@nurix/etna 0.19.73 → 0.19.75

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "96b7a7dc48a3",
+    "fingerprint": "a4e2f407bbc6",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/agents/brainstorm.md

@@ -21,6 +21,10 @@ run at the start of every dispatch and again before you return:
 node <skill>/scripts/detector.mjs <session-folder> [--gate=manifest|move] [--json]
 ```
 
+A real run always prints per-rule lines and a `clean`/`failing` summary (or a usage/error
+message). **Empty output is not a clean run — it means the detector never executed**; treat it
+as a failed gate and report it, never as a pass.
+
 ## The write protocol you enforce
 
 One writer per file. You write `state.md`, `thesis.md`, `forks.md`, `ledger.md`, `fragments/`,

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.9.4",
+  "version": "3.9.6",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -15,5 +15,5 @@
     "docs/memory/main.md",
     ".mcp.json"
   ],
-  "digest": "df2fa5a29379"
+  "digest": "f1da48ec8895"
 }

package/data/harnesses/code/rules/cloudflare.md

@@ -21,6 +21,7 @@ None by default. Keep a comment only when it captures a non-obvious **WHY** —
 
 ### 1.4 workers.dev URLs
 
+- **Don't expose on `workers.dev` by default** — it is a public, guessable, internet-facing domain (`<worker>.<account>.workers.dev`), indexed and reachable by anyone the moment the Worker deploys. Default to `"workers_dev": false`; when a deploy is requested and no custom domain or route exists yet, warn the user that enabling `workers.dev` makes the Worker public, and enable it only if they confirm they want that.
 - Set `"workers_dev": false` once a custom domain is wired up, so the custom domain is the only entry point.
 - Pair with a `routes` entry using `custom_domain: true` so Cloudflare manages the DNS record and cert.
 

package/data/harnesses/code/skills/brainstorm/references/session-schema.md

@@ -181,6 +181,8 @@ the move to history requires a recorded passing uselessness test [BS-USELESS-01]
 - `move` — adds the post-apply gates (manifest applied, uselessness pass recorded, no links into
   scaffolding); the folder may not move while any fail.
 
-Exit code 0 = clean, 1 = violations (listed with rule IDs), 2 = unusable input. Rules degrade
+Exit code 0 = clean, 1 = violations (listed with rule IDs), 2 = unusable input. A run always
+prints output — per-rule lines plus a `clean`/`failing` summary (or a usage/error message);
+**exit 0 with empty output means the detector never executed** and is a failure, never a pass. Rules degrade
 gracefully: no git context ⇒ BS-OPS-02 reports `skipped`, never blocks. Rule IDs are stable —
 consumers (the twin, the evals, the maintenance census) key on them.

package/data/harnesses/code/skills/brainstorm/scripts/detector.mjs

@@ -3,7 +3,7 @@
 // Contract: references/session-schema.md. Rule IDs are stable; consumers key on them.
 // Usage: node detector.mjs <session-folder> [--gate=session|manifest|move] [--json]
 
-import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { readFileSync, existsSync, readdirSync, statSync, realpathSync } from 'node:fs';
 import { join, basename, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
@@ -455,6 +455,8 @@ function main() {
     process.exit(failed.length === 0 ? 0 : 1);
 }
 
-if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+// realpath both sides: argv[1] keeps the invoking symlink (e.g. a ~/.claude/skills link),
+// while import.meta.url is the resolved file — a plain path compare silently skips main().
+if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
     main();
 }

package/data/harnesses/code/skills/design/scripts/select-chart.mjs

@@ -617,6 +617,8 @@ function main() {
   process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+// realpath both sides: argv[1] keeps the invoking symlink (e.g. a ~/.claude/skills link),
+// while import.meta.url is the resolved file — a plain path compare silently skips main().
+if (process.argv[1] && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url))) {
   main();
 }

package/data/harnesses/code/skills/design/scripts/validate-design-md.mjs

@@ -86,9 +86,9 @@
 // (--space-base, --sidebar-width[-collapsed], --topbar-height, --side-panel-width[-wide],
 // --content-max-width; unmapped keys emit as --layout-<key>). The dark block carries the 36 dark roles.
 
-import { readFileSync, existsSync, statSync, readdirSync } from "node:fs";
+import { readFileSync, existsSync, statSync, readdirSync, realpathSync } from "node:fs";
 import { join, resolve, basename, dirname, relative, sep } from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import process from "node:process";
 
 // ---------------------------------------------------------------------------
@@ -1195,4 +1195,6 @@ function main() {
     process.exit(anyFail ? 1 : 0);
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) main();
+// realpath both sides: argv[1] keeps the invoking symlink (e.g. a ~/.claude/skills link),
+// while import.meta.url is the resolved file — a plain path compare silently skips main().
+if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) main();

package/data/harnesses/delivery/agents/brainstorm.md

@@ -21,6 +21,10 @@ run at the start of every dispatch and again before you return:
 node <skill>/scripts/detector.mjs <session-folder> [--gate=manifest|move] [--json]
 ```
 
