vouchington-tooling 0.28.0 → 0.30.0

package/dist/api-contract-discovery/response-contract-route-analysis.mjs

@@ -1,4 +1,5 @@
 import ts from '../contract-schema/typescript-api.mjs';
+import { executableProtocolPath } from './protocol-execution-path.mjs';
 export { isContextMethod, isContextResponseBufferCall, isContextResponseEmptyCall, responseMarker, } from './response-contract-ctx-analysis.mjs';
 const HTTP_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']);
 export function requestedKeyForBinding(binding, requestedKeys) {
@@ -19,23 +20,38 @@ export function requestedKeyForBinding(binding, requestedKeys) {
 function routeShape(routeTemplate) {
     return routeTemplate.replace(/:[^/]+/g, ':');
 }
-export function enclosingRouteBinding(node, checker, handlerBindings) {
+export function enclosingRouteBinding(node, checker, handlerBindings, proveCallbacks = true) {
     let current = node;
+    let insideHandlerFunction = false;
     while (current) {
+        if (ts.isFunctionLike(current))
+            insideHandlerFunction = true;
+        if (insideHandlerFunction && ts.isCallExpression(current)) {
+            const method = propertyName(current.expression)?.toUpperCase();
+            const routeTemplate = routeTemplateFromExpression(current.expression);
+            if (method && HTTP_METHODS.has(method) && routeTemplate)
+                return !proveCallbacks || executableProtocolPath(node, checker)
+                    ? { method, routeTemplate }
+                    : undefined;
+        }
         if (isFunctionLike(current) && ts.isCallExpression(current.parent)) {
             const handlerCall = current.parent;
             const method = propertyName(handlerCall.expression)?.toUpperCase();
             if (method && HTTP_METHODS.has(method)) {
                 const routeTemplate = routeTemplateFromExpression(handlerCall.expression);
                 if (routeTemplate)
-                    return { method, routeTemplate };
+                    return !proveCallbacks || executableProtocolPath(node, checker)
+                        ? { method, routeTemplate }
+                        : undefined;
             }
         }
         const handlerSymbol = functionSymbol(current, checker);
         if (handlerSymbol) {
             const binding = handlerBindings.get(resolveSymbol(handlerSymbol, checker));
             if (binding)
-                return binding;
+                return !proveCallbacks || executableProtocolPath(node, checker, current)
+                    ? binding
+                    : undefined;
         }
         current = current.parent;
     }
@@ -93,7 +109,9 @@ function handlerArgumentSymbols(node, checker) {
         }
         if (isFunctionLike(argument)) {
             visit(argument, (child) => {
-                if (!ts.isCallExpression(child) || !ts.isIdentifier(child.expression))
+                if (!ts.isCallExpression(child) ||
+                    !ts.isIdentifier(child.expression) ||
+                    !executableProtocolPath(child, checker))
                     return;
                 const symbol = checker.getSymbolAtLocation(child.expression);
                 if (symbol)

package/dist/api-contract-discovery/response-contract-status.d.mts

@@ -20,7 +20,7 @@ export declare function responseStatusCodesForContract(contract: BackendResponse
  * and the route-wide map (keyed only on `method:routeTemplate`) can't tell two markers in the
  * same route apart when they're preceded by different statuses.
  */
-export declare function resolveEmissionStatus(call: ts.CallExpression): {
+export declare function resolveEmissionStatus(call: ts.CallExpression | ts.NewExpression, matchesContext?: (expression: ts.Expression) => boolean): {
     statusCodes?: readonly [number, ...number[]];
     statusKnowledge: 'default' | 'explicit' | 'unknown';
     unavailableReason?: string;

package/dist/api-contract-discovery/response-contract-status.mjs

@@ -27,32 +27,34 @@ export function responseStatusCodesForContract(contract) {
  * and the route-wide map (keyed only on `method:routeTemplate`) can't tell two markers in the
  * same route apart when they're preceded by different statuses.
  */
-export function resolveEmissionStatus(call) {
-    if (isContextMethod(call.expression, 'setStatus'))
+export function resolveEmissionStatus(call, matchesContext = (expression) => isContextMethod(expression, 'setStatus')) {
+    if (ts.isCallExpression(call) && matchesContext(call.expression))
         return statusArgument(call.arguments[0]);
     let statement = call;
     while (!ts.isStatement(statement))
         statement = statement.parent;
-    return precedingStatus(statement);
+    return precedingStatus(statement, matchesContext);
 }
-function precedingStatus(statement) {
+function precedingStatus(statement, matchesContext) {
     const block = statement.parent;
     if (!ts.isBlock(block))
         return { statusKnowledge: 'default' };
     const index = block.statements.indexOf(statement);
     for (let i = index - 1; i >= 0; i--) {
-        const status = statusStatement(block.statements[i]);
+        const status = statusStatement(block.statements[i], matchesContext);
         if (status)
             return status;
     }
     const enclosing = block.parent;
-    return ts.isStatement(enclosing) ? precedingStatus(enclosing) : { statusKnowledge: 'default' };
+    return ts.isStatement(enclosing)
+        ? precedingStatus(enclosing, matchesContext)
+        : { statusKnowledge: 'default' };
 }
-function statusStatement(statement) {
+function statusStatement(statement, matchesContext) {
     if (!ts.isExpressionStatement(statement))
         return undefined;
     const expression = statement.expression;
-    if (!ts.isCallExpression(expression) || !isContextMethod(expression.expression, 'setStatus'))
+    if (!ts.isCallExpression(expression) || !matchesContext(expression.expression))
         return undefined;
     return statusArgument(expression.arguments[0]);
 }

package/dist/api-contract-discovery/response-contract-types.d.mts

@@ -11,6 +11,13 @@ export type BackendResponseContract = ExtractedResponseContract & {
     mediaType?: string;
     /** Raw buffers and arbitrary streams have an unknown media type; bodyless emissions have none. */
     mediaTypeKnowledge?: 'known' | 'none' | 'unknown';
+    /** Named SSE frames carried by the string stream body. */
+    sseEvents?: readonly {
+        eventName: string;
+        contract: ExtractedResponseContract;
+    }[];
+    /** A concrete error status can also be produced by the framework before dispatch. */
+    includeDefaultError?: boolean;
     /** Set when the route's response schema could not be extracted (lenient discovery mode). */
     unavailableReason?: string;
 };

