@osfactory/har 0.53.0 → 0.54.1

package/dist/index.js

@@ -69193,7 +69193,7 @@ function harnessExists(repoPath) {
 // src/harness/plugins.ts
 init_schema2();
 init_stages();
-var PLUGIN_IDS = ["playwright", "rocketsim", "kerno", "gitleaks", "trivy"];
+var PLUGIN_IDS = ["playwright", "rocketsim", "kerno", "gitleaks", "trivy", "semgrep"];
 var PluginManifestFileSchema = external_exports.object({
   src: external_exports.string().min(1),
   dest: external_exports.string().min(1),
@@ -70294,7 +70294,7 @@ var ADAPTATION_PROMPT_FILE = "ADAPT-PROMPT.md";
 var PROFILE_HINTS = {
   default: "Web app profile (SaaS/full-stack) \u2014 Docker Compose for shared infra (HARNESS_INFRA_SERVICES), PM2 for the primary application only, git worktree per agent slot by default. Launch provisions toolchain via harness.env (HARNESS_ECOSYSTEM, HARNESS_INSTALL_CMD) and writes paths to .env.agent.<id>. Identify the primary app agents modify; run supporting services shared.",
   cli: "CLI/library profile (typical SWE-bench) \u2014 no PM2. Optional Docker Compose via HARNESS_INFRA_SERVICES. Git worktree by default. Launch provisions toolchain declaratively (HARNESS_ECOSYSTEM auto-detects common ecosystems); verify must use resolved tool paths from .env.agent.<id>, never hardcoded interpreter or package-manager paths.",
-  ios: "iOS mobile app profile \u2014 xcodebuild + iOS Simulator in an isolated git worktree. Set HARNESS_XCODE_SCHEME, workspace/project, HARNESS_SIMULATOR_NAME, HARNESS_BUNDLE_ID. Launch writes XCODEBUILD_BIN to .env.agent.<id>; verify uses it. Install RocketSim plugin (har env add-plugin rocketsim) for user-flow validation."
+  ios: "iOS mobile app profile \u2014 xcodebuild + iOS Simulator in an isolated git worktree. Set HARNESS_XCODE_SCHEME, workspace/project, HARNESS_SIMULATOR_NAME, HARNESS_BUNDLE_ID. Launch writes XCODEBUILD_BIN to .env.agent.<id>; verify uses it."
 };
 function loadTemplate(name) {
   const filePath = resolveTemplateFile(name);

package/dist/templates/har-boilerplate/STAGES.md

@@ -1,7 +1,7 @@
 # HAR Stages — authoring guide
 
 Stages are the harness's single vocabulary for runnable checks and lifecycle
-actions. Everything — shipped plugins (`playwright`, `rocketsim`, `kerno`, `gitleaks`, `trivy`), your
+actions. Everything — shipped plugins (`playwright`, `rocketsim`, `kerno`, `gitleaks`, `trivy`, `semgrep`), your
 project's test/lint commands, bespoke validation scripts — registers in
 `.har/stages.json` with the same schema, and agents interact with stages only
 through that registry (CLI `har env verify`, MCP `har_run_stage` /
@@ -92,7 +92,8 @@ committed.
 `har env add-plugin --list` shows available plugins; `har env add-plugin
 playwright` (web), `har env add-plugin rocketsim` (iOS), or `har env
 add-plugin kerno` (backend), `har env add-plugin gitleaks` (secrets scanning, any
-stack), or `har env add-plugin trivy` (dependency + IaC security scan, any stack)
+stack), or `har env add-plugin trivy` (dependency + IaC security scan, any stack),
+or `har env add-plugin semgrep` (SAST, any stack)
 installs one. A
 plugin is just packaging: it copies files, merges `package.json` fragments,
 and registers stages through the exact same registry as `add-stage --custom`.

package/dist/templates/har-boilerplate/agent-slot.sh

@@ -445,6 +445,35 @@ try {
 #   optional: SLOT_SUFFIX, SLOT_WORKTREE_PATH, SLOT_BRANCH, SLOT_BASE_BRANCH,
 #             SLOT_BASE_COMMIT, SLOT_PORTS_JSON, SLOT_PREVIEW_URLS_JSON,
 #             SLOT_STATUS, SLOT_LAST_ERROR, SLOT_WORK_UNIT_ID, SLOT_ATTEMPT_ID
+# Mission Control re-reads slot state only when something syncs, and a sync takes
+# about twenty seconds — too long to make a slot change wait for it. Detached, and
+# coalesced so a run of slot changes leaves one sync going, then one more if needed.
+har_notify_control() {
+  local root bin lock
+  root="$(cd "${SCRIPT_DIR}/.." && pwd)"
+  bin="$(command -v har 2>/dev/null || echo "${root}/node_modules/.bin/har")"
+  [ -x "$bin" ] || return 0
+
+  lock="${TMPDIR:-/tmp}/har-control-sync.$(id -u)"
+  : > "${lock}.pending"
+  mkdir "$lock" 2>/dev/null || return 0
+  (
+    trap "" HUP
+    trap 'rmdir "$lock" 2>/dev/null || true' EXIT
+    cd "$root" || exit 0
+    while [ -f "${lock}.pending" ]; do
+      rm -f "${lock}.pending"
+      if command -v timeout >/dev/null 2>&1; then
+        timeout 120 "$bin" control sync || true
+      else
+        "$bin" control sync || true
+      fi
+    done
+  # Redirected as a whole, not per command: a background job that keeps the inherited
+  # stdout open makes any caller reading that pipe wait for it.
+  ) >/dev/null 2>&1 &
+}
+
 write_slot_registry() {
   local file
   file="$(slot_registry_file "$SLOT_AGENT_ID")"
@@ -474,10 +503,12 @@ for (const [key, env] of [["ports", "SLOT_PORTS_JSON"], ["previewUrls", "SLOT_PR
 }
 fs.writeFileSync(process.argv[1], JSON.stringify(entry, null, 2) + "\n");
 ' "$file"
+  har_notify_control
 }
 
 remove_slot_registry() {
   rm -f "$(slot_registry_file "$1")"
+  har_notify_control
 }
 
