@elie-laloum/outpost 11.1.2 → 11.2.0

package/dist/domain/egress.js.map

@@ -1 +1 @@
-{"version":3,"file":"egress.js","sourceRoot":"","sources":["../../src/domain/egress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,SAAS,OAAO,CACd,KAAc,EACd,KAAa,EACb,QAAoC;IAEpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,SAAS,CACP,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EACpE,WAAW,KAAK,QAAQ,CACzB,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7D,OAAO,CACL,IAAI,CAAC,MAAM,IAAI,GAAG;QAClB,CAAC,IAAI,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI;aACD,KAAK,CAAC,GAAG,CAAC;aACV,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,yCAAyC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChC,OAAO,CACL,OAAO,KAAK,CAAC;QACb,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,SAAS,CACP,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACpE,gCAAgC,CACjC,CAAC;IACF,SAAS,CAAC,MAAM,IAAI,KAAK,EAAE,wBAAwB,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,SAAS,CACP,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,EACjD,2CAA2C,CAC5C,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IACD,SAAS,CACP,KAAK,CAAC,IAAI,KAAK,WAAW,EAC1B,2CAA2C,CAC5C,CAAC;IACF,SAAS,CACP,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC7D,6BAA6B,CAC9B,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CACrB,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAC9C,gBAAgB,EAChB,MAAM,CACP,CAAC;IACF,MAAM,UAAU,GAAG,OAAO,CACxB,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EACpD,mBAAmB,EACnB,IAAI,CACL,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CACvB,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAClD,kBAAkB,EAClB,IAAI,CACL,CAAC;IACF,SAAS,CACP,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EACtC,uFAAuF,CACxF,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC","sourcesContent":["import { isIP } from \"node:net\";\nimport { egressFields } from \"./egress.constants.ts\";\nimport { invariant } from \"./errors.ts\";\nimport type { EgressPolicy } from \"./egress.types.ts\";\n\nfunction entries(\n  value: unknown,\n  label: string,\n  validate: (entry: string) => boolean,\n): string[] {\n  if (value === undefined) return [];\n  invariant(Array.isArray(value), `${label} must be an array`);\n  const items = Array.from(value);\n  invariant(\n    items.every((entry) => typeof entry === \"string\" && validate(entry)),\n    `Invalid ${label} entry`,\n  );\n  return [...new Set<string>(items)];\n}\n\nfunction domain(value: string): boolean {\n  const name = value.startsWith(\"*.\") ? value.slice(2) : value;\n  return (\n    name.length <= 253 &&\n    !isIP(name) &&\n    name.includes(\".\") &&\n    name\n      .split(\".\")\n      .every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label))\n  );\n}\n\nfunction cidr(value: string): boolean {\n  const parts = value.split(\"/\");\n  if (parts.length !== 2) return false;\n  const version = isIP(parts[0]!);\n  return (\n    version !== 0 &&\n    /^(0|[1-9][0-9]*)$/.test(parts[1]!) &&\n    Number(parts[1]) <= (version === 4 ? 32 : 128) &&\n    !parts[0]!.includes(\"%\")\n  );\n}\n\nexport function validateEgress(value: unknown): EgressPolicy | undefined {\n  if (value === undefined) return undefined;\n  invariant(\n    value !== null && typeof value === \"object\" && !Array.isArray(value),\n    \"egress must be a policy object\",\n  );\n  invariant(\"mode\" in value, \"egress requires a mode\");\n  if (value.mode === \"deny-all\") {\n    invariant(\n      Object.keys(value).every((key) => key === \"mode\"),\n      \"deny-all does not accept allowlist fields\",\n    );\n    return { mode: \"deny-all\" };\n  }\n  invariant(\n    value.mode === \"allowlist\",\n    \"egress mode must be deny-all or allowlist\",\n  );\n  invariant(\n    Object.keys(value).every((key) => egressFields.includes(key)),\n    \"Unknown egress policy field\",\n  );\n  const domains = entries(\n    \"domains\" in value ? value.domains : undefined,\n    \"egress domains\",\n    domain,\n  );\n  const allowCidrs = entries(\n    \"allowCidrs\" in value ? value.allowCidrs : undefined,\n    \"egress allowCidrs\",\n    cidr,\n  );\n  const denyCidrs = entries(\n    \"denyCidrs\" in value ? value.denyCidrs : undefined,\n    \"egress denyCidrs\",\n    cidr,\n  );\n  invariant(\n    domains.length + allowCidrs.length > 0,\n    \"egress allowlist requires an allowed domain or CIDR; use deny-all to block everything\",\n  );\n  return { mode: \"allowlist\", domains, allowCidrs, denyCidrs };\n}\n"]}
+{"version":3,"file":"egress.js","sourceRoot":"","sources":["../../src/domain/egress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,SAAS,OAAO,CACd,KAAc,EACd,KAAa,EACb,QAAoC;IAEpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,SAAS,CACP,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EACpE,WAAW,KAAK,QAAQ,CACzB,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7D,OAAO,CACL,IAAI,CAAC,MAAM,IAAI,GAAG;QAClB,CAAC,IAAI,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI;aACD,KAAK,CAAC,GAAG,CAAC;aACV,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,yCAAyC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChC,OAAO,CACL,OAAO,KAAK,CAAC;QACb,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,SAAS,CACP,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACpE,gCAAgC,CACjC,CAAC;IACF,SAAS,CAAC,MAAM,IAAI,KAAK,EAAE,wBAAwB,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,SAAS,CACP,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,EACjD,2CAA2C,CAC5C,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IACD,SAAS,CACP,KAAK,CAAC,IAAI,KAAK,WAAW,EAC1B,2CAA2C,CAC5C,CAAC;IACF,SAAS,CACP,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC7D,6BAA6B,CAC9B,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CACrB,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAC9C,gBAAgB,EAChB,MAAM,CACP,CAAC;IACF,MAAM,UAAU,GAAG,OAAO,CACxB,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EACpD,mBAAmB,EACnB,IAAI,CACL,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CACvB,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAClD,kBAAkB,EAClB,IAAI,CACL,CAAC;IACF,SAAS,CACP,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EACtC,uFAAuF,CACxF,CAAC;IACF,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAChE,UAAU;QACV,SAAS;KACV,CAAC;AACJ,CAAC","sourcesContent":["import { isIP } from \"node:net\";\nimport { egressFields } from \"./egress.constants.ts\";\nimport { invariant } from \"./errors.ts\";\nimport type { EgressPolicy } from \"./egress.types.ts\";\n\nfunction entries(\n  value: unknown,\n  label: string,\n  validate: (entry: string) => boolean,\n): string[] {\n  if (value === undefined) return [];\n  invariant(Array.isArray(value), `${label} must be an array`);\n  const items = Array.from(value);\n  invariant(\n    items.every((entry) => typeof entry === \"string\" && validate(entry)),\n    `Invalid ${label} entry`,\n  );\n  return [...new Set<string>(items)];\n}\n\nfunction domain(value: string): boolean {\n  const name = value.startsWith(\"*.\") ? value.slice(2) : value;\n  return (\n    name.length <= 253 &&\n    !isIP(name) &&\n    name.includes(\".\") &&\n    name\n      .split(\".\")\n      .every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label))\n  );\n}\n\nfunction cidr(value: string): boolean {\n  const parts = value.split(\"/\");\n  if (parts.length !== 2) return false;\n  const version = isIP(parts[0]!);\n  return (\n    version !== 0 &&\n    /^(0|[1-9][0-9]*)$/.test(parts[1]!) &&\n    Number(parts[1]) <= (version === 4 ? 32 : 128) &&\n    !parts[0]!.includes(\"%\")\n  );\n}\n\nexport function validateEgress(value: unknown): EgressPolicy | undefined {\n  if (value === undefined) return undefined;\n  invariant(\n    value !== null && typeof value === \"object\" && !Array.isArray(value),\n    \"egress must be a policy object\",\n  );\n  invariant(\"mode\" in value, \"egress requires a mode\");\n  if (value.mode === \"deny-all\") {\n    invariant(\n      Object.keys(value).every((key) => key === \"mode\"),\n      \"deny-all does not accept allowlist fields\",\n    );\n    return { mode: \"deny-all\" };\n  }\n  invariant(\n    value.mode === \"allowlist\",\n    \"egress mode must be deny-all or allowlist\",\n  );\n  invariant(\n    Object.keys(value).every((key) => egressFields.includes(key)),\n    \"Unknown egress policy field\",\n  );\n  const domains = entries(\n    \"domains\" in value ? value.domains : undefined,\n    \"egress domains\",\n    domain,\n  );\n  const allowCidrs = entries(\n    \"allowCidrs\" in value ? value.allowCidrs : undefined,\n    \"egress allowCidrs\",\n    cidr,\n  );\n  const denyCidrs = entries(\n    \"denyCidrs\" in value ? value.denyCidrs : undefined,\n    \"egress denyCidrs\",\n    cidr,\n  );\n  invariant(\n    domains.length + allowCidrs.length > 0,\n    \"egress allowlist requires an allowed domain or CIDR; use deny-all to block everything\",\n  );\n  return {\n    mode: \"allowlist\",\n    domains: [...new Set(domains.map((name) => name.toLowerCase()))],\n    allowCidrs,\n    denyCidrs,\n  };\n}\n"]}

package/dist/domain/glob.js

@@ -4,7 +4,7 @@ const stars = {
 };
 const tokens = {
     "*": (mode) => stars[mode],
-    "?": () => "[^/]",
+    "?": (mode) => (mode === "text" ? "[^]" : "[^/]"),
 };
 export function glob(pattern, mode) {
     let source = "";

