@tangle-network/cli-agent-registry 0.14.0 → 0.15.0

package/dist/{specs-BSELpX1h.d.mts → spec-CcvTM7-j.d.mts}

@@ -1,12 +1,12 @@
-import { t as HarnessSessionContract } from "./session-contract-BC75JdnA.mjs";
-import { SdkProviderAdapter, WellKnownInteractionKind, agentProfileSchema } from "@tangle-network/agent-interface";
+import { t as HarnessSessionContract } from "./session-contract-BhzcbPRW.mjs";
+import { SdkProviderAdapter, WellKnownInteractionKind } from "@tangle-network/agent-interface";
 import { HarnessModelSupport, HarnessModelSupportOptions } from "@tangle-network/agent-interface/harness-capabilities";
 
 //#region src/cli-dir-layout.d.ts
 /**
  * How a parked export reads a CLI's own directory (`.codex`, `.claude`, …)
  * beyond the session stores its contract declares. Globs are relative to that
- * directory, in the session-contract glob syntax (`*`, `**`).
+ * directory except `homeSessionData`, in session-contract glob syntax (`*`, `**`).
  *
  * - `sessionData`: what holds a user's session, to be exported as a
  *   transcript is. Until the export carries it, it is missing, and the box is
@@ -24,8 +24,13 @@ import { HarnessModelSupport, HarnessModelSupportOptions } from "@tangle-network
  * version adds holds the box until it is classified here.
  */
 interface CliDirLayout {
+  /** Auxiliary session files relative to the owning runtime HOME, outside its CLI directory. */
+  homeSessionData: readonly string[];
   sessionData: readonly string[];
-  configAllow: readonly string[];
+  configAllow: readonly (string | {
+    path: string;
+    kind: "symlink";
+  })[];
   credential: readonly string[];
 }
 /** What every CLI's directory is read with; a spec adds its own entries. */
@@ -155,8 +160,8 @@ declare function canonicalModelSlug(model: string | {
 } | undefined): string | undefined;
 /**
  * Whether a harness can run a model, read from the one capability table in
- * `@tangle-network/agent-interface`: vendor locks (kimi-code runs Moonshot
- * models) and pairs measured to fail on production. A refused pair is refused
+ * `@tangle-network/agent-interface`: pairs measured to fail on production
+ * (and any vendor lock it declares). A refused pair is refused
  * where it is chosen (create, run, an authored workflow action) with the
  * returned message, rather than provisioning a box whose first model call
  * fails. An absent model is the harness's own default and is always supported.
@@ -223,13 +228,11 @@ interface CliAgentRuntimeSpec {
    * (`input.disableTools`). Execution fails loudly for harnesses without it.
    */
   supportsToolDisabledTurns?: boolean;
-  /**
-   * The adapter accepts a host-env redaction hook and the sidecar MUST wire
-   * its sanitizer into the adapter constructor so the agent process only
-   * inherits sandbox-public vars, never internal platform secrets. The
-   * binding fails closed if this declaration ever drifts off.
-   */
+  /** Adapter accepts host-env redaction; Sidecar must bind its sanitizer,
+   * admitting sandbox-public vars only and failing closed if this drifts off. */
   redactsHostEnv?: boolean;
+  /** Native launch and MCP custody implement secret-profile UID/HOME isolation. */
+  secretProfileIsolation?: boolean;
 }
 /**
  * A tool the harness ships built in, surfaced verbatim on the sidecar's
@@ -322,6 +325,11 @@ interface CliAgentSpec {
    * starts on the Router when the caller brings no credential of its own.
    */
   callerCredentialOnly?: boolean;
+  /** A capability the harness needs and Tangle sandboxes lack: creates are refused. */
+  unavailable?: {
+    capability: "docker";
+    reason: string;
+  };
 }
 type AdapterFactory = (logger: ProviderLogger) => SdkProviderAdapter;
 /** Bounded provider startup spans, timed by the operation's owner. */
@@ -334,82 +342,5 @@ type ProviderLogger = {
   observePhase?: (phase: ProviderPhase, durationMs: number, scope?: "turn" | "prewarm") => void;
 };
 //#endregion
-//#region src/specs.d.ts
-/**
- * Env var naming a sandbox's selected backend. Stamped into every create env
- * by the orchestrator (`buildSidecarContainerConfig`); read by the sidecar's
- * backend resolution (`resolveConfiguredBackend`) and by the host-agent's
- * warm-claim env selection to pick which spec's env vars the rebind delivers.
- */
-declare const AGENT_BACKEND_ENV_VAR = "AGENT_BACKEND";
-/**
- * The managed-router model-key channel every backend shares: the box-side
- * value is always the salted proxy dummy (`proxy-model-token.<salt>`), which
- * the per-sandbox egress proxy swaps for the real budget-scoped key at the
- * network boundary. The opencode-derived NAME is pinned naming debt: FC
- * shared-snapshot salt recovery, resume re-key, and the egress proxy swap map
- * all key on this literal, so renaming it bricks managed-model auth
- * fleet-wide. Kept equal to the opencode spec's own apiKey declaration
- * (enforced by a registry test).
