@poncho-ai/harness 0.17.0 → 0.19.0

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @poncho-ai/harness@0.17.0 build /home/runner/work/poncho-ai/poncho-ai/packages/harness
+> @poncho-ai/harness@0.19.0 build /home/runner/work/poncho-ai/poncho-ai/packages/harness
 > tsup src/index.ts --format esm --dts
 
 CLI Building entry: src/index.ts
@@ -7,8 +7,8 @@
 CLI tsup v8.5.1
 CLI Target: es2022
 ESM Build start
-ESM dist/index.js 196.31 KB
-ESM ⚡️ Build success in 155ms
+ESM dist/index.js 198.85 KB
+ESM ⚡️ Build success in 137ms
 DTS Build start
-DTS ⚡️ Build success in 6569ms
-DTS dist/index.d.ts 23.97 KB
+DTS ⚡️ Build success in 7145ms
+DTS dist/index.d.ts 24.33 KB

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @poncho-ai/harness
 
+## 0.19.0
+
+### Minor Changes
+
+- [`075b9ac`](https://github.com/cesr/poncho-ai/commit/075b9ac3556847af913bf2b58f030575c3b99852) Thanks [@cesr](https://github.com/cesr)! - Batch tool approvals, fix serverless session persistence and adapter init
+  - Batch tool approvals: all approval-requiring tool calls in a single step are now collected and presented together instead of one at a time.
+  - Fix messaging adapter route registration: routes are only registered after successful initialization, preventing "Adapter not initialised" errors on Vercel.
+  - Add stateless signed-cookie sessions so web UI auth survives serverless cold starts.
+
+### Patch Changes
+
+- Updated dependencies [[`075b9ac`](https://github.com/cesr/poncho-ai/commit/075b9ac3556847af913bf2b58f030575c3b99852)]:
+  - @poncho-ai/sdk@1.4.0
+
+## 0.18.0
+
+### Minor Changes
+
+- [`cd6ccd7`](https://github.com/cesr/poncho-ai/commit/cd6ccd7846e16fbaf17167617666796320ec29ce) Thanks [@cesr](https://github.com/cesr)! - Add MCP custom headers support, tool:generating streaming feedback, and cross-owner subagent recovery
+  - **MCP custom headers**: `poncho mcp add --header "Name: value"` and `headers` config field let servers like Arcade receive extra HTTP headers alongside bearer auth.
+  - **tool:generating event**: the harness now emits `tool:generating` events when the model begins writing tool-call arguments, so the web UI shows real-time "preparing <tool>" feedback instead of appearing stuck during large tool calls.
+  - **Subagent recovery**: `list`/`listSummaries` accept optional `ownerId` so stale-subagent recovery on server restart scans across all owners.
+
+### Patch Changes
+
+- Updated dependencies [[`cd6ccd7`](https://github.com/cesr/poncho-ai/commit/cd6ccd7846e16fbaf17167617666796320ec29ce)]:
+  - @poncho-ai/sdk@1.3.0
+
 ## 0.17.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -94,6 +94,7 @@ interface Conversation {
             name: string;
             input: Record<string, unknown>;
         }>;
+        decision?: "approved" | "denied";
     }>;
     ownerId: string;
     tenantId: string | null;
@@ -205,6 +206,7 @@ interface RemoteMcpServerConfig {
         type: "bearer";
         tokenEnv?: string;
     };
+    headers?: Record<string, string>;
     timeoutMs?: number;
     reconnectAttempts?: number;
     reconnectDelayMs?: number;
@@ -267,6 +269,8 @@ type BuiltInToolToggles = {
     list_directory?: boolean;
     read_file?: boolean;
     write_file?: boolean;
+    delete_file?: boolean;
+    delete_directory?: boolean;
 };
 interface MessagingChannelConfig {
     platform: "slack" | "resend";
@@ -275,6 +279,7 @@ interface MessagingChannelConfig {
     apiKeyEnv?: string;
     webhookSecretEnv?: string;
     fromEnv?: string;
+    replyToEnv?: string;
     allowedSenders?: string[];
     mode?: "auto-reply" | "tool";
     allowedRecipients?: string[];
@@ -358,6 +363,8 @@ declare const loadPonchoConfig: (workingDir: string) => Promise<PonchoConfig | u
 
 declare const createDefaultTools: (workingDir: string) => ToolDefinition[];
 declare const createWriteTool: (workingDir: string) => ToolDefinition;
+declare const createDeleteTool: (workingDir: string) => ToolDefinition;
+declare const createDeleteDirectoryTool: (workingDir: string) => ToolDefinition;
 
 declare const PONCHO_UPLOAD_SCHEME = "poncho-upload://";
 interface UploadStore {
@@ -680,4 +687,4 @@ declare class TelemetryEmitter {
 
 declare const createSubagentTools: (manager: SubagentManager, getConversationId: () => string | undefined, getOwnerId: () => string) => ToolDefinition[];
 
