From ae7c8cc78613b42dc1d439989219d4b697c9cdfd Mon Sep 17 00:00:00 2001 From: Jack Herrington Date: Wed, 14 Oct 2026 10:08:08 -0700 Subject: [PATCH] fix(ai-harness-cli): pass canAccess and mediaSecret to the harness handler The handler now requires canAccess, and a mediaSecret on a durable host (fix/harness-transport-release). The CLI serves one principal behind its token, so it can use every thread, and the token signs media URLs. Co-Authored-By: Claude Opus 5.5 (1M context) --- .changeset/harness-cli-handler-options.md | 5 +++++ packages/ai-harness-cli/src/serve.ts | 4 ++++ 2 files changed, 9 insertions(+) create mode 100644 .changeset/harness-cli-handler-options.md diff --git a/.changeset/harness-cli-handler-options.md b/.changeset/harness-cli-handler-options.md new file mode 100644 index 0000000000..c2f77f3e99 --- /dev/null +++ b/.changeset/harness-cli-handler-options.md @@ -0,0 +1,5 @@ +--- +'@tanstack/ai-harness-cli': patch +--- + +`--serve` passes `canAccess` and `mediaSecret` to the harness handler, which needs both. diff --git a/packages/ai-harness-cli/src/serve.ts b/packages/ai-harness-cli/src/serve.ts index bdc3e67f2a..ed8c574847 100644 --- a/packages/ai-harness-cli/src/serve.ts +++ b/packages/ai-harness-cli/src/serve.ts @@ -101,6 +101,10 @@ export async function serve( host: options.host, harness: options.harness, authorize: (request) => (isAllowed(request) ? principal : null), + // One principal holds the token, so it can use every thread. + canAccess: () => true, + // ponytail: the token signs media URLs, so they work as long as it does. + mediaSecret: options.token, }) const mcp = await mcpServer(options) const route = (request: Request) => {