@harness-engineering/cli 1.15.0 → 1.16.0

package/dist/{chunk-NNHDDXYT.js → chunk-JOP2NDNB.js}

@@ -1,7 +1,7 @@
 import {
   detectEntropyDefinition,
   handleDetectEntropy
-} from "./chunk-VEPAJXBW.js";
+} from "./chunk-AV6KMDO5.js";
 import {
   checkPerformanceDefinition,
   getCriticalPathsDefinition,
@@ -11,7 +11,7 @@ import {
   handleGetPerfBaselines,
   handleUpdatePerfBaselines,
   updatePerfBaselinesDefinition
-} from "./chunk-EDXIVMAP.js";
+} from "./chunk-DNDBFIZN.js";
 import {
   analyzeDiffDefinition,
   createSelfReviewDefinition,
@@ -19,43 +19,45 @@ import {
   handleCreateSelfReview,
   handleRequestPeerReview,
   requestPeerReviewDefinition
-} from "./chunk-YLXFKVJE.js";
+} from "./chunk-RWZPHW4H.js";
 import {
   handleRunSecurityScan,
   runSecurityScanDefinition
-} from "./chunk-3ZZKVN62.js";
+} from "./chunk-QDF7COPQ.js";
 import {
   handleRunCodeReview,
   runCodeReviewDefinition
-} from "./chunk-ND2ENWDM.js";
+} from "./chunk-ZJMU7MEV.js";
 import {
   GENERATED_HEADER_CLAUDE,
+  GENERATED_HEADER_CODEX,
+  GENERATED_HEADER_CURSOR,
   GENERATED_HEADER_GEMINI,
   VALID_PLATFORMS,
   applySyncPlan,
   computeSyncPlan
-} from "./chunk-ZOAWBDWU.js";
+} from "./chunk-CJDVBBPB.js";
 import {
   handleValidateProject,
   validateToolDefinition
-} from "./chunk-OFXQSFOW.js";
+} from "./chunk-TF6ZLHJV.js";
 import {
   loadGraphStore
 } from "./chunk-FTMXDOR6.js";
 import {
   checkDependenciesDefinition,
   handleCheckDependencies
-} from "./chunk-N25INEIX.js";
+} from "./chunk-SFRGPAK6.js";
 import {
   resolveProjectConfig
 } from "./chunk-H7Y5CKTM.js";
 import {
   checkDocsDefinition,
   handleCheckDocs
-} from "./chunk-2BKLWLY6.js";
+} from "./chunk-C7DTKLPW.js";
 import {
   resolveConfig
-} from "./chunk-B2HKP423.js";
+} from "./chunk-OCDDCGDE.js";
 import {
   resultToMcpResponse
 } from "./chunk-IDZNPTYD.js";
@@ -78,7 +80,13 @@ import {
 } from "./chunk-3WGJMBKH.js";
 import {
   SkillMetadataSchema
-} from "./chunk-XYLGHKG6.js";
+} from "./chunk-HKUX2X7O.js";
+import {
+  DESTRUCTIVE_BASH,
+  checkTaint,
+  scanForInjection,
+  writeTaint
+} from "./chunk-ALFKNAZW.js";
 import {
   Err,
   Ok
@@ -94,6 +102,123 @@ import {
   ReadResourceRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
 
+// src/mcp/middleware/injection-guard.ts
+import { realpathSync } from "fs";
+import { resolve } from "path";
+function isDestructiveBash(command) {
+  return DESTRUCTIVE_BASH.some((p) => p.test(command));
+}
+function isOutsideWorkspace(filePath, workspaceRoot) {
+  if (!filePath || !workspaceRoot) return false;
+  const resolved = resolve(workspaceRoot, filePath);
+  let realResolved = resolved;
+  try {
+    realResolved = realpathSync(resolved);
+  } catch {
+  }
+  return !realResolved.startsWith(workspaceRoot);
+}
+var INPUT_EXTRACTORS = {
+  Bash: (input) => input?.command ?? "",
+  Write: (input) => input?.content ?? "",
+  Edit: (input) => `${input?.old_string ?? ""}
+${input?.new_string ?? ""}`,
+  Read: (input) => input?.file_path ?? ""
+};
+function extractInputText(toolName, toolInput) {
+  const extractor = INPUT_EXTRACTORS[toolName];
+  if (extractor) return extractor(toolInput);
+  const parts = Object.values(toolInput || {}).filter((v) => typeof v === "string");
+  return parts.length > 0 ? parts.join("\n") : null;
+}
+function extractResultText(result) {
+  return result.content.filter((c) => c.type === "text").map((c) => c.text).join("\n");
+}
+function isDestructiveOperation(toolName, toolInput, workspaceRoot) {
+  const normalized = toolName.toLowerCase().replace(/_/g, "");
+  if (normalized === "bash") {
+    const command = toolInput?.command ?? "";
+    return isDestructiveBash(command);
+  }
+  if (normalized === "write" || normalized === "edit") {
+    const filePath = toolInput?.file_path ?? "";
+    return isOutsideWorkspace(filePath, workspaceRoot);
+  }
+  return false;
+}
+function wrapWithInjectionGuard(toolName, handler, options = {}) {
+  const projectRoot = options.projectRoot ?? process.cwd();
+  const sessionId = options.sessionId ?? "default";
+  return async (input) => {
+    try {
+      const taintCheck = checkTaint(projectRoot, sessionId);
+      if (taintCheck.tainted && isDestructiveOperation(toolName, input, projectRoot)) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `BLOCKED by Sentinel: "${toolName}" blocked during tainted session. Destructive operations are restricted. Run "harness taint clear" to lift.`
+            }
+          ],
+          isError: true
+        };
+      }
+      const textToScan = extractInputText(toolName, input);
+      if (textToScan) {
+        const findings = scanForInjection(textToScan);
+        const actionable = findings.filter(
+          (f) => f.severity === "high" || f.severity === "medium"
+        );
+        if (actionable.length > 0) {
+          writeTaint(
+            projectRoot,
+            sessionId,
+            `Injection pattern detected in MCP:${toolName} input`,
+            actionable,
+            `MCP:${toolName}`
+          );
+        }
+      }
+      const result = await handler(input);
+      const outputText = extractResultText(result);
+      if (outputText) {
+        const outputFindings = scanForInjection(outputText);
+        const actionableOutput = outputFindings.filter(
+          (f) => f.severity === "high" || f.severity === "medium"
+        );
+        if (actionableOutput.length > 0) {
+          writeTaint(
+            projectRoot,
+            sessionId,
+            `Injection pattern detected in MCP:${toolName} result`,
+            actionableOutput,
+            `MCP:${toolName}:output`
+          );
+          const warningLines = actionableOutput.map(
+            (f) => `Sentinel [${f.severity}] ${f.ruleId}: detected in ${toolName} output`
+          );
+          result.content.push({
+            type: "text",
+            text: `
+---
+Sentinel Warning: ${warningLines.join("; ")}`
+          });
+        }
+      }
+      return result;
+    } catch {
