@rsaglobaltech/specgate 0.20.0 → 0.21.0

package/dist/scripts/cli/commands/harness/RunCommand.js

@@ -19,7 +19,9 @@
  *   5. Emit a pass/fail/attempts report.
  *
  * Vendor-neutral by construction: the agent is any shell command. The
- * harness never merges a branch — a human reviews and merges.
+ * harness never merges a branch — a human reviews and merges — except with
+ * `--chain`, which a person asks for and which merges only what passed the
+ * gate twice: on its branch and merged (ADR-0036).
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -75,6 +77,25 @@ const node_child_process_1 = require("node:child_process");
 const command_1 = require("../../../lib/command");
 const project_root_1 = require("../../../lib/project-root");
 const prompt_1 = require("../../../harness/prompt");
+const init_1 = require("../../../harness/init");
+const in_flight_1 = require("../../../lib/in-flight");
+const harness_events_1 = require("../../../lib/harness-events");
+const HarnessEvents_1 = require("../../../../packages/core/src/domain/HarnessEvents");
+/**
+ * `read` against the project as it will be after its open changes are
+ * archived (ADR-0035), so the harness sees, prompts for and gates a change's
+ * requirements while they are in flight. The project itself when none is open.
+ */
+function judged(dir, read) {
+    const view = (0, in_flight_1.inFlightView)(dir);
+    try {
+        return read(view ? view.dir : dir, view ? view.toProject : (text) => text);
+    }
+    finally {
+        if (view)
+            view.cleanup();
+    }
+}
 const GherkinQuality_1 = require("../../../../packages/core/src/domain/GherkinQuality");
 const HarnessConfigFile_1 = require("../../../../packages/core/src/infrastructure/HarnessConfigFile");
 const agent_1 = require("../../../lib/agent");
@@ -156,6 +177,15 @@ function usage() {
         "  --req <REQ-NNN>        Limit to specific requirement(s); repeatable.\n" +
         "  --project-dir <path>   Project root (auto-detected from cwd if omitted).\n" +
         "  --base-branch <ref>    Branch/ref each worktree is cut from (default: current HEAD).\n" +
+        "  --setup-cmd <cmd>      Run in each new worktree before the agent. Default: the\n" +
+        "                         install the lockfile implies (npm ci, pnpm, yarn);\n" +
+        "                         `none` runs nothing. The agent gets SPECGATE_REQ and\n" +
+        "                         SPECGATE_ATTEMPT in its environment.\n" +
+        "  --chain                One requirement at a time, in order, each cut from the\n" +
+        "                         previous merge: a green one is merged into the branch\n" +
+        "                         you are on (a merge commit, its prompts left on its\n" +
+        "                         branch), the gate runs again on the merge, and a red\n" +
+        "                         result is undone. Stops at the first failure.\n" +
         "  --timeout <seconds>    Per-agent-invocation timeout (default 1200).\n" +
         "  --keep-worktrees       Do not remove worktrees after each requirement.\n" +
         "  --force                Recreate harness/REQ-NNN branches that already exist.\n" +
@@ -212,6 +242,8 @@ function parseArgs(argv) {
         push: false,
         remote: "",
         prCmd: "",
+        setupCmd: "",
+        chain: false,
     };
     for (let i = 0; i < argv.length; i += 1) {
         const token = argv[i];
@@ -247,6 +279,12 @@ function parseArgs(argv) {
         else if (token === "--base-branch") {
             args.baseBranch = argv[++i] || "";
         }
+        else if (token === "--setup-cmd") {
+            args.setupCmd = argv[++i] || "";
+        }
+        else if (token === "--chain") {
+            args.chain = true;
+        }
         else if (token === "--timeout") {
             const n = Number(argv[++i]);
             if (!Number.isInteger(n) || n < 1)
@@ -335,9 +373,9 @@ function branchExists(projectDir, branch) {
     return r.status === 0 && r.stdout.trim() !== "";
 }
 function runPlan(projectDir) {
-    const r = (0, node_child_process_1.spawnSync)(process.execPath, [PLAN_SCRIPT, "--project-dir", projectDir, "--format", "json"], {
+    const r = judged(projectDir, (dir) => (0, node_child_process_1.spawnSync)(process.execPath, [PLAN_SCRIPT, "--project-dir", dir, "--format", "json"], {
         encoding: "utf8",
-    });
+    }));
     if (r.status !== 0) {
         throw new Error(`plan failed:\n${r.stderr || r.stdout}`);
     }
@@ -346,6 +384,7 @@ function runPlan(projectDir) {
         parsed = JSON.parse(r.stdout);
     }
     catch (err) {
+        // `JSON.parse` only ever throws a SyntaxError.
