@fusengine/harness 0.1.40 → 0.1.42

package/README.md

@@ -26,7 +26,9 @@ bun add @fusengine/harness      # Bun reads the TS source directly — no build
 ```sh
 cd your-project
 harness init                              # detects the harness, writes its pre+post hooks
-export FUSE_HARNESS_REFS=.claude/skills   # (optional) activate the SOLID-read gate
+# The SOLID-read gate auto-activates from discovered skills (default marketplace: fusengine-plugins).
+export FUSE_HARNESS_MARKETPLACES=fusengine-plugins   # (optional) which marketplaces to auto-scan
+export FUSE_HARNESS_REFS=.claude/skills              # (optional) explicit refs dir, overrides auto-discovery
 ```
 
 That's it. `init` writes the wiring file for the detected harness
@@ -43,6 +45,11 @@ automatically under `<project>/.harness/` (track, cache, memory).
 | `harness init [id]` | Write the pre+post hook wiring for the detected (or named) harness. |
 | `harness hook <id>` | Runtime: read a hook payload on stdin, gate (pre) or record (post), print the native response. (Hooks call this — you don't.) |
 | `harness check` | cli-mode: check staged files in a pre-commit step, exit non-zero on a violation. For harnesses without hooks. |
+| `harness doctor` | Print the version + resolved path of the harness *actually executing*, and compare it to npm's latest — the fast way to catch a stale global (see Pinning). |
+| `harness --version` | Print the running version (bare, on stdout) and exit. |
+
+Every invocation writes a `@fusengine/harness vX.Y.Z` banner to **stderr** (never
+stdout — the hook JSON contract stays clean) so you can see which version ran.
 
 cli-mode (Aider / Windsurf / OpenHands), as a pre-commit step:
 
@@ -51,6 +58,48 @@ cli-mode (Aider / Windsurf / OpenHands), as a pre-commit step:
 npx harness check
 ```
 
+### Pinning (required for hook consumers)
+
+Any consumer `hooks.json` / `settings.json` that runs the harness via `bunx`
+**MUST pin an exact version** — `@fusengine/harness@X.Y.Z` — never a range
+(`^` / `~`) and never the bare or `@latest` spec:
+
+```jsonc
+// .claude/settings.json — correct: exact pin
+"command": "bunx @fusengine/harness@0.1.41 hook claude"
+// WRONG — may silently keep running a stale global install:
+"command": "bunx @fusengine/harness hook claude"
+```
+
+**Why.** A still-open bun bug ([oven-sh/bun#5791]) makes an unpinned `bunx <pkg>`
+prefer an already-installed **global** copy over npm-latest, and publishing a new
+version updates neither that global nor the bunx cache (`bun pm cache rm` does
+**not** remove the global). A hook wired without an exact pin can therefore keep
+executing an old harness indefinitely after you publish a fix — the failure is
+silent because the smoke test (importing the local dist) never exercises the
+`bunx`-resolved binary. Pinning `@X.Y.Z` forces the exact version to resolve.
+
+Run `harness doctor` to see which version is actually executing and whether npm
+has a newer one:
+
+```sh
+harness doctor
+# @fusengine/harness doctor
+#   running:    0.1.41
+#   package:    /Users/you/.bun/install/global/node_modules/@fusengine/harness
+#   runtime:    /Users/you/.bun/bin/bun
+#   npm latest: 0.1.42
+#   ! stale — npm serves 0.1.42. Pin "@fusengine/harness@0.1.42" in hooks.json.
+```
+
+If `doctor` reports a stale global, clear it and re-pin:
+
+```sh
+bun remove -g @fusengine/harness && bun pm cache rm
+```
+
+[oven-sh/bun#5791]: https://github.com/oven-sh/bun/issues/5791
+
 ## What it enforces
 
 Ten portable guards + the APEX gate chain, all evaluated before a tool runs:
@@ -65,8 +114,8 @@ Ten portable guards + the APEX gate chain, all evaluated before a tool runs:
 | interface-separation | top-level interface/type/protocol in a component/controller |
 | protected-path | edits to `.claude/plugins\|logs\|cache`, `.git/` |
 | APEX freshness | `explore-codebase` + `research-expert` not run within the window |
-| APEX doc-consulted | Context7 **and** Exa not consulted this session |
-| APEX solid-read | required SOLID refs (from `FUSE_HARNESS_REFS`) not read |
+| APEX doc-consulted | no doc source (Context7 / Exa / fuse-browser / WebSearch / WebFetch) consulted this session |
+| APEX solid-read | required SOLID refs (auto-discovered, or `FUSE_HARNESS_REFS`) not read |
 | brainstorm | creating a new file without brainstorming (when flagged) |
 | MCP verbosity / cache | caps exa `numResults`; serves a fresh cached MCP/WebFetch result |
 
@@ -78,7 +127,8 @@ through per window without the full APEX gates.