+      return handler(input);
+    }
+  };
+}
+function applyInjectionGuard(handlers, options = {}) {
+  const wrapped = {};
+  for (const [name, handler] of Object.entries(handlers)) {
+    wrapped[name] = wrapWithInjectionGuard(name, handler, options);
+  }
+  return wrapped;
+}
+
 // src/mcp/tools/linter.ts
 var generateLinterDefinition = {
   name: "generate_linter",
@@ -428,7 +553,7 @@ ${skippedMsg}`
 async function handleInitProject(input) {
   const i = input;
   try {
-    const { TemplateEngine } = await import("./engine-3RB7MXPP.js");
+    const { TemplateEngine } = await import("./engine-3G3VIM6L.js");
     const engine = new TemplateEngine(resolveTemplatesDir());
     const safePath = sanitizePath(i.path);
     const detected = tryDetectFramework(engine, safePath, i);
@@ -449,7 +574,7 @@ var listPersonasDefinition = {
   inputSchema: { type: "object", properties: {} }
 };
 async function handleListPersonas() {
-  const { listPersonas } = await import("./loader-UUTVMQCC.js");
+  const { listPersonas } = await import("./loader-VCOK3PF7.js");
   const result = listPersonas(resolvePersonasDir());
   return resultToMcpResponse(result);
 }
@@ -473,10 +598,10 @@ async function handleGeneratePersonaArtifacts(input) {
   if (!/^[a-z0-9][a-z0-9._-]*$/i.test(input.name)) {
     return resultToMcpResponse(Err(new Error(`Invalid persona name: ${input.name}`)));
   }
-  const { loadPersona } = await import("./loader-UUTVMQCC.js");
-  const { generateRuntime } = await import("./runtime-BCK5RRZQ.js");
-  const { generateAgentsMd } = await import("./agents-md-ZGNIDWAF.js");
-  const { generateCIWorkflow } = await import("./ci-workflow-765LSHRD.js");
+  const { loadPersona } = await import("./loader-VCOK3PF7.js");
+  const { generateRuntime } = await import("./runtime-PYFFIESU.js");
+  const { generateAgentsMd } = await import("./agents-md-VYDFPIRW.js");
+  const { generateCIWorkflow } = await import("./ci-workflow-CRWU723U.js");
   const personasDir = resolvePersonasDir();
   const filePath = path3.join(personasDir, `${input.name}.yaml`);
   if (!filePath.startsWith(personasDir)) {
@@ -531,9 +656,9 @@ async function handleRunPersona(input) {
   if (!/^[a-z0-9][a-z0-9._-]*$/i.test(input.persona)) {
     return resultToMcpResponse(Err(new Error(`Invalid persona name: ${input.persona}`)));
   }
-  const { loadPersona } = await import("./loader-UUTVMQCC.js");
+  const { loadPersona } = await import("./loader-VCOK3PF7.js");
   const { runPersona } = await import("./runner-VMYLHWOC.js");
-  const { executeSkill } = await import("./skill-executor-XZLYZYAK.js");
+  const { executeSkill } = await import("./skill-executor-XEVDGXUM.js");
   const personasDir = resolvePersonasDir();
   const filePath = path3.join(personasDir, `${input.persona}.yaml`);
   if (!filePath.startsWith(personasDir)) {
@@ -944,8 +1069,8 @@ var runSkillDefinition = {
       path: { type: "string", description: "Path to project root for state context injection" },
       complexity: {
         type: "string",
-        enum: ["auto", "light", "full"],
-        description: "Complexity level for scale-adaptive rigor"
+        enum: ["fast", "standard", "thorough"],
+        description: "Rigor level: fast (minimal), standard (default), thorough (full)"
       },
       phase: { type: "string", description: "Start at a specific phase (re-entry)" },
       party: { type: "boolean", description: "Enable multi-perspective evaluation" }
@@ -1031,7 +1156,7 @@ var createSkillDefinition = {
 };
 async function handleCreateSkill(input) {
   try {
-    const { generateSkillFiles } = await import("./create-skill-XSWHMSM5.js");
+    const { generateSkillFiles } = await import("./create-skill-NDXQSTIK.js");
     const result = generateSkillFiles({
       name: input.name,
       description: input.description,
@@ -1149,7 +1274,7 @@ async function autoSyncRoadmap(projectPath) {
   try {
     const roadmapFile = path11.join(projectPath, "docs", "roadmap.md");
     if (!fs10.existsSync(roadmapFile)) return;
-    const { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges } = await import("./dist-ALQDD67R.js");
+    const { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges } = await import("./dist-4LPXJYVZ.js");
     const raw = fs10.readFileSync(roadmapFile, "utf-8");
     const parseResult = parseRoadmap(raw);
     if (!parseResult.ok) return;
@@ -1235,12 +1360,12 @@ var manageStateDefinition = {
   }
 };
 async function handleShow(projectPath, input) {
-  const { loadState } = await import("./dist-ALQDD67R.js");
+  const { loadState } = await import("./dist-4LPXJYVZ.js");
   return resultToMcpResponse(await loadState(projectPath, input.stream, input.session));
 }
 async function handleLearn(projectPath, input) {
   if (!input.learning) return mcpError("Error: learning is required for learn action");
-  const { appendLearning } = await import("./dist-ALQDD67R.js");
+  const { appendLearning } = await import("./dist-4LPXJYVZ.js");
   const result = await appendLearning(
     projectPath,
     input.learning,
@@ -1255,7 +1380,7 @@ async function handleLearn(projectPath, input) {
 async function handleFailure(projectPath, input) {
   if (!input.description) return mcpError("Error: description is required for failure action");
   if (!input.failureType) return mcpError("Error: failureType is required for failure action");
-  const { appendFailure } = await import("./dist-ALQDD67R.js");
+  const { appendFailure } = await import("./dist-4LPXJYVZ.js");
   const result = await appendFailure(
     projectPath,
     input.description,
@@ -1268,24 +1393,24 @@ async function handleFailure(projectPath, input) {
   return resultToMcpResponse(Ok({ recorded: true }));
 }
 async function handleArchive(projectPath, input) {
-  const { archiveFailures } = await import("./dist-ALQDD67R.js");
+  const { archiveFailures } = await import("./dist-4LPXJYVZ.js");
   const result = await archiveFailures(projectPath, input.stream, input.session);
   if (!result.ok) return resultToMcpResponse(result);
