@harness-engineering/core 0.27.0 → 0.28.0

package/dist/index.mjs

@@ -221,15 +221,15 @@ function validateConfig(data, schema) {
   let message = "Configuration validation failed";
   const suggestions = [];
   if (firstError) {
-    const path48 = firstError.path.join(".");
-    const pathDisplay = path48 ? ` at "${path48}"` : "";
+    const path50 = firstError.path.join(".");
+    const pathDisplay = path50 ? ` at "${path50}"` : "";
     if (firstError.code === "invalid_type") {
       const received = firstError.received;
       const expected = firstError.expected;
       if (received === "undefined") {
         code = "MISSING_FIELD";
         message = `Missing required field${pathDisplay}: ${firstError.message}`;
-        suggestions.push(`Field "${path48}" is required and must be of type "${expected}"`);
+        suggestions.push(`Field "${path50}" is required and must be of type "${expected}"`);
       } else {
         code = "INVALID_TYPE";
         message = `Invalid type${pathDisplay}: ${firstError.message}`;
@@ -683,16 +683,16 @@ function makeFinding(input) {
   if (input.suggestion) finding.suggestion = input.suggestion;
   return finding;
 }
-function readTextSafe(path48) {
+function readTextSafe(path50) {
   try {
-    return readFileSync(path48, "utf-8");
+    return readFileSync(path50, "utf-8");
   } catch {
     return null;
   }
 }
-function safeFileSize(path48) {
+function safeFileSize(path50) {
   try {
-    return statSync(path48).size;
+    return statSync(path50).size;
   } catch {
     return null;
   }
@@ -1286,27 +1286,27 @@ function extractSections(content) {
   }
   return sections.map((section) => buildAgentMapSection(section, lines));
 }
-function isExternalLink(path48) {
-  return path48.startsWith("http://") || path48.startsWith("https://") || path48.startsWith("#") || path48.startsWith("mailto:");
+function isExternalLink(path50) {
+  return path50.startsWith("http://") || path50.startsWith("https://") || path50.startsWith("#") || path50.startsWith("mailto:");
 }
 function resolveLinkPath(linkPath, baseDir) {
   return linkPath.startsWith(".") ? join8(baseDir, linkPath) : linkPath;
 }
-async function validateAgentsMap(path48 = "./AGENTS.md") {
-  const contentResult = await readFileContent(path48);
+async function validateAgentsMap(path50 = "./AGENTS.md") {
+  const contentResult = await readFileContent(path50);
   if (!contentResult.ok) {
     return Err(
       createError(
         "PARSE_ERROR",
         `Failed to read AGENTS.md: ${contentResult.error.message}`,
-        { path: path48 },
+        { path: path50 },
         ["Ensure the file exists", "Check file permissions"]
       )
     );
   }
   const content = contentResult.value;
   const sections = extractSections(content);
-  const baseDir = dirname2(path48);
+  const baseDir = dirname2(path50);
   const sectionTitles = sections.map((s) => s.title);
   const missingSections = REQUIRED_SECTIONS.filter(
     (required) => !sectionTitles.some((title) => title.toLowerCase().includes(required.toLowerCase()))
@@ -1913,8 +1913,8 @@ async function checkDocCoverage(domain, options = {}) {
 
 // src/context/knowledge-map.ts
 import { join as join14, basename as basename3 } from "path";
-function suggestFix(path48, existingFiles) {
-  const targetName = basename3(path48).toLowerCase();
+function suggestFix(path50, existingFiles) {
+  const targetName = basename3(path50).toLowerCase();
   const similar = existingFiles.find((file) => {
     const fileName = basename3(file).toLowerCase();
     return fileName.includes(targetName) || targetName.includes(fileName);
@@ -1922,7 +1922,7 @@ function suggestFix(path48, existingFiles) {
   if (similar) {
     return `Did you mean "${similar}"?`;
   }
-  return `Create the file "${path48}" or remove the link`;
+  return `Create the file "${path50}" or remove the link`;
 }
 async function validateKnowledgeMap(rootDir = process.cwd()) {
   const agentsPath = join14(rootDir, "AGENTS.md");
@@ -2399,8 +2399,8 @@ function createBoundaryValidator(schema, name) {
         return Ok(result.data);
       }
       const suggestions = result.error.issues.map((issue) => {
-        const path48 = issue.path.join(".");
-        return path48 ? `${path48}: ${issue.message}` : issue.message;
+        const path50 = issue.path.join(".");
+        return path50 ? `${path50}: ${issue.message}` : issue.message;
       });
       return Err(
         createError(
@@ -4279,12 +4279,12 @@ function parseDiffHeader(part) {
   return headerMatch[2];
 }
 function parseDiffPart(part) {
-  const path48 = parseDiffHeader(part);
-  if (!path48) return null;
+  const path50 = parseDiffHeader(part);
+  if (!path50) return null;
   const additionRegex = /^\+(?!\+\+)/gm;
   const deletionRegex = /^-(?!--)/gm;
   return {
-    path: path48,
+    path: path50,
     status: detectFileStatus(part),
     additions: (part.match(additionRegex) || []).length,
     deletions: (part.match(deletionRegex) || []).length
@@ -9144,6 +9144,98 @@ var SecurityScanner = class {
   }
 };
 
+// src/security/osv-client.ts
+import * as fs30 from "fs";
+import * as path26 from "path";
+var OSV_ENDPOINT = "https://api.osv.dev/v1/query";
+var DEFAULT_CACHE_DIR = path26.join(".harness", "cache", "osv");
+var DEFAULT_TTL_HOURS = 24;
+function createOsvClient(options = {}) {
+  const cacheDir = options.cacheDir ?? DEFAULT_CACHE_DIR;
+  const ttlMs = (options.cacheTtlHours ?? DEFAULT_TTL_HOURS) * 60 * 60 * 1e3;
+  const fetchFn = options.fetchFn ?? globalThis.fetch;
+  const logger = options.logger ?? { warn: (m, ctx) => console.warn(m, ctx) };
+  const strict = options.strict ?? false;
+  return {
+    async check(pkg) {
+      const cacheKey = `${pkg.ecosystem}-${sanitizePkgName(pkg.name)}@${pkg.version ?? "latest"}.json`;
+      const cachePath = path26.join(cacheDir, cacheKey);
+      const cached = await readCache(cachePath, ttlMs);
+      if (cached) {
+        return { ...cached, source: "cache" };
+      }
+      try {
+        const advisories = await queryOsv(fetchFn, pkg);
+        const result = classify(advisories);
+        await writeCache(cachePath, result);
+        return { ...result, source: "network" };
+      } catch (err) {
+        const message = `OSV query failed for ${pkg.name}@${pkg.version ?? "latest"}: ${String(err)}`;
+        if (strict) {
+          throw new Error(message, { cause: err });
+        }
+        logger.warn(message, { pkg });
+        return { malicious: [], other: [], source: "fail-open" };
+      }
+    },
+    async clearCache() {
+      try {
+        await fs30.promises.rm(cacheDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  };
+}
+async function queryOsv(fetchFn, pkg) {
+  const body = {
+    package: { ecosystem: pkg.ecosystem, name: pkg.name }
+  };
+  if (pkg.version) body.version = pkg.version;
+  const response = await fetchFn(OSV_ENDPOINT, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    throw new Error(`OSV returned HTTP ${response.status}`);
+  }
+  const json = await response.json();
+  return json.vulns ?? [];
+}
+function classify(advisories) {
+  const malicious = [];
+  const other = [];
+  for (const a of advisories) {
+    if (typeof a?.id === "string" && a.id.startsWith("MAL-")) {
+      malicious.push(a);
+    } else {
+      other.push(a);
+    }
+  }
+  return { malicious, other };
+}
+async function readCache(cachePath, ttlMs) {
+  try {
+    const stat2 = await fs30.promises.stat(cachePath);
+    if (Date.now() - stat2.mtimeMs > ttlMs) return null;
+    const buf = await fs30.promises.readFile(cachePath, "utf-8");
+    const parsed = JSON.parse(buf);
+    return { malicious: parsed.malicious ?? [], other: parsed.other ?? [] };
+  } catch {
+    return null;
+  }
+}
+async function writeCache(cachePath, payload) {
+  try {
+    await fs30.promises.mkdir(path26.dirname(cachePath), { recursive: true });
+    await fs30.promises.writeFile(cachePath, JSON.stringify(payload, null, 2), "utf-8");
+  } catch {
+  }
+}
+function sanitizePkgName(name) {
+  return name.replace(/[/\\]/g, "__");
+}
+
 // src/security/injection-patterns.ts
 var hiddenUnicodePatterns = [
   {
@@ -9382,12 +9474,12 @@ var DESTRUCTIVE_BASH = [
 
