@qvac/harness 0.2.9 → 0.2.10

package/dist-lib/lib/tools/skills/auth-resolver.js

@@ -60,49 +60,79 @@ export function parseAuth(v) {
     }
     return { ok: true, value: { type: 'bearer', tokenCredentialKey: key } };
 }
-export async function resolveAuth(auth, url, credentialStore, credentialAllowList, ctx) {
-    const key = auth.tokenCredentialKey;
-    if (!credentialStore)
-        return { error: 'credentials not configured' };
-    const entry = credentialAllowList?.[key];
-    if (!entry) {
+function grantedKeys(url, credentialAllowList) {
+    return Object.entries(credentialAllowList)
+        .filter(([, entry]) => urlAllowed(url, Array.isArray(entry) ? entry : [entry]))
+        .map(([key]) => key);
+}
+async function connectedCredentials(keys, credentialStore, ctx) {
+    const connected = [];
+    for (const key of keys) {
+        const record = credentialRecord(await credentialStore(key, ctx));
+        if (record)
+            connected.push({ token: record.token, key });
+    }
+    return connected;
+}
+function ambiguous(keys) {
+    return {
+        error: `multiple credentials match this URL; set auth.tokenCredentialKey to one of ${keys.join(', ')}`
+    };
+}
+async function resolveGuessedKey(key, url, credentialStore, credentialAllowList, ctx) {
+    const granted = grantedKeys(url, credentialAllowList);
+    if (granted.length === 0) {
         return {
-            error: `credential ${key} is not available here — load the skill that declares it first`
+            error: `unknown credential key ${key}; no loaded skill grants a credential for ${url.host} — omit auth, or load the skill that declares it`
         };
     }
+    const [first, ...rest] = await connectedCredentials(granted, credentialStore, ctx);
+    if (!first) {
+        return {
+            error: `unknown credential key ${key}; no connected credential for ${url.host} (${granted.join(', ')}). Tell the user to connect it in Skills; do not retry`
+        };
+    }
+    if (rest.length > 0)
+        return ambiguous([first, ...rest].map((c) => c.key));
+    return first;
+}
+async function resolveDeclaredKey(key, url, credentialStore, credentialAllowList, ctx) {
+    const entry = credentialAllowList?.[key];
+    if (!entry)
+        return null;
     const patterns = Array.isArray(entry) ? entry : [entry];
     if (!urlAllowed(url, patterns)) {
         return { error: `credential ${key} is not allowed for URL ${url.href}` };
     }
     const record = credentialRecord(await credentialStore(key, ctx));
-    if (!record)
-        return { error: `unknown credential: ${key}` };
-    return { token: record.token };
+    if (!record) {
+        return {
+            error: `credential ${key} is not connected for ${url.host}. Tell the user to connect it in Skills; do not retry`
+        };
+    }
+    return { token: record.token, key };
+}
+export async function resolveAuth(auth, url, credentialStore, credentialAllowList, ctx) {
+    const key = auth.tokenCredentialKey;
+    if (!credentialStore)
+        return { error: 'credentials not configured' };
+    return ((await resolveDeclaredKey(key, url, credentialStore, credentialAllowList, ctx)) ??
+        resolveGuessedKey(key, url, credentialStore, credentialAllowList ?? {}, ctx));
 }
 export async function resolveAutoAuth(url, credentialStore, credentialAllowList, ctx) {
     if (!credentialStore || !credentialAllowList)
         return null;
-    let selected = null;
-    for (const [key, entry] of Object.entries(credentialAllowList)) {
-        const patterns = Array.isArray(entry) ? entry : [entry];
-        if (!urlAllowed(url, patterns))
-            continue;
-        const record = credentialRecord(await credentialStore(key, ctx));
-        if (!record)
-            continue;
-        if (selected) {
-            return { error: 'multiple credentials match this URL; set auth.tokenCredentialKey' };
-        }
-        selected = { token: record.token, key };
-    }
-    return selected;
+    const connected = await connectedCredentials(grantedKeys(url, credentialAllowList), credentialStore, ctx);
+    if (connected.length > 1)
+        return ambiguous(connected.map((c) => c.key));
+    return connected[0] ?? null;
 }
 export async function resolveBearerHeader(auth, url, credentialStore, credentialAllowList, ctx, signal) {
     if (auth) {
         const resolved = await raceAbort(resolveAuth(auth, url, credentialStore, credentialAllowList, ctx), signal);
         if ('error' in resolved)
             return { error: resolved.error };
-        return { header: `Bearer ${resolved.token}`, credentialKey: auth.tokenCredentialKey };
+        return { header: `Bearer ${resolved.token}`, credentialKey: resolved.key };
     }
     const resolved = await raceAbort(resolveAutoAuth(url, credentialStore, credentialAllowList, ctx), signal);
     if (resolved && 'error' in resolved)
@@ -112,10 +142,10 @@ export async function resolveBearerHeader(auth, url, credentialStore, credential
         : { header: null };
 }
 export async function resolveRedirectBearerHeader(auth, url, credentialStore, credentialAllowList, ctx, signal) {
-    if (!auth)
+    if (!auth || !credentialStore)
         return { header: null };
-    const resolved = await raceAbort(resolveAuth(auth, url, credentialStore, credentialAllowList, ctx), signal);
-    return 'error' in resolved
+    const resolved = await raceAbort(resolveDeclaredKey(auth.tokenCredentialKey, url, credentialStore, credentialAllowList, ctx), signal);
+    return !resolved || 'error' in resolved
         ? { header: null }
-        : { header: `Bearer ${resolved.token}`, credentialKey: auth.tokenCredentialKey };
+        : { header: `Bearer ${resolved.token}`, credentialKey: resolved.key };
 }