   return resultToMcpResponse(Ok({ archived: true }));
 }
 async function handleReset(projectPath, input) {
-  const { saveState, DEFAULT_STATE } = await import("./dist-ALQDD67R.js");
+  const { saveState, DEFAULT_STATE } = await import("./dist-4LPXJYVZ.js");
   const result = await saveState(projectPath, { ...DEFAULT_STATE }, input.stream, input.session);
   if (!result.ok) return resultToMcpResponse(result);
   return resultToMcpResponse(Ok({ reset: true }));
 }
 async function handleGate(projectPath, _input) {
-  const { runMechanicalGate } = await import("./dist-ALQDD67R.js");
+  const { runMechanicalGate } = await import("./dist-4LPXJYVZ.js");
   return resultToMcpResponse(await runMechanicalGate(projectPath));
 }
 async function handleSaveHandoff(projectPath, input) {
   if (!input.handoff) return mcpError("Error: handoff is required for save-handoff action");
-  const { saveHandoff } = await import("./dist-ALQDD67R.js");
+  const { saveHandoff } = await import("./dist-4LPXJYVZ.js");
   const result = await saveHandoff(
     projectPath,
     input.handoff,
@@ -1297,7 +1422,7 @@ async function handleSaveHandoff(projectPath, input) {
   return resultToMcpResponse(Ok({ saved: true }));
 }
 async function handleLoadHandoff(projectPath, input) {
-  const { loadHandoff } = await import("./dist-ALQDD67R.js");
+  const { loadHandoff } = await import("./dist-4LPXJYVZ.js");
   return resultToMcpResponse(await loadHandoff(projectPath, input.stream, input.session));
 }
 async function handleAppendEntry(projectPath, input) {
@@ -1305,7 +1430,7 @@ async function handleAppendEntry(projectPath, input) {
   if (!input.section) return mcpError("Error: section is required for append_entry action");
   if (!input.authorSkill) return mcpError("Error: authorSkill is required for append_entry action");
   if (!input.content) return mcpError("Error: content is required for append_entry action");
-  const { appendSessionEntry } = await import("./dist-ALQDD67R.js");
+  const { appendSessionEntry } = await import("./dist-4LPXJYVZ.js");
   const result = await appendSessionEntry(
     projectPath,
     input.session,
@@ -1321,7 +1446,7 @@ async function handleUpdateEntryStatus(projectPath, input) {
   if (!input.entryId) return mcpError("Error: entryId is required for update_entry_status action");
   if (!input.newStatus)
     return mcpError("Error: newStatus is required for update_entry_status action");
-  const { updateSessionEntryStatus } = await import("./dist-ALQDD67R.js");
+  const { updateSessionEntryStatus } = await import("./dist-4LPXJYVZ.js");
   const result = await updateSessionEntryStatus(
     projectPath,
     input.session,
@@ -1334,7 +1459,7 @@ async function handleUpdateEntryStatus(projectPath, input) {
 async function handleReadSection(projectPath, input) {
   if (!input.session) return mcpError("Error: session is required for read_section action");
   if (!input.section) return mcpError("Error: section is required for read_section action");
-  const { readSessionSection } = await import("./dist-ALQDD67R.js");
+  const { readSessionSection } = await import("./dist-4LPXJYVZ.js");
   const result = await readSessionSection(
     projectPath,
     input.session,
@@ -1344,13 +1469,13 @@ async function handleReadSection(projectPath, input) {
 }
 async function handleReadSections(projectPath, input) {
   if (!input.session) return mcpError("Error: session is required for read_sections action");
-  const { readSessionSections } = await import("./dist-ALQDD67R.js");
+  const { readSessionSections } = await import("./dist-4LPXJYVZ.js");
   const result = await readSessionSections(projectPath, input.session);
   return resultToMcpResponse(result);
 }
 async function handleArchiveSession(projectPath, input) {
   if (!input.session) return mcpError("Error: session is required for archive_session action");
-  const { archiveSession } = await import("./dist-ALQDD67R.js");
+  const { archiveSession } = await import("./dist-4LPXJYVZ.js");
   const result = await archiveSession(projectPath, input.session);
   if (!result.ok) return resultToMcpResponse(result);
   await autoSyncRoadmap(projectPath);
@@ -1394,7 +1519,7 @@ var listStreamsDefinition = {
 };
 async function handleListStreams(input) {
   try {
-    const { listStreams, loadStreamIndex } = await import("./dist-ALQDD67R.js");
+    const { listStreams, loadStreamIndex } = await import("./dist-4LPXJYVZ.js");
     const projectPath = sanitizePath(input.path);
     const indexResult = await loadStreamIndex(projectPath);
     const streamsResult = await listStreams(projectPath);
@@ -1432,7 +1557,7 @@ var checkPhaseGateDefinition = {
 };
 async function handleCheckPhaseGate(input) {
   try {
-    const { runCheckPhaseGate } = await import("./check-phase-gate-ZOXVBDCN.js");
+    const { runCheckPhaseGate } = await import("./check-phase-gate-5AS6SXL6.js");
     const result = await runCheckPhaseGate({ cwd: sanitizePath(input.path) });
     if (result.ok) {
       return { content: [{ type: "text", text: JSON.stringify(result.value) }] };
@@ -1488,7 +1613,7 @@ async function handleValidateCrossCheck(input) {
     };
   }
   try {
-    const { runCrossCheck } = await import("./validate-cross-check-OABMREW4.js");
+    const { runCrossCheck } = await import("./validate-cross-check-4Y6NHNK3.js");
     const specsDir = path12.resolve(projectPath, input.specsDir ?? "docs/specs");
     if (!specsDir.startsWith(projectPath)) {
       return {
@@ -1527,8 +1652,8 @@ async function handleValidateCrossCheck(input) {
 
 // src/commands/generate-slash-commands.ts
 import { Command } from "commander";
-import fs12 from "fs";
-import path14 from "path";
+import fs13 from "fs";
+import path15 from "path";
 import os from "os";
 import readline from "readline";
 
@@ -1560,8 +1685,12 @@ function readSkillYaml(yamlPath) {
   }
   return SkillMetadataSchema.safeParse(parse3(raw));
 }
+var DERIVED_FROM_CLAUDE_CODE = ["cursor", "codex"];
 function shouldSkipSkill(meta, platforms) {