package/dist/cli/index.mjs

@@ -2,7 +2,6 @@
 import { realpathSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { runAgentHarnessConfigCli } from '../agent-harness-config/cli.mjs';
 import { runPostReviewCli } from '../gha-post-review/cli.mjs';
 import { runStageReviewPayloadCli } from '../gha-review-payload/cli.mjs';
 import { runSwiftSemanticEqualCli } from '../swift-semantic-equal/cli.mjs';
@@ -98,8 +97,6 @@ export function runCli(argv = process.argv) {
             return runRunnerPortPolicy(parsed);
         case 'with-host-lock':
             return runWithHostLock(parsed.args);
-        case 'agent-harness-config':
-            return runAgentHarnessConfigCli(parsed.args);
         case 'gha-runtime-audit':
             return runGhaRuntimeAudit(parsed);
         case 'script': {

package/dist/cli/parse-forwarded-commands.d.mts

@@ -1,9 +1,6 @@
 type ForwardedCommand = {
     kind: 'with-host-lock';
     args: string[];
-} | {
-    kind: 'agent-harness-config';
-    args: string[];
 } | {
     kind: 'pnpm-install';
     args: string[];

package/dist/cli/parse-forwarded-commands.mjs

@@ -1,8 +1,6 @@
 export function parseForwardedCommand(command, args) {
     if (command === 'with-host-lock')
         return { kind: 'with-host-lock', args };
-    if (command === 'agent-harness-config')
-        return { kind: 'agent-harness-config', args };
     if (command === 'pnpm-install')
         return { kind: 'pnpm-install', args };
     if (command === 'vitest-blob-manifest')

package/dist/cli/parse.d.mts

@@ -17,9 +17,6 @@ export type ParsedCli = {
 } | {
     kind: 'with-host-lock';
     args: string[];
-} | {
-    kind: 'agent-harness-config';
-    args: string[];
 } | {
     kind: 'script';
     command: ScriptCommand;

