harnery 0.40.0 → 0.42.0

package/src/commands/tunnel.ts

@@ -4,12 +4,20 @@ import { resolve } from "node:path";
 import type { Command } from "commander";
 import type { EmitContext, HarneryProgramContext } from "../commander.ts";
 
+import { resolveCoordRoot } from "../core/agents/coord-client.ts";
 import { resolveBinName } from "../core/config.ts";
+import {
+  tryRegisterServer,
+  tunnelServerId,
+  tunnelServerInput,
+  unregisterServer,
+} from "../core/servers/index.ts";
 import {
   processLogDestination,
   runRotatingProcessSync,
   spawnRotatingProcess,
 } from "../core/storage/process-log.ts";
+import { ALLOW_PATHS_ENV, normalizeAllowPaths } from "../lib/tunnel/path-scope.ts";
 import {
   clearState,
   DEFAULT_INSTANCE,
@@ -35,6 +43,8 @@ import {
  * upstream. Cloudflare quick tunnels add an IP allowlist at the gate via the
  * Cloudflare-set `CF-Connecting-IP` header; Tailscale Serve/Funnel exposes the
  * same gate through tailscaled, with Tailscale owning the access boundary.
+ * Every provider also passes through a path scope: `up` requires at least one
+ * `--allow-path <prefix>`, and the gate refuses any request outside it.
  *
  * State + config persisted under `.cache/tunnel/`. cloudflared auto-installs
  * to ~/.local/bin/ on first run (Linux only; macOS users `brew install`);
@@ -55,6 +65,7 @@ interface UpOpts {
   visibility?: string;
   path?: string;
   httpsPort?: string;
+  allowPath?: string[];
 }
 
 interface DownOpts {
@@ -165,6 +176,46 @@ function resolveHttpsPort(raw: string | undefined): number {
   return port;
 }
 
+/**
+ * The path scope for `up`. At least one prefix is required: a tunnel forwards
+ * to a whole local app, and publishing all of it has to be a stated choice
+ * (`--allow-path /`), never the result of leaving a flag off.
+ */
+function resolveAllowPaths(raw: string[] | undefined): string[] {
+  let paths: string[];
+  try {
+    paths = normalizeAllowPaths(raw ?? []);
+  } catch (error) {
+    emit.error({
+      code: "tunnel_path_scope_invalid",
+      message: error instanceof Error ? error.message : String(error),
+    });
+    process.exit(1);
+  }
+  if (paths.length === 0) {
+    emit.error({
+      code: "tunnel_path_scope_empty",
+      message:
+        "No path scope; refusing to start. Name what the tunnel shares with --allow-path <prefix> " +
+        "(repeatable), or pass --allow-path / to publish the whole upstream.",
+    });
+    process.exit(1);
+  }
+  return paths;
+}
+
+function samePaths(a: readonly string[], b: readonly string[]): boolean {
+  return a.length === b.length && [...a].sort().join("\n") === [...b].sort().join("\n");
+}
+
+function formatPaths(paths: readonly string[]): string {
+  return paths.length === 0 ? "(none: every path refused)" : paths.join(", ");
+}
+
+function collectPath(value: string, previous: string[]): string[] {
+  return [...previous, value];
+}
+
 function gateScriptPath(): string {
   return resolve(import.meta.dirname, "..", "lib", "tunnel", "gate.ts");
 }
@@ -444,6 +495,7 @@ interface GateSpawnOpts {
   vhost: string;
   provider: TunnelProvider;
   allowedIps: string[];
+  allowPaths: string[];
   gateLogPath: string;
 }
 
@@ -470,6 +522,7 @@ function spawnGate(o: GateSpawnOpts): ChildProcess {
       HARNERY_TUNNEL_TARGET: o.target,
       HARNERY_TUNNEL_VHOST: o.vhost,
       HARNERY_TUNNEL_PORT: String(o.gatePort),
+      [ALLOW_PATHS_ENV]: o.allowPaths.join(","),
     },
   });
   gateProc.unref();
@@ -498,6 +551,7 @@ async function up(opts: UpOpts): Promise<void> {
     provider === "tailscale" ? resolveTailscalePath(opts.path, name) : undefined;
   const tailscaleHttpsPort =
     provider === "tailscale" ? resolveHttpsPort(opts.httpsPort) : undefined;
+  const allowPaths = resolveAllowPaths(opts.allowPath);
 
