cowork-harness 1.3.0 → 1.4.0

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 1.3.0
-  tracks-harness: cowork-harness 1.3.0 (baseline desktop-1.21459.0)
+  version: 1.4.0
+  tracks-harness: cowork-harness 1.4.0 (baseline desktop-1.22209.3)
 ---
 
 # cowork-harness
@@ -22,8 +22,8 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.3.0` (baseline
-> `desktop-1.21459.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.4.0` (baseline
+> `desktop-1.22209.3`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
 ## Preflight — make sure the harness can actually run
@@ -39,9 +39,9 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.3.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.3.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.3.0"`. **Pin `@>=1.3.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.4.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.4.0" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.4.0"`. **Pin `@>=1.4.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
-  What the ≥ 1.3.0 floor gates, by release:
+  What the ≥ 1.4.0 floor gates, by release:
 
   - **core set (pre-0.21.0 vintage, or mixed):** `assertions --list`, `scaffold <run-id>`, `trace --view dispatches`, `artifact_json` incl. the `in:` operator (passes when the resolved value deep-equals one of the listed members — value ∈ your list, not the reverse), `verify-cassettes` incl. the `--allow-domain`/`--allow-email`/`--allow-patterns-file` allows (`--allow-patterns-file <path>` is a FILE of patterns, one regex per line — not a path to allow, unlike `--allow <regex>`), batch `record <dir>`/`--rerecord-stale`, `record --concurrency <N>`, record-time redaction, multiSelect/`answer:`, `verify-run` answer-coverage, `record --max-artifact-bytes`, live record-time deciders, scenario `skills:` staleness scoping with `COWORK_HARNESS_AGENT_SCOPE=skill`, `chat --plugin`, and `/help` in the REPL.
   - **0.21.0:** `verify-cassettes --allow-path` (`path` — local absolute filesystem paths — is the scanner's 4th class), and `hostloop`'s native host/VM process split with its `allow_host_writes:` consent field.
@@ -55,6 +55,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
   - **1.1.0:** `analyze-skill` now also flags **interactive-artifact write-backs lost under Cowork** — a relative `fetch`/XHR/`sendBeacon`/`<form method=post>` in an emitted `.html` (or its `.py`/`.js` generator) that silently fails when the artifact is served from Cowork's own origin. `artifact-write-back-lost` gates under `--strict`; `artifact-write-back-suspect` is advisory; an unanalyzable candidate is a could-not-verify exit 3. An optional **`analyze-skill --runtime`** drives the artifact in a headless DOM (needs `jsdom`) to *observe* the lost write-back — enrichment only, never changes the exit code. Plus a `lint` check for a container-only assertion key (`no_scratchpad_leak`/`present_files_called`) used off the `container` tier, and the `doctor --output-format json` envelope frozen as a covered SPEC §12 surface (`schema/doctor.json`).
   - **1.2.0:** three new assertion keys — `no_lost_write_back: true` (the write-back detector above wired as a per-scenario gate over the run's authored files, live-only) and the regex siblings `tool_result_matches`/`tool_result_not_matches` (case-insensitive per-result, for an error-signature *family* a literal substring can't express). **`microvm` outputs are now observable** — its session tree is snapshotted from the VM into the run dir, so `file_exists`/`artifact_json`/`user_visible_artifact`/`no_unexpected_files`/`input_unmodified`/`no_lost_write_back`/`semantic_matches` all work there, no longer `container`/`hostloop`-only. `status <dir>` also resolves the newest session under a `--run-dir` root; the completion footer prints a `→ result: …/result.json` pointer; the `on_unanswered=fail` error also points to `on_unanswered: llm`. `analyze-skill` hardening: a phantom `<script>` prose block no longer sinks a real verdict, a delete/remove flow claiming success classifies as lost (error) not just suspect, and write-back detection widened (optional-call `?.` spellings, member-spelled/aliased `fetch`/`sendBeacon`, axios instance/config forms).
   - **1.3.0:** run-identity for the iterate-across-fixes loop — `skill`/`run` take `--label <tag>` (a generation tag surfaced in `result.json` `runLabel`, the run-index row, `inspect`, and `status.json`) alongside an auto-recorded `skillCommit`, layered on the **authoritative** content-exact `fingerprint.skillHash` a harvest step should pair critiques by (`inspect`/index surface a short `skillHash` prefix). `trace --full-results` captures the full input+result of **every** tool call — successful ones too, not just errors — so an external grader can ground a self-critique finding against the call it cites. `verify-run` now **warns** on skillHash drift for answer-less scenarios (was silent unless the scenario declared scripted `answers`). Plus `skill --allow-missing-capability` (the open-ended-run opt-out for a capability FALSE-NEGATIVE on the lean `core` image), a new **warn-severity `ended_with_question`** verdict signal (the agent's final answer contains a question and the run wrote no `outputs/` deliverable — the lenient sibling of the strict `stalled`), and LLM-decider `OTHER:` free-text answers now marked `[via Other free-text]` in gate provenance.
+  - **1.4.0:** platform baseline synced to Desktop **1.22209.3** (agent 2.1.215; no prompt/spawn/egress drift), and **`coworkWebFetchDedup` is now enacted** on the hostloop `web_fetch` path — a repeat fetch of the same normalized URL within the TTL (15 min, cap 100) makes **no network request** and returns a marker to re-use the earlier result, with no egress event. Baseline-gated (Desktop ≥ 1.22209.3), keyed under the request + terminal `destination_url`, never caching errors/empty; a hit is assertable via `tool_result_contains: "Already fetched"`.
 - **Agent binary (sandboxed live tiers — `container`/`microvm`/`hostloop`/`cowork`).** The staged Claude Code agent is **bind-mounted** from a local Claude Desktop install, or point `COWORK_AGENT_BINARY` at a `claude-code-vm/<ver>/claude` ELF. Nothing is bundled. `protocol` (L0) and `replay` need no staged agent; for the sandboxed tiers, no agent → no run; report that, don't skip silently.
 - **Docker / Lima.** Only `--fidelity protocol` (L0) runs without them. `container` / `microvm` / `hostloop` / `cowork` need Docker (Lima for L2). If they're absent, drop to `--fidelity protocol` and **say so** — a green that never exercised the sandbox is not a sandbox pass.
 - **Auth.** `CLAUDE_CODE_OAUTH_TOKEN` (preferred), or `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN`, via env or `.env`. Minting an OAuth token needs the **`claude` CLI** (`npm i -g @anthropic-ai/claude-code`, then `claude setup-token`).

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 1.3.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.4.0` (baseline `desktop-1.20186.1`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -13,7 +13,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 ```
 
 The Action's `version` input defaults to `latest` — intentional so a copy-pasted recipe tracks the current
-release; pin an exact version (e.g. `version: "1.3.0"`) for reproducible CI.
+release; pin an exact version (e.g. `version: "1.4.0"`) for reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified — see docs/maintenance.md)
         run: |
-          V=2.1.209   # match your scenario's pinned baseline's agentVersion
+          V=2.1.215   # match your scenario's pinned baseline's agentVersion
           curl -fSL "https://downloads.claude.ai/claude-code-releases/$V/linux-arm64/claude" -o "$RUNNER_TEMP/claude-$V"
           chmod +x "$RUNNER_TEMP/claude-$V"
           # verify against the committed baseline's sha256 (baselines/desktop-*.json → agentBinary.sha256)
@@ -57,7 +57,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=1.3.0"
+- run: npm i -g "cowork-harness@>=1.4.0"
 - run: cowork-harness lint scenarios/*.yaml          # no silent false-greens
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness
 - run: cowork-harness replay cassettes/              # token-free content/structure
@@ -197,7 +197,7 @@ jobs:
         with: { node-version: '20' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=1.3.0"
+      - run: npm i -g "cowork-harness@>=1.4.0"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -226,7 +226,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=1.3.0"
+        run: npm i -g "cowork-harness@>=1.4.0"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 1.3.0` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.4.0` (baseline `desktop-1.20186.1`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.3.0`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.4.0`
 (baseline `desktop-1.20186.1`). If your checkout is newer, prefer the live `docs/scenario.md`,
 `docs/session.md`, and `SPEC.md`.
 

