@harness-engineering/cli 2.5.0 → 2.6.0

package/dist/{chunk-KQ6TDRPS.js → chunk-YYRQCQPZ.js}

@@ -31,13 +31,15 @@ import {
   resetParserCache,
   resolveFileToLayer,
   validateDependencies
-} from "./chunk-IWRYCUDO.js";
+} from "./chunk-SZEFU6XC.js";
 import {
   AuthAuditEntrySchema,
   AuthTokenPublicSchema,
   AuthTokenSchema,
   BridgeKindSchema,
   DEFAULT_SKILL_CONTEXT_BUDGET,
+  EditProposalInputSchema,
+  EmitSkillProposalInputSchema,
   Err,
   GatewayEventSchema,
   INDEXED_FILE_KINDS,
@@ -53,10 +55,19 @@ import {
   OTLPSpanSchema,
   Ok,
   PromptCacheStatsSchema,
+  ProposalContentSchema,
+  ProposalDecisionSchema,
+  ProposalGateFindingSchema,
+  ProposalGateSchema,
+  ProposalKindSchema,
+  ProposalSourceSchema,
+  ProposalStatusSchema,
   SESSIONS_DEFAULTS,
   SESSION_SECTION_NAMES,
   STANDARD_COGNITIVE_MODES,
   SessionSummarySchema,
+  SkillProposalSchema,
+  SkillProvenanceSchema,
   TokenScopeSchema,
   TrajectoryMetadataSchema,
   WebhookDeliverySchema,
@@ -66,7 +77,7 @@ import {
   init_dist,
   isErr,
   isOk
-} from "./chunk-2LPUIBVH.js";
+} from "./chunk-OH3NXXUY.js";
 import {
   DEFAULT_SKIP_DIRS,
   GraphStore,
@@ -1296,10 +1307,12 @@ __export(dist_exports, {
   ETagStore: () => ETagStore,
   EVIDENCE_SATURATION: () => EVIDENCE_SATURATION,
   EXTENSION_MAP: () => EXTENSION_MAP,
+  EditProposalInputSchema: () => EditProposalInputSchema,
   EmergenceConfidenceSchema: () => EmergenceConfidenceSchema,
   EmergenceResultSchema: () => EmergenceResultSchema,
   EmergentConstraintSuggestionSchema: () => EmergentConstraintSuggestionSchema,
   EmitInteractionInputSchema: () => EmitInteractionInputSchema,
+  EmitSkillProposalInputSchema: () => EmitSkillProposalInputSchema,
   EntropyAnalyzer: () => EntropyAnalyzer,
   EntropyConfigSchema: () => EntropyConfigSchema,
   Err: () => Err,
@@ -1354,6 +1367,15 @@ __export(dist_exports, {
   PredictionWarningSchema: () => PredictionWarningSchema,
   ProjectScanner: () => ProjectScanner,
   PromptCacheStatsSchema: () => PromptCacheStatsSchema,
+  ProposalConflictError: () => ProposalConflictError,
+  ProposalContentSchema: () => ProposalContentSchema,
+  ProposalDecisionSchema: () => ProposalDecisionSchema,
+  ProposalGateFindingSchema: () => ProposalGateFindingSchema,
+  ProposalGateSchema: () => ProposalGateSchema,
+  ProposalKindSchema: () => ProposalKindSchema,
+  ProposalNotFoundError: () => ProposalNotFoundError,
+  ProposalSourceSchema: () => ProposalSourceSchema,
+  ProposalStatusSchema: () => ProposalStatusSchema,
   PulseAdapterAlreadyRegisteredError: () => PulseAdapterAlreadyRegisteredError,
   PulseConfigSchema: () => PulseConfigSchema,
   PulseDbSourceSchema: () => PulseDbSourceSchema,
@@ -1384,6 +1406,8 @@ __export(dist_exports, {
   SharableLayerSchema: () => SharableLayerSchema,
   SharableSecurityRulesSchema: () => SharableSecurityRulesSchema,
   SkillEventSchema: () => SkillEventSchema,
+  SkillProposalSchema: () => SkillProposalSchema,
+  SkillProvenanceSchema: () => SkillProvenanceSchema,
   SolutionDocFrontmatterSchema: () => SolutionDocFrontmatterSchema,
   SpanKind: () => SpanKind,
   SpecImpactEstimateSchema: () => SpecImpactEstimateSchema,
@@ -1487,7 +1511,9 @@ __export(dist_exports, {
   createFixes: () => createFixes,
   createForbiddenImportFixes: () => createForbiddenImportFixes,
   createOrphanedDepFixes: () => createOrphanedDepFixes,
+  createOsvClient: () => createOsvClient,
   createParseError: () => createParseError,
+  createProposal: () => createProposal,
   createRegionMap: () => createRegionMap,
   createSelfReview: () => createSelfReview,
   createStream: () => createStream,
@@ -1499,6 +1525,7 @@ __export(dist_exports, {
   deepMergeConstraints: () => deepMergeConstraints,
   defaultCollectors: () => defaultCollectors,
   defineLayer: () => defineLayer,
+  deriveSkillUsage: () => deriveSkillUsage,
   deserializationRules: () => deserializationRules,
   detectChangeType: () => detectChangeType,
   detectCircularDeps: () => detectCircularDeps,
@@ -1551,6 +1578,7 @@ __export(dist_exports, {
   getOutline: () => getOutline,
   getParser: () => getParser,
   getPhaseCategories: () => getPhaseCategories,
+  getProposal: () => getProposal,
   getPulseAdapter: () => getPulseAdapter,
   getRoadmapMode: () => getRoadmapMode,
   getStreamForBranch: () => getStreamForBranch,
@@ -1572,6 +1600,7 @@ __export(dist_exports, {
   isUpdateCheckEnabled: () => isUpdateCheckEnabled,
   isoWeek: () => isoWeek,
   listActiveSessions: () => listActiveSessions,
+  listProposals: () => listProposals,
   listPulseAdapters: () => listPulseAdapters,
   listStreams: () => listStreams,
   listTaintedSessions: () => listTaintedSessions,
@@ -1622,6 +1651,7 @@ __export(dist_exports, {
   previewFix: () => previewFix,
   projectValue: () => projectValue,
   promoteSessionLearnings: () => promoteSessionLearnings,
+  proposalsDir: () => proposalsDir,
   pruneLearnings: () => pruneLearnings,
   reactRules: () => reactRules,
   readAdoptionRecords: () => readAdoptionRecords,
@@ -1694,6 +1724,7 @@ __export(dist_exports, {
   trackAction: () => trackAction,
   unfoldRange: () => unfoldRange,
   unfoldSymbol: () => unfoldSymbol,
+  updateProposal: () => updateProposal,
   updateSessionEntryStatus: () => updateSessionEntryStatus,
   updateSessionIndex: () => updateSessionIndex,
   validateAgentConfigs: () => validateAgentConfigs,
@@ -1828,71 +1859,76 @@ import { minimatch as minimatch3 } from "minimatch";
 import { z as z9 } from "zod";
 import * as fs28 from "fs";
 import * as path25 from "path";
+import * as fs30 from "fs";
+import * as path26 from "path";
 import { readFileSync as readFileSync22, writeFileSync as writeFileSync14, unlinkSync as unlinkSync2, mkdirSync as mkdirSync13, readdirSync as readdirSync3 } from "fs";
-import { join as join372, dirname as dirname9 } from "path";
+import { join as join382, dirname as dirname10 } from "path";
 import { createHash as createHash32 } from "crypto";
 import { z as z10 } from "zod";
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync15, renameSync as renameSync72, mkdirSync as mkdirSync14, existsSync as existsSync342 } from "fs";
 import { execSync as execSync3 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { isAbsolute as isAbsolute4, join as join38, relative as relative3, dirname as dirname10 } from "path";
-import * as path26 from "path";
+import { isAbsolute as isAbsolute4, join as join39, relative as relative3, dirname as dirname11 } from "path";
 import * as path27 from "path";
 import * as path28 from "path";
 import * as path29 from "path";
-import * as fs30 from "fs";
 import * as path30 from "path";
 import * as fs31 from "fs";
 import * as path31 from "path";
 import * as fs32 from "fs";
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
-import * as fs33 from "fs";
 import * as path32 from "path";
+import * as fs33 from "fs";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import * as fs34 from "fs";
 import * as path33 from "path";
-import { createHash as createHash4 } from "crypto";
+import * as fs35 from "fs";
 import * as path34 from "path";
-import { z as z11 } from "zod";
-import * as fs35 from "fs/promises";
+import { createHash as createHash4 } from "crypto";
