@fusengine/harness 0.1.91 → 0.1.93

package/dist/{hermes-B9-p_3IF.mjs → hermes-ByopGx6C.mjs}

@@ -1,7 +1,7 @@
 import { t as evaluate } from "./evaluate-CMiIqHeH.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { t as commandToString } from "./command-string-CALMTnwN.mjs";
-import { c as readClaudeInput } from "./claude-Ckv2_TgP.mjs";
+import { c as readClaudeInput } from "./claude-D62hkUfS.mjs";
 //#region src/adapters/hermes/index.ts
 /**
 * Hermes Agent adapter (hook-mode). Nous Research's hermes-agent (2026) pipes a

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { n as PromptKind, r as formatPrompt, t as Prompt } from "./types-Bh0jEF3_.mjs";
 import { _ as queryHash, a as cacheLookupSubstringMeta, c as mcpCacheKey, d as extractText, f as IndexSummary, g as jaccardSimilar, h as compactMarkdown, i as cacheLookupSubstring, l as mcpCacheWrite, m as summarizeIndex, n as cacheLookup, o as cachePath, p as loadIndex, r as cacheLookupMeta, s as cacheStore, t as CacheHit, u as webfetchCacheWrite } from "./index-DhmV2MPh.mjs";
-import { _ as DEFAULT_TTL_SEC, a as ProjectLayout, b as ttlLabel, c as projectLayout, d as MAX_LINES_ENV_KEY, f as hookBudget, g as storeBudget, h as splitTarget, i as parseEnvFile, l as DEFAULT_MAX_LINES, m as resolveStdinMaxBytes, n as envCandidates, o as STATE_GITIGNORE, p as resolveMaxLines, r as loadDotenv, s as STATE_ROOT, t as HOME_DIR, u as DEFAULT_STDIN_MAX_BYTES, v as TTL_ENV_KEY, x as parseEnvInt, y as resolveTtlSec } from "./index-oXXPs2xl.mjs";
 import { i as HarnessVia, n as HarnessInfo, r as HarnessMode, t as HarnessId } from "./types-DvXTI71X.mjs";
+import { _ as DEFAULT_TTL_SEC, a as ProjectLayout, b as ttlLabel, c as projectLayout, d as MAX_LINES_ENV_KEY, f as hookBudget, g as storeBudget, h as splitTarget, i as parseEnvFile, l as DEFAULT_MAX_LINES, m as resolveStdinMaxBytes, n as envCandidates, o as STATE_GITIGNORE, p as resolveMaxLines, r as loadDotenv, s as STATE_ROOT, t as HOME_DIR, u as DEFAULT_STDIN_MAX_BYTES, v as TTL_ENV_KEY, x as parseEnvInt, y as resolveTtlSec } from "./index-oXXPs2xl.mjs";
 import { n as detectMode, r as modeFor, t as detectHarness } from "./index-CigBu4K9.mjs";
 import { a as isDocConsulted, i as formatDocSatisfactionStatus, n as DocSatisfactionStatus, o as resolveSessions, r as formatDocDeny, t as AuthEntry } from "./doc-helpers-BGCzP9VF.mjs";
 import { t as incrementTrivialEditCounter } from "./index-84heAAm_.mjs";

package/dist/index.mjs

@@ -1,6 +1,7 @@
 import { a as resolveMaxLines, c as storeBudget, i as hookBudget, l as parseEnvInt, n as DEFAULT_STDIN_MAX_BYTES, o as resolveStdinMaxBytes, r as MAX_LINES_ENV_KEY, s as splitTarget, t as DEFAULT_MAX_LINES } from "./limits-DG5pl-5s.mjs";
-import { c as resolveTtlSec, i as parseEnvFile, l as ttlLabel, n as envCandidates, o as DEFAULT_TTL_SEC, r as loadDotenv, s as TTL_ENV_KEY, t as HOME_DIR } from "./dotenv-BLBkBTww.mjs";
+import { i as ttlLabel, n as TTL_ENV_KEY, r as resolveTtlSec, t as DEFAULT_TTL_SEC } from "./ttl-Dgwg_QAv.mjs";
 import { n as STATE_ROOT, r as projectLayout, t as STATE_GITIGNORE } from "./layout-KWoE_Mqn.mjs";
+import { i as parseEnvFile, n as envCandidates, r as loadDotenv, t as HOME_DIR } from "./dotenv-C1LkcfW-.mjs";
 import { t as compactJson } from "./compact-json-DK2nX-MK.mjs";
 import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
 import { n as detectMode, r as modeFor, t as detectHarness } from "./harness-BMuLJ9lm.mjs";
@@ -8,7 +9,7 @@ import { $ as isRalphMode, B as protectedPathGuard, C as isInterfacesPath, D as
 import { d as countFrameworkCodeLines, f as countLines, l as PLUGINS_DIR, p as evaluateFileSize, u as SOLID_REF } from "./home-state-oUGFB4ds.mjs";
 import { i as resolveSessions, n as formatDocSatisfactionStatus, r as isDocConsulted, t as formatDocDeny } from "./doc-helpers-CWZegVdR.mjs";
 import { i as parseFrontmatter, n as scoreReferences, r as globToRe, t as routeReferences } from "./router-PKVNBHge.mjs";
