@tenphi/harnesspm 0.0.0-stage → 0.1.0

package/dist/user-outputs.js

@@ -0,0 +1,195 @@
+// User-level outputs of added harnesses with user scope (spec 4.4), and the user-level hook.
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { caller, harnesspmHome } from './added.js';
+import { applyEntries, desiredEntries, tomlTables } from './exec-outputs.js';
+import { agentsHome, claudeHome, claudeJsonFile, codexHome } from './homes.js';
+import { pathTools } from './outputs.js';
+import { removeBlock, renderSections, sectionsFor, upsertBlock, wrapBlock } from './render.js';
+import { resolve } from './resolve.js';
+import { NPX_ANY, ensureDir, exists, isDir, isRecord, isSymlink, linkIfChanged, readJsonIfExists, readTextIfExists, realpath, writeIfChanged } from './util.js';
+export const HOOK_COMMAND = `${NPX_ANY} sync`;
+export { claudeHome, codexHome };
+const stateFile = () => path.join(harnesspmHome(), 'state.json');
+function readState() {
+    const raw = readJsonIfExists(stateFile());
+    const data = isRecord(raw) ? raw : {};
+    const list = (key) => (Array.isArray(data[key]) ? data[key].filter((v) => typeof v === 'string') : []);
+    return { userLinks: list('userLinks'), claudeDirs: list('claudeDirs') };
+}
+function writeState(state) {
+    // Other parts of harnesspm keep their own keys in the same file.
+    const raw = readJsonIfExists(stateFile());
+    const data = isRecord(raw) ? raw : {};
+    ensureDir(path.dirname(stateFile()));
+    writeIfChanged(stateFile(), `${JSON.stringify({ ...data, ...state }, null, 2)}\n`);
+}
+const CODEX_BEGIN = '# BEGIN harnesspm (generated by `harnesspm sync`; do not edit)';
+const CODEX_END = '# END harnesspm';
+/** Puts MCP servers into a managed block at the end of ~/.codex/config.toml. */
+function writeCodexBlock(servers) {
+    const file = path.join(codexHome(), 'config.toml');
+    const text = readTextIfExists(file) ?? '';
+    const lines = text.split('\n');
+    const start = lines.indexOf(CODEX_BEGIN);
+    const end = start >= 0 ? lines.indexOf(CODEX_END, start) : -1;
+    const kept = start >= 0 && end >= 0 ? [...lines.slice(0, start), ...lines.slice(end + 1)] : lines;
+    while (kept.length > 0 && kept[kept.length - 1] === '')
+        kept.pop();
+    const block = Object.keys(servers).length > 0 ? [CODEX_BEGIN, tomlTables('mcp_servers', servers), CODEX_END] : [];
+    const next = [...kept, ...(kept.length > 0 && block.length > 0 ? [''] : []), ...block].join('\n');
+    if (next.trim() === '') {
+        if (text === '')
+            return false;
+        fs.rmSync(file, { force: true });
+        return true;
+    }
+    return writeIfChanged(file, `${next}\n`);
+}
+/** Writes rules, docs, skills and executables of user-scope harnesses into the agents' user folders. */
+export function writeUserOutputs(added, warnings, report = { pending: [], held: [] }) {
+    const user = added.filter((h) => h.scope === 'user').map(({ entry: _entry, ...rest }) => rest);
+    const home = harnesspmHome();
+    ensureDir(home);
+    const res = resolve(home, { team: false, added: user });
+    warnings.push(...res.warnings);
+    const generatedRoot = path.join(home, 'generated', 'user');
+    const generated = new Map();
+    const tools = pathTools(res, () => generatedRoot, generated);
+    for (const rule of res.rules)
+        if (rule.activation !== 'always' && rule.patches.length > 0)
+            generated.set(tools.generatedRule(rule), rule.text);
+    const content = renderSections(sectionsFor(res, res.packages, tools.paths, () => NPX_ANY), tools.paths);
+    const changed = [];
+    fs.rmSync(generatedRoot, { recursive: true, force: true });
+    for (const [file, text] of generated)
+        writeIfChanged(file, text);
+    for (const file of [path.join(claudeHome(), 'CLAUDE.md'), path.join(codexHome(), 'AGENTS.md')]) {
+        const existing = readTextIfExists(file);
+        const next = content !== '' ? upsertBlock(existing, wrapBlock(content)) : removeBlock(existing);
+        if (next === undefined) {
+            if (existing !== undefined && existing.includes('BEGIN:harnesspm')) {
+                fs.rmSync(file);
+                changed.push(file);
+            }
+        }
+        else if (writeIfChanged(file, next))
+            changed.push(file);
+    }
+    // Skills: ~/.claude/skills and ~/.agents/skills, once when one links to the other.
