@poncho-ai/harness 0.28.2 → 0.29.0

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @poncho-ai/harness@0.28.2 build /home/runner/work/poncho-ai/poncho-ai/packages/harness
+> @poncho-ai/harness@0.29.0 build /Users/cesar/Dev/latitude/poncho-ai/packages/harness
 > node scripts/embed-docs.js && tsup src/index.ts --format esm --dts
 
 [embed-docs] Generated poncho-docs.ts with 4 topics
@@ -8,8 +8,8 @@
 CLI tsup v8.5.1
 CLI Target: es2022
 ESM Build start
-ESM dist/index.js 289.62 KB
-ESM ⚡️ Build success in 213ms
+ESM dist/index.js 297.56 KB
+ESM ⚡️ Build success in 32ms
 DTS Build start
-DTS ⚡️ Build success in 7196ms
-DTS dist/index.d.ts 29.62 KB
+DTS ⚡️ Build success in 4608ms
+DTS dist/index.d.ts 30.41 KB

package/.turbo/turbo-lint.log

@@ -0,0 +1,6 @@
+
+> @poncho-ai/harness@0.11.2 lint /Users/cesar/Dev/latitude/poncho-ai/packages/harness
+> eslint src/
+
+sh: eslint: command not found
+ ELIFECYCLE  Command failed.

package/.turbo/turbo-test.log

@@ -0,0 +1,34 @@
+
+> @poncho-ai/harness@0.26.0 test /Users/cesar/Dev/latitude/poncho-ai/packages/harness
+> vitest
+
+
+ RUN  v1.6.1 /Users/cesar/Dev/latitude/poncho-ai/packages/harness
+
+stdout | test/mcp.test.ts > mcp bridge protocol transports > discovers and calls tools over streamable HTTP
+[poncho][mcp] {"event":"catalog.loaded","server":"remote","discoveredCount":1}
+[poncho][mcp] {"event":"tools.selected","requestedPatternCount":1,"registeredCount":1,"filteredByPolicyCount":0,"filteredByIntentCount":0}
+
+stdout | test/mcp.test.ts > mcp bridge protocol transports > sends custom headers alongside bearer token
+[poncho][mcp] {"event":"catalog.loaded","server":"custom-headers","discoveredCount":1}
+
+stderr | test/mcp.test.ts > mcp bridge protocol transports > skips discovery when bearer token env value is missing
+stdout | test/mcp.test.ts > mcp bridge protocol transports > selects discovered tools by requested patterns
+[poncho][mcp] {"event":"auth.token_missing","server":"remote","tokenEnv":"MISSING_TOKEN_ENV"}
+[poncho][mcp] {"event":"catalog.loaded","server":"remote","discoveredCount":2}
+[poncho][mcp] {"event":"tools.selected","requestedPatternCount":1,"registeredCount":1,"filteredByPolicyCount":0,"filteredByIntentCount":1}
+
+[poncho][mcp] {"event":"tools.selected","requestedPatternCount":1,"registeredCount":2,"filteredByPolicyCount":0,"filteredByIntentCount":0}
+
+stdout | test/mcp.test.ts > mcp bridge protocol transports > skips discovery when bearer token env value is missing
+[poncho][mcp] {"event":"tools.selected","requestedPatternCount":1,"registeredCount":0,"filteredByPolicyCount":0,"filteredByIntentCount":0}
+
+[event] step:completed {"type":"step:completed","step":1,"duration":1}
+ ✓ test/telemetry.test.ts  (3 tests) 5ms
+[event] step:started {"type":"step:started","step":2}
+ ✓ test/schema-converter.test.ts  (27 tests) 13ms
+stdout | test/mcp.test.ts > mcp bridge protocol transports > returns actionable errors for 403 permission failures
+[poncho][mcp] {"event":"catalog.loaded","server":"remote","discoveredCount":1}
+[poncho][mcp] {"event":"tools.selected","requestedPatternCount":1,"registeredCount":1,"filteredByPolicyCount":0,"filteredByIntentCount":0}
+
+ ✓ test/mcp.test.ts  (7 tests) 84ms

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @poncho-ai/harness
 
+## 0.29.0
+
+### Minor Changes
+
+- [#51](https://github.com/cesr/poncho-ai/pull/51) [`eb661a5`](https://github.com/cesr/poncho-ai/commit/eb661a554da6839702651671db8a8820ceb13f35) Thanks [@cesr](https://github.com/cesr)! - Add generic OTLP trace exporter for sending OpenTelemetry traces to any collector (Jaeger, Grafana Tempo, Honeycomb, etc.). Configure via `telemetry.otlp` as a URL string or `{ url, headers }` object. Works alongside or instead of Latitude telemetry.
+
+### Patch Changes
+
+- Updated dependencies [[`eb661a5`](https://github.com/cesr/poncho-ai/commit/eb661a554da6839702651671db8a8820ceb13f35)]:
+  - @poncho-ai/sdk@1.6.2
+
+## 0.28.3
+
+### Patch Changes
+
+- [`87f844b`](https://github.com/cesr/poncho-ai/commit/87f844b0a76ece87e4bba78eaf73392f857cdef2) Thanks [@cesr](https://github.com/cesr)! - Fix tool execution blowing past serverless timeout and cross-skill script paths
+  - Race tool batch execution against remaining soft deadline so parallel tools can't push past the hard platform timeout
+  - Add post-tool-execution soft deadline checkpoint for tools that finish just past the deadline
+  - Allow skill scripts to reference sibling directories (e.g. ../scripts/current-date.ts)
+  - Catch script path normalization errors in approval check instead of crashing the run
+
 ## 0.28.2
 
 ### Patch Changes

package/dist/index.d.ts

@@ -176,6 +176,11 @@ interface Conversation {
     /** Harness-internal message chain preserved across continuation runs.
      *  Cleared when a run completes without continuation. */
     _continuationMessages?: Message[];
+    /** Full structured message chain from the last harness run, including
+     *  tool-call and tool-result messages the model needs for context.
+     *  Unlike `_continuationMessages`, this is always set after a run
+     *  and does NOT signal that a continuation is pending. */
+    _harnessMessages?: Message[];
     createdAt: number;
     updatedAt: number;
 }
@@ -411,7 +416,10 @@ interface PonchoConfig extends McpConfig {
     };
     telemetry?: {
         enabled?: boolean;
-        otlp?: string;
+        otlp?: string | {
+            url: string;
+            headers?: Record<string, string>;
+        };
         latitude?: {
             apiKeyEnv?: string;
             projectIdEnv?: string;
@@ -623,6 +631,9 @@ declare class AgentHarness {
     private readonly activeSkillNames;
     private readonly registeredMcpToolNames;
     private latitudeTelemetry?;
+    private otlpSpanProcessor?;
+    private otlpTracerProvider?;
+    private hasOtlpExporter;
     private insideTelemetryCapture;
     private _browserSession?;
     private _browserMod?;
@@ -686,8 +697,9 @@ declare class AgentHarness {
     shutdown(): Promise<void>;
     listTools(): ToolDefinition[];
     /**
-     * Wraps the run() generator with Latitude telemetry capture for complete trace coverage
-     * Streams events in real-time using an event queue pattern
+     * Wraps the run() generator with telemetry capture for complete trace coverage.
+     * Supports Latitude, generic OTLP, or both simultaneously.
+     * Streams events in real-time using an event queue pattern.
      */
     runWithTelemetry(input: RunInput): AsyncGenerator<AgentEvent>;
     compact(messages: Message[], options?: CompactMessagesOptions): Promise<CompactResult>;
@@ -804,9 +816,15 @@ declare const createSkillTools: (skills: SkillMetadata[], options?: {
 }) => ToolDefinition[];
 declare const normalizeScriptPolicyPath: (relativePath: string) => string;
 