-import { A as importsTanstackQuery, B as APEX_GATES, C as detectRequiredSkills, D as frameworkSolidGate, E as SKILL_TRIGGERS, G as evaluateApex, H as PRE_AUTH_GATES, I as MAX_EXA_RESULTS, K as freshnessGate, L as MAX_TOKENS, M as countStores, N as declaresStore, O as declaresCustomHook, R as capVerbosity, S as parseField, T as usesTailwindUtilities, U as brainstormGate, V as POST_AUTH_GATES, W as docConsultedGate, _ as detectClaudeMdProjectType, a as firstHeading, c as EXCLUDE_DIRS, d as buildApexTaskInjection, f as loadApexTaskState, g as buildClaudeMdContext, h as buildApexInstruction, i as firstComment, j as queryCapActive, k as declaresQueryHook, l as PROJECT_INDICATORS, m as DEV_VERBS, n as missingSeoElements, o as parseEnrichment, q as solidReadGate, r as descFromText, s as parseEntry, t as isHtmlLike, u as buildApexTaskContext, w as skillTriggerGate, x as parseBodyDesc, z as detectCreationIntent } from "./validate-KjZ1X9tH.mjs";
+import { A as countStores, B as PRE_AUTH_GATES, C as usesTailwindUtilities, D as declaresQueryHook, E as declaresCustomHook, F as MAX_TOKENS, G as solidReadGate, H as docConsultedGate, I as capVerbosity, L as detectCreationIntent, O as importsTanstackQuery, P as MAX_EXA_RESULTS, R as APEX_GATES, S as skillTriggerGate, T as frameworkSolidGate, U as evaluateApex, V as brainstormGate, W as freshnessGate, _ as detectClaudeMdProjectType, a as firstHeading, b as parseField, c as EXCLUDE_DIRS, d as buildApexTaskInjection, f as loadApexTaskState, g as buildClaudeMdContext, h as buildApexInstruction, i as firstComment, j as declaresStore, k as queryCapActive, l as PROJECT_INDICATORS, m as DEV_VERBS, n as missingSeoElements, o as parseEnrichment, r as descFromText, s as parseEntry, t as isHtmlLike, u as buildApexTaskContext, w as SKILL_TRIGGERS, x as detectRequiredSkills, y as parseBodyDesc, z as POST_AUTH_GATES } from "./validate-Dcjl0LUS.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { a as nowStamp, c as stateFileFor, i as lessonsFileFor, l as throttleMs, n as readRoots, o as readState, r as registryFile, s as setStateField, t as addRoot, u as ensureMemoryGitignore } from "./registry-IhHk2KlT.mjs";
 import { a as cacheLookupSubstring, c as cacheStore, d as loadIndex, f as summarizeIndex, h as queryHash, i as cacheLookupMeta, l as mcpCacheKey, m as jaccardSimilar, n as webfetchCacheWrite, o as cacheLookupSubstringMeta, p as compactMarkdown, r as cacheLookup, s as cachePath, t as mcpCacheWrite, u as extractText } from "./mcp-store-BkBDmuxN.mjs";

package/dist/{kimi-G2wcSh5-.mjs → kimi-C-Oia9q-.mjs}

@@ -1,7 +1,7 @@
 import { t as evaluate } from "./evaluate-CMiIqHeH.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { t as commandToString } from "./command-string-CALMTnwN.mjs";
-import { c as readClaudeInput } from "./claude-Ckv2_TgP.mjs";
+import { c as readClaudeInput } from "./claude-D62hkUfS.mjs";
 //#region src/adapters/kimi/index.ts
 /**
 * Kimi Code CLI adapter (hook-mode). Moonshot AI's Kimi Code CLI (v0.27.0,

package/dist/{normalize-BjG6unTj.mjs → normalize-Dy8g9Ybl.mjs}

@@ -189,14 +189,32 @@ function contains(root, filePath) {
 	const rel = relative(root, filePath);
 	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
-/** Select Cursor's project scope without replacing a valid payload cwd. */
-function cursorProjectCwd(cwd, workspaceRoots, filePath, fallback) {
+/**
+* Select Cursor's project scope without replacing a valid payload cwd. Order:
+* payload `cwd` -> longest workspace root containing `filePath` ->
+* `workspaceRoots[0]` -> `CURSOR_PROJECT_DIR` env -> `CLAUDE_PROJECT_DIR` env
+* -> `fallback`. Both env vars are validated the same way as any other Cursor
+* path (`cursorAbsolutePath`: absolute, NUL-free, realpath-resolved), so an
+* unset or malformed value is silently skipped rather than trusted.
+* @param cwd - Cursor payload `cwd`, when present.
+* @param workspaceRoots - Validated, deduped Cursor `workspace_roots`.
+* @param filePath - The file the current event targets, when present.
+* @param fallback - Caller-supplied last resort (never `process.cwd()`).
+* @param env - Environment (defaults to `process.env`).
+* @returns The resolved project root.
