subharness 0.0.1

package/dist/cli/main.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+import { readFile, realpath, stat } from 'node:fs/promises';
+import { parseArgs } from './args.js';
+import { renderHelp } from './help.js';
+import { renderText, exitCode } from './output.js';
+import { loadCatalog, loadDeclaredChildren } from './catalog.js';
+import { AgentError, errorInfo } from '../errors.js';
+import { connect, request } from '../runtime/client.js';
+import { harnessReference } from '../runtime/definition.js';
+const valueOptions = new Set(['cwd', 'prompt', 'prompt-file', 'model', 'effort', 'delivery', 'after']);
+function parseErrorFormat(argv) {
+    for (let index = 1; index < argv.length; index++) {
+        const argument = argv[index];
+        if (argument === '--')
+            break;
+        if (argument === '--format')
+            return argv[index + 1] === 'jsonl' ? 'jsonl' : 'text';
+        if (argument.startsWith('--') && valueOptions.has(argument.slice(2)))
+            index++;
+    }
+    return 'text';
+}
+async function main() {
+    let format = parseErrorFormat(process.argv.slice(2));
+    const emit = (record) => {
+        const text = format === 'jsonl' ? JSON.stringify(record) : renderText(record);
+        (record.type === 'error' && format === 'text' ? process.stderr : process.stdout).write(text + '\n');
+        process.exitCode = exitCode(record);
+    };
+    try {
+        const args = await parseArgs(process.argv.slice(2));
+        format = args.format;
+        if (args.command === 'help') {
+            process.stdout.write(renderHelp(args.harness));
+            return;
+        }
+        if (args.command === 'version') {
+            const manifest = JSON.parse(await readFile(new URL('../../package.json', import.meta.url), 'utf8'));
+            process.stdout.write(`${manifest.version}\n`);
+            return;
+        }
+        const parentToken = process.env.AGENT_PARENT_TOKEN;
+        let reference;
+        if (args.command === 'list' || args.command === 'run') {
+            const requestedCwd = args.cwd;
+            try {
+                args.cwd = await realpath(requestedCwd);
+                if (!(await stat(args.cwd)).isDirectory())
+                    throw new Error();
+            }
+            catch {
+                throw new AgentError('INVALID_CONFIG', `Execution directory is not accessible: ${requestedCwd}`);
+            }
+            if (args.command === 'run' && args.harness) {
+                reference = harnessReference(args.harness, args.model, args.effort);
+            }
+            else {
+                let parent;
+                if (parentToken) {
+                    const endpoint = await connect(false);
+                    for await (const record of request(endpoint, { command: 'parent', parentToken })) {
+                        if (record.type === 'error')
+                            throw new AgentError(record.error.code, record.error.message);
+                        parent = record;
+                    }
+                }
+                if (args.command === 'run' && args.id.startsWith('subagent:')) {
+                    const name = args.id.slice(9);
+                    if (!parent || !('file' in parent.reference))
+                        throw new AgentError('INVALID_PARENT', 'This subagent is not available in the active parent context.');
+                    const children = await loadDeclaredChildren(args.cwd, parent.reference);
+                    if (!children.some(child => child.name === name))
+                        throw new AgentError('INVALID_PARENT', 'This subagent is not available in the active parent context.');
+                    reference = { file: parent.reference.file, subagents: [...parent.reference.subagents, name] };
+                }
+                else {
+                    const { entries, children } = await loadCatalog(args.cwd, parent?.reference);
+                    if (args.command === 'list') {
+                        emit({ version: 1, type: 'agents', agents: [
+                                { id: 'codex', name: 'codex', description: 'Run the native Codex harness.', scope: 'harness' },
+                                { id: 'claude', name: 'claude', description: 'Run the native Claude Code harness.', scope: 'harness' },
+                                { id: 'fx', name: 'fx', description: 'Run the native fx harness through AI Gateway.', scope: 'harness' },
+                                ...entries.map(({ id, name, description, scope }) => ({ id, name, description, scope })),
+                                ...children.map(({ name, description }) => ({ id: `subagent:${name}`, name, description, scope: 'subagent' })),
+                            ] });
+                        return;
+                    }
+                    const matches = entries.filter(entry => entry.id === args.id || entry.name === args.id);
+                    if (matches.length !== 1)
+                        throw new AgentError(matches.length ? 'AMBIGUOUS_AGENT' : 'UNKNOWN_AGENT', matches.length ? `Choose ${matches.map(entry => entry.id).join(' or ')}.` : 'Agent not found. Use subharness list.');
+                    reference = { file: matches[0].file, subagents: [] };
+                }
+            }
+        }
+        const endpoint = await connect(args.command === 'run');
+        const body = args.command === 'run' ? { command: 'run', input: { reference, cwd: args.cwd, env: process.env, prompt: args.prompt, parentToken } } : { ...args, parentToken };
+        for await (const record of request(endpoint, body))
+            emit(record);
+    }
+    catch (error) {
+        emit({ version: 1, type: 'error', error: errorInfo(error) });
+    }
+}
+await main();
+//# sourceMappingURL=main.js.map

