@harness-engineering/cli 8.0.0 → 9.0.0

package/dist/bin/harness.js

@@ -3,7 +3,7 @@ import {
   createProgram,
   installCommandTelemetry,
   printFirstRunWelcome
-} from "../chunk-MSJJU6KH.js";
+} from "../chunk-SHOTI4TA.js";
 import "../chunk-PYDUECJ3.js";
 import "../chunk-7IVIRKHD.js";
 import "../chunk-XYP5CIEN.js";

package/dist/{chunk-MSJJU6KH.js → chunk-SHOTI4TA.js}

@@ -3338,7 +3338,7 @@ import { spawn } from "child_process";
 import { existsSync as existsSync6 } from "fs";
 import { createRequire } from "module";
 import { dirname as dirname4, join as join10, resolve as resolve15 } from "path";
-import { setTimeout } from "timers";
+import { setTimeout as setTimeout2 } from "timers";
 import { fileURLToPath } from "url";
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = dirname4(__filename);
@@ -3413,7 +3413,7 @@ function runDashboard(opts) {
   console.log(`Dashboard API starting on http://localhost:${apiPort}`);
   console.log(`Open ${url} (pass --no-open to suppress)`);
   if (opts.noOpen !== true) {
-    setTimeout(() => openBrowser(url), 1500);
+    setTimeout2(() => openBrowser(url), 1500);
   }
 }
 function createDashboardCommand() {
@@ -9518,9 +9518,12 @@ function createOrchestratorCommand() {
       logger.error(`Failed to load workflow: ${result.error.message}`);
       process.exit(ExitCode.ERROR);
     }
-    const { config, promptTemplate, warnings } = result.value;
+    const { config, promptTemplate, localPromptTemplate, warnings } = result.value;
     for (const w of warnings) logger.warn(w);
-    const daemon = new Orchestrator(config, promptTemplate, { discoverCandidates });
+    const daemon = new Orchestrator(config, promptTemplate, {
+      discoverCandidates,
+      ...localPromptTemplate !== void 0 ? { localPromptTemplate } : {}
+    });
     const shutdown = () => {
       daemon.stop();
       process.exit(ExitCode.SUCCESS);
@@ -11792,7 +11795,7 @@ function firstModel(model) {
   if (Array.isArray(model)) return model[0];
   return model;
 }
-function resolveTriageProvider(config, modelOverride) {
+function resolveTriageProvider(config, modelOverride, localModelPreference) {
   const explicit = config?.intelligence?.provider;
   if (explicit) {
     if (explicit.kind === "anthropic") {
@@ -11815,7 +11818,7 @@ function resolveTriageProvider(config, modelOverride) {
   if (!backends) return null;
   const local = pickBackend(backends, ["local", "pi"]);
   if (local && local.endpoint) {
-    const model = modelOverride ?? firstModel(local.model);
+    const model = modelOverride ?? localModelPreference ?? firstModel(local.model);
     return new OpenAICompatibleAnalysisProvider2({
       apiKey: local.apiKey ?? "ollama",
       baseUrl: local.endpoint,
@@ -11841,6 +11844,48 @@ function pickBackend(backends, types) {
   return null;
 }
 
