remote-codex 0.11.12 → 0.11.13

package/apps/supervisor-api/dist/{chunk-TQUNANIS.js → chunk-ZTQPMDTP.js}

@@ -98,6 +98,7 @@ var envSchema = z.object({
   ELAGENTE_HARNESS_BASE_URL: z.string().url().optional(),
   INACT_X_APP_KEY: z.string().min(1).optional(),
   REMOTE_CODEX_CHEMISTRY_TOOLS_ENABLED: z.string().optional(),
+  REMOTE_CODEX_HARNESS_WAKEUP_CALLBACK_BASE_URL: z.string().url().optional(),
   REMOTE_CODEX_WORKER_RUNTIME_MANIFEST: z.string().min(1).optional(),
   APP_NAME: z.string().min(1).optional(),
   APP_VERSION: z.string().min(1).optional(),
@@ -209,6 +210,7 @@ function loadRuntimeConfig(env = process.env) {
     harnessBaseUrl: parsed.ELAGENTE_HARNESS_BASE_URL ?? null,
     harnessEnabled: Boolean(parsed.ELAGENTE_HARNESS_BASE_URL && parsed.INACT_X_APP_KEY),
     chemistryToolsEnabled: parseBoolean(parsed.REMOTE_CODEX_CHEMISTRY_TOOLS_ENABLED, false),
+    harnessWakeupCallbackBaseUrl: parsed.REMOTE_CODEX_HARNESS_WAKEUP_CALLBACK_BASE_URL?.replace(/\/+$/, "") ?? null,
     workerRuntimeManifestPath: parsed.REMOTE_CODEX_WORKER_RUNTIME_MANIFEST ? path.resolve(parsed.REMOTE_CODEX_WORKER_RUNTIME_MANIFEST) : runtimeRole === "worker" ? "/opt/remote-codex/worker-runtime-manifest.json" : null,
     appName: parsed.APP_NAME ?? (runtimeRole === "worker" ? "Remote Codex Worker" : "Remote Codex Supervisor"),
     appVersion: parsed.APP_VERSION ?? "0.1.0",
@@ -6390,6 +6392,8 @@ __export(schema_exports, {
   controlUsageImportState: () => controlUsageImportState,
   controlUsers: () => controlUsers,
   controlWorkspaces: () => controlWorkspaces,
+  harnessJobWatches: () => harnessJobWatches,
+  harnessNotifyRegistrations: () => harnessNotifyRegistrations,
   hosts: () => hosts,
   notifications: () => notifications,
   policies: () => policies,
@@ -6855,6 +6859,33 @@ var controlAuditLogs = sqliteTable("control_audit_logs", {
   metadataJson: text("metadata_json").notNull(),
   createdAt: text("created_at").notNull()
 });
+var harnessNotifyRegistrations = sqliteTable("harness_notify_registrations", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull(),
+  hookToken: text("hook_token").notNull(),
+  secret: text("secret").notNull(),
+  callbackUrl: text("callback_url").notNull(),
+  registeredAt: text("registered_at").notNull(),
+  updatedAt: text("updated_at").notNull()
+});
+var harnessJobWatches = sqliteTable(
+  "harness_job_watches",
+  {
+    id: text("id").primaryKey(),
+    jobId: text("job_id").notNull(),
+    threadId: text("thread_id").notNull(),
+    title: text("title"),
+    status: text("status").notNull().default("pending"),
+    lastJobStatus: text("last_job_status"),
+    lastError: text("last_error"),
+    createdAt: text("created_at").notNull(),
+    updatedAt: text("updated_at").notNull(),
+    deliveredAt: text("delivered_at")
+  },
+  (table) => ({
+    jobIdUnique: uniqueIndex("harness_job_watches_job_id_idx").on(table.jobId)
+  })
+);
 
 // ../../packages/db/src/client.ts
 function resolvePlatform() {
@@ -7394,6 +7425,72 @@ function deleteNotificationsByThreadId(db, threadId) {
 function deleteWorkspaceRecord(db, id) {
   db.delete(workspaces).where(eq(workspaces.id, id)).run();
 }
+function getHarnessNotifyRegistration(db) {
+  return db.select().from(harnessNotifyRegistrations).where(eq(harnessNotifyRegistrations.id, "default")).get();
+}
+function upsertHarnessNotifyRegistration(db, input) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const existing = getHarnessNotifyRegistration(db);
+  if (existing) {
+    db.update(harnessNotifyRegistrations).set({
+      agentId: input.agentId,
+      hookToken: input.hookToken,
+      secret: input.secret,
+      callbackUrl: input.callbackUrl,
+      updatedAt: now
+    }).where(eq(harnessNotifyRegistrations.id, "default")).run();
+    return getHarnessNotifyRegistration(db);
