@lensagent/core 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 LensAgent
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,48 @@
+# lens-core
+
+`lens-core` 是 LensAgent 的后端 Core / Harness 仓库。当前实际行为以源码、Schema、配置、脚本、测试和可复核运行结果为准。
+
+## 仓库与运行
+
+仓库根目录本身就是可安装、构建和运行的 Node.js 项目。文件、终端、Git 和搜索能力由独立仓库 `lens-remote-executor` 提供；本仓库通过 gRPC 与其通信。两侧各自维护一份 `proto/executor.proto`，修改 RPC 契约时需要同步。
+
+要求 Node.js 24 或更高版本。
+
+```bash
+pnpm install
+pnpm run typecheck
+pnpm run lint
+pnpm run build
+pnpm run secret-scan
+pnpm run dev
+```
+
+默认配置模板位于 `config/lens.example.jsonc`。本地运行时复制为 `config/lens.jsonc`。配置与 `config/pair.json` 的相对路径均以进程 `cwd` 为根。
+
+已安装包的入口与构建产物入口：
+
+```bash
+lens-core
+node dist/entry/node.js
+```
+
+Executor 需要独立启动；`pnpm run dev` 不会自动启动它。
+
+## 文档
+
+2026-09-19 之前的架构设计、Context、计划、研究、审查、日期快照及相关生成物已归档到 `waste/2026-09-19/`，不再作为当前规范。
+
+当前保留：
+
+- [AGENTS.md](./AGENTS.md) — 仓库级工程与 Agent 工作规则。
+- [CLAUDE.md](./CLAUDE.md) — Claude Code 的最小入口。
+- [CONTEXT.md](./CONTEXT.md) — 当前术语、事实边界与工程共享语境。
+- [docs/2026-09-19/current-system-architecture.md](./docs/2026-09-19/current-system-architecture.md) — 基于当前源码与 CodeGraph 重建的系统架构快照。
+- [docs/DOCUMENT-LIFECYCLE.md](./docs/DOCUMENT-LIFECYCLE.md) — 文档治理与归档规则。
+- [waste/manifest.md](./waste/manifest.md) — 历史归档清单。
+
+不要根据 `waste/` 中的历史资料推断当前行为；需要确认时直接检查当前代码和可执行证据。
+
+## 许可证
+
+本项目使用 [MIT License](./LICENSE)。

package/config/lens.example.jsonc

@@ -0,0 +1,92 @@
+{
+  "listen": { "host": "127.0.0.1", "port": 4317 },
+  "tls": { "enabled": false, "certFile": null, "keyFile": null },
+  "database": { "path": "data/lens.db" },
+  "pairPath": "config/pair.json",
+  // Upper bound on the ordered shutdown, in milliseconds. Optional; 30000 when omitted. Read when a
+  // stop begins, so a change applies to the next stop without a restart. A stage that never settles
+  // -- a Worker ignoring cancellation, an LSP child not exiting -- stops holding the process past
+  // this point; anything left unconfirmed is resolved by Recovery on the next start.
