@osfactory/har 0.4.0 → 0.6.0

package/dist/index.js

@@ -26921,6 +26921,7 @@ var REQUIRED_FILES_DEFAULT = [
   "harness.env",
   "setup-infra.sh",
   "launch.sh",
+  "provision-toolchain.sh",
   "verify.sh",
   "teardown.sh",
   "agent-cli.sh",
@@ -26939,6 +26940,7 @@ var REQUIRED_FILES_IOS = [
   "harness.env",
   "setup-infra.sh",
   "launch.sh",
+  "provision-toolchain.sh",
   "verify.sh",
   "teardown.sh",
   "agent-cli.sh",
@@ -26955,6 +26957,7 @@ function getRequiredFiles(repoPath) {
 var SHELL_SCRIPTS = [
   "setup-infra.sh",
   "launch.sh",
+  "provision-toolchain.sh",
   "verify.sh",
   "teardown.sh",
   "agent-cli.sh",
@@ -27244,7 +27247,7 @@ function patchStageRegistry(repoPath, manifest, force) {
   if (verifyIdx >= 0) {
     stages[verifyIdx] = {
       ...stages[verifyIdx],
-      description: "Verification pipeline (quick by default; --full adds lint and browser-e2e when installed)",
+      description: "Verification pipeline (quick smoke by default; --full adds tests, lint, and browser-e2e when installed)",
       acceptsArgs: ["--full"]
     };
   }
@@ -27466,9 +27469,9 @@ var fs17 = __toESM(require("fs"));
 var path15 = __toESM(require("path"));
 var ADAPTATION_PROMPT_FILE = "ADAPT-PROMPT.md";
 var PROFILE_HINTS = {
-  default: "Web app profile \u2014 Docker Compose for shared infra (HARNESS_INFRA_SERVICES), PM2 for the primary application only, git worktree per agent slot by default. Identify the primary app agents modify; run supporting services shared. Adapt docker-compose, setup-infra, and ecosystem templates for this stack.",
-  cli: "CLI/library profile \u2014 no PM2. Optional Docker Compose via the `HARNESS_INFRA_SERVICES` list in harness.env. Agents work in an isolated git worktree by default (`--no-worktree` to use the repo root). Remove any leftover PM2/ecosystem files; keep docker-compose when shared services are enabled.",
-  ios: "iOS mobile app profile \u2014 no PM2, no web ports. Agents build and test via xcodebuild in an isolated git worktree. Set HARNESS_XCODE_SCHEME, HARNESS_XCODE_WORKSPACE/PROJECT, HARNESS_SIMULATOR_NAME, and HARNESS_BUNDLE_ID in harness.env. Adapt setup-infra.sh to boot the target simulator. Install the RocketSim stage template (har env add-stage rocketsim) for user-flow validation."
+  default: "Web app profile (SaaS/full-stack) \u2014 Docker Compose for shared infra (HARNESS_INFRA_SERVICES), PM2 for the primary application only, git worktree per agent slot by default. Launch provisions toolchain via harness.env (HARNESS_ECOSYSTEM, HARNESS_INSTALL_CMD) and writes paths to .env.agent.<id>. Identify the primary app agents modify; run supporting services shared.",
+  cli: "CLI/library profile (typical SWE-bench) \u2014 no PM2. Optional Docker Compose via HARNESS_INFRA_SERVICES. Git worktree by default. Launch provisions toolchain declaratively (HARNESS_ECOSYSTEM auto-detects common ecosystems); verify must use resolved tool paths from .env.agent.<id>, never hardcoded interpreter or package-manager paths.",
+  ios: "iOS mobile app profile \u2014 xcodebuild + iOS Simulator in an isolated git worktree. Set HARNESS_XCODE_SCHEME, workspace/project, HARNESS_SIMULATOR_NAME, HARNESS_BUNDLE_ID. Launch writes XCODEBUILD_BIN to .env.agent.<id>; verify uses it. Install RocketSim stage (har env add-stage rocketsim) for user-flow validation."
 };
 function loadTemplate(name) {
   const filePath = resolveTemplateFile(name);

package/dist/templates/adaptation-prompt-init.md

@@ -6,6 +6,24 @@ Explore this repository, then edit files in `.har/` directly to make the harness
 
 **Do NOT** create a YAML config or JSON mapping file for runtime behavior. Put behavior directly in the harness scripts and templates.
 
