@oharness/engine 0.1.0

package/dist/auth/types.d.ts

@@ -0,0 +1,167 @@
+/**
+ * Authentication contract.
+ *
+ * Two things drive the design:
+ *
+ * 1. Subscription credentials expire. Anything that snapshots a header at
+ *    construction time breaks an hour later, so credentials are resolved
+ *    **per request** and the resolver owns refresh.
+ * 2. Login flows differ per provider, but a CLI should not need to know that.
+ *    Providers therefore *describe* their login methods declaratively and the
+ *    UI renders whatever prompts they declare.
+ */
+export interface ApiCredential {
+    type: "api";
+    key: string;
+    /** Extra non-secret fields a provider needs alongside the key. */
+    metadata?: Record<string, string>;
+}
+export interface OAuthCredential {
+    type: "oauth";
+    access: string;
+    refresh: string;
+    /** Epoch milliseconds. */
+    expires: number;
+    /** Provider-specific extras, e.g. an enterprise endpoint or account id. */
+    accountId?: string;
+    baseUrl?: string;
+    metadata?: Record<string, string>;
+}
+/** A long-lived token paired with a key, for providers that issue both. */
+export interface WellKnownCredential {
+    type: "wellknown";
+    key: string;
+    token: string;
+}
+export type Credential = ApiCredential | OAuthCredential | WellKnownCredential;
+/** Show a prompt only when an earlier answer matches. */
+export interface PromptCondition {
+    key: string;
+    op: "eq" | "neq";
+    value: string;
+}
+export interface TextPrompt {
+    type: "text";
+    key: string;
+    message: string;
+    placeholder?: string;
+    /** Mask the input (API keys, secrets). */
+    secret?: boolean;
+    when?: PromptCondition;
+    validate?(value: string): string | undefined;
+}
+export interface SelectPrompt {
+    type: "select";
+    key: string;
+    message: string;
+    options: Array<{
+        label: string;
+        value: string;
+        hint?: string;
+    }>;
+    when?: PromptCondition;
+}
+export type Prompt = TextPrompt | SelectPrompt;
+/** What `authorize()` hands back so the UI can walk the user through login. */
+export type AuthorizeResult = {
+    /**
+     * The page the user has to visit, if there is one. Absent for flows that
+     * deliver the code out of band — an emailed one-time code has nothing to
+     * open, and sending a browser somewhere anyway invites a second, competing
+     * session.
+     */
+    url?: string;
+    instructions: string;
+} & ({
+    /**
+     * The flow completes without the user typing anything back — a device
+     * code poll, or a loopback redirect we listen for.
+     */
+    method: "auto";
+    callback(): Promise<CallbackResult>;
+} | {
+    /** The user copies a code out of the browser and pastes it back. */
+    method: "code";
+    callback(code: string): Promise<CallbackResult>;
+});
+export type CallbackResult = ({
+    type: "success";
+} & Omit<OAuthCredential, "type">) | ({
+    type: "success";
+} & Omit<ApiCredential, "type">) | {
+    type: "failed";
+    error?: string;
+};
+export interface OAuthMethod {
+    type: "oauth";
+    label: string;
+    prompts?: Prompt[];
+    authorize(inputs: Record<string, string>): Promise<AuthorizeResult>;
+}
+export interface ApiKeyMethod {
+    type: "api";
+    label: string;
+    prompts?: Prompt[];
+    /**
+     * Turn the collected prompt answers into a credential. Defaults to treating
+     * the `key` answer as the API key.
+     */
+    authorize?(inputs: Record<string, string>): Promise<CallbackResult>;
+}
+export type AuthMethod = OAuthMethod | ApiKeyMethod;
+/** Context a resolver may use to vary headers per request. */
+export interface AuthContext {
+    providerId: string;
+    /** The request body about to be sent, for providers that inspect it. */
+    body?: unknown;
+    /** The URL about to be called. */
+    url?: string;
+}
+export interface ResolvedAuth {
+    headers: Record<string, string>;
+    /** Override the endpoint, e.g. an enterprise or regional host. */
+    baseUrl?: string;
+    /**
+     * Headers to strip before sending. Bearer-token auth must remove the
+     * `x-api-key` a provider would otherwise set, or the API sees two
+     * conflicting credentials and rejects the request.