package/dist/cli/usage.d.mts

@@ -1,4 +1,4 @@
-export declare const USAGE = "Usage: vouchington <command> [options]\n\nCommands:\n  runner-port-policy   Print or validate a runner port policy\n  with-host-lock       Run a command under a host-wide lock\n  agent-harness-config          Apply classifier-auto + sandbox keys to agent harnesses\n  gha-runtime-audit             Audit successful GitHub Actions job runtimes\n  require-up-to-date            Require HEAD to include a fetched remote branch\n  gitleaks-directory-scan       Scan a directory with Gitleaks\n  ast-grep-examples             Run AST-grep rule examples\n  ast-grep-pack                 Print shipped unconditional AST-grep pack paths as JSON\n  gha-workspace-policy          Check GitHub Actions workspace safety policy\n  gha-output                    Write a collision-safe multiline GITHUB_OUTPUT record\n  gha-needs-results             Fail if required GitHub Actions job results failed\n  download-with-diagnostics     Download a URL and report HTTP status on failure\n  download-optional-run-artifacts  Download optional artifacts from the current run\n  host-pressure-diagnostics     Print a bounded host memory/OOM/PSI snapshot\n  allocate-browser-safe-ports   Allocate Fetch-safe localhost ports\n  diagnose-port-collision       Capture bounded localhost port diagnostics\n  prepare-trivy-db              Download the Trivy vulnerability database\n  gha-artifacts-cleanup         Delete classified GitHub Actions artifacts\n  http-origin                   Validate an optional HTTP(S) origin\n  vitest-blob-manifest          Stamp a vitest-blob-manifest:v1 identity file\n  vitest-report-attempt         Write or read a Vitest report-attempt marker\n  prepare-vitest-reports        Validate and select Vitest report JSON files\n  pnpm-install                  Install a pnpm workspace with retry and release-age fail-fast\n  check-cache-size              Measure a path and decide whether to save a GHA cache\n  make-shard-matrix             Emit a [1..N] GitHub Actions shard matrix\n  load-runner-env               Overlay a runner env file onto GITHUB_ENV with injection guards\n  clean-workspace               Reset a persistent-runner workspace with a fork-PR trust gate\n  install-github-release        Download a checksum-verified GitHub Release binary\n  run-with-timeout              Run a command with GNU timeout or a Perl fallback\n  lint-links                    Two-pass lychee: internal links fail, external warn\n  materialize-pr-context        Dump PR title/body/files/diff/comments and #N crawl\n  wait-for-apt-locks            Wait until apt/dpkg lock files are free\n  install-playwright-chromium-arm64  Install Playwright Chromium from browsers.json\n  ghcr-package-retention        Delete old GHCR package versions past KEEP_MIN\n  harness-admission-lane        Compute a GITHUB_RUN_ID admission lane for fleet fan-out\n  harness-assert-gates          Fail if any named HARNESS_*_ENABLED gate is enabled\n  gha-collaborator-trust        Classify authors as write-access collaborators or not\n  nuget-central-version         Validate a Directory.Packages.props PackageVersion delta\n  swift-semantic-equal          Compare Swift sources ignoring comments and whitespace\n  post-review                   Post one COMMENT review from a staged payload file\n  stage-review-payload          Validate a review payload file into a staging directory\n  retrospective-transcript      Format facts from Claude-compatible, Codex, or Grok transcripts\n  link-skill                    Link one packaged skill into an explicit consumer directory\n  retrospective-facts           Gather immutable facts for a retrospective\n  agent-blackboard              Probe and journal an Agent Blackboard deployment\n  mcp                           Serve the agent-blackboard journal tools over stdio (MCP)\n\nOptions:\n  -h, --help       Show this help\n  -v, --version    Print the package version\n\nrunner-port-policy\n  (no args)              Print the shipped policy as JSON\n  --file <path>          Validate and print a policy file\n  --reserved <port>      Print true if the port is reserved\n\nwith-host-lock\n  --name <family>\n  [--slots <n>]\n  --timeout-seconds <n>\n  [--command-timeout-seconds <n>]\n  [--failure-diagnostics <absolute-script>]\n  [--on-acquire-timeout fail|run-unlocked]\n  -- <command> [args...]\n\nagent-harness-config dump\nagent-harness-config check|apply [--global] [--repo PATH]... [--harness claude|codex|grok|cursor]...\n  [--home PATH]\n\ngha-runtime-audit\n  [--repository owner/name]   Default GITHUB_REPOSITORY\n  [--branch main]\n  [--median-threshold-floor <seconds>]    Off unless set. Must be below the ceiling\n  [--median-threshold-ceiling <seconds>]  Default 360. Flags a five-sample median above this\n  --pr-workflow <name|/regex/>     Repeatable\n  --push-workflow <name|/regex/>   Repeatable\n\nrequire-up-to-date --remote <name> --branch <name>\ngitleaks-directory-scan --config <path> [--directory <path>]\nast-grep-examples --rules <directory> --config <path>\nast-grep-pack\ngha-workspace-policy [--root <directory>] [--workflow-directory <directory>] [--action-directory <directory>]\n\ngha-output <name>\ngha-needs-results [label]\ndownload-with-diagnostics <url> <destination> [-- curl-args...]\ndownload-optional-run-artifacts (--name <name>... | --pattern <pattern>) --dir <directory>\nhost-pressure-diagnostics\nallocate-browser-safe-ports <count> [--policy path] [--forbidden-ports path]\ndiagnose-port-collision [--ports \"2200 2216\"] [--output-dir PATH]\nprepare-trivy-db\ngha-artifacts-cleanup run --run-id <id> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\ngha-artifacts-cleanup sweep --older-than-hours <n> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\nhttp-origin [--field NAME] [value]\nvitest-blob-manifest <suite> [reports-directory]\nvitest-report-attempt <write DIRECTORY SUITE|read ROOT>\nprepare-vitest-reports [primary-directory] [fallback-directory] [output-directory]\npnpm-install --runner-lifecycle persistent|ephemeral|ephemeral-full --install-scripts true|false\ncheck-cache-size <path> <max-bytes> <label>\nmake-shard-matrix <total>\nload-runner-env\nclean-workspace\ninstall-github-release --repo owner/name --version X --asset 'name-{platform}.tar.gz' --bin name [--tag-prefix PREFIX] [--expected-sha256 SHA256] [--no-checksum] [--checksums-asset NAME] [--version-flag FLAG] [--bin-dir DIR]\nrun-with-timeout <timeout-seconds> <kill-after-seconds> <command...>\nlint-links [--offline] [--config PATH] [--glob PATTERN] [files...]\nmaterialize-pr-context\nwait-for-apt-locks\ninstall-playwright-chromium-arm64 [name:archive...]\nghcr-package-retention <url-encoded-package>...\nharness-admission-lane <lanes>\nharness-assert-gates <gate>...\ngha-collaborator-trust <owner/repo> [--allow-bot <login>]... < authors.json\nnuget-central-version <trusted-props> <candidate-props> <metadata-json> <output-props>\nswift-semantic-equal <base> <head> <file.swift>\npost-review\nstage-review-payload optional|required <source> <destination>\nretrospective-transcript [--session-id ID] [--jsonl PATH] [--projects-dir PATH] [--codex-sessions-dir PATH] [--grok-sessions-dir PATH]\nlink-skill <name> --source-root <skills-dir> --target-root <consumer-skills-dir>  Link a packaged or repository-local skill\nretrospective-facts (--pr NUMBER | --branch NAME | --no-pr) [--repo OWNER/NAME] [--raw]\nagent-blackboard probe\nagent-blackboard journal append --mode interactive|autonomous --source-event-id ID --work-outcome OUTCOME --coverage-status STATUS --session-id UUID --agent NAME --version VERSION --file PATH --repository OWNER/NAME [--repository OWNER/NAME ...] [--parent-session-id UUID] [--timestamp ISO8601] [--coverage-source SOURCE,...] [--dropped-count N] [--outbox-directory PATH]\nagent-blackboard journal entries --session-id UUID\nagent-blackboard journal flush --outbox-directory PATH\nInteractive journal append requires --outbox-directory PATH.\nagent-blackboard snapshot partition --snapshot PATH --checksum SHA256 --counts '{\"sessions\":N,\"entries\":N,\"records\":N,\"bytes\":N}'\nagent-blackboard snapshot cleanup [--snapshot PATH] [--partition-directory PATH --receipt JSON]\nmcp\n  (no args)              Serve journal_append, journal_entries, outbox_status, outbox_flush,\n                         session_ensure, snapshot_export, and session_archive over stdio.\n                         Needs the optional @modelcontextprotocol/sdk peer (and zod).\n                         Launch it from inside the repository's git worktree.\n";
