@shahboura/harness 3.0.4

package/.opencode/agents/developer.md

@@ -0,0 +1,60 @@
+---
+description: "Implementation agent with proof-anchored TDD enforcement"
+mode: "subagent"
+hidden: true
+model: "anthropic/claude-sonnet-4-5"
+permission:
+  read: allow
+  grep: allow
+  glob: allow
+  write:
+    "core/**": "allow"
+    "tests/**": "allow"
+    "*": "ask"
+  edit:
+    "core/**": "allow"
+    "tests/**": "allow"
+    "*": "ask"
+  bash: allow
+  task: deny
+---
+
+# Developer Agent
+
+You are the **developer** agent for the ai-sdlc-harness SDLC pipeline.
+
+## Responsibilities
+- Write failing tests first (proven-red TDD)
+- Implement code to make tests pass
+- Harden implementation (security, edge cases)
+- Apply pre-PR fixes from reviewer feedback
+
+## Spawn Headers
+Your spawn prompt carries structured headers:
+- `harness-mode`: develop | harden | fixup
+- `harness-task`: task-id
+- `harness-run`: run-dir
+- `harness-repo`: worktree-path
+- `harness-test-cmd`: test command
+
+## Path Confinement (Plugin-Enforced)
+- Work ONLY inside `harness-repo` (your worktree). Never touch `ai/<run>/` authority files.
+- State moves only via `harness` commands, never by direct file writes.
+- Non-test paths are blocked until `bin/harness verify-red` seals red-proof.
+
+## TDD Enforcement (Plugin-Enforced)
+1. Write tests first — non-test writes blocked until `bin/harness verify-red` seals red-proof
+2. `bin/harness verify-red` runs tests, seals chained red-proof + SHA-locks test files
+3. Implement until green; checkpoint via `bin/harness commit`
+4. Completion requires `verify-green` + red-proof SHA verification
+5. Test revisions require `bin/harness verify-red --revise --reason "..."` (flagged event)
+
+## Hard Rules
+- Never run raw `git commit` / `merge` / `rebase` — use `bin/harness commit`
+- Cite `.opencode/skills/dev-workflow/shared/engineering.md` for code standards
+- Near turn ceiling: `bin/harness commit --commit-class wip` a checkpoint, then report `harness-status: PARTIAL`
+- End EVERY response with the status block (`.opencode/skills/dev-workflow/shared/status-block.md`)
+
+## Worktree Isolation
+- Each task runs in dedicated git worktree: `bin/harness worktree-add --task-id T1`
+- Worktree removed on task completion: `bin/harness worktree-remove`

package/.opencode/agents/planner.md

@@ -0,0 +1,51 @@
+---
+description: "Planning & analysis agent for SDLC workflow — orchestrates the pipeline"
+mode: "primary"
+model: "anthropic/claude-sonnet-4-5"
+permission:
+  read: allow
+  grep: allow
+  glob: allow
+  write:
+    "ai/*": "allow"
+    ".claude/context/*": "allow"
+    "*": "deny"
+  edit:
+    "ai/*": "allow"
+    ".claude/context/*": "allow"
+    "*": "deny"
+  bash: allow
+  task:
+    "developer": "allow"
+    "reviewer": "allow"
+    "*": "deny"
+  webfetch: allow
+---
+
+# Planner Agent
+
+You are the **planner** agent for the ai-sdlc-harness SDLC pipeline.
+
+## Responsibilities
+- **Intake**: Fetch and classify work items from providers (GitHub, GitLab, ADO, Jira, local markdown)
+- **Plan**: Create detailed implementation plans with test intents, risk tiers, edge cases
+- **Repo Map**: Generate and refresh codebase maps for grounding
+- **Orchestrate**: Coordinate developer and reviewer subagents through the pipeline
+
+## Path Confinement (Plugin-Enforced)
+- Writes allowed only under `ai/<run>/` and `.claude/context/`
+- Never write to repo source files directly
+- All git operations via `bin/harness` CLI verbs
+- State managed via `bin/harness` state machine
+
+## Workflow
+1. Receive work item via `/dev-workflow <id>` or `/story-workflow analyze <id>`
+2. Run intake → plan → (human gate) → preflight
+3. Spawn developer via `task` tool (spawn prompt should ideally include `harness-mode: develop` for traceability; **note: opencode plugin cannot validate these headers** — spawn permission is enforced at agent level via `permission.task` globs, not prompt content)
+4. Spawn reviewer via `task` tool (same advisory header pattern)
+5. Coordinate review, reconciliation, and gates
+
+## Mode Reference
+- `intake` → read `<run>/work-item.json`, produce requirements summary in `<run>/requirements.md`
+- `plan` → `.opencode/skills/dev-workflow/steps/plan-task.md` — decomposition, two-altitude approach selection, test-intents, diagrams
+- `repo-map` → generate tiered repo map under `.claude/context/repo-map/`

