@inflexa-ai/harness 0.44.0 → 0.45.1

package/dist/agents/conversation-agent.d.ts

@@ -37,6 +37,7 @@ import type { ExtendAnalysisFarm } from "../sandbox/types.js";
 import type { WorkspaceFilesystem } from "../workspace/filesystem.js";
 import type { ResolveWorkspaceRoot } from "../workspace/paths.js";
 import { type BioToolKeys } from "../tools/bio/keys.js";
+import type { KnowledgeClient } from "../tools/knowledge/index.js";
 import type { EnvironmentStorePaths } from "../config/environment-stores.js";
 import type { RunAuthorizer } from "../execution/run-authorizer.js";
 import type { RunLauncher } from "../execution/run-launcher.js";
@@ -44,6 +45,7 @@ import type { ProvenanceSeam } from "../provenance/seam.js";
 import type { Logger } from "../lib/logger.js";
 import type { UsageRecorder } from "../billing/usage-recorder.js";
 import type { CitationResolver } from "../citations/types.js";
+import { type WebSearchEngine } from "../tools/research/web-search.js";
 /** Canonical agent id — the single source of truth. */
 export declare const CONVERSATION_AGENT_ID: "conversation-agent";
 /**
@@ -63,6 +65,8 @@ export interface ConversationAgentDeps extends EnvironmentStorePaths {
     readonly usageRecorder?: UsageRecorder;
     /** Adds `read_tool_output`, and each loop-driving tool gives the same store to its sub-agent. */
     readonly toolOutputStore?: ToolOutputStore;
+    /** The web-search engine the embedder injected; set, `web_search` attaches, absent it does not. `web_fetch` attaches either way. */
+    readonly webSearch?: WebSearchEngine;
     /** Shared host-side bibliographic verification service. */
     readonly citationResolver: CitationResolver;
     /** The LLM seam every loop-driving tool runs its sub-agent on. */
@@ -107,6 +111,12 @@ export interface ConversationAgentDeps extends EnvironmentStorePaths {
     readonly runLauncher: RunLauncher;
     /** API keys for the external bio/chem data sources. */
     readonly bioKeys: BioToolKeys;
+    /**
+     * The knowledge service client, for the planner that `generate_plan` drives.
+     * Absent, the planner attaches no knowledge tool. The conversation agent
+     * itself gets `knowledge_recommend` through `hostTools`, from the embedder.
+     */
+    readonly knowledge?: KnowledgeClient;
     /** Skills root. No tool of the roster reads it. */
     readonly skillsDir: string;
     /** Headless-Chrome config for report snapshot/preview rendering. */

