harnery 0.46.0 → 0.47.0

package/src/core/storage/modes.ts

@@ -54,6 +54,12 @@ export function stateFileMode(): number {
  * True when a state file or directory is readable or writable by someone it should not be: anyone
  * but the owner in private mode, anyone outside the owner and group in group mode.
  */
-export function stateModeTooOpen(mode: number): boolean {
+export function stateModeTooOpen(
+  mode: number,
+  platform: NodeJS.Platform = process.platform,
+): boolean {
+  // Windows synthesizes POSIX mode bits; access is controlled by inherited
+  // NTFS ACLs, which chmod and stat.mode cannot inspect or tighten.
+  if (platform === "win32") return false;
   return (mode & (stateSharing() === "group" ? 0o007 : 0o077)) !== 0;
 }

package/src/core/workflow/durable-record.ts

@@ -61,10 +61,24 @@ export function writeImmutableJson(path: string, value: unknown): boolean {
 }
 
 export function fsyncParentDirectory(path: string): void {
-  const directory = dirname(path);
+  fsyncDirectory(dirname(path));
+}
+
+/** Flush directory entries where the runtime supports it; file fsync remains mandatory. */
+export function fsyncDirectory(directory: string): void {
   const fd = openSync(directory, "r");
   try {
     fsyncSync(fd);
+  } catch (error) {
+    // Windows does not expose directory FlushFileBuffers through node:fs.
+    // Keep atomic links/renames and file flushes, but do not claim POSIX
+    // directory-entry durability on that platform. Other errors still fail.
+    if (
+      process.platform !== "win32" ||
+      !["EPERM", "EINVAL", "ENOTSUP"].includes((error as NodeJS.ErrnoException).code ?? "")
+    ) {
+      throw error;
+    }
   } finally {
     closeSync(fd);
   }

package/src/core/workflow/engine.ts

@@ -1101,6 +1101,7 @@ async function executeWorkflow(
           runId,
           agentId: id,
           subscriptionOnly,
+          ...(agentOpts.mcp ? { mcp: agentOpts.mcp } : {}),
           // A full-access launch has no sandbox to project a policy into.
           ...(access.mode === "full-access"
             ? { access: "full-access" as const }
@@ -1505,6 +1506,8 @@ function agentCallKey(
     agentOpts.schema ?? null,
   ];
   if (agentOpts.specialist) parts.push(agentOpts.specialist);
+  // Appended only when set so existing resume keys stay stable.
+  if (agentOpts.mcp) parts.push({ mcp: agentOpts.mcp });
   parts.push(prompt);
   const basis = JSON.stringify(parts);
   return createHash("sha256").update(basis).digest("hex").slice(0, 16);

package/src/core/workflow/spawn-claude.ts

@@ -16,9 +16,17 @@
  *    visible to peers — the point of running them under harnery. So the child
  *    gets HARNERY_WORKFLOW_CHILD=1 and the stop-hook rule exempts it
  *    (stop-hook.ts), keeping heartbeats + events on.
+ * 3. **No MCP servers or claude.ai connectors unless the spawn asks.** A
+ *    headless child otherwise loads every connector on the account (about 130
+ *    tool schemas) into every turn. `req.mcp` defaults to `"none"` (strict
+ *    empty MCP config plus ENABLE_CLAUDEAI_MCP_SERVERS=false); `"inherit"` or
+ *    a server map is the per-spawn opt-in. Project settings, hooks, and
+ *    CLAUDE.md still load: workflow children need them, so this adapter never
+ *    passes `--setting-sources ""`.
  */
 
 import { exec } from "../../lib/exec.ts";
+import { claudeMcpLaunch } from "../../lib/headless/index.ts";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.ts";
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
@@ -62,6 +70,7 @@ export function buildClaudeInvocation(req: SpawnRequest): AdapterInvocation {
   if (fullAccess) argv.push(...fullAccess);
   if (req.model) argv.push("--model", req.model);
   if (req.effort) argv.push("--effort", req.effort);
+  argv.push(...claudeMcpLaunch(req.mcp).args);
   return { argv };
 }
 
@@ -152,10 +161,13 @@ export const claudeCodeSpawner: Spawner = async (req: SpawnRequest): Promise<Spa
   }
   const r = await exec(invocation.argv, {
     cwd: req.cwd,
-    env: buildChildEnv(req.runId, {
-      subscriptionOnly: req.subscriptionOnly,
-      agentId: req.agentId,
-    }),
+    env: {
+      ...buildChildEnv(req.runId, {
+        subscriptionOnly: req.subscriptionOnly,
+        agentId: req.agentId,
+      }),
+      ...claudeMcpLaunch(req.mcp).env,
+    },
     timeout: req.timeoutMs,
   });
   return normalizeClaudeResult({ ...r, durationMs: Date.now() - t0 });

package/src/core/workflow/specialists.ts

@@ -72,6 +72,7 @@ export function resolveSpecialistAssignment(
       maxTurns: opts.maxTurns ?? profile.maxTurns,
       label: opts.label,
       schema: opts.schema,
+      ...(opts.mcp ? { mcp: opts.mcp } : {}),
     },
   };
 }

package/src/core/workflow/types.ts

@@ -7,6 +7,7 @@
  * Design record: decision 0015 (portable coordination-aware workflows).
  */
 
+import type { ClaudeMcpMode } from "../../lib/headless/index.ts";
 import type { DiagnosticAdvice } from "../diagnostics/contract.ts";
 import type {
   DispatchCostEstimator,
@@ -342,6 +343,11 @@ export interface AgentOpts {
    * Mixed-adapter workflows are legal: triage on one CLI, deep work on
    * another. */
   adapter?: AdapterName;
+  /** MCP servers a Claude Code child may load (default `"none"`: no MCP
+   * servers, no claude.ai connectors). Set `"inherit"` for a stage that really
+   * calls a connector, or `{ mcpServers: {...} }` for exactly those servers.
+   * Other adapters ignore it. */
+  mcp?: ClaudeMcpMode;
 }
 
 /** Open registry key. The built-in catalog currently contains Claude Code,
@@ -436,6 +442,10 @@ export interface SpawnRequest {
    * spawner refuses it when its adapter declares no full-access rendering, and
    * refuses it alongside a filesystem policy, which it would contradict. */
   access?: WorkerAccessMode;
+  /** MCP servers a Claude Code child may load. Absent means `"none"`: no MCP
+   * servers and no claude.ai connectors. `"inherit"` or an explicit server map
+   * is the per-spawn opt-in (see `ClaudeMcpMode`). Other adapters ignore it. */
+  mcp?: ClaudeMcpMode;
 }
 
 /**

package/src/core/workflow/workspaces/leases.ts

@@ -17,6 +17,7 @@ import {
 import { hostname } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { stateDirMode, stateFileMode } from "../../storage/modes.ts";
+import { fsyncDirectory } from "../durable-record.ts";
 
 const MAX_LEASE_BYTES = 8 * 1024;
 const MAX_CONTENTION_OBSERVATION_ATTEMPTS = 8;
@@ -568,15 +569,6 @@ function digestBytes(bytes: string): string {
   return createHash("sha256").update(bytes).digest("hex");
 }
 
-function fsyncDirectory(path: string): void {
-  const fd = openSync(path, "r");
-  try {
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-}
-
 function safeUnlink(path: string): void {
   try {
     unlinkSync(path);