@cargo-ai/cli 1.0.94 → 1.0.96

package/build/commands/ask/harness/create.js

@@ -0,0 +1,314 @@
+import { HarnessAgent } from "@ai-sdk/harness/agent";
+import { createClaudeCode } from "@ai-sdk/harness-claude-code";
+import { createLocalSandbox } from "ai-sdk-sandbox-local";
+import { pruneHarnessArtifacts } from "./artifacts.js";
+import { buildAskUserQuestionHostTool, denyNativeAskUserQuestion, } from "./askUserQuestion.js";
+import { askClaudeConfigDir } from "./claudeConfig.js";
+import { ingestTurn } from "./ingest.js";
+import { localHarnessInstructions, localHarnessSkills, } from "./instructions.js";
+import { resolveWorkspaceLayout } from "./layout.js";
+import { CARGO_MCP_SERVER_NAME, cargoMcpServer } from "./mcp.js";
+import { ensureHarnessPnpmOnPath } from "./pnpmShim.js";
+import { buildReleaseHostTools, buildReleaseMcpServers } from "./release.js";
+import { withGetPortEndpoint } from "./sandbox.js";
+import { ASK_TIMING_ENABLED, createPhaseLog, reportHarnessDiagnostic, timeStreamParts, } from "./timing.js";
+import { HarnessTurnStuck, runPromptTurn, settleWithin, } from "./turn.js";
+import { createTurnAccumulator, didReachAnthropic } from "./usage.js";
+/**
+ * How long teardown may take before the session is abandoned. Short, because
+ * the caller is usually someone who just pressed Ctrl-C.
+ */
+const SESSION_DESTROY_TIMEOUT_MS = 5_000;
+/**
+ * How long winding down a previous unfinished turn may take before it is cut
+ * off and the question refused.
+ */
+const TURN_DRAIN_TIMEOUT_MS = 30_000;
+export async function createLocalHarness(input) {
+    const setupPhase = createPhaseLog("setup");
+    // Claude Code bootstrap shells out to `pnpm`; Volta often has a dead shim
+    // and pnpm 9 refuses this npm packageManager root — put pnpm@10 first.
+    ensureHarnessPnpmOnPath();
+    setupPhase("pnpm shim written to PATH");
+    const workspace = resolveWorkspaceLayout(input.dir);
+    pruneHarnessArtifacts(workspace.sandboxCwd);
+    // Earlier versions rooted the sandbox at the project, so its artifacts are
+    // still in there to collect.
+    if (workspace.sandboxCwd !== input.dir) {
+        pruneHarnessArtifacts(input.dir);
+    }
+    setupPhase("stale harness artifacts pruned");
+    const anthropicBaseUrl = `${input.apiBaseUrl.replace(/\/$/, "")}/sandbox/anthropic`;
+    const release = input.release;
+    const releaseTools = input.allowWorkspaceMutations === false || release === undefined
+        ? {}
+        : buildReleaseHostTools(input.api, release.actions);
+    // Bound per prompt: the picker lives on the turn, the tool on the session.
+    const askUserQuestionAsk = { current: undefined };
+    const hostTools = {
+        ...releaseTools,
+        ...buildAskUserQuestionHostTool(() => askUserQuestionAsk.current),
+    };
+    const mcpServers = {
+        [CARGO_MCP_SERVER_NAME]: cargoMcpServer(input.apiBaseUrl),
+    };
+    if (release !== undefined && input.allowWorkspaceMutations === true) {
+        const extra = buildReleaseMcpServers(release.mcpClients);
+        for (const [name, server] of Object.entries(extra)) {
+            mcpServers[name] = server;
+        }
+    }
+    // Pin auth the same way the backend harness stream does. Credentials go
+    // through `auth`, not `env`: passing them via `env` alone lets
+    // createClaudeCode auto-detect AI Gateway from the host process and ignore
+    // the Cargo proxy.
+    const claudeCode = createClaudeCode({
+        auth: {
+            ANTHROPIC_BASE_URL: anthropicBaseUrl,
+            ANTHROPIC_API_KEY: input.proxyToken,
+        },
+        env: { CLAUDE_CONFIG_DIR: askClaudeConfigDir() },
+        mcpServers,
+    });
+    const harnessAgent = new HarnessAgent({
+        // Native AskUserQuestion is withheld on the session, not via
+        // `inactiveTools` (that would drop the host tool of the same name) and
+        // not via settings.json deny (that name matches the replacement too).
+        harness: {
+            ...claudeCode,
+            doStart: async (startOpts) => claudeCode.doStart({
+                ...startOpts,
+                builtinToolFiltering: denyNativeAskUserQuestion(startOpts.builtinToolFiltering),
+            }),
+        },
+        id: "cargo-ai-ask",
+        sandbox: withGetPortEndpoint(createLocalSandbox({ cwd: workspace.sandboxCwd })),
+        sandboxConfig: workspace.workDir === undefined ? {} : { workDir: workspace.workDir },
+        instructions: localHarnessInstructions(input.dir, release),
+        skills: localHarnessSkills(input.dir),
+        model: input.languageModelSlug,
+        // Nested @ai-sdk/harness ships its own @ai-sdk/provider-utils, so its
+        // ToolSet does not unify with this package's. Runtime shape is the same.
+        tools: hostTools,
+        permissionMode: "allow-reads",
+        ...(ASK_TIMING_ENABLED === false
+            ? {}
+            : { debug: { enabled: true }, onLog: reportHarnessDiagnostic }),
+    });
+    setupPhase("harness agent constructed");
+    // Local sandbox cannot broker credentials via request transforms; the
+    // harness always warns. Keep that off the Ask tree (stderr mid-reply).
+    const session = await withMutedCredentialBrokerWarning(() => harnessAgent.createSession());
+    setupPhase("harness session created");
+    // Consumed by the first prompt: this session has never seen the chat, so it
+    // is told the story once rather than on every question.