 # Exit 0 when the worktree has uncommitted or untracked changes.

package/dist/templates/har-boilerplate-cli/STAGES.md

@@ -1,7 +1,7 @@
 # HAR Stages — authoring guide
 
 Stages are the harness's single vocabulary for runnable checks and lifecycle
-actions. Everything — shipped plugins (`playwright`, `rocketsim`, `kerno`, `gitleaks`, `trivy`), your
+actions. Everything — shipped plugins (`playwright`, `rocketsim`, `kerno`, `gitleaks`, `trivy`, `semgrep`), your
 project's test/lint commands, bespoke validation scripts — registers in
 `.har/stages.json` with the same schema, and agents interact with stages only
 through that registry (CLI `har env verify`, MCP `har_run_stage` /
@@ -92,7 +92,8 @@ committed.
 `har env add-plugin --list` shows available plugins; `har env add-plugin
 playwright` (web), `har env add-plugin rocketsim` (iOS), or `har env
 add-plugin kerno` (backend), `har env add-plugin gitleaks` (secrets scanning, any
-stack), or `har env add-plugin trivy` (dependency + IaC security scan, any stack)
+stack), or `har env add-plugin trivy` (dependency + IaC security scan, any stack),
+or `har env add-plugin semgrep` (SAST, any stack)
 installs one. A
 plugin is just packaging: it copies files, merges `package.json` fragments,
 and registers stages through the exact same registry as `add-stage --custom`.

package/dist/templates/har-boilerplate-cli/agent-slot.sh

@@ -427,6 +427,35 @@ try {
 #   optional: SLOT_SUFFIX, SLOT_WORKTREE_PATH, SLOT_BRANCH, SLOT_BASE_BRANCH,
 #             SLOT_BASE_COMMIT, SLOT_PORTS_JSON, SLOT_PREVIEW_URLS_JSON,
 #             SLOT_STATUS, SLOT_LAST_ERROR, SLOT_WORK_UNIT_ID, SLOT_ATTEMPT_ID
+# Mission Control re-reads slot state only when something syncs, and a sync takes
+# about twenty seconds — too long to make a slot change wait for it. Detached, and
+# coalesced so a run of slot changes leaves one sync going, then one more if needed.
+har_notify_control() {
+  local root bin lock
+  root="$(cd "${SCRIPT_DIR}/.." && pwd)"
+  bin="$(command -v har 2>/dev/null || echo "${root}/node_modules/.bin/har")"
+  [ -x "$bin" ] || return 0
+
+  lock="${TMPDIR:-/tmp}/har-control-sync.$(id -u)"
+  : > "${lock}.pending"
+  mkdir "$lock" 2>/dev/null || return 0
+  (
+    trap "" HUP
+    trap 'rmdir "$lock" 2>/dev/null || true' EXIT
+    cd "$root" || exit 0
+    while [ -f "${lock}.pending" ]; do
+      rm -f "${lock}.pending"
+      if command -v timeout >/dev/null 2>&1; then
+        timeout 120 "$bin" control sync || true
+      else
+        "$bin" control sync || true
+      fi
+    done
+  # Redirected as a whole, not per command: a background job that keeps the inherited
+  # stdout open makes any caller reading that pipe wait for it.
+  ) >/dev/null 2>&1 &
+}
+
 write_slot_registry() {
   local file
   file="$(slot_registry_file "$SLOT_AGENT_ID")"
@@ -456,10 +485,12 @@ for (const [key, env] of [["ports", "SLOT_PORTS_JSON"], ["previewUrls", "SLOT_PR
 }
 fs.writeFileSync(process.argv[1], JSON.stringify(entry, null, 2) + "\n");
 ' "$file"
+  har_notify_control
 }
 
 remove_slot_registry() {
   rm -f "$(slot_registry_file "$1")"
+  har_notify_control
 }
 
 # Exit 0 when the worktree has uncommitted or untracked changes.

package/dist/templates/har-boilerplate-ios/README.md

@@ -109,6 +109,24 @@ launch fails and lists the models this machine can create.
 If `HARNESS_SIMULATOR_NAME` is not a model but names an existing device, that
 device is used as-is and never deleted — how a hand-renamed simulator is targeted.
 
+### Running from an agent sandbox
+
+`xcrun simctl` reaches CoreSimulatorService over XPC. Coding agents that sandbox
+their shell (Codex, Claude Code and others) usually deny that lookup, so `simctl`
+fails while `xcodebuild` keeps working — every simulator command then dies with
+`CoreSimulatorService connection became invalid`. Nothing is missing on the machine.
+
+Launch and teardown say so when it happens. Either run `har env launch <id>` and
+`har env teardown <id>` from a normal terminal and let the agent work in the
+worktree, or grant the agent unsandboxed access to `xcrun simctl` — the escalation
+must cover every subcommand the harness uses (`list`, `create`, `boot`,
+`bootstatus`, `shutdown`, `delete`), not just `list`.
+
+The same messages distinguish a second cause: if `xcrun simctl` is missing from
+the selected developer directory — no Xcode, or `xcode-select` pointing at the
+Command Line Tools — they say so and print the current selection instead of
+blaming a sandbox.
+
 The device lands in `.env.agent.<id>` as `HARNESS_SIMULATOR_UDID`,
 `HARNESS_SIMULATOR_DEVICE_NAME` and `HARNESS_IOS_DESTINATION` — the model stays in
 `HARNESS_SIMULATOR_NAME`, so the two never mean the same thing in one place; what a slot holds is tracked in `.har/simulators/`.

