Changelog

All notable changes to AgentHarness will be documented in this file.

The project follows Semantic Versioning. It has not yet published a stable public API.

Unreleased

Pi session adapter for pi --mode rpc, speaking pi's JSONL command and event protocol over stdio.
Pi provider options for tool allow and deny lists, thinking level, extensions, resume, fork, ephemeral sessions, session storage, and agent_dir isolation.
Questions from Pi, raised through its extension UI sub-protocol as confirm, select, input, and editor dialogs.
Native Pi skills through --skill.
Subscription auth for Pi, which rejects credential-shaped session env entries and confirms the selected provider holds an OAuth credential without reading the token.
Pi capability reporting for approvals, per_session_mcp, and steer, all unsupported. A session that sets mcp_servers, approval_policy, or sandbox is rejected at start_session/2 instead of opened with those settings dropped.
Recorded pi --mode rpc fixtures that the normalizer and session tests replay, and live tests behind the live tag.

Supervised Codex CLI and Claude Code session adapters.
Ordered session and turn event subscriptions, replay, streams, and await.
Structured questions, approvals, MCP elicitation, cancellation, and terminal outcomes.
Per-session MCP, skills, authentication, model, sandbox, and provider configuration.
Store behaviour with an in-memory implementation, inventory, guarded purge, explicit ID replacement, and durability policy.
Session monitoring and Telemetry lifecycle events for orchestrators.
Configurable lifecycle deadlines and supervisor capacity limits.
Owner-bound startup guardians for provider runtimes that ignore readiness cancellation.
A configurable completed-turn cache that bounds hot Turn, terminal-event, and request retention while preserving Store-backed cold lookup.
A bounded provider-command state machine with exactly-once response claims, local cancellation admission, and provider-command Telemetry spans.

Provider and session startup handshakes no longer serialize independent session creation.
Provider opening and initial Store finalization have separate phase-aware deadlines; partial new aggregates are rolled back without burning their ID.
Turn admission is asynchronous and preserves a stable turn handle across a local call timeout.
Store failures now follow an explicit degrade or fail-stop policy.
Turn replay is indexed by turn and reports when a completed turn's terminal replay is unavailable.
Graceful application shutdown closes sessions before provider infrastructure.
Provider-open and turn-admission tasks now share the owning SessionServer's lifecycle, and startup readiness uses an acknowledged caller handoff.
Pending startup attempts remain explicitly marked in Store until the two-way readiness acknowledgement, so a hard kill cannot burn a logical session ID.

General calls no longer report :ok when a SessionServer exits normally.
Live Store deletion is rejected instead of crashing the active session.
Consumers can monitor session death without blocking a GenServer callback.
Invalid approval scopes are rejected at both construction and response boundaries.
Provider-admission timeouts and crashes retire uncertain sessions instead of exposing them as reusable idle conversations.
Provider response and cancellation callbacks no longer block the SessionServer; uncertain acknowledgement retires the session.
Live session inventory reads Registry metadata without waiting on each SessionServer mailbox.
Transport loss reported during provider opening can no longer be overwritten by a late successful return.
Provider loss and terminal messages received during turn admission preserve their causal ordering.
Graceful shutdown expires pending requests and records an interrupted turn before the final session-closed event.
Generated Claude skill plugins are removed when startup is killed before ownership can transfer to the provider runtime.