-export { type AgentFrontmatter, AgentHarness, type AgentIdentity, type AgentLimitsConfig, type AgentModelConfig, type BuiltInToolToggles, type Conversation, type ConversationState, type ConversationStore, type ConversationSummary, type CronJobConfig, type HarnessOptions, type HarnessRunOutput, InMemoryConversationStore, InMemoryStateStore, LatitudeCapture, type LatitudeCaptureConfig, LocalMcpBridge, LocalUploadStore, type MainMemory, type McpConfig, type MemoryConfig, type MemoryStore, type MessagingChannelConfig, type ModelProviderFactory, PONCHO_UPLOAD_SCHEME, type ParsedAgent, type PonchoConfig, type ProviderConfig, type RemoteMcpServerConfig, type RuntimeRenderContext, S3UploadStore, STORAGE_SCHEMA_VERSION, type SkillContextEntry, type SkillMetadata, type StateConfig, type StateProviderName, type StateStore, type StorageConfig, type SubagentManager, type SubagentResult, type SubagentSummary, type TelemetryConfig, TelemetryEmitter, type ToolAccess, type ToolCall, ToolDispatcher, type ToolExecutionResult, type UploadStore, type UploadsConfig, VercelBlobUploadStore, buildAgentDirectoryName, buildSkillContextWindow, createConversationStore, createDefaultTools, createMemoryStore, createMemoryTools, createModelProvider, createSkillTools, createStateStore, createSubagentTools, createUploadStore, createWriteTool, deriveUploadKey, ensureAgentIdentity, generateAgentId, getAgentStoreDirectory, getModelContextWindow, getPonchoStoreRoot, jsonSchemaToZod, loadPonchoConfig, loadSkillContext, loadSkillInstructions, loadSkillMetadata, normalizeScriptPolicyPath, parseAgentFile, parseAgentMarkdown, readSkillResource, renderAgentPrompt, resolveAgentIdentity, resolveMemoryConfig, resolveSkillDirs, resolveStateConfig, slugifyStorageComponent };
+export { type AgentFrontmatter, AgentHarness, type AgentIdentity, type AgentLimitsConfig, type AgentModelConfig, type BuiltInToolToggles, type Conversation, type ConversationState, type ConversationStore, type ConversationSummary, type CronJobConfig, type HarnessOptions, type HarnessRunOutput, InMemoryConversationStore, InMemoryStateStore, LatitudeCapture, type LatitudeCaptureConfig, LocalMcpBridge, LocalUploadStore, type MainMemory, type McpConfig, type MemoryConfig, type MemoryStore, type MessagingChannelConfig, type ModelProviderFactory, PONCHO_UPLOAD_SCHEME, type ParsedAgent, type PonchoConfig, type ProviderConfig, type RemoteMcpServerConfig, type RuntimeRenderContext, S3UploadStore, STORAGE_SCHEMA_VERSION, type SkillContextEntry, type SkillMetadata, type StateConfig, type StateProviderName, type StateStore, type StorageConfig, type SubagentManager, type SubagentResult, type SubagentSummary, type TelemetryConfig, TelemetryEmitter, type ToolAccess, type ToolCall, ToolDispatcher, type ToolExecutionResult, type UploadStore, type UploadsConfig, VercelBlobUploadStore, buildAgentDirectoryName, buildSkillContextWindow, createConversationStore, createDefaultTools, createDeleteDirectoryTool, createDeleteTool, createMemoryStore, createMemoryTools, createModelProvider, createSkillTools, createStateStore, createSubagentTools, createUploadStore, createWriteTool, deriveUploadKey, ensureAgentIdentity, generateAgentId, getAgentStoreDirectory, getModelContextWindow, getPonchoStoreRoot, jsonSchemaToZod, loadPonchoConfig, loadSkillContext, loadSkillInstructions, loadSkillMetadata, normalizeScriptPolicyPath, parseAgentFile, parseAgentMarkdown, readSkillResource, renderAgentPrompt, resolveAgentIdentity, resolveMemoryConfig, resolveSkillDirs, resolveStateConfig, slugifyStorageComponent };

package/dist/index.js

@@ -378,7 +378,7 @@ var loadPonchoConfig = async (workingDir) => {
 };
 
 // src/default-tools.ts
-import { mkdir, readdir, readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
+import { mkdir, readdir, readFile as readFile3, rm, unlink, writeFile as writeFile2 } from "fs/promises";
 import { dirname, resolve as resolve4, sep } from "path";
 import { defineTool } from "@poncho-ai/sdk";
 var resolveSafePath = (workingDir, inputPath) => {
@@ -463,6 +463,52 @@ var createWriteTool = (workingDir) => defineTool({
     return { path, written: true };
   }
 });
+var createDeleteTool = (workingDir) => defineTool({
+  name: "delete_file",
+  description: "Delete a file at a path inside the working directory",
+  inputSchema: {
+    type: "object",
+    properties: {
+      path: {
+        type: "string",
+        description: "File path relative to working directory"
+      }
+    },
+    required: ["path"],
+    additionalProperties: false
+  },
+  handler: async (input) => {
+    const path = typeof input.path === "string" ? input.path : "";
+    const resolved = resolveSafePath(workingDir, path);
+    await unlink(resolved);
+    return { path, deleted: true };
+  }
+});
+var createDeleteDirectoryTool = (workingDir) => defineTool({
+  name: "delete_directory",
+  description: "Recursively delete a directory and all its contents inside the working directory",
+  inputSchema: {
+    type: "object",
+    properties: {
+      path: {
+        type: "string",
+        description: "Directory path relative to working directory"
+      }
+    },
+    required: ["path"],
+    additionalProperties: false
+  },
+  handler: async (input) => {
+    const path = typeof input.path === "string" ? input.path : "";
+    if (!path) throw new Error("Path must not be empty.");
+    const resolved = resolveSafePath(workingDir, path);
+    if (resolved === resolve4(workingDir)) {
+      throw new Error("Cannot delete the working directory root.");
+    }
+    await rm(resolved, { recursive: true });
+    return { path, deleted: true };
+  }
+});
 
 // src/harness.ts
 import { randomUUID as randomUUID3 } from "crypto";
@@ -470,7 +516,7 @@ import { getTextContent as getTextContent2 } from "@poncho-ai/sdk";
 