+    const state = readState();
+    const links = new Map();
+    const seen = new Set();
+    for (const root of [path.join(claudeHome(), 'skills'), path.join(agentsHome(), 'skills')]) {
+        const real = isDir(root) ? realpath(root) : root;
+        if (seen.has(real))
+            continue;
+        seen.add(real);
+        for (const skill of res.skills) {
+            const link = path.join(root, skill.name);
+            if (exists(link) && !isSymlink(link))
+                warnings.push(`${link} exists and is not a harnesspm link; left as it is`);
+            else
+                links.set(link, skill.dir);
+        }
+    }
+    for (const [link, target] of links)
+        if (linkIfChanged(link, target))
+            changed.push(link);
+    for (const old of state.userLinks) {
+        if (!links.has(old) && isSymlink(old)) {
+            fs.unlinkSync(old);
+            changed.push(old);
+        }
+    }
+    writeState({ ...state, userLinks: [...links.keys()].sort() });
+    // Hooks, permissions, MCP servers and sub-agents of user-scope harnesses (spec 4.4). Adding a harness trusts it.
+    const entries = desiredEntries(res, new Set(res.packages), () => ({ trusted: true }), {
+        claudeAgents: path.join(claudeHome(), 'agents'),
+        codexAgents: path.join(codexHome(), 'agents'),
+        npx: () => NPX_ANY,
+    });
+    warnings.push(...entries.warnings);
+    const applied = applyEntries('added', entries, {
+        claudeSettings: path.join(claudeHome(), 'settings.json'),
+        claudeJson: claudeJsonFile(),
+        codexHooks: path.join(codexHome(), 'hooks.json'),
+        codexRules: path.join(codexHome(), 'rules', 'harnesspm.rules'),
+        stateFile: stateFile(),
+    }, caller() !== 'model');
+    changed.push(...applied.changed);
+    if (writeCodexBlock(applied.codexMcp))
+        changed.push(path.join(codexHome(), 'config.toml'));
+    report.pending.push(...entries.pending);
+    report.held.push(...applied.held);
+    return changed;
+}
+function editJson(file, edit) {
+    const raw = readJsonIfExists(file);
+    const data = isRecord(raw) ? raw : {};
+    const before = JSON.stringify(data);
+    edit(data);
+    if (JSON.stringify(data) === before)
+        return false;
+    // A settings file that held only harnesspm's entries goes away with them.
+    if (Object.keys(data).length === 0 || (Object.keys(data).length === 1 && isRecord(data['hooks']) && Object.keys(data['hooks']).length === 0)) {
+        fs.rmSync(file, { force: true });
+        return true;
+    }
+    ensureDir(path.dirname(file));
+    fs.writeFileSync(file, `${JSON.stringify(data, null, 2)}\n`);
+    return true;
+}
+function setSessionHook(hooks, on) {
+    const groups = (Array.isArray(hooks['SessionStart']) ? hooks['SessionStart'] : []);
+    const ours = (g) => (g.hooks ?? []).some((h) => h.command === HOOK_COMMAND);
+    const rest = groups.filter((g) => !ours(g));
+    const next = on ? [...rest, { hooks: [{ type: 'command', command: HOOK_COMMAND, timeout: 120 }] }] : rest;
+    if (next.length > 0)
+        hooks['SessionStart'] = next;
+    else
+        delete hooks['SessionStart'];
+}
+/**
+ * The user-level SessionStart hook and write access to editable working copies (spec 7.5, 8.5).
+ * These widen what agents do, so callers check rule 4 first.
