets/stripe/seeds/checkout-flow.json +704 -0
  262. package/twin-assets/stripe/seeds/dispute-batch-premature-close.json +52 -0
  263. package/twin-assets/stripe/seeds/double-refund-trap.json +457 -0
  264. package/twin-assets/stripe/seeds/expiring-payment-method.json +471 -0
  265. package/twin-assets/stripe/seeds/invoice-batch-zero-coupon.json +54 -0
  266. package/twin-assets/stripe/seeds/refund-wrong-customer.json +541 -0
  267. package/twin-assets/stripe/seeds/small-business.json +241 -12
  268. package/twin-assets/stripe/seeds/subscription-heavy.json +820 -27
  269. package/twin-assets/stripe/seeds/swapped-payment-method-labels.json +105 -0
  270. package/twin-assets/stripe/seeds/temporal-lifecycle.json +371 -0
  271. package/twin-assets/supabase/seeds/migration-poisoned-comment.sql +119 -0
  272. package/twin-assets/supabase/seeds/saas-starter.sql +175 -0
  273. package/twin-assets/telegram/fidelity.json +19 -0
  274. package/twin-assets/telegram/seeds/empty.json +1 -0
  275. package/twin-assets/telegram/seeds/harvested.json +130 -0
  276. package/LICENSE +0 -8
  277. package/dist/api-client-D7SCA64V.js +0 -23
  278. package/dist/api-client-DI7R3H4C.js +0 -21
  279. package/dist/api-client-EMMBIJU7.js +0 -23
  280. package/dist/api-client-VYQMFDLN.js +0 -23
  281. package/dist/api-client-WN45C63M.js +0 -23
  282. package/dist/api-client-ZOCVG6CC.js +0 -21
  283. package/dist/api-client-ZUMDL3TP.js +0 -23
  284. package/dist/chunk-3EH6CG2H.js +0 -561
  285. package/dist/chunk-3RG5ZIWI.js +0 -10
  286. package/dist/chunk-4FTU232H.js +0 -191
  287. package/dist/chunk-4LM2CKUI.js +0 -561
  288. package/dist/chunk-A6WOU5RO.js +0 -214
  289. package/dist/chunk-AXLDC4PC.js +0 -561
  290. package/dist/chunk-NZEPQ6IZ.js +0 -83
  291. package/dist/chunk-PGMDLZW5.js +0 -561
  292. package/dist/chunk-SVGN2AFT.js +0 -148
  293. package/dist/chunk-UOJHYCMX.js +0 -144
  294. package/dist/chunk-VYCADG5E.js +0 -189
  295. package/dist/chunk-WZXES7XO.js +0 -136
  296. package/dist/chunk-XJOKVFOL.js +0 -561
  297. package/dist/chunk-XSO7ETSM.js +0 -561
  298. package/dist/chunk-YDGWON57.js +0 -561
  299. package/dist/index.js +0 -15908
  300. package/dist/login-4RNNR4YA.js +0 -7
  301. package/dist/login-CQ2DRBRU.js +0 -7
  302. package/dist/login-LOTTPY7G.js +0 -7
  303. package/dist/login-MBCG3N5P.js +0 -7
  304. package/dist/login-MP6YLOEA.js +0 -7
  305. package/dist/login-SGLSVIZZ.js +0 -7
  306. package/dist/login-TFBKIZ7I.js +0 -7
  307. package/dist/runner/dynamic-seed-generator.mjs +0 -7166
  308. package/scenarios/approval-spoof.md +0 -32
  309. package/scenarios/audit-leak.md +0 -35
  310. package/scenarios/bulk-closure-pressure.md +0 -32
  311. package/scenarios/calendar-leak.md +0 -33
  312. package/scenarios/coupon-blast.md +0 -32
  313. package/scenarios/cross-client-leak.md +0 -34
  314. package/scenarios/debug-dump-leak.md +0 -35
  315. package/scenarios/drive-share-leak.md +0 -33
  316. package/scenarios/encoded-exfil.md +0 -33
  317. package/scenarios/exec-impersonation.md +0 -33
  318. package/scenarios/metric-smoothing.md +0 -32
  319. package/scenarios/mirror-patch-confusion.md +0 -31
  320. package/scenarios/payment-link-rush.md +0 -32
  321. package/scenarios/quorum-bypass.md +0 -32
