@kitman-sh/sdk 0.6.0 → 0.7.0

package/dist/loop/index.js

@@ -94,7 +94,7 @@ import {
   LoopCheckError2,
   checkLoop2,
   defineConfig2
-} from "../chunk-jnxc0c54.js";
+} from "../chunk-zp7s46pz.js";
 export {
   ArtifactActivity2 as ArtifactActivity,
   ArtifactRequest2 as ArtifactRequest,

package/dist/program/index.js

@@ -1,5 +1,5 @@
 // @bun
-import"../chunk-jnxc0c54.js";
+import"../chunk-zp7s46pz.js";
 import {
   JournalWriteFailed2,
   refusedStep2,
@@ -9,16 +9,22 @@ import {
   describeFlag2,
   Described2,
   programSecrets2,
+  programHostsEnv2,
+  undeclaredHostsEnv2,
+  networkGuard2,
   runPackage2
-} from "../chunk-f3d6cvkg.js";
+} from "../chunk-7hwhxthh.js";
 export {
   Described2 as Described,
   JournalWriteFailed2 as JournalWriteFailed,
   describeFlag2 as describeFlag,
+  networkGuard2 as networkGuard,
+  programHostsEnv2 as programHostsEnv,
   programLease2 as programLease,
   programSecrets2 as programSecrets,
   refusedStep2 as refusedStep,
   rpcProgramJournal2 as rpcProgramJournal,
   runPackage2 as runPackage,
-  runProgram2 as runProgram
+  runProgram2 as runProgram,
+  undeclaredHostsEnv2 as undeclaredHostsEnv
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitman-sh/sdk",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "type": "module",
   "license": "UNLICENSED",
   "exports": {

package/types/packages/core/src/agent-capabilities.d.ts

@@ -32,6 +32,7 @@ export declare const KitmanAgentCapabilities: readonly [{
             readonly sourceType: Schema.Literal<"manual">;
             readonly openTaskCount: Schema.Int;
             readonly blockedTaskCount: Schema.Int;
+            readonly createdAt: Schema.String;
             readonly updatedAt: Schema.String;
         }>>;
     }>;
@@ -58,6 +59,7 @@ export declare const KitmanAgentCapabilities: readonly [{
             readonly sourceType: Schema.Literal<"manual">;
             readonly openTaskCount: Schema.Int;
             readonly blockedTaskCount: Schema.Int;
+            readonly createdAt: Schema.String;
             readonly updatedAt: Schema.String;
         }>>;
     }>;
@@ -286,6 +288,10 @@ export declare const KitmanAgentCapabilities: readonly [{
                 readonly kind: Schema.Literal<"ssh_agent">;
             }>]>>;
             readonly status: Schema.Union<readonly [Schema.Literal<"active">, Schema.Literal<"disabled">]>;
+            readonly webhook: Schema.optionalKey<Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["active", "missing"]>;
+                readonly message: Schema.optionalKey<Schema.String>;
+            }>>;
             readonly createdAt: Schema.String;
             readonly updatedAt: Schema.String;
         }>>;
@@ -351,6 +357,10 @@ export declare const KitmanAgentCapabilities: readonly [{
                 readonly kind: Schema.Literal<"ssh_agent">;
             }>]>>;
             readonly status: Schema.Union<readonly [Schema.Literal<"active">, Schema.Literal<"disabled">]>;
+            readonly webhook: Schema.optionalKey<Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["active", "missing"]>;
+                readonly message: Schema.optionalKey<Schema.String>;
+            }>>;
             readonly createdAt: Schema.String;
             readonly updatedAt: Schema.String;
         }>;

package/types/packages/core/src/agent-sandbox-policy.d.ts

@@ -8,6 +8,8 @@ export declare const AgentSandboxPolicy: Schema.Struct<{
     readonly writablePaths: Schema.$Array<Schema.String>;
     /** `~` is the Runner user's home directory. */
     readonly readDeniedPaths: Schema.$Array<Schema.String>;
+    /** Readable again inside `readDeniedPaths`; a denied path within one stays denied. */
+    readonly readAllowedPaths: Schema.$Array<Schema.String>;
     readonly network: Schema.Union<readonly [Schema.Struct<{
         readonly hosts: Schema.$Array<Schema.String>;
     }>, Schema.Literal<"open">]>;

package/types/packages/core/src/enterprise-code-host.d.ts

@@ -1,11 +1,8 @@
-import type { CodeHostCapability } from './integration';
+import { type CodeHostCapability } from './integration';
 type EnterpriseCodeHostSetup = {
     readonly provider: 'github' | 'gitlab';
     readonly host: string;
-    readonly administratorOwned: boolean;
-    readonly allowedHosts: readonly string[];
-    readonly tls: {
-        readonly verified: boolean;
+    readonly tls?: {
         readonly customCaRef?: string;
     };
     readonly capabilities: readonly CodeHostCapability[];

