tryharness 0.7.8 → 0.7.9

package/cli.mjs

@@ -649,8 +649,33 @@ async function link({ quiet = false } = {}) {
   }
 }
 
+// Approving Harness in T3 Code (lib/t3.mjs): then what you send your T3 Code sessions from Harness, in the desktop app or
+// on your phone, goes straight into their threads. No T3 account; T3's page asks for a pairing code from its settings.
+const t3Words = (access) => !access ? "Harness is not approved in T3 Code. Messages to its sessions wait for them to pick them up (run: tryharness t3)."
+  : access.state === "send" ? `Harness sends your messages into T3 Code's threads, until ${access.until.slice(0, 10)}.`
+    : access.state === "read" ? "Harness was approved in T3 Code to read only, so messages still wait for its sessions to pick them up. Approve it again with the access your threads run with: tryharness t3"
+      : "Harness's approval in T3 Code ran out. Approve it again: tryharness t3";
+async function t3() {
+  const sub = argv[0] || "connect";
+  if (sub === "status") { console.log(t3Words((await daemonRequest({ command: "t3.status" })).t3)); return; }
+  if (sub === "forget") { await daemonRequest({ command: "t3.forget" }); console.log("Harness forgot its approval. To end it in T3 Code as well: Settings → Connections."); return; }
+  if (sub !== "connect") throw new Error("usage: tryharness t3 [connect [--print] | status | forget]");
+  const before = (await daemonRequest({ command: "t3.status" })).t3;
+  const started = await daemonRequest({ command: "t3.connect" }, 20_000);
+  if (!started.ok) throw new Error(started.error || "the daemon could not start the approval");
+  const opened = !has("--print") && openUrl(started.url);
+  console.log(opened ? "T3 Code's approval page is open in your browser." : `Open this in a browser on this computer:\n\n${started.url}\n`);
+  console.log("There, enter a pairing code from T3 Code (Settings → Connections), then choose what Harness may do. To message threads that run in Full access, choose Full access.");
+  console.log("Waiting for your approval (Ctrl-C stops waiting; an approval still counts).");
+  for (;;) {
+    await sleep(1_000);
+    const now = (await daemonRequest({ command: "t3.status" })).t3;
+    if (now && JSON.stringify(now) !== JSON.stringify(before)) { console.log(t3Words(now)); return; }
+  }
+}
+
 function help() {
-  console.log(`tryharness ${VERSION}\n\nCommands:\n  tryharness                 set up everything and start the daemon\n  tryharness desktop         open the Harness desktop app (setup opens it too; --no-desktop skips it)\n  tryharness status          show daemon, bridge, agent, and index health\n  tryharness doctor          diagnose the complete connection\n  tryharness sync [--agent]  rescan local coding history in the background\n  tryharness task <id> --follow\n                             follow a delegated agent run in this terminal\n  tryharness board [--all]   list open work on the machine's task board\n  tryharness board post --for <agent> --objective <text> [--file <brief.md>]\n  tryharness board show <id>\n  tryharness board post --for codex --objective <text> --run --workspace <dir>\n                             the daemon runs it and reports back on the task\n  tryharness board run <id>  authorize a run an agent asked for\n  tryharness board release <id>\n  tryharness board agents    when each agent last read the board\n  tryharness board --watch   follow the board in this terminal\n  tryharness notify on|off   desktop notifications for what waits on you\n  tryharness board send <task> <message>   send a held reply to another person's agent\n  tryharness board auto <task> on|off      auto-send replies on that thread\n  tryharness board end <task> --outcome <text>\n  tryharness board context <task> <query>  search everything written about a task\n  tryharness goal set --objective <text> [--team a,b] [--workspace <dir>]   a goal your agents