+// src/commands/roadmap/triage-pool.ts
+import {
+  PoolStateStore,
+  poolStateToCandidates
+} from "@harness-engineering/orchestrator";
+var PROBE_TIMEOUT_MS = 4e3;
+async function probeServedModels(endpoint, apiKey, fetchImpl) {
+  const url = endpoint.replace(/\/$/, "") + "/models";
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(url, {
+      signal: controller.signal,
+      ...apiKey !== void 0 ? { headers: { Authorization: `Bearer ${apiKey}` } } : {}
+    });
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    const ids = (body.data ?? []).map((m) => m.id).filter((id) => typeof id === "string" && id.length > 0);
+    return new Set(ids);
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function resolvePreferredLocalModel(profile, deps = {}) {
+  try {
+    const store = deps.store ?? new PoolStateStore();
+    await store.load();
+    const candidates = poolStateToCandidates(store.snapshot(), profile).filter(
+      (name) => typeof name === "string" && name.length > 0
+    );
+    if (candidates.length === 0) return void 0;
+    if (deps.endpoint === void 0) return void 0;
+    const served = await probeServedModels(deps.endpoint, deps.apiKey, deps.fetchImpl ?? fetch);
+    if (served === void 0) return void 0;
+    return candidates.find((name) => served.has(name));
+  } catch {
+    return void 0;
+  }
+}
+
 // src/commands/roadmap/triage-approve.ts
 import {
   detectScopeTier,
@@ -12010,12 +12055,13 @@ async function runTriageReport(roadmap, deps = {}) {
     ...deps.only !== void 0 ? { only: deps.only } : {},
     ...deps.limit !== void 0 ? { limit: deps.limit } : {}
   });
+  const useModel = deps.offline !== true && deps.provider != null;
   const cheapDeps = {
     ...deps.graphStore ? { graphStore: deps.graphStore } : {},
     ...deps.precedent ? { precedent: deps.precedent } : {},
-    ...deps.config ? { config: deps.config } : {}
+    ...deps.config ? { config: deps.config } : {},
+    ...useModel ? { modelDeferred: true } : {}
   };
-  const useModel = deps.offline !== true && deps.provider != null;
   const rows = [];
   for (const feature of features) {
     let verdict = await triageIssue(featureToIssue(feature), cheapDeps);
@@ -12214,10 +12260,29 @@ function renderBrainstormJson(rows) {
     2
   );
 }
-function resolveBrainstormProvider(configPath, model) {
+async function resolveBrainstormProvider(configPath, model) {
   const configResult = resolveConfig(configPath);
   if (!configResult.ok) return null;
-  return resolveTriageProvider(configResult.value, model);
+  const config = configResult.value;
+  const localBackend = pickLocalBackendConn(config);
+  const preferredLocalModel = await resolvePreferredLocalModel("reasoning", {
+    ...localBackend?.endpoint !== void 0 ? { endpoint: localBackend.endpoint } : {},
+    ...localBackend?.apiKey !== void 0 ? { apiKey: localBackend.apiKey } : {}
+  });
+  return resolveTriageProvider(config, model, preferredLocalModel);
+}
+function pickLocalBackendConn(config) {
+  const backends = config.agent?.backends;
+  if (!backends) return void 0;
+  for (const def of Object.values(backends)) {
+    if (def.type === "local" || def.type === "pi") {
+      return {
+        ...def.endpoint !== void 0 ? { endpoint: def.endpoint } : {},
+        ...def.apiKey !== void 0 ? { apiKey: def.apiKey } : {}
+      };
+    }
+  }
+  return void 0;
 }
 async function runApproveCommand(cwd, opts) {
   const configResult = resolveConfig(opts.config);
@@ -12234,7 +12299,7 @@ async function runApproveCommand(cwd, opts) {
   const parsed = parseRoadmap(fs36.readFileSync(roadmapPath, "utf-8"));
   if (!parsed.ok) return { marked: [], held: [], note: "roadmap-parse-error" };
   const graphStore = await loadGraphStore(cwd);
-  const provider = resolveBrainstormProvider(opts.config);
+  const provider = await resolveBrainstormProvider(opts.config);
   const precedent = await buildPrecedentLookup(cwd);
   const rows = await runBrainstormReport(parsed.value, {
     ...graphStore ? { graphStore } : {},
@@ -12339,7 +12404,7 @@ async function runTriageCommandAction(opts, cmd) {
   if (!parsed) return;
   const graphStore = await loadGraphStore(cwd);
   const precedent = await buildPrecedentLookup(cwd);
-  const provider = opts.offline === true ? null : resolveBrainstormProvider(globalOpts.config);
+  const provider = opts.offline === true ? null : await resolveBrainstormProvider(globalOpts.config);
   const onProgress = globalOpts.json === true ? void 0 : (message) => logger.info(message);
   const shared = {
     ...graphStore ? { graphStore } : {},
@@ -14114,6 +14179,17 @@ function detectComplexity(projectPath) {
 }
 