+  "shutdown": { "graceMs": 30000 },
+  "executor": { "address": "127.0.0.1:50051" },
+  "artifacts": { "directory": "artifacts" },
+  "persistence": {
+    "eventLog": { "enabled": false, "path": "data/lens.events.jsonl", "fsync": false },
+    "contentStore": { "mode": "filesystem" }
+  },
+  "observability": {
+    "logs": { "enabled": true, "path": "runtime/lens.jsonl", "maxFileBytes": 10485760, "maxFiles": 5, "retentionDays": 14 },
+    "traces": { "capacity": 2048 }
+  },
+  "mcpServers": {},
+  "lspServers": {},
+  "providers": {
+    "openai": {
+      "adapter": "@ai-sdk/openai",
+      "options": { "apiKey": { "env": "OPENAI_API_KEY", "optional": true } },
+      "models": { "gpt-5": { "contextWindowTokens": 400000 } }
+    }
+  },
+  "modelHarnessProfiles": {},
+  "roles": {
+    "agent": {
+      "model": "openai/gpt-5",
+      "modelReasoningEffort": "high",
+      "policyPreset": "Write",
+      "capabilities": ["capability_search", "programmatic_tool_run", "system_echo", "read_file", "write_file", "edit_file", "glob", "grep", "terminal_command_run", "git_run", "internet_search", "update_plan", "ask_user", "compact", "subagent_create", "subagent_message", "subagent_broadcast", "subagent_wait"],
+      "contextStrategy": "default",
+      "providerRouting": { "retryMaxAttempts": 2, "fallback": [] }
+    },
+    "subagent": {
+      "model": "openai/gpt-5",
+      "modelReasoningEffort": "medium",
+      "policyPreset": "Write",
+      "capabilities": ["capability_search", "programmatic_tool_run", "system_echo", "read_file", "write_file", "edit_file", "glob", "grep", "terminal_command_run", "git_run", "internet_search", "update_plan", "ask_user", "subagent_wait"],
+      "contextStrategy": "default",
+      "providerRouting": { "retryMaxAttempts": 2, "fallback": [] }
+    },
+    "compactor": {
+      "model": "openai/gpt-5",
+      "modelReasoningEffort": "medium",
+      "policyPreset": null,
+      "capabilities": [],
+      "contextStrategy": "default",
+      "providerRouting": { "retryMaxAttempts": 2, "fallback": [] }
+    },
+    "auto-review": {
+      "model": "openai/gpt-5",
+      "modelReasoningEffort": "medium",
+      "policyPreset": null,
+      "capabilities": [],
+      "contextStrategy": null,
+      "providerRouting": { "retryMaxAttempts": 1, "fallback": [] }
+    }
+  },
+  "tokenizer": { "mode": "universal_tel", "version": 1 },
+  "policyPresets": {
+    "Read": { "capabilities": {
+      "capability_search": "read_only", "programmatic_tool_run": "full_access", "system_echo": "read_only", "read_file": "read_only", "glob": "read_only", "grep": "read_only", "git_run": "read_only", "internet_search": "external", "subagent_wait": "read_only"
+    } },
+    "Write": { "capabilities": {
+      "capability_search": "read_only", "programmatic_tool_run": "full_access", "system_echo": "read_only", "read_file": "read_only", "write_file": "workspace_write", "edit_file": "workspace_write", "glob": "read_only", "grep": "read_only", "terminal_command_run": "external", "git_run": "workspace_write", "internet_search": "external", "update_plan": "workspace_write", "update_todo": "workspace_write", "ask_user": "read_only", "compact": "ask", "subagent_create": "workspace_write", "subagent_message": "workspace_write", "subagent_broadcast": "workspace_write", "subagent_wait": "read_only", "slash_command_list": "read_only", "slash_command_run": "ask"
+    } }
+  },
+  "concurrency": { "instanceMax": 8, "perStepMax": 4, "perAdapterMax": 4 },
+  "worker": { "timeoutMs": 120000, "outputLimitBytes": 1048576 },
+  "contextBudget": { "outputReserveTokens": 8192, "safetyMarginTokens": 2048 },
+  "capabilityInput": { "catalogMaxTokens": 4096, "searchResultMaxTokens": 4096 },
+  "contextProjection": {
+    "toolResultMaxTokens": 8192,
+    "snip": { "triggerTokens": 64000, "retainedTokens": 32000 },
+    "microcompact": { "triggerTokens": 96000, "projectedTokens": 48000 },
+    "contextCollapse": { "triggerTokens": 128000, "projectedTokens": 64000 },
+    "stageVersion": "v1"
+  },
+  "compaction": { "preservedSegmentTokens": 16000, "preservedSegmentBytes": 262144, "summaryMaxTokens": 8192 },
+  "autoReview": { "timeoutMs": 30000, "goalMaxBytes": 32768 },
+  "executive": { "verification": [] },
+  "providerPromptCache": { "enabled": false, "minimumEligiblePrefixTokens": 1024, "maximumBreakpoints": 4 },
+  "historyRetention": { "purgeMode": "manual", "purgeArchivedAfterDays": null },
+  "snapshot": { "maxRuntimeEntities": 50000, "pageSizeDefault": 100, "pageSizeMax": 500 },
+  "sse": { "heartbeatIntervalMs": 15000, "maxBufferedEvents": 1024, "maxBufferedBytes": 1048576 }
+}

package/config/pair.example.json

@@ -0,0 +1,3 @@
+{
+  "clients": []
+}

package/dist/adapters/executor.d.ts

@@ -0,0 +1,35 @@
+import { type CapabilityAdapter, type CapabilityInvocation, type CapabilityOutput, type Json } from '../core/domain.js';
+import type { ConfigRuntime } from '../config/runtime.js';
+import type { RegisteredCapability } from '../runtime/capabilities.js';
+/**
+ * Carries the Executor's gRPC status alongside the message. Without it every failure looked the
+ * same to callers, so a path the Executor deliberately rejected was reported as the Executor
+ * being unavailable -- a 503 marked retryable for a request that can never succeed.
