@harness-engineering/cli 1.25.0 → 1.25.2

package/dist/hooks/profiles.ts

@@ -0,0 +1,48 @@
+/**
+ * Hook profile definitions.
+ *
+ * Profiles are additive: each higher tier includes all hooks from lower tiers.
+ * - minimal: safety floor (block-no-verify only)
+ * - standard: + protect-config, quality-gate, pre-compact-state (default)
+ * - strict: + cost-tracker, sentinel-pre, sentinel-post
+ */
+
+export type HookProfile = 'minimal' | 'standard' | 'strict';
+
+export interface HookScript {
+  /** Script filename without .js extension */
+  name: string;
+  /** Claude Code hook event */
+  event: 'PreToolUse' | 'PostToolUse' | 'PreCompact' | 'Stop';
+  /** Tool matcher pattern */
+  matcher: string;
+  /** Minimum profile tier that includes this hook */
+  minProfile: HookProfile;
+}
+
+export const HOOK_SCRIPTS: HookScript[] = [
+  { name: 'block-no-verify', event: 'PreToolUse', matcher: 'Bash', minProfile: 'minimal' },
+  { name: 'protect-config', event: 'PreToolUse', matcher: 'Write|Edit', minProfile: 'standard' },
+  { name: 'quality-gate', event: 'PostToolUse', matcher: 'Edit|Write', minProfile: 'standard' },
+  { name: 'pre-compact-state', event: 'PreCompact', matcher: '*', minProfile: 'standard' },
+  { name: 'adoption-tracker', event: 'Stop', matcher: '*', minProfile: 'standard' },
+  { name: 'telemetry-reporter', event: 'Stop', matcher: '*', minProfile: 'standard' },
+  { name: 'cost-tracker', event: 'Stop', matcher: '*', minProfile: 'strict' },
+  { name: 'sentinel-pre', event: 'PreToolUse', matcher: '*', minProfile: 'strict' },
+  { name: 'sentinel-post', event: 'PostToolUse', matcher: '*', minProfile: 'strict' },
+];
+
+const PROFILE_ORDER: HookProfile[] = ['minimal', 'standard', 'strict'];
+
+function hooksForProfile(profile: HookProfile): string[] {
+  const profileIndex = PROFILE_ORDER.indexOf(profile);
+  return HOOK_SCRIPTS.filter((h) => PROFILE_ORDER.indexOf(h.minProfile) <= profileIndex).map(
+    (h) => h.name
+  );
+}
+
+export const PROFILES: Record<HookProfile, string[]> = {
+  minimal: hooksForProfile('minimal'),
+  standard: hooksForProfile('standard'),
+  strict: hooksForProfile('strict'),
+};

package/dist/hooks/protect-config.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+// protect-config.js — PreToolUse:Write/Edit hook
+// Blocks modifications to linter/formatter config files.
+// Fail-open: parse errors and unexpected exceptions log to stderr and exit 0.
+// Exit codes: 0 = allow, 2 = block
+
+import { readFileSync } from 'node:fs';
+import { basename } from 'node:path';
+import process from 'node:process';
+
+// Protected config file patterns
+const PROTECTED_PATTERNS = [
+  /^\.eslintrc/,
+  /^eslint\.config\./,
+  /^\.prettierrc/,
+  /^prettier\.config\./,
+  /^biome\.json$/,
+  /^biome\.jsonc$/,
+  /^\.ruff\.toml$/,
+  /^ruff\.toml$/,
+  /^\.stylelintrc/,
+  /^\.markdownlint/,
+  /^deno\.json$/,
+];
+
+function isProtected(filePath) {
+  const base = basename(filePath);
+  return PROTECTED_PATTERNS.some((pattern) => pattern.test(base));
+}
+
+function main() {
+  let raw;
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    process.stderr.write('[protect-config] Could not read stdin — allowing (fail-open)\n');
+    process.exit(0);
+  }
+
+  if (!raw.trim()) {
+    process.stderr.write('[protect-config] Empty stdin — allowing (fail-open)\n');
+    process.exit(0);
+  }
+
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    process.stderr.write('[protect-config] Could not parse stdin JSON — allowing (fail-open)\n');
+    process.exit(0);
+  }
+
+  try {
+    const filePath = input?.tool_input?.file_path;
+
+    if (typeof filePath !== 'string' || !filePath) {
+      process.stderr.write('[protect-config] Missing file_path in tool input — allowing (fail-open)\n');
+      process.exit(0);
+    }
+
+    if (isProtected(filePath)) {
+      process.stderr.write(
+        `BLOCKED: Modification to protected config file: ${basename(filePath)}. Linter/formatter configs must not be weakened.\n`
+      );
+      process.exit(2);
+    }
+
+    process.exit(0);
+  } catch {
+    process.stderr.write('[protect-config] Unexpected error — allowing (fail-open)\n');
+    process.exit(0);
+  }
+}
+
+main();

package/dist/hooks/quality-gate.js

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+// quality-gate.js — PostToolUse:Edit/Write hook
+// Runs project formatter/linter after edits and warns on violations.