- */
-declare const MANAGED_MODEL_KEY_ENV_VAR = "OPENCODE_MODEL_API_KEY";
-/**
- * Caller-owned auth by reference: the NAME of the box env var (a stored
- * secret) that holds the provider's key. The orchestrator sets it only when it
- * injected no managed key; the sidecar composes the named provider on that
- * credential. A variable name, never a secret, so it may ride every channel a
- * create's env takes to the guest — the kernel cmdline and a warm-claim rebind.
- */
-declare const MANAGED_MODEL_KEY_NAME_ENV_VAR = "OPENCODE_MODEL_API_KEY_ENV";
-/**
- * Env var names declared across ALL registered harness specs, grouped by
- * their `CliAgentEnvVars` role. The ONE derivation every allowlist that must
- * track "what env names can a backend legitimately use" builds from — the
- * FC kernel-cmdline whitelist, the egress secret handling, the sidecar
- * terminal scrub, the SSH env forward, and the rebind union below. Deriving
- * from roles (not one flat set) lets each consumer apply its own security
- * policy per role: apiKey and oauthToken names are secret channels.
- * Native subscription tokens stay out of warm-claim delivery.
- */
-declare function cliAgentEnvVarNamesByRole(): {
-  apiKey: ReadonlySet<string>;
-  oauthToken: ReadonlySet<string>;
-  model: ReadonlySet<string>;
-  baseUrl: ReadonlySet<string>;
-  authMode: ReadonlySet<string>;
-  authFiles: ReadonlySet<string>;
-  extras: ReadonlySet<string>;
-};
-/**
- * Union of every spec's `hostPassthroughEnvVars` — the operator tuning names
- * a host process (orchestrator system env, host-agent process env) may
- * forward into containers. Request/caller env always keeps precedence at the
- * host-agent boundary; the orchestrator system-env channel stays
- * operator-authoritative. Replaces the old `OPENCODE_*` prefix forward,
- * which leaked ANY stray host var with that prefix (model tuple and key
- * included) into every tenant.
- */
-declare function cliAgentHostPassthroughEnvVarNames(): ReadonlySet<string>;
-/**
- * Union of every env var name a warm-claim rebind may deliver, across all
- * registered harnesses. The ONE source both sides of the rebind derive from:
- * the host-agent selects its delivery from it and the sidecar rebind route
- * carves it out of the loader-control rejection, so the two can never drift
- * into "host delivers a name the sidecar 400s" — which silently cold-paths
- * every warm claim of that backend. Includes each spec's apiKey name because
- * acceptance is a superset of delivery: the HOST decides which key names are
- * safe to send (egress proxy-swap-covered only), while the sidecar must not
- * reject a name a valid host may deliver.
- */
-declare function claimDeliverableEnvVarNames(): ReadonlySet<string>;
-declare const CLI_AGENT_SPECS: readonly CliAgentSpec[];
-declare function getSpec(name: string): CliAgentSpec | undefined;
-/**
- * The directory, relative to a session's storage path, where a backend's
- * message log lives: the one value adapters, the sidecar and the parked
- * export read. Throws for a backend whose spec names none.
- */
-declare function messageStorageDirOf(name: string): string;
-//#endregion
-export { CliDirLayout as A, ProviderPhase as C, harnessModelSupportFor as D, cliAgentEnvRoleName as E, DEFAULT_CLI_DIR_LAYOUT as M, mergeCliDirLayout as N, harnessModelWire as O, ProviderLogger as S, cliAgentClaimEnvVarNames as T, CliAgentModelWire as _, agentProfileSchema as a, CliAuthHome as b, cliAgentHostPassthroughEnvVarNames as c, AdapterFactory as d, CliAgentBuiltinTool as f, CliAgentEnvVars as g, CliAgentEnvExtraRole as h, MANAGED_MODEL_KEY_NAME_ENV_VAR as i, CliDirLayoutAdditions as j, SYNTHETIC_ROUTER_MODEL as k, getSpec as l, CliAgentEnvExtraParser as m, CLI_AGENT_SPECS as n, claimDeliverableEnvVarNames as o, CliAgentEnvExtra as p, MANAGED_MODEL_KEY_ENV_VAR as r, cliAgentEnvVarNamesByRole as s, AGENT_BACKEND_ENV_VAR as t, messageStorageDirOf as u, CliAgentRuntimeSpec as v, canonicalModelSlug as w, HarnessSpecCapabilities as x, CliAgentSpec as y };
