@osfactory/har 0.64.2 → 1.0.0-rc.1

package/dist/templates/har-boilerplate/README.md

@@ -1,199 +0,0 @@
-# .har — Agent Harness
-
-This directory is the **agent harness** for this repository. It lets AI coding agents (Cursor, Claude Code, etc.) run the project in isolated environments with their own ports, database, and verification workflow.
-
-Generated and maintained by [`har`](https://github.com/os-factory/har). Run `har env maintain` when the repo stack changes.
-
-**The harness is how you run this project.** Need the app live — manual testing, a browser session, screenshots? `launch` a slot; don't hand-roll docker/dev-server startup. If a harness command fails, fix the harness or report it — don't silently fall back to ad-hoc commands.
-
-## What's in here
-
-| File | Purpose |
-|------|---------|
-| `README.md` | This file — index of the harness |
-| `manifest.json` | Generator metadata (version, checksums) — do not edit |
-| `harness.env` | Shared config: primary app, ports, agent slot limits, `HARNESS_INFRA_SERVICES`, toolchain provisioning, migrate/seed commands |
-| `stages.json` | Machine-readable registry of runnable harness stages |
-| `stages/` | Optional custom stage scripts registered from `stages.json` |
-| `runs/` | Run history from `har env` / MCP only — `.har/runs/YYYY-MM-DD/HH-mm-ss_<stageId>_agent-<id>.json` (gitignore) |
-| `artifacts/` | Stage outputs: reports, traces, screenshots, logs |
-| `agent-slot.sh` | Shared agent-id validation (reads limits from `harness.env`) |
-| `setup-infra.sh` | Start shared Docker infra + create template database |
-| `launch.sh` | Launch one agent slot (ports, DB clone, toolchain provisioning, PM2 processes) |
-| `provision-toolchain.sh` | Install deps and write toolchain paths to `.env.agent.<id>` |
-| `verify.sh` | Verification pipeline (smoke by default; --full adds tests, lint, e2e) |
-| `teardown.sh` | Tear down one agent slot |
-| `agent-cli.sh` | Manage a running agent (status, logs, psql, health) |
-| `attach.sh` | Attach to agent tmux session |
-| `env.template` | Per-agent env vars (expanded by `launch.sh`) |
-| `ecosystem.agent.template.cjs` | PM2 processes for the **primary app only** (expanded by `launch.sh`) |
-| `ecosystem.shared.config.cjs` | Optional — shared app services started once by `setup-infra.sh` (only when the repo has supporting services) |
-| `docker-compose.agent.yml` | Shared infrastructure containers |
-| `CLAUDE.agent.md` | Detailed instructions for coding agents |
-| `justfile` | Optional shortcuts (requires `just`) |
-
-## Quick start
-
-**Preferred — har CLI or MCP** (persists run history under `.har/runs/`):
-
-```bash
-har env launch 1
-har env verify 1
-har env verify 1 --full
-har env teardown 1
-```
-
-In Cursor with HAR MCP configured: use `har_launch_environment`, `har_run_verification`, and `har_teardown_environment`.
-
-**Shell fallback** (no CLI/MCP installed):
-
-```bash
-./.har/setup-infra.sh          # when HARNESS_INFRA_SERVICES is non-empty
-./.har/launch.sh 1
-./.har/verify.sh 1             # quick: ecosystem smoke + health
-./.har/verify.sh 1 --full      # + conventional tests/lint, browser-e2e (if installed)
-./.har/teardown.sh 1
-```
-
-Read **`stages.json`** for registered stages and **`verificationStages`** for the expected pass set.
-
-## Verification contract
-
-Steps in `verify.sh` are **project-specific examples** — adapt them to your stack
-during `har env init` / `har env maintain`. The table describes each tier's intent,
-not a fixed command list.