 import * as path35 from "path";
+import { z as z11 } from "zod";
 import * as fs36 from "fs/promises";
 import * as path36 from "path";
-import * as ejs from "ejs";
-import * as fs37 from "fs";
+import * as fs37 from "fs/promises";
 import * as path37 from "path";
+import * as ejs from "ejs";
+import * as fs38 from "fs";
+import * as path38 from "path";
 import * as os from "os";
 import { spawn as spawn2 } from "child_process";
-import * as fs38 from "fs/promises";
-import * as path38 from "path";
-import * as fs39 from "fs";
+import * as fs39 from "fs/promises";
 import * as path39 from "path";
 import * as fs40 from "fs";
 import * as path40 from "path";
-import * as os2 from "os";
 import * as fs41 from "fs";
 import * as path41 from "path";
+import * as os2 from "os";
 import * as fs42 from "fs";
 import * as path42 from "path";
-import * as fs44 from "fs";
-import * as path44 from "path";
-import { execFileSync as execFileSync2 } from "child_process";
 import * as fs43 from "fs";
 import * as path43 from "path";
-import * as crypto4 from "crypto";
 import * as fs45 from "fs";
 import * as path45 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+import * as fs44 from "fs";
+import * as path44 from "path";
+import * as crypto4 from "crypto";
 import * as fs46 from "fs";
-import * as fs47 from "fs";
 import * as path46 from "path";
+import * as fs47 from "fs";
+import * as fs48 from "fs";
+import * as path47 from "path";
 import { readFileSync as readFileSync392 } from "fs";
 import { fileURLToPath } from "url";
-import { dirname as dirname15, join as join602 } from "path";
+import { dirname as dirname16, join as join612 } from "path";
 import { execFile } from "child_process";
 import { promisify as promisify2 } from "util";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify3 } from "util";
-import * as fs48 from "fs/promises";
-import * as path47 from "path";
+import * as fs49 from "fs/promises";
+import * as path48 from "path";
+import * as fs50 from "fs";
+import * as path49 from "path";
+import { randomUUID as randomUUID2 } from "crypto";
 function isBadPort(port) {
   return BAD_PORT_SET.has(port);
 }
@@ -1938,15 +1974,15 @@ function validateConfig(data, schema) {
   let message = "Configuration validation failed";
   const suggestions = [];
   if (firstError) {
-    const path48 = firstError.path.join(".");
-    const pathDisplay = path48 ? ` at "${path48}"` : "";
+    const path50 = firstError.path.join(".");
+    const pathDisplay = path50 ? ` at "${path50}"` : "";
     if (firstError.code === "invalid_type") {
       const received = firstError.received;
       const expected = firstError.expected;
       if (received === "undefined") {
         code = "MISSING_FIELD";
         message = `Missing required field${pathDisplay}: ${firstError.message}`;
-        suggestions.push(`Field "${path48}" is required and must be of type "${expected}"`);
+        suggestions.push(`Field "${path50}" is required and must be of type "${expected}"`);
       } else {
         code = "INVALID_TYPE";
         message = `Invalid type${pathDisplay}: ${firstError.message}`;
@@ -2280,16 +2316,16 @@ function makeFinding(input) {
   if (input.suggestion) finding.suggestion = input.suggestion;
   return finding;
 }
-function readTextSafe(path48) {
+function readTextSafe(path50) {
   try {
-    return readFileSync2(path48, "utf-8");
+    return readFileSync2(path50, "utf-8");
   } catch {
     return null;
   }
 }
-function safeFileSize(path48) {
+function safeFileSize(path50) {
   try {
-    return statSync(path48).size;
+    return statSync(path50).size;
   } catch {
     return null;
   }
@@ -2834,27 +2870,27 @@ function extractSections(content) {
   }
   return sections.map((section) => buildAgentMapSection(section, lines));
 }
-function isExternalLink(path48) {
-  return path48.startsWith("http://") || path48.startsWith("https://") || path48.startsWith("#") || path48.startsWith("mailto:");
+function isExternalLink(path50) {
+  return path50.startsWith("http://") || path50.startsWith("https://") || path50.startsWith("#") || path50.startsWith("mailto:");
 }
 function resolveLinkPath(linkPath, baseDir) {
   return linkPath.startsWith(".") ? join8(baseDir, linkPath) : linkPath;
 }
-async function validateAgentsMap(path48 = "./AGENTS.md") {
-  const contentResult = await readFileContent(path48);
+async function validateAgentsMap(path50 = "./AGENTS.md") {
+  const contentResult = await readFileContent(path50);
   if (!contentResult.ok) {
     return Err(
       createError(
         "PARSE_ERROR",
         `Failed to read AGENTS.md: ${contentResult.error.message}`,
-        { path: path48 },
+        { path: path50 },
         ["Ensure the file exists", "Check file permissions"]
       )
     );
   }
   const content = contentResult.value;
   const sections = extractSections(content);
-  const baseDir = dirname22(path48);
+  const baseDir = dirname22(path50);
   const sectionTitles = sections.map((s) => s.title);
   const missingSections = REQUIRED_SECTIONS.filter(
     (required) => !sectionTitles.some((title) => title.toLowerCase().includes(required.toLowerCase()))
@@ -3402,8 +3438,8 @@ async function checkDocCoverage(domain, options = {}) {
     );
   }
 }
-function suggestFix(path48, existingFiles) {
-  const targetName = basename3(path48).toLowerCase();
+function suggestFix(path50, existingFiles) {
+  const targetName = basename3(path50).toLowerCase();
   const similar = existingFiles.find((file) => {
     const fileName = basename3(file).toLowerCase();
     return fileName.includes(targetName) || targetName.includes(fileName);
@@ -3411,7 +3447,7 @@ function suggestFix(path48, existingFiles) {
   if (similar) {
     return `Did you mean "${similar}"?`;
   }
-  return `Create the file "${path48}" or remove the link`;
+  return `Create the file "${path50}" or remove the link`;
 }
 async function validateKnowledgeMap(rootDir = process.cwd()) {
   const agentsPath = join14(rootDir, "AGENTS.md");
@@ -3769,8 +3805,8 @@ function createBoundaryValidator(schema, name) {
         return Ok(result.data);
       }
       const suggestions = result.error.issues.map((issue) => {
-        const path48 = issue.path.join(".");
-        return path48 ? `${path48}: ${issue.message}` : issue.message;
+        const path50 = issue.path.join(".");
+        return path50 ? `${path50}: ${issue.message}` : issue.message;
       });
       return Err(
         createError(
@@ -4775,7 +4811,7 @@ function arrayLen(arr) {
   return Array.isArray(arr) ? arr.length : 0;
 }
 async function gatherEntropyBlock(projectPath) {
-  const { EntropyAnalyzer: EntropyAnalyzer2 } = await import("./analyzer-VY6DJVOU-NI56JRFK.js");
+  const { EntropyAnalyzer: EntropyAnalyzer2 } = await import("./analyzer-VY6DJVOU-4AHIJLNS.js");
   const analyzer = new EntropyAnalyzer2({
     rootDir: projectPath,
     include: ["src/**/*.ts", "src/**/*.tsx", "packages/*/src/**/*.ts"],
@@ -4971,12 +5007,12 @@ function parseDiffHeader(part) {
   return headerMatch[2];
 }
 function parseDiffPart(part) {
-  const path48 = parseDiffHeader(part);
-  if (!path48) return null;
+  const path50 = parseDiffHeader(part);
+  if (!path50) return null;
