@peakflo/agent-harness 0.2.18 → 0.2.19-rc.1

package/dist/adapters/claude-code-adapter.d.ts

@@ -23,11 +23,13 @@ export declare enum ClaudeSystemSubtype {
      *  status source and as a transcript-suppression case. */
     BACKGROUND_TASKS_CHANGED = "background_tasks_changed",
     STATUS = "status",
-    THINKING_TOKENS = "thinking_tokens"
+    THINKING_TOKENS = "thinking_tokens",
+    API_RETRY = "api_retry"
 }
 export declare class ClaudeCodeAdapter implements CodingAgentAdapter {
     private readonly executableOverride?;
     private sessions;
+    private apiRetryBursts;
     private sdkLoading;
     private claudeExecutablePath;
     private verifiedClaudeExecutablePath;

package/dist/adapters/claude-code-adapter.js

@@ -54,6 +54,7 @@ exports.verifyClaudeIsolatedConfigVersion = verifyClaudeIsolatedConfigVersion;
  * `./optional-agent-sdks.d.ts` so `tsc` succeeds when it is not installed.
  * Source formatting (no semicolons) preserved.
  */
+const node_crypto_1 = require("node:crypto");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const coding_agent_adapter_1 = require("./coding-agent-adapter");
@@ -103,7 +104,12 @@ var ClaudeSystemSubtype;
     ClaudeSystemSubtype["BACKGROUND_TASKS_CHANGED"] = "background_tasks_changed";
     ClaudeSystemSubtype["STATUS"] = "status";
     ClaudeSystemSubtype["THINKING_TOKENS"] = "thinking_tokens";
+    ClaudeSystemSubtype["API_RETRY"] = "api_retry";
 })(ClaudeSystemSubtype || (exports.ClaudeSystemSubtype = ClaudeSystemSubtype = {}));
+function retryBurstLabel(burst, ended = false) {
+    const state = ended ? 'retry attempts ended' : 'retrying';
+    return `Claude API ${burst.cause} — ${state} (${burst.attempt}${ended ? '' : burst.delay})`;
+}
 /**
  * Terminal states for a Claude Code background task. Once a task reports one of
  * these (via `task_updated.patch.status` or `task_notification.status`) it is no
@@ -121,6 +127,9 @@ const MAX_BACKGROUND_TASK_AGE_MS = 60 * 60 * 1000; // 60 minutes
 class ClaudeCodeAdapter {
     executableOverride;
     sessions = new Map();
+    // Each polling/replay context owns its retry burst. Weak keys let closed
+    // readers be collected without keeping state in the content-length map.
+    apiRetryBursts = new WeakMap();
     sdkLoading = null;
     claudeExecutablePath = null;
     verifiedClaudeExecutablePath = null;
@@ -1484,6 +1493,24 @@ class ClaudeCodeAdapter {
         if (msgWithProps.parent_tool_use_id) {
             return parts;
         }
+        // A retry burst is one durable status row. Keep the first event's UUID so
+        // later turns cannot overwrite an earlier turn's retry history.
+        if (msgWithProps.type === 'assistant' || msgWithProps.type === 'assistant_message' ||
+            msgWithProps.type === 'result' || msgWithProps.type === 'user') {
+            const burst = this.apiRetryBursts.get(partContentLengths);
+            if (burst) {
+                const content = retryBurstLabel(burst, true);
+                partContentLengths.set(burst.id, String(content.length));
+                parts.push({
+                    id: burst.id,
+                    type: coding_agent_adapter_1.MessagePartType.RETRY,
+                    role: 'system',
+                    content,
+                    update: true,
+                });
+            }
+            this.apiRetryBursts.delete(partContentLengths);
+        }
         // Handle assistant_message type
         if (msgWithProps.type === 'assistant' || msgWithProps.type === 'assistant_message') {
             // Content is nested inside message.content for Claude Code SDK format
@@ -1838,6 +1865,38 @@ class ClaudeCodeAdapter {
             }
         }
         else if (msgWithProps.type === 'system') {
+            if (msgWithProps.subtype === ClaudeSystemSubtype.API_RETRY) {
+                const previous = this.apiRetryBursts.get(partContentLengths);
+                const partId = previous?.id || `claude-api-retry-${msgWithProps.uuid || (0, node_crypto_1.randomUUID)()}`;
+                const positive = (value) => typeof value === 'number' && Number.isFinite(value) && value > 0;
+                const attempt = positive(msgWithProps.attempt) && positive(msgWithProps.max_retries)
+                    ? `attempt ${Math.floor(msgWithProps.attempt)}/${Math.floor(msgWithProps.max_retries)}`
+                    : 'next attempt';
+                const delay = typeof msgWithProps.retry_delay_ms === 'number' &&
+                    Number.isFinite(msgWithProps.retry_delay_ms) && msgWithProps.retry_delay_ms >= 0
+                    ? `, in ${Math.ceil(msgWithProps.retry_delay_ms / 1000)} s`
+                    : '';
+                const status = msgWithProps.error_status;
+                const cause = status === 429 ? 'rate limit reached'
+                    : status === 529 ? 'busy'
+                        : status === null ? 'connection failed'
+                            : typeof status === 'number' && status >= 500 ? `server error ${status}`
+                                : 'request failed';
+                const burst = { id: partId, cause, attempt, delay };
+                const content = retryBurstLabel(burst);
+                // Never forward the raw error, which can contain request credentials.
+                this.apiRetryBursts.set(partContentLengths, burst);
+                partContentLengths.set(partId, String(content.length));
+                seenPartIds.add(partId);
+                parts.push({
+                    id: partId,
+                    type: coding_agent_adapter_1.MessagePartType.RETRY,
+                    role: 'system',
+                    content,
+                    update: previous !== undefined,
+                });
+                return parts;
+            }
             // Skip system init messages - they're internal session setup
             if (msgWithProps.subtype === ClaudeSystemSubtype.INIT) {
                 return parts;