+ */
+export declare class ExecutorCallError extends Error {
+    readonly grpcCode: number;
+    constructor(message: string, grpcCode: number);
+    /** True when the Executor answered and refused, rather than failing to answer. */
+    get refused(): boolean;
+}
+type ObjectValue = Readonly<Record<string, unknown>>;
+export declare class ExecutorClient implements CapabilityAdapter {
+    #private;
+    readonly config: ConfigRuntime;
+    readonly id = "executor";
+    private constructor();
+    static create(root: string, runtime: ConfigRuntime): Promise<ExecutorClient>;
+    close(): void;
+    health(signal?: AbortSignal): Promise<Json>;
+    browse(path: string, signal?: AbortSignal): Promise<Json>;
+    chooseFolder(_initialPath?: string, signal?: AbortSignal): Promise<Json>;
+    open(workspacePaths: readonly string[], path: string, signal?: AbortSignal): Promise<Json>;
+    validatePaths(paths: readonly string[], signal?: AbortSignal, createIfMissing?: boolean): Promise<Json>;
+    deleteCallHistory(workspaceId: string, callIds: readonly string[], signal?: AbortSignal): Promise<Json>;
+    describeCallHistory(workspaceId: string, callIds: readonly string[], workspacePaths: readonly string[], fullAccess: boolean, signal?: AbortSignal): Promise<Json>;
+    execute(invocation: CapabilityInvocation): Promise<CapabilityOutput>;
+    call(method: string, request: ObjectValue, timeoutMs: number, signal?: AbortSignal): Promise<Json>;
+}
+export declare function executorCapabilities(adapter: ExecutorClient): readonly RegisteredCapability[];
+export declare function pathResource(path: string, workspacePaths: readonly string[]): string;
+export {};

package/dist/adapters/executor.js

@@ -0,0 +1,296 @@
+import { randomBytes } from 'node:crypto';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import * as grpc from '@grpc/grpc-js';
+import * as protoLoader from '@grpc/proto-loader';
+import { fail } from '../core/domain.js';
+import { capabilityManifest } from '../runtime/manifests.js';
+/**
+ * Carries the Executor's gRPC status alongside the message. Without it every failure looked the
+ * same to callers, so a path the Executor deliberately rejected was reported as the Executor
+ * being unavailable -- a 503 marked retryable for a request that can never succeed.
+ */
+export class ExecutorCallError extends Error {
+    grpcCode;
+    constructor(message, grpcCode) {
+        super(message);
+        this.grpcCode = grpcCode;
+        this.name = 'ExecutorCallError';
+    }
+    /** True when the Executor answered and refused, rather than failing to answer. */
+    get refused() {
+        return [grpc.status.INVALID_ARGUMENT, grpc.status.NOT_FOUND, grpc.status.ALREADY_EXISTS,
+            grpc.status.PERMISSION_DENIED, grpc.status.FAILED_PRECONDITION, grpc.status.OUT_OF_RANGE].includes(this.grpcCode);
+    }
+}
+// core carries its own copy of executor.proto (core/proto/executor.proto) since core and
+// executor are independent, non-shared projects that only communicate over the gRPC port. If
+// the RPC schema changes, mirror the change in executor/proto/executor.proto.
+const executorProtoPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../proto/executor.proto');
+// Set explicitly instead of inheriting @grpc/grpc-js's 4 MiB receive default. Keep in step with the
+// same constant in lens-remote-executor's src/main.ts: the Executor's server-side receive limit is
+// what actually bounds a write_file request, so both sides have to agree.
+const maxMessageBytes = 16 * 1024 * 1024;
+// Rejected in Core with a usable message rather than letting the transport fail with
+// RESOURCE_EXHAUSTED. Below maxMessageBytes so the rest of the request always fits.
