@harness-engineering/cli 4.0.1 → 4.2.0

package/dist/{feedback-BPHADTRQ.js → feedback-NDGZZ37W.js}

@@ -5,7 +5,7 @@ import {
   handleCreateSelfReview,
   handleRequestPeerReview,
   requestPeerReviewDefinition
-} from "./chunk-OQ6KOQEV.js";
+} from "./chunk-KYFXXEK3.js";
 import "./chunk-RC3OI5NK.js";
 import "./chunk-W6Y7ZW3Y.js";
 import "./chunk-KFQGP6VL.js";

package/dist/{generate-agent-definitions-KPVGBGDY.js → generate-agent-definitions-PYZ3E7SP.js}

@@ -1,15 +1,15 @@
 import {
   createGenerateAgentDefinitionsCommand,
   generateAgentDefinitions
-} from "./chunk-E5EW5HVJ.js";
+} from "./chunk-DVG6DDX6.js";
 import "./chunk-KET4QQZB.js";
-import "./chunk-5RSXUAMN.js";
+import "./chunk-MHHISNS2.js";
 import "./chunk-3ISINLYT.js";
 import "./chunk-UTJJJDNN.js";
 import "./chunk-3WGJMBKH.js";
-import "./chunk-MMLQPHZ5.js";
-import "./chunk-6YFHUIGT.js";
-import "./chunk-BDGTZRZ6.js";
+import "./chunk-33OU3LYX.js";
+import "./chunk-RZTLXZHJ.js";
+import "./chunk-UEXQMI6K.js";
 import "./chunk-WZJR6SOI.js";
 import "./chunk-QCLOIUMX.js";
 import "./chunk-XARGEOJV.js";

package/dist/hooks/sentinel-pre.js

@@ -1,17 +1,23 @@
 #!/usr/bin/env node
-/* global console */
 // sentinel-pre.js — PreToolUse:* hook
-// Sentinel prompt injection defense — scans tool inputs for injection patterns
-// and blocks destructive operations during tainted sessions.
+// Sentinel ENFORCEMENT: blocks destructive operations during an already-tainted
+// session. Taint is set exclusively by sentinel-post from untrusted tool OUTPUT
+// (the actual prompt-injection vector). This hook performs NO injection detection
+// on tool INPUTS — an agent's own tool inputs are its intent, not untrusted content,
+// and scanning them here falsely tainted legitimate work (e.g. an agent running
+// `git commit --no-verify`, or inputs containing base64/git-SHA tokens), then blocked
+// the agent's own `git push`. Detection lives in sentinel-post; pre only enforces.
 // Exit codes: 0 = allow, 2 = block
+//
+// Design contract: see packages/cli/src/hooks/profiles.ts — "sentinel-pre (exit-2
+// blocks a destructive op in an already-tainted session) and sentinel-post
+// (detection only)".
 
-import { readFileSync, writeFileSync, mkdirSync, unlinkSync, realpathSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
+import { readFileSync, unlinkSync, realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
 import process from 'node:process';
 
 // Destructive tool patterns blocked during taint.
-// These are intentionally inline — this check runs before the @harness-engineering/core
-// import attempt to ensure enforcement even when core is unavailable.
 // Keep in sync with DESTRUCTIVE_BASH exported from @harness-engineering/core injection-patterns.ts.
 const DESTRUCTIVE_BASH = [
   /\bgit\s+push\b/,
@@ -33,73 +39,6 @@ function isOutsideWorkspace(filePath, workspaceRoot) {
   return !realResolved.startsWith(workspaceRoot);
 }
 
