@harness-engineering/cli 1.24.3 → 1.25.1

package/dist/hooks/sentinel-post.js

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+/* global console */
+// sentinel-post.js — PostToolUse:* hook
+// Sentinel prompt injection defense — scans tool outputs for injection patterns.
+// Exit codes: always 0 (PostToolUse cannot block)
+
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import process from 'node:process';
+
+// Minimal inline patterns for when @harness-engineering/core isn't available.
+// Keep in sync with @harness-engineering/core injection-patterns.ts ALL_PATTERNS.
+// Covers all HIGH-severity patterns and key MEDIUM patterns for degraded-mode safety.
+function inlineScan(text) {
+  console.error('[sentinel] Running in degraded mode: core import failed, using inline patterns');
+  const findings = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    // HIGH: INJ-UNI-001 — Zero-width characters
+    // eslint-disable-next-line no-misleading-character-class -- intentional: detects zero-width chars for security
+    if (/[\u200B\u200C\u200D\uFEFF\u2060]/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-UNI-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-UNI-002 — RTL/LTR override characters
+    if (/[\u202A-\u202E\u2066-\u2069]/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-UNI-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-001 — Ignore previous instructions
+    if (/(?:ignore|disregard|forget)\s+(?:all\s+)?(?:previous|prior|above|earlier)\s+(?:instructions?|prompts?|context|rules?|guidelines?)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-002 — Role reassignment
+    if (/you\s+are\s+now\s+(?:a\s+|an\s+)?(?:new\s+)?(?:helpful\s+)?(?:my\s+)?(?:\w+\s+)?(?:assistant|agent|AI|bot|chatbot|system|persona)\b/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-003 — Direct instruction override
+    if (/(?:new\s+)?(?:system\s+)?(?:instruction|directive|role|persona)\s*[:=]\s*/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-003', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-001 — Enable all tools/permissions
+    if (/(?:allow|enable|grant)\s+all\s+(?:tools?|permissions?|access)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-002 — Disable safety/security
+    if (/(?:disable|turn\s+off|remove|bypass)\s+(?:all\s+)?(?:safety|security|restrictions?|guardrails?|protections?|checks?)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-003 — Auto-approve directive
+    if (/(?:auto[- ]?approve|--no-verify|--dangerously-skip-permissions)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-003', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-ENC-001 — Suspicious base64
+    if (/(?<!Bearer\s)(?<![:])(?<![A-Za-z0-9/])(?!eyJ)(?:[A-Za-z0-9+/]{4}){7,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?(?![A-Za-z0-9/])/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-ENC-001', match: line.trim(), line: i + 1 });
+    }
+    // MEDIUM: INJ-CTX-001 — System prompt claims
+    if (/(?:the\s+)?(?:system\s+prompt|system\s+message|hidden\s+instructions?)\s+(?:says?|tells?|instructs?|contains?|is)/i.test(line)) {
+      findings.push({ severity: 'medium', ruleId: 'INJ-CTX-001', match: line.trim(), line: i + 1 });
+    }
+  }
+  return findings;
+}
+
+async function main() {
+  let raw = '';
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    process.exit(0);
+  }
+
+  if (!raw.trim()) {
+    process.exit(0);
+  }
+
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    process.exit(0);
+  }
+
+  try {
+    const toolName = input?.tool_name ?? '';
+    const toolOutput = input?.tool_output ?? '';
+    const sessionId = input?.session_id;
+    const workspaceRoot = process.cwd();
+
+    if (!toolOutput || typeof toolOutput !== 'string') {
+      process.exit(0);
+    }
+
+    let findings;
+    try {
+      const core = await import('@harness-engineering/core');