+interface OtlpConfig {
+    url: string;
+    headers?: Record<string, string>;
+}
+type OtlpOption = string | OtlpConfig;
+declare function normalizeOtlp(opt: OtlpOption | undefined): OtlpConfig | undefined;
 interface TelemetryConfig {
     enabled?: boolean;
-    otlp?: string;
+    otlp?: OtlpOption;
     latitude?: {
         apiKeyEnv?: string;
         projectIdEnv?: string;
@@ -824,4 +842,4 @@ declare class TelemetryEmitter {
 
 declare const createSubagentTools: (manager: SubagentManager) => ToolDefinition[];
 
-export { type AgentFrontmatter, AgentHarness, type AgentIdentity, type AgentLimitsConfig, type AgentModelConfig, type BuiltInToolToggles, type CompactMessagesOptions, type CompactResult, type CompactionConfig, type Conversation, type ConversationState, type ConversationStore, type ConversationSummary, type CronJobConfig, type HarnessOptions, type HarnessRunOutput, InMemoryConversationStore, InMemoryStateStore, LatitudeCapture, type LatitudeCaptureConfig, LocalMcpBridge, LocalUploadStore, type MainMemory, type McpConfig, type MemoryConfig, type MemoryStore, type MessagingChannelConfig, type ModelProviderFactory, PONCHO_UPLOAD_SCHEME, type ParsedAgent, type PendingSubagentResult, type PonchoConfig, type ProviderConfig, type RemoteMcpServerConfig, type RuntimeRenderContext, S3UploadStore, STORAGE_SCHEMA_VERSION, type SkillContextEntry, type SkillMetadata, type StateConfig, type StateProviderName, type StateStore, type StorageConfig, type SubagentManager, type SubagentResult, type SubagentSpawnResult, type SubagentSummary, type TelemetryConfig, TelemetryEmitter, type ToolAccess, type ToolCall, ToolDispatcher, type ToolExecutionResult, type UploadStore, type UploadsConfig, VercelBlobUploadStore, buildAgentDirectoryName, buildSkillContextWindow, compactMessages, createConversationStore, createDefaultTools, createDeleteDirectoryTool, createDeleteTool, createEditTool, createMemoryStore, createMemoryTools, createModelProvider, createSearchTools, createSkillTools, createStateStore, createSubagentTools, createUploadStore, createWriteTool, deriveUploadKey, ensureAgentIdentity, estimateTokens, estimateTotalTokens, findSafeSplitPoint, generateAgentId, getAgentStoreDirectory, getModelContextWindow, getPonchoStoreRoot, jsonSchemaToZod, loadPonchoConfig, loadSkillContext, loadSkillInstructions, loadSkillMetadata, normalizeScriptPolicyPath, parseAgentFile, parseAgentMarkdown, ponchoDocsTool, readSkillResource, renderAgentPrompt, resolveAgentIdentity, resolveCompactionConfig, resolveMemoryConfig, resolveSkillDirs, resolveStateConfig, slugifyStorageComponent };
+export { type AgentFrontmatter, AgentHarness, type AgentIdentity, type AgentLimitsConfig, type AgentModelConfig, type BuiltInToolToggles, type CompactMessagesOptions, type CompactResult, type CompactionConfig, type Conversation, type ConversationState, type ConversationStore, type ConversationSummary, type CronJobConfig, type HarnessOptions, type HarnessRunOutput, InMemoryConversationStore, InMemoryStateStore, LatitudeCapture, type LatitudeCaptureConfig, LocalMcpBridge, LocalUploadStore, type MainMemory, type McpConfig, type MemoryConfig, type MemoryStore, type MessagingChannelConfig, type ModelProviderFactory, type OtlpConfig, type OtlpOption, PONCHO_UPLOAD_SCHEME, type ParsedAgent, type PendingSubagentResult, type PonchoConfig, type ProviderConfig, type RemoteMcpServerConfig, type RuntimeRenderContext, S3UploadStore, STORAGE_SCHEMA_VERSION, type SkillContextEntry, type SkillMetadata, type StateConfig, type StateProviderName, type StateStore, type StorageConfig, type SubagentManager, type SubagentResult, type SubagentSpawnResult, type SubagentSummary, type TelemetryConfig, TelemetryEmitter, type ToolAccess, type ToolCall, ToolDispatcher, type ToolExecutionResult, type UploadStore, type UploadsConfig, VercelBlobUploadStore, buildAgentDirectoryName, buildSkillContextWindow, compactMessages, createConversationStore, createDefaultTools, createDeleteDirectoryTool, createDeleteTool, createEditTool, createMemoryStore, createMemoryTools, createModelProvider, createSearchTools, createSkillTools, createStateStore, createSubagentTools, createUploadStore, createWriteTool, deriveUploadKey, ensureAgentIdentity, estimateTokens, estimateTotalTokens, findSafeSplitPoint, generateAgentId, getAgentStoreDirectory, getModelContextWindow, getPonchoStoreRoot, jsonSchemaToZod, loadPonchoConfig, loadSkillContext, loadSkillInstructions, loadSkillMetadata, normalizeOtlp, normalizeScriptPolicyPath, parseAgentFile, parseAgentMarkdown, ponchoDocsTool, readSkillResource, renderAgentPrompt, resolveAgentIdentity, resolveCompactionConfig, resolveMemoryConfig, resolveSkillDirs, resolveStateConfig, slugifyStorageComponent };