work together in one room\n  tryharness goal [list | show <id> | stop <id> | resume <id>]\n  tryharness room <goal> | room post <goal> <text> [--ask agent,agent]\n  tryharness swarm rounds [<thread>]   what the coordinator saw, chose and cost each round\n  tryharness swarm coordinator [harness|local]   who coordinates your threads\n  tryharness connect <handle/agent> --about <text>   ask another person's agent to work an issue with yours, sealed to their computer\n  tryharness peers           the keys of other people's computers this one has worked with, to compare\n  tryharness agents          how Harness wakes each of your agents, and set up the rest\n  tryharness agents setup <agent> | agents test <agent>\n  tryharness mcp grok-bot    print the MCP snippet that puts Grok Bot on the board\n  tryharness link            connect the browser you use Harness in to this computer, end to end (--print shows the link)\n  tryharness phone pair      show a QR code that pairs your phone with this computer\n  tryharness phone list | revoke <id>\n  tryharness logs [--follow]\n  tryharness disconnect\n`);
+  console.log(`tryharness ${VERSION}\n\nCommands:\n  tryharness                 set up everything and start the daemon\n  tryharness desktop         open the Harness desktop app (setup opens it too; --no-desktop skips it)\n  tryharness status          show daemon, bridge, agent, and index health\n  tryharness doctor          diagnose the complete connection\n  tryharness sync [--agent]  rescan local coding history in the background\n  tryharness task <id> --follow\n                             follow a delegated agent run in this terminal\n  tryharness board [--all]   list open work on the machine's task board\n  tryharness board post --for <agent> --objective <text> [--file <brief.md>]\n  tryharness board show <id>\n  tryharness board post --for codex --objective <text> --run --workspace <dir>\n                             the daemon runs it and reports back on the task\n  tryharness board run <id>  authorize a run an agent asked for\n  tryharness board release <id>\n  tryharness board agents    when each agent last read the board\n  tryharness board --watch   follow the board in this terminal\n  tryharness notify on|off   desktop notifications for what waits on you\n  tryharness board send <task> <message>   send a held reply to another person's agent\n  tryharness board auto <task> on|off      auto-send replies on that thread\n  tryharness board end <task> --outcome <text>\n  tryharness board context <task> <query>  search everything written about a task\n  tryharness goal set --objective <text> [--team a,b] [--workspace <dir>]   a goal your agents work together in one room\n  tryharness goal [list | show <id> | stop <id> | resume <id>]\n  tryharness room <goal> | room post <goal> <text> [--ask agent,agent]\n  tryharness swarm rounds [<thread>]   what the coordinator saw, chose and cost each round\n  tryharness swarm coordinator [harness|local]   who coordinates your threads\n  tryharness connect <handle/agent> --about <text>   ask another person's agent to work an issue with yours, sealed to their computer\n  tryharness peers           the keys of other people's computers this one has worked with, to compare\n  tryharness agents          how Harness wakes each of your agents, and set up the rest\n  tryharness agents setup <agent> | agents test <agent>\n  tryharness mcp grok-bot    print the MCP snippet that puts Grok Bot on the board\n  tryharness link            connect the browser you use Harness in to this computer, end to end (--print shows the link)\n  tryharness phone pair      show a QR code that pairs your phone with this computer\n  tryharness phone list | revoke <id>\n  tryharness t3              approve Harness in T3 Code once, so your messages go into its threads (t3 status | t3 forget)\n  tryharness logs [--follow]\n  tryharness disconnect\n`);
 }
 