+// Never blocks (always exits 0). Warnings go to stderr.
+// Exit codes: 0 = allow (always)
+
+import { readFileSync, accessSync } from 'node:fs';
+import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import process from 'node:process';
+
+// Detection order: first match wins
+const DETECTORS = [
+  {
+    configs: ['biome.json', 'biome.jsonc'],
+    cmd: 'npx',
+    args: ['biome', 'check'],
+    name: 'Biome',
+  },
+  {
+    configs: [
+      '.prettierrc',
+      '.prettierrc.json',
+      '.prettierrc.yml',
+      '.prettierrc.yaml',
+      '.prettierrc.js',
+      '.prettierrc.cjs',
+      '.prettierrc.mjs',
+      'prettier.config.js',
+      'prettier.config.cjs',
+      'prettier.config.mjs',
+    ],
+    cmd: 'npx',
+    args: ['prettier', '--check'],
+    name: 'Prettier',
+  },
+  {
+    configs: ['.ruff.toml', 'ruff.toml'],
+    cmd: 'ruff',
+    args: ['check'],
+    name: 'Ruff',
+  },
+];
+
+function detectFormatter(cwd) {
+  for (const detector of DETECTORS) {
+    for (const config of detector.configs) {
+      try {
+        accessSync(join(cwd, config));
+        return detector;
+      } catch {
+        // Config not found, try next
+      }
+    }
+  }
+  return null;
+}
+
+function main() {
+  let raw = '';
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    process.exit(0);
+  }
+
+  if (!raw.trim()) {
+    process.exit(0);
+  }
+
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    process.exit(0);
+  }
+
+  try {
+    const filePath = input?.tool_input?.file_path ?? '';
+    const cwd = process.cwd();
+
+    // Special case: .go files use gofmt
+    if (typeof filePath === 'string' && filePath.endsWith('.go')) {
+      try {
+        const result = execFileSync('gofmt', ['-l', filePath], {
+          encoding: 'utf-8',
+          cwd,
+          timeout: 10000,
+        });
+        if (result.trim()) {
+          process.stderr.write(
+            `[quality-gate] gofmt found formatting issues in: ${result.trim()}\n`
+          );
+        }
+      } catch {
+        // gofmt not available or failed — warn and continue
+        process.stderr.write('[quality-gate] gofmt check failed (tool may not be installed)\n');
+      }
+      process.exit(0);
+    }
+
+    const detector = detectFormatter(cwd);
+    if (!detector) {
+      // No formatter detected — nothing to check
+      process.exit(0);
+    }
+
+    try {
+      execFileSync(detector.cmd, detector.args, {
+        encoding: 'utf-8',
+        cwd,
+        timeout: 30000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+      process.stderr.write(`[quality-gate] ${detector.name} check passed\n`);
+    } catch (err) {
+      // Formatter found violations or failed to run — warn only
+      const output = err.stdout || err.stderr || '';
+      process.stderr.write(
+        `[quality-gate] ${detector.name} check reported issues:\n${output.slice(0, 500)}\n`
+      );
+    }
+
+    process.exit(0);
+  } catch {
+    // Unexpected error — fail open
+    process.exit(0);
+  }
+}
+
+main();

package/dist/hooks/sentinel-post.js

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+/* global console */
+// sentinel-post.js — PostToolUse:* hook
+// Sentinel prompt injection defense — scans tool outputs for injection patterns.