 // src/commands/skill/preamble.ts
+var AUTONOMOUS_SECTION = `## Autonomous Decision-Making: Active
+
+You are running this workflow **headless \u2014 there is no human in this session to answer questions.**
+
+Wherever this skill instructs you to present options and a recommendation and then STOP and wait for the human (design forks, \`emit_interaction\`/\`AskUserQuestion\` prompts, spec sign-off, the next-skill handoff), do NOT wait. Instead:
+
+1. Do the full analysis exactly as written \u2014 honor every gate (at least two approaches with tradeoffs, YAGNI, the persona council, soundness review). Autonomy narrows the decider, never the rigor.
+2. Commit to the option **you** recommend, and record the question, the chosen answer, and the rationale in the spec's **"Decisions made"** section.
+3. Continue to the next step. Self-approve the Phase-4 sign-off once the soundness review converges; proceed through the handoff to the next skill.
+
+**Safety valve \u2014 surface, do not bury.** For any decision made at **low confidence**, and for any **strategy contradiction** the skill says to "never auto-resolve," still decide and proceed, but additionally record it under an **"## Autonomous decisions requiring review"** heading in the spec (question, your call, confidence, why) so the human's PR review sees exactly what you decided and where you were unsure. You are the decider, not a shortcut \u2014 the human's checkpoint is the PR, not a mid-run pause.`;
 function buildActivePhasesSection(complexity, phases) {
   const lines = [`## Active Phases (complexity: ${complexity})`];
   for (const phase of phases) {
@@ -14138,6 +14214,9 @@ ${priorState}`);
 }
 function buildPreamble(options) {
   const sections = [];
+  if (options.autonomous) {
+    sections.push(AUTONOMOUS_SECTION);
+  }
   if (options.complexity && options.phases && options.phases.length > 0) {
     sections.push(buildActivePhasesSection(options.complexity, options.phases));
   }
@@ -14256,7 +14335,8 @@ async function runSkill(name, opts) {
     ...opts.phase !== void 0 && { phase: opts.phase },
     ...priorState !== void 0 && { priorState },
     ...stateWarning !== void 0 && { stateWarning },
-    ...opts.party !== void 0 && { party: opts.party }
+    ...opts.party !== void 0 && { party: opts.party },
+    ...opts.autonomous !== void 0 && { autonomous: opts.autonomous }
   });
   const skillMdPath = path66.join(skillDir, "SKILL.md");
   if (!fs42.existsSync(skillMdPath)) {
@@ -14277,6 +14357,9 @@ async function runSkill(name, opts) {
 }
 function createRunCommand3() {
   return new Command104("run").description("Run a skill (outputs SKILL.md content with context preamble)").argument("<name>", "Skill name (e.g., harness-tdd)").option("--path <path>", "Project root path for context injection").option("--complexity <level>", "Rigor level: fast, standard, thorough", "standard").option("--phase <name>", "Start at a specific phase (for re-entry)").option("--party", "Enable multi-perspective evaluation").option(
+    "--autonomous",
+    "Headless mode: inject the autonomous-decider preamble so the agent decides every fork at full rigor (recording each decision in the spec) instead of pausing for a human"
+  ).option(
     "--backend <name>",
     "Spec B: one-shot routing override forwarded to the orchestrator as HARNESS_BACKEND_OVERRIDE"
   ).action(async (name, opts) => runSkill(name, opts));

package/dist/index.d.ts

@@ -18,6 +18,7 @@ interface PreambleOptions {
     priorState?: string;
     stateWarning?: string;
     party?: boolean;
+    autonomous?: boolean;
 }
 declare function buildPreamble(options: PreambleOptions): string;
 
