@nurix/etna 0.19.92 → 0.20.0

package/lib/install/plan.mjs

@@ -45,7 +45,7 @@ export const PLUGIN_SUBDIRS = ['skills', 'agents', 'rules', 'scripts', 'hooks'];
 export const PRUNABLE_SUBDIRS = ['skills', 'agents', 'rules', 'scripts'];
 
 // Codex targets rebuilt wholesale on every install rather than merged, so a refresh must delete
-// them first. Recorded in harness.json's `owned.codex` so a later version can prune one it drops.
+// them first.
 export const CODEX_REBUILT_DIRS = ['.agents/skills', '.codex/agents'];
 
 // Every file under dir, as posix paths relative to it. Posix regardless of host, because these
@@ -165,7 +165,49 @@ function codexHooks(bundleDir) {
  * Throws when the bundle has no CLAUDE.md: that is the one file every harness must carry, and a
  * harness without a policy is not a harness.
  */
-export function planHarnessFiles(bundleDir) {
+// The one capability-gated rule (owner ruling 2026-08-15): `cloudflare` ships only where a
+// Worker exists — wrangler.jsonc/wrangler.toml at the target root or one directory level deep
+// (a monorepo's worker package), node_modules excluded. Every other rule ships everywhere by
+// decision. Detection re-runs on every refresh, so `owned.rules` records the filtered truth and
+// the prune/add diff converges a repo whose Worker appears or disappears.
+const CAPABILITY_RULES = { 'cloudflare.md': targetHasWorkerConfig };
+
+function targetHasWorkerConfig(targetDir) {
+  const names = ['wrangler.jsonc', 'wrangler.toml'];
+  if (names.some((n) => existsSync(join(targetDir, n)))) return true;
+  let entries = [];
+  try {
+    entries = readdirSync(targetDir, { withFileTypes: true });
+  } catch {
+    return false;
+  }
+  for (const e of entries) {
+    if (!e.isDirectory() || e.name === 'node_modules' || e.name.startsWith('.')) continue;
+    if (names.some((n) => existsSync(join(targetDir, e.name, n)))) return true;
+    // one more level: packages/*/wrangler.jsonc — the common monorepo shape
+    let sub = [];
+    try {
+      sub = readdirSync(join(targetDir, e.name), { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const s of sub) {
+      if (!s.isDirectory() || s.name === 'node_modules' || s.name.startsWith('.')) continue;
+      if (names.some((n) => existsSync(join(targetDir, e.name, s.name, n)))) return true;
+    }
+  }
+  return false;
+}
+
+// A rule the target's capabilities exclude. No targetDir (payload verification, byte-identity
+// tests) means no filtering — the plan then describes the full bundle.
+function ruleExcluded(sub, rel, targetDir) {
+  if (!targetDir || sub !== 'rules') return false;
+  const gate = CAPABILITY_RULES[rel];
+  return !!gate && !gate(targetDir);
+}
+
+export function planHarnessFiles(bundleDir, targetDir = null) {
   const claudeMdPath = join(bundleDir, 'CLAUDE.md');
   if (!existsSync(claudeMdPath)) {
     throw new Error(`Bundled CLAUDE.md missing at ${claudeMdPath}. Rebuild package data.`);
@@ -177,8 +219,13 @@ export function planHarnessFiles(bundleDir) {
 
   // The component subtrees. This is the mapping the whole module exists for: a bundle says
   // `skills/design/SKILL.md`, a project says `.claude/skills/design/SKILL.md`.
+  const excludedRules = [];
   for (const sub of PLUGIN_SUBDIRS) {
     for (const rel of filesUnder(join(bundleDir, sub))) {
+      if (ruleExcluded(sub, rel, targetDir)) {
+        excludedRules.push(rel);
+        continue;
+      }
       files.push({
         path: `.claude/${sub}/${rel}`,
         content: readFileSync(join(bundleDir, sub, rel), 'utf8'),
@@ -191,7 +238,10 @@ export function planHarnessFiles(bundleDir) {
   // installer, so if these are not in the payload a downloaded project has no Codex support at
   // all and no way to generate it.
   const owned = bundledOwned(bundleDir);
-  const codexOwned = [];
+  if (excludedRules.length) owned.rules = owned.rules.filter((r) => !excludedRules.includes(r));
+  const capabilityNotes = excludedRules.map(
+    (r) => `Rule ${r} not installed — no wrangler.jsonc/wrangler.toml found (capability-gated; a refresh after one appears adds it).`
+  );
 
