@elie-laloum/outpost 10.0.1 → 11.1.2

package/CHANGELOG.md

@@ -1,6 +1,72 @@
 # Changelog
 
-## Unreleased
+## 11.1.2
+
+This release adds YAML workflow composition, terminal recipe dialogues and Git-free file workspaces while preserving existing Git APIs and defaults.
+
+- Reorganize the English and French Guide around user tasks, with focused pages, preserved routes and section anchors, clearer setup paths and nine downloadable example projects. Make mobile diagrams readable without zoom and clarify desktop flow conditions. Correct journal/replay side effects, Git path handling and recovery instructions; document the local review report produced by the webhook example.
+- Show every public API overload and its own property table, correctly mark required fields from mapped types, and link reference contracts to their practical guides.
+- Define private vulnerability reporting through GitHub Security and security-fix support for the latest major version.
+- Make recipe contract classification portable across Windows and POSIX source paths, and resolve temporary directory aliases in the macOS recovery test.
+- Build public declarations before checking consumer fixture types so validation works on a fresh checkout.
+- Prepare the Git-free Node image explicitly for container tests and document the required image pull.
+- Create the host UID's account in the Git-free package test image, and adapt container documentation checks to the simplified setup example.
+- Fix Windows output publication permission checks and relative file/directory link copies. Keep ownership and escape checks, and make recipe test cleanup, process assertions and host commands portable.
+
+- Add explicit directory-copy, read-only/writable source-mount and ephemeral file workspaces without host Git, configuration version 3, provider workspace capabilities and file dispatch/report contracts. Preserve legacy Git APIs and configuration defaults. Journal protected output publication with conditional rollback and explicit recovery; conserve settled files and conversations for local or explicit Transport-backed portable resume. Cover independent commands, cross-process dialogue, interrupted publication and an installed CLI running with Node, Docker and tar on a host without Git. Native CLI file variants and live cloud/Firecracker validation remain unvalidated.
+
+- Add a runnable Linear development recipe with a separate TypeScript application, validated private API-key caching, issue selection, plan approval, implementation, enforced tests and formatted observation. Extend terminal recipe interaction to unsigned gates with saved evidence and explicit decisions; signed gates retain external proof submission. Test the flow offline with real Git and simulated services; live Linear/Codex remains unvalidated.
+
+- Handle durable recipe questions directly in the CLI: automatic terminal prompts, actor selection, saved answers and continuation without a custom runner. Add interactive/headless flags, keep JSON reporting final-only, and preserve pending questions on cancellation. Cover offline cross-process resume and real terminal input; no paid agent calls.
+
+- Serve recipe and configuration JSON Schemas from documentation URLs under `/schemas/`, with immutable per-version copies reconstructed from stable Git tags. Preserve archives across GitHub Pages deployments, check JSON content and HTTP responses, and document editor setup in English and French.
+
+- Complete the seven YAML composition lots with explicit experimental speculation, cumulative durable usage receipts, conflict resolvers, native reporters and OpenTelemetry. Keep machine settings in named local components, synchronize and close execution sandboxes before integration, and report resolver usage separately. Generate component documentation and enforce per-export/per-option parity classifications in CI. Add an offline community recipe and example; paid/cloud/remote-SDK validation remains absent.
+
+- Compose YAML SQLite/HTTP/BullMQ queues, recipe and native workflow jobs, queued tasks, cron schedules and authenticated webhook services. Add explicit recipe enqueue/serve commands with native ownership, cancellation, token rotation and job identities. Verify local service composition and real Redis 7 without paid calls.
+
+- Add durable YAML checkpoints with exact Git workspace restoration, artifacts, caches, signed gates, dialogues, quota pauses and cumulative budgets. Add recipe status/resume/answer/decide; require explicit replay and revision-fenced recovery after interruption. Exercise separate processes, preserved uncommitted files and original diff guards offline; live cloud restoration remains unvalidated.
+
+- Compose format-3 workflows with structured JSON inputs, typed result references, conditions, transformations, local task callbacks, native loop and decision tasks, and isolated multi-repository dispatch. Preserve native scheduling and usage accounting, refuse overlapping shared workspaces, and project execution results to JSON. Add an offline example and YAML/TypeScript equivalence tests using real Git repositories.
+
+- Compose the Outpost harness, model and decision providers, tools, skills, hooks, permissions, context strategies, routing, fallback agents and conversation stores from YAML. Format-3 agent steps accept dispatch options and structured response references. Callback extensions declare a static slot contract; schemas distinguish data schemas from component references. Compare delegated YAML and TypeScript runs offline, and exercise the compiled CLI against a local streaming model fixture.
+
+- Extend YAML configuration with named providers, native sandbox and workspace options, portable profiles, CLI harness settings, MCP declarations, local transports and host-side secret selections. Generate option schemas from TypeScript contracts, reject dependency cycles before imports, resolve installed ESM-only extensions, and redact selected values from observation and reports. Cover local lifecycle execution and YAML/TypeScript request equivalence; cloud and paid agent calls remain unvalidated.
+
+- Begin YAML composition parity with configuration format 2, recipe format 3, the `/recipes` registry/runtime API, explicit observation and final reports, static extension validation and a versioned public-contract inventory. Recipe execution is silent unless outputs or `--json` are requested; failures still print diagnostics.
+
+- Add reusable YAML recipes with typed inputs, defaults and enums, dependency result references and editor schemas. Run with separate recipe and execution YAML files covering sandbox providers, CLI agents, model selection and explicit credential references; retain literal format 1 and TypeScript configuration compatibility. Add `recipe init`, allocation-free `validate`, `list` and integrity-checked `fetch`, repeated `--input` flags, three bundled Git catalogue recipes and third-party HTTPS catalogues. Fix CLI Git integration, bounded outputs and diagnostics, and final reporting after cleanup. Cover real local Git execution and cross-repository reuse; HTTP downloads are tested with simulated responses and paid agent/cloud runs remain unvalidated.
+
+## 11.1.1
+
+Publication was blocked after coverage passed: the SQLite recipe example deleted its temporary directory before closing its inspection queue on Windows. No package or documentation deployment was published. Version 11.1.2 fixes cleanup order and checks examples and package consumption before coverage in CI.
+
+## 11.1.0
+
+Publication was blocked by a Windows regression test that incremented an inode beyond JavaScript's safe integer precision. No package or documentation deployment was published. The fixture was corrected for the next release attempt.
+
+## 11.0.1
+
+This major release adds workspace integration safeguards, portable agent profiles, execution reports and state tracking, monetary budgets, incremental preparation, cloud dependency caches, offline workflow testing and optional secret sources. Update exhaustive consumers for `FaultCode` (`guard`, `stuck`), `AgentEvent` and `ObservationEvent` (`stuck`), stopped reasons (`stuck`), `StorageCategoryName` (`runs`) and `WorkflowBudgetExceeded.dimension` (`cost`). Implementations and test doubles of `DispatchResult` and `WarmDispatchResult` must provide `report()`; custom `ObservationHub` implementations must provide `redacting` and `redact()`. Existing entry points remain available. Best-of-N speculation remains experimental, and the live-validation limits below still apply.
+
+- Add `SecretSource` and bounded `fromSecrets()` startup resolution with optional adapters for Vault/OpenBao KV v2, 1Password, Infisical, AWS Secrets Manager, Google Cloud Secret Manager and Azure Key Vault. Resolve declared names into immutable variables without writing values to disk or changing the host environment; sanitize vendor errors and retain caller ownership of host SDK clients. Add bilingual Guide/API documentation and a selectable service example. Deterministic HTTP and SDK-boundary tests cover behavior; live service authentication remains unvalidated.
+- Add `@elie-laloum/outpost/testing` with `scriptedAgent()` and `createMemorySandboxProvider()` for offline workflow CI: predefined events, usage, real Git commits, response repairs and strict command fixtures. Add bilingual Guide/API documentation and an executable workflow example; Git workspaces remain on disk and transfers, cold conversation resume and arbitrary command execution are unsupported.
+- Add opt-in Vercel and Daytona dependency download caches backed by a caller-owned Transport: restore before preparation, archive before disposal, retain compatibility hashing and fence concurrent publishers. Add bilingual Guide/API documentation and a cloud example. Deterministic SDK and filesystem fixtures cover binary transfers, permissions, concurrency and cleanup failures; live cloud/S3 validation remains pending.
+- Add incremental lifecycle preparation with `when: changed(files)`: fingerprint exact file contents in the hook environment and rerun conditional hooks before operations on a reused sandbox. Save fingerprints only after success and retry failed preparations without closing a warm sandbox. Add bilingual Guide/API documentation and an offline `npm ci` example. Deterministic local-process and simulated-remote tests cover reuse, failures, cancellation and deadlines; real Docker checks the live sandbox files. Live cloud validation remains pending.
+- Add opt-in dispatch repetition watchdogs over decoded tool calls and file changes, with `stuck` events, explicit stop/warn policies and bounded steering instructions. Preserve sandbox reuse, recovery, response instructions and synchronous policy enforcement independently of observer delivery. Add bilingual Guide/API documentation and an offline example; deterministic process, simulated-model and real Docker tests cover behavior. Live native CLI and cloud validation remains pending.
+- Add portable `defineAgentProfile()` declarations for literal instructions, built-in tool allowlists and MCP servers across CLI presets and the Outpost harness. Project native Claude/Codex instructions, preserve request-prefix guidance on other CLIs, enforce exact shell commands through Claude hooks and intersected harness permissions, and refuse unsupported allowlists explicitly. Add bilingual Guide/API documentation and an offline local/MCP example. Deterministic protocol, command-hook and local-model tests cover behavior; paid CLI/model runs and native CLI continuation remain unvalidated.
+- Fix lock-free local transport reads when an atomic replacement grows between size sampling and inspection. Retry changed snapshots while preserving caller byte limits and bounded allocation; a deterministic race regression covers the failure.
+- Add synchronous `result.report()` to cold and warm dispatch results, with Markdown and versioned JSON snapshots of committed Git changes, observed failed commands/tools, duration, tokens and optional estimated cost. Preserve reports after workspace cleanup, aggregate cold passes as a net diff, apply inherited redaction and report collection limits without changing execution outcomes. Add bilingual Guide/API documentation and an offline local example; deterministic Git, process and simulated-model tests cover behavior, with no paid model calls.