+export declare const USAGE = "Usage: vouchington <command> [options]\n\nCommands:\n  runner-port-policy   Print or validate a runner port policy\n  with-host-lock       Run a command under a host-wide lock\n  gha-runtime-audit             Audit successful GitHub Actions job runtimes\n  require-up-to-date            Require HEAD to include a fetched remote branch\n  gitleaks-directory-scan       Scan a directory with Gitleaks\n  ast-grep-examples             Run AST-grep rule examples\n  ast-grep-pack                 Print shipped unconditional AST-grep pack paths as JSON\n  gha-workspace-policy          Check GitHub Actions workspace safety policy\n  gha-output                    Write a collision-safe multiline GITHUB_OUTPUT record\n  gha-needs-results             Fail if required GitHub Actions job results failed\n  download-with-diagnostics     Download a URL and report HTTP status on failure\n  download-optional-run-artifacts  Download optional artifacts from the current run\n  host-pressure-diagnostics     Print a bounded host memory/OOM/PSI snapshot\n  allocate-browser-safe-ports   Allocate Fetch-safe localhost ports\n  diagnose-port-collision       Capture bounded localhost port diagnostics\n  prepare-trivy-db              Download the Trivy vulnerability database\n  gha-artifacts-cleanup         Delete classified GitHub Actions artifacts\n  http-origin                   Validate an optional HTTP(S) origin\n  vitest-blob-manifest          Stamp a vitest-blob-manifest:v1 identity file\n  vitest-report-attempt         Write or read a Vitest report-attempt marker\n  prepare-vitest-reports        Validate and select Vitest report JSON files\n  pnpm-install                  Install a pnpm workspace with retry and release-age fail-fast\n  check-cache-size              Measure a path and decide whether to save a GHA cache\n  make-shard-matrix             Emit a [1..N] GitHub Actions shard matrix\n  load-runner-env               Overlay a runner env file onto GITHUB_ENV with injection guards\n  clean-workspace               Reset a persistent-runner workspace with a fork-PR trust gate\n  install-github-release        Download a checksum-verified GitHub Release binary\n  run-with-timeout              Run a command with GNU timeout or a Perl fallback\n  lint-links                    Two-pass lychee: internal links fail, external warn\n  materialize-pr-context        Dump PR title/body/files/diff/comments and #N crawl\n  wait-for-apt-locks            Wait until apt/dpkg lock files are free\n  install-playwright-chromium-arm64  Install Playwright Chromium from browsers.json\n  ghcr-package-retention        Delete old GHCR package versions past KEEP_MIN\n  harness-admission-lane        Compute a GITHUB_RUN_ID admission lane for fleet fan-out\n  harness-assert-gates          Fail if any named HARNESS_*_ENABLED gate is enabled\n  gha-collaborator-trust        Classify authors as write-access collaborators or not\n  nuget-central-version         Validate a Directory.Packages.props PackageVersion delta\n  swift-semantic-equal          Compare Swift sources ignoring comments and whitespace\n  post-review                   Post one COMMENT review from a staged payload file\n  stage-review-payload          Validate a review payload file into a staging directory\n  retrospective-transcript      Format facts from Claude-compatible, Codex, or Grok transcripts\n  link-skill                    Link one packaged skill into an explicit consumer directory\n  retrospective-facts           Gather immutable facts for a retrospective\n  agent-blackboard              Probe and journal an Agent Blackboard deployment\n  mcp                           Serve the agent-blackboard journal tools over stdio (MCP)\n\nOptions:\n  -h, --help       Show this help\n  -v, --version    Print the package version\n\nrunner-port-policy\n  (no args)              Print the shipped policy as JSON\n  --file <path>          Validate and print a policy file\n  --reserved <port>      Print true if the port is reserved\n\nwith-host-lock\n  --name <family>\n  [--slots <n>]\n  --timeout-seconds <n>\n  [--command-timeout-seconds <n>]\n  [--failure-diagnostics <absolute-script>]\n  [--on-acquire-timeout fail|run-unlocked]\n  -- <command> [args...]\n\ngha-runtime-audit\n  [--repository owner/name]   Default GITHUB_REPOSITORY\n  [--branch main]\n  [--median-threshold-floor <seconds>]    Off unless set. Must be below the ceiling\n  [--median-threshold-ceiling <seconds>]  Default 360. Flags a five-sample median above this\n  --pr-workflow <name|/regex/>     Repeatable\n  --push-workflow <name|/regex/>   Repeatable\n\nrequire-up-to-date --remote <name> --branch <name>\ngitleaks-directory-scan --config <path> [--directory <path>]\nast-grep-examples --rules <directory> --config <path>\nast-grep-pack\ngha-workspace-policy [--root <directory>] [--workflow-directory <directory>] [--action-directory <directory>]\n\ngha-output <name>\ngha-needs-results [label]\ndownload-with-diagnostics <url> <destination> [-- curl-args...]\ndownload-optional-run-artifacts (--name <name>... | --pattern <pattern>) --dir <directory>\nhost-pressure-diagnostics\nallocate-browser-safe-ports <count> [--policy path] [--forbidden-ports path]\ndiagnose-port-collision [--ports \"2200 2216\"] [--output-dir PATH]\nprepare-trivy-db\ngha-artifacts-cleanup run --run-id <id> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\ngha-artifacts-cleanup sweep --older-than-hours <n> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\nhttp-origin [--field NAME] [value]\nvitest-blob-manifest <suite> [reports-directory]\nvitest-report-attempt <write DIRECTORY SUITE|read ROOT>\nprepare-vitest-reports [primary-directory] [fallback-directory] [output-directory]\npnpm-install --runner-lifecycle persistent|ephemeral|ephemeral-full --install-scripts true|false\ncheck-cache-size <path> <max-bytes> <label>\nmake-shard-matrix <total>\nload-runner-env\nclean-workspace\ninstall-github-release --repo owner/name --version X --asset 'name-{platform}.tar.gz' --bin name [--tag-prefix PREFIX] [--expected-sha256 SHA256] [--no-checksum] [--checksums-asset NAME] [--version-flag FLAG] [--bin-dir DIR]\nrun-with-timeout <timeout-seconds> <kill-after-seconds> <command...>\nlint-links [--offline] [--config PATH] [--glob PATTERN] [files...]\nmaterialize-pr-context\nwait-for-apt-locks\ninstall-playwright-chromium-arm64 [name:archive...]\nghcr-package-retention <url-encoded-package>...\nharness-admission-lane <lanes>\nharness-assert-gates <gate>...\ngha-collaborator-trust <owner/repo> [--allow-bot <login>]... < authors.json\nnuget-central-version <trusted-props> <candidate-props> <metadata-json> <output-props>\nswift-semantic-equal <base> <head> <file.swift>\npost-review\nstage-review-payload optional|required <source> <destination>\nretrospective-transcript [--session-id ID] [--jsonl PATH] [--projects-dir PATH] [--codex-sessions-dir PATH] [--grok-sessions-dir PATH]\nlink-skill <name> --source-root <skills-dir> --target-root <consumer-skills-dir>  Link a packaged or repository-local skill\nretrospective-facts (--pr NUMBER | --branch NAME | --no-pr) [--repo OWNER/NAME] [--raw]\nagent-blackboard probe\nagent-blackboard journal append --mode interactive|autonomous --source-event-id ID --work-outcome OUTCOME --coverage-status STATUS --session-id UUID --agent NAME --version VERSION --file PATH --repository OWNER/NAME [--repository OWNER/NAME ...] [--parent-session-id UUID] [--timestamp ISO8601] [--coverage-source SOURCE,...] [--dropped-count N] [--outbox-directory PATH]\nagent-blackboard journal entries --session-id UUID\nagent-blackboard journal flush --outbox-directory PATH\nInteractive journal append requires --outbox-directory PATH.\nagent-blackboard snapshot partition --snapshot PATH --checksum SHA256 --counts '{\"sessions\":N,\"entries\":N,\"records\":N,\"bytes\":N}'\nagent-blackboard snapshot cleanup [--snapshot PATH] [--partition-directory PATH --receipt JSON]\nmcp\n  (no args)              Serve journal_append, journal_entries, outbox_status, outbox_flush,\n                         session_ensure, snapshot_export, and session_archive over stdio.\n                         Needs the optional @modelcontextprotocol/sdk peer (and zod).\n                         Launch it from inside the repository's git worktree.\n";
 export declare function printUsage(stream?: NodeJS.WritableStream): void;
 export declare function commandNames(usage?: string): string[];
 export declare function commandUsage(command: string, usage?: string): string;

package/dist/cli/usage.mjs

@@ -3,7 +3,6 @@ export const USAGE = `Usage: vouchington <command> [options]
 Commands:
   runner-port-policy   Print or validate a runner port policy
   with-host-lock       Run a command under a host-wide lock
-  agent-harness-config          Apply classifier-auto + sandbox keys to agent harnesses
   gha-runtime-audit             Audit successful GitHub Actions job runtimes
   require-up-to-date            Require HEAD to include a fetched remote branch
   gitleaks-directory-scan       Scan a directory with Gitleaks
@@ -66,10 +65,6 @@ with-host-lock
   [--on-acquire-timeout fail|run-unlocked]
   -- <command> [args...]
 
-agent-harness-config dump
-agent-harness-config check|apply [--global] [--repo PATH]... [--harness claude|codex|grok|cursor]...
-  [--home PATH]
-
 gha-runtime-audit
   [--repository owner/name]   Default GITHUB_REPOSITORY
   [--branch main]

package/dist/contract-schema/contract-schema-bounded-array.d.mts

@@ -9,7 +9,5 @@ export type ExtractionContext = {
     options: ExtractContractSchemaOptions;
 };
 type SchemaForType = (type: ts.Type, context: ExtractionContext) => ContractSchemaNode;
-export declare function boundedArraySchema(type: ts.Type, context: ExtractionContext, schemaForType: SchemaForType): Extract<ContractSchemaNode, {
-    type: 'array';
-}> | undefined;
+export declare function boundedArraySchema(type: ts.Type, context: ExtractionContext, schemaForType: SchemaForType): ContractSchemaNode | undefined;
 export {};

package/dist/contract-schema/contract-schema-bounded-array.mjs

@@ -16,6 +16,11 @@ export function boundedArraySchema(type, context, schemaForType) {
     if (!(uniqueItemsType.flags & ts.TypeFlags.BooleanLiteral)) {
         throw unsupportedType(type, context.checker, `${alias} uniqueness must be literal`);
     }
+    if (itemType.flags & ts.TypeFlags.Never) {
+        if (minItems !== 0)
+            throw unsupportedType(type, context.checker, `${alias} has impossible never element bounds`);
+        return { type: 'tuple', items: [], optionalItems: 0 };
+    }
     return {
         type: 'array',
         items: schemaForType(itemType, context),

package/dist/contract-schema/contract-schema-object-tuple.mjs

@@ -1,7 +1,7 @@
 import ts from './typescript-api.mjs';
 import { compareSymbols } from './contract-schema-type-utils.mjs';
 export function objectSchema(type, context, schemaForType) {
-    const properties = {};
+    const properties = new Map();
     for (const property of context.checker.getPropertiesOfType(type).toSorted(compareSymbols)) {
         const declaration = property.valueDeclaration;
         /* v8 ignore start */
@@ -12,10 +12,10 @@ export function objectSchema(type, context, schemaForType) {
             throw new Error(`Property "${property.name}" has no type`);
         /* v8 ignore stop */
         try {
-            properties[property.name] = {
+            properties.set(property.name, {
                 required: !(property.flags & ts.SymbolFlags.Optional),
                 schema: schemaForType(propertyType, context),
-            };
+            });
         }
         catch (error) {
             throw new Error(`Property "${property.name}": ${error.message}`, { cause: error });
@@ -24,8 +24,10 @@ export function objectSchema(type, context, schemaForType) {
     const stringIndex = context.checker.getIndexInfoOfType(type, ts.IndexKind.String);
     return {
         type: 'object',
-        properties,
-        additionalProperties: stringIndex ? schemaForType(stringIndex.type, context) : false,
+        properties: Object.fromEntries(properties),
+        additionalProperties: stringIndex && !(stringIndex.type.flags & ts.TypeFlags.Never)
+            ? schemaForType(stringIndex.type, context)
+            : false,
     };
 }
 /* v8 ignore start -- checker internal used only for compiler-synthesized properties */