package/dist/domain/glob.js.map

@@ -1 +1 @@
-{"version":3,"file":"glob.js","sourceRoot":"","sources":["../../src/domain/glob.ts"],"names":[],"mappings":"AAEA,MAAM,KAAK,GAAuC;IAChD,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,MAAM,MAAM,GAAyD;IACnE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;IAC1B,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM;CAClB,CAAC;AAEF,MAAM,UAAU,IAAI,CAAC,OAAe,EAAE,IAAc;IAClD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAClC,IAAI,SAAS,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;YAC7C,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;YAC5C,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM;YACJ,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC;gBACzB,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type { GlobMode } from \"./glob.types.ts\";\n\nconst stars: Readonly<Record<GlobMode, string>> = {\n  path: \"[^/]*\",\n  text: \"[^]*\",\n};\n\nconst tokens: Readonly<Record<string, (mode: GlobMode) => string>> = {\n  \"*\": (mode) => stars[mode],\n  \"?\": () => \"[^/]\",\n};\n\nexport function glob(pattern: string, mode: GlobMode): RegExp {\n  let source = \"\";\n  for (let index = 0; index < pattern.length; index++) {\n    const character = pattern[index]!;\n    if (character === \"*\" && pattern[index + 1] === \"*\") {\n      const directory = pattern[index + 2] === \"/\";\n      source += directory ? \"(?:[^]*/)?\" : \"[^]*\";\n      index += directory ? 2 : 1;\n      continue;\n    }\n    source +=\n      tokens[character]?.(mode) ??\n      character.replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\");\n  }\n  return new RegExp(`^${source}$`);\n}\n"]}
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../../src/domain/glob.ts"],"names":[],"mappings":"AAEA,MAAM,KAAK,GAAuC;IAChD,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,MAAM,MAAM,GAAyD;IACnE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;IAC1B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;CAClD,CAAC;AAEF,MAAM,UAAU,IAAI,CAAC,OAAe,EAAE,IAAc;IAClD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAClC,IAAI,SAAS,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;YAC7C,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;YAC5C,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM;YACJ,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC;gBACzB,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type { GlobMode } from \"./glob.types.ts\";\n\nconst stars: Readonly<Record<GlobMode, string>> = {\n  path: \"[^/]*\",\n  text: \"[^]*\",\n};\n\nconst tokens: Readonly<Record<string, (mode: GlobMode) => string>> = {\n  \"*\": (mode) => stars[mode],\n  \"?\": (mode) => (mode === \"text\" ? \"[^]\" : \"[^/]\"),\n};\n\nexport function glob(pattern: string, mode: GlobMode): RegExp {\n  let source = \"\";\n  for (let index = 0; index < pattern.length; index++) {\n    const character = pattern[index]!;\n    if (character === \"*\" && pattern[index + 1] === \"*\") {\n      const directory = pattern[index + 2] === \"/\";\n      source += directory ? \"(?:[^]*/)?\" : \"[^]*\";\n      index += directory ? 2 : 1;\n      continue;\n    }\n    source +=\n      tokens[character]?.(mode) ??\n      character.replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\");\n  }\n  return new RegExp(`^${source}$`);\n}\n"]}

package/dist/domain/harness.js

@@ -58,7 +58,10 @@ export function createHarness(options) {
         skills,
         limits: limits(options.limits ?? {}),
         toolExecution: toolExecution(options.toolExecution ?? {}),
-        hooks: harnessHooks(options.hooks),
+        hooks: harnessHooks([
+            ...(profile?.hooks?.outpost ?? []),
+            ...harnessHooks(options.hooks),
+        ]),
         ...(options.permissions ? { permissions: options.permissions } : {}),
         ...(options.context ? { context: options.context } : {}),
         ...(options.conversations === undefined