package/dist/agents/conversation-agent.js

@@ -36,10 +36,13 @@ import { createEditFileTool, createFileStatTool, createGrepTool, createListFiles
 import { showUserTool } from "../tools/display/index.js";
 import { createUpdateWorkingMemoryTool } from "../tools/memory/index.js";
 import { createListAvailablePackagesTool } from "../tools/sandbox/list-available-packages.js";
+import { createInspectCapabilityDataTool } from "../tools/capability-data.js";
 import { createListAvailableRefsTool } from "../tools/sandbox/list-available-refs.js";
 import { createExecuteAnalysisTool } from "../tools/execute-analysis.js";
 import { createStartReportSessionTool } from "../tools/start-report-session.js";
 import { createResolveCitationTool } from "../tools/research/resolve-citation.js";
+import { createWebFetchTool } from "../tools/research/web-fetch.js";
+import { createWebSearchTool } from "../tools/research/web-search.js";
 /** Canonical agent id — the single source of truth. */
 export const CONVERSATION_AGENT_ID = "conversation-agent";
 /** Runaway guard — heavy tool-driving turns need generous headroom. */
@@ -48,7 +51,7 @@ const CONVERSATION_MAX_ITERATIONS = 200;
 const CONVERSATION_COMPACTION = { turnStartBudget: 150_000, budget: 200_000 };
 /** Build the conversation `AgentDefinition` with every tool fully dep-bound. */
 export function createConversationAgent(deps) {
-    const { provider, pool, embedding, workspaceFs, model, utilityProvider, utilityModel, executeAnalysisWorkflow, runAuthorizer, runLauncher, bioKeys, chrome, resourcePolicy, hostTools, refStorePath, farmLockFile, imagePackagesFile, readPoolInventory, usageRecorder, toolOutputStore, citationResolver, } = deps;
+    const { provider, pool, embedding, workspaceFs, model, utilityProvider, utilityModel, executeAnalysisWorkflow, runAuthorizer, runLauncher, bioKeys, chrome, resourcePolicy, hostTools, refStorePath, farmLockFile, imagePackagesFile, readPoolInventory, usageRecorder, toolOutputStore, citationResolver, webSearch, } = deps;
     const workingMemory = createWorkingMemory(pool);
     const ncbi = createNcbiTools(bioKeys);
     const chemDb = createChemDbTools(bioKeys, { ...(deps.logger ? { logger: deps.logger } : {}) });
@@ -81,6 +84,11 @@ export function createConversationAgent(deps) {
         // preprint has no MEDLINE record, thus PubMed alone cannot answer it.
         createSearchSemanticScholarTool({ ...(bioKeys.semanticScholar === undefined ? {} : { apiKey: bioKeys.semanticScholar }) }),
         searchArxivTool,
+        // The web step of research — the injected web-search engine (the CLI runs
+        // SearXNG and binds its realization), then the guarded page fetch that
+        // reads what the search found.
+        ...(webSearch ? [createWebSearchTool({ engine: webSearch })] : []),
+        createWebFetchTool({ ...(toolOutputStore ? { toolOutputStore } : {}) }),
         // ChEMBL (compounds / drug / mechanism / bioactivity / targets behind one action).
         chemblTool,
         // PubChem (compound / crossrefs / assays behind one action).
@@ -109,6 +117,11 @@ export function createConversationAgent(deps) {
         // blind is how a user gets asked to download something already installed, or
         // told nothing is missing when it is; this is the only tool that can tell.
         createListAvailableRefsTool({ ...(refStorePath ? { refStorePath } : {}) }),
+        // Which datasets a specialist capability cannot run without. `list_available_refs` answers
+        // what the store HOLDS; this answers what a capability WANTS, which no prompt may name and
+        // only a skill otherwise records — and a skill is read by a step agent, not here. Without
+        // it this agent meets an absent source as a dead end and designs around it.
+        createInspectCapabilityDataTool({ ...(refStorePath ? { refStorePath } : {}) }),
         // What the STORE holds, pool-scope where the embedder binds the reader:
         // the ask flow of this agent marks the packages the pool does not hold,