+  }
+  const record = {
+    id: "default",
+    agentId: input.agentId,
+    hookToken: input.hookToken,
+    secret: input.secret,
+    callbackUrl: input.callbackUrl,
+    registeredAt: now,
+    updatedAt: now
+  };
+  db.insert(harnessNotifyRegistrations).values(record).run();
+  return record;
+}
+function getHarnessJobWatchByJobId(db, jobId) {
+  return db.select().from(harnessJobWatches).where(eq(harnessJobWatches.jobId, jobId)).get();
+}
+function listHarnessJobWatches(db) {
+  return db.select().from(harnessJobWatches).orderBy(desc(harnessJobWatches.createdAt)).all();
+}
+function listPendingHarnessJobWatches(db) {
+  return db.select().from(harnessJobWatches).where(eq(harnessJobWatches.status, "pending")).all();
+}
+function upsertHarnessJobWatch(db, input) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const existing = getHarnessJobWatchByJobId(db, input.jobId);
+  if (existing) {
+    db.update(harnessJobWatches).set({
+      threadId: input.threadId,
+      title: input.title ?? existing.title,
+      updatedAt: now
+    }).where(eq(harnessJobWatches.id, existing.id)).run();
+    return getHarnessJobWatchByJobId(db, input.jobId);
+  }
+  const record = {
+    id: randomUUID(),
+    jobId: input.jobId,
+    threadId: input.threadId,
+    title: input.title ?? null,
+    status: "pending",
+    lastJobStatus: null,
+    lastError: null,
+    createdAt: now,
+    updatedAt: now,
+    deliveredAt: null
+  };
+  db.insert(harnessJobWatches).values(record).run();
+  return record;
+}
+function updateHarnessJobWatch(db, id, input) {
+  db.update(harnessJobWatches).set({ ...input, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(harnessJobWatches.id, id)).run();
+}
 
 // ../../packages/db/src/seed.ts
 var defaultPolicies = [
@@ -16200,6 +16297,15 @@ function parseUuidV7Timestamp2(id) {
   }
   return new Date(millis).toISOString();
 }
+function normalizeHistoryItemCreatedAt(item, fallback) {
+  if (item.createdAt) {
+    return item;
+  }
+  return {
+    ...item,
+    createdAt: parseUuidV7Timestamp2(item.id) ?? fallback
+  };
+}
 function summarizeText(text2, fallback) {
   const lines = text2.replace(/\r\n/g, "\n").split("\n");
   while (lines.length > 1 && lines.at(-1)?.trim() === "") {
@@ -16552,13 +16658,17 @@ function mergePersistedHistoryItemsIntoTurns(turns, persistedItemsByTurnId, defe
   });
 }
 function agentTurnToThreadTurnDto(turn, deferredDetails) {
+  const startedAt = turn.startedAt ?? parseUuidV7Timestamp2(turn.providerTurnId);
   const baseTurn = {
     id: turn.providerTurnId,
-    startedAt: turn.startedAt ?? parseUuidV7Timestamp2(turn.providerTurnId),
+    startedAt,
     status: turn.status,
     error: turn.error?.message ?? null,
     items: visibleRuntimeTurnItems(turn.items).map(
-      (item, transcriptIndex) => item.transcriptOrder === transcriptIndex ? item : { ...item, transcriptOrder: transcriptIndex }
+      (item, transcriptIndex) => normalizeHistoryItemCreatedAt(
+        item.transcriptOrder === transcriptIndex ? item : { ...item, transcriptOrder: transcriptIndex },
+        startedAt
+      )
     )
   };
   return deferredDetails ? deferLargeHistoryItemDetails(baseTurn, deferredDetails) : baseTurn;
@@ -21005,11 +21115,18 @@ function harnessDeveloperInstructions(config) {
     return null;
   }
   const baseUrl = config.harnessBaseUrl.replace(/\/+$/, "");
-  return [
+  const lines = [
     `ElAgente Harness chemistry tools are available at ${baseUrl}.`,
     "For chemistry tasks, call its HTTP API directly using the sandbox env var INACT_X_APP_KEY as the x-api-key header; never print or expose that key.",
     "Discover tools with GET /, GET /farmaco/tools, GET /farmaco/.help, GET /quntur/tools, or GET /estructural/tools; invoke approved tools with POST /{module}/tools/{tool} using JSON input."
