agentic-engineering-harness 0.4.16 → 0.6.0

package/dist/paseo/start.d.ts

@@ -0,0 +1,55 @@
+import type { ResolvedAgentTopology } from "../agents/types.js";
+import { loadResolvedAgentTopology } from "../agents/config.js";
+import type { HarnessProjectConfig } from "../core/types.js";
+import { setupToolchain } from "../toolchain/setup.js";
+import { commandExists, runProcess } from "../utils/process.js";
+import { detectPaseoCapabilities } from "./capabilities.js";
+export declare const PASEO_BOOTSTRAP_VERSION = 3;
+export type PaseoSessionPolicy = "fresh-on-start" | "reuse-compatible" | "resume-explicit";
+export interface PaseoStartOptions {
+    autoSetup?: boolean;
+    webUi?: boolean;
+    forceNew?: boolean;
+    resume?: boolean;
+    leadAgent?: string;
+    title?: string;
+    aehCommand?: string;
+    handoffPath?: string;
+}
+export interface PaseoLeadState {
+    version: 1;
+    bootstrapVersion: number;
+    projectRoot: string;
+    projectName: string;
+    agentId: string;
+    title: string;
+    leadAgent: string;
+    provider: string;
+    model: string;
+    createdAt: string;
+    generation?: number;
+    handoffPath?: string;
+}
+export interface PaseoStartResult {
+    daemonStarted: boolean;
+    session: "created" | "reused";
+    agentId: string;
+    title: string;
+    leadAgent: string;
+    provider: string;
+    model: string;
+    stateFile: string;
+    bootstrapFile: string;
+    paseoVersion?: string;
+}
+interface PaseoStartDeps {
+    run: typeof runProcess;
+    commandExists: typeof commandExists;
+    setupToolchain: typeof setupToolchain;
+    loadTopology: typeof loadResolvedAgentTopology;
+    detectCapabilities: typeof detectPaseoCapabilities;
+}
+export declare function startPaseoHarness(root: string, config: HarnessProjectConfig, options?: PaseoStartOptions, deps?: PaseoStartDeps): Promise<PaseoStartResult>;
+export declare function buildPaseoLeadBootstrap(projectName: string, projectRoot: string, aehCommand: string, preferPaseoTools?: boolean, handoffPath?: string): string;
+export declare function resolveLeadAgent(topology: ResolvedAgentTopology, configured?: string): string;
+export {};

