@astrale-os/cli 1.0.0-beta.8 → 1.0.0-npm-deprecated.0

package/studio/server/agent/harness/gateway/config.ts

@@ -1,214 +0,0 @@
-/**
- * gateway/config.ts — point the selected harness at an Anthropic-compatible
- * model gateway (e.g. an Astrale `ai-gateway` model node) instead of Claude
- * Code's built-in auth. Two scopes, layered:
- *   - per-domain : `<domain>/.domain-studio/harness-gateway.json` — AUTHORITATIVE
- *                  when present (its presence is the override, even when disabled).
- *   - global     : `~/.domain-studio/harness-gateway.json` — the studio-wide
- *                  default applied to every domain that has no local override.
- *
- * The config never escapes the studio's spawned child: `harnessGatewayEnv` turns
- * it into ANTHROPIC_* env that runner / ask / loadout merge into the `claude`
- * subprocess env ONLY — never the studio's own process env, the user's shell, or
- * a `claude` they run themselves outside the studio.
- */
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { dirname, join } from 'node:path'
-
-import type {
-  HarnessGatewayAuth,
-  HarnessGatewayConfig,
-  HarnessGatewayState,
-} from '../../../../shared/types'
-
-import { asJsonRecord, asString, parseJson } from '../../../json'
-import { readJson, removeState, statePath, writeJson } from '../../../state/store'
-import { acquireGatewayToken } from './token'
-
-/** Per-domain file (lives under the domain's `.domain-studio/`, gitignored). */
-const LOCAL_FILE = 'harness-gateway.json'
-/** Studio-wide default — a sibling-named hidden dir in the user's home. */
-const GLOBAL_FILE = join(homedir(), '.domain-studio', 'harness-gateway.json')
-
-/** Coerce a wire/disk auth block into a well-formed discriminated union. Default
- *  is `mint` (no secret on disk). A legacy `{ apiKey }` shape maps to `token` mode. */
-function normalizeAuth(input: unknown): HarnessGatewayAuth {
-  const record = asJsonRecord(input)
-  if (record?.mode === 'token' || (record?.token != null && record?.mode == null))
-    return { mode: 'token', token: asString(record.token)?.trim() ?? '' }
-  if (record?.mode === 'host') return { mode: 'host' }
-  const instance = asString(record?.instance)?.trim() ?? ''
-  return { mode: 'mint', ...(instance ? { instance } : {}) }
-}
-
-/** Coerce a wire/disk value into a well-formed config (trim, drop blanks). */
-function normalize(input: unknown): HarnessGatewayConfig {
-  const record = asJsonRecord(input) ?? {}
-  const model = asString(record.model)?.trim() ?? ''
-  // back-compat: a pre-union config stored only `apiKey` → treat as a static token
-  const authInput =
-    record.auth ??
-    (typeof record.apiKey === 'string' ? { mode: 'token', token: record.apiKey } : undefined)
-  return {
-    enabled: record.enabled === true,
-    baseUrl: asString(record.baseUrl)?.trim() ?? '',
-    ...(model ? { model } : {}),
-    auth: normalizeAuth(authInput),
-  }
-}
-
-function decodeConfig(value: unknown): HarnessGatewayConfig | undefined {
-  return asJsonRecord(value) ? normalize(value) : undefined
-}
-
-function validateEnabledConfig(config: HarnessGatewayConfig): void {
-  if (!config.enabled) return
-  if (!config.baseUrl) throw new Error('gateway base URL is required while enabled')
-  let url: URL
-  try {
-    url = new URL(config.baseUrl)
-  } catch {
-    throw new Error(`invalid gateway base URL: ${config.baseUrl}`)
-  }
-  if (url.protocol !== 'http:' && url.protocol !== 'https:')
-    throw new Error('gateway base URL must use http:// or https://')
-  if (config.auth.mode === 'token' && !config.auth.token)
-    throw new Error('gateway static token is required in token mode')
-}
-
-function readLocal(root: string): HarnessGatewayConfig | null {
-  return readJson(root, LOCAL_FILE, decodeConfig, null)
-}
-
-function readGlobal(): HarnessGatewayConfig | null {