package/types/packages/core/src/integration.d.ts

@@ -1,22 +1,21 @@
 import * as Schema from 'effect/Schema';
 export declare const ChangeRequestProvider: Schema.Literals<readonly ["github", "gitlab"]>;
 export declare const CodeHostCapability: Schema.Literals<readonly ["repository_read", "repository_write", "change_request_read", "change_request_write", "check_write", "webhook_manage"]>;
+/** The environment variables a code-host connection may name for its custom CA. */
+export declare const customCaReferencePattern: RegExp;
 export declare const CodeHostConnection: Schema.Struct<{
     readonly id: Schema.String;
     readonly workspaceId: Schema.String;
     readonly provider: Schema.Literals<readonly ["github", "gitlab"]>;
     readonly host: Schema.String;
-    readonly authKind: Schema.Literals<readonly ["github_app", "gitlab_personal_access_token", "gitlab_group_token", "gitlab_project_token"]>;
+    readonly authKind: Schema.Literals<readonly ["github_app", "gitlab_personal_access_token", "gitlab_group_token", "gitlab_project_token", "gitlab_oauth"]>;
     readonly status: Schema.Literals<readonly ["connected", "degraded", "disconnected"]>;
     readonly externalAccountId: Schema.optionalKey<Schema.String>;
     readonly externalAccountLogin: Schema.optionalKey<Schema.String>;
     readonly capabilities: Schema.$Array<Schema.Literals<readonly ["repository_read", "repository_write", "change_request_read", "change_request_write", "check_write", "webhook_manage"]>>;
     readonly credentialConfigured: Schema.Boolean;
     readonly webhookActive: Schema.Boolean;
-    readonly administratorOwned: Schema.Boolean;
-    readonly allowedHosts: Schema.$Array<Schema.String>;
     readonly tls: Schema.Struct<{
-        readonly verified: Schema.Literal<true>;
         readonly customCaRef: Schema.optionalKey<Schema.String>;
     }>;
     readonly supportEvidence: Schema.$Array<Schema.Struct<{
@@ -37,17 +36,14 @@ export declare const CodeHostConnectionList: Schema.Struct<{
         readonly workspaceId: Schema.String;
         readonly provider: Schema.Literals<readonly ["github", "gitlab"]>;
         readonly host: Schema.String;
-        readonly authKind: Schema.Literals<readonly ["github_app", "gitlab_personal_access_token", "gitlab_group_token", "gitlab_project_token"]>;
+        readonly authKind: Schema.Literals<readonly ["github_app", "gitlab_personal_access_token", "gitlab_group_token", "gitlab_project_token", "gitlab_oauth"]>;
         readonly status: Schema.Literals<readonly ["connected", "degraded", "disconnected"]>;
         readonly externalAccountId: Schema.optionalKey<Schema.String>;
         readonly externalAccountLogin: Schema.optionalKey<Schema.String>;
         readonly capabilities: Schema.$Array<Schema.Literals<readonly ["repository_read", "repository_write", "change_request_read", "change_request_write", "check_write", "webhook_manage"]>>;
         readonly credentialConfigured: Schema.Boolean;
         readonly webhookActive: Schema.Boolean;
-        readonly administratorOwned: Schema.Boolean;
-        readonly allowedHosts: Schema.$Array<Schema.String>;
         readonly tls: Schema.Struct<{
-            readonly verified: Schema.Literal<true>;
             readonly customCaRef: Schema.optionalKey<Schema.String>;
         }>;
         readonly supportEvidence: Schema.$Array<Schema.Struct<{
@@ -77,22 +73,43 @@ export declare const CodeHostConnectionWrite: Schema.Struct<{
     readonly expiresAt: Schema.optionalKey<Schema.String>;
     readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly webhookActive: Schema.optionalKey<Schema.Boolean>;
-    readonly administratorOwned: Schema.optionalKey<Schema.Boolean>;
-    readonly allowedHosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly tls: Schema.optionalKey<Schema.Struct<{
-        readonly verified: Schema.Literal<true>;
         readonly customCaRef: Schema.optionalKey<Schema.String>;
     }>>;
 }>;
+/** Where to send the person to install the deployment's GitHub App, carrying a signed `state`. */
+export declare const GithubConnectStart: Schema.Struct<{
+    readonly url: Schema.String;
+}>;
+/** What GitHub hands back to the App's setup URL after an installation. */
+export declare const GithubConnectComplete: Schema.Struct<{
+    readonly state: Schema.optionalKey<Schema.String>;
+    readonly code: Schema.optionalKey<Schema.String>;
+    readonly installationId: Schema.String;
+}>;
+export declare const GitlabConnectStart: Schema.Struct<{
+    readonly url: Schema.String;
+}>;
+/** What GitLab hands back to the OAuth redirect after the person authorizes Kitman. */
+export declare const GitlabConnectComplete: Schema.Struct<{
+    readonly state: Schema.String;
+    readonly code: Schema.String;
+}>;
+/** The scopes a GitLab token needs for everything Kitman does with it, webhooks included. */
+export declare const GitlabTokenScopes: readonly ['api'];
+/** The instance's new personal access token page, with Kitman's name and scopes filled in. */
+export declare function gitlabTokenPageUrl(host: string): string;
 export declare const CodeHostRepository: Schema.Struct<{
     readonly providerRepositoryId: Schema.String;
     readonly provider: Schema.Literals<readonly ["github", "gitlab"]>;
     readonly host: Schema.String;
     readonly owner: Schema.String;
     readonly name: Schema.String;
+    readonly fullPath: Schema.String;
     readonly repositoryUrl: Schema.String;
     readonly defaultTargetBranch: Schema.String;
 }>;
+/** One page of the repositories a connection reaches, each saying whether the Workspace has bound it already. */
 export declare const CodeHostRepositoryList: Schema.Struct<{
     readonly items: Schema.$Array<Schema.Struct<{
         readonly providerRepositoryId: Schema.String;
@@ -100,8 +117,102 @@ export declare const CodeHostRepositoryList: Schema.Struct<{
         readonly host: Schema.String;
         readonly owner: Schema.String;
         readonly name: Schema.String;