   const additionRegex = /^\+(?!\+\+)/gm;
   const deletionRegex = /^-(?!--)/gm;
   return {
-    path: path48,
+    path: path50,
     status: detectFileStatus(part),
     additions: (part.match(additionRegex) || []).length,
     deletions: (part.match(deletionRegex) || []).length
@@ -7614,6 +7650,91 @@ function parseHarnessIgnore(line, ruleId) {
   const text = match[2]?.trim();
   return { ruleId, justification: text || null };
 }
+function createOsvClient(options = {}) {
+  const cacheDir = options.cacheDir ?? DEFAULT_CACHE_DIR;
+  const ttlMs = (options.cacheTtlHours ?? DEFAULT_TTL_HOURS) * 60 * 60 * 1e3;
+  const fetchFn = options.fetchFn ?? globalThis.fetch;
+  const logger = options.logger ?? { warn: (m, ctx) => console.warn(m, ctx) };
+  const strict = options.strict ?? false;
+  return {
+    async check(pkg) {
+      const cacheKey = `${pkg.ecosystem}-${sanitizePkgName(pkg.name)}@${pkg.version ?? "latest"}.json`;
+      const cachePath = path26.join(cacheDir, cacheKey);
+      const cached = await readCache(cachePath, ttlMs);
+      if (cached) {
+        return { ...cached, source: "cache" };
+      }
+      try {
+        const advisories = await queryOsv(fetchFn, pkg);
+        const result = classify(advisories);
+        await writeCache(cachePath, result);
+        return { ...result, source: "network" };
+      } catch (err) {
+        const message = `OSV query failed for ${pkg.name}@${pkg.version ?? "latest"}: ${String(err)}`;
+        if (strict) {
+          throw new Error(message, { cause: err });
+        }
+        logger.warn(message, { pkg });
+        return { malicious: [], other: [], source: "fail-open" };
+      }
+    },
+    async clearCache() {
+      try {
+        await fs30.promises.rm(cacheDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  };
+}
+async function queryOsv(fetchFn, pkg) {
+  const body = {
+    package: { ecosystem: pkg.ecosystem, name: pkg.name }
+  };
+  if (pkg.version) body.version = pkg.version;
+  const response = await fetchFn(OSV_ENDPOINT, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    throw new Error(`OSV returned HTTP ${response.status}`);
+  }
+  const json = await response.json();
+  return json.vulns ?? [];
+}
+function classify(advisories) {
+  const malicious = [];
+  const other = [];
+  for (const a of advisories) {
+    if (typeof a?.id === "string" && a.id.startsWith("MAL-")) {
+      malicious.push(a);
+    } else {
+      other.push(a);
+    }
+  }
+  return { malicious, other };
+}
+async function readCache(cachePath, ttlMs) {
+  try {
+    const stat2 = await fs30.promises.stat(cachePath);
+    if (Date.now() - stat2.mtimeMs > ttlMs) return null;
+    const buf = await fs30.promises.readFile(cachePath, "utf-8");
+    const parsed = JSON.parse(buf);
+    return { malicious: parsed.malicious ?? [], other: parsed.other ?? [] };
+  } catch {
+    return null;
+  }
+}
+async function writeCache(cachePath, payload) {
+  try {
+    await fs30.promises.mkdir(path26.dirname(cachePath), { recursive: true });
+    await fs30.promises.writeFile(cachePath, JSON.stringify(payload, null, 2), "utf-8");
+  } catch {
+  }
+}
+function sanitizePkgName(name) {
+  return name.replace(/[/\\]/g, "__");
+}
 function scanForInjection(text) {
   const findings = [];
   const lines = text.split("\n");
@@ -7643,7 +7764,7 @@ function getInjectionPatterns() {
 }
 function getTaintFilePath(projectRoot, sessionId) {
   const id = sessionId || DEFAULT_SESSION_ID;
-  return join372(projectRoot, ".harness", `session-taint-${id}.json`);
+  return join382(projectRoot, ".harness", `session-taint-${id}.json`);
 }
 function readTaint(projectRoot, sessionId) {
   const filePath = getTaintFilePath(projectRoot, sessionId);
@@ -7693,7 +7814,7 @@ function writeTaint(projectRoot, sessionId, reason, findings, source) {
   const id = sessionId || DEFAULT_SESSION_ID;
   const filePath = getTaintFilePath(projectRoot, id);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const dir = dirname9(filePath);
+  const dir = dirname10(filePath);
   mkdirSync13(dir, { recursive: true });
   const existing = readTaint(projectRoot, id);
   const maxSeverity = findings.some((f) => f.severity === "high") ? "high" : "medium";
@@ -7725,14 +7846,14 @@ function clearTaint(projectRoot, sessionId) {
       return 0;
     }
   }
-  const harnessDir = join372(projectRoot, ".harness");
+  const harnessDir = join382(projectRoot, ".harness");
   let count = 0;
   try {
     const files = readdirSync3(harnessDir);
     for (const file of files) {
       if (file.startsWith("session-taint-") && file.endsWith(".json")) {
         try {
-          unlinkSync2(join372(harnessDir, file));
+          unlinkSync2(join382(harnessDir, file));
           count++;
         } catch {
         }
@@ -7743,7 +7864,7 @@ function clearTaint(projectRoot, sessionId) {
   return count;
 }
 function listTaintedSessions(projectRoot) {
-  const harnessDir = join372(projectRoot, ".harness");
+  const harnessDir = join382(projectRoot, ".harness");
   const sessions = [];
   try {
     const files = readdirSync3(harnessDir);
@@ -7815,7 +7936,7 @@ function securityFindingId(finding) {
 }
 async function runValidateCheck(projectRoot, config) {
   const issues = [];
-  const agentsPath = path26.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
+  const agentsPath = path27.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
   const result = await validateAgentsMap(agentsPath);
   if (!result.ok) {
     issues.push({ severity: "error", message: result.error.message });
@@ -7872,7 +7993,7 @@ async function runDepsCheck(projectRoot, config) {
 }
 async function runDocsCheck(projectRoot, config) {
   const issues = [];
-  const docsDir = path26.join(projectRoot, config.docsDir ?? "docs");
+  const docsDir = path27.join(projectRoot, config.docsDir ?? "docs");
   const entropyConfig = config.entropy || {};
   const result = await checkDocCoverage("project", {
     docsDir,
@@ -8051,7 +8172,7 @@ async function runTraceabilityCheck(projectRoot, config) {
   const issues = [];
   const traceConfig = config.traceability || {};
   if (traceConfig.enabled === false) return issues;
-  const graphDir = path26.join(projectRoot, ".harness", "graph");
+  const graphDir = path27.join(projectRoot, ".harness", "graph");
   const store = new GraphStore();
   const loaded = await store.load(graphDir);
   if (!loaded) {
@@ -8229,7 +8350,7 @@ async function runMechanicalChecks(options) {
   };
   if (!skip.includes("validate")) {
     try {
-      const agentsPath = path27.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
+      const agentsPath = path28.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
       const result = await validateAgentsMap(agentsPath);
       if (!result.ok) {
         statuses.validate = "fail";
@@ -8266,7 +8387,7 @@ async function runMechanicalChecks(options) {
       statuses.validate = "fail";
       findings.push({
         tool: "validate",
-        file: path27.join(projectRoot, "AGENTS.md"),
+        file: path28.join(projectRoot, "AGENTS.md"),
         message: err instanceof Error ? err.message : String(err),
         severity: "error"
       });