-// Minimal inline patterns for when @harness-engineering/core isn't available.
-// Keep in sync with @harness-engineering/core injection-patterns.ts ALL_PATTERNS.
-// Covers all HIGH-severity patterns and key MEDIUM patterns for degraded-mode safety.
-function inlineScan(text) {
-  console.error('[sentinel] Running in degraded mode: core import failed, using inline patterns');
-  const findings = [];
-  const lines = text.split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    // HIGH: INJ-UNI-001 — Zero-width characters
-    // eslint-disable-next-line no-misleading-character-class -- intentional: detects zero-width chars for security
-    if (/[\u200B\u200C\u200D\uFEFF\u2060]/.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-UNI-001', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-UNI-002 — RTL/LTR override characters
-    if (/[\u202A-\u202E\u2066-\u2069]/.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-UNI-002', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-REROL-001 — Ignore previous instructions
-    if (/(?:ignore|disregard|forget)\s+(?:all\s+)?(?:previous|prior|above|earlier)\s+(?:instructions?|prompts?|context|rules?|guidelines?)/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-REROL-001', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-REROL-002 — Role reassignment
-    if (/you\s+are\s+now\s+(?:a\s+|an\s+)?(?:new\s+)?(?:helpful\s+)?(?:my\s+)?(?:\w+\s+)?(?:assistant|agent|AI|bot|chatbot|system|persona)\b/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-REROL-002', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-REROL-003 — Direct instruction override
-    if (/(?:new\s+)?(?:system\s+)?(?:instruction|directive|role|persona)\s*[:=]\s*/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-REROL-003', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-PERM-001 — Enable all tools/permissions
-    if (/(?:allow|enable|grant)\s+all\s+(?:tools?|permissions?|access)/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-PERM-001', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-PERM-002 — Disable safety/security
-    if (/(?:disable|turn\s+off|remove|bypass)\s+(?:all\s+)?(?:safety|security|restrictions?|guardrails?|protections?|checks?)/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-PERM-002', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-PERM-003 — Auto-approve directive
-    if (/(?:auto[- ]?approve|--no-verify|--dangerously-skip-permissions)/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-PERM-003', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-ENC-001 — Suspicious base64 (skip lines that look like file paths or CLI commands)
-    if (!/^[\s]*(?:cd |git |node |pnpm |npm |\/|packages\/|agents\/|src\/)/.test(line) &&
-        /(?<!Bearer\s)(?<![:])(?<![A-Za-z0-9/])(?!eyJ)(?:[A-Za-z0-9+/]{4}){7,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?(?![A-Za-z0-9/])/.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-ENC-001', match: line.trim(), line: i + 1 });
-    }
-    // MEDIUM: INJ-CTX-001 — System prompt claims
-    if (/(?:the\s+)?(?:system\s+prompt|system\s+message|hidden\s+instructions?)\s+(?:says?|tells?|instructs?|contains?|is)/i.test(line)) {
-      findings.push({ severity: 'medium', ruleId: 'INJ-CTX-001', match: line.trim(), line: i + 1 });
-    }
-  }
-  return findings;
-}
-
-function extractText(toolName, toolInput) {
-  if (toolName === 'Bash') return toolInput?.command ?? '';
-  if (toolName === 'Write') return toolInput?.content ?? '';
-  if (toolName === 'Edit') return `${toolInput?.old_string ?? ''}\n${toolInput?.new_string ?? ''}`;
-  if (toolName === 'Read') return toolInput?.file_path ?? '';
-  const parts = [];
-  for (const value of Object.values(toolInput || {})) {
-    if (typeof value === 'string') parts.push(value);
-  }
-  return parts.join('\n') || null;
-}
-
 async function main() {
   let raw = '';
   try {
@@ -125,7 +64,8 @@ async function main() {
     const sessionId = input?.session_id;
     const workspaceRoot = process.cwd();
 
-    // Step 1: Check taint state — block destructive ops if tainted
+    // Check taint state — block destructive ops if the session is already tainted.
+    // Taint is written only by sentinel-post (from untrusted tool OUTPUT).
     let tainted = false;
     try {
       const taintPath = resolve(
@@ -173,69 +113,6 @@ async function main() {
       }
     }
 
