@odla-ai/harness 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 odla ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,178 @@
+# @odla-ai/harness
+
+@odla-ai/harness is the experimental coding-task boundary shared by odla
+Studio, a trusted Mac/Linux runner, and an untrusted coding-agent container.
+It owns the protocol and safe runner defaults; agent implementations such as Pi
+remain replaceable adapters.
+
+Harness can stage a bounded, secret-filtered copy of a local checkout. The
+brokered Pi image receives no workspace mount at all: reads and mutations cross
+the typed tool channel into that disposable snapshot. The original checkout,
+terminal credential, provider credentials, container-engine socket, and
+network are never available to Pi. Inference requests cross the same JSONL
+channel and are fulfilled by the control plane through @odla-ai/ai.
+
+## Personal Code terminal
+
+Open **Studio → Code → Terminal**, copy the command shown for the selected app
+and environment, and run it from that app's Git checkout. For example:
+
+~~~sh
+export ODLA_USER_EMAIL=owner@example.com
+npx @odla-ai/cli@0.16.4 code connect \
+  --platform https://odla.ai \
+  --app-id my-app \
+  --env dev
+~~~
+
+The terminal verifies the checkout and isolation engine, builds the Pi adapter
+bundled with the exact CLI release into a content-addressed local image, prepares
+each digest-pinned recipe image, and sends the connection request outbound to odla. The signed-in app
+owner approves it; no bearer is copied from the browser. The process stays in
+the foreground, opens no listener, and keeps its collected host credential in
+memory only.
+
+At connection time it freezes tracked and non-ignored untracked source into a
+staged snapshot, omitting `.git`, `.odla`, `.wrangler`, `node_modules`, build
+output, `.env` files, `.dev.vars`, credential JSON, unsafe paths, and symlinks.
+Each session binds an explicitly selected primary repository/ref plus any named
+read-only repository/ref references to exact commits and tree digests. A
+matching local snapshot remains an optimization with explicit provenance;
+otherwise Harness receives the immutable sources from the Registry. References
+are materialized under `.odla-references/<alias>` and the broker rejects every
+attempt to patch them. A checkpoint patch is computed against the selected
+primary Git base, so local developer changes remain explicit provenance
+alongside Pi's changes.
+
+On Apple Silicon with macOS 26, install Apple's lightweight runtime once with
+`brew install container`; `code connect` selects it and starts its user service.
+On Linux, auto requires rootless Podman. Podman Machine is the macOS fallback;
+Docker is an explicit compatibility adapter only. Recipe images must be
+digest-pinned; the Pi adapter's local tag contains the SHA-256 of its CLI bundle
+and requires no registry credential. All adapters run Pi networkless and
+non-root with bounded CPU/memory; Pi has no
+checkout or engine-socket mount.
+
+## Experimental task runner
+
+The older generic task queue is separate from the personal Pi terminal flow.
+It lives under **Code → Task runners · advanced**. To exercise it, register a
+workspace and keep its runner token outside shell history:
+
+~~~sh
+export ODLA_HARNESS_TOKEN=odla_hrn_...
+npx @odla-ai/harness runner \
+  --endpoint https://odla.ai \
+  --workspace my-repo=/absolute/path/to/repo \
+  --image registry.example/coding-agent@sha256:<digest> \
+  --engine auto
+~~~
+
+The runner adds network=none, a read-only root, dropped capabilities, non-root
+uid/gid, and CPU/memory limits across adapters. Docker and Podman additionally
+receive no-new-privileges plus PID and bounded-tmpfs limits. A legacy image's
+only writable mount is the disposable workspace copy; a broker-only image has
+no source mount.
+
+The runner skips .git, .odla, .wrangler, node_modules, build output, .env files,
+.dev.vars, credential JSON, and symlinks while staging. Completed attempts
+return a bounded binary-capable Git patch to Studio.
+
+Studio can branch the attempt ledger from an inspected event checkpoint. In
+this first release the branch records immutable lineage and starts from a fresh
+copy of the registered workspace; it does not replay the parent patch into the
+new copy.
+
+## Build recipes
+
+The Code terminal advertises a closed recipe catalog. The content-addressed,
+CLI-embedded Pi image and every registry-digest-pinned recipe are prepared
+before approval:
+
+~~~json
+{
+  "recipeAuthorization": "registered_recipe",
+  "recipes": [{
+    "id": "test",
+    "image": "registry.example/app-build@sha256:<digest>",
+    "command": ["npm", "test"],
+    "timeoutMs": 600000,
+    "maxOutputBytes": 1048576
+  }]
+}
+~~~
+
+The runtime validates HTTPS, never places its credential in a request body,
+never opens a listener, and rejects malformed or cross-host binding responses.
+Pi reads, patches, and runs only registered build recipes through the typed
+CaMeL broker. Checkpoint-stop captures a bounded combined patch; resume verifies
+it against the same selected Git base and exact local source descriptor.
+
+`--once` is diagnostic-only and refuses pending commands so a one-heartbeat
+probe cannot acknowledge a session as running and then immediately tear it
+down.
+
+## Agent protocol
+
+The image reads one JSON object per line on stdin and writes protocol messages
+on stdout. Version 1 supports task.start, typed event messages,
+inference.request/inference.response, tool.request/tool.response,
+attempt.cancel, and attempt.complete.
