@harness-engineering/cli 1.14.0 → 1.16.0

package/dist/{chunk-YZD2MRNQ.js → chunk-JOP2NDNB.js}

@@ -1,7 +1,7 @@
 import {
   detectEntropyDefinition,
   handleDetectEntropy
-} from "./chunk-OXLLOSSR.js";
+} from "./chunk-AV6KMDO5.js";
 import {
   checkPerformanceDefinition,
   getCriticalPathsDefinition,
@@ -11,7 +11,7 @@ import {
   handleGetPerfBaselines,
   handleUpdatePerfBaselines,
   updatePerfBaselinesDefinition
-} from "./chunk-YPYGXRDR.js";
+} from "./chunk-DNDBFIZN.js";
 import {
   analyzeDiffDefinition,
   createSelfReviewDefinition,
@@ -19,43 +19,45 @@ import {
   handleCreateSelfReview,
   handleRequestPeerReview,
   requestPeerReviewDefinition
-} from "./chunk-TPOTOBR7.js";
+} from "./chunk-RWZPHW4H.js";
 import {
   handleRunSecurityScan,
   runSecurityScanDefinition
-} from "./chunk-OSXBPAMK.js";
+} from "./chunk-QDF7COPQ.js";
 import {
   handleRunCodeReview,
   runCodeReviewDefinition
-} from "./chunk-NLVUVUGD.js";
+} from "./chunk-ZJMU7MEV.js";
 import {
   GENERATED_HEADER_CLAUDE,
+  GENERATED_HEADER_CODEX,
+  GENERATED_HEADER_CURSOR,
   GENERATED_HEADER_GEMINI,
   VALID_PLATFORMS,
   applySyncPlan,
   computeSyncPlan
-} from "./chunk-ZOAWBDWU.js";
+} from "./chunk-CJDVBBPB.js";
 import {
   handleValidateProject,
   validateToolDefinition
-} from "./chunk-S2FXOWOR.js";
+} from "./chunk-TF6ZLHJV.js";
 import {
   loadGraphStore
 } from "./chunk-FTMXDOR6.js";
 import {
   checkDependenciesDefinition,
   handleCheckDependencies
-} from "./chunk-3C2MLBPJ.js";
+} from "./chunk-SFRGPAK6.js";
 import {
   resolveProjectConfig
 } from "./chunk-H7Y5CKTM.js";
 import {
   checkDocsDefinition,
   handleCheckDocs
-} from "./chunk-7IP4JIFL.js";
+} from "./chunk-C7DTKLPW.js";
 import {
   resolveConfig
-} from "./chunk-O5OJVPL6.js";
+} from "./chunk-OCDDCGDE.js";
 import {
   resultToMcpResponse
 } from "./chunk-IDZNPTYD.js";
@@ -78,7 +80,13 @@ import {
 } from "./chunk-3WGJMBKH.js";
 import {
   SkillMetadataSchema
-} from "./chunk-XYLGHKG6.js";
+} from "./chunk-HKUX2X7O.js";
+import {
+  DESTRUCTIVE_BASH,
+  checkTaint,
+  scanForInjection,
+  writeTaint
+} from "./chunk-ALFKNAZW.js";
 import {
   Err,
   Ok
@@ -94,6 +102,123 @@ import {
   ReadResourceRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
 
+// src/mcp/middleware/injection-guard.ts
+import { realpathSync } from "fs";
+import { resolve } from "path";
+function isDestructiveBash(command) {
+  return DESTRUCTIVE_BASH.some((p) => p.test(command));
+}
+function isOutsideWorkspace(filePath, workspaceRoot) {
+  if (!filePath || !workspaceRoot) return false;
+  const resolved = resolve(workspaceRoot, filePath);
+  let realResolved = resolved;
+  try {
+    realResolved = realpathSync(resolved);
+  } catch {
+  }
+  return !realResolved.startsWith(workspaceRoot);
+}
+var INPUT_EXTRACTORS = {
+  Bash: (input) => input?.command ?? "",
+  Write: (input) => input?.content ?? "",
+  Edit: (input) => `${input?.old_string ?? ""}
+${input?.new_string ?? ""}`,
+  Read: (input) => input?.file_path ?? ""
+};
+function extractInputText(toolName, toolInput) {
+  const extractor = INPUT_EXTRACTORS[toolName];
+  if (extractor) return extractor(toolInput);
+  const parts = Object.values(toolInput || {}).filter((v) => typeof v === "string");
+  return parts.length > 0 ? parts.join("\n") : null;
+}
+function extractResultText(result) {
+  return result.content.filter((c) => c.type === "text").map((c) => c.text).join("\n");
+}
+function isDestructiveOperation(toolName, toolInput, workspaceRoot) {
+  const normalized = toolName.toLowerCase().replace(/_/g, "");
+  if (normalized === "bash") {
+    const command = toolInput?.command ?? "";
+    return isDestructiveBash(command);
+  }
+  if (normalized === "write" || normalized === "edit") {
+    const filePath = toolInput?.file_path ?? "";
+    return isOutsideWorkspace(filePath, workspaceRoot);
+  }
+  return false;
+}
+function wrapWithInjectionGuard(toolName, handler, options = {}) {
+  const projectRoot = options.projectRoot ?? process.cwd();
+  const sessionId = options.sessionId ?? "default";
+  return async (input) => {
+    try {
+      const taintCheck = checkTaint(projectRoot, sessionId);
+      if (taintCheck.tainted && isDestructiveOperation(toolName, input, projectRoot)) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `BLOCKED by Sentinel: "${toolName}" blocked during tainted session. Destructive operations are restricted. Run "harness taint clear" to lift.`
+            }
+          ],
+          isError: true
+        };
+      }
+      const textToScan = extractInputText(toolName, input);
+      if (textToScan) {
+        const findings = scanForInjection(textToScan);
+        const actionable = findings.filter(
+          (f) => f.severity === "high" || f.severity === "medium"
+        );
+        if (actionable.length > 0) {
+          writeTaint(
+            projectRoot,
+            sessionId,
+            `Injection pattern detected in MCP:${toolName} input`,
+            actionable,
+            `MCP:${toolName}`
+          );
+        }
+      }
+      const result = await handler(input);
+      const outputText = extractResultText(result);
+      if (outputText) {
+        const outputFindings = scanForInjection(outputText);
+        const actionableOutput = outputFindings.filter(
+          (f) => f.severity === "high" || f.severity === "medium"
+        );
+        if (actionableOutput.length > 0) {
+          writeTaint(
+            projectRoot,
+            sessionId,
+            `Injection pattern detected in MCP:${toolName} result`,
+            actionableOutput,
+            `MCP:${toolName}:output`
+          );
+          const warningLines = actionableOutput.map(
+            (f) => `Sentinel [${f.severity}] ${f.ruleId}: detected in ${toolName} output`
+          );
+          result.content.push({
+            type: "text",
+            text: `
+---
+Sentinel Warning: ${warningLines.join("; ")}`
+          });
+        }
+      }
+      return result;
+    } catch {
+      return handler(input);
+    }
+  };
+}
+function applyInjectionGuard(handlers, options = {}) {
+  const wrapped = {};
+  for (const [name, handler] of Object.entries(handlers)) {
+    wrapped[name] = wrapWithInjectionGuard(name, handler, options);
+  }
+  return wrapped;
+}
+
 // src/mcp/tools/linter.ts
 var generateLinterDefinition = {
   name: "generate_linter",
@@ -428,7 +553,7 @@ ${skippedMsg}`
 async function handleInitProject(input) {
   const i = input;
   try {
-    const { TemplateEngine } = await import("./engine-EG4EH4IX.js");
+    const { TemplateEngine } = await import("./engine-3G3VIM6L.js");
     const engine = new TemplateEngine(resolveTemplatesDir());
     const safePath = sanitizePath(i.path);
     const detected = tryDetectFramework(engine, safePath, i);
@@ -449,7 +574,7 @@ var listPersonasDefinition = {
   inputSchema: { type: "object", properties: {} }
 };
 async function handleListPersonas() {
-  const { listPersonas } = await import("./loader-ZPALXIVR.js");
+  const { listPersonas } = await import("./loader-VCOK3PF7.js");
   const result = listPersonas(resolvePersonasDir());
   return resultToMcpResponse(result);
 }
@@ -473,10 +598,10 @@ async function handleGeneratePersonaArtifacts(input) {