package/dist/cli/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvG,SAAS,gBAAgB,CAAC,IAAc;IACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAC9B,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM;QAC7B,IAAI,QAAQ,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACnF,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,MAAoB,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACpG,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1E,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;YAC3H,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACnD,IAAI,SAAyC,CAAC;QAC9C,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;gBACxC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,0CAA0C,YAAY,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC3C,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,IAAI,MAAgD,CAAC;gBACrD,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;oBACtC,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,OAAO,CAAC,QAAQ,EAAC,EAAC,OAAO,EAAC,QAAQ,EAAC,WAAW,EAAC,CAAC,EAAE,CAAC;wBAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;4BAAE,MAAM,IAAI,UAAU,CAAE,MAAM,CAAC,KAAa,CAAC,IAAI,EAAE,MAAM,CAAC,KAAa,CAAC,OAAO,CAAC,CAAC;wBAC5G,MAAM,GAAG,MAAmD,CAAC;oBAC/D,CAAC;gBACH,CAAC;gBACD,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,EAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,EAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC;wBAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAC,8DAA8D,CAAC,CAAC;oBACpJ,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBACxE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;wBAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAC,8DAA8D,CAAC,CAAC;oBACxJ,SAAS,GAAG,EAAC,IAAI,EAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAC,SAAS,EAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,EAAC,IAAI,CAAC,EAAC,CAAC;gBAC1F,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;oBAC7E,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;wBAC5B,IAAI,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,MAAM,EAAC;gCACnC,EAAC,EAAE,EAAC,OAAO,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,+BAA+B,EAAC,KAAK,EAAC,SAAS,EAAC;gCACrF,EAAC,EAAE,EAAC,QAAQ,EAAC,IAAI,EAAC,QAAQ,EAAC,WAAW,EAAC,qCAAqC,EAAC,KAAK,EAAC,SAAS,EAAC;gCAC7F,EAAC,EAAE,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,WAAW,EAAC,+CAA+C,EAAC,KAAK,EAAC,SAAS,EAAC;gCAC/F,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAC,EAAE,EAAC,IAAI,EAAC,WAAW,EAAC,KAAK,EAAC,EAAC,EAAE,CAAA,CAAC,EAAC,EAAE,EAAC,IAAI,EAAC,WAAW,EAAC,KAAK,EAAC,CAAC,CAAC;gCAC5E,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAC,IAAI,EAAC,WAAW,EAAC,EAAC,EAAE,CAAA,CAAC,EAAC,EAAE,EAAC,YAAY,IAAI,EAAE,EAAC,IAAI,EAAC,WAAW,EAAC,KAAK,EAAC,UAAU,EAAC,CAAC,CAAC;6BACnG,EAAC,CAAC,CAAC;wBAAC,OAAO;oBACd,CAAC;oBACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,EAAE,KAAG,IAAI,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,KAAG,IAAI,CAAC,EAAE,CAAC,CAAC;oBAClF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAA,CAAC,CAAA,eAAe,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC;oBACrN,SAAS,GAAG,EAAC,IAAI,EAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,EAAC,SAAS,EAAC,EAAE,EAAC,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAC,OAAO,EAAC,KAAK,EAAC,KAAK,EAAC,EAAC,SAAS,EAAC,GAAG,EAAC,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,OAAO,CAAC,GAAG,EAAC,MAAM,EAAC,IAAI,CAAC,MAAM,EAAC,WAAW,EAAC,EAAC,CAAC,CAAC,CAAC,EAAC,GAAG,IAAI,EAAC,WAAW,EAAC,CAAC;QAC5J,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,OAAO,CAAC,QAAQ,EAAC,IAAI,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,OAAO,EAAC,KAAK,EAAC,SAAS,CAAC,KAAK,CAAC,EAAC,CAAC,CAAC;IAAC,CAAC;AAC5E,CAAC;AACD,MAAM,IAAI,EAAE,CAAC","sourcesContent":["#!/usr/bin/env node\nimport { readFile, realpath, stat } from 'node:fs/promises';\nimport { parseArgs } from './args.js';\nimport { renderHelp } from './help.js';\nimport { renderText, exitCode, type OutputRecord } from './output.js';\nimport { loadCatalog, loadDeclaredChildren } from './catalog.js';\nimport { AgentError, errorInfo } from '../errors.js';\nimport { connect, request } from '../runtime/client.js';\nimport type { ExecutionReference } from '../runtime/types.js';\nimport { harnessReference } from '../runtime/definition.js';\n\nconst valueOptions = new Set(['cwd', 'prompt', 'prompt-file', 'model', 'effort', 'delivery', 'after']);\n\nfunction parseErrorFormat(argv: string[]): 'text' | 'jsonl' {\n  for (let index = 1; index < argv.length; index++) {\n    const argument = argv[index]!;\n    if (argument === '--') break;\n    if (argument === '--format') return argv[index + 1] === 'jsonl' ? 'jsonl' : 'text';\n    if (argument.startsWith('--') && valueOptions.has(argument.slice(2))) index++;\n  }\n  return 'text';\n}\n\nasync function main() {\n  let format = parseErrorFormat(process.argv.slice(2));\n  const emit = (record: OutputRecord) => {\n    const text = format === 'jsonl' ? JSON.stringify(record) : renderText(record);\n    (record.type === 'error' && format === 'text' ? process.stderr : process.stdout).write(text + '\\n');\n    process.exitCode = exitCode(record);\n  };\n  try {\n    const args = await parseArgs(process.argv.slice(2)); format = args.format;\n    if (args.command === 'help') { process.stdout.write(renderHelp(args.harness)); return; }\n    if (args.command === 'version') {\n      const manifest = JSON.parse(await readFile(new URL('../../package.json', import.meta.url), 'utf8')) as { version: string };\n      process.stdout.write(`${manifest.version}\\n`);\n      return;\n    }\n    const parentToken = process.env.AGENT_PARENT_TOKEN;\n    let reference: ExecutionReference | undefined;\n    if (args.command === 'list' || args.command === 'run') {\n      const requestedCwd = args.cwd;\n      try {\n        args.cwd = await realpath(requestedCwd);\n        if (!(await stat(args.cwd)).isDirectory()) throw new Error();\n      } catch {\n        throw new AgentError('INVALID_CONFIG', `Execution directory is not accessible: ${requestedCwd}`);\n      }\n      if (args.command === 'run' && args.harness) {\n        reference = harnessReference(args.harness, args.model, args.effort);\n      } else {\n        let parent: {reference:ExecutionReference}|undefined;\n        if (parentToken) {\n          const endpoint = await connect(false);\n          for await (const record of request(endpoint,{command:'parent',parentToken})) {\n            if (record.type === 'error') throw new AgentError((record.error as any).code,(record.error as any).message);\n            parent = record as unknown as {reference:ExecutionReference};\n          }\n        }\n        if (args.command === 'run' && args.id!.startsWith('subagent:')) {\n          const name = args.id!.slice(9);\n          if (!parent || !('file' in parent.reference)) throw new AgentError('INVALID_PARENT','This subagent is not available in the active parent context.');\n          const children = await loadDeclaredChildren(args.cwd, parent.reference);\n          if (!children.some(child => child.name === name)) throw new AgentError('INVALID_PARENT','This subagent is not available in the active parent context.');\n          reference = {file:parent.reference.file,subagents:[...parent.reference.subagents,name]};\n        } else {\n          const { entries, children } = await loadCatalog(args.cwd, parent?.reference);\n          if (args.command === 'list') {\n            emit({version:1,type:'agents',agents:[\n              {id:'codex',name:'codex',description:'Run the native Codex harness.',scope:'harness'},\n              {id:'claude',name:'claude',description:'Run the native Claude Code harness.',scope:'harness'},\n              {id:'fx',name:'fx',description:'Run the native fx harness through AI Gateway.',scope:'harness'},\n              ...entries.map(({id,name,description,scope})=>({id,name,description,scope})),\n              ...children.map(({name,description})=>({id:`subagent:${name}`,name,description,scope:'subagent'})),\n            ]}); return;\n          }\n          const matches = entries.filter(entry=>entry.id===args.id || entry.name===args.id);\n          if (matches.length !== 1) throw new AgentError(matches.length ? 'AMBIGUOUS_AGENT':'UNKNOWN_AGENT',matches.length ? `Choose ${matches.map(entry=>entry.id).join(' or ')}.` : 'Agent not found. Use subharness list.');\n          reference = {file:matches[0]!.file,subagents:[]};\n        }\n      }\n    }\n    const endpoint = await connect(args.command === 'run');\n    const body = args.command === 'run' ? {command:'run',input:{reference,cwd:args.cwd,env:process.env,prompt:args.prompt,parentToken}} : {...args,parentToken};\n    for await (const record of request(endpoint,body)) emit(record);\n  } catch (error) { emit({version:1,type:'error',error:errorInfo(error)}); }\n}\nawait main();\n"]}