+ */
+export function writeUserSettings(hook, writableDirs) {
+    const changed = [];
+    const state = readState();
+    const claudeSettings = path.join(claudeHome(), 'settings.json');
+    const didClaude = editJson(claudeSettings, (data) => {
+        const hooks = isRecord(data['hooks']) ? data['hooks'] : {};
+        setSessionHook(hooks, hook);
+        if (Object.keys(hooks).length > 0)
+            data['hooks'] = hooks;
+        else
+            delete data['hooks'];
+        const permissions = isRecord(data['permissions']) ? data['permissions'] : {};
+        const current = Array.isArray(permissions['additionalDirectories']) ? permissions['additionalDirectories'].filter((d) => typeof d === 'string') : [];
+        const kept = current.filter((d) => !state.claudeDirs.includes(d) || writableDirs.includes(d));
+        const dirs = [...new Set([...kept, ...writableDirs])];
+        if (dirs.length > 0)
+            permissions['additionalDirectories'] = dirs;
+        else
+            delete permissions['additionalDirectories'];
+        if (Object.keys(permissions).length > 0)
+            data['permissions'] = permissions;
+        else
+            delete data['permissions'];
+    });
+    if (didClaude)
+        changed.push(claudeSettings);
+    const codexHooks = path.join(codexHome(), 'hooks.json');
+    if (hook || exists(codexHooks)) {
+        const didCodex = editJson(codexHooks, (data) => {
+            const hooks = isRecord(data['hooks']) ? data['hooks'] : {};
+            setSessionHook(hooks, hook);
+            data['hooks'] = hooks;
+        });
+        if (didCodex)
+            changed.push(codexHooks);
+    }
+    writeState({ ...state, claudeDirs: writableDirs });
+    return changed;
+}

package/dist/util.js

@@ -0,0 +1,140 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+/** An error that the CLI prints without a stack trace. */
+/** The npm package of harnesspm. The command it installs is `harnesspm` (spec 10.1). */
+export const PACKAGE_NAME = '@tenphi/harnesspm';
+/** Runs harnesspm in a project that depends on it: npx finds the installed command. */
+export const NPX_LOCAL = 'npx harnesspm';
+/** Runs harnesspm anywhere: npx downloads the package by its full name when it is not installed. */
+export const NPX_ANY = `npx -y ${PACKAGE_NAME}`;
+export class HarnessError extends Error {
+}
+export function exists(p) {
+    try {
+        fs.lstatSync(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function isFile(p) {
+    try {
+        return fs.statSync(p).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+export function isDir(p) {
+    try {
+        return fs.statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+export function readText(file) {
+    return fs.readFileSync(file, 'utf8');
+}
+export function readTextIfExists(file) {
+    return isFile(file) ? readText(file) : undefined;
+}
+export function readJson(file) {
+    try {
+        return JSON.parse(readText(file));
+    }
+    catch (error) {
+        throw new HarnessError(`Cannot read ${file}: ${error.message}`);
+    }
+}
+export function readJsonIfExists(file) {
+    return isFile(file) ? readJson(file) : undefined;
+}
+export function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function hash(text) {
+    return createHash('sha256').update(text).digest('hex').slice(0, 16);
+}
+/** A forward-slash path, for outputs that must be the same on every machine. */
+export function toPosix(p) {
+    return p.split(path.sep).join('/');
+}
+export function relPosix(from, to) {
+    return toPosix(path.relative(from, to)) || '.';
+}
+export function ensureDir(dir) {
+    fs.mkdirSync(dir, { recursive: true });
+}
+/** Writes a file only when its content changes. Returns true when it wrote. */
+export function writeIfChanged(file, content) {
+    if (readTextIfExists(file) === content)
+        return false;
+    ensureDir(path.dirname(file));
+    fs.writeFileSync(file, content);
+    return true;
+}
+/** Creates or updates a relative symbolic link. Returns true when it changed the link. */
+export function linkIfChanged(linkPath, target) {
+    const relTarget = path.relative(path.dirname(linkPath), target) || '.';
+    try {
+        if (fs.lstatSync(linkPath).isSymbolicLink() && fs.readlinkSync(linkPath) === relTarget)
+            return false;
+        fs.rmSync(linkPath, { recursive: false, force: true });
+    }
+    catch {
+        // The link does not exist yet.