-  const matchesPlatform = platforms.some((p) => meta.platforms.includes(p));
+  const effectivePlatforms = platforms.map(
+    (p) => DERIVED_FROM_CLAUDE_CODE.includes(p) ? "claude-code" : p
+  );
+  const matchesPlatform = effectivePlatforms.some((p) => meta.platforms.includes(p));
   if (!matchesPlatform) return true;
   if (meta.tier === 3 || meta.internal) return true;
   return false;
@@ -1642,6 +1771,7 @@ function buildSpec(meta, normalized, entry, skillsDir, source) {
     sourceDir: entry.name,
     skillsBaseDir: skillsDir,
     source,
+    ...meta.cursor ? { cursor: meta.cursor } : {},
     prompt: {
       context: buildContextLines(meta).join("\n"),
       objective: buildObjectiveLines(meta).join("\n"),
@@ -1766,27 +1896,140 @@ function renderGemini(spec, skillMdContent, skillYamlContent) {
   return lines.join("\n");
 }
 
+// src/slash-commands/render-cursor.ts
+function renderCursor(spec, skillMdContent, cursorConfig) {
+  const lines = ["---"];
+  lines.push(`description: ${spec.description}`);
+  if (cursorConfig?.globs && cursorConfig.globs.length > 0) {
+    lines.push("globs:");
+    for (const glob of cursorConfig.globs) {
+      lines.push(`  - ${glob}`);
+    }
+  }
+  const alwaysApply = cursorConfig?.alwaysApply ?? false;
+  lines.push(`alwaysApply: ${alwaysApply}`);
+  lines.push("---");
+  lines.push("");
+  lines.push(GENERATED_HEADER_CURSOR);
+  lines.push("");
+  lines.push(skillMdContent);
+  lines.push("");
+  return lines.join("\n");
+}
+
+// src/slash-commands/render-codex.ts
+function renderCodexSkill(skillMdContent) {
+  return `<!-- ${GENERATED_HEADER_CODEX.replace(/<!--\s*|\s*-->/g, "").trim()} -->
+
+${skillMdContent}
+`;
+}
+function renderCodexOpenaiYaml(spec) {
+  return [
+    "# Reserved for Phase B native integration",
+    `name: ${spec.skillYamlName}`,
+    `version: "1.0.0"`,
+    ""
+  ].join("\n");
+}
+function renderCodexAgentsMd(specs) {
+  const lines = [];
+  lines.push(`<!-- ${GENERATED_HEADER_CODEX.replace(/<!--\s*|\s*-->/g, "").trim()} -->`);
+  lines.push("");
+  lines.push("# Harness Skills");
+  lines.push("");
+  lines.push(
+    "This file bootstraps harness context for Codex CLI. Each skill is available as a structured workflow in the `harness/` directory."
+  );
+  lines.push("");
+  lines.push("## Available Skills");
+  lines.push("");
+  for (const spec of specs) {
+    lines.push(`- **${spec.skillYamlName}** \u2014 ${spec.description}`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+
+// src/slash-commands/sync-codex.ts
+import fs12 from "fs";
+import path14 from "path";
+function computeCodexSync(outputDir, specs, dryRun) {
+  const added = [];
+  const updated = [];
+  const unchanged = [];
+  const specSkillNames = /* @__PURE__ */ new Set();
+  for (const spec of specs) {
+    const mdPath = path14.join(spec.skillsBaseDir, spec.sourceDir, "SKILL.md");
+    const skillMd = fs12.existsSync(mdPath) ? fs12.readFileSync(mdPath, "utf-8") : "";
+    const skillDir = path14.join(outputDir, spec.skillYamlName);
+    specSkillNames.add(spec.skillYamlName);
+    const renderedSkillMd = renderCodexSkill(skillMd);
+    const renderedOpenaiYaml = renderCodexOpenaiYaml(spec);
+    const existingSkillMdPath = path14.join(skillDir, "SKILL.md");
+    const existingOpenaiYamlPath = path14.join(skillDir, "agents", "openai.yaml");
+    if (!fs12.existsSync(skillDir)) {
+      added.push(spec.skillYamlName);
+    } else {
+      const existingSkillMd = fs12.existsSync(existingSkillMdPath) ? fs12.readFileSync(existingSkillMdPath, "utf-8") : "";
+      const existingOpenaiYaml = fs12.existsSync(existingOpenaiYamlPath) ? fs12.readFileSync(existingOpenaiYamlPath, "utf-8") : "";
+      if (existingSkillMd === renderedSkillMd && existingOpenaiYaml === renderedOpenaiYaml) {
+        unchanged.push(spec.skillYamlName);
+      } else {
+        updated.push(spec.skillYamlName);
+      }
+    }
+    if (!dryRun && !unchanged.includes(spec.skillYamlName)) {
+      const agentsSubDir = path14.join(skillDir, "agents");
+      fs12.mkdirSync(agentsSubDir, { recursive: true });
+      fs12.writeFileSync(existingSkillMdPath, renderedSkillMd, "utf-8");
+      fs12.writeFileSync(existingOpenaiYamlPath, renderedOpenaiYaml, "utf-8");
+    }
+  }
+  const removed = detectCodexOrphans(outputDir, specSkillNames);
+  return { added, updated, removed, unchanged };
+}
+function detectCodexOrphans(outputDir, specSkillNames) {
+  const removed = [];
+  if (!fs12.existsSync(outputDir)) return removed;
+  const existingDirs = fs12.readdirSync(outputDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  for (const dirName of existingDirs) {
+    if (specSkillNames.has(dirName)) continue;
+    const skillMdPath = path14.join(outputDir, dirName, "SKILL.md");
+    if (fs12.existsSync(skillMdPath)) {
+      const content = fs12.readFileSync(skillMdPath, "utf-8");
+      if (content.includes(GENERATED_HEADER_CODEX)) {
+        removed.push(dirName);
+      }
+    }
+  }
+  return removed;
+}
+
 // src/commands/generate-slash-commands.ts
 function resolveOutputDir(platform, opts) {
   if (opts.output) {
-    return path14.join(opts.output, "harness");
+    return path15.join(opts.output, "harness");
   }
   if (opts.global) {
     const home = os.homedir();
-    return platform === "claude-code" ? path14.join(home, ".claude", "commands", "harness") : path14.join(home, ".gemini", "commands", "harness");
+    if (platform === "claude-code") return path15.join(home, ".claude", "commands", "harness");
+    if (platform === "gemini-cli") return path15.join(home, ".gemini", "commands", "harness");
+    if (platform === "cursor") return path15.join(home, ".cursor", "rules", "harness");
+    return path15.join(home, ".codex", "harness");
   }
-  return platform === "claude-code" ? path14.join("agents", "commands", "claude-code", "harness") : path14.join("agents", "commands", "gemini-cli", "harness");
-}
-function fileExtension(platform) {
-  return platform === "claude-code" ? ".md" : ".toml";
