@harness-engineering/cli 1.14.0 → 1.16.0

package/dist/agents/skills/gemini-cli/harness-security-scan/SKILL.md

@@ -58,6 +58,58 @@
 - **`harness.config.json`** — Security section configures severity threshold and file exclusions.
 - **codebase-health-analyst persona** — Invokes this skill as part of its sweep.
 
+## Evidence Requirements
+
+When this skill makes claims about existing code, architecture, or behavior,
+it MUST cite evidence using one of:
+
+1. **File reference:** `file:line` format (e.g., `src/auth.ts:42`)
+2. **Code pattern reference:** `file` with description (e.g., `src/utils/hash.ts` —
+   "existing bcrypt wrapper")
+3. **Test/command output:** Inline or referenced output from a test run or CLI command
+4. **Session evidence:** Write to the `evidence` session section via `manage_state`
+
+**Uncited claims:** Technical assertions without citations MUST be prefixed with
+`[UNVERIFIED]`. Example: `[UNVERIFIED] The auth middleware supports refresh tokens`.
+
+## Red Flags
+
+### Universal
+
+These apply to ALL skills. If you catch yourself doing any of these, STOP.
+
+- **"I believe the codebase does X"** — Stop. Read the code and cite a file:line
+  reference. Belief is not evidence.
+- **"Let me recommend [pattern] for this"** without checking existing patterns — Stop.
+  Search the codebase first. The project may already have a convention.
+- **"While we're here, we should also [unrelated improvement]"** — Stop. Flag the idea
+  but do not expand scope beyond the stated task.
+
+### Domain-Specific
+
+- **"This finding is in test code, so it's not a real issue"** — Stop. Test code can leak secrets, establish bad patterns, and be copy-pasted to production.
+- **"This dependency is widely used, so it's safe"** — Stop. Popularity is not a security guarantee. Check CVE databases and advisory feeds.
+- **"This is a low-severity finding, skipping"** — Stop. Low-severity findings compound. Document why you are deprioritizing, do not silently skip.
+- **"The scanner didn't flag it, so it's clean"** — Stop. Scanners have false negatives. A clean scan is not proof of security — it is absence of evidence.
+
+## Rationalizations to Reject
+
+### Universal
+
+These reasoning patterns sound plausible but lead to bad outcomes. Reject them.
+
+- **"It's probably fine"** — "Probably" is not evidence. Verify before asserting.
+- **"This is best practice"** — Best practice in what context? Cite the source and
+  confirm it applies to this codebase.
+- **"We can fix it later"** — If it is worth flagging, it is worth documenting now
+  with a concrete follow-up plan.
+
+### Domain-Specific
+
+- **"No attacker would find this"** — Security by obscurity. If the code is wrong, flag it regardless of discoverability.
+- **"We're behind a firewall"** — Network boundaries change. Code should be secure at every layer regardless of deployment topology.
+- **"The framework handles this for us"** — Verify the framework's actual behavior. Misuse of a secure framework is still insecure.
+
 ## Escalation
 
 - **When error-severity findings are disputed:** The scanner is mechanical — it may flag false positives. If a finding is a false positive, add a `// harness-ignore SEC-XXX` comment on the line and document the rationale. Do not suppress without explanation.