-  ].join(" ");
+  ];
+  if (config.harnessWakeupCallbackBaseUrl) {
+    const supervisorBaseUrl = `http://127.0.0.1:${config.port}`;
+    lines.push(
+      `For long-running compute jobs you do not need to stay running: first GET ${supervisorBaseUrl}/api/harness/wakeup and read "notifyTo"; submit the job with "notify_to" set to that value. If you submit directly to Harness rather than through the Remote Codex Harness invoke proxy, immediately register POST ${supervisorBaseUrl}/api/harness/job-watches with JSON {"jobId": "<job id>"}. After that you may end your turn; this thread is woken with a new message when the job reaches a terminal status.`
+    );
+  }
+  return lines.join(" ");
 }
 function combineDeveloperInstructions(parts) {
   const normalized = parts.map((part) => part?.trim()).filter((part) => Boolean(part));
@@ -22690,6 +22807,14 @@ var harnessToolParamSchema = harnessModuleParamSchema.extend({
   tool: z4.string().trim().min(1).max(160).regex(/^[a-zA-Z0-9_-]+$/)
 });
 var harnessInvokeBodySchema = z4.record(z4.string(), z4.unknown());
+var harnessJobWatchBodySchema = z4.object({
+  jobId: z4.string().trim().min(1).max(200).regex(/^[a-zA-Z0-9_.:-]+$/),
+  threadId: z4.string().trim().min(1).max(200).optional(),
+  title: z4.string().trim().min(1).max(300).optional()
+});
+var harnessHookParamSchema = z4.object({
+  token: z4.string().trim().min(1).max(200).regex(/^[a-zA-Z0-9_-]+$/)
+});
 var harnessInvokeContextSchema = z4.object({
   workspaceId: z4.string().uuid().nullable().optional(),
   sessionId: z4.string().uuid().nullable().optional(),
@@ -23033,6 +23158,19 @@ async function registerSystemRoutes(app) {
           metadata: harnessUsageMetadata(payload, attributionSource)
         }).catch(() => void 0);
       }
+      const invokeJobId = stringField2(result, ["job_id", "jobId", "compute_job_id", "computeJobId"]);
+      if (invokeJobId && context.threadId && app.services.harnessWakeupService.enabled()) {
+        await app.services.harnessWakeupService.watchJob({
+          jobId: invokeJobId,
+          threadId: context.threadId,
+          title: `${params.module}/${params.tool}`
+        }).catch((watchError) => {
+          request.log.warn(
+            { err: watchError, jobId: invokeJobId },
+            "Harness wakeup auto-watch failed."
+          );
+        });
+      }
       return payload;
     } catch (error) {
       if (error instanceof HttpError) {
@@ -23044,6 +23182,68 @@ async function registerSystemRoutes(app) {
       });
     }
   });
+  app.get("/api/harness/wakeup", async () => {
+    try {
+      return await app.services.harnessWakeupService.getWakeupInfo();
+    } catch (error) {
+      if (error instanceof HttpError) {
+        throw error;
+      }
+      throw new HttpError(503, {
+        code: "harness_unavailable",
+        message: error instanceof Error ? error.message : "ElAgenteHarness is unavailable."
+      });
+    }
+  });
+  app.get("/api/harness/job-watches", async () => {
+    return {
+      watches: listHarnessJobWatches(app.services.database.db)
+    };
+  });
+  app.post("/api/harness/job-watches", async (request, reply) => {
+    const body = harnessJobWatchBodySchema.parse(request.body ?? {});
+    try {
+      const result = await app.services.harnessWakeupService.watchJob({
+        jobId: body.jobId,
+        threadId: body.threadId ?? null,
+        title: body.title ?? null
+      });
+      reply.status(201);
+      return result;
+    } catch (error) {
+      if (error instanceof HttpError) {
+        throw error;
+      }
+      throw new HttpError(503, {
+        code: "harness_unavailable",
+        message: error instanceof Error ? error.message : "ElAgenteHarness is unavailable."