+  if (platform === "claude-code") return path15.join("agents", "commands", "claude-code", "harness");
+  if (platform === "gemini-cli") return path15.join("agents", "commands", "gemini-cli", "harness");
+  if (platform === "cursor") return path15.join("agents", "commands", "cursor", "harness");
+  return path15.join("agents", "commands", "codex", "harness");
 }
 async function confirmDeletion(files) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     rl.question(`
 Remove ${files.length} orphaned command(s)? (y/N) `, (answer) => {
       rl.close();
-      resolve2(answer.toLowerCase() === "y");
+      resolve3(answer.toLowerCase() === "y");
     });
   });
 }
@@ -1800,12 +2043,12 @@ function resolveSkillSources(opts) {
     sources.push({ dir: projectDir, source: "project" });
   }
   const communityDir = resolveCommunitySkillsDir();
-  if (fs12.existsSync(communityDir)) {
+  if (fs13.existsSync(communityDir)) {
     sources.push({ dir: communityDir, source: "community" });
   }
   if (opts.includeGlobal || sources.length === 0) {
     const globalDir = resolveGlobalSkillsDir();
-    if (!projectDir || path14.resolve(globalDir) !== path14.resolve(projectDir)) {
+    if (!projectDir || path15.resolve(globalDir) !== path15.resolve(projectDir)) {
       sources.push({ dir: globalDir, source: "global" });
     }
   }
@@ -1817,12 +2060,26 @@ function generateSlashCommands(opts) {
   const results = [];
   for (const platform of opts.platforms) {
     const outputDir = resolveOutputDir(platform, opts);
-    const ext = fileExtension(platform);
     const useAbsolutePaths = opts.global;
     const rendered = /* @__PURE__ */ new Map();
+    if (platform === "codex") {
+      const codexSync = computeCodexSync(outputDir, specs, opts.dryRun);
+      const codexRoot = path15.dirname(outputDir);
+      if (!opts.dryRun) {
+        fs13.mkdirSync(codexRoot, { recursive: true });
+        fs13.writeFileSync(path15.join(codexRoot, "AGENTS.md"), renderCodexAgentsMd(specs), "utf-8");
+      }
+      results.push({ platform, ...codexSync, outputDir });
+      continue;
+    }
     for (const spec of specs) {
-      const filename = `${spec.name}${ext}`;
-      if (platform === "claude-code") {
+      if (platform === "cursor") {
+        const filename = `${spec.skillYamlName}.mdc`;
+        const mdPath = path15.join(spec.skillsBaseDir, spec.sourceDir, "SKILL.md");
+        const skillMd = fs13.existsSync(mdPath) ? fs13.readFileSync(mdPath, "utf-8") : "";
+        rendered.set(filename, renderCursor(spec, skillMd, spec.cursor));
+      } else if (platform === "claude-code") {
+        const filename = `${spec.name}.md`;
         const renderSpec = useAbsolutePaths ? {
           ...spec,
           prompt: {
@@ -1830,7 +2087,7 @@ function generateSlashCommands(opts) {
             executionContext: spec.prompt.executionContext.split("\n").map((line) => {
               if (line.startsWith("@")) {
                 const relPath = line.slice(1);
-                return `@${path14.resolve(relPath)}`;
+                return `@${path15.resolve(relPath)}`;
               }
               return line;
             }).join("\n")
@@ -1838,10 +2095,11 @@ function generateSlashCommands(opts) {
         } : spec;
         rendered.set(filename, renderClaudeCode(renderSpec));
       } else {
-        const mdPath = path14.join(spec.skillsBaseDir, spec.sourceDir, "SKILL.md");
-        const yamlPath = path14.join(spec.skillsBaseDir, spec.sourceDir, "skill.yaml");
-        const mdContent = fs12.existsSync(mdPath) ? fs12.readFileSync(mdPath, "utf-8") : "";
-        const yamlContent = fs12.existsSync(yamlPath) ? fs12.readFileSync(yamlPath, "utf-8") : "";
+        const filename = `${spec.name}.toml`;
+        const mdPath = path15.join(spec.skillsBaseDir, spec.sourceDir, "SKILL.md");
+        const yamlPath = path15.join(spec.skillsBaseDir, spec.sourceDir, "skill.yaml");
+        const mdContent = fs13.existsSync(mdPath) ? fs13.readFileSync(mdPath, "utf-8") : "";
+        const yamlContent = fs13.existsSync(yamlPath) ? fs13.readFileSync(yamlPath, "utf-8") : "";
         rendered.set(filename, renderGemini(spec, mdContent, yamlContent));
       }
     }
@@ -1867,9 +2125,14 @@ async function handleOrphanDeletion(results, opts) {
     const shouldDelete = opts.yes || await confirmDeletion(result.removed);
     if (shouldDelete) {
       for (const filename of result.removed) {
-        const filePath = path14.join(result.outputDir, filename);
-        if (fs12.existsSync(filePath)) {
-          fs12.unlinkSync(filePath);
+        const filePath = path15.join(result.outputDir, filename);
+        if (fs13.existsSync(filePath)) {
+          const stat = fs13.statSync(filePath);
+          if (stat.isDirectory()) {
+            fs13.rmSync(filePath, { recursive: true, force: true });
+          } else {
+            fs13.unlinkSync(filePath);
+          }
         }
       }
     }
@@ -1877,7 +2140,7 @@ async function handleOrphanDeletion(results, opts) {
 }
 function createGenerateSlashCommandsCommand() {
   return new Command("generate-slash-commands").description(
-    "Generate native slash commands for Claude Code and Gemini CLI from skill metadata"
+    "Generate native commands for Claude Code, Gemini CLI, Codex CLI, and Cursor from skill metadata"
   ).option("--platforms <list>", "Target platforms (comma-separated)", "claude-code,gemini-cli").option("--global", "Write to global config directories", false).option("--include-global", "Include built-in global skills alongside project skills", false).option("--output <dir>", "Custom output directory").option("--skills-dir <path>", "Skills directory to scan").option("--dry-run", "Show what would change without writing", false).option("--yes", "Skip deletion confirmation prompts", false).action(async (opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
     const platforms = opts.platforms.split(",").map((p) => p.trim());
@@ -1995,7 +2258,7 @@ async function handleGenerateSlashCommands(input) {