+const contentLimitBytes = 8 * 1024 * 1024;
+export class ExecutorClient {
+    config;
+    id = 'executor';
+    #client;
+    #metadata = new grpc.Metadata();
+    constructor(client, config, identity) {
+        this.config = config;
+        this.#client = client;
+        if (identity !== undefined) {
+            this.#metadata.set('x-lens-client-kind', 'native');
+            this.#metadata.set('x-lens-client-mac', identity.mac);
+            this.#metadata.set('x-lens-hardware-id', identity.hardwareId);
+        }
+    }
+    static async create(root, runtime) {
+        const config = runtime.current.config.executor;
+        const packageDefinition = protoLoader.loadSync(executorProtoPath, { keepCase: true, longs: Number, defaults: true, oneofs: true });
+        const loaded = grpc.loadPackageDefinition(packageDefinition);
+        const credentials = await channelCredentials(root, config);
+        const clientIdentity = config.identityPath === undefined ? undefined : await loadIdentity(resolve(root, config.identityPath));
+        const options = { 'grpc.max_receive_message_length': maxMessageBytes, 'grpc.max_send_message_length': maxMessageBytes };
+        return new ExecutorClient(new loaded.lens.executor.v1.Executor(config.address, credentials, options), runtime, clientIdentity);
+    }
+    close() {
+        this.#client.close();
+    }
+    health(signal) {
+        return this.call('health', {}, 5000, signal);
+    }
+    browse(path, signal) {
+        return this.call('listAllowedParent', { path }, 30000, signal);
+    }
+    chooseFolder(_initialPath, signal) {
+        return this.call('chooseWorkspaceFolder', {}, 605000, signal);
+    }
+    open(workspacePaths, path, signal) {
+        return this.call('openInFileManager', { workspace_paths: workspacePaths, path, full_access: false }, 30000, signal);
+    }
+    validatePaths(paths, signal, createIfMissing = false) {
+        return this.call('validateWorkspacePaths', { workspace_paths: paths, create_if_missing: createIfMissing }, 30000, signal);
+    }
+    // Drops the Executor's file history for Calls that Core has physically deleted, so revertable
+    // state does not outlive the Call it belongs to. Called after the purge transaction commits --
+    // never from inside a Store transaction.
+    deleteCallHistory(workspaceId, callIds, signal) {
+        return this.call('deleteCallHistory', { workspace_id: workspaceId, call_ids: callIds }, 120000, signal);
+    }
+    // What revert_call would do to these Calls right now, without doing it. The answer can be
+    // invalidated by any later write, so it is a preview for the user -- not a permission the
+    // subsequent revert relies on. The Executor re-simulates when the revert actually runs.
+    describeCallHistory(workspaceId, callIds, workspacePaths, fullAccess, signal) {
+        return this.call('describeCallHistory', { workspace_paths: workspacePaths, workspace_id: workspaceId, call_ids: callIds, full_access: fullAccess }, 30000, signal);
+    }
+    async execute(invocation) {
+        const input = object(invocation.arguments);
+        const common = { workspace_paths: invocation.workspacePaths, full_access: invocation.fullAccess === true };
+        const worker = this.config.current.config.worker;
+        // write_file/edit_file carry the Workspace and Call identity so the Executor can record the
+        // change in its own file history for a later revert_call. Core never sees the file bytes or
+        // their object ids -- see docs/architecture/harness-level3/09-file-snapshot-storage-decision.md.