 | Var | Effect |
 |---|---|
 | `FUSE_SOLID_MAX_LINES` | SOLID file-size limit (default `100`). |
-| `FUSE_HARNESS_REFS` | Directory of `.md` SOLID references → activates `solidReadGate`. |
+| `FUSE_HARNESS_REFS` | Explicit `path.delimiter`-list of `.md` SOLID-reference dirs → activates `solidReadGate`. Overrides auto-discovery. |
+| `FUSE_HARNESS_MARKETPLACES` | Comma-list of marketplace names whose `solid-*` skill refs are auto-discovered when `FUSE_HARNESS_REFS` is unset (default `fusengine-plugins`; an absent marketplace contributes nothing). Standalone `.claude`/`.codex`/`.cursor`/`.agents` skills are always scanned. |
 | `FUSE_ENFORCE_TTL_SEC` | APEX freshness window in seconds. |
 | `FUSE_LESSONS_THROTTLE_MIN` | Lessons-injection throttle (memory module). |
 

package/dist/adapters/claude/index.mjs

@@ -1,2 +1,2 @@
-import { a as guard, i as fileSizeGuard, n as contextResponse, o as readClaudeInput, r as denyResponse, s as toClaudeResponse, t as blockResponse } from "../../claude-BnFrSfMo.mjs";
+import { a as guard, i as fileSizeGuard, n as contextResponse, o as readClaudeInput, r as denyResponse, s as toClaudeResponse, t as blockResponse } from "../../claude-CeRYMOaG.mjs";
 export { blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, readClaudeInput, toClaudeResponse };

package/dist/adapters/cline/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-B1n1ti0N.mjs";
+import { t as evaluate } from "../../evaluate-CeivW6G0.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cline/index.ts
 /**

package/dist/adapters/codex/index.mjs

@@ -1,2 +1,2 @@
-import { a as guard, n as contextResponse, o as readClaudeInput, r as denyResponse } from "../../claude-BnFrSfMo.mjs";
+import { a as guard, n as contextResponse, o as readClaudeInput, r as denyResponse } from "../../claude-CeRYMOaG.mjs";
 export { contextResponse, denyResponse, guard, readClaudeInput as readCodexInput };

package/dist/adapters/cursor/index.d.mts

@@ -1,4 +1,4 @@
-//#region src/adapters/cursor/index.d.ts
+//#region src/adapters/cursor/interfaces/types.d.ts
 /** `beforeShellExecution` stdin payload (subset). */
 interface CursorShellPayload {
   command?: string;
@@ -21,6 +21,8 @@ interface CursorResponse {
   userMessage?: string;
   agentMessage?: string;
 }
+//#endregion
+//#region src/adapters/cursor/index.d.ts
 /** Guard a shell command (git/install policies). */
 declare function beforeShellExecution(payload: CursorShellPayload): CursorResponse;
 /** Observe a file edit (Cursor cannot block here). Returns the verdict for logging. */
@@ -28,4 +30,4 @@ declare function afterFileEdit(payload: CursorEditPayload): {
   violation: string | null;
 };
 //#endregion
-export { CursorEditPayload, CursorResponse, CursorShellPayload, afterFileEdit, beforeShellExecution };
+export { type CursorEditPayload, type CursorResponse, type CursorShellPayload, afterFileEdit, beforeShellExecution };

package/dist/adapters/cursor/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-B1n1ti0N.mjs";
+import { t as evaluate } from "../../evaluate-CeivW6G0.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cursor/index.ts
 /**

package/dist/adapters/gemini/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-B1n1ti0N.mjs";
+import { t as evaluate } from "../../evaluate-CeivW6G0.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/gemini/index.ts
 /**

package/dist/cache/index.mjs

@@ -1,3 +1,3 @@
-import { a as cachePath, c as extractText, d as compactMarkdown, f as jaccardSimilar, i as cacheLookupSubstring, l as loadIndex, n as webfetchCacheWrite, o as cacheStore, p as queryHash, r as cacheLookup, s as mcpCacheKey, t as mcpCacheWrite, u as summarizeIndex } from "../mcp-store-CDUVqtJ0.mjs";
