@runtypelabs/cli 2.59.0 → 2.59.2

package/dist/chunk-D3y2bURs.js

@@ -0,0 +1,1347 @@
+#!/usr/bin/env node
+import { P as getRuntypeHomeDir, l as normalizeApiUrl, s as getInvocationOptions } from "./index.js";
+import { i as HARNESS_TRACE_ARTIFACT, o as harnessTurnBindingSchema, r as HARNESS_BINDING_METADATA_KEY } from "./chunk-Bu0FJr6S.js";
+import { i as getApiUrl, r as createCliClient } from "./chunk-BW2fg46T.js";
+import { n as ensureAuth } from "./chunk-CJraEBVd.js";
+import { i as createDeviceListenIdentityStore, r as runDeviceListen, t as DeviceListenCleanupError } from "./chunk-Dn8eaJuu.js";
+import { t as HARNESS_LIMITS } from "./chunk-0x7UKC1U.js";
+import { t as redactHarnessValue } from "./chunk-KcqPQJBi.js";
+import { Command } from "commander";
+import { join } from "node:path";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { chmod, link, mkdir, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { createServer, request } from "node:http";
+// src/lib/local-harness/host/replay.ts
+/** A content-free durable turn reservation survives process failure without replaying inference. */
+async function reserveHarnessTurn(directory, traceId, expiresAt) {
+	if (!/^[0-9a-f]{32}$/.test(traceId)) throw new Error("Invalid harness trace identity.");
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(directory, 448);
+	const names = await readdir(directory);
+	let retained = 0;
+	for (const name of names) {
+		if (!/^[0-9a-f]{32}\.json$/.test(name)) continue;
+		const file = join(directory, name);
+		try {
+			if ((await stat(file)).size > 128) throw new Error("Invalid harness replay reservation.");
+			const reservation = JSON.parse(await readFile(file, "utf8"));
+			if (typeof reservation.expiresAt !== "number" || !Number.isFinite(reservation.expiresAt)) throw new Error("Invalid harness replay reservation.");
+			if (reservation.expiresAt <= Date.now()) await unlink(file);
+			else retained += 1;
+		} catch (error) {
+			if (error instanceof Error && "code" in error && error.code === "ENOENT") continue;
+			throw new Error("Harness replay state needs inspection before running more turns.", { cause: error });
+		}
+	}
+	if (retained >= Math.floor(HARNESS_LIMITS.maxSpoolBytes / HARNESS_LIMITS.maxControlReplyBytes)) throw new Error("Harness replay reservation capacity reached.");
+	let handle;
+	try {
+		handle = await open(join(directory, `${traceId}.json`), "wx", 384);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "EEXIST") return false;
+		throw error;
+	}
+	try {
+		await handle.writeFile(JSON.stringify({ expiresAt }));
+		await handle.sync();
+	} finally {
+		await handle.close();
+	}
+	return true;
+}
+// src/lib/local-harness/host/sessions.ts
+const MAX_RETIRED_CONTEXTS = 4096;
+const STRANDED_SESSION_MESSAGE = "A retired harness session did not stop; its slot stays reserved until the harness restarts.";
+var HarnessAdmissionError = class extends Error {};
+var HarnessCleanupError = class extends Error {
+	failures;
+	constructor(failures = []) {
+		super("Harness cleanup failed or timed out; owned execution may still be running." + (failures.length ? ` Cleanup stages: ${failures.join("; ")}.` : ""));
+		this.failures = failures;
+	}
+};
+async function cleanupFailure(stage, work, timeoutMs) {
+	let timer;
+	try {
+		return await Promise.race([work.then(() => void 0, () => `${stage} failed`), new Promise((resolve) => {
+			timer = setTimeout(() => resolve(`${stage} timed out`), timeoutMs);
+		})]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+/** Keeps each native conversation sequential; retired and failed contexts stay refused as tombstones. */
+var HarnessSessions = class {
+	backend;
+	config;
+	sessions = /* @__PURE__ */ new Map();
+	retired = /* @__PURE__ */ new Set();
+	releasing = /* @__PURE__ */ new Set();
+	stranded = /* @__PURE__ */ new Set();
+	closing = false;
+	cleanupFailures = /* @__PURE__ */ new Set();
+	uses = 0;
+	constructor(backend, config) {
+		this.backend = backend;
+		this.config = config;
+	}
+	get count() {
+		return this.sessions.size;
+	}
+	async prompt(contextId, input) {
+		if (this.closing) throw new HarnessAdmissionError("Harness is stopping.");
+		if (this.retired.has(contextId)) throw new HarnessAdmissionError("This session was retired to admit newer conversations; start a new conversation.");
+		let state = this.sessions.get(contextId);
+		if (!state) {
+			if (this.stranded.size >= HARNESS_LIMITS.maxSessions) throw new HarnessAdmissionError(STRANDED_SESSION_MESSAGE);
+			const released = this.sessions.size + this.stranded.size >= HARNESS_LIMITS.maxSessions ? this.retireIdle() : null;
+			if (released === void 0) throw new HarnessAdmissionError("Harness session limit reached; every session has a turn in progress.");
+			const admitted = {
+				tail: Promise.resolve(),
+				pending: 0,
+				turns: 0,
+				blocked: false,
+				lastUsed: 0
+			};
+			if (released) admitted.tail = released.then((stopped) => {
+				if (stopped) return;
+				admitted.predecessorStranded = true;
+				if (this.sessions.get(contextId) === admitted) this.sessions.delete(contextId);
+			});
+			state = admitted;
+			this.sessions.set(contextId, state);
+		}
+		state.lastUsed = ++this.uses;
+		if (state.blocked) throw new HarnessAdmissionError("This session cannot resume after an incomplete turn.");
+		if (state.turns + state.pending >= this.config.maxTurns) throw new HarnessAdmissionError("Harness turn limit reached.");
+		if (state.pending >= 1 + HARNESS_LIMITS.maxQueuedTurnsPerSession) throw new HarnessAdmissionError("Harness session queue is full.");
+		state.pending += 1;
+		const current = state;
+		const execute = async () => {
+			try {
+				input.signal.throwIfAborted();
+				if (current.predecessorStranded) throw new HarnessAdmissionError(STRANDED_SESSION_MESSAGE);
+				if (current.blocked || this.closing) throw new HarnessAdmissionError("Harness session is closed.");
+				const controller = new AbortController();
+				current.controller = controller;
+				const abort = () => controller.abort();
+				input.signal.addEventListener("abort", abort, { once: true });
+				if (input.signal.aborted) abort();
+				try {
+					current.turns += 1;
+					if (!current.session) current.launching = Promise.resolve().then(() => this.backend.start(this.config, {
+						sessionId: contextId,
+						signal: controller.signal,
+						deadlineAt: input.deadlineAt
+					})).then(async (session) => {
+						if (controller.signal.aborted || this.closing) {