-    // Step 2: Scan tool inputs for injection patterns
-    const textToScan = extractText(toolName, toolInput);
-    if (textToScan) {
-      let findings;
-      try {
-        const core = await import('@harness-engineering/core');
-        findings = core.scanForInjection(textToScan);
-      } catch {
-        findings = inlineScan(textToScan);
-      }
-
-      const actionable = findings.filter((f) => f.severity === 'high' || f.severity === 'medium');
-
-      if (actionable.length > 0) {
-        try {
-          const core = await import('@harness-engineering/core');
-          core.writeTaint(
-            workspaceRoot,
-            sessionId,
-            `Injection pattern detected in PreToolUse:${toolName} input`,
-            actionable,
-            `PreToolUse:${toolName}`
-          );
-        } catch {
-          // Fallback inline taint writer — merges with existing taint state
-          try {
-            const id = sessionId || 'default';
-            const taintPath = resolve(workspaceRoot, '.harness', `session-taint-${id}.json`);
-            mkdirSync(dirname(taintPath), { recursive: true });
-            const now = new Date().toISOString();
-            const maxSev = actionable.some((f) => f.severity === 'high') ? 'high' : 'medium';
-            const newFindings = actionable.map((f) => ({
-              ruleId: f.ruleId, severity: f.severity, match: f.match,
-              source: `PreToolUse:${toolName}`, detectedAt: now,
-            }));
-            // Read and merge existing taint state to preserve earlier taintedAt and findings
-            let existing = null;
-            try { existing = JSON.parse(readFileSync(taintPath, 'utf-8')); } catch { /* no existing */ }
-            const state = {
-              sessionId: id,
-              taintedAt: existing?.taintedAt ?? now,
-              expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
-              reason: existing?.reason ?? `Injection pattern detected in PreToolUse:${toolName} input`,
-              severity: maxSev,
-              findings: [...(existing?.findings ?? []), ...newFindings],
-            };
-            writeFileSync(taintPath, JSON.stringify(state, null, 2) + '\n');
-          } catch { /* best-effort */ }
-        }
-
-        for (const f of actionable) {
-          process.stderr.write(
-            `Sentinel [${f.severity}] ${f.ruleId}: detected in ${toolName} input\n`
-          );
-        }
-      }
-
-      const low = findings.filter((f) => f.severity === 'low');
-      for (const f of low) {
-        process.stderr.write(`Sentinel [low] ${f.ruleId}: ${f.match.slice(0, 80)}\n`);
-      }
-    }
-
     process.exit(0);
   } catch {
     process.exit(0);

package/dist/index.d.ts

@@ -704,14 +704,59 @@ declare const HarnessConfigSchema: z.ZodObject<{
         excludePatterns: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         /** Whether to automatically attempt to fix simple entropy issues */
         autoFix: z.ZodDefault<z.ZodBoolean>;
+        /** Documentation-drift detection tuning (scope/disable individual checks) */
+        drift: z.ZodOptional<z.ZodObject<{
+            /** Glob patterns for docs to scan for drift (default: docs/**, README) */
+            docPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Flag doc references to code symbols that no longer exist (default: true) */
+            checkApiSignatures: z.ZodOptional<z.ZodBoolean>;
+            /** Check fenced code examples against the codebase (default: true) */