package/dist/domain/harness.js.map

@@ -1 +1 @@
-{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../src/domain/harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,SAAS,CACP,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC/C,mCAAmC,CACpC,CAAC;IACF,SAAS,CACP,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,EACnB,+EAA+E,CAChF,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAC7C,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAClC,CAAC;IACF,SAAS,CACP,WAAW,CAAC,MAAM,KAAK,CAAC,EACxB,+BAA+B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxD,CAAC;IACF,SAAS,CACP,OAAO,OAAO,CAAC,aAAa,EAAE,OAAO,KAAK,UAAU,EACpD,0CAA0C,CAC3C,CAAC;IACF,SAAS,CACP,OAAO,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS;QAC1C,OAAO,OAAO,CAAC,aAAa,CAAC,QAAQ,KAAK,UAAU,EACtD,4CAA4C,CAC7C,CAAC;IACF,SAAS,CACP,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,EACjE,+BAA+B,CAChC,CAAC;IACF,SAAS,CACP,OAAO,CAAC,WAAW,KAAK,SAAS;QAC/B,OAAO,CAAC,WAAW,EAAE,IAAI,KAAK,aAAa,EAC7C,mDAAmD,CACpD,CAAC;IACF,SAAS,CACP,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,EACpE,8DAA8D,CAC/D,CAAC;IACF,SAAS,CACP,OAAO,CAAC,aAAa,KAAK,SAAS;QACjC,OAAO,CAAC,aAAa,KAAK,KAAK;QAC/B,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,EAC5C,6DAA6D,CAC9D,CAAC;IACF,IAAI,OAAO,CAAC,aAAa;QACvB,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAS,CACP,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,eAAe,EAC1E,gDAAgD,CACjD,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;QACpB,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACrD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChD,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;YAC1B,GAAG,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC;YAC7C,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,MAAM;gBACf,CAAC,CAAC,CAAC,yBAAyB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,KAAK,EAAE,YAAY,CAAC;YAClB,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACxB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;QACF,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACpC,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACzD,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;QAClC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;QAC7C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,gBAAgB,CAAC,KAAK;QAC9C,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAoB;IAClC,SAAS,CACP,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAC3C,kCAAkC,CACnC,CAAC;IACF,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACxC,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC5C,KAAK,CAAC,kBAAkB,IAAI,CAAC,EAC/B,0DAA0D,CAC3D,CAAC;IACJ,MAAM,QAAQ,GAAG,QAAQ,CACvB,KAAK,CAAC,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,EAC3C,kBAAkB,CACnB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAClC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,SAAS,CACP,KAAK,CAAC,KAAK,KAAK,IAAI;YAClB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACrE,oEAAoE,CACrE,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAC5C,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EACzC,mDAAmD,CACpD,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;QACzC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,KAA2B;IAE3B,SAAS,CACP,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAC3C,yCAAyC,CAC1C,CAAC;IACF,SAAS,CACP,KAAK,CAAC,OAAO,KAAK,SAAS;QACzB,KAAK,CAAC,OAAO,KAAK,iBAAiB;QACnC,KAAK,CAAC,OAAO,KAAK,MAAM,EAC1B,kDAAkD,CACnD,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,QAAQ,CACnB,KAAK,CAAC,WAAW,IAAI,gBAAgB,CAAC,WAAW,EACjD,kBAAkB,CACnB;QACD,UAAU,EAAE,QAAQ,CAClB,KAAK,CAAC,UAAU,IAAI,gBAAgB,CAAC,cAAc,EACnD,iBAAiB,CAClB;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,OAAO;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9D,SAAS,CACP,MAAM,CAAC,MAAM,KAAK,CAAC,EACnB,sEAAsE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1F,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import { conversationFormat, isConversationStore } from \"./conversation.ts\";\nimport { agentProfile, profileMcpServers } from \"./agent-profile.ts\";\nimport { invariant, positive } from \"./errors.ts\";\nimport {\n  HARNESS_DEFAULTS,\n  HARNESS_FIELDS,\n  USAGE_FIELDS,\n} from \"./harness.constants.ts\";\nimport type {\n  Harness,\n  HarnessOptions,\n  HarnessLimits,\n  HarnessToolExecution,\n  ResolvedHarnessLimits,\n} from \"./harness.types.ts\";\nimport { harnessHooks } from \"./hook.ts\";\nimport { mcpLoginServers, mcpServers } from \"./mcp-server.ts\";\nimport {\n  defineHarnessInstructions,\n  harnessInstructions,\n} from \"./instructions.ts\";\nimport { harnessSkills, skillCatalog, skillLoader } from \"./skill.ts\";\nimport { harnessTools } from \"./tool.ts\";\nimport { defineHarnessModelRouting } from \"./harness-routing.ts\";\n\nexport function createHarness(options: HarnessOptions): Harness {\n  invariant(\n    options !== null && typeof options === \"object\",\n    \"Harness options must be an object\",\n  );\n  invariant(\n    !(\"run\" in options),\n    \"createHarness() no longer accepts run; declare tools, instructions and limits\",\n  );\n  const unsupported = Object.keys(options).filter(\n    (key) => !HARNESS_FIELDS.has(key),\n  );\n  invariant(\n    unsupported.length === 0,\n    `Unsupported harness option: ${unsupported.join(\", \")}`,\n  );\n  invariant(\n    typeof options.modelProvider?.request === \"function\",\n    \"Custom harness requires a model provider\",\n  );\n  invariant(\n    options.modelProvider.validate === undefined ||\n      typeof options.modelProvider.validate === \"function\",\n    \"Model provider validate must be a function\",\n  );\n  invariant(\n    options.cache === undefined || typeof options.cache === \"boolean\",\n    \"Harness cache must be boolean\",\n  );\n  invariant(\n    options.permissions === undefined ||\n      options.permissions?.kind === \"permissions\",\n    \"Declare permissions with defineHarnessPermissions\",\n  );\n  invariant(\n    options.context === undefined || options.context?.kind === \"context\",\n    \"Declare context strategies with defineHarnessContextStrategy\",\n  );\n  invariant(\n    options.conversations === undefined ||\n      options.conversations === false ||\n      isConversationStore(options.conversations),\n    \"Harness conversations must be a conversation store or false\",\n  );\n  if (options.conversations)\n    conversationFormat(\"Harness\", options.conversations, \"harness\");\n  const profile = agentProfile(options.profile);\n  const servers = profileMcpServers(profile, options.mcpServers);\n  const skills = harnessSkills(options.skills);\n  invariant(\n    options.routing === undefined || options.routing?.kind === \"model-routing\",\n    \"Declare routing with defineHarnessModelRouting\",\n  );\n  const routing = (() => {\n    if (!options.routing) return undefined;\n    const { kind: _kind, ...settings } = options.routing;\n    const declared = defineHarnessModelRouting(settings);\n    for (const model of Object.values(declared.models))\n      options.modelProvider.validate?.(model);\n    return declared;\n  })();\n  return Object.freeze({\n    kind: \"custom\",\n    ...(profile === undefined ? {} : { profile }),\n    ...(routing ? { routing } : {}),\n    modelProvider: options.modelProvider,\n    instructions: Object.freeze([\n      ...harnessInstructions(profile?.instructions),\n      ...harnessInstructions(options.instructions),\n      ...(skills.length\n        ? [defineHarnessInstructions(skillCatalog(skills))]\n        : []),\n    ]),\n    tools: harnessTools([\n      ...(options.tools ?? []),\n      ...skills.flatMap((skill) => skill.tools),\n      ...(skills.length ? [skillLoader(skills)] : []),\n    ]),\n    skills,\n    limits: limits(options.limits ?? {}),\n    toolExecution: toolExecution(options.toolExecution ?? {}),\n    hooks: harnessHooks(options.hooks),\n    ...(options.permissions ? { permissions: options.permissions } : {}),\n    ...(options.context ? { context: options.context } : {}),\n    ...(options.conversations === undefined\n      ? {}\n      : { conversations: options.conversations }),\n    cache: options.cache ?? HARNESS_DEFAULTS.cache,\n    ...(servers === undefined\n      ? {}\n      : { mcpServers: harnessMcpServers(servers) }),\n  });\n}\n\nfunction limits(value: HarnessLimits): ResolvedHarnessLimits {\n  invariant(\n    value !== null && typeof value === \"object\",\n    \"Harness limits must be an object\",\n  );\n  if (value.maxDelegationDepth !== undefined)\n    invariant(\n      Number.isSafeInteger(value.maxDelegationDepth) &&\n        value.maxDelegationDepth >= 0,\n      \"Harness maxDelegationDepth must be a nonnegative integer\",\n    );\n  const maxSteps = positive(\n    value.maxSteps ?? HARNESS_DEFAULTS.maxSteps,\n    \"Harness maxSteps\",\n  );\n  if (value.maxToolCalls !== undefined)\n    positive(value.maxToolCalls, \"Harness maxToolCalls\");\n  if (value.usage !== undefined) {\n    invariant(\n      value.usage !== null &&\n        typeof value.usage === \"object\" &&\n        Object.keys(value.usage).every((key) => USAGE_FIELDS.includes(key)),\n      \"Harness usage limits accept input, cached, cacheCreated and output\",\n    );\n    for (const limit of Object.values(value.usage))\n      invariant(\n        Number.isSafeInteger(limit) && limit >= 0,\n        \"Harness usage limits must be nonnegative integers\",\n      );\n  }\n  return Object.freeze({\n    maxSteps,\n    ...(value.maxDelegationDepth === undefined\n      ? {}\n      : { maxDelegationDepth: value.maxDelegationDepth }),\n    ...(value.maxToolCalls === undefined\n      ? {}\n      : { maxToolCalls: value.maxToolCalls }),\n    ...(value.usage === undefined\n      ? {}\n      : { usage: Object.freeze({ ...value.usage }) }),\n  });\n}\n\nfunction toolExecution(\n  value: HarnessToolExecution,\n): Required<HarnessToolExecution> {\n  invariant(\n    value !== null && typeof value === \"object\",\n    \"Harness toolExecution must be an object\",\n  );\n  invariant(\n    value.onError === undefined ||\n      value.onError === \"return-to-model\" ||\n      value.onError === \"fail\",\n    'Tool onError must be \"return-to-model\" or \"fail\"',\n  );\n  return Object.freeze({\n    concurrency: positive(\n      value.concurrency ?? HARNESS_DEFAULTS.concurrency,\n      \"Tool concurrency\",\n    ),\n    deadlineMs: positive(\n      value.deadlineMs ?? HARNESS_DEFAULTS.toolDeadlineMs,\n      \"Tool deadlineMs\",\n    ),\n    onError: value.onError ?? HARNESS_DEFAULTS.onError,\n  });\n}\n\nfunction harnessMcpServers(value: unknown) {\n  const servers = mcpServers(value);\n  const logins = mcpLoginServers(servers).map(([name]) => name);\n  invariant(\n    logins.length === 0,\n    `The built-in harness cannot reuse a CLI OAuth login for MCP server ${logins.join(\", \")}`,\n  );\n  return servers;\n}\n"]}
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../src/domain/harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,SAAS,CACP,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC/C,mCAAmC,CACpC,CAAC;IACF,SAAS,CACP,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,EACnB,+EAA+E,CAChF,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAC7C,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAClC,CAAC;IACF,SAAS,CACP,WAAW,CAAC,MAAM,KAAK,CAAC,EACxB,+BAA+B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxD,CAAC;IACF,SAAS,CACP,OAAO,OAAO,CAAC,aAAa,EAAE,OAAO,KAAK,UAAU,EACpD,0CAA0C,CAC3C,CAAC;IACF,SAAS,CACP,OAAO,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS;QAC1C,OAAO,OAAO,CAAC,aAAa,CAAC,QAAQ,KAAK,UAAU,EACtD,4CAA4C,CAC7C,CAAC;IACF,SAAS,CACP,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,EACjE,+BAA+B,CAChC,CAAC;IACF,SAAS,CACP,OAAO,CAAC,WAAW,KAAK,SAAS;QAC/B,OAAO,CAAC,WAAW,EAAE,IAAI,KAAK,aAAa,EAC7C,mDAAmD,CACpD,CAAC;IACF,SAAS,CACP,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,EACpE,8DAA8D,CAC/D,CAAC;IACF,SAAS,CACP,OAAO,CAAC,aAAa,KAAK,SAAS;QACjC,OAAO,CAAC,aAAa,KAAK,KAAK;QAC/B,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,EAC5C,6DAA6D,CAC9D,CAAC;IACF,IAAI,OAAO,CAAC,aAAa;QACvB,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAS,CACP,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,eAAe,EAC1E,gDAAgD,CACjD,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;QACpB,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACrD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChD,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;YAC1B,GAAG,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC;YAC7C,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,MAAM;gBACf,CAAC,CAAC,CAAC,yBAAyB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,KAAK,EAAE,YAAY,CAAC;YAClB,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACxB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;QACF,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACpC,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACzD,KAAK,EAAE,YAAY,CAAC;YAClB,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;YAClC,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;SAC/B,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;QAC7C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,gBAAgB,CAAC,KAAK;QAC9C,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAoB;IAClC,SAAS,CACP,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAC3C,kCAAkC,CACnC,CAAC;IACF,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACxC,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC5C,KAAK,CAAC,kBAAkB,IAAI,CAAC,EAC/B,0DAA0D,CAC3D,CAAC;IACJ,MAAM,QAAQ,GAAG,QAAQ,CACvB,KAAK,CAAC,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,EAC3C,kBAAkB,CACnB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAClC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,SAAS,CACP,KAAK,CAAC,KAAK,KAAK,IAAI;YAClB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACrE,oEAAoE,CACrE,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAC5C,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EACzC,mDAAmD,CACpD,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;QACzC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,KAA2B;IAE3B,SAAS,CACP,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAC3C,yCAAyC,CAC1C,CAAC;IACF,SAAS,CACP,KAAK,CAAC,OAAO,KAAK,SAAS;QACzB,KAAK,CAAC,OAAO,KAAK,iBAAiB;QACnC,KAAK,CAAC,OAAO,KAAK,MAAM,EAC1B,kDAAkD,CACnD,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,QAAQ,CACnB,KAAK,CAAC,WAAW,IAAI,gBAAgB,CAAC,WAAW,EACjD,kBAAkB,CACnB;QACD,UAAU,EAAE,QAAQ,CAClB,KAAK,CAAC,UAAU,IAAI,gBAAgB,CAAC,cAAc,EACnD,iBAAiB,CAClB;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,OAAO;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9D,SAAS,CACP,MAAM,CAAC,MAAM,KAAK,CAAC,EACnB,sEAAsE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1F,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import { conversationFormat, isConversationStore } from \"./conversation.ts\";\nimport { agentProfile, profileMcpServers } from \"./agent-profile.ts\";\nimport { invariant, positive } from \"./errors.ts\";\nimport {\n  HARNESS_DEFAULTS,\n  HARNESS_FIELDS,\n  USAGE_FIELDS,\n} from \"./harness.constants.ts\";\nimport type {\n  Harness,\n  HarnessOptions,\n  HarnessLimits,\n  HarnessToolExecution,\n  ResolvedHarnessLimits,\n} from \"./harness.types.ts\";\nimport { harnessHooks } from \"./hook.ts\";\nimport { mcpLoginServers, mcpServers } from \"./mcp-server.ts\";\nimport {\n  defineHarnessInstructions,\n  harnessInstructions,\n} from \"./instructions.ts\";\nimport { harnessSkills, skillCatalog, skillLoader } from \"./skill.ts\";\nimport { harnessTools } from \"./tool.ts\";\nimport { defineHarnessModelRouting } from \"./harness-routing.ts\";\n\nexport function createHarness(options: HarnessOptions): Harness {\n  invariant(\n    options !== null && typeof options === \"object\",\n    \"Harness options must be an object\",\n  );\n  invariant(\n    !(\"run\" in options),\n    \"createHarness() no longer accepts run; declare tools, instructions and limits\",\n  );\n  const unsupported = Object.keys(options).filter(\n    (key) => !HARNESS_FIELDS.has(key),\n  );\n  invariant(\n    unsupported.length === 0,\n    `Unsupported harness option: ${unsupported.join(\", \")}`,\n  );\n  invariant(\n    typeof options.modelProvider?.request === \"function\",\n    \"Custom harness requires a model provider\",\n  );\n  invariant(\n    options.modelProvider.validate === undefined ||\n      typeof options.modelProvider.validate === \"function\",\n    \"Model provider validate must be a function\",\n  );\n  invariant(\n    options.cache === undefined || typeof options.cache === \"boolean\",\n    \"Harness cache must be boolean\",\n  );\n  invariant(\n    options.permissions === undefined ||\n      options.permissions?.kind === \"permissions\",\n    \"Declare permissions with defineHarnessPermissions\",\n  );\n  invariant(\n    options.context === undefined || options.context?.kind === \"context\",\n    \"Declare context strategies with defineHarnessContextStrategy\",\n  );\n  invariant(\n    options.conversations === undefined ||\n      options.conversations === false ||\n      isConversationStore(options.conversations),\n    \"Harness conversations must be a conversation store or false\",\n  );\n  if (options.conversations)\n    conversationFormat(\"Harness\", options.conversations, \"harness\");\n  const profile = agentProfile(options.profile);\n  const servers = profileMcpServers(profile, options.mcpServers);\n  const skills = harnessSkills(options.skills);\n  invariant(\n    options.routing === undefined || options.routing?.kind === \"model-routing\",\n    \"Declare routing with defineHarnessModelRouting\",\n  );\n  const routing = (() => {\n    if (!options.routing) return undefined;\n    const { kind: _kind, ...settings } = options.routing;\n    const declared = defineHarnessModelRouting(settings);\n    for (const model of Object.values(declared.models))\n      options.modelProvider.validate?.(model);\n    return declared;\n  })();\n  return Object.freeze({\n    kind: \"custom\",\n    ...(profile === undefined ? {} : { profile }),\n    ...(routing ? { routing } : {}),\n    modelProvider: options.modelProvider,\n    instructions: Object.freeze([\n      ...harnessInstructions(profile?.instructions),\n      ...harnessInstructions(options.instructions),\n      ...(skills.length\n        ? [defineHarnessInstructions(skillCatalog(skills))]\n        : []),\n    ]),\n    tools: harnessTools([\n      ...(options.tools ?? []),\n      ...skills.flatMap((skill) => skill.tools),\n      ...(skills.length ? [skillLoader(skills)] : []),\n    ]),\n    skills,\n    limits: limits(options.limits ?? {}),\n    toolExecution: toolExecution(options.toolExecution ?? {}),\n    hooks: harnessHooks([\n      ...(profile?.hooks?.outpost ?? []),\n      ...harnessHooks(options.hooks),\n    ]),\n    ...(options.permissions ? { permissions: options.permissions } : {}),\n    ...(options.context ? { context: options.context } : {}),\n    ...(options.conversations === undefined\n      ? {}\n      : { conversations: options.conversations }),\n    cache: options.cache ?? HARNESS_DEFAULTS.cache,\n    ...(servers === undefined\n      ? {}\n      : { mcpServers: harnessMcpServers(servers) }),\n  });\n}\n\nfunction limits(value: HarnessLimits): ResolvedHarnessLimits {\n  invariant(\n    value !== null && typeof value === \"object\",\n    \"Harness limits must be an object\",\n  );\n  if (value.maxDelegationDepth !== undefined)\n    invariant(\n      Number.isSafeInteger(value.maxDelegationDepth) &&\n        value.maxDelegationDepth >= 0,\n      \"Harness maxDelegationDepth must be a nonnegative integer\",\n    );\n  const maxSteps = positive(\n    value.maxSteps ?? HARNESS_DEFAULTS.maxSteps,\n    \"Harness maxSteps\",\n  );\n  if (value.maxToolCalls !== undefined)\n    positive(value.maxToolCalls, \"Harness maxToolCalls\");\n  if (value.usage !== undefined) {\n    invariant(\n      value.usage !== null &&\n        typeof value.usage === \"object\" &&\n        Object.keys(value.usage).every((key) => USAGE_FIELDS.includes(key)),\n      \"Harness usage limits accept input, cached, cacheCreated and output\",\n    );\n    for (const limit of Object.values(value.usage))\n      invariant(\n        Number.isSafeInteger(limit) && limit >= 0,\n        \"Harness usage limits must be nonnegative integers\",\n      );\n  }\n  return Object.freeze({\n    maxSteps,\n    ...(value.maxDelegationDepth === undefined\n      ? {}\n      : { maxDelegationDepth: value.maxDelegationDepth }),\n    ...(value.maxToolCalls === undefined\n      ? {}\n      : { maxToolCalls: value.maxToolCalls }),\n    ...(value.usage === undefined\n      ? {}\n      : { usage: Object.freeze({ ...value.usage }) }),\n  });\n}\n\nfunction toolExecution(\n  value: HarnessToolExecution,\n): Required<HarnessToolExecution> {\n  invariant(\n    value !== null && typeof value === \"object\",\n    \"Harness toolExecution must be an object\",\n  );\n  invariant(\n    value.onError === undefined ||\n      value.onError === \"return-to-model\" ||\n      value.onError === \"fail\",\n    'Tool onError must be \"return-to-model\" or \"fail\"',\n  );\n  return Object.freeze({\n    concurrency: positive(\n      value.concurrency ?? HARNESS_DEFAULTS.concurrency,\n      \"Tool concurrency\",\n    ),\n    deadlineMs: positive(\n      value.deadlineMs ?? HARNESS_DEFAULTS.toolDeadlineMs,\n      \"Tool deadlineMs\",\n    ),\n    onError: value.onError ?? HARNESS_DEFAULTS.onError,\n  });\n}\n\nfunction harnessMcpServers(value: unknown) {\n  const servers = mcpServers(value);\n  const logins = mcpLoginServers(servers).map(([name]) => name);\n  invariant(\n    logins.length === 0,\n    `The built-in harness cannot reuse a CLI OAuth login for MCP server ${logins.join(\", \")}`,\n  );\n  return servers;\n}\n"]}

