@oneharness/sdk 0.16.2 → 0.17.0

package/dist/generated/capabilities.d.ts

@@ -632,7 +632,7 @@ export declare const CAPABILITIES: {
         readonly output: "sync_report";
         readonly stdout: "json";
         readonly stdin: false;
-        readonly rust: "oneharness_core::io::sync::sync";
+        readonly rust: "oneharness_core::io::sync::sync_with";
         readonly always: readonly ["--compact", "--format", "json"];
         readonly bindings: readonly [{
             readonly option: "cwd";
@@ -649,6 +649,11 @@ export declare const CAPABILITIES: {
             readonly flag: "--check";
             readonly kind: "switch";
             readonly unless: null;
+        }, {
+            readonly option: "exact";
+            readonly flag: "--exact";
+            readonly kind: "switch";
+            readonly unless: null;
         }, {
             readonly option: "global";
             readonly flag: "--global";

package/dist/generated/capabilities.js

@@ -705,7 +705,7 @@ export const CAPABILITIES = {
         output: "sync_report",
         stdout: "json",
         stdin: false,
-        rust: "oneharness_core::io::sync::sync",
+        rust: "oneharness_core::io::sync::sync_with",
         always: ["--compact", "--format", "json"],
         bindings: [
             {
@@ -726,6 +726,12 @@ export const CAPABILITIES = {
                 kind: "switch",
                 unless: null,
             },
+            {
+                option: "exact",
+                flag: "--exact",
+                kind: "switch",
+                unless: null,
+            },
             {
                 option: "global",
                 flag: "--global",

package/dist/generated/schemas.json

@@ -732,7 +732,7 @@
             "output": "sync_report",
             "stdout": "json",
             "stdin": false,
-            "rust": "oneharness_core::io::sync::sync",
+            "rust": "oneharness_core::io::sync::sync_with",
             "always": [
                 "--compact",
                 "--format",
@@ -757,6 +757,12 @@
                     "kind": "switch",
                     "unless": null
                 },
+                {
+                    "option": "exact",
+                    "flag": "--exact",
+                    "kind": "switch",
+                    "unless": null
+                },
                 {
                     "option": "global",
                     "flag": "--global",
@@ -16592,6 +16598,10 @@
             "cwd": {
                 "type": "string"
             },
+            "exact": {
+                "description": "Hold each harness's allow/deny list to exactly the configured one:\nstale and hand-added entries are removed, every other key is merged as\nusual, and the report names each added and removed entry.",
+                "type": "boolean"
+            },
             "global": {
                 "type": "boolean"
             },
@@ -16624,6 +16634,10 @@
                     "type": "string"
                 }
             },
+            "exact": {
+                "description": "True under `--exact`: each permission list was held to exactly the\nsource's, and each result names the entries that added and removed.\nOmitted when false.",
+                "type": "boolean"
+            },
             "results": {
                 "type": "array",
                 "items": {
@@ -16677,10 +16691,56 @@
                     "status"
                 ]
             },
+            "RuleChange": {
+                "description": "One entry an `--exact` sync added to, or removed from, a harness's rules.",
+                "type": "object",
+                "properties": {
+                    "list": {
+                        "description": "The list the entry belongs to; absent for a statement in a Codex rules\nfile that no unified list renders (a hand-written `decision=\"prompt\"`).",
+                        "anyOf": [
+                            {
+                                "$ref": "#/$defs/RuleList"
+                            },
+                            {