+*/
+function cursorProjectCwd(cwd, workspaceRoots, filePath, fallback, env = process.env) {
 	if (cwd) return cwd;
 	if (filePath) {
 		const matches = workspaceRoots.filter((root) => contains(root, filePath));
 		if (matches.length > 0) return matches.sort((a, b) => b.length - a.length)[0];
 	}
-	return workspaceRoots[0] ?? fallback;
+	if (workspaceRoots[0]) return workspaceRoots[0];
+	const fromCursorEnv = cursorAbsolutePath(env.CURSOR_PROJECT_DIR);
+	if (fromCursorEnv) return fromCursorEnv;
+	const fromClaudeEnv = cursorAbsolutePath(env.CLAUDE_PROJECT_DIR);
+	if (fromClaudeEnv) return fromClaudeEnv;
+	return fallback;
 }
 //#endregion
 //#region src/adapters/cursor/normalize.ts
@@ -240,10 +258,72 @@ function sanitizedCursorInput(input) {
 	else delete safe.workspace_roots;
 	return safe;
 }
+/**
+* Closed table: Cursor's `MCP:<tool>` tool_name form on preToolUse/
+* postToolUse/postToolUseFailure LOSES the MCP server name (ground truth:
+* Cursor CLI 3.18.25 + official docs — only beforeMCPExecution/
+* afterMCPExecution carry `mcp_server_name`). This reconstructs the real
+* server for the closed set of tool names this repo's gates actually depend
+* on (GATED_TOOLS in doc-cache-gate.ts, CONTEXT7_SOURCE, RESEARCH_TOOLS,
+* SHOT_TOOLS, gemini-mcp-gate, shadcn-skill-gate) — same closed-table
+* philosophy as `mcp-tool-name.ts`'s Codex aliasing, never a blanket
+* reversal. Coordinator decision: a tool name OUTSIDE this table (server
+* genuinely unrecoverable, and no safe placeholder) is left as Cursor's raw
+* `MCP:<tool>` string — `test/cursor-followup-normalize.test.ts` pins this
+* as the committed contract ("commandless MCP tools keep their name"), so a
+* fabricated `mcp__cursor__<tool>` placeholder is never introduced for the
+* unknown case.
+*/
+const CURSOR_MCP_TOOL_SERVERS = Object.assign(Object.create(null), {
+	"query-docs": "context7",
+	"resolve-library-id": "context7",
+	web_search_exa: "exa",
+	get_code_context_exa: "exa",
+	deep_researcher_start: "exa",
+	deep_researcher_check: "exa",
+	create_frontend: "gemini-design",
+	modify_frontend: "gemini-design",
+	snippet_frontend: "gemini-design",
+	search_items_in_registries: "shadcn",
+	view_items_in_registries: "shadcn",
+	get_item_examples_from_registries: "shadcn",
+	get_add_command_for_items: "shadcn",
+	get_audit_checklist: "shadcn"
+});
+/**
+* The real MCP server for a bare Cursor tool name (the part after `MCP:`),
+* or `undefined` when it isn't in the closed table. fuse-browser is inferred
+* from the `browser_*` prefix — every fuse-browser tool is named that way
+* and no other server in this ecosystem uses it — the remaining,
+* non-distinctive tool names go through {@link CURSOR_MCP_TOOL_SERVERS}.
+* NO placeholder fallback (coordinator decision, see {@link CURSOR_MCP_TOOL_SERVERS}):
+* an unknown tool name means the server is genuinely unrecoverable, so the
+* caller leaves the raw `MCP:<tool>` string untouched instead of fabricating one.
+*/
+function cursorMcpServer(bareTool) {
+	if (bareTool.startsWith("browser_")) return "fuse-browser";
+	return CURSOR_MCP_TOOL_SERVERS[bareTool];
+}
+/**
+* Canonicalize Cursor's `MCP:<tool>` tool_name (preToolUse/postToolUse/
+* postToolUseFailure) into the shared `mcp__<server>__<tool>` shape every
+* other harness/gate expects. Returns `undefined` — meaning "leave the raw
+* `MCP:<tool>` string as-is" — both when `tool` isn't the `MCP:` form and
+* when the bare tool name is outside the closed {@link CURSOR_MCP_TOOL_SERVERS}
+* table (server unrecoverable, no placeholder fabricated).
