@harness-engineering/cli 1.15.0 → 1.16.0

package/dist/agents/skills/gemini-cli/harness-supply-chain-audit/skill.yaml

@@ -0,0 +1,51 @@
+name: harness-supply-chain-audit
+version: "1.0.0"
+description: 6-factor dependency risk evaluation for supply chain security
+cognitive_mode: meticulous-implementer
+triggers:
+  - manual
+  - on_milestone
+platforms:
+  - claude-code
+  - gemini-cli
+tools:
+  - Bash
+  - Read
+  - Write
+  - Grep
+  - Glob
+  - WebFetch
+cli:
+  command: harness skill run harness-supply-chain-audit
+  args:
+    - name: path
+      description: Project root path
+      required: false
+    - name: depth
+      description: Maximum dependency depth to evaluate (default 3)
+      required: false
+    - name: output
+      description: Write report to file instead of stdout
+      required: false
+mcp:
+  tool: run_skill
+  input:
+    skill: harness-supply-chain-audit
+    path: string
+type: rigid
+tier: 2
+phases:
+  - name: inventory
+    description: Build dependency inventory from lockfile
+    required: true
+  - name: evaluate
+    description: Score each dependency on 6 risk factors
+    required: true
+  - name: report
+    description: Generate risk report with actionable findings
+    required: true
+state:
+  persistent: false
+  files: []
+depends_on:
+  - harness-security-scan

package/dist/agents/skills/templates/discipline-template.md

@@ -0,0 +1,49 @@
+## Evidence Requirements
+
+When this skill makes claims about existing code, architecture, or behavior,
+it MUST cite evidence using one of:
+
+1. **File reference:** `file:line` format (e.g., `src/auth.ts:42`)
+2. **Code pattern reference:** `file` with description (e.g., `src/utils/hash.ts` —
+   "existing bcrypt wrapper")
+3. **Test/command output:** Inline or referenced output from a test run or CLI command
+4. **Session evidence:** Write to the `evidence` session section via `manage_state`
+
+**Uncited claims:** Technical assertions without citations MUST be prefixed with
+`[UNVERIFIED]`. Example: `[UNVERIFIED] The auth middleware supports refresh tokens`.
+
+## Red Flags
+
+### Universal
+
+These apply to ALL skills. If you catch yourself doing any of these, STOP.
+
+- **"I believe the codebase does X"** — Stop. Read the code and cite a file:line
+  reference. Belief is not evidence.
+- **"Let me recommend [pattern] for this"** without checking existing patterns — Stop.
+  Search the codebase first. The project may already have a convention.
+- **"While we're here, we should also [unrelated improvement]"** — Stop. Flag the idea
+  but do not expand scope beyond the stated task.
+
+### Domain-Specific
+
+<!-- Add 3-5 red flags specific to this skill's domain.
+     Each MUST contain a quoted phrase the agent would say.
+     Format: **"<quoted phrase>"** — <why it's dangerous and what to do instead> -->
+
+## Rationalizations to Reject
+
+### Universal
+
+These reasoning patterns sound plausible but lead to bad outcomes. Reject them.
+
+- **"It's probably fine"** — "Probably" is not evidence. Verify before asserting.
+- **"This is best practice"** — Best practice in what context? Cite the source and
+  confirm it applies to this codebase.
+- **"We can fix it later"** — If it is worth flagging, it is worth documenting now
+  with a concrete follow-up plan.
+
+### Domain-Specific
+
+<!-- Add 3-5 rationalizations specific to this skill's domain.
+     Format: **"<rationalization>"** — <why it's wrong and what to do instead> -->

package/dist/agents/skills/tests/schema.ts

@@ -43,7 +43,7 @@ const ALLOWED_TRIGGERS = [
   'on_task_complete',
 ] as const;
 