+
+## CaMeL tool and build boundary
+
+`createCodeToolBroker` is the trusted implementation for the three Pi tools:
+registered staged-file reads, confined unified patches, and app-registered
+build recipes. Each request is labelled and evaluated by @odla-ai/camel before
+an effect. Patch data remains Prompt-Unsafe payload; file and recipe selectors
+must pass closed conversions; recipe execution is either explicitly
+pre-authorized by app policy or bound to an exact approval digest.
+
+Recipes contain a fixed command and digest-pinned image. They run without a
+shell in a second networkless, non-root container over a newly staged copy.
+Build output and mutations are discarded after the bounded result returns. The
+decision binds a digest of the exact source copy, and the broker refuses to run
+if that copy changes after authorization. No repository code executes in the
+host runner process.
+
+`verifyCodeCandidate` is the independent landing verifier. It reconstructs the
+candidate from the registered trusted-base digest and patch, gives each fixed
+recipe a fresh source copy, and emits a digest-authenticated closed receipt.
+Raw stdout, stderr, and changed-test paths remain separate quarantined evidence
+for coding, review, and owner display. Only the prose-free receipt of registered
+recipe outcomes, digests, and changed-test counts can be promoted to planning
+Safe through `createTrustedCodeVerificationReceipt`; changed tests always set a
+separate review requirement.
+
+## Portable checkpoint and resume
+
+`createCodeWorkspaceCheckpoint` captures the staged candidate as a bounded,
+validated text patch plus closed resume state: plan and conversation cursors,
+build-policy and dependency-layer digests, completed effect receipts,
+unresolved approvals, and trust status. Patch, state, and total checkpoint have
+independent SHA-256 digests. The Registry verifies the complete payload before
+storing it and keeps only its digest in the command ledger.
+
+`restoreCodeWorkspaceCheckpoint` verifies every digest, requires the exact base
+commit, and applies the patch to a fresh staged copy on the currently bound
+host. `isCheckpointEffectCompleted` skips an exact prior effect and rejects an
+effect ID rebound to another action digest, preventing resume from replaying a
+database write, publication, or deployment.
+
+Use @odla-ai/harness for protocol types and validation,
+@odla-ai/harness/node for runner/container primitives, and
+@odla-ai/harness/testing for deterministic test doubles.
+
+## Local fixture image
+
+The included fixture proves the transport without running an autonomous coding
+agent:
+
+~~~sh
+docker build -t odla-harness-fixture:local packages/harness/fixtures
+ODLA_HARNESS_CONTAINER_TEST=1 npm test -w @odla-ai/harness
+~~~
+
+Unpinned images are accepted only when both the explicit test flag and
+ODLA_HARNESS_UNSAFE_TESTING=1 are present. That escape hatch is not intended
+for a connected Studio runner.

package/dist/chunk-ATKV6VTU.js

@@ -0,0 +1,168 @@
+import {
+  runContainerAttempt,
+  stageWorkspace
+} from "./chunk-PHXQH4YM.js";
+import {
+  makeHarnessEvent
+} from "./chunk-GE6CCN7W.js";
+import {
+  HARNESS_PROTOCOL_VERSION
+} from "./chunk-QTUEF2HZ.js";
+
+// src/runner.ts
+import { setTimeout as delay } from "timers/promises";
+async function append(control, lease, kind, actor, payload) {
+  await control.appendEvents(lease.task.attemptId, lease.leaseId, [makeHarnessEvent(kind, actor, payload)]);
+}
+async function runLeasedAttempt(lease, options) {
+  const source = options.workspaces[lease.task.workspace];
+  if (!source) {
+    await options.control.complete(lease.task.attemptId, lease.leaseId, {
+      status: "failed",
+      error: `runner does not expose workspace "${lease.task.workspace}"`
+    });
+    return;
+  }
+  let staged = null;
+  const controller = new AbortController();
+  const cancelFromParent = () => controller.abort(options.signal?.reason);
+  options.signal?.addEventListener("abort", cancelFromParent, { once: true });
+  if (options.signal?.aborted) controller.abort(options.signal.reason);
+  let heartbeat;
+  let heartbeatInFlight = false;
+  const pulse = async () => {
+    if (heartbeatInFlight || controller.signal.aborted) return;
+    heartbeatInFlight = true;
+    try {
+      const value = await options.control.heartbeat(lease.task.attemptId, lease.leaseId);
+      if (value.cancelRequested) controller.abort("cancel_requested");
+    } catch {
+      controller.abort("heartbeat_failed");
+    } finally {