package/dist/adapters/coding-agent-adapter.d.ts

@@ -23,6 +23,7 @@ export declare enum MessageRole {
 }
 export declare enum MessagePartType {
     TEXT = "text",
+    RETRY = "retry",
     REASONING = "reasoning",
     TOOL = "tool",
     QUESTION = "question",

package/dist/adapters/coding-agent-adapter.js

@@ -22,6 +22,7 @@ var MessageRole;
 var MessagePartType;
 (function (MessagePartType) {
     MessagePartType["TEXT"] = "text";
+    MessagePartType["RETRY"] = "retry";
     MessagePartType["REASONING"] = "reasoning";
     MessagePartType["TOOL"] = "tool";
     MessagePartType["QUESTION"] = "question";

package/dist/github-command-guards.d.ts

@@ -1,20 +1,15 @@
-export declare const MERGE_REFUSAL = "GitHub merge refused: agents may open pull requests but must not merge them.";
 interface GuardPathLease {
     bin: string;
     release(): void;
 }
 /**
- * Install friendly command-line refusals before backend processes start.
- * These launchers are UX only. The TLS proxy is the security boundary and
- * applies the same policy even when an agent calls the real binary directly.
+ * Install credential-isolating launchers before backend processes start.
+ * Commands and arguments pass through. GitHub enforces operation policy.
  */
 export declare function installGhGuard(root: string): Promise<string>;
 /**
- * Lease one session-neutral guard directory for the whole process. Generated
- * launchers read policy from the target worktree, so sharing the launcher is
- * safe; stacking per-Harness directories in global PATH is not.
+ * Lease one session-neutral guard directory for the whole process. The
+ * launchers contain no session policy, so sharing the launcher is safe; stacking per-Harness directories in global PATH is not.
  */
 export declare function acquireGhGuardPath(root: string): Promise<GuardPathLease>;
-/** Git supplies resolved destination refs, covering force, wildcard and implicit pushes. */
-export declare function installPushGuard(directory: string, sessionId: string, defaultBranch: string, remoteUrl: string): Promise<void>;
 export {};

