@1agh/maude 1.0.11 → 1.2.0

package/cli/lib/hubs-config.mjs

@@ -83,28 +83,55 @@ export function saveHubsConfig(config) {
  *
  * @param {string} url
  * @param {string} token
- * `role` is the ONE prior field carried across a relink (Cloud Phase 25 C2).
- * It records what the workspace vouched for at sign-in, and this path has no
- * fresher answer — the CLI does not sign in. Dropping it would silently show
- * a viewer the editing UI again, which is the exact experience the flag
+ * `role` and `expiresAt` are the prior fields carried across a relink (Cloud
+ * Phase 25 C2; `expiresAt` added 2026-09-03).
+ *
+ * `role` records what the workspace vouched for at sign-in, and this path has
+ * no fresher answer — the CLI does not sign in. Dropping it would silently
+ * show a viewer the editing UI again, which is the exact experience the flag
  * exists to prevent; a stale value costs a redundant hidden affordance and
- * self-corrects at the next workspace sign-in. Nothing ELSE is preserved:
- * `adoptedAt` is a per-machine attestation that a relink is entitled to clear.
+ * self-corrects at the next workspace sign-in.
+ *
+ * `expiresAt` is carried ONLY when the incoming token is byte-identical to the
+ * stored one — it describes the token, not the machine, so a new token
+ * invalidates it. Dropping it unconditionally is what left a linked project
+ * with no pre-expiry renewal timer at all.
+ *
+ * Nothing ELSE is preserved: `adoptedAt` is a per-machine attestation that a
+ * relink is entitled to clear.
  *
  * @param {{ adoptedAt?: number }} [extra]
  */
 export function addHub(url, token, extra = {}) {
   const norm = normalizeUrl(url);
   const cfg = loadHubsConfig();
-  const priorRole = cfg.hubs[norm]?.role;
+  const prior = cfg.hubs[norm];
+  const priorRole = prior?.role;
   // LOCAL CONSENT SURVIVES EVERY RE-SAVE. `role` is a cache of what the hub
   // said about you at sign-in; `codeModulesAllowed` is what YOU said about the
   // hub, and a login response must not be able to change it.
-  const priorConsent = cfg.hubs[norm]?.codeModulesAllowed;
+  const priorConsent = prior?.codeModulesAllowed;
+  // THE EXPIRY BELONGS TO THE TOKEN, so it survives exactly when the token does.
+  //
+  // `expiresAt` is written only by the sign-in and renew paths in
+  // `apps/studio/` — the CLI has never written it and, before this, never
+  // carried it either. So `maude design link --adopt` after a workspace
+  // sign-in silently dropped it, and a record with no expiry means
+  // `scheduleRenewal()` arms no timer at all (sync/index.ts): the credential
+  // then dies mid-session with nothing having tried to renew it.
+  //
+  // CONDITIONAL ON TOKEN IDENTITY, and that is the whole subtlety. Carrying it
+  // unconditionally would be worse than dropping it: a stale expiry against a
+  // NEW token arms the timer at the wrong instant and burns a slot in the
+  // `renewalsSinceProgress` cap for nothing. Same argument as `role` above —
+  // "this path has no fresher answer" — except that a relink CAN supply a new
+  // token, which is what makes the check necessary.
+  const priorExpiry = prior?.token === token ? prior?.expiresAt : undefined;
   cfg.hubs[norm] = {
     token,
     linkedAt: Date.now(),
     ...(priorRole ? { role: priorRole } : {}),
+    ...(typeof priorExpiry === 'number' ? { expiresAt: priorExpiry } : {}),
     ...(typeof priorConsent === 'boolean' ? { codeModulesAllowed: priorConsent } : {}),
     ...extra,
   };

package/cli/templates/harness/opencode/maude-projector.ts

@@ -0,0 +1,58 @@
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const inventoryPath = join(
+  dirname(fileURLToPath(import.meta.url)),
+  'maude-projector.inventory.json'
+);
+
+function mergeAbsent(target, additions) {
+  for (const [name, value] of Object.entries(additions ?? {})) {
+    if (!Object.hasOwn(target, name)) target[name] = value;
+  }
+}
+
+export async function MaudeProjectorPlugin() {
+  let inventory = null;
+  try {
+    inventory = JSON.parse(await readFile(inventoryPath, 'utf8'));
+  } catch {
+    return {};
+  }
+  if (inventory?.schemaVersion !== 1 || inventory.target !== 'opencode') return {};
+
+  for (const [name, value] of Object.entries(inventory.environment ?? {})) {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || typeof value !== 'string') continue;
+    const reference =
+      /^\$\{([A-Z_][A-Z0-9_]*)\}$/.exec(value)?.[1] ??
