@peakflo/agent-harness 0.2.9-rc.6 → 0.2.9-rc.7

package/README.md

@@ -126,6 +126,11 @@ An approval request says what will happen in its first line ("Run: npm test",
 Codex can send. "Deny" refuses the action and lets the turn go on, so the agent
 says that it was not allowed; the denied action never runs.
 
+A command too long for the card keeps its start and its end, and the card
+says it is not shown in full. A question Codex asks the person is shown as a
+question to answer in words, not as Allow / Deny. An MCP form that needs values
+is declined, because nobody can fill it in from the chat.
+
 Cursor reports an account limit as a normal reply ("Upgrade your plan to
 continue"). The runner turns a reply that is only that sentence into a failed
 turn that says it comes from the Cursor account on the runner.

package/dist/adapters/codex-app-server-adapter.d.ts

@@ -29,6 +29,11 @@ export declare function isStandingApprovalDecision(optionId: string): boolean;
  * any file change — is sent to the client as an approval request before it
  * runs. That is what "Ask before each action" says.
  */
+/**
+ * The fields an MCP form asks the person to fill in. Empty for a form with no
+ * fields, and for a request that is not a form (`mode: 'url'`).
+ */
+export declare function elicitationFormFields(params: Record<string, unknown>): string[];
 export declare function codexApprovalPolicy(config: Pick<SessionConfig, 'permissionMode'>): 'never' | 'untrusted';
 interface PendingApproval {
     requestId: string | number;
@@ -89,6 +94,19 @@ export declare class CodexAppServerAdapter implements CodingAgentAdapter {
     private setupStdoutParser;
     private handleRpcMessage;
     private handleServerRequest;
+    /**
+     * ADDED, not in 20x: `item/tool/requestUserInput` IS A QUESTION.
+     *
+     * It was shown as a permission card, and "Allow" sent the word "accept" to
+     * the model as the person's answer. It is now a question part, like the
+     * ones Pi asks: the person picks an option or types, and the answer goes
+     * back through `respondToQuestion` in the form this request takes
+     * (`{ answers: { <question id>: { answers: [text] } } }`). It is asked in
+     * every permission mode, bypass included: nobody can answer it but a person.
+     */
+    private handleUserInputRequest;
+    /** The answer to a question asked with `item/tool/requestUserInput`. */
+    respondToQuestion(sessionId: string, answers: Record<string, string>, _config?: SessionConfig, requestId?: string): Promise<boolean>;
     private handleNotification;
     private handleApprovalRequest;
     private buildApprovalResponse;