+        const change = { workspace_id: invocation.workspaceId, call_id: invocation.callId };
+        if (invocation.capabilityId === 'read_file')
+            return result(await this.call('readFile', { ...common, path: string(input.path) }, 30000, invocation.signal));
+        if (invocation.capabilityId === 'write_file') {
+            return result(await this.call('writeFile', { ...common, ...change, path: string(input.path), content: bounded(text(input.content), 'content') }, 30000, invocation.signal));
+        }
+        if (invocation.capabilityId === 'edit_file') {
+            return result(await this.call('editFile', { ...common, ...change, path: string(input.path), old_string: string(input.old_string), new_string: bounded(text(input.new_string), 'new_string'), replace_all: input.replace_all === true }, 30000, invocation.signal));
+        }
+        if (invocation.capabilityId === 'glob')
+            return result(await this.call('glob', { ...common, pattern: string(input.pattern), path: optionalString(input.path) ?? '.', include_hidden: input.include_hidden === true, max_results: optionalNumber(input.max_results) ?? 1000 }, 30000, invocation.signal));
+        if (invocation.capabilityId === 'grep')
+            return result(await this.call('grep', {
+                ...common,
+                pattern: string(input.pattern),
+                path: optionalString(input.path) ?? '.',
+                glob: optionalString(input.glob) ?? '',
+                include_hidden: input.include_hidden === true,
+                literal: input.literal === true,
+                case_insensitive: input.case_sensitive === false,
+                max_results: optionalNumber(input.max_results) ?? 1000,
+                max_bytes_per_file: optionalNumber(input.max_bytes_per_file) ?? 1048576
+            }, 30000, invocation.signal));
+        if (invocation.capabilityId === 'terminal_command_run') {
+            const timeout = optionalNumber(input.timeout_ms) ?? worker.timeoutMs;
+            return processResult(await this.call('runCommand', { ...common, command: string(input.command), args: strings(input.args), cwd: optionalString(input.cwd) ?? '.', env: stringRecord(input.env), timeout_ms: timeout, output_limit_bytes: optionalNumber(input.output_limit_bytes) ?? worker.outputLimitBytes }, timeout + 5000, invocation.signal));
+        }
+        if (invocation.capabilityId === 'git_run') {
+            const timeout = optionalNumber(input.timeout_ms) ?? worker.timeoutMs;
+            return processResult(await this.call('gitRun', { ...common, args: strings(input.args), cwd: optionalString(input.cwd) ?? '.', timeout_ms: timeout, output_limit_bytes: optionalNumber(input.output_limit_bytes) ?? worker.outputLimitBytes }, timeout + 5000, invocation.signal));
+        }
+        if (invocation.capabilityId === 'internet_search')
+            return result(await this.call('internetSearch', { query: string(input.query), max_results: optionalNumber(input.max_results) ?? 5 }, 30000, invocation.signal));
+        if (invocation.capabilityId === 'open_in_file_manager')
+            return result(await this.call('openInFileManager', { ...common, path: optionalString(input.path) ?? '.' }, 30000, invocation.signal));
+        fail('CAPABILITY_NOT_FOUND', 404, 'The Executor Capability does not exist.');
+    }
+    call(method, request, timeoutMs, signal) {
+        const invoke = this.#client[method];
+        if (invoke === undefined)
+            fail('EXECUTOR_PROTOCOL_ERROR', 503, `Executor RPC ${method} is unavailable.`);
+        return new Promise((resolveResult, reject) => {
+            const call = invoke.call(this.#client, request, this.#metadata, { deadline: Date.now() + timeoutMs }, (error, response) => {
+                if (error !== null)
+                    reject(new ExecutorCallError(error.details || error.message, error.code));
+                else
+                    resolveResult(jsonValue(response));
+            });
+            signal?.addEventListener('abort', () => call.cancel(), { once: true });
+        });
+    }
+}
+export function executorCapabilities(adapter) {
+    return definitions.map((definition) => ({
+        definition,
+        adapter,
+        manifest: capabilityManifest(definition),
+        claims: (context) => claims(definition.id, object(context.arguments), context.workspacePaths)
+    }));
+}
+const stringSchema = { type: 'string', minLength: 1 };
+const stringArray = { type: 'array', items: { type: 'string' } };
+const environmentSchema = { type: 'object', additionalProperties: { type: 'string' } };
+const positive = { type: 'integer', minimum: 1 };
+const outputLimits = { edit_file: 262144, internet_search: 262144, grep: 2097152, open_in_file_manager: 4096 };
+const defaultAssignments = {
+    read_file: 'all_new_agents', write_file: 'all_new_agents', edit_file: 'all_new_agents', glob: 'all_new_agents', grep: 'all_new_agents', open_in_file_manager: 'none'
+};
+/**
+ * The read-only file loop, loaded for every new Agent rather than discovered.