package/.opencode/agents/reviewer.md

@@ -0,0 +1,53 @@
+---
+description: "Code review & security analysis agent (read-only)"
+mode: "subagent"
+hidden: true
+model: "anthropic/claude-sonnet-4-5"
+permission:
+  read: allow
+  grep: allow
+  glob: allow
+  write: deny
+  edit: deny
+  bash:
+    "*": "ask"
+    "npm test*": "allow"
+    "python -m unittest*": "allow"
+    "cat /tmp/*": "allow"
+  task: deny
+---
+
+# Reviewer Agent
+
+You are the **reviewer** agent for the ai-sdlc-harness SDLC pipeline.
+
+## Responsibilities
+- Review implementation diffs independently (re-run build + tests)
+- Security scanning (configured scan commands)
+- Pre-PR review (completeness, contracts, docs)
+- PR comment analysis & triage
+- Request triage (ad-hoc human requests during runs)
+
+## Path Confinement (Plugin-Enforced)
+- **Strictly read-only**: No write/edit access granted
+- Bash commands restricted: test runners and `/tmp` reads allowed; shell writes blocked
+- `bin/harness` verbs allowed for state queries
+- Never trust another agent's claim — verify independently by re-running builds and tests
+
+## Review Modes
+- `review`: Per-task diff review inside develop mode. Verdict: APPROVED or CHANGES_REQUESTED with numbered, severity-tagged findings. Re-run build/tests yourself.
+- `pre-pr`: Holistic pre-PR review producing `<run>/reports/pre-pr.md`
+- `analyze-comments`: Classify PR comments VALID / INVALID / PARTIAL
+- `request-triage`: Triage ad-hoc human request against the plan
+
+## Verdict Format
+Output structured verdict captured by hooks:
+```
+VERDICT: APPROVED
+# or
+VERDICT: CHANGES_REQUESTED
+1. Finding description (severity: high|medium|low)
+2. Finding description
+```
+
+End every response with the status block (`.opencode/skills/dev-workflow/shared/status-block.md`).

package/.opencode/commands/add-repo.md

@@ -0,0 +1,26 @@
+---
+description: "Register one new repo into an already-bootstrapped workspace"
+agent: planner
+model: anthropic/claude-sonnet-4-5
+---
+
+# /add-repo
+
+Register a new repository into an existing workspace without re-running the full setup.
+
+## Usage
+```
+/add-repo --name <name> --path <path> [--test-cmd <cmd>]
+```
+
+## Arguments
+- `--name <name>` — Short name for the repo
+- `--path <path>` — Absolute path to the cloned repo
+- `--test-cmd <cmd>` — Test command (auto-discovered if omitted)
+
+## Workflow
+1. `bin/harness discover --repo <path>` — Auto-detect toolchain
+2. Review discovered settings
+3. `bin/harness add-repo --name <n> --path <path> --test-cmd <cmd>`
+4. `bin/harness init-verify` — Verification gate
+5. `bin/harness init-finalize` — Finalize configuration