+## HAR profiles (pick the right one at init)
+
+`har env init` scaffolds from one of three boilerplate profiles — **choose the profile that matches this repository**:
+
+| Profile | Best for | What you get |
+|---------|----------|--------------|
+| `default` | **SaaS / web apps** (Next.js, Rails, full-stack, etc.) | Docker Compose shared infra, PM2 for primary app, per-slot ports and preview URLs |
+| `cli` | **CLI tools, libraries, test-suite repos** (typical SWE-bench) | Git worktree by default, no PM2; optional Docker for databases; run project commands in isolation |
+| `ios` | **Mobile iOS / Swift** | xcodebuild + iOS Simulator; scheme/project/simulator in `harness.env` |
+
+```bash
+har env init                  # default (SaaS/web)
+har env init --profile cli    # libraries / CLI / polyglot test repos
+har env init --profile ios    # iOS apps
+```
+
+Do **not** disable worktrees, rewrite launch into repo-root-only mode, or pick the wrong profile unless the project truly requires it.
+
 ## Profile: {{PROFILE}}
 
 {{PROFILE_HINT}}
@@ -38,11 +56,31 @@ Clear index of the harness: what each file does, quick start, architecture, how
 ### `.har/harness.env`
 Primary app, ports, `HARNESS_INFRA_SERVICES`, migrate/seed commands, health check path.
 
+**Toolchain provisioning:** set `HARNESS_ECOSYSTEM` (`auto` detects from manifests) and optional `HARNESS_INSTALL_CMD`. Launch runs `provision-toolchain.sh`, writes resolved paths (`PYTHON_BIN`, `NODE_BIN`, `NPM_BIN`, `XCODEBUILD_BIN`, …) into `.env.agent.<id>`. Verify steps **must** use those paths — never hardcode venv or interpreter locations.
+
 ### `.har/ecosystem.agent.template.cjs` (default profile only)
 PM2 processes for the primary application only, matching how it runs in dev. Skip entirely for the CLI profile.
 
 ### `.har/verify.sh`
-Real typecheck, lint, test, and health check commands — replace all TODOs.
+Adapt verification for this repository's toolchain. Step lists in the template are
+**examples, not exhaustive** — add, remove, or reorder `run_step` calls to match
+how this project is built and tested. Use toolchain variables from `.env.agent.<id>`
+(e.g. `${NPM_BIN:-npm}`, `${PYTHON_BIN:-python3}`, `${XCODEBUILD_BIN:-xcodebuild}`).
+The stock verify section is keyed by `HARNESS_ECOSYSTEM`; it is a starting point,
+not the repo's final contract. Replace conventions that do not match this project.
+
+**Tier contract:**
+
+| Mode | Command | Intent |
+|------|---------|--------|
+| Quick (default) | `har env verify 1` | Smoke — compile / import / build / health only |
+| Full | `har env verify 1 --full` | Stricter — unit tests, lint, readiness, optional browser-e2e |
+
+- **Quick** must stay fast and minimal (syntax, compile, import smoke) — not the full test suite.
+- **Full** holds unit tests, lint, and heavier checks; optional Playwright runs on `--full` when installed.
+- Reuse real commands from `package.json`, `Makefile`, CI, `pyproject.toml`, etc.
+- Remove stock npm/pytest/go/cargo/maven/gradle examples that do not apply.
+- Replace all TODO placeholders in both tiers.
 
