@sweny-ai/core 0.1.142 → 0.1.143

package/dist/harness/index.d.ts

@@ -3,17 +3,25 @@
  * public harness types. Every construction site goes through `createHarness`.
  */
 import { ClaudeCodeHarness, type ClaudeCodeHarnessOptions } from "./claude-code.js";
+import { CodexHarness, type CodexHarnessOptions } from "./codex.js";
 export { claudeCompat, asClaude } from "./compat.js";
 export type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass, } from "./types.js";
-export { policyGate } from "./policy.js";
+export { policyGate, nativeDenyClasses, resolveHarnessPolicy, isToolClass, TOOL_CLASSES } from "./policy.js";
+export type { HarnessPolicyMode } from "./policy.js";
 export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt } from "./prompts.js";
 export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
 export type { ClaudeCodeHarnessOptions } from "./claude-code.js";
+export { CodexHarness, CODEX_CAPABILITIES, MIN_CODEX_VERSION } from "./codex.js";
+export type { CodexHarnessOptions } from "./codex.js";
 export { startToolBridge } from "./tool-bridge/server.js";
 export type { ToolBridge, ToolBridgeOptions } from "./tool-bridge/server.js";
+export { SUPPORTED_AGENTS, isSupportedAgent, unsupportedAgentError } from "./agents.js";
+export type { SupportedAgent } from "./agents.js";
 /**
  * Build the harness for an agent id. `claude` is the historical `--agent` /
  * `coding-agent-provider` value and means the same as `claude-code`.
- * Unknown ids fail with the same error `sweny` has always given.
+ * Unknown ids throw: sweny never runs one agent under another's name.
  */
-export declare function createHarness(id: string, opts?: ClaudeCodeHarnessOptions): ClaudeCodeHarness;
+export declare function createHarness(id: "claude" | "claude-code", opts?: ClaudeCodeHarnessOptions): ClaudeCodeHarness;
+export declare function createHarness(id: "codex", opts?: CodexHarnessOptions): CodexHarness;
+export declare function createHarness(id: string, opts?: ClaudeCodeHarnessOptions & CodexHarnessOptions): ClaudeCodeHarness | CodexHarness;

package/dist/harness/index.js

@@ -3,23 +3,23 @@
  * public harness types. Every construction site goes through `createHarness`.
  */
 import { ClaudeCodeHarness } from "./claude-code.js";
+import { CodexHarness } from "./codex.js";
+import { unsupportedAgentError } from "./agents.js";
 export { claudeCompat, asClaude } from "./compat.js";
-export { policyGate } from "./policy.js";
+export { policyGate, nativeDenyClasses, resolveHarnessPolicy, isToolClass, TOOL_CLASSES } from "./policy.js";
 export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt } from "./prompts.js";
 export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
+export { CodexHarness, CODEX_CAPABILITIES, MIN_CODEX_VERSION } from "./codex.js";
 export { startToolBridge } from "./tool-bridge/server.js";
-/**
- * Build the harness for an agent id. `claude` is the historical `--agent` /
- * `coding-agent-provider` value and means the same as `claude-code`.
- * Unknown ids fail with the same error `sweny` has always given.
- */
+export { SUPPORTED_AGENTS, isSupportedAgent, unsupportedAgentError } from "./agents.js";
 export function createHarness(id, opts = {}) {
     switch (id) {
         case "claude":
         case "claude-code":
             return new ClaudeCodeHarness(opts);
+        case "codex":
+            return new CodexHarness(opts);
         default:
-            throw new Error(`Unsupported coding agent "${id}": the only supported agent is "claude" ` +
-                `(headless Claude Code). Remove --agent / coding-agent-provider or set it to claude.`);
+            throw new Error(unsupportedAgentError(id));
     }
 }

