@hunter-harness/workflow-harness 0.2.4 → 0.2.6

package/harness/bundles/general/codex/scripts/harness_ledger.py

@@ -40,7 +40,9 @@ BROAD_SCOPES = frozenset({"module", "module-am", "full"})
 
 # --- Ledger v2 (cluster 2) ---
 LEDGER_VERSION = "harness-ledger-2"
-DIFF_HASH_VERSION = "content-changeset-1"
+DIFF_HASH_VERSION = "content-changeset-2"
+TEST_TRACKING_REL = Path("evidence") / "test-tracking.json"
+TEST_TRACKING_REASONS = frozenset({"tdd-created", "stale-test-repair", "test-updated"})
 # Coverage lattice: a recorded verification's coverage rank must meet the
 # verification's required rank. Prevents incremental evidence from satisfying
 # a module/full gate (UT-015 / API-005).
@@ -168,7 +170,88 @@ def _changed_paths(repo_root: Path, base: str | None) -> tuple[str, list[str]]:
     return base, sorted(paths)
 
 
-def compute_diff_hash(repo_root: Path, base: str | None = None) -> tuple[str, dict[str, Any]]:
+def _inside(path: Path, root: Path) -> bool:
+    try:
+        path.relative_to(root)
+        return True
+    except ValueError:
+        return False
+
+
+def _tracked_test_contents(
+    repo_root: Path,
+    change_dir: Path | str | None,
+) -> tuple[dict[str, bytes], str | None]:
+    """Load exact test paths recorded by harness_test_guard.
+
+    The ledger validates the same security-critical manifest fields again so a
+    hand-edited manifest cannot silently widen the fingerprint or reuse stale
+    evidence. Missing manifests remain backward-compatible and contribute no
+    additional paths.
+    """
+    if change_dir is None:
+        return {}, None
+    candidate = Path(change_dir)
+    if not candidate.is_absolute():
+        candidate = repo_root / candidate
+    change_root = candidate.resolve()
+    if not _inside(change_root, repo_root):
+        raise ValueError("TEST_TRACKING_CHANGE_DIR_OUTSIDE_PROJECT")
+    manifest_path = (change_root / TEST_TRACKING_REL).resolve()
+    if not _inside(manifest_path, change_root):
+        raise ValueError("TEST_TRACKING_MANIFEST_OUTSIDE_CHANGE")
+    if not manifest_path.is_file():
+        return {}, None
+    try:
+        manifest = json.loads(manifest_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError) as exc:
+        raise ValueError(f"TEST_TRACKING_MANIFEST_INVALID: {exc}") from exc
+    if (
+        not isinstance(manifest, dict)
+        or manifest.get("schemaVersion") != 1
+        or manifest.get("mode") != "force-track-touched"
+        or manifest.get("projectRoot") != str(repo_root)
+    ):
+        raise ValueError("TEST_TRACKING_MANIFEST_INVALID")
+    entries = manifest.get("files")
+    if not isinstance(entries, list) or not entries:
+        raise ValueError("TEST_TRACKING_MANIFEST_INVALID: EMPTY_FILES")
+
+    contents: dict[str, bytes] = {}
+    for item in entries:
+        if not isinstance(item, dict):
+            raise ValueError("TEST_TRACKING_MANIFEST_INVALID")
+        rel = item.get("path")
+        expected_hash = item.get("sha256")
+        if (
+            not isinstance(rel, str)
+            or not rel
+            or not isinstance(expected_hash, str)
+            or item.get("reason") not in TEST_TRACKING_REASONS
+            or type(item.get("ignored")) is not bool
+            or type(item.get("trackedBefore")) is not bool
+        ):
+            raise ValueError("TEST_TRACKING_MANIFEST_INVALID")
+        raw_path = Path(rel)
+        resolved = (repo_root / raw_path).resolve()
+        if raw_path.is_absolute() or not _inside(resolved, repo_root):
+            raise ValueError(f"TEST_TRACKING_PATH_OUTSIDE_PROJECT: {rel}")
+        normalized = resolved.relative_to(repo_root).as_posix()
+        if normalized != rel or not resolved.is_file():
+            raise ValueError(f"TEST_TRACKING_FILE_INVALID: {rel}")
+        content = resolved.read_bytes()
+        actual_hash = "sha256:" + hashlib.sha256(content).hexdigest()
+        if actual_hash != expected_hash:
+            raise ValueError(f"TEST_TRACKING_HASH_DRIFT: {rel}")
+        contents[rel] = content
+    return {rel: contents[rel] for rel in sorted(contents)}, str(manifest_path)
+
+
+def compute_diff_hash(
+    repo_root: Path,
+    base: str | None = None,
+    change_dir: Path | str | None = None,
+) -> tuple[str, dict[str, Any]]:
     """Byte-level, commit-invariant diff hash (cluster 2).
 
