@peakflo/agent-harness 0.2.15 → 0.2.16-rc.1

package/dist/capabilities.d.ts

@@ -34,7 +34,7 @@ import { RunnerCapabilities } from './types';
  *   chat browser (409 + `x-pf-browser-takeover`) and gives Pi a 24 h timeout
  *   for that server. The API leases the `browser` server only with this.
  */
-export declare const HARNESS_FEATURES: readonly ["spaceFiles", "browserTakeover"];
+export declare const HARNESS_FEATURES: readonly ["spaceFiles", "codexRepositoryAccess", "browserTakeover"];
 /** Steering mode was verified with Pi 0.84.3. Older Pi keeps the queue path. */
 export declare function supportsPiSteering(version: string | null): boolean;
 export interface ProbeResult {

package/dist/capabilities.js

@@ -34,6 +34,7 @@ const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const browser_takeover_1 = require("./runtime/browser-takeover");
+const vendor_backends_1 = require("./vendor-backends");
 const version_1 = require("./version");
 const PROBE_TIMEOUT_MS = 10_000;
 /**
@@ -48,6 +49,7 @@ const PROBE_TIMEOUT_MS = 10_000;
  */
 exports.HARNESS_FEATURES = [
     'spaceFiles',
+    vendor_backends_1.CODEX_REPOSITORY_FEATURE,
     browser_takeover_1.BROWSER_HARNESS_FEATURE
 ];
 /** Steering mode was verified with Pi 0.84.3. Older Pi keeps the queue path. */

package/dist/runtime/session-runner.js

@@ -2776,6 +2776,7 @@ class SessionRunner {
     sessionDirectUrls(session, knowledgeUrl) {
         return [
             session.agent.model.gatewayUrl ?? '',
+            ...(0, vendor_backends_1.vendorModelDirectUrls)(session.agent.backend),
             ...session.agent.mcpServers.map((server) => server.url),
             ...(knowledgeUrl ? [knowledgeUrl] : [])
         ];

package/dist/vendor-backends.d.ts

@@ -41,6 +41,9 @@ export declare function vendorModelId(model: {
     provider?: string | null;
     model?: string | null;
 }, backend: string): string | undefined;
+export declare const CODEX_REPOSITORY_FEATURE = "codexRepositoryAccess";
+/** Model/auth traffic must not enter the GitHub-only TLS proxy after checkout. */
+export declare function vendorModelDirectUrls(backend: string): string[];
 export declare const CLAUDE_SDK_PACKAGE = "@anthropic-ai/claude-agent-sdk";
 /**
  * Why a harness that is installed and signed in still cannot be run by this

package/dist/vendor-backends.js

@@ -22,9 +22,10 @@
  * stays Pi-only.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NOT_RUNNABLE_REASONS = exports.CLAUDE_SDK_PACKAGE = exports.VENDOR_BACKENDS = void 0;
+exports.NOT_RUNNABLE_REASONS = exports.CLAUDE_SDK_PACKAGE = exports.CODEX_REPOSITORY_FEATURE = exports.VENDOR_BACKENDS = void 0;
 exports.isVendorBackend = isVendorBackend;
 exports.vendorModelId = vendorModelId;
+exports.vendorModelDirectUrls = vendorModelDirectUrls;
 exports.resolveClaudeSdk = resolveClaudeSdk;
 exports.vendorBackendBlocker = vendorBackendBlocker;
 const node_module_1 = require("node:module");
@@ -51,6 +52,20 @@ function vendorModelId(model, backend) {
     const provider = (model.provider ?? '').trim();
     return name && provider === backend ? name : undefined;
 }
+exports.CODEX_REPOSITORY_FEATURE = 'codexRepositoryAccess';
+/** Model/auth traffic must not enter the GitHub-only TLS proxy after checkout. */
+function vendorModelDirectUrls(backend) {
+    // Codex subscription calls were observed at chatgpt.com during the local
+    // add-repository smoke. Include its token refresh and API-key paths too.
+    // Exact hosts only: GitHub always keeps its sentinel and branch policy.
+    return backend === 'codex'
+        ? [
+            'https://chatgpt.com',
+            'https://auth.openai.com',
+            'https://api.openai.com'
+        ]
+        : [];
+}
 /* -------------------------------------------------------------------------- */
 /* The Claude Agent SDK                                                        */
 /* -------------------------------------------------------------------------- */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peakflo/agent-harness",
-  "version": "0.2.15",
+  "version": "0.2.16-rc.1",
   "description": "Headless Peakflo coding-agent harness. One codebase, three hosting modes: a Daytona cloud sandbox, a customer VM, and the 20x desktop.",
   "license": "MIT",
   "type": "commonjs",