@peakflo/agent-harness 0.2.9-rc.3 → 0.2.9-rc.5

package/dist/adapters/claude-code-adapter.js

@@ -46,7 +46,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClaudeCodeAdapter = exports.ClaudeSystemSubtype = void 0;
 const coding_agent_adapter_1 = require("./coding-agent-adapter");
 const permission_mode_1 = require("../runtime/permission-mode");
-const vendor_backends_1 = require("../vendor-backends");
 let ClaudeAgentSDK = null;
 /** Module-level cache for the resolved Claude executable path (persists across adapter instances) */
 let resolvedClaudeExecutablePath = null;
@@ -271,10 +270,7 @@ class ClaudeCodeAdapter {
     }
     async loadSDK() {
         try {
-            // CHANGED from 20x: the SDK is not bundled with the runner (it would add
-            // ~190 MB to every install), so it is also looked for in the global
-            // node_modules. See `vendor-backends.ts`.
-            ClaudeAgentSDK = (await (0, vendor_backends_1.importClaudeSdk)());
+            ClaudeAgentSDK = await Promise.resolve().then(() => __importStar(require('@anthropic-ai/claude-agent-sdk')));
             console.log('[ClaudeCodeAdapter] SDK loaded successfully');
         }
         catch (error) {
@@ -706,7 +702,18 @@ class ClaudeCodeAdapter {
             // the mode above decorative in exactly the way G1 was.
             ...(claudePermissionMode === 'bypassPermissions'
                 ? { allowDangerouslySkipPermissions: true }
-                : {}),
+                : {
+                    /*
+                     * ADDED, not in 20x. In every mode that asks, the SDK calls this
+                     * before a tool that needs permission. Without it the SDK has
+                     * nobody to ask and DENIES the tool: nothing unsafe runs, but
+                     * "Ask before each action" asked nobody and refused everything.
+                     * The question is held here until the runner brings the person's
+                     * answer (`getPendingApproval` / `respondToApproval`, the same
+                     * two methods the Codex and ACP adapters have).
+                     */
+                    canUseTool: (toolName, input, extra) => this.askToolApproval(sessionId, toolName, input, extra?.signal)
+                }),
             ...(secretHooks ? { hooks: secretHooks } : {}),
         };
         // Determine session continuation mode
@@ -808,6 +815,92 @@ class ClaudeCodeAdapter {
         // Start consuming stream
         session.streamTask = this.consumeStream(sessionId, session);
     }
+    /* ---------------------------------------------------------------------- */
+    /* Tool approvals (ADDED, not in 20x) — see `canUseTool` in startQuery       */
+    /* ---------------------------------------------------------------------- */
+    /**
+     * Questions waiting for a person, oldest first, per session. Claude can ask
+     * about several tools at once (parallel tool use); they are answered one at
+     * a time, in the order they were asked, and none is answered by a reply
+     * that was meant for another.
+     */
+    pendingToolApprovals = new Map();
+    askToolApproval(sessionId, toolName, input, signal) {
+        return new Promise((resolve) => {
+            // The command, path or URL is shown in full: a person must not approve
+            // from a shortened view of what will run. Only the fallback, a dump of
+            // an unknown tool's whole input, is cut, and says so.
+            const dump = JSON.stringify(input ?? {});
+            const detail = typeof input?.command === 'string' ? input.command
+                : typeof input?.file_path === 'string' ? input.file_path
+                    : typeof input?.url === 'string' ? input.url
+                        : dump.length > 300 ? `${dump.slice(0, 300)}… (input shortened)` : dump;
+            const toolCallId = `claude-approval-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const onAbort = () => entry.settle(false, 'The turn was stopped before this action was approved.');
+            const entry = {
+                toolCallId,
+                question: `${toolName}: ${detail}`,
+                settle: (approved, reason) => {
+                    signal?.removeEventListener('abort', onAbort);
+                    const queue = this.pendingToolApprovals.get(sessionId) ?? [];
+                    const index = queue.indexOf(entry);
+                    if (index < 0)
+                        return; // already answered
+                    queue.splice(index, 1);
+                    if (queue.length === 0)
+                        this.pendingToolApprovals.delete(sessionId);
+                    if (approved)
+                        resolve({ behavior: 'allow', updatedInput: input });
+                    else
+                        resolve({ behavior: 'deny', message: reason ?? 'The user did not approve this action.' });
+                    // The next question in the queue, if any, is now the one to show.