 ### Readiness vs liveness (required)
 Do not treat a passing health check as adaptation complete. Before finishing,
@@ -74,8 +112,9 @@ scripts or document why no substitute is needed. In particular:
   choose and document an agent-friendly asset mode.
 - Put Layer 3 checks in `verify --full`, a project-owned readiness script, or
   documented smoke URLs. Health alone is not sufficient for UI/auth apps.
-- Ensure `launch.sh` writes the slot registry before slow or fragile steps, and
-  `verify.sh` resolves env/work dir through `agent-slot.sh`.
+- Ensure `launch.sh` writes the slot registry before slow or fragile steps, runs
+  `provision-toolchain.sh` to install deps and record toolchain paths in
+  `.env.agent.<id>`, and `verify.sh` resolves env/work dir through `agent-slot.sh`.
 
 ### Optional Playwright stage
 If the user ran `har env add-stage playwright` (or `@playwright/test` is in package.json):

package/dist/templates/adaptation-prompt-maintain.md

@@ -22,8 +22,8 @@ Prefer targeted edits over full rewrites. Key files to review:
 ### `.har/README.md` (required)
 Keep this accurate — it is the harness index. Update whenever scripts, stages, or workflow change.
 
-### `.har/harness.env`, `verify.sh`, `ecosystem.agent.template.cjs`, `CLAUDE.agent.md`
-Align commands and instructions with the current stack.
+### `.har/harness.env`, `verify.sh`, `provision-toolchain.sh`, `ecosystem.agent.template.cjs`, `CLAUDE.agent.md`
+Align commands and instructions with the current stack. Verify steps must use toolchain paths from `.env.agent.<id>` (`PYTHON_BIN`, `NPM_BIN`, `XCODEBUILD_BIN`, …) — never hardcoded venv or interpreter paths. Replace stock ecosystem conventions that do not match the repository; do not leave npm/pytest/go/cargo/maven/gradle examples in place by accident.
 
 ### `.har/env.template`, `setup-infra.sh`, `docker-compose.agent.yml`
 Update only if infra changed.

package/dist/templates/har-boilerplate/CLAUDE.agent.md

@@ -50,10 +50,12 @@ Quick loop during development: MCP `har_run_verification`, `har env verify ${AGE
 ## Project commands
 
 ```bash
-# TODO: adapt for this repository (see package.json, Makefile, etc.)
+# TODO: adapt for this repository (see package.json, Makefile, pyproject.toml, CI, etc.)
 # npm run typecheck
-# npm test
-# npm run lint
+# pytest -q
+# go test ./...
+# cargo test
+# make test
 ```
 
 ## Do not

package/dist/templates/har-boilerplate/README.md

@@ -12,15 +12,16 @@ Generated and maintained by [`har`](https://github.com/antoineFrau/har). Run `ha
 |------|---------|
 | `README.md` | This file — index of the harness |
 | `manifest.json` | Generator metadata (version, checksums) — do not edit |
-| `harness.env` | Shared config: primary app, ports, agent slot limits, `HARNESS_INFRA_SERVICES`, migrate/seed commands |
+| `harness.env` | Shared config: primary app, ports, agent slot limits, `HARNESS_INFRA_SERVICES`, toolchain provisioning, migrate/seed commands |
 | `stages.json` | Machine-readable registry of runnable harness stages |
 | `stages/` | Optional custom stage scripts registered from `stages.json` |
 | `runs/` | Run history from `har env` / MCP only — `.har/runs/YYYY-MM-DD/HH-mm-ss_<stageId>_agent-<id>.json` (gitignore) |
 | `artifacts/` | Stage outputs: reports, traces, screenshots, logs |
 | `agent-slot.sh` | Shared agent-id validation (reads limits from `harness.env`) |
 | `setup-infra.sh` | Start shared Docker infra + create template database |
-| `launch.sh` | Launch one agent slot (ports, DB clone, PM2 processes) |
-| `verify.sh` | Verification pipeline (typecheck, tests, health) |
+| `launch.sh` | Launch one agent slot (ports, DB clone, toolchain provisioning, PM2 processes) |
+| `provision-toolchain.sh` | Install deps and write toolchain paths to `.env.agent.<id>` |
+| `verify.sh` | Verification pipeline (smoke by default; --full adds tests, lint, e2e) |
 | `teardown.sh` | Tear down one agent slot |
 | `agent-cli.sh` | Manage a running agent (status, logs, psql, health) |
 | `attach.sh` | Attach to agent tmux session |
@@ -49,8 +50,8 @@ In Cursor with HAR MCP configured: use `har_launch_environment`, `har_run_verifi
 ```bash
 ./.har/setup-infra.sh          # when HARNESS_INFRA_SERVICES is non-empty
 ./.har/launch.sh 1
-./.har/verify.sh 1             # quick: typecheck, tests, health
-./.har/verify.sh 1 --full      # done gate: + lint + browser-e2e (if Playwright stage installed)
+./.har/verify.sh 1             # quick: ecosystem smoke + health
+./.har/verify.sh 1 --full      # + conventional tests/lint, browser-e2e (if installed)
 ./.har/teardown.sh 1
 ```
 
