maf 0.1.0 → 0.3.0

data/lib/maf/shared/sandbox/paths.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+# maf shared library - code that the maf CLI and the scripts in .maf/bin share.
+# The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
+# Use the Ruby stdlib only: a script loads this file without a gem bundle.
+require_relative "../project"
+require_relative "references"
+require_relative "harness_files"
+
+module Maf
+  module Shared
+    module Sandbox
+      # Paths holds the real paths of a sandbox.
+      class Paths
+        COMMON = ["/tmp", "/var/tmp"].freeze
+        PROTECTED = [".maf/sandbox.json", ".maf/bin", ".maf/lib", ".maf/env.sh", ".maf/coordination/harness-hooks",
+                     ".maf/claude", ".maf/mcp", ".git/hooks", ".git/config", ".git/commondir",
+                     ".git/config.worktree"].freeze
+        COORD_PROTECTED = %w[message-hooks taskrc worktree-env.rb taskdata/hooks].freeze
+        COORD_DIRS = %w[message-hooks taskdata/hooks].freeze
+        PROTECTED_DIRS = [".maf/bin", ".maf/lib", ".maf/claude", ".maf/mcp", ".git/hooks"].freeze
+        WORKTREE_PROTECTED = [".maf/bin", ".maf/lib", ".maf/env.sh", ".maf/coordination/harness-hooks"].freeze
+        FLOW_CONFIG = %w[.maf/claude/settings.json .maf/mcp/*.json].freeze
+
+        attr_reader :root
+
+        def initialize(harnesses, root, coord_dir, extra)
+          @harness = HarnessFiles.new(harnesses, ->(paths) { real(paths) })
+          @root = root
+          @coord_dir = coord_dir || File.join(root, ".maf", "coordination")
+          @extra = extra.map { |path| File.expand_path(path, root) }
+        end
+
+        def dirs = @dirs ||= real([@root, @coord_dir, *@extra, ENV.fetch("TMPDIR", nil), *COMMON])
+        def harness_dirs = @harness.dirs
+        def state = @harness.state
+        def harness_files = @harness.locked
+        def placeholders = @harness.placeholders
+        def prefixes = @harness.prefixes
+
+        def references
+          keep = ->(path) { writable?(path) }
+          References.of(@harness.config + project_config + flow_config, @root, keep) +
+            worktrees.flat_map { |dir| References.of(config_in(dir), dir, keep) }
+        end
+
+        def existing = dirs.select { |dir| File.exist?(dir) }
+        def sockets = real([@root, @coord_dir])
+
+        def protected
+          @protected ||= begin
+            paths = [*PROTECTED.map { |path| File.join(@root, path) }, *project_config, *coord_files, *worktree_links,
+                     *worktree_files, *submodule_files, *harness_files, *references]
+            (real(paths) + links(paths)).uniq
+          end
+        end
+
+        def project_config = config_in(@root)
+        def config_in(dir) = Harness.all.flat_map(&:sandbox_project).uniq.map { |path| File.join(dir, path) }
+        def flow_config = FLOW_CONFIG.flat_map { |glob| Dir.glob(File.join(@root, glob)) }
+
+        def protected_dirs
+          real([*PROTECTED_DIRS.map { |path| File.join(@root, path) }, *COORD_DIRS.map { |name| coord_file(name) }])
+        end
+
+        def coord_files = COORD_PROTECTED.map { |name| coord_file(name) }
+        def coord_file(name) = File.join(@coord_dir, name)
+
+        def worktree_links
+          Dir.glob(File.join(@root, Project::WORKTREES_DIR, "*", ".git")) +
+            Dir.glob(File.join(@root, ".git", "worktrees", "*", "{commondir,gitdir,config.worktree}"))
+        end
+
+        def worktree_files
+          worktrees.flat_map do |dir|
+            [*WORKTREE_PROTECTED.map { |path| File.join(dir, path) }, *config_in(dir)]
+          end
+        end
+
+        GIT_FILES = %w[config hooks].freeze
+
+        def submodule_files
+          dirs = Dir.glob(File.join(@root, ".git", "modules", "**", "HEAD")).map { |head| File.dirname(head) }
+          dirs = dirs.select { |dir| File.file?(File.join(dir, "config")) }
+          dirs.flat_map { |dir| GIT_FILES.map { |name| File.join(dir, name) } }
+        end
+
+        def worktrees = Dir.glob(File.join(@root, Project::WORKTREES_DIR, "*"))
+
+        def parents
+          protected.flat_map { |path| parents_of(path) }.uniq.sort_by(&:size)
+        end
+
+        private
+
+        def parents_of(path)
+          top = (dirs + harness_dirs).select { |dir| path.start_with?("#{dir}/") }.max_by(&:size)
+          top ? ancestors(path).take_while { |dir| dir.size >= top.size } : []
+        end
+
+        def writable?(path)
+          real_path = real([path]).first
+          dirs.any? { |dir| real_path.start_with?("#{dir}/") }
+        end
+
+        def ancestors(path) = (dir = File.dirname(path)) == path ? [] : [dir, *ancestors(dir)]
+        def real(paths) = paths.compact.reject(&:empty?).map { |path| resolve(File.expand_path(path)) }.uniq
+
+        def resolve(path)
+          File.realpath(path)
+        rescue SystemCallError
+          File.exist?(File.dirname(path)) ? in_real_dir(path) : path
+        end
+
+        def links(paths)
+          symlinks = paths.map { |path| File.expand_path(path) }.select { |path| File.symlink?(path) }
+          symlinks.map { |link| in_real_dir(link) }
+        end
+
+        def in_real_dir(path) = File.join(File.realpath(File.dirname(path)), File.basename(path))
+      end
+    end
+  end
+end

