@hunter-harness/workflow-harness 0.2.15 → 0.2.17

package/harness/bundles/java/cursor/scripts/harness_review.py

@@ -14,6 +14,7 @@ Python 3.10+, stdlib only.
 from __future__ import annotations
 
 import argparse
+import datetime as dt
 import hashlib
 import json
 import os
@@ -270,6 +271,112 @@ def _emit(payload: Any, *, as_json: bool) -> int:
     return 0 if payload.get("ok") else 1
 
 
+def dispatch_review(
+    *,
+    change_dir: Path,
+    run_id: str,
+    budget_seconds: int = 300,
+) -> dict[str, Any]:
+    """C11: dispatch a bounded review task.
+
+    Returns reviewTaskId / deadline / heartbeatAt. The caller is expected to
+    poll the review subagent and collect partial findings on timeout.
+    """
+    now = dt.datetime.now(dt.timezone.utc).astimezone()
+    task_id = f"review-{uuid.uuid4().hex}"
+    deadline = now + dt.timedelta(seconds=budget_seconds)
+    # heartbeat at midpoint of the budget
+    heartbeat = now + dt.timedelta(seconds=budget_seconds // 2)
+    return {
+        "ok": True,
+        "code": "DISPATCHED",
+        "reviewTaskId": task_id,
+        "runId": run_id,
+        "deadline": deadline.isoformat(timespec="milliseconds"),
+        "heartbeatAt": heartbeat.isoformat(timespec="milliseconds"),
+        "budgetSeconds": budget_seconds,
+    }
+
+
+def collect_partial_findings(
+    *,
+    change_dir: Path,
+    run_id: str,
+    completed_dimensions: list[str],
+    pending_dimensions: list[str],
+) -> dict[str, Any]:
+    """C11: collect partial findings after timeout — completed dimensions only.
+
+    Applies the degradation matrix to decide the fallback path.
+    """
+    matrix = degradation_matrix(
+        subagent_timed_out=bool(pending_dimensions),
+        main_session_available=True,
+    )
+    return {
+        "ok": True,
+        "code": "PARTIAL_FINDINGS",
+        "runId": run_id,
+        "completedDimensions": list(completed_dimensions),
+        "pendingDimensions": list(pending_dimensions),
+        "degradationMatrix": matrix,
+    }
+
+
+def degradation_matrix(
+    *,
+    subagent_timed_out: bool,
+    main_session_available: bool,
+) -> dict[str, Any]:
+    """C11: degradation matrix — subagent timeout → main session; main fail → ADVISORY."""
+    if not subagent_timed_out:
+        return {"fallback": "none", "status": "OK"}
+    if main_session_available:
+        return {"fallback": "main-session", "status": "DEGRADED"}
+    return {"fallback": "advisory", "status": "ADVISORY"}
+
+
+def validate_codegraph_identity(
+    *,
+    response: dict[str, Any],
+    expected_repository_id: str,
+    expected_head: str,
+) -> dict[str, Any]:
+    """C12: validate CodeGraph identity — repositoryId/indexedHead must match.
+
+    On mismatch, signal CODEGRAPH_IDENTITY_MISMATCH with fallback to Grep/Glob + Read.
+    """
+    repo_id = response.get("repositoryId")
+    indexed_head = response.get("indexedHead")
+    indexed_at = response.get("indexedAt")
+    if (
+        repo_id == expected_repository_id
+        and indexed_head == expected_head
+        and indexed_at
+    ):
+        return {
+            "ok": True,
+            "code": "IDENTITY_OK",
+            "repositoryId": repo_id,
+            "indexedHead": indexed_head,
+            "indexedAt": indexed_at,
+        }
+    return {
+        "ok": False,
+        "code": "CODEGRAPH_IDENTITY_MISMATCH",
+        "expected": {
+            "repositoryId": expected_repository_id,
+            "indexedHead": expected_head,
+        },
+        "actual": {
+            "repositoryId": repo_id,
+            "indexedHead": indexed_head,
+            "indexedAt": indexed_at,
+        },
+        "fallback": "grep-glob-read",
+    }
+
+
 def cmd_validate_findings(args: argparse.Namespace) -> int:
     doc = _read_json(Path(args.input))
     problems = validate_findings(doc)

package/harness/bundles/java/cursor/scripts/harness_test_cleanup.py

@@ -0,0 +1,175 @@
+#!/usr/bin/env python3
+"""Controlled cleanup helper for test fixtures (retro §5.23).
