@memberjunction/ai-agent-harness 0.0.0 → 6.1.0-edge.2

package/LICENSE

@@ -0,0 +1,7 @@
+ISC License
+
+Copyright (c) 2023 MemberJunction
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -1,45 +1,210 @@
 # @memberjunction/ai-agent-harness
 
-## ⚠️ IMPORTANT NOTICE ⚠️
+Run an **external agent harness** — Claude Code, Codex CLI, OpenCode, Gemini CLI, Pi — as the
+reasoning substrate for a MemberJunction agent, while MJ keeps identity, permissions, governed data
+access, payload contracts, HITL, cost control and run-level audit.
 
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
+> **Design principle: the harness is a substrate, not a peer.** MJ owns the run record, the
+> credentials, the tool surface and the approval flow. The harness owns the reasoning inside a turn.
 
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
+Design plan: [`plans/external-agent-harness.md`](../../../plans/external-agent-harness.md)
 
-## Purpose
+---
+
+## The core idea: a harness turn *is* a Loop iteration
+
+`BaseAgent` already runs an iterate → decide → execute-steps → iterate loop where the "decide" input
+is a prompt execution. This package substitutes a **harness turn** for that prompt call and changes
+nothing else.
+
+```
+   ┌─ BaseAgent loop (unchanged) ──────────────────────────────────┐
+   │                                                               │
+   │   executePrompt() ──► [ HarnessAgentBase override ]           │
+   │        │                      │                               │
+   │        │                      ├─ adapter.RunTurn(input)       │
+   │        │                      ├─ accumulate usage             │
+   │        │                      └─ write AIPromptRun            │
+   │        ▼                                                      │
+   │   DetermineNextStep  (inherited from LoopAgentType)           │
+   │        ▼                                                      │
+   │   validate ─► execute actions / sub-agents / skills           │
+   │        ▼                                                      │
+   │   checkExecutionGuardrails ─► next turn                       │
+   └───────────────────────────────────────────────────────────────┘
+```
+
+The harness ends each turn by emitting the **Loop next-step JSON envelope**. MJ then executes any
+actions, sub-agents or skills through its own validated machinery and resumes the session with the
+results.
+
+**Why this matters:** every guardrail, payload ACL, HITL gate and accounting path already written for
+Loop agents applies to harness agents with no new enforcement code — and there is exactly **one**
+authority channel to audit, not two.
+
+---
+
+## Two registrations, one metadata column
+
+ClassFactory registrations are namespaced per base class, so `'HarnessAgentType'` is registered
+twice against different roots:
+
+| Registered under | Class | Resolved by | Gives you |
+|---|---|---|---|
+| `BaseAgentType` | `HarnessAgentType` | `BaseAgentType.GetAgentTypeInstance` | the turn protocol (inherits Loop) |
+| `BaseAgent` | `HarnessAgentBase` | `AgentRunner` (`AgentRunner.ts:101`) | the execution driver |
+
+Both read `AIAgentType.DriverClass`, so **one metadata value selects both halves**. This is the
+mechanism working as designed — `AgentRunner` already treats the type's `DriverClass` as a
+`BaseAgent` key and falls back to plain `BaseAgent` when unregistered, which is why every Loop agent
+gets the base execution class today.
+
+---
+
+## Adapters
+
+| Harness | DriverClass | Mechanism | Notes |
+|---|---|---|---|
+| Claude Code | `ClaudeCodeCliAdapter` | CLI, `stream-json` | Session resume; permission hook pending |
+| Codex | `CodexAdapter` | `codex exec --json` | Session resume |
+| OpenCode | `OpenCodeAdapter` | `opencode run` JSON | Session resume |
+| Gemini CLI | `GeminiCliAdapter` | `gemini --output-format json` | **No** resume — context replayed |
+| Pi | `PiAdapter` | stdio-JSON contract | Requires `ExecutablePath` |
+| *anything* | `StdioJsonAdapter` | documented JSON contract | Escape hatch — zero MJ code |
 
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@memberjunction/ai-agent-harness`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
+Register your own with `@RegisterClass(BaseHarnessAdapter, 'MyAdapter')` and point a harness row's
+`DriverClass` at it. No core changes required.
 