+// Exit codes: always 0 (PostToolUse cannot block)
+
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import process from 'node:process';
+
+// Minimal inline patterns for when @harness-engineering/core isn't available.
+// Keep in sync with @harness-engineering/core injection-patterns.ts ALL_PATTERNS.
+// Covers all HIGH-severity patterns and key MEDIUM patterns for degraded-mode safety.
+function inlineScan(text) {
+  console.error('[sentinel] Running in degraded mode: core import failed, using inline patterns');
+  const findings = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    // HIGH: INJ-UNI-001 — Zero-width characters
+    // eslint-disable-next-line no-misleading-character-class -- intentional: detects zero-width chars for security
+    if (/[\u200B\u200C\u200D\uFEFF\u2060]/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-UNI-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-UNI-002 — RTL/LTR override characters
+    if (/[\u202A-\u202E\u2066-\u2069]/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-UNI-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-001 — Ignore previous instructions
+    if (/(?:ignore|disregard|forget)\s+(?:all\s+)?(?:previous|prior|above|earlier)\s+(?:instructions?|prompts?|context|rules?|guidelines?)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-002 — Role reassignment
+    if (/you\s+are\s+now\s+(?:a\s+|an\s+)?(?:new\s+)?(?:helpful\s+)?(?:my\s+)?(?:\w+\s+)?(?:assistant|agent|AI|bot|chatbot|system|persona)\b/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-003 — Direct instruction override
+    if (/(?:new\s+)?(?:system\s+)?(?:instruction|directive|role|persona)\s*[:=]\s*/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-003', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-001 — Enable all tools/permissions
+    if (/(?:allow|enable|grant)\s+all\s+(?:tools?|permissions?|access)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-002 — Disable safety/security
+    if (/(?:disable|turn\s+off|remove|bypass)\s+(?:all\s+)?(?:safety|security|restrictions?|guardrails?|protections?|checks?)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-003 — Auto-approve directive
+    if (/(?:auto[- ]?approve|--no-verify|--dangerously-skip-permissions)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-003', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-ENC-001 — Suspicious base64
+    if (/(?<!Bearer\s)(?<![:])(?<![A-Za-z0-9/])(?!eyJ)(?:[A-Za-z0-9+/]{4}){7,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?(?![A-Za-z0-9/])/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-ENC-001', match: line.trim(), line: i + 1 });
+    }
+    // MEDIUM: INJ-CTX-001 — System prompt claims
+    if (/(?:the\s+)?(?:system\s+prompt|system\s+message|hidden\s+instructions?)\s+(?:says?|tells?|instructs?|contains?|is)/i.test(line)) {
+      findings.push({ severity: 'medium', ruleId: 'INJ-CTX-001', match: line.trim(), line: i + 1 });
+    }
+  }
+  return findings;
+}
+
+async function main() {
+  let raw = '';
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    process.exit(0);
+  }
+
+  if (!raw.trim()) {
+    process.exit(0);
+  }
+
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    process.exit(0);
+  }
+
+  try {
+    const toolName = input?.tool_name ?? '';
+    const toolOutput = input?.tool_output ?? '';
+    const sessionId = input?.session_id;
+    const workspaceRoot = process.cwd();
+
+    if (!toolOutput || typeof toolOutput !== 'string') {
+      process.exit(0);
+    }
+
+    let findings;
+    try {
+      const core = await import('@harness-engineering/core');
+      findings = core.scanForInjection(toolOutput);
+    } catch {
+      findings = inlineScan(toolOutput);
+    }
+
+    const actionable = findings.filter((f) => f.severity === 'high' || f.severity === 'medium');