 // src/upload-store.ts
 import { createHash as createHash2 } from "crypto";
-import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile3, rm } from "fs/promises";
+import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile3, rm as rm2 } from "fs/promises";
 import { createRequire } from "module";
 import { resolve as resolve5 } from "path";
 var tryImport = async (mod, workingDir) => {
@@ -577,7 +623,7 @@ var LocalUploadStore = class {
   }
   async delete(urlOrKey) {
     const key = urlOrKey.startsWith(PONCHO_UPLOAD_SCHEME) ? urlOrKey.slice(PONCHO_UPLOAD_SCHEME.length) : urlOrKey;
-    await rm(resolve5(this.uploadsDir, key), { force: true });
+    await rm2(resolve5(this.uploadsDir, key), { force: true });
   }
 };
 var VercelBlobUploadStore = class {
@@ -1306,16 +1352,19 @@ var StreamableHttpMcpRpcClient = class {
   endpoint;
   timeoutMs;
   bearerToken;
+  customHeaders;
   idCounter = 1;
   initialized = false;
   sessionId;
-  constructor(endpoint, timeoutMs = 1e4, bearerToken) {
+  constructor(endpoint, timeoutMs = 1e4, bearerToken, customHeaders) {
     this.endpoint = endpoint;
     this.timeoutMs = timeoutMs;
     this.bearerToken = bearerToken;
+    this.customHeaders = customHeaders ?? {};
   }
   buildHeaders(accept) {
     const headers = {
+      ...this.customHeaders,
       "Content-Type": "application/json",
       Accept: accept
     };
@@ -1596,7 +1645,8 @@ var LocalMcpBridge = class {
         new StreamableHttpMcpRpcClient(
           server.url,
           server.timeoutMs ?? 1e4,
-          server.auth?.tokenEnv ? process.env[server.auth.tokenEnv] : void 0
+          server.auth?.tokenEnv ? process.env[server.auth.tokenEnv] : void 0,
+          server.headers
         )
       );
     }
@@ -2904,6 +2954,7 @@ The agent will respond in Slack threads when @mentioned. Each Slack thread maps
    RESEND_API_KEY=re_...
    RESEND_WEBHOOK_SECRET=whsec_...
    RESEND_FROM=Agent <agent@yourdomain.com>
+   RESEND_REPLY_TO=support@yourdomain.com   # optional
    \`\`\`
 5. Add to \`poncho.config.js\`:
    \`\`\`javascript
@@ -3076,7 +3127,7 @@ var AgentHarness = class {
   isToolEnabled(name) {
     const access3 = this.resolveToolAccess(name);
     if (access3 === false) return false;
-    if (name === "write_file") {
+    if (name === "write_file" || name === "delete_file" || name === "delete_directory") {
       return this.shouldEnableWriteTool();
     }
     return true;
@@ -3119,6 +3170,12 @@ var AgentHarness = class {
     if (this.isToolEnabled("write_file")) {
       this.registerIfMissing(createWriteTool(this.workingDir));
     }
+    if (this.isToolEnabled("delete_file")) {
+      this.registerIfMissing(createDeleteTool(this.workingDir));
+    }
+    if (this.isToolEnabled("delete_directory")) {
+      this.registerIfMissing(createDeleteDirectoryTool(this.workingDir));
+    }
   }
   shouldEnableWriteTool() {
     const override = process.env.PONCHO_FS_WRITE?.toLowerCase();
@@ -4063,7 +4120,7 @@ ${textContent}` };
         let chunkCount = 0;
         const hasRunTimeout = timeoutMs > 0;
         const streamDeadline = hasRunTimeout ? start + timeoutMs : 0;
-        const textIterator = result.textStream[Symbol.asyncIterator]();
+        const fullStreamIterator = result.fullStream[Symbol.asyncIterator]();
         try {
           while (true) {
             if (isCancelled()) {
@@ -4089,20 +4146,20 @@ ${textContent}` };
             }
             const remaining = hasRunTimeout ? streamDeadline - now() : Infinity;
             const timeout = chunkCount === 0 ? Math.min(remaining, FIRST_CHUNK_TIMEOUT_MS) : hasRunTimeout ? remaining : 0;
-            let nextChunk;
+            let nextPart;
             if (timeout <= 0 && chunkCount > 0) {
-              nextChunk = await textIterator.next();
+              nextPart = await fullStreamIterator.next();
             } else {
               let timer;
-              nextChunk = await Promise.race([
-                textIterator.next(),
+              nextPart = await Promise.race([
+                fullStreamIterator.next(),
                 new Promise((resolve10) => {
                   timer = setTimeout(() => resolve10(null), timeout);
                 })
               ]);
               clearTimeout(timer);
             }
-            if (nextChunk === null) {
+            if (nextPart === null) {
               const isFirstChunk = chunkCount === 0;
               console.error(
                 `[poncho][harness] Stream timeout waiting for ${isFirstChunk ? "first" : "next"} chunk: model="${modelName}", step=${step}, chunks=${chunkCount}, elapsed=${now() - start}ms`
@@ -4120,13 +4177,19 @@ ${textContent}` };
               });
               return;
             }
-            if (nextChunk.done) break;
-            chunkCount += 1;
-            fullText += nextChunk.value;
-            yield pushEvent({ type: "model:chunk", content: nextChunk.value });
+            if (nextPart.done) break;
+            const part = nextPart.value;
+            if (part.type === "text-delta") {
+              chunkCount += 1;
+              fullText += part.text;
+              yield pushEvent({ type: "model:chunk", content: part.text });
+            } else if (part.type === "tool-input-start") {
+              chunkCount += 1;
+              yield pushEvent({ type: "tool:generating", tool: part.toolName, toolCallId: part.id });
+            }
           }
         } finally {
-          textIterator.return?.(void 0)?.catch?.(() => {
+          fullStreamIterator.return?.(void 0)?.catch?.(() => {
           });
         }
         if (isCancelled()) {
@@ -4232,6 +4295,7 @@ ${textContent}` };
         const toolResultsForModel = [];
         const richToolResults = [];
         const approvedCalls = [];
+        const approvalNeeded = [];
         for (const call of toolCalls) {
           if (isCancelled()) {
             yield emitCancellation();
@@ -4239,52 +4303,60 @@ ${textContent}` };
           }
           const runtimeToolName = exposedToolNames.get(call.name) ?? call.name;
           yield pushEvent({ type: "tool:started", tool: runtimeToolName, input: call.input });
-          const requiresApproval = this.requiresApprovalForToolCall(
-            runtimeToolName,
-            call.input
-          );
-          if (requiresApproval) {
-            const approvalId = `approval_${randomUUID3()}`;
-            yield pushEvent({
-              type: "tool:approval:required",
-              tool: runtimeToolName,
-              input: call.input,
-              approvalId
+          if (this.requiresApprovalForToolCall(runtimeToolName, call.input)) {
+            approvalNeeded.push({
+              approvalId: `approval_${randomUUID3()}`,
+              id: call.id,
+              name: runtimeToolName,
+              input: call.input
             });
-            const assistantContent2 = JSON.stringify({
-              text: fullText,
-              tool_calls: toolCalls.map((tc) => ({
-                id: tc.id,
-                name: exposedToolNames.get(tc.name) ?? tc.name,
-                input: tc.input
-              }))
+          } else {
+            approvedCalls.push({
+              id: call.id,
+              name: runtimeToolName,
+              input: call.input
             });
-            const assistantMsg = {
-              role: "assistant",
-              content: assistantContent2,
-              metadata: { timestamp: now(), id: randomUUID3(), step }
-            };
-            const deltaMessages = [...messages.slice(inputMessageCount), assistantMsg];
+          }
+        }
+        if (approvalNeeded.length > 0) {
+          for (const an of approvalNeeded) {
             yield pushEvent({
-              type: "tool:approval:checkpoint",
-              approvalId,
-              tool: runtimeToolName,
-              toolCallId: call.id,
-              input: call.input,
-              checkpointMessages: deltaMessages,
-              pendingToolCalls: toolCalls.map((tc) => ({
-                id: tc.id,
-                name: exposedToolNames.get(tc.name) ?? tc.name,
-                input: tc.input
-              }))
+              type: "tool:approval:required",
+              tool: an.name,
+              input: an.input,
+              approvalId: an.approvalId
             });
-            return;
           }
-          approvedCalls.push({
-            id: call.id,
-            name: runtimeToolName,
-            input: call.input
+          const assistantContent2 = JSON.stringify({
+            text: fullText,
+            tool_calls: toolCalls.map((tc) => ({
+              id: tc.id,
+              name: exposedToolNames.get(tc.name) ?? tc.name,
+              input: tc.input
+            }))
+          });
+          const assistantMsg = {
+            role: "assistant",
+            content: assistantContent2,
+            metadata: { timestamp: now(), id: randomUUID3(), step }
+          };
+          const deltaMessages = [...messages.slice(inputMessageCount), assistantMsg];
+          yield pushEvent({
+            type: "tool:approval:checkpoint",
+            approvals: approvalNeeded.map((an) => ({
+              approvalId: an.approvalId,
+              tool: an.name,
+              toolCallId: an.id,
+              input: an.input
+            })),
+            checkpointMessages: deltaMessages,
+            pendingToolCalls: toolCalls.map((tc) => ({
+              id: tc.id,
+              name: exposedToolNames.get(tc.name) ?? tc.name,
+              input: tc.input
+            }))
           });
+          return;
         }
         const batchStart = now();
         if (isCancelled()) {
@@ -4578,7 +4650,7 @@ var LatitudeCapture = class {
 