+      /^\{env:([A-Z_][A-Z0-9_]*)\}$/.exec(value)?.[1];
+    if (reference) {
+      if (process.env[reference] !== undefined) process.env[name] = process.env[reference];
+    } else {
+      process.env[name] = value;
+    }
+  }
+
+  return {
+    config: async (config) => {
+      config.agent ??= {};
+      config.command ??= {};
+      config.mcp ??= {};
+      config.permission ??= {};
+      mergeAbsent(config.agent, inventory.config.agent);
+      mergeAbsent(config.command, inventory.config.command);
+      mergeAbsent(config.mcp, inventory.config.mcp);
+      mergeAbsent(config.permission, inventory.config.permission);
+      config.instructions ??= [];
+      for (const path of inventory.config.instructions ?? []) {
+        if (!config.instructions.includes(path)) config.instructions.push(path);
+      }
+      config.skills ??= {};
+      config.skills.paths ??= [];
+      for (const path of inventory.config.skills?.paths ?? []) {
+        if (!config.skills.paths.includes(path)) config.skills.paths.push(path);
+      }
+    },
+  };
+}

package/docs/harness-capability-matrix.md

@@ -0,0 +1,125 @@
+# Harness Capability Matrix
+
+Reviewed: 2026-09-01
+
+This document freezes the initial semantic contract for projecting a Claude Code and Maude environment into OpenCode and Codex. Claude remains the authoring source. A target status describes one representation only; it is not a claim of full parity.
+
+## Tested Versions
+
+| Harness | Version | Verification |
+| --- | --- | --- |
+| Claude Code | 2.1.241 | Installed CLI plus current settings, hooks, subagent, skill, plugin, and MCP documentation. |
+| OpenCode | 1.18.25 | Installed CLI; `opencode debug config` run with isolated `HOME` and `XDG_CONFIG_HOME`. |
+| Codex | 0.152.0 | Installed CLI; generated config passed `codex --strict-config doctor --json` in an isolated `CODEX_HOME`. |
+
+Generated output is valid only for a target version accepted by the versioned capability registry. Unknown target versions fail `check` and do not mutate target state.
+
+## Status Contract
+
+- `native`: the target documents compatible representation and relevant semantics.
+- `degraded`: Maude can emit a narrower or differently-invoked representation and reports the exact loss.
+- `unsupported`: no safe equivalent exists; Maude emits no active behavior.
+- Security-relevant `degraded` records fail strict mode unless an explicit target override acknowledges that exact degradation.
+- Security-relevant `unsupported` records always fail strict mode.
+- Unknown capabilities fail closed and cannot be promoted by an override.
+
+## Capability Matrix
+
+| Source category | OpenCode | Codex | Fail-closed behavior |
+| --- | --- | --- | --- |
+| Global and project `CLAUDE.md` instructions | `native` fallback, `degraded` when a target instruction file shadows it | `native` through `project_doc_fallback_filenames`, `degraded` when `AGENTS.md` shadows it | Report the shadowing file; never overwrite or adopt it implicitly. |
+| Imported Claude instructions | `degraded` to explicit `instructions` paths/globs | `degraded` to the `AGENTS.md` chain or a generated reference | Preserve source order and report import-semantic differences. |
+| `.claude/rules/**/*.md` | `degraded` to scoped instruction globs | `degraded` to generated skill/instruction references | Do not claim Claude path-condition semantics when the target cannot enforce them. |
+| Scalar Claude settings | `degraded` per registered key | `degraded` per registered key and allowed scope | Unknown keys are reported and omitted. |
+| Map/list setting precedence | `degraded`; lower into OpenCode's merge layers | `degraded`; lower into Codex's CLI/project/profile/user/system layers | Retain all contributing sources; refuse ambiguous security conflicts. |
+| User/project marketplace plugin selection | `degraded`; lower individual compatible assets | `native` plugin lifecycle in the pre-launch bridge; `degraded` in static projection | Runtime mirrors preserve selected plugin identity; static projection never claims lifecycle parity. |
+| Claude custom commands | `degraded` to OpenCode commands | `degraded` to Codex skills/plugins | Preserve body and description; report frontmatter, argument, and invocation differences. |
+| Claude subagents | `degraded` to OpenCode agents | `unsupported`; Codex custom agents inherit the parent tool registry | Do not emit a role whose Claude tool restrictions cannot be enforced; remove previously managed roles and report them. |
+| Claude skills | `native` for target-valid `SKILL.md` assets | `native` for target-valid skills/plugin assets | Validate frontmatter and references; malformed skills are invalid source, not skipped. |
