harnery 0.9.0 → 0.11.0

package/dist/core/workflow/proof.js

@@ -0,0 +1,342 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.js";
+const MAX_ACCEPTANCE_CRITERIA = 50;
+const MAX_EVIDENCE_RECORDS = 200;
+const MAX_PACKET_BYTES = 512 * 1024;
+const MAX_NAME_CHARS = 200;
+const MAX_OBJECTIVE_CHARS = 2_000;
+const MAX_CRITERION_CHARS = 500;
+const MAX_LABEL_CHARS = 200;
+const MAX_SUMMARY_CHARS = 2_000;
+const MAX_REF_CHARS = 1_000;
+const ACCEPTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+export function normalizeWorkflowMeta(meta, fallbackName) {
+    const name = boundedRequired(meta?.name ?? fallbackName, "workflow name", MAX_NAME_CHARS);
+    const objective = boundedOptional(meta?.objective, "workflow objective", MAX_OBJECTIVE_CHARS);
+    const description = boundedOptional(meta?.description, "workflow description", MAX_OBJECTIVE_CHARS);
+    const acceptance = meta?.acceptance ?? [];
+    if (!Array.isArray(acceptance))
+        throw new Error("workflow acceptance must be an array");
+    if (acceptance.length > MAX_ACCEPTANCE_CRITERIA) {
+        throw new Error(`workflow acceptance exceeds ${MAX_ACCEPTANCE_CRITERIA} criteria`);
+    }
+    const seen = new Set();
+    const normalized = acceptance.map((criterion, index) => {
+        if (!criterion || typeof criterion !== "object") {
+            throw new Error(`workflow acceptance[${index}] must be an object`);
+        }
+        const id = boundedRequired(criterion.id, `workflow acceptance[${index}].id`, 64);
+        if (!ACCEPTANCE_ID.test(id)) {
+            throw new Error(`workflow acceptance id ${JSON.stringify(id)} must match ${ACCEPTANCE_ID.source}`);
+        }
+        if (seen.has(id))
+            throw new Error(`duplicate workflow acceptance id ${JSON.stringify(id)}`);
+        seen.add(id);
+        return {
+            id,
+            statement: boundedRequired(criterion.statement, `workflow acceptance[${index}].statement`, MAX_CRITERION_CHARS),
+        };
+    });
+    return { name, description, objective, acceptance: normalized };
+}
+export function createEvidenceRecord(input) {
+    if (input.sequence > MAX_EVIDENCE_RECORDS) {
+        throw new Error(`workflow evidence exceeds ${MAX_EVIDENCE_RECORDS} records`);
+    }
+    const value = input.value;
+    const acceptanceIds = value.acceptanceIds ?? [];
+    if (!Array.isArray(acceptanceIds))
+        throw new Error("evidence acceptanceIds must be an array");
+    const uniqueAcceptanceIds = [...new Set(acceptanceIds)];
+    for (const id of uniqueAcceptanceIds) {
+        if (typeof id !== "string" || !input.acceptanceIds.has(id)) {
+            throw new Error(`evidence references unknown acceptance id ${JSON.stringify(id)}`);
+        }
+    }
+    return {
+        id: `e${input.sequence}`,
+        source: "workflow",
+        recorded_at: input.recordedAt ?? new Date().toISOString(),
+        kind: enumValue(value.kind, ["test", "command", "artifact", "change", "review", "observation"], "evidence kind"),
+        status: enumValue(value.status, ["passed", "failed", "observed", "unknown"], "evidence status"),
+        label: boundedRequired(value.label, "evidence label", MAX_LABEL_CHARS),
+        summary: boundedOptional(value.summary, "evidence summary", MAX_SUMMARY_CHARS),
+        ref: boundedOptional(value.ref, "evidence ref", MAX_REF_CHARS),
+        stage: boundedOptional(input.stage, "evidence stage", MAX_LABEL_CHARS),
+        acceptance_ids: uniqueAcceptanceIds,
+    };
+}
+export function rollupAcceptance(criteria, evidence) {
+    const results = criteria.map((criterion) => {
+        const attached = evidence.filter((item) => item.acceptance_ids.includes(criterion.id));
+        const failed = attached.filter((item) => item.status === "failed");
