ProtectedactiveProtectedconfigProtecteddeclaredProtectedexecutableProtectedextraProtectedsessionWhat this adapter actually supports. See the class doc on capability honesty.
Whether this session actually continued HarnessSessionConfig.ResumeSessionId.
Default false: a harness that cannot resume, or one offered no prior session, starts cold and must be sent the full conversation. Adapters that DO resume MUST override this and report truthfully — the caller sends only the newest message when it returns true, so a false positive leaves the harness answering a question it never saw the context for.
Deliberately separate from CapabilitySettings.SessionResume. That flag says the adapter CAN
resume in principle; this says it DID, this time. A stale or pruned session id makes the two
disagree, and only the second one is safe to branch the turn input on.
ProtectedExecutableAbsolute path or bare command name of the harness binary.
The model the harness actually used, if it reports one.
Adapters that can observe this SHOULD override it. Accounting resolves AIPromptRun.ModelID
from this first and only falls back to the harness row's declared model, because a harness left
to choose its own model will — and billing a run against a model it never used is worse than
having no attribution at all, since it looks authoritative.
Vendor session id once known, persisted to AIAgentRun.ExternalSessionID.
Translates MJ's permission policy into whatever this harness understands.
Overridable and default no-op, matching the other capability seams. An adapter that cannot
enforce permissions should leave this alone AND report PermissionHooks: false, so the
runtime knows the policy is advisory rather than enforced. Silently accepting a policy you
cannot apply is the worst option: the operator believes strict is gating something.
Called once, before StartSession, so adapters can fold the result into launch flags.
ProtectedBuildBuilds the argv for one turn.
Task prompt on the first turn; formatted step results afterwards.
Lets a subclass choose between "start" and "resume" argument forms.
Configures the command, extra argv and declared capabilities from AIAgentHarness metadata.
ProtecteddescribeNarrows an unknown catch binding to a readable message without reaching for any.
Tears the session down.
MUST be idempotent and MUST be safe to call on every exit path — success, failure, cancellation and crash — because it is what revokes the per-run MCP credential and releases the workspace. A teardown that only runs on the happy path leaks a live credential.
ProtectedMapInterprets one line of the harness's JSON stream.
Return null for lines that carry no meaning for MJ — heartbeats, progress spinners, internal
bookkeeping. Returning null is normal and expected; it is not an error path.
ProtectedreadFrames stdout into lines, parses each as JSON, and maps it through the subclass.
ProtectedreadReads a numeric field from a raw event, or undefined when absent/not a number.
ProtectedreadReads a nested object from a raw event, or undefined when absent/not an object.
ProtectedreadReads a string field from a raw event, or undefined when absent/not a string.
Answers a permission-request the adapter raised.
Only meaningful when Capabilities.PermissionHooks is true; adapters without hooks should treat this as a no-op rather than throwing, because the posture layer above may still call it defensively.
Optional_note: stringRuns one turn and streams what happens.
The first call receives the task prompt; subsequent calls receive formatted results of steps MJ
executed on the harness's behalf. Implementations MUST emit exactly one terminal event —
turn-complete or session-error — so the caller's accumulation loop always terminates.
Where the harness cannot resume a session natively (SessionResume false), the adapter is
responsible for replaying prior context into a fresh invocation here, and for reporting the
resulting token cost through usage so the run's guardrails see the true spend.
Points the adapter at a specific binary, from AIAgentHarness.ExecutablePath.
Supplies MJ's system prompt for the session, where the harness can accept one.
Harnesses ship their own system prompt defining their identity, and it dominates anything sent as user text. MJ's turn-end contract delivered as a user message therefore competes with the harness's own instructions and loses — observed directly: a harness given the contract in the user turn still answered "what can you do?" in prose, costing a retry every run.
Adapters whose harness accepts a system prompt SHOULD override this. Those that cannot are no worse off than before: the contract still rides in the turn input.
Launches the harness session. Called once per run, before the first turn.
Implementations must not begin reasoning here — only establish the process, workspace and credentials. Any failure should throw, so the run fails visibly rather than proceeding with a half-built session.
ProtectedstartStarts one turn's process INSIDE THE SANDBOX.
Note what this does not do: call spawn. Where the process physically runs is the sandbox
provider's decision, delivered through the executor, so this adapter behaves identically on a
laptop and in a per-run container.
Drives ANY command that speaks a documented newline-delimited JSON event contract.
This is the escape hatch that keeps "adding a harness must not require core changes" true in the strong sense: a harness MJ has never heard of works with zero MJ code, provided its CLI emits lines matching the vocabulary below.
The contract
Each stdout line is a JSON object with a
typefield:typetexttextactivitydescriptionpermissionid,description,command?usageinput_tokens,output_tokens,cost_usd?completetexttextcarries the envelopeerrormessageUnrecognised lines are ignored, so a harness may interleave its own diagnostics freely.
Capabilities default to the conservative end — an unknown harness is assumed NOT to resume sessions or honour permission hooks, so the runtime emulates continuity rather than silently losing context. Override via
AIAgentHarness.CapabilitySettingswhen the harness does better.