-const ALLOWED_PLATFORMS = ['claude-code', 'gemini-cli'] as const;
+const ALLOWED_PLATFORMS = ['claude-code', 'gemini-cli', 'codex', 'cursor'] as const;
 
 export const SkillMetadataSchema = z.object({
   name: z.string().regex(/^[a-z][a-z0-9-]*$/, 'Name must be lowercase with hyphens'),

package/dist/{agents-md-ZGNIDWAF.js → agents-md-VYDFPIRW.js}

@@ -1,7 +1,7 @@
 import {
   generateAgentsMd
 } from "./chunk-OD3S2NHN.js";
-import "./chunk-Z2OOPXJO.js";
+import "./chunk-ALFKNAZW.js";
 import "./chunk-ERS5EVUZ.js";
 export {
   generateAgentsMd

package/dist/{architecture-ZLIH5533.js → architecture-K5HSRBGB.js}

@@ -1,11 +1,11 @@
 import {
   checkDependenciesDefinition,
   handleCheckDependencies
-} from "./chunk-N25INEIX.js";
+} from "./chunk-SFRGPAK6.js";
 import "./chunk-H7Y5CKTM.js";
 import "./chunk-IDZNPTYD.js";
 import "./chunk-W6Y7ZW3Y.js";
-import "./chunk-Z2OOPXJO.js";
+import "./chunk-ALFKNAZW.js";
 import "./chunk-ERS5EVUZ.js";
 export {
   checkDependenciesDefinition,

package/dist/bin/harness-mcp.js

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import {
   startServer
-} from "../chunk-NNHDDXYT.js";
-import "../chunk-VEPAJXBW.js";
-import "../chunk-EDXIVMAP.js";
-import "../chunk-YLXFKVJE.js";
-import "../chunk-3ZZKVN62.js";
-import "../chunk-ND2ENWDM.js";
-import "../chunk-ZOAWBDWU.js";
-import "../chunk-OFXQSFOW.js";
+} from "../chunk-JOP2NDNB.js";
+import "../chunk-AV6KMDO5.js";
+import "../chunk-DNDBFIZN.js";
+import "../chunk-RWZPHW4H.js";
+import "../chunk-QDF7COPQ.js";
+import "../chunk-ZJMU7MEV.js";
+import "../chunk-CJDVBBPB.js";
+import "../chunk-TF6ZLHJV.js";
 import "../chunk-FTMXDOR6.js";
-import "../chunk-N25INEIX.js";
+import "../chunk-SFRGPAK6.js";
 import "../chunk-H7Y5CKTM.js";
-import "../chunk-2BKLWLY6.js";
-import "../chunk-B2HKP423.js";
+import "../chunk-C7DTKLPW.js";
+import "../chunk-OCDDCGDE.js";
 import "../chunk-IDZNPTYD.js";
 import "../chunk-W6Y7ZW3Y.js";
 import "../chunk-N5G5QMS3.js";
 import "../chunk-3WGJMBKH.js";
-import "../chunk-XYLGHKG6.js";
-import "../chunk-Z2OOPXJO.js";
+import "../chunk-HKUX2X7O.js";
+import "../chunk-ALFKNAZW.js";
 import "../chunk-ERS5EVUZ.js";
 