package/dist/domain/hook-command.d.ts

@@ -0,0 +1,2 @@
+import type { HookCommand } from "./hook-command.types.ts";
+export declare function hookCommand(command: HookCommand): HookCommand;

package/dist/domain/hook-command.js

@@ -0,0 +1,26 @@
+import { invariant } from "./errors.js";
+export function hookCommand(command) {
+    invariant(command !== null && typeof command === "object", "Hook command must be an object");
+    invariant(Object.keys(command).every((key) => ["executable", "arguments", "directory", "variables"].includes(key)), "Unsupported hook command option");
+    invariant(typeof command.executable === "string" && command.executable.trim(), "Hook command requires an executable");
+    invariant(command.arguments === undefined ||
+        (Array.isArray(command.arguments) &&
+            command.arguments.every((value) => typeof value === "string")), "Hook command arguments must be strings");
+    invariant(command.directory === undefined ||
+        (typeof command.directory === "string" && command.directory.trim()), "Hook command directory must be nonempty text");
+    invariant(command.variables === undefined ||
+        (command.variables !== null &&
+            typeof command.variables === "object" &&
+            !Array.isArray(command.variables) &&
+            Object.values(command.variables).every((value) => typeof value === "string")), "Hook command variables must be strings");
+    return Object.freeze({
+        ...command,
+        ...(command.arguments
+            ? { arguments: Object.freeze([...command.arguments]) }
+            : {}),
+        ...(command.variables
+            ? { variables: Object.freeze({ ...command.variables }) }
+            : {}),
+    });
+}
+//# sourceMappingURL=hook-command.js.map

package/dist/domain/hook-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-command.js","sourceRoot":"","sources":["../../src/domain/hook-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,MAAM,UAAU,WAAW,CAAC,OAAoB;IAC9C,SAAS,CACP,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC/C,gCAAgC,CACjC,CAAC;IACF,SAAS,CACP,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACjC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CACpE,EACD,iCAAiC,CAClC,CAAC;IACF,SAAS,CACP,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EACnE,qCAAqC,CACtC,CAAC;IACF,SAAS,CACP,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;YAC/B,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,EAClE,wCAAwC,CACzC,CAAC;IACF,SAAS,CACP,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EACrE,8CAA8C,CAC/C,CAAC;IACF,SAAS,CACP,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI;YACzB,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;YACrC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CACpC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACrC,CAAC,EACN,wCAAwC,CACzC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,OAAO;QACV,GAAG,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { invariant } from \"./errors.ts\";\nimport type { HookCommand } from \"./hook-command.types.ts\";\n\nexport function hookCommand(command: HookCommand): HookCommand {\n  invariant(\n    command !== null && typeof command === \"object\",\n    \"Hook command must be an object\",\n  );\n  invariant(\n    Object.keys(command).every((key) =>\n      [\"executable\", \"arguments\", \"directory\", \"variables\"].includes(key),\n    ),\n    \"Unsupported hook command option\",\n  );\n  invariant(\n    typeof command.executable === \"string\" && command.executable.trim(),\n    \"Hook command requires an executable\",\n  );\n  invariant(\n    command.arguments === undefined ||\n      (Array.isArray(command.arguments) &&\n        command.arguments.every((value) => typeof value === \"string\")),\n    \"Hook command arguments must be strings\",\n  );\n  invariant(\n    command.directory === undefined ||\n      (typeof command.directory === \"string\" && command.directory.trim()),\n    \"Hook command directory must be nonempty text\",\n  );\n  invariant(\n    command.variables === undefined ||\n      (command.variables !== null &&\n        typeof command.variables === \"object\" &&\n        !Array.isArray(command.variables) &&\n        Object.values(command.variables).every(\n          (value) => typeof value === \"string\",\n        )),\n    \"Hook command variables must be strings\",\n  );\n  return Object.freeze({\n    ...command,\n    ...(command.arguments\n      ? { arguments: Object.freeze([...command.arguments]) }\n      : {}),\n    ...(command.variables\n      ? { variables: Object.freeze({ ...command.variables }) }\n      : {}),\n  });\n}\n"]}

package/dist/domain/hook-command.types.d.ts

@@ -0,0 +1,7 @@
+import type { Variables } from "./command.types.ts";
+export interface HookCommand {
+    readonly executable: string;
+    readonly arguments?: readonly string[];
+    readonly directory?: string;
+    readonly variables?: Variables;
+}

package/dist/domain/hook-command.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=hook-command.types.js.map

package/dist/domain/hook-command.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-command.types.js","sourceRoot":"","sources":["../../src/domain/hook-command.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Variables } from \"./command.types.ts\";\n\nexport interface HookCommand {\n  readonly executable: string;\n  readonly arguments?: readonly string[];\n  readonly directory?: string;\n  readonly variables?: Variables;\n}\n"]}

package/dist/domain/hook-decision.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessHookPhase, HarnessHookResult } from "./hook.types.ts";
+export declare function validateHookDecision<Phase extends HarnessHookPhase>(phase: Phase, value: unknown): asserts value is HarnessHookResult<Phase>;

package/dist/domain/hook-decision.js

@@ -0,0 +1,38 @@
+import { HOOK_DECISION_FIELDS } from "./hook.constants.js";
+import { invariant } from "./errors.js";
+export function validateHookDecision(phase, value) {
+    if (value === undefined)
+        return;
+    const allowed = HOOK_DECISION_FIELDS[phase];
+    invariant(value !== null && typeof value === "object" && !Array.isArray(value), phase === "before-tool"
+        ? "before-tool hooks may return { deny } or { input }"
+        : `${phase} hooks must return an object or nothing`);
+    const keys = Object.keys(value);
+    invariant(keys.length > 0 && keys.every((key) => allowed.includes(key)), `${phase} hooks ${phase === "before-tool" ? "may return" : "may only return"} ${allowed.map((key) => `{ ${key} }`).join(" or ") || "nothing"}`);
+    invariant(phase === "before-model" || keys.length === 1, `${phase} hooks must return exactly one decision`);
+    for (const key of keys) {
+        const field = Reflect.get(value, key);
+        if (["instructions", "prompt", "system", "deny", "continue", "text"].includes(key)) {
+            invariant(typeof field === "string", `${phase} ${key} must be text`);
+            if (key === "deny" || key === "continue")
+                invariant(field.trim() !== "", key === "deny"
+                    ? `${phase} deny reasons must be nonempty text`
+                    : `${phase} hooks may only return { ${key} } with nonempty text`);
+        }
+        if (key === "messages")
+            invariant(Array.isArray(field), `${phase} messages must be an array`);
+        if (key === "result") {
+            if (phase === "after-tool" && typeof field === "string")
+                continue;
+            invariant(field !== null && typeof field === "object" && !Array.isArray(field), `${phase} result must be an object`);
+            const resultKeys = phase === "after-model" ? ["text", "content"] : ["content", "isError"];
+            invariant(Object.keys(field).every((name) => resultKeys.includes(name)), `${phase} result contains unsupported fields`);
+            invariant(typeof Reflect.get(field, phase === "after-model" ? "text" : "content") === "string", `${phase} result must contain text`);
+            if (phase === "after-model" && Reflect.has(field, "content"))
+                invariant(Array.isArray(Reflect.get(field, "content")), "after-model result content must be an array");
+            if (phase === "after-tool" && Reflect.has(field, "isError"))
+                invariant(typeof Reflect.get(field, "isError") === "boolean", "after-tool result isError must be boolean");
+        }
+    }
+}
+//# sourceMappingURL=hook-decision.js.map