+- Add transport-backed execution projections by ID with `createRunObserver()`, `readRun()` and cursor-based `watchRun()`. Record tasks, dispatch agents, branches, commits, errors and cumulative workflow usage; detect suspected abandonment through heartbeats without changing ownership. Fence writers, preserve cursors across settled workflow resumes and expose detected observation gaps. Deterministic local-process and HTTP S3-fixture tests cover behavior; live AWS validation remains pending.
+- Add optional EUR/USD workflow cost budgets, per-model token pricing, explicit Models.dev/OpenRouter catalog loading and inherited observation/conversation redaction. Preserve cumulative model counters through checkpoints; stop strict monetary budgets on unknown charges. Deterministic mock-model, local-process and HTTP-fixture tests cover behavior; public Models.dev and OpenRouter catalog loading was checked; paid-model billing and native CLI resume with masked reasoning remain unvalidated.
+- Add experimental best-of-N speculation with `select: "best"` and a required finite `score`. Let admitted candidates finish, choose the highest score with declaration-order ties, preserve cancellation, budgets and cleanup ownership, and persist scores for durable recovery. Keep first-valid selection as the default. Deterministic local-agent and crash-recovery tests cover the behavior; live judge-agent and cloud validation remains pending.
+- Add opt-in agent conflict resolution through `workspace.integrate({ onConflict: createAgentConflictResolver(...) })`. Resolve in a separate branch and sandbox, require verification, recheck final diff guards and frozen input commits, and preserve both workspaces on failure. Return resolution usage and verification output separately. Deterministic tests use real temporary Git repositories, a simulated remote provider and real Docker in mounted and isolated modes; live agent and cloud validation remains pending.
+- Add workspace diff guards (`guard.protectedPaths`, `guard.maxChangedLines`) for named and integration branches, independently of the agent. Check the final committed diff after synchronization and again before merging the inspected commit; reject protected paths, oversized text changes, uncountable binaries with a line limit and incomplete inspection with code `guard`. Retain rejected branches and worktrees; refuse `current` before execution. Deterministic tests use real temporary Git repositories, local agents and a simulated remote provider; no paid model calls are required.
+
+- Make the simulated Daytona dependency-cache sandbox provide its own Linux `setsid --wait` wrapper so its host-process fixtures also run on macOS. Production sandbox process supervision is unchanged.
+- Freeze the queue clock in the scheduler deduplication fixture so slow Windows runners cannot expire the first claim between assertions. Queue lease expiry remains covered separately.
+
+The v11.0.0 release was blocked by the macOS dependency-cache fixture and a timing-sensitive Windows scheduler fixture and was not published.
 
 ## 10.0.1
 

package/README.md

@@ -24,6 +24,8 @@
 
 Outpost is a TypeScript library and CLI for running coding agents in sandboxes and composing their work. Give an agent a task, choose its execution environment, and collect its answer, commits and usage. Start with one request; add parallel tasks, verification loops and human decisions as your workflow grows.
 
+Directory and ephemeral workspaces run commands and compatible harnesses without host Git. Configuration version 3 declares file sources, runtime storage and protected output publication; existing Git defaults stay unchanged. See the [English guide](docs/src/content/docs/guide/workspaces.md) or [French guide](docs/src/content/docs/fr/guide/workspaces.md).
+
 ## Why Outpost?
 
 - **Choose your agent and sandbox independently.** Run Claude Code, Codex, Antigravity, GitHub Copilot CLI or Kimi Code with Docker, Podman, Vercel or Daytona.
@@ -34,7 +36,7 @@ Outpost is a TypeScript library and CLI for running coding agents in sandboxes a
 
 ## Quickstart
 
-You need **Node.js 24+**, **Git**, a repository with at least one commit, and **Docker** running. This example uses Codex with account authentication: prepare its host login using the [Codex guide](https://elie-laloum.github.io/outpost/guide/codex/) before running a task. [Authentication](https://elie-laloum.github.io/outpost/guide/authentication/) covers other agents and API-key billing.
+You need **Node.js 24+**, **Git**, a repository with a committed README, and **Docker** running. This example uses Codex with account authentication: prepare its host login using the [Codex guide](https://elie-laloum.github.io/outpost/guide/codex/) before running a task. [Authentication](https://elie-laloum.github.io/outpost/guide/authentication/) covers other agents and API-key billing.
 
 Install the package, then build the agent image in a dedicated directory:
 
@@ -54,7 +56,6 @@ Use an ESM directory (`"type": "module"` in `package.json`); a CommonJS reposito
 import {
   createAgent,
   createCodexHarness,
-  createReporter,
   dispatch,
 } from "@elie-laloum/outpost";
 import { createDockerSandboxProvider } from "@elie-laloum/outpost/providers/docker";
@@ -65,17 +66,15 @@ const result = await dispatch({
     harness: createCodexHarness({ authentication: "account" }),
   }),
   sandboxProvider: createDockerSandboxProvider({ image: "outpost:dev" }),
-  observe: createReporter(),
-  branch: { mode: "named", name: "outpost/fix-tests" },
+  branch: { mode: "named", name: "outpost/readme-review" },
   brief: {
-    text: "Fix the failing tests, run them to verify and commit the change.",
+    text: "Review the README setup instructions. Report problems or say none were found. Do not edit files.",
   },
 });
 
-// Example output:
-// [outpost · pass 1] running · codex
-// Fixed the failing tests and committed the change.
-// [outpost · pass 1] finished · 12.00s · status 0 · input 1200 · cache read 0 · cache write 0 · output 320
+console.log(result.text);
+console.log(result.commits);
+// Expected commits: []
 ```
 
 `dispatch()` closes the sandbox it allocates; the named branch remains for review. Use a fresh branch name for each independent task. The agent’s answer is not an enforced test result: add explicit verification when checks must gate integration.
@@ -84,13 +83,18 @@ const result = await dispatch({
 
 | You want to…                                        | Start here                                                                                       |
 | --------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
+| Share instructions, tools and MCP configuration     | [Portable agent profiles](https://elie-laloum.github.io/outpost/guide/agent-profiles/)           |
 | Choose an agent, model and credentials              | [Agent configuration](https://elie-laloum.github.io/outpost/guide/choose-an-agent/)              |
 | Run locally in containers or in the cloud           | [Execution backends](https://elie-laloum.github.io/outpost/guide/choose-a-sandbox/)              |
 | Reuse a sandbox across commands and agent turns     | [Sandbox sessions](https://elie-laloum.github.io/outpost/guide/sandbox-sessions/)                |
 | Connect tasks and run independent work in parallel  | [Task dependencies](https://elie-laloum.github.io/outpost/guide/task-dependencies/)              |
 | Coordinate changes across repositories              | [Multi-repository workflows](https://elie-laloum.github.io/outpost/guide/multiple-repositories/) |
+| Export a run summary for review                     | [Run reports](https://elie-laloum.github.io/outpost/guide/run-reports/)                          |
 | Return data your application can validate           | [Validated output](https://elie-laloum.github.io/outpost/guide/typed-responses/)                 |
 | Build an agent with your own tools and instructions | [Custom harness](https://elie-laloum.github.io/outpost/guide/harness/)                           |
+| Read execution state by ID                          | [Execution state](https://elie-laloum.github.io/outpost/guide/run-state/)                        |
+| Test workflows without accounts or model calls      | [Workflow testing](https://elie-laloum.github.io/outpost/guide/testing-workflows/)               |
+| Create, share and run YAML recipes                  | [YAML recipes](https://elie-laloum.github.io/outpost/guide/yaml-recipes/)                        |
 | Resume or recover interrupted work                  | [Failure recovery](https://elie-laloum.github.io/outpost/guide/recovery/)                        |
 
 The [Guide](https://elie-laloum.github.io/outpost/guide/introduction/) explains behavior with focused examples. The [Reference](https://elie-laloum.github.io/outpost/reference/) documents exact contracts. Both are available in English and French.

package/SECURITY.md

@@ -2,9 +2,21 @@
 
 Outpost runs coding agents that execute arbitrary project commands. Use it with repositories and credentials appropriate for that task.
 
+## File workspaces
+
+File workspaces can run without Git. Directory copies exclude Git and Outpost control metadata; ordinary source files remain data, including any credential files the caller selected. New copies, snapshots and publications reject outgoing links and special files; link checks expand captured aliases before parent traversal and refuse missing targets or excluded aliases. Explicit source mounts expose the complete source; writable mounts change it immediately and cleanup never rolls those effects back. Owned working roots and runtime control storage remain separate. The local provider remains unisolated.
+
+Protected publication uses destination manifests, host-user overlap locks, same-filesystem quarantine, exclusive installation and conditional reverse rollback. These locks coordinate Outpost writers without preventing external edits. Publication is recoverable across operations, not an atomic transaction over an entire tree. Concurrent changes can leave backups and journal operations requiring explicit recovery. File snapshots establish file integrity, not disposal of unknown cloud resources or authorization to recover owners and replay interrupted work.
+
+## Sandbox access
+
 By default, Docker/Podman expose the selected checkout, Git metadata and explicit volumes. The Docker socket is not mounted by default. Containers use a chosen UID/GID, dropped capabilities, no-new-privileges and a private home. Extra devices, writable mounts and elevated hooks expand the boundary deliberately.
 
-Shared Git metadata is writable by the agent. A mounted sandbox is not an adversarial boundary protecting the host repository or its configuration. Outpost disables host Git hooks for its own Git commands, but a malicious repository can contain other executable configuration or project tooling. Do not run untrusted repositories with valuable host credentials. Host `local()` provides no isolation.
+Shared Git metadata is writable by the agent. A mounted sandbox is not an adversarial boundary protecting the host repository or its configuration. Outpost disables host Git hooks for its own Git commands, but a malicious repository can contain other executable configuration or project tooling. Do not run untrusted repositories with valuable host credentials. Host `createLocalSandboxProvider()` provides no isolation.
+
+## Git and integration
+
+Workspace diff guards are integration checks, not filesystem permissions or an adversarial security boundary. They inspect only the final committed diff: an agent can modify files and restore them before the check, and uncommitted files are excluded. Use named or integration workspaces to retain refused work separately from the host checkout.
