harness

Append a function id to the per-session always-allow list (idempotent).

Remember an "approve always" decision for this session — the function id stops prompting in every mode. Idempotent.

Clear the per-session approval settings on conversation deletion.

Read the per-session approval settings; returns defaults when none persisted.

Remove a function id from the per-session always-allow list.

Flip an approval to allow or deny. Persists the decision to the approvals scope to wake the parked turn.

Set the permission mode (manual | auto | full) for a session.

Add an alert to a budget.

Check whether a budget allows an estimated spend.

Create a budget with ceiling + period.

Delete a budget.

Toggle enforcement on a budget.

Add a 24h exemption for a principal.

Project spend through period end.

Fetch a budget by id.

List budgets, newest first.

Pause or resume a budget.

Record a spend, fire matching alerts.

Reset spent_usd, archive prior period.

Update a whitelisted set of budget fields.

Aggregate spend over a window.

Sync pre-turn compaction triggered by turn-orchestrator when a turn would overflow. Performs prune+summarise+reinject+continue.

User-initiated synchronous compaction of a session. Required: session_id. Optional: model { id, providerID, limit? } to skip auto-resolution. If model is omitted, falls back to (1) most recent assistant message in session-tree, (2) orchestrator run_request.

Internal: subscribes to agent::turn_end; triggers async compaction on TurnEnd when running tokens exceed usable(model).

Prune older tool outputs without summarisation (cheap path).

Internal: coalesces models-scope state changes into ui::models::changed::<browser_id> pushes.

Internal: fans out a newly-created session id to ui::sessions::changed::<browser_id>.

Read a host file via shell::fs::read, drain its channel, and return a {content:[{text}], details:{size, truncated, bytes_read}} envelope (max 256 KiB inline by default).

List providers declared to the harness.

Self-declare an LLM provider (id, config schema, defaults) into the dynamic harness configuration schema.

Resolve a provider credential + settings (api_url, max_tokens) from the harness configuration. Server-side only.

Browser kickoff: forward payload to run::start. Used by console/web over the iii-browser-sdk.

Publish a topic, collect subscriber replies until timeout, apply merge_rule.

Internal: routes agent::hook_reply stream events to pending publish_collect calls.

Look up a single model by (provider, model_id). Returns null when no provider has registered it.

List models, optionally filtered by provider or capability. Returns only models registered by providers (no embedded seed).

Replace the catalog for <provider> with a single Model[] value under scope models (one state write).

Check whether a provider-registered model supports a capability (false when unknown).

Check a function call against iii-permissions.yaml; returns allow, deny, or needs_approval.

Legacy: drain a streamed Anthropic completion and return the final AssistantMessage.

Re-pull the Anthropic model list (GET /v1/models) and register each into the iii models catalog. Idempotent.

Stream a single assistant turn from Anthropic into the caller-supplied channel. Each AssistantMessageEvent is sent as a JSON text message; the terminal event is Done or Error followed by close.

Legacy: drain a streamed Kimi chat-completion and return the final AssistantMessage.

Re-pull the Kimi (Moonshot) model list (GET /v1/models) and register each into the iii models catalog. Idempotent.

Stream a single assistant turn from Kimi (Moonshot) Chat Completions into the caller-supplied channel.

Legacy: drain a streamed llama-server chat-completion and return the final AssistantMessage.

Re-discover the loaded llama-server model and register it into the iii models catalog. Idempotent.

Stream a single assistant turn from a local llama-server Chat Completions server into the caller-supplied channel.

Legacy: drain a streamed LM Studio chat-completion and return the final AssistantMessage.

Load an LM Studio model into memory via POST /api/v1/models/load. Blocks until ready (up to 120s).

Re-discover loaded LM Studio models and register each into the iii models catalog. Idempotent.

Stream a single assistant turn from a local LM Studio Chat Completions server into the caller-supplied channel.

Unload an LM Studio model instance via POST /api/v1/models/unload.

Legacy: drain a streamed OpenAI chat-completion and return the final AssistantMessage.

Re-pull the OpenAI model list (GET /v1/models) and register the chat-capable subset into the iii models catalog. Idempotent.

Stream a single assistant turn from OpenAI Chat Completions into the caller-supplied channel.

Start a durable agent session and return immediately.

Atomically read and clear all items in a session-scoped inbox.

Read all items in a session-scoped inbox without mutating.

Append an item to a session-scoped inbox.

Append an AgentMessage entry to a session

Append a synthetic user-role message entry to a session

Duplicate a session with re-mapped ids

Append a Compaction entry summarising the active path

Return all compaction entries for a session, sorted by timestamp ascending

Create a new empty session record

Idempotently ensure a session exists with the given id

Render the active path as a self-contained HTML document

Fork a session at a given entry into a new session id

List sessions with optional pagination and ordering

Load every AgentMessage on the active path of a session, paired with its entry_id, oldest first

Mirror missing messages from a state-snapshot into session-tree

Return the session tree as a nested TreeNode

Replace content of a function_result message entry with compacted output

Batch replace content of multiple function_result message entries. Loads entries once.

Run one durable FSM transition for session in state assistant_streaming: start turn, stream provider response, finalize, and route onward.

Run one durable FSM transition for session in state function_awaiting_approval: execute each call as its approval decision arrives.

Run one durable FSM transition for session in state function_execute: dispatch prepared calls and finalize results.

Read the current turn_state record for a session. Returns null if the session is unknown. UI clients use this on page reload to recover any in-progress modals (e.g. function_awaiting_approval) without reading iii state directly.

State trigger on scope=approvals; enqueues turn::function_awaiting_approval when a decision is written.

Run one durable FSM transition for session in state provisioning: build the system prompt, attach the agent_trigger function schema, advance to assistant_streaming.

Run one durable FSM transition for session in state steering_check: drain inboxes and route onward.

Register a browser's interest in model-catalog changes (ui::models::changed pushes).

Remove a browser's model-catalog change subscription.

Register a browser's interest in a session (or all sessions if session_id is null).

Remove a browser's subscription to a session (or its all-sessions sub if session_id is null).

Fetch a URL over HTTP(S) and return the response as a structured envelope. Use this INSTEAD of `shell::exec` with curl for any HTTP request — it returns {ok, status, headers, body} as JSON, enforces size/timeout caps, and blocks private / cloud-metadata / link-local addresses server-side (SSRF guard; loopback is allowed by default for harness dev workflows). For JSON: pass `json: {...}` (auto-stringifies + sets content-type) and `response_format: "json"` (auto-parses response into the `json` field). Method is case-insensitive. On failure returns `{ok:false, error, message}` where `error` is one of: invalid_payload, invalid_url, blocked_host, timeout, too_many_redirects, transport_error. Branch on `error`, not on text.