+                    if (queue.length > 0)
+                        this.onDataAvailable?.(sessionId);
+                }
+            };
+            const queue = this.pendingToolApprovals.get(sessionId) ?? [];
+            queue.push(entry);
+            this.pendingToolApprovals.set(sessionId, queue);
+            if (signal?.aborted)
+                onAbort();
+            else
+                signal?.addEventListener('abort', onAbort, { once: true });
+            this.onDataAvailable?.(sessionId);
+        });
+    }
+    /**
+     * Refuse every question still waiting for this session. Called when the
+     * turn is aborted or the session is destroyed, so no tool is left waiting
+     * on an answer that can no longer come — whether or not the SDK passed an
+     * abort signal with the question.
+     */
+    denyPendingToolApprovals(sessionId, reason) {
+        for (const entry of [...(this.pendingToolApprovals.get(sessionId) ?? [])]) {
+            entry.settle(false, reason);
+        }
+        this.pendingToolApprovals.delete(sessionId);
+    }
+    getPendingApproval(sessionId) {
+        const pending = this.pendingToolApprovals.get(sessionId)?.[0];
+        if (!pending)
+            return null;
+        return {
+            toolCallId: pending.toolCallId,
+            question: pending.question,
+            options: [
+                { optionId: 'allow', name: 'Allow', kind: 'allow' },
+                { optionId: 'deny', name: 'Deny', kind: 'reject' }
+            ]
+        };
+    }
+    async respondToApproval(sessionId, approved, optionId) {
+        const pending = this.pendingToolApprovals.get(sessionId)?.[0];
+        if (!pending)
+            return false;
+        // Only an explicit allow allows. A reply naming any other option denies.
+        pending.settle(approved && (optionId === undefined || optionId === 'allow'));
+        return true;
+    }
     async getStatus(sessionId, _config) {
         const session = this.sessions.get(sessionId);
         if (!session) {
@@ -891,6 +984,7 @@ class ClaudeCodeAdapter {
         session.enqueuePrompt = null;
         session.backgroundTasks.clear();
         session.abortController?.abort();
+        this.denyPendingToolApprovals(sessionId, 'The turn was stopped before this action was approved.');
         // Wait for stream to finish cleanup
         if (session.streamTask) {
             console.log(`[ClaudeCodeAdapter] Waiting for stream cleanup...`);
@@ -916,6 +1010,7 @@ class ClaudeCodeAdapter {
         session.enqueuePrompt = null;
         session.backgroundTasks.clear();
         session.abortController?.abort();
+        this.denyPendingToolApprovals(sessionId, 'The session was closed before this action was approved.');
         // Wait for stream task to complete
         if (session.streamTask) {
             try {
@@ -1225,6 +1320,9 @@ class ClaudeCodeAdapter {
         }
         finally {
             console.log('[ClaudeCodeAdapter] Stream consumption ended');
+            // ADDED, not in 20x: the stream that asked is gone (ended, failed or the
+            // process exited), so no answer can reach it. Nothing may stay queued.
+            this.denyPendingToolApprovals(sessionId, 'The turn ended before this action was approved.');
             // Always reset queryIterator when the stream ends (process exited).
             // Previously only error paths did this, leaving a truthy-but-exhausted
             // iterator after normal completion.  That caused the next sendPrompt to

package/dist/adapters/codex-app-server-adapter.d.ts

@@ -6,6 +6,30 @@
  * 20x's CodingAgentAdapter contract.
  */
 import type { CodingAgentAdapter, SessionConfig, SessionStatus, SessionMessage, MessagePart } from './coding-agent-adapter';
+/**
+ * `thread/items/list` returns each item inside an envelope:
+ * `{ turnId, item: { type: 'userMessage', … }, startedAtMs, completedAtMs }`.
+ * Read as an item, the envelope has no `type`, no role and no text, so it fell
+ * through to the "unknown item is a tool call" branch and the transcript showed
+ * a "tool / tool" card holding the echoed prompt as JSON after every reply.
+ */
+export declare function unwrapListedThreadItem(entry: unknown): unknown;
+/** A decision that approves more than the one request it answers, or may. */
+export declare function isStandingApprovalDecision(optionId: string): boolean;
+/**
+ * CHANGED from 20x, which sends `on-request` for every mode but "allow".