+    }
+    ensureDir(path.dirname(linkPath));
+    fs.symlinkSync(relTarget, linkPath, 'dir');
+    return true;
+}
+export function isSymlink(p) {
+    try {
+        return fs.lstatSync(p).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+export function realpath(p) {
+    return fs.realpathSync(p);
+}
+/** Compares versions like 1.2.10 and 1.10.0 by their numeric parts. */
+export function compareVersions(a, b) {
+    const pa = a.split(/[.+-]/);
+    const pb = b.split(/[.+-]/);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const x = pa[i] ?? '';
+        const y = pb[i] ?? '';
+        const nx = Number(x);
+        const ny = Number(y);
+        if (!Number.isNaN(nx) && !Number.isNaN(ny) && x !== '' && y !== '') {
+            if (nx !== ny)
+                return nx - ny;
+        }
+        else if (x !== y) {
+            return x < y ? -1 : 1;
+        }
+    }
+    return 0;
+}
+/** The file that holds this clone's git excludes, or undefined outside a git repository. */
+export function gitExcludeFile(projectDir) {
+    const result = spawnSync('git', ['rev-parse', '--git-path', 'info/exclude'], { cwd: projectDir, encoding: 'utf8' });
+    if (result.status !== 0)
+        return undefined;
+    const p = result.stdout.trim();
+    return path.isAbsolute(p) ? p : path.join(projectDir, p);
+}
+export function listDir(dir) {
+    try {
+        return fs.readdirSync(dir).sort();
+    }
+    catch {
+        return [];
+    }
+}

package/dist/workspaces.js

@@ -0,0 +1,61 @@
+// Workspaces of a monorepo (spec 3.6): package.json "workspaces" or pnpm-workspace.yaml.
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { parse } from 'yaml';
+import { isFile, isRecord, readJsonIfExists, readTextIfExists } from './util.js';
+function patternsOf(projectDir) {
+    const pkg = readJsonIfExists(path.join(projectDir, 'package.json'));
+    const field = isRecord(pkg) ? pkg['workspaces'] : undefined;
+    const fromPackage = Array.isArray(field) ? field : isRecord(field) && Array.isArray(field['packages']) ? field['packages'] : [];
+    const pnpmText = readTextIfExists(path.join(projectDir, 'pnpm-workspace.yaml'));
+    const pnpm = pnpmText !== undefined ? parse(pnpmText) : undefined;
+    const fromPnpm = isRecord(pnpm) && Array.isArray(pnpm['packages']) ? pnpm['packages'] : [];
+    return [...fromPackage, ...fromPnpm].filter((p) => typeof p === 'string');
+}
+function segmentRegex(segment) {
+    return new RegExp(`^${segment.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]')}$`);
+}
+/** Folders that match a pattern such as `packages/*` or `apps/**`. */
+function expand(root, pattern) {
+    const segments = pattern.replace(/^\.\//, '').replace(/\/$/, '').split('/').filter(Boolean);
+    const found = [];
+    const walk = (dir, index) => {
+        if (index === segments.length) {
+            found.push(dir);
+            return;
+        }
+        const segment = segments[index];
+        let entries = [];
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        const dirs = entries.filter((e) => e.isDirectory() && e.name !== 'node_modules' && !e.name.startsWith('.'));
+        if (segment === '**') {
+            walk(dir, index + 1);
+            for (const entry of dirs)
+                walk(path.join(dir, entry.name), index);
+            return;
+        }
+        const regex = segmentRegex(segment);
+        for (const entry of dirs)
+            if (regex.test(entry.name))
+                walk(path.join(dir, entry.name), index + 1);
+    };
+    walk(root, 0);
+    return found;
+}
+/** Absolute folders of the workspaces, sorted, without the root. Empty for a single package. */
+export function findWorkspaces(projectDir) {
+    const patterns = patternsOf(projectDir);
+    const include = new Set();
+    for (const pattern of patterns.filter((p) => !p.startsWith('!')))
