[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_573":-7,"_574":-5,"_575":-5,"_576":-5,"_577":14,"_578":25,"_579":580,"_581":582,"_583":25,"_584":585,"_586":587,"_55":56,"_57":25},"routes/_auth",{"_547":-5,"_548":549,"_550":551,"_552":553,"_554":555,"_556":557,"_558":25,"_43":14,"_559":14,"_560":14,"_561":14,"_562":14,"_563":25,"_564":14,"_565":-7,"_566":567,"_568":569,"_570":571,"_572":14,"_55":56,"_57":25},"routes/_auth.cipes.$cipeId",{"_11":12,"_13":14,"_15":-5,"_16":17,"_18":19,"_20":-5,"_21":22,"_23":14,"_24":25,"_26":14,"_27":-5,"_28":-5,"_29":14,"_30":31,"_32":25,"_33":14,"_34":25,"_35":36,"_37":38,"_39":40,"_41":42,"_43":14,"_44":25,"_45":14,"_46":14,"_47":14,"_48":14,"_49":50,"_51":52,"_53":14,"_54":-5,"_55":56,"_57":25,"_58":59,"_60":-5},"workspace",{"_69":309,"_501":104,"_81":258,"_502":-5,"_503":504,"_115":505,"_506":507,"_508":507,"_509":14,"_510":511,"_512":-5,"_75":513,"_84":514,"_515":516,"_517":25,"_518":519,"_520":14,"_521":25,"_522":523,"_524":525,"_526":527,"_528":529,"_530":531,"_532":533,"_534":-7},"isAdmin",false,"membership","ciPipelineExecution",{"_69":77,"_308":309,"_310":215,"_311":312,"_75":313,"_84":314,"_218":315,"_316":317,"_318":319,"_73":79,"_320":14,"_321":-5,"_322":323,"_324":325,"_326":327,"_328":329,"_330":-5,"_331":25,"_332":333,"_334":-5,"_335":-5,"_336":337,"_338":-5,"_339":-5,"_340":-5,"_341":-5,"_342":-5,"_343":-5,"_344":-5},"runGroup",{"_213":214,"_18":215,"_75":216,"_84":217,"_218":219,"_73":79,"_220":-5,"_221":25,"_222":-5,"_223":-5,"_224":-5,"_225":226,"_227":25,"_228":229,"_230":14,"_231":232,"_233":234,"_235":236,"_237":-5,"_238":239,"_240":241,"_242":243,"_244":-5,"_245":14,"_246":247,"_248":249,"_250":249,"_251":252,"_253":14},"cancellationTriggeringUserName","organization",{"_81":82,"_75":83,"_84":85,"_65":25,"_86":25,"_87":88,"_89":90,"_91":14,"_92":93,"_94":14,"_95":25,"_96":97,"_98":99,"_100":25,"_101":102,"_103":104,"_69":104,"_105":106,"_107":-7,"_108":14,"_109":14,"_110":14,"_111":14,"_112":14,"_113":114,"_115":116,"_117":-5,"_118":-5,"_119":-7},"shouldCompleteAccessControlSetup","isWorkspaceClaimed",true,"isCurrentUserOrganizationMember","aiFix","mostRecentCipeForBranch","supersededOnBranch","attempts",[67,68],"multipleFailuresWithoutFixes","isResourceUsageAvailable","isCipeExecutionTimelineEnabled","cappedCiPipelineExecutionCount",10,"currentUsagePercentage",100,"contributorsCount",134,"nxCloudAppUrl","https://cloud.nx.app","isPrivateCloud","isSandboxingToggleEnabled","isUltracacheUiEnabled","isTaskArtifactsViewerEnabled","isSandboxingPreviewEligible","isResourceUsagePreviewEligible","organizationActor",{"_64":65,"_66":14},"settingsDestinations",[],"managedCiNavigation","pipelinePreview","result","success","ok","managedContext",{"_61":62,"_63":-5},"overviewPreview","loadedAt",1793399052691,"managed","access","public","isInternalAdmin",{"_69":77,"_71":78,"_73":79,"_75":80},{"_69":70,"_71":72,"_73":74,"_75":76},"_id","6ada0d6d589c015bdb72a0a8","attemptNumber",2,"status","FAILED","createdAt","2026-10-22T13:19:41.958Z","6ada13fe8475d7a9410dfded",3,"SUCCEEDED","2026-10-22T13:47:42.278Z","name","TanStack",["D",1678953117327],"updatedAt",["D",1791581852888],"enabled","plan","OSS","planActivationDate",["D",1681913269035],"isEligibleForProTrial","planLimits",{"_143":144,"_145":146,"_147":148,"_149":150,"_151":150,"_152":153,"_154":155,"_156":155,"_157":158},"isAiBringYourOwnKey","isAiEnabled","privateAccess","MEMBERS_ONLY","planTransitions",[],"allowPrivilegedAgentCapabilities","resourceUsageViewedAt",["D",1785439427946],"id","6412ca9d1c251d000efa21ba","memberships",[125,126,127,128,129,130,131],"privateCloudInstallationId","hasBillingInformation","hasLicense","isUnclaimed","isOnTrial","isHighPriority","vcsProfileLink","https://github.com/organizations/TanStack/settings/profile","vcsConfiguration",{"_120":121,"_122":123,"_124":82},"lastMembersSyncedAt","enterpriseTrial","disabledReasonMessage","provider","GITHUB","vcsOrganizationId","72518640","vcsOrganizationName",{"_132":142,"_134":135},{"_132":141,"_134":135},{"_132":140,"_134":135},{"_132":139,"_134":135},{"_132":138,"_134":137},{"_132":136,"_134":137},{"_132":133,"_134":135},"userId","62aa1f8a86f3d10005571913","role","admin","67996bb7ff879c45f678c044","member","64f0c3871ce17678e1f2ba5a","65bd71e6aefbc8e5daf93e52","64456449119e68000d2e957d","641b03afeead08000e27f2c1","612011eac3430200057bde33","baseIncludedCredits",300000,"additionalCredits",{},"discountedCreditsMaximum",0,"contributorLimit",70,"concurrentConnectionLimit","runsLimit",1000000,"adminUserLimit",9999,"workspaceLimit","modifiers",[159,160,161,162,163,164,165,166,167,168],{"_169":170,"_171":210,"_173":174,"_175":211,"_177":212,"_179":180,"_181":187,"_183":25},{"_169":170,"_171":207,"_173":174,"_175":208,"_177":209,"_179":180,"_181":187,"_183":25},{"_169":170,"_171":204,"_173":174,"_175":205,"_177":206,"_179":180,"_181":197,"_183":25},{"_169":170,"_171":201,"_173":174,"_175":202,"_177":203,"_179":180,"_181":187,"_183":25},{"_169":170,"_171":198,"_173":174,"_175":199,"_177":200,"_179":180,"_181":182,"_183":25},{"_169":170,"_171":194,"_173":174,"_175":195,"_177":196,"_179":180,"_181":197,"_183":25},{"_169":170,"_171":191,"_173":174,"_175":192,"_177":193,"_179":180,"_181":187,"_183":25},{"_169":170,"_171":188,"_173":174,"_175":189,"_177":190,"_179":180,"_181":187,"_183":25},{"_169":170,"_171":184,"_173":174,"_175":185,"_177":186,"_179":180,"_181":187,"_183":25},{"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":25},"displayName","Achievement credit reward","description","Invite 2 team members and receive 30,000 credits after they log in.","appliesTo","ALL_CREDITS","appliedAt",["D",1788209088720],"expiresAt",["D",1790812800000],"validationPeriod","BILLING_CYCLE","value",30000,"active","Right-size agents and track CPU and memory stats. Included with Enterprise or available as an add-on.",["D",1785439427976],["D",1788220800000],10000,"Earn 10,000 credits by securing your workspace with caching strategies and CI tokens.",["D",1785439421422],["D",1788220800000],"Authenticate the Nx CLI with `nx login` so your runs can read and write the shared cache under your own identity.",["D",1785439383610],["D",1788220800000],"Let Nx Cloud propose a fix when CI fails and apply it to get the pipeline green.",["D",1785439383535],["D",1788220800000],20000,"Run CI with Nx Cloud connected and restore at least one task from the remote cache after claiming your workspace.",["D",1785439383535],["D",1788220800000],"Create a CI access token and remove read-write default access so cache reads and writes are protected.",["D",1785439383535],["D",1788220800000],"Run CI with distributed task execution so work is spread across agents to cut wall-clock time.",["D",1785439383535],["D",1788220800000],"Let Nx Cloud surface tasks that pass and fail without input changes so you can stabilize them.",["D",1785439383535],["D",1788220800000],"Connect your workspace to a Git provider so Nx Cloud can attach runs to commits and pull requests.",["D",1785439383483],["D",1788220800000],"ciExecutionEnv","","39785377070-3",["D",1792676862278],["D",1792676908236],"completedAt",["D",1792676908236],"agentCount","stopAgentsOnFailure","criticalErrorMessage","commandCount","stopAgentsAfter","agents",[],"closed","completedBy","HEARTBEAT","requireExplicitCompletion","linkedWorkflows",[],"activeAgents",[],"assignmentRules",[],"schedulingConstraintsInput","agentsMetadata",{},"agentInstances",{},"stopAgentsAfterConditions",{},"continuousAssignment","resourcePackingEnabled","packingDecisionReason","default","packingCpuMultiplier",1,"packingMemMultiplier","config",{"_254":255,"_213":-5},"waiting","sources",{"_256":257,"_258":259,"_260":261,"_262":263},"lifecycle",{"_298":299,"_300":301,"_302":303},"ai",{"_290":291,"_292":293},"dte",{"_270":271,"_272":273,"_235":274,"_275":276},"nxAgents",{"_264":265},"withEnvVars",[266],{"_267":268,"_181":269,"_213":-5},"kind","LEGACY",[],"enabledByDefault",[289],"distributeOn",[],[284],"schedulingConstraints",[277],{"_267":278,"_181":279,"_213":-5},"DEFAULT",{"_280":281,"_282":283},"_t","io.nrwl.models.SchedulingConstraintsInput.Inline","constraints",[],{"_267":278,"_181":285,"_213":-5},{"_280":286,"_287":288},"io.nrwl.models.AssignmentRulesInput.Inline","rules",[],{"_267":278,"_181":25,"_213":-5},"fixTasksPatterns",[296],"autoApplyPatterns",[294],{"_267":278,"_181":295,"_213":-5},[],{"_267":278,"_181":297,"_213":-5},[],"failAfter",[307],"heartbeat",[306],"stopAfter",[304],{"_267":268,"_181":305,"_213":-5},[],{"_267":268,"_181":25,"_213":-5},{"_267":268,"_181":249,"_213":-5},"workspaceId","6928ccd60a2e27ab22f38ad0","ciExecutionId","branch","1743",["D",1792676862278],["D",1792676908473],["D",1792676908236],"runGroups",[498],"vcsContext",{"_311":473,"_474":473,"_475":476,"_477":478,"_479":-5,"_480":-5,"_481":482,"_483":484,"_485":486,"_487":488,"_489":490,"_491":492,"_493":494,"_495":121,"_496":-5,"_497":-5},"cancellationRequested","affectedProjectRatio","touchedProjects",[],"affectedProjects",[361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,5],"criticalWorkflowErrors",[],"projectGraphSha","738b9ac1fc5d0a21f67358d84a80b961efac8f9873fba73bae2ad75e81f737a1","fileMapSha","cacheEnabled","hashScope","501272372","fixTasks","autoApplyFixes","selfHealing",{"_345":346,"_347":348,"_349":14},"selfHealingSkipInfo","pipelineHeadSha","pipelineParentShas","ioSnapshotCommitGraph","ioSnapshotCommitGraphClaimedAt","managedCi","cancellation","cliOverrides",{"_334":-5,"_335":-5},"workspaceConfigSnapshot",{"_86":14,"_350":25,"_351":14,"_352":25,"_353":25,"_354":-5,"_355":-5,"_356":-5,"_357":-5,"_358":-5,"_359":-5,"_360":-5},"isLongLivedBranch","commentNotificationEnabled","allowAnonymousExternalCommand","enableFlakyRerunsAutomatically","allowDraftPullRequests","protectedBranchPatterns","selfHealingCISetupCompletedAt","fixPatterns","neverFixPatterns","autoApplyIncludePatterns","autoApplyExcludePatterns","formatCommand","streaming-structured-table","subagents-persisted","@tanstack/ai-code-mode-models-eval","@tanstack/ai-sandbox-local-process","@tanstack/ai-computer-playwright","@tanstack/ai-isolate-quickjs-bun","@tanstack/ai-sandbox-upstash-box","@tanstack/ai-code-mode-snippets","@tanstack/ai-computer-sandbox-smoke","@tanstack/ai-isolate-cloudflare","@tanstack/ai-sandbox-cloudflare","generate-image","ts-react-native-chat","@tanstack/ai-computer-sandbox","ts-react-ui-chatbot","@tanstack/ai-isolate-daytona","@tanstack/ai-isolate-quickjs","@tanstack/ai-sandbox-daytona","@tanstack/ai-sandbox-railway","@tanstack/ai-sandbox-sprites","@tanstack/preact-ai-devtools","@tanstack/sandbox-cloudflare-example","@tanstack/svelte-ai-devtools","computer-use","@tanstack/ai-computer-local","@tanstack/ai-durable-stream","@tanstack/ai-react-native-smoke","@tanstack/ai-sandbox-blaxel","@tanstack/ai-sandbox-docker","@tanstack/ai-sandbox-vercel","@tanstack/ai-vercel-gateway","@tanstack/react-ai-devtools","@tanstack/solid-ai-devtools","basic-chat","mcp-events","mcp-server","ts-code-mode-web","@tanstack/ai-computer-use","@tanstack/ai-event-client","@tanstack/ai-isolate-node","@tanstack/ai-sandbox-boxd","subagents","ts-angular-chat","ts-react-rerank","ts-react-search","@tanstack/ai-claude-code","@tanstack/ai-harness-cli","@tanstack/ai-isolate-e2b","@tanstack/ai-persistence","@tanstack/ai-sandbox-e2b","evaluate","ts-react-media","ts-svelte-chat","@tanstack/ai-cloudflare","@tanstack/ai-compaction","@tanstack/ai-elevenlabs","@tanstack/ai-grok-build","@tanstack/ai-llmgateway","@tanstack/ai-openrouter","@tanstack/ai-perplexity","@tanstack/workspace-plugin","ts-group-chat","ts-react-chat","ts-remix-chat","ts-solid-chat","@tanstack/ai-anthropic","@tanstack/ai-code-mode","@tanstack/ai-worldlabs","vanilla-chat","@tanstack/ai-byteplus","@tanstack/ai-devtools-core","@tanstack/ai-opencode","@tanstack/ai-typesafe","@tanstack/openai-base","@tanstack/sandbox-web-example","harness-cli-example","ts-vue-chat","@tanstack/ai-angular","@tanstack/ai-bedrock","@tanstack/ai-harness","@tanstack/ai-lovable","@tanstack/ai-mistral","@tanstack/ai-reactor","@tanstack/ai-sandbox","@tanstack/ai-client","@tanstack/ai-cohere","@tanstack/ai-gemini","@tanstack/ai-memory","@tanstack/ai-octane","@tanstack/ai-ollama","@tanstack/ai-ollaya","@tanstack/ai-openai","@tanstack/ai-preact","@tanstack/ai-skills","@tanstack/ai-svelte","@tanstack/ai-vertex","@tanstack/ai-codex","@tanstack/ai-react","@tanstack/ai-remix","@tanstack/ai-solid","@tanstack/ai-utils","@tanstack/ai-grok","@tanstack/ai-groq","@tanstack/ai-acp","@tanstack/ai-fal","@tanstack/ai-mcp","@tanstack/ai-vue","ag-ui","stream-processor-panel","@tanstack/ai","@tanstack/ai-e2e","@tanstack/ai-codemods","feat/evaluate-refusal-error","ref","title","fix(ai-harness): do not run a no-user input as the session owner (#1876)\n\n* feat(ai-persistence): session stores for inputs, credentials, a log, leases, work claims, and a session index\n\n* test(ai-persistence): name each inbox id in the conformance case\n\n* fix(ai-persistence): read the sessions store through the persistence plan\n\n* feat(ai-harness): new package with the harness contracts and plugin API\n\n* feat(ai-harness): session engine and host, with the session split into modules\n\n* feat(ai-harness): durable sessions on the session log\n\n* test(ai-harness): unit tests and E2E for the core harness\n\n* docs(ai-harness): harness guides, README, and changeset\n\n* fix(ai-harness): restore split imports, type the session for hooks, and keep cut-call text consistent\n\n* test(ai-harness): keep only the core auth case, and use a type import in the session base\n\n* fix(ai-harness): keep the lockfile minimal, sort the e2e dependency, and leave sessionOfTurn to the transport\n\n* fix(ai-harness): import ./session/index so the published d.ts files resolve\n\n* feat(ai-skills): a harness plugin that makes each skill a slash command (#1756)\n\n* feat(ai-skills): skills plugin for a harness, with one command per skill\n\n* docs(ai-skills): say that the harness skills plugin does not run on Cloudflare Workers\n\n* feat(ai-harness, ai-persistence): read the transcript of a child agent run\n\nsession.agentTranscript(subagentRunId) gives the saved messages of a child\nof the thread, for a UI that shows subagents after a reload. It uses the new\nloadChildTranscript, which walks the parent chain so a nested child loads\nand a child of another thread does not.\n\n* test(ai-harness): a fork does not read the child transcripts of its source\n\n* fix(ai-persistence): loadChildTranscript keeps the card of a child with no messages\n\nA UI reads how a child ended from the card in metadata.tanstack.subagent.\nA child that failed before its first message has only its card-only head.\n\n* docs(ai-harness): describe the card in session.agentTranscript\n\n* docs(ai-harness): show what a child agent wrote after a reload\n\n* feat(ai-acp): serve a harness as an ACP v2 agent (#1758)\n\n* feat(ai-acp): serve a harness as an ACP v2 agent\n\n* fix(ai-acp): give each idle stop reason its own update type\n\n* feat(ai-acp): list the sessions of the harness with session/list\n\nACP v2 agents with sessions must answer session/list. The agent reads\nthe top-level sessions of the harness from the host's session index,\n50 per page. Each session reports the agent's cwd (new cwd option,\ndefault process.cwd()), because the harness keeps no cwd per thread.\n\n* fix(ai-acp): make approvals, cancel, and queued prompts work in the agent\n\n- Cancel during a permission request ends the turn as cancelled. The\n next prompt cancels the open interrupts first, because the thread\n takes no new input while they are open.\n- Interrupts the editor cannot answer (sign-in, input form, client tool)\n are cancelled, and the model continues.\n- A rejected resolve receipt ends the turn with an error.\n- The prompts of a session run one after another, so a later prompt\n cannot overtake a permission request or report out of order.\n- session/prompt echoes a user_message with the returned messageId.\n- Data that is not base64 fails with invalid params.\n- Unknown session ids fail with resource not found.\n- The agent keeps no session objects; host.open returns the live one.\n\n* feat(ai-harness, ai-persistence, ai-skills): onEvent and onMedia callbacks, object params, and review fixes (#1779)\n\n* feat(ai-harness, ai-persistence): onEvent, onMedia, and object params\n\n- session.onEvent(listener) and session.onEvent(type, listener) call\n listeners as the session publishes events. The typed form narrows the\n event. Each returns a stop function. operation.onEvent does the same for\n one operation.\n- operation.onMedia(listener) gets each media record an operation saves,\n and a chat turn result has every record in `media`.\n- Store methods and session/host methods with several plain-data\n arguments take one object: InboxStore.markApplied/markRejected,\n CredentialStore.get/set/delete, LogStore.append/subscribe,\n WorkClaimStore.release, SessionIndexStore.upsertIf,\n host.sessions.rename/update/fork, session.setConfig/answer/setDelivery/\n sendToAgent, ctx.session.setConfig, and credentials.set.\n\n* docs(harness, persistence): onEvent, onMedia, object params, and fixes\n\n- overview, usage, media: use onEvent and onMedia instead of a for-await\n loop. The usage sample no longer loops forever.\n- sessions: a \"React to events\" section on session.onEvent.\n- sessions, fork-and-reset, plugins, subagents, store-reference: the\n object-param call shapes.\n- Fix wrong statements: parentThreadId, the define*Store list, what\n withPersistence uses, host.close({ recoverable }), the transient status\n codes, the recover hook context, and Bedrock in the adapter list.\n\n* fix(ai-harness): redact credentials from errors a session publishes\n\ncredentialsFor records the secret values it hands out, and command and\nturn errors pass through scrubSecrets before they reach clients.\nscrubSecrets also matches the JSON-escaped and URL-encoded forms.\n\n* fix(ai-harness): harden media keys, MIME types, part kinds, and base64\n\n- Encode the client thread id in the upload blob key, so '../' cannot\n leave a filesystem blob store's folder.\n- Accept only a strict type/subtype[; name=value] MIME type, so a data\n URL cannot be broken by the stored type.\n- Send the stored media kind, not the client part type.\n- Base64 with Buffer when present, else per-chunk btoa, so a big file\n does not build one binary string.\n\n* fix(ai-skills): re-arm dead skill folder watchers, and watch without recursive\n\nA watcher whose folder went away (a 'rename' of the folder itself, or a\nfolder that no longer exists at a sync) is dropped, so the parent is\nwatched and a re-created folder is seen. Where recursive watch is not\navailable (Linux before Node 19.1), the folder is watched without it\ninstead of being treated as missing.\n\n* fix(ai-harness): scrub credentials from SUBAGENT_ERROR chunks of a chat turn\n\n* fix(ai-harness): accept MediaRecorder MIME types, refuse line breaks\n\nkindOf accepts commas and quoted parameter values (video/webm;codecs=vp8,opus)\nand refuses CR/LF. dataUrl keeps only parameters with plain values, so a\ncomma or quote cannot break the data URL.\n\n* fix(ai-persistence): a log conformance case for concurrent appends, and a working durable memory setup in the JSDoc\n\nThe memoryLogStore example spread memoryPersistence().stores, which now\nhas messages and inbox, so a durable harness host rejected it. The log\nsuite now checks that of two appends at one position, exactly one wins\nand the other rejects with LogConflictError.\n\n* fix(ai-harness): keep usage buckets as own properties\n\nA principal id like __proto__ wrote its counts onto Object.prototype.\n\n* fix(ai-harness): resumePending reads past expired claims of other harnesses\n\nlistExpired has no cursor, so more than limit expired claims of other\nharnesses starved the host. It now reads with a doubling limit until it\nhas limit claims of its own or the store has no more.\n\n* fix(ai-harness): catch failed lease renewals, and put repaired tool results next to their calls\n\nA failed runs.update in the renewal timer was an unhandled rejection.\nrepairTranscript appended recovered results after later host messages;\nthey now go right after the tool-call message.\n\n* fix(ai-harness): make the session log durable across crashes, closes, and odd stores\n\n- A durable tool's appended records land in the same append as its\n harness.tool.result, so a crash after the result no longer loses them,\n and an unrelated commit no longer flushes them early.\n- A failed read in the store subscriber fails the log instead of an\n unhandled rejection.\n- A checkpoint is copied on load, so in-place usage folding no longer\n changes the stored checkpoint and counts twice.\n- A log goes idle only after the last append landed, and session.close()\n waits for it, so a quick reopen reads it.\n- A project or reduce fold that throws skips the record with a warning,\n live and on reload, instead of a half-applied fold and a stale seq.\n- Folds read until an empty page, and the landed check ignores key order.\n- Tool results, starts, and steps are dropped once the call's result is\n in the transcript, or its agent run settled.\n\n* fix(ai-harness): settle operations when a store write throws\n\nA store write that threw after an agent run, in a command, or in the early\nsteps of a turn left the operation unsettled and the rejection unhandled.\nThe operation now fails with a RUN_ERROR. An early turn failure also\nsettles its input, so settled() returns. Writes no one waits for (inbox\nmarks, wake follow-ups, group cancels, the close on a log failure) now\ncatch their errors and report a warning.\n\n* fix(ai-harness): admit inputs correctly on store failures, close, and replays\n\n- A failed input write no longer keeps its id, so a retry runs.\n- Work inputs that come while the session closes are rejected with\n 'closed', and a turn queued late in a close ends cancelled.\n- A duplicate replayed from the log gets the text of its own turn, and\n the real interrupts when its turn still waits.\n- A prompt that joined the running turn stays findable, ends cancelled\n or interrupted with that turn, and a cancel of it is refused.\n\n* fix(ai-harness): clean up on cancel, failed open, and reload during close\n\n- A cancelled turn rejects its pending ctx.session.ask() questions.\n- A session that fails to open closes as on a crash: it disposes its\n plugins, stops the claim timer, and stops the turns recovery started.