+      heartbeatInFlight = false;
+    }
+  };
+  try {
+    await pulse();
+    heartbeat = setInterval(() => {
+      void pulse();
+    }, options.heartbeatMs ?? 15e3);
+    if (controller.signal.aborted) throw new Error("lease was cancelled before workspace staging");
+    staged = await stageWorkspace(source);
+    if (controller.signal.aborted) throw new Error("lease was cancelled during workspace staging");
+    const stagedWorkspace = staged;
+    await append(options.control, lease, "runner.workspace_staged", "runner", {
+      workspace: lease.task.workspace,
+      files: stagedWorkspace.fileCount,
+      bytes: stagedWorkspace.byteCount
+    });
+    const result = await runContainerAttempt({
+      engine: options.engine,
+      image: options.image,
+      workspaceDir: stagedWorkspace.workspaceDir,
+      task: lease.task,
+      limits: options.limits,
+      allowUnpinnedImage: options.allowUnpinnedImage,
+      workspaceAccess: options.workspaceAccess ?? (options.toolBroker ? "none" : "read-write"),
+      signal: controller.signal,
+      onStderr: async (text) => {
+        await append(options.control, lease, "agent.stderr", "agent", { text: text.slice(0, 64 * 1024) });
+      },
+      onMessage: async (message) => {
+        if (message.type === "event") {
+          await append(options.control, lease, message.kind, "agent", message.payload ?? null);
+          return;
+        }
+        if (message.type === "attempt.complete") {
+          await append(options.control, lease, "agent.completed", "agent", {
+            status: message.status,
+            result: message.result ?? null
+          });
+          return;
+        }
+        if (message.type === "tool.request") {
+          await append(options.control, lease, "tool.requested", "agent", {
+            requestId: message.requestId,
+            tool: message.tool
+          });
+          const response2 = options.toolBroker ? await options.toolBroker.execute({
+            lease,
+            workspaceDir: stagedWorkspace.workspaceDir,
+            signal: controller.signal
+          }, message) : { requestId: message.requestId, ok: false, content: "tool denied: no trusted broker configured" };
+          await append(options.control, lease, "tool.responded", "system", {
+            requestId: message.requestId,
+            tool: message.tool,
+            ok: response2.ok,
+            contentBytes: Buffer.byteLength(response2.content)
+          });
+          return { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "tool.response", ...response2 };
+        }
+        await append(options.control, lease, "model.requested", "agent", {
+          requestId: message.requestId,
+          messages: message.call.messages.length,
+          maxTokens: message.call.maxTokens
+        });
+        const response = await options.control.infer(lease.task.attemptId, lease.leaseId, {
+          requestId: message.requestId,
+          call: message.call
+        });
+        await append(options.control, lease, "model.responded", "model", {
+          requestId: message.requestId,
+          response: response.response,
+          receipt: response.receipt
+        });
+        return {
+          protocolVersion: HARNESS_PROTOCOL_VERSION,
+          type: "inference.response",
+          requestId: message.requestId,
+          response: response.response
+        };
+      }
+    });
+    const patch = await stagedWorkspace.patch(lease.task.policy.maxPatchBytes);
+    await options.control.complete(lease.task.attemptId, lease.leaseId, {
+      status: result.status,
+      result: result.result,
+      patch,
+      ...result.status === "failed" ? { error: result.stderr.slice(0, 4e3) || "container attempt failed" } : {}
+    });
+  } catch (reason) {
+    const message = reason instanceof Error ? reason.message : "runner failed";
+    try {
+      await append(options.control, lease, "runner.failed", "runner", { message });
+      await options.control.complete(lease.task.attemptId, lease.leaseId, {
+        status: controller.signal.aborted ? "cancelled" : "failed",
+        error: message
+      });
+    } catch {
+    }
+  } finally {
+    if (heartbeat) clearInterval(heartbeat);
+    options.signal?.removeEventListener("abort", cancelFromParent);
+    if (staged && !options.preserveWorkspace) await staged.cleanup();
+  }
+}
+async function runHarnessRunner(options) {
+  const workspaceNames = Object.keys(options.workspaces).sort();
+  if (!workspaceNames.length) throw new TypeError("at least one workspace mapping is required");