+     */
+    removeHeaders?: string[];
+    /** How this credential was obtained, for `/auth` and diagnostics. */
+    source?: string;
+}
+/**
+ * Resolves credentials at request time. Returning `undefined` means "no
+ * credential available" and the provider falls back to its own env lookup.
+ */
+export type AuthResolver = (ctx: AuthContext) => Promise<ResolvedAuth | undefined>;
+/**
+ * Everything a provider needs to declare about authentication. `loader` is the
+ * counterpart to `methods`: methods obtain a credential, loader turns a stored
+ * credential into request headers.
+ */
+export interface AuthProvider {
+    /** Must match the id of the model provider it authenticates. */
+    id: string;
+    label: string;
+    methods: AuthMethod[];
+    /**
+     * Turn a stored credential into request headers. Called on every request,
+     * so it is also the place to refresh an expiring token.
+     */
+    loader?(credential: Credential | undefined, ctx: AuthContext): Promise<ResolvedAuth | undefined>;
+    /**
+     * Refresh an OAuth credential. The manager calls this shortly before expiry
+     * and persists whatever comes back.
+     */
+    refresh?(credential: OAuthCredential): Promise<OAuthCredential | undefined>;
+    /**
+     * Discover credentials the harness did not store itself — an API key in the
+     * environment, or a profile written by a vendor's own CLI.
+     */
+    discover?(): Promise<{
+        credential: Credential;
+        source: string;
+    } | undefined>;
+}
+export declare function isExpired(credential: OAuthCredential, skewMs?: number): boolean;

package/dist/auth/types.js

@@ -0,0 +1,16 @@
+/**
+ * Authentication contract.
+ *
+ * Two things drive the design:
+ *
+ * 1. Subscription credentials expire. Anything that snapshots a header at
+ *    construction time breaks an hour later, so credentials are resolved
+ *    **per request** and the resolver owns refresh.
+ * 2. Login flows differ per provider, but a CLI should not need to know that.
+ *    Providers therefore *describe* their login methods declaratively and the
+ *    UI renders whatever prompts they declare.
+ */
+export function isExpired(credential, skewMs = 60_000) {
+    return credential.expires > 0 && credential.expires - skewMs <= Date.now();
+}
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoLH,MAAM,UAAU,SAAS,CAAC,UAA2B,EAAE,MAAM,GAAG,MAAM;IACpE,OAAO,UAAU,CAAC,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAC7E,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,197 @@
+import type { McpServerConfig } from "./mcp/client.ts";
+import type { OAuthProviderOptions } from "./auth/providers/generic.ts";
+import type { ModelSpec, ProviderCredentials, ThinkingConfig } from "./providers/types.ts";
+import type { HookConfig } from "./agent/hooks.ts";
+import type { PermissionMode, PermissionRules } from "./agent/permissions.ts";
+import type { WorkspaceMode } from "./agent/workspace.ts";
+import type { SubagentDefinition } from "./agent/subagent.ts";
+import type { ScheduleDefinition } from "./schedule/scheduler.ts";
+import type { ToolFilter } from "./tools/registry.ts";
+import type { LogLevel } from "./util/logger.ts";
+import type { PluginConfig } from "./plugins.ts";
+export interface HarnessConfig {
+    /** Default model alias, e.g. "sonnet" or "openai/gpt-4.1". */
+    model?: string;
+    /** Model used for compaction and cheap subagents. */
+    smallModel?: string;
+    permissionMode?: PermissionMode;
+    permissions?: PermissionRules;
+    /**
+     * Where writes may land: `read-only`, `workspace-write` (the default — the
+     * project directory plus `writableRoots`), or `full-access`. This is a
+     * policy gate on tool arguments, not an OS sandbox.
+     */
+    workspaceMode?: WorkspaceMode;
+    /** Extra directories the agent may write to, beyond the project root. */
+    writableRoots?: string[];
+    /** Extra directories the agent may read but not write. */
+    readableRoots?: string[];
+    /**
+     * Record every permission decision with the session that made it. On unless
+     * set to false — the trail is small, local, and the one thing that can answer
+     * afterwards what the agent was allowed to do.
+     */
+    audit?: boolean;
+    /**
+     * Also append every decision to this file. The session's own trail is kept
+     * either way; this is for a run whose record has to end up somewhere a
+     * collector can read, e.g. an unattended scheduled one.