package/dist/agents/skills/gemini-cli/harness-supply-chain-audit/SKILL.md

@@ -0,0 +1,281 @@
+# Harness Supply Chain Audit
+
+> 6-factor dependency risk evaluation adapted from Trail of Bits security skill patterns. Surfaces dependency risk flags for human review — not automated verdicts.
+
+## When to Use
+
+- Before a major release to assess dependency risk
+- After adding new dependencies
+- During security audits or compliance reviews
+- When `on_milestone` trigger fires (part of release gate)
+- NOT as a replacement for `npm audit` — this complements it with risk signals beyond CVEs
+- NOT for license compliance (separate concern)
+
+## Iron Law
+
+**Present findings as flags for human review, never as verdicts.** A dependency flagged as "high risk" may be entirely appropriate for a project. The skill surfaces signals; humans decide whether to act.
+
+---
+
+## Process
+
+### Phase 1: INVENTORY — Build Dependency List
+
+1. **Resolve project root.** Use the path argument or default to the current directory.
+
+2. **Detect lockfile.** Check for the following in order:
+   - `package-lock.json` (npm)
+   - `pnpm-lock.yaml` (pnpm)
+   - `yarn.lock` (yarn)
+   - If none found: report "No lockfile detected. Run `npm install` first." and stop.
+
+3. **Parse direct dependencies** from `package.json`:
+   - Read `dependencies` and `devDependencies`
+   - Build a list: `{ name, version, isDev }`
+
+4. **Parse transitive depth** from lockfile:
+   - For `package-lock.json`: read `packages` keys to extract the dependency tree. Nesting depth of `node_modules/` segments in keys indicates transitive depth.
+   - For `pnpm-lock.yaml`: read `importers` section for direct dependencies (keyed by workspace path, e.g., `.` for root). Each importer lists `dependencies` and `devDependencies` with version specifiers. Read `packages` section for resolved versions — keys are package identifiers (e.g., `/@scope/pkg@1.2.3`) with `resolution` (tarball URL + integrity hash) and `dependencies` sub-map for transitives.
+   - For `yarn.lock`: parse block-format entries. Each block header is `"pkg@version-range":` followed by indented fields: `version` (resolved), `resolved` (tarball URL), `integrity` (hash), and `dependencies` sub-block listing transitive deps as `"name" "version-range"` pairs.
+   - Assign each package a depth (0 = direct, 1 = first-level transitive, etc.)
+   - Flag packages with depth > 5 for transitive risk evaluation
+
+5. **Build inventory table:**
+
+   ```
+   INVENTORY: <project-name>
+   Direct dependencies: N
+   Dev dependencies: N
+   Total packages (including transitives): N
+   Deep transitive packages (depth > 5): N
+   ```
+
+6. Proceed to EVALUATE.
+
+---
+
+### Phase 2: EVALUATE — Score Dependencies on 6 Factors
+
+For each **direct dependency** (and any transitive with depth > 5), score on 6 factors:
+
+> Network access required: npm registry (`https://registry.npmjs.org/<pkg>`) and GitHub API (`https://api.github.com/repos/<owner>/<repo>`).
+>
+> - If npm registry returns 404: mark as "unresolvable", flag for manual review, skip remaining factors
+> - If GitHub API rate limits hit: score `maintenance-status` as "unknown", continue with other factors
+> - If no GitHub repo link in package metadata: skip `maintenance-status` factor, note in report
+
+#### Factor 1: Maintainer Concentration
+
+- Fetch: `GET https://registry.npmjs.org/<pkg>`
+- Check: `maintainers` array length
+- Score:
+  - **High risk:** 1 maintainer (bus factor = 1)
+  - **Medium risk:** 2-3 maintainers
+  - **Low risk:** 4+ maintainers
+
+#### Factor 2: Maintenance Status
+
+- Source: npm `time` field (last publish date) + GitHub API commit activity
+- npm: `GET https://registry.npmjs.org/<pkg>` → `time.modified`
+- GitHub: `GET https://api.github.com/repos/<owner>/<repo>/commits?per_page=1` → latest commit date
+- Score:
+  - **High risk:** Last publish > 12 months ago AND no GitHub commits in 6 months
+  - **Medium risk:** Last publish > 12 months ago OR no commits in 6 months (not both)
+  - **Low risk:** Active in both dimensions
