@cargo-ai/cli 1.0.94 → 1.0.95

package/build/commands/ai/chat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/chat.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAGxC,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAyI7E"}
+{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/chat.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAGxC,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAyI7E"}

package/build/commands/ai/chat.js

@@ -1,3 +1,4 @@
+import { AiUtils } from "@cargo-ai/types";
 import { handleApiCall, outputJson, parseJson } from "../runHandler.js";
 export function registerChatCommands(parent, getApi) {
     const chat = parent
@@ -41,7 +42,7 @@ export function registerChatCommands(parent, getApi) {
         .option("--name <name>", "Chat name (string)")
         .option("--agent-uuid <uuid>", "Agent UUID to associate with (string)")
         .option("--release-uuid <uuid>", "Release UUID to pin to (string)")
-        .option("--harness-slug <slug>", "Coding-agent runtime. Currently only claudeCode. When omitted, later turns use the agent's pinned release, if any.")
+        .option("--harness-slug <slug>", `Coding-agent runtime: ${AiUtils.harnessSlugs.join(", ")}. When omitted, later turns use the agent's pinned release, if any.`)
         .option("--repository <json>", "Git workspace for a coding harness (JSON object: connectorUuid, repository as owner/name, defaultBranch, rootDirectory, env)")
         .addHelpText("after", `
 Examples:

package/build/commands/ai/message.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/message.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAoCxC,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAmTN"}
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/message.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAoCxC,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAmTN"}

package/build/commands/ai/message.js

@@ -1,3 +1,4 @@
+import { AiUtils } from "@cargo-ai/types";
 import { parseBooleanOption } from "../../utils/booleanOption.js";
 import { loadCompiledAgent, resolveCompiledAgentFromState, } from "../../utils/loadCompiledAgent.js";
 import { ExitCodes, failWith, handleApiCall, info, outputJson, parseJson, pollUntilFinished, } from "../runHandler.js";
@@ -27,7 +28,7 @@ export function registerMessageCommands(parent, getApi) {
         .option("--integration-slug <slug>", "Integration slug (string)")
         .option("--connector-uuid <uuid>", "Connector UUID (string)")
         .option("--language-model-slug <slug>", "Language model slug (string)")
-        .option("--harness-slug <slug>", "Coding-agent runtime. Currently only claudeCode. When omitted, later turns use the agent's pinned release, if any.")
+        .option("--harness-slug <slug>", `Coding-agent runtime: ${AiUtils.harnessSlugs.join(", ")}. When omitted, later turns use the agent's pinned release, if any.`)
         .option("--repository <json>", "Git workspace for a coding harness (JSON object: connectorUuid, repository as owner/name, defaultBranch, rootDirectory, env)")
         .option("--output <json>", 'Output format for the assistant message (JSON object, e.g. \'{"type":"text"}\' or \'{"type":"jsonSchema","jsonSchema":{...}}\'). Defaults to text when omitted.')
         .option("--wait-until-finished [true|false]", "Poll the assistant message until finished before returning (defaults to true when passed bare)", parseBooleanOption)

package/build/commands/ai/release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/release.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAIxC,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CA0VN"}
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/release.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAIxC,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAoVN"}