         // and the farm of a new analysis is empty — a farm view here would read
@@ -130,6 +143,7 @@ export function createConversationAgent(deps) {
             usageRecorder,
             ...(toolOutputStore ? { toolOutputStore } : {}),
             bioKeys,
+            ...(deps.knowledge ? { knowledge: deps.knowledge } : {}),
             ...(refStorePath ? { refStorePath } : {}),
             ...(farmLockFile ? { farmLockFile } : {}),
             ...(imagePackagesFile ? { imagePackagesFile } : {}),
@@ -147,6 +161,10 @@ export function createConversationAgent(deps) {
             ...(farmLockFile ? { farmLockFile } : {}),
             ...(imagePackagesFile ? { imagePackagesFile } : {}),
             ...(readPoolInventory ? { readPoolInventory } : {}),
+            // The pre-launch pass resolves the declared reference data of a capability against the
+            // store. Without this path it would read the CONTAINER path, which no host holds, and
+            // refuse every launch of a plan that declares one.
+            ...(refStorePath ? { refStorePath } : {}),
             ...(deps.extendAnalysisFarm ? { extendAnalysisFarm: deps.extendAnalysisFarm } : {}),
             ...(deps.logger ? { logger: deps.logger } : {}),
             ...(usageRecorder ? { usageRecorder } : {}),

package/dist/agents/sandbox/shared.d.ts

@@ -31,11 +31,19 @@ import type { AgentMeta, SandboxToolName } from "./types.js";
 import type { EnvironmentStorePaths } from "../../config/environment-stores.js";
 import type { Logger } from "../../lib/logger.js";
 import type { CitationResolver } from "../../citations/types.js";
+import { type KnowledgeClient, type TemplateBinding } from "../../tools/knowledge/index.js";
 /**
  * Tools every sandbox agent receives — sandbox-environment introspection,
- * library docs, and run inspection. Spread into each agent's
- * `meta.tools` so planner-facing metadata and the resolved tool record
+ * library docs, run inspection, and the knowledge template. Spread into each
+ * agent's `meta.tools` so planner-facing metadata and the resolved tool record
  * stay in sync. Keep minimal — only tools every agent genuinely needs.
+ *
+ * The knowledge template is here, not on a specialist, because the template
+ * follows the step: the planner binds a template to a step from the
+ * recommendation and routes that step to whichever specialist owns its data
+ * object. The tool acts only on the template the step grounding names, thus
+ * a step without a template costs nothing, and it attaches only when the
+ * embedder binds a knowledge client (see the registry below).
  */
 export declare const BASE_SANDBOX_TOOLS: readonly SandboxToolName[];
 /** Per-step coordinates the composition root threads through every mutate tool. */
@@ -48,6 +56,12 @@ export interface SandboxStepCoords {
     readonly allowedWritePrefix: string;
     /** Absolute unix-ms deadline of each exec. */
     readonly deadlineMs: () => number;
+    /**
+     * The plan settings bound to the template of this step, from the durable
+     * step input. Reaches `knowledge_template` alone. Absent when the step
+     * grounds on no template, or when the host bound nothing.
+     */
+    readonly templateBinding?: TemplateBinding;
 }
 /** The shared dependency graph every sandbox agent draws from. */
 export interface SandboxAgentDeps extends EnvironmentStorePaths {
@@ -95,6 +109,13 @@ export interface SandboxAgentDeps extends EnvironmentStorePaths {
      * and the package-link prompt layer appends. Without it, neither exists.
      */
     readonly extendAnalysisFarm?: ExtendAnalysisFarm;
+    /**
+     * The knowledge service client. Bound, an agent that declares
+     * `knowledgeTemplate` gets the tool, over the same mutator as `write_file`.
+     * Absent, the declaration resolves to nothing, which is the default state
+     * of the open-source host and never an error.
+     */
+    readonly knowledge?: KnowledgeClient;
 }
 /** Per-agent override for the prompt composition and tool surface. */
 export interface SandboxAgentPromptOptions {