-
-| Mode | Command | Typical steps |
-|------|---------|---------------|
-| Quick | `har env verify <id>` or `verify.sh <id>` | Stock ecosystem smoke + health (stops early on failure) |
-| Full | `har env verify <id> --full` or `verify.sh <id> --full` | Stock conventional tests/lint, optional readiness smoke + **`browser-e2e`** when `.har/stages/browser-e2e.sh` exists |
-
-The stock commands are deliberately generic conventions keyed by
-`HARNESS_ECOSYSTEM`. Replace them with the repository's real commands during
-adaptation; do not leave Node/npm, Python, Go, Rust, Java, or Ruby defaults in
-place when they do not match the project.
-
-Install Playwright plugin: `har env add-plugin playwright` (optional). UI changes should add or update specs under `tests/`.
-
-## Readiness layers
-
-Do not treat a health endpoint as the whole definition of success. Adapt this
-section for the repository:
-
-| Layer | What it means | Where to encode it |
-|-------|---------------|--------------------|
-| Infra ready | Shared services and template data stores exist | `setup-infra.sh`, `docker-compose.agent.yml` |
-| Slot data ready | Every per-slot data store is created/cloned | `launch.sh` |
-| Process ready | Primary app is running and health passes | `launch.sh`, `verify.sh` |
-| Agent usable | Login/API/UI smoke works with documented data | `HARNESS_READINESS_CMD`, browser-e2e, `CLAUDE.agent.md` |
-
-If full local-dev setup is too heavy to run in the harness, document the skipped
-steps and add the minimum substitute directly in `.har/` scripts (for example an
-idempotent bootstrap for required users/tenants/settings). Health alone is not
-enough for UI/auth apps.
-
-## Run history
-
-| Entry point | Writes `.har/runs/`? |
-|-------------|------------------------|
-| `./.har/*.sh` | No — same scripts, no run record |
-| `har env …` / MCP | Yes — under main checkout `.har/runs/YYYY-MM-DD/` |
-
-With git worktree slots, verification runs code in the worktree but run JSON stays in the main repo `.har/runs/`. Each record includes `workDir` when a slot is active.
-
-## For coding agents
-
-1. Read repo [`AGENTS.md`](../AGENTS.md)
-2. Read this file and `stages.json`
-3. After launch, read `.har/CLAUDE.agent.md` for slot URLs and definition of done
-
-Prefer HAR MCP tools or `har env …` for launch, verify, and teardown. Use `./.har/*.sh` only when the CLI is not installed.
-
-Always use `./.har/agent-cli.sh <id> ...` — never hardcoded ports.
-
-## Architecture
-
-Each agent slot gets isolated app ports. Defaults follow `BASE + (AGENT_ID × HARNESS_PORT_STEP)`; when a default is busy, `launch.sh` scans the slot lane (`STEP` increments) and writes the resolved ports to `.env.agent.<id>` and `.har/slots/agent-<id>.json`.
-
-Configure how many slots your machine can run in parallel in `.har/stages.json` (`agentSlots`). Bash scripts and the CLI read that first; `harness.env` keeps legacy `HARNESS_AGENT_SLOT_*` exports in sync via `har env maintain --finalize`.
-
-| Service | Agent 1 (default) | Agent 2 (default) |
-|---------|-------------------|-------------------|
-| Frontend | 3010 | 3020 |
-| API | 8010 | 8020 |
-| Node debug | 9210 | 9220 |
-
-## Port & shared services
-
-### Port allocation
-
-| Layer | Scope | Rule | On conflict |
-|-------|-------|------|-------------|
-| App — frontend | Per slot | `HARNESS_FE_BASE_PORT + (AGENT_ID × HARNESS_PORT_STEP)` | Scan `STEP` increments within the slot lane |
-| App — API | Per slot | `HARNESS_API_BASE_PORT + (AGENT_ID × STEP)` | Same scan policy |
-| Node debug | Per slot | `9200 + (AGENT_ID × STEP)` | Same scan policy |
-| Shared Postgres | Per machine | `HARNESS_DB_PORT_DEFAULT` | Scan `HARNESS_DB_PORT_SCAN_START..END` |
-| MinIO / S3 | Per machine | `HARNESS_MINIO_PORT_DEFAULT` (+ console port) | Scan configured ranges in `harness.env` |
-| Mailpit | Per machine | `HARNESS_MAILPIT_*_PORT_DEFAULT` | Scan configured ranges |
-| Headless browser | Per machine | `HARNESS_BROWSER_PORT_DEFAULT` | Scan configured ranges |
-
-Resolved ports may differ from the formula when something else is already bound. Always use `./.har/agent-cli.sh <id>` or read `.har/slots/agent-<id>.json` — never hardcode `3010`, `15432`, etc. in app code or tests.