 try {
@@ -668,6 +693,7 @@ try {
   else if (command === "phone") await phone();
   else if (command === "agents") await agents();
   else if (command === "link") await link();
+  else if (command === "t3") await t3();
   else if (command === "peers") await peers();
   else if (command === "connect") await connectAgent();
   else if (command === "desktop") { if (!desktop()) process.exitCode = 1; }

package/lib/daemon.mjs

@@ -30,6 +30,7 @@ import { machineActivity } from "./activity.mjs";
 import { LIVE_AGENTS, focusTerminal, hostApp, liveSessions, processTable, sessionFeed, sessionFile, sessionOfProcess, workingDirectories } from "./live.mjs";
 import { EDITOR_IDS, agentCommand, editorFolder, editorInstall, editorName, editorTerminalStarts, openEditorFolder, panelLink, placeEnv, placeFrom, placeKey, processEnv, resumeLine, t3App, t3Link, t3OpensLinks, t3Runs, t3Thread } from "./places.mjs";
 import { detectMcpClients } from "./adapters.mjs";
+import { forgetT3, sendToT3, startT3SignIn, t3Access } from "./t3.mjs";
 
 // What may be referenced on a thread with another person (the server's rule, src/server/relay/refs.ts, kept
 // here since a sealed request is opened only on the machines).
@@ -1009,7 +1010,7 @@ export async function startDaemon() {
         if (!LIVE_AGENTS.includes(row.agent) || last[row.agent] || !ownSession(row)) continue;
         last[row.agent] = { sessionId: nativeSessionId(row.agent, row.session_id), folder: row.cwd || null };
       }
-      return { ok: true, sessions: liveNow(), last, homes: homes() };
+      return { ok: true, sessions: liveNow(), last, homes: homes(), t3: t3Access() };
     }
     // A session's latest messages and steps, from its own file (running or not).
     if (request.command === "board.live.read") {
@@ -1031,9 +1032,19 @@ export async function startDaemon() {
       if (!text) return { ok: false, error: "a message needs text" };
       const session = liveNow().find((row) => row.agent === request.to && row.sessionId === sessionId);
       if (!session) return { ok: false, error: "that session is not running any more" };
-      const messages = [...said(session.agent, sessionId), { text, at: new Date().toISOString() }];
-      store.meta(saidKey(session.agent, sessionId), JSON.stringify(messages));
-      return { ok: true, session: { ...session, waiting: messages.length } };
+      // Kept until the session's own hook takes it: when its turn ends, or the person next types there.
+      const keep = (t3) => {
+        const messages = [...said(session.agent, sessionId), { text, at: new Date().toISOString() }];
+        store.meta(saidKey(session.agent, sessionId), JSON.stringify(messages));
+        return { ok: true, sent: "hooks", session: { ...session, waiting: messages.length }, ...(t3 ? { t3 } : {}) };
+      };
+      // A session in T3 Code, once the person approved Harness there: into its T3 thread, as T3 sends any message.
+      const thread = session.host && /^T3 Code\b/.test(session.host.name) ? t3Thread(sessionId) : null;
+      if (!thread) return keep(null);
+      const access = t3Access();
+      if (access?.state !== "send") return keep(!access ? "not_connected" : access.state === "read" ? "read_only" : access.state);
+      return { pending: sendToT3(thread, text).then((delivery) => ({ ok: true, sent: "t3", delivery, session }),
+        (error) => { log(`T3 Code did not take a message: ${error.message}`); return keep(error.code || "failed"); }) };
     }
     return { ok: false, error: `unknown command ${request.command}` };
   };
@@ -1579,6 +1590,10 @@ export async function startDaemon() {
       else if (request.command === "phone.list") reply({ ok: true, phones: phones.list() });
       else if (request.command === "phone.revoke") reply(phones.revoke(request.id));
       else if (request.command === "wake.local") reply({ ok: true, agents: localWaker.status() });
+      // Approving Harness in T3 Code: the page to approve it on, for the desktop app or the CLI to open.
+      else if (request.command === "t3.connect") startT3SignIn().then((started) => reply({ ok: true, ...started }), (error) => reply({ ok: false, error: error.message }));
+      else if (request.command === "t3.status") reply({ ok: true, t3: t3Access() });
+      else if (request.command === "t3.forget") { forgetT3(); reply({ ok: true }); }
       // How Harness wakes the agents it keeps on the server (Grok Bot): read and saved there, never here.
       else if (request.command === "wake.server") askHarness("wake", request.input || {}).then(reply, (error) => reply({ ok: false, error: error.message }));
       // Whether agent work is going on here, for the desktop app deciding when the Mac may sleep.