\n- A reload that waited for the running turn mounts nothing when the\n session started to close, and close() waits for a reload in progress.\n\n* fix(ai-harness): end harnessText streams with the real outcome\n\n- A signal that aborted before the call cancels the inner turn, and the\n abort listener is removed when the call ends.\n- The outer stream awaits the inner turn, so a cancelled or failed turn\n ends with RUN_ERROR, not RUN_FINISHED.\n- The remote adapter passes the signal to fetch, cancels the body reader\n on an early end, reads CRLF events, and fails a stream that closes\n before RUN_FINISHED.\n\n* fix(ai-harness): harden plugin state, events, and turn plugin mounts\n\n- A plugin with lifetime 'turn' that adds a command or a config option\n fails at mount with a clear error. The session reads both only from its\n session plugins, so they never worked.\n- An async plugin event listener that rejects gets a warning, not an\n unhandled rejection.\n- Plugin state and inspect() key by name with no prototype, so a plugin\n named 'constructor' or '__proto__' is a plain key.\n- Without a store setIf, plugin state updates of a session run one at a\n time, so concurrent updates are not lost.\n\n* fix(ai-harness): bound settled-operation bookkeeping and keep retrying claims\n\n- A session keeps its last 500 settled operations, with their receipts,\n settlements, and agent chains. Older ones go, so a long-lived session\n does not grow. A duplicate of an older input falls back to the log or\n the inbox.\n- A claim that another host holds no longer stops the claim timer. The\n timer tries again while the thread has work, so a running turn gets a\n claim once the other one expires.\n\n* fix(ai-harness): keep a turn's text past mid-turn inputs, and cancelled runs cancelled\n\n- A replayed duplicate reads its turn's text up to the next turn or reset,\n not up to an answer, command, or agent run applied during the turn.\n- An operation that a store write fails after a cancel ends cancelled,\n with no second terminal event, and an agent run frees its input lease\n also when its end record fails.\n\n* fix(ai-harness): fail, not cancel, an operation that a log failure stopped\n\n* fix(ai-harness): redact credentials from background agent errors\n\nThe session keeps one set of the secrets its credentials accesses and\nprovider keys hand out, so an agent run that reads its own keys gets its\nRUN_ERROR, SUBAGENT_ERROR, and failure text scrubbed too.\n\n* docs(harness): a turn plugin cannot add commands or config\n\n* fix(ai-harness): catch async onEvent listeners, and drop operation listeners when it finishes\n\nA listener's rejected promise is reported, not left unhandled. An\noperation's onEvent and onMedia listeners stop after its finished event,\nand a listener stopped by an earlier one gets nothing more.\n\n* fix(ai-harness): follow-ups to the session fixes\n\n- answer() keeps the question when its write fails.\n- A command's questions belong to the command, so cancelling it rejects\n them.\n- A closing session starts no agent follow-up run.\n- Plugin warnings, early turn failures, failed operations, reload errors,\n and job failure notes are scrubbed of credentials.\n- hostRecords reads until an empty page.\n- Agent runs stay listed past the settled window, a forgotten run id\n stays taken, and turnJoins entries are dropped.\n\n* fix(ai-harness): cancel queued agent follow-ups on close, and drop operation listeners on every settle\n\n- A closing session cancels an agent chain's queued follow-ups, so\n close() and their callers no longer wait for runs that never start.\n- An operation removes its onEvent and onMedia listeners a tick after it\n settles, on every settle path. An async onMedia listener's rejection is\n caught.\n- A failed reset's message is scrubbed of credentials.\n\n* fix(ai-harness): cancel queued follow-ups after a log failure, and publish an agent run's finished event before its lease write\n\n- A log failure closes the session, and the queued follow-ups of an agent\n chain now end cancelled then too, so close() does not hang.\n- An agent run publishes its finished event as it settles, before the\n awaited lease release, so its operation listeners still get it.\n- The operation listener cleanup timer does not keep a process alive.\n\n* feat(ai-harness): serve sessions over HTTP and WebSocket, with a typed client and OAuth connectors (#1757)\n\n* feat(ai-harness): serve sessions over HTTP and WebSocket, with a typed client and OAuth connectors\n\n* fix(ai-harness): add back sessionOfTurn for the run route, and the OAuth cases of auth.test.ts\n\n* fix(ai-harness): import ./session/index, so the built types resolve HarnessSession\n\n* test(ai-harness): startLoopbackReceiver cases from #1555\n\n* feat(ai-harness, ai-mcp): MCP servers in a harness, and a harness as an MCP server (#1763)\n\n* feat(ai-harness, ai-mcp): MCP servers in a harness, and a harness as an MCP server\n\nAdds @tanstack/ai-mcp/harness (createHarnessMcpServer and the mcp() plugin)\nand @tanstack/ai-mcp/connector (mcpConnector with OAuth sign-in and RFC 9207\niss). mcp() and mcpConnector ask spec 2025 elicitation/create requests and\nspec 2026 input rounds as session questions. Split out of #1555.\n\n* docs(ai-harness, ai-mcp): import definePlugin in the discoverTools sample\n\n* feat(ai-harness): GET agent-transcript and client.agentTranscript\n\nA client can read the saved messages of a child agent run, as a local\nsession does with session.agentTranscript. The route opens the session for\nthe principal, so a child of another thread or user stays hidden.\n\n* docs(ai-harness): list GET agent-transcript in the handler routes\n\n* docs(ai-harness): describe the card in client.agentTranscript\n\n* docs(ai-harness): read a child's messages from the browser\n\n* feat(ai-harness): createSessionView, one live store for a session in any UI (#1761)\n\n* feat(ai-harness): createSessionView, one live store for a session in any UI\n\n* fix(ai-harness): import ../session/index in the view\n\n* feat(ai-harness): close the gaps between createSessionView and the harness\n\n- Actions: followUp, continue, upload, configure, cancel(operationId),\n cancelInput, setDelivery, reset, revert, unrevert, and ViewAgent.cancel.\n- Interrupts: generic interrupts get their own list with resolve and cancel.\n Approvals can send edited arguments or a payload, and find their tool in a\n child agent.\n- Subagents: AgentPart.result, and after a reload each child shows its saved\n messages and how it ended.\n- A view that opens while a turn runs shows the turn from its start without\n what the transcript has. The snapshot is read before the transcript.\n- A retry drops the failed attempt, turnEnd skips a turn that stops for an\n interrupt, usage, models, and settings are in the state, and media that no\n message shows stops getting new URLs.\n\n* docs(ai-harness): every view action, other interrupts, and subagents after a reload\n\n* fix(ai-harness, ai-mcp): adopt object params from #1779\n\nThe client, the session view, and its source take one object for\nsetConfig, answer, setDelivery, sendToAgent, renameSession,\nupdateSession, and forkSession, as the session does. A view agent's\nsend takes { mode }, as AgentRun.send does. The protocol, the HTTP\nhandler, the connectors, and the MCP connector call the new store and\nsession shapes.\n\n* docs(ai-harness): object params in the transport, view, MCP, and auth pages\n\n* test(ai-harness): rename, update, and fork a session through the client\n\n* fix(ai-harness): join and resume a run on any instance, and no insecure transport defaults (#1781)\n\n* fix(ai-harness): no insecure or single-process transport defaults\n\n- `canAccess` is now required on `createHarnessHandler` and\n `handleHarnessSocket`. Forgetting it used to let every principal into\n every thread. Allow-all is now an explicit `canAccess: () => true`.\n- A durable host (`stores.log`) runs behind several instances, so a random\n per-handler `mediaSecret` makes signed media URLs fail on every other\n instance. The handler now throws at creation on a durable host without\n `mediaSecret`. A host without a log store keeps the random default.\n- `oauthConnector` no longer defaults to `login: 'loopback'`, which opened a\n node:http listener on 127.0.0.1 inside the server process, where the\n user's browser can never reach it. `login` is now required. A default of\n `'device'` was rejected: it needs `oauth.deviceUrl`, which many apps do\n not have, so a silent default would just move the failure to run time.\n Requiring the choice is the smallest change that is correct for both a\n CLI (`'loopback'`) and a server (`'device'`).\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* fix(ai-harness): join and resume a run on any instance of a durable host\n\nOn serverless hosting, several instances serve one URL with no sticky\nrouting, and a connection can be cut at any time.\n\n- `POST run` streamed with no `id:` lines, so a cut stream could not\n resume. On a durable host each event now carries its log cursor as `id`\n (the same cursors as `GET events`). The ai-client SSE adapters already\n re-send the request with `Last-Event-ID`: the run id is the input id, so\n the retry finds the same turn (live, or replayed from the log on another\n instance) and streams after that cursor, without running it again. The\n `resume` branch of `POST run` does the same.\n- `GET run?runId=` only found turns in this process. When the turn is not\n local, a durable host now looks up its thread in `stores.runs` (the run\n id is the operation id, and every chat turn has a run record), opens the\n thread, and streams that operation's `harness.event` records from the\n shared log, from the start or `Last-Event-ID`, live until\n `harness.operation.finished`. Agent runs and child runs stay 404.\n- `GET run?threadId=` also reports a turn another instance runs as\n `activeRun` (from `runs.findActiveRun`), so a reloaded ChatClient on\n another instance knows to join it.\n\nWithout a log store nothing changes: no ids on `POST run`, since a\nprocess-local cursor means nothing on another instance.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* docs(ai-harness): mark the session view experimental, and say what a cursor is\n\n`createSessionView`, `SessionViewState`, and `SessionViewEvents` become\npublic API on publish. Tag them `@experimental` so their shape can still\nchange in a minor release.\n\nThe HTTP transport page now says that event cursors are opaque strings:\nlog positions on a durable host, process-local counters without a log\nstore. So a deployment with more than one instance needs `stores.log`.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n---------\n\nCo-authored-by: Claude Opus 5.5 (1M context) \n\n---------\n\nCo-authored-by: Jack Herrington \nCo-authored-by: Claude Opus 5.5 (1M context) \n\n* feat(ai-harness): session.onQuestion, onAuthRequired, onMedia, and onUsage\n\nEach hook calls a listener for one harness event, with a typed value.\nAn app no longer filters CUSTOM events by name to answer a question,\nshow a sign-in, show a media file, or show a live token count.\n\nThe mcp, auth, usage, media, and plugins docs use the hooks.\n\n* feat(ai-harness): first-party plugins in @tanstack/ai-harness/plugins: permissions, agent profiles, questions, todos, titles, and usage (#1759)\n\n* feat(ai-harness): first-party plugins in @tanstack/ai-harness/plugins\n\nAdd permissions, agents, question, todos, title, modelPicker,\nprojectInstructions, fileCommands, compact, usage, and boundToolOutput\nunder the ./plugins entry. Export the portable permission names from\nthe package root again, so edge-safe plugins can read the rules.\n\n* docs(ai-harness): say that a tool with no rule runs in plan mode\n\n* fix(ai-harness): adopt object params from #1779\n\nThe first-party plugins and their tests now call setConfig and answer\nwith one object. Prompt results in the tests also have media: [].\n\n* docs(ai-harness): answer permission questions with onEvent\n\nThe permissions page listens for the question with session.onEvent\ninstead of a loop over session.events(). The permissions and agents\npages call setConfig and answer with one object.\n\n* ci: apply automated fixes\n\n* docs(ai-harness): answer each open permission question once\n\nTool calls can run in parallel, so two questions can be open at the\nsame time. The sample now answers each open question once, by id,\ninstead of the first one in the list.\n\n* docs(ai-harness): answer permission questions with session.onQuestion\n\n* fix(ai-harness): safe /compact, cut marker in approvals, and whole-folder globs\n\n- /compact fails and keeps the conversation when the summary is empty.\n- The approval question says when it cut the call arguments.\n- A **/ glob matches whole folders only, and {a,b} matches one of the parts.\n\n---------\n\nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\n\n* fix(ai-harness, ai-persistence): pass inputs to the instance that owns a thread, and other pre-release fixes (#1780)\n\n* fix(ai-harness): definePlugin refuses a setup() contribution at the top level\n\n`const TDefinition` turns off the excess property check, so\n`definePlugin({ name, adapter })` type-checked and the adapter was never\nused. A key of the setup() return (adapter, tools, prompts, middleware, ...)\nat the top level is now a type error and throws. Other extra keys stay the\nplugin's own API, such as the diff() of snapshots().\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* fix(ai-harness): refuse to write a log that has a record type from a newer harness\n\nDuring a rolling deploy an old host could fold a log with records it skips,\nthen write on top of that wrong state. It now reads the log but fails the\nwrite with LogVersionError. Checkpoints list the record types their writer\nknew, so an old host never starts from a newer fold.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* fix(ai-persistence): store shapes that third-party backends can implement\n\n- InboxStore.get/markApplied/markRejected take threadId, so a store does\n not need a global index of input ids.\n- WorkClaimStore.get(threadId) tells a host who owns a thread.\n- The session revision contract allows content-hash ETags (S3, Netlify\n Blobs), which give the same revision back for the same content.\n\nNone of these interfaces is released yet.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* fix(ai-harness): pass an input to the host that owns the thread, not over its turn\n\nOn a durable host, an input on a second host appended to the log and made\nthe running owner fail with LogConflictError, which aborted its turn. Two\nactors per cold start make this routine on serverless platforms.\n\nWith stores.workClaims, accept() now checks who owns the thread:\n- With stores.inbox (now allowed in durable mode), the input waits in the\n inbox and the receipt is 'queued'. The owner drains the inbox every second\n while it holds the claim, once more when it goes idle, and when a session\n opens (the crash sweep).\n- Without an inbox, the input is refused with 'owned_elsewhere'.\n\nA question from ctx.session.ask claims the thread and keeps it busy, so its\nanswer is forwarded to the host that holds the question.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* fix(ai-harness): a host that opens a thread leaves a live owner's inputs alone\n\nBetween storing an input and writing its run lease, the owner's input\nlooked crashed to another host. Any request that opened the thread there\n(events, hydrate, a join) recovered and ran it, and the owner then failed\nwith a log conflict. Recovery now skips a thread whose work claim another\nlive host holds.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* test(e2e): an input on a second host waits for the owner of the thread\n\nTwo hosts over one set of durable stores. A follow-up on the second host\nis queued and runs on the owner after its turn; without an inbox it is\nrefused. In both, the owner's turn ends normally.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* fix(ai-harness): a forwarded turn runs under the run id of the host that took it\n\nA POST run on a host that does not own the thread forwards the prompt.\nThe owner now runs it as the request's AG-UI run id, so the operation on\nthe forwarding host streams the owner's events from the shared log, and\nuseChat sees the turn on whichever instance it reached.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* docs(ai-persistence): the inbox and work claim store shapes, and content-hash revisions\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* docs(ai-harness): inputs on another instance, rolling deploys, and setup() keys\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* fix(ai-harness): a host that passed an input on runs it if the owner stops\n\nThe forwarding host reads the inbox every second until its inputs ran.\nWhen the owner stops, its claim expires, and the forwarding host claims\nthe thread and runs them, so an input never waits for a sweep. The\nclaim test from #1779 now covers both setups: refused without an inbox,\nand run once the other claim expires with one.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* fix(ai-harness): run a forwarded input safely when the owner stops\n\n- A host that passed a POST run on runs it itself, on the operation its\n caller holds, when the owner stops. Before, its own run id refused it\n as a conflict.\n- An inbox entry is applied only after the owner stored the turn. Before,\n a failed log write lost a forwarded prompt.\n- A host that takes a thread from the inbox recovers the stopped owner's\n inputs first, as an open does. Before, they were never run.\n\n* fix(ai-harness): a forwarded resume runs as its run id, and two lint errors\n\n- A POST run with a resume that reaches a host that does not own the\n thread got HTTP 409: the queued receipt had no operationId, and the\n owner ran the resume under a new id. The inbox entry now keeps the run\n id, the owner runs the resume as it, and the receipt names it.\n- watchInbox passed an async function to setInterval, and applyForwarded\n had a default case where the switch can be exhaustive. Both failed\n test:oxlint in CI.\n\n* fix(ai-harness, ai-persistence): keep a forwarded secret answer out of the inbox\n\nA host that does not have a question cannot tell if it is a secret, so\nit stored the answer in stores.inbox as typed, and the entry stayed\nthere. InboxStore.delete removes an entry. The owner deletes a forwarded\nanswer after it applies it, and logs a secret answer as [secret].\n\n* fix(ai-harness): a forwarded input runs once, keeps its wake mark, and ids stay bounded\n\n- The owner passes the inbox input id to cancel, command, answer, and\n setConfig (an @internal inputId option). An entry that the owner\n applies again, after a crash or a failed markApplied, is a duplicate.\n Before, a forwarded command ran again on each read of the inbox.\n- A forwarded follow-up that wakes the session keeps its wake mark.\n- The forwarded id set keeps the newest 500 ids, like settled operations.\n- Docs: a forwarded prompt runs without overrides and ephemeral messages.\n\n* fix(ai-harness): refuse a revert on a host that does not own the thread\n\nrevert and unrevert write a harness.revert record and never went through\naccept, so a host that did not own the thread wrote to the log during\nthe owner's turn, and the owner's turn failed with a log conflict. They\nnow refuse with busy while another host holds the claim. The revert and\nunrevert cases of applyForwarded never ran, so they go with agent and\nbackground.\n\n---------\n\nCo-authored-by: Claude Opus 5.5 (1M context) \nCo-authored-by: Alem Tuzlak \n\n* feat(ai-code-mode): codeMode() harness plugin in @tanstack/ai-code-mode/harness (#1769)\n\n* feat(ai-harness): first-party plugins in @tanstack/ai-harness/plugins\n\nAdd permissions, agents, question, todos, title, modelPicker,\nprojectInstructions, fileCommands, compact, usage, and boundToolOutput\nunder the ./plugins entry. Export the portable permission names from\nthe package root again, so edge-safe plugins can read the rules.\n\n* docs(ai-harness): say that a tool with no rule runs in plan mode\n\n* feat(ai-code-mode): codeMode() harness plugin in @tanstack/ai-code-mode/harness\n\n* fix(ai-harness): adopt object params from #1779\n\nThe first-party plugins and their tests now call setConfig and answer\nwith one object. Prompt results in the tests also have media: [].\n\n* docs(ai-harness): answer permission questions with onEvent\n\nThe permissions page listens for the question with session.onEvent\ninstead of a loop over session.events(). The permissions and agents\npages call setConfig and answer with one object.\n\n* ci: apply automated fixes\n\n* docs(ai-harness): answer each open permission question once\n\nTool calls can run in parallel, so two questions can be open at the\nsame time. The sample now answers each open question once, by id,\ninstead of the first one in the list.\n\n* fix(ai-code-mode): tell the model what execute_typescript returns (#1785)\n\nfix(ai-code-mode): describe execute_typescript result shape to the model\n\nThe tool description and system prompt now say the tool returns\n{ success, result, logs, error }, where result is the program's return\nvalue, so models stop guessing at the wrapper.\n\nCo-authored-by: Claude Opus 5.5 (1M context) \n\n* test(ai-code-mode): cover the code mode allow rules and the prompt reset\n\nAdd tests: a program runs with no question when permissions() asks by\ndefault, in default and plan mode. A user rule that asks for\nexecute_typescript still wins. A failed pick drops the prompt of the\nlast turn.\n\nThe docs list all six isolate drivers and say what happens when two\ntools get the same safe name.\n\n---------\n\nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\nCo-authored-by: Jack Herrington \nCo-authored-by: Claude Opus 5.5 (1M context) \n\n* feat(ai-harness): goal() plugin that keeps working until a judge says the goal is met (#1762)\n\n* feat(ai-harness): first-party plugins in @tanstack/ai-harness/plugins\n\nAdd permissions, agents, question, todos, title, modelPicker,\nprojectInstructions, fileCommands, compact, usage, and boundToolOutput\nunder the ./plugins entry. Export the portable permission names from\nthe package root again, so edge-safe plugins can read the rules.