@fusengine/harness 0.1.59 → 0.1.61

package/dist/adapters/claude/index.d.mts

@@ -1,2 +1,2 @@
-import { a as denyResponse, c as informResponse, d as toClaudeResponse, i as contextResponse, l as readClaudeInput, n as attachSystemMessage, o as fileSizeGuard, r as blockResponse, s as guard, t as ClaudeHookInput, u as systemMessage } from "../../index-DZCLmSoO.mjs";
+import { a as denyResponse, c as informResponse, d as toClaudeResponse, i as contextResponse, l as readClaudeInput, n as attachSystemMessage, o as fileSizeGuard, r as blockResponse, s as guard, t as ClaudeHookInput, u as systemMessage } from "../../index-ce2J1bHC.mjs";
 export { ClaudeHookInput, attachSystemMessage, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, informResponse, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/claude/index.mjs

@@ -1,2 +1,2 @@
-import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-BLuab-tR.mjs";
+import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-BJER7Mbj.mjs";
 export { attachSystemMessage, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, informResponse, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/cline/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-BgFLlqrs.mjs";
+import { t as evaluate } from "../../evaluate-PuyQPU36.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cline/index.ts
 /**

package/dist/adapters/codex/index.d.mts

@@ -1,5 +1,5 @@
 import { t as Prompt } from "../../types-DVbIl9md.mjs";
-import { a as denyResponse, i as contextResponse, l as readClaudeInput, t as ClaudeHookInput } from "../../index-DZCLmSoO.mjs";
+import { a as denyResponse, i as contextResponse, l as readClaudeInput, t as ClaudeHookInput } from "../../index-ce2J1bHC.mjs";
 
 //#region src/adapters/codex/index.d.ts
 /** Render a portable {@link Prompt} as a Codex hook response, `ask` → explicit deny. */

package/dist/adapters/codex/index.mjs

@@ -1,8 +1,8 @@
 import { f as countLines } from "../../home-state-D0RLWP8J.mjs";
-import { t as evaluate } from "../../evaluate-BgFLlqrs.mjs";
+import { t as evaluate } from "../../evaluate-PuyQPU36.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 import { t as parseApplyPatch } from "../../apply-patch-CIS2EZ_q.mjs";
-import { c as readClaudeInput, i as denyResponse, r as contextResponse } from "../../claude-BLuab-tR.mjs";
+import { _ as commandToString, c as readClaudeInput, i as denyResponse, r as contextResponse } from "../../claude-BJER7Mbj.mjs";
 //#region src/adapters/codex/index.ts
 /**
 * OpenAI Codex CLI adapter (hook-mode). Codex's `PreToolUse` hook (since 2026)
@@ -49,7 +49,7 @@ function resolvePrompt(input) {
 		tool: input.tool_name ?? "Write",
 		filePath: i?.file_path,
 		content: i?.content ?? i?.new_string,
-		command: i?.command
+		command: commandToString(i?.command)
 	});
 	return r.decision === "allow" || !r.prompt ? null : r.prompt;
 }
@@ -59,7 +59,7 @@ function resolvePrompt(input) {
 * into per-file checks; every other tool routes through the portable policy.
 */
 function guard(input) {
-	const prompt = input.tool_name === "apply_patch" ? applyPatchPrompt(input.tool_input?.command ?? "") : resolvePrompt(input);
+	const prompt = input.tool_name === "apply_patch" ? applyPatchPrompt(commandToString(input.tool_input?.command) ?? "") : resolvePrompt(input);
 	return prompt ? toCodexResponse(prompt) : null;
 }
 //#endregion

package/dist/adapters/cursor/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-BgFLlqrs.mjs";
+import { t as evaluate } from "../../evaluate-PuyQPU36.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cursor/index.ts
 /**

package/dist/adapters/gemini/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-BgFLlqrs.mjs";
+import { t as evaluate } from "../../evaluate-PuyQPU36.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/gemini/index.ts
 /**

package/dist/adapters/hermes/index.d.mts

@@ -15,7 +15,7 @@ interface HermesHookInput {
     path?: string;
     file_path?: string;
     content?: string;
-    command?: string;
+    command?: string | string[];
   };
   session_id?: string;
   cwd?: string;

package/dist/adapters/hermes/index.mjs

@@ -1,2 +1,2 @@
-import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-CyhCYqD7.mjs";
+import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-DKPzVwI7.mjs";
 export { guard, readHermesInput, toHermesResponse };

