janissary 0.5.0

package/dist/git-status.js

@@ -0,0 +1,64 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+// `git status` reports paths relative to the repository root, even when run from a subdirectory.
+// When the tree root sits below the repo root, strip that subdirectory prefix so paths come back
+// relative to the tree root (matching the tree's own row paths). `prefix` is the tree root's path
+// within the repo (e.g. `sub/`, always forward-slashed) and is empty when the tree root is the
+// repo root. The `-- .` pathspec already limits results to the subtree, so every path is prefixed.
+function stripPrefix(p, prefix) {
+    return prefix && p.startsWith(prefix) ? p.slice(prefix.length) : p;
+}
+// Split a NUL-terminated `git status --porcelain=v1 -z` payload into the set of changed
+// root-relative paths. Each entry is `XY path` (two status columns, a space, then the path). A
+// rename or copy entry (`R`/`C` in either column) is followed by one extra NUL-terminated field —
+// the original path — which counts as one more changed path; every other entry is a single field.
+function parsePorcelain(stdout, prefix) {
+    const changed = new Set();
+    const fields = stdout.split('\0');
+    for (let i = 0; i < fields.length; i++) {
+        const entry = fields[i];
+        if (!entry)
+            continue;
+        const status = entry.slice(0, 2);
+        changed.add(stripPrefix(entry.slice(3), prefix));
+        if (status.includes('R') || status.includes('C')) {
+            const original = fields[++i];
+            if (original)
+                changed.add(stripPrefix(original, prefix));
+        }
+    }
+    return changed;
+}
+// Given an absolute directory root, resolve to the set of root-relative paths git considers
+// changed — modified, staged, or untracked (all three treated identically). Scoped to `root`'s own
+// subtree via the `-- .` pathspec so opening a tree deep inside a large repo does not pay a
+// full-repository status cost. Resolves to an empty set — never rejects — when `root` is not inside
+// a git repository or the command fails for any reason (git missing, non-zero exit), so a non-git
+// directory renders with no coloring and no error.
+export async function changedPaths(root) {
+    try {
+        const [status, prefix] = await Promise.all([
+            execFileAsync('git', ['status', '--porcelain=v1', '--untracked-files=all', '-z', '--', '.'], { cwd: root }),
+            execFileAsync('git', ['rev-parse', '--show-prefix'], { cwd: root }),
+        ]);
+        return parsePorcelain(status.stdout, prefix.stdout.trim());
+    }
+    catch {
+        return new Set();
+    }
+}
+// Given an absolute directory root, resolve to the name of the currently checked-out branch — the
+// literal string `HEAD` for a detached checkout, matching git's own convention. Resolves to
+// `undefined` — never rejects — when `root` is not inside a git repository or the command fails
+// for any reason, so a non-git directory renders with no branch text and no error.
+export async function currentBranch(root) {
+    try {
+        const { stdout } = await execFileAsync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: root });
+        const branch = stdout.trim();
+        return branch || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/github-token.js

@@ -0,0 +1,19 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+let githubToken;
+// Reads `.janissary/github-token` — a user-provisioned, narrowly-scoped GitHub fine-grained PAT
+// (Contents + Pull requests write, Metadata read) used to authenticate `git push`/`gh` from inside
+// a sandboxed workspace. Absent by default: no token, no injection, workspaces behave as before.
+export function loadGithubToken(projectDir) {
+    const tokenPath = path.join(projectDir, '.janissary', 'github-token');
+    if (!existsSync(tokenPath)) {
+        githubToken = undefined;
+        return githubToken;
+    }
+    const token = readFileSync(tokenPath, 'utf8').trim();
+    githubToken = token || undefined;
+    return githubToken;
+}
+export function getGithubToken() {
+    return githubToken;
+}