+import { a as cachePath, c as extractText, d as compactMarkdown, f as jaccardSimilar, i as cacheLookupSubstring, l as loadIndex, n as webfetchCacheWrite, o as cacheStore, p as queryHash, r as cacheLookup, s as mcpCacheKey, t as mcpCacheWrite, u as summarizeIndex } from "../mcp-store-CnsW9oFj.mjs";
 import "../cache-la_KkjCS.mjs";
 export { cacheLookup, cacheLookupSubstring, cachePath, cacheStore, compactMarkdown, extractText, jaccardSimilar, loadIndex, mcpCacheKey, mcpCacheWrite, queryHash, summarizeIndex, webfetchCacheWrite };

package/dist/{claude-BnFrSfMo.mjs → claude-CeRYMOaG.mjs}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-B1n1ti0N.mjs";
+import { t as evaluate } from "./evaluate-CeivW6G0.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

package/dist/cli/bin.mjs

@@ -2,12 +2,14 @@
 import { r as resolveTtlSec } from "../ttl-BG55s6HZ.mjs";
 import { r as loadDotenv } from "../dotenv-DGyLln7U.mjs";
 import { t as detectHarness } from "../harness-C8Nxxyn_.mjs";
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-D-Ydrw3D.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-jgivVDv6.mjs";
 import { n as writeInitFile, t as initFor } from "../run-Do2JltgU.mjs";
-import { Ot as todayUtc, kt as claudeHome, t as handleHook } from "../handle-gYSq5znf.mjs";
-import { join } from "node:path";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { f as claudeHome } from "../store-CdWOQ9zD.mjs";
+import { Ot as todayUtc, t as handleHook } from "../handle-BTHcKWQ5.mjs";
+import { delimiter, dirname, join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
 //#region src/changelog/fetch.ts
 /**
 * Changelog scanner — ports the changelog-watcher plugin's `fetch-changelog`
@@ -76,6 +78,151 @@ async function scanChangelog(now = Date.now(), home = homedir()) {
 	};
 }
 //#endregion
+//#region src/refs/discover.ts
+/** Immediate subdirectory names of `p`, or `[]` when it is missing/inaccessible. */
+function subdirs(p) {
+	try {
+		return readdirSync(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+	} catch {
+		return [];
+	}
+}
+/**
+* Every `skills/` parent dir across the Open-Agent-Skills layouts
+* (agentskills.io) of Claude Code, Codex and Cursor: the standalone skill roots
+* (`<base>/{.claude,.codex,.cursor,.agents}/skills` + `/etc/codex/skills`) plus
+* installed-plugin roots (`<plugin>/skills` under the Claude marketplace and the
+* Claude/Codex version caches). Shallow `readdir` only — no deep walk — so it is
+* cheap enough to run on every hook.
+*/
+function skillParents(home, cwd, marketplaces) {
+	const out = [];
+	for (const base of [cwd, home]) for (const tool of [
+		".claude",
+		".codex",
+		".cursor",
+		".agents"
+	]) out.push(join(base, tool, "skills"));
+	out.push(join("/etc", "codex", "skills"));
+	const mktRoot = join(home, ".claude", "plugins", "marketplaces");
+	for (const mkt of subdirs(mktRoot)) {
+		if (!marketplaces.includes(mkt)) continue;
+		const pluginsDir = join(mktRoot, mkt, "plugins");
+		for (const plugin of subdirs(pluginsDir)) out.push(join(pluginsDir, plugin, "skills"));
+	}
+	for (const cacheRoot of [join(home, ".claude", "plugins", "cache"), join(home, ".codex", "plugins", "cache")]) for (const mkt of subdirs(cacheRoot)) {
+		if (!marketplaces.includes(mkt)) continue;
+		for (const plugin of subdirs(join(cacheRoot, mkt))) for (const ver of subdirs(join(cacheRoot, mkt, plugin))) out.push(join(cacheRoot, mkt, plugin, ver, "skills"));
+	}
+	return out;
+}
+/**
+* Auto-discover SOLID reference dirs (`<skill>/references` for every `solid-*`
+* skill) across the Claude/Codex/Cursor skill layouts — the fallback used when
+* `FUSE_HARNESS_REFS` is unset. Deduped by skill name (first source wins, so a
+* marketplace skill shadows its version-cache copy). Returns a path-delimiter
+* list, or `""` when none is found — with no refs the SOLID-read gate stays off.