 // src/security/taint.ts
 import { readFileSync as readFileSync22, writeFileSync as writeFileSync14, unlinkSync as unlinkSync2, mkdirSync as mkdirSync13, readdirSync as readdirSync3 } from "fs";
-import { join as join37, dirname as dirname9 } from "path";
+import { join as join38, dirname as dirname10 } from "path";
 var TAINT_DURATION_MS = 30 * 60 * 1e3;
 var DEFAULT_SESSION_ID = "default";
 function getTaintFilePath(projectRoot, sessionId) {
   const id = sessionId || DEFAULT_SESSION_ID;
-  return join37(projectRoot, ".harness", `session-taint-${id}.json`);
+  return join38(projectRoot, ".harness", `session-taint-${id}.json`);
 }
 function readTaint(projectRoot, sessionId) {
   const filePath = getTaintFilePath(projectRoot, sessionId);
@@ -9437,7 +9529,7 @@ function writeTaint(projectRoot, sessionId, reason, findings, source) {
   const id = sessionId || DEFAULT_SESSION_ID;
   const filePath = getTaintFilePath(projectRoot, id);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const dir = dirname9(filePath);
+  const dir = dirname10(filePath);
   mkdirSync13(dir, { recursive: true });
   const existing = readTaint(projectRoot, id);
   const maxSeverity = findings.some((f) => f.severity === "high") ? "high" : "medium";
@@ -9469,14 +9561,14 @@ function clearTaint(projectRoot, sessionId) {
       return 0;
     }
   }
-  const harnessDir = join37(projectRoot, ".harness");
+  const harnessDir = join38(projectRoot, ".harness");
   let count = 0;
   try {
     const files = readdirSync3(harnessDir);
     for (const file of files) {
       if (file.startsWith("session-taint-") && file.endsWith(".json")) {
         try {
-          unlinkSync2(join37(harnessDir, file));
+          unlinkSync2(join38(harnessDir, file));
           count++;
         } catch {
         }
@@ -9487,7 +9579,7 @@ function clearTaint(projectRoot, sessionId) {
   return count;
 }
 function listTaintedSessions(projectRoot) {
-  const harnessDir = join37(projectRoot, ".harness");
+  const harnessDir = join38(projectRoot, ".harness");
   const sessions = [];
   try {
     const files = readdirSync3(harnessDir);
@@ -9659,13 +9751,13 @@ var EMPTY_SUPPLY_CHAIN = {
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync15, renameSync as renameSync7, mkdirSync as mkdirSync14, existsSync as existsSync34 } from "fs";
 import { execSync as execSync3 } from "child_process";
 import { randomBytes } from "crypto";
-import { isAbsolute as isAbsolute4, join as join38, relative as relative3, dirname as dirname10 } from "path";
+import { isAbsolute as isAbsolute4, join as join39, relative as relative3, dirname as dirname11 } from "path";
 var SecurityTimelineManager = class _SecurityTimelineManager {
   rootDir;
   timelinePath;
   constructor(rootDir) {
     this.rootDir = rootDir;
-    this.timelinePath = join38(rootDir, ".harness", "security", "timeline.json");
+    this.timelinePath = join39(rootDir, ".harness", "security", "timeline.json");
   }
   /**
    * Load timeline from disk.
@@ -9709,7 +9801,7 @@ var SecurityTimelineManager = class _SecurityTimelineManager {
    * Save timeline to disk using atomic write (temp file + rename).
    */
   save(timeline) {
-    const dir = dirname10(this.timelinePath);
+    const dir = dirname11(this.timelinePath);
     if (!existsSync34(dir)) {
       mkdirSync14(dir, { recursive: true });
     }
@@ -10059,7 +10151,7 @@ var SecurityTimelineManager = class _SecurityTimelineManager {
 };
 
 // src/ci/check-orchestrator.ts
-import * as path26 from "path";
+import * as path27 from "path";
 import { skipDirGlobs as skipDirGlobs3 } from "@harness-engineering/graph";
 import { GraphStore, queryTraceability } from "@harness-engineering/graph";
 var ALL_CHECKS = [
@@ -10075,7 +10167,7 @@ var ALL_CHECKS = [
 ];
 async function runValidateCheck(projectRoot, config) {
   const issues = [];
-  const agentsPath = path26.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
+  const agentsPath = path27.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
   const result = await validateAgentsMap(agentsPath);
   if (!result.ok) {
     issues.push({ severity: "error", message: result.error.message });
@@ -10132,7 +10224,7 @@ async function runDepsCheck(projectRoot, config) {
 }
 async function runDocsCheck(projectRoot, config) {
   const issues = [];
-  const docsDir = path26.join(projectRoot, config.docsDir ?? "docs");
+  const docsDir = path27.join(projectRoot, config.docsDir ?? "docs");
   const entropyConfig = config.entropy || {};
   const result = await checkDocCoverage("project", {
     docsDir,
@@ -10311,7 +10403,7 @@ async function runTraceabilityCheck(projectRoot, config) {
   const issues = [];
   const traceConfig = config.traceability || {};
   if (traceConfig.enabled === false) return issues;
-  const graphDir = path26.join(projectRoot, ".harness", "graph");
+  const graphDir = path27.join(projectRoot, ".harness", "graph");
   const store = new GraphStore();
   const loaded = await store.load(graphDir);
   if (!loaded) {
@@ -10534,7 +10626,7 @@ var CINotifier = class {
 };
 