package/CHANGELOG.md

@@ -6,6 +6,26 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [1.4.0] — 2026-07-19
+
+### Added
+
+- **`coworkWebFetchDedup` enacted (hostloop `web_fetch`).** Real Cowork keeps a per-session negative-work
+  cache: a repeat `web_fetch` of the same normalized URL within a TTL (default 15 min; cap 100; FIFO
+  eviction; a hit does not refresh recency) makes **no network request** and returns a marker telling the
+  model to re-use the earlier result. The harness now reproduces this on the host-API (`coworkWebFetchViaApi`)
+  path — **baseline-gated** (only when the resolved baseline's `coworkWebFetchDedup` gate is on, i.e. Desktop
+  ≥ 1.22209.3), keyed under both the request URL and the terminal `destination_url`, never caching errors /
+  empty / non-2xx responses, and emitting **no egress event** on a hit (matching production's zero-network
+  dedup). A hit is observable via the marker text (`tool_result_contains: "Already fetched"`).
+
+### Changed
+
+- **Platform baseline synced to Desktop 1.22209.3** (agent `2.1.215`). No prompt / spawn-env / egress-allowlist
+  drift vs 1.21459.0; the sync captured the new `coworkWebFetchDedup` runtime config (enacted above) plus a
+  few new (off) GrowthBook gates. The skill/README/reference version floors and agent-binary pins track the
+  new baseline.
+
 ## [1.3.0] — 2026-07-19
 
 ### Added

package/README.md

@@ -91,7 +91,7 @@ node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 
 > **Installed globally instead?** Once linked/installed, the same command is `cowork-harness replay
 > <cassette>` — but the relative path above only resolves from a source checkout's `examples/replays/`.
-> From a global install (`npm i -g "cowork-harness@>=1.3.0"`), point at the package root instead:
+> From a global install (`npm i -g "cowork-harness@>=1.4.0"`), point at the package root instead:
 > `cowork-harness replay "$(npm root -g)/cowork-harness/examples/replays/example-pdf-skill.cassette.json"`
 > (or copy the cassette into your own project and pass that path).
 
@@ -101,7 +101,7 @@ Live `run`/`skill` need the prerequisites in the next section — note the `prot
 > - **Replay only (zero setup):** `cowork-harness replay <cassette>` — no token, no Docker, no agent. The command above.
 > - **`protocol` (real model, no Docker):** needs only the auth token (item 3 below).
 > - **Live `container` / `microvm` / `hostloop` / `cowork`:** needs Docker (or Lima for `microvm`), a staged agent, and the token — run `cowork-harness doctor` first.
-> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@>=1.3.0"`.
+> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@>=1.4.0"`.
 
 Two more worked examples worth knowing about: `examples/scenarios/protocol-smoke.yaml` (zero-Docker smoke
 test) and `examples/scenarios/skill-loads.yaml` (container-tier acceptance check) — see
@@ -126,7 +126,7 @@ claude plugin marketplace add yaniv-golan/cowork-harness
 claude plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@>=1.3.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@>=1.4.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://agentskills.io) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) via [`npx skills`](https://github.com/vercel-labs/skills) (Vercel Labs' CLI implementation of that spec):
 
@@ -147,7 +147,7 @@ A global install is enough for CI `lint`, reading the teaching skill, and replay
 To `run` the worked examples live or copy them as a starting point, use a source checkout. (The marketplace
 skill install itself only pulls `.claude/skills/cowork-harness/` — SKILL.md + `references/` + `scenario.py`/
 assertion keys, per `.claude-plugin/marketplace.json`'s `source` — not the rest of this table; the full set
-above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@>=1.3.0"` — see
+above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@>=1.4.0"` — see
 [above](#drive-it-from-claude-code-companion-skill) — which pulls the same npm package as the global-install row.)
 
 ### Prerequisites for anything above `protocol` fidelity
@@ -659,7 +659,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Stage the agent binary (official channel, sha256-verified — see docs/maintenance.md)
         run: |
-          V=2.1.209   # match your scenario's pinned baseline's agentVersion
+          V=2.1.215   # match your scenario's pinned baseline's agentVersion
           curl -fSL "https://downloads.claude.ai/claude-code-releases/$V/linux-arm64/claude" -o "$RUNNER_TEMP/claude-$V"
           chmod +x "$RUNNER_TEMP/claude-$V"
           echo "COWORK_AGENT_BINARY=$RUNNER_TEMP/claude-$V" >> "$GITHUB_ENV"
@@ -670,7 +670,7 @@ jobs:
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
-Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — intentional so recipes track the current release; pin an exact version for reproducible CI. The companion skill's `cowork-harness@>=1.3.0` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any advisory finding); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). See [`action.yml`](./action.yml) for the full input reference.
+Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — intentional so recipes track the current release; pin an exact version for reproducible CI. The companion skill's `cowork-harness@>=1.4.0` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any advisory finding); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). See [`action.yml`](./action.yml) for the full input reference.
 
 The provided [GitHub Actions workflow](.github/workflows/ci.yml) runs a **six-stage pipeline**. The **unit** stage is the token-free gate you can copy into your skill repo; the `action-self-test`, `python`, `boundary`, `scenarios`, and `parity-drift` stages are this repo's own fidelity self-tests and are not directly portable (they build the harness's Docker image and run harness-specific e2e scenarios — see [`ci-recipe.md`](./.claude/skills/cowork-harness/references/ci-recipe.md) for the skill-repo template):
 
@@ -831,6 +831,6 @@ inputs/outputs. Human-readable terminal text is explicitly **not** part of the c
 ## Status
 
 The latest shipped baseline — what `baseline: latest` resolves to (`cowork-harness list`) — is
-**`desktop-1.21459.0`**. Release-by-release verification notes (what was re-verified against
+**`desktop-1.22209.3`**. Release-by-release verification notes (what was re-verified against
 which live agent/asar) are recorded in [CHANGELOG.md](./CHANGELOG.md); the feature catalogue
 this section used to duplicate lives in the sections above.

package/SPEC.md

@@ -309,7 +309,7 @@ Payload sits under an **inner** `response`. Missing the nesting ⇒ `ZodError: e
 > Channels 2-3 = CLI `--mcp-config` / `.mcp.json` servers (honored in plain cowork mode; dropped only in
 > hermetic mode). Details per channel below.
 