\n\n* docs(ai-harness): say that a tool with no rule runs in plan mode\n\n* feat(ai-harness): goal() plugin keeps a session working until a judge says the goal is met\n\n* fix(ai-harness): adopt object params from #1779\n\nThe first-party plugins and their tests now call setConfig and answer\nwith one object. Prompt results in the tests also have media: [].\n\n* docs(ai-harness): answer permission questions with onEvent\n\nThe permissions page listens for the question with session.onEvent\ninstead of a loop over session.events(). The permissions and agents\npages call setConfig and answer with one object.\n\n* ci: apply automated fixes\n\n* docs(ai-harness): answer each open permission question once\n\nTool calls can run in parallel, so two questions can be open at the\nsame time. The sample now answers each open question once, by id,\ninstead of the first one in the list.\n\n---------\n\nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\n\n* feat(ai-harness): build a harness into a worker artifact, and run it as a worker (#1760)\n\n* feat(ai-harness): serve sessions over HTTP and WebSocket, with a typed client and OAuth connectors\n\n* feat(ai-harness): build a harness into a worker artifact, and run it as a worker\n\n* fix(ai-harness): add back sessionOfTurn for the run route, and the OAuth cases of auth.test.ts\n\n* fix(ai-harness): import ./session/index, so the built types resolve HarnessSession\n\n* test(ai-harness): the stub worker ignores cancel and reads content parts\n\n* test(ai-harness): allow Node modules in the build and worker entries\n\n* test(ai-harness): startLoopbackReceiver cases from #1555\n\n* feat(ai-harness, ai-mcp): MCP servers in a harness, and a harness as an MCP server (#1763)\n\n* feat(ai-harness, ai-mcp): MCP servers in a harness, and a harness as an MCP server\n\nAdds @tanstack/ai-mcp/harness (createHarnessMcpServer and the mcp() plugin)\nand @tanstack/ai-mcp/connector (mcpConnector with OAuth sign-in and RFC 9207\niss). mcp() and mcpConnector ask spec 2025 elicitation/create requests and\nspec 2026 input rounds as session questions. Split out of #1555.\n\n* docs(ai-harness, ai-mcp): import definePlugin in the discoverTools sample\n\n* feat(ai-harness): GET agent-transcript and client.agentTranscript\n\nA client can read the saved messages of a child agent run, as a local\nsession does with session.agentTranscript. The route opens the session for\nthe principal, so a child of another thread or user stays hidden.\n\n* docs(ai-harness): list GET agent-transcript in the handler routes\n\n* docs(ai-harness): describe the card in client.agentTranscript\n\n* docs(ai-harness): read a child's messages from the browser\n\n* feat(ai-harness): createSessionView, one live store for a session in any UI (#1761)\n\n* feat(ai-harness): createSessionView, one live store for a session in any UI\n\n* fix(ai-harness): import ../session/index in the view\n\n* feat(ai-harness): close the gaps between createSessionView and the harness\n\n- Actions: followUp, continue, upload, configure, cancel(operationId),\n cancelInput, setDelivery, reset, revert, unrevert, and ViewAgent.cancel.\n- Interrupts: generic interrupts get their own list with resolve and cancel.\n Approvals can send edited arguments or a payload, and find their tool in a\n child agent.\n- Subagents: AgentPart.result, and after a reload each child shows its saved\n messages and how it ended.\n- A view that opens while a turn runs shows the turn from its start without\n what the transcript has. The snapshot is read before the transcript.\n- A retry drops the failed attempt, turnEnd skips a turn that stops for an\n interrupt, usage, models, and settings are in the state, and media that no\n message shows stops getting new URLs.\n\n* docs(ai-harness): every view action, other interrupts, and subagents after a reload\n\n* fix(ai-harness, ai-mcp): adopt object params from #1779\n\nThe client, the session view, and its source take one object for\nsetConfig, answer, setDelivery, sendToAgent, renameSession,\nupdateSession, and forkSession, as the session does. A view agent's\nsend takes { mode }, as AgentRun.send does. The protocol, the HTTP\nhandler, the connectors, and the MCP connector call the new store and\nsession shapes.\n\n* docs(ai-harness): object params in the transport, view, MCP, and auth pages\n\n* test(ai-harness): rename, update, and fork a session through the client\n\n* test(ai-harness): a remote harness response with no body fails the run\n\nSince #1779, the remote harnessText fails a stream that closes before\nRUN_FINISHED. A response with no body is such a stream.\n\n* test(ai-harness): pass canAccess in the remote harness tests (#1783)\n\ntest(ai-harness): pass canAccess to the handler in the remote harness tests\n\nThe handler requires canAccess (fix/harness-transport-release).\n\nCo-authored-by: Claude Opus 5.5 (1M context) \n\n---------\n\nCo-authored-by: Jack Herrington \nCo-authored-by: Claude Opus 5.5 (1M context) \n\n* feat(ai-harness): providerKeys() plugin lets each user connect their own model provider key (#1765)\n\n* feat(ai-harness): first-party plugins in @tanstack/ai-harness/plugins\n\nAdd permissions, agents, question, todos, title, modelPicker,\nprojectInstructions, fileCommands, compact, usage, and boundToolOutput\nunder the ./plugins entry. Export the portable permission names from\nthe package root again, so edge-safe plugins can read the rules.\n\n* docs(ai-harness): say that a tool with no rule runs in plan mode\n\n* feat(ai-harness): providerKeys() plugin lets each user connect their own model provider key\n\n* test(ai-e2e): read the key from the adapter factory, aimock redacts the header\n\n* fix(ai-persistence): store a tool result once when a run resumes from a client tool (#1744)\n\n* fix(ai-persistence): store a tool result once when a run resumes from a client tool\n\n* test(e2e): client tool resume stores each tool result once\n\n* fix(ai-persistence): keep a later tool result that reuses a stored toolCallId\n\nCount stored tool results per toolCallId and let each posted copy use up\none, instead of dropping every posted result whose toolCallId the prefix\nholds. Check before the id check, so a result posted under its stored id\nalso uses up its count.\n\nCo-Authored-By: Claude Opus 5.5 \nClaude-Session: https://claude.ai/code/session_01AGyaNPEJb8zBzY2wY5xWdZ\n\n* Revert \"fix(ai-persistence): keep a later tool result that reuses a stored toolCallId\"\n\nProvider tool call ids are unique within a thread, so the reuse case\ndoes not occur. Back to the plain toolCallId match.\n\nCo-Authored-By: Claude Opus 5.5 \nClaude-Session: https://claude.ai/code/session_01AGyaNPEJb8zBzY2wY5xWdZ\n\n* fix(ai-persistence): replace a tool result matched by toolCallId in place\n\nSkip the toolCallId match when the incoming tool result has no\ntoolCallId, so two id-less results are not treated as one. Replace the\nmatched stored row with the incoming copy instead of dropping it, the\nsame as a match by id. Move the merge-rules comment onto\nmergeStoredMessages and add direct merge tests.\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: Tom Beckenham <34339192+tombeckenham@users.noreply.github.com>\n\n* fix(openai-base): report Responses cache write tokens in usage (#1774)\n\n* fix(openai-base): map Responses input_tokens_details.cache_write_tokens to cacheWriteTokens\n\nCloses #1734\n\n* fix(openai-base): keep the cache-write fix to one block; add Responses usage e2e\n\n* fix(ai-opencode, ai-sandbox): end the run when a teardown step does not settle (#1773)\n\nBound each OpenCode teardown step to one second and log failures, and\nclose open connections when the host tool bridge closes.\n\nCloses #1638\n\n* feat(ai): check tool input after approval edits and middleware, just before it runs (#1750)\n\n* feat(ai): check tool input at the last moment, after approval edits and middleware\n\n* test(ai): fix the boundary client tool tests\n\n* test(ai): the subagent tool input is checked after middleware\n\n* test(ai): subagent schema errors also show the received arguments\n\n* fix(ai): keep returned client results and run tool hooks once at boundaries\n\n- A client result that comes back is kept as is. Checking the raw model\n input again dropped the real result when middleware had repaired it.\n- An afterTools boundary reuses the tool phase result, so\n onBeforeToolCall and the tool results do not run twice.\n- The boundary drains executeToolCalls through drainToolCallGenerator and\n passes the resume state; the hooks and resume state come from shared\n helpers.\n- The validation error shows the model's own arguments in the tool\n result only, so middleware-injected values do not reach the model or\n tracing.\n- Changeset, middleware docs, and args JSDoc corrected.\n\n* feat(ai): check JSON Schema and MCP tool input with @cfworker/json-schema (#1751)\n\n* feat(ai): validate JSON Schema tool input with @cfworker/json-schema\n\n* chore: keep one @google/genai copy for ai-vertex and ai-gemini\n\n* test(ai): the JSON Schema of a subagent tool checks background\n\n* fix(ai): keep the page URL out of a JSON Schema tool error\n\nA failed $ref included the validator base URI. In a browser that URI is the page, query included.\n\n* fix(ai): JSON Schema tool check accepts OpenAPI 3.0 and keeps data intact\n\n- Strip `format` only from schema positions, so a `format` key inside\n `const` or `enum` data still matches.\n- Convert boolean `exclusiveMinimum`/`exclusiveMaximum` per schema, so\n they work under any `$schema` and numeric bounds elsewhere still apply.\n- Support OpenAPI 3.0 `nullable: true`: null joins `type`/`enum`, and a\n nullable `$ref`/`allOf`/`anyOf`/`oneOf`/`not` schema is wrapped as\n `if: null, else: schema`. Local `$ref`s into a wrapped schema move with it.\n- Check an input with no JSON form as null, list at most 10 errors, and\n drop more wrapper errors (`if`, `$recursiveRef`, `additionalItems`,\n `unevaluatedItems`).\n- Read the first error line with `split('\\n', 1)`, which type-checks\n under `noUncheckedIndexedAccess`.\n\n* feat(ai): repair common model mistakes in tool input, with chat({ repairToolInput }) (#1752)\n\n* feat(ai): repair common model mistakes in tool input before the final check\n\n* fix(ai): type the repair order list\n\n* test(ai): use an input the repair cannot fix in the subagent schema test\n\n* feat(ai): chat({ repairToolInput }) to turn off or replace the input repair\n\nfalse turns the built-in tool input repair off. A function replaces it:\nit gets { tool, toolCall, input, error } for an input that failed the\ncheck, and returns the input to check again, or undefined to send the\nvalidation error to the model.\n\n* feat(ai, adapters): keep the raw tool argument string for replay (#1753)\n\n* feat(ai, adapters): keep the raw tool argument string for replay\n\n* refactor(ai): one tool-argument reconcile helper, args sent once\n\nfinishToolCallArguments replaces the three reconcile copies in\nToolCallManager, TextEngine and StreamProcessor. TOOL_CALL_END now sends\nits arguments once, as metadata.tanstack.args reconciled to the input;\nin-process input is parsed back from it. Drops jsonInput and\nisToolInputJsonLossless. A null input no longer replaces the raw args.\n\n* fix(ai-bedrock, ai-gemini): replay malformed tool arguments as {}\n\nMalformed arguments now stay in the history next to their tool error.\nThe Bedrock and Gemini Interactions history converters send them as {}\ninstead of failing the request.\n\n* fix(ai-gemini): send the args snapshot only when no deltas stream\n\nThe initial step.arguments snapshot went out as a TOOL_CALL_ARGS delta\nbefore the streamed deltas, so the deltas did not add up to the final\narguments on the client.\n\n* refactor(adapters): always send args on TOOL_CALL_END\n\nDrop the redundant rawArgs guards and hasArguments flags. Core treats\nempty args the same as missing args.\n\n* test(ai): keep the JSON Schema check tests off the repair path\n\nThe OpenAPI 3.0 and $ref tests from feat/json-schema-tool-input send\ninputs the repair now fixes (a null optional field, \"3\" for an integer).\nThey check the schema alone, with repairToolInput: false. Adds a test that\nthe repair walks a nullable schema, and restores the subagent 'yes' input.\n\n---------\n\nCo-authored-by: Tom Beckenham <34339192+tombeckenham@users.noreply.github.com>\n\n* fix(ai): give held calls a result and keep child interrupts at boundaries\n\n- When the only call that waits for approval fails its input check, the\n calls that the batch gating held back now run, so each call has a result.\n- An approved client tool is sent to the client while another call waits\n for approval, as a plain client tool already was.\n- The validation error tells the model when an approval edit or middleware\n changed its arguments, so it does not retry the same valid call.\n- An afterTools boundary interrupt keeps the subagent interrupts of the\n tool phase.\n- Changeset and server tools docs: a bad approval edit is rejected when the\n run resumes.\n\n---------\n\nCo-authored-by: Tom Beckenham <34339192+tombeckenham@users.noreply.github.com>\n\n* fix(ai-harness): adopt object params from #1779\n\nThe first-party plugins and their tests now call setConfig and answer\nwith one object. Prompt results in the tests also have media: [].\n\n* docs(ai-harness): answer permission questions with onEvent\n\nThe permissions page listens for the question with session.onEvent\ninstead of a loop over session.events(). The permissions and agents\npages call setConfig and answer with one object.\n\n* ci: apply automated fixes\n\n* fix(ai-harness, ai-e2e): adopt object params from #1779\n\nproviderKeys saves the key with credentials.set({ id, credential }).\nThe tests and the E2E route use the object shapes of the credential\nstore and session.answer. Prompt results in the tests have media: [].\nA new test checks that a key that /connect saved is scrubbed from the\nerrors that the session publishes.\n\n* docs(ai-harness): answer the /connect question with onEvent\n\nThe provider keys page answers the key question with session.onEvent\ninstead of a loop over session.events(), and calls session.answer with\none object.\n\n* docs(ai-harness): answer each open permission question once\n\nTool calls can run in parallel, so two questions can be open at the\nsame time. The sample now answers each open question once, by id,\ninstead of the first one in the list.\n\n* fix(ai, ai-persistence): close subagent budget and continue edges (#1786)\n\nfix(ai): close subagent budget and continue edges\n\nA background start that throws gives the maxCalls slot back, and maxConcurrent counts that child until done settles. A non-object schema no longer drops sessionId or background, and a top-level anyOf still shows those fields. A suspended child with no stored base keeps its transcript. An exhausted parent deadline says no time is left.\n\n* fix(ai-compaction, openai-base): do not save a failed native compact (#1787)\n\n* fix(ai-compaction, openai-base): do not save a failed native compact\n\nA failed compact must not become the checkpoint or the durable record.\nThe next process calls compact again. A compact echo keeps image files,\ndocuments, and audio.\n\n* test(e2e): retry native compact when the result has no item\n\nA compact result with no item is not stored. The next run on the same\nthread calls compact again, then uses the fallback strategy.\n\n* feat(ai-client): publish observable client snapshots (#1232)\n\n* feat(ai-client): publish observable client snapshots\n\nHold chat, generation, video, and realtime UI state in a TanStack Store\natom and subscribe from the framework hooks. Snapshot tool input, output,\nand subagent transcripts are copies. A failed realtime connect keeps the\ntranscript. A throwing subscriber cannot stick isLoading or skip the next\nlistener.\n\n* ci: apply automated fixes\n\n* fix(ai-react, deps): batch useChat renders and restore one @google/genai copy\n\nuseChat used useSyncExternalStore, which renders synchronously on every\nsnapshot change. A buffered stream rendered once per chunk and the\ntime-slicing e2e spec saw 6-9 long tasks. Hold the snapshot in state so\nReact batches changes into one render per task, as main did.\n\nThe lockfile regen moved ai-vertex's @google/genai dev dependency onto a\ndifferent zod peer than ai-gemini's. Two copies meant the factories test\nmocked the wrong one. Restore main's entry.\n\n---------\n\nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\nCo-authored-by: Tom Beckenham <34339192+tombeckenham@users.noreply.github.com>\n\n* fix(ai): report evaluate usage when answer mapping fails (#1742)\n\n* fix(ai): report evaluate usage when answer mapping fails\n\n- Wrap only mapAnswers in decide() so a mapping failure reports usage (evaluate:usage event and onUsage) before the error is rethrown\n- A provider answer that is missing or has the wrong type made decide() throw before usage was reported, so billed tokens were lost\n- The success path is unchanged, and onFinish still runs only on success\n- Add tests for the mapping failure, the success event order, a throwing onUsage, and an adapter that throws\n\n* docs(evaluate): note that usage is reported when answer mapping fails\n\n- Say that onUsage and evaluate:usage still get the usage when an answer is missing or has the wrong type\n- Bump the evaluate page updatedAt\n\n* chore(changeset): say which error decide() throws when onUsage fails\n\n- A throwing onUsage hook propagates on the mapping-failure path, same as on the success path\n- The changeset said decide() always throws the original error, which was not true in that case\n\n* test(e2e): cover decide() usage reporting when answer mapping fails\n\n- Add an aimock mount at /evaluate-usage-on-failure that serves an OpenAI Decisions response with valid usage and a choice outside the question's options\n- Add the /api/evaluate-usage-on-failure route, which runs decide() through the OpenAI evaluate adapter and returns the error name and message plus the usage seen by the onUsage hook\n- Add evaluate-usage-on-failure.spec.ts asserting decide() rejects and the onUsage hook received the usage\n\n* fix(ai): log the decide() mapping error before onUsage runs\n\nA throwing onUsage hook replaces the mapping error, so log it first.\nAlso correct the e2e comments (the choice has no probability, it is not\nchecked against the options) and widen the docs and changeset wording.\n\n---------\n\nCo-authored-by: Tom Beckenham <34339192+tombeckenham@users.noreply.github.com>\n\n* fix(ai): file each model call on its own assistant message (#1776)\n\n* fix(ai): file each model call on its own assistant message (#1533)\n\nA finished tool-call turn stays closed, and a signature goes to the step that owns it. The next model call no longer lands on the previous assistant message.\n\n* fix(e2e): typecheck the call-ownership harness\n\nThe wire yields events the same way the other harnesses do, and the page label accepts tool-result content.\n\n* fix(ai): keep REASONING_MESSAGE_START metadata on the assistant message (#1789)\n\n* fix(ai): keep REASONING_MESSAGE_START metadata on the assistant message\n\nFixes #1667\n\n* fix(ai): file reasoning-start metadata on the run's own assistant message\n\n* test(ai): give reasoning start events the required role\n\n* feat(openai-base, ai-openrouter, ai-groq, ai-utils): send json_object when strict json_schema is rejected (#1775)\n\n* feat(ai, openai-base, ai-openrouter, ai-groq): send json_object when strict json_schema is rejected\n\n* refactor(openai-base, ai-openrouter, ai-groq, ai-utils): pick json_object in the adapter and send the schema as a system prompt\n\nDrop the structuredOutputMode option from chat(). Adapters choose JSON mode\nfrom modelOptions or the model catalog, and add the schema as a system\nprompt because JSON mode does not send it.\n\n* fix(openai-base, ai-openrouter): keep JSON mode off tool turns and match :variant catalog ids\n\n- supportsCombinedToolsAndSchema() returns false in JSON mode, so the schema\n prompt goes only on the separate structured-output request. mapOptionsToRequest\n no longer adds it, so it cannot repeat.\n- OpenRouter checks the full id (with modelOptions.variant) before the id\n without its :variant, in one shared helper for the JSON-only and combined sets.\n- Docs, changeset and skills: plain JSON Schema and streamed replies are not\n validated; note the openai-base json_object behavior change.\n- Tests: :free/variant/fallback lookup, combined gate in JSON mode, OpenRouter\n chat and Responses JSON mode with tools, single schema prompt, Groq prompt.\n\n* test(ai-harness): pass thread id to inbox.get in provider-keys test\n\nThe inbox store's get() now takes { threadId, inputId } after the\none-object params migration, but provider-keys.test.ts still called it\npositionally (inbox.get(receipt.inputId)), failing @tanstack/ai-harness\ntest:types. Update it to the object form like the other inbox.get call\nsites.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \n\n---------\n\nCo-authored-by: Patrick L \nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: Tom Beckenham <34339192+tombeckenham@users.noreply.github.com>\nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\nCo-authored-by: Chris Trześniewski \nCo-authored-by: Jack Herrington \nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\n\n* fix(ai-harness): return done from the subagent start binding\n\nSubagentBinding.start is typed to return { subagentRunId, done }, where\ndone settles when the child ends, but the session binding returned only\n{ subagentRunId }. That broke @tanstack/ai-harness build and test:types.\nCapture the runAgent operation and resolve it as done, the same awaitable\nthe agent group already uses.\n\nAlso update the todos session-plugins test: chat() now checks a tool's\nJSON Schema before it runs, so an invalid todo status is a tool error the\nmodel sees, not the plugin's own \"Each todo needs text and a status.\"\nmessage. The test now expects the input-validation error.