+A real run always prints per-rule lines and a `clean`/`failing` summary (or a usage/error
+message). **Empty output is not a clean run — it means the detector never executed**; treat it
+as a failed gate and report it, never as a pass.
+
 ## The write protocol you enforce
 
 One writer per file. You write `state.md`, `thesis.md`, `forks.md`, `ledger.md`, `fragments/`,

package/data/harnesses/delivery/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "delivery",
   "name": "delivery",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "ea0919582c83"
+  "digest": "599762913a4e"
 }

package/data/harnesses/delivery/skills/brainstorm/references/session-schema.md

@@ -181,6 +181,8 @@ the move to history requires a recorded passing uselessness test [BS-USELESS-01]
 - `move` — adds the post-apply gates (manifest applied, uselessness pass recorded, no links into
   scaffolding); the folder may not move while any fail.
 
-Exit code 0 = clean, 1 = violations (listed with rule IDs), 2 = unusable input. Rules degrade
+Exit code 0 = clean, 1 = violations (listed with rule IDs), 2 = unusable input. A run always
+prints output — per-rule lines plus a `clean`/`failing` summary (or a usage/error message);
+**exit 0 with empty output means the detector never executed** and is a failure, never a pass. Rules degrade
 gracefully: no git context ⇒ BS-OPS-02 reports `skipped`, never blocks. Rule IDs are stable —
 consumers (the twin, the evals, the maintenance census) key on them.

package/data/harnesses/delivery/skills/brainstorm/scripts/detector.mjs

@@ -3,7 +3,7 @@
 // Contract: references/session-schema.md. Rule IDs are stable; consumers key on them.
 // Usage: node detector.mjs <session-folder> [--gate=session|manifest|move] [--json]
 
-import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { readFileSync, existsSync, readdirSync, statSync, realpathSync } from 'node:fs';
 import { join, basename, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
@@ -455,6 +455,8 @@ function main() {
     process.exit(failed.length === 0 ? 0 : 1);
 }
 
-if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+// realpath both sides: argv[1] keeps the invoking symlink (e.g. a ~/.claude/skills link),
+// while import.meta.url is the resolved file — a plain path compare silently skips main().
+if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
     main();
 }

package/data/harnesses/etna/agents/brainstorm.md

@@ -21,6 +21,10 @@ run at the start of every dispatch and again before you return:
 node <skill>/scripts/detector.mjs <session-folder> [--gate=manifest|move] [--json]
 ```
 
+A real run always prints per-rule lines and a `clean`/`failing` summary (or a usage/error
+message). **Empty output is not a clean run — it means the detector never executed**; treat it
+as a failed gate and report it, never as a pass.
+
 ## The write protocol you enforce
 
 One writer per file. You write `state.md`, `thesis.md`, `forks.md`, `ledger.md`, `fragments/`,

package/data/harnesses/etna/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.4.10",
+  "version": "1.4.11",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "a3ff16dda3c2"
+  "digest": "84ce5acb1a74"
 }

package/data/harnesses/etna/skills/brainstorm/references/session-schema.md

@@ -181,6 +181,8 @@ the move to history requires a recorded passing uselessness test [BS-USELESS-01]
 - `move` — adds the post-apply gates (manifest applied, uselessness pass recorded, no links into
   scaffolding); the folder may not move while any fail.
 
-Exit code 0 = clean, 1 = violations (listed with rule IDs), 2 = unusable input. Rules degrade
+Exit code 0 = clean, 1 = violations (listed with rule IDs), 2 = unusable input. A run always
+prints output — per-rule lines plus a `clean`/`failing` summary (or a usage/error message);
+**exit 0 with empty output means the detector never executed** and is a failure, never a pass. Rules degrade
 gracefully: no git context ⇒ BS-OPS-02 reports `skipped`, never blocks. Rule IDs are stable —
 consumers (the twin, the evals, the maintenance census) key on them.

package/data/harnesses/etna/skills/brainstorm/scripts/detector.mjs

@@ -3,7 +3,7 @@
 // Contract: references/session-schema.md. Rule IDs are stable; consumers key on them.
 // Usage: node detector.mjs <session-folder> [--gate=session|manifest|move] [--json]
 
-import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { readFileSync, existsSync, readdirSync, statSync, realpathSync } from 'node:fs';
 import { join, basename, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
@@ -455,6 +455,8 @@ function main() {
     process.exit(failed.length === 0 ? 0 : 1);
 }
 
-if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+// realpath both sides: argv[1] keeps the invoking symlink (e.g. a ~/.claude/skills link),
+// while import.meta.url is the resolved file — a plain path compare silently skips main().
+if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
     main();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.73",
+    "version": "0.19.75",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {
@@ -42,5 +42,5 @@
         "agent",
         "plugin"
     ],
-    "etnaFingerprint": "96b7a7dc48a3"
+    "etnaFingerprint": "a4e2f407bbc6"
 }