package/dist/paseo/start.js

@@ -0,0 +1,138 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { loadResolvedAgentTopology } from "../agents/config.js";
+import { executionSelectionForAgent } from "../agents/routing.js";
+import { setupToolchain } from "../toolchain/setup.js";
+import { clearToolchainEnvCache, commandExists, runProcess } from "../utils/process.js";
+import { buildPaseoBackgroundRunCommand, detectPaseoCapabilities, extractPaseoAgentId, isRecoverableDaemonStatus } from "./capabilities.js";
+export const PASEO_BOOTSTRAP_VERSION = 3;
+const DEFAULT_DEPS = { run: runProcess, commandExists, setupToolchain, loadTopology: loadResolvedAgentTopology, detectCapabilities: detectPaseoCapabilities };
+export async function startPaseoHarness(root, config, options = {}, deps = DEFAULT_DEPS) {
+    const projectRoot = path.resolve(root);
+    const settings = config.orchestration?.interactive;
+    const autoSetup = options.autoSetup ?? settings?.autoSetup ?? true;
+    const webUi = options.webUi ?? settings?.webUi ?? true;
+    const stateDir = path.resolve(projectRoot, settings?.stateDir ?? ".harness/paseo");
+    const stateFile = path.join(stateDir, "lead-session.json");
+    const bootstrapFile = path.join(stateDir, "lead-bootstrap.md");
+    const sessionPolicy = settings?.sessionPolicy ?? "fresh-on-start";
+    const reuseRequested = options.resume === true || (sessionPolicy === "reuse-compatible" && options.forceNew !== true);
+    const topology = await deps.loadTopology(projectRoot, config, config.agents?.activeProfile);
+    const leadName = resolveLeadAgent(topology, options.leadAgent ?? settings?.leadAgent);
+    const selection = executionSelectionForAgent(topology, leadName);
+    const runtimeCommand = runtimeExecutable(topology, leadName);
+    const missingBefore = await missingCommands(projectRoot, ["paseo", runtimeCommand], deps);
+    if (missingBefore.length && autoSetup) {
+        await deps.setupToolchain(projectRoot, config, { skipProjectDependencies: true });
+        clearToolchainEnvCache();
+    }
+    const missingAfter = await missingCommands(projectRoot, ["paseo", runtimeCommand], deps);
+    if (missingAfter.length)
+        throw new Error(`aeh start cannot launch Paseo because these managed commands are unavailable: ${missingAfter.join(", ")}. Run aeh setup or provide the required host prerequisite/credential.`);
+    const capabilities = await deps.detectCapabilities(projectRoot, deps.run);
+    let daemonStarted = false;
+    const daemonStatusCommand = capabilities.daemonJson ? "paseo daemon status --json" : "paseo daemon status";
+    let daemonStatus = await deps.run(daemonStatusCommand, { cwd: projectRoot, timeoutMs: 30_000 });
+    if (daemonStatus.exitCode !== 0) {
+        if (isRecoverableDaemonStatus(daemonStatus))
+            await deps.run("paseo daemon stop", { cwd: projectRoot, timeoutMs: 30_000 }).catch(() => undefined);
+        const startCommand = webUi ? "paseo daemon start --web-ui" : "paseo daemon start";
+        const daemonStart = await deps.run(startCommand, { cwd: projectRoot, timeoutMs: 60_000 });
+        if (daemonStart.exitCode !== 0)
+            throw new Error(`Failed to start Paseo daemon: ${diagnostic(daemonStart)}`);
+        daemonStarted = true;
+        daemonStatus = await deps.run(daemonStatusCommand, { cwd: projectRoot, timeoutMs: 30_000 });
+        if (daemonStatus.exitCode !== 0)
+            throw new Error(`Paseo daemon did not become ready after startup: ${diagnostic(daemonStatus)}`);
+    }
+    const provider = selection.paseoProvider;
+    const model = paseoModel(selection);
+    const title = options.title ?? settings?.title ?? `AEH Lead · ${config.project.name}`;
+    const aehCommand = options.aehCommand ?? "aeh";
+    const bootstrap = buildPaseoLeadBootstrap(config.project.name, projectRoot, aehCommand, settings?.usePaseoTools !== false, options.handoffPath);
+    await fs.mkdir(stateDir, { recursive: true });
+    await fs.writeFile(bootstrapFile, `${bootstrap}\n`);
+    const previous = await loadState(stateFile);
+    if (!options.forceNew && reuseRequested && !options.handoffPath && previous && compatibleState(previous, { projectRoot, leadName, provider, model, title })) {
