@osfactory/har 1.0.0 → 1.2.0

package/dist/templates/plugins/gitleaks/template.manifest.json

@@ -43,7 +43,7 @@
   ],
   "nextSteps": [
     "Install gitleaks: brew install gitleaks — or a release binary from https://github.com/gitleaks/gitleaks/releases",
-    "./.har/launch.sh 1",
+    "har env launch 1",
     "./.har/stages/secrets-scan.sh 1",
     "Open .har/artifacts/secrets-scan/report.json for findings (secrets are redacted)",
     "Tune allowlists in .gitleaks.toml — read .har/stages/GITLEAKS.md for the adaptation guide"

package/dist/templates/plugins/kerno/.github/workflows/kerno.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Install Kerno CLI
         run: npm install -g @kerno/cli
       # - name: Start the app (adapt for your stack) and migrate/seed its database
-      #   run: ./.har/launch.sh 1 && <start your app in the slot>
+      #   run: har env launch 1 && <start your app in the slot>
       # - name: Bind a Kerno agent to this checkout
       #   run: kerno init
       # - name: Run backend validation

package/dist/templates/plugins/kerno/.har/stages/KERNO.md

@@ -47,7 +47,7 @@ concurrently across slots.
 
 ## Configuration the stage reads
 
-All values come from the slot's `.env.agent.<id>` (written by `launch.sh`) and `~/.kerno/agent.port`:
+All values come from the slot's `.env.agent.<id>` (written by `har env launch`) and `~/.kerno/agent.port`:
 
 | Value | Source | Used for |
 |-------|--------|----------|
@@ -101,7 +101,7 @@ Under `.har/artifacts/backend-validation/`:
 ./.har/stages/backend-validation.sh 1
 
 # As part of full verify
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```
 
 ## Adapting per repo

package/dist/templates/plugins/kerno/.har/stages/backend-validation.sh

@@ -4,7 +4,7 @@
 # via the local Kerno agent's REST API. Outputs JSON to stdout, progress to stderr.
 #
 # Usage: ./.har/stages/backend-validation.sh <agent-id>
-# Prerequisite: ./.har/launch.sh <agent-id>, the app running in the slot, AND a Kerno
+# Prerequisite: har env launch <agent-id>, the app running in the slot, AND a Kerno
 #   agent started with `kerno init` in THIS worktree (Kerno allows ONE agent per machine).
 # See: ./.har/stages/KERNO.md for the full setup + adaptation guide.
 set -euo pipefail
@@ -76,8 +76,8 @@ fi
 trap cleanup EXIT
 
 # ── Resolve agent env + slot target ───────────────────────────────────────────
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 
 # SUT URL: prefer an explicit override, then the app's own SITE_URL (both the default
 # web profile and single-port apps like Next.js set SITE_URL to the running app), then a

package/dist/templates/plugins/kerno/README.md

@@ -55,13 +55,13 @@ kerno init                       # run inside the slot worktree
 ls .kerno/scenarios/endpoints/
 
 # 4. Launch the slot and start your app
-./.har/launch.sh 1
+har env launch 1
 
 # 5. Run backend validation
 ./.har/stages/backend-validation.sh 1
 
 # 6. Validate everything
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```
 
 Per-endpoint run responses and verdicts land in `.har/artifacts/backend-validation/`.

package/dist/templates/plugins/kerno/template.manifest.json

@@ -49,7 +49,7 @@
     "npm install -g @kerno/cli",
     "kerno init                       # bind the single Kerno agent to THIS worktree",
     "Ask your Kerno agent to generate a scenario suite (or ensure .kerno/scenarios/ is committed)",
-    "./.har/launch.sh 1               # then start your app in the slot",
+    "har env launch 1               # then start your app in the slot",
     "./.har/stages/backend-validation.sh 1",
     "Open .har/artifacts/backend-validation/ for verdicts and per-endpoint run responses"
   ],

package/dist/templates/plugins/playwright/.har/stages/PLAYWRIGHT.md

@@ -10,12 +10,12 @@ Adapt specs under `tests/` for your application. Full verification (`verify --fu
 
 ## Run
 
-After `./.har/launch.sh <id>`:
+After `har env launch <id>`:
 
 ```bash
 ./.har/stages/browser-e2e.sh <id>
 # included in:
-./.har/verify.sh <id> --full
+har env verify <id> --full
 ```
 