package/dist/{claude-BLuab-tR.mjs → claude-BJER7Mbj.mjs}

@@ -1,8 +1,49 @@
-import { t as evaluate } from "./evaluate-BgFLlqrs.mjs";
+import { t as evaluate } from "./evaluate-PuyQPU36.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
+//#region src/runtime/command-string.ts
+/** Shell basenames whose `-c`-style argv carries the real script in argv[2]. */
+const SHELLS = /* @__PURE__ */ new Set([
+	"bash",
+	"sh",
+	"zsh",
+	"dash"
+]);
+/** True when `arg` is (a path to) a POSIX shell we know wraps a `-c` script. */
+function isShell(arg) {
+	if (arg === void 0) return false;
+	const base = arg.slice(arg.lastIndexOf("/") + 1);
+	return SHELLS.has(base);
+}
+/** True for a shell command flag (`-c`, `-lc`, `-ic`, …) — anything ending in `c`. */
+function isCommandFlag(arg) {
+	return arg !== void 0 && /^-[a-z]*c$/.test(arg);
+}
+/**
+* Coerce a hook payload's `command` field to the shell string the guard chain
+* expects. Harnesses disagree on the wire shape: Claude Code, Cursor, and Hermes
+* send a plain string, but Codex CLI sends an argv ARRAY
+* (`["bash", "-lc", "git commit -m x"]`). A naive `typeof === "string"` check
+* dropped the array to `undefined`, blinding every `ctx.command` guard
+* (destructive-git, mutators, install…) into a silent fail-open. This restores
+* the script so the array and string payloads reach an identical verdict.
+*
+* @param v - Raw `command` value off the payload (string, argv array, or other).
+* @returns A string as-is; a `[shell, -c|-lc, script]` argv reduced to its
+*   script; any other all-string array joined with spaces; and `undefined` for
+*   empty arrays, arrays holding non-strings, or any other type.
+*/
+function commandToString(v) {
+	if (typeof v === "string") return v;
+	if (!Array.isArray(v)) return void 0;
+	if (v.length === 0 || !v.every((e) => typeof e === "string")) return void 0;
+	const argv = v;
+	if (argv.length >= 3 && isShell(argv[0]) && isCommandFlag(argv[1])) return argv[2];
+	return argv.join(" ");
+}
+//#endregion
 //#region src/util/runtime-io.ts
 /**
 * Cross-runtime I/O helpers (Node + Bun). The published CLI ships a `node`
@@ -165,7 +206,7 @@ function guard(input) {
 		tool: input.tool_name ?? "Write",
 		filePath: input.tool_input?.file_path,
 		content: input.tool_input?.content ?? input.tool_input?.new_string,
-		command: input.tool_input?.command
+		command: commandToString(input.tool_input?.command)
 	});
 	if (result.decision === "allow" || !result.prompt) return null;
 	return toClaudeResponse(input.hook_event_name ?? "PreToolUse", result.prompt);
@@ -173,4 +214,4 @@ function guard(input) {
 /** @deprecated use {@link guard}. Kept for back-compat. */
 const fileSizeGuard = guard;
 //#endregion
-export { fileSizeGuard as a, readClaudeInput as c, collectFiles as d, pathExists as f, writeText as g, spawnCapture as h, denyResponse as i, systemMessage as l, sleep as m, blockResponse as n, guard as o, readText as p, contextResponse as r, informResponse as s, attachSystemMessage as t, toClaudeResponse as u };
+export { commandToString as _, fileSizeGuard as a, readClaudeInput as c, collectFiles as d, pathExists as f, writeText as g, spawnCapture as h, denyResponse as i, systemMessage as l, sleep as m, blockResponse as n, guard as o, readText as p, contextResponse as r, informResponse as s, attachSystemMessage as t, toClaudeResponse as u };

package/dist/cli/bin.mjs

@@ -2,9 +2,9 @@
 import { r as loadDotenv, s as resolveTtlSec } from "../dotenv-Jj8aL1FL.mjs";
 import { t as detectHarness } from "../harness-Cb9xR8dC.mjs";
 import { t as claudeHome } from "../home-state-D0RLWP8J.mjs";
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-B4b2_7Qm.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-CvqZrZUR.mjs";
 import { n as writeInitFile, t as initFor } from "../run-Do2JltgU.mjs";
-import { J as runningVersion, Lt as todayUtc, Y as versionBanner, q as runDoctor, t as handleHook } from "../handle-B6yL03we.mjs";
+import { J as runningVersion, Lt as todayUtc, Y as versionBanner, q as runDoctor, t as handleHook } from "../handle-DJovWDAy.mjs";
 import { delimiter, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/cli/index.mjs

@@ -1,2 +1,2 @@
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-B4b2_7Qm.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-CvqZrZUR.mjs";
 export { checkStaged, stagedContent, stagedFiles };