package/dist/templates/har-boilerplate-ios/STAGES.md

@@ -1,7 +1,7 @@
 # HAR Stages — authoring guide
 
 Stages are the harness's single vocabulary for runnable checks and lifecycle
-actions. Everything — shipped plugins (`playwright`, `rocketsim`, `kerno`, `gitleaks`, `trivy`), your
+actions. Everything — shipped plugins (`playwright`, `rocketsim`, `kerno`, `gitleaks`, `trivy`, `semgrep`), your
 project's test/lint commands, bespoke validation scripts — registers in
 `.har/stages.json` with the same schema, and agents interact with stages only
 through that registry (CLI `har env verify`, MCP `har_run_stage` /
@@ -92,7 +92,8 @@ committed.
 `har env add-plugin --list` shows available plugins; `har env add-plugin
 playwright` (web), `har env add-plugin rocketsim` (iOS), or `har env
 add-plugin kerno` (backend), `har env add-plugin gitleaks` (secrets scanning, any
-stack), or `har env add-plugin trivy` (dependency + IaC security scan, any stack)
+stack), or `har env add-plugin trivy` (dependency + IaC security scan, any stack),
+or `har env add-plugin semgrep` (SAST, any stack)
 installs one. A
 plugin is just packaging: it copies files, merges `package.json` fragments,
 and registers stages through the exact same registry as `add-stage --custom`.

package/dist/templates/har-boilerplate-ios/agent-slot.sh

@@ -95,6 +95,35 @@ try {
 #   optional: SLOT_SUFFIX, SLOT_WORKTREE_PATH, SLOT_BRANCH, SLOT_BASE_BRANCH,
 #             SLOT_BASE_COMMIT, SLOT_PORTS_JSON, SLOT_PREVIEW_URLS_JSON,
 #             SLOT_STATUS, SLOT_LAST_ERROR, SLOT_WORK_UNIT_ID, SLOT_ATTEMPT_ID
+# Mission Control re-reads slot state only when something syncs, and a sync takes
+# about twenty seconds — too long to make a slot change wait for it. Detached, and
+# coalesced so a run of slot changes leaves one sync going, then one more if needed.
+har_notify_control() {
+  local root bin lock
+  root="$(cd "${SCRIPT_DIR}/.." && pwd)"
+  bin="$(command -v har 2>/dev/null || echo "${root}/node_modules/.bin/har")"
+  [ -x "$bin" ] || return 0
+
+  lock="${TMPDIR:-/tmp}/har-control-sync.$(id -u)"
+  : > "${lock}.pending"
+  mkdir "$lock" 2>/dev/null || return 0
+  (
+    trap "" HUP
+    trap 'rmdir "$lock" 2>/dev/null || true' EXIT
+    cd "$root" || exit 0
+    while [ -f "${lock}.pending" ]; do
+      rm -f "${lock}.pending"
+      if command -v timeout >/dev/null 2>&1; then
+        timeout 120 "$bin" control sync || true
+      else
+        "$bin" control sync || true
+      fi
+    done
+  # Redirected as a whole, not per command: a background job that keeps the inherited
+  # stdout open makes any caller reading that pipe wait for it.
+  ) >/dev/null 2>&1 &
+}
+
 write_slot_registry() {
   local file
   file="$(slot_registry_file "$SLOT_AGENT_ID")"
@@ -124,10 +153,12 @@ for (const [key, env] of [["ports", "SLOT_PORTS_JSON"], ["previewUrls", "SLOT_PR
 }
 fs.writeFileSync(process.argv[1], JSON.stringify(entry, null, 2) + "\n");
 ' "$file"
+  har_notify_control
 }
 
 remove_slot_registry() {
   rm -f "$(slot_registry_file "$1")"
+  har_notify_control
 }
 
 # Exit 0 when the worktree has uncommitted or untracked changes.

package/dist/templates/har-boilerplate-ios/setup-infra.sh

@@ -19,6 +19,14 @@ source "$SCRIPT_DIR/simulator.sh"
 
 log() { echo "==> $*" >&2; }
 
+# simctl could not be asked, so nothing it did not return is evidence of anything
+# missing on this machine. The wording lives in simulator.sh so launch and this
+# script cannot drift apart on which of the two causes they name.
+fail_simctl_unavailable() {
+  har_sim_log_simctl_unavailable
+  exit 1
+}
+
 # ── Xcode check ───────────────────────────────────────────────────────────────
 if ! command -v xcodebuild >/dev/null 2>&1; then
   echo "Error: xcodebuild not found — install Xcode from the App Store." >&2
@@ -40,6 +48,8 @@ if har_sim_per_slot_enabled; then
   PLAN_STATUS="${PLAN%%$'\t'*}"
   if [ "$PLAN_STATUS" = "OK" ]; then
     log "Per-slot simulators: launch creates one $(printf '%s' "$PLAN" | cut -f3) per agent."
+  elif [ "$PLAN_STATUS" = "SIMCTL_UNAVAILABLE" ]; then
+    fail_simctl_unavailable
   elif [ "$PLAN_STATUS" = "NO_MODEL" ] && [ -n "$(har_sim_device_by_name "${HARNESS_SIMULATOR_NAME:-}")" ]; then
     # Supported fallback: the name is an existing device rather than a model.
     log "Per-slot simulators: launch reuses the existing device '${SIMULATOR_NAME}'."
@@ -63,6 +73,7 @@ else
   UDID="${RESOLVED%%$'\t'*}"
 