+      findings = core.scanForInjection(toolOutput);
+    } catch {
+      findings = inlineScan(toolOutput);
+    }
+
+    const actionable = findings.filter((f) => f.severity === 'high' || f.severity === 'medium');
+
+    if (actionable.length > 0) {
+      try {
+        const core = await import('@harness-engineering/core');
+        core.writeTaint(
+          workspaceRoot,
+          sessionId,
+          `Injection pattern detected in PostToolUse:${toolName} result`,
+          actionable,
+          `PostToolUse:${toolName}`
+        );
+      } catch {
+        // Fallback inline taint writer — merges with existing taint state
+        try {
+          const id = sessionId || 'default';
+          const taintPath = resolve(workspaceRoot, '.harness', `session-taint-${id}.json`);
+          mkdirSync(dirname(taintPath), { recursive: true });
+          const now = new Date().toISOString();
+          const maxSev = actionable.some((f) => f.severity === 'high') ? 'high' : 'medium';
+          const newFindings = actionable.map((f) => ({
+            ruleId: f.ruleId, severity: f.severity, match: f.match,
+            source: `PostToolUse:${toolName}`, detectedAt: now,
+          }));
+          // Read and merge existing taint state to preserve earlier taintedAt and findings
+          let existing = null;
+          try { existing = JSON.parse(readFileSync(taintPath, 'utf-8')); } catch { /* no existing */ }
+          const state = {
+            sessionId: id,
+            taintedAt: existing?.taintedAt ?? now,
+            expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
+            reason: existing?.reason ?? `Injection pattern detected in PostToolUse:${toolName} result`,
+            severity: maxSev,
+            findings: [...(existing?.findings ?? []), ...newFindings],
+          };
+          writeFileSync(taintPath, JSON.stringify(state, null, 2) + '\n');
+        } catch { /* best-effort */ }
+      }
+
+      for (const f of actionable) {
+        process.stderr.write(
+          `Sentinel [${f.severity}] ${f.ruleId}: detected in ${toolName} output\n`
+        );
+      }
+    }
+
+    const low = findings.filter((f) => f.severity === 'low');
+    for (const f of low) {
+      process.stderr.write(`Sentinel [low] ${f.ruleId}: ${f.match.slice(0, 80)}\n`);
+    }
+
+    process.exit(0);
+  } catch {
+    process.exit(0);
+  }
+}
+
+main();

package/dist/hooks/sentinel-pre.js

@@ -0,0 +1,244 @@
+#!/usr/bin/env node
+/* global console */
+// sentinel-pre.js — PreToolUse:* hook
+// Sentinel prompt injection defense — scans tool inputs for injection patterns
+// and blocks destructive operations during tainted sessions.
+// Exit codes: 0 = allow, 2 = block
+
+import { readFileSync, writeFileSync, mkdirSync, unlinkSync, realpathSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import process from 'node:process';
+
+// Destructive tool patterns blocked during taint.
+// These are intentionally inline — this check runs before the @harness-engineering/core
+// import attempt to ensure enforcement even when core is unavailable.
+// Keep in sync with DESTRUCTIVE_BASH exported from @harness-engineering/core injection-patterns.ts.
+const DESTRUCTIVE_BASH = [
+  /\bgit\s+push\b/,
+  /\bgit\s+commit\b/,
+  /\brm\s+-rf?\b/,
+  /\brm\s+-r\b/,
+];
+
+function isDestructiveBash(command) {
+  return DESTRUCTIVE_BASH.some((p) => p.test(command));
+}
+
+function isOutsideWorkspace(filePath, workspaceRoot) {
+  if (!filePath || !workspaceRoot) return false;
+  const resolved = resolve(workspaceRoot, filePath);
+  // Resolve symlinks to prevent bypass via symlink pointing outside workspace
+  let realResolved = resolved;
+  try { realResolved = realpathSync(resolved); } catch { /* path doesn't exist yet — use resolved */ }
+  return !realResolved.startsWith(workspaceRoot);
+}
+
+// Minimal inline patterns for when @harness-engineering/core isn't available.