+  do {
+    if (options.signal?.aborted) return;
+    const lease = await options.control.lease(workspaceNames);
+    if (lease) {
+      options.log?.(`leased ${lease.task.taskId}/${lease.task.attemptId}`);
+      await runLeasedAttempt(lease, options);
+      if (options.once) return;
+      continue;
+    }
+    if (options.once) return;
+    await delay(options.pollMs ?? 2e3, void 0, { signal: options.signal }).catch(() => {
+    });
+  } while (!options.signal?.aborted);
+}
+
+export {
+  runLeasedAttempt,
+  runHarnessRunner
+};
+//# sourceMappingURL=chunk-ATKV6VTU.js.map

package/dist/chunk-ATKV6VTU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runner.ts"],"sourcesContent":["import { setTimeout as delay } from \"node:timers/promises\";\nimport { runContainerAttempt, type ContainerEngine, type ContainerLimits } from \"./container\";\nimport { makeHarnessEvent } from \"./protocol\";\nimport { stageWorkspace, type StagedWorkspace } from \"./workspace\";\nimport {\n  HARNESS_PROTOCOL_VERSION,\n  type HarnessAgentInput,\n  type HarnessAgentOutput,\n  type HarnessControlPlane,\n  type HarnessLease,\n  type HarnessToolBroker,\n} from \"./types\";\n\n/** Control-plane, workspace, isolation, polling, and lifecycle settings for a runner. */\nexport interface HarnessRunnerOptions {\n  control: HarnessControlPlane;\n  workspaces: Readonly<Record<string, string>>;\n  engine: ContainerEngine;\n  image: string;\n  limits?: ContainerLimits;\n  heartbeatMs?: number;\n  pollMs?: number;\n  once?: boolean;\n  preserveWorkspace?: boolean;\n  allowUnpinnedImage?: boolean;\n  workspaceAccess?: \"read-write\" | \"read-only\" | \"none\";\n  signal?: AbortSignal;\n  log?: (message: string) => void;\n  toolBroker?: HarnessToolBroker;\n}\n\nasync function append(\n  control: HarnessControlPlane,\n  lease: HarnessLease,\n  kind: string,\n  actor: \"runner\" | \"agent\" | \"model\" | \"system\",\n  payload: unknown,\n): Promise<void> {\n  await control.appendEvents(lease.task.attemptId, lease.leaseId, [makeHarnessEvent(kind, actor, payload)]);\n}\n\n/** Execute one leased task. The registered workspace is copied before the\n * container starts; neither the checkout nor the runner credential is mounted. */\nexport async function runLeasedAttempt(lease: HarnessLease, options: HarnessRunnerOptions): Promise<void> {\n  const source = options.workspaces[lease.task.workspace];\n  if (!source) {\n    await options.control.complete(lease.task.attemptId, lease.leaseId, {\n      status: \"failed\",\n      error: `runner does not expose workspace \"${lease.task.workspace}\"`,\n    });\n    return;\n  }\n\n  let staged: StagedWorkspace | null = null;\n  const controller = new AbortController();\n  const cancelFromParent = () => controller.abort(options.signal?.reason);\n  options.signal?.addEventListener(\"abort\", cancelFromParent, { once: true });\n  if (options.signal?.aborted) controller.abort(options.signal.reason);\n  let heartbeat: ReturnType<typeof setInterval> | undefined;\n  let heartbeatInFlight = false;\n  const pulse = async () => {\n    if (heartbeatInFlight || controller.signal.aborted) return;\n    heartbeatInFlight = true;\n    try {\n      const value = await options.control.heartbeat(lease.task.attemptId, lease.leaseId);\n      if (value.cancelRequested) controller.abort(\"cancel_requested\");\n    } catch {\n      controller.abort(\"heartbeat_failed\");\n    } finally {\n      heartbeatInFlight = false;\n    }\n  };\n  try {\n    await pulse();\n    heartbeat = setInterval(() => { void pulse(); }, options.heartbeatMs ?? 15_000);\n    if (controller.signal.aborted) throw new Error(\"lease was cancelled before workspace staging\");\n    staged = await stageWorkspace(source);\n    if (controller.signal.aborted) throw new Error(\"lease was cancelled during workspace staging\");\n    const stagedWorkspace = staged;\n    await append(options.control, lease, \"runner.workspace_staged\", \"runner\", {\n      workspace: lease.task.workspace,\n      files: stagedWorkspace.fileCount,\n      bytes: stagedWorkspace.byteCount,\n    });\n\n    const result = await runContainerAttempt({\n      engine: options.engine,\n      image: options.image,\n      workspaceDir: stagedWorkspace.workspaceDir,\n      task: lease.task,\n      limits: options.limits,\n      allowUnpinnedImage: options.allowUnpinnedImage,\n      workspaceAccess: options.workspaceAccess ?? (options.toolBroker ? \"none\" : \"read-write\"),\n      signal: controller.signal,\n      onStderr: async (text) => {\n        await append(options.control, lease, \"agent.stderr\", \"agent\", { text: text.slice(0, 64 * 1024) });\n      },\n      onMessage: async (message: HarnessAgentOutput): Promise<HarnessAgentInput | void> => {\n        if (message.type === \"event\") {\n          await append(options.control, lease, message.kind, \"agent\", message.payload ?? null);\n          return;\n        }\n        if (message.type === \"attempt.complete\") {\n          await append(options.control, lease, \"agent.completed\", \"agent\", {\n            status: message.status,\n            result: message.result ?? null,\n          });\n          return;\n        }\n        if (message.type === \"tool.request\") {\n          await append(options.control, lease, \"tool.requested\", \"agent\", {\n            requestId: message.requestId, tool: message.tool,\n          });\n          const response = options.toolBroker\n            ? await options.toolBroker.execute({\n              lease, workspaceDir: stagedWorkspace.workspaceDir, signal: controller.signal,\n            }, message)\n            : { requestId: message.requestId, ok: false, content: \"tool denied: no trusted broker configured\" };\n          await append(options.control, lease, \"tool.responded\", \"system\", {\n            requestId: message.requestId, tool: message.tool, ok: response.ok,\n            contentBytes: Buffer.byteLength(response.content),\n          });\n          return { protocolVersion: HARNESS_PROTOCOL_VERSION, type: \"tool.response\", ...response };\n        }\n        await append(options.control, lease, \"model.requested\", \"agent\", {\n          requestId: message.requestId,\n          messages: message.call.messages.length,\n          maxTokens: message.call.maxTokens,\n        });\n        const response = await options.control.infer(lease.task.attemptId, lease.leaseId, {\n          requestId: message.requestId,\n          call: message.call,\n        });\n        await append(options.control, lease, \"model.responded\", \"model\", {\n          requestId: message.requestId,\n          response: response.response,\n          receipt: response.receipt,\n        });\n        return {\n          protocolVersion: HARNESS_PROTOCOL_VERSION,\n          type: \"inference.response\",\n          requestId: message.requestId,\n          response: response.response,\n        };\n      },\n    });\n\n    const patch = await stagedWorkspace.patch(lease.task.policy.maxPatchBytes);\n    await options.control.complete(lease.task.attemptId, lease.leaseId, {\n      status: result.status,\n      result: result.result,\n      patch,\n      ...(result.status === \"failed\" ? { error: result.stderr.slice(0, 4_000) || \"container attempt failed\" } : {}),\n    });\n  } catch (reason) {\n    const message = reason instanceof Error ? reason.message : \"runner failed\";\n    try {\n      await append(options.control, lease, \"runner.failed\", \"runner\", { message });\n      await options.control.complete(lease.task.attemptId, lease.leaseId, {\n        status: controller.signal.aborted ? \"cancelled\" : \"failed\",\n        error: message,\n      });\n    } catch {\n      // A lost or revoked lease can also make the terminal report unavailable.\n    }\n  } finally {\n    if (heartbeat) clearInterval(heartbeat);\n    options.signal?.removeEventListener(\"abort\", cancelFromParent);\n    if (staged && !options.preserveWorkspace) await staged.cleanup();\n  }\n}\n\n/** One runner executes one attempt at a time. Concurrency comes from multiple\n * independently credentialed runner processes. */\nexport async function runHarnessRunner(options: HarnessRunnerOptions): Promise<void> {\n  const workspaceNames = Object.keys(options.workspaces).sort();\n  if (!workspaceNames.length) throw new TypeError(\"at least one workspace mapping is required\");\n  do {\n    if (options.signal?.aborted) return;\n    const lease = await options.control.lease(workspaceNames);\n    if (lease) {\n      options.log?.(`leased ${lease.task.taskId}/${lease.task.attemptId}`);\n      await runLeasedAttempt(lease, options);\n      if (options.once) return;\n      continue;\n    }\n    if (options.once) return;\n    await delay(options.pollMs ?? 