+ *
+ * `on-request` leaves it to the MODEL to ask, and it asks only when it wants
+ * to leave the sandbox. Inside a workspace-write sandbox that is never: Codex
+ * created files and ran shell commands with no prompt at all while the agent
+ * was set to "Ask before each action". Seen on staging and reproduced.
+ *
+ * `untrusted` is Codex's own "ask first" policy: commands on its short list of
+ * read-only ones (ls, cat, ...) run, and everything else — any other command,
+ * any file change — is sent to the client as an approval request before it
+ * runs. That is what "Ask before each action" says.
+ */
+export declare function codexApprovalPolicy(config: Pick<SessionConfig, 'permissionMode'>): 'never' | 'untrusted';
 interface PendingApproval {
     requestId: string | number;
     toolCallId: string;

package/dist/adapters/codex-app-server-adapter.js

@@ -41,6 +41,9 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodexAppServerAdapter = void 0;
+exports.unwrapListedThreadItem = unwrapListedThreadItem;
+exports.isStandingApprovalDecision = isStandingApprovalDecision;
+exports.codexApprovalPolicy = codexApprovalPolicy;
 /**
  * Extracted verbatim from 20x `src/main/adapters/codex-app-server-adapter.ts`.
  * CHANGED: imports only — `../child-stream-guards` ->
@@ -55,6 +58,60 @@ const path_1 = require("path");
 const util_1 = require("util");
 const coding_agent_adapter_1 = require("./coding-agent-adapter");
 const DEFAULT_CODEX_APP_SERVER_MODEL = 'gpt-5.5';
+/**
+ * `thread/items/list` returns each item inside an envelope:
+ * `{ turnId, item: { type: 'userMessage', … }, startedAtMs, completedAtMs }`.
+ * Read as an item, the envelope has no `type`, no role and no text, so it fell
+ * through to the "unknown item is a tool call" branch and the transcript showed
+ * a "tool / tool" card holding the echoed prompt as JSON after every reply.
+ */
+function unwrapListedThreadItem(entry) {
+    if (!isObject(entry))
+        return entry;
+    if (asString(entry.type))
+        return entry;
+    return isObject(entry.item) ? entry.item : entry;
+}
+/**
+ * The decisions that answer ONE request and nothing more. A list of what is
+ * known to be safe, not of what is known to be unsafe: a decision Codex adds
+ * later (one that remembers a rule under a name nobody here has seen) is
+ * treated as standing until someone adds it here. The cost of that: a new
+ * ONE-TIME decision from Codex is also hidden until it is added; the withheld
+ * names are logged by `handleApprovalRequest` so that is visible.
+ */
+const ONE_TIME_APPROVAL_DECISIONS = new Set([
+    'accept',
+    'approved',
+    'decline',
+    'denied',
+    'cancel',
+    'abort'
+]);
+/** A decision that approves more than the one request it answers, or may. */
+function isStandingApprovalDecision(optionId) {
+    return !ONE_TIME_APPROVAL_DECISIONS.has(optionId);
+}
+/**
+ * CHANGED from 20x, which sends `on-request` for every mode but "allow".
+ *
+ * `on-request` leaves it to the MODEL to ask, and it asks only when it wants
+ * to leave the sandbox. Inside a workspace-write sandbox that is never: Codex
+ * created files and ran shell commands with no prompt at all while the agent
+ * was set to "Ask before each action". Seen on staging and reproduced.
+ *
+ * `untrusted` is Codex's own "ask first" policy: commands on its short list of
+ * read-only ones (ls, cat, ...) run, and everything else — any other command,
+ * any file change — is sent to the client as an approval request before it
+ * runs. That is what "Ask before each action" says.
+ */
+function codexApprovalPolicy(config) {
+    // `'allow'` is what `mapPermissionMode` makes of the agent's
+    // `bypassPermissions` ("Don't ask for permission"), and of nothing else.
+    // Only an explicit "allow" runs without asking. Anything else, including a
+    // value this build does not know, asks.