+
+Provides a host-policy-friendly entry point for removing gitignored test
+fixtures (e.g. .pytest_data) within an execution root. Performs realpath
+containment, rejects symlink/reparse escapes, lists exact counts before
+deletion, and outputs a structured receipt.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import shutil
+import sys
+from pathlib import Path
+from typing import Any
+
+if hasattr(sys.stdout, "reconfigure"):
+    sys.stdout.reconfigure(encoding="utf-8")
+if hasattr(sys.stderr, "reconfigure"):
+    sys.stderr.reconfigure(encoding="utf-8")
+
+
+def _resolve_within(execution_root: Path, rel: str) -> Path | None:
+    """Resolve rel under execution_root, rejecting escapes and symlinks."""
+    if not rel or rel.startswith("/"):
+        return None
+    # Reject absolute paths (Windows drive letter or POSIX).
+    if len(rel) >= 2 and rel[1] == ":":
+        return None
+    parts = rel.replace("\\", "/").split("/")
+    if ".." in parts:
+        return None
+    candidate = (execution_root / rel).resolve(strict=False)
+    # Containment check: candidate must be under execution_root.
+    try:
+        candidate.relative_to(execution_root.resolve(strict=False))
+    except ValueError:
+        return None
+    # Reject symlink/reparse escape: if the path is a symlink, check its target.
+    if candidate.is_symlink():
+        target = Path(os.readlink(candidate)).resolve(strict=False)
+        try:
+            target.relative_to(execution_root.resolve(strict=False))
+        except ValueError:
+            return None
+        # Even if target is inside, a symlinked cleanup root is suspicious;
+        # reject to avoid following links into unexpected locations.
+        return None
+    return candidate
+
+
+def _count_files(root: Path) -> tuple[int, int]:
+    """Count files and total bytes under root."""
+    count = 0
+    total = 0
+    for dirpath, _dirs, files in os.walk(root):
+        for name in files:
+            fp = Path(dirpath) / name
+            try:
+                total += fp.stat().st_size
+                count += 1
+            except OSError:
+                continue
+    return count, total
+
+
+def cleanup(execution_root: Path, cleanup_roots: list[str]) -> dict[str, Any]:
+    """Remove allowlisted cleanup roots within execution_root.
+
+    Returns a structured receipt. Any path escape, symlink escape, or
+    unallowed root results in ok=false with zero files removed.
+    """
+    execution_root = Path(execution_root).resolve(strict=False)
+    if not execution_root.is_dir():
+        return {
+            "ok": False,
+            "code": "EXECUTION_ROOT_MISSING",
+            "executionRoot": str(execution_root),
+            "removedFiles": 0,
+            "removedBytes": 0,
+            "rejectedEscapes": [],
+        }
+
+    rejected: list[dict[str, str]] = []
+    removed_files = 0
+    removed_bytes = 0
+    cleaned: list[str] = []
+
+    for rel in cleanup_roots:
+        target = _resolve_within(execution_root, rel)
+        if target is None:
+            rejected.append({"path": rel, "reason": "PATH_ESCAPE_REJECTED"})
+            continue
+        if not target.exists():
+            # Already absent — idempotent reentry.
+            continue
+        # Re-check symlink after resolution (the parent might be a symlink).
