@botbotgo/agent-harness 0.0.428 → 0.0.430

package/README.md

@@ -191,7 +191,7 @@ The public API spans a full product runtime—persistent records, memory and evi
 - **Frontend/client entrypoints:** `createAgentHarnessClient`, `createInProcessHarnessClient`, `createAcpHarnessClient`, `createAcpStdioHarnessClient`, `createAcpHttpHarnessClient`, and `HarnessClient` let product shells consume the runtime through one reusable client layer instead of re-binding runtime calls per UI. `request(...)` is the streamed request entrypoint; `subscribe(...)` is the runtime lifecycle observer surface.
 - **Runtime memory and evidence:** `memorize`, `recall`, `listMemories`, memory policy hooks, `recordArtifact`, `listArtifacts`, `getArtifact`, `exportEvaluationBundle`, `replayEvaluationBundle`, and request/session evidence export helpers.
 - **Protocol and transport surfaces:** `createAcpServer`, `createAcpStdioClient`, `serveAcpStdio`, `serveAcpHttp`, `serveA2aHttp`, `serveAgUiHttp`, and `createRuntimeMcpServer` / `serveRuntimeMcpOverStdio`.
-- **Governed workspace runtime:** YAML-owned routing, concurrency, maintenance, MCP policy, runtime governance bundles, and approval defaults for sensitive memory or write-like MCP side effects.
+- **Governed workspace runtime:** YAML-owned routing, concurrency, maintenance, MCP policy, runtime governance bundles, and approval defaults for sensitive memory or MCP tools with declared write access.
 - **Policy-shaped approvals:** governed tools can stay on manual review, auto-approve, or auto-reject / deny-and-continue modes while the runtime keeps one inspectable governance decision surface.
 
 If you integrate external clients, treat `deepagents-acp` as the primary protocol direction: clients connect through that surface while `agent-harness` keeps persistence, recovery, approvals, and operator control on the runtime side.
@@ -208,7 +208,7 @@ What you get on day one:
 - a runtime that keeps `requests`, `sessions`, `approvals`, and `events` as inspectable product records
 - a recovery path that survives interruption, restart, and operator decisions
 - stable request correlation and continuity metadata so operators can join one persisted request to logs, traces, and fallback transitions
-- approval defaults for sensitive durable memory writes and write-like MCP calls instead of relying on each tool definition to remember governance
+- approval defaults for sensitive durable memory writes and MCP tools with declared write access instead of relying on tool names or descriptions to imply governance
 - one workspace-shaped assembly model instead of app-specific runtime glue
 - one stable runtime contract even when execution backends change underneath
 

package/README.zh.md

@@ -187,7 +187,7 @@ durable memory 的写入现在也会在模型做 mutation reconciliation 之前
 - **前端/client 入口：** `createAgentHarnessClient`、`createInProcessHarnessClient`、`createAcpHarnessClient`、`createAcpStdioHarnessClient`、`createAcpHttpHarnessClient` 与 `HarnessClient` 让产品壳层可以复用同一套 runtime 接入层，而不是每个 UI 各自重新绑定运行时调用。`request(...)` 负责流式 request；`subscribe(...)` 负责 runtime 生命周期事件。
 - **运行时 memory 与证据能力：** `memorize`、`recall`、`listMemories`、memory policy hooks、`recordArtifact`、`listArtifacts`、`getArtifact`、`exportEvaluationBundle`、`replayEvaluationBundle`，以及 request / session 级证据导出辅助函数。
 - **协议与传输层：** `createAcpServer`、`createAcpStdioClient`、`serveAcpStdio`、`serveAcpHttp`、`serveA2aHttp`、`serveAgUiHttp`，以及 `createRuntimeMcpServer` / `serveRuntimeMcpOverStdio`。
-- **受治理的工作区运行时：** 由 YAML 持有的路由、并发、维护、MCP 策略、runtime governance bundles，以及针对敏感 memory 或写类 MCP 副作用的默认审批门槛。
+- **受治理的工作区运行时：** 由 YAML 持有的路由、并发、维护、MCP 策略、runtime governance bundles，以及针对敏感 memory 或声明了写入访问的 MCP 工具的默认审批门槛。
 - **策略化审批：** 受治理工具现在既可以走人工审批，也可以走 `auto-approve`、`auto-reject` 或 `deny-and-continue`，同时继续保留统一可检查的治理决策面。
 
 若你的产品需要对接外部客户端，可从本节理解边界：`deepagents-acp` 是主要的外部协议接入方向；持久化、恢复、审批与运行控制仍由 `agent-harness` 在运行时侧承担。
@@ -204,7 +204,7 @@ durable memory 的写入现在也会在模型做 mutation reconciliation 之前
 - 把 `requests`、`sessions`、`approvals`、`events` 作为可查询产品记录保存下来的 runtime
 - 能跨中断、重启和人工决策继续推进的恢复路径
 - 稳定的 request 关联与连续性元数据，让一次持久化请求能和日志、trace、fallback 过程对齐
-- 对敏感 durable memory 写入和写类 MCP 调用默认走审批，而不是把治理责任留给每个工具定义自己记住
+- 对敏感 durable memory 写入和声明了写入访问的 MCP 工具默认走审批，而不是从工具名称或 description 里推断治理责任
 - 一个工作区形态的装配模型，而不是每个应用各写一套运行时胶水
 - 即使底层 execution backend 变化，也尽量保持稳定的 runtime 契约
 

package/dist/package-version.d.ts

@@ -1,2 +1,2 @@
-export declare const AGENT_HARNESS_VERSION = "0.0.428";
+export declare const AGENT_HARNESS_VERSION = "0.0.430";
 export declare const AGENT_HARNESS_RELEASE_DATE = "2026-05-03";

package/dist/package-version.js

@@ -1,2 +1,2 @@
-export const AGENT_HARNESS_VERSION = "0.0.428";
+export const AGENT_HARNESS_VERSION = "0.0.430";
 export const AGENT_HARNESS_RELEASE_DATE = "2026-05-03";

package/dist/runtime/adapter/middleware-assembly.js

@@ -180,19 +180,52 @@ function extractUrls(value) {
     return [...new Set((value.match(/https?:\/\/[^\s<>"')\]}]+/giu) ?? [])
             .map((url) => url.replace(/[.,;:!?]+$/u, "")))];
 }
-function buildEvidenceToolArgs(tool, taskText) {
-    const urls = extractUrls(taskText);
-    const metadata = `${tool.name} ${tool.description ?? ""}`.toLowerCase();
-    if (urls.length > 0 && (metadata.includes("source") || metadata.includes("url"))) {
-        return {
-            sources: urls.map((url) => ({ type: "url", url, timeoutMs: 30000 })),
-            question: "Summarize this source for an engineering team briefing with background, key facts, risks, and next steps.",
-            workspaceRoot: ".",
-            modelName: "gpt-oss-latest",
-            maxChunks: 5,
-        };
+function readSchemaObjectShape(schema) {
+    if (!isRecord(schema)) {
+        return undefined;
+    }
+    if (isRecord(schema.properties)) {
+        return schema.properties;
+    }
+    const candidates = [
+        schema._def?.shape,
+        schema._zod?.def?.shape,
+        schema.def?.shape,
+    ];
+    for (const candidate of candidates) {
+        const shape = typeof candidate === "function" ? candidate() : candidate;
+        if (isRecord(shape)) {
+            return shape;
+        }
+    }
+    return undefined;
+}
+function buildUrlSourceArgs(urls) {
+    return urls.map((url) => ({ type: "url", url, timeoutMs: 30000 }));
+}
+function buildEvidenceToolArgs(tool, taskText, evidenceText = taskText) {
+    const urls = extractUrls(evidenceText);
+    if (urls.length === 0) {
+        return {};
+    }
+    const shape = readSchemaObjectShape(tool.schema);
+    if (!shape) {
+        return {};
+    }
+    const args = {};
+    if ("sources" in shape) {
+        args.sources = buildUrlSourceArgs(urls);
+    }
+    if ("url" in shape) {
+        args.url = urls[0];
+    }
+    if ("urls" in shape) {
+        args.urls = urls;
+    }
+    if ("question" in shape) {
+        args.question = taskText.trim() || evidenceText.trim();
     }
-    return {};
+    return args;
 }
 function resolveCommittedEvidenceTools(input) {
     const availableTools = readResolvedEvidenceTools(input.resolvedTools)
@@ -200,15 +233,16 @@ function resolveCommittedEvidenceTools(input) {
     if (availableTools.length === 0) {
         return [];
     }
-    const stateText = `${input.taskText}\n${stringifyTaskState(readMessages(input.result))}`.toLowerCase();
+    const stateText = `${input.taskText}\n${stringifyTaskState(readMessages(input.result))}`;
+    const selectionText = stateText.toLowerCase();
     const selected = [];
     for (const tool of availableTools) {
-        if (!stateText.includes(tool.name.toLowerCase())) {
+        if (!selectionText.includes(tool.name.toLowerCase())) {
             continue;
         }
         selected.push({
             tool,
-            args: buildEvidenceToolArgs(tool, stateText),
+            args: buildEvidenceToolArgs(tool, input.taskText, stateText),
         });
     }
     if (selected.length > 0) {

package/dist/runtime/adapter/tool/tool-hitl.js

@@ -6,7 +6,6 @@ const PATH_LIKE_INPUT_KEYS = new Set(["path", "root", "dir", "directory", "cwd"]
 const ROOT_SCOPING_INPUT_KEYS = new Set(["root", "dir", "directory", "cwd"]);
 const SENSITIVE_MEMORY_LEVELS = new Set(["high", "sensitive", "restricted", "secret", "confidential"]);
 const NON_THREAD_MEMORY_SCOPES = new Set(["workspace", "agent", "user", "project"]);
-const WRITE_LIKE_REMOTE_TOOL_PATTERN = /\b(write|edit|delete|create|update|append|insert|push|commit|publish|send|post|apply|merge|sync|upload|save)\b/i;
 function asRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value)
         ? value
@@ -59,16 +58,16 @@ function requiresApprovalForHighRiskMcpWrite(compiledTool) {
         return true;
     }
     const mcpConfig = asRecord(compiledTool.config?.mcp);
-    const targetText = [
-        compiledTool.name,
-        compiledTool.description,
-        asString(mcpConfig?.tool),
-        asString(mcpConfig?.ref),
-        asString(mcpConfig?.operation),
-    ]
-        .filter((value) => Boolean(value))
-        .join(" ");
-    return WRITE_LIKE_REMOTE_TOOL_PATTERN.test(targetText);
+    const mcpServer = asRecord(compiledTool.config?.mcpServer);
+    const access = asString(mcpServer?.access ?? mcpConfig?.access);
+    const approvalPolicy = asString(mcpServer?.approvalPolicy ?? mcpConfig?.approvalPolicy);
+    if (approvalPolicy === "always") {
+        return true;
+    }
+    if (approvalPolicy === "never") {
+        return false;
+    }
+    return access === "read-write";
 }
 function matchesGovernanceToolPolicy(rule, compiledTool) {
     const match = asRecord(rule.match) ?? rule;

package/dist/runtime/harness/run/governance.js

@@ -1,7 +1,6 @@
 import { getBindingPrimaryTools } from "../../support/compiled-binding.js";
 import { resolveToolApprovalDecisionMode } from "../../adapter/tool/tool-hitl.js";
 import { compiledToolHasInputSchema } from "../tool-schema.js";
-const WRITE_LIKE_PATTERN = /\b(write|edit|delete|create|update|append|insert|push|commit|publish|send|post|apply|merge|sync|upload|save)\b/i;
 function inputHints(binding, tool) {
     const hints = new Set();
     const target = `${tool.name} ${tool.description}`.toLowerCase();
@@ -29,10 +28,6 @@ function classifyRisk(policy) {
     if (policy.mcpAccess === "read-write" || policy.promptInjectionRisk === "medium") {
         return "medium";
     }
-    const target = `${policy.toolName} ${policy.description}`;
-    if (policy.toolType === "mcp" && WRITE_LIKE_PATTERN.test(target)) {
-        return "high";
-    }
     if (policy.toolType === "backend" || policy.toolType === "mcp") {
         return "medium";
     }
@@ -200,12 +195,13 @@ function applyRemoteMcpGovernance(binding, policies) {
 export function buildRuntimeGovernanceBundles(binding) {
     const toolPolicies = applyGovernanceOverrides(binding, applyRemoteMcpGovernance(binding, getBindingPrimaryTools(binding).map((tool) => {
         const remoteMcp = readRemoteMcpMetadata(tool);
-        const writeLikeRemoteMcp = tool.type === "mcp" && (remoteMcp.access === "read-write" || WRITE_LIKE_PATTERN.test(`${tool.name} ${tool.description}`));
+        const remoteMcpWriteAccess = tool.type === "mcp" && remoteMcp.access === "read-write";
         const derivedDecisionMode = resolveToolApprovalDecisionMode(tool, binding);
         const requiresApproval = derivedDecisionMode === "manual" ||
             remoteMcp.trustTier === "untrusted" ||
             remoteMcp.approvalPolicy === "always" ||
-            (remoteMcp.approvalPolicy === "write" && writeLikeRemoteMcp) ||
+            (remoteMcp.approvalPolicy === "write" && remoteMcpWriteAccess) ||
+            remoteMcpWriteAccess ||
             remoteMcp.tenantScope === "cross-tenant";
         const decisionMode = requiresApproval
             ? (derivedDecisionMode === "none" ? "manual" : derivedDecisionMode)
@@ -216,9 +212,9 @@ export function buildRuntimeGovernanceBundles(binding) {
                 ? "cross-tenant-mcp-access"
                 : remoteMcp.approvalPolicy === "always"
                     ? "remote-mcp-approval-policy"
-                    : remoteMcp.approvalPolicy === "write" && writeLikeRemoteMcp
+                    : remoteMcp.approvalPolicy === "write" && remoteMcpWriteAccess
                         ? "high-risk-mcp-write"
-                        : requiresApproval && tool.type === "mcp"
+                        : remoteMcpWriteAccess
                             ? "high-risk-mcp-write"
                             : undefined;
         const inputRiskHints = inputHints(binding, tool);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbotgo/agent-harness",
-  "version": "0.0.428",
+  "version": "0.0.430",
   "description": "Workspace runtime for multi-agent applications",
   "license": "MIT",
   "type": "module",