-
-### Shared vs per-slot
-
-| Resource | Model | Configuration |
-|----------|-------|---------------|
-| Postgres | One shared container; per-slot database `agent_<id>` cloned from template | `HARNESS_INFRA_SERVICES="db"` |
-| MinIO / S3 | One shared container; per-slot bucket `agent-<id>` | `HARNESS_INFRA_SERVICES="... minio"` |
-| Mailpit, Redis, etc. | One shared container on a scanned host port | Listed in `HARNESS_INFRA_SERVICES` |
-| Primary application | One PM2 ecosystem per slot (isolated ports) | `HARNESS_PRIMARY_APP`, `ecosystem.agent.template.cjs` |
-| Internal supporting services | Shared across all slots | `docker-compose.agent.yml` or `ecosystem.shared.config.cjs` |
-
-Shared infra starts once via `./.har/setup-infra.sh` (also run automatically by `launch.sh`). Per-slot databases are cloned in `launch.sh`.
-
-### Do not
-
-- Hardcode default ports (`3000`, `15432`, `3847`, …) in application code, tests, or agent docs — read from `.env.agent.<id>`, `agent-cli.sh`, or the slot registry
-- Run raw `docker compose` for harness infrastructure — use `setup-infra.sh` / `launch.sh` so ports are scanned and persisted in `.har/state/infra.env`
-
-### Primary app vs shared services
-
-Each slot runs **only the primary application** (`HARNESS_PRIMARY_APP` in `harness.env`) — the app agents modify. Everything else runs **once**, shared by all slots on fixed ports:
-
-- **External dependencies** (Postgres, Redis, mail, ...): services in `docker-compose.agent.yml`, enabled via the `HARNESS_INFRA_SERVICES` list in `harness.env`, started by `setup-infra.sh`.
-- **Internal supporting services** (other services of a monolith/monorepo the agent depends on but does not change): either compose services in `docker-compose.agent.yml`, or PM2 processes in an optional `.har/ecosystem.shared.config.cjs` (named `har-shared-<name>`, started by `setup-infra.sh`).
-
-Isolation still applies where it matters: each slot gets its own database (`agent_<id>`, cloned from the template DB), ports, and git worktree.
-
-## Maintaining this harness
-
-When the project stack changes (new services, different test commands, new env vars):
-
-```bash
-har env maintain
-```
-
-The authoring agent updates scripts and this README. Review changes before committing.
-
-**Do not** put runtime behavior in YAML — edit the scripts directly.
-
-## Session lifecycle
-
-Every `launch` starts a **fresh session**: a new git worktree from the **main
-checkout's current HEAD** at
-`~/worktrees/<base-branch>-<sha4>-har-agent-<id>-<rand4>`, on a branch of the same name.
-Switch that checkout to your intended base before launch. The session is recorded in
-`.har/slots/agent-<id>.json` (the slot registry) — status, verify, and teardown resolve
-the work dir through it. Make ALL file edits under the work dir printed by launch,
-never in the main checkout.
-
-- Occupied slots always block a new launch: `har env complete <id>` (or `teardown <id>`),
-  then `har env launch <id>`. A new launch never chooses `main` for you — switch the
-  main checkout to your intended base first.
-- `teardown` removes the worktree but **keeps the session branch** so you can push it
-  or open a PR (`--delete-branch` to drop it).
-- If launch fails after creating a worktree/env file, the registry records `status: failed`.
-  Resume it instead of starting fresh: `har env launch <id> --resume` or `har env recover <id>`.