data/lib/maf/shared/sandbox/references.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+# maf shared library - code that the maf CLI and the scripts in .maf/bin share.
+# The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
+# Use the Ruby stdlib only: a script loads this file without a gem bundle.
+require "json"
+
+module Maf
+  module Shared
+    module Sandbox
+      # References finds the files that a config file of a harness names.
+      module References
+        # A path in a command or a setting: ~/x, $HOME/x, ${HOME}/x, or /x.
+        PATH = %r{(?:~|\$\{?HOME\}?)?/[^\s"'`;|&()<>,\\]+}
+        # A relative path with a folder (scripts/hook.sh). A hook runs in the project folder.
+        RELATIVE = /(?<![\w.\/~}$-])[\w.-]+(?:\/[\w.-]+)+/
+        # An import in a Markdown file: @path, at the start of a line or after a space.
+        # A period or a comma after the path ends the sentence.
+        IMPORT = /(?:^|\s)@([^\s]+?)[.,;:!?)]*(?=\s|$)/
+        # Claude Code sets this variable to the project folder for a hook. It becomes ".", so RELATIVE finds the path.
+        PROJECT_DIR = /\$\{?CLAUDE_PROJECT_DIR\}?/
+        DEPTH = 5
+        MAX_SIZE = 1_000_000
+
+        def self.of(files, root, keep) = walk(files, root, DEPTH).select(&keep)
+
+        def self.walk(files, root, depth)
+          found = files.flat_map { |file| named_in(file, root) }.uniq - files
+          depth.zero? || found.empty? ? found : (found + walk(found, root, depth - 1)).uniq
+        end
+
+        def self.named_in(file, root)
+          text = read(file)
+          paths = file.end_with?(".md") ? imports(text, file) : commands(text, file, root)
+          paths.select { |path| File.file?(path) }
+        rescue SystemCallError, ArgumentError
+          []
+        end
+
+        def self.imports(text, file) = text.scan(IMPORT).flatten.map { |path| expand(path, file) }
+
+        def self.commands(text, file, root)
+          text = text.gsub(PROJECT_DIR, ".")
+          text.scan(PATH).map { |path| expand(path, file) } +
+            text.scan(RELATIVE).map { |path| File.expand_path(path, root) }
+        end
+
+        def self.read(file)
+          text = File.file?(file) && File.size(file) < MAX_SIZE ? File.read(file) : ""
+          file.end_with?(".json") ? without_permissions(text) : text
+        end
+
+        def self.without_permissions(text)
+          data = JSON.parse(text)
+          data.is_a?(Hash) ? JSON.generate(data.except("permissions")) : text
+        rescue JSON::ParserError
+          text
+        end
+
+        def self.expand(path, file) = File.expand_path(path.sub(/\A\$\{?HOME\}?/, "~"), File.dirname(file))
+      end
+    end
+  end
+end

