@plainconceptsplatform/agent-harness 3.5.0 → 3.7.0

package/harness/.opencode/scripts/platform-manifest.mjs

@@ -0,0 +1,112 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+export const ANSWERS_FILE = '.copier-answers.yml'
+export const MANIFEST_FILE = '.platform/manifest'
+export const EXCEPTIONS_FILE = '.platform/exceptions.yml'
+
+const escapeRegExp = text => text.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&')
+
+export function globToRegExp(glob) {
+  const directory = glob.endsWith('/')
+  const body = glob.replace(/\/$/, '')
+  const anchored = body.includes('/')
+  const pattern = body.replace(/^\//, '')
+  let source = ''
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i]
+    if (c === '*' && pattern[i + 1] === '*' && (i === 0 || pattern[i - 1] === '/')) {
+      if (i + 2 === pattern.length) {
+        source += '.*'
+        i += 1
+        continue
+      }
+      if (pattern[i + 2] === '/') {
+        source += '(?:.*/)?'
+        i += 2
+        continue
+      }
+    }
+    if (c === '*') {
+      source += '[^/]*'
+      while (pattern[i + 1] === '*') i++
+    } else if (c === '?') source += '[^/]'
+    else if (c === '[' && pattern.indexOf(']', i + 2) !== -1) {
+      const end = pattern.indexOf(']', i + 2)
+      source += `[${pattern.slice(i + 1, end).replace(/^!/, '^')}]`
+      i = end
+    } else if (c === '\\' && i + 1 < pattern.length) source += escapeRegExp(pattern[++i])
+    else source += escapeRegExp(c)
+  }
+  return new RegExp(`^${anchored ? '' : '(?:.*/)?'}${source}${directory ? '/.*' : '(?:/.*)?'}$`)
+}
+
+export function parseManifest(text) {
+  return text
+    .split(/\r?\n/)
+    .map(line => line.replace(/(?<!\\)\s+$/, ''))
+    .filter(line => line && !line.startsWith('#'))
+    .map(line => {
+      const negated = line.startsWith('!')
+      return { negated, regex: globToRegExp(negated ? line.slice(1) : line) }
+    })
+}
+
+export function matchesRules(rules, file) {
+  let matched = false
+  for (const rule of rules) if (rule.regex.test(file)) matched = !rule.negated
+  return matched
+}
+
+const scalar = raw => {
+  const value = raw.trim()
+  const quoted = value.match(/^(["'])(.*)\1$/)
+  return quoted ? quoted[2] : value.replace(/\s+#.*$/, '')
+}
+
+export function parseExceptions(text) {
+  const exceptions = []
+  let current
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.trim() || line.trim().startsWith('#') || /^exceptions:/.test(line)) continue
+    const item = line.match(/^\s*-\s+(.*)$/)
+    if (item) exceptions.push((current = {}))
+    const pair = (item ? item[1] : line).match(/^\s*([A-Za-z_]+):\s*(.*)$/)
+    if (pair && current) current[pair[1]] = scalar(pair[2])
+  }
+  return exceptions
+}
+
+export function commitOf(answers) {
+  const match = answers?.match(/^_commit:\s*(.+)$/m)
+  return match ? scalar(match[1]) : null
+}
+
+const localDate = (now = new Date()) =>
+  `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}`
+
+function readText(file) {
+  try {
+    return fs.readFileSync(file, 'utf8')
+  } catch {
+    return null
+  }
+}
+
+// A repository opts in by carrying both files; without them every caller behaves exactly as before.
+export function loadPlatform(root) {
+  if (!fs.existsSync(path.join(root, ANSWERS_FILE))) return null
+  const manifest = readText(path.join(root, MANIFEST_FILE))
+  if (manifest == null) return null
+  return {
+    rules: parseManifest(manifest),
+    exceptions: parseExceptions(readText(path.join(root, EXCEPTIONS_FILE)) ?? ''),
+  }
+}
+
+export function isPlatformOwned(platform, file, today = localDate()) {
+  const relative = file.replace(/\\/g, '/').replace(/^\.\//, '')
+  if (!matchesRules(platform.rules, relative)) return false
+  return !platform.exceptions.some(e =>
+    typeof e.path === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(e.expires ?? '') && e.expires >= today && globToRegExp(e.path).test(relative))
+}

package/harness/AGENTS.md

@@ -1,49 +1,49 @@
-# AGENTS.md
-
-<!-- PC-NOT-INITIALIZED -->
-
-# Agent operating guide
-
-The operating contract for AI agents in this repository. Agent-agnostic: OpenCode, Claude Code, Codex, Gemini and others.
-
-## Session context
-
-Before a non-trivial change, read `AGENTS.md` for workflow rules, `ARCHITECTURE.md` for boundaries and component interactions, `DESIGN.md` for UI and design-system work, and the active OpenSpec change or the specification covering the area you are changing.
-
-Command aliases: OpenSpec skills may reference `/opsx-propose`, `/opsx-apply`, `/opsx-archive`, or `/opsx-explore`. Always substitute them with the `pc-plan-propose`, `pc-plan-apply`, `pc-plan-archive`, and `pc-plan-explore` skills respectively. User-facing command names are `/plan-propose`, `/plan-apply`, `/plan-archive`, and `/plan-explore`. Never mention the `opsx-` names to the user.
-
-## Workflow ownership
-
-<!-- PC-PLATFORM-WORKFLOW-START -->
-<!-- PC-PLATFORM-WORKFLOW-END -->
-
-## Planning and execution
-
-- Never combine an unrelated refactor with the work you were asked to do. It arrives under a message that does not mention it, and the reviewer approves both.
-- Never introduce a new convention where the repository already has one, and never guess when requirements, architecture or a security constraint are unclear. Ask.
-
-## Engineer selection
-
-Inspect `.opencode/agents/*.md` before spawning. Prefer the most specialized custom engineer. `build` and `plan` are the only primaries and are never spawned; `fullstack-engineer` is the body they share and the fallback worker, so prefer a specialist over it. If no specialist matches, tell the user to create one with `/make-engineer`. Spawn only engineers present in that directory.
-
-The `pc-plan-apply` skill is authoritative for subagent waves, dependency ordering, retries, and concurrency. A spawn past `agents.maxConcurrent` is denied (`pc-subagent-monitor`); a denied spawn is not a failed task, so re-issue it in the next wave.
-
-## Tool and repository safety
-
-- Never expose or commit secrets, credentials, tokens, or production data.
-- Never overwrite a generated file, or uncommitted changes you did not make. The tree may be shared with a person and another agent.
-- Never bypass a check, weaken a test, or silence a lint rule to reach a green result. A green run that was arranged is worse than a red one, because nobody looks again.
-- Commit, push, open a pull request, change dependencies, or touch deployment configuration only with the user's explicit approval and the repository's stated process.
-
-## Verification and completion
-
-- Never call a bug fixed without a test that would have caught it, where one is practical.
-- Never leave a specification, `ARCHITECTURE.md` or `DESIGN.md` asserting something this change made false.
-- Never end on a blocker without naming it and the decision it needs. An unattended run that stops quietly looks like one that finished.
-
-## Skills
-
-Skills live in `.agents/skills/`. Always installed: `@pc-guardrails-generic`, `@pc-guardrails-project`, and `@browser-automation`. An entry under `## Abilities` is not a passive reference: call the `skill` tool once per `@skill-name`, guardrails first. Editing, shell and spawning stay blocked until you have (`pc-system-reminders`), and a loaded skill can require further loads.
-
-<!-- PC-PLATFORM-SKILLS-GUIDE-START -->
-<!-- PC-PLATFORM-SKILLS-GUIDE-END -->
+# AGENTS.md
+
+<!-- PC-NOT-INITIALIZED -->
+
+# Agent operating guide
+
+The operating contract for AI agents in this repository. Agent-agnostic: OpenCode, Claude Code, Codex, Gemini and others.
+
+## Session context
+
+Before a non-trivial change, read `AGENTS.md` for workflow rules, `ARCHITECTURE.md` for boundaries and component interactions, `DESIGN.md` for UI and design-system work, and the active OpenSpec change or the specification covering the area you are changing.
+
+Command aliases: OpenSpec skills may reference `/opsx-propose`, `/opsx-apply`, `/opsx-archive`, or `/opsx-explore`. Always substitute them with the `pc-plan-propose`, `pc-plan-apply`, `pc-plan-archive`, and `pc-plan-explore` skills respectively. User-facing command names are `/plan-propose`, `/plan-apply`, `/plan-archive`, and `/plan-explore`. Never mention the `opsx-` names to the user.
+
+## Workflow ownership
+
+<!-- PC-PLATFORM-WORKFLOW-START -->
+<!-- PC-PLATFORM-WORKFLOW-END -->
+
+## Planning and execution
+
+- Never combine an unrelated refactor with the work you were asked to do. It arrives under a message that does not mention it, and the reviewer approves both.
+- Never introduce a new convention where the repository already has one, and never guess when requirements, architecture or a security constraint are unclear. Ask.
+
+## Engineer selection
+
+Inspect `.opencode/agents/*.md` before spawning. Prefer the most specialized custom engineer. `build` and `plan` are the only primaries and are never spawned; `fullstack-engineer` is the body they share and the fallback worker, so prefer a specialist over it. If no specialist matches, tell the user to create one with `/make-engineer`. Spawn only engineers present in that directory.
+
+The `pc-plan-apply` skill is authoritative for subagent waves, dependency ordering, retries, and concurrency. A spawn past `agents.maxConcurrent` is denied (`pc-subagent-monitor`); a denied spawn is not a failed task, so re-issue it in the next wave.
+
+## Tool and repository safety
+
+- Never expose or commit secrets, credentials, tokens, or production data.
+- Never overwrite a generated file, or uncommitted changes you did not make. The tree may be shared with a person and another agent.
+- Never bypass a check, weaken a test, or silence a lint rule to reach a green result. A green run that was arranged is worse than a red one, because nobody looks again.
+- Commit, push, open a pull request, change dependencies, or touch deployment configuration only with the user's explicit approval and the repository's stated process.
+
+## Verification and completion
+
+- Never call a bug fixed without a test that would have caught it, where one is practical.
+- Never leave a specification, `ARCHITECTURE.md` or `DESIGN.md` asserting something this change made false.
+- Never end on a blocker without naming it and the decision it needs. An unattended run that stops quietly looks like one that finished.
+
+## Skills
+
+Skills live in `.agents/skills/`. Always installed: `@pc-guardrails-generic`, `@pc-guardrails-project`, and `@browser-automation`. An entry under `## Abilities` is not a passive reference: call the `skill` tool once per `@skill-name`, guardrails first. Editing, shell and spawning stay blocked until you have (`pc-system-reminders`), and a loaded skill can require further loads.
+
+<!-- PC-PLATFORM-SKILLS-GUIDE-START -->
+<!-- PC-PLATFORM-SKILLS-GUIDE-END -->

package/harness/ARCHITECTURE.md

@@ -1,13 +1,13 @@
-> NOT GENERATED YET
->
-> This file has not been populated yet. It is intentionally empty.
->
-> **If this is a greenfield project** (no codebase exists yet): skip this for now. Come back and run `/make-architecture` once you have meaningful code, structure, or infrastructure in place.
->
-> **If this is a brownfield project** (existing codebase): run this command now to generate the architecture documentation:
->
-> ```
-> /make-architecture
-> ```
->
-> This command analyzes your folder structure, config files, routes, data models, integrations, and build setup, then writes a complete ARCHITECTURE.md covering components, data flow, tech stack, deployment, and more. It is safe to rerun any time the architecture changes significantly.
+> NOT GENERATED YET
+>
+> This file has not been populated yet. It is intentionally empty.
+>
+> **If this is a greenfield project** (no codebase exists yet): skip this for now. Come back and run `/make-architecture` once you have meaningful code, structure, or infrastructure in place.
+>
+> **If this is a brownfield project** (existing codebase): run this command now to generate the architecture documentation:
+>
+> ```
+> /make-architecture
+> ```
+>
+> This command analyzes your folder structure, config files, routes, data models, integrations, and build setup, then writes a complete ARCHITECTURE.md covering components, data flow, tech stack, deployment, and more. It is safe to rerun any time the architecture changes significantly.

package/harness/DESIGN.md

@@ -1,13 +1,13 @@
-> NOT GENERATED YET
->
-> This file has not been populated yet. It is intentionally empty.
->
-> **If this is a greenfield project** (no UI exists yet): skip this for now. Come back and run `/make-design` once you have a design system, UI components, or styles in place.
->
-> **If this is a brownfield project** (existing UI/styles): run this command now to generate the design documentation:
->
-> ```
-> /make-design
-> ```
->
-> This command analyzes your CSS, Tailwind config, component files, and design tokens, then writes a complete DESIGN.md with structured YAML tokens and written design intent. It is safe to rerun any time your design system changes.
+> NOT GENERATED YET
+>
+> This file has not been populated yet. It is intentionally empty.
+>
+> **If this is a greenfield project** (no UI exists yet): skip this for now. Come back and run `/make-design` once you have a design system, UI components, or styles in place.
+>
+> **If this is a brownfield project** (existing UI/styles): run this command now to generate the design documentation:
+>
+> ```
+> /make-design
+> ```
+>
+> This command analyzes your CSS, Tailwind config, component files, and design tokens, then writes a complete DESIGN.md with structured YAML tokens and written design intent. It is safe to rerun any time your design system changes.

package/harness/opencode.jsonc

@@ -1,36 +1,36 @@
-{
-  "$schema": "https://opencode.ai/config.json",
-  "mcp": {
-    "servers": {
-      "agent-browser": {
-        "type": "local",
-        "command": ["agent-browser", "mcp", "--tools", "core"],
-        "disabled": false
-      }
-    },
-    "timeout": {
-      "catalog": 300000,
-      "execution": 300000
-    }
-  },
-  "compaction": {
-    "auto": true,
-    "buffer": 10000
-  },
-  "permissions": [
-    { "action": "question", "resource": "*", "effect": "allow" },
-    { "action": "skill", "resource": "*", "effect": "allow" }
-  ],
-  "skills": [".agents/skills"],
-  "default_agent": "plan",
-  "agents": {
-    "build": { "mode": "primary" },
-    "plan": {
-      "mode": "primary",
-      "permissions": [
-        { "action": "edit", "resource": "*", "effect": "deny" },
-        { "action": "subagent", "resource": "*", "effect": "deny" }
-      ]
-    }
-  }
-}
+{
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
+    "servers": {
+      "agent-browser": {
+        "type": "local",
+        "command": ["agent-browser", "mcp", "--tools", "core"],
+        "disabled": false
+      }
+    },
+    "timeout": {
+      "catalog": 300000,
+      "execution": 300000
+    }
+  },
+  "compaction": {
+    "auto": true,
+    "buffer": 10000
+  },
+  "permissions": [
+    { "action": "question", "resource": "*", "effect": "allow" },
+    { "action": "skill", "resource": "*", "effect": "allow" }
+  ],
+  "skills": [".agents/skills"],
+  "default_agent": "plan",
+  "agents": {
+    "build": { "mode": "primary" },
+    "plan": {
+      "mode": "primary",
+      "permissions": [
+        { "action": "edit", "resource": "*", "effect": "deny" },
+        { "action": "subagent", "resource": "*", "effect": "deny" }
+      ]
+    }
+  }
+}

package/harness/openspec/config.yaml

@@ -1,20 +1,20 @@
-schema: spec-driven
-
-# Project context (optional)
-# This is shown to AI when creating artifacts.
-# Add your tech stack, conventions, style guides, domain knowledge, etc.
-# Example:
-#   context: |
-#     Tech stack: TypeScript, React, Node.js
-#     We use conventional commits
-#     Domain: e-commerce platform
-
-# Per-artifact rules (optional)
-# Add custom rules for specific artifacts.
-# Example:
-#   rules:
-#     proposal:
-#       - Keep proposals under 500 words
-#       - Always include a "Non-goals" section
-#     tasks:
-#       - Break tasks into chunks of max 2 hours
+schema: spec-driven
+
+# Project context (optional)
+# This is shown to AI when creating artifacts.
+# Add your tech stack, conventions, style guides, domain knowledge, etc.
+# Example:
+#   context: |
+#     Tech stack: TypeScript, React, Node.js
+#     We use conventional commits
+#     Domain: e-commerce platform
+
+# Per-artifact rules (optional)
+# Add custom rules for specific artifacts.
+# Example:
+#   rules:
+#     proposal:
+#       - Keep proposals under 500 words
+#       - Always include a "Non-goals" section
+#     tasks:
+#       - Break tasks into chunks of max 2 hours