+                                "type": "null"
+                            }
+                        ]
+                    },
+                    "rule": {
+                        "description": "The entry as it appears in the harness's file: the rule string for a\nJSON list, the whole `prefix_rule(...)` statement for a Codex rules file.",
+                        "type": "string"
+                    }
+                },
+                "required": [
+                    "rule"
+                ]
+            },
+            "RuleList": {
+                "description": "Which unified rule list an entry belongs to.",
+                "oneOf": [
+                    {
+                        "description": "`allowed_tools`.",
+                        "type": "string",
+                        "const": "allowed_tools"
+                    },
+                    {
+                        "description": "`denied_tools`.",
+                        "type": "string",
+                        "const": "denied_tools"
+                    }
+                ]
+            },
             "SyncResult": {
                 "description": "What one harness's sync did (or would do).",
                 "type": "object",
                 "properties": {
+                    "added_rules": {
+                        "description": "Under `--exact`: each entry the sync added (or would add) to this\nharness's permission lists. Omitted when empty.",
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/$defs/RuleChange"
+                        }
+                    },
                     "file": {
                         "description": "The permission/settings config file written (or that would be written);\n`null` when nothing of that kind is configured for this harness.",
                         "type": [
@@ -16698,6 +16758,13 @@
                             "$ref": "#/$defs/HookFileResult"
                         }
                     },
+                    "removed_rules": {
+                        "description": "Under `--exact`: each entry the sync removed (or would remove) from\nthis harness's permission lists — stale and hand-added alike. Omitted\nwhen empty.",
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/$defs/RuleChange"
+                        }
+                    },
                     "status": {
                         "$ref": "#/$defs/SyncStatus"
                     },
@@ -16707,6 +16774,13 @@
                         "items": {
                             "type": "string"
                         }
+                    },
+                    "unmapped_rules": {
+                        "description": "Individual configured rules this harness cannot express (a Codex\nexecpolicy pattern has no wildcards and no exact-length form), each left\nout of the file with the reason — never widened, and never silently\ndropped. Omitted when empty.",
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/$defs/UnmappedRule"
+                        }
                     }
                 },
                 "required": [
@@ -16741,6 +16815,28 @@
                         "const": "skipped"
                     }
                 ]
+            },
+            "UnmappedRule": {
+                "description": "A configured rule the harness cannot express, left out of what was written.",
+                "type": "object",
+                "properties": {
+                    "list": {
+                        "$ref": "#/$defs/RuleList"
+                    },
+                    "reason": {
+                        "description": "Why the harness cannot express it.",
+                        "type": "string"
+                    },
+                    "rule": {
+                        "description": "The rule exactly as configured.",
+                        "type": "string"
+                    }
+                },
+                "required": [
+                    "list",
+                    "rule",
+                    "reason"
+                ]
             }
         }
     },