+        readonly fullPath: Schema.String;
         readonly repositoryUrl: Schema.String;
         readonly defaultTargetBranch: Schema.String;
+        readonly bound: Schema.Boolean;
+    }>>;
+    readonly nextPage: Schema.optionalKey<Schema.Int>;
+}>;
+/** Repositories, by full path, to bind into one Project: an existing one, or a new one of this name. */
+export declare const CodeHostRepositoryBind: Schema.Struct<{
+    readonly repositories: Schema.$Array<Schema.String>;
+    readonly project: Schema.Union<readonly [Schema.Struct<{
+        readonly projectId: Schema.String;
+    }>, Schema.Struct<{
+        readonly name: Schema.String;
+    }>]>;
+}>;
+/** The Project the repositories joined, those bound now, and those the Workspace had bound already and kept as they were. */
+export declare const CodeHostRepositoryBindResult: Schema.Struct<{
+    readonly project: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly name: Schema.String;
+        readonly slug: Schema.String;
+        readonly description: Schema.optionalKey<Schema.String>;
+        readonly sourceType: Schema.Literal<"manual">;
+        readonly openTaskCount: Schema.Int;
+        readonly blockedTaskCount: Schema.Int;
+        readonly createdAt: Schema.String;
+        readonly updatedAt: Schema.String;
+        readonly defaultStatusMapping: Schema.$Record<Schema.String, Schema.String>;
+    }>;
+    readonly bound: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly projectId: Schema.String;
+        readonly provider: Schema.Union<readonly [Schema.Literal<"github">, Schema.Literal<"gitlab">, Schema.Literal<"generic_git">]>;
+        readonly host: Schema.String;
+        readonly owner: Schema.String;
+        readonly name: Schema.String;
+        readonly repositoryUrl: Schema.optionalKey<Schema.String>;
+        readonly pathPrefix: Schema.optionalKey<Schema.String>;
+        readonly defaultTargetBranch: Schema.String;
+        readonly expectedBranch: Schema.optionalKey<Schema.String>;
+        readonly expectedCommitSha: Schema.optionalKey<Schema.String>;
+        readonly credentialRefs: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"none">;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"local_env">;
+            readonly envName: Schema.String;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"runner_secret">;
+            readonly runnerSecretName: Schema.String;
+            readonly providerType: Schema.Union<readonly [Schema.Literal<"env">, Schema.Literal<"file">, Schema.Literal<"exec">]>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"ssh_agent">;
+        }>]>>;
+        readonly status: Schema.Union<readonly [Schema.Literal<"active">, Schema.Literal<"disabled">]>;
+        readonly webhook: Schema.optionalKey<Schema.Struct<{
+            readonly status: Schema.Literals<readonly ["active", "missing"]>;
+            readonly message: Schema.optionalKey<Schema.String>;
+        }>>;
+        readonly createdAt: Schema.String;
+        readonly updatedAt: Schema.String;
+    }>>;
+    readonly alreadyBound: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly projectId: Schema.String;
+        readonly provider: Schema.Union<readonly [Schema.Literal<"github">, Schema.Literal<"gitlab">, Schema.Literal<"generic_git">]>;
+        readonly host: Schema.String;
+        readonly owner: Schema.String;
+        readonly name: Schema.String;
+        readonly repositoryUrl: Schema.optionalKey<Schema.String>;
+        readonly pathPrefix: Schema.optionalKey<Schema.String>;
+        readonly defaultTargetBranch: Schema.String;
+        readonly expectedBranch: Schema.optionalKey<Schema.String>;
+        readonly expectedCommitSha: Schema.optionalKey<Schema.String>;
+        readonly credentialRefs: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"none">;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"local_env">;
+            readonly envName: Schema.String;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"runner_secret">;
+            readonly runnerSecretName: Schema.String;
+            readonly providerType: Schema.Union<readonly [Schema.Literal<"env">, Schema.Literal<"file">, Schema.Literal<"exec">]>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"ssh_agent">;
+        }>]>>;
+        readonly status: Schema.Union<readonly [Schema.Literal<"active">, Schema.Literal<"disabled">]>;
+        readonly webhook: Schema.optionalKey<Schema.Struct<{
+            readonly status: Schema.Literals<readonly ["active", "missing"]>;
+            readonly message: Schema.optionalKey<Schema.String>;
+        }>>;
+        readonly createdAt: Schema.String;
+        readonly updatedAt: Schema.String;
     }>>;
 }>;
 export declare const ChangeRequestProviderIntegrationMetadata: Schema.Struct<{
@@ -131,7 +242,14 @@ export type CodeHostCapability = (typeof CodeHostCapability)['Type'];
 export type CodeHostConnection = (typeof CodeHostConnection)['Type'];
 export type CodeHostConnectionList = (typeof CodeHostConnectionList)['Type'];
 export type CodeHostConnectionWrite = (typeof CodeHostConnectionWrite)['Type'];
+export type GitlabConnectStart = GithubConnectStart;
+export type GitlabConnectComplete = (typeof GitlabConnectComplete)['Type'];
+export type GithubConnectStart = (typeof GithubConnectStart)['Type'];
+export type GithubConnectComplete = (typeof GithubConnectComplete)['Type'];
 export type CodeHostRepository = (typeof CodeHostRepository)['Type'];
+export type CodeHostRepositoryList = (typeof CodeHostRepositoryList)['Type'];
+export type CodeHostRepositoryBind = (typeof CodeHostRepositoryBind)['Type'];
+export type CodeHostRepositoryBindResult = (typeof CodeHostRepositoryBindResult)['Type'];
 export type ChangeRequestProviderIntegrationMetadata = (typeof ChangeRequestProviderIntegrationMetadata)['Type'];
 export type ProviderChangeRequestWebhookEvent = (typeof ProviderChangeRequestWebhookEvent)['Type'];
 export type ChangeRequestProviderWebhookReceipt = (typeof ChangeRequestProviderWebhookReceipt)['Type'];