+    let pendingHistory = input.history;
+    let proxyLastUsedAtMs;
+    // Approvals the previous turn asked about and never answered — a turn
+    // cancelled at the confirmation prompt leaves one here.
+    const unanswered = [];
+    return {
+        streamPrompt: async (question, options) => {
+            const turnPhase = createPhaseLog("turn ");
+            turnPhase("prompt submitted");
+            const abortSignal = options === undefined ? undefined : options.abortSignal;
+            // The turn is stored and shown as the user wrote it; only what Claude
+            // Code is asked carries the replayed history.
+            const prompt = pendingHistory === undefined
+                ? question
+                : `${pendingHistory}\n\n${question}`;
+            // A cancelled turn stays unfinished, and the harness refuses a new
+            // prompt until it is drained. Do that here rather than making the next
+            // question fail with "must be continued before accepting a new prompt".
+            if (session.hasUnfinishedTurn() === true) {
+                // Anything the last turn asked about and never got an answer for is
+                // denied. Draining with no continuations leaves the runtime waiting
+                // on a response that is never coming, and the honest reading of a
+                // user who walked away from the prompt is "no" — carrying the
+                // question into a turn they did not ask for would be worse.
+                const denials = unanswered.map((approval) => ({
+                    approvalResponse: {
+                        type: "tool-approval-response",
+                        approvalId: approval.approvalId,
+                        approved: false,
+                    },
+                    toolCall: {
+                        type: "tool-call",
+                        toolCallId: approval.toolCallId,
+                        toolName: approval.toolName,
+                        input: approval.input,
+                    },
+                }));
+                unanswered.length = 0;
+                // The drain gets its own controller so the timeout can stop it rather
+                // than walk away from it. Nothing watches this call the way the stall
+                // watchdog watches a turn's stream, so a runtime that never settles
+                // would otherwise hang the question just asked — but abandoning the
+                // promise and carrying on is no better: `continueGenerate` keeps
+                // running, and submitting the new prompt to the same session races the
+                // turn we failed to wind down. Chained to the turn's signal so ctrl-c
+                // still gets out of it.
+                const drain = new AbortController();
+                const abortDrain = () => drain.abort();
+                if (abortSignal !== undefined) {
+                    if (abortSignal.aborted === true) {
+                        drain.abort();
+                    }
+                    else {
+                        abortSignal.addEventListener("abort", abortDrain, { once: true });
+                    }
+                }
+                const drainTimer = setTimeout(abortDrain, TURN_DRAIN_TIMEOUT_MS);
+                try {
+                    await harnessAgent.continueGenerate({
+                        session,
+                        toolApprovalContinuations: denials,
+                        abortSignal: drain.signal,
+                    });
+                }
+                catch {
+                    // Whether it failed or was cut off, the session itself is the only
+                    // thing that can say if a new prompt is allowed.
+                }
+                finally {
+                    clearTimeout(drainTimer);
+                    if (abortSignal !== undefined) {
+                        abortSignal.removeEventListener("abort", abortDrain);
+                    }
+                }
+                if (session.hasUnfinishedTurn() === true) {
+                    throw new HarnessTurnStuck();
+                }
+                turnPhase("unfinished previous turn drained");
+            }
+            const accumulator = createTurnAccumulator();
+            let answer;
+            askUserQuestionAsk.current =
+                options === undefined ? undefined : options.onUserQuestion;
+            try {
+                answer = await runPromptTurn({
+                    driver: {
+                        start: async () => {
+                            turnPhase("harness stream() called");
+                            const stream = (await harnessAgent.stream({
+                                prompt,
+                                session,
+                                abortSignal,
+                            }));
+                            turnPhase("harness stream() returned");
+                            // The prompt is in the session now, so the replayed history has
+                            // been told. Cleared here rather than before submitting: a turn
+                            // that never reached the harness must keep it for the retry, or
+                            // a cancelled first question would leave every later one in this
+                            // process without the earlier conversation.
+                            pendingHistory = undefined;
+                            return timeStreamParts(stream, turnPhase);