+*/
+function cursorBareMcpToolName(tool) {
+	if (!tool || !tool.startsWith("MCP:")) return void 0;
+	const bare = tool.slice(4);
+	const server = cursorMcpServer(bare);
+	return server ? `mcp__${server}__${bare}` : void 0;
+}
 function cursorToolName(raw, event, tool, hasCommand) {
 	if (hasCommand) return "Bash";
 	const server = str(raw.mcp_server_name)?.trim().replace(/[^A-Za-z0-9_-]+/g, "_");
 	if (/^(before|after)MCPExecution$/i.test(event) && server && tool && !tool.startsWith("mcp__")) return `mcp__${server}__${tool}`;
+	const bareMcp = cursorBareMcpToolName(tool);
+	if (bareMcp) return bareMcp;
 	if (tool === "Write") return "Edit";
 	return tool ?? "";
 }

package/dist/policy/index.mjs

@@ -1,5 +1,5 @@
 import { $ as isRalphMode, B as protectedPathGuard, C as isInterfacesPath, D as isVendorPath, E as isTypesPath, F as FILE_REDIRECT, H as ASK_PATTERNS, I as SAFE_PREFIXES, J as GIT_ASK, L as SESSION_STATE_FRAGMENT, M as ASK_WRITERS, N as CODE_MUTATORS, O as langOfPath, P as CODE_REDIRECT, Q as SYSTEM_INSTALL, R as PROTECTED_FRAGMENTS, S as isHooksPath, T as isStoresPath, U as CRITICAL_PATTERNS, W as securityGuard, X as PROJECT_INSTALL, Y as GIT_BLOCKED, Z as RALPH_SAFE, a as registerGuard, at as maskCommentsOnly, b as interfaceDeclLevel, c as GO_DECL_RE, ct as detectProjectType, d as PY_MODEL_RE, et as matchPatterns, f as RUST_DECL_RE, h as interfaceSeparationGuard, i as clearUserGuards, it as maskCommentsAndStrings, j as bashWriteGuard, k as lexProfileOf, l as JAVA_DECL_RE, lt as isApexCommand, m as TS_DECL_RE, n as FAIL_CLOSED, o as runGuards, ot as DEV_KEYWORDS, p as SWIFT_PROTO_RE, r as GUARDS, s as installGuard, st as detectModularArchitecture, t as evaluate, tt as detectFramework, u as PHP_DECL_RE, ut as requiredArchSkill, v as declaresExportedTypeAlias, w as isQueryPath, x as isComponentsPath, y as declaresInterface, z as PROTECTED_GIT_RE } from "../evaluate-CMiIqHeH.mjs";
 import { d as countFrameworkCodeLines, f as countLines, l as PLUGINS_DIR, p as evaluateFileSize, u as SOLID_REF } from "../home-state-oUGFB4ds.mjs";
-import { A as importsTanstackQuery, B as APEX_GATES, C as detectRequiredSkills, D as frameworkSolidGate, E as SKILL_TRIGGERS, G as evaluateApex, H as PRE_AUTH_GATES, I as MAX_EXA_RESULTS, K as freshnessGate, L as MAX_TOKENS, M as countStores, N as declaresStore, O as declaresCustomHook, R as capVerbosity, S as parseField, T as usesTailwindUtilities, U as brainstormGate, V as POST_AUTH_GATES, W as docConsultedGate, _ as detectClaudeMdProjectType, a as firstHeading, c as EXCLUDE_DIRS, d as buildApexTaskInjection, f as loadApexTaskState, g as buildClaudeMdContext, h as buildApexInstruction, i as firstComment, j as queryCapActive, k as declaresQueryHook, l as PROJECT_INDICATORS, m as DEV_VERBS, n as missingSeoElements, o as parseEnrichment, q as solidReadGate, r as descFromText, s as parseEntry, t as isHtmlLike, u as buildApexTaskContext, w as skillTriggerGate, x as parseBodyDesc, z as detectCreationIntent } from "../validate-KjZ1X9tH.mjs";
+import { A as countStores, B as PRE_AUTH_GATES, C as usesTailwindUtilities, D as declaresQueryHook, E as declaresCustomHook, F as MAX_TOKENS, G as solidReadGate, H as docConsultedGate, I as capVerbosity, L as detectCreationIntent, O as importsTanstackQuery, P as MAX_EXA_RESULTS, R as APEX_GATES, S as skillTriggerGate, T as frameworkSolidGate, U as evaluateApex, V as brainstormGate, W as freshnessGate, _ as detectClaudeMdProjectType, a as firstHeading, b as parseField, c as EXCLUDE_DIRS, d as buildApexTaskInjection, f as loadApexTaskState, g as buildClaudeMdContext, h as buildApexInstruction, i as firstComment, j as declaresStore, k as queryCapActive, l as PROJECT_INDICATORS, m as DEV_VERBS, n as missingSeoElements, o as parseEnrichment, r as descFromText, s as parseEntry, t as isHtmlLike, u as buildApexTaskContext, w as SKILL_TRIGGERS, x as detectRequiredSkills, y as parseBodyDesc, z as POST_AUTH_GATES } from "../validate-Dcjl0LUS.mjs";
 import "../policy-la_KkjCS.mjs";
 export { APEX_GATES, ASK_PATTERNS, ASK_WRITERS, CODE_MUTATORS, CODE_REDIRECT, CRITICAL_PATTERNS, DEV_KEYWORDS, DEV_VERBS, EXCLUDE_DIRS, FAIL_CLOSED, FILE_REDIRECT, GIT_ASK, GIT_BLOCKED, GO_DECL_RE, GUARDS, JAVA_DECL_RE, MAX_EXA_RESULTS, MAX_TOKENS, PHP_DECL_RE, PLUGINS_DIR, POST_AUTH_GATES, PRE_AUTH_GATES, PROJECT_INDICATORS, PROJECT_INSTALL, PROTECTED_FRAGMENTS, PROTECTED_GIT_RE, PY_MODEL_RE, RALPH_SAFE, RUST_DECL_RE, SAFE_PREFIXES, SESSION_STATE_FRAGMENT, SKILL_TRIGGERS, SOLID_REF, SWIFT_PROTO_RE, SYSTEM_INSTALL, TS_DECL_RE, bashWriteGuard, brainstormGate, buildApexInstruction, buildApexTaskContext, buildApexTaskInjection, buildClaudeMdContext, capVerbosity, clearUserGuards, countFrameworkCodeLines, countLines, countStores, declaresCustomHook, declaresExportedTypeAlias, declaresInterface, declaresQueryHook, declaresStore, descFromText, detectClaudeMdProjectType, detectCreationIntent, detectFramework, detectModularArchitecture, detectProjectType, detectRequiredSkills, docConsultedGate, evaluate, evaluateApex, evaluateFileSize, firstComment, firstHeading, frameworkSolidGate, freshnessGate, importsTanstackQuery, installGuard, interfaceDeclLevel, interfaceSeparationGuard, isApexCommand, isComponentsPath, isHooksPath, isHtmlLike, isInterfacesPath, isQueryPath, isRalphMode, isStoresPath, isTypesPath, isVendorPath, langOfPath, lexProfileOf, loadApexTaskState, maskCommentsAndStrings, maskCommentsOnly, matchPatterns, missingSeoElements, parseBodyDesc, parseEnrichment, parseEntry, parseField, protectedPathGuard, queryCapActive, registerGuard, requiredArchSkill, runGuards, securityGuard, skillTriggerGate, solidReadGate, usesTailwindUtilities };