+      });
+    }
+  });
+  app.register(async (hookApp) => {
+    hookApp.addContentTypeParser(
+      ["application/json", "text/plain"],
+      { parseAs: "buffer" },
+      (_request, body, done) => done(null, body)
+    );
+    hookApp.addContentTypeParser(
+      "*",
+      { parseAs: "buffer" },
+      (_request, body, done) => done(null, body)
+    );
+    hookApp.post("/api/hooks/harness-notify/:token", async (request, reply) => {
+      const params = harnessHookParamSchema.parse(request.params);
+      const signatureHeader = request.headers["x-webhook-signature"];
+      const rawBody = Buffer.isBuffer(request.body) ? request.body : Buffer.from(typeof request.body === "string" ? request.body : "");
+      const result = app.services.harnessWakeupService.handleCallback({
+        hookToken: params.token,
+        rawBody,
+        signature: typeof signatureHeader === "string" ? signatureHeader : null
+      });
+      reply.status(202);
+      return result;
+    });
+  });
   app.get("/api/config/workspace-settings", async () => {
     return getWorkspaceSettings(
       app.services.database.db,
@@ -25929,13 +26129,13 @@ var terminalPluginManifest = {
   }
 };
 
-// ../../node_modules/.pnpm/@remote-codex+plugin-xyz-viewer@file+..+remote-codex-thread-ui+packages+plugin-xyz-view_5227bf80a742872b523d08ba646669ff/node_modules/@remote-codex/plugin-xyz-viewer/dist/chunk-6FS7BLJV.js
+// src/plugins/xyz-viewer-plugin-manifest.ts
 var XYZ_MOLECULE_ARTIFACT_TYPE = "chemistry.molecule3d";
 var xyzViewerPluginManifest = {
   id: "remote-codex.xyz-viewer",
   name: "XYZ Molecule Viewer",
   version: "0.1.0",
-  description: "A draft built-in plugin for previewing xyz, extxyz, cif, and pdb molecular structures with 3Dmol.js.",
+  description: "A built-in plugin for previewing xyz, extxyz, cif, and pdb molecular structures.",
   remoteCodex: "^0.11.0",
   capabilities: {
     artifactTypes: [
@@ -25966,11 +26166,7 @@ var xyzViewerPluginManifest = {
         command: "node",
         args: ["bin/remote-codex-plugin-mcp.mjs"]
       }
-    ],
-    frontend: {
-      entry: "./dist/index.js",
-      style: "./src/styles.css"
-    }
+    ]
   }
 };
 
@@ -27496,6 +27692,9 @@ function makeShellErrorEnvelope(shellId, error) {
 var HARNESS_MODULES = ["estructural", "quntur", "farmaco"];
 var HARNESS_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
 var HARNESS_RUN_ID_PATTERN = /^[a-zA-Z0-9_.-]+$/;
+var HARNESS_JOB_ID_PATTERN = /^[a-zA-Z0-9_.:-]+$/;
+var HARNESS_NOTIFICATION_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
+var HARNESS_TERMINAL_JOB_STATUSES = /* @__PURE__ */ new Set(["done", "failed", "cancelled"]);
 var MOLECULE_ARTIFACT_TYPES = /* @__PURE__ */ new Set(["xyz", "extxyz", "pdb", "cif"]);
 function recordFrom(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -27615,6 +27814,51 @@ function normalizeArtifact(module, runId, value) {
     previewKind: artifactPreviewKind(type, format, path27)
   };
 }
+function parseTomlScalar(raw) {
+  const value = raw.trim();
+  if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+    try {
+      return JSON.parse(value);
+    } catch {
+      return value.slice(1, -1);
+    }
+  }
+  return value;
+}
+function parseTomlLines(text2) {
+  const record = {};
+  for (const line of text2.split("\n")) {
+    const match = /^([A-Za-z0-9_]+)\s*=\s*(.+)$/.exec(line.trim());
+    if (match && !(match[1] in record)) {
+      record[match[1]] = parseTomlScalar(match[2]);
+    }
+  }
+  return record;
+}
+function parseTomlBlocks(text2, blockName) {
+  const marker = `[[${blockName}]]`;
+  const blocks = [];
+  let current = null;
+  for (const line of text2.split("\n")) {
+    if (line.trim() === marker) {
+      if (current) {
+        blocks.push(parseTomlLines(current.join("\n")));
+      }
+      current = [];
+      continue;
+    }
+    if (line.trim().startsWith("[[") && current) {
+      blocks.push(parseTomlLines(current.join("\n")));
+      current = null;
+      continue;
+    }
+    current?.push(line);
+  }
+  if (current) {
+    blocks.push(parseTomlLines(current.join("\n")));
+  }
+  return blocks;
+}
 function normalizeRuns(module, result) {
   const runs = payloadItems(result.payload, ["runs", "items", "results"]).map((item) => normalizeRun(module, item)).filter(Boolean);