 // src/mcp/resources/state.ts
 async function getStateResource(projectRoot) {
   try {
-    const { loadState, migrateToStreams } = await import("./dist-ALQDD67R.js");
+    const { loadState, migrateToStreams } = await import("./dist-4LPXJYVZ.js");
     await migrateToStreams(projectRoot);
     const result = await loadState(projectRoot);
     if (result.ok) {
@@ -2542,7 +2805,7 @@ async function handleGetImpact(input) {
 }
 
 // src/mcp/tools/graph/ingest-source.ts
-import * as path15 from "path";
+import * as path16 from "path";
 var ingestSourceDefinition = {
   name: "ingest_source",
   description: "Ingest sources into the project knowledge graph. Supports code analysis, knowledge documents, git history, or all at once.",
@@ -2562,10 +2825,10 @@ var ingestSourceDefinition = {
 async function handleIngestSource(input) {
   try {
     const projectPath = sanitizePath(input.path);
-    const graphDir = path15.join(projectPath, ".harness", "graph");
+    const graphDir = path16.join(projectPath, ".harness", "graph");
     const { GraphStore, CodeIngestor, TopologicalLinker, KnowledgeIngestor, GitIngestor } = await import("./dist-B26DFXMP.js");
-    const fs15 = await import("fs/promises");
-    await fs15.mkdir(graphDir, { recursive: true });
+    const fs16 = await import("fs/promises");
+    await fs16.mkdir(graphDir, { recursive: true });
     const store = new GraphStore();
     await store.load(graphDir);
     const results = [];
@@ -2697,8 +2960,8 @@ async function handleAskGraph(input) {
 }
 
 // src/mcp/resources/graph.ts
-import * as fs13 from "fs/promises";
-import * as path16 from "path";
+import * as fs14 from "fs/promises";
+import * as path17 from "path";
 var MAX_ITEMS = 5e3;
 function formatStaleness(isoTimestamp) {
   const then = new Date(isoTimestamp).getTime();
@@ -2721,11 +2984,11 @@ async function getGraphResource(projectRoot) {
       message: "No knowledge graph found. Run harness scan to build one."
     });
   }
-  const graphDir = path16.join(projectRoot, ".harness", "graph");
-  const metadataPath = path16.join(graphDir, "metadata.json");
+  const graphDir = path17.join(projectRoot, ".harness", "graph");
+  const metadataPath = path17.join(graphDir, "metadata.json");
   let lastScanTimestamp = null;
   try {
-    const raw = JSON.parse(await fs13.readFile(metadataPath, "utf-8"));
+    const raw = JSON.parse(await fs14.readFile(metadataPath, "utf-8"));
     lastScanTimestamp = raw.lastScanTimestamp ?? null;
   } catch {
   }
@@ -2814,7 +3077,7 @@ var generateAgentDefinitionsDefinition = {
   }
 };
 async function handleGenerateAgentDefinitions(input) {
-  const { generateAgentDefinitions } = await import("./generate-agent-definitions-ZAE726AU.js");
+  const { generateAgentDefinitions } = await import("./generate-agent-definitions-SAAOAPT4.js");
   const platforms = input.platform === "all" || !input.platform ? ["claude-code", "gemini-cli"] : [input.platform];
   const results = generateAgentDefinitions({
     platforms: [...platforms],
@@ -2825,8 +3088,8 @@ async function handleGenerateAgentDefinitions(input) {
 }
 
 // src/mcp/tools/roadmap.ts
-import * as fs14 from "fs";
-import * as path17 from "path";
+import * as fs15 from "fs";
+import * as path18 from "path";
 var manageRoadmapDefinition = {
   name: "manage_roadmap",
   description: "Manage the project roadmap: show, add, update, remove, sync features, or query by filter. Reads and writes docs/roadmap.md.",
@@ -2881,21 +3144,21 @@ var manageRoadmapDefinition = {
   }
 };
 function roadmapPath(projectRoot) {
-  return path17.join(projectRoot, "docs", "roadmap.md");
+  return path18.join(projectRoot, "docs", "roadmap.md");
 }
 function readRoadmapFile(projectRoot) {
   const filePath = roadmapPath(projectRoot);
   try {
-    return fs14.readFileSync(filePath, "utf-8");
+    return fs15.readFileSync(filePath, "utf-8");
   } catch {
     return null;
   }
 }
 function writeRoadmapFile(projectRoot, content) {
   const filePath = roadmapPath(projectRoot);
-  const dir = path17.dirname(filePath);
-  fs14.mkdirSync(dir, { recursive: true });
-  fs14.writeFileSync(filePath, content, "utf-8");
+  const dir = path18.dirname(filePath);
+  fs15.mkdirSync(dir, { recursive: true });
+  fs15.writeFileSync(filePath, content, "utf-8");
 }
 function roadmapNotFoundError() {
   return {
@@ -3108,7 +3371,7 @@ function handleSync(projectPath, input, deps) {
 }
 async function handleManageRoadmap(input) {
   try {
-    const { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges } = await import("./dist-ALQDD67R.js");
+    const { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges } = await import("./dist-4LPXJYVZ.js");
     const { Ok: Ok2 } = await import("./dist-USY2C5JL.js");
     const projectPath = sanitizePath(input.path);
     const deps = { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges, Ok: Ok2 };
@@ -3536,7 +3799,7 @@ async function handleTransition(validInput, projectPath, id) {
   const transition = transitionResult.data;
   const prompt = renderTransition(transition);
   try {
-    const { saveHandoff } = await import("./dist-ALQDD67R.js");
+    const { saveHandoff } = await import("./dist-4LPXJYVZ.js");
     await saveHandoff(
       projectPath,
       {
@@ -3606,7 +3869,7 @@ async function handleEmitInteraction(input) {
 }
 async function recordInteraction(projectPath, id, type, decision, stream) {
   try {
-    const { loadState, saveState } = await import("./dist-ALQDD67R.js");
+    const { loadState, saveState } = await import("./dist-4LPXJYVZ.js");
     const stateResult = await loadState(projectPath, stream);
     if (stateResult.ok) {
       const state = stateResult.value;
@@ -3695,10 +3958,10 @@ async function handleGatherContext(input) {
     input.include ?? ["state", "learnings", "handoff", "graph", "validation"]
   );
   const errors = [];
-  const statePromise = includeSet.has("state") ? import("./dist-ALQDD67R.js").then(
+  const statePromise = includeSet.has("state") ? import("./dist-4LPXJYVZ.js").then(