   if (!/^[a-z0-9][a-z0-9._-]*$/i.test(input.name)) {
     return resultToMcpResponse(Err(new Error(`Invalid persona name: ${input.name}`)));
   }
-  const { loadPersona } = await import("./loader-ZPALXIVR.js");
-  const { generateRuntime } = await import("./runtime-7YLVK453.js");
-  const { generateAgentsMd } = await import("./agents-md-YTYQDA3P.js");
-  const { generateCIWorkflow } = await import("./ci-workflow-EQZFVX3P.js");
+  const { loadPersona } = await import("./loader-VCOK3PF7.js");
+  const { generateRuntime } = await import("./runtime-PYFFIESU.js");
+  const { generateAgentsMd } = await import("./agents-md-VYDFPIRW.js");
+  const { generateCIWorkflow } = await import("./ci-workflow-CRWU723U.js");
   const personasDir = resolvePersonasDir();
   const filePath = path3.join(personasDir, `${input.name}.yaml`);
   if (!filePath.startsWith(personasDir)) {
@@ -531,9 +656,9 @@ async function handleRunPersona(input) {
   if (!/^[a-z0-9][a-z0-9._-]*$/i.test(input.persona)) {
     return resultToMcpResponse(Err(new Error(`Invalid persona name: ${input.persona}`)));
   }
-  const { loadPersona } = await import("./loader-ZPALXIVR.js");
+  const { loadPersona } = await import("./loader-VCOK3PF7.js");
   const { runPersona } = await import("./runner-VMYLHWOC.js");
-  const { executeSkill } = await import("./skill-executor-XZLYZYAK.js");
+  const { executeSkill } = await import("./skill-executor-XEVDGXUM.js");
   const personasDir = resolvePersonasDir();
   const filePath = path3.join(personasDir, `${input.persona}.yaml`);
   if (!filePath.startsWith(personasDir)) {
@@ -944,8 +1069,8 @@ var runSkillDefinition = {
       path: { type: "string", description: "Path to project root for state context injection" },
       complexity: {
         type: "string",
-        enum: ["auto", "light", "full"],
-        description: "Complexity level for scale-adaptive rigor"
+        enum: ["fast", "standard", "thorough"],
+        description: "Rigor level: fast (minimal), standard (default), thorough (full)"
       },
       phase: { type: "string", description: "Start at a specific phase (re-entry)" },
       party: { type: "boolean", description: "Enable multi-perspective evaluation" }
@@ -1031,7 +1156,7 @@ var createSkillDefinition = {
 };
 async function handleCreateSkill(input) {
   try {
-    const { generateSkillFiles } = await import("./create-skill-XSWHMSM5.js");
+    const { generateSkillFiles } = await import("./create-skill-NDXQSTIK.js");
     const result = generateSkillFiles({
       name: input.name,
       description: input.description,
@@ -1142,6 +1267,26 @@ async function getLearningsResource(projectRoot) {
   return sections.length > 0 ? sections.join("\n\n---\n\n") : "No learnings files found.";
 }
 
+// src/mcp/tools/roadmap-auto-sync.ts
+import * as fs10 from "fs";
+import * as path11 from "path";
+async function autoSyncRoadmap(projectPath) {
+  try {
+    const roadmapFile = path11.join(projectPath, "docs", "roadmap.md");
+    if (!fs10.existsSync(roadmapFile)) return;
+    const { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges } = await import("./dist-4LPXJYVZ.js");
+    const raw = fs10.readFileSync(roadmapFile, "utf-8");
+    const parseResult = parseRoadmap(raw);
+    if (!parseResult.ok) return;
+    const roadmap = parseResult.value;
+    const syncResult = syncRoadmap({ projectPath, roadmap });
+    if (!syncResult.ok || syncResult.value.length === 0) return;
+    applySyncChanges(roadmap, syncResult.value);
+    fs10.writeFileSync(roadmapFile, serializeRoadmap(roadmap), "utf-8");
+  } catch {
+  }
+}
+
 // src/mcp/utils.ts
 function mcpError(text) {
   return { content: [{ type: "text", text }], isError: true };
@@ -1215,12 +1360,12 @@ var manageStateDefinition = {
   }
 };
 async function handleShow(projectPath, input) {
-  const { loadState } = await import("./dist-HWXF2C3R.js");
+  const { loadState } = await import("./dist-4LPXJYVZ.js");
   return resultToMcpResponse(await loadState(projectPath, input.stream, input.session));
 }
 async function handleLearn(projectPath, input) {
   if (!input.learning) return mcpError("Error: learning is required for learn action");
-  const { appendLearning } = await import("./dist-HWXF2C3R.js");
+  const { appendLearning } = await import("./dist-4LPXJYVZ.js");
   const result = await appendLearning(
     projectPath,
     input.learning,
@@ -1235,7 +1380,7 @@ async function handleLearn(projectPath, input) {
 async function handleFailure(projectPath, input) {
   if (!input.description) return mcpError("Error: description is required for failure action");
   if (!input.failureType) return mcpError("Error: failureType is required for failure action");
-  const { appendFailure } = await import("./dist-HWXF2C3R.js");
+  const { appendFailure } = await import("./dist-4LPXJYVZ.js");
   const result = await appendFailure(
     projectPath,
     input.description,
@@ -1248,34 +1393,36 @@ async function handleFailure(projectPath, input) {
   return resultToMcpResponse(Ok({ recorded: true }));
 }
 async function handleArchive(projectPath, input) {
-  const { archiveFailures } = await import("./dist-HWXF2C3R.js");
+  const { archiveFailures } = await import("./dist-4LPXJYVZ.js");
   const result = await archiveFailures(projectPath, input.stream, input.session);
   if (!result.ok) return resultToMcpResponse(result);
   return resultToMcpResponse(Ok({ archived: true }));
 }
 async function handleReset(projectPath, input) {
-  const { saveState, DEFAULT_STATE } = await import("./dist-HWXF2C3R.js");
+  const { saveState, DEFAULT_STATE } = await import("./dist-4LPXJYVZ.js");
   const result = await saveState(projectPath, { ...DEFAULT_STATE }, input.stream, input.session);
   if (!result.ok) return resultToMcpResponse(result);
   return resultToMcpResponse(Ok({ reset: true }));
 }
 async function handleGate(projectPath, _input) {
-  const { runMechanicalGate } = await import("./dist-HWXF2C3R.js");
+  const { runMechanicalGate } = await import("./dist-4LPXJYVZ.js");
   return resultToMcpResponse(await runMechanicalGate(projectPath));
 }
 async function handleSaveHandoff(projectPath, input) {
   if (!input.handoff) return mcpError("Error: handoff is required for save-handoff action");
-  const { saveHandoff } = await import("./dist-HWXF2C3R.js");
+  const { saveHandoff } = await import("./dist-4LPXJYVZ.js");
   const result = await saveHandoff(
     projectPath,
     input.handoff,
     input.stream,
     input.session
   );
-  return resultToMcpResponse(result.ok ? Ok({ saved: true }) : result);
+  if (!result.ok) return resultToMcpResponse(result);
+  await autoSyncRoadmap(projectPath);
+  return resultToMcpResponse(Ok({ saved: true }));
 }
 async function handleLoadHandoff(projectPath, input) {
-  const { loadHandoff } = await import("./dist-HWXF2C3R.js");
+  const { loadHandoff } = await import("./dist-4LPXJYVZ.js");
   return resultToMcpResponse(await loadHandoff(projectPath, input.stream, input.session));
 }
 async function handleAppendEntry(projectPath, input) {
@@ -1283,7 +1430,7 @@ async function handleAppendEntry(projectPath, input) {
   if (!input.section) return mcpError("Error: section is required for append_entry action");