+ *
+ * Every Executor Capability used to be `deferred`, so a new Agent's loaded set held no way to see the
+ * Workspace at all. Deferred loading is meant to keep rarely-used tool schemas out of the prompt, and
+ * for `git_run` or `internet_search` that is right -- but an Agent cannot decide whether it needs to
+ * look at the files before it has looked at the files. Asked "does a PowerShell script run during the
+ * VM build", one searched the catalogue for a VM-build capability, found none, and asked the user to
+ * describe their setup -- while the answer sat in a Packer template two `glob` calls away. The failure
+ * is structural, not a bad guess: discovery only works when the Agent knows what to look for, and the
+ * first question about an unfamiliar Workspace is exactly when it does not.
+ *
+ * Three schemas is the whole cost. Writing, running commands and reaching the network stay deferred:
+ * those are decisions an Agent makes *after* reading, when it does know what it is looking for.
+ */
+const eagerCapabilities = new Set(['read_file', 'glob', 'grep']);
+const definitions = [
+    definition('read_file', 'Read file', 'Read UTF-8 file content inside the Workspace.', 'read_only', { path: stringSchema }, ['path']),
+    definition('write_file', 'Write file', 'Write UTF-8 file content inside the Workspace.', 'workspace_write', { path: stringSchema, content: { type: 'string' } }, ['path', 'content']),
+    definition('edit_file', 'Edit file', 'Replace exact text inside a Workspace file.', 'workspace_write', { path: stringSchema, old_string: stringSchema, new_string: { type: 'string' }, replace_all: { type: 'boolean' } }, ['path', 'old_string', 'new_string']),
+    definition('glob', 'Glob files', 'Find Workspace files by wildcard pattern.', 'read_only', { pattern: stringSchema, path: stringSchema, include_hidden: { type: 'boolean' }, max_results: { ...positive, maximum: 10000 } }, ['pattern']),
+    definition('grep', 'Search files', 'Find text or regular expression matches inside Workspace files.', 'read_only', { pattern: stringSchema, path: stringSchema, glob: stringSchema, literal: { type: 'boolean' }, case_sensitive: { type: 'boolean' }, include_hidden: { type: 'boolean' }, max_results: { ...positive, maximum: 10000 }, max_bytes_per_file: { ...positive, maximum: 10485760 } }, ['pattern']),
+    definition('terminal_command_run', 'Run command', 'Run a command without a shell inside the Workspace.', 'full', { command: stringSchema, args: stringArray, cwd: stringSchema, env: environmentSchema, timeout_ms: positive, output_limit_bytes: positive }, ['command']),
+    definition('git_run', 'Run Git', 'Run Git arguments inside the Workspace.', 'full', { args: stringArray, cwd: stringSchema, timeout_ms: positive, output_limit_bytes: positive }, ['args']),
+    definition('internet_search', 'Search internet', 'Search public web pages.', 'external', { query: stringSchema, max_results: { ...positive, maximum: 20 } }, ['query']),
+    definition('open_in_file_manager', 'Open in file manager', 'Open a Workspace path in the operating system file manager.', 'external', { path: stringSchema }, [])
+];
+function claims(capabilityId, input, paths) {
+    if (capabilityId === 'internet_search')
+        return [{ resource: 'network', mode: 'read' }];
+    const path = optionalString(input.path) ?? optionalString(input.cwd) ?? '.';
+    return [{ resource: pathResource(path, paths), mode: ['write_file', 'edit_file', 'terminal_command_run', 'git_run'].includes(capabilityId) ? 'write' : 'read' }];
+}
+// The resource name a file Capability claims for a path. Shared so revert_call names the same
+// resource its target write_file/edit_file Calls named -- claims only detect conflicts if both sides
+// spell the resource identically. Note this is a naive resolve, not a realpath: the vocabulary is
+// internally consistent rather than canonical, which is what conflict detection needs.
+export function pathResource(path, workspacePaths) {
+    return isAbsolute(path) ? resolve(path) : resolve(workspacePaths[0] ?? '*', path);
+}
+async function channelCredentials(root, config) {
+    if (config.tls?.enabled !== true)
+        return grpc.credentials.createInsecure();
+    const ca = config.tls.caFile === undefined ? undefined : await readFile(resolve(root, config.tls.caFile));
+    const cert = config.tls.certFile === undefined ? undefined : await readFile(resolve(root, config.tls.certFile));
+    const key = config.tls.keyFile === undefined ? undefined : await readFile(resolve(root, config.tls.keyFile));
+    return grpc.credentials.createSsl(ca, key, cert);
+}
+async function loadIdentity(path) {
+    try {
+        const document = JSON.parse(await readFile(path, 'utf8'));
+        if (typeof document.mac === 'string' && typeof document.hardwareId === 'string')
+            return { mac: document.mac, hardwareId: document.hardwareId };
+    }
+    catch {
+        // The identity file is created below when absent or invalid.