package/dist/index.js

@@ -1529,11 +1529,17 @@ export default {
     },
   },
 
-  // Telemetry destination
+  // Telemetry destination \u2014 generic OTLP and/or Latitude
   telemetry: {
     enabled: true,
+    // Generic OTLP: string shorthand or { url, headers? } object
     otlp: process.env.OTEL_EXPORTER_OTLP_ENDPOINT,
-    // Or use Latitude (reads from LATITUDE_API_KEY and LATITUDE_PROJECT_ID env vars by default)
+    // With auth headers (Honeycomb, Grafana Cloud, etc.):
+    // otlp: {
+    //   url: 'https://api.honeycomb.io/v1/traces',
+    //   headers: { 'x-honeycomb-team': process.env.HONEYCOMB_API_KEY },
+    // },
+    // Latitude (reads from LATITUDE_API_KEY and LATITUDE_PROJECT_ID env vars by default)
     latitude: {
       // apiKeyEnv: 'LATITUDE_API_KEY',       // default
       // projectIdEnv: 'LATITUDE_PROJECT_ID', // default
@@ -1606,7 +1612,7 @@ Remote storage keys are namespaced and versioned, for example \`poncho:v1:<agent
 | \`PONCHO_AUTH_TOKEN\` | No | Unified auth token (Web UI passphrase + API Bearer token) |
 | \`PONCHO_INTERNAL_SECRET\` | No | Shared secret used by internal serverless callbacks (recommended for Vercel/Lambda) |
 | \`PONCHO_SELF_BASE_URL\` | No | Explicit base URL for internal self-callbacks when auto-detection is unavailable |
-| \`OTEL_EXPORTER_OTLP_ENDPOINT\` | No | Telemetry destination |
+| \`OTEL_EXPORTER_OTLP_ENDPOINT\` | No | OTLP trace endpoint (Jaeger, Tempo, Honeycomb, etc.) |
 | \`LATITUDE_API_KEY\` | No | Latitude dashboard integration |
 | \`LATITUDE_PROJECT_ID\` | No | Latitude project identifier for capture traces |
 | \`LATITUDE_PATH\` | No | Latitude prompt path for grouping traces |
@@ -1641,23 +1647,45 @@ Logs print to console:
 [event] run:completed {"type":"run:completed","runId":"run_abc123","result":{"status":"completed","response":"...","steps":3,"tokens":{"input":1500,"output":840}}}
 \`\`\`
 
-### Production telemetry
+### Production telemetry (generic OTLP)
 
-Send events to your observability stack:
+Send full OpenTelemetry traces (agent runs, LLM calls, tool executions) to any
+OTLP-compatible collector \u2014 Jaeger, Grafana Tempo, Honeycomb, Datadog, etc.
 
 \`\`\`bash
-# Environment variable
-OTEL_EXPORTER_OTLP_ENDPOINT=https://otel.example.com
+# Simple: just a URL
+OTEL_EXPORTER_OTLP_ENDPOINT=https://otel.example.com/v1/traces
 \`\`\`
 
-Or configure in code:
+\`\`\`javascript
+// poncho.config.js \u2014 string shorthand
+export default {
+  telemetry: {
+    otlp: 'https://otel.example.com/v1/traces',
+  }
+}
+\`\`\`
+
+\`\`\`javascript
+// poncho.config.js \u2014 with auth headers (Honeycomb, Grafana Cloud, etc.)
+export default {
+  telemetry: {
+    otlp: {
+      url: 'https://api.honeycomb.io/v1/traces',
+      headers: {
+        'x-honeycomb-team': process.env.HONEYCOMB_API_KEY,
+      },
+    },
+  }
+}
+\`\`\`
+
+You can also use a custom event handler for non-OTLP destinations:
 
 \`\`\`javascript
 // poncho.config.js
 export default {
   telemetry: {
-    otlp: 'https://otel.example.com',
-    // Or custom handler
     handler: async (event) => {
       await sendToMyLoggingService(event)
     }
@@ -1687,6 +1715,8 @@ telemetry: {
 }
 \`\`\`
 
+Both \`otlp\` and \`latitude\` can be configured simultaneously \u2014 all spans flow to both destinations.
+
 ## Security
 
 ### Protect your endpoint
@@ -4087,7 +4117,8 @@ var createSkillTools = (skills, options) => {
                 error: `Unknown skill: "${name}". Available skills: ${knownNames}`
               };
             }
-            const resolved2 = resolveScriptPath(skill.skillDir, script);
+            const projectRoot = options?.workingDir ?? process.cwd();
+            const resolved2 = resolveScriptPath(skill.skillDir, script, projectRoot);
             if (options?.isScriptAllowed && !options.isScriptAllowed(name, resolved2.relativePath)) {
               return {
                 error: `Script "${resolved2.relativePath}" for skill "${name}" is not allowed by policy.`
@@ -4175,7 +4206,7 @@ var collectScriptFiles = async (directory) => {
 var normalizeScriptPolicyPath = (relativePath) => {
   const trimmed = relativePath.trim();
   const normalized = normalize2(trimmed).split(sep2).join("/");
-  if (normalized.startsWith("..") || normalized.startsWith("/")) {
+  if (normalized.startsWith("/")) {
     throw new Error("Script path must be relative and within the allowed directory");
   }
   const withoutDotPrefix = normalized.startsWith("./") ? normalized.slice(2) : normalized;
@@ -4184,10 +4215,11 @@ var normalizeScriptPolicyPath = (relativePath) => {
   }
   return withoutDotPrefix;
 };
-var resolveScriptPath = (baseDir, relativePath) => {
+var resolveScriptPath = (baseDir, relativePath, containmentDir) => {
   const normalized = normalizeScriptPolicyPath(relativePath);
   const fullPath = resolve9(baseDir, normalized);
-  if (!fullPath.startsWith(`${resolve9(baseDir)}${sep2}`) && fullPath !== resolve9(baseDir)) {
+  const boundary = resolve9(containmentDir ?? baseDir);
+  if (!fullPath.startsWith(`${boundary}${sep2}`) && fullPath !== boundary) {
     throw new Error("Script path must stay inside the allowed directory");
   }
   const extension = extname(fullPath).toLowerCase();
@@ -4579,6 +4611,78 @@ var createSubagentTools = (manager) => [
 
 // src/harness.ts
 import { LatitudeTelemetry } from "@latitude-data/telemetry";
+import { trace, context as otelContext, SpanStatusCode } from "@opentelemetry/api";
+import { NodeTracerProvider, BatchSpanProcessor } from "@opentelemetry/sdk-trace-node";
+import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
+
+// src/telemetry.ts
+var MAX_FIELD_LENGTH = 200;
+function sanitizeEventForLog(event) {
+  return JSON.stringify(event, (_key, value) => {
+    if (typeof value === "string" && value.length > MAX_FIELD_LENGTH) {
+      return `${value.slice(0, 80)}...[${value.length} chars]`;
+    }
+    return value;
+  });
+}
+function normalizeOtlp(opt) {
+  if (!opt) return void 0;
+  if (typeof opt === "string") return opt ? { url: opt } : void 0;
+  return opt.url ? opt : void 0;
+}
+var TelemetryEmitter = class {
+  config;
+  constructor(config) {
+    this.config = config;
+  }
+  async emit(event) {
+    if (this.config?.enabled === false) {
+      return;
+    }
+    if (this.config?.handler) {
+      await this.config.handler(event);
+      return;
+    }
+    const otlp = normalizeOtlp(this.config?.otlp);
+    if (otlp) {
+      await this.sendOtlp(event, otlp);
+    }
+    process.stdout.write(`[event] ${event.type} ${sanitizeEventForLog(event)}
+`);
+  }
+  async sendOtlp(event, otlp) {
+    try {
+      await fetch(otlp.url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...otlp.headers },
+        body: JSON.stringify({
+          resourceLogs: [
+            {
+              scopeLogs: [
+                {
+                  logRecords: [
+                    {
+                      timeUnixNano: String(Date.now() * 1e6),
+                      severityText: "INFO",
+                      body: { stringValue: event.type },
+                      attributes: [
+                        {
+                          key: "event.payload",
+                          value: { stringValue: JSON.stringify(event) }
+                        }
+                      ]
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        })
+      });
+    } catch {
+    }
+  }
+};
 
 // src/tool-dispatcher.ts
 var ToolDispatcher = class {
@@ -5111,6 +5215,9 @@ var AgentHarness = class _AgentHarness {
   activeSkillNames = /* @__PURE__ */ new Set();
   registeredMcpToolNames = /* @__PURE__ */ new Set();
   latitudeTelemetry;
+  otlpSpanProcessor;
+  otlpTracerProvider;
+  hasOtlpExporter = false;
   insideTelemetryCapture = false;
   _browserSession;
   _browserMod;
@@ -5325,10 +5432,15 @@ var AgentHarness = class _AgentHarness {
       if (!rawScript) {
         return false;
       }
-      const canonicalPath = normalizeRelativeScriptPattern(
-        `./${normalizeScriptPolicyPath(rawScript)}`,
-        "run_skill_script input.script"
-      );
+      let canonicalPath;
+      try {
+        canonicalPath = normalizeRelativeScriptPattern(
+          `./${normalizeScriptPolicyPath(rawScript)}`,
+          "run_skill_script input.script"
+        );
+      } catch {
+        return true;
+      }
       const scriptPatterns = this.getRequestedScriptApprovalPatterns();
       return scriptPatterns.some(
         (pattern) => matchesRelativeScriptPattern(canonicalPath, pattern)
@@ -5553,6 +5665,31 @@ var AgentHarness = class _AgentHarness {
         `[poncho][telemetry] Latitude telemetry is configured but missing: ${missing.join(", ")}. Traces will NOT be sent.`
       );
     }
+    const otlpConfig = telemetryEnabled ? normalizeOtlp(config?.telemetry?.otlp) : void 0;
+    if (otlpConfig) {
+      const exporter = new OTLPTraceExporter({
+        url: otlpConfig.url,
+        headers: otlpConfig.headers
+      });
+      const processor = new BatchSpanProcessor(exporter);
+      this.otlpSpanProcessor = processor;
+      if (this.latitudeTelemetry) {
+        const globalProvider = trace.getTracerProvider();
+        const delegate = globalProvider.getDelegate?.() ?? globalProvider;
+        if (typeof delegate.addSpanProcessor === "function") {
+          delegate.addSpanProcessor(processor);
+        }
+        console.info(`[poncho][telemetry] OTLP exporter added (piggybacking on Latitude provider) \u2192 ${otlpConfig.url}`);
+      } else {
+        const provider2 = new NodeTracerProvider({
+          spanProcessors: [processor]
+        });
+        provider2.register();
+        this.otlpTracerProvider = provider2;
+        console.info(`[poncho][telemetry] OTLP exporter active (standalone provider) \u2192 ${otlpConfig.url}`);
+      }
+      this.hasOtlpExporter = true;
+    }
   }
   async buildBrowserStoragePersistence(config, sessionId) {
     const provider = config.storage?.provider ?? config.state?.provider ?? "local";
@@ -5703,13 +5840,31 @@ var AgentHarness = class _AgentHarness {
       });
       this.latitudeTelemetry = void 0;
     }
+    if (this.otlpSpanProcessor) {
+      await this.otlpSpanProcessor.shutdown().catch((err) => {
+        console.warn(
+          `[poncho][telemetry] OTLP span processor shutdown error: ${err instanceof Error ? err.message : String(err)}`
+        );
+      });
+      this.otlpSpanProcessor = void 0;
+    }
+    if (this.otlpTracerProvider) {
+      await this.otlpTracerProvider.shutdown().catch((err) => {
+        console.warn(
+          `[poncho][telemetry] OTLP tracer provider shutdown error: ${err instanceof Error ? err.message : String(err)}`
+        );
+      });
+      this.otlpTracerProvider = void 0;
+    }
+    this.hasOtlpExporter = false;
   }
   listTools() {
     return this.dispatcher.list();
   }
   /**
-   * Wraps the run() generator with Latitude telemetry capture for complete trace coverage
-   * Streams events in real-time using an event queue pattern
+   * Wraps the run() generator with telemetry capture for complete trace coverage.
+   * Supports Latitude, generic OTLP, or both simultaneously.
+   * Streams events in real-time using an event queue pattern.
    */
   async *runWithTelemetry(input) {
     const config = this.loadedConfig;
@@ -5776,6 +5931,39 @@ var AgentHarness = class _AgentHarness {
           }
         }
       }
+    } else if (this.hasOtlpExporter) {
+      const tracer = trace.getTracer("poncho");
+      const agentName = this.parsedAgent?.frontmatter.name ?? "agent";
+      const rootSpan = tracer.startSpan(`agent.run ${agentName}`);
+      rootSpan.setAttribute("poncho.agent.name", agentName);
+      if (input.conversationId) {
+        rootSpan.setAttribute("poncho.conversation.id", input.conversationId);
+      }
+      const spanContext = trace.setSpan(otelContext.active(), rootSpan);
+      this.insideTelemetryCapture = true;
+      try {
+        const gen = this.run(input);
+        let next;
+        do {
+          next = await otelContext.with(spanContext, () => gen.next());
+          if (!next.done) yield next.value;
+        } while (!next.done);
+        rootSpan.setStatus({ code: SpanStatusCode.OK });
+      } catch (error) {
+        rootSpan.setStatus({
+          code: SpanStatusCode.ERROR,
+          message: error instanceof Error ? error.message : String(error)
+        });
+        rootSpan.recordException(error instanceof Error ? error : new Error(String(error)));
+        throw error;
+      } finally {
+        this.insideTelemetryCapture = false;
+        rootSpan.end();
+        try {
+          await this.otlpSpanProcessor?.forceFlush();
+        } catch {
+        }
+      }
     } else {
       yield* this.run(input);
     }
@@ -6264,7 +6452,7 @@ ${textContent}` };
           abortSignal: input.abortSignal,
           ...typeof maxTokens === "number" ? { maxTokens } : {},
           experimental_telemetry: {
-            isEnabled: telemetryEnabled && !!this.latitudeTelemetry,
+            isEnabled: telemetryEnabled && !!(this.latitudeTelemetry || this.hasOtlpExporter),
             recordInputs: true,
             recordOutputs: true
           }
@@ -6435,6 +6623,13 @@ ${textContent}` };
               `[poncho][harness] Model "${modelName}" returned an empty response with finishReason="stop" on step ${step}.`
             );
           }
+          if (fullText.length > 0) {
+            messages.push({
+              role: "assistant",
+              content: fullText,
+              metadata: { timestamp: now(), id: randomUUID3(), step }
+            });
+          }
           responseText = fullText;
           yield pushEvent({
             type: "step:completed",
@@ -6452,7 +6647,8 @@ ${textContent}` };
             },
             duration: now() - start,
             contextTokens: latestContextTokens + toolOutputEstimateSinceModel,
-            contextWindow
+            contextWindow,
+            continuationMessages: [...messages]
           };
           yield pushEvent({ type: "run:completed", runId, result: result2 });
           return;
@@ -6548,8 +6744,66 @@ ${textContent}` };
               })
             );
           }
+        } else if (this.insideTelemetryCapture && this.hasOtlpExporter) {
+          const tracer = trace.getTracer("poncho");
+          for (const call of approvedCalls) {
+            const span = tracer.startSpan(`tool ${call.name}`, {
+              attributes: {
+                "poncho.tool.name": call.name,
+                "poncho.tool.call_id": call.id,
+                "poncho.tool.arguments": JSON.stringify(call.input)
+              }
+            });
+            toolSpans.set(call.id, {
+              end(opts) {
+                if (opts.result.isError) {
+                  span.setStatus({ code: SpanStatusCode.ERROR, message: String(opts.result.value) });
+                } else {
+                  span.setStatus({ code: SpanStatusCode.OK });
+                }
+                span.end();
+              }
+            });
+          }
+        }
+        const TOOL_DEADLINE_SENTINEL = /* @__PURE__ */ Symbol("tool_deadline");
+        const toolDeadlineRemainingMs = softDeadlineMs > 0 ? softDeadlineMs - (now() - start) : Infinity;
+        let batchResults;
+        if (approvedCalls.length === 0) {
+          batchResults = [];
+        } else if (toolDeadlineRemainingMs <= 0) {
+          batchResults = TOOL_DEADLINE_SENTINEL;
+        } else if (toolDeadlineRemainingMs < Infinity) {
+          const raced = await Promise.race([
+            this.dispatcher.executeBatch(approvedCalls, toolContext),
+            new Promise(
+              (resolve12) => setTimeout(() => resolve12(TOOL_DEADLINE_SENTINEL), toolDeadlineRemainingMs)
+            )
+          ]);
+          if (raced === TOOL_DEADLINE_SENTINEL) {
+            batchResults = TOOL_DEADLINE_SENTINEL;
+          } else {
+            batchResults = raced;
+          }
+        } else {
+          batchResults = await this.dispatcher.executeBatch(approvedCalls, toolContext);
+        }
+        if (batchResults === TOOL_DEADLINE_SENTINEL) {
+          const result_ = {
+            status: "completed",
+            response: responseText + fullText,
+            steps: step,
+            tokens: { input: totalInputTokens, output: totalOutputTokens, cached: totalCachedTokens },
+            duration: now() - start,
+            continuation: true,
+            continuationMessages: [...messages],
+            maxSteps,
+            contextTokens: latestContextTokens + toolOutputEstimateSinceModel,
+            contextWindow
+          };
+          yield pushEvent({ type: "run:completed", runId, result: result_ });
+          return;
         }
-        const batchResults = approvedCalls.length > 0 ? await this.dispatcher.executeBatch(approvedCalls, toolContext) : [];
         if (isCancelled()) {
           yield emitCancellation();
           return;
@@ -6637,6 +6891,22 @@ ${textContent}` };
           content: JSON.stringify(toolResultsForModel),
           metadata: toolMsgMeta
         });
+        if (softDeadlineMs > 0 && now() - start > softDeadlineMs) {
+          const result_ = {
+            status: "completed",
+            response: responseText + fullText,
+            steps: step,
+            tokens: { input: totalInputTokens, output: totalOutputTokens, cached: totalCachedTokens },
+            duration: now() - start,
+            continuation: true,
+            continuationMessages: [...messages],
+            maxSteps,
+            contextTokens: latestContextTokens + toolOutputEstimateSinceModel,
+            contextWindow
+          };
+          yield pushEvent({ type: "run:completed", runId, result: result_ });
+          return;
+        }
         if (this.environment === "development") {
           const agentChanged = await this.refreshAgentIfChanged();
           const skillsChanged = await this.refreshSkillsIfChanged(true);
@@ -8006,73 +8276,6 @@ var createConversationStore = (config, options) => {
   return new InMemoryConversationStore(ttl);
 };
 
-// src/telemetry.ts
-var MAX_FIELD_LENGTH = 200;
-function sanitizeEventForLog(event) {
-  return JSON.stringify(event, (_key, value) => {
-    if (typeof value === "string" && value.length > MAX_FIELD_LENGTH) {
-      return `${value.slice(0, 80)}...[${value.length} chars]`;
-    }
-    return value;
-  });
-}
-var TelemetryEmitter = class {
-  config;
-  constructor(config) {
-    this.config = config;
-  }
-  async emit(event) {
-    if (this.config?.enabled === false) {
-      return;
-    }
-    if (this.config?.handler) {
-      await this.config.handler(event);
-      return;
-    }
-    if (this.config?.otlp) {
-      await this.sendOtlp(event);
-    }
-    process.stdout.write(`[event] ${event.type} ${sanitizeEventForLog(event)}
-`);
-  }
-  async sendOtlp(event) {
-    const endpoint = this.config?.otlp;
-    if (!endpoint) {
-      return;
-    }
-    try {
-      await fetch(endpoint, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          resourceLogs: [
-            {
-              scopeLogs: [
-                {
-                  logRecords: [
-                    {
-                      timeUnixNano: String(Date.now() * 1e6),
-                      severityText: "INFO",
-                      body: { stringValue: event.type },
-                      attributes: [
-                        {
-                          key: "event.payload",
-                          value: { stringValue: JSON.stringify(event) }
-                        }
-                      ]
-                    }
-                  ]
-                }
-              ]
-            }
-          ]
-        })
-      });
-    } catch {
-    }
-  }
-};
-
 // src/index.ts
 import { defineTool as defineTool7 } from "@poncho-ai/sdk";
 export {
@@ -8120,6 +8323,7 @@ export {
   loadSkillContext,
   loadSkillInstructions,
   loadSkillMetadata,
+  normalizeOtlp,
   normalizeScriptPolicyPath,
   parseAgentFile,
   parseAgentMarkdown,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poncho-ai/harness",
-  "version": "0.28.2",
+  "version": "0.29.0",
   "description": "Agent execution runtime - conversation loop, tool dispatch, streaming",
   "repository": {
     "type": "git",
@@ -25,6 +25,8 @@
     "@aws-sdk/client-dynamodb": "^3.988.0",
     "@latitude-data/telemetry": "^2.0.4",
     "@opentelemetry/api": "1.9.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.213.0",
+    "@opentelemetry/sdk-trace-node": "^2.6.0",
     "ai": "^6.0.86",
     "cheerio": "^1.2.0",
     "jiti": "^2.6.1",
@@ -32,7 +34,7 @@
     "redis": "^5.10.0",
     "yaml": "^2.4.0",
     "zod": "^3.22.0",
-    "@poncho-ai/sdk": "1.6.1"
+    "@poncho-ai/sdk": "1.6.2"
   },
   "devDependencies": {
     "@types/mustache": "^4.2.6",

package/src/config.ts

@@ -104,7 +104,10 @@ export interface PonchoConfig extends McpConfig {
   };
   telemetry?: {
     enabled?: boolean;
-    otlp?: string;
+    otlp?: string | {
+      url: string;
+      headers?: Record<string, string>;
+    };
     latitude?: {
       apiKeyEnv?: string;
       projectIdEnv?: string;

package/src/harness.ts

@@ -36,6 +36,10 @@ import { createSearchTools } from "./search-tools.js";
 import { createSubagentTools } from "./subagent-tools.js";
 import type { SubagentManager } from "./subagent-manager.js";
 import { LatitudeTelemetry } from "@latitude-data/telemetry";
+import { trace, context as otelContext, SpanStatusCode } from "@opentelemetry/api";
+import { NodeTracerProvider, BatchSpanProcessor } from "@opentelemetry/sdk-trace-node";
+import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
+import { normalizeOtlp } from "./telemetry.js";
 import {
   isSiblingScriptsPattern,
   matchesRelativeScriptPattern,
@@ -560,6 +564,9 @@ export class AgentHarness {
   private readonly activeSkillNames = new Set<string>();
   private readonly registeredMcpToolNames = new Set<string>();
   private latitudeTelemetry?: LatitudeTelemetry;
+  private otlpSpanProcessor?: BatchSpanProcessor;
+  private otlpTracerProvider?: NodeTracerProvider;
+  private hasOtlpExporter = false;
   private insideTelemetryCapture = false;
   private _browserSession?: unknown;
   private _browserMod?: {
@@ -812,10 +819,15 @@ export class AgentHarness {
       if (!rawScript) {
         return false;
       }
-      const canonicalPath = normalizeRelativeScriptPattern(
-        `./${normalizeScriptPolicyPath(rawScript)}`,
-        "run_skill_script input.script",
-      );
+      let canonicalPath: string;
+      try {
+        canonicalPath = normalizeRelativeScriptPattern(
+          `./${normalizeScriptPolicyPath(rawScript)}`,
+          "run_skill_script input.script",
+        );
+      } catch {
+        return true;
+      }
       const scriptPatterns = this.getRequestedScriptApprovalPatterns();
       return scriptPatterns.some((pattern) =>
         matchesRelativeScriptPattern(canonicalPath, pattern),
@@ -1074,6 +1086,37 @@ export class AgentHarness {
         `[poncho][telemetry] Latitude telemetry is configured but missing: ${missing.join(", ")}. Traces will NOT be sent.`,
       );
     }
+
+    // Generic OTLP trace exporter — works alongside or instead of Latitude.
+    const otlpConfig = telemetryEnabled ? normalizeOtlp(config?.telemetry?.otlp) : undefined;
+    if (otlpConfig) {
+      const exporter = new OTLPTraceExporter({
+        url: otlpConfig.url,
+        headers: otlpConfig.headers,
+      });
+      const processor = new BatchSpanProcessor(exporter);
+      this.otlpSpanProcessor = processor;
+
+      if (this.latitudeTelemetry) {
+        // Latitude already registered a global TracerProvider (v1.x) — add our
+        // processor to it so every span flows to both destinations.
+        const globalProvider = trace.getTracerProvider();
+        const delegate = (globalProvider as unknown as { getDelegate?: () => unknown })
+          .getDelegate?.() ?? globalProvider;
+        if (typeof (delegate as Record<string, unknown>).addSpanProcessor === "function") {
+          (delegate as unknown as { addSpanProcessor(p: BatchSpanProcessor): void }).addSpanProcessor(processor);
+        }
+        console.info(`[poncho][telemetry] OTLP exporter added (piggybacking on Latitude provider) → ${otlpConfig.url}`);
+      } else {
+        const provider = new NodeTracerProvider({
+          spanProcessors: [processor],
+        });
+        provider.register();
+        this.otlpTracerProvider = provider;
+        console.info(`[poncho][telemetry] OTLP exporter active (standalone provider) → ${otlpConfig.url}`);
+      }
+      this.hasOtlpExporter = true;
+    }
   }
 
   private async buildBrowserStoragePersistence(
@@ -1245,6 +1288,27 @@ export class AgentHarness {
       });
       this.latitudeTelemetry = undefined;
     }
+    if (this.otlpSpanProcessor) {
+      await this.otlpSpanProcessor.shutdown().catch((err) => {
+        console.warn(
+          `[poncho][telemetry] OTLP span processor shutdown error: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+      });
+      this.otlpSpanProcessor = undefined;
+    }
+    if (this.otlpTracerProvider) {
+      await this.otlpTracerProvider.shutdown().catch((err) => {
+        console.warn(
+          `[poncho][telemetry] OTLP tracer provider shutdown error: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+      });
+      this.otlpTracerProvider = undefined;
+    }
+    this.hasOtlpExporter = false;
   }
 
   listTools(): ToolDefinition[] {
@@ -1252,18 +1316,20 @@ export class AgentHarness {
   }
 
   /**
-   * Wraps the run() generator with Latitude telemetry capture for complete trace coverage
-   * Streams events in real-time using an event queue pattern
+   * Wraps the run() generator with telemetry capture for complete trace coverage.
+   * Supports Latitude, generic OTLP, or both simultaneously.
+   * Streams events in real-time using an event queue pattern.
    */
   async *runWithTelemetry(input: RunInput): AsyncGenerator<AgentEvent> {
     const config = this.loadedConfig;
     const telemetry = this.latitudeTelemetry;
 
     if (telemetry) {
+      // Latitude capture path — wraps run() inside telemetry.capture().
+      // If OTLP is also configured, spans flow to both via the shared provider.
       const latProjectIdEnv2 = config?.telemetry?.latitude?.projectIdEnv ?? "LATITUDE_PROJECT_ID";
       const projectId = parseInt(process.env[latProjectIdEnv2] ?? "", 10) as number;
       const rawPath = config?.telemetry?.latitude?.path ?? this.parsedAgent?.frontmatter.name ?? 'agent';
-      // Sanitize path for Latitude's DOCUMENT_PATH_REGEXP: /^([\w-]+\/)*([\w-.])+$/
       const path = rawPath.replace(/[^\w\-./]/g, '-').replace(/-+/g, '-').replace(/^-+|-+$/g, '') || 'agent';
 
       const rawConversationId = input.conversationId ?? (
@@ -1271,7 +1337,6 @@ export class AgentHarness {
           ? input.parameters.__activeConversationId
           : undefined
       );
-      // Latitude expects a UUID v4 for documentLogUuid; only pass it if valid
       const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
       const conversationUuid = rawConversationId && UUID_RE.test(rawConversationId)
         ? rawConversationId
@@ -1281,13 +1346,11 @@ export class AgentHarness {
         `[poncho][telemetry] Latitude telemetry active – projectId=${projectId}, path="${path}"${conversationUuid ? `, conversation="${conversationUuid}"` : ""}`,
       );
 
-      // Event queue for streaming events in real-time
       const eventQueue: AgentEvent[] = [];
       let queueResolve: ((value: void) => void) | null = null;
       let generatorDone = false;
       let generatorError: Error | null = null;
 
-      // Start the generator inside telemetry.capture() (runs in background)
       const capturePromise = telemetry.capture({ projectId, path, conversationUuid }, async () => {
         this.insideTelemetryCapture = true;
         try {
@@ -1311,13 +1374,11 @@ export class AgentHarness {
         }
       });
 
-      // Yield events from the queue as they arrive
       try {
         while (!generatorDone || eventQueue.length > 0) {
           if (eventQueue.length > 0) {
             yield eventQueue.shift()!;
           } else if (!generatorDone) {
-            // Wait for next event
             await new Promise<void>((resolve) => {
               queueResolve = resolve;
             });
@@ -1339,8 +1400,47 @@ export class AgentHarness {
           }
         }
       }
+    } else if (this.hasOtlpExporter) {
+      // Standalone OTLP path — create a root span for the agent run so all
+      // child spans (LLM calls via Vercel AI SDK, tool spans) are grouped
+      // under a single trace.
+      const tracer = trace.getTracer("poncho");
+      const agentName = this.parsedAgent?.frontmatter.name ?? "agent";
+
+      const rootSpan = tracer.startSpan(`agent.run ${agentName}`);
+      rootSpan.setAttribute("poncho.agent.name", agentName);
+      if (input.conversationId) {
+        rootSpan.setAttribute("poncho.conversation.id", input.conversationId);
+      }
+
+      // Bind the root span's context so every async step (including
+      // streamText and tool calls) sees it as the parent span.
+      const spanContext = trace.setSpan(otelContext.active(), rootSpan);
+      this.insideTelemetryCapture = true;
+
+      try {
+        const gen = this.run(input);
+        let next: IteratorResult<AgentEvent>;
+        do {
+          next = await otelContext.with(spanContext, () => gen.next());
+          if (!next.done) yield next.value;
+        } while (!next.done);
+        rootSpan.setStatus({ code: SpanStatusCode.OK });
+      } catch (error) {
+        rootSpan.setStatus({
+          code: SpanStatusCode.ERROR,
+          message: error instanceof Error ? error.message : String(error),
+        });
+        rootSpan.recordException(error instanceof Error ? error : new Error(String(error)));
+        throw error;
+      } finally {
+        this.insideTelemetryCapture = false;
+        rootSpan.end();
+        try {
+          await this.otlpSpanProcessor?.forceFlush();
+        } catch { /* best-effort */ }
+      }
     } else {
-      // No telemetry configured, just pass through
       yield* this.run(input);
     }
   }
@@ -1936,7 +2036,7 @@ ${boundedMainMemory.trim()}`
           abortSignal: input.abortSignal,
           ...(typeof maxTokens === "number" ? { maxTokens } : {}),
           experimental_telemetry: {
-            isEnabled: telemetryEnabled && !!this.latitudeTelemetry,
+            isEnabled: telemetryEnabled && !!(this.latitudeTelemetry || this.hasOtlpExporter),
             recordInputs: true,
             recordOutputs: true,
           },
@@ -2133,6 +2233,13 @@ ${boundedMainMemory.trim()}`
             `[poncho][harness] Model "${modelName}" returned an empty response with finishReason="stop" on step ${step}.`,
           );
         }
+        if (fullText.length > 0) {
+          messages.push({
+            role: "assistant",
+            content: fullText,
+            metadata: { timestamp: now(), id: randomUUID(), step },
+          });
+        }
         responseText = fullText;
         yield pushEvent({
           type: "step:completed",
@@ -2151,6 +2258,7 @@ ${boundedMainMemory.trim()}`
           duration: now() - start,
           contextTokens: latestContextTokens + toolOutputEstimateSinceModel,
           contextWindow,
+          continuationMessages: [...messages],
         };
         yield pushEvent({ type: "run:completed", runId, result });
         return;
@@ -2270,7 +2378,7 @@ ${boundedMainMemory.trim()}`
         return;
       }
 
-      // Create telemetry tool spans so tool calls appear in Latitude traces
+      // Create telemetry tool spans so tool calls appear in traces
       type ToolSpanHandle = { end: (opts: { result: { value: unknown; isError: boolean } }) => void };
       const toolSpans = new Map<string, ToolSpanHandle>();
       if (this.insideTelemetryCapture && this.latitudeTelemetry) {
@@ -2283,12 +2391,76 @@ ${boundedMainMemory.trim()}`
             }),
           );
         }
+      } else if (this.insideTelemetryCapture && this.hasOtlpExporter) {
+        const tracer = trace.getTracer("poncho");
+        for (const call of approvedCalls) {
+          const span = tracer.startSpan(`tool ${call.name}`, {
+            attributes: {
+              "poncho.tool.name": call.name,
+              "poncho.tool.call_id": call.id,
+              "poncho.tool.arguments": JSON.stringify(call.input),
+            },
+          });
+          toolSpans.set(call.id, {
+            end(opts: { result: { value: unknown; isError: boolean } }) {
+              if (opts.result.isError) {
+                span.setStatus({ code: SpanStatusCode.ERROR, message: String(opts.result.value) });
+              } else {
+                span.setStatus({ code: SpanStatusCode.OK });
+              }
+              span.end();
+            },
+          });
+        }
       }
 
-      const batchResults =
-        approvedCalls.length > 0
-          ? await this.dispatcher.executeBatch(approvedCalls, toolContext)
-          : [];
+      // Race tool execution against the soft deadline so long-running tool
+      // batches (e.g. 4 parallel web_search calls) can't push us past the
+      // hard platform timeout.  If the deadline fires first, we checkpoint
+      // with the pre-tool messages and the step will be re-done on
+      // continuation (assistant + tool results are not yet in `messages`).
+      const TOOL_DEADLINE_SENTINEL = Symbol("tool_deadline");
+      const toolDeadlineRemainingMs = softDeadlineMs > 0
+        ? softDeadlineMs - (now() - start)
+        : Infinity;
+
+      let batchResults: Awaited<ReturnType<typeof this.dispatcher.executeBatch>>;
+      if (approvedCalls.length === 0) {
+        batchResults = [];
+      } else if (toolDeadlineRemainingMs <= 0) {
+        batchResults = TOOL_DEADLINE_SENTINEL as never;
+      } else if (toolDeadlineRemainingMs < Infinity) {
+        const raced = await Promise.race([
+          this.dispatcher.executeBatch(approvedCalls, toolContext),
+          new Promise<typeof TOOL_DEADLINE_SENTINEL>((resolve) =>
+            setTimeout(() => resolve(TOOL_DEADLINE_SENTINEL), toolDeadlineRemainingMs),
+          ),
+        ]);
+        if (raced === TOOL_DEADLINE_SENTINEL) {
+          batchResults = TOOL_DEADLINE_SENTINEL as never;
+        } else {
+          batchResults = raced;
+        }
+      } else {
+        batchResults = await this.dispatcher.executeBatch(approvedCalls, toolContext);
+      }
+
+      if ((batchResults as unknown) === TOOL_DEADLINE_SENTINEL) {
+        const result_: RunResult = {
+          status: "completed",
+          response: responseText + fullText,
+          steps: step,
+          tokens: { input: totalInputTokens, output: totalOutputTokens, cached: totalCachedTokens },
+          duration: now() - start,
+          continuation: true,
+          continuationMessages: [...messages],
+          maxSteps,
+          contextTokens: latestContextTokens + toolOutputEstimateSinceModel,
+          contextWindow,
+        };
+        yield pushEvent({ type: "run:completed", runId, result: result_ });
+        return;
+      }
 
       if (isCancelled()) {
         yield emitCancellation();
@@ -2386,6 +2558,26 @@ ${boundedMainMemory.trim()}`
         metadata: toolMsgMeta as Message["metadata"],
       });
 
+      // Post-tool-execution soft deadline: long-running tool batches (e.g.
+      // multiple web_search calls) can push past the deadline. Checkpoint
+      // now so the platform doesn't hard-kill us before we can continue.
+      if (softDeadlineMs > 0 && now() - start > softDeadlineMs) {
+        const result_: RunResult = {
+          status: "completed",
+          response: responseText + fullText,
+          steps: step,
+          tokens: { input: totalInputTokens, output: totalOutputTokens, cached: totalCachedTokens },
+          duration: now() - start,
+          continuation: true,
+          continuationMessages: [...messages],
+          maxSteps,
+          contextTokens: latestContextTokens + toolOutputEstimateSinceModel,
+          contextWindow,
+        };
+        yield pushEvent({ type: "run:completed", runId, result: result_ });
+        return;
+      }
+
         // In development, re-read AGENT.md and re-scan skills after tool
         // execution so changes are available on the next step without
         // requiring a server restart.

package/src/skill-tools.ts

@@ -244,7 +244,8 @@ export const createSkillTools = (
                 error: `Unknown skill: "${name}". Available skills: ${knownNames}`,
               };
             }
-            const resolved = resolveScriptPath(skill.skillDir, script);
+            const projectRoot = options?.workingDir ?? process.cwd();
+            const resolved = resolveScriptPath(skill.skillDir, script, projectRoot);
             if (
               options?.isScriptAllowed &&
               !options.isScriptAllowed(name, resolved.relativePath)
@@ -357,7 +358,7 @@ const collectScriptFiles = async (directory: string): Promise<string[]> => {
 export const normalizeScriptPolicyPath = (relativePath: string): string => {
   const trimmed = relativePath.trim();
   const normalized = normalize(trimmed).split(sep).join("/");
-  if (normalized.startsWith("..") || normalized.startsWith("/")) {
+  if (normalized.startsWith("/")) {
     throw new Error("Script path must be relative and within the allowed directory");
   }
   const withoutDotPrefix = normalized.startsWith("./") ? normalized.slice(2) : normalized;
@@ -370,10 +371,12 @@ export const normalizeScriptPolicyPath = (relativePath: string): string => {
 const resolveScriptPath = (
   baseDir: string,
   relativePath: string,
+  containmentDir?: string,
 ): { fullPath: string; relativePath: string } => {
   const normalized = normalizeScriptPolicyPath(relativePath);
   const fullPath = resolve(baseDir, normalized);
-  if (!fullPath.startsWith(`${resolve(baseDir)}${sep}`) && fullPath !== resolve(baseDir)) {
+  const boundary = resolve(containmentDir ?? baseDir);
+  if (!fullPath.startsWith(`${boundary}${sep}`) && fullPath !== boundary) {
     throw new Error("Script path must stay inside the allowed directory");
   }
   const extension = extname(fullPath).toLowerCase();

package/src/state.ts

@@ -71,6 +71,11 @@ export interface Conversation {
   /** Harness-internal message chain preserved across continuation runs.
    *  Cleared when a run completes without continuation. */
   _continuationMessages?: Message[];
+  /** Full structured message chain from the last harness run, including
+   *  tool-call and tool-result messages the model needs for context.
+   *  Unlike `_continuationMessages`, this is always set after a run
+   *  and does NOT signal that a continuation is pending. */
+  _harnessMessages?: Message[];
   createdAt: number;
   updatedAt: number;
 }

package/src/telemetry.ts

@@ -11,9 +11,22 @@ function sanitizeEventForLog(event: AgentEvent): string {
   });
 }
 
+export interface OtlpConfig {
+  url: string;
+  headers?: Record<string, string>;
+}
+
+export type OtlpOption = string | OtlpConfig;
+
+export function normalizeOtlp(opt: OtlpOption | undefined): OtlpConfig | undefined {
+  if (!opt) return undefined;
+  if (typeof opt === "string") return opt ? { url: opt } : undefined;
+  return opt.url ? opt : undefined;
+}
+
 export interface TelemetryConfig {
   enabled?: boolean;
-  otlp?: string;
+  otlp?: OtlpOption;
   latitude?: {
     apiKeyEnv?: string;
     projectIdEnv?: string;
@@ -38,8 +51,9 @@ export class TelemetryEmitter {
       await this.config.handler(event);
       return;
     }
-    if (this.config?.otlp) {
-      await this.sendOtlp(event);
+    const otlp = normalizeOtlp(this.config?.otlp);
+    if (otlp) {
+      await this.sendOtlp(event, otlp);
     }
     // Latitude telemetry is handled by LatitudeTelemetry (from
     // @latitude-data/telemetry) via harness.runWithTelemetry().
@@ -48,15 +62,11 @@ export class TelemetryEmitter {
     process.stdout.write(`[event] ${event.type} ${sanitizeEventForLog(event)}\n`);
   }
 
-  private async sendOtlp(event: AgentEvent): Promise<void> {
-    const endpoint = this.config?.otlp;
-    if (!endpoint) {
-      return;
-    }
+  private async sendOtlp(event: AgentEvent, otlp: OtlpConfig): Promise<void> {
     try {
-      await fetch(endpoint, {
+      await fetch(otlp.url, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: { "Content-Type": "application/json", ...otlp.headers },
         body: JSON.stringify({
           resourceLogs: [
             {