package/dist/prd-PvK7PKWS.mjs

@@ -0,0 +1,494 @@
+import { r as loadDotenv, t as HOME_DIR } from "./dotenv-C1LkcfW-.mjs";
+import { t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
+import { t as evaluate } from "./evaluate-CMiIqHeH.mjs";
+import { r as harnessHomeSegment } from "./apex-target-Xc2M32Pl.mjs";
+import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
+import { C as withRouterStatus, D as prdDir, O as prdRouterPath, S as subTasksOf, c as crossCheckTask, d as readAgentReport, g as readTaskFile, m as readRouter, o as isPrdFlagSet, p as readAllTaskFiles, t as acquireLock, u as incompleteSubTasks, v as writeRouter, w as withSubTaskValidated, x as isCompacted, y as writeTaskFile } from "./apex-task-store-Cb65rE5i.mjs";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { execFileSync } from "node:child_process";
+//#region src/cli/run.ts
+/** Staged files (Added/Copied/Modified/Renamed). Uses `node:child_process` (Bun shell can hang on `git show`). */
+function stagedFiles() {
+	return execFileSync("git", [
+		"diff",
+		"--cached",
+		"--name-only",
+		"--diff-filter=ACMR"
+	], { encoding: "utf8" }).trim().split("\n").filter(Boolean);
+}
+/**
+* Read a file's staged (index) content — not the working-tree version.
+* Uses `execFileSync` with an argv array (never a shell), so a staged
+* filename containing shell metacharacters (backticks, `$(...)`, quotes)
+* reaches `git show` as a single literal argument — see issue #87.
+*/
+function stagedContent(path) {
+	return execFileSync("git", ["show", `:${path}`], { encoding: "utf8" });
+}
+/**
+* Evaluate staged code files against the policy core; return violation blocks.
+* `read` is injected (the real impl is {@link stagedContent}) so this is pure + testable.
+*/
+function checkStaged(files, read) {
+	const violations = [];
+	for (const file of files) {
+		if (!isCodeFile(file)) continue;
+		const r = evaluate({
+			tool: "Write",
+			filePath: file,
+			content: read(file)
+		});
+		if (r.decision === "deny" && r.prompt) violations.push(`${file}\n${formatPrompt(r.prompt)}`);
+	}
+	return violations;
+}
+//#endregion
+//#region src/cli/prd/resolve.ts
+/**
+* Argument parsing + harness resolution for `harness prd <cmd>`. Resolves
+* `--root` (default `cwd`) and `--id`/`homeSeg` (default: the sole
+* `HOME_DIR` (`config/dotenv.ts`) segment under which
+* `<root>/<seg>/apex/prd.json` exists — ambiguous or absent is a caller
+* error, never guessed).
+*/
+const VALUE_FLAGS = /* @__PURE__ */ new Set(["--id", "--root"]);
+const BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["--json"]);
+/** Read `--<name> <value>` from argv, or `undefined` when absent. */
+function readFlag(argv, name) {
+	const idx = argv.indexOf(name);
+	return idx !== -1 ? argv[idx + 1] : void 0;
+}
+/** True when `--json` is present in argv. */
+function hasJsonFlag(argv) {
+	return argv.includes("--json");
+}
+/** Non-flag tokens in argv, skipping known flags and their values. */
+function positionalArgs(argv) {
+	const out = [];
+	for (let i = 0; i < argv.length; i++) {
+		const tok = argv[i];
+		if (tok === void 0) continue;
+		if (VALUE_FLAGS.has(tok)) {
+			i++;
+			continue;
+		}
+		if (BOOLEAN_FLAGS.has(tok)) continue;
+		out.push(tok);
+	}
+	return out;
+}
+/**
+* Resolve `{root, homeSeg, id}` for a `prd` sub-command. `--id` wins
+* outright; otherwise auto-detects the sole `HOME_DIR` segment under which
+* `<root>/<seg>/apex/prd.json` exists.
+*/
+function resolvePrdArgs(argv, cwd) {
+	const root = readFlag(argv, "--root") ?? cwd;
+	const idFlag = readFlag(argv, "--id");
+	if (idFlag) return {
+		ok: true,
+		value: {
+			root,
+			homeSeg: harnessHomeSegment(idFlag),
+			id: idFlag
+		}
+	};
+	const matches = [];
+	for (const [id, seg] of Object.entries(HOME_DIR)) if (existsSync(join(root, seg, "apex", "prd.json"))) matches.push({
+		id,
+		seg
+	});
+	if (matches.length === 0) return {
+		ok: false,
+		message: `no PRD router found under ${root}/<home>/apex/prd.json — pass --id <harness>`
+	};
+	if (matches.length > 1) return {
+		ok: false,
+		message: `ambiguous harness: PRD routers found for ${matches.map((m) => m.id).join(", ")} — pass --id`
+	};
+	const only = matches[0];
+	return {
+		ok: true,
+		value: {
+			root,
+			homeSeg: only.seg,
+			id: only.id
+		}
+	};
+}
+/**
+* Shared first step of every `prd` sub-command: {@link resolvePrdArgs}, then
+* (on success) `loadDotenv` the resolved harness's home `.env` + `<root>/.env`
+* as a side effect on `env` — same env-loading contract as the `hook` branch
+* (`bin.ts`'s `loadDotenv(id)` call).