2_000, undefined, { signal: options.signal }).catch(() => {});\n  } while (!options.signal?.aborted);\n}\n"],"mappings":";;;;;;;;;;;;AAAA,SAAS,cAAc,aAAa;AA+BpC,eAAe,OACb,SACA,OACA,MACA,OACA,SACe;AACf,QAAM,QAAQ,aAAa,MAAM,KAAK,WAAW,MAAM,SAAS,CAAC,iBAAiB,MAAM,OAAO,OAAO,CAAC,CAAC;AAC1G;AAIA,eAAsB,iBAAiB,OAAqB,SAA8C;AACxG,QAAM,SAAS,QAAQ,WAAW,MAAM,KAAK,SAAS;AACtD,MAAI,CAAC,QAAQ;AACX,UAAM,QAAQ,QAAQ,SAAS,MAAM,KAAK,WAAW,MAAM,SAAS;AAAA,MAClE,QAAQ;AAAA,MACR,OAAO,qCAAqC,MAAM,KAAK,SAAS;AAAA,IAClE,CAAC;AACD;AAAA,EACF;AAEA,MAAI,SAAiC;AACrC,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,mBAAmB,MAAM,WAAW,MAAM,QAAQ,QAAQ,MAAM;AACtE,UAAQ,QAAQ,iBAAiB,SAAS,kBAAkB,EAAE,MAAM,KAAK,CAAC;AAC1E,MAAI,QAAQ,QAAQ,QAAS,YAAW,MAAM,QAAQ,OAAO,MAAM;AACnE,MAAI;AACJ,MAAI,oBAAoB;AACxB,QAAM,QAAQ,YAAY;AACxB,QAAI,qBAAqB,WAAW,OAAO,QAAS;AACpD,wBAAoB;AACpB,QAAI;AACF,YAAM,QAAQ,MAAM,QAAQ,QAAQ,UAAU,MAAM,KAAK,WAAW,MAAM,OAAO;AACjF,UAAI,MAAM,gBAAiB,YAAW,MAAM,kBAAkB;AAAA,IAChE,QAAQ;AACN,iBAAW,MAAM,kBAAkB;AAAA,IACrC,UAAE;AACA,0BAAoB;AAAA,IACtB;AAAA,EACF;AACA,MAAI;AACF,UAAM,MAAM;AACZ,gBAAY,YAAY,MAAM;AAAE,WAAK,MAAM;AAAA,IAAG,GAAG,QAAQ,eAAe,IAAM;AAC9E,QAAI,WAAW,OAAO,QAAS,OAAM,IAAI,MAAM,8CAA8C;AAC7F,aAAS,MAAM,eAAe,MAAM;AACpC,QAAI,WAAW,OAAO,QAAS,OAAM,IAAI,MAAM,8CAA8C;AAC7F,UAAM,kBAAkB;AACxB,UAAM,OAAO,QAAQ,SAAS,OAAO,2BAA2B,UAAU;AAAA,MACxE,WAAW,MAAM,KAAK;AAAA,MACtB,OAAO,gBAAgB;AAAA,MACvB,OAAO,gBAAgB;AAAA,IACzB,CAAC;AAED,UAAM,SAAS,MAAM,oBAAoB;AAAA,MACvC,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,cAAc,gBAAgB;AAAA,MAC9B,MAAM,MAAM;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,oBAAoB,QAAQ;AAAA,MAC5B,iBAAiB,QAAQ,oBAAoB,QAAQ,aAAa,SAAS;AAAA,MAC3E,QAAQ,WAAW;AAAA,MACnB,UAAU,OAAO,SAAS;AACxB,cAAM,OAAO,QAAQ,SAAS,OAAO,gBAAgB,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,EAAE,CAAC;AAAA,MAClG;AAAA,MACA,WAAW,OAAO,YAAmE;AACnF,YAAI,QAAQ,SAAS,SAAS;AAC5B,gBAAM,OAAO,QAAQ,SAAS,OAAO,QAAQ,MAAM,SAAS,QAAQ,WAAW,IAAI;AACnF;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,oBAAoB;AACvC,gBAAM,OAAO,QAAQ,SAAS,OAAO,mBAAmB,SAAS;AAAA,YAC/D,QAAQ,QAAQ;AAAA,YAChB,QAAQ,QAAQ,UAAU;AAAA,UAC5B,CAAC;AACD;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,gBAAgB;AACnC,gBAAM,OAAO,QAAQ,SAAS,OAAO,kBAAkB,SAAS;AAAA,YAC9D,WAAW,QAAQ;AAAA,YAAW,MAAM,QAAQ;AAAA,UAC9C,CAAC;AACD,gBAAMA,YAAW,QAAQ,aACrB,MAAM,QAAQ,WAAW,QAAQ;AAAA,YACjC;AAAA,YAAO,cAAc,gBAAgB;AAAA,YAAc,QAAQ,WAAW;AAAA,UACxE,GAAG,OAAO,IACR,EAAE,WAAW,QAAQ,WAAW,IAAI,OAAO,SAAS,4CAA4C;AACpG,gBAAM,OAAO,QAAQ,SAAS,OAAO,kBAAkB,UAAU;AAAA,YAC/D,WAAW,QAAQ;AAAA,YAAW,MAAM,QAAQ;AAAA,YAAM,IAAIA,UAAS;AAAA,YAC/D,cAAc,OAAO,WAAWA,UAAS,OAAO;AAAA,UAClD,CAAC;AACD,iBAAO,EAAE,iBAAiB,0BAA0B,MAAM,iBAAiB,GAAGA,UAAS;AAAA,QACzF;AACA,cAAM,OAAO,QAAQ,SAAS,OAAO,mBAAmB,SAAS;AAAA,UAC/D,WAAW,QAAQ;AAAA,UACnB,UAAU,QAAQ,KAAK,SAAS;AAAA,UAChC,WAAW,QAAQ,KAAK;AAAA,QAC1B,CAAC;AACD,cAAM,WAAW,MAAM,QAAQ,QAAQ,MAAM,MAAM,KAAK,WAAW,MAAM,SAAS;AAAA,UAChF,WAAW,QAAQ;AAAA,UACnB,MAAM,QAAQ;AAAA,QAChB,CAAC;AACD,cAAM,OAAO,QAAQ,SAAS,OAAO,mBAAmB,SAAS;AAAA,UAC/D,WAAW,QAAQ;AAAA,UACnB,UAAU,SAAS;AAAA,UACnB,SAAS,SAAS;AAAA,QACpB,CAAC;AACD,eAAO;AAAA,UACL,iBAAiB;AAAA,UACjB,MAAM;AAAA,UACN,WAAW,QAAQ;AAAA,UACnB,UAAU,SAAS;AAAA,QACrB;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,QAAQ,MAAM,gBAAgB,MAAM,MAAM,KAAK,OAAO,aAAa;AACzE,UAAM,QAAQ,QAAQ,SAAS,MAAM,KAAK,WAAW,MAAM,SAAS;AAAA,MAClE,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf;AAAA,MACA,GAAI,OAAO,WAAW,WAAW,EAAE,OAAO,OAAO,OAAO,MAAM,GAAG,GAAK,KAAK,2BAA2B,IAAI,CAAC;AAAA,IAC7G,CAAC;AAAA,EACH,SAAS,QAAQ;AACf,UAAM,UAAU,kBAAkB,QAAQ,OAAO,UAAU;AAC3D,QAAI;AACF,YAAM,OAAO,QAAQ,SAAS,OAAO,iBAAiB,UAAU,EAAE,QAAQ,CAAC;AAC3E,YAAM,QAAQ,QAAQ,SAAS,MAAM,KAAK,WAAW,MAAM,SAAS;AAAA,QAClE,QAAQ,WAAW,OAAO,UAAU,cAAc;AAAA,QAClD,OAAO;AAAA,MACT,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF,UAAE;AACA,QAAI,UAAW,eAAc,SAAS;AACtC,YAAQ,QAAQ,oBAAoB,SAAS,gBAAgB;AAC7D,QAAI,UAAU,CAAC,QAAQ,kBAAmB,OAAM,OAAO,QAAQ;AAAA,EACjE;AACF;AAIA,eAAsB,iBAAiB,SAA8C;AACnF,QAAM,iBAAiB,OAAO,KAAK,QAAQ,UAAU,EAAE,KAAK;AAC5D,MAAI,CAAC,eAAe,OAAQ,OAAM,IAAI,UAAU,4CAA4C;AAC5F,KAAG;AACD,QAAI,QAAQ,QAAQ,QAAS;AAC7B,UAAM,QAAQ,MAAM,QAAQ,QAAQ,MAAM,cAAc;AACxD,QAAI,OAAO;AACT,cAAQ,MAAM,UAAU,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE;AACnE,YAAM,iBAAiB,OAAO,OAAO;AACrC,UAAI,QAAQ,KAAM;AAClB;AAAA,IACF;AACA,QAAI,QAAQ,KAAM;AAClB,UAAM,MAAM,QAAQ,UAAU,KAAO,QAAW,EAAE,QAAQ,QAAQ,OAAO,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC5F,SAAS,CAAC,QAAQ,QAAQ;AAC5B;","names":["response"]}

package/dist/chunk-GE6CCN7W.js

@@ -0,0 +1,93 @@
+import {
+  HARNESS_PROTOCOL_VERSION
+} from "./chunk-QTUEF2HZ.js";
+
+// src/protocol.ts
+var CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
+var HarnessProtocolError = class extends Error {
+  name = "HarnessProtocolError";
+};
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function boundedText(value, label, max) {
+  if (typeof value !== "string" || !value || value.length > max || CONTROL.test(value)) {