package/dist/cli/output.d.ts

@@ -0,0 +1,7 @@
+export type OutputRecord = {
+    version: number;
+    type: string;
+    [key: string]: unknown;
+};
+export declare function renderText(record: OutputRecord): string;
+export declare function exitCode(record: OutputRecord): number;

package/dist/cli/output.js

@@ -0,0 +1,43 @@
+export function renderText(record) {
+    const header = `Session: ${record.sessionId}\nTask: ${record.taskId}`;
+    switch (record.type) {
+        case 'started': return `${header}\nState: ${record.state}${record.delivery ? `\nDelivery: ${record.delivery}` : ''}`;
+        case 'response': return `${header}\nResponse: ${record.responseId}\nState: ${record.state}\n\n${record.text}` +
+            (record.state === 'waiting' || record.state === 'running' ? `\n\nNext response: subharness wait ${record.taskId} --after ${record.responseId}` : '');
+        case 'terminal': return `${header}\nState: ${record.state}${record.error ? `\n${errorText(record.error)}` : ''}`;
+        case 'error': return errorText(record.error);
+        case 'accepted': return `${header}\nDelivery: steer (accepted)`;
+        case 'cancelled': return `${header}\nState: ${record.state}`;
+        case 'agents': {
+            const entries = record.agents;
+            return entries.length ? entries.map(entry => `${entry.id} — ${entry.description}`).join('\n') : 'No agents found.';
+        }
+        case 'status': {
+            const response = record.response;
+            return `${header}\nState: ${record.state}${record.error ? `\n${errorText(record.error)}` : ''}` +
+                (response ? `\nResponse: ${response.responseId}\n\n${response.text}${response.truncated ? '\n[Preview truncated; use status --full.]' : ''}` : '');
+        }
+        case 'queue': {
+            const active = record.active;
+            const tasks = record.tasks;
+            return `Session: ${record.sessionId}\nPaused: ${record.paused}\nActive: ${active ? `${active.taskId} (${active.state})` : 'none'}\n` +
+                (tasks.length ? tasks.map(task => `${task.taskId} — ${task.description}`).join('\n') : 'Queue empty.');
+        }
+        default: return JSON.stringify(record);
+    }
+}
+function errorText(error) {
+    const value = error;
+    return `${value.code}: ${value.message}`;
+}
+export function exitCode(record) {
+    if (record.type === 'cancelled')
+        return 0;
+    if (record.state === 'cancelled' || record.state === 'interrupted')
+        return 130;
+    const error = record.error;
+    if (!error && record.state !== 'failed')
+        return 0;
+    return /^(INVALID_|UNKNOWN_|AMBIGUOUS_|NOT_FAILED|NO_ACTIVE_TASK)/.test(error?.code ?? '') ? 2 : 1;
+}
+//# sourceMappingURL=output.js.map

package/dist/cli/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/cli/output.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,UAAU,CAAC,MAAoB;IAC7C,MAAM,MAAM,GAAG,YAAY,MAAM,CAAC,SAAS,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC;IACtE,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS,EAAE,OAAO,GAAG,MAAM,YAAY,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACrH,KAAK,UAAU,EAAE,OAAO,GAAG,MAAM,eAAe,MAAM,CAAC,UAAU,YAAY,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,IAAI,EAAE;YAC3G,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,sCAAsC,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvJ,KAAK,UAAU,EAAE,OAAO,GAAG,MAAM,YAAY,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjH,KAAK,OAAO,EAAE,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,KAAK,UAAU,EAAE,OAAO,GAAG,MAAM,8BAA8B,CAAC;QAChE,KAAK,WAAW,EAAE,OAAO,GAAG,MAAM,YAAY,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7D,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,CAAC,MAA0C,CAAC;YAClE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACrH,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAuE,CAAC;YAChG,OAAO,GAAG,MAAM,YAAY,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7F,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,CAAC,UAAU,OAAO,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvJ,CAAC;QACD,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,CAAC,MAAgD,CAAC;YACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAA6C,CAAC;YACnE,OAAO,YAAY,MAAM,CAAC,SAAS,aAAa,MAAM,CAAC,MAAM,aAAa,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI;gBAClI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAC3G,CAAC;QACD,SAAS,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AACD,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,KAAK,GAAG,KAAqC,CAAC;IACpD,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;AAC3C,CAAC;AACD,MAAM,UAAU,QAAQ,CAAC,MAAoB;IAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa;QAAE,OAAO,GAAG,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAiC,CAAC;IACvD,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IAClD,OAAO,2DAA2D,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC","sourcesContent":["export type OutputRecord = {version: number; type: string; [key: string]: unknown};\n\nexport function renderText(record: OutputRecord): string {\n  const header = `Session: ${record.sessionId}\\nTask: ${record.taskId}`;\n  switch (record.type) {\n    case 'started': return `${header}\\nState: ${record.state}${record.delivery ? `\\nDelivery: ${record.delivery}` : ''}`;\n    case 'response': return `${header}\\nResponse: ${record.responseId}\\nState: ${record.state}\\n\\n${record.text}` +\n      (record.state === 'waiting' || record.state === 'running' ? `\\n\\nNext response: subharness wait ${record.taskId} --after ${record.responseId}` : '');\n    case 'terminal': return `${header}\\nState: ${record.state}${record.error ? `\\n${errorText(record.error)}` : ''}`;\n    case 'error': return errorText(record.error);\n    case 'accepted': return `${header}\\nDelivery: steer (accepted)`;\n    case 'cancelled': return `${header}\\nState: ${record.state}`;\n    case 'agents': {\n      const entries = record.agents as {id:string;description:string}[];\n      return entries.length ? entries.map(entry => `${entry.id} — ${entry.description}`).join('\\n') : 'No agents found.';\n    }\n    case 'status': {\n      const response = record.response as {responseId:string;text:string;truncated:boolean}|undefined;\n      return `${header}\\nState: ${record.state}${record.error ? `\\n${errorText(record.error)}` : ''}` +\n        (response ? `\\nResponse: ${response.responseId}\\n\\n${response.text}${response.truncated ? '\\n[Preview truncated; use status --full.]' : ''}` : '');\n    }\n    case 'queue': {\n      const active = record.active as {taskId:string;state:string}|undefined;\n      const tasks = record.tasks as {taskId:string;description:string}[];\n      return `Session: ${record.sessionId}\\nPaused: ${record.paused}\\nActive: ${active ? `${active.taskId} (${active.state})` : 'none'}\\n` +\n        (tasks.length ? tasks.map(task => `${task.taskId} — ${task.description}`).join('\\n') : 'Queue empty.');\n    }\n    default: return JSON.stringify(record);\n  }\n}\nfunction errorText(error: unknown) {\n  const value = error as {code:string;message:string};\n  return `${value.code}: ${value.message}`;\n}\nexport function exitCode(record: OutputRecord): number {\n  if (record.type === 'cancelled') return 0;\n  if (record.state === 'cancelled' || record.state === 'interrupted') return 130;\n  const error = record.error as {code?:string}|undefined;\n  if (!error && record.state !== 'failed') return 0;\n  return /^(INVALID_|UNKNOWN_|AMBIGUOUS_|NOT_FAILED|NO_ACTIVE_TASK)/.test(error?.code ?? '') ? 2 : 1;\n}\n"]}