 // src/review/mechanical-checks.ts
-import * as path27 from "path";
+import * as path28 from "path";
 async function runMechanicalChecks(options) {
   const { projectRoot, config, skip = [], changedFiles } = options;
   const findings = [];
@@ -10546,7 +10638,7 @@ async function runMechanicalChecks(options) {
   };
   if (!skip.includes("validate")) {
     try {
-      const agentsPath = path27.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
+      const agentsPath = path28.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
       const result = await validateAgentsMap(agentsPath);
       if (!result.ok) {
         statuses.validate = "fail";
@@ -10583,7 +10675,7 @@ async function runMechanicalChecks(options) {
       statuses.validate = "fail";
       findings.push({
         tool: "validate",
-        file: path27.join(projectRoot, "AGENTS.md"),
+        file: path28.join(projectRoot, "AGENTS.md"),
         message: err instanceof Error ? err.message : String(err),
         severity: "error"
       });
@@ -10647,7 +10739,7 @@ async function runMechanicalChecks(options) {
       (async () => {
         const localFindings = [];
         try {
-          const docsDir = path27.join(projectRoot, config.docsDir ?? "docs");
+          const docsDir = path28.join(projectRoot, config.docsDir ?? "docs");
           const result = await checkDocCoverage("project", { docsDir });
           if (!result.ok) {
             statuses["check-docs"] = "warn";
@@ -10674,7 +10766,7 @@ async function runMechanicalChecks(options) {
           statuses["check-docs"] = "warn";
           localFindings.push({
             tool: "check-docs",
-            file: path27.join(projectRoot, "docs"),
+            file: path28.join(projectRoot, "docs"),
             message: err instanceof Error ? err.message : String(err),
             severity: "warning"
           });
@@ -10822,7 +10914,7 @@ function detectChangeType(commitMessage, diff2) {
 }
 
 // src/review/context-scoper.ts
-import * as path28 from "path";
+import * as path29 from "path";
 var ALL_DOMAINS = ["compliance", "bug", "security", "architecture", "learnings"];
 var SECURITY_PATTERNS = /auth|crypto|password|secret|token|session|cookie|hash|encrypt|decrypt|sql|shell|exec|eval/i;
 function computeContextBudget(diffLines) {
@@ -10830,18 +10922,18 @@ function computeContextBudget(diffLines) {
   return diffLines;
 }
 function isWithinProject(absPath, projectRoot) {
-  const resolvedRoot = path28.resolve(projectRoot) + path28.sep;
-  const resolvedPath = path28.resolve(absPath);
-  return resolvedPath.startsWith(resolvedRoot) || resolvedPath === path28.resolve(projectRoot);
+  const resolvedRoot = path29.resolve(projectRoot) + path29.sep;
+  const resolvedPath = path29.resolve(absPath);
+  return resolvedPath.startsWith(resolvedRoot) || resolvedPath === path29.resolve(projectRoot);
 }
 async function readContextFile(projectRoot, filePath, reason) {
-  const absPath = path28.isAbsolute(filePath) ? filePath : path28.join(projectRoot, filePath);
+  const absPath = path29.isAbsolute(filePath) ? filePath : path29.join(projectRoot, filePath);
   if (!isWithinProject(absPath, projectRoot)) return null;
   const result = await readFileContent(absPath);
   if (!result.ok) return null;
   const content = result.value;
   const lines = content.split("\n").length;
-  const relPath2 = path28.isAbsolute(filePath) ? relativePosix(projectRoot, filePath) : filePath;
+  const relPath2 = path29.isAbsolute(filePath) ? relativePosix(projectRoot, filePath) : filePath;
   return { path: relPath2, content, reason, lines };
 }
 function extractImportSources(content) {
@@ -10862,24 +10954,24 @@ var JS_EXT_FALLBACKS = {
 };
 async function resolveImportPath(projectRoot, fromFile, importSource) {
   if (!importSource.startsWith(".")) return null;
-  const fromDir = path28.dirname(path28.join(projectRoot, fromFile));
-  const basePath = path28.resolve(fromDir, importSource);
+  const fromDir = path29.dirname(path29.join(projectRoot, fromFile));
+  const basePath = path29.resolve(fromDir, importSource);
   if (!isWithinProject(basePath, projectRoot)) return null;
   const relBase = relativePosix(projectRoot, basePath);
-  const sourceExt = path28.extname(relBase);
+  const sourceExt = path29.extname(relBase);
   const candidates = [];
   const fallbacks = JS_EXT_FALLBACKS[sourceExt];
   if (fallbacks) {
     const stripped = relBase.slice(0, -sourceExt.length);
     for (const ext of fallbacks) candidates.push(stripped + ext);
-    candidates.push(path28.join(stripped, "index.ts"));
-    candidates.push(path28.join(stripped, "index.tsx"));
-    candidates.push(path28.join(stripped, "index.jsx"));
+    candidates.push(path29.join(stripped, "index.ts"));
+    candidates.push(path29.join(stripped, "index.tsx"));
+    candidates.push(path29.join(stripped, "index.jsx"));
   }
   candidates.push(relBase + ".ts", relBase + ".tsx", relBase + ".mts");
-  candidates.push(path28.join(relBase, "index.ts"));
+  candidates.push(path29.join(relBase, "index.ts"));
   for (const candidate of candidates) {
-    const absCandidate = path28.join(projectRoot, candidate);
+    const absCandidate = path29.join(projectRoot, candidate);
     if (await fileExists(absCandidate)) {
       return candidate;
     }
@@ -10887,7 +10979,7 @@ async function resolveImportPath(projectRoot, fromFile, importSource) {
   return null;
 }
 async function findTestFiles(projectRoot, sourceFile) {
-  const baseName = path28.basename(sourceFile, path28.extname(sourceFile));
+  const baseName = path29.basename(sourceFile, path29.extname(sourceFile));
   const pattern = `**/${baseName}.{test,spec}.{ts,tsx,mts}`;
   const results = await findFiles(pattern, projectRoot);
   return results.map((f) => relativePosix(projectRoot, f));
@@ -11783,7 +11875,7 @@ async function fanOutReview(options) {
 }
 
 // src/review/validate-findings.ts
-import * as path29 from "path";
+import * as path30 from "path";
 var DOWNGRADE_MAP = {
   critical: "important",
   important: "suggestion",
@@ -11804,7 +11896,7 @@ function normalizePath(filePath, projectRoot) {
   let normalized = filePath;
   normalized = normalized.replace(/\\/g, "/");
   const normalizedRoot = projectRoot.replace(/\\/g, "/");
-  if (path29.isAbsolute(normalized)) {
+  if (path30.isAbsolute(normalized)) {
     const root = normalizedRoot.endsWith("/") ? normalizedRoot : normalizedRoot + "/";
     if (normalized.startsWith(root)) {
       normalized = normalized.slice(root.length);
@@ -11816,12 +11908,12 @@ function normalizePath(filePath, projectRoot) {
   return normalized;
 }
 function resolveImportPath2(currentFile, importPath) {
-  const dir = path29.dirname(currentFile);
-  let resolved = path29.join(dir, importPath).replace(/\\/g, "/");
+  const dir = path30.dirname(currentFile);
+  let resolved = path30.join(dir, importPath).replace(/\\/g, "/");
   if (!resolved.match(/\.(ts|tsx|js|jsx)$/)) {
     resolved += ".ts";
   }
-  return path29.normalize(resolved).replace(/\\/g, "/");
+  return path30.normalize(resolved).replace(/\\/g, "/");
 }
 function enqueueImports(content, current, visited, queue, maxDepth) {
   const importRegex = /import\s+.*?from\s+['"]([^'"]+)['"]/g;
@@ -11853,7 +11945,7 @@ function isMechanicallyExcluded(finding, exclusionSet, projectRoot) {
   const normalizedFile = normalizePath(finding.file, projectRoot);
   if (exclusionSet.isExcluded(normalizedFile, finding.lineRange)) return true;
   if (exclusionSet.isExcluded(finding.file, finding.lineRange)) return true;
-  const absoluteFile = path29.isAbsolute(finding.file) ? finding.file : path29.join(projectRoot, finding.file).replace(/\\/g, "/");
+  const absoluteFile = path30.isAbsolute(finding.file) ? finding.file : path30.join(projectRoot, finding.file).replace(/\\/g, "/");
   return exclusionSet.isExcluded(absoluteFile, finding.lineRange);
 }
 async function validateWithGraph(crossFileRefs, graph) {
@@ -12914,8 +13006,8 @@ function serializeAssignmentHistory(records) {
 }
 
 // src/roadmap/sync.ts
-import * as fs30 from "fs";
-import * as path30 from "path";
+import * as fs31 from "fs";
+import * as path31 from "path";
 import { Ok as Ok3 } from "@harness-engineering/types";
 
 // src/roadmap/status-rank.ts
@@ -12936,7 +13028,7 @@ function isRegression(from, to) {
 // src/roadmap/sync.ts
 function collectAutopilotStatuses(autopilotPath, featurePlans, allTaskStatuses) {
   try {
-    const raw = fs30.readFileSync(autopilotPath, "utf-8");
+    const raw = fs31.readFileSync(autopilotPath, "utf-8");
     const autopilot = JSON.parse(raw);
     if (!autopilot.phases) return;
     const linkedPhases = autopilot.phases.filter(
@@ -12968,10 +13060,10 @@ function inferStatus(feature, projectPath, allFeatures) {
   const featuresWithPlans = allFeatures.filter((f) => f.plans.length > 0);
   const useRootState = featuresWithPlans.length <= 1;
   if (useRootState) {
-    const rootStatePath = path30.join(projectPath, ".harness", "state.json");
-    if (fs30.existsSync(rootStatePath)) {
+    const rootStatePath = path31.join(projectPath, ".harness", "state.json");
+    if (fs31.existsSync(rootStatePath)) {
       try {
-        const raw = fs30.readFileSync(rootStatePath, "utf-8");
+        const raw = fs31.readFileSync(rootStatePath, "utf-8");
         const state = JSON.parse(raw);
         if (state.progress) {
           for (const status of Object.values(state.progress)) {
@@ -12982,14 +13074,14 @@ function inferStatus(feature, projectPath, allFeatures) {
       }
     }
   }
-  const sessionsDir = path30.join(projectPath, ".harness", "sessions");
-  if (fs30.existsSync(sessionsDir)) {
+  const sessionsDir = path31.join(projectPath, ".harness", "sessions");
+  if (fs31.existsSync(sessionsDir)) {
     try {
-      const sessionDirs = fs30.readdirSync(sessionsDir, { withFileTypes: true });
+      const sessionDirs = fs31.readdirSync(sessionsDir, { withFileTypes: true });
       for (const entry of sessionDirs) {
         if (!entry.isDirectory()) continue;
-        const autopilotPath = path30.join(sessionsDir, entry.name, "autopilot-state.json");
-        if (!fs30.existsSync(autopilotPath)) continue;
+        const autopilotPath = path31.join(sessionsDir, entry.name, "autopilot-state.json");
+        if (!fs31.existsSync(autopilotPath)) continue;
         collectAutopilotStatuses(autopilotPath, feature.plans, allTaskStatuses);
       }
     } catch {
@@ -13476,8 +13568,8 @@ var GitHubIssuesSyncAdapter = class {
 };
 
 // src/roadmap/tracker-config.ts
-import * as fs31 from "fs";
-import * as path31 from "path";
+import * as fs32 from "fs";
+import * as path32 from "path";
 function isValidTrackerShape(tracker) {
   if (!tracker || typeof tracker !== "object") return false;
   const t = tracker;
@@ -13490,9 +13582,9 @@ function isValidTrackerShape(tracker) {
 }
 function loadTrackerSyncConfig(projectRoot) {
   try {
-    const configPath = path31.join(projectRoot, "harness.config.json");
-    if (!fs31.existsSync(configPath)) return null;
-    const raw = fs31.readFileSync(configPath, "utf-8");
+    const configPath = path32.join(projectRoot, "harness.config.json");
+    if (!fs32.existsSync(configPath)) return null;
+    const raw = fs32.readFileSync(configPath, "utf-8");
     const config = JSON.parse(raw);
     const tracker = config.roadmap?.tracker;
     if (!isValidTrackerShape(tracker)) return null;
@@ -13503,7 +13595,7 @@ function loadTrackerSyncConfig(projectRoot) {
 }
 
 // src/roadmap/sync-engine.ts
-import * as fs32 from "fs";
+import * as fs33 from "fs";
 function emptySyncResult() {
   return { created: [], updated: [], assignmentChanges: [], errors: [] };
 }
@@ -13616,7 +13708,7 @@ async function fullSync(roadmapPath, adapter2, config, options) {
   });
   await previousSync;
   try {
-    const raw = fs32.readFileSync(roadmapPath, "utf-8");
+    const raw = fs33.readFileSync(roadmapPath, "utf-8");
     const parseResult = parseRoadmap(raw);
     if (!parseResult.ok) {
       return {
@@ -13629,7 +13721,7 @@ async function fullSync(roadmapPath, adapter2, config, options) {
     const tickets = fetchResult.ok ? fetchResult.value : void 0;
     const pushResult = await syncToExternal(roadmap, adapter2, config, tickets);
     const pullResult = await syncFromExternal(roadmap, adapter2, config, options);
-    fs32.writeFileSync(roadmapPath, serializeRoadmap(roadmap), "utf-8");
+    fs33.writeFileSync(roadmapPath, serializeRoadmap(roadmap), "utf-8");
     return {
       created: pushResult.created,
       updated: pushResult.updated,
@@ -14589,13 +14681,13 @@ function makeTrackerConflictBody(err, opts = {}) {
 }
 
 // src/roadmap/load-mode.ts
-import * as fs33 from "fs";
-import * as path32 from "path";
+import * as fs34 from "fs";
+import * as path33 from "path";
 function loadProjectRoadmapMode(projectRoot) {
   try {
-    const configPath = path32.join(projectRoot, "harness.config.json");
-    if (!fs33.existsSync(configPath)) return getRoadmapMode(null);
-    const raw = fs33.readFileSync(configPath, "utf-8");
+    const configPath = path33.join(projectRoot, "harness.config.json");
+    if (!fs34.existsSync(configPath)) return getRoadmapMode(null);
+    const raw = fs34.readFileSync(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     return getRoadmapMode(parsed);
   } catch {
@@ -14604,16 +14696,16 @@ function loadProjectRoadmapMode(projectRoot) {
 }
 
 // src/roadmap/load-tracker-client-config.ts
-import * as fs34 from "fs";
-import * as path33 from "path";
+import * as fs35 from "fs";
+import * as path34 from "path";
 import { Ok as Ok7, Err as Err6 } from "@harness-engineering/types";
 function loadTrackerClientConfigFromProject(projectRoot) {
   try {
-    const configPath = path33.join(projectRoot, "harness.config.json");
-    if (!fs34.existsSync(configPath)) {
+    const configPath = path34.join(projectRoot, "harness.config.json");
+    if (!fs35.existsSync(configPath)) {
       return Err6(new Error("harness.config.json not found"));
     }
-    const cfg = JSON.parse(fs34.readFileSync(configPath, "utf-8"));
+    const cfg = JSON.parse(fs35.readFileSync(configPath, "utf-8"));
     const tracker = cfg.roadmap?.tracker;
     if (!tracker) {
       return Err6(
@@ -14839,13 +14931,13 @@ function mapAction(action) {
 
 // src/roadmap/migrate/run.ts
 import { Ok as Ok8 } from "@harness-engineering/types";
-import * as path34 from "path";
+import * as path35 from "path";
 async function runMigrationPlan(plan, deps, opts) {
   const projectRoot = opts.projectRoot;
-  const roadmapPath = path34.join(projectRoot, "docs", "roadmap.md");
-  const archivedPath = path34.join(projectRoot, "docs", "roadmap.md.archived");
-  const configPath = path34.join(projectRoot, "harness.config.json");
-  const configBackupPath = path34.join(projectRoot, "harness.config.json.pre-migration");
+  const roadmapPath = path35.join(projectRoot, "docs", "roadmap.md");
+  const archivedPath = path35.join(projectRoot, "docs", "roadmap.md.archived");
+  const configPath = path35.join(projectRoot, "harness.config.json");
+  const configBackupPath = path35.join(projectRoot, "harness.config.json.pre-migration");
   const createdSoFar = [];
   const report = {
     created: 0,
@@ -14986,18 +15078,18 @@ var EmitInteractionInputSchema = z11.object({
 });
 
 // src/blueprint/scanner.ts
-import * as fs35 from "fs/promises";
-import * as path35 from "path";
+import * as fs36 from "fs/promises";
+import * as path36 from "path";
 var ProjectScanner = class {
   constructor(rootDir) {
     this.rootDir = rootDir;
   }
   rootDir;
   async scan() {
-    let projectName = path35.basename(this.rootDir);
+    let projectName = path36.basename(this.rootDir);
     try {
-      const pkgPath = path35.join(this.rootDir, "package.json");
-      const pkgRaw = await fs35.readFile(pkgPath, "utf-8");
+      const pkgPath = path36.join(this.rootDir, "package.json");
+      const pkgRaw = await fs36.readFile(pkgPath, "utf-8");
       const pkg = JSON.parse(pkgRaw);
       if (pkg.name) projectName = pkg.name;
     } catch {
@@ -15038,8 +15130,8 @@ var ProjectScanner = class {
 };
 
 // src/blueprint/generator.ts
-import * as fs36 from "fs/promises";
-import * as path36 from "path";
+import * as fs37 from "fs/promises";
+import * as path37 from "path";
 import * as ejs from "ejs";
 
 // src/blueprint/templates.ts
@@ -15123,19 +15215,19 @@ var BlueprintGenerator = class {
       styles: STYLES,
       scripts: SCRIPTS
     });
-    await fs36.mkdir(options.outputDir, { recursive: true });
-    await fs36.writeFile(path36.join(options.outputDir, "index.html"), html);
+    await fs37.mkdir(options.outputDir, { recursive: true });
+    await fs37.writeFile(path37.join(options.outputDir, "index.html"), html);
   }
 };
 
 // src/update-checker.ts
-import * as fs37 from "fs";
-import * as path37 from "path";
+import * as fs38 from "fs";
+import * as path38 from "path";
 import * as os from "os";
 import { spawn as spawn2 } from "child_process";
 function getStatePath() {
   const home = process.env["HOME"] || os.homedir();
-  return path37.join(home, ".harness", "update-check.json");
+  return path38.join(home, ".harness", "update-check.json");
 }
 function isUpdateCheckEnabled(configInterval) {
   if (process.env["HARNESS_NO_UPDATE_CHECK"] === "1") return false;
@@ -15148,13 +15240,13 @@ function shouldRunCheck(state, intervalMs) {
 }
 function invalidateCheckState() {
   try {
-    fs37.unlinkSync(getStatePath());
+    fs38.unlinkSync(getStatePath());
   } catch {
   }
 }
 function readCheckState() {
   try {
-    const raw = fs37.readFileSync(getStatePath(), "utf-8");
+    const raw = fs38.readFileSync(getStatePath(), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && "lastCheckTime" in parsed && typeof parsed.lastCheckTime === "number" && "currentVersion" in parsed && typeof parsed.currentVersion === "string") {
       const state = parsed;
@@ -15171,7 +15263,7 @@ function readCheckState() {
 }
 function spawnBackgroundCheck(currentVersion) {
   const statePath = getStatePath();
-  const stateDir = path37.dirname(statePath);
+  const stateDir = path38.dirname(statePath);
   const script = `
 const { execSync } = require('child_process');
 const fs = require('fs');
@@ -15422,8 +15514,8 @@ function getModelPrice(model, dataset) {
 }
 
 // src/pricing/cache.ts
-import * as fs38 from "fs/promises";
-import * as path38 from "path";
+import * as fs39 from "fs/promises";
+import * as path39 from "path";
 
 // src/pricing/fallback.json
 var fallback_default = {
@@ -15476,14 +15568,14 @@ var LITELLM_PRICING_URL = "https://raw.githubusercontent.com/BerriAI/litellm/mai
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var STALENESS_WARNING_DAYS = 7;
 function getCachePath(projectRoot) {
-  return path38.join(projectRoot, ".harness", "cache", "pricing.json");
+  return path39.join(projectRoot, ".harness", "cache", "pricing.json");
 }
 function getStalenessMarkerPath(projectRoot) {
-  return path38.join(projectRoot, ".harness", "cache", "staleness-marker.json");
+  return path39.join(projectRoot, ".harness", "cache", "staleness-marker.json");
 }
 async function readDiskCache(projectRoot) {
   try {
-    const raw = await fs38.readFile(getCachePath(projectRoot), "utf-8");
+    const raw = await fs39.readFile(getCachePath(projectRoot), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -15491,8 +15583,8 @@ async function readDiskCache(projectRoot) {
 }
 async function writeDiskCache(projectRoot, data) {
   const cachePath = getCachePath(projectRoot);
-  await fs38.mkdir(path38.dirname(cachePath), { recursive: true });
-  await fs38.writeFile(cachePath, JSON.stringify(data, null, 2));
+  await fs39.mkdir(path39.dirname(cachePath), { recursive: true });
+  await fs39.writeFile(cachePath, JSON.stringify(data, null, 2));
 }
 async function fetchFromNetwork() {
   try {
@@ -15519,7 +15611,7 @@ function loadFallbackDataset() {
 async function checkAndWarnStaleness(projectRoot) {
   const markerPath = getStalenessMarkerPath(projectRoot);
   try {
-    const raw = await fs38.readFile(markerPath, "utf-8");
+    const raw = await fs39.readFile(markerPath, "utf-8");
     const marker = JSON.parse(raw);
     const firstUse = new Date(marker.firstFallbackUse).getTime();
     const now = Date.now();
@@ -15531,8 +15623,8 @@ async function checkAndWarnStaleness(projectRoot) {
     }
   } catch {
     try {
-      await fs38.mkdir(path38.dirname(markerPath), { recursive: true });
-      await fs38.writeFile(
+      await fs39.mkdir(path39.dirname(markerPath), { recursive: true });
+      await fs39.writeFile(
         markerPath,
         JSON.stringify({ firstFallbackUse: (/* @__PURE__ */ new Date()).toISOString() })
       );
@@ -15542,7 +15634,7 @@ async function checkAndWarnStaleness(projectRoot) {
 }
 async function clearStalenessMarker(projectRoot) {
   try {
-    await fs38.unlink(getStalenessMarkerPath(projectRoot));
+    await fs39.unlink(getStalenessMarkerPath(projectRoot));
   } catch {
   }
 }
@@ -15741,8 +15833,8 @@ function aggregateByDay(records) {
 }
 
 // src/usage/jsonl-reader.ts
-import * as fs39 from "fs";
-import * as path39 from "path";
+import * as fs40 from "fs";
+import * as path40 from "path";
 function extractTokenUsage(entry, lineNumber) {
   const tokenUsage = entry.token_usage;
   if (!tokenUsage || typeof tokenUsage !== "object") {
@@ -15789,10 +15881,10 @@ function parseLine(line, lineNumber) {
   return record;
 }
 function readCostRecords(projectRoot) {
-  const costsFile = path39.join(projectRoot, ".harness", "metrics", "costs.jsonl");
+  const costsFile = path40.join(projectRoot, ".harness", "metrics", "costs.jsonl");
   let raw;
   try {
-    raw = fs39.readFileSync(costsFile, "utf-8");
+    raw = fs40.readFileSync(costsFile, "utf-8");
   } catch {
     return [];
   }
@@ -15810,8 +15902,8 @@ function readCostRecords(projectRoot) {
 }
 
 // src/usage/cc-parser.ts
-import * as fs40 from "fs";
-import * as path40 from "path";
+import * as fs41 from "fs";
+import * as path41 from "path";
 import * as os2 from "os";
 function extractUsage(entry) {
   if (entry.type !== "assistant") return null;
@@ -15847,7 +15939,7 @@ function parseCCLine(line, filePath, lineNumber) {
     entry = JSON.parse(line);
   } catch {
     console.warn(
-      `[harness usage] Skipping malformed CC JSONL line ${lineNumber} in ${path40.basename(filePath)}`
+      `[harness usage] Skipping malformed CC JSONL line ${lineNumber} in ${path41.basename(filePath)}`
     );
     return null;
   }
@@ -15861,7 +15953,7 @@ function parseCCLine(line, filePath, lineNumber) {
 function readCCFile(filePath) {
   let raw;
   try {
-    raw = fs40.readFileSync(filePath, "utf-8");
+    raw = fs41.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -15883,10 +15975,10 @@ function readCCFile(filePath) {
 }
 function parseCCRecords() {
   const homeDir = process.env.HOME ?? os2.homedir();
-  const projectsDir = path40.join(homeDir, ".claude", "projects");
+  const projectsDir = path41.join(homeDir, ".claude", "projects");
   let projectDirs;
   try {
-    projectDirs = fs40.readdirSync(projectsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path40.join(projectsDir, d.name));
+    projectDirs = fs41.readdirSync(projectsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path41.join(projectsDir, d.name));
   } catch {
     return [];
   }
@@ -15894,7 +15986,7 @@ function parseCCRecords() {
   for (const dir of projectDirs) {
     let files;
     try {
-      files = fs40.readdirSync(dir).filter((f) => f.endsWith(".jsonl")).map((f) => path40.join(dir, f));
+      files = fs41.readdirSync(dir).filter((f) => f.endsWith(".jsonl")).map((f) => path41.join(dir, f));
     } catch {
       continue;
     }
@@ -15906,8 +15998,8 @@ function parseCCRecords() {
 }
 
 // src/adoption/reader.ts
-import * as fs41 from "fs";
-import * as path41 from "path";
+import * as fs42 from "fs";
+import * as path42 from "path";
 function parseLine2(line, lineNumber) {
   try {
     const parsed = JSON.parse(line);
@@ -15926,10 +16018,10 @@ function parseLine2(line, lineNumber) {
   }
 }
 function readAdoptionRecords(projectRoot) {
-  const adoptionFile = path41.join(projectRoot, ".harness", "metrics", "adoption.jsonl");
+  const adoptionFile = path42.join(projectRoot, ".harness", "metrics", "adoption.jsonl");
   let raw;
   try {
-    raw = fs41.readFileSync(adoptionFile, "utf-8");
+    raw = fs42.readFileSync(adoptionFile, "utf-8");
   } catch {
     return [];
   }
@@ -16005,17 +16097,17 @@ function topSkills(records, n) {
 }
 
 // src/notifications/config-loader.ts
-import * as fs42 from "fs";
-import * as path42 from "path";
+import * as fs43 from "fs";
+import * as path43 from "path";
 import { NotificationsConfigSchema } from "@harness-engineering/types";
 function loadNotificationsConfig(projectRoot) {
-  const configPath = path42.join(projectRoot, "harness.config.json");
-  if (!fs42.existsSync(configPath)) {
+  const configPath = path43.join(projectRoot, "harness.config.json");
+  if (!fs43.existsSync(configPath)) {
     return Ok({ sinks: [] });
   }
   let raw;
   try {
-    raw = fs42.readFileSync(configPath, "utf-8");
+    raw = fs43.readFileSync(configPath, "utf-8");
   } catch (err) {
     return Err(err instanceof Error ? err : new Error(String(err)));
   }
@@ -16300,28 +16392,28 @@ var GeminiCacheAdapter = class {
 };
 
 // src/telemetry/consent.ts
-import * as fs44 from "fs";
-import * as path44 from "path";
+import * as fs45 from "fs";
+import * as path45 from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 
 // src/telemetry/install-id.ts
-import * as fs43 from "fs";
-import * as path43 from "path";
+import * as fs44 from "fs";
+import * as path44 from "path";
 import * as crypto4 from "crypto";
 function getOrCreateInstallId(projectRoot) {
-  const harnessDir = path43.join(projectRoot, ".harness");
-  const installIdFile = path43.join(harnessDir, ".install-id");
+  const harnessDir = path44.join(projectRoot, ".harness");
+  const installIdFile = path44.join(harnessDir, ".install-id");
   const UUID_V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
   try {
-    const existing = fs43.readFileSync(installIdFile, "utf-8").trim();
+    const existing = fs44.readFileSync(installIdFile, "utf-8").trim();
     if (UUID_V4_RE.test(existing)) {
       return existing;
     }
   } catch {
   }
   const id = crypto4.randomUUID();
-  fs43.mkdirSync(harnessDir, { recursive: true });
-  fs43.writeFileSync(installIdFile, id, { encoding: "utf-8", mode: 384 });
+  fs44.mkdirSync(harnessDir, { recursive: true });
+  fs44.writeFileSync(installIdFile, id, { encoding: "utf-8", mode: 384 });
   return id;
 }
 
@@ -16329,7 +16421,7 @@ function getOrCreateInstallId(projectRoot) {
 function parseIdentityFromTelemetryFile(filePath) {
   const identity = {};
   try {
-    const raw = fs44.readFileSync(filePath, "utf-8");
+    const raw = fs45.readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
     const src = parsed?.identity;
     if (!src || typeof src !== "object") return identity;
@@ -16342,7 +16434,7 @@ function parseIdentityFromTelemetryFile(filePath) {
 }
 function readProjectNameFallback(configPath) {
   try {
-    const raw = fs44.readFileSync(configPath, "utf-8");
+    const raw = fs45.readFileSync(configPath, "utf-8");
     const config = JSON.parse(raw);
     return typeof config?.name === "string" ? config.name : void 0;
   } catch {
@@ -16363,10 +16455,10 @@ function readGitAliasFallback(cwd) {
   }
 }
 function readIdentity(projectRoot) {
-  const filePath = path44.join(projectRoot, ".harness", "telemetry.json");
+  const filePath = path45.join(projectRoot, ".harness", "telemetry.json");
   const identity = parseIdentityFromTelemetryFile(filePath);
   if (!identity.project) {
-    const fallbackProject = readProjectNameFallback(path44.join(projectRoot, "harness.config.json"));
+    const fallbackProject = readProjectNameFallback(path45.join(projectRoot, "harness.config.json"));
     if (fallbackProject) identity.project = fallbackProject;
   }
   if (!identity.alias) {
@@ -16663,8 +16755,8 @@ var SpanKind = /* @__PURE__ */ ((SpanKind2) => {
 })(SpanKind || {});
 
 // src/locks/compound-lock.ts
-import * as fs45 from "fs";
-import * as path45 from "path";
+import * as fs46 from "fs";
+import * as path46 from "path";
 var CompoundLockHeldError = class extends Error {
   constructor(category, holderPid, lockPath) {
     super(
@@ -16687,12 +16779,12 @@ function acquireCompoundLock(category, opts = {}) {
     );
   }
   const cwd = opts.cwd ?? process.cwd();
-  const lockDir = path45.join(cwd, ".harness", "locks");
-  fs45.mkdirSync(lockDir, { recursive: true });
-  const lockPath = path45.join(lockDir, `compound-${category}.lock`);
+  const lockDir = path46.join(cwd, ".harness", "locks");
+  fs46.mkdirSync(lockDir, { recursive: true });
+  const lockPath = path46.join(lockDir, `compound-${category}.lock`);
   let fd;
   try {
-    fd = fs45.openSync(lockPath, "wx");
+    fd = fs46.openSync(lockPath, "wx");
   } catch (e) {
     const err = e;
     if (err.code === "EEXIST") {
@@ -16701,14 +16793,14 @@ function acquireCompoundLock(category, opts = {}) {
     }
     throw err;
   }
-  fs45.writeSync(fd, String(process.pid));
-  fs45.closeSync(fd);
+  fs46.writeSync(fd, String(process.pid));
+  fs46.closeSync(fd);
   let released = false;
   const release = () => {
     if (released) return;
     released = true;
     try {
-      fs45.unlinkSync(lockPath);
+      fs46.unlinkSync(lockPath);
     } catch {
     }
     process.removeListener("exit", onExit);
@@ -16734,7 +16826,7 @@ function acquireCompoundLock(category, opts = {}) {
 }
 function readHolderPid(lockPath) {
   try {
-    const raw = fs45.readFileSync(lockPath, "utf-8").trim();
+    const raw = fs46.readFileSync(lockPath, "utf-8").trim();
     const n = Number.parseInt(raw, 10);
     return Number.isFinite(n) ? n : -1;
   } catch {
@@ -16784,13 +16876,13 @@ function assertSanitized(value) {
 }
 
 // src/pulse/config-writer.ts
-import * as fs46 from "fs";
+import * as fs47 from "fs";
 function writePulseConfig(config, opts) {
   PulseConfigSchema.parse(config);
-  if (!fs46.existsSync(opts.configPath)) {
+  if (!fs47.existsSync(opts.configPath)) {
     throw new Error(`harness.config.json not found at ${opts.configPath}`);
   }
-  const raw = fs46.readFileSync(opts.configPath, "utf-8");
+  const raw = fs47.readFileSync(opts.configPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -16798,18 +16890,18 @@ function writePulseConfig(config, opts) {
     throw new Error(`Invalid JSON in ${opts.configPath}: ${e.message}`, { cause: e });
   }
   const bakPath = `${opts.configPath}.bak`;
-  if (!opts.skipBackup && !fs46.existsSync(bakPath)) {
-    fs46.writeFileSync(bakPath, raw, "utf-8");
+  if (!opts.skipBackup && !fs47.existsSync(bakPath)) {
+    fs47.writeFileSync(bakPath, raw, "utf-8");
   }
   parsed.pulse = config;
   const serialized = JSON.stringify(parsed, null, 2) + "\n";
   const tmpPath = `${opts.configPath}.tmp-${process.pid}`;
-  fs46.writeFileSync(tmpPath, serialized, "utf-8");
+  fs47.writeFileSync(tmpPath, serialized, "utf-8");
   try {
-    fs46.renameSync(tmpPath, opts.configPath);
+    fs47.renameSync(tmpPath, opts.configPath);
   } catch (e) {
     try {
-      fs46.unlinkSync(tmpPath);
+      fs47.unlinkSync(tmpPath);
     } catch {
     }
     throw e;
@@ -16817,16 +16909,16 @@ function writePulseConfig(config, opts) {
 }
 
 // src/pulse/strategy-seeder.ts
-import * as fs47 from "fs";
-import * as path46 from "path";
+import * as fs48 from "fs";
+import * as path47 from "path";
 function seedFromStrategy(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const strategyPath = path46.join(cwd, "STRATEGY.md");
+  const strategyPath = path47.join(cwd, "STRATEGY.md");
   const warnings = [];
-  if (!fs47.existsSync(strategyPath)) {
+  if (!fs48.existsSync(strategyPath)) {
     return { name: null, keyMetrics: [], warnings: ["STRATEGY.md not found"] };
   }
-  const raw = fs47.readFileSync(strategyPath, "utf-8");
+  const raw = fs48.readFileSync(strategyPath, "utf-8");
   let name = null;
   const fmMatch = /^---\s*\n([\s\S]*?)\n---\s*\n/.exec(raw);
   const fm = fmMatch?.[1];
@@ -17021,7 +17113,7 @@ async function runPulse(config, window) {
 // src/pulse/run/report.ts
 import { readFileSync as readFileSync39 } from "fs";
 import { fileURLToPath } from "url";
-import { dirname as dirname15, join as join60 } from "path";
+import { dirname as dirname16, join as join61 } from "path";
 var MAX_LINES = 40;
 var INLINE_TEMPLATE = `# {{productName}} Pulse \u2014 {{windowLabel}}
 
@@ -17045,8 +17137,8 @@ function loadTemplate() {
   try {
     const url = import.meta?.url;
     if (!url) return INLINE_TEMPLATE;
-    const here = dirname15(fileURLToPath(url));
-    return readFileSync39(join60(here, "template.md"), "utf-8");
+    const here = dirname16(fileURLToPath(url));
+    return readFileSync39(join61(here, "template.md"), "utf-8");
   } catch {
     return INLINE_TEMPLATE;
   }
@@ -17250,16 +17342,16 @@ async function computeHotspots(opts) {
   }
   const counts = /* @__PURE__ */ new Map();
   for (const line of stdout.split("\n")) {
-    const path48 = line.trim();
-    if (path48.length === 0) continue;
-    counts.set(path48, (counts.get(path48) ?? 0) + 1);
+    const path50 = line.trim();
+    if (path50.length === 0) continue;
+    counts.set(path50, (counts.get(path50) ?? 0) + 1);
   }
-  return [...counts.entries()].filter(([, c]) => c > opts.threshold).map(([path48, churn]) => ({ path: path48, churn })).sort((a, b) => b.churn - a.churn);
+  return [...counts.entries()].filter(([, c]) => c > opts.threshold).map(([path50, churn]) => ({ path: path50, churn })).sort((a, b) => b.churn - a.churn);
 }
 
 // src/solutions/scan-candidates/cross-reference.ts
-import * as fs48 from "fs/promises";
-import * as path47 from "path";
+import * as fs49 from "fs/promises";
+import * as path48 from "path";
 var TRACK_CATEGORIES2 = [
   ["bug-track", BUG_TRACK_CATEGORIES],
   ["knowledge-track", KNOWLEDGE_TRACK_CATEGORIES]
@@ -17295,12 +17387,12 @@ function tokenize(text) {
 async function* walk2(dir) {
   let entries;
   try {
-    entries = await fs48.readdir(dir, { withFileTypes: true });
+    entries = await fs49.readdir(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const e of entries) {
-    const p = path47.join(dir, e.name);
+    const p = path48.join(dir, e.name);
     if (e.isDirectory()) yield* walk2(p);
     else if (e.isFile() && e.name.endsWith(".md")) yield p;
   }
@@ -17309,11 +17401,11 @@ async function readDocumentedTokens(solutionsDir) {
   const docs = [];
   for (const [track, categories] of TRACK_CATEGORIES2) {
     for (const category of categories) {
-      const dir = path47.join(solutionsDir, track, category);
+      const dir = path48.join(solutionsDir, track, category);
       for await (const file of walk2(dir)) {
-        const raw = await fs48.readFile(file, "utf-8");
+        const raw = await fs49.readFile(file, "utf-8");
         const m = /^#\s+(.+)$/m.exec(raw);
-        const title = m?.[1] ?? path47.basename(file, ".md");
+        const title = m?.[1] ?? path48.basename(file, ".md");
         docs.push(tokenize(title));
       }
     }
@@ -17394,6 +17486,135 @@ function assembleCandidateReport(input) {
   }
   return lines.join("\n");
 }
+
+// src/proposals/store.ts
+import * as fs50 from "fs";
+import * as path49 from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  SkillProposalSchema,
+  EmitSkillProposalInputSchema
+} from "@harness-engineering/types";
+function proposalsDir(projectPath) {
+  return path49.join(projectPath, ".harness", "proposals");
+}
+function proposalPath(projectPath, id) {
+  return path49.join(proposalsDir(projectPath), `${id}.json`);
+}
+function ensureDir(dir) {
+  fs50.mkdirSync(dir, { recursive: true });
+}
+function writeAtomic(filePath, content) {
+  const tmpPath = `${filePath}.tmp`;
+  fs50.writeFileSync(tmpPath, content);
+  fs50.renameSync(tmpPath, filePath);
+}
+var ProposalNotFoundError = class extends Error {
+  constructor(id) {
+    super(`proposal not found: ${id}`);
+    this.name = "ProposalNotFoundError";
+  }
+};
+var ProposalConflictError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProposalConflictError";
+  }
+};
+async function createProposal(projectPath, input) {
+  const validated = EmitSkillProposalInputSchema.parse(input);
+  const id = `proposal_${randomUUID2().replace(/-/g, "")}`;
+  const proposal = SkillProposalSchema.parse({
+    id,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    kind: validated.kind,
+    targetSkill: validated.targetSkill,
+    proposedBy: validated.proposedBy,
+    source: {
+      sessionId: validated.sessionId,
+      taskId: validated.taskId,
+      justification: validated.justification
+    },
+    content: validated.content,
+    status: "open"
+  });
+  if (proposal.kind === "refinement" && proposal.targetSkill) {
+    const existing = await listProposals(projectPath, { status: "open" });
+    const clash = existing.find(
+      (p) => p.kind === "refinement" && p.targetSkill === proposal.targetSkill
+    );
+    if (clash) {
+      throw new ProposalConflictError(
+        `An open refinement proposal already exists for skill "${proposal.targetSkill}" (id: ${clash.id})`
+      );
+    }
+  }
+  const dir = proposalsDir(projectPath);
+  ensureDir(dir);
+  writeAtomic(proposalPath(projectPath, id), JSON.stringify(proposal, null, 2));
+  return proposal;
+}
+async function getProposal(projectPath, id) {
+  const file = proposalPath(projectPath, id);
+  try {
+    const raw = fs50.readFileSync(file, "utf-8");
+    const parsed = SkillProposalSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+async function listProposals(projectPath, opts = {}) {
+  const dir = proposalsDir(projectPath);
+  let files;
+  try {
+    files = fs50.readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const file of files) {
+    if (!file.endsWith(".json")) continue;
+    const id = file.slice(0, -".json".length);
+    const proposal = await getProposal(projectPath, id);
+    if (!proposal) continue;
+    if (opts.status && opts.status !== "all" && proposal.status !== opts.status) continue;
+    out.push(proposal);
+  }
+  out.sort((a, b) => a.createdAt > b.createdAt ? -1 : a.createdAt < b.createdAt ? 1 : 0);
+  return out;
+}
+async function updateProposal(projectPath, id, patch) {
+  const current = await getProposal(projectPath, id);
+  if (!current) throw new ProposalNotFoundError(id);
+  const next = SkillProposalSchema.parse({
+    ...current,
+    ...patch,
+    id: current.id,
+    createdAt: current.createdAt,
+    kind: current.kind
+  });
+  writeAtomic(proposalPath(projectPath, id), JSON.stringify(next, null, 2));
+  return next;
+}
+
+// src/proposals/usage.ts
+function deriveSkillUsage(projectRoot, skillName, windowDays = 30) {
+  const records = readAdoptionRecords(projectRoot);
+  const cutoffMs = Date.now() - windowDays * 24 * 60 * 60 * 1e3;
+  let count = 0;
+  let lastUsed;
+  for (const rec of records) {
+    if (rec.skill !== skillName) continue;
+    const startedMs = Date.parse(rec.startedAt);
+    if (Number.isFinite(startedMs) && startedMs < cutoffMs) continue;
+    count += 1;
+    if (!lastUsed || rec.startedAt > lastUsed) lastUsed = rec.startedAt;
+  }
+  const stats = { count, windowDays };
+  if (lastUsed) stats.lastUsed = lastUsed;
+  return stats;
+}
 export {
   AGENT_DESCRIPTORS,
   AGREEMENT_LINE_GAP,
@@ -17496,6 +17717,8 @@ export {
   PredictionResultSchema,
   PredictionWarningSchema,
   ProjectScanner,
+  ProposalConflictError,
+  ProposalNotFoundError,
   PulseAdapterAlreadyRegisteredError,
   PulseConfigSchema,
   PulseDbSourceSchema,
@@ -17619,7 +17842,9 @@ export {
   createFixes,
   createForbiddenImportFixes,
   createOrphanedDepFixes,
+  createOsvClient,
   createParseError,
+  createProposal,
   createRegionMap,
   createSelfReview,
   createStream,
@@ -17631,6 +17856,7 @@ export {
   deepMergeConstraints,
   defaultCollectors,
   defineLayer,
+  deriveSkillUsage,
   deserializationRules,
   detectChangeType,
   detectCircularDeps,
@@ -17683,6 +17909,7 @@ export {
   getOutline,
   getParser,
   getPhaseCategories,
+  getProposal,
   getPulseAdapter,
   getRoadmapMode,
   getStreamForBranch,
@@ -17702,6 +17929,7 @@ export {
   isUpdateCheckEnabled,
   isoWeek,
   listActiveSessions,
+  listProposals,
   listPulseAdapters,
   listStreams,
   listTaintedSessions,
@@ -17752,6 +17980,7 @@ export {
   previewFix,
   projectValue,
   promoteSessionLearnings,
+  proposalsDir,
   pruneLearnings,
   reactRules,
   readAdoptionRecords,
@@ -17824,6 +18053,7 @@ export {
   trackAction,
   unfoldRange,
   unfoldSymbol,
+  updateProposal,
   updateSessionEntryStatus,
   updateSessionIndex,
   validateAgentConfigs,