package/build/commands/ai/release.js

@@ -1,3 +1,4 @@
+import { AiUtils } from "@cargo-ai/types";
 import { parseBooleanOption } from "../../utils/booleanOption.js";
 import { handleApiCall, outputJson, parseJson } from "../runHandler.js";
 export function registerReleaseCommands(parent, getApi) {
@@ -63,7 +64,7 @@ export function registerReleaseCommands(parent, getApi) {
         .option("--integration-slug <slug>", "LLM integration slug (string)")
         .option("--connector-uuid <uuid>", "Connector UUID (string)")
         .option("--language-model-slug <slug>", "Language model slug (string)")
-        .option("--harness-slug <slug>", "Coding-agent runtime. Currently only claudeCode.")
+        .option("--harness-slug <slug>", `Coding-agent runtime: ${AiUtils.harnessSlugs.join(", ")}.`)
         .option("--repository <json>", "Git workspace for a coding harness (JSON object: connectorUuid, repository as owner/name, defaultBranch, rootDirectory, env)")
         .option("--actions <json>", "Actions configuration (JSON array of action objects)")
         .option("--mcp-clients <json>", "MCP clients configuration (JSON array of MCP client objects)")
@@ -126,9 +127,9 @@ Set "isReadOnly": false on a model resource to grant the agent write tools (inse
         .command("deploy-draft")
         .description("Deploy the draft release to production")
         .requiredOption("--agent-uuid <uuid>", "Agent UUID (string, required)")
-        .option("--integration-slug <slug>", "LLM integration slug (string). Unused when --harness-slug is set.")
-        .option("--language-model-slug <slug>", "Language model slug (string). Unused when --harness-slug is set.")
-        .option("--harness-slug <slug>", "Coding-agent runtime. Currently only claudeCode. When set, --integration-slug and --language-model-slug are unused.")
+        .option("--integration-slug <slug>", "LLM integration slug (string)")
+        .option("--language-model-slug <slug>", "Language model slug (string)")
+        .option("--harness-slug <slug>", `Coding-agent runtime: ${AiUtils.harnessSlugs.join(", ")}.`)
         .option("--repository <json>", "Git workspace for a coding harness (JSON object: connectorUuid, repository as owner/name, defaultBranch, rootDirectory, env)")
         .option("--version <version>", "Semver release version, e.g. 1.0.0 (string, auto-incremented if omitted)")
         .requiredOption("--actions <json>", "Actions configuration (JSON array of action objects, required)")
@@ -152,12 +153,12 @@ Examples:
 
   $ cargo-ai ai release deploy-draft --agent-uuid <uuid> \\
       --harness-slug claudeCode \\
+      --integration-slug anthropic --language-model-slug claude-sonnet-5 \\
       --repository '{"connectorUuid":"<github-uuid>","repository":"acme/app"}' \\
       --actions '[]' --mcp-clients '[]' --resources '[]' \\
       --capabilities '[]' --suggested-actions '[]'
 
-A tool-loop agent needs --integration-slug and --language-model-slug. A
---harness-slug claudeCode agent does not — those flags are unused.`)
+`)
         .action(async (opts) => {
         const api = getApi();
         const result = await handleApiCall(() => api.ai.release.deployDraft({

package/build/commands/ask/harness/approvals.d.ts

@@ -0,0 +1,7 @@
+export declare function isAutoApproved(toolName: string, options?: {
+    unattended?: boolean;
+}): boolean;
+export declare const DENIED_TOOL_REASON = "Spawning a subagent is not available in this session. Do the work in this turn instead, asking for each tool you need.";
+/** Exported for tests. */
+export declare function isAlwaysDenied(toolName: string): boolean;
+//# sourceMappingURL=approvals.d.ts.map

package/build/commands/ask/harness/approvals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/approvals.ts"],"names":[],"mappings":"AA2CA,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACjC,OAAO,CA2BT;AAqBD,eAAO,MAAM,kBAAkB,2HAC2F,CAAC;AAE3H,0BAA0B;AAC1B,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/build/commands/ask/harness/approvals.js