package/dist/domain/hook-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-decision.js","sourceRoot":"","sources":["../../src/domain/hook-decision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,MAAM,UAAU,oBAAoB,CAClC,KAAY,EACZ,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,SAAS,CACP,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACpE,KAAK,KAAK,aAAa;QACrB,CAAC,CAAC,oDAAoD;QACtD,CAAC,CAAC,GAAG,KAAK,yCAAyC,CACtD,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,SAAS,CACP,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC7D,GAAG,KAAK,UAAU,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,SAAS,EAAE,CAC/I,CAAC;IACF,SAAS,CACP,KAAK,KAAK,cAAc,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAC7C,GAAG,KAAK,yCAAyC,CAClD,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/C,IACE,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CACvE,GAAG,CACJ,EACD,CAAC;YACD,SAAS,CAAC,OAAO,KAAK,KAAK,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,eAAe,CAAC,CAAC;YACrE,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,UAAU;gBACtC,SAAS,CACP,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EACnB,GAAG,KAAK,MAAM;oBACZ,CAAC,CAAC,GAAG,KAAK,qCAAqC;oBAC/C,CAAC,CAAC,GAAG,KAAK,4BAA4B,GAAG,uBAAuB,CACnE,CAAC;QACN,CAAC;QACD,IAAI,GAAG,KAAK,UAAU;YACpB,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,4BAA4B,CAAC,CAAC;QACxE,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,IAAI,KAAK,KAAK,YAAY,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAClE,SAAS,CACP,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACpE,GAAG,KAAK,2BAA2B,CACpC,CAAC;YACF,MAAM,UAAU,GACd,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACzE,SAAS,CACP,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAC7D,GAAG,KAAK,qCAAqC,CAC9C,CAAC;YACF,SAAS,CACP,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,EACL,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAC7C,KAAK,QAAQ,EACd,GAAG,KAAK,2BAA2B,CACpC,CAAC;YACF,IAAI,KAAK,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC;gBAC1D,SAAS,CACP,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAC5C,6CAA6C,CAC9C,CAAC;YACJ,IAAI,KAAK,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC;gBACzD,SAAS,CACP,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,SAAS,EAClD,2CAA2C,CAC5C,CAAC;QACN,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { HOOK_DECISION_FIELDS } from \"./hook.constants.ts\";\nimport { invariant } from \"./errors.ts\";\nimport type { HarnessHookPhase, HarnessHookResult } from \"./hook.types.ts\";\n\nexport function validateHookDecision<Phase extends HarnessHookPhase>(\n  phase: Phase,\n  value: unknown,\n): asserts value is HarnessHookResult<Phase> {\n  if (value === undefined) return;\n  const allowed = HOOK_DECISION_FIELDS[phase];\n  invariant(\n    value !== null && typeof value === \"object\" && !Array.isArray(value),\n    phase === \"before-tool\"\n      ? \"before-tool hooks may return { deny } or { input }\"\n      : `${phase} hooks must return an object or nothing`,\n  );\n  const keys = Object.keys(value);\n  invariant(\n    keys.length > 0 && keys.every((key) => allowed.includes(key)),\n    `${phase} hooks ${phase === \"before-tool\" ? \"may return\" : \"may only return\"} ${allowed.map((key) => `{ ${key} }`).join(\" or \") || \"nothing\"}`,\n  );\n  invariant(\n    phase === \"before-model\" || keys.length === 1,\n    `${phase} hooks must return exactly one decision`,\n  );\n  for (const key of keys) {\n    const field: unknown = Reflect.get(value, key);\n    if (\n      [\"instructions\", \"prompt\", \"system\", \"deny\", \"continue\", \"text\"].includes(\n        key,\n      )\n    ) {\n      invariant(typeof field === \"string\", `${phase} ${key} must be text`);\n      if (key === \"deny\" || key === \"continue\")\n        invariant(\n          field.trim() !== \"\",\n          key === \"deny\"\n            ? `${phase} deny reasons must be nonempty text`\n            : `${phase} hooks may only return { ${key} } with nonempty text`,\n        );\n    }\n    if (key === \"messages\")\n      invariant(Array.isArray(field), `${phase} messages must be an array`);\n    if (key === \"result\") {\n      if (phase === \"after-tool\" && typeof field === \"string\") continue;\n      invariant(\n        field !== null && typeof field === \"object\" && !Array.isArray(field),\n        `${phase} result must be an object`,\n      );\n      const resultKeys =\n        phase === \"after-model\" ? [\"text\", \"content\"] : [\"content\", \"isError\"];\n      invariant(\n        Object.keys(field).every((name) => resultKeys.includes(name)),\n        `${phase} result contains unsupported fields`,\n      );\n      invariant(\n        typeof Reflect.get(\n          field,\n          phase === \"after-model\" ? \"text\" : \"content\",\n        ) === \"string\",\n        `${phase} result must contain text`,\n      );\n      if (phase === \"after-model\" && Reflect.has(field, \"content\"))\n        invariant(\n          Array.isArray(Reflect.get(field, \"content\")),\n          \"after-model result content must be an array\",\n        );\n      if (phase === \"after-tool\" && Reflect.has(field, \"isError\"))\n        invariant(\n          typeof Reflect.get(field, \"isError\") === \"boolean\",\n          \"after-tool result isError must be boolean\",\n        );\n    }\n  }\n}\n"]}

package/dist/domain/hook.constants.d.ts

@@ -1,3 +1,6 @@
 import type { HarnessHookPhase } from "./hook.types.ts";
 export declare const HOOK_PHASES: ReadonlySet<HarnessHookPhase>;
 export declare const HOOK_FIELDS: ReadonlySet<string>;
+export declare const HOOK_TIMEOUT_MS = 30000;
+export declare const HOOK_OUTPUT_BYTES = 1048576;
+export declare const HOOK_DECISION_FIELDS: Readonly<Record<HarnessHookPhase, readonly string[]>>;

package/dist/domain/hook.constants.js

@@ -4,7 +4,37 @@ export const HOOK_PHASES = new Set([
     "after-model",
     "before-tool",
     "after-tool",
+    "before-prompt",
+    "model-error",
+    "before-compaction",
+    "after-compaction",
+    "before-subagent",
+    "after-subagent",
+    "run-end",
     "stop",
 ]);
-export const HOOK_FIELDS = new Set(["on", "name", "run"]);
+export const HOOK_FIELDS = new Set([
+    "on",
+    "name",
+    "run",
+    "command",
+    "timeoutMs",
+]);
+export const HOOK_TIMEOUT_MS = 30_000;
+export const HOOK_OUTPUT_BYTES = 1_048_576;
+export const HOOK_DECISION_FIELDS = {
+    "session-start": ["instructions"],
+    "before-prompt": ["prompt", "deny"],
+    "before-model": ["messages", "system"],
+    "after-model": ["result"],
+    "before-tool": ["deny", "input"],
+    "after-tool": ["result"],
+    stop: ["continue"],
+    "before-compaction": ["messages"],
+    "after-compaction": ["messages"],
+    "before-subagent": ["prompt", "deny"],
+    "after-subagent": ["text"],
+    "model-error": [],
+    "run-end": [],
+};
 //# sourceMappingURL=hook.constants.js.map

package/dist/domain/hook.constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook.constants.js","sourceRoot":"","sources":["../../src/domain/hook.constants.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,WAAW,GAAkC,IAAI,GAAG,CAAC;IAChE,eAAe;IACf,cAAc;IACd,aAAa;IACb,aAAa;IACb,YAAY;IACZ,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC","sourcesContent":["import type { HarnessHookPhase } from \"./hook.types.ts\";\n\nexport const HOOK_PHASES: ReadonlySet<HarnessHookPhase> = new Set([\n  \"session-start\",\n  \"before-model\",\n  \"after-model\",\n  \"before-tool\",\n  \"after-tool\",\n  \"stop\",\n]);\n\nexport const HOOK_FIELDS: ReadonlySet<string> = new Set([\"on\", \"name\", \"run\"]);\n"]}
+{"version":3,"file":"hook.constants.js","sourceRoot":"","sources":["../../src/domain/hook.constants.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,WAAW,GAAkC,IAAI,GAAG,CAAC;IAChE,eAAe;IACf,cAAc;IACd,aAAa;IACb,aAAa;IACb,YAAY;IACZ,eAAe;IACf,aAAa;IACb,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,SAAS;IACT,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IACtD,IAAI;IACJ,MAAM;IACN,KAAK;IACL,SAAS;IACT,WAAW;CACZ,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAE3C,MAAM,CAAC,MAAM,oBAAoB,GAE7B;IACF,eAAe,EAAE,CAAC,cAAc,CAAC;IACjC,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;IACnC,cAAc,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtC,aAAa,EAAE,CAAC,QAAQ,CAAC;IACzB,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;IAChC,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,IAAI,EAAE,CAAC,UAAU,CAAC;IAClB,mBAAmB,EAAE,CAAC,UAAU,CAAC;IACjC,kBAAkB,EAAE,CAAC,UAAU,CAAC;IAChC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;IACrC,gBAAgB,EAAE,CAAC,MAAM,CAAC;IAC1B,aAAa,EAAE,EAAE;IACjB,SAAS,EAAE,EAAE;CACd,CAAC","sourcesContent":["import type { HarnessHookPhase } from \"./hook.types.ts\";\n\nexport const HOOK_PHASES: ReadonlySet<HarnessHookPhase> = new Set([\n  \"session-start\",\n  \"before-model\",\n  \"after-model\",\n  \"before-tool\",\n  \"after-tool\",\n  \"before-prompt\",\n  \"model-error\",\n  \"before-compaction\",\n  \"after-compaction\",\n  \"before-subagent\",\n  \"after-subagent\",\n  \"run-end\",\n  \"stop\",\n]);\n\nexport const HOOK_FIELDS: ReadonlySet<string> = new Set([\n  \"on\",\n  \"name\",\n  \"run\",\n  \"command\",\n  \"timeoutMs\",\n]);\nexport const HOOK_TIMEOUT_MS = 30_000;\nexport const HOOK_OUTPUT_BYTES = 1_048_576;\n\nexport const HOOK_DECISION_FIELDS: Readonly<\n  Record<HarnessHookPhase, readonly string[]>\n> = {\n  \"session-start\": [\"instructions\"],\n  \"before-prompt\": [\"prompt\", \"deny\"],\n  \"before-model\": [\"messages\", \"system\"],\n  \"after-model\": [\"result\"],\n  \"before-tool\": [\"deny\", \"input\"],\n  \"after-tool\": [\"result\"],\n  stop: [\"continue\"],\n  \"before-compaction\": [\"messages\"],\n  \"after-compaction\": [\"messages\"],\n  \"before-subagent\": [\"prompt\", \"deny\"],\n  \"after-subagent\": [\"text\"],\n  \"model-error\": [],\n  \"run-end\": [],\n};\n"]}