package/dist/harness/parse.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Harness-neutral parsing of agent output: tool results and the final JSON
+ * answer. Shared by every adapter so a node's `data` and `toolCalls` mean the
+ * same thing whichever harness ran it. Moved out of claude-code.ts unchanged
+ * (the contract suite's structured-output golden cases pin the behavior).
+ *
+ * No agent SDK imports.
+ */
+import type { JSONSchema, Logger } from "../types.js";
+/**
+ * Best-effort recovery of typed output from a tool_result's `content`.
+ *
+ * The MCP protocol sends tool results as string content. Our in-process
+ * wrapper JSON-stringifies structured output before returning; external
+ * MCP servers generally do the same for JSON payloads. If the string
+ * looks like a JSON object or array and parses, return the parsed value
+ * so verify's output-path walks work against typed data.
+ *
+ * Raw strings are preserved verbatim. JSON-primitive strings (e.g. the
+ * literal four characters `"42"`) are intentionally NOT parsed - we
+ * cannot distinguish a tool that returned the number 42 (wrapper sends
+ * `"42"`) from a tool that returned the string "42" (wrapper also sends
+ * `"42"`). Preserving the string is safer than guessing.
+ */
+export declare function parseToolResultContent(content: unknown): unknown;
+/**
+ * Produce a short, single-line description of a tool-error payload suitable
+ * for the CI log stream. The full parsed value stays on the ToolCall for
+ * verify and downstream tooling - this is only for inline observability.
+ *
+ * Collapses newlines, trims whitespace, and caps to 300 chars so a huge
+ * API response body doesn't flood the log.
+ */
+export declare function summarizeToolError(parsed: unknown): string;
+/**
+ * Extract a JSON object from an agent's final text response.
+ *
+ * Strategy (in order):
+ * 1. LAST ```json code block``` - models put their real final answer last, so
+ *    a prompt-injected fake fenced block placed earlier must not win.
+ * 2. Last brace-delimited `{...}` block - handles inline JSON at end of text
+ * 3. Full text parse - for responses that are pure JSON
+ * 4. Empty object - safe fallback
+ *
+ * When `outputSchema` is supplied, the parsed object is checked against it.
+ * A mismatch is logged (warning) rather than silently accepted, so a
+ * non-conforming model answer is at least attributable.
+ */
+export declare function tryParseJSON(text: string, outputSchema?: JSONSchema, logger?: Pick<Logger, "warn">, label?: string): Record<string, unknown>;