   if [ -z "$UDID" ]; then
+    har_sim_simctl_available || fail_simctl_unavailable
     echo "Error: Simulator '${SIMULATOR_NAME}' not found in available devices." >&2
     echo "  Available simulators:" >&2
     xcrun simctl list devices available 2>/dev/null | grep -E 'iPhone|iPad' | head -20 >&2

package/dist/templates/har-boilerplate-ios/simulator.sh

@@ -108,10 +108,25 @@ har_sim_claim_owner_of() {
 
 # ── Device discovery ──────────────────────────────────────────────────────────
 
+# Every simctl call goes through here, so "simctl could not be asked" stays
+# distinguishable from "simctl answered, and the answer is empty" at the one place
+# that still knows the difference. Non-zero means the first; callers check it
+# instead of reading an empty list as a fact about the machine.
+har_sim_simctl() {
+  local out rc=0
+  out="$(xcrun simctl "$@" 2>/dev/null)" || rc=$?
+  if [ "$rc" -ne 0 ] || [ -z "$out" ]; then
+    return 1
+  fi
+  printf '%s' "$out"
+}
+
 # Unavailable devices are skipped: a device whose runtime was uninstalled must
 # not pass validation only to fail at boot.
 har_sim_device_field() {
-  xcrun simctl list devices --json 2>/dev/null | node -e '
+  local devices
+  devices="$(har_sim_simctl list devices --json)" || return 1
+  printf '%s' "$devices" | node -e '
 const data = JSON.parse(require("fs").readFileSync(0, "utf8"));
 const [want, field] = process.argv.slice(1);
 const device = Object.values(data.devices || {})
@@ -128,9 +143,10 @@ har_sim_device_name() { har_sim_device_field "$1" name; }
 # UDID of an existing device with this exact name, newest runtime first.
 # A substring match would resolve "iPhone 16" to "iPhone 16 Pro Max".
 har_sim_device_by_name() {
-  local want="${1:-}"
+  local want="${1:-}" devices
   [ -n "$want" ] || return 0
-  xcrun simctl list devices available --json 2>/dev/null | node -e '
+  devices="$(har_sim_simctl list devices available --json)" || return 1
+  printf '%s' "$devices" | node -e '
 const data = JSON.parse(require("fs").readFileSync(0, "utf8"));
 const want = process.argv[1];
 const rows = [];
@@ -157,22 +173,66 @@ har_sim_resolve_configured() {
   printf '%s\t%s' "$udid" "${HARNESS_SIMULATOR_NAME}"
 }
 
-# `simctl list` is a subprocess and a JSON parse; neither answer changes during
-# a launch, so each is fetched at most once per process.
+# `simctl list` is a subprocess and a JSON parse, so each answer is cached — but in
+# the calling shell, not the process: `$(har_sim_runtimes_json)` fetches, then throws
+# the cache and the availability flag away with the subshell that held them. Call
+# these directly and read the variable whenever either one matters.
 har_sim_devicetypes_json() {
   if [ -z "${_HAR_SIM_TYPES_JSON:-}" ]; then
-    _HAR_SIM_TYPES_JSON="$(xcrun simctl list devicetypes --json 2>/dev/null || echo '{}')"
+    _HAR_SIM_TYPES_JSON="$(har_sim_simctl list devicetypes --json)" || _HAR_SIM_TYPES_JSON='{}'
   fi
   printf '%s' "$_HAR_SIM_TYPES_JSON"
 }
 
 har_sim_runtimes_json() {
   if [ -z "${_HAR_SIM_RUNTIMES_JSON:-}" ]; then
-    _HAR_SIM_RUNTIMES_JSON="$(xcrun simctl list runtimes --json 2>/dev/null || echo '{}')"
+    if _HAR_SIM_RUNTIMES_JSON="$(har_sim_simctl list runtimes --json)"; then
+      _HAR_SIM_SIMCTL_OK=true
+    else
+      _HAR_SIM_RUNTIMES_JSON='{}'
+      _HAR_SIM_SIMCTL_OK=false
+      # A second call, but only ever when simctl is already failing — and failing
+      # is the fast path. Its stderr is the only thing that tells the causes apart.
+      _HAR_SIM_SIMCTL_ERROR="$(xcrun simctl list runtimes --json 2>&1 >/dev/null || true)"
+    fi
   fi
   printf '%s' "$_HAR_SIM_RUNTIMES_JSON"
 }
 