 // src/state.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { mkdir as mkdir4, readFile as readFile7, readdir as readdir4, rename as rename2, rm as rm2, writeFile as writeFile5 } from "fs/promises";
+import { mkdir as mkdir4, readFile as readFile7, readdir as readdir4, rename as rename2, rm as rm3, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname4, resolve as resolve9 } from "path";
 var DEFAULT_OWNER = "local-owner";
 var LOCAL_STATE_FILE = "state.json";
@@ -4693,13 +4765,13 @@ var InMemoryConversationStore = class {
       }
     }
   }
-  async list(ownerId = DEFAULT_OWNER) {
+  async list(ownerId) {
     this.purgeExpired();
-    return Array.from(this.conversations.values()).filter((conversation) => conversation.ownerId === ownerId).sort((a, b) => b.updatedAt - a.updatedAt);
+    return Array.from(this.conversations.values()).filter((conversation) => !ownerId || conversation.ownerId === ownerId).sort((a, b) => b.updatedAt - a.updatedAt);
   }
-  async listSummaries(ownerId = DEFAULT_OWNER) {
+  async listSummaries(ownerId) {
     this.purgeExpired();
-    return Array.from(this.conversations.values()).filter((c) => c.ownerId === ownerId).sort((a, b) => b.updatedAt - a.updatedAt).map((c) => ({
+    return Array.from(this.conversations.values()).filter((c) => !ownerId || c.ownerId === ownerId).sort((a, b) => b.updatedAt - a.updatedAt).map((c) => ({
       conversationId: c.conversationId,
       title: c.title,
       updatedAt: c.updatedAt,
@@ -4875,9 +4947,9 @@ var FileConversationStore = class {
     });
     await this.writing;
   }
-  async list(ownerId = DEFAULT_OWNER) {
+  async list(ownerId) {
     await this.ensureLoaded();
-    const summaries = Array.from(this.conversations.values()).filter((conversation) => conversation.ownerId === ownerId).sort((a, b) => b.updatedAt - a.updatedAt);
+    const summaries = Array.from(this.conversations.values()).filter((conversation) => !ownerId || conversation.ownerId === ownerId).sort((a, b) => b.updatedAt - a.updatedAt);
     const conversations = [];
     for (const summary of summaries) {
       const loaded = await this.readConversationFile(summary.fileName);
@@ -4887,9 +4959,9 @@ var FileConversationStore = class {
     }
     return conversations;
   }
-  async listSummaries(ownerId = DEFAULT_OWNER) {
+  async listSummaries(ownerId) {
     await this.ensureLoaded();
-    return Array.from(this.conversations.values()).filter((c) => c.ownerId === ownerId).sort((a, b) => b.updatedAt - a.updatedAt).map((c) => ({
+    return Array.from(this.conversations.values()).filter((c) => !ownerId || c.ownerId === ownerId).sort((a, b) => b.updatedAt - a.updatedAt).map((c) => ({
       conversationId: c.conversationId,
       title: c.title,
       updatedAt: c.updatedAt,
@@ -4953,7 +5025,7 @@ var FileConversationStore = class {
     if (removed) {
       this.writing = this.writing.then(async () => {
         if (existing) {
-          await rm2(resolve9(conversationsDir, existing.fileName), { force: true });
+          await rm3(resolve9(conversationsDir, existing.fileName), { force: true });
         }
         await this.writeIndex();
       });
@@ -5115,11 +5187,14 @@ var KeyValueConversationStoreBase = class {
       return void 0;
     }
   }
-  async list(ownerId = DEFAULT_OWNER) {
+  async list(ownerId) {
     const kv = await this.client();
     if (!kv) {
       return await this.memoryFallback.list(ownerId);
     }
+    if (!ownerId) {
+      return [];
+    }
     const ids = await this.getOwnerConversationIds(ownerId);
     const conversations = [];
     for (const id of ids) {
@@ -5134,11 +5209,14 @@ var KeyValueConversationStoreBase = class {
     }
     return conversations.sort((a, b) => b.updatedAt - a.updatedAt);
   }
-  async listSummaries(ownerId = DEFAULT_OWNER) {
+  async listSummaries(ownerId) {
     const kv = await this.client();
     if (!kv) {
       return await this.memoryFallback.listSummaries(ownerId);
     }
+    if (!ownerId) {
+      return [];
+    }
     const ids = await this.getOwnerConversationIds(ownerId);
     const summaries = [];
     for (const id of ids) {
@@ -5695,6 +5773,8 @@ export {
   buildSkillContextWindow,
   createConversationStore,
   createDefaultTools,
+  createDeleteDirectoryTool,
+  createDeleteTool,
   createMemoryStore,
   createMemoryTools,
   createModelProvider,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poncho-ai/harness",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Agent execution runtime - conversation loop, tool dispatch, streaming",
   "repository": {
     "type": "git",
@@ -31,7 +31,7 @@
     "redis": "^5.10.0",
     "yaml": "^2.4.0",
     "zod": "^3.22.0",
-    "@poncho-ai/sdk": "1.2.0"
+    "@poncho-ai/sdk": "1.4.0"
   },
   "devDependencies": {
     "@types/mustache": "^4.2.6",