+    }
+    const value = {
+        mac: [...randomBytes(6)].map((byte) => byte.toString(16).padStart(2, '0')).join(':'),
+        hardwareId: randomBytes(16).toString('hex')
+    };
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+    return value;
+}
+function definition(id, title, description, effect, properties, required) {
+    return { id, title, description, effect, adapterId: 'executor', loadMode: eagerCapabilities.has(id) ? 'eager' : 'deferred', outputLimitBytes: outputLimits[id] ?? 1048576, defaultAssignment: defaultAssignments[id] ?? 'configured', inputSchema: { type: 'object', additionalProperties: false, properties, required } };
+}
+function result(content) {
+    return { content };
+}
+function bounded(value, field) {
+    const bytes = Buffer.byteLength(value, 'utf8');
+    if (bytes > contentLimitBytes)
+        fail('CALL_ARGUMENTS_INVALID', 422, `${field} is ${bytes} bytes, above the ${contentLimitBytes} byte limit for a single Call.`);
+    return value;
+}
+function processResult(content) {
+    const value = object(content);
+    const signal = optionalString(value.signal);
+    const exitCode = typeof value.exit_code === 'number' ? value.exit_code : -1;
+    const failed = exitCode !== 0 || signal !== undefined;
+    return {
+        content,
+        ...(failed ? { outcome: 'failed', errorCode: signal === 'TIMEOUT' ? 'WORKER_TIMEOUT' : signal === 'CANCELLED' ? 'WORKER_CANCELLED' : 'WORKER_EXIT_NONZERO' } : {})
+    };
+}
+function object(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        fail('INVALID_INPUT', 400, 'Executor input must be an object.');
+    return value;
+}
+function string(value) {
+    if (typeof value !== 'string' || value.length === 0)
+        fail('INVALID_INPUT', 400, 'A required string is missing.');
+    return value;
+}
+function text(value) {
+    if (typeof value !== 'string')
+        fail('INVALID_INPUT', 400, 'A required text value is missing.');
+    return value;
+}
+function optionalString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function optionalNumber(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
+function strings(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== 'string'))
+        fail('INVALID_INPUT', 400, 'args must be a string array.');
+    return value;
+}
+function stringRecord(value) {
+    if (value === undefined)
+        return {};
+    if (typeof value !== 'object' || value === null || Array.isArray(value) || Object.values(value).some((entry) => typeof entry !== 'string'))
+        fail('INVALID_INPUT', 400, 'env must be a string map.');
+    return value;
+}
+function jsonValue(value) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean' || typeof value === 'number')
+        return value;
+    if (Array.isArray(value))
+        return value.map(jsonValue);
+    if (typeof value === 'object')
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, jsonValue(entry)]));
+    fail('EXECUTOR_PROTOCOL_ERROR', 503, 'Executor returned a non-JSON value.');
+}

package/dist/adapters/lsp.d.ts

@@ -0,0 +1,18 @@
+import { type CapabilityAdapter, type CapabilityInvocation, type CapabilityOutput, type Json } from '../core/domain.js';
+import type { HarnessConfig } from '../config/schema.js';
+import type { RegisteredCapability } from '../runtime/capabilities.js';
+export declare class LspPool {
+    #private;
+    readonly servers: NonNullable<HarnessConfig['lspServers']>;
+    constructor(servers: NonNullable<HarnessConfig['lspServers']>);
+    request(serverId: string, workspacePaths: readonly string[], sessionId: string, method: string, params: Json, signal: AbortSignal): Promise<Json>;
+    projectPath(serverId: string, workspacePaths: readonly string[]): string;
+    close(): Promise<void>;
+}
+export declare class LspAdapter implements CapabilityAdapter {
+    readonly pool: LspPool;
+    readonly id = "lsp";
+    constructor(pool: LspPool);
+    execute(invocation: CapabilityInvocation): Promise<CapabilityOutput>;
+}
+export declare function lspCapabilities(config: NonNullable<HarnessConfig['lspServers']>, pool: LspPool): readonly RegisteredCapability[];