+
+    if (actionable.length > 0) {
+      try {
+        const core = await import('@harness-engineering/core');
+        core.writeTaint(
+          workspaceRoot,
+          sessionId,
+          `Injection pattern detected in PostToolUse:${toolName} result`,
+          actionable,
+          `PostToolUse:${toolName}`
+        );
+      } catch {
+        // Fallback inline taint writer — merges with existing taint state
+        try {
+          const id = sessionId || 'default';
+          const taintPath = resolve(workspaceRoot, '.harness', `session-taint-${id}.json`);
+          mkdirSync(dirname(taintPath), { recursive: true });
+          const now = new Date().toISOString();
+          const maxSev = actionable.some((f) => f.severity === 'high') ? 'high' : 'medium';
+          const newFindings = actionable.map((f) => ({
+            ruleId: f.ruleId, severity: f.severity, match: f.match,
+            source: `PostToolUse:${toolName}`, detectedAt: now,
+          }));
+          // Read and merge existing taint state to preserve earlier taintedAt and findings
+          let existing = null;
+          try { existing = JSON.parse(readFileSync(taintPath, 'utf-8')); } catch { /* no existing */ }
+          const state = {
+            sessionId: id,
+            taintedAt: existing?.taintedAt ?? now,
+            expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
+            reason: existing?.reason ?? `Injection pattern detected in PostToolUse:${toolName} result`,
+            severity: maxSev,
+            findings: [...(existing?.findings ?? []), ...newFindings],
+          };
+          writeFileSync(taintPath, JSON.stringify(state, null, 2) + '\n');
+        } catch { /* best-effort */ }
+      }
+
+      for (const f of actionable) {
+        process.stderr.write(
+          `Sentinel [${f.severity}] ${f.ruleId}: detected in ${toolName} output\n`
+        );
+      }
+    }
+
+    const low = findings.filter((f) => f.severity === 'low');
+    for (const f of low) {
+      process.stderr.write(`Sentinel [low] ${f.ruleId}: ${f.match.slice(0, 80)}\n`);
+    }
+
+    process.exit(0);
+  } catch {
+    process.exit(0);
+  }
+}
+
+main();

package/dist/hooks/sentinel-pre.js

@@ -0,0 +1,244 @@
+#!/usr/bin/env node
+/* global console */
+// sentinel-pre.js — PreToolUse:* hook
+// Sentinel prompt injection defense — scans tool inputs for injection patterns
+// and blocks destructive operations during tainted sessions.
+// Exit codes: 0 = allow, 2 = block
+
+import { readFileSync, writeFileSync, mkdirSync, unlinkSync, realpathSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import process from 'node:process';
+
+// Destructive tool patterns blocked during taint.
+// These are intentionally inline — this check runs before the @harness-engineering/core
+// import attempt to ensure enforcement even when core is unavailable.
+// Keep in sync with DESTRUCTIVE_BASH exported from @harness-engineering/core injection-patterns.ts.
+const DESTRUCTIVE_BASH = [
+  /\bgit\s+push\b/,
+  /\bgit\s+commit\b/,
+  /\brm\s+-rf?\b/,
+  /\brm\s+-r\b/,
+];
+
+function isDestructiveBash(command) {
+  return DESTRUCTIVE_BASH.some((p) => p.test(command));
+}
+
+function isOutsideWorkspace(filePath, workspaceRoot) {
+  if (!filePath || !workspaceRoot) return false;
+  const resolved = resolve(workspaceRoot, filePath);
+  // Resolve symlinks to prevent bypass via symlink pointing outside workspace
+  let realResolved = resolved;
+  try { realResolved = realpathSync(resolved); } catch { /* path doesn't exist yet — use resolved */ }
+  return !realResolved.startsWith(workspaceRoot);
+}
+
+// Minimal inline patterns for when @harness-engineering/core isn't available.
+// Keep in sync with @harness-engineering/core injection-patterns.ts ALL_PATTERNS.