package/dist/harness/parse.js

@@ -0,0 +1,253 @@
+/**
+ * Harness-neutral parsing of agent output: tool results and the final JSON
+ * answer. Shared by every adapter so a node's `data` and `toolCalls` mean the
+ * same thing whichever harness ran it. Moved out of claude-code.ts unchanged
+ * (the contract suite's structured-output golden cases pin the behavior).
+ *
+ * No agent SDK imports.
+ */
+/**
+ * Best-effort recovery of typed output from a tool_result's `content`.
+ *
+ * The MCP protocol sends tool results as string content. Our in-process
+ * wrapper JSON-stringifies structured output before returning; external
+ * MCP servers generally do the same for JSON payloads. If the string
+ * looks like a JSON object or array and parses, return the parsed value
+ * so verify's output-path walks work against typed data.
+ *
+ * Raw strings are preserved verbatim. JSON-primitive strings (e.g. the
+ * literal four characters `"42"`) are intentionally NOT parsed - we
+ * cannot distinguish a tool that returned the number 42 (wrapper sends
+ * `"42"`) from a tool that returned the string "42" (wrapper also sends
+ * `"42"`). Preserving the string is safer than guessing.
+ */
+export function parseToolResultContent(content) {
+    // The Anthropic tool_result `content` field can be a block array
+    // (e.g. [{type:"text",text:"..."}, ...]) rather than a string. When it is,
+    // concatenate the text of every {type:"text"} block (recursing through any
+    // nested content), then run the same object/array JSON-parse logic on the
+    // joined string. This keeps `call.output` the actual payload instead of the
+    // raw wrapper array that eval/route logic would otherwise have to walk.
+    if (Array.isArray(content)) {
+        const text = collectBlockText(content);
+        return parseJsonObjectOrArray(text);
+    }
+    if (typeof content !== "string")
+        return content;
+    return parseJsonObjectOrArray(content);
+}
+/**
+ * Parse a string only when it is an unambiguous JSON object or array.
+ *
+ * Strings, numbers, booleans, and null would all corrupt or discard
+ * information (we cannot distinguish the literal text `"42"` from the number
+ * 42), so non-object/array inputs are preserved verbatim.
+ */
+function parseJsonObjectOrArray(content) {
+    const trimmed = content.trim();
+    if (trimmed.length === 0)
+        return content;
+    const first = trimmed[0];
+    if (first !== "{" && first !== "[")
+        return content;
+    try {
+        return JSON.parse(trimmed);
+    }
+    catch {
+        return content;
+    }
+}
+/**
+ * Concatenate the text of an array of content blocks. Handles {type:"text"}
+ * blocks and recurses into any nested `content` array so deeply-wrapped tool
+ * results still flatten to their underlying text.
+ */
+function collectBlockText(blocks) {
+    const parts = [];
+    for (const block of blocks) {
+        if (typeof block === "string") {
+            parts.push(block);
+            continue;
+        }
+        if (!block || typeof block !== "object")
+            continue;
+        const b = block;
+        if (b.type === "text" && typeof b.text === "string") {
+            parts.push(b.text);
+        }
+        else if (Array.isArray(b.content)) {
+            parts.push(collectBlockText(b.content));
+        }
+        else if (typeof b.text === "string") {
+            // Some producers omit an explicit type but still carry text.
+            parts.push(b.text);
+        }
+    }
+    return parts.join("");
+}
+/**
+ * Produce a short, single-line description of a tool-error payload suitable
+ * for the CI log stream. The full parsed value stays on the ToolCall for
+ * verify and downstream tooling - this is only for inline observability.
+ *
+ * Collapses newlines, trims whitespace, and caps to 300 chars so a huge
+ * API response body doesn't flood the log.
+ */
+export function summarizeToolError(parsed) {
+    let raw;
+    if (typeof parsed === "string") {
+        raw = parsed;
+    }
+    else if (parsed && typeof parsed === "object") {
+        try {
+            raw = JSON.stringify(parsed);
+        }
+        catch {
+            raw = String(parsed);
+        }
+    }
+    else {
+        raw = String(parsed);
+    }
+    const collapsed = raw.replace(/\s+/g, " ").trim();
+    return collapsed.length > 300 ? collapsed.slice(0, 297) + "..." : collapsed;
+}
+// ─── JSON extraction ────────────────────────────────────────────
+/**
+ * Extract a JSON object from an agent's final text response.
+ *
+ * Strategy (in order):
+ * 1. LAST ```json code block``` - models put their real final answer last, so
+ *    a prompt-injected fake fenced block placed earlier must not win.
+ * 2. Last brace-delimited `{...}` block - handles inline JSON at end of text
+ * 3. Full text parse - for responses that are pure JSON
+ * 4. Empty object - safe fallback
+ *
+ * When `outputSchema` is supplied, the parsed object is checked against it.
+ * A mismatch is logged (warning) rather than silently accepted, so a
+ * non-conforming model answer is at least attributable.
+ */
+export function tryParseJSON(text, outputSchema, logger, label = "Claude") {
+    if (!text)
+        return {};
+    const finalize = (parsed) => {
+        if (outputSchema) {
+            const problems = schemaMismatches(parsed, outputSchema);
+            if (problems.length > 0) {
+                logger?.warn?.(`${label} output did not conform to outputSchema: ${problems.join("; ")}`);
+            }
+        }
+        return parsed;
+    };
+    // 1. Code block - scan ALL fenced blocks, prefer the LAST that parses.
+    const fences = [...text.matchAll(/```(?:json)?\s*([\s\S]*?)```/g)];
+    for (let i = fences.length - 1; i >= 0; i--) {
+        try {
+            const parsed = JSON.parse(fences[i][1].trim());
+            if (typeof parsed === "object" && parsed !== null)
+                return finalize(parsed);
+        }
+        catch {
+            /* try the next-earlier fence, then fall through to brace scan */
+        }
+    }
+    // 2. Last brace-delimited block (scan backwards for matching braces)
+    const lastBrace = text.lastIndexOf("}");
+    if (lastBrace !== -1) {
+        let depth = 0;
+        for (let i = lastBrace; i >= 0; i--) {
+            if (text[i] === "}")
+                depth++;
+            else if (text[i] === "{")
+                depth--;
+            if (depth === 0) {
+                try {
+                    const parsed = JSON.parse(text.slice(i, lastBrace + 1));
+                    if (typeof parsed === "object" && parsed !== null)
+                        return finalize(parsed);
+                }
+                catch {
+                    /* try next strategy */
+                }
+                break;
+            }
+        }
+    }
+    // 3. Full text parse
+    try {
+        const parsed = JSON.parse(text.trim());
+        if (typeof parsed === "object" && parsed !== null)
+            return finalize(parsed);
+    }
+    catch {
+        /* fall through */
+    }
+    return {};
+}
+/**
+ * Lightweight structural check of a parsed object against a JSON Schema.
+ *
+ * Deliberately shallow: it verifies `required` keys are present and that the
+ * top-level `type` and each declared property `type` match. It does NOT do
+ * full JSON Schema validation (no `$ref`, `oneOf`, formats, nested arrays).
+ * The contract here is "flag an obviously non-conforming object" so a mismatch
+ * is logged rather than silently accepted; it is not a validation gate.
+ *
+ * Returns a list of human-readable problems; empty means no detected mismatch.
+ */
+function schemaMismatches(value, schema) {
+    const problems = [];
+    const s = schema;
+    if (s.type === "object" || s.properties || s.required) {
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
+            return [`expected an object, got ${Array.isArray(value) ? "array" : typeof value}`];
+        }
+        const obj = value;
+        const required = Array.isArray(s.required) ? s.required : [];
+        for (const key of required) {
+            if (!(key in obj) || obj[key] === undefined) {
+                problems.push(`missing required property "${key}"`);
+            }
+        }
+        const props = s.properties ?? {};
+        for (const [key, propSchema] of Object.entries(props)) {
+            if (!(key in obj) || obj[key] === undefined || obj[key] === null)
+                continue;
+            const expected = propSchema?.type;
+            if (typeof expected === "string" && !jsonTypeMatches(obj[key], expected)) {
+                problems.push(`property "${key}" expected ${expected}, got ${jsonTypeOf(obj[key])}`);
+            }
+        }
+    }
+    else if (typeof s.type === "string" && !jsonTypeMatches(value, s.type)) {
+        problems.push(`expected ${s.type}, got ${jsonTypeOf(value)}`);
+    }
+    return problems;
+}
+function jsonTypeOf(value) {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "array";
+    return typeof value;
+}
+function jsonTypeMatches(value, expected) {
+    switch (expected) {
+        case "object":
+            return typeof value === "object" && value !== null && !Array.isArray(value);
+        case "array":
+            return Array.isArray(value);
+        case "string":
+            return typeof value === "string";
+        case "number":
+            return typeof value === "number";
+        case "integer":
+            return typeof value === "number" && Number.isInteger(value);
+        case "boolean":
+            return typeof value === "boolean";
+        case "null":
+            return value === null;
+        default:
+            return true; // unknown/unsupported type keyword - don't flag
+    }
+}