package/dist/global-history.js

@@ -0,0 +1,48 @@
+import { mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import path from 'node:path';
+const MAX_ENTRIES = 1000;
+let historyPath = '';
+let entries = [];
+function isHistoryEntry(x) {
+    return (typeof x === 'object' && x !== null &&
+        typeof x.command === 'string' &&
+        typeof x.tab === 'string' &&
+        typeof x.timestamp === 'number');
+}
+export function initGlobalHistory(home) {
+    const base = home ?? homedir();
+    const dir = path.join(base, '.janissary');
+    mkdirSync(dir, { recursive: true });
+    historyPath = path.join(dir, 'history.json');
+    if (!existsSync(historyPath)) {
+        entries = [];
+        writeFileSync(historyPath, '[]');
+        return;
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(historyPath, 'utf8'));
+        entries = Array.isArray(parsed) ? parsed.filter(isHistoryEntry) : [];
+    }
+    catch {
+        entries = [];
+    }
+}
+export function recordGlobalHistory(command, tab) {
+    if (!historyPath)
+        return;
+    if (entries.at(-1)?.command === command)
+        return;
+    entries = [...entries, { command, tab, timestamp: Date.now() }].slice(-MAX_ENTRIES);
+    try {
+        writeFileSync(historyPath, JSON.stringify(entries, null, 2));
+    }
+    catch {
+        // persistence failure is non-fatal; in-memory buffer still works
+    }
+}
+export function globalCommands() {
+    if (!historyPath)
+        return [];
+    return entries.map((e) => e.command);
+}

package/dist/harness/auto-approve.js

@@ -0,0 +1,79 @@
+// How far up from the bottom of the capture the gate menu is allowed to sit. The real permission
+// menu always occupies the final few lines; requiring both anchors inside this window rejects the
+// classic false positive of a session merely *printing* gate-shaped text that has scrolled upward.
+const GATE_WINDOW_LINES = 10;
+// The highlighted default option-1 line, e.g. `❯ 1. Yes` (possibly with trailing text). The `❯`
+// glyph is the highlight marker and is required — a gate always defaults to "Yes".
+function isYesDefaultLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith('❯'))
+        return false;
+    const afterMarker = trimmed.slice('❯'.length).trimStart();
+    if (!afterMarker.startsWith('1.'))
+        return false;
+    return afterMarker.slice('1.'.length).trimStart().startsWith('Yes');
+}
+// A `No` option line, numbered `2.` (two-option gates) or `3.` (three-option gates), tolerating a
+// missing space after the number (the MCP capture rendered `2.Yes` with no space).
+function isNoOptionLine(line) {
+    const trimmed = line.trim();
+    if (!(trimmed.startsWith('2.') || trimmed.startsWith('3.')))
+        return false;
+    return trimmed.slice('2.'.length).trimStart().startsWith('No');
+}
+// claude's permission gate, matched on menu *structure* rather than the (variable) question,
+// footer, or option wording: within the last few lines, a highlighted `❯ 1. Yes` line followed by
+// a later `2. No`/`3. No` line. Deterministic, so false positives stay near-zero.
+function detectClaudeGate(text) {
+    const window = text.split('\n').slice(-GATE_WINDOW_LINES);
+    const yesIndex = window.findIndex((line) => isYesDefaultLine(line));
+    if (yesIndex === -1)
+        return false;
+    return window.slice(yesIndex + 1).some((line) => isNoOptionLine(line));
+}
+// Per-harness gate detectors + approval keystrokes. Only claude is populated today; opencode/codex
+// are deliberate later work (each needs its own captured gate signatures). claude's keystroke is
+// Enter (`\r`), which accepts the highlighted default "Yes" across every captured variant — `y`
+// does not work because these are numbered menus, not y/n prompts.
+const GATE_TABLE = {
+    claude: { detect: detectClaudeGate, keystroke: '\r' },
+};
+// Whether the rendered screen `text` is a recognized permission gate for `harnessName`. Pure and
+// deterministic; any harness without a table entry returns false.
+export function detectPermissionGate(text, harnessName) {
+    const entry = GATE_TABLE[harnessName];
+    return entry ? entry.detect(text) : false;
+}
+// Watches a harness's screen captures and injects the approval keystroke when a permission gate is
+// detected, then reports it. A loop guard prevents re-injecting into an identical, uncleared gate.
+export class HarnessAutoApprover {
+    opts;
+    lastApprovedText;
+    stuckNotified = false;
+    keystroke;
+    constructor(opts) {
+        this.opts = opts;
+        this.keystroke = GATE_TABLE[opts.harnessName]?.keystroke ?? '\r';
+    }
+    // Whether the approver has stood down on a gate it could not clear — the signal busy/ready
+    // tracking uses to badge a gate that still needs the user despite auto-approve being on.
+    get isStuck() { return this.stuckNotified; }
+    onCapture(capture) {
+        if (!detectPermissionGate(capture.text, this.opts.harnessName)) {
+            this.lastApprovedText = undefined;
+            this.stuckNotified = false;
+            return;
+        }
+        if (capture.text === this.lastApprovedText) {
+            if (!this.stuckNotified) {
+                this.stuckNotified = true;
+                this.opts.notify('Auto-approve could not clear the permission prompt; standing down');
+            }
+            return;
+        }
+        this.opts.approve(this.keystroke);
+        this.lastApprovedText = capture.text;
+        this.stuckNotified = false;
+        this.opts.notify('Auto-approved a permission prompt');
+    }
+}