@@ -0,0 +1,82 @@
+import { CARGO_MCP_SERVER_NAME } from "./mcp.js";
+import { CARGO_AGENT_MCP_NAME_PREFIX } from "./release.js";
+/**
+ * Claude Code's own bookkeeping. `allow-reads` classifies these as edits
+ * because they call a write-shaped tool, but they touch nothing outside the
+ * session — prompting for a todo-list update is noise, and Claude Code
+ * rewrites its list on every step of any multi-step task.
+ */
+const AUTO_APPROVED_TOOL_NAMES = new Set([
+    "TodoWrite",
+    "EnterPlanMode",
+    "ExitPlanMode",
+    "TaskCreate",
+    "TaskUpdate",
+    "TaskStop",
+    "AskUserQuestion",
+]);
+/**
+ * Cargo's MCP tools run unattended in an interactive session, `execute_action`
+ * included: a turn can spend credits and write to a connected system on its
+ * own. That is the deliberate trade for a chat that answers without being
+ * nursed, and it is defensible only because this server reaches the workspace
+ * with the user's own credentials — it can do nothing they could not do from
+ * the CLI. `--print` is the exception: there is nobody to approve, so mutating
+ * workspace tools are denied there.
+ *
+ * Only this server's tools. Claude Code names them `mcp__<server>__<tool>`,
+ * and matching the bare `mcp__` was safe only while Ask owned the config
+ * directory: `CLAUDE_CONFIG_DIR` reinstates the user's own MCP servers, whose
+ * tools write and shell out with none of the above reasoning behind them.
+ * Those go through approval like anything else that touches the machine.
+ *
+ * Built from the mount key so renaming the server cannot silently widen this.
+ */
+const CARGO_MCP_TOOL_PREFIX = `mcp__${CARGO_MCP_SERVER_NAME}__`;
+const CARGO_AGENT_MCP_TOOL_PREFIX = `mcp__${CARGO_AGENT_MCP_NAME_PREFIX}`;
+const CARGO_EXECUTE_ACTION_TOOL = `${CARGO_MCP_TOOL_PREFIX}execute_action`;
+const CARGO_EXECUTE_ACTION_BATCH_TOOL = `${CARGO_MCP_TOOL_PREFIX}execute_action_batch`;
+export function isAutoApproved(toolName, options) {
+    const unattended = options === undefined ? false : options.unattended === true;
+    if (unattended === true) {
+        if (toolName === CARGO_EXECUTE_ACTION_TOOL) {
+            return false;
+        }
+        if (toolName === CARGO_EXECUTE_ACTION_BATCH_TOOL) {
+            return false;
+        }
+        if (toolName.startsWith(CARGO_AGENT_MCP_TOOL_PREFIX) === true) {
+            return false;
+        }
+    }
+    if (toolName.startsWith(CARGO_MCP_TOOL_PREFIX) === true) {
+        return true;
+    }
+    if (toolName.startsWith(CARGO_AGENT_MCP_TOOL_PREFIX) === true) {
+        return true;
+    }
+    return AUTO_APPROVED_TOOL_NAMES.has(toolName);
+}
+/**
+ * `Agent` spawns a subagent to run a task of its own, and approving one is a
+ * different kind of decision from approving a `Bash`: the subagent runs its
+ * own tools, can be asked for with `mode: "bypassPermissions"`, and whether
+ * its calls come back here for individual approval is not something we control
+ * or currently know.
+ *
+ * The refusal that actually stops it is in `claudeConfig.ts`, as a deny rule
+ * in Claude Code's own settings — this never fired, because the approval
+ * request it waits for is never sent. The bridge writes `ask` rules only for
+ * the tools in its `NATIVE_TOOL_KINDS` map, the subagent tools are not in it,
+ * and so `allow-reads` left them running unattended.
+ *
+ * Kept as the second line: a user who points `CLAUDE_CONFIG_DIR` at their own
+ * Claude Code config gets no deny rule written for them, and a future bridge
+ * that does surface the approval should find an answer waiting.
+ */
+const DENIED_TOOL_NAMES = new Set(["Agent", "Task"]);
+export const DENIED_TOOL_REASON = "Spawning a subagent is not available in this session. Do the work in this turn instead, asking for each tool you need.";
+/** Exported for tests. */
+export function isAlwaysDenied(toolName) {
+    return DENIED_TOOL_NAMES.has(toolName);
+}

package/build/commands/ask/harness/artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/artifacts.ts"],"names":[],"mappings":"AAwBA,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI,CAGzE"}

package/build/commands/ask/harness/claudeConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeConfig.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/claudeConfig.ts"],"names":[],"mappings":"AA2BA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C"}