package/dist/harness/policy.d.ts

@@ -5,6 +5,28 @@
  * enforced natively, so the result is always `{ degraded: [] }`. A harness
  * without a native sandbox is covered by a process wrapper when the host has
  * one (`wrappers`; see `prepareAgentSpawn` in sandbox-wrapper.ts).
+ *
+ * Two kinds of `degraded` entry:
+ * - unenforced: nobody enforces the opinion (the harness cannot, and no host
+ *   wrapper is active). Strict mode refuses the node on these.
+ * - wrapped: sweny keeps the opinion itself, but not natively (for example a
+ *   watchdog in place of a native turn limit). Reported, never refused.
+ */
+import type { HarnessCapabilities, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass } from "./types.js";
+/** `strict` refuses a node whose opinions the harness cannot honor; `warn` runs it and reports `degraded`. */
+export type HarnessPolicyMode = "strict" | "warn";
+/**
+ * Resolve the harness policy mode: the explicit value (`--harness-policy`),
+ * else `SWENY_HARNESS_POLICY`, else `strict` under GitHub Actions and `warn`
+ * everywhere else. An unknown value warns and uses that default.
  */
-import type { HarnessCapabilities, NodePolicy, PolicyGateResult, PolicyWrappers } from "./types.js";
+export declare function resolveHarnessPolicy(env: Record<string, string | undefined>, explicit?: string, logger?: {
+    warn(msg: string): void;
+}): HarnessPolicyMode;
+/** Every portable tool class, in a stable order. */
+export declare const TOOL_CLASSES: readonly ToolClass[];
+/** Is `name` a portable tool class (`tools.deny: [write]`)? */
+export declare function isToolClass(name: string): name is ToolClass;
+/** The tool classes a harness can deny natively. */
+export declare function nativeDenyClasses(caps: HarnessCapabilities): ToolClass[];
 export declare function policyGate(caps: HarnessCapabilities, policy: NodePolicy, wrappers?: PolicyWrappers): PolicyGateResult;