package/dist/agents/sandbox/shared.js

@@ -42,19 +42,34 @@ import { createSubmitFileMetadataTool } from "../../tools/sandbox/submit-file-me
 import { toSandboxPath } from "../../workspace/paths.js";
 import { SANDBOX_AGENT_DEFAULT_MAX_ITERATIONS } from "./types.js";
 import { createResolveCitationTool } from "../../tools/research/resolve-citation.js";
+import { createKnowledgeTemplateTool } from "../../tools/knowledge/index.js";
 /**
  * Tools every sandbox agent receives — sandbox-environment introspection,
- * library docs, and run inspection. Spread into each agent's
- * `meta.tools` so planner-facing metadata and the resolved tool record
+ * library docs, run inspection, and the knowledge template. Spread into each
+ * agent's `meta.tools` so planner-facing metadata and the resolved tool record
  * stay in sync. Keep minimal — only tools every agent genuinely needs.
+ *
+ * The knowledge template is here, not on a specialist, because the template
+ * follows the step: the planner binds a template to a step from the
+ * recommendation and routes that step to whichever specialist owns its data
+ * object. The tool acts only on the template the step grounding names, thus
+ * a step without a template costs nothing, and it attaches only when the
+ * embedder binds a knowledge client (see the registry below).
  */
-export const BASE_SANDBOX_TOOLS = ["listAvailablePackages", "listAvailableRefs", "resolveLibraryId", "queryDocs", "inspectRun"];
+export const BASE_SANDBOX_TOOLS = [
+    "listAvailablePackages",
+    "listAvailableRefs",
+    "resolveLibraryId",
+    "queryDocs",
+    "inspectRun",
+    "knowledgeTemplate",
+];
 /**
  * Resolve `meta.tools` into the bio/research tools record. The workspace
  * read/mutate tools and `inspect_data_profile` are added by `createSandboxAgent`
  * regardless of meta — they are the always-on substrate, not in the allowlist.
  */
-function resolveSandboxTools(deps, tools) {
+function resolveSandboxTools(deps, tools, mutator) {
     const ncbi = createNcbiTools(deps.bioKeys);
     const chemDb = createChemDbTools(deps.bioKeys, { ...(deps.logger ? { logger: deps.logger } : {}) });
     const amass = createAmassTools(deps.bioKeys);
@@ -97,6 +112,15 @@ function resolveSandboxTools(deps, tools) {
         searchRegulatoryApprovals: amass.regulatoryApprovals,
         targetSafety: targetSafetyTool,
         comptox: chemDb.comptox,
+        knowledgeTemplate: deps.knowledge && mutator
+            ? createKnowledgeTemplateTool({
+                client: deps.knowledge,
+                mutator,
+                ...(deps.farmLockFile ? { farmLockFile: deps.farmLockFile } : {}),
+                ...(deps.imagePackagesFile ? { imagePackagesFile: deps.imagePackagesFile } : {}),
+                ...(deps.step.templateBinding ? { binding: deps.step.templateBinding } : {}),
+            })
+            : undefined,
     };
     const seen = new Set();
     const resolved = [];
@@ -105,6 +129,12 @@ function resolveSandboxTools(deps, tools) {
             continue;
         seen.add(name);
         const tool = registry[name];
+        // The knowledge template is the one optional member of the allowlist: every
+        // agent lists it through BASE_SANDBOX_TOOLS, and it attaches only when the
+        // embedder binds a client and the agent can write. Absence is a normal
+        // state, not a wiring fault.
+        if (name === "knowledgeTemplate" && !tool)
+            continue;
         if (!tool) {
             throw new Error(`createSandboxAgent: unknown SandboxToolName "${name}" — ` + `agent meta references a tool with no harness implementation.`);
         }
@@ -124,24 +154,25 @@ function buildWorkspaceTools(deps, readOnly) {
     // it is correct for non-step agents such as the data profiler too.
     const hostWorkingDir = step.allowedWritePrefix;
     const sandboxWorkingDir = toSandboxPath(step.workspaceRoot, step.analysisId, hostWorkingDir);
-    const mutateTools = readOnly
-        ? []
-        : (() => {
-            const mutator = createWorkspaceMutator({
-                workspaceRoot: step.workspaceRoot,
-                analysisId: step.analysisId,
-                workingDir: hostWorkingDir,
-                ...(lineageCollector ? { lineageCollector } : {}),
-            });
-            return [createWriteFileTool({ mutator }), createEditFileTool({ mutator, workspaceFilesystem: workspaceFs, workingDir: hostWorkingDir })];
-        })();
-    return [
+    const mutator = readOnly
+        ? undefined
+        : createWorkspaceMutator({
+            workspaceRoot: step.workspaceRoot,
+            analysisId: step.analysisId,
+            workingDir: hostWorkingDir,
+            ...(lineageCollector ? { lineageCollector } : {}),
+        });
+    const mutateTools = mutator
+        ? [createWriteFileTool({ mutator }), createEditFileTool({ mutator, workspaceFilesystem: workspaceFs, workingDir: hostWorkingDir })]
+        : [];
+    const tools = [
         createExecuteCommandTool({
             sandboxClient,
             sandbox: step.sandbox,
             deadlineMs: step.deadlineMs,
             defaultCwd: sandboxWorkingDir,
             ...(lineageCollector ? { lineageCollector, mountRoot: `/${step.analysisId}` } : {}),
+            ...(mutator ? { workspaceFilesystem: workspaceFs, mutator } : {}),
         }),
         ...mutateTools,
         createReadFileTool(workspaceFs, hostWorkingDir),
@@ -150,6 +181,7 @@ function buildWorkspaceTools(deps, readOnly) {
         createGrepTool(workspaceFs, hostWorkingDir),
         ...(embedding ? [createWorkspaceSearchTool(pool, embedding)] : []),
     ];
+    return { tools, mutator };
 }
 /**
  * Build one sandbox `AgentDefinition`. The system prompt is composed once
@@ -185,8 +217,9 @@ export function createSandboxAgent(deps, meta, body, opts = {}) {
     const agentBody = [body, ...sandboxLayer].map((s) => s.trim()).join("\n\n");
     const systemPrompt = composeSystemPrompt(agentBody);
     const skillTools = deps.skillsDir ? Object.values(createSkillTools({ skillsDir: deps.skillsDir, skills: meta.skills })) : [];
+    const workspace = buildWorkspaceTools(deps, opts.readOnly ?? false);
     const tools = [
-        ...buildWorkspaceTools(deps, opts.readOnly ?? false),
+        ...workspace.tools,
         ...(deps.toolOutputStore ? [createReadToolOutputTool(deps.toolOutputStore)] : []),
         // Always-on, not in the `meta.tools` allowlist: the data profile is the only
         // record of what the analysis's input dataset IS, and no file carries it (the
@@ -199,7 +232,7 @@ export function createSandboxAgent(deps, meta, body, opts = {}) {
         // seam (the harness-sandbox-agents spec).
         ...(deps.extendAnalysisFarm ? [createLinkPackagesTool({ extendAnalysisFarm: deps.extendAnalysisFarm, analysisId: deps.step.analysisId })] : []),
         ...skillTools,
-        ...resolveSandboxTools(deps, meta.tools),
+        ...resolveSandboxTools(deps, meta.tools, workspace.mutator),
         ...(deps.blockerHolder ? [createReportBlockerTool(deps.blockerHolder)] : []),
         ...(deps.fileMetadata ? [createSubmitFileMetadataTool(deps.fileMetadata)] : []),
     ];