+    return config.permissionMode === 'allow' ? 'never' : 'untrusted';
+}
 const MAX_IPC_TOOL_INPUT_CHARS = 20_000;
 const MAX_IPC_TOOL_OUTPUT_CHARS = 100_000;
 const MIN_THREAD_LEVEL_ASSISTANT_DEDUPE_CHARS = 40;
@@ -269,7 +326,7 @@ class CodexAppServerAdapter {
         const result = await this.sendRpcRequest(session, 'thread/start', {
             cwd: config.workspaceDir,
             model: config.model || DEFAULT_CODEX_APP_SERVER_MODEL,
-            approvalPolicy: config.permissionMode === 'allow' ? 'never' : 'on-request',
+            approvalPolicy: codexApprovalPolicy(config),
             approvalsReviewer: 'user',
             sandbox: this.resolveSandboxMode(config),
             developerInstructions: config.systemPrompt || null,
@@ -295,7 +352,7 @@ class CodexAppServerAdapter {
             threadId: sessionId,
             cwd: config.workspaceDir,
             model: config.model || DEFAULT_CODEX_APP_SERVER_MODEL,
-            approvalPolicy: config.permissionMode === 'allow' ? 'never' : 'on-request',
+            approvalPolicy: codexApprovalPolicy(config),
             approvalsReviewer: 'user',
             sandbox: this.resolveSandboxMode(config),
             runtimeWorkspaceRoots: this.buildRuntimeWorkspaceRoots(config.workspaceDir),
@@ -347,7 +404,7 @@ class CodexAppServerAdapter {
             cwd: config.workspaceDir,
             model: config.model || DEFAULT_CODEX_APP_SERVER_MODEL,
             effort: config.reasoningEffort && config.reasoningEffort !== 'max' ? config.reasoningEffort : null,
-            approvalPolicy: config.permissionMode === 'allow' ? 'never' : 'on-request',
+            approvalPolicy: codexApprovalPolicy(config),
             approvalsReviewer: 'user',
             sandbox: this.resolveSandboxMode(config),
             sandboxPolicy: this.buildSandboxPolicy(config),
@@ -827,7 +884,17 @@ class CodexAppServerAdapter {
         }
         const toolCallId = asString(params.approvalId) || asString(params.itemId) || asString(params.callId) || String(request.id);
         const responseKind = this.getApprovalResponseKind(request.method);
-        const rawDecisions = Array.isArray(params.availableDecisions) ? params.availableDecisions : [];
+        // A decision that also writes a standing rule ("…WithExecpolicyAmendment",
+        // "…ForSession") would let one click approve later commands nobody saw, and
+        // the amendment is saved into the Codex config on the runner. Offer only
+        // the decisions known to answer this one request; the rest are logged.
+        const offered = Array.isArray(params.availableDecisions) ? params.availableDecisions : [];
+        const rawDecisions = offered
+            .filter((decision) => !isStandingApprovalDecision(normalizeDecisionName(decision)));
+        if (rawDecisions.length !== offered.length) {
+            const withheld = offered.map(normalizeDecisionName).filter(isStandingApprovalDecision);
+            console.log(`[CodexAppServerAdapter] Not offering approval decisions: ${withheld.join(', ')}`);
+        }
         const approvalOptions = rawDecisions.length > 0
             ? rawDecisions.map((decision) => {
                 const optionId = normalizeDecisionName(decision);
@@ -922,8 +989,9 @@ class CodexAppServerAdapter {
     }
     bufferThreadItems(session, result) {
         const items = isObject(result) && Array.isArray(result.data) ? result.data : [];
-        for (const item of items) {
-            this.bufferReconciledThreadItem(session, item, isObject(item) ? asString(item.turnId) : undefined);
+        for (const entry of items) {
+            const turnId = isObject(entry) ? asString(entry.turnId) : undefined;
+            this.bufferReconciledThreadItem(session, unwrapListedThreadItem(entry), turnId);
         }
     }
     /**

package/dist/adapters/cursor-acp.d.ts

@@ -0,0 +1,84 @@
+/**
+ * What the runner has to know about Cursor's ACP agent (`cursor-agent acp`)
+ * that the generic ACP adapter does not: how a model is named on the wire,
+ * which Cursor mode a permission mode maps to, and how the account's plan
+ * limit shows up.
+ *
+ * Kept out of `acp-adapter.ts`, which is a copy of the 20x adapter, so the
+ * copy stays close to its source and these rules can be tested on their own.
+ */
+/** One entry of `configOptions` in a `session/new` or `session/load` result. */
+interface AcpConfigOption {
+    id: string;
+    values: Array<{
+        value: string;
+        name: string;
+    }>;
+}
+/** The `configOptions` of a session result, in a shape that is safe to read. */
+export declare function readAcpConfigOptions(sessionResult: unknown): AcpConfigOption[];
+/**
+ * The value to send in `session/set_config_option { configId: 'model' }` for
+ * the model an agent names, or null when the session offers nothing that
+ * matches — in which case nothing is sent and Cursor keeps its own default.