package/dist/generated/sync-options.d.ts

@@ -8,6 +8,12 @@ export interface SyncOptions {
     check?: boolean | undefined;
     config?: string | undefined;
     cwd?: string | undefined;
+    /**
+     * Hold each harness's allow/deny list to exactly the configured one:
+     * stale and hand-added entries are removed, every other key is merged as
+     * usual, and the report names each added and removed entry.
+     */
+    exact?: boolean | undefined;
     global?: boolean | undefined;
     harnesses?: string[] | undefined;
     noConfig?: boolean | undefined;

package/dist/generated/sync-report.d.ts

@@ -1,3 +1,7 @@
+/**
+ * Which unified rule list an entry belongs to.
+ */
+export type RuleList = "allowed_tools" | "denied_tools";
 /**
  * What applying a fragment did (or, under `check`, would do) to one file.
  *
@@ -26,6 +30,12 @@ export interface SyncReport {
      * The oneharness config files the synced settings came from.
      */
     config_files: string[];
+    /**
+     * True under `--exact`: each permission list was held to exactly the
+     * source's, and each result names the entries that added and removed.
+     * Omitted when false.
+     */
+    exact?: boolean | undefined;
     results: SyncResult[];
     schema_version: string;
     [k: string]: unknown;
@@ -34,6 +44,11 @@ export interface SyncReport {
  * What one harness's sync did (or would do).
  */
 export interface SyncResult {
+    /**
+     * Under `--exact`: each entry the sync added (or would add) to this
+     * harness's permission lists. Omitted when empty.
+     */
+    added_rules?: RuleChange[] | undefined;
     /**
      * The permission/settings config file written (or that would be written);
      * `null` when nothing of that kind is configured for this harness.
@@ -45,6 +60,12 @@ export interface SyncResult {
      * writes two). Empty when no `[[hooks]]` entry targets it.
      */
     hooks: HookFileResult[];
+    /**
+     * Under `--exact`: each entry the sync removed (or would remove) from
+     * this harness's permission lists — stale and hand-added alike. Omitted
+     * when empty.
+     */
+    removed_rules?: RuleChange[] | undefined;
     status: SyncStatus;
     /**
      * Top-level settings that have no mapping for this harness (e.g. a
@@ -52,6 +73,29 @@ export interface SyncResult {
      * — visible here and warned on stderr, never silently dropped.
      */
     unmapped: string[];
+    /**
+     * Individual configured rules this harness cannot express (a Codex
+     * execpolicy pattern has no wildcards and no exact-length form), each left
+     * out of the file with the reason — never widened, and never silently
+     * dropped. Omitted when empty.
+     */
+    unmapped_rules?: UnmappedRule[] | undefined;
+    [k: string]: unknown;
+}
+/**
+ * One entry an `--exact` sync added to, or removed from, a harness's rules.
+ */
+export interface RuleChange {
+    /**
+     * The list the entry belongs to; absent for a statement in a Codex rules
+     * file that no unified list renders (a hand-written `decision="prompt"`).
+     */
+    list?: RuleList | null | undefined;
+    /**
+     * The entry as it appears in the harness's file: the rule string for a
+     * JSON list, the whole `prefix_rule(...)` statement for a Codex rules file.
+     */
+    rule: string;
     [k: string]: unknown;
 }
 /**
@@ -62,3 +106,18 @@ export interface HookFileResult {
     status: FileStatus;
     [k: string]: unknown;
 }
+/**
+ * A configured rule the harness cannot express, left out of what was written.
+ */
+export interface UnmappedRule {
+    list: RuleList;
+    /**
+     * Why the harness cannot express it.
+     */
+    reason: string;
+    /**
+     * The rule exactly as configured.
+     */
+    rule: string;
+    [k: string]: unknown;
+}

package/dist/generated/zod.d.ts

@@ -27,7 +27,7 @@ import type { HistoryLabels, OutputFormat, PermissionMode, RunMode, RunOptions }
 import type { HarnessInfo, ListReport, ModeInfo, VariantInfo } from "./registry.js";
 import type { RunStreamEnvelope } from "./run-stream-envelope.js";
 import type { SyncOptions } from "./sync-options.js";
-import type { FileStatus, HookFileResult, SyncReport, SyncResult, SyncStatus } from "./sync-report.js";
+import type { FileStatus, HookFileResult, RuleChange, RuleList, SyncReport, SyncResult, SyncStatus, UnmappedRule } from "./sync-report.js";
 import type { UsageOptions } from "./usage-options.js";
 import type { AuthMode, QuotaAmount, QuotaCounters, QuotaUnit, UnavailableReason, UnknownReason, UsageAvailability, UsageIdentity, UsageReport, UsageWindow, WindowUsage, Windows } from "./usage-report.js";
 export type AbsolutePath = ControlReport["socket"];
@@ -109,6 +109,8 @@ export declare const PermissionModeSchema: z.ZodType<PermissionMode>;
 export declare const QuotaAmountSchema: z.ZodType<QuotaAmount>;
 export declare const QuotaCountersSchema: z.ZodType<QuotaCounters>;
 export declare const QuotaUnitSchema: z.ZodType<QuotaUnit>;
+export declare const RuleChangeSchema: z.ZodType<RuleChange>;
+export declare const RuleListSchema: z.ZodType<RuleList>;
 export declare const RunModeSchema: z.ZodType<RunMode>;
 export declare const RunOptionsSchema: z.ZodType<RunOptions>;
 export declare const RunReportSchema: z.ZodType<RunReport>;
@@ -126,6 +128,7 @@ export declare const TimingSourceSchema: z.ZodType<TimingSource>;
 export declare const ToolCallStatusSchema: z.ZodType<ToolCallStatus>;
 export declare const UnavailableReasonSchema: z.ZodType<UnavailableReason>;
 export declare const UnknownReasonSchema: z.ZodType<UnknownReason>;
+export declare const UnmappedRuleSchema: z.ZodType<UnmappedRule>;
 export declare const UsageSchema: z.ZodType<Usage>;
 export declare const UsageAvailabilitySchema: z.ZodType<UsageAvailability>;
 export declare const UsageIdentitySchema: z.ZodType<UsageIdentity>;