+| STDIO MCP | `native` local MCP | `native` STDIO MCP | Preserve command/args and environment references without spawning the server. |
+| Streamable HTTP MCP | `native` remote MCP | `native` HTTP MCP | Validate URL and reference syntax; never make a discovery-time request. |
+| Legacy SSE MCP | `degraded` to remote transport after compatibility validation | `degraded` to streamable HTTP after compatibility validation | Disabled unless endpoint compatibility is explicitly proven. |
+| Disabled MCP | `native` with `enabled: false` | `native` with `enabled: false` | A disabled source can never become enabled implicitly. |
+| MCP OAuth | `degraded`; target OAuth options differ | `degraded`; target OAuth options differ | Unsupported callback/client-secret fields remain disabled and reported. |
+| MCP headers and environment | `native` for `{env:NAME}`-style references after syntax conversion | `native` for target environment-backed header fields | Never interpolate variables; reject credential-shaped literals. |
+| Command hooks with equivalent event, input, output, blocking, timeout, and failure semantics | `degraded` through exact compatible plugin hooks | `native` only for proven Codex hook equivalents and persisted hook trust | Any failed equivalence dimension leaves the hook disabled. |
+| HTTP hooks | `unsupported` without a separately reviewed target-native implementation | `unsupported` | Emit no active hook and fail strict mode. |
+| Prompt hooks | `unsupported` | `unsupported` | Parse for inventory, emit no active hook, fail strict mode. |
+| Agent hooks | `unsupported` | `unsupported` | Parse for inventory, emit no active hook, fail strict mode. |
+| Unknown hook handlers | `unsupported` | `unsupported` | Preserve the source inventory record, emit no active hook, and fail strict mode. |
+| Hook matchers, output, and blocking decisions | `degraded` only when all semantics match | `degraded` only when all semantics match | Never approximate lifecycle events or discard hook output/errors. |
+| Permission allow rules | `degraded` per exactly expressible tool/path/command scope | `degraded` through approval, sandbox, and exec-policy intersections | A scoped rule can never become blanket allow. |
+| Permission ask rules | `degraded` where the target has the same approval boundary | `degraded` through approval policy plus sandbox/exec policy | If exact scope is unavailable, retain deny/default posture and report loss. |
+| Permission deny rules | `degraded` per exactly expressible scope | `degraded` through sandbox and exec-policy denial; runtime `Read(path)` rules become stricter filesystem denies | Deny wins; an unrepresentable deny blocks migration or keeps runtime bypass inert. |
+| Claude permission modes | `unsupported` as direct mappings | `degraded` to narrower approval/sandbox combinations; trusted runtime `bypassPermissions` uses a no-prompt permission profile | Static projection stays narrow. Runtime bypass activates only when every ask/deny rule is conservatively representable. |
+| Generic environment injection | `degraded` through a bounded thin plugin using references | `degraded` through shell environment policy and MCP-specific fields | Preserve names/references only; do not read current values. |
+| Keychain identifiers | `degraded` reference-only | `degraded` reference-only | Never read, copy, log, or back up resolved credentials. |
+| `.ai/` state | `degraded` reference/register in place | `degraded` reference/register in place | Never copy the state tree into target directories. |
+| `.design/` state | `degraded` reference/register in place | `degraded` reference/register in place | Never copy the state tree into target directories. |
+| kgai prompt integration | `degraded` through bounded target-native prompt/plugin wiring | `degraded` through bounded target-native instruction/hook wiring | Treat graph output as untrusted data; transcript-dependent behavior remains disabled. |
+| Target config ownership | `native` managed JSON entries/files through Maude manifest | `native` managed TOML entries/files through Maude manifest | Existing state requires preview and explicit adoption; external edits stop all writes. |
+
+## Precedence Findings
+
+Claude inputs are normalized from least to most specific while preserving every contributor: global instructions/settings/assets/MCP, user-enabled plugin assets, project instructions/settings/assets/MCP, project-enabled plugin assets, then `.claude/settings.local.json`. Claude settings lists generally accumulate, scalar/map conflicts prefer the higher-precedence layer, hooks accumulate, and permissions resolve deny before ask before allow.
