aiterm-mcp 0.28.0 → 0.28.2

package/README.ja.md

@@ -18,7 +18,7 @@
 
 > **あなたの AI に、ほかの AI を操らせる。** `agent_launch`の1回の呼び出しで、実行基盤harnessとmodelを別々に選び、永続sessionを受け取る。CursorでGPT／Claude／Grokを選んでも、session・hook・transcriptはCursorが所有する。
 >
-> **これは何か:** AI が握る 1 本の永続 MCP 端末——その中に他のコーディングエージェントも起動できる。`ssh`・`docker exec`・REPL・別エージェントの TUI は、すべてその 1 本の端末の中へ「送るだけのテキスト」として入れ子になる。仕組みはあえて素朴——MCP クライアントが相手エージェントの端末を 1 ターンずつ操作するだけ。隠れたプロトコルも・aiterm独自の共有メモリ層も・自律的な交渉も無い。起動したagentは、直接CLIと同じproject／vendorの通常memory・設定を読む。
+> **これは何か:** AI が握る 1 本の永続 MCP 端末——その中に他のコーディングエージェントも起動できる。`ssh`・`docker exec`・REPL・別エージェントの TUI は、すべてその 1 本の端末の中へ「送るだけのテキスト」として入れ子になる。仕組みはあえて素朴——MCP クライアントが相手エージェントの端末を 1 ターンずつ操作するだけ。隠れたプロトコルも・aiterm独自の共有メモリ層も・自律的な交渉も無い。起動したagentは、直接CLIと同じproject／harnessの通常memory・設定を読む。
 >
 > **人が tmux に張り付く必要はない。** aiterm は MCP 越しにプログラムから駆動されるので、「AI が別のエージェントを起動して操作する」のに端末の前に誰も座らなくていい——オーケストレーションのループ・CI ステップ・cron から動かせる。
 >
@@ -118,17 +118,17 @@ serverがMCP processより先に起動していても、古いserver環境に席
 常駐するmodel／effort footerと入力欄でCodexを識別する。idle sessionをそのまま変更でき、
 caller側の画面再描画、再試行、agent再起動は不要。
 
-**v0.24.0では起動中agentの設定変更を追加。** `agent_configure`はvendor標準操作を使って、
-起動中のCodex／Claudeのmodelとreasoning effortを変更する。PTY、vendor session、会話contextは維持する。
+**v0.24.0では起動中agentの設定変更を追加。** `agent_configure`はharness標準操作を使って、
+起動中のCodex／Claudeのmodelとreasoning effortを変更する。PTY、harness session、会話contextは維持する。
 
-**v0.23.0では、ローカル完結の別vendor向けportable forkを追加した。** どのlauncherでも
+**v0.23.0では、ローカル完結の別harness向けportable forkを追加した。** どのlauncherでも
 `throughline_source_session`と新しいミッションを`prompt`へ渡すと、PTY作成前にローカルの
 Throughlineから対象sessionの読み取り専用handoff contextを取得する。返された記憶はそのまま
 ミッションの前へ置かれ、元sessionのDB所属は移動もcopyもされない。Throughlineが無い、または
 結果が不正／空ならclean launchへfallbackせず明示失敗する。引数を省略した通常起動は従来どおり。
 
 **v0.22.0では4 launcherを完全なプロジェクト共同作業員へ戻した。** 直接CLIを起動した時と同じ
-`HOME`、作業tree、vendor home、project/user/local設定、MCP、plugin、skill、permission、trust、memory、
+`HOME`、作業tree、harness home、project/user/local設定、MCP、plugin、skill、permission、trust、memory、
 session historyをそのまま使う。aitermがlaunchごとに分離するのは完了相関stateだけ。子には
 `role=subagent`、親session、delegation depth、lineage、`delegation_allowed=true`を注入する。
 孫以降への再委譲は禁止せず、孫はdepth 2と伸びたlineageを受け取る。既存receiptの
@@ -304,9 +304,9 @@ claude mcp add --scope user --transport stdio aiterm -- aiterm-mcp
 
 ## ヘッドレス: 端末に人が居ない
 
-MCP クライアントが aiterm を stdio 越しにプログラムから駆動するので、上のすべては **tmux に誰も座らないまま**動く。Claude／Codexのどちらからでも、自分自身を含む任意のlauncherを呼び、`pty_read`で結果を読んで次へ進める——無人で。これは、人が操作する端末が向かない場所にこそ aiterm が合うということ:
+MCP クライアントが aiterm を stdio 越しにプログラムから駆動するので、上のすべては **端末に誰も座らないまま**動く。任意のMCP対応統括役が、自分と同じharnessを含む`agent_launch`を呼び、`pty_read`で結果を読んで次へ進める——無人で。これは、人が操作する端末が向かない場所にこそ aiterm が合うということ:
 
-- **複数エージェントのオーケストレーション** — 統括役がサブタスクを Claude / Codex / Grok / Composer に渡し、各々を専用の永続セッションに置き、全部を読み戻す。
+- **複数エージェントのオーケストレーション** — 統括役がサブタスクを Claude Code / Codex / Grok / Cursor harnessへ渡し、各々を専用の永続セッションに置き、全部を読み戻す。ComposerはGrok CLIのmodel presetとして扱う。
 - **CI** — ジョブのステップがエージェントを起こし、操作し、片付けられる。
 - **cron** — スケジュール実行がエージェントを起動して出力を回収できる。
 
@@ -318,7 +318,7 @@ MCP クライアントが aiterm を stdio 越しにプログラムから駆動
 flowchart LR
     AI["AI / MCP client<br/>(the orchestrator)"] -->|"pty_send · agent_launch · agent_configure · claude_turn · claude_approval<br/>旧launcher alias · diagnostics"| S["aiterm-mcp<br/>stdio MCP · 15 tools"]
     S -->|"pty_read<br/>token-reduced"| AI
-    S -->|"tmux send-keys<br/>capture-pane"| P["persistent PTYs<br/>tmux · survive restarts"]
+    S -->|"tmux / psmux<br/>send · capture"| P["persistent PTYs<br/>再起動を跨ぐ"]
     P -->|"ssh · docker · repl"| R["nested<br/>remote · container · REPL"]
     P -->|"launches a fresh PTY per agent"| A["another coding-agent TUI<br/>Claude · Codex · Grok · Cursor"]
 ```
@@ -352,10 +352,10 @@ aiterm はセッションの状態も持ち越せる。組み込みツールは
 
