@hunter-harness/workflow-harness 0.2.38 → 0.2.39

package/harness/bundles/java/cursor/scripts/harness_review.py

@@ -19,6 +19,7 @@ import hashlib
 import json
 import os
 import re
+import subprocess
 import sys
 import uuid
 from pathlib import Path
@@ -351,43 +352,121 @@ def degradation_matrix(
     return {"fallback": "advisory", "status": "ADVISORY"}
 
 
+def _canonical_root(value: str | Path) -> str:
+    """Canonicalize a root for an identity comparison across Windows worktrees."""
+    return os.path.normcase(str(Path(value).expanduser().resolve()))
+
+
+def codegraph_worktree_id(execution_root: Path) -> str | None:
+    """Return a stable id for a linked worktree, or ``None`` for the main checkout."""
+    root = Path(execution_root).resolve()
+    try:
+        git_dir = subprocess.run(
+            ["git", "rev-parse", "--git-dir"],
+            cwd=str(root),
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            check=False,
+        )
+        common_dir = subprocess.run(
+            ["git", "rev-parse", "--git-common-dir"],
+            cwd=str(root),
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            check=False,
+        )
+    except OSError:
+        return None
+    if git_dir.returncode != 0 or common_dir.returncode != 0:
+        return None
+    git_dir_path = Path(git_dir.stdout.strip())
+    common_dir_path = Path(common_dir.stdout.strip())
+    if not git_dir_path.is_absolute():
+        git_dir_path = (root / git_dir_path).resolve()
+    if not common_dir_path.is_absolute():
+        common_dir_path = (root / common_dir_path).resolve()
+    if _canonical_root(git_dir_path) == _canonical_root(common_dir_path):
+        return None
+    return "sha256:" + hashlib.sha256(
+        _canonical_root(root).encode("utf-8")
+    ).hexdigest()
+
+
+def codegraph_expected_identity(
+    execution_root: Path,
+    *,
+    expected_repository_id: str,
+    expected_head: str,
+) -> dict[str, str | None]:
+    """Build the identity contract supplied with every CodeGraph query."""
+    root = Path(execution_root).resolve()
+    return {
+        "rootPath": str(root),
+        "worktreeId": codegraph_worktree_id(root),
+        "repositoryId": expected_repository_id,
+        "head": expected_head,
+        "indexSnapshotAt": None,
+    }
+
+
 def validate_codegraph_identity(
     *,
     response: dict[str, Any],
     expected_repository_id: str,
     expected_head: str,
+    expected_root: str | Path,
+    expected_worktree_id: str | None,
 ) -> dict[str, Any]:
-    """C12: validate CodeGraph identity — repositoryId/indexedHead must match.
+    """Validate CodeGraph evidence before Review adopts its source snippets.
 
-    On mismatch, signal CODEGRAPH_IDENTITY_MISMATCH with fallback to Grep/Glob + Read.
+    A repository id is shared by the main checkout and linked worktrees, so it
+    cannot by itself prevent main-checkout evidence from being used for feature
+    worktree review. Root and worktree identity are therefore mandatory.
     """
     repo_id = response.get("repositoryId")
-    indexed_head = response.get("indexedHead")
-    indexed_at = response.get("indexedAt")
+    indexed_head = response.get("head", response.get("indexedHead"))
+    indexed_at = response.get("indexSnapshotAt", response.get("indexedAt"))
+    root_path = response.get("rootPath", response.get("indexedRoot"))
+    worktree_id = response.get("worktreeId")
+    expected_root_path = _canonical_root(expected_root)
+    actual_root_path = (
+        _canonical_root(root_path) if isinstance(root_path, str) and root_path.strip() else None
+    )
+    actual = {
+        "rootPath": root_path,
+        "worktreeId": worktree_id,
+        "repositoryId": repo_id,
+        "head": indexed_head,
+        "indexSnapshotAt": indexed_at,
+    }
+    expected = {
+        "rootPath": str(Path(expected_root).resolve()),
+        "worktreeId": expected_worktree_id,
+        "repositoryId": expected_repository_id,
+        "head": expected_head,
+        "indexSnapshotAt": None,
+    }
     if (
         repo_id == expected_repository_id
         and indexed_head == expected_head
+        and actual_root_path == expected_root_path
+        and worktree_id == expected_worktree_id
         and indexed_at
     ):
         return {
             "ok": True,
             "code": "IDENTITY_OK",
-            "repositoryId": repo_id,
-            "indexedHead": indexed_head,
-            "indexedAt": indexed_at,
+            "evidence": actual,
         }
     return {
         "ok": False,
-        "code": "CODEGRAPH_IDENTITY_MISMATCH",
-        "expected": {
-            "repositoryId": expected_repository_id,
-            "indexedHead": expected_head,
-        },
-        "actual": {
-            "repositoryId": repo_id,
-            "indexedHead": indexed_head,
-            "indexedAt": indexed_at,
-        },
+        "code": "IDENTITY_MISMATCH",
+        "expected": expected,
+        "actual": actual,
         "fallback": "grep-glob-read",
     }
 