@@ -58,10 +59,19 @@ Read **`stages.json`** for registered stages and **`verificationStages`** for th
 
 ## Verification contract
 
+Steps in `verify.sh` are **project-specific examples** — adapt them to your stack
+during `har env init` / `har env maintain`. The table describes each tier's intent,
+not a fixed command list.
+
 | Mode | Command | Typical steps |
 |------|---------|---------------|
-| Quick | `har env verify <id>` or `verify.sh <id>` | Project checks in `verify.sh` (stops early on failure) |
-| Full | `har env verify <id> --full` or `verify.sh <id> --full` | Quick steps + lint + optional readiness smoke + **`browser-e2e`** when `.har/stages/browser-e2e.sh` exists |
+| Quick | `har env verify <id>` or `verify.sh <id>` | Stock ecosystem smoke + health (stops early on failure) |
+| Full | `har env verify <id> --full` or `verify.sh <id> --full` | Stock conventional tests/lint, optional readiness smoke + **`browser-e2e`** when `.har/stages/browser-e2e.sh` exists |
+
+The stock commands are deliberately generic conventions keyed by
+`HARNESS_ECOSYSTEM`. Replace them with the repository's real commands during
+adaptation; do not leave Node/npm, Python, Go, Rust, Java, or Ruby defaults in
+place when they do not match the project.
 
 Install Playwright stage: `har env add-stage playwright` (optional). UI changes should add or update specs under `tests/`.
 

package/dist/templates/har-boilerplate/ecosystem.agent.template.cjs

@@ -23,6 +23,8 @@ module.exports = {
     // .har/ecosystem.shared.config.cjs (started by setup-infra.sh, processes
     // named "har-shared-<name>", fixed ports). A primary app may still need two
     // processes (e.g. api + frontend) — add one entry per process.
+    // Example Node dev process. Replace with this repo's actual primary app
+    // command (Rails, Django, Go, Java, etc. should not keep this npm entry).
     {
       name: 'agent-${AGENT_ID}-api',
       script: 'npm',

package/dist/templates/har-boilerplate/env.template

@@ -32,6 +32,9 @@ S3_FORCE_PATH_STYLE=true
 # Headless browser (if enabled)
 HEADLESS_BROWSER_URL=http://localhost:${BROWSER_PORT}
 
+# Toolchain paths — appended by provision-toolchain.sh during launch
+# NODE_BIN=  NPM_BIN=  PYTHON_BIN=  VIRTUAL_ENV=  GO_BIN=  CARGO_BIN=  JAVA_HOME=
+
 # Mail (if enabled)
 SMTP_HOST=localhost
 SMTP_PORT=11025

package/dist/templates/har-boilerplate/harness.env

@@ -19,6 +19,11 @@ export HARNESS_HEALTH_CHECK_PATH=/health
 export HARNESS_AGENT_SLOT_MIN=1
 export HARNESS_AGENT_SLOT_MAX=5
 