+
+#### Factor 3: Popularity Signal
+
+- Fetch: `GET https://api.npmjs.org/downloads/point/last-week/<pkg>`
+- Score:
+  - **High risk:** < 1,000 weekly downloads
+  - **Medium risk:** 1,000–10,000 weekly downloads
+  - **Low risk:** > 10,000 weekly downloads
+  - **Note:** Low popularity is a signal, not a verdict — internal/niche packages are expected to be low
+
+#### Factor 4: Install Scripts
+
+- Read: `node_modules/<pkg>/package.json` (or lockfile-resolved path) → `scripts` field
+- Check for: `preinstall`, `postinstall`, `install`, `preuninstall`, `postuninstall`
+- Score:
+  - **High risk:** Any install script present
+  - **Low risk:** No install scripts
+  - **Note:** Some install scripts are legitimate (native addon compilation). Flag for review.
+
+#### Factor 5: Known CVEs
+
+- Run: `npm audit --json` or `pnpm audit --json`
+- Parse: map findings to their package name
+- Score:
+  - **Critical:** Any high/critical severity CVE
+  - **Medium risk:** Moderate severity CVE
+  - **Low risk:** No CVEs or low severity only
+
+#### Factor 6: Transitive Risk
+
+- Source: Lockfile depth analysis from INVENTORY phase
+- Score:
+  - **High risk:** Depth > 5 AND subtree size > 20 transitive packages
+  - **Medium risk:** Depth > 5 OR subtree size > 20
+  - **Low risk:** Depth ≤ 5 and subtree size ≤ 20
+
+#### Risk Scoring
+
+Combine factor scores into an overall risk level:
+
+| Overall Risk | Condition                                                      |
+| ------------ | -------------------------------------------------------------- |
+| **Critical** | Factor 5 is Critical (any high/critical CVE)                   |
+| **High**     | 2+ factors scored High, OR Factor 1 is High + Factor 2 is High |
+| **Medium**   | 1 factor scored High, OR 3+ factors scored Medium              |
+| **Low**      | All factors Low or at most 1 Medium                            |
+
+---
+
+### Phase 3: REPORT — Generate Risk Summary
+
+1. **Produce risk summary table** sorted by overall risk (Critical first):
+
+   ```
+   Supply Chain Audit: <project-name>
+   Date: <ISO date>
+   Packages evaluated: N direct + M deep transitives
+
+   ┌─────────────────────┬──────────┬────────────┬─────────────┬────────────┬──────┬─────────────┐
+   │ Package             │ Version  │ Maintainers│ Last Publish│ Downloads  │ CVEs │ Overall Risk│
+   ├─────────────────────┼──────────┼────────────┼─────────────┼────────────┼──────┼─────────────┤
+   │ example-pkg         │ 1.2.3    │ 1 (HIGH)   │ 18mo (HIGH) │ 500 (MED)  │ none │ HIGH        │
+   │ another-pkg         │ 2.0.0    │ 12         │ 2mo         │ 50k        │ 1 mod│ MEDIUM      │
+   └─────────────────────┴──────────┴────────────┴─────────────┴────────────┴──────┴─────────────┘
+   ```
+
+2. **Detail section for Critical and High risk packages:**
+
+   ```
+   HIGH RISK: example-pkg@1.2.3
+   ├── Maintainer concentration: 1 maintainer (bus factor = 1)
+   ├── Maintenance status: Last publish 18 months ago, no commits in 12 months
+   ├── Popularity: 500 weekly downloads
+   ├── Install scripts: none
+   ├── Known CVEs: none
+   └── Transitive risk: depth 2, subtree 4 packages
+   Recommendation: Consider replacing with a well-maintained alternative,
+   or pin the version and monitor for abandonment.
+   ```
+
+3. **Install script warnings** (any package with install scripts):
+
+   ```
+   INSTALL SCRIPTS DETECTED:
+   - node-gyp@9.4.0: postinstall — native addon compilation (likely legitimate)
+   - suspicious-pkg@1.0.0: postinstall — review script contents before trusting
+   ```
+
+4. **Summary line:**
+
+   ```
+   RESULT: 1 Critical, 2 High, 3 Medium, N Low — Review flagged items before release
+   ```
+
+5. **Output:** Print report to stdout. If `--output <file>` was passed, also write to that file.
+
+---
+
+## Gates
+
+- **Stop if no lockfile.** Do not evaluate without a lockfile — results will be unreliable.
+- **Present as flags, not verdicts.** Never state "this package is unsafe." State "this package has signals that warrant review."
+- **Do not block on API failures.** If npm registry or GitHub API is unavailable, note which factors were skipped and continue with available data.
+
+## Harness Integration
+
+- **`harness validate`** — Run after creating the skill files to verify they are properly placed.
+- **Triggers:** `on_milestone` fires this skill as part of the milestone completion checklist.
+- **Depends on:** `harness-security-scan` — run after mechanical scanning to complete the security picture.
+- **Output:** Stdout report, optionally written to file via `--output`. No state files written.
+
+## Evidence Requirements
+
+When reporting findings, cite the source for each factor:
+
+- Maintainer data: `registry.npmjs.org/<pkg>` → `maintainers` field
+- Publish date: `registry.npmjs.org/<pkg>` → `time.modified`
+- Downloads: `api.npmjs.org/downloads/point/last-week/<pkg>`
+- Install scripts: `node_modules/<pkg>/package.json` → `scripts`
+- CVEs: `npm audit --json` output
+- Depth: lockfile analysis
+
+Do not assert risk scores without citing the specific data point that generated the score.
+
+## Success Criteria
+
+- Running `/harness:supply-chain-audit` on a project with dependencies outputs a risk table with all 6 factors scored
+- A dependency with a sole maintainer and no commits in 12 months scores "high risk"
+- A dependency with a `postinstall` script is flagged in the install scripts section
+- API failures produce "unknown" scores with a note, not errors that stop the audit
+- All findings are framed as flags for human review, not automated verdicts
+
+## Escalation
+
+- **If a critical CVE is found:** Surface immediately — do not bury it in the table. Recommend blocking the dependency update or requiring an immediate patch before merge.
+- **If all maintainers are unresponsive:** Flag the package as abandoned and recommend finding an alternative. Include download counts to help the user assess how widely adopted the package is.
+- **If an install script has unknown behavior:** Do not guess. State that the script requires manual review and link to the script source.
+- **If the npm or GitHub API is unavailable:** Note which factors were skipped with "unknown" scores. Do not fail the audit — partial results are better than none.
+- **If the user asks for a verdict ("is this safe?"):** Decline to give a binary answer. Supply chain risk is probabilistic. Present the risk signals and let the human decide.
+
+## Examples
+
+```
+Supply Chain Audit: my-project
+Date: 2026-03-31
+Packages evaluated: 24 direct + 3 deep transitives (depth > 5)
+
+CRITICAL (1):
+  lodash@4.17.20 — CVE-2021-23337 (high severity, unpatched)
+
+HIGH (2):
+  abandoned-util@0.9.1 — sole maintainer, last publish 22 months ago
+  sketchy-helper@2.1.0 — sole maintainer, postinstall script detected
+
+MEDIUM (3):
+  small-lib@1.0.0 — 800 weekly downloads (low popularity signal)
+  ...
+
+LOW (18): no significant risk signals
+
+INSTALL SCRIPTS:
+  node-gyp@9.4.0 — postinstall (native compilation, likely legitimate)
+  sketchy-helper@2.1.0 — postinstall (REVIEW: contents unknown)
+
+RESULT: 1 Critical, 2 High, 3 Medium, 18 Low
+Next steps: Update lodash to patch CVE. Review sketchy-helper postinstall script.
+Consider alternatives to abandoned-util.
+```
+
+## Example Output
+
+```
+Supply Chain Audit: my-project
+Date: 2026-03-31
+Packages evaluated: 24 direct + 3 deep transitives (depth > 5)
+
+CRITICAL (1):
+  lodash@4.17.20 — CVE-2021-23337 (high severity, unpatched)
+
+HIGH (2):
+  abandoned-util@0.9.1 — sole maintainer, last publish 22 months ago
+  sketchy-helper@2.1.0 — sole maintainer, postinstall script detected
+
+MEDIUM (3):
+  small-lib@1.0.0 — 800 weekly downloads (low popularity signal)
+  ...
+
+LOW (18): no significant risk signals
+
+INSTALL SCRIPTS:
+  node-gyp@9.4.0 — postinstall (native compilation, likely legitimate)
+  sketchy-helper@2.1.0 — postinstall (REVIEW: contents unknown)
+
+RESULT: 1 Critical, 2 High, 3 Medium, 18 Low
+Next steps: Update lodash to patch CVE. Review sketchy-helper postinstall script.
+Consider alternatives to abandoned-util.
+```