+*/
+function resolveAndLoadEnv(argv, cwd, env = process.env) {
+	const resolved = resolvePrdArgs(argv, cwd);
+	if (resolved.ok) loadDotenv(resolved.value.id, env, homedir(), resolved.value.root);
+	return resolved;
+}
+//#endregion
+//#region src/cli/prd/format.ts
+/**
+* Rendering helpers for `harness prd` output: an aligned ASCII table for the
+* human-readable path, and pretty JSON for `--json`.
+*/
+/** Pad `s` with trailing spaces to `width`. */
+function pad(s, width) {
+	return s.length >= width ? s : s + " ".repeat(width - s.length);
+}
+/** Render an aligned ASCII table from a header row + data rows. */
+function renderTable(header, rows) {
+	const all = [header, ...rows];
+	const widths = header.map((_, col) => Math.max(...all.map((r) => (r[col] ?? "").length)));
+	return all.map((r) => r.map((cell, col) => pad(cell ?? "", widths[col] ?? 0)).join("  ").trimEnd()).join("\n");
+}
+/** Render `data` as pretty-printed JSON with a trailing newline. */
+function renderJson(data) {
+	return JSON.stringify(data, null, 2) + "\n";
+}
+//#endregion
+//#region src/cli/prd/shared.ts
+/**
+* Shared plumbing for `status`/`validate`/`compact`: root+env resolution,
+* the `FUSE_PRD` write gate, task-PRD lookup, and the `.lock`-guarded write.
+* All return a result instead of calling `process.exit` themselves —
+* callers own the exit code (extracted to kill a jscpd-measured clone
+* across the three `run*` functions).
+*/
+/** {@link resolveAndLoadEnv}, narrowed to `{root, homeSeg}` — the common first step of every sub-command. */
+function resolveRoot(argv, cwd, env) {
+	const resolved = resolveAndLoadEnv(argv, cwd, env);
+	if (!resolved.ok) return {
+		ok: false,
+		code: 2,
+		message: resolved.message
+	};
+	return {
+		ok: true,
+		root: resolved.value.root,
+		homeSeg: resolved.value.homeSeg
+	};
+}
+/** {@link resolveRoot} + the `FUSE_PRD=1` write gate shared by `validate`/`compact`. */
+function requireFusePrd(argv, cwd, env, sub) {
+	const resolved = resolveRoot(argv, cwd, env);
+	if (!resolved.ok) return resolved;
+	if (!isPrdFlagSet(env)) return {
+		ok: false,
+		code: 1,
+		message: `prd ${sub} requires FUSE_PRD=1 in ${resolved.homeSeg}/.env or the project .env`
+	};
+	return resolved;
+}
+/** Reads the router + the named task's task-PRD file. Never calls `process.exit`. */
+async function loadTaskFileFor(root, homeSeg, task) {
+	const router = await readRouter(root, homeSeg);
+	const routerEntry = router?.[task];
+	if (!router || !routerEntry) return {
+		ok: false,
+		code: 2,
+		message: `no such task "${task}" in PRD router`
+	};
+	const taskFile = await readTaskFile(root, homeSeg, routerEntry.prd);
+	if (!taskFile) return {
+		ok: false,
+		code: 2,
+		message: `task PRD not found or malformed: ${routerEntry.prd}`
+	};
+	return {
+		ok: true,
+		router,
+		routerEntry,
+		taskFile
+	};
+}
+/** Extracts `<task> [agent]` from argv, then {@link loadTaskFileFor} — the shared `validate`/`compact` entry lookup. */
+async function resolveTaskFile(argv, root, homeSeg, usage) {
+	const [task, agentArg] = positionalArgs(argv);
+	if (!task) return {
+		ok: false,
+		code: 2,
+		message: usage
+	};
+	const lookup = await loadTaskFileFor(root, homeSeg, task);
+	if (!lookup.ok) return lookup;
+	return {
+		task,
+		agentArg,
+		...lookup
+	};
+}
+/** Runs `fn` under the PRD `.lock` directory-lock. Never calls `process.exit`. */
+async function withPrdLock(root, homeSeg, fn) {
+	const lockDir = join(prdDir(root, homeSeg), ".lock");
+	const release = await acquireLock(lockDir);
+	if (!release) return {
+		ok: false,
+		message: `lock held at ${lockDir}`
+	};
+	try {
+		return {
+			ok: true,
+			value: await fn()
+		};
+	} finally {
+		await release();
+	}
+}
+//#endregion
+//#region src/cli/prd/status.ts
+/**
+* `harness prd status [--json] [--id <harness>] [--root <dir>]` — read-only
+* PRD snapshot. Never requires `FUSE_PRD`. Exit 0 on success, exit 1 when no
+* router is found, exit 2 on an unresolved/ambiguous `--id`.