-- `har env complete <id>` finishes a session: full verify (recorded as a validation),
-  then teardown — branch kept.
-- `--no-worktree` runs the slot from the repo root instead (single-agent mode).

package/dist/templates/har-boilerplate/STAGES.md

@@ -1,99 +0,0 @@
-# HAR Stages — authoring guide
-
-Stages are the harness's single vocabulary for runnable checks and lifecycle
-actions. Everything — shipped plugins (`playwright`, `rocketsim`, `kerno`, `gitleaks`, `trivy`, `semgrep`), your
-project's test/lint commands, bespoke validation scripts — registers in
-`.har/stages.json` with the same schema, and agents interact with stages only
-through that registry (CLI `har env verify`, MCP `har_run_stage` /
-`har_run_verification`), never through stack-specific tooling.
-
-Philosophy: *plugins install stages; agents only talk to the stage registry.*
-
-## The registry: `.har/stages.json`
-
-```jsonc
-{
-  "verificationStages": ["typecheck", "unit-tests", "api-health", "browser-e2e"],
-  "stages": [
-    {
-      "id": "browser-e2e",              // stable, shell-friendly slug
-      "kind": "test",                   // setup | launch | verify | test | inspect | reset | teardown | custom
-      "description": "Playwright E2E",
-      "script": "stages/browser-e2e.sh", // relative to .har/ — OR use "command"
-      "requiresAgentId": true,           // default true for test/verify/custom kinds
-      "artifacts": [{ "path": ".har/artifacts/browser-e2e", "kind": "directory" }]
-    },
-    {
-      "id": "unit-tests-fast",
-      "kind": "test",
-      "command": "npm test -- --agent {agentId}"   // {agentId} is substituted at run time
-    }
-  ]
-}
-```
-
-Optional stage fields: `cwd` (working directory), `env` (extra env vars),
-`group`, `acceptsArgs` (extra CLI args the stage accepts, e.g. `["--full"]`).
-
-## Two ways to define a stage
-
-**Command stages** — the default for simple checks (`npm test`, `swiftlint`,
-`make check`). One JSON entry, zero files:
-
-```bash
-har env add-stage unit-tests-fast --custom --kind test --command "npm test" --verification
-```
-
-**Script stages** — for anything that needs the slot's env, ports, or
-artifacts. Scaffold a contract-compliant skeleton:
-
-```bash
-har env add-stage db-integrity --custom --script --description "Check DB invariants"
-```
-
-then implement the TODO block in `.har/stages/db-integrity.sh`.
-
-## The stage script contract
-
-Every script under `.har/stages/` must:
-
-1. Source `harness.env` and `agent-slot.sh` from `.har/`. Before sourcing,
-   set `SCRIPT_DIR` to the `.har/` directory (not `stages/`) — `agent-slot.sh`
-   resolves the slot registry via `$SCRIPT_DIR/slots/...`.
-2. Take the agent slot id as `$1` (validate with `validate_agent_id`); extra
-   args may follow.
-3. Load the slot env via `resolve_agent_env_file` and run checks from the
-   agent's work dir (`resolve_agent_work_dir`).
-4. Write artifacts (reports, screenshots, logs) under `.har/artifacts/<id>/`.
-5. Print **only** the normalized JSON result object on stdout
-   (`status`, `stageId`, `agent_id`, `total_ms`, …); log progress to stderr.
-6. Exit with the real status code (0 = pass).
-
-The scaffolded skeleton implements all of this — replace its TODO block.
-
-## Verification membership
-
-Listing a stage id in `verificationStages` is what includes it in
-`har env verify <id> --full`. Ids that match a registered stage run via their
-script/command; ids without a registry entry (e.g. `typecheck`, `api-health`)
-are inline steps owned by `.har/verify.sh`. Lifecycle kinds
-(`setup`/`launch`/`reset`/`teardown`/`inspect`) and `verify` itself never run
-as part of verification, even if listed.