@@ -399,6 +478,20 @@ def cmd_validate_findings(args: argparse.Namespace) -> int:
     return _emit(payload, as_json=True)
 
 
+def cmd_validate_codegraph_identity(args: argparse.Namespace) -> int:
+    response = _read_json(Path(args.input))
+    if not isinstance(response, dict):
+        raise ValueError("CodeGraph response must be an object")
+    payload = validate_codegraph_identity(
+        response=response,
+        expected_repository_id=args.repository_id,
+        expected_head=args.head,
+        expected_root=args.execution_root,
+        expected_worktree_id=args.worktree_id,
+    )
+    return _emit(payload, as_json=True)
+
+
 def cmd_write_findings(args: argparse.Namespace) -> int:
     doc = _read_json(Path(args.input))
     return _emit(write_findings(Path(args.change_dir), doc), as_json=True)
@@ -421,6 +514,14 @@ def build_parser() -> argparse.ArgumentParser:
     p_validate.add_argument("--input", required=True)
     p_validate.set_defaults(func=cmd_validate_findings)
 
+    p_codegraph = sub.add_parser("validate-codegraph-identity")
+    p_codegraph.add_argument("--input", required=True)
+    p_codegraph.add_argument("--execution-root", required=True)
+    p_codegraph.add_argument("--repository-id", required=True)
+    p_codegraph.add_argument("--head", required=True)
+    p_codegraph.add_argument("--worktree-id")
+    p_codegraph.set_defaults(func=cmd_validate_codegraph_identity)
+
     p_findings = sub.add_parser("write-findings")
     p_findings.add_argument("--change-dir", required=True)
     p_findings.add_argument("--input", required=True)

package/harness/bundles/java/cursor/scripts/harness_service.py

@@ -726,6 +726,173 @@ def write_session(change_dir: Path, session: dict[str, Any]) -> Path:
     return path
 
 
+def _same_path(left: Any, right: Path | None) -> bool:
+    if right is None or not isinstance(left, str) or not left.strip():
+        return False
+    try:
+        return Path(left).resolve() == right.resolve()
+    except OSError:
+        return False
+
+
+def session_is_owned(
+    session: dict[str, Any],
+    *,
+    change_id: str | None = None,
+    execution_root: Path | None = None,
+    worktree_root: Path | None = None,
+) -> bool:
+    """Return true for an AI session owned by the supplied change/root filters.
+
+    ``change_id`` is required when provided. Root filters match if the session's
+    ``executionRoot`` or ``worktreeRoot`` equals any supplied root (OR).
+    """
+    if session.get("startedBy") != "AI":
+        return False
+    if change_id is not None and session.get("changeId") != change_id:
+        return False
+    root_matches: list[bool] = []
+    if execution_root is not None:
+        root_matches.append(_same_path(session.get("executionRoot"), execution_root))
+        root_matches.append(_same_path(session.get("worktreeRoot"), execution_root))
+    if worktree_root is not None:
+        root_matches.append(_same_path(session.get("worktreeRoot"), worktree_root))
+        root_matches.append(_same_path(session.get("executionRoot"), worktree_root))
+    if root_matches and not any(root_matches):
+        return False
+    return True
+
+
+def find_owned_sessions(
+    project_root: Path,
+    *,
+    change_id: str | None = None,
+    execution_root: Path | None = None,
+    worktree_root: Path | None = None,
+) -> dict[str, list[dict[str, Any]]]:
+    """Discover persisted sessions and classify them without stopping anything."""
+    project = resolve_path(project_root)
+    candidate_dirs: list[Path] = []
+    if change_id:
+        candidate_dirs.extend(
+            [
+                project / ".harness" / "changes" / change_id,
+                project / ".harness" / "state" / "changes" / change_id,
+            ]
+        )
+    else:
+        for root in (
+            project / ".harness" / "changes",
+            project / ".harness" / "state" / "changes",
+        ):
+            if root.is_dir():
+                candidate_dirs.extend(path for path in root.iterdir() if path.is_dir())
+
+    owned: list[dict[str, Any]] = []
+    reported: list[dict[str, Any]] = []
+    seen: set[Path] = set()
+    for change_dir in candidate_dirs:
+        path = session_path(change_dir)
+        try:
+            path = path.resolve()
+        except OSError:
+            continue
+        if path in seen or not path.is_file():
+            continue
+        seen.add(path)
+        try:
+            session = load_session(change_dir)
+        except SessionCorrupt as exc:
+            reported.append(
+                {
+                    "sessionPath": str(path),
+                    "reason": "session-corrupt",
+                    "detail": str(exc),
+                }
+            )
+            continue
+        if session is None:
+            continue
+        item = {"changeDir": str(change_dir.resolve()), "session": session}
+        if session_is_owned(
+            session,
+            change_id=change_id,
+            execution_root=execution_root,
+            worktree_root=worktree_root,
+        ):
+            owned.append(item)
+        else:
+            reported.append(
+                {
+                    "sessionPath": str(path),
+                    "reason": "not-owned",
+                    "startedBy": session.get("startedBy"),
+                    "pid": session.get("pid"),
+                    "leasedPort": session.get("leasedPort"),
+                }
+            )
+    return {"owned": owned, "reported": reported}
+
+
+def stop_owned_sessions(
+    project_root: Path,
+    *,
+    change_id: str | None = None,
+    execution_root: Path | None = None,
+    worktree_root: Path | None = None,
+) -> dict[str, Any]:
+    """Stop only discovered AI sessions whose persisted ownership still matches."""
+    discovered = find_owned_sessions(
+        project_root,
+        change_id=change_id,
+        execution_root=execution_root,
+        worktree_root=worktree_root,
+    )
+    stopped: list[dict[str, Any]] = []
+    blocked: list[dict[str, Any]] = []
+    ports_still_in_use: list[int] = []
+    for item in discovered["owned"]:
+        change_dir = Path(item["changeDir"])
+        session = item["session"]
+        if not session_is_owned(
+            session,
+            change_id=change_id,
+            execution_root=execution_root,
+            worktree_root=worktree_root,
+        ):
+            blocked.append(
+                {"sessionPath": str(session_path(change_dir)), "reason": "ownership-changed"}
+            )
+            continue
+        result = stop_ai_session(change_dir, session, require_identity=True)
+        result["sessionPath"] = str(session_path(change_dir))
+        if result.get("action") == "needs-user-decision":
+            blocked.append(result)
+            continue
+        pid = session.get("pid")
+        if isinstance(pid, int) and is_pid_alive(pid):
+            blocked.append(
+                {
+                    "sessionPath": str(session_path(change_dir)),
+                    "reason": "owned-process-still-alive",
+                    "pid": pid,
+                }
+            )
+            continue
+        stopped.append(result)
+        port = session.get("leasedPort")
+        if isinstance(port, int) and is_port_in_use(port):
+            ports_still_in_use.append(port)
+    return {
+        "ok": not blocked,
+        "ownedSessions": len(discovered["owned"]),
+        "stopped": stopped,
+        "blocked": blocked,
+        "reported": discovered["reported"],
+        "portsStillInUse": ports_still_in_use,
+    }
+
+
 # ---------------------------------------------------------------------------
 # Start / stop helpers
 # ---------------------------------------------------------------------------
@@ -924,6 +1091,10 @@ def build_session(
     command: str,
     service_start: dict[str, Any],
     started_at: str | None = None,
+    worktree_root: Path | None = None,
+    execution_root: Path | None = None,
+    change_id: str | None = None,
+    attempt_id: str | None = None,
 ) -> dict[str, Any]:
     profile_name = service_start.get("profile") or "local-dev"
     overlay = service_start.get("overlayPath") or ""
@@ -941,6 +1112,14 @@ def build_session(
     if isinstance(service_start.get("leasedPort"), int):
         session["leasedPort"] = service_start["leasedPort"]
         session["leaseOwner"] = service_start.get("leaseOwner")
+    if worktree_root is not None:
+        session["worktreeRoot"] = str(worktree_root.resolve())
+    if execution_root is not None:
+        session["executionRoot"] = str(execution_root.resolve())
+    if change_id:
+        session["changeId"] = change_id
+    if attempt_id:
+        session["attemptId"] = attempt_id
     return session
 