-  if (!existsSync(GLOBAL_FILE)) return null
-  return decodeConfig(parseJson(readFileSync(GLOBAL_FILE, 'utf8'))) ?? null
-}
-
-/** Write (or, on null, delete) the global default. Not under any domain root, so
- *  it bypasses the store's domain-scoped write-allowlist by design. */
-function writeGlobal(cfg: HarnessGatewayConfig | null): void {
-  if (cfg === null) {
-    if (existsSync(GLOBAL_FILE)) rmSync(GLOBAL_FILE, { force: true })
-    return
-  }
-  mkdirSync(dirname(GLOBAL_FILE), { recursive: true })
-  writeFileSync(GLOBAL_FILE, JSON.stringify(cfg, null, 2), { mode: 0o600 })
-  chmodSync(GLOBAL_FILE, 0o600)
-}
-
-/** Resolve the layered state. A PRESENT local override wins outright — even when
- *  disabled, which is exactly how you turn the gateway off for one domain despite
- *  a global default. With no local override, the global default applies. */
-export function getHarnessGatewayState(root: string): HarnessGatewayState {
-  const local = readLocal(root)
-  const global = readGlobal()
-  if (local) {
-    return {
-      local,
-      global,
-      effective: local.enabled ? local : null,
-      source: local.enabled ? 'domain' : 'none',
-    }
-  }
-  return {
-    local: null,
-    global,
-    effective: global?.enabled ? global : null,
-    source: global?.enabled ? 'global' : 'none',
-  }
-}
-
-export interface SetHarnessGatewayInput {
-  scope: 'domain' | 'global'
-  config: Partial<HarnessGatewayConfig>
-}
-
-/** Persist the config to the chosen scope. Writing GLOBAL also clears any local
- *  override so this domain (and every un-overridden one) inherits it — that is the
- *  "apply to all domains" intent. */
-export function setHarnessGateway(
-  root: string,
-  input: SetHarnessGatewayInput,
-): HarnessGatewayState {
-  const cfg = normalize(input.config)
-  validateEnabledConfig(cfg)
-  if (input.scope === 'global') {
-    writeGlobal(cfg)
-    removeState(root, LOCAL_FILE)
-  } else {
-    writeJson(root, LOCAL_FILE, cfg)
-    chmodSync(statePath(root, LOCAL_FILE), 0o600)
-  }
-  return getHarnessGatewayState(root)
-}
-
-/** Drop the override at a scope (revert to the layer below / default harness auth). */
-export function clearHarnessGateway(root: string, scope: 'domain' | 'global'): HarnessGatewayState {
-  if (scope === 'global') writeGlobal(null)
-  else removeState(root, LOCAL_FILE)
-  return getHarnessGatewayState(root)
-}
-
-/** The config that takes effect for a domain (or undefined ⇒ default harness auth). */
-export function resolveHarnessGateway(root: string): HarnessGatewayConfig | undefined {
-  return getHarnessGatewayState(root).effective ?? undefined
-}
-
-/** The gateway audience (origin) for a domain's effective config — the token
- *  audience to mint/relay for. Null when no gateway is configured / URL invalid. */
-export function gatewayAudience(root: string): string | null {
-  const cfg = resolveHarnessGateway(root)
-  if (!cfg?.enabled || !cfg.baseUrl) return null
-  try {
-    return new URL(cfg.baseUrl).origin
-  } catch {
-    return null
-  }
-}
-
-/** Either the ANTHROPIC_* env to inject (empty ⇒ no gateway configured), or a
- *  human error when a gateway IS configured but its token can't be obtained — so
- *  callers fail loudly instead of silently falling back to the default Claude auth. */
-export type HarnessEnvResult =
-  | { ok: true; env: Record<string, string> }
-  | { ok: false; error: string }
-
-/**
- * Resolve the ANTHROPIC_* env for a domain's harness child. Derives the gateway
- * audience from the URL, acquires the bearer token per auth mode (mint / static /
- * host-supplied), and sets `ANTHROPIC_AUTH_TOKEN` (Authorization: Bearer — the
- * custom-gateway path, which sidesteps the x-api-key approval prompt) plus the
- * model labels. The Astrale gateway pins the real model by URL, so `model` is
- * only for display.