+                        },
+                        continueWithApprovals: async (continuations) => {
+                            turnPhase("harness continueStream() called");
+                            const stream = (await harnessAgent.continueStream({
+                                session,
+                                toolApprovalContinuations: continuations,
+                                abortSignal,
+                            }));
+                            turnPhase("harness continueStream() returned");
+                            return timeStreamParts(stream, turnPhase);
+                        },
+                    },
+                    handlers: options,
+                    accumulator,
+                    unanswered,
+                    // Interrupt Claude Code through the turn's abort signal so the
+                    // bridge stops cleanly. Without this the host walks away from the
+                    // stream and teardown looks like "bridge closed before the turn
+                    // finished" rather than an intentional stop.
+                    onStall: options === undefined ? undefined : options.onStall,
+                });
+            }
+            catch (error) {
+                // Cancelled or failed after Claude Code already spent tokens. Record
+                // what it spent, then let the caller handle the failure.
+                if (didReachAnthropic(accumulator.usage) === true) {
+                    proxyLastUsedAtMs = Date.now();
+                }
+                await ingestTurn({
+                    api: input.api,
+                    chatUuid: input.chatUuid,
+                    agentUuid: input.agentUuid,
+                    connectorUuid: input.connectorUuid,
+                    integrationSlug: input.integrationSlug,
+                    languageModelSlug: input.languageModelSlug,
+                    question,
+                    answer: accumulator.chunks.join(""),
+                    usage: accumulator.usage,
+                    // Whatever it managed to say is a fragment, not the answer. Stored
+                    // as cancelled so a later session does not replay it as work done.
+                    cancelled: true,
+                    turnOwnerId: input.turnOwnerId,
+                    onNotice: options === undefined ? undefined : options.onNotice,
+                });
+                throw error;
+            }
+            finally {
+                askUserQuestionAsk.current = undefined;
+            }
+            if (didReachAnthropic(accumulator.usage) === true) {
+                proxyLastUsedAtMs = Date.now();
+            }
+            // A turn that spent tokens or edited files is recorded even when it
+            // produced no prose, so history and billing match what actually ran.
+            await ingestTurn({
+                api: input.api,
+                chatUuid: input.chatUuid,
+                agentUuid: input.agentUuid,
+                connectorUuid: input.connectorUuid,
+                integrationSlug: input.integrationSlug,
+                languageModelSlug: input.languageModelSlug,
+                question,
+                answer,
+                usage: accumulator.usage,
+                turnOwnerId: input.turnOwnerId,
+                onNotice: options === undefined ? undefined : options.onNotice,
+            });
+            // Nothing said and nothing spent means the harness never reached
+            // Anthropic — a misconfigured proxy rather than a quiet tool-only turn.
+            // Same predicate `ingestTurn` uses, so a turn that reached Anthropic
+            // is never also reported as unreachable.
+            if (answer.length === 0 &&
+                didReachAnthropic(accumulator.usage) === false) {
+                throw new Error(`Local Claude Code returned no text. The harness called ${anthropicBaseUrl} with the minted proxy token — confirm CARGO_BASE_URL points at your API and that /sandbox/anthropic is reachable.`);
+            }
+            return answer;
+        },
+        proxyLastUsedAtMs: () => proxyLastUsedAtMs,
+        close: async () => {
+            // `detach` would leave the bridge and Claude Code running for a resume
+            // that never comes, which is how orphaned bridges piled up. Nothing here
+            // is resumable by design, so take the runtime down with the session.
+            //
+            // Bounded, because Ctrl-C at the prompt now unwinds through here: a
+            // destroy that never settles would turn "stop" into a hang, which is
+            // what pressing it was meant to escape. Giving up can leave the orphan
+            // this call exists to prevent, but a teardown already stuck is no more
+            // likely to finish while the user waits on it.
+            await settleWithin(session.destroy().catch(() => undefined), SESSION_DESTROY_TIMEOUT_MS);
+        },
+    };
+}
+async function withMutedCredentialBrokerWarning(run) {
+    const originalWarn = console.warn;
+    console.warn = (...args) => {
+        const first = args[0];
+        if (typeof first === "string" &&
+            first.includes("credential brokering does not work")) {
+            return;
+        }
+        originalWarn.apply(console, args);
+    };
+    try {
+        return await run();
+    }
+    finally {
+        console.warn = originalWarn;
+    }
+}