+# Ask simctl once, recording in this shell whether it answered and why not.
+har_sim_probe_simctl() {
+  har_sim_runtimes_json >/dev/null
+}
+
+har_sim_simctl_available() {
+  har_sim_probe_simctl
+  [ "${_HAR_SIM_SIMCTL_OK:-true}" = "true" ]
+}
+
+# Two unrelated problems make simctl unusable — a sandbox denying the
+# CoreSimulatorService lookup, and a developer directory with no simctl in it.
+# Naming the wrong one costs the reader the hunt this check exists to prevent.
+har_sim_log_simctl_unavailable() {
+  # Teardown hits two failures in a row; the cause only needs saying once.
+  [ -z "${_HAR_SIM_SIMCTL_CAUSE_REPORTED:-}" ] || return 0
+  _HAR_SIM_SIMCTL_CAUSE_REPORTED=1
+  # For a launch the failing call happened inside the command substitution around
+  # har_sim_plan_creation, so the reason died with that subshell — ask again here.
+  har_sim_probe_simctl
+  case "${_HAR_SIM_SIMCTL_ERROR:-}" in
+    *"not a developer tool"*|*"unable to find utility"*|*"command not found"*)
+      har_sim_log "'xcrun simctl' is not in the selected developer directory"
+      har_sim_log "  install Xcode, then point the toolchain at it:"
+      har_sim_log "    sudo xcode-select -s /Applications/Xcode.app"
+      har_sim_log "  current selection: $(xcode-select -p 2>/dev/null || echo 'none')"
+      return
+      ;;
+  esac
+  har_sim_log "cannot reach CoreSimulatorService — 'xcrun simctl' is unusable here"
+  har_sim_log "  this usually means the command is running inside an agent sandbox"
+  har_sim_log "  run it from a normal terminal, or let the agent run 'xcrun simctl' unsandboxed"
+}
+
 # Model and runtime to create this slot's device from. Failures carry the models
 # this machine can create, so the caller never has to re-derive that list.
 # Prints one of:
@@ -180,10 +240,18 @@ har_sim_runtimes_json() {
 #   NO_RUNTIME                        no iOS runtime installed
 #   NO_MODEL <models>                 HARNESS_SIMULATOR_NAME is not a device model
 #   NO_RUNTIME_FOR_MODEL <models>     model exists, no installed runtime supports it
+#   SIMCTL_UNAVAILABLE                simctl could not be asked at all
 har_sim_plan_creation() {
   local types runtimes
   types="$(har_sim_devicetypes_json)"
-  runtimes="$(har_sim_runtimes_json)"
+  # Not `$(...)`: that would discard the availability flag with the subshell.
+  har_sim_runtimes_json >/dev/null
+  runtimes="$_HAR_SIM_RUNTIMES_JSON"
+  # Checked before the empty lists are read as an answer about the machine.
+  if ! har_sim_simctl_available; then
+    printf 'SIMCTL_UNAVAILABLE'
+    return
+  fi
   node -e '
 const [typesRaw, runtimesRaw, wantName, family] = process.argv.slice(1);
 const types = JSON.parse(typesRaw).devicetypes || [];
@@ -240,7 +308,9 @@ process.stdout.write(plan());
 # Every device whose name is <prefix> or starts with "<prefix>-", so a slot's
 # leftovers are found whatever model they were created from.
 har_sim_devices_with_prefix() {
-  xcrun simctl list devices --json 2>/dev/null | node -e '
+  local devices
+  devices="$(har_sim_simctl list devices --json)" || return 1
+  printf '%s' "$devices" | node -e '
 const data = JSON.parse(require("fs").readFileSync(0, "utf8"));
 const prefix = process.argv[1];
 const matches = Object.values(data.devices || {})
@@ -252,12 +322,19 @@ process.stdout.write(matches.join("\n"));
 ' "$1" 2>/dev/null || true
 }
 
+# Returns 0 even when it could not look: teardown.sh runs under `set -e`, and
+# aborting there would leave the slot registry behind on top of the device.
 har_sim_delete_devices_with_prefix() {
-  local udid
+  local udid list
+  if ! list="$(har_sim_devices_with_prefix "$1")"; then
+    har_sim_log "cannot check for leftover devices named ${1}* — none were removed"
+    har_sim_log_simctl_unavailable
+    return 0
+  fi
   while read -r udid; do
     [ -n "$udid" ] || continue
     xcrun simctl delete "$udid" >/dev/null 2>&1 || true
-  done <<< "$(har_sim_devices_with_prefix "$1")"
+  done <<< "$list"
 }
 
 # ── Boot ──────────────────────────────────────────────────────────────────────
@@ -289,7 +366,11 @@ _har_sim_select() {
 
   # An explicit UDID is a deliberate override — never fall back off it.
   if [ -n "${HARNESS_SIMULATOR_UDID:-}" ]; then
-    name="$(har_sim_device_name "$HARNESS_SIMULATOR_UDID")"
+    # A failed lookup is "could not ask"; an empty one is "no such device".
+    name="$(har_sim_device_name "$HARNESS_SIMULATOR_UDID")" || {
+      har_sim_log_simctl_unavailable
+      return 1
+    }
     if [ -z "$name" ]; then
       har_sim_log "HARNESS_SIMULATOR_UDID=${HARNESS_SIMULATOR_UDID} is not a known device"
       return 1
@@ -310,6 +391,11 @@ _har_sim_select() {
   models=""
   [ "$plan" != "$status" ] && models="${plan#*$'\t'}"
 
+  if [ "$status" = "SIMCTL_UNAVAILABLE" ]; then
+    har_sim_log_simctl_unavailable
+    return 1
+  fi
+
   if [ "$status" = "OK" ]; then
     IFS=$'\t' read -r _ device_type model runtime _ <<< "$plan"
     label="$(har_sim_device_label "$agent_id" "$model")"
@@ -388,8 +474,14 @@ har_sim_release() {
     rm -f "$file"
     if [ "$created" = "true" ] && [ -n "$udid" ]; then
       xcrun simctl shutdown "$udid" >/dev/null 2>&1 || true
-      xcrun simctl delete "$udid" >/dev/null 2>&1 || true
-      echo "✓ Deleted simulator created for this slot ($udid)"
+      if xcrun simctl delete "$udid" >/dev/null 2>&1; then
+        echo "✓ Deleted simulator created for this slot ($udid)"
+      else
+        # Naming it is the whole remedy left: the claim is gone, so only the name
+        # prefix sweep at the next launch can still find this device.
+        har_sim_log "could not delete ${udid}, created for agent ${agent_id} — it is still on this machine"
+        har_sim_simctl_available || har_sim_log_simctl_unavailable
+      fi
     fi
   fi
 