- */
-export async function resolveHarnessEnv(root: string): Promise<HarnessEnvResult> {
-  const cfg = resolveHarnessGateway(root)
-  if (!cfg || !cfg.enabled) return { ok: true, env: {} }
-  if (!cfg.baseUrl) return { ok: false, error: 'gateway base URL is required while enabled' }
-  let audience: string
-  try {
-    const url = new URL(cfg.baseUrl)
-    if (url.protocol !== 'http:' && url.protocol !== 'https:')
-      return { ok: false, error: 'gateway base URL must use http:// or https://' }
-    audience = url.origin
-  } catch {
-    return { ok: false, error: `invalid gateway base URL: ${cfg.baseUrl}` }
-  }
-  let token: string
-  try {
-    token = await acquireGatewayToken(cfg, audience)
-  } catch (e) {
-    return { ok: false, error: (e as Error)?.message ?? String(e) }
-  }
-  const env: Record<string, string> = {
-    ANTHROPIC_BASE_URL: cfg.baseUrl,
-    ANTHROPIC_AUTH_TOKEN: token,
-  }
-  if (cfg.model) {
-    env.ANTHROPIC_MODEL = cfg.model
-    env.ANTHROPIC_SMALL_FAST_MODEL = cfg.model
-  }
-  return { ok: true, env }
-}

package/studio/server/agent/harness/gateway/token.test.ts

@@ -1,133 +0,0 @@
-import { expect, test } from 'bun:test'
-
-import { HarnessTokenBroker, HarnessTokenError } from './token'
-
-function jwt(audience: string, expiresAtMs = Date.now() + 3_600_000): string {
-  const header = Buffer.from(JSON.stringify({ alg: 'none' })).toString('base64url')
-  const payload = Buffer.from(
-    JSON.stringify({ aud: audience, exp: Math.floor(expiresAtMs / 1000) }),
-  ).toString('base64url')
-  return `${header}.${payload}.signature`
-}
-
-test('resolves static and audience-bound host-relayed gateway tokens', async () => {
-  const broker = new HarnessTokenBroker()
-  expect(
-    await broker.acquireGatewayToken(
-      {
-        enabled: true,
-        baseUrl: 'https://gateway.example',
-        auth: { mode: 'token', token: ' x ' },
-      },
-      'https://gateway.example',
-    ),
-  ).toBe('x')
-
-  const audience = 'https://host.example'
-  const token = jwt(audience)
-  expect(broker.setHostToken(audience, token)).toBe(true)
-  expect(broker.setHostToken(audience, jwt('https://other.example'))).toBe(false)
-  expect(
-    await broker.acquireGatewayToken(
-      { enabled: true, baseUrl: audience, auth: { mode: 'host' } },
-      audience,
-    ),
-  ).toBe(token)
-})
-
-test('reports a missing host relay as the concrete typed failure', async () => {
-  expect.assertions(2)
-  const broker = new HarnessTokenBroker()
-  try {
-    await broker.acquireGatewayToken(
-      {
-        enabled: true,
-        baseUrl: 'https://missing.example',
-        auth: { mode: 'host' },
-      },
-      'https://missing.example',
-    )
-  } catch (error) {
-    expect(error).toBeInstanceOf(HarnessTokenError)
-    expect((error as HarnessTokenError).kind).toBe('host-token-needed')
-  }
-})
-