package/build/commands/ask/harness/index.d.ts

@@ -0,0 +1,9 @@
+export { isAlwaysDenied, isAutoApproved } from "./approvals.js";
+export { ASK_USER_QUESTION_DENIED_REASON, ASK_USER_QUESTION_MISSING_INPUT_REASON, ASK_USER_QUESTION_TOOL_NAME, buildAskUserQuestionHostTool, denyNativeAskUserQuestion, formatAskUserQuestionAnswers, readAskUserQuestions, summarizeAskUserQuestion, } from "./askUserQuestion.js";
+export { createLocalHarness, type LocalHarness } from "./create.js";
+export { localHarnessInstructions, localHarnessSkills, } from "./instructions.js";
+export { resolveWorkspaceLayout } from "./layout.js";
+export { CARGO_MCP_SERVER_NAME } from "./mcp.js";
+export { HarnessTurnStalled, HarnessTurnStuck, isBridgeClosedError, type LocalStreamHandlers, type LocalStreamOptions, type LocalToolActivity, type LocalToolApproval, runPromptTurn, settleWithin, type StreamLike, type TurnDriver, } from "./turn.js";
+export { createTurnAccumulator, type LocalTurnAccumulator, type LocalTurnUsage, readClaudeCodeCostUsd, } from "./usage.js";
+//# sourceMappingURL=index.d.ts.map

package/build/commands/ask/harness/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,EACtC,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,aAAa,EACb,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,qBAAqB,GACtB,MAAM,YAAY,CAAC"}