package/build/commands/ask/harness/create.d.ts

@@ -0,0 +1,59 @@
+import type { Ai } from "@cargo-ai/api";
+import type { Api } from "../../../api.js";
+import { type LocalStreamOptions } from "./turn.js";
+export type LocalHarness = {
+    streamPrompt: (question: string, options?: LocalStreamOptions) => Promise<string>;
+    /**
+     * When a turn last reached Anthropic, or undefined if none has. The proxy
+     * token re-arms on every call it makes, so this — not the mint time — is
+     * what its real expiry runs from.
+     */
+    proxyLastUsedAtMs: () => number | undefined;
+    /** Stops Claude Code and its bridge; the session is not resumable. */
+    close: () => Promise<void>;
+};
+export declare function createLocalHarness(input: {
+    api: Api;
+    /**
+     * Cargo API origin (`config.baseUrl`). The Anthropic proxy is mounted on
+     * the API as `/sandbox/anthropic` — same host the backend uses via
+     * `config.app.url` (which is the API URL, not the web app).
+     */
+    apiBaseUrl: string;
+    dir: string;
+    chatUuid: string;
+    agentUuid?: string;
+    /**
+     * Deployed release of the selected agent. Applied the way `/stream` applies
+     * a harness agent's release: prompt, actions, resources, MCP, capabilities.
+     * Does not change the local harness or --dir.
+     */
+    release?: Ai.Release;
+    proxyToken: string;
+    /**
+     * Connector the mint picked for this session, plus the integration and
+     * model it resolved. Sent with ingest so usage is attributed to the same
+     * provider the proxy spent against — not reconstructed from the harness slug.
+     */
+    connectorUuid: string;
+    integrationSlug: string;
+    languageModelSlug: string;
+    /**
+     * Earlier turns of this chat, from `loadChatHistoryPreamble`. The session is
+     * always new, so this is the only thing that carries a `--continue` chat
+     * across CLI runs.
+     */
+    history?: string;
+    /**
+     * The id the caller claimed the chat with. Sent with the ingest so recording
+     * a turn releases this session's claim and not one taken after it.
+     */
+    turnOwnerId?: string;
+    /**
+     * Interactive Ask can run host tools and custom agent MCP unattended.
+     * `--print` cannot: nobody is there to approve, and host tools never
+     * prompt under `allow-reads`.
+     */
+    allowWorkspaceMutations: boolean;
+}): Promise<LocalHarness>;
+//# sourceMappingURL=create.d.ts.map

package/build/commands/ask/harness/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/create.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAmB3C,OAAO,EAGL,KAAK,kBAAkB,EAKxB,MAAM,WAAW,CAAC;AAGnB,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE,CACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,kBAAkB,KACzB,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC5C,sEAAsE;IACtE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAcF,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,uBAAuB,EAAE,OAAO,CAAC;CAClC,GAAG,OAAO,CAAC,YAAY,CAAC,CA4SxB"}