   const adapter = buildCodexAdapter(bundleDir);
   const separator = claudeMd.endsWith('\n') ? '\n' : '\n\n';
@@ -200,7 +250,6 @@ export function planHarnessFiles(bundleDir) {
     content: adapter ? claudeMd + separator + adapter : claudeMd,
     policy: 'own',
   });
-  codexOwned.push('AGENTS.md');
 
   // `.agents/skills/` is Codex's official scan path and a byte mirror of `.claude/skills/`. Both
   // runtimes require exactly name+description in SKILL.md frontmatter, so the mirrored files are
@@ -214,7 +263,6 @@ export function planHarnessFiles(bundleDir) {
         policy: 'own',
       });
     }
-    codexOwned.push('.agents/skills');
   }
 
   const tomls = listByExt(join(bundleDir, 'codex', 'agents'), '.toml');
@@ -226,17 +274,13 @@ export function planHarnessFiles(bundleDir) {
         policy: 'own',
       });
     }
-    codexOwned.push('.codex/agents');
   }
 
   const hooks = codexHooks(bundleDir);
   if (hooks) {
     files.push({ path: '.codex/hooks.json', content: hooks, policy: 'own' });
-    codexOwned.push('.codex/hooks.json');
   }
 
-  owned.codex = codexOwned;
-
   // The marker, at the path the CLI writes and the maintenance agent resolves the installed
   // version from — never at the bundle root, where nothing reads it.
   const markerPath = join(bundleDir, 'harness.json');
@@ -267,5 +311,5 @@ export function planHarnessFiles(bundleDir) {
     seen.add(file.path);
   }
 
-  return { files, owned, meta };
+  return { files, owned, meta, capabilityNotes };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/etna",
-  "version": "0.19.92",
+  "version": "0.20.0",
   "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
   "type": "module",
   "bin": {
@@ -19,7 +19,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "test": "node --test 'tests/**/*.test.mjs'",
+    "test": "node --test 'tests/**/*.test.mjs' '../../harness/code/hooks/tests/*.test.mjs'",
     "build:data": "node scripts/build-data.js",
     "prepack": "node scripts/build-data.js",
     "validate:codex-agents": "node lib/codex/validate-codex-agents.mjs"
@@ -42,5 +42,5 @@
     "agent",
     "plugin"
   ],
-  "etnaFingerprint": "a1cf8eb35f57"
+  "etnaFingerprint": "067206dbe15a"
 }

package/data/harnesses/code/hooks/check-bookkeeping-clean.mjs

@@ -1,28 +0,0 @@
-// harness/code/hooks/check-bookkeeping-clean.mjs — CI backstop: no unresolved bookkeeping rows
-// (auto:/note:/needs-session:) may reach the remote. waived: rows pass — they are the recorded,
-// PR-reviewable exceptions. Exit 1 when unresolved rows exist.
-//
-// THIS CHECK IS GLOBAL AND STAYS GLOBAL. The commit gate scopes to one commit's staged set so
-// concurrent agents in one checkout do not wall each other; CI judges the branch as a whole, where
-// there is no staged set to scope by and every row has had every commit to be drained in.
-
-import { readQueue, countRows } from "./lib/state.mjs";
-
-const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-const counts = countRows(readQueue(projectDir));
-
-if (counts.unresolved === 0) {
-  console.log(`check-bookkeeping-clean: OK (${counts.waived} waived row(s))`);
-  process.exit(0);
-}
-console.error(
-  `check-bookkeeping-clean: ${counts.unresolved} unresolved row(s) in docs/operations/bookkeeping.md ` +
-    `(${counts.auto} auto, ${counts.note} note, ${counts.needsSession} needs-session, ` +
-    `${counts.expiredWaived} expired-waived). ` +
-    "Drain them (bookkeeper agent), resolve them, or convert to waived: with reason + expires=. " +
-    (counts.expiredWaived > 0
-      ? "An expired waiver is a deferral that ran out: re-judge whether its reason still holds — " +
-        "re-waive with a fresh date only if it does, and never by default."
-      : "")
-);
-process.exit(1);