package/build/commands/ask/harness/index.js

@@ -0,0 +1,8 @@
+export { isAlwaysDenied, isAutoApproved } from "./approvals.js";
+export { ASK_USER_QUESTION_DENIED_REASON, ASK_USER_QUESTION_MISSING_INPUT_REASON, ASK_USER_QUESTION_TOOL_NAME, buildAskUserQuestionHostTool, denyNativeAskUserQuestion, formatAskUserQuestionAnswers, readAskUserQuestions, summarizeAskUserQuestion, } from "./askUserQuestion.js";
+export { createLocalHarness } from "./create.js";
+export { localHarnessInstructions, localHarnessSkills, } from "./instructions.js";
+export { resolveWorkspaceLayout } from "./layout.js";
+export { CARGO_MCP_SERVER_NAME } from "./mcp.js";
+export { HarnessTurnStalled, HarnessTurnStuck, isBridgeClosedError, runPromptTurn, settleWithin, } from "./turn.js";
+export { createTurnAccumulator, readClaudeCodeCostUsd, } from "./usage.js";

package/build/commands/ask/harness/ingest.d.ts

@@ -0,0 +1,25 @@
+import type { Api } from "../../../api.js";
+import { type LocalTurnUsage } from "./usage.js";
+/**
+ * Persist the turn and what it spent. Credits for a credits connector are
+ * billed on the sandbox proxy from the forwarded Anthropic response; this
+ * call writes history. `costUsd` is stored on the message, not charged.
+ *
+ * History is best effort: a failed ingest is reported but never turns a reply
+ * the user already read into a failed turn.
+ */
+export declare function ingestTurn(input: {
+    api: Api;
+    chatUuid: string;
+    agentUuid?: string;
+    connectorUuid: string;
+    integrationSlug: string;
+    languageModelSlug: string;
+    question: string;
+    answer: string;
+    usage: LocalTurnUsage;
+    cancelled?: boolean;
+    turnOwnerId?: string;
+    onNotice?: (message: string) => void;
+}): Promise<void>;
+//# sourceMappingURL=ingest.d.ts.map

package/build/commands/ask/harness/ingest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/ingest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE;IACtC,GAAG,EAAE,GAAG,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhB"}

package/build/commands/ask/harness/ingest.js

@@ -0,0 +1,35 @@
+import { didReachAnthropic } from "./usage.js";
+/**
+ * Persist the turn and what it spent. Credits for a credits connector are
+ * billed on the sandbox proxy from the forwarded Anthropic response; this
+ * call writes history. `costUsd` is stored on the message, not charged.
+ *
+ * History is best effort: a failed ingest is reported but never turns a reply
+ * the user already read into a failed turn.
+ */
+export async function ingestTurn(input) {
+    if (input.answer.length === 0 && didReachAnthropic(input.usage) === false) {
+        return;
+    }
+    try {
+        await input.api.ai.message.ingest({
+            chatUuid: input.chatUuid,
+            agentUuid: input.agentUuid,
+            connectorUuid: input.connectorUuid,
+            integrationSlug: input.integrationSlug,
+            languageModelSlug: input.languageModelSlug,
+            userParts: [{ type: "text", text: input.question }],
+            // A turn cancelled before it said anything is recorded for its usage
+            // alone, so it has no text part rather than an empty one.
+            assistantParts: input.answer.length === 0 ? [] : [{ type: "text", text: input.answer }],
+            usage: didReachAnthropic(input.usage) === true ? input.usage : undefined,
+            cancelled: input.cancelled,
+            turnOwnerId: input.turnOwnerId,
+        });
+    }
+    catch (error) {
+        if (input.onNotice !== undefined) {
+            input.onNotice(`Could not save this turn to the chat history: ${error instanceof Error ? error.message : "unknown error"}`);
+        }
+    }
+}