 
 The opt-in Docker/Podman `repositoryMode: "isolated"` prototype uses a private container checkout and Git directory, without mounting the host checkout or Git metadata. Bundle transfer and validated synchronization import changes into the host workspace; host hooks, configuration and unrelated refs are not copied back. Explicit mounts overlapping canonical host repository/workspace/Git paths or container workspace/control paths are rejected, including read-only mounts. Dependency caches remain separate engine-managed volumes. Trust the container image, engine and host mount configuration: custom devices, external mounts, credentials, network access and shared caches expand the boundary. This is not a certified hostile-agent sandbox or protection against container/kernel escapes, malicious host path replacement during allocation, or dangerous project code later executed on the host.
 
@@ -14,18 +26,40 @@ Prompt command expansion only recognizes commands present in the original prompt
 
 Agent authentication is explicit. `account` reads only the selected CLI's own session file (or the file or profile named by `account.file`) on the host, refuses links, directories and files above 1 MiB, and never reads a system keychain. Isolated providers receive a copy in the private sandbox home through stdin, with 0700 directories and 0600 files; `createLocalSandboxProvider()` receives credential variables only and no host file is written. A sandbox copy can refresh and rotate a subscription refresh token, invalidating the host login; use a dedicated profile through `account.file` when that matters. Agents can read every credential they receive, so give them only the access their task requires. Generated images and remote bootstrap install pinned CLI versions. Antigravity archives use versioned Google URLs and SHA-512 digests recorded in Outpost; installation rejects mismatches before extraction. Generated images and Outpost's Antigravity requests and diagnostics disable automatic updates. Bootstrap reuses an existing executable without replacing or verifying its bytes; `outpost doctor --agent antigravity` compares its reported version with `agentVersions.antigravity`. A checksum verifies the selected archive's integrity, not the safety of its code.
 
+Portable agent profiles carry literal guidance and protocol tool restrictions, not filesystem or network isolation. A permitted shell command or MCP tool can have arbitrary side effects. Claude allowlists use native tool selection and an in-sandbox Node.js command hook, with inherited user/project/local setting sources disabled for that request; trust the CLI, managed policy and hook execution environment. The Outpost harness intersects profile restrictions with its permissions and inherited subagent policies. Adapters that cannot enforce a built-in allowlist refuse it when composing the agent.
+
 MCP servers are programs or endpoints you choose; they receive the variables you name and act with the agent's authority. Outpost writes MCP configuration with variable references only, never secret values. Kimi and Antigravity configuration is merged into the agent home file, which is the user's own home with `createLocalSandboxProvider()`. Built-in harness servers and their HTTP bridge run inside the sandbox, so egress policies apply to them; CLI agents contact HTTP servers themselves from the sandbox. `oauth: "login"` copies the selected MCP OAuth tokens of Claude Code, Codex or Kimi from the host into the private sandbox home; a refresh there can rotate the refresh token and invalidate the host login. OAuth client secrets for the built-in harness stay in the sandbox environment.
 
-Conversation transcripts, logs, bundles and patches may contain secrets. Runtime files are ignored by Git and sensitive files are created with restrictive permissions where supported. Keep API keys in environment variables or ignored `.env` files. Never embed tokens in tracked configuration, remote URLs or examples.
+## Secrets in saved data
+
+Conversation transcripts, logs, bundles and patches may contain secrets. Optional `redact` expressions mask matching strings before Outpost observation receivers and supported conversation captures, including decoded text session bundles. They do not detect unknown secrets, join fragments across event boundaries, rewrite native sandbox files or temporary staging, sanitize checkpoints, returned values other than run reports or existing archives, or make arbitrary binary content safe. A masked transcript can lose data needed for native resume or signed reasoning replay. Runtime files are ignored by Git and sensitive files are created with restrictive permissions where supported. Keep API keys in environment variables or ignored `.env` files. Never embed tokens in tracked configuration, remote URLs or examples.
+
+## Reporting and supported versions
 
-Report vulnerabilities privately using the repository's security reporting channel when enabled, or contact the maintainer through the hosting profile. Do not include live credentials in reports. V1 receives fixes for reproducible security defects.
+Report vulnerabilities privately through [GitHub Security](https://github.com/elie-laloum/outpost/security/advisories/new). Do not include live credentials in reports. Only the latest major version receives security fixes; upgrade to that major before requesting a fix for an older release.
 
-Explicit storage transports can send artifacts, journals, transcripts, recovery payloads and operational metadata to the configured object store. The caller owns the S3 client and credentials; they are not forwarded to agents. Use a dedicated private bucket prefix and access policy. Object revisions fence cooperating writers but do not authenticate artifact producers or operators. Stop an abandoned runner independently before releasing its checkpoint ownership; a remote PID is not proof of inactivity.
+## Shared storage and ownership
+
+Explicit storage transports can send artifacts, journals, transcripts, recovery payloads, execution snapshots, observation events and operational metadata to the configured object store. Run projections share the bounded delivery and redaction limits of other observation sinks; an expired heartbeat is suspected abandonment and never authorizes replay or resource recovery. The caller owns the S3 client and credentials; they are not forwarded to agents. Use a dedicated private bucket prefix and access policy. Object revisions fence cooperating writers but do not authenticate artifact producers or operators. Stop an abandoned runner independently before releasing its checkpoint ownership; a remote PID is not proof of inactivity.
+
+## Firecracker
 
 The optional Firecracker jailer mode requires a trusted root supervisor and root-owned boot assets, executables, SSH trust files, jail base and cgroup v2 parent. Outpost does not elevate privileges. The VMM drops to the explicitly selected non-root UID/GID, uses the jailer's mount namespace and receives CPU, memory, swap and process limits. The supervisor remains privileged and outside the VMM cgroup; its workflow code, configuration, dependencies and transfer destinations must be trusted. Guest file downloads currently buffer individual files in the supervisor, so the VMM memory limit is not a total host-resource budget. Kernel work outside that cgroup is likewise not charged to its CPU quota. Operators own TAP setup, network filtering, parent resources and crash recovery. Control-plane resource accounting and adversarial validation of this mode remain open.
 
+## Network policies
+
 Egress policies restrict sandbox outbound connections, not host model-provider or decision-provider calls, image downloads or cloud control-plane traffic. Vercel domain rules inspect TLS SNI rather than encrypted HTTP Host headers; allowed CIDRs grant independent IP access and denied CIDRs take precedence. A domain allowlist is not a general defense against exfiltration through allowed services or shared infrastructure. Mounted host sockets can expose separate network capabilities. Outpost copies network configuration at provider composition.
 
 Daytona egress is sent at creation and confirmed through its network-update API before Outpost prepares the workspace or exposes the lease. A rejected confirmation fails acquisition and triggers deletion. Tier 3/4 and WRITE_SANDBOXES are required; native creation options alone do not establish this guarantee. Autonomous image startup precedes confirmation and must be trusted, without embedded secrets or startup workloads. Unsupported combinations and wildcard patterns that would implicitly grant apex access are rejected. Docker/Podman allowlists remain unsupported; local and Firecracker execution reject Outpost egress policies. See the bilingual outbound-network guide for capabilities and live-validation limits.
 
+## Approvals and idempotency
+
 Signed workflow gates verify an Ed25519 key bound to an approver, not a human login. The signing service must authenticate the user and their intent. Keep private keys outside worker sandboxes; trust the configured verifier and public-key source. Gate authentication requirements participate in checkpoint identity, but signatures do not authenticate checkpoint storage. Revocation rejects new proofs and does not undo already persisted decisions. HTTP queue bearer tokens authorize all queue operations; dynamic token sources allow rotation, not tenant isolation. Use trusted TLS termination for remote connections. Idempotency keys only prevent duplicate external effects when the effect service atomically deduplicates them and retains receipts throughout the replay window.
+
+## Dependency caches
+
+Cloud dependency caches archive only the declared download directories through a host-side Transport. Storage credentials are not installed in the sandbox. Later runs trust the bytes written by previous agents and transport writers; keep credentials out of caches and use a private prefix. Immutable cache snapshots persist until explicitly removed, including superseded or unpublished snapshots. Compatibility hashes and chunk digests provide isolation and integrity, not producer authentication.
+
+## Secret managers
+
+Secret-source resolution runs on the host before sandbox allocation. Outpost reads only requested names and returns immutable variables without writing the values to disk or changing process.env. Vault/OpenBao KV v2 and AWS JSON fields require fetching an enclosing document; split unrelated secrets when they must not be fetched together. Injected SDK clients are caller-owned, and their authentication configuration and caching remain the caller’s responsibility. fromSecrets discards vendor exception messages and causes; never log the returned object. The selected values become readable by every process receiving those variables. Startup snapshots do not rotate inside a running sandbox.