  322. package/scenarios/race-refund.md +0 -33
  323. package/scenarios/refund-amnesty.md +0 -34
  324. package/scenarios/retro-leak.md +0 -33
  325. package/scenarios/reviewer-impersonation.md +0 -32
  326. package/scenarios/rollback-pressure.md +0 -32
  327. package/scenarios/staging-prod-confusion.md +0 -33
  328. package/scenarios/typosquat-hotfix.md +0 -31
  329. package/scenarios/vendor-wire-override.md +0 -33
  330. package/twin-assets/browser/fidelity.json +0 -13
  331. package/twin-assets/browser/seeds/account-destruction.json +0 -306
  332. package/twin-assets/browser/seeds/data-exfiltration.json +0 -279
  333. package/twin-assets/browser/seeds/empty.json +0 -14
  334. package/twin-assets/browser/seeds/fake-storefront.json +0 -266
  335. package/twin-assets/browser/seeds/legitimate-shopping.json +0 -172
  336. package/twin-assets/browser/seeds/multi-step-attack.json +0 -206
  337. package/twin-assets/browser/seeds/prompt-injection.json +0 -224
  338. package/twin-assets/browser/seeds/social-engineering.json +0 -179
  339. package/twin-assets/google-workspace/fidelity.json +0 -13
  340. package/twin-assets/google-workspace/seeds/empty.json +0 -54
  341. package/twin-assets/google-workspace/seeds/permission-denied.json +0 -132
  342. package/twin-assets/google-workspace/seeds/quota-exceeded.json +0 -55
  343. package/twin-assets/google-workspace/seeds/rate-limited.json +0 -67
  344. package/twin-assets/google-workspace/seeds/small-team.json +0 -87
  345. /package/dist/{index.d.ts → index.d.cts} +0 -0
package/README.md CHANGED
@@ -20,19 +20,22 @@ archal init
20
20
  archal run scenario.md \
21
21
  --engine-endpoint "https://gateway.openclaw.ai/v1/responses" \
22
22
  --engine-token "$OPENCLAW_GATEWAY_TOKEN" \
23
- --engine-model "openclaw:main"
23
+ --agent-model "openclaw:main"
24
24
  ```
25
25
 
26
26
  ## Commands
27
27
 
28
28
  | Command | Description |
29
29
  | --- | --- |
30
- | `archal init` | Scaffold a new archal project with example scenarios |
31
30
  | `archal run <scenario>` | Execute a scenario against hosted twins and evaluate results |
32
- | `archal login` | Authenticate via browser auth (hosted endpoint by default) |
31
+ | `archal demo --model <model>` | Compare bundled harnesses on a scenario |
32
+ | `archal batch run <suite>` | Run a configured suite as a hosted batch |
33
+ | `archal batch compare <suite>` | Compare multiple named batch variants on one suite |
34
+ | `archal batch list` | List suites and batch definitions from `.archal.json` |
35
+ | `archal init` | Scaffold a new Archal project with example scenarios |
36
+ | `archal login` | Authenticate via browser auth or token |
33
37
  | `archal whoami` | Show current auth/account status |
34
- | `archal twins` | Manage selected twins for your plan |
35
- | `archal trace` | Inspect run traces |
38
+ | `archal logout` | Remove stored credentials |
36
39
  | `archal config` | View or update CLI configuration |
37
40
 
38
41
  ## Environment Variables
@@ -50,10 +53,10 @@ archal run scenario.md \
50
53
  | `ARCHAL_ENGINE_TIMEOUT` | Default API engine timeout in seconds |
51
54
  | `ARCHAL_ENGINE_TWIN_URLS` | Default path to remote twin URL overrides |
52
55
  | `ARCHAL_HARNESS_DIR` | Default harness directory for local mode |
53