 // src/bin/harness-mcp.ts

package/dist/bin/harness.js

@@ -2,43 +2,43 @@
 import {
   createProgram,
   printFirstRunWelcome
-} from "../chunk-J4RAX7YB.js";
+} from "../chunk-SHYWICGA.js";
 import "../chunk-SD3SQOZ2.js";
-import "../chunk-LGYBN7Y6.js";
-import "../chunk-RCWZBSK5.js";
+import "../chunk-5ZXHMCPL.js";
+import "../chunk-6KWBH4EO.js";
 import "../chunk-YQ6KC6TE.js";
 import "../chunk-TRAPF4IX.js";
-import "../chunk-AOZRDOIP.js";
+import "../chunk-M6TIO6NF.js";
 import "../chunk-TEFCFC4H.js";
-import "../chunk-YBJ262QL.js";
+import "../chunk-LRG3B43J.js";
 import "../chunk-EBJQ6N4M.js";
 import "../chunk-DBSOCI3G.js";
 import "../chunk-FIAPHX37.js";
 import "../chunk-KET4QQZB.js";
 import "../chunk-OD3S2NHN.js";
-import "../chunk-NNHDDXYT.js";
-import "../chunk-VEPAJXBW.js";
-import "../chunk-EDXIVMAP.js";
-import "../chunk-YLXFKVJE.js";
-import "../chunk-3ZZKVN62.js";
-import "../chunk-ND2ENWDM.js";
-import "../chunk-ZOAWBDWU.js";
-import "../chunk-OFXQSFOW.js";
+import "../chunk-JOP2NDNB.js";
+import "../chunk-AV6KMDO5.js";
+import "../chunk-DNDBFIZN.js";
+import "../chunk-RWZPHW4H.js";
+import "../chunk-QDF7COPQ.js";
+import "../chunk-ZJMU7MEV.js";
+import "../chunk-CJDVBBPB.js";
+import "../chunk-TF6ZLHJV.js";
 import "../chunk-FTMXDOR6.js";
-import "../chunk-N25INEIX.js";
+import "../chunk-SFRGPAK6.js";
 import "../chunk-H7Y5CKTM.js";
-import "../chunk-2BKLWLY6.js";
+import "../chunk-C7DTKLPW.js";
 import {
   findConfigFile,
   loadConfig
-} from "../chunk-B2HKP423.js";
+} from "../chunk-OCDDCGDE.js";
 import "../chunk-IDZNPTYD.js";
 import "../chunk-W6Y7ZW3Y.js";
 import "../chunk-N5G5QMS3.js";
 import {
   handleError
 } from "../chunk-3WGJMBKH.js";
-import "../chunk-XYLGHKG6.js";
+import "../chunk-HKUX2X7O.js";
 import {
   CLI_VERSION
 } from "../chunk-BM3PWGXQ.js";
@@ -50,7 +50,7 @@ import {
   readCheckState,
   shouldRunCheck,
   spawnBackgroundCheck
-} from "../chunk-Z2OOPXJO.js";
+} from "../chunk-ALFKNAZW.js";
 import "../chunk-ERS5EVUZ.js";
 
 // src/bin/update-check-hooks.ts

package/dist/{check-phase-gate-ZOXVBDCN.js → check-phase-gate-5AS6SXL6.js}

@@ -1,11 +1,11 @@
 import {
   createCheckPhaseGateCommand,
   runCheckPhaseGate
-} from "./chunk-LGYBN7Y6.js";
+} from "./chunk-5ZXHMCPL.js";
 import "./chunk-EBJQ6N4M.js";
-import "./chunk-B2HKP423.js";
+import "./chunk-OCDDCGDE.js";
 import "./chunk-3WGJMBKH.js";
-import "./chunk-Z2OOPXJO.js";
+import "./chunk-ALFKNAZW.js";
 import "./chunk-ERS5EVUZ.js";
 export {
   createCheckPhaseGateCommand,

package/dist/{chunk-LGYBN7Y6.js → chunk-5ZXHMCPL.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-EBJQ6N4M.js";
 import {
   resolveConfig
-} from "./chunk-B2HKP423.js";
+} from "./chunk-OCDDCGDE.js";
 import {
   ExitCode
 } from "./chunk-3WGJMBKH.js";

package/dist/{chunk-RCWZBSK5.js → chunk-6KWBH4EO.js}

@@ -10,7 +10,7 @@ import {
   VALID_PLATFORMS,
   applySyncPlan,
   computeSyncPlan
-} from "./chunk-ZOAWBDWU.js";
+} from "./chunk-CJDVBBPB.js";
 import {
   resolvePersonasDir,
   resolveSkillsDir