+
+OpenCode merges remote, global, custom-config, project, `.opencode`, inline, managed, and MDM configuration layers. Later conflicting values win; the projector therefore owns individual entries and one thin plugin registration rather than replacing a complete `opencode.json`.
+
+Codex resolves CLI overrides, trusted project layers from root to current directory, the selected profile, user config, system config, and defaults, while managed requirements constrain the result. Project config cannot own provider/authentication, notification, profile-selection, or telemetry-routing settings.
+
+## TOML Writer Decision
+
+Codex managed merge will use exact-pinned `@decimalturn/toml-patch@3.0.5` under Node 20. It is dependency-free, supports TOML 1.1, and preserves comments, whitespace, formatting, and existing order. The writer must parse the complete existing document, mutate only manifest-owned keys in the parsed object, and patch the complete object back. Passing a partial object is forbidden because omitted user keys may be removed. Tests must cover comments, unknown keys, arrays of tables, idempotence, and malformed input.
+
+## Active Adapter Audit
+
+`~/Dotfiles/opencode/claude-parity.ts` is prior art, not a correctness oracle. The current adapter:
+
+- widens any scoped `Bash(...)` allow to blanket Bash access;
+- broadens `auto` and `bypassPermissions` to unrestricted read/edit/Bash/web/external-directory access;
+- drops ask rules, most deny rules, MCP permission rules, and unknown tools;
+- resolves `${NAME}` header references to live values;
+- silently ignores malformed JSON/frontmatter and unsupported agent fields;
+- approximates Claude `SessionStart`/`Stop`, runs discovered commands detached, and discards output/errors/timeouts/blocking behavior;
+- injects a Codex MCP with independent `approval_policy="never"` and `sandbox_mode="workspace-write"`;
+- has no ownership manifest, adoption, conflict detection, atomic transaction, rollback, or exhaustive inventory assertion.
+
+None of these behaviors may be carried into the projector.
+
+## Contract Transcript
+
+The T0 spike used isolated homes and did not load user secrets:
+
+```text
+$ claude --version
+2.1.241 (Claude Code)
+
+$ opencode --version
+1.18.25
+
+$ HOME=<isolated> XDG_CONFIG_HOME=<isolated> opencode debug config
+{ "$schema": "https://opencode.ai/config.json", "agent": {}, "plugin": [], "command": {} ... }
+
+$ codex --version
+codex-cli 0.152.0
+
+$ pnpm view @decimalturn/toml-patch version time.modified engines dependencies
+3.0.5; updated 2026-08-30; Node >=16; no dependencies
+```
+
+Executable conformance in later gates must use isolated `HOME`, `XDG_CONFIG_HOME`, and `CODEX_HOME`, committed safe fixtures, and no arbitrary discovered hooks.
+
+## Sources
+
+- [Claude Code settings](https://docs.anthropic.com/en/docs/claude-code/settings)
+- [Claude Code hooks](https://docs.anthropic.com/en/docs/claude-code/hooks)
+- [Claude Code subagents](https://docs.anthropic.com/en/docs/claude-code/sub-agents)
+- [Claude Code skills](https://docs.anthropic.com/en/docs/claude-code/skills)
+- [OpenCode configuration](https://opencode.ai/docs/config/)
+- [OpenCode plugins](https://opencode.ai/docs/plugins/)
+- [OpenCode configuration source](https://github.com/anomalyco/opencode/blob/dev/packages/core/src/config.ts)
+- [Codex configuration reference](https://developers.openai.com/codex/config-file/config-reference)
+- [Codex AGENTS.md discovery](https://developers.openai.com/codex/agent-configuration/agents-md)
+- [Codex hooks](https://developers.openai.com/codex/hooks)
+- [Codex skills](https://developers.openai.com/codex/build-skills)
+- [`@decimalturn/toml-patch`](https://www.npmjs.com/package/@decimalturn/toml-patch)

package/docs/harness-environment-projection.md

@@ -0,0 +1,95 @@
+# Harness environment projection
+
+Claude Code and Maude remain the authoring source. `maude harness` generates managed,
+target-native OpenCode and Codex files without resolving secret references or copying
+`.ai` and `.design` state.