package/dist/harness/busy-status.js

@@ -0,0 +1,91 @@
+import { detectPermissionGate } from './auto-approve.js';
+// claude and codex both animate a Braille spinner glyph (U+2800–U+28FF) at the start of the OSC
+// title while generating; an idle title leads with something else (claude's `✳`, codex's cwd
+// basename). The leading glyph alone is the discriminator.
+function leadsWithBraille(title) {
+    const code = title.codePointAt(0);
+    return code !== undefined && code >= 0x28_00 && code <= 0x28_ff;
+}
+// Shared claude/codex title rule: leading Braille spinner glyph means busy, any other non-empty
+// title means ready. Returns undefined when there is no usable title to classify.
+function classifyTitle(title) {
+    const trimmed = title?.trim();
+    if (!trimmed)
+        return undefined;
+    return leadsWithBraille(trimmed) ? 'busy' : 'ready';
+}
+// claude's rendered-screen fallback for when no title is present: an `esc to interrupt` footer
+// means it is still generating; otherwise a live input prompt box (a `❯` caret line that is not
+// the permission gate's `❯ 1. Yes` option) means it is sitting at its own prompt.
+function classifyClaudeScreen(text) {
+    if (text.includes('esc to interrupt'))
+        return 'busy';
+    const promptBox = text.split('\n').some((line) => {
+        const trimmed = line.trim();
+        return trimmed.startsWith('❯') && !trimmed.slice('❯'.length).trimStart().startsWith('1.');
+    });
+    return promptBox ? 'ready' : 'busy';
+}
+// opencode has no OSC-title state signal (its title is a static app/session name), so busy is
+// recognized from the rendered frame: a progress-bar run of block/dot glyphs, or the interrupt
+// hint footer (rendered `esc interrupt` in 1.17.18, `esc to interrupt` in earlier versions).
+function classifyOpencodeScreen(text) {
+    if (/[■⬝]{4}/.test(text))
+        return 'busy';
+    if (text.includes('esc interrupt') || text.includes('esc to interrupt'))
+        return 'busy';
+    return 'ready';
+}
+// Per-harness busy/ready detectors, keyed by harness name (same shape as auto-approve's
+// GATE_TABLE). A harness without an entry keeps today's coarse behavior — busy for the whole
+// process lifetime. Signals were confirmed against claude 2.1.210, codex-cli 0.144.4, and
+// opencode 1.17.18.
+const BUSY_TABLE = {
+    claude: {
+        classify: (capture) => classifyTitle(capture.title) ?? classifyClaudeScreen(capture.text),
+    },
+    codex: {
+        // codex emitted a title in every observed state; before the first title arrives, stay busy
+        // (matching the busy-at-spawn initial state) rather than guessing from the screen.
+        classify: (capture) => classifyTitle(capture.title) ?? 'busy',
+    },
+    opencode: {
+        classify: (capture) => classifyOpencodeScreen(capture.text),
+    },
+};
+// Classify a capture for `harnessName`, or undefined when the harness has no detector.
+export function classifyBusy(capture, harnessName) {
+    return BUSY_TABLE[harnessName]?.classify(capture);
+}
+// Build the per-tab capture handler that keeps the tab's busy dot in sync with the harness's
+// actual state, or undefined when the harness has no detector (leaving the coarse spawn-to-exit
+// busy behavior untouched). A visible permission gate outranks the busy/ready signals: the
+// harness is idle, blocked on the user, so busy clears immediately — and the tab is badged unread
+// when nothing is going to answer the gate (`approver` missing, or stood down on it). A busy→ready
+// transition is debounced to two consecutive ready captures so a brief mid-generation pause does
+// not flicker the dot off; ready→busy is applied immediately.
+export function busyStatusHandler(name, label, managers, approver) {
+    const entry = BUSY_TABLE[name];
+    if (!entry)
+        return undefined;
+    let pendingReady = false;
+    return (capture) => {
+        if (detectPermissionGate(capture.text, name)) {
+            pendingReady = false;
+            managers.tab.deleteBusy(label);
+            if (!approver || approver.isStuck)
+                managers.tab.markUnread(label);
+            return;
+        }
+        const state = classifyBusy(capture, name);
+        if (state === 'busy') {
+            pendingReady = false;
+            managers.tab.addBusy(label);
+            return;
+        }
+        if (pendingReady)
+            managers.tab.deleteBusy(label);
+        else
+            pendingReady = true;
+    };
+}