package/dist/{evaluate-BgFLlqrs.mjs → evaluate-PuyQPU36.mjs}

@@ -404,39 +404,61 @@ function hasSafeWriteTarget(cmd) {
 	const quoted = (p) => cmd.includes(`'${p}'`) || cmd.includes(`"${p}"`) || cmd.includes(`'${p}/`) || cmd.includes(`"${p}/`);
 	return SAFE_WRITE_PATHS.some(quoted) || SAFE_WRITE_RAW.some(quoted);
 }
+/**
+* Command-position anchor: line/segment start or a `;&|(` separator, then any
+* chain of {@link WRAP} wrappers (each with its own {@link WRAP_ARG} tokens).
+* Anchoring a write motif here makes it fire on a real invocation
+* (`env sed -i x src/a.ts`) while ignoring a quoted/argument MENTION of the same
+* text (`git commit -m "fix sed -i doc"`, `npm run t -- --grep "sed -i"`), which
+* is never at a command position.
+*
+* Defense-in-depth first pass, NOT the sole control: regex-on-raw-string is
+* lossy vs a real shell lexer. Known residual gaps (enumerated, not silently
+* assumed away): command substitution `$(…)`/backticks, indirect exec via
+* `bash -c`/`eval`/`find -exec`, process substitution `<(…)`, shell-quoting
+* tricks (`s''ed`, `${x}ed`), and variable-indirection targets (`tee $F`). Those
+* need a tokenizer, out of scope here; the Write/Edit tool gate stays the
+* backstop for what slips through.
+*/
+const CMD = `(?:^|[\\n;&|(])\\s*(?:(?:env|timeout|nice|nohup|sudo|command|stdbuf|time|ionice|exec|xargs)\\s+(?:(?:\\w+=\\S+|--?[^\\s-]\\S*|\\d+[smhd]?)\\s+)*)*`;
 //#endregion
 //#region src/policy/guards/bash-write-patterns.ts
+/** Code-file extensions the write guards police (shared by CODE_REDIRECT and
+*  CODE_COMMAND_WRITE). Case-sensitive, parity with the Python guard's list. */
+const CODE_EXT = "ts|tsx|js|jsx|py|go|rb|rs|java|kt|php|swift|vue|svelte|astro|css|c|cpp|h";
 /** Redirect (`>`/`>>`) targeting a code-file extension. */
-const CODE_REDIRECT = /(?:>>?)\s*[^\s|;&]*\.(?:ts|tsx|js|jsx|py|go|rb|rs|java|kt|php|swift|vue|svelte|astro|css|c|cpp|h)\b/;
+const CODE_REDIRECT = new RegExp(`(?:>>?)\\s*[^\\s|;&]*\\.(?:${CODE_EXT})\\b`);
 /**
 * Interpreters / tools that mutate source in place, plus heredoc-into-file —
 * split into labeled sub-patterns (parity bash-write-guard.py `DENY_PATTERNS`,
 * each with its own `desc`) so the deny reason names which motif matched
-* instead of a single generic message for all six.
+* instead of a single generic message. Every command-named motif is
+* {@link CMD}-anchored (start/separator + optional wrapper chain); only the
+* structural heredoc-into-file motif is position-free.
 */
 const CODE_MUTATORS = [
 	{
-		re: /\bpython3?\s+-\s*<</,
+		re: new RegExp(`${CMD}python3?\\s+-\\s*<<`),
 		desc: "Python heredoc input"
 	},
 	{
-		re: /\bpython3?\s+-c\b/,
+		re: new RegExp(`${CMD}python3?\\s+-c\\b`),
 		desc: "Python inline script"
 	},
 	{
-		re: /\bsed\b[^|]*\s-i/,
+		re: new RegExp(`${CMD}sed\\b[^|]*\\s-i`),
 		desc: "sed in-place edit"
 	},
 	{
-		re: /\bperl\b[^|]*\s-[pi]i?\b/,
+		re: new RegExp(`${CMD}perl\\b[^|]*\\s-[pi]i?\\b`),
 		desc: "perl in-place edit"
 	},
 	{
-		re: /\bawk\b[^|]*-i\s*inplace/,
+		re: new RegExp(`${CMD}awk\\b[^|]*-i\\s*inplace`),
 		desc: "awk in-place edit"
 	},
 	{
-		re: /(?:^|[\n;&|(])\s*patch(?=\s|<|[;&|)>]|$)/,
+		re: new RegExp(`${CMD}patch(?=\\s|<|[;&|)>]|$)`),
 		desc: "patch file modification"
 	},
 	{
@@ -444,6 +466,15 @@ const CODE_MUTATORS = [
 		desc: "heredoc redirected into a file"
 	}
 ];
+/**
+* `tee`/`dd of=` whose TARGET is a code file — the command-form parallel to
+* CODE_REDIRECT. {@link CMD}-anchored so `env`/`timeout` wrappers don't shield
+* it; the `tee` branch scans ALL args up to the next `;&|` separator so a
+* decoy-first-target (`tee log.txt src/x.ts`) can't hide the code write. A tee
+* to a NON-code target (`cmd | tee results.txt`) does not match — it stays a
+* plain ASK_WRITERS ask, never a hard block, so ordinary logging is untouched.
+*/
+const CODE_COMMAND_WRITE = new RegExp(`${CMD}(?:tee\\s+[^;&|\\n]*?|dd\\b[^|]*\\bof=\\S*)\\.(?:${CODE_EXT})\\b`);
 /** File-mutating one-liners via `node -e` / `ruby -e` (parity NODE_WRITES/RUBY_WRITES). */
 const NODE_WRITES = /writeFile|appendFile|createWriteStream|fs\.(?:write|rename|unlink|mkdir|rmdir|copyFile)|execSync|spawnSync|child_process/;
 const RUBY_WRITES = /File\.(?:write|open|delete|rename)|IO\.write|FileUtils|\bsystem\b|\bexec\b|`[^`]/;
@@ -530,11 +561,22 @@ function askFileWrite(reason) {
 * to source files); asks before other file-writing shell commands unless the
 * target is a harness-owned safe path. Forces use of the Write/Edit tool so
 * APEX/SOLID checks are not bypassed.
+*
+* The code-write detectors (CODE_MUTATORS, CODE_COMMAND_WRITE) run BEFORE the
+* SAFE_PREFIXES short-circuit: they are command-position anchored
+* (bash-command-anchor.ts), so a transparent wrapper (`env sed -i src/x.ts`,
+* `timeout 5 patch`, `cp a b; tee src/y.ts`) can no longer smuggle a code write
+* past its safe first token, while a quoted mention (`git commit -m "fix sed -i"`)
+* still falls through. The short-circuit becomes the terminal allow — "first
+* token never writes, nothing above matched".
 */
 function bashWriteGuard(ctx) {
 	if (ctx.tool !== "Bash" || !ctx.command) return null;
 	const cmd = ctx.command;
 	const stripped = cmd.trim();
+	const mutator = CODE_MUTATORS.find((m) => m.re.test(cmd));
+	if (mutator) return blockCodeWrite(`${mutator.desc} — Use Edit/Write tools instead`);
+	if (CODE_COMMAND_WRITE.test(cmd)) return blockCodeWrite("tee/dd into a code file — Use Edit/Write tools instead");
 	if (SAFE_PREFIXES.some((p) => stripped.startsWith(p)) && !FILE_REDIRECT.test(stripped)) return null;
 	if (cmd.includes(".fuse-harness/cache/sessions")) return {
 		kind: "block",
@@ -542,8 +584,6 @@ function bashWriteGuard(ctx) {
 		reason: "Bash access to the harness session-state directory is a hook-bypass vector — the freshness/APEX enforcement reads it to decide block/allow.",
 		actions: ["Never read or write session state from the shell"]
 	};
-	const mutator = CODE_MUTATORS.find((m) => m.re.test(cmd));
-	if (mutator) return blockCodeWrite(`${mutator.desc} — Use Edit/Write tools instead`);
 	if (FILE_REDIRECT.test(cmd)) {
 		if (isSafeWritePath(cmd)) return null;
 		return CODE_REDIRECT.test(cmd) ? blockCodeWrite("Bash redirect to code file — Use Write/Edit tools (enforces APEX + SOLID specs)") : askFileWrite("Shell redirect to file detected. Authorize?");