 Adapt selectors and paths in the scaffold specs during harness adaptation.

package/dist/templates/plugins/playwright/.har/stages/browser-e2e.sh

@@ -3,7 +3,7 @@
 # Outputs JSON to stdout, human-readable progress to stderr.
 #
 # Usage: ./.har/stages/browser-e2e.sh <agent-id>
-# Prerequisite: ./.har/launch.sh <agent-id>
+# Prerequisite: har env launch <agent-id>
 set -euo pipefail
 
 # 1.0 stage surface: the runner exports WORK_DIR, ENV_FILE, AGENT_ID and
@@ -17,8 +17,8 @@ now_ms() { node -e 'process.stdout.write(String(Date.now()))'; }
 
 log() { echo "==> [browser-e2e agent-$AGENT_ID] $*" >&2; }
 
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 FE_PORT="${FE_PORT:-$(( HARNESS_FE_BASE_PORT + AGENT_ID * 10 ))}"
 API_PORT="${API_PORT:-$(( HARNESS_API_BASE_PORT + AGENT_ID * 10 ))}"
 

package/dist/templates/plugins/playwright/README.md

@@ -7,7 +7,7 @@ This plugin was added by `har env add-plugin playwright`. It registers a `browse
 ```bash
 npm install
 npx playwright install
-./.har/launch.sh 1
+har env launch 1
 ./.har/stages/browser-e2e.sh 1
 ```
 

package/dist/templates/plugins/playwright/playwright.config.js

@@ -4,14 +4,14 @@
 // -------------------
 // - Stage id: `browser-e2e` (`.har/stages/browser-e2e.sh`, registered in `stages.json`).
 // - Runs automatically on FULL verify only — not on quick verify:
-//     ./.har/verify.sh <id> --full
+//     har env verify <id> --full
 //     har env verify <id> --full
 //     har env complete <id>          # always full; required before declaring done
 // - Quick verify (`verify.sh <id>`) stops at typecheck / unit tests / api-health.
 //
 // Prerequisites
 // -------------
-// 1. Launch a slot first:     ./.har/launch.sh <id>
+// 1. Launch a slot first:     har env launch <id>
 // 2. Install browsers once:     npx playwright install chromium
 //
 // Environment (injected by browser-e2e.sh — never hardcode slot ports in specs)

package/dist/templates/plugins/playwright/template.manifest.json

@@ -67,7 +67,7 @@
   "nextSteps": [
     "npm install",
     "npx playwright install",
-    "./.har/launch.sh 1",
+    "har env launch 1",
     "./.har/stages/browser-e2e.sh 1",
     "npx playwright show-report .har/artifacts/browser-e2e/playwright-report"
   ],

package/dist/templates/plugins/rocketsim/.har/stages/ROCKETSIM.md

@@ -111,7 +111,7 @@ fi
 ./.har/stages/rocketsim-flows.sh 1 example-smoke
 
 # Included in full verify
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```
 
 Screenshots and per-flow logs are saved under `.har/artifacts/rocketsim-flows/`.

package/dist/templates/plugins/rocketsim/.har/stages/rocketsim-flows.sh

@@ -6,7 +6,7 @@
 # Usage: ./.har/stages/rocketsim-flows.sh <agent-id> [flow-name]
 #   flow-name (optional): run only flows/<flow-name>.sh instead of all flows
 #
-# Prerequisite: ./.har/launch.sh <agent-id> AND app installed+running on simulator
+# Prerequisite: har env launch <agent-id> AND app installed+running on simulator
 # See: ./.har/stages/ROCKETSIM.md for the full authoring guide.
 set -euo pipefail
 
@@ -38,8 +38,8 @@ if ! rocketsim doctor --quiet 2>/dev/null; then
 fi
 
 # ── Resolve agent env ─────────────────────────────────────────────────────────
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 
 # ── Discover flows ─────────────────────────────────────────────────────────────
 FLOWS_DIR="$WORK_DIR/flows"

package/dist/templates/plugins/rocketsim/README.md

@@ -62,5 +62,5 @@ cp flows/example-smoke.sh flows/my-feature.sh
 ./.har/stages/rocketsim-flows.sh 1
 
