@tech-leads-club/harness-toolkit 0.15.2 → 0.15.4

package/docs/log.md

@@ -13,6 +13,11 @@ Generated from `docs/decisions/` — do not edit by hand. Run `node tools/render
 A reserved file of the [OKF v0.1](/decisions/ad-013.md) bundle: entries grouped under ISO 8601 headings,
 newest first. For what landed in which npm release, see `CHANGELOG.md` at the repository root.
 
+## 2026-09-12
+
+- **AD-139** — lessonsView joins ProviderPort, closing the one dispatcher that bypassed it ([/decisions/ad-139.md](/decisions/ad-139.md))
+- **AD-140** — an unrecognized shell wrapper can no longer hide a forced push ([/decisions/ad-140.md](/decisions/ad-140.md))
+
 ## 2026-09-11
 
 - **AD-137** — Gate artifacts are scoped per session, the same fix AD-122 already proved for handoff ([/decisions/ad-137.md](/decisions/ad-137.md))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tech-leads-club/harness-toolkit",
-  "version": "0.15.2",
+  "version": "0.15.4",
   "type": "module",
   "description": "Multi-provider agent steering: gates, follow-up, handoff, policy",
   "keywords": [

package/src/core/floor/floor.service.ts

@@ -145,6 +145,26 @@ function pathArgs(args: ShellWord[]): ShellWord[] {
   return args.filter((word) => !word.text.startsWith("-") && word.text !== "");
 }
 
+// hazard: `verbOf` strips a path down to its basename before comparing (`/usr/bin/git` → `git`) — a
+// literal-text scan that skips the same normalization would deny `git push --force` but allow the identical
+// command run as `/usr/bin/git push --force`, which is exactly the shape a path-qualifying wrapper produces.
+function namesGit(text: string): boolean {
+  return (text.split("/").pop() ?? text) === "git";
+}
+
+// why: `verbOf` only sees through a wrapper this gate already knows by name, and `WRAPPERS` cannot list
+// every proxy or shim an operator's shell might inject ahead of the real command — discovered live when one
+// such wrapper carried a force push straight past this rule. Matching the whole segment, not the resolved
+// head verb, means an unrecognized wrapper can delay `git` but not hide it.
+function forcedGitPush(segment: ShellSegment): boolean {
+  const texts = segment.words.map((word) => word.text);
+  return (
+    texts.some(namesGit) &&
+    texts.includes("push") &&
+    texts.some((text) => text === "--force" || text === "-f")
+  );
+}
+
 function checkShell(input: FloorInput): Decision {
   const command = input.command;
   if (!command) {
@@ -165,6 +185,17 @@ function checkShell(input: FloorInput): Decision {
   }
 
   for (const segment of segments) {
+    // why: checked before `verbOf` resolves anything — a wrapper this gate does not recognize can delay
+    // which word `verbOf` treats as the head, or exhaust the segment before a head is ever found, but it
+    // cannot remove `git`/`push`/`--force` from the segment's own words.
+    if (forcedGitPush(segment)) {
+      return denial(
+        "history-rewrite",
+        "`git push --force` discards remote commits that are not in your history. Use --force-with-lease, which refuses when the remote moved.",
+        "force push",
+      );
+    }
+
     const head = verbOf(segment.words);
     if (!head) {
       continue;
@@ -187,17 +218,6 @@ function checkShell(input: FloorInput): Decision {
       return denial("machine-control", `\`${verb}\` controls the machine, not the project.`, verb);
     }
 
-    if (verb === "git" && args.some((word) => word.text === "push")) {
-      const forced = args.some((word) => word.text === "--force" || word.text === "-f");
-      if (forced) {
-        return denial(
-          "history-rewrite",
-          "`git push --force` discards remote commits that are not in your history. Use --force-with-lease, which refuses when the remote moved.",
-          "force push",
-        );
-      }
-    }
-
     const destructive = DESTRUCTIVE_VERBS.has(verb) || isMkfs(verb);
     if (!destructive) {
       continue;

package/src/entrypoints/support.ts

@@ -10,7 +10,7 @@ import {
 } from "../core/index.ts";
 import { filterCodeTargets, filterTestTargets, gitRootOf, listChangedRepoFiles } from "../platform/git.ts";
 import { runProcess } from "../platform/process.ts";
-import { type ProviderPort, renderClaudeLessonsView, renderCursorLessonsView } from "../providers/index.ts";
+import { type ProviderPort, providers } from "../providers/index.ts";
 