package/dist/config/access.d.ts

@@ -0,0 +1,21 @@
+import type { HarnessKind } from "../sdk/types.js";
+export { resolveAccess } from "./resolve-access.js";
+export type AccessConnection = {
+    type: "subscription";
+} | {
+    type: "api-key" | "vercel-api-key";
+    env?: string;
+    envFile?: string;
+} | {
+    type: "vercel-oidc";
+    env?: string;
+    envFile?: string;
+    project?: string;
+};
+export interface AccessConfig {
+    access?: Partial<Record<HarnessKind, AccessConnection[]>>;
+}
+export declare function configError(message: string): never;
+export declare function parseConnection(value: unknown): AccessConnection;
+export declare function parseAccess(value: unknown): AccessConfig;
+export declare function loadAccess(cwd: string): Promise<AccessConfig>;

package/dist/config/access.js

@@ -0,0 +1,97 @@
+import { appendFile, mkdir, readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { AgentError } from "../errors.js";
+import { git, resolveProject } from "./project.js";
+export { resolveAccess } from "./resolve-access.js";
+export function configError(message) {
+    throw new AgentError("INVALID_CONFIG", message);
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export function parseConnection(value) {
+    if (!record(value) || !["subscription", "api-key", "vercel-api-key", "vercel-oidc"].includes(value.type))
+        configError("Unknown access connection type.");
+    const allowed = value.type === "subscription" ? ["type"] : ["type", "env", "envFile", ...(value.type === "vercel-oidc" ? ["project"] : [])];
+    if (Object.keys(value).some((key) => !allowed.includes(key)))
+        configError("Unknown access connection field; secrets must be supplied through environment references.");
+    if (value.env !== undefined && (typeof value.env !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(value.env)))
+        configError("Invalid credential variable name.");
+    for (const field of ["envFile", "project"]) {
+        if (value[field] !== undefined && (typeof value[field] !== "string" || !value[field].trim()))
+            configError(`${field} must be a nonempty path.`);
+    }
+    return value;
+}
+export function parseAccess(value) {
+    if (!record(value) || Object.keys(value).some((key) => key !== "access"))
+        configError("Personal settings must contain only an optional access map.");
+    if (value.access === undefined)
+        return {};
+    if (!record(value.access))
+        configError("access must be an object.");
+    for (const [kind, connections] of Object.entries(value.access)) {
+        if (kind !== "codex" && kind !== "claudeCode" && kind !== "fx")
+            configError("Unsupported harness in personal access settings.");
+        if (!Array.isArray(connections))
+            configError("Each harness access selection must be an array.");
+        connections.forEach(parseConnection);
+    }
+    return value;
+}
+async function ensureExcluded(mainRoot) {
+    try {
+        await git(mainRoot, ["rev-parse", "--git-dir"]);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes("not a git repository"))
+            return;
+        configError("Cannot inspect Git configuration for personal settings.");
+    }
+    let tracked = false;
+    try {
+        tracked = !!await git(mainRoot, ["ls-files", "--", ".agents/agents.local.json"]);
+    }
+    catch {
+        configError("Cannot inspect whether personal access settings are tracked by Git.");
+    }
+    if (tracked)
+        configError("Personal access settings are tracked. Remove .agents/agents.local.json from the Git index before using it.");
+    const exclude = await git(mainRoot, ["rev-parse", "--path-format=absolute", "--git-path", "info/exclude"]);
+    let contents = "";
+    try {
+        contents = await readFile(exclude, "utf8");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            configError("Cannot read Git's local exclude file.");
+    }
+    const pattern = "/.agents/agents.local.json";
+    if (!contents.split(/\r?\n/).includes(pattern)) {
+        await mkdir(dirname(exclude), { recursive: true });
+        await appendFile(exclude, `${contents.endsWith("\n") || !contents ? "" : "\n"}${pattern}\n`);
+    }
+}
+export async function loadAccess(cwd) {
+    const { mainRoot } = await resolveProject(cwd);
+    const file = join(mainRoot, ".agents", "agents.local.json");
+    let contents;
+    try {
+        contents = await readFile(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return {};
+        configError(`Cannot read personal settings: ${file}`);
+    }
+    await ensureExcluded(mainRoot);
+    let value;
+    try {
+        value = JSON.parse(contents);
+    }
+    catch {
+        configError(`Invalid JSON in personal settings: ${file}`);
+    }
+    return parseAccess(value);
+}
+//# sourceMappingURL=access.js.map