+        if target.is_symlink():
+            rejected.append({"path": rel, "reason": "SYMLINK_ESCAPE_REJECTED"})
+            continue
+        # Count before deletion for the receipt.
+        try:
+            count, total = _count_files(target)
+        except OSError:
+            count, total = 0, 0
+        # Delete.
+        try:
+            shutil.rmtree(target)
+        except OSError as exc:
+            rejected.append({"path": rel, "reason": f"DELETE_FAILED: {exc}"})
+            continue
+        removed_files += count
+        removed_bytes += total
+        cleaned.append(rel)
+
+    if rejected:
+        return {
+            "ok": False,
+            "code": rejected[0]["reason"],
+            "executionRoot": str(execution_root),
+            "removedFiles": removed_files,
+            "removedBytes": removed_bytes,
+            "rejectedEscapes": rejected,
+            "cleaned": cleaned,
+        }
+
+    if removed_files == 0 and not cleaned:
+        return {
+            "ok": True,
+            "code": "ALREADY_ABSENT",
+            "executionRoot": str(execution_root),
+            "removedFiles": 0,
+            "removedBytes": 0,
+            "rejectedEscapes": [],
+            "cleaned": [],
+        }
+
+    return {
+        "ok": True,
+        "code": "CLEANUP_COMPLETE",
+        "executionRoot": str(execution_root),
+        "removedFiles": removed_files,
+        "removedBytes": removed_bytes,
+        "rejectedEscapes": [],
+        "cleaned": cleaned,
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    sub = parser.add_subparsers(dest="action", required=True)
+    clean_parser = sub.add_parser("cleanup")
+    clean_parser.add_argument("--execution-root", required=True)
+    clean_parser.add_argument("--cleanup-roots", required=True, help="JSON array of relative paths")
+    clean_parser.add_argument("--json", action="store_true")
+    args = parser.parse_args(argv)
+
+    try:
+        roots = json.loads(args.cleanup_roots)
+        if not isinstance(roots, list):
+            raise ValueError("cleanup-roots must be a JSON array")
+    except (json.JSONDecodeError, ValueError) as exc:
+        result = {"ok": False, "code": "INVALID_CLEANUP_ROOTS", "error": str(exc)}
+        print(json.dumps(result, ensure_ascii=False, indent=2))
+        return 1
+
+    result = cleanup(Path(args.execution_root), roots)
+    print(json.dumps(result, ensure_ascii=False, indent=2 if args.json else None))
+    return 0 if result["ok"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/harness/manifests/general/claude-code.json

@@ -2,12 +2,12 @@
   "schema_version": 2,
   "profile": "general",
   "adapter": "claude-code",
-  "bundle_version": "0.2.14",
+  "bundle_version": "0.2.16",
   "generator": "harness_deploy.py",
   "files": [
     {
       "path": ".harness-build.json",
-      "sha256": "f7e5fcab41c868a1acf53d59f58cad0ca69f7da5dca394b3081de73b6e530074"
+      "sha256": "f8d05b3cde1a30f216ab0d3ba26ec45796f533686a003c4c656a36aed077634b"