-test('mints with the exact audience and instance, caches, and coalesces concurrent callers', async () => {
-  const calls: { args: string[]; timeoutMs?: number }[] = []
-  const audience = 'https://gateway.example'
-  const token = jwt(audience)
-  const broker = new HarnessTokenBroker({
-    capture: async (_bin, args, _cwd, options) => {
-      calls.push({ args, timeoutMs: options?.timeoutMs })
-      await Promise.resolve()
-      return { code: 0, stdout: `${token}\n`, stderr: '' }
-    },
-  })
-  const config = {
-    enabled: true,
-    baseUrl: audience,
-    auth: { mode: 'mint' as const, instance: 'prod' },
-  }
-
-  expect(
-    await Promise.all([
-      broker.acquireGatewayToken(config, audience),
-      broker.acquireGatewayToken(config, audience),
-    ]),
-  ).toEqual([token, token])
-  expect(await broker.acquireGatewayToken(config, audience)).toBe(token)
-  expect(calls).toEqual([
-    {
-      args: ['token', '--audience', audience, '--ttl', '3600', '--raw', '-i', 'prod'],
-      timeoutMs: 12_000,
-    },
-  ])
-})
-
-test('isolates mint caches by audience and instance', async () => {
-  let calls = 0
-  const broker = new HarnessTokenBroker({
-    capture: async (_bin, args) => {
-      calls++
-      const audience = args[args.indexOf('--audience') + 1]
-      return { code: 0, stdout: jwt(audience), stderr: '' }
-    },
-  })
-
-  for (const [audience, instance] of [
-    ['https://one.example', 'a'],
-    ['https://one.example', 'b'],
-    ['https://two.example', 'a'],
-  ] as const)
-    await broker.acquireGatewayToken(
-      { enabled: true, baseUrl: audience, auth: { mode: 'mint', instance } },
-      audience,
-    )
-
-  expect(calls).toBe(3)
-})
-
-test('turns failed, blank, or wrong-audience mint output into a typed failure', async () => {
-  expect.assertions(6)
-  for (const result of [
-    { code: 7, stdout: '', stderr: 'not signed in' },
-    { code: 0, stdout: ' ', stderr: '' },
-    { code: 0, stdout: jwt('https://other.example'), stderr: '' },
-  ]) {
-    const broker = new HarnessTokenBroker({ capture: async () => result })
-    try {
-      await broker.acquireGatewayToken(
-        {
-          enabled: true,
-          baseUrl: 'https://gateway.example',
-          auth: { mode: 'mint' },
-        },
-        'https://gateway.example',
-      )
-    } catch (error) {
-      expect(error).toBeInstanceOf(HarnessTokenError)
-      expect((error as HarnessTokenError).kind).toBe('mint-failed')
-    }
-  }
-})

package/studio/server/agent/harness/gateway/token.ts

@@ -1,166 +0,0 @@
-/**
- * Acquire bearer tokens for a harness model gateway.
- *
- * - mint: shell out to `astrale token`, cache the short-lived delegation, and
- *   coalesce concurrent requests for the same audience/instance
- * - token: use the manually configured bearer
- * - host: consume a token relayed by the embedding Astrale application
- *
- * Tokens only flow into the spawned harness child environment.