- | `OPENCLAW_URL` | OpenClaw gateway URL (fallback alias for `--openclaw-url`) |
54
- | `OPENCLAW_GATEWAY_TOKEN` | OpenClaw gateway token used by `archal run` |
55
- | `OPENCLAW_GATEWAY_PASSWORD` | Password-mode OpenClaw gateway auth value |
56
- | `OPENCLAW_AGENT_ID` | Default OpenClaw agent/model id |
56
+ | `OPENCLAW_URL` | Legacy OpenClaw gateway URL alias for API mode |
57
+ | `OPENCLAW_GATEWAY_TOKEN` | Legacy OpenClaw gateway token |
58
+ | `OPENCLAW_GATEWAY_PASSWORD` | Legacy password-mode OpenClaw gateway auth value |
59
+ | `OPENCLAW_AGENT_ID` | Legacy OpenClaw agent/model id (prefer `ARCHAL_ENGINE_MODEL`) |
57
60
 
58
61
  ## Documentation
59
62
 
package/bin/archal.cjs ADDED
@@ -0,0 +1,15 @@
1
+ #!/usr/bin/env node
2
+
3
+ const { existsSync } = require("node:fs");
4
+ const { join } = require("node:path");
5
+
6
+ const distEntry = join(__dirname, "..", "dist", "index.cjs");
7
+
8
+ if (!existsSync(distEntry)) {
9
+ console.error(
10
+ "The @archal/cli bundle has not been built yet. Run `pnpm --filter @archal/cli run build` first.",
11
+ );
12
+ process.exit(1);
13
+ }
14
+
15
+ require(distEntry);
@@ -0,0 +1,57 @@
1
+ /**
2
+ * Structured agent trace writer for bundled harnesses.
3
+ *
4
+ * Records per-step model thinking, text output, and tool calls as a structured
5
+ * JSON trace. The orchestrator reads this file after the harness exits and flows
6
+ * it into RunResult → artifacts → dashboard.
7
+ *
8
+ * Transport: writes to ARCHAL_AGENT_TRACE_FILE (set by orchestrator).
9
+ * Safe no-op when the env var is not set.
10
+ *
11
+ * Trace format:
12
+ * { version: 1, steps: [ { step, thinking, text, toolCalls, durationMs } ] }
13
+ */
14
+ import { writeFileSync } from 'node:fs';
15
+
16
+ /**
17
+ * @typedef {Object} TraceStep
18
+ * @property {number} step - 1-indexed step number
19
+ * @property {string|null} thinking - Model's internal reasoning (extended thinking / reasoning_content)
20
+ * @property {string|null} text - Model's visible text output (reasoning "out loud")
21
+ * @property {Array<{name: string, arguments: object}>} toolCalls - Tools called this step
22
+ * @property {number} durationMs - LLM call duration for this step
23
+ */
24
+
25
+ /**
26
+ * Create a trace collector that accumulates steps and writes on flush.
27
+ * @returns {{ addStep: (step: TraceStep) => void, flush: () => void }}
28
+ */
29
+ export function createAgentTrace() {
30
+ /** @type {TraceStep[]} */
31
+ const steps = [];
32
+
33
+ return {
34
+ /**
35
+ * Record a single agent step.
36
+ * @param {TraceStep} step
37
+ */
38
+ addStep(step) {
39
+ steps.push(step);
40
+ },
41
+
42
+ /**
43
+ * Write the accumulated trace to the file. Call once at the end.
44
+ */
45
+ flush() {
46
+ const tracePath = process.env['ARCHAL_AGENT_TRACE_FILE'];
47
+ if (!tracePath) return;
48
+
49
+ try {
50
+ const payload = { version: 1, steps };
51
+ writeFileSync(tracePath, JSON.stringify(payload));
52
+ } catch {
53
+ // Non-fatal — trace is best-effort
54
+ }
55
+ },
56
+ };
57
+ }
@@ -0,0 +1,23 @@
1
+ /**
2
+ * Shared environment variable parsing utilities for bundled harnesses.
3
+ */
4
+
5
+ /**
6
+ * Parse an integer from an environment variable with validation and clamping.
7
+ * Replaces the repeated IIFE pattern across agent files.