   if (!input.authorSkill) return mcpError("Error: authorSkill is required for append_entry action");
   if (!input.content) return mcpError("Error: content is required for append_entry action");
-  const { appendSessionEntry } = await import("./dist-HWXF2C3R.js");
+  const { appendSessionEntry } = await import("./dist-4LPXJYVZ.js");
   const result = await appendSessionEntry(
     projectPath,
     input.session,
@@ -1299,7 +1446,7 @@ async function handleUpdateEntryStatus(projectPath, input) {
   if (!input.entryId) return mcpError("Error: entryId is required for update_entry_status action");
   if (!input.newStatus)
     return mcpError("Error: newStatus is required for update_entry_status action");
-  const { updateSessionEntryStatus } = await import("./dist-HWXF2C3R.js");
+  const { updateSessionEntryStatus } = await import("./dist-4LPXJYVZ.js");
   const result = await updateSessionEntryStatus(
     projectPath,
     input.session,
@@ -1312,7 +1459,7 @@ async function handleUpdateEntryStatus(projectPath, input) {
 async function handleReadSection(projectPath, input) {
   if (!input.session) return mcpError("Error: session is required for read_section action");
   if (!input.section) return mcpError("Error: section is required for read_section action");
-  const { readSessionSection } = await import("./dist-HWXF2C3R.js");
+  const { readSessionSection } = await import("./dist-4LPXJYVZ.js");
   const result = await readSessionSection(
     projectPath,
     input.session,
@@ -1322,15 +1469,16 @@ async function handleReadSection(projectPath, input) {
 }
 async function handleReadSections(projectPath, input) {
   if (!input.session) return mcpError("Error: session is required for read_sections action");
-  const { readSessionSections } = await import("./dist-HWXF2C3R.js");
+  const { readSessionSections } = await import("./dist-4LPXJYVZ.js");
   const result = await readSessionSections(projectPath, input.session);
   return resultToMcpResponse(result);
 }
 async function handleArchiveSession(projectPath, input) {
   if (!input.session) return mcpError("Error: session is required for archive_session action");
-  const { archiveSession } = await import("./dist-HWXF2C3R.js");
+  const { archiveSession } = await import("./dist-4LPXJYVZ.js");
   const result = await archiveSession(projectPath, input.session);
   if (!result.ok) return resultToMcpResponse(result);
+  await autoSyncRoadmap(projectPath);
   return resultToMcpResponse(Ok({ archived: true }));
 }
 var ACTION_HANDLERS = {
@@ -1371,7 +1519,7 @@ var listStreamsDefinition = {
 };
 async function handleListStreams(input) {
   try {
-    const { listStreams, loadStreamIndex } = await import("./dist-HWXF2C3R.js");
+    const { listStreams, loadStreamIndex } = await import("./dist-4LPXJYVZ.js");
     const projectPath = sanitizePath(input.path);
     const indexResult = await loadStreamIndex(projectPath);
     const streamsResult = await listStreams(projectPath);
@@ -1409,7 +1557,7 @@ var checkPhaseGateDefinition = {
 };
 async function handleCheckPhaseGate(input) {
   try {
-    const { runCheckPhaseGate } = await import("./check-phase-gate-L3RADYWO.js");
+    const { runCheckPhaseGate } = await import("./check-phase-gate-5AS6SXL6.js");
     const result = await runCheckPhaseGate({ cwd: sanitizePath(input.path) });
     if (result.ok) {
       return { content: [{ type: "text", text: JSON.stringify(result.value) }] };
@@ -1429,7 +1577,7 @@ async function handleCheckPhaseGate(input) {
 }
 
 // src/mcp/tools/cross-check.ts
-import * as path11 from "path";
+import * as path12 from "path";
 var validateCrossCheckDefinition = {
   name: "validate_cross_check",
   description: "Validate plan-to-implementation coverage: checks that specs have plans and plans have implementations, detects staleness",
@@ -1465,15 +1613,15 @@ async function handleValidateCrossCheck(input) {
     };
   }
   try {
-    const { runCrossCheck } = await import("./validate-cross-check-WNJM6H2D.js");
-    const specsDir = path11.resolve(projectPath, input.specsDir ?? "docs/specs");
+    const { runCrossCheck } = await import("./validate-cross-check-4Y6NHNK3.js");
+    const specsDir = path12.resolve(projectPath, input.specsDir ?? "docs/specs");
     if (!specsDir.startsWith(projectPath)) {
       return {
         content: [{ type: "text", text: "Error: specsDir escapes project root" }],
         isError: true
       };
     }
-    const plansDir = path11.resolve(projectPath, input.plansDir ?? "docs/plans");
+    const plansDir = path12.resolve(projectPath, input.plansDir ?? "docs/plans");
     if (!plansDir.startsWith(projectPath)) {
       return {
         content: [{ type: "text", text: "Error: plansDir escapes project root" }],
@@ -1504,14 +1652,14 @@ async function handleValidateCrossCheck(input) {
 
 // src/commands/generate-slash-commands.ts
 import { Command } from "commander";
-import fs11 from "fs";
-import path13 from "path";
+import fs13 from "fs";
+import path15 from "path";
 import os from "os";
 import readline from "readline";
 
 // src/slash-commands/normalize.ts
-import fs10 from "fs";
-import path12 from "path";
+import fs11 from "fs";
+import path13 from "path";
 import { parse as parse3 } from "yaml";
 
 // src/slash-commands/normalize-name.ts
@@ -1531,14 +1679,18 @@ function normalizeName(skillName) {
 function readSkillYaml(yamlPath) {
   let raw;
   try {
-    raw = fs10.readFileSync(yamlPath, "utf-8");
+    raw = fs11.readFileSync(yamlPath, "utf-8");
   } catch {
     return null;
   }
   return SkillMetadataSchema.safeParse(parse3(raw));
 }
+var DERIVED_FROM_CLAUDE_CODE = ["cursor", "codex"];
 function shouldSkipSkill(meta, platforms) {
-  const matchesPlatform = platforms.some((p) => meta.platforms.includes(p));
+  const effectivePlatforms = platforms.map(
+    (p) => DERIVED_FROM_CLAUDE_CODE.includes(p) ? "claude-code" : p
+  );
+  const matchesPlatform = effectivePlatforms.some((p) => meta.platforms.includes(p));
   if (!matchesPlatform) return true;
   if (meta.tier === 3 || meta.internal) return true;
   return false;
@@ -1591,10 +1743,10 @@ function buildProcessLines(meta) {
   ];
 }
 function buildSpec(meta, normalized, entry, skillsDir, source) {
-  const skillMdPath = path12.join(skillsDir, entry.name, "SKILL.md");
-  const skillMdContent = fs10.existsSync(skillMdPath) ? fs10.readFileSync(skillMdPath, "utf-8") : "";
-  const skillMdRelative = path12.relative(process.cwd(), skillMdPath).replaceAll("\\", "/");
-  const skillYamlRelative = path12.relative(process.cwd(), path12.join(skillsDir, entry.name, "skill.yaml")).replaceAll("\\", "/");
+  const skillMdPath = path13.join(skillsDir, entry.name, "SKILL.md");
+  const skillMdContent = fs11.existsSync(skillMdPath) ? fs11.readFileSync(skillMdPath, "utf-8") : "";
+  const skillMdRelative = path13.relative(process.cwd(), skillMdPath).replaceAll("\\", "/");
+  const skillYamlRelative = path13.relative(process.cwd(), path13.join(skillsDir, entry.name, "skill.yaml")).replaceAll("\\", "/");
   const args = (meta.cli?.args ?? []).map((a) => ({
     name: a.name,
     description: a.description ?? "",
@@ -1619,6 +1771,7 @@ function buildSpec(meta, normalized, entry, skillsDir, source) {