package/dist/harness/policy.js

@@ -5,37 +5,95 @@
  * enforced natively, so the result is always `{ degraded: [] }`. A harness
  * without a native sandbox is covered by a process wrapper when the host has
  * one (`wrappers`; see `prepareAgentSpawn` in sandbox-wrapper.ts).
+ *
+ * Two kinds of `degraded` entry:
+ * - unenforced: nobody enforces the opinion (the harness cannot, and no host
+ *   wrapper is active). Strict mode refuses the node on these.
+ * - wrapped: sweny keeps the opinion itself, but not natively (for example a
+ *   watchdog in place of a native turn limit). Reported, never refused.
+ */
+/**
+ * Resolve the harness policy mode: the explicit value (`--harness-policy`),
+ * else `SWENY_HARNESS_POLICY`, else `strict` under GitHub Actions and `warn`
+ * everywhere else. An unknown value warns and uses that default.
  */
+export function resolveHarnessPolicy(env, explicit, logger) {
+    const fallback = env.GITHUB_ACTIONS === "true" ? "strict" : "warn";
+    const raw = (explicit ?? env.SWENY_HARNESS_POLICY ?? "").trim().toLowerCase();
+    if (raw === "strict" || raw === "warn")
+        return raw;
+    if (raw !== "")
+        logger?.warn(`harness policy "${raw}" is not one of strict|warn; using ${fallback}`);
+    return fallback;
+}
+/** Every portable tool class, in a stable order. */
+export const TOOL_CLASSES = ["shell", "write", "edit", "net", "subagent"];
+/** Is `name` a portable tool class (`tools.deny: [write]`)? */
+export function isToolClass(name) {
+    return TOOL_CLASSES.includes(name);
+}
+/** The tool classes a harness can deny natively. */
+export function nativeDenyClasses(caps) {
+    const base = caps.builtinDeny === "by-name" || caps.builtinDeny === "by-class"
+        ? TOOL_CLASSES
+        : caps.builtinDeny === "shell-only"
+            ? ["shell"]
+            : [];
+    const set = new Set([...base, ...(caps.denyClasses ?? [])]);
+    return TOOL_CLASSES.filter((c) => set.has(c));
+}
 export function policyGate(caps, policy, wrappers = {}) {
-    const degraded = [];
+    const unenforced = [];
+    const wrapped = [];
     if (policy.readOnly && caps.readOnly === "none" && !wrappers.readOnlyMount) {
-        degraded.push("read-only: harness cannot enforce it and no read-only mount is active");
+        unenforced.push("read-only: harness cannot enforce it and no read-only mount is active");
     }
     if (policy.deny.length > 0) {
-        if (caps.builtinDeny === "none") {
-            degraded.push(`deny [${policy.deny.join(", ")}]: harness cannot deny built-in tools`);
-        }
-        else if (caps.builtinDeny === "shell-only") {
-            const unmappable = policy.deny.filter((c) => c !== "shell");
-            if (unmappable.length > 0) {
-                degraded.push(`deny [${unmappable.join(", ")}]: harness can only deny the shell tool`);
+        const native = nativeDenyClasses(caps);
+        const unmappable = policy.deny.filter((c) => !native.includes(c));
+        if (unmappable.length > 0) {
+            const list = unmappable.join(", ");
+            if (native.length === 0) {
+                unenforced.push(`deny [${list}]: harness cannot deny built-in tools`);
+            }
+            else if (native.length === 1 && native[0] === "shell") {
+                unenforced.push(`deny [${list}]: harness can only deny the shell tool`);
+            }
+            else {
+                unenforced.push(`deny [${list}]: harness can only deny [${native.join(", ")}]`);
             }
         }
     }
-    if ((policy.nativeDeny?.length ?? 0) > 0 && caps.builtinDeny === "none") {
-        degraded.push("disallowed_tools: harness cannot deny built-in tools");
+    if ((policy.nativeDeny?.length ?? 0) > 0) {
+        if (caps.builtinDeny === "none") {
+            unenforced.push("disallowed_tools: harness cannot deny built-in tools");
+        }
+        else if (caps.builtinDeny !== "by-name") {
+            // Only a by-name harness can take tool names verbatim. Adapters translate
+            // the names they know into classes first; what is left is unenforced.
+            unenforced.push(`disallowed_tools [${policy.nativeDeny.join(", ")}]: harness has no tools by these names`);
+        }
     }
     if (policy.egress.length > 0 && !caps.sandbox.network && !wrappers.egress) {
-        degraded.push("egress allowlist: harness has no network sandbox and no egress wrapper is active");
+        unenforced.push("egress allowlist: harness has no network sandbox and no egress wrapper is active");
     }
     const sandboxMode = policy.sandbox ?? "off";
     let sandboxGap;
     if (sandboxMode !== "off" && !(caps.sandbox.fs && caps.sandbox.network) && !wrappers.sandbox) {
         sandboxGap = "sandbox: harness has no native fs and network sandbox and no process sandbox wrapper is available";
-        degraded.push(sandboxGap);
+        unenforced.push(sandboxGap);
+    }
+    if (policy.maxTurns !== undefined && caps.turnLimit !== "native") {
+        if (caps.turnLimit === "watchdog") {
+            wrapped.push(`max_turns: no native turn limit; sweny stops the run after ${policy.maxTurns} tool calls`);
+        }
+        else {
+            unenforced.push("max_turns: harness has no turn limit and no watchdog");
+        }
     }
-    if (degraded.length > 0 && policy.strict) {
-        return { degraded, refuse: `strict policy: ${degraded.join("; ")}` };
+    const degraded = [...unenforced, ...wrapped];
+    if (unenforced.length > 0 && policy.strict) {
+        return { degraded, refuse: `strict policy: ${unenforced.join("; ")}` };
     }
     if (sandboxGap && sandboxMode === "strict") {
         return {

package/dist/harness/prompts.d.ts

@@ -4,12 +4,18 @@
  * `ClaudeClient.ask` / `ClaudeClient.evaluate` built before the harness seam
  * (#330); prompts.test.ts pins them against the old builders.
  */
-import type { Claude, Logger } from "../types.js";
+import type { Claude, JSONSchema, Logger } from "../types.js";
 import type { AgentHarness } from "./types.js";
 /** @internal Registers the legacy object behind a compat harness. */
 export declare function registerLegacyClaude(harness: AgentHarness, claude: Claude): void;
 /** @internal The legacy `Claude` behind a compat harness, if any. */
 export declare function legacyClaudeOf(harness: AgentHarness): Claude | undefined;
+/**
+ * The prompt for a node run: the instruction, the context fenced as untrusted
+ * data (#360), and the output schema when the node declares one. Every
+ * adapter sends this string, so fencing holds on every harness.
+ */
+export declare function buildNodePrompt(instruction: string, context: Record<string, unknown>, outputSchema?: JSONSchema): string;
 /** The `ask` prompt: the instruction, then the fenced context when there is any. */
 export declare function buildAskPrompt(instruction: string, context: Record<string, unknown>): string;
 /**

package/dist/harness/prompts.js

@@ -16,6 +16,22 @@ export function registerLegacyClaude(harness, claude) {
 export function legacyClaudeOf(harness) {
     return LEGACY.get(harness);
 }
+/**
+ * The prompt for a node run: the instruction, the context fenced as untrusted
+ * data (#360), and the output schema when the node declares one. Every
+ * adapter sends this string, so fencing holds on every harness.
+ */
+export function buildNodePrompt(instruction, context, outputSchema) {
+    return [
+        `## Instruction\n\n${instruction}`,
+        `## Context\n\n${fenceUntrustedJson(context, "context")}`,
+        outputSchema
+            ? `## Required Output\n\nYou MUST end with a JSON object matching this schema:\n\`\`\`json\n${JSON.stringify(outputSchema, null, 2)}\n\`\`\``
+            : "",
+    ]
+        .filter(Boolean)
+        .join("\n\n");
+}
 /** The `ask` prompt: the instruction, then the fenced context when there is any. */
 export function buildAskPrompt(instruction, context) {
     return [instruction, Object.keys(context).length > 0 ? `\nContext:\n${fenceUntrustedJson(context, "context")}` : ""]

package/dist/harness/types.d.ts

@@ -1,8 +1,8 @@
 /**
  * AgentHarness: the seam between the executor and whatever agent runs a node.
  *
- * Design: research/2026-09-30-sota/harness-design.md, section 1. Claude Code
- * (`ClaudeCodeHarness`) is the only adapter today. `evaluate` and `ask` are
+ * Design: research/2026-09-30-sota/harness-design.md, section 1. Adapters:
+ * Claude Code (`ClaudeCodeHarness`) and Codex (`CodexHarness`). `evaluate` and `ask` are
  * not adapter methods: core builds the prompt and calls `complete()` (see
  * prompts.ts), so every adapter gets routing and judging for free.
  *
@@ -18,6 +18,12 @@ export interface HarnessCapabilities {
     /** full = built-in tool calls are visible with status; skill-only = only skill tools are traced. */
     toolTrace: "full" | "skill-only";
     builtinDeny: "by-name" | "by-class" | "shell-only" | "none";
+    /**
+     * Tool classes the harness can deny natively on top of what `builtinDeny`
+     * implies (Codex: shell-only by name, but web search and subagents are
+     * config switches). See `nativeDenyClasses()` in policy.ts.
+     */
+    denyClasses?: ToolClass[];
     mcp: {
         inject: boolean;
         exclusive: "native" | "home-isolation" | "none";
@@ -49,6 +55,11 @@ export interface NodePolicy {
     egress: string[];
     /** Refuse instead of degrade when an opinion cannot be enforced. */
     strict: boolean;
+    /**
+     * Turn budget for the run. Set by adapters whose `turnLimit` is not native,
+     * so the gate reports how the budget is kept (watchdog) or that it is not.
+     */
+    maxTurns?: number;
     /**
      * Process sandbox mode (`SWENY_SANDBOX`, #360). `auto` and `strict` need fs
      * and network containment: native, or a process wrapper (sandbox-wrapper.ts).

package/dist/harness/types.js

@@ -1,8 +1,8 @@
 /**
  * AgentHarness: the seam between the executor and whatever agent runs a node.
  *
- * Design: research/2026-09-30-sota/harness-design.md, section 1. Claude Code
- * (`ClaudeCodeHarness`) is the only adapter today. `evaluate` and `ask` are
+ * Design: research/2026-09-30-sota/harness-design.md, section 1. Adapters:
+ * Claude Code (`ClaudeCodeHarness`) and Codex (`CodexHarness`). `evaluate` and `ask` are
  * not adapter methods: core builds the prompt and calls `complete()` (see
  * prompts.ts), so every adapter gets routing and judging for free.
  *

package/dist/index.d.ts

@@ -27,8 +27,8 @@ export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRA
 export { consoleLogger } from "./types.js";
 export { execute, RouteEvaluationError } from "./executor.js";
 export type { ExecuteOptions } from "./executor.js";
-export { createHarness, claudeCompat, asClaude, policyGate, ClaudeCodeHarness } from "./harness/index.js";
-export type { AgentHarness, HarnessCapabilities, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass, ClaudeCodeHarnessOptions, } from "./harness/index.js";
+export { createHarness, claudeCompat, asClaude, policyGate, ClaudeCodeHarness, CodexHarness, SUPPORTED_AGENTS, } from "./harness/index.js";
+export type { AgentHarness, HarnessCapabilities, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass, ClaudeCodeHarnessOptions, CodexHarnessOptions, } from "./harness/index.js";
 export { ClaudeClient, resolveAuthEnv } from "./harness/claude-code.js";
 export type { ClaudeClientOptions, SwenyAuthMode, ResolveAuthEnvOpts } from "./harness/claude-code.js";
 export { resolveExecutionModel } from "./model.js";

package/dist/index.js

@@ -27,8 +27,8 @@ export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRA
 export { consoleLogger } from "./types.js";
 // Executor
 export { execute, RouteEvaluationError } from "./executor.js";
-// Agent harness (the seam) and its Claude Code adapter
-export { createHarness, claudeCompat, asClaude, policyGate, ClaudeCodeHarness } from "./harness/index.js";
+// Agent harness (the seam) and its adapters: Claude Code and Codex
+export { createHarness, claudeCompat, asClaude, policyGate, ClaudeCodeHarness, CodexHarness, SUPPORTED_AGENTS, } from "./harness/index.js";
 // Claude client (back-compat: ClaudeClient is ClaudeCodeHarness, @deprecated)
 export { ClaudeClient, resolveAuthEnv } from "./harness/claude-code.js";
 // Execution model resolution