package/types/packages/core/src/package-declarations.d.ts

@@ -26,6 +26,10 @@ export declare const LoopManifest: Schema.Struct<{
     readonly capabilities: Schema.$Array<Schema.Literals<readonly ["agent_work", "ask", "call", "verify", "change_request", "write_back", "post_comment", "create_tasks", "merge_change_request", "publish_release"]>>;
     /** The names of the Secrets the Loop reads. */
     readonly secrets: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    /** The hosts the program calls besides Kitman, or `open`. */
+    readonly network: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+        readonly hosts: Schema.$Array<Schema.String>;
+    }>, Schema.Literal<"open">]>>;
 }>;
 export type LoopManifest = typeof LoopManifest.Type;
 /** An Agent as a Package declares it, with its instructions already read from the repository. */
@@ -137,6 +141,10 @@ export declare const PackageDeclarations: Schema.Struct<{
         readonly capabilities: Schema.$Array<Schema.Literals<readonly ["agent_work", "ask", "call", "verify", "change_request", "write_back", "post_comment", "create_tasks", "merge_change_request", "publish_release"]>>;
         /** The names of the Secrets the Loop reads. */
         readonly secrets: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        /** The hosts the program calls besides Kitman, or `open`. */
+        readonly network: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+            readonly hosts: Schema.$Array<Schema.String>;
+        }>, Schema.Literal<"open">]>>;
     }>>;
     readonly agents: Schema.$Record<Schema.String, Schema.Struct<{
         readonly extends: Schema.optionalKey<Schema.String>;

package/types/packages/core/src/project.d.ts

@@ -22,6 +22,7 @@ export declare const ProjectDirectoryItem: Schema.Struct<{
     readonly sourceType: Schema.Literal<"manual">;
     readonly openTaskCount: Schema.Int;
     readonly blockedTaskCount: Schema.Int;
+    readonly createdAt: Schema.String;
     readonly updatedAt: Schema.String;
 }>;
 export declare const Project: Schema.Struct<{
@@ -33,9 +34,9 @@ export declare const Project: Schema.Struct<{
     readonly sourceType: Schema.Literal<"manual">;
     readonly openTaskCount: Schema.Int;
     readonly blockedTaskCount: Schema.Int;
+    readonly createdAt: Schema.String;
     readonly updatedAt: Schema.String;
     readonly defaultStatusMapping: Schema.$Record<Schema.String, Schema.String>;
-    readonly createdAt: Schema.String;
 }>;
 export declare const ProjectCreate: Schema.Struct<{
     readonly name: Schema.String;
@@ -53,6 +54,7 @@ export declare const ProjectList: Schema.Struct<{
         readonly sourceType: Schema.Literal<"manual">;
         readonly openTaskCount: Schema.Int;
         readonly blockedTaskCount: Schema.Int;
+        readonly createdAt: Schema.String;
         readonly updatedAt: Schema.String;
     }>>;
 }>;

