@harness-engineering/cli 1.25.0 → 1.25.2

package/dist/bin/harness-mcp.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   startServer
-} from "../chunk-RX7TUMBR.js";
+} from "../chunk-TBGIHPNA.js";
 import "../chunk-FES2YEQU.js";
 import "../chunk-UV3BZMGT.js";
 import "../chunk-F23H3U5U.js";

package/dist/bin/harness.js

@@ -2,7 +2,7 @@
 import {
   createProgram,
   printFirstRunWelcome
-} from "../chunk-AZT567I6.js";
+} from "../chunk-5I3W4J5X.js";
 import "../chunk-5BQ5BOJL.js";
 import "../chunk-EHRZMOQ2.js";
 import "../chunk-XTITAVUR.js";
@@ -19,7 +19,7 @@ import "../chunk-P7PANON5.js";
 import "../chunk-4NK7Z3BP.js";
 import {
   dispatchSkillsFromGit
-} from "../chunk-RX7TUMBR.js";
+} from "../chunk-TBGIHPNA.js";
 import "../chunk-FES2YEQU.js";
 import "../chunk-UV3BZMGT.js";
 import "../chunk-F23H3U5U.js";
@@ -113,6 +113,96 @@ ${message}
   }
 }
 
+// src/bin/command-telemetry.ts
+import { existsSync, readFileSync, mkdirSync, appendFileSync, writeFileSync } from "fs";
+import { join, parse as parsePath, resolve } from "path";
+import { spawn } from "child_process";
+var EXCLUDED_COMMANDS = /* @__PURE__ */ new Set(["help", "completion"]);
+function findProjectRoot(cwd) {
+  let dir = resolve(cwd);
+  const { root } = parsePath(dir);
+  while (dir !== root) {
+    if (existsSync(join(dir, "harness.config.json"))) return dir;
+    dir = resolve(dir, "..");
+  }
+  return cwd;
+}
+var commandName = "";
+var startTime = 0;
+var recorded = false;
+function installCommandTelemetry(program, cwd) {
+  if (typeof program.hook !== "function") return;
+  const projectRoot = findProjectRoot(cwd);
+  flushTelemetryBackground(projectRoot);
+  program.hook("preAction", (thisCommand) => {
+    commandName = resolveCommandName(thisCommand);
+    startTime = Date.now();
+  });
+  process.on("exit", (code) => {
+    if (recorded || !commandName || EXCLUDED_COMMANDS.has(commandName)) return;
+    recorded = true;
+    const duration = Date.now() - startTime;
+    const outcome = code === 0 ? "completed" : "failed";
+    writeCommandRecordSync(projectRoot, commandName, duration, outcome);
+  });
+}
+function resolveCommandName(cmd) {
+  const parts = [];
+  let current = cmd;
+  while (current) {
+    const name = current.name();
+    if (name && name !== "harness") {
+      parts.unshift(name);
+    }
+    current = current.parent;
+  }
+  return parts.length > 0 ? `cli/${parts.join(".")}` : "";
+}
+function writeCommandRecordSync(cwd, command, duration, outcome) {
+  try {
+    const metricsDir = join(cwd, ".harness", "metrics");
+    mkdirSync(metricsDir, { recursive: true });
+    const record = {
+      skill: command,
+      session: `cli-${Date.now()}`,
+      startedAt: new Date(Date.now() - duration).toISOString(),
+      duration,
+      outcome,
+      phasesReached: []
+    };
+    const adoptionFile = join(metricsDir, "adoption.jsonl");
+    appendFileSync(adoptionFile, JSON.stringify(record) + "\n");
+  } catch {
+  }
+}
+function flushTelemetryBackground(cwd) {
+  try {
+    const adoptionFile = join(cwd, ".harness", "metrics", "adoption.jsonl");
+    if (!existsSync(adoptionFile)) return;
+    const configPath = join(cwd, "harness.config.json");
+    if (existsSync(configPath)) {
+      try {
+        const config = JSON.parse(readFileSync(configPath, "utf-8"));
+        if (config?.telemetry?.enabled === false) return;
+      } catch {
+      }
+    }
+    if (process.env.DO_NOT_TRACK === "1") return;
+    if (process.env.HARNESS_TELEMETRY_OPTOUT === "1") return;
+    const reporterPath = join(cwd, ".harness", "hooks", "telemetry-reporter.js");
+    if (!existsSync(reporterPath)) return;
+    const child = spawn(process.execPath, [reporterPath], {
+      cwd,
+      stdio: ["pipe", "ignore", "ignore"],
+      detached: true
+    });
+    child.stdin?.write("{}");
+    child.stdin?.end();
+    child.unref();
+  } catch {
+  }
+}
+
 // src/skill/dispatch-session.ts
 import { execSync } from "child_process";
 import fs from "fs";
@@ -211,6 +301,7 @@ async function main() {
     () => ({ dispatched: false })
   );
   const program = createProgram();
+  installCommandTelemetry(program, process.cwd());
   try {
     await program.parseAsync(process.argv);
   } catch (error) {