+*/
+const HEADER = [
+	"Task",
+	"Router status",
+	"Agents",
+	"Sub-tasks done/total",
+	"Violations"
+];
+/**
+* Sub-task readiness counts for the "done/total" column: a sub-task counts as
+* done once it is `validated` OR its owning agent's own report already shows
+* `"done"` for it (readiness view — a report can land well before the
+* coordinator runs `prd validate`). A compacted (fully-validated) entry
+* counts as one done/one total unit — its per-sub-task detail is gone.
+*/
+function subTaskCounts(taskFile, reports, task) {
+	let done = 0;
+	let total = 0;
+	for (const [agent, entry] of Object.entries(taskFile)) {
+		if (isCompacted(entry)) {
+			done++;
+			total++;
+			continue;
+		}
+		const report = reports[agent];
+		for (const [sub, subTask] of Object.entries(subTasksOf(entry))) {
+			total++;
+			if (subTask.status === "validated" || report?.[task]?.[sub]?.status === "done") done++;
+		}
+	}
+	return {
+		done,
+		total
+	};
+}
+/**
+* Run `harness prd status`. Prints an aligned table (or `--json` dump of
+* `{router, taskFiles, reports}`) and returns the process exit code.
+*/
+async function runPrdStatus(argv, cwd, env = process.env) {
+	const resolved = resolveRoot(argv, cwd, env);
+	if (!resolved.ok) {
+		process.stderr.write(resolved.message + "\n");
+		return resolved.code;
+	}
+	const { root, homeSeg } = resolved;
+	const router = await readRouter(root, homeSeg);
+	if (!router) {
+		process.stderr.write(`no PRD router at ${prdRouterPath(root, homeSeg)}\n`);
+		return 1;
+	}
+	const taskFiles = await readAllTaskFiles(root, homeSeg, router);
+	const agentNames = /* @__PURE__ */ new Set();
+	for (const tf of Object.values(taskFiles)) if (tf) for (const agent of Object.keys(tf)) agentNames.add(agent);
+	const reports = {};
+	for (const agent of agentNames) reports[agent] = await readAgentReport(root, homeSeg, agent);
+	if (hasJsonFlag(argv)) {
+		process.stdout.write(renderJson({
+			router,
+			taskFiles,
+			reports
+		}));
+		return 0;
+	}
+	const rows = [];
+	for (const [task, entry] of Object.entries(router)) {
+		const tf = taskFiles[task];
+		const agentCount = tf ? Object.keys(tf).length : 0;
+		const { done, total } = tf ? subTaskCounts(tf, reports, task) : {
+			done: 0,
+			total: 0
+		};
+		const violations = tf ? crossCheckTask(tf, reports, task) : [];
+		rows.push([
+			task,
+			entry.status,
+			String(agentCount),
+			`${done}/${total}`,
+			String(violations.length)
+		]);
+	}
+	process.stdout.write(renderTable(HEADER, rows) + "\n");
+	return 0;
+}
+//#endregion
+//#region src/cli/prd/validate.ts
+/**
+* `harness prd validate <task> [agent] [--id] [--root]` — cross-checks a
+* task-PRD against the named agent(s)' own report(s); on success flips the
+* matching sub-tasks to `validated` and promotes the router entry when every
+* agent is fully validated. Requires `FUSE_PRD=1`.
+*/
+function allValidated(taskFile) {
+	return Object.values(taskFile).every((entry) => isCompacted(entry) || Object.values(subTasksOf(entry)).every((s) => s.status === "validated"));
+}
+/**
+* Sub-tasks of `agents` with no matching `done` entry in their owning
+* agent's own report — the readiness gate `validate` enforces before
+* flipping anything. Reuses `incompleteSubTasks` (distinct from
+* `crossCheckTask`, which only flags an ALREADY-`validated` sub-task lacking
+* a report; here nothing has been validated yet).
+*/
+function findUnreadySubTasks(taskFile, reports, task, agents) {
+	const out = [];
+	for (const agent of agents) {
+		const missing = incompleteSubTasks(taskFile, agent, task, reports[agent] ?? null);
+		for (const sub of missing) out.push({
+			task,
+			agent,
+			sub,
+			reason: `no "done" report from "${agent}" for sub-task "${sub}"`
+		});
+	}
+	return out;
+}
+/**
+* Run `harness prd validate`. Exit 0 on success, exit 1 on cross-check
+* violations or a missing `FUSE_PRD=1`/held lock, exit 2 on usage/lookup errors.