package/src/config.ts

@@ -39,6 +39,8 @@ export type BuiltInToolToggles = {
   list_directory?: boolean;
   read_file?: boolean;
   write_file?: boolean;
+  delete_file?: boolean;
+  delete_directory?: boolean;
 };
 
 export interface MessagingChannelConfig {
@@ -50,6 +52,7 @@ export interface MessagingChannelConfig {
   apiKeyEnv?: string;
   webhookSecretEnv?: string;
   fromEnv?: string;
+  replyToEnv?: string;
   allowedSenders?: string[];
   mode?: "auto-reply" | "tool";
   allowedRecipients?: string[];

package/src/default-tools.ts

@@ -1,4 +1,4 @@
-import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readdir, readFile, rm, unlink, writeFile } from "node:fs/promises";
 import { dirname, resolve, sep } from "node:path";
 import { defineTool, type ToolDefinition } from "@poncho-ai/sdk";
 
@@ -87,3 +87,53 @@ export const createWriteTool = (workingDir: string): ToolDefinition =>
       return { path, written: true };
     },
   });
+
+export const createDeleteTool = (workingDir: string): ToolDefinition =>
+  defineTool({
+    name: "delete_file",
+    description: "Delete a file at a path inside the working directory",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description: "File path relative to working directory",
+        },
+      },
+      required: ["path"],
+      additionalProperties: false,
+    },
+    handler: async (input) => {
+      const path = typeof input.path === "string" ? input.path : "";
+      const resolved = resolveSafePath(workingDir, path);
+      await unlink(resolved);
+      return { path, deleted: true };
+    },
+  });
+
+export const createDeleteDirectoryTool = (workingDir: string): ToolDefinition =>
+  defineTool({
+    name: "delete_directory",
+    description: "Recursively delete a directory and all its contents inside the working directory",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description: "Directory path relative to working directory",
+        },
+      },
+      required: ["path"],
+      additionalProperties: false,
+    },
+    handler: async (input) => {
+      const path = typeof input.path === "string" ? input.path : "";
+      if (!path) throw new Error("Path must not be empty.");
+      const resolved = resolveSafePath(workingDir, path);
+      if (resolved === resolve(workingDir)) {
+        throw new Error("Cannot delete the working directory root.");
+      }
+      await rm(resolved, { recursive: true });
+      return { path, deleted: true };
+    },
+  });

package/src/harness.ts

@@ -15,7 +15,7 @@ import type { UploadStore } from "./upload-store.js";
 import { PONCHO_UPLOAD_SCHEME, deriveUploadKey } from "./upload-store.js";
 import { parseAgentFile, renderAgentPrompt, type ParsedAgent, type AgentFrontmatter } from "./agent-parser.js";
 import { loadPonchoConfig, resolveMemoryConfig, type PonchoConfig, type ToolAccess, type BuiltInToolToggles } from "./config.js";
-import { createDefaultTools, createWriteTool } from "./default-tools.js";
+import { createDefaultTools, createDeleteDirectoryTool, createDeleteTool, createWriteTool } from "./default-tools.js";
 import {
   createMemoryStore,
   createMemoryTools,
@@ -324,6 +324,7 @@ The agent will respond in Slack threads when @mentioned. Each Slack thread maps
    RESEND_API_KEY=re_...
    RESEND_WEBHOOK_SECRET=whsec_...
    RESEND_FROM=Agent <agent@yourdomain.com>
+   RESEND_REPLY_TO=support@yourdomain.com   # optional
    \`\`\`
 5. Add to \`poncho.config.js\`:
    \`\`\`javascript
@@ -526,7 +527,7 @@ export class AgentHarness {
   private isToolEnabled(name: string): boolean {
     const access = this.resolveToolAccess(name);
     if (access === false) return false;
-    if (name === "write_file") {
+    if (name === "write_file" || name === "delete_file" || name === "delete_directory") {
       return this.shouldEnableWriteTool();
     }
     return true;
@@ -574,6 +575,12 @@ export class AgentHarness {
     if (this.isToolEnabled("write_file")) {
       this.registerIfMissing(createWriteTool(this.workingDir));
     }
+    if (this.isToolEnabled("delete_file")) {
+      this.registerIfMissing(createDeleteTool(this.workingDir));
+    }
+    if (this.isToolEnabled("delete_directory")) {
+      this.registerIfMissing(createDeleteDirectoryTool(this.workingDir));
+    }
   }
 