package/build/commands/ask/harness/instructions.d.ts

@@ -0,0 +1,13 @@
+import type { Ai } from "@cargo-ai/api";
+/**
+ * Always-on local-copy rails, plus CDK rails only when `dir` is a CDK project.
+ * Exported for tests.
+ */
+export declare function localHarnessInstructions(dir: string, release?: Ai.Release): string;
+/** Exported for tests. */
+export declare function localHarnessSkills(dir: string): Array<{
+    name: string;
+    description: string;
+    content: string;
+}>;
+//# sourceMappingURL=instructions.d.ts.map

package/build/commands/ask/harness/instructions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/instructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AAwBxC;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,GACnB,MAAM,CAkBR;AAED,0BAA0B;AAC1B,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAM/D"}

package/build/commands/ask/harness/instructions.js

@@ -0,0 +1,43 @@
+import { cdkProjectRoot } from "@cargo-ai/cdk/cli";
+import { buildReleaseInstructionAppendix } from "./release.js";
+const LOCAL_WORKING_COPY_INSTRUCTIONS = `You are working in the user's local working copy, not a sandbox. Prefer plan over deploy.
+
+The user confirms each Bash, Write, Edit and NotebookEdit call, and can only answer one at a time. Ask for a single one of those per step and wait for its result before asking for the next; two in one step leaves the second waiting on a confirmation it will never be offered. Reads (Read, Glob, Grep) and the Cargo \`mcp__cargo__*\` tools need no confirmation — batch those freely.
+
+When you need a multiple-choice answer, call AskUserQuestion. This session presents the options in the terminal and returns the user's answers as the tool result. Do not wait for a Claude Code question picker.
+
+Prefer minimal, focused diffs; match the existing code style; run the project's own checks when they exist. End each task with a short summary of what changed and how it was validated.`;
+const CDK_RAILS_INSTRUCTIONS = `This directory is a Cargo CDK project.
+- Never edit cargo.state.json, cargo.state.lock, or .cargo-ai/ by hand — they are generated. Repoint this project's deploy state with \`cargo-cdk state bind\`.
+- Validate your changes before declaring them done: run \`npx tsc --noEmit\` and \`npx cargo-cdk plan\` (plan only reads — it changes nothing).
+- Never run \`cargo-cdk deploy\`, \`destroy\`, \`import\`, or \`rollback\` unless the user explicitly asked.`;
+const LOCAL_CDK_RAILS_SKILL = {
+    name: "cdk-rails",
+    description: "Rails for working on a Cargo CDK project on this machine.",
+    content: CDK_RAILS_INSTRUCTIONS,
+};
+/**
+ * Always-on local-copy rails, plus CDK rails only when `dir` is a CDK project.
+ * Exported for tests.
+ */
+export function localHarnessInstructions(dir, release) {
+    const rails = cdkProjectRoot(dir) !== undefined
+        ? `${LOCAL_WORKING_COPY_INSTRUCTIONS}\n\n${CDK_RAILS_INSTRUCTIONS}`
+        : LOCAL_WORKING_COPY_INSTRUCTIONS;
+    if (release === undefined) {
+        return rails;
+    }
+    const parts = [release.systemPrompt, rails];
+    const appendix = buildReleaseInstructionAppendix(release);
+    if (appendix !== undefined) {
+        parts.push(appendix);
+    }
+    return parts.join("\n\n");
+}
+/** Exported for tests. */
+export function localHarnessSkills(dir) {
+    if (cdkProjectRoot(dir) !== undefined) {
+        return [LOCAL_CDK_RAILS_SKILL];
+    }
+    return [];
+}