+// Covers all HIGH-severity patterns and key MEDIUM patterns for degraded-mode safety.
+function inlineScan(text) {
+  console.error('[sentinel] Running in degraded mode: core import failed, using inline patterns');
+  const findings = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    // HIGH: INJ-UNI-001 — Zero-width characters
+    // eslint-disable-next-line no-misleading-character-class -- intentional: detects zero-width chars for security
+    if (/[\u200B\u200C\u200D\uFEFF\u2060]/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-UNI-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-UNI-002 — RTL/LTR override characters
+    if (/[\u202A-\u202E\u2066-\u2069]/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-UNI-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-001 — Ignore previous instructions
+    if (/(?:ignore|disregard|forget)\s+(?:all\s+)?(?:previous|prior|above|earlier)\s+(?:instructions?|prompts?|context|rules?|guidelines?)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-002 — Role reassignment
+    if (/you\s+are\s+now\s+(?:a\s+|an\s+)?(?:new\s+)?(?:helpful\s+)?(?:my\s+)?(?:\w+\s+)?(?:assistant|agent|AI|bot|chatbot|system|persona)\b/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-REROL-003 — Direct instruction override
+    if (/(?:new\s+)?(?:system\s+)?(?:instruction|directive|role|persona)\s*[:=]\s*/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-REROL-003', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-001 — Enable all tools/permissions
+    if (/(?:allow|enable|grant)\s+all\s+(?:tools?|permissions?|access)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-001', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-002 — Disable safety/security
+    if (/(?:disable|turn\s+off|remove|bypass)\s+(?:all\s+)?(?:safety|security|restrictions?|guardrails?|protections?|checks?)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-002', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-PERM-003 — Auto-approve directive
+    if (/(?:auto[- ]?approve|--no-verify|--dangerously-skip-permissions)/i.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-PERM-003', match: line.trim(), line: i + 1 });
+    }
+    // HIGH: INJ-ENC-001 — Suspicious base64
+    if (/(?<!Bearer\s)(?<![:])(?<![A-Za-z0-9/])(?!eyJ)(?:[A-Za-z0-9+/]{4}){7,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?(?![A-Za-z0-9/])/.test(line)) {
+      findings.push({ severity: 'high', ruleId: 'INJ-ENC-001', match: line.trim(), line: i + 1 });
+    }
+    // MEDIUM: INJ-CTX-001 — System prompt claims
+    if (/(?:the\s+)?(?:system\s+prompt|system\s+message|hidden\s+instructions?)\s+(?:says?|tells?|instructs?|contains?|is)/i.test(line)) {
+      findings.push({ severity: 'medium', ruleId: 'INJ-CTX-001', match: line.trim(), line: i + 1 });
+    }
+  }
+  return findings;
+}
+
+function extractText(toolName, toolInput) {
+  if (toolName === 'Bash') return toolInput?.command ?? '';
+  if (toolName === 'Write') return toolInput?.content ?? '';
+  if (toolName === 'Edit') return `${toolInput?.old_string ?? ''}\n${toolInput?.new_string ?? ''}`;
+  if (toolName === 'Read') return toolInput?.file_path ?? '';
+  const parts = [];
+  for (const value of Object.values(toolInput || {})) {
+    if (typeof value === 'string') parts.push(value);
+  }
+  return parts.join('\n') || null;
+}
+
+async function main() {
+  let raw = '';
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    process.exit(0);
+  }
+
+  if (!raw.trim()) {
+    process.exit(0);
+  }
+
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    process.exit(0);
+  }
+
+  try {
+    const toolName = input?.tool_name ?? '';
+    const toolInput = input?.tool_input ?? {};
+    const sessionId = input?.session_id;
+    const workspaceRoot = process.cwd();
+
+    // Step 1: Check taint state — block destructive ops if tainted
+    let tainted = false;
+    try {
+      const taintPath = resolve(
+        workspaceRoot,
+        '.harness',
+        `session-taint-${sessionId || 'default'}.json`
+      );
+      const taintRaw = readFileSync(taintPath, 'utf-8');