package/dist/{chunk-AZT567I6.js → chunk-5I3W4J5X.js}

@@ -56,7 +56,7 @@ import {
   loadOrRebuildIndex,
   persistToolingConfig,
   recommend
-} from "./chunk-RX7TUMBR.js";
+} from "./chunk-TBGIHPNA.js";
 import {
   findConfigFile,
   resolveConfig
@@ -3111,11 +3111,21 @@ var __filename2 = fileURLToPath2(import.meta.url);
 var __dirname2 = path20.dirname(__filename2);
 var VALID_PROFILES = ["minimal", "standard", "strict"];
 function resolveHookSourceDir() {
-  const candidate = path20.resolve(__dirname2, "..", "..", "hooks");
-  if (fs8.existsSync(candidate)) {
-    return candidate;
+  const candidates = [
+    // Dev layout: src/commands/hooks/ → ../../hooks/
+    path20.resolve(__dirname2, "..", "..", "hooks"),
+    // Bundled layout: dist/ → ./hooks/ (copied by copy-assets.mjs)
+    path20.resolve(__dirname2, "hooks")
+  ];
+  for (const candidate of candidates) {
+    if (fs8.existsSync(candidate)) {
+      return candidate;
+    }
   }
-  throw new Error(`Cannot locate hook scripts directory. Expected at: ${candidate}`);
+  throw new Error(
+    `Cannot locate hook scripts directory. Searched:
+${candidates.map((c) => `  - ${c}`).join("\n")}`
+  );
 }
 function buildSettingsHooks(profile) {
   const activeHookNames = PROFILES[profile];
@@ -3127,7 +3137,12 @@ function buildSettingsHooks(profile) {
     }
     hooks[script.event].push({
       matcher: script.matcher,
-      hooks: [{ type: "command", command: `node .harness/hooks/${script.name}.js` }]
+      hooks: [
+        {
+          type: "command",
+          command: `node "$(git rev-parse --show-toplevel)/.harness/hooks/${script.name}.js"`
+        }
+      ]
     });
   }
   return hooks;
@@ -3345,7 +3360,7 @@ function readJson(p) {
 }
 function registerHook(s, ev, matcher, name) {
   if (!s.hooks[ev]) s.hooks[ev] = [];
-  const cmd = `node .harness/hooks/${name}.js`;
+  const cmd = `node "$(git rev-parse --show-toplevel)/.harness/hooks/${name}.js"`;
   if (!s.hooks[ev].some((e) => e.hooks?.some((h) => h.command === cmd))) {
     s.hooks[ev].push({ matcher, hooks: [{ type: "command", command: cmd }] });
   }
@@ -5408,7 +5423,7 @@ function createMcpCommand() {
     parseBudget
   ).action(async (opts) => {
     const [{ startServer: startServer2, getToolDefinitions: getToolDefinitions2 }, { selectTier }] = await Promise.all([
-      import("./mcp-2553PNUC.js"),
+      import("./mcp-W3FLXSFF.js"),
       import("./tool-tiers-7QGZ3FKY.js")
     ]);
     if (opts.tools && opts.tools.length > 0) {
@@ -6262,6 +6277,18 @@ function prompt(question) {
     });
   });
 }
+function promptRaw(question) {
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return new Promise((resolve35) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve35(answer.trim());
+    });
+  });
+}
 function isNo(answer) {
   return answer === "n" || answer === "no";
 }
@@ -6302,11 +6329,11 @@ async function promptIdentity() {
   const answer = await prompt("  Set identity fields? (y/N) ");
   const identity = {};
   if (answer === "y" || answer === "yes") {
-    const projectName = await prompt("    Project name: ");
+    const projectName = await promptRaw("    Project name: ");
     if (projectName) identity.project = projectName;
-    const teamName = await prompt("    Team name: ");
+    const teamName = await promptRaw("    Team name: ");
     if (teamName) identity.team = teamName;
-    const alias = await prompt("    Alias: ");
+    const alias = await promptRaw("    Alias: ");
     if (alias) identity.alias = alias;
   }
   return identity;