package/dist/config/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/config/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAWpD,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAc,CAAC;QAAE,WAAW,CAAC,iCAAiC,CAAC,CAAC;IACnK,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5I,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,WAAW,CAAC,2FAA2F,CAAC,CAAC;IACvK,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,WAAW,CAAC,mCAAmC,CAAC,CAAC;IAChK,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACjJ,CAAC;IACD,OAAO,KAAyB,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC;QAAE,WAAW,CAAC,6DAA6D,CAAC,CAAC;IACrJ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,WAAW,CAAC,2BAA2B,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,IAAI;YAAE,WAAW,CAAC,kDAAkD,CAAC,CAAC;QAChI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,WAAW,CAAC,iDAAiD,CAAC,CAAC;QAChG,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAqB,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,IAAI,CAAC;QAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAAC,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,OAAO;QACrF,WAAW,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAAC,CAAC;IACzF,MAAM,CAAC;QAAC,WAAW,CAAC,qEAAqE,CAAC,CAAC;IAAC,CAAC;IAC7F,IAAI,OAAO;QAAE,WAAW,CAAC,4GAA4G,CAAC,CAAC;IACvI,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3G,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACnD,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,WAAW,CAAC,uCAAuC,CAAC,CAAC;IAAC,CAAC;IAC/H,MAAM,OAAO,GAAG,4BAA4B,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC5D,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAChD,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,WAAW,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IACrC,MAAM,CAAC;QAAC,WAAW,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IACpE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC","sourcesContent":["import { appendFile, mkdir, readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { AgentError } from \"../errors.js\";\nimport type { HarnessKind } from \"../sdk/types.js\";\nimport { git, resolveProject } from \"./project.js\";\nexport { resolveAccess } from \"./resolve-access.js\";\n\nexport type AccessConnection =\n  | { type: \"subscription\" }\n  | { type: \"api-key\" | \"vercel-api-key\"; env?: string; envFile?: string }\n  | { type: \"vercel-oidc\"; env?: string; envFile?: string; project?: string };\n\nexport interface AccessConfig {\n  access?: Partial<Record<HarnessKind, AccessConnection[]>>;\n}\n\nexport function configError(message: string): never {\n  throw new AgentError(\"INVALID_CONFIG\", message);\n}\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nexport function parseConnection(value: unknown): AccessConnection {\n  if (!record(value) || ![\"subscription\", \"api-key\", \"vercel-api-key\", \"vercel-oidc\"].includes(value.type as string)) configError(\"Unknown access connection type.\");\n  const allowed = value.type === \"subscription\" ? [\"type\"] : [\"type\", \"env\", \"envFile\", ...(value.type === \"vercel-oidc\" ? [\"project\"] : [])];\n  if (Object.keys(value).some((key) => !allowed.includes(key))) configError(\"Unknown access connection field; secrets must be supplied through environment references.\");\n  if (value.env !== undefined && (typeof value.env !== \"string\" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(value.env))) configError(\"Invalid credential variable name.\");\n  for (const field of [\"envFile\", \"project\"]) {\n    if (value[field] !== undefined && (typeof value[field] !== \"string\" || !value[field].trim())) configError(`${field} must be a nonempty path.`);\n  }\n  return value as AccessConnection;\n}\n\nexport function parseAccess(value: unknown): AccessConfig {\n  if (!record(value) || Object.keys(value).some((key) => key !== \"access\")) configError(\"Personal settings must contain only an optional access map.\");\n  if (value.access === undefined) return {};\n  if (!record(value.access)) configError(\"access must be an object.\");\n  for (const [kind, connections] of Object.entries(value.access)) {\n    if (kind !== \"codex\" && kind !== \"claudeCode\" && kind !== \"fx\") configError(\"Unsupported harness in personal access settings.\");\n    if (!Array.isArray(connections)) configError(\"Each harness access selection must be an array.\");\n    connections.forEach(parseConnection);\n  }\n  return value as AccessConfig;\n}\n\nasync function ensureExcluded(mainRoot: string): Promise<void> {\n  try { await git(mainRoot, [\"rev-parse\", \"--git-dir\"]); }\n  catch (error) {\n    if (error instanceof Error && error.message.includes(\"not a git repository\")) return;\n    configError(\"Cannot inspect Git configuration for personal settings.\");\n  }\n  let tracked = false;\n  try { tracked = !!await git(mainRoot, [\"ls-files\", \"--\", \".agents/agents.local.json\"]); }\n  catch { configError(\"Cannot inspect whether personal access settings are tracked by Git.\"); }\n  if (tracked) configError(\"Personal access settings are tracked. Remove .agents/agents.local.json from the Git index before using it.\");\n  const exclude = await git(mainRoot, [\"rev-parse\", \"--path-format=absolute\", \"--git-path\", \"info/exclude\"]);\n  let contents = \"\";\n  try { contents = await readFile(exclude, \"utf8\"); }\n  catch (error) { if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") configError(\"Cannot read Git's local exclude file.\"); }\n  const pattern = \"/.agents/agents.local.json\";\n  if (!contents.split(/\\r?\\n/).includes(pattern)) {\n    await mkdir(dirname(exclude), { recursive: true });\n    await appendFile(exclude, `${contents.endsWith(\"\\n\") || !contents ? \"\" : \"\\n\"}${pattern}\\n`);\n  }\n}\n\nexport async function loadAccess(cwd: string): Promise<AccessConfig> {\n  const { mainRoot } = await resolveProject(cwd);\n  const file = join(mainRoot, \".agents\", \"agents.local.json\");\n  let contents: string;\n  try { contents = await readFile(file, \"utf8\"); }\n  catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return {};\n    configError(`Cannot read personal settings: ${file}`);\n  }\n  await ensureExcluded(mainRoot);\n  let value: unknown;\n  try { value = JSON.parse(contents); }\n  catch { configError(`Invalid JSON in personal settings: ${file}`); }\n  return parseAccess(value);\n}\n"]}

package/dist/config/loader.d.ts

@@ -0,0 +1,13 @@
+import type { AgentDefinition } from "../sdk/types.js";
+export interface CatalogEntry {
+    id: string;
+    name: string;
+    description: string;
+    scope: "repo" | "global";
+    file: string;
+    definition: AgentDefinition;
+}
+export declare function loadDefinition(file: string, subagents?: string[]): Promise<AgentDefinition>;
+export declare function discover(cwd: string, options?: {
+    home?: string;
+}): Promise<CatalogEntry[]>;

package/dist/config/loader.js

@@ -0,0 +1,80 @@
+import { readdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { tsImport } from "tsx/esm/api";
+import { AgentError } from "../errors.js";
+import { agent } from "../sdk/definitions.js";
+import { resolveProject } from "./project.js";
+// Only fixed SDK diagnostics may cross the module-evaluation boundary.
+// User exceptions can contain credential values, including exceptions named AgentError.
+const safeDiagnostics = new Set([
+    "Expected a configuration object.", "Unknown configuration field.",
+    "Names must start with a letter and contain at most 64 letters, digits, underscores, or hyphens.",
+    "fast must be a boolean.", "Unsupported harness kind.", "At least one harness is required.",
+    "Claude effort must be low, medium, high, xhigh, or max.",
+    "Subagent definitions cannot contain recursive references.",
+    "Tools require a Zod 4 object schema.", "Tool execute must be a function.",
+    "Tool input schema cannot be represented as JSON Schema.",
+    ...["Model", "Effort", "Description", "Instructions", "Tool description"].map(label => `${label} must be a nonempty string.`),
+]);
+export async function loadDefinition(file, subagents = []) {
+    let definition;
+    try {
+        const url = pathToFileURL(resolve(file));
+        url.searchParams.set("load", crypto.randomUUID());
+        const loaded = await tsImport(url.href, import.meta.url);
+        const exported = loaded.default?.__esModule ? loaded.default.default : loaded.default;
+        definition = agent(exported);
+    }
+    catch (error) {
+        const reason = error instanceof Error && safeDiagnostics.has(error.message)
+            && error.code === "INVALID_DEFINITION" ? error.message
+            : "Definition could not be loaded. Check its imports, dependencies, and module initialization.";
+        throw new AgentError("INVALID_DEFINITION", `${file}: ${reason}`);
+    }
+    for (const name of subagents) {
+        const children = definition.subagents ?? {};
+        const child = Object.hasOwn(children, name) ? children[name] : undefined;
+        if (!child)
+            throw new AgentError("INVALID_DEFINITION", `${file}: Subagent '${name}' is not declared.`);
+        definition = child;
+    }
+    return definition;
+}
+async function files(directory) {
+    let entries;
+    try {
+        entries = await readdir(directory, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw new AgentError("INVALID_CONFIG", `Cannot read agent directory: ${directory}`);
+    }
+    const found = [];
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        const file = join(directory, entry.name);
+        if (entry.isDirectory())
+            found.push(...await files(file));
+        else if (entry.isFile() && entry.name.endsWith(".agent.ts"))
+            found.push(file);
+    }
+    return found;
+}
+export async function discover(cwd, options = {}) {
+    const { root } = await resolveProject(cwd);
+    const entries = [];
+    for (const [scope, base] of [["repo", root], ["global", options.home ?? homedir()]]) {
+        const names = new Set();
+        for (const file of await files(join(base, ".agents", "agents"))) {
+            const definition = await loadDefinition(file);
+            if (names.has(definition.name))
+                throw new AgentError("INVALID_DEFINITION", `${file}: Duplicate agent name '${definition.name}' in ${scope} scope.`);
+            names.add(definition.name);
+            entries.push({ id: `${scope}:${definition.name}`, name: definition.name, description: definition.description, scope, file, definition });
+        }
+    }
+    return entries;
+}
+//# sourceMappingURL=loader.js.map