package/.opencode/commands/dev-workflow.md

@@ -0,0 +1,40 @@
+---
+description: "Execute full SDLC workflow for a work item: fetch → plan → TDD → review → security → PR → reconcile → metrics"
+agent: planner
+model: anthropic/claude-sonnet-4-5
+---
+
+# /dev-workflow
+
+Execute the complete governed SDLC pipeline for a work item end-to-end.
+
+## Usage
+```
+/dev-workflow <work-item-id>
+```
+
+## Arguments
+- `work-item-id`: Provider work item ID (e.g., `PROJ-123`, `GH-456`)
+
+## Workflow
+1. **Fetch & Classify** — Retrieve work item, classify mode (full/quick)
+2. **Intake** — Extract requirements, acceptance criteria
+3. **Plan** — Create detailed plan with test intents, risk tiers, diagrams
+4. **Human Gate: Approve Plan** — You approve/reject the plan
+5. **Preflight** — Verify toolchain, create worktree
+6. **Develop** — Proven-red TDD per task (developer agent)
+7. **Human Gate: Approve Implementation** — You approve/reject
+8. **Harden** — Security scan, edge cases
+9. **Security Gate** — Conditional (threshold-based)
+10. **Pre-PR Review** — Reviewer agent checks diff
+11. **Human Gate: Approve Pre-PR** — You approve/reject
+12. **Create PR** — `bin/harness create-pr` + `bin/harness push`
+13. **Analyze Comments** — Optional: reviewer triages PR comments
+14. **Reconcile** — Apply fixes, update contracts
+15. **Metrics** — Record token spend, cycle time, gate outcomes
+
+## Quick Mode
+If work item has `Mode: quick` hint and no risk keywords:
+- Skips plan step, single pre-PR gate
+- Size caps: 80 lines / 5 files (configurable)
+- `quick-recheck` escalates to full mode if diff exceeds caps

package/.opencode/commands/init-workspace.md

@@ -0,0 +1,22 @@
+---
+description: "One-time workspace setup: provider, repos, toolchain discovery, verification gate"
+agent: planner
+model: anthropic/claude-sonnet-4-5
+---
+
+# /init-workspace
+
+One-time interview that bootstraps a workspace for the ai-sdlc-harness pipeline. Creates `.claude/context/`, discovers toolchain, configures provider, registers repos, and runs a verification gate.
+
+## Usage
+```
+/init-workspace
+```
+
+## Workflow
+1. **Provider selection** — GitHub, GitLab, ADO, Jira, or local-markdown
+2. **Repo registration** — point to cloned repos, discover test commands
+3. **Toolchain discovery** — detect language, test framework, build tools
+4. **Verification gate** — every check must pass before proceeding
+5. **Permission config** — writes `.claude/settings.json` with allowlist
+6. **Bootstrap marker** — marks workspace as initialized

package/.opencode/commands/migrate-workspace.md

@@ -0,0 +1,28 @@
+---
+description: "Adopt a v2.x workspace: config carries over, run history stays archived"
+agent: planner
+model: anthropic/claude-sonnet-4-5
+---
+
+# /migrate-workspace
+
+Migrate an existing v2.x workspace to the v3.0 format. Configuration carries over; run history stays archived in place.
+
+## Usage
+```
+/migrate-workspace [--path <path>]
+```
+
+## Arguments
+- `--path <path>` — Path to existing v2.x workspace (defaults to current directory)
+
+## Workflow
+1. `bin/harness migrate-detect` — Detect v2.x workspace structure
+2. Review detected settings
+3. `bin/harness migrate-extract` — Extract and convert configuration
+4. Verify migrated workspace
+5. Archive old run history
+
+## Notes
+- Old run data is not deleted — only archived
+- Permission settings are migrated but may need review for opencode format

package/.opencode/commands/repo-map-refresh.md

@@ -0,0 +1,23 @@
+---
+description: "Regenerate the auto-generated codebase map the planner grounds its plans in"
+agent: planner
+model: anthropic/claude-sonnet-4-5
+---
+
+# /repo-map-refresh
+
+Regenerate the codebase map used by the planner for grounding implementation plans.
+
+## Usage
+```
+/repo-map-refresh [--repo-name <name>] [--repo <path>]
+```
+
+## Arguments
+- `--repo-name <name>` — Name of the repo to map (omitted for all repos)
+- `--repo <path>` — Path to the repo
+
+## Workflow
+1. `bin/harness repo-map-check --repo-name <n> --repo <path>` — Check staleness
+2. Generate tiered map (structure → key files → details)
+3. `bin/harness repo-map-stamp --repo-name <n> --repo <path>` — Stamp freshness

package/.opencode/commands/story-workflow.md

@@ -0,0 +1,24 @@
+---
+description: "Shape a story's quality before building: analyze, refine, improve, groom"
+agent: planner
+model: anthropic/claude-sonnet-4-5
+---
+
+# /story-workflow
+
+Analyze and shape a work item's quality before implementation begins.
+
+## Usage
+```
+/story-workflow <command> <work-item-id>
+```
+
+## Commands
+- `analyze <id>` — Analyze work item for clarity, completeness, testability
+- `refine <id>` — Refine acceptance criteria, add edge cases
+- `improve <id>` — Improve test intents, risk assessment
+- `groom <id>` — Full grooming pass: dependencies, sizing, priority
+
+## Arguments
+- `command`: One of `analyze`, `refine`, `improve`, `groom`
+- `work-item-id`: Provider work item ID