 ```text
 組み込みシェル  →  var=                   # 空。env は消え、cwd はプロジェクト直下に戻る
-aiterm          →  cwd=/tmp var=hello123  # 1 本の tmux セッションが両方を保つ
+aiterm          →  cwd=/tmp var=hello123  # 1 本の永続PTYが両方を保つ
 ```
 
-cd でディレクトリを移り、環境変数を立て、ビルドを走らせる。ssh で一度ログインして、その接続のまま 10 個コマンドを打つ。REPL や起動したエージェントの TUI を 1 ターンずつ操作する。こういう流れは、1 本の tmux セッションが状態を握っていて初めて成り立つ。端末に何かを覚えておいてほしいときは、aiterm を使う。
+cd でディレクトリを移り、環境変数を立て、ビルドを走らせる。ssh で一度ログインして、その接続のまま 10 個コマンドを打つ。REPL や起動したエージェントの TUI を 1 ターンずつ操作する。こういう流れは、1 本の永続PTYが状態を握っていて初めて成り立つ。端末に何かを覚えておいてほしいときは、aiterm を使う。
 
 <sub>¹ いまのハーネスは ~192 KB の出力をいったんファイルに逃がして、先頭 ~2 KB だけを見せる。そのためトークン数はほぼ並ぶ。aiterm は行数を正確に返すうえ、あとから `line_range="A:B"` で好きな範囲（先頭でも末尾でも）を取り出せる。² `rtk` の grep 縮約は長い行（~80 字）を切り詰めて、あふれを `[+N more]` にまとめる。ざっと眺めるには向くが、全行をそのまま読みたいときは組み込みツールを使う。</sub>
 
@@ -365,7 +365,7 @@ aiterm は 2 つの系譜の交点にいる——端末を操作する MCP サ
 
 |  | **aiterm-mcp** | 1 コマンド毎の往復<br/>(例: `mcp-server-commands`) | terminal / SSH / tmux MCP<br/>(例: `iterm-mcp`, `ssh-mcp`, `tmux-mcp`) | 共有 tmux でエージェント同士<br/>(例: `smux`) |
 | --- | --- | --- | --- | --- |
-| 永続セッション | ✅ tmux・再起動を跨ぐ | ❌ 毎回新シェル | ⚠️ まちまち | ✅ tmux |
+| 永続セッション | ✅ tmux / psmux・再起動を跨ぐ | ❌ 毎回新シェル | ⚠️ まちまち | ✅ tmux |
 | SSH / コンテナ / REPL | `pty_send` 1 回でネスト | 毎コマンド接続し直し | ⚠️ ツールが分かれがち | ✅ tmux（人が操作） |
 | 1 コールで別エージェント起動 | ✅ `agent_launch(harness=…)` | ❌ | ❌ | ⚠️ 人が動かす tmux に CLI + skills で参加 |
 | ヘッドレス（人が tmux に居ない） | ✅ MCP 駆動・プログラム的 | ✅ | ⚠️ まちまち | ❌ 人が tmux に居る前提 |
@@ -373,7 +373,7 @@ aiterm は 2 つの系譜の交点にいる——端末を操作する MCP サ
 | トークン削減読取 | ✅ コマンド別 reducer | ❌ 生出力 | ⚠️ ほぼ無し | ❌ 生 tmux |
 | 完了検出 | 5 層: 終了 / `mark` / `until` / 静止 / timeout | 無し（毎回ブロック） | ⚠️ プロンプト一致・脆い | ❌ エージェントがペインを読む |
 | 破壊コマンド遮断 | ✅ tripwire（`force` で越える） | ❌ | ⚠️ まちまち | ❌ |
-| 人が同時操作 | ✅ 共有 tmux ソケット（`attach`） | ❌ | ⚠️ まちまち | ✅（設計の芯） |
+| 人が同時操作 | ✅ 共有socket／namespace（`attach`） | ❌ | ⚠️ まちまち | ✅（設計の芯） |
 
 ## aiterm の立ち位置
 
@@ -448,7 +448,7 @@ handoff contextを前置きできる。この任意経路は`throughline >= 0.9.
 
 `pty_send` は送信前に破壊的コマンド（`rm -rf /`, `mkfs`, `dd of=/dev/…`, `DROP TABLE` 等）を遮断し（`force: true` で越える）、ESC・ブラケットペースト終端などをサニタイズする。`pty_read` は既定で制御文字を無害化して返す（`raw: true` はバイトをそのまま返す）。これは**サンドボックスではなく tripwire**（[既知の制約](#既知の制約バグではなく仕様)参照）。
 
-1回の `pty_send` が受理する本文はUTF-8で最大64KiB。同一sessionへの送信はaiterm processをまたいで直列化し、chunk同士の混線を防ぐ。全OSで長いPTY入力の欠落を避けるためUTF-8境界を壊さない256-byte単位でpasteし、chunk間に10msのdrain間隔を置く。POSIX shellが前面にいる時のsanitize済み複数行は、改行を含まない単一の`eval`入力へ符号化する。shellがscript全体を所有してから先頭行を実行するため、途中で起動したpager／REPLが後続行を対話キーとして奪わない。単一行、`raw:true`、非shell前面は従来どおり直接PTYへpasteする。agent dispatch の paste はさらに tmux bracketed paste（`paste-buffer -p`）を使う: bracketed paste mode を要求している pane（vendor TUI）へは各 chunk を `ESC[200~/201~` で包んで届け、チャンク投入中のキー解釈による語中文字化け・submit 取り落としを抑える。途中chunkが失敗した場合は部分送信済みであることを明示し、自動でEnterを押さない。送信processの異常終了でlockが残った場合は送信前にfail-closedする。そのsessionを `pty_close` して作り直すか、全sessionを破棄できる場合だけ `pty_kill_all` で安全に掃除する。
+1回の `pty_send` が受理する本文はUTF-8で最大64KiB。同一sessionへの送信はaiterm processをまたいで直列化し、chunk同士の混線を防ぐ。全OSで長いPTY入力の欠落を避けるためplatformのmultiplexerへUTF-8境界を壊さない256-byte単位でpasteし、chunk間に10msのdrain間隔を置く。POSIX shellが前面にいる時のsanitize済み複数行は、改行を含まない単一の`eval`入力へ符号化する。shellがscript全体を所有してから先頭行を実行するため、途中で起動したpager／REPLが後続行を対話キーとして奪わない。単一行、`raw:true`、非shell前面は従来どおり直接PTYへpasteする。agent dispatchはtmux互換のbracketed paste操作（`paste-buffer -p`）を使う: bracketed paste modeを要求しているpaneへは各chunkを`ESC[200~/201~`で包んで届け、chunk投入中のキー解釈による語中文字化け・submit取り落としを抑える。途中chunkが失敗した場合は部分送信済みであることを明示し、自動でEnterを押さない。送信processの異常終了でlockが残った場合は送信前にfail-closedする。そのsessionを `pty_close` して作り直すか、全sessionを破棄できる場合だけ `pty_kill_all` で安全に掃除する。
 
 ## 人が覗く
 
@@ -472,14 +472,14 @@ handoff contextを前置きできる。この任意経路は`throughline >= 0.9.
 - **`pty_send({ rtk: true })` は単行コマンドのみ＋外部 `rtk` バイナリが必要**（無ければ素通し）。一方 `pty_read({ rtk: true })` の reducer は自前実装で rtk 非依存。
 - **`pytest` reducer は件数・罫線・`FAILURES` ブロック整形が rtk 0.42.0 と byte 一致**（回帰テストで固定）。ただし `-ra`/`-rf` 時の `FAILED` 要約行の理由は**全文を保持する**（rtk 0.42.0 は最初の `" - "` 区切りで切るが、本実装は可読性優先で情報を残すため、この行は意図的に rtk と完全一致させない）。rtk が大出力時に付ける `[full output: …]`（tee ポインタ）行は read 側では再現しない。
 - **tmux は `-f /dev/null` 起動**なので `~/.tmux.conf` を読まない（環境差を排除するため）。
-- **全セッションが単一 socket（POSIX では `claude.sock`）上にある。** `tmux … kill-server` は全セッションを消す。
+- **全セッションが単一multiplexer endpoint（POSIXは`claude.sock`、Windows nativeは1つのpsmux namespace）を共有する。** platformの`kill-server` commandは全セッションを消す。
 
 ## 開発
 
