after moving all to cipher

worker-toolkit-stocks-in-the-future/scripts/resolve_harness.py

@@ -36,6 +36,7 @@ from __future__ import annotations
 import argparse
 import json
 import os
+import re
 import shlex
 import sys
 import tomllib
@@ -77,6 +78,26 @@ def is_multi_turn(task_dir: str | None) -> bool:
     return session.is_file() and session.stat().st_size > 0
 
 
+def wants_browser(task_dir: str | None) -> bool:
+    """True when task.toml opts into a browser (`[metadata] browser = true`).
+
+    Read straight from the file rather than via tomllib: this must agree with
+    build-workspace.sh, which decides whether the IMAGE gets Playwright using the same
+    text match. If the two ever disagree the agent is told about a browser the image
+    lacks, which is the one failure the disclosure is designed to make impossible.
+    Accepts the quoted form for the same reason build-workspace.sh does."""
+    if not task_dir:
+        return False
+    toml_path = Path(task_dir) / "task.toml"
+    if not toml_path.is_file():
+        return False
+    try:
+        text = toml_path.read_text(encoding="utf-8")
+    except OSError:
+        return False
+    return re.search(r'^[ \t]*browser[ \t]*=[ \t]*"?true"?[ \t]*$', text, re.M) is not None
+
+
 def harness_from_task_toml(task_dir: str | None) -> str | None:
     """The task's own `[agent] harness` — the authoritative record of which harness
     this task was authored against.
@@ -388,8 +409,9 @@ def main(argv: list[str] | None = None) -> int:
 
     # Every assignment here becomes a harbor flag. Nothing else: the caller is bash, and
     # anything it would only echo back at the worker is said below instead.
+    browser = wants_browser(args.task_dir)
     assignments = {
-        "AGENT_IMPORT_PATH": harness.agent_import_path_for(multi_turn=multi_turn),
+        "AGENT_IMPORT_PATH": harness.agent_import_path_for(multi_turn=multi_turn, browser=browser),
         "MODEL": normalize_model(harness, model),
         "EFFORT_KWARG": harness.effort_kwarg,
         "EFFORT_VALUE": (harness.effort_default or "") if harness.effort_kwarg else "",
@@ -398,8 +420,17 @@ def main(argv: list[str] | None = None) -> int:
     warn(
         f"{harness.label} · model={assignments['MODEL']} · "
         f"{'multi-turn' if multi_turn else 'single-turn'} · "
+        f"{'browser · ' if browser else ''}"
         f"agent={assignments['AGENT_IMPORT_PATH']}"
     )
+    if browser and not harness.agent_import_path_browser:
+        # Not a failure: the image still gets Playwright and the agent is still told about
+        # it. Only the Read-enabled toolset swap is claude-specific, and saying so beats
+        # letting someone infer from a log line that the opt-in was ignored entirely.
+        warn(
+            f'"{harness.id}" has no browser-specific agent, so it runs its usual toolset. '
+            f"The browser and its disclosure are unaffected."
+        )
     if harness.flaky_hangs:
         warn(
             f"{harness.label} is known to hang with no client-side timeout on a small "