+ *
+ * WHY THIS IS NOT THE ID ITSELF. Cursor's ACP agent accepts only the values it
+ * lists in the session's own `model` option, and those carry parameters:
+ * `default[]` (shown as "Auto"), `composer-2.5[fast=true]`,
+ * `gpt-5.6-sol[context=272k,reasoning=medium,fast=false]`. The ids an agent
+ * holds come from `cursor-agent models` (`auto`, `composer-2.5`,
+ * `gpt-5.6-sol-medium`), which is a different list. Sending such an id gave
+ * `Failed to set model: Invalid params` on every turn, "Auto" included.
+ *
+ * Tried in order: the exact value, the option's display name, the part before
+ * `[`, then the longest such part the id starts with (`gpt-5.6-sol-medium`
+ * → `gpt-5.6-sol[…]`). `auto` is Cursor's `default`.
+ */
+export declare function resolveCursorModelValue(model: string | undefined, sessionResult: unknown): string | null;
+export type CursorMode = 'agent' | 'plan' | 'ask';
+/**
+ * The Cursor mode a turn must run in.
+ *
+ * FAIL CLOSED. In its `agent` mode Cursor asks only about commands that are
+ * not on the allow-list in the runner owner's `~/.cursor/cli-config.json`
+ * (seen: "Not in allowlist: cat, echo"). The runner must not read or change
+ * that list, so it cannot know which actions Cursor will run unasked, and a
+ * permission mode that promises a question before EACH action cannot be
+ * promised for Cursor. Every asking mode therefore runs
+ * Cursor in one of its own read-only modes — stricter than what was asked for,
+ * never looser:
+ *
+ *   plan                       → Cursor `plan` (reads and proposes a plan)
+ *   default, acceptEdits       → Cursor `ask`  (reads and answers, no changes)
+ *   bypassPermissions          → Cursor `agent` (the only mode that may act)
+ *
+ * A permission request Cursor does raise is still put to the person.
+ */
+export declare function cursorModeFor(config: {
+    permissionMode?: string;
+    sandboxMode?: string;
+}): CursorMode;
+/**
+ * The exact value of the session's `mode` option for a Cursor mode, or null
+ * when the session does not offer it. The caller must refuse the turn on null
+ * for a read-only mode rather than run in whatever mode Cursor starts in.
+ */
+export declare function resolveCursorModeValue(mode: CursorMode, sessionResult: unknown): string | null;
+/**
+ * Is this whole assistant reply Cursor's plan-limit notice?
+ *
+ * Cursor does not report its account limit as an error. It sends the sentence
+ * "Upgrade your plan to continue" as the model's answer and ends the turn
+ * normally. Matched on the WHOLE reply only, so an answer that merely quotes
+ * the sentence is left alone.
+ */
+export declare function isCursorPlanLimitReply(text: string | undefined): boolean;
+/** Could this partial reply still grow into the plan-limit notice? */
+export declare function mayBecomeCursorPlanLimitReply(text: string | undefined): boolean;
+export declare const CURSOR_PLAN_LIMIT_ERROR: string;
+/** `error.message`, plus `error.data.message` when the agent sent one. */
+export declare function describeAcpRpcError(error: {
+    message?: unknown;
+    data?: unknown;
+}): string;
+export {};

package/dist/adapters/cursor-acp.js

@@ -0,0 +1,202 @@
+"use strict";
+/**
+ * What the runner has to know about Cursor's ACP agent (`cursor-agent acp`)
+ * that the generic ACP adapter does not: how a model is named on the wire,
+ * which Cursor mode a permission mode maps to, and how the account's plan
+ * limit shows up.
+ *
+ * Kept out of `acp-adapter.ts`, which is a copy of the 20x adapter, so the
+ * copy stays close to its source and these rules can be tested on their own.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CURSOR_PLAN_LIMIT_ERROR = void 0;
+exports.readAcpConfigOptions = readAcpConfigOptions;
+exports.resolveCursorModelValue = resolveCursorModelValue;
+exports.cursorModeFor = cursorModeFor;
+exports.resolveCursorModeValue = resolveCursorModeValue;
+exports.isCursorPlanLimitReply = isCursorPlanLimitReply;
+exports.mayBecomeCursorPlanLimitReply = mayBecomeCursorPlanLimitReply;
+exports.describeAcpRpcError = describeAcpRpcError;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function readOptionValues(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const values = [];
+    for (const entry of raw) {
+        if (!isRecord(entry))
+            continue;
+        // A grouped option list: `{ group, name, options: [...] }`.