package/dist/templates/plugins/semgrep/.github/workflows/semgrep.yml

@@ -0,0 +1,39 @@
+# Semgrep SAST — official recipe (https://semgrep.dev/docs/semgrep-ci/sample-ci-configs)
+#
+# With a SEMGREP_APP_TOKEN secret (Semgrep AppSec Platform → Settings), `semgrep ci`
+# publishes findings to the AppSec Platform — the org-level evidence layer that
+# compliance tools like Vanta ingest natively:
+# https://help.vanta.com/en/articles/15705377-connecting-vanta-semgrep
+# Without the token, this falls back to a Community Edition scan that still blocks
+# the PR on findings but publishes nothing.
+name: Semgrep
+
+on:
+  pull_request: {}
+  push:
+    branches: ["main", "master"]
+  workflow_dispatch: {}
+  schedule:
+    # Daily scan so new registry rules surface without a code change
+    - cron: '17 5 * * *'
+
+jobs:
+  semgrep:
+    name: semgrep/ci
+    runs-on: ubuntu-latest
+    container:
+      image: semgrep/semgrep
+    if: (github.actor != 'dependabot[bot]')
+    steps:
+      # Pinned to a SHA so semgrep's own mutable-action-tag rule stays quiet
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Run Semgrep
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+        run: |
+          if [ -n "$SEMGREP_APP_TOKEN" ]; then
+            semgrep ci
+          else
+            echo "SEMGREP_APP_TOKEN not set — running Community Edition scan (no platform/Vanta reporting)"
+            semgrep scan --config auto --error
+          fi

package/dist/templates/plugins/semgrep/.har/stages/SEMGREP.md

@@ -0,0 +1,91 @@
+# Semgrep SAST Stage
+
+The `sast` stage scans the agent's session worktree with [Semgrep](https://semgrep.dev)
+and fails verification when blocking findings exist. Full verify (`verify --full`)
+runs it automatically once it is listed in `verificationStages`.
+
+## Running
+
+```bash
+# Whole worktree
+./.har/stages/sast.sh 1
+
+# Only specific paths
+./.har/stages/sast.sh 1 src/ lib/auth.py
+
+# Included in full verify
+./.har/verify.sh 1 --full
+```
+
+Reports land under `.har/artifacts/sast/` in the **main repo root** (not the worktree):
+
+| File | Contents |
+|------|----------|
+| `semgrep.json` | Full findings report (machine-readable) |
+| `semgrep.sarif` | SARIF report — upload to GitHub code scanning if desired |
+| `scan.log` | Semgrep's own text output for the run |
+
+Exit codes pass through from Semgrep: `0` clean, `1` findings, `>=2` scan error.
+
+## Choosing rules
+
+The stage runs `semgrep scan --config "$HARNESS_SEMGREP_CONFIG"` (default `auto`).
+Set the variable in `.har/harness.env` to pin behavior:
+
+```bash
+# .har/harness.env
+export HARNESS_SEMGREP_CONFIG="p/ci"          # curated low-noise ruleset
+# export HARNESS_SEMGREP_CONFIG="p/security-audit"
+# export HARNESS_SEMGREP_CONFIG=".semgrep/"   # local rules only (works offline)
+```
+
+Honest notes about `--config auto` and registry rulesets (`p/...`):
+
+- They **fetch rules from the Semgrep registry**, so the stage needs network access.
+- Semgrep **sends pseudonymized metrics** to semgrep.dev when registry configs are
+  used (this cannot be disabled for registry configs). For fully offline, metric-free
+  scans, commit local rule files and point `HARNESS_SEMGREP_CONFIG` at them.
+- `auto` picks rulesets based on the languages it detects — convenient, but pin a
+  named ruleset (`p/ci`) when you want reproducible results.
+
+## Tuning noise
+
+- Semgrep respects `.gitignore` by default; add a [`.semgrepignore`](https://semgrep.dev/docs/ignoring-files-folders-code)
+  file for extra exclusions (vendored code, generated files, fixtures).
+- The stage always passes `--exclude .har` — harness scaffolding is not your
+  project's code and semgrep cannot parse some of its bash.
+- Suppress a single finding with a trailing `# nosemgrep: <rule-id>` comment —
+  prefer rule-scoped suppressions over blanket `# nosemgrep`.
+- Write repo-specific rules under `.semgrep/` and add the directory to your config.
+
+## CI and compliance (Vanta)
+
+Of the security plugins, this one has the strongest compliance story. The optional
+workflow `.github/workflows/semgrep.yml` runs `semgrep ci` in the official
+`semgrep/semgrep` container. With a `SEMGREP_APP_TOKEN` secret (generated in
+Semgrep AppSec Platform → Settings), findings publish to the
+[Semgrep AppSec Platform](https://semgrep.dev/login) — which has a
+[native Vanta integration](https://help.vanta.com/en/articles/15705377-connecting-vanta-semgrep):
+Vanta pulls findings, projects, and scan history from Semgrep automatically as
+compliance evidence.
+
+Division of labor:
+
+- **This local stage** is the shift-left layer — agents catch findings *before*
+  code lands on the default branch. Local runs are invisible to Vanta (no noise).
+- **The CI run** (`semgrep ci` on the default branch and PRs) is the org-level
+  evidence layer Vanta reads.
+
+Without a token, the workflow falls back to `semgrep scan --config auto --error`
+(Community Edition — CI still blocks on findings, but nothing publishes to the
+platform and there is no Vanta evidence).
+
+## Adapting per repo
+
+- Pin `HARNESS_SEMGREP_CONFIG` to the ruleset your team standardizes on.
+- Add `.semgrepignore` entries for paths that produce noise.
+- If findings should not block agents yet, keep `sast` out of `verificationStages`
+  in `.har/stages.json` and run it manually while you triage the baseline.
+- The stage summarizes reports with `node`; it assumes a Node.js toolchain is
+  available (true for HAR-provisioned slots on node ecosystems — on other stacks,
+  ensure `node` is on PATH or adapt the summary block).