package/dist/config/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAW9C,uEAAuE;AACvE,wFAAwF;AACxF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,kCAAkC,EAAE,8BAA8B;IAClE,iGAAiG;IACjG,yBAAyB,EAAE,2BAA2B,EAAE,mCAAmC;IAC3F,yDAAyD;IACzD,2DAA2D;IAC3D,sCAAsC,EAAE,kCAAkC;IAC1E,yDAAyD;IACzD,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,6BAA6B,CAAC;CAC9H,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,SAAS,GAAa,EAAE;IACzE,IAAI,UAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACtF,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;eACrE,KAAoB,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO;YACtE,CAAC,CAAC,6FAA6F,CAAC;QAClG,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,GAAG,IAAI,eAAe,IAAI,oBAAoB,CAAC,CAAC;QACvG,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,SAAiB;IACpC,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IACpE,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,gCAAgC,SAAS,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;aACrD,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,OAAO,GAAsB,EAAE;IACzE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAU,EAAE,CAAC;QAC7F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,GAAG,IAAI,2BAA2B,UAAU,CAAC,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC;YACpJ,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3I,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import { readdir } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { tsImport } from \"tsx/esm/api\";\nimport { AgentError } from \"../errors.js\";\nimport { agent } from \"../sdk/definitions.js\";\nimport type { AgentDefinition } from \"../sdk/types.js\";\nimport { resolveProject } from \"./project.js\";\n\nexport interface CatalogEntry {\n  id: string;\n  name: string;\n  description: string;\n  scope: \"repo\" | \"global\";\n  file: string;\n  definition: AgentDefinition;\n}\n\n// Only fixed SDK diagnostics may cross the module-evaluation boundary.\n// User exceptions can contain credential values, including exceptions named AgentError.\nconst safeDiagnostics = new Set([\n  \"Expected a configuration object.\", \"Unknown configuration field.\",\n  \"Names must start with a letter and contain at most 64 letters, digits, underscores, or hyphens.\",\n  \"fast must be a boolean.\", \"Unsupported harness kind.\", \"At least one harness is required.\",\n  \"Claude effort must be low, medium, high, xhigh, or max.\",\n  \"Subagent definitions cannot contain recursive references.\",\n  \"Tools require a Zod 4 object schema.\", \"Tool execute must be a function.\",\n  \"Tool input schema cannot be represented as JSON Schema.\",\n  ...[\"Model\", \"Effort\", \"Description\", \"Instructions\", \"Tool description\"].map(label => `${label} must be a nonempty string.`),\n]);\n\nexport async function loadDefinition(file: string, subagents: string[] = []): Promise<AgentDefinition> {\n  let definition: AgentDefinition;\n  try {\n    const url = pathToFileURL(resolve(file));\n    url.searchParams.set(\"load\", crypto.randomUUID());\n    const loaded = await tsImport(url.href, import.meta.url);\n    const exported = loaded.default?.__esModule ? loaded.default.default : loaded.default;\n    definition = agent(exported);\n  } catch (error) {\n    const reason = error instanceof Error && safeDiagnostics.has(error.message)\n      && (error as AgentError).code === \"INVALID_DEFINITION\" ? error.message\n      : \"Definition could not be loaded. Check its imports, dependencies, and module initialization.\";\n    throw new AgentError(\"INVALID_DEFINITION\", `${file}: ${reason}`);\n  }\n  for (const name of subagents) {\n    const children = definition.subagents ?? {};\n    const child = Object.hasOwn(children, name) ? children[name] : undefined;\n    if (!child) throw new AgentError(\"INVALID_DEFINITION\", `${file}: Subagent '${name}' is not declared.`);\n    definition = child;\n  }\n  return definition;\n}\n\nasync function files(directory: string): Promise<string[]> {\n  let entries;\n  try { entries = await readdir(directory, { withFileTypes: true }); }\n  catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return [];\n    throw new AgentError(\"INVALID_CONFIG\", `Cannot read agent directory: ${directory}`);\n  }\n  const found: string[] = [];\n  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {\n    const file = join(directory, entry.name);\n    if (entry.isDirectory()) found.push(...await files(file));\n    else if (entry.isFile() && entry.name.endsWith(\".agent.ts\")) found.push(file);\n  }\n  return found;\n}\n\nexport async function discover(cwd: string, options: { home?: string } = {}): Promise<CatalogEntry[]> {\n  const { root } = await resolveProject(cwd);\n  const entries: CatalogEntry[] = [];\n  for (const [scope, base] of [[\"repo\", root], [\"global\", options.home ?? homedir()]] as const) {\n    const names = new Set<string>();\n    for (const file of await files(join(base, \".agents\", \"agents\"))) {\n      const definition = await loadDefinition(file);\n      if (names.has(definition.name)) throw new AgentError(\"INVALID_DEFINITION\", `${file}: Duplicate agent name '${definition.name}' in ${scope} scope.`);\n      names.add(definition.name);\n      entries.push({ id: `${scope}:${definition.name}`, name: definition.name, description: definition.description, scope, file, definition });\n    }\n  }\n  return entries;\n}\n"]}

package/dist/config/oidc.d.ts

@@ -0,0 +1 @@
+export declare function validateOidc(token: string, mainRoot: string, project: string | undefined, env: NodeJS.ProcessEnv): Promise<void>;