+     */
+    auditLog?: string;
+    maxTurns?: number;
+    thinking?: ThinkingConfig;
+    cache?: boolean;
+    systemPrompt?: string;
+    appendSystemPrompt?: string;
+    /** Path to a project instructions file, relative to the project root. */
+    instructionsFile?: string;
+    tools?: ToolFilter;
+    mcpServers?: Record<string, McpServerConfig>;
+    hooks?: HookConfig;
+    subagents?: SubagentDefinition[];
+    /** Extra directories to scan for skills, relative to the project root. */
+    skillDirs?: string[];
+    /** Extra directories to scan for markdown subagent definitions. */
+    agentDirs?: string[];
+    /** Recurring prompts, run on a cron schedule. */
+    schedules?: ScheduleDefinition[];
+    /** Where durable notes live; defaults to .oharness/memory. */
+    memoryDir?: string;
+    /** Declarative plugin bundles to discover and activate. */
+    plugins?: PluginConfig;
+    /** Extra or overriding model specs, merged over the built-in catalog. */
+    models?: ModelSpec[];
+    /** Per-provider credentials and endpoints; env vars still apply as fallback. */
+    providers?: Record<string, ProviderCredentials>;
+    /**
+     * Subscription providers authenticated by OAuth. `clientId` is required —
+     * see the README on why no client id ships built in.
+     */
+    oauthProviders?: OAuthProviderOptions[];
+    /**
+     * Path to an extra catalog file, merged over the bundled one and the user's.
+     * The catalog is where providers and models live — see src/providers/catalog.json.
+     */
+    catalog?: string;
+    /** OpenAI-compatible vendors to register as their own providers. */
+    openAiCompatible?: Array<{
+        id: string;
+        name?: string;
+        baseUrl: string;
+        apiKeyEnv?: string;
+        includeUsage?: boolean;
+    }>;
+    logLevel?: LogLevel;
+    /**
+     * Where sessions, transcripts and project records are kept. Defaults to
+     * `storage/` in the user directory; naming one here opts out of importing
+     * anything that was recorded under the default.
+     */
+    sessionDir?: string;
+    /**
+     * Reclaim old sessions on startup. Nothing is deleted unless one of these is
+     * set — losing a transcript should be opt-in.
+     */
+    sessionRetention?: {
+        maxAgeDays?: number;
+        keep?: number;
+    };
+    /** Where transcripts are mirrored so a second device can continue them. */
+    sync?: SyncConfig;
+    /**
+     * The account system `auth login official` signs in to.
+     *
+     * User config only — see `projectSafe`. This is the setting a fork or a
+     * self-hosted deployment uses to point the harness at its own Supabase
+     * project without rebuilding anything, and it beats the ids a published
+     * build was packaged with.
+     */
+    account?: AccountConfig;
+}
+export interface AccountConfig {
+    /**
+     * The Supabase project accounts live in, e.g.
+     * `https://<project>.supabase.co`. Set this and `supabaseAnonKey` together;
+     * one without the other is treated as neither.
+     */
+    supabaseUrl?: string;
+    /**
+     * The project's anon key. A publishable client credential — it grants
+     * nothing beyond what an anonymous visitor has, and row level security is
+     * what protects the data — so it is no more sensitive here than in the
+     * browser bundle of the site it belongs to.
+     */
+    supabaseAnonKey?: string;
+    /**
+     * The website that owns those accounts, for the browser sign-in handoff.
+     * Defaults to the official one.
+     */
+    siteUrl?: string;
+}
+export interface SyncConfig {
+    /**
+     * Defaults to on. Sync still does nothing without a destination and a token,
+     * so "on" means "as soon as you are signed in" rather than "immediately" —
+     * see `resolveSync`.
+     */
+    enabled?: boolean;
+    /** Base URL of the sync server. Unset uses the official one. */
+    url?: string;
+    /**
+     * Bearer token. Usually left unset: the official service reads the account
+     * credential, and a self-hosted server's token is better placed in the user
+     * config than in a repository's.
+     */
+    token?: string;
+    /**
+     * Mirror into a team's shared history rather than your own.
+     *
+     * Everyone on the team reads and writes one feed per project, which is what
+     * lets two people continue each other's sessions. The server checks the
+     * account holds the team, so naming one here is a choice about where your
+     * own transcripts go, never a way to reach someone else's.
+     */
+    team?: string;
+    /**
+     * Projects never to mirror, by project id or worktree path. For the one repo
+     * whose transcripts should not leave the machine, without turning sync off
+     * everywhere else.