 ```bash
 npm install
 npm run build      # tsc → dist/
-npm test           # build してから node:test 回帰スイート（tmux 必須）
+npm test           # build してから node:test 回帰スイート（tmux または psmux 必須）
 npm link           # ローカルで `aiterm-mcp` を PATH に
 ```
 
@@ -488,7 +488,7 @@ self-hostedのmacOS native・Linux native・Windows native・WSL2で同じ`npm t
 OS別の縮小suiteで代用しません。tag起点のnpm公開は4環境greenとtagged commitの`origin/main`
 祖先確認を通過した後だけ実行します。
 
-ロジックは `src/core.ts`（tmux 制御・削減・完了検出・安全・エージェント起動）と `src/rtk.ts`（コマンド別 reducer）、公開は `src/index.ts`。設計の出発点と reducer の移植元（pytest reducer は本家 rtk 0.42.0 と一致するよう移植・ただし上記の `FAILED` 行の差異は意図的・回帰テストで固定）は `prototype/python/` を参照。
+共通進行は`src/core.ts`、harness固有は`src/harnesses/`、OS差は`src/tmux-runtime.ts`／`src/agent-resolver.ts`、reducerは`src/rtk.ts`、公開面は`src/index.ts`が所有する。設計の出発点と reducer の移植元（pytest reducer は本家 rtk 0.42.0 と一致するよう移植・ただし上記の `FAILED` 行の差異は意図的・回帰テストで固定）は `prototype/python/` を参照。
 
 ## 試す
 

package/README.md

@@ -18,7 +18,7 @@
 
 > **Let your AI orchestrate other AIs.** One `agent_launch` call selects the execution harness separately from its model and hands you a persistent session to drive. Cursor can run GPT, Claude, or Grok while Cursor still owns the session, hooks, and transcript.
 >
-> **What it is:** one persistent MCP terminal your AI drives — and can launch other coding agents into. `ssh`, `docker exec`, a REPL, or another agent's TUI all nest inside that one terminal as just text you send in. The mechanism is deliberately plain — your MCP client drives the other agent's terminal turn by turn: no hidden protocol, no separate aiterm-owned shared-memory layer, no autonomous negotiation. Launched agents still read the normal project and vendor memory/configuration that a direct CLI launch would use.
+> **What it is:** one persistent MCP terminal your AI drives — and can launch other coding agents into. `ssh`, `docker exec`, a REPL, or another agent's TUI all nest inside that one terminal as just text you send in. The mechanism is deliberately plain — your MCP client drives the other agent's terminal turn by turn: no hidden protocol, no separate aiterm-owned shared-memory layer, no autonomous negotiation. Launched agents still read the normal project and harness memory/configuration that a direct CLI launch would use.
 >
 > **No human at a tmux required.** aiterm is driven programmatically over MCP, so an AI can launch and drive another agent with no one sitting in the terminal — from an orchestration loop, a CI step, or a cron job.
 >
@@ -96,7 +96,7 @@ toolchain behind kitepon.dev's products.
 
 Fifteen tools: six **PTY tools** — `pty_open` / `pty_send` / `pty_read` / `pty_key` / `pty_close` / `pty_list` — to open, drive, and read one persistent terminal; one canonical **agent launcher**, `agent_launch`, which selects `claude-code`, `codex-cli`, `grok-cli`, or `cursor-cli` as the execution harness; four deprecated launcher aliases kept for migration; `agent_configure`; `claude_turn`; `claude_approval`; and `diagnostics`. The backend is **tmux**, so sessions survive even if the MCP server or the AI client restarts.
 
-**v0.28.0 separates the execution harness from the model.** The harness owns the agent loop, authentication, hooks, session, and transcript; `model` is what that harness runs. Cursor Agent CLI can therefore select GPT, Claude, or Grok without changing the completion contract from Cursor hooks to another vendor's. Grok Composer is a Grok CLI model preset, not another harness: use `harness: "grok-cli", model: "grok-composer-2.5-fast"`. The old four launcher tools are thin compatibility aliases over the same implementation.
+**v0.28.0 separates the execution harness from the model.** The harness owns the agent loop, authentication, hooks, session, and transcript; `model` is what that harness runs. Cursor Agent CLI can therefore select GPT, Claude, or Grok without changing the completion contract from Cursor hooks to another harness's. Grok Composer is a Grok CLI model preset, not another harness: use `harness: "grok-cli", model: "grok-composer-2.5-fast"`. The old four launcher tools are thin compatibility aliases over the same implementation.
 
 **v0.25.2 stabilizes repeated in-place configuration changes, including Grok 4.6.** If Grok Build
 1.0.3 redraws before its `/model` success notice can be observed, aiterm confirms the requested model/effort
@@ -107,7 +107,7 @@ round a failure into success; explicit `grok-4.6` launch and configuration still
 `reasoning_effort`, enforce `write_scope: "read-only"` with `--sandbox read-only`, and support
 in-place model/effort changes through `agent_configure`. Before creating a PTY, aiterm checks an
 explicit Grok/Composer model—and Composer's default model—against the live `grok models` catalog.
-An unavailable model fails visibly instead of letting the vendor CLI fall back to another model.
+An unavailable model fails visibly instead of letting the harness CLI fall back to another model.
 
 **v0.24.3 forwards explicitly selected launcher environment variables from the current MCP process.**
 Pass variable names in `env_vars`; aiterm reads their current values at launch and injects only the
@@ -121,11 +121,11 @@ startup header has scrolled out of the captured pane, aiterm recognizes Codex by
 model/effort footer together with the input prompt. An idle session is therefore configured
 directly; callers do not need to redraw the TUI, retry, or restart the agent.
 
-**v0.24.0 adds in-place agent configuration.** `agent_configure` uses each vendor's
+**v0.24.0 adds in-place agent configuration.** `agent_configure` uses each harness's
 native controls to change the model and/or reasoning effort of a running Codex or Claude
-session while preserving its PTY, vendor session, and conversation context.
+session while preserving its PTY, harness session, and conversation context.
 
-**v0.23.0 adds a local, cross-vendor portable fork.** Pass `throughline_source_session`
+**v0.23.0 adds a local, cross-harness portable fork.** Pass `throughline_source_session`
 with a mission in `prompt` to any launcher, and aiterm asks the locally installed Throughline
 for that session's read-only handoff context before creating the PTY. The exact returned memory
 is prepended to the mission without moving or copying the source session's database ownership.
@@ -133,7 +133,7 @@ If Throughline is missing or returns an invalid/empty result, launch fails visib
 fallback. Omitting the field preserves the ordinary clean launch.
 
 **v0.22.0 makes launched agents full project collaborators.** All four launchers now use the
-same normal `HOME`, working tree, vendor home, project/user/local configuration, MCP servers,
+same normal `HOME`, working tree, harness home, project/user/local configuration, MCP servers,
 plugins, skills, permissions, trust, memory, and session history as a direct CLI launch. Aiterm
 isolates only its own per-launch completion correlation state. Every child is told that it is a
 sub-agent and receives its parent session, delegation depth, lineage, and
@@ -150,7 +150,7 @@ structured launch receipts so a supplied scope and its enforcement status are re
 v0.20.3 prevents concurrent
 correlated Claude/Fable sessions from turning one broken login into many competing login
 flows. Every new Claude launch verifies the
-vendor-owned shared credential store before creating a PTY, while healthy credentials
+harness-owned shared credential store before creating a PTY, while healthy credentials
 remain reusable across concurrent and repeated sessions. The v0.20 line also distinguishes
 a non-blocking `aiterm-wait --timeout 0` observation (`running`, exit 5) from a real timed-out
 wait. The v0.19 line added the correlated Claude approval relay,
@@ -228,14 +228,14 @@ The canonical harness choices are:
 
 `env_vars` is an allowlist of environment-variable **names**, not a name/value map. At launch,
 aiterm reads each valid name from its current MCP process, shell-quotes present values, and places
-them on that one vendor launch command. Missing names are omitted; invalid shell variable names
+them on that one harness launch command. Missing names are omitted; invalid shell variable names
 fail before session creation. There is no implicit whole-environment copy, tmux-server restart,
 retry, or fallback. Values do not enter the MCP tool arguments, but they are delivered through the
-PTY launch command and retained in aiterm's per-session `.lastcmd`; the launched vendor and other
+PTY launch command and retained in aiterm's per-session `.lastcmd`; the launched harness and other
 processes with access to the same OS user may read them. Use this for non-secret seat identity and
 workflow variables, not as a secret transport.
 
-The selected harness CLI must be installed and authenticated. Aiterm resolves `CLAUDE_BIN` / `CODEX_BIN` / `GROK_BIN` / `CURSOR_AGENT_BIN`, then the documented default binary, then `PATH`. Cursor resolution deliberately uses `cursor-agent`, never the ambiguous `agent` name. Claude and Cursor authentication are checked before a PTY exists, so a failed preflight leaves no session. All harnesses use their normal vendor-owned credential and configuration stores in place.
+The selected harness CLI must be installed and authenticated. Aiterm resolves `CLAUDE_BIN` / `CODEX_BIN` / `GROK_BIN` / `CURSOR_AGENT_BIN`, then the documented default binary, then `PATH`. Cursor resolution deliberately uses `cursor-agent`, never the ambiguous `agent` name. Claude and Cursor authentication are checked before a PTY exists, so a failed preflight leaves no session. All harnesses use their normal harness-owned credential and configuration stores in place.
 
 Portable fork is optional. When `throughline_source_session` is present, `prompt` is the required
 new mission and `launch_operation_id` cannot be combined with it. aiterm resolves Throughline via
@@ -330,9 +330,9 @@ This registers it in `~/.claude.json`; you'll get an approval prompt the first t
 
 ## Headless: no human at the terminal
 
-Because an MCP client drives aiterm programmatically over stdio, everything above can run with **nobody sitting at a tmux**. A Claude or Codex session can call any launcher — including another instance of itself — then `pty_read` the result and act on it unattended. That makes aiterm a fit for exactly the places a human-driven terminal isn't:
+Because an MCP client drives aiterm programmatically over stdio, everything above can run with **nobody sitting at the terminal**. Any MCP-capable orchestrator can call `agent_launch` — including a harness matching itself — then `pty_read` the result and act on it unattended. That makes aiterm a fit for exactly the places a human-driven terminal isn't:
 
-- **Multi-agent orchestration** — an orchestrator hands sub-tasks to Claude / Codex / Grok / Composer, each in its own persistent session, and reads them all back.
+- **Multi-agent orchestration** — an orchestrator hands sub-tasks to Claude Code / Codex / Grok / Cursor harnesses, each in its own persistent session, and reads them all back. Composer remains a Grok CLI model preset.
 - **CI** — a job step can spin up an agent, drive it, and tear it down.
 - **cron** — a scheduled run can launch an agent and collect its output.
 
@@ -344,7 +344,7 @@ The terminal is real and shared, so a human *can* jump in ([A human can watch](#
 flowchart LR
     AI["AI / MCP client<br/>(the orchestrator)"] -->|"pty_send · agent_launch · agent_configure · claude_turn · claude_approval<br/>legacy launcher aliases · diagnostics"| S["aiterm-mcp<br/>stdio MCP · 15 tools"]
     S -->|"pty_read<br/>token-reduced"| AI
-    S -->|"tmux send-keys<br/>capture-pane"| P["persistent PTYs<br/>tmux · survive restarts"]
+    S -->|"tmux / psmux<br/>send · capture"| P["persistent PTYs<br/>survive restarts"]
     P -->|"ssh · docker · repl"| R["nested<br/>remote · container · REPL"]
     P -->|"launches a fresh PTY per agent"| A["another coding-agent harness<br/>Claude Code · Codex CLI · Grok CLI · Cursor CLI"]
 ```
@@ -380,10 +380,10 @@ aiterm also holds state across calls. The built-in tool runs each call in a fres
 
 ```text
 built-in shell  →  var=                   # empty; env dropped, cwd back at project root
-aiterm          →  cwd=/tmp var=hello123  # one tmux session holds both
+aiterm          →  cwd=/tmp var=hello123  # one persistent PTY holds both
 ```
 
-`cd` then set env then build, `ssh` once then run ten commands on the authenticated session, drive a live REPL or a launched agent's TUI turn by turn — one tmux session holds all of it. Reach for aiterm when the terminal has to remember something.
+`cd` then set env then build, `ssh` once then run ten commands on the authenticated session, drive a live REPL or a launched agent's TUI turn by turn — one persistent PTY holds all of it. Reach for aiterm when the terminal has to remember something.
 
 <sub>¹ Today's harness auto-offloads the ~192 KB dump to a file and previews only a ~2 KB head, so the token counts nearly tie; aiterm reports the accurate line count and lets `line_range="A:B"` pull any slice later, head or tail. ² The `rtk` grep reducer truncates long lines (~80 chars) and folds the overflow into `[+N more]`, which suits scanning; use the built-in tool when you need every full line.</sub>
 
@@ -393,7 +393,7 @@ aiterm sits at the intersection of two families: terminal-driving MCP servers, a
 
 |  | **aiterm-mcp** | one-shot shell MCP<br/>(e.g. `mcp-server-commands`) | terminal / SSH / tmux MCPs<br/>(e.g. `iterm-mcp`, `ssh-mcp`, `tmux-mcp`) | shared-tmux agent-to-agent<br/>(e.g. `smux`) |
 | --- | --- | --- | --- | --- |
-| Persistent session | ✅ tmux, survives restarts | ❌ new shell every call | ⚠️ varies | ✅ tmux |
+| Persistent session | ✅ tmux / psmux, survives restarts | ❌ new shell every call | ⚠️ varies | ✅ tmux |
 | SSH / containers / REPLs | nest with one `pty_send` | reconnect every command | ⚠️ often separate tools | ✅ tmux (human drives) |
 | Launch another agent in one call | ✅ `agent_launch(harness=…)` | ❌ | ❌ | ⚠️ agents join a human-run tmux via a CLI + skills |
 | Headless (no human at a tmux) | ✅ MCP-driven, programmatic | ✅ | ⚠️ varies | ❌ built around a human in the tmux |
@@ -401,7 +401,7 @@ aiterm sits at the intersection of two families: terminal-driving MCP servers, a
 | Token-reduced reads | ✅ per-command reducers | ❌ raw output | ⚠️ rarely | ❌ raw tmux |
 | Completion detection | 5-layer: exit / `mark` / `until` / quiescence / timeout | n/a (blocks per call) | ⚠️ prompt-match, fragile | ❌ agent reads the pane |
 | Destructive-command gate | ✅ tripwire (override with `force`) | ❌ | ⚠️ varies | ❌ |
-| Human can co-drive | ✅ shared tmux socket (`attach`) | ❌ | ⚠️ varies | ✅ (its core model) |
+| Human can co-drive | ✅ shared socket / namespace (`attach`) | ❌ | ⚠️ varies | ✅ (its core model) |
 
 ## Where aiterm fits
 
@@ -461,18 +461,18 @@ cannot be combined with `launch_operation_id`, and leaves the source session's d
 unchanged. Throughline is resolved through `THROUGHLINE_BIN` and then `PATH`; a missing or invalid
 export fails before the PTY exists instead of silently launching clean.
 
-When an agent's answer is longer than the on-screen tail (pane height ≈ 24 lines), callers recover it in full with `pty_read({ agent_transcript: true })`. It returns the most recently completed turn's final assistant message in plain text with no re-prompting. Claude reads the bounded owner-only result captured by the launch-correlated Stop hook and verifies its digest/byte count; it never reads Claude's private transcript. Durable machine callers should use `claude_turn`: `issue` sends once, `recover` never sends, `pending` is distinct from unsafe or malformed state, and only `completed` carries the exact verified `raw_output`. Codex uses the normal rollout transcript's `task_complete.turn_id`; Grok/Composer use their normal session history after the last real user row. Missing or ambiguous attribution remains an explicit error.
+When an agent's answer is longer than the on-screen tail (pane height ≈ 24 lines), callers recover it in full with `pty_read({ agent_transcript: true })`. It returns the most recently completed turn's final assistant message in plain text with no re-prompting. Claude reads the bounded owner-only result captured by the launch-correlated Stop hook and verifies its digest/byte count; it never reads Claude's private transcript. Durable machine callers should use `claude_turn`: `issue` sends once, `recover` never sends, `pending` is distinct from unsafe or malformed state, and only `completed` carries the exact verified `raw_output`. Codex uses the normal rollout transcript's `task_complete.turn_id`; Grok/Composer use their normal session history after the last real user row; Cursor uses the normal agent transcript bound to the launch ID and current turn. Missing or ambiguous attribution remains an explicit error.
 
 ### Completion detection (5 layers)
 
-`pty_read({ wait: true })` decides "is the command done?" via five layers: process exit / a `mark:true` sentinel / an `until` match / output quiescence with shell return / timeout. `mark` emits the shell's exit status on POSIX shells and `0` (success) or `1` (failure) on PowerShell; fish/csh/tcsh are rejected before send because they do not share either status syntax. When `mark` or `until` is active, that requested evidence takes precedence and a momentarily quiet shell cannot complete the read as quiescent. Agent sessions add a sixth exact layer: Codex observes normal rollout `task_complete`; Grok/Composer observe normal session `turn_ended`; Claude observes its additive launch-correlated Stop event. `aiterm-wait --cursor` performs that vendor-specific observation without the parent blocking or polling. Pre-send readiness failures are MCP errors, and late completion remains recoverable without resending.
+`pty_read({ wait: true })` decides "is the command done?" via five layers: process exit / a `mark:true` sentinel / an `until` match / output quiescence with shell return / timeout. `mark` emits the shell's exit status on POSIX shells and `0` (success) or `1` (failure) on PowerShell; fish/csh/tcsh are rejected before send because they do not share either status syntax. When `mark` or `until` is active, that requested evidence takes precedence and a momentarily quiet shell cannot complete the read as quiescent. Agent sessions add a sixth exact layer: Codex observes normal rollout `task_complete`; Grok/Composer observe normal session `turn_ended`; Claude observes its additive launch-correlated Stop event; Cursor observes `turn_ended(status:"success")` in the launch-bound normal agent transcript. `aiterm-wait --cursor` performs that harness-specific observation without the parent blocking or polling. Pre-send readiness failures are MCP errors, and late completion remains recoverable without resending.
 
 ### Completion push for parent agents (`aiterm-wait`)
 
 As of v0.16 a parent agent **never blocks** on aiterm — there is no wait parameter anywhere (v0.17 makes the waiter's exit codes mirror its outcome). The whole flow is dispatch + one universal waiter:
 
 1. Launch the child with `agent_launch({ harness: ... })`; every launch shares the normal project/user environment and adds only completion correlation plus lineage. Send a turn with plain `pty_send` (or `claude_turn issue` for durable Claude operations). The call returns immediately with an `event_cursor` in its structured receipt.
-2. Run `aiterm-wait --session <id> --cursor <event_cursor> [--operation sha256:<64hex>] [--timeout <sec>]`. It observes the vendor-native completion source, plus Claude's additive launch hook, as a **pure reader** and exits with a one-line `aiterm.agent-wait-result.v1` receipt. **Exit ≠ done**: the receipt's `outcome` is authoritative (`0` = `done`, `3` = `timeout`, `4` = `closed`, `1` = error).
+2. Run `aiterm-wait --session <id> --cursor <event_cursor> [--operation sha256:<64hex>] [--timeout <sec>]`. It observes the harness-owned completion source, plus Claude's additive launch hook, as a **pure reader** and exits with a one-line `aiterm.agent-wait-result.v1` receipt. **Exit ≠ done**: the receipt's `outcome` is authoritative (`0` = `done`, `3` = `timeout`, `4` = `closed`, `1` = error).
 3. **The parent never runs the waiter in its own foreground.** Waiting is correct — but the waiter is a separate process, not the parent's turn. A harness that re-invokes its agent when a background task exits (Claude Code) runs the waiter **in the background** and gets woken with zero polling. So that this is not left to interpretation, aiterm reads `clientInfo.name` from the MCP `initialize` handshake and its receipts name the concrete invocation for the detected host — for Claude Code, literally `Bash(command: "aiterm-wait …", run_in_background: true)`. Unknown or undeclared hosts get the generic "start it as a process that does not block the parent's turn" wording; nothing else about the contract changes. Every receipt leads with the same rule: dispatch and let go, then go do something else or end the turn.
 4. Collect the result exactly as before: `pty_read(agent_transcript: true)`, or `claude_turn recover` for durable Claude operations. The waiter carries the signal, never the payload.
 
@@ -490,18 +490,18 @@ As of v0.16 a parent agent **never blocks** on aiterm — there is no wait param
 
 Before sending, `pty_send` blocks destructive commands (`rm -rf /`, `mkfs`, `dd of=/dev/…`, `DROP TABLE`, …) — pass `force: true` to override — and sanitizes ESC / bracketed-paste terminators. `pty_read` neutralizes control characters in what it returns by default (`raw: true` returns the bytes verbatim). This is a **tripwire, not a sandbox** (see [Known constraints](#known-constraints-by-design-not-bugs)).
 
-Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session are serialized across aiterm processes so chunks cannot interleave. Every OS pastes through tmux in UTF-8-safe 256-byte chunks with a 10 ms drain interval; macOS, Linux, and WSL2 have all demonstrated silent middle/trailing loss when a long input is pushed without that boundary. Sanitized multiline text sent while a POSIX shell is in the foreground is encoded as one newline-free `eval` input: the shell receives the complete script before it runs the first line, so a pager or REPL started mid-script cannot consume later lines as interactive keystrokes. Single-line input, `raw:true`, and non-shell frontends remain direct PTY pastes. Agent dispatches additionally paste with tmux bracketed paste (`paste-buffer -p`): panes that requested bracketed-paste mode (the vendor TUIs) receive each chunk wrapped in `ESC[200~/201~`, hardening prompt injection against mid-word key-interpretation corruption and dropped submits. If a later chunk fails, aiterm reports the partial-send state and does not press Enter automatically. A lock left by a terminated sender fails closed before sending; close and recreate that session (or use `pty_kill_all` when every session is disposable) to clean it up safely.
+Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session are serialized across aiterm processes so chunks cannot interleave. Every OS pastes through its multiplexer in UTF-8-safe 256-byte chunks with a 10 ms drain interval; macOS, Linux, and WSL2 have all demonstrated silent middle/trailing loss when a long input is pushed without that boundary. Sanitized multiline text sent while a POSIX shell is in the foreground is encoded as one newline-free `eval` input: the shell receives the complete script before it runs the first line, so a pager or REPL started mid-script cannot consume later lines as interactive keystrokes. Single-line input, `raw:true`, and non-shell frontends remain direct PTY pastes. Agent dispatches additionally use the tmux-compatible bracketed-paste operation (`paste-buffer -p`): panes that requested bracketed-paste mode receive each chunk wrapped in `ESC[200~/201~`, hardening prompt injection against mid-word key-interpretation corruption and dropped submits. If a later chunk fails, aiterm reports the partial-send state and does not press Enter automatically. A lock left by a terminated sender fails closed before sending; close and recreate that session (or use `pty_kill_all` when every session is disposable) to clean it up safely.
 
 ## A human can watch
 
-Sessions live on a shared tmux socket. The `tmux -S … attach -t <id>` line printed by `pty_open` and `agent_launch` lets a human attach to the same terminal and intervene (`Ctrl-b d` to detach), including a Claude/Codex/Grok/Cursor harness session. On native Windows the printed line is the psmux form — `psmux -L <namespace> attach -t <id>` — pointing at the same Windows-native session.
+Sessions live on a shared tmux socket on POSIX or a shared psmux namespace on native Windows. The attach line printed by `pty_open` and `agent_launch` lets a human attach to the same terminal and intervene, including a Claude/Codex/Grok/Cursor harness session: `tmux -S … attach -t <id>` on POSIX, or `psmux -L <namespace> attach -t <id>` on native Windows.
 
 ## Requirements
 
 - **Node.js >= 18**
-- **tmux** (runtime prerequisite; check with `tmux -V`. Install with `apt install tmux` / `brew install tmux`)
+- **tmux or psmux** (platform runtime prerequisite)
   - **macOS / Linux / WSL2** run tmux directly. On macOS install it with `brew install tmux` (stock macOS ships none). If your MCP client is launched from the **GUI** rather than a terminal, Homebrew's bin (`/opt/homebrew/bin` on Apple Silicon, `/usr/local/bin` on Intel) may be off its `PATH`; aiterm auto-searches those locations, or set **`AITERM_TMUX=/path/to/tmux`** to point at it explicitly.
-  - **Native Windows** has no tmux, so aiterm drives [psmux](https://github.com/psmux/psmux) — a tmux-CLI-compatible native multiplexer — with a per-install `-L` namespace. **No WSL is required.** Install psmux **3.3.8 or newer** (`winget install marlocarlo.psmux`; 3.3.8 is the first release whose `pipe-pane` file sink, byte-exact `paste-buffer` wire, and foreground `#{pane_current_command}` behave the way aiterm's capture/dispatch paths rely on), plus [Git for Windows](https://gitforwindows.org/) whose `bash.exe` becomes the pane shell (System32's `bash.exe` is the WSL launcher and is deliberately not used). Override resolution with **`AITERM_PSMUX`** / **`AITERM_BASH`** when the binaries live elsewhere. You reach Windows tools the same way you reach SSH: `pty_send "powershell.exe …"` nests into PowerShell. `grok_agent`/`composer_agent` launch the **Windows-native** Grok CLI (`%USERPROFILE%\.grok\bin\grok.exe`, or `GROK_BIN` pointing at a `.exe`) as a Windows process, and a WSL-side grok is rejected before a session is created so vendor auth and session records never split across an OS boundary.
+  - **Native Windows** has no tmux, so aiterm drives [psmux](https://github.com/psmux/psmux) — a tmux-CLI-compatible native multiplexer — with a per-install `-L` namespace. **No WSL is required.** Install psmux **3.3.8 or newer** (`winget install marlocarlo.psmux`; 3.3.8 is the first release whose `pipe-pane` file sink, byte-exact `paste-buffer` wire, and foreground `#{pane_current_command}` behave the way aiterm's capture/dispatch paths rely on), plus [Git for Windows](https://gitforwindows.org/) whose `bash.exe` becomes the pane shell (System32's `bash.exe` is the WSL launcher and is deliberately not used). Override resolution with **`AITERM_PSMUX`** / **`AITERM_BASH`** when the binaries live elsewhere. You reach Windows tools the same way you reach SSH: `pty_send "powershell.exe …"` nests into PowerShell. The `grok-cli` harness and its deprecated aliases launch the **Windows-native** Grok CLI (`%USERPROFILE%\.grok\bin\grok.exe`, or `GROK_BIN` pointing at a `.exe`) as a Windows process, and a WSL-side grok is rejected before a session is created so product auth and session records never split across an OS boundary.
 - For **agent harnesses**: the selected CLI, installed and authenticated through its product owner's official path — `claude`, `codex`, `grok`, or Cursor's `cursor-agent`. Portable fork additionally needs `throughline >= 0.9.0`; ordinary clean launch does not. (Not needed if you only use the PTY tools.)
 - Optional: the [`rtk`](https://github.com/rtk-ai/rtk) binary (used by `pty_send`'s `rtk: true` delegation; works fine without it)
 
@@ -514,14 +514,14 @@ Sessions live on a shared tmux socket. The `tmux -S … attach -t <id>` line pri
 - **`pty_send({ rtk: true })` is single-line only and needs the external `rtk` binary** (passthrough without it). The `pty_read({ rtk: true })` reducer, by contrast, is self-contained and rtk-independent.
 - **The `pytest` reducer matches rtk 0.42.0** on test counts, the rule line, and `FAILURES`-block formatting (locked by regression tests). It **deliberately preserves the full failure reason** on the `FAILED` summary lines (emitted under `-ra`/`-rf`), whereas rtk 0.42.0 truncates the reason at the first `" - "` — a readability choice, so those lines are intentionally not byte-identical to rtk. The `[full output: …]` tee-pointer line rtk appends on large output is not reproduced on the read side.
 - **tmux is started with `-f /dev/null`**, so it does not read `~/.tmux.conf` (to keep behavior reproducible across machines).
-- **All sessions live on a single socket (`claude.sock` on POSIX).** `tmux … kill-server` removes them all.
+- **All sessions share one multiplexer endpoint** (`claude.sock` on POSIX, one psmux namespace on native Windows). The platform's `kill-server` command removes them all.
 
 ## Development
 
 ```bash
 npm install
 npm run build      # tsc → dist/
-npm test           # build, then the node:test regression suite (requires tmux)
+npm test           # build, then the node:test regression suite (requires tmux or psmux)
 npm link           # put `aiterm-mcp` on PATH locally
 ```
 
@@ -531,7 +531,7 @@ runners; it does not replace any OS with a reduced suite. Tag-triggered npm publ
 after all four environments pass and the tagged commit is confirmed on `origin/main`. The native
 Windows runner needs psmux ≥ 3.3.8 and Git for Windows on its PATH, and must run as an
 interactive Windows user; `NETWORK SERVICE` lacks the per-user environment the pane shell and
-vendor CLIs rely on and is not a valid runner identity (the separate WSL2 runner still owns the
+harness CLIs rely on and is not a valid runner identity (the separate WSL2 runner still owns the
 initialized WSL distro).
 
 Logic lives in `src/core.ts` (tmux control, reduction, completion detection, safety, agent launch) and `src/rtk.ts` (per-command reducers); `src/index.ts` is the MCP surface. The design origin and the reducer's porting source (the pytest reducer is ported to match upstream rtk 0.42.0, except the deliberate `FAILED`-line difference noted above, and is locked by regression tests) are in `prototype/python/`.
@@ -552,7 +552,7 @@ If aiterm let your AI hand a task to another agent — or saved you a round-trip
 ## Shared agent environment
 
 All harnesses use the caller's normal project and user environment. Aiterm does not copy,
-symlink, filter, or replace vendor configuration, authentication, MCP, plugin, skill, permission,
+symlink, filter, or replace harness configuration, authentication, MCP, plugin, skill, permission,
 trust, memory, or history stores. Cleanup removes only aiterm-owned launch metadata and completion
 correlation files.
 

package/dist/agent-resolver.js

@@ -28,7 +28,7 @@ export function isWindowsNativeExecutable(candidate) {
 // Windows の bin 受入: native 実行ファイル（.exe/.cmd/.bat）に加え、pane shell
 // （Git Bash）が shebang で実行できる script も実在すれば受け入れる。旧 WSL 側
 // バイナリ検査への黙ったフォールバックは廃止（別 HOME・別 auth の subagent を
-// 作るため）。native 実行ファイルの強制が要る vendor（grok/composer の実効
+// 作るため）。native 実行ファイルの強制が要る harness（grok/composer の実効
 // sandbox 等）は openAgent 側の専用ゲートが明示エラーで担う。
 export function isUsableAgentExecutableFile(candidate) {
     if (!isWin)

package/dist/agent-shared.js

@@ -1,5 +1,5 @@
-// vendor中立の共有プリミティブ。core と vendors/ の両方が依存する最下層で、
-// tmux-runtime / errors 以外の内部moduleへ依存しない（依存方向: core → vendors → agent-shared）。
+// harness中立の共有プリミティブ。core と harnesses/ の両方が依存する最下層で、
+// tmux-runtime / errors 以外の内部moduleへ依存しない（依存方向: core → harnesses → agent-shared）。
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -200,7 +200,7 @@ export function subagentInstruction(meta) {
     ].join("\n");
 }
 // launch noteのwrite_scope説明。文言はkindに依存する分岐まで含めて単一実装で持つ
-// （vendor別noteへ複製すると文言が発散する）。
+// （harness別noteへ複製すると文言が発散する）。
 export function writeScopeLaunchNote(kind, writeScope) {
     return writeScope === undefined
         ? ""

package/dist/aiterm-wait-cli.js

@@ -2,7 +2,7 @@
 // aiterm-wait — agent turn 完了eventの純リーダー観測CLI。
 // 完了/timeout/close を1行のJSON receiptで返してexitする。lock・PTY・dispatch状態には一切触れない。
 // 親AIホストのバックグラウンドタスクとして起動し、exitを「観測終了の通知」として使う。
-// exit≠完了: exit code は outcome を映す（0=done / 5=running=未完了 / 3=timeout=未完了 / 4=closed / 6=rate_limited=vendor利用上限 / 1=エラー）。
+// exit≠完了: exit code は outcome を映す（0=done / 5=running=未完了 / 3=timeout=未完了 / 4=closed / 6=rate_limited=harness利用上限 / 1=エラー）。
 // --timeout 0 は待たずに一度だけ観測する照会で、未完了は running（timeout と混同させない）。
 // receipt の outcome が正で、done 以外は未完了。timeout の既定は core の DEFAULT_AGENT_DONE_TIMEOUT（600秒）。
 import { fileURLToPath } from "node:url";

package/dist/core.js

@@ -15,10 +15,10 @@ import * as rtk from "./rtk.js";
 import { AitermError, telemetryOwnedFailure, ownTelemetryFailure } from "./errors.js";
 import { isWin, SOCKDIR, tmuxCommand, loadPtyBufferChunk, pasteBufferBaseArgs, TMUX_EMPTY_CONFIG, attachCommand, normalizePaneCommand, appendMarkSentinel, settlePaneLog, paneCwdArgument, } from "./tmux-runtime.js";
 import { sleep, currentUid, runtimeStateBase, safeStatSize, readFileRange, writeJson0600, createEmpty0600, shq, LAUNCH_ID_RE, AGENT_DONE_POLL_MS, AGENT_EVENT_MAX_BYTES, assertSessionName, agentsDir, agentEventPath, agentMetadataPath, writeAgentMetadata, AGENT_EVENT_TAIL_BYTES, agentLabel, agentHarness, subagentInstruction, agentLineageFields, } from "./agent-shared.js";
-import { GROK_MODEL_DEFAULTS, realGrokHome, resolveAndValidateGrokAuth, assertGrokModelAvailable, grokEventsTranscript, latestGrokCompletion, grokInitializationComplete, observeGrokDone, buildGrokAgentCmd, grokLaunchNote, grokEnvTokens, grokTuiReady, GROK_COMPOSER_MARKER_RE, grokFooterHasConfiguration, grokTranscriptText, createGrokAgentMetadata, } from "./vendors/grok.js";
-import { bindCodexTranscriptSession, latestCodexCompletion, observeCodexDone, buildCodexAgentCmd, codexLaunchNote, codexTuiReady, CODEX_COMPOSER_MARKER_RE, codexModelChoice, codexEffortChoice, codexMoreReasoningChoice, codexTranscriptText, createCodexAgentMetadata, } from "./vendors/codex.js";
-import { OPERATION_ID_RE, CLAUDE_RESULT_MAX_BYTES, CLAUDE_EFFORTS, agentManagedClaudeSettingsPath, agentClaudeResultPath, agentClaudeOperationPath, agentClaudeApprovalReceiptPath, agentClaudeDispatchReceiptPath, validateOperationId, readClaudeResultText, assertClaudeAuthenticationReady, buildClaudeAgentCmd, claudeLaunchNote, claudeTuiReady, CLAUDE_COMPOSER_MARKER_RE, createClaudeAgentMetadata, } from "./vendors/claude.js";
-import { bindCursorTranscriptSession, cursorTurnBoundary, latestCursorCompletion, observeCursorDone, cursorTranscriptText, assertCursorAuthenticationReady, assertCursorModelAvailable, buildCursorAgentCmd, createCursorAgentMetadata, cursorLaunchNote, cursorEffortNavigation, cursorTuiReady, CURSOR_COMPOSER_MARKER_RE, validateCursorModelEffort, } from "./vendors/cursor.js";
+import { GROK_MODEL_DEFAULTS, realGrokHome, resolveAndValidateGrokAuth, assertGrokModelAvailable, grokEventsTranscript, latestGrokCompletion, grokInitializationComplete, observeGrokDone, buildGrokAgentCmd, grokLaunchNote, grokEnvTokens, grokTuiReady, GROK_COMPOSER_MARKER_RE, grokFooterHasConfiguration, grokTranscriptText, createGrokAgentMetadata, } from "./harnesses/grok.js";
+import { bindCodexTranscriptSession, latestCodexCompletion, observeCodexDone, buildCodexAgentCmd, codexLaunchNote, codexTuiReady, CODEX_COMPOSER_MARKER_RE, codexModelChoice, codexEffortChoice, codexMoreReasoningChoice, codexTranscriptText, createCodexAgentMetadata, } from "./harnesses/codex.js";
+import { OPERATION_ID_RE, CLAUDE_RESULT_MAX_BYTES, CLAUDE_EFFORTS, agentManagedClaudeSettingsPath, agentClaudeResultPath, agentClaudeOperationPath, agentClaudeApprovalReceiptPath, agentClaudeDispatchReceiptPath, validateOperationId, readClaudeResultText, assertClaudeAuthenticationReady, buildClaudeAgentCmd, claudeLaunchNote, claudeTuiReady, CLAUDE_COMPOSER_MARKER_RE, createClaudeAgentMetadata, } from "./harnesses/claude.js";
+import { bindCursorTranscriptSession, cursorTurnBoundary, latestCursorCompletion, observeCursorDone, cursorTranscriptText, assertCursorAuthenticationReady, assertCursorModelAvailable, buildCursorAgentCmd, createCursorAgentMetadata, cursorLaunchNote, cursorEffortNavigation, cursorTuiReady, CURSOR_COMPOSER_MARKER_RE, validateCursorModelEffort, } from "./harnesses/cursor.js";
 import { resolveAgentBin, resolveThroughlineBin, runThroughlineHandoffContext, isWindowsNativeExecutable, agentBinForPaneShell, resolveWinPaneShell } from "./agent-resolver.js";
 export { AitermError } from "./errors.js";
 export { tmuxSpawnEnv } from "./tmux-runtime.js";
@@ -1789,18 +1789,18 @@ function scanAgentDoneLines(lines, meta, expectedOperationId = null) {
         if (expectedOperationId && ev.operation_id !== expectedOperationId)
             continue;
         if (meta.vendor_session_id)
-            return { event: ev, malformedEvents, ambiguousVendorSession: false };
+            return { event: ev, malformedEvents, ambiguousHarnessSession: false };
         if (candidate?.vendor_session_id &&
             ev.vendor_session_id &&
             candidate.vendor_session_id !== ev.vendor_session_id) {
-            return { event: null, malformedEvents, ambiguousVendorSession: true };
+            return { event: null, malformedEvents, ambiguousHarnessSession: true };
         }
         if (!candidate)
             candidate = ev;
     }
-    return { event: candidate, malformedEvents, ambiguousVendorSession: false };
+    return { event: candidate, malformedEvents, ambiguousHarnessSession: false };
 }
-function bindAgentVendorSession(meta, ev) {
+function bindAgentHarnessSession(meta, ev) {
     if (!meta.vendor_session_id && ev.vendor_session_id) {
         meta.vendor_session_id = ev.vendor_session_id;
     }
@@ -1816,7 +1816,7 @@ function bindCompletedInitialPrompt(meta) {
         if (!done) {
             throw new AitermError(`agent session '${meta.aiterm_session}' は起動時 prompt の完了待ちです。${agentWaitGuide(meta.aiterm_session)}`, 2);
         }
-        bindAgentVendorSession(meta, done);
+        bindAgentHarnessSession(meta, done);
         setInitialPromptState(meta, "done");
         return;
     }
@@ -1825,7 +1825,7 @@ function bindCompletedInitialPrompt(meta) {
         if (!done) {
             throw new AitermError(`agent session '${meta.aiterm_session}' は起動時 prompt の完了待ちです。${agentWaitGuide(meta.aiterm_session)}`, 2);
         }
-        bindAgentVendorSession(meta, done);
+        bindAgentHarnessSession(meta, done);
         setInitialPromptState(meta, "done");
         return;
     }
@@ -1844,7 +1844,7 @@ function bindCompletedInitialPrompt(meta) {
     const lines = text.split("\n");
     const tail = lines.pop() ?? "";
     const scanned = scanAgentDoneLines(lines, meta);
-    if (scanned.ambiguousVendorSession) {
+    if (scanned.ambiguousHarnessSession) {
         throw new AitermError("agent event file に複数の vendor_session_id が混在しています。該当セッションを閉じて起動し直してください。", 2);
     }
     if (!scanned.event) {
@@ -1852,7 +1852,7 @@ function bindCompletedInitialPrompt(meta) {
         const partial = tail.trim() ? " partial_event=true" : "";
         throw new AitermError(`agent session '${meta.aiterm_session}' は起動時 prompt の完了 event をまだ確認できません。${agentWaitGuide(meta.aiterm_session)}${malformed}${partial}`, 2);
     }
-    bindAgentVendorSession(meta, scanned.event);
+    bindAgentHarnessSession(meta, scanned.event);
     setInitialPromptState(meta, "done");
 }
 function tryLoadAgentMetadata(name) {
@@ -1923,7 +1923,7 @@ function completedClaudeOperationEvent(meta, operationId) {
     }
     return match;
 }
-function recoverAgentVendorSession(meta) {
+function recoverAgentHarnessSession(meta) {
     if (meta.vendor_session_id)
         return;
     if (meta.kind === "codex") {
@@ -1952,12 +1952,12 @@ function recoverAgentVendorSession(meta) {
     const lines = text.split("\n");
     lines.pop(); // hook は newline 完結eventだけを確定済みとして扱う。
     const scanned = scanAgentDoneLines(lines, meta);
-    if (scanned.ambiguousVendorSession) {
+    if (scanned.ambiguousHarnessSession) {
         throw new AitermError("agent event file に複数の vendor_session_id が混在しています。該当セッションを閉じて起動し直してください。", 2);
     }
     if (!scanned.event?.vendor_session_id)
         return;
-    bindAgentVendorSession(meta, scanned.event);
+    bindAgentHarnessSession(meta, scanned.event);
     writeAgentMetadata(meta);
 }
 function agentCompletionCursor(meta) {
@@ -2021,7 +2021,7 @@ async function settlePublishedClaudeCompletionMarker(meta, marker) {
     }
     return active;
 }
-/** agent vendor の構造化 transcript から直近完了ターンの最終回答を読む。 */
+/** agent harness の構造化 transcript から直近完了ターンの最終回答を読む。 */
 export async function readAgentTranscript(name, o = {}) {
     const meta = loadAgentMetadata(name);
     const operationId = o.operation_id == null ? null : validateOperationId(o.operation_id);
@@ -2038,8 +2038,8 @@ export async function readAgentTranscript(name, o = {}) {
         }
     }
     // wait timeout は「失敗」ではなく状態不明。後着した同一launchの完了eventから
-    // vendor session をbindし、promptを再送せず結果だけ回収できるようにする。
-    recoverAgentVendorSession(meta);
+    // harness session をbindし、promptを再送せず結果だけ回収できるようにする。
+    recoverAgentHarnessSession(meta);
     if (!meta.vendor_session_id) {
         throw new AitermError(`agent session '${name}' はまだターンが完了していません。agent_done 完了後に再取得してください。${agentWaitGuide(name)}`, 2);
     }
@@ -2160,7 +2160,7 @@ export function agentWaitGuide(session) {
     const cmd = `aiterm-wait --session ${session ?? "<session_id>"} --cursor 0`;
     return `完了通知は ${agentWaitLaunchForm(cmd)} で受ける（親はここで待たない・polling 不要）。receipt の outcome=done を確認してから再取得する。`;
 }
-// vendor 別の利用上限バナー。検知は「報告」専用で、完了判定や自動復旧には使わない。
+// harness 別の利用上限バナー。検知は「報告」専用で、完了判定や自動復旧には使わない。
 // 出典（2026-08-22）: grok は live 実バナーで検証、codex/claude はインストール済み実バイナリの
 // 埋込文字列から抽出（codex: "You've hit your usage limit for" / claude: "Usage limit reached ·
 // continuing automatically when it resets"。Claude Code はリセット時に自動継続する設計なので、
@@ -2172,7 +2172,7 @@ const AGENT_RATE_LIMIT_PATTERNS = {
     claude: [/Usage limit reached/i],
 };
 const AGENT_RATE_LIMIT_SCAN_BYTES = 16 * 1024;
-// pane log の末尾から上限バナーを探す。読めない・無い・対象 vendor でないは全て null（誤検知より取りこぼし側へ倒す）。
+// pane log の末尾から上限バナーを探す。読めない・無い・対象 harness でないは全て null（誤検知より取りこぼし側へ倒す）。
 export function detectAgentRateLimit(kind, aitermSession) {
     const patterns = AGENT_RATE_LIMIT_PATTERNS[kind];
     if (!patterns)
@@ -2264,7 +2264,7 @@ export async function observeAgentDone(name, o = {}) {
             carry = parts.pop() ?? "";
             const scanned = scanAgentDoneLines(parts, meta, operationId);
             malformedEvents += scanned.malformedEvents;
-            if (scanned.ambiguousVendorSession) {
+            if (scanned.ambiguousHarnessSession) {
                 throw new AitermError("agent event file に複数の vendor_session_id が混在しています。該当セッションを閉じて起動し直してください。", 2);
             }
             if (scanned.event)
@@ -2578,7 +2578,7 @@ async function waitForGrokConfigurationResult(name, before, model, effort, timeo
         if (added.some((line) => /^(?:Switched to |✓?\s*Default model:)/.test(line)))
             return;
         // Grok Build 1.0.3では成功通知が次の再描画で消えることがある。変更前には無かった
-        // target model／effortが常駐footerへ現れた場合も、vendor自身の最終状態として受理する。
+        // target model／effortが常駐footerへ現れた場合も、harness自身の最終状態として受理する。
         if (!footerAlreadyMatched && grokFooterHasConfiguration(screen, model, effort))
             return;
         await sleep(100);
@@ -2591,7 +2591,7 @@ function sendMenuChoice(name, choice) {
         throw new AitermError(`agent設定の選択を送れませんでした: ${sent.stderr.trim() || `code=${sent.code}`}`, 2);
     }
 }
-/** 同じ対話sessionを保ったまま、vendor標準の操作でmodel／effortを変更する。 */
+/** 同じ対話sessionを保ったまま、harness標準の操作でmodel／effortを変更する。 */
 export async function configureAgent(name, opts) {
     assertSessionName(name);
     const model = opts.model?.trim() || null;
@@ -2738,7 +2738,7 @@ export function __testCodexConfigureChoices(screen, model, effort) {
     };
 }
 // v0.16.0: 親をブロックする wait 経路は廃止した。send は ready gate と submit 分離を内蔵した
-// dispatch として即返り、event_cursor（送信直前のvendor完了正本境界）を receipt で返す。
+// dispatch として即返り、event_cursor（送信直前のharness完了正本境界）を receipt で返す。
 // 完了通知は aiterm-wait（--cursor で境界を渡す）、回収は pty_read / claude_turn recover が担う。
 export async function dispatchAgentTurn(name, text, o = {}) {
     assertSessionName(name);
@@ -2850,7 +2850,7 @@ function inspectClaudeOperation(meta, operationId, action) {
     if (!done)
         return { ...base, status: "unknown", raw_output: null, reason: "result_unknown" };
     if (!meta.vendor_session_id && done.vendor_session_id) {
-        bindAgentVendorSession(meta, done);
+        bindAgentHarnessSession(meta, done);
         writeAgentMetadata(meta);
     }
     const rawOutput = readClaudeResultText(meta, done, operationId, transcriptUnavailable);
@@ -2893,8 +2893,8 @@ function portableForkPrompt(sourceSessionId, mission) {
     }
     return composePortableForkPrompt(value.context, mission);
 }
-/** vendor CLI の存在だけを安全に要約する。認証状態・実行出力・解決先 path は返さない。 */
-export function vendorLauncherDiagnostic(kind) {
+/** harness CLI の存在だけを安全に要約する。認証状態・実行出力・解決先 path は返さない。 */
+export function harnessLauncherDiagnostic(kind) {
     try {
         return resolveAgentBin(kind) ? "ready" : "not_applicable";
     }
@@ -3082,7 +3082,7 @@ export function openAgent(kind, opts = {}) {
     // grok.exe で実測済み（2026-08-15）。
     // Windows の grok/composer は Windows native の grok.exe だけを起動する（オーナー裁定 2026-08-15:
     // WindowsネイティブはWindowsネイティブで完結させ、WSL2へ持ち込まない）。WSL 側 grok を起動すると
-    // vendor 実体が WSL process になり、auth・session 記録（events/chat_history）が WSL home 側へ分裂して
+    // harness 実体が WSL process になり、auth・session 記録（events/chat_history）が WSL home 側へ分裂して
     // transcript／completion を回収できない（実被弾: 2026-08-15 olc-plan-review-grok2）。
     if (isWin && (kind === "grok" || kind === "composer") && !isWindowsNativeExecutable(bin)) {
         ownTelemetryFailure("AITERM.VENDOR_LAUNCHER_FAILED", new AitermError(`Windows の ${label} launcher は Windows native の grok.exe だけを起動できます（現在の解決先: ${bin}）。` +
@@ -3185,7 +3185,7 @@ export async function openAgentWithInitialPrompt(kind, opts = {}) {
         throw new AitermError("launch_operation_idはpromptなしのClaude相関launchだけで指定できます", 2);
     }
     // v0.16.0: launcher は常に managed（Stop hook つき）で立つ。手動運転したい場合は
-    // pty_open で素の PTY を開き、vendor CLI を自分で send する。
+    // pty_open で素の PTY を開き、harness CLI を自分で send する。
     // 第3要素は「起動時点でturnが走っているか」の event_cursor: Grok/Composer/Cursor の argv prompt は
     // event file 新規作成直後の起動＝境界0、prompt なしの起動は turn なし＝null。
     if (!prompt || (kind !== "codex" && kind !== "claude")) {

package/dist/{vendors → harnesses}/claude.js

@@ -1,6 +1,6 @@
 // Claude Code 固有の制御。完了正本は launch 固有 Stop hook が書く event/result（ADR 0025）。
 // core 所有のサービス（transcript 不在エラー）は引数で注入し、
-// 依存方向を core → vendors → agent-shared の一方向に保つ。
+// 依存方向を core → harnesses → agent-shared の一方向に保つ。
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -44,7 +44,7 @@ export function agentClaudeDispatchReceiptPath(name, launchId, operationId) {
     return path.join(agentsDir(), `${name}.${launchId}.${validated.slice("sha256:".length)}.claude-dispatch`);
 }
 function claudeHookScriptPath() {
-    // この module は dist/vendors/ に置かれるが、stop hook 実体は dist/ 直下に build される。
+    // この module は dist/harnesses/ に置かれるが、stop hook 実体は dist/ 直下に build される。
     return path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "claude-stop-hook.js");
 }
 // process.execPath は Homebrew 等では Cellar の版付き実体を指す。長寿命 MCP server の起動後に

package/dist/{vendors → harnesses}/codex.js

@@ -1,6 +1,6 @@
 // Codex 固有の制御。完了正本は root rollout transcript の task_complete（ADR 0022）。
 // core 所有のサービス（transcript 行読取・rate limit 検知）は引数で注入し、
-// 依存方向を core → vendors → agent-shared の一方向に保つ。
+// 依存方向を core → harnesses → agent-shared の一方向に保つ。
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -65,7 +65,7 @@ export function codexConfigSummary(configPath) {
         bits.push(`sandbox_mode=${sandboxMode}`);
     return `共有 config: ${bits.join(" / ")}`;
 }
-export function findLatestCodexTranscript(codexHome, vendorSessionId) {
+export function findLatestCodexTranscript(codexHome, harnessSessionId) {
     const sessionsDir = path.join(codexHome, "sessions");
     let latestFile = null;
     let latestMtime = -Infinity;
@@ -83,7 +83,7 @@ export function findLatestCodexTranscript(codexHome, vendorSessionId) {
                 visit(file);
                 continue;
             }
-            if (!entry.isFile() || !entry.name.startsWith("rollout-") || !entry.name.endsWith(".jsonl") || !entry.name.includes(vendorSessionId))
+            if (!entry.isFile() || !entry.name.startsWith("rollout-") || !entry.name.endsWith(".jsonl") || !entry.name.includes(harnessSessionId))
                 continue;
             try {
                 const mtimeMs = fs.statSync(file).mtimeMs;
@@ -204,14 +204,14 @@ export function bindCodexTranscriptSession(meta) {
     const transcript = codexRootTranscript(meta);
     if (!transcript)
         return null;
-    const vendorSessionId = codexTranscriptSessionId(transcript);
-    if (vendorSessionId && !meta.vendor_session_id) {
-        meta.vendor_session_id = vendorSessionId;
+    const harnessSessionId = codexTranscriptSessionId(transcript);
+    if (harnessSessionId && !meta.vendor_session_id) {
+        meta.vendor_session_id = harnessSessionId;
         writeAgentMetadata(meta);
     }
     return transcript;
 }
-export function codexCompletionEvent(meta, vendorSessionId, record) {
+export function codexCompletionEvent(meta, harnessSessionId, record) {
     if (record?.type !== "event_msg" ||
         record?.payload?.type !== "task_complete" ||
         typeof record?.payload?.turn_id !== "string" ||
@@ -222,7 +222,7 @@ export function codexCompletionEvent(meta, vendorSessionId, record) {
         vendor: "codex",
         aiterm_session: meta.aiterm_session,
         launch_id: meta.launch_id,
-        vendor_session_id: vendorSessionId,
+        vendor_session_id: harnessSessionId,
         turn_id: record.payload.turn_id,
         operation_id: null,
         reason: "Codex transcript task_complete",
@@ -235,13 +235,13 @@ export function latestCodexCompletion(meta, readTranscriptLines) {
     const transcript = codexRootTranscript(meta);
     if (!transcript)
         return null;
-    const vendorSessionId = meta.vendor_session_id ?? codexTranscriptSessionId(transcript);
+    const harnessSessionId = meta.vendor_session_id ?? codexTranscriptSessionId(transcript);
     let latest = null;
     for (const line of readTranscriptLines(transcript)) {
         if (!line.trim())
             continue;
         try {
-            latest = codexCompletionEvent(meta, vendorSessionId, JSON.parse(line)) ?? latest;
+            latest = codexCompletionEvent(meta, harnessSessionId, JSON.parse(line)) ?? latest;
         }
         catch {
             // Codexが末尾を書込み中なら、その行は次の観測で完結してから読む。
@@ -301,7 +301,7 @@ export async function observeCodexDone(meta, timeout, requestedCursor, detectRat
                     parts.shift();
                     discardLeadingFragment = false;
                 }
-                const vendorSessionId = meta.vendor_session_id ?? codexTranscriptSessionId(transcript);
+                const harnessSessionId = meta.vendor_session_id ?? codexTranscriptSessionId(transcript);
                 for (const line of parts) {
                     if (!line.trim())
                         continue;
@@ -310,7 +310,7 @@ export async function observeCodexDone(meta, timeout, requestedCursor, detectRat
                         continue;
                     }
                     try {
-                        const done = codexCompletionEvent(meta, vendorSessionId, JSON.parse(line));
+                        const done = codexCompletionEvent(meta, harnessSessionId, JSON.parse(line));
                         if (done)
                             return observation("done", done);
                     }