package/dist/generated/zod.js

@@ -2337,6 +2337,11 @@ export const QuotaCountersSchema = z.looseObject({
     used: z.lazy(() => QuotaAmountSchema).refine((value) => value !== undefined, { message: "Required" }),
 });
 export const QuotaUnitSchema = z.union([z.literal("ai_credits"), z.literal("unspecified")]);
+export const RuleChangeSchema = z.looseObject({
+    list: z.union([z.lazy(() => RuleListSchema), z.null()]).optional(),
+    rule: z.string().refine((value) => value !== undefined, { message: "Required" }),
+});
+export const RuleListSchema = z.union([z.literal("allowed_tools"), z.literal("denied_tools")]);
 export const RunModeSchema = z.union([z.literal("parallel"), z.literal("fallback")]);
 export const RunOptionsSchema = z.strictObject({
     all: z.boolean().optional(),
@@ -2492,6 +2497,7 @@ export const SyncOptionsSchema = z.strictObject({
     check: z.boolean().optional(),
     config: z.string().optional(),
     cwd: z.string().optional(),
+    exact: z.boolean().optional(),
     global: z.boolean().optional(),
     harnesses: z.array(z.string()).optional(),
     noConfig: z.boolean().optional(),
@@ -2499,15 +2505,19 @@ export const SyncOptionsSchema = z.strictObject({
 export const SyncReportSchema = z.looseObject({
     check: z.boolean().refine((value) => value !== undefined, { message: "Required" }),
     config_files: z.array(z.string()).refine((value) => value !== undefined, { message: "Required" }),
+    exact: z.boolean().optional(),
     results: z.array(z.lazy(() => SyncResultSchema)).refine((value) => value !== undefined, { message: "Required" }),
     schema_version: z.string().refine((value) => value !== undefined, { message: "Required" }),
 });
 export const SyncResultSchema = z.looseObject({
+    added_rules: z.array(z.lazy(() => RuleChangeSchema)).optional(),
     file: z.union([z.string(), z.null()]).refine((value) => value !== undefined, { message: "Required" }),
     harness: z.string().refine((value) => value !== undefined, { message: "Required" }),
     hooks: z.array(z.lazy(() => HookFileResultSchema)).refine((value) => value !== undefined, { message: "Required" }),
+    removed_rules: z.array(z.lazy(() => RuleChangeSchema)).optional(),
     status: z.lazy(() => SyncStatusSchema).refine((value) => value !== undefined, { message: "Required" }),
     unmapped: z.array(z.string()).refine((value) => value !== undefined, { message: "Required" }),
+    unmapped_rules: z.array(z.lazy(() => UnmappedRuleSchema)).optional(),
 });
 export const SyncStatusSchema = z.union([
     z.literal("created"),
@@ -2545,6 +2555,11 @@ export const UnknownReasonSchema = z.union([
         kind: z.literal("binary_missing").refine((value) => value !== undefined, { message: "Required" }),
     }),
 ]);
+export const UnmappedRuleSchema = z.looseObject({
+    list: z.lazy(() => RuleListSchema).refine((value) => value !== undefined, { message: "Required" }),
+    reason: z.string().refine((value) => value !== undefined, { message: "Required" }),
+    rule: z.string().refine((value) => value !== undefined, { message: "Required" }),
+});
 export const UsageSchema = z.looseObject({
     cache_read_tokens: z
         .union([z.int().gte(0), z.null()])

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneharness/sdk",
-  "version": "0.16.2",
+  "version": "0.17.0",
   "description": "Typed Node.js SDK for oneharness",
   "type": "module",
   "main": "dist/index.js",
@@ -19,7 +19,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "oneharness-cli": "0.16.2",
+    "oneharness-cli": "0.17.0",
     "zod": "^4.4.3"
   }
 }