+     */
+    exclude?: string[];
+}
+export declare const CONFIG_FILENAMES: string[];
+/**
+ * Load and merge configuration.
+ *
+ * User config (`~/.oharness/config.json`) is the base; project config
+ * overrides it, so a repo can tighten policy for everyone working in it
+ * without each person editing their global settings.
+ */
+export declare function loadConfig(cwd?: string): Promise<HarnessConfig>;
+/**
+ * The project's own config file, unmerged.
+ *
+ * Provenance, for the settings a UI offers to change. Once merged there is no
+ * way to tell a value the user chose from one the repository imposed, and the
+ * difference decides whether a switch works or silently reverts on the next
+ * launch — so a control over a setting a project may override has to ask this
+ * first.
+ */
+export declare function loadProjectConfig(cwd?: string): Promise<HarnessConfig | undefined>;
+/**
+ * Change the user's own config file.
+ *
+ * The only writer in this module, and deliberately narrow. Config is a file a
+ * person edits, so a program that rewrites it wholesale would reformat their
+ * comments away and reorder their keys — this reads, applies one change, and
+ * writes back, which loses formatting but not content. Reach for it when a
+ * setting is toggled from a UI and has to still be true tomorrow; leave
+ * everything else to the person and their editor.
+ *
+ * Never the project config: a preference is about this machine and its owner,
+ * and writing it into the repository would commit it to everyone.
+ */
+export declare function updateUserConfig(change: (current: HarnessConfig) => HarnessConfig): Promise<HarnessConfig>;
+export declare function mergeConfig(base: HarnessConfig, override: HarnessConfig): HarnessConfig;
+/** Read the project's instructions file, if one exists. */
+export declare function loadProjectInstructions(cwd: string, configured?: string): Promise<string | undefined>;

package/dist/config.js

@@ -0,0 +1,195 @@
+import { userPath } from "./paths.js";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { ConfigError } from "./core/errors.js";
+import { parseJson } from "./util/json.js";
+export const CONFIG_FILENAMES = ["oharness.config.json", ".oharness.json"];
+const DEFAULT_INSTRUCTIONS = ["AGENTS.md", "CLAUDE.md", ".oharness/instructions.md"];
+/**
+ * Load and merge configuration.
+ *
+ * User config (`~/.oharness/config.json`) is the base; project config
+ * overrides it, so a repo can tighten policy for everyone working in it
+ * without each person editing their global settings.
+ */
+export async function loadConfig(cwd = process.cwd()) {
+    const user = await readConfigFile(userPath("config.json"));
+    const project = await loadProjectConfig(cwd);
+    return mergeConfig(user ?? {}, projectSafe(project ?? {}));
+}
+/**
+ * The project's own config file, unmerged.
+ *
+ * Provenance, for the settings a UI offers to change. Once merged there is no
+ * way to tell a value the user chose from one the repository imposed, and the
+ * difference decides whether a switch works or silently reverts on the next
+ * launch — so a control over a setting a project may override has to ask this
+ * first.
+ */
+export async function loadProjectConfig(cwd = process.cwd()) {
+    for (const filename of CONFIG_FILENAMES) {
+        const found = await readConfigFile(path.join(cwd, filename));
+        if (found)
+            return found;
+    }
+    return undefined;
+}
+/**
+ * A project config with the parts a repository may not decide removed.
+ *
+ * Applied here rather than inside `mergeConfig`, because this is the only
+ * place that knows which side is the person and which is the repository —
+ * elsewhere the same function merges plugin contributions under a user's own
+ * settings, and a rule written as "the base wins" would there mean "discard
+ * what the user set", which is how this was wrong the first time.
+ *
+ * What a project may still do: switch sync off, and add exclusions. Both
+ * restrict. What it may not do is switch sync on, choose the server, supply
+ * the credential, or name the team — each of which would let a repository you
+ * cloned decide where your transcripts go.
+ *
+ * `account` is removed outright, for a sharper version of the same reason. It
+ * names where sign-in sends an email address and a password; a repository that
+ * could set it would be a repository that collects them. There is no part of
+ * it a project has any business deciding, so unlike sync there is nothing to
+ * keep.
+ */
+function projectSafe(project) {
+    const { account: _account, ...rest } = project;
+    if (!rest.sync)
+        return rest;
+    const { url: _url, token: _token, team: _team, ...allowed } = rest.sync;
+    return { ...rest, sync: allowed };
+}
+/**
+ * Change the user's own config file.