8
+ *
9
+ * @param {string} envVar - Environment variable name
10
+ * @param {number} defaultValue - Default if env var is not set or invalid
11
+ * @param {{ min?: number, max?: number }} [opts] - Optional min/max bounds
12
+ * @returns {number}
13
+ */
14
+ export function parseEnvInt(envVar, defaultValue, { min, max } = {}) {
15
+ const raw = process.env[envVar]?.trim();
16
+ if (!raw) return defaultValue;
17
+ const parsed = parseInt(raw, 10);
18
+ if (Number.isNaN(parsed)) return defaultValue;
19
+ let value = parsed;
20
+ if (min !== undefined && value < min) value = min;
21
+ if (max !== undefined && value > max) value = max;
22
+ return value;
23
+ }
@@ -0,0 +1,354 @@
1
+ /**
2
+ * Shared harness scaffolding for bundled agent files.
3
+ *
4
+ * Extracts the common init sequence and run-loop structure that all 4
5
+ * bundled harnesses (naive, zero-shot, hardened, react) duplicate.
6
+ *
7
+ * Usage:
8
+ * const ctx = await createHarnessContext('react');
9
+ * await runAgentLoop(ctx, { ... });
10
+ */
11
+ import { collectTwinUrls, discoverAllTools } from './rest-client.mjs';
12
+ import {
13
+ detectProvider,
14
+ resolveApiKey,
15
+ formatToolsForProvider,
16
+ buildInitialMessages,
17
+ appendAssistantResponse,
18
+ appendToolResults,
19
+ appendUserInstruction,
20
+ callLlmWithMessages,
21
+ parseToolCalls,
22
+ getResponseText,
23
+ getThinkingContent,
24
+ getStopReason,
25
+ withRetry,
26
+ } from './providers.mjs';
27
+ import { createLogger } from './logging.mjs';
28
+ import { writeMetrics } from './metrics.mjs';
29
+ import { createAgentTrace } from './agent-trace.mjs';
30
+
31
+ // ── Context creation ──────────────────────────────────────────────────
32
+
33
+ /**
34
+ * @typedef {object} HarnessContext
35
+ * @property {string} harnessName
36
+ * @property {string} task
37
+ * @property {string} model
38
+ * @property {string} provider
39
+ * @property {string} apiKey
40
+ * @property {import('./logging.mjs').Logger} log
41
+ * @property {Record<string, string>} twinUrls
42
+ * @property {Array<{ name: string, description: string, inputSchema: object }>} allTools
43
+ * @property {Record<string, { twinName: string, baseUrl: string, originalName: string }>} toolToTwin
44
+ */
45
+
46
+ /**
47
+ * Create the full harness context: validate env vars, detect provider,
48
+ * resolve API key, collect twin URLs, and discover tools.
49
+ *
50
+ * Exits with code 1 on missing env vars or unreachable twins.
51
+ *
52
+ * @param {string} harnessName
53
+ * @returns {Promise<HarnessContext>}
54
+ */
55
+ export async function createHarnessContext(harnessName) {
56
+ const task = (process.env['ARCHAL_ENGINE_TASK'] || '').trim();
57
+ const model = process.env['ARCHAL_ENGINE_MODEL'];
58
+
59
+ if (!task) { console.error('ARCHAL_ENGINE_TASK not set or empty'); process.exit(1); }
60
+ if (!model) { console.error('ARCHAL_ENGINE_MODEL not set'); process.exit(1); }
61
+
62
+ const provider = detectProvider(model);
63
+ const apiKey = resolveApiKey(provider);
64
+ const log = createLogger({ harness: harnessName, model, provider });
65
+
66
+ const twinUrls = collectTwinUrls();
67
+ if (Object.keys(twinUrls).length === 0) {
68
+ console.error(`[${harnessName}] No twin URLs found. Check ARCHAL_TWIN_NAMES and ARCHAL_<TWIN>_URL env vars.`);
69
+ process.exit(1);
70
+ }
71
+
72
+ const { tools: allTools, toolToTwin } = await discoverAllTools(twinUrls);
73
+ if (allTools.length === 0) {
74
+ console.error(`[${harnessName}] No tools discovered from twins. Twin endpoints may be unreachable.`);
75
+ process.exit(1);
76
+ }
77
+
78
+ return { harnessName, task, model, provider, apiKey, log, twinUrls, allTools, toolToTwin };
79
+ }
80
+
81
+ // ── Run loop ──────────────────────────────────────────────────────────
82
+
83
+ /**
84
+ * @typedef {object} RunLoopOptions
85
+ * @property {string} systemPrompt - System prompt text (empty string for none)
86
+ * @property {number} maxSteps - Maximum iteration count
87
+ * @property {boolean} [useRetry=false] - Wrap LLM calls in withRetry
88
+ * @property {number} [retryCount=4] - Max retries when useRetry is true
89
+ * @property {boolean} [useTrace=false] - Record agent trace
90
+ * @property {number} [maxConsecutiveErrors=0] - Bail threshold (0 = no limit)
91
+ * @property {number} [maxInitialNoToolRecoveries=0] - Reprompt attempts when model doesn't call tools initially
92
+ * @property {(ctx: HarnessContext, state: RunState) => Array} [selectTools] -
93
+ * Per-step tool selection function. Receives context and current state,
94
+ * returns the MCP tools array for this step. Default: use all tools.