+        const probe = await deps.run(`paseo logs ${quote(previous.agentId)} --tail 1`, { cwd: projectRoot, timeoutMs: 30_000 });
+        if (probe.exitCode === 0)
+            return { daemonStarted, session: "reused", agentId: previous.agentId, title: previous.title, leadAgent: previous.leadAgent, provider: previous.provider, model: previous.model, stateFile, bootstrapFile, paseoVersion: capabilities.version };
+    }
+    const launchCommand = buildPaseoBackgroundRunCommand({ title, provider, model, prompt: bootstrap }, capabilities);
+    const launch = await deps.run(launchCommand, { cwd: projectRoot, timeoutMs: 60_000 });
+    if (launch.exitCode !== 0)
+        throw new Error(`Failed to create AEH lead in Paseo${capabilities.version ? ` ${capabilities.version}` : ""}: ${diagnostic(launch)}`);
+    const agentId = extractPaseoAgentId(launch.stdout);
+    if (!agentId)
+        throw new Error(`Paseo created no parseable agent id. Output: ${launch.stdout.trim() || "<empty>"}`);
+    const wait = await deps.run(`paseo wait ${quote(agentId)} --timeout 300`, { cwd: projectRoot, timeoutMs: 330_000 });
+    if (wait.exitCode !== 0)
+        throw new Error(`AEH lead bootstrap did not complete successfully: ${diagnostic(wait)}`);
+    const state = { version: 1, bootstrapVersion: PASEO_BOOTSTRAP_VERSION, projectRoot, projectName: config.project.name, agentId, title, leadAgent: leadName, provider, model, createdAt: new Date().toISOString(), generation: (previous?.generation ?? 0) + 1, handoffPath: options.handoffPath };
+    await fs.writeFile(stateFile, `${JSON.stringify(state, null, 2)}\n`);
+    return { daemonStarted, session: "created", agentId, title, leadAgent: leadName, provider, model, stateFile, bootstrapFile, paseoVersion: capabilities.version };
+}
+export function buildPaseoLeadBootstrap(projectName, projectRoot, aehCommand, preferPaseoTools = true, handoffPath) {
+    const handoff = handoffPath ? `\n\nThis lead was created by proactive context rotation. Before handling the next engineering action, read the deterministic handoff artifact ${JSON.stringify(handoffPath)} and every sealed/run/audit/delivery artifact it references. Treat that durable state as authoritative; do not ask the previous lead to replay its conversation. Preserve the same active user goal unless the handoff records a true ambiguity.` : "";
+    return `AEH thin-lead Paseo bootstrap v${PASEO_BOOTSTRAP_VERSION}.
+
+You are the top-level engineering lead for project ${JSON.stringify(projectName)} at ${JSON.stringify(projectRoot)}. This instruction governs every later user message in this Paseo conversation. This lead is intentionally short-lived: a normal \`aeh start\` creates a fresh lead; explicit resume is opt-in.${handoff}
+
+Before engineering work, read AGENTS.md and .harness/skills/engineering-workflow/SKILL.md when present. Every engineering operation must enter through AEH, including read-only audits. Only purely informational questions may bypass. Whenever the workflow says \`aeh\`, invoke exactly: \`${aehCommand}\`.
+
+You are an ORCHESTRATOR, not the repository operator. Your responsibilities are: preserve user intent, choose/delegate workflow roles, resolve genuine ambiguity, monitor deterministic state, and perform final semantic acceptance. Do not spend your context doing broad repository exploration, package installation, daemon debugging, specification authoring, implementation, or raw log analysis when a bounded agent/Harness operation can own it.
+
+Delegation policy:
+- repository discovery/evidence -> explorer;
+- toolchain, doctor, agents-check or Paseo daemon/provider recovery -> environment-manager;
+- non-trivial triage/decomposition -> planner;
+- SPEC authoring -> spec-manager using OpenSpec, never write proposal/spec/design/tasks yourself;
+- implementation, validation and reviews -> AEH/Harness-selected workers.
+
+${preferPaseoTools ? `Prefer Paseo's injected native/MCP orchestration tools (create_agent, send_agent_prompt, get_agent_status, get_agent_activity, cancel_agent/archive_agent) and load /paseo when exact syntax is needed. Use /paseo-handoff for responsibility transfer. Do not shell out to hand-written paseo run loops from this lead. AEH's CLI adapter is only a compatibility fallback.` : `Use AEH's configured Paseo adapter for delegation; do not hand-write shell orchestration loops.`}