+    throw new HarnessProtocolError(`${label} must be a non-empty string of at most ${max} characters`);
+  }
+  return value;
+}
+function parseAgentOutput(line) {
+  if (Buffer.byteLength(line, "utf8") > 1e6) throw new HarnessProtocolError("agent message exceeds 1 MB");
+  let value;
+  try {
+    value = JSON.parse(line);
+  } catch {
+    throw new HarnessProtocolError("agent emitted invalid JSON");
+  }
+  const message = record(value);
+  if (!message || message.protocolVersion !== HARNESS_PROTOCOL_VERSION) {
+    throw new HarnessProtocolError(`agent protocolVersion must be ${HARNESS_PROTOCOL_VERSION}`);
+  }
+  if (message.type === "event") {
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "event",
+      kind: boundedText(message.kind, "event.kind", 120),
+      ...message.payload === void 0 ? {} : { payload: message.payload }
+    };
+  }
+  if (message.type === "inference.request") {
+    const call = record(message.call);
+    if (!call || !Array.isArray(call.messages) || !Number.isSafeInteger(call.maxTokens)) {
+      throw new HarnessProtocolError("inference.request.call requires messages and maxTokens");
+    }
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "inference.request",
+      requestId: boundedText(message.requestId, "requestId", 180),
+      call
+    };
+  }
+  if (message.type === "tool.request") {
+    const input = record(message.input);
+    const tool = String(message.tool);
+    if (!input || !["sandbox.read", "sandbox.apply_patch", "sandbox.run_recipe"].includes(tool)) {
+      throw new HarnessProtocolError("tool.request requires a registered tool and object input");
+    }
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "tool.request",
+      requestId: boundedText(message.requestId, "requestId", 180),
+      tool,
+      input
+    };
+  }
+  if (message.type === "attempt.complete") {
+    if (!(/* @__PURE__ */ new Set(["completed", "failed", "cancelled"])).has(String(message.status))) {
+      throw new HarnessProtocolError("attempt.complete.status is invalid");
+    }
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "attempt.complete",
+      status: message.status,
+      ...message.result === void 0 ? {} : { result: message.result }
+    };
+  }
+  throw new HarnessProtocolError("agent message type is unsupported");
+}
+function encodeAgentInput(message) {
+  return `${JSON.stringify(message)}
+`;
+}
+function makeHarnessEvent(kind, actor, payload, now = Date.now(), id = crypto.randomUUID()) {
+  boundedText(kind, "event.kind", 120);
+  return { eventId: id, kind, actor, payload, createdAt: now };
+}
+
+export {
+  HarnessProtocolError,
+  parseAgentOutput,
+  encodeAgentInput,
+  makeHarnessEvent
+};
+//# sourceMappingURL=chunk-GE6CCN7W.js.map

package/dist/chunk-GE6CCN7W.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/protocol.ts"],"sourcesContent":["import type { ChatInput } from \"@odla-ai/ai\";\nimport {\n  HARNESS_PROTOCOL_VERSION,\n  type HarnessAgentInput,\n  type HarnessAgentOutput,\n  type HarnessEventInput,\n} from \"./types\";\n\nconst CONTROL = /[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f]/;\n\n/** Error raised when an agent emits malformed, oversized, or unsupported protocol data. */\nexport class HarnessProtocolError extends Error {\n  override readonly name = \"HarnessProtocolError\";\n}\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? value as Record<string, unknown>\n    : null;\n}\n\nfunction boundedText(value: unknown, label: string, max: number): string {\n  if (typeof value !== \"string\" || !value || value.length > max || CONTROL.test(value)) {\n    throw new HarnessProtocolError(`${label} must be a non-empty string of at most ${max} characters`);\n  }\n  return value;\n}\n\n/** Parse and validate one newline-delimited message emitted by an agent container. */\nexport function parseAgentOutput(line: string): HarnessAgentOutput {\n  if (Buffer.byteLength(line, \"utf8\") > 1_000_000) throw new HarnessProtocolError(\"agent message exceeds 1 MB\");\n  let value: unknown;\n  try { value = JSON.parse(line); } catch { throw new HarnessProtocolError(\"agent emitted invalid JSON\"); }\n  const message = record(value);\n  if (!message || message.protocolVersion !== HARNESS_PROTOCOL_VERSION) {\n    throw new HarnessProtocolError(`agent protocolVersion must be ${HARNESS_PROTOCOL_VERSION}`);\n  }\n  if (message.type === \"event\") {\n    return {\n      protocolVersion: HARNESS_PROTOCOL_VERSION,\n      type: \"event\",\n      kind: boundedText(message.kind, \"event.kind\", 120),\n      ...