 
@@ -1031,6 +1210,15 @@ def cmd_ensure(args: argparse.Namespace) -> int:
     # 持久 profile 只保存模板；runtime overlay/profile 注入到 session，不写回持久 profile。
     # 含 worktree/change 陈旧持久值时拒绝（修复输入端陈旧 profile）。
     change_name = getattr(args, "change_name", None) or change_dir.name
+    worktree_root_raw = getattr(args, "worktree_root", None)
+    execution_root_raw = getattr(args, "execution_root", None)
+    attempt_id = str(getattr(args, "attempt_id", None) or "").strip() or None
+    worktree_root = (
+        resolve_path(worktree_root_raw) if worktree_root_raw else project
+    )
+    execution_root = (
+        resolve_path(execution_root_raw) if execution_root_raw else None
+    )
     overlay = getattr(args, "overlay", None)
     leased_port = getattr(args, "leased_port", None)
     lease_owner = str(getattr(args, "lease_owner", None) or "").strip() or None
@@ -1135,6 +1323,10 @@ def cmd_ensure(args: argparse.Namespace) -> int:
                 as_json=as_json,
                 action="restarted",
                 previousPid=pid,
+                worktree_root=worktree_root,
+                execution_root=execution_root,
+                change_id=change_name,
+                attempt_id=attempt_id,
             )
 
         # pid dead → stale session; clear and fall through
@@ -1161,6 +1353,10 @@ def cmd_ensure(args: argparse.Namespace) -> int:
         files=files,
         as_json=as_json,
         action="started",
+        worktree_root=worktree_root,
+        execution_root=execution_root,
+        change_id=change_name,
+        attempt_id=attempt_id,
     )
 
 
@@ -1173,6 +1369,10 @@ def _start_and_record(
     files: list[str],
     as_json: bool,
     action: str,
+    worktree_root: Path | None = None,
+    execution_root: Path | None = None,
+    change_id: str | None = None,
+    attempt_id: str | None = None,
     **extra: Any,
 ) -> int:
     if not files:
@@ -1224,6 +1424,10 @@ def _start_and_record(
         command=command,
         service_start=service_start,
         started_at=started_at,
+        worktree_root=worktree_root,
+        execution_root=execution_root,
+        change_id=change_id,
+        attempt_id=attempt_id,
     )
     write_session(change_dir, session)
 
@@ -1423,6 +1627,21 @@ def build_parser() -> argparse.ArgumentParser:
         default=None,
         help="run id that owns --leased-port",
     )
+    p_ensure.add_argument(
+        "--worktree-root",
+        default=None,
+        help="worktree that owns the service (default: --project)",
+    )
+    p_ensure.add_argument(
+        "--execution-root",
+        default=None,
+        help="ephemeral execution worktree that owns the service",
+    )
+    p_ensure.add_argument(
+        "--attempt-id",
+        default=None,
+        help="phase or transaction attempt that started the service",
+    )
     p_ensure.add_argument("--json", action="store_true")
     p_ensure.set_defaults(func=cmd_ensure)
 

package/harness/manifests/general/claude-code.json

@@ -2,9 +2,9 @@
   "schema_version": 2,
   "profile": "general",
   "adapter": "claude-code",
-  "bundle_version": "0.2.28",
+  "bundle_version": "0.2.29",
   "requires": {
-    "minimumCliVersion": "0.2.40",
+    "minimumCliVersion": "0.2.41",
     "capabilities": [
       "sync@1",
       "rules-sync@1",
@@ -22,7 +22,7 @@
   "files": [
     {
       "path": ".harness-build.json",
-      "sha256": "6502c319f9300c8756e88bb4d1fa9d71793cef7f87eb84683b5567a237230433"
+      "sha256": "45df5a5dbfe9105752ef4fd05ab83c1811a4f9bf4d9b5b8b7a1d36481d2197ef"
     },
     {
       "path": "agents/harness-evaluator.md",
@@ -74,11 +74,11 @@
     },
     {
       "path": "harness-archive/SKILL.md",
-      "sha256": "e322f9da025fd9443b446c27b8bed66fc589386f1bfab6fb4480e029e38ecb95"
+      "sha256": "00382c82dc704e45dd8d19b20971bf5972e932ebf67f49e1ba4b37d568e2cdaa"
     },
     {
       "path": "harness-archive/templates/render-summary.mjs",
-      "sha256": "b437798e93e4bf1afc31305de9e448e4f292ed57513b059ffab59bc53f6dc347"
+      "sha256": "6f5198906276a80859e1dc17793113c39dea8fb510c51678e0c1f91e40fddfa0"
     },
     {
       "path": "harness-archive/templates/summary-data-template.json",
@@ -94,7 +94,7 @@
     },
     {
       "path": "harness-codebase-map/SKILL.md",
-      "sha256": "a84c7adcae064a729ce9ab6ab41a2936b197d70a38402f14e388af628b76c4c9"
+      "sha256": "c24223f26125039aad63e2596e9f2d4ade19d99ab1ccc52723ed9d315e3df079"
     },
     {
       "path": "harness-codebase-map/templates/ARCHITECTURE.md",
@@ -154,15 +154,15 @@
     },
     {
       "path": "harness-knowledge-ingest/scripts/harness_knowledge.py",
-      "sha256": "4c83c3282b956143de287e6817f34687457c98f456f71749e2ad6ac4546a2498"
+      "sha256": "b451ad12a16758b69b6852e0a4348b3889795c05cbe691d49efdeb78a1abecea"
     },
     {
       "path": "harness-knowledge-ingest/SKILL.md",
-      "sha256": "56c5a9b22ccf70763fe45dadda515b7b7fb819e792c1445f40dffd96688e232c"
+      "sha256": "26c49a665ddf68a01130e3b8b96285b392e52397c0931484ae89e9b0e329897a"
     },
     {
       "path": "harness-knowledge-query/SKILL.md",
-      "sha256": "6e5d0ed600d479aeda3824710675746e04455b54126eea5fb7573dff958d8901"
+      "sha256": "4329b3378066d4e8566fd4890007825269b3ee06c684b636e90f30e1d3f70699"
     },
     {
       "path": "harness-plan/checklist.md",
@@ -178,7 +178,7 @@
     },
     {
       "path": "harness-plan/SKILL.md",
-      "sha256": "17c38a879581733b674ab637f1bfac299a18d58e741217cc8e754381e7c5d6ba"
+      "sha256": "c8b413024053717bd9822d000dfc3bffb602b4e66a71774bb311b09919fc74e2"
     },
     {
       "path": "harness-review/checklist.md",
@@ -190,11 +190,11 @@
     },
     {
       "path": "harness-review/reference.md",
-      "sha256": "5e43f753b2189bc8256c04905c079016a31694dad2aa1ad841aceae3670dd6c6"
+      "sha256": "94bfb479910abbf393721887c4ce1b7d4259d170a1223c3315330d317ce77510"
     },
     {
       "path": "harness-review/SKILL.md",
-      "sha256": "0a295bf9e189d5f4664c5df4fb5f6c95b3d489c7e91fbe4ac741722086310aa0"
+      "sha256": "1fa201e66482740662d82910d9958285d3589364be96cd69926fbb932a732c1c"
     },
     {
       "path": "harness-run/checklist.md",
@@ -210,7 +210,7 @@
     },
     {
       "path": "harness-run/SKILL.md",
-      "sha256": "798c96ba1e8ec8ccb180ccbf9f82a49164f5a8869d85ec96a13b93476841717d"
+      "sha256": "e886f41e4c4f4fc71ae19bb2804430faab5cafa22de070b517fe1ea43da7b316"
     },
     {
       "path": "harness-submit/checklist.md",
@@ -222,7 +222,7 @@
     },
     {
       "path": "harness-submit/SKILL.md",
-      "sha256": "e13c96a448efeb54ac1c1f7239754be351d6a8bbb9959d679fbf1ecf0390aa15"
+      "sha256": "0473bf9a7ad86f9b14e9beb1b9fc2d19aa8ca720776b517de534bef040bb7c2e"
     },
     {
       "path": "harness-sync/reference.md",
@@ -230,7 +230,7 @@
     },
     {
       "path": "harness-sync/SKILL.md",
-      "sha256": "1315123144c3d2c3d79cf52e8a8745cd282fb6e4ded2b3486efabee6981e2f5d"
+      "sha256": "45d990b184c82ff193cc1bb81b293c22971a203f2e20b888fc9fce4c0c45abe7"
     },
     {
       "path": "harness-test/checklist.md",
@@ -254,7 +254,7 @@
     },
     {
       "path": "harness-test/SKILL.md",
-      "sha256": "02f62492e02e3cf6cbdb2dc3720e43245dc9b067fa9e2ff5dcf3668e8c524ac8"
+      "sha256": "fe595cdc91eb12e12d4881bf881cc8ad1d0c00577f1c219108508148e74f0886"
     },
     {
       "path": "protocols/archive-report-protocol.md",
@@ -322,7 +322,7 @@
     },
     {
       "path": "scripts/harness_archive.py",
-      "sha256": "77b77ccbea2ec201294eb13763f90ca7bb2fc8f1fbdb4456e455d02bbcc78309"
+      "sha256": "d9992c4f1a5e3c777ee4d6a8415b1a127dc28d2921110e4bd9fd2726827c0abb"
     },
     {
       "path": "scripts/harness_change.py",
@@ -346,19 +346,19 @@
     },
     {
       "path": "scripts/harness_events.py",
-      "sha256": "7f5e9e316c422f7532fe0fcf52beb809125f757af7ccfbdf85fa519c2de4e66d"
+      "sha256": "0d4db19d71d5945837c255192f7c915af447f98e2ac66bf60e25b93f1613b391"
     },
     {
       "path": "scripts/harness_gate.py",
-      "sha256": "37bdb2eaaac2652fe5cdf142572e99379b1b17630f365a01b6e3e71333055a8a"
+      "sha256": "d6085f724ea59f0fcd47a190a7c45ce81c77a21e84fba185e47c6b21b84c054e"
     },
     {
       "path": "scripts/harness_integration.py",
-      "sha256": "88d0a6ffbdec74ce8c3a994c1ec80e5a0c550b3cccad8d46fb8c355ced1a7721"
+      "sha256": "19ff557794609d94af780f0055aa0a50d47cfd6775f97c163d542205d2ab0044"
     },
     {
       "path": "scripts/harness_ledger.py",
-      "sha256": "ffb7aa2f63b86edf74730dcf44cb530266bda2a8064bada11cd8240651b634e5"
+      "sha256": "3b00ff15958a1cc650ee32f6a3d8807f4585b75c5bce33707fc9e48c9ec71235"
     },
     {
       "path": "scripts/harness_migration_head.py",
@@ -390,7 +390,7 @@
     },
     {
       "path": "scripts/harness_report_model.py",
-      "sha256": "fd30968d429aed3a82bddd3203ccfe89807c00fa2d67787b625c67182a289feb"
+      "sha256": "08b6df8f053ea3381ca24571056817e0756a06cef01edd1aaee6a7eb492426d6"
     },
     {
       "path": "scripts/harness_retry.py",
@@ -398,7 +398,7 @@
     },
     {
       "path": "scripts/harness_review.py",
-      "sha256": "f5b9170f5c3b35c87bd340e8368cd08d8940176a67fb11666518107ba3626e86"
+      "sha256": "a493efd57d743f7414617ffa2e8cac59d6ddd102b0e45cab60795492bf442e20"
     },
     {
       "path": "scripts/harness_runtime.py",
@@ -406,7 +406,7 @@
     },
     {
       "path": "scripts/harness_service.py",
-      "sha256": "af0eb7c93d5f856c5ed5a977e3f9a12dc0ced5baca571f7023f6b04ece46baf6"
+      "sha256": "a897ccb4ef397d1677e7d45ce55357b37f0083ea7e985685604c40a6da075d12"
     },
     {
       "path": "scripts/harness_state.py",