+ *
+ * The only writer in this module, and deliberately narrow. Config is a file a
+ * person edits, so a program that rewrites it wholesale would reformat their
+ * comments away and reorder their keys — this reads, applies one change, and
+ * writes back, which loses formatting but not content. Reach for it when a
+ * setting is toggled from a UI and has to still be true tomorrow; leave
+ * everything else to the person and their editor.
+ *
+ * Never the project config: a preference is about this machine and its owner,
+ * and writing it into the repository would commit it to everyone.
+ */
+export async function updateUserConfig(change) {
+    const file = userPath("config.json");
+    const current = (await readConfigFile(file)) ?? {};
+    const next = change(current);
+    await mkdir(path.dirname(file), { recursive: true });
+    const temp = `${file}.${process.pid}.tmp`;
+    // Temp plus rename, so an interrupted write cannot leave a config file that
+    // fails to parse — which would read as "every setting reverted".
+    await writeFile(temp, `${JSON.stringify(next, null, 2)}\n`, "utf8");
+    await rename(temp, file);
+    return next;
+}
+export function mergeConfig(base, override) {
+    return {
+        ...base,
+        ...override,
+        permissions: mergeRules(base.permissions, override.permissions),
+        tools: {
+            allow: override.tools?.allow ?? base.tools?.allow,
+            deny: [...(base.tools?.deny ?? []), ...(override.tools?.deny ?? [])],
+        },
+        mcpServers: { ...base.mcpServers, ...override.mcpServers },
+        hooks: mergeHooks(base.hooks, override.hooks),
+        subagents: [...(base.subagents ?? []), ...(override.subagents ?? [])],
+        skillDirs: [...(base.skillDirs ?? []), ...(override.skillDirs ?? [])],
+        agentDirs: [...(base.agentDirs ?? []), ...(override.agentDirs ?? [])],
+        schedules: [...(base.schedules ?? []), ...(override.schedules ?? [])],
+        writableRoots: [...(base.writableRoots ?? []), ...(override.writableRoots ?? [])],
+        readableRoots: [...(base.readableRoots ?? []), ...(override.readableRoots ?? [])],
+        plugins: mergePlugins(base.plugins, override.plugins),
+        models: [...(base.models ?? []), ...(override.models ?? [])],
+        providers: { ...base.providers, ...override.providers },
+        openAiCompatible: [...(base.openAiCompatible ?? []), ...(override.openAiCompatible ?? [])],
+        oauthProviders: [...(base.oauthProviders ?? []), ...(override.oauthProviders ?? [])],
+        sync: mergeSync(base.sync, override.sync),
+    };
+}
+/**
+ * Sync settings.
+ *
+ * `enabled` is the one field where the later side cannot win outright: off
+ * from either is off. Turning sync *on* is a decision about where a
+ * transcript goes, so nothing merged in later gets to make it on the user's
+ * behalf — not a project, and not a plugin. Exclusions accumulate for the
+ * same reason, exactly like `tools.deny`.
+ *
+ * The destination, credential and team merge normally here. Keeping a
+ * repository from setting them is `projectSafe`'s job, one layer up, where it
+ * is known which side is the repository.
+ */
+function mergeSync(base, override) {
+    if (!base && !override)
+        return undefined;
+    const enabled = base?.enabled === false || override?.enabled === false
+        ? false
+        : (override?.enabled ?? base?.enabled);
+    const url = override?.url ?? base?.url;
+    const token = override?.token ?? base?.token;
+    const team = override?.team ?? base?.team;
+    return {
+        ...(enabled !== undefined ? { enabled } : {}),
+        ...(url ? { url } : {}),
+        ...(token ? { token } : {}),
+        ...(team ? { team } : {}),
+        exclude: [...(base?.exclude ?? []), ...(override?.exclude ?? [])],
+    };
+}
+function mergePlugins(base, override) {
+    return {
+        dirs: [...(base?.dirs ?? []), ...(override?.dirs ?? [])],
+        enabled: override?.enabled ?? base?.enabled,
+        disabled: [...(base?.disabled ?? []), ...(override?.disabled ?? [])],
+    };
+}
+/** Read the project's instructions file, if one exists. */
+export async function loadProjectInstructions(cwd, configured) {
+    const candidates = configured ? [configured] : DEFAULT_INSTRUCTIONS;
+    for (const candidate of candidates) {
+        try {
+            const body = await readFile(path.resolve(cwd, candidate), "utf8");
+            if (body.trim())
+                return body;
+        }
+        catch {
+            continue;
+        }
+    }
+    return undefined;
+}
+async function readConfigFile(file) {
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const parsed = parseJson(raw);
+    if (!parsed.ok) {
+        throw new ConfigError(`${file} is not valid JSON: ${parsed.error}`);
+    }
+    return parsed.value;
+}
+function mergeRules(base, override) {
+    return {
+        allow: [...(base?.allow ?? []), ...(override?.allow ?? [])],
+        // Denials accumulate: a project can add restrictions but not remove them.
