@dungle-scrubs/harness-cli-normalizer 0.3.1 → 0.4.0

package/dist/knowledge/muse.js

@@ -109,5 +109,24 @@ export const museCode = deepFreeze({
             render: { kind: "flag-value", flag: "--max-model-steps" },
         },
     },
+    // Phase 0 fixtures: muse-category-flags.md. No name lists; category
+    // switches are enforcement gates - tools stay listed in the catalog but
+    // calls are denied per session policy (unlike claude's set removal).
+    // Tool names follow muse.<name> (write_file, edit_file, bash, bash_input,
+    // add_memory, edit_memory, web_search). --disable-web-tools has no
+    // normalized turnOption yet - candidate for a web toggle or passthrough.
+    tools: {
+        includeFlag: null,
+        excludeFlag: null,
+        includeIsStrictAllowlist: false,
+        composable: false,
+        builtins: [],
+        categories: [
+            { key: "write", disableFlag: "--disable-write", configKey: null },
+            { key: "shell", disableFlag: "--disable-shell", configKey: null },
+            { key: "web", disableFlag: "--disable-web-tools", configKey: null },
+        ],
+        denySemantics: "policy-gate",
+    },
 });
 //# sourceMappingURL=muse.js.map

package/dist/knowledge/muse.js.map

@@ -1 +1 @@
-{"version":3,"file":"muse.js","sourceRoot":"","sources":["../../src/knowledge/muse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAA0B,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE5E,MAAM,CAAC,MAAM,QAAQ,GAAsB,UAAU,CAAC;IACpD,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,eAAe,EAAE,OAAO;IACxB,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,aAAa,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACpC,MAAM,EAAE;QACN,uEAAuE;QACvE,kDAAkD;QAClD,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC7B,WAAW,EAAE,CAAC,MAAM,CAAC;QACrB,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,cAAc;KACvB;IACD,MAAM,EAAE;QACN,sEAAsE;QACtE,yDAAyD;QACzD,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,QAAQ;QACnB,0DAA0D;QAC1D,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,mBAAmB,EAAE,QAAQ;KAC9B;IACD,WAAW,EAAE,IAAI;IACjB,MAAM,EAAE;QACN,mEAAmE;QACnE,0DAA0D;QAC1D,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QACnD,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,EAAE;KAChB;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,iBAAiB;QAC5B,4DAA4D;QAC5D,uEAAuE;QACvE,+DAA+D;QAC/D,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;KAC9C;IACD,aAAa,EAAE,CAAC,GAAG,qBAAqB,CAAC;IACzC,YAAY,EAAE,CAAC,GAAG,oBAAoB,CAAC;IACvC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,UAAU,EAAE;QACV,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE,CAAC,4BAA4B,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;QAC1E,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;QAC9D,UAAU,EAAE,KAAK;KAClB;IACD,KAAK,EAAE;QACL,uEAAuE;QACvE,gEAAgE;QAChE,mDAAmD;QACnD,QAAQ,EAAE,mCAAmC;QAC7C,OAAO,EAAE,UAAU;KACpB;IACD,WAAW,EAAE,IAAI;IACjB,oDAAoD;IACpD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE;QACR,eAAe,EAAE,CAAC,MAAM,CAAC;KAC1B;IACD,YAAY,EAAE;QACZ,uEAAuE;QACvE,mDAAmD;QACnD,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;QACb,eAAe,EAAE;YACf,eAAe,EAAE,OAAO;YACxB,kBAAkB,EAAE,MAAM;YAC1B,WAAW,EAAE,MAAM;SACpB;QACD,OAAO,EAAE,KAAK;KACf;IACD,WAAW,EAAE;QACX,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE;QACtF,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE;SAC1D;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE;SAC1D;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,KAAK;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE;SAC1D;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"muse.js","sourceRoot":"","sources":["../../src/knowledge/muse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAA0B,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE5E,MAAM,CAAC,MAAM,QAAQ,GAAsB,UAAU,CAAC;IACpD,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,eAAe,EAAE,OAAO;IACxB,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,aAAa,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACpC,MAAM,EAAE;QACN,uEAAuE;QACvE,kDAAkD;QAClD,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC7B,WAAW,EAAE,CAAC,MAAM,CAAC;QACrB,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,cAAc;KACvB;IACD,MAAM,EAAE;QACN,sEAAsE;QACtE,yDAAyD;QACzD,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,QAAQ;QACnB,0DAA0D;QAC1D,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,mBAAmB,EAAE,QAAQ;KAC9B;IACD,WAAW,EAAE,IAAI;IACjB,MAAM,EAAE;QACN,mEAAmE;QACnE,0DAA0D;QAC1D,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QACnD,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,EAAE;KAChB;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,iBAAiB;QAC5B,4DAA4D;QAC5D,uEAAuE;QACvE,+DAA+D;QAC/D,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;KAC9C;IACD,aAAa,EAAE,CAAC,GAAG,qBAAqB,CAAC;IACzC,YAAY,EAAE,CAAC,GAAG,oBAAoB,CAAC;IACvC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,UAAU,EAAE;QACV,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE,CAAC,4BAA4B,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;QAC1E,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;QAC9D,UAAU,EAAE,KAAK;KAClB;IACD,KAAK,EAAE;QACL,uEAAuE;QACvE,gEAAgE;QAChE,mDAAmD;QACnD,QAAQ,EAAE,mCAAmC;QAC7C,OAAO,EAAE,UAAU;KACpB;IACD,WAAW,EAAE,IAAI;IACjB,oDAAoD;IACpD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE;QACR,eAAe,EAAE,CAAC,MAAM,CAAC;KAC1B;IACD,YAAY,EAAE;QACZ,uEAAuE;QACvE,mDAAmD;QACnD,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;QACb,eAAe,EAAE;YACf,eAAe,EAAE,OAAO;YACxB,kBAAkB,EAAE,MAAM;YAC1B,WAAW,EAAE,MAAM;SACpB;QACD,OAAO,EAAE,KAAK;KACf;IACD,WAAW,EAAE;QACX,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE;QACtF,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE;SAC1D;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE;SAC1D;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,KAAK;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE;SAC1D;KACF;IACD,oEAAoE;IACpE,wEAAwE;IACxE,qEAAqE;IACrE,0EAA0E;IAC1E,mEAAmE;IACnE,yEAAyE;IACzE,KAAK,EAAE;QACL,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,wBAAwB,EAAE,KAAK;QAC/B,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE;YACV,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE;YACjE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE;YACjE,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE;SACpE;QACD,aAAa,EAAE,aAAa;KAC7B;CACF,CAAC,CAAC"}

package/dist/knowledge/pi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../../src/knowledge/pi.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAc,KAAK,iBAAiB,EAAc,MAAM,iBAAiB,CAAC;AAGjF,eAAO,MAAM,KAAK,EAAE,iBA6GlB,CAAC"}
+{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../../src/knowledge/pi.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAc,KAAK,iBAAiB,EAAc,MAAM,iBAAiB,CAAC;AAGjF,eAAO,MAAM,KAAK,EAAE,iBAkIlB,CAAC"}

package/dist/knowledge/pi.js

@@ -117,5 +117,26 @@ export const piCli = deepFreeze({
             },
         },
     },
+    // Phase 0 fixtures: pi-both-tool-flags.md. Both list flags legal at once;
+    // exclude subtracts from include. --tools is strict over BUILT-INS but
+    // does not strip MCP/extension registrations (additive over them);
+    // -nbt (built-ins only off) exists but has no normalized spelling yet.
+    tools: {
+        includeFlag: "--tools",
+        excludeFlag: "--exclude-tools",
+        includeIsStrictAllowlist: true,
+        composable: true,
+        builtins: [
+            { name: "read", defaultEnabled: true },
+            { name: "bash", defaultEnabled: true },
+            { name: "edit", defaultEnabled: true },
+            { name: "write", defaultEnabled: true },
+            { name: "grep", defaultEnabled: false },
+            { name: "find", defaultEnabled: false },
+            { name: "ls", defaultEnabled: false },
+        ],
+        categories: [],
+        denySemantics: "remove-from-set",
+    },
 });
 //# sourceMappingURL=pi.js.map

package/dist/knowledge/pi.js.map

@@ -1 +1 @@
-{"version":3,"file":"pi.js","sourceRoot":"","sources":["../../src/knowledge/pi.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAA0B,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE5E,MAAM,CAAC,MAAM,KAAK,GAAsB,UAAU,CAAC;IACjD,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,IAAI;IACT,eAAe,EAAE,QAAQ;IACzB,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE;IAC1E,MAAM,EAAE;QACN,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,yDAAyD;QACzD,SAAS,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;QACnC,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,cAAc;KACvB;IACD,MAAM,EAAE;QACN,uEAAuE;QACvE,qEAAqE;QACrE,yDAAyD;QACzD,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;KACrC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,UAAU;IACV,WAAW,EAAE,IAAI;IACjB,MAAM,EAAE;QACN,mEAAmE;QACnE,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QAC3D,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,EAAE;KAChB;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,iBAAiB;QAC5B,wEAAwE;QACxE,0EAA0E;QAC1E,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KACxD;IACD,aAAa,EAAE,CAAC,GAAG,qBAAqB,CAAC;IACzC,YAAY,EAAE,CAAC,GAAG,oBAAoB,CAAC;IACvC,QAAQ,EAAE,IAAI;IACd,UAAU,EAAE;QACV,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE,CAAC,aAAa,CAAC;QACvB,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,oDAAoD;QACpD,UAAU,EAAE,IAAI;KACjB;IACD,KAAK,EAAE;QACL,wEAAwE;QACxE,kEAAkE;QAClE,sEAAsE;QACtE,4CAA4C;QAC5C,QAAQ,EAAE,+BAA+B;QACzC,OAAO,EAAE,iBAAiB;KAC3B;IACD,WAAW,EAAE,IAAI;IACjB,UAAU,EAAE,IAAI;IAChB,KAAK,EAAE,gBAAgB;IACvB,QAAQ,EAAE;QACR,eAAe,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC;KACnC;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;QACb,eAAe,EAAE;YACf,eAAe,EAAE,OAAO;YACxB,kBAAkB,EAAE,MAAM;YAC1B,WAAW,EAAE,MAAM;SACpB;QACD,OAAO,EAAE,KAAK;KACf;IACD,WAAW,EAAE;QACX,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE;QAC9E,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE;QAClF,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE;gBACN,KAAK,EAAE;oBACL,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;iBAC9C;gBACD,gBAAgB,EAAE;oBAChB,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;iBAC9C;gBACD,UAAU,EAAE;oBACV,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;iBAC9C;gBACD,MAAM,EAAE;oBACN,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;iBAC9C;aACF;SACF;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"pi.js","sourceRoot":"","sources":["../../src/knowledge/pi.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAA0B,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE5E,MAAM,CAAC,MAAM,KAAK,GAAsB,UAAU,CAAC;IACjD,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,IAAI;IACT,eAAe,EAAE,QAAQ;IACzB,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE;IAC1E,MAAM,EAAE;QACN,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,yDAAyD;QACzD,SAAS,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;QACnC,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,cAAc;KACvB;IACD,MAAM,EAAE;QACN,uEAAuE;QACvE,qEAAqE;QACrE,yDAAyD;QACzD,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;KACrC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,UAAU;IACV,WAAW,EAAE,IAAI;IACjB,MAAM,EAAE;QACN,mEAAmE;QACnE,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QAC3D,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,EAAE;KAChB;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,iBAAiB;QAC5B,wEAAwE;QACxE,0EAA0E;QAC1E,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KACxD;IACD,aAAa,EAAE,CAAC,GAAG,qBAAqB,CAAC;IACzC,YAAY,EAAE,CAAC,GAAG,oBAAoB,CAAC;IACvC,QAAQ,EAAE,IAAI;IACd,UAAU,EAAE;QACV,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE,CAAC,aAAa,CAAC;QACvB,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,oDAAoD;QACpD,UAAU,EAAE,IAAI;KACjB;IACD,KAAK,EAAE;QACL,wEAAwE;QACxE,kEAAkE;QAClE,sEAAsE;QACtE,4CAA4C;QAC5C,QAAQ,EAAE,+BAA+B;QACzC,OAAO,EAAE,iBAAiB;KAC3B;IACD,WAAW,EAAE,IAAI;IACjB,UAAU,EAAE,IAAI;IAChB,KAAK,EAAE,gBAAgB;IACvB,QAAQ,EAAE;QACR,eAAe,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC;KACnC;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;QACb,eAAe,EAAE;YACf,eAAe,EAAE,OAAO;YACxB,kBAAkB,EAAE,MAAM;YAC1B,WAAW,EAAE,MAAM;SACpB;QACD,OAAO,EAAE,KAAK;KACf;IACD,WAAW,EAAE;QACX,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE;QAC9E,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE;QAClF,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE;gBACN,KAAK,EAAE;oBACL,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;iBAC9C;gBACD,gBAAgB,EAAE;oBAChB,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;iBAC9C;gBACD,UAAU,EAAE;oBACV,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;iBAC9C;gBACD,MAAM,EAAE;oBACN,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;iBAC9C;aACF;SACF;KACF;IACD,0EAA0E;IAC1E,uEAAuE;IACvE,mEAAmE;IACnE,uEAAuE;IACvE,KAAK,EAAE;QACL,WAAW,EAAE,SAAS;QACtB,WAAW,EAAE,iBAAiB;QAC9B,wBAAwB,EAAE,IAAI;QAC9B,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE;YACtC,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE;YACtC,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE;YACtC,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE;YACvC,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE;YACvC,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE;YACvC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE;SACtC;QACD,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,iBAAiB;KACjC;CACF,CAAC,CAAC"}

package/dist/knowledge/profile.d.ts

@@ -0,0 +1,13 @@
+export declare const DEFAULT_TURN_PROFILE: {
+    readonly effort: "medium";
+    readonly sandbox: "workspace-write";
+    readonly discovery: {
+        readonly tools: true;
+        readonly instructionFiles: true;
+        readonly extensions: true;
+        readonly skills: true;
+    };
+    readonly autonomy: false;
+};
+export type ProfileKey = keyof typeof DEFAULT_TURN_PROFILE;
+//# sourceMappingURL=profile.d.ts.map

package/dist/knowledge/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/knowledge/profile.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,oBAAoB;qBACvB,QAAQ;sBAKP,iBAAiB;;iBAMb,KAAK;iBAAQ,gBAAgB;iBAAQ,UAAU;iBAAQ,MAAM;;;CAIjE,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,oBAAoB,CAAC"}

package/dist/knowledge/profile.js

@@ -0,0 +1,31 @@
+/**
+ * The built-in default turn profile: hcn's curated defaults for a bare run,
+ * decided in review (2026-08-18) and applied LAUNCH-ONLY, before user config
+ * and args. Every entry here is a ratified dimension; unratified dimensions
+ * stay absent and defer to the harness.
+ *
+ * effort: "medium" - the only value present in all four effort ladders
+ * (claude/pi/muse/codex-per-model). Live probe on claude 2.1.233 showed the
+ * internal default is above medium and nondeterministic (599-1482 thinking
+ * tokens on identical tasks vs 436 at medium); pinning makes bare runs
+ * cheaper on claude, uniform everywhere, and knowable from the outside.
+ */
+import { deepFreeze } from "./descriptor.js";
+export const DEFAULT_TURN_PROFILE = deepFreeze({
+    effort: "medium",
+    // codex-only (the only harness with a sandbox dimension). Promotes the
+    // descriptor's implicit workspace-write default into the visible
+    // profile tier. On the other three the dimension is unrenderable and
+    // reports as divergence.
+    sandbox: "workspace-write",
+    // Ratified: discovery fully ON. The harnesses' bare runs already
+    // discover instruction files, skills, and extensions; the profile makes
+    // that a stated contract. The off-spellings exist per harness
+    // (-ns/-nc/-ne on pi, --setting-sources on claude) for callers who want
+    // less.
+    discovery: { tools: true, instructionFiles: true, extensions: true, skills: true },
+    // Ratified: autonomy OFF. No bare run is unattended; --autonomy or a
+    // config must say so deliberately.
+    autonomy: false,
+});
+//# sourceMappingURL=profile.js.map

package/dist/knowledge/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/knowledge/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;IAC7C,MAAM,EAAE,QAAQ;IAChB,uEAAuE;IACvE,iEAAiE;IACjE,qEAAqE;IACrE,yBAAyB;IACzB,OAAO,EAAE,iBAAiB;IAC1B,iEAAiE;IACjE,wEAAwE;IACxE,8DAA8D;IAC9D,wEAAwE;IACxE,QAAQ;IACR,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IAClF,qEAAqE;IACrE,mCAAmC;IACnC,QAAQ,EAAE,KAAK;CACP,CAAC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dungle-scrubs/harness-cli-normalizer",
-  "version": "0.3.1",
-  "description": "One stable interface to four coding-agent CLIs.",
+  "version": "0.4.0",
+  "description": "One stable CLI to four coding-agent harnesses: normalized flags, defaults, and events.",
   "license": "MIT",
   "author": "Kevin Frilot",
   "repository": {
@@ -13,27 +13,6 @@
   "bin": {
     "hcn": "./dist/cli.js"
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
-    "./knowledge": {
-      "types": "./dist/knowledge/index.d.ts",
-      "import": "./dist/knowledge/index.js"
-    },
-    "./interpretation": {
-      "types": "./dist/interpretation/index.d.ts",
-      "import": "./dist/interpretation/index.js"
-    },
-    "./execution": {
-      "types": "./dist/execution/index.d.ts",
-      "import": "./dist/execution/index.js"
-    },
-    "./package.json": "./package.json"
-  },
   "files": [
     "dist",
     "src"

package/src/cli/args.ts

@@ -162,6 +162,10 @@ export const parseTurnOptions = (values: Record<string, unknown>): TurnOptions =
     const raw = String(values.tools);
     opts.tools = raw.length === 0 ? [] : raw.split(",").map((s) => s.trim());
   }
+  if (values["exclude-tools"] !== undefined) {
+    const raw = String(values["exclude-tools"]);
+    opts.excludeTools = raw.length === 0 ? [] : raw.split(",").map((s) => s.trim());
+  }
   if (values.autonomy === true) opts.autonomy = true;
   else if (values["no-autonomy"] === true) opts.autonomy = false;
   else if (values.autonomy === false) opts.autonomy = false; // for completeness
@@ -238,6 +242,7 @@ const KNOWN_FLAGS = new Set([
   "--sandbox",
   "--provider",
   "--tools",
+  "--exclude-tools",
   "--autonomy",
   "--no-autonomy",
   "--write",
@@ -269,6 +274,7 @@ const FLAGS_WITH_VALUE = new Set([
   "--sandbox",
   "--provider",
   "--tools",
+  "--exclude-tools",
   "--max-steps",
   "--cwd",
   "--env",
@@ -339,11 +345,34 @@ const preprocessPromptArgs = (argv: string[]): string[] => {
  * Wrapper around node:util parseArgs for the common flag table.
  * Throws with exit code 2 on unknown flag.
  */
+export interface SplitPassthrough {
+  /** Tokens before the separator - hcn's normalized surface. */
+  readonly normalized: string[];
+  /** Tokens after the separator - verbatim passthrough to the harness,
+   * empty when no separator was present. */
+  readonly passthrough: readonly string[];
+}
+
+/** D6: split argv at the first bare `--`. Everything after it belongs to
+ * the harness, not to hcn - wrong-harness flags there fail in the harness
+ * itself and surface as native errors, never as hcn refusals. */
+export const splitPassthrough = (argv: readonly string[]): SplitPassthrough => {
+  const idx = argv.indexOf("--");
+  if (idx === -1) return { normalized: [...argv], passthrough: [] };
+  return {
+    normalized: argv.slice(0, idx),
+    passthrough: argv.slice(idx + 1),
+  };
+};
+
 export const parseCommonFlags = (
   argv: string[],
   opts: { strict?: boolean } = {},
 ): ReturnType<typeof parseArgs> => {
-  const normalized = preprocessPromptArgs(argv);
+  // The separator itself never reaches parseArgs: passthrough tokens may
+  // be unknown to hcn by design (that is their purpose).
+  const { normalized: withoutPassthrough } = splitPassthrough(argv);
+  const normalized = preprocessPromptArgs(withoutPassthrough);
   const config = {
     allowPositionals: true,
     strict: opts.strict ?? true,
@@ -355,6 +384,7 @@ export const parseCommonFlags = (
       sandbox: { type: "string" as const },
       provider: { type: "string" as const },
       tools: { type: "string" as const },
+      "exclude-tools": { type: "string" as const },
       autonomy: { type: "boolean" as const },
       "no-autonomy": { type: "boolean" as const },
       write: { type: "boolean" as const },

package/src/cli/config.ts

@@ -0,0 +1,166 @@
+/**
+ * User-level config: ~/.config/hcn/config.json (or $HCN_CONFIG_DIR for
+ * tests). Hard-fail discipline: unknown keys, malformed JSON, and schema
+ * version mismatches exit 2 naming the offender - a config that silently
+ * no-ops is a safety hole in a tool whose config can tighten a sandbox.
+ *
+ * Schema is intentionally minimal and mirrors the normalized option
+ * surface; it grows as dimensions ratify. The parser validates SHAPE
+ * (key known, value type plausible); value legality (effort in ladder,
+ * model in vocabulary) is enforced by the same renderers as args, so
+ * config and CLI can never disagree about what is legal.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import type { TurnOptions } from "../interpretation/argv.js";
+
+const SCHEMA_VERSION = 1;
+
+export class ConfigError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ConfigError";
+  }
+}
+
+export const userConfigPath = (): string =>
+  join(
+    process.env.HCN_CONFIG_DIR ??
+      join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "hcn"),
+    "config.json",
+  );
+
+/** Project config: `.hcn/config.json` at the git root (P4 ratified as A -
+ * auto-discover, no trust gate; the config is code-reviewed like AGENTS.md
+ * and every project-tier provenance line names its path). Null outside a
+ * repo or when the repo declares none. */
+export const projectConfigPath = (startDir: string = process.cwd()): string | null => {
+  let dir = resolve(startDir);
+  for (;;) {
+    if (existsSync(join(dir, ".hcn", "config.json"))) return join(dir, ".hcn", "config.json");
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    // stop at the git root: above it is not this project
+    if (existsSync(join(dir, ".git")) && !existsSync(join(parent, ".git"))) {
+      return null;
+    }
+    dir = parent;
+  }
+};
+
+type MutableTurnOptions = {
+  [K in keyof TurnOptions]?: TurnOptions[K];
+};
+
+const KNOWN_KEYS = new Set([
+  "effort",
+  "model",
+  "provider",
+  "sandbox",
+  "tools",
+  "excludeTools",
+  "autonomy",
+  "write",
+  "shell",
+  "maxSteps",
+  "toolsets",
+]);
+
+const LIST_KEYS = new Set(["tools", "excludeTools"]);
+const BOOL_KEYS = new Set(["autonomy", "write", "shell"]);
+
+/** Parse + validate config text. Throws ConfigError with the offending key
+ * named on any violation - never warns and continues. */
+export const parseUserConfig = (text: string): Partial<TurnOptions> => {
+  let raw: unknown;
+  try {
+    raw = JSON.parse(text);
+  } catch (e) {
+    throw new ConfigError(`config is not valid JSON: ${(e as Error).message}`);
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new ConfigError("config root must be a JSON object");
+  }
+  const obj = raw as Record<string, unknown>;
+
+  if (obj.version === undefined) {
+    throw new ConfigError("config missing required field: version");
+  }
+  if (obj.version !== SCHEMA_VERSION) {
+    throw new ConfigError(
+      `config version ${JSON.stringify(obj.version)} not supported (expected ${SCHEMA_VERSION})`,
+    );
+  }
+  delete obj.version;
+
+  const out: MutableTurnOptions = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (!KNOWN_KEYS.has(key)) {
+      throw new ConfigError(`unknown config key: ${JSON.stringify(key)}`);
+    }
+    if (key === "toolsets") {
+      if (
+        typeof value !== "object" ||
+        value === null ||
+        Array.isArray(value) ||
+        Object.entries(value).some(
+          ([, v]) => !Array.isArray(v) || v.some((t) => typeof t !== "string" || t.trim() === ""),
+        )
+      ) {
+        throw new ConfigError(
+          'config key "toolsets" must be an object of name -> non-empty string array',
+        );
+      }
+      (out as Record<string, unknown>)[key] = value;
+      continue;
+    }
+    if (LIST_KEYS.has(key)) {
+      if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) {
+        throw new ConfigError(`config key ${JSON.stringify(key)} must be an array of strings`);
+      }
+      (out as Record<string, unknown>)[key] = value;
+      continue;
+    }
+    if (BOOL_KEYS.has(key)) {
+      if (typeof value !== "boolean") {
+        throw new ConfigError(`config key ${JSON.stringify(key)} must be a boolean`);
+      }
+      (out as Record<string, unknown>)[key] = value;
+      continue;
+    }
+    if (typeof value !== "string" && typeof value !== "number") {
+      throw new ConfigError(
+        `config key ${JSON.stringify(key)} must be a string or number, got ${typeof value}`,
+      );
+    }
+    (out as Record<string, unknown>)[key] = value;
+  }
+  return out as Partial<TurnOptions>;
+};
+
+/** Load the user config if the file exists; absent file is an empty config
+ * (no tiers engaged), unreadable or invalid file is a hard error. */
+export const loadUserConfig = (): { config: Partial<TurnOptions>; path: string } | null =>
+  loadConfigAt(userConfigPath());
+
+/** Load the project config (git-root auto-discovery, ratified A). */
+export const loadProjectConfig = (
+  startDir?: string,
+): { config: Partial<TurnOptions>; path: string } | null => {
+  const path = projectConfigPath(startDir);
+  if (path === null) return null;
+  return loadConfigAt(path);
+};
+
+const loadConfigAt = (path: string): { config: Partial<TurnOptions>; path: string } | null => {
+  let text: string;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (e) {
+    const code = (e as NodeJS.ErrnoException).code;
+    if (code === "ENOENT") return null;
+    throw new ConfigError(`cannot read config at ${path}: ${(e as Error).message}`);
+  }
+  return { config: parseUserConfig(text), path };
+};

package/src/cli/inspect.ts

@@ -1,6 +1,7 @@
 import { redactArgv } from "../execution/stream-turn.js";
 import { buildLaunchArgv } from "../interpretation/argv.js";
 import { ArgvRefusalError } from "../interpretation/refusal.js";
+import { FloorExceededError, resolveEffectiveOptions } from "../interpretation/resolve-options.js";
 import { parseTurnOptions, resolvePromptAsync } from "./args.js";
 import { resolveHarness } from "./resolve-harness.js";
 
@@ -123,8 +124,40 @@ export const inspect = async (harnessName: string, rawArgs: string[]): Promise<v
     throw err;
   }
 
+  // Inspect resolves exactly as a launch would: profile + user config,
+  // launch-only semantics, so --argv previews the truth of a bare run.
+  const { loadUserConfig, loadProjectConfig, ConfigError } = await import("./config.js");
+  const tiers: {
+    user?: Partial<ReturnType<typeof parseTurnOptions>>;
+    project?: Partial<ReturnType<typeof parseTurnOptions>>;
+  } = {};
+  try {
+    const loaded = loadUserConfig();
+    if (loaded !== null) tiers.user = loaded.config;
+    const proj = loadProjectConfig();
+    if (proj !== null) tiers.project = proj.config;
+  } catch (configErr) {
+    if (configErr instanceof ConfigError) {
+      process.stderr.write(`config error: ${(configErr as Error).message}\n`);
+      process.exitCode = 2;
+      return;
+    }
+    throw configErr;
+  }
+  let resolved: ReturnType<typeof resolveEffectiveOptions>;
+  try {
+    resolved = resolveEffectiveOptions(h, { ...turnOpts, prompt } as never, tiers);
+  } catch (resErr) {
+    if (resErr instanceof FloorExceededError) {
+      process.stderr.write(`${(resErr as Error).message}\n`);
+      process.exitCode = 2;
+      return;
+    }
+    throw resErr;
+  }
+  const { prompt: _p, ...effectiveRest } = resolved.options as { prompt: string };
   const fullOpts = {
-    ...turnOpts,
+    ...(effectiveRest as object),
     prompt,
     ...(promptSource !== "positional" ? { __explicitPrompt: true as const } : {}),
   } as Parameters<typeof buildLaunchArgv>[1];

package/src/cli/render.ts

@@ -41,7 +41,16 @@ export const renderEvent = (event: HarnessEvent, state: RenderState): void => {
       break;
     case "failure": {
       const detail = event.message ?? `${event.class}`;
-      process.stdout.write(red(`\n  ✗ failure ${event.class}: ${detail}`));
+      // D6: native failures get an unmistakable prefix and the native exit
+      // code shown as data, so a human never reads a harness error as an
+      // hcn error.
+      if (event.class === "native") {
+        const nat =
+          event.nativeExitCode !== undefined ? ` [native exit ${event.nativeExitCode}]` : "";
+        process.stdout.write(red(`\n  ✗ NATIVE${nat} ${detail}`));
+      } else {
+        process.stdout.write(red(`\n  ✗ failure ${event.class}: ${detail}`));
+      }
       break;
     }
     case "done": {