data/lib/maf/shared/sandbox/seatbelt.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+# maf shared library - code that the maf CLI and the scripts in .maf/bin share.
+# The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
+# Use the Ruby stdlib only: a script loads this file without a gem bundle.
+require "digest"
+
+module Maf
+  module Shared
+    module Sandbox
+      # Seatbelt runs a command in a macOS sandbox-exec profile.
+      module Seatbelt
+        COMMAND = "/usr/bin/sandbox-exec"
+        DEVICES = '(literal "/dev/null") (literal "/dev/zero") (literal "/dev/dtracehelper") ' \
+                  '(regex #"^/dev/tty") (regex #"^/dev/fd/") (regex #"^/dev/ptmx")'
+        DNS = '(path-literal "/private/var/run/mDNSResponder")'
+        TMP_PREFIX = "maf-sandbox-"
+        SERVICES = "(deny mach-lookup (global-name-regex #\"^com\\.apple\\.(coreservices|lsd)\\.\"))\n" \
+                   "(deny appleevent-send)\n"
+
+        def self.wrap(cmd, paths)
+          tmp = private_tmp(paths.root)
+          [COMMAND, "-p", profile(paths, tmp), "env", "TMPDIR=#{tmp}/", "XDG_CACHE_HOME=#{tmp}/cache", *cmd]
+        end
+
+        def self.available? = File.executable?(COMMAND)
+        def self.require! = available? || abort("maf: sandbox mode seatbelt needs #{COMMAND} (macOS only).")
+
+        def self.private_tmp(root) = own_dir(project_tmp(root))
+
+        def self.project_tmp(root)
+          File.join(File.realpath("/tmp"), "#{TMP_PREFIX}#{Process.uid}-#{Digest::SHA256.hexdigest(root)[0, 12]}")
+        end
+
+        def self.own_dir(dir)
+          make(dir)
+          stat = File.lstat(dir)
+          return dir if stat.directory? && stat.uid == Process.uid && stat.mode.nobits?(0o077)
+
+          abort "maf: #{dir} belongs to another user or is open to others. Remove it."
+        end
+
+        def self.make(dir)
+          Dir.mkdir(dir, 0o700)
+        rescue Errno::EEXIST
+          nil
+        end
+
+        def self.profile(paths, tmp)
+          "(version 1)\n(allow default)\n(deny file-write*)\n#{writes(paths)}#{protects(paths)}" \
+            "#{sockets([*paths.sockets, tmp])}#{SERVICES}"
+        end
+
+        def self.writes(paths)
+          rules = paths.dirs.map { |dir| "(subpath #{quote(dir)})" } +
+                  paths.prefixes.map { |prefix| "(prefix #{quote(prefix)})" } +
+                  paths.state.filter_map { |pattern| regex(pattern) }
+          "(allow file-write* #{DEVICES}\n  #{rules.join("\n  ")})\n"
+        end
+
+        def self.regex(pattern)
+          return if pattern.include?('"')
+
+          "(regex #\"^#{escape(pattern).gsub("*", "[^/]*")}(/|$)\")"
+        end
+
+        def self.escape(pattern) = pattern.gsub(/[.^$|()\[\]{}+?\\]/) { |char| "\\#{char}" }
+
+        # A later rule wins, so these denials come after the allowed folders.
+        def self.protects(paths)
+          rules = paths.protected.map { |path| "(subpath #{quote(path)})" } +
+                  paths.parents.map { |dir| "(literal #{quote(dir)})" }
+          "(deny file-write*\n  #{rules.join("\n  ")})\n"
+        end
+
+        def self.sockets(dirs)
+          allowed = [DNS, *dirs.map { |dir| "(subpath #{quote(dir)})" }]
+          rules = allowed.map { |path| "(allow network-outbound (remote unix-socket #{path}))\n" }
+          "(deny network-outbound (remote unix-socket))\n#{rules.join}"
+        end
+
+        def self.quote(path) = "\"#{path.gsub(/["\\]/) { |char| "\\#{char}" }}\""
+      end
+    end
+  end
+end