     sourceDir: entry.name,
     skillsBaseDir: skillsDir,
     source,
+    ...meta.cursor ? { cursor: meta.cursor } : {},
     prompt: {
       context: buildContextLines(meta).join("\n"),
       objective: buildObjectiveLines(meta).join("\n"),
@@ -1631,11 +1784,11 @@ function normalizeSkills(skillSources, platforms) {
   const specs = [];
   const nameMap = /* @__PURE__ */ new Map();
   for (const { dir: skillsDir, source } of skillSources) {
-    if (!fs10.existsSync(skillsDir)) continue;
-    const entries = fs10.readdirSync(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory());
+    if (!fs11.existsSync(skillsDir)) continue;
+    const entries = fs11.readdirSync(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory());
     for (const entry of entries) {
-      const yamlPath = path12.join(skillsDir, entry.name, "skill.yaml");
-      if (!fs10.existsSync(yamlPath)) continue;
+      const yamlPath = path13.join(skillsDir, entry.name, "skill.yaml");
+      if (!fs11.existsSync(yamlPath)) continue;
       const result = readSkillYaml(yamlPath);
       if (!result) continue;
       if (!result.success) {
@@ -1743,27 +1896,140 @@ function renderGemini(spec, skillMdContent, skillYamlContent) {
   return lines.join("\n");
 }
 
+// src/slash-commands/render-cursor.ts
+function renderCursor(spec, skillMdContent, cursorConfig) {
+  const lines = ["---"];
+  lines.push(`description: ${spec.description}`);
+  if (cursorConfig?.globs && cursorConfig.globs.length > 0) {
+    lines.push("globs:");
+    for (const glob of cursorConfig.globs) {
+      lines.push(`  - ${glob}`);
+    }
+  }
+  const alwaysApply = cursorConfig?.alwaysApply ?? false;
+  lines.push(`alwaysApply: ${alwaysApply}`);
+  lines.push("---");
+  lines.push("");
+  lines.push(GENERATED_HEADER_CURSOR);
+  lines.push("");
+  lines.push(skillMdContent);
+  lines.push("");
+  return lines.join("\n");
+}
+
+// src/slash-commands/render-codex.ts
+function renderCodexSkill(skillMdContent) {
+  return `<!-- ${GENERATED_HEADER_CODEX.replace(/<!--\s*|\s*-->/g, "").trim()} -->
+
+${skillMdContent}
+`;
+}
+function renderCodexOpenaiYaml(spec) {
+  return [
+    "# Reserved for Phase B native integration",
+    `name: ${spec.skillYamlName}`,
+    `version: "1.0.0"`,
+    ""
+  ].join("\n");
+}
+function renderCodexAgentsMd(specs) {
+  const lines = [];
+  lines.push(`<!-- ${GENERATED_HEADER_CODEX.replace(/<!--\s*|\s*-->/g, "").trim()} -->`);
+  lines.push("");
+  lines.push("# Harness Skills");
+  lines.push("");
+  lines.push(
+    "This file bootstraps harness context for Codex CLI. Each skill is available as a structured workflow in the `harness/` directory."
+  );
+  lines.push("");
+  lines.push("## Available Skills");
+  lines.push("");
+  for (const spec of specs) {
+    lines.push(`- **${spec.skillYamlName}** \u2014 ${spec.description}`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+
+// src/slash-commands/sync-codex.ts
+import fs12 from "fs";
+import path14 from "path";
+function computeCodexSync(outputDir, specs, dryRun) {
+  const added = [];
+  const updated = [];
+  const unchanged = [];
+  const specSkillNames = /* @__PURE__ */ new Set();
+  for (const spec of specs) {
+    const mdPath = path14.join(spec.skillsBaseDir, spec.sourceDir, "SKILL.md");
+    const skillMd = fs12.existsSync(mdPath) ? fs12.readFileSync(mdPath, "utf-8") : "";
+    const skillDir = path14.join(outputDir, spec.skillYamlName);
+    specSkillNames.add(spec.skillYamlName);
+    const renderedSkillMd = renderCodexSkill(skillMd);
+    const renderedOpenaiYaml = renderCodexOpenaiYaml(spec);
+    const existingSkillMdPath = path14.join(skillDir, "SKILL.md");
+    const existingOpenaiYamlPath = path14.join(skillDir, "agents", "openai.yaml");
+    if (!fs12.existsSync(skillDir)) {
+      added.push(spec.skillYamlName);
+    } else {
+      const existingSkillMd = fs12.existsSync(existingSkillMdPath) ? fs12.readFileSync(existingSkillMdPath, "utf-8") : "";
+      const existingOpenaiYaml = fs12.existsSync(existingOpenaiYamlPath) ? fs12.readFileSync(existingOpenaiYamlPath, "utf-8") : "";
+      if (existingSkillMd === renderedSkillMd && existingOpenaiYaml === renderedOpenaiYaml) {
+        unchanged.push(spec.skillYamlName);
+      } else {
+        updated.push(spec.skillYamlName);
+      }
+    }
+    if (!dryRun && !unchanged.includes(spec.skillYamlName)) {
+      const agentsSubDir = path14.join(skillDir, "agents");
+      fs12.mkdirSync(agentsSubDir, { recursive: true });
+      fs12.writeFileSync(existingSkillMdPath, renderedSkillMd, "utf-8");
+      fs12.writeFileSync(existingOpenaiYamlPath, renderedOpenaiYaml, "utf-8");
+    }
+  }
+  const removed = detectCodexOrphans(outputDir, specSkillNames);
+  return { added, updated, removed, unchanged };
+}
+function detectCodexOrphans(outputDir, specSkillNames) {
+  const removed = [];
+  if (!fs12.existsSync(outputDir)) return removed;
+  const existingDirs = fs12.readdirSync(outputDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  for (const dirName of existingDirs) {
+    if (specSkillNames.has(dirName)) continue;
+    const skillMdPath = path14.join(outputDir, dirName, "SKILL.md");
+    if (fs12.existsSync(skillMdPath)) {
+      const content = fs12.readFileSync(skillMdPath, "utf-8");
+      if (content.includes(GENERATED_HEADER_CODEX)) {
+        removed.push(dirName);
+      }
+    }
+  }
+  return removed;
+}
+
 // src/commands/generate-slash-commands.ts
 function resolveOutputDir(platform, opts) {
   if (opts.output) {
-    return path13.join(opts.output, "harness");
+    return path15.join(opts.output, "harness");
   }
   if (opts.global) {
     const home = os.homedir();
-    return platform === "claude-code" ? path13.join(home, ".claude", "commands", "harness") : path13.join(home, ".gemini", "commands", "harness");
+    if (platform === "claude-code") return path15.join(home, ".claude", "commands", "harness");
+    if (platform === "gemini-cli") return path15.join(home, ".gemini", "commands", "harness");
+    if (platform === "cursor") return path15.join(home, ".cursor", "rules", "harness");
+    return path15.join(home, ".codex", "harness");
   }
-  return platform === "claude-code" ? path13.join("agents", "commands", "claude-code", "harness") : path13.join("agents", "commands", "gemini-cli", "harness");
-}
-function fileExtension(platform) {
-  return platform === "claude-code" ? ".md" : ".toml";
+  if (platform === "claude-code") return path15.join("agents", "commands", "claude-code", "harness");
+  if (platform === "gemini-cli") return path15.join("agents", "commands", "gemini-cli", "harness");
+  if (platform === "cursor") return path15.join("agents", "commands", "cursor", "harness");
+  return path15.join("agents", "commands", "codex", "harness");
 }
 async function confirmDeletion(files) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     rl.question(`
 Remove ${files.length} orphaned command(s)? (y/N) `, (answer) => {
       rl.close();
-      resolve2(answer.toLowerCase() === "y");
+      resolve3(answer.toLowerCase() === "y");
     });
   });
 }
@@ -1777,12 +2043,12 @@ function resolveSkillSources(opts) {
     sources.push({ dir: projectDir, source: "project" });