@@ -8330,7 +8451,7 @@ async function runMechanicalChecks(options) {
       (async () => {
         const localFindings = [];
         try {
-          const docsDir = path27.join(projectRoot, config.docsDir ?? "docs");
+          const docsDir = path28.join(projectRoot, config.docsDir ?? "docs");
           const result = await checkDocCoverage("project", { docsDir });
           if (!result.ok) {
             statuses["check-docs"] = "warn";
@@ -8357,7 +8478,7 @@ async function runMechanicalChecks(options) {
           statuses["check-docs"] = "warn";
           localFindings.push({
             tool: "check-docs",
-            file: path27.join(projectRoot, "docs"),
+            file: path28.join(projectRoot, "docs"),
             message: err instanceof Error ? err.message : String(err),
             severity: "warning"
           });
@@ -8454,18 +8575,18 @@ function computeContextBudget(diffLines) {
   return diffLines;
 }
 function isWithinProject(absPath, projectRoot) {
-  const resolvedRoot = path28.resolve(projectRoot) + path28.sep;
-  const resolvedPath = path28.resolve(absPath);
-  return resolvedPath.startsWith(resolvedRoot) || resolvedPath === path28.resolve(projectRoot);
+  const resolvedRoot = path29.resolve(projectRoot) + path29.sep;
+  const resolvedPath = path29.resolve(absPath);
+  return resolvedPath.startsWith(resolvedRoot) || resolvedPath === path29.resolve(projectRoot);
 }
 async function readContextFile(projectRoot, filePath, reason) {
-  const absPath = path28.isAbsolute(filePath) ? filePath : path28.join(projectRoot, filePath);
+  const absPath = path29.isAbsolute(filePath) ? filePath : path29.join(projectRoot, filePath);
   if (!isWithinProject(absPath, projectRoot)) return null;
   const result = await readFileContent(absPath);
   if (!result.ok) return null;
   const content = result.value;
   const lines = content.split("\n").length;
-  const relPath2 = path28.isAbsolute(filePath) ? relativePosix(projectRoot, filePath) : filePath;
+  const relPath2 = path29.isAbsolute(filePath) ? relativePosix(projectRoot, filePath) : filePath;
   return { path: relPath2, content, reason, lines };
 }
 function extractImportSources2(content) {
@@ -8480,24 +8601,24 @@ function extractImportSources2(content) {
 }
 async function resolveImportPath(projectRoot, fromFile, importSource) {
   if (!importSource.startsWith(".")) return null;
-  const fromDir = path28.dirname(path28.join(projectRoot, fromFile));
-  const basePath = path28.resolve(fromDir, importSource);
+  const fromDir = path29.dirname(path29.join(projectRoot, fromFile));
+  const basePath = path29.resolve(fromDir, importSource);
   if (!isWithinProject(basePath, projectRoot)) return null;
   const relBase = relativePosix(projectRoot, basePath);
-  const sourceExt = path28.extname(relBase);
+  const sourceExt = path29.extname(relBase);
   const candidates = [];
   const fallbacks = JS_EXT_FALLBACKS[sourceExt];
   if (fallbacks) {
     const stripped = relBase.slice(0, -sourceExt.length);
     for (const ext of fallbacks) candidates.push(stripped + ext);
-    candidates.push(path28.join(stripped, "index.ts"));
-    candidates.push(path28.join(stripped, "index.tsx"));
-    candidates.push(path28.join(stripped, "index.jsx"));
+    candidates.push(path29.join(stripped, "index.ts"));
+    candidates.push(path29.join(stripped, "index.tsx"));
+    candidates.push(path29.join(stripped, "index.jsx"));
   }
   candidates.push(relBase + ".ts", relBase + ".tsx", relBase + ".mts");
-  candidates.push(path28.join(relBase, "index.ts"));
+  candidates.push(path29.join(relBase, "index.ts"));
   for (const candidate of candidates) {
-    const absCandidate = path28.join(projectRoot, candidate);
+    const absCandidate = path29.join(projectRoot, candidate);
     if (await fileExists(absCandidate)) {
       return candidate;
     }
@@ -8505,7 +8626,7 @@ async function resolveImportPath(projectRoot, fromFile, importSource) {
   return null;
 }
 async function findTestFiles(projectRoot, sourceFile) {
-  const baseName = path28.basename(sourceFile, path28.extname(sourceFile));
+  const baseName = path29.basename(sourceFile, path29.extname(sourceFile));
   const pattern = `**/${baseName}.{test,spec}.{ts,tsx,mts}`;
   const results = await findFiles(pattern, projectRoot);
   return results.map((f) => relativePosix(projectRoot, f));
@@ -9273,7 +9394,7 @@ function normalizePath(filePath, projectRoot) {
   let normalized = filePath;
   normalized = normalized.replace(/\\/g, "/");
   const normalizedRoot = projectRoot.replace(/\\/g, "/");
-  if (path29.isAbsolute(normalized)) {
+  if (path30.isAbsolute(normalized)) {
     const root = normalizedRoot.endsWith("/") ? normalizedRoot : normalizedRoot + "/";
     if (normalized.startsWith(root)) {
       normalized = normalized.slice(root.length);
@@ -9285,12 +9406,12 @@ function normalizePath(filePath, projectRoot) {
   return normalized;
 }
 function resolveImportPath2(currentFile, importPath) {
-  const dir = path29.dirname(currentFile);
-  let resolved = path29.join(dir, importPath).replace(/\\/g, "/");
+  const dir = path30.dirname(currentFile);
+  let resolved = path30.join(dir, importPath).replace(/\\/g, "/");
   if (!resolved.match(/\.(ts|tsx|js|jsx)$/)) {
     resolved += ".ts";
   }
-  return path29.normalize(resolved).replace(/\\/g, "/");
+  return path30.normalize(resolved).replace(/\\/g, "/");
 }
 function enqueueImports(content, current, visited, queue, maxDepth) {
   const importRegex = /import\s+.*?from\s+['"]([^'"]+)['"]/g;
@@ -9322,7 +9443,7 @@ function isMechanicallyExcluded(finding, exclusionSet, projectRoot) {
   const normalizedFile = normalizePath(finding.file, projectRoot);
   if (exclusionSet.isExcluded(normalizedFile, finding.lineRange)) return true;
   if (exclusionSet.isExcluded(finding.file, finding.lineRange)) return true;
-  const absoluteFile = path29.isAbsolute(finding.file) ? finding.file : path29.join(projectRoot, finding.file).replace(/\\/g, "/");
+  const absoluteFile = path30.isAbsolute(finding.file) ? finding.file : path30.join(projectRoot, finding.file).replace(/\\/g, "/");
   return exclusionSet.isExcluded(absoluteFile, finding.lineRange);
 }
 async function validateWithGraph(crossFileRefs, graph) {
@@ -10330,7 +10451,7 @@ function isRegression(from, to) {
 }
 function collectAutopilotStatuses(autopilotPath, featurePlans, allTaskStatuses) {
   try {
-    const raw = fs30.readFileSync(autopilotPath, "utf-8");
+    const raw = fs31.readFileSync(autopilotPath, "utf-8");
     const autopilot = JSON.parse(raw);
     if (!autopilot.phases) return;
     const linkedPhases = autopilot.phases.filter(
@@ -10362,10 +10483,10 @@ function inferStatus(feature, projectPath, allFeatures) {
   const featuresWithPlans = allFeatures.filter((f) => f.plans.length > 0);
   const useRootState = featuresWithPlans.length <= 1;
   if (useRootState) {
-    const rootStatePath = path30.join(projectPath, ".harness", "state.json");
-    if (fs30.existsSync(rootStatePath)) {
+    const rootStatePath = path31.join(projectPath, ".harness", "state.json");
+    if (fs31.existsSync(rootStatePath)) {
       try {
-        const raw = fs30.readFileSync(rootStatePath, "utf-8");
+        const raw = fs31.readFileSync(rootStatePath, "utf-8");