-1. **SDK servers over the control protocol** — declared via `sdkMcpServers` in `initialize`; tool calls tunnel as `mcp_message`. This is how the **desktop host** bridges its own servers (incl. `claude_desktop_config.json` `mcpServers`, spawned host-side with full host env) and how the harness delivers the workspace shell. The workspace handler (`src/hostloop/workspace-handler.ts`) implements `initialize`/`tools/list`/`tools/call`; `bash`→`docker exec -w <mntRoot> <container> sh -c <cmd>` (container-egress-gated). **CB-8:** `makeWorkspaceHandler` accepts an `onInfraError?: (message: string) => void` callback at parameter position 6 (after `onEgress`); on infrastructure errors (ETIMEDOUT / killed / no code+stdout+stderr) the handler calls `onInfraError?.(e.message)`, returns a textResult with `"[infrastructure error: …]"`, and `spawnHostLoop` wires `onInfraError` to append `{type:"infra_error", ts, message}` to `events.jsonl`. **`web_fetch` is NOT container-egress-gated:** real Cowork routes it through the host API (gate `1978029737` `coworkWebFetchViaApi:true` → `POST /api/organizations/<org>/cowork/web_fetch`), gated by a **separate web-fetch hostname allowlist** (`getWebFetchAllowedUrls`, `*`=unrestricted) + a **URL-provenance** rule (URL must have appeared in a prior message/result). The harness mirrors this with the **two-path model** (`src/hostloop/workspace-handler.ts`, binary-verified `G1t`/`U1t`): **Path A** (provenance engaged — `coworkWebFetchViaApi` on) gates on the **exact-URL provenance set** ONLY (seeded from user-turn + tool-result URLs; `src/hostloop/provenance.ts`), with **no** hostname allowlist — but still an `http(s)`-scheme + private-address **SSRF backstop re-checked on every redirect hop** (a manual redirect loop, not `curl -L`) — a miss raises a per-domain approval (`webfetch:<domain>` permission with options `Allow once | Allow all for website | Deny`) routed through the Decider; "Allow all for website" approves the host for the rest of the run (`Run.approvedDomains`, per-run/ephemeral). **Path B** (gate off) is a direct host fetch gated by the egress domain list via the same `wen()`/`compile()` matcher container egress uses, with `redirect:"manual"` re-checking `U1t` (scheme + private-address SSRF + allowlist) on **every** redirect hop. web_fetch is thus **decoupled from `plan.egressAllow`** on Path A (egress applies to `bash`/Path B only). An unanswered cold miss is fail-closed; scenarios answer via `--answer "webfetch:<domain>=allow"` (with `grant`), `web_fetch.approved_domains`, or an LLM/external terminal. `bash` stays container-egress-sandboxed.
+1. **SDK servers over the control protocol** — declared via `sdkMcpServers` in `initialize`; tool calls tunnel as `mcp_message`. This is how the **desktop host** bridges its own servers (incl. `claude_desktop_config.json` `mcpServers`, spawned host-side with full host env) and how the harness delivers the workspace shell. The workspace handler (`src/hostloop/workspace-handler.ts`) implements `initialize`/`tools/list`/`tools/call`; `bash`→`docker exec -w <mntRoot> <container> sh -c <cmd>` (container-egress-gated). **CB-8:** `makeWorkspaceHandler` accepts an `onInfraError?: (message: string) => void` callback at parameter position 6 (after `onEgress`); on infrastructure errors (ETIMEDOUT / killed / no code+stdout+stderr) the handler calls `onInfraError?.(e.message)`, returns a textResult with `"[infrastructure error: …]"`, and `spawnHostLoop` wires `onInfraError` to append `{type:"infra_error", ts, message}` to `events.jsonl`. **`web_fetch` is NOT container-egress-gated:** real Cowork routes it through the host API (gate `1978029737` `coworkWebFetchViaApi:true` → `POST /api/organizations/<org>/cowork/web_fetch`), gated by a **separate web-fetch hostname allowlist** (`getWebFetchAllowedUrls`, `*`=unrestricted) + a **URL-provenance** rule (URL must have appeared in a prior message/result). The harness mirrors this with the **two-path model** (`src/hostloop/workspace-handler.ts`, binary-verified `G1t`/`U1t`): **Path A** (provenance engaged — `coworkWebFetchViaApi` on) gates on the **exact-URL provenance set** ONLY (seeded from user-turn + tool-result URLs; `src/hostloop/provenance.ts`), with **no** hostname allowlist — but still an `http(s)`-scheme + private-address **SSRF backstop re-checked on every redirect hop** (a manual redirect loop, not `curl -L`) — a miss raises a per-domain approval (`webfetch:<domain>` permission with options `Allow once | Allow all for website | Deny`) routed through the Decider; "Allow all for website" approves the host for the rest of the run (`Run.approvedDomains`, per-run/ephemeral). On Path A, **AFTER** the provenance/approval gate, **`coworkWebFetchDedup`** (gate `1978029737`, on for baselines ≥ `1.22209.3`) applies a per-session **negative-work cache** (`src/hostloop/webfetch-dedup.ts`, binary-verified): a repeat `web_fetch` of the same **normalized** URL (`normalizeUrl`) within the TTL (baseline-sourced, default `900000` ms; cap `100`, FIFO eviction; a hit does NOT refresh recency) returns a marker telling the model to re-use the earlier result, with **no network request and no egress event** — matching production's zero-network dedup. Only successful (HTTP-2xx, trimmed-nonempty) fetches are cached, keyed under both the request URL and the terminal `destination_url`; errors/empty/non-2xx are never cached. Dedup is baseline-gated (an older baseline lacking the flag never dedups) and Path-A-only. **Path B** (gate off) is a direct host fetch gated by the egress domain list via the same `wen()`/`compile()` matcher container egress uses, with `redirect:"manual"` re-checking `U1t` (scheme + private-address SSRF + allowlist) on **every** redirect hop. web_fetch is thus **decoupled from `plan.egressAllow`** on Path A (egress applies to `bash`/Path B only). An unanswered cold miss is fail-closed; scenarios answer via `--answer "webfetch:<domain>=allow"` (with `grant`), `web_fetch.approved_domains`, or an LLM/external terminal. `bash` stays container-egress-sandboxed.
 2. **CLI-spawned `--mcp-config` / `.mcp.json` servers — HONORED in plain cowork mode** (NOT ignored). **Verified:** a valid `--mcp-config` populates `mcp_servers` (`[{name,status:"pending"|"connected"}]`); these run in-sandbox with the env-allowlist `CLAUDE_CODE_MCP_ALLOWLIST_ENV` (`RW8`/`oG8`/`LU5` = {HOME, LOGNAME, PATH, SHELL, TERM, USER}). The harness MAY use this as a convenience injection path.
 3. **The drop is SAFE/HERMETIC-mode-gated, not cowork-gated.** `--mcp-config` is filtered to SDK-only (`ap5()`) **only when** safe mode (`I5()`) or `xB8()` is true, and `xB8()` requires **both** `CLAUDE_CODE_REMOTE` **and** `CLAUDE_CODE_REMOTE_HERMETIC_MODE`. **Verified:** with both set, `mcp_servers:[]`; without them (plain `SESSION_KIND=bg`), the config is honored. The earlier "cowork ignores `--mcp-config`" was a hermetic-session observation over-generalized.
 