-
-## Commit gate
-
-The registry also holds the optional `commitGate` config (installed via
-`har hooks install`): `{ "commitGate": { "mode": "block" | "warn", "scope":
-"worktrees" | "all" } }` controls whether unverified change batches may be
-committed.
-
-## Shipped plugins
-
-`har env add-plugin --list` shows available plugins; `har env add-plugin
-playwright` (web), `har env add-plugin rocketsim` (iOS), or `har env
-add-plugin kerno` (backend), `har env add-plugin gitleaks` (secrets scanning, any
-stack), or `har env add-plugin trivy` (dependency + IaC security scan, any stack),
-or `har env add-plugin semgrep` (SAST, any stack)
-installs one. A
-plugin is just packaging: it copies files, merges `package.json` fragments,
-and registers stages through the exact same registry as `add-stage --custom`.

package/dist/templates/har-boilerplate/agent-cli.sh

@@ -1,225 +0,0 @@
-#!/usr/bin/env bash
-# Namespaced CLI for managing a running agent environment.
-#
-# Usage: ./.har/agent-cli.sh <agent-id> <command> [args...]
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-
-# shellcheck source=/dev/null
-source "$SCRIPT_DIR/harness.env"
-# shellcheck source=/dev/null
-source "$SCRIPT_DIR/agent-slot.sh"
-
-AGENT_ID="${1:?Usage: agent-cli.sh <agent-id> <command> [args...]}"
-COMMAND="${2:?Usage: agent-cli.sh <agent-id> <command> [args...]}"
-
-validate_agent_id "$AGENT_ID"
-
-load_agent_ports "$AGENT_ID" "$REPO_ROOT"
-DB_PORT="${DB_PORT:-${AGENT_DB_PORT:-${HARNESS_DB_PORT_DEFAULT:-15432}}}"
-export PGPASSWORD="password"
-
-PM2_SLOT_PREFIX="$(har_pm2_slot_prefix "$AGENT_ID")"
-
-case "$COMMAND" in
-  status)
-    ENV_FILE="$(resolve_agent_env_file "$AGENT_ID" "$REPO_ROOT" || true)"
-    WORKTREE_DIR="$(existing_slot_worktree "$AGENT_ID")"
-    REG_FILE="$(slot_registry_file "$AGENT_ID")"
-    PM2_RAW=$($(har_pkg_exec) pm2 jlist 2>/dev/null || true)
-    PM2_FOUND=false
-    PM2_FOREIGN=false
-    PM2_LEGACY=false
-
-    if [ -n "$PM2_RAW" ]; then
-      set +e
-      echo "$PM2_RAW" | node -e "
-const agentId = '${AGENT_ID}';
-const project = '${HARNESS_PROJECT_NAME}';
-const slotPrefix = 'har-' + project + '-agent-' + agentId + '-';
-const legacyPrefix = 'agent-' + agentId + '-';
-let raw = '';
-process.stdin.on('data', c => raw += c);
-process.stdin.on('end', () => {
-  try {
-    const arr = JSON.parse(raw);
-    if (!Array.isArray(arr)) process.exit(1);
-    const owned = arr.filter(x => x.name && x.name.startsWith(slotPrefix));
-    const foreignProject = arr.filter(x =>
-      x.name && x.name.startsWith('har-') && x.name.includes('-agent-' + agentId + '-') && !x.name.startsWith(slotPrefix));
-    const legacy = arr.filter(x => x.name && x.name.startsWith(legacyPrefix) && !x.name.startsWith('har-'));
-    if (owned.length > 0) {
-      console.log('Agent ' + agentId + ' processes (' + project + '):');
-      owned.forEach(p => {
-        const s = (p.pm2_env?.status || 'unknown').padEnd(10);
-        const mem = Math.round((p.monit?.memory || 0) / 1024 / 1024) + 'MB';
-        const cpu = (p.monit?.cpu || 0) + '%';
-        const cwd = p.pm2_env?.pm_cwd || p.pm2_env?.cwd || '';
-        console.log('  ' + p.name.padEnd(48) + s + '  mem=' + mem + '  cpu=' + cpu);
-        if (cwd) console.log('    cwd: ' + cwd);
-      });
-      process.exit(0);
-    }
-    if (foreignProject.length > 0 || legacy.length > 0) {
-      if (foreignProject.length > 0) {
-        console.log('ERROR: foreign PM2 processes match agent ' + agentId + ' but belong to another harness:');
-        foreignProject.forEach(p => console.log('  ' + p.name + '  cwd=' + (p.pm2_env?.pm_cwd || p.pm2_env?.cwd || 'unknown')));
-      }
-      if (legacy.length > 0) {
-        console.log('ERROR: legacy PM2 processes (pre project-scoping) match agent ' + agentId + ':');
-        legacy.forEach(p => console.log('  ' + p.name + '  cwd=' + (p.pm2_env?.pm_cwd || p.pm2_env?.cwd || 'unknown')));
-      }
-      process.exit(2);
-    }
-    process.exit(1);
-  } catch {
-    process.exit(1);
-  }
-});
-"
-      pm2_status=$?