package/dist/contract-schema/contract-schema-type-extractor.mjs

@@ -80,6 +80,17 @@ function schemaForType(type, context) {
         return buildUnion();
     }
     if (type.isIntersection()) {
+        const index = checker.getIndexTypeOfType(type, ts.IndexKind.String);
+        const properties = checker.getPropertiesOfType(type);
+        if (index && index.flags & ts.TypeFlags.Never && properties.length > 0) {
+            if (properties.some((property) => !(property.flags & ts.SymbolFlags.Optional)))
+                throw unsupportedType(type, checker, 'never string index conflicts with named properties');
+            if (checker.getSignaturesOfType(type, ts.SignatureKind.Call).length > 0)
+                throw unsupportedType(type, checker, 'callable types are not supported');
+            if (checker.getSignaturesOfType(type, ts.SignatureKind.Construct).length > 0)
+                throw unsupportedType(type, checker, 'constructable types are not supported');
+            return { type: 'object', properties: {}, additionalProperties: false };
+        }
         return {
             type: 'intersection',
             variants: distinctNodes(type.types.map((variant) => schemaForType(variant, context))),
@@ -104,6 +115,8 @@ function schemaForType(type, context) {
         /* v8 ignore next */
         if (!typeArguments[0])
             throw unsupportedType(type, checker, 'array element type is missing');
+        if (typeArguments[0].flags & ts.TypeFlags.Never)
+            return { type: 'tuple', items: [], optionalItems: 0 };
         return { type: 'array', items: schemaForType(typeArguments[0], context) };
     }
     if (checker.getSignaturesOfType(type, ts.SignatureKind.Call).length > 0) {

package/dist/contract-schema/contract-schema-validator.mjs

@@ -66,7 +66,7 @@ function validateObject(node, value, path, context, checkUnexpected) {
     if (!isObject(value))
         return requireType(false, 'object', value, path, context);
     for (const [key, property] of Object.entries(node.properties)) {
-        if (!(key in value)) {
+        if (!Object.hasOwn(value, key)) {
             if (property.required) {
                 addIssue(context, propertyPath(path, key), 'missing-required', 'Required field is missing');
             }
@@ -77,7 +77,7 @@ function validateObject(node, value, path, context, checkUnexpected) {
     if (!checkUnexpected)
         return;
     for (const [key, nested] of Object.entries(value)) {
-        if (key in node.properties)
+        if (Object.hasOwn(node.properties, key))
             continue;
         if (node.additionalProperties === false) {
             addUnexpectedIssue(context, propertyPath(path, key));

package/dist/index.d.mts

@@ -15,8 +15,6 @@ export type { EphemeralListenerOptions, RunnerPortPolicy } from './runner-port-p
 export { extractAlterTableAddColumnLocations, extractCreateIndexMetadata, extractCreateTableMetadata, extractDefaultFunction, extractDropIndexMetadata, extractFuncCallArgColumnNames, extractMigrationConstraintMetadata, initSqlAst, lineOfUtf8ByteOffset, MissingSqlAstParserError, parseSql, } from './sql-ast/index.mts';
 export type { ForeignKey, SqlCreateIndexMetadata, SqlCreateTableColumn, SqlCreateTableMetadata, SqlDropIndexMetadata, SqlIndexParam, SqlMigrationConstraintMetadata, } from './sql-ast/index.mts';
 export { dollarQuoteEnd, lineOf, maskSqlQuotedText, readDollarQuoteDelimiter, readStringLiteral, splitSqlStatements, sqlFragments, stripSqlComments, } from './sql-scanner/index.mts';
-export { applyHarnessConfig, checkHarnessConfig, dumpHarnessPolicy, planHarnessConfig, DEFAULT_EXTRA_WRITABLE_ROOTS, } from './agent-harness-config/index.mts';
-export type { ApplyTarget, FilePlan, FileResult, HarnessApplyResult, HarnessCheckResult, HarnessConfigOptions, HarnessId, HarnessPlan, HarnessPolicyDump, JsonPatch, KeyDrift, TomlPatch, TomlValue, } from './agent-harness-config/index.mts';
 export { auditCiJobRuntime, parseWorkflowNameMatch } from './gha-runtime-audit/index.mts';
 export type { GhApiExecutor, RuntimeAuditOptions, RuntimeAuditResult, RuntimeAuditWorkflowFilter, RuntimeJobResult, RuntimeSample, } from './gha-runtime-audit/index.mts';
 export { checkGhaWorkspacePolicy } from './gha-workspace-policy/index.mts';

package/dist/index.mjs

@@ -8,7 +8,6 @@ export { buildSessionFrictionReport, classifyFrictionObservation, FRICTION_LOG_M
 export { EphemeralListenerAttemptsExhaustedError, isRunnerReservedPort, listenOnRunnerUnreservedEphemeralPort, loadRunnerPortPolicy, runnerPortPolicy, validateRunnerPortPolicy, } from './runner-port-policy/index.mjs';
 export { extractAlterTableAddColumnLocations, extractCreateIndexMetadata, extractCreateTableMetadata, extractDefaultFunction, extractDropIndexMetadata, extractFuncCallArgColumnNames, extractMigrationConstraintMetadata, initSqlAst, lineOfUtf8ByteOffset, MissingSqlAstParserError, parseSql, } from './sql-ast/index.mjs';
 export { dollarQuoteEnd, lineOf, maskSqlQuotedText, readDollarQuoteDelimiter, readStringLiteral, splitSqlStatements, sqlFragments, stripSqlComments, } from './sql-scanner/index.mjs';
-export { applyHarnessConfig, checkHarnessConfig, dumpHarnessPolicy, planHarnessConfig, DEFAULT_EXTRA_WRITABLE_ROOTS, } from './agent-harness-config/index.mjs';
 export { auditCiJobRuntime, parseWorkflowNameMatch } from './gha-runtime-audit/index.mjs';
 export { checkGhaWorkspacePolicy } from './gha-workspace-policy/index.mjs';
 export { requireUpToDate } from './require-up-to-date/index.mjs';

package/dist/openapi-document/build-openapi-catalog-sse.d.mts

@@ -0,0 +1,4 @@
+import type { buildOperationResponse } from './build-openapi-response.mts';
+import type { RegisteredRoute, ResponseContract } from './operation-types.mts';
+/** Keeps a cataloged stream unavailable until its extracted variants describe SSE. */
+export declare function retainCatalogSseResponse(kind: RegisteredRoute['kind'] | undefined, variants: readonly ResponseContract[], rendered: ReturnType<typeof buildOperationResponse>): ReturnType<typeof buildOperationResponse>;