 // invariant: one definition, taken from core rather than restated.
 export const OBS_CONFIG = coreFacade.observability.DEFAULT_OBS;
@@ -248,18 +248,20 @@ export function renderLessonLine(lesson: HarnessLesson): string {
   return coreFacade.lesson.renderLessonBlock(lesson);
 }
 
-/**
- * invariant: one dispatcher, imported by both session entrypoints. The durable view is written at session start and
- * again at session end, and a copy of this switch in each would be the AD-042 defect a second time.
- */
-export function renderProviderLessonsView(providerName: string, root: string): string | null {
-  if (providerName === "cursor") {
-    return renderCursorLessonsView(root);
-  }
-  if (providerName === "claude") {
-    return renderClaudeLessonsView(root);
-  }
-  return null;
+// invariant: a single dispatcher, called from both session entrypoints — the durable view is written at
+// session start and again at session end, so a second copy of this logic in either one would repeat the
+// AD-042 defect.
+
+// why: a registry lookup, not a name-checking chain — adding a third adapter to `providers` gets it
+// dispatched here for free, exactly as it already gets `detect`/`capabilities`/`render` for free —
+// `ProviderPort` itself, not this function, is what requires `lessonsView` to exist ([/decisions/ad-139.md](/decisions/ad-139.md)).
+export function renderProviderLessonsView(
+  providerName: string,
+  root: string,
+  registry: readonly ProviderPort[] = providers,
+): string | null {
+  const provider = registry.find((candidate) => candidate.name === providerName);
+  return provider?.lessonsView(root) ?? null;
 }
 
 /**

package/src/providers/claude/index.ts

@@ -2,6 +2,7 @@ import type { ProviderPort } from "../provider.port.ts";
 import { claudeCapabilities } from "./claude.capabilities.ts";
 import { detectClaude } from "./claude.detect.ts";
 import { claudeToEvent } from "./claude.inbound.ts";
+import { renderClaudeLessonsView } from "./claude.lessons-view.ts";
 import { claudeRender } from "./claude.outbound.ts";
 import { claudePolicyDefaults } from "./claude.policy-defaults.ts";
 import { claudeWiring, claudeWiringTargets } from "./claude.wiring.ts";
@@ -15,4 +16,5 @@ export const claudeProvider: ProviderPort = {
   render: claudeRender,
   wiring: claudeWiring,
   wiringTargets: claudeWiringTargets,
+  lessonsView: renderClaudeLessonsView,
 };

package/src/providers/cursor/index.ts

@@ -2,6 +2,7 @@ import type { ProviderPort } from "../provider.port.ts";
 import { cursorCapabilities } from "./cursor.capabilities.ts";
 import { detectCursor } from "./cursor.detect.ts";
 import { cursorToEvent } from "./cursor.inbound.ts";
+import { renderCursorLessonsView } from "./cursor.lessons-view.ts";
 import { cursorRender } from "./cursor.outbound.ts";
 import { cursorPolicyDefaults } from "./cursor.policy-defaults.ts";
 import { cursorWiring, cursorWiringTargets } from "./cursor.wiring.ts";
@@ -15,4 +16,5 @@ export const cursorProvider: ProviderPort = {
   render: cursorRender,
   wiring: cursorWiring,
   wiringTargets: cursorWiringTargets,
+  lessonsView: renderCursorLessonsView,
 };

package/src/providers/index.ts

@@ -1,8 +1,6 @@
-export { renderClaudeLessonsView } from "./claude/claude.lessons-view.ts";
 export type { TranscriptUsage } from "./claude/claude.transcript.ts";
 export { readClaudeUsage } from "./claude/claude.transcript.ts";
 export { claudeWiring, mergeClaudeSettings } from "./claude/claude.wiring.ts";
-export { renderCursorLessonsView } from "./cursor/cursor.lessons-view.ts";
 export type { DegradeOptions } from "./provider.degrade.ts";
 export { degrade, truncateContext } from "./provider.degrade.ts";
 export type { ProviderPort } from "./provider.port.ts";

package/src/providers/provider.port.ts

@@ -18,4 +18,5 @@ export type ProviderPort = {
   render(decision: Decision, event: HarnessEvent): Rendered;
   wiring(runtime: RuntimePaths): ProviderWiring;
   wiringTargets(): string[];
+  lessonsView(root: string): string | null;
 };