         throw new Error(`plan produced invalid JSON: ${err.message}`);
     }
     return parsed;
@@ -388,21 +427,26 @@ function readGateMessages(worktreeDir, reportPath) {
     const run = (0, CucumberMessages_1.parseCucumberMessages)(raw);
     return run.parsed ? run : null;
 }
-function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}) {
+function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}, report = () => { }) {
     // `--delivering`: the requirement is still Draft while its gate runs, and a
     // Draft row owes no files. Without it the gate would skip the one
     // requirement this attempt exists to deliver.
     // The agent's tests are new evidence for a generated matrix: refresh it so
     // the gate judges the attempt, not the matrix as it was before it.
     (0, MatrixCommand_1.refreshDerivedMatrix)(worktreeDir);
-    const validateArgs = [VALIDATE_SCRIPT, worktreeDir, "--strict"];
-    if (req.requirement)
-        validateArgs.push("--delivering", req.requirement);
-    const validate = (0, node_child_process_1.spawnSync)(process.execPath, validateArgs, {
-        encoding: "utf8",
-        timeout: timeoutMs,
-        maxBuffer: SUBPROCESS_MAX_BUFFER,
+    const validate = judged(worktreeDir, (dir, toProject) => {
+        const validateArgs = [VALIDATE_SCRIPT, dir, "--strict"];
+        if (req.requirement)
+            validateArgs.push("--delivering", req.requirement);
+        const run = (0, node_child_process_1.spawnSync)(process.execPath, validateArgs, {
+            encoding: "utf8",
+            timeout: timeoutMs,
+            maxBuffer: SUBPROCESS_MAX_BUFFER,
+        });
+        // The agent is told about its worktree, not about the copy it was judged in.
+        return { ...run, stdout: toProject(run.stdout || ""), stderr: toProject(run.stderr || "") };
     });
+    report("validate --strict", validate.status === 0 ? "pass" : "fail");
     if (validate.status !== 0) {
         return {
             ok: false,
@@ -422,6 +466,7 @@ function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}) {
             timeout: timeoutMs,
             maxBuffer: SUBPROCESS_MAX_BUFFER,
         });
+        report(`architecture check: ${archCmd}`, arch.status === 0 ? "pass" : "fail");
         if (arch.status !== 0) {
             return {
                 ok: false,
@@ -463,6 +508,7 @@ function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}) {
             maxBuffer: SUBPROCESS_MAX_BUFFER,
             stdio: settings.verbose ? ["ignore", 2, 2] : undefined,
         });
+        report(`test command: ${(0, HarnessEvents_1.maskCommand)(resolved)}`, test.status === 0 ? "pass" : "fail", (0, HarnessEvents_1.testCounts)(`${test.stdout || ""}${test.stderr || ""}`));
         if (test.status !== 0) {
             // Name the command. A gate that silently does the wrong thing — running
             // the whole suite because a filter did not apply, say — produces a
@@ -732,7 +778,7 @@ function checkWriteScopeInWorktree(worktreeDir, settings) {
             `makes a passing gate meaningless. Revert them and satisfy the scenario as written.\n` +
             (evidence ? `\nWhat was changed:\n\n\`\`\`diff\n${evidence}\n\`\`\`\n` : "") +
             `\nIf the change is genuinely required, it belongs in a spec change ` +
-            `(\`specgate change new\`), reviewed by a person — not in this attempt.`,
+            `(\`specgate propose\`), reviewed by a person — not in this attempt.`,
     };
 }
 /**
@@ -765,12 +811,14 @@ function checkGateCommandInWorktree(worktreeDir, baseRef, testCmd) {
     const result = (0, GateCommandIntegrity_1.gateCommandIntegrity)(testCmd, before, after);
     if (!result.checked || !result.changed)
         return null;
+    // A checked result always names its script: the probe above resolved it.