-## What is OIDC Trusted Publishing?
+### Capability honesty
 
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
+`AIAgentHarness.CapabilitySettings` (typed as `IHarnessCapabilitySettings`) declares what an adapter
+**actually implements**, because the runtime *emulates what is missing*. Gemini CLI reports
+`SessionResume: false`, so context is replayed each turn and those extra tokens are budgeted against
+the run's guardrails rather than quietly absorbed.
 
-## Setup Instructions
+Claiming a capability that is not wired up produces a silent behavioural gap, not an error. Report
+`false` and let the runtime compensate.
 
-To properly configure OIDC trusted publishing for this package:
+---
+
+## Sandboxes: the provider owns process placement
+
+Adapters never call `spawn`. They run everything through `SandboxExecutor`, obtained from the
+handle the provider returns.
+
+| Provider | Execution | Isolation |
+|---|---|---|
+| `LocalDirectorySandboxProvider` | direct spawn | **None** — dev only |
+| `DockerSandboxProvider` | `docker exec`, container per run | Real FS boundary; `networkPolicy: 'none'` enforced |
+
+> ⚠️ The local provider scopes a *directory*; it does **not** contain the *process*. `networkPolicy`
+> is advisory there. Anyone who believes `'none'` is enforced locally has a false sense of
+> containment, which is worse than knowing the boundary is soft.
+
+`HarnessProcess` is deliberately **stream-based**, not `ChildProcess`-based — a Kubernetes exec is
+streams over a websocket and a remote runner is HTTP, and neither could honestly implement a
+`ChildProcess` contract. It also makes adapters unit-testable with a fake executor: no binary, no
+container, no network.
 
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
+### `WorkspacePath` means "as the harness sees it"
 
-## DO NOT USE THIS PACKAGE
+A host path under the local provider; a **container-internal** path under Docker. Pass it to harness
+processes — do **not** open it with `fs` unless you know you are on the local provider.
 
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
+---
+
+## Configuration
+
+Per-agent, in `AIAgent.TypeConfiguration`, validated against `AIAgentType.ConfigSchema`:
 
-## More Information
+```jsonc
+{
+  "harnessName": "Claude Code",          // lookup into MJ: AI Agent Harnesses
+  "sandbox": {
+    "provider": "local",                 // local | docker
+    "image": "ghcr.io/memberjunction/harness-sandbox:latest",
+    "workspaceScope": "agent-user",      // run | agent | agent-user
+    "networkPolicy": "mcp-only"
+  }
+}
+```
 
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
+**Workspace scope** decides how long files live: `run` is discarded, `agent` is shared across every
+run of that agent, `agent-user` (default) is per agent per user — continuity without one user's
+working files leaking into another's session.
 
 ---
 
-**Maintained for OIDC setup purposes only**
+## Accounting — why every turn writes an `AIPromptRun`
+
+Run totals are **derived**: `calculateTokenStats` sums `AIAgentRunStep.PromptRun` rollups. A turn
+that records no prompt run contributes nothing, so the run reports zero tokens and zero cost
+*forever* — and its cost ceiling has nothing to compare against.
+
+`AIPromptRun.PromptID`, `.ModelID` and `.VendorID` are all **NOT NULL**, and each resolves to a
+**real** catalog row rather than a placeholder:
+
+| Column | Resolves to | Why it is not a fiction |
+|---|---|---|
+| `PromptID` | the agent type's system prompt | that template really did produce the turn |
+| `VendorID` | `AIAgentHarness.AIVendorID` | Claude Code really does call Anthropic |
+| `ModelID` | `AIAgentHarness.AIModelID` | the harness really does run that model |
+
+If none resolves, the runtime **fails loudly** rather than skipping the row. A silent skip is exactly
+how a cost ceiling stops protecting anything.
+
+---
+
+## Credentials
+
+`MJ: AI Agent Credentials` records the **grant edge** — which credentials an agent carries into its
+sandbox. Custody stays in `MJ: Credentials` / `CredentialEngine`.
+
+Environment injection is the **only** channel by which a secret reaches the harness, and it carries
+exactly what was granted — never the MJAPI process environment, never DB credentials, never a user
+token.
+
+Distinct from `MJ: AI Credential Bindings`, which is inference-selection plumbing for
+`AIPromptRunner` failover when *MJ itself* executes a prompt.
+
+---
+
+## The audit boundary
+
+MJ records what **crosses the boundary**: MCP loopback reads and the turn-end step. Activity *inside*
+the sandbox — file edits, shell commands — streams to `onProgress` for live view but is **not**
+persisted as run steps.
+
+This "opaque super-step" granularity is **intentional**. In-sandbox behaviour is governed by posture
+policy, not by run steps. Widening it is a design change, not a bug fix.
+
+---
+
+## Deployment
+
+| Environment | Provider | Notes |
+|---|---|---|
+| Local dev | `local` | Fast; uses the dev's own installed CLI and auth |
+| Local parity | `docker` | Same path as production |
+| AWS / Azure | `docker` → ECS/Fargate or ACI | Sandbox image versioned **separately** from MJAPI |
+
+Do **not** bake harness binaries into the MJAPI image. A harness running inside the API container
+inherits that container's network reach and IAM role — the wrong blast radius for a process
+executing an autonomous agent's shell commands.
+
+---
+
+## Known gaps
+
+- **`PermissionHooks: false` on every adapter.** The `strict` posture needs an MCP permission-prompt
+  tool that does not exist yet. Reported honestly so the runtime cannot assume interception it lacks.
+- **`networkPolicy` `mcp-only` / `allowlist` are not enforced at the packet level** under Docker —
+  documented as such rather than aliased to `open`.
+- **MCP loopback is not yet wired.** `HarnessSessionConfig` carries the fields; the server and
+  per-run scoped credential are still to come.
+- **`ModelID` uses the declared model**, not the model the harness reported for the turn. The
+  refinement belongs in `resolveAccountingIds` once adapters surface it.
+
+## License
+
+ISC