package/dist-lib/lib/tools/toolsets.d.ts

@@ -4,5 +4,6 @@ export declare function asToolset(value?: string | null): Toolset | null;
 export interface ToolsetScoped {
     toolset?: string | null;
 }
+export declare const NETWORK_TOOLSETS: ReadonlyArray<Toolset>;
 export declare function permittedTools<T extends ToolsetScoped>(tools: ReadonlyArray<T>, disabled?: ReadonlyArray<string> | null): T[];
 export declare function toolsetEnabled(toolset: Toolset, disabled?: ReadonlyArray<string> | null): boolean;

package/dist-lib/lib/tools/toolsets.js

@@ -9,6 +9,7 @@ export const TOOLSETS = [
 export function asToolset(value) {
     return TOOLSETS.find((toolset) => toolset === value) ?? null;
 }
+export const NETWORK_TOOLSETS = ['web-search', 'http-request', 'mcp-call'];
 export function permittedTools(tools, disabled) {
     if (!disabled?.length)
         return [...tools];

package/dist-lib/lib/tools/weather-lookup.js

@@ -63,7 +63,7 @@ export function createWeatherLookupTool({ fetch: fetchImpl, resolveHost = lookup
                 if (/location not found/i.test(body))
                     return { content: notFound(location) };
                 if (response.status !== 200) {
-                    return { error: unavailable(`it answered HTTP ${response.status}`) };
+                    return { error: unavailable(`it answered HTTP ${response.status}`), code: 'transport' };
                 }
                 let json;
                 try {
@@ -91,9 +91,15 @@ export function createWeatherLookupTool({ fetch: fetchImpl, resolveHost = lookup
                 if (ctx?.signal?.aborted)
                     return { error: 'weather_lookup cancelled' };
                 if (controller.signal.aborted) {
-                    return { error: `weather_lookup timed out after ${LOOKUP_TIMEOUT_MS} ms` };
+                    return {
+                        error: `weather_lookup timed out after ${LOOKUP_TIMEOUT_MS} ms`,
+                        code: 'timeout'
+                    };
                 }
-                return { error: unavailable(err instanceof Error ? err.message : String(err)) };
+                return {
+                    error: unavailable(err instanceof Error ? err.message : String(err)),
+                    code: 'transport'
+                };
             }
             finally {
                 clearTimeout(timeout);

package/dist-lib/lib/tools/web-fetch.js

@@ -79,7 +79,10 @@ export function createWebFetchTool({ fetch: fetchImpl, resolveHost = lookupHost
                     return { error: got.error };
                 const { response, finalUrl: currentUrl } = got;
                 if (response.status < 200 || response.status >= 300) {
-                    return { error: `HTTP ${response.status} fetching ${currentUrl.toString()}` };
+                    return {
+                        error: `HTTP ${response.status} fetching ${currentUrl.toString()}`,
+                        status: response.status
+                    };
                 }
                 const rawBody = await response.text();
                 const body = rawBody.length > MAX_HTML_CHARS ? rawBody.slice(0, MAX_HTML_CHARS) : rawBody;
@@ -140,9 +143,9 @@ export function createWebFetchTool({ fetch: fetchImpl, resolveHost = lookupHost
                     return { error: 'web_fetch cancelled' };
                 }
                 if (controller.signal.aborted) {
-                    return { error: `${url.hostname} timed out after ${PAGE_TIMEOUT_MS}ms` };
+                    return { error: `${url.hostname} timed out after ${PAGE_TIMEOUT_MS}ms`, code: 'timeout' };
                 }
-                return { error: err instanceof Error ? err.message : String(err) };
+                return { error: err instanceof Error ? err.message : String(err), code: 'transport' };
             }
             finally {
                 clearTimeout(timeout);

package/dist-lib/lib/tools/web-search.js

@@ -43,12 +43,15 @@ export function createWebSearchTool({ fetch } = {}) {
                 }
                 const failed = engineSummary.filter((e) => e.status !== 'ok').length;
                 if (engineSummary.length > 0 && failed === engineSummary.length) {
-                    return { error: `web_search unavailable: all ${failed} engines failed (timeout/error)` };
+                    return {
+                        error: `web_search unavailable: all ${failed} engines failed (timeout/error)`,
+                        code: 'transport'
+                    };
                 }
                 return { content: `No web results found for "${query}".` };
             }
             catch (err) {
-                return { error: err instanceof Error ? err.message : String(err) };
+                return { error: err instanceof Error ? err.message : String(err), code: 'transport' };
             }
         }
     };

package/dist-lib/schema/harness.js

@@ -23,7 +23,8 @@ export function registerHarnessTypes(ns) {
             { name: 'imageWidth', type: 'uint' },
             { name: 'imageHeight', type: 'uint' },
             { name: 'approvalMode', type: '@harness/approval-mode' },
-            { name: 'disabledToolsets', type: 'string', array: true }
+            { name: 'disabledToolsets', type: 'string', array: true },
+            { name: 'sandboxMode', type: 'bool' }
         ]
     });
     ns.register({

package/dist-lib/spec/hrpc/messages.js

@@ -1,12 +1,12 @@
 // This file is autogenerated by the hyperschema compiler
-// Schema Version: 9
+// Schema Version: 10
 /* eslint-disable camelcase */
 /* eslint-disable quotes */
 /* eslint-disable space-before-function-paren */
 
 import { c } from 'hyperschema/runtime'
 
-const VERSION = 9
+const VERSION = 10
 
 // eslint-disable-next-line no-unused-vars
 let version = VERSION
@@ -143,7 +143,8 @@ const encoding4 = {
       (m.imageWidth ? 8192 : 0) |
       (m.imageHeight ? 16384 : 0) |
       ((version >= 5 && m.approvalMode) ? 32768 : 0) |
-      ((version >= 5 && m.disabledToolsets) ? 65536 : 0)
+      ((version >= 5 && m.disabledToolsets) ? 65536 : 0) |
+      ((version >= 10 && m.sandboxMode) ? 131072 : 0)
 
     c.uint.preencode(state, flags)
 
@@ -183,7 +184,8 @@ const encoding4 = {
       (m.imageWidth ? 8192 : 0) |
       (m.imageHeight ? 16384 : 0) |
       ((version >= 5 && m.approvalMode) ? 32768 : 0) |
-      ((version >= 5 && m.disabledToolsets) ? 65536 : 0)
+      ((version >= 5 && m.disabledToolsets) ? 65536 : 0) |
+      ((version >= 10 && m.sandboxMode) ? 131072 : 0)
 
     c.uint.encode(state, flags)
 
@@ -225,7 +227,8 @@ const encoding4 = {
       imageWidth: (flags & 8192) !== 0 ? c.uint.decode(state) : 0,
       imageHeight: (flags & 16384) !== 0 ? c.uint.decode(state) : 0,
       approvalMode: (version >= 5 && (flags & 32768) !== 0) ? encoding59.decode(state) : null,
-      disabledToolsets: (version >= 5 && (flags & 65536) !== 0) ? encoding4_16.decode(state) : null
+      disabledToolsets: (version >= 5 && (flags & 65536) !== 0) ? encoding4_16.decode(state) : null,
+      sandboxMode: (version >= 10 && (flags & 131072) !== 0)
     }
   }
 }

package/dist-lib/spec/hyperschema/index.js

@@ -1,12 +1,12 @@
 // This file is autogenerated by the hyperschema compiler
-// Schema Version: 9
+// Schema Version: 10
 /* eslint-disable camelcase */
 /* eslint-disable quotes */
 /* eslint-disable space-before-function-paren */
 
 import { c } from 'hyperschema/runtime'
 
-const VERSION = 9
+const VERSION = 10
 
 // eslint-disable-next-line no-unused-vars
 let version = VERSION
@@ -143,7 +143,8 @@ const encoding4 = {
       (m.imageWidth ? 8192 : 0) |
       (m.imageHeight ? 16384 : 0) |
       ((version >= 5 && m.approvalMode) ? 32768 : 0) |
-      ((version >= 5 && m.disabledToolsets) ? 65536 : 0)
+      ((version >= 5 && m.disabledToolsets) ? 65536 : 0) |
+      ((version >= 10 && m.sandboxMode) ? 131072 : 0)
 
     c.uint.preencode(state, flags)
 
@@ -183,7 +184,8 @@ const encoding4 = {
       (m.imageWidth ? 8192 : 0) |
       (m.imageHeight ? 16384 : 0) |
       ((version >= 5 && m.approvalMode) ? 32768 : 0) |
-      ((version >= 5 && m.disabledToolsets) ? 65536 : 0)
+      ((version >= 5 && m.disabledToolsets) ? 65536 : 0) |
+      ((version >= 10 && m.sandboxMode) ? 131072 : 0)
 
     c.uint.encode(state, flags)
 
@@ -225,7 +227,8 @@ const encoding4 = {
       imageWidth: (flags & 8192) !== 0 ? c.uint.decode(state) : 0,
       imageHeight: (flags & 16384) !== 0 ? c.uint.decode(state) : 0,
       approvalMode: (version >= 5 && (flags & 32768) !== 0) ? encoding59.decode(state) : null,
-      disabledToolsets: (version >= 5 && (flags & 65536) !== 0) ? encoding4_16.decode(state) : null
+      disabledToolsets: (version >= 5 && (flags & 65536) !== 0) ? encoding4_16.decode(state) : null,
+      sandboxMode: (version >= 10 && (flags & 131072) !== 0)
     }
   }
 }

package/dist-lib/spec/hyperschema/schema.json

@@ -1,5 +1,5 @@
 {
-  "version": 9,
+  "version": 10,
   "schema": [
     {
       "name": "empty",
@@ -151,6 +151,11 @@
           "array": true,
           "type": "string",
           "version": 5
+        },
+        {
+          "name": "sandboxMode",
+          "type": "bool",
+          "version": 10
         }
       ]
     },

package/dist-lib/spec/hyperschema/types.d.ts

@@ -1,5 +1,5 @@
 // This file is autogenerated by hyperschema-ts
-// Schema version: 9
+// Schema version: 10
 // Do not edit manually.
 
 export interface HarnessEmpty {
@@ -31,6 +31,7 @@ export interface HarnessAgentKnobs {
   imageHeight?: number
   approvalMode?: HarnessApprovalMode | null
   disabledToolsets?: string[] | null
+  sandboxMode?: boolean
 }
 
 export type HarnessMessageRole = "system" | "user" | "assistant" | "tool"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qvac/harness",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "type": "module",
   "description": "An AI harness implementing generate(context) via @qvac/sdk. Knows nothing about workbench, hyperdb, or chunks — just inference in, events out.",
   "exports": {
@@ -12,6 +12,10 @@
       "types": "./dist-lib/lib/docx/index.d.ts",
       "default": "./dist-lib/lib/docx/index.js"
     },
+    "./office": {
+      "types": "./dist-lib/lib/office/index.d.ts",
+      "default": "./dist-lib/lib/office/index.js"
+    },
     "./lib/dns-lookup.ts": {
       "types": "./dist-lib/lib/dns-lookup.d.ts",
       "default": "./dist-lib/lib/dns-lookup.js"