package/dist/{chunk-RX7TUMBR.js → chunk-TBGIHPNA.js}

@@ -564,6 +564,8 @@ function ensureHarnessGitignore(targetDir) {
   const content = `# Runtime artifacts (generated, ephemeral, session-scoped)
 graph/
 debug/
+hooks/
+security/
 sessions/
 state.json
 state/

package/dist/hooks/adoption-tracker.js

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+// adoption-tracker.js — Stop:* hook
+// Reads .harness/events.jsonl, reconstructs skill invocations,
+// appends SkillInvocationRecord entries to .harness/metrics/adoption.jsonl.
+// Exit codes: 0 = allow (always, log-only hook)
+
+import { readFileSync, mkdirSync, appendFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import process from 'node:process';
+
+/** Read and parse a JSON file, returning null on any error. */
+function readJsonSafe(filePath) {
+  try {
+    return JSON.parse(readFileSync(filePath, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+/** Check if adoption tracking is enabled in harness.config.json. */
+function isAdoptionEnabled(cwd) {
+  const config = readJsonSafe(join(cwd, 'harness.config.json'));
+  if (!config) return true; // default: enabled
+  if (config.adoption && config.adoption.enabled === false) return false;
+  return true;
+}
+
+/** Parse events.jsonl into an array of event objects. Skips malformed lines. */
+function parseEventsFile(eventsPath) {
+  let raw;
+  try {
+    raw = readFileSync(eventsPath, 'utf-8');
+  } catch {
+    return [];
+  }
+
+  const events = [];
+  const lines = raw.split('\n');
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed.skill && parsed.type && parsed.timestamp) {
+        events.push(parsed);
+      }
+    } catch {
+      // Skip malformed lines
+    }
+  }
+  return events;
+}
+
+/** Relevant event types for adoption tracking. */
+const RELEVANT_TYPES = new Set(['phase_transition', 'gate_result', 'handoff', 'error']);
+
+/** Derive outcome from a skill's events. */
+function deriveOutcome(events) {
+  const hasHandoff = events.some((e) => e.type === 'handoff');
+  const hasError = events.some((e) => e.type === 'error');
+
+  // Check for final phase (VALIDATE is the conventional final phase)
+  const phases = events
+    .filter((e) => e.type === 'phase_transition')
+    .map((e) => (e.data && e.data.to) || '')
+    .filter(Boolean);
+  const hasFinalPhase = phases.some(
+    (p) => p.toLowerCase() === 'validate' || p.toLowerCase() === 'complete'
+  );
+
+  if (hasHandoff || hasFinalPhase) return 'completed';
+  if (hasError) return 'failed';
+  return 'abandoned';
+}
+
+/** Derive phases reached from phase_transition events. */
+function derivePhasesReached(events) {
+  const phases = [];
+  const seen = new Set();
+  for (const event of events) {
+    if (event.type === 'phase_transition' && event.data && event.data.to) {
+      const phase = event.data.to;
+      if (!seen.has(phase)) {
+        seen.add(phase);
+        phases.push(phase);
+      }
+    }
+  }
+  return phases;
+}
+
+/** Derive duration in ms from first to last event timestamp. */
+function deriveDuration(events) {
+  if (events.length < 2) return 0;
+  const timestamps = events.map((e) => new Date(e.timestamp).getTime()).filter((t) => !isNaN(t));
+  if (timestamps.length < 2) return 0;
+  const min = Math.min(...timestamps);
+  const max = Math.max(...timestamps);
+  return max - min;
+}
+
+function main() {
+  let raw = '';
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    process.exit(0);
+  }
+
+  if (!raw.trim()) {
+    process.exit(0);
+  }
+
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    process.stderr.write('[adoption-tracker] Could not parse stdin — skipping\n');
+    process.exit(0);
+  }
+
+  try {
+    const cwd = process.cwd();
+
+    // Check config
+    if (!isAdoptionEnabled(cwd)) {
+      process.stderr.write('[adoption-tracker] Adoption tracking disabled — skipping\n');
+      process.exit(0);
+    }
+
+    // Read events.jsonl
+    const eventsPath = join(cwd, '.harness', 'events.jsonl');
+    if (!existsSync(eventsPath)) {
+      process.stderr.write('[adoption-tracker] No events.jsonl found — skipping\n');
+      process.exit(0);
+    }
+
+    const allEvents = parseEventsFile(eventsPath);
+    // Filter to relevant event types
+    const relevantEvents = allEvents.filter((e) => RELEVANT_TYPES.has(e.type));
+    if (relevantEvents.length === 0) {
+      process.stderr.write('[adoption-tracker] No relevant skill events — skipping\n');
+      process.exit(0);
+    }
+
+    // Group events by skill
+    const skillGroups = new Map();
+    for (const event of relevantEvents) {
+      if (!skillGroups.has(event.skill)) {
+        skillGroups.set(event.skill, []);
+      }
+      skillGroups.get(event.skill).push(event);
+    }
+
+    // Reconstruct invocation records
+    const sessionId = input.session_id ?? 'unknown';
+    const metricsDir = join(cwd, '.harness', 'metrics');
+    mkdirSync(metricsDir, { recursive: true });
+    const adoptionFile = join(metricsDir, 'adoption.jsonl');
+
+    let written = 0;
+    for (const [skill, events] of skillGroups) {
+      // Use all events for this skill (including non-relevant) for timing
+      const allSkillEvents = allEvents.filter((e) => e.skill === skill);
+
+      const record = {
+        skill,
+        session: sessionId,
+        startedAt: allSkillEvents[0]?.timestamp ?? events[0].timestamp,
+        duration: deriveDuration(allSkillEvents.length > 0 ? allSkillEvents : events),
+        outcome: deriveOutcome(events),
+        phasesReached: derivePhasesReached(events),
+      };
+
+      appendFileSync(adoptionFile, JSON.stringify(record) + '\n');
+      written++;
+    }
+
+    process.stderr.write(
+      `[adoption-tracker] Wrote ${written} adoption record(s) for session ${sessionId}\n`
+    );
+    process.exit(0);
+  } catch (err) {
+    process.stderr.write(`[adoption-tracker] Failed: ${err.message}\n`);
+    process.exit(0);
+  }
+}
+
+main();