package/dist/HarnessAgentBase.d.ts

@@ -0,0 +1,261 @@
+import { BaseAgent } from '@memberjunction/ai-agents';
+import { AIPromptParams, AIPromptRunResult } from '@memberjunction/ai-core-plus';
+/**
+ * Executes an MJ agent whose reasoning substrate is an external harness.
+ *
+ * ## The single seam
+ *
+ * `BaseAgent` already runs an iterate → decide → execute-steps → iterate loop where the "decide"
+ * input is a prompt execution. This class overrides exactly one method — {@link executePrompt} — and
+ * substitutes a harness turn for that prompt call. Everything else is untouched `BaseAgent`: the
+ * loop, next-step validation, action and sub-agent execution, payload merging under ACLs, guardrail
+ * checks between iterations, and run-step recording.
+ *
+ * That is worth stating precisely because it is the whole architectural bet. `executePrompt` is a
+ * five-line protected method with a single call site, so substituting it changes what produces a
+ * decision without changing anything about how decisions are validated or enforced.
+ *
+ * ## Accounting is not optional
+ *
+ * A harness turn must produce a real `AIPromptRun` row. Run totals are DERIVED — `calculateTokenStats`
+ * sums `AIAgentRunStep.PromptRun` rollups — so a turn that records no prompt run contributes nothing,
+ * and the run reports zero tokens and zero cost forever. Combined with the cost guardrail, that means
+ * a runaway harness would never be interrupted: the ceiling would have nothing to compare against.
+ *
+ * `AIPromptRun.PromptID`, `.ModelID` and `.VendorID` are all NOT NULL, and every one is resolved to a
+ * REAL catalog row rather than a placeholder — see {@link resolveAccountingIds}.
+ */
+export declare class HarnessAgentBase extends BaseAgent {
+    private adapter;
+    private sandboxProvider;
+    private sandboxHandle;
+    private harnessRow;
+    private turnIndex;
+    /**
+     * Substitutes a harness turn for the prompt call a Loop agent would make.
+     *
+     * The returned {@link AIPromptRunResult} is shaped exactly as `AIPromptRunner` would shape one,
+     * because everything downstream — `DetermineNextStep`, the malformed-response retry machinery,
+     * step recording — reads it without knowing or caring that a harness produced it.
+     */
+    protected executePrompt(promptParams: AIPromptParams): Promise<AIPromptRunResult>;
+    /** Provisions the sandbox, resolves credentials and launches the harness session. */
+    private startHarnessSession;
+    /**
+     * Resolves what the agent may do inside its sandbox.
+     *
+     * Defaults to `strict` when unset — the safe direction. An agent that has never been given a
+     * posture should be unable to mutate anything, rather than inheriting whatever the harness does
+     * by default, which for a coding agent is a great deal.
+     */
+    private resolvePermissionPolicy;
+    /**
+     * Says out loud when a configured policy will not actually be enforced.
+     *
+     * Two distinct gaps, previously conflated behind one `PermissionHooks` check — which is why four
+     * adapters could ignore a policy entirely while the runtime warned about something else:
+     *
+     * 1. **`PermissionPolicy: false`** — the adapter never translated the policy into harness flags.
+     *    The posture and allow/deny lists are inert; the harness runs on its own defaults. This is
+     *    the serious one, because the agent's metadata reads as though something is gated.
+     * 2. **`PermissionHooks: false` under `strict`** — the policy applies, but there is no channel to
+     *    route an approval through, so anything requiring one is denied rather than escalated.
+     *
+     * Warn, don't fail. Refusing the run would take every adapter without a verified flag vocabulary
+     * offline, and an unenforced policy on a properly-provisioned sandbox is still contained by the
+     * sandbox. What is not acceptable is the operator not knowing which situation they are in.
+     */
+    private warnOnUnenforceablePolicy;
+    /**
+     * Finds a prior harness session this run can continue, if the adapter can use one.
+     *
+     * ## Why this is worth doing
+     *
+     * Without it, every message in a conversation opens a COLD session and MJ replays the whole
+     * history into it. Measured on two consecutive messages in one conversation: the second cost
+     * $0.0448 against the first's $0.0155 — nearly 3x, spent entirely on re-reading context the
+     * harness had already been told once.
+     *
+     * ## Three gates, each guarding a different way this goes wrong
+     *
+     * 1. `SessionResume` capability — a harness that cannot resume must keep replaying. Offering a
+     *    session id to an adapter that ignores it is harmless; ASSUMING it resumed is not, which is
+     *    why the outcome is reported back rather than inferred.
+     * 2. Workspace scope must be durable. Harnesses key their session store by working directory, so