package/dist/agents/skills/gemini-cli/harness-supply-chain-audit/skill.yaml

@@ -0,0 +1,51 @@
+name: harness-supply-chain-audit
+version: "1.0.0"
+description: 6-factor dependency risk evaluation for supply chain security
+cognitive_mode: meticulous-implementer
+triggers:
+  - manual
+  - on_milestone
+platforms:
+  - claude-code
+  - gemini-cli
+tools:
+  - Bash
+  - Read
+  - Write
+  - Grep
+  - Glob
+  - WebFetch
+cli:
+  command: harness skill run harness-supply-chain-audit
+  args:
+    - name: path
+      description: Project root path
+      required: false
+    - name: depth
+      description: Maximum dependency depth to evaluate (default 3)
+      required: false
+    - name: output
+      description: Write report to file instead of stdout
+      required: false
+mcp:
+  tool: run_skill
+  input:
+    skill: harness-supply-chain-audit
+    path: string
+type: rigid
+tier: 2
+phases:
+  - name: inventory
+    description: Build dependency inventory from lockfile
+    required: true
+  - name: evaluate
+    description: Score each dependency on 6 risk factors
+    required: true
+  - name: report
+    description: Generate risk report with actionable findings
+    required: true
+state:
+  persistent: false
+  files: []
+depends_on:
+  - harness-security-scan

package/dist/agents/skills/package.json

@@ -9,6 +9,7 @@
     "test:coverage": "vitest run --coverage"
   },
   "devDependencies": {
+    "@vitest/coverage-v8": "^4.0.18",
     "glob": "^10.3.0",
     "vitest": "^4.0.18",
     "yaml": "^2.3.0",

package/dist/agents/skills/templates/discipline-template.md

@@ -0,0 +1,49 @@
+## Evidence Requirements
+
+When this skill makes claims about existing code, architecture, or behavior,
+it MUST cite evidence using one of:
+
+1. **File reference:** `file:line` format (e.g., `src/auth.ts:42`)
+2. **Code pattern reference:** `file` with description (e.g., `src/utils/hash.ts` —
+   "existing bcrypt wrapper")
+3. **Test/command output:** Inline or referenced output from a test run or CLI command
+4. **Session evidence:** Write to the `evidence` session section via `manage_state`
+
+**Uncited claims:** Technical assertions without citations MUST be prefixed with
+`[UNVERIFIED]`. Example: `[UNVERIFIED] The auth middleware supports refresh tokens`.
+
+## Red Flags
+
+### Universal
+
+These apply to ALL skills. If you catch yourself doing any of these, STOP.
+
+- **"I believe the codebase does X"** — Stop. Read the code and cite a file:line
+  reference. Belief is not evidence.
+- **"Let me recommend [pattern] for this"** without checking existing patterns — Stop.
+  Search the codebase first. The project may already have a convention.
+- **"While we're here, we should also [unrelated improvement]"** — Stop. Flag the idea
+  but do not expand scope beyond the stated task.
+
+### Domain-Specific
+
+<!-- Add 3-5 red flags specific to this skill's domain.
+     Each MUST contain a quoted phrase the agent would say.
+     Format: **"<quoted phrase>"** — <why it's dangerous and what to do instead> -->
+
+## Rationalizations to Reject
+
+### Universal
+
+These reasoning patterns sound plausible but lead to bad outcomes. Reject them.
+
+- **"It's probably fine"** — "Probably" is not evidence. Verify before asserting.
+- **"This is best practice"** — Best practice in what context? Cite the source and
+  confirm it applies to this codebase.
+- **"We can fix it later"** — If it is worth flagging, it is worth documenting now
+  with a concrete follow-up plan.
+
+### Domain-Specific
+
+<!-- Add 3-5 rationalizations specific to this skill's domain.
+     Format: **"<rationalization>"** — <why it's wrong and what to do instead> -->

package/dist/agents/skills/tests/schema.ts

@@ -43,7 +43,7 @@ const ALLOWED_TRIGGERS = [
   'on_task_complete',
 ] as const;
 