         const state = JSON.parse(raw);
         if (state.progress) {
           for (const status of Object.values(state.progress)) {
@@ -10376,14 +10497,14 @@ function inferStatus(feature, projectPath, allFeatures) {
       }
     }
   }
-  const sessionsDir = path30.join(projectPath, ".harness", "sessions");
-  if (fs30.existsSync(sessionsDir)) {
+  const sessionsDir = path31.join(projectPath, ".harness", "sessions");
+  if (fs31.existsSync(sessionsDir)) {
     try {
-      const sessionDirs = fs30.readdirSync(sessionsDir, { withFileTypes: true });
+      const sessionDirs = fs31.readdirSync(sessionsDir, { withFileTypes: true });
       for (const entry of sessionDirs) {
         if (!entry.isDirectory()) continue;
-        const autopilotPath = path30.join(sessionsDir, entry.name, "autopilot-state.json");
-        if (!fs30.existsSync(autopilotPath)) continue;
+        const autopilotPath = path31.join(sessionsDir, entry.name, "autopilot-state.json");
+        if (!fs31.existsSync(autopilotPath)) continue;
         collectAutopilotStatuses(autopilotPath, feature.plans, allTaskStatuses);
       }
     } catch {
@@ -10498,9 +10619,9 @@ function isValidTrackerShape(tracker) {
 }
 function loadTrackerSyncConfig(projectRoot) {
   try {
-    const configPath = path31.join(projectRoot, "harness.config.json");
-    if (!fs31.existsSync(configPath)) return null;
-    const raw = fs31.readFileSync(configPath, "utf-8");
+    const configPath = path32.join(projectRoot, "harness.config.json");
+    if (!fs32.existsSync(configPath)) return null;
+    const raw = fs32.readFileSync(configPath, "utf-8");
     const config = JSON.parse(raw);
     const tracker = config.roadmap?.tracker;
     if (!isValidTrackerShape(tracker)) return null;
@@ -10620,7 +10741,7 @@ async function fullSync(roadmapPath, adapter2, config, options) {
   });
   await previousSync;
   try {
-    const raw = fs32.readFileSync(roadmapPath, "utf-8");
+    const raw = fs33.readFileSync(roadmapPath, "utf-8");
     const parseResult = parseRoadmap(raw);
     if (!parseResult.ok) {
       return {
@@ -10633,7 +10754,7 @@ async function fullSync(roadmapPath, adapter2, config, options) {
     const tickets = fetchResult.ok ? fetchResult.value : void 0;
     const pushResult = await syncToExternal(roadmap, adapter2, config, tickets);
     const pullResult = await syncFromExternal(roadmap, adapter2, config, options);
-    fs32.writeFileSync(roadmapPath, serializeRoadmap(roadmap), "utf-8");
+    fs33.writeFileSync(roadmapPath, serializeRoadmap(roadmap), "utf-8");
     return {
       created: pushResult.created,
       updated: pushResult.updated,
@@ -10986,9 +11107,9 @@ function makeTrackerConflictBody(err, opts = {}) {
 }
 function loadProjectRoadmapMode(projectRoot) {
   try {
-    const configPath = path32.join(projectRoot, "harness.config.json");
-    if (!fs33.existsSync(configPath)) return getRoadmapMode(null);
-    const raw = fs33.readFileSync(configPath, "utf-8");
+    const configPath = path33.join(projectRoot, "harness.config.json");
+    if (!fs34.existsSync(configPath)) return getRoadmapMode(null);
+    const raw = fs34.readFileSync(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     return getRoadmapMode(parsed);
   } catch {
@@ -10997,11 +11118,11 @@ function loadProjectRoadmapMode(projectRoot) {
 }
 function loadTrackerClientConfigFromProject(projectRoot) {
   try {
-    const configPath = path33.join(projectRoot, "harness.config.json");
-    if (!fs34.existsSync(configPath)) {
+    const configPath = path34.join(projectRoot, "harness.config.json");
+    if (!fs35.existsSync(configPath)) {
       return Err(new Error("harness.config.json not found"));
     }
-    const cfg = JSON.parse(fs34.readFileSync(configPath, "utf-8"));
+    const cfg = JSON.parse(fs35.readFileSync(configPath, "utf-8"));
     const tracker = cfg.roadmap?.tracker;
     if (!tracker) {
       return Err(
@@ -11207,10 +11328,10 @@ function mapAction(action) {
 }
 async function runMigrationPlan(plan, deps, opts) {
   const projectRoot = opts.projectRoot;
-  const roadmapPath = path34.join(projectRoot, "docs", "roadmap.md");
-  const archivedPath = path34.join(projectRoot, "docs", "roadmap.md.archived");
-  const configPath = path34.join(projectRoot, "harness.config.json");
-  const configBackupPath = path34.join(projectRoot, "harness.config.json.pre-migration");
+  const roadmapPath = path35.join(projectRoot, "docs", "roadmap.md");
+  const archivedPath = path35.join(projectRoot, "docs", "roadmap.md.archived");
+  const configPath = path35.join(projectRoot, "harness.config.json");
+  const configBackupPath = path35.join(projectRoot, "harness.config.json.pre-migration");
   const createdSoFar = [];
   const report = {
     created: 0,
@@ -11322,7 +11443,7 @@ async function runMigrationPlan(plan, deps, opts) {
 }
 function getStatePath() {
   const home = process.env["HOME"] || os.homedir();
-  return path37.join(home, ".harness", "update-check.json");
+  return path38.join(home, ".harness", "update-check.json");
 }
 function isUpdateCheckEnabled(configInterval) {
   if (process.env["HARNESS_NO_UPDATE_CHECK"] === "1") return false;
@@ -11335,13 +11456,13 @@ function shouldRunCheck(state, intervalMs) {
 }
 function invalidateCheckState() {
   try {
-    fs37.unlinkSync(getStatePath());
+    fs38.unlinkSync(getStatePath());
   } catch {
   }
 }
 function readCheckState() {
   try {
-    const raw = fs37.readFileSync(getStatePath(), "utf-8");
+    const raw = fs38.readFileSync(getStatePath(), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && "lastCheckTime" in parsed && typeof parsed.lastCheckTime === "number" && "currentVersion" in parsed && typeof parsed.currentVersion === "string") {
       const state = parsed;
@@ -11358,7 +11479,7 @@ function readCheckState() {
 }
 function spawnBackgroundCheck(currentVersion) {
   const statePath = getStatePath();
-  const stateDir = path37.dirname(statePath);
+  const stateDir = path38.dirname(statePath);
   const script = `
 const { execSync } = require('child_process');
 const fs = require('fs');
@@ -11601,14 +11722,14 @@ function getModelPrice(model, dataset) {
   return pricing;
 }
 function getCachePath(projectRoot) {
-  return path38.join(projectRoot, ".harness", "cache", "pricing.json");
+  return path39.join(projectRoot, ".harness", "cache", "pricing.json");
 }
 function getStalenessMarkerPath(projectRoot) {
-  return path38.join(projectRoot, ".harness", "cache", "staleness-marker.json");
+  return path39.join(projectRoot, ".harness", "cache", "staleness-marker.json");
 }
 async function readDiskCache(projectRoot) {
   try {
-    const raw = await fs38.readFile(getCachePath(projectRoot), "utf-8");
+    const raw = await fs39.readFile(getCachePath(projectRoot), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -11616,8 +11737,8 @@ async function readDiskCache(projectRoot) {
 }
 async function writeDiskCache(projectRoot, data) {
   const cachePath = getCachePath(projectRoot);
-  await fs38.mkdir(path38.dirname(cachePath), { recursive: true });
-  await fs38.writeFile(cachePath, JSON.stringify(data, null, 2));
+  await fs39.mkdir(path39.dirname(cachePath), { recursive: true });
