refactor: unify skill loading and host-owned harness state

.github/workflows/ci.yml

@@ -220,6 +220,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install kernel snapshot dependency
+        run: python -m pip install dill==0.4.1
       - run: cargo test --workspace --jobs 1
 
   fmt:

apps/tui/lib/coding-agent/src/core/prompts/rlm.ts

@@ -44,7 +44,7 @@ const REPL_CONTROL_PROMPT = [
 	"",
 	"Python state in the kernel persists across cells: named variables, helper functions, classes, imports, notes, parsed outputs, and helper data structures all remain available in every later turn. Tool calls are themselves Python `await` expressions, so their return values can be bound to variables and composed into program logic just like any other call.",
 	"",
-	"Continual harness state is available as `rlm.harness` and `rlm.get_harness_state()`. CRUD calls are local to this Devo session by default: `rlm.harness.create_memory(...)`, `rlm.harness.update_memory(...)`, `rlm.harness.delete_memory(...)`, `rlm.harness.create_skill(...)`, `rlm.harness.update_skill(...)`, `rlm.harness.delete_skill(...)`, `rlm.harness.create_subagent(...)`, `rlm.harness.update_subagent(...)`, `rlm.harness.delete_subagent(...)`, `rlm.harness.create_prompt_note(...)`, `rlm.harness.update_prompt_note(...)`, `rlm.harness.delete_prompt_note(...)`, plus `rlm.harness.record_refinement(...)` and `rlm.harness.overview()`. Use `global_=True` only for stable cross-session lessons; Python reserves `global`, so literal `global=True` is invalid syntax.",
+	"Continual harness state is available as `rlm.harness` and `rlm.get_harness_state()`. Call `await rlm.harness.load()` to refresh cached reads. Persistent CRUD calls go through the host and are local to this Devo session by default: `await rlm.harness.create_memory(...)`, `await rlm.harness.update_memory(...)`, `await rlm.harness.delete_memory(...)`, `await rlm.harness.create_skill(...)`, `await rlm.harness.update_skill(...)`, `await rlm.harness.delete_skill(...)`, `await rlm.harness.create_subagent(...)`, `await rlm.harness.update_subagent(...)`, `await rlm.harness.delete_subagent(...)`, `await rlm.harness.create_prompt_note(...)`, `await rlm.harness.update_prompt_note(...)`, `await rlm.harness.delete_prompt_note(...)`, plus `await rlm.harness.record_refinement(...)` and `rlm.harness.overview()`. Use `global_=True` only for stable cross-session lessons; Python reserves `global`, so literal `global=True` is invalid syntax.",
 	"",
 	"Terminology: continual harness names the persisted prompt, memory, skill, and subagent layer; RLM names the runtime, Python REPL kernel, and native call interface exposed to the model.",
 	"",

crates/cli/Cargo.toml

@@ -11,6 +11,7 @@ path = "src/main.rs"
 
 [dependencies]
 devo-core = { workspace = true }
+devo-harness = { workspace = true }
 devo-kernel = { workspace = true }
 devo-mcp = { workspace = true }
 devo-protocol = { workspace = true }
@@ -38,4 +39,5 @@ tracing-subscriber = { workspace = true }
 tokio-console = ["devo-arg0/tokio-console"]
 
 [dev-dependencies]
+tempfile = { workspace = true }
 pretty_assertions = "1"