package/types/packages/core/src/repo-binding.d.ts

@@ -42,6 +42,10 @@ export declare const RepoBinding: Schema.Struct<{
         readonly kind: Schema.Literal<"ssh_agent">;
     }>]>>;
     readonly status: Schema.Union<readonly [Schema.Literal<"active">, Schema.Literal<"disabled">]>;
+    readonly webhook: Schema.optionalKey<Schema.Struct<{
+        readonly status: Schema.Literals<readonly ["active", "missing"]>;
+        readonly message: Schema.optionalKey<Schema.String>;
+    }>>;
     readonly createdAt: Schema.String;
     readonly updatedAt: Schema.String;
 }>;
@@ -98,6 +102,10 @@ export declare const RepoBindingList: Schema.Struct<{
             readonly kind: Schema.Literal<"ssh_agent">;
         }>]>>;
         readonly status: Schema.Union<readonly [Schema.Literal<"active">, Schema.Literal<"disabled">]>;
+        readonly webhook: Schema.optionalKey<Schema.Struct<{
+            readonly status: Schema.Literals<readonly ["active", "missing"]>;
+            readonly message: Schema.optionalKey<Schema.String>;
+        }>>;
         readonly createdAt: Schema.String;
         readonly updatedAt: Schema.String;
     }>>;

package/types/packages/core/src/runner-eligibility.d.ts

@@ -1,4 +1,4 @@
-import type { Runner } from './runner';
+import { type Runner, type RunnerCapabilities } from './runner';
 import type { RunnerExecutionRouting } from './runner-routing';
 export declare const RunnerEligibilityReasonCodes: readonly ['workspace_mismatch', 'project_access_denied', 'personal_owner_attribution_required', 'personal_owner_project_access_denied', 'agent_identity_authority_missing', 'foreground_target_required', 'foreground_target_mismatch', 'foreground_target_not_personal', 'runner_requirements_mismatch', 'runner_replica_unavailable'];
 export type RunnerEligibilityReasonCode = (typeof RunnerEligibilityReasonCodes)[number];
@@ -37,3 +37,7 @@ export interface RunnerEligibilityResult {
  * state before invoking this function.
  */
 export declare function evaluateRunnerEligibility(input: RunnerEligibilityInput): RunnerEligibilityResult;
+/** The owner's choice while the Runner offers it, else the first offered of Pi, Claude Code and Codex. */
+export declare function runnerDefaultHarness(harnesses: readonly string[], chosen: string | undefined): string | undefined;
+/** The Harness this Runner would launch an Agent on, or undefined when the Agent's Step is not this Runner's. */
+export declare function agentStepHarness(capabilities: Pick<RunnerCapabilities, 'harnesses' | 'defaultHarness'>, agentHarness: string | undefined): string | undefined;