   }
   const communityDir = resolveCommunitySkillsDir();
-  if (fs11.existsSync(communityDir)) {
+  if (fs13.existsSync(communityDir)) {
     sources.push({ dir: communityDir, source: "community" });
   }
   if (opts.includeGlobal || sources.length === 0) {
     const globalDir = resolveGlobalSkillsDir();
-    if (!projectDir || path13.resolve(globalDir) !== path13.resolve(projectDir)) {
+    if (!projectDir || path15.resolve(globalDir) !== path15.resolve(projectDir)) {
       sources.push({ dir: globalDir, source: "global" });
     }
   }
@@ -1794,12 +2060,26 @@ function generateSlashCommands(opts) {
   const results = [];
   for (const platform of opts.platforms) {
     const outputDir = resolveOutputDir(platform, opts);
-    const ext = fileExtension(platform);
     const useAbsolutePaths = opts.global;
     const rendered = /* @__PURE__ */ new Map();
+    if (platform === "codex") {
+      const codexSync = computeCodexSync(outputDir, specs, opts.dryRun);
+      const codexRoot = path15.dirname(outputDir);
+      if (!opts.dryRun) {
+        fs13.mkdirSync(codexRoot, { recursive: true });
+        fs13.writeFileSync(path15.join(codexRoot, "AGENTS.md"), renderCodexAgentsMd(specs), "utf-8");
+      }
+      results.push({ platform, ...codexSync, outputDir });
+      continue;
+    }
     for (const spec of specs) {
-      const filename = `${spec.name}${ext}`;
-      if (platform === "claude-code") {
+      if (platform === "cursor") {
+        const filename = `${spec.skillYamlName}.mdc`;
+        const mdPath = path15.join(spec.skillsBaseDir, spec.sourceDir, "SKILL.md");
+        const skillMd = fs13.existsSync(mdPath) ? fs13.readFileSync(mdPath, "utf-8") : "";
+        rendered.set(filename, renderCursor(spec, skillMd, spec.cursor));
+      } else if (platform === "claude-code") {
+        const filename = `${spec.name}.md`;
         const renderSpec = useAbsolutePaths ? {
           ...spec,
           prompt: {
@@ -1807,7 +2087,7 @@ function generateSlashCommands(opts) {
             executionContext: spec.prompt.executionContext.split("\n").map((line) => {
               if (line.startsWith("@")) {
                 const relPath = line.slice(1);
-                return `@${path13.resolve(relPath)}`;
+                return `@${path15.resolve(relPath)}`;
               }
               return line;
             }).join("\n")
@@ -1815,10 +2095,11 @@ function generateSlashCommands(opts) {
         } : spec;
         rendered.set(filename, renderClaudeCode(renderSpec));
       } else {
-        const mdPath = path13.join(spec.skillsBaseDir, spec.sourceDir, "SKILL.md");
-        const yamlPath = path13.join(spec.skillsBaseDir, spec.sourceDir, "skill.yaml");
-        const mdContent = fs11.existsSync(mdPath) ? fs11.readFileSync(mdPath, "utf-8") : "";
-        const yamlContent = fs11.existsSync(yamlPath) ? fs11.readFileSync(yamlPath, "utf-8") : "";
+        const filename = `${spec.name}.toml`;
+        const mdPath = path15.join(spec.skillsBaseDir, spec.sourceDir, "SKILL.md");
+        const yamlPath = path15.join(spec.skillsBaseDir, spec.sourceDir, "skill.yaml");
+        const mdContent = fs13.existsSync(mdPath) ? fs13.readFileSync(mdPath, "utf-8") : "";
+        const yamlContent = fs13.existsSync(yamlPath) ? fs13.readFileSync(yamlPath, "utf-8") : "";
         rendered.set(filename, renderGemini(spec, mdContent, yamlContent));
       }
     }
@@ -1844,9 +2125,14 @@ async function handleOrphanDeletion(results, opts) {
     const shouldDelete = opts.yes || await confirmDeletion(result.removed);
     if (shouldDelete) {
       for (const filename of result.removed) {
-        const filePath = path13.join(result.outputDir, filename);
-        if (fs11.existsSync(filePath)) {
-          fs11.unlinkSync(filePath);
+        const filePath = path15.join(result.outputDir, filename);
+        if (fs13.existsSync(filePath)) {
+          const stat = fs13.statSync(filePath);
+          if (stat.isDirectory()) {
+            fs13.rmSync(filePath, { recursive: true, force: true });
+          } else {
+            fs13.unlinkSync(filePath);
+          }
         }
       }
     }
@@ -1854,7 +2140,7 @@ async function handleOrphanDeletion(results, opts) {
 }
 function createGenerateSlashCommandsCommand() {
   return new Command("generate-slash-commands").description(
-    "Generate native slash commands for Claude Code and Gemini CLI from skill metadata"
+    "Generate native commands for Claude Code, Gemini CLI, Codex CLI, and Cursor from skill metadata"
   ).option("--platforms <list>", "Target platforms (comma-separated)", "claude-code,gemini-cli").option("--global", "Write to global config directories", false).option("--include-global", "Include built-in global skills alongside project skills", false).option("--output <dir>", "Custom output directory").option("--skills-dir <path>", "Skills directory to scan").option("--dry-run", "Show what would change without writing", false).option("--yes", "Skip deletion confirmation prompts", false).action(async (opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
     const platforms = opts.platforms.split(",").map((p) => p.trim());
@@ -1972,7 +2258,7 @@ async function handleGenerateSlashCommands(input) {
 // src/mcp/resources/state.ts
 async function getStateResource(projectRoot) {
   try {
-    const { loadState, migrateToStreams } = await import("./dist-HWXF2C3R.js");
+    const { loadState, migrateToStreams } = await import("./dist-4LPXJYVZ.js");
     await migrateToStreams(projectRoot);
     const result = await loadState(projectRoot);
     if (result.ok) {
@@ -2519,7 +2805,7 @@ async function handleGetImpact(input) {
 }
 
 // src/mcp/tools/graph/ingest-source.ts
-import * as path14 from "path";
+import * as path16 from "path";
 var ingestSourceDefinition = {
   name: "ingest_source",
   description: "Ingest sources into the project knowledge graph. Supports code analysis, knowledge documents, git history, or all at once.",
@@ -2539,10 +2825,10 @@ var ingestSourceDefinition = {
 async function handleIngestSource(input) {
   try {
     const projectPath = sanitizePath(input.path);
-    const graphDir = path14.join(projectPath, ".harness", "graph");
+    const graphDir = path16.join(projectPath, ".harness", "graph");
     const { GraphStore, CodeIngestor, TopologicalLinker, KnowledgeIngestor, GitIngestor } = await import("./dist-B26DFXMP.js");
-    const fs14 = await import("fs/promises");
-    await fs14.mkdir(graphDir, { recursive: true });
+    const fs16 = await import("fs/promises");
+    await fs16.mkdir(graphDir, { recursive: true });
     const store = new GraphStore();
     await store.load(graphDir);
     const results = [];
@@ -2674,8 +2960,8 @@ async function handleAskGraph(input) {
 }
 
 // src/mcp/resources/graph.ts
-import * as fs12 from "fs/promises";
-import * as path15 from "path";
+import * as fs14 from "fs/promises";
+import * as path17 from "path";
 var MAX_ITEMS = 5e3;
 function formatStaleness(isoTimestamp) {
   const then = new Date(isoTimestamp).getTime();
@@ -2698,11 +2984,11 @@ async function getGraphResource(projectRoot) {
       message: "No knowledge graph found. Run harness scan to build one."