package/baselines/desktop-1.22209.3.json

@@ -0,0 +1,392 @@
+{
+  "baselineVersion": 1,
+  "appVersion": "1.22209.3",
+  "agentVersion": "2.1.215",
+  "agentBinary": {
+    "stagedPath": "~/Library/Application Support/Claude/claude-code-vm/2.1.215/claude",
+    "format": "elf-aarch64",
+    "nativeStagedPath": "~/Library/Application Support/Claude/claude-code/2.1.215/claude.app/Contents/MacOS/claude",
+    "sha256": "2b43a3d5b0787217e5d7381fad42c7314292546fe9db9eb8b9b379de90509b30",
+    "shaProvenance": "measured-local",
+    "manifestChecksumMatch": true
+  },
+  "guest": {
+    "os": "linux",
+    "arch": "arm64",
+    "baseImage": "ubuntu:22.04"
+  },
+  "spawn": {
+    "configDirInGuest": "mnt/.claude",
+    "settingSources": [
+      "user"
+    ],
+    "permissionMode": "default",
+    "maxThinkingTokens": 31999,
+    "effortDefault": "medium",
+    "effortByModel": {
+      "claude-haiku-4-5": {
+        "modes": [
+          "extended"
+        ]
+      },
+      "claude-sonnet-4-5": {
+        "modes": [
+          "extended"
+        ]
+      },
+      "claude-sonnet-4-6": {
+        "effortLevels": [
+          "low",
+          "medium",
+          "high",
+          "max"
+        ],
+        "recommended": "low",
+        "modes": [
+          "auto"
+        ]
+      },
+      "claude-opus-4-6": {
+        "effortLevels": [
+          "low",
+          "medium",
+          "high",
+          "max"
+        ],
+        "recommended": "medium",
+        "modes": [
+          "extended"
+        ]
+      },
+      "claude-opus-4-7": {
+        "effortLevels": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "recommended": "xhigh",
+        "modes": [
+          "auto"
+        ]
+      },
+      "claude-opus-4-8": {
+        "effortLevels": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "recommended": "high",
+        "modes": [
+          "auto"
+        ]
+      }
+    },
+    "effortRegexDefault": {
+      "pattern": "^(?:claude-)?(?:fable|mythos)(?:-|$)",
+      "effortLevels": [
+        "low",
+        "medium",
+        "high",
+        "xhigh",
+        "max"
+      ],
+      "recommended": "high",
+      "modes": [
+        "auto"
+      ],
+      "disallowThinkingDisabled": true
+    },
+    "tools": [
+      "Task",
+      "Bash",
+      "Glob",
+      "Grep",
+      "Read",
+      "Edit",
+      "Write",
+      "NotebookEdit",
+      "WebFetch",
+      "TaskCreate",
+      "TaskUpdate",
+      "TaskGet",
+      "TaskList",
+      "TaskStop",
+      "WebSearch",
+      "Skill",
+      "REPL",
+      "JavaScript",
+      "AskUserQuestion",
+      "ToolSearch"
+    ],
+    "allowedTools": [
+      "Task",
+      "Bash",
+      "Glob",
+      "Grep",
+      "Read",
+      "Edit",
+      "Write",
+      "NotebookEdit",
+      "WebFetch",
+      "TaskCreate",
+      "TaskUpdate",
+      "TaskGet",
+      "TaskList",
+      "TaskStop",
+      "WebSearch",
+      "Skill",
+      "REPL",
+      "JavaScript",
+      "ToolSearch"
+    ],
+    "env": {
+      "CLAUDE_CODE_IS_COWORK": "1",
+      "CLAUDE_CODE_ENTRYPOINT": "local-agent",
+      "CLAUDE_CODE_TAGS": "lam_session_type:chat",
+      "CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST": "1",
+      "CLAUDE_CODE_ENABLE_ASK_USER_QUESTION_TOOL": "true",
+      "CLAUDE_CODE_DISABLE_CRON": "1",
+      "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS": "1",
+      "CLAUDE_CODE_DISABLE_AGENTS_FLEET": "1",
+      "CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT": "1",
+      "CLAUDE_CODE_ENABLE_TASKS": "true",
+      "CLAUDE_CODE_DISABLE_TERMINAL_TITLE": "1",
+      "ENABLE_PROMPT_CACHING_1H": "1",
+      "DISABLE_MICROCOMPACT": "1",
+      "MCP_CONNECTION_NONBLOCKING": "true",
+      "API_TIMEOUT_MS": "900000",
+      "CLAUDE_CODE_EMIT_TOOL_USE_SUMMARIES": "",
+      "CLAUDE_CODE_ENABLE_FINE_GRAINED_TOOL_STREAMING": "1",
+      "DISABLE_AUTOUPDATER": "1",
+      "MCP_TOOL_TIMEOUT": "60000",
+      "USE_LOCAL_OAUTH": "",
+      "USE_STAGING_OAUTH": ""
+    },
+    "promptTemplate": "prompts/desktop-1.18286.0/system-prompt-append.md",
+    "subagentAppend": "prompts/desktop-1.15200.0/subagent-append-vm.md",
+    "subagentAppendHostLoop": "prompts/desktop-1.18286.2/subagent-append-hl.md",
+    "$comment": "Binary-verified Desktop->agent spawn contract, re-derived per release. spawn.env is GENERATED by deriveSpawnEnv() in src/sync/cowork-sync.ts (windowed enumeration of the asar env construction + gate/const value resolution); the scalar options, tools/allowedTools, and prompt-asset pointers are sentinel-guarded by checkSpawnContractFacts(). Do not hand-edit spawn.env — re-run sync.",
+    "$comment_handPinned": "Why the NON-env spawn fields stay hand-pinned: each is built in the asar as a non-literal expression (a session-path template, a session-type ternary, a const indirection, or a head+spread+tail array), so the windowed-enumeration generator that derives spawn.env cannot construct their VALUES without a full JS evaluator; instead each value was binary-verified once and is drift-guarded by a checkSpawnContractFacts() sentinel (cowork-sync.ts) that re-asserts the asar-side FACT at every sync. Scope caveat: the sentinels make DESKTOP-side drift loud; they do not validate this committed JSON itself — an erroneous hand-edit here is invisible to them.",
+    "$comment_configDirInGuest": "Hand-pinned: the asar builds it as a per-session path template (/sessions/${id}/mnt/.claude), not a constructable literal. Sentinel S1 pins the template shape.",
+    "$comment_settingSources": "Hand-pinned: sentinel S2 pins the settingSources:[\"user\"] literal.",
+    "$comment_permissionMode": "Hand-pinned: the asar computes it via a session ternary whose chat-session branch resolves to \"default\". Sentinel S3 pins the ternary shape.",
+    "$comment_maxThinkingTokens": "Hand-pinned: the asar reaches the value through const indirection. Sentinel S4 VALUE-pins the resolved const to 31999.",
+    "$comment_effortDefault": "Hand-pinned: sentinel S5 pins the .effort … :\"medium\" default.",
+    "$comment_tools": "Hand-pinned: the asar builds tools[] as head-list + Task-tools spread + session-type tail, not one literal. Sentinels S6 (head), S7 (the TaskCreate…TaskStop spread), S8 (tail-guard after ToolSearch) pin all three parts. As of desktop-1.21459.0 the asar head also carries an INERT `...CLAUDE_DESIGN_TOOLS` spread between Task and Bash that resolves to [] (deployment-gated off on first-party), so the rendered list — and this pin — stay 20 entries; S6b asserts it empty and fails loud if a build ever populates it.",
+    "$comment_allowedTools": "Hand-pinned: same head+spread+tail construction as tools[], minus AskUserQuestion (tools-only by design). Sentinels S9 (head) and S10 (the built-in→mcp__ boundary tail-guard) pin it.",
+    "$comment_promptTemplate": "Hand-pinned pointer to a RECONSTRUCTED asset (see $comment_prompts) — the generator cannot extract prose. Sentinel S15 pins the claude_code preset-append delivery site.",
+    "$comment_subagentAppend": "Hand-pinned pointer to a reconstructed asset (see $comment_prompts). Sentinel S16 pins the per-session appendSubagentSystemPrompt generator call shape.",
+    "$comment_subagentAppendHostLoop": "Hand-pinned pointer to a reconstructed (paraphrased) asset for the HOST-LOOP branch of the per-session sub-agent append (section key subagent_env_hl; selected purely on hostLoopMode). Backfilled only for release families whose hl text is binary-verified byte-identical (1.18286.2+). Sentinel: checkSubagentPromptFacts (two-branch fingerprint + substitution-value proofs). A hostloop run on a baseline lacking this pointer fails loud rather than falling back to the VM text.",
+    "$comment_notSet": "Deliberately NOT set: CLAUDE_CODE_USE_COWORK_PLUGINS (Desktop never sets it; would flip the agent to cowork_settings.json/cowork_plugins — asserted absent by the S17 negative invariant). Enumerated-but-not-pinned keys are enforced by SPAWN_ENV_ALLOWLIST in src/sync/cowork-sync.ts, each with a reason; categories: host-derived (CLAUDE_CONFIG_DIR, TZ, HOST_PLATFORM, OAUTH_TOKEN/BASE_URL/CUSTOM_HEADERS, account UUIDs, WORKSPACE_HOST_PATHS, OTEL), constructed-then-deleted (ANTHROPIC_API_KEY/AUTH_TOKEN via FnA), gate-conditional-off (MCP_CONNECT_TIMEOUT_MS, ENABLE_TOOL_SEARCH, SKIP_PRECOMPACT_LOAD), non-chat/project-session (BRIEF*, PROJECT*), user-settings (SUBAGENT_MODEL, AUTO_COMPACT_WINDOW, ...), and 3p-provider-only branches. The opaque ...g.env/...l session spreads are the known static-extraction blind spot (runtime lane backstop).",
+    "$comment_prompts": "Reconstructed cowork-specific sections, re-paraphrased from asar 1.18286.0 const aui (system prompt; RESTRUCTURED at this release — see the asset header) and 1.15200.0 generator CVr (subagent; verified unchanged in the 1.18286.0 asar, generator Zgn). Not the full base prompt (not cleanly extractable); generic refusal/safety policy elided. Delivered via --append-system-prompt (layered on the agent's built-in base prompt), NOT the initialize handshake; only the subagent append goes over initialize (appendSubagentSystemPrompt), gated on CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT."
+  },
+  "mountLayout": {
+    "sessionRoot": "/sessions/{sessionId}",
+    "cwd": "/sessions/{sessionId}",
+    "mntRoot": "/sessions/{sessionId}/mnt",
+    "mounts": [
+      {
+        "name": "uploads",