   return { runs };
@@ -27658,6 +27902,57 @@ var WorkerHarnessClient = class {
   async me() {
     return this.fetchText("/members/.me");
   }
+  async whoami() {
+    const { text: text2 } = await this.fetchText("/members/.me");
+    const record = parseTomlLines(text2);
+    const agentId = record.id?.trim();
+    if (!agentId) {
+      throw new Error("ElAgenteHarness /members/.me response did not include an id.");
+    }
+    return { agentId };
+  }
+  async registerNotifyCallback(input) {
+    return this.fetchPayload("/notify/register", {
+      method: "POST",
+      headers: {
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        agent_id: input.agentId,
+        callback: input.callback,
+        secret: input.secret
+      })
+    });
+  }
+  async getComputeJob(jobId) {
+    const id = this.requireJobId(jobId);
+    const { text: text2 } = await this.fetchText(`/compute/jobs/${encodeURIComponent(id)}`);
+    const record = parseTomlLines(text2);
+    const status = record.status?.trim() ?? null;
+    return {
+      jobId: record.id?.trim() ?? id,
+      status,
+      terminal: status !== null && HARNESS_TERMINAL_JOB_STATUSES.has(status),
+      title: record.title?.trim() || null,
+      reason: record.reason?.trim() || null,
+      raw: record
+    };
+  }
+  async listUnreadNotifications() {
+    const { text: text2 } = await this.fetchText("/notify/inbox");
+    return parseTomlBlocks(text2, "notifications").filter((entry) => entry.id?.trim()).map((entry) => ({
+      id: entry.id.trim(),
+      from: entry.from?.trim() ?? "",
+      message: entry.message ?? ""
+    }));
+  }
+  async markNotificationRead(notificationId) {
+    const id = notificationId.trim();
+    if (!HARNESS_NOTIFICATION_ID_PATTERN.test(id)) {
+      throw new Error(`Unsupported Harness notification id: ${notificationId}`);
+    }
+    return this.fetchText(`/notify/inbox/${encodeURIComponent(id)}`);
+  }
   async home() {
     return this.fetchPayload("/");
   }
@@ -27724,6 +28019,13 @@ var WorkerHarnessClient = class {
     }
     return normalized;
   }
+  requireJobId(jobId) {
+    const normalized = jobId.trim();
+    if (!HARNESS_JOB_ID_PATTERN.test(normalized)) {
+      throw new Error(`Unsupported Harness job id: ${jobId}`);
+    }
+    return normalized;
+  }
   requireRunId(runId) {
     const normalized = runId.trim();
     if (!HARNESS_RUN_ID_PATTERN.test(normalized)) {
@@ -27797,6 +28099,297 @@ var WorkerHarnessClient = class {
   }
 };
 
+// src/harness-wakeup-service.ts
+import crypto3 from "crypto";
+var JOB_ID_FROM_MESSAGE_PATTERN = /^id:\s*(\S+)\s*$/m;
+function timingSafeEqualString2(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  return leftBuffer.length === rightBuffer.length && crypto3.timingSafeEqual(leftBuffer, rightBuffer);
+}
+var HarnessWakeupService = class {
+  constructor(config, db, harnessClient, threadService, logger) {
+    this.config = config;
+    this.db = db;
+    this.harnessClient = harnessClient;
+    this.threadService = threadService;
+    this.logger = logger;
+  }
+  config;
+  db;
+  harnessClient;
+  threadService;
+  logger;
+  reconcileInFlight = null;
+  reconcileQueued = false;
+  disabledReasonFor(keyPresent) {
+    if (!this.config.harnessBaseUrl) {
+      return "missing_harness_base_url";
+    }
+    if (!keyPresent) {
+      return "missing_harness_key";
+    }
+    if (!this.config.harnessWakeupCallbackBaseUrl) {
+      return "missing_callback_base_url";
+    }
+    return null;
+  }
+  disabledReason() {
+    return this.disabledReasonFor(this.harnessClient.configured().keyPresent);
+  }
+  status() {
+    const keyPresent = this.harnessClient.configured().keyPresent;
+    const reason = this.disabledReasonFor(keyPresent);
+    return {
+      enabled: reason === null,
+      reason,
+      harnessBaseUrl: this.config.harnessBaseUrl,
+      callbackBaseUrl: this.config.harnessWakeupCallbackBaseUrl,
+      keyPresent
+    };
+  }
+  enabled() {
+    return this.disabledReason() === null;
+  }
+  requireEnabled() {
+    if (!this.enabled()) {
+      throw new HttpError(409, {
+        code: "conflict",
+        message: "Harness wakeup is not configured. REMOTE_CODEX_HARNESS_WAKEUP_CALLBACK_BASE_URL and the Harness key are required."