+        if (Array.isArray(entry.options)) {
+            values.push(...readOptionValues(entry.options));
+            continue;
+        }
+        if (typeof entry.value !== 'string')
+            continue;
+        values.push({
+            value: entry.value,
+            name: typeof entry.name === 'string' ? entry.name : entry.value
+        });
+    }
+    return values;
+}
+/** The `configOptions` of a session result, in a shape that is safe to read. */
+function readAcpConfigOptions(sessionResult) {
+    if (!isRecord(sessionResult) || !Array.isArray(sessionResult.configOptions)) {
+        return [];
+    }
+    const options = [];
+    for (const entry of sessionResult.configOptions) {
+        if (!isRecord(entry) || typeof entry.id !== 'string')
+            continue;
+        options.push({ id: entry.id, values: readOptionValues(entry.options) });
+    }
+    return options;
+}
+function optionValues(sessionResult, id) {
+    return (readAcpConfigOptions(sessionResult).find((option) => option.id === id)
+        ?.values ?? []);
+}
+/** `composer-2.5[fast=true]` → `composer-2.5`. */
+function baseOf(value) {
+    const bracket = value.indexOf('[');
+    return (bracket >= 0 ? value.slice(0, bracket) : value).trim().toLowerCase();
+}
+/**
+ * The value to send in `session/set_config_option { configId: 'model' }` for
+ * the model an agent names, or null when the session offers nothing that
+ * matches — in which case nothing is sent and Cursor keeps its own default.
+ *
+ * WHY THIS IS NOT THE ID ITSELF. Cursor's ACP agent accepts only the values it
+ * lists in the session's own `model` option, and those carry parameters:
+ * `default[]` (shown as "Auto"), `composer-2.5[fast=true]`,
+ * `gpt-5.6-sol[context=272k,reasoning=medium,fast=false]`. The ids an agent
+ * holds come from `cursor-agent models` (`auto`, `composer-2.5`,
+ * `gpt-5.6-sol-medium`), which is a different list. Sending such an id gave
+ * `Failed to set model: Invalid params` on every turn, "Auto" included.
+ *
+ * Tried in order: the exact value, the option's display name, the part before
+ * `[`, then the longest such part the id starts with (`gpt-5.6-sol-medium`
+ * → `gpt-5.6-sol[…]`). `auto` is Cursor's `default`.
+ */
+function resolveCursorModelValue(model, sessionResult) {
+    const wanted = (model ?? '').trim().toLowerCase();
+    if (!wanted)
+        return null;
+    const values = optionValues(sessionResult, 'model');
+    if (values.length === 0)
+        return null;
+    const exact = values.find((entry) => entry.value.toLowerCase() === wanted);
+    if (exact)
+        return exact.value;
+    const byName = values.find((entry) => entry.name.trim().toLowerCase() === wanted);
+    if (byName)
+        return byName.value;
+    const wantedBase = wanted === 'auto' ? 'default' : baseOf(wanted);
+    const byBase = values.find((entry) => baseOf(entry.value) === wantedBase);
+    if (byBase)
+        return byBase.value;
+    let best = null;
+    for (const entry of values) {
+        const base = baseOf(entry.value);
+        if (!base || !wantedBase.startsWith(`${base}-`))
+            continue;
+        if (!best || base.length > best.base.length) {
+            best = { value: entry.value, base };
+        }
+    }
+    return best?.value ?? null;
+}
+/**
+ * The Cursor mode a turn must run in.
+ *
+ * FAIL CLOSED. In its `agent` mode Cursor asks only about commands that are
+ * not on the allow-list in the runner owner's `~/.cursor/cli-config.json`
+ * (seen: "Not in allowlist: cat, echo"). The runner must not read or change
+ * that list, so it cannot know which actions Cursor will run unasked, and a
+ * permission mode that promises a question before EACH action cannot be
+ * promised for Cursor. Every asking mode therefore runs
+ * Cursor in one of its own read-only modes — stricter than what was asked for,
+ * never looser:
+ *
+ *   plan                       → Cursor `plan` (reads and proposes a plan)
+ *   default, acceptEdits       → Cursor `ask`  (reads and answers, no changes)
+ *   bypassPermissions          → Cursor `agent` (the only mode that may act)
+ *
+ * A permission request Cursor does raise is still put to the person.