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \n\n* feat(ai-harness-cli): run a harness from the terminal, with optional ACP, MCP, and dashboard modes (#1768)\n\n* feat(ai-harness): serve sessions over HTTP and WebSocket, with a typed client and OAuth connectors\n\n* feat(ai-harness): createSessionView, one live store for a session in any UI\n\n* fix(ai-harness): add back sessionOfTurn for the run route, and the OAuth cases of auth.test.ts\n\n* feat(ai-harness-cli): run a harness from the terminal, with optional ACP, MCP, and dashboard modes\n\n* fix(ai-harness): import ./session/index, so the built types resolve HarnessSession\n\n* fix(ai-harness): import ../session/index in the view\n\n* test(ai-harness): startLoopbackReceiver cases from #1555\n\n* docs(examples): harness-cli, a notes assistant in the terminal with an Ink screen (#1770)\n\n* docs(examples): harness-cli, a notes assistant in the terminal with an Ink screen\n\n* chore(examples): keep the @google/genai resolution of ai-vertex in the lockfile\n\n* feat(ai-harness, ai-mcp): MCP servers in a harness, and a harness as an MCP server (#1763)\n\n* feat(ai-harness, ai-mcp): MCP servers in a harness, and a harness as an MCP server\n\nAdds @tanstack/ai-mcp/harness (createHarnessMcpServer and the mcp() plugin)\nand @tanstack/ai-mcp/connector (mcpConnector with OAuth sign-in and RFC 9207\niss). mcp() and mcpConnector ask spec 2025 elicitation/create requests and\nspec 2026 input rounds as session questions. Split out of #1555.\n\n* docs(ai-harness, ai-mcp): import definePlugin in the discoverTools sample\n\n* feat(ai-harness): GET agent-transcript and client.agentTranscript\n\nA client can read the saved messages of a child agent run, as a local\nsession does with session.agentTranscript. The route opens the session for\nthe principal, so a child of another thread or user stays hidden.\n\n* docs(ai-harness): list GET agent-transcript in the handler routes\n\n* docs(ai-harness): describe the card in client.agentTranscript\n\n* docs(ai-harness): read a child's messages from the browser\n\n* feat(ai-harness): createSessionView, one live store for a session in any UI (#1761)\n\n* feat(ai-harness): createSessionView, one live store for a session in any UI\n\n* fix(ai-harness): import ../session/index in the view\n\n* feat(ai-harness): close the gaps between createSessionView and the harness\n\n- Actions: followUp, continue, upload, configure, cancel(operationId),\n cancelInput, setDelivery, reset, revert, unrevert, and ViewAgent.cancel.\n- Interrupts: generic interrupts get their own list with resolve and cancel.\n Approvals can send edited arguments or a payload, and find their tool in a\n child agent.\n- Subagents: AgentPart.result, and after a reload each child shows its saved\n messages and how it ended.\n- A view that opens while a turn runs shows the turn from its start without\n what the transcript has. The snapshot is read before the transcript.\n- A retry drops the failed attempt, turnEnd skips a turn that stops for an\n interrupt, usage, models, and settings are in the state, and media that no\n message shows stops getting new URLs.\n\n* docs(ai-harness): every view action, other interrupts, and subagents after a reload\n\n* fix(ai-harness, ai-mcp): adopt object params from #1779\n\nThe client, the session view, and its source take one object for\nsetConfig, answer, setDelivery, sendToAgent, renameSession,\nupdateSession, and forkSession, as the session does. A view agent's\nsend takes { mode }, as AgentRun.send does. The protocol, the HTTP\nhandler, the connectors, and the MCP connector call the new store and\nsession shapes.\n\n* docs(ai-harness): object params in the transport, view, MCP, and auth pages\n\n* test(ai-harness): rename, update, and fork a session through the client\n\n* fix(ai-harness-cli): adopt object params from #1779\n\nThe session source of the CLI passes answer and setConfig through as one\nobject. The /answer and /config commands and the tests call the new\nsession and credential shapes. The printer test state has the view's\ninterrupts and models.\n\n* fix(ai-harness-cli): answer view interrupts, and skip old child parts on a reopened thread\n\n- The Ink screen asks each item of state.interrupts after the approvals,\n so a turn that waits for an interrupt can go on.\n- Line mode marks the saved parts of a child that ended before they\n loaded, so a reopened thread does not print old tool lines or save old\n media again.\n- docs/config.json lists Build your own UI once.\n\n* fix(ai-harness-cli): pass canAccess and mediaSecret to the harness handler (#1782)\n\nThe handler now requires canAccess, and a mediaSecret on a durable host\n(fix/harness-transport-release). The CLI serves one principal behind its\ntoken, so it can use every thread, and the token signs media URLs.\n\nCo-authored-by: Claude Opus 5.5 (1M context) \n\n* docs(harness-cli): document the --serve trust model\n\n--serve uses one bearer token, one principal, and canAccess: () => true,\nso any token holder can drive any thread (and its host-side tools) as the\nCLI's user. Document that trust boundary: keep it on loopback, what --host\n0.0.0.0 exposes, and point readers who need per-user auth or thread rules to\ncreateHarnessHandler.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \n\n---------\n\nCo-authored-by: Jack Herrington \nCo-authored-by: Claude Opus 5.5 (1M context) \n\n* fix(ai-harness, ai-persistence, ai-acp, ai-skills): review fix pass on sessions, durability, and adapters\n\nSessions: inputs settle on every path (commands, detached wakes, recovery),\nprincipals follow the requester (agent starts, wakes, steer with no turn),\nadmitted inputs leave on reject/settle, close() waits for recovery, restart\nnotes no longer end a transcript a cut turn continues, prompt() refuses a\nsession waiting on interrupts up front, JSON Schema command inputs run\nunchecked like core tool inputs, Standard Schema inputs are validated.\n\nDurability: lease renewal checks owner and status, crashed runs without a\nfirst lease stamp are found, fork closes the source session it opened and\nkeeps the index entry, resumePending survives one bad thread, emit survives\none bad listener, durable tool results are cloned, operation finish/fail\nwake a waiting feed, resource scope dispose no longer waits on in-flight\nopens. LeaseStore gets defineLeaseStore, memoryLeaseStore, and conformance\ncases. InboxStatus 'expired' removed (never produced).\n\nAgents: harnessContext() replaced by ctx.harness through a new\nSubagentBinding.extend hook in core; SubagentContextExtension is augmentable.\n\nharnessText: per-call thread id, principal option, session closed in finally,\ninterrupt finish reason, SSE trailing buffer flushed, outer tools forwarded.\nACP: TOOL_CALL_ARGS forwarded as rawInput; known() checks the harness name.\nSkills: watcher follows the nearest existing ancestor folder.\n\n* refactor(ai-harness): discriminate Receipt, InputSettlement, MediaRecord, and AgentRun by status\n\nA rejected receipt always carries its reason, a failed settlement always\ncarries its error, generated media always carries the run that made it, and\nan agent run always names its agent. The types now say so. SettlementOutcome\nis the outcome arm on its own, for code that settles several inputs at once.\n\n* docs(ai-harness, ai-persistence): match the docs to the fix pass\n\nctx.harness replaces harnessContext(), the subagents sample prints the child\ntranscript, coalescing covers tool call arguments, commitRevert runs on every\nturn, plugin state without a metadata store lives in memory, durable tool\nrecords land with harness.tool.result, InboxStatus has no 'expired',\ndefineLeaseStore and memoryLeaseStore are listed, agents.start takes a\nprincipal, and JSON Schema command inputs run unchecked. Changesets for\nSubagentBinding.extend and the lease store helpers.\n\n* feat(ai-harness)!: one session.send() replaces prompt, steer, followUp, and sendToAgent\n\nsend(message, { mode: 'prompt' | 'steer' | 'followUp' }) always returns an\nOperation. A steer's operation ends with the turn it joined. send(message,\n{ to: agentOperationId, mode }) routes a message to an agent run and returns\nan operation that ends with that run; an unknown run rejects with\nnot_running. continue() and AgentRun.send stay. Log records keep their ops,\nso stored logs replay unchanged. ACP, harnessText, the e2e routes, the\nREADME, and the tests use send().\n\n* docs(ai-harness): send() on every harness page, and the plugin session api sends too\n\nEvery sample sends with session.send, with mode: 'steer' or 'followUp' where\nthe page needs them, and send(message, { to }) for an agent run. The plugin\nctx.session.send matches the session API name.\n\n* fix(ai-harness, ai-persistence): review follow-ups on the send() push\n\nresumePending names its counts in the AggregateError message.\nmemoryLeaseStore is exported. harnessText closes only the per-call session\nit opened, so a caller's named thread stays open. A bare /command validates\n{} against an object schema. close() keeps its docs above the followers\nfield. ctx.harness docs say a plain chat() run has none. An applied log\ninput without an operation id, and a rejected one without a reason, are\ncorrupt-log errors instead of empty strings. A failed settle append after a\nreset or a cut turn is reported, not swallowed.\n\n* fix(ai-harness): close only the session a call opened, and report refused wakes\n\nhost.isOpen(harness, { threadId }) says whether this host holds a session\nopen. harnessText and host.fork close a session only when they opened it,\nso a thread the caller holds open keeps its running turn, and a per-call\nthread does not pile up on the host. A background agent's wake that the\nsession refuses (the thread waits for an interrupt) is reported instead of\ndropped. A command whose result landed but whose settle append failed\nfinishes completed. send(message, { to }) refuses with the input id it was\ngiven. resumePending's error carries the threads it did open. Tests for\neach, plus the JSON Schema command input and the forwarded follower on\nclose.\n\n* fix(ai-harness, e2e): lint the view receipt helper, and keep the e2e helper's prompt name\n\nThe thread-controls spec calls its own HTTP helper, prompt(), not the\nsession API. receiptOf in the view is a block, not a comma expression.\n\n* feat(ai, ai-harness, ai-persistence): credential store moves to byok, with server-side keys\n\nCredentialStore, Credential, CredentialScope, and defineCredentialStore now\nlive in @tanstack/ai/byok. @tanstack/ai/byok/server adds storedProviderKeys,\nreadCredential, tenantScopeOf, memoryCredentialStore, and envKeyEntry, so a\nserver keeps each user's provider keys without the harness or persistence.\n\nKeys are not a persistence store: createHarnessHost and runCli take a\n`credentials` option, and stores.credentials is gone. A user without a\ntenant no longer reads the bucket that every scope with neither shares.\n\nDocs: a Keep Keys on the Server page, the store rules, and a secure\npersistence section in the persistence skill.\n\n* feat(ai, ai-harness, ai-mcp): out-of-band tool runs, client appends, and a per-run system preamble (#1798)\n\n* feat(ai-harness, ai-mcp): out-of-band session.tool() and per-run systemPreamble\n\nTwo generic host primitives for the harness.\n\n- session.tool(name, args?, options?) runs one harness tool with no model\n turn (e.g. from a schedule or webhook), through the same middleware, input\n check, and permissions() rules as a model call; the call and its result\n join the transcript, and a tool that asks for approval stops the turn with\n an interrupt. A { op: 'tool', name, args?, meta? } client input runs a tool\n in the new expose.tools list (any other tool is refused with not_exposed);\n capabilitiesOf marks each tool with `exposed`; createHarnessMcpServer adds a\n tool_ tool per exposed tool. meta is echoed as a tanstack.injection\n custom event, and a plain-object or absent turn context carries the live\n threadId/runId so in-band tools can resolve the calling thread.\n- session.prompt(message, { systemPreamble }) prepends per-run, server-only\n system prompts ahead of the harness's own (e.g. host-provided memory). A\n client input cannot set them.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \n\n* docs(harness): document out-of-band tool runs and systemPreamble\n\n- New page \"Run a tool without a model\" (harness/tool-runs): session.tool,\n expose.tools, the tanstack.injection meta event, and the client/MCP path.\n- inputs: a server-only systemPreamble section next to ephemeral notes.\n- mcp-server: the tool_ per-tool entry.\n- config.json nav entry and addedAt/updatedAt dates.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \n\n* feat(ai, ai-harness, ai-mcp): typed expose.tools, an append input, and review fixes\n\n- expose.tools is typed from the harness tools, and defineHarness throws for\n a name that is not in tools. session.tool() and the new client.tool() type\n args from the tool's input schema.\n- expose.records lets a client add host records with an append input,\n client.append(), or the MCP append tool. A record of another type, or with\n a thread field, is refused with not_exposed.\n- A tool input now answers with its real receipt (its inputId, queued, and\n conflict), not always accepted.\n- session.tool() is refused with pending_interrupts while interrupts wait,\n as a prompt is.\n- threadId and runId go on the tool execution context, not into the user's\n context. ToolExecutionContext gets the two optional fields.\n- An MCP tool input with its own threadId field throws when the server is\n created, because MCP uses threadId to pick the thread.\n\n* docs(harness): typed tool runs, client records, and the MCP append tool\n\n* docs(harness): pass the CLI host credentials as a host option\n\nThe credential store left persistence.stores in c2b505b78, so this\nsnippet failed test:kiira on feat/harness-core too.\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) \nCo-authored-by: Alem Tuzlak \n\n* feat(ai, ai-persistence): keep approved edits raw until the final check, and bind a client-tool phase to its approval (#1764)\n\n* feat(ai): check tool input at the last moment, after approval edits and middleware\n\n* test(ai): fix the boundary client tool tests\n\n* feat(ai): validate JSON Schema tool input with @cfworker/json-schema\n\n* chore: keep one @google/genai copy for ai-vertex and ai-gemini\n\n* feat(ai): repair common model mistakes in tool input before the final check\n\n* fix(ai): type the repair order list\n\n* feat(ai, adapters): keep the raw tool argument string for replay\n\n* test(ai): the subagent tool input is checked after middleware\n\n* test(ai): subagent schema errors also show the received arguments\n\n* test(ai): the JSON Schema of a subagent tool checks background\n\n* test(ai): use an input the repair cannot fix in the subagent schema test\n\n* feat(ai, ai-persistence): keep approved edits raw until the final check, and bind a client-tool phase to its approval\n\n* test(ai-harness): adapt the replay parity test to the tool-input stack\n\n* test(ai-harness): expect media in turn results after #1779\n\n* test(ai-harness): use session.send() after the core send() change\n\n* fix(ai): keep an approved edit only when its call passed the check\n\n- Remove checkCompletedResumedClientTools. Main's final check (#1750)\n keeps a client result as it is, so this pass never checked the input.\n It only sent a second TOOL_CALL_RESULT and wrote an unchecked edit.\n- A null editedArgs is no edit (executeToolCalls uses editedArgs ?? input),\n so the transcript keeps the model input, not the string \"null\".\n- A middleware skip did not pass the check, so its edit is not kept.\n retainApprovedArgumentEdits takes the phase result and picks the ids.\n\n* feat(ai-harness): coding tools in @tanstack/ai-harness/plugins/coding (#1767)\n\n* feat(ai-harness): first-party plugins in @tanstack/ai-harness/plugins\n\nAdd permissions, agents, question, todos, title, modelPicker,\nprojectInstructions, fileCommands, compact, usage, and boundToolOutput\nunder the ./plugins entry. Export the portable permission names from\nthe package root again, so edge-safe plugins can read the rules.\n\n* docs(ai-harness): say that a tool with no rule runs in plan mode\n\n* feat(ai-harness): coding tools in @tanstack/ai-harness/plugins/coding\n\nAdd workspaceTools (read, write, edit or patch, list, grep, bash, webfetch,\nwebsearch), the WorkspaceBackend with hostBackend, snapshots (/undo, /redo,\nrevert file restore), and formatter in a new Node entry. turndown and\n@vscode/ripgrep are optional peers. Split out of #1555.\n\n* docs(ai-harness): end the terminal loop of the coding samples on exit\n\n* fix(ai-harness): adopt object params from #1779\n\nThe first-party plugins and their tests now call setConfig and answer\nwith one object. Prompt results in the tests also have media: [].\n\n* docs(ai-harness): answer permission questions with onEvent\n\nThe permissions page listens for the question with session.onEvent\ninstead of a loop over session.events(). The permissions and agents\npages call setConfig and answer with one object.\n\n* ci: apply automated fixes\n\n* fix(ai-harness, ai-e2e): adopt object params from #1779\n\nThe coding tool tests and the coding-tools E2E route call\nsession.answer with one object.\n\n* docs(ai-harness): print and answer with onEvent in the coding samples\n\nThe coding agent and coding tools samples print the text with\nturn.onEvent and answer questions with session.onEvent, instead of a\nloop over prompt().stream(). They call session.answer with one object.\n\n* docs(ai-harness): answer each open permission question once\n\nTool calls can run in parallel, so two questions can be open at the\nsame time. The sample now answers each open question once, by id,\ninstead of the first one in the list.\n\n* docs(ai-harness): ask one question at a time in the coding samples\n\nTool calls can run in parallel, so two questions can be open at the\nsame time. The terminal samples now ask each open question once, one\nat a time. A failed turn prints its error and the loop goes on.\n\n* feat(ai-harness, ai-sandbox): codingAgents and sandboxWorkspaceBackend in @tanstack/ai-sandbox/harness (#1771)\n\n* feat(ai-sandbox): codingAgents and sandboxWorkspaceBackend in @tanstack/ai-sandbox/harness\n\ncodingAgents({ sandbox, agents, workspace? }) lets a harness hand tasks to\nClaude Code, Codex, Grok Build, or any ACP agent in a sandbox, with a saved\nsession per agent and read-only plan mode. sandboxWorkspaceBackend runs the\nharness coding tools in a sandbox. Split out of #1555.\n\n* test(ai-sandbox): an agent without plan options does not run in plan mode\n\n* fix(ai-sandbox): adopt object params from #1779\n\nThe coding agents test calls session.setConfig with one object.\n\n* fix(ai-harness, ai-sandbox, ai-e2e): use session.send() after the core send() change\n\n* fix(ai-harness, ai-sandbox): review fixes for the coding tools\n\n- A background job keeps the last 10 MiB of its output, not all of it.\n The host backend decodes UTF-8 on the stream, so a character split\n over two chunks stays whole.\n- A Windows network path (\\server\\share) goes through the boundary\n check before realpath, which connects to the server.\n- patch refuses an Add File on a folder before it writes any file.\n- The formatter checks the project again after a failed check, so one\n failed readdir does not stop formatting for the session.\n\n* perf(ai-harness): faster file reads, edits, and searches in the coding tools\n\n- edit_file skips a loose match level that changes neither the file nor\n the old text. A miss in a 5 MB file takes about 12 ms, not 1 s.\n- hostBackend.readLines reads one page of a file. It counts lines on the\n bytes and decodes only the page. read_file uses it when the backend\n has it, and reads the whole file when it does not.\n- Without rg, list_files and grep read up to 16 folders or files at a\n time, and keep the order.\n- The real path of the root is read once, the permission check reuses\n the real path of the call, read_file needs no stat when the file is\n there, and writeFile makes folders only when one is missing.\n\n---------\n\nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\n\n* feat(ai, ai-persistence, ai-harness, ai-mcp, ai-acp, ai-sandbox, ai-utils): the harness redesign as one PR, with one durable log per session, access, waits, the agent tree, and coding workspaces (#1807)\n\n* feat(ai-persistence): LogStore v2 contract and the records API with an epoch\n\n* feat(ai-persistence): LogStore ownership with an epoch fence\n\n* docs(ai-persistence): LogStore v2 reference\n\n* refactor(ai-harness): move the harness to the LogStore v2 call shapes\n\n* feat(ai-persistence): LogStore input lane with atomic consumption\n\n* feat(ai-persistence): LogStore snapshots, truncate, and delete\n\n* feat(ai-persistence): memory log backend shared by store instances, and the kit twin option\n\n* docs(ai-persistence): acquire adds a missing owner row and deleteLog resets it; widen the conformance expiry window for networked stores\n\n* feat(ai-harness): seal the public API with subpaths, one-object calls, and grouped options (#1809)\n\n* chore(ai-acp): pin @agentclientprotocol/sdk to ~1.8.0\n\n* chore: keep the lockfile peer resolution unchanged for the ACP pin\n\n* refactor(ai-harness): drop the 'run' lifetime, type schema-less command input as unknown, use core metadata keys\n\n* refactor(ai-harness): subpath entry points for server, oauth, media, and Node plugins\n\n* refactor(ai-harness): HarnessSession as a type over a private class, whenIdle, and harnessOf\n\n* refactor(ai-harness): group host options per concern, and keep project and reduce on the harness\n\n* docs(ai-harness): one-object samples, subpath imports, grouped options, and the import guide\n\n* refactor(ai-harness): one-object parameters for the host, session, client, view, and helpers\n\n* docs(ai-harness): client and view samples in the one-object shapes\n\n* refactor(ai-harness): ctx.harness always present, and harness-first host.open and helpers\n\n* fix(ai, ai-harness): each context default registration removes only itself, an empty media.secret fails at start, and the docs say the oauth loopback helpers need Node\n\n* feat(ai-persistence, ai-harness): identity and access, with tenants, shared sessions, and a run context (#1812)\n\n* feat(ai-persistence): session index v2 keyed by tenant and thread, with owner, members, and required compare-and-set\n\n* feat(ai-harness): a RunContext for every run, so tools and plugins act as the user who started the run\n\n* feat(ai-harness): access types and the membersOnly() policy\n\n* feat(ai-harness): tenant-keyed index rows, log ids, and media keys\n\n* feat(ai-harness): host access with a principal-bound handle, sharing, revoke, and handlers that fail closed\n\n* docs(ai-harness): access and tenants, shared threads on membersOnly, and the run context\n\n* feat(ai-mcp, ai-acp, ai-harness-cli): the MCP server, the ACP agent, and the CLI act as a principal\n\n* fix(ai-harness): every thread-keyed store write carries the tenant\n\n* fix(ai-harness): delete removes the transcript, session plugins see the owner, host.hasAccess, and events wait for a new thread\n\n* test(ai-e2e): the protocol route on host access, and a shared-thread access spec\n\n* test(ai-harness): delete removes the transcript and closes the session\n\n* chore(ai-harness-cli): list @tanstack/ai-mcp as a dev dependency for the /mcp test\n\n* feat(ai-harness): session lifecycle with handles, observe, retention, host plugins, and a purging delete (#1813)\n\n* fix(ai-harness, ai-mcp): OAuth flows and commands stop on their signal\n\n* fix(ai-harness-cli): SIGINT and SIGTERM cancel the turn, then stop, in every mode\n\n* fix(ai-harness): one retention policy bounds every per-session collection, the feed, and the log tail\n\n* feat(ai-harness, ai-mcp, ai-acp, ai-harness-cli): reference-counted session handles with idle close and maxOpen\n\n* docs(ai-harness): lifecycle and retention, handles, observe, signals, and OAuth cancel\n\n* feat(ai-harness, ai-mcp, ai-acp): host.observe, a read-only session view, and read routes on it\n\n* test(ai-e2e): delete purges media and messages, and reads work after idle close\n\n* feat(ai-harness, ai-mcp): host-lifetime plugins, MCP stdio servers once per host, and delete that purges a thread\n\n* fix(ai-harness): definePlugin infers its definition only from the argument\n\n* fix(ai-harness): key host plugins by the harness definition, not its name\n\n* test(ai-mcp): open two sessions of one harness definition to share a stdio server\n\n* test(ai-harness, ai-harness-cli): give polled checks 5 s, for slower CI runs\n\n* feat(ai-persistence, ai-harness): the session log is the session, with ownership, an input lane, workers, schedules, and snapshots (#1814)\n\n* feat(ai-harness): thread-state log records and their fold\n\n* feat(ai-persistence, ai-harness): one persistence shape, every host has a log\n\n* feat(ai-harness): settings, config, plugin state, interrupted turns, overrides, and agent results live in the log\n\n* feat(ai-harness): one ownership epoch per log, renewed once per host, with abort on loss\n\n* feat(ai-harness): runs and interrupts live in the session log\n\n* feat(ai-persistence, ai-harness): inputs from any machine through the log input lane, host.submit, and no inbox, work claims, or leases\n\n* feat(ai-harness): createHarnessWorker, session.schedule, and step.sleep on the log\n\n* test(e2e): a worker on another host runs a submitted input and a schedule\n\n* feat(ai-harness): one log per session tree, session.logState(), and a wake when a busy session closes\n\n* feat(ai-harness): snapshots in the log store by size or time, retention logRecords, and the harness.gap event\n\n* fix(ai-harness): export LogOwnedElsewhereError, and say that the log keeps ephemeral messages with the turn\n\n* docs(ai-harness, ai-persistence): durable sessions, one log per tree, workers, snapshots, and the changesets for the log as the session\n\n* ci: apply automated fixes\n\n* fix(ai-harness): check answers and cancels from submit and schedule against their run, a schedule against its maker, and keep a same-host takeover and a lost log's inputs working\n\n* test(ai-harness): give polled checks 5 s, for slower CI coverage runs\n\n* test(e2e): read the data lines of POST run streams that now carry an id line per event\n\n* feat(ai, ai-harness, ai-mcp): one redaction sink, the final tool result in the log, secret answers by reference, and single-flight OAuth refresh (#1815)\n\n* feat(ai): CredentialStore compare-and-set pair, readCredentialEntry, and one scrubSecrets\n\n* feat(ai-harness): one redactor per session for log records, feed events, plugin state, notes, and the model context\n\n* feat(ai-harness): the log keeps the final tool result the model saw, and errors and step results leave the session scrubbed\n\n* feat(ai-harness): a secret answer sent to another host goes through the credential store as a one-time reference\n\n* test(e2e): a secret answer sent to another host never shows in the transcript, the events, the log, or the model input\n\n* feat(ai-harness, ai-mcp): OAuth refresh runs once per host, saves with compare-and-set to the scope it came from, and keeps the client registration\n\n* docs(ai, ai-harness, ai-mcp): redaction, secret answers across hosts, the final tool result, OAuth refresh, and the CredentialStore compare-and-set pair\n\n* feat(ai, ai-harness, ai-mcp, ai-acp, ai-harness-cli): durable waits in the log, at the boundary, in background runs, and on every transport (#1817)\n\n* feat(ai-harness): the Wait type and waits in the log, with expiry, waitFor, settled({ inputId, signal }), and operator answers to human waits\n\n* wip(ai-harness, ai-mcp): PR 7 boundary, coding-approvals, live-waits, background-waits (stopped mid-way, not checked)\n\n* feat(ai-harness, ai-mcp): waits at the boundary (permissions, the question tool, step.ask), live MCP and sign-in waits, and background runs that suspend and resume\n\n* feat(ai, ai-harness, ai-mcp, ai-acp, ai-harness-cli): agent runs pause on boundary approvals through SubagentBinding.interrupts, and every transport uses one wait shape\n\n* test(ai-mcp): the media result has a waits list\n\n* test(e2e): an approval asked on one server is answered on another, and an unanswered wait expires\n\n* docs(ai, ai-harness, ai-mcp, ai-acp, ai-harness-cli): wait for a person, step.ask, approvals at the boundary, background waits, and waits on every transport\n\n* fix(ai-harness): a session that does not own the log shows the waits and interrupts other hosts write\n\n* fix(ai-harness): lint errors in agent waits, step.ask, and permission resources\n\n* test(ai-harness, ai-code-mode): approvals are turn waits answered with resolve, and the device code carries expiresAt\n\n* test(e2e): in acceptEdits mode the write asks before it runs, with its formatter, and a reject writes nothing\n\n* feat(ai-harness): the agent tree, with typed agent actions, limits and budgets that hold, run inheritance, shared state, durable groups, and harnessAgent as a child run (#1818)\n\n* feat(ai-harness): typed subject-first agent actions start, run, and group, with grouped options, for plugins and agent code\n\n* feat(ai-harness): the run tree in the log, with RunNode for turns, agents, tools, and commands, and agentRuns read from it\n\n* feat(ai-harness): agent limits and budgets that hold, with queued starts, per-run usage, timeouts, attempts, and a budget code\n\n* feat(ai-harness): background runs inherit turn plugins, child signals follow their parent, tool-mode children get ctx.harness and share the turn budget, and ctx.harness.state shares state by key\n\n* feat(ai-harness): durable agent groups with a concurrency gate and keyed children, and routed agents that take steers, late joins, and turn hooks\n\n* docs(ai-harness): agents from code, groups, limits, budgets, the run tree, shared state, and routed agents\n\n* feat(ai-harness): harnessAgent runs as a child session in the root log, for the parent's user and keys, with usage, budget, waits, and events in the parent run\n\n* docs(ai-harness): the harnessAgent child run, as built\n\n* test(e2e): agent groups with a concurrency gate, a run budget, shared state, and a harnessAgent child run\n\n* test(ai-harness): give polled checks and a takeover deadline room for slower CI coverage runs\n\n* feat(ai-harness): handoffs between agents and to a person, the active agent in the log, and host.transfer between harnesses (#1819)\n\n* wip(ai-harness): PR 9 transfer (stopped mid-way, not checked)\n\n* feat(ai-harness): host.transfer moves a conversation to another harness with an envelope, links both threads, and is safe to retry; fork stays in its harness\n\n* feat(ai-harness): the active agent lives in the log and answers when the router picks nothing; routing.strategy 'handoff' becomes routing.after 'main'\n\n* feat(ai-harness): ctx.harness.handoff, a handoff tool, and one handoff path for code, tool, and router, with the target answering in the same turn\n\n* feat(ai-harness): hand a turn to a person through a human wait, operator replies with as: 'operator', and run.handoff for the main model's tools\n\n* feat(ai-harness): handing a turn to a person is opt-in with routing.humans, and an operator reply shows live in the view\n\n* test(e2e): handoffs to an agent and to a person, and a transfer between harnesses that is safe to retry\n\n* docs(ai-harness): hand off a conversation to an agent, to a person, or to another harness\n\n* test(e2e): the handoff route reads view text by message role\n\n* feat(ai-harness, ai-sandbox, ai-sandbox-local-process): coding tools for many threads, with workspaces per run, locks, bounded jobs, and moving threads between hosts (#1820)\n\n* fix(ai-harness, ai-sandbox): coding commands get an env allowlist, one workspace per thread, and real paths checked under the lock\n\n* wip: unfinished node work, saved before a shutdown (not reviewed)\n\n* fix(ai-harness): shared file locks with an unchanged check, and snapshots per thread and per run\n\n* fix(ai-harness, ai-sandbox, ai-sandbox-local-process): bounded background jobs with a ring buffer, a kill that waits for the spawn, workspace close, and an env allowlist in the local sandbox\n\n* perf(ai-harness, ai-sandbox): size caps for webfetch and read_file, range reads in the sandbox, one grep listing, and coding events for jobs, snapshots, and the formatter\n\n* docs(ai-harness, ai-sandbox, ai-sandbox-local-process): run the coding tools for many threads, with workspaces per thread, jobs, moving threads between hosts, and snapshots in the log\n\n* feat(ai-harness): ownership.hostId pins threads that use a local folder to their host, with E2E specs for env, roots, moving a sandbox thread, stranded, and pinning\n\n* chore(ai-harness): allow the ps binary in knip, and give polled checks room for slower CI coverage runs\n\n* feat(ai, ai-harness): protocol v2 with one wire encoding, healthy streams, run tags, lifecycle events, usage by source, and tracing (#1821)\n\n* feat(ai-harness, ai): protocol v2 frames with error codes and request ids, observability types, and pull-based SSE and socket senders\n\n* docs(ai-harness): first draft of the harness protocol page\n\n* feat(ai-harness): one wire encoding on every transport with hello, version, request ids, and heartbeats; hooks and status from other hosts; a gap event for evicted feeds\n\n* test(e2e): the access spec skips the hello frame of the session stream\n\n* feat(ai-harness): a grouped stream option for the heartbeat, the slow-consumer close, and the SSE and socket buffer limits\n\n* feat(ai-harness): run tags on every event frame, ctx.model.chat for plugins, and usage by source\n\n* feat(ai-harness): lifecycle events, counted router and transfer model calls, tracing with span links, and onOperation reports\n\n* docs(ai-harness): the harness protocol page, keeping the stream open, stopping a turn from useChat, and the changesets for reporting and observability\n\n* docs(ai-harness): run tags and the gap reload in the custom UI page\n\n* test(e2e): the wire, the gap, the run tree in one stream, lifecycle events, tracing, remote status, cancel from another host, and an unsupported version\n\n* test(ai-harness): give polled checks room for slower CI coverage runs\n\n* feat(ai-mcp, ai-acp, ai-code-mode, ai-skills, ai-harness-cli, ai-harness): integrations on the new harness, with MCP reconnects, ACP order, a skills watcher per host, and a CLI that cancels at once (#1822)\n\n* feat(ai-mcp): mcp() reconnects with backoff, lists tools again on list_changed, and takes needsApproval and toolName per server\n\n* fix(ai-acp, ai-code-mode, ai-harness): ACP keeps prompt order and releases idle sessions, code mode never moves approval tools, harnessText acts for the caller\n\n* perf(ai-skills): one folder watcher per host with a cache of the skills\n\n* feat(ai-harness-cli): cancel and steer act at once in a terminal, loadOptional reports real errors, and --dashboard goes away\n\n* chore(changeset): the integration changes for mcp, acp, code mode, skills, and harnessText\n\n* perf(ai-harness, ai-harness-cli): cheaper plugin, log, media, view, client, and host-event paths, no idle store calls, and context prompts after the history (#1823)\n\n* perf(ai-harness): cache plugin lists and permission patterns, read instruction files async, parse SSE as a stream with one abort listener and capped backoff, and give each control input an id\n\n* perf(ai-harness): stream media, cache base64 parts across turns, cap open-ended ranges, and add a byte-capped event ring\n\n* perf(ai-harness, ai-harness-cli): the view and the printer only redo what changed, children load on demand with view.loadAgent, operation.stream reads from its start\n\n* perf(ai-harness): ring buffer log tail, joins and rebuilt operations read from the run start, a per-tenant host event bus, no MESSAGES_SNAPSHOT in the log, and no idle store calls\n\n* perf(ai-harness): plugin prompts with placement 'context' go after the history, so the cached prompt prefix stays valid\n\n* test(ai-harness): one threadId in the expected gap frame\n\n* test(e2e): the first-party fixtures match the context prompt that now comes after the user message\n\n* fix(ai, ai-harness): a guard tier for tool calls, complete plugin removal, media and body limits, signing keys, and turn and config fixes (#1824)\n\n* fix(ai-harness): a settled operation keeps its status, a media signer with key rotation, and agents() rule docs that match the code\n\n* fix(ai-harness): every plugin contribution has an owner, ctx.on cleans up, inline media goes to the media store, and capabilities report the socket only when mounted\n\n* docs(ai-harness): say when capabilities report the WebSocket\n\n* feat(ai): onGuardToolCall middleware hook that runs on the final arguments of every tool call\n\n* test(e2e): onGuardToolCall denies on the final args after a transformArgs\n\n* fix(ai-harness): tool turns take no steers, a turn keeps its config, removing a plugin removes all of it, body and frame limits, signing keys, and a warning on tool name clashes\n\n* fix(ai-harness): the media signer's key check covers an empty secret\n\n* fix(ai-harness-cli): serve signs media URLs with a key derived from the token, so a short token meets the 32-byte key rule\n\n* feat(ai-harness, ai-mcp, ai-acp, ai-code-mode, ai-harness-cli): the final review of the harness, with its fixes, one object per call, and the known limits (#1825)\n\n* fix(ai-harness, ai-mcp, ai-acp, ai-code-mode): final review fixes for durability, access, plugins, transports, integrations, and coding tools\n\n* fix(ai-acp): one agent app serves one connection, with editor capabilities read from that connection, and no private SDK field\n\n* fix(ai-harness): a thread delete ends it in first-party plugins, the bash spill is scrubbed, removed schedules go at once, agent run receipts resolve, and session.append takes one object with an optional inputId\n\n* refactor(ai-harness, ai-mcp, ai-harness-cli): session, client, and view methods take one object, the client and view use putMedia and client.sessions, and internal fields leave the public types\n\n* docs(ai-harness, ai-mcp, ai-acp, ai-code-mode): the final review changes, the fixed durable-tools and server-tools text, and a known limits section\n\n* fix(ai-harness): revoke and unshare reject when work does not stop, thread delete reaches child logs and known harnesses, plugins declare kept records, and the review fixes\n\n- host.revoke and host.sessions.unshare reject when the work stop fails\n (the access is gone already). unshare ends the reads before it stops\n the work.\n- createHarnessHost takes harnesses, so a delete on a new host ends the\n thread in its plugins. An unknown harness warns. A child thread ends in\n the log of its root.\n- A plugin declares keepRecords. The core fold reads them from the\n plugins of the harness that folds the log, and counts per type.\n snapshots() keeps its 500 steps this way.\n- revert and unrevert open the workspace of the thread from the log when\n no turn opened it on this host.\n- The harness.revert and harness.job records keep the principal.\n- append with no inputId goes through accept(), so its id is real.\n- A formatter config below the root, or a write under node_modules, asks\n again.\n- The base64 cache takes the largest encodedBytes. The client takes\n idleTimeoutMs.\n- An events() read listens for a revoke from the call, not the first pull.\n\n* docs(ai-harness): the harnesses option, keepRecords, idleTimeoutMs, a revoke that rejects, and one known limit less\n\n* feat(ai-harness): ctx.session.keptRecords reads the kept records of a plugin, and session.revert reads them the same way\n\n* fix(ai-harness): an always answer saves no rule for an @unsaved: action\n\n* refactor(ai-harness): mounted plugins keep each contribution list with its owner, not in parallel owner arrays\n\n* fix(ai-harness): a plugins remove setting is rejected when a kept turn plugin or a harness middleware needs the removed capability\n\n* fix(ai-harness): client media checks every part before it stores any, refuses provider file handles unless media.allowProviderFiles, and the frame limit docs name the server maxPayload\n\n* fix(ai-harness): a retried client input with inline media reuses the stored media, so it stores nothing again and is a duplicate, not a conflict\n\n* docs(ai-harness): routed root-agent turns take steers and late joins, only session.tool() turns do not\n\n* fix(ai-harness-cli): --serve signs media URLs with --media-key or HARNESS_MEDIA_KEY, or a random key, never with the bearer token\n\n* fix(ai-harness): keep the usage source in the view, and a host events read that listens from the call\n\n* fix(ai-harness): send context prompts as the last system prompt, not as a user message\n\n* fix(ai-harness): check the snapshot shape in client.events(), and document its head-first default\n\n* feat(ai-harness): an onTurnStart plugin hook, used by projectInstructions and workspaceTools\n\n* fix(ai-harness): keep the interrupt messages snapshot in the log, so a rejoin from the log gets it\n\n* fix(ai-harness-cli): load the saved child agents in the TUI example, and document view.loadAgent for a ui\n\n* fix(ai-mcp): no reconnect timer after close, backoff that survives crash loops, and onDuplicateTool 'error'\n\n* fix(ai-harness-cli): tell a missing optional package by its resolve error code, not the message text\n\n* fix(ai-harness): check the inner session of harnessText through the outer thread, and pass the run principal on as is\n\n* fix(ai-harness): bind the harnessText inner thread to its outer thread before the outer check applies\n\n* fix(ai-acp): keep the sessions of the connection known on a host with no session index\n\n* refactor(ai-skills): one shared watcher per host that only triggers a sync, with no skill cache\n\n* fix(ai-harness): one harnessText inner thread id shape, /inner/, on every host\n\n* fix(ai-harness): use the real OpenTelemetry types, guard a tracer that throws, and trace a transfer inside it\n\n@opentelemetry/api is now an optional peer (type imports, and a lazy load for\ntrace.setSpan when a host has a tracer). The copied span types and the private\ncontext key are gone. A tracer or span call that throws is logged and fails no\nrun. The harness.transfer span is part of host.transfer, not a patch after it.\n\n* fix(ai-harness): trim the protocol to one version check, put the parent run on RUN_STARTED, and surface harness.error in the client\n\n- A requested version other than 2 gets unsupported_version from one\n equality check. negotiateVersion, SUPPORTED_PROTOCOL_VERSIONS, and the\n supported field are gone.\n- harness.event frames and session events no longer carry parentRunId. The\n AG-UI RUN_STARTED of a child agent run has it.\n- client.events() and client.hostEvents() connect again after slow_consumer\n and throw a HarnessProtocolError (code + message) for any other error frame.\n\n* fix(ai-harness): no usage event after a run finished, and bySource on old snapshots\n\n- A ctx.model.chat call that ends after its run settled (the title plugin)\n writes the usage record only: the run sends nothing after RUN_FINISHED.\n- Usage totals from a snapshot written before bySource get an empty map at\n load, so session.usage().bySource is always an object.\n\n* fix(ai-harness, ai-persistence): read takeover and open questions from real state, and clear the runs of a stopped owner\n\n- LogStore.acquire returns expired: true when it takes a log from another\n owner whose ownership expired with no release. harness.ownership.changed\n says taken_over from that, not from pending inputs.\n- The host status reads open questions from the folded log only.\n- The status rule drops the running operations of a stopped owner on\n taken_over, and the old operation of a resumed input, so a reader host\n does not show running forever after a takeover.\n\n* test(ai-harness): an append is an input, so a non-owner forwards it and the log has its input records\n\n- shared-log: check that the two app records land in one store append, or\n neither, among the input records that the append now writes.\n- ownership: the append of a host that does not own the log is queued and\n the owner writes it. A write that is not an input (a schedule) is still\n refused.\n- docs: an append on a host that does not own the thread gets a queued\n receipt.\n\n* fix(ai-harness): coding tools review fixes for many threads\n\n- The changed-since-read check keeps what each chat run read, so a lead\n and its tool-mode subagents do not lose each other's edits.