+        "mountPath": "uploads",
+        "mode": "r",
+        "purpose": "user-uploaded files (read-only — asar 'ro')"
+      },
+      {
+        "name": "projects",
+        "mountPath": ".projects/{projectId}",
+        "mode": "rw",
+        "purpose": "RESERVED namespace (and the separate UUID project-sync feature) — NOT the work-folder path. From Desktop 1.14271.0 selected work folders mount at mnt/<collision-resolved-basename> (dynamic, derived per session by buildLaunchPlan; see MOUNT_BARE_NAME_MIN_VERSION). This decorative row is not consumed for binding (staged paths come from plan.mounts)."
+      },
+      {
+        "name": "local-plugins",
+        "mountPath": ".local-plugins/marketplaces",
+        "mode": "r",
+        "purpose": "marketplace skills/plugins, runtime-discovered"
+      },
+      {
+        "name": "remote-plugins",
+        "mountPath": ".remote-plugins",
+        "mode": "r",
+        "purpose": "org-remote plugins, runtime-discovered"
+      },
+      {
+        "name": "outputs",
+        "mountPath": "outputs",
+        "mode": "rw",
+        "purpose": "session outputs/artifacts — delete denied by default (asar IX); rwd only when approved"
+      },
+      {
+        "name": "skills",
+        "mountPath": ".claude/skills",
+        "mode": "r",
+        "purpose": "personal/saved skill doc bodies (NOT plugin-bundled skills, which live under local-plugins/remote-plugins above) — real VM confirmed via systemd unit sessions-<name>-mnt-.claude-skills.mount in vm_bundles/claudevm.bundle/rootfs.img. Decorative row like 'projects' above (not consumed for binding — resolveMounts()'s mounts[] is destructured away at every call site); the harness reproduces this via CLAUDE_CONFIG_DIR staging (session.ts skill copy + stage.ts cpSync), not a plan.mounts bind — see hostloop-prompt.ts's asar-verified skills bullet."
+      }
+    ]
+  },
+  "network": {
+    "mode": "gvisor",
+    "allowKind": "allowlist",
+    "allowDomains": [
+      "preview.claude.ai",
+      "downloads.claude.ai",
+      "api.anthropic.com",
+      "a-cdn.anthropic.com",
+      "a-api.anthropic.com",
+      "assets.claude.ai",
+      "sentry.io",
+      "console.anthropic.com",
+      "api-staging.anthropic.com",
+      "www.anthropic.com",
+      "api.claude.ai",
+      "support.anthropic.com",
+      "docs.anthropic.com",
+      "mcp-proxy.anthropic.com",
+      "pivot.claude.ai"
+    ]
+  },
+  "bgEnvStrip": {
+    "knownVars": [
+      "CLAUDE_CODE_OAUTH_TOKEN",
+      "CLAUDE_CODE_SESSION_KIND",
+      "CLAUDE_CODE_SESSION_ID",
+      "CLAUDE_CODE_SESSION_NAME",
+      "CLAUDE_CODE_SESSION_LOG"
+    ]
+  },
+  "$comment": "Platform baseline auto-derived by `cowork-harness sync` from a live Claude Desktop install + app.asar. VOLATILE per-release facts only. Regenerate per release; review the diff. Captured 2026-07-19 on macOS arm64.",
+  "capturedAt": "2026-07-19",
+  "platform": "darwin-arm64",
+  "settings": {
+    "autoMountFolders": {
+      "key": "autoMountFolders",
+      "default": false
+    },
+    "localAgentModeTrustedFolders": {
+      "key": "localAgentModeTrustedFolders",
+      "default": []
+    }
+  },
+  "provenance": {
+    "asarPath": "/Applications/Claude.app/Contents/Resources/app.asar",
+    "asarFingerprint": "a8cf7b198d479a2b",
+    "gates": {
+      "$comment": "Production GrowthBook gate states decoded from ~/Library/Application Support/Claude/fcache (standard interactive Anthropic account, 2026-06-13; binary-verified app.asar 1.12603.1). Pin per release. Behavior-affecting gates the harness models: 1143815894 (loop), 1648655587 (dispatch cap), 1978029737 (web_fetch routing). Telemetry/auth-internal gates omitted. Also pinned: 2614807392 (skeletonHome), 123929380 (autoMemoryStandardSessions), 1696890383 (memoryGuidelinesEnv), 2860753854 (memoryExtraGuidelines) — dormant drift-sentinels for dark-launched features (host-fs skeleton, auto-memory) the harness deliberately models as OFF (or, for memoryExtraGuidelines, as inert-default: on in production but its served value equals the hardcoded default); pinned so a production flip surfaces as a sync diff instead of silent drift.",
+      "emitToolUseSummaries:66187241": {
+        "on": false,
+        "source": "defaultValue",
+        "value": false
+      },
+      "autoMemoryStandardSessions:123929380": {
+        "on": false,
+        "source": "defaultValue",
+        "value": false
+      },
+      "subagentPromptServerOverride:124685897": {
+        "on": false,
+        "source": "defaultValue",
+        "value": false
+      },
+      "mcpConnectionNonblockingOff:434204418": {
+        "on": false,
+        "source": "defaultValue",
+        "value": false
+      },
+      "bridgeSdkTransport:583857784": {
+        "on": true,
+        "source": "force",
+        "value": true,
+        "note": "— Cowork uses the SDK-based transport (control protocol), confirming the harness's sdkMcpServers/mcp_message path is the production transport."
+      },
+      "fineGrainedToolStreaming:714014285": {
+        "on": true,
+        "source": "force",
+        "value": true
+      },
+      "enableToolSearchAuto:1129419822": {
+        "on": false,
+        "source": "absent"
+      },
+      "hostLoop:1143815894": {
+        "on": true,
+        "source": "force",
+        "value": true
+      },
+      "scheduledTaskToolsApprovableByAutoMode:1447478638": {
+        "on": false,
+        "source": "absent"
+      },
+      "scheduledTaskSessionLimiter:1648655587": {
+        "on": true,
+        "source": "force",
+        "value": {
+          "global": 3,
+          "perTask": 1
+        },
+        "note": "SCHEDULED-TASK (cron) session limiter — NOT an in-conversation Task-tool cap (binary-verified 2026-07-04, asar 1.18286.0 class L9t [ScheduledTasks]). perTask=1: <=1 concurrent session PER SCHEDULED TASK; global=3: <=3 concurrent scheduled-task sessions globally (+_pendingTaskDispatches). Host-side SKIP (recordSkipAndEmit/PerTaskLimit|GlobalLimit — NOT queue/deny). Cowork imposes no cap on Task-tool sub-agent fan-out; the harness has no scheduled-task scheduler, so this gate has no applicable surface — pinned as a sync drift-sentinel only."
+      },
+      "memoryGuidelinesEnv:1696890383": {
+        "on": false,
+        "source": "defaultValue",
+        "value": false
+      },
+      "oauthScopesEnv:1936081873": {
+        "on": true,
+        "source": "force",
+        "value": true
+      },
+      "coworkRuntimeConfig:1978029737": {
+        "on": true,
+        "source": "experiment",
+        "value": {
+          "coworkNativeFilePreview": true,
+          "coworkWebFetchDedup": true,
+          "coworkWebFetchDedupMaxEntries": 100,
+          "coworkWebFetchDedupTtlMs": 900000,
+          "coworkWebFetchPrompt": true,
+          "coworkWebFetchViaApi": true,
+          "pluginsFullSyncStalenessMs": 0,
+          "sessionsBridgePollBlockMs": 30,
+          "workspaceBashWaitLonger": true
+        },
+        "note": "coworkWebFetchViaApi=true coworkWebFetchPrompt=true workspaceBashWaitLonger=true sessionsBridgePollBlockMs=30 — web_fetch is host/API-routed (POST /api/organizations/<org>/cowork/web_fetch), NOT container egress; gated by a separate web-fetch hostname allowlist + URL provenance."
+      },
+      "cliPlugin:2307090146": {
+        "on": false,
+        "source": "defaultValue",
+        "value": false,
+        "note": "— the CLI-plugin credential broker is dark-launched off for standard interactive accounts (Ch23/L106)."
+      },
+      "pluginSyncSparkplug:2340532315": {
+        "on": true,
+        "source": "force",
+        "value": true,
+        "note": "— startup syncPlugins(); plugins load via --plugin-dir (registry inert in-VM)."
+      },
+      "skeletonHome:2614807392": {
+        "on": false,
+        "source": "absent"
+      },
+      "memoryExtraGuidelines:2860753854": {
+        "on": true,
+        "source": "defaultValue",
+        "value": "## Sensitive personal information\n\nDo not save the following to memory unless the user explicitly asks you to remember it:\n\n- Protected attributes: race, ethnicity, national origin, religion, age, sex, sexual orientation, gender identity, immigration status, disability, serious illness, union membership\n- Government identifiers: Social Security numbers, driver's license numbers, passport numbers, government ID numbers\n- Financial account details: credit card numbers, bank account numbers\n- Health information: medical conditions, diagnoses, lab results, mental health details, therapy or counseling\n- Home or personal mailing addresses (work addresses are fine)\n- Account passwords, secret tokens, or secret keys\n\nIf any of the above appears in conversation context, complete the task but do not persist it to a memory file. If the user explicitly says \"remember my address is X\", saving it is acceptable — they've given consent."
+      },
+      "skipPrecompactLoad:4153934152": {
+        "on": false,
+        "source": "defaultValue",
+        "value": false
+      },
+      "autoModeOverridesAlwaysAllow:4200321681": {
+        "on": false,
+        "source": "absent"
+      }
+    },
+    "eipcChannelUuid": "4f426349-8d6f-45f3-ae22-280fef323564",
+    "$comment": "eipcChannelUuid is per-build; recorded for provenance only — the harness does not use Desktop IPC."
+  },
+  "requireFullVmSandbox": null
+}