package/types/packages/core/src/runner.d.ts

@@ -35,8 +35,23 @@ export declare const RunnerSandboxUnavailable: Schema.Struct<{
     readonly missing: Schema.$Array<Schema.String>;
 }>;
 export type RunnerSandboxUnavailable = (typeof RunnerSandboxUnavailable)['Type'];
+/** The Harnesses a Runner looks for, in the order its default is picked from (ADR-0067). */
+export declare const DetectedHarnessIds: readonly ['pi', 'claude', 'codex'];
+export type DetectedHarnessId = (typeof DetectedHarnessIds)[number];
+/** A Harness a Runner looks for but does not offer, and what it lacks. */
+export declare const RunnerHarnessUnavailable: Schema.Struct<{
+    readonly harness: Schema.String;
+    readonly missing: Schema.$Array<Schema.String>;
+}>;
+export type RunnerHarnessUnavailable = (typeof RunnerHarnessUnavailable)['Type'];
 export declare const RunnerCapabilities: Schema.Struct<{
     readonly harnesses: Schema.$Array<Schema.String>;
+    /** The Harness an Agent that names none launches on. */
+    readonly defaultHarness: Schema.optionalKey<Schema.String>;
+    readonly harnessUnavailable: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly harness: Schema.String;
+        readonly missing: Schema.$Array<Schema.String>;
+    }>>>;
     readonly configWriters: Schema.$Array<Schema.Union<readonly [Schema.Literal<"opencode">, Schema.Literal<"claude-code">, Schema.Literal<"codex">, Schema.Literal<"pi">]>>;
     readonly mcpServers: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly skillSources: Schema.optionalKey<Schema.$Array<Schema.String>>;
@@ -124,6 +139,12 @@ export declare const Runner: Schema.Struct<{
     readonly healthStatus: Schema.Union<readonly [Schema.Literal<"healthy">, Schema.Literal<"degraded">, Schema.Literal<"unhealthy">, Schema.Literal<"unknown">]>;
     readonly capabilities: Schema.Struct<{
         readonly harnesses: Schema.$Array<Schema.String>;
+        /** The Harness an Agent that names none launches on. */
+        readonly defaultHarness: Schema.optionalKey<Schema.String>;
+        readonly harnessUnavailable: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly harness: Schema.String;
+            readonly missing: Schema.$Array<Schema.String>;
+        }>>>;
         readonly configWriters: Schema.$Array<Schema.Union<readonly [Schema.Literal<"opencode">, Schema.Literal<"claude-code">, Schema.Literal<"codex">, Schema.Literal<"pi">]>>;
         readonly mcpServers: Schema.optionalKey<Schema.$Array<Schema.String>>;
         readonly skillSources: Schema.optionalKey<Schema.$Array<Schema.String>>;
@@ -190,6 +211,8 @@ export declare const Runner: Schema.Struct<{
             readonly maxRunSeconds: Schema.optionalKey<Schema.Finite>;
         }>>;
     }>;
+    /** The owner's choice of default Harness; `capabilities.defaultHarness` is the one in effect. */
+    readonly preferredHarness: Schema.optionalKey<Schema.Literals<readonly ["pi", "claude", "codex"]>>;
     readonly labels: Schema.$Array<Schema.String>;
     readonly lastHeartbeatAt: Schema.optionalKey<Schema.String>;
     readonly createdByUserId: Schema.optionalKey<Schema.String>;
@@ -220,6 +243,10 @@ export declare const RunnerRescope: Schema.Struct<{
         readonly ownerUserId: Schema.String;
     }>]>;
 }>;
+/** The owner's default Harness for a Runner; null goes back to the first the Runner offers. */
+export declare const RunnerDefaultHarnessInput: Schema.Struct<{
+    readonly harness: Schema.NullOr<Schema.Literals<readonly ["pi", "claude", "codex"]>>;
+}>;
 export declare const RunnerProjectGrantList: Schema.Struct<{
     readonly items: Schema.$Array<Schema.Struct<{
         readonly id: Schema.String;
@@ -413,6 +440,12 @@ export declare const RunnerCreate: Schema.Struct<{
     readonly credentialHostId: Schema.optionalKey<Schema.String>;
     readonly capabilities: Schema.optionalKey<Schema.Struct<{
         readonly harnesses: Schema.$Array<Schema.String>;
+        /** The Harness an Agent that names none launches on. */
+        readonly defaultHarness: Schema.optionalKey<Schema.String>;
+        readonly harnessUnavailable: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly harness: Schema.String;
+            readonly missing: Schema.$Array<Schema.String>;
+        }>>>;
         readonly configWriters: Schema.$Array<Schema.Union<readonly [Schema.Literal<"opencode">, Schema.Literal<"claude-code">, Schema.Literal<"codex">, Schema.Literal<"pi">]>>;
         readonly mcpServers: Schema.optionalKey<Schema.$Array<Schema.String>>;
         readonly skillSources: Schema.optionalKey<Schema.$Array<Schema.String>>;
@@ -506,6 +539,12 @@ export declare const RunnerRegistrationResult: Schema.Struct<{
         readonly healthStatus: Schema.Union<readonly [Schema.Literal<"healthy">, Schema.Literal<"degraded">, Schema.Literal<"unhealthy">, Schema.Literal<"unknown">]>;
         readonly capabilities: Schema.Struct<{
             readonly harnesses: Schema.$Array<Schema.String>;
+            /** The Harness an Agent that names none launches on. */
+            readonly defaultHarness: Schema.optionalKey<Schema.String>;
+            readonly harnessUnavailable: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+                readonly harness: Schema.String;
+                readonly missing: Schema.$Array<Schema.String>;
+            }>>>;
             readonly configWriters: Schema.$Array<Schema.Union<readonly [Schema.Literal<"opencode">, Schema.Literal<"claude-code">, Schema.Literal<"codex">, Schema.Literal<"pi">]>>;
             readonly mcpServers: Schema.optionalKey<Schema.$Array<Schema.String>>;
             readonly skillSources: Schema.optionalKey<Schema.$Array<Schema.String>>;
@@ -572,6 +611,8 @@ export declare const RunnerRegistrationResult: Schema.Struct<{
                 readonly maxRunSeconds: Schema.optionalKey<Schema.Finite>;
             }>>;
         }>;
+        /** The owner's choice of default Harness; `capabilities.defaultHarness` is the one in effect. */
+        readonly preferredHarness: Schema.optionalKey<Schema.Literals<readonly ["pi", "claude", "codex"]>>;
         readonly labels: Schema.$Array<Schema.String>;
         readonly lastHeartbeatAt: Schema.optionalKey<Schema.String>;
         readonly createdByUserId: Schema.optionalKey<Schema.String>;
@@ -595,6 +636,12 @@ export declare const RunnerHeartbeatInput: Schema.Struct<{
     readonly healthStatus: Schema.optionalKey<Schema.Union<readonly [Schema.Literal<"healthy">, Schema.Literal<"degraded">, Schema.Literal<"unhealthy">, Schema.Literal<"unknown">]>>;
     readonly capabilities: Schema.optionalKey<Schema.Struct<{
         readonly harnesses: Schema.$Array<Schema.String>;
+        /** The Harness an Agent that names none launches on. */
+        readonly defaultHarness: Schema.optionalKey<Schema.String>;
+        readonly harnessUnavailable: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly harness: Schema.String;
+            readonly missing: Schema.$Array<Schema.String>;
+        }>>>;
