@peakflo/agent-harness 0.2.9 → 0.2.10-rc.2

package/dist/adapters/pi-adapter.js

@@ -21,6 +21,7 @@ const string_decoder_1 = require("string_decoder");
 const util_1 = require("util");
 const coding_agent_adapter_1 = require("./coding-agent-adapter");
 const model_gateway_1 = require("./model-gateway");
+const vendor_environment_1 = require("./vendor-environment");
 const cold_start_steps_1 = require("../runtime/cold-start-steps");
 const dev_server_guard_1 = require("../runtime/dev-server-guard");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
@@ -66,6 +67,7 @@ function findPiNodeRuntime(platform, electronExecutable, pathExists = fs_1.exist
  */
 exports.PI_MCP_SERVER_ALIASES = {
     '[Workflo] Organisation Workspace': 'workflo',
+    '[Spaces] Organisation Workspace': 'workflo',
     '[Workflo] MCP Dev Server': 'workflo-dev'
 };
 function slugifyPiName(value, maxLength) {
@@ -428,6 +430,7 @@ class PiAdapter {
         // precedence over its config, which would undo `directTools: false` and
         // recreate overlong provider-facing names.
         delete env.MCP_DIRECT_TOOLS;
+        env.GIT_SSH_COMMAND = vendor_environment_1.DISABLED_GIT_SSH_COMMAND;
         return env;
     }
     buildSkillFiles(config) {

package/dist/adapters/vendor-environment.d.ts

@@ -0,0 +1,12 @@
+import type { SessionConfig } from './coding-agent-adapter';
+export declare function allowedVendorSecretKey(key: string): boolean;
+/** Remove folders for vendor sessions that have not been used for 90 days. */
+export declare function sweepVendorConfigDirs(now?: number): number;
+export declare function vendorConfigDir(kind: 'claude' | 'codex' | 'cursor', config: SessionConfig, sourceDir: string, authFiles: readonly string[]): string;
+/** Keep Claude API-key turns away from a subscription credential link. */
+export declare function claudeVendorConfigDir(config: SessionConfig): string;
+/** The isolated Codex home can use only the owner's file-based login. */
+export declare function codexVendorConfigDir(config: SessionConfig, useApiKey: boolean): string;
+export declare function isolateVendorHome(env: NodeJS.ProcessEnv, directory: string): void;
+export declare const DISABLED_GIT_SSH_COMMAND: string;
+export declare function vendorEnvironment(config: SessionConfig, auth?: Record<string, string | undefined>): NodeJS.ProcessEnv;

package/dist/adapters/vendor-environment.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DISABLED_GIT_SSH_COMMAND = void 0;
+exports.allowedVendorSecretKey = allowedVendorSecretKey;
+exports.sweepVendorConfigDirs = sweepVendorConfigDirs;
+exports.vendorConfigDir = vendorConfigDir;
+exports.claudeVendorConfigDir = claudeVendorConfigDir;
+exports.codexVendorConfigDir = codexVendorConfigDir;
+exports.isolateVendorHome = isolateVendorHome;
+exports.vendorEnvironment = vendorEnvironment;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+// A vendor CLI runs commands on behalf of the agent. Do not give it the
+// runner's control-plane credentials or the owner's GitHub login.
+const HOST_KEYS = [
+    'PATH',
+    'USER',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'SHELL',
+    'LANG',
+    'LC_ALL',
+    'LC_CTYPE',
+    'TERM',
+    'SYSTEMROOT',
+    'WINDIR',
+    'COMSPEC',
+    'PATHEXT'
+];
+const SESSION_KEYS = [
+    'HTTPS_PROXY',
+    'https_proxy',
+    'NO_PROXY',
+    'no_proxy',
+    'SSL_CERT_FILE',
+    'GIT_SSL_CAINFO',
+    'CURL_CA_BUNDLE',
+    'NODE_EXTRA_CA_CERTS',
+    'GH_TOKEN',
+    'GH_CONFIG_DIR'
+];
+const FORBIDDEN = /^(?:PF_|PEAKFLO_|GH_|GIT_|GITHUB_TOKEN$|SSH_|HOME$|USERPROFILE$|CODEX_HOME$|CLAUDE_CONFIG_DIR$|CLAUDE_SECURESTORAGE_CONFIG_DIR$|XDG_CONFIG_HOME$|APPDATA$|LOCALAPPDATA$|PATH$|HTTPS?_PROXY$|NO_PROXY$|SSL_CERT_FILE$|CURL_CA_BUNDLE$|NODE_EXTRA_CA_CERTS$|NODE_OPTIONS$|LD_PRELOAD$|DYLD_)/i;
+function allowedVendorSecretKey(key) {
+    return !FORBIDDEN.test(key);
+}
+// Persist across harness restarts so native vendor sessions can resume.
+// Each runner OS account owns this directory; it is not under the worktree.
+const configRoot = process.env.NODE_ENV === 'test'
+    ? (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'pf-vendor-config-test-'))
+    : (0, node_path_1.join)((0, node_os_1.homedir)(), '.pf-agent-harness', 'vendor-config');
+if (process.env.NODE_ENV === 'test') {
+    process.once('exit', () => (0, node_fs_1.rmSync)(configRoot, { recursive: true, force: true }));
+}
+const VENDOR_CONFIG_MAX_AGE_MS = 90 * 24 * 60 * 60 * 1000;
+/** Remove folders for vendor sessions that have not been used for 90 days. */
+function sweepVendorConfigDirs(now = Date.now()) {
+    if (!(0, node_fs_1.existsSync)(configRoot) || !(0, node_fs_1.lstatSync)(configRoot).isDirectory())
+        return 0;
+    let removed = 0;
+    for (const kind of ['claude', 'codex', 'cursor']) {
+        const kindRoot = (0, node_path_1.join)(configRoot, kind);
+        if (!(0, node_fs_1.existsSync)(kindRoot) || !(0, node_fs_1.lstatSync)(kindRoot).isDirectory())
+            continue;
+        for (const entry of (0, node_fs_1.readdirSync)(kindRoot, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const taskRoot = (0, node_path_1.join)(kindRoot, entry.name);
+            if ((0, node_fs_1.lstatSync)(taskRoot).mtimeMs >= now - VENDOR_CONFIG_MAX_AGE_MS)
+                continue;
+            (0, node_fs_1.rmSync)(taskRoot, { recursive: true, force: true });
+            removed++;
+        }
+    }
+    return removed;
+}
+function vendorConfigDir(kind, config, sourceDir, authFiles) {
+    const directory = (0, node_path_1.join)(configRoot, kind, config.taskId.replace(/[^a-zA-Z0-9_-]/g, '_'));
+    (0, node_fs_1.mkdirSync)(configRoot, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(configRoot, 0o700);
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(directory, 0o700);
+    for (const name of authFiles) {
+        const source = (0, node_path_1.resolve)(sourceDir, name);
+        const target = (0, node_path_1.join)(directory, name);
+        if ((0, node_fs_1.existsSync)(source)) {
+            // Codex CLI 0.163.0 opens auth.json with truncate(true) and writes
+            // through this link. A copy would diverge when Codex refreshes login.
+            try {
+                if ((0, node_fs_1.lstatSync)(target).isSymbolicLink() &&
+                    (0, node_fs_1.readlinkSync)(target) === source)
+                    continue;
+                (0, node_fs_1.unlinkSync)(target);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+            (0, node_fs_1.symlinkSync)(source, target);
+        }
+    }
+    (0, node_fs_1.utimesSync)(directory, new Date(), new Date());
+    return directory;
+}
+/** Keep Claude API-key turns away from a subscription credential link. */
+function claudeVendorConfigDir(config) {
+    if (config.authMethod === 'api_key')
+        return vendorConfigDir('claude', { ...config, taskId: `${config.taskId}-api-key` }, '', []);
+    const ownerDir = (0, node_path_1.resolve)(process.env.CLAUDE_CONFIG_DIR || (0, node_path_1.join)((0, node_os_1.homedir)(), '.claude'));
+    return vendorConfigDir('claude', config, process.platform === 'linux' ? ownerDir : '', process.platform === 'linux' ? ['.credentials.json'] : []);
+}
+/** The isolated Codex home can use only the owner's file-based login. */
+function codexVendorConfigDir(config, useApiKey) {
+    if (useApiKey)
+        return vendorConfigDir('codex', { ...config, taskId: `${config.taskId}-api-key` }, '', []);
+    const ownerDir = (0, node_path_1.resolve)(process.env.CODEX_HOME || (0, node_path_1.join)((0, node_os_1.homedir)(), '.codex'));
+    const configFile = (0, node_path_1.join)(ownerDir, 'config.toml');
+    if ((0, node_fs_1.existsSync)(configFile)) {
+        const contents = (0, node_fs_1.readFileSync)(configFile, 'utf8');
+        // cli_auth_credentials_store is a top-level TOML key. A key below a
+        // table heading is not the CLI auth store setting.
+        for (const line of contents.split(/\r?\n/)) {
+            const trimmed = line.trim();
+            if (trimmed.startsWith('['))
+                break;
+            const assignment = trimmed.match(/^cli_auth_credentials_store\s*=\s*(.*)$/);
+            if (!assignment)
+                continue;
+            const mode = assignment[1].match(/^['"]([a-z]+)['"](?:\s*(?:#.*)?)?$/)?.[1];
+            if (mode !== 'file') {
+                throw new Error(`Codex subscription login uses cli_auth_credentials_store=${mode ?? 'unknown'}. ` +
+                    'The runner supports file login only. Set cli_auth_credentials_store="file" and run codex login, or use an API key.');
+            }
+        }
+    }
+    if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(ownerDir, 'auth.json'))) {
+        throw new Error('Codex file login was not found. Run codex login with cli_auth_credentials_store="file", or use an API key. Keyring and auto login cannot be shared with an isolated CODEX_HOME.');
+    }
+    return vendorConfigDir('codex', config, ownerDir, ['auth.json']);
+}
+function isolateVendorHome(env, directory) {
+    env.HOME = directory;
+    env.USERPROFILE = directory;
+    env.XDG_CONFIG_HOME = directory;
+    env.APPDATA = directory;
+    env.LOCALAPPDATA = directory;
+}
+exports.DISABLED_GIT_SSH_COMMAND = `ssh -F ${process.platform === 'win32' ? 'NUL' : '/dev/null'} -o IdentitiesOnly=yes -o IdentityFile=${process.platform === 'win32' ? 'NUL' : '/dev/null'} -o IdentityAgent=none`;
+function vendorEnvironment(config, auth = {}) {
+    const env = {};
+    for (const key of HOST_KEYS) {
+        if (process.env[key])
+            env[key] = process.env[key];
+    }
+    for (const key of SESSION_KEYS) {
+        if (config.environment?.[key])
+            env[key] = config.environment[key];
+    }
+    // A missing guard environment must never select the owner's gh login.
+    if (!env.GH_CONFIG_DIR) {
+        env.GH_CONFIG_DIR = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'pf-vendor-gh-'));
+    }
+    else {
+        (0, node_fs_1.mkdirSync)(env.GH_CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+    for (const [key, value] of Object.entries(config.secretEnvVars ?? {})) {
+        if (allowedVendorSecretKey(key))
+            env[key] = value;
+    }
+    for (const [key, value] of Object.entries(auth)) {
+        if (value && allowedVendorSecretKey(key))
+            env[key] = value;
+    }
+    env.GIT_CONFIG_GLOBAL = process.platform === 'win32' ? 'NUL' : '/dev/null';
+    env.GIT_CONFIG_NOSYSTEM = '1';
+    env.GIT_TERMINAL_PROMPT = '0';
+    env.GIT_SSH_COMMAND = exports.DISABLED_GIT_SSH_COMMAND;
+    // A non-repository turn can still create a local Git repository and commit.
+    // Keep the identity independent of the owner's global Git configuration.
+    env.GIT_AUTHOR_NAME = 'Peakflo Agent';
+    env.GIT_AUTHOR_EMAIL = 'agent@peakflo.bot';
+    env.GIT_COMMITTER_NAME = 'Peakflo Agent';
+    env.GIT_COMMITTER_EMAIL = 'agent@peakflo.bot';
+    return env;
+}

package/dist/cli.js

@@ -40,12 +40,17 @@ const credential_store_1 = require("./credential-store");
 const harness_1 = require("./harness");
 const node_floor_1 = require("./node-floor");
 const options_1 = require("./options");
+const service_1 = require("./service");
 const version_1 = require("./version");
 const USAGE = `pf-agent-harness — headless Peakflo coding-agent harness
 
 Usage:
   pf-agent-harness start [options]
   pf-agent-harness version
+  pf-agent-harness service install [start options]
+  pf-agent-harness service status
+  pf-agent-harness service repair
+  pf-agent-harness service uninstall
 
 Options:
   --control-plane <url>         workflow-api base url (env PF_CONTROL_PLANE_URL)
@@ -76,6 +81,8 @@ Options:
   --max-sessions <n>            concurrent sessions   (env PF_MAX_CONCURRENT_SESSIONS,
                                 default 10 for desktop/self-hosted; sandbox is configured by control plane)
   --labels <a,b>                routing labels        (env PF_RUNNER_LABELS)
+  --vendor-harnesses <list>     allow codex,claude-code,cursor on this machine
+                                (env PF_VENDOR_HARNESSES; default none)
   --no-harness-discovery        do not look for Codex, Claude Code, Cursor,
                                 Pi and OpenCode on this machine, and report
                                 none (env PF_HARNESS_DISCOVERY=0). On by
@@ -88,6 +95,19 @@ PF_ALLOW_UNSUPPORTED_NODE=1 starts anyway, at your own risk.
 In a managed sandbox pf-bootstrap supplies these through the environment, so
 the enrolment token never appears in /proc/<pid>/cmdline.
 `;
+const serviceStart = (0, service_1.isServiceStart)(process.argv.slice(2));
+function stopPermanentServiceFailure(reason, linuxCode) {
+    try {
+        (0, service_1.recordServiceFailure)(reason);
+    }
+    catch {
+        /* exit even if the disk is full */
+    }
+    process.stderr.write(`Service stopped: ${reason}.\n`);
+    // launchd can prevent a restart on a successful exit. systemd uses
+    // RestartPreventExitStatus for the two permanent error codes.
+    process.exit((0, service_1.permanentServiceExitCode)(process.platform, linuxCode));
+}
 /**
  * Read `--flag value` from argv. A tiny duplicate of the reader in options.ts,
  * because the login decision has to be made BEFORE `parseOptions` runs — that
@@ -122,6 +142,14 @@ async function main() {
         })}\n`);
         return;
     }
+    if (command === 'service') {
+        await (0, service_1.runServiceCommand)(argv.slice(1), {
+            nodePath: process.execPath,
+            cliPath: __filename,
+            env: process.env
+        });
+        return;
+    }
     if (command !== 'start') {
         process.stderr.write(`Unknown command: ${command}\n\n${USAGE}`);
         process.exitCode = 2;
@@ -141,6 +169,8 @@ async function main() {
         env: process.env
     });
     if (nodeFloor.action === 'refuse') {
+        if (serviceStart)
+            throw new options_1.OptionsError(nodeFloor.message);
         process.stderr.write(`${nodeFloor.message}\n`);
         process.exit(1);
     }
@@ -165,7 +195,7 @@ async function main() {
     // `--token=x` counts as a token, hence readOptionValue rather than indexOf.
     const hasToken = Boolean(readOptionValue(startArgs, 'token') ?? process.env.PF_ENROLMENT_TOKEN);
     const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-    if (!hasToken && (wantsLogin || interactive)) {
+    if (!serviceStart && !hasToken && (wantsLogin || interactive)) {
         const { enrolViaBrowser } = await Promise.resolve().then(() => __importStar(require('./enrol/browser-enrol')));
         const token = await enrolViaBrowser({
             controlPlaneUrl: readOptionValue(startArgs, 'control-plane') ??
@@ -182,6 +212,11 @@ async function main() {
         process.env.PF_ENROLMENT_TOKEN = token;
     }
     const options = (0, options_1.parseOptions)(startArgs, process.env);
+    new service_1.ServiceManager({
+        nodePath: process.execPath,
+        cliPath: __filename,
+        env: process.env
+    }).assertNoDuplicateRunner(options);
     const handedOffCredential = (0, credential_store_1.takeHandedOffCredential)(process.env);
     const resolveAdapter = (0, adapter_resolver_1.createAdapterResolver)(options.runtime, options.workspaceRoot);
     const harness = new harness_1.Harness(options, {
@@ -207,6 +242,8 @@ async function main() {
     process.on('SIGTERM', () => shutdown('SIGTERM'));
     process.on('SIGINT', () => shutdown('SIGINT'));
     await harness.start();
+    if (serviceStart)
+        (0, service_1.clearServiceFailure)();
     // BLOCK ON THE LEASE LOOP, and let it decide when the process is done.
     //
     // The Phase 0 skeleton relied on the health socket keeping the event loop
@@ -216,9 +253,13 @@ async function main() {
     // build, so the exit code carries the reason.
     try {
         await harness.wait();
+        if (serviceStart && process.platform === 'darwin')
+            process.exit(75);
     }
     catch (error) {
         if (error instanceof harness_1.UpgradeRequestedError) {
+            if (serviceStart)
+                stopPermanentServiceFailure('harness upgrade required', 78);
             process.exit(contract_1.HARNESS_UPGRADE_EXIT_CODE);
         }
         throw error;
@@ -231,9 +272,22 @@ main().catch((error) => {
     // ever. A sandbox that hangs is worse than one that dies: the control plane
     // cannot recycle it, so the version gate would never take effect.
     if (error instanceof options_1.OptionsError) {
+        if (serviceStart)
+            stopPermanentServiceFailure('invalid service options', 2);
         process.stderr.write(`${error.message}\n\n${USAGE}`);
         process.exit(2);
     }
+    if (serviceStart && error instanceof harness_1.StoredCredentialUnavailableError) {
+        stopPermanentServiceFailure('runner credential unavailable', 78);
+    }
+    if (serviceStart && error instanceof harness_1.VersionRefusedError) {
+        stopPermanentServiceFailure('harness version or protocol refused', 78);
+    }
+    if (serviceStart) {
+        const reason = (0, service_1.permanentStartupFailure)(error);
+        if (reason)
+            stopPermanentServiceFailure(reason, 78);
+    }
     const message = error instanceof Error ? error.stack : String(error);
     process.stderr.write(`pf-agent-harness failed to start:\n${message}\n`);
     process.exit(1);

package/dist/github-command-guards.js

@@ -7,6 +7,7 @@ exports.installPushGuard = installPushGuard;
 const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = require("node:path");
+const vendor_environment_1 = require("./adapters/vendor-environment");
 exports.MERGE_REFUSAL = 'GitHub merge refused: agents may open pull requests but must not merge them.';
 let guardPathState;
 let guardPathQueue = Promise.resolve();
@@ -59,6 +60,9 @@ for (const key of Object.keys(gitEnv)) {
   if (key.startsWith('GH_') && !['GH_TOKEN', 'GH_CONFIG_DIR'].includes(key)) delete gitEnv[key];
 }
 gitEnv.GIT_TERMINAL_PROMPT = '0';
+gitEnv.GIT_CONFIG_GLOBAL = process.platform === 'win32' ? 'NUL' : '/dev/null';
+gitEnv.GIT_CONFIG_NOSYSTEM = '1';
+gitEnv.GIT_SSH_COMMAND = ${JSON.stringify(vendor_environment_1.DISABLED_GIT_SSH_COMMAND)};
 // The wrapper deliberately removes caller-controlled GIT_* overrides, but
 // Git's libcurl requires GIT_SSL_CAINFO to trust the harness TLS proxy. Pin it
 // to the harness-owned bundle instead of accepting the caller's value.
@@ -152,6 +156,7 @@ for (const key of Object.keys(cleanEnv)) {
   if (key.startsWith('GH_') && !['GH_TOKEN', 'GH_CONFIG_DIR'].includes(key)) delete cleanEnv[key];
 }
 cleanEnv.GIT_TERMINAL_PROMPT = '0';
+cleanEnv.GIT_SSH_COMMAND = ${JSON.stringify(vendor_environment_1.DISABLED_GIT_SSH_COMMAND)};
 // Inspect all args, including endpoint=... and flags before the subcommand.
 const decodedArgs = args.map(arg => {
   try { return decodeURIComponent(arg); } catch { return arg; }

package/dist/github-workspace.js

@@ -8,6 +8,7 @@ const promises_1 = require("node:fs/promises");
 const node_http_1 = require("node:http");
 const node_path_1 = require("node:path");
 const node_util_1 = require("node:util");
+const vendor_environment_1 = require("./adapters/vendor-environment");
 const github_command_guards_1 = require("./github-command-guards");
 const github_proxy_1 = require("./github-proxy");
 const github_proxy_certificates_1 = require("./github-proxy-certificates");
@@ -393,6 +394,31 @@ class GitHubWorkspaceProvider {
             await this.runGit(['config', '--worktree', 'core.hooksPath', hooks], {
                 cwd: worktree
             });
+            // A direct /usr/bin/git call also uses this worktree configuration.
+            // Rewrite GitHub SSH addresses before transport selection and disable
+            // owner SSH keys for any address that is not rewritten.
+            await this.runGit([
+                'config',
+                '--worktree',
+                '--unset-all',
+                'url.https://github.com/.insteadOf'
+            ], {
+                cwd: worktree
+            }).catch(() => undefined);
+            for (const sshPrefix of ['git@github.com:', 'ssh://git@github.com/']) {
+                await this.runGit([
+                    'config',
+                    '--worktree',
+                    '--add',
+                    'url.https://github.com/.insteadOf',
+                    sshPrefix
+                ], {
+                    cwd: worktree
+                });
+            }
+            await this.runGit(['config', '--worktree', 'core.sshCommand', vendor_environment_1.DISABLED_GIT_SSH_COMMAND], { cwd: worktree });
+            await this.runGit(['config', '--worktree', 'user.name', 'Peakflo Agent'], { cwd: worktree });
+            await this.runGit(['config', '--worktree', 'user.email', 'agent@peakflo.bot'], { cwd: worktree });
             request.onRepositoryStatus?.({
                 fullName: repository.fullName,
                 status: 'checkedOut'
@@ -412,7 +438,7 @@ class GitHubWorkspaceProvider {
             '# GitHub repository access',
             '',
             'Each repository is a child directory. Commit and push only the agent/<session-id> branch.',
-            'GitHub is reachable through a local proxy; use gh and git as usual. The token in GH_TOKEN is a session sentinel that works only inside this sandbox. Merges and pushes outside agent/<session-id> are refused.',
+            'GitHub access uses the session proxy. Use gh and git only in this session worktree. GH_TOKEN is a session sentinel, not a GitHub token. Merges and pushes outside agent/<session-id> are refused.',
             ''
         ].join('\n');
         await (0, promises_1.writeFile)((0, node_path_1.join)(sessionRoot, 'AGENTS.md'), instructions, {
@@ -443,7 +469,8 @@ class GitHubWorkspaceProvider {
             CURL_CA_BUNDLE: this.caCertificatePath,
             NODE_EXTRA_CA_CERTS: this.caCertificatePath,
             GH_TOKEN: session.sentinel,
-            GH_CONFIG_DIR: (0, node_path_1.join)(this.sessionPath(sessionId), '.gh')
+            GH_CONFIG_DIR: (0, node_path_1.join)(this.sessionPath(sessionId), '.gh'),
+            GIT_SSH_COMMAND: vendor_environment_1.DISABLED_GIT_SSH_COMMAND
         };
     }
     takeTurnNote(sessionId) {
@@ -454,7 +481,7 @@ class GitHubWorkspaceProvider {
         this.restartNotedSessions.add(sessionId);
         const restored = this.restoredWorktreeNotes.get(sessionId);
         return [
-            'Harness restarted; GitHub access is through the local proxy — use gh/git as usual.',
+            'Harness restarted; use gh and git only in this session worktree through the local proxy.',
             restored
         ]
             .filter(Boolean)

package/dist/harness.d.ts

@@ -49,6 +49,10 @@ export declare function harnessContentKey(harnesses: readonly RunnerHarness[]):
 export declare class VersionRefusedError extends Error {
     constructor(message: string);
 }
+/** A service cannot re-enrol without a new one-time token from a user. */
+export declare class StoredCredentialUnavailableError extends Error {
+    constructor();
+}
 /** The sandbox supervisor, not the harness, owns package installation. */
 export declare class UpgradeRequestedError extends Error {
     readonly harnessVersion: string;

package/dist/harness.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Harness = exports.UpgradeRequestedError = exports.VersionRefusedError = exports.HARNESS_DISCOVERY_FEATURE = exports.HARNESS_RETRY_DELAYS_MS = exports.HARNESS_DISCOVERY_REFRESH_MS = void 0;
+exports.Harness = exports.UpgradeRequestedError = exports.StoredCredentialUnavailableError = exports.VersionRefusedError = exports.HARNESS_DISCOVERY_FEATURE = exports.HARNESS_RETRY_DELAYS_MS = exports.HARNESS_DISCOVERY_REFRESH_MS = void 0;
 exports.mergeHarnessReports = mergeHarnessReports;
 exports.harnessContentKey = harnessContentKey;
 const node_crypto_1 = require("node:crypto");
 const node_path_1 = require("node:path");
 const model_gateway_1 = require("./adapters/model-gateway");
+const vendor_environment_1 = require("./adapters/vendor-environment");
 const capabilities_1 = require("./capabilities");
 const contract_1 = require("./contract");
 const control_plane_1 = require("./control-plane");
@@ -111,6 +112,14 @@ class VersionRefusedError extends Error {
     }
 }
 exports.VersionRefusedError = VersionRefusedError;
+/** A service cannot re-enrol without a new one-time token from a user. */
+class StoredCredentialUnavailableError extends Error {
+    constructor() {
+        super('No usable stored runner credential. Start the runner in a terminal to sign in again.');
+        this.name = 'StoredCredentialUnavailableError';
+    }
+}
+exports.StoredCredentialUnavailableError = StoredCredentialUnavailableError;
 /** The sandbox supervisor, not the harness, owns package installation. */
 class UpgradeRequestedError extends Error {
     harnessVersion;
@@ -365,6 +374,16 @@ class Harness {
         // The health check comes up FIRST, so a probe sees 'starting' rather than a
         // connection refused while registration is still retrying.
         await this.health.start();
+        try {
+            const removed = (0, vendor_environment_1.sweepVendorConfigDirs)();
+            if (removed)
+                log('Old vendor config folders removed', { removed });
+        }
+        catch (error) {
+            log('Vendor config cleanup failed', {
+                reason: error instanceof Error ? error.message : String(error)
+            });
+        }
         await this.proxy.start();
         this.capabilities = await (0, capabilities_1.probeCapabilities)({
             maxConcurrentSessions: this.options.maxConcurrentSessions,
@@ -373,10 +392,8 @@ class Harness {
         // Install immediately before model probing can start a backend. The lease
         // is process-wide and reference-counted, so concurrent Harness instances
         // share one generic launcher instead of racing to rewrite global PATH.
-        if (this.options.runtime === 'sandbox') {
-            const guard = await (0, github_command_guards_1.acquireGhGuardPath)(this.options.workspaceRoot);
-            this.releaseGitHubGuard = guard.release;
-        }
+        const guard = await (0, github_command_guards_1.acquireGhGuardPath)(this.options.workspaceRoot);
+        this.releaseGitHubGuard = guard.release;
         /*
          * MODELS ARE PROBED ONCE, AT START-UP — not on every heartbeat, because
          * enumerating providers starts a Pi discovery process. The catalogue is
@@ -534,8 +551,7 @@ class Harness {
         // 2. ENROL. The ordinary first-boot path, and the fallback when no usable
         //    stored credential exists (absent, expired or rejected).
         if (!this.options.enrolmentToken) {
-            throw new Error('No usable stored runner credential and no enrolment token. Provide ' +
-                '--token / PF_ENROLMENT_TOKEN for the first registration.');
+            throw new StoredCredentialUnavailableError();
         }
         // Back-off and the final-status short-circuit both live in the client, so
         // every route obeys the same retry rule and no route can drift from it.
@@ -945,6 +961,7 @@ class Harness {
         if (!this.harnessReport) {
             return;
         }
+        capabilities.vendorHarnesses = this.options.vendorHarnesses ?? [];
         const blocked = this.addVendorBackends(capabilities);
         const harnesses = this.harnessReport.map((harness) => {
             const backend = capabilities.backends.find((candidate) => candidate.name === harness.name);
@@ -1030,6 +1047,14 @@ class Harness {
                 continue;
             if (capabilities.backends.some((b) => b.name === harness.name))
                 continue;
+            if (!this.options.vendorHarnesses?.includes(harness.name)) {
+                blocked.set(harness.name, 'Not enabled on this machine. Start the runner with --vendor-harnesses ' +
+                    harness.name +
+                    ' or set PF_VENDOR_HARNESSES=' +
+                    harness.name +
+                    '.');
+                continue;
+            }
             const reason = blocker(harness.name, this.options.runtime);
             if (reason) {
                 blocked.set(harness.name, reason);

package/dist/options.js

@@ -4,6 +4,7 @@ exports.OptionsError = void 0;
 exports.parseOptions = parseOptions;
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
+const vendor_backends_1 = require("./vendor-backends");
 const DEFAULT_HEALTH_PORT = 7777;
 const DEFAULT_GITHUB_PROXY_PORT = 7780;
 const DEFAULT_HEARTBEAT_INTERVAL_MS = 30_000;
@@ -141,6 +142,20 @@ function parseLabels(raw) {
         .filter(Boolean);
     return labels.length > 0 ? labels : undefined;
 }
+function parseVendorHarnesses(raw) {
+    if (!raw?.trim())
+        return [];
+    const names = raw
+        .split(',')
+        .map((name) => name.trim())
+        .filter(Boolean);
+    for (const name of names) {
+        if (!(0, vendor_backends_1.isVendorBackend)(name)) {
+            throw new OptionsError(`Invalid vendor harness: '${name}'. Expected codex, claude-code or cursor.`);
+        }
+    }
+    return [...new Set(names)];
+}
 function parseBoolean(raw, fallback, name) {
     if (raw === undefined || raw === '')
         return fallback;
@@ -178,7 +193,7 @@ function parseOptions(argv, env) {
         throw new OptionsError('Missing control plane url. Pass --control-plane <url> or set PF_CONTROL_PLANE_URL.');
     }
     const enrolmentToken = readFlag(argv, 'token') ?? env.PF_ENROLMENT_TOKEN;
-    if (!enrolmentToken) {
+    if (!enrolmentToken && !readBoolFlag(argv, 'stored-credential')) {
         throw new OptionsError('Missing enrolment token. Pass --token <token> or set PF_ENROLMENT_TOKEN.');
     }
     let parsed;
@@ -205,7 +220,7 @@ function parseOptions(argv, env) {
     const runtime = parseRuntime(readFlag(argv, 'runtime') ?? env.PF_RUNNER_RUNTIME);
     return {
         controlPlaneUrl,
-        enrolmentToken,
+        enrolmentToken: enrolmentToken ?? '',
         healthPort: parsePort(readFlag(argv, 'health-port') ?? env.PF_HARNESS_HEALTH_PORT, DEFAULT_HEALTH_PORT),
         githubProxyPort: parsePort(readFlag(argv, 'github-proxy-port') ?? env.PF_GITHUB_PROXY_PORT, DEFAULT_GITHUB_PROXY_PORT),
         autoCommitDirtyWorktree: parseBoolean(readFlag(argv, 'worktree-wip-commit') ?? env.PF_WORKTREE_WIP_COMMIT, runtime === 'sandbox', 'worktree WIP commit flag'),
@@ -219,6 +234,7 @@ function parseOptions(argv, env) {
         runtime,
         maxConcurrentSessions: parseConcurrency(readFlag(argv, 'max-sessions') ?? env.PF_MAX_CONCURRENT_SESSIONS, runtime),
         labels: parseLabels(readFlag(argv, 'labels') ?? env.PF_RUNNER_LABELS),
+        vendorHarnesses: parseVendorHarnesses(readFlag(argv, 'vendor-harnesses') ?? env.PF_VENDOR_HARNESSES),
         // The flag wins over the environment, so one start can turn it off
         // without editing a service file.
         harnessDiscovery: readBoolFlag(argv, 'no-harness-discovery')

package/dist/runtime/permission-mode.d.ts

@@ -17,9 +17,8 @@
  * adapter default. That is defect G1 — a Permission control that is recorded,
  * served, rendered, and enforced nowhere.
  *
- * A stored mode keeps the user's choice. Missing mode uses the new-agent
- * default, `bypassPermissions`. An unrecognised value fails closed onto
- * `'ask'`; it may be a mode from a newer control plane.
+ * A stored mode keeps the user's choice. Missing and unrecognised modes
+ * fail closed onto 'ask'.
  *
  * ---------------------------------------------------------------------------
  * THE TABLE, AND WHAT IS AND IS NOT FAITHFUL

package/dist/runtime/permission-mode.js

@@ -18,9 +18,8 @@
  * adapter default. That is defect G1 — a Permission control that is recorded,
  * served, rendered, and enforced nowhere.
  *
- * A stored mode keeps the user's choice. Missing mode uses the new-agent
- * default, `bypassPermissions`. An unrecognised value fails closed onto
- * `'ask'`; it may be a mode from a newer control plane.
+ * A stored mode keeps the user's choice. Missing and unrecognised modes
+ * fail closed onto 'ask'.
  *
  * ---------------------------------------------------------------------------
  * THE TABLE, AND WHAT IS AND IS NOT FAITHFUL
@@ -92,8 +91,6 @@ exports.claudeCodePermissionMode = claudeCodePermissionMode;
  */
 function mapPermissionMode(mode) {
     switch (mode) {
-        case null:
-        case undefined:
         case 'bypassPermissions':
             return {
                 permissionMode: 'allow',

package/dist/runtime/session-runner.d.ts

@@ -25,6 +25,7 @@ import { LeaseResponse, LeasedTurnInput, ModelMessageInput, TranscriptPartInput,
 import { KnowledgeToolHost, type KnowledgeControl } from './knowledge-tools';
 import { McpAuthProxy } from './mcp-auth-proxy';
 import { type FailedMcpCheck } from './mcp-preflight';
+export declare function approvalTimeoutMs(value: string | undefined): number;
 export interface SessionRunnerDeps {
     /** Resolves a backend name from the lease to a working adapter. */
     getAdapter(backend: string): CodingAgentAdapter;
@@ -347,6 +348,7 @@ export declare class SessionRunner {
     private openApproval;
     /** The transcript identity of an ordinary agent question, if one is open. */
     private openQuestionPartId;
+    private openQuestionStartedAt;
     /**
      * Expiry of the model token THIS RUNNING BACKEND is holding, when the
      * control plane reported one — see `LeaseResponse.modelTokenExpiresAt`.