@@ -864,6 +865,7 @@ declare const HarnessConfigSchema: z.ZodObject<{
                     model?: string | undefined;
                 } | undefined;
             }>>;
+            workflowGates: z.ZodOptional<z.ZodEnum<["local", "primary"]>>;
         }, "strict", z.ZodTypeAny, {
             default: string | readonly [string, ...string[]];
             'quick-fix'?: string | readonly [string, ...string[]] | undefined;
@@ -898,6 +900,7 @@ declare const HarnessConfigSchema: z.ZodObject<{
                     model?: string | undefined;
                 } | undefined;
             } | undefined;
+            workflowGates?: "local" | "primary" | undefined;
         }, {
             default: string | readonly [string, ...string[]];
             'quick-fix'?: string | readonly [string, ...string[]] | undefined;
@@ -932,6 +935,7 @@ declare const HarnessConfigSchema: z.ZodObject<{
                     model?: string | undefined;
                 } | undefined;
             } | undefined;
+            workflowGates?: "local" | "primary" | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
         executor: "subprocess" | "cloud" | "noop";
@@ -1059,6 +1063,7 @@ declare const HarnessConfigSchema: z.ZodObject<{
                     model?: string | undefined;
                 } | undefined;
             } | undefined;
+            workflowGates?: "local" | "primary" | undefined;
         } | undefined;
     }, {
         executor?: "subprocess" | "cloud" | "noop" | undefined;
@@ -1186,6 +1191,7 @@ declare const HarnessConfigSchema: z.ZodObject<{
                     model?: string | undefined;
                 } | undefined;
             } | undefined;
+            workflowGates?: "local" | "primary" | undefined;
         } | undefined;
     }>>;
     /** Source-file ingestion controls (skip-dirs, exclude patterns, gitignore handling) */
@@ -2825,6 +2831,7 @@ declare const HarnessConfigSchema: z.ZodObject<{
                     model?: string | undefined;
                 } | undefined;
             } | undefined;
+            workflowGates?: "local" | "primary" | undefined;
         } | undefined;
     } | undefined;
     ingest?: {
@@ -3247,6 +3254,7 @@ declare const HarnessConfigSchema: z.ZodObject<{
                     model?: string | undefined;
                 } | undefined;
             } | undefined;
+            workflowGates?: "local" | "primary" | undefined;
         } | undefined;
     } | undefined;
     ingest?: {

package/dist/index.js

@@ -12,7 +12,7 @@ import {
   runSnapshotCapture,
   runUninstall,
   runUninstallConstraints
-} from "./chunk-MSJJU6KH.js";
+} from "./chunk-SHOTI4TA.js";
 import {
   generateRuntime
 } from "./chunk-PYDUECJ3.js";