+
+For every non-trivial user request:
+1. check context pressure with Paseo status if exposed, or \`${aehCommand} context guard --agent "$PASEO_AGENT_ID"\`. At 70% stop exploratory work. At 80% AEH automatically creates a deterministic handoff artifact and, when possible, rotates the persisted lead to a fresh Paseo agent; if the command reports rotatedAgentId, tell the user to continue in that fresh lead and stop this lead. At 90% no further engineering work is allowed in the old lead. Do not compact-and-continue after HANDOFF_REQUIRED/HARD_HANDOFF;
+2. classify INFORMATIONAL | AUDIT | CHANGE using \`${aehCommand} intent\` when not trivially informational;
+3. for AUDIT, invoke \`${aehCommand} audit\`; do not perform an ad-hoc review;
+4. for CHANGE, delegate discovery to explorer and planning/triage evidence to planner. Feed only their compact structured evidence into deterministic \`${aehCommand} triage\`;
+5. QUICK: create/validate/run the bounded QuickContract. Do not broaden QUICK;
+6. SPEC: delegate to spec-manager. spec-manager owns OpenSpec artifacts and returns a compiled/validated AEH SDD/TaskContract. The lead must not author those files. Then invoke the sealed AEH run;
+7. if execution reports environment/tool failure, delegate recovery to environment-manager and retry the same sealed operation after deterministic readiness. Do not personally run sequences of npm/git/Paseo diagnostic shells;
+8. surface only concise state transitions, true human-on-exception decisions, and final audit/acceptance/delivery state.
+
+Existing GitHub issue requests use the issue-driven AEH path. A later request to fix audit findings must reuse .harness/audits/latest.json as evidence for a new CHANGE. Security, architecture, schema, public API and cross-module changes still escalate to SPEC.
+
+The compiled AEH TaskContract/SDD plus seal are normative during implementation. OpenSpec is an authoring source before freeze, not a competing runtime authority. Harness workers/subagents do not replace this lead unless an explicit context handoff rotates responsibility.
+
+Initialize this role now by reading only the project entry instructions needed to understand these rules. Do not run doctor/setup or inspect the repository broadly during bootstrap. When initialization is complete, respond with exactly: AEH READY`;
+}
+export function resolveLeadAgent(topology, configured) {
+    if (configured) {
+        const selected = topology.agents[configured];
+        if (!selected || selected.disabled)
+            throw new Error(`Configured interactive lead agent '${configured}' is unavailable.`);
+        return configured;
+    }
+    if (topology.agents.lead && !topology.agents.lead.disabled)
+        return "lead";
+    const orchestrator = Object.values(topology.agents).find((agent) => agent.role === "orchestrator" && !agent.disabled);
+    if (!orchestrator)
+        throw new Error("aeh start requires an enabled orchestrator/lead agent in the resolved topology.");
+    return orchestrator.name;
+}
+function runtimeExecutable(topology, leadName) { const runtime = topology.agents[leadName].runtime; return runtime.command?.trim().split(/\s+/, 1)[0] || runtime.adapter; }
+async function missingCommands(root, commands, deps) { const result = []; for (const command of [...new Set(commands.filter(Boolean))])
+    if (!(await deps.commandExists(command, root)))
+        result.push(command); return result; }
+function paseoModel(selection) { return selection.runtimeAdapter === "codex" ? selection.modelName : selection.modelId; }
+async function loadState(file) { try {
+    return JSON.parse(await fs.readFile(file, "utf8"));
+}
+catch {
+    return undefined;
+} }
+function compatibleState(state, expected) { return state.version === 1 && state.bootstrapVersion === PASEO_BOOTSTRAP_VERSION && state.projectRoot === expected.projectRoot && state.leadAgent === expected.leadName && state.provider === expected.provider && state.model === expected.model && state.title === expected.title; }
+function diagnostic(result) { return [result.stderr.trim(), result.stdout.trim()].filter(Boolean).join("\n") || `exit code ${result.exitCode}`; }
+function quote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
+//# sourceMappingURL=start.js.map