package/build/commands/ask/harness/layout.d.ts

@@ -0,0 +1,23 @@
+export type WorkspaceLayout = {
+    sandboxCwd: string;
+    /** `undefined` leaves the harness its per-session default. */
+    workDir: string | undefined;
+};
+/**
+ * Where to root the sandbox, and which directory inside it the session works in.
+ *
+ * The harness gives every session a work directory under the sandbox root and
+ * starts Claude Code there — `cwd: workdir` in the bridge — and it refuses to
+ * use the root itself. Rooted at the project, that means the agent begins in an
+ * empty `claude-code-<sessionId>` directory one level below the working copy it
+ * was asked about. Rooting at the project's parent instead makes the session
+ * work directory *be* the project, so the agent starts where the user is, and
+ * the harness's own artifacts land beside the project rather than in it.
+ *
+ * Falls back to the project when the parent cannot serve — a project at a
+ * filesystem root has no usable name, and a parent we cannot write to would
+ * fail the session at startup. The per-session directory returns in that case,
+ * and `pruneHarnessArtifacts` sweeps it once it is cold.
+ */
+export declare function resolveWorkspaceLayout(dir: string): WorkspaceLayout;
+//# sourceMappingURL=layout.d.ts.map

package/build/commands/ask/harness/layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/layout.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAenE"}

package/build/commands/ask/harness/layout.js

@@ -0,0 +1,32 @@
+import { accessSync, constants } from "node:fs";
+import { basename, dirname } from "node:path";
+/**
+ * Where to root the sandbox, and which directory inside it the session works in.
+ *
+ * The harness gives every session a work directory under the sandbox root and
+ * starts Claude Code there — `cwd: workdir` in the bridge — and it refuses to
+ * use the root itself. Rooted at the project, that means the agent begins in an
+ * empty `claude-code-<sessionId>` directory one level below the working copy it
+ * was asked about. Rooting at the project's parent instead makes the session
+ * work directory *be* the project, so the agent starts where the user is, and
+ * the harness's own artifacts land beside the project rather than in it.
+ *
+ * Falls back to the project when the parent cannot serve — a project at a
+ * filesystem root has no usable name, and a parent we cannot write to would
+ * fail the session at startup. The per-session directory returns in that case,
+ * and `pruneHarnessArtifacts` sweeps it once it is cold.
+ */
+export function resolveWorkspaceLayout(dir) {
+    const parent = dirname(dir);
+    const name = basename(dir);
+    if (parent === dir || name.length === 0) {
+        return { sandboxCwd: dir, workDir: undefined };
+    }
+    try {
+        accessSync(parent, constants.W_OK);
+    }
+    catch {
+        return { sandboxCwd: dir, workDir: undefined };
+    }
+    return { sandboxCwd: parent, workDir: name };
+}

package/build/commands/ask/harness/mcp.d.ts

@@ -0,0 +1,25 @@
+/**
+ * What Claude Code mounts this server as, and so the `mcp__<server>__` prefix
+ * its tools carry. Read by `isAutoApproved`, which trusts this server and no
+ * other — see the note there.
+ *
+ * Exported for tests.
+ */
+export declare const CARGO_MCP_SERVER_NAME = "cargo";
+/**
+ * The workspace half of local Ask: the hosted Cargo MCP server, reached
+ * through this CLI's own `mcp` bridge.
+ *
+ * Going through the bridge rather than configuring the HTTP endpoint directly
+ * is what keeps a long chat working — the bridge rebuilds the `Authorization`
+ * header per request from the same credentials every other command uses, so an
+ * OAuth session that expires mid-session renews instead of 401ing. `CARGO_BASE_URL`
+ * is pinned so the bridge cannot end up on a different API than this session.
+ *
+ * Everything the workspace can do arrives this way: actions, runs, models and
+ * SQL, the context, usage. That includes `execute_action`, which spends credits
+ * and writes to connected systems — see the approval note on
+ * `isAutoApproved`.
+ */
+export declare function cargoMcpServer(apiBaseUrl: string): Record<string, unknown>;
+//# sourceMappingURL=mcp.d.ts.map

package/build/commands/ask/harness/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/mcp.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAO1E"}