+// Keep in sync with @harness-engineering/core injection-patterns.ts ALL_PATTERNS.
+// Covers all HIGH-severity patterns and key MEDIUM patterns for degraded-mode safety.
+function inlineScan(text) {
+  console.error('[sentinel] Running in degraded mode: core import failed, using inline patterns');
+  const findings = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    // HIGH: INJ-UNI-001 — Zero-width characters
+    // eslint-disable-next-line no-misleading-character-class -- intentional: detects zero-width chars for security
+    if (/[\u200B\u200C\u200D\uFEFF\u2060]/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-UNI-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-UNI-002 — RTL/LTR override characters
+    if (/[\u202A-\u202E\u2066-\u2069]/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-UNI-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-001 — Ignore previous instructions
+    if (/(?:ignore|disregard|forget)\s+(?:all\s+)?(?:previous|prior|above|earlier)\s+(?:instructions?|prompts?|context|rules?|guidelines?)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-002 — Role reassignment
+    if (/you\s+are\s+now\s+(?:a\s+|an\s+)?(?:new\s+)?(?:helpful\s+)?(?:my\s+)?(?:\w+\s+)?(?:assistant|agent|AI|bot|chatbot|system|persona)\b/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-003 — Direct instruction override
+    if (/(?:new\s+)?(?:system\s+)?(?:instruction|directive|role|persona)\s*[:=]\s*/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-003', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-001 — Enable all tools/permissions
+    if (/(?:allow|enable|grant)\s+all\s+(?:tools?|permissions?|access)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-002 — Disable safety/security
+    if (/(?:disable|turn\s+off|remove|bypass)\s+(?:all\s+)?(?:safety|security|restrictions?|guardrails?|protections?|checks?)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-003 — Auto-approve directive
+    if (/(?:auto[- ]?approve|--no-verify|--dangerously-skip-permissions)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-003', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-ENC-001 — Suspicious base64
+    if (/(?<!Bearer\s)(?<![:])(?<![A-Za-z0-9/])(?!eyJ)(?:[A-Za-z0-9+/]{4}){7,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?(?![A-Za-z0-9/])/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-ENC-001', match: line.trim(), line: i + 1 });
+    }
+    // MEDIUM: INJ-CTX-001 — System prompt claims
+    if (/(?:the\s+)?(?:system\s+prompt|system\s+message|hidden\s+instructions?)\s+(?:says?|tells?|instructs?|contains?|is)/i.test(line)) {
+      findings.push({ severity: 'medium', ruleId: 'INJ-CTX-001', match: line.trim(), line: i + 1 });
+    }
+  }
+  return findings;
+}
+
+function extractText(toolName, toolInput) {
+  if (toolName === 'Bash') return toolInput?.command ?? '';
+  if (toolName === 'Write') return toolInput?.content ?? '';
+  if (toolName === 'Edit') return `${toolInput?.old_string ?? ''}\n${toolInput?.new_string ?? ''}`;
+  if (toolName === 'Read') return toolInput?.file_path ?? '';
+  const parts = [];
+  for (const value of Object.values(toolInput || {})) {
+    if (typeof value === 'string') parts.push(value);
+  }
+  return parts.join('\n') || null;
+}
+
+async function main() {
+  let raw = '';
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    process.exit(0);
+  }
+
+  if (!raw.trim()) {
+    process.exit(0);
+  }
+
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    process.exit(0);
+  }
+
+  try {
+    const toolName = input?.tool_name ?? '';
+    const toolInput = input?.tool_input ?? {};
+    const sessionId = input?.session_id;
+    const workspaceRoot = process.cwd();
+
+    // Step 1: Check taint state — block destructive ops if tainted
+    let tainted = false;
+    try {
+      const taintPath = resolve(
+        workspaceRoot,
+        '.harness',
+        `session-taint-${sessionId || 'default'}.json`
+      );
+      const taintRaw = readFileSync(taintPath, 'utf-8');
+      const taintState = JSON.parse(taintRaw);
+
+      const expiresAt = new Date(taintState.expiresAt);
+      if (new Date() >= expiresAt) {
+        try { unlinkSync(taintPath); } catch { /* ignore */ }