package/lib/phones.mjs

@@ -24,6 +24,8 @@ const PHONE_COMMANDS = new Set([
   "board.goal.list", "board.goal.get", "board.goal.stop", "board.room.read",
   "board.swarm.list", "board.swarm.read", "board.swarm.start", "board.swarm.post", "board.swarm.stop", "board.swarm.stop_all", "board.swarm.resume", "board.swarm.folder", "board.swarm.coordinator",
   "board.swarm.diff", "board.swarm.merge", "board.swarm.discard", "board.swarm.start_run",
+  // The person's own running sessions, read and messaged as from the desktop app; never queued (a session may be gone).
+  "board.live", "board.live.read", "board.live.say",
 ]);
 // What the chat owner does on the board, in Harness's name (was src/server/mcp/board.ts HARNESS_COMMANDS).
 const HARNESS_COMMANDS = new Set([

package/lib/t3.mjs

@@ -0,0 +1,172 @@
+import http from "node:http";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { readJson, writeJsonAtomic } from "./files.mjs";
+import { paths } from "./paths.mjs";
+import { t3Home } from "./places.mjs";
+
+// T3 Code's door for agents it did not start (its /mcp; T3's docs/user/outside-agents.md). Harness signs in once and the
+// person approves it inside T3, choosing what it may do; T3 asks for a pairing code from its Settings → Connections, and
+// no T3 account. From then on a message the person sends a session running in T3 Code (from the desktop app or the
+// phone) goes into that session's T3 thread as T3 sends any message: started when the thread is idle, queued behind its
+// turn when it is busy. T3 shows it as sent by an agent through MCP. The key lives in ~/.harness/t3.json (0600), works
+// only on T3's /mcp on this computer's loopback, lasts 30 days, and is revoked in T3 under Settings → Connections.
+
+// T3's desktop app binds the first free port from 3773 up (T3 apps/server/src/auth/utils.ts).
+const FIRST_PORT = 3773;
+const PORTS = 20;
+// Its descriptor answered in at most 1.7 ms over 40 tries while T3 ran four busy sessions (October 12); a closed port
+// refuses in under 0.4 ms. The limit only keeps a port held by something else from stalling the search.
+const PROBE_MS = 1_000;
+const PROTOCOL = "2025-06-18";
+
+const b64u = (bytes) => Buffer.from(bytes).toString("base64url");
+const file = () => path.join(paths.home, "t3.json");
+
+class T3Error extends Error {
+  constructor(code, message) { super(message); this.code = code; }
+}
+
+/** This computer's T3 Code: its environment (from T3's own data folder) and the loopback address that answers as it. */
+export async function findT3(home = t3Home(), hint = null) {
+  let environmentId = "";
+  try { environmentId = fs.readFileSync(path.join(home, "environment-id"), "utf8").trim(); } catch { return null; }
+  const answers = async (origin) => {
+    try {
+      const response = await fetch(`${origin}/.well-known/t3/environment`, { signal: AbortSignal.timeout(PROBE_MS) });
+      return response.ok && (await response.json())?.environmentId === environmentId;
+    } catch { return false; }
+  };
+  if (hint && await answers(hint)) return { origin: hint, environmentId };
+  for (let port = FIRST_PORT; port < FIRST_PORT + PORTS; port++) {
+    const origin = `http://127.0.0.1:${port}`;
+    if (origin !== hint && await answers(origin)) return { origin, environmentId };
+  }
+  return null;
+}
+
+/** What Harness may do in T3 Code: "send", "read", "expired", or null before the person approves it. */
+export function t3Access() {
+  const saved = readJson(file(), null);
+  if (!saved?.token) return null;
+  if (!(Date.parse(saved.expiresAt) > Date.now())) return { state: "expired", at: saved.expiresAt };
+  return { state: String(saved.scope || "").split(" ").includes("orchestration:operate") ? "send" : "read", until: saved.expiresAt };
+}
+
+export function forgetT3() {
+  try { fs.rmSync(file()); } catch {}
+}
+
+const json = async (url, body) => {
+  const response = await fetch(url, body ? { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) } : {});
+  const value = await response.json().catch(() => null);
+  if (!response.ok || !value) throw new T3Error("t3", value?.error_description || `T3 Code answered ${response.status}`);
+  return value;
+};
+
+const page = (title, words) => `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title>`