package/dist/github-command-guards.js

@@ -1,20 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MERGE_REFUSAL = void 0;
 exports.installGhGuard = installGhGuard;
 exports.acquireGhGuardPath = acquireGhGuardPath;
-exports.installPushGuard = installPushGuard;
 const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = require("node:path");
 const vendor_environment_1 = require("./adapters/vendor-environment");
-exports.MERGE_REFUSAL = 'GitHub merge refused: agents may open pull requests but must not merge them.';
 let guardPathState;
 let guardPathQueue = Promise.resolve();
 /**
- * Install friendly command-line refusals before backend processes start.
- * These launchers are UX only. The TLS proxy is the security boundary and
- * applies the same policy even when an agent calls the real binary directly.
+ * Install credential-isolating launchers before backend processes start.
+ * Commands and arguments pass through. GitHub enforces operation policy.
  */
 async function installGhGuard(root) {
     const bin = (0, node_path_1.join)(root, '.github-bin');
@@ -49,8 +45,6 @@ async function installGhGuard(root) {
     }
     await (0, promises_1.writeFile)((0, node_path_1.join)(bin, 'git'), `#!${process.execPath}
 const { spawnSync } = require('node:child_process');
-const { readFileSync } = require('node:fs');
-const { resolve, join } = require('node:path');
 const executable = ${JSON.stringify(gitExecutable)};
 if (!executable) { console.error('git is not installed'); process.exit(127); }
 const args = process.argv.slice(2);
@@ -70,85 +64,11 @@ gitEnv.GIT_SSL_CAINFO = ${JSON.stringify((0, node_path_1.join)(root, '.github-pr
 for (const key of ['GIT_AUTHOR_NAME', 'GIT_AUTHOR_EMAIL', 'GIT_AUTHOR_DATE', 'GIT_COMMITTER_NAME', 'GIT_COMMITTER_EMAIL', 'GIT_COMMITTER_DATE']) {
   if (process.env[key]) gitEnv[key] = process.env[key];
 }
-let command = 0;
-let cwd = process.cwd();
-let refusedGlobalOption = null;
-const valueOptions = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--super-prefix', '--config-env', '--list-cmds', '--attr-source']);
-const flagOptions = new Set(['-p', '-P', '--bare', '--no-pager', '--paginate', '--exec-path', '--html-path', '--man-path', '--info-path', '--version', '--help', '--literal-pathspecs', '--glob-pathspecs', '--noglob-pathspecs', '--icase-pathspecs', '--no-optional-locks', '--no-replace-objects', '--no-lazy-fetch', '--no-advice']);
-const redirectingOptions = new Set(['--git-dir', '--work-tree', '--namespace', '--super-prefix', '--config-env', '--bare', '--exec-path']);
-while (command < args.length) {
-  const arg = args[command];
-  if (valueOptions.has(arg) && args[command + 1]) {
-    if (arg === '-C') cwd = resolve(cwd, args[command + 1]);
-    if (redirectingOptions.has(arg)) refusedGlobalOption = arg;
-    if (arg === '-c') refusedGlobalOption = arg + ' ' + args[command + 1].split('=', 1)[0];
-    command += 2;
-    continue;
-  }
-  if (/^-c.+/.test(arg)) {
-    refusedGlobalOption = '-c ' + arg.slice(2).split('=', 1)[0];
-    command += 1;
-    continue;
-  }
-  if (/^-C.+/.test(arg)) {
-    cwd = resolve(cwd, arg.slice(2));
-    command += 1;
-    continue;
-  }
-  const assignedOption = arg.match(/^(--(?:git-dir|work-tree|namespace|super-prefix|config-env|exec-path|list-cmds|attr-source))=/)?.[1];
-  if (flagOptions.has(arg) || assignedOption) {
-    if (redirectingOptions.has(arg) || (assignedOption && redirectingOptions.has(assignedOption))) refusedGlobalOption = assignedOption ?? arg;
-    command += 1;
-    continue;
-  }
-  break;
-}
-if (refusedGlobalOption && args[command] !== 'push') {
-  console.error('Git command refused: global option ' + refusedGlobalOption + ' can redirect repository policy or command execution.');
-  process.exit(1);
-}
-if (args[command] === 'config') {
-  const configArgs = args.slice(command + 1);
-  const readActions = new Set(['--get', '--get-all', '--get-regexp', '--get-urlmatch', '--list', '-l', '--get-color', '--get-colorbool']);
-  const writeActions = new Set(['--add', '--replace-all', '--unset', '--unset-all', '--rename-section', '--remove-section', '-e', '--edit']);
-  const positional = configArgs.filter(arg => !arg.startsWith('-'));
-  const mutates = configArgs.some(arg => writeActions.has(arg)) || (!configArgs.some(arg => readActions.has(arg)) && positional.length > 1);
-  if (mutates) {
-    console.error('Git config refused: agents may read Git configuration but may not change it.');
-    process.exit(1);
-  }
-}
-if (args[command] === 'push') {
-  const refuse = () => { console.error('Git push refused: use an explicit agent/<session-id> destination; default and other branches are forbidden.'); process.exit(1); };
-  if (refusedGlobalOption) {
-    console.error('Git push refused: global option ' + refusedGlobalOption + ' can redirect the repository, hooks, refs, or push URL.');
-    process.exit(1);
-  }
-  let policy;
-  const hooks = spawnSync(executable, ['-C', cwd, 'config', '--get', 'core.hooksPath'], { encoding: 'utf8', env: gitEnv });
-  try { policy = JSON.parse(readFileSync(join(hooks.stdout.trim(), 'push-policy.json'), 'utf8')); } catch { refuse(); }
-  const positional = [];
-  for (const arg of args.slice(command + 1)) {
-    if (['-u', '--set-upstream', '-f', '--force', '--force-with-lease', '--dry-run', '-n', '--porcelain', '-v', '--verbose'].includes(arg)) continue;
-    if (arg.startsWith('-')) refuse();
-    positional.push(arg);
-  }
-  if (positional.length < 2) refuse();
-  if (positional[0] !== 'origin') refuse();
-  const remote = spawnSync(executable, ['-C', cwd, 'remote', 'get-url', '--push', positional[0]], { encoding: 'utf8', env: gitEnv });
-  if (remote.status !== 0 || remote.stdout.trim() !== policy.remoteUrl) refuse();
-  for (const ref of positional.slice(1)) {
-    const destination = ref.replace(/^\\+/, '').split(':').pop().replace(/^refs\\/heads\\//, '');
-    if (destination === policy.defaultBranch || destination !== policy.branch) refuse();
-  }
-}
 const result = spawnSync(executable, args, { stdio: 'inherit', env: gitEnv });
 process.exit(result.status ?? 1);
 `, { mode: 0o700 });
     await (0, promises_1.writeFile)((0, node_path_1.join)(bin, 'gh'), `#!${process.execPath}
 const { spawnSync } = require('node:child_process');
-const { readFileSync } = require('node:fs');
-const { resolve } = require('node:path');
 const args = process.argv.slice(2);
 const cleanEnv = { ...process.env };
 for (const key of Object.keys(cleanEnv)) {
@@ -157,119 +77,16 @@ for (const key of Object.keys(cleanEnv)) {
 }
 cleanEnv.GIT_TERMINAL_PROMPT = '0';
 cleanEnv.GIT_SSH_COMMAND = ${JSON.stringify(vendor_environment_1.DISABLED_GIT_SSH_COMMAND)};
-// Inspect all args, including endpoint=... and flags before the subcommand.