+     *    a `run`-scoped workspace is a new directory every time and the session would never be
+     *    found. Gating here keeps the failure at "no resume" rather than a silent miss.
+     * 3. Same conversation. That is the continuity boundary users already understand — a time-based
+     *    cache would expire while someone is at lunch and, worse, leak stale context into an
+     *    unrelated new conversation.
+     */
+    private findResumableSession;
+    /** Accumulates one turn's event stream into a single result. */
+    private runTurn;
+    /**
+     * Writes the `AIPromptRun` that carries this turn's usage.
+     *
+     * Returns undefined only when the row could not be created, which is logged loudly rather than
+     * swallowed: without it the run's cost and token totals stay at zero and its guardrails go blind.
+     */
+    private recordPromptRun;
+    /**
+     * Resolves the three NOT NULL foreign keys on `AIPromptRun` to REAL catalog rows.
+     *
+     * None of these is a placeholder, which is the point — inventing catalog rows to satisfy a
+     * constraint would pollute the model and vendor catalogs with fictions that then show up in
+     * every cost report:
+     *
+     *   · PromptID — the agent type's system prompt. The harness turn really was produced by that
+     *     template; it is the same one the Loop type renders.
+     *   · VendorID — `AIAgentHarness.AIVendorID`. Claude Code really does call Anthropic.
+     *   · ModelID  — `AIAgentHarness.AIModelID`. Ideally this would be the model the harness
+     *     REPORTED for the turn, resolved by name; that refinement belongs here once adapters
+     *     surface it, and falls back to the declared model meanwhile.
+     */
+    private resolveAccountingIds;
+    /**
+     * Resolves the model the harness REPORTED using to an MJ catalog row.
+     *
+     * Recording the model we assumed rather than the one that ran is not a cosmetic problem: a
+     * harness picks its own model unless told otherwise, and Opus and Sonnet are not the same price,
+     * so the run's cost is attributed to the wrong model. Observed live — the harness ran
+     * `claude-opus-4-6` while the run recorded Claude Sonnet 5, purely because that was the harness
+     * row's declared anchor.
+     *
+     * Returns null when the reported name matches nothing, letting the caller fall back to the
+     * declared anchor. A miss is expected for a model newer than the catalog and must not fail the
+     * run — an approximate attribution still beats no AIPromptRun at all.
+     */
+    private resolveReportedModelId;
+    /**
+     * Records the harness session on the run.
+     *
+     * AIAgentRun.ExternalSessionID exists precisely so an MJ run can be correlated with the vendor's
+     * own session logs when diagnosing in-sandbox behaviour — the one place MJ's audit trail
+     * deliberately stops. It was added, documented, and then never populated, so answering "did this
+     * run resume its session?" meant reading the vendor's files off disk instead of the run record.
+     */
+    private persistExternalSessionId;
+    /**
+     * Builds the environment injected into the sandbox.
+     *
+     * ## Secrets travel as process environment, never as prompt text
+     *
+     * Everything resolved here is handed to the sandbox executor and becomes the harness PROCESS's
+     * environment. None of it is rendered into the turn prompt, so a credential never enters the
+     * model's context and cannot be echoed back, logged as conversation, or persisted to a run step.
+     * It lives exactly as long as the process does.
+     *
+     * ## Resolution order — credentials first, env as the documented fallback
+     *
+     * Mirrors how MJ's AI layer already resolves vendor keys, because operators should not have to
+     * learn a second scheme:
+     *
+     *   1. `MJ: AI Agent Credentials` grants for this agent, read from `MJ: Credentials`. The
+     *      governed path — auditable, revocable, per-agent.
+     *   2. The server's own `process.env[EnvVariableName]`. If a harness needs ANTHROPIC_API_KEY and
+     *      no credential row grants one, the MJAPI process's own value is used.
+     *   3. When the agent has no grants at all, the harness vendor's key under the existing
+     *      `AI_VENDOR_API_KEY__<DRIVER>` convention — the zero-config path.
+     *
+     * Preferring credentials matters: env vars are process-wide, so falling back means an agent gets
+     * whatever the server holds rather than only what it was granted. That is the pragmatic path for
+     * dev and single-tenant installs, and the reason multi-tenant deployments should grant
+     * explicitly. The distinction is logged, not silent.
+     */
+    private resolveGrantedEnvironment;
+    /**
+     * Zero-config path: use the harness vendor's key from the environment when the agent has no
+     * explicit grants.
+     *
+     * Uses the same `AI_VENDOR_API_KEY__<DRIVER>` convention the AI layer already uses, so a