+            checkExamples: z.ZodOptional<z.ZodBoolean>;
+            /** Check documented structure against the filesystem (default: true) */
+            checkStructure: z.ZodOptional<z.ZodBoolean>;
+            /** Regexes matched against a reference to exclude it from drift reporting */
+            ignorePatterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Doc-path prefixes whose symbols describe intended future code (ADRs, proposals) */
+            forwardLookingPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            docPaths?: string[] | undefined;
+            checkApiSignatures?: boolean | undefined;
+            checkExamples?: boolean | undefined;
+            checkStructure?: boolean | undefined;
+            ignorePatterns?: string[] | undefined;
+            forwardLookingPaths?: string[] | undefined;
+        }, {
+            docPaths?: string[] | undefined;
+            checkApiSignatures?: boolean | undefined;
+            checkExamples?: boolean | undefined;
+            checkStructure?: boolean | undefined;
+            ignorePatterns?: string[] | undefined;
+            forwardLookingPaths?: string[] | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         excludePatterns: string[];
         autoFix: boolean;
         entryPoints?: string[] | undefined;
+        drift?: {
+            docPaths?: string[] | undefined;
+            checkApiSignatures?: boolean | undefined;
+            checkExamples?: boolean | undefined;
+            checkStructure?: boolean | undefined;
+            ignorePatterns?: string[] | undefined;
+            forwardLookingPaths?: string[] | undefined;
+        } | undefined;
     }, {
         excludePatterns?: string[] | undefined;
         entryPoints?: string[] | undefined;
         autoFix?: boolean | undefined;
+        drift?: {
+            docPaths?: string[] | undefined;
+            checkApiSignatures?: boolean | undefined;
+            checkExamples?: boolean | undefined;
+            checkStructure?: boolean | undefined;
+            ignorePatterns?: string[] | undefined;
+            forwardLookingPaths?: string[] | undefined;
+        } | undefined;
     }>>;
     /** Security scanning configuration */
     security: z.ZodOptional<z.ZodObject<{
@@ -2100,6 +2145,14 @@ declare const HarnessConfigSchema: z.ZodObject<{
         excludePatterns: string[];
         autoFix: boolean;
         entryPoints?: string[] | undefined;
+        drift?: {
+            docPaths?: string[] | undefined;
+            checkApiSignatures?: boolean | undefined;
+            checkExamples?: boolean | undefined;
+            checkStructure?: boolean | undefined;
+            ignorePatterns?: string[] | undefined;
+            forwardLookingPaths?: string[] | undefined;
+        } | undefined;
     } | undefined;
     security?: z.objectOutputType<{
         /** Whether security scanning is enabled */
@@ -2418,6 +2471,14 @@ declare const HarnessConfigSchema: z.ZodObject<{
         excludePatterns?: string[] | undefined;
         entryPoints?: string[] | undefined;
         autoFix?: boolean | undefined;
+        drift?: {
+            docPaths?: string[] | undefined;
+            checkApiSignatures?: boolean | undefined;
+            checkExamples?: boolean | undefined;
+            checkStructure?: boolean | undefined;
+            ignorePatterns?: string[] | undefined;
+            forwardLookingPaths?: string[] | undefined;
+        } | undefined;
     } | undefined;
     security?: z.objectInputType<{
         /** Whether security scanning is enabled */