package/dist/domain/hook.js

@@ -1,17 +1,55 @@
-import { invariant } from "./errors.js";
-import { HOOK_FIELDS, HOOK_PHASES } from "./hook.constants.js";
+import { hookCommand } from "./hook-command.js";
+import { invariant, OutpostError, positive } from "./errors.js";
+import { HOOK_FIELDS, HOOK_PHASES, HOOK_OUTPUT_BYTES, HOOK_TIMEOUT_MS, } from "./hook.constants.js";
+import { validateHookDecision } from "./hook-decision.js";
 export function defineHarnessHook(options) {
     invariant(options !== null && typeof options === "object", "Hook options must be an object");
     invariant(Object.keys(options).every((key) => HOOK_FIELDS.has(key)), "Unsupported hook option");
     invariant(HOOK_PHASES.has(options.on), `Hook phase must be one of ${[...HOOK_PHASES].join(", ")}`);
-    invariant(typeof options.run === "function", "Hook run must be a function");
+    if (options.command === undefined)
+        invariant(typeof options.run === "function", "Hook run must be a function");
+    invariant((typeof options.run === "function") !== (options.command !== undefined), "Hook requires exactly one of run or command");
+    const command = options.command === undefined ? undefined : hookCommand(options.command);
+    const callback = options.run;
+    const phase = options.on;
+    const name = options.name ?? phase;
+    const timeoutMs = positive(options.timeoutMs ?? HOOK_TIMEOUT_MS, "Hook timeoutMs");
     invariant(options.name === undefined ||
         (typeof options.name === "string" && options.name.trim()), "Hook name must be nonempty text");
     return Object.freeze({
         kind: "hook",
         on: options.on,
         name: options.name ?? options.on,
-        run: (input) => options.run(input),
+        timeoutMs,
+        async run(input) {
+            if (callback)
+                return callback(input);
+            const { sandbox, signal, ...event } = input;
+            let bytes = 0;
+            const encoder = new TextEncoder();
+            const result = await sandbox.invoke({
+                ...command,
+                stdin: JSON.stringify(event, (_key, value) => value instanceof Error
+                    ? { name: value.name, message: value.message }
+                    : value),
+                signal,
+                deadlineMs: timeoutMs,
+                retain: HOOK_OUTPUT_BYTES + 1,
+                observe(channel, chunk) {
+                    if (channel === "stdout")
+                        bytes += encoder.encode(chunk).byteLength;
+                },
+            });
+            if (result.status !== 0)
+                throw new OutpostError("process", `Hook ${name} exited with status ${result.status}`);
+            invariant(Math.max(bytes, encoder.encode(result.stdout).byteLength) <=
+                HOOK_OUTPUT_BYTES, "Hook output exceeds its size limit");
+            const decision = result.stdout.trim()
+                ? JSON.parse(result.stdout)
+                : undefined;
+            validateHookDecision(phase, decision);
+            return decision;
+        },
     });
 }
 export function harnessHooks(hooks) {
@@ -19,7 +57,13 @@ export function harnessHooks(hooks) {
         return [];
     invariant(Array.isArray(hooks), "Hooks must be an array");
     for (const hook of hooks)
-        invariant(hook?.kind === "hook", "Declare hooks with defineHarnessHook");
+        invariant(hook?.kind === "hook" &&
+            typeof hook.run === "function" &&
+            HOOK_PHASES.has(hook.on) &&
+            typeof hook.name === "string" &&
+            hook.name.trim().length > 0 &&
+            (hook.timeoutMs === undefined ||
+                (Number.isFinite(hook.timeoutMs) && hook.timeoutMs > 0)), "Declare hooks with defineHarnessHook");
     return Object.freeze([...hooks]);
 }
 //# sourceMappingURL=hook.js.map

package/dist/domain/hook.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/domain/hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAQ/D,MAAM,UAAU,iBAAiB,CAC/B,OAAkC;IAElC,SAAS,CACP,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC/C,gCAAgC,CACjC,CAAC;IACF,SAAS,CACP,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACzD,yBAAyB,CAC1B,CAAC;IACF,SAAS,CACP,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAC3B,6BAA6B,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3D,CAAC;IACF,SAAS,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,EAAE,6BAA6B,CAAC,CAAC;IAC5E,SAAS,CACP,OAAO,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE;QAChC,GAAG,EAAE,CAAC,KAA8B,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAyC;IAEzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK;QACtB,SAAS,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,EAAE,sCAAsC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import { invariant } from \"./errors.ts\";\nimport { HOOK_FIELDS, HOOK_PHASES } from \"./hook.constants.ts\";\nimport type {\n  HarnessHook,\n  HarnessHookInput,\n  HarnessHookOptions,\n  HarnessHookPhase,\n} from \"./hook.types.ts\";\n\nexport function defineHarnessHook<Phase extends HarnessHookPhase>(\n  options: HarnessHookOptions<Phase>,\n): HarnessHook<Phase> {\n  invariant(\n    options !== null && typeof options === \"object\",\n    \"Hook options must be an object\",\n  );\n  invariant(\n    Object.keys(options).every((key) => HOOK_FIELDS.has(key)),\n    \"Unsupported hook option\",\n  );\n  invariant(\n    HOOK_PHASES.has(options.on),\n    `Hook phase must be one of ${[...HOOK_PHASES].join(\", \")}`,\n  );\n  invariant(typeof options.run === \"function\", \"Hook run must be a function\");\n  invariant(\n    options.name === undefined ||\n      (typeof options.name === \"string\" && options.name.trim()),\n    \"Hook name must be nonempty text\",\n  );\n  return Object.freeze({\n    kind: \"hook\",\n    on: options.on,\n    name: options.name ?? options.on,\n    run: (input: HarnessHookInput<Phase>) => options.run(input),\n  });\n}\n\nexport function harnessHooks(\n  hooks: readonly HarnessHook[] | undefined,\n): readonly HarnessHook[] {\n  if (hooks === undefined) return [];\n  invariant(Array.isArray(hooks), \"Hooks must be an array\");\n  for (const hook of hooks)\n    invariant(hook?.kind === \"hook\", \"Declare hooks with defineHarnessHook\");\n  return Object.freeze([...hooks]);\n}\n"]}
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/domain/hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EACL,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAQ1D,MAAM,UAAU,iBAAiB,CAC/B,OAAkC;IAElC,SAAS,CACP,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC/C,gCAAgC,CACjC,CAAC;IACF,SAAS,CACP,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACzD,yBAAyB,CAC1B,CAAC;IACF,SAAS,CACP,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAC3B,6BAA6B,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3D,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAC/B,SAAS,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,EAAE,6BAA6B,CAAC,CAAC;IAC9E,SAAS,CACP,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EACvE,6CAA6C,CAC9C,CAAC;IACF,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;IACnC,MAAM,SAAS,GAAG,QAAQ,CACxB,OAAO,CAAC,SAAS,IAAI,eAAe,EACpC,gBAAgB,CACjB,CAAC;IACF,SAAS,CACP,OAAO,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE;QAChC,SAAS;QACT,KAAK,CAAC,GAAG,CAAC,KAA8B;YACtC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC;YAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;gBAClC,GAAG,OAAQ;gBACX,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE,CACpD,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;oBAC9C,CAAC,CAAC,KAAK,CACV;gBACD,MAAM;gBACN,UAAU,EAAE,SAAS;gBACrB,MAAM,EAAE,iBAAiB,GAAG,CAAC;gBAC7B,OAAO,CAAC,OAAO,EAAE,KAAK;oBACpB,IAAI,OAAO,KAAK,QAAQ;wBAAE,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;gBACtE,CAAC;aACF,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBACrB,MAAM,IAAI,YAAY,CACpB,SAAS,EACT,QAAQ,IAAI,uBAAuB,MAAM,CAAC,MAAM,EAAE,CACnD,CAAC;YACJ,SAAS,CACP,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC;gBACvD,iBAAiB,EACnB,oCAAoC,CACrC,CAAC;YACF,MAAM,QAAQ,GAAY,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC5C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC3B,CAAC,CAAC,SAAS,CAAC;YACd,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAyC;IAEzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK;QACtB,SAAS,CACP,IAAI,EAAE,IAAI,KAAK,MAAM;YACnB,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU;YAC9B,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC3B,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;gBAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAC5D,sCAAsC,CACvC,CAAC;IACJ,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import { hookCommand } from \"./hook-command.ts\";\nimport { invariant, OutpostError, positive } from \"./errors.ts\";\nimport {\n  HOOK_FIELDS,\n  HOOK_PHASES,\n  HOOK_OUTPUT_BYTES,\n  HOOK_TIMEOUT_MS,\n} from \"./hook.constants.ts\";\nimport { validateHookDecision } from \"./hook-decision.ts\";\nimport type {\n  HarnessHook,\n  HarnessHookInput,\n  HarnessHookOptions,\n  HarnessHookPhase,\n} from \"./hook.types.ts\";\n\nexport function defineHarnessHook<Phase extends HarnessHookPhase>(\n  options: HarnessHookOptions<Phase>,\n): HarnessHook<Phase> {\n  invariant(\n    options !== null && typeof options === \"object\",\n    \"Hook options must be an object\",\n  );\n  invariant(\n    Object.keys(options).every((key) => HOOK_FIELDS.has(key)),\n    \"Unsupported hook option\",\n  );\n  invariant(\n    HOOK_PHASES.has(options.on),\n    `Hook phase must be one of ${[...HOOK_PHASES].join(\", \")}`,\n  );\n  if (options.command === undefined)\n    invariant(typeof options.run === \"function\", \"Hook run must be a function\");\n  invariant(\n    (typeof options.run === \"function\") !== (options.command !== undefined),\n    \"Hook requires exactly one of run or command\",\n  );\n  const command =\n    options.command === undefined ? undefined : hookCommand(options.command);\n  const callback = options.run;\n  const phase = options.on;\n  const name = options.name ?? phase;\n  const timeoutMs = positive(\n    options.timeoutMs ?? HOOK_TIMEOUT_MS,\n    \"Hook timeoutMs\",\n  );\n  invariant(\n    options.name === undefined ||\n      (typeof options.name === \"string\" && options.name.trim()),\n    \"Hook name must be nonempty text\",\n  );\n  return Object.freeze({\n    kind: \"hook\",\n    on: options.on,\n    name: options.name ?? options.on,\n    timeoutMs,\n    async run(input: HarnessHookInput<Phase>) {\n      if (callback) return callback(input);\n      const { sandbox, signal, ...event } = input;\n      let bytes = 0;\n      const encoder = new TextEncoder();\n      const result = await sandbox.invoke({\n        ...command!,\n        stdin: JSON.stringify(event, (_key, value: unknown) =>\n          value instanceof Error\n            ? { name: value.name, message: value.message }\n            : value,\n        ),\n        signal,\n        deadlineMs: timeoutMs,\n        retain: HOOK_OUTPUT_BYTES + 1,\n        observe(channel, chunk) {\n          if (channel === \"stdout\") bytes += encoder.encode(chunk).byteLength;\n        },\n      });\n      if (result.status !== 0)\n        throw new OutpostError(\n          \"process\",\n          `Hook ${name} exited with status ${result.status}`,\n        );\n      invariant(\n        Math.max(bytes, encoder.encode(result.stdout).byteLength) <=\n          HOOK_OUTPUT_BYTES,\n        \"Hook output exceeds its size limit\",\n      );\n      const decision: unknown = result.stdout.trim()\n        ? JSON.parse(result.stdout)\n        : undefined;\n      validateHookDecision(phase, decision);\n      return decision;\n    },\n  });\n}\n\nexport function harnessHooks(\n  hooks: readonly HarnessHook[] | undefined,\n): readonly HarnessHook[] {\n  if (hooks === undefined) return [];\n  invariant(Array.isArray(hooks), \"Hooks must be an array\");\n  for (const hook of hooks)\n    invariant(\n      hook?.kind === \"hook\" &&\n        typeof hook.run === \"function\" &&\n        HOOK_PHASES.has(hook.on) &&\n        typeof hook.name === \"string\" &&\n        hook.name.trim().length > 0 &&\n        (hook.timeoutMs === undefined ||\n          (Number.isFinite(hook.timeoutMs) && hook.timeoutMs > 0)),\n      \"Declare hooks with defineHarnessHook\",\n    );\n  return Object.freeze([...hooks]);\n}\n"]}

package/dist/domain/hook.types.d.ts

@@ -1,12 +1,16 @@
 import type { AgentModel, ModelMessage, ModelResult, ModelToolCallBlock } from "./model.types.ts";
 import type { SandboxLease } from "./sandbox.types.ts";
 import type { ToolOutput } from "./tool.types.ts";
-export type HarnessHookPhase = "session-start" | "before-model" | "after-model" | "before-tool" | "after-tool" | "stop";
+import type { HookCommand } from "./hook-command.types.ts";
+export type HarnessHookPhase = "session-start" | "before-model" | "after-model" | "before-tool" | "after-tool" | "before-prompt" | "model-error" | "before-compaction" | "after-compaction" | "before-subagent" | "after-subagent" | "run-end" | "stop";
 export interface HarnessHookContext {
     readonly sandbox: SandboxLease;
     readonly signal: AbortSignal;
     readonly model: AgentModel;
     readonly step: number;
+    readonly conversation?: string;
+    readonly subagentId?: string;
+    readonly depth?: number;
 }
 export interface HarnessToolResultView {
     readonly content: string;
@@ -15,19 +19,56 @@ export interface HarnessToolResultView {
 export interface HarnessHookEvents {
     readonly "session-start": {
         readonly prompt: string;
+        readonly source?: "start" | "resume" | "repair";
+    };
+    readonly "before-prompt": {
+        readonly prompt: string;
+        readonly source: "initial" | "steering";
     };
     readonly "before-model": {
         readonly messages: readonly ModelMessage[];
+        readonly system?: string;
     };
     readonly "after-model": {
         readonly result: ModelResult;
     };
+    readonly "model-error": {
+        readonly error: unknown;
+    };
+    readonly "before-compaction": {
+        readonly messages: readonly ModelMessage[];
+        readonly strategy: string;
+    };
+    readonly "after-compaction": {
+        readonly messages: readonly ModelMessage[];
+        readonly strategy: string;
+    };
+    readonly "before-subagent": {
+        readonly id: string;
+        readonly name: string;
+        readonly callId: string;
+        readonly prompt: string;
+    };
+    readonly "after-subagent": {
+        readonly id: string;
+        readonly name: string;
+        readonly callId: string;
+        readonly text?: string;
+        readonly error?: unknown;
+        readonly conversation?: string;
+    };
+    readonly "run-end": {
+        readonly reason: "success" | "error" | "aborted" | "timeout" | "limit";
+        readonly text?: string;
+        readonly error?: unknown;
+    };
     readonly "before-tool": {
         readonly call: ModelToolCallBlock;
     };
     readonly "after-tool": {
         readonly call: ModelToolCallBlock;
         readonly result: HarnessToolResultView;
+        readonly status?: "success" | "denied" | "error";
     };
     readonly stop: {
         readonly text: string;
@@ -37,8 +78,37 @@ export interface HarnessHookDecisions {
     readonly "session-start": {
         readonly instructions: string;
     };
-    readonly "before-model": never;
-    readonly "after-model": never;
+    readonly "before-prompt": {
+        readonly prompt: string;
+    } | {
+        readonly deny: string;
+    };
+    readonly "before-model": {
+        readonly messages?: readonly ModelMessage[];
+        readonly system?: string;
+    };
+    readonly "after-model": {
+        readonly result: Pick<ModelResult, "text" | "content"> & {
+            readonly usage?: never;
+            readonly stopReason?: never;
+        };
+    };
+    readonly "model-error": never;
+    readonly "before-compaction": {
+        readonly messages: readonly ModelMessage[];
+    };
+    readonly "after-compaction": {
+        readonly messages: readonly ModelMessage[];
+    };
+    readonly "before-subagent": {
+        readonly prompt: string;
+    } | {
+        readonly deny: string;
+    };
+    readonly "after-subagent": {
+        readonly text: string;
+    };
+    readonly "run-end": never;
     readonly "before-tool": {
         readonly deny: string;
     } | {
@@ -53,14 +123,21 @@ export interface HarnessHookDecisions {
 }
 export type HarnessHookInput<Phase extends HarnessHookPhase> = HarnessHookEvents[Phase] & HarnessHookContext;
 export type HarnessHookResult<Phase extends HarnessHookPhase> = HarnessHookDecisions[Phase] | undefined | void;
-export interface HarnessHookOptions<Phase extends HarnessHookPhase> {
+export type HarnessHookOptions<Phase extends HarnessHookPhase> = {
     readonly on: Phase;
     readonly name?: string;
+    readonly timeoutMs?: number;
+} & ({
+    readonly command?: never;
     run(input: HarnessHookInput<Phase>): HarnessHookResult<Phase> | Promise<HarnessHookResult<Phase>>;
-}
+} | {
+    readonly command: HookCommand;
+    readonly run?: never;
+});
 export interface HarnessHook<Phase extends HarnessHookPhase = HarnessHookPhase> {
     readonly kind: "hook";
     readonly on: Phase;
     readonly name: string;
+    readonly timeoutMs?: number;
     run(input: HarnessHookInput<Phase>): HarnessHookResult<Phase> | Promise<HarnessHookResult<Phase>>;
 }

package/dist/domain/hook.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook.types.js","sourceRoot":"","sources":["../../src/domain/hook.types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AgentModel,\n  ModelMessage,\n  ModelResult,\n  ModelToolCallBlock,\n} from \"./model.types.ts\";\nimport type { SandboxLease } from \"./sandbox.types.ts\";\nimport type { ToolOutput } from \"./tool.types.ts\";\n\nexport type HarnessHookPhase =\n  | \"session-start\"\n  | \"before-model\"\n  | \"after-model\"\n  | \"before-tool\"\n  | \"after-tool\"\n  | \"stop\";\n\nexport interface HarnessHookContext {\n  readonly sandbox: SandboxLease;\n  readonly signal: AbortSignal;\n  readonly model: AgentModel;\n  readonly step: number;\n}\n\nexport interface HarnessToolResultView {\n  readonly content: string;\n  readonly isError: boolean;\n}\n\nexport interface HarnessHookEvents {\n  readonly \"session-start\": { readonly prompt: string };\n  readonly \"before-model\": { readonly messages: readonly ModelMessage[] };\n  readonly \"after-model\": { readonly result: ModelResult };\n  readonly \"before-tool\": { readonly call: ModelToolCallBlock };\n  readonly \"after-tool\": {\n    readonly call: ModelToolCallBlock;\n    readonly result: HarnessToolResultView;\n  };\n  readonly stop: { readonly text: string };\n}\n\nexport interface HarnessHookDecisions {\n  readonly \"session-start\": { readonly instructions: string };\n  readonly \"before-model\": never;\n  readonly \"after-model\": never;\n  readonly \"before-tool\":\n    { readonly deny: string } | { readonly input: unknown };\n  readonly \"after-tool\": { readonly result: ToolOutput };\n  readonly stop: { readonly continue: string };\n}\n\nexport type HarnessHookInput<Phase extends HarnessHookPhase> =\n  HarnessHookEvents[Phase] & HarnessHookContext;\n\nexport type HarnessHookResult<Phase extends HarnessHookPhase> =\n  HarnessHookDecisions[Phase] | undefined | void;\n\nexport interface HarnessHookOptions<Phase extends HarnessHookPhase> {\n  readonly on: Phase;\n  readonly name?: string;\n  run(\n    input: HarnessHookInput<Phase>,\n  ): HarnessHookResult<Phase> | Promise<HarnessHookResult<Phase>>;\n}\n\nexport interface HarnessHook<\n  Phase extends HarnessHookPhase = HarnessHookPhase,\n> {\n  readonly kind: \"hook\";\n  readonly on: Phase;\n  readonly name: string;\n  run(\n    input: HarnessHookInput<Phase>,\n  ): HarnessHookResult<Phase> | Promise<HarnessHookResult<Phase>>;\n}\n"]}
+{"version":3,"file":"hook.types.js","sourceRoot":"","sources":["../../src/domain/hook.types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AgentModel,\n  ModelMessage,\n  ModelResult,\n  ModelToolCallBlock,\n} from \"./model.types.ts\";\nimport type { SandboxLease } from \"./sandbox.types.ts\";\nimport type { ToolOutput } from \"./tool.types.ts\";\nimport type { HookCommand } from \"./hook-command.types.ts\";\n\nexport type HarnessHookPhase =\n  | \"session-start\"\n  | \"before-model\"\n  | \"after-model\"\n  | \"before-tool\"\n  | \"after-tool\"\n  | \"before-prompt\"\n  | \"model-error\"\n  | \"before-compaction\"\n  | \"after-compaction\"\n  | \"before-subagent\"\n  | \"after-subagent\"\n  | \"run-end\"\n  | \"stop\";\n\nexport interface HarnessHookContext {\n  readonly sandbox: SandboxLease;\n  readonly signal: AbortSignal;\n  readonly model: AgentModel;\n  readonly step: number;\n  readonly conversation?: string;\n  readonly subagentId?: string;\n  readonly depth?: number;\n}\n\nexport interface HarnessToolResultView {\n  readonly content: string;\n  readonly isError: boolean;\n}\n\nexport interface HarnessHookEvents {\n  readonly \"session-start\": {\n    readonly prompt: string;\n    readonly source?: \"start\" | \"resume\" | \"repair\";\n  };\n  readonly \"before-prompt\": {\n    readonly prompt: string;\n    readonly source: \"initial\" | \"steering\";\n  };\n  readonly \"before-model\": {\n    readonly messages: readonly ModelMessage[];\n    readonly system?: string;\n  };\n  readonly \"after-model\": { readonly result: ModelResult };\n  readonly \"model-error\": { readonly error: unknown };\n  readonly \"before-compaction\": {\n    readonly messages: readonly ModelMessage[];\n    readonly strategy: string;\n  };\n  readonly \"after-compaction\": {\n    readonly messages: readonly ModelMessage[];\n    readonly strategy: string;\n  };\n  readonly \"before-subagent\": {\n    readonly id: string;\n    readonly name: string;\n    readonly callId: string;\n    readonly prompt: string;\n  };\n  readonly \"after-subagent\": {\n    readonly id: string;\n    readonly name: string;\n    readonly callId: string;\n    readonly text?: string;\n    readonly error?: unknown;\n    readonly conversation?: string;\n  };\n  readonly \"run-end\": {\n    readonly reason: \"success\" | \"error\" | \"aborted\" | \"timeout\" | \"limit\";\n    readonly text?: string;\n    readonly error?: unknown;\n  };\n  readonly \"before-tool\": { readonly call: ModelToolCallBlock };\n  readonly \"after-tool\": {\n    readonly call: ModelToolCallBlock;\n    readonly result: HarnessToolResultView;\n    readonly status?: \"success\" | \"denied\" | \"error\";\n  };\n  readonly stop: { readonly text: string };\n}\n\nexport interface HarnessHookDecisions {\n  readonly \"session-start\": { readonly instructions: string };\n  readonly \"before-prompt\":\n    { readonly prompt: string } | { readonly deny: string };\n  readonly \"before-model\": {\n    readonly messages?: readonly ModelMessage[];\n    readonly system?: string;\n  };\n  readonly \"after-model\": {\n    readonly result: Pick<ModelResult, \"text\" | \"content\"> & {\n      readonly usage?: never;\n      readonly stopReason?: never;\n    };\n  };\n  readonly \"model-error\": never;\n  readonly \"before-compaction\": { readonly messages: readonly ModelMessage[] };\n  readonly \"after-compaction\": { readonly messages: readonly ModelMessage[] };\n  readonly \"before-subagent\":\n    { readonly prompt: string } | { readonly deny: string };\n  readonly \"after-subagent\": { readonly text: string };\n  readonly \"run-end\": never;\n  readonly \"before-tool\":\n    { readonly deny: string } | { readonly input: unknown };\n  readonly \"after-tool\": { readonly result: ToolOutput };\n  readonly stop: { readonly continue: string };\n}\n\nexport type HarnessHookInput<Phase extends HarnessHookPhase> =\n  HarnessHookEvents[Phase] & HarnessHookContext;\n\nexport type HarnessHookResult<Phase extends HarnessHookPhase> =\n  HarnessHookDecisions[Phase] | undefined | void;\n\nexport type HarnessHookOptions<Phase extends HarnessHookPhase> = {\n  readonly on: Phase;\n  readonly name?: string;\n  readonly timeoutMs?: number;\n} & (\n  | {\n      readonly command?: never;\n      run(\n        input: HarnessHookInput<Phase>,\n      ): HarnessHookResult<Phase> | Promise<HarnessHookResult<Phase>>;\n    }\n  | { readonly command: HookCommand; readonly run?: never }\n);\n\nexport interface HarnessHook<\n  Phase extends HarnessHookPhase = HarnessHookPhase,\n> {\n  readonly kind: \"hook\";\n  readonly on: Phase;\n  readonly name: string;\n  readonly timeoutMs?: number;\n  run(\n    input: HarnessHookInput<Phase>,\n  ): HarnessHookResult<Phase> | Promise<HarnessHookResult<Phase>>;\n}\n"]}

package/dist/domain/mcp-server.constants.d.ts

@@ -1,4 +1,10 @@
 export declare const MCP_SERVER_NAME_PATTERN: RegExp;
+export declare const MCP_CAPABILITY_TOOLS: Readonly<{
+    listResources: "mcp_list_resources";
+    readResource: "mcp_read_resource";
+    listPrompts: "mcp_list_prompts";
+    getPrompt: "mcp_get_prompt";
+}>;
 export declare const MCP_VARIABLE_PATTERN: RegExp;
 export declare const MCP_HEADER_PATTERN: RegExp;
 export declare const MCP_STDIO_FIELDS: ReadonlySet<string>;

package/dist/domain/mcp-server.constants.js

@@ -1,4 +1,10 @@
 export const MCP_SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]{1,32}$/;
+export const MCP_CAPABILITY_TOOLS = Object.freeze({
+    listResources: "mcp_list_resources",
+    readResource: "mcp_read_resource",
+    listPrompts: "mcp_list_prompts",
+    getPrompt: "mcp_get_prompt",
+});
 export const MCP_VARIABLE_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 export const MCP_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 export const MCP_STDIO_FIELDS = new Set([

package/dist/domain/mcp-server.constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.constants.js","sourceRoot":"","sources":["../../src/domain/mcp-server.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAE/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAElE,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,SAAS;IACT,WAAW;IACX,aAAa;IACb,WAAW;IACX,OAAO;IACP,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,KAAK;IACL,SAAS;IACT,qBAAqB;IACrB,OAAO;IACP,OAAO;IACP,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IACjE,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,kBAAkB;IAClB,sBAAsB;IACtB,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,6BAA6B,CAAC","sourcesContent":["export const MCP_SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]{1,32}$/;\n\nexport const MCP_VARIABLE_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\nexport const MCP_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;\n\nexport const MCP_STDIO_FIELDS: ReadonlySet<string> = new Set([\n  \"command\",\n  \"arguments\",\n  \"environment\",\n  \"variables\",\n  \"tools\",\n  \"startupTimeoutMs\",\n]);\n\nexport const MCP_HTTP_FIELDS: ReadonlySet<string> = new Set([\n  \"url\",\n  \"headers\",\n  \"bearerTokenVariable\",\n  \"oauth\",\n  \"tools\",\n  \"startupTimeoutMs\",\n]);\n\nexport const MCP_TOOL_FILTER_FIELDS: ReadonlySet<string> = new Set([\n  \"include\",\n  \"exclude\",\n]);\n\n// Kimi stores timeouts as 32-bit integers and Node timers overflow above this bound.\nexport const MCP_MAX_TIMEOUT_MS = 2_147_483_647;\n\nexport const MCP_TOOL_NAME_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;\n\nexport const MCP_URL_PROTOCOLS: ReadonlySet<string> = new Set([\n  \"http:\",\n  \"https:\",\n]);\n\nexport const MCP_CLIENT_CREDENTIAL_FIELDS: ReadonlySet<string> = new Set([\n  \"clientIdVariable\",\n  \"clientSecretVariable\",\n  \"scopes\",\n]);\n\nexport const MCP_SCOPE_PATTERN = /^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$/;\n"]}
+{"version":3,"file":"mcp-server.constants.js","sourceRoot":"","sources":["../../src/domain/mcp-server.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAE/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,aAAa,EAAE,oBAAoB;IACnC,YAAY,EAAE,mBAAmB;IACjC,WAAW,EAAE,kBAAkB;IAC/B,SAAS,EAAE,gBAAgB;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAElE,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,SAAS;IACT,WAAW;IACX,aAAa;IACb,WAAW;IACX,OAAO;IACP,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,KAAK;IACL,SAAS;IACT,qBAAqB;IACrB,OAAO;IACP,OAAO;IACP,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IACjE,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,kBAAkB;IAClB,sBAAsB;IACtB,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,6BAA6B,CAAC","sourcesContent":["export const MCP_SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]{1,32}$/;\n\nexport const MCP_CAPABILITY_TOOLS = Object.freeze({\n  listResources: \"mcp_list_resources\",\n  readResource: \"mcp_read_resource\",\n  listPrompts: \"mcp_list_prompts\",\n  getPrompt: \"mcp_get_prompt\",\n});\n\nexport const MCP_VARIABLE_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\nexport const MCP_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;\n\nexport const MCP_STDIO_FIELDS: ReadonlySet<string> = new Set([\n  \"command\",\n  \"arguments\",\n  \"environment\",\n  \"variables\",\n  \"tools\",\n  \"startupTimeoutMs\",\n]);\n\nexport const MCP_HTTP_FIELDS: ReadonlySet<string> = new Set([\n  \"url\",\n  \"headers\",\n  \"bearerTokenVariable\",\n  \"oauth\",\n  \"tools\",\n  \"startupTimeoutMs\",\n]);\n\nexport const MCP_TOOL_FILTER_FIELDS: ReadonlySet<string> = new Set([\n  \"include\",\n  \"exclude\",\n]);\n\n// Kimi stores timeouts as 32-bit integers and Node timers overflow above this bound.\nexport const MCP_MAX_TIMEOUT_MS = 2_147_483_647;\n\nexport const MCP_TOOL_NAME_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;\n\nexport const MCP_URL_PROTOCOLS: ReadonlySet<string> = new Set([\n  \"http:\",\n  \"https:\",\n]);\n\nexport const MCP_CLIENT_CREDENTIAL_FIELDS: ReadonlySet<string> = new Set([\n  \"clientIdVariable\",\n  \"clientSecretVariable\",\n  \"scopes\",\n]);\n\nexport const MCP_SCOPE_PATTERN = /^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$/;\n"]}