+        const passed = attached.filter((item) => item.status === "passed");
+        const decisive = failed.length > 0 ? failed : passed;
+        const status = failed.length > 0 ? "unsatisfied" : passed.length > 0 ? "satisfied" : "unknown";
+        return {
+            ...criterion,
+            status,
+            evidence_ids: attached.map((item) => item.id),
+            sources: [...new Set(decisive.map((item) => item.source))],
+        };
+    });
+    return {
+        criteria: results,
+        summary: {
+            satisfied: results.filter((item) => item.status === "satisfied").length,
+            unsatisfied: results.filter((item) => item.status === "unsatisfied").length,
+            unknown: results.filter((item) => item.status === "unknown").length,
+            total: results.length,
+        },
+    };
+}
+export function digestResult(value, kind) {
+    const resolvedKind = kind ?? (typeof value === "string" ? "text" : "json");
+    const serialized = resolvedKind === "text" ? String(value) : (JSON.stringify(value) ?? "null");
+    return {
+        kind: resolvedKind,
+        sha256: createHash("sha256").update(serialized).digest("hex"),
+        bytes: Buffer.byteLength(serialized),
+    };
+}
+export function buildWorkflowProof(input) {
+    const acceptance = rollupAcceptance(input.meta.acceptance, input.evidence);
+    const repository = buildRepoEvidence(input.before, input.after);
+    const agents = input.agents.map((agent) => ({
+        ...agent,
+        label: clipped(agent.label, MAX_LABEL_CHARS),
+        model: clippedOptional(agent.model, MAX_LABEL_CHARS),
+        session_id: clippedOptional(agent.session_id, MAX_REF_CHARS),
+        error: clippedOptional(agent.error, MAX_SUMMARY_CHARS),
+    }));
+    const harnesses = buildHarnessCoverage(agents, input.harnessEvidence);
+    const unknowns = buildUnknowns(agents, harnesses, repository);
+    const journal = readFileSync(input.journalPath);
+    return {
+        schema_version: WORKFLOW_PROOF_SCHEMA_VERSION,
+        run: {
+            id: input.runId,
+            name: input.meta.name,
+            status: input.status,
+            started_at: input.startedAt,
+            ended_at: input.endedAt,
+            duration_ms: input.durationMs,
+            objective: input.meta.objective,
+            error: clippedOptional(input.error, MAX_SUMMARY_CHARS),
+            result: input.result === undefined ? undefined : digestResult(input.result),
+        },
+        acceptance,
+        agents,
+        evidence: input.evidence,
+        repository,
+        harnesses,
+        unknowns,
+        integrity: {
+            journal: {
+                path: "journal.jsonl",
+                sha256: createHash("sha256").update(journal).digest("hex"),
+                bytes: journal.byteLength,
+            },
+        },
+    };
+}
+export function writeWorkflowProof(path, proof) {
+    const body = `${JSON.stringify(proof, null, 2)}\n`;
+    const bytes = Buffer.byteLength(body);
+    if (bytes > MAX_PACKET_BYTES) {
+        throw new Error(`workflow proof is ${bytes} bytes; limit is ${MAX_PACKET_BYTES}`);
+    }
+    mkdirSync(dirname(path), { recursive: true });
+    const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+    try {
+        writeFileSync(temporary, body, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        renameSync(temporary, path);
+        chmodSync(path, 0o600);
+    }
+    finally {
+        if (existsSync(temporary))
+            unlinkSync(temporary);
+    }
+}
+export function readWorkflowProof(coordRoot, runId) {
+    if (!RUN_ID.test(runId))
+        throw new Error(`invalid workflow run id ${JSON.stringify(runId)}`);