package/dist/index.js

@@ -12,20 +12,20 @@ import {
   runSnapshotCapture,
   runUninstall,
   runUninstallConstraints
-} from "./chunk-GHBFNLV2.js";
+} from "./chunk-RRCS27GT.js";
 import {
   generateRuntime
-} from "./chunk-YANR2RL7.js";
+} from "./chunk-ZIJABBGZ.js";
 import {
   generateAgentsMd
-} from "./chunk-T746REAE.js";
+} from "./chunk-VC2B275U.js";
 import {
   generateCIWorkflow
-} from "./chunk-AX5KGRM6.js";
-import "./chunk-AAUY53CC.js";
+} from "./chunk-SI4O2W4H.js";
+import "./chunk-KHL6WFRL.js";
 import {
   runCrossCheck
-} from "./chunk-4VXFZSYF.js";
+} from "./chunk-DW6HE5DH.js";
 import {
   AGENT_DESCRIPTIONS,
   DEFAULT_TOOLS,
@@ -34,14 +34,14 @@ import {
   generateAgentDefinitions,
   renderClaudeCodeAgent,
   renderGeminiAgent
-} from "./chunk-E5EW5HVJ.js";
+} from "./chunk-DVG6DDX6.js";
 import "./chunk-KET4QQZB.js";
 import {
   runScan
 } from "./chunk-YYFSFSB3.js";
 import {
   TemplateEngine
-} from "./chunk-UWVMJEUJ.js";
+} from "./chunk-YTJIRQON.js";
 import "./chunk-CQ553GZO.js";
 import {
   generateSkillFiles
@@ -49,7 +49,7 @@ import {
 import {
   listPersonas,
   loadPersona
-} from "./chunk-5RSXUAMN.js";
+} from "./chunk-MHHISNS2.js";
 import {
   detectTrigger,
   runPersona
@@ -64,27 +64,27 @@ import {
   OutputFormatter,
   OutputMode,
   runCheckPhaseGate
-} from "./chunk-7TIJXWG3.js";
+} from "./chunk-V2GJE5J5.js";
 import {
   createHarnessServer,
   generateSlashCommands,
   getToolDefinitions,
   startServer
-} from "./chunk-RG3TNIUB.js";
-import "./chunk-OQ6KOQEV.js";
-import "./chunk-M7F2PPN3.js";
-import "./chunk-EYMOPFSD.js";
-import "./chunk-6SCYTIF4.js";
-import "./chunk-I3CGCZJF.js";
-import "./chunk-SDMV4QHM.js";
-import "./chunk-7PJCK7UE.js";
+} from "./chunk-K5R2I37T.js";
+import "./chunk-KYFXXEK3.js";
+import "./chunk-D5YCPIK6.js";
+import "./chunk-J5MFNKE7.js";
+import "./chunk-HU7NS7JA.js";
+import "./chunk-BJDT3VGQ.js";
+import "./chunk-DBCC7KIW.js";
+import "./chunk-E5KJOUHI.js";
 import "./chunk-IOW3MW2K.js";
 import "./chunk-3ISINLYT.js";
 import "./chunk-4U5LDFCY.js";
-import "./chunk-36GQREOE.js";
-import "./chunk-JPVOI7GP.js";
+import "./chunk-HUC73DZC.js";
+import "./chunk-J7H5I4FO.js";
 import "./chunk-RC3OI5NK.js";
-import "./chunk-SEA2PFVI.js";
+import "./chunk-XACP5P2J.js";
 import "./chunk-W6Y7ZW3Y.js";
 import "./chunk-WBVCN35T.js";
 import "./chunk-UTJJJDNN.js";
@@ -94,7 +94,7 @@ import {
   findConfigFile,
   loadConfig,
   resolveConfig
-} from "./chunk-XAVMTAUT.js";
+} from "./chunk-6STDKKAM.js";
 import "./chunk-ZCZD7FHU.js";
 import {
   logger
@@ -104,10 +104,10 @@ import {
   ExitCode,
   handleError
 } from "./chunk-3WGJMBKH.js";
-import "./chunk-MMLQPHZ5.js";
+import "./chunk-33OU3LYX.js";
 import "./chunk-BM3PWGXQ.js";
-import "./chunk-6YFHUIGT.js";
-import "./chunk-BDGTZRZ6.js";
+import "./chunk-RZTLXZHJ.js";
+import "./chunk-UEXQMI6K.js";
 import "./chunk-WZJR6SOI.js";
 import "./chunk-QCLOIUMX.js";
 import "./chunk-XARGEOJV.js";

package/dist/{loader-QOJQ6NZM.js → loader-QK2OJXKB.js}

@@ -1,10 +1,10 @@
 import {
   listPersonas,
   loadPersona
-} from "./chunk-5RSXUAMN.js";
-import "./chunk-MMLQPHZ5.js";
-import "./chunk-6YFHUIGT.js";
-import "./chunk-BDGTZRZ6.js";
+} from "./chunk-MHHISNS2.js";
+import "./chunk-33OU3LYX.js";
+import "./chunk-RZTLXZHJ.js";
+import "./chunk-UEXQMI6K.js";
 import "./chunk-WZJR6SOI.js";
 import "./chunk-QCLOIUMX.js";
 import "./chunk-XARGEOJV.js";