package/.opencode/commands/workflow-status.md

@@ -0,0 +1,23 @@
+---
+description: "Read-only dashboard: cursor, tasks, gates, flagged events per run"
+agent: planner
+model: anthropic/claude-sonnet-4-5
+---
+
+# /workflow-status
+
+Read-only dashboard showing current pipeline state for one or all runs.
+
+## Usage
+```
+/workflow-status [--run <run-id>]
+```
+
+## Options
+- `--run <run-id>` — Show status for a specific run (omit for all runs)
+
+## Output
+- Current step and mode
+- Task statuses (pending / in-progress / in-review / done)
+- Gate states (pending / approved / rejected)
+- Flagged events and metrics

package/.opencode/commands/workspace-config.md

@@ -0,0 +1,27 @@
+---
+description: "Change one config section without re-running the interview"
+agent: planner
+model: anthropic/claude-sonnet-4-5
+---
+
+# /workspace-config
+
+Modify workspace configuration sections without re-running the full setup interview.
+
+## Usage
+```
+/workspace-config <section> [<key>=<value> ...]
+```
+
+## Sections
+- `provider` — Change provider settings
+- `repos` — Update repo paths or test commands
+- `workflow` — Adjust pipeline knobs (review rounds, security thresholds)
+- `naming` — Branch/commit naming conventions
+- `permissions` — Update permission allowlists
+
+## Examples
+```
+/workspace-config workflow review_rounds.max=3
+/workspace-config naming branch_prefix=feat
+```

package/.opencode/package.json

@@ -0,0 +1,9 @@
+{
+  "private": true,
+  "dependencies": {
+    "@opencode-ai/plugin": "^1.17.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.1"
+  }
+}