+        deny: [...(base?.deny ?? []), ...(override?.deny ?? [])],
+        ask: [...(base?.ask ?? []), ...(override?.ask ?? [])],
+    };
+}
+function mergeHooks(base, override) {
+    const merged = { ...base };
+    for (const [event, hooks] of Object.entries(override ?? {})) {
+        merged[event] = [...(merged[event] ?? []), ...(hooks ?? [])];
+    }
+    return merged;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAU/C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA0J3C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,sBAAsB,EAAE,gBAAgB,CAAC,CAAC;AAC3E,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,2BAA2B,CAAC,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAClD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,WAAW,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACzD,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,WAAW,CAAC,OAAsB;IACzC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;IACxE,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAiD;IAEjD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAE7B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC1C,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAmB,EAAE,QAAuB;IACtE,OAAO;QACL,GAAG,IAAI;QACP,GAAG,QAAQ;QACX,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC;QAC/D,KAAK,EAAE;YACL,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK;YACjD,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;SACrE;QACD,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE;QAC1D,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;QAC7C,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACrE,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACrE,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACrE,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACrE,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACjF,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC;QACrD,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC5D,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE;QACvD,gBAAgB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QAC1F,cAAc,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,SAAS,CAAC,IAAiB,EAAE,QAAqB;IACzD,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,OAAO,GACX,IAAI,EAAE,OAAO,KAAK,KAAK,IAAI,QAAQ,EAAE,OAAO,KAAK,KAAK;QACpD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG,CAAC;IACvC,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;IAC1C,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB,EAAE,QAAuB;IAChE,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO;QAC3C,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,UAAmB;IAEnB,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACpE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAgB,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,uBAAuB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CACjB,IAAiC,EACjC,QAAqC;IAErC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC3D,0EAA0E;QAC1E,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACxD,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAiB,EAAE,QAAqB;IAC1D,MAAM,MAAM,GAAe,EAAE,GAAG,IAAI,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/errors.d.ts

@@ -0,0 +1,46 @@
+export declare class HarnessError extends Error {
+    readonly code: string;
+    readonly retryable: boolean;
+    readonly cause?: unknown;
+    constructor(message: string, opts?: {
+        code?: string;
+        retryable?: boolean;
+        cause?: unknown;
+    });
+}
+export declare class ConfigError extends HarnessError {
+    constructor(message: string, cause?: unknown);
+}
+export declare class ProviderError extends HarnessError {
+    readonly status?: number;
+    readonly provider: string;
+    constructor(provider: string, message: string, opts?: {
+        status?: number;
+        retryable?: boolean;
+        cause?: unknown;
+    });
+}
+export declare class ToolError extends HarnessError {
+    readonly toolName: string;
+    constructor(toolName: string, message: string, cause?: unknown);
+}
+export declare class PermissionDeniedError extends HarnessError {
+    constructor(message: string);
+}
+export declare class McpError extends HarnessError {
+    readonly server: string;
+    constructor(server: string, message: string, cause?: unknown);
+}
+/**
+ * The server answered 401: it has an identity to check and we have not proved
+ * one. Distinct from `McpError` because it is not a failure to be reported —
+ * it is the start of a login, and the caller needs the challenge to begin it.
+ */
+export declare class McpAuthRequiredError extends McpError {
+    /** The `WWW-Authenticate` header, which carries where to go discover auth. */
+    readonly challenge?: string;
+    readonly url: string;
+    constructor(server: string, url: string, challenge?: string);
+}
+export declare function isRetryableStatus(status: number | undefined): boolean;
+export declare function errorMessage(err: unknown): string;