@dungle-scrubs/harness-cli-normalizer 0.6.1 → 0.6.3

package/src/interpretation/argv.ts

@@ -10,6 +10,7 @@ import type {
   StreamingGranularity,
 } from "../knowledge/descriptor.js";
 import { defaultDescriptors } from "../knowledge/overrides.js";
+import { assertIsolationCombination } from "./isolation.js";
 import { ArgvRefusalError } from "./refusal.js";
 import { assertUsableSessionId, SESSION_ID_MAX, SessionIdRefusalError } from "./session-id.js";
 import { renderSkillsSelection, type SkillsSelection } from "./skills-selection.js";
@@ -61,6 +62,7 @@ export interface DiscoveryOptions {
 }
 
 export interface TurnOptions {
+  readonly isolation?: "tool-free";
   readonly prompt: Prompt;
   readonly tools?: readonly string[];
   readonly excludeTools?: readonly string[];
@@ -205,6 +207,7 @@ export interface SpawnArgvOptions extends TurnOptions {
  * passthrough tail after a bare separator. One owner, so the CLI's preview
  * and the runner's spawn agree by construction (RFC-02 change 10). */
 export const buildSpawnArgv = (h: HarnessDescriptor, opts: SpawnArgvOptions): string[] => {
+  assertIsolationCombination(h, opts);
   const base =
     opts.resume === undefined
       ? buildLaunchArgv(h, opts)

package/src/interpretation/isolation.ts

@@ -0,0 +1,39 @@
+import type { HarnessDescriptor } from "../knowledge/descriptor.js";
+import type { TurnOptions } from "./argv.js";
+import { ArgvRefusalError } from "./refusal.js";
+
+/** Isolation owns these dimensions for the whole invocation. Config defaults
+ * yield to it; explicit competing selections refuse before registry reads. */
+export const ISOLATION_OVERRIDES = [
+  "tools",
+  "excludeTools",
+  "skills",
+  "access",
+  "autonomy",
+  "discovery",
+] as const;
+export const assertIsolationCombination = (
+  h: HarnessDescriptor,
+  opts: Partial<TurnOptions> & {
+    readonly skillNames?: readonly string[];
+    readonly passthrough?: readonly string[];
+  },
+): void => {
+  if (opts.isolation === undefined) return;
+  const conflict =
+    ISOLATION_OVERRIDES.find((key) =>
+      key === "autonomy" ? opts[key] === true : opts[key] !== undefined,
+    ) ??
+    (opts.skillNames !== undefined ? "skills" : undefined) ??
+    (opts.passthrough?.length ? "native passthrough" : undefined);
+  if (conflict === undefined) return;
+  throw new ArgvRefusalError({
+    issue: "mutually-exclusive-options",
+    harness: h.name,
+    option: "isolation",
+    detail: conflict,
+    supported: [
+      "tool-free without explicit tools, skills, access, autonomy, discovery, or native passthrough",
+    ],
+  });
+};

package/src/interpretation/resolve-options.ts

@@ -11,6 +11,7 @@ import type { HarnessDescriptor } from "../knowledge/descriptor.js";
 import { defaultDescriptors } from "../knowledge/overrides.js";
 import { DEFAULT_TURN_PROFILE, type ProfileKey } from "../knowledge/profile.js";
 import type { TurnOptions } from "./argv.js";
+import { assertIsolationCombination, ISOLATION_OVERRIDES } from "./isolation.js";
 import type { QuestionMode } from "./question.js";
 import { ArgvRefusalError } from "./refusal.js";
 import type { ToolMapConfig } from "./tool-vocabulary.js";
@@ -152,10 +153,17 @@ export const resolveEffectiveOptions = (
   args: TurnOptions,
   tiers: ConfigTiers = {},
 ): ResolvedOptions => {
+  assertIsolationCombination(h, args);
   const provenance: ProvenanceEntry[] = [];
+  if (args.isolation !== undefined)
+    provenance.push({ key: "isolation", value: args.isolation, tier: "arg" });
   const unrenderable: string[] = [];
-  const config = effectiveConfig(tiers);
+  const config = { ...effectiveConfig(tiers) };
+  if (args.isolation !== undefined) {
+    for (const key of ISOLATION_OVERRIDES) delete config[key];
+  }
   const sourceTier = (key: string): ProvenanceTier | undefined => {
+    if (config[key as keyof TurnOptions] === undefined) return undefined;
     if (tiers.project?.[key as keyof TurnOptions] !== undefined) return "project-config";
     if (tiers.user?.[key as keyof TurnOptions] !== undefined) return "user-config";
     return undefined;
@@ -288,6 +296,10 @@ export const resolveEffectiveOptions = (
 