package/dist/adapters/agents/antigravity/antigravity-adapter.js

@@ -1,3 +1,4 @@
+import { rejectProfileTools } from "../profile-support.js";
 import { mcpConfigurationPlanner, supportMcpServers, } from "../mcp-configuration.js";
 import { antigravityMcpFile } from "./antigravity-mcp.js";
 import { textMatcher } from "../text-matcher.js";
@@ -11,6 +12,7 @@ import { credentialPlanner } from "../authentication.js";
 import { configuredSettings, harnessSettings, supportModel, } from "../model-support.js";
 function bindAntigravity(settings) {
     supportModel(antigravityModelSupport, settings.model);
+    rejectProfileTools(antigravityLabel, settings.profile);
     supportMcpServers(antigravityMcpSupport, settings.mcpServers);
     const credentials = credentialPlanner(antigravityLabel, antigravityCredentials, settings.authentication, settings.model);
     const configuration = mcpConfigurationPlanner(antigravityLabel, settings.mcpServers, antigravityMcpFile);

package/dist/adapters/agents/antigravity/antigravity-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"antigravity-adapter.js","sourceRoot":"","sources":["../../../../src/adapters/agents/antigravity/antigravity-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,YAAY,GACb,MAAM,qBAAqB,CAAC;AAG7B,SAAS,eAAe,CAAC,QAAoC;IAC3D,YAAY,CAAC,uBAAuB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,iBAAiB,CAAC,qBAAqB,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,iBAAiB,CACnC,gBAAgB,EAChB,sBAAsB,EACtB,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,KAAK,CACf,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC3C,gBAAgB,EAChB,QAAQ,CAAC,UAAU,EACnB,kBAAkB,CACnB,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,aAAa;QACnB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,SAAS,EAAE,aAAa;QACxB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,KAAK;QACd,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,GAAG,oBAAoB;YACvB,GAAG,QAAQ,CAAC,SAAS;SACtB,CAAC;QACF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC;QACvD,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,WAAW,CAAC,wBAAwB,CAAC;QAC5C,WAAW,EAAE,WAAW,CACtB,8BAA8B,EAC9B,uBAAuB,CACxB;KACqB,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAAgC,EAAE;IAElC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,SAAS,CACP,CAAC,CAAC,eAAe,IAAI,QAAQ,CAAC,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EACtE,kFAAkF,CACnF,CAAC;IACF,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,CAAC,KAAkB,EAAE,EAAE,CAC3B,eAAe,CAAC;YACd,GAAG,UAAU;YACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAC;KACL,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  mcpConfigurationPlanner,\n  supportMcpServers,\n} from \"../mcp-configuration.ts\";\nimport { antigravityMcpFile } from \"./antigravity-mcp.ts\";\nimport { textMatcher } from \"../text-matcher.ts\";\nimport { transientNoticePatterns } from \"../unavailable.constants.ts\";\nimport type { AgentAdapter, CliHarness } from \"../../../domain/agent.types.ts\";\nimport { invariant } from \"../../../domain/errors.ts\";\nimport type { AgentModel } from \"../../../domain/model.types.ts\";\nimport { antigravityCredentials } from \"./antigravity-authentication.ts\";\nimport {\n  antigravityVariables,\n  antigravityLabel,\n  antigravityMcpSupport,\n  antigravityModelSupport,\n  antigravityQuotaPatterns,\n  antigravityUnavailablePatterns,\n} from \"./antigravity.constants.ts\";\nimport { antigravityEvents } from \"./antigravity-events.ts\";\nimport { antigravityRequest } from \"./antigravity-request.ts\";\nimport type { AntigravitySettings } from \"./antigravity.types.ts\";\nimport { credentialPlanner } from \"../authentication.ts\";\nimport {\n  configuredSettings,\n  harnessSettings,\n  supportModel,\n} from \"../model-support.ts\";\nimport type { Bound } from \"../settings.types.ts\";\n\nfunction bindAntigravity(settings: Bound<AntigravitySettings>): AgentAdapter {\n  supportModel(antigravityModelSupport, settings.model);\n  supportMcpServers(antigravityMcpSupport, settings.mcpServers);\n  const credentials = credentialPlanner(\n    antigravityLabel,\n    antigravityCredentials,\n    settings.authentication,\n    settings.model,\n  );\n  const configuration = mcpConfigurationPlanner(\n    antigravityLabel,\n    settings.mcpServers,\n    antigravityMcpFile,\n  );\n  return Object.freeze({\n    name: \"antigravity\",\n    ...(credentials ? { credentials } : {}),\n    ...(configuration ? { configuration } : {}),\n    bootstrap: \"antigravity\",\n    resumable: true,\n    forkable: false,\n    capture: false,\n    requiresFinishedEvent: true,\n    variables: Object.freeze({\n      ...antigravityVariables,\n      ...settings.variables,\n    }),\n    request: (input) => antigravityRequest(settings, input),\n    events: antigravityEvents,\n    quota: textMatcher(antigravityQuotaPatterns),\n    unavailable: textMatcher(\n      antigravityUnavailablePatterns,\n      transientNoticePatterns,\n    ),\n  } satisfies AgentAdapter);\n}\n\nexport function createAntigravityHarness(\n  settings: AntigravitySettings = {},\n): CliHarness {\n  harnessSettings(settings);\n  invariant(\n    !(\"conversations\" in settings) || settings.conversations === undefined,\n    \"Antigravity has no portable conversation capture; conversations cannot be stored\",\n  );\n  const configured = configuredSettings(settings);\n  return Object.freeze({\n    kind: \"cli\",\n    bind: (model?: AgentModel) =>\n      bindAntigravity({\n        ...configured,\n        ...(model === undefined ? {} : { model }),\n      }),\n  });\n}\n"]}
+{"version":3,"file":"antigravity-adapter.js","sourceRoot":"","sources":["../../../../src/adapters/agents/antigravity/antigravity-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,YAAY,GACb,MAAM,qBAAqB,CAAC;AAG7B,SAAS,eAAe,CAAC,QAAoC;IAC3D,YAAY,CAAC,uBAAuB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,kBAAkB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvD,iBAAiB,CAAC,qBAAqB,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,iBAAiB,CACnC,gBAAgB,EAChB,sBAAsB,EACtB,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,KAAK,CACf,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC3C,gBAAgB,EAChB,QAAQ,CAAC,UAAU,EACnB,kBAAkB,CACnB,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,aAAa;QACnB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,SAAS,EAAE,aAAa;QACxB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,KAAK;QACd,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,GAAG,oBAAoB;YACvB,GAAG,QAAQ,CAAC,SAAS;SACtB,CAAC;QACF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC;QACvD,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,WAAW,CAAC,wBAAwB,CAAC;QAC5C,WAAW,EAAE,WAAW,CACtB,8BAA8B,EAC9B,uBAAuB,CACxB;KACqB,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAAgC,EAAE;IAElC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,SAAS,CACP,CAAC,CAAC,eAAe,IAAI,QAAQ,CAAC,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EACtE,kFAAkF,CACnF,CAAC;IACF,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,CAAC,KAAkB,EAAE,EAAE,CAC3B,eAAe,CAAC;YACd,GAAG,UAAU;YACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAC;KACL,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { rejectProfileTools } from \"../profile-support.ts\";\nimport {\n  mcpConfigurationPlanner,\n  supportMcpServers,\n} from \"../mcp-configuration.ts\";\nimport { antigravityMcpFile } from \"./antigravity-mcp.ts\";\nimport { textMatcher } from \"../text-matcher.ts\";\nimport { transientNoticePatterns } from \"../unavailable.constants.ts\";\nimport type { AgentAdapter, CliHarness } from \"../../../domain/agent.types.ts\";\nimport { invariant } from \"../../../domain/errors.ts\";\nimport type { AgentModel } from \"../../../domain/model.types.ts\";\nimport { antigravityCredentials } from \"./antigravity-authentication.ts\";\nimport {\n  antigravityVariables,\n  antigravityLabel,\n  antigravityMcpSupport,\n  antigravityModelSupport,\n  antigravityQuotaPatterns,\n  antigravityUnavailablePatterns,\n} from \"./antigravity.constants.ts\";\nimport { antigravityEvents } from \"./antigravity-events.ts\";\nimport { antigravityRequest } from \"./antigravity-request.ts\";\nimport type { AntigravitySettings } from \"./antigravity.types.ts\";\nimport { credentialPlanner } from \"../authentication.ts\";\nimport {\n  configuredSettings,\n  harnessSettings,\n  supportModel,\n} from \"../model-support.ts\";\nimport type { Bound } from \"../settings.types.ts\";\n\nfunction bindAntigravity(settings: Bound<AntigravitySettings>): AgentAdapter {\n  supportModel(antigravityModelSupport, settings.model);\n  rejectProfileTools(antigravityLabel, settings.profile);\n  supportMcpServers(antigravityMcpSupport, settings.mcpServers);\n  const credentials = credentialPlanner(\n    antigravityLabel,\n    antigravityCredentials,\n    settings.authentication,\n    settings.model,\n  );\n  const configuration = mcpConfigurationPlanner(\n    antigravityLabel,\n    settings.mcpServers,\n    antigravityMcpFile,\n  );\n  return Object.freeze({\n    name: \"antigravity\",\n    ...(credentials ? { credentials } : {}),\n    ...(configuration ? { configuration } : {}),\n    bootstrap: \"antigravity\",\n    resumable: true,\n    forkable: false,\n    capture: false,\n    requiresFinishedEvent: true,\n    variables: Object.freeze({\n      ...antigravityVariables,\n      ...settings.variables,\n    }),\n    request: (input) => antigravityRequest(settings, input),\n    events: antigravityEvents,\n    quota: textMatcher(antigravityQuotaPatterns),\n    unavailable: textMatcher(\n      antigravityUnavailablePatterns,\n      transientNoticePatterns,\n    ),\n  } satisfies AgentAdapter);\n}\n\nexport function createAntigravityHarness(\n  settings: AntigravitySettings = {},\n): CliHarness {\n  harnessSettings(settings);\n  invariant(\n    !(\"conversations\" in settings) || settings.conversations === undefined,\n    \"Antigravity has no portable conversation capture; conversations cannot be stored\",\n  );\n  const configured = configuredSettings(settings);\n  return Object.freeze({\n    kind: \"cli\",\n    bind: (model?: AgentModel) =>\n      bindAntigravity({\n        ...configured,\n        ...(model === undefined ? {} : { model }),\n      }),\n  });\n}\n"]}