+    const path = join(coordRoot, ".harnery", "workflows", runId, "proof.json");
+    if (!existsSync(path))
+        throw new Error(`workflow run ${runId} has no proof packet at ${path}`);
+    const size = statSync(path).size;
+    if (size > MAX_PACKET_BYTES) {
+        throw new Error(`workflow proof is ${size} bytes; limit is ${MAX_PACKET_BYTES}`);
+    }
+    let proof;
+    try {
+        proof = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`cannot parse workflow proof at ${path}: ${error.message}`);
+    }
+    if (proof.schema_version !== WORKFLOW_PROOF_SCHEMA_VERSION || proof.run?.id !== runId) {
+        throw new Error(`workflow proof at ${path} has an unsupported or mismatched schema`);
+    }
+    return proof;
+}
+export function renderWorkflowProof(proof) {
+    const lines = [
+        `run ${proof.run.id} (${proof.run.name}): ${proof.run.status}`,
+        `duration: ${Math.round(proof.run.duration_ms / 1000)}s`,
+    ];
+    if (proof.run.objective)
+        lines.push(`objective: ${proof.run.objective}`);
+    const summary = proof.acceptance.summary;
+    lines.push(`acceptance: ${summary.satisfied} satisfied, ${summary.unsatisfied} unsatisfied, ${summary.unknown} unknown`);
+    for (const criterion of proof.acceptance.criteria) {
+        const mark = criterion.status === "satisfied" ? "PASS" : criterion.status === "unsatisfied" ? "FAIL" : "?";
+        const refs = criterion.evidence_ids.length > 0 ? ` [${criterion.evidence_ids.join(", ")}]` : "";
+        lines.push(`  ${mark} ${criterion.id}: ${criterion.statement}${refs}`);
+    }
+    lines.push(`evidence: ${proof.evidence.length} record(s); agents: ${proof.agents.length}`);
+    const repo = proof.repository;
+    const drift = repo.drift;
+    lines.push(`repository: branch ${repo.before.branch ?? "unknown"} -> ${repo.after.branch ?? "unknown"}; ` +
+        `HEAD ${short(repo.before.head)} -> ${short(repo.after.head)}; ` +
+        `${drift.dirty_paths_added.length} dirty added, ${drift.dirty_paths_cleared.length} cleared`);
+    if (proof.unknowns.length > 0) {
+        lines.push(`unknowns: ${proof.unknowns.length}`);
+        for (const unknown of proof.unknowns)
+            lines.push(`  - ${unknown.message}`);
+    }
+    lines.push(`journal sha256: ${proof.integrity.journal.sha256}`);
+    return `${lines.join("\n")}\n`;
+}
+function buildRepoEvidence(beforeRaw, afterRaw) {
+    const before = normalizeRepoSnapshot(beforeRaw);
+    const after = normalizeRepoSnapshot(afterRaw);
+    const beforeDirty = new Set(before.dirty_paths);
+    const afterDirty = new Set(after.dirty_paths);
+    const retained = after.dirty_paths.filter((path) => beforeDirty.has(path));
+    const incomplete = Boolean(before.dirty_paths_truncated || after.dirty_paths_truncated || retained.length > 0);
+    return {
+        source: "engine",
+        before,
+        after,
+        drift: {
+            branch_changed: before.branch !== after.branch,
+            head_changed: before.head !== after.head,
+            dirty_paths_added: after.dirty_paths.filter((path) => !beforeDirty.has(path)),
+            dirty_paths_cleared: before.dirty_paths.filter((path) => !afterDirty.has(path)),
+            dirty_paths_retained: retained,
+            incomplete,
+            note: incomplete
+                ? "Snapshots cannot prove whether retained dirty paths changed during the run, and truncated lists may omit paths."
+                : undefined,
+        },
+    };
+}
+function normalizeRepoSnapshot(snapshot) {
+    return {
+        cwd: snapshot.cwd,
+        root: snapshot.root,
+        branch: snapshot.branch,
+        head: snapshot.head,
+        dirty_paths: snapshot.dirty_paths,
+        dirty_paths_truncated: snapshot.dirty_paths_truncated,
+    };
+}
+function buildHarnessCoverage(agents, claims) {
+    return [...new Set(agents.map((agent) => agent.harness))].map((harness) => {
+        const harnessAgents = agents.filter((agent) => agent.harness === harness);
+        return {
+            harness,
+            tool_evidence: claims?.[harness]?.toolEvidence ?? {
+                support: "unknown",
+                note: "No harness capability claim was supplied to this workflow run.",
+            },
+            observed: {
+                final_results: harnessAgents.filter((agent) => agent.result).length,
+                session_ids: harnessAgents.filter((agent) => agent.session_id).length,
+                costs: harnessAgents.filter((agent) => agent.cost_usd !== undefined).length,
+            },
+        };
+    });
+}
+function buildUnknowns(agents, harnesses, repository) {
+    const unknowns = [];
+    for (const harness of harnesses) {
+        if (harness.tool_evidence.support === "unknown") {
+            unknowns.push({
+                code: "harness_capability_unregistered",
+                harness: harness.harness,
+                message: `${harness.harness}: tool-evidence capability was not registered for this run.`,
+            });
+        }
+        else if (harness.tool_evidence.support !== "supported") {
+            unknowns.push({
+                code: "tool_evidence_unavailable",
+                harness: harness.harness,
+                message: `${harness.harness}: adapter-native tool evidence is ${harness.tool_evidence.support}.`,
+            });
+        }
+    }
+    for (const agent of agents.filter((item) => item.status !== "failed")) {
+        if (agent.cost_usd === undefined) {
+            unknowns.push({
+                code: "agent_cost_unreported",
+                harness: agent.harness,
+                agent_id: agent.id,
+                message: `${agent.id}: ${agent.harness} did not report per-run cost.`,
+            });
+        }
+        if (!agent.session_id) {
+            unknowns.push({
+                code: "agent_session_unreported",
+                harness: agent.harness,
+                agent_id: agent.id,
+                message: `${agent.id}: ${agent.harness} did not report a child session id.`,
+            });
+        }
+    }
+    if (repository.drift.incomplete) {
+        unknowns.push({
+            code: "repository_drift_incomplete",
+            message: repository.drift.note ?? "Repository drift is incomplete.",
+        });
+    }
+    return unknowns;
+}
+function boundedRequired(value, field, max) {
+    if (typeof value !== "string" || value.trim() === "")
+        throw new Error(`${field} is required`);
+    const normalized = value.trim();
+    if (normalized.length > max)
+        throw new Error(`${field} exceeds ${max} characters`);
+    return normalized;
+}
+function boundedOptional(value, field, max) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string")
+        throw new Error(`${field} must be a string`);
+    const normalized = value.trim();
+    if (normalized === "")
+        return undefined;
+    if (normalized.length > max)
+        throw new Error(`${field} exceeds ${max} characters`);
+    return normalized;
+}
+function enumValue(value, values, field) {
+    if (typeof value === "string" && values.includes(value))
+        return value;
+    throw new Error(`${field} must be one of: ${values.join(", ")}`);
+}
+function short(value) {
+    return value ? value.slice(0, 8) : "unknown";
+}
+function clipped(value, max) {
+    return value.length <= max ? value : `${value.slice(0, Math.max(0, max - 1))}…`;
+}
+function clippedOptional(value, max) {
+    return value === undefined ? undefined : clipped(value, max);
+}

package/dist/core/workflow/spawn-claude.d.ts

@@ -17,6 +17,9 @@
  *    gets HARNERY_WORKFLOW_CHILD=1 and the stop-hook rule exempts it
  *    (stop-hook.ts), keeping heartbeats + events on.
  */
-import type { Spawner } from "./types.js";
+import type { HarnessInvocation, HarnessRawResult } from "../harnesses/types.js";
+import type { Spawner, SpawnRequest, SpawnResult } from "./types.js";
+export declare function buildClaudeInvocation(req: SpawnRequest): HarnessInvocation;
+export declare function normalizeClaudeResult(raw: HarnessRawResult): SpawnResult;
 export declare const claudeCodeSpawner: Spawner;
 //# sourceMappingURL=spawn-claude.d.ts.map

package/dist/core/workflow/spawn-claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,KAAK,EAAE,OAAO,EAA6B,MAAM,YAAY,CAAC;AAYrE,eAAO,MAAM,iBAAiB,EAAE,OA+D/B,CAAC"}
+{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAc1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAgDxE;AAED,eAAO,MAAM,iBAAiB,EAAE,OAc/B,CAAC"}

package/dist/core/workflow/spawn-claude.js

@@ -18,10 +18,11 @@
  *    (stop-hook.ts), keeping heartbeats + events on.
  */
 import { exec } from "../../lib/exec.js";
+import { validateHarnessEffort } from "../harnesses/profiles.js";
 import { buildChildEnv } from "./child-env.js";
 import { notFoundError } from "./harnesses.js";
-export const claudeCodeSpawner = async (req) => {
-    const t0 = Date.now();
+export function buildClaudeInvocation(req) {
+    validateHarnessEffort("claude-code", req.effort);
     const argv = [
         "claude",
         "-p",
@@ -33,33 +34,37 @@ export const claudeCodeSpawner = async (req) => {
     ];
     if (req.model)
         argv.push("--model", req.model);
-    const r = await exec(argv, {
-        cwd: req.cwd,
-        env: buildChildEnv(req.runId, { subscriptionOnly: req.subscriptionOnly }),
-        timeout: req.timeoutMs,
-    });
-    const durationMs = Date.now() - t0;
-    if (r.exitCode === 127) {
-        return { ok: false, text: "", durationMs, error: notFoundError("claude-code") };
+    if (req.effort)
+        argv.push("--effort", req.effort);
+    return { argv };
+}
+export function normalizeClaudeResult(raw) {
+    if (raw.exitCode === 127) {
+        return {
+            ok: false,
+            text: "",
+            durationMs: raw.durationMs,
+            error: notFoundError("claude-code"),
+        };
     }
-    if (r.exitCode !== 0) {
+    if (raw.exitCode !== 0) {
         return {
             ok: false,
             text: "",
-            durationMs,
-            error: `claude exited ${r.exitCode}: ${(r.stderr || r.stdout).slice(0, 500)}`,
+            durationMs: raw.durationMs,
+            error: `claude exited ${raw.exitCode}: ${(raw.stderr || raw.stdout).slice(0, 500)}`,
         };
     }
     let envelope;
     try {
-        envelope = JSON.parse(r.stdout);
+        envelope = JSON.parse(raw.stdout);
     }
     catch {
         return {
             ok: false,
             text: "",
-            durationMs,
-            error: `result envelope was not JSON: ${r.stdout.slice(0, 300)}`,
+            durationMs: raw.durationMs,
+            error: `result envelope was not JSON: ${raw.stdout.slice(0, 300)}`,
         };
     }
     if (envelope.is_error) {
@@ -68,7 +73,7 @@ export const claudeCodeSpawner = async (req) => {
             text: String(envelope.result ?? ""),
             sessionId: envelope.session_id,
             costUsd: envelope.total_cost_usd,
-            durationMs,
+            durationMs: raw.durationMs,
             error: `harness error (${envelope.subtype ?? "unknown"}): ${(envelope.errors ?? []).join("; ") || "see envelope"}`,
         };
     }
@@ -77,6 +82,22 @@ export const claudeCodeSpawner = async (req) => {
         text: String(envelope.result ?? ""),
         sessionId: envelope.session_id,
         costUsd: envelope.total_cost_usd,
-        durationMs,
+        durationMs: raw.durationMs,
     };
+}
+export const claudeCodeSpawner = async (req) => {
+    const t0 = Date.now();
+    let invocation;
+    try {
+        invocation = buildClaudeInvocation(req);
+    }
+    catch (error) {
+        return { ok: false, text: "", durationMs: 0, error: error.message };
+    }
+    const r = await exec(invocation.argv, {
+        cwd: req.cwd,
+        env: buildChildEnv(req.runId, { subscriptionOnly: req.subscriptionOnly }),
+        timeout: req.timeoutMs,
+    });
+    return normalizeClaudeResult({ ...r, durationMs: Date.now() - t0 });
 };

package/dist/core/workflow/spawn-codex.d.ts

@@ -14,6 +14,9 @@
  * - No max-turns equivalent → `maxTurns` is accepted and ignored (documented
  *   in the CLI docs page).
  */
-import type { Spawner } from "./types.js";
+import type { HarnessInvocation, HarnessRawResult } from "../harnesses/types.js";
+import type { Spawner, SpawnRequest, SpawnResult } from "./types.js";
+export declare function buildCodexInvocation(req: SpawnRequest, resultFile?: string): HarnessInvocation;
+export declare function normalizeCodexResult(raw: HarnessRawResult): SpawnResult;
 export declare const codexSpawner: Spawner;
 //# sourceMappingURL=spawn-codex.d.ts.map

package/dist/core/workflow/spawn-codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,KAAK,EAAE,OAAO,EAA6B,MAAM,YAAY,CAAC;AAErE,eAAO,MAAM,YAAY,EAAE,OA+C1B,CAAC"}
+{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAgB9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAiBvE;AAED,eAAO,MAAM,YAAY,EAAE,OA2B1B,CAAC"}

package/dist/core/workflow/spawn-codex.js

@@ -19,46 +19,68 @@ import { existsSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { exec } from "../../lib/exec.js";
+import { validateHarnessEffort } from "../harnesses/profiles.js";
 import { buildChildEnv } from "./child-env.js";
 import { notFoundError } from "./harnesses.js";
-export const codexSpawner = async (req) => {
-    const t0 = Date.now();
-    const outFile = join(tmpdir(), `harnery-codex-${process.pid}-${randomBytes(4).toString("hex")}.txt`);
+export function buildCodexInvocation(req, resultFile) {
+    validateHarnessEffort("codex", req.effort);
+    if (!resultFile)
+        throw new Error("codex adapter requires a final-message result file");
     const argv = [
         "codex",
         "exec",
         req.prompt,
         "--output-last-message",
-        outFile,
+        resultFile,
         "--skip-git-repo-check",
         "--sandbox",
         "workspace-write",
     ];
     if (req.model)
         argv.push("--model", req.model);
+    if (req.effort)
+        argv.push("-c", `model_reasoning_effort=${JSON.stringify(req.effort)}`);
+    return { argv, resultFile };
+}
+export function normalizeCodexResult(raw) {
+    if (raw.exitCode === 127) {
+        return { ok: false, text: "", durationMs: raw.durationMs, error: notFoundError("codex") };
+    }
+    if (raw.exitCode !== 0) {
+        return {
+            ok: false,
+            text: "",
+            durationMs: raw.durationMs,
+            error: `codex exited ${raw.exitCode}: ${(raw.stderr || raw.stdout).slice(0, 500)}`,
+        };
+    }
+    return {
+        ok: true,
+        text: (raw.resultFileText ?? raw.stdout).trim(),
+        durationMs: raw.durationMs,
+    };
+}
+export const codexSpawner = async (req) => {
+    const t0 = Date.now();
+    const outFile = join(tmpdir(), `harnery-codex-${process.pid}-${randomBytes(4).toString("hex")}.txt`);
     try {
-        const r = await exec(argv, {
+        let invocation;
+        try {
+            invocation = buildCodexInvocation(req, outFile);
+        }
+        catch (error) {
+            return { ok: false, text: "", durationMs: 0, error: error.message };
+        }
+        const r = await exec(invocation.argv, {
             cwd: req.cwd,
             env: buildChildEnv(req.runId, { subscriptionOnly: req.subscriptionOnly }),
             timeout: req.timeoutMs,
         });
-        const durationMs = Date.now() - t0;
-        if (r.exitCode === 127) {
-            return { ok: false, text: "", durationMs, error: notFoundError("codex") };
-        }
-        if (r.exitCode !== 0) {
-            return {
-                ok: false,
-                text: "",
-                durationMs,
-                error: `codex exited ${r.exitCode}: ${(r.stderr || r.stdout).slice(0, 500)}`,
-            };
-        }
-        if (!existsSync(outFile)) {
-            // Exit 0 but no last-message file: fall back to stdout (contract drift guard).
-            return { ok: true, text: r.stdout, durationMs };
-        }
-        return { ok: true, text: readFileSync(outFile, "utf8").trim(), durationMs };
+        return normalizeCodexResult({
+            ...r,
+            durationMs: Date.now() - t0,
+            resultFileText: existsSync(outFile) ? readFileSync(outFile, "utf8") : undefined,
+        });
     }
     finally {
         rmSync(outFile, { force: true });

package/dist/core/workflow/spawn-cursor.d.ts

@@ -15,12 +15,15 @@
  * - No per-run cost surface → undefined. No max-turns equivalent → `maxTurns`
  *   accepted and ignored (documented in the CLI docs page).
  */
-import type { Spawner } from "./types.js";
+import type { HarnessInvocation, HarnessRawResult } from "../harnesses/types.js";
+import type { Spawner, SpawnRequest, SpawnResult } from "./types.js";
 /** Exported for unit tests (no live binary to test against). */
 export declare function parseCursorOutput(stdout: string): {
     text: string;
     sessionId?: string;
     isError: boolean;
 };
+export declare function buildCursorInvocation(req: SpawnRequest): HarnessInvocation;
+export declare function normalizeCursorResult(raw: HarnessRawResult): SpawnResult;
 export declare const cursorSpawner: Spawner;
 //# sourceMappingURL=spawn-cursor.d.ts.map

package/dist/core/workflow/spawn-cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,OAAO,EAA6B,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,eAAO,MAAM,aAAa,EAAE,OAwC3B,CAAC"}
+{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAS1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA6BxE;AAED,eAAO,MAAM,aAAa,EAAE,OAe3B,CAAC"}

package/dist/core/workflow/spawn-cursor.js

@@ -16,6 +16,7 @@
  *   accepted and ignored (documented in the CLI docs page).
  */
 import { exec } from "../../lib/exec.js";
+import { validateHarnessEffort } from "../harnesses/profiles.js";
 import { buildChildEnv } from "./child-env.js";
 import { notFoundError } from "./harnesses.js";
 /** Exported for unit tests (no live binary to test against). */
@@ -32,8 +33,8 @@ export function parseCursorOutput(stdout) {
         return { text: stdout, isError: false };
     }
 }
-export const cursorSpawner = async (req) => {
-    const t0 = Date.now();
+export function buildCursorInvocation(req) {
+    validateHarnessEffort("cursor", req.effort);
     // --trust: headless cursor-agent refuses untrusted workspaces (exit 1,
     // "Workspace Trust Required"). Workflow children run in the engine's cwd
     // deliberately and may edit files — the same posture as the codex adapter's
@@ -41,32 +42,50 @@ export const cursorSpawner = async (req) => {
     const argv = ["cursor-agent", "-p", req.prompt, "--output-format", "json", "--trust"];
     if (req.model)
         argv.push("--model", req.model);
-    const r = await exec(argv, {
-        cwd: req.cwd,
-        env: buildChildEnv(req.runId, { subscriptionOnly: req.subscriptionOnly }),
-        timeout: req.timeoutMs,
-    });
-    const durationMs = Date.now() - t0;
-    if (r.exitCode === 127) {
-        return { ok: false, text: "", durationMs, error: notFoundError("cursor") };
+    return { argv };
+}
+export function normalizeCursorResult(raw) {
+    if (raw.exitCode === 127) {
+        return { ok: false, text: "", durationMs: raw.durationMs, error: notFoundError("cursor") };
     }
-    if (r.exitCode !== 0) {
+    if (raw.exitCode !== 0) {
         return {
             ok: false,
             text: "",
-            durationMs,
-            error: `cursor-agent exited ${r.exitCode}: ${(r.stderr || r.stdout).slice(0, 500)}`,
+            durationMs: raw.durationMs,
+            error: `cursor-agent exited ${raw.exitCode}: ${(raw.stderr || raw.stdout).slice(0, 500)}`,
         };
     }
-    const parsed = parseCursorOutput(r.stdout);
+    const parsed = parseCursorOutput(raw.stdout);
     if (parsed.isError) {
         return {
             ok: false,
             text: parsed.text,
             sessionId: parsed.sessionId,
-            durationMs,
+            durationMs: raw.durationMs,
             error: `cursor-agent reported is_error: ${parsed.text.slice(0, 300)}`,
         };
     }
-    return { ok: true, text: parsed.text, sessionId: parsed.sessionId, durationMs };
+    return {
+        ok: true,
+        text: parsed.text,
+        sessionId: parsed.sessionId,
+        durationMs: raw.durationMs,
+    };
+}
+export const cursorSpawner = async (req) => {
+    const t0 = Date.now();
+    let invocation;
+    try {
+        invocation = buildCursorInvocation(req);
+    }
+    catch (error) {
+        return { ok: false, text: "", durationMs: 0, error: error.message };
+    }
+    const r = await exec(invocation.argv, {
+        cwd: req.cwd,
+        env: buildChildEnv(req.runId, { subscriptionOnly: req.subscriptionOnly }),
+        timeout: req.timeoutMs,
+    });
+    return normalizeCursorResult({ ...r, durationMs: Date.now() - t0 });
 };