     });
   }
-  const graphDir = path15.join(projectRoot, ".harness", "graph");
-  const metadataPath = path15.join(graphDir, "metadata.json");
+  const graphDir = path17.join(projectRoot, ".harness", "graph");
+  const metadataPath = path17.join(graphDir, "metadata.json");
   let lastScanTimestamp = null;
   try {
-    const raw = JSON.parse(await fs12.readFile(metadataPath, "utf-8"));
+    const raw = JSON.parse(await fs14.readFile(metadataPath, "utf-8"));
     lastScanTimestamp = raw.lastScanTimestamp ?? null;
   } catch {
   }
@@ -2791,7 +3077,7 @@ var generateAgentDefinitionsDefinition = {
   }
 };
 async function handleGenerateAgentDefinitions(input) {
-  const { generateAgentDefinitions } = await import("./generate-agent-definitions-3PM5EU7V.js");
+  const { generateAgentDefinitions } = await import("./generate-agent-definitions-SAAOAPT4.js");
   const platforms = input.platform === "all" || !input.platform ? ["claude-code", "gemini-cli"] : [input.platform];
   const results = generateAgentDefinitions({
     platforms: [...platforms],
@@ -2802,8 +3088,8 @@ async function handleGenerateAgentDefinitions(input) {
 }
 
 // src/mcp/tools/roadmap.ts
-import * as fs13 from "fs";
-import * as path16 from "path";
+import * as fs15 from "fs";
+import * as path18 from "path";
 var manageRoadmapDefinition = {
   name: "manage_roadmap",
   description: "Manage the project roadmap: show, add, update, remove, sync features, or query by filter. Reads and writes docs/roadmap.md.",
@@ -2858,21 +3144,21 @@ var manageRoadmapDefinition = {
   }
 };
 function roadmapPath(projectRoot) {
-  return path16.join(projectRoot, "docs", "roadmap.md");
+  return path18.join(projectRoot, "docs", "roadmap.md");
 }
 function readRoadmapFile(projectRoot) {
   const filePath = roadmapPath(projectRoot);
   try {
-    return fs13.readFileSync(filePath, "utf-8");
+    return fs15.readFileSync(filePath, "utf-8");
   } catch {
     return null;
   }
 }
 function writeRoadmapFile(projectRoot, content) {
   const filePath = roadmapPath(projectRoot);
-  const dir = path16.dirname(filePath);
-  fs13.mkdirSync(dir, { recursive: true });
-  fs13.writeFileSync(filePath, content, "utf-8");
+  const dir = path18.dirname(filePath);
+  fs15.mkdirSync(dir, { recursive: true });
+  fs15.writeFileSync(filePath, content, "utf-8");
 }
 function roadmapNotFoundError() {
   return {
@@ -3077,18 +3363,7 @@ function handleSync(projectPath, input, deps) {
     return resultToMcpResponse(Ok2({ changes: [], message: "Roadmap is up to date." }));
   }
   if (input.apply) {
-    for (const change of changes) {
-      for (const m of roadmap.milestones) {
-        const feature = m.features.find(
-          (f) => f.name.toLowerCase() === change.feature.toLowerCase()
-        );
-        if (feature) {
-          feature.status = change.to;
-          break;
-        }
-      }
-    }
-    roadmap.frontmatter.lastSynced = (/* @__PURE__ */ new Date()).toISOString();
+    deps.applySyncChanges(roadmap, changes);
     writeRoadmapFile(projectPath, serializeRoadmap(roadmap));
     return resultToMcpResponse(Ok2({ changes, applied: true, roadmap }));
   }
@@ -3096,10 +3371,10 @@ function handleSync(projectPath, input, deps) {
 }
 async function handleManageRoadmap(input) {
   try {
-    const { parseRoadmap, serializeRoadmap, syncRoadmap } = await import("./dist-HWXF2C3R.js");
+    const { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges } = await import("./dist-4LPXJYVZ.js");
     const { Ok: Ok2 } = await import("./dist-USY2C5JL.js");
     const projectPath = sanitizePath(input.path);
-    const deps = { parseRoadmap, serializeRoadmap, syncRoadmap, Ok: Ok2 };
+    const deps = { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges, Ok: Ok2 };
     switch (input.action) {
       case "show":
         return handleShow2(projectPath, input, deps);
@@ -3524,7 +3799,7 @@ async function handleTransition(validInput, projectPath, id) {
   const transition = transitionResult.data;
   const prompt = renderTransition(transition);
   try {
-    const { saveHandoff } = await import("./dist-HWXF2C3R.js");
+    const { saveHandoff } = await import("./dist-4LPXJYVZ.js");
     await saveHandoff(
       projectPath,
       {
@@ -3594,7 +3869,7 @@ async function handleEmitInteraction(input) {
 }
 async function recordInteraction(projectPath, id, type, decision, stream) {
   try {
-    const { loadState, saveState } = await import("./dist-HWXF2C3R.js");
+    const { loadState, saveState } = await import("./dist-4LPXJYVZ.js");
     const stateResult = await loadState(projectPath, stream);
     if (stateResult.ok) {
       const state = stateResult.value;
@@ -3633,10 +3908,14 @@ var gatherContextDefinition = {
         type: "array",
         items: {
           type: "string",
-          enum: ["state", "learnings", "handoff", "graph", "validation", "sessions"]
+          enum: ["state", "learnings", "handoff", "graph", "validation", "sessions", "events"]
         },
         description: "Which constituents to include (default: all)"
       },
+      includeEvents: {
+        type: "boolean",
+        description: "Include recent events timeline. Default: true when session is provided, false otherwise. Can also be controlled via include array."
+      },
       mode: {
         type: "string",
         enum: ["summary", "detailed"],
@@ -3649,6 +3928,11 @@ var gatherContextDefinition = {
       session: {
         type: "string",
         description: "Session slug for session-scoped state. When provided, state/learnings/handoff/failures are read from .harness/sessions/<session>/ instead of .harness/. Omit for global fallback."
+      },
+      depth: {
+        type: "string",
+        enum: ["index", "summary", "full"],
+        description: 'Retrieval depth for learnings. "index" returns one-line summaries, "summary" (default) returns full entries, "full" returns entries with linked context.'
       }
     },
     required: ["path", "intent"]
@@ -3674,18 +3958,19 @@ async function handleGatherContext(input) {
     input.include ?? ["state", "learnings", "handoff", "graph", "validation"]
   );
   const errors = [];
-  const statePromise = includeSet.has("state") ? import("./dist-HWXF2C3R.js").then(
+  const statePromise = includeSet.has("state") ? import("./dist-4LPXJYVZ.js").then(
     (core) => core.loadState(projectPath, void 0, input.session)
   ) : Promise.resolve(null);
-  const learningsPromise = includeSet.has("learnings") ? import("./dist-HWXF2C3R.js").then(
+  const learningsPromise = includeSet.has("learnings") ? import("./dist-4LPXJYVZ.js").then(
     (core) => core.loadBudgetedLearnings(projectPath, {
       intent: input.intent,
       tokenBudget: input.learningsBudget ?? 1e3,
       ...input.skill !== void 0 && { skill: input.skill },
-      ...input.session !== void 0 && { session: input.session }
+      ...input.session !== void 0 && { session: input.session },
+      ...input.depth !== void 0 && { depth: input.depth }
     })
   ) : Promise.resolve(null);
-  const handoffPromise = includeSet.has("handoff") ? import("./dist-HWXF2C3R.js").then(
+  const handoffPromise = includeSet.has("handoff") ? import("./dist-4LPXJYVZ.js").then(
     (core) => core.loadHandoff(projectPath, void 0, input.session)
   ) : Promise.resolve(null);
   const graphPromise = includeSet.has("graph") ? (async () => {
@@ -3729,11 +4014,19 @@ async function handleGatherContext(input) {
       context: contextBlocks
     };
   })() : Promise.resolve(null);
-  const sessionsPromise = includeSet.has("sessions") && input.session ? import("./dist-HWXF2C3R.js").then(
+  const sessionsPromise = includeSet.has("sessions") && input.session ? import("./dist-4LPXJYVZ.js").then(
     (core) => core.readSessionSections(projectPath, input.session)
   ) : Promise.resolve(null);
+  const shouldIncludeEvents = input.includeEvents !== void 0 ? input.includeEvents : includeSet.has("events") || !!input.session && !input.include;
+  const eventsPromise = shouldIncludeEvents ? import("./dist-4LPXJYVZ.js").then(async (core) => {
+    const result = await core.loadEvents(projectPath, {
+      session: input.session
+    });
+    if (!result.ok) return null;
+    return core.formatEventTimeline(result.value);
+  }) : Promise.resolve(null);
   const validationPromise = includeSet.has("validation") ? (async () => {