+# Toolchain provisioning — launch writes resolved paths into .env.agent.<id>
+# Ecosystem: auto (detect from manifests) | node | python | go | rust | java | ruby | none
+export HARNESS_ECOSYSTEM="auto"
+# export HARNESS_INSTALL_CMD="make deps"
+
 # Shared infrastructure — space-separated docker compose service names from
 # docker-compose.agent.yml. Started ONCE by setup-infra.sh and shared by all
 # agent slots on fixed ports. Prune/add services in the compose file, then

package/dist/templates/har-boilerplate/launch.sh

@@ -110,26 +110,12 @@ else
   log "Using repo root (worktree disabled)"
 fi
 
-# Install dependencies (fresh worktrees have no node_modules — PM2 config needs them at load time)
-if [ -f "$WORK_DIR/package.json" ] && [ ! -d "$WORK_DIR/node_modules" ]; then
-  log "Installing dependencies in $WORK_DIR..."
-  (cd "$WORK_DIR" && npm install --silent)
-elif [ -f "$WORK_DIR/go.mod" ] && [ ! -d "$WORK_DIR/vendor" ]; then
-  log "Go module detected in work dir (run go mod download if needed)"
-fi
-
-# Monorepo: file:/workspace deps may resolve modules from the repo root — install there too
-if [ -n "${REL_PREFIX:-}" ] && [ -f "$WORKTREE_DIR/package.json" ] && [ ! -d "$WORKTREE_DIR/node_modules" ]; then
-  log "Installing monorepo root dependencies in $WORKTREE_DIR..."
-  (cd "$WORKTREE_DIR" && npm install --silent)
-fi
-
 # Generate .env.agent.N
 # Keep harness-generated files out of accidental `git add -A` commits in repos
 # whose .gitignore doesn't know about har (applies to all worktrees too).
 GIT_EXCLUDE="$(git -C "$REPO_ROOT" rev-parse --git-common-dir 2>/dev/null)/info/exclude"
 if [ -n "$GIT_EXCLUDE" ] && [ -d "$(dirname "$GIT_EXCLUDE")" ]; then
-  for pattern in '.env.agent.*' 'ecosystem.agent.*.config.cjs'; do
+  for pattern in '.env.agent.*' 'ecosystem.agent.*.config.cjs' '.har/venv'; do
     grep -qxF "$pattern" "$GIT_EXCLUDE" 2>/dev/null || echo "$pattern" >> "$GIT_EXCLUDE"
   done
 fi
@@ -191,6 +177,14 @@ SLOT_STATUS="starting" \
   write_slot_registry
 REGISTRY_WRITTEN=true
 
+log "Provisioning toolchain (see harness.env: HARNESS_ECOSYSTEM, HARNESS_INSTALL_CMD)..."
+HAR_WORK_DIR="$WORK_DIR" \
+HAR_ENV_FILE="$ENV_FILE" \
+HAR_WORKTREE_DIR="${WORKTREE_DIR:-}" \
+HAR_REL_PREFIX="${REL_PREFIX:-}" \
+HAR_AGENT_ID="$AGENT_ID" \
+  "$SCRIPT_DIR/provision-toolchain.sh"
+
 if [ -n "${HARNESS_DB_MINIMAL_BOOTSTRAP_CMD:-}" ]; then
   log "Running minimal data bootstrap..."
   (cd "$WORK_DIR" && set -a && . "$ENV_FILE" && set +a && eval "$HARNESS_DB_MINIMAL_BOOTSTRAP_CMD")

