@hmharness/kernel 0.1.0 → 0.2.0

package/dist/mcp.d.ts

@@ -5,11 +5,13 @@ export type McpServerConfig = {
     args?: string[];
     env?: Record<string, string>;
     trusted?: boolean;
+    trustedTools?: string[];
 } | {
     type: 'http';
     url: string;
     headers?: Record<string, string>;
     trusted?: boolean;
+    trustedTools?: string[];
 };
 export declare class McpClient {
     readonly serverName: string;

package/dist/mcp.js

@@ -253,14 +253,20 @@ export async function mcpServerTools(serverName, config) {
     await client.connect();
     const remote = await client.listTools();
     const trusted = 'trusted' in config && config.trusted === true;
+    // Exemption granularity: `trusted: true` exempts the WHOLE server (dangerous,
+    // meant for servers you own). `trustedTools: ['search', ...]` exempts only
+    // the named REMOTE tool names - read-only lookups stay frictionless while
+    // every mutating tool on the same server still hits the approval gate.
+    const trustedTools = 'trustedTools' in config && Array.isArray(config.trustedTools) ? config.trustedTools : [];
     const tools = remote.map((t) => {
         const localName = `mcp_${sanitizeToolName(serverName)}_${sanitizeToolName(t.name)}`.slice(0, 60);
         const remoteName = t.name;
+        const exempt = trusted || trustedTools.includes(remoteName);
         return {
             name: localName,
             description: `[mcp:${serverName}] ${t.description ?? t.name}`.slice(0, 400),
             parameters: normalizeSchema(t.inputSchema),
-            needsApproval: trusted ? undefined : () => true,
+            needsApproval: exempt ? undefined : () => true,
             async execute(args) {
                 return client.callTool(remoteName, args);
             },

package/dist/provider.js

@@ -17,7 +17,7 @@ export async function chat(cfg, messages, tools, opts = {}) {
     let lastError = '';
     for (let attempt = 0; attempt < 2; attempt++) {
         const ctrl = new AbortController();
-        const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 120_000);
+        const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? cfg.timeoutMs ?? 120_000);
         try {
             const res = await fetch(endpoint(cfg.baseUrl), {
                 method: 'POST',
@@ -191,7 +191,7 @@ export async function chatVision(cfg, prompt, imageDataUrl, opts = {}) {
     let vAuth = cfg.authHeader ?? 'bearer';
     for (let attempt = 0; attempt < 2; attempt++) {
         const ctrl = new AbortController();
-        const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 120_000);
+        const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? cfg.timeoutMs ?? 120_000);
         try {
             const vHeaders = vAuth === 'bearer'
                 ? { 'Content-Type': 'application/json', Authorization: `Bearer ${cfg.apiKey}` }

package/dist/types.d.ts

@@ -60,6 +60,10 @@ export interface ProviderConfig {
      *  for freellmapi). Omit for standard Authorization: Bearer; on 401 the
      *  provider renegotiates with X-Api-Key automatically. */
     authHeader?: string;
+    /** Per-request timeout override (ms). Slow reasoning models (free-tier
+     *  tokenrouter took 84s on an evolve-sized prompt vs the 120s default)
+     *  set e.g. 240000 on the evolve/bench routes. */
+    timeoutMs?: number;
 }
 /** User-level configuration (HMH_HOME/config.json). */
 export interface HmhConfig {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hmharness/kernel",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "hmharness kernel: tool registry, provider adapters, the agent loop, session log, config. Zero runtime dependencies (Node >=22 native fetch).",
   "type": "module",
   "main": "dist/index.js",