package/dist/config/oidc.js

@@ -0,0 +1,53 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { configError } from "./access.js";
+async function projectIdentity(mainRoot, project, env) {
+    let content;
+    try {
+        content = await readFile(resolve(mainRoot, project ?? ".", ".vercel/project.json"), "utf8");
+    }
+    catch (error) {
+        if (project === undefined && error.code === "ENOENT" && env.VERCEL_PROJECT_ID && env.VERCEL_ORG_ID) {
+            return { projectId: env.VERCEL_PROJECT_ID, orgId: env.VERCEL_ORG_ID };
+        }
+        configError("Selected OIDC project requires accessible .vercel/project.json linkage.");
+    }
+    let identity;
+    try {
+        identity = JSON.parse(content);
+    }
+    catch {
+        configError("Selected Vercel project linkage is not valid JSON.");
+    }
+    if (typeof identity?.projectId !== "string" || !identity.projectId || typeof identity.orgId !== "string" || !identity.orgId) {
+        configError("Selected Vercel project linkage requires projectId and orgId.");
+    }
+    return identity;
+}
+export async function validateOidc(token, mainRoot, project, env) {
+    const parts = token.split(".");
+    if (parts.length !== 3 || parts.some((part) => !/^[A-Za-z0-9_-]+$/.test(part)))
+        configError("Configured OIDC token is malformed.");
+    let claims;
+    try {
+        const header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+        if (!header || typeof header !== "object" || Array.isArray(header))
+            throw new Error();
+        claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    }
+    catch {
+        configError("Configured OIDC token is malformed.");
+    }
+    const now = Date.now() / 1000;
+    if (!claims || typeof claims !== "object" || Array.isArray(claims)
+        || typeof claims.exp !== "number" || !Number.isFinite(claims.exp)
+        || (claims.nbf !== undefined && (typeof claims.nbf !== "number" || !Number.isFinite(claims.nbf)))) {
+        configError("Configured OIDC token has invalid validity claims.");
+    }
+    if (claims.exp <= now || (claims.nbf !== undefined && claims.nbf > now))
+        configError("Configured OIDC token is expired or not yet valid; refresh its credential source.");
+    const expected = await projectIdentity(mainRoot, project, env);
+    if (claims.project_id !== expected.projectId || claims.owner_id !== expected.orgId)
+        configError("Configured OIDC token does not match the selected Vercel project and organization.");
+}
+//# sourceMappingURL=oidc.js.map

package/dist/config/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/config/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI1C,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAA2B,EAAE,GAAsB;IAClG,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,GAAG,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACpG,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,OAAO,KAAK,SAAS,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YAC9H,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QACxE,CAAC;QACD,WAAW,CAAC,yEAAyE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACvC,MAAM,CAAC;QAAC,WAAW,CAAC,oDAAoD,CAAC,CAAC;IAAC,CAAC;IAC5E,IAAI,OAAO,QAAQ,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC5H,WAAW,CAAC,+DAA+D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,OAA2B,EAAE,GAAsB;IACrH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,WAAW,CAAC,qCAAqC,CAAC,CAAC;IACnI,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtF,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC9B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;WAC7D,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;WAC9D,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,WAAW,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QAAE,WAAW,CAAC,mFAAmF,CAAC,CAAC;IAC1K,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,KAAK;QAAE,WAAW,CAAC,oFAAoF,CAAC,CAAC;AACxL,CAAC","sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { configError } from \"./access.js\";\n\ninterface ProjectIdentity { projectId: string; orgId: string }\n\nasync function projectIdentity(mainRoot: string, project: string | undefined, env: NodeJS.ProcessEnv): Promise<ProjectIdentity> {\n  let content: string;\n  try { content = await readFile(resolve(mainRoot, project ?? \".\", \".vercel/project.json\"), \"utf8\"); }\n  catch (error) {\n    if (project === undefined && (error as NodeJS.ErrnoException).code === \"ENOENT\" && env.VERCEL_PROJECT_ID && env.VERCEL_ORG_ID) {\n      return { projectId: env.VERCEL_PROJECT_ID, orgId: env.VERCEL_ORG_ID };\n    }\n    configError(\"Selected OIDC project requires accessible .vercel/project.json linkage.\");\n  }\n  let identity;\n  try { identity = JSON.parse(content); }\n  catch { configError(\"Selected Vercel project linkage is not valid JSON.\"); }\n  if (typeof identity?.projectId !== \"string\" || !identity.projectId || typeof identity.orgId !== \"string\" || !identity.orgId) {\n    configError(\"Selected Vercel project linkage requires projectId and orgId.\");\n  }\n  return identity;\n}\n\nexport async function validateOidc(token: string, mainRoot: string, project: string | undefined, env: NodeJS.ProcessEnv): Promise<void> {\n  const parts = token.split(\".\");\n  if (parts.length !== 3 || parts.some((part) => !/^[A-Za-z0-9_-]+$/.test(part))) configError(\"Configured OIDC token is malformed.\");\n  let claims;\n  try {\n    const header = JSON.parse(Buffer.from(parts[0]!, \"base64url\").toString(\"utf8\"));\n    if (!header || typeof header !== \"object\" || Array.isArray(header)) throw new Error();\n    claims = JSON.parse(Buffer.from(parts[1]!, \"base64url\").toString(\"utf8\"));\n  } catch { configError(\"Configured OIDC token is malformed.\"); }\n  const now = Date.now() / 1000;\n  if (!claims || typeof claims !== \"object\" || Array.isArray(claims)\n    || typeof claims.exp !== \"number\" || !Number.isFinite(claims.exp)\n    || (claims.nbf !== undefined && (typeof claims.nbf !== \"number\" || !Number.isFinite(claims.nbf)))) {\n    configError(\"Configured OIDC token has invalid validity claims.\");\n  }\n  if (claims.exp <= now || (claims.nbf !== undefined && claims.nbf > now)) configError(\"Configured OIDC token is expired or not yet valid; refresh its credential source.\");\n  const expected = await projectIdentity(mainRoot, project, env);\n  if (claims.project_id !== expected.projectId || claims.owner_id !== expected.orgId) configError(\"Configured OIDC token does not match the selected Vercel project and organization.\");\n}\n"]}

package/dist/config/project.d.ts

@@ -0,0 +1,5 @@
+export declare function git(cwd: string, args: string[]): Promise<string>;
+export declare function resolveProject(cwd: string): Promise<{
+    root: string;
+    mainRoot: string;
+}>;