+
+Every command requires exactly one scope: `--global` or `--project <root>`. Projection
+verbs require `--targets opencode,codex`; `adopt` and `remove` require one `--target`.
+
+```sh
+maude harness migrate --from claude --targets opencode,codex --project .
+maude harness migrate --from claude --targets opencode,codex --project . --yes
+maude harness sync --targets opencode,codex --project .
+maude harness check --targets opencode,codex --project . --strict --json
+maude harness status --project . --json
+```
+
+`migrate`, `diff`, and `adopt` preview by default. Mutations run only after complete
+target-specific validation and confirmation or `--yes`. Confirmation never overrides
+literal-secret rejection, unsupported security semantics, invalid sources or targets,
+or ownership conflicts. `sync` commits all requested targets in one managed transaction.
+
+Machine-local ownership, backups, recovery material, and manifests live below
+`~/.config/maude/harness/`. `remove` touches manifest-owned output only and restores an
+adopted backup when present. Generated reports contain references and hashes, not secret
+values.
+
+Exit codes are stable: `0` clean/success, `1` drift or declined preview, `2` usage,
+`3` strict/unsupported security failure, `4` ownership conflict, `5` invalid source,
+`6` invalid target/config/version, and `7` interrupted transaction or required recovery.
+
+No postinstall, startup, plugin hook, or `maude init` path invokes harness mutation.
+
+## Codex pre-launch bridge
+
+`maude codex [args...]` is a separate machine-local bridge for daily Codex use. Before
+launching the real Codex executable it reads the effective Claude plugin selection for
+the current project when Codex marks that project trusted (otherwise only global Claude
+selection applies), materializes owner-only runtime marketplace mirrors below
+`~/.config/maude/harness/codex-runtime/`, and reconciles those plugins through Codex's
+native `plugin marketplace` and `plugin add/remove` commands. `maude codex sync --json`
+performs the same reconciliation without starting a session.
+
+For a Codex-trusted project whose effective Claude settings select
+`permissions.defaultMode: "bypassPermissions"`, the bridge adds a launch-only Codex
+permission profile with `approval_policy="never"`, root filesystem write access, and
+full network access. Claude `Read(path)` deny rules become stricter Codex filesystem
+denies. Any Claude ask rule or unrepresentable deny keeps runtime bypass inert. These
+overrides are passed on the command line and are not persisted. A pre-existing
+`sandbox_mode`, an explicit sandbox/permission-profile override, a remote target, or an
+ambiguous working-directory override keeps the launch fail-closed so the deny profile
+cannot be silently disabled. Any `-C`/`--cd` path is authorized first and then forwarded
+only in canonical form; path identity and trust are checked again immediately before
+launch. Runtime-only defaults such as the skill context budget are also passed as CLI
+overrides instead of rewriting user-owned Codex config.
+
+`-C` and `--cd` are resolved before project trust and settings discovery, so authority
+cannot be borrowed from one project and applied to another. Remote and Codex Cloud
+sessions are rejected before runtime reconciliation, so local plugins, MCP state, and
+permissions are never mutated for a remote launch. Runtime reconciliation is serialized
+by the same crash-safe scope-lock primitive used by transactional harness writes.
+
+Claude commands are exposed as namespaced Codex skills. Claude agents are reported but
+not installed: Codex custom agents inherit the parent's tool registry, so a read-only
+sandbox cannot enforce Claude agent tool restrictions. The bridge removes role files it
+managed before this limitation was proven. Standalone Claude MCP servers are merged with
+plugin MCP servers. Bearer credentials must reference an environment variable or exactly
+match one already present in the launch environment; credential values are never pooled
+into bridge state or persisted config. The current Codex CLI cannot write pass-through
+environment names for STDIO MCP servers without materializing values, so the runtime bridge
+rejects those entries; the transactional `maude harness` lowerer remains the supported path.
+
+The bridge never writes into the current repository and does not copy `.ai` or `.design`.
+A `CODEX_HOME` inside the current project is rejected rather than weakening that boundary.
+A shell launcher may safely shadow the real Codex binary when it sets
+`MAUDE_CODEX_REAL` to that binary before executing `maude codex`. This runtime path
+complements the explicit, transactional `maude harness` migration workflow; it does not
+adopt repository files or retire existing adapters by itself.
