@hmharness/kernel 0.1.0 → 0.3.0

package/dist/mcp.d.ts

@@ -5,11 +5,13 @@ export type McpServerConfig = {
     args?: string[];
     env?: Record<string, string>;
     trusted?: boolean;
+    trustedTools?: string[];
 } | {
     type: 'http';
     url: string;
     headers?: Record<string, string>;
     trusted?: boolean;
+    trustedTools?: string[];
 };
 export declare class McpClient {
     readonly serverName: string;

package/dist/mcp.js

@@ -253,14 +253,20 @@ export async function mcpServerTools(serverName, config) {
     await client.connect();
     const remote = await client.listTools();
     const trusted = 'trusted' in config && config.trusted === true;
+    // Exemption granularity: `trusted: true` exempts the WHOLE server (dangerous,
+    // meant for servers you own). `trustedTools: ['search', ...]` exempts only
+    // the named REMOTE tool names - read-only lookups stay frictionless while
+    // every mutating tool on the same server still hits the approval gate.
+    const trustedTools = 'trustedTools' in config && Array.isArray(config.trustedTools) ? config.trustedTools : [];
     const tools = remote.map((t) => {
         const localName = `mcp_${sanitizeToolName(serverName)}_${sanitizeToolName(t.name)}`.slice(0, 60);
         const remoteName = t.name;
+        const exempt = trusted || trustedTools.includes(remoteName);
         return {
             name: localName,
             description: `[mcp:${serverName}] ${t.description ?? t.name}`.slice(0, 400),
             parameters: normalizeSchema(t.inputSchema),
-            needsApproval: trusted ? undefined : () => true,
+            needsApproval: exempt ? undefined : () => true,
             async execute(args) {
                 return client.callTool(remoteName, args);
             },

package/dist/provider.d.ts

@@ -21,6 +21,9 @@ export interface ChatOptions {
     onDelta?(kind: DeltaKind, chunk: string): void;
 }
 export declare function chat(cfg: ProviderConfig, messages: ChatMessage[], tools?: unknown[], opts?: ChatOptions): Promise<ChatResponse>;
+/** Accept bases with any /vN suffix (v1 OpenAI convention, v4 zhipu coding
+ *  plan: open.bigmodel.cn/api/coding/paas/v4) or none at all. */
+export declare function endpoint(baseUrl: string): string;
 /**
  * Single multimodal call: text prompt + one image (data URL). Used by the
  * see_image tool; deliberately separate from chat() so the streaming path

package/dist/provider.js

@@ -17,7 +17,7 @@ export async function chat(cfg, messages, tools, opts = {}) {
     let lastError = '';
     for (let attempt = 0; attempt < 2; attempt++) {
         const ctrl = new AbortController();
-        const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 120_000);
+        const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? cfg.timeoutMs ?? 120_000);
         try {
             const res = await fetch(endpoint(cfg.baseUrl), {
                 method: 'POST',
@@ -162,10 +162,11 @@ async function consumeStream(res, onDelta) {
         usage,
     };
 }
-/** Accept bases both with and without the /v1 suffix. */
-function endpoint(baseUrl) {
+/** Accept bases with any /vN suffix (v1 OpenAI convention, v4 zhipu coding
+ *  plan: open.bigmodel.cn/api/coding/paas/v4) or none at all. */
+export function endpoint(baseUrl) {
     const b = baseUrl.replace(/\/+$/, '');
-    return b.endsWith('/v1') ? `${b}/chat/completions` : `${b}/v1/chat/completions`;
+    return /\/v\d+$/.test(b) ? `${b}/chat/completions` : `${b}/v1/chat/completions`;
 }
 /**
  * Single multimodal call: text prompt + one image (data URL). Used by the
@@ -191,7 +192,7 @@ export async function chatVision(cfg, prompt, imageDataUrl, opts = {}) {
     let vAuth = cfg.authHeader ?? 'bearer';
     for (let attempt = 0; attempt < 2; attempt++) {
         const ctrl = new AbortController();
-        const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 120_000);
+        const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? cfg.timeoutMs ?? 120_000);
         try {
             const vHeaders = vAuth === 'bearer'
                 ? { 'Content-Type': 'application/json', Authorization: `Bearer ${cfg.apiKey}` }

package/dist/types.d.ts

@@ -60,6 +60,10 @@ export interface ProviderConfig {
      *  for freellmapi). Omit for standard Authorization: Bearer; on 401 the
      *  provider renegotiates with X-Api-Key automatically. */
     authHeader?: string;
+    /** Per-request timeout override (ms). Slow reasoning models (free-tier
+     *  tokenrouter took 84s on an evolve-sized prompt vs the 120s default)
+     *  set e.g. 240000 on the evolve/bench routes. */
+    timeoutMs?: number;
 }
 /** User-level configuration (HMH_HOME/config.json). */
 export interface HmhConfig {

package/dist/types.js

@@ -30,7 +30,7 @@ export function listProviders(cfg) {
 export const PROVIDER_PRESETS = [
     { name: 'deepseek', baseUrl: 'https://api.deepseek.com/v1', envVar: 'DEEPSEEK_API_KEY', model: 'deepseek-chat' },
     { name: 'kimi', baseUrl: 'https://api.moonshot.cn/v1', envVar: 'MOONSHOT_API_KEY', model: 'kimi-latest' },
-    { name: 'glm', baseUrl: 'https://open.bigmodel.cn/api/paas/v4', envVar: 'ZHIPU_API_KEY', model: 'glm-4.7' },
+    { name: 'glm', baseUrl: 'https://open.bigmodel.cn/api/coding/paas/v4', envVar: 'ZHIPU_API_KEY', model: 'glm-5.3' },
     { name: 'qwen', baseUrl: 'https://dashscope.aliyuncs.com/compatible-mode/v1', envVar: 'DASHSCOPE_API_KEY', model: 'qwen3-max' },
     { name: 'openai', baseUrl: 'https://api.openai.com/v1', envVar: 'OPENAI_API_KEY', model: 'gpt-5' },
     { name: 'siliconflow', baseUrl: 'https://api.siliconflow.cn/v1', envVar: 'SILICONFLOW_API_KEY', model: 'deepseek-ai/DeepSeek-V3.2-Exp' },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hmharness/kernel",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "hmharness kernel: tool registry, provider adapters, the agent loop, session log, config. Zero runtime dependencies (Node >=22 native fetch).",
   "type": "module",
   "main": "dist/index.js",