+      });
+    }
+  }
+  buildCallbackUrl(hookToken) {
+    const base = this.config.harnessWakeupCallbackBaseUrl.replace(/\/+$/, "");
+    const userSuffix = this.config.userId ? `?u=${encodeURIComponent(this.config.userId)}` : "";
+    return `${base}/harness-notify/${hookToken}${userSuffix}`;
+  }
+  async ensureRegistration() {
+    this.requireEnabled();
+    const existing = getHarnessNotifyRegistration(this.db);
+    if (existing) {
+      const desiredUrl = this.buildCallbackUrl(existing.hookToken);
+      if (existing.callbackUrl === desiredUrl) {
+        return existing;
+      }
+      await this.harnessClient.registerNotifyCallback({
+        agentId: existing.agentId,
+        callback: desiredUrl,
+        secret: existing.secret
+      });
+      return upsertHarnessNotifyRegistration(this.db, {
+        agentId: existing.agentId,
+        hookToken: existing.hookToken,
+        secret: existing.secret,
+        callbackUrl: desiredUrl
+      });
+    }
+    const { agentId } = await this.harnessClient.whoami();
+    const hookToken = crypto3.randomBytes(32).toString("hex");
+    const secret = crypto3.randomBytes(32).toString("hex");
+    const callbackUrl = this.buildCallbackUrl(hookToken);
+    await this.harnessClient.registerNotifyCallback({
+      agentId,
+      callback: callbackUrl,
+      secret
+    });
+    return upsertHarnessNotifyRegistration(this.db, {
+      agentId,
+      hookToken,
+      secret,
+      callbackUrl
+    });
+  }
+  async getWakeupInfo() {
+    const status = this.status();
+    if (!status.enabled) {
+      return {
+        ...status,
+        enabled: false
+      };
+    }
+    const registration = await this.ensureRegistration();
+    return {
+      ...status,
+      enabled: true,
+      notifyTo: registration.agentId,
+      registered: true
+    };
+  }
+  async watchJob(input) {
+    this.requireEnabled();
+    const jobId = input.jobId.trim();
+    if (!jobId) {
+      throw new HttpError(400, {
+        code: "bad_request",
+        message: "jobId is required."
+      });
+    }
+    let threadId = input.threadId?.trim() || null;
+    if (!threadId) {
+      const runningThreads = listThreadRecords(this.db).filter(
+        (thread) => thread.status === "running"
+      );
+      if (runningThreads.length === 1) {
+        threadId = runningThreads[0].id;
+      }
+    }
+    if (!threadId) {
+      throw new HttpError(400, {
+        code: "bad_request",
+        message: "threadId is required when it cannot be inferred from a single running thread."
+      });
+    }
+    if (!getThreadRecordById(this.db, threadId)) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Thread was not found."
+      });
+    }
+    const registration = await this.ensureRegistration();
+    const watch = upsertHarnessJobWatch(this.db, {
+      jobId,
+      threadId,
+      title: input.title ?? null
+    });
+    return {
+      watch,
+      notifyTo: registration.agentId
+    };
+  }
+  verifyCallback(input) {
+    const registration = getHarnessNotifyRegistration(this.db);
+    if (!registration || !timingSafeEqualString2(registration.hookToken, input.hookToken)) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Unknown harness hook."
+      });
+    }
+    const expected = crypto3.createHmac("sha256", registration.secret).update(input.rawBody).digest("hex");
+    if (!input.signature || !timingSafeEqualString2(expected, input.signature.trim())) {
+      throw new HttpError(403, {
+        code: "forbidden",
+        message: "Invalid harness hook signature."