+
+Real-workspace conformance can keep sources and generated target files physically
+separate: set `MAUDE_HARNESS_SOURCE_HOME` to the read-only Claude source home and
+`MAUDE_HARNESS_PROJECT_TARGET_ROOT` to a temporary project target root. These are
+diagnostic/operator controls; normal migration should leave both unset. A temporary
+source mirror may set the path-delimited `MAUDE_HARNESS_ALLOWED_PLUGIN_ROOTS` to
+explicit read-only plugin cache roots referenced by its installation index.
+
+The npm package contains the harness command, lowerers, capability/compatibility registry,
+OpenCode runtime template, and Codex pre-launch bridge. Test fixtures, tests, backups, machine-local manifests,
+logs, workspace metadata, and secrets are not part of that published harness surface.
+
+Harness output is version-locked to the target versions listed by the capability registry
+and to the machine-local manifest schema. `check` refuses an unsupported target or schema
+before writing anything and prints two recovery choices: upgrade Maude for a newer registry,
+or install the target version supported by the current Maude release. Never delete an
+incompatible manifest or its backups as an upgrade shortcut.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "1.0.11",
+  "version": "1.2.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -51,20 +51,39 @@
     "test:e2e:desktop:onboarding": "pnpm --filter @maude/desktop-e2e e2e:onboarding",
     "test:e2e:desktop:acp-cold-start": "pnpm --filter @maude/desktop-e2e e2e:acp-cold-start",
     "test:e2e:desktop:parity": "pnpm --filter @maude/desktop-e2e e2e:parity",
+    "test:e2e:desktop:sidecar-respawn": "pnpm --filter @maude/desktop-e2e e2e:sidecar-respawn",
     "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "1.0.11",
-    "@1agh/maude-darwin-x64": "1.0.11",
-    "@1agh/maude-linux-arm64": "1.0.11",
-    "@1agh/maude-linux-arm64-musl": "1.0.11",
-    "@1agh/maude-linux-x64": "1.0.11",
-    "@1agh/maude-linux-x64-musl": "1.0.11",
-    "@1agh/maude-win32-x64": "1.0.11"
+    "@1agh/maude-darwin-arm64": "1.2.0",
+    "@1agh/maude-darwin-x64": "1.2.0",
+    "@1agh/maude-linux-arm64": "1.2.0",
+    "@1agh/maude-linux-arm64-musl": "1.2.0",
+    "@1agh/maude-linux-x64": "1.2.0",
+    "@1agh/maude-linux-x64-musl": "1.2.0",
+    "@1agh/maude-win32-x64": "1.2.0"
   },
   "files": [
     "cli",
+    "!cli/.platform-binary-path",
+    "!cli/**/*.test.mjs",
+    "!cli/fixtures",
+    "!cli/**/fixtures",
+    "!cli/**/backups",
+    "!cli/**/logs",
+    "!cli/**/.DS_Store",
     "apps/studio",
+    "!apps/studio/.ai",
+    "!apps/studio/bun.lock",
+    "!apps/studio/test",
+    "!apps/studio/**/test",
+    "!apps/studio/**/tests",
+    "!apps/studio/**/fixtures",
+    "!apps/studio/**/backups",
+    "!apps/studio/**/logs",
+    "!apps/studio/**/*.test.*",
+    "!apps/studio/**/*.spec.*",
+    "!apps/studio/**/.DS_Store",
     "plugins/design/dependencies.json",
     "plugins/design/dependencies.schema.json",
     "plugins/design/templates",
@@ -72,6 +91,8 @@
     "plugins/flow/dependencies.schema.json",
     "plugins/flow/templates",
     "plugins/flow/.claude-plugin/config.schema.json",
+    "docs/harness-capability-matrix.md",
+    "docs/harness-environment-projection.md",
     "LICENSE",
     "README.md"
   ],
@@ -104,9 +125,11 @@
     "lucide-react": "^1.24.0"
   },
   "dependencies": {
+    "@decimalturn/toml-patch": "3.0.5",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "happy-dom": "20.10.6",
-    "svgo": "^4.0.1"
+    "svgo": "^4.0.1",
+    "yaml": "2.9.0"
   }
 }

package/plugins/flow/.claude-plugin/config.schema.json

@@ -459,6 +459,14 @@
         "minLength": 1
       }
     },
+    "qualityScoped": {
+      "type": "object",
+      "description": "Scoped (changed-files / changed-packages-only) gate variants for the IMPLEMENTATION inner loop (`/flow:utils-verify`, per-task `/flow:execute`, `/flow:bug-fix`). Same flat shape as `quality` — gate name → shell command string, keys mirror `quality` (conventionally `lint`, `format`, `typecheck`, `tests`). During implementation these run INSTEAD of the repo-wide `quality.*` commands; a missing key means the inner loop defers that gate to `/flow:validate` (it never falls back to the repo-wide command). `/flow:validate` and `/flow:done` ignore this block entirely — the full `quality.*` pipeline remains the single outer gate. Monorepo example: `\"lint\": \"turbo run lint --filter='[origin/main]'\"` — note changed-only `[base]`, NOT dependents-inclusive `...[base]`, which selects nearly the whole monorepo whenever a shared package is touched; dependent breakage is `/flow:validate`'s job.",
+      "additionalProperties": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
     "integrations": {
       "type": "object",
       "additionalProperties": false,

package/apps/studio/.ai/cache/_stats.json

@@ -1,7 +0,0 @@
-{
-  "hits": {},
-  "misses": {
-    "security": 2
-  },
-  "since": 1783681711349
-}

package/apps/studio/bin/_agent-browser-safe.test.mjs

@@ -1,165 +0,0 @@
-// DDR-185 security addendum, round 3 — the hardened agent-browser wrapper
-// behind `maude design agent-browser-safe`
-// (apps/studio/bin/_agent-browser-safe.mjs). This suite locks the SECURITY
-// CORE: the closed subcommand allow-list (no cookies/clipboard/storage/
-// connect/chat/eval reachable — `eval` was REMOVED in round 3, see below),
-// the fixed positional-argument ARITY per subcommand with NO flag
-// vocabulary at all, and the `--config`-pin + full env-clearing that closes
-// the project-level `agent-browser.json` auto-discovery bypass a live
-// adversarial pass found round 2 never considered.
-
-import { describe, expect, test } from 'bun:test';
-import { readFileSync } from 'node:fs';
-import {
-  ALLOWED_SUBCOMMANDS,
-  CLEARED_ENV_KEYS,
-  SUBCOMMAND_ARITY,
-  validateArgv,
-} from './_agent-browser-safe.mjs';
-
-describe('validateArgv — subcommand allow-list', () => {
-  for (const sub of ALLOWED_SUBCOMMANDS) {
-    test(`accepts "${sub}" with its minimum expected argument count`, () => {
-      const [min] = SUBCOMMAND_ARITY[sub];
-      const args = Array.from({ length: min }, (_, i) => `arg${i}`);
-      expect(validateArgv([sub, ...args])).toBeNull();
-    });
-  }
-
-  test('round 3: "eval" is REMOVED — arbitrary JS execution can\'t be argv-constrained (ethical-hacker Finding 1)', () => {
-    // Round 2 kept eval on the allow-list; a live adversarial pass proved
-    // eval defeats --allowed-domains entirely (window.location.href escapes
-    // the navigation gate; a no-cors fetch() exfiltrates without even
-    // needing a domain match) — no argv check can close that, so the
-    // capability itself is cut, mirroring this DDR's own `find` precedent.
-    expect(ALLOWED_SUBCOMMANDS).not.toContain('eval');
-    const reason = validateArgv(['eval', '1+1']);
-    expect(reason).toContain('eval');
-  });
-
-  for (const sub of [
-    'cookies',
-    'clipboard',
-    'storage',
-    'connect',
-    'chat',
-    'upload',
-    'auth',
-    'profiles',
-  ]) {
-    test(`rejects the credential/session-hijack-capable subcommand "${sub}" (ethical-hacker Finding D)`, () => {
-      const reason = validateArgv([sub, 'get']);
-      expect(reason).toContain(sub);
-    });
-  }
-
-  test('rejects when no subcommand is given', () => {
-    expect(validateArgv([])).not.toBeNull();
-  });
-});
-
-describe('validateArgv — fixed arity, NO flag vocabulary at all', () => {
-  test('rejects an extra argument beyond the expected arity, whatever it looks like', () => {
-    const reason = validateArgv(['open', 'http://localhost:1', 'extra']);
-    expect(reason).toContain('exactly 1');
-  });
-
-  test('rejects the --provider/-p remote-cloud-browser PoC verbatim (round-2 finding)', () => {
-    expect(
-      validateArgv(['open', 'http://localhost:1', '--provider', 'browserbase'])
-    ).not.toBeNull();
-    expect(validateArgv(['open', '-p', 'browserbase', 'http://localhost:1'])).not.toBeNull();
-  });
-
-  test('rejects the persistent-profile PoC verbatim (still closed under the arity model)', () => {
-    expect(
-      validateArgv(['open', '--profile', 'Default', 'https://github.com/settings/tokens'])
-    ).not.toBeNull();
-  });
-
-  test('rejects the CDP-attach PoC verbatim (still closed under the arity model)', () => {
-    expect(validateArgv(['snapshot', '--cdp', '9222'])).not.toBeNull();
-  });
-
-  test('a positional value that itself starts with "-" is NOT mistaken for a flag (arity-based, not prefix-based)', () => {
-    // agent-browser-safe get "-weird-thing" must still work — the arity
-    // model looks at COUNT, not at whether a token happens to start with a
-    // dash.
-    expect(validateArgv(['get', '-weird-thing'])).toBeNull();
-  });
-
-  test('screenshot accepts 0 or 1 positional args (optional path)', () => {
-    expect(validateArgv(['screenshot'])).toBeNull();
-    expect(validateArgv(['screenshot', '/tmp/out.png'])).toBeNull();
-    expect(validateArgv(['screenshot', '/tmp/out.png', 'extra'])).not.toBeNull();
-  });
-
-  test('get accepts 1 or 2 positional args (thing + optional selector)', () => {
-    expect(validateArgv(['get', 'text'])).toBeNull();
-    expect(validateArgv(['get', 'text', '.selector'])).toBeNull();
-    expect(validateArgv(['get'])).not.toBeNull();
-  });
-
-  test('snapshot and close accept exactly 0 arguments', () => {
-    expect(validateArgv(['snapshot'])).toBeNull();
-    expect(validateArgv(['snapshot', '-i'])).not.toBeNull();
-    expect(validateArgv(['close'])).toBeNull();
-    expect(validateArgv(['close', '--all'])).not.toBeNull();
-  });
-
-  test('an ordinary allowed invocation with no extra args passes', () => {
-    expect(validateArgv(['open', 'http://localhost:3000/'])).toBeNull();
-    expect(validateArgv(['screenshot', '/tmp/out.png'])).toBeNull();
-  });
-});
-
-describe('CLEARED_ENV_KEYS', () => {
-  test('round 3: covers AGENT_BROWSER_CONFIG (defense in depth alongside the --config pin)', () => {
-    expect(CLEARED_ENV_KEYS).toContain('AGENT_BROWSER_CONFIG');
-  });
-
-  test('round 2: covers the three vars a live verification pass found missing from round 1', () => {
-    for (const key of [
-      'AGENT_BROWSER_AUTO_CONNECT',
-      'AGENT_BROWSER_PROXY',
-      'AGENT_BROWSER_ENGINE',
-    ]) {
-      expect(CLEARED_ENV_KEYS).toContain(key);
-    }
-  });
-
-  test('covers all four standard proxy env vars, both cases', () => {
-    for (const key of [
-      'HTTP_PROXY',
-      'HTTPS_PROXY',
-      'ALL_PROXY',
-      'http_proxy',
-      'https_proxy',
-      'all_proxy',
-    ]) {
-      expect(CLEARED_ENV_KEYS).toContain(key);
-    }
-  });
-
-  test('still covers the original round-1 set', () => {
-    for (const key of [
-      'AGENT_BROWSER_PROFILE',
-      'AGENT_BROWSER_SESSION_NAME',
-      'AGENT_BROWSER_ACTION_POLICY',
-      'AGENT_BROWSER_CONFIRM_ACTIONS',
-      'AGENT_BROWSER_CONFIRM_INTERACTIVE',
-    ]) {
-      expect(CLEARED_ENV_KEYS).toContain(key);
-    }
-  });
-});
-
-describe('the forced --config target (round 3: closes ./agent-browser.json auto-discovery)', () => {
-  test('_agent-browser-safe-config.json exists and is valid, empty JSON', () => {
-    // Must stay valid JSON — agent-browser exits with an error if --config
-    // points to a missing/invalid file, which would break every allowed
-    // subcommand, not just fail safe.
-    const raw = readFileSync(new URL('./_agent-browser-safe-config.json', import.meta.url), 'utf8');
-    expect(JSON.parse(raw)).toEqual({});
-  });
-});