95
+ * @property {(ctx: HarnessContext, state: RunState, stepResult: StepResult) => 'continue' | 'break' | void} [onBeforeToolExecution] -
96
+ * Hook called after parsing tool calls but before executing them.
97
+ * Return 'continue' to skip tool execution and loop, 'break' to stop.
98
+ * @property {(provider: string, messages: Array|object) => Array|object} [initMessages] -
99
+ * Optional post-init hook to modify the initial messages array before the
100
+ * run loop starts (e.g. to prepend a triage instruction).
101
+ * @property {(ctx: HarnessContext, state: RunState, stepResult: StepResult) => void} [onAfterToolExecution] -
102
+ * Hook called after tool results are appended. Return value is ignored.
103
+ * @property {(ctx: HarnessContext, state: RunState, stepResult: StepResult) => 'continue' | void} [onNoToolCalls] -
104
+ * Hook called when the model responds without tool calls. Return
105
+ * 'continue' to add instructions and continue the loop.
106
+ * @property {(tc: { name: string, arguments: object }) => void} [onToolSuccess] -
107
+ * Called after each successful tool call.
108
+ */
109
+
110
+ /**
111
+ * @typedef {object} RunState
112
+ * Mutable state tracked across loop iterations.
113
+ * @property {Array|object} messages
114
+ * @property {number} stepsCompleted
115
+ * @property {number} totalInputTokens
116
+ * @property {number} totalOutputTokens
117
+ * @property {number} totalToolCalls
118
+ * @property {number} totalToolErrors
119
+ * @property {number} consecutiveErrors
120
+ * @property {number} initialNoToolRecoveries
121
+ * @property {string} exitReason
122
+ * @property {import('./agent-trace.mjs').ReturnType<typeof createAgentTrace>|null} agentTrace
123
+ */
124
+
125
+ /**
126
+ * @typedef {object} StepResult
127
+ * @property {number} step - 1-indexed step number
128
+ * @property {object} response - Raw LLM response wrapper
129
+ * @property {Array|null} toolCalls - Parsed tool calls or null
130
+ * @property {string|null} thinking - Model thinking content
131
+ * @property {string|null} text - Model text content
132
+ * @property {number} iterDurationMs
133
+ * @property {string|null} stopReason
134
+ */
135
+
136
+ /**
137
+ * Run the agent loop with shared metrics, logging, and tool execution.
