@hydraharness/harness-client-connection 0.1.1-rc.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,19 @@
+# @hydraharness/harness-client-connection
+
+`ctx.connection` owns the browser API client, loopback classification, connection generation, and the single-consumer Host/event downlink loops. The served Web app uses HTTP and WebSocket transport; a shell can supply `globalThis.__HYDRA_TRANSPORT__` with `createApiClient`, `fetch`, and optional `loadBundle` instead.
+
+The Host owns the `/api` route and applies the loopback fence before a registered Typert Remote or API Proxy handles a request. Plugin inventory management is loopback-only: loader enablement, OpenAI/Codex marketplace-source changes, imported-plugin lifecycle, imported MCP-server enablement, and hook trust all expose installed code or mutate local configuration. A configured trusted host can invoke other application methods but cannot bypass this fence.
+
+Authorization methods are loopback-only as well: account inventories reveal provider identities, and begin/answer/logout can start an interactive login, carry its answer, or mutate the provider account pool. The connection keeps these methods behind the same local caller check while ordinary model and session reads remain available to a configured trusted host.
+
+## Model Experience
+
+None, as this transport package neither assembles model input nor registers a model-facing capability.
+
+#### KV Cache effect
+
+None.
+
+## Known Limitations and Deferred Work
+
+- **Local-only plugin management** — remote clients cannot manage marketplace sources or imported bundles until an authenticated authority model exists.