package/data/harnesses/code/hooks/check-changelog-presence.mjs

@@ -1,36 +0,0 @@
-// harness/code/hooks/check-changelog-presence.mjs — CI backstop: the commit under test (HEAD)
-// carries a docs/history/changelog/ entry unless it is exempt by the changelog rule's closed list,
-// judged mechanically: lockfile-only, harness-file-only, pure renames, changelog housekeeping,
-// or a bot author. Exit 1 when a non-exempt HEAD stages no entry.
-
-import { changelogExemptFile } from "./lib/exempt.mjs";
-import { git as gitAt } from "./lib/repo.mjs";
-
-const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-const git = (args) => gitAt(projectDir, args);
-
-const nameStatus = git(["diff-tree", "--root", "--no-commit-id", "--name-status", "-r", "HEAD"]) || "";
-const entries = nameStatus
-  .split("\n")
-  .filter(Boolean)
-  .map((line) => {
-    const [status, ...files] = line.split("\t");
-    return { status, file: files[files.length - 1] };
-  });
-
-
-const author = git(["log", "-1", "--format=%an <%ae>"]) || "";
-const isBot = /\[bot\]|actions@github\.com/i.test(author);
-const allRenames = entries.length > 0 && entries.every((e) => e.status.startsWith("R"));
-const allExempt = entries.length === 0 || entries.every((e) => changelogExemptFile(e.file));
-const hasEntry = entries.some((e) => e.file.startsWith("docs/history/changelog/") && e.file.endsWith(".md"));
-
-if (isBot || allRenames || allExempt || hasEntry) {
-  console.log("check-changelog-presence: OK");
-  process.exit(0);
-}
-console.error(
-  "check-changelog-presence: HEAD is a non-exempt commit carrying no docs/history/changelog/ entry. " +
-    "Every non-exempt commit ships its entry inside it (exempt: release/bot, harness installs and bumps, lockfile-only, pure renames, changelog housekeeping)."
-);
-process.exit(1);