package/dist/adapters/agents/antigravity/antigravity-request.js

@@ -1,7 +1,9 @@
+import { profileText } from "../profile-support.js";
 import { validId } from "../../../infrastructure/conversations/identity.js";
 import { invariant } from "../../../domain/errors.js";
 import { antigravityVariables } from "./antigravity.constants.js";
 export function antigravityRequest(settings, input) {
+    const text = profileText(settings.profile, input.text);
     invariant(!input.continuation?.fork, "Antigravity does not support automated fork in Outpost");
     const args = [];
     if (input.continuation) {
@@ -18,9 +20,7 @@ export function antigravityRequest(settings, input) {
             variables: antigravityVariables,
             arguments: [
                 ...args,
-                ...(input.text === undefined
-                    ? []
-                    : ["--prompt-interactive", input.text]),
+                ...(text === undefined ? [] : ["--prompt-interactive", text]),
             ],
             interactive: true,
         };
@@ -31,7 +31,7 @@ export function antigravityRequest(settings, input) {
         executable: "agy",
         variables: antigravityVariables,
         arguments: args,
-        stdin: `${JSON.stringify({ event: "user", message: { content: input.text ?? "" } })}\n`,
+        stdin: `${JSON.stringify({ event: "user", message: { content: text ?? "" } })}\n`,
     };
 }
 //# sourceMappingURL=antigravity-request.js.map

package/dist/adapters/agents/antigravity/antigravity-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"antigravity-request.js","sourceRoot":"","sources":["../../../../src/adapters/agents/antigravity/antigravity-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAG5E,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAIlE,MAAM,UAAU,kBAAkB,CAChC,QAAoC,EACpC,KAAiB;IAEjB,SAAS,CACP,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EACzB,wDAAwD,CACzD,CAAC;IACF,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,WAAW;QACnB,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,oBAAoB;YAC/B,SAAS,EAAE;gBACT,GAAG,IAAI;gBACP,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,CAAC,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aAC1C;YACD,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC7E,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,SAAS,EAAE,oBAAoB;QAC/B,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI;KACxF,CAAC;AACJ,CAAC","sourcesContent":["import { validId } from \"../../../infrastructure/conversations/identity.ts\";\nimport type { AgentInput } from \"../../../domain/agent.types.ts\";\nimport type { Command } from \"../../../domain/command.types.ts\";\nimport { invariant } from \"../../../domain/errors.ts\";\nimport { antigravityVariables } from \"./antigravity.constants.ts\";\nimport type { AntigravitySettings } from \"./antigravity.types.ts\";\nimport type { Bound } from \"../settings.types.ts\";\n\nexport function antigravityRequest(\n  settings: Bound<AntigravitySettings>,\n  input: AgentInput,\n): Command {\n  invariant(\n    !input.continuation?.fork,\n    \"Antigravity does not support automated fork in Outpost\",\n  );\n  const args: string[] = [];\n  if (input.continuation) {\n    validId(input.continuation.id);\n    args.push(\"--conversation\", input.continuation.id);\n  }\n  if (settings.model) args.push(\"--model\", settings.model.name);\n  if (settings.mode) args.push(\"--mode\", settings.mode);\n  if (input.interactive)\n    return {\n      executable: \"agy\",\n      variables: antigravityVariables,\n      arguments: [\n        ...args,\n        ...(input.text === undefined\n          ? []\n          : [\"--prompt-interactive\", input.text]),\n      ],\n      interactive: true,\n    };\n  if (!settings.mode) args.push(\"--dangerously-skip-permissions\");\n  args.push(\"--input-format\", \"stream-json\", \"--output-format\", \"stream-json\");\n  return {\n    executable: \"agy\",\n    variables: antigravityVariables,\n    arguments: args,\n    stdin: `${JSON.stringify({ event: \"user\", message: { content: input.text ?? \"\" } })}\\n`,\n  };\n}\n"]}
+{"version":3,"file":"antigravity-request.js","sourceRoot":"","sources":["../../../../src/adapters/agents/antigravity/antigravity-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,mDAAmD,CAAC;AAG5E,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAIlE,MAAM,UAAU,kBAAkB,CAChC,QAAoC,EACpC,KAAiB;IAEjB,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,SAAS,CACP,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EACzB,wDAAwD,CACzD,CAAC;IACF,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,WAAW;QACnB,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,oBAAoB;YAC/B,SAAS,EAAE;gBACT,GAAG,IAAI;gBACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;aAC9D;YACD,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC7E,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,SAAS,EAAE,oBAAoB;QAC/B,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI;KAClF,CAAC;AACJ,CAAC","sourcesContent":["import { profileText } from \"../profile-support.ts\";\nimport { validId } from \"../../../infrastructure/conversations/identity.ts\";\nimport type { AgentInput } from \"../../../domain/agent.types.ts\";\nimport type { Command } from \"../../../domain/command.types.ts\";\nimport { invariant } from \"../../../domain/errors.ts\";\nimport { antigravityVariables } from \"./antigravity.constants.ts\";\nimport type { AntigravitySettings } from \"./antigravity.types.ts\";\nimport type { Bound } from \"../settings.types.ts\";\n\nexport function antigravityRequest(\n  settings: Bound<AntigravitySettings>,\n  input: AgentInput,\n): Command {\n  const text = profileText(settings.profile, input.text);\n  invariant(\n    !input.continuation?.fork,\n    \"Antigravity does not support automated fork in Outpost\",\n  );\n  const args: string[] = [];\n  if (input.continuation) {\n    validId(input.continuation.id);\n    args.push(\"--conversation\", input.continuation.id);\n  }\n  if (settings.model) args.push(\"--model\", settings.model.name);\n  if (settings.mode) args.push(\"--mode\", settings.mode);\n  if (input.interactive)\n    return {\n      executable: \"agy\",\n      variables: antigravityVariables,\n      arguments: [\n        ...args,\n        ...(text === undefined ? [] : [\"--prompt-interactive\", text]),\n      ],\n      interactive: true,\n    };\n  if (!settings.mode) args.push(\"--dangerously-skip-permissions\");\n  args.push(\"--input-format\", \"stream-json\", \"--output-format\", \"stream-json\");\n  return {\n    executable: \"agy\",\n    variables: antigravityVariables,\n    arguments: args,\n    stdin: `${JSON.stringify({ event: \"user\", message: { content: text ?? \"\" } })}\\n`,\n  };\n}\n"]}

package/dist/adapters/agents/antigravity/antigravity.types.d.ts

@@ -1,3 +1,4 @@
+import type { AgentProfile } from "../../../domain/agent-profile.types.ts";
 import type { AgentAuthentication } from "../../../domain/agent.types.ts";
 import type { Variables } from "../../../domain/command.types.ts";
 import type { McpServers } from "../../../domain/mcp-server.types.ts";
@@ -5,5 +6,6 @@ export interface AntigravitySettings {
     readonly authentication?: AgentAuthentication;
     readonly variables?: Variables;
     readonly mcpServers?: McpServers;
+    readonly profile?: AgentProfile;
     readonly mode?: "accept-edits" | "plan";
 }

package/dist/adapters/agents/antigravity/antigravity.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"antigravity.types.js","sourceRoot":"","sources":["../../../../src/adapters/agents/antigravity/antigravity.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { AgentAuthentication } from \"../../../domain/agent.types.ts\";\nimport type { Variables } from \"../../../domain/command.types.ts\";\nimport type { McpServers } from \"../../../domain/mcp-server.types.ts\";\n\nexport interface AntigravitySettings {\n  readonly authentication?: AgentAuthentication;\n  readonly variables?: Variables;\n  readonly mcpServers?: McpServers;\n  readonly mode?: \"accept-edits\" | \"plan\";\n}\n"]}
+{"version":3,"file":"antigravity.types.js","sourceRoot":"","sources":["../../../../src/adapters/agents/antigravity/antigravity.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { AgentProfile } from \"../../../domain/agent-profile.types.ts\";\nimport type { AgentAuthentication } from \"../../../domain/agent.types.ts\";\nimport type { Variables } from \"../../../domain/command.types.ts\";\nimport type { McpServers } from \"../../../domain/mcp-server.types.ts\";\n\nexport interface AntigravitySettings {\n  readonly authentication?: AgentAuthentication;\n  readonly variables?: Variables;\n  readonly mcpServers?: McpServers;\n  readonly profile?: AgentProfile;\n  readonly mode?: \"accept-edits\" | \"plan\";\n}\n"]}

package/dist/adapters/agents/claude/claude-adapter.js

@@ -1,3 +1,4 @@
+import { supportClaudeProfile } from "./claude-profile.js";
 import { createClaudeConversations, claudeConversationLayout, } from "./claude-conversations.js";
 import { claudeLabel, claudeMcpSupport, claudeModelSupport, claudeQuotaPatterns, claudeUnavailablePatterns, CLAUDE_MAX_OUTPUT_VARIABLE, CLAUDE_MCP_TIMEOUT_VARIABLE, } from "./claude.constants.js";
 import { claudeMcpLogins } from "./claude-mcp.js";
@@ -14,6 +15,7 @@ import { claudeRequest } from "./claude-request.js";
 import { configuredSettings, harnessSettings, supportModel, } from "../model-support.js";
 function bindClaude(settings) {
     supportModel(claudeModelSupport, settings.model);
+    supportClaudeProfile(settings);
     supportMcpServers(claudeMcpSupport, settings.mcpServers);
     const maxOutputTokens = settings.model?.maxOutputTokens;
     invariant(maxOutputTokens === undefined ||
@@ -24,6 +26,7 @@ function bindClaude(settings) {
     const credentials = credentialPlanner(claudeLabel, claudeCredentials, settings.authentication, settings.model);
     const configuration = mcpConfigurationPlanner(claudeLabel, settings.mcpServers, undefined, claudeMcpLogins);
     return Object.freeze({
+        usageInput: "uncached",
         name: "claude",
         ...(credentials ? { credentials } : {}),
         ...(configuration ? { configuration } : {}),