package/dist/hostloop/webfetch-dedup.js

@@ -0,0 +1,50 @@
+/**
+ * `coworkWebFetchDedup` — a per-Cowork-session NEGATIVE-WORK cache for hostloop `web_fetch` (binary-verified
+ * port of Claude Desktop 1.22209.3's `Ne` write/evict + the lookup in `.vite/build/index.chunk-CYQPQGee.js`).
+ *
+ * It stores only `{ts, size, hits}` (never content). A repeat fetch of the same normalized URL within the
+ * TTL is a HIT: real Cowork skips the network entirely and returns a marker telling the model to re-use the
+ * earlier result. See the workspace-handler seam for the marker + the no-egress semantics.
+ *
+ * Faithful details (do NOT "improve"): FIFO (insertion-order) eviction — NOT LRU; a hit does NOT refresh the
+ * entry's `ts`/recency (`hits` is incremented but is behaviorally inert), so an entry hard-expires exactly
+ * `ttlMs` after the fetch that created it. Hit boundary is INCLUSIVE (`now - ts <= ttlMs`); the write-time
+ * TTL sweep is STRICT (`now - ts > ttlMs`). Clock is injected (`nowMs`) — no `Date.now()` here, so tests
+ * pin the boundaries deterministically.
+ */
+export function makeWebFetchDedupCache(opts) {
+    const { ttlMs, maxEntries } = opts;
+    const map = new Map();
+    return {
+        lookup(normUrl, nowMs) {
+            const e = map.get(normUrl);
+            if (e === undefined)
+                return null;
+            if (nowMs - e.ts <= ttlMs) {
+                e.hits += 1; // structural parity only — does NOT refresh recency/ts (hard-expiry stands)
+                return { ageS: Math.round((nowMs - e.ts) / 1000) };
+            }
+            map.delete(normUrl); // expired → delete + miss
+            return null;
+        },
+        record(normUrl, size, nowMs) {
+            // 1) TTL sweep (STRICT >), deleting entries older than the window. Deleting during Map iteration is safe.
+            for (const [k, v] of map)
+                if (nowMs - v.ts > ttlMs)
+                    map.delete(k);
+            // 2) delete-then-set moves the key to the tail so recency == insertion/re-insertion order (FIFO).
+            map.delete(normUrl);
+            map.set(normUrl, { ts: nowMs, size, hits: 0 });
+            // 3) FIFO-evict the oldest-inserted entries until at the cap.
+            while (map.size > maxEntries) {
+                const oldest = map.keys().next().value;
+                if (oldest === undefined)
+                    break;
+                map.delete(oldest);
+            }
+        },
+        ttlSeconds() {
+            return Math.round(ttlMs / 1000);
+        },
+    };
+}