data/lib/maf/shared/sandbox.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+# maf shared library - code that the maf CLI and the scripts in .maf/bin share.
+# The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
+# Use the Ruby stdlib only: a script loads this file without a gem bundle.
+require "json"
+require_relative "project"
+require_relative "harness"
+require_relative "sandbox/paths"
+require_relative "sandbox/seatbelt"
+require_relative "sandbox/bwrap"
+require_relative "sandbox/links"
+
+module Maf
+  module Shared
+    # Sandbox runs an agent command in the OS sandbox of the mode in .maf/sandbox.json.
+    module Sandbox
+      BACKENDS = { "seatbelt" => Seatbelt, "bwrap" => Bwrap }.freeze
+      MODES = ["off", "auto", *BACKENDS.keys].freeze
+      POLICY = File.join(".maf", "sandbox.json")
+
+      def self.policy
+        path = File.join(Project.root, POLICY)
+        return {} unless File.exist?(path)
+
+        JSON.parse(File.read(path)).tap { |data| data.is_a?(Hash) || abort("maf: #{POLICY} must hold a JSON object.") }
+      rescue SystemCallError, JSON::ParserError => e
+        abort "maf: cannot read #{POLICY}: #{e.message.lines.first.strip}. Fix the file, or delete it."
+      end
+
+      def self.mode(policy = self.policy)
+        mode = ENV.fetch("MAF_SANDBOX", nil).to_s
+        mode = policy["mode"] || "off" if mode.empty?
+        abort "maf: unknown sandbox mode '#{mode}' (use #{MODES.join(", ")})" unless MODES.include?(mode)
+        (mode == "auto" ? native : mode).tap { |name| BACKENDS[name]&.require! }
+      end
+
+      def self.native = RUBY_PLATFORM.include?("darwin") ? "seatbelt" : "bwrap"
+
+      def self.wrap(cmd, harness, coord_dir: ENV.fetch("COORD_DIR", nil))
+        policy = self.policy
+        mode = mode(policy)
+        mode == "off" ? cmd : BACKENDS[mode].wrap(harness.sandboxed(cmd), paths(harness, policy, coord_dir))
+      end
+
+      def self.keeping_links(harness, coord_dir: ENV.fetch("COORD_DIR", nil))
+        links = protected_links(harness, coord_dir)
+        yield
+      ensure
+        Links.restore(links || {})
+      end
+
+      def self.protected_links(harness, coord_dir)
+        policy = self.policy
+        mode(policy) == "bwrap" && !Bwrap.inside? ? Links.record(paths(harness, policy, coord_dir).protected) : {}
+      end
+
+      def self.describe(harness, coord_dir: ENV.fetch("COORD_DIR", nil))
+        policy = self.policy
+        mode = mode(policy)
+        mode == "off" ? "off" : "#{mode}, #{writes(paths(harness, policy, coord_dir))}"
+      end
+
+      def self.writes(paths)
+        state = paths.harness_dirs.select { |dir| File.exist?(dir) }
+        "writes to #{paths.existing.join(", ")}#{", and the state files in #{state.join(", ")}" if state.any?}"
+      end
+
+      def self.paths(harness, policy, coord_dir)
+        protect_policy
+        Paths.new([harness, *project_harnesses].uniq, Project.root, coord_dir, Array(policy["write"]))
+      end
+
+      def self.project_harnesses = Project.manifest.fetch("agents", []).filter_map { |a| Harness[a["harness"]] }
+
+      def self.protect_policy
+        path = File.join(Project.root, POLICY)
+        File.write(path, "{}\n") unless File.exist?(path)
+      rescue SystemCallError
+        nil
+      end
+    end
+  end
+end