package/dist/harness/capture-file.js

@@ -0,0 +1,28 @@
+import { mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import path from 'node:path';
+let captureDirectory = '';
+export function initHarnessCaptureDirectory(projectDirectory) {
+    captureDirectory = path.join(projectDirectory, '.janissary', 'captures');
+}
+export function ensureCaptureDirectory() {
+    mkdirSync(captureDirectory, { recursive: true });
+}
+// Write a screen capture for the tab labeled `label` to `<label>-<capturedAt-iso>.txt` and return
+// the absolute path. The label is sanitized rather than rejected — the tab exists, so its label is
+// legitimate even when it holds filename-hostile characters (`/`, `.`).
+export function writeCaptureFile(label, capturedAt, text) {
+    const safeLabel = label.replaceAll(/[^\w-]/g, '-');
+    const timestamp = new Date(capturedAt).toISOString().replaceAll(/[:.]/g, '-');
+    const file = path.join(captureDirectory, `${safeLabel}-${timestamp}.txt`);
+    ensureCaptureDirectory();
+    writeFileSync(file, text);
+    return file;
+}
+export function clearCaptureDirectory() {
+    if (!captureDirectory)
+        return;
+    try {
+        rmSync(captureDirectory, { recursive: true, force: true });
+    }
+    catch { /* ignore */ }
+}

package/dist/harness/index.js

@@ -0,0 +1,87 @@
+// The embeddable AI coding harnesses, mapped to the binary that launches each. In the web app a
+// harness runs in a PTY rendered as an inline terminal card (see src/server/controller.ts).
+export const HARNESS_COMMANDS = {
+    claude: 'claude',
+    opencode: 'opencode',
+    codex: 'codex',
+};
+export const HARNESS_NAMES = Object.keys(HARNESS_COMMANDS);
+// Find a `--flag <value>` pair anywhere in `tokens`. Returns the value, `undefined` if the flag
+// isn't present, or an error string if the flag is present with no following value.
+function findFlagValue(tokens, flag) {
+    const index = tokens.findIndex((t) => t.toLowerCase() === flag);
+    if (index === -1)
+        return undefined;
+    const value = tokens[index + 1];
+    if (!value)
+        return { error: `Usage: harness <${HARNESS_NAMES.join('|')}> ${flag} <value>.` };
+    return value;
+}
+/**
+ * Parse a `harness <name> [as <label>] [-w|--workspace] [--offline] [-y|--yes] [--model <name>]
+ * [--effort <level>]` command, validating the harness name against the known set. `as <label>`
+ * gives the new tab a custom label instead of the harness name (still de-duplicated against
+ * existing tab labels). `--offline` adds a network-deny rule to the tab's sandbox profile (only
+ * meaningful alongside `-w`/`--workspace`). `-y`/`--yes` auto-approves the harness's own permission
+ * prompts; it is claude-only and requires `-w`/`--workspace` (both are hard errors otherwise).
+ * `--model <name>` selects a model, validated by the caller against the harness's catalog.
+ * `--effort <level>` selects an effort level, passed through verbatim with no validation.
+ * `harness capture <name>` is the other form: `<name>` targets an existing harness tab by label
+ * (`capture` can never collide with a harness name — it is not a HARNESS_COMMANDS key).
+ */
+export function parseHarnessCommand(input) {
+    const rest = input.replace(/^harness\b\s*/i, '').trim();
+    if (!rest)
+        return { error: `Usage: harness <${HARNESS_NAMES.join('|')}> [as <label>] [-w] [-y].` };
+    const tokens = rest.split(/\s+/);
+    if (tokens[0].toLowerCase() === 'capture') {
+        const label = tokens[1];
+        if (!label)
+            return { error: 'Usage: harness capture <name>.' };
+        return { capture: true, label };
+    }
+    const name = tokens[0].toLowerCase();
+    if (HARNESS_COMMANDS[name] === undefined) {
+        return { error: `Unknown harness "${name}". Choose from: ${HARNESS_NAMES.join(', ')}.` };
+    }
+    const rest_ = tokens.slice(1);
+    const workspace = rest_.some((t) => t === '-w' || t === '--workspace');
+    const offline = rest_.some((t) => t.toLowerCase() === '--offline');
+    const autoApprove = rest_.some((t) => t === '-y' || t === '--yes');
+    // Claude-only comes first: adding -w would not make `harness opencode -y` valid, so pointing at
+    // -w would misdirect — the harness choice is the real blocker.
+    if (autoApprove && name !== 'claude')
+        return { error: '-y/--yes is only supported for the claude harness.' };
+    if (autoApprove && !workspace)
+        return { error: '-y/--yes requires -w/--workspace: auto-approval is only allowed in a sandboxed workspace.' };
+    const model = findFlagValue(rest_, '--model');
+    if (model !== undefined && typeof model !== 'string')
+        return model;
+    const effort = findFlagValue(rest_, '--effort');
+    if (effort !== undefined && typeof effort !== 'string')
+        return effort;
+    const asIndex = rest_.findIndex((t) => t.toLowerCase() === 'as');
+    if (asIndex === -1)
+        return { name, workspace, offline, autoApprove, model, effort };
+    const label = rest_[asIndex + 1];
+    if (!label)
+        return { error: `Usage: harness <${HARNESS_NAMES.join('|')}> as <label>.` };
+    return { name, workspace, offline, autoApprove, model, effort, label };
+}
+// Single-quote a value for embedding in a `shell -lc '<command>'` string, escaping any embedded
+// single quotes (`'` → `'\''`).
+function shellQuote(value) {
+    return `'${value.replaceAll("'", String.raw `'\''`)}'`;
+}
+// Build the shell command string that launches a harness binary, optionally with a model and/or
+// effort flag. `buildHarnessCommand('opencode', 'opencode-go/deepseek-v4-pro', 'high')` →
+// `opencode --model 'opencode-go/deepseek-v4-pro' --effort 'high'`.
+export function buildHarnessCommand(name, model, effort) {
+    const program = HARNESS_COMMANDS[name];
+    const parts = [program];
+    if (model)
+        parts.push(`--model ${shellQuote(model)}`);
+    if (effort)
+        parts.push(`--effort ${shellQuote(effort)}`);
+    return parts.join(' ');
+}