-const ALLOWED_PLATFORMS = ['claude-code', 'gemini-cli'] as const;
+const ALLOWED_PLATFORMS = ['claude-code', 'gemini-cli', 'codex', 'cursor'] as const;
 
 export const SkillMetadataSchema = z.object({
   name: z.string().regex(/^[a-z][a-z0-9-]*$/, 'Name must be lowercase with hyphens'),

package/dist/agents/skills/vitest.config.mts

@@ -5,5 +5,10 @@ export default defineConfig({
     globals: true,
     environment: 'node',
     include: ['tests/**/*.test.ts'],
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'json', 'json-summary', 'html'],
+      include: ['src/**/*.ts'],
+    },
   },
 });

package/dist/{agents-md-YTYQDA3P.js → agents-md-VYDFPIRW.js}

@@ -1,7 +1,7 @@
 import {
   generateAgentsMd
 } from "./chunk-OD3S2NHN.js";
-import "./chunk-ABQHQ6I5.js";
+import "./chunk-ALFKNAZW.js";
 import "./chunk-ERS5EVUZ.js";
 export {
   generateAgentsMd

package/dist/{architecture-JQZYM4US.js → architecture-K5HSRBGB.js}

@@ -1,11 +1,11 @@
 import {
   checkDependenciesDefinition,
   handleCheckDependencies
-} from "./chunk-3C2MLBPJ.js";
+} from "./chunk-SFRGPAK6.js";
 import "./chunk-H7Y5CKTM.js";
 import "./chunk-IDZNPTYD.js";
 import "./chunk-W6Y7ZW3Y.js";
-import "./chunk-ABQHQ6I5.js";
+import "./chunk-ALFKNAZW.js";
 import "./chunk-ERS5EVUZ.js";
 export {
   checkDependenciesDefinition,

package/dist/bin/harness-mcp.js

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import {
   startServer
-} from "../chunk-YZD2MRNQ.js";
-import "../chunk-OXLLOSSR.js";
-import "../chunk-YPYGXRDR.js";
-import "../chunk-TPOTOBR7.js";
-import "../chunk-OSXBPAMK.js";
-import "../chunk-NLVUVUGD.js";
-import "../chunk-ZOAWBDWU.js";
-import "../chunk-S2FXOWOR.js";
+} from "../chunk-JOP2NDNB.js";
+import "../chunk-AV6KMDO5.js";
+import "../chunk-DNDBFIZN.js";
+import "../chunk-RWZPHW4H.js";
+import "../chunk-QDF7COPQ.js";
+import "../chunk-ZJMU7MEV.js";
+import "../chunk-CJDVBBPB.js";
+import "../chunk-TF6ZLHJV.js";
 import "../chunk-FTMXDOR6.js";
-import "../chunk-3C2MLBPJ.js";
+import "../chunk-SFRGPAK6.js";
 import "../chunk-H7Y5CKTM.js";
-import "../chunk-7IP4JIFL.js";
-import "../chunk-O5OJVPL6.js";
+import "../chunk-C7DTKLPW.js";
+import "../chunk-OCDDCGDE.js";
 import "../chunk-IDZNPTYD.js";
 import "../chunk-W6Y7ZW3Y.js";
 import "../chunk-N5G5QMS3.js";
 import "../chunk-3WGJMBKH.js";
-import "../chunk-XYLGHKG6.js";
-import "../chunk-ABQHQ6I5.js";
+import "../chunk-HKUX2X7O.js";
+import "../chunk-ALFKNAZW.js";
 import "../chunk-ERS5EVUZ.js";
 