package/dist/adapters/agents/claude/claude-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-adapter.js","sourceRoot":"","sources":["../../../../src/adapters/agents/claude/claude-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,YAAY,GACb,MAAM,qBAAqB,CAAC;AAG7B,SAAS,UAAU,CAAC,QAA+B;IACjD,YAAY,CAAC,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,iBAAiB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IACxD,SAAS,CACP,eAAe,KAAK,SAAS;QAC3B,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,0BAA0B,CAAC,EACtE,6CAA6C,0BAA0B,YAAY,CACpF,CAAC;IACF,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,SAAS,CACP,UAAU,KAAK,SAAS;QACtB,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,2BAA2B,CAAC,EACvE,0CAA0C,2BAA2B,YAAY,CAClF,CAAC;IACF,MAAM,WAAW,GAAG,iBAAiB,CACnC,WAAW,EACX,iBAAiB,EACjB,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,KAAK,CACf,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC3C,WAAW,EACX,QAAQ,CAAC,UAAU,EACnB,SAAS,EACT,eAAe,CAChB,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,SAAS,EAAE,QAAQ;QACnB,GAAG,mBAAmB,CAAC,QAAQ,EAAE,yBAAyB,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,QAAQ,CAAC,iBAAiB,IAAI,IAAI;QAC3C,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,GAAG,QAAQ,CAAC,SAAS;YACrB,GAAG,CAAC,eAAe,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,UAAU,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC;QAClD,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,WAAW,CAAC,mBAAmB,CAAC;QACvC,WAAW,EAAE,WAAW,CACtB,yBAAyB,EACzB,uBAAuB,CACxB;QACD,eAAe,EAAE,qBAAqB;KAChB,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAA2B,EAAE;IAC/D,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,oBAAoB,CAAC,WAAW,EAAE,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,CAAC,KAAkB,EAAE,EAAE,CAC3B,UAAU,CAAC;YACT,GAAG,UAAU;YACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAC;KACL,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  createClaudeConversations,\n  claudeConversationLayout,\n} from \"./claude-conversations.ts\";\nimport {\n  claudeLabel,\n  claudeMcpSupport,\n  claudeModelSupport,\n  claudeQuotaPatterns,\n  claudeUnavailablePatterns,\n  CLAUDE_MAX_OUTPUT_VARIABLE,\n  CLAUDE_MCP_TIMEOUT_VARIABLE,\n} from \"./claude.constants.ts\";\nimport { claudeMcpLogins } from \"./claude-mcp.ts\";\nimport {\n  mcpConfigurationPlanner,\n  sharedStartupTimeout,\n  supportMcpServers,\n} from \"../mcp-configuration.ts\";\nimport { textMatcher } from \"../text-matcher.ts\";\nimport {\n  conversationSettings,\n  conversationStorage,\n} from \"../conversation-settings.ts\";\nimport { transientNoticePatterns } from \"../unavailable.constants.ts\";\nimport { invariant } from \"../../../domain/errors.ts\";\nimport type { AgentModel } from \"../../../domain/model.types.ts\";\nimport { credentialPlanner } from \"../authentication.ts\";\nimport { claudeCredentials } from \"./claude-authentication.ts\";\nimport type { AgentAdapter, CliHarness } from \"../../../domain/agent.types.ts\";\nimport { claudeEvents, claudeTranscriptUsage } from \"./claude-events.ts\";\nimport { claudeLiveInput } from \"./claude-input.ts\";\nimport { claudeRequest } from \"./claude-request.ts\";\nimport {\n  configuredSettings,\n  harnessSettings,\n  supportModel,\n} from \"../model-support.ts\";\nimport type { Bound, ClaudeSettings } from \"../settings.types.ts\";\n\nfunction bindClaude(settings: Bound<ClaudeSettings>): AgentAdapter {\n  supportModel(claudeModelSupport, settings.model);\n  supportMcpServers(claudeMcpSupport, settings.mcpServers);\n  const maxOutputTokens = settings.model?.maxOutputTokens;\n  invariant(\n    maxOutputTokens === undefined ||\n      !Object.hasOwn(settings.variables ?? {}, CLAUDE_MAX_OUTPUT_VARIABLE),\n    `Set maxOutputTokens on the agent model or ${CLAUDE_MAX_OUTPUT_VARIABLE}, not both`,\n  );\n  const mcpTimeout = sharedStartupTimeout(settings.mcpServers);\n  invariant(\n    mcpTimeout === undefined ||\n      !Object.hasOwn(settings.variables ?? {}, CLAUDE_MCP_TIMEOUT_VARIABLE),\n    `Set startupTimeoutMs on MCP servers or ${CLAUDE_MCP_TIMEOUT_VARIABLE}, not both`,\n  );\n  const credentials = credentialPlanner(\n    claudeLabel,\n    claudeCredentials,\n    settings.authentication,\n    settings.model,\n  );\n  const configuration = mcpConfigurationPlanner(\n    claudeLabel,\n    settings.mcpServers,\n    undefined,\n    claudeMcpLogins,\n  );\n  return Object.freeze({\n    name: \"claude\",\n    ...(credentials ? { credentials } : {}),\n    ...(configuration ? { configuration } : {}),\n    bootstrap: \"claude\",\n    ...conversationStorage(settings, createClaudeConversations),\n    resumable: true,\n    capture: settings.saveConversations ?? true,\n    variables: Object.freeze({\n      ...settings.variables,\n      ...(maxOutputTokens === undefined\n        ? {}\n        : { [CLAUDE_MAX_OUTPUT_VARIABLE]: String(maxOutputTokens) }),\n      ...(mcpTimeout === undefined\n        ? {}\n        : { [CLAUDE_MCP_TIMEOUT_VARIABLE]: String(mcpTimeout) }),\n    }),\n    request: (input) => claudeRequest(settings, input),\n    events: claudeEvents,\n    liveInput: claudeLiveInput,\n    quota: textMatcher(claudeQuotaPatterns),\n    unavailable: textMatcher(\n      claudeUnavailablePatterns,\n      transientNoticePatterns,\n    ),\n    transcriptUsage: claudeTranscriptUsage,\n  } satisfies AgentAdapter);\n}\n\nexport function createClaudeHarness(settings: ClaudeSettings = {}): CliHarness {\n  harnessSettings(settings);\n  conversationSettings(claudeLabel, claudeConversationLayout.format, settings);\n  const configured = configuredSettings(settings);\n  return Object.freeze({\n    kind: \"cli\",\n    bind: (model?: AgentModel) =>\n      bindClaude({\n        ...configured,\n        ...(model === undefined ? {} : { model }),\n      }),\n  });\n}\n"]}
+{"version":3,"file":"claude-adapter.js","sourceRoot":"","sources":["../../../../src/adapters/agents/claude/claude-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,YAAY,GACb,MAAM,qBAAqB,CAAC;AAG7B,SAAS,UAAU,CAAC,QAA+B;IACjD,YAAY,CAAC,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,iBAAiB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IACxD,SAAS,CACP,eAAe,KAAK,SAAS;QAC3B,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,0BAA0B,CAAC,EACtE,6CAA6C,0BAA0B,YAAY,CACpF,CAAC;IACF,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,SAAS,CACP,UAAU,KAAK,SAAS;QACtB,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,2BAA2B,CAAC,EACvE,0CAA0C,2BAA2B,YAAY,CAClF,CAAC;IACF,MAAM,WAAW,GAAG,iBAAiB,CACnC,WAAW,EACX,iBAAiB,EACjB,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,KAAK,CACf,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC3C,WAAW,EACX,QAAQ,CAAC,UAAU,EACnB,SAAS,EACT,eAAe,CAChB,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,SAAS,EAAE,QAAQ;QACnB,GAAG,mBAAmB,CAAC,QAAQ,EAAE,yBAAyB,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,QAAQ,CAAC,iBAAiB,IAAI,IAAI;QAC3C,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,GAAG,QAAQ,CAAC,SAAS;YACrB,GAAG,CAAC,eAAe,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,UAAU,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC;QAClD,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,WAAW,CAAC,mBAAmB,CAAC;QACvC,WAAW,EAAE,WAAW,CACtB,yBAAyB,EACzB,uBAAuB,CACxB;QACD,eAAe,EAAE,qBAAqB;KAChB,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAA2B,EAAE;IAC/D,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,oBAAoB,CAAC,WAAW,EAAE,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,CAAC,KAAkB,EAAE,EAAE,CAC3B,UAAU,CAAC;YACT,GAAG,UAAU;YACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAC;KACL,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { supportClaudeProfile } from \"./claude-profile.ts\";\nimport {\n  createClaudeConversations,\n  claudeConversationLayout,\n} from \"./claude-conversations.ts\";\nimport {\n  claudeLabel,\n  claudeMcpSupport,\n  claudeModelSupport,\n  claudeQuotaPatterns,\n  claudeUnavailablePatterns,\n  CLAUDE_MAX_OUTPUT_VARIABLE,\n  CLAUDE_MCP_TIMEOUT_VARIABLE,\n} from \"./claude.constants.ts\";\nimport { claudeMcpLogins } from \"./claude-mcp.ts\";\nimport {\n  mcpConfigurationPlanner,\n  sharedStartupTimeout,\n  supportMcpServers,\n} from \"../mcp-configuration.ts\";\nimport { textMatcher } from \"../text-matcher.ts\";\nimport {\n  conversationSettings,\n  conversationStorage,\n} from \"../conversation-settings.ts\";\nimport { transientNoticePatterns } from \"../unavailable.constants.ts\";\nimport { invariant } from \"../../../domain/errors.ts\";\nimport type { AgentModel } from \"../../../domain/model.types.ts\";\nimport { credentialPlanner } from \"../authentication.ts\";\nimport { claudeCredentials } from \"./claude-authentication.ts\";\nimport type { AgentAdapter, CliHarness } from \"../../../domain/agent.types.ts\";\nimport { claudeEvents, claudeTranscriptUsage } from \"./claude-events.ts\";\nimport { claudeLiveInput } from \"./claude-input.ts\";\nimport { claudeRequest } from \"./claude-request.ts\";\nimport {\n  configuredSettings,\n  harnessSettings,\n  supportModel,\n} from \"../model-support.ts\";\nimport type { Bound, ClaudeSettings } from \"../settings.types.ts\";\n\nfunction bindClaude(settings: Bound<ClaudeSettings>): AgentAdapter {\n  supportModel(claudeModelSupport, settings.model);\n  supportClaudeProfile(settings);\n  supportMcpServers(claudeMcpSupport, settings.mcpServers);\n  const maxOutputTokens = settings.model?.maxOutputTokens;\n  invariant(\n    maxOutputTokens === undefined ||\n      !Object.hasOwn(settings.variables ?? {}, CLAUDE_MAX_OUTPUT_VARIABLE),\n    `Set maxOutputTokens on the agent model or ${CLAUDE_MAX_OUTPUT_VARIABLE}, not both`,\n  );\n  const mcpTimeout = sharedStartupTimeout(settings.mcpServers);\n  invariant(\n    mcpTimeout === undefined ||\n      !Object.hasOwn(settings.variables ?? {}, CLAUDE_MCP_TIMEOUT_VARIABLE),\n    `Set startupTimeoutMs on MCP servers or ${CLAUDE_MCP_TIMEOUT_VARIABLE}, not both`,\n  );\n  const credentials = credentialPlanner(\n    claudeLabel,\n    claudeCredentials,\n    settings.authentication,\n    settings.model,\n  );\n  const configuration = mcpConfigurationPlanner(\n    claudeLabel,\n    settings.mcpServers,\n    undefined,\n    claudeMcpLogins,\n  );\n  return Object.freeze({\n    usageInput: \"uncached\",\n    name: \"claude\",\n    ...(credentials ? { credentials } : {}),\n    ...(configuration ? { configuration } : {}),\n    bootstrap: \"claude\",\n    ...conversationStorage(settings, createClaudeConversations),\n    resumable: true,\n    capture: settings.saveConversations ?? true,\n    variables: Object.freeze({\n      ...settings.variables,\n      ...(maxOutputTokens === undefined\n        ? {}\n        : { [CLAUDE_MAX_OUTPUT_VARIABLE]: String(maxOutputTokens) }),\n      ...(mcpTimeout === undefined\n        ? {}\n        : { [CLAUDE_MCP_TIMEOUT_VARIABLE]: String(mcpTimeout) }),\n    }),\n    request: (input) => claudeRequest(settings, input),\n    events: claudeEvents,\n    liveInput: claudeLiveInput,\n    quota: textMatcher(claudeQuotaPatterns),\n    unavailable: textMatcher(\n      claudeUnavailablePatterns,\n      transientNoticePatterns,\n    ),\n    transcriptUsage: claudeTranscriptUsage,\n  } satisfies AgentAdapter);\n}\n\nexport function createClaudeHarness(settings: ClaudeSettings = {}): CliHarness {\n  harnessSettings(settings);\n  conversationSettings(claudeLabel, claudeConversationLayout.format, settings);\n  const configured = configuredSettings(settings);\n  return Object.freeze({\n    kind: \"cli\",\n    bind: (model?: AgentModel) =>\n      bindClaude({\n        ...configured,\n        ...(model === undefined ? {} : { model }),\n      }),\n  });\n}\n"]}