package/dist/{handle-B6yL03we.mjs → handle-DJovWDAy.mjs}

@@ -4,7 +4,7 @@ import { r as projectLayout } from "./layout-C0jaaCQC.mjs";
 import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
 import { A as detectCreationIntent, E as isExcludedSwiftPath, F as docConsultedGate, H as detectProjectType$1, I as evaluateApex, M as POST_AUTH_GATES, N as PRE_AUTH_GATES, S as usesTailwindUtilities, T as isExcludedJsPath, V as detectModularArchitecture, W as requiredArchSkill, _ as scanPlugin, c as EXCLUDE_DIRS$1, d as buildApexTaskInjection, h as buildClaudeMdContext, k as capVerbosity, l as PROJECT_INDICATORS, n as missingSeoElements, o as parseEnrichment, r as descFromText, s as parseEntry, t as isHtmlLike, w as frameworkSolidGate, x as skillTriggerGate, y as parseField, z as detectFramework } from "./validate-DCQ8dkdL.mjs";
 import { a as sanitizeSessionId, c as sessionsDir, d as countFrameworkCodeLines, f as countLines, i as loadSessionState, l as PLUGINS_DIR, n as fuseHarnessHome, o as saveSessionState, r as fusengineCache, t as claudeHome } from "./home-state-D0RLWP8J.mjs";
-import { n as FAIL_CLOSED, t as evaluate } from "./evaluate-BgFLlqrs.mjs";
+import { n as FAIL_CLOSED, t as evaluate } from "./evaluate-PuyQPU36.mjs";
 import { a as writeJsonFile, i as readJsonFile, r as hashText, t as atomicWrite } from "./json-io-DisYd2fb.mjs";
 import { r as isDocConsulted } from "./doc-helpers-CWZegVdR.mjs";
 import { n as findMarketplacePlugins, r as readPluginMeta, t as resolveSkillPath } from "./skill-path-DhItkBzk.mjs";
@@ -14,8 +14,8 @@ import { d as loadIndex, i as cacheLookupMeta, n as webfetchCacheWrite, o as cac
 import { t as loadRefs } from "./loader-AGz4nK7d.mjs";
 import { a as writeLastNonce, c as recordAgent, d as recordRefRead, f as recordTarget, h as apexAuthorizationGate, i as verifyTrack, l as recordBrainstormRequired, m as trivialCount, n as saveTrack, o as agentsFresh, p as recordTrivialEdit, r as signTrack, s as emptyTrack, t as loadTrack, u as recordDoc } from "./store-CQ4roWrU.mjs";
 import { t as parseApplyPatch } from "./apply-patch-CIS2EZ_q.mjs";
-import { d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-BLuab-tR.mjs";
-import { r as toHermesResponse } from "./hermes-CyhCYqD7.mjs";
+import { _ as commandToString, d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-BJER7Mbj.mjs";
+import { r as toHermesResponse } from "./hermes-DKPzVwI7.mjs";
 import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
 import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -111,7 +111,7 @@ function normalizeEvent(id, payload) {
 		...base,
 		filePath: str(input.file_path) ?? str(input.path) ?? str(payload.file_path),
 		content: str(input.content) ?? str(input.new_string),
-		command: str(input.command) ?? str(payload.command)
+		command: commandToString(input.command) ?? commandToString(payload.command)
 	};
 }
 //#endregion

package/dist/{hermes-CyhCYqD7.mjs → hermes-DKPzVwI7.mjs}

@@ -1,6 +1,6 @@
-import { t as evaluate } from "./evaluate-BgFLlqrs.mjs";
+import { t as evaluate } from "./evaluate-PuyQPU36.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
-import { c as readClaudeInput } from "./claude-BLuab-tR.mjs";
+import { _ as commandToString, c as readClaudeInput } from "./claude-BJER7Mbj.mjs";
 //#region src/adapters/hermes/index.ts
 /**
 * Hermes Agent adapter (hook-mode). Nous Research's hermes-agent (2026) pipes a
@@ -45,7 +45,7 @@ function guard(input) {
 		tool: input.tool_name ?? "write_file",
 		filePath: t?.path ?? t?.file_path,
 		content: t?.content,
-		command: t?.command
+		command: commandToString(t?.command)
 	});
 	if (r.decision === "allow" || !r.prompt) return null;
 	return toHermesResponse(r.prompt);

package/dist/{index-BfMsILmg.d.mts → index-BUDzFkeo.d.mts}

@@ -218,7 +218,9 @@ declare const CODE_REDIRECT: RegExp;
 * Interpreters / tools that mutate source in place, plus heredoc-into-file —
 * split into labeled sub-patterns (parity bash-write-guard.py `DENY_PATTERNS`,
 * each with its own `desc`) so the deny reason names which motif matched
-* instead of a single generic message for all six.
+* instead of a single generic message. Every command-named motif is
+* {@link CMD}-anchored (start/separator + optional wrapper chain); only the
+* structural heredoc-into-file motif is position-free.
 */
 declare const CODE_MUTATORS: readonly {
   re: RegExp;
@@ -250,6 +252,14 @@ declare const SESSION_STATE_FRAGMENT = ".fuse-harness/cache/sessions";
 * to source files); asks before other file-writing shell commands unless the
 * target is a harness-owned safe path. Forces use of the Write/Edit tool so
 * APEX/SOLID checks are not bypassed.
+*
+* The code-write detectors (CODE_MUTATORS, CODE_COMMAND_WRITE) run BEFORE the
+* SAFE_PREFIXES short-circuit: they are command-position anchored
+* (bash-command-anchor.ts), so a transparent wrapper (`env sed -i src/x.ts`,
+* `timeout 5 patch`, `cp a b; tee src/y.ts`) can no longer smuggle a code write
+* past its safe first token, while a quoted mention (`git commit -m "fix sed -i"`)
+* still falls through. The short-circuit becomes the terminal allow — "first
+* token never writes, nothing above matched".
 */
 declare function bashWriteGuard(ctx: GuardContext): Prompt | null;
 //#endregion

package/dist/{index-DZCLmSoO.d.mts → index-ce2J1bHC.d.mts}

@@ -9,7 +9,7 @@ interface ClaudeHookInput {
     file_path?: string;
     content?: string;
     new_string?: string;
-    command?: string;
+    command?: string | string[];
   };
   cwd?: string;
 }