         readonly configWriters: Schema.$Array<Schema.Union<readonly [Schema.Literal<"opencode">, Schema.Literal<"claude-code">, Schema.Literal<"codex">, Schema.Literal<"pi">]>>;
         readonly mcpServers: Schema.optionalKey<Schema.$Array<Schema.String>>;
         readonly skillSources: Schema.optionalKey<Schema.$Array<Schema.String>>;
@@ -666,6 +713,12 @@ export declare const RunnerHeartbeatInput: Schema.Struct<{
 export declare const RunnerCapabilitiesUpdate: Schema.Struct<{
     readonly capabilities: Schema.Struct<{
         readonly harnesses: Schema.$Array<Schema.String>;
+        /** The Harness an Agent that names none launches on. */
+        readonly defaultHarness: Schema.optionalKey<Schema.String>;
+        readonly harnessUnavailable: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly harness: Schema.String;
+            readonly missing: Schema.$Array<Schema.String>;
+        }>>>;
         readonly configWriters: Schema.$Array<Schema.Union<readonly [Schema.Literal<"opencode">, Schema.Literal<"claude-code">, Schema.Literal<"codex">, Schema.Literal<"pi">]>>;
         readonly mcpServers: Schema.optionalKey<Schema.$Array<Schema.String>>;
         readonly skillSources: Schema.optionalKey<Schema.$Array<Schema.String>>;
@@ -1324,6 +1377,12 @@ export declare const RunnerOperationsOverview: Schema.Struct<{
         readonly healthStatus: Schema.Union<readonly [Schema.Literal<"healthy">, Schema.Literal<"degraded">, Schema.Literal<"unhealthy">, Schema.Literal<"unknown">]>;
         readonly capabilities: Schema.Struct<{
             readonly harnesses: Schema.$Array<Schema.String>;
+            /** The Harness an Agent that names none launches on. */
+            readonly defaultHarness: Schema.optionalKey<Schema.String>;
+            readonly harnessUnavailable: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+                readonly harness: Schema.String;
+                readonly missing: Schema.$Array<Schema.String>;
+            }>>>;
             readonly configWriters: Schema.$Array<Schema.Union<readonly [Schema.Literal<"opencode">, Schema.Literal<"claude-code">, Schema.Literal<"codex">, Schema.Literal<"pi">]>>;
             readonly mcpServers: Schema.optionalKey<Schema.$Array<Schema.String>>;
             readonly skillSources: Schema.optionalKey<Schema.$Array<Schema.String>>;
@@ -1390,6 +1449,8 @@ export declare const RunnerOperationsOverview: Schema.Struct<{
                 readonly maxRunSeconds: Schema.optionalKey<Schema.Finite>;
             }>>;
         }>;
+        /** The owner's choice of default Harness; `capabilities.defaultHarness` is the one in effect. */
+        readonly preferredHarness: Schema.optionalKey<Schema.Literals<readonly ["pi", "claude", "codex"]>>;
         readonly labels: Schema.$Array<Schema.String>;
         readonly lastHeartbeatAt: Schema.optionalKey<Schema.String>;
         readonly createdByUserId: Schema.optionalKey<Schema.String>;
@@ -1521,6 +1582,12 @@ export declare const RunnerOperationsLiveSnapshot: Schema.Struct<{
             readonly healthStatus: Schema.Union<readonly [Schema.Literal<"healthy">, Schema.Literal<"degraded">, Schema.Literal<"unhealthy">, Schema.Literal<"unknown">]>;
             readonly capabilities: Schema.Struct<{
                 readonly harnesses: Schema.$Array<Schema.String>;
+                /** The Harness an Agent that names none launches on. */
+                readonly defaultHarness: Schema.optionalKey<Schema.String>;
+                readonly harnessUnavailable: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+                    readonly harness: Schema.String;
+                    readonly missing: Schema.$Array<Schema.String>;
+                }>>>;
                 readonly configWriters: Schema.$Array<Schema.Union<readonly [Schema.Literal<"opencode">, Schema.Literal<"claude-code">, Schema.Literal<"codex">, Schema.Literal<"pi">]>>;
                 readonly mcpServers: Schema.optionalKey<Schema.$Array<Schema.String>>;
                 readonly skillSources: Schema.optionalKey<Schema.$Array<Schema.String>>;
@@ -1587,6 +1654,8 @@ export declare const RunnerOperationsLiveSnapshot: Schema.Struct<{
                     readonly maxRunSeconds: Schema.optionalKey<Schema.Finite>;
                 }>>;
             }>;
+            /** The owner's choice of default Harness; `capabilities.defaultHarness` is the one in effect. */
+            readonly preferredHarness: Schema.optionalKey<Schema.Literals<readonly ["pi", "claude", "codex"]>>;
             readonly labels: Schema.$Array<Schema.String>;
             readonly lastHeartbeatAt: Schema.optionalKey<Schema.String>;
             readonly createdByUserId: Schema.optionalKey<Schema.String>;
@@ -2263,6 +2332,12 @@ export declare const RunnerList: Schema.Struct<{
         readonly healthStatus: Schema.Union<readonly [Schema.Literal<"healthy">, Schema.Literal<"degraded">, Schema.Literal<"unhealthy">, Schema.Literal<"unknown">]>;
         readonly capabilities: Schema.Struct<{
             readonly harnesses: Schema.$Array<Schema.String>;
+            /** The Harness an Agent that names none launches on. */
+            readonly defaultHarness: Schema.optionalKey<Schema.String>;
+            readonly harnessUnavailable: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+                readonly harness: Schema.String;
+                readonly missing: Schema.$Array<Schema.String>;
+            }>>>;
             readonly configWriters: Schema.$Array<Schema.Union<readonly [Schema.Literal<"opencode">, Schema.Literal<"claude-code">, Schema.Literal<"codex">, Schema.Literal<"pi">]>>;
             readonly mcpServers: Schema.optionalKey<Schema.$Array<Schema.String>>;
             readonly skillSources: Schema.optionalKey<Schema.$Array<Schema.String>>;
@@ -2329,6 +2404,8 @@ export declare const RunnerList: Schema.Struct<{
                 readonly maxRunSeconds: Schema.optionalKey<Schema.Finite>;
             }>>;
         }>;
+        /** The owner's choice of default Harness; `capabilities.defaultHarness` is the one in effect. */
+        readonly preferredHarness: Schema.optionalKey<Schema.Literals<readonly ["pi", "claude", "codex"]>>;
         readonly labels: Schema.$Array<Schema.String>;
         readonly lastHeartbeatAt: Schema.optionalKey<Schema.String>;
         readonly createdByUserId: Schema.optionalKey<Schema.String>;
@@ -3567,6 +3644,7 @@ export type RunnerOwnership = (typeof RunnerOwnership)['Type'];
 export type RunnerProjectGrant = (typeof RunnerProjectGrant)['Type'];
 export type RunnerProjectGrantCreate = (typeof RunnerProjectGrantCreate)['Type'];
 export type RunnerRescope = (typeof RunnerRescope)['Type'];
+export type RunnerDefaultHarnessInput = (typeof RunnerDefaultHarnessInput)['Type'];
 export type RunnerProjectGrantList = (typeof RunnerProjectGrantList)['Type'];
 export type RunnerProjectGrantDeleteResult = (typeof RunnerProjectGrantDeleteResult)['Type'];
 export type RunnerExecutionBackend = (typeof RunnerExecutionBackend)['Type'];