package/dist/harness/manager.js

@@ -0,0 +1,182 @@
+import { makeHarnessTab, distinctColor, uniqueLabel } from '../tab/index.js';
+import { parseHarnessCommand, HARNESS_COMMANDS, buildHarnessCommand } from './index.js';
+import { isKnownModel } from './models.js';
+import { HarnessScreenReader } from './screen.js';
+import { HarnessRecorder } from './recorder.js';
+import { HarnessAutoApprover } from './auto-approve.js';
+import { busyStatusHandler } from './busy-status.js';
+import { writeCaptureFile } from './capture-file.js';
+import { messageBus } from '../bus.js';
+import { notify } from '../notifications.js';
+import { sandboxNotice } from '../sandbox/index.js';
+// Owns harness command handling: launching a harness `<name>` as a PTY-backed tab (optionally in a
+// fresh `--workspace` git clone, and optionally under a custom `as <label>`) and naming it uniquely.
+// The controller owns the shared tab and PTY state; this module owns the harness-specific decisions
+// and wiring.
+export class HarnessManager {
+    managers;
+    screenReaders = new Map();
+    recorders = new Map();
+    autoApprovers = new Map();
+    constructor(managers) {
+        this.managers = managers;
+        messageBus.on('pty', 'exit', (event) => {
+            if (event.type !== 'exit')
+                return;
+            this.screenReaders.get(event.id)?.dispose();
+            this.screenReaders.delete(event.id);
+            this.recorders.get(event.id)?.dispose();
+            this.recorders.delete(event.id);
+            this.autoApprovers.delete(event.id);
+        });
+    }
+    // The named harness tab's most recent rendered-screen capture, or undefined when the tab is
+    // missing, is not a harness tab, or has no capture yet. Exposes the screen reader's rendered
+    // text (the coherent, de-ANSI'd form) to monitors without exposing the reader map.
+    latestScreenText(label) {
+        const tab = this.managers.tab.tabs.find((t) => t.label === label);
+        if (!tab?.harness)
+            return undefined;
+        return this.screenReaders.get(tab.harness.ptyId)?.latestCapture();
+    }
+    // Register a screen reader for a PTY this manager did not spawn itself (currently: ssh tabs,
+    // which reuse the harness-view tab shape but spawn their PTY directly via SshManager). No
+    // capture handler — auto-approve and busy detection are harness-specific and don't apply.
+    registerScreenReader(id) {
+        const dims = this.managers.pty.spawnDimensions();
+        this.screenReaders.set(id, new HarnessScreenReader(id, dims.cols, dims.rows));
+    }
+    // Handle a `harness <name> [as <label>] [-w] [--offline] [--model <name>] [--effort <level>]`
+    // command. Returns an error message to surface in the creator's transcript, or undefined once
+    // the harness tab has been opened.
+    run(input) {
+        const parsed = parseHarnessCommand(input);
+        if ('error' in parsed)
+            return parsed.error;
+        if ('capture' in parsed)
+            return this.capture(input, parsed.label);
+        if (parsed.model && !isKnownModel(parsed.name, parsed.model)) {
+            return `Unknown model "${parsed.model}" for harness "${parsed.name}" — add it to harness-models.json.`;
+        }
+        return this.open(parsed.name, parsed.workspace, parsed.offline, parsed.autoApprove, parsed.label, parsed.model, parsed.effort);
+    }
+    // Handle `harness capture <name>`: write the target tab's latest in-memory screen capture to a
+    // file under .janissary/captures/ and open it in a normal editor tab. Returns an error message
+    // to surface in the invoking tab's transcript, or undefined on success.