     (core) => core.loadState(projectPath, void 0, input.session)
   ) : Promise.resolve(null);
-  const learningsPromise = includeSet.has("learnings") ? import("./dist-ALQDD67R.js").then(
+  const learningsPromise = includeSet.has("learnings") ? import("./dist-4LPXJYVZ.js").then(
     (core) => core.loadBudgetedLearnings(projectPath, {
       intent: input.intent,
       tokenBudget: input.learningsBudget ?? 1e3,
@@ -3707,7 +3970,7 @@ async function handleGatherContext(input) {
       ...input.depth !== void 0 && { depth: input.depth }
     })
   ) : Promise.resolve(null);
-  const handoffPromise = includeSet.has("handoff") ? import("./dist-ALQDD67R.js").then(
+  const handoffPromise = includeSet.has("handoff") ? import("./dist-4LPXJYVZ.js").then(
     (core) => core.loadHandoff(projectPath, void 0, input.session)
   ) : Promise.resolve(null);
   const graphPromise = includeSet.has("graph") ? (async () => {
@@ -3751,11 +4014,11 @@ async function handleGatherContext(input) {
       context: contextBlocks
     };
   })() : Promise.resolve(null);
-  const sessionsPromise = includeSet.has("sessions") && input.session ? import("./dist-ALQDD67R.js").then(
+  const sessionsPromise = includeSet.has("sessions") && input.session ? import("./dist-4LPXJYVZ.js").then(
     (core) => core.readSessionSections(projectPath, input.session)
   ) : Promise.resolve(null);
   const shouldIncludeEvents = input.includeEvents !== void 0 ? input.includeEvents : includeSet.has("events") || !!input.session && !input.include;
-  const eventsPromise = shouldIncludeEvents ? import("./dist-ALQDD67R.js").then(async (core) => {
+  const eventsPromise = shouldIncludeEvents ? import("./dist-4LPXJYVZ.js").then(async (core) => {
     const result = await core.loadEvents(projectPath, {
       session: input.session
     });
@@ -3763,7 +4026,7 @@ async function handleGatherContext(input) {
     return core.formatEventTimeline(result.value);
   }) : Promise.resolve(null);
   const validationPromise = includeSet.has("validation") ? (async () => {
-    const { handleValidateProject: handleValidateProject2 } = await import("./validate-KBYQAEWE.js");
+    const { handleValidateProject: handleValidateProject2 } = await import("./validate-VRTUHALQ.js");
     const result = await handleValidateProject2({ path: projectPath });
     const first = result.content[0];
     return first ? JSON.parse(first.text) : null;
@@ -3857,7 +4120,7 @@ async function handleGatherContext(input) {
   };
   if (input.session) {
     try {
-      const core = await import("./dist-ALQDD67R.js");
+      const core = await import("./dist-4LPXJYVZ.js");
       core.updateSessionIndex(
         projectPath,
         input.session,
@@ -3927,7 +4190,7 @@ async function handleAssessProject(input) {
   let validateResult = null;
   if (checksToRun.has("validate")) {
     try {
-      const { handleValidateProject: handleValidateProject2 } = await import("./validate-KBYQAEWE.js");
+      const { handleValidateProject: handleValidateProject2 } = await import("./validate-VRTUHALQ.js");
       const result = await handleValidateProject2({ path: projectPath });
       const first = result.content[0];
       const parsed = first ? JSON.parse(first.text) : {};
@@ -3952,7 +4215,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleCheckDependencies: handleCheckDependencies2 } = await import("./architecture-ZLIH5533.js");
+          const { handleCheckDependencies: handleCheckDependencies2 } = await import("./architecture-K5HSRBGB.js");
           const result = await handleCheckDependencies2({ path: projectPath });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -3979,7 +4242,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleCheckDocs: handleCheckDocs2 } = await import("./docs-NRMQCOJ6.js");
+          const { handleCheckDocs: handleCheckDocs2 } = await import("./docs-4JRHTLUZ.js");
           const result = await handleCheckDocs2({ path: projectPath, scope: "coverage" });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -4006,7 +4269,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleDetectEntropy: handleDetectEntropy2 } = await import("./entropy-6AGX2ZUN.js");
+          const { handleDetectEntropy: handleDetectEntropy2 } = await import("./entropy-G6CZ2A6P.js");
           const result = await handleDetectEntropy2({ path: projectPath, type: "all" });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -4033,7 +4296,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleRunSecurityScan: handleRunSecurityScan2 } = await import("./security-2RPQEN62.js");
+          const { handleRunSecurityScan: handleRunSecurityScan2 } = await import("./security-ZDADTPYW.js");
           const result = await handleRunSecurityScan2({ path: projectPath });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -4065,14 +4328,28 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleCheckPerformance: handleCheckPerformance2 } = await import("./performance-2D7G6NMJ.js");
+          const { handleCheckPerformance: handleCheckPerformance2 } = await import("./performance-UBCFI2UP.js");
           const result = await handleCheckPerformance2({ path: projectPath });
+          if ("isError" in result && result.isError) {
+            const msg = result.content[0]?.text ?? "Performance check failed";
+            return { name: "perf", passed: false, issueCount: 1, topIssue: msg };
+          }
           const first = result.content[0];
-          const parsed = first ? JSON.parse(first.text) : {};
+          let parsed = {};
+          try {
+            parsed = first ? JSON.parse(first.text) : {};
+          } catch {
+            return {
+              name: "perf",
+              passed: false,
+              issueCount: 1,
+              topIssue: first?.text ?? "Invalid perf output"
+            };
+          }
           const issues = parsed.violations?.length ?? parsed.issues?.length ?? 0;
           return {
             name: "perf",
-            passed: !("isError" in result && result.isError) && issues === 0,