+							const failure = await cleanupFailure("session close", Promise.resolve().then(() => session.close()), 2 * HARNESS_LIMITS.cancelGraceMs);
+							if (failure) this.cleanupFailures.add(failure);
+							throw new HarnessAdmissionError("Harness session stopped during launch.");
+						}
+						return session;
+					});
+					const session = current.session ?? await abortable(current.launching, controller.signal);
+					if (!session) throw new HarnessAdmissionError("Harness backend did not create a session.");
+					current.session = session;
+					controller.signal.throwIfAborted();
+					const result = await abortable(session.prompt({
+						...input,
+						signal: controller.signal
+					}), controller.signal);
+					if (result.status !== "completed") current.blocked = true;
+					return result;
+				} finally {
+					input.signal.removeEventListener("abort", abort);
+					current.controller = void 0;
+				}
+			} catch (error) {
+				current.blocked = true;
+				if (current.session) {
+					const failure = await cleanupFailure("session cancellation", Promise.resolve().then(() => current.session.cancel()), HARNESS_LIMITS.cancelGraceMs);
+					if (failure) this.cleanupFailures.add(failure);
+				}
+				throw error;
+			} finally {
+				current.pending -= 1;
+			}
+		};
+		const result = current.tail.then(execute);
+		current.tail = result.then(() => {}, () => {});
+		return result;
+	}
+	retireIdle() {
+		const idle = [...this.sessions].filter(([, state]) => state.pending === 0);
+		const victim = idle.find(([, state]) => state.blocked) ?? idle.sort(([, a], [, b]) => a.lastUsed - b.lastUsed)[0];
+		if (!victim) return void 0;
+		const [contextId, state] = victim;
+		this.sessions.delete(contextId);
+		this.retired.add(contextId);
+		if (this.retired.size > MAX_RETIRED_CONTEXTS) this.retired.delete(this.retired.values().next().value);
+		state.blocked = true;
+		const release = this.release(state);
+		this.releasing.add(release);
+		release.then(() => this.releasing.delete(release));
+		return release;
+	}
+	/** Resolves false when the backend did not stop; that state stays reserved until its one close attempt settles. */
+	async release(state) {
+		const failures = [];
+		const pending = await cleanupFailure("session cancellation", state.tail, HARNESS_LIMITS.cancelGraceMs);
+		if (pending) failures.push(pending);
+		if (state.launching && !state.session) {
+			const failure = await cleanupFailure("session launch", state.launching.then(() => {}, () => {}), 2 * HARNESS_LIMITS.cancelGraceMs);
+			if (failure) failures.push(failure);
+		}
+		if (state.session) {
+			state.closing ??= Promise.resolve().then(() => state.session.close());
+			const failure = await cleanupFailure("session close", state.closing, 2 * HARNESS_LIMITS.cancelGraceMs);
+			if (failure) failures.push(failure);
+		}
+		const stopped = failures.length === 0;
+		state.cleanupFailures = failures;
+		if (stopped) this.stranded.delete(state);
+		else this.stranded.add(state);
+		return stopped;
+	}
+	async cancelAll() {
+		await Promise.all([...this.sessions.values(), ...this.stranded].map(async (state) => {
+			state.blocked = true;
+			state.controller?.abort();
+			if (state.session) {
+				const failure = await cleanupFailure("session cancellation", Promise.resolve().then(() => state.session.cancel()), HARNESS_LIMITS.cancelGraceMs);
+				if (failure) this.cleanupFailures.add(failure);
+			}
+		}));
+	}
+	async close() {
+		this.closing = true;
+		await this.cancelAll();
+		await Promise.all([...[...this.sessions.values(), ...this.stranded].map((state) => this.release(state)), ...this.releasing]);
+		for (const state of this.stranded) for (const failure of state.cleanupFailures ?? []) this.cleanupFailures.add(failure);
+		if (this.cleanupFailures.size) throw new HarnessCleanupError([...this.cleanupFailures]);
+	}
+};
+async function abortable(work, signal) {
+	let rejectAbort = () => {};
+	const interrupted = new Promise((_, reject) => {
+		rejectAbort = () => reject(new HarnessAdmissionError("Harness turn cancelled."));
+		signal.addEventListener("abort", rejectAbort, { once: true });
+		if (signal.aborted) rejectAbort();
+	});
+	try {
+		return await Promise.race([work, interrupted]);
+	} finally {
+		signal.removeEventListener("abort", rejectAbort);
+	}
+}
+// src/lib/local-harness/host/server.ts
+function authorized(header, token) {
+	const supplied = Buffer.from(header?.startsWith("Bearer ") ? header.slice(7) : "");
+	const expected = Buffer.from(token);
+	return supplied.length === expected.length && timingSafeEqual(supplied, expected);
+}
+function record$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function readRequest(request) {
+	const chunks = [];
+	let bytes = 0;
+	for await (const chunk of request) {
+		bytes += Buffer.byteLength(chunk);
+		if (bytes > HARNESS_LIMITS.maxControlReplyBytes) throw new HarnessAdmissionError("Request exceeds the harness input limit.");
+		chunks.push(Buffer.from(chunk));
+	}
+	return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function send(response, status, value) {
+	if (response.destroyed || response.writableEnded) return;
+	response.writeHead(status, { "content-type": "application/json" });
+	response.end(JSON.stringify(value));
+}
+async function createHarnessHost(options) {
+	const sessions = new HarnessSessions(options.backend, options.config);
+	let captureFactory;
+	let accepting = false;
+	let stopping = false;
+	const replies = /* @__PURE__ */ new Map();
+	const active = /* @__PURE__ */ new Set();
+	const work = /* @__PURE__ */ new Set();
+	const handle = async (request, response) => {
+		if (!(request.method === "GET" && request.url === "/.well-known/agent-card.json") && !authorized(request.headers.authorization, options.token)) {
+			send(response, 401, { error: "Unauthorized" });
+			return;
+		}
+		if (request.method === "GET" && request.url === "/status") {
+			send(response, 200, {
+				accepting,
+				stopping,
+				sessions: sessions.count,
+				activeTurns: active.size,
+				delivery: captureFactory?.status?.() ?? null
+			});
+			return;
+		}
+		if (request.method === "POST" && request.url === "/disconnect") {
+			send(response, 200, { stopping: true });
+			options.onDisconnect?.();
+			return;
+		}
+		if (request.method === "GET") {
+			send(response, 200, {
+				name: "Runtype local harness",
+				url,
+				version: "1.0.0",
+				protocolVersion: "0.3.0",
+				capabilities: { streaming: false },
+				defaultInputModes: ["text"],
+				defaultOutputModes: ["text"],
+				skills: [{
+					id: "chat",
+					name: "Chat",
+					description: "Run one harness turn."
+				}]
+			});
+			return;
+		}
+		if (request.method !== "POST" || request.url !== "/") {
+			send(response, 405, { error: "Method not allowed" });
+			return;
+		}
+		if (!accepting || !captureFactory || stopping) {
+			send(response, 503, { error: "Harness is not accepting turns." });
+			return;
+		}
+		let rpc;
+		try {
+			rpc = await readRequest(request);
+		} catch {
+			send(response, 400, { error: "Invalid or oversized request." });
+			return;
+		}
+		if (!record$1(rpc) || rpc.method !== "message/send" && rpc.method !== "SendMessage" || !record$1(rpc.params) || !record$1(rpc.params.message)) {
+			send(response, 400, { error: "Expected A2A message/send." });
+			return;
+		}
+		const metadata = record$1(rpc.params.metadata) ? rpc.params.metadata : {};
+		const binding = harnessTurnBindingSchema.safeParse(metadata[HARNESS_BINDING_METADATA_KEY]);
+		if (!binding.success || binding.data.expiresAt <= Date.now()) {
+			send(response, 403, { error: "Missing, invalid or expired harness binding." });
+			return;
+		}
+		const message = rpc.params.message;
+		if (typeof message.contextId !== "string" || !message.contextId || message.contextId.length > 200 || !Array.isArray(message.parts)) {
+			send(response, 400, { error: "A bounded context ID and message parts are required." });
+			return;
+		}
+		const prompt = message.parts.map((part) => record$1(part) && (part.kind === "text" || part.type === "text") && typeof part.text === "string" ? part.text : "").join("");
+		const contextId = message.contextId;
+		const fingerprint = createHash("sha256").update(JSON.stringify([
+			contextId,
+			prompt,
+			binding.data.token
+		])).digest("hex");
+		const previous = replies.get(binding.data.traceId);
+		if (previous) {
+			if (previous.fingerprint !== fingerprint) {
+				send(response, 409, { error: "Harness binding was reused with a different request." });
+				return;
+			}
+			if (previous.body) {
+				send(response, previous.status ?? 200, {
+					...previous.body,
+					...previous.body.jsonrpc ? { id: rpc.id ?? null } : {}
+				});
+				return;
+			}
+			send(response, 409, { error: "This harness turn is already running or its completion is unknown." });
+			return;
+		}
+		for (const [id, reply] of replies) if (reply.expiresAt <= Date.now()) replies.delete(id);
+		if (replies.size >= Math.floor(HARNESS_LIMITS.maxSpoolBytes / HARNESS_LIMITS.maxControlReplyBytes)) {
+			send(response, 503, { error: "Harness replay capacity reached; wait for prior bindings to expire." });
+			return;
+		}
+		const ledger = {
+			fingerprint,
+			expiresAt: binding.data.expiresAt
+		};
+		replies.set(binding.data.traceId, ledger);
+		const finishResponse = (status, body) => {
+			ledger.status = status;
+			ledger.body = body;
+			send(response, status, body);
+		};
+		const turnId = randomUUID();
+		const controller = new AbortController();
+		active.add(controller);
+		const supplied = metadata.runtypeTurnDeadlineAt;
+		const deadlineAt = Math.min(Date.now() + options.config.timeoutMs, binding.data.expiresAt, typeof supplied === "number" && Number.isFinite(supplied) ? supplied : Infinity);
+		const timer = setTimeout(() => controller.abort(), Math.max(0, deadlineAt - Date.now()));
+		const disconnected = () => {
+			if (!response.writableEnded) controller.abort();
+		};
+		response.once("close", disconnected);
+		let capture;
+		try {
+			capture = captureFactory({
+				binding: binding.data,
+				sessionId: contextId,
+				turnId,
+				provenance: options.provenance,
+				dataPolicy: options.config.dataPolicy
+			});
+			if (capture.prepare) await abortable(capture.prepare(), controller.signal);
+		} catch {
+			replies.delete(binding.data.traceId);
+			clearTimeout(timer);
+			active.delete(controller);
+			response.off("close", disconnected);
+			finishResponse(503, { error: "Harness capture is unavailable." });
+			return;
+		}
+		if (options.replayDirectory) try {
+			if (!await reserveHarnessTurn(options.replayDirectory, binding.data.traceId, binding.data.expiresAt)) {
+				finishResponse(409, { error: "This harness turn was already admitted; completion is unknown after restart." });
+				return;
+			}
+		} catch {
+			finishResponse(503, { error: "Harness replay state is unavailable or at capacity." });
+			return;
+		} finally {
+			if (ledger.body) {
+				clearTimeout(timer);
+				active.delete(controller);
+				response.off("close", disconnected);
+			}
+		}
+		let result;
+		try {
+			capture.observe({
+				kind: "message",
+				message: {
+					role: "user",
+					content: prompt
+				}
+			});
+			result = await sessions.prompt(contextId, {
+				turnId,
+				prompt,
+				deadlineAt,
+				signal: controller.signal,
+				emit: (observation) => capture.observe(observation)
+			});
+		} catch (error) {
+			result = {
+				text: error instanceof HarnessAdmissionError ? error.message : controller.signal.aborted ? "Harness turn cancelled." : "Harness turn failed.",
+				status: controller.signal.aborted ? "cancelled" : "failed"
+			};
+		}
+		const redactedText = redactHarnessValue(result.text, "full", [
+			options.token,
+			...options.secrets ?? [],
+			...options.config.mcpServers.flatMap((server) => Object.values(server.headers ?? {}))
+		]);
+		result = {
+			...result,
+			text: String(redactedText.value ?? "")
+		};
+		if (redactedText.changed || result.text.length > 16e3) result.coverage = {
+			...result.coverage,
+			controlResponse: {
+				state: result.text.length > 16e3 ? "truncated" : "redacted",
+				reason: result.text.length > 16e3 ? "Final response exceeded the control text limit." : "Credentials were removed from the response."
+			}
+		};
+		let captured;
+		let deliveryTimedOut = false;
+		try {
+			let finishTimer;
+			try {
+				captured = await Promise.race([capture.finish(result), new Promise((_, reject) => {
+					finishTimer = setTimeout(() => {
+						deliveryTimedOut = true;
+						reject(/* @__PURE__ */ new Error("Harness evidence delivery timed out."));
+					}, HARNESS_LIMITS.deliveryTimeoutMs);
+				})]);
+			} finally {
+				if (finishTimer) clearTimeout(finishTimer);
+			}
+		} catch {
+			result = {
+				...result,
+				status: "failed",
+				text: deliveryTimedOut ? "Harness evidence delivery timed out." : "Harness evidence delivery failed."
+			};
+		}
+		clearTimeout(timer);
+		response.off("close", disconnected);
+		active.delete(controller);
+		const body = {
+			jsonrpc: "2.0",
+			id: rpc.id ?? null,
+			result: {
+				kind: "task",
+				id: turnId,
+				contextId,
+				status: {
+					state: result.status === "completed" ? "completed" : result.status === "cancelled" ? "canceled" : "failed",
+					...result.status !== "completed" ? { message: {
+						role: "agent",
+						parts: [{
+							kind: "text",
+							text: Array.from(result.text).slice(0, 1024).join("")
+						}]
+					} } : {}
+				},
+				artifacts: [{
+					artifactId: "response",
+					name: "response",
+					parts: [{
+						kind: "text",
+						text: Array.from(result.text).slice(0, 16e3).join("")
+					}]
+				}, ...captured ? [{
+					artifactId: "harness",
+					name: HARNESS_TRACE_ARTIFACT,
+					parts: [{
+						kind: "data",
+						data: captured.summary
+					}]
+				}, {
+					artifactId: "trace",
+					name: "runtype.trace",
+					parts: [{
+						kind: "data",
+						data: {
+							toolCalls: captured.toolCalls,
+							reportedUsage: captured.reportedUsage
+						}
+					}]
+				}] : []]
+			}
+		};
+		if (Buffer.byteLength(JSON.stringify(body)) > HARNESS_LIMITS.maxControlReplyBytes) {
+			body.result.artifacts = body.result.artifacts.filter((artifact) => artifact.name !== "runtype.trace");
+			if (captured) captured.summary.coverage.controlProjection = {
+				state: "truncated",
+				reason: "Legacy tool projection exceeded the control reply limit; canonical trace retained."
+			};
+		}
+		if (Buffer.byteLength(JSON.stringify(body)) > HARNESS_LIMITS.maxControlReplyBytes) {
+			finishResponse(502, { error: "Harness reply exceeded its bounded projection." });
+			return;
+		}
+		finishResponse(200, body);
+	};
+	const server = createServer((request, response) => {
+		const pending = handle(request, response).catch(() => send(response, 500, { error: "Harness request failed." }));
+		work.add(pending);
+		pending.then(() => work.delete(pending), () => work.delete(pending));
+	});
+	server.requestTimeout = 1e4;
+	server.headersTimeout = 5e3;
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(options.port ?? 0, "127.0.0.1", resolve);
+	});
+	const address = server.address();
+	if (!address || typeof address === "string") throw new Error("Harness could not bind a loopback port.");
+	const url = `http://127.0.0.1:${address.port}/`;
+	return {
+		url,
+		activate(factory) {
+			captureFactory = factory;
+			accepting = true;
+		},
+		async suspend() {
+			accepting = false;
+			for (const controller of active) controller.abort();
+			await sessions.cancelAll();
+		},
+		async close() {
+			stopping = true;
+			accepting = false;
+			for (const controller of active) controller.abort();
+			const closed = new Promise((resolve) => server.close(() => resolve()));
+			const failures = [];
+			try {
+				await sessions.close();
+			} catch (error) {
+				failures.push(...error instanceof HarnessCleanupError && error.failures.length ? error.failures : ["session close failed"]);
+			} finally {
+				const deliveryFailure = await cleanupFailure("request delivery", Promise.all([...work]), HARNESS_LIMITS.deliveryTimeoutMs);
+				if (deliveryFailure) failures.push(deliveryFailure);
+				server.closeAllConnections();
+				const serverFailure = await cleanupFailure("HTTP close", closed, HARNESS_LIMITS.cancelGraceMs);
+				if (serverFailure) failures.push(serverFailure);
+			}
+			if (failures.length) throw new HarnessCleanupError(failures);
+		}
+	};
+}
+// src/lib/local-harness/lifecycle/config.ts
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseMcpServers(value) {
+	if (!record(value) || !record(value.mcpServers)) throw new Error("MCP config requires an mcpServers object.");
+	const entries = Object.entries(value.mcpServers);
+	if (!entries.length || entries.length > 32) throw new Error("Configure between 1 and 32 MCP servers.");
+	return entries.map(([name, server]) => {
+		if (!/^[A-Za-z0-9_-]{1,64}$/.test(name) || !record(server) || typeof server.url !== "string") throw new Error("Each MCP server needs a valid name and HTTP URL.");
+		if (server.command !== void 0 || server.type !== void 0 && server.type !== "http") throw new Error("The controlled profile supports HTTP MCP servers only.");
+		const url = new URL(server.url);
+		const loopback = [
+			"localhost",
+			"127.0.0.1",
+			"[::1]"
+		].includes(url.hostname);
+		if (url.username || url.password || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) throw new Error("MCP URLs require HTTPS or loopback HTTP, without URL credentials or fragments.");
+		let headers;
+		if (server.headers !== void 0) {
+			if (!record(server.headers) || Object.keys(server.headers).length > 16 || Object.values(server.headers).some((v) => typeof v !== "string" || v.length > 8192 || /[\r\n]/.test(v))) throw new Error("MCP headers must be bounded strings without newlines.");
+			headers = server.headers;
+		}
+		return {
+			name,
+			url: url.toString(),
+			...headers ? { headers } : {}
+		};
+	});
+}
+async function readMcpConfiguration(file) {
+	const source = await readFile(file);
+	if (source.length > 131072) throw new Error("MCP configuration exceeds 128 KiB.");
+	return parseMcpServers(JSON.parse(source.toString("utf8")));
+}
+function validateConfiguration(config) {
+	if (!["claude", "codex"].includes(config.harness) || !["native", "acp"].includes(config.backend)) throw new Error("Unsupported harness or backend.");
+	if (config.profile !== "controlled-mcp") throw new Error("The workspace profile is not qualified for this release.");
+	if (![
+		"metrics",
+		"redacted",
+		"full"
+	].includes(config.dataPolicy)) throw new Error("Unsupported data policy.");
+	if (!Number.isInteger(config.maxTurns) || config.maxTurns < 1 || config.maxTurns > 100) throw new Error("maxTurns must be between 1 and 100.");
+	if (!Number.isInteger(config.timeoutMs) || config.timeoutMs < 1e3 || config.timeoutMs > HARNESS_LIMITS.maxTurnTimeoutMs) throw new Error("timeoutMs must be between 1000 and 300000.");
+	parseMcpServers({ mcpServers: Object.fromEntries(config.mcpServers.map(({ name, ...server }) => [name, server])) });
+	if (new Set(config.mcpServers.map((server) => server.name)).size !== config.mcpServers.length) throw new Error("MCP names must be unique.");
+}
+// src/lib/local-harness/lifecycle/registration.ts
+const marker = (registration) => `[runtype-harness:${registration.id}]`;
+const targetName = (registration) => `${registration.name.slice(0, 150)} ${marker(registration)}`;
+const segment = encodeURIComponent;
+function matchesAgent(agent, registration) {
+	return agent.description === marker(registration) && agent.agentType === "external" && agent.externalConfig?.transport === "device" && agent.externalConfig.protocol === "a2a" && agent.externalConfig.deviceId === registration.deviceId;
+}
+async function allOwned(client, path) {
+	const items = [];
+	let cursor;
+	for (let page = 0; page < 100; page += 1) {
+		const reply = await client.get(path, {
+			limit: 100,
+			offset: page * 100,
+			...cursor ? { cursor } : {}
+		});
+		if (!Array.isArray(reply.data)) throw new Error("Cannot reconcile an invalid resource list.");
+		items.push(...reply.data);
+		cursor = reply.pagination?.nextCursor ?? void 0;
+		if (!cursor && (reply.pagination?.hasMore === false || reply.data.length < 100 || items.length >= (reply.total ?? reply.pagination?.total ?? Infinity))) return items;
+	}
+	throw new Error("Resource reconciliation exceeded its page limit; registration was preserved.");
+}
+function notFound(error) {
+	return error !== null && typeof error === "object" && (error.statusCode === 404 || error.status === 404);
+}
+async function ownedOrMissing(read) {
+	try {
+		return await read();
+	} catch (error) {
+		if (notFound(error)) return void 0;
+		throw error;
+	}
+}
+async function findAgent(client, registration) {
+	const candidates = (await allOwned(client, "/agents")).filter((agent) => agent.description === marker(registration) && agent.agentType === "external");
+	return single((await Promise.all(candidates.map((candidate) => ownedOrMissing(() => client.agents.get(candidate.id))))).filter((agent) => agent !== void 0 && matchesAgent(agent, registration)));
+}
+async function findTarget(client, registration) {
+	return single((await allOwned(client, "/simulations/targets")).filter((target) => target.name === targetName(registration) && target.config.kind === "external_agent" && target.config.agentId === registration.agentId));
+}
+/** Recovers IDs whose creation succeeded but whose reply was lost, so removal deletes those resources too. */
+async function reconcileForRemoval(client, store, registration) {
+	if (registration.deviceId && !registration.agentId) {
+		const agent = await findAgent(client, registration);
+		if (agent) {
+			registration.agentId = agent.id;
+			await store.save(registration);
+		}
+	}
+	if (registration.agentId && !registration.targetId) {
+		const target = await findTarget(client, registration);
+		if (target) {
+			registration.targetId = target.id;
+			await store.save(registration);
+		}
+	}
+}
+function single(matches) {
+	if (matches.length > 1) throw new Error("Multiple resources match this registration; reconcile them before retrying.");
+	return matches[0];
+}
+async function registerHarness(client, store, registration) {
+	if (!registration.deviceId || !registration.endpoint) throw new Error("Device and loopback host must be ready before registration.");
+	if (registration.phase === "removed") throw new Error("This registration was removed; create a new one.");
+	const externalConfig = {
+		protocol: "a2a",
+		transport: "device",
+		deviceId: registration.deviceId,
+		endpoint: registration.endpoint,
+		auth: {
+			type: "bearer",
+			credentials: registration.token
+		},
+		timeoutMs: registration.config.timeoutMs
+	};
+	if (!registration.agentId) {
+		const found = await findAgent(client, registration);
+		if (found) registration.agentId = found.id;
+		else {
+			registration.phase = "agent-pending";
+			await store.save(registration);
+			const agent = await client.agents.create({
+				name: registration.name,
+				description: marker(registration),
+				agentType: "external",
+				externalConfig
+			});
+			if (!agent.id) throw new Error("Agent creation returned no ID; retry to reconcile the registration.");
+			registration.agentId = agent.id;
+		}
+		registration.phase = "agent";
+		await store.save(registration);
+	}
+	const agent = await client.agents.get(registration.agentId);
+	if (!matchesAgent(agent, registration)) throw new Error("The registered agent changed protocol, transport, device or registration identity.");
+	await client.agents.update(agent.id, { externalConfig });
+	if (!registration.targetId) {
+		const found = await findTarget(client, registration);
+		if (found) registration.targetId = found.id;
+		else {
+			registration.phase = "target-pending";
+			await store.save(registration);
+			const created = await client.post("/simulations/targets", {
+				name: targetName(registration),
+				config: {
+					kind: "external_agent",
+					agentId: registration.agentId
+				}
+			});
+			if (!created.target?.id) throw new Error("Target creation returned no ID; retry to reconcile the registration.");
+			registration.targetId = created.target.id;
+		}
+	}
+	const target = await client.get(`/simulations/targets/${segment(registration.targetId)}`);
+	if (target.target.config.kind !== "external_agent" || target.target.config.agentId !== registration.agentId || target.target.name !== targetName(registration)) throw new Error("The registered target changed; refusing to overwrite it.");
+	registration.phase = "registered";
+	await store.save(registration);
+}
+async function removeHarness(client, store, registration) {
+	await reconcileForRemoval(client, store, registration);
+	if (registration.targetId) {
+		const path = `/simulations/targets/${segment(registration.targetId)}`;
+		const target = await ownedOrMissing(() => client.get(path));
+		if (target) {
+			if (target.target.name !== targetName(registration) || target.target.config.agentId !== registration.agentId || target.target.config.kind !== "external_agent") throw new Error("The target is no longer owned by this registration.");
+			await ownedOrMissing(() => client.delete(path));
+		}
+		delete registration.targetId;
+		await store.save(registration);
+	}
+	if (registration.agentId) {
+		const agentId = registration.agentId;
+		const agent = await ownedOrMissing(() => client.agents.get(agentId));
+		if (agent) {
+			if (!matchesAgent(agent, registration)) throw new Error("The agent is no longer owned by this registration.");
+			await ownedOrMissing(() => client.agents.delete(agentId));
+		}
+		delete registration.agentId;
+		await store.save(registration);
+	}
+	if (registration.deviceId) {
+		const deviceId = registration.deviceId;
+		await ownedOrMissing(() => client.post(`/devices/${segment(deviceId)}/revoke`, {}));
+		delete registration.deviceId;
+	}
+	registration.phase = "removed";
+	delete registration.endpoint;
+	await store.save(registration);
+}
+// src/lib/local-harness/lifecycle/store.ts
+function newRegistration(workspace, config, name) {
+	return {
+		version: 1,
+		id: randomUUID(),
+		workspace: {
+			...workspace,
+			apiUrl: normalizeApiUrl(workspace.apiUrl)
+		},
+		name,
+		token: randomBytes(32).toString("base64url"),
+		config,
+		phase: "prepared",
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+var HarnessRegistrationStore = class {
+	workspace;
+	directory;
+	constructor(workspace, root = getRuntypeHomeDir()) {
+		this.workspace = workspace;
+		if (!workspace.userId || !workspace.orgId) throw new Error("An authenticated organization and device owner are required.");
+		const scope = createHash("sha256").update(JSON.stringify([
+			normalizeApiUrl(workspace.apiUrl),
+			workspace.userId,
+			workspace.orgId
+		])).digest("hex");
+		this.directory = join(root, "harness", scope);
+	}
+	path(id) {
+		if (!/^[a-f0-9-]{36}$/.test(id)) throw new Error("Invalid harness registration ID.");
+		return join(this.directory, `${id}.json`);
+	}
+	async save(registration) {
+		this.assertWorkspace(registration);
+		await mkdir(this.directory, {
+			recursive: true,
+			mode: 448
+		});
+		await chmod(this.directory, 448);
+		const destination = this.path(registration.id);
+		const temporary = `${destination}.${randomUUID()}.tmp`;
+		const handle = await open(temporary, "wx", 384);
+		try {
+			await handle.writeFile(JSON.stringify(registration));
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+		try {
+			await rename(temporary, destination);
+		} finally {
+			await rm(temporary, { force: true });
+		}
+	}
+	async load(id) {
+		const file = this.path(id);
+		const metadata = await stat(file);
+		if (metadata.size > 262144 || (metadata.mode & 63) !== 0) throw new Error("Harness registration must be a private bounded file.");
+		const value = JSON.parse(await readFile(file, "utf8"));
+		if (value.version !== 1 || value.id !== id || typeof value.token !== "string" || value.token.length < 32 || typeof value.name !== "string" || !value.config) throw new Error("Invalid harness registration.");
+		this.assertWorkspace(value);
+		return value;
+	}
+	assertWorkspace(registration) {
+		const owner = registration.workspace;
+		if (!owner || normalizeApiUrl(owner.apiUrl) !== normalizeApiUrl(this.workspace.apiUrl) || owner.userId !== this.workspace.userId || owner.orgId !== this.workspace.orgId) throw new Error("Harness registration belongs to a different authenticated workspace.");
+	}
+	/** Takes the registration's exclusive lock; a lock left by a dead process is recovered without racing a live one. */
+	async lock(id) {
+		await mkdir(this.directory, {
+			recursive: true,
+			mode: 448
+		});
+		const file = `${this.path(id)}.lock`;
+		const token = `${process.pid}\n${randomUUID()}`;
+		for (let attempt = 0; attempt < 3; attempt += 1) {
+			if (await createExclusive(file, token)) return async () => {
+				if (await readFile(file, "utf8").catch(() => null) === token) await unlink(file);
+			};
+			const held = await readLock(file);
+			if (!held) continue;
+			if (held.pid === null) throw new Error("Invalid harness lock; inspect the registration before removing it.");
+			if (processAlive(held.pid)) throw new Error("This harness registration is already running or locked.");
+			if (!await removeIfUnchanged(file, held.ino)) throw new Error("This harness registration is already running or locked.");
+		}
+		throw new Error("Could not lock harness registration.");
+	}
+};
+/** Publishes `content` at `file` only if nothing is there, so no reader ever sees a half-written lock. */
+async function createExclusive(file, content) {
+	const staged = `${file}.${randomUUID()}.tmp`;
+	await writeFile(staged, content, {
+		mode: 384,
+		flag: "wx"
+	});
+	try {
+		await link(staged, file);
+		return true;
+	} catch (error) {
+		if (errorCode(error) === "EEXIST") return false;
+		throw error;
+	} finally {
+		await rm(staged, { force: true });
+	}
+}
+async function readLock(file) {
+	const handle = await open(file, "r").catch((error) => {
+		if (errorCode(error) === "ENOENT") return null;
+		throw error;
+	});
+	if (!handle) return null;
+	try {
+		const pid = Number((await handle.readFile("utf8")).split("\n")[0]);
+		return {
+			pid: Number.isInteger(pid) && pid > 0 ? pid : null,
+			ino: (await handle.stat()).ino
+		};
+	} finally {
+		await handle.close();
+	}
+}
+function processAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (probe) {
+		return errorCode(probe) !== "ESRCH";
+	}
+}
+/** Moves the inspected stale lock aside; if another process replaced it first, puts the replacement back. */
+async function removeIfUnchanged(file, ino) {
+	const aside = `${file}.${randomUUID()}.stale`;
+	try {
+		await rename(file, aside);
+	} catch (error) {
+		if (errorCode(error) === "ENOENT") return true;
+		throw error;
+	}
+	try {
+		if ((await stat(aside)).ino === ino) return true;
+		await link(aside, file).catch((error) => {
+			if (errorCode(error) !== "EEXIST") throw error;
+		});
+		return false;
+	} finally {
+		await rm(aside, { force: true });
+	}
+}
+function errorCode(error) {
+	return error instanceof Error && "code" in error ? error.code : void 0;
+}
+function publicRegistration(registration) {
+	return {
+		registrationId: registration.id,
+		name: registration.name,
+		phase: registration.phase,
+		deviceId: registration.deviceId,
+		agentId: registration.agentId,
+		targetId: registration.targetId,
+		harness: registration.config.harness,
+		backend: registration.config.backend,
+		profile: registration.config.profile,
+		dataPolicy: registration.config.dataPolicy,
+		coverage: registration.provenance?.coverage,
+		cleanupFailures: registration.cleanupFailures,
+		versions: registration.provenance ? {
+			harness: registration.provenance.harnessVersion,
+			sdk: registration.provenance.sdkVersion,
+			adapter: registration.provenance.adapterVersion,
+			protocol: registration.provenance.protocolVersion
+		} : void 0
+	};
+}
+// src/lib/local-harness/lifecycle/connect.ts
+async function loadLockedRegistration(store, supplied) {
+	let registration;
+	try {
+		registration = await store.load(supplied.id);
+	} catch (error) {
+		if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+		registration = supplied;
+		await store.save(registration);
+	}
+	assertConnectable(registration);
+	return registration;
+}
+function assertConnectable(registration) {
+	if (registration.phase === "removed") throw new Error("This registration was removed; create a new one.");
+	validateConfiguration(registration.config);
+}
+async function connectHarness(options) {
+	const { store, client, backend } = options;
+	assertConnectable(options.registration);
+	try {
+		await client.post("/otel/v1/traces", { resourceSpans: [] }, void 0, { timeoutMs: 1e4 });
+	} catch (error) {
+		throw new Error("Telemetry readiness check failed. Use an API key with TELEMETRY:WRITE and a reachable ingest endpoint.", { cause: error });
+	}
+	const release = await store.lock(options.registration.id);
+	let registration;
+	try {
+		registration = await loadLockedRegistration(store, options.registration);
+	} catch (error) {
+		await release();
+		throw error;
+	}
+	const stop = new AbortController();
+	const abort = () => stop.abort();
+	options.signal?.addEventListener("abort", abort, { once: true });
+	if (options.signal?.aborted) abort();
+	let host;
+	let relay;
+	let failed = false;
+	let failure;
+	const cleanupFailures = [];
+	let relayPending = false;
+	try {
+		stop.signal.throwIfAborted();
+		const doctor = await backend.doctor(registration.config);
+		if (!doctor.ready) throw new Error(`Harness is not ready: ${doctor.diagnostics.join("; ")}`);
+		registration.provenance = doctor.provenance;
+		delete registration.cleanupFailures;
+		await store.save(registration);
+		host = await createHarnessHost({
+			token: registration.token,
+			config: registration.config,
+			provenance: doctor.provenance,
+			backend,
+			port: options.port,
+			onDisconnect: abort,
+			secrets: options.secrets,
+			replayDirectory: `${store.directory}/${registration.id}-replay`
+		});
+		registration.endpoint = host.url;
+		let resolveReady = () => {};
+		let rejectReady = () => {};
+		const ready = new Promise((resolve, reject) => {
+			resolveReady = resolve;
+			rejectReady = reject;
+		});
+		let captureFactory;
+		let online = false;
+		const readyAbort = () => rejectReady(/* @__PURE__ */ new Error("Harness connection stopped before device readiness."));
+		stop.signal.addEventListener("abort", readyAbort, { once: true });
+		const setupTimer = setTimeout(() => {
+			rejectReady(/* @__PURE__ */ new Error("Device connection timed out."));
+			abort();
+		}, 3e4);
+		relay = (options.runListen ?? runDeviceListen)({
+			client,
+			apiUrl: registration.workspace.apiUrl,
+			forwardTo: host.url,
+			name: registration.name,
+			quiet: true,
+			signal: stop.signal,
+			recoverRevokedIdentity: false,
+			identityStore: createDeviceListenIdentityStore({
+				workspace: registration.workspace,
+				cwd: store.directory,
+				namespace: registration.id
+			}),
+			installSignalHandlers: () => () => {},
+			setExitCode: () => {},
+			onReady: ({ deviceId }) => {
+				if (registration.deviceId && registration.deviceId !== deviceId) {
+					rejectReady(/* @__PURE__ */ new Error("The registered device changed."));
+					abort();
+					return;
+				}
+				resolveReady(deviceId);
+			},
+			onStatus: (status) => {
+				online = status === "listening";
+				if (online && captureFactory) host?.activate(captureFactory);
+				if (status === "offline") host?.suspend();
+			}
+		}).then(() => {
+			if (!stop.signal.aborted) {
+				failed = true;
+				failure = /* @__PURE__ */ new Error("Device listener stopped unexpectedly; the harness stopped.");
+			}
+			rejectReady(/* @__PURE__ */ new Error("Device listener stopped."));
+			abort();
+		}, (error) => {
+			failed = true;
+			if (error instanceof DeviceListenCleanupError) cleanupFailures.push("relay close failed");
+			rejectReady(/* @__PURE__ */ new Error("Device listener failed or the device was revoked."));
+			abort();
+		});
+		try {
+			registration.deviceId = await ready;
+		} finally {
+			clearTimeout(setupTimer);
+			stop.signal.removeEventListener("abort", readyAbort);
+		}
+		registration.phase = "device";
+		await store.save(registration);
+		stop.signal.throwIfAborted();
+		await registerHarness(client, store, registration);
+		stop.signal.throwIfAborted();
+		if (!registration.agentId) throw new Error("Harness agent registration is missing.");
+		captureFactory = options.createCaptureFactory({
+			client,
+			spoolDirectory: `${store.directory}/${registration.id}-spool`,
+			agentId: registration.agentId,
+			secrets: [
+				registration.token,
+				...options.secrets ?? [],
+				...registration.config.mcpServers.flatMap((server) => Object.values(server.headers ?? {}))
+			]
+		});
+		if (online) host.activate(captureFactory);
+		options.onReady?.(publicRegistration(registration), doctor.provenance);
+		if (!stop.signal.aborted) await new Promise((resolve) => {
+			stop.signal.addEventListener("abort", () => resolve(), { once: true });
+		});
+		if (failed) throw new Error("Device listener failed or the device was revoked; the harness stopped.");
+	} catch (error) {
+		failed = true;
+		failure = error;
+	} finally {
+		stop.abort();
+		try {
+			await host?.close();
+		} catch (error) {
+			cleanupFailures.push(...error instanceof HarnessCleanupError && error.failures.length ? error.failures : ["session close failed"]);
+		}
+		if (relay) {
+			const relayFailure = await cleanupFailure("relay close", relay, HARNESS_LIMITS.cancelGraceMs);
+			if (relayFailure) cleanupFailures.push(relayFailure);
+			relayPending = relayFailure === "relay close timed out";
+		}
+		failed ||= cleanupFailures.length > 0;
+		if (cleanupFailures.length) registration.cleanupFailures = cleanupFailures;
+		registration.phase = failed ? "failed" : "stopped";
+		delete registration.endpoint;
+		try {
+			await store.save(registration);
+		} finally {
+			try {
+				if (relayPending && relay) relay.then(release).catch(() => void 0);
+				else await release();
+			} finally {
+				options.signal?.removeEventListener("abort", abort);
+			}
+		}
+	}
+	if (cleanupFailures.length) throw new HarnessCleanupError(cleanupFailures);
+	if (failed) throw failure ?? /* @__PURE__ */ new Error("Harness connection failed.");
+}
+// src/lib/local-harness/lifecycle/control.ts
+async function disconnectHarness(store, registration) {
+	if (registration.endpoint) try {
+		await controlHarness(registration, "disconnect");
+	} catch (error) {
+		if ((await store.load(registration.id)).endpoint) throw error;
+	}
+	const deadline = Date.now() + HARNESS_LIMITS.deliveryTimeoutMs + 10 * HARNESS_LIMITS.cancelGraceMs;
+	while (Date.now() < deadline) {
+		const current = await store.load(registration.id);
+		if (!current.endpoint && [
+			"stopped",
+			"failed",
+			"removed"
+		].includes(current.phase)) {
+			let release;
+			try {
+				release = await store.lock(current.id);
+			} catch (error) {
+				if (!(error instanceof Error && error.message.includes("already running or locked"))) throw error;
+			}
+			if (release) try {
+				const terminal = await store.load(current.id);
+				if (!terminal.endpoint) {
+					if (terminal.phase === "failed") {
+						if (terminal.cleanupFailures?.length) throw new HarnessCleanupError(terminal.cleanupFailures);
+						throw new Error("The harness stopped after a connection failure; inspect its foreground log.");
+					}
+					return {
+						...publicRegistration(terminal),
+						stopping: false
+					};
+				}
+			} finally {
+				await release();
+			}
+		}
+		await setTimeout$1(25);
+	}
+	throw new Error("Harness shutdown is still in progress; inspect status before removing it.");
+}
+/** Uses only the registration's exact loopback origin and never follows redirects. */
+async function controlHarness(registration, action) {
+	if (!registration.endpoint) throw new Error("This harness has no active local endpoint.");
+	const url = new URL(registration.endpoint);
+	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.username || url.password || url.pathname !== "/") throw new Error("Invalid registered loopback endpoint.");
+	url.pathname = `/${action}`;
+	return new Promise((resolve, reject) => {
+		const call = request(url, {
+			method: action === "status" ? "GET" : "POST",
+			headers: { Authorization: `Bearer ${registration.token}` },
+			timeout: 2e3
+		}, (response) => {
+			let text = "";
+			response.on("data", (data) => {
+				text += data.toString("utf8");
+				if (text.length > 16384) call.destroy(/* @__PURE__ */ new Error("Local harness status exceeded its limit."));
+			});
+			response.on("end", () => {
+				if (response.statusCode !== 200) {
+					reject(/* @__PURE__ */ new Error("Local harness control was refused."));
+					return;
+				}
+				try {
+					resolve(JSON.parse(text));
+				} catch {
+					reject(/* @__PURE__ */ new Error("Invalid local harness status."));
+				}
+			});
+			response.on("error", reject);
+		});
+		call.on("error", () => reject(/* @__PURE__ */ new Error("The local harness is unavailable.")));
+		call.on("timeout", () => call.destroy(/* @__PURE__ */ new Error("Local harness control timed out.")));
+		call.end();
+	});
+}
+// src/commands/harness.ts
+function common(command) {
+	return command.option("--harness <name>", "claude or codex", "claude").option("--backend <backend>", "native or acp", "native").option("--profile <profile>", "Qualified permissions profile", "controlled-mcp").option("--data-policy <policy>", "metrics, redacted, or full", "redacted").option("--executable <path>", "Installed harness executable").option("--adapter <path>", "Pinned ACP adapter executable").option("--model <model>", "Model to request").option("--mcp-config <file>", "Explicit HTTP MCP configuration JSON").option("--max-turns <count>", "Maximum turns in one session", "20").option("--timeout-ms <milliseconds>", "Maximum turn duration", "300000");
+}
+async function configuration(options, requireMcp) {
+	if (requireMcp && !options.mcpConfig) throw new Error("--mcp-config is required for a new controlled harness.");
+	const config = {
+		harness: options.harness,
+		backend: options.backend,
+		profile: options.profile,
+		dataPolicy: options.dataPolicy,
+		executable: options.executable,
+		adapter: options.adapter,
+		model: options.model,
+		mcpServers: options.mcpConfig ? await readMcpConfiguration(options.mcpConfig) : [],
+		maxTurns: Number(options.maxTurns),
+		timeoutMs: Number(options.timeoutMs)
+	};
+	if (requireMcp) validateConfiguration(config);
+	else {
+		if (!["claude", "codex"].includes(config.harness) || !["native", "acp"].includes(config.backend)) throw new Error("Unsupported harness or backend.");
+		if (config.profile !== "controlled-mcp") throw new Error("The workspace profile is not qualified for this release.");
+	}
+	return config;
+}
+function createHarnessCommand(dependencies) {
+	const print = dependencies.print ?? ((value) => console.log(JSON.stringify(value, null, 2)));
+	const command = new Command("harness").description("Connect a local coding harness to Runtype simulations");
+	const action = (handler) => async (...args) => {
+		try {
+			await handler(...args);
+		} catch (error) {
+			print({ error: error instanceof Error ? error.message : "Harness command failed." });
+			process.exitCode = 1;
+		}
+	};
+	const authenticated = async () => {
+		const key = await (dependencies.ensureAuth ?? ensureAuth)({ exitOnFailure: false });
+		if (!key) throw new Error("Authentication required. Run runtype auth login.");
+		const client = (dependencies.createClient ?? createCliClient)(key);
+		const identity = await client.get("/auth/me");
+		if (!identity.userId || typeof identity.orgId !== "string" || !identity.orgId) throw new Error("An authenticated organization and device owner are required.");
+		const workspace = {
+			apiUrl: (dependencies.apiUrl ?? getApiUrl)(),
+			userId: identity.userId,
+			orgId: identity.orgId
+		};
+		return {
+			client,
+			workspace,
+			store: new HarnessRegistrationStore(workspace, (dependencies.stateRoot ?? getRuntypeHomeDir)()),
+			key
+		};
+	};
+	common(command.command("doctor").description("Check installed harness readiness without a model call")).action(action(async (options) => {
+		const config = await configuration(options, false);
+		const result = await dependencies.createBackend(config).doctor(config);
+		print(result);
+		if (!result.ready) process.exitCode = 1;
+	}));
+	common(command.command("connect").description("Run a registered harness in the foreground")).option("--registration <id>", "Resume an existing owned registration").option("--name <name>", "Display name", "Local coding harness").option("--port <port>", "Loopback listening port; default chooses a free port").action(action(async (options) => {
+		const { client, workspace, store, key } = await authenticated();
+		const registration = options.registration ? await store.load(options.registration) : newRegistration(workspace, await configuration(options, true), (options.name ?? "Local coding harness").slice(0, 120));
+		const port = options.port === void 0 ? void 0 : Number(options.port);
+		if (port !== void 0 && (!Number.isInteger(port) || port < 1 || port > 65535)) throw new Error("--port must be between 1 and 65535.");
+		if (!options.registration) await store.save(registration);
+		print({
+			...publicRegistration(registration),
+			externalToolWrites: "real",
+			isolation: "unverifiable",
+			externalSpendCap: false
+		});
+		const controller = new AbortController();
+		const stop = () => controller.abort();
+		process.on("SIGINT", stop);
+		process.on("SIGTERM", stop);
+		try {
+			await connectHarness({
+				registration,
+				store,
+				client,
+				backend: dependencies.createBackend(registration.config),
+				createCaptureFactory: dependencies.createCaptureFactory,
+				signal: controller.signal,
+				port,
+				secrets: [key, ...[
+					process.env.ANTHROPIC_API_KEY,
+					process.env.ANTHROPIC_AUTH_TOKEN,
+					process.env.CLAUDE_CODE_OAUTH_TOKEN,
+					process.env.OPENAI_API_KEY,
+					process.env.CODEX_API_KEY
+				].filter((value) => Boolean(value))],
+				onReady: (status, provenance) => print({
+					...status,
+					provenance
+				})
+			});
+		} finally {
+			process.off("SIGINT", stop);
+			process.off("SIGTERM", stop);
+		}
+	}));
+	command.command("status <registration>").description("Show safe local registration and live status").option("--json", "Output JSON").action(action(async (id) => {
+		const { store } = await authenticated();
+		const registration = await store.load(id);
+		let live;
+		try {
+			live = await controlHarness(registration, "status");
+		} catch {
+			live = { online: false };
+		}
+		print({
+			...publicRegistration(registration),
+			live
+		});
+	}));
+	command.command("disconnect <registration>").description("Stop the owned local host without removing registration").action(action(async (id) => {
+		const { store } = await authenticated();
+		print(await disconnectHarness(store, await store.load(id)));
+	}));
+	command.command("remove <registration>").description("Remove owned target, agent and paired device").option("--yes", "Confirm removal").action(action(async (id, options) => {
+		if (!options.yes && !getInvocationOptions().yes) throw new Error("Pass --yes to remove this registration and its owned resources.");
+		const { client, store } = await authenticated();
+		const release = await store.lock(id);
+		try {
+			const registration = await store.load(id);
+			await removeHarness(client, store, registration);
+			print(publicRegistration(registration));
+		} finally {
+			await release();
+		}
+	}));
+	return command;
+}
+export { createHarnessCommand };
+