package/dist/hooks/block-no-verify.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+// block-no-verify.js — PreToolUse:Bash hook
+// Blocks git commands that use --no-verify to skip hooks.
+// Exit codes: 0 = allow, 2 = block
+
+import { readFileSync } from 'node:fs';
+import process from 'node:process';
+
+function main() {
+  let raw = '';
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    // No stdin or read error — fail open
+    process.exit(0);
+  }
+
+  if (!raw.trim()) {
+    process.exit(0);
+  }
+
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    // Malformed JSON — fail open
+    process.exit(0);
+  }
+
+  try {
+    const command = input?.tool_input?.command ?? '';
+    if (typeof command !== 'string') {
+      process.exit(0);
+    }
+
+    if (/--no-verify/.test(command) || /\bgit\b.*\bcommit\b.*\s-n\b/.test(command)) {
+      process.stderr.write(
+        'BLOCKED: --no-verify flag detected. Hooks must not be bypassed.\n'
+      );
+      process.exit(2);
+    }
+
+    process.exit(0);
+  } catch {
+    // Unexpected error — fail open
+    process.exit(0);
+  }
+}
+
+main();

package/dist/hooks/cost-tracker.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+// cost-tracker.js — Stop:* hook
+// Appends token usage to .harness/metrics/costs.jsonl.
+// Exit codes: 0 = allow (always, log-only hook)
+
+import { readFileSync, mkdirSync, appendFileSync } from 'node:fs';
+import { join } from 'node:path';
+import process from 'node:process';
+
+function main() {
+  let raw = '';
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    process.exit(0);
+  }
+
+  if (!raw.trim()) {
+    process.exit(0);
+  }
+
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    process.stderr.write('[cost-tracker] Could not parse stdin — skipping\n');
+    process.exit(0);
+  }
+
+  try {
+    const cwd = process.cwd();
+    const metricsDir = join(cwd, '.harness', 'metrics');
+
+    mkdirSync(metricsDir, { recursive: true });
+
+    const entry = {
+      timestamp: new Date().toISOString(),
+      session_id: input.session_id ?? null,
+      token_usage: input.token_usage ?? null,
+      model: input.model ?? null,
+    };
+
+    // Pass through cache token fields (prefer camelCase input, fall back to snake_case)
+    if (input.cacheCreationTokens != null) {
+      entry.cacheCreationTokens = input.cacheCreationTokens;
+    } else if (input.cache_creation_tokens != null) {
+      entry.cacheCreationTokens = input.cache_creation_tokens;
+    }
+    if (input.cacheReadTokens != null) {
+      entry.cacheReadTokens = input.cacheReadTokens;
+    } else if (input.cache_read_tokens != null) {
+      entry.cacheReadTokens = input.cache_read_tokens;
+    }
+
+    const costsFile = join(metricsDir, 'costs.jsonl');
+    appendFileSync(costsFile, JSON.stringify(entry) + '\n');
+
+    process.stderr.write(`[cost-tracker] Logged cost entry for session ${entry.session_id}\n`);
+    process.exit(0);
+  } catch (err) {
+    process.stderr.write(`[cost-tracker] Failed to log costs: ${err.message}\n`);
+    process.exit(0);
+  }
+}
+
+main();