package/.opencode/plugins/harness-guards.ts

@@ -0,0 +1,290 @@
+import type { Plugin } from "@opencode-ai/plugin";
+
+// ── Types ────────────────────────────────────────────────────────────────
+
+interface PermissionEvent {
+  type: string;
+  command?: string;
+  path?: string;
+  [key: string]: unknown;
+}
+
+// ── Python guard pattern equivalents (hooks/guards.py) ──────────────────
+
+/**
+ * GIT_VERB_RE equivalent — matches `git commit|merge|push|...` with global
+ * flags between `git` and the verb, anchored at command boundaries and
+ * excluded inside quotes.
+ *
+ * Python source: hooks/guards.py lines 130-134
+ *
+ * Breakdown:
+ *   (?<!['"])              – negative lookbehind: NOT preceded by quote
+ *   \bgit\b                – word-boundary git
+ *   (?:[ \t]+              – optional global flags (zero or more):
+ *     (?:-C|-c|--git-dir|…)(?:=TOKEN|[ \t]+TOKEN)?  – flags that take a value
+ *     |-{1,2}[A-Za-z][\w-]*(?:=TOKEN)?               – self-contained flags
+ *   )*
+ *   [ \t]+                 – separator before verb
+ *   (commit|merge|…)       – captured verb
+ *   \b                     – word boundary after verb
+ */
+const GIT_TOKEN = /[^\s"']+/;
+const GIT_VERB_RE = new RegExp(
+  "(?<!['\"])" +
+  "\\bgit\\b" +
+  "(?:[ \\t]+(?:" +
+    "(?:-C|-c|--git-dir|--work-tree|--namespace|--super-prefix|--exec-path)" +
+    "(?:=" + GIT_TOKEN.source + "|[ \\t]+" + GIT_TOKEN.source + ")?" +
+    "|-{1,2}[A-Za-z][\\w-]*(?:=" + GIT_TOKEN.source + ")?" +
+  "))*" +
+  "[ \\t]+" +
+  "(commit|merge|rebase|cherry-pick|revert|am|pull|(?<!stash )push)\\b"
+);
+
+/**
+ * SHELL_C_RE equivalent — extracts payloads from `sh -c "..."` / `bash -c '...'`
+ * so that GIT_VERB_RE can check them (quoted payloads would otherwise be
+ * invisible due to the (?<!['"]) anchor).
+ *
+ * Python source: hooks/guards.py lines 139-140
+ */
+const SHELL_C_RE = /\b(?:sh|bash|zsh|dash|ksh)\b[^|;&\n\r]*?-c[ \t]+(?:"([^"]*)"|'([^']*)')/;
+
+/**
+ * AUTHORITY_RE equivalent — scoped to `ai/<run>/` prefix and matching ALL
+ * integrity-critical filenames. False-positive-safe because it requires the
+ * `ai/` prefix (matches Python's behavior exactly).
+ *
+ * Python source: hooks/guards.py lines 149-152
+ */
+const AUTHORITY_RE = /ai[/\\][^/\\\s"']+[/\\](?:state\.yaml|events\.ndjson|tokens\.ndjson|human-input\.ndjson|reviews\.ndjson|\.redproof|\.state\.lock)\b|\.hmac\b/;
+
+/**
+ * WRITE_HINT_RE equivalent — detects inline programming-language writes that
+ * circumvent path-based write blocking (shell redirects, tee, sed, python
+ * open/write, node fs.writeFile, etc.).
+ *
+ * Python source: hooks/guards.py lines 162-173
+ */
+const WRITE_HINT_RE = /(?<![0-9])>(?!&)|\btee\b|\bsed\s+(-\w+\s+)*-i|\brm\b|\bmv\b|\bcp\b|\btruncate\b|\bdd\b|yq\s+.*-i|--in-place/;
+
+/**
+ * Agent shapes in the harness — matches Python's shape_of().
+ * Python source: hooks/guards.py lines 499-502
+ */
+const HARNESS_SHAPES = ["planner", "developer", "reviewer"];
+
+// ── Helpers ──────────────────────────────────────────────────────────────
+
+/** Normalize agent name the same way Python's shape_of() does. */
+function normalizeAgent(raw: string): string {
+  const tail = raw.split(":").pop() ?? "";
+  return tail.trim().toLowerCase().replace(/^ai-sdlc-/, "");
+}
+
+/** Recursively extract all shell command targets from a bash command line. */
+function extractTargets(cmd: string): string[] {
+  const targets = [cmd];
+  // Extract sh -c / bash -c payloads
+  const m = SHELL_C_RE.exec(cmd);
+  if (m) {
+    const payload = m[1] ?? m[2] ?? "";
+    if (payload) targets.push(...extractTargets(payload));
+  }
+  return targets;
+}
+
+/** Check if ANY target contains a blocked git verb. */
+function hasBlockedGitVerb(cmd: string): boolean {
+  for (const target of extractTargets(cmd)) {
+    if (GIT_VERB_RE.test(target)) return true;
+  }
+  return false;
+}
+
+/** Check if a bash command contains inline/injected write operations. */
+function hasWriteHint(cmd: string): boolean {
+  return WRITE_HINT_RE.test(cmd);
+}
+
+// ── Plugin ───────────────────────────────────────────────────────────────
+
+const HarnessGuardsPlugin: Plugin = async ({ project, $, directory }) => {
+  const rawName =
+    (project as { agent?: { name?: string } }).agent?.name ?? "";
+  const agentName = normalizeAgent(rawName) || "direct-user";
+  const guardsPy = `${directory}/hooks/guards.py`;
+  const encoder = new TextEncoder();
+
+  // ── Layer 1: Enforcement via permission.ask ──────────────────────────
+  async function handlePermissionAsk(
+    permission: PermissionEvent,
+    output: { status: "ask" | "deny" | "allow" },
+  ): Promise<void> {
+    try {
+      if (output.status === "deny") return; // Already denied upstream
+
+      switch (permission.type) {
+        case "bash": {
+          const cmd = permission.command ?? "";
+          if (!cmd) break;
+
+          // Block git verbs (matching Python guard_bash)
+          if (hasBlockedGitVerb(cmd)) {
+            output.status = "deny";
+            console.warn(
+              `[harness-guards] DENIED bash (git verb): ${cmd.slice(0, 120)}`,
+            );
+            break;
+          }
+
+          // Block inline writes to authority paths via shell commands
+          if (hasWriteHint(cmd)) {
+            // For now, only block if a write hint targets an authority path.
+            // Full authority-path write detection requires command parsing
+            // (the Python guard uses both WRITE_HINT_RE + AUTHORITY_RE).
+            // This is a best-effort check; the Python audit (Layer 2) catches
+            // the rest.
+            output.status = "deny";
+            console.warn(
+              `[harness-guards] DENIED bash (write hint): ${cmd.slice(0, 120)}`,
+            );
+            break;
+          }
+
+          // Not a dangerous command — auto-allow to avoid prompt fatigue.
+          // Without this, every safe command would prompt the user.
+          output.status = "allow";
+          break;
+        }
+
+        case "write":
+        case "edit": {
+          const filePath = permission.path ?? "";
+          if (!filePath) break;
+
+          // Block writes to authority files (Python guard_write: AUTHORITY_RE)
+          if (AUTHORITY_RE.test(filePath)) {
+            output.status = "deny";
+            console.warn(
+              `[harness-guards] DENIED ${permission.type} (authority path): ${filePath}`,
+            );
+            break;
+          }
+
+          // Auto-allow to avoid prompt fatigue for non-authority paths.
+          // The permission patterns in opencode.jsonc still deny writes
+          // outside allowed directories.
+          output.status = "allow";
+          break;
+        }
+
+        case "read": {
+          const filePath = permission.path ?? "";
+          if (!filePath) break;
+
+          // Block raw .redproof reads for ALL harness shapes
+          // (Python guard_read blocks for planner, developer, reviewer)
+          if (
+            HARNESS_SHAPES.includes(agentName) &&
+            /\.redproof[/\\]/.test(filePath)
+          ) {
+            output.status = "deny";
+            console.warn(
+              `[harness-guards] DENIED read (redproof isolation): ${filePath}`,
+            );
+          }
+          // Leave non-redproof reads at their configured status
+          break;
+        }
+      }
+    } catch (err) {
+      // Error boundary — never let a plugin crash allow a blocked action
+      console.error(`[harness-guards] ERROR in permission.ask: ${err}`);
+    }
+  }
+
+  // ── Layer 2: Audit via Python guards (non-blocking) ─────────────────
+  async function auditGuard(
+    guard: string,
+    payload: Record<string, unknown>,
+  ): Promise<void> {
+    const t0 = Date.now();
+    try {
+      const proc = $`python3 ${guardsPy} ${guard}`.quiet().nothrow();
+      const writer = proc.stdin.getWriter();
+      await writer.write(encoder.encode(JSON.stringify(payload)));
+      await writer.close();
+
+      // 5-second timeout to prevent a hung Python process from stalling tools
+      const output = await Promise.race([
+        proc,
+        new Promise<never>((_, reject) =>
+          setTimeout(() => reject(new Error("timeout")), 5000),
+        ),
+      ]);
+
+      const elapsed = Date.now() - t0;
+      if (output.exitCode === 2) {
+        const reason = output.stderr?.toString()?.trim() ?? "unknown";
+        console.warn(
+          `[harness-guards] ${guard} BLOCK (${elapsed}ms): ${reason}`,
+        );
+      } else if (output.exitCode !== 0) {
+        console.warn(
+          `[harness-guards] ${guard} exit ${output.exitCode} (${elapsed}ms)`,
+        );
+      }
+    } catch (err) {
+      // Fail open — audit should never impede the tool
+      const elapsed = Date.now() - t0;
+      if (
+        err instanceof Error &&
+        err.message === "timeout" &&
+        elapsed >= 5000
+      ) {
+        console.warn(
+          `[harness-guards] ${guard} TIMEOUT after ${elapsed}ms`,
+        );
+      } else {
+        console.warn(`[harness-guards] ${guard} ERROR: ${err}`);
+      }
+    }
+  }
+
+  return {
+    // Layer 1: Enforcement
+    "permission.ask": handlePermissionAsk,
+
+    // Layer 2: Audit
+    "tool.execute.before": async (_input, output) => {
+      const tool = (_input as { tool?: string }).tool ?? "unknown";
+      const args = output?.args ?? {};
+      const payload: Record<string, unknown> = {
+        agent_type: agentName,
+        cwd: directory,
+        tool_input: args,
+      };
+
+      switch (tool) {
+        case "bash":
+          await auditGuard("bash", payload);
+          break;
+        case "write":
+        case "edit":
+          await auditGuard("write", payload);
+          break;
+        case "read":
+        case "grep":
+          await auditGuard("read", payload);
+          break;
+        case "task":
+          await auditGuard("spawn", payload);
+          break;
+      }
+    },
+  };
+};
+
+export default HarnessGuardsPlugin;