-    const { handleValidateProject: handleValidateProject2 } = await import("./validate-FD3Z6VJD.js");
+    const { handleValidateProject: handleValidateProject2 } = await import("./validate-VRTUHALQ.js");
     const result = await handleValidateProject2({ path: projectPath });
     const first = result.content[0];
     return first ? JSON.parse(first.text) : null;
@@ -3744,14 +4037,16 @@ async function handleGatherContext(input) {
     handoffResult,
     graphResult,
     validationResult,
-    sessionsResult
+    sessionsResult,
+    eventsResult
   ] = await Promise.allSettled([
     statePromise,
     learningsPromise,
     handoffPromise,
     graphPromise,
     validationPromise,
-    sessionsPromise
+    sessionsPromise,
+    eventsPromise
   ]);
   function extract(settled, name) {
     if (settled.status === "rejected") {
@@ -3766,6 +4061,7 @@ async function handleGatherContext(input) {
   const graphContextRaw = extract(graphResult, "graph");
   const validationRaw = extract(validationResult, "validation");
   const sessionsRaw = extract(sessionsResult, "sessions");
+  const eventsTimeline = extract(eventsResult, "events");
   const state = stateRaw && typeof stateRaw === "object" && "ok" in stateRaw ? stateRaw.ok ? stateRaw.value : (() => {
     errors.push(`state: ${stateRaw.error.message}`);
     return null;
@@ -3813,6 +4109,7 @@ async function handleGatherContext(input) {
     graphContext: outputGraphContext,
     validation: outputValidation,
     sessionSections: sessionSections ?? null,
+    events: eventsTimeline || null,
     meta: {
       assembledIn,
       graphAvailable: graphContext !== null,
@@ -3823,7 +4120,7 @@ async function handleGatherContext(input) {
   };
   if (input.session) {
     try {
-      const core = await import("./dist-HWXF2C3R.js");
+      const core = await import("./dist-4LPXJYVZ.js");
       core.updateSessionIndex(
         projectPath,
         input.session,
@@ -3893,7 +4190,7 @@ async function handleAssessProject(input) {
   let validateResult = null;
   if (checksToRun.has("validate")) {
     try {
-      const { handleValidateProject: handleValidateProject2 } = await import("./validate-FD3Z6VJD.js");
+      const { handleValidateProject: handleValidateProject2 } = await import("./validate-VRTUHALQ.js");
       const result = await handleValidateProject2({ path: projectPath });
       const first = result.content[0];
       const parsed = first ? JSON.parse(first.text) : {};
@@ -3918,7 +4215,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleCheckDependencies: handleCheckDependencies2 } = await import("./architecture-JQZYM4US.js");
+          const { handleCheckDependencies: handleCheckDependencies2 } = await import("./architecture-K5HSRBGB.js");
           const result = await handleCheckDependencies2({ path: projectPath });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -3945,7 +4242,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleCheckDocs: handleCheckDocs2 } = await import("./docs-7ECGYMAV.js");
+          const { handleCheckDocs: handleCheckDocs2 } = await import("./docs-4JRHTLUZ.js");
           const result = await handleCheckDocs2({ path: projectPath, scope: "coverage" });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -3972,7 +4269,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleDetectEntropy: handleDetectEntropy2 } = await import("./entropy-5USWKLVS.js");
+          const { handleDetectEntropy: handleDetectEntropy2 } = await import("./entropy-G6CZ2A6P.js");
           const result = await handleDetectEntropy2({ path: projectPath, type: "all" });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -3999,7 +4296,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleRunSecurityScan: handleRunSecurityScan2 } = await import("./security-PZOX7AQS.js");
+          const { handleRunSecurityScan: handleRunSecurityScan2 } = await import("./security-ZDADTPYW.js");
           const result = await handleRunSecurityScan2({ path: projectPath });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -4031,14 +4328,28 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleCheckPerformance: handleCheckPerformance2 } = await import("./performance-OQAFMJUD.js");
+          const { handleCheckPerformance: handleCheckPerformance2 } = await import("./performance-UBCFI2UP.js");
           const result = await handleCheckPerformance2({ path: projectPath });
+          if ("isError" in result && result.isError) {
+            const msg = result.content[0]?.text ?? "Performance check failed";
+            return { name: "perf", passed: false, issueCount: 1, topIssue: msg };
+          }
           const first = result.content[0];
-          const parsed = first ? JSON.parse(first.text) : {};
+          let parsed = {};
+          try {
+            parsed = first ? JSON.parse(first.text) : {};
+          } catch {
+            return {
+              name: "perf",
+              passed: false,
+              issueCount: 1,
+              topIssue: first?.text ?? "Invalid perf output"
+            };
+          }
           const issues = parsed.violations?.length ?? parsed.issues?.length ?? 0;
           return {
             name: "perf",
-            passed: !("isError" in result && result.isError) && issues === 0,
+            passed: issues === 0,
             issueCount: issues,
             ...issues > 0 ? { topIssue: "Performance issues detected" } : {},
             ...mode === "detailed" ? { detailed: parsed } : {}
@@ -4220,7 +4531,7 @@ async function handleReviewChanges(input) {
   }
 }
 async function runQuickReview(projectPath, diff, diffLines, downgraded) {
-  const { handleAnalyzeDiff: handleAnalyzeDiff2 } = await import("./feedback-UTBXZZHF.js");
+  const { handleAnalyzeDiff: handleAnalyzeDiff2 } = await import("./feedback-QYKQ65HB.js");
   const result = await handleAnalyzeDiff2({ diff, path: projectPath });
   const firstContent = result.content[0];
   if (!firstContent) throw new Error("Empty analyze_diff response");
@@ -4251,7 +4562,7 @@ function extractFileCount(diffParsed) {
   return files?.length ?? 0;
 }
 async function runStandardReview(projectPath, diff, diffLines, downgraded) {
-  const { handleAnalyzeDiff: handleAnalyzeDiff2, handleCreateSelfReview: handleCreateSelfReview2 } = await import("./feedback-UTBXZZHF.js");
+  const { handleAnalyzeDiff: handleAnalyzeDiff2, handleCreateSelfReview: handleCreateSelfReview2 } = await import("./feedback-QYKQ65HB.js");
   const [diffResult, reviewResult] = await Promise.all([
     handleAnalyzeDiff2({ diff, path: projectPath }),
     handleCreateSelfReview2({ path: projectPath, diff })
@@ -4283,7 +4594,7 @@ async function runStandardReview(projectPath, diff, diffLines, downgraded) {
   };
 }
 async function runDeepReview(projectPath, diff, diffLines, _downgraded) {
-  const { handleRunCodeReview: handleRunCodeReview2 } = await import("./review-pipeline-C4GCFVGP.js");
+  const { handleRunCodeReview: handleRunCodeReview2 } = await import("./review-pipeline-IQAVCWAX.js");
   const result = await handleRunCodeReview2({ path: projectPath, diff });
   const deepContent = result.content[0];
   if (!deepContent) throw new Error("Empty code review response");
@@ -4569,7 +4880,7 @@ async function handleDetectStaleConstraints(input) {
         ]
       };
     }
-    const { detectStaleConstraints } = await import("./dist-HWXF2C3R.js");
+    const { detectStaleConstraints } = await import("./dist-4LPXJYVZ.js");
     const result = detectStaleConstraints(
       store,
       windowDays,
@@ -4666,6 +4977,226 @@ async function handleSearchSkills(input) {
   };
 }
 
+// src/mcp/tools/code-nav.ts
+var codeOutlineDefinition = {
+  name: "code_outline",
+  description: "Get a structural skeleton of a file or files matching a glob: exports, classes, functions, types with signatures and line numbers. No implementation bodies. 4-8x token savings vs full file read.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      path: {
+        type: "string",
+        description: "Absolute file path or directory path. When a directory, outlines all supported files within it."
+      },
+      glob: {
+        type: "string",
+        description: 'Optional glob pattern to filter files (e.g. "*.ts", "src/**/*.py"). Only used when path is a directory.'