package/dist/index.d.mts

@@ -5,7 +5,7 @@ import { a as HarnessInfo, i as HarnessId, n as detectMode, o as HarnessMode, r
 import { a as isDocConsulted, i as formatDocSatisfactionStatus, n as DocSatisfactionStatus, o as resolveSessions, r as formatDocDeny, t as AuthEntry } from "./doc-helpers-CEKzGg2u.mjs";
 import { t as incrementTrivialEditCounter } from "./index-BOBXQ91y.mjs";
 import { a as compactJson, i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFile } from "./index-BEMumjOw.mjs";
-import { $ as ASK_PATTERNS, A as FAIL_CLOSED, B as SWIFT_PROTO_RE, C as usesTailwindUtilities, Ct as ModularArchitecture, D as MAX_TOKENS, Dt as isApexCommand, E as MAX_EXA_RESULTS, Et as detectProjectType, F as installGuard, G as CODE_MUTATORS, H as interfaceSeparationGuard, I as GO_DECL_RE, J as SAFE_PREFIXES, K as CODE_REDIRECT, L as JAVA_DECL_RE, M as clearUserGuards, N as registerGuard, O as capVerbosity, Ot as requiredArchSkill, P as runGuards, Q as protectedPathGuard, R as PHP_DECL_RE, S as skillTriggerGate, St as DEV_KEYWORDS, T as frameworkSolidGate, Tt as detectModularArchitecture, U as bashWriteGuard, V as TS_DECL_RE, W as ASK_WRITERS, X as PROTECTED_FRAGMENTS, Y as SESSION_STATE_FRAGMENT, Z as PROTECTED_GIT_RE, _ as DEV_VERBS, _t as SOLID_REF, a as firstHeading, at as evaluate, b as detectClaudeMdProjectType, bt as evaluateFileSize, c as parseEntry, ct as GIT_ASK, d as EXCLUDE_DIRS, dt as RALPH_SAFE, et as CRITICAL_PATTERNS, f as PROJECT_INDICATORS, ft as SYSTEM_INSTALL, g as loadApexTaskState, gt as PLUGINS_DIR, h as buildApexTaskInjection, ht as FileSizeVerdict, i as firstComment, it as GuardContext, j as GUARDS, k as detectCreationIntent, l as parseBodyDesc, lt as GIT_BLOCKED, m as buildApexTaskContext, mt as matchPatterns, n as missingSeoElements, nt as securityGuard, o as TreeEntry, ot as PolicyContext, p as ApexTaskState, pt as isRalphMode, q as FILE_REDIRECT, r as descFromText, rt as Guard, s as parseEnrichment, st as PolicyResult, t as isHtmlLike, tt as LabeledPattern, u as parseField, ut as PROJECT_INSTALL, v as buildApexInstruction, vt as countFrameworkCodeLines, w as SKILL_TRIGGERS, wt as ProjectType, x as detectRequiredSkills, xt as detectFramework, y as buildClaudeMdContext, yt as countLines, z as PY_MODEL_RE } from "./index-BfMsILmg.mjs";
+import { $ as ASK_PATTERNS, A as FAIL_CLOSED, B as SWIFT_PROTO_RE, C as usesTailwindUtilities, Ct as ModularArchitecture, D as MAX_TOKENS, Dt as isApexCommand, E as MAX_EXA_RESULTS, Et as detectProjectType, F as installGuard, G as CODE_MUTATORS, H as interfaceSeparationGuard, I as GO_DECL_RE, J as SAFE_PREFIXES, K as CODE_REDIRECT, L as JAVA_DECL_RE, M as clearUserGuards, N as registerGuard, O as capVerbosity, Ot as requiredArchSkill, P as runGuards, Q as protectedPathGuard, R as PHP_DECL_RE, S as skillTriggerGate, St as DEV_KEYWORDS, T as frameworkSolidGate, Tt as detectModularArchitecture, U as bashWriteGuard, V as TS_DECL_RE, W as ASK_WRITERS, X as PROTECTED_FRAGMENTS, Y as SESSION_STATE_FRAGMENT, Z as PROTECTED_GIT_RE, _ as DEV_VERBS, _t as SOLID_REF, a as firstHeading, at as evaluate, b as detectClaudeMdProjectType, bt as evaluateFileSize, c as parseEntry, ct as GIT_ASK, d as EXCLUDE_DIRS, dt as RALPH_SAFE, et as CRITICAL_PATTERNS, f as PROJECT_INDICATORS, ft as SYSTEM_INSTALL, g as loadApexTaskState, gt as PLUGINS_DIR, h as buildApexTaskInjection, ht as FileSizeVerdict, i as firstComment, it as GuardContext, j as GUARDS, k as detectCreationIntent, l as parseBodyDesc, lt as GIT_BLOCKED, m as buildApexTaskContext, mt as matchPatterns, n as missingSeoElements, nt as securityGuard, o as TreeEntry, ot as PolicyContext, p as ApexTaskState, pt as isRalphMode, q as FILE_REDIRECT, r as descFromText, rt as Guard, s as parseEnrichment, st as PolicyResult, t as isHtmlLike, tt as LabeledPattern, u as parseField, ut as PROJECT_INSTALL, v as buildApexInstruction, vt as countFrameworkCodeLines, w as SKILL_TRIGGERS, wt as ProjectType, x as detectRequiredSkills, xt as detectFramework, y as buildClaudeMdContext, yt as countLines, z as PY_MODEL_RE } from "./index-BUDzFkeo.mjs";
 import { n as RouteResult, r as ScoredRef, t as RefMeta } from "./types-CY5qT2X1.mjs";
 import { a as PRE_AUTH_GATES, c as evaluateApex, i as POST_AUTH_GATES, l as freshnessGate, n as ApexContext, o as brainstormGate, r as ApexGate, s as docConsultedGate, t as APEX_GATES, u as solidReadGate } from "./apex-Wdi1nq_w.mjs";
 import { a as ReminderState, c as readState, d as throttleMs, i as registryFile, l as setStateField, n as addRoot, o as lessonsFileFor, r as readRoots, s as nowStamp, t as ensureMemoryGitignore, u as stateFileFor } from "./index-DLYhervv.mjs";

package/dist/index.mjs

@@ -6,7 +6,7 @@ import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFi
 import { n as detectMode, r as modeFor, t as detectHarness } from "./harness-Cb9xR8dC.mjs";
 import { A as detectCreationIntent, B as DEV_KEYWORDS, C as SKILL_TRIGGERS, D as MAX_EXA_RESULTS, F as docConsultedGate, H as detectProjectType, I as evaluateApex, L as freshnessGate, M as POST_AUTH_GATES, N as PRE_AUTH_GATES, O as MAX_TOKENS, P as brainstormGate, R as solidReadGate, S as usesTailwindUtilities, U as isApexCommand, V as detectModularArchitecture, W as requiredArchSkill, a as firstHeading, b as detectRequiredSkills, c as EXCLUDE_DIRS, d as buildApexTaskInjection, f as loadApexTaskState, g as detectClaudeMdProjectType, h as buildClaudeMdContext, i as firstComment, j as APEX_GATES, k as capVerbosity, l as PROJECT_INDICATORS, m as buildApexInstruction, n as missingSeoElements, o as parseEnrichment, p as DEV_VERBS, r as descFromText, s as parseEntry, t as isHtmlLike, u as buildApexTaskContext, v as parseBodyDesc, w as frameworkSolidGate, x as skillTriggerGate, y as parseField, z as detectFramework } from "./validate-DCQ8dkdL.mjs";
 import { d as countFrameworkCodeLines, f as countLines, l as PLUGINS_DIR, p as evaluateFileSize, u as SOLID_REF } from "./home-state-D0RLWP8J.mjs";
-import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "./evaluate-BgFLlqrs.mjs";
+import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "./evaluate-PuyQPU36.mjs";
 import { i as resolveSessions, n as formatDocSatisfactionStatus, r as isDocConsulted, t as formatDocDeny } from "./doc-helpers-CWZegVdR.mjs";
 import { i as parseFrontmatter, n as scoreReferences, r as globToRe, t as routeReferences } from "./router-PKVNBHge.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";

package/dist/policy/index.d.mts

@@ -1,3 +1,3 @@
-import { $ as ASK_PATTERNS, A as FAIL_CLOSED, B as SWIFT_PROTO_RE, C as usesTailwindUtilities, Ct as ModularArchitecture, D as MAX_TOKENS, Dt as isApexCommand, E as MAX_EXA_RESULTS, Et as detectProjectType, F as installGuard, G as CODE_MUTATORS, H as interfaceSeparationGuard, I as GO_DECL_RE, J as SAFE_PREFIXES, K as CODE_REDIRECT, L as JAVA_DECL_RE, M as clearUserGuards, N as registerGuard, O as capVerbosity, Ot as requiredArchSkill, P as runGuards, Q as protectedPathGuard, R as PHP_DECL_RE, S as skillTriggerGate, St as DEV_KEYWORDS, T as frameworkSolidGate, Tt as detectModularArchitecture, U as bashWriteGuard, V as TS_DECL_RE, W as ASK_WRITERS, X as PROTECTED_FRAGMENTS, Y as SESSION_STATE_FRAGMENT, Z as PROTECTED_GIT_RE, _ as DEV_VERBS, _t as SOLID_REF, a as firstHeading, at as evaluate, b as detectClaudeMdProjectType, bt as evaluateFileSize, c as parseEntry, ct as GIT_ASK, d as EXCLUDE_DIRS, dt as RALPH_SAFE, et as CRITICAL_PATTERNS, f as PROJECT_INDICATORS, ft as SYSTEM_INSTALL, g as loadApexTaskState, gt as PLUGINS_DIR, h as buildApexTaskInjection, ht as FileSizeVerdict, i as firstComment, it as GuardContext, j as GUARDS, k as detectCreationIntent, l as parseBodyDesc, lt as GIT_BLOCKED, m as buildApexTaskContext, mt as matchPatterns, n as missingSeoElements, nt as securityGuard, o as TreeEntry, ot as PolicyContext, p as ApexTaskState, pt as isRalphMode, q as FILE_REDIRECT, r as descFromText, rt as Guard, s as parseEnrichment, st as PolicyResult, t as isHtmlLike, tt as LabeledPattern, u as parseField, ut as PROJECT_INSTALL, v as buildApexInstruction, vt as countFrameworkCodeLines, w as SKILL_TRIGGERS, wt as ProjectType, x as detectRequiredSkills, xt as detectFramework, y as buildClaudeMdContext, yt as countLines, z as PY_MODEL_RE } from "../index-BfMsILmg.mjs";
+import { $ as ASK_PATTERNS, A as FAIL_CLOSED, B as SWIFT_PROTO_RE, C as usesTailwindUtilities, Ct as ModularArchitecture, D as MAX_TOKENS, Dt as isApexCommand, E as MAX_EXA_RESULTS, Et as detectProjectType, F as installGuard, G as CODE_MUTATORS, H as interfaceSeparationGuard, I as GO_DECL_RE, J as SAFE_PREFIXES, K as CODE_REDIRECT, L as JAVA_DECL_RE, M as clearUserGuards, N as registerGuard, O as capVerbosity, Ot as requiredArchSkill, P as runGuards, Q as protectedPathGuard, R as PHP_DECL_RE, S as skillTriggerGate, St as DEV_KEYWORDS, T as frameworkSolidGate, Tt as detectModularArchitecture, U as bashWriteGuard, V as TS_DECL_RE, W as ASK_WRITERS, X as PROTECTED_FRAGMENTS, Y as SESSION_STATE_FRAGMENT, Z as PROTECTED_GIT_RE, _ as DEV_VERBS, _t as SOLID_REF, a as firstHeading, at as evaluate, b as detectClaudeMdProjectType, bt as evaluateFileSize, c as parseEntry, ct as GIT_ASK, d as EXCLUDE_DIRS, dt as RALPH_SAFE, et as CRITICAL_PATTERNS, f as PROJECT_INDICATORS, ft as SYSTEM_INSTALL, g as loadApexTaskState, gt as PLUGINS_DIR, h as buildApexTaskInjection, ht as FileSizeVerdict, i as firstComment, it as GuardContext, j as GUARDS, k as detectCreationIntent, l as parseBodyDesc, lt as GIT_BLOCKED, m as buildApexTaskContext, mt as matchPatterns, n as missingSeoElements, nt as securityGuard, o as TreeEntry, ot as PolicyContext, p as ApexTaskState, pt as isRalphMode, q as FILE_REDIRECT, r as descFromText, rt as Guard, s as parseEnrichment, st as PolicyResult, t as isHtmlLike, tt as LabeledPattern, u as parseField, ut as PROJECT_INSTALL, v as buildApexInstruction, vt as countFrameworkCodeLines, w as SKILL_TRIGGERS, wt as ProjectType, x as detectRequiredSkills, xt as detectFramework, y as buildClaudeMdContext, yt as countLines, z as PY_MODEL_RE } from "../index-BUDzFkeo.mjs";
 import { a as PRE_AUTH_GATES, c as evaluateApex, i as POST_AUTH_GATES, l as freshnessGate, n as ApexContext, o as brainstormGate, r as ApexGate, s as docConsultedGate, t as APEX_GATES, u as solidReadGate } from "../apex-Wdi1nq_w.mjs";
 export { APEX_GATES, ASK_PATTERNS, ASK_WRITERS, ApexContext, ApexGate, ApexTaskState, CODE_MUTATORS, CODE_REDIRECT, CRITICAL_PATTERNS, DEV_KEYWORDS, DEV_VERBS, EXCLUDE_DIRS, FAIL_CLOSED, FILE_REDIRECT, FileSizeVerdict, GIT_ASK, GIT_BLOCKED, GO_DECL_RE, GUARDS, Guard, GuardContext, JAVA_DECL_RE, LabeledPattern, MAX_EXA_RESULTS, MAX_TOKENS, ModularArchitecture, PHP_DECL_RE, PLUGINS_DIR, POST_AUTH_GATES, PRE_AUTH_GATES, PROJECT_INDICATORS, PROJECT_INSTALL, PROTECTED_FRAGMENTS, PROTECTED_GIT_RE, PY_MODEL_RE, type PolicyContext, type PolicyResult, ProjectType, RALPH_SAFE, SAFE_PREFIXES, SESSION_STATE_FRAGMENT, SKILL_TRIGGERS, SOLID_REF, SWIFT_PROTO_RE, SYSTEM_INSTALL, TS_DECL_RE, TreeEntry, bashWriteGuard, brainstormGate, buildApexInstruction, buildApexTaskContext, buildApexTaskInjection, buildClaudeMdContext, capVerbosity, clearUserGuards, countFrameworkCodeLines, countLines, descFromText, detectClaudeMdProjectType, detectCreationIntent, detectFramework, detectModularArchitecture, detectProjectType, detectRequiredSkills, docConsultedGate, evaluate, evaluateApex, evaluateFileSize, firstComment, firstHeading, frameworkSolidGate, freshnessGate, installGuard, interfaceSeparationGuard, isApexCommand, isHtmlLike, isRalphMode, loadApexTaskState, matchPatterns, missingSeoElements, parseBodyDesc, parseEnrichment, parseEntry, parseField, protectedPathGuard, registerGuard, requiredArchSkill, runGuards, securityGuard, skillTriggerGate, solidReadGate, usesTailwindUtilities };

package/dist/policy/index.mjs

@@ -1,5 +1,5 @@
 import { A as detectCreationIntent, B as DEV_KEYWORDS, C as SKILL_TRIGGERS, D as MAX_EXA_RESULTS, F as docConsultedGate, H as detectProjectType, I as evaluateApex, L as freshnessGate, M as POST_AUTH_GATES, N as PRE_AUTH_GATES, O as MAX_TOKENS, P as brainstormGate, R as solidReadGate, S as usesTailwindUtilities, U as isApexCommand, V as detectModularArchitecture, W as requiredArchSkill, a as firstHeading, b as detectRequiredSkills, c as EXCLUDE_DIRS, d as buildApexTaskInjection, f as loadApexTaskState, g as detectClaudeMdProjectType, h as buildClaudeMdContext, i as firstComment, j as APEX_GATES, k as capVerbosity, l as PROJECT_INDICATORS, m as buildApexInstruction, n as missingSeoElements, o as parseEnrichment, p as DEV_VERBS, r as descFromText, s as parseEntry, t as isHtmlLike, u as buildApexTaskContext, v as parseBodyDesc, w as frameworkSolidGate, x as skillTriggerGate, y as parseField, z as detectFramework } from "../validate-DCQ8dkdL.mjs";
 import { d as countFrameworkCodeLines, f as countLines, l as PLUGINS_DIR, p as evaluateFileSize, u as SOLID_REF } from "../home-state-D0RLWP8J.mjs";
-import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "../evaluate-BgFLlqrs.mjs";
+import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "../evaluate-PuyQPU36.mjs";
 import "../policy-la_KkjCS.mjs";
 export { APEX_GATES, ASK_PATTERNS, ASK_WRITERS, CODE_MUTATORS, CODE_REDIRECT, CRITICAL_PATTERNS, DEV_KEYWORDS, DEV_VERBS, EXCLUDE_DIRS, FAIL_CLOSED, FILE_REDIRECT, GIT_ASK, GIT_BLOCKED, GO_DECL_RE, GUARDS, JAVA_DECL_RE, MAX_EXA_RESULTS, MAX_TOKENS, PHP_DECL_RE, PLUGINS_DIR, POST_AUTH_GATES, PRE_AUTH_GATES, PROJECT_INDICATORS, PROJECT_INSTALL, PROTECTED_FRAGMENTS, PROTECTED_GIT_RE, PY_MODEL_RE, RALPH_SAFE, SAFE_PREFIXES, SESSION_STATE_FRAGMENT, SKILL_TRIGGERS, SOLID_REF, SWIFT_PROTO_RE, SYSTEM_INSTALL, TS_DECL_RE, bashWriteGuard, brainstormGate, buildApexInstruction, buildApexTaskContext, buildApexTaskInjection, buildClaudeMdContext, capVerbosity, clearUserGuards, countFrameworkCodeLines, countLines, descFromText, detectClaudeMdProjectType, detectCreationIntent, detectFramework, detectModularArchitecture, detectProjectType, detectRequiredSkills, docConsultedGate, evaluate, evaluateApex, evaluateFileSize, firstComment, firstHeading, frameworkSolidGate, freshnessGate, installGuard, interfaceSeparationGuard, isApexCommand, isHtmlLike, isRalphMode, loadApexTaskState, matchPatterns, missingSeoElements, parseBodyDesc, parseEnrichment, parseEntry, parseField, protectedPathGuard, registerGuard, requiredArchSkill, runGuards, securityGuard, skillTriggerGate, solidReadGate, usesTailwindUtilities };

package/dist/{run-B4b2_7Qm.mjs → run-CvqZrZUR.mjs}

@@ -1,5 +1,5 @@
 import { t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
-import { t as evaluate } from "./evaluate-BgFLlqrs.mjs";
+import { t as evaluate } from "./evaluate-PuyQPU36.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/run.ts

package/dist/runtime/index.mjs

@@ -1,6 +1,6 @@
 import { r as projectLayout } from "../layout-C0jaaCQC.mjs";
 import { a as sanitizeSessionId, c as sessionsDir, i as loadSessionState, n as fuseHarnessHome, o as saveSessionState, r as fusengineCache, s as sessionStatePath, t as claudeHome } from "../home-state-D0RLWP8J.mjs";
-import { $ as postEditTypescript, A as trackSkillRead, At as trackFile, B as isProject, C as seoPostToolUse, Ct as gitContext, D as postTrackingSideEffects, Dt as taskContext, E as securityAdvisory, Et as promptSubmitContext, F as dispatchLessons, Ft as securityStateDir, G as getFileDesc, H as loadEnriched, I as cartoSessionStart, It as securityStatePath, K as listChildren, L as generateEcosystemMap, Lt as todayUtc, M as dispatchLifecycle, Mt as isoUtc, N as aipilotPostToolUse, Nt as loadSecurityState, O as trackWatchResearch, Ot as defaultStateDir, P as dispatchAipilot, Pt as saveSecurityState, Q as lessonsStateFileFor, R as writePluginMap, S as postEditContext, St as devContext, T as dispatchMemory, Tt as claudeMdKey, U as mergeLines, V as writeTree, W as countFiles, X as lessonsArchiveFileFor, Z as lessonsFileFor, _ as preCommitGate, _t as sessionStartCore, a as recordActivity, at as validateTeammateOutput, b as extractSymbols, bt as removeOldFiles, c as MCP_TTL_MS, ct as validateTailwind, d as isMcpTool, dt as countLoc, et as trackSessionChanges, f as queryOf, ft as detectSolidProfile, g as gate, gt as runSessionStartCleanups, h as TRIVIAL_BUDGET, ht as readRules, i as respond, it as logToolFailure, j as trackEnrichment, jt as normalizeEvent, k as trackMcpResearch, kt as projectHash, l as WEBFETCH_TTL_MS, lt as validateSolidGate, m as REQUIRED_AGENTS, mt as injectRules, n as activityFor, nt as cleanupSession, o as mcpPostStore, ot as trackAgentMemory, p as DEFAULT_WINDOW_MS, pt as solidDetectStart, r as handlePre, rt as saveApexState, s as mcpPreIntercept, st as subagentCacheContext, t as handleHook, tt as validateRulesLoaded, u as cacheQueryOf, ut as checkFileSize, v as detectDuplication, vt as pruneEmptyDirs, w as seoPostToolUseResponse, wt as projectContext, x as lifecycleStdout, xt as trimLogFile, y as dryGate, yt as purgeTtlTree, z as generateProjectMap } from "../handle-B6yL03we.mjs";
+import { $ as postEditTypescript, A as trackSkillRead, At as trackFile, B as isProject, C as seoPostToolUse, Ct as gitContext, D as postTrackingSideEffects, Dt as taskContext, E as securityAdvisory, Et as promptSubmitContext, F as dispatchLessons, Ft as securityStateDir, G as getFileDesc, H as loadEnriched, I as cartoSessionStart, It as securityStatePath, K as listChildren, L as generateEcosystemMap, Lt as todayUtc, M as dispatchLifecycle, Mt as isoUtc, N as aipilotPostToolUse, Nt as loadSecurityState, O as trackWatchResearch, Ot as defaultStateDir, P as dispatchAipilot, Pt as saveSecurityState, Q as lessonsStateFileFor, R as writePluginMap, S as postEditContext, St as devContext, T as dispatchMemory, Tt as claudeMdKey, U as mergeLines, V as writeTree, W as countFiles, X as lessonsArchiveFileFor, Z as lessonsFileFor, _ as preCommitGate, _t as sessionStartCore, a as recordActivity, at as validateTeammateOutput, b as extractSymbols, bt as removeOldFiles, c as MCP_TTL_MS, ct as validateTailwind, d as isMcpTool, dt as countLoc, et as trackSessionChanges, f as queryOf, ft as detectSolidProfile, g as gate, gt as runSessionStartCleanups, h as TRIVIAL_BUDGET, ht as readRules, i as respond, it as logToolFailure, j as trackEnrichment, jt as normalizeEvent, k as trackMcpResearch, kt as projectHash, l as WEBFETCH_TTL_MS, lt as validateSolidGate, m as REQUIRED_AGENTS, mt as injectRules, n as activityFor, nt as cleanupSession, o as mcpPostStore, ot as trackAgentMemory, p as DEFAULT_WINDOW_MS, pt as solidDetectStart, r as handlePre, rt as saveApexState, s as mcpPreIntercept, st as subagentCacheContext, t as handleHook, tt as validateRulesLoaded, u as cacheQueryOf, ut as checkFileSize, v as detectDuplication, vt as pruneEmptyDirs, w as seoPostToolUseResponse, wt as projectContext, x as lifecycleStdout, xt as trimLogFile, y as dryGate, yt as purgeTtlTree, z as generateProjectMap } from "../handle-DJovWDAy.mjs";
 //#region src/runtime/storage.ts
 /**
 * The project's single state dir (`<root>/.harness`) — neutral + harness-agnostic,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusengine/harness",
-  "version": "0.1.59",
+  "version": "0.1.61",
   "description": "Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable prompts), cache, project memory, ref routing, state/locks, statusline, per-harness adapters (Claude/Cursor/Cline/Gemini) and a cli-mode harness-check binary. Bun-native, with a built dist for Node + bundlers.",
   "type": "module",
   "module": "src/index.ts",