- */
-import type { HarnessGatewayConfig } from '../../../../shared/types'
-
-import { captureCommand, type CapturedCommand, type CaptureOptions } from '../process'
-
-const MINT_TTL_SECONDS = 3600
-const REFRESH_SKEW_MS = 5 * 60_000
-
-interface CachedToken {
-  token: string
-  expiresAtMs: number
-}
-
-type CaptureHarnessCommand = (
-  bin: string,
-  args: string[],
-  cwd: string,
-  options?: CaptureOptions,
-) => Promise<CapturedCommand>
-
-export interface HarnessTokenBrokerOptions {
-  capture?: CaptureHarnessCommand
-  now?: () => number
-}
-
-export class HarnessTokenError extends Error {
-  constructor(
-    message: string,
-    readonly kind: 'mint-failed' | 'host-token-needed' | 'config',
-  ) {
-    super(message)
-    this.name = 'HarnessTokenError'
-  }
-}
-
-function jwtClaims(jwt: string): { audience?: string | string[]; expiresAtMs?: number } | null {
-  try {
-    const payload = Buffer.from(jwt.split('.')[1], 'base64url').toString('utf8')
-    const claims = JSON.parse(payload)
-    return {
-      audience:
-        typeof claims?.aud === 'string' ||
-        (Array.isArray(claims?.aud) &&
-          claims.aud.every((item: unknown) => typeof item === 'string'))
-          ? claims.aud
-          : undefined,
-      expiresAtMs: typeof claims?.exp === 'number' ? claims.exp * 1000 : undefined,
-    }
-  } catch {
-    return null
-  }
-}
-
-function audienceMatches(actual: string | string[] | undefined, expected: string): boolean {
-  return actual === expected || (Array.isArray(actual) && actual.includes(expected))
-}
-
-export class HarnessTokenBroker {
-  private readonly mintCache = new Map<string, CachedToken>()
-  private readonly hostTokens = new Map<string, CachedToken>()
-  private readonly inFlightMints = new Map<string, Promise<string>>()
-  private readonly capture: CaptureHarnessCommand
-  private readonly now: () => number
-
-  constructor(options: HarnessTokenBrokerOptions = {}) {
-    this.capture = options.capture ?? captureCommand
-    this.now = options.now ?? Date.now
-  }
-
-  /** Relay a host-owned delegation token into the embedded Studio process. */
-  setHostToken(audience: string, token: string): boolean {
-    if (!audience || !token || token.split('.').length !== 3) return false
-    const claims = jwtClaims(token)
-    if (!claims || !audienceMatches(claims.audience, audience)) return false
-    const expiresAtMs = claims.expiresAtMs ?? this.now() + MINT_TTL_SECONDS * 1000
-    if (expiresAtMs <= this.now()) return false
-    this.hostTokens.set(audience, { token, expiresAtMs })
-    return true
-  }
-
-  /** Acquire the configured gateway bearer for one child-process invocation. */
-  async acquireGatewayToken(config: HarnessGatewayConfig, audience: string): Promise<string> {
-    switch (config.auth.mode) {
-      case 'token': {
-        const token = config.auth.token.trim()
-        if (!token) throw new HarnessTokenError('no token set for this gateway', 'config')
-        return token
-      }
-      case 'host':
-        return this.readHostToken(audience)
-      default:
-        return this.mintToken(audience, config.auth.instance)
-    }
-  }
-
-  private readHostToken(audience: string): string {
-    const cached = this.hostTokens.get(audience)
-    if (!cached || cached.expiresAtMs <= this.now())
-      throw new HarnessTokenError(
-        'no valid host-supplied token — the embedding Astrale app must provide one',
-        'host-token-needed',
-      )
-    return cached.token
-  }
-
-  private mintToken(audience: string, instance?: string): Promise<string> {
-    const key = `${audience}\u0000${instance ?? ''}`
-    const cached = this.mintCache.get(key)
-    if (cached && cached.expiresAtMs - this.now() > REFRESH_SKEW_MS)
-      return Promise.resolve(cached.token)
-
-    const pending = this.inFlightMints.get(key)
-    if (pending) return pending
-
-    let mint!: Promise<string>
-    mint = this.mintAndCache(key, audience, instance).finally(() => {
-      if (this.inFlightMints.get(key) === mint) this.inFlightMints.delete(key)
-    })
-    this.inFlightMints.set(key, mint)
-    return mint
-  }
-
-  private async mintAndCache(key: string, audience: string, instance?: string): Promise<string> {
-    const args = ['token', '--audience', audience, '--ttl', String(MINT_TTL_SECONDS), '--raw']
-    if (instance) args.push('-i', instance)
-    const result = await this.capture('astrale', args, process.cwd(), { timeoutMs: 12_000 })
-    const token = result.code === 0 ? result.stdout.trim() : ''
-    const claims = token && token.split('.').length === 3 ? jwtClaims(token) : null
-    if (
-      !claims ||
-      !audienceMatches(claims.audience, audience) ||
-      (claims.expiresAtMs !== undefined && claims.expiresAtMs <= this.now())
-    )
-      throw new HarnessTokenError(
-        'could not mint a delegation token — is the instance reachable and are you signed in? (try `astrale login` / `astrale use <instance>`)',
-        'mint-failed',
-      )
-    this.mintCache.set(key, {
-      token,
-      expiresAtMs: claims.expiresAtMs ?? this.now() + MINT_TTL_SECONDS * 1000,
-    })
-    return token
-  }
-}
-
-const defaultBroker = new HarnessTokenBroker()
-
-export function setHostToken(audience: string, token: string): boolean {
-  return defaultBroker.setHostToken(audience, token)
-}
-
-export function acquireGatewayToken(
-  config: HarnessGatewayConfig,
-  audience: string,
-): Promise<string> {
-  return defaultBroker.acquireGatewayToken(config, audience)
-}

package/studio/server/agent/harness/mock/adapter.ts

@@ -1,190 +0,0 @@
-import type { Comment } from '../../../../shared/types'
-import type { AgentHarness, AgentTurnInput, AgentTurnResult, AskInput, AskResult } from '../adapter'
-
-import { readComments } from '../../../state/comments'
-import { applyMockDomainEdit } from './domain-edit'
-
-function sleep(ms: number, signal: AbortSignal): Promise<void> {
-  if (signal.aborted) return Promise.resolve()
-  return new Promise((resolve) => {
-    const timer = setTimeout(resolve, ms)
-    signal.addEventListener(
-      'abort',
-      () => {
-        clearTimeout(timer)
-        resolve()
-      },
-      { once: true },
-    )
-  })
-}
-
-export class MockHarness implements AgentHarness {
-  id = 'mock'
-  label = 'Mock agent (free)'
-  capabilities = {
-    effortLevels: ['low', 'medium', 'high'],
-    accessLevels: ['workspace', 'full'],
-    ask: true,
-    loadout: false,
-    gateway: 'none',
-  } as const
-
-  async isAvailable(): Promise<boolean> {
-    return true
-  }
-
-  async run(input: AgentTurnInput): Promise<AgentTurnResult> {
-    const expectedModel = process.env.DOMAIN_STUDIO_MOCK_EXPECT_MODEL
-    if (expectedModel && input.model !== expectedModel)
-      throw new Error(
-        `mock expected model ${expectedModel}, received ${input.model ?? '(default)'}`,
-      )
-    const mode = process.env.DOMAIN_STUDIO_MOCK_MODE || 'normal'
-    const extraDelay = Number(process.env.DOMAIN_STUDIO_MOCK_DELAY_MS || 0)
-    if ((mode === 'resumefail' || mode === 'resumefailafterevent') && input.sessionId) {
-      input.onEvent({ kind: 'status', text: 'resuming…' })
-      if (mode === 'resumefailafterevent')
-        input.onEvent({
-          kind: 'tool',
-          text: 'Edit',
-          tool: 'Edit',
-          target: 'schema/test.ts',
-        })
-      return {
-        sessionId: input.sessionId,
-        finalText: '',
-        isError: true,
-        errorMessage: 'mock: no conversation found with session id',
-        resumeRejected: true,
-      }
-    }
-    const store = readComments(input.root)
-    const open = store.comments.filter(
-      (comment) => comment.status === 'open' && comment.thread.at(-1)?.role !== 'author',
-    )
-
-    input.onEvent({ kind: 'status', text: 'session started' })
-    await sleep(250, input.signal)
-    if (extraDelay > 0) await sleep(extraDelay, input.signal)
-    if (mode === 'error') throw new Error('mock harness failure (test)')
-    input.onEvent({
-      kind: 'thinking',