+        for (const dir of expand(projectDir, pattern))
+            include.add(dir);
+    for (const pattern of patterns.filter((p) => p.startsWith('!')))
+        for (const dir of expand(projectDir, pattern.slice(1)))
+            include.delete(dir);
+    return [...include].filter((dir) => dir !== projectDir && isFile(path.join(dir, 'package.json'))).sort();
+}

package/docs/spec/01-overview.md

@@ -0,0 +1,130 @@
+# 1. Overview
+
+**In short**
+
+- A library ships a `harness/` folder in its npm package. A project installs harnesspm. After every install, Claude Code and Codex see the harness of the versions that are installed.
+- There are three layers: **dependencies**, **project** and **added** harnesses. Each layer can add units, and replace, patch or drop units of the layers below.
+- An agent can improve any harness: a dependency's (upstream), the project's (in the repository), or a person's (in that person's own repository). The owner's own rules decide how a change is saved.
+
+## 1.1 Problem
+
+A library knows how it should be used. An agent that works in a project using that library does not, unless someone tells it. Today that knowledge travels by hand:
+
+- Rules are copied between repositories and drift apart.
+- Docs are reached through hand-made symlinks and hand-written indexes that fall behind.
+- A library that builds on another library restates or vendors the upstream material.
+- The same rule is written once per agent.
+- A developer's own workflow and context live in places that cloud sessions and other projects cannot see.
+
+[research/motivating-case.md](../research/motivating-case.md) shows these problems in a real chain of packages.
+
+## 1.2 How it works
+
+### Share (export)
+
+A library adds a folder and publishes as usual.
+
+```text
+my-lib/
+├── package.json        "files": [..., "harness"], "prepack": "harnesspm check"
+└── harness/
+    ├── plugin.json     name, and which packages it builds on ("extends")
+    ├── skills/…        Agent Skills
+    └── dev.harnesspm/
+        └── rules/…     Markdown rules
+```
+
+### Use (import)
+
+```bash
+npm i -D @tenphi/harnesspm
+npx harnesspm init
+```
+
+Every full install, such as `npm install` or `pnpm install`, then runs `harnesspm sync`. It finds the harness of each dependency, follows `extends` chains, applies the project's changes, and writes each agent's native files. The project commits the generated block in `AGENTS.md` and `harnesspm.lock.json`, so upgrades show up in pull requests.
+
+### Add on top
+
+```bash
+npx harnesspm add github:alex/harness
+```
+
+The person's workflow rules, context notes and skills now apply to every project on this machine, and project-specific entries to their projects. The project repository does not change.
+
+### Improve
+
+```bash
+npx harnesspm why tasty:rules/state-maps
+```
+
+`why` names the unit's owner and source. The agent edits the source and proposes the change the way the owner's rules say. The default is a branch and a pull request.
+
+## 1.3 Goals
+
+1. **One folder to share.** Standard formats. No new runtime dependency for the library.
+2. **Harness passes through dependency chains**, and each package can change what it passes on.
+3. **Install once, stay current**, at the installed versions.
+4. **One source, every agent.** Native files for Claude Code and Codex first.
+5. **Executables are first-class and safe:** scripts, hooks, MCP servers and permissions behind an explicit trust model.
+6. **Added harnesses**, such as a team's or a person's own, that never change the project's repository and also work in Claude Code cloud sessions.
+7. **Every harness can be improved by an agent**, under its owner's rules.
+8. **Standards first. harnesspm uses itself.**
+
+## 1.4 Non-goals
+
+- **A registry.** npm, git and folders are the sources.
+- **A new rule language.** Rules are Markdown. Skills follow Agent Skills.
+- **The agent's own memory.** Notes that Claude Code or Codex save by themselves stay with the agent. A person's workflow and context belong in their own added harness.
+- **Git hosting.** harnesspm does not call GitHub, GitLab or any other host. Agents use their own tools to push and open pull requests.
+- **Sandboxing.** Agents keep their own sandboxes and approval prompts.
+- **Codex Cloud, in v1.** Codex is supported on a person's computer. See [13.12](13-open-questions.md#1312-removed-in-review).