+    const changed = result.script;
     return {
         manifest,
-        script: result.script.script,
+        script: changed.script,
         message: `agent_rewrote_gate_command — the gate runs \`${testCmd}\`, and this attempt ` +
             `changed what that means.\n\n` +
-            `  ${manifest} → scripts.${result.script.script}\n` +
+            `  ${manifest} → scripts.${changed.script}\n` +
             `  before: ${result.before === null ? "(absent)" : result.before}\n` +
             `  after:  ${result.after === null ? "(absent)" : result.after}\n\n` +
             `The command the gate runs is part of the contract this requirement is ` +
@@ -842,13 +890,23 @@ function attemptRequirement(req, ctx) {
     const firstAttempt = Math.max(1, (ctx.resumeAt && ctx.resumeAt.attempt) || 1);
     /** Set when another attempt cannot change the outcome (#50). */
     let stopRetrying = false;
+    // The live view's file (ADR-0037), in the project, not the worktree.
+    const eventsFile = (0, harness_events_1.eventsFileFor)(ctx.projectDir || worktreeDir, req.requirement);
     for (let attempt = firstAttempt; attempt <= settings.maxAttempts; attempt += 1) {
         info(`${req.requirement}: attempt ${attempt}/${settings.maxAttempts}`);
         const attemptStart = Date.now();
+        const event = (e) => (0, harness_events_1.appendEvent)(eventsFile, e, req.requirement, attempt);
+        event({ type: "attempt", state: "start" });
         let agentMs = 0;
         /** Which roles ran this attempt, in order — the run record's answer to "who did this". */
         const profilesUsed = [];
         const record = (stage) => {
+            event({
+                type: "attempt",
+                state: "end",
+                result: stage === "pass" ? "pass" : "fail",
+                ...(stage === "pass" ? {} : { stage }),
+            });
             attemptLog.push({
                 attempt,
                 endedAt: stage,
@@ -871,7 +929,7 @@ function attemptRequirement(req, ctx) {
                 // implementing step that follows must see what it said. Building once
                 // up front meant findings only ever reached the *next* attempt, which
                 // is not what a reviewer is for.
-                const prompt = (0, prompt_1.buildPrompt)(req, worktreeDir, {
+                const prompt = judged(worktreeDir, (dir) => (0, prompt_1.buildPrompt)(req, dir, {
                     promptPrefix: settings.promptPrefix,
                     hint,
                     previousFailure: previousFailure || undefined,
@@ -882,7 +940,7 @@ function attemptRequirement(req, ctx) {
                     // commit — the precedent must be work already accepted, not a
                     // sibling requirement this same run happens to be writing.
                     withPrecedents: settings.promptPrecedents === true,
-                });
+                }));
                 const promptFile = path.join(os.tmpdir(), `specgate-harness-prompt-${req.requirement}-${crypto.randomBytes(4).toString("hex")}.md`);
                 fs.writeFileSync(promptFile, prompt, "utf8");
                 archivePrompt(worktreeDir, req.requirement, attempt, step, prompt);
@@ -903,6 +961,15 @@ function attemptRequirement(req, ctx) {
                     cwd: worktreeDir,
                     timeoutMs,
                     maxBuffer: SUBPROCESS_MAX_BUFFER,
+                    // Which requirement and attempt this is, for agents and the wrappers
+                    // around them (ADR-0036).
+                    env: {
+                        SPECGATE_REQ: req.requirement,
+                        SPECGATE_ATTEMPT: String(attempt),
+                        [HarnessEvents_1.EVENTS_FILE_VAR]: eventsFile,
+                        [HarnessEvents_1.EVENTS_REQ_VAR]: req.requirement,
+                        [HarnessEvents_1.EVENTS_ATTEMPT_VAR]: String(attempt),
+                    },
                 });
                 // Node reports a timeout as an errno-carrying Error; the base `Error`
                 // type the spawnSync signature declares does not have `code`.
@@ -997,10 +1064,7 @@ function attemptRequirement(req, ctx) {
         }
         // `verbose` is a run flag, not a project setting, so it travels on the
         // context rather than in `harness.config.yaml`.
-        const gate = runGate(worktreeDir, settings.testCmd, timeoutMs, req, {
-            ...settings,
-            verbose: ctx.verbose,
-        });
+        const gate = runGate(worktreeDir, settings.testCmd, timeoutMs, req, { ...settings, verbose: ctx.verbose }, (stage, result, extra) => event({ type: "gate", stage, result, ...(extra || {}) }));
         if (!gate.ok) {
             previousFailure =
                 `Gate failed at: ${gate.stage}\n\n` + (gate.hint ? `⚠ ${gate.hint}\n\n` : "") + gate.output;
@@ -1260,7 +1324,7 @@ function resolveGeneratedConflicts(worktree) {
  * @param passed REQ → branch, for the dependencies that passed in this run
  */
 function deriveBase(projectDir, reqId, deps, passed, ctx) {
-    const branches = deps.map((d) => passed.get(d)).filter(Boolean);
+    const branches = deps.map((d) => passed.get(d)).filter((b) => Boolean(b));
     if (branches.length === 0)
         return { base: ctx.baseRef };
     if (branches.length === 1)
@@ -1382,7 +1446,7 @@ function preserveFailedAttempt(worktreeDir, req, failure) {
         `wip(${req.requirement}): FAILED the gate — do not merge as is\n\n` +
             `${firstLine}\n\n` +
             "Committed by `specgate harness run` so the attempt is reviewable rather than\n" +
-            "discarded. The requirement is still Draft: `specgate done` never ran.",
+            "discarded. The requirement is still Draft: `specgate apply` never ran.",
     ]);
     return commit.status === 0;
 }
@@ -1811,6 +1875,7 @@ function printReport(results, format, recorded) {
         process.stdout.write(`  ${ui.muted(`Run recorded in ${recorded} — specgate harness report sums them up`)}\n`);
     }
     if (pass > 0) {
+        // `pass > 0`, so there is one.
         const first = results.find((r) => r.result === "pass");
         process.stdout.write(ui.next(`git diff HEAD...${first.branch}`, "review and merge the harness/* branches you trust"));
     }
@@ -1832,7 +1897,7 @@ function printReport(results, format, recorded) {
  * scoped to one requirement, so a parallel run and a serial run execute the
  * same code.
  */
-async function dispatchLevel(runnable, byId, hintByReq, ctx, concurrency) {
+const dispatchLevel = async (runnable, byId, hintByReq, ctx, concurrency) => {
     if (concurrency <= 1) {
         const results = [];
         for (const id of runnable) {
@@ -1844,6 +1909,7 @@ async function dispatchLevel(runnable, byId, hintByReq, ctx, concurrency) {
                 results.push(notAttempted(byId.get(id), id, ctx.stopReason()));
                 continue;
             }
+            // Every id in a level comes from the queue `byId` was built from.
             results.push(processRequirement(byId.get(id), {
                 ...ctx,
                 baseRef: ctx.baseFor ? ctx.baseFor(id) : ctx.baseRef,
@@ -1853,6 +1919,99 @@ async function dispatchLevel(runnable, byId, hintByReq, ctx, concurrency) {
         return results;
     }
     return runWorkers(runnable, byId, ctx, concurrency);
+};
+/**
+ * `--chain` (ADR-0036): the one place the harness merges, and only on request.
+ *
+ * Each requirement is cut from the head the previous merge produced, so it
+ * builds on everything before it. A green one is merged into the branch the
+ * run started on with a merge commit — one revertible commit per requirement,
+ * its prompt archive left on its own branch — and the gate runs again on the
+ * merged result: green alone is not green together. A red result is undone,
+ * and the chain stops at the first requirement that does not pass.
+ */
+async function runChain(pending, ctx, hintByReq) {
+    const projectDir = ctx.projectDir;
+    const results = [];
+    for (let i = 0; i < pending.length; i += 1) {
+        const req = pending[i];
+        const stop = (reason) => {
+            for (const rest of pending.slice(i + 1)) {
+                results.push(notAttempted(rest, rest.requirement, reason));
+            }
+        };
+        const [result] = await runLevels([req], ctx, {
+            concurrency: 1,
+            hintByReq,
+            runOne: dispatchLevel,
+        });
+        results.push(result);
+        if (!result || result.result !== "pass") {
+            stop(`the chain stopped at ${req.requirement}`);
+            break;
+        }
+        const branch = `harness/${req.requirement}`;
+        const merge = git(projectDir, ["merge", "--no-ff", "--no-commit", branch]);
+        if (merge.status !== 0) {
+            const unresolved = resolveGeneratedConflicts(projectDir);
+            if (unresolved.length > 0) {
+                git(projectDir, ["merge", "--abort"]);
+                Object.assign(result, {
+                    result: "fail",
+                    error: `merge into the chain's branch conflicted in: ${unresolved.join(", ")}`,
+                });
+                stop(`the chain stopped at ${req.requirement}`);
+                break;
+            }
+        }
+        // The prompts stay on the requirement's branch, for review and --resume;
+        // they never reach the branch the chain merges into.
+        const prompts = git(projectDir, [
+            "diff",
+            "--cached",
+            "--name-only",
+            "--diff-filter=A",
+            "HEAD",
+            "--",
+            EmptyAttempt_1.PROMPT_ARCHIVE_DIR,
+        ])
+            .stdout.split("\n")
+            .filter(Boolean);
+        if (prompts.length > 0) {
+            git(projectDir, ["rm", "-q", "--cached", "--", ...prompts]);
+            for (const f of prompts)
+                fs.rmSync(path.join(projectDir, f), { force: true });
+        }
+        const title = String(req.title || req.use_case || req.useCase || "").replace(/^UC-\d+\s*/, "");
+        git(projectDir, [
+            "commit",
+            "-q",
+            "-m",
+            `Merge ${branch}${title ? ` — ${title}` : ""}\n\n` +
+                `Merged by \`specgate harness run --chain\` after its gate passed on ${branch}.`,
+        ]);
+        const eventsFile = (0, harness_events_1.eventsFileFor)(projectDir, req.requirement);
+        const attempt = Number(result.attempts) || undefined;
+        (0, harness_events_1.appendEvent)(eventsFile, { type: "merge", into: "HEAD", branch }, req.requirement, attempt);
+        const gate = runGate(projectDir, ctx.settings.testCmd, ctx.timeoutMs, req, ctx.settings, (stage, res, extra) => (0, harness_events_1.appendEvent)(eventsFile, { type: "gate", stage: `post-merge ${stage}`, result: res, ...(extra || {}) }, req.requirement, attempt));
+        if (!gate.ok) {
+            git(projectDir, ["reset", "-q", "--hard", "HEAD~1"]);
+            Object.assign(result, {
+                result: "fail",
+                error: `post-merge gate: ${gate.stage}\n${String(gate.output || "").slice(-4000)}`,
+            });
+            warn(`${req.requirement}: green on ${branch}, red once merged — the merge was undone`);
+            stop(`the chain stopped at ${req.requirement}`);
+            break;
+        }
+        // The gate may regenerate the matrix: it belongs to the merge commit.
+        if (!isGitClean(projectDir)) {
+            git(projectDir, ["add", "-A"]);
+            git(projectDir, ["commit", "-q", "--amend", "--no-edit"]);
+        }
+        info(`${req.requirement}: merged into the chain's branch, gate green`);
+    }
+    return results;
 }
 /** A requirement the budget never let start. Not a failure — it was not tried. */
 function notAttempted(req, id, reason) {
@@ -1942,6 +2101,8 @@ function workerArgs(id, ctx) {
         String(ctx.timeoutSeconds),
         "--max-attempts",
         String(ctx.settings.maxAttempts),
+        "--setup-cmd",
+        ctx.settings.setupCmd || "none",
         ...(ctx.force ? ["--force"] : []),
         ...(ctx.keepWorktrees ? ["--keep-worktrees"] : []),
         ...(ctx.settings.agent ? ["--agent", ctx.settings.agent] : []),
@@ -2000,8 +2161,14 @@ async function runLevels(pending, ctx, opts) {
     };
     const budgetStartedAt = Date.now();
     let started = 0;
+    // Asserted rather than annotated: it is assigned inside `mayStart`, and an
+    // annotated `null` would stay narrowed to `null` everywhere below.
     let stoppedBy = null;
-    const { levels, cycles, dependsOn, graph } = (0, HarnessRun_1.scheduleLevels)(pending);
+    const schedule = (0, HarnessRun_1.scheduleLevels)(pending);
+    const { levels, cycles, graph } = schedule;
+    // REQ → the requirements in this run it waits for. Core builds it as a plain
+    // object and does not declare its shape.
+    const dependsOn = schedule.dependsOn;
     const byId = new Map(pending.map((r) => [r.requirement, r]));
     if (cycles.length > 0) {
         // `validate` is the gate that reports the cycle properly. Here we only
@@ -2036,7 +2203,7 @@ async function runLevels(pending, ctx, opts) {
         const derivationFailures = new Map();
         const baseFor = (id) => {
             const derived = deriveBase(ctx.projectDir, id, dependsOn[id] || [], passedBranches, ctx);
-            if (derived.error) {
+            if ("error" in derived) {
                 derivationFailures.set(id, derived.error);
                 return ctx.baseRef;
             }
@@ -2068,6 +2235,7 @@ async function runLevels(pending, ctx, opts) {
         // that, and again with `--budget-seconds`.
         const levelResults = await runOne(attemptable, byId, hintByReq, {
             ...ctx,
+            // Only `attemptable` ids reach the runner, and each has a base.
             baseFor: (id) => bases.get(id),
             // The level asks before starting each requirement. `started` counts
             // what was actually begun, so the count ceiling and the clock agree.
@@ -2135,6 +2303,12 @@ class RunCommand extends command_1.BaseCommand {
             const projectDir = (0, project_root_1.resolveProjectDir)(args.projectDir, { requireSentinel: true });
             const fileConfig = (0, HarnessConfigFile_1.readHarnessConfig)(projectDir);
             const settings = (0, HarnessConfigFile_1.resolveHarnessSettings)(fileConfig, args);
+            // A fresh worktree has no dependencies. Unless told, install what the
+            // lockfile pins (ADR-0036); `--setup-cmd none` runs nothing.
+            if (settings.setupCmd === "none")
+                settings.setupCmd = "";
+            else if (!settings.setupCmd)
+                settings.setupCmd = (0, init_1.detectSetupCommand)(projectDir);
             // D1: profile match rules live in `.harness/profiles.yaml`, and a project
             // may declare profiles without ever writing a `harness.config.yaml`.
             // Reaching them through the config reader made them silently absent
@@ -2188,13 +2362,15 @@ class RunCommand extends command_1.BaseCommand {
             }
             const hintByReq = new Map((plan.next_steps || []).map((s) => [s.requirement, s.hint]));
             if (args.dryRun) {
-                process.stdout.write(ui.header("harness run", `dry run · ${pending.length} requirement(s) would be processed`));
+                process.stdout.write(ui.header("harness run", `dry run · ${pending.length} requirement(s) would be processed`) +
+                    ui.kv("Setup", settings.setupCmd || "none", 14) +
+                    (args.chain ? ui.kv("Chain", "each green requirement merged into this branch", 14) : ""));
                 for (const req of pending) {
-                    const prompt = (0, prompt_1.buildPrompt)(req, projectDir, {
+                    const prompt = judged(projectDir, (dir) => (0, prompt_1.buildPrompt)(req, dir, {
                         promptPrefix: settings.promptPrefix,
                         hint: hintByReq.get(req.requirement),
                         withPrecedents: settings.promptPrecedents === true,
-                    });
+                    }));
                     process.stdout.write("\n" +
                         ui.section(`${req.requirement} · ${req.category} → branch harness/${req.requirement}`) +
                         "\n");
@@ -2214,6 +2390,15 @@ class RunCommand extends command_1.BaseCommand {
             const identity = gitIdentityProblem(projectDir);
             if (identity)
                 throw new Error(identity);
+            if (args.chain) {
+                if (args.baseBranch) {
+                    throw new Error("--chain merges into the branch you are on: check that branch out instead of --base-branch.");
+                }
+                const current = git(projectDir, ["rev-parse", "--abbrev-ref", "HEAD"]).stdout.trim();
+                if (!current || current === "HEAD") {
+                    throw new Error("--chain needs a branch to merge into; HEAD is detached.");
+                }
+            }
             const baseRef = args.baseBranch || "HEAD";
             const concurrencyNote = settings.concurrency > 1 ? `, up to ${settings.concurrency} at a time` : "";
             if (jsonMode || process.env.SPECGATE_HARNESS_WORKER) {
@@ -2245,11 +2430,13 @@ class RunCommand extends command_1.BaseCommand {
                 verbose: args.verbose,
             };
             const startedAt = new Date().toISOString();
-            const results = await runLevels(pending, ctx, {
-                concurrency: settings.concurrency,
-                hintByReq,
-                runOne: dispatchLevel,
-            });
+            const results = args.chain
+                ? await runChain(pending, ctx, hintByReq)
+                : await runLevels(pending, ctx, {
+                    concurrency: settings.concurrency,
+                    hintByReq,
+                    runOne: dispatchLevel,
+                });
             // Only the run that a person started writes a record. A worker is one
             // slice of that run, and its own record would be a second copy of the
             // same requirement — `harness report` reads every file in the directory,
@@ -2279,6 +2466,7 @@ class RunCommand extends command_1.BaseCommand {
             process.exit(failed > 0 ? 1 : 0);
         }
         catch (err) {
+            const thrown = err;
             let isJson = false;
             try {
                 isJson = parseArgs(this.args).format === "json";
@@ -2288,7 +2476,7 @@ class RunCommand extends command_1.BaseCommand {
             }
             const io = (0, agent_1.agentIo)(isJson);
             return io.fail({ results: null }, [
-                { severity: "error", code: "harness_run_error", message: err.message || String(err) },
+                { severity: "error", code: "harness_run_error", message: thrown.message || String(err) },
             ]);
         }
     }