package/dist/{vendors → harnesses}/cursor.js

@@ -21,11 +21,11 @@ export function cursorTranscriptRoot(meta) {
         return null;
     return path.join(meta.cursor_home, "projects", cursorWorkspaceId(meta.cwd ?? process.cwd()), "agent-transcripts");
 }
-export function cursorTranscriptForSession(meta, vendorSessionId) {
+export function cursorTranscriptForSession(meta, harnessSessionId) {
     const root = cursorTranscriptRoot(meta);
-    if (!root || !UUID_RE.test(vendorSessionId))
+    if (!root || !UUID_RE.test(harnessSessionId))
         return null;
-    return path.join(root, vendorSessionId, `${vendorSessionId}.jsonl`);
+    return path.join(root, harnessSessionId, `${harnessSessionId}.jsonl`);
 }
 export function listCursorTranscripts(meta) {
     const root = cursorTranscriptRoot(meta);
@@ -102,14 +102,14 @@ export function bindCursorTranscriptSession(meta) {
     const transcript = cursorTranscript(meta);
     if (!transcript)
         return null;
-    const vendorSessionId = cursorTranscriptSessionId(transcript);
-    if (vendorSessionId && !meta.vendor_session_id) {
-        meta.vendor_session_id = vendorSessionId;
+    const harnessSessionId = cursorTranscriptSessionId(transcript);
+    if (harnessSessionId && !meta.vendor_session_id) {
+        meta.vendor_session_id = harnessSessionId;
         writeAgentMetadata(meta);
     }
     return transcript;
 }
-export function cursorCompletionEvent(meta, vendorSessionId, record, turnId) {
+export function cursorCompletionEvent(meta, harnessSessionId, record, turnId) {
     if (meta.kind !== "cursor" || record?.type !== "turn_ended" || typeof record?.status !== "string")
         return null;
     return {
@@ -117,7 +117,7 @@ export function cursorCompletionEvent(meta, vendorSessionId, record, turnId) {
         vendor: "cursor",
         aiterm_session: meta.aiterm_session,
         launch_id: meta.launch_id,
-        vendor_session_id: vendorSessionId,
+        vendor_session_id: harnessSessionId,
         turn_id: turnId,
         operation_id: null,
         reason: `Cursor transcript turn_ended:${record.status}`,
@@ -172,12 +172,12 @@ export function latestCursorCompletion(meta, readTranscriptLines) {
     const transcript = cursorTranscript(meta);
     if (!transcript)
         return null;
-    const vendorSessionId = meta.vendor_session_id ?? cursorTranscriptSessionId(transcript);
+    const harnessSessionId = meta.vendor_session_id ?? cursorTranscriptSessionId(transcript);
     // callerとの共通signatureを保つ。Cursorのturn境界はbyte列でなくuser turn数を使う。
     void readTranscriptLines;
     const state = cursorTranscriptState(transcript);
     return state.terminalRecord
-        ? cursorCompletionEvent(meta, vendorSessionId, state.terminalRecord, `cursor:${state.userTurns}`)
+        ? cursorCompletionEvent(meta, harnessSessionId, state.terminalRecord, `cursor:${state.userTurns}`)
         : null;
 }
 export async function observeCursorDone(meta, timeout, requestedCursor, detectRateLimit) {
@@ -208,8 +208,8 @@ export async function observeCursorDone(meta, timeout, requestedCursor, detectRa
             const state = cursorTranscriptState(transcript);
             malformedEvents = state.malformedEvents;
             if (state.userTurns > startBoundary && state.terminalRecord) {
-                const vendorSessionId = meta.vendor_session_id ?? cursorTranscriptSessionId(transcript);
-                const done = cursorCompletionEvent(meta, vendorSessionId, state.terminalRecord, `cursor:${state.userTurns}`);
+                const harnessSessionId = meta.vendor_session_id ?? cursorTranscriptSessionId(transcript);
+                const done = cursorCompletionEvent(meta, harnessSessionId, state.terminalRecord, `cursor:${state.userTurns}`);
                 if (done)
                     return observation("done", done);
             }

package/dist/{vendors → harnesses}/grok.js

@@ -1,7 +1,7 @@
 // Grok / Composer 固有の制御。Composer は grok CLI の別モデル起動プリセットであり、
 // モデル既定値と表示名以外は Grok と完全共通（実測 2026-08-23 棚卸し・docs/32）。
 // core 所有のサービス（transcript 行読取・rate limit 検知）は引数で注入し、
-// 依存方向を core → vendors → agent-shared の一方向に保つ。
+// 依存方向を core → harnesses → agent-shared の一方向に保つ。
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -43,8 +43,8 @@ export function resolveAndValidateGrokAuth(srcHome) {
         if (!value || typeof value !== "object" || Array.isArray(value))
             throw new AitermError("Grok 認証正本のJSONが不正です", 2);
         // auth file 自体は O_NOFOLLOW で開いているが、中間 directory の symlink は辿り得る。
-        // vendor に渡す正本を path swap の入口にしないため、字句正規化した絶対 path と realpath を
-        // 一致させ、canonical な祖先も root まで検証する。same-UID race の排他は vendor lock の責務。
+        // harness に渡す正本を path swap の入口にしないため、字句正規化した絶対 path と realpath を
+        // 一致させ、canonical な祖先も root まで検証する。same-UID race の排他は harness lock の責務。
         const lexicalPath = path.resolve(authPath);
         const canonicalPath = fs.realpathSync(authPath);
         if (lexicalPath !== canonicalPath)
@@ -299,7 +299,7 @@ export function grokLaunchNote(kind, model, effort, meta) {
         `effort=${effort ?? "CLI／model既定"}。` + writeScopeNote);
 }
 // grok/composer: 検証済み auth 正本をそのままの path 形で渡す。Windows では native 強制により
-// vendor は Windows process なので、Windows ドライブパスが正しい形（WSL 形への変換はしない）。
+// harness は Windows process なので、Windows ドライブパスが正しい形（WSL 形への変換はしない）。
 export function grokEnvTokens(meta) {
     return [
         ...(meta.grok_auth_path ? [`GROK_AUTH_PATH=${shq(meta.grok_auth_path)}`] : []),
@@ -308,7 +308,7 @@ export function grokEnvTokens(meta) {
 }
 export function grokTuiReady(screen) {
     // Grok Build 0.2.117 は起動完了後に製品名を消し、model footerだけを残す。
-    // Composerも同じfrontendでmodel名だけが異なるため、両方をvendor UIの根拠にする。
+    // Composerも同じfrontendでmodel名だけが異なるため、両方をharness UIの根拠にする。
     // Windows native grok.exe（1.0.4 実測）は入力欄markerを `❯` でなく `>` で描画するため両方を受ける。
     const grokFrontend = screen.includes("Grok Build") || /\b(?:Grok|Composer)\s+[\w.()-]+/.test(screen);
     return grokFrontend && /(^|\n|\s)[❯>]/.test(screen);

package/dist/index.js

@@ -43,10 +43,10 @@ function fail(e) {
  */
 async function factoryDiagnostics() {
     const ptyList = core.readOnlyPtyListDiagnostic();
-    const claude = core.vendorLauncherDiagnostic("claude");
-    const codex = core.vendorLauncherDiagnostic("codex");
-    const grok = core.vendorLauncherDiagnostic("grok");
-    const cursor = core.vendorLauncherDiagnostic("cursor");
+    const claude = core.harnessLauncherDiagnostic("claude");
+    const codex = core.harnessLauncherDiagnostic("codex");
+    const grok = core.harnessLauncherDiagnostic("grok");
+    const cursor = core.harnessLauncherDiagnostic("cursor");
     const runtimeErrors = await runtimeErrorStoreDiagnostic();
     const overall = ptyList.status === "unverified" || runtimeErrors.status === "unverified" ? "unverified" : "ready";
     return JSON.stringify({
@@ -193,7 +193,7 @@ server.registerTool("pty_send", {
 server.registerTool("pty_read", {
     description: "セッションの出力をトークン削減して読む（既定は前回読取位置からの増分）。" +
         "削減: 制御文字除去 / 反復圧縮 / head+tail 折りたたみ＋復元ヒント＋メタ併記。" +
-        "agent_transcript:true は agent session の直近完了ターンの最終 assistant メッセージを公開されたvendor記録から平文で返す。" +
+        "agent_transcript:true は agent session の直近完了ターンの最終 assistant メッセージを公開されたharness記録から平文で返す。" +
         "長い回答が screen tail で切れた時の回収用。",
     inputSchema: {
         session_id: z.string(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent terminal MCP with one harness-based launcher for Claude Code, Codex CLI, Grok CLI, and Cursor Agent CLI, plus durable PTYs for SSH, containers, and REPLs.",
   "keywords": [
@@ -26,7 +26,7 @@
   ],
   "license": "MIT",
   "author": {
-    "name": "Quo / \u30af\u30aa at kitepon.dev",
+    "name": "Quo / クオ at kitepon.dev",
     "url": "https://kitepon.dev/"
   },
   "repository": {
@@ -45,7 +45,7 @@
   },
   "files": [
     "dist/*.js",
-    "dist/vendors/*.js",
+    "dist/harnesses/*.js",
     "README.md",
     "LICENSE"
   ],