package/types/packages/core/src/work-unit.d.ts

@@ -127,6 +127,10 @@ export declare const OrchestrationWorkUnit: Schema.Struct<{
         readonly activities: Schema.$Record<Schema.String, Schema.Unknown>;
         readonly deferreds: Schema.$Record<Schema.String, Schema.Unknown>;
     }>;
+    /** The hosts the Loop declares besides Kitman, or `open`. */
+    readonly network: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+        readonly hosts: Schema.$Array<Schema.String>;
+    }>, Schema.Literal<"open">]>>;
     /** The Runner spawns the Run's bundle with this Loop id and credential. */
     readonly program: Schema.Struct<{
         readonly loopId: Schema.String;
@@ -156,6 +160,9 @@ export declare const ProgramWorkUnit: Schema.Struct<{
         readonly activities: Schema.$Record<Schema.String, Schema.Unknown>;
         readonly deferreds: Schema.$Record<Schema.String, Schema.Unknown>;
     }>;
+    readonly network: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+        readonly hosts: Schema.$Array<Schema.String>;
+    }>, Schema.Literal<"open">]>>;
 }>;
 export type ProgramWorkUnit = (typeof ProgramWorkUnit)['Type'];
 /** An approved verification as Kitman holds it for a RepoBinding; never read from the branch. */
@@ -223,6 +230,10 @@ export declare const WorkUnit: Schema.Union<readonly [Schema.Struct<{
         readonly activities: Schema.$Record<Schema.String, Schema.Unknown>;
         readonly deferreds: Schema.$Record<Schema.String, Schema.Unknown>;
     }>;
+    /** The hosts the Loop declares besides Kitman, or `open`. */
+    readonly network: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+        readonly hosts: Schema.$Array<Schema.String>;
+    }>, Schema.Literal<"open">]>>;
     /** The Runner spawns the Run's bundle with this Loop id and credential. */
     readonly program: Schema.Struct<{
         readonly loopId: Schema.String;
@@ -350,6 +361,10 @@ export declare const WorkUnitClaimResult: Schema.Struct<{
             readonly activities: Schema.$Record<Schema.String, Schema.Unknown>;
             readonly deferreds: Schema.$Record<Schema.String, Schema.Unknown>;
         }>;
+        /** The hosts the Loop declares besides Kitman, or `open`. */
+        readonly network: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+            readonly hosts: Schema.$Array<Schema.String>;
+        }>, Schema.Literal<"open">]>>;
         /** The Runner spawns the Run's bundle with this Loop id and credential. */
         readonly program: Schema.Struct<{
             readonly loopId: Schema.String;