package/dist/{mcp-ZPX6O767.js → mcp-Z5YMV7TA.js}

@@ -2,37 +2,37 @@ import {
   createHarnessServer,
   getToolDefinitions,
   startServer
-} from "./chunk-RG3TNIUB.js";
-import "./chunk-OQ6KOQEV.js";
-import "./chunk-M7F2PPN3.js";
-import "./chunk-EYMOPFSD.js";
-import "./chunk-6SCYTIF4.js";
-import "./chunk-I3CGCZJF.js";
-import "./chunk-SDMV4QHM.js";
-import "./chunk-7PJCK7UE.js";
+} from "./chunk-K5R2I37T.js";
+import "./chunk-KYFXXEK3.js";
+import "./chunk-D5YCPIK6.js";
+import "./chunk-J5MFNKE7.js";
+import "./chunk-HU7NS7JA.js";
+import "./chunk-BJDT3VGQ.js";
+import "./chunk-DBCC7KIW.js";
+import "./chunk-E5KJOUHI.js";
 import "./chunk-IOW3MW2K.js";
 import "./chunk-3ISINLYT.js";
 import "./chunk-4U5LDFCY.js";
-import "./chunk-36GQREOE.js";
-import "./chunk-JPVOI7GP.js";
+import "./chunk-HUC73DZC.js";
+import "./chunk-J7H5I4FO.js";
 import {
   resultToMcpResponse
 } from "./chunk-RC3OI5NK.js";
 import {
   resolveProjectConfig
-} from "./chunk-SEA2PFVI.js";
+} from "./chunk-XACP5P2J.js";
 import "./chunk-W6Y7ZW3Y.js";
 import "./chunk-WBVCN35T.js";
 import "./chunk-UTJJJDNN.js";
 import "./chunk-HIK6OEUF.js";
 import "./chunk-Y6SUQC32.js";
-import "./chunk-XAVMTAUT.js";
+import "./chunk-6STDKKAM.js";
 import "./chunk-ZCZD7FHU.js";
 import "./chunk-EBJQ6N4M.js";
 import "./chunk-3WGJMBKH.js";
-import "./chunk-MMLQPHZ5.js";
-import "./chunk-6YFHUIGT.js";
-import "./chunk-BDGTZRZ6.js";
+import "./chunk-33OU3LYX.js";
+import "./chunk-RZTLXZHJ.js";
+import "./chunk-UEXQMI6K.js";
 import "./chunk-WZJR6SOI.js";
 import "./chunk-QCLOIUMX.js";
 import "./chunk-XARGEOJV.js";

package/dist/{performance-FXYTGJGQ.js → performance-VAYOYPVK.js}

@@ -7,15 +7,15 @@ import {
   handleGetPerfBaselines,
   handleUpdatePerfBaselines,
   updatePerfBaselinesDefinition
-} from "./chunk-7PJCK7UE.js";
+} from "./chunk-E5KJOUHI.js";
 import "./chunk-RC3OI5NK.js";
 import "./chunk-W6Y7ZW3Y.js";
-import "./chunk-XAVMTAUT.js";
+import "./chunk-6STDKKAM.js";
 import "./chunk-ZCZD7FHU.js";
 import "./chunk-3WGJMBKH.js";
-import "./chunk-MMLQPHZ5.js";
-import "./chunk-6YFHUIGT.js";
-import "./chunk-BDGTZRZ6.js";
+import "./chunk-33OU3LYX.js";
+import "./chunk-RZTLXZHJ.js";
+import "./chunk-UEXQMI6K.js";
 import "./chunk-WZJR6SOI.js";
 import "./chunk-QCLOIUMX.js";
 import "./chunk-XARGEOJV.js";

package/dist/{review-pipeline-2TFQ5OAE.js → review-pipeline-UETEOWSS.js}

@@ -1,11 +1,11 @@
 import {
   handleRunCodeReview,
   runCodeReviewDefinition
-} from "./chunk-EYMOPFSD.js";
+} from "./chunk-J5MFNKE7.js";
 import "./chunk-W6Y7ZW3Y.js";
-import "./chunk-MMLQPHZ5.js";
-import "./chunk-6YFHUIGT.js";
-import "./chunk-BDGTZRZ6.js";
+import "./chunk-33OU3LYX.js";
+import "./chunk-RZTLXZHJ.js";
+import "./chunk-UEXQMI6K.js";
 import "./chunk-WZJR6SOI.js";
 import "./chunk-QCLOIUMX.js";
 import "./chunk-XARGEOJV.js";

package/dist/{runtime-XK6ZCHKE.js → runtime-J7KFACTK.js}

@@ -1,10 +1,10 @@
 import {
   generateRuntime
-} from "./chunk-YANR2RL7.js";
+} from "./chunk-ZIJABBGZ.js";
 import "./chunk-KET4QQZB.js";
-import "./chunk-MMLQPHZ5.js";
-import "./chunk-6YFHUIGT.js";
-import "./chunk-BDGTZRZ6.js";
+import "./chunk-33OU3LYX.js";
+import "./chunk-RZTLXZHJ.js";
+import "./chunk-UEXQMI6K.js";
 import "./chunk-WZJR6SOI.js";
 import "./chunk-QCLOIUMX.js";
 import "./chunk-XARGEOJV.js";