+     * developer who has MJ talking to Anthropic already has Claude Code working without seeding a
+     * credential row.
+     */
+    private applyVendorKeyFallback;
+    /**
+     * Reads a credential's value.
+     *
+     * Custody stays in `MJ: Credentials` — this only reads what the agent was granted, and does not
+     * cache it beyond the session.
+     */
+    private loadCredentialValue;
+    /** Loads the harness registry row this agent selected by name. */
+    private loadHarnessRow;
+    /** Resolves the adapter class named by the harness row. */
+    private resolveAdapter;
+    /** Chooses a sandbox provider from the agent's configuration. */
+    private createSandboxProvider;
+    /** Reads and parses the harness block from the agent's TypeConfiguration. */
+    private readHarnessConfig;
+    /**
+     * The text handed to the harness for this turn.
+     *
+     * ## Turn 1 carries the RENDERED system prompt — this is not optional
+     *
+     * The agent-type system prompt template holds the turn-end contract AND, critically, the
+     * `_OUTPUT_EXAMPLE` placeholder that shows the harness the exact JSON envelope shape. In the
+     * normal Loop path `AIPromptRunner` renders that template; a harness turn bypasses
+     * AIPromptRunner, so without rendering it here the harness never sees the schema at all.
+     *
+     * The failure that caused is worth recording, because it did not look like a missing prompt.
+     * The harness emitted well-formed JSON and simply GUESSED the vocabulary — `nextStep.type` came
+     * back as `complete`, then `respond`, then `undefined`, none of which are Loop step names. Five
+     * turns were burned while BaseAgent's retry feedback taught it the contract one rejection at a
+     * time, turning a one-turn question into a two-minute run. A model inventing plausible values
+     * for a schema it was never shown reads as a sloppy model; it is actually a missing prompt.
+     *
+     * Later turns send only the conversation: the harness has the contract from turn 1 and, where
+     * `SessionResume` is true, still has it in session context.
+     */
+    private buildTurnInput;
+    /**
+     * The turn-end contract, carrying the ACTUAL envelope schema.
+     *
+     * Deliberately does not depend on template rendering succeeding. The schema reaches the harness
+     * from `AIPrompt.OutputExample` directly, because the first attempt at this relied on the
+     * agent-type template rendering `_OUTPUT_EXAMPLE` — and when that silently fell back to raw
+     * template text, the harness received the literal string `{{ _OUTPUT_EXAMPLE }}` and was no
+     * better off than before. It then invented step names (`complete`, `result`, `undefined`) across
+     * five wasted turns.
+     *
+     * The step vocabulary is listed explicitly too. A harness that knows the SHAPE but guesses the
+     * VALUES still fails validation, and that is precisely the failure mode observed: well-formed
+     * JSON, invented `nextStep.type`.
+     */
+    private buildTurnEndContract;
+    /**
+     * Renders the agent type's system prompt through the same template engine AIPromptRunner uses,
+     * so the harness receives exactly what a Loop model would — including the output example.
+     *
+     * Falls back to the raw template text if rendering fails. A partially-substituted prompt still
+     * carries the envelope shape and lets the run proceed; throwing here would fail a run over a
+     * template warning, which is the worse trade.
+     */
+    private renderSystemPrompt;
+    /** Shapes a harness turn as the prompt result the rest of BaseAgent expects. */
+    private buildPromptResult;
+    /**
+     * Wires {@link EndHarnessSession} into `BaseAgent.Execute()`'s per-run teardown. `Execute()`
+     * calls this exactly once per call, from its top-level `finally` block, regardless of outcome —
+     * without it, `startHarnessSession()`'s provisioned sandbox (a live Docker container or a
+     * workspace directory) is never finalized and leaks for the life of the host process.
+     */
+    protected finalizeRun(outcome: 'success' | 'failure' | 'cancelled'): Promise<void>;
+    /** Tears the session and sandbox down on every exit path. */
+    EndHarnessSession(outcome: 'success' | 'failure' | 'cancelled'): Promise<void>;
+    private _agentRunId;
+    private _agentRunAgentId;
+    /**
+     * The agent's type-specific configuration.
+     *
+     * Read from BaseAgent's `_executeParams`, NOT from `_agentConfig`: the latter is an
+     * AgentConfiguration (agentType / systemPrompt / childPrompt) and carries no agent entity, so
+     * reaching for `.agent` there silently yields undefined and every run fails with "does not name
+     * a harness" no matter how it is configured.
+     */
+    private _agentRunConversationId;
+    private _agentTypeConfiguration;
+    private _executeAgentParams;
+}
+//# sourceMappingURL=HarnessAgentBase.d.ts.map