+      const taintState = JSON.parse(taintRaw);
+
+      const expiresAt = new Date(taintState.expiresAt);
+      if (new Date() >= expiresAt) {
+        try { unlinkSync(taintPath); } catch { /* ignore */ }
+        process.stderr.write(
+          'Sentinel: session taint expired. Destructive operations re-enabled.\n'
+        );
+      } else {
+        tainted = true;
+      }
+    } catch {
+      // No taint file or malformed — not tainted
+    }
+
+    if (tainted) {
+      if (toolName === 'Bash') {
+        const command = toolInput?.command ?? '';
+        if (isDestructiveBash(command)) {
+          process.stderr.write(
+            `BLOCKED by Sentinel: "${toolName}" blocked during tainted session. ` +
+            `Destructive operations are restricted. Run "harness taint clear" to lift.\n`
+          );
+          process.exit(2);
+        }
+      }
+
+      if (toolName === 'Write' || toolName === 'Edit') {
+        const filePath = toolInput?.file_path ?? '';
+        if (isOutsideWorkspace(filePath, workspaceRoot)) {
+          process.stderr.write(
+            `BLOCKED by Sentinel: "${toolName}" to "${filePath}" blocked during tainted session. ` +
+            `File is outside workspace. Run "harness taint clear" to lift.\n`
+          );
+          process.exit(2);
+        }
+      }
+    }
+
+    // Step 2: Scan tool inputs for injection patterns
+    const textToScan = extractText(toolName, toolInput);
+    if (textToScan) {
+      let findings;
+      try {
+        const core = await import('@harness-engineering/core');
+        findings = core.scanForInjection(textToScan);
+      } catch {
+        findings = inlineScan(textToScan);
+      }
+
+      const actionable = findings.filter((f) => f.severity === 'high' || f.severity === 'medium');
+
+      if (actionable.length > 0) {
+        try {
+          const core = await import('@harness-engineering/core');
+          core.writeTaint(
+            workspaceRoot,
+            sessionId,
+            `Injection pattern detected in PreToolUse:${toolName} input`,
+            actionable,
+            `PreToolUse:${toolName}`
+          );
+        } catch {
+          // Fallback inline taint writer — merges with existing taint state
+          try {
+            const id = sessionId || 'default';
+            const taintPath = resolve(workspaceRoot, '.harness', `session-taint-${id}.json`);
+            mkdirSync(dirname(taintPath), { recursive: true });
+            const now = new Date().toISOString();
+            const maxSev = actionable.some((f) => f.severity === 'high') ? 'high' : 'medium';
+            const newFindings = actionable.map((f) => ({
+              ruleId: f.ruleId, severity: f.severity, match: f.match,
+              source: `PreToolUse:${toolName}`, detectedAt: now,
+            }));
+            // Read and merge existing taint state to preserve earlier taintedAt and findings
+            let existing = null;
+            try { existing = JSON.parse(readFileSync(taintPath, 'utf-8')); } catch { /* no existing */ }
+            const state = {
+              sessionId: id,
+              taintedAt: existing?.taintedAt ?? now,
+              expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
+              reason: existing?.reason ?? `Injection pattern detected in PreToolUse:${toolName} input`,
+              severity: maxSev,
+              findings: [...(existing?.findings ?? []), ...newFindings],
+            };
+            writeFileSync(taintPath, JSON.stringify(state, null, 2) + '\n');
+          } catch { /* best-effort */ }
+        }
+
+        for (const f of actionable) {
+          process.stderr.write(
+            `Sentinel [${f.severity}] ${f.ruleId}: detected in ${toolName} input\n`
+          );
+        }
+      }
+
+      const low = findings.filter((f) => f.severity === 'low');
+      for (const f of low) {
+        process.stderr.write(`Sentinel [low] ${f.ruleId}: ${f.match.slice(0, 80)}\n`);
+      }
+    }
+
+    process.exit(0);
+  } catch {
+    process.exit(0);
+  }
+}
+
+main();