   private shouldEnableWriteTool(): boolean {
@@ -1682,15 +1689,14 @@ ${boundedMainMemory.trim()}`
             isEnabled: telemetryEnabled && !!this.latitudeTelemetry,
           },
         });
-        // Stream text chunks — enforce overall run timeout per chunk.
-        // The top-of-step timeout check cannot fire while we are
-        // blocked inside the textStream async iterator, so we race
-        // each next() call against the remaining time budget.
+        // Stream full response — use fullStream to get visibility into
+        // tool-call generation (tool-input-start) in addition to text deltas.
+        // Enforce overall run timeout per part.
         let fullText = "";
         let chunkCount = 0;
         const hasRunTimeout = timeoutMs > 0;
         const streamDeadline = hasRunTimeout ? start + timeoutMs : 0;
-        const textIterator = result.textStream[Symbol.asyncIterator]();
+        const fullStreamIterator = result.fullStream[Symbol.asyncIterator]();
         try {
           while (true) {
             if (isCancelled()) {
@@ -1714,21 +1720,17 @@ ${boundedMainMemory.trim()}`
                 return;
               }
             }
-            // Use a shorter timeout for the first chunk to detect
-            // non-responsive models quickly instead of waiting minutes.
-            // When no run timeout is set, only the first chunk is time-bounded.
             const remaining = hasRunTimeout ? streamDeadline - now() : Infinity;
             const timeout = chunkCount === 0
               ? Math.min(remaining, FIRST_CHUNK_TIMEOUT_MS)
               : hasRunTimeout ? remaining : 0;
-            let nextChunk: IteratorResult<string> | null;
+            let nextPart: IteratorResult<(typeof result.fullStream) extends AsyncIterable<infer T> ? T : never> | null;
             if (timeout <= 0 && chunkCount > 0) {
-              // No time budget — await the stream directly (development mode, no run timeout)
-              nextChunk = await textIterator.next();
+              nextPart = await fullStreamIterator.next();
             } else {
               let timer: ReturnType<typeof setTimeout> | undefined;
-              nextChunk = await Promise.race([
-                textIterator.next(),
+              nextPart = await Promise.race([
+                fullStreamIterator.next(),
                 new Promise<null>((resolve) => {
                   timer = setTimeout(() => resolve(null), timeout);
                 }),
@@ -1736,16 +1738,14 @@ ${boundedMainMemory.trim()}`
               clearTimeout(timer);
             }
 
-            if (nextChunk === null) {
+            if (nextPart === null) {
               const isFirstChunk = chunkCount === 0;
               console.error(
                 `[poncho][harness] Stream timeout waiting for ${isFirstChunk ? "first" : "next"} chunk: model="${modelName}", step=${step}, chunks=${chunkCount}, elapsed=${now() - start}ms`,
               );
               if (isFirstChunk) {
-                // Throw so the step-level retry logic can handle it.
                 throw new FirstChunkTimeoutError(modelName, FIRST_CHUNK_TIMEOUT_MS);
               }
-              // Mid-stream timeout: not retryable (partial response would be lost)
               yield pushEvent({
                 type: "run:error",
                 runId,
@@ -1757,14 +1757,20 @@ ${boundedMainMemory.trim()}`
               return;
             }
 
-            if (nextChunk.done) break;
-            chunkCount += 1;
-            fullText += nextChunk.value;
-            yield pushEvent({ type: "model:chunk", content: nextChunk.value });
+            if (nextPart.done) break;
+            const part = nextPart.value;
+
+            if (part.type === "text-delta") {
+              chunkCount += 1;
+              fullText += part.text;
+              yield pushEvent({ type: "model:chunk", content: part.text });
+            } else if (part.type === "tool-input-start") {
+              chunkCount += 1;
+              yield pushEvent({ type: "tool:generating", tool: part.toolName, toolCallId: part.id });
+            }
           }
         } finally {
-          // Best-effort cleanup of the underlying stream/connection.
-          textIterator.return?.(undefined)?.catch?.(() => {});
+          fullStreamIterator.return?.(undefined)?.catch?.(() => {});
         }
 
         if (isCancelled()) {
@@ -1773,8 +1779,6 @@ ${boundedMainMemory.trim()}`
         }
 
       // Check finish reason for error / abnormal completions.
-      // textStream silently swallows model-level errors – they only
-      // surface through finishReason (or fullStream, which we don't use).
       const finishReason = await result.finishReason;
 
       if (finishReason === "error") {
@@ -1909,7 +1913,14 @@ ${boundedMainMemory.trim()}`
         name: string;
         input: Record<string, unknown>;
       }> = [];
+      const approvalNeeded: Array<{
+        approvalId: string;
+        id: string;
+        name: string;
+        input: Record<string, unknown>;
+      }> = [];
 
+      // Phase 1: classify all tool calls
       for (const call of toolCalls) {
         if (isCancelled()) {
           yield emitCancellation();
@@ -1917,54 +1928,66 @@ ${boundedMainMemory.trim()}`
         }
         const runtimeToolName = exposedToolNames.get(call.name) ?? call.name;
         yield pushEvent({ type: "tool:started", tool: runtimeToolName, input: call.input });
-        const requiresApproval = this.requiresApprovalForToolCall(
-          runtimeToolName,
-          call.input,
-        );
-        if (requiresApproval) {
-          const approvalId = `approval_${randomUUID()}`;
-          yield pushEvent({
-            type: "tool:approval:required",
-            tool: runtimeToolName,
+        if (this.requiresApprovalForToolCall(runtimeToolName, call.input)) {
+          approvalNeeded.push({
+            approvalId: `approval_${randomUUID()}`,
+            id: call.id,
+            name: runtimeToolName,
             input: call.input,
-            approvalId,
           });
-
-          const assistantContent = JSON.stringify({
-            text: fullText,
-            tool_calls: toolCalls.map(tc => ({
-              id: tc.id,
-              name: exposedToolNames.get(tc.name) ?? tc.name,
-              input: tc.input,
-            })),
+        } else {
+          approvedCalls.push({
+            id: call.id,
+            name: runtimeToolName,
+            input: call.input,
           });
-          const assistantMsg: Message = {
-            role: "assistant",
-            content: assistantContent,
-            metadata: { timestamp: now(), id: randomUUID(), step },
-          };
-          const deltaMessages = [...messages.slice(inputMessageCount), assistantMsg];
+        }
+      }
+
+      // Phase 2a: if any tools need approval, emit events for ALL of them and checkpoint
+      if (approvalNeeded.length > 0) {
+        for (const an of approvalNeeded) {
           yield pushEvent({
-            type: "tool:approval:checkpoint",
-            approvalId,
-            tool: runtimeToolName,
-            toolCallId: call.id,
-            input: call.input,
-            checkpointMessages: deltaMessages,
-            pendingToolCalls: toolCalls.map(tc => ({
-              id: tc.id,
-              name: exposedToolNames.get(tc.name) ?? tc.name,
-              input: tc.input,
-            })),
+            type: "tool:approval:required",
+            tool: an.name,
+            input: an.input,
+            approvalId: an.approvalId,
           });
-          return;
         }
-        approvedCalls.push({
-          id: call.id,
-          name: runtimeToolName,
-          input: call.input,
+
+        const assistantContent = JSON.stringify({
+          text: fullText,
+          tool_calls: toolCalls.map(tc => ({
+            id: tc.id,
+            name: exposedToolNames.get(tc.name) ?? tc.name,
+            input: tc.input,
+          })),
         });
+        const assistantMsg: Message = {
+          role: "assistant",
+          content: assistantContent,
+          metadata: { timestamp: now(), id: randomUUID(), step },
+        };
+        const deltaMessages = [...messages.slice(inputMessageCount), assistantMsg];
+        yield pushEvent({
+          type: "tool:approval:checkpoint",
+          approvals: approvalNeeded.map(an => ({
+            approvalId: an.approvalId,
+            tool: an.name,
+            toolCallId: an.id,
+            input: an.input,
+          })),
+          checkpointMessages: deltaMessages,
+          pendingToolCalls: toolCalls.map(tc => ({
+            id: tc.id,
+            name: exposedToolNames.get(tc.name) ?? tc.name,
+            input: tc.input,
+          })),
+        });
+        return;
       }
+
+      // Phase 2b: no approvals needed — execute all auto-approved calls
       const batchStart = now();
       if (isCancelled()) {
         yield emitCancellation();

package/src/mcp.ts

@@ -12,6 +12,7 @@ export interface RemoteMcpServerConfig {
     type: "bearer";
     tokenEnv?: string;
   };
+  headers?: Record<string, string>;
   timeoutMs?: number;
   reconnectAttempts?: number;
   reconnectDelayMs?: number;
@@ -46,18 +47,26 @@ class StreamableHttpMcpRpcClient implements McpRpcClient {
   private readonly endpoint: string;
   private readonly timeoutMs: number;
   private readonly bearerToken?: string;
+  private readonly customHeaders: Record<string, string>;
   private idCounter = 1;
   private initialized = false;
   private sessionId?: string;
 
-  constructor(endpoint: string, timeoutMs = 10_000, bearerToken?: string) {
+  constructor(
+    endpoint: string,
+    timeoutMs = 10_000,
+    bearerToken?: string,
+    customHeaders?: Record<string, string>,
+  ) {
     this.endpoint = endpoint;
     this.timeoutMs = timeoutMs;
     this.bearerToken = bearerToken;
+    this.customHeaders = customHeaders ?? {};
   }
 
   private buildHeaders(accept: string): Record<string, string> {
     const headers: Record<string, string> = {
+      ...this.customHeaders,
       "Content-Type": "application/json",
       Accept: accept,
     };
@@ -367,6 +376,7 @@ export class LocalMcpBridge {
           server.url,
           server.timeoutMs ?? 10_000,
           server.auth?.tokenEnv ? process.env[server.auth.tokenEnv] : undefined,
+          server.headers,
         ),
       );
     }

package/src/state.ts

@@ -35,6 +35,7 @@ export interface Conversation {
     checkpointMessages?: Message[];
     baseMessageCount?: number;
     pendingToolCalls?: Array<{ id: string; name: string; input: Record<string, unknown> }>;
+    decision?: "approved" | "denied";
   }>;
   ownerId: string;
   tenantId: string | null;
@@ -223,17 +224,17 @@ export class InMemoryConversationStore implements ConversationStore {
     }
   }
 
-  async list(ownerId = DEFAULT_OWNER): Promise<Conversation[]> {
+  async list(ownerId?: string): Promise<Conversation[]> {
     this.purgeExpired();
     return Array.from(this.conversations.values())
-      .filter((conversation) => conversation.ownerId === ownerId)
+      .filter((conversation) => !ownerId || conversation.ownerId === ownerId)
       .sort((a, b) => b.updatedAt - a.updatedAt);
   }
 