+      });
+    }
+    let payload = {};
+    try {
+      const parsed = JSON.parse(input.rawBody.toString("utf8"));
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        payload = parsed;
+      }
+    } catch {
+    }
+    return payload;
+  }
+  handleCallback(input) {
+    const payload = this.verifyCallback(input);
+    this.scheduleReconcile();
+    return {
+      accepted: true,
+      type: typeof payload.type === "string" ? payload.type : null
+    };
+  }
+  scheduleReconcile() {
+    if (this.reconcileInFlight) {
+      this.reconcileQueued = true;
+      return;
+    }
+    this.reconcileInFlight = this.reconcile().catch((error) => {
+      this.logger.error({ err: error }, "Harness wakeup reconcile failed.");
+    }).finally(() => {
+      this.reconcileInFlight = null;
+      if (this.reconcileQueued) {
+        this.reconcileQueued = false;
+        this.scheduleReconcile();
+      }
+    });
+  }
+  async waitForReconcile() {
+    while (this.reconcileInFlight) {
+      await this.reconcileInFlight;
+    }
+  }
+  async reconcile() {
+    const watches = listPendingHarnessJobWatches(this.db);
+    for (const watch of watches) {
+      try {
+        const job = await this.harnessClient.getComputeJob(watch.jobId);
+        updateHarnessJobWatch(this.db, watch.id, {
+          lastJobStatus: job.status
+        });
+        if (!job.terminal) {
+          continue;
+        }
+        await this.wakeThread(watch, job);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        this.logger.warn(
+          { jobId: watch.jobId, threadId: watch.threadId, err: error },
+          "Harness wakeup delivery attempt failed; will retry on the next callback."
+        );
+        updateHarnessJobWatch(this.db, watch.id, { lastError: message });
+      }
+    }
+    await this.acknowledgeNotifications();
+  }
+  async wakeThread(watch, job) {
+    const thread = getThreadRecordById(this.db, watch.threadId);
+    if (!thread) {
+      updateHarnessJobWatch(this.db, watch.id, {
+        status: "failed",
+        lastError: "Thread was not found."
+      });
+      return;
+    }
+    if (thread.isConnected === false) {
+      await this.threadService.resumeThread(watch.threadId);
+    }
+    const title = watch.title ?? job.title;
+    const prompt = [
+      `[Harness job wakeup] Compute job ${job.jobId}${title ? ` ("${title}")` : ""} finished with status: ${job.status}.`,
+      job.reason ? `Reason: ${job.reason}.` : null,
+      `Retrieve details and outputs from the ElAgente Harness API (GET /compute/jobs/${job.jobId}, output files under GET /compute/jobs/${job.jobId}/files/...) using the INACT_X_APP_KEY env var, then continue the original task.`
+    ].filter(Boolean).join(" ");
+    await this.threadService.sendPrompt(watch.threadId, { prompt });
+    updateHarnessJobWatch(this.db, watch.id, {
+      status: "delivered",
+      lastError: null,
+      deliveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  async acknowledgeNotifications() {
+    let notifications2;
+    try {
+      notifications2 = await this.harnessClient.listUnreadNotifications();
+    } catch (error) {
+      this.logger.warn({ err: error }, "Harness wakeup inbox listing failed.");
+      return;
+    }
+    for (const notification of notifications2) {
+      if (!notification.from.includes("jobs")) {
+        continue;
+      }
+      const jobId = JOB_ID_FROM_MESSAGE_PATTERN.exec(notification.message)?.[1] ?? null;
+      if (!jobId) {
+        continue;
+      }
+      const watch = getHarnessJobWatchByJobId(this.db, jobId);
+      if (watch && watch.status === "pending") {
+        continue;
+      }
+      try {
+        await this.harnessClient.markNotificationRead(notification.id);
+      } catch (error) {
+        this.logger.warn(
+          { notificationId: notification.id, err: error },
+          "Harness wakeup notification acknowledgement failed."