package/dist/agents/sandbox/translational-safety-agent.js

@@ -3,6 +3,11 @@
  */
 import { translationalSafetyAgentPrompt } from "../../prompts/sandbox/translational-safety-agent.js";
 import { BASE_SANDBOX_TOOLS, createSandboxAgent } from "./shared.js";
+/**
+ * Named once, because the capability phrase is the key of its own data requirement below and a
+ * plan step copies it verbatim. Two spellings of one capability would lose the pre-launch check.
+ */
+const MATCHED_NEGATIVE_CAPABILITY = "matched negative gene set for a tissue risk benchmark (annotation_free or tested_clean negatives) matched on tissue expression and PPI connectivity with mouse and human phenotype annotation exclusions";
 export const meta = {
     id: "translational-safety-agent",
     capabilities: [
@@ -20,6 +25,8 @@ export const meta = {
         "hematological toxicity assessment",
         "mouse KO phenotype lookup",
         "cross-species baseline expression lookup",
+        MATCHED_NEGATIVE_CAPABILITY,
+        "expression and PPI connectivity matching",
     ],
     suitableFor: [
         "safety-biomarkers",
@@ -29,6 +36,25 @@ export const meta = {
         "clinical-safety-labs",
         "drug-interaction-data",
         "pharmacogenomic-data",
+        "gene-lists",
+    ],
+    // The method of this capability reads six opt-in datasets. Without any one of them a negatives
+    // file would carry a label the run cannot defend, so the launch refuses rather than spend a run.
+    // The recommended datasets it also reads (the expression table, the network, the gene tables,
+    // the GO collection) stay out: a default store holds them, and declaring one would refuse a
+    // launch an embedder already provisioned.
+    dataRequirements: [
+        {
+            capability: MATCHED_NEGATIVE_CAPABILITY,
+            datasets: [
+                "string-aliases-human",
+                "mgi-mouse-human-homology",
+                "impc-phenotyping",
+                "hpo-annotations",
+                "opentargets-mouse-phenotype",
+                "opentargets-target-safety-event",
+            ],
+        },
     ],
     skills: ["translational-safety", "cheminformatics", "shared/omics-general"],
     tools: [

package/dist/agents/sandbox/types.d.ts

@@ -12,7 +12,21 @@
  * in the tool's `perSource` report; the rest of the call still answers.
  */
 /** Closed allowlist of tools any sandbox agent may declare. */
-export type SandboxToolName = "listAvailablePackages" | "listAvailableRefs" | "scanInputs" | "resolveLibraryId" | "queryDocs" | "inspectRun" | "pubmed" | "resolve_citation" | "searchGene" | "lookupAnnotation" | "searchInteractions" | "chembl" | "pubchem" | "opentargets" | "geneDiseaseEvidence" | "drugGeneInteractions" | "genePreclinicalProfile" | "searchFaers" | "searchClinicalTrials" | "searchGeoDatasets" | "searchRegulatoryApprovals" | "targetSafety" | "comptox";
+export type SandboxToolName = "listAvailablePackages" | "listAvailableRefs" | "scanInputs" | "resolveLibraryId" | "queryDocs" | "inspectRun" | "pubmed" | "resolve_citation" | "searchGene" | "lookupAnnotation" | "searchInteractions" | "chembl" | "pubchem" | "opentargets" | "geneDiseaseEvidence" | "drugGeneInteractions" | "genePreclinicalProfile" | "searchFaers" | "searchClinicalTrials" | "searchGeoDatasets" | "searchRegulatoryApprovals" | "targetSafety" | "comptox" | "knowledgeTemplate";
+/**
+ * The reference datasets that one capability of one agent cannot run without.
+ *
+ * A requirement belongs to a capability, never to the agent: an agent holds capabilities that need
+ * no reference data at all, so an agent-wide requirement would refuse a step that needs nothing.
+ * The skill of the agent still states what the data IS and how to use it. This states which catalog
+ * entry carries it, in a form a test can pin.
+ */
+export interface CapabilityDataRequirement {
+    /** One phrase of the same agent's `capabilities`, verbatim — the step copies it from the catalog. */
+    readonly capability: string;
+    /** Reference-catalog dataset ids. Declare only an opt-in dataset: a recommended one is already in a default store. */
+    readonly datasets: readonly string[];
+}
 /** Planner-facing metadata + tool allowlist for one sandbox agent. */
 export interface AgentMeta {
     /** Stable agent id — also the key in the catalog and the `AgentDefinition.id`. */
@@ -29,6 +43,15 @@ export interface AgentMeta {
     readonly defaultMaxSteps?: number;
     /** False for agents the planner must NOT assign to plan steps (executors, the profiler). */
     readonly plannable?: boolean;
+    /**
+     * Per-capability reference-data requirements. Omitted by an agent whose capabilities all run on
+     * what a default store holds.
+     *
+     * The pre-launch pass resolves these against the live store, so an absent dataset refuses the
+     * launch instead of costing a run. The planner-facing projection deliberately drops this field:
+     * a prompt names no dataset, so the ids reach a caller through a tool and the launch through here.
+     */
+    readonly dataRequirements?: readonly CapabilityDataRequirement[];
 }
 /** Default runaway-guard for sandbox agents. */
 export declare const SANDBOX_AGENT_DEFAULT_MAX_ITERATIONS = 200;