package/dist/openapi-document/build-openapi-catalog-sse.mjs

@@ -0,0 +1,27 @@
+import { catalogResponse } from './openapi-route-helpers.mjs';
+/** Keeps a cataloged stream unavailable until its extracted variants describe SSE. */
+export function retainCatalogSseResponse(kind, variants, rendered) {
+    if (kind !== 'sse' ||
+        variants.some((variant) => variant.mediaType === 'text/event-stream' &&
+            variant.mediaTypeKnowledge !== 'unknown' &&
+            variant.bodyKind !== 'none'))
+        return rendered;
+    const reason = [rendered.unavailableReason, catalogResponse('sse').unavailableReason]
+        .filter(Boolean)
+        .join('; ');
+    const existing = rendered.responses[200];
+    return {
+        responses: {
+            ...rendered.responses,
+            200: {
+                ...existing,
+                description: existing?.description ?? 'OK',
+                content: { ...existing?.content, 'text/event-stream': { schema: {} } },
+                'x-schema-unavailable': true,
+                'x-schema-unavailable-reason': reason,
+            },
+        },
+        unavailable: true,
+        unavailableReason: reason,
+    };
+}

package/dist/openapi-document/build-openapi-document.mjs

@@ -1,6 +1,7 @@
 import { queryParameters } from './build-openapi-query.mjs';
 import { buildOperationRequestBody } from './build-openapi-request.mjs';
 import { buildOperationResponse } from './build-openapi-response.mjs';
+import { retainCatalogSseResponse } from './build-openapi-catalog-sse.mjs';
 import { createComponentRegistry } from './component-registry.mjs';
 import { responseStatusCodesForContract, routeShape, } from './operation-types.mjs';
 import { registerOpenApiErrorResponse } from './openapi-error-response.mjs';
@@ -112,10 +113,12 @@ function assertFixedNoContent(catalogRoute, variants, groupKey) {
     throw new Error(`OpenAPI fixed-no-content metadata conflicts with extracted response variants for ${groupKey}`);
 }
 function renderOperation(catalogRoute, variants, registry) {
-    if (catalogRoute?.kind === 'sse' || catalogRoute?.kind === 'fixed-no-content')
+    if (catalogRoute?.kind === 'fixed-no-content')
         return catalogResponse(catalogRoute.kind, catalogRoute.fixedStatus);
     if (variants)
-        return buildOperationResponse(variants, registry);
+        return retainCatalogSseResponse(catalogRoute?.kind, variants, buildOperationResponse(variants, registry));
+    if (catalogRoute?.kind === 'sse')
+        return catalogResponse('sse');
     if (catalogRoute?.kind === 'error-only')
         return catalogResponse('error-only');
     return catalogResponse('ordinary');

package/dist/openapi-document/build-openapi-response.d.mts

@@ -1,8 +1,8 @@
 import type { ComponentRegistry } from './component-registry.mts';
 import { type ResponseContract } from './operation-types.mts';
-import type { OpenApiResponseOrRef, OpenApiSchema } from './openapi-types.mts';
+import type { OpenApiResponse, OpenApiSchema } from './openapi-types.mts';
 export declare function buildOperationResponse(variants: ResponseContract[], registry: ComponentRegistry): {
-    responses: Record<number, OpenApiResponseOrRef>;
+    responses: Record<number, OpenApiResponse>;
     unavailable: boolean;
     unavailableReason?: string;
 };

package/dist/openapi-document/build-openapi-response.mjs

@@ -1,4 +1,5 @@
 import { STATUS_CODES } from 'node:http';
+import { collectSseEventSchemas, renderSseEvents, } from './build-openapi-sse-events.mjs';
 import { nodeToOpenApi } from './contract-schema-to-openapi.mjs';
 import { responseStatusCodesForContract } from './operation-types.mjs';
 export function buildOperationResponse(variants, registry) {
@@ -7,6 +8,8 @@ export function buildOperationResponse(variants, registry) {
     const operationFailures = [];
     for (const contract of variants) {
         const converted = convertContract(contract, registry);
+        const events = collectSseEventSchemas(contract, registry);
+        operationFailures.push(...events.failureReasons);
         if (converted.failureReason)
             operationFailures.push(converted.failureReason);
         if (contract.statusKnowledge === 'unknown' && !converted.failureReason)
@@ -17,6 +20,8 @@ export function buildOperationResponse(variants, registry) {
                 if (converted.failureReason)
                     reasons.push(converted.failureReason);
                 bodyless.set(status, reasons);
+                if (contract.includeDefaultError)
+                    addDefaultError(content, status, registry);
                 continue;
             }
             const mediaType = mediaTypeFor(contract);
@@ -25,12 +30,21 @@ export function buildOperationResponse(variants, registry) {
                 continue;
             }
             const byMedia = content.get(status) ?? new Map();
-            const bucket = byMedia.get(mediaType) ?? { schemas: [], failureReasons: [] };
-            bucket.schemas.push(converted.schema ?? {});
+            const bucket = byMedia.get(mediaType) ?? {
+                schemas: [],
+                failureReasons: [],
+                sseEvents: new Map(),
+            };
+            bucket.schemas.push(mediaType === 'text/event-stream' ? { type: 'string' } : (converted.schema ?? {}));
+            bucket.failureReasons.push(...events.failureReasons);
             if (converted.failureReason)
                 bucket.failureReasons.push(converted.failureReason);
+            for (const [name, schemas] of events.schemas)
+                bucket.sseEvents.set(name, [...(bucket.sseEvents.get(name) ?? []), ...schemas]);
             byMedia.set(mediaType, bucket);
             content.set(status, byMedia);
+            if (contract.includeDefaultError)
+                addDefaultError(content, status, registry);
         }
     }
     const responses = {};
@@ -45,6 +59,17 @@ export function buildOperationResponse(variants, registry) {
         ...(reasons.length > 0 ? { unavailableReason: reasons.join('; ') } : {}),
     };
 }
+function addDefaultError(content, status, registry) {
+    const byMedia = content.get(status) ?? new Map();
+    const bucket = byMedia.get('application/json') ?? {
+        schemas: [],
+        failureReasons: [],
+        sseEvents: new Map(),
+    };
+    bucket.schemas.push({ $ref: `#/components/schemas/${registry.refName('ErrorBody')}` });
+    byMedia.set('application/json', bucket);
+    content.set(status, byMedia);
+}
 function renderStatusResponse(status, byMedia, bodyless, operationFailures) {
     const hasBodyless = bodyless.has(status);
     const conflictReason = byMedia && hasBodyless
@@ -67,7 +92,12 @@ function renderStatusResponse(status, byMedia, bodyless, operationFailures) {
                     .toSorted(([left], [right]) => left.localeCompare(right))
                     .map(([mediaType, bucket]) => [
                     mediaType,
-                    { schema: mergeVariantSchemas(bucket.schemas) },
+                    {
+                        schema: mergeVariantSchemas(bucket.schemas),
+                        ...(bucket.sseEvents.size
+                            ? { 'x-sse-events': renderSseEvents(bucket.sseEvents) }
+                            : {}),
+                    },
                 ])),
             }
             : {}),

