@tech-leads-club/harness-toolkit 0.3.0 → 0.3.2

package/README.md

@@ -1,9 +1,46 @@
-# harness-toolkit
-
-Steers Cursor and Claude Code agents with **gates → follow-up → handoff → policy**.
-
-Hooks fire on the editor's own events. The harness answers each one with a decision — allow, ask, deny, or
-text injected into the turn — and writes a record of what it decided and why.
+<p align="center">
+  <img src=".github/assets/logo.png" alt="Tech Leads Club" width="400" />
+</p>
+
+<p align="center">
+  <img src="https://img.shields.io/npm/v/@tech-leads-club/harness-toolkit?style=flat-square&color=blue" alt="npm version" />
+  <img src="https://img.shields.io/npm/dt/@tech-leads-club/harness-toolkit?style=flat-square&color=blue" alt="total downloads" />
+  <img src="https://img.shields.io/npm/dm/@tech-leads-club/harness-toolkit?style=flat-square&color=blue" alt="monthly downloads" />
+  <img src="https://img.shields.io/badge/license-PolyForm%20Noncommercial-blue?style=flat-square" alt="license" />
+  <img src="https://img.shields.io/github/actions/workflow/status/tech-leads-club/harness-toolkit/release.yml?style=flat-square" alt="build status" />
+</p>
+
+<p align="center">
+  <img src="https://img.shields.io/badge/Bun-recommended-black?style=flat-square&logo=bun" alt="bun" />
+  <img src="https://img.shields.io/badge/node-%3E%3D24-brightgreen?style=flat-square&logo=node.js" alt="node version" />
+  <img src="https://img.shields.io/badge/TypeScript-strict-blue?style=flat-square&logo=typescript" alt="typescript" />
+  <img src="https://img.shields.io/badge/provenance-SLSA%20v1-green?style=flat-square&logo=npm" alt="npm provenance" />
+  <img src="https://img.shields.io/badge/dependencies-0%20runtime-brightgreen?style=flat-square" alt="zero runtime dependencies" />
+</p>
+
+<p align="center">
+  <img src="https://img.shields.io/badge/Cursor-supported-black?style=flat-square" alt="cursor" />
+  <img src="https://img.shields.io/badge/Claude%20Code-supported-black?style=flat-square&logo=anthropic" alt="claude code" />
+  <img src="https://img.shields.io/badge/Linux%20%C2%B7%20macOS%20%C2%B7%20Windows-tested%20in%20CI-informational?style=flat-square" alt="platforms" />
+</p>
+
+<p align="center">
+  <img src="https://img.shields.io/github/stars/tech-leads-club/harness-toolkit?style=flat-square&color=yellow" alt="github stars" />
+  <img src="https://img.shields.io/github/contributors/tech-leads-club/harness-toolkit?style=flat-square&color=orange" alt="contributors" />
+  <img src="https://img.shields.io/github/last-commit/tech-leads-club/harness-toolkit?style=flat-square" alt="last commit" />
+</p>
+
+<h1 align="center">🛡️ Harness Toolkit</h1>
+
+<p align="center">
+  <strong>Steers Cursor and Claude Code agents with gates → follow-up → handoff → policy</strong>
+</p>
+
+<p align="center">
+  Hooks fire on the editor's own events. The harness answers each one with a decision — <b>allow</b>, <b>ask</b>,
+  <b>deny</b>, or text injected into the turn — and writes a record of what it decided and why.
+  <b>7 floor rules</b> no configuration can reach, <b>3 always-on checks</b>, and <b>23 rails</b> you choose.
+</p>
 
 - **[Everything it validates](#everything-it-validates)** — the whole list, one row per check
 - **[How to see any of it](#how-to-see-any-of-it)** — the command behind each row
@@ -12,8 +49,7 @@ text injected into the turn — and writes a record of what it decided and why.
 ## Start here
 
 ```bash
-npm i -g @tech-leads-club/harness-toolkit
-tlc harness install
+npm i -g @tech-leads-club/harness-toolkit && tlc harness install
 ```
 
 Then restart Cursor or Claude Code. That is the whole setup — `install` finds which of the two you
@@ -222,11 +258,10 @@ three on every push; hooks firing inside an editor session on Windows are outsid
 
 ## Install
 
-The same two commands on every platform.
+One command, the same on every platform.
 
 ```bash
-npm i -g @tech-leads-club/harness-toolkit
-tlc harness install
+npm i -g @tech-leads-club/harness-toolkit && tlc harness install
 ```
 
 The package is the delivery vehicle and `tlc harness install` is what puts the runtime in place. They are

package/bin/tlc-build.mjs

@@ -37,14 +37,37 @@ function sourcesIn(dir) {
     .map((entry) => ({ name: basename(entry.name, ".ts"), source: join(dir, entry.name) }));
 }
 
-function buildOne(source, out) {
+/**
+ * why one invocation with every entry: `--splitting` can only share a chunk between entries it sees together.
+ * Built one at a time, each bundle inlined the whole core — measured, 24 bundles of ~257 KB each where more than
+ * half of every one was byte-identical to its neighbour: 5.0 MB of `dist/` to carry 548 KB of distinct code
+ * ([/decisions/ad-098.md](/decisions/ad-098.md)).
+ *
+ * invariant: the entry names stay flat and keep `.mjs`, because the launcher resolves `dist/<entry>.mjs` and the
+ * hooks on every installed machine name the launcher. Chunks go in a subdirectory, so pruning an orphan entry
+ * never has to tell the two apart.
+ */
+const CHUNK_DIR = "chunks";
+
+function build(targets) {
   const result = spawnSync(
     "bun",
-    ["build", "--target=node", "--format=esm", `--outfile=${out}`, source],
+    [
+      "build",
+      "--target=node",
+      "--format=esm",
+      "--splitting",
+      `--outdir=${dist}`,
+      "--entry-naming",
+      "[name].mjs",
+      "--chunk-naming",
+      `${CHUNK_DIR}/[name]-[hash].mjs`,
+      ...targets.map((target) => target.source),
+    ],
     { stdio: "inherit" },
   );
   if (result.error?.code === "ENOENT") {
-    console.error("tlc-build: Bun is not on PATH, and dist/ is committed so the bundler is part of the artefact.");
+    console.error("tlc-build: Bun is not on PATH, and it is the only bundler this builds with.");
     console.error("  curl -fsSL https://bun.sh/install | bash");
     process.exit(1);
   }
@@ -61,9 +84,15 @@ const targets = [
 
 mkdirSync(dist, { recursive: true });
 console.log(`tlc-build → ${dist}`);
-for (const target of targets) {
-  buildOne(target.source, join(dist, `${target.name}.mjs`));
-}
+
+/**
+ * hazard: chunk names carry a content hash, so a rebuild after a source change writes new ones and leaves the old
+ * ones behind. Nothing references them and they ship anyway, growing the package with every build.
+ *
+ * invariant: the chunk directory is derived, so it is replaced rather than merged.
+ */
+rmSync(join(dist, CHUNK_DIR), { recursive: true, force: true });
+build(targets);
 
 // invariant: the launcher stays executable on a filesystem that tracks the bit. A no-op where it does not.
 try {

package/config.example.json

@@ -2,7 +2,7 @@
   "version": 1,
   "mode": "solo",
   "subagents": {
-    "enforceAllowlist": true,
+    "enforceAllowlist": false,
     "requireModel": true,
     "blockMode": "deny",
     "blockParentFast": false,