+            passed: issues === 0,
             issueCount: issues,
             ...issues > 0 ? { topIssue: "Performance issues detected" } : {},
             ...mode === "detailed" ? { detailed: parsed } : {}
@@ -4254,7 +4531,7 @@ async function handleReviewChanges(input) {
   }
 }
 async function runQuickReview(projectPath, diff, diffLines, downgraded) {
-  const { handleAnalyzeDiff: handleAnalyzeDiff2 } = await import("./feedback-MY4QZIFD.js");
+  const { handleAnalyzeDiff: handleAnalyzeDiff2 } = await import("./feedback-QYKQ65HB.js");
   const result = await handleAnalyzeDiff2({ diff, path: projectPath });
   const firstContent = result.content[0];
   if (!firstContent) throw new Error("Empty analyze_diff response");
@@ -4285,7 +4562,7 @@ function extractFileCount(diffParsed) {
   return files?.length ?? 0;
 }
 async function runStandardReview(projectPath, diff, diffLines, downgraded) {
-  const { handleAnalyzeDiff: handleAnalyzeDiff2, handleCreateSelfReview: handleCreateSelfReview2 } = await import("./feedback-MY4QZIFD.js");
+  const { handleAnalyzeDiff: handleAnalyzeDiff2, handleCreateSelfReview: handleCreateSelfReview2 } = await import("./feedback-QYKQ65HB.js");
   const [diffResult, reviewResult] = await Promise.all([
     handleAnalyzeDiff2({ diff, path: projectPath }),
     handleCreateSelfReview2({ path: projectPath, diff })
@@ -4317,7 +4594,7 @@ async function runStandardReview(projectPath, diff, diffLines, downgraded) {
   };
 }
 async function runDeepReview(projectPath, diff, diffLines, _downgraded) {
-  const { handleRunCodeReview: handleRunCodeReview2 } = await import("./review-pipeline-RAQ55ISU.js");
+  const { handleRunCodeReview: handleRunCodeReview2 } = await import("./review-pipeline-IQAVCWAX.js");
   const result = await handleRunCodeReview2({ path: projectPath, diff });
   const deepContent = result.content[0];
   if (!deepContent) throw new Error("Empty code review response");
@@ -4603,7 +4880,7 @@ async function handleDetectStaleConstraints(input) {
         ]
       };
     }
-    const { detectStaleConstraints } = await import("./dist-ALQDD67R.js");
+    const { detectStaleConstraints } = await import("./dist-4LPXJYVZ.js");
     const result = detectStaleConstraints(
       store,
       windowDays,
@@ -4735,7 +5012,7 @@ async function handleCodeOutline(input) {
     };
   }
   try {
-    const { getOutline, formatOutline, EXTENSION_MAP } = await import("./dist-ALQDD67R.js");
+    const { getOutline, formatOutline, EXTENSION_MAP } = await import("./dist-4LPXJYVZ.js");
     const { stat } = await import("fs/promises");
     const stats = await stat(targetPath).catch(() => null);
     if (stats?.isFile()) {
@@ -4815,7 +5092,7 @@ async function handleCodeSearch(input) {
     };
   }
   try {
-    const { searchSymbols } = await import("./dist-ALQDD67R.js");
+    const { searchSymbols } = await import("./dist-4LPXJYVZ.js");
     const result = await searchSymbols(input.query, directory, input.glob);
     const lines = [`Search: "${result.query}" \u2014 ${result.matches.length} matches`];
     for (const match of result.matches) {
@@ -4884,7 +5161,7 @@ async function handleCodeUnfold(input) {
   }
   try {
     if (input.symbol) {
-      const { unfoldSymbol } = await import("./dist-ALQDD67R.js");
+      const { unfoldSymbol } = await import("./dist-4LPXJYVZ.js");
       const result = await unfoldSymbol(filePath, input.symbol);
       const header = result.warning ? `${result.file}:${result.startLine}-${result.endLine} ${result.warning}
 ` : `${result.file}:${result.startLine}-${result.endLine}
@@ -4892,7 +5169,7 @@ async function handleCodeUnfold(input) {
       return { content: [{ type: "text", text: header + result.content }] };
     }
     if (input.startLine != null && input.endLine != null) {
-      const { unfoldRange } = await import("./dist-ALQDD67R.js");
+      const { unfoldRange } = await import("./dist-4LPXJYVZ.js");
       const result = await unfoldRange(filePath, input.startLine, input.endLine);
       const header = `${result.file}:${result.startLine}-${result.endLine}
 `;
@@ -5107,7 +5384,7 @@ async function appendUpdateNotification(result, resolvedRoot) {
       shouldRunCheck,
       readCheckState,
       spawnBackgroundCheck
-    } = await import("./dist-ALQDD67R.js");
+    } = await import("./dist-4LPXJYVZ.js");
     const { CLI_VERSION } = await import("./version-KFFPOQAX.js");
     const configInterval = readConfigInterval(resolvedRoot);
     const DEFAULT_INTERVAL = 864e5;
@@ -5125,19 +5402,24 @@ ${notification}` });
   } catch {
   }
 }
-function createHarnessServer(projectRoot) {
+function createHarnessServer(projectRoot, toolFilter) {
   const resolvedRoot = projectRoot ?? process.cwd();
   let sessionChecked = false;
+  const filteredDefinitions = toolFilter ? TOOL_DEFINITIONS.filter((t) => toolFilter.includes(t.name)) : TOOL_DEFINITIONS;
+  const filteredHandlers = toolFilter ? Object.fromEntries(
+    Object.entries(TOOL_HANDLERS).filter(([name]) => toolFilter.includes(name))
+  ) : TOOL_HANDLERS;
   const server = new Server(
     { name: "harness-engineering", version: "0.1.0" },
     { capabilities: { tools: {}, resources: {} } }
   );
   server.setRequestHandler(ListToolsRequestSchema, async () => ({
-    tools: TOOL_DEFINITIONS
+    tools: filteredDefinitions
   }));
+  const guardedHandlers = applyInjectionGuard(filteredHandlers, { projectRoot: resolvedRoot });
   server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
-    const handler = TOOL_HANDLERS[name];
+    const handler = guardedHandlers[name];
     if (!handler) {
       return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
     }
@@ -5166,8 +5448,8 @@ function createHarnessServer(projectRoot) {
   });
   return server;
 }
-async function startServer() {
-  const server = createHarnessServer();
+async function startServer(toolFilter) {
+  const server = createHarnessServer(void 0, toolFilter);
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }