@hanamorilabs/tab 0.1.13 → 0.1.15

package/dist/cli.js

@@ -37,14 +37,15 @@ import { runPooled } from "./pool-run.js";
 import { renderPool } from "./pool-view.js";
 import { renderHelp } from "./help.js";
 import { findTabCommand } from "./tab-docs.js";
-import { ConsoleApiError, createAgent, issueAgentKey, listAgents } from "./console-api.js";
+import { ConsoleApiError, createAgent, issueAgentKey, listAgents, setAgentHarness } from "./console-api.js";
 import { consoleUrlFor, DeviceLoginError, startDeviceLogin, waitForApproval } from "./device-login.js";
 import { clearConfig, configDir, configPath, HOSTED_PROXY, isLocalProxy, loadConfig, LOCAL_PROXY, normalizeProxyUrl, presentedKey, saveConfig, } from "./config.js";
 import { reportFolder } from "./folder.js";
 import { whoami } from "./proxy-identity.js";
 import { listAliases, pathLine, pathWithoutShims, removeAlias, shimDir, shimDirOnPath, validAliasName, writeAlias } from "./alias.js";
 import * as manage from "./manage.js";
-import { agentNameFor, projectRoot, readProject, writeProject } from "./project.js";
+import { agentNameFor, assignProjectAgent, projectRoot, readProject } from "./project.js";
+import { HARNESSES, agentNameFor as harnessAgentName } from "./tab-docs-shared.js";
 import { downloadProxy, hasProxyEnv, packagedBinPath, proxyBinPath, proxyEnvPath, proxyInstalled, proxyLogPath, hasProxyLog, PROXY_VERSION, startProxy, stopProxy, tailProxyLog, writeProxyEnv, } from "./proxy-bin.js";
 import { proxyHealth, waitHealthy } from "./selfhost.js";
 import { TAB_VERSION } from "./version.js";
@@ -319,13 +320,23 @@ async function bringUp(proxyUrl) {
  * holds its key. Missing either: ask (or, with `.flocktab` present, mint the
  * key silently for this machine), save both, carry on.
  */
+/** `claude`, `codex`, `grok`, `kimi`, else `any`: the harness a command is. */
+function harnessOf(command) {
+    return HARNESSES.includes(command) && command !== "any" ? command : "any";
+}
+/**
+ * The Agent this folder runs `harness` as. One harness on one project is
+ * one Agent, so `tab claude` and `tab codex` in a folder are two Agents
+ * (that is what the plan counts), each asked for once.
+ */
 async function resolveAgent(config, opts = {}) {
     const agents = config.agents ?? {};
+    const harness = opts.harness ?? "any";
     // CI and scripts: FLOCKTAB_KEY is the Agent, no folder involved.
     if (agents.env && !opts.pick)
         return agents.env;
     const cwd = process.cwd();
-    const project = opts.pick ? undefined : await readProject(cwd);
+    const project = opts.pick ? undefined : await readProject(cwd, harness);
     if (project && agents[project.agent])
         return agents[project.agent];
     if (!config.token || !config.consoleUrl) {
@@ -351,14 +362,15 @@ async function resolveAgent(config, opts = {}) {
     }
     if (!chosen) {
         const root = await projectRoot(cwd);
-        const suggested = agentNameFor(root);
-        say(heading(`Which Agent does this folder run as?`));
-        say(dim(`${root}  ·  flock ${listed.flock.name}`));
-        const options = listed.agents;
+        const suggested = harnessAgentName(agentNameFor(root), harness);
+        say(heading(harness === "any" ? "Which Agent does this folder run as?" : `Which Agent does this folder run ${harness} as?`));
+        say(dim(`${root}  ·  flock ${listed.flock.name}${harness === "any" ? "" : `  ·  one harness per Agent: this one is for ${harness}`}`));
+        // Only Agents of this harness, plus untied ones (made before harnesses were told apart) that can be tied now.
+        const options = listed.agents.filter((a) => harness === "any" ? (a.harness ?? "any") === "any" : (a.harness ?? "any") === harness || (a.harness ?? "any") === "any");
         say(rows([
             ...options.map((a, i) => [
                 `${bold(String(i + 1))}  ${a.name}`,
-                `${a.state === "open" ? green("open") : yellow(a.state)}  ${a.kind === "subscription" ? yellow("subscription") : dim("api")}  ${dim(`$${(Number(a.capCents) / 100).toFixed(2)} cap`)}${agents[a.slug] ? dim("  keyed here") : a.hasKey ? dim("  keyed elsewhere") : ""}`,
+                `${a.state === "open" ? green("open") : yellow(a.state)}  ${a.kind === "subscription" ? yellow("subscription") : dim("api")}  ${dim(a.harness && a.harness !== "any" ? a.harness : "untied")}${a.kind === "api" ? dim(`  $${(Number(a.capCents) / 100).toFixed(2)} cap`) : ""}${agents[a.slug] ? dim("  keyed here") : a.hasKey ? dim("  keyed elsewhere") : ""}`,
             ]),
             [`${bold("n")}  New Agent`, dim(`named ${suggested}, $50.00 cap`)],
         ]));
@@ -370,7 +382,7 @@ async function resolveAgent(config, opts = {}) {
                 [`${bold("2")}  Subscription`, dim("your own Claude Max / ChatGPT / SuperGrok / Kimi logins; gated and recorded, never charged")],
             ]));
             const which = await ask(`Which kind? ${bold("1")} or ${bold("2")} ${dim("[1]")}: `);
-            created = { name, kind: which.trim() === "2" ? "subscription" : "api" };
+            created = { name, kind: which.trim() === "2" ? "subscription" : "api", harness };
         }
         else {
             const index = Number.parseInt(answer, 10);
@@ -384,8 +396,8 @@ async function resolveAgent(config, opts = {}) {
     let issued;
     try {
         if (created) {
-            issued = await createAgent(config.consoleUrl, config.token, { name: created.name, kind: created.kind });
-            ok(`Created ${created.kind === "subscription" ? "subscription" : "API-key"} Agent ${bold(issued.agent.name)} with a $50.00 cap. Change it in the console.`);
+            issued = await createAgent(config.consoleUrl, config.token, { name: created.name, kind: created.kind, harness: created.harness });
+            ok(`Created ${created.kind === "subscription" ? "subscription" : "API-key"} ${created.harness === "any" ? "" : `${created.harness} `}Agent ${bold(issued.agent.name)}${created.kind === "api" ? " with a $50.00 cap. Change it in the console." : "."}`);
         }
         else if (chosen) {
             if (chosen.hasKey && !agents[chosen.slug]) {
@@ -395,6 +407,11 @@ async function resolveAgent(config, opts = {}) {
                     return undefined;
             }
             issued = await issueAgentKey(config.consoleUrl, config.token, chosen.id);
+            // An untied Agent chosen for a harness is tied to it from now on, so the proxies enforce it.
+            if (harness !== "any" && (chosen.harness ?? "any") === "any") {
+                await setAgentHarness(config.consoleUrl, config.token, chosen.slug, harness);
+                say(dim(`${chosen.name} is now a ${harness} Agent.`));
+            }
         }
         else {
             return undefined;
@@ -415,8 +432,8 @@ async function resolveAgent(config, opts = {}) {
     config.agents = next.agents ?? {};
     if (next.unlock)
         config.unlock = next.unlock;
-    const file = await writeProject(await projectRoot(cwd), { agent: issued.agent.slug });
-    ok(`This folder runs as ${bold(issued.agent.name)} ${dim(`(${file})`)}`);
+    const file = await assignProjectAgent(await projectRoot(cwd), harness, issued.agent.slug);
+    ok(`This folder runs ${harness === "any" ? "" : `${harness} `}as ${bold(issued.agent.name)} ${dim(`(${file})`)}`);
     return login;
 }
 /** `tab version`: this CLI, and the proxy it would run (packaged, downloaded, or neither). */
@@ -558,7 +575,7 @@ async function runAgent(name, argv) {
     // Hosted whoami below proves readiness and current Agent kind in one round trip.
     if (config.mode === "self-hosted" && !(await ensureProxy(config)))
         return 1;
-    const agent = await resolveAgent(config);
+    const agent = await resolveAgent(config, { harness: harnessOf(name) });
     if (!agent)
         return 1;
     // The Agent's kind decides: a subscription Agent's harness brings its own
@@ -770,7 +787,7 @@ async function poolCommand(argv) {
             say(dim(`Signing ${harness} in for ${memberName}. Your browser opens; pick the account for this login.`));
             // Plain launch: no proxy, no tab key. This only creates the login, in the harness's own store.
             const loginEnv = { ...process.env, ...memberEnv(vendor, member), PATH: pathWithoutShims() };
-            for (const k of ["ANTHROPIC_BASE_URL", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "OPENAI_BASE_URL", "OPENAI_API_KEY", "XAI_API_KEY", "GROK_XAI_API_BASE_URL", "KIMI_API_KEY", "KIMI_BASE_URL", "KIMI_CODE_BASE_URL"])
+            for (const k of ["ANTHROPIC_BASE_URL", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "OPENAI_BASE_URL", "OPENAI_API_KEY", "XAI_API_KEY", "GROK_XAI_API_BASE_URL", "GROK_CLI_CHAT_PROXY_BASE_URL", "KIMI_API_KEY", "KIMI_BASE_URL", "KIMI_CODE_BASE_URL"])
                 delete loginEnv[k];
             const run = (argv) => new Promise((resolve) => {
                 const child = spawn(harness, argv, { stdio: "inherit", env: loginEnv });
@@ -871,14 +888,19 @@ function pathHint() {
     say(`  ${bold(pathLine())}`);
     return 0;
 }
-/** `tab use`: pick or change the Agent for this folder. */
-async function use() {
+/** `tab use [claude|codex|grok|kimi]`: pick or change the Agent this folder runs a harness as; bare, the folder's default. */
+async function use(args) {
     const config = await ensureLogin();
     if (!config)
         return 2;
     if (!(await ensureProxy(config)))
         return 1;
-    const agent = await resolveAgent(config, { pick: true });
+    const word = args[0];
+    if (word && harnessOf(word) === "any") {
+        fail(`tab use [claude|codex|grok|kimi]: which harness to pick an Agent for; bare for the folder's default.`);
+        return 2;
+    }
+    const agent = await resolveAgent(config, { pick: true, harness: word ? harnessOf(word) : "any" });
     return agent ? 0 : 1;
 }
 /**
@@ -1065,7 +1087,7 @@ async function main(argv) {
             ok("Forgot the session and keys on this machine.");
             return 0;
         case "use":
-            return use();
+            return use(rest);
         case "alias":
             return alias(rest);
         case "unalias":

package/dist/clients.js

@@ -124,7 +124,10 @@ export function envFor(input) {
             delete env.OPENAI_BASE_URL;
             delete env.OPENAI_API_KEY;
             if (spec.provider === "xai") {
-                env.GROK_XAI_API_BASE_URL = `${passthroughBase(input.proxyUrl, input.presentedKey, "xai")}/v1`;
+                // On a SuperGrok login Grok Build talks to xAI's CLI chat proxy, chosen by this variable; the public-API
+                // variable only matters with an API key, which a subscription launch never has.
+                env.GROK_CLI_CHAT_PROXY_BASE_URL = `${passthroughBase(input.proxyUrl, input.presentedKey, "xai")}/v1`;
+                delete env.GROK_XAI_API_BASE_URL;
                 delete env.XAI_API_KEY;
             }
             if (spec.provider === "moonshot") {

package/dist/console-api.js

@@ -32,3 +32,7 @@ export async function createAgent(consoleUrl, token, input, fetchImpl = fetch) {
 export async function issueAgentKey(consoleUrl, token, agentId, fetchImpl = fetch) {
     return call(consoleUrl, token, `/api/cli/agents/${encodeURIComponent(agentId)}/key`, { method: "POST" }, fetchImpl);
 }
+/** Tie an untied Agent to a harness (or change it): `tab agent harness <agent> codex`. */
+export async function setAgentHarness(consoleUrl, token, slug, harness, fetchImpl = fetch) {
+    return call(consoleUrl, token, `/api/cli/tabs/${encodeURIComponent(slug)}`, { method: "PATCH", body: JSON.stringify({ harness }) }, fetchImpl);
+}

package/dist/manage.js

@@ -61,6 +61,10 @@ export function parseFlags(argv) {
     return flags;
 }
 const kindOf = (t) => (t.kind === "subscription" ? yellow("subscription") : "api");
+const harnessOf = (t) => (t.harness && t.harness !== "any" ? t.harness : dim("any"));
+// A subscription never touches its cap: nothing to show but the kill switch.
+const capOf = (t) => (t.kind === "subscription" ? dim("-") : money(t.capCents));
+const usedOf = (t) => (t.kind === "subscription" ? dim("-") : pct(t.spentCents, t.capCents));
 async function tabsOf(call) {
     return (await call("GET", "/api/cli/tabs")).tabs;
 }
@@ -94,7 +98,7 @@ export async function list(config, flags) {
     const tabs = await tabsOf(api(config));
     emit(flags.json, { tabs }, () => tabs.length === 0
         ? dim("No Agents yet. Run tab claude or tab codex in a project folder.")
-        : table(["agent", "kind", "state", "spent", "cap", "used", "window", "project"], tabs.map((t) => [t.name === t.slug ? t.slug : `${t.name} ${dim(t.slug)}`, kindOf(t), state(t.state), money(t.spentCents), money(t.capCents), pct(t.spentCents, t.capCents), t.window, t.projectName ?? dim("-")]), { right: [3, 4, 5] }));
+        : table(["agent", "harness", "kind", "state", "spent", "cap", "used", "window", "project"], tabs.map((t) => [t.name === t.slug ? t.slug : `${t.name} ${dim(t.slug)}`, harnessOf(t), kindOf(t), state(t.state), t.kind === "subscription" ? dim("-") : money(t.spentCents), capOf(t), usedOf(t), t.window, t.projectName ?? dim("-")]), { right: [3, 4, 5] }));
     return 0;
 }
 export async function setState(config, flags, next) {
@@ -156,7 +160,7 @@ export async function agent(config, flags) {
         if (!name)
             throw new ManageError('tab agent create <name> [--subscription|--api] [--cap 50]');
         const kind = flags.opts.subscription !== undefined ? "subscription" : "api";
-        const body = { name, kind };
+        const body = { name, kind, ...(flags.opts.harness ? { harness: flags.opts.harness.toLowerCase() } : {}) };
         if (flags.opts.cap)
             body.capDollars = flags.opts.cap.replace(/^\$/, "");
         const made = await call("POST", "/api/cli/agents", body);
@@ -169,6 +173,18 @@ export async function agent(config, flags) {
                 : "Its calls use the flock's provider key and are metered against the cap. tab use picks it for a folder."));
         return 0;
     }
+    if (verb === "harness") {
+        const [given, wanted] = rest;
+        const harness = (wanted ?? "").toLowerCase();
+        if (!given || !["claude", "codex", "grok", "kimi", "any"].includes(harness))
+            throw new ManageError("tab agent harness <agent> claude|codex|grok|kimi|any");
+        const slug = await resolveSlug(call, given);
+        const { tab } = await call("PATCH", `/api/cli/tabs/${encodeURIComponent(slug)}`, { harness });
+        emit(flags.json, { tab }, () => harness === "any"
+            ? `${bold(tab.name)} is tied to no harness: it is metered on the tab and cannot pass a login through.`
+            : `${bold(tab.name)} is a ${bold(harness)} Agent. A ${harness} login passes through it; any other harness is refused before the vendor.`);
+        return 0;
+    }
     if (verb === "kind" || verb === "type") {
         const [given, wanted] = rest;
         if (!given || !wanted)
@@ -178,7 +194,7 @@ export async function agent(config, flags) {
         emit(flags.json, { tab }, () => `${bold(tab.name)} is now ${tab.kind === "subscription" ? bold("a subscription Agent") + dim(": its harnesses use your own logins from the next run") : bold("an API-key Agent") + dim(": metered with the flock's key from the next run")}.`);
         return 0;
     }
-    throw new ManageError("tab agent create <name> [--subscription|--api] | tab agent kind <agent> api|subscription");
+    throw new ManageError("tab agent create <name> [--subscription|--api] [--harness claude|codex|grok|kimi] | tab agent kind <agent> api|subscription | tab agent harness <agent> claude|codex|grok|kimi|any");
 }
 /**
  * `tab accounts` (also `tab quota`): every account the flock's subscription

package/dist/project.js

@@ -16,6 +16,7 @@ export function projectFileName(env = process.env) {
     const name = env.FLOCKTAB_PROJECT_FILE?.trim();
     return name && /^\.[A-Za-z0-9._-]{1,40}$/.test(name) ? name : PROJECT_FILE;
 }
+const SLUG = /^[a-z0-9][a-z0-9-]*$/;
 async function exists(file) {
     try {
         await access(file);
@@ -40,19 +41,49 @@ export async function findProjectFile(cwd) {
         dir = parent;
     }
 }
-export async function readProject(cwd) {
+/** The whole file, cleaned: only valid slugs survive. */
+export async function readProjectConfig(cwd) {
     const file = await findProjectFile(cwd);
     if (!file)
         return undefined;
     try {
         const parsed = JSON.parse(await readFile(file, "utf8"));
-        const agent = parsed && typeof parsed === "object" ? parsed.agent : undefined;
-        if (typeof agent === "string" && /^[a-z0-9][a-z0-9-]*$/.test(agent))
-            return { file, agent };
+        if (!parsed || typeof parsed !== "object")
+            return { file, config: {} };
+        const raw = parsed;
+        const config = {};
+        if (typeof raw.agent === "string" && SLUG.test(raw.agent))
+            config.agent = raw.agent;
+        if (raw.agents && typeof raw.agents === "object") {
+            const agents = {};
+            for (const [harness, slug] of Object.entries(raw.agents)) {
+                if (typeof slug === "string" && SLUG.test(slug) && /^[a-z]{1,16}$/.test(harness))
+                    agents[harness] = slug;
+            }
+            if (Object.keys(agents).length > 0)
+                config.agents = agents;
+        }
+        return { file, config };
     }
     catch {
         // Unreadable: treat as absent and ask again.
+        return undefined;
     }
+}
+/**
+ * The Agent this folder runs `harness` as: its own entry, else the file's
+ * single `agent` (an older file, or a folder that made one Agent for
+ * everything before harnesses were told apart).
+ */
+export async function readProject(cwd, harness = "any") {
+    const found = await readProjectConfig(cwd);
+    if (!found)
+        return undefined;
+    const own = found.config.agents?.[harness];
+    if (own)
+        return { file: found.file, agent: own, own: true };
+    if (found.config.agent)
+        return { file: found.file, agent: found.config.agent, own: false };
     return undefined;
 }
 /** Where a new `.flocktab` goes: the git root above `cwd` when there is one, else `cwd`. */
@@ -72,6 +103,17 @@ export async function writeProject(dir, config) {
     await writeFile(file, `${JSON.stringify(config)}\n`);
     return file;
 }
+/** Set which Agent this folder runs `harness` as, keeping the rest of the file. */
+export async function assignProjectAgent(dir, harness, slug) {
+    const existing = (await readProjectConfig(dir))?.config ?? {};
+    const agents = { ...(existing.agents ?? {}) };
+    if (harness === "any") {
+        // The folder's default: also what older files meant by `agent`.
+        return writeProject(dir, { agent: slug, ...(Object.keys(agents).length > 0 ? { agents } : {}) });
+    }
+    agents[harness] = slug;
+    return writeProject(dir, { ...(existing.agent ? { agent: existing.agent } : {}), agents });
+}
 /** A default Agent name for a folder: its basename, kebab-cased. */
 export function agentNameFor(dir) {
     return path

package/dist/proxy-bin.js

@@ -13,7 +13,7 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { configDir } from "./config.js";
 /** The proxy release `tab up` fetches. Bump with each proxy tag. */
-export const PROXY_VERSION = "0.1.8";
+export const PROXY_VERSION = "0.1.10";
 export const RELEASES = "https://github.com/joseairosa/flocktab/releases/download";
 export function targetFor(platform = process.platform, arch = process.arch) {
     if (platform === "darwin")

package/dist/tab-docs-shared.js

@@ -0,0 +1,9 @@
+/**
+ * The harness vocabulary, the same as `@flocktab/shared`'s. `tab` ships to
+ * npm alone, so it carries a copy rather than the dependency.
+ */
+export const HARNESSES = ["claude", "codex", "grok", "kimi", "any"];
+/** `dash-f4f` + `claude` -> `dash-f4f-claude`; `any` keeps the folder's name. */
+export function agentNameFor(project, harness) {
+    return harness === "any" ? project : `${project}-${harness}`;
+}

package/dist/tab-docs.js

@@ -35,11 +35,11 @@ export const TAB_COMMANDS = [
     {
         name: "use",
         group: "start",
-        usage: ["use"],
-        summary: "Pick or change the Agent this folder runs as.",
+        usage: ["use", "use claude|codex|grok|kimi"],
+        summary: "Pick or change the Agent this folder runs a harness as.",
         details: [
-            "Lists the flock's Agents (state, kind, cap) and lets you choose one or make a new one. A new Agent asks for its kind: API key or Subscription. The choice is written to a one-line .flocktab file at the git root (or this folder), and a key for that Agent is minted and kept on this machine.",
-            "Running tab claude or tab codex in a folder with no .flocktab asks the same question, so tab use is only needed to change the answer.",
+            "An Agent is one harness on one project. tab claude and tab codex in the same folder are two Agents (that is what the plan counts), each asked for once: the first run of a harness in a folder lists the flock's Agents of that harness (and untied ones it can tie), or makes a new one named <folder>-<harness> and asks its kind. The choice goes into .flocktab at the git root, one entry per harness, and a key for that Agent is minted and kept on this machine.",
+            "tab use codex changes the answer for one harness; bare tab use sets the folder's default, which every other command (tab python …) runs as. An older .flocktab with a single Agent applies to every harness until one is set apart.",
             "An Agent that already holds a key on another machine can be used here too, but minting a key here replaces the one there. tab asks before doing it.",
         ],
         see: ["agent", "key", "list"],
@@ -91,18 +91,22 @@ export const TAB_COMMANDS = [
         name: "agent",
         overview: "agent create | kind",
         group: "agents",
-        usage: ["agent create <name> --subscription|--api [--cap <dollars>]", "agent kind <agent> api|subscription"],
-        summary: "Make an Agent of a given kind, or change an Agent's kind.",
+        usage: ["agent create <name> --subscription|--api [--harness claude|codex|grok|kimi] [--cap <dollars>]", "agent kind <agent> api|subscription", "agent harness <agent> claude|codex|grok|kimi|any"],
+        summary: "Make an Agent, or change its kind or harness.",
         details: [
-            "An Agent is one named worker with one tab. Its kind is the only thing anyone declares: api means the flock's provider key pays and the cap is the meter; subscription means its agents use your own plan logins and nothing is charged.",
+            "An Agent is one harness on one project, with one tab. Two things are declared: its kind (api: the flock's provider key pays and the cap is the meter; subscription: your own plan logins, nothing charged) and its harness (claude, codex, grok, kimi, or any for scripts). The proxies enforce the harness: a Claude Agent's key cannot pass a Codex login through (403 wrong_harness), so Claude and Codex on one folder are two Agents and count as two.",
+            "A subscription Agent's cap is never touched, so tab list shows none; its tab is the kill switch.",
             "Changing the kind applies to the next launch. tab claude reads it fresh every time.",
         ],
         options: [
             { flag: "--subscription | --api", what: "the kind of the new Agent (api when neither is given)" },
             { flag: "--cap <dollars>", what: "the new Agent's cap; 50 when left out" },
+            { flag: "--harness claude|codex|grok|kimi", what: "which harness this Agent is; any when left out" },
         ],
         examples: [
             { cmd: "tab agent create billing-api --api --cap 20", what: "a metered Agent with a $20 cap" },
+            { cmd: "tab agent create dash-f4f-codex --subscription --harness codex", what: "a Codex Agent for the dash folder" },
+            { cmd: "tab agent harness dash-f4f codex", what: "tie an untied Agent to Codex" },
             { cmd: "tab agent create my-laptop --subscription", what: "an Agent for your own plan logins" },
             { cmd: "tab agent kind billing-api subscription", what: "switch an existing Agent" },
         ],
@@ -375,7 +379,8 @@ export const TAB_COMMANDS = [
 /** What is what. Alphabetical in the docs; grouped by subject here. */
 export const TAB_GLOSSARY = [
     { term: "Flock", meaning: "Your workspace: many Agents, one plan, one ledger. Each console login has its own." },
-    { term: "Agent", meaning: "One named worker, such as billing-api or my-laptop. It has exactly one tab, one kind, and its own keys, policies and history. Plans count Agents." },
+    { term: "Agent", meaning: "One harness on one project, such as dash-f4f-claude. It has exactly one tab, one kind, one harness, and its own keys, policies and history. Claude and Codex on the same folder are two Agents. Plans count Agents." },
+    { term: "Harness", also: ["claude", "codex", "grok", "kimi", "any"], meaning: "Which coding agent an Agent is for. Set when the Agent is made; the proxies refuse a call from another harness before the vendor (403 wrong_harness). any is a script or unknown agent: metered only, never a subscription passthrough." },
     { term: "Tab", meaning: "An Agent's spend account: a hard dollar cap, a window, and a state, open or closed. Closing the tab is the kill switch." },
     { term: "Kind", also: ["api", "subscription"], meaning: "What pays for an Agent's tokens. api: the flock's provider key, every call charged to the cap. subscription: your own plan login, gated and recorded but never charged. Chosen when the Agent is made; it can be changed." },
     { term: "Cap", meaning: "The most an Agent may spend in one window, in dollars. Hard: a call that would pass it is refused before the provider. There is no overage." },
@@ -407,7 +412,6 @@ export const TAB_GLOSSARY = [
     { term: "Outside spend", meaning: "Money that did not go through a tab, read from provider admin APIs and cloud billing, so it can be told apart from metered spend. Team plan and up." },
     { term: "Ledger", meaning: "Every decision, one row per call: allowed, settled, refunded, blocked and why. Money is whole cents, never a fraction. If the ledger cannot be reached, no call goes out." },
     { term: "Fail closed", meaning: "When FlockTab cannot be sure a call fits (the ledger is down, the key is unknown, the unlock is missing) the call is refused rather than let through." },
-    { term: "Harness", meaning: "The coding agent you run: Claude Code, Codex, Grok Build, Kimi Code, or any command. tab calls them agents in its output." },
     { term: ".flocktab", meaning: "A one-line file at a project's root naming the Agent that folder runs as. Safe to commit: it holds no key." },
     { term: "~/.flocktab", meaning: "This machine's tab folder: the session and Agent keys (config.json), the pool (pool.json), the self-hosted proxy's keys, log and binary, and the alias shims. Owner-only." },
 ];
@@ -419,6 +423,7 @@ export const TAB_ERRORS = [
     { status: 403, code: "model_blocked", when: "The model is not on the Agent's allowlist.", fix: "tab policy --models ..., or none to allow any." },
     { status: 403, code: "agent_frozen", when: "The Agent was frozen from the console.", fix: "Frozen by FlockTab support or an admin rule; write to support." },
     { status: 403, code: "not_subscription", when: "A passthrough (/t/...) call for an API-key Agent.", fix: "tab agent kind <agent> subscription, or run it metered." },
+    { status: 403, code: "wrong_harness", when: "A passthrough for another harness than the Agent's: a Claude Agent's key with a Codex login, or an untied Agent with any login.", fix: "Run tab <harness> in the folder and pick or make that harness's Agent; or tab agent harness <agent> <harness>." },
     { status: 429, code: "velocity", when: "More calls this minute than the policy allows.", fix: "Wait, or tab policy --velocity N." },
     { status: 401, code: "key_revoked", when: "The key is unknown, rotated or missing.", fix: "tab key rotate mints a fresh one on this machine." },
     { status: 503, code: "ledger_unavailable", when: "FlockTab could not reach its ledger. Nothing was sent to the provider.", fix: "Retry. This is fail closed on purpose." },