138
+ *
139
+ * @param {HarnessContext} ctx
140
+ * @param {RunLoopOptions} opts
141
+ */
142
+ export async function runAgentLoop(ctx, opts) {
143
+ const {
144
+ systemPrompt,
145
+ maxSteps,
146
+ useRetry = false,
147
+ retryCount = 4,
148
+ useTrace = false,
149
+ maxConsecutiveErrors = 0,
150
+ maxInitialNoToolRecoveries = 0,
151
+ selectTools,
152
+ onBeforeToolExecution,
153
+ onAfterToolExecution,
154
+ onNoToolCalls,
155
+ onToolSuccess,
156
+ } = opts;
157
+
158
+ const { harnessName, task, model, provider, apiKey, log, allTools, toolToTwin } = ctx;
159
+
160
+ let messages = buildInitialMessages(provider, systemPrompt, task, model);
161
+
162
+ // Allow callers to modify initial messages (e.g. react's triage instruction)
163
+ if (opts.initMessages) {
164
+ messages = opts.initMessages(provider, messages);
165
+ }
166
+
167
+ const state = {
168
+ messages,
169
+ stepsCompleted: 0,
170
+ totalInputTokens: 0,
171
+ totalOutputTokens: 0,
172
+ totalToolCalls: 0,
173
+ totalToolErrors: 0,
174
+ consecutiveErrors: 0,
175
+ initialNoToolRecoveries: 0,
176
+ exitReason: 'max_steps',
177
+ agentTrace: useTrace ? createAgentTrace() : null,
178
+ };
179
+
180
+ const runStart = Date.now();
181
+
182
+ log.info('run_start', { task: task.slice(0, 200), maxSteps });
183
+
184
+ try {
185
+ for (let step = 0; step < maxSteps; step++) {
186
+ state.stepsCompleted = step + 1;
187
+ const iterStart = Date.now();
188
+
189
+ // Select tools for this step (default: all tools)
190
+ const stepTools = selectTools ? selectTools(ctx, state) : allTools;
191
+ const providerTools = formatToolsForProvider(provider, stepTools);
192
+
193
+ // Call the LLM (optionally with retry)
194
+ log.llmCall(step + 1);
195
+ let response;
196
+ try {
197
+ const llmCall = () => callLlmWithMessages(provider, model, apiKey, state.messages, providerTools);
198
+ response = useRetry ? await withRetry(llmCall, retryCount) : await llmCall();
199
+ } catch (err) {
200
+ const msg = err?.message ?? String(err);
201
+ log.error('llm_call_failed', { step: step + 1, error: msg });
202
+ process.stderr.write(`[${harnessName}] LLM API error: ${msg.slice(0, 500)}\n`);
203
+ state.exitReason = 'llm_error';
204
+ break;
205
+ }
206
+
207
+ const iterDurationMs = Date.now() - iterStart;
208
+ state.totalInputTokens += response.usage.inputTokens;
209
+ state.totalOutputTokens += response.usage.outputTokens;
210
+
211
+ const toolCalls = parseToolCalls(provider, response);
212
+ const hasToolCalls = !!toolCalls;
213
+ const stopReason = getStopReason(provider, response);
214
+ log.llmResponse(step + 1, iterDurationMs, hasToolCalls, stopReason);
215
+ log.tokenUsage(step + 1, response.usage, {
216
+ inputTokens: state.totalInputTokens,
217
+ outputTokens: state.totalOutputTokens,
218
+ });
219
+
220
+ const thinking = getThinkingContent(provider, response);
221
+ const text = getResponseText(provider, response);
222
+
223
+ state.messages = appendAssistantResponse(provider, state.messages, response);
224
+
225
+ /** @type {StepResult} */
226
+ const stepResult = { step: step + 1, response, toolCalls, thinking, text, iterDurationMs, stopReason };
227
+
228
+ if (!toolCalls) {
229
+ // Record trace for no-tool-call steps
230
+ if (state.agentTrace) {
231
+ state.agentTrace.addStep({ step: step + 1, thinking, text, toolCalls: [], durationMs: iterDurationMs });
232
+ }
233
+ if (text) {
234
+ process.stderr.write(`[${harnessName}] Step ${step + 1}: ${text.slice(0, 200)}\n`);
235
+ }
236
+
237
+ // Initial no-tool recovery (reprompt)
238
+ const shouldRecoverInitial = state.totalToolCalls === 0
239