+        process.stderr.write(
+          'Sentinel: session taint expired. Destructive operations re-enabled.\n'
+        );
+      } else {
+        tainted = true;
+      }
+    } catch {
+      // No taint file or malformed — not tainted
+    }
+
+    if (tainted) {
+      if (toolName === 'Bash') {
+        const command = toolInput?.command ?? '';
+        if (isDestructiveBash(command)) {
+          process.stderr.write(
+            `BLOCKED by Sentinel: "${toolName}" blocked during tainted session. ` +
+            `Destructive operations are restricted. Run "harness taint clear" to lift.\n`
+          );
+          process.exit(2);
+        }
+      }
+
+      if (toolName === 'Write' || toolName === 'Edit') {
+        const filePath = toolInput?.file_path ?? '';
+        if (isOutsideWorkspace(filePath, workspaceRoot)) {
+          process.stderr.write(
+            `BLOCKED by Sentinel: "${toolName}" to "${filePath}" blocked during tainted session. ` +
+            `File is outside workspace. Run "harness taint clear" to lift.\n`
+          );
+          process.exit(2);
+        }
+      }
+    }
+
+    // Step 2: Scan tool inputs for injection patterns
+    const textToScan = extractText(toolName, toolInput);
+    if (textToScan) {
+      let findings;
+      try {
+        const core = await import('@harness-engineering/core');
+        findings = core.scanForInjection(textToScan);
+      } catch {
+        findings = inlineScan(textToScan);
+      }
+
+      const actionable = findings.filter((f) => f.severity === 'high' || f.severity === 'medium');
+
+      if (actionable.length > 0) {
+        try {
+          const core = await import('@harness-engineering/core');
+          core.writeTaint(
+            workspaceRoot,
+            sessionId,
+            `Injection pattern detected in PreToolUse:${toolName} input`,
+            actionable,
+            `PreToolUse:${toolName}`
+          );
+        } catch {
+          // Fallback inline taint writer — merges with existing taint state
+          try {
+            const id = sessionId || 'default';
+            const taintPath = resolve(workspaceRoot, '.harness', `session-taint-${id}.json`);
+            mkdirSync(dirname(taintPath), { recursive: true });
+            const now = new Date().toISOString();
+            const maxSev = actionable.some((f) => f.severity === 'high') ? 'high' : 'medium';
+            const newFindings = actionable.map((f) => ({
+              ruleId: f.ruleId, severity: f.severity, match: f.match,
+              source: `PreToolUse:${toolName}`, detectedAt: now,
+            }));
+            // Read and merge existing taint state to preserve earlier taintedAt and findings
+            let existing = null;
+            try { existing = JSON.parse(readFileSync(taintPath, 'utf-8')); } catch { /* no existing */ }
+            const state = {
+              sessionId: id,
+              taintedAt: existing?.taintedAt ?? now,
+              expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
+              reason: existing?.reason ?? `Injection pattern detected in PreToolUse:${toolName} input`,
+              severity: maxSev,
+              findings: [...(existing?.findings ?? []), ...newFindings],
+            };
+            writeFileSync(taintPath, JSON.stringify(state, null, 2) + '\n');
+          } catch { /* best-effort */ }
+        }
+
+        for (const f of actionable) {
+          process.stderr.write(
+            `Sentinel [${f.severity}] ${f.ruleId}: detected in ${toolName} input\n`
+          );
+        }
+      }
+
+      const low = findings.filter((f) => f.severity === 'low');
+      for (const f of low) {
+        process.stderr.write(`Sentinel [low] ${f.ruleId}: ${f.match.slice(0, 80)}\n`);
+      }
+    }
+
+    process.exit(0);
+  } catch {
+    process.exit(0);
+  }
+}
+
+main();

package/dist/hooks/telemetry-reporter.js

@@ -0,0 +1,248 @@
+#!/usr/bin/env node
+/* global setTimeout, fetch, AbortSignal */
+// telemetry-reporter.js — Stop:* hook
+// Reads adoption.jsonl, resolves consent, sends telemetry events to PostHog,
+// and shows a one-time first-run privacy notice.