package/dist/templates/plugins/semgrep/.har/stages/sast.sh

@@ -0,0 +1,141 @@
+#!/usr/bin/env bash
+# Semgrep SAST scan for an agent slot.
+# Scans the session worktree with Semgrep and writes JSON + SARIF reports.
+# Outputs JSON to stdout, human-readable progress to stderr.
+#
+# Usage: ./.har/stages/sast.sh <agent-id> [paths...]
+#   paths (optional): scan only these paths instead of the whole worktree
+#
+# Config: HARNESS_SEMGREP_CONFIG (default "auto") — any semgrep --config value,
+#   e.g. "p/ci", "p/security-audit", or a local rules file/dir. Set it in
+#   .har/harness.env to pin rulesets. Registry configs (auto, p/...) need
+#   network access and send pseudonymized metrics to semgrep.dev.
+#
+# Prerequisite: ./.har/launch.sh <agent-id> AND the semgrep CLI installed
+# See: ./.har/stages/SEMGREP.md for the full adaptation guide.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HARNESS_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+REPO_ROOT="$(cd "$HARNESS_DIR/.." && pwd)"
+# agent-slot.sh expects SCRIPT_DIR to be .har/ (slot registry lives there)
+SCRIPT_DIR="$HARNESS_DIR"
+
+# shellcheck source=/dev/null
+source "$HARNESS_DIR/harness.env"
+# shellcheck source=/dev/null
+source "$HARNESS_DIR/agent-slot.sh"
+
+AGENT_ID="${1:?Usage: sast.sh <agent-id> [paths...]}"
+shift
+SCAN_PATHS=("$@")
+
+validate_agent_id "$AGENT_ID"
+
+log() { echo "==> [semgrep agent-$AGENT_ID] $*" >&2; }
+
+# ── Preflight ─────────────────────────────────────────────────────────────────
+if ! command -v semgrep >/dev/null 2>&1; then
+  echo "Error: semgrep CLI not found." >&2
+  echo "  Install with one of:" >&2
+  echo "    pipx install semgrep      # recommended" >&2
+  echo "    pip install semgrep" >&2
+  echo "    brew install semgrep      # may lag behind the latest release" >&2
+  echo "  Then re-run: ./.har/stages/sast.sh ${AGENT_ID}" >&2
+  exit 1
+fi
+
+# ── Resolve agent env ─────────────────────────────────────────────────────────
+ENV_FILE="$(resolve_agent_env_file "$AGENT_ID" "$REPO_ROOT")" || {
+  echo "No .env.agent.${AGENT_ID} found." >&2
+  har_suggest_launch "$AGENT_ID" >&2
+  exit 1
+}
+
+# .env.agent.<id> exports REPO_ROOT pointing at the worktree — keep the main
+# checkout path so artifacts land in the main repo root, not the worktree.
+MAIN_REPO_ROOT="$REPO_ROOT"
+
+set -a
+# shellcheck source=/dev/null
+source "$ENV_FILE"
+set +a
+
+WORK_DIR="$(resolve_agent_work_dir "$ENV_FILE")"
+
+# ── Artifact directory (main repo root, not the worktree) ─────────────────────
+ARTIFACT_DIR="$MAIN_REPO_ROOT/.har/artifacts/sast"
+mkdir -p "$ARTIFACT_DIR"
+
+SEMGREP_CONFIG="${HARNESS_SEMGREP_CONFIG:-auto}"
+JSON_REPORT="$ARTIFACT_DIR/semgrep.json"
+SARIF_REPORT="$ARTIFACT_DIR/semgrep.sarif"
+SCAN_LOG="$ARTIFACT_DIR/scan.log"
+
+# ── Run semgrep ───────────────────────────────────────────────────────────────
+log "Scanning $WORK_DIR (config: $SEMGREP_CONFIG)..."
+START=$(now_ms)
+
+set +e
+(
+  cd "$WORK_DIR" &&
+  semgrep scan \
+    --config "$SEMGREP_CONFIG" \
+    --error \
+    --exclude .har \
+    --json-output "$JSON_REPORT" \
+    --sarif-output "$SARIF_REPORT" \
+    ${SCAN_PATHS[@]+"${SCAN_PATHS[@]}"}
+) >"$SCAN_LOG" 2>&1
+SEMGREP_EXIT=$?
+set -e
+
+END=$(now_ms)
+TOTAL_MS=$(( END - START ))
+
+# Surface the scan tail so failures are diagnosable without opening the log
+tail -20 "$SCAN_LOG" | sed 's/^/    /' >&2
+
+# semgrep exit codes: 0 = clean, 1 = findings (--error), >=2 = scan error
+if [ "$SEMGREP_EXIT" = "0" ]; then
+  STATUS="pass"
+  log "✓ No blocking findings (${TOTAL_MS}ms)"
+elif [ "$SEMGREP_EXIT" = "1" ]; then
+  STATUS="fail"
+  log "✗ Semgrep reported findings (${TOTAL_MS}ms) — see $JSON_REPORT"
+else
+  STATUS="fail"
+  log "✗ Semgrep scan errored with exit code $SEMGREP_EXIT (${TOTAL_MS}ms) — see $SCAN_LOG"
+fi
+
+# ── Output ────────────────────────────────────────────────────────────────────
+node -e "
+const fs = require('fs');
+let findings = null;
+let errors = null;
+try {
+  const report = JSON.parse(fs.readFileSync('$JSON_REPORT', 'utf8'));
+  findings = report.results ? report.results.length : 0;
+  errors = report.errors ? report.errors.length : 0;
+} catch { /* report missing when the scan itself errored */ }
+const out = {
+  status: '$STATUS',
+  stageId: 'sast',
+  kind: 'test',
+  agent_id: $AGENT_ID,
+  total_ms: $TOTAL_MS,
+  exit_code: $SEMGREP_EXIT,
+  config: '$SEMGREP_CONFIG',
+  findings,
+  scan_errors: errors,
+  artifacts: [
+    { path: '.har/artifacts/sast', kind: 'directory' },
+    { path: '.har/artifacts/sast/semgrep.json', kind: 'report' }
+  ]
+};
+process.stdout.write(JSON.stringify(out, null, 2) + '\n');
+"
+
+if [ "$SEMGREP_EXIT" != "0" ]; then
+  exit "$SEMGREP_EXIT"
+fi