+      }
+    },
+    required: ["path"]
+  }
+};
+async function handleCodeOutline(input) {
+  let targetPath;
+  try {
+    targetPath = sanitizePath(input.path);
+  } catch (error) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Error: ${error instanceof Error ? error.message : String(error)}`
+        }
+      ],
+      isError: true
+    };
+  }
+  try {
+    const { getOutline, formatOutline, EXTENSION_MAP } = await import("./dist-4LPXJYVZ.js");
+    const { stat } = await import("fs/promises");
+    const stats = await stat(targetPath).catch(() => null);
+    if (stats?.isFile()) {
+      const outline = await getOutline(targetPath);
+      return { content: [{ type: "text", text: formatOutline(outline) }] };
+    }
+    if (stats?.isDirectory()) {
+      const { glob } = await import("glob");
+      const exts = Object.keys(EXTENSION_MAP).map((e) => e.slice(1));
+      const pattern = input.glob ?? `**/*.{${exts.join(",")}}`;
+      const files = await glob(pattern, { cwd: targetPath, absolute: true });
+      const results = [];
+      const MAX_FILES = 50;
+      for (const file of files.slice(0, MAX_FILES)) {
+        const outline = await getOutline(file);
+        results.push(formatOutline(outline));
+      }
+      if (files.length > MAX_FILES) {
+        results.push(
+          `
+... and ${files.length - MAX_FILES} more files (use a narrower glob to see them)`
+        );
+      }
+      return { content: [{ type: "text", text: results.join("\n\n") }] };
+    }
+    return {
+      content: [{ type: "text", text: `Error: Path not found: ${targetPath}` }],
+      isError: true
+    };
+  } catch (error) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Error: ${error instanceof Error ? error.message : String(error)}`
+        }
+      ],
+      isError: true
+    };
+  }
+}
+var codeSearchDefinition = {
+  name: "code_search",
+  description: "Search for symbols (functions, classes, types, variables) by name or pattern across a directory. Returns matching locations with file, line, kind, and one-line context. 6-12x token savings vs grep + read.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      query: {
+        type: "string",
+        description: "Symbol name or substring to search for (case-insensitive)."
+      },
+      directory: {
+        type: "string",
+        description: "Absolute path to directory to search in."
+      },
+      glob: {
+        type: "string",
+        description: 'Optional glob pattern to filter files (e.g. "*.ts").'
+      }
+    },
+    required: ["query", "directory"]
+  }
+};
+async function handleCodeSearch(input) {
+  let directory;
+  try {
+    directory = sanitizePath(input.directory);
+  } catch (error) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Error: ${error instanceof Error ? error.message : String(error)}`
+        }
+      ],
+      isError: true
+    };
+  }
+  try {
+    const { searchSymbols } = await import("./dist-4LPXJYVZ.js");
+    const result = await searchSymbols(input.query, directory, input.glob);
+    const lines = [`Search: "${result.query}" \u2014 ${result.matches.length} matches`];
+    for (const match of result.matches) {
+      const { symbol } = match;
+      lines.push(
+        `  ${symbol.file}:${symbol.line} [${symbol.kind}] ${symbol.name} \u2014 ${match.context}`
+      );
+    }
+    if (result.skipped.length > 0) {
+      lines.push(`
+Skipped ${result.skipped.length} files (unsupported or parse failed)`);
+    }
+    return { content: [{ type: "text", text: lines.join("\n") }] };
+  } catch (error) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Error: ${error instanceof Error ? error.message : String(error)}`
+        }
+      ],
+      isError: true
+    };
+  }
+}
+var codeUnfoldDefinition = {
+  name: "code_unfold",
+  description: "Extract the complete implementation of a specific symbol (function, class, type) or a line range from a file. Uses AST boundaries for precise extraction. 2-4x token savings vs full file read.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      path: {
+        type: "string",
+        description: "Absolute path to the file."
+      },
+      symbol: {
+        type: "string",
+        description: "Name of the symbol to extract (function, class, type, etc.). Mutually exclusive with startLine/endLine."
+      },
+      startLine: {
+        type: "number",
+        description: "Start line number (1-indexed). Used with endLine for range extraction. Mutually exclusive with symbol."
+      },
+      endLine: {
+        type: "number",
+        description: "End line number (1-indexed, inclusive). Used with startLine for range extraction."
+      }
+    },
+    required: ["path"]
+  }
+};
+async function handleCodeUnfold(input) {
+  let filePath;
+  try {
+    filePath = sanitizePath(input.path);
+  } catch (error) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Error: ${error instanceof Error ? error.message : String(error)}`
+        }
+      ],
+      isError: true
+    };
+  }
+  try {
+    if (input.symbol) {
+      const { unfoldSymbol } = await import("./dist-4LPXJYVZ.js");
+      const result = await unfoldSymbol(filePath, input.symbol);
+      const header = result.warning ? `${result.file}:${result.startLine}-${result.endLine} ${result.warning}
+` : `${result.file}:${result.startLine}-${result.endLine}
+`;
+      return { content: [{ type: "text", text: header + result.content }] };
+    }
+    if (input.startLine != null && input.endLine != null) {
+      const { unfoldRange } = await import("./dist-4LPXJYVZ.js");
+      const result = await unfoldRange(filePath, input.startLine, input.endLine);
+      const header = `${result.file}:${result.startLine}-${result.endLine}
+`;
+      return { content: [{ type: "text", text: header + result.content }] };
+    }
+    return {
+      content: [
+        {
+          type: "text",
+          text: 'Error: Provide either "symbol" or "startLine" + "endLine".'
+        }
+      ],
+      isError: true
+    };
+  } catch (error) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Error: ${error instanceof Error ? error.message : String(error)}`
+        }
+      ],
+      isError: true
+    };
+  }
+}
+
 // src/mcp/server.ts
 var TOOL_DEFINITIONS = [
   validateToolDefinition,
@@ -4713,7 +5244,10 @@ var TOOL_DEFINITIONS = [
   checkTaskIndependenceDefinition,
   predictConflictsDefinition,
   detectStaleConstraintsDefinition,
-  searchSkillsDefinition
+  searchSkillsDefinition,
+  codeOutlineDefinition,
+  codeSearchDefinition,
+  codeUnfoldDefinition
 ];
 var TOOL_HANDLERS = {
   validate_project: handleValidateProject,
@@ -4761,7 +5295,10 @@ var TOOL_HANDLERS = {
   check_task_independence: handleCheckTaskIndependence,
   predict_conflicts: handlePredictConflicts,
   detect_stale_constraints: handleDetectStaleConstraints,
-  search_skills: handleSearchSkills
+  search_skills: handleSearchSkills,
+  code_outline: handleCodeOutline,
+  code_search: handleCodeSearch,
+  code_unfold: handleCodeUnfold
 };
 var RESOURCE_DEFINITIONS = [
   {
@@ -4847,7 +5384,7 @@ async function appendUpdateNotification(result, resolvedRoot) {
       shouldRunCheck,
       readCheckState,
       spawnBackgroundCheck
-    } = await import("./dist-HWXF2C3R.js");
+    } = await import("./dist-4LPXJYVZ.js");
     const { CLI_VERSION } = await import("./version-KFFPOQAX.js");
     const configInterval = readConfigInterval(resolvedRoot);
     const DEFAULT_INTERVAL = 864e5;
@@ -4865,19 +5402,24 @@ ${notification}` });
   } catch {
   }
 }
-function createHarnessServer(projectRoot) {
+function createHarnessServer(projectRoot, toolFilter) {
   const resolvedRoot = projectRoot ?? process.cwd();
   let sessionChecked = false;
+  const filteredDefinitions = toolFilter ? TOOL_DEFINITIONS.filter((t) => toolFilter.includes(t.name)) : TOOL_DEFINITIONS;
+  const filteredHandlers = toolFilter ? Object.fromEntries(
+    Object.entries(TOOL_HANDLERS).filter(([name]) => toolFilter.includes(name))
+  ) : TOOL_HANDLERS;
   const server = new Server(
     { name: "harness-engineering", version: "0.1.0" },
     { capabilities: { tools: {}, resources: {} } }
   );
   server.setRequestHandler(ListToolsRequestSchema, async () => ({
-    tools: TOOL_DEFINITIONS
+    tools: filteredDefinitions
   }));
+  const guardedHandlers = applyInjectionGuard(filteredHandlers, { projectRoot: resolvedRoot });
   server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
-    const handler = TOOL_HANDLERS[name];
+    const handler = guardedHandlers[name];
     if (!handler) {
       return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
     }
@@ -4906,8 +5448,8 @@ function createHarnessServer(projectRoot) {
   });
   return server;
 }
-async function startServer() {
-  const server = createHarnessServer();
+async function startServer(toolFilter) {
+  const server = createHarnessServer(void 0, toolFilter);
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }