@osfactory/har 1.0.0-rc.2 → 1.1.0

package/dist/templates/har-boilerplate-cli/stages.json

@@ -13,14 +13,12 @@
     {
       "id": "setup-infra",
       "kind": "setup",
-      "description": "Optional shared Docker infrastructure",
-      "command": "./.har/setup-infra.sh"
+      "description": "Optional shared Docker infrastructure"
     },
     {
       "id": "launch",
       "kind": "launch",
       "description": "Prepare agent slot (git worktree, deps, env file)",
-      "command": "./.har/launch.sh {agentId}",
       "artifacts": [
         {
           "path": ".env.agent.{agentId}",
@@ -33,7 +31,6 @@
       "id": "verify",
       "kind": "verify",
       "description": "Verification pipeline: runs stages.json verificationStages in order (tier \"quick\" by default; --full runs the whole list)",
-      "command": "./.har/verify.sh {agentId}",
       "acceptsArgs": [
         "--full"
       ],
@@ -49,7 +46,6 @@
       "id": "status",
       "kind": "inspect",
       "description": "Inspect agent slot status and worktree path",
-      "command": "./.har/agent-cli.sh {agentId} status",
       "artifacts": [
         {
           "path": ".har/logs",
@@ -61,8 +57,7 @@
     {
       "id": "teardown",
       "kind": "teardown",
-      "description": "Remove worktree and env file for the slot",
-      "command": "./.har/teardown.sh {agentId}"
+      "description": "Remove worktree and env file for the slot"
     },
     {
       "id": "typecheck",

package/dist/templates/har-boilerplate-ios/gitignore.template

@@ -12,6 +12,8 @@ AGENT.md.proposed
 AGENT.md.proposed.meta.json
 maintain/
 ADAPT-PROMPT.md
+migrate/
+MIGRATE-PROMPT.md
 slots/
 simulators/
 

package/dist/templates/har-boilerplate-ios/harness.env

@@ -1,5 +1,5 @@
 # iOS mobile app harness — Xcode / iOS Simulator, no PM2, no Docker infra
-# Generated by har env init --profile ios
+# Generated when the harness is scaffolded (--profile ios)
 #
 # This file is pure KEY=value config (plus comments) and is schema-validated
 # on read. Runtime helpers (har_infra_enabled, port resolution) live in

package/dist/templates/har-boilerplate-ios/justfile

@@ -2,29 +2,28 @@
 
 set shell := ["bash", "-cu"]
 
+repo := justfile_directory() + "/.."
+
 setup:
-    ./setup-infra.sh
+    har env setup-infra --repo {{repo}}
 
 launch id:
-    ./launch.sh {{id}}
+    har env launch {{id}} --repo {{repo}}
 
 teardown id:
-    ./teardown.sh {{id}}
+    har env teardown {{id}} --repo {{repo}}
 
 verify id:
-    ./verify.sh {{id}}
+    har env verify {{id}} --repo {{repo}}
 
 verify-full id:
-    ./verify.sh {{id}} --full
+    har env verify {{id}} --full --repo {{repo}}
 
 status:
-    #!/usr/bin/env bash
-    for id in 1 2 3; do
-        ./agent-cli.sh "$id" status 2>/dev/null || true
-    done
+    har env status --repo {{repo}}
 
 cli id cmd *args:
-    ./agent-cli.sh {{id}} {{cmd}} {{args}}
+    har env agent {{id}} {{cmd}} {{args}} --repo {{repo}}
 
 simulator:
     xcrun simctl list devices available | grep -E 'iPhone|iPad' | head -20

package/dist/templates/har-boilerplate-ios/stages.json

@@ -13,14 +13,12 @@
     {
       "id": "setup-infra",
       "kind": "setup",
-      "description": "Boot iOS Simulator and start optional shared infra",
-      "command": "./.har/setup-infra.sh"
+      "description": "Boot iOS Simulator and start optional shared infra"
     },
     {
       "id": "launch",
       "kind": "launch",
       "description": "Prepare agent slot (git worktree, iOS deps, env file)",
-      "command": "./.har/launch.sh {agentId}",
       "artifacts": [
         {
           "path": ".env.agent.{agentId}",
@@ -33,7 +31,6 @@
       "id": "verify",
       "kind": "verify",
       "description": "Verification pipeline: runs stages.json verificationStages in order (tier \"quick\" by default; --full runs the whole list)",
-      "command": "./.har/verify.sh {agentId}",
       "acceptsArgs": [
         "--full"
       ],
@@ -49,7 +46,6 @@
       "id": "status",
       "kind": "inspect",
       "description": "Inspect agent slot status, simulator, and worktree path",
-      "command": "./.har/agent-cli.sh {agentId} status",
       "artifacts": [
         {
           "path": ".har/logs",
@@ -61,8 +57,7 @@
     {
       "id": "teardown",
       "kind": "teardown",
-      "description": "Remove worktree and env file for the slot",
-      "command": "./.har/teardown.sh {agentId}"
+      "description": "Remove worktree and env file for the slot"
     },
     {
       "id": "build",
@@ -85,7 +80,7 @@
       "kind": "test",
       "tier": "full",
       "description": "SwiftLint (skips when not installed)",
-      "command": "command -v \"${HARNESS_SWIFTLINT_CMD:-swiftlint}\" >/dev/null 2>&1 && \"${HARNESS_SWIFTLINT_CMD:-swiftlint}\" --quiet || echo \"swiftlint not installed — skipping\"",
+      "command": "command -v \"${HARNESS_SWIFTLINT_CMD:-swiftlint}\" >/dev/null 2>&1 && \"${HARNESS_SWIFTLINT_CMD:-swiftlint}\" --quiet || echo \"swiftlint not installed \u2014 skipping\"",
       "requiresAgentId": true
     },
     {

package/dist/templates/migration-prompt.md

@@ -9,7 +9,7 @@ In 1.0 the harness machinery lives once, in the `@osfactory/har` package. `.har/
 - **hooks** — `.har/hooks/{pre-launch,post-launch,pre-verify,pre-teardown,post-teardown}.sh` (custom lifecycle behavior)
 - **plugins** — `.har/plugins/<id>/` local plugins for anything bigger (`har plugin create <id>`)
 
-The `./.har/*.sh` entry points become thin shims (`exec har env … "$@"` with a pinned `npx` fallback), so every surface — raw scripts, `har env`, MCP tools — writes the same run/validation records. Your muscle memory (`./.har/launch.sh 1`, `./.har/verify.sh 1 --full`, `har env launch 1`) keeps working before, during, and after.
+Lifecycle wrappers under `.har/` are deleted. Drive the harness with `har env …` or MCP — both write the same run/validation records. Project-owned `stages/*.sh` and `hooks/*.sh` stay.
 
 {{MIGRATION_SECTION}}
 
@@ -35,7 +35,7 @@ If the backups show deep patches to the machinery itself (not just config/stages
 2. `har env maintain` — drift report should show only files you deliberately adapted.
 3. Full verify on **every configured agent slot** that is in use; at minimum:
    - `har env launch 1`
-   - `har env verify 1 --full` (or `./.har/verify.sh 1 --full` — same records either way)
+   - `har env verify 1 --full`
    - `har env complete 1` (or `har env teardown 1`)
 4. Exercise anything you lifted into hooks/stages (e.g. per-slot data stores exist in the work dir, custom checks run in `--full`).
 
@@ -50,5 +50,6 @@ Record the migration and clean up the migration artifacts (`.har/migrate/`, this
 1. Never edit `.har/manifest.json` by hand — it is managed by the har CLI.
 2. Do not delete `.har/migrate/backup/` until finalize — it is the only copy of the pre-1.0 adaptations.
 3. Keep `stages.json` stage ids stable — run records and Mission Control reference them.
-4. Update `.har/README.md` and `.har/CLAUDE.agent.md` if commands or workflow notes changed.
+4. Update `.har/README.md` if commands or workflow notes changed — 1.0 does not
+   generate `.har/CLAUDE.agent.md`; its content belongs there.
 5. Commit the migrated harness (shims, `harness.env`, `stages.json`, `.har/hooks/`) once verified — `.har/migrate/` and this prompt are transient and stay untracked.

package/dist/templates/plugins/custom-stage-skeleton.sh

@@ -26,8 +26,8 @@ escape_step_output() {
   printf '%s' "$1" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{const s=d.trim().split('\n').slice(0,50).join('\n');process.stdout.write(JSON.stringify(s))})" 2>/dev/null || echo '""'
 }
 
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 ARTIFACTS_DIR="$HARNESS_DIR/artifacts/__STAGE_ID__"
 mkdir -p "$ARTIFACTS_DIR"
 

package/dist/templates/plugins/gitleaks/.har/stages/secrets-scan.sh

@@ -48,8 +48,8 @@ REPORT_PATH="$ARTIFACT_DIR/report.json"
 SCAN_LOG="$ARTIFACT_DIR/gitleaks.log"
 
 # ── Resolve agent env ─────────────────────────────────────────────────────────
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 
 GITLEAKS_VERSION="$(gitleaks version 2>/dev/null | head -1 || echo unknown)"
 log "gitleaks ${GITLEAKS_VERSION} — ${MODE} scan of $WORK_DIR"

package/dist/templates/plugins/gitleaks/template.manifest.json

@@ -43,7 +43,7 @@
   ],
   "nextSteps": [
     "Install gitleaks: brew install gitleaks — or a release binary from https://github.com/gitleaks/gitleaks/releases",
-    "./.har/launch.sh 1",
+    "har env launch 1",
     "./.har/stages/secrets-scan.sh 1",
     "Open .har/artifacts/secrets-scan/report.json for findings (secrets are redacted)",
     "Tune allowlists in .gitleaks.toml — read .har/stages/GITLEAKS.md for the adaptation guide"

package/dist/templates/plugins/kerno/.github/workflows/kerno.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Install Kerno CLI
         run: npm install -g @kerno/cli
       # - name: Start the app (adapt for your stack) and migrate/seed its database
-      #   run: ./.har/launch.sh 1 && <start your app in the slot>
+      #   run: har env launch 1 && <start your app in the slot>
       # - name: Bind a Kerno agent to this checkout
       #   run: kerno init
       # - name: Run backend validation

package/dist/templates/plugins/kerno/.har/stages/KERNO.md

@@ -47,7 +47,7 @@ concurrently across slots.
 
 ## Configuration the stage reads
 
-All values come from the slot's `.env.agent.<id>` (written by `launch.sh`) and `~/.kerno/agent.port`:
+All values come from the slot's `.env.agent.<id>` (written by `har env launch`) and `~/.kerno/agent.port`:
 
 | Value | Source | Used for |
 |-------|--------|----------|
@@ -101,7 +101,7 @@ Under `.har/artifacts/backend-validation/`:
 ./.har/stages/backend-validation.sh 1
 
 # As part of full verify
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```
 
 ## Adapting per repo

package/dist/templates/plugins/kerno/.har/stages/backend-validation.sh

@@ -4,7 +4,7 @@
 # via the local Kerno agent's REST API. Outputs JSON to stdout, progress to stderr.
 #
 # Usage: ./.har/stages/backend-validation.sh <agent-id>
-# Prerequisite: ./.har/launch.sh <agent-id>, the app running in the slot, AND a Kerno
+# Prerequisite: har env launch <agent-id>, the app running in the slot, AND a Kerno
 #   agent started with `kerno init` in THIS worktree (Kerno allows ONE agent per machine).
 # See: ./.har/stages/KERNO.md for the full setup + adaptation guide.
 set -euo pipefail
@@ -76,8 +76,8 @@ fi
 trap cleanup EXIT
 
 # ── Resolve agent env + slot target ───────────────────────────────────────────
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 
 # SUT URL: prefer an explicit override, then the app's own SITE_URL (both the default
 # web profile and single-port apps like Next.js set SITE_URL to the running app), then a

package/dist/templates/plugins/kerno/README.md

@@ -55,13 +55,13 @@ kerno init                       # run inside the slot worktree
 ls .kerno/scenarios/endpoints/
 
 # 4. Launch the slot and start your app
-./.har/launch.sh 1
+har env launch 1
 
 # 5. Run backend validation
 ./.har/stages/backend-validation.sh 1
 
 # 6. Validate everything
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```
 
 Per-endpoint run responses and verdicts land in `.har/artifacts/backend-validation/`.

package/dist/templates/plugins/kerno/template.manifest.json

@@ -49,7 +49,7 @@
     "npm install -g @kerno/cli",
     "kerno init                       # bind the single Kerno agent to THIS worktree",
     "Ask your Kerno agent to generate a scenario suite (or ensure .kerno/scenarios/ is committed)",
-    "./.har/launch.sh 1               # then start your app in the slot",
+    "har env launch 1               # then start your app in the slot",
     "./.har/stages/backend-validation.sh 1",
     "Open .har/artifacts/backend-validation/ for verdicts and per-endpoint run responses"
   ],

package/dist/templates/plugins/playwright/.har/stages/PLAYWRIGHT.md

@@ -10,12 +10,12 @@ Adapt specs under `tests/` for your application. Full verification (`verify --fu
 
 ## Run
 
-After `./.har/launch.sh <id>`:
+After `har env launch <id>`:
 
 ```bash
 ./.har/stages/browser-e2e.sh <id>
 # included in:
-./.har/verify.sh <id> --full
+har env verify <id> --full
 ```
 
 Adapt selectors and paths in the scaffold specs during harness adaptation.

package/dist/templates/plugins/playwright/.har/stages/browser-e2e.sh

@@ -3,7 +3,7 @@
 # Outputs JSON to stdout, human-readable progress to stderr.
 #
 # Usage: ./.har/stages/browser-e2e.sh <agent-id>
-# Prerequisite: ./.har/launch.sh <agent-id>
+# Prerequisite: har env launch <agent-id>
 set -euo pipefail
 
 # 1.0 stage surface: the runner exports WORK_DIR, ENV_FILE, AGENT_ID and
@@ -17,8 +17,8 @@ now_ms() { node -e 'process.stdout.write(String(Date.now()))'; }
 
 log() { echo "==> [browser-e2e agent-$AGENT_ID] $*" >&2; }
 
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 FE_PORT="${FE_PORT:-$(( HARNESS_FE_BASE_PORT + AGENT_ID * 10 ))}"
 API_PORT="${API_PORT:-$(( HARNESS_API_BASE_PORT + AGENT_ID * 10 ))}"
 

package/dist/templates/plugins/playwright/README.md

@@ -7,7 +7,7 @@ This plugin was added by `har env add-plugin playwright`. It registers a `browse
 ```bash
 npm install
 npx playwright install
-./.har/launch.sh 1
+har env launch 1
 ./.har/stages/browser-e2e.sh 1
 ```
 

package/dist/templates/plugins/playwright/playwright.config.js

@@ -4,14 +4,14 @@
 // -------------------
 // - Stage id: `browser-e2e` (`.har/stages/browser-e2e.sh`, registered in `stages.json`).
 // - Runs automatically on FULL verify only — not on quick verify:
-//     ./.har/verify.sh <id> --full
+//     har env verify <id> --full
 //     har env verify <id> --full
 //     har env complete <id>          # always full; required before declaring done
 // - Quick verify (`verify.sh <id>`) stops at typecheck / unit tests / api-health.
 //
 // Prerequisites
 // -------------
-// 1. Launch a slot first:     ./.har/launch.sh <id>
+// 1. Launch a slot first:     har env launch <id>
 // 2. Install browsers once:     npx playwright install chromium
 //
 // Environment (injected by browser-e2e.sh — never hardcode slot ports in specs)

package/dist/templates/plugins/playwright/template.manifest.json

@@ -67,7 +67,7 @@
   "nextSteps": [
     "npm install",
     "npx playwright install",
-    "./.har/launch.sh 1",
+    "har env launch 1",
     "./.har/stages/browser-e2e.sh 1",
     "npx playwright show-report .har/artifacts/browser-e2e/playwright-report"
   ],

package/dist/templates/plugins/rocketsim/.har/stages/ROCKETSIM.md

@@ -111,7 +111,7 @@ fi
 ./.har/stages/rocketsim-flows.sh 1 example-smoke
 
 # Included in full verify
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```
 
 Screenshots and per-flow logs are saved under `.har/artifacts/rocketsim-flows/`.

package/dist/templates/plugins/rocketsim/.har/stages/rocketsim-flows.sh

@@ -6,7 +6,7 @@
 # Usage: ./.har/stages/rocketsim-flows.sh <agent-id> [flow-name]
 #   flow-name (optional): run only flows/<flow-name>.sh instead of all flows
 #
-# Prerequisite: ./.har/launch.sh <agent-id> AND app installed+running on simulator
+# Prerequisite: har env launch <agent-id> AND app installed+running on simulator
 # See: ./.har/stages/ROCKETSIM.md for the full authoring guide.
 set -euo pipefail
 
@@ -38,8 +38,8 @@ if ! rocketsim doctor --quiet 2>/dev/null; then
 fi
 
 # ── Resolve agent env ─────────────────────────────────────────────────────────
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 
 # ── Discover flows ─────────────────────────────────────────────────────────────
 FLOWS_DIR="$WORK_DIR/flows"

package/dist/templates/plugins/rocketsim/README.md

@@ -62,5 +62,5 @@ cp flows/example-smoke.sh flows/my-feature.sh
 ./.har/stages/rocketsim-flows.sh 1
 
 # 7. Validate everything
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```

package/dist/templates/plugins/rocketsim/flows/example-smoke.sh

@@ -20,7 +20,7 @@ log() { echo "==> [example-smoke] $*" >&2; }
 log "Checking simulator focus..."
 FOCUSED=$(rocketsim simulator focused 2>/dev/null || echo "")
 if [ -z "$FOCUSED" ]; then
-  log "✗ No focused simulator — run ./.har/setup-infra.sh first"
+  log "✗ No focused simulator — run har env setup-infra first"
   exit 1
 fi
 log "Simulator: $(echo "$FOCUSED" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const j=JSON.parse(d);process.stdout.write(j.name||d.trim());}catch{process.stdout.write(d.trim());}})" 2>/dev/null || echo "$FOCUSED")"

package/dist/templates/plugins/rocketsim/template.manifest.json

@@ -41,7 +41,7 @@
   ],
   "nextSteps": [
     "rocketsim doctor",
-    "./.har/launch.sh 1",
+    "har env launch 1",
     "Build and install your app on the simulator",
     "./.har/stages/rocketsim-flows.sh 1",
     "Open .har/artifacts/rocketsim-flows/ for screenshots and per-flow results",

package/dist/templates/plugins/semgrep/.har/stages/SEMGREP.md

@@ -14,7 +14,7 @@ runs it automatically once it is listed in `verificationStages`.
 ./.har/stages/sast.sh 1 src/ lib/auth.py
 
 # Included in full verify
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```
 
 Reports land under `.har/artifacts/sast/` in the **main repo root** (not the worktree):

package/dist/templates/plugins/semgrep/.har/stages/sast.sh

@@ -11,7 +11,7 @@
 #   .har/harness.env to pin rulesets. Registry configs (auto, p/...) need
 #   network access and send pseudonymized metrics to semgrep.dev.
 #
-# Prerequisite: ./.har/launch.sh <agent-id> AND the semgrep CLI installed
+# Prerequisite: har env launch <agent-id> AND the semgrep CLI installed
 # See: ./.har/stages/SEMGREP.md for the full adaptation guide.
 set -euo pipefail
 
@@ -44,8 +44,8 @@ fi
 # Artifacts land in the main repo root (where .har/ lives), not the worktree.
 MAIN_REPO_ROOT="$REPO_ROOT"
 
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 
 # ── Artifact directory (main repo root, not the worktree) ─────────────────────
 ARTIFACT_DIR="$MAIN_REPO_ROOT/.har/artifacts/sast"

package/dist/templates/plugins/semgrep/README.md

@@ -50,8 +50,8 @@ evidence. See `.har/stages/SEMGREP.md` for the full story.
 
 ```bash
 pipx install semgrep
-./.har/launch.sh 1
+har env launch 1
 ./.har/stages/sast.sh 1
 # reports: .har/artifacts/sast/semgrep.json (+ .sarif, scan.log)
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```

package/dist/templates/plugins/semgrep/template.manifest.json

@@ -43,7 +43,7 @@
   ],
   "nextSteps": [
     "pipx install semgrep   # or: pip install semgrep / brew install semgrep",
-    "./.har/launch.sh 1",
+    "har env launch 1",
     "./.har/stages/sast.sh 1",
     "Open .har/artifacts/sast/ for the JSON and SARIF reports",
     "Read .har/stages/SEMGREP.md to pin rulesets (HARNESS_SEMGREP_CONFIG) or add local rules",

package/dist/templates/plugins/trivy/.har/stages/TRIVY.md

@@ -84,5 +84,5 @@ produce the evidence.
 
 ```bash
 ./.har/stages/vuln-scan.sh 1        # standalone
-./.har/verify.sh 1 --full           # as part of full verification
+har env verify 1 --full           # as part of full verification
 ```

package/dist/templates/plugins/trivy/.har/stages/vuln-scan.sh

@@ -12,7 +12,7 @@
 #   TRIVY_CACHE_DIR         vulnerability DB cache (default: ~/.cache/trivy —
 #                           shared across slots so the DB downloads once)
 #
-# Prerequisite: ./.har/launch.sh <agent-id>
+# Prerequisite: har env launch <agent-id>
 # See: ./.har/stages/TRIVY.md for the full adaptation guide.
 set -euo pipefail
 
@@ -39,8 +39,8 @@ if ! command -v trivy >/dev/null 2>&1; then
 fi
 
 # ── Resolve agent env ─────────────────────────────────────────────────────────
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 
 # ── Configuration ─────────────────────────────────────────────────────────────
 SEVERITY="${HARNESS_TRIVY_SEVERITY:-HIGH,CRITICAL}"

package/dist/templates/plugins/trivy/template.manifest.json

@@ -47,7 +47,7 @@
   ],
   "nextSteps": [
     "Install trivy: brew install trivy (or https://trivy.dev/latest/getting-started/installation/)",
-    "./.har/launch.sh 1",
+    "har env launch 1",
     "./.har/stages/vuln-scan.sh 1",
     "Open .har/artifacts/vuln-scan/summary.txt for findings",
     "Tune HARNESS_TRIVY_SEVERITY / HARNESS_TRIVY_SCANNERS in .har/harness.env — read .har/stages/TRIVY.md"

package/dist/templates/profiles/cli/docs/{claude-agent → readme}/definition-of-done.md

@@ -1,12 +1,12 @@
 ## Definition of done
 
-- [ ] Full verification returns `"status": "pass"` (`har env verify ${AGENT_ID} --full`, MCP `har_run_verification` with `full: true`, or `./.har/verify.sh ${AGENT_ID} --full`)
+- [ ] Full verification returns `"status": "pass"` (`har env verify <id> --full`, MCP `har_run_verification` with `full: true`, or `har env verify <id> --full`)
 - [ ] The slot is agent-usable for this repo's documented smoke workflow when runtime services are involved
 - [ ] Full verify runs every registered stage in `stages.json` `verificationStages` (Playwright, custom checks, …) — when `stages/browser-e2e.sh` exists, adapt specs under `tests/` for UI changes
 - [ ] New behavior has automated test coverage
 - [ ] Changes committed **in the session worktree** with a clear message
 - [ ] Present session handoff (summary, branch, preview URLs) and **wait for user** before `complete`, push, or PR
-- [ ] On user approval of the default: push + open PR (when `gh`/GitHub MCP available), then `har env complete ${AGENT_ID}` (or MCP `har_complete_environment`) — full verify + validation + teardown, branch kept
+- [ ] On user approval of the default: push + open PR (when `gh`/GitHub MCP available), then `har env complete <id>` (or MCP `har_complete_environment`) — full verify + validation + teardown, branch kept
 
 ### Session handoff
 
@@ -18,6 +18,6 @@ else as alternatives. If PR tooling is unavailable, recommend complete and repor
 the session branch for a manual push. Prefer `complete` over bare `teardown` when
 the work succeeded. See `.cursor/rules/har-workflow.mdc` for the handoff shape.
 
-Quick loop: MCP `har_run_verification`, `har env verify ${AGENT_ID}`, or `./.har/verify.sh ${AGENT_ID}`
+Quick loop: MCP `har_run_verification`, `har env verify <id>`, or `har env verify <id>`
 
 Stages are the harness's single vocabulary for checks: templates and custom stages compile to generic kinds in `.har/stages.json`, and you interact with them only through the registry (`har_run_stage`, `verify`), never stack-specific tooling. Authoring guide: `.har/STAGES.md`.

package/dist/templates/profiles/cli/docs/{claude-agent → readme}/do-not.md

@@ -1,6 +1,6 @@
 ## Do not
 
 - Work around a failing harness command with ad-hoc setup — fix the harness or report the failure
-- Edit `.env.agent.${AGENT_ID}` by hand
+- Edit `.env.agent.<id>` by hand
 - Run `verify` before `launch` when e2e needs a running server
 - Edit the main checkout — all edits go under the session work dir

package/dist/templates/profiles/cli/docs/{claude-agent → readme}/environment.md

@@ -2,11 +2,11 @@
 
 | | |
 |--|--|
-| **Agent ID** | ${AGENT_ID} |
-| **Work dir** | Fresh session worktree per launch — see the launch output or `.har/slots/agent-${AGENT_ID}.json` |
+| **Agent ID** | <id> |
+| **Work dir** | Fresh session worktree per launch — see the launch output or `.har/slots/agent-<id>.json` |
 
 **Never edit the main checkout** — launch FIRST, then make ALL file edits under the work dir from the launch output. An occupied slot always blocks a new launch — run `har env teardown <id>` (or `complete <id>`) first, then launch again.
 
 ```bash
-./.har/agent-cli.sh ${AGENT_ID} status
+har env agent <id> status
 ```

package/dist/templates/profiles/cli/docs/readme/for-coding-agents.md

@@ -1,9 +1,7 @@
 ## For coding agents
 
-**Start here:** read [`AGENTS.md`](../AGENTS.md) at the repo root for a short pointer, then [`.har/CLAUDE.agent.md`](./CLAUDE.agent.md) for full instructions.
-
-Prefer HAR MCP tools or `har env …` for launch, verify, and teardown. Use `./.har/*.sh` only when the CLI is not installed.
-
-Work in the isolated git worktree created by launch. Use `./.har/agent-cli.sh <id> exec ...` to run ad-hoc project commands in that work dir.
-
-When the project needs Postgres, Redis, or similar, add the service to `docker-compose.agent.yml` (or keep one from the menu), list it in `HARNESS_INFRA_SERVICES` in `harness.env`, and use `setup-infra.sh` — never run raw `docker compose` for shared infra. Shared services run once on fixed ports and serve every agent slot.
+1. Read repo [`AGENTS.md`](../AGENTS.md)
+2. Read this file and `stages.json` — this file is the harness reference:
+   slot environment, readiness, definition of done, project commands
+3. Drive the harness with HAR MCP tools or `har env …`; never hardcode ports —
+   ask `har env agent <id> url`

package/dist/templates/profiles/cli/docs/readme/port-shared-services-cli-profile.md

@@ -9,17 +9,17 @@ This profile has **no PM2 app ports** — agents run project commands directly i
 | Shared Postgres | Per machine | `HARNESS_DB_PORT_DEFAULT` | Scan `HARNESS_DB_PORT_SCAN_START..END` |
 | Other compose services | Per machine | `HARNESS_*_PORT_DEFAULT` for that service | Scan configured ranges in `harness.env` |
 
-When a repo adds a local HTTP server for integration tests, prefer reading ports from `.env.agent.<id>` or `./.har/agent-cli.sh <id>` rather than hardcoding values.
+When a repo adds a local HTTP server for integration tests, prefer reading ports from `.env.agent.<id>` or `har env agent <id>` rather than hardcoding values.
 
 ### Shared vs per-slot
 
 | Resource | Model | Configuration |
 |----------|-------|---------------|
 | Postgres / Redis / mail / … | One shared container on a scanned host port | `HARNESS_INFRA_SERVICES` + matching vars in `harness.env` |
-| Per-slot databases | Cloned from template DB when `db` is enabled | `launch.sh` |
+| Per-slot databases | Cloned from template DB when `db` is enabled | `har env launch` |
 | Application code | Isolated git worktree per slot | `HARNESS_USE_WORKTREE=true` |
 
 ### Do not
 
 - Hardcode `15432` or other default infra ports in tests — read `AGENT_DB_PORT` from `.env.agent.<id>` or `har_pg`
-- Run raw `docker compose` for harness infrastructure — use `setup-infra.sh`
+- Run raw `docker compose` for harness infrastructure — use `har env setup-infra`