-const decodedArgs = args.map(arg => {
-  try { return decodeURIComponent(arg); } catch { return arg; }
-});
-const ghGlobalValueOptions = new Set(['-R', '--repo', '--hostname']);
-const ghGlobalFlagOptions = new Set(['--help', '--version', '--prompt', '--no-pager']);
-let command = 0;
-while (command < decodedArgs.length) {
-  const arg = decodedArgs[command];
-  if (ghGlobalValueOptions.has(arg) && decodedArgs[command + 1]) {
-    command += 2;
-    continue;
-  }
-  if (/^-R.+/.test(arg) || /^--(?:repo|hostname)=/.test(arg) || ghGlobalFlagOptions.has(arg)) {
-    command += 1;
-    continue;
-  }
-  break;
-}
-const commandName = decodedArgs[command];
-const api = commandName === 'api' ? command : -1;
-const apiValueOptions = new Set(['-X', '--method', '-H', '--header', '-F', '--field', '-f', '--raw-field', '--input', '--hostname', '--cache']);
-let endpoint = null;
-let inputBuffer = null;
-const body = [...decodedArgs];
-if (api >= 0) {
-  for (let index = api + 1; index < decodedArgs.length; index += 1) {
-    const arg = decodedArgs[index];
-    if (apiValueOptions.has(arg)) {
-      const value = decodedArgs[index + 1];
-      if (arg === '--input' && value) {
-        try {
-          inputBuffer = value === '-' ? readFileSync(0) : readFileSync(resolve(value));
-          body.push(inputBuffer.toString('utf8'));
-        } catch { /* Let gh report an unreadable input after policy checks. */ }
-      }
-      index += 1;
-      continue;
-    }
-    const assigned = arg.match(/^(?:-X|--method|-H|--header|-F|--field|-f|--raw-field|--input|--hostname|--cache)=(.*)$/)?.[1];
-    if (assigned !== undefined) {
-      if (/^--input=/.test(arg)) {
-        try {
-          inputBuffer = assigned === '-' ? readFileSync(0) : readFileSync(resolve(assigned));
-          body.push(inputBuffer.toString('utf8'));
-        } catch { /* Let gh report an unreadable input after policy checks. */ }
-      }
-      continue;
-    }
-    if (arg.startsWith('-')) continue;
-    if (endpoint === null) endpoint = arg;
-  }
-}
-const normaliseEndpoint = value => {
-  if (!value) return '';
-  try {
-    const parsed = new URL(value, 'https://api.github.com');
-    return parsed.pathname.replace(/\\/+$/, '') || '/';
-  } catch {
-    return value.split(/[?#]/, 1)[0].replace(/\\/+$/, '');
-  }
-};
-const mergeOperation = api >= 0 && body.some(value => /\\b(?:mergePullRequest|enablePullRequestAutoMerge)\\b/i.test(value));
-const mergePath = api >= 0 && /^\\/repos\\/[^/]+\\/[^/]+\\/(?:pulls\\/[^/]+\\/merge|merges)$/i.test(normaliseEndpoint(endpoint));
-const containsPrMerge = value => /(?:^|\\s)pr(?:\\s+--?\\S+(?:\\s+\\S+)?)*\\s+merge(?:\\s|$)/i.test(value);
-let prCommand = command + 1;
-if (commandName === 'pr') {
-  while (prCommand < decodedArgs.length) {
-    const arg = decodedArgs[prCommand];
-    if (ghGlobalValueOptions.has(arg) && decodedArgs[prCommand + 1]) {
-      prCommand += 2;
-      continue;
-    }
-    if (/^-R.+/.test(arg) || /^--(?:repo|hostname)=/.test(arg) || ghGlobalFlagOptions.has(arg)) {
-      prCommand += 1;
-      continue;
-    }
-    break;
-  }
-}
-const mergeCommand = commandName === 'pr' && decodedArgs[prCommand] === 'merge';
-const commandTail = decodedArgs.slice(command + 1);
-const administrativeCommand =
-  (commandName === 'repo' && commandTail.includes('delete')) ||
-  (commandName === 'secret' && commandTail.includes('set')) ||
-  (commandName === 'workflow' && commandTail.includes('run'));
-const dangerousAliasText = value => /\\b(?:mergePullRequest|enablePullRequestAutoMerge)\\b|\\/merges?(?:[\\s/?#]|$)/i.test(value) || containsPrMerge(value);
 const executable = ${JSON.stringify(executable)};
-let dangerousAlias = commandName === 'alias' && decodedArgs.slice(command).some(dangerousAliasText);
-if (!dangerousAlias && executable && commandName) {
-  const alias = spawnSync(executable, ['alias', 'get', commandName], { encoding: 'utf8', env: cleanEnv });
-  dangerousAlias = alias.status === 0 && dangerousAliasText(alias.stdout);
-}
-if (mergeOperation || mergePath || mergeCommand || dangerousAlias) {
-  console.error(${JSON.stringify(exports.MERGE_REFUSAL)});
-  process.exit(1);
-}
-if (administrativeCommand) {
-  console.error('GitHub request refused: this administrative operation is not permitted.');
-  process.exit(1);
-}
 if (!executable) { console.error('gh is not installed; use the workspace GitHub API link to open a PR.'); process.exit(127); }
-const result = inputBuffer
-  ? spawnSync(executable, args, { input: inputBuffer, stdio: ['pipe', 'inherit', 'inherit'], env: cleanEnv })
-  : spawnSync(executable, args, { stdio: 'inherit', env: cleanEnv });
+const result = spawnSync(executable, args, { stdio: 'inherit', env: cleanEnv });
 process.exit(result.status ?? 1);
 `, { mode: 0o700 });
     return bin;
 }
 /**
- * Lease one session-neutral guard directory for the whole process. Generated
- * launchers read policy from the target worktree, so sharing the launcher is
- * safe; stacking per-Harness directories in global PATH is not.
+ * Lease one session-neutral guard directory for the whole process. The
+ * launchers contain no session policy, so sharing the launcher is safe; stacking per-Harness directories in global PATH is not.
  */
 async function acquireGhGuardPath(root) {
     let unlock;
@@ -311,25 +128,3 @@ async function acquireGhGuardPath(root) {
         unlock();
     }
 }
-/** Git supplies resolved destination refs, covering force, wildcard and implicit pushes. */
-async function installPushGuard(directory, sessionId, defaultBranch, remoteUrl) {
-    await (0, promises_1.mkdir)(directory, { recursive: true, mode: 0o700 });
-    await (0, promises_1.writeFile)((0, node_path_1.join)(directory, 'push-policy.json'), JSON.stringify({ branch: `agent/${sessionId}`, defaultBranch, remoteUrl }), { mode: 0o600 });
-    await (0, promises_1.writeFile)((0, node_path_1.join)(directory, 'pre-push'), `#!${process.execPath}
-const { readFileSync } = require('node:fs');
-const allowed = ${JSON.stringify(`refs/heads/agent/${sessionId}`)};
-const defaultRef = ${JSON.stringify(`refs/heads/${defaultBranch}`)};
-const allowedRemote = ${JSON.stringify(remoteUrl)};
-if (process.argv[2] !== 'origin' || process.argv[3] !== allowedRemote) {
-  console.error('Git push refused: remote ' + process.argv[2] + ' is not this worktree origin.');
-  process.exit(1);
-}
-for (const line of readFileSync(0, 'utf8').trim().split('\\n').filter(Boolean)) {
-  const remoteRef = line.split(/\\s+/)[2];
-  if (remoteRef === defaultRef || remoteRef !== allowed) {
-    console.error('Git push refused: destination ' + remoteRef + '; this session may push only ' + allowed + '.');
-    process.exit(1);
-  }
-}
-`, { mode: 0o700 });
-}

package/dist/github-proxy.d.ts

@@ -13,6 +13,8 @@ export interface GitHubProxyOptions {
     certificates: GitHubProxyCertificates;
     findSession(sentinel: string): GitHubProxySession | undefined;
     isDirectHostAllowed?(hostname: string): boolean;
+    /** Local runners use normal HTTPS egress for non-GitHub hosts. */
+    allowDirectHttps?: boolean;
     logger?: Pick<Console, 'warn'>;
     connectDirect?: (hostname: string, port: number) => Socket;
     resolveUpstream?: (hostname: string) => Partial<HttpsRequestOptions>;
@@ -23,13 +25,6 @@ export interface GitHubProxyOptions {
      */
     peerUid?: PeerUidResolver;
 }
-export interface ReceivePackCommand {
-    oldOid: string;
-    newOid: string;
-    ref: string;
-}
-export declare function parseReceivePackCommands(body: Buffer): ReceivePackCommand[];
-export declare function receivePackRefusal(body: Buffer, sessionId: string): string | null;
 export declare class GitHubTlsProxy {
     private readonly listener;
     private readonly options;
@@ -47,7 +42,6 @@ export declare class GitHubTlsProxy {
      * true; otherwise returns false and the caller answers as before.
      */
     refuseBrowserPeer(request: IncomingMessage, response: ServerResponse): boolean;
-    private refused;
     private logRefusal;
     private connect;
     private connectDirect;

package/dist/github-proxy.js

@@ -1,8 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GitHubTlsProxy = void 0;
-exports.parseReceivePackCommands = parseReceivePackCommands;
-exports.receivePackRefusal = receivePackRefusal;
 const node_crypto_1 = require("node:crypto");
 const node_http_1 = require("node:http");
 const node_https_1 = require("node:https");
@@ -16,88 +14,11 @@ const PASS_THROUGH_HOSTS = new Set([
     'codeload.github.com'
 ]);
 const ALLOWED_HOSTS = new Set([...INTERCEPTED_HOSTS, ...PASS_THROUGH_HOSTS]);
-const GRAPHQL_REFUSED_MUTATIONS = [
-    'mergePullRequest',
-    'enablePullRequestAutoMerge',
-    'deleteRepository',
-    'updateBranchProtectionRule',
-    'createBranchProtectionRule'
-];
-const ZERO_OID = /^0+$/;
-const MAX_INSPECTED_BODY_BYTES = 16 * 1024 * 1024;
-const MAX_RECEIVE_PACK_COMMAND_BYTES = 64 * 1024;
-function receivePackCommandLength(body) {
-    let offset = 0;
-    while (offset + 4 <= body.length) {
-        const lengthText = body.subarray(offset, offset + 4).toString('ascii');
-        if (!/^[0-9a-f]{4}$/i.test(lengthText)) {
-            throw new Error('Invalid git receive-pack pkt-line length.');
-        }
-        const length = Number.parseInt(lengthText, 16);
-        if (length === 0)
-            return offset + 4;
-        if (length < 4)
-            throw new Error('Invalid git receive-pack pkt-line length.');
-        if (offset + length > body.length)
-            return null;
-        offset += length;
-    }
-    return null;
-}
 function safeEquals(left, right) {
     const a = Buffer.from(left);
     const b = Buffer.from(right);
     return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b);
 }
-function parseReceivePackCommands(body) {
-    const commands = [];
-    let offset = 0;
-    while (offset + 4 <= body.length) {
-        const lengthText = body.subarray(offset, offset + 4).toString('ascii');
-        if (!/^[0-9a-f]{4}$/i.test(lengthText)) {
-            throw new Error('Invalid git receive-pack pkt-line length.');
-        }
-        const length = Number.parseInt(lengthText, 16);
-        if (length === 0)
-            return commands;
-        if (length < 4 || offset + length > body.length) {
-            throw new Error('Incomplete git receive-pack pkt-line.');
-        }
-        const payload = body
-            .subarray(offset + 4, offset + length)
-            .toString('utf8')
-            .replace(/\n$/, '');
-        const command = payload.split('\0', 1)[0];
-        const match = command.match(/^([0-9a-f]+) ([0-9a-f]+) ([^\s]+)$/i);
-        if (!match)
-            throw new Error('Invalid git receive-pack ref update.');
-        commands.push({ oldOid: match[1], newOid: match[2], ref: match[3] });
-        offset += length;
-    }
-    throw new Error('Incomplete git receive-pack command list.');
-}
-function receivePackRefusal(body, sessionId) {
-    let commands;
-    try {
-        commands = parseReceivePackCommands(body);
-    }
-    catch {
-        return 'Git push refused: the receive-pack command list is malformed.';
-    }
-    if (commands.length === 0) {
-        return 'Git push refused: the receive-pack command list is empty.';
-    }
-    const allowed = `refs/heads/agent/${sessionId}`;
-    for (const command of commands) {
-        if (ZERO_OID.test(command.newOid)) {
-            return `Git push refused: deleting ${command.ref} is not permitted.`;
-        }
-        if (command.ref !== allowed) {
-            return `Git push refused: this session may update only ${allowed}.`;
-        }
-    }
-    return null;
-}
 function decodedPath(request) {
     try {
         return decodeURIComponent(new URL(request.url ?? '/', 'https://x').pathname);
@@ -106,34 +27,6 @@ function decodedPath(request) {
         return null;
     }
 }
-function repositoryFromPath(hostname, path) {
-    const match = hostname === 'api.github.com'
-        ? path.match(/^\/repos\/([^/]+)\/([^/]+)(?:\/|$)/)
-        : path.match(/^\/([^/]+)\/([^/]+?)\.git(?:\/|$)/);
-    return match ? `${match[1]}/${match[2]}` : null;
-}
-function restRefusal(method, path) {
-    if (/^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/merge\/?$/i.test(path))
-        return 'GitHub request refused: pull requests must be merged by a human.';
-    if (/^\/repos\/[^/]+\/[^/]+\/merges\/?$/i.test(path))
-        return 'GitHub request refused: merge commits are not permitted.';
-    if (method === 'DELETE' && /^\/repos\/[^/]+\/[^/]+\/?$/i.test(path))
-        return 'GitHub request refused: repository deletion is not permitted.';
-    const forbidden = [
-        /\/actions\/secrets(?:\/|$)/i,
-        /\/actions\/workflows\/[^/]+\/dispatches\/?$/i,
-        /\/rulesets(?:\/|$)/i,
-        /\/branches\/[^/]+\/protection(?:\/|$)/i,
-        /\/hooks(?:\/|$)/i,
-        /\/keys(?:\/|$)/i,
-        /\/collaborators(?:\/|$)/i,
-        /\/deployments(?:\/|$)/i,
-        /\/codespaces(?:\/|$)/i
-    ];
-    return forbidden.some((pattern) => pattern.test(path))
-        ? 'GitHub request refused: this administrative operation is not permitted.'
-        : null;
-}
 function bearerSentinel(header) {
     const value = Array.isArray(header) ? header[0] : header;
     return (value?.match(/^\s*(?:token|Bearer)\s+(pfgh_[A-Za-z0-9_-]+)\s*$/i)?.[1] ??
@@ -155,23 +48,6 @@ function basicSentinel(header) {
         return null;
     }
 }
-function graphQLPolicyText(body) {
-    const raw = body.toString('utf8');
-    const forms = [raw];
-    try {
-        forms.push(JSON.stringify(JSON.parse(raw)));
-    }
-    catch {
-        /* gh uses JSON; retain the raw form for other valid GitHub clients. */
-    }
-    try {
-        forms.push(decodeURIComponent(raw.replace(/\+/g, ' ')));
-    }
-    catch {
-        /* A malformed percent escape remains visible in the raw form. */
-    }
-    return forms.join('\n');
-}
 function forwardedHeaders(headers) {
     const copy = { ...headers };
     for (const name of [
@@ -187,74 +63,10 @@ function forwardedHeaders(headers) {
     }
     return copy;
 }
-async function readBody(request) {
-    const chunks = [];
-    let length = 0;
-    for await (const chunk of request) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        length += buffer.length;
-        if (length > MAX_INSPECTED_BODY_BYTES) {
-            throw new Error('GitHub request body is too large for policy inspection.');
-        }
-        chunks.push(buffer);
-    }
-    return Buffer.concat(chunks);
-}
-async function readReceivePackPrefix(request) {
-    return new Promise((resolvePromise, reject) => {
-        let buffered = Buffer.alloc(0);
-        function cleanup() {
-            // eslint-disable-next-line @typescript-eslint/no-use-before-define
-            request.off('data', onData);
-            // eslint-disable-next-line @typescript-eslint/no-use-before-define
-            request.off('end', onEnd);
-            // eslint-disable-next-line @typescript-eslint/no-use-before-define
-            request.off('error', onError);
-        }
-        function onError(error) {
-            cleanup();
-            reject(error);
-        }
-        function onEnd() {
-            cleanup();
-            reject(new Error('Incomplete git receive-pack command list.'));
-        }
-        function onData(chunk) {
-            request.pause();
-            buffered = Buffer.concat([buffered, Buffer.from(chunk)]);
-            if (buffered.length > MAX_RECEIVE_PACK_COMMAND_BYTES) {
-                cleanup();
-                reject(new Error('Git receive-pack command list is too large.'));
-                return;
-            }
-            try {
-                const length = receivePackCommandLength(buffered);
-                if (length === null) {
-                    request.resume();
-                    return;
-                }
-                cleanup();
-                const remainder = buffered.subarray(length);
-                if (remainder.length > 0)
-                    request.unshift(remainder);
-                resolvePromise(buffered.subarray(0, length));
-            }
-            catch (error) {
-                cleanup();
-                reject(error);
-            }
-        }
-        request.on('data', onData);
-        request.once('end', onEnd);
-        request.once('error', onError);
-        request.resume();
-    });
-}
-function reply(response, status, message, basicChallenge = false) {
+function reply(response, status, message) {
     response.writeHead(status, {
         'content-type': 'text/plain; charset=utf-8',
-        'cache-control': 'no-store',
-        ...(basicChallenge ? { 'www-authenticate': 'Basic realm="GitHub"' } : {})
+        'cache-control': 'no-store'
     });
     response.end(`${message}\n`);
 }
@@ -298,10 +110,6 @@ class GitHubTlsProxy {
     refuseBrowserPeer(request, response) {
         return this.peerGuard.refuse(request.socket, response);
     }
-    refused(sessionId, kind, path, response, reason) {
-        this.logRefusal(sessionId, kind, path);
-        reply(response, 403, reason);
-    }
     logRefusal(sessionId, kind, path) {
         (this.options.logger ?? console).warn(`[coding-agents] github-proxy-refused sessionId=${sessionId} kind=${kind} path=${JSON.stringify(path)}`);
     }
@@ -309,7 +117,10 @@ class GitHubTlsProxy {
         const target = request.url ?? '';
         const match = target.match(/^([^:]+):(\d+)$/);
         const hostname = match?.[1]?.toLowerCase() ?? '';
-        if (match?.[2] === '443' && this.options.isDirectHostAllowed?.(hostname)) {
+        if (match?.[2] === '443' &&
+            !ALLOWED_HOSTS.has(hostname) &&
+            (this.options.allowDirectHttps ||
+                this.options.isDirectHostAllowed?.(hostname))) {
             this.connectDirect(hostname, 443, socket, head);
             return;
         }
@@ -340,9 +151,8 @@ class GitHubTlsProxy {
         }
     }
     connectDirect(hostname, port, socket, head) {
-        // Some clients do not consistently honor NO_PROXY. Tunnel only the exact
-        // server-configured direct hosts so their public TLS certificate remains
-        // end-to-end, while GitHub traffic continues through policy inspection.
+        // Keep non-GitHub TLS end to end. The local runner's own network policy
+        // controls this tunnel. Sandbox callers still need an approved direct host.
         const upstream = (this.options.connectDirect ??
             ((host, targetPort) => (0, node_net_1.connect)(targetPort, host)))(hostname, port);
         (0, child_stream_guards_1.guardStream)(upstream, 'GitHubProxy/direct-upstream');
@@ -380,17 +190,24 @@ class GitHubTlsProxy {
             return;
         }
         if (PASS_THROUGH_HOSTS.has(hostname)) {
-            this.forward(hostname, request, response, Buffer.alloc(0), undefined);
+            this.forward(hostname, request, response, undefined);
             return;
         }
         const gitRequest = hostname === 'github.com' &&
             /\.git\/(?:info\/refs|git-upload-pack|git-receive-pack)$/i.test(path);
+        // Public GitHub pages need no installation token. Do not inject it into
+        // web traffic; only Git smart HTTP and the API use token exchange.
+        if (hostname === 'github.com' && !gitRequest) {
+            this.forward(hostname, request, response, undefined);
+            return;
+        }
         const sentinel = gitRequest
             ? basicSentinel(request.headers.authorization)
             : bearerSentinel(request.headers.authorization);
         if (!sentinel) {
-            this.logRefusal('unknown', 'missing-sentinel', path);
-            reply(response, 401, 'GitHub session sentinel is required.', gitRequest);
+            // GitHub handles anonymous requests and sends its own auth challenge.
+            // forwardedHeaders strips caller authorization before this reaches it.
+            this.forward(hostname, request, response, undefined);
             return;
         }
         const session = this.options.findSession(sentinel);
@@ -399,71 +216,16 @@ class GitHubTlsProxy {
             reply(response, 403, 'GitHub session sentinel is invalid.');
             return;
         }
-        if (hostname === 'github.com' && !gitRequest) {
-            this.refused(session.sessionId, 'github-path', path, response, 'GitHub request refused: github.com is limited to Git smart HTTP.');
-            return;
-        }
-        const repository = repositoryFromPath(hostname, path);
-        if (repository &&
-            !session.credential.repositories.some((item) => item.fullName.toLowerCase() === repository.toLowerCase())) {
-            this.refused(session.sessionId, 'repository-grant', path, response, 'Repository is outside this agent grant.');
-            return;
-        }
-        if (hostname === 'api.github.com' && path !== '/graphql' && !repository) {
-            this.refused(session.sessionId, 'repository-grant', path, response, 'GitHub API request is not scoped to a granted repository.');
-            return;
-        }
-        const restReason = hostname === 'api.github.com'
-            ? restRefusal(request.method ?? 'GET', path)
-            : null;
-        if (restReason) {
-            this.refused(session.sessionId, 'rest-policy', path, response, restReason);
-            return;
-        }
-        const receivePack = /\.git\/git-receive-pack$/i.test(path);
-        let body;
-        try {
-            body = receivePack
-                ? await readReceivePackPrefix(request)
-                : await readBody(request);
-        }
-        catch (error) {
-            reply(response, 413, error instanceof Error ? error.message : String(error));
-            return;
-        }
-        if (path === '/graphql') {
-            if (request.method !== 'POST' ||
-                ![undefined, 'identity'].includes(request.headers['content-encoding'])) {
-                this.refused(session.sessionId, 'graphql-policy', path, response, 'GitHub GraphQL request refused: the body cannot be inspected.');
-                return;
-            }
-            const text = graphQLPolicyText(body);
-            const mutation = GRAPHQL_REFUSED_MUTATIONS.find((name) => new RegExp(`\\b${name}\\b`).test(text));
-            if (mutation) {
-                this.refused(session.sessionId, 'graphql-policy', path, response, `GitHub GraphQL mutation refused: ${mutation} is not permitted.`);
-                return;
-            }
-        }
-        if (receivePack) {
-            const reason = receivePackRefusal(body, session.sessionId);
-            if (reason) {
-                this.refused(session.sessionId, 'git-receive-pack', path, response, reason);
-                return;
-            }
-        }
         const authorization = gitRequest
             ? `Basic ${Buffer.from(`x-access-token:${session.credential.token}`).toString('base64')}`
             : `Bearer ${session.credential.token}`;
-        this.forward(hostname, request, response, body, authorization, receivePack);
+        this.forward(hostname, request, response, authorization);
     }
-    forward(hostname, request, response, body, authorization, pipeRemainder = false) {
+    forward(hostname, request, response, authorization) {
         const headers = forwardedHeaders(request.headers);
         headers.host = hostname;
         if (authorization)
             headers.authorization = authorization;
-        if (body.length > 0 && !pipeRemainder) {
-            headers['content-length'] = String(body.length);
-        }
         const upstream = (0, node_https_1.request)({
             hostname,
             port: 443,
@@ -482,14 +244,7 @@ class GitHubTlsProxy {
                 response.writeHead(502);
             response.end(error.message);
         });
-        if (pipeRemainder) {
-            if (body.length > 0)
-                upstream.write(body);
-            request.pipe(upstream);
-        }
-        else if (body.length > 0)
-            upstream.end(body);
-        else if (request.readableEnded)
+        if (request.readableEnded)
             upstream.end();
         else
             request.pipe(upstream);

package/dist/github-workspace.d.ts

@@ -10,6 +10,7 @@ export interface GitHubWorkspaceOptions {
     createServer?: (handler: RequestListener) => Server;
     logger?: Pick<Console, 'warn'>;
     directUrls?: string[];
+    allowDirectHttps?: boolean;
     /** Injected in tests: the proxy's peer-uid lookup. See `GitHubTlsProxy`. */
     peerUid?: PeerUidResolver;
 }

package/dist/github-workspace.js

@@ -11,7 +11,6 @@ const node_http_1 = require("node:http");
 const node_path_1 = require("node:path");
 const node_util_1 = require("node:util");
 const vendor_environment_1 = require("./adapters/vendor-environment");
-const github_command_guards_1 = require("./github-command-guards");
 const github_proxy_1 = require("./github-proxy");
 const github_proxy_certificates_1 = require("./github-proxy-certificates");
 const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
@@ -446,6 +445,7 @@ class GitHubWorkspaceProvider {
         tlsProxy = new github_proxy_1.GitHubTlsProxy(server, {
             certificates,
             peerUid: this.options.peerUid,
+            allowDirectHttps: this.options.allowDirectHttps,
             logger: this.options.logger,
             isDirectHostAllowed: (hostname) => this.directHosts.has(hostname),
             findSession: (sentinel) => [...this.sessions.values()].find((entry) => entry.sentinel === sentinel)
@@ -598,10 +598,14 @@ class GitHubWorkspaceProvider {
             });
             await this.runGit(['config', '--worktree', 'remote.origin.url', transportUrl], { cwd: worktree });
             const hooks = (0, node_path_1.join)(sessionRoot, '.github-hooks', name);
-            await (0, github_command_guards_1.installPushGuard)(hooks, request.sessionId, repository.defaultBranch, transportUrl);
-            await this.runGit(['config', '--worktree', 'core.hooksPath', hooks], {
-                cwd: worktree
-            });
+            // Retire our old hook on reused checkouts. GitHub decides push policy.
+            await (0, promises_1.rm)(hooks, { recursive: true, force: true });
+            const configuredHooks = await this.runGit(['config', '--worktree', '--get', 'core.hooksPath'], { cwd: worktree }).catch(() => ({ stdout: '' }));
+            if (configuredHooks.stdout.trim() === hooks) {
+                await this.runGit(['config', '--worktree', '--unset', 'core.hooksPath'], {
+                    cwd: worktree
+                });
+            }
             // A direct /usr/bin/git call also uses this worktree configuration.
             // Rewrite GitHub SSH addresses before transport selection and disable
             // owner SSH keys for any address that is not rewritten.
@@ -645,8 +649,8 @@ class GitHubWorkspaceProvider {
         const instructions = [
             '# GitHub repository access',
             '',
-            'Each repository is a child directory. Commit and push only the agent/<session-id> branch.',
-            'GitHub access uses the session proxy. Use gh and git only in this session worktree. GH_TOKEN is a session sentinel, not a GitHub token. Merges and pushes outside agent/<session-id> are refused.',
+            'Each repository is a child directory. New checkouts start on agent/<session-id>.',
+            'GitHub access uses the session proxy. Use gh and git only in this session worktree. GH_TOKEN is a session sentinel, not a GitHub token. GitHub permissions and repository rules decide which pushes and merges are allowed.',
             ''
         ].join('\n');
         await (0, promises_1.writeFile)((0, node_path_1.join)(sessionRoot, 'AGENTS.md'), instructions, {

package/dist/harness.js

@@ -328,7 +328,8 @@ class Harness {
                 new github_workspace_1.GitHubWorkspaceProvider({
                     root: options.workspaceRoot,
                     port: options.githubProxyPort,
-                    directUrls: [options.controlPlaneUrl]
+                    directUrls: [options.controlPlaneUrl],
+                    allowDirectHttps: options.runtime === 'desktop' || options.runtime === 'self-hosted'
                 });
         this.secrets = deps.secrets ?? new ports_default_1.NoSecretProvider();
         this.events = deps.events ?? new ports_default_1.NullEventSink();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peakflo/agent-harness",
-  "version": "0.2.18",
+  "version": "0.2.19-rc.1",
   "description": "Headless Peakflo coding-agent harness. One codebase, three hosting modes: a Daytona cloud sandbox, a customer VM, and the 20x desktop.",
   "license": "MIT",
   "type": "commonjs",