     Content-based change set: every file whose working-tree content differs
@@ -179,6 +262,8 @@ def compute_diff_hash(repo_root: Path, base: str | None = None) -> tuple[str, di
     """
     repo_root = Path(repo_root).resolve()
     base, paths = _changed_paths(repo_root, base)
+    tracked_test_contents, manifest_path = _tracked_test_contents(repo_root, change_dir)
+    paths = sorted(set(paths).union(tracked_test_contents))
     digest = hashlib.sha256()
     digest.update(DIFF_HASH_VERSION.encode("utf-8"))
     digest.update(b"\x00")
@@ -187,7 +272,12 @@ def compute_diff_hash(repo_root: Path, base: str | None = None) -> tuple[str, di
         digest.update(len(path_bytes).to_bytes(4, "big"))
         digest.update(path_bytes)
         abs_path = repo_root / rel
-        if abs_path.is_file():
+        if rel in tracked_test_contents:
+            content = tracked_test_contents[rel]
+            digest.update(b"\x01")
+            digest.update(len(content).to_bytes(8, "big"))
+            digest.update(content)
+        elif abs_path.is_file():
             content = abs_path.read_bytes()
             digest.update(b"\x01")
             digest.update(len(content).to_bytes(8, "big"))
@@ -196,6 +286,14 @@ def compute_diff_hash(repo_root: Path, base: str | None = None) -> tuple[str, di
             # Deleted since base: record absence with no content.
             digest.update(b"\x00")
             digest.update((0).to_bytes(8, "big"))
+    for rel, verified_content in tracked_test_contents.items():
+        path = repo_root / rel
+        try:
+            current_content = path.read_bytes()
+        except OSError as exc:
+            raise ValueError(f"TEST_TRACKING_HASH_DRIFT: {rel}") from exc
+        if current_content != verified_content:
+            raise ValueError(f"TEST_TRACKING_HASH_DRIFT: {rel}")
     try:
         head = _git_bytes(["rev-parse", "HEAD"], repo_root).decode("utf-8", "replace").strip()
     except RuntimeError:
@@ -205,6 +303,8 @@ def compute_diff_hash(repo_root: Path, base: str | None = None) -> tuple[str, di
         "fileCount": len(paths),
         "base": base,
         "head": head or None,
+        "trackedTestFileCount": len(tracked_test_contents),
+        "testTrackingManifest": manifest_path,
     }
     return f"sha256:{digest.hexdigest()}", meta
 
@@ -778,9 +878,10 @@ def cmd_diff_hash(args: argparse.Namespace) -> int:
     repo_raw = getattr(args, "repo", None)
     repo = Path(repo_raw).expanduser().resolve() if repo_raw else Path.cwd().resolve()
     base = getattr(args, "base", None)
+    change_dir = getattr(args, "change_dir", None)
     try:
-        diff_hash, meta = compute_diff_hash(repo, base=base)
-    except (OSError, RuntimeError) as exc:
+        diff_hash, meta = compute_diff_hash(repo, base=base, change_dir=change_dir)
+    except (OSError, RuntimeError, ValueError) as exc:
         return emit_error(str(exc), as_json=as_json)
     payload = {"ok": True, "action": "diff-hash", "diffHash": diff_hash}
     payload.update(meta)
@@ -922,6 +1023,11 @@ def build_parser() -> argparse.ArgumentParser:
     )
     p_diff.add_argument("--repo", default=None, help="repo root (default: cwd)")
     p_diff.add_argument("--base", default=None, help="base commit (default: root commit)")
+    p_diff.add_argument(
+        "--change-dir",
+        default=None,
+        help="change directory whose evidence/test-tracking.json contributes ignored tests",
+    )
     p_diff.set_defaults(func=cmd_diff_hash)
 