+  + `<body style="font-family:-apple-system,system-ui,sans-serif;display:grid;place-items:center;min-height:90vh;margin:0"><main style="max-width:420px;padding:24px"><h1 style="font-size:20px">${title}</h1><p style="line-height:1.5">${words}</p></main>`;
+
+let pending = null;
+
+/**
+ * Starts the sign-in: registers Harness with this computer's T3 Code and returns the page where the person approves it.
+ * The approval comes back to a loopback address here, which keeps listening until it does or another sign-in starts.
+ */
+export async function startT3SignIn() {
+  const t3 = await findT3(t3Home(), readJson(file(), null)?.origin ?? null);
+  if (!t3) throw new T3Error("not_running", "T3 Code is not running on this computer. Open it, then try again.");
+  // T3 Code takes outside agents from its 0.0.46 builds on; an older one has no sign-in to offer.
+  const server = await json(`${t3.origin}/.well-known/oauth-authorization-server`).catch(() => {
+    throw new T3Error("too_old", "This T3 Code can't approve outside agents yet. Update it (0.0.46 or newer), then try again.");
+  });
+  pending?.close();
+  const listener = http.createServer();
+  pending = listener;
+  await new Promise((resolve, reject) => { listener.once("error", reject); listener.listen(0, "127.0.0.1", resolve); });
+  const redirect = `http://127.0.0.1:${listener.address().port}/t3/callback`;
+  const client = await json(server.registration_endpoint, { client_name: "Harness", redirect_uris: [redirect] });
+  const verifier = b64u(randomBytes(32));
+  const state = b64u(randomBytes(16));
+  const resource = `${t3.origin}/mcp`;
+  listener.on("request", async (request, response) => {
+    const url = new URL(request.url, redirect);
+    const answer = (status, title, words) => { response.writeHead(status, { "content-type": "text/html; charset=utf-8" }); response.end(page(title, words)); };
+    if (url.pathname !== "/t3/callback" || url.searchParams.get("state") !== state) return answer(400, "Not this sign-in", "This page is not the sign-in Harness started. Start it again from Harness.");
+    const done = () => { listener.close(); if (pending === listener) pending = null; };
+    if (url.searchParams.get("error")) { done(); return answer(200, "Harness was not approved", "Nothing changed. Harness keeps leaving your messages for T3 Code's sessions to pick up themselves."); }
+    if (url.searchParams.has("iss") && url.searchParams.get("iss") !== server.issuer) return answer(400, "Not this sign-in", "The approval came from another server.");
+    try {
+      const exchanged = await fetch(server.token_endpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ grant_type: "authorization_code", code: url.searchParams.get("code") || "", redirect_uri: redirect, client_id: client.client_id, code_verifier: verifier, resource }) });
+      const token = await exchanged.json().catch(() => null);
+      if (!exchanged.ok || !token?.access_token) throw new Error(token?.error_description || `T3 Code answered ${exchanged.status}`);
+      writeJsonAtomic(file(), { origin: t3.origin, environmentId: t3.environmentId, clientId: client.client_id, token: token.access_token, scope: token.scope || "",
+        expiresAt: new Date(Date.now() + Number(token.expires_in || 0) * 1000).toISOString(), approvedAt: new Date().toISOString() });
+      done();
+      const send = t3Access()?.state === "send";
+      answer(200, send ? "Harness can send into T3 Code" : "Harness can read T3 Code", send
+        ? "Messages you send your T3 Code sessions from Harness, on this computer or your phone, now go straight into their threads. You can close this tab."
+        : "You approved read only, so messages still wait for your sessions to pick them up. To send into T3 Code's threads, approve Harness again with the access your threads run with.");
+    } catch (error) {
+      answer(502, "The sign-in did not finish", `${String(error.message).replace(/[<>&]/g, "")}. Start it again from Harness.`);
+    }
+  });
+  const url = `${server.authorization_endpoint}?${new URLSearchParams({ response_type: "code", client_id: client.client_id, redirect_uri: redirect,
+    code_challenge: b64u(createHash("sha256").update(verifier).digest()), code_challenge_method: "S256", state, resource })}`;
+  return { url };
+}
+
+/** One JSON-RPC message to T3's /mcp (Streamable HTTP): the answer comes as JSON or as a server-sent event. */