package/data/harnesses/code/hooks/check-completion-integrity.mjs

@@ -1,72 +0,0 @@
-// harness/code/hooks/check-completion-integrity.mjs — CI backstop for plan completion. Scope:
-// plans in the Gates: format only (legacy plans predate the contract and are history). A Complete
-// plan must show a fully discharged surface: no unchecked Done Criteria boxes, the Spec'd LLD
-// flipped active, and the behavioral checklist present. An Abandoned plan must reference the
-// backlog (undischarged obligations outlive the frozen file there). Exit 1 on any violation.
-
-import fs from "node:fs";
-import path from "node:path";
-import { frontmatter, field } from "./lib/ownership.mjs";
-import { undischargedRows } from "./lib/ledger.mjs";
-import { readSafe } from "./lib/repo.mjs";
-
-const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-const plansDir = path.join(projectDir, "docs", "history", "plans");
-
-let failures = 0;
-const fail = (msg) => {
-  failures += 1;
-  console.error(`check-completion-integrity: ${msg}`);
-};
-
-let plans = [];
-try {
-  plans = fs.readdirSync(plansDir).filter((f) => f.endsWith(".md"));
-} catch (e) {
-  plans = [];
-}
-
-for (const file of plans) {
-  const text = readSafe(path.join(plansDir, file));
-  if (!/^\*\*Gates:\*\*/m.test(text)) continue; // legacy plan — out of contract
-  const status = (/^\*\*Status:\*\*\s*(\S+)/m.exec(text) || [])[1];
-
-  if (status === "Complete") {
-    const unchecked = (text.match(/^- \[ \]/gm) || []).length;
-    if (unchecked > 0) fail(`${file} is Complete with ${unchecked} unchecked Done Criteria box(es)`);
-
-    // The ledger is discharged per row, in the file — a Done Criteria checkbox asserting "every
-    // row discharged" is exactly the checkbox-nothing-reads failure the doc ledger existed to fix.
-    const rows = undischargedRows(text);
-    if (rows.length > 0) {
-      fail(`${file} is Complete with ${rows.length} Test Obligations row(s) missing a discharge outcome (#${rows.join(", #")})`);
-    }
-
-    // EVERY Spec line, not the first. A plan may implement against several feature docs, and a
-    // single-match parse silently exempts all but one — the same singular assumption the Doc
-    // Obligations ledger exists to break, reintroduced here where nothing would surface it.
-    const specs = [...text.matchAll(/^\*\*Spec:\*\*\s*\[[^\]]*\]\(([^)]+)\)/gm)].map((m) => m[1]);
-    for (const spec of specs) {
-      const specPath = path.resolve(plansDir, spec);
-      const specText = readSafe(specPath);
-      const specStatus = (field(frontmatter(specText), "status") || "").toString();
-      if (specText && specStatus !== "active") {
-        fail(`${file} is Complete but its Spec LLD ${spec} is status: ${specStatus || "unknown"} (expected active)`);
-      }
-      const feature = path.basename(specPath, ".md");
-      if (!fs.existsSync(path.join(projectDir, "docs", "tests", `${feature}.md`))) {
-        fail(`${file} is Complete but docs/tests/${feature}.md (the behavioral checklist) is missing`);
-      }
-    }
-  }
-
-  if (status === "Abandoned" && !/backlog/i.test(text)) {
-    fail(`${file} is Abandoned without referencing the backlog — undischarged obligations must outlive the frozen plan`);
-  }
-}
-
-if (failures === 0) {
-  console.log("check-completion-integrity: OK");
-  process.exit(0);
-}
-process.exit(1);

package/data/harnesses/code/hooks/check-ownership.mjs

@@ -1,55 +0,0 @@
-// harness/code/hooks/check-ownership.mjs — CI backstop for docs/features/ ownership. Two checks,
-// one walk of the tree:
-//
-//   1. dead-glob         — every owns: glob matches at least one file
-//   2. ownership-overlap — no two feature docs claim a common file at EQUAL specificity, which
-//                          leaves "most specific wins" unable to pick an owner
-//
-// Either is silenced by an unexpired `waived:` row in docs/operations/bookkeeping.md naming its
-// kind plus the offending glob (dead-glob) or the shared path (ownership-overlap) in backticks.
-// Exit 1 on anything unwaived.
-//
-// A glob at strictly HIGHER specificity carving a sub-path out of a broader `**` is the designed
-// layering, not a conflict — only an exact tie is reported.
-
-import { deadGlobs, listRepoFiles, overlaps } from "./lib/ownership.mjs";
-import { readQueue, waiverCovers } from "./lib/state.mjs";
-
-const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-const today = new Date().toISOString().slice(0, 10);
-
-const files = listRepoFiles(projectDir);
-const queue = readQueue(projectDir);
-
-const dead = deadGlobs(projectDir, files);
-const unwaivedDead = dead.filter((d) => !waiverCovers(queue, "dead-glob", d.glob, today));
-
-const conflicts = overlaps(projectDir, files);
-const unwaivedOverlaps = conflicts.filter((c) => !waiverCovers(queue, "ownership-overlap", c.example, today));
-
-if (unwaivedDead.length === 0 && unwaivedOverlaps.length === 0) {
-  console.log(
-    `check-ownership: OK (${dead.length} dead glob(s), ${conflicts.length} equal-specificity overlap(s), all waived or none)`,
-  );
-  process.exit(0);
-}
-
-if (unwaivedDead.length > 0) {
-  console.error(`check-ownership: ${unwaivedDead.length} unwaived dead owns: glob(s):`);
-  for (const d of unwaivedDead) console.error(`  ${d.glob} → ${d.doc}`);
-  console.error("Fix the owning doc's owns: frontmatter, or add a `waived:` dead-glob row naming the glob in backticks, with reason + expires=.");
-}
-
-if (unwaivedOverlaps.length > 0) {
-  console.error(`check-ownership: ${unwaivedOverlaps.length} unwaived equal-specificity overlap(s):`);
-  for (const c of unwaivedOverlaps) {
-    console.error(`  ${c.example}`);
-    console.error(`    ${c.a.glob} → ${c.a.doc}`);
-    console.error(`    ${c.b.glob} → ${c.b.doc}`);
-  }
-  console.error(
-    "Narrow one doc's glob so a single owner wins, or add a `waived:` ownership-overlap row naming the shared path in backticks with reason + expires=.",
-  );
-}
-
-process.exit(1);

package/lib/codex/index.mjs

@@ -1,63 +0,0 @@
-// packages/cli/lib/codex/index.mjs
-// Claude→Codex projection entry. Derives a repo's Codex-native artifacts
-// (AGENTS.md, .agents/skills/, .codex/agents/, .codex/hooks.json) from the
-// just-installed Claude tree + the harness bundle. Consumed by BOTH shippers —
-// the installer (bin/etna.js) and the marketplace publisher (publish.mjs) — so
-// the two distribution channels can never diverge (the same "keep in agreement"
-// discipline as the evals/fixtures ship-filter). MCP and a settings/config.toml
-// equivalent are deliberately OUT of scope (owner decision 2026-07-13); see
-// docs/features/codex-support.md.
-
-import { existsSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { projectAgentsMd } from './agents-md.mjs';
-import { projectSkills } from './skills.mjs';
-import { copyCodexAgents } from './subagents.mjs';
-import { projectHooks } from './hooks.mjs';
-
-// Project every Codex artifact into targetDir. Returns the same {installed,
-// notices, warnings} accounting shape the installer already collects, plus
-// `owned` — the top-level Codex targets, recorded in harness.json's
-// `owned.codex` so a later version can prune one it stops shipping.
-export function projectCodexArtifacts({
-    targetDir,
-    bundledHarnessDir,
-    bundledClaudeMd,
-    projectHasGit,
-    priorCodexOwned = [],
-}) {
-    const installed = [];
-    const notices = [];
-    const warnings = [];
-    const owned = [];
-
-    const collect = (result, ownedPath) => {
-        if (!result) return;
-        if (result.installed) installed.push(result.installed);
-        if (result.notice) notices.push(result.notice);
-        if (result.warning) warnings.push(result.warning);
-        owned.push(ownedPath);
-    };
-
-    // AGENTS.md — CLAUDE.md copied byte-for-byte + a generated Codex runtime adapter derived from
-    // the bundled harness inventory (see agents-md.mjs), with the CLAUDE.md backup-if-no-git rule.
-    collect(projectAgentsMd({ targetDir, bundledClaudeMd, bundledHarnessDir, projectHasGit }), 'AGENTS.md');
-    // .agents/skills — full-rebuilt mirror of the installed (already ship-filtered) .claude/skills.
-    collect(projectSkills({ targetDir, projectHasGit }), '.agents/skills');
-    // .codex/agents — copy the shipped, pre-authored *.toml (see docs/architecture/harness/authoring-agents.md).
-    collect(copyCodexAgents({ targetDir, bundledHarnessDir, projectHasGit }), '.codex/agents');
-    // .codex/hooks.json — Claude hooks.json filtered to type:"command".
-    collect(projectHooks({ targetDir, bundledHarnessDir }), '.codex/hooks.json');
-
-    // Prune a Codex target a prior version owned but this bundle no longer emits.
-    for (const rel of priorCodexOwned) {
-        if (owned.includes(rel)) continue;
-        const target = join(targetDir, rel);
-        if (existsSync(target)) {
-            rmSync(target, { recursive: true, force: true });
-            notices.push(`removed orphaned codex ${rel}`);
-        }
-    }
-
-    return { installed, notices, warnings, owned };
-}

package/lib/codex/plugin-manifest.mjs

@@ -1,42 +0,0 @@
-// packages/cli/lib/codex/plugin-manifest.mjs
-// Pure builders for the Codex plugin + marketplace manifests, emitted by the
-// marketplace shipper (.github/scripts/publish.mjs) alongside the Claude ones.
-// A Codex plugin reuses the same skills/ and hooks/ dirs as a Claude plugin — only
-// the manifest differs (.codex-plugin/plugin.json) — plus a Codex marketplace
-// catalog (.agents/plugins/marketplace.json). Codex also reads the legacy
-// .claude-plugin/marketplace.json but for DISCOVERY only, so native ones are still emitted.
-
-// The required Codex plugin.json fields + component pointers. `hasHooks` adds the
-// hooks pointer (Codex auto-detects hooks/hooks.json, but naming it is explicit).
-export function buildCodexPluginJson(fm, { hasHooks = false } = {}) {
-    const out = {
-        name: fm.name,
-        version: fm.version,
-        description: fm.description,
-        skills: './skills/',
-    };
-    if (hasHooks) out.hooks = './hooks/hooks.json';
-    return out;
-}
-
-// The repo marketplace catalog Codex reads at .agents/plugins/marketplace.json. Each plugin is a
-// LOCAL source (source.path relative to the catalog root) carrying an explicit install policy:
-//   · installation AVAILABLE — offered, not force-installed (INSTALLED_BY_DEFAULT / NOT_AVAILABLE
-//     are the other documented tokens; these plugins are opt-in).
-//   · authentication NONE — they bundle only skills + hooks, no credentials or external auth.
-// The first keyword (if any) seeds a category. (Enum tokens per codex-support.md → Open Questions;
-// AVAILABLE/NONE are the correct pair for an opt-in, no-auth plugin.)
-export function buildCodexMarketplace(plugins) {
-    return {
-        name: 'nurixlabs',
-        interface: { displayName: 'Nurix Labs' },
-        plugins: [...plugins]
-            .sort((a, b) => a.name.localeCompare(b.name))
-            .map((p) => ({
-                name: p.name,
-                source: { path: `./plugins/${p.name}` },
-                policy: { installation: 'AVAILABLE', authentication: 'NONE' },
-                ...(p.frontmatter?.keywords?.length ? { category: p.frontmatter.keywords[0] } : {}),
-            })),
-    };
-}

package/lib/codex/subagents.mjs

@@ -1,26 +0,0 @@
-// packages/cli/lib/codex/subagents.mjs
-// Copy the harness's pre-authored Codex subagent TOML — bundle codex/agents/*.toml,
-// authored per docs/architecture/harness/authoring-agents.md — into the project's
-// .codex/agents/. Full rebuild each run. The consumer needs NO Codex CLI: the TOML
-// ships ready, so a missing local Codex never blocks an install.
-
-import { existsSync, readdirSync, cpSync, rmSync, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
-
-export function copyCodexAgents({ targetDir, bundledHarnessDir, projectHasGit }) {
-    const src = join(bundledHarnessDir, 'codex', 'agents');
-    if (!existsSync(src)) return null;
-    const tomls = readdirSync(src).filter((f) => f.endsWith('.toml'));
-    if (!tomls.length) return null;
-    const dest = join(targetDir, '.codex', 'agents');
-    if (existsSync(dest)) {
-        if (!projectHasGit) {
-            const ts = new Date().toISOString().replace(/[:.]/g, '-');
-            cpSync(dest, `${dest}.bak.${ts}`, { recursive: true });
-        }
-        rmSync(dest, { recursive: true, force: true });
-    }
-    mkdirSync(dest, { recursive: true });
-    for (const f of tomls) cpSync(join(src, f), join(dest, f), { force: true });
-    return { installed: `${tomls.length} codex agent(s) → .codex/agents/` };
-}