+// Exit codes: 0 = allow (always, log-only hook — never blocks session teardown)
+
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import process from 'node:process';
+
+// PostHog project API key — public, write-only (cannot read data)
+const POSTHOG_API_KEY = process.env.POSTHOG_API_KEY ?? 'phc_wNTdCMcfJXZPgdNeDociZW6vwoGGo4nb7vqEfWThFfsG'; // harness-ignore SEC-SEC-002: public PostHog write-only ingest key
+const POSTHOG_BATCH_URL = 'https://app.posthog.com/batch';
+const MAX_ATTEMPTS = 3;
+const TIMEOUT_MS = 5000;
+
+const FIRST_RUN_NOTICE = `Harness collects anonymous usage analytics to improve the tool.
+No personal information is sent. Disable with:
+  DO_NOT_TRACK=1  or  harness.config.json \u2192 telemetry.enabled: false\n`;
+
+// --- Helpers ---
+
+function readJsonSafe(filePath) {
+  try {
+    return JSON.parse(readFileSync(filePath, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// --- Consent ---
+
+function resolveConsent(cwd) {
+  if (process.env.DO_NOT_TRACK === '1') return { allowed: false };
+  if (process.env.HARNESS_TELEMETRY_OPTOUT === '1') return { allowed: false };
+
+  const config = readJsonSafe(join(cwd, 'harness.config.json'));
+  if (config?.telemetry?.enabled === false) return { allowed: false };
+
+  const installId = getOrCreateInstallId(cwd);
+
+  const identityFile = readJsonSafe(join(cwd, '.harness', 'telemetry.json'));
+  const identity = {};
+  if (identityFile?.identity) {
+    if (typeof identityFile.identity.project === 'string') identity.project = identityFile.identity.project;
+    if (typeof identityFile.identity.team === 'string') identity.team = identityFile.identity.team;
+    if (typeof identityFile.identity.alias === 'string') identity.alias = identityFile.identity.alias;
+  }
+
+  return { allowed: true, installId, identity };
+}
+
+// --- Install ID ---
+
+const UUID_V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function getOrCreateInstallId(cwd) {
+  const harnessDir = join(cwd, '.harness');
+  const installIdFile = join(harnessDir, '.install-id');
+
+  try {
+    const existing = readFileSync(installIdFile, 'utf-8').trim();
+    if (UUID_V4_RE.test(existing)) return existing;
+  } catch {
+    // File does not exist
+  }
+
+  const id = randomUUID();
+  mkdirSync(harnessDir, { recursive: true });
+  writeFileSync(installIdFile, id, { encoding: 'utf-8', mode: 0o600 });
+  return id;
+}
+
+// --- Collector ---
+
+function readAdoptionRecords(cwd) {
+  const adoptionFile = join(cwd, '.harness', 'metrics', 'adoption.jsonl');
+  let raw;
+  try {
+    raw = readFileSync(adoptionFile, 'utf-8');
+  } catch {
+    return [];
+  }
+
+  const records = [];
+  for (const line of raw.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (
+        typeof parsed.skill === 'string' &&
+        typeof parsed.startedAt === 'string' &&
+        typeof parsed.duration === 'number' &&
+        typeof parsed.outcome === 'string' &&
+        Array.isArray(parsed.phasesReached)
+      ) {
+        records.push(parsed);
+      }
+    } catch {
+      // Skip malformed lines
+    }
+  }
+  return records;
+}
+
+function collectEvents(cwd, consent) {
+  const records = readAdoptionRecords(cwd);
+  if (records.length === 0) return [];
+
+  const { installId, identity } = consent;
+  const distinctId = identity.alias ?? installId;
+
+  return records.map((record) => ({
+    event: 'skill_invocation',