\n- File locks are keyed by the sandbox (or host) and the real path, not by\n the root string.\n- A foreground command moves to the background only under maxJobs, and\n the log gets its process id (exec onStart), so a later host can stop it.\n- A job that the backend cannot check (killJob throws, or no killJob)\n stays in the log, and the model hears that it may still run.\n hostBackend.killJob throws when ps gives no start time.\n- workspaceRoot(base, ...parts) encodes each part of a workspace folder,\n so a thread id from a client cannot leave base.\n- host.unpin({ harness, threadId }) unpins a thread from a host that does\n not come back.\n\n* fix(ai-sandbox, ai-sandbox-local-process): job ids with a start time, one commandEnv, and passEnv\n\n- sandboxWorkspaceBackend gives a job id of pid and start time (ps -o\n lstart), and killJob stops only the process that started then. It\n rejects when it cannot check a process that runs.\n- commandEnv and createOutputTail live in @tanstack/ai-sandbox, and\n local-process imports commandEnv from there.\n- localProcessSandbox({ passEnv }) gives commands more variables of the\n host, for a CLI login or a proxy.\n\n* docs(ai-harness, ai-sandbox): safe workspace roots, host.unpin, a stable hostId, no isolation claims for host commands, and passEnv\n\n* refactor(ai-utils, ai-harness, ai-sandbox, ai-sandbox-local-process): one commandEnv and createOutputTail in @tanstack/ai-utils\n\nThe three packages import both helpers from @tanstack/ai-utils, a new\ndirect dependency of each. No more copies. commandEnv reads process.env\nonly when there is a process, and createOutputTail needs no Buffer.\n\n* feat(ai-persistence, ai-harness): host heartbeats, so a pin lapses only when its host stopped\n\n- LogStore.heartbeat({ hostId, ttlMs }). acquire and listOrphaned ignore\n the affinity of a host with no live heartbeat. The memory store, the\n conformance suite, and the SQL recipe have it.\n- A host with ownership.hostId sends a heartbeat each renewMs, also when\n it owns no log. A live host keeps its pins on idle threads. When it\n stops, another host reattaches its threads.\n- Docs for the workspaces, deploy, durable sessions, and store pages.\n\n* fix(ai-utils): type the process env of commandEnv, so the React Native smoke typechecks\n\nWithout process, commandEnv reads {}. The union of process.env and {}\ncannot be indexed by a string under the React Native smoke tsconfig\n(TS7053 at command.ts:46), and the Test job stopped there.\n\n* fix(ai-vertex): give ai-vertex the same @google/genai copy as ai-gemini again\n\nThe lockfile moved the @google/genai devDependency of ai-vertex to the\nzod@4.6.5 peer copy, while ai-gemini keeps the zod@4.3.6 copy. Then the\nvi.mock('@google/genai') of the vertex tests mocks another file than the\none that ai-gemini imports, and tests/factories.test.ts fails.\n\n* test(ai-harness): give the live-host pin test a 1 s heartbeat\n\nWith a 300 ms ttl and a 100 ms heartbeat, a CI run that holds the event\nloop for 200 ms lets the heartbeat expire, and the pin stops counting.\n\n* feat(ai-harness, ai-persistence): an operator role, so the user who waits for a person cannot act as that person\n\nmembersOnly() gives the operator action only to the role 'operator' by\ndefault. membersOnly({ operator: { roles } }) sets the roles that have it.\nA human wait takes only 'operator', for an answer and for a resolve that\nends it, on a handle and through host.submit.\n\n* fix(ai-harness): handoff review fixes\n\n- The fold ends a handoff to a person when its human wait settles in any\n way, and refuses a human handoff record with no waitId.\n- The router writes the move to the main model once when the active agent\n is gone.\n- An operator can hand back to a root agent of a turn plugin: the human\n handoff record keeps the agents of its turn.\n- routing.handoffs: false gives no model the handoff tool.\n- A handoff stops only the chat that made it.\n- A handoff in a part that also stops for interrupts waits with them, so\n the resolve turn runs the target or pauses for a person.\n- The view adds no empty message for a handoff to a person or an operator\n hand-back.\n- An operator reply keeps its text in the assistant message and its files\n in a marked user note, which the view shows with the reply.\n- host.transfer throws for a source thread that does not exist.\n\n* fix(ai): ask onShouldContinue after the resumed tools, before the next model call\n\nA resume runs the pending tool calls, then went to the model with no loop\ncheck. Now the middleware onShouldContinue decides, as after any tool\nphase. false ends the run with no more model calls. So a harness handoff\nin a part that also waited for a client tool runs the target in the\nresolve turn, and the agent that handed off does not answer again.\n\n* fix(ai-harness): a harnessAgent child goes on after any resume, and a POST run resume of its wait streams the parent run\n\nThe parent run now listens for the next turn of the child session, so an\nanswer that comes early, or a child that resumes by itself (an expired\nwait), no longer leaves the parent run waiting for good. An answer to a\nchild wait returns a receipt that names the parent run, so the POST run\nhandler streams that run to its end.\n\n* fix(ai-harness): a plugin start with parent: ctx.context.run is a child of that agent run\n\nA top-level agent run that awaited a plugin start could wait for good\nunder maxConcurrent: the start queued behind the run that awaited it.\nWith parent: ctx.context.run, the start is a child of the running agent\nrun, as ctx.harness.agents starts it, and takes no maxConcurrent slot.\n\n* fix(ai-harness): child ids of a resumable run in their own namespaces, so keyed children never collide and an outliving child keeps its steps\n\nKeyed and positional children now get separate ids (start:k: vs\nstart:n:, group:k: vs group:n:), after a '/' that the settle\ncleanup prefix agent:: cannot match. So a background child\nthat outlives its parent keeps its steps, tool results, and kept answers.\nA known child of another agent than the one asked for now throws.\n\n* fix(ai-harness): a resumed agent run carries the usage of the run before, so its budget holds across a restart\n\nThe log fold now keeps the usage sum of a run whose input is still\napplied, and moves it to the next run of that input when it applies. So\nmaxTokens and maxCost count every attempt of a resume: true run.\n\n* fix(ai-harness): onModelError of an agent run retries only the failed model call\n\nThe option was asked for any failure of the run, and 'retry' ran the whole\nagent again from its first message, with no bound: a tool side effect ran\ntwice, and a permanent error looped for good. Now a chat middleware asks\nthe option only for a model call that fails before it streams, waits a\nshort backoff, and calls that model again. Core calls one model call at\nmost 3 times.\n\n* fix(ai-harness): host.open reserves only real harnessAgent child and harnessText inner thread ids\n\nhost.open refused any thread id that contained /agent/ or /inner/. One\nhelper now refuses such an id only when the part before the marker is a\nthread of the index, so an app id like org/agent/notes opens.\n\n* docs(ai-harness): document only the stable fields of harness.run.node, and mark its bookkeeping fields internal\n\n* chore(ai-harness): import the backoff wait under its own name, so it shadows no wait\n\n* refactor(ai-harness): one admission gate for maxConcurrent slots, group slots, and tree budget calls\n\nThe session maxConcurrent slots, the slots of each group, and the tree\nbudget calls that ran when a queued child started were three separate\nmechanisms. A small Gate now holds the slots of both the session and a\ngroup, with FIFO waiters, drop on abort, and an admit hook that takes the\ntree budget call as a start enters. admitStart replaces reserveWhenReady.\nNo behavior change.\n\n* feat(ai-harness): a plugin start in a tool call of an agent run is a child of that run, with parent: null to opt out\n\nctx.agents of a plugin now finds the agent run whose tool call runs (when\nit is the only operation of the session in a tool call), and starts the\nagent as its child, so it takes no maxConcurrent slot and the run can\nawait it. parent: { runId } still names the run, and parent: null starts\na top-level run that takes a slot.\n\n* fix(ai-harness): refuse every /inner/ thread id from app code\n\nhost.open, host.submit, host.fork, and host.transfer now refuse any thread\nid with /inner/, also when the thread before it does not exist yet, so no\napp call can take the id of a harnessText inner session first. Only the\nthroughOuterThread open gets one. The narrow /agent/ rule stays.\n\n* fix(ai-harness): a stop of the parent run cancels its harnessAgent child again\n\nThe change that lets a child go on after any resume dropped the abort\nlistener of the parent run. A stopped run then left its child running,\nand a run stopped while its child waited never ended.\n\n* test(ai-harness): skip four flaky CI tests, and no backoff after the last onModelError retry\n\n* feat(ai): export validateJsonSchema and the Standard Schema types\n\n* fix(ai-harness): recovery fails an interrupted agent run whose waits never reached the log, so it does not wait forever\n\n* fix(ai-harness, ai-mcp, ai-acp, ai-harness-cli): one wait view, and answer and resolve check every wait they end\n\n- snapshot().pendingWaits is the one wait view. pendingInterrupts and\n pendingQuestions are gone. A PendingWait has its interrupt when a chat\n run stopped for it, turn: true for a wait of the stopped turn, and the\n secret and url of a question. The HTTP connect payload, the view, MCP,\n ACP, the CLI, and the e2e apps read it.\n- The answer to a logged wait is checked with validateJsonSchema of core\n (cfworker), so pattern and every other keyword count. The hand-written\n JSON Schema validator and the copied Standard Schema types are gone.\n- resolve takes only waits with a pending interrupt (use_answer for a\n step.ask question or a handoff wait), and only the waits of one run\n (mixed_runs). host.submit checks a resolve against the run of its wait.\n- A second answer to a wait that an answer ends now is refused.\n- The MCP resolve tool finds a background-run wait in the log and checks\n every decision, so it answers a wait that another server opened.\n\n* test(e2e): read only this test's request from the aimock journal in the ArkType wire spec\n\nOther specs run at the same time against the same aimock. The spec read\nentries[0], which was a request of a parallel spec, so it got no tool.\nIt now finds its request by the x-test-id header, and it no longer clears\nthe journal that the other specs read.\n\n* fix(ai-harness): no dropped-handle warning after host.close()\n\nhost.close() closes every session, but it kept the hold records. When the\ngarbage collector later dropped a handle that was not closed, the host\nwarned. The warning came at a random time, also while vitest closed a test\nfile, which fails the run with 'Closing rpc while onUserConsoleLog was\npending'. The host now gives no warning after close(). A test in\nclient-reads also closes the handle that it opens.\n\n* feat(ai): add lastChatMiddleware to SubagentBinding, and the secret_answer credential type\n\n- binding.lastChatMiddleware runs after the own middleware of each ctx.chat\n call of an agent run, so a host middleware sees the final model context\n and tool results. Nested children get it after their own.\n- Credential has a secret_answer type with an expiresAt, so the harness keeps\n a secret answer apart from the user credentials.\n\n* fix(ai-harness): keep secrets out of step values, agent middleware, and secret answer rows\n\n- step.do throws when its value holds a secret of the session, on the first\n run and on a replay, so the log never keeps a secret and a tool never gets\n a silent '[redacted]' value.\n- The redact, tool result scrub, and tool result recorder middleware of an\n agent run go in binding.lastChatMiddleware, after the agent's own\n ctx.chat middleware. The log keeps the result the model got, and an agent\n middleware that sets the messages again cannot send a secret to the model.\n- Secret answers are credentials of the type secret_answer with an expiresAt\n 24 hours later. credentials.list hides that type. An expired ref is refused.\n- The redactor is a closure. Its walk covers Map and Set, and add() takes\n each string field of a secret answer with fields.\n- The duplicate check compares an input without the secrets of the session,\n as the log keeps it, so a retry with a secret in it is a duplicate.\n\n* fix(ai-mcp): ask for a sign-in when the user signs out while the SDK refreshes a token\n\nThe SDK's new tokens are not saved when credentials.refresh finds no\ncredential, so saveTokens throws AuthRequiredError instead of dropping them\nwith no sign.\n\n* test(e2e): run the harness secret answer route against aimock\n\nThe route uses the OpenAI adapter against aimock with a fixture, and the\nspec reads the model calls of each host from the aimock journal.\n\n* docs(ai-harness): narrow credentials on oauth, so the secret_answer kind type-checks\n\n* fix(ai-persistence): keep the harness of the owner or the first offer for a log\n\n* fix(ai-harness): check the harness in host.submit, and throw when a child cannot find its root\n\n* fix(ai-harness): prune settled state from the thread fold, and change its maps in place\n\n* fix(ai-harness): take only JSON values from step.do\n\n* fix(ai-harness): back off a failing log in the worker, free the slot of a long sleep, and need media on a shared host\n\n* test(ai-harness): skip a build-stub test that times out under load\n\n* chore(changeset): note the review fixes of the log session\n\n* fix(ai-harness): need media only on a host with ownership, and warn once on another host\n\n---------\n\nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\n\n* fix(ai-harness): refuse an open while a thread purges, and a delete of a thread with no entry on a host with access\n\n* fix(ai-harness): throw on each call of a closed handle, and keep the quiet reopen only for a live handle\n\n* fix(ai-harness): share a host plugin setup only for the same plugin object\n\n* refactor(ai-harness): build the live and the observed snapshot with one builder\n\n* fix(ai-harness-cli): resolve at once on a second signal with your own host, also when the turn ignores the cancel\n\n* chore(changeset): note the review fixes of the session lifecycle\n\n---------\n\nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\n\n* fix(ai-harness): run the rest of an answered turn as the user who sent it\n\nWhen the owner answers the approval of a member's turn, the resumed turn\nused the credentials and provider key of the owner. It now runs as the\nsender of the stopped turn, also after a restart. The log still keeps the\nanswerer as the actor of the resolve.\n\n* fix(ai-harness): keep the keys of one user out of the shared provider-keys state\n\nThe plugin state showed 'env' for a key that a host with access never\nreads, and /connect wrote the status of one user into the state that\nevery member reads. The state now holds only the env vars that the\nsession reads, and /keys checks the keys of the user who runs it.\n\n* fix(ai-harness): explicit access rules, one owner record, and fail-closed child and media checks\n\n- access takes { identify, authorize, listFilter?, members?, envKeys? }.\n membersOnly() returns authorize, listFilter, and members, so spread it\n into access. The host no longer sniffs a marker on authorize.\n- The owner is kept once: the member with the role owner. SessionIndexEntry\n has no ownerId. A share cannot change the role of the owner.\n- host.open of a child thread checks read on its root first, and a child\n whose root is missing is refused, so a stranger gets 403 and never the\n parent thread id.\n- A signed media URL proves only that the handler made it. The handler\n runs identify for it and checks read for that user in the tenant of the\n URL. The fabricated principal is gone.\n- A revoke of a user in GET host-events drops every kept read decision,\n so the child threads of the revoked thread stop too. A deleted child is\n decided through its parent.\n- createHarnessMcpServer uses requestUsers from the server entry, the same\n fail-closed rule as the HTTP handler and the socket.\n- Tests for the delete refusal over HTTP, a revoked handle that cancels\n its own run, and a member turn that the owner approves.\n\n* docs(ai-harness): explicit access rules, members-only ownership, and signed media that needs a user\n\n* feat(ai-harness): access.anonymous gives a guest for a signed media URL with no login\n\nThe handler calls it only on the signed media route, after the signature\nchecks out, and only when identify finds no user. authorize then decides\nread for the guest, in the tenant of the URL. Without it, the request\ngets 401. The guest reaches no other route.\n\n* refactor(ai-harness)!: nest the access rules in access.policy\n\naccess is now { identify, policy, anonymous?, envKeys? }, and a policy is\n{ authorize, listFilter?, members? }. membersOnly() returns a policy, so\na host passes policy: membersOnly(). A custom policy is\npolicy: { authorize }. No spread of the rules into access. Callers, tests,\ne2e routes, docs, and the changeset follow.\n\n---------\n\nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\n\n* fix(ai,ai-harness): optional ctx.harness, an error for a mixed log fold, and an allow-listed HarnessSession\n\n- Remove registerSubagentContextDefaults, its process-global Set, and the\n harness module side effect that filled it. ctx.harness is now optional\n on SubagentContextExtension. Every session path still passes it through\n binding.extend. ai-harness goes back to \"sideEffects\": false.\n- A harness with another durability.project or durability.reduce than the\n one that folds an open log now throws when it opens that log, in place\n of a silent first-opener-wins fold.\n- HarnessSession lists its public members (an allow-list), and SessionImpl\n implements it. takeOver, scrubError, loggedRun, and scheduleRun leave the\n public type.\n- The POST run route calls resolveForRun and sendForRun directly, and\n throws for a session of another package copy.\n- Fix the expose.commands JSDoc to client.command({ name }).\n\n---------\n\nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\n\n* fix(ai-persistence)!: owner-only pins and snapshots, a delete tombstone, and a plain memoryLogState\n\n- setAffinity, putSnapshot, and truncate need an acquired log at the\n current epoch. UNOWNED_EPOCH calls reject with OwnershipLostError.\n Plain unowned appends still work.\n- deleteLog leaves a tombstone: every fenced write to the log fails,\n also with UNOWNED_EPOCH, until the next acquire. A late saveThread\n cannot bring a purged transcript back. An offer still works.\n- memoryLogState() replaces memoryLogBackend(). memoryLogStore({ state })\n takes the plain shared state. The frozen handle, the WeakMap, and the\n TypeError guard are gone.\n- Conformance: acquire clears the wake time, renew after release fails,\n the twin must have a new log store instance, owner-only pins,\n snapshots, and truncates, and the delete tombstone.\n- The SQL recipe in store-reference.md matches the contract: acquire\n with expired, owner-only fences, the tombstone row, and the\n first-offer harness in listOrphaned.\n\n* fix(ai-persistence,ai-harness)!: offer to a deleted log returns 'deleted'\n\n- OfferResult gets 'deleted'. An offer to a log with a delete tombstone\n stores nothing and returns 'deleted', until a new acquire clears the\n tombstone. Contract JSDoc, memory store, a conformance case, and the\n SQL recipe (a deleted column on log_owner) follow it.\n- The harness surfaces it: host.submit and a session input that goes to\n the lane get a rejected receipt with the reason 'deleted', an awaited\n operation rejects with InputRejectedError (\"The thread was deleted.\"),\n and a transfer record offer throws.