(message.payload === undefined ? {} : { payload: message.payload }),\n    };\n  }\n  if (message.type === \"inference.request\") {\n    const call = record(message.call);\n    if (!call || !Array.isArray(call.messages) || !Number.isSafeInteger(call.maxTokens)) {\n      throw new HarnessProtocolError(\"inference.request.call requires messages and maxTokens\");\n    }\n    return {\n      protocolVersion: HARNESS_PROTOCOL_VERSION,\n      type: \"inference.request\",\n      requestId: boundedText(message.requestId, \"requestId\", 180),\n      call: call as unknown as ChatInput,\n    };\n  }\n  if (message.type === \"tool.request\") {\n    const input = record(message.input);\n    const tool = String(message.tool);\n    if (!input || ![\"sandbox.read\", \"sandbox.apply_patch\", \"sandbox.run_recipe\"].includes(tool)) {\n      throw new HarnessProtocolError(\"tool.request requires a registered tool and object input\");\n    }\n    return {\n      protocolVersion: HARNESS_PROTOCOL_VERSION,\n      type: \"tool.request\",\n      requestId: boundedText(message.requestId, \"requestId\", 180),\n      tool: tool as \"sandbox.read\" | \"sandbox.apply_patch\" | \"sandbox.run_recipe\",\n      input,\n    };\n  }\n  if (message.type === \"attempt.complete\") {\n    if (!new Set([\"completed\", \"failed\", \"cancelled\"]).has(String(message.status))) {\n      throw new HarnessProtocolError(\"attempt.complete.status is invalid\");\n    }\n    return {\n      protocolVersion: HARNESS_PROTOCOL_VERSION,\n      type: \"attempt.complete\",\n      status: message.status as \"completed\" | \"failed\" | \"cancelled\",\n      ...(message.result === undefined ? {} : { result: message.result }),\n    };\n  }\n  throw new HarnessProtocolError(\"agent message type is unsupported\");\n}\n\n/** Serialize one trusted runner message as a newline-terminated JSONL record. */\nexport function encodeAgentInput(message: HarnessAgentInput): string {\n  return `${JSON.stringify(message)}\\n`;\n}\n\n/** Create a timestamped, uniquely identified event for control-plane submission. */\nexport function makeHarnessEvent(\n  kind: string,\n  actor: HarnessEventInput[\"actor\"],\n  payload: unknown,\n  now = Date.now(),\n  id = crypto.randomUUID(),\n): HarnessEventInput {\n  boundedText(kind, \"event.kind\", 120);\n  return { eventId: id, kind, actor, payload, createdAt: now };\n}\n"],"mappings":";;;;;AAQA,IAAM,UAAU;AAGT,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC5B,OAAO;AAC3B;AAEA,SAAS,OAAO,OAAgD;AAC9D,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACtE,QACA;AACN;AAEA,SAAS,YAAY,OAAgB,OAAe,KAAqB;AACvE,MAAI,OAAO,UAAU,YAAY,CAAC,SAAS,MAAM,SAAS,OAAO,QAAQ,KAAK,KAAK,GAAG;AACpF,UAAM,IAAI,qBAAqB,GAAG,KAAK,0CAA0C,GAAG,aAAa;AAAA,EACnG;AACA,SAAO;AACT;AAGO,SAAS,iBAAiB,MAAkC;AACjE,MAAI,OAAO,WAAW,MAAM,MAAM,IAAI,IAAW,OAAM,IAAI,qBAAqB,4BAA4B;AAC5G,MAAI;AACJ,MAAI;AAAE,YAAQ,KAAK,MAAM,IAAI;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,qBAAqB,4BAA4B;AAAA,EAAG;AACxG,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,CAAC,WAAW,QAAQ,oBAAoB,0BAA0B;AACpE,UAAM,IAAI,qBAAqB,iCAAiC,wBAAwB,EAAE;AAAA,EAC5F;AACA,MAAI,QAAQ,SAAS,SAAS;AAC5B,WAAO;AAAA,MACL,iBAAiB;AAAA,MACjB,MAAM;AAAA,MACN,MAAM,YAAY,QAAQ,MAAM,cAAc,GAAG;AAAA,MACjD,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,IACtE;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,qBAAqB;AACxC,UAAM,OAAO,OAAO,QAAQ,IAAI;AAChC,QAAI,CAAC,QAAQ,CAAC,MAAM,QAAQ,KAAK,QAAQ,KAAK,CAAC,OAAO,cAAc,KAAK,SAAS,GAAG;AACnF,YAAM,IAAI,qBAAqB,wDAAwD;AAAA,IACzF;AACA,WAAO;AAAA,MACL,iBAAiB;AAAA,MACjB,MAAM;AAAA,MACN,WAAW,YAAY,QAAQ,WAAW,aAAa,GAAG;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,gBAAgB;AACnC,UAAM,QAAQ,OAAO,QAAQ,KAAK;AAClC,UAAM,OAAO,OAAO,QAAQ,IAAI;AAChC,QAAI,CAAC,SAAS,CAAC,CAAC,gBAAgB,uBAAuB,oBAAoB,EAAE,SAAS,IAAI,GAAG;AAC3F,YAAM,IAAI,qBAAqB,0DAA0D;AAAA,IAC3F;AACA,WAAO;AAAA,MACL,iBAAiB;AAAA,MACjB,MAAM;AAAA,MACN,WAAW,YAAY,QAAQ,WAAW,aAAa,GAAG;AAAA,MAC1D;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,oBAAoB;AACvC,QAAI,EAAC,oBAAI,IAAI,CAAC,aAAa,UAAU,WAAW,CAAC,GAAE,IAAI,OAAO,QAAQ,MAAM,CAAC,GAAG;AAC9E,YAAM,IAAI,qBAAqB,oCAAoC;AAAA,IACrE;AACA,WAAO;AAAA,MACL,iBAAiB;AAAA,MACjB,MAAM;AAAA,MACN,QAAQ,QAAQ;AAAA,MAChB,GAAI,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,IACnE;AAAA,EACF;AACA,QAAM,IAAI,qBAAqB,mCAAmC;AACpE;AAGO,SAAS,iBAAiB,SAAoC;AACnE,SAAO,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA;AACnC;AAGO,SAAS,iBACd,MACA,OACA,SACA,MAAM,KAAK,IAAI,GACf,KAAK,OAAO,WAAW,GACJ;AACnB,cAAY,MAAM,cAAc,GAAG;AACnC,SAAO,EAAE,SAAS,IAAI,MAAM,OAAO,SAAS,WAAW,IAAI;AAC7D;","names":[]}