-      text: `Reviewing ${open.length} open thread(s) and the current schema.`,
-    })
-    await sleep(300, input.signal)
-    input.onEvent({
-      kind: 'tool',
-      text: 'Read',
-      tool: 'Read',
-      target: '.domain-studio/comments.json',
-    })
-    await sleep(250, input.signal)
-
-    const seed = open[0]?.thread.at(-1)?.text ?? 'note'
-    const edit = input.signal.aborted ? null : applyMockDomainEdit(input.root, seed)
-    if (edit) {
-      input.onEvent({ kind: 'tool', text: 'Edit', tool: 'Edit', target: edit.file })
-      await sleep(300, input.signal)
-    }
-    input.onEvent({
-      kind: 'message',
-      text: edit
-        ? `Added a \`${edit.prop}\` property to \`${edit.file}\` and answered the open threads.`
-        : 'Answered the open threads.',
-    })
-
-    const replyText = edit
-      ? `Done — implemented this by adding \`${edit.prop}\` to \`${edit.file}\`. (mock agent)`
-      : 'Acknowledged. (mock agent)'
-
-    if ((mode === 'liveandblock' || mode === 'liveandblockdifferent') && open[0]) {
-      const bridge = input.mcpServers?.find((server) => server.name === 'domain-studio')
-      if (!bridge?.invoke) throw new Error('mock bridge grant is not invokable')
-      await bridge.invoke('reply_to_thread', {
-        commentId: open[0].id,
-        text: replyText,
-        resolve: true,
-        closeNote: 'mock live reply',
-      })
-    }
-
-    const replied: Comment[] = open.map((comment) => ({
-      ...comment,
-      status: 'closed',
-      thread: [
-        ...comment.thread,
-        {
-          id: crypto.randomUUID(),
-          role: 'author' as const,
-          type: 'text' as const,
-          text: replyText,
-        },
-        ...(mode === 'liveandblockdifferent'
-          ? [
-              {
-                id: crypto.randomUUID(),
-                role: 'author' as const,
-                type: 'text' as const,
-                text: 'Additional final detail. (mock agent)',
-              },
-            ]
-          : []),
-      ],
-    }))
-    const machine = {
-      schemaVersion: store.schemaVersion,
-      comments: replied.map((comment) => ({
-        id: comment.id,
-        anchors: comment.anchors,
-        status: mode === 'openreply' ? 'open' : comment.status,
-        thread: comment.thread,
-      })),
-    }
-    const finalText =
-      mode === 'noblock'
-        ? 'I reviewed the open threads and made the edit. (no machine-state block — resilience test)'
-        : mode === 'badblock'
-          ? 'I made the edit.\n\n```json\n{ this is : not valid json, ]\n```\n'
-          : `I reviewed the open threads and made the edit.\n\n\`\`\`json\n${JSON.stringify(machine, null, 2)}\n\`\`\`\n`
-
-    return {
-      sessionId: input.sessionId ?? 'mock-session',
-      finalText,
-      costUsd: 0,
-      numTurns: 1,
-      isError: false,
-    }
-  }
-
-  async ask(input: AskInput): Promise<AskResult> {
-    const expectedModel = process.env.DOMAIN_STUDIO_MOCK_EXPECT_MODEL
-    if (expectedModel && input.model !== expectedModel)
-      return {
-        text: '',
-        isError: true,
-        errorMessage: `mock expected model ${expectedModel}, received ${input.model ?? '(default)'}`,
-      }
-    const expectedSession = process.env.DOMAIN_STUDIO_MOCK_EXPECT_SESSION
-    if (expectedSession && input.sessionId !== expectedSession)
-      return {
-        text: '',
-        isError: true,
-        errorMessage: `mock expected session ${expectedSession}, received ${input.sessionId ?? '(fresh)'}`,
-      }
-    const forked = input.sessionId ? `(forked from ${input.sessionId.slice(0, 8)}…) ` : '(fresh) '
-    const parts = [
-      forked,
-      'This is a mock answer to your side question. ',
-      'In a real run, the selected harness would answer from the inherited conversation context.',
-    ]
-    let text = ''
-    for (const part of parts) {
-      if (input.signal.aborted) break
-      text += part
-      input.onDelta(part)
-      await sleep(180, input.signal)
-    }
-    return { text, isError: false }
-  }
-}