 # 7. Validate everything
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```

package/dist/templates/plugins/rocketsim/flows/example-smoke.sh

@@ -20,7 +20,7 @@ log() { echo "==> [example-smoke] $*" >&2; }
 log "Checking simulator focus..."
 FOCUSED=$(rocketsim simulator focused 2>/dev/null || echo "")
 if [ -z "$FOCUSED" ]; then
-  log "✗ No focused simulator — run ./.har/setup-infra.sh first"
+  log "✗ No focused simulator — run har env setup-infra first"
   exit 1
 fi
 log "Simulator: $(echo "$FOCUSED" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const j=JSON.parse(d);process.stdout.write(j.name||d.trim());}catch{process.stdout.write(d.trim());}})" 2>/dev/null || echo "$FOCUSED")"

package/dist/templates/plugins/rocketsim/template.manifest.json

@@ -41,7 +41,7 @@
   ],
   "nextSteps": [
     "rocketsim doctor",
-    "./.har/launch.sh 1",
+    "har env launch 1",
     "Build and install your app on the simulator",
     "./.har/stages/rocketsim-flows.sh 1",
     "Open .har/artifacts/rocketsim-flows/ for screenshots and per-flow results",

package/dist/templates/plugins/semgrep/.har/stages/SEMGREP.md

@@ -14,7 +14,7 @@ runs it automatically once it is listed in `verificationStages`.
 ./.har/stages/sast.sh 1 src/ lib/auth.py
 
 # Included in full verify
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```
 
 Reports land under `.har/artifacts/sast/` in the **main repo root** (not the worktree):

package/dist/templates/plugins/semgrep/.har/stages/sast.sh

@@ -11,7 +11,7 @@
 #   .har/harness.env to pin rulesets. Registry configs (auto, p/...) need
 #   network access and send pseudonymized metrics to semgrep.dev.
 #
-# Prerequisite: ./.har/launch.sh <agent-id> AND the semgrep CLI installed
+# Prerequisite: har env launch <agent-id> AND the semgrep CLI installed
 # See: ./.har/stages/SEMGREP.md for the full adaptation guide.
 set -euo pipefail
 
@@ -44,8 +44,8 @@ fi
 # Artifacts land in the main repo root (where .har/ lives), not the worktree.
 MAIN_REPO_ROOT="$REPO_ROOT"
 
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 
 # ── Artifact directory (main repo root, not the worktree) ─────────────────────
 ARTIFACT_DIR="$MAIN_REPO_ROOT/.har/artifacts/sast"

package/dist/templates/plugins/semgrep/README.md

@@ -50,8 +50,8 @@ evidence. See `.har/stages/SEMGREP.md` for the full story.
 
 ```bash
 pipx install semgrep
-./.har/launch.sh 1
+har env launch 1
 ./.har/stages/sast.sh 1
 # reports: .har/artifacts/sast/semgrep.json (+ .sarif, scan.log)
-./.har/verify.sh 1 --full
+har env verify 1 --full
 ```

package/dist/templates/plugins/semgrep/template.manifest.json

@@ -43,7 +43,7 @@
   ],
   "nextSteps": [
     "pipx install semgrep   # or: pip install semgrep / brew install semgrep",
-    "./.har/launch.sh 1",
+    "har env launch 1",
     "./.har/stages/sast.sh 1",
     "Open .har/artifacts/sast/ for the JSON and SARIF reports",
     "Read .har/stages/SEMGREP.md to pin rulesets (HARNESS_SEMGREP_CONFIG) or add local rules",

package/dist/templates/plugins/trivy/.har/stages/TRIVY.md

@@ -84,5 +84,5 @@ produce the evidence.
 
 ```bash
 ./.har/stages/vuln-scan.sh 1        # standalone
-./.har/verify.sh 1 --full           # as part of full verification
+har env verify 1 --full           # as part of full verification
 ```

package/dist/templates/plugins/trivy/.har/stages/vuln-scan.sh

@@ -12,7 +12,7 @@
 #   TRIVY_CACHE_DIR         vulnerability DB cache (default: ~/.cache/trivy —
 #                           shared across slots so the DB downloads once)
 #
-# Prerequisite: ./.har/launch.sh <agent-id>
+# Prerequisite: har env launch <agent-id>
 # See: ./.har/stages/TRIVY.md for the full adaptation guide.
 set -euo pipefail
 
@@ -39,8 +39,8 @@ if ! command -v trivy >/dev/null 2>&1; then
 fi
 
 # ── Resolve agent env ─────────────────────────────────────────────────────────
-ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
-WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run ./.har/launch.sh ${AGENT_ID} first}"
+ENV_FILE="${ENV_FILE:?No slot env for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
+WORK_DIR="${WORK_DIR:?No slot work dir for agent ${AGENT_ID} — run har env launch ${AGENT_ID} first}"
 
 # ── Configuration ─────────────────────────────────────────────────────────────
 SEVERITY="${HARNESS_TRIVY_SEVERITY:-HIGH,CRITICAL}"

package/dist/templates/plugins/trivy/template.manifest.json

@@ -47,7 +47,7 @@
   ],
   "nextSteps": [
     "Install trivy: brew install trivy (or https://trivy.dev/latest/getting-started/installation/)",
-    "./.har/launch.sh 1",
+    "har env launch 1",
     "./.har/stages/vuln-scan.sh 1",
     "Open .har/artifacts/vuln-scan/summary.txt for findings",
     "Tune HARNESS_TRIVY_SEVERITY / HARNESS_TRIVY_SCANNERS in .har/harness.env — read .har/stages/TRIVY.md"

package/dist/templates/profiles/cli/docs/readme/quick-start.md

@@ -11,8 +11,7 @@ har env teardown 1
 
 In Cursor with HAR MCP configured: use `har_launch_environment`, `har_run_verification`, and `har_teardown_environment`.
 
-`./.har/*.sh` exist as compatibility shims over the same runtime — generated,
-never edited, and not the way to drive the harness. Take explicit ownership of
-them with `har env eject`.
+CLI and MCP are the only entry points. `har env eject` vendors the runtime into
+`.har/runtime/` for offline ownership (`node .har/runtime/har.cjs env …`).
 
 Read **`stages.json`** and **`verificationStages`**. Optional: `har env add-plugin playwright`.

package/dist/templates/profiles/cli/docs/readme/verification-contract.md

@@ -1,13 +1,13 @@
 ## Verification contract
 
 Steps in `har env verify` are **project-specific examples** — adapt them to your stack
-during `har env init` / `har env maintain` / benchmark setup. The table describes
+during scaffold / `har env maintain` / benchmark setup. The table describes
 each tier's intent, not a fixed command list.
 
 | Mode | Command | Typical steps |
 |------|---------|---------------|
-| Quick | `har env verify <id>` or `verify.sh <id>` | Stock ecosystem smoke: compile / import / build conventions |
-| Full | `har env verify <id> --full` or `verify.sh <id> --full` | Stock conventional tests/lint + optional readiness smoke, **browser-e2e** when `stages/browser-e2e.sh` exists |
+| Quick | `har env verify <id>` | Stock ecosystem smoke: compile / import / build conventions |
+| Full | `har env verify <id> --full` | Stock conventional tests/lint + optional readiness smoke, **browser-e2e** when `stages/browser-e2e.sh` exists |
 
 The stock commands are deliberately generic conventions keyed by
 `HARNESS_ECOSYSTEM`. Replace them with the repository's real commands during

package/dist/templates/profiles/cli/docs/readme/what-s-in-here.md

@@ -15,11 +15,10 @@
 | `STAGES.md` | Stage registry and script-contract guide |
 | `justfile` | Optional shortcuts (requires `just`) |
 
-**Generated shims and state** (don't edit — `har env eject` for full ownership):
+**Generated state** (don't edit — `har env eject` vendors `.har/runtime/`):
 
 | File | Purpose |
 |------|---------|
-| `har env launch` / `har env verify` / `har env teardown` / `har env setup-infra` / `preflight.sh` / `agent-cli.sh` | Thin shims forwarding to the packaged runtime (`har env …`); same run records on every surface |
 | `manifest.json` | Runtime version, profile, checksums — managed by the har CLI |
 | `runs/` | Run history from every entry point — `.har/runs/YYYY-MM-DD/HH-mm-ss_<stageId>_agent-<id>.json` (gitignored) |
 | `artifacts/` | Stage outputs: reports, traces, logs |

package/dist/templates/profiles/default/docs/readme/quick-start.md

@@ -11,8 +11,7 @@ har env teardown 1
 
 In Cursor with HAR MCP configured: use `har_launch_environment`, `har_run_verification`, and `har_teardown_environment`.
 
-`./.har/*.sh` exist as compatibility shims over the same runtime — generated,
-never edited, and not the way to drive the harness. Take explicit ownership of
-them with `har env eject`.
+CLI and MCP are the only entry points. `har env eject` vendors the runtime into
+`.har/runtime/` for offline ownership (`node .har/runtime/har.cjs env …`).
 
 Read **`stages.json`** for registered stages and **`verificationStages`** for the expected pass set.

package/dist/templates/profiles/default/docs/readme/verification-contract.md

@@ -1,13 +1,13 @@
 ## Verification contract
 
 Steps in `har env verify` are **project-specific examples** — adapt them to your stack
-during `har env init` / `har env maintain`. The table describes each tier's intent,
+during scaffold / `har env maintain`. The table describes each tier's intent,
 not a fixed command list.
 
 | Mode | Command | Typical steps |
 |------|---------|---------------|
-| Quick | `har env verify <id>` or `verify.sh <id>` | Stock ecosystem smoke + health (stops early on failure) |
-| Full | `har env verify <id> --full` or `verify.sh <id> --full` | Stock conventional tests/lint, optional readiness smoke + **`browser-e2e`** when `.har/stages/browser-e2e.sh` exists |
+| Quick | `har env verify <id>` | Stock ecosystem smoke + health (stops early on failure) |
+| Full | `har env verify <id> --full` | Stock conventional tests/lint, optional readiness smoke + **`browser-e2e`** when `.har/stages/browser-e2e.sh` exists |
 
 The stock commands are deliberately generic conventions keyed by
 `HARNESS_ECOSYSTEM`. Replace them with the repository's real commands during

package/dist/templates/profiles/default/docs/readme/what-s-in-here.md

@@ -18,11 +18,10 @@
 | `STAGES.md` | Stage registry and script-contract guide |
 | `justfile` | Optional shortcuts (requires `just`) |
 
-**Generated shims and state** (don't edit — `har env eject` for full ownership):
+**Generated state** (don't edit — `har env eject` vendors `.har/runtime/`):
 
 | File | Purpose |
 |------|---------|
-| `har env launch` / `har env verify` / `har env teardown` / `har env setup-infra` / `preflight.sh` / `agent-cli.sh` / `attach.sh` | Thin shims forwarding to the packaged runtime (`har env …`); same run records on every surface |
 | `manifest.json` | Runtime version, profile, checksums — managed by the har CLI |
 | `runs/` | Run history from every entry point — `.har/runs/YYYY-MM-DD/HH-mm-ss_<stageId>_agent-<id>.json` (gitignored) |
 | `artifacts/` | Stage outputs: reports, traces, screenshots, logs |

package/dist/templates/profiles/ios/docs/readme/quick-start.md

@@ -11,6 +11,5 @@ har env teardown 1
 
 In Cursor with HAR MCP configured: use `har_launch_environment`, `har_run_verification`, and `har_teardown_environment`.
 
-`./.har/*.sh` exist as compatibility shims over the same runtime — generated,
-never edited, and not the way to drive the harness. Take explicit ownership of
-them with `har env eject`.
+CLI and MCP are the only entry points. `har env eject` vendors the runtime into
+`.har/runtime/` for offline ownership (`node .har/runtime/har.cjs env …`).

package/dist/templates/profiles/ios/docs/readme/what-s-in-here.md

@@ -15,11 +15,10 @@
 | `STAGES.md` | Stage registry and script-contract guide |
 | `justfile` | Optional shortcuts (requires `just`) |
 
-**Generated shims and state** (don't edit — `har env eject` for full ownership):
+**Generated state** (don't edit — `har env eject` vendors `.har/runtime/`):
 
 | File | Purpose |
 |------|---------|
-| `har env launch` / `har env verify` / `har env teardown` / `har env setup-infra` / `preflight.sh` / `agent-cli.sh` | Thin shims forwarding to the packaged runtime (`har env …`); same run records on every surface |
 | `manifest.json` | Runtime version, profile, checksums — managed by the har CLI |
 | `runs/` | Run history from every entry point — `.har/runs/YYYY-MM-DD/HH-mm-ss_<stageId>_agent-<id>.json` (gitignored) |
 | `artifacts/` | Stage outputs: test results, screenshots, logs |

package/dist/templates/runtime-bundles/shared-kernel/STAGES.md

@@ -67,7 +67,7 @@ Every script under `.har/stages/` must:
 2. Take the agent slot id as `$1`, falling back to the exported `AGENT_ID`
    (`AGENT_ID="${1:-${AGENT_ID:?...}}"`); extra args may follow.
 3. Guard the runner contract with `${ENV_FILE:?...}` / `${WORK_DIR:?...}`
-   (pointing at `./.har/launch.sh <id>`) and run checks from `$WORK_DIR`.
+   (pointing at `har env launch <id>`) and run checks from `$WORK_DIR`.
 4. Write artifacts (reports, screenshots, logs) under `.har/artifacts/<id>/`.
 5. Print **only** the normalized JSON result object on stdout
    (`status`, `stageId`, `agent_id`, `total_ms`, …); log progress to stderr.

package/dist/templates/runtime-bundles/shared-kernel/lib/verify-runner.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Verification runner: executes the stages.json verification plan.
-// Invoked by .har/verify.sh after it sources harness.env and the agent env
+// Invoked by `har env verify` after it sources harness.env and the agent env
 // file (so the full slot environment is inherited). Replaces the bash
 // run_step/run_http_step/RESULTS_JSON plumbing: step names may contain any
 // characters, no result is ever silently dropped, and stage env vars are

package/dist/templates/shared-docs/readme/maintaining-this-harness.md

@@ -9,6 +9,6 @@ har env maintain
 The authoring agent reconciles the config surface and this README. Review changes before committing.
 
 Customize through the contract — config (`harness.env`), stages (`stages.json` +
-`stages/`), hooks (`hooks/`), plugins (`plugins/`). The `*.sh` files are generated
-shims over the packaged runtime: don't edit them (`har env eject` exists for full
-ownership). `har env doctor` validates the result.
+`stages/`), hooks (`hooks/`), plugins (`plugins/`). Drive the harness with
+`har env …` or MCP. `har env eject` vendors `.har/runtime/` for offline ownership.
+`har env doctor` validates the result.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@osfactory/har",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "HAR: open agent harness CLI and MCP server for coding agents, isolated worktrees, and software-factory workflows",
   "keywords": [
     "har",

package/dist/templates/runtime-bundles/pm2-runtime/attach.sh

@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-# Attach to the tmux session for an agent.
-# The runtime lives in the HAR package (#234) — this file only forwards to it.
-# Usage: ./.har/attach.sh <agent-id>
-set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-# Loop guard (#291): a pre-1.0 har does not own this runtime kind in the
-# package — it executes this script as authoritative, which would exec back
-# into har forever (one node process per cycle). Trip on re-entry for this
-# harness root, and skip har binaries older than the pinned runtime (#298).
-HAR_SHIM_GUARD="attach@${REPO_ROOT}"
-case ":${HAR_SHIM_REENTRY:-}:" in *":${HAR_SHIM_GUARD}:"*)
-  echo "Error: runtime loop detected — the har CLI that ran this shim delegated back into it." >&2
-  echo "  The har runtime handling this repo is older than the harness contract (pinned: @osfactory/har@__HAR_VERSION__)." >&2
-  echo "  Fix: npm i -g @osfactory/har@latest    # or in this repo: npm i -D @osfactory/har" >&2
-  exit 86
-  ;;
-esac
-export HAR_SHIM_REENTRY="${HAR_SHIM_REENTRY:-}:${HAR_SHIM_GUARD}"
-# True when $1 reports a version >= the pinned runtime. Comparing only the
-# major (#298) made the floor inert for the whole 0.x line: every pre-1.0 har
-# passed it and then bounced straight back into this shim. Compare the full
-# release triple, and treat anything unparseable as unusable.
-har_runtime_compatible() {
-  local v pinned="__HAR_VERSION__" i a b
-  v="$("$1" --version 2>/dev/null | head -n1)" || return 1
-  v="${v#v}"
-  v="${v%%[-+ ]*}"
-  local -a have pin
-  IFS=. read -r -a have <<<"$v"
-  IFS=. read -r -a pin <<<"${pinned%%[-+]*}"
-  for i in 0 1 2; do
-    a="${have[i]:-0}"
-    b="${pin[i]:-0}"
-    case "$a" in ''|*[!0-9]*) return 1 ;; esac
-    case "$b" in ''|*[!0-9]*) return 1 ;; esac
-    [ "$a" -gt "$b" ] && return 0
-    [ "$a" -lt "$b" ] && return 1
-  done
-  return 0
-}
-# `$1` (not a named var) so `har env eject` can lift this delegate verbatim.
-if command -v har >/dev/null 2>&1 && har_runtime_compatible har; then
-  exec har env agent "${1:?Usage: attach.sh <agent-id>}" attach
-elif [ -x "$REPO_ROOT/node_modules/.bin/har" ] && har_runtime_compatible "$REPO_ROOT/node_modules/.bin/har"; then
-  exec "$REPO_ROOT/node_modules/.bin/har" env agent "${1:?Usage: attach.sh <agent-id>}" attach
-elif command -v npx >/dev/null 2>&1; then
-  exec npx --yes @osfactory/har@__HAR_VERSION__ env agent "${1:?Usage: attach.sh <agent-id>}" attach
-fi
-echo "Error: cannot run the HAR runtime — 'har' is not on PATH and Node.js (npx) is unavailable." >&2
-echo "  Install Node.js, then: npm i -D @osfactory/har   # or: npx @osfactory/har@__HAR_VERSION__ env agent" >&2
-exit 127