package/build/commands/ask/harness/mcp.js

@@ -0,0 +1,72 @@
+import { fileURLToPath } from "node:url";
+/**
+ * What Claude Code mounts this server as, and so the `mcp__<server>__` prefix
+ * its tools carry. Read by `isAutoApproved`, which trusts this server and no
+ * other — see the note there.
+ *
+ * Exported for tests.
+ */
+export const CARGO_MCP_SERVER_NAME = "cargo";
+/**
+ * The workspace half of local Ask: the hosted Cargo MCP server, reached
+ * through this CLI's own `mcp` bridge.
+ *
+ * Going through the bridge rather than configuring the HTTP endpoint directly
+ * is what keeps a long chat working — the bridge rebuilds the `Authorization`
+ * header per request from the same credentials every other command uses, so an
+ * OAuth session that expires mid-session renews instead of 401ing. `CARGO_BASE_URL`
+ * is pinned so the bridge cannot end up on a different API than this session.
+ *
+ * Everything the workspace can do arrives this way: actions, runs, models and
+ * SQL, the context, usage. That includes `execute_action`, which spends credits
+ * and writes to connected systems — see the approval note on
+ * `isAutoApproved`.
+ */
+export function cargoMcpServer(apiBaseUrl) {
+    return {
+        type: "stdio",
+        command: process.execPath,
+        args: [...loaderArgs(), cliEntryPath(), "mcp"],
+        env: { CARGO_BASE_URL: apiBaseUrl },
+    };
+}
+/**
+ * This CLI's own entry, so the bridge is the same code and version as the
+ * session that spawned it — not whatever `cargo-ai` happens to be on PATH.
+ */
+function cliEntryPath() {
+    const entry = process.argv[1];
+    return entry !== undefined && entry.length > 0
+        ? entry
+        : fileURLToPath(new URL("../../../index.js", import.meta.url));
+}
+/**
+ * Loader flags only. A dev run under `tsx` starts from a `.ts` entry that bare
+ * node cannot execute, so the child needs the same loader; the rest of
+ * `execArgv` (`--inspect` above all, which would fight over a port) must not
+ * be inherited.
+ */
+function loaderArgs() {
+    const flags = ["--import", "--loader", "--require"];
+    const args = [];
+    for (let index = 0; index < process.execArgv.length; index += 1) {
+        const arg = process.execArgv[index];
+        if (arg === undefined) {
+            continue;
+        }
+        // `--import=tsx` carries its value; `--import tsx` is two entries and the
+        // second one has to come along.
+        if (flags.some((flag) => arg.startsWith(`${flag}=`)) === true) {
+            args.push(arg);
+            continue;
+        }
+        if (flags.includes(arg) === true) {
+            const value = process.execArgv[index + 1];
+            if (value !== undefined) {
+                args.push(arg, value);
+                index += 1;
+            }
+        }
+    }
+    return args;
+}

package/build/commands/ask/harness/pnpmShim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpmShim.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/pnpmShim.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,8EAA8E;AAC9E,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAchD;AAED,mDAAmD;AACnD,wBAAgB,qBAAqB,IAAI,MAAM,CAI9C"}

package/build/commands/ask/harness/release.d.ts

@@ -0,0 +1,18 @@
+import type { Ai, Orchestration } from "@cargo-ai/api";
+import type { Api } from "../../../api.js";
+/** Mount prefix so agent MCP tools can be auto-approved without widening user MCP. */
+export declare const CARGO_AGENT_MCP_NAME_PREFIX = "cargoagent_";
+type HostTool = {
+    description?: string;
+    inputSchema: {
+        type: "object";
+        additionalProperties: true;
+    };
+    execute: (data: unknown) => Promise<unknown>;
+};
+export declare function buildReleaseInstructionAppendix(release: Ai.Release): string | undefined;
+export declare function buildReleaseMcpServers(mcpClients: Ai.McpClient[]): Record<string, unknown>;
+export declare function buildReleaseHostTools(api: Api, actions: Ai.Action[]): Record<string, HostTool>;
+export declare function toExecuteAction(action: Ai.Action): Orchestration.Api.ExecuteActionPayload["action"];
+export {};
+//# sourceMappingURL=release.d.ts.map