-//# sourceMappingURL=specs-BSELpX1h.d.mts.map
+export { mergeCliDirLayout as C, DEFAULT_CLI_DIR_LAYOUT as S, harnessModelSupportFor as _, CliAgentEnvExtraRole as a, CliDirLayout as b, CliAgentRuntimeSpec as c, HarnessSpecCapabilities as d, ProviderLogger as f, cliAgentEnvRoleName as g, cliAgentClaimEnvVarNames as h, CliAgentEnvExtraParser as i, CliAgentSpec as l, canonicalModelSlug as m, CliAgentBuiltinTool as n, CliAgentEnvVars as o, ProviderPhase as p, CliAgentEnvExtra as r, CliAgentModelWire as s, AdapterFactory as t, CliAuthHome as u, harnessModelWire as v, CliDirLayoutAdditions as x, SYNTHETIC_ROUTER_MODEL as y };
+//# sourceMappingURL=spec-CcvTM7-j.d.mts.map

package/dist/{specs-Bbiay_8K.mjs → specs-BBF55TnM.mjs}

@@ -1,5 +1,6 @@
-import { a as HARNESSES, r as NATIVE_SESSION_CONTRACTS } from "./native-session-contracts-DWFzgoye.mjs";
-import { n as BACKEND_TYPE } from "./backend-types-CREj4iOY.mjs";
+import { t as HARNESSES } from "./harness-contracts-BZoECCMc.mjs";
+import { NATIVE_SESSION_CONTRACTS } from "./native-session-contracts.mjs";
+import { n as BACKEND_TYPE } from "./backend-types-CNo_Zj_K.mjs";
 import { agentProfileJsonSchema, agentProfileSchema } from "@tangle-network/agent-interface";
 import { z } from "zod";
 import { harnessModelSupport } from "@tangle-network/agent-interface/harness-capabilities";
@@ -53,8 +54,8 @@ function canonicalModelSlug(model) {
 }
 /**
 * Whether a harness can run a model, read from the one capability table in
-* `@tangle-network/agent-interface`: vendor locks (kimi-code runs Moonshot
-* models) and pairs measured to fail on production. A refused pair is refused
+* `@tangle-network/agent-interface`: pairs measured to fail on production
+* (and any vendor lock it declares). A refused pair is refused
 * where it is chosen (create, run, an authored workflow action) with the
 * returned message, rather than provisioning a box whose first model call
 * fails. An absent model is the harness's own default and is always supported.
@@ -103,24 +104,9 @@ z.globalRegistry.add(agentProfileSchema, {
 * warm-claim env selection to pick which spec's env vars the rebind delivers.
 */
 const AGENT_BACKEND_ENV_VAR = "AGENT_BACKEND";
-/**
-* The managed-router model-key channel every backend shares: the box-side
-* value is always the salted proxy dummy (`proxy-model-token.<salt>`), which
-* the per-sandbox egress proxy swaps for the real budget-scoped key at the
-* network boundary. The opencode-derived NAME is pinned naming debt: FC
-* shared-snapshot salt recovery, resume re-key, and the egress proxy swap map
-* all key on this literal, so renaming it bricks managed-model auth
-* fleet-wide. Kept equal to the opencode spec's own apiKey declaration
-* (enforced by a registry test).
-*/
+/** Salted proxy model key. The name OPENCODE_MODEL_API_KEY is load-bearing; do not rename it. */
 const MANAGED_MODEL_KEY_ENV_VAR = "OPENCODE_MODEL_API_KEY";
-/**
-* Caller-owned auth by reference: the NAME of the box env var (a stored
-* secret) that holds the provider's key. The orchestrator sets it only when it
-* injected no managed key; the sidecar composes the named provider on that
-* credential. A variable name, never a secret, so it may ride every channel a
-* create's env takes to the guest — the kernel cmdline and a warm-claim rebind.
-*/
+/** Name of the box env var holding a caller-owned provider key. A name, never a secret. */
 const MANAGED_MODEL_KEY_NAME_ENV_VAR = "OPENCODE_MODEL_API_KEY_ENV";
 /**
 * Env var names declared across ALL registered harness specs, grouped by
@@ -197,22 +183,40 @@ function claimDeliverableEnvVarNames() {
 		...roles.apiKey
 	]);
 }
+const BASE_CAPABILITIES = {
+	streaming: true,
+	toolUse: true,
+	reasoning: true,
+	multimodal: false
+};
+/**
+* claude-code is the only provider that demotes uid + forces HOME=/home/agent
+* when the sidecar runs as root. All other CLIs inherit the sidecar HOME.