package/dist/templates/orchestrator/harness.orchestrator.local.md

@@ -0,0 +1,195 @@
+---
+tracker:
+  kind: roadmap
+  filePath: docs/roadmap.md
+  activeStates: [planned, in-progress]
+  terminalStates: [done]
+polling:
+  intervalMs: 30000
+workspace:
+  root: .harness/workspaces
+hooks:
+  afterCreate: null
+  beforeRun: null
+  afterRun: null
+  beforeRemove: null
+  timeoutMs: 60000
+agent:
+  # Named backend definitions (Spec 2). See docs/guides/multi-backend-routing.md.
+  # `capabilities` (tier/cost/privacy/context) let AMR compare backends and select a
+  # capability tier per dispatch — a backend without one is invisible to tier selection.
+  backends:
+    primary:
+      type: claude
+      command: claude
+      capabilities:
+        { tier: strong, costPer1kTokens: 15, privacyClass: shared-cloud, contextWindow: 200000 }
+    # Local backend for autonomous execution of simple tasks.
+    # `model` accepts a string OR a prefer-and-fallback array — first
+    # match wins after a `/v1/models` probe.
+    local:
+      type: pi
+      # Ollama's OpenAI-compatible API lives under /v1 (the resolver probes
+      # `${endpoint}/models`). Names must match `ollama list` exactly.
+      endpoint: http://127.0.0.1:11434/v1
+      # Prefer-and-fallback: first name present in /v1/models wins. Coder model
+      # first (local routes are quick-fix/diagnostic), general model as fallback.
+      # Quote the names — the ':tag' colon otherwise breaks YAML flow parsing.
+      model: ['qwen2.5-coder:7b', 'gemma3n:e4b']
+      capabilities:
+        { tier: fast, costPer1kTokens: 0, privacyClass: on-device, contextWindow: 32768 }
+  # Routing — controls WHICH backend handles each use case.
+  routing:
+    default: primary
+    quick-fix: local
+    diagnostic: local
+    # Route the intelligence pipeline (sel/pesl) to the local backend.
+    intelligence:
+      sel: local
+      pesl: local
+    # AMR (Adaptive Model Routing) — opt-in; its PRESENCE flips dispatch from the
+    # identity/default chain to complexity-aware tier selection. trivial/simple →
+    # local (fast, free); moderate/complex → claude (no `standard` backend, so a
+    # `standard` requirement resolves to the cheapest backend at-or-above it =
+    # primary). The always-on baseline-relative security-defect feeder climbs a
+    # unit's tier after `escalationThreshold` consecutive quality failures
+    # (strong-capped, then hard-fails to a human). Budget cap + LLM acceptance-eval
+    # are available opt-ins (docs/guides/adaptive-model-routing.md) — left off here.
+    policy:
+      complexityTierMatrix: { trivial: fast, simple: fast, moderate: standard, complex: strong }
+      escalationThreshold: 2
+  # Escalation — controls WHETHER a tier dispatches at all (orthogonal to routing).
+  escalation:
+    alwaysHuman: [full-exploration]
+    autoExecute: [quick-fix, diagnostic]
+    primaryExecute: [guided-change]
+    signalGated: []
+    diagnosticRetryBudget: 1
+  maxConcurrentAgents: 1
+  maxTurns: 10
+  maxRetryBackoffMs: 5000
+  maxConcurrentAgentsByState: {}
+  globalCooldownMs: 60000
+  maxRequestsPerMinute: 50
+  maxRequestsPerSecond: 1
+  # Default limits based on Anthropic Tier 3. Adjust according to your account tier.
+  # Tier 1: 40k ITPM / 10k OTPM
+  # Tier 2: 200k ITPM / 40k OTPM
+  # Tier 3: 400k ITPM / 80k OTPM
+  # Tier 4: 1m ITPM / 200k OTPM
+  maxInputTokensPerMinute: 400000
+  maxOutputTokensPerMinute: 80000
+  turnTimeoutMs: 300000
+  readTimeoutMs: 30000
+  stallTimeoutMs: 60000
+intelligence:
+  enabled: true
+  requestTimeoutMs: 180000
+server:
+  port: 8080
+localModels:
+  enabled: true
+  pool:
+    diskBudgetGb: 100
+    allowedOrgs: [Qwen, deepseek-ai, meta-llama, google]
+    allowedFamilies: []
+  refresh:
+    intervalMs: 86400000
+    proposalThreshold: 5
+    jitterMs: 600000
+  installer:
+    backend: ollama
+    ollamaEndpoint: http://127.0.0.1:11434
+# Built-in maintenance tasks run on cron when `maintenance.enabled: true`.
+# Notable housekeeping tasks: `main-sync` (every 15 min) fast-forwards the
+# orchestrator's local default branch from origin so files read from `cwd`
+# (e.g., docs/roadmap.md, harness.orchestrator.md) stay current. Sync is
+# fast-forward-only — never destructive — and skips with a structured
+# warning event if the working tree is dirty, the branch is wrong, or the
+# local default has diverged. Disable all maintenance via `maintenance.enabled: false`.
+#
+# Per-task Run Now (since 2026-05-09): the dashboard Maintenance page renders
+# a Run Now button on every row of the schedule table. The previous single-
+# button affordance (which always triggered `project-health`) has been
+# removed. Each button is disabled while a `maintenance:started` event is in
+# flight for that task ID and re-enables on the matching `maintenance:completed`
+# or `maintenance:error` event.
+maintenance:
+  enabled: true
+---
+
+# Prompt Template (Local Backend — bootstrap shim)
+
+You are a local agent with `bash`, `read`, `write`, `grep`, and `find`. You do
+NOT have `/harness:*` slash commands or harness MCP tools. You run the REAL
+harness workflow skills by reading them over bash — this template carries no
+methodology of its own.
+
+## Issue: {{ issue.title }}
+
+**Identifier:** {{ issue.identifier }}
+**Description:** {{ issue.description }}
+
+## How to run a harness skill (the indirection rule)
+
+To run any harness workflow skill, execute it over bash and follow its output
+**verbatim**:
+
+```bash
+harness skill run <skill-name> --autonomous --path .
+```
+
+`harness skill run` prints the skill's full instructions (the same content the
+primary backend gets from a `/harness:*` slash command) to stdout as a plain CLI
+read. `--autonomous` prepends the headless-decider preamble: you do the full
+analysis at full rigor but YOU decide every fork and record it in the spec — you
+never pause for a human.
+
+**Redirect rule.** Whenever a skill's output instructs you to run `/harness:X`,
+instead run `harness skill run harness-X --autonomous`. Slash commands are
+unavailable on this backend; the skill-run indirection is their equivalent.
+
+## Full-workflow entry sequence
+
+Run these in order, each via `harness skill run <name> --autonomous --path .`,
+following each skill's output before moving on:
+
+1. `harness-brainstorming` — runs at full rigor (≥2 approaches, YAGNI, persona
+   council, soundness), but YOU decide the forks (autonomous) and record each
+   decision in the spec.
+2. `harness-planning`
+3. `harness-execution` (or `harness-tdd` for test-driven work)
+4. `harness-verification`
+5. `harness-code-review`
+
+Run `harness skill list` to see the full roster of available skills.
+
+## Gates (enforced by the harness, not just by you)
+
+The orchestrator INDEPENDENTLY enforces `harness validate` plus the
+verify/outcome-eval gates against your branch after you exit — you cannot ship
+past a red gate. Reach a green state: run `harness validate` and the project's
+own typecheck/lint/test yourself and fix every failure before shipping. A run
+that cannot reach green is halted and re-dispatched rather than shipped, and
+escalated to a human if the retry budget is exhausted.
+
+## Ship (only after the gates are green)
+
+- Create a topic branch if you are still on `main`/`master`
+  (e.g. `feat/{{ issue.identifier }}`).
+- Stage your changes and create a descriptive commit (Conventional Commits style).
+- Push the branch with `git push -u origin HEAD`.
+- Open a pull request with `gh pr create`. Use a HEREDOC for the body:
+
+  ```bash
+  gh pr create --title "<title>" --body "$(cat <<'EOF'
+  ## Summary
+
+  <body content with real newlines>
+  EOF
+  )"
+  ```
+
+- Report the PR URL as your final output, then stop.
+
+Attempt Number: {{ attempt }}