data/lib/maf/team.rb

@@ -2,7 +2,7 @@
 
 # team.rb - add, replace, and retire workers in one command.
 #
-#   maf prepare HARNESS ROLE[_WORKER] [--model M] [--dispatch | --interactive] [--replace WORKER]
+#   maf prepare HARNESS ROLE[_WORKER] [--model M] [--effort L] [--dispatch | --interactive] [--replace WORKER]
 #   maf retire WORKER
 #
 # The project manager runs these commands. `maf prepare` adds the role file,
@@ -72,7 +72,7 @@ module Maf
     end
 
     def prepare
-      Maf.flow("--agent", spec) unless Maf.agent_specs.include?("#{@args.harness}:#{@args.role}")
+      Maf.flow("--agent", spec, *effort_flag) unless Maf.agent_specs.include?("#{@args.harness}:#{@args.role}")
       worktree = SetupAgent::Worktree.ensure(@args.role, @args.worker_id, @args.harness)
       SetupAgent::RoleFile.copy(@root, worktree.dir, @args.harness, @args.role)
       archive_on_harness_change
@@ -87,6 +87,7 @@ module Maf
     end
 
     def spec = [@args.harness, @args.role, @args.model].compact.join(":")
+    def effort_flag = @args.effort ? ["--effort", "#{@args.role}=#{@args.effort}"] : []
 
     def workers_after
       all = Workers.at(@root).all
@@ -98,12 +99,12 @@ module Maf
     def start_dispatcher
       Dir.chdir(@root)
       args = [@args.harness, "#{@args.role}_#{@args.worker_id}", "--dispatch", "--detach"]
-      SetupAgent.run(@args.model ? args + ["--model", @args.model] : args)
+      SetupAgent.run(args + { "--model" => @args.model, "--effort" => @args.effort }.compact.flatten)
     end
 
     def entry(dir)
       { "role" => @args.role, "worker_id" => @args.worker_id, "harness" => @args.harness,
-        "model" => @args.model, "dispatch" => @args.dispatch, "dir" => dir }.compact
+        "model" => @args.model, "effort" => @args.effort, "dispatch" => @args.dispatch, "dir" => dir }.compact
     end
 
     def print_next_steps

data/lib/maf/team_command.rb

@@ -32,15 +32,17 @@ module Maf
 
     def line(id, entry)
       mode = entry["dispatch"] ? "dispatch" : "interactive"
-      [id.ljust(28), entry["role"].to_s.ljust(20), entry["harness"], entry["model"] || "-", mode, state(entry)]
+      [id.ljust(28), entry["role"].to_s.ljust(20), entry["harness"], model(entry), mode, state(id, entry)]
         .join("  ")
     end
 
-    def state(entry)
+    def model(entry) = [entry["model"] || "-", entry["effort"]].compact.join("/")
+
+    def state(id, entry)
       pid = entry["pid"]
       return "-" unless pid
 
-      Shared::Processes.alive?(pid) ? "running (pid #{pid})" : "stopped"
+      Workers.at(@root).running?(id) ? "running (pid #{pid})" : "stopped"
     end
 
     # The budget keys replace the old budget. Keep every other manifest key,

data/lib/maf/uninstall/manifest.rb

@@ -2,25 +2,27 @@
 
 module Maf
   module Uninstall
-    # .maf/config.json lists the generated agents. Hermes skills live outside
-    # the project, so only the manifest tells which ones belong to it.
+    # .maf/config.json lists the generated agents. Some harnesses keep role
+    # files outside the project, so only the manifest tells which ones belong to it.
     class Manifest
       def initialize(project)
         @project = project
         @path = File.join(project, ".maf/config.json")
       end
 
-      def steps = File.exist?(@path) ? [Owned.remove(@path)] : []
+      def steps = [@path, policy].select { |path| File.exist?(path) }.map { |path| Owned.remove(path) }
+      def policy = File.join(@project, Maf::Shared::Sandbox::POLICY)
 
-      def hermes_skills
-        roles = data.fetch("agents", []).select { |a| a["harness"] == "hermes" }.map { |a| a["role"] }
-        roles.map { |role| File.join(hermes_dir, "#{File.basename(@project)}-#{role}", "SKILL.md") }
+      # The role files of the harnesses that keep them outside .maf/agents/.
+      def outside_role_files
+        data.fetch("agents", []).filter_map do |agent|
+          harness = Maf::Shared::Harness[agent["harness"]]
+          harness.role_destination(@project, agent["role"], data) if harness && !harness.role_path(agent["role"])
+        end
       end
 
       private
 
-      def hermes_dir = data.fetch("hermes_dir", Flow::DEFAULT_HERMES_DIR)
-
       def data
         @data ||= File.exist?(@path) ? (JSON.parse(File.read(@path)) rescue {}) : {}
       end

data/lib/maf/uninstall/mcp_entries.rb

@@ -2,15 +2,14 @@
 
 module Maf
   module Uninstall
-    # Removes the graphify server that an older maf wrote into the project's
-    # .mcp.json and opencode.json. Today the server lives in .maf/mcp/. A
+    # Removes the graphify server that an older maf wrote into a project file
+    # (Harness#legacy_mcp_file). Today the server lives in .maf/mcp/. A
     # foreign entry and all other settings stay. A file goes only if nothing
     # else is left in it.
     class McpEntries
-      PROJECT_FILES = { "claude" => ".mcp.json", "opencode" => "opencode.json" }.freeze
-
       def initialize(project)
-        @files = Flow::McpConfig.targets.map { |harness, t| [File.join(project, PROJECT_FILES.fetch(harness)), t] }
+        harnesses = Maf::Shared::Harness.all.select { |harness| harness.mcp && harness.legacy_mcp_file }
+        @files = harnesses.map { |harness| [File.join(project, harness.legacy_mcp_file), harness.mcp] }
       end
 
       def steps

data/lib/maf/uninstall/notes.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../vm"
+
 module Maf
   module Uninstall
     # Tells the user what the uninstaller keeps on purpose.
@@ -7,7 +9,7 @@ module Maf
       def initialize(project) = @project = project
 
       def lines
-        [kept_dirs, branches, global_hooks].compact
+        [kept_dirs, branches, global_hooks, vm].compact
       end
 
       private
@@ -22,8 +24,17 @@ module Maf
         "kept   branches #{list.join(", ")} (delete with git branch -D)" if list.any?
       end
 
+      def vm
+        return unless Maf::Shared::Harness.on_path?(Vm::LIMACTL)
+
+        name = Vm.new([], @project).name
+        "kept   the VM #{name} (delete with maf vm delete)" if vm_names.include?(name)
+      end
+
+      def vm_names = IO.popen([Vm::LIMACTL, "list", "--quiet"], err: File::NULL, &:readlines).map(&:strip)
+
       def global_hooks
-        hooks = GLOBAL_HOOKS.select { |path| File.exist?(path) }
+        hooks = Uninstall.global_files.select { |path| File.exist?(path) }
         "kept   global hooks #{hooks.join(", ")} (other projects can use them)" if hooks.any?
       end
     end

data/lib/maf/uninstall/role_files.rb

@@ -5,8 +5,6 @@ module Maf
     # Removes the role files in .maf/agents/ and the symlink of each harness
     # folder that points there.
     class RoleFiles
-      DIRS = %w[claude opencode codex].map { |harness| [".maf", "agents", harness] }.freeze
-
       def initialize(project, manifest)
         @project = project
         @manifest = manifest
@@ -14,28 +12,28 @@ module Maf
 
       def steps
         links.map { |path| Owned.remove(path) } + project_files.map { |path| Owned.remove(path) } +
-          @manifest.hermes_skills.select { |path| Owned.marked?(path) }.map { |path| hermes_step(path) }
+          @manifest.outside_role_files.select { |path| Owned.marked?(path) }.map { |path| outside_step(path) }
       end
 
       private
 
       def project_files
-        DIRS.flat_map { |parts| Dir.glob(File.join(@project, *parts, "*.md")) }.select { |path| Owned.marked?(path) }
+        Dir.glob(File.join(@project, ".maf", "agents", "*", "*.md")).select { |path| Owned.marked?(path) }
       end
 
       def links = folder_links + file_links
 
       def folder_links
-        Flow::HARNESS_DIRS.filter_map do |harness, dir|
-          path = File.join(@project, dir)
-          path if File.symlink?(path) && File.readlink(path) == Flow::AgentLinks.target(harness)
+        harnesses.filter_map do |harness|
+          path = File.join(@project, harness.role_dir)
+          path if File.symlink?(path) && File.readlink(path) == Flow::AgentLinks.target(harness.name)
         end
       end
 
       # The links of single role files in a harness folder with the user's own files.
       def file_links
-        Flow::HARNESS_DIRS.flat_map do |harness, dir|
-          Dir.glob(File.join(@project, dir, "*.md")).select { |path| file_link?(path, harness) }
+        harnesses.flat_map do |harness|
+          Dir.glob(File.join(@project, harness.role_dir, "*.md")).select { |path| file_link?(path, harness.name) }
         end
       end
 
@@ -43,7 +41,10 @@ module Maf
         File.symlink?(path) && File.readlink(path) == Flow::AgentLinks.file_target(harness, File.basename(path))
       end
 
-      def hermes_step(path)
+      def harnesses = Maf::Shared::Harness.all.select(&:role_dir)
+
+      # A role file outside the project lives in a folder of its own.
+      def outside_step(path)
         Step.new("remove #{File.dirname(path)}", -> { FileUtils.rm(path) && Owned.prune(File.dirname(path)) })
       end
     end

data/lib/maf/uninstall/runner.rb

@@ -40,14 +40,15 @@ module Maf
         manifest = Manifest.new(project)
         [VaultWatcher.new(project), Worktrees.new(project, @opts[:force]), Scripts.new(project),
          CommitGuard.new(project), DocGraphHooks.new(project), RoleFiles.new(project, manifest),
-         ClaudeSettings.new(project), CodexHooks.new(project), McpEntries.new(project),
-         MarkedFiles.new(project), LocalFiles.new(project), Coordination.new(project), manifest].flat_map(&:steps)
+         *Uninstall.harness_cleaners(project), *file_cleaners, manifest].flat_map(&:steps)
       end
 
+      def file_cleaners = [McpEntries, MarkedFiles, LocalFiles, Coordination, VmFiles].map { |step| step.new(project) }
+
       def apply(steps)
         abort "uninstall: cancelled" unless @opts[:yes] || confirmed?
         steps.each(&:run)
-        EMPTY_DIRS.each { |parts| Owned.prune(File.join(project, *parts)) }
+        Uninstall.empty_dirs.each { |parts| Owned.prune(File.join(project, *parts)) }
         finish("removed the multi-agent flow from #{project}")
       end
 

data/lib/maf/uninstall/scripts.rb

@@ -28,7 +28,7 @@ module Maf
       # The files of the shared library. A file without the signature stays.
       def shared
         dir = File.join(@project, Bootstrap::MAF_DIR, Bootstrap::SHARED_DIR)
-        Dir.glob(File.join(dir, "*.rb")).map { |path| [path, Bootstrap::SHARED_SIGNATURE] }
+        Dir.glob(File.join(dir, "**", "*.rb")).map { |path| [path, Bootstrap::SHARED_SIGNATURE] }
       end
     end
   end

data/lib/maf/uninstall/vm_files.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Maf
+  module Uninstall
+    # VmFiles removes the gem file that maf vm create copied into .maf/vm/.
+    class VmFiles
+      def initialize(project) = @dir = File.join(project, ".maf", "vm")
+
+      def steps
+        return [] unless Dir.exist?(@dir)
+
+        [Step.new("remove #{@dir} (the gem file for maf vm)", -> { FileUtils.rm_rf(@dir) })]
+      end
+    end
+  end
+end

data/lib/maf/uninstall.rb

@@ -20,18 +20,32 @@ require_relative "flow"
 require_relative "env_exclude"
 require_relative "local_exclude"
 require_relative "migrate"
+require_relative "shared/sandbox"
 
 module Maf
+  # Uninstall removes the flow from a project. Each harness adds its own
+  # folders, files, and cleaners (Maf::Shared::Harness).
   module Uninstall
     KEPT_DIRS = %w[graphify-out].freeze
+    # The folders of the shared library in .maf/lib/. Children come before parents.
+    LIB_DIRS = [*%w[harness harnesses sandbox].map { |dir| [".maf", "lib", "maf", "shared", dir] },
+                %w[.maf lib maf shared], %w[.maf lib maf], %w[.maf lib]].freeze
 
     # Removed after all steps if empty. Children come before parents.
-    EMPTY_DIRS = [%w[.claude agents], %w[.claude], %w[.opencode agents], %w[.opencode plugins], %w[.opencode],
-                  %w[.codex prompts], %w[.codex], %w[.maf bin], %w[.maf agents claude], %w[.maf agents opencode],
-                  %w[.maf agents codex], %w[.maf agents], %w[.maf worktrees],
-                  %w[.maf lib maf shared], %w[.maf lib maf], %w[.maf lib], %w[.maf]].freeze
+    def self.empty_dirs
+      harnesses = Maf::Shared::Harness.all
+      harnesses.flat_map(&:empty_dirs).map { |dir| dir.split("/") } + [%w[.maf bin]] +
+        harnesses.map { |harness| [".maf", "agents", harness.name] } +
+        [%w[.maf agents], %w[.maf worktrees], *LIB_DIRS, %w[.maf]]
+    end
+
+    # Files outside the project that uninstall keeps: other projects can use them.
+    def self.global_files = Maf::Shared::Harness.all.flat_map(&:global_files)
 
-    GLOBAL_HOOKS = [File.join(Dir.home, ".hermes", "agent-hooks", "next-task.sh")].freeze
+    # The cleaners of each harness. untrack runs only the legacy cleaners.
+    def self.harness_cleaners(project, legacy_only: false)
+      Maf::Shared::Harness.all.flat_map { |h| h.legacy_cleaners(project) + (legacy_only ? [] : h.cleaners(project)) }
+    end
 
     # Step is one removal. --check prints the label and runs nothing.
     Step = Struct.new(:label, :work) do
@@ -56,4 +70,5 @@ require_relative "uninstall/marked_files"
 require_relative "uninstall/coordination"
 require_relative "uninstall/local_files"
 require_relative "uninstall/notes"
+require_relative "uninstall/vm_files"
 require_relative "uninstall/runner"