\n\n* docs(ai-harness): bump updatedAt of the inputs page\n\n* test(ai-harness): check that no sign-in deadline starts, not the process-wide timer count, so loopbackLogin's onUrl test is not flaky in CI\n\n* refactor(ai-harness, ai-harness-cli, ai-mcp): remove what the harness redesign replaced, with the docs, skills, and changesets of the end state (#1829)\n\n* chore(ai-acp): pin @agentclientprotocol/sdk to ~1.8.0\n\n* chore: keep the lockfile peer resolution unchanged for the ACP pin\n\n* refactor(ai-harness): drop the 'run' lifetime, type schema-less command input as unknown, use core metadata keys\n\n* refactor(ai-harness): subpath entry points for server, oauth, media, and Node plugins\n\n* refactor(ai-harness): HarnessSession as a type over a private class, whenIdle, and harnessOf\n\n* refactor(ai-harness): group host options per concern, and keep project and reduce on the harness\n\n* docs(ai-harness): one-object samples, subpath imports, grouped options, and the import guide\n\n* refactor(ai-harness): one-object parameters for the host, session, client, view, and helpers\n\n* docs(ai-harness): client and view samples in the one-object shapes\n\n* refactor(ai-harness): ctx.harness always present, and harness-first host.open and helpers\n\n* feat(ai-persistence): session index v2 keyed by tenant and thread, with owner, members, and required compare-and-set\n\n* feat(ai-harness): a RunContext for every run, so tools and plugins act as the user who started the run\n\n* feat(ai-harness): access types and the membersOnly() policy\n\n* feat(ai-harness): tenant-keyed index rows, log ids, and media keys\n\n* feat(ai-harness): host access with a principal-bound handle, sharing, revoke, and handlers that fail closed\n\n* docs(ai-harness): access and tenants, shared threads on membersOnly, and the run context\n\n* feat(ai-mcp, ai-acp, ai-harness-cli): the MCP server, the ACP agent, and the CLI act as a principal\n\n* fix(ai-harness): every thread-keyed store write carries the tenant\n\n* fix(ai-harness): delete removes the transcript, session plugins see the owner, host.hasAccess, and events wait for a new thread\n\n* test(ai-e2e): the protocol route on host access, and a shared-thread access spec\n\n* test(ai-harness): delete removes the transcript and closes the session\n\n* chore(ai-harness-cli): list @tanstack/ai-mcp as a dev dependency for the /mcp test\n\n* fix(ai-harness, ai-mcp): OAuth flows and commands stop on their signal\n\n* fix(ai-harness-cli): SIGINT and SIGTERM cancel the turn, then stop, in every mode\n\n* fix(ai-harness): one retention policy bounds every per-session collection, the feed, and the log tail\n\n* feat(ai-harness, ai-mcp, ai-acp, ai-harness-cli): reference-counted session handles with idle close and maxOpen\n\n* docs(ai-harness): lifecycle and retention, handles, observe, signals, and OAuth cancel\n\n* feat(ai-harness, ai-mcp, ai-acp): host.observe, a read-only session view, and read routes on it\n\n* test(ai-e2e): delete purges media and messages, and reads work after idle close\n\n* feat(ai-harness, ai-mcp): host-lifetime plugins, MCP stdio servers once per host, and delete that purges a thread\n\n* fix(ai-harness): definePlugin infers its definition only from the argument\n\n* feat(ai-harness): thread-state log records and their fold\n\n* fix(ai-harness): key host plugins by the harness definition, not its name\n\n* feat(ai-persistence, ai-harness): one persistence shape, every host has a log\n\n* test(ai-mcp): open two sessions of one harness definition to share a stdio server\n\n* test(ai-harness, ai-harness-cli): give polled checks 5 s, for slower CI runs\n\n* feat(ai-harness): settings, config, plugin state, interrupted turns, overrides, and agent results live in the log\n\n* feat(ai-harness): one ownership epoch per log, renewed once per host, with abort on loss\n\n* feat(ai-mcp): mcp() reconnects with backoff, lists tools again on list_changed, and takes needsApproval and toolName per server\n\n* fix(ai-harness, ai-sandbox): coding commands get an env allowlist, one workspace per thread, and real paths checked under the lock\n\n* feat(ai-harness): runs and interrupts live in the session log\n\n* fix(ai-acp, ai-code-mode, ai-harness): ACP keeps prompt order and releases idle sessions, code mode never moves approval tools, harnessText acts for the caller\n\n* wip: unfinished node work, saved before a shutdown (not reviewed)\n\n* fix(ai-harness): shared file locks with an unchanged check, and snapshots per thread and per run\n\n* fix(ai-harness, ai-sandbox, ai-sandbox-local-process): bounded background jobs with a ring buffer, a kill that waits for the spawn, workspace close, and an env allowlist in the local sandbox\n\n* perf(ai-skills): one folder watcher per host with a cache of the skills\n\n* feat(ai-harness-cli): cancel and steer act at once in a terminal, loadOptional reports real errors, and --dashboard goes away\n\n* feat(ai-persistence, ai-harness): inputs from any machine through the log input lane, host.submit, and no inbox, work claims, or leases\n\n* fix(ai-harness): a settled operation keeps its status, a media signer with key rotation, and agents() rule docs that match the code\n\n* perf(ai-harness, ai-sandbox): size caps for webfetch and read_file, range reads in the sandbox, one grep listing, and coding events for jobs, snapshots, and the formatter\n\n* fix(ai-harness): every plugin contribution has an owner, ctx.on cleans up, inline media goes to the media store, and capabilities report the socket only when mounted\n\n* perf(ai-harness): cache plugin lists and permission patterns, read instruction files async, parse SSE as a stream with one abort listener and capped backoff, and give each control input an id\n\n* docs(ai-harness): say when capabilities report the WebSocket\n\n* feat(ai-harness): createHarnessWorker, session.schedule, and step.sleep on the log\n\n* feat(ai): onGuardToolCall middleware hook that runs on the final arguments of every tool call\n\n* test(e2e): onGuardToolCall denies on the final args after a transformArgs\n\n* perf(ai-harness): stream media, cache base64 parts across turns, cap open-ended ranges, and add a byte-capped event ring\n\n* test(e2e): a worker on another host runs a submitted input and a schedule\n\n* feat(ai): CredentialStore compare-and-set pair, readCredentialEntry, and one scrubSecrets\n\n* feat(ai-harness): one log per session tree, session.logState(), and a wake when a busy session closes\n\n* perf(ai-harness, ai-harness-cli): the view and the printer only redo what changed, children load on demand with view.loadAgent, operation.stream reads from its start\n\n* feat(ai-harness): snapshots in the log store by size or time, retention logRecords, and the harness.gap event\n\n* fix(ai-harness): export LogOwnedElsewhereError, and say that the log keeps ephemeral messages with the turn\n\n* feat(ai-harness, ai): protocol v2 frames with error codes and request ids, observability types, and pull-based SSE and socket senders\n\n* docs(ai-harness, ai-persistence): durable sessions, one log per tree, workers, snapshots, and the changesets for the log as the session\n\n* ci: apply automated fixes\n\n* docs(ai-harness): first draft of the harness protocol page\n\n* feat(ai-harness): one redactor per session for log records, feed events, plugin state, notes, and the model context\n\n* fix(ai-harness): check answers and cancels from submit and schedule against their run, a schedule against its maker, and keep a same-host takeover and a lost log's inputs working\n\n* test(ai-harness): give polled checks 5 s, for slower CI coverage runs\n\n* test(e2e): read the data lines of POST run streams that now carry an id line per event\n\n* feat(ai-harness): the log keeps the final tool result the model saw, and errors and step results leave the session scrubbed\n\n* fix(ai-harness): tool turns take no steers, a turn keeps its config, removing a plugin removes all of it, body and frame limits, signing keys, and a warning on tool name clashes\n\n* feat(ai-harness): a secret answer sent to another host goes through the credential store as a one-time reference\n\n* fix(ai, ai-harness): each context default registration removes only itself, an empty media.secret fails at start, and the docs say the oauth loopback helpers need Node\n\n* fix(ai-harness): the media signer's key check covers an empty secret\n\n* test(e2e): a secret answer sent to another host never shows in the transcript, the events, the log, or the model input\n\n* feat(ai-harness, ai-mcp): OAuth refresh runs once per host, saves with compare-and-set to the scope it came from, and keeps the client registration\n\n* perf(ai-harness): ring buffer log tail, joins and rebuilt operations read from the run start, a per-tenant host event bus, no MESSAGES_SNAPSHOT in the log, and no idle store calls\n\n* perf(ai-harness): plugin prompts with placement 'context' go after the history, so the cached prompt prefix stays valid\n\n* docs(ai, ai-harness, ai-mcp): redaction, secret answers across hosts, the final tool result, OAuth refresh, and the CredentialStore compare-and-set pair\n\n* feat(ai-harness): the Wait type and waits in the log, with expiry, waitFor, settled({ inputId, signal }), and operator answers to human waits\n\n* feat(ai-harness): one wire encoding on every transport with hello, version, request ids, and heartbeats; hooks and status from other hosts; a gap event for evicted feeds\n\n* test(e2e): the access spec skips the hello frame of the session stream\n\n* feat(ai-harness): typed subject-first agent actions start, run, and group, with grouped options, for plugins and agent code\n\n* wip(ai-harness, ai-mcp): PR 7 boundary, coding-approvals, live-waits, background-waits (stopped mid-way, not checked)\n\n* wip(ai-harness): PR 9 transfer (stopped mid-way, not checked)\n\n* feat(ai-harness): host.transfer moves a conversation to another harness with an envelope, links both threads, and is safe to retry; fork stays in its harness\n\n* feat(ai-harness): a grouped stream option for the heartbeat, the slow-consumer close, and the SSE and socket buffer limits\n\n* feat(ai-harness): the active agent lives in the log and answers when the router picks nothing; routing.strategy 'handoff' becomes routing.after 'main'\n\n* feat(ai-harness, ai-mcp): waits at the boundary (permissions, the question tool, step.ask), live MCP and sign-in waits, and background runs that suspend and resume\n\n* feat(ai-harness): ctx.harness.handoff, a handoff tool, and one handoff path for code, tool, and router, with the target answering in the same turn\n\n* feat(ai-harness): hand a turn to a person through a human wait, operator replies with as: 'operator', and run.handoff for the main model's tools\n\n* feat(ai, ai-harness, ai-mcp, ai-acp, ai-harness-cli): agent runs pause on boundary approvals through SubagentBinding.interrupts, and every transport uses one wait shape\n\n* test(ai-mcp): the media result has a waits list\n\n* feat(ai-harness): handing a turn to a person is opt-in with routing.humans, and an operator reply shows live in the view\n\n* test(e2e): an approval asked on one server is answered on another, and an unanswered wait expires\n\n* test(e2e): handoffs to an agent and to a person, and a transfer between harnesses that is safe to retry\n\n* docs(ai-harness): hand off a conversation to an agent, to a person, or to another harness\n\n* docs(ai, ai-harness, ai-mcp, ai-acp, ai-harness-cli): wait for a person, step.ask, approvals at the boundary, background waits, and waits on every transport\n\n* fix(ai-harness): a session that does not own the log shows the waits and interrupts other hosts write\n\n* fix(ai-harness): lint errors in agent waits, step.ask, and permission resources\n\n* feat(ai-harness): the run tree in the log, with RunNode for turns, agents, tools, and commands, and agentRuns read from it\n\n* feat(ai-harness): agent limits and budgets that hold, with queued starts, per-run usage, timeouts, attempts, and a budget code\n\n* test(ai-harness, ai-code-mode): approvals are turn waits answered with resolve, and the device code carries expiresAt\n\n* test(e2e): in acceptEdits mode the write asks before it runs, with its formatter, and a reject writes nothing\n\n* feat(ai-harness): background runs inherit turn plugins, child signals follow their parent, tool-mode children get ctx.harness and share the turn budget, and ctx.harness.state shares state by key\n\n* feat(ai-harness): durable agent groups with a concurrency gate and keyed children, and routed agents that take steers, late joins, and turn hooks\n\n* docs(ai-harness, ai-sandbox, ai-sandbox-local-process): run the coding tools for many threads, with workspaces per thread, jobs, moving threads between hosts, and snapshots in the log\n\n* feat(ai-harness): ownership.hostId pins threads that use a local folder to their host, with E2E specs for env, roots, moving a sandbox thread, stranded, and pinning\n\n* docs(ai-harness): agents from code, groups, limits, budgets, the run tree, shared state, and routed agents\n\n* feat(ai-harness): harnessAgent runs as a child session in the root log, for the parent's user and keys, with usage, budget, waits, and events in the parent run\n\n* docs(ai-harness): the harnessAgent child run, as built\n\n* test(e2e): agent groups with a concurrency gate, a run budget, shared state, and a harnessAgent child run\n\n* test(ai-harness): give polled checks and a takeover deadline room for slower CI coverage runs\n\n* test(e2e): the handoff route reads view text by message role\n\n* feat(ai-harness): run tags on every event frame, ctx.model.chat for plugins, and usage by source\n\n* chore(ai-harness): allow the ps binary in knip, and give polled checks room for slower CI coverage runs\n\n* feat(ai-harness): lifecycle events, counted router and transfer model calls, tracing with span links, and onOperation reports\n\n* test(ai-harness): one threadId in the expected gap frame\n\n* docs(ai-harness): the harness protocol page, keeping the stream open, stopping a turn from useChat, and the changesets for reporting and observability\n\n* docs(ai-harness): run tags and the gap reload in the custom UI page\n\n* test(e2e): the wire, the gap, the run tree in one stream, lifecycle events, tracing, remote status, cancel from another host, and an unsupported version\n\n* chore(changeset): the integration changes for mcp, acp, code mode, skills, and harnessText\n\n* test(e2e): the first-party fixtures match the context prompt that now comes after the user message\n\n* fix(ai-harness-cli): serve signs media URLs with a key derived from the token, so a short token meets the 32-byte key rule\n\n* fix(ai-harness, ai-mcp, ai-acp, ai-code-mode): final review fixes for durability, access, plugins, transports, integrations, and coding tools\n\n* test(ai-harness): give polled checks room for slower CI coverage runs\n\n* fix(ai-acp): one agent app serves one connection, with editor capabilities read from that connection, and no private SDK field\n\n* fix(ai-harness): a thread delete ends it in first-party plugins, the bash spill is scrubbed, removed schedules go at once, agent run receipts resolve, and session.append takes one object with an optional inputId\n\n* refactor(ai-harness, ai-mcp, ai-harness-cli): session, client, and view methods take one object, the client and view use putMedia and client.sessions, and internal fields leave the public types\n\n* docs(ai-harness, ai-mcp, ai-acp, ai-code-mode): the final review changes, the fixed durable-tools and server-tools text, and a known limits section\n\n* refactor(ai-harness, ai-harness-cli, ai-mcp): remove what the redesign replaced\n\n- The purge no longer deletes the old usage and revert metadata rows. The\n log keeps both, and deleteLog removes them.\n- The snapshot parser drops its branches for older snapshot shapes. A\n snapshot with a missing field is not used, so the fold starts again.\n InputState.seq and LogState.transcriptSeq are required.\n- A root turn tracks its running tools only with harness.tool.started. It\n no longer also writes pendingTools to the run checkpoint.\n- SessionSnapshot.pendingWaits is required, so the \"?? []\" fallbacks go.\n- HarnessSession hides scrubError, takeOver, scheduleRun, and loggedRun.\n- Remove the unused traceparentOf and formatOnWrite, the --dashboard test,\n and old lease and metadata wording. leases.test.ts is now recovery.test.ts.\n- Docs, skills, and changesets describe the end state: snapshots in the\n log, not a metadata checkpoint. Changesets that told the history of\n unreleased code are removed or folded into the main ones.\n\n* docs(ai-harness): read pendingWaits with no fallback in the code samples\n\n* test(ai-harness): name projectFormatters in its describe, and drop old lease and run store wording\n\n* test(ai-harness): a snapshot with usage totals that have no bySource is not used, and skip a load-flaky revert test\n\n* chore(changeset): fold the LogStore heartbeat changeset into the session stores one, and drop history wording\n\n* test(ai-harness): run the tests that were skipped as flaky again, now that the CI-flaky oauth test is fixed\n\n---------\n\nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\n\n* test(ai-harness): a second host's plugin state does not stop the owner's turn (from #1810)\n\n* docs(ai-harness): match the code on who answers a human wait, send to another host's run, and stores.log\n\n* feat(ai-harness): client.sessions.share and unshare, and export the HarnessErrorCode type\n\nclient.sessions gets share({ threadId, userId, role }) and unshare({ threadId, userId }).\nBoth use the POST sessions ops that the handler already has, and resolve to the\nchanged entry. A missing thread throws, as rename does. HarnessErrorCode, the type\nof HarnessProtocolError.code, comes from the main, /client, and /server entries.\n\n* feat(ai-harness): add a handoff note to the transcript for router and code handoffs\n\nThe target of a router or code handoff now gets a handoff tool call and\nits result in the transcript, before it answers. With routing.handoffs\nfalse, it gets one assistant note. The ids come from the turn input, so\na run of the turn on the next host keeps each note once.\n\nai-persistence: a routed answer that waits for an approval keeps its own\nmessage on resume when a finished tool call comes before it.\n\n* feat(ai-harness): session.jobs() lists the background jobs that did not end\n\nA harness.job start now has at and label (the command or the tool name). The fold\nkeeps the backend id, who moved the call, when it started, and the label, and it\nstill folds the old records and snapshots. session.jobs() and jobs() of a\nhost.observe view read the fold of the thread and its child threads. JobInfo.running\nis true for a job that this host runs.\n\n* feat(ai-harness): accept onModelError as data that the log keeps\n\nAn agent start takes onModelError: { retries: 1 | 2, transientOnly? }.\nThe run node keeps it, so a host that takes the run over or resumes it\nretries too. The function form stays, live only, with its warning.\n\n* feat(ai-harness, ai, ai-persistence): an agent tool waits with the turn\n\nAn agent that the main model calls as a tool can now wait. Its\napprovals, questions, sign-ins, app interrupts, client tools, and\nstep.ask questions are waits of the turn. After the resolve, on any\nhost, the agent goes on from where it stopped.\n\n- The turn keeps the agent cards of a turn with agents, as a client\n does, and keeps only the messages of the turn in the record.\n- PendingWait gets agent and subagentRunId.\n- ctx.harness.step of an agent tool is durable. step.ask stops the\n agent, and the answer is a step in the log.\n- Core: an agent run that throws an input request stops as suspended.\n- Persistence: the parent run does not check the answers of a child.\n- durability.agentToolWaits: false keeps the old refusal.\n\n* feat(ai-harness): every host and host.observe see the waits of a harnessAgent child\n\nThe child writes its waits to its own thread in the log of the root. The snapshot\nof a root session and of a host.observe view now reads them from the fold of each\nchild thread whose run did not end. The live children of the owner win over the\nlog, so the owner lists each wait once. An answer on another host is offered to\nthe owner, which gives it to the child.\n\n* feat(ai-harness): resume background agents of the model after a host stop\n\nA child that the model starts with background: true now starts as a run\nwith resume: true. The next host continues it with the same\nsubagentRunId, so the id that the model got stays valid.\ndurability.resumeBackgroundAgents: false fails it as before.\n\n* docs(ai-harness): an agent tool waits with the turn\n\n- subagents: a new section, \"When an agent tool waits\", with step.ask\n in agent code and the known limits.\n- permissions, waits, durable-tools: an agent tool asks and waits as\n the turn does.\n- test: an agent that a router picks waits too.\n\n* feat(ai-harness): start a queued top-level agent start on the next host\n\nRecovery no longer refuses a top-level agent start that waited for a\nmaxConcurrent slot when its host stopped. The next host starts it with\nthe run id of its queued node, so the receipt stays valid, and it waits\nfor a slot again in log order. A start whose cancel reached the log\nsettles aborted.\n\n* fix…\n\n* fix(ai-harness-cli): give the ui view every session method\n\nattachingSource() forwarded 12 of the 21 SessionViewSource members, so in a\ncustom ui view loadAgent() did nothing, putMedia() rejected, and\nupdateThreadSettings, reset, revert, unrevert, continueWithoutMessage,\ncancelInput, and changeInputDelivery showed an error notice.\n\nForward every member. Required makes a missing member a\ntype error.\n\n* fix(ai-harness): read session view approvals in permissions()\n\nA session view answers an approval with the core resolution\n{ approved, payload?, editedArgs? }. permissions() knew only true/false, a\nstring, or { answer, message }, so the schema refused the resume and the\nturn failed, and readApproval() read a yes as a reject and dropped the\nreject message.\n\nThe approval schema and readApproval() now accept the view shape: a yes is\nthe answer its payload names (or once), a no rejects with the payload as the\nmessage. A yes with editedArgs rejects: this approval cannot apply edited\narguments, and the model's original call is not what the user approved.\n\n* test(e2e): answer a harness approval with the session view shape\n\nThe approval scenario of harness-waits also runs with the answer that a\nsession view sends, { approved: true, payload: 'always' }, and checks that\ndeploy runs.\n\n* feat(ai): pass a debug option to the model calls of child agents\n\nSubagentBinding gets debug?: DebugOption. The bound activities of a child use\nit when a call sets no debug of its own, and nested children inherit it, so\na host can send the logs of child agents to its own logger.\n\n* feat(ai-harness): send harness warnings and errors to a host logger\n\ncreateHarnessHost({ logger }) takes a Logger from @tanstack/ai (default\nConsoleLogger). Every console.warn and console.error of the harness goes\nthrough it, plugins get it as ctx.logger, and the model calls of a session\nsend their errors to it. A logger that throws or rejects cannot break the\nharness.\n\n* feat(ai-harness): PermissionCallCapability for tool calls that a plugin runs\n\npermissions() provides PermissionCallCapability: the same decision as for a\ndirect tool call (allow, deny, or ask with the approval question and schema),\nand settle() reads the answer and saves an 'always' rule. The guard and the\nturn boundary share this decision.\n\n* feat(ai-harness): child agents log through the host logger\n\nThe subagent binding of a session gets the errors-only debug option with the\nhost logger, so a failed model call of a child agent goes to the host logger\nand not to the console.\n\n* feat(ai-harness): FileChanged events with a unified diff from the coding tools\n\nwrite_file, edit_file, and patch send a FileChanged plugin event after the\nwrite hooks: the path, the kind of change, a git-style unified patch, and the\ncounts. A new unifiedDiff() in utils.ts makes the patch (Myers with a cap,\nno dependency). Binary files, files over 1 MiB, patches over 256 KiB, .env\nfiles, and files that the permission rules protect get no patch.