package/dist/openapi-document/build-openapi-sse-events.d.mts

@@ -0,0 +1,11 @@
+import type { ComponentRegistry } from './component-registry.mts';
+import type { ResponseContract } from './operation-types.mts';
+import type { OpenApiSchema } from './openapi-types.mts';
+export type SseEventSchemas = Map<string, OpenApiSchema[]>;
+export declare function collectSseEventSchemas(contract: ResponseContract, registry: ComponentRegistry): {
+    schemas: SseEventSchemas;
+    failureReasons: string[];
+};
+export declare function renderSseEvents(schemas: SseEventSchemas): Record<string, {
+    dataSchema: OpenApiSchema;
+}>;

package/dist/openapi-document/build-openapi-sse-events.mjs

@@ -0,0 +1,46 @@
+import { nodeToOpenApi } from './contract-schema-to-openapi.mjs';
+export function collectSseEventSchemas(contract, registry) {
+    const schemas = new Map();
+    const failureReasons = [];
+    if (contract.mediaType !== 'text/event-stream' && !contract.sseEvents)
+        return { schemas, failureReasons };
+    if (contract.mediaType !== 'text/event-stream' || contract.bodyKind === 'none')
+        return {
+            schemas,
+            failureReasons: ['SSE event metadata requires a text/event-stream response body'],
+        };
+    if (!contract.sseEvents?.length)
+        return { schemas, failureReasons: ['SSE event payload contracts are missing'] };
+    for (const { eventName, contract: event } of contract.sseEvents) {
+        if (!eventName.trim() || event.schema.root.type === 'unknown') {
+            failureReasons.push('SSE event payload or name is not statically known');
+            continue;
+        }
+        let schema;
+        try {
+            schema = nodeToOpenApi(event.schema.root, {
+                definitions: event.schema.definitions,
+                refName: registry.refName,
+            });
+        }
+        catch (error) {
+            failureReasons.push(String(error));
+            continue;
+        }
+        registry.register(event.source, event.schema.definitions);
+        const variants = schemas.get(eventName) ?? [];
+        variants.push(schema);
+        schemas.set(eventName, variants);
+    }
+    return { schemas, failureReasons };
+}
+export function renderSseEvents(schemas) {
+    return Object.fromEntries([...schemas.entries()]
+        .toSorted(([left], [right]) => left.localeCompare(right))
+        .map(([name, variants]) => {
+        const unique = [
+            ...new Map(variants.map((schema) => [JSON.stringify(schema), schema])).values(),
+        ].toSorted((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+        return [name, { dataSchema: unique.length === 1 ? unique[0] : { anyOf: unique } }];
+    }));
+}

package/dist/openapi-document/contract-schema-intersection-merge.mjs

@@ -11,10 +11,10 @@ export function intersectionToOpenApi(node, ctx, nodeToOpenApi) {
     if (resolved.some((variant) => variant === undefined)) {
         return { allOf: node.variants.map((variant) => nodeToOpenApi(variant, ctx)) };
     }
-    const properties = {};
+    const properties = new Map();
     for (const variant of resolved) {
         for (const [key, property] of Object.entries(variant.properties)) {
-            const existing = properties[key];
+            const existing = properties.get(key);
             if (existing &&
                 hashSchemaNode(existing.schema, ctx) !== hashSchemaNode(property.schema, ctx)) {
                 // A member re-declaring a shared key with a strictly narrower type is a common, valid
@@ -23,33 +23,33 @@ export function intersectionToOpenApi(node, ctx, nodeToOpenApi) {
                 // narrower type, not a conflict. Prefer whichever side is the narrower one; only two
                 // genuinely incompatible schemas (neither a subset of the other) are a real conflict.
                 if (isNarrowerVariant(property.schema, existing.schema, ctx)) {
-                    properties[key] = {
+                    properties.set(key, {
                         schema: property.schema,
                         required: existing.required || property.required,
-                    };
+                    });
                     continue;
                 }
                 /* v8 ignore next 6 -- symmetric of the previous branch; covered by order-swapped fixtures */
                 if (isNarrowerVariant(existing.schema, property.schema, ctx)) {
-                    properties[key] = {
+                    properties.set(key, {
                         schema: existing.schema,
                         required: existing.required || property.required,
-                    };
+                    });
                     continue;
                 }
                 throw new Error(`Cannot merge intersection: property "${key}" has conflicting schemas across members`);
             }
-            properties[key] = {
+            properties.set(key, {
                 schema: property.schema,
                 required: existing?.required || property.required,
-            };
+            });
         }
     }
-    const sortedKeys = Object.keys(properties).toSorted();
-    const required = sortedKeys.filter((key) => properties[key].required);
+    const sortedKeys = [...properties.keys()].toSorted();
+    const required = sortedKeys.filter((key) => properties.get(key).required);
     return {
         type: 'object',
-        properties: Object.fromEntries(sortedKeys.map((key) => [key, nodeToOpenApi(properties[key].schema, ctx)])),
+        properties: Object.fromEntries(sortedKeys.map((key) => [key, nodeToOpenApi(properties.get(key).schema, ctx)])),
         ...(required.length > 0 ? { required } : {}),
         additionalProperties: false,
     };