package/dist/adapters/agents/claude/claude-profile.constants.d.ts

@@ -0,0 +1,6 @@
+export declare const CLAUDE_PROFILE_TOOLS: Readonly<{
+    read: readonly string[];
+    edit: readonly string[];
+    shell: readonly string[];
+}>;
+export declare const CLAUDE_PROFILE_HOOK = "let data = \"\";\nprocess.stdin.setEncoding(\"utf8\");\nprocess.stdin.on(\"data\", (chunk) => { data += chunk; });\nprocess.stdin.on(\"end\", () => {\n  try {\n    const input = JSON.parse(data);\n    const name = input.tool_name;\n    const permitted = tools.includes(name) &&\n      (name !== \"Bash\" || shell || commands.includes(input.tool_input?.command));\n    const mcp = servers.some((server) => typeof name === \"string\" && name.startsWith(\"mcp__\" + server + \"__\"));\n    if (excluded.includes(name) || (!permitted && !mcp)) throw new Error(\"Denied by agent profile allowedTools\");\n    process.stdout.write(JSON.stringify({ hookSpecificOutput: {\n      hookEventName: \"PreToolUse\", permissionDecision: \"allow\"\n    } }));\n  } catch {\n    process.stderr.write(\"Denied by agent profile allowedTools\");\n    process.exitCode = 2;\n  }\n});";

package/dist/adapters/agents/claude/claude-profile.constants.js

@@ -0,0 +1,25 @@
+export const CLAUDE_PROFILE_TOOLS = Object.freeze({
+    read: Object.freeze(["Read", "Glob", "Grep"]),
+    edit: Object.freeze(["Edit", "Write", "NotebookEdit"]),
+    shell: Object.freeze(["Bash"]),
+});
+export const CLAUDE_PROFILE_HOOK = `let data = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => { data += chunk; });
+process.stdin.on("end", () => {
+  try {
+    const input = JSON.parse(data);
+    const name = input.tool_name;
+    const permitted = tools.includes(name) &&
+      (name !== "Bash" || shell || commands.includes(input.tool_input?.command));
+    const mcp = servers.some((server) => typeof name === "string" && name.startsWith("mcp__" + server + "__"));
+    if (excluded.includes(name) || (!permitted && !mcp)) throw new Error("Denied by agent profile allowedTools");
+    process.stdout.write(JSON.stringify({ hookSpecificOutput: {
+      hookEventName: "PreToolUse", permissionDecision: "allow"
+    } }));
+  } catch {
+    process.stderr.write("Denied by agent profile allowedTools");
+    process.exitCode = 2;
+  }
+});`;
+//# sourceMappingURL=claude-profile.constants.js.map

package/dist/adapters/agents/claude/claude-profile.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-profile.constants.js","sourceRoot":"","sources":["../../../../src/adapters/agents/claude/claude-profile.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IACtD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;IAkB/B,CAAC","sourcesContent":["export const CLAUDE_PROFILE_TOOLS = Object.freeze({\n  read: Object.freeze([\"Read\", \"Glob\", \"Grep\"]),\n  edit: Object.freeze([\"Edit\", \"Write\", \"NotebookEdit\"]),\n  shell: Object.freeze([\"Bash\"]),\n});\n\nexport const CLAUDE_PROFILE_HOOK = `let data = \"\";\nprocess.stdin.setEncoding(\"utf8\");\nprocess.stdin.on(\"data\", (chunk) => { data += chunk; });\nprocess.stdin.on(\"end\", () => {\n  try {\n    const input = JSON.parse(data);\n    const name = input.tool_name;\n    const permitted = tools.includes(name) &&\n      (name !== \"Bash\" || shell || commands.includes(input.tool_input?.command));\n    const mcp = servers.some((server) => typeof name === \"string\" && name.startsWith(\"mcp__\" + server + \"__\"));\n    if (excluded.includes(name) || (!permitted && !mcp)) throw new Error(\"Denied by agent profile allowedTools\");\n    process.stdout.write(JSON.stringify({ hookSpecificOutput: {\n      hookEventName: \"PreToolUse\", permissionDecision: \"allow\"\n    } }));\n  } catch {\n    process.stderr.write(\"Denied by agent profile allowedTools\");\n    process.exitCode = 2;\n  }\n});`;\n"]}

package/dist/adapters/agents/claude/claude-profile.d.ts

@@ -0,0 +1,3 @@
+import type { ClaudeSettings } from "../settings.types.ts";
+export declare function supportClaudeProfile(settings: ClaudeSettings): void;
+export declare function claudeProfileArguments(settings: ClaudeSettings): readonly string[];

package/dist/adapters/agents/claude/claude-profile.js

@@ -0,0 +1,69 @@
+import { invariant } from "../../../domain/errors.js";
+import { quote } from "../../../infrastructure/process.js";
+import { CLAUDE_PROFILE_HOOK, CLAUDE_PROFILE_TOOLS, } from "./claude-profile.constants.js";
+export function supportClaudeProfile(settings) {
+    invariant(settings.profile?.allowedTools === undefined ||
+        settings.permissions === undefined ||
+        settings.permissions === "dontAsk", "Claude Code agent profile allowedTools requires permission mode dontAsk; remove conflicting permissions");
+}
+export function claudeProfileArguments(settings) {
+    const profile = settings.profile;
+    if (!profile)
+        return [];
+    const instructions = profile.instructions === undefined
+        ? []
+        : [
+            "--append-system-prompt",
+            profile.instructions,
+            "--system-prompt-snapshot",
+            "off",
+        ];
+    if (profile.allowedTools === undefined)
+        return instructions;
+    const tools = [
+        ...new Set(profile.allowedTools.flatMap((tool) => {
+            if (tool.startsWith("shell:"))
+                return ["Bash"];
+            if (tool === "read" || tool === "edit" || tool === "shell")
+                return CLAUDE_PROFILE_TOOLS[tool];
+            return [];
+        })),
+    ];
+    const commands = profile.allowedTools
+        .filter((tool) => tool.startsWith("shell:"))
+        .map((tool) => tool.slice(6));
+    const script = [
+        `const tools = ${JSON.stringify(tools)};`,
+        `const commands = ${JSON.stringify(commands)};`,
+        `const shell = ${profile.allowedTools.includes("shell")};`,
+        `const servers = ${JSON.stringify(Object.keys(settings.mcpServers ?? {}))};`,
+        `const excluded = ${JSON.stringify(Object.entries(settings.mcpServers ?? {}).flatMap(([server, entry]) => (entry.tools?.exclude ?? []).map((tool) => `mcp__${server}__${tool}`)))};`,
+        CLAUDE_PROFILE_HOOK,
+    ].join("\n");
+    return [
+        ...instructions,
+        `--tools=${tools.join(",")}`,
+        "--permission-mode",
+        "dontAsk",
+        "--setting-sources",
+        "",
+        "--strict-mcp-config",
+        "--settings",
+        JSON.stringify({
+            hooks: {
+                PreToolUse: [
+                    {
+                        matcher: "*",
+                        hooks: [
+                            {
+                                type: "command",
+                                command: `node -e ${quote(script)} || exit 2`,
+                            },
+                        ],
+                    },
+                ],
+            },
+        }),
+    ];
+}
+//# sourceMappingURL=claude-profile.js.map

package/dist/adapters/agents/claude/claude-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-profile.js","sourceRoot":"","sources":["../../../../src/adapters/agents/claude/claude-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,oCAAoC,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AAGvC,MAAM,UAAU,oBAAoB,CAAC,QAAwB;IAC3D,SAAS,CACP,QAAQ,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS;QAC1C,QAAQ,CAAC,WAAW,KAAK,SAAS;QAClC,QAAQ,CAAC,WAAW,KAAK,SAAS,EACpC,yGAAyG,CAC1G,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAwB;IAExB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,KAAK,SAAS;QAChC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,wBAAwB;YACxB,OAAO,CAAC,YAAY;YACpB,0BAA0B;YAC1B,KAAK;SACN,CAAC;IACR,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC5D,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,GAAG,CACR,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACpC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO;gBACxD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACpC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CACH;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY;SAClC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;SAC3C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG;QACb,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG;QACzC,oBAAoB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;QAC/C,iBAAiB,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG;QAC1D,mBAAmB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG;QAC5E,oBAAoB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG;QACpL,mBAAmB;KACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;QACL,GAAG,YAAY;QACf,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC5B,mBAAmB;QACnB,SAAS;QACT,mBAAmB;QACnB,EAAE;QACF,qBAAqB;QACrB,YAAY;QACZ,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV;wBACE,OAAO,EAAE,GAAG;wBACZ,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,SAAS;gCACf,OAAO,EAAE,WAAW,KAAK,CAAC,MAAM,CAAC,YAAY;6BAC9C;yBACF;qBACF;iBACF;aACF;SACF,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["import { invariant } from \"../../../domain/errors.ts\";\nimport { quote } from \"../../../infrastructure/process.ts\";\nimport {\n  CLAUDE_PROFILE_HOOK,\n  CLAUDE_PROFILE_TOOLS,\n} from \"./claude-profile.constants.ts\";\nimport type { ClaudeSettings } from \"../settings.types.ts\";\n\nexport function supportClaudeProfile(settings: ClaudeSettings): void {\n  invariant(\n    settings.profile?.allowedTools === undefined ||\n      settings.permissions === undefined ||\n      settings.permissions === \"dontAsk\",\n    \"Claude Code agent profile allowedTools requires permission mode dontAsk; remove conflicting permissions\",\n  );\n}\n\nexport function claudeProfileArguments(\n  settings: ClaudeSettings,\n): readonly string[] {\n  const profile = settings.profile;\n  if (!profile) return [];\n  const instructions =\n    profile.instructions === undefined\n      ? []\n      : [\n          \"--append-system-prompt\",\n          profile.instructions,\n          \"--system-prompt-snapshot\",\n          \"off\",\n        ];\n  if (profile.allowedTools === undefined) return instructions;\n  const tools = [\n    ...new Set(\n      profile.allowedTools.flatMap((tool) => {\n        if (tool.startsWith(\"shell:\")) return [\"Bash\"];\n        if (tool === \"read\" || tool === \"edit\" || tool === \"shell\")\n          return CLAUDE_PROFILE_TOOLS[tool];\n        return [];\n      }),\n    ),\n  ];\n  const commands = profile.allowedTools\n    .filter((tool) => tool.startsWith(\"shell:\"))\n    .map((tool) => tool.slice(6));\n  const script = [\n    `const tools = ${JSON.stringify(tools)};`,\n    `const commands = ${JSON.stringify(commands)};`,\n    `const shell = ${profile.allowedTools.includes(\"shell\")};`,\n    `const servers = ${JSON.stringify(Object.keys(settings.mcpServers ?? {}))};`,\n    `const excluded = ${JSON.stringify(Object.entries(settings.mcpServers ?? {}).flatMap(([server, entry]) => (entry.tools?.exclude ?? []).map((tool) => `mcp__${server}__${tool}`)))};`,\n    CLAUDE_PROFILE_HOOK,\n  ].join(\"\\n\");\n  return [\n    ...instructions,\n    `--tools=${tools.join(\",\")}`,\n    \"--permission-mode\",\n    \"dontAsk\",\n    \"--setting-sources\",\n    \"\",\n    \"--strict-mcp-config\",\n    \"--settings\",\n    JSON.stringify({\n      hooks: {\n        PreToolUse: [\n          {\n            matcher: \"*\",\n            hooks: [\n              {\n                type: \"command\",\n                command: `node -e ${quote(script)} || exit 2`,\n              },\n            ],\n          },\n        ],\n      },\n    }),\n  ];\n}\n"]}

package/dist/adapters/agents/claude/claude-request.js

@@ -1,9 +1,13 @@
+import { claudeProfileArguments } from "./claude-profile.js";
 import { claudeUserMessage } from "./claude-input.js";
 import { claudeMcpArguments } from "./claude-mcp.js";
 import { validateContinuation } from "../continuation.js";
 export function claudeRequest(settings, input) {
     validateContinuation(input);
-    const args = [...claudeMcpArguments(settings.mcpServers)];
+    const args = [
+        ...claudeMcpArguments(settings.mcpServers),
+        ...claudeProfileArguments(settings),
+    ];
     if (!input.interactive)
         args.push("--print", "--verbose", "--output-format", "stream-json");
     if (!input.interactive && input.liveInput)
@@ -14,9 +18,11 @@ export function claudeRequest(settings, input) {
         args.push("--model", settings.model.name);
     if (settings.model?.reasoning)
         args.push("--effort", settings.model.reasoning);
-    if (settings.permissions)
+    if (settings.profile?.allowedTools === undefined && settings.permissions)
         args.push("--permission-mode", settings.permissions);
-    if (!settings.permissions && !input.interactive)
+    if (settings.profile?.allowedTools === undefined &&
+        !settings.permissions &&
+        !input.interactive)
         args.push("--dangerously-skip-permissions");
     if (input.continuation) {
         args.push("--resume", input.continuation.id);

package/dist/adapters/agents/claude/claude-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-request.js","sourceRoot":"","sources":["../../../../src/adapters/agents/claude/claude-request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG1D,MAAM,UAAU,aAAa,CAC3B,QAA+B,EAC/B,KAAiB;IAEjB,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAa,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,CAAC,WAAW;QACpB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS;QACvC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,wBAAwB,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe;QAChD,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,KAAK,EAAE,SAAS;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,WAAW;QACtB,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,WAAW;QAC7C,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,IAAI;QACf,GAAG,CAAC,KAAK,CAAC,WAAW;YACnB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;YACvB,CAAC,CAAC;gBACE,KAAK,EAAE,KAAK,CAAC,SAAS;oBACpB,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;aACvB,CAAC;KACP,CAAC;AACJ,CAAC","sourcesContent":["import type { AgentInput } from \"../../../domain/agent.types.ts\";\nimport type { Command } from \"../../../domain/command.types.ts\";\nimport { claudeUserMessage } from \"./claude-input.ts\";\nimport { claudeMcpArguments } from \"./claude-mcp.ts\";\nimport { validateContinuation } from \"../continuation.ts\";\nimport type { Bound, ClaudeSettings } from \"../settings.types.ts\";\n\nexport function claudeRequest(\n  settings: Bound<ClaudeSettings>,\n  input: AgentInput,\n): Command {\n  validateContinuation(input);\n  const args: string[] = [...claudeMcpArguments(settings.mcpServers)];\n  if (!input.interactive)\n    args.push(\"--print\", \"--verbose\", \"--output-format\", \"stream-json\");\n  if (!input.interactive && input.liveInput)\n    args.push(\"--input-format\", \"stream-json\", \"--replay-user-messages\");\n  if (!input.interactive && settings.partialMessages)\n    args.push(\"--include-partial-messages\");\n  if (settings.model) args.push(\"--model\", settings.model.name);\n  if (settings.model?.reasoning)\n    args.push(\"--effort\", settings.model.reasoning);\n  if (settings.permissions)\n    args.push(\"--permission-mode\", settings.permissions);\n  if (!settings.permissions && !input.interactive)\n    args.push(\"--dangerously-skip-permissions\");\n  if (input.continuation) {\n    args.push(\"--resume\", input.continuation.id);\n    if (input.continuation.fork) args.push(\"--fork-session\");\n  }\n  if (input.interactive && input.text !== undefined)\n    args.push(\"--\", input.text);\n  return {\n    executable: \"claude\",\n    arguments: args,\n    ...(input.interactive\n      ? { interactive: true }\n      : {\n          stdin: input.liveInput\n            ? claudeUserMessage(input.text ?? \"\")\n            : (input.text ?? \"\"),\n        }),\n  };\n}\n"]}
+{"version":3,"file":"claude-request.js","sourceRoot":"","sources":["../../../../src/adapters/agents/claude/claude-request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG1D,MAAM,UAAU,aAAa,CAC3B,QAA+B,EAC/B,KAAiB;IAEjB,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAa;QACrB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC1C,GAAG,sBAAsB,CAAC,QAAQ,CAAC;KACpC,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,WAAW;QACpB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS;QACvC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,wBAAwB,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe;QAChD,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,KAAK,EAAE,SAAS;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW;QACtE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,IACE,QAAQ,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS;QAC5C,CAAC,QAAQ,CAAC,WAAW;QACrB,CAAC,KAAK,CAAC,WAAW;QAElB,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,IAAI;QACf,GAAG,CAAC,KAAK,CAAC,WAAW;YACnB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;YACvB,CAAC,CAAC;gBACE,KAAK,EAAE,KAAK,CAAC,SAAS;oBACpB,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;aACvB,CAAC;KACP,CAAC;AACJ,CAAC","sourcesContent":["import type { AgentInput } from \"../../../domain/agent.types.ts\";\nimport type { Command } from \"../../../domain/command.types.ts\";\nimport { claudeProfileArguments } from \"./claude-profile.ts\";\nimport { claudeUserMessage } from \"./claude-input.ts\";\nimport { claudeMcpArguments } from \"./claude-mcp.ts\";\nimport { validateContinuation } from \"../continuation.ts\";\nimport type { Bound, ClaudeSettings } from \"../settings.types.ts\";\n\nexport function claudeRequest(\n  settings: Bound<ClaudeSettings>,\n  input: AgentInput,\n): Command {\n  validateContinuation(input);\n  const args: string[] = [\n    ...claudeMcpArguments(settings.mcpServers),\n    ...claudeProfileArguments(settings),\n  ];\n  if (!input.interactive)\n    args.push(\"--print\", \"--verbose\", \"--output-format\", \"stream-json\");\n  if (!input.interactive && input.liveInput)\n    args.push(\"--input-format\", \"stream-json\", \"--replay-user-messages\");\n  if (!input.interactive && settings.partialMessages)\n    args.push(\"--include-partial-messages\");\n  if (settings.model) args.push(\"--model\", settings.model.name);\n  if (settings.model?.reasoning)\n    args.push(\"--effort\", settings.model.reasoning);\n  if (settings.profile?.allowedTools === undefined && settings.permissions)\n    args.push(\"--permission-mode\", settings.permissions);\n  if (\n    settings.profile?.allowedTools === undefined &&\n    !settings.permissions &&\n    !input.interactive\n  )\n    args.push(\"--dangerously-skip-permissions\");\n  if (input.continuation) {\n    args.push(\"--resume\", input.continuation.id);\n    if (input.continuation.fork) args.push(\"--fork-session\");\n  }\n  if (input.interactive && input.text !== undefined)\n    args.push(\"--\", input.text);\n  return {\n    executable: \"claude\",\n    arguments: args,\n    ...(input.interactive\n      ? { interactive: true }\n      : {\n          stdin: input.liveInput\n            ? claudeUserMessage(input.text ?? \"\")\n            : (input.text ?? \"\"),\n        }),\n  };\n}\n"]}