-  async listSummaries(ownerId = DEFAULT_OWNER): Promise<ConversationSummary[]> {
+  async listSummaries(ownerId?: string): Promise<ConversationSummary[]> {
     this.purgeExpired();
     return Array.from(this.conversations.values())
-      .filter((c) => c.ownerId === ownerId)
+      .filter((c) => !ownerId || c.ownerId === ownerId)
       .sort((a, b) => b.updatedAt - a.updatedAt)
       .map((c) => ({
         conversationId: c.conversationId,
@@ -454,10 +455,10 @@ class FileConversationStore implements ConversationStore {
     await this.writing;
   }
 
-  async list(ownerId = DEFAULT_OWNER): Promise<Conversation[]> {
+  async list(ownerId?: string): Promise<Conversation[]> {
     await this.ensureLoaded();
     const summaries = Array.from(this.conversations.values())
-      .filter((conversation) => conversation.ownerId === ownerId)
+      .filter((conversation) => !ownerId || conversation.ownerId === ownerId)
       .sort((a, b) => b.updatedAt - a.updatedAt);
     const conversations: Conversation[] = [];
     for (const summary of summaries) {
@@ -469,10 +470,10 @@ class FileConversationStore implements ConversationStore {
     return conversations;
   }
 
-  async listSummaries(ownerId = DEFAULT_OWNER): Promise<ConversationSummary[]> {
+  async listSummaries(ownerId?: string): Promise<ConversationSummary[]> {
     await this.ensureLoaded();
     return Array.from(this.conversations.values())
-      .filter((c) => c.ownerId === ownerId)
+      .filter((c) => !ownerId || c.ownerId === ownerId)
       .sort((a, b) => b.updatedAt - a.updatedAt)
       .map((c) => ({
         conversationId: c.conversationId,
@@ -751,11 +752,15 @@ abstract class KeyValueConversationStoreBase implements ConversationStore {
     }
   }
 
-  async list(ownerId = DEFAULT_OWNER): Promise<Conversation[]> {
+  async list(ownerId?: string): Promise<Conversation[]> {
     const kv = await this.client();
     if (!kv) {
       return await this.memoryFallback.list(ownerId);
     }
+    if (!ownerId) {
+      // KV stores index per-owner; cross-owner listing not supported
+      return [];
+    }
     const ids = await this.getOwnerConversationIds(ownerId);
     const conversations: Conversation[] = [];
     for (const id of ids) {
@@ -772,11 +777,14 @@ abstract class KeyValueConversationStoreBase implements ConversationStore {
     return conversations.sort((a, b) => b.updatedAt - a.updatedAt);
   }
 
-  async listSummaries(ownerId = DEFAULT_OWNER): Promise<ConversationSummary[]> {
+  async listSummaries(ownerId?: string): Promise<ConversationSummary[]> {
     const kv = await this.client();
     if (!kv) {
       return await this.memoryFallback.listSummaries(ownerId);
     }
+    if (!ownerId) {
+      return [];
+    }
     const ids = await this.getOwnerConversationIds(ownerId);
     const summaries: ConversationSummary[] = [];
     for (const id of ids) {

package/test/mcp.test.ts

@@ -126,6 +126,89 @@ describe("mcp bridge protocol transports", () => {
     expect(deleteSeen).toBe(true);
   });
 
+  it("sends custom headers alongside bearer token", async () => {
+    process.env.LINEAR_TOKEN = "token-123";
+    let capturedHeaders: Record<string, string | undefined> = {};
+    const server = createServer(async (req, res) => {
+      if (req.method === "DELETE") {
+        res.statusCode = 200;
+        res.end();
+        return;
+      }
+      const chunks: Buffer[] = [];
+      for await (const chunk of req) chunks.push(Buffer.from(chunk));
+      const body = Buffer.concat(chunks).toString("utf8");
+      const payload = body.trim().length > 0 ? (JSON.parse(body) as any) : {};
+      capturedHeaders = {
+        authorization: req.headers.authorization,
+        "x-custom-id": req.headers["x-custom-id"] as string | undefined,
+        "x-another": req.headers["x-another"] as string | undefined,
+      };
+      if (payload.method === "initialize") {
+        res.setHeader("Content-Type", "application/json");
+        res.setHeader("Mcp-Session-Id", "s");
+        res.end(
+          JSON.stringify({
+            jsonrpc: "2.0",
+            id: payload.id,
+            result: {
+              protocolVersion: "2025-03-26",
+              capabilities: { tools: { listChanged: true } },
+              serverInfo: { name: "remote", version: "1.0.0" },
+            },
+          }),
+        );
+        return;
+      }
+      if (payload.method === "notifications/initialized") {
+        res.statusCode = 202;
+        res.end();
+        return;
+      }
+      if (payload.method === "tools/list") {
+        res.setHeader("Content-Type", "application/json");
+        res.end(
+          JSON.stringify({
+            jsonrpc: "2.0",
+            id: payload.id,
+            result: {
+              tools: [
+                { name: "ping", inputSchema: { type: "object", properties: {} } },
+              ],
+            },
+          }),
+        );
+        return;
+      }
+      res.statusCode = 404;
+      res.end();
+    });
+    await new Promise<void>((r) => server.listen(0, () => r()));
+    const address = server.address();
+    if (!address || typeof address === "string") throw new Error("Unexpected address");
+
+    const bridge = new LocalMcpBridge({
+      mcp: [
+        {
+          name: "custom-headers",
+          url: `http://127.0.0.1:${address.port}/mcp`,
+          auth: { type: "bearer", tokenEnv: "LINEAR_TOKEN" },
+          headers: { "X-Custom-Id": "user-42", "X-Another": "value" },
+        },
+      ],
+    });
+
+    await bridge.startLocalServers();
+    await bridge.discoverTools();
+
+    expect(capturedHeaders.authorization).toBe("Bearer token-123");
+    expect(capturedHeaders["x-custom-id"]).toBe("user-42");
+    expect(capturedHeaders["x-another"]).toBe("value");
+
+    await bridge.stopLocalServers();
+    await new Promise<void>((r) => server.close(() => r()));
+  });
+
   it("fails fast on duplicate server names", () => {
     expect(
       () =>