feat(agent-harness): authorize internal provider operations

[iscekic]

No new behavior — the new tool support is not available to users yet.

---

Summary

executeHarnessProviders validates signed requests before minting narrower capabilities for mcp.discover, mcp.call, web.search, and web.retrieve, so providers receive only request-scoped authority.
Web dispatch requires a matching, live reservation of at most 30 seconds; reconcile and unsupported tools return invalid_input.
Validated replies retain nullable costMicrodollars through overflow and cancellation races; callers must keep Model Context Protocol (MCP) authorization outside tool results, model messages, and clients.

Files

• apps/web/src/lib/agent-harness/operation-providers.ts — Added source (+130/−0 lines). Checks current authority, bounds signed inputs and MCP connections at 65,536 bytes, and binds capabilities to actual arguments and definition versions. Validates nonempty connection identifiers, https: addresses without credentials, and bounded bearer authorization; strips extra connection fields. Matches reservations to the operation, run, call, and dispatch time, then rechecks the original deadline after minting. Rejects prior cancellation and combines caller and deadline cancellation for web dispatch. Bounds web transport and complete serialized replies at 1,048,576 bytes; validates reply shapes and nonnegative integer or null costs. Preserves empty and completed results, error codes, and retryability while sanitizing error messages. Returns a small, non-retryable limit_exceeded result with the validated cost after reply overflow, including cancellation races.
• apps/web/src/lib/agent-harness/operation-providers.test.ts — Added test (+363/−0 lines). Covers personal and organization authority, signed request tampering, invalid reservations, deadline expiry during minting, unsupported operations, connection validation, and invalid costs. Checks actual and empty results, sanitized recovery states, serialized output bounds, pre-dispatch cancellation, deadline propagation, and cost retention during overflow and cancellation races.

Tests: 1 test file added — operation-providers.test.ts (+363/−0 lines).
Generated: 0 files changed.

---

Verification

Manual verification: not run because this provider module is not activated.
The endpoint, committed Worker wiring, live providers, presentation, and cross-client verification remain later planned work.

Visual Changes

Visual Changes: N/A

Reviewer Notes

Human steps

This level needs no manual steps before or after merge.
Product pull request merges remain human-owned.

Recorded checks

• The supplied report records 71 passing provider tests, including 12 overflow and cancellation-race regressions, plus passing targeted lint, formatting, and whitespace checks.
• The tests use real capability signing with fixture authority and adapter responses; they do not prove live providers or committed reservation origin.
• This description round did not rerun product checks; repository-wide lint, tests, typecheck, and build remain unverified.

Notes

• Runtime verification remains pending until the complete backend, browser, iOS, and Android integration reaches the stack tip.
• Font-scaling variants, including large text and dynamic type: owner-descoped.
• Light, dark, and other theme variants, including variant-only geometry: owner-descoped.
• Visual contrast, scaled-text layout, and screen-reader presentation checks: owner-descoped.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. shared-agent-harness-3bb0 — chore(agent-harness): register workspaces and enforce CI boundaries #5632
2. shared-agent-harness-3bb0-s2 — feat(agent-harness): define portable domain and snapshots #5637
3. shared-agent-harness-3bb0-s3 — feat(agent-harness): define commands tools and permission policy #5639
4. shared-agent-harness-3bb0-s4 — feat(agent-harness): share client state and cursor recovery #5643
5. shared-agent-harness-3bb0-s5 — feat(agent-harness): persist command intents and execution receipts #5647
6. shared-agent-harness-3bb0-s6 — feat(db): add harness ingress grants and retirement fences #5655
7. shared-agent-harness-3bb0-s7 — feat(agent-harness): deliver legacy history and project durable text #5659
8. shared-agent-harness-3bb0-s8 — feat(agent-harness): authorize durable grants and registered clients #5662
9. shared-agent-harness-3bb0-s9 — feat(agent-harness): fence retirement and retry payload cleanup #5667
10. shared-agent-harness-3bb0-s10 — feat(agent-harness): persist authoritative state in SQLite #5675
11. shared-agent-harness-3bb0-s11 — feat(agent-harness): admit durable runs and revisioned commands #5678
12. shared-agent-harness-3bb0-s12 — feat(agent-harness): recover queued runs and stream checkpointed steps #5688
13. shared-agent-harness-3bb0-s13 — feat(agent-harness): resolve interactions and dispatch tools sequentially #5693
14. shared-agent-harness-3bb0-s14 — feat(agent-harness): fence designated client tool execution #5697
15. shared-agent-harness-3bb0-s15 — feat(agent-harness): synchronize durable snapshots and legacy history #5701
16. shared-agent-harness-3bb0-s16 — feat(agent-harness): reuse authorized invitations with durable replay #5704
17. shared-agent-harness-3bb0-s17 — feat(integrations): bound repository transport for harness reads #5710
18. shared-agent-harness-3bb0-s18 — feat(integrations): expose bounded authorized repository reads #5714
19. shared-agent-harness-3bb0-s19 — feat(agent-harness): expose named authorized resource reads #5718
20. shared-agent-harness-3bb0-s20 — feat(sessions): bound history transport for harness reads #5724
21. shared-agent-harness-3bb0-s21 — feat(agent-harness): read scoped Cloud Agent context and progress #5726
22. shared-agent-harness-3bb0-s22 — fix(agent-harness): preserve ordered Cloud Agent dispatch identity #5731
23. shared-agent-harness-3bb0-s23 — feat(agent-harness): hand coding work to authorized Cloud Agent sessions #5733
24. shared-agent-harness-3bb0-s24 — feat(agent-harness): authorize scoped MCP gateway connections #5737
25. shared-agent-harness-3bb0-s25 — feat(agent-harness): bound MCP gateway transport in the Worker #5740
26. shared-agent-harness-3bb0-s26 — feat(agent-harness): execute validated remote MCP tools #5743
27. shared-agent-harness-3bb0-s27 — refactor(exa): share provider dispatch and usage recording #5746
28. shared-agent-harness-3bb0-s28 — feat(agent-harness): authorize bounded web provider requests #5747
29. shared-agent-harness-3bb0-s29 — feat(agent-harness): normalize web sources and preserve citations #5749
30. shared-agent-harness-3bb0-s30 — feat(agent-harness): define closed internal operation contracts #5753
31. shared-agent-harness-3bb0-s31 — feat(agent-harness): authorize internal maintenance operations #5754
32. shared-agent-harness-3bb0-s32 — feat(agent-harness): authorize named Kilo operation dispatch #5755
33. shared-agent-harness-3bb0-s33 — feat(agent-harness): authorize internal provider operations #5757 ← this PR
34. shared-agent-harness-3bb0-s34 — feat(agent-harness): secure the internal operations endpoint #5758
35. shared-agent-harness-3bb0-s35 — feat(agent-harness): bound and sanitize model streams #5767
36. shared-agent-harness-3bb0-s36 — feat(agent-harness): secure billed model inference #5776
37. shared-agent-harness-3bb0-s37 — test(agent-harness): cover model gateway security boundaries #5777 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/lib/agent-harness/operation-providers.ts
• apps/web/src/lib/agent-harness/operation-providers.test.ts

---

_{Reviewed by grok-4.6 · Input: 241.6K · Output: 27.6K · Cached: 704.3K}

_{Review guidance: REVIEW.md from base branch shared-agent-harness-3bb0-s32}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.