+  await fs39.writeFile(cachePath, JSON.stringify(data, null, 2));
 }
 async function fetchFromNetwork() {
   try {
@@ -11644,7 +11765,7 @@ function loadFallbackDataset() {
 async function checkAndWarnStaleness(projectRoot) {
   const markerPath = getStalenessMarkerPath(projectRoot);
   try {
-    const raw = await fs38.readFile(markerPath, "utf-8");
+    const raw = await fs39.readFile(markerPath, "utf-8");
     const marker = JSON.parse(raw);
     const firstUse = new Date(marker.firstFallbackUse).getTime();
     const now = Date.now();
@@ -11656,8 +11777,8 @@ async function checkAndWarnStaleness(projectRoot) {
     }
   } catch {
     try {
-      await fs38.mkdir(path38.dirname(markerPath), { recursive: true });
-      await fs38.writeFile(
+      await fs39.mkdir(path39.dirname(markerPath), { recursive: true });
+      await fs39.writeFile(
         markerPath,
         JSON.stringify({ firstFallbackUse: (/* @__PURE__ */ new Date()).toISOString() })
       );
@@ -11667,7 +11788,7 @@ async function checkAndWarnStaleness(projectRoot) {
 }
 async function clearStalenessMarker(projectRoot) {
   try {
-    await fs38.unlink(getStalenessMarkerPath(projectRoot));
+    await fs39.unlink(getStalenessMarkerPath(projectRoot));
   } catch {
   }
 }
@@ -11904,10 +12025,10 @@ function parseLine(line, lineNumber) {
   return record;
 }
 function readCostRecords(projectRoot) {
-  const costsFile = path39.join(projectRoot, ".harness", "metrics", "costs.jsonl");
+  const costsFile = path40.join(projectRoot, ".harness", "metrics", "costs.jsonl");
   let raw;
   try {
-    raw = fs39.readFileSync(costsFile, "utf-8");
+    raw = fs40.readFileSync(costsFile, "utf-8");
   } catch {
     return [];
   }
@@ -11957,7 +12078,7 @@ function parseCCLine(line, filePath, lineNumber) {
     entry = JSON.parse(line);
   } catch {
     console.warn(
-      `[harness usage] Skipping malformed CC JSONL line ${lineNumber} in ${path40.basename(filePath)}`
+      `[harness usage] Skipping malformed CC JSONL line ${lineNumber} in ${path41.basename(filePath)}`
     );
     return null;
   }
@@ -11971,7 +12092,7 @@ function parseCCLine(line, filePath, lineNumber) {
 function readCCFile(filePath) {
   let raw;
   try {
-    raw = fs40.readFileSync(filePath, "utf-8");
+    raw = fs41.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -11993,10 +12114,10 @@ function readCCFile(filePath) {
 }
 function parseCCRecords() {
   const homeDir = process.env.HOME ?? os2.homedir();
-  const projectsDir = path40.join(homeDir, ".claude", "projects");
+  const projectsDir = path41.join(homeDir, ".claude", "projects");
   let projectDirs;
   try {
-    projectDirs = fs40.readdirSync(projectsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path40.join(projectsDir, d.name));
+    projectDirs = fs41.readdirSync(projectsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path41.join(projectsDir, d.name));
   } catch {
     return [];
   }
@@ -12004,7 +12125,7 @@ function parseCCRecords() {
   for (const dir of projectDirs) {
     let files;
     try {
-      files = fs40.readdirSync(dir).filter((f) => f.endsWith(".jsonl")).map((f) => path40.join(dir, f));
+      files = fs41.readdirSync(dir).filter((f) => f.endsWith(".jsonl")).map((f) => path41.join(dir, f));
     } catch {
       continue;
     }
@@ -12032,10 +12153,10 @@ function parseLine2(line, lineNumber) {
   }
 }
 function readAdoptionRecords(projectRoot) {
-  const adoptionFile = path41.join(projectRoot, ".harness", "metrics", "adoption.jsonl");
+  const adoptionFile = path42.join(projectRoot, ".harness", "metrics", "adoption.jsonl");
   let raw;
   try {
-    raw = fs41.readFileSync(adoptionFile, "utf-8");
+    raw = fs42.readFileSync(adoptionFile, "utf-8");
   } catch {
     return [];
   }
@@ -12108,13 +12229,13 @@ function topSkills(records, n) {
   return aggregateBySkill(records).slice(0, n);
 }
 function loadNotificationsConfig(projectRoot) {
-  const configPath = path42.join(projectRoot, "harness.config.json");
-  if (!fs42.existsSync(configPath)) {
+  const configPath = path43.join(projectRoot, "harness.config.json");
+  if (!fs43.existsSync(configPath)) {
     return Ok({ sinks: [] });
   }
   let raw;
   try {
-    raw = fs42.readFileSync(configPath, "utf-8");
+    raw = fs43.readFileSync(configPath, "utf-8");
   } catch (err) {
     return Err(err instanceof Error ? err : new Error(String(err)));
   }
@@ -12215,25 +12336,25 @@ function resolveStability(contentType) {
   return STABILITY_LOOKUP[contentType] ?? "ephemeral";
 }
 function getOrCreateInstallId(projectRoot) {
-  const harnessDir = path43.join(projectRoot, ".harness");
-  const installIdFile = path43.join(harnessDir, ".install-id");
+  const harnessDir = path44.join(projectRoot, ".harness");
+  const installIdFile = path44.join(harnessDir, ".install-id");
   const UUID_V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
   try {
-    const existing = fs43.readFileSync(installIdFile, "utf-8").trim();
+    const existing = fs44.readFileSync(installIdFile, "utf-8").trim();
     if (UUID_V4_RE.test(existing)) {
       return existing;
     }
   } catch {
   }
   const id = crypto4.randomUUID();
-  fs43.mkdirSync(harnessDir, { recursive: true });
-  fs43.writeFileSync(installIdFile, id, { encoding: "utf-8", mode: 384 });
+  fs44.mkdirSync(harnessDir, { recursive: true });
+  fs44.writeFileSync(installIdFile, id, { encoding: "utf-8", mode: 384 });
   return id;
 }
 function parseIdentityFromTelemetryFile(filePath) {
   const identity = {};
   try {
-    const raw = fs44.readFileSync(filePath, "utf-8");
+    const raw = fs45.readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
     const src = parsed?.identity;
     if (!src || typeof src !== "object") return identity;
@@ -12246,7 +12367,7 @@ function parseIdentityFromTelemetryFile(filePath) {
 }
 function readProjectNameFallback(configPath) {
   try {
-    const raw = fs44.readFileSync(configPath, "utf-8");
+    const raw = fs45.readFileSync(configPath, "utf-8");
     const config = JSON.parse(raw);
     return typeof config?.name === "string" ? config.name : void 0;
   } catch {
@@ -12267,10 +12388,10 @@ function readGitAliasFallback(cwd) {
   }
 }
 function readIdentity(projectRoot) {
-  const filePath = path44.join(projectRoot, ".harness", "telemetry.json");
+  const filePath = path45.join(projectRoot, ".harness", "telemetry.json");
   const identity = parseIdentityFromTelemetryFile(filePath);
   if (!identity.project) {
-    const fallbackProject = readProjectNameFallback(path44.join(projectRoot, "harness.config.json"));
+    const fallbackProject = readProjectNameFallback(path45.join(projectRoot, "harness.config.json"));
     if (fallbackProject) identity.project = fallbackProject;
   }
   if (!identity.alias) {
@@ -12367,12 +12488,12 @@ function acquireCompoundLock(category, opts = {}) {
     );
   }
   const cwd = opts.cwd ?? process.cwd();
-  const lockDir = path45.join(cwd, ".harness", "locks");
-  fs45.mkdirSync(lockDir, { recursive: true });
-  const lockPath = path45.join(lockDir, `compound-${category}.lock`);
+  const lockDir = path46.join(cwd, ".harness", "locks");
+  fs46.mkdirSync(lockDir, { recursive: true });
+  const lockPath = path46.join(lockDir, `compound-${category}.lock`);