   const existing = readState(name);
   if (existing && tunnelIsAlive(existing)) {
@@ -508,9 +562,19 @@ async function up(opts: UpOpts): Promise<void> {
       });
       process.exit(1);
     }
+    if (!samePaths(existing.allow_paths, allowPaths)) {
+      emit.error({
+        code: "tunnel_instance_in_use",
+        message:
+          `Tunnel [${name}] is already up sharing ${formatPaths(existing.allow_paths)}. ` +
+          `Stop it before starting it with ${formatPaths(allowPaths)}.`,
+      });
+      process.exit(1);
+    }
     emit.text(`Already up [${name}]: ${existing.url}\n`);
     emit.text(`  Provider:   ${existing.provider}\n`);
     emit.text(`  Forwarding: ${existing.target} (Host: ${existing.vhost})\n`);
+    emit.text(`  Paths:      ${formatPaths(existing.allow_paths)}\n`);
     return;
   }
   if (existing) downOne(name, new Set());
@@ -552,6 +616,7 @@ async function up(opts: UpOpts): Promise<void> {
     vhost,
     provider,
     allowedIps: cfg.allowed_ips,
+    allowPaths,
     gateLogPath,
   });
 
@@ -630,11 +695,13 @@ async function up(opts: UpOpts): Promise<void> {
     target,
     vhost,
     gate_port: gatePort,
+    allow_paths: allowPaths,
     tailscale_mode: tailscaleMode,
     tailscale_path: tailscalePath,
     tailscale_https_port: tailscaleHttpsPort,
   };
   writeState(state);
+  recordTunnelServer(state);
 
   const stopHint =
     name === DEFAULT_INSTANCE ? "harn tunnel down" : `harn tunnel down --name ${name}`;
@@ -642,6 +709,7 @@ async function up(opts: UpOpts): Promise<void> {
   emit.text(`  Provider: ${provider}${tailscaleMode ? ` (${tailscaleMode})` : ""}\n`);
   emit.text(`  URL: ${url}\n\n`);
   emit.text(`  Forwarding: ${target} (Host: ${vhost})\n`);
+  emit.text(`  Paths: ${formatPaths(allowPaths)}\n`);
   emit.text(`  Gate port: ${gatePort}\n`);
   if (provider === "cloudflare") {
     emit.text(`  Allowed IPs: ${cfg.allowed_ips.join(", ")}\n\n`);
@@ -662,6 +730,16 @@ async function up(opts: UpOpts): Promise<void> {
   emit.text("  Status: harn tunnel status\n");
 }
 
+/** The server registry lists tunnels beside every other local server. */
+function registryRoot(): string {
+  return resolveCoordRoot() ?? process.cwd();
+}
+
+function recordTunnelServer(state: TunnelState): void {
+  const coordRoot = registryRoot();
+  tryRegisterServer(tunnelServerInput(state, coordRoot), { coordRoot });
+}
+
 /** Tear down a single instance by name. Returns the number of processes killed. */
 function downOne(name: string, killed: Set<number>): number {
   const before = killed.size;
@@ -684,6 +762,7 @@ function downOne(name: string, killed: Set<number>): number {
   // lost; they'd otherwise squat on the port and break the next `up`.
   sweepStrays(state?.gate_port ?? DEFAULT_GATE_PORT, killed);
   clearState(name);
+  unregisterServer(tunnelServerId(name), { coordRoot: registryRoot() });
   return killed.size - before;
 }
 
@@ -771,6 +850,15 @@ export async function reloadOne(state: TunnelState): Promise<{ ok: boolean; mess
   if (!bunAvailable()) {
     return { ok: false, message: `[${name}] bun is not on PATH, so the gate can't be respawned.` };
   }
+  if (state.allow_paths.length === 0) {
+    return {
+      ok: false,
+      message:
+        `[${name}] has no recorded path scope, so a reloaded gate would refuse every request. ` +
+        `Restart it with \`${bin} tunnel down --name ${name}\` and ` +
+        `\`${bin} tunnel up --name ${name} --allow-path <prefix>\`.`,
+    };
+  }
 