   // Profile is the floor: apply only where nothing above it set the key.
   for (const [key, value] of Object.entries(DEFAULT_TURN_PROFILE)) {
+    if (args.isolation !== undefined && ISOLATION_OVERRIDES.some((owned) => owned === key)) {
+      provenance.push({ key, value: "disabled (tool-free isolation)", tier: "arg" });
+      continue;
+    }
     const argsSet = effectiveArgs[key as keyof TurnOptions] !== undefined;
     const tier = sourceTier(key);
     if (argsSet) {

package/src/interpretation/support.ts

@@ -51,6 +51,7 @@ const spellingOf = (h: HarnessDescriptor, option: RefusalOption): string | null
     }
     case "autonomy":
       return h.autonomy?.flag ?? null;
+    case "isolation":
     case "effort":
     case "sandbox":
     case "contextWindow":
@@ -124,6 +125,7 @@ export const recognizeNativeSpelling = (
     "tools",
     "excludeTools",
     "autonomy",
+    "isolation",
     "effort",
     "sandbox",
     "contextWindow",

package/src/interpretation/turn-options.ts

@@ -24,6 +24,7 @@ import {
 import { defaultDescriptors } from "../knowledge/overrides.js";
 import type { DiscoveryOptions, TurnOptions } from "./argv.js";
 import { hintFor } from "./hints.js";
+import { assertIsolationCombination } from "./isolation.js";
 import { ArgvRefusalError } from "./refusal.js";
 import { supportedBy } from "./support.js";
 import { renderToolSelection } from "./tool-selection.js";
@@ -41,6 +42,7 @@ export const renderTurnOptions = (
   opts: TurnOptions,
   phase: "launch" | "resume",
 ): string[] => {
+  assertIsolationCombination(h, opts);
   const sequences: string[][] = [];
   // The turn option the access preset displaces when set (codex: sandbox),
   // read from the descriptor so no arm below branches on a harness name.

package/src/knowledge/claude-code.ts

@@ -9,7 +9,9 @@
  * `ANTHROPIC_API_KEY` / `apiKeyHelper` (OAuth never read) - so a caller
  * authenticated via OAuth would break. The descriptor therefore offers no
  * `instructionFiles` facet and a call passing it must refuse. Likewise
- * `tools` has no discovery flag on claude and refuses.
+ * `tools` has no discovery flag on claude and refuses. The explicit
+ * tool-free isolation composite below accepts the bare-mode auth cost and
+ * disables native tools too. It is separate from a granular discovery facet.
  *
  * Effort: A-002 showed `--effort bogus` warns on stderr and runs at DEFAULT
  * effort, exit 0, with nothing echoed in the stream. The library-side
@@ -115,9 +117,16 @@ export const claudeCode: HarnessDescriptor = deepFreeze({
   autonomy: { flag: "--dangerously-skip-permissions" },
   vocabulary: {
     modelFlag: "--model",
-    models: ["claude-fable-5", "claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5-20251001"],
+    // https://platform.claude.com/docs/en/models/fable-5-1/overview
+    models: [
+      "claude-fable-5-1",
+      "claude-fable-5",
+      "claude-opus-5",
+      "claude-sonnet-5",
+      "claude-haiku-4-5-20251001",
+    ],
     aliases: {
-      fable: "claude-fable-5",
+      fable: "claude-fable-5-1",
       opus: "claude-opus-5",
       sonnet: "claude-sonnet-5",
       haiku: "claude-haiku-4-5-20251001",
@@ -161,6 +170,17 @@ export const claudeCode: HarnessDescriptor = deepFreeze({
     observedOn: { harness: "claude", model: "", version: "2.1.235", date: "2026-08-19" },
   },
   turnOptions: {
+    // Native CLI reference: bare removes discovery; the empty built-in list and
+    // MCP deny remove tool access. Resume and native overrides are refused.
+    isolation: {
+      kind: "enum",
+      values: ["tool-free"],
+      resumeRender: null,
+      render: {
+        kind: "flag-list",
+        flags: ["--bare", "--tools", "", "--disallowedTools", "mcp__*", "--strict-mcp-config"],
+      },
+    },
     effort: { kind: "effort", render: { kind: "flag-value", flag: "--effort" } },
     // issue #48, live-verified 2.1.235: --system-prompt replaces the built-in
     // prompt; --exclude-dynamic-system-prompt-sections strips the dynamic

package/src/knowledge/descriptor.ts

@@ -146,6 +146,7 @@ export type UnavailableMatcher = PhraseMatcher;
  * arm would be dead data that can only drift. Render order is the tuple
  * order, so argv is deterministic regardless of caller field order. */
 export const TURN_OPTION_KEYS = deepFreeze([
+  "isolation",
   "effort",
   "sandbox",
   "contextWindow",

package/src/knowledge/muse.ts

@@ -59,7 +59,12 @@ export const museCode: HarnessDescriptor = deepFreeze({
   autonomy: { flag: "--yolo" },
   vocabulary: {
     modelFlag: "--model",
-    models: ["muse-spark-1.2-contributor", "muse-spark-1.2", "muse-spark-1.1"],
+    models: [
+      "muse-spark-1.3-contributor",
+      "muse-spark-1.2-contributor",
+      "muse-spark-1.2",
+      "muse-spark-1.1",
+    ],
     aliases: {},
     efforts: ["none", "minimal", "low", "medium", "high", "xhigh"],
     extensible: false,