     },
     {
       "path": "agents/harness-evaluator.md",
@@ -23,7 +23,7 @@
     },
     {
       "path": "CONTEXT.md",
-      "sha256": "19c75b493f6f760d0e607a88bd355acdd232fcb66660887ef94d10425f39507b"
+      "sha256": "2318aba4ff5ae4db0a0bff6380d1e9f4ed697caf9a4b2c1458ad2cdda1acb9e8"
     },
     {
       "path": "contracts/ci-metrics.schema.json",
@@ -39,7 +39,7 @@
     },
     {
       "path": "harness-archive/reference.md",
-      "sha256": "a956c4474df338c35934933c131a3fefb84e6b296a961c4f731526a4aff4f32f"
+      "sha256": "9a76b0d880e3951ca2d24e56573a4144fdfe3d7abb4a8a44dda4a19d4dce4ec1"
     },
     {
       "path": "harness-archive/scripts/gen-manifest.ps1",
@@ -47,7 +47,7 @@
     },
     {
       "path": "harness-archive/SKILL.md",
-      "sha256": "55d393fc6b7accab0802115fc6628c68545e1069cbc1aa0e16c412d6a8edfa5a"
+      "sha256": "1081a1913e62f86ada5b5b43eed866e0de0aca1e9900883aa9c3a328168e0128"
     },
     {
       "path": "harness-archive/templates/render-summary.mjs",
@@ -67,7 +67,7 @@
     },
     {
       "path": "harness-codebase-map/SKILL.md",
-      "sha256": "8901d29948bd75933d22dea87d15b9b47eeab660063af3e4c13718e7e5fdc4a4"
+      "sha256": "ebfa5cc6ca087dddf001c7e951cfe40c9a47dd1ab15e69b696564bc9d35c4dd2"
     },
     {
       "path": "harness-codebase-map/templates/ARCHITECTURE.md",
@@ -127,19 +127,19 @@
     },
     {
       "path": "harness-knowledge-ingest/scripts/harness_knowledge.py",
-      "sha256": "48620b3aa57da3cbc39c556b73006108e0ae4e40d7b662709869dfc1877158ee"
+      "sha256": "062115a524d5bd4aec27e40e2b57cf4e7ed6e0509d4a8e6e78a79a62ee32e2c5"
     },
     {
       "path": "harness-knowledge-ingest/SKILL.md",
-      "sha256": "013252318d6a27d6c62bcf5247e0e3a2f78187fe7758950edf93e44340943fd9"
+      "sha256": "fb0e10981ec43a63fe89365edf12c4d65058050d593e612cbca05116f721a76f"
     },
     {
       "path": "harness-knowledge-query/SKILL.md",
-      "sha256": "5e0d111527aa23bc2ecd60e9808a8d65e23f21344920447c247aa8592ad176fd"
+      "sha256": "4825b36103b11eb1b2759167638af9234d6612b16ea2024c87f0c4dadf740e46"
     },
     {
       "path": "harness-plan/checklist.md",
-      "sha256": "897649058dea86440bcbf4fcb7f2323a6c361318da48737ca69b282f7a9b1870"
+      "sha256": "cd990f8557f92ca0b2259d0ed4aab51c25ecf977fe8cddc9a689e0d05b334a2b"
     },
     {
       "path": "harness-plan/protocols.md",
@@ -151,7 +151,7 @@
     },
     {
       "path": "harness-plan/SKILL.md",
-      "sha256": "c73337d7896b89c67ecdbc623145ee1ffad679302b72eeb054b7d1508dee4a86"
+      "sha256": "83d1a6c96be57ea556d0c08c665ad62ccd7813bb9f7e5fed0354ab8f4cd3756c"
     },
     {
       "path": "harness-review/checklist.md",
@@ -163,15 +163,15 @@
     },
     {
       "path": "harness-review/reference.md",
-      "sha256": "0644a39417d51f1222905567dca80a433661a2411e2d4dd1b94644bc1cda596d"
+      "sha256": "5e43f753b2189bc8256c04905c079016a31694dad2aa1ad841aceae3670dd6c6"
     },
     {
       "path": "harness-review/SKILL.md",
-      "sha256": "ec00e56acc221f34ab5b2717a560473670a897c8bf75039bae290a6d875c17df"
+      "sha256": "536fc0c4200bd8701991b2446d929c1fb3db6b06838227860eea81a8ea734cd1"
     },
     {
       "path": "harness-run/checklist.md",
-      "sha256": "091bde8a02224f8da1078c7022bb431c2ea696779efef5a8b9129b2e51522505"
+      "sha256": "9b7578d1697772c6c545d1a65c0d232b7f0848185aa4b47ee254ee7b3fbbcb81"
     },
     {
       "path": "harness-run/protocols.md",
@@ -183,31 +183,31 @@
     },
     {
       "path": "harness-run/SKILL.md",
-      "sha256": "9b3b608914a7bbf698c3a28a45e5d4cd6a8156bd49c9a780da5e1adbbde02408"
+      "sha256": "89cfccb7a8bae365a56614bf4e6b21749e83abb894f3af18ee6430fe23cafeff"
     },
     {
       "path": "harness-submit/checklist.md",
-      "sha256": "297a6a235ef03cd49ef1c3bd13180040f8ce25354b2ced82373d4a7a5f0dc181"
+      "sha256": "9748c5cb4fb33919490d2cc7757b35fd191090ed02af6eacce8aa97e19666328"
     },
     {
       "path": "harness-submit/reference.md",
-      "sha256": "39de14a56303ef2389beeab9be163aab2596fe45b262b45393f1321d18d0511a"
+      "sha256": "03a0f92ad85b94610d724333bdc4b0b1063f2065e7ec4ab518363adeef7c7303"
     },
     {
       "path": "harness-submit/SKILL.md",
-      "sha256": "279bb2546f41d617fe4402caa5cad7db788643407ba47b5cfe0dae00b1c18e72"
+      "sha256": "d0ff4a5569685e018fef7bdc02a17d9a5889b269505dd0b0d31dbe66d75301f9"
     },
     {
       "path": "harness-sync/reference.md",
-      "sha256": "86a1cee8298bbc2c68db60956530fa40b92ef82e4e0e122498352459e9157141"
+      "sha256": "695d7ffea45f50008277851eefb815c1979e0c47f7184919ee2a7eee6a363988"
     },
     {
       "path": "harness-sync/SKILL.md",
-      "sha256": "6dc61858ea0293876a79be8130de7c3f7699f1f8510a50fac6a6da01d62b4673"
+      "sha256": "1544c88eb25a2902df8e0789e2b7f4bb0ba6b5da8baf01293d745f42e3c514d3"
     },
     {
       "path": "harness-test/checklist.md",
-      "sha256": "66f96a4e5cc39ab7ec736994a23dac88e349c63845659d595737100b9584b84e"
+      "sha256": "5d7a734ba1832690bc9a405e062f83ae81a56b2c2d86d23e381c841b74c68ba1"
     },
     {
       "path": "harness-test/pitfalls-java.md",
@@ -215,11 +215,11 @@
     },
     {
       "path": "harness-test/pitfalls.md",
-      "sha256": "074ee0b2fb710840b6a323c4d677f14ac89e5cc77c36466bc89f9772a8443842"
+      "sha256": "c96afa8739598a2a5977ed2e734e42d1b330901528df4651f33ec20c0295ec42"
     },
     {
       "path": "harness-test/reference.md",
-      "sha256": "37d781daf890ff86663e0fe8c0449c97e40ec512c3515a73923f7fb162e9c180"
+      "sha256": "1b705db0a2f075d7c7aa48a9130719557daf1d5cddc0271ea68d4e75a3f827b2"
     },
     {
       "path": "harness-test/scripts/runtime-helpers.mjs",
@@ -227,7 +227,7 @@
     },
     {
       "path": "harness-test/SKILL.md",
-      "sha256": "a7c8d010c05c216c17ba353525ce06e3c8d39f5ec9182be29b4420f567fe36a7"
+      "sha256": "cc698eebaa77cb448ef9aba98e8b0e0c43ee7530557e2df9d33645539bbc7b37"
     },
     {
       "path": "protocols/archive-report-protocol.md",
@@ -259,11 +259,11 @@
     },
     {
       "path": "protocols/submit-protocol.md",
-      "sha256": "b0fb07830c3b25b06bba3b8af3f831a5dde9b7329d8b1ee19386a59040cfc481"
+      "sha256": "01465556bd00fe01f91f315fd3eb365099eb3dd2e111331ba70c103a37794543"
     },
     {
       "path": "README.md",
-      "sha256": "57ae38357a7bf4118f91c4404b8133a81aced923c836c498b04ff18461eae665"
+      "sha256": "9edb4d313701f7317805dedb1b1e7e61aa986bed1e5e4266b257eb880abb33e0"
     },
     {
       "path": "scripts/harness_apidoc.py",
@@ -283,7 +283,7 @@
     },
     {
       "path": "scripts/harness_deploy.py",
-      "sha256": "4a0a4ccfd6ded25596266d7f07cc5e740b4d7224dfba610cd9f7f041d23948e9"
+      "sha256": "48a95b696cd4df411cc206b80b16b436018e7648bd2daa55f110ceee2e403271"
     },
     {
       "path": "scripts/harness_events.py",
@@ -291,19 +291,19 @@
     },
     {
       "path": "scripts/harness_gate.py",
-      "sha256": "f83e9d33816052553e2ae8e5514fae318c5b5bc48ba2aded67d88fc9f0b51a98"
+      "sha256": "c5762a90f0361496d1f6a64670ee4cc84dd5075924fec08c3846530393c0b2ff"
     },
     {
       "path": "scripts/harness_integration.py",
-      "sha256": "6b078d7d1d053e4c46bc320496fab3060d883b256d517a56f0b078eec2fa0ce0"
+      "sha256": "777c8d0bd07b026645d5c6938da64699c123ab13870f04963fa0b09a900b095d"
     },
     {
       "path": "scripts/harness_ledger.py",
-      "sha256": "5141168aa1c566327e421d6ab6de876dfe0cf6ae3e97d336fcce6dc7fc4bfb56"
+      "sha256": "60a6cdff5c3c81abf5606f7914c299828c4ed2b21d19e9acbb27b001a03fcaa5"
     },
     {
       "path": "scripts/harness_paths.py",
-      "sha256": "75560c0141172b335811014320001a299846e4fba45dd0589cba86da058ab01a"
+      "sha256": "c60d272e61aa98fc84a89c24db81c1ff8cbf2dac16b88fddbcd18fcc5d6199a5"
     },
     {
       "path": "scripts/harness_phase.py",
@@ -311,7 +311,7 @@
     },
     {
       "path": "scripts/harness_plan_finalize.py",
-      "sha256": "5534eb277e29e3473149a0f113ea107dc17b6cade742d7de920befb87e46fdfa"
+      "sha256": "e5152dda3380b1c1acdd219f8af0117b0c1670f0998ea62340f89e27a09f7585"
     },
     {
       "path": "scripts/harness_preflight.py",
@@ -319,11 +319,11 @@
     },
     {
       "path": "scripts/harness_profile.py",
-      "sha256": "7c02010be79352e552d028ac7a5884f273b832af304cb2336824d41a4371a800"
+      "sha256": "e242f79d36d7a38bdf3927cd2f65d1c7bb687a4119b07e41a59fec6989d5e253"
     },
     {
       "path": "scripts/harness_review.py",
-      "sha256": "78009e09b79867a13c66a8c71114b6cd04fe75c72054f5ec35d63c7be990bb04"
+      "sha256": "a741a63f62993d72889e78f540feb57a95e713b4d7a98fa61ff208b2ce914ca7"
     },
     {
       "path": "scripts/harness_runtime.py",
@@ -341,6 +341,10 @@
       "path": "scripts/harness_sync.py",
       "sha256": "3ab54718ab8448f7bdac76119806a885e0f19cece05b0d8108128dc7d895d6e1"
     },
+    {
+      "path": "scripts/harness_test_cleanup.py",
+      "sha256": "5b60d6f5f057885f25d33906db69ce834193654024a7bf5ce1a09dc49808eff3"
+    },
     {
       "path": "scripts/harness_test_guard.py",
       "sha256": "36d0ae0776c75fb2f5a233500aa8dd1647a17880676cb07e441e2896e402e67c"