   // Kill ONLY the gate. sweepStrays() is deliberately avoided here: it also
   // matches `--url http://localhost:<port>`, which is the provider process we
@@ -803,6 +891,7 @@ export async function reloadOne(state: TunnelState): Promise<{ ok: boolean; mess
     vhost: state.vhost,
     provider: state.provider,
     allowedIps: cfg.allowed_ips,
+    allowPaths: state.allow_paths,
     gateLogPath: tunnelLogDestinations(name, state.provider).gate,
   });
 
@@ -822,6 +911,7 @@ export async function reloadOne(state: TunnelState): Promise<{ ok: boolean; mess
   }
 
   writeState({ ...state, gate_pid: pid });
+  recordTunnelServer({ ...state, gate_pid: pid });
   const allowNote =
     state.provider === "cloudflare" ? ` Allowlist: ${cfg.allowed_ips.length} IP(s).` : "";
   return { ok: true, message: `[${name}] gate reloaded, URL unchanged: ${state.url}.${allowNote}` };
@@ -898,6 +988,7 @@ function statusDetail(state: TunnelState): void {
   );
   emit.text(`  URL:         ${state.url}\n`);
   emit.text(`  Forwarding:  ${state.target} (Host: ${state.vhost})\n`);
+  emit.text(`  Paths:       ${formatPaths(state.allow_paths)}\n`);
   emit.text(`  Gate port:   ${state.gate_port}\n`);
   if (state.provider === "cloudflare") {
     emit.text(`  Allowed IPs: ${cfg.allowed_ips.join(", ")}\n`);
@@ -941,6 +1032,7 @@ function status(opts: StatusOpts): void {
     state: instanceState(s),
     url: s.url,
     fwd: `${s.target} (${s.vhost})`,
+    paths: formatPaths(s.allow_paths),
     port: String(s.gate_port),
     up: fmtUptime(s.started_at),
   }));
@@ -950,15 +1042,16 @@ function status(opts: StatusOpts): void {
     state: 5,
     url: Math.max(3, ...rows.map((r) => r.url.length)),
     fwd: Math.max(10, ...rows.map((r) => r.fwd.length)),
+    paths: Math.max(5, ...rows.map((r) => r.paths.length)),
     port: 4,
   };
   const pad = (s: string, n: number) => s.padEnd(n);
   emit.text(
-    `${pad("NAME", w.name)}  ${pad("PROVIDER", w.provider)}  ${pad("STATE", w.state)}  ${pad("URL", w.url)}  ${pad("FORWARDING", w.fwd)}  ${pad("PORT", w.port)}  UPTIME\n`,
+    `${pad("NAME", w.name)}  ${pad("PROVIDER", w.provider)}  ${pad("STATE", w.state)}  ${pad("URL", w.url)}  ${pad("FORWARDING", w.fwd)}  ${pad("PATHS", w.paths)}  ${pad("PORT", w.port)}  UPTIME\n`,
   );
   for (const r of rows) {
     emit.text(
-      `${pad(r.name, w.name)}  ${pad(r.provider, w.provider)}  ${pad(r.state, w.state)}  ${pad(r.url, w.url)}  ${pad(r.fwd, w.fwd)}  ${pad(r.port, w.port)}  ${r.up}\n`,
+      `${pad(r.name, w.name)}  ${pad(r.provider, w.provider)}  ${pad(r.state, w.state)}  ${pad(r.url, w.url)}  ${pad(r.fwd, w.fwd)}  ${pad(r.paths, w.paths)}  ${pad(r.port, w.port)}  ${r.up}\n`,
     );
   }
 }
@@ -1071,6 +1164,13 @@ export function registerTunnelCommand(
       "Tailscale only: URL path mount (default: / for default, /<name> for named instances)",
     )
     .option("--https-port <port>", "Tailscale only: HTTPS listen port (default: 443)", "443")
+    .option(
+      "--allow-path <prefix>",
+      "URL path prefix the tunnel shares (repeatable, required). Every other path is refused; " +
+        "pass / to publish the whole upstream.",
+      collectPath,
+      [],
+    )
     .action(up);
 
   cmd

package/src/commands/webview.ts

@@ -0,0 +1,159 @@
+import { resolve } from "node:path";
+import type { Command } from "commander";
+import type { EmitContext } from "../commander.ts";
+import { commandPaceGate } from "../lib/pace/index.ts";
+import {
+  parseWebViewTypeStep,
+  parseWebViewViewport,
+  runWebView,
+  type WebViewBackend,
+  WebViewUnavailableError,
+} from "../lib/webview/index.ts";
+
+/**
+ * `harn webview`: a lightweight headless page probe through Bun.WebView.
+ *
+ * Experimental and Bun-only (Bun 1.4+). It always launches a fresh browser with
+ * ephemeral storage unless `--profile` is given, and never attaches to a
+ * running user browser. Use `browse` for headed login, the shared cookie jar,
+ * HAR capture, full-page screenshots, and page QA; use `browse-ai` for
+ * accessibility-tree element references. On Node the command fails with a
+ * clear message, matching how `tunnel` handles its Bun-only worker.
+ */
+
+interface WebviewOpts {
+  userAgent?: string;
+  backend: string;
+  viewport: string;
+  profile?: string;
+  chromePath?: string;
+  browserArg: string[];
+  timeout: string;
+  waitFor?: string;
+  type: string[];
+  click: string[];
+  press: string[];
+  evaluate?: string;
+  settle: string;
+  screenshot?: string;
+  html?: boolean;
+  json?: boolean;
+  pace?: boolean;
+}
+
+export function registerWebviewCommand(program: Command, emit: EmitContext, binName: string): void {
+  program
+    .command("webview <url>")
+    .description(
+      "Lightweight headless page probe through Bun.WebView (experimental, Bun 1.4+). " +
+        `Fresh ephemeral browser per call; use ${binName} browse for login, cookies, HAR, and QA.`,
+    )
+    .option("--backend <engine>", "Browser engine: auto | chrome | webkit", "auto")
+    .option(
+      "--user-agent <ua>",
+      "Chrome user agent: shared store by default; auto refreshes, native disables",
+    )
+    .option("--viewport <WxH>", "Viewport in CSS pixels", "1280x800")
+    .option(
+      "--profile <dir>",
+      "Persist cookies and local storage in this directory (default is ephemeral)",
+    )
+    .option("--chrome-path <path>", "Chrome-family executable; implies the Chrome backend")
+    .option("--browser-arg <flag>", "Extra Chrome launch flag (repeatable)", collect, [])
+    .option("--timeout <ms>", "Navigation and selector timeout in milliseconds", "30000")
+    .option("--wait-for <css>", "Wait for a CSS selector after navigation")
+    .option(
+      "--type <css=>text>",
+      "Focus a selector and insert text (repeatable; runs before clicks)",
+      collect,
+      [],
+    )
+    .option("--click <css>", "Scroll to and click a CSS selector (repeatable)", collect, [])
+    .option(
+      "--press <key>",
+      "Press a key in the currently focused element (repeatable)",
+      collect,
+      [],
+    )
+    .option("--evaluate <expression>", "Evaluate a JavaScript expression after actions")
+    .option("--settle <ms>", "Extra delay after actions before capture", "0")
+    .option(
+      "--screenshot <path>",
+      "Save a viewport PNG (Bun.WebView does not provide full-page capture)",
+    )
+    .option("--html", "Print the final document HTML instead of body text")
+    .option("--json", "Print the full result envelope")
+    .option(
+      "--no-pace",
+      "Skip the human-pace gap (3 to 9 s) between page loads of the same site for this run. " +
+        "HARNERY_PACE=off disables it machine-wide; local and private hosts never wait.",
+    )
+    .action(async (url: string, opts: WebviewOpts) => {
+      try {
+        await runWebview(url, opts, emit);
+      } catch (err: unknown) {
+        const message = err instanceof Error ? err.message : String(err);
+        emit.error({
+          code: err instanceof WebViewUnavailableError ? err.code : "webview_error",
+          message,
+        });
+        process.exit(1);
+      }
+    });
+}
+
+async function runWebview(url: string, opts: WebviewOpts, emit: EmitContext): Promise<void> {
+  if (!isBackend(opts.backend)) {
+    throw new Error(`Invalid backend "${opts.backend}". Expected auto, chrome, or webkit.`);
+  }
+  const backend = opts.backend === "auto" && opts.chromePath ? "chrome" : opts.backend;
+  const result = await runWebView(url, {
+    backend,
+    viewport: parseWebViewViewport(opts.viewport),
+    profileDir: opts.profile ? resolve(opts.profile) : undefined,
+    chromePath: opts.chromePath ? resolve(opts.chromePath) : undefined,
+    browserArgs: opts.browserArg,
+    timeoutMs: parseNonNegativeInteger(opts.timeout, "--timeout", false),
+    waitFor: opts.waitFor,
+    typeSteps: opts.type.map(parseWebViewTypeStep),
+    clicks: opts.click,
+    presses: opts.press,
+    evaluate: opts.evaluate,
+    settleMs: parseNonNegativeInteger(opts.settle, "--settle", true),
+    screenshotPath: opts.screenshot ? resolve(opts.screenshot) : undefined,
+    captureHtml: opts.html === true,
+    pace: commandPaceGate(opts.pace !== false, (message) => emit.log(message, "info")),
+    userAgent: opts.userAgent,
+  });
+
+  if (opts.json) {
+    emit.data(result);
+  } else if (opts.html) {
+    emit.text(result.html?.endsWith("\n") ? result.html : `${result.html ?? ""}\n`);
+  } else if (opts.evaluate !== undefined) {
+    const value =
+      typeof result.evaluation === "string"
+        ? result.evaluation
+        : JSON.stringify(result.evaluation, null, 2);
+    emit.text(`${value ?? "undefined"}\n`);
+  } else {
+    emit.text(result.text.endsWith("\n") ? result.text : `${result.text}\n`);
+  }
+}
+
+function collect(value: string, previous: string[]): string[] {
+  return [...previous, value];
+}
+
+function isBackend(value: string): value is WebViewBackend {
+  return value === "auto" || value === "chrome" || value === "webkit";
+}
+
+function parseNonNegativeInteger(value: string, flag: string, allowZero: boolean): number {
+  if (!/^\d+$/.test(value)) throw new Error(`${flag} expects an integer, got "${value}".`);
+  const parsed = Number.parseInt(value, 10);
+  if ((!allowZero && parsed < 1) || (allowZero && parsed < 0)) {
+    throw new Error(`${flag} must be ${allowZero ? "zero or greater" : "greater than zero"}.`);
+  }
+  return parsed;
+}

package/src/core/adapter.ts

@@ -1,5 +1,106 @@
 /** First-party harness adapters supported by Harnery's canonical V3 ledger. */
-export type Adapter = "claude-code" | "cursor" | "codex";
+export type Adapter = "claude-code" | "cursor" | "codex" | "opencode";
 
 /** Canonical producer classes used by V3 provenance. */
 export type EventSource = "agent-hooks" | "agent-coord" | "user" | "system";
+
+/**
+ * Runtime census of the workflow adapters. Adding a member to `Adapter`
+ * without listing it here is a compile error (see `adaptersComplete`), so a
+ * new adapter can never slip past the shared normalizer.
+ */
+export const ADAPTERS = [
+  "claude-code",
+  "cursor",
+  "codex",
+  "opencode",
+] as const satisfies readonly Adapter[];
+
+type MissingAdapter = Exclude<Adapter, (typeof ADAPTERS)[number]>;
+const adaptersComplete: [MissingAdapter] extends [never] ? true : never = true;
+void adaptersComplete;
+
+/** Every adapter falls back to this identity when a platform value carries no usable evidence. */
+export const DEFAULT_ADAPTER: Adapter = "claude-code";
+
+/** Why a platform value could not be normalized to a known adapter. */
+export type AdapterFallbackReason = "missing" | "unknown";
+
+export interface AdapterFallback {
+  /** The raw value that was normalized. */
+  value: unknown;
+  /** `missing` for null, undefined, or an empty string; `unknown` for anything else. */
+  reason: AdapterFallbackReason;
+  /** The adapter that was substituted. */
+  fallback: string;
+  /** Caller-supplied label naming the code path, for the diagnostic line. */
+  context?: string;
+}
+
+export interface AdapterFallbackOptions {
+  /** Names the caller in the diagnostic line, e.g. `"claim-conflict"`. */
+  context?: string;
+  /**
+   * Receives every fallback. The default writes one stderr line per unknown
+   * value; a missing value is a pre-heartbeat state rather than a
+   * misattribution, so it is passed here but not printed.
+   */
+  onFallback?: (fallback: AdapterFallback) => void;
+}
+
+/**
+ * Generic membership normalizer shared by every adapter census. Returns the
+ * matching id or `null`; it never substitutes a default.
+ */
+export function normalizeAdapterId<T extends string>(
+  value: unknown,
+  census: readonly T[],
+): T | null {
+  if (typeof value !== "string") return null;
+  return (census as readonly string[]).includes(value) ? (value as T) : null;
+}
+
+/**
+ * Normalize with an explicit, reported fallback. Every caller that must end up
+ * with *some* adapter routes through here so the substitution is visible.
+ */
+export function resolveAdapterId<T extends string>(
+  value: unknown,
+  census: readonly T[],
+  fallback: T,
+  options: AdapterFallbackOptions = {},
+): T {
+  const normalized = normalizeAdapterId(value, census);
+  if (normalized !== null) return normalized;
+  const reason: AdapterFallbackReason =
+    value === undefined || value === null || value === "" ? "missing" : "unknown";
+  (options.onFallback ?? reportAdapterFallback)({
+    value,
+    reason,
+    fallback,
+    context: options.context,
+  });
+  return fallback;
+}
+
+/** Default fallback sink: one stderr line for an unrecognized platform value. */
+export function reportAdapterFallback(fallback: AdapterFallback): void {
+  if (fallback.reason !== "unknown") return;
+  const where = fallback.context ? ` (${fallback.context})` : "";
+  process.stderr.write(
+    `harnery: unknown adapter platform ${JSON.stringify(fallback.value)}${where}; treating it as ${fallback.fallback}\n`,
+  );
+}
+
+/** Strict workflow-adapter normalizer: a known id or `null`. */
+export function normalizeAdapter(value: unknown): Adapter | null {
+  return normalizeAdapterId(value, ADAPTERS);
+}
+
+/**
+ * Heartbeat `platform` (or any adapter-shaped string) to a workflow adapter,
+ * substituting `DEFAULT_ADAPTER` and reporting the substitution.
+ */
+export function adapterFromPlatform(value: unknown, options?: AdapterFallbackOptions): Adapter {
+  return resolveAdapterId(value, ADAPTERS, DEFAULT_ADAPTER, options);
+}

package/src/core/adapters/attestation.ts

@@ -22,6 +22,7 @@ import {
 } from "node:fs";
 import { resolve } from "node:path";
 import { monorepoRoot } from "../agents/coord-client.ts";
+import { stateDirMode, stateFileMode } from "../storage/modes.ts";
 import { stableDigest } from "../workflow/durable-record.ts";
 import type { AdapterId, AdapterProfile, CapabilitySupport } from "./types.ts";
 
@@ -107,12 +108,12 @@ export function writeAttestation(
   opts: AttestationStoreOptions = {},
 ): string {
   const path = attestationPath(record.adapter, opts);
-  mkdirSync(attestationsDir(opts), { recursive: true, mode: 0o700 });
+  mkdirSync(attestationsDir(opts), { recursive: true, mode: stateDirMode() });
   const temporary = `${path}.tmp-${process.pid}`;
   try {
     writeFileSync(temporary, `${JSON.stringify(record, null, 2)}\n`, {
       encoding: "utf8",
-      mode: 0o600,
+      mode: stateFileMode(),
     });
     renameSync(temporary, path);
   } catch (error) {

package/src/core/adapters/profiles.ts

@@ -45,6 +45,18 @@ export const BUILTIN_ADAPTER_PROFILES = {
     modelFamily: "claude",
     effortValues: ["low", "medium", "high", "xhigh", "max"],
     verified: { date: "2026-08-18", version: "2.1.233 (Claude Code)" },
+    // Checked against 2.1.283 (ADR 0192). Claude Code has no sandbox mode flag;
+    // its permission mode and its optional Bash sandbox are separate, so full
+    // access needs both: bypass permissions, and a settings layer that turns
+    // the Bash sandbox off in case a user or project settings file enabled it.
+    fullAccess: {
+      argv: [
+        "--permission-mode",
+        "bypassPermissions",
+        "--settings",
+        '{"sandbox":{"enabled":false}}',
+      ],
+    },
     capabilities: capabilities({
       effortSelection: supported("Mapped to `--effort <level>`."),
       maxTurns: supported("Mapped to `--max-turns <n>`."),
@@ -78,6 +90,9 @@ export const BUILTIN_ADAPTER_PROFILES = {
       modes: { "read-only": "read-only", "workspace-write": "workspace-write" },
       writableRoots: true,
     },
+    // Checked against codex-cli 0.155.1 (ADR 0192): `--sandbox` accepts
+    // danger-full-access, and `codex exec` never prompts for approval.
+    fullAccess: { argv: ["--sandbox", "danger-full-access"] },
     capabilities: capabilities({
       effortSelection: supported('Mapped to `-c model_reasoning_effort="<level>"`.'),
       filesystemPolicyProjection: supported(
@@ -106,7 +121,11 @@ export const BUILTIN_ADAPTER_PROFILES = {
     authModel: "own-auth",
     modelFamily: "multi",
     effortValues: [],
-    verified: { date: "2026-08-18", version: "2026.08.11-e8db854" },
+    verified: { date: "2026-09-20", version: "2026.09.18-9a7762b" },
+    // Checked against 2026.09.26-dd393fe (ADR 0192): `--sandbox disabled`
+    // overrides the configured sandbox. Cursor carries effort inside the model
+    // id, so a full-access floor for it names exact model ids.
+    fullAccess: { argv: ["--sandbox", "disabled"] },
     capabilities: capabilities({
       effortSelection: unsupported(
         "Cursor embeds effort in some parameterized model ids; Harnery does not rewrite model ids.",
@@ -114,6 +133,10 @@ export const BUILTIN_ADAPTER_PROFILES = {
       maxTurns: unsupported("cursor-agent exposes no turn-ceiling flag."),
       sessionId: supported("Read from the JSON result envelope."),
       cost: unsupported("The JSON result envelope carries no cost."),
+      // Still unknown on 2026-09-20 against cursor-agent 2026.09.18: the live
+      // `cursor_composer_context_percent` reader serves IDE hook sessions from
+      // the composer `state.vscdb`, and headless `cursor-agent` children (this
+      // workflow adapter) leave no composer row and no usage in the JSON result.
       contextTelemetry: unknown("No stable Cursor context-usage payload has been certified."),
       preCompactionSignal: supported("Cursor preCompact is wired to a durable checkpoint."),
       postCompactionSignal: unsupported(
@@ -121,6 +144,45 @@ export const BUILTIN_ADAPTER_PROFILES = {
       ),
     }),
   },
+  opencode: {
+    id: "opencode",
+    displayName: "OpenCode",
+    binary: "opencode",
+    installHint: "curl -fsSL https://opencode.ai/install | bash",
+    loginHint: "opencode auth login",
+    apiKeyEnv: "OPENCODE_API_KEY",
+    integrationMode: "cli-subprocess",
+    authModel: "own-auth",
+    modelFamily: "multi",
+    // Model reasoning is selected through the `provider/model#variant` id;
+    // OpenCode exposes no separate effort dial for Harnery to map. It also has
+    // no vendor sandbox to remove, so it declares no full-access rendering and
+    // a worker on it is never granted one (ADR 0192).
+    effortValues: [],
+    verified: { date: "2026-09-20", version: "opencode v2.0.11" },
+    capabilities: capabilities({
+      effortSelection: unsupported(
+        "OpenCode selects reasoning through the model id variant; there is no separate effort flag.",
+      ),
+      maxTurns: unsupported("`opencode run` exposes no turn-ceiling flag."),
+      sessionId: supported("Read from the `sessionID` on every `--format json` NDJSON line."),
+      cost: unsupported(
+        "`opencode run --format json` streams parts without a final cost; cost lives in `session export`.",
+      ),
+      // Tool evidence is delivered on the event axis by the Harnery OpenCode
+      // plugin, not by the final-result workflow spawn, which retains no tool
+      // events (as with Codex and Cursor).
+      contextTelemetry: unknown(
+        "OpenCode stores context in SQLite; no context-window bridge is certified yet.",
+      ),
+      preCompactionSignal: supported(
+        'OpenCode session.hook("compaction") is bridged to a durable checkpoint.',
+      ),
+      postCompactionSignal: unsupported(
+        "No post-compact hook is wired; OpenCode post-compaction recovery is not yet certified.",
+      ),
+    }),
+  },
 } as const satisfies Record<string, AdapterProfile>;
 
 export type BuiltinAdapterId = keyof typeof BUILTIN_ADAPTER_PROFILES;