     return parser

package/harness/bundles/general/codex/scripts/harness_preflight.py

@@ -313,7 +313,23 @@ def _parse_scalar(val: str) -> Any:
     return val
 
 
-def cmd_check_agents(skills_root: Path, agent: str) -> dict[str, Any]:
+def _resolve_agents_root(skills_root: Path, agents_root: Path | None) -> tuple[Path | None, str | None]:
+    """Resolve agent definitions without confusing a skills root with its sibling."""
+    if agents_root is not None:
+        return agents_root.resolve(), None
+    if skills_root.name == "skills" and skills_root.parent.name in (".claude", ".codebuddy"):
+        return (skills_root.parent / "agents").resolve(), None
+    if skills_root.name == "skills" and skills_root.parent.name in (".agents", ".cursor"):
+        return None, "CUSTOM_AGENTS_UNSUPPORTED"
+    return (skills_root / "agents").resolve(), None
+
+
+def cmd_check_agents(
+    skills_root: Path,
+    agent: str,
+    *,
+    agents_root: Path | None = None,
+) -> dict[str, Any]:
     skills_root = skills_root.resolve()
     agent_name = agent.strip()
     if not agent_name:
@@ -325,9 +341,23 @@ def cmd_check_agents(skills_root: Path, agent: str) -> dict[str, Any]:
             "reason": "agent name is empty",
         }
 
+    resolved_agents_root, capability_error = _resolve_agents_root(skills_root, agents_root)
+    if capability_error is not None:
+        return {
+            "ok": True,
+            "action": "check-agents",
+            "agent": agent_name,
+            "usable": False,
+            "definitionValid": False,
+            "runtimeSupported": False,
+            "reasonCode": capability_error,
+            "reason": "current adapter runtime does not support custom agent definitions; use main-session fallback",
+        }
+
+    assert resolved_agents_root is not None
     # Accept bare name or with .md
     filename = agent_name if agent_name.endswith(".md") else f"{agent_name}.md"
-    agent_path = skills_root / "agents" / filename
+    agent_path = resolved_agents_root / filename
 
     if not agent_path.is_file():
         return {
@@ -335,7 +365,11 @@ def cmd_check_agents(skills_root: Path, agent: str) -> dict[str, Any]:
             "action": "check-agents",
             "agent": agent_name,
             "path": str(agent_path),
+            "agentsRoot": str(resolved_agents_root),
             "usable": False,
+            "definitionValid": False,
+            "runtimeSupported": True,
+            "reasonCode": "AGENT_DEFINITION_NOT_FOUND",
             "reason": f"agent file not found: {agent_path}",
         }
 
@@ -390,7 +424,11 @@ def cmd_check_agents(skills_root: Path, agent: str) -> dict[str, Any]:
         "action": "check-agents",
         "agent": agent_name,
         "path": str(agent_path),
+        "agentsRoot": str(resolved_agents_root),
         "usable": True,
+        "definitionValid": True,
+        "runtimeSupported": True,
+        "reasonCode": "READY",
         "reason": "agent file exists; frontmatter parsed; tools declared",
         "name": name_field,
         "tools": tools,
@@ -431,6 +469,7 @@ def build_parser() -> argparse.ArgumentParser:
 
     p_agents = sub.add_parser("check-agents", help="Validate agent definition usability")
     p_agents.add_argument("--skills-root", required=True, type=Path)
+    p_agents.add_argument("--agents-root", type=Path)
     p_agents.add_argument("--agent", required=True)
     p_agents.add_argument("--json", action="store_true")
 
@@ -459,7 +498,11 @@ def main(argv: list[str] | None = None) -> int:
         )
         return emit_json(result, ok=bool(result.get("ok", False)))
     if args.command == "check-agents":
-        result = cmd_check_agents(args.skills_root, args.agent)
+        result = cmd_check_agents(
+            args.skills_root,
+            args.agent,
+            agents_root=args.agents_root,
+        )
         return emit_json(result, ok=True)
 
     parser.error(f"unknown command: {args.command}")

package/harness/bundles/general/codex/scripts/harness_profile.py

@@ -223,8 +223,8 @@ def _java_commands(reactor_modules: list[str], pom_hash: str) -> dict[str, Any]:
             "basis": dict(basis),
         },
         "package": {
-            "command": "mvn -f pom.xml package '-Dmaven.test.skip=true'",
-            "argvTemplate": ["mvn", "-f", "pom.xml", "package", "-Dmaven.test.skip=true"],
+            "command": "mvn -f pom.xml clean package '-Dmaven.test.skip=true'",
+            "argvTemplate": ["mvn", "-f", "pom.xml", "clean", "package", "-Dmaven.test.skip=true"],
             "scope": "module",
             "inputs": _cmd_inputs(reactor_modules, pom=True, main=True, test=True),
             "coverage": "package",
@@ -324,6 +324,13 @@ def empty_profile_skeleton(excluded: tuple[str, ...] | list[str]) -> dict[str, A
         "knownPreexistingErrors": [],
         "shellQuirks": [],
         "fingerprint": {"mvnVersion": "", "nodeVersion": "", "pomHash": ""},
+        "testTracking": {
+            "source": "detected",
+            "mode": "force-track-touched",
+            "paths": [],
+            "staleTestPolicy": "safe-repair",
+            "forbidTemporaryExclusion": True,
+        },
     }
 
 
@@ -357,6 +364,9 @@ def _merge_user_overrides(
         profile["knownPreexistingErrors"] = list(existing["knownPreexistingErrors"])
     if isinstance(existing.get("shellQuirks"), list):
         profile["shellQuirks"] = list(existing["shellQuirks"])
+    test_tracking = existing.get("testTracking")
+    if isinstance(test_tracking, dict) and test_tracking.get("source") == "user":
+        profile["testTracking"] = dict(test_tracking)
     # 兼容字段：用户在 v1 配置的 verificationInputs 不保留（无 provenance），
     # 由 commands 重新派生。knownPreexistingErrors/shellQuirks 是人工标注，保留。
 
@@ -392,10 +402,28 @@ def detect(project: Path) -> dict[str, Any]:
         reactor_modules = find_reactor_modules(project, excluded)
         if reactor_modules:
             profile["commands"] = _java_commands(reactor_modules, pom_hash)
+            profile["testTracking"]["paths"] = sorted(
+                "src/test/**" if module == "." else f"{module}/src/test/**"
+                for module in reactor_modules
+            )
     elif project_type == "node":
         node_cmds = _node_commands(project)
         if node_cmds:
             profile["commands"] = node_cmds
+        profile["testTracking"]["paths"] = [
+            pattern
+            for extension in ("js", "jsx", "ts", "tsx", "mjs", "cjs")
+            for pattern in (
+                f"apps/*/test/**/*.{extension}",
+                f"apps/*/tests/**/*.{extension}",
+                f"packages/*/test/**/*.{extension}",
+                f"packages/*/tests/**/*.{extension}",
+                f"test/**/*.{extension}",
+                f"tests/**/*.{extension}",
+                f"**/*.test.{extension}",
+                f"**/*.spec.{extension}",
+            )
+        ]
 
     _merge_user_overrides(profile, existing)
     _derive_verification_inputs(profile)
@@ -719,7 +747,7 @@ def main(argv: list[str] | None = None) -> int:
     if args.command == "check":
         result = check(args.project)
         sys.stdout.write(json.dumps(result, ensure_ascii=False, indent=2) + "\n")
-        return 0 if not result.get("stale") else 0  # stale still exits 0 (callers branch on JSON)
+        return 0 if result.get("ok") and not result.get("stale") else 1
     if args.command == "validate":
         profile = load_profile(args.project.resolve())
         if profile is None:

package/harness/bundles/general/codex/scripts/harness_state.py

@@ -12,9 +12,11 @@ Python 3.10+ stdlib only. UTF-8 without BOM. Windows path friendly.
 from __future__ import annotations
 
 import datetime as dt
+import argparse
 import hashlib
 import json
 import os
+import subprocess
 import sys
 from pathlib import Path
 from typing import Any
@@ -177,3 +179,149 @@ def refresh_segments(
     refreshed["segments"] = refreshed_segments
     refreshed["generatedAt"] = now_iso()
     return refreshed
+
+
+def _git(project: Path, *args: str) -> str:
+    proc = subprocess.run(
+        ["git", "-C", str(project), *args],
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+        check=False,
+    )
+    return proc.stdout.strip() if proc.returncode == 0 else ""
+
+
+def _existing_files(paths: list[Path]) -> list[str]:
+    return sorted({str(path.resolve()) for path in paths if path.is_file()})
+
+
+def discover_segment_files(
+    project: Path, change_dir: Path, *, base: str = "", head: str = "HEAD"
+) -> dict[str, list[str]]:
+    """Discover the compact inputs shared by plan/run/test/review/submit."""
+    project = project.resolve()
+    rules = [project / "AGENTS.md", project / "CLAUDE.md"]
+    for pattern in (
+        ".claude/rules/**/*",
+        ".cursor/rules/**/*",
+        ".codebuddy/rules/**/*",
+        ".codebuddy/.rules/**/*",
+    ):
+        rules.extend(project.glob(pattern))
+
+    profile = [
+        project / ".harness/config/build-profile.json",
+        project / ".harness/context-index.json",
+        project / "project.yaml",
+        project / "harness.json",
+    ]
+    codebase_map = list((project / ".harness/codebase/map").glob("**/*"))
+    knowledge = [
+        project / ".harness/knowledge/index.json",
+        project / ".harness/knowledge/status.json",
+        project / ".harness/knowledge/config.json",
+    ]
+    change_inputs: list[Path] = []
+    for folder in ("spec", "plans", "meta"):
+        change_inputs.extend((change_dir / folder).glob("**/*"))
+    change_inputs = [path for path in change_inputs if path != snapshot_path(change_dir)]
+
+    changed_names: list[str] = []
+    if base:
+        raw = _git(project, "diff", "--name-only", "--diff-filter=ACMRT", f"{base}..{head}")
+        changed_names = [line for line in raw.splitlines() if line.strip()]
+    code = [project / name for name in changed_names]
+    return {
+        "profile": _existing_files(profile),
+        "rules": _existing_files(rules),
+        "map": _existing_files(codebase_map),
+        "knowledge": _existing_files(knowledge),
+        "change": _existing_files(change_inputs),
+        "code": _existing_files(code),
+    }
+
+
+def capture_current_state(
+    *,
+    project: Path,
+    change_dir: Path,
+    change_name: str,
+    worktree_root: Path,
+    base: str = "",
+    head: str = "HEAD",
+) -> tuple[dict[str, Any], list[str]]:
+    resolved_head = _git(project, "rev-parse", head) or head
+    resolved_base = _git(project, "rev-parse", base) if base else ""
+    files = discover_segment_files(project, change_dir, base=resolved_base, head=resolved_head)
+    previous = load_snapshot(change_dir)
+    fresh = capture_snapshot(
+        change_dir,
+        change_name=change_name,
+        project=project,
+        worktree_root=worktree_root,
+        base=resolved_base,
+        head=resolved_head,
+        segment_files=files,
+    )
+    changed: list[str] = []
+    if previous:
+        old_segments = previous.get("segments") or {}
+        for name, segment in fresh["segments"].items():
+            old = old_segments.get(name)
+            if isinstance(old, dict) and old.get("fingerprint") == segment.get("fingerprint"):
+                segment["capturedAt"] = old.get("capturedAt", segment["capturedAt"])
+            else:
+                changed.append(name)
+    else:
+        changed = list(fresh["segments"])
+    write_snapshot(change_dir, fresh)
+    return fresh, changed
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description="Capture reusable Harness state")
+    sub = parser.add_subparsers(dest="command", required=True)
+    capture = sub.add_parser("capture", help="capture or refresh changed segments")
+    capture.add_argument("--project", default=".")
+    capture.add_argument("--change-dir", required=True)
+    capture.add_argument("--change-name")
+    capture.add_argument("--worktree-root")
+    capture.add_argument("--base", default="")
+    capture.add_argument("--head", default="HEAD")
+    capture.add_argument("--json", action="store_true")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    project = Path(args.project).resolve()
+    change_dir = Path(args.change_dir).resolve()
+    name = args.change_name or change_dir.name
+    worktree = Path(args.worktree_root).resolve() if args.worktree_root else project
+    snapshot, changed = capture_current_state(
+        project=project,
+        change_dir=change_dir,
+        change_name=name,
+        worktree_root=worktree,
+        base=args.base,
+        head=args.head,
+    )
+    result = {
+        "ok": True,
+        "path": str(snapshot_path(change_dir)),
+        "changedSegments": changed,
+        "reusedSegments": sorted(set(snapshot["segments"]) - set(changed)),
+        "git": snapshot["git"],
+    }
+    if args.json:
+        print(json.dumps(result, ensure_ascii=False))
+    else:
+        print(f"state snapshot: {result['path']}")
+        print(f"changed: {', '.join(changed) if changed else 'none'}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())