+        );
+      }
+    }
+  }
+};
+
 // src/worker-control-plane-sync.ts
 import { setTimeout as delay } from "timers/promises";
 var WorkerControlPlaneSyncError = class extends Error {
@@ -27932,7 +28525,7 @@ var WorkerControlPlaneSyncClient = class {
 };
 
 // src/auth.ts
-import crypto3 from "crypto";
+import crypto4 from "crypto";
 var AUTH_COOKIE_NAME = "remote_codex_session";
 var AuthService = class {
   required;
@@ -28015,7 +28608,7 @@ var AuthService = class {
     const payload = {
       username,
       expiresAt: expiresAtMs,
-      nonce: crypto3.randomBytes(16).toString("base64url")
+      nonce: crypto4.randomBytes(16).toString("base64url")
     };
     const payloadText = Buffer.from(JSON.stringify(payload), "utf8").toString(
       "base64url"
@@ -28063,7 +28656,7 @@ var AuthService = class {
     };
   }
   sign(payloadText) {
-    return crypto3.createHmac("sha256", this.secret ?? "").update(payloadText).digest("base64url");
+    return crypto4.createHmac("sha256", this.secret ?? "").update(payloadText).digest("base64url");
   }
 };
 function unauthorizedPayload() {
@@ -28120,7 +28713,7 @@ function constantTimeEqual(left, right) {
   if (leftBuffer.length !== rightBuffer.length) {
     return false;
   }
-  return crypto3.timingSafeEqual(leftBuffer, rightBuffer);
+  return crypto4.timingSafeEqual(leftBuffer, rightBuffer);
 }
 
 // src/relay-tunnel-client.ts
@@ -28287,6 +28880,14 @@ var RelayTunnelClient = class {
 var MAX_PROMPT_ATTACHMENTS2 = 10;
 var MAX_PROMPT_ATTACHMENT_BYTES2 = 25 * 1024 * 1024;
 var WORKER_AUTH_EXEMPT_PATHS = /* @__PURE__ */ new Set(["/healthz", "/readyz"]);
+var WORKER_AUTH_HOOK_PATH_PREFIX = "/api/hooks/";
+var WORKER_AUTH_LOOPBACK_PATHS = /* @__PURE__ */ new Set([
+  "/api/harness/wakeup",
+  "/api/harness/job-watches"
+]);
+function isLoopbackAddress(ip) {
+  return ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1";
+}
 var RELAY_FORWARD_HEADER = "x-remote-codex-relay-forwarded";
 var SUPERVISOR_LOG_REDACTION_PATHS = [
   "req.headers.authorization",
@@ -28403,7 +29004,8 @@ function buildApp(options = {}) {
     disableRequestLogging: config.disableRequestLogging
   });
   app.addHook("onRequest", async (request) => {
-    if (config.runtimeRole !== "worker" || !config.workerAuthToken || WORKER_AUTH_EXEMPT_PATHS.has(request.url.split("?")[0] ?? request.url)) {
+    const requestPath = request.url.split("?")[0] ?? request.url;
+    if (config.runtimeRole !== "worker" || !config.workerAuthToken || WORKER_AUTH_EXEMPT_PATHS.has(requestPath) || requestPath.startsWith(WORKER_AUTH_HOOK_PATH_PREFIX) || WORKER_AUTH_LOOPBACK_PATHS.has(requestPath) && isLoopbackAddress(request.ip)) {
       return;
     }
     const headerToken = request.headers["x-remote-codex-worker-token"];
@@ -28433,6 +29035,13 @@ function buildApp(options = {}) {
     relaySocketBridge.handleMessage
   ) : null;
   relayTunnelClient?.validateConfig();
+  const harnessWakeupService = new HarnessWakeupService(
+    config,
+    database.db,
+    harnessClient,
+    threadService,
+    app.log
+  );
   app.decorate("services", {
     config,
     database,
@@ -28445,6 +29054,7 @@ function buildApp(options = {}) {
     pluginRegistry,
     pluginService,
     harnessClient,
+    harnessWakeupService,
     controlPlaneSyncClient,
     authService,
     relayTunnelClient,
@@ -28461,6 +29071,12 @@ function buildApp(options = {}) {
     if (requestPath === "/api/auth/login" || requestPath === "/api/auth/logout" || requestPath === "/api/auth/session") {
       return;
     }
+    if (requestPath.startsWith(WORKER_AUTH_HOOK_PATH_PREFIX)) {
+      return;
+    }
+    if (WORKER_AUTH_LOOPBACK_PATHS.has(requestPath) && isLoopbackAddress(request.ip)) {
+      return;
+    }
     if (config.mode === "relay" && request.headers[RELAY_FORWARD_HEADER] === "1") {
       return;
     }