package/dist/templates/har-boilerplate/provision-toolchain.sh

@@ -0,0 +1,285 @@
+#!/usr/bin/env bash
+# Provision the project toolchain and append resolved paths to .env.agent.<id>.
+# Called from launch.sh after the agent env file is created.
+#
+# Configure in harness.env:
+#   HARNESS_ECOSYSTEM   — auto (default) | node | python | go | rust | java | ruby | ios | none
+#   HARNESS_INSTALL_CMD — optional override (eval in HAR_WORK_DIR)
+# Ecosystem-specific optional overrides:
+#   HARNESS_PYTHON_VENV_DIR — Python venv path relative to HAR_WORK_DIR (default: .har/venv)
+#
+# Required env from caller: HAR_WORK_DIR, HAR_ENV_FILE
+# Optional: HAR_WORKTREE_DIR, HAR_REL_PREFIX, HAR_AGENT_ID (for logging)
+set -euo pipefail
+
+: "${HAR_WORK_DIR:?HAR_WORK_DIR is required}"
+: "${HAR_ENV_FILE:?HAR_ENV_FILE is required}"
+
+HAR_WORKTREE_DIR="${HAR_WORKTREE_DIR:-}"
+HAR_REL_PREFIX="${HAR_REL_PREFIX:-}"
+HAR_AGENT_ID="${HAR_AGENT_ID:-}"
+
+pt_log() {
+  if [ -n "$HAR_AGENT_ID" ]; then
+    echo "==> [agent-${HAR_AGENT_ID}] toolchain: $*" >&2
+  else
+    echo "==> [provision-toolchain] $*" >&2
+  fi
+}
+
+append_env() {
+  local key="$1"
+  local value="$2"
+  printf '%s=%s\n' "$key" "$value" >> "$HAR_ENV_FILE"
+}
+
+append_path_prefix() {
+  local prefix="$1"
+  [ -n "$prefix" ] && [ -d "$prefix" ] || return 0
+  append_env "PATH" "${prefix}:${PATH:-$PATH}"
+}
+
+detect_ecosystem() {
+  local dir="$1"
+  local configured="${HARNESS_ECOSYSTEM:-auto}"
+  if [ -n "$configured" ] && [ "$configured" != "auto" ]; then
+    echo "$configured"
+    return
+  fi
+  if [ -f "$dir/package.json" ]; then echo node; return; fi
+  if [ -f "$dir/pyproject.toml" ] || [ -f "$dir/setup.py" ] || [ -f "$dir/setup.cfg" ] \
+    || [ -f "$dir/requirements.txt" ] || [ -f "$dir/Pipfile" ]; then
+    echo python
+    return
+  fi
+  if [ -f "$dir/go.mod" ]; then echo go; return; fi
+  if [ -f "$dir/Cargo.toml" ]; then echo rust; return; fi
+  if [ -f "$dir/pom.xml" ] || [ -f "$dir/build.gradle" ] || [ -f "$dir/build.gradle.kts" ]; then
+    echo java
+    return
+  fi
+  if [ -f "$dir/Gemfile" ]; then echo ruby; return; fi
+  if [ -n "${HARNESS_XCODE_SCHEME:-}" ] || [ -n "${HARNESS_XCODE_PROJECT:-}" ] \
+    || [ -n "${HARNESS_XCODE_WORKSPACE:-}" ]; then
+    echo ios
+    return
+  fi
+  echo none
+}
+
+run_install_cmd() {
+  local dir="$1"
+  if [ -n "${HARNESS_INSTALL_CMD:-}" ]; then
+    pt_log "Running HARNESS_INSTALL_CMD..."
+    (cd "$dir" && eval "$HARNESS_INSTALL_CMD")
+    return
+  fi
+  return 1
+}
+
+provision_node() {
+  local dir="$1"
+  local npm_bin="npm"
+  local node_bin="node"
+
+  if ! run_install_cmd "$dir"; then
+    pt_log "Installing Node dependencies..."
+    if [ -f "$dir/pnpm-lock.yaml" ] && command -v pnpm >/dev/null 2>&1; then
+      (cd "$dir" && pnpm install --silent)
+      npm_bin="pnpm"
+    elif [ -f "$dir/yarn.lock" ] && command -v yarn >/dev/null 2>&1; then
+      (cd "$dir" && yarn install --silent)
+      npm_bin="yarn"
+    else
+      (cd "$dir" && npm install --silent)
+    fi
+  fi
+
+  if command -v node >/dev/null 2>&1; then