package/dist/agents/sandbox-catalog.d.ts

@@ -15,6 +15,20 @@ export interface PlannerAgentMeta {
 }
 /** The sandbox agents the planner may assign to analysis-plan steps. */
 export declare const PLANNABLE_AGENT_CATALOG: readonly PlannerAgentMeta[];
+/**
+ * The reference datasets one capability of one agent cannot run without, by catalog id.
+ *
+ * Empty for an unknown agent, for an agent that declares nothing, and for a phrase no declaration
+ * matches. An unmatched phrase must NOT refuse a launch: the pass can only demand what a
+ * declaration states, so a paraphrased phrase degrades to the behaviour of a step with no phrase.
+ */
+export declare function capabilityDataRequirement(agentId: string, capability: string): readonly string[];
+/** Every declared requirement, for a caller that asks what a capability wants before it plans. */
+export declare function declaredDataRequirements(): readonly {
+    agentId: string;
+    capability: string;
+    datasets: readonly string[];
+}[];
 /**
  * Ids of the agents the planner may assign — the `z.enum` domain for
  * `PlanStepSchema.agent`. A non-empty tuple, as `z.enum` requires.

package/dist/agents/sandbox-catalog.js

@@ -16,6 +16,25 @@ export const PLANNABLE_AGENT_CATALOG = Object.values(SANDBOX_AGENT_META)
     capabilities: [...meta.capabilities],
     suitableFor: [...meta.suitableFor],
 }));
+/**
+ * The reference datasets one capability of one agent cannot run without, by catalog id.
+ *
+ * Empty for an unknown agent, for an agent that declares nothing, and for a phrase no declaration
+ * matches. An unmatched phrase must NOT refuse a launch: the pass can only demand what a
+ * declaration states, so a paraphrased phrase degrades to the behaviour of a step with no phrase.
+ */
+export function capabilityDataRequirement(agentId, capability) {
+    const entry = SANDBOX_AGENT_META[agentId]?.dataRequirements?.find((requirement) => requirement.capability === capability);
+    return entry?.datasets ?? [];
+}
+/** Every declared requirement, for a caller that asks what a capability wants before it plans. */
+export function declaredDataRequirements() {
+    return Object.values(SANDBOX_AGENT_META).flatMap((meta) => (meta.dataRequirements ?? []).map((requirement) => ({
+        agentId: meta.id,
+        capability: requirement.capability,
+        datasets: requirement.datasets,
+    })));
+}
 /**
  * Ids of the agents the planner may assign — the `z.enum` domain for
  * `PlanStepSchema.agent`. A non-empty tuple, as `z.enum` requires.

package/dist/app/approve-plan.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Approve a stored plan by its id, with no model call.
+ *
+ * A host calls this when a person approves a plan. The function refuses a thread or a plan that does
+ * not belong to the analysis, and a plan that a newer plan replaced. Then it starts the run of the plan,
+ * emits the `approve-plan` provenance event, and appends one record to the thread. The record tells the
+ * model that the run started, and it shows the person the approval and the run card.
+ *
+ * The function is an API boundary: it gives a `Result` for each outcome and never rejects for one. The
+ * host gives the identity and the auth of the session, because the harness forwards the auth and never
+ * mints it. The harness gives the provenance of the session.
+ */
+import { ResultAsync } from "neverthrow";
+import type { AuthContext, Identity } from "../auth/types.js";
+import type { ChatMessage } from "../contracts/message.js";
+import { type ProvenanceSeam } from "../provenance/seam.js";
+import { type LaunchPlanRunDeps, type LaunchPlanRunRefusal } from "../tools/execute-analysis.js";
+/** The deps of an approval: the deps of the launch, and the provenance sink of the host. */
+export type ApprovePlanDeps = LaunchPlanRunDeps & {
+    readonly provenance?: ProvenanceSeam;
+};
+export type ApprovePlanInput = {
+    analysisId: string;
+    threadId: string;
+    planId: string;
+    /** The newest run of the plan in the view that the person approved, or `null` when that view showed no run. */
+    newestRunId: string | null;
+    identity: Identity;
+    auth: AuthContext;
+};
+/**
+ * The outcome of an approval. `started` is false when a run of the plan was already active, or when the
+ * view of the person was stale: the approval then changed nothing, `runId` names the active run or the
+ * newest run of the plan, and `message` is `null`. `message` is also `null` when the record
+ * could not be appended, because the run started anyway. It has no `createdAt`: the transcript read
+ * adds the time of the row.
+ */
+export type PlanApproval = {
+    planId: string;
+    runId: string;
+    started: boolean;
+    message: ChatMessage | null;
+};
+export type ApprovePlanRefusal = LaunchPlanRunRefusal | {
+    type: "thread_not_found";
+} | {
+    type: "superseded";
+    supersededBy: string;
+};
+/** Approve the plan `planId` on the thread `threadId` of the analysis, and start its run. */
+export declare function approvePlan(deps: ApprovePlanDeps, input: ApprovePlanInput): ResultAsync<PlanApproval, ApprovePlanRefusal>;