+* @param home - User home dir (`os.homedir()`).
+* @param cwd - Current project dir (`process.cwd()`).
+* @param marketplaces - Allowlist of marketplace names to scan (env
+*   `FUSE_HARNESS_MARKETPLACES`, default `["fusengine-plugins"]`); a marketplace
+*   absent from disk simply contributes nothing. Standalone
+*   `.claude`/`.codex`/`.cursor`/`.agents` skill roots are always scanned.
+* @returns A `path.delimiter`-joined list of `references` dirs, or `""`.
+*/
+function discoverRefs(home, cwd, marketplaces) {
+	const bySkill = /* @__PURE__ */ new Map();
+	for (const parent of skillParents(home, cwd, marketplaces)) for (const skill of subdirs(parent)) {
+		if (!skill.startsWith("solid-") || bySkill.has(skill)) continue;
+		if (subdirs(join(parent, skill)).includes("references")) bySkill.set(skill, join(parent, skill, "references"));
+	}
+	return [...bySkill.values()].join(delimiter);
+}
+//#endregion
+//#region src/cli/doctor.ts
+/**
+* `harness doctor` — diagnose which `@fusengine/harness` is actually running.
+*
+* A confirmed, still-open bun bug (oven-sh/bun #5791; scoped-pkg behaviour
+* reinforced by #32019/#32150) makes `bunx <pkg>` (unpinned) prefer a stale
+* GLOBAL install over npm-latest, so a consumer can silently run an old harness
+* after a publish. This command surfaces the truth: the resolved version +
+* package path of the code executing right now, the runtime binary, and the
+* latest version published on npm. It queries the registry over HTTP (not
+* `npm view`, whose exit code is 0 even on an empty result — npm/cli#6408) and
+* never throws: an offline environment yields `latest: null`, never a crash.
+*/
+const PKG = "@fusengine/harness";
+/** Walk up from `startDir` for the `@fusengine/harness` `package.json`. */
+function findPackage(startDir) {
+	let dir = startDir;
+	for (let depth = 0; depth < 6; depth++) {
+		try {
+			const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+			if (pkg.name === PKG) return {
+				version: pkg.version ?? "unknown",
+				path: dir
+			};
+		} catch {}
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return null;
+}
+/** Resolve the running version + package path (no network), from a module URL. */
+function runningVersion(moduleUrl) {
+	const found = findPackage(dirname(fileURLToPath(moduleUrl)));
+	return {
+		version: found?.version ?? "unknown",
+		path: found?.path ?? "unknown"
+	};
+}
+/** One-line `pkg vX.Y.Z` banner (written to stderr on every CLI invocation). */
+function versionBanner(moduleUrl) {
+	return `${PKG} v${runningVersion(moduleUrl).version}`;
+}
+/** Latest published version via the npm registry HTTP API. `null` on any failure. */
+async function npmLatest() {
+	try {
+		const res = await fetch(`https://registry.npmjs.org/${PKG}/latest`, { signal: AbortSignal.timeout(8e3) });
+		if (!res.ok) return null;
+		return (await res.json()).version ?? null;
+	} catch {
+		return null;
+	}
+}
+/** Build the full diagnostic report for the module at `moduleUrl`. */
+async function buildDoctorReport(moduleUrl) {
+	const { version, path } = runningVersion(moduleUrl);
+	const latest = await npmLatest();
+	return {
+		running: version,
+		packagePath: path,
+		runtime: process.execPath,
+		latest,
+		stale: latest !== null && latest !== version
+	};
+}
+/** Render a {@link DoctorReport} as human-readable stdout text. */
+function formatDoctor(r) {
+	const lines = [
+		`${PKG} doctor`,
+		`  running:    ${r.running}`,
+		`  package:    ${r.packagePath}`,
+		`  runtime:    ${r.runtime}`,
+		`  npm latest: ${r.latest ?? "(unavailable — offline or unreachable)"}`
+	];
+	if (r.stale) lines.push(`  ! stale — npm serves ${r.latest}. Pin "@fusengine/harness@${r.latest}" in hooks.json (see README).`);
+	else if (r.latest !== null) lines.push(`  ok — running the latest published version.`);
+	return lines.join("\n");
+}
+/** Run `harness doctor`: print the diagnostic to stdout. Always resolves 0 (pure info). */
+async function runDoctor(moduleUrl) {
+	process.stdout.write(formatDoctor(await buildDoctorReport(moduleUrl)) + "\n");
+	return 0;
+}
+//#endregion
 //#region src/cli/bin.ts
 /**
 * harness — CLI for @fusengine/harness.
@@ -97,7 +244,12 @@ async function readStdin() {
 	}
 }
 const cmd = process.argv[2];
-if (cmd === "hook") {
+process.stderr.write(versionBanner(import.meta.url) + "\n");
+if (cmd === "--version" || cmd === "-v") {
+	process.stdout.write(runningVersion(import.meta.url).version + "\n");
+	process.exit(0);
+} else if (cmd === "doctor") process.exit(await runDoctor(import.meta.url));
+else if (cmd === "hook") {
 	const id = process.argv[3] ?? detectHarness().id;
 	loadDotenv(id);
 	const scopeArg = process.argv[4];
@@ -112,10 +264,12 @@ if (cmd === "hook") {
 		"seo",
 		"memory"
 	])).has(scopeArg) ? scopeArg : "core";
+	const marketplaces = (process.env.FUSE_HARNESS_MARKETPLACES ?? "fusengine-plugins").split(",").map((s) => s.trim()).filter(Boolean);
+	const refsDir = process.env.FUSE_HARNESS_REFS || discoverRefs(homedir(), process.cwd(), marketplaces) || void 0;
 	const outcome = await handleHook(id, await readStdin(), {
 		now: Date.now(),
 		cwd: process.cwd(),
-		refsDir: process.env.FUSE_HARNESS_REFS,
+		refsDir,
 		windowMs: resolveTtlSec(process.env) * 1e3,
 		scope
 	});

package/dist/cli/index.mjs

@@ -1,2 +1,2 @@
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-D-Ydrw3D.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-jgivVDv6.mjs";
 export { checkStaged, stagedContent, stagedFiles };

package/dist/config/index.d.mts

@@ -1,2 +1,2 @@
-import { _ as parseEnvInt, a as ProjectLayout, c as projectLayout, d as resolveMaxLines, f as splitTarget, g as ttlLabel, h as resolveTtlSec, i as parseEnvFile, l as DEFAULT_MAX_LINES, m as TTL_ENV_KEY, n as envCandidates, o as STATE_GITIGNORE, p as DEFAULT_TTL_SEC, r as loadDotenv, s as STATE_ROOT, t as HOME_DIR, u as MAX_LINES_ENV_KEY } from "../index-COBvvc3L.mjs";
+import { _ as parseEnvInt, a as ProjectLayout, c as projectLayout, d as resolveMaxLines, f as splitTarget, g as ttlLabel, h as resolveTtlSec, i as parseEnvFile, l as DEFAULT_MAX_LINES, m as TTL_ENV_KEY, n as envCandidates, o as STATE_GITIGNORE, p as DEFAULT_TTL_SEC, r as loadDotenv, s as STATE_ROOT, t as HOME_DIR, u as MAX_LINES_ENV_KEY } from "../index-DXQfL1u8.mjs";
 export { DEFAULT_MAX_LINES, DEFAULT_TTL_SEC, HOME_DIR, MAX_LINES_ENV_KEY, ProjectLayout, STATE_GITIGNORE, STATE_ROOT, TTL_ENV_KEY, envCandidates, loadDotenv, parseEnvFile, parseEnvInt, projectLayout, resolveMaxLines, resolveTtlSec, splitTarget, ttlLabel };

package/dist/detect/index.d.mts

@@ -1,2 +1,2 @@
-import { a as detectHarness, i as HarnessVia, n as HarnessInfo, o as detectMode, r as HarnessMode, s as modeFor, t as HarnessId } from "../harness-DwJskkz_.mjs";
-export { HarnessId, HarnessInfo, HarnessMode, HarnessVia, detectHarness, detectMode, modeFor };
+import { a as HarnessInfo, i as HarnessId, n as detectMode, o as HarnessMode, r as modeFor, s as HarnessVia, t as detectHarness } from "../harness-BPPu5CrN.mjs";
+export { type HarnessId, type HarnessInfo, type HarnessMode, type HarnessVia, detectHarness, detectMode, modeFor };

package/dist/{doc-helpers-B4XYL1v8.mjs → doc-helpers-BhzDmJ18.mjs}

@@ -13,7 +13,7 @@ function evaluateDoc(auths) {
 	const readPaths = auths.flatMap((a) => a.read_paths ?? []);
 	const liveC7 = sources.some((s) => /context7/i.test(s));
 	const liveExa = sources.some((s) => /exa/i.test(s));
-	const liveWeb = sources.some((s) => /web(search|fetch)/i.test(s));
+	const liveWeb = sources.some((s) => /web(search|fetch)|fuse-browser/i.test(s));
 	const cacheC7 = readPaths.some((p) => /\/context\/mcp\/context7-/.test(p));
 	const cacheExa = readPaths.some((p) => /\/context\/mcp\/(exa-search|exa-code-context)-/.test(p));
 	return {
@@ -36,7 +36,7 @@ function formatDocSatisfactionStatus(authorizations, sessionId) {
 function formatDocDeny(framework) {
 	return [
 		`APEX: Online documentation not consulted for ${framework}!`,
-		"Use ANY ONE of: mcp__context7__query-docs, mcp__exa__web_search_exa, WebSearch, or WebFetch.",
+		"Use ANY ONE of: mcp__context7__query-docs, mcp__exa__web_search_exa (or — if Exa is down — mcp__fuse-browser__browser_fetch / browser_crawl / browser_serp_batch), WebSearch, or WebFetch.",
 		"This check is once per session — after consulting one source, Write/Edit will be allowed."
 	].join("\n");
 }

package/dist/{evaluate-B1n1ti0N.mjs → evaluate-CeivW6G0.mjs}

@@ -189,15 +189,15 @@ function securityGuard(ctx) {
 /**
 * Path fragments that mark a location as internal/generated state.
 *
-* Parity with safe_paths.py: `~/.claude/fusengine-cache` is a *writable* cache
-* the harness owns (lessons, MCP cache, per-type state) — only the
-* `fusengine-cache/sessions` subtree is protected, not the whole cache.
+* Parity with safe_paths.py: `~/.fuse-harness/cache` is a *writable*
+* cache the harness owns (lessons, MCP cache, per-type state) — only the
+* `cache/sessions` subtree is protected, not the whole cache.
 */
 const PROTECTED_FRAGMENTS = [
 	".claude/plugins/marketplaces",
 	".claude/plugins/cache",
 	".claude/logs/00-apex",
-	".claude/fusengine-cache/sessions",
+	".fuse-harness/cache/sessions",
 	".claude/apex/",
 	".harness/track",
 	".harness/memory/state"

package/dist/freshness/index.mjs

@@ -1,3 +1,3 @@
-import { i as resolveSessions, n as formatDocSatisfactionStatus, r as isDocConsulted, t as formatDocDeny } from "../doc-helpers-B4XYL1v8.mjs";
-import { t as incrementTrivialEditCounter } from "../freshness-43gxYpiX.mjs";
+import { i as resolveSessions, n as formatDocSatisfactionStatus, r as isDocConsulted, t as formatDocDeny } from "../doc-helpers-BhzDmJ18.mjs";
+import { t as incrementTrivialEditCounter } from "../freshness-BV3PQkDB.mjs";
 export { formatDocDeny, formatDocSatisfactionStatus, incrementTrivialEditCounter, isDocConsulted, resolveSessions };

package/dist/{freshness-43gxYpiX.mjs → freshness-BV3PQkDB.mjs}

@@ -1,4 +1,4 @@
-import { a as writeJsonFile, i as readJsonFile, n as ensureDir } from "./json-io-CvSumjtz.mjs";
+import { a as writeJsonFile, i as readJsonFile, n as ensureDir } from "./json-io-DisYd2fb.mjs";
 import { dirname } from "node:path";
 //#region src/freshness/trivial-edit-counter.ts
 /**