crates/cli/src/prompt_command.rs

@@ -101,12 +101,28 @@ pub(crate) async fn run_prompt(
         })?;
     }
 
+    use devo_core::SkillCatalog;
+    let mut skill_catalog = devo_core::FileSystemSkillCatalog::with_devo_home(
+        app_config.skills.clone(),
+        home_dir.clone(),
+        cwd.clone(),
+        app_config.project_root_markers.clone(),
+    );
+    let python_skills = skill_catalog.python_skills(Some(&cwd))?;
+    session_state.config.available_skills_instructions =
+        skill_catalog.available_skills_instructions(Some(&cwd), None)?;
     let tool_plan = ToolPlanConfig::from_app_config(&app_config);
     let kernel = if app_config.tools.execution_surface == devo_core::ToolExecutionSurface::Rlm {
-        Some(
-            handlers::ensure_kernel(&None, &cwd, None, devo_protocol::CollaborationMode::Build)
-                .await?,
+        let (kernel, _, imports) = handlers::ensure_kernel_with_skills(
+            &None,
+            &cwd,
+            None,
+            devo_protocol::CollaborationMode::Build,
+            &python_skills,
         )
+        .await?;
+        session_state.config.installed_python_skills = imports;
+        Some(kernel)
     } else {
         None
     };

crates/cli/src/prompt_host.rs

@@ -1,3 +1,5 @@
+mod harness;
+
 use std::sync::Arc;
 
 use devo_core::tools::{PermissionChecker, PermissionGrant, ToolCall, ToolContent, ToolRuntime};
@@ -53,6 +55,15 @@ async fn dispatch_host_request(runtime: &ToolRuntime, request_id: String, data:
         return error_reply("host request is missing a type");
     };
 
+    if action.starts_with("harness.") {
+        let (_, params) = devo_kernel::parse_host_request_data(&data);
+        let home = match devo_util_paths::find_devo_home() {
+            Ok(home) => home,
+            Err(error) => return error_reply(error.to_string()),
+        };
+        return harness::handle_harness(runtime, request_id, action, &params, &home).await;
+    }
+
     if matches!(action, "bash.poll" | "bash.kill" | "bash.forget") {
         return runtime.control_host_bash(action, &data);
     }