+async function rpc(origin, token, session, message) {
+  const response = await fetch(`${origin}/mcp`, { method: "POST", body: JSON.stringify({ jsonrpc: "2.0", ...message }), headers: {
+    authorization: `Bearer ${token}`, "content-type": "application/json", accept: "application/json, text/event-stream", "mcp-protocol-version": PROTOCOL,
+    ...(session ? { "mcp-session-id": session } : {}) } });
+  if (response.status === 401 || response.status === 403) throw new T3Error("expired", "T3 Code no longer accepts Harness's sign-in.");
+  if (!response.ok) throw new T3Error("t3", `T3 Code answered ${response.status}`);
+  const next = response.headers.get("mcp-session-id") || session;
+  if (message.id === undefined) return { session: next };
+  const text = await response.text();
+  const replies = (response.headers.get("content-type") || "").includes("text/event-stream")
+    ? text.split("\n").filter((line) => line.startsWith("data:")).map((line) => { try { return JSON.parse(line.slice(5)); } catch { return null; } })
+    : [JSON.parse(text)];
+  const reply = replies.find((entry) => entry?.id === message.id);
+  if (!reply) throw new T3Error("t3", "T3 Code sent no answer");
+  if (reply.error) throw new T3Error("t3", reply.error.message || "T3 Code refused");
+  return { session: next, result: reply.result };
+}
+
+async function callTool(origin, token, name, args) {
+  let { session } = await rpc(origin, token, null, { id: 1, method: "initialize", params: { protocolVersion: PROTOCOL, capabilities: {}, clientInfo: { name: "Harness", version: "1" } } });
+  try {
+    ({ session } = await rpc(origin, token, session, { method: "notifications/initialized" }));
+    const { result } = await rpc(origin, token, session, { id: 2, method: "tools/call", params: { name, arguments: args } });
+    const words = (result?.content || []).map((part) => part?.text || "").join("\n").trim();
+    if (result?.isError) throw new T3Error("refused", words || "T3 Code refused");
+    if (result?.structuredContent) return result.structuredContent;
+    try { return JSON.parse(words); } catch { return {}; }
+  } finally {
+    if (session) fetch(`${origin}/mcp`, { method: "DELETE", headers: { authorization: `Bearer ${token}`, "mcp-session-id": session } }).catch(() => {});
+  }
+}
+
+/** Sends the person's words into a T3 Code thread: "started" or "queued" behind its turn. */
+export async function sendToT3(threadId, text) {
+  const saved = readJson(file(), null);
+  const access = t3Access();
+  if (!access) throw new T3Error("not_connected", "Harness is not approved in T3 Code yet.");
+  if (access.state === "expired") throw new T3Error("expired", "Harness's approval in T3 Code ran out.");
+  if (access.state !== "send") throw new T3Error("read_only", "Harness was approved in T3 Code to read only.");
+  // T3 may come back on another port after a restart: the saved address first, else the search again.
+  const t3 = await findT3(t3Home(), saved.origin);
+  if (!t3 || t3.environmentId !== saved.environmentId) throw new T3Error("not_running", "T3 Code is not running on this computer.");
+  if (t3.origin !== saved.origin) writeJsonAtomic(file(), { ...saved, origin: t3.origin });
+  try {
+    const sent = await callTool(t3.origin, saved.token, "t3_thread_send", { threadId, message: text, mode: "queue", clientRequestId: randomUUID() });
+    return sent.delivery === "queued" ? "queued" : "started";
+  } catch (error) {
+    if (error.code === "expired") writeJsonAtomic(file(), { ...saved, expiresAt: new Date(0).toISOString() });
+    throw error;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tryharness",
-  "version": "0.7.8",
+  "version": "0.7.9",
   "description": "Harness Relay: the daemon that turns the agents on this machine into your personal swarm. Memory, history, and work handed between any of them.",
   "bin": {
     "tryharness": "cli.mjs"
@@ -36,8 +36,8 @@
     "onnxruntime-web": "1.26.0-dev.20260416-b7804b056c"
   },
   "optionalDependencies": {
-    "tryharness-desktop-darwin-arm64": "0.7.8",
-    "tryharness-desktop-darwin-x64": "0.7.8",
+    "tryharness-desktop-darwin-arm64": "0.7.9",
+    "tryharness-desktop-darwin-x64": "0.7.9",
     "tryharness-desktop-linux-x64": "0.7.4",
     "tryharness-desktop-win32-x64": "0.7.4"
   }