-      set -e
-      case "$pm2_status" in
-        0) PM2_FOUND=true ;;
-        2) PM2_FOREIGN=true ;;
-      esac
-    fi
-
-    if [ "$PM2_FOREIGN" = true ]; then
-      exit 1
-    fi
-
-    if [ "$PM2_FOUND" = true ]; then
-      if [ ! -f "$REG_FILE" ]; then
-        echo "ERROR: slot registry missing at $REG_FILE but PM2 processes exist for this project." >&2
-        echo "  Another harness may have been torn down incorrectly, or this slot was started outside launch.sh." >&2
-        exit 1
-      fi
-      REG_PROJECT="$(read_slot_field "$REG_FILE" projectName || true)"
-      if [ -n "$REG_PROJECT" ] && [ "$REG_PROJECT" != "$HARNESS_PROJECT_NAME" ]; then
-        echo "ERROR: slot registry projectName=${REG_PROJECT} does not match harness ${HARNESS_PROJECT_NAME}." >&2
-        exit 1
-      fi
-      if [ -z "$ENV_FILE" ]; then
-        echo "ERROR: .env.agent.${AGENT_ID} could not be resolved — teardown this slot, then relaunch." >&2
-        exit 1
-      fi
-    elif [ -n "$ENV_FILE" ] && [ -f "$ENV_FILE" ]; then
-      echo "Agent ${AGENT_ID}: active (no PM2 processes)"
-      # shellcheck source=/dev/null
-      source "$ENV_FILE" 2>/dev/null || true
-      echo "  Work dir:  $(resolve_agent_work_dir "$ENV_FILE" "$AGENT_ID")"
-      [ -n "$WORKTREE_DIR" ] && [ -d "$WORKTREE_DIR" ] && echo "  Worktree:  $WORKTREE_DIR"
-      echo "  Frontend:  http://localhost:${FE_PORT}"
-      echo "  API:       http://localhost:${API_PORT}"
-    else
-      echo "No active environment for agent ${AGENT_ID}"
-      har_suggest_launch "$AGENT_ID"
-    fi
-    ;;
-
-  logs)
-    SERVICE="${3:-}"
-    if [ -n "$SERVICE" ]; then
-      $(har_pkg_exec) pm2 logs "${PM2_SLOT_PREFIX}-${SERVICE}" --lines 100
-    else
-      $(har_pkg_exec) pm2 logs --name "${PM2_SLOT_PREFIX}" --lines 100
-    fi
-    ;;
-
-  restart)
-    SERVICE="${3:-}"
-    PKG_EXEC="$(har_pkg_exec)"
-    if [ -n "$SERVICE" ]; then
-      $(har_pkg_exec) pm2 restart "${PM2_SLOT_PREFIX}-${SERVICE}"
-    else
-      $(har_pkg_exec) pm2 jlist 2>/dev/null | node -e "
-const prefix = '${PM2_SLOT_PREFIX}-';
-const d = JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
-const names = d.filter(x => x.name && x.name.startsWith(prefix)).map(x => x.name);
-names.forEach(n => require('child_process').execSync('${PKG_EXEC} pm2 restart ' + n, {stdio:'inherit'}));
-if (names.length === 0) console.log('No processes found for ${PM2_SLOT_PREFIX}');
-" 2>/dev/null || true
-    fi
-    ;;
-
-  psql)
-    QUERY="${3:-}"
-    if [ -n "$QUERY" ]; then
-      har_pg psql -d "agent_${AGENT_ID}" -c "$QUERY"
-    else
-      har_pg psql -d "agent_${AGENT_ID}"
-    fi
-    ;;
-
-  health)
-    if [ -n "${HARNESS_HEALTH_CHECK_PATH:-}" ]; then
-      curl -sf "http://localhost:${API_PORT}${HARNESS_HEALTH_CHECK_PATH}" | node -e "
-const d = require('fs').readFileSync('/dev/stdin','utf8');
-try { console.log(JSON.stringify(JSON.parse(d), null, 2)); } catch { console.log(d); }
-" || curl -v "http://localhost:${API_PORT}${HARNESS_HEALTH_CHECK_PATH}"
-    else
-      echo "No health check path configured in harness.env"
-    fi
-    ;;
-
-  url)
-    echo "Frontend:  http://localhost:${FE_PORT}"
-    echo "API:       http://localhost:${API_PORT}"
-    har_infra_enabled db               && echo "Database:  agent_${AGENT_ID} @ localhost:${DB_PORT}"
-    har_infra_enabled minio            && echo "MinIO:     http://localhost:${AGENT_MINIO_CONSOLE_PORT:-19001}"
-    har_infra_enabled headless-browser && echo "Browser:   http://localhost:${AGENT_BROWSER_PORT:-13001}"
-    har_infra_enabled mailpit          && echo "Mailpit:   http://localhost:${AGENT_MAILPIT_WEB_PORT:-18025}"
-    ;;
-
-  reset-db)
-    echo "==> Resetting database for agent ${AGENT_ID}..."
-    har_pg psql -d postgres -c \
-      "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname='agent_${AGENT_ID}';" \
-      >/dev/null
-    har_pg dropdb --if-exists "agent_${AGENT_ID}"
-    har_pg createdb -T "$HARNESS_TEMPLATE_DB" "agent_${AGENT_ID}"
-    echo "✓ Database reset to clean state"
-    ;;
-
-  slow-queries)
-    har_pg psql -d "agent_${AGENT_ID}" -c "
-SELECT round(mean_exec_time::numeric, 2) AS mean_ms,
-       calls,
-       left(query, 120) AS query
-FROM pg_stat_statements
-ORDER BY mean_exec_time DESC
-LIMIT 20;" 2>/dev/null || echo "pg_stat_statements extension not available"
-    ;;
-
-  exec)
-    shift 2
-    if [ $# -eq 0 ]; then
-      echo "Usage: agent-cli.sh ${AGENT_ID} exec <command>" >&2
-      exit 1
-    fi
-    WORK_DIR="$(resolve_agent_work_dir "" "$AGENT_ID" 2>/dev/null || true)"
-    [ -n "$WORK_DIR" ] && [ -d "$WORK_DIR" ] || WORK_DIR="$REPO_ROOT"
-    PGHOST=localhost PGPORT="$DB_PORT" PGUSER=postgres PGDATABASE="agent_${AGENT_ID}" \
-      bash -c "cd '$WORK_DIR' && $*"
-    ;;
-
-  attach)
-    SESSION="$(har_tmux_session "$AGENT_ID")"
-    if ! tmux has-session -t "$SESSION" 2>/dev/null; then
-      echo "No tmux session found: $SESSION" >&2
-      exit 1
-    fi
-    tmux attach -t "$SESSION"
-    ;;
-
-  *)
-    echo "Unknown command: $COMMAND" >&2
-    echo ""
-    echo "Commands: status, logs [service], restart [service], psql [query],"
-    echo "          health, url, reset-db, slow-queries, exec <cmd>, attach"
-    exit 1
-    ;;
-esac