\n\n* feat(ai-sandbox-docker): copy a localSource folder into the container\n\ndockerSandbox().create() with a localSource(dir) workspace now copies the\nfolder into the work dir: the files that git lists (tracked, and untracked\nthat .gitignore keeps, with their uncommitted changes) in one tar stream\nthrough putArchive, and the current branch as a git bundle, so git status\nin the container matches the host. A git worktree works. The folder must be\na full (not shallow) git repository, and the image needs git. A failed copy\nremoves the container. Fork, restore, and resume do not copy.\n\n* feat(ai-code-mode): code mode runs the coding tools under the permission rules\n\ncodeMode({ include }) can now move a tool that has permission checks, like\nthe harness coding tools. Each call inside a program gets the same decision\nas a direct call through PermissionCallCapability: allow runs, deny throws in\nthe program, ask waits for the user (a step.ask question with the approval\nschema) and applies the answer. Each checked call is a step.do, so a host\nstop while a program waits does not run finished calls again. The program\ntimeout defaults to 10 minutes when a checked tool moves.\n\nThe new directCalls option ('remove' | 'keep', also a session setting) keeps\na moved tool in the model's tool list too.\n\n* feat(ai-computer-use, ai-harness): computerUse() harness plugin in @tanstack/ai-computer-use/harness (#1844)\n\n* feat(ai-computer-use, ai-harness): computerUse() harness plugin\n\nScreenshots go to the media store of the session. The model gets only the\nnewest screenshots. OpenAI safety checks ask through permissions().\nPlugins can store media with ctx.session.putMedia.\n\n* docs(harness): give your agent a computer\n\n* feat(ai-computer-use): plan mode refuses the computer tool\n\n* feat(ai-mcp, ai-code-mode): plugin warnings go to the host logger\n\nmcp() warns about duplicate tool names, and codeMode() about tools that\ninclude cannot move, through ctx.logger instead of console.warn.\n\n* docs(harness, sandbox): copy a local folder into a Docker sandbox\n\nA new subsection in Run the tools in a sandbox shows localSource() with\ndockerSandbox(), and the Docker provider docs describe the copy.\n\n* test(e2e): a code mode program edits a file after an approval\n\nA code-mode-edit scenario: a scripted isolate program reads notes.txt with\nno question, then its edit_file call waits for the user's approval, and runs\nafter the answer once.\n\n* feat(ai-harness): snapshots() sends FileChanged for the files of bash\n\nAt the end of each model step, snapshots() sends FileChanged for the changed\nfiles that the workspace tools did not report, like the files that bash\nwrote: one git diff for the step, split per file, with the same caps, and at\nmost 100 events for each step.\n\n* test(e2e): FileChanged for a write_file edit and a bash write\n\nA coding-diffs scenario collects the FileChanged events of a turn: write_file\nupdates a.txt (patch -one +two), and snapshots() reports b.txt that bash\ncreated (+hi).\n\n* docs(harness): show live diffs, and answer permissions() approvals from a view\n\ncustom-ui gets a Show live diffs section with view.on(FileChanged), and the\napprove and reject options for a permissions() approval. snapshots and\ncoding-workspaces describe the FileChanged events of snapshots(). The\nFileChange comment names which limits the tools and snapshots() apply.\n\n* docs(harness): run the coding tools in a code mode program\n\ncode-mode gets Run the coding tools in a program (setup, allow/deny/ask,\nthe approval question, time limits, host stops) and Keep direct calls\n(directCalls). permissions documents PermissionCallCapability, and\ncoding-tools and waits name code mode where a call can ask while it runs.\n\n* fix(ai-code-mode): write the aroundCalls hook type inline\n\nThe build of @tanstack/ai-code-mode-snippets failed with TS2883: the\ninferred type of createCodeModeWithSnippetsConfig named CodeModeCallHook,\nwhich the package index does not export. The aroundCalls option now writes\nthe hook type out, and CodeModeCallHook is derived from it.\n\n* feat(ai-harness, ai-skills): host plugins get the host logger\n\nHostPluginContext gets logger, the host logger, so a lifetime 'host' plugin\ncan warn without a session. skills() sends its shared-folder warnings there\ninstead of console.warn.\n\n* docs(harness): send the harness warnings to your own logger\n\nhost-options gets Send the warnings to your own logger (a file logger for a\nterminal UI, pino for a server), plugins gets Write warnings to the host\nlogger, and mcp names the host logger for the duplicate-tool warning. The\nlogger example in host.ts sets pino's errorKey. docs/config.json dates the\npages that this work changed.\n\n* fix: one @google/genai for ai-vertex and ai-gemini in the lockfile\n\nAfter the merge of main, ai-vertex resolved @google/genai with the zod@4.6.5\npeer and ai-gemini with zod@4.3.6, so pnpm made two copies. The vi.mock of\n@google/genai in the ai-vertex tests then missed the copy that ai-gemini\nuses, and 2 factory tests failed. ai-vertex now uses the zod@4.3.6 variant,\nas on main; the two unused variant entries are gone. pnpm install\n--frozen-lockfile accepts the lockfile.\n\n* fix(ai-harness): link a permissions() approval in the view to its tool call\n\nA permissions() approval is a generic interrupt: its tool call id is only in\nits payload. The view looked the call up by interrupt.toolCallId, found\nnone, and showed the question text as the tool, with no args. The view now\ntakes the tool call id from the payload, so the approval has the tool name,\nthe args, and the toolCallId of its call.\n\n* refactor(ai-harness, ai-client): drop fallbacks for the now-required threadId and runId\n\nthreadId is required on TextOptions and runContext ids are required in 1.0.\nharnessText, artifactText, and the tool-turn adapter read threadId as is.\nThe connect wrapper and buildRunAgentInputBody stop guarding runContext ids,\nso requireSyntheticId, generateRunId, and the catch around the synthetic\nRUN_ERROR go.\n\n* chore: release ai-harness and ai-harness-cli as 1.0.0 with the rest\n\n* fix(ai-harness): view.ready settles when the session closes during its first load\n\nA closed session handle throws at once from describe(), snapshot(), and\ntranscript(). The first load called them inside Promise.resolve(...), so\nthe throw escaped the .catch, and view.ready rejected with no handler.\npromiseOf() turns the throw into a rejection: the view shows the error as\na notice, and ready resolves, as for any other failed read.\n\n* fix(ai-sandbox-docker): resume gives null only for a missing container\n\nresume() turned every inspect error into null, so a stopped Docker looked\nlike a deleted container, and the harness said the workspace is gone. Now\nonly a 404 is null. Any other error goes to the caller.\n\n* fix(ai-harness): undo, redo, and revert send FileChanged for the files they put back\n\nsnapshots() restored files with git for /undo, /redo, revert, and\nunrevert, and sent no FileChanged. So a live diff, or a sandbox that\nmirrors the files to the user's folder, never saw the restore.\n\nEach restore now takes a snapshot after it, and sends one FileChanged per\nchanged file, built by the same code as the end-of-step events (sendChanges).\n/undo and /redo take a snapshot before the restore too, so a user edit to\nanother file sends no event. .env files stay out. The docs, the changeset,\nand the coding-tools E2E route and spec cover it.\n\n* fix(ai-harness): keep the user message of a turn that stops before its first model call\n\nA turn counts as started when its applied record is in the log, but the\nfirst chat() call saves the user message. A recoverable close or a crash in\nbetween left no message in the transcript, and recovery ran the turn again\nwith sentMessage only, so the model got messages: []. A turn that had added\na note was also settled as completed, because its note looked like an\nanswer.\n\nThe user message now has a fixed id, inputMessageId(inputId), also for a\nheld message. Recovery checks if the transcript has the message. If not, the\nturn adds it, once. A note no longer counts as an answer before the message\nis saved.\n\n* test(ai-harness): give the inner-failure harnessText test a threadId\n\nthreadId is required since 9d999ebdc, and the as never cast hid that the\ntest did not pass one. host.open refused the thread \"undefined/inner/...\"\nbefore the turn ran.\n\n* fix(ai-harness): do not run a no-user input as the session owner\n\nAn offered or recovered input that names no user kept that absence.\nA host with access refuses it. A direct send with no user still\nuses the user that opened the session.\n\n* fix(ai-harness): a forwarded command ends with the owner's result or error (#1872)\n\n* fix(ai-harness): a forwarded command ends with the owner's result or error\n\nA command that reaches a host that does not own the thread now waits for\nthe owner to settle it. It resolves with the owner's result, fails when the\ncommand throws, and rejects with InputRejectedError when the owner refuses\nit (unknown_command, invalid_input). Before, it completed with undefined.\n\nCloses #1796\n\n* fix(ai): resume a nested subagent that waits, under a child loader\n\nA child resumes from its stored pending messages. The store keeps a nested\nchild in its own thread, so those messages had no card for it, and the\nnested child ran again from the start. Keep the nested cards from the\nclient's copy on the stored message of their parent tool call.\n\nAlso update the harnessText test for the required threadId: one session per\nthread.\n\n* test: drop the nested-card stopgap, skip its test until #1878, add a twin to the chat-only conformance\n\nThe stopgap in spawn.ts copied nested subagent cards from the client, which\ntrusts the client's messages for a nested child. #1878 fixes the nested\nresume from the store. Until then, skip the subagent-waits test that needs it.\n\nThe chat-only conformance test from main had no twin. On this branch\nmemoryPersistence has a log store, so the log-across-instances cases need one.\n\n* fix(ai-persistence): check a durable resume after the whole onConfig chain\n\nA tool that a middleware adds in onConfig can ask for approval, but the\nresolve failed with \"Tool is unavailable for interrupt\". withPersistence\nchecked the resume in its own onConfig, before later middleware added tools.\nNow chat() runs the check after the onConfig chain, against the final tools.\n\n* fix(ai-harness): run the harness middleware on ctx.model.chat calls\n\nA plugin model call (title(), a judge, the router) ran only the usage\ncounter, so app middleware for cost, traces or limits never saw it. The\ncall now runs the harness middleware too, with the run in ctx.context.run.\n\n* fix(ai-compaction): add a middleware option to conversationSummarizer\n\nThe summary call ran only its own usage count, so app middleware for cost or\ntraces never saw it. The new middleware option runs after that count.\n\n* fix(ai-compaction): drop a background summary that another model prepared\n\nA summary prepared on a model A turn was applied on a model B turn. The ready\nsummary now keeps its model, and a call on another model drops it as stale.\n\n* fix(ai-harness): run the continuation of a recovered resolve\n\nA host that stopped in the model call after a resolve left its interrupts\nused up. The host that recovered the thread then settled the resolve\ncompleted, but it never called the model, so the turn had no answer.\n\nNow a used-up resume with no final answer runs again like a stopped chat\nturn: the transcript is repaired, a cut answer can continue, and the model\ngets the tool result.\n\n* fix(ai-harness): keep the text that a cancelled turn streamed\n\nA cancel cut the answer, and the transcript kept none of it. The next\nmodel call then got two user messages in a row.\n\nNow the text that the model streamed before the cancel goes in the\ntranscript as an assistant message. An answer that is saved already is\nnot added again.\n\n* fix(ai-harness): end the text message and the run of a cancelled turn\n\nA cancelled turn sent RUN_STARTED and TEXT_MESSAGE_START, but no\nTEXT_MESSAGE_END and no run end. A client saw an open message and an\nopen run until harness.operation.finished.\n\nNow a stopped turn ends its open text message. A cancel then sends\nRUN_FINISHED with outcome cancelled, as an agent run does. A turn past\nits time limit sends RUN_ERROR with code timeout.\n\n* fix(ai-harness): show idle in host.events() after a turn that a steer joined\n\nA steer that joined a turn ends a tick after that turn. The host read the\nsnapshot at harness.operation.finished, saw the steer as still active, and\nkept the status running.\n\nNow the snapshot leaves out a joined steer whose turn ended.\n\n* fix(ai-anthropic): move outputSchema keywords that Anthropic rejects into the description\n\n* fix(ai-anthropic): report the 1-hour part of a cache write as cacheWrite1hTokens\n\n* fix(ai-anthropic): warn once when chat({ reasoning }) is ignored for a model missing from the reasoning table\n\n* fix(ai-anthropic): also move an outputSchema not into the description\n\n* fix(openai-base): drop msg_ and fc_ item ids on replay of a message with no reasoning item\n\n* fix(ai-cloudflare): keep the reply when the usage trailer has no choices in any SSE form\n\n* fix(ai): put the model text on a schema failure, and give a non-JSON answer the parse-failed code\n\n* fix(ai-client): send addToolResult through the generic interrupt when the tool schemas differ\n\n* fix(ai-persistence): check \"not due yet\" on a live log so slow stores pass the log ownership cases\n\n* feat(ai-sandbox): let each sandbox file call take an abort signal\n\nSandboxFs methods take an optional last argument { signal }. bootstrapWorkspace gives its signal to its file calls. E2B and local process give the signal to the native call. The other providers check it before the call.\n\n* feat(ai-harness): add a beforeWrite workspace hook that can refuse a write\n\nwrite_file, edit_file and patch run the beforeWrite hooks before they change a file. A hook that returns { refuse } fails the call, and no file changes. A patch asks for each file before its first write.\n\n* fix(ai-harness): the duplicate-input check ignores the key order of the stored input\n\n* fix(ai-harness): a steer that can't join another sender's turn gets a queued receipt for its own operation\n\n* feat(ai-harness): harness.input.accepted carries the input's user message\n\n* feat(ai-harness): TurnInfo names the model and the attempt, and a snapshot has the saved state of a turn plugin\n\n* feat(ai-harness): TurnInfo.sender names who sent the input, also the user who resolved\n\n* fix(ai-harness): the log keeps the name of a sender, not only its id and tenant\n\n* fix(ai-harness): the run hydration carries the pending waits, so a reload during a step.ask question keeps it\n\n* feat(ai-harness): a host.observe view reads how an input ended with settled()\n\n* docs(ai-harness): idle in a snapshot means no turn runs on this host, not that the thread is free\n\n* feat(ai-harness): export the abort reasons SHUTDOWN_REASON, RUN_CANCEL_REASON, and BUDGET_REASON\n\n* feat(ai-harness, ai-client): export HARNESS_EVENTS from ./client, and the chat hydrate types from ai-client\n\n* feat(ai-harness): subagents.background false keeps the background field off the agent tools\n\n* feat(ai-harness): media.urlTtlMs sets how long a signed media URL works\n\n* chore: changeset for the fifth findings list fixes\n\n* fix(ai-harness): keep the sender on an old sign-in wait\n\nAn interrupted record from before senders were stored takes the user from\nthe input of that run. Two harnessText calls on one outer thread share one\ninner thread.\n\n* fix(ai, ai-persistence): resume a waiting nested subagent from the store (#1879)\n\n* fix(ai, ai-persistence): resume a waiting nested subagent from the store\n\nA nested child that waits on an interrupt ran again from its prompt under\nwithPersistence. The store keeps a nested child in its own transcript, so the\nstored pending of the outer child had no card for it.\n\nCore now rebuilds each nested card from the store and takes only the id from\nthe client card. LoadChild takes an optional parentSubagentRunId, and returns\ninterruptIds and parentToolCallId.\n\nCloses #1878\n\n* test(ai-harness): run the nested wait test again (#1878)\n\n* fix(ai-harness): define sender in applyConfig after the main merge\n\n---------\n\nCo-authored-by: Alem Tuzlak \nCo-authored-by: Alem Tuzlak \nCo-authored-by: Jack Herrington \nCo-authored-by: Claude Opus 5.5 (1M context) \nCo-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>\nCo-authored-by: Patrick L \nCo-authored-by: Chris Trześniewski \nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>","headSha","ac57fcaa96cfa87643e3062e55b0f74843f94918","baseSha","parentShas","commitLink","https://github.com/TanStack/ai/pull/1743","author","Tom Beckenham","authorEmail","34339192+tombeckenham@users.noreply.github.com","authorUrl","https://github.com/tombeckenham","authorAvatarUrl","https://github.com/tombeckenham.png","repositoryUrl","https://github.com/TanStack/ai","platformName","GITHUB_ACTIONS","runnerProvider","isFork","isDraft",{"_213":214,"_18":215,"_75":216,"_84":217,"_218":219,"_73":79,"_220":-5,"_221":25,"_222":-5,"_223":-5,"_224":-5,"_225":226,"_227":25,"_228":229,"_230":14,"_231":499,"_233":234,"_235":236,"_237":-5,"_238":239,"_240":500,"_242":243,"_244":-5,"_245":14,"_246":247,"_248":249,"_250":249,"_251":252,"_253":14},[],{},"orgId","templatePreset","installationSource","vcs-repository",{"_541":542,"_543":544,"_545":546,"_120":121},"idAccessLevel","READ_ONLY","patAccessLevel","showDteTerminalOutput","workspaceProfile","FULL_FEATURED","nxInitDate",["D",1764281558914],["D",1764281558914],"claimedAt",["D",1764281558914],"retryFlakyTasks","flakyTaskConfiguration",{"_537":538,"_539":540},"showVcsStatusChecks","enableWorkspaceDataCaching","defaultBranch","main","aiTaskFixingConfiguration",{"_86":14,"_350":25,"_351":14},"remoteSourceIntegrationType","GITHUB_EVENTLESS","visibility","ALLOW_UNAUTHENTICATED","cacheIsolation","STRICT","resourceUsageConfiguration",{"_535":14,"_536":25},"launchTemplate","nonDteEnabled","dteEnabled","threshold","AGGRESSIVE","samplePeriodDays",28,"repositoryFullName","TanStack/ai","repositoryVisibility","PUBLIC","repositoryId","1072429861","currentUser","currentHostname","cloud.nx.app","incident",["P",551],"notifications",["P",553],"showLearnNote",["P",555],"announcements",["P",557],"hasAnnouncements","isSystemAdmin","isSingleTenant","isPATExpiryAfterLoginEnabled","isOrganizationAccessEnabled","isUserVcsIntegrationEnabled","isExecutiveReportDisabled","loginas","repositoryAccessProvidersToOffer",[],"redirectTo","/cipes/6ada13fe8475d7a9410dfded?runGroup=39785377070-3","deferredUserOrganizations",["P",571],"sidebarCollapsed","toast","currentUserId","currentUserEmail","signedInUser","isImpersonating","isBotRequest","ENV",{"_657":25,"_43":14,"_658":25,"_659":25,"_660":25,"_661":662,"_663":664,"_665":666,"_667":14,"_668":669,"_670":671,"_584":672},"posthogBootstrap",{"_614":615,"_616":617},"ultracacheUiEnabled","pylon",{"_606":607,"_608":609,"_81":610,"_611":-7,"_612":613},"requestInfo",{"_588":589,"_590":42,"_591":592,"_593":594,"_595":596},"hints",{"_599":602,"_604":605},"origin","path","/cipes/6ada13fe8475d7a9410dfded","url","https://cloud.nx.app/cipes/6ada13fe8475d7a9410dfded","userPreferences",{"_597":598},"theme",{"_81":247,"_599":600,"_601":602,"_603":602},"variant","system","resolvedVariant","light","clientColorScheme","timeZone","UTC","appId","a1074fe2-8172-4ebd-9889-879f8308a0a2","email","123f7976-c140-43eb-a0e7-1d9ff8f0a1bd@nxcloud.invalid","Anonymous Nx Cloud Visitor","avatarUrl","emailHash","6b96565b26525b9db19c6d1f8a7e99ab394907e4fb7c8a172c81e9f5941178c7","distinctID","123f7976-c140-43eb-a0e7-1d9ff8f0a1bd","featureFlags",{"_618":14,"_619":14,"_620":14,"_621":14,"_622":14,"_623":14,"_624":14,"_625":14,"_626":14,"_627":14,"_628":14,"_629":14,"_630":14,"_631":14,"_632":14,"_633":14,"_634":14,"_635":14,"_636":14,"_637":14,"_638":14,"_639":14,"_640":14,"_641":14,"_642":25,"_643":25,"_644":25,"_645":25,"_646":25,"_647":25,"_648":25,"_649":25,"_650":25,"_651":652,"_653":25,"_654":25,"_655":25,"_656":25},"cipe_execution_timeline","cnw_empty_workspace_position","custom_workflows_results","dedicated_compute_enablement_allowed","demo-mode","enable_sandboxing_analytics","feature_activation_guide","get_started_options_experiment","managed_ci_executions","new_layout","onboarding-path-time-estimates","onboarding_templates","one_page_connect_workspace","one_page_connect_workspace_github","one_page_connect_workspace_gitlab","one_page_connect_workspace_manual","organization-analytics","private_networking_add_on","team_ownership","ultracache_ui_organization","workspace_env_var_management","run_details_polling","task_artifacts_viewer","workspace_packing_budgets_toggle","automated_add_ons","config_yaml","new_access_control","pylon_chat","non_dte_resource_usage","resource_addon_default","resource_usage_toggle","show_setup_self_healing_ci_alert","teams_minimum_spend","welcome_view_cnw_experiment","variant-2","workspace_badges","workspace_continuous_assignment_toggle","workspace_rewind","workspace_sandboxing_toggle","isProduction","isAnalyticsEnabled","isPosthogEnabled","isPylonEnabled","privateCloud",{"_705":682,"_41":42},"auth0",{"_699":700,"_701":702,"_703":704},"github",{"_685":686,"_687":688,"_689":690,"_691":692,"_693":694,"_695":696,"_697":698},"e2eTestMode","rollbar",{"_677":678,"_679":680,"_86":25,"_681":682,"_683":25,"_684":25},"posthog",{"_673":674,"_675":676},{"_606":607},"apiKey","phc_eTmACxF0EKeNRjAZbfpdszbHYumyKhWqsIpMU4Wi53c","apiHost","https://pha-prx.ops.cloud.nx.app","accessToken","d0e4070ed1d54ed29429808f497ffbab3e77f1c74c2a9427fa5c5e418eea62ca96294bc716a7e8210acf93f0d37b6d29","environment","production","codeVersion","2610.30.0011","captureUncaught","captureUnhandledRejections","baseUrl","https://github.com","hostname","github.com","appUrl","https://github.com/marketplace/official-nx-cloud-app","appInstallUrl","https://github.com/apps/nx-cloud/installations/new","appManageAccessUrl","https://github.com/apps/nx-cloud/installations/select_target","createPersonalAccessTokenUrl","https://github.com/settings/tokens/new?scopes=repo","createRepositoryUrl","https://github.com/new","domain","auth.nx.app","clientId","Ron6k221B4IaH0QK9hmHuCneTovLLPpX","audience","https://api.nrwl.io/","containerVersionTimestamp"]