package/dist/adapters/codex-app-server-adapter.js

@@ -43,6 +43,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodexAppServerAdapter = void 0;
 exports.unwrapListedThreadItem = unwrapListedThreadItem;
 exports.isStandingApprovalDecision = isStandingApprovalDecision;
+exports.elicitationFormFields = elicitationFormFields;
 exports.codexApprovalPolicy = codexApprovalPolicy;
 /**
  * Extracted verbatim from 20x `src/main/adapters/codex-app-server-adapter.ts`.
@@ -106,6 +107,26 @@ function isStandingApprovalDecision(optionId) {
  * any file change — is sent to the client as an approval request before it
  * runs. That is what "Ask before each action" says.
  */
+/**
+ * The fields an MCP form asks the person to fill in. Empty for a form with no
+ * fields, and for a request that is not a form (`mode: 'url'`).
+ */
+function elicitationFormFields(params) {
+    // Only a request that says it is NOT a form is taken at its word. A missing
+    // or unknown mode is read from the schema it carries, like a form.
+    if (asString(params.mode) === 'url')
+        return [];
+    const schema = params.requestedSchema;
+    if (!isObject(schema)) {
+        // A form whose shape this build cannot read is treated as having fields.
+        return schema === undefined || schema === null ? [] : ['an unreadable form'];
+    }
+    const properties = isObject(schema.properties) ? Object.keys(schema.properties) : [];
+    const required = Array.isArray(schema.required)
+        ? schema.required.filter((name) => typeof name === 'string')
+        : [];
+    return [...new Set([...required, ...properties])];
+}
 function codexApprovalPolicy(config) {
     // `'allow'` is what `mapPermissionMode` makes of the agent's
     // `bypassPermissions` ("Don't ask for permission"), and of nothing else.
@@ -803,12 +824,113 @@ class CodexAppServerAdapter {
             this.handleApprovalRequest(session, request, params);
             return;
         }
-        if (request.method === 'mcpServer/elicitation/request' || request.method === 'item/tool/requestUserInput') {
+        if (request.method === 'item/tool/requestUserInput') {
+            this.handleUserInputRequest(session, request, params);
+            return;
+        }
+        if (request.method === 'mcpServer/elicitation/request') {
+            /*
+             * CHANGED from 20x: A FORM THAT NEEDS VALUES IS DECLINED, NOT "ALLOWED".
+             *
+             * An elicitation in form mode asks the person to fill in fields. This
+             * runner can relay a yes or a no, not field values, and "Allow" answered
+             * with an empty form. A form with fields is therefore declined at once,
+             * in every permission mode: the MCP server is told no, rather than
+             * being handed values nobody entered. A form with no fields is a plain
+             * confirmation (how an MCP tool call asks to run) and is still put to
+             * the person.
+             */
+            const fields = elicitationFormFields(params);
+            if (fields.length > 0) {
+                console.warn(`[CodexAppServerAdapter] Declining an MCP form from ${asString(params.serverName) || 'a server'}: ` +
+                    `it asks for ${fields.join(', ')}, which cannot be entered from here`);
+                this.sendRpcResponse(session, request.id, { action: 'decline' });
+                return;
+            }
             this.handleApprovalRequest(session, request, params);
             return;
         }
         this.sendRpcResponse(session, request.id, {});
     }
+    /**
+     * ADDED, not in 20x: `item/tool/requestUserInput` IS A QUESTION.
+     *
+     * It was shown as a permission card, and "Allow" sent the word "accept" to
+     * the model as the person's answer. It is now a question part, like the
+     * ones Pi asks: the person picks an option or types, and the answer goes
+     * back through `respondToQuestion` in the form this request takes
+     * (`{ answers: { <question id>: { answers: [text] } } }`). It is asked in
+     * every permission mode, bypass included: nobody can answer it but a person.
+     */
+    handleUserInputRequest(session, request, params) {
+        const asked = (Array.isArray(params.questions) ? params.questions : []).filter(isObject);
+        /*
+         * A SECRET IS NOT ASKED FOR IN THE CHAT. An answer typed here is stored in
+         * the transcript and shown to everyone who can read the chat; a question
+         * marked `isSecret` asks for something that must not be. The whole request
+         * is left unanswered instead.
+         */
+        if (asked.some((question) => question.isSecret === true)) {
+            console.warn('[CodexAppServerAdapter] Not asking a question marked secret; it is left unanswered');
+            this.sendRpcResponse(session, request.id, { answers: {} });
+            return;
+        }
+        // The card sends each answer back under its header, so headers are made
+        // unique here: two questions called the same would get one answer.
+        const usedHeaders = new Map();
+        const uniqueHeader = (wanted) => {
+            const count = (usedHeaders.get(wanted) ?? 0) + 1;
+            usedHeaders.set(wanted, count);
+            return count === 1 ? wanted : `${wanted} (${count})`;
+        };
+        const questions = asked
+            .map((question, index) => ({
+            id: asString(question.id) || `q${index + 1}`,
+            header: uniqueHeader(asString(question.header) || `Question ${index + 1}`),
+            question: asString(question.question) || '',
+            options: (Array.isArray(question.options) ? question.options : [])
+                .filter(isObject)
+                .map((option) => ({
+                label: asString(option.label) || '',
+                description: asString(option.description) || ''
+            }))
+                .filter((option) => option.label)
+        }));
+        if (questions.length === 0) {
+            // Nothing to ask. An empty answer set, never an invented one.
+            this.sendRpcResponse(session, request.id, { answers: {} });
+            return;
+        }
+        // An earlier question that was never answered gets no answer.
+        if (session.pendingQuestion) {
+            this.sendRpcResponse(session, session.pendingQuestion.requestId, { answers: {} });
+        }
+        const partId = `codex-question-${asString(params.itemId) || String(request.id)}`;
+        session.pendingQuestion = { requestId: request.id, partId, questions };
+        session.status = coding_agent_adapter_1.SessionStatusType.WAITING_APPROVAL;
+        this.addEvent(session, { method: 'pf/question', params: { partId, questions } });
+    }
+    /** The answer to a question asked with `item/tool/requestUserInput`. */
+    async respondToQuestion(sessionId, answers, _config, requestId) {
+        const session = this.sessions.get(sessionId);
+        const pending = session?.pendingQuestion;
+        if (!session || !pending)
+            return false;
+        if (requestId && requestId !== pending.partId)
+            return false;
+        // The card sends `Header: answer` per question, or one bare answer.
+        const result = {};
+        for (const question of pending.questions) {
+            const answer = (answers[question.header] ??
+                (pending.questions.length === 1 ? answers.answer : undefined) ??
+                '').trim();
+            result[question.id] = { answers: answer ? [answer] : [] };
+        }
+        this.sendRpcResponse(session, pending.requestId, { answers: result });
+        session.pendingQuestion = null;
+        session.status = coding_agent_adapter_1.SessionStatusType.BUSY;
+        return true;
+    }
     handleNotification(session, notification) {
         const params = isObject(notification.params) ? notification.params : {};
         if (notification.method === 'thread/status/changed') {
@@ -822,6 +944,9 @@ class CodexAppServerAdapter {
         }
         if (notification.method === 'turn/completed') {
             session.activeTurnId = null;
+            // The turn is over, so a question it asked can no longer be answered:
+            // the request is gone on Codex's side. A late answer finds nothing.
+            session.pendingQuestion = null;
             if (session.threadId) {
                 session.pendingCompletionRefreshes += 1;
                 void this.reconcileCompletedTurn(session);
@@ -853,6 +978,13 @@ class CodexAppServerAdapter {
         }
         if (notification.method === 'serverRequest/resolved') {
             const requestId = params.requestId;
+            // Codex settled the question itself (the turn was interrupted).
+            if (session.pendingQuestion && String(session.pendingQuestion.requestId) === String(requestId)) {
+                session.pendingQuestion = null;
+                if (session.status === coding_agent_adapter_1.SessionStatusType.WAITING_APPROVAL) {
+                    session.status = coding_agent_adapter_1.SessionStatusType.BUSY;
+                }
+            }
             if (session.pendingApproval && String(session.pendingApproval.requestId) === String(requestId)) {
                 session.pendingApproval = null;
                 if (session.status === coding_agent_adapter_1.SessionStatusType.WAITING_APPROVAL) {
@@ -1184,6 +1316,29 @@ class CodexAppServerAdapter {
         if ((method === 'item/started' || method === 'item/completed') && item) {
             return this.convertThreadItem(method, item, params, seenMessageIds, seenPartIds, partContentLengths, session);
         }
+        if (method === 'pf/question') {
+            const partId = asString(params.partId) || 'codex-question';
+            if (seenPartIds.has(partId))
+                return [];
+            seenPartIds.add(partId);
+            const questions = Array.isArray(params.questions) ? params.questions.filter(isObject) : [];
+            return [{
+                    id: partId,
+                    type: coding_agent_adapter_1.MessagePartType.QUESTION,
+                    role: coding_agent_adapter_1.MessageRole.ASSISTANT,
+                    text: questions.map((question) => asString(question.question) || '').join('\n'),
+                    tool: {
+                        name: 'question',
+                        status: 'running',
+                        title: asString(questions[0]?.header) || 'Question',
+                        questions: questions.map((question) => ({
+                            header: question.header,
+                            question: question.question,
+                            options: question.options
+                        }))
+                    }
+                }];
+        }
         if (method === 'error') {
             const partId = `error-${Date.now()}`;
             return [{

package/dist/adapters/codex-approval-text.d.ts

@@ -21,6 +21,10 @@
  * Kept out of the adapter, which is a copy of 20x's, so it can be tested alone.
  */
 type Json = Record<string, unknown>;
+/** The longest command shown whole. Longer ones keep both ends. */
+export declare const MAX_SHOWN_COMMAND = 2000;
+/** The longest reason, message or question shown whole. */
+export declare const MAX_SHOWN_NOTE = 500;
 interface FileChange {
     path: string;
     kind: string;

package/dist/adapters/codex-approval-text.js

@@ -22,6 +22,7 @@
  * Kept out of the adapter, which is a copy of 20x's, so it can be tested alone.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_SHOWN_NOTE = exports.MAX_SHOWN_COMMAND = void 0;
 exports.readFileChanges = readFileChanges;
 exports.describeCodexApproval = describeCodexApproval;
 function isRecord(value) {
@@ -35,11 +36,49 @@ function oneLine(value) {
     return value.replace(/\s*\n\s*/g, ' ⏎ ').trim();
 }
 const MAX_LISTED_PATHS = 12;
+/** The longest command shown whole. Longer ones keep both ends. */
+exports.MAX_SHOWN_COMMAND = 2000;
+const COMMAND_HEAD = 1500;
+const COMMAND_TAIL = 300;
+/** The longest reason, message or question shown whole. */
+exports.MAX_SHOWN_NOTE = 500;
+/**
+ * A command that is too long for a card keeps its start, where the program
+ * and its first arguments are, and its end, where a redirect or a second
+ * command would be, and says how much is missing. The card then also says, on
+ * a line of its own, that this is not the whole command: a person must never
+ * approve a shortened command believing they have read it.
+ */
+function shownCommand(command) {
+    const line = oneLine(command);
+    if (line.length <= exports.MAX_SHOWN_COMMAND)
+        return { text: line, hidden: 0 };
+    const hidden = line.length - COMMAND_HEAD - COMMAND_TAIL;
+    return {
+        text: `${line.slice(0, COMMAND_HEAD)} … [${hidden} characters not shown] … ${line.slice(-COMMAND_TAIL)}`,
+        hidden
+    };
+}
+function notShownInFull(command) {
+    return (`Not shown in full: this command is ${oneLine(command).length} characters ` +
+        'long. Deny it unless you know what it runs.');
+}
+/** Words about the request (why, what a server says), not what will run. */
+function note(value) {
+    const line = oneLine(value);
+    return line.length <= exports.MAX_SHOWN_NOTE
+        ? line
+        : `${line.slice(0, exports.MAX_SHOWN_NOTE)} … (shortened, ${line.length - exports.MAX_SHOWN_NOTE} more characters)`;
+}
 /** `/work/space/src/a.ts` in `/work/space` → `src/a.ts`. Others unchanged. */
 function relativeTo(workspaceDir, path) {
     const root = (workspaceDir ?? '').replace(/\/+$/, '');
     if (!root)
         return path;
+    // A path that climbs (`/work/space/../../etc/passwd`) is not inside the
+    // workspace whatever it starts with. Shown as it is.
+    if (/(^|\/)\.\.?(\/|$)/.test(path.replace(/\/\.$/, '')))
+        return path;
     // macOS reports the same directory as /tmp/… and /private/tmp/….
     for (const prefix of [
         root,
@@ -161,11 +200,14 @@ function describeFileChanges(changes) {
  * literally what the shell will be given.
  */
 function unwrapShell(command) {
-    const match = /^(?:\/(?:usr\/)?bin\/)?(?:zsh|bash|sh) -l?c (['"])([\s\S]*)\1$/.exec(command.trim());
+    // SINGLE quotes only: inside them the shell changes nothing, so the inner
+    // text is exactly the command. Inside double quotes it would still expand
+    // `$(…)`, backticks and variables, and the card would not show what runs.
+    const match = /^(?:\/(?:usr\/)?bin\/)?(?:zsh|bash|sh) -l?c '([\s\S]*)'$/.exec(command.trim());
     if (!match)
         return command;
-    const [, quote, inner] = match;
-    return inner.includes(quote) || inner.includes('\\') ? command : inner;
+    const inner = match[1];
+    return inner.includes("'") ? command : inner;
 }
 function commandText(value) {
     if (Array.isArray(value)) {
@@ -239,11 +281,18 @@ workspaceDir) {
         const network = isRecord(params.networkApprovalContext)
             ? params.networkApprovalContext
             : null;
+        const capped = shownCommand(command);
         if (params.kind === 'writeStdin') {
-            lines.push(`Send input to a running command: ${oneLine(command)}`);
+            lines.push(`Send input to a running command: ${capped.text}`);
+            if (capped.hidden)
+                lines.push(notShownInFull(command));
         }
         else if (command) {
-            lines.push(`Run: ${oneLine(command)}`);
+            lines.push(`Run: ${capped.text}`);
+            // Straight under the command, before anything else that could push it
+            // out of sight.
+            if (capped.hidden)
+                lines.push(notShownInFull(command));
         }
         else if (network) {
             lines.push(`Network access: ${text(network.host)}`);
@@ -284,7 +333,7 @@ workspaceDir) {
         const server = text(params.serverName) || 'An MCP server';
         const message = text(params.message);
         lines.push(message
-            ? `${server} asks: ${oneLine(message)}`
+            ? `${server} asks: ${note(message)}`
             : `${server} asks to continue`);
         const url = text(params.url);
         if (url)
@@ -295,20 +344,23 @@ workspaceDir) {
         const question = isRecord(first)
             ? text(first.question) || text(first.header)
             : '';
-        lines.push(question ? `Codex asks: ${oneLine(question)}` : 'Codex asks a question');
+        lines.push(question ? `Codex asks: ${note(question)}` : 'Codex asks a question');
     }
     else {
         // A kind this build does not know. Say what is asked in plain words and
         // show what the request itself says about it, never the method name alone.
         const command = commandText(params.command);
         lines.push(`Codex asks to approve: ${humanise(method)}`);
-        if (command)
-            lines.push(`Command: ${oneLine(command)}`);
+        if (command) {
+            lines.push(`Command: ${shownCommand(command).text}`);
+            if (shownCommand(command).hidden)
+                lines.push(notShownInFull(command));
+        }
         const cwd = text(params.cwd);
         if (cwd)
             lines.push(`In: ${cwd}`);
     }
     if (reason)
-        lines.push(`Reason: ${oneLine(reason)}`);
+        lines.push(`Reason: ${note(reason)}`);
     return lines.join('\n');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peakflo/agent-harness",
-  "version": "0.2.9-rc.6",
+  "version": "0.2.9-rc.7",
   "description": "Headless Peakflo coding-agent harness. One codebase, three hosting modes: a Daytona cloud sandbox, a customer VM, and the 20x desktop.",
   "license": "MIT",
   "type": "commonjs",