package/dist/app/approve-plan.js

@@ -0,0 +1,84 @@
+/**
+ * Approve a stored plan by its id, with no model call.
+ *
+ * A host calls this when a person approves a plan. The function refuses a thread or a plan that does
+ * not belong to the analysis, and a plan that a newer plan replaced. Then it starts the run of the plan,
+ * emits the `approve-plan` provenance event, and appends one record to the thread. The record tells the
+ * model that the run started, and it shows the person the approval and the run card.
+ *
+ * The function is an API boundary: it gives a `Result` for each outcome and never rejects for one. The
+ * host gives the identity and the auth of the session, because the harness forwards the auth and never
+ * mints it. The harness gives the provenance of the session.
+ */
+import { ResultAsync, err, ok } from "neverthrow";
+import { createNoopLogger } from "../lib/console-logger.js";
+import { buildRunCardData } from "../memory/card-builders.js";
+import { conversationUIToChatMessages } from "../memory/conversation-display-storage.js";
+import { conversationRecordTurn, createThreadHistory } from "../memory/thread-history.js";
+import { createThreadStore } from "../memory/thread-store.js";
+import { bindSessionEmit } from "../provenance/seam.js";
+import { loadPlanRecord } from "../state/index.js";
+import { launchPlanRun } from "../tools/execute-analysis.js";
+const APPROVAL_PROVENANCE = { agentId: "plan-approval", callPath: ["plan-approval"] };
+function storeFailed(cause) {
+    return err({ type: "store_failed", cause });
+}
+/** The refusals that need no launch: a thread or a plan that does not belong, and a replaced plan. */
+async function checkApprovable(deps, input) {
+    const read = await ResultAsync.combine([
+        createThreadStore(deps.pool).getThread(input.threadId),
+        loadPlanRecord(deps.pool, input.planId, { analysisId: input.analysisId }),
+    ]);
+    if (read.isErr())
+        return storeFailed(read.error);
+    const [thread, record] = read.value;
+    if (thread === null || thread.analysisId !== input.analysisId)
+        return err({ type: "thread_not_found" });
+    if (record === null)
+        return err({ type: "plan_not_found", planId: input.planId });
+    if (record.supersededBy !== null)
+        return err({ type: "superseded", supersededBy: record.supersededBy });
+    return ok(undefined);
+}
+async function approve(deps, input) {
+    const logger = (deps.logger ?? createNoopLogger()).named("approve-plan");
+    const { analysisId, threadId, planId } = input;
+    const approvable = await checkApprovable(deps, input);
+    if (approvable.isErr())
+        return err(approvable.error);
+    // Read before the launch: the kernel writes the approval at this time, and the run writes
+    // `run_started` from its workflow body after the launch, so the approval precedes the start.
+    const approvedAtMs = Date.now();
+    const session = {
+        identity: input.identity,
+        auth: input.auth,
+        scope: { kind: "analysis", analysisId, threadId },
+        provenance: APPROVAL_PROVENANCE,
+    };
+    const launched = await launchPlanRun(deps, { session, planId, newestRunId: input.newestRunId });
+    if (launched.isErr())
+        return err(launched.error);
+    const { runId, started } = launched.value;
+    if (!started)
+        return ok({ planId, runId, started: false, message: null });
+    bindSessionEmit(deps.provenance, logger)({ type: "approve-plan", analysisId, threadId, planId, runId, atMs: approvedAtMs });
+    const card = await buildRunCardData(deps.pool, { planId, analysisId, runId }).match((data) => data, (cause) => {
+        logger.error("the run card of an approval could not be read", { analysisId, threadId, planId, runId, ...logger.errorFields(cause) });
+        return null;
+    });
+    const approval = { type: "data-plan-approval", planId, runId, approvedAt: new Date(approvedAtMs).toISOString() };
+    const turn = conversationRecordTurn(`The person approved plan ${planId}. Run ${runId} started.`, [
+        approval,
+        ...(card === null ? [] : [{ type: "data-run-card", ...card }]),
+    ]);
+    const appended = await createThreadHistory(deps.pool, logger).appendTurn(threadId, turn);
+    if (appended.isErr()) {
+        logger.error("the approval record could not be appended", { analysisId, threadId, planId, runId, ...logger.errorFields(appended.error) });
+        return ok({ planId, runId, started: true, message: null });
+    }
+    return ok({ planId, runId, started: true, message: conversationUIToChatMessages(turn.displayMessages)[0] ?? null });
+}
+/** Approve the plan `planId` on the thread `threadId` of the analysis, and start its run. */
+export function approvePlan(deps, input) {
+    return new ResultAsync(approve(deps, input));
+}