package/dist/templates/orchestrator/harness.orchestrator.md

@@ -82,6 +82,11 @@ Your goal is to implement the following issue using the standard Harness Enginee
 Follow these steps exactly, using the corresponding slash commands to ensure
 high-quality, architecturally sound delivery:
 
+<!-- This slash-command workflow targets Claude-shaped backends. A backend-specific
+     variant, `harness.orchestrator.local.md`, is auto-selected for `local`/`pi`
+     backends (which lack `/harness:*` slash commands) and expresses the same
+     workflow via bash `harness <gate>` CLI calls. See ADR 0071. -->
+
 1. **Brainstorming:** Use `/harness:brainstorming` to explore the problem space
    and draft a technical proposal in `docs/changes/`. The spec MUST include an
    Integration Points section defining how the feature connects to the system.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harness-engineering/cli",
-  "version": "8.0.0",
+  "version": "9.0.0",
   "description": "CLI for Harness Engineering toolkit",
   "type": "module",
   "bin": {
@@ -39,16 +39,16 @@
     "web-tree-sitter": "^0.24.7",
     "yaml": "^2.8.3",
     "zod": "^3.25.76",
-    "@harness-engineering/core": "0.37.0",
-    "@harness-engineering/dashboard": "0.14.4",
-    "@harness-engineering/graph": "0.11.8",
+    "@harness-engineering/core": "0.37.1",
+    "@harness-engineering/dashboard": "0.14.5",
+    "@harness-engineering/graph": "0.11.9",
     "@harness-engineering/linter-gen": "0.1.7",
-    "@harness-engineering/orchestrator": "0.15.1",
-    "@harness-engineering/signals": "0.2.6",
-    "@harness-engineering/types": "0.22.0"
+    "@harness-engineering/orchestrator": "0.16.0",
+    "@harness-engineering/signals": "0.2.7",
+    "@harness-engineering/types": "0.23.0"
   },
   "peerDependencies": {
-    "@harness-engineering/intelligence": "0.8.0"
+    "@harness-engineering/intelligence": "0.9.0"
   },
   "peerDependenciesMeta": {
     "@harness-engineering/intelligence": {