+ */
+function cursorModeFor(config) {
+    // Only an explicit "allow" may act. An unknown value is treated as asking.
+    if (config.permissionMode === 'allow')
+        return 'agent';
+    return config.sandboxMode === 'read-only' ? 'plan' : 'ask';
+}
+/**
+ * The exact value of the session's `mode` option for a Cursor mode, or null
+ * when the session does not offer it. The caller must refuse the turn on null
+ * for a read-only mode rather than run in whatever mode Cursor starts in.
+ */
+function resolveCursorModeValue(mode, sessionResult) {
+    const values = optionValues(sessionResult, 'mode');
+    const found = values.find((entry) => entry.value.toLowerCase() === mode);
+    if (found)
+        return found.value;
+    // Older agents list modes under `modes.availableModes` instead.
+    if (isRecord(sessionResult) && isRecord(sessionResult.modes)) {
+        const available = sessionResult.modes.availableModes;
+        if (Array.isArray(available)) {
+            for (const entry of available) {
+                if (isRecord(entry) &&
+                    typeof entry.id === 'string' &&
+                    entry.id.toLowerCase() === mode) {
+                    return entry.id;
+                }
+            }
+        }
+    }
+    return null;
+}
+const CURSOR_PLAN_LIMIT_TEXT = 'upgrade your plan to continue';
+function normalise(text) {
+    return text
+        .trim()
+        .replace(/[.!]+$/, '')
+        .replace(/\s+/g, ' ')
+        .toLowerCase();
+}
+/**
+ * Is this whole assistant reply Cursor's plan-limit notice?
+ *
+ * Cursor does not report its account limit as an error. It sends the sentence
+ * "Upgrade your plan to continue" as the model's answer and ends the turn
+ * normally. Matched on the WHOLE reply only, so an answer that merely quotes
+ * the sentence is left alone.
+ */
+function isCursorPlanLimitReply(text) {
+    return typeof text === 'string' && normalise(text) === CURSOR_PLAN_LIMIT_TEXT;
+}
+/** Could this partial reply still grow into the plan-limit notice? */
+function mayBecomeCursorPlanLimitReply(text) {
+    if (typeof text !== 'string')
+        return false;
+    const partial = normalise(text);
+    return partial.length > 0 && CURSOR_PLAN_LIMIT_TEXT.startsWith(partial);
+}
+exports.CURSOR_PLAN_LIMIT_ERROR = 'Cursor answered "Upgrade your plan to continue" and did no work. This ' +
+    'comes from the Cursor account that is signed in on the runner, not from ' +
+    'Peakflo: its plan does not include the selected model or has reached its ' +
+    'limit. Choose the "Auto" model for this agent, upgrade or change the ' +
+    'Cursor account on the runner machine, or choose another harness.';
+/** `error.message`, plus `error.data.message` when the agent sent one. */
+function describeAcpRpcError(error) {
+    const message = typeof error.message === 'string' ? error.message : 'ACP error';
+    const detail = isRecord(error.data) && typeof error.data.message === 'string'
+        ? error.data.message
+        : typeof error.data === 'string'
+            ? error.data
+            : '';
+    return detail && !message.includes(detail)
+        ? `${message}: ${detail}`
+        : message;
+}

package/dist/harness.js

@@ -1035,12 +1035,16 @@ class Harness {
                 blocked.set(harness.name, reason);
                 continue;
             }
+            /*
+             * NAME AND VERSION ONLY. The harness's models are already in
+             * `harnesses[]`, which is sent once and then by digest. Repeating them
+             * here put them back into every heartbeat: about 15 KB each time on a
+             * machine with Cursor's 200 models, seen on the first release candidate
+             * that had this.
+             */
             capabilities.backends.push({
                 name: harness.name,
-                version: harness.version ?? null,
-                ...(harness.models && harness.models.length > 0
-                    ? { models: harness.models.map(({ id, name }) => ({ id, name })) }
-                    : {})
+                version: harness.version ?? null
             });
         }
         return blocked;