crates/cli/src/prompt_host/harness.rs

@@ -0,0 +1,226 @@
+//! One-shot CLI adapter to the same host-owned harness operations as the server.
+
+use std::path::Path;
+
+use devo_core::tools::{SandboxPermissionRequest, ToolPermissionRequest, ToolRuntime};
+use devo_harness::{
+    HarnessCommand, HarnessScope, HarnessState, canonical_harness_path, mutate_harness,
+};
+use devo_protocol::CollaborationMode;
+use devo_safety::ResourceKind;
+use serde_json::{Value, json};
+
+use super::error_reply;
+
+pub(super) async fn handle_harness(
+    runtime: &ToolRuntime,
+    request_id: String,
+    action: &str,
+    params: &Value,
+    home: &Path,
+) -> Value {
+    if !params.is_object() {
+        return error_reply("harness request params must be an object");
+    }
+    let operation = action.strip_prefix("harness.").unwrap_or("");
+    let mutation = match operation {
+        "load" => false,
+        "create" | "update" | "upsert" | "delete" | "record_refinement" => true,
+        _ => return error_reply(format!("unknown harness action: {action}")),
+    };
+    let context = runtime.context();
+    if mutation && context.collaboration_mode == CollaborationMode::Plan {
+        return error_reply(format!("denied: {action} blocked in Plan mode"));
+    }
+    let scope: HarnessScope = match params.get("scope") {
+        Some(value) => match serde_json::from_value(value.clone()) {
+            Ok(scope) => scope,
+            Err(error) => return error_reply(format!("invalid harness scope: {error}")),
+        },
+        None => HarnessScope::Local,
+    };
+    let root = match scope {
+        HarnessScope::Local => match context.session_dir.as_deref() {
+            Some(root) => root,
+            None if !mutation => {
+                return json!({"status":"ok", "result": {
+                    "state": HarnessState::default(), "file_path": null, "scope": scope
+                }});
+            }
+            None => {
+                return error_reply(
+                    "This session has no persistent local harness store; pass global_=True to persist across sessions.",
+                );
+            }
+        },
+        HarnessScope::Global => home,
+    };
+    let path = match canonical_harness_path(&HarnessState::file_path(root)) {
+        Ok(path) => path,
+        Err(error) => return error_reply(error.to_string()),
+    };
+    let command = if mutation {
+        let mut input = params.clone();
+        input["op"] = json!(operation);
+        match serde_json::from_value::<HarnessCommand>(input) {
+            Ok(command) => Some(command),
+            Err(error) => return error_reply(format!("invalid {action} request: {error}")),
+        }
+    } else {
+        None
+    };
+    let request = ToolPermissionRequest {
+        tool_call_id: request_id,
+        tool_name: if mutation { "write" } else { "read" }.into(),
+        input: params.clone(),
+        cwd: context.cwd.clone(),
+        session_id: context.session_id,
+        turn_id: context.turn_id,
+        resource: if mutation {
+            ResourceKind::FileWrite
+        } else {
+            ResourceKind::FileRead
+        },
+        action_summary: format!("{action} {}", path.display()),
+        justification: None,
+        path: Some(path.clone()),
+        host: None,
+        target: None,
+        command_prefix: None,
+        command_argv: None,
+        command_pattern: None,
+        sandbox_permissions: SandboxPermissionRequest::Default,
+    };
+    if let Err(error) = runtime.permission_checker().check(request).await {
+        return error_reply(error);
+    }
+    if runtime.cancel_token().is_cancelled() {
+        return error_reply("cancelled");
+    }
+    match tokio::task::spawn_blocking(move || {
+        let mut result = match command {
+            Some(command) => {
+                mutate_harness(&path, scope, command).map_err(|error| error.to_string())?
+            }
+            None => json!({"state": HarnessState::load(&path).map_err(|error| error.to_string())?}),
+        };
+        result["file_path"] = json!(path);
+        result["scope"] = json!(scope);
+        Ok::<_, String>(result)
+    })
+    .await
+    {
+        Ok(Ok(result)) => json!({"status":"ok", "result":result}),
+        Ok(Err(error)) => error_reply(error),
+        Err(error) => error_reply(format!("harness worker failed: {error}")),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use devo_core::tools::{PermissionChecker, ToolRegistry, ToolRuntimeContext};
+    use pretty_assertions::assert_eq;
+    use std::sync::Arc;
+
+    #[tokio::test]
+    async fn cli_local_harness_is_explicitly_ephemeral() {
+        let runtime = ToolRuntime::new_without_permissions(Arc::new(ToolRegistry::new()));
+        assert_eq!(
+            super::super::dispatch_host_request(
+                &runtime,
+                "load".into(),
+                json!({"type":"harness.load"})
+            )
+            .await,
+            json!({"status":"ok", "result":{"state":HarnessState::default(), "file_path":null, "scope":"local"}})
+        );
+        assert_eq!(super::super::dispatch_host_request(&runtime, "create".into(), json!({
+            "type":"harness.create", "kind":"memory", "id":"m", "title":"M", "content":"value"
+        })).await, json!({"status":"error", "error":"This session has no persistent local harness store; pass global_=True to persist across sessions."}));
+    }
+
+    #[tokio::test]
+    async fn cli_global_harness_uses_shared_store_and_runtime_policy() {
+        let home = tempfile::tempdir().unwrap();
+        let runtime = ToolRuntime::new(
+            Arc::new(ToolRegistry::new()),
+            super::super::permission_checker(),
+        );
+        let reply = handle_harness(
+            &runtime,
+            "create".into(),
+            "harness.create",
+            &json!({
+                "scope":"global", "kind":"memory", "id":"m", "title":"M", "content":"value"
+            }),
+            home.path(),
+        )
+        .await;
+        assert_eq!(reply["status"], "ok");
+        let state = HarnessState::load(&HarnessState::file_path(home.path())).unwrap();
+        assert_eq!(reply["result"]["state"], json!(state));
+        assert_eq!(
+            state.entries["memory"]["m"].scope,
+            Some(HarnessScope::Global)
+        );
+
+        let denied = ToolRuntime::new(
+            Arc::new(ToolRegistry::new()),
+            PermissionChecker::new(|_| Box::pin(async { Err("test denial".into()) })),
+        );
+        assert_eq!(
+            handle_harness(
+                &denied,
+                "delete".into(),
+                "harness.delete",
+                &json!({
+                    "scope":"global", "kind":"memory", "id":"m"
+                }),
+                home.path()
+            )
+            .await,
+            json!({"status":"error", "error":"test denial"})
+        );
+        assert_eq!(
+            HarnessState::load(&HarnessState::file_path(home.path())).unwrap(),
+            state
+        );
+    }
+
+    #[tokio::test]
+    async fn cli_plan_denies_global_mutation_but_allows_reads() {
+        let home = tempfile::tempdir().unwrap();
+        let runtime = ToolRuntime::new_with_context(
+            Arc::new(ToolRegistry::new()),
+            super::super::permission_checker(),
+            ToolRuntimeContext {
+                collaboration_mode: CollaborationMode::Plan,
+                ..ToolRuntimeContext::default()
+            },
+        );
+        assert_eq!(
+            handle_harness(
+                &runtime,
+                "delete".into(),
+                "harness.delete",
+                &json!({
+                    "scope":"global", "kind":"memory", "id":"m"
+                }),
+                home.path()
+            )
+            .await,
+            json!({"status":"error", "error":"denied: harness.delete blocked in Plan mode"})
+        );
+        let reply = handle_harness(
+            &runtime,
+            "load".into(),
+            "harness.load",
+            &json!({"scope":"global"}),
+            home.path(),
+        )
+        .await;
+        assert_eq!(reply["result"]["state"], json!(HarnessState::default()));
+        assert!(!HarnessState::file_path(home.path()).exists());
+    }
+}