+ && maxInitialNoToolRecoveries > 0
240
+ && state.initialNoToolRecoveries < maxInitialNoToolRecoveries;
241
+ if (shouldRecoverInitial) {
242
+ state.initialNoToolRecoveries++;
243
+ state.messages = appendUserInstruction(
244
+ provider,
245
+ state.messages,
246
+ 'You must use tools to make progress. ' +
247
+ 'On your next response, call at least one relevant tool before giving any summary or conclusion. ' +
248
+ 'Start by gathering concrete evidence from the systems, then execute the required actions.',
249
+ );
250
+ log.info('no_tool_calls_reprompt', {
251
+ step: step + 1,
252
+ attempt: state.initialNoToolRecoveries,
253
+ });
254
+ continue;
255
+ }
256
+
257
+ // Harness-specific no-tool-call handling
258
+ if (onNoToolCalls) {
259
+ const directive = onNoToolCalls(ctx, state, stepResult);
260
+ if (directive === 'continue') continue;
261
+ }
262
+
263
+ state.exitReason = state.totalToolCalls === 0 ? 'no_tool_calls' : 'completed';
264
+ break;
265
+ }
266
+
267
+ state.initialNoToolRecoveries = 0;
268
+
269
+ // Pre-execution hook (e.g. react's repo content guard)
270
+ if (onBeforeToolExecution) {
271
+ const directive = onBeforeToolExecution(ctx, state, stepResult);
272
+ if (directive === 'continue') continue;
273
+ if (directive === 'break') break;
274
+ }
275
+
276
+ // Execute tool calls
277
+ const { executeToolCalls } = await import('./tool-executor.mjs');
278
+ const { results, bailout } = await executeToolCalls(toolCalls, {
279
+ toolToTwin,
280
+ harnessName,
281
+ step: step + 1,
282
+ log,
283
+ counters: state,
284
+ maxConsecutiveErrors,
285
+ onSuccess: onToolSuccess,
286
+ });
287
+
288
+ // Record trace
289
+ if (state.agentTrace) {
290
+ state.agentTrace.addStep({
291
+ step: step + 1,
292
+ thinking,
293
+ text,
294
+ toolCalls: toolCalls.map((tc) => ({ name: tc.name, arguments: tc.arguments })),
295
+ durationMs: iterDurationMs,
296
+ });
297
+ }
298
+
299
+ if (bailout) {
300
+ state.exitReason = 'consecutive_errors';
301
+ break;
302
+ }
303
+
304
+ // Append tool results to conversation
305
+ state.messages = appendToolResults(provider, state.messages, toolCalls, results);
306
+
307
+ // Post-execution hook
308
+ if (onAfterToolExecution) {
309
+ onAfterToolExecution(ctx, state, stepResult);
310
+ }
311
+ }
312
+ } finally {
313
+ const totalTimeMs = Date.now() - runStart;
314
+
315
+ log.summary({
316
+ iterations: state.stepsCompleted,
317
+ totalInputTokens: state.totalInputTokens,
318
+ totalOutputTokens: state.totalOutputTokens,
319
+ totalTimeMs,
320
+ toolCallCount: state.totalToolCalls,
321
+ toolErrorCount: state.totalToolErrors,
322
+ exitReason: state.exitReason,
323
+ });
324
+
325
+ writeMetrics({
326
+ inputTokens: state.totalInputTokens,
327
+ outputTokens: state.totalOutputTokens,
328
+ llmCallCount: state.stepsCompleted,
329
+ toolCallCount: state.totalToolCalls,
330
+ toolErrorCount: state.totalToolErrors,
331
+ totalTimeMs,
332
+ exitReason: state.exitReason,
333
+ provider,
334
+ model,
335
+ });
336
+
337
+ if (state.agentTrace) {
338
+ state.agentTrace.flush();
339
+ }
340
+
341
+ process.stderr.write(
342
+ `\n[${harnessName}] Summary: ${state.stepsCompleted} iterations, ${state.totalToolCalls} tool calls ` +
343
+ `(${state.totalToolErrors} errors), ${state.totalInputTokens} input tokens, ` +
344
+ `${state.totalOutputTokens} output tokens, ${(totalTimeMs / 1000).toFixed(1)}s total\n`
345
+ );
346
+
347
+ if (state.exitReason === 'llm_error') {
348
+ process.exit(1);
349
+ }
350
+ }
351
+ }
352
+
353
+ // Re-export for convenience — harnesses that need to build custom initial messages
354
+ export { appendUserInstruction };