package/dist/HarnessAgentBase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HarnessAgentBase.d.ts","sourceRoot":"","sources":["../src/HarnessAgentBase.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AA+DjF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBACa,gBAAiB,SAAQ,SAAS;IAC3C,OAAO,CAAC,OAAO,CAAmC;IAClD,OAAO,CAAC,eAAe,CAAiC;IACxD,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,UAAU,CAAuC;IACzD,OAAO,CAAC,SAAS,CAAK;IAEtB;;;;;;OAMG;cACsB,aAAa,CAAC,YAAY,EAAE,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA0BhG,qFAAqF;YACvE,mBAAmB;IA6CjC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAQ/B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,yBAAyB;IA2BjC;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,oBAAoB;IA6ClC,gEAAgE;YAClD,OAAO;IAgCrB;;;;;OAKG;YACW,eAAe;IAkE7B;;;;;;;;;;;;;OAaG;YACW,oBAAoB;IAYlC;;;;;;;;;;;;OAYG;YACW,sBAAsB;IA+CpC;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IAOhC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,yBAAyB;IAgDvC;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IA0B9B;;;;;OAKG;YACW,mBAAmB;IAcjC,kEAAkE;YACpD,cAAc;IA2B5B,2DAA2D;IAC3D,OAAO,CAAC,cAAc;IAiBtB,iEAAiE;IACjE,OAAO,CAAC,qBAAqB;IAM7B,6EAA6E;IAC7E,OAAO,CAAC,iBAAiB;IAazB;;;;;;;;;;;;;;;;;;;OAmBG;YACW,cAAc;IA4B5B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;;;;;;OAOG;YACW,kBAAkB;IA8ChC,gFAAgF;IAChF,OAAO,CAAC,iBAAiB;IAkCzB;;;;;OAKG;cACsB,WAAW,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjG,6DAA6D;IAChD,iBAAiB,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3F,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,mBAAmB;CAK9B"}