package/harness/skills-lock.json

@@ -1,17 +1,17 @@
-{
-  "version": 1,
-  "skills": {
-    "find-skills": {
-      "source": "vercel-labs/skills",
-      "sourceType": "github",
-      "skillPath": "skills/find-skills/SKILL.md",
-      "computedHash": "781bd6d3f9b19f8c9af6b53d8d0e4876d0183841b565db34ca7092ffa412d111"
-    },
-    "user-story": {
-      "source": "deanpeters/product-manager-skills",
-      "sourceType": "github",
-      "skillPath": "skills/user-story/SKILL.md",
-      "computedHash": "user-story-placeholder"
-    }
-  }
-}
+{
+  "version": 1,
+  "skills": {
+    "find-skills": {
+      "source": "vercel-labs/skills",
+      "sourceType": "github",
+      "skillPath": "skills/find-skills/SKILL.md",
+      "computedHash": "781bd6d3f9b19f8c9af6b53d8d0e4876d0183841b565db34ca7092ffa412d111"
+    },
+    "user-story": {
+      "source": "deanpeters/product-manager-skills",
+      "sourceType": "github",
+      "skillPath": "skills/user-story/SKILL.md",
+      "computedHash": "user-story-placeholder"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/agent-harness",
-  "version": "3.5.0",
+  "version": "3.7.0",
   "description": "Installs the Plain Concepts Platform Harness into any codebase, and keeps it up to date. Wires OpenCode, OpenSpec, codegraph, and agentmemory into a multi-agent workflow that runs on native parallel subagents.",
   "keywords": [
     "opencode",
@@ -42,6 +42,7 @@
   "engines": {
     "node": ">=18"
   },
+  "packageManager": "pnpm@11.10.0",
   "dependencies": {
     "@inquirer/prompts": "^7.0.0",
     "chalk": "^5.0.0",
@@ -50,16 +51,6 @@
     "jsonc-parser": "^3.3.1",
     "ora": "^8.0.0"
   },
-  "devDependencies": {
-    "@eslint/js": "^9.0.0",
-    "eslint": "^9.0.0",
-    "globals": "^15.0.0",
-    "markdownlint-cli2": "0.23.2",
-    "vitest": "^4.1.5"
-  },
-  "vitest": {
-    "environment": "node"
-  },
   "scripts": {
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
@@ -67,7 +58,18 @@
     "lint:md:fix": "markdownlint-cli2 --fix \"**/*.md\"",
     "test": "vitest run",
     "test:watch": "vitest",
+    "prepublishOnly": "npm run lint && npm run lint:md && npm run test",
     "release:dry": "pnpm publish --dry-run --no-git-checks --access public",
     "release": "pnpm publish --no-git-checks --access public"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.0.0",
+    "eslint": "^9.0.0",
+    "globals": "^15.0.0",
+    "markdownlint-cli2": "0.23.2",
+    "vitest": "^4.1.5"
+  },
+  "vitest": {
+    "environment": "node"
   }
-}
+}

package/skills/README.md

@@ -1,18 +1,18 @@
-# skills/
-
-Two kinds of skills live here, both discoverable by `npx skills`:
-
-| Kind | Directories | Purpose |
-| --- | --- | --- |
-| Installable `pc-*` + `browser-automation` | `pc-*`, `browser-automation` | What the CLI copies into a target project under `.agents/skills/` during onboarding. Plain Concepts' own skills. |
-| CLI-self | `agent-harness-cli` | Skills for agents working on THIS CLI repo (driving `npx @plainconceptsplatform/agent-harness`). Never copied into target projects. |
-
-Discoverability: any `SKILL.md` in a subdirectory here is auto-discovered by OpenCode, Claude Code, and `npx skills` (which scans `./skills/` as a recognized project-skill location).
-
-## Using one
-
-Point your agent at the directory, or copy a skill into wherever your tool discovers skills:
-
-```bash
-cp -r skills/agent-harness-cli ~/.claude/skills/
-```
+# skills/
+
+Two kinds of skills live here, both discoverable by `npx skills`:
+
+| Kind | Directories | Purpose |
+| --- | --- | --- |
+| Installable `pc-*` + `browser-automation` | `pc-*`, `browser-automation` | What the CLI copies into a target project under `.agents/skills/` during onboarding. Plain Concepts' own skills. |
+| CLI-self | `agent-harness-cli` | Skills for agents working on THIS CLI repo (driving `npx @plainconceptsplatform/agent-harness`). Never copied into target projects. |
+
+Discoverability: any `SKILL.md` in a subdirectory here is auto-discovered by OpenCode, Claude Code, and `npx skills` (which scans `./skills/` as a recognized project-skill location).
+
+## Using one
+
+Point your agent at the directory, or copy a skill into wherever your tool discovers skills:
+
+```bash
+cp -r skills/agent-harness-cli ~/.claude/skills/
+```