package/dist/{security-4W2P5ZGI.js → security-6AIUZXF5.js}

@@ -3,7 +3,7 @@ import {
   handleGetSecurityTrends,
   handleRunSecurityScan,
   runSecurityScanDefinition
-} from "./chunk-M7F2PPN3.js";
+} from "./chunk-D5YCPIK6.js";
 import "./chunk-W6Y7ZW3Y.js";
 import "./chunk-KFQGP6VL.js";
 export {

package/dist/{state-events-ECQAIZLU.js → state-events-XQPHGLG5.js}

@@ -6,10 +6,10 @@ import {
   isEmptyHarnessState,
   readAuditTimeline,
   readHarnessState
-} from "./chunk-AAUY53CC.js";
-import "./chunk-MMLQPHZ5.js";
-import "./chunk-6YFHUIGT.js";
-import "./chunk-BDGTZRZ6.js";
+} from "./chunk-KHL6WFRL.js";
+import "./chunk-33OU3LYX.js";
+import "./chunk-RZTLXZHJ.js";
+import "./chunk-UEXQMI6K.js";
 import "./chunk-WZJR6SOI.js";
 import "./chunk-QCLOIUMX.js";
 import "./chunk-XARGEOJV.js";

package/dist/{validate-64KTEGIE.js → validate-ON7YMVLY.js}

@@ -1,12 +1,12 @@
 import {
   handleValidateProject,
   validateToolDefinition
-} from "./chunk-36GQREOE.js";
-import "./chunk-SEA2PFVI.js";
+} from "./chunk-HUC73DZC.js";
+import "./chunk-XACP5P2J.js";
 import "./chunk-W6Y7ZW3Y.js";
-import "./chunk-MMLQPHZ5.js";
-import "./chunk-6YFHUIGT.js";
-import "./chunk-BDGTZRZ6.js";
+import "./chunk-33OU3LYX.js";
+import "./chunk-RZTLXZHJ.js";
+import "./chunk-UEXQMI6K.js";
 import "./chunk-WZJR6SOI.js";
 import "./chunk-QCLOIUMX.js";
 import "./chunk-XARGEOJV.js";

package/dist/{validate-cross-check-J5PVGICB.js → validate-cross-check-HKKQA7K5.js}

@@ -1,9 +1,9 @@
 import {
   runCrossCheck
-} from "./chunk-4VXFZSYF.js";
-import "./chunk-MMLQPHZ5.js";
-import "./chunk-6YFHUIGT.js";
-import "./chunk-BDGTZRZ6.js";
+} from "./chunk-DW6HE5DH.js";
+import "./chunk-33OU3LYX.js";
+import "./chunk-RZTLXZHJ.js";
+import "./chunk-UEXQMI6K.js";
 import "./chunk-WZJR6SOI.js";
 import "./chunk-QCLOIUMX.js";
 import "./chunk-XARGEOJV.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harness-engineering/cli",
-  "version": "4.0.1",
+  "version": "4.2.0",
   "description": "CLI for Harness Engineering toolkit",
   "type": "module",
   "bin": {
@@ -39,15 +39,16 @@
     "web-tree-sitter": "^0.24.7",
     "yaml": "^2.8.3",
     "zod": "^3.25.76",
-    "@harness-engineering/core": "0.32.0",
-    "@harness-engineering/dashboard": "0.11.0",
-    "@harness-engineering/graph": "0.11.2",
+    "@harness-engineering/core": "0.33.0",
+    "@harness-engineering/dashboard": "0.11.2",
+    "@harness-engineering/graph": "0.11.3",
     "@harness-engineering/linter-gen": "0.1.7",
-    "@harness-engineering/orchestrator": "0.9.0",
-    "@harness-engineering/types": "0.16.2"
+    "@harness-engineering/orchestrator": "0.9.2",
+    "@harness-engineering/signals": "0.2.1",
+    "@harness-engineering/types": "0.17.0"
   },
   "peerDependencies": {
-    "@harness-engineering/intelligence": "0.4.0"
+    "@harness-engineering/intelligence": "0.4.1"
   },
   "peerDependenciesMeta": {
     "@harness-engineering/intelligence": {