package/build/commands/ask/harness/create.js

@@ -0,0 +1,292 @@
+import { HarnessAgent } from "@ai-sdk/harness/agent";
+import { createClaudeCode } from "@ai-sdk/harness-claude-code";
+import { createLocalSandbox } from "ai-sdk-sandbox-local";
+import { pruneHarnessArtifacts } from "./artifacts.js";
+import { askClaudeConfigDir } from "./claudeConfig.js";
+import { ingestTurn } from "./ingest.js";
+import { localHarnessInstructions, localHarnessSkills, } from "./instructions.js";
+import { resolveWorkspaceLayout } from "./layout.js";
+import { CARGO_MCP_SERVER_NAME, cargoMcpServer } from "./mcp.js";
+import { ensureHarnessPnpmOnPath } from "./pnpmShim.js";
+import { buildReleaseHostTools, buildReleaseMcpServers } from "./release.js";
+import { withGetPortEndpoint } from "./sandbox.js";
+import { ASK_TIMING_ENABLED, createPhaseLog, reportHarnessDiagnostic, timeStreamParts, } from "./timing.js";
+import { HarnessTurnStuck, runPromptTurn, settleWithin, } from "./turn.js";
+import { createTurnAccumulator, didReachAnthropic } from "./usage.js";
+/**
+ * How long teardown may take before the session is abandoned. Short, because
+ * the caller is usually someone who just pressed Ctrl-C.
+ */
+const SESSION_DESTROY_TIMEOUT_MS = 5_000;
+/**
+ * How long winding down a previous unfinished turn may take before it is cut
+ * off and the question refused.
+ */
+const TURN_DRAIN_TIMEOUT_MS = 30_000;
+export async function createLocalHarness(input) {
+    const setupPhase = createPhaseLog("setup");
+    // Claude Code bootstrap shells out to `pnpm`; Volta often has a dead shim
+    // and pnpm 9 refuses this npm packageManager root — put pnpm@10 first.
+    ensureHarnessPnpmOnPath();
+    setupPhase("pnpm shim written to PATH");
+    const workspace = resolveWorkspaceLayout(input.dir);
+    pruneHarnessArtifacts(workspace.sandboxCwd);
+    // Earlier versions rooted the sandbox at the project, so its artifacts are
+    // still in there to collect.
+    if (workspace.sandboxCwd !== input.dir) {
+        pruneHarnessArtifacts(input.dir);
+    }
+    setupPhase("stale harness artifacts pruned");
+    const anthropicBaseUrl = `${input.apiBaseUrl.replace(/\/$/, "")}/sandbox/anthropic`;
+    const release = input.release;
+    const hostTools = input.allowWorkspaceMutations === false || release === undefined
+        ? {}
+        : buildReleaseHostTools(input.api, release.actions);
+    const mcpServers = {
+        [CARGO_MCP_SERVER_NAME]: cargoMcpServer(input.apiBaseUrl),
+    };
+    if (release !== undefined && input.allowWorkspaceMutations === true) {
+        const extra = buildReleaseMcpServers(release.mcpClients);
+        for (const [name, server] of Object.entries(extra)) {
+            mcpServers[name] = server;
+        }
+    }
+    const harnessAgent = new HarnessAgent({
+        // Pin auth the same way the backend harness stream does. Credentials go
+        // through `auth`, not `env`: passing them via `env` alone lets
+        // createClaudeCode auto-detect AI Gateway from the host process and ignore
+        // the Cargo proxy.
+        harness: createClaudeCode({
+            auth: {
+                ANTHROPIC_BASE_URL: anthropicBaseUrl,
+                ANTHROPIC_API_KEY: input.proxyToken,
+            },
+            env: { CLAUDE_CONFIG_DIR: askClaudeConfigDir() },
+            mcpServers,
+        }),
+        id: "cargo-ai-ask",
+        sandbox: withGetPortEndpoint(createLocalSandbox({ cwd: workspace.sandboxCwd })),
+        sandboxConfig: workspace.workDir === undefined ? {} : { workDir: workspace.workDir },
+        instructions: localHarnessInstructions(input.dir, release),
+        skills: localHarnessSkills(input.dir),
+        model: input.languageModelSlug,
+        // Nested @ai-sdk/harness ships its own @ai-sdk/provider-utils, so its
+        // ToolSet does not unify with this package's. Runtime shape is the same.
+        tools: hostTools,
+        permissionMode: "allow-reads",
+        ...(ASK_TIMING_ENABLED === false
+            ? {}
+            : { debug: { enabled: true }, onLog: reportHarnessDiagnostic }),
+    });
+    setupPhase("harness agent constructed");
+    // Local sandbox cannot broker credentials via request transforms; the
+    // harness always warns. Keep that off the Ask tree (stderr mid-reply).
+    const session = await withMutedCredentialBrokerWarning(() => harnessAgent.createSession());
+    setupPhase("harness session created");
+    // Consumed by the first prompt: this session has never seen the chat, so it
+    // is told the story once rather than on every question.
+    let pendingHistory = input.history;
+    let proxyLastUsedAtMs;
+    // Approvals the previous turn asked about and never answered — a turn
+    // cancelled at the confirmation prompt leaves one here.
+    const unanswered = [];
+    return {
+        streamPrompt: async (question, options) => {
+            const turnPhase = createPhaseLog("turn ");
+            turnPhase("prompt submitted");
+            const abortSignal = options === undefined ? undefined : options.abortSignal;
+            // The turn is stored and shown as the user wrote it; only what Claude
+            // Code is asked carries the replayed history.
+            const prompt = pendingHistory === undefined
+                ? question
+                : `${pendingHistory}\n\n${question}`;
+            // A cancelled turn stays unfinished, and the harness refuses a new
+            // prompt until it is drained. Do that here rather than making the next
+            // question fail with "must be continued before accepting a new prompt".
+            if (session.hasUnfinishedTurn() === true) {
+                // Anything the last turn asked about and never got an answer for is
+                // denied. Draining with no continuations leaves the runtime waiting
+                // on a response that is never coming, and the honest reading of a
+                // user who walked away from the prompt is "no" — carrying the
+                // question into a turn they did not ask for would be worse.
+                const denials = unanswered.map((approval) => ({
+                    approvalResponse: {
+                        type: "tool-approval-response",
+                        approvalId: approval.approvalId,
+                        approved: false,
+                    },
+                    toolCall: {
+                        type: "tool-call",
+                        toolCallId: approval.toolCallId,
+                        toolName: approval.toolName,
+                        input: approval.input,
+                    },
+                }));
+                unanswered.length = 0;
+                // The drain gets its own controller so the timeout can stop it rather
+                // than walk away from it. Nothing watches this call the way the stall
+                // watchdog watches a turn's stream, so a runtime that never settles
+                // would otherwise hang the question just asked — but abandoning the
+                // promise and carrying on is no better: `continueGenerate` keeps
+                // running, and submitting the new prompt to the same session races the
+                // turn we failed to wind down. Chained to the turn's signal so ctrl-c
+                // still gets out of it.
+                const drain = new AbortController();
+                const abortDrain = () => drain.abort();
+                if (abortSignal !== undefined) {
+                    if (abortSignal.aborted === true) {
+                        drain.abort();
+                    }
+                    else {
+                        abortSignal.addEventListener("abort", abortDrain, { once: true });
+                    }
+                }
+                const drainTimer = setTimeout(abortDrain, TURN_DRAIN_TIMEOUT_MS);
+                try {
+                    await harnessAgent.continueGenerate({
+                        session,
+                        toolApprovalContinuations: denials,
+                        abortSignal: drain.signal,
+                    });
+                }
+                catch {
+                    // Whether it failed or was cut off, the session itself is the only
+                    // thing that can say if a new prompt is allowed.
+                }
+                finally {
+                    clearTimeout(drainTimer);
+                    if (abortSignal !== undefined) {
+                        abortSignal.removeEventListener("abort", abortDrain);
+                    }
+                }
+                if (session.hasUnfinishedTurn() === true) {
+                    throw new HarnessTurnStuck();
+                }
+                turnPhase("unfinished previous turn drained");
+            }
+            const accumulator = createTurnAccumulator();
+            let answer;
+            try {
+                answer = await runPromptTurn({
+                    driver: {
+                        start: async () => {
+                            turnPhase("harness stream() called");
+                            const stream = (await harnessAgent.stream({
+                                prompt,
+                                session,
+                                abortSignal,
+                            }));
+                            turnPhase("harness stream() returned");
+                            // The prompt is in the session now, so the replayed history has
+                            // been told. Cleared here rather than before submitting: a turn
+                            // that never reached the harness must keep it for the retry, or
+                            // a cancelled first question would leave every later one in this
+                            // process without the earlier conversation.
+                            pendingHistory = undefined;
+                            return timeStreamParts(stream, turnPhase);
+                        },
+                        continueWithApprovals: async (continuations) => {
+                            turnPhase("harness continueStream() called");
+                            const stream = (await harnessAgent.continueStream({
+                                session,
+                                toolApprovalContinuations: continuations,
+                                abortSignal,
+                            }));
+                            turnPhase("harness continueStream() returned");
+                            return timeStreamParts(stream, turnPhase);
+                        },
+                    },
+                    handlers: options,
+                    accumulator,
+                    unanswered,
+                    // Interrupt Claude Code through the turn's abort signal so the
+                    // bridge stops cleanly. Without this the host walks away from the
+                    // stream and teardown looks like "bridge closed before the turn
+                    // finished" rather than an intentional stop.
+                    onStall: options === undefined ? undefined : options.onStall,
+                });
+            }
+            catch (error) {
+                // Cancelled or failed after Claude Code already spent tokens. Record
+                // what it spent, then let the caller handle the failure.
+                if (didReachAnthropic(accumulator.usage) === true) {
+                    proxyLastUsedAtMs = Date.now();
+                }
+                await ingestTurn({
+                    api: input.api,
+                    chatUuid: input.chatUuid,
+                    agentUuid: input.agentUuid,
+                    connectorUuid: input.connectorUuid,
+                    integrationSlug: input.integrationSlug,
+                    languageModelSlug: input.languageModelSlug,
+                    question,
+                    answer: accumulator.chunks.join(""),
+                    usage: accumulator.usage,
+                    // Whatever it managed to say is a fragment, not the answer. Stored
+                    // as cancelled so a later session does not replay it as work done.
+                    cancelled: true,
+                    turnOwnerId: input.turnOwnerId,
+                    onNotice: options === undefined ? undefined : options.onNotice,
+                });
+                throw error;
+            }
+            if (didReachAnthropic(accumulator.usage) === true) {
+                proxyLastUsedAtMs = Date.now();
+            }
+            // A turn that spent tokens or edited files is recorded even when it
+            // produced no prose, so history and billing match what actually ran.
+            await ingestTurn({
+                api: input.api,
+                chatUuid: input.chatUuid,
+                agentUuid: input.agentUuid,
+                connectorUuid: input.connectorUuid,
+                integrationSlug: input.integrationSlug,
+                languageModelSlug: input.languageModelSlug,
+                question,
+                answer,
+                usage: accumulator.usage,
+                turnOwnerId: input.turnOwnerId,
+                onNotice: options === undefined ? undefined : options.onNotice,
+            });
+            // Nothing said and nothing spent means the harness never reached
+            // Anthropic — a misconfigured proxy rather than a quiet tool-only turn.
+            // Same predicate `ingestTurn` uses, so a turn that reached Anthropic
+            // is never also reported as unreachable.
+            if (answer.length === 0 &&
+                didReachAnthropic(accumulator.usage) === false) {
+                throw new Error(`Local Claude Code returned no text. The harness called ${anthropicBaseUrl} with the minted proxy token — confirm CARGO_BASE_URL points at your API and that /sandbox/anthropic is reachable.`);
+            }
+            return answer;
+        },
+        proxyLastUsedAtMs: () => proxyLastUsedAtMs,
+        close: async () => {
+            // `detach` would leave the bridge and Claude Code running for a resume
+            // that never comes, which is how orphaned bridges piled up. Nothing here
+            // is resumable by design, so take the runtime down with the session.
+            //
+            // Bounded, because Ctrl-C at the prompt now unwinds through here: a
+            // destroy that never settles would turn "stop" into a hang, which is
+            // what pressing it was meant to escape. Giving up can leave the orphan
+            // this call exists to prevent, but a teardown already stuck is no more
+            // likely to finish while the user waits on it.
+            await settleWithin(session.destroy().catch(() => undefined), SESSION_DESTROY_TIMEOUT_MS);
+        },
+    };
+}
+async function withMutedCredentialBrokerWarning(run) {
+    const originalWarn = console.warn;
+    console.warn = (...args) => {
+        const first = args[0];
+        if (typeof first === "string" &&
+            first.includes("credential brokering does not work")) {
+            return;
+        }
+        originalWarn.apply(console, args);
+    };
+    try {
+        return await run();
+    }
+    finally {
+        console.warn = originalWarn;
+    }
+}