package/dist/app/chat-turn.js

@@ -4,6 +4,7 @@
  * values, and the harness stores the opening, each round, and the outcome.
  */
 import { unwrapOrThrow } from "../lib/result.js";
+import { rulesForContextWindow } from "../loop/compaction.js";
 import { finalText, runAgent } from "../loop/run-agent.js";
 import { passthroughStep } from "../loop/run-step.js";
 import { compactionExchangeOf, syntheticUserMessage } from "../memory/ai-sdk-message-storage.js";
@@ -244,10 +245,12 @@ function compactionPolicy(deps, analysisId, params, threadType, agent, emit) {
     // A report thread reads a frozen copy of the working memory, thus its agent declares no memory tool.
     const remembers = agent.tools.some((tool) => tool.id === WORKING_MEMORY_TOOL_ID);
     const workingMemory = createWorkingMemory(deps.pool);
+    // A streaming provider sends each text delta with no source, thus a delta of the summary would show as a reply.
+    const provider = params.chat((event) => (event.type === "text-delta" ? undefined : emit(event)));
     return {
-        ...agent.compaction,
-        // A streaming provider sends each text delta with no source, thus a delta of the summary would show as a reply.
-        provider: params.chat((event) => (event.type === "text-delta" ? undefined : emit(event))),
+        // The capabilities are read for each turn, because a host can switch the model of the conversation between turns.
+        ...rulesForContextWindow(agent.compaction, provider.capabilities.contextWindow),
+        provider,
         request: remembers ? MEMORY_COMPACTION_REQUEST : SUMMARY_COMPACTION_REQUEST,
         mask: remembers ? { allow: [WORKING_MEMORY_TOOL_ID] } : "none",
         keepFirstTurn: threadType === "report",

package/dist/app/data-profile-view.d.ts

@@ -65,6 +65,6 @@ export declare function profileFileRecords(result: DataProfileResult): DataProfi
  * rows fall back to coverage, then to summed kind counts, then to `null`: reporting the
  * described-file count would be a dataset size the row cannot support.
  */
-export declare function profileDatasetFileCount(result: DataProfileResult): number | null;
+export declare function profileDatasetFileCount(result: Pick<DataProfileResult, "partition" | "coverage" | "kinds">): number | null;
 /** Dataset-wide findings the agent wrote, from whichever field the snapshot carries them in. */
 export declare function profileCaveats(result: DataProfileResult): string[];

package/dist/app/run-activity.js

@@ -4,21 +4,19 @@
  */
 /** Maximum detailed run rows paid into every conversation turn. */
 export const RUN_ACTIVITY_DETAIL_LIMIT = 20;
-function renderRows(label, rows) {
+function renderRows(rows) {
     if (rows.length === 0)
         return [];
-    return [`${label}:`, ...rows.map((run) => `- runId: ${run.runId} | planId: ${run.planId ?? "none"} | startedAt: ${run.startedAt}`)];
+    return ["Running:", ...rows.map((run) => `- runId: ${run.runId} | planId: ${run.planId ?? "none"} | startedAt: ${run.startedAt}`)];
 }
 /** Render the bounded run-activity snapshot of a conversation turn. */
 export function renderRunActivity(activity) {
     const lines = ["[Run Activity]"];
     if (activity.total === 0) {
-        lines.push("No runs are currently running or suspended.");
+        lines.push("No runs are currently running.");
         return lines.join("\n");
     }
-    const running = activity.runs.filter((run) => run.status === "running");
-    const suspended = activity.runs.filter((run) => run.status === "suspended_insufficient_funds");
-    lines.push(...renderRows("Running", running), ...renderRows("Suspended", suspended));
+    lines.push(...renderRows(activity.runs.filter((run) => run.status === "running")));
     const omitted = activity.total - activity.runs.length;
     if (omitted > 0) {
         lines.push(`Showing ${activity.runs.length} of ${activity.total} non-terminal runs; ${omitted} omitted. Use inspect_run to page the full list.`);

package/dist/config/environment-stores.d.ts

@@ -49,8 +49,10 @@ export interface EnvironmentStorePaths {
     readonly farmLockFile?: string | ((analysisId: string) => string);
     /**
      * Host path of the image inventory record, `image-packages.json` at the
-     * root of the package store — the image-owned tools and Node packages
-     * that `list_available_packages` merges into its report. Omit when the
+     * root of the package store — the image-owned tools, the Node packages,
+     * and the R packages that ship with the R runtime, which
+     * `list_available_packages` merges into its report and which the
+     * knowledge tools read for the environment of a step. Omit when the
      * host's own process sees the store at the container mountpoint, which
      * makes `/mnt/libs/image-packages.json` correct as-is; set it when the
      * host reads the store somewhere else. An absent or invalid record