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Written by scripts/write-version.mjs from package.json at build; `tab version` prints it. */
-export const TAB_VERSION = "0.1.13";
+export const TAB_VERSION = "0.1.15";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanamorilabs/tab",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Run any AI agent on a FlockTab tab: tab claude, tab codex, tab <command>.",
   "license": "MIT",
   "type": "module",
@@ -22,11 +22,11 @@
     "prepublishOnly": "pnpm build"
   },
   "optionalDependencies": {
-    "@hanamorilabs/flocktab-proxy-darwin-arm64": "0.1.8",
-    "@hanamorilabs/flocktab-proxy-darwin-x64": "0.1.8",
-    "@hanamorilabs/flocktab-proxy-linux-x64": "0.1.8",
-    "@hanamorilabs/flocktab-proxy-linux-arm64": "0.1.8",
-    "@hanamorilabs/flocktab-proxy-win-x64": "0.1.8"
+    "@hanamorilabs/flocktab-proxy-darwin-arm64": "0.1.10",
+    "@hanamorilabs/flocktab-proxy-darwin-x64": "0.1.10",
+    "@hanamorilabs/flocktab-proxy-linux-x64": "0.1.10",
+    "@hanamorilabs/flocktab-proxy-linux-arm64": "0.1.10",
+    "@hanamorilabs/flocktab-proxy-win-x64": "0.1.10"
   },
   "devDependencies": {
     "@types/node": "^22.18.6",