   let fd;
   try {
-    fd = fs45.openSync(lockPath, "wx");
+    fd = fs46.openSync(lockPath, "wx");
   } catch (e) {
     const err = e;
     if (err.code === "EEXIST") {
@@ -12381,14 +12502,14 @@ function acquireCompoundLock(category, opts = {}) {
     }
     throw err;
   }
-  fs45.writeSync(fd, String(process.pid));
-  fs45.closeSync(fd);
+  fs46.writeSync(fd, String(process.pid));
+  fs46.closeSync(fd);
   let released = false;
   const release = () => {
     if (released) return;
     released = true;
     try {
-      fs45.unlinkSync(lockPath);
+      fs46.unlinkSync(lockPath);
     } catch {
     }
     process.removeListener("exit", onExit);
@@ -12414,7 +12535,7 @@ function acquireCompoundLock(category, opts = {}) {
 }
 function readHolderPid(lockPath) {
   try {
-    const raw = fs45.readFileSync(lockPath, "utf-8").trim();
+    const raw = fs46.readFileSync(lockPath, "utf-8").trim();
     const n = Number.parseInt(raw, 10);
     return Number.isFinite(n) ? n : -1;
   } catch {
@@ -12439,10 +12560,10 @@ function assertSanitized(value) {
 }
 function writePulseConfig(config, opts) {
   PulseConfigSchema.parse(config);
-  if (!fs46.existsSync(opts.configPath)) {
+  if (!fs47.existsSync(opts.configPath)) {
     throw new Error(`harness.config.json not found at ${opts.configPath}`);
   }
-  const raw = fs46.readFileSync(opts.configPath, "utf-8");
+  const raw = fs47.readFileSync(opts.configPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -12450,18 +12571,18 @@ function writePulseConfig(config, opts) {
     throw new Error(`Invalid JSON in ${opts.configPath}: ${e.message}`, { cause: e });
   }
   const bakPath = `${opts.configPath}.bak`;
-  if (!opts.skipBackup && !fs46.existsSync(bakPath)) {
-    fs46.writeFileSync(bakPath, raw, "utf-8");
+  if (!opts.skipBackup && !fs47.existsSync(bakPath)) {
+    fs47.writeFileSync(bakPath, raw, "utf-8");
   }
   parsed.pulse = config;
   const serialized = JSON.stringify(parsed, null, 2) + "\n";
   const tmpPath = `${opts.configPath}.tmp-${process.pid}`;
-  fs46.writeFileSync(tmpPath, serialized, "utf-8");
+  fs47.writeFileSync(tmpPath, serialized, "utf-8");
   try {
-    fs46.renameSync(tmpPath, opts.configPath);
+    fs47.renameSync(tmpPath, opts.configPath);
   } catch (e) {
     try {
-      fs46.unlinkSync(tmpPath);
+      fs47.unlinkSync(tmpPath);
     } catch {
     }
     throw e;
@@ -12469,12 +12590,12 @@ function writePulseConfig(config, opts) {
 }
 function seedFromStrategy(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const strategyPath = path46.join(cwd, "STRATEGY.md");
+  const strategyPath = path47.join(cwd, "STRATEGY.md");
   const warnings = [];
-  if (!fs47.existsSync(strategyPath)) {
+  if (!fs48.existsSync(strategyPath)) {
     return { name: null, keyMetrics: [], warnings: ["STRATEGY.md not found"] };
   }
-  const raw = fs47.readFileSync(strategyPath, "utf-8");
+  const raw = fs48.readFileSync(strategyPath, "utf-8");
   let name = null;
   const fmMatch = /^---\s*\n([\s\S]*?)\n---\s*\n/.exec(raw);
   const fm = fmMatch?.[1];
@@ -12625,8 +12746,8 @@ function loadTemplate() {
   try {
     const url = import.meta?.url;
     if (!url) return INLINE_TEMPLATE;
-    const here = dirname15(fileURLToPath(url));
-    return readFileSync392(join602(here, "template.md"), "utf-8");
+    const here = dirname16(fileURLToPath(url));
+    return readFileSync392(join612(here, "template.md"), "utf-8");
   } catch {
     return INLINE_TEMPLATE;
   }
@@ -12815,11 +12936,11 @@ async function computeHotspots(opts) {
   }
   const counts = /* @__PURE__ */ new Map();
   for (const line of stdout.split("\n")) {
-    const path48 = line.trim();
-    if (path48.length === 0) continue;
-    counts.set(path48, (counts.get(path48) ?? 0) + 1);
+    const path50 = line.trim();
+    if (path50.length === 0) continue;
+    counts.set(path50, (counts.get(path50) ?? 0) + 1);
   }
-  return [...counts.entries()].filter(([, c]) => c > opts.threshold).map(([path48, churn]) => ({ path: path48, churn })).sort((a, b) => b.churn - a.churn);
+  return [...counts.entries()].filter(([, c]) => c > opts.threshold).map(([path50, churn]) => ({ path: path50, churn })).sort((a, b) => b.churn - a.churn);
 }
 function tokenize(text) {
   return new Set(
@@ -12829,12 +12950,12 @@ function tokenize(text) {
 async function* walk2(dir) {
   let entries;
   try {
-    entries = await fs48.readdir(dir, { withFileTypes: true });
+    entries = await fs49.readdir(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const e of entries) {
-    const p = path47.join(dir, e.name);
+    const p = path48.join(dir, e.name);
     if (e.isDirectory()) yield* walk2(p);
     else if (e.isFile() && e.name.endsWith(".md")) yield p;
   }
@@ -12843,11 +12964,11 @@ async function readDocumentedTokens(solutionsDir) {
   const docs = [];
   for (const [track, categories] of TRACK_CATEGORIES2) {
     for (const category of categories) {
-      const dir = path47.join(solutionsDir, track, category);
+      const dir = path48.join(solutionsDir, track, category);
       for await (const file of walk2(dir)) {
-        const raw = await fs48.readFile(file, "utf-8");
+        const raw = await fs49.readFile(file, "utf-8");
         const m = /^#\s+(.+)$/m.exec(raw);
-        const title = m?.[1] ?? path47.basename(file, ".md");
+        const title = m?.[1] ?? path48.basename(file, ".md");
         docs.push(tokenize(title));
       }
     }
@@ -12910,7 +13031,113 @@ function assembleCandidateReport(input) {
   }
   return lines.join("\n");
 }
-var WHATWG_BAD_PORTS, BAD_PORT_SET, VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, KEBAB_CASE, TICKET_ID, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, readFile62, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, JS_EXT_FALLBACKS, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, AGENT_DESCRIPTORS, AGENT_RUNNERS, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, PRIORITY_RANK2, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, ConflictError, DEFAULTS, GitHubHttp, ETagStore, START_MARKER, END_MARKER, SERIALIZER_FIELDS, GitHubIssuesTrackerAdapter, migrate_exports, HASH_RE, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, DEFAULT_CAPACITY, CacheMetricsRecorder, RETRY_BACKOFFS_MS, OTLPExporter, SpanKind, CompoundLockHeldError, KNOWN_CATEGORIES, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY;
+function proposalsDir(projectPath) {
+  return path49.join(projectPath, ".harness", "proposals");
+}
+function proposalPath(projectPath, id) {
+  return path49.join(proposalsDir(projectPath), `${id}.json`);
+}
+function ensureDir(dir) {
+  fs50.mkdirSync(dir, { recursive: true });
+}
+function writeAtomic(filePath, content) {
+  const tmpPath = `${filePath}.tmp`;
+  fs50.writeFileSync(tmpPath, content);
+  fs50.renameSync(tmpPath, filePath);
+}
+async function createProposal(projectPath, input) {
+  const validated = EmitSkillProposalInputSchema.parse(input);
+  const id = `proposal_${randomUUID2().replace(/-/g, "")}`;
+  const proposal = SkillProposalSchema.parse({
+    id,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    kind: validated.kind,
+    targetSkill: validated.targetSkill,