package/dist/templates/runtime-bundles/shared-kernel/agent-cli.sh

@@ -1,52 +0,0 @@
-#!/usr/bin/env bash
-# Namespaced CLI for managing a running agent environment.
-# The runtime lives in the HAR package (#234) — this file only forwards to it.
-# Usage: ./.har/agent-cli.sh <agent-id> <command> [args...]
-set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-# Loop guard (#291): a pre-1.0 har does not own this runtime kind in the
-# package — it executes this script as authoritative, which would exec back
-# into har forever (one node process per cycle). Trip on re-entry for this
-# harness root, and skip har binaries older than the pinned runtime (#298).
-HAR_SHIM_GUARD="agent@${REPO_ROOT}"
-case ":${HAR_SHIM_REENTRY:-}:" in *":${HAR_SHIM_GUARD}:"*)
-  echo "Error: runtime loop detected — the har CLI that ran this shim delegated back into it." >&2
-  echo "  The har runtime handling this repo is older than the harness contract (pinned: @osfactory/har@__HAR_VERSION__)." >&2
-  echo "  Fix: npm i -g @osfactory/har@latest    # or in this repo: npm i -D @osfactory/har" >&2
-  exit 86
-  ;;
-esac
-export HAR_SHIM_REENTRY="${HAR_SHIM_REENTRY:-}:${HAR_SHIM_GUARD}"
-# True when $1 reports a version >= the pinned runtime. Comparing only the
-# major (#298) made the floor inert for the whole 0.x line: every pre-1.0 har
-# passed it and then bounced straight back into this shim. Compare the full
-# release triple, and treat anything unparseable as unusable.
-har_runtime_compatible() {
-  local v pinned="__HAR_VERSION__" i a b
-  v="$("$1" --version 2>/dev/null | head -n1)" || return 1
-  v="${v#v}"
-  v="${v%%[-+ ]*}"
-  local -a have pin
-  IFS=. read -r -a have <<<"$v"
-  IFS=. read -r -a pin <<<"${pinned%%[-+]*}"
-  for i in 0 1 2; do
-    a="${have[i]:-0}"
-    b="${pin[i]:-0}"
-    case "$a" in ''|*[!0-9]*) return 1 ;; esac
-    case "$b" in ''|*[!0-9]*) return 1 ;; esac
-    [ "$a" -gt "$b" ] && return 0
-    [ "$a" -lt "$b" ] && return 1
-  done
-  return 0
-}
-if command -v har >/dev/null 2>&1 && har_runtime_compatible har; then
-  exec har env agent "$@"
-elif [ -x "$REPO_ROOT/node_modules/.bin/har" ] && har_runtime_compatible "$REPO_ROOT/node_modules/.bin/har"; then
-  exec "$REPO_ROOT/node_modules/.bin/har" env agent "$@"
-elif command -v npx >/dev/null 2>&1; then
-  exec npx --yes @osfactory/har@__HAR_VERSION__ env agent "$@"
-fi
-echo "Error: cannot run the HAR runtime — 'har' is not on PATH and Node.js (npx) is unavailable." >&2
-echo "  Install Node.js, then: npm i -D @osfactory/har   # or: npx @osfactory/har@__HAR_VERSION__ env agent" >&2
-exit 127