package/dist/config/project.js

@@ -0,0 +1,56 @@
+import { execFile } from "node:child_process";
+import { realpath, stat } from "node:fs/promises";
+import { promisify } from "node:util";
+import { AgentError } from "../errors.js";
+const execute = promisify(execFile);
+// These variables describe a caller's repository, not the explicit execution directory.
+// Keep normal user/system Git configuration and leave the caller's environment untouched.
+const repositoryVariables = new Set([
+    "GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_IMPLICIT_WORK_TREE",
+    "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_GRAFT_FILE", "GIT_SHALLOW_FILE", "GIT_NAMESPACE", "GIT_QUARANTINE_PATH",
+    "GIT_PREFIX", "GIT_INTERNAL_SUPER_PREFIX", "GIT_NO_REPLACE_OBJECTS", "GIT_REPLACE_REF_BASE",
+    "GIT_CEILING_DIRECTORIES", "GIT_DISCOVERY_ACROSS_FILESYSTEM", "GIT_REFERENCE_BACKEND",
+    "GIT_CONFIG", "GIT_CONFIG_PARAMETERS", "GIT_CONFIG_COUNT",
+]);
+export async function git(cwd, args) {
+    const env = { ...process.env };
+    for (const key of Object.keys(env)) {
+        if (repositoryVariables.has(key) || /^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(key))
+            delete env[key];
+    }
+    const { stdout } = await execute("git", ["-C", cwd, ...args], { env, maxBuffer: 1024 * 1024 });
+    return stdout.trim();
+}
+export async function resolveProject(cwd) {
+    let directory;
+    try {
+        directory = await realpath(cwd);
+        if (!(await stat(directory)).isDirectory())
+            throw new Error();
+    }
+    catch {
+        throw new AgentError("INVALID_CONFIG", `Execution directory is not accessible: ${cwd}`);
+    }
+    try {
+        if ((await git(directory, ["rev-parse", "--is-bare-repository"])) === "true") {
+            throw new AgentError("INVALID_CONFIG", "Bare repositories are unsupported execution directories.");
+        }
+        const root = await git(directory, ["rev-parse", "--show-toplevel"]);
+        const worktrees = await git(directory, ["worktree", "list", "--porcelain", "-z"]);
+        const first = worktrees.split("\0").find((line) => line.startsWith("worktree "));
+        if (!first)
+            throw new Error();
+        const mainRoot = await realpath(first.slice("worktree ".length));
+        return { root: await realpath(root), mainRoot };
+    }
+    catch (error) {
+        if (error instanceof AgentError)
+            throw error;
+        const message = error instanceof Error ? error.message : "";
+        if (message.includes("not a git repository"))
+            return { root: directory, mainRoot: directory };
+        throw new AgentError("INVALID_CONFIG", "The Git project or its main checkout cannot be accessed.");
+    }
+}
+//# sourceMappingURL=project.js.map

package/dist/config/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../../src/config/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEpC,wFAAwF;AACxF,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,wBAAwB;IACtE,gBAAgB,EAAE,sBAAsB,EAAE,kCAAkC;IAC5E,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAqB;IAC5E,YAAY,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,sBAAsB;IAC3F,yBAAyB,EAAE,iCAAiC,EAAE,uBAAuB;IACrF,YAAY,EAAE,uBAAuB,EAAE,kBAAkB;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IACnD,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,0CAA0C,GAAG,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU;YAAE,MAAM,KAAK,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC9F,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC;IACrG,CAAC;AACH,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { realpath, stat } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport { AgentError } from \"../errors.js\";\n\nconst execute = promisify(execFile);\n\n// These variables describe a caller's repository, not the explicit execution directory.\n// Keep normal user/system Git configuration and leave the caller's environment untouched.\nconst repositoryVariables = new Set([\n  \"GIT_DIR\", \"GIT_WORK_TREE\", \"GIT_COMMON_DIR\", \"GIT_IMPLICIT_WORK_TREE\",\n  \"GIT_INDEX_FILE\", \"GIT_OBJECT_DIRECTORY\", \"GIT_ALTERNATE_OBJECT_DIRECTORIES\",\n  \"GIT_GRAFT_FILE\", \"GIT_SHALLOW_FILE\", \"GIT_NAMESPACE\", \"GIT_QUARANTINE_PATH\",\n  \"GIT_PREFIX\", \"GIT_INTERNAL_SUPER_PREFIX\", \"GIT_NO_REPLACE_OBJECTS\", \"GIT_REPLACE_REF_BASE\",\n  \"GIT_CEILING_DIRECTORIES\", \"GIT_DISCOVERY_ACROSS_FILESYSTEM\", \"GIT_REFERENCE_BACKEND\",\n  \"GIT_CONFIG\", \"GIT_CONFIG_PARAMETERS\", \"GIT_CONFIG_COUNT\",\n]);\n\nexport async function git(cwd: string, args: string[]): Promise<string> {\n  const env = { ...process.env };\n  for (const key of Object.keys(env)) {\n    if (repositoryVariables.has(key) || /^GIT_CONFIG_(KEY|VALUE)_\\d+$/.test(key)) delete env[key];\n  }\n  const { stdout } = await execute(\"git\", [\"-C\", cwd, ...args], { env, maxBuffer: 1024 * 1024 });\n  return stdout.trim();\n}\n\nexport async function resolveProject(cwd: string): Promise<{ root: string; mainRoot: string }> {\n  let directory: string;\n  try {\n    directory = await realpath(cwd);\n    if (!(await stat(directory)).isDirectory()) throw new Error();\n  } catch {\n    throw new AgentError(\"INVALID_CONFIG\", `Execution directory is not accessible: ${cwd}`);\n  }\n  try {\n    if ((await git(directory, [\"rev-parse\", \"--is-bare-repository\"])) === \"true\") {\n      throw new AgentError(\"INVALID_CONFIG\", \"Bare repositories are unsupported execution directories.\");\n    }\n    const root = await git(directory, [\"rev-parse\", \"--show-toplevel\"]);\n    const worktrees = await git(directory, [\"worktree\", \"list\", \"--porcelain\", \"-z\"]);\n    const first = worktrees.split(\"\\0\").find((line) => line.startsWith(\"worktree \"));\n    if (!first) throw new Error();\n    const mainRoot = await realpath(first.slice(\"worktree \".length));\n    return { root: await realpath(root), mainRoot };\n  } catch (error) {\n    if (error instanceof AgentError) throw error;\n    const message = error instanceof Error ? error.message : \"\";\n    if (message.includes(\"not a git repository\")) return { root: directory, mainRoot: directory };\n    throw new AgentError(\"INVALID_CONFIG\", \"The Git project or its main checkout cannot be accessed.\");\n  }\n}\n"]}

package/dist/config/resolve-access.d.ts

@@ -0,0 +1,4 @@
+import type { ResolvedAccess } from "../adapters/types.js";
+import type { HarnessConfig, HarnessKind } from "../sdk/types.js";
+import { type AccessConnection } from "./access.js";
+export declare function resolveAccess(connection: AccessConnection, harness: HarnessKind | HarnessConfig, cwd: string, env?: NodeJS.ProcessEnv): Promise<ResolvedAccess>;