 // src/bin/harness-mcp.ts

package/dist/bin/harness.js

@@ -1,43 +1,44 @@
 #!/usr/bin/env node
 import {
-  createProgram
-} from "../chunk-XKECDXJS.js";
+  createProgram,
+  printFirstRunWelcome
+} from "../chunk-SHYWICGA.js";
 import "../chunk-SD3SQOZ2.js";
-import "../chunk-6KTUUFRN.js";
-import "../chunk-RCWZBSK5.js";
+import "../chunk-5ZXHMCPL.js";
+import "../chunk-6KWBH4EO.js";
 import "../chunk-YQ6KC6TE.js";
 import "../chunk-TRAPF4IX.js";
-import "../chunk-AOZRDOIP.js";
+import "../chunk-M6TIO6NF.js";
 import "../chunk-TEFCFC4H.js";
-import "../chunk-YBJ262QL.js";
+import "../chunk-LRG3B43J.js";
 import "../chunk-EBJQ6N4M.js";
 import "../chunk-DBSOCI3G.js";
 import "../chunk-FIAPHX37.js";
 import "../chunk-KET4QQZB.js";
 import "../chunk-OD3S2NHN.js";
-import "../chunk-YZD2MRNQ.js";
-import "../chunk-OXLLOSSR.js";
-import "../chunk-YPYGXRDR.js";
-import "../chunk-TPOTOBR7.js";
-import "../chunk-OSXBPAMK.js";
-import "../chunk-NLVUVUGD.js";
-import "../chunk-ZOAWBDWU.js";
-import "../chunk-S2FXOWOR.js";
+import "../chunk-JOP2NDNB.js";
+import "../chunk-AV6KMDO5.js";
+import "../chunk-DNDBFIZN.js";
+import "../chunk-RWZPHW4H.js";
+import "../chunk-QDF7COPQ.js";
+import "../chunk-ZJMU7MEV.js";
+import "../chunk-CJDVBBPB.js";
+import "../chunk-TF6ZLHJV.js";
 import "../chunk-FTMXDOR6.js";
-import "../chunk-3C2MLBPJ.js";
+import "../chunk-SFRGPAK6.js";
 import "../chunk-H7Y5CKTM.js";
-import "../chunk-7IP4JIFL.js";
+import "../chunk-C7DTKLPW.js";
 import {
   findConfigFile,
   loadConfig
-} from "../chunk-O5OJVPL6.js";
+} from "../chunk-OCDDCGDE.js";
 import "../chunk-IDZNPTYD.js";
 import "../chunk-W6Y7ZW3Y.js";
 import "../chunk-N5G5QMS3.js";
 import {
   handleError
 } from "../chunk-3WGJMBKH.js";
-import "../chunk-XYLGHKG6.js";
+import "../chunk-HKUX2X7O.js";
 import {
   CLI_VERSION
 } from "../chunk-BM3PWGXQ.js";
@@ -49,7 +50,7 @@ import {
   readCheckState,
   shouldRunCheck,
   spawnBackgroundCheck
-} from "../chunk-ABQHQ6I5.js";
+} from "../chunk-ALFKNAZW.js";
 import "../chunk-ERS5EVUZ.js";
 
 // src/bin/update-check-hooks.ts
@@ -103,6 +104,7 @@ ${message}
 
 // src/bin/harness.ts
 async function main() {
+  printFirstRunWelcome();
   runUpdateCheckAtStartup();
   const program = createProgram();
   try {

package/dist/{check-phase-gate-L3RADYWO.js → check-phase-gate-5AS6SXL6.js}

@@ -1,11 +1,11 @@
 import {
   createCheckPhaseGateCommand,
   runCheckPhaseGate
-} from "./chunk-6KTUUFRN.js";
+} from "./chunk-5ZXHMCPL.js";
 import "./chunk-EBJQ6N4M.js";
-import "./chunk-O5OJVPL6.js";
+import "./chunk-OCDDCGDE.js";
 import "./chunk-3WGJMBKH.js";
-import "./chunk-ABQHQ6I5.js";
+import "./chunk-ALFKNAZW.js";
 import "./chunk-ERS5EVUZ.js";
 export {
   createCheckPhaseGateCommand,

package/dist/{chunk-6KTUUFRN.js → chunk-5ZXHMCPL.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-EBJQ6N4M.js";
 import {
   resolveConfig
-} from "./chunk-O5OJVPL6.js";
+} from "./chunk-OCDDCGDE.js";
 import {
   ExitCode
 } from "./chunk-3WGJMBKH.js";

package/dist/{chunk-RCWZBSK5.js → chunk-6KWBH4EO.js}

@@ -10,7 +10,7 @@ import {
   VALID_PLATFORMS,
   applySyncPlan,
   computeSyncPlan
-} from "./chunk-ZOAWBDWU.js";
+} from "./chunk-CJDVBBPB.js";
 import {
   resolvePersonasDir,
   resolveSkillsDir