+    node_bin="$(command -v node)"
+  fi
+  if [ "$npm_bin" = "npm" ] && command -v npm >/dev/null 2>&1; then
+    npm_bin="$(command -v npm)"
+  fi
+
+  append_env "HARNESS_ECOSYSTEM" "node"
+  append_env "NODE_BIN" "$node_bin"
+  append_env "NPM_BIN" "$npm_bin"
+  append_path_prefix "$dir/node_modules/.bin"
+}
+
+provision_python() {
+  local dir="$1"
+  local venv_rel="${HARNESS_PYTHON_VENV_DIR:-.har/venv}"
+  local venv_dir="$dir/$venv_rel"
+  local python_bin="python3"
+
+  if ! command -v python3 >/dev/null 2>&1; then
+    pt_log "python3 not found on PATH — skipping venv provisioning"
+    append_env "HARNESS_ECOSYSTEM" "python"
+    append_env "PYTHON_BIN" "${PYTHON_BIN:-python3}"
+    return
+  fi
+
+  if [ ! -d "$venv_dir" ]; then
+    pt_log "Creating Python venv at $venv_rel..."
+    if ! python3 -m venv "$venv_dir"; then
+      rm -rf "$venv_dir"
+      pt_log "python3 -m venv failed (on Debian/Ubuntu install python3-venv) — using system python3"
+      append_env "HARNESS_ECOSYSTEM" "python"
+      append_env "PYTHON_BIN" "$(command -v python3)"
+      return
+    fi
+  fi
+
+  if [ ! -x "$venv_dir/bin/python" ]; then
+    pt_log "Python venv at $venv_rel is missing or broken — using system python3"
+    append_env "HARNESS_ECOSYSTEM" "python"
+    append_env "PYTHON_BIN" "$(command -v python3)"
+    return
+  fi
+
+  python_bin="$venv_dir/bin/python"
+  # shellcheck disable=SC1091
+  source "$venv_dir/bin/activate"
+
+  if ! run_install_cmd "$dir"; then
+    pt_log "Installing Python dependencies..."
+    if [ -f "$dir/pyproject.toml" ]; then
+      (cd "$dir" && pip install -q -e ".[dev]" 2>/dev/null) || (cd "$dir" && pip install -q -e .)
+    elif [ -f "$dir/requirements.txt" ]; then
+      (cd "$dir" && pip install -q -r requirements.txt)
+    elif [ -f "$dir/setup.py" ] || [ -f "$dir/setup.cfg" ]; then
+      (cd "$dir" && pip install -q -e .)
+    elif [ -f "$dir/Pipfile" ] && command -v pipenv >/dev/null 2>&1; then
+      (cd "$dir" && pipenv install --dev)
+      python_bin="$(cd "$dir" && pipenv --py)"
+    fi
+  fi
+
+  append_env "HARNESS_ECOSYSTEM" "python"
+  append_env "PYTHON_BIN" "$python_bin"
+  append_env "VIRTUAL_ENV" "$venv_dir"
+  append_path_prefix "$venv_dir/bin"
+}
+
+provision_go() {
+  local dir="$1"
+  if ! run_install_cmd "$dir"; then
+    if command -v go >/dev/null 2>&1; then
+      pt_log "Downloading Go modules..."
+      (cd "$dir" && go mod download)
+    else
+      pt_log "go not found on PATH — record paths only"
+    fi
+  fi
+  append_env "HARNESS_ECOSYSTEM" "go"
+  append_env "GO_BIN" "$(command -v go 2>/dev/null || echo go)"
+  if [ -n "${GOPATH:-}" ]; then append_env "GOPATH" "$GOPATH"; fi
+  if [ -n "${GOROOT:-}" ]; then append_env "GOROOT" "$GOROOT"; fi
+}
+
+provision_rust() {
+  local dir="$1"
+  if ! run_install_cmd "$dir"; then
+    if command -v cargo >/dev/null 2>&1; then
+      pt_log "Fetching Rust dependencies..."
+      (cd "$dir" && cargo fetch)
+    else
+      pt_log "cargo not found on PATH — record paths only"
+    fi
+  fi
+  append_env "HARNESS_ECOSYSTEM" "rust"
+  append_env "CARGO_BIN" "$(command -v cargo 2>/dev/null || echo cargo)"
+  append_env "RUSTC_BIN" "$(command -v rustc 2>/dev/null || echo rustc)"
+}
+
+provision_java() {
+  local dir="$1"
+  run_install_cmd "$dir" || true
+  append_env "HARNESS_ECOSYSTEM" "java"
+  if [ -n "${JAVA_HOME:-}" ]; then
+    append_env "JAVA_HOME" "$JAVA_HOME"
+    append_path_prefix "$JAVA_HOME/bin"
+  fi
+  if command -v mvn >/dev/null 2>&1; then
+    append_env "MVN_BIN" "$(command -v mvn)"
+  elif [ -f "$dir/gradlew" ]; then
+    append_env "GRADLE_BIN" "$dir/gradlew"
+  elif command -v gradle >/dev/null 2>&1; then
+    append_env "GRADLE_BIN" "$(command -v gradle)"
+  fi
+}
+
+provision_ruby() {
+  local dir="$1"
+  if ! run_install_cmd "$dir"; then
+    if command -v bundle >/dev/null 2>&1; then
+      pt_log "Installing Ruby gems..."
+      (cd "$dir" && bundle install --quiet)
+    else
+      pt_log "bundle not found on PATH — record paths only"
+    fi
+  fi
+  append_env "HARNESS_ECOSYSTEM" "ruby"
+  append_env "RUBY_BIN" "$(command -v ruby 2>/dev/null || echo ruby)"
+  append_env "BUNDLE_BIN" "$(command -v bundle 2>/dev/null || echo bundle)"
+  append_path_prefix "$dir/vendor/bundle/bin"
+}
+
+provision_ios() {
+  local dir="$1"
+  run_install_cmd "$dir" || true
+  append_env "HARNESS_ECOSYSTEM" "ios"
+  append_env "XCODEBUILD_BIN" "$(command -v xcodebuild 2>/dev/null || echo xcodebuild)"
+  if [ -n "${HARNESS_XCODE_SCHEME:-}" ]; then
+    append_env "HARNESS_XCODE_SCHEME" "$HARNESS_XCODE_SCHEME"
+  fi
+  if [ -n "${HARNESS_SIMULATOR_NAME:-}" ]; then
+    append_env "HARNESS_SIMULATOR_NAME" "$HARNESS_SIMULATOR_NAME"
+  fi
+  if [ -n "${HARNESS_BUNDLE_ID:-}" ]; then
+    append_env "HARNESS_BUNDLE_ID" "$HARNESS_BUNDLE_ID"
+  fi
+  if [ -n "${DEVELOPER_DIR:-}" ]; then
+    append_env "DEVELOPER_DIR" "$DEVELOPER_DIR"
+  fi
+}
+
+provision_monorepo_root() {
+  [ -n "$HAR_REL_PREFIX" ] || return 0
+  [ -n "$HAR_WORKTREE_DIR" ] || return 0
+  [ -f "$HAR_WORKTREE_DIR/package.json" ] || return 0
+  [ -d "$HAR_WORKTREE_DIR/node_modules" ] && return 0
+  pt_log "Installing monorepo root dependencies in $HAR_WORKTREE_DIR..."
+  (cd "$HAR_WORKTREE_DIR" && npm install --silent)
+}
+
+provision_ecosystem() {
+  local dir="$1"
+  local ecosystem
+  ecosystem="$(detect_ecosystem "$dir")"
+  pt_log "Toolchain ecosystem: ${ecosystem} (work dir: ${dir})"
+
+  case "$ecosystem" in
+    node) provision_node "$dir" ;;
+    python) provision_python "$dir" ;;
+    go) provision_go "$dir" ;;
+    rust) provision_rust "$dir" ;;
+    java) provision_java "$dir" ;;
+    ruby) provision_ruby "$dir" ;;
+    ios) provision_ios "$dir" ;;
+    none)
+      if run_install_cmd "$dir"; then
+        append_env "HARNESS_ECOSYSTEM" "custom"
+      else
+        pt_log "No ecosystem manifest detected — set HARNESS_ECOSYSTEM or HARNESS_INSTALL_CMD in harness.env"
+        append_env "HARNESS_ECOSYSTEM" "none"
+      fi
+      ;;
+  esac
+}
+
+append_env "HARNESS_TOOLCHAIN_PROVISIONED" "true"
+provision_ecosystem "$HAR_WORK_DIR"
+provision_monorepo_root