crates/core/prompts/rlm/repl_control.md

@@ -14,7 +14,7 @@ Each `bash()` call is a separate host-owned process. Shell state does not persis
 
 Python state in the kernel persists across cells: named variables, helper functions, classes, imports, notes, parsed outputs, and helper data structures all remain available in every later turn. Tool calls are themselves Python `await` expressions, so their return values can be bound to variables and composed into program logic just like any other call.
 
-Continual harness state is available as `rlm.harness` and `rlm.get_harness_state()`. CRUD calls are local to this Devo session by default: `rlm.harness.create_memory(...)`, `rlm.harness.update_memory(...)`, `rlm.harness.delete_memory(...)`, `rlm.harness.create_skill(...)`, `rlm.harness.update_skill(...)`, `rlm.harness.delete_skill(...)`, `rlm.harness.create_subagent(...)`, `rlm.harness.update_subagent(...)`, `rlm.harness.delete_subagent(...)`, `rlm.harness.create_prompt_note(...)`, `rlm.harness.update_prompt_note(...)`, `rlm.harness.delete_prompt_note(...)`, plus `rlm.harness.record_refinement(...)` and `rlm.harness.overview()`. Use `global_=True` only for stable cross-session lessons; Python reserves `global`, so literal `global=True` is invalid syntax.
+Continual harness state is available as `rlm.harness` and `rlm.get_harness_state()`. Call `await rlm.harness.load()` to refresh the cached read view. CRUD calls are host-owned and local to this Devo session by default: `await rlm.harness.create_memory(...)`, `await rlm.harness.update_memory(...)`, `await rlm.harness.delete_memory(...)`, `await rlm.harness.create_skill(...)`, `await rlm.harness.update_skill(...)`, `await rlm.harness.delete_skill(...)`, `await rlm.harness.create_subagent(...)`, `await rlm.harness.update_subagent(...)`, `await rlm.harness.delete_subagent(...)`, `await rlm.harness.create_prompt_note(...)`, `await rlm.harness.update_prompt_note(...)`, `await rlm.harness.delete_prompt_note(...)`, plus `await rlm.harness.record_refinement(...)` and `rlm.harness.overview()`. Use `global_=True` only for stable cross-session lessons; Python reserves `global`, so literal `global=True` is invalid syntax.
 
 Terminology: continual harness names the persisted prompt, memory, skill, and subagent layer; RLM names the runtime, Python REPL kernel, and native call interface exposed to the model.