package/dist/hooks/pre-compact-state.js

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+// pre-compact-state.js — PreCompact:* hook
+// Saves a compact session summary before context compaction.
+// Reads from .harness/state.json and .harness/sessions/ to gather context.
+// Writes to .harness/state/pre-compact-summary.json (overwrites on each run).
+// Fail-open: parse errors and unexpected exceptions log to stderr and exit 0.
+// Exit codes: 0 = allow (always, log-only hook)
+
+import { readFileSync, mkdirSync, writeFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import process from 'node:process';
+
+function readJsonSafe(filePath) {
+  try {
+    return JSON.parse(readFileSync(filePath, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function findActiveSession(sessionsDir) {
+  try {
+    const entries = readdirSync(sessionsDir, { withFileTypes: true });
+    // Look for the most recently modified session with an autopilot-state.json
+    let latest = null;
+    let latestMtime = 0;
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const statePath = join(sessionsDir, entry.name, 'autopilot-state.json');
+      try {
+        const stat = statSync(statePath);
+        if (stat.mtimeMs > latestMtime) {
+          latestMtime = stat.mtimeMs;
+          latest = { dir: entry.name, state: readJsonSafe(statePath) };
+        }
+      } catch {
+        // No autopilot-state.json in this session
+      }
+    }
+    return latest;
+  } catch {
+    return null;
+  }
+}
+
+function main() {
+  let raw = '';
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    process.stderr.write('[pre-compact-state] Could not read stdin — allowing (fail-open)\n');
+    process.exit(0);
+  }
+
+  if (!raw.trim()) {
+    process.stderr.write('[pre-compact-state] Empty stdin — allowing (fail-open)\n');
+    process.exit(0);
+  }
+
+  try {
+    JSON.parse(raw); // validate stdin is JSON
+  } catch {
+    process.stderr.write('[pre-compact-state] Could not parse stdin — allowing (fail-open)\n');
+    process.exit(0);
+  }
+
+  try {
+    const cwd = process.cwd();
+    const harnessDir = join(cwd, '.harness');
+    const stateDir = join(harnessDir, 'state');
+
+    // Read harness state
+    const state = readJsonSafe(join(harnessDir, 'state.json'));
+
+    // Find active session
+    const session = findActiveSession(join(harnessDir, 'sessions'));
+
+    // Extract recent decisions (last 5)
+    const decisions = state?.decisions ?? [];
+    const recentDecisions = decisions.slice(-5).map((d) =>
+      typeof d === 'string' ? d : (d?.decision ?? d?.summary ?? JSON.stringify(d))
+    );
+
+    // Extract open questions / blockers
+    const openQuestions = state?.blockers ?? [];
+
+    // Determine current phase from session state
+    const currentPhase = session?.state?.currentState
+      ?? (state?.position?.phase ?? null);
+
+    // Build summary
+    const summary = {
+      timestamp: new Date().toISOString(),
+      sessionId: session?.dir ?? null,
+      activeStream: session?.state?.currentState ?? null,
+      recentDecisions,
+      openQuestions,
+      currentPhase,
+    };
+
+    mkdirSync(stateDir, { recursive: true });
+    writeFileSync(
+      join(stateDir, 'pre-compact-summary.json'),
+      JSON.stringify(summary, null, 2) + '\n'
+    );
+
+    process.stderr.write('[pre-compact-state] Saved pre-compact summary\n');
+    process.exit(0);
+  } catch (err) {
+    process.stderr.write(`[pre-compact-state] Failed to save summary: ${String(err?.message ?? err)}\n`);
+    process.exit(0);
+  }
+}
+
+main();