package/dist/templates/plugins/semgrep/README.md

@@ -0,0 +1,57 @@
+# Semgrep plugin
+
+Add a Semgrep SAST stage to your harness so agents catch security findings
+before code lands.
+
+```bash
+har env add-plugin semgrep
+```
+
+## What this installs
+
+| File | Purpose |
+|------|---------|
+| `.har/stages/sast.sh` | Stage runner — scans the session worktree with Semgrep |
+| `.har/stages/SEMGREP.md` | Adaptation guide: rulesets, noise tuning, CI/Vanta story |
+| `.github/workflows/semgrep.yml` | Optional CI workflow (`--skip-ci` to omit) — official `semgrep ci` recipe |
+
+## Workflow
+
+```
+        Code change
+             │
+       launch slot
+             │
+   typecheck + unit-tests
+             │
+           sast  ◄── semgrep scan over the worktree
+             │
+          pass/fail
+```
+
+Full verify (`verify --full`) runs the scan after lint. Reports (JSON + SARIF)
+land under `.har/artifacts/sast/`.
+
+## Requirements
+
+- `semgrep` CLI: `pipx install semgrep` (recommended), `pip install semgrep`,
+  or `brew install semgrep`
+- Network access for registry rulesets (`auto`, `p/ci`, …) — or commit local
+  rules and set `HARNESS_SEMGREP_CONFIG` to their path for offline scans
+
+## Compliance (Vanta)
+
+The local stage is shift-left only — compliance platforms never see it. The CI
+workflow's `semgrep ci` run (with a `SEMGREP_APP_TOKEN` secret) publishes to the
+Semgrep AppSec Platform, which Vanta ingests natively as vulnerability-management
+evidence. See `.har/stages/SEMGREP.md` for the full story.
+
+## Quick start after install
+
+```bash
+pipx install semgrep
+./.har/launch.sh 1
+./.har/stages/sast.sh 1
+# reports: .har/artifacts/sast/semgrep.json (+ .sarif, scan.log)
+./.har/verify.sh 1 --full
+```

package/dist/templates/plugins/semgrep/template.manifest.json

@@ -0,0 +1,44 @@
+{
+  "id": "semgrep",
+  "stageId": "sast",
+  "verificationStages": [
+    "typecheck",
+    "unit-tests",
+    "lint",
+    "sast"
+  ],
+  "stage": {
+    "id": "sast",
+    "kind": "test",
+    "description": "Static analysis (SAST) with Semgrep — scans the session worktree for security findings",
+    "script": "stages/sast.sh",
+    "requiresAgentId": true,
+    "artifacts": [
+      {
+        "path": ".har/artifacts/sast",
+        "kind": "directory",
+        "description": "Semgrep JSON + SARIF reports and scan log"
+      },
+      {
+        "path": ".har/artifacts/sast/semgrep.json",
+        "kind": "report"
+      }
+    ]
+  },
+  "files": [
+    { "src": ".har/stages/sast.sh", "dest": ".har/stages/sast.sh", "executable": true },
+    { "src": ".har/stages/SEMGREP.md", "dest": ".har/stages/SEMGREP.md" }
+  ],
+  "optionalFiles": [
+    { "src": ".github/workflows/semgrep.yml", "dest": ".github/workflows/semgrep.yml", "skipFlag": "skipCi" }
+  ],
+  "nextSteps": [
+    "pipx install semgrep   # or: pip install semgrep / brew install semgrep",
+    "./.har/launch.sh 1",
+    "./.har/stages/sast.sh 1",
+    "Open .har/artifacts/sast/ for the JSON and SARIF reports",
+    "Read .har/stages/SEMGREP.md to pin rulesets (HARNESS_SEMGREP_CONFIG) or add local rules",
+    "CI: set the SEMGREP_APP_TOKEN secret so semgrep ci reports to the Semgrep AppSec Platform (compliance evidence, e.g. Vanta)"
+  ],
+  "docsPath": ".har/stages/SEMGREP.md"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@osfactory/har",
-  "version": "0.53.0",
+  "version": "0.54.1",
   "description": "Open harness for reproducible multi-agent coding workflows",
   "keywords": [
     "har",