package/dist/hostloop/workspace-handler.js

@@ -6,6 +6,7 @@ import http from "node:http";
 import https from "node:https";
 import { lookup } from "node:dns/promises";
 import { compile } from "../egress/proxy.js";
+import { normalizeUrl } from "./provenance.js";
 const pexec = promisify(execFile);
 const MAX_REDIRECTS = 5; // Cowork's RZe redirect cap (Path B re-checks U1t per hop)
 /** Is a dotted-quad's four octets in a loopback/this-host/private/link-local range? */
@@ -227,7 +228,7 @@ const defaultRawFetch = async (url, pinnedAddresses) => {
 const BASH_DESC = "Run a shell command in the session's isolated Linux workspace. Your connected folders are mounted under {{mnt}}/ — the Shell access section of your system prompt lists the exact path for each folder. Each bash call is independent (no cwd/env carryover). Use absolute paths.";
 const FETCH_DESC = "Fetch a URL from the session network (subject to the egress allowlist). web_fetch can only retrieve URLs that appeared in a user message or a prior result.";
 export function makeWorkspaceHandler(opts) {
-    const { containerName, vmMnt, runner = "docker", webFetchAllow = ["*"], onEgress, onInfraError, provenanceRef, rawFetch = defaultRawFetch, resolve = defaultResolver, execCwd = vmMnt, } = opts;
+    const { containerName, vmMnt, runner = "docker", webFetchAllow = ["*"], onEgress, onInfraError, provenanceRef, dedup, rawFetch = defaultRawFetch, resolve = defaultResolver, execCwd = vmMnt, } = opts;
     // Per-handler (per-spawn) latch for the provenance-unenforced warning — was module-level, which
     // silenced the gap after the first run in a long-lived process. Each fresh handler warns once.
     const provWarned = { value: false };
@@ -264,7 +265,7 @@ export function makeWorkspaceHandler(opts) {
                 };
             if (name === "web_fetch")
                 return {
-                    result: await fetchViaHost(String(a.url ?? ""), webFetchAllow, onEgress, provenanceRef?.current, provWarned, rawFetch, resolve),
+                    result: await fetchViaHost(String(a.url ?? ""), webFetchAllow, onEgress, provenanceRef?.current, provWarned, rawFetch, resolve, dedup),
                 };
             return { error: { code: -32602, message: `unknown tool: ${name}` } };
         }
@@ -277,6 +278,13 @@ function textResult(text, isError = false) {
         r.isError = true;
     return r;
 }
+/** The `coworkWebFetchDedup` HIT marker — verbatim port of Claude Desktop 1.22209.3 (asar chunk
+ *  `index.chunk-CYQPQGee.js`). `url` is the raw model-sent argument; `ageS`/`ttlS` are already Math.round-ed. */
+function dedupMarker(url, ageS, ttlS) {
+    return (`Already fetched ${url} ${ageS}s ago in this session. Re-use the content from that earlier web_fetch ` +
+        `result instead of re-reading it. Fetch again only if the page is likely to have changed ` +
+        `(deduplicated for up to ${ttlS}s).`);
+}
 // Clamp a model-requested bash timeout into a sane range. Guards NaN/negative/missing → the
 // 120s default; floors at 1s and caps at 10min. This is INFERRED-parity for the bash tool — Cowork's
 // binary-verified timeout_ms honoring is for web_fetch, not bash — but the bash inputSchema advertises
@@ -368,7 +376,11 @@ function schemePrivateGate(u) {
  * protection that `curl -L` lacked. Emits one egress allow/deny on the terminal decision. Shared by
  * both web_fetch paths; the gate is the only difference (Path A: scheme+private; Path B: full u1t).
  */
-async function followWithRedirects(startUrl, rawFetch, gate, resolve, onEgress) {
+async function followWithRedirects(startUrl, rawFetch, gate, resolve, onEgress, 
+// coworkWebFetchDedup record hook — called ONLY on a terminal HTTP-2xx, trimmed-nonempty response, with
+// the post-redirect terminal URL (`cur.href` = destination_url) + the untrimmed emitted-text length. Not
+// called on errors, non-2xx bodies, empty/whitespace bodies, or redirect hops (so those are never cached).
+onSuccess) {
     let cur;
     try {
         cur = new URL(startUrl);
@@ -442,16 +454,21 @@ async function followWithRedirects(startUrl, rawFetch, gate, resolve, onEgress)
             }
             const decoder = new TextDecoder();
             const text = chunks.map((c) => decoder.decode(c, { stream: true })).join("") + decoder.decode();
+            // dedup record: 2xx + trimmed-nonempty only; untrimmed emitted length (pre-`[truncated]` suffix).
+            if (resp.status >= 200 && resp.status < 300 && text.trim().length > 0)
+                onSuccess?.(cur.href, text.length);
             return textResult(truncated ? text + "\n[truncated]" : text);
         }
         const raw = await resp.text();
         const sliced = raw.slice(0, LIMIT);
         const wasTruncated = resp.truncated || sliced.length < raw.length;
+        if (resp.status >= 200 && resp.status < 300 && sliced.trim().length > 0)
+            onSuccess?.(cur.href, sliced.length);
         return textResult(wasTruncated ? sliced + "\n[truncated]" : sliced);
     }
     return textResult(`web_fetch failed: too many redirects (> ${MAX_REDIRECTS}).`, true);
 }
-async function fetchViaHost(url, allow, onEgress, prov, warned, rawFetch = defaultRawFetch, resolve = defaultResolver) {
+async function fetchViaHost(url, allow, onEgress, prov, warned, rawFetch = defaultRawFetch, resolve = defaultResolver, dedup) {
     if (!url)
         return textResult("error: missing 'url'", true);
     let host;
@@ -488,6 +505,27 @@ async function fetchViaHost(url, allow, onEgress, prov, warned, rawFetch = defau
         // Provenance satisfied. Cowork fetches server-side (host API); the hostname allowlist does NOT apply
         // here (decoupled from egress). But scheme + private-address ARE enforced per
         // hop: follow redirects manually instead of `curl -L`, blocking file:// / SSRF targets.
+        //
+        // coworkWebFetchDedup (host-API path only): AFTER the provenance gate, a repeat of the same normalized
+        // URL within the TTL returns a marker with NO network request and NO egress event — matching
+        // production's zero-network dedup. On a miss, record the request key + the terminal destination_url on
+        // a 2xx, non-empty success (the guards live in followWithRedirects's onSuccess call).
+        if (dedup) {
+            const key = normalizeUrl(url);
+            if (key) {
+                const cache = dedup;
+                const hit = cache.lookup(key, Date.now());
+                if (hit)
+                    return textResult(dedupMarker(url, hit.ageS, cache.ttlSeconds()), false);
+                const onSuccess = (terminalUrl, size) => {
+                    cache.record(key, size, Date.now());
+                    const dk = normalizeUrl(terminalUrl); // terminal destination_url key
+                    if (dk && dk !== key)
+                        cache.record(dk, size, Date.now());
+                };
+                return followWithRedirects(url, rawFetch, schemePrivateGate, resolve, onEgress, onSuccess);
+            }
+        }
         return followWithRedirects(url, rawFetch, schemePrivateGate, resolve, onEgress);
     }
     // PATH B (provenance not enforced — coworkWebFetchViaApi off). Faithful port of U1t re-checked on EVERY

package/dist/loop-decision.js

@@ -28,6 +28,36 @@ export function readGateFlag(baseline, id, flag) {
     }
     return false;
 }
+/**
+ * Numeric sibling of `readGateFlag` (e.g. `coworkWebFetchDedupTtlMs`). Same prefixed-then-bare key lookup;
+ * reads the number from the structured `value[flag]` (or the bare-entry `[flag]`), else parses `flag=<n>`
+ * from the committed prose-string shape. Returns `undefined` when absent — the caller supplies the default
+ * (so an older baseline that carries the flag without the numbers still gets the binary default).
+ */
+export function readGateNumber(baseline, id, flag) {
+    const gates = baseline.provenance?.gates ?? {};
+    let entry = gates[id];
+    if (entry === undefined) {
+        for (const k of Object.keys(gates)) {
+            if (k.endsWith(":" + id)) {
+                entry = gates[k];
+                break;
+            }
+        }
+    }
+    if (entry == null)
+        return undefined;
+    if (typeof entry === "string") {
+        const m = new RegExp(`\\b${flag}=(\\d+)\\b`).exec(entry);
+        return m ? Number(m[1]) : undefined;
+    }
+    if (typeof entry === "object") {
+        const v = entry.value;
+        const raw = v && typeof v === "object" ? v[flag] : entry[flag];
+        return typeof raw === "number" ? raw : undefined;
+    }
+    return undefined;
+}
 export function decideLoop(inputs) {
     if (inputs.requireFullVmSandbox === true)
         return "vm"; // HeA()

package/dist/run/chat.js

@@ -23,7 +23,8 @@ import { writeTrace, scrubRawRunLogs } from "./execute.js";
 import { appendIndexRow, indexRowFromResult } from "./run-index.js";
 import { scrub, collectSecrets } from "../secrets.js";
 import { Chain, ScriptedDecider, PermissionDefaultDecider, PromptDecider } from "../decide/decider.js";
-import { readGateFlag } from "../loop-decision.js";
+import { readGateFlag, readGateNumber } from "../loop-decision.js";
+import { makeWebFetchDedupCache } from "../hostloop/webfetch-dedup.js";
 import { checkHostLoopWriteConsent, logHostWriteNotice } from "../hostloop/safety.js";
 import { PATH_GATE_TOOL_NAMES } from "../hostloop/pretooluse-path-hook.js";
 import { makeHostLoopCanUseToolGate } from "../hostloop/canusetool-gate.js";
@@ -280,6 +281,13 @@ export async function cmdChat(args) {
     const viaApiOn = readGateFlag(baseline, "1978029737", "coworkWebFetchViaApi");
     const promptGateOn = readGateFlag(baseline, "1978029737", "coworkWebFetchPrompt");
     const provenanceRef = {};
+    // coworkWebFetchDedup — per-session cache; kept for the chat REPL's lifetime (= one Cowork session).
+    const dedup = viaApiOn && readGateFlag(baseline, "1978029737", "coworkWebFetchDedup")
+        ? makeWebFetchDedupCache({
+            ttlMs: readGateNumber(baseline, "1978029737", "coworkWebFetchDedupTtlMs") ?? 900000,
+            maxEntries: readGateNumber(baseline, "1978029737", "coworkWebFetchDedupMaxEntries") ?? 100,
+        })
+        : undefined;
     // ONE readline interface on process.stdin, shared by the turn reader (ttyTurns) and the gate
     // prompter (PromptDecider). Two interfaces would race for the same stdin → undefined input routing.
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
@@ -326,6 +334,7 @@ export async function cmdChat(args) {
                 dockerNetwork: sidecar.network,
                 provenanceRef,
                 webFetchViaApi: viaApiOn,
+                dedup,
             });
             child = hl.child;
             containerName = hl.containerName;

package/dist/run/diff.js

@@ -14,6 +14,8 @@ const MASKS = [
     { re: /\blocal_[a-z0-9]+/gi, token: "<SESSION>" },
     { re: /\bsess-[A-Za-z0-9-]+/g, token: "<SESSION>" },
     { re: /\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z?\b/g, token: "<TIMESTAMP>" },
+    // coworkWebFetchDedup marker's "…{N}s ago…" — a live-run age that varies run-to-run (advisory diff view only).
+    { re: /\b\d+s ago\b/g, token: "<AGE>" },
 ];
 /** Replaces every volatile-but-not-meaningful span (tool-use ids, UUIDs, session-dir markers,
  *  ISO-8601 timestamps, host paths) with a stable placeholder token, so two runs of the SAME scenario

package/dist/run/execute.js

@@ -27,7 +27,8 @@ import { spawnMicroVm, snapshotMicroVmWorkspace } from "../runtime/microvm.js";
 import { probeImageOmitted, probeMicrovmOmitted, detectCapabilityUse, capabilityPreflightDecision, CAPABILITY_FAMILIES, } from "../runtime/image-capabilities.js";
 import { instanceName, VM_WORK_HOST } from "../runtime/lima.js";
 import { ResourceSampler, makeSampleOnce, foldResources, resolveIntervalMs } from "../runtime/resource-sampler.js";
-import { decideLoopFromBaseline, readGateFlag } from "../loop-decision.js";
+import { decideLoopFromBaseline, readGateFlag, readGateNumber } from "../loop-decision.js";
+import { makeWebFetchDedupCache } from "../hostloop/webfetch-dedup.js";
 import { startEgressSidecar, registerCleanup } from "../egress/sidecar.js";
 import { startEgressProxy } from "../egress/proxy.js";
 import { evaluate, hostMatches, budgetFields, runSemanticJudges } from "../assert.js";
@@ -414,6 +415,14 @@ export async function executeScenario(scenario, opts = {}) {
     const viaApiOn = readGateFlag(baseline, "1978029737", "coworkWebFetchViaApi");
     const promptGateOn = readGateFlag(baseline, "1978029737", "coworkWebFetchPrompt");
     const provenanceRef = {};
+    // coworkWebFetchDedup (host-API path only): a per-session negative-work cache. Built only when the gate is
+    // on (an older baseline that lacks it ⇒ undefined ⇒ no behavior change); 100/900000 come from the baseline.
+    const dedup = viaApiOn && readGateFlag(baseline, "1978029737", "coworkWebFetchDedup")
+        ? makeWebFetchDedupCache({
+            ttlMs: readGateNumber(baseline, "1978029737", "coworkWebFetchDedupTtlMs") ?? 900000,
+            maxEntries: readGateNumber(baseline, "1978029737", "coworkWebFetchDedupMaxEntries") ?? 100,
+        })
+        : undefined;
     // Pre-flight: if the skill DECLARES required capabilities and the image provably omits one, FAIL FAST here
     // — before any paid agent run — instead of burning ~12 min to reach a verdict the post-run guard already
     // knows. The author can opt out with `allow_missing_capability: true` (the fallback is equivalent), which
@@ -524,6 +533,7 @@ export async function executeScenario(scenario, opts = {}) {
                     dockerNetwork: sidecar?.network,
                     provenanceRef,
                     webFetchViaApi: viaApiOn,
+                    dedup,
                 });
                 child = hl.child;
                 sdkMcp = hl.sdkMcp;

package/dist/runtime/hostloop.js

@@ -261,6 +261,7 @@ export function spawnHostLoop(_scenario, baseline, plan, outDir, sessionId, opts
         onEgress: (e) => hostEgress.push(e),
         onInfraError: logInfra,
         provenanceRef: opts.provenanceRef,
+        dedup: opts.dedup,
         execCwd,
     });
     const sdkMcp = { servers: ["workspace"], handle: workspaceHandle };

package/docs/maintenance.md

@@ -71,7 +71,7 @@ Another runtime knob in the same family: `COWORK_HARNESS_RESOURCE_INTERVAL_MS` s
 Old staged binaries are re-downloadable from Anthropic's own release channel. For the **container/microvm** tiers the harness needs the **Linux/arm64 ELF**, so download it directly and point the resolver at it:
 
 ```bash
-V=2.1.209   # your baseline's agentVersion (read it from baselines/desktop-<latest>.json)
+V=2.1.215   # your baseline's agentVersion (read it from baselines/desktop-<latest>.json)
 curl -fSL "https://downloads.claude.ai/claude-code-releases/$V/linux-arm64/claude" -o "claude-$V"
 # verify against the committed baseline sha256 (== manifest platforms["linux-arm64"].checksum):
 shasum -a 256 "claude-$V"

package/examples/replays/README.md

@@ -16,7 +16,7 @@ DOES exercise a real gate exchange, see `example-multiselect-gate.cassette.json`
 
 Run it with:
 
-> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@>=1.3.0"`. (`replay` itself needs nothing else — no token, no Docker.)
+> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@>=1.4.0"`. (`replay` itself needs nothing else — no token, no Docker.)
 
 ```sh
 cowork-harness replay examples/replays/example-pdf-skill.cassette.json

package/examples/replays/example-multiselect-gate.cassette.json

@@ -100,7 +100,7 @@
   "preRunHashes": {},
   "scenarioSource": "../../e2e/scenarios/smoke-multiselect.yaml",
   "fingerprint": {
-    "baseline": "1.21459.0"
+    "baseline": "1.22209.3"
   },
   "timeline": [
     {

package/examples/replays/example-pdf-skill.cassette.json

@@ -111,7 +111,7 @@
   },
   "scenarioSource": "../scenarios/example-pdf-skill.yaml",
   "fingerprint": {
-    "baseline": "1.21459.0",
+    "baseline": "1.22209.3",
     "skillHash": "b760ea90682777367fbd44d866ea66d316452da1abb18bf8cb61f1cec8e67806",
     "contentSig": "ddf68cf6d74e0599729589f8be4f0a9eec440093c99c1060cd6f47dd671a0dfd",
     "skillSources": [

package/examples/replays/hostloop-computer-links.cassette.json

@@ -78,7 +78,7 @@
   "preRunHashes": {},
   "scenarioSource": "../scenarios/hostloop-computer-links.yaml",
   "fingerprint": {
-    "baseline": "1.21459.0"
+    "baseline": "1.22209.3"
   },
   "timeline": [
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-harness",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Scriptable, CI-friendly harness for Claude Cowork's runtime contract for testing skills across scenarios — same agent, mounts, egress allowlist, permission protocol, and sandbox limitations.",
   "license": "MIT",
   "type": "module",