+    proposedBy: validated.proposedBy,
+    source: {
+      sessionId: validated.sessionId,
+      taskId: validated.taskId,
+      justification: validated.justification
+    },
+    content: validated.content,
+    status: "open"
+  });
+  if (proposal.kind === "refinement" && proposal.targetSkill) {
+    const existing = await listProposals(projectPath, { status: "open" });
+    const clash = existing.find(
+      (p) => p.kind === "refinement" && p.targetSkill === proposal.targetSkill
+    );
+    if (clash) {
+      throw new ProposalConflictError(
+        `An open refinement proposal already exists for skill "${proposal.targetSkill}" (id: ${clash.id})`
+      );
+    }
+  }
+  const dir = proposalsDir(projectPath);
+  ensureDir(dir);
+  writeAtomic(proposalPath(projectPath, id), JSON.stringify(proposal, null, 2));
+  return proposal;
+}
+async function getProposal(projectPath, id) {
+  const file = proposalPath(projectPath, id);
+  try {
+    const raw = fs50.readFileSync(file, "utf-8");
+    const parsed = SkillProposalSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+async function listProposals(projectPath, opts = {}) {
+  const dir = proposalsDir(projectPath);
+  let files;
+  try {
+    files = fs50.readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const file of files) {
+    if (!file.endsWith(".json")) continue;
+    const id = file.slice(0, -".json".length);
+    const proposal = await getProposal(projectPath, id);
+    if (!proposal) continue;
+    if (opts.status && opts.status !== "all" && proposal.status !== opts.status) continue;
+    out.push(proposal);
+  }
+  out.sort((a, b) => a.createdAt > b.createdAt ? -1 : a.createdAt < b.createdAt ? 1 : 0);
+  return out;
+}
+async function updateProposal(projectPath, id, patch) {
+  const current = await getProposal(projectPath, id);
+  if (!current) throw new ProposalNotFoundError(id);
+  const next = SkillProposalSchema.parse({
+    ...current,
+    ...patch,
+    id: current.id,
+    createdAt: current.createdAt,
+    kind: current.kind
+  });
+  writeAtomic(proposalPath(projectPath, id), JSON.stringify(next, null, 2));
+  return next;
+}
+function deriveSkillUsage(projectRoot, skillName, windowDays = 30) {
+  const records = readAdoptionRecords(projectRoot);
+  const cutoffMs = Date.now() - windowDays * 24 * 60 * 60 * 1e3;
+  let count = 0;
+  let lastUsed;
+  for (const rec of records) {
+    if (rec.skill !== skillName) continue;
+    const startedMs = Date.parse(rec.startedAt);
+    if (Number.isFinite(startedMs) && startedMs < cutoffMs) continue;
+    count += 1;
+    if (!lastUsed || rec.startedAt > lastUsed) lastUsed = rec.startedAt;
+  }
+  const stats = { count, windowDays };
+  if (lastUsed) stats.lastUsed = lastUsed;
+  return stats;
+}
+var WHATWG_BAD_PORTS, BAD_PORT_SET, VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, KEBAB_CASE, TICKET_ID, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, readFile62, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, OSV_ENDPOINT, DEFAULT_CACHE_DIR, DEFAULT_TTL_HOURS, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, JS_EXT_FALLBACKS, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, AGENT_DESCRIPTORS, AGENT_RUNNERS, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, PRIORITY_RANK2, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, ConflictError, DEFAULTS, GitHubHttp, ETagStore, START_MARKER, END_MARKER, SERIALIZER_FIELDS, GitHubIssuesTrackerAdapter, migrate_exports, HASH_RE, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, DEFAULT_CAPACITY, CacheMetricsRecorder, RETRY_BACKOFFS_MS, OTLPExporter, SpanKind, CompoundLockHeldError, KNOWN_CATEGORIES, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY, ProposalNotFoundError, ProposalConflictError;
 var init_dist3 = __esm({
   "../core/dist/index.mjs"() {
     init_chunk_FYTJQ2ZY();
@@ -12936,6 +13163,7 @@ var init_dist3 = __esm({
     init_dist();
     init_dist();
     init_dist2();
+    init_dist();
     WHATWG_BAD_PORTS = Object.freeze([
       1,
       7,
@@ -15893,6 +16121,9 @@ var init_dist3 = __esm({
         };
       }
     };
+    OSV_ENDPOINT = "https://api.osv.dev/v1/query";
+    DEFAULT_CACHE_DIR = path26.join(".harness", "cache", "osv");
+    DEFAULT_TTL_HOURS = 24;
     hiddenUnicodePatterns = [
       {
         ruleId: "INJ-UNI-001",
@@ -16198,7 +16429,7 @@ var init_dist3 = __esm({
       timelinePath;
       constructor(rootDir) {
         this.rootDir = rootDir;
-        this.timelinePath = join38(rootDir, ".harness", "security", "timeline.json");
+        this.timelinePath = join39(rootDir, ".harness", "security", "timeline.json");
       }
       /**
        * Load timeline from disk.
@@ -16242,7 +16473,7 @@ var init_dist3 = __esm({
        * Save timeline to disk using atomic write (temp file + rename).
        */
       save(timeline) {
-        const dir = dirname10(this.timelinePath);
+        const dir = dirname11(this.timelinePath);
         if (!existsSync342(dir)) {
           mkdirSync14(dir, { recursive: true });
         }
@@ -17879,10 +18110,10 @@ ${JSON.stringify(event)}`;
       }
       rootDir;
       async scan() {
-        let projectName = path35.basename(this.rootDir);
+        let projectName = path36.basename(this.rootDir);
         try {
-          const pkgPath = path35.join(this.rootDir, "package.json");
-          const pkgRaw = await fs35.readFile(pkgPath, "utf-8");
+          const pkgPath = path36.join(this.rootDir, "package.json");
+          const pkgRaw = await fs36.readFile(pkgPath, "utf-8");
           const pkg = JSON.parse(pkgRaw);
           if (pkg.name) projectName = pkg.name;
         } catch {
@@ -17995,8 +18226,8 @@ console.log('Blueprint player initialized.');
           styles: STYLES,
           scripts: SCRIPTS
         });
-        await fs36.mkdir(options.outputDir, { recursive: true });
-        await fs36.writeFile(path36.join(options.outputDir, "index.html"), html);
+        await fs37.mkdir(options.outputDir, { recursive: true });
+        await fs37.writeFile(path37.join(options.outputDir, "index.html"), html);
       }
     };
     TOKENS_PER_MILLION = 1e6;
@@ -18547,6 +18778,18 @@ console.log('Blueprint player initialized.');
       [/\b(runtime|crash|exception|panic)\b/i, "bug-track/runtime-errors"],
       [/\(orchestrator\)|\bintegrat|\blease\b|\brace\b|\bconcurren/i, "bug-track/integration-issues"]
     ];
+    ProposalNotFoundError = class extends Error {
+      constructor(id) {
+        super(`proposal not found: ${id}`);
+        this.name = "ProposalNotFoundError";
+      }
+    };
+    ProposalConflictError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ProposalConflictError";
+      }
+    };
   }
 });
 
@@ -18782,6 +19025,7 @@ export {
   goRules,
   parseHarnessIgnore,
   SecurityScanner,
+  createOsvClient,
   scanForInjection,
   getInjectionPatterns,
   DESTRUCTIVE_BASH,
@@ -18959,6 +19203,14 @@ export {
   crossReferenceUndocumentedFixes,
   suggestCategory,
   assembleCandidateReport,
+  proposalsDir,
+  ProposalNotFoundError,
+  ProposalConflictError,
+  createProposal,
+  getProposal,
+  listProposals,
+  updateProposal,
+  deriveSkillUsage,
   dist_exports,
   init_dist3 as init_dist
 };