+*/
+async function runPrdValidate(argv, cwd, env = process.env) {
+	const resolved = requireFusePrd(argv, cwd, env, "validate");
+	if (!resolved.ok) {
+		process.stderr.write(resolved.message + "\n");
+		return resolved.code;
+	}
+	const { root, homeSeg } = resolved;
+	const tf = await resolveTaskFile(argv, root, homeSeg, "usage: harness prd validate <task> [agent]");
+	if (!tf.ok) {
+		process.stderr.write(tf.message + "\n");
+		return tf.code;
+	}
+	const { task, agentArg, router, routerEntry, taskFile } = tf;
+	if (agentArg && !(agentArg in taskFile)) {
+		process.stderr.write(`no such agent "${agentArg}" in task PRD for "${task}"\n`);
+		return 2;
+	}
+	const agents = agentArg ? [agentArg] : Object.keys(taskFile);
+	const reports = {};
+	for (const agent of Object.keys(taskFile)) reports[agent] = await readAgentReport(root, homeSeg, agent);
+	const violations = findUnreadySubTasks(taskFile, reports, task, agents);
+	if (violations.length > 0) {
+		process.stderr.write(`prd validate: ${violations.length} violation(s)\n`);
+		for (const v of violations) process.stderr.write(`  - ${v.task}/${v.agent}/${v.sub}: ${v.reason}\n`);
+		return 1;
+	}
+	const result = await withPrdLock(root, homeSeg, async () => {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		let updated = taskFile;
+		for (const agent of agents) {
+			const entry = updated[agent];
+			if (!entry || isCompacted(entry)) continue;
+			for (const sub of Object.keys(subTasksOf(entry))) updated = withSubTaskValidated(updated, agent, sub, now);
+		}
+		await writeTaskFile(root, homeSeg, routerEntry.prd, updated);
+		if (allValidated(updated)) await writeRouter(root, homeSeg, withRouterStatus(router, task, "validated", now));
+	});
+	if (!result.ok) {
+		process.stderr.write(`prd validate: ${result.message}\n`);
+		return 1;
+	}
+	return 0;
+}
+//#endregion
+//#region src/policy/prd/prd-compact.ts
+/** Collapses fully-validated task-PRD agent entries to their compact shape. Pure — no fs. */
+/** Collapses one agent entry to the compacted shape ONLY when every sub-task is `validated`; else returns it unchanged. */
+function compactAgentEntry(e, at) {
+	if (isCompacted(e)) return e;
+	const subTasks = Object.values(subTasksOf(e));
+	if (subTasks.length === 0 || !subTasks.every((s) => s.status === "validated")) return e;
+	return {
+		status: "validated",
+		files: e.files,
+		"validated-at": at
+	};
+}
+/** Compacts every eligible agent entry in a task-PRD; reports which agent names got collapsed. */
+function compactTaskFile(taskFile, at) {
+	const compacted = [];
+	const file = {};
+	for (const [agent, entry] of Object.entries(taskFile)) {
+		const next = compactAgentEntry(entry, at);
+		if (next !== entry) compacted.push(agent);
+		file[agent] = next;
+	}
+	return {
+		file,
+		compacted
+	};
+}
+//#endregion
+//#region src/cli/prd/compact.ts
+/**
+* `harness prd compact <task> [--id] [--root]` — collapses every fully
+* validated agent entry of a task-PRD to its compacted shape. Requires
+* `FUSE_PRD=1`; refuses (exit 1) when any sub-task is not yet `validated`.
+*/
+/**
+* Run `harness prd compact`. Exit 0 on success (including a no-op compact),
+* exit 1 when `FUSE_PRD` is unset, a sub-task is unvalidated, or the lock is
+* held, exit 2 on usage/lookup errors.
+*/
+async function runPrdCompact(argv, cwd, env = process.env) {
+	const resolved = requireFusePrd(argv, cwd, env, "compact");
+	if (!resolved.ok) {
+		process.stderr.write(resolved.message + "\n");
+		return resolved.code;
+	}
+	const { root, homeSeg } = resolved;
+	const tf = await resolveTaskFile(argv, root, homeSeg, "usage: harness prd compact <task>");
+	if (!tf.ok) {
+		process.stderr.write(tf.message + "\n");
+		return tf.code;
+	}
+	const { routerEntry, taskFile } = tf;
+	for (const [agent, entry] of Object.entries(taskFile)) {
+		if (isCompacted(entry)) continue;
+		for (const [sub, status] of Object.entries(subTasksOf(entry))) if (status.status !== "validated") {
+			process.stderr.write(`prd compact: sub-task "${sub}" of agent "${agent}" is not validated\n`);
+			return 1;
+		}
+	}
+	const result = await withPrdLock(root, homeSeg, async () => {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const { file, compacted } = compactTaskFile(taskFile, now);
+		await writeTaskFile(root, homeSeg, routerEntry.prd, file);
+		return compacted;
+	});
+	if (!result.ok) {
+		process.stderr.write(`prd compact: ${result.message}\n`);
+		return 1;
+	}
+	process.stdout.write(result.value.length > 0 ? `compacted: ${result.value.join(", ")}\n` : "nothing to compact\n");
+	return 0;
+}
+//#endregion
+//#region src/cli/prd/index.ts
+/** Dispatch `harness prd <sub> ...rest` to the matching `run*` function. */
+async function runPrd(argv, cwd, env = process.env) {
+	const [sub, ...rest] = argv;
+	if (sub === "status") return runPrdStatus(rest, cwd, env);
+	if (sub === "validate") return runPrdValidate(rest, cwd, env);
+	if (sub === "compact") return runPrdCompact(rest, cwd, env);
+	process.stderr.write(`harness prd: unknown sub-command "${sub ?? ""}" (expected status|validate|compact)\n`);
+	return 2;
+}
+//#endregion
+export { renderJson as a, positionalArgs as c, resolvePrdArgs as d, checkStaged as f, runPrdStatus as i, readFlag as l, stagedFiles as m, runPrdCompact as n, renderTable as o, stagedContent as p, runPrdValidate as r, hasJsonFlag as s, runPrd as t, resolveAndLoadEnv as u };