package/build/commands/ask/harness/index.d.ts

@@ -0,0 +1,8 @@
+export { isAlwaysDenied, isAutoApproved } from "./approvals.js";
+export { createLocalHarness, type LocalHarness } from "./create.js";
+export { localHarnessInstructions, localHarnessSkills, } from "./instructions.js";
+export { resolveWorkspaceLayout } from "./layout.js";
+export { CARGO_MCP_SERVER_NAME } from "./mcp.js";
+export { HarnessTurnStalled, HarnessTurnStuck, isBridgeClosedError, type LocalStreamHandlers, type LocalStreamOptions, type LocalToolActivity, type LocalToolApproval, runPromptTurn, settleWithin, type StreamLike, type TurnDriver, } from "./turn.js";
+export { createTurnAccumulator, type LocalTurnAccumulator, type LocalTurnUsage, readClaudeCodeCostUsd, } from "./usage.js";
+//# sourceMappingURL=index.d.ts.map

package/build/commands/ask/harness/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,aAAa,EACb,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,qBAAqB,GACtB,MAAM,YAAY,CAAC"}

package/build/commands/ask/harness/index.js

@@ -0,0 +1,7 @@
+export { isAlwaysDenied, isAutoApproved } from "./approvals.js";
+export { createLocalHarness } from "./create.js";
+export { localHarnessInstructions, localHarnessSkills, } from "./instructions.js";
+export { resolveWorkspaceLayout } from "./layout.js";
+export { CARGO_MCP_SERVER_NAME } from "./mcp.js";
+export { HarnessTurnStalled, HarnessTurnStuck, isBridgeClosedError, runPromptTurn, settleWithin, } from "./turn.js";
+export { createTurnAccumulator, readClaudeCodeCostUsd, } from "./usage.js";

package/build/commands/ask/harness/ingest.d.ts

@@ -0,0 +1,25 @@
+import type { Api } from "../../../api.js";
+import { type LocalTurnUsage } from "./usage.js";
+/**
+ * Persist the turn and what it spent. Credits for a credits connector are
+ * billed on the sandbox proxy from the forwarded Anthropic response; this
+ * call writes history. `costUsd` is stored on the message, not charged.
+ *
+ * History is best effort: a failed ingest is reported but never turns a reply
+ * the user already read into a failed turn.
+ */
+export declare function ingestTurn(input: {
+    api: Api;
+    chatUuid: string;
+    agentUuid?: string;
+    connectorUuid: string;
+    integrationSlug: string;
+    languageModelSlug: string;
+    question: string;
+    answer: string;
+    usage: LocalTurnUsage;
+    cancelled?: boolean;
+    turnOwnerId?: string;
+    onNotice?: (message: string) => void;
+}): Promise<void>;
+//# sourceMappingURL=ingest.d.ts.map

package/build/commands/ask/harness/ingest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/ingest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE;IACtC,GAAG,EAAE,GAAG,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhB"}

package/build/commands/ask/harness/ingest.js

@@ -0,0 +1,35 @@
+import { didReachAnthropic } from "./usage.js";
+/**
+ * Persist the turn and what it spent. Credits for a credits connector are
+ * billed on the sandbox proxy from the forwarded Anthropic response; this
+ * call writes history. `costUsd` is stored on the message, not charged.
+ *
+ * History is best effort: a failed ingest is reported but never turns a reply
+ * the user already read into a failed turn.
+ */
+export async function ingestTurn(input) {
+    if (input.answer.length === 0 && didReachAnthropic(input.usage) === false) {
+        return;
+    }
+    try {
+        await input.api.ai.message.ingest({
+            chatUuid: input.chatUuid,
+            agentUuid: input.agentUuid,
+            connectorUuid: input.connectorUuid,
+            integrationSlug: input.integrationSlug,
+            languageModelSlug: input.languageModelSlug,
+            userParts: [{ type: "text", text: input.question }],
+            // A turn cancelled before it said anything is recorded for its usage
+            // alone, so it has no text part rather than an empty one.
+            assistantParts: input.answer.length === 0 ? [] : [{ type: "text", text: input.answer }],
+            usage: didReachAnthropic(input.usage) === true ? input.usage : undefined,
+            cancelled: input.cancelled,
+            turnOwnerId: input.turnOwnerId,
+        });
+    }
+    catch (error) {
+        if (input.onNotice !== undefined) {
+            input.onNotice(`Could not save this turn to the chat history: ${error instanceof Error ? error.message : "unknown error"}`);
+        }
+    }
+}