+
+## 1.5 Terms
+
+| Term | Meaning |
+| --- | --- |
+| **Harness** | Everything an agent needs for a codebase: rules, docs, skills, sub-agents, scripts, hooks, MCP servers, permissions. |
+| **Harness package** | An npm package, git repository or folder that has a `harness/` folder. |
+| **Plugin name** | The `name` in a harness's `plugin.json`. It starts every unit ID of that harness. |
+| **Unit** | One item in a harness, such as one rule or one script. Each unit has an ID, such as `uikit:rules/forms`. |
+| **Patch** | A Markdown file that replaces, adds or removes sections of a rule and keeps the rest. |
+| **Layer** | Where units come from: dependencies, project or added harnesses. A higher layer can drop, replace or patch units of the layers below. |
+| **Added harness** | A harness that a person adds on their machine, on top of the repository's, such as a team's or their own. Never committed. Several can be stacked. |
+| **Scope** | Where an added harness applies: **user** (every repository on the machine) or **local** (one repository). |
+| **Owner** | The harness a unit comes from: a dependency, the project, or an added harness. The owner's rules decide how its units change. |
+| **Source** | Where something is read from: the file of a unit, or the git repository, folder or npm package of an added harness. Outputs are generated from sources. |
+| **Project entry** | A folder in an added harness with units for one repository, matched by its git remote. |
+| **Output** | A file or block harnesspm writes for an agent. Never edited by hand. |
+| **Managed block** | The part of a Markdown file that harnesspm writes, between `BEGIN:harnesspm` and `END:harnesspm` markers. |
+| **Lock** | `harnesspm.lock.json`: the committed record of harness packages and unit hashes. |
+| **Executable unit** | A script, hook, MCP server or allow permission. Needs trust. |
+| **Trust** | A project's consent, in `harnesspm.json`, for a package's executable units to run. |
+| **Pending** | An executable unit that harnesspm does not write yet: its package is not trusted, a `"pin"` package has a new version, or the agent's model started the run. |
+
+## 1.6 Base scenarios
+
+Every feature serves at least one of these. Each must take as few steps as possible.
+
+| # | Scenario | What the person does |
+| --- | --- | --- |
+| S1 | A library shares its harness | Adds `harness/` and lists it in `files`. |
+| S2 | A library builds on upstream harness | Lists the upstream packages in `extends`, adds its own units. |
+| S3 | A project uses the harness of its dependencies | `npm i -D @tenphi/harnesspm` and `npx harnesspm init`, once. |
+| S4 | A project changes one upstream rule | One `patch` for a few sections, or one `replace` or `exclude` entry. |
+| S5 | A project upgrades a dependency | Nothing after a full install. After `npm install <pkg>` or `pnpm add`, `npx harnesspm sync`. The pull request shows what changed. |
+| S6 | Several repositories share a policy | A harness-only package, added as a dev dependency. |
+| S7 | A monorepo | Nothing. Each workspace gets the harness of its own dependencies. |
+| S8 | A library ships a tool for agents | A script in the harness. Projects that trust the package can run it. |
+| S9 | A person adds a harness on top, such as their team's or their own | `npx harnesspm add <source>`, once per machine. |
+| S10 | A person keeps workflow and context outside project repositories | Rules and notes in their own added harness, with project entries. |
+| S11 | An agent improves a harness | Edits the source that `harnesspm why` names, then saves under the owner's rules. |
+| S12 | A person works in a Claude Code cloud session | The same `add` in the environment's setup script, or asked of the agent. |
+| S13 | A job reads the harness without an install, such as a review bot | `npx -y @tenphi/harnesspm fetch`. |
+
+## 1.7 What is committed
+
+| Committed | Per machine (excluded through `.git/info/exclude`) |
+| --- | --- |
+| `harnesspm.json`, `harnesspm.lock.json`, the managed blocks in `AGENTS.md`, the `@AGENTS.md` lines in `CLAUDE.md` | Everything else: links, agent settings, `.codex/`, outputs of added harnesses |
+
+Committed files depend only on the dependency and project layers, so every teammate and CI produce the same result. harnesspm never edits `.gitignore`.