+    capture(input, label) {
+        const tab = this.managers.tab.tabs.find((t) => t.label === label);
+        if (!tab)
+            return `No tab labeled "${label}".`;
+        if (!tab.harness)
+            return `"${label}" is not a harness tab.`;
+        const latest = this.screenReaders.get(tab.harness.ptyId)?.latestCapture();
+        if (!latest)
+            return `No capture available for "${label}" yet.`;
+        const file = writeCaptureFile(label, latest.capturedAt, latest.text);
+        this.managers.openFile.edit(input, file, this.managers.tab.cur().label);
+        return undefined;
+    }
+    // Open (and focus) a harness tab running `name`, labeled `label` if given (otherwise `name`).
+    // With `workspace`, the harness starts in a fresh clone of the `origin` remote of the repo
+    // detected from cwd; otherwise it inherits the creator's cwd.
+    open(name, workspace, offline, autoApprove, label_, model, effort) {
+        const creator = this.managers.tab.cur();
+        const label = uniqueLabel(this.managers.tab.tabs, label_ ?? name);
+        const dir = this.parseDir(this.resolveCwd(workspace, label, this.managers.tab.cwdOf(creator.label) ?? process.cwd()));
+        if (typeof dir === 'string')
+            return dir;
+        const { cwd, workspaceDir } = dir;
+        const dotColor = distinctColor(this.managers.tab.tabs.map((t) => t.dotColor));
+        const group = creator?.group ?? 1;
+        const groupColor = creator?.groupColor ?? dotColor;
+        this.spawnTab(name, label, cwd, workspaceDir, offline, group, groupColor, dotColor, autoApprove, model, effort);
+        return undefined;
+    }
+    // Open a harness tab for a profile entry: unlike `open()`, the group/color come from the
+    // profile launch (not the creator tab) and the starting directory comes from the entry's own
+    // `cwd`/`workspace` (falling back to the issuing tab's cwd when the entry has neither). Returns
+    // an error to report and skip on, or undefined once the tab is open. Never persisted — harness
+    // tabs have no agent state.
+    openFromProfile(entry, label, group, groupColor) {
+        const unique = uniqueLabel(this.managers.tab.tabs, label);
+        const dir = this.parseDir(this.resolveCwd(!!entry.workspace, unique, entry.cwd ?? process.cwd()));
+        if (typeof dir === 'string')
+            return dir;
+        const { cwd, workspaceDir } = dir;
+        const dotColor = distinctColor(this.managers.tab.tabs.map((t) => t.dotColor), entry.dotColor);
+        this.spawnTab(entry.harness, unique, cwd, workspaceDir, entry.offline ?? false, group, groupColor, dotColor, entry.autoApprove ?? false, entry.model, entry.effort);
+        return undefined;
+    }
+    // Shared core: create the harness tab, focus it, and spawn its PTY. `model`/`effort`, when
+    // given, are passed to the harness binary via `buildHarnessCommand`.
+    spawnTab(name, label, cwd, workspaceDir, offline, group, groupColor, dotColor, autoApprove, model, effort) {
+        const program = HARNESS_COMMANDS[name];
+        const harness = { name, program, ptyId: '', status: 'running' };
+        const tab = makeHarnessTab(label, dotColor, this.managers.tab.tabs.length + 1, group, groupColor, harness, workspaceDir);
+        tab.offline = offline;
+        tab.autoApprove = autoApprove;
+        this.managers.tab.insertTabInGroup(tab);
+        this.managers.tab.setCwd(label, cwd);
+        this.managers.tab.addBusy(label);
+        this.managers.tab.activeTab = this.managers.tab.findIndex(tab.label);
+        const id = this.managers.pty.spawn(label, program, buildHarnessCommand(name, model, effort), cwd, workspaceDir, offline);
+        const dims = this.managers.pty.spawnDimensions();
+        this.screenReaders.set(id, new HarnessScreenReader(id, dims.cols, dims.rows, this.captureHandler(name, label, id, autoApprove)));
+        this.recorders.set(id, new HarnessRecorder(id, label, program, dims.cols, dims.rows));
+        const liveTab = this.managers.tab.tabs.find((t) => t.label === label);
+        if (liveTab?.harness)
+            liveTab.harness.ptyId = id;
+        const notice = workspaceDir ? sandboxNotice() : undefined;
+        if (notice)
+            this.managers.tab.append(label, { input: '', output: notice });
+        messageBus.emit('state', { type: 'dirty' });
+    }
+    // Build the screen-reader callback that feeds each fresh capture to whichever consumers apply:
+    // the auto-approver (when `autoApprove` is on) and the busy/ready status handler (when the
+    // harness has a detector). The approver runs first so the busy handler reads its stuck state as
+    // of the same capture. Returns undefined when neither applies, so the reader runs exactly as it
+    // would with no consumers.
+    captureHandler(name, label, id, autoApprove) {
+        const approver = this.buildAutoApprover(name, label, id, autoApprove);
+        const busyHandler = busyStatusHandler(name, label, this.managers, approver);
+        if (!approver && !busyHandler)
+            return undefined;
+        return (capture) => {
+            approver?.onCapture(capture);
+            busyHandler?.(capture);
+        };
+    }
+    // When `autoApprove` is on, build the tab's auto-approver and register it under the PTY id;
+    // otherwise return undefined. The approver injects the approval keystroke back into this PTY
+    // and reports each approval to the notifications feed (label-free — `notify` prefixes the tab
+    // label).
+    buildAutoApprover(name, label, id, autoApprove) {
+        if (!autoApprove)
+            return undefined;
+        const approver = new HarnessAutoApprover({
+            harnessName: name,
+            approve: (keystroke) => this.managers.pty.input(id, keystroke),
+            notify: (message) => notify(this.managers, 'auto-approve', label, message),
+        });
+        this.autoApprovers.set(id, approver);
+        return approver;
+    }
+    // Parse `resolveCwd`'s result into a clean `{ cwd, workspaceDir }` or return the error string.
+    parseDir(resolved) {
+        if (typeof resolved !== 'string' && 'error' in resolved)
+            return resolved.error;
+        return {
+            cwd: typeof resolved === 'string' ? resolved : resolved.dir,
+            workspaceDir: typeof resolved === 'string' ? undefined : resolved.dir,
+        };
+    }
+    // The harness's starting directory: a new workspace clone (with `workspace`) or `fallbackCwd`.
+    // Returns the directory, or an `{ error }` to surface when there's no repo or the clone fails.
+    // A workspace clone is returned as `{ dir }` (not a bare string) so the caller can tell it apart
+    // from the fallback cwd and record it on the tab for cleanup on close.
+    resolveCwd(workspace, label, fallbackCwd) {
+        if (!workspace)
+            return fallbackCwd;
+        return this.managers.workspace.create(label);
+    }
+}

package/dist/harness/models.js

@@ -0,0 +1,8 @@
+import catalog from '../../harness-models.json' with { type: 'json' };
+const models = catalog;
+export function modelsFor(harness) {
+    return models[harness] ?? [];
+}
+export function isKnownModel(harness, model) {
+    return modelsFor(harness).includes(model);
+}