+*/
 const CLI_AGENT_SPECS = [
 	{
 		name: BACKEND_TYPE.OPENCODE,
 		nativeSession: NATIVE_SESSION_CONTRACTS.opencode,
 		messageStorageDir: ".opencode",
 		cliDirLayout: {
-			sessionData: ["snapshot/**"],
-			configAllow: ["bin/**"]
+			sessionData: [
+				"snapshot/**",
+				"agent-system-prompt.md",
+				"profile-instructions.md"
+			],
+			configAllow: [
+				"bin/**",
+				".gitignore",
+				"log",
+				"log/opencode.log",
+				"repos"
+			]
 		},
 		displayName: "OpenCode Agent",
 		description: "OpenCode CLI coding agent with native sessions, profiles, tools, and MCP.",
 		envVars: HARNESSES["opencode"].config.envVars,
 		capabilities: {
-			streaming: true,
-			toolUse: true,
-			reasoning: true,
+			...BASE_CAPABILITIES,
 			multimodal: true,
 			contextWindow: 2e5,
 			mcp: true,
@@ -314,10 +318,12 @@ const CLI_AGENT_SPECS = [
 		runtime: HARNESSES["claude-code"].lifecycle.runtime,
 		messageStorageDir: ".claude-code",
 		cliDirLayout: {
+			homeSessionData: [".cache/claude-cli-nodejs/-*/mcp-logs-*/*.jsonl"],
 			sessionData: [
 				"plans/**",
 				"file-history/**",
 				"debug/**",
+				"projects/*/memory/**/*.md",
 				"projects/*/*/subagents/**/*.meta.json",
 				"projects/*/*/tool-results/**"
 			],
@@ -325,6 +331,7 @@ const CLI_AGENT_SPECS = [
 				".last-cleanup",
 				"policy-limits.json*",
 				"remote-settings.json",
+				"remote-settings.json.synced-at",
 				"skills/**"
 			],
 			credential: [
@@ -339,9 +346,7 @@ const CLI_AGENT_SPECS = [
 		envVars: HARNESSES["claude-code"].config.envVars,
 		modelWire: HARNESSES["claude-code"].config.modelWire,
 		capabilities: {
-			streaming: true,
-			toolUse: true,
-			reasoning: true,
+			...BASE_CAPABILITIES,
 			multimodal: true,
 			contextWindow: 2e5,
 			mcp: true,
@@ -377,13 +382,12 @@ const CLI_AGENT_SPECS = [
 		nativeSession: NATIVE_SESSION_CONTRACTS["kimi-code"],
 		runtime: HARNESSES["kimi-code"].lifecycle.runtime,
 		messageStorageDir: ".kimi-code",
+		cliDirLayout: { credential: ["config.json"] },
 		displayName: "Kimi Code",
 		description: "Moonshot AI Kimi Code CLI — headless non-interactive mode via `kimi --print --output-format stream-json --prompt ...`. Defaults to OAuth (Kimi Code subscription) with credentials materialized from the host-managed ~/.kimi/credentials/kimi-code.json; falls back to MOONSHOT_API_KEY when an apiKey is supplied.",
 		envVars: HARNESSES["kimi-code"].config.envVars,
 		capabilities: {
-			streaming: true,
-			toolUse: true,
-			reasoning: true,
+			...BASE_CAPABILITIES,
 			multimodal: true,
 			contextWindow: 262144,
 			mcp: false,
@@ -399,19 +403,56 @@ const CLI_AGENT_SPECS = [
 	{
 		name: BACKEND_TYPE.CODEX,
 		nativeSession: NATIVE_SESSION_CONTRACTS.codex,
+		runtime: HARNESSES["codex"].lifecycle.runtime,
 		messageStorageDir: ".codex",
-		cliDirLayout: { sessionData: [
-			"logs_*.sqlite*",
-			"goals_*.sqlite*",
-			"memories_*.sqlite*"
-		] },
+		cliDirLayout: {
+			sessionData: [
+				...[
+					"logs",
+					"goals",
+					"memories"
+				].map((name) => `${name}_*.sqlite*`),
+				...[
+					"state_5",
+					"queue_1",
+					"thread_history_1"
+				].flatMap((name) => [
+					"",
+					"-wal",
+					"-shm"
+				].map((suffix) => `${name}.sqlite${suffix}`)),
+				"skills/**",
+				"cache/codex_apps_tools/**",
+				"cache/codex_apps_server_info/**",
+				"cache/remote_plugin_catalog/**",
+				"plugins/cache/**",
+				"mcp-oauth-locks/file-store.lock",
+				"mcp-oauth-locks/secrets-store.lock",
+				"thread-writer-locks/.coordination.lock",
+				"thread-writer-locks/*-*-*-*-*.lock",
+				"tmp/arg0/codex-arg0*/.lock"
+			],
+			configAllow: [
+				".sandbox_migration",
+				".sqlite-maintenance.lock",
+				...[
+					"apply_patch",
+					"applypatch",
+					"codex-execve-wrapper",
+					"codex-linux-sandbox"
+				].map((name) => ({
+					path: `tmp/arg0/codex-arg0*/${name}`,
+					kind: "symlink"
+				}))
+			],
+			credential: ["shell_snapshots/**"]
+		},
 		displayName: "Codex",
 		description: "OpenAI Codex CLI-based agent backend.",
 		envVars: HARNESSES["codex"].config.envVars,
 		modelWire: HARNESSES["codex"].config.modelWire,
 		capabilities: {
-			streaming: true,
-			toolUse: true,
+			...BASE_CAPABILITIES,
 			reasoning: false,
 			multimodal: true,
 			contextWindow: 128e3,
@@ -440,10 +481,8 @@ const CLI_AGENT_SPECS = [
 		callerCredentialOnly: true,
 		envVars: HARNESSES["amp"].config.envVars,
 		capabilities: {
-			streaming: true,
-			toolUse: true,
+			...BASE_CAPABILITIES,
 			reasoning: false,
-			multimodal: false,
 			contextWindow: 128e3,
 			mcp: false,
 			sessions: true,
@@ -462,10 +501,8 @@ const CLI_AGENT_SPECS = [
 		description: "Factory Droids CLI-based agent backend. A managed box runs its Tangle Router model as a droid custom model; a caller's FACTORY_API_KEY runs on the caller's Factory account.",
 		envVars: HARNESSES["factory-droids"].config.envVars,
 		capabilities: {
-			streaming: true,
-			toolUse: true,
+			...BASE_CAPABILITIES,
 			reasoning: false,
-			multimodal: false,
 			contextWindow: 128e3,
 			mcp: false,
 			sessions: true,
@@ -485,10 +522,7 @@ const CLI_AGENT_SPECS = [
 		description: "Pi CLI backend. Managed OpenAI-compatible model tuples use one private runtime HOME models.json and the shared Pi model schema.",
 		envVars: HARNESSES["pi"].config.envVars,
 		capabilities: {
-			streaming: true,
-			toolUse: true,
-			reasoning: true,
-			multimodal: false,
+			...BASE_CAPABILITIES,
 			contextWindow: 128e3,
 			mcp: true,
 			sessions: true,
@@ -510,9 +544,7 @@ const CLI_AGENT_SPECS = [
 		envVars: HARNESSES["prime"].config.envVars,
 		hostPassthroughEnvVars: ["PRIME_AGENT_INSTALL_UV", "PRIME_AGENT_KERNEL_PYTHON"],
 		capabilities: {
-			streaming: true,
-			toolUse: true,
-			reasoning: true,
+			...BASE_CAPABILITIES,
 			multimodal: true,
 			contextWindow: 128e3,
 			mcp: false,
@@ -536,10 +568,9 @@ const CLI_AGENT_SPECS = [
 		description: "Open-source self-improving CLI agent. Persistent memory and skills live in $HERMES_HOME (pinned to the per-session workspace mount, not the read-only in-box $HOME) across same-tenant snapshot resumes — the learning loop is the differentiator. Provider-pluggable; defaults to OpenRouter via Tangle Router.",
 		envVars: HARNESSES["hermes"].config.envVars,
 		capabilities: {
+			...BASE_CAPABILITIES,
 			streaming: false,
-			toolUse: true,
 			reasoning: false,
-			multimodal: false,
 			contextWindow: 2e5,
 			mcp: true,
 			sessions: true,
@@ -550,28 +581,6 @@ const CLI_AGENT_SPECS = [
 		cliAuthHome: { kind: "inherit-home" },
 		hasCliAuth: true
 	},
-	{
-		name: BACKEND_TYPE.FORGE,
-		nativeSession: NATIVE_SESSION_CONTRACTS.forge,
-		messageStorageDir: ".forge-agent",
-		displayName: "Forge (forgecode.dev)",
-		description: "Rust-built multi-provider coding agent from tailcallhq/forgecode. Speaks anthropic/openai/openrouter/gemini/deepseek/kimi + local providers (ollama, lm_studio, llama_cpp). Credentials live in ~/.forge/.credentials.json, materialized via the standard authFiles pipeline — no interactive `forge provider login` required.",
-		envVars: HARNESSES["forge"].config.envVars,
-		capabilities: {
-			streaming: false,
-			toolUse: true,
-			reasoning: true,
-			multimodal: false,
-			contextWindow: 2e5,
-			mcp: true,
-			sessions: true,
-			configurable: true,
-			interactions: [],
-			imageInput: false
-		},
-		cliAuthHome: { kind: "inherit-home" },
-		hasCliAuth: true
-	},
 	{
 		name: BACKEND_TYPE.OPENCLAW,
 		nativeSession: NATIVE_SESSION_CONTRACTS.openclaw,
@@ -581,9 +590,8 @@ const CLI_AGENT_SPECS = [
 		description: "Orchestrator-tier CLI agent that dispatches to underlying coding-agent CLIs (claude-cli, codex-cli, gemini-cli) via its built-in cliBackends plugin model. Use this when you want one entry point that intelligently routes tasks to the right coding harness.",
 		envVars: HARNESSES["openclaw"].config.envVars,
 		capabilities: {
+			...BASE_CAPABILITIES,
 			streaming: false,
-			toolUse: true,
-			reasoning: true,
 			multimodal: true,
 			contextWindow: 2e5,
 			mcp: true,
@@ -597,16 +605,14 @@ const CLI_AGENT_SPECS = [
 	},
 	{
 		name: BACKEND_TYPE.NANOCLAW,
-		nativeSession: null,
+		nativeSession: NATIVE_SESSION_CONTRACTS.nanoclaw,
 		messageStorageDir: ".nanoclaw-agent",
 		displayName: "NanoClaw",
-		description: "NanoClaw local socket bridge. Requires a running NanoClaw install and uses its `pnpm run chat` CLI channel; the adapter does not manage NanoClaw's Docker/service lifecycle.",
+		description: "NanoClaw local socket bridge. The daemon persists v2-sessions and the chat bridge prints the session id.",
 		envVars: HARNESSES["nanoclaw"].config.envVars,
 		capabilities: {
+			...BASE_CAPABILITIES,
 			streaming: false,
-			toolUse: true,
-			reasoning: true,
-			multimodal: false,
 			contextWindow: 2e5,
 			mcp: false,
 			sessions: true,
@@ -615,7 +621,11 @@ const CLI_AGENT_SPECS = [
 			imageInput: false
 		},
 		cliAuthHome: { kind: "inherit-home" },
-		hasCliAuth: false
+		hasCliAuth: false,
+		unavailable: {
+			capability: "docker",
+			reason: "NanoClaw runs its agent in Docker, which Tangle sandboxes do not offer. Use another harness, such as opencode."
+		}
 	},
 	{
 		name: BACKEND_TYPE.ACP,
@@ -625,10 +635,7 @@ const CLI_AGENT_SPECS = [
 		description: "Generic Agent Client Protocol bridge — fronts any ACP-compliant agent binary (claude-agent-acp, codex-acp, gemini, openclaw acp, hermes acp). Pick the backing agent via config.subAgent; hermes runs on the box's Router model when none is named. One TypeScript adapter, many supported coding harnesses.",
 		envVars: HARNESSES["acp"].config.envVars,
 		capabilities: {
-			streaming: true,
-			toolUse: true,
-			reasoning: true,
-			multimodal: false,
+			...BASE_CAPABILITIES,
 			contextWindow: 2e5,
 			mcp: false,
 			sessions: true,
@@ -646,12 +653,16 @@ const CLI_AGENT_SPECS = [
 		displayName: "Cursor Agent SDK",
 		description: "Cursor Agent SDK backend. Runs Cursor's local agent against the sandbox workspace via @cursor/sdk, using CURSOR_API_KEY or backend.model.apiKey for authentication.",
 		callerCredentialOnly: true,
-		egressHosts: ["api2.cursor.sh", "api.cursor.com"],
+		egressHosts: [
+			"api2.cursor.sh",
+			"api2direct.cursor.sh",
+			"api.cursor.com",
+			"api5.cursor.sh",
+			"*.api5.cursor.sh"
+		],
 		envVars: HARNESSES["cursor"].config.envVars,
 		capabilities: {
-			streaming: true,
-			toolUse: true,
-			reasoning: true,
+			...BASE_CAPABILITIES,
 			multimodal: true,
 			contextWindow: 2e5,
 			mcp: true,
@@ -663,6 +674,26 @@ const CLI_AGENT_SPECS = [
 		cliAuthHome: { kind: "inherit-home" },
 		hasCliAuth: false
 	},
+	{
+		name: BACKEND_TYPE.GROK,
+		nativeSession: NATIVE_SESSION_CONTRACTS.grok,
+		messageStorageDir: ".grok-sessions",
+		displayName: "Grok",
+		description: "Grok Build CLI. Headless grok -p against a caller base URL.",
+		envVars: HARNESSES.grok.config.envVars,
+		capabilities: {
+			...BASE_CAPABILITIES,
+			reasoning: false,
+			contextWindow: 128e3,
+			mcp: false,
+			sessions: true,
+			configurable: false,
+			interactions: [],
+			imageInput: false
+		},
+		cliAuthHome: { kind: "inherit-home" },
+		hasCliAuth: false
+	},
 	{
 		name: BACKEND_TYPE.CLI_BASE,
 		nativeSession: null,
@@ -670,10 +701,10 @@ const CLI_AGENT_SPECS = [
 		description: "Bare sandbox without an AI agent backend. Use when you want the workspace, tools, and SSH access but no LLM dispatch.",
 		envVars: HARNESSES["cli-base"].config.envVars,
 		capabilities: {
+			...BASE_CAPABILITIES,
 			streaming: false,
 			toolUse: false,
 			reasoning: false,
-			multimodal: false,
 			contextWindow: 0,
 			mcp: false,
 			sessions: false,
@@ -701,4 +732,4 @@ function messageStorageDirOf(name) {
 //#endregion
 export { agentProfileSchema as a, cliAgentHostPassthroughEnvVarNames as c, canonicalModelSlug as d, cliAgentClaimEnvVarNames as f, SYNTHETIC_ROUTER_MODEL as g, harnessModelWire as h, MANAGED_MODEL_KEY_NAME_ENV_VAR as i, getSpec as l, harnessModelSupportFor as m, CLI_AGENT_SPECS as n, claimDeliverableEnvVarNames as o, cliAgentEnvRoleName as p, MANAGED_MODEL_KEY_ENV_VAR as r, cliAgentEnvVarNamesByRole as s, AGENT_BACKEND_ENV_VAR as t, messageStorageDirOf as u };
 
-//# sourceMappingURL=specs-Bbiay_8K.mjs.map
+//# sourceMappingURL=specs-BBF55TnM.mjs.map

package/dist/specs.d.mts

@@ -1,3 +1,72 @@
-import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-CJH-wHS3.mjs";
-import { D as harnessModelSupportFor, O as harnessModelWire, T as cliAgentClaimEnvVarNames, _ as CliAgentModelWire, a as agentProfileSchema, c as cliAgentHostPassthroughEnvVarNames, i as MANAGED_MODEL_KEY_NAME_ENV_VAR, l as getSpec, n as CLI_AGENT_SPECS, o as claimDeliverableEnvVarNames, r as MANAGED_MODEL_KEY_ENV_VAR, s as cliAgentEnvVarNamesByRole, t as AGENT_BACKEND_ENV_VAR, u as messageStorageDirOf, w as canonicalModelSlug, y as CliAgentSpec } from "./specs-BSELpX1h.mjs";
-export { AGENT_BACKEND_ENV_VAR, ALL_BACKEND_TYPES, BACKEND_TYPE, BackendType, CLI_AGENT_SPECS, CliAgentModelWire, CliAgentSpec, MANAGED_MODEL_KEY_ENV_VAR, MANAGED_MODEL_KEY_NAME_ENV_VAR, agentProfileSchema, backendTypeSchema, canonicalModelSlug, claimDeliverableEnvVarNames, cliAgentClaimEnvVarNames, cliAgentEnvVarNamesByRole, cliAgentHostPassthroughEnvVarNames, getSpec, harnessModelSupportFor, harnessModelWire, isBackendType, messageStorageDirOf, parseBackendType };
+import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-DRmLR1e0.mjs";
+import { _ as harnessModelSupportFor, h as cliAgentClaimEnvVarNames, l as CliAgentSpec, m as canonicalModelSlug, s as CliAgentModelWire, v as harnessModelWire } from "./spec-CcvTM7-j.mjs";
+import { agentProfileSchema } from "@tangle-network/agent-interface";
+
+//#region src/specs.d.ts
+/**
+ * Env var naming a sandbox's selected backend. Stamped into every create env
+ * by the orchestrator (`buildSidecarContainerConfig`); read by the sidecar's
+ * backend resolution (`resolveConfiguredBackend`) and by the host-agent's
+ * warm-claim env selection to pick which spec's env vars the rebind delivers.
+ */
+declare const AGENT_BACKEND_ENV_VAR = "AGENT_BACKEND";
+/** Salted proxy model key. The name OPENCODE_MODEL_API_KEY is load-bearing; do not rename it. */
+declare const MANAGED_MODEL_KEY_ENV_VAR = "OPENCODE_MODEL_API_KEY";
+/** Name of the box env var holding a caller-owned provider key. A name, never a secret. */
+declare const MANAGED_MODEL_KEY_NAME_ENV_VAR = "OPENCODE_MODEL_API_KEY_ENV";
+/**
+ * Env var names declared across ALL registered harness specs, grouped by
+ * their `CliAgentEnvVars` role. The ONE derivation every allowlist that must
+ * track "what env names can a backend legitimately use" builds from — the
+ * FC kernel-cmdline whitelist, the egress secret handling, the sidecar
+ * terminal scrub, the SSH env forward, and the rebind union below. Deriving
+ * from roles (not one flat set) lets each consumer apply its own security
+ * policy per role: apiKey and oauthToken names are secret channels.
+ * Native subscription tokens stay out of warm-claim delivery.
+ */
+declare function cliAgentEnvVarNamesByRole(): {
+  apiKey: ReadonlySet<string>;
+  oauthToken: ReadonlySet<string>;
+  model: ReadonlySet<string>;
+  baseUrl: ReadonlySet<string>;
+  authMode: ReadonlySet<string>;
+  authFiles: ReadonlySet<string>;
+  extras: ReadonlySet<string>;
+};
+/**
+ * Union of every spec's `hostPassthroughEnvVars` — the operator tuning names
+ * a host process (orchestrator system env, host-agent process env) may
+ * forward into containers. Request/caller env always keeps precedence at the
+ * host-agent boundary; the orchestrator system-env channel stays
+ * operator-authoritative. Replaces the old `OPENCODE_*` prefix forward,
+ * which leaked ANY stray host var with that prefix (model tuple and key
+ * included) into every tenant.
+ */
+declare function cliAgentHostPassthroughEnvVarNames(): ReadonlySet<string>;
+/**
+ * Union of every env var name a warm-claim rebind may deliver, across all
+ * registered harnesses. The ONE source both sides of the rebind derive from:
+ * the host-agent selects its delivery from it and the sidecar rebind route
+ * carves it out of the loader-control rejection, so the two can never drift
+ * into "host delivers a name the sidecar 400s" — which silently cold-paths
+ * every warm claim of that backend. Includes each spec's apiKey name because
+ * acceptance is a superset of delivery: the HOST decides which key names are
+ * safe to send (egress proxy-swap-covered only), while the sidecar must not
+ * reject a name a valid host may deliver.
+ */
+declare function claimDeliverableEnvVarNames(): ReadonlySet<string>;
+/**
+ * claude-code is the only provider that demotes uid + forces HOME=/home/agent
+ * when the sidecar runs as root. All other CLIs inherit the sidecar HOME.
+ */
+declare const CLI_AGENT_SPECS: readonly CliAgentSpec[];
+declare function getSpec(name: string): CliAgentSpec | undefined;
+/**
+ * The directory, relative to a session's storage path, where a backend's
+ * message log lives: the one value adapters, the sidecar and the parked
+ * export read. Throws for a backend whose spec names none.
+ */
+declare function messageStorageDirOf(name: string): string;
+//#endregion
+export { AGENT_BACKEND_ENV_VAR, ALL_BACKEND_TYPES, BACKEND_TYPE, type BackendType, CLI_AGENT_SPECS, type CliAgentModelWire, type CliAgentSpec, MANAGED_MODEL_KEY_ENV_VAR, MANAGED_MODEL_KEY_NAME_ENV_VAR, agentProfileSchema, backendTypeSchema, canonicalModelSlug, claimDeliverableEnvVarNames, cliAgentClaimEnvVarNames, cliAgentEnvVarNamesByRole, cliAgentHostPassthroughEnvVarNames, getSpec, harnessModelSupportFor, harnessModelWire, isBackendType, messageStorageDirOf, parseBackendType };
+//# sourceMappingURL=specs.d.mts.map

package/dist/specs.mjs

@@ -1,3 +1,3 @@
-import { a as parseBackendType, i as isBackendType, n as BACKEND_TYPE, r as backendTypeSchema, t as ALL_BACKEND_TYPES } from "./backend-types-CREj4iOY.mjs";
-import { a as agentProfileSchema, c as cliAgentHostPassthroughEnvVarNames, d as canonicalModelSlug, f as cliAgentClaimEnvVarNames, h as harnessModelWire, i as MANAGED_MODEL_KEY_NAME_ENV_VAR, l as getSpec, m as harnessModelSupportFor, n as CLI_AGENT_SPECS, o as claimDeliverableEnvVarNames, r as MANAGED_MODEL_KEY_ENV_VAR, s as cliAgentEnvVarNamesByRole, t as AGENT_BACKEND_ENV_VAR, u as messageStorageDirOf } from "./specs-Bbiay_8K.mjs";
+import { a as parseBackendType, i as isBackendType, n as BACKEND_TYPE, r as backendTypeSchema, t as ALL_BACKEND_TYPES } from "./backend-types-CNo_Zj_K.mjs";
+import { a as agentProfileSchema, c as cliAgentHostPassthroughEnvVarNames, d as canonicalModelSlug, f as cliAgentClaimEnvVarNames, h as harnessModelWire, i as MANAGED_MODEL_KEY_NAME_ENV_VAR, l as getSpec, m as harnessModelSupportFor, n as CLI_AGENT_SPECS, o as claimDeliverableEnvVarNames, r as MANAGED_MODEL_KEY_ENV_VAR, s as cliAgentEnvVarNamesByRole, t as AGENT_BACKEND_ENV_VAR, u as messageStorageDirOf } from "./specs-BBF55TnM.mjs";
 export { AGENT_BACKEND_ENV_VAR, ALL_BACKEND_TYPES, BACKEND_TYPE, CLI_AGENT_SPECS, MANAGED_MODEL_KEY_ENV_VAR, MANAGED_MODEL_KEY_NAME_ENV_VAR, agentProfileSchema, backendTypeSchema, canonicalModelSlug, claimDeliverableEnvVarNames, cliAgentClaimEnvVarNames, cliAgentEnvVarNamesByRole, cliAgentHostPassthroughEnvVarNames, getSpec, harnessModelSupportFor, harnessModelWire, isBackendType, messageStorageDirOf, parseBackendType };