package/dist/paseo/start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/paseo/start.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,UAAU,EAAsB,MAAM,qBAAqB,CAAC;AAC5G,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE5I,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAOzC,MAAM,YAAY,GAAmB,EAAE,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,CAAC;AAG9K,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAA4B,EAAE,UAA6B,EAAE,EAAE,OAAuB,YAAY;IACtJ,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,EAAE,WAAwC,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,IAAI,gBAAgB,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,QAAQ,EAAE,aAAa,IAAI,gBAAgB,CAAC;IAClE,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,KAAK,kBAAkB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;IAEtH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE7D,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1F,IAAI,aAAa,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QAAC,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,sBAAsB,EAAE,CAAC;IAAC,CAAC;IACvJ,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IACzF,IAAI,YAAY,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IAE1N,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,mBAAmB,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAC3G,IAAI,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,IAAI,YAAY,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,yBAAyB,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjJ,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAClF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5G,aAAa,GAAG,IAAI,CAAC;QACrB,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5F,IAAI,YAAY,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,KAAK,IAAI,cAAc,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACtF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;IAC/C,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,KAAK,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAChJ,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,QAAQ,IAAI,eAAe,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC5J,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACxH,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;IAC3Q,CAAC;IAED,MAAM,aAAa,GAAG,8BAA8B,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,CAAC;IAClH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjK,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;IACnH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACpH,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAElH,MAAM,KAAK,GAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;IACjT,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;AACnK,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,WAAmB,EAAE,WAAmB,EAAE,UAAkB,EAAE,gBAAgB,GAAG,IAAI,EAAE,WAAoB;IACjJ,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,iJAAiJ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,kPAAkP,CAAC,CAAC,CAAC,EAAE,CAAC;IAClc,OAAO,kCAAkC,uBAAuB;;qDAEb,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,kMAAkM,OAAO;;gSAE3B,UAAU;;;;;;;;;;;EAWxS,gBAAgB,CAAC,CAAC,CAAC,8WAA8W,CAAC,CAAC,CAAC,iGAAiG;;;+DAGxa,UAAU;qDACpB,UAAU;yBACtC,UAAU;0JACuH,UAAU;;;;;;;;;;uPAUmF,CAAC;AACxP,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAA+B,EAAE,UAAmB;IACnF,IAAI,UAAU,EAAE,CAAC;QAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,UAAU,mBAAmB,CAAC,CAAC;QAAC,OAAO,UAAU,CAAC;IAAC,CAAC;IAC9M,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC1E,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtH,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACtH,OAAO,YAAY,CAAC,IAAI,CAAC;AAC3B,CAAC;AACD,SAAS,iBAAiB,CAAC,QAA+B,EAAE,QAAgB,IAAY,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAClN,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,QAAkB,EAAE,IAAoB,IAAuB,MAAM,MAAM,GAAa,EAAE,CAAC,CAAC,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAAE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC;AAC7R,SAAS,UAAU,CAAC,SAAkC,IAAY,OAAO,SAAS,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1J,KAAK,UAAU,SAAS,CAAC,IAAY,IAAyC,IAAI,CAAC;IAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAmB,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,SAAS,CAAC;AAAC,CAAC,CAAC,CAAC;AACzL,SAAS,eAAe,CAAC,KAAqB,EAAE,QAAmG,IAAa,OAAO,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,uBAAuB,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACtb,SAAS,UAAU,CAAC,MAAqB,IAAY,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AACxK,SAAS,KAAK,CAAC,KAAa,IAAY,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC"}

package/dist/policy/bundles.d.ts

@@ -0,0 +1,27 @@
+import type { HarnessProjectConfig } from "../core/types.js";
+export interface PolicyBundleFile {
+    path: string;
+    sha256: string;
+}
+export interface OrganizationPolicyBundleManifest {
+    version: 1;
+    name: string;
+    extends?: string[];
+    policyDirs?: string[];
+    files: PolicyBundleFile[];
+}
+export interface ResolvedPolicyBundle {
+    name: string;
+    root: string;
+    manifestSha256: string;
+    verifiedSignature: boolean;
+    policyDirs: string[];
+    extends: string[];
+}
+export interface PolicyBundleResolution {
+    bundles: ResolvedPolicyBundle[];
+    policyDirs: string[];
+    issues: string[];
+}
+export declare function resolveOrganizationPolicyBundles(root: string, config: HarnessProjectConfig): Promise<PolicyBundleResolution>;
+export declare function withOrganizationPolicies(config: HarnessProjectConfig, resolution: PolicyBundleResolution): HarnessProjectConfig;

package/dist/policy/bundles.js

@@ -0,0 +1,129 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { commandExists, runProcess } from "../utils/process.js";
+export async function resolveOrganizationPolicyBundles(root, config) {
+    const settings = config.organization?.policyBundles;
+    const sources = settings?.sources ?? [];
+    if (!sources.length)
+        return { bundles: [], policyDirs: [], issues: [] };
+    const cacheRoot = path.resolve(root, settings?.cacheDir ?? ".harness/policy-bundles");
+    await fs.mkdir(cacheRoot, { recursive: true });
+    const byName = new Map(sources.map((source) => [source.name, source]));
+    const resolved = new Map();
+    const issues = [];
+    const visiting = new Set();
+    const visit = async (name) => {
+        if (resolved.has(name))
+            return;
+        if (visiting.has(name))
+            throw new Error(`Organization policy bundle inheritance cycle at ${name}.`);
+        const source = byName.get(name);
+        if (!source)
+            throw new Error(`Organization policy bundle '${name}' is referenced but not configured.`);
+        visiting.add(name);
+        try {
+            const bundle = await materializeBundle(root, cacheRoot, source);
+            for (const parent of bundle.extends)
+                await visit(parent);
+            resolved.set(name, bundle);
+        }
+        catch (error) {
+            const message = `${name}: ${String(error)}`;
+            issues.push(message);
+            if (source.required !== false || settings?.required === true)
+                throw new Error(`Required organization policy bundle failed: ${message}`);
+        }
+        finally {
+            visiting.delete(name);
+        }
+    };
+    for (const source of sources)
+        await visit(source.name);
+    const bundles = [...resolved.values()];
+    return { bundles, policyDirs: [...new Set(bundles.flatMap((bundle) => bundle.policyDirs))], issues };
+}
+export function withOrganizationPolicies(config, resolution) {
+    if (!resolution.policyDirs.length)
+        return config;
+    const existing = config.validation?.opa?.policyDirs ?? [];
+    return {
+        ...config,
+        validation: {
+            ...config.validation,
+            opa: { ...config.validation?.opa, enabled: config.validation?.opa?.enabled ?? true, policyDirs: [...new Set([...existing, ...resolution.policyDirs])] }
+        }
+    };
+}
+async function materializeBundle(projectRoot, cacheRoot, source) {
+    const target = path.join(cacheRoot, safe(source.name));
+    await fs.rm(target, { recursive: true, force: true });
+    await fs.mkdir(target, { recursive: true });
+    const loaded = source.path ? await loadLocalManifest(projectRoot, source.path) : await loadRemoteManifest(source.url);
+    if (loaded.manifest.name !== source.name)
+        throw new Error(`manifest name '${loaded.manifest.name}' does not match configured source '${source.name}'.`);
+    const manifestHash = sha256(loaded.raw);
+    if (source.sha256 && source.sha256 !== manifestHash)
+        throw new Error(`manifest SHA-256 mismatch: expected ${source.sha256}, got ${manifestHash}.`);
+    const manifestFile = path.join(target, "bundle.json");
+    await fs.writeFile(manifestFile, loaded.raw);
+    let verifiedSignature = false;
+    if (source.signature || source.publicKey) {
+        if (!source.signature || !source.publicKey)
+            throw new Error("signed bundle requires both signature and publicKey.");
+        verifiedSignature = await verifySignature(projectRoot, manifestFile, source.signature, source.publicKey);
+        if (!verifiedSignature)
+            throw new Error("cosign signature verification failed.");
+    }
+    for (const file of loaded.manifest.files) {
+        if (file.path.includes("..") || path.isAbsolute(file.path))
+            throw new Error(`unsafe bundle file path ${file.path}.`);
+        const content = source.path ? await readLocalBundleFile(projectRoot, source.path, file.path) : await readRemoteBundleFile(source.url, file.path);
+        const actual = sha256(content);
+        if (actual !== file.sha256)
+            throw new Error(`${file.path} SHA-256 mismatch: expected ${file.sha256}, got ${actual}.`);
+        const destination = path.join(target, file.path);
+        await fs.mkdir(path.dirname(destination), { recursive: true });
+        await fs.writeFile(destination, content);
+    }
+    const policyDirs = (loaded.manifest.policyDirs?.length ? loaded.manifest.policyDirs : ["policies"]).map((relative) => path.relative(projectRoot, path.resolve(target, relative)).replaceAll("\\", "/"));
+    return { name: source.name, root: target, manifestSha256: manifestHash, verifiedSignature, policyDirs, extends: loaded.manifest.extends ?? [] };
+}
+async function loadLocalManifest(projectRoot, configuredPath) {
+    const source = path.resolve(projectRoot, configuredPath);
+    const stat = await fs.stat(source);
+    const manifestFile = stat.isDirectory() ? path.join(source, "bundle.json") : source;
+    const raw = await fs.readFile(manifestFile);
+    return { manifest: parseManifest(raw), raw };
+}
+async function loadRemoteManifest(url) {
+    const response = await fetch(url);
+    if (!response.ok)
+        throw new Error(`unable to fetch manifest ${url}: HTTP ${response.status}`);
+    const raw = Buffer.from(await response.arrayBuffer());
+    return { manifest: parseManifest(raw), raw };
+}
+function parseManifest(raw) {
+    const value = JSON.parse(raw.toString("utf8"));
+    if (value.version !== 1 || !value.name || !Array.isArray(value.files))
+        throw new Error("invalid organization policy bundle manifest.");
+    for (const file of value.files)
+        if (!file.path || !/^[a-f0-9]{64}$/.test(file.sha256))
+            throw new Error(`invalid bundle file declaration ${file.path ?? "<missing>"}.`);
+    return value;
+}
+async function readLocalBundleFile(projectRoot, configuredPath, relative) { const source = path.resolve(projectRoot, configuredPath); const stat = await fs.stat(source); const base = stat.isDirectory() ? source : path.dirname(source); return fs.readFile(path.resolve(base, relative)); }
+async function readRemoteBundleFile(manifestUrl, relative) { const url = new URL(relative, manifestUrl).toString(); const response = await fetch(url); if (!response.ok)
+    throw new Error(`unable to fetch bundle file ${url}: HTTP ${response.status}`); return Buffer.from(await response.arrayBuffer()); }
+async function verifySignature(root, manifestFile, signature, publicKey) {
+    if (!(await commandExists("cosign", root)))
+        throw new Error("cosign is required to verify the configured organization policy bundle signature.");
+    const signaturePath = path.resolve(root, signature);
+    const keyPath = path.resolve(root, publicKey);
+    const result = await runProcess(`cosign verify-blob --key ${quote(keyPath)} --signature ${quote(signaturePath)} ${quote(manifestFile)}`, { cwd: root, timeoutMs: 60_000 });
+    return result.exitCode === 0;
+}
+function sha256(value) { return crypto.createHash("sha256").update(value).digest("hex"); }
+function safe(value) { return value.replace(/[^A-Za-z0-9._-]/g, "-"); }
+function quote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
+//# sourceMappingURL=bundles.js.map

package/dist/policy/bundles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundles.js","sourceRoot":"","sources":["../../src/policy/bundles.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAahE,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,IAAY,EAAE,MAA4B;IAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC;IACpD,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,yBAAyB,CAAC,CAAC;IACtF,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QAClD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/B,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,GAAG,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,qCAAqC,CAAC,CAAC;QACxI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAChE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YACzD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,GAAG,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,QAAQ,EAAE,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,EAAE,CAAC,CAAC;QAC1I,CAAC;gBAAS,CAAC;YAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACtC,CAAC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAA4B,EAAE,UAAkC;IACvG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE;YACV,GAAG,MAAM,CAAC,UAAU;YACpB,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;SACxJ;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,WAAmB,EAAE,SAAiB,EAAE,MAAgC;IACvG,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC;IACvH,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,QAAQ,CAAC,IAAI,uCAAuC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IACxJ,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,MAAM,SAAS,YAAY,GAAG,CAAC,CAAC;IACnJ,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACpG,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACpH,iBAAiB,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzG,IAAI,CAAC,iBAAiB;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACrH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,GAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClJ,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,+BAA+B,IAAI,CAAC,MAAM,SAAS,MAAM,GAAG,CAAC,CAAC;QACtJ,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC7J,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACxM,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;AAClJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,WAAmB,EAAE,cAAsB;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAAC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAClL,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;AAC5F,CAAC;AACD,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,UAAU,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAAC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;AACxO,CAAC;AACD,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAqC,CAAC;IACnF,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACvI,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC;IACvK,OAAO,KAAK,CAAC;AACf,CAAC;AACD,KAAK,UAAU,mBAAmB,CAAC,WAAmB,EAAE,cAAsB,EAAE,QAAgB,IAAqB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACvU,KAAK,UAAU,oBAAoB,CAAC,WAAmB,EAAE,QAAgB,IAAqB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;IAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,UAAU,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7U,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,YAAoB,EAAE,SAAiB,EAAE,SAAiB;IACrG,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACjJ,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,4BAA4B,KAAK,CAAC,OAAO,CAAC,gBAAgB,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3K,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;AAC/B,CAAC;AACD,SAAS,MAAM,CAAC,KAAsB,IAAY,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnH,SAAS,IAAI,CAAC,KAAa,IAAY,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,SAAS,KAAK,CAAC,KAAa,IAAY,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC"}

package/dist/security/sandbox.d.ts

@@ -0,0 +1,12 @@
+import type { AgentExecutionSelection } from "../agents/types.js";
+import type { HarnessProjectConfig, TaskRisk } from "../core/types.js";
+export interface SandboxDecision {
+    required: boolean;
+    provider: string;
+    reasons: string[];
+    selection: AgentExecutionSelection;
+}
+export declare function enforceSandboxPolicy(selection: AgentExecutionSelection, config: HarnessProjectConfig, risk?: TaskRisk): SandboxDecision;
+export declare function hardenedPodmanArgs(config: HarnessProjectConfig, selection: AgentExecutionSelection, writable: boolean): string[];
+export declare function sandboxImage(config: HarnessProjectConfig): string;
+export declare function allowedSandboxEnvironment(config: HarnessProjectConfig, source?: NodeJS.ProcessEnv): Record<string, string>;

package/dist/security/sandbox.js

@@ -0,0 +1,64 @@
+export function enforceSandboxPolicy(selection, config, risk = "low") {
+    const sandbox = config.security?.sandbox;
+    const force = (sandbox?.forceForRisks ?? []).includes(risk);
+    const required = sandbox?.required === true || force;
+    const provider = sandbox?.provider ?? "podman";
+    if (!required)
+        return { required: false, provider, reasons: [], selection };
+    if (provider === "none")
+        throw new Error(`Sandbox is required for ${risk}-risk work but security.sandbox.provider is none.`);
+    if (selection.runtimeAdapter !== "opencode")
+        throw new Error(`Sandbox policy requires ${provider}, but runtime ${selection.runtimeAdapter} is not supported by the hardened worker sandbox.`);
+    if (!sandbox?.image)
+        throw new Error("Sandbox policy requires security.sandbox.image.");
+    return { required: true, provider, reasons: force ? [`risk:${risk}`] : ["security.sandbox.required"], selection: { ...selection, transport: provider === "podman" ? "podman" : selection.transport } };
+}
+export function hardenedPodmanArgs(config, selection, writable) {
+    const sandbox = config.security?.sandbox;
+    const args = ["--rm", "-i", "--userns=keep-id"];
+    if (sandbox?.readOnlyRoot !== false)
+        args.push("--read-only");
+    if (sandbox?.capDropAll !== false)
+        args.push("--cap-drop=ALL");
+    if (sandbox?.noNewPrivileges !== false)
+        args.push("--security-opt=no-new-privileges");
+    args.push(`--pids-limit=${sandbox?.pidsLimit ?? 512}`);
+    if (sandbox?.memory)
+        args.push(`--memory=${sandbox.memory}`);
+    if (sandbox?.cpus)
+        args.push(`--cpus=${sandbox.cpus}`);
+    if (sandbox?.network === false || selection.permissions.network === "deny")
+        args.push("--network=none");
+    const tmpfs = sandbox?.tmpfs ?? ["/tmp:rw,nosuid,nodev,noexec,size=1g"];
+    for (const mount of tmpfs)
+        args.push(`--tmpfs=${mount}`);
+    if (sandbox?.ephemeralHome !== false) {
+        args.push("--tmpfs=/home/aeh:rw,nosuid,nodev,size=256m");
+        args.push("--env=HOME=/home/aeh");
+    }
+    if (!writable)
+        args.push("--env=AEH_WORKSPACE_READ_ONLY=1");
+    for (const extra of sandbox?.extraArgs ?? [])
+        args.push(extra);
+    return args;
+}
+export function sandboxImage(config) {
+    const sandbox = config.security?.sandbox;
+    if (!sandbox?.image)
+        throw new Error("security.sandbox.image is required for Podman execution.");
+    if (!sandbox.imageDigest || sandbox.image.includes("@sha256:"))
+        return sandbox.image;
+    const digest = sandbox.imageDigest.startsWith("sha256:") ? sandbox.imageDigest : `sha256:${sandbox.imageDigest}`;
+    return `${sandbox.image.replace(/:[^/@]+$/, "")}@${digest}`;
+}
+export function allowedSandboxEnvironment(config, source = process.env) {
+    const sandbox = config.security?.sandbox;
+    const allowed = new Set(sandbox?.environmentAllowlist ?? []);
+    const credentials = new Set(sandbox?.credentialEnvAllowlist ?? []);
+    const result = {};
+    for (const name of [...allowed, ...credentials])
+        if (source[name] !== undefined)
+            result[name] = source[name];
+    return result;
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/security/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,oBAAoB,CAAC,SAAkC,EAAE,MAA4B,EAAE,OAAiB,KAAK;IAC3H,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,QAAQ,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAI,QAAQ,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,mDAAmD,CAAC,CAAC;IAC7H,IAAI,SAAS,CAAC,cAAc,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,iBAAiB,SAAS,CAAC,cAAc,mDAAmD,CAAC,CAAC;IAC9L,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACxF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;AACzM,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA4B,EAAE,SAAkC,EAAE,QAAiB;IACpH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;IACzC,MAAM,IAAI,GAAa,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC1D,IAAI,OAAO,EAAE,YAAY,KAAK,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,OAAO,EAAE,UAAU,KAAK,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/D,IAAI,OAAO,EAAE,eAAe,KAAK,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACtF,IAAI,CAAC,IAAI,CAAC,gBAAgB,OAAO,EAAE,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,EAAE,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,EAAE,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,EAAE,OAAO,KAAK,KAAK,IAAI,SAAS,CAAC,WAAW,CAAC,OAAO,KAAK,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxG,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACxE,KAAK,MAAM,KAAK,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO,EAAE,aAAa,KAAK,KAAK,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,SAAS,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA4B;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACjG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,WAAW,EAAE,CAAC;IACjH,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAA4B,EAAE,SAA4B,OAAO,CAAC,GAAG;IAC7G,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,sBAAsB,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC;QAAE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAE,CAAC;IAC9G,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/spec/openspec.d.ts

@@ -0,0 +1,28 @@
+import type { HarnessProjectConfig } from "../core/types.js";
+import { runProcess } from "../utils/process.js";
+export interface OpenSpecAuthoringConfig {
+    provider?: "openspec" | "native" | string;
+    schema?: string;
+    managerAgent?: string;
+}
+export interface OpenSpecPreparedChange {
+    taskId: string;
+    changeName: string;
+    directory: string;
+    created: boolean;
+    schema: string;
+    managerAgent: string;
+}
+export interface OpenSpecCompileResult {
+    taskId: string;
+    changeName: string;
+    sddDirectory: string;
+    contractPath: string;
+    requirements: string[];
+    sourceSha256: string;
+    validatorId: string;
+}
+export declare function openSpecAuthoringConfig(config: HarnessProjectConfig): Required<Pick<OpenSpecAuthoringConfig, "provider" | "schema" | "managerAgent">>;
+export declare function openSpecChangeName(taskId: string): string;
+export declare function prepareOpenSpecChange(root: string, config: HarnessProjectConfig, taskId: string, title: string, run?: typeof runProcess): Promise<OpenSpecPreparedChange>;
+export declare function compileOpenSpecChange(root: string, config: HarnessProjectConfig, taskId: string, title: string, changeName?: string, run?: typeof runProcess): Promise<OpenSpecCompileResult>;