+    distinctId,
+    timestamp: record.startedAt,
+    properties: {
+      installId,
+      os: process.platform,
+      nodeVersion: process.version,
+      harnessVersion: readHarnessVersion(cwd),
+      skillName: record.skill,
+      duration: record.duration,
+      outcome: record.outcome === 'completed' ? 'success' : 'failure',
+      phasesReached: record.phasesReached,
+      ...(identity.project ? { project: identity.project } : {}),
+      ...(identity.team ? { team: identity.team } : {}),
+    },
+  }));
+}
+
+function readHarnessVersion(cwd) {
+  try {
+    const pkg = readJsonSafe(join(cwd, 'node_modules', '@harness-engineering', 'core', 'package.json'));
+    return pkg?.version ?? 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
+// --- Transport ---
+
+async function sendEvents(events) {
+  if (events.length === 0) return;
+
+  const payload = JSON.stringify({ api_key: POSTHOG_API_KEY, batch: events });
+
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+    try {
+      const res = await fetch(POSTHOG_BATCH_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: payload,
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+      });
+      if (res.ok) return;
+      if (res.status < 500) return; // 4xx = permanent, do not retry
+    } catch {
+      // Network error or timeout — retry
+    }
+    if (attempt < MAX_ATTEMPTS - 1) {
+      await sleep(1000 * (attempt + 1));
+    }
+  }
+  // Silent failure — all retries exhausted
+}
+
+// --- First-run notice ---
+
+function showFirstRunNotice(cwd) {
+  const flagFile = join(cwd, '.harness', '.telemetry-notice-shown');
+  if (existsSync(flagFile)) return;
+
+  process.stderr.write(FIRST_RUN_NOTICE);
+
+  try {
+    mkdirSync(join(cwd, '.harness'), { recursive: true });
+    writeFileSync(flagFile, new Date().toISOString(), { encoding: 'utf-8' });
+  } catch {
+    // Non-fatal — notice will show again next time
+  }
+}
+
+// --- Main ---
+
+async function main() {
+  let raw = '';
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    process.exit(0);
+  }
+
+  if (!raw.trim()) {
+    process.exit(0);
+  }
+
+  // Parse stdin (stop hook receives session JSON)
+  try {
+    JSON.parse(raw);
+  } catch {
+    process.stderr.write('[telemetry-reporter] Could not parse stdin — skipping\n');
+    process.exit(0);
+  }
+
+  try {
+    const cwd = process.cwd();
+    const consent = resolveConsent(cwd);
+
+    if (!consent.allowed) {
+      process.exit(0);
+    }
+
+    // Show first-run notice (before sending, so user sees it even if send fails)
+    showFirstRunNotice(cwd);
+
+    const events = collectEvents(cwd, consent);
+    if (events.length === 0) {
+      process.stderr.write('[telemetry-reporter] No adoption records to report\n');
+      process.exit(0);
+    }
+
+    await sendEvents(events);
+
+    // Truncate adoption.jsonl after successful send to prevent re-sending
+    const adoptionFile = join(cwd, '.harness', 'metrics', 'adoption.jsonl');
+    try {
+      writeFileSync(adoptionFile, '', 'utf-8');
+    } catch {
+      // Non-fatal — records may be re-sent next session
+    }
+
+    process.stderr.write(`[telemetry-reporter] Sent ${events.length} telemetry event(s)\n`);
+    process.exit(0);
+  } catch (err) {
+    process.stderr.write(`[telemetry-reporter] Failed: ${err.message}\n`);
+    process.exit(0);
+  }
+}
+
+main();