@useshifu/coding-harness 0.3.3 → 0.3.5

package/README.md

@@ -5,7 +5,7 @@
 ## Connect
 
 ```sh
-npx @useshifu/coding-harness connect --harness <codex|claude_code|opencode>
+npx --yes @useshifu/coding-harness connect --harness <codex|claude_code|opencode>
 ```
 
 Connect installs the local instruction and scheduled runner, saves the connection key with owner-only permissions, and uses these defaults without setup questions:
@@ -20,35 +20,39 @@ For named meeting transcripts, set your display name in Shifu Profile so your sp
 
 The shortcuts are symlinks to the same folder, not additional watched folders. An existing conflicting `Shifu` item is left untouched and reported. To choose another existing, readable folder, use `--input-folder <path>` with `connect` or `config update`; Shifu checks the path before saving the change. No macOS permission flow is required by the CLI.
 
-No content is sent during setup. Re-running `connect` on an older installation keeps its key, checkpoints, and selected sync policy. Change the choices later with:
+No content is sent during setup. Every `connect` asks for a connection key and verifies it with Shifu for the chosen coding tool before saving it or reporting success. An invalid key or unreachable server leaves the existing connection unchanged. Replacing a key resets local checkpoints so existing work can be reconsidered for the new connection; the selected sync policy remains. If a coding tool cannot run `npx` or accept hidden input in its tool terminal, run the same command in your own interactive terminal and check the confirmation output. Change the choices later with:
 
 ```sh
-npx @useshifu/coding-harness config update --harness <codex|claude_code|opencode> --interval-hours 1 --approval-mode automatic --input-folder ~/Desktop/Shifu
+npx --yes @useshifu/coding-harness config update --harness <codex|claude_code|opencode> --interval-hours 1 --approval-mode automatic --input-folder ~/Desktop/Shifu
 ```
 
 Older configuration files remain on-demand and manual until either command completes onboarding; upgrading the package alone never enables background upload.
 
+To disconnect this device, run `npx --yes @useshifu/coding-harness disconnect --harness <codex|claude_code|opencode>`. This removes the local key, schedule, and checkpoints. It does not revoke the key on Shifu; revoke the old key there if it should no longer work.
+
 ## Operate
 
 ```sh
-npx @useshifu/coding-harness status --harness codex
-npx @useshifu/coding-harness sessions --harness codex --hours 24
-npx @useshifu/coding-harness review --harness codex --session-ref opaque-session-id
-npx @useshifu/coding-harness pending --harness codex
-npx @useshifu/coding-harness approve --harness codex
-npx @useshifu/coding-harness sync-files --harness codex
+npx --yes @useshifu/coding-harness status --harness codex
+npx --yes @useshifu/coding-harness sessions --harness codex --hours 24
+npx --yes @useshifu/coding-harness review --harness codex --session-ref opaque-session-id
+npx --yes @useshifu/coding-harness pending --harness codex
+npx --yes @useshifu/coding-harness approve --harness codex
+npx --yes @useshifu/coding-harness sync-files --harness codex
 ```
 
 Automatic scheduled runs send each accepted segment and advance its local checkpoint only after the server returns a matching receipt. Manual scheduled runs rebuild an accumulated local queue without advancing checkpoints and create or resume one content-free harness session when the pending count changes; one approval sends the queue in order. Network failures and server throttling are retried, while rejected segments stay pending.
 
-The same scheduled run checks the input folder. `sync-files` checks it immediately without changing the schedule. Before sending new or changed files, the runner polls unfinished jobs from its local checkpoints. It sends supported file bytes over the configured HTTPS connection (or localhost HTTP for development). The server accepts each file as a background job and processes its text in chunks; upload does not wait for claim extraction. A later scheduled or manual sync polls the job's result. Only `processed`, `no_claims`, or `duplicate` finalizes the local checkpoint; `partial` reopens failed chunks on the next sync. Existing file checkpoints are checked once again after upgrading to this job-based protocol. Files larger than 20 MB remain pending with an error. The scanner reads regular files directly in the chosen folder and ignores symlinks and subfolders. Unknown formats are reported as unsupported rather than treated as successful syncs.
+The same scheduled run checks the input folder. `sync-files` checks it immediately without changing the schedule. Before sending new or changed files, the runner polls unfinished jobs from its local checkpoints. It sends supported file bytes over the configured HTTPS connection (or localhost HTTP for development). The server accepts each file as a background job and processes its text in chunks; upload does not wait for claim extraction. A later scheduled or manual sync polls the job's result. Only `processed`, `no_claims`, or `duplicate` finalizes the local checkpoint; `partial` reopens failed chunks on the next sync. On this upgrade, completed file checkpoints are replayed once so the new extraction can retain suggestions; in-flight jobs are polled first and replayed after finishing. Server-side idempotency prevents already published claims from being duplicated. Files larger than 20 MB remain pending with an error. The scanner reads regular files directly in the chosen folder and ignores symlinks and subfolders. Unknown formats are reported as unsupported rather than treated as successful syncs.
+
+The file-job result reports published claims separately from needs-evidence suggestions. A `no_claims` result can still contain suggestions: these are possible contributions awaiting evidence or attribution, not verified claims. The runner reports the suggestion count but never labels those suggestions as established work. It does not print the file's text, candidate statements, or source excerpts to logs. Use Shifu to inspect the suggestions and their evidence status. A result with zero claims and zero suggestions means no user-attributable contribution was extracted; it does not mean the upload failed.
 
-The connector captures any useful harness activity, including engineering, product discovery, writing, interview feedback, research, and planning. Version-four payloads support generic `activity` items without a technical scope and accept a safe session-level summary when no item survives redaction. Version 1–3 clients remain supported.
+The connector captures supported harness work in engineering, product discovery, writing, interview feedback, research, and planning. Automatic sync turns completed actions and known work topics into separate controlled statements without sending source prose. If a segment has no supported work items, it advances the checkpoint without creating a claim. Version 1–3 clients remain supported.
 
 ## Sync a prepared payload
 
 ```sh
-printf '%s' '{"harness":"codex","sessionRef":"opaque-session-id","fromTurn":1,"toTurn":3,"title":"Prepared structured interview feedback","summary":"Prepared structured interview feedback and clarified the recommendation.","evidence":[{"kind":"activity","title":"Drafted interview feedback","statement":"Prepared structured interview feedback."}],"verification":[],"decisions":[],"redactionVersion":4}' | npx @useshifu/coding-harness sync --harness codex
+printf '%s' '{"harness":"codex","sessionRef":"opaque-session-id","fromTurn":1,"toTurn":3,"title":"Prepared structured interview feedback","summary":"Prepared structured interview feedback and clarified the recommendation.","evidence":[{"kind":"activity","title":"Drafted interview feedback","statement":"Prepared structured interview feedback."}],"verification":[],"decisions":[],"redactionVersion":4}' | npx --yes @useshifu/coding-harness sync --harness codex
 ```
 
 Automatic mode sends immediately. Manual mode asks once unless the calling harness already obtained approval and passes `--approved`.

package/bin/shifu-harness.js

@@ -42,7 +42,7 @@ const MAX_INTERVAL_HOURS = 720;
 const SCHEDULER_TICK_MINUTES = 15;
 const MAX_RETRIES = 4;
 const MAX_WORK_FILE_BYTES = 20 * 1024 * 1024;
-const WORK_FILE_SYNC_VERSION = 3;
+const WORK_FILE_SYNC_VERSION = 4;
 const WORK_FILE_EXTENSIONS = new Set([".txt", ".md", ".rtf", ".docx"]);
 const FINAL_WORK_FILE_STATUSES = new Set(["processed", "no_claims", "duplicate"]);
 const ACTIVE_WORK_FILE_STATUSES = new Set(["queued", "processing", "retrying"]);
@@ -53,7 +53,7 @@ Put work logs, meeting transcripts, and other work documents directly in this fo
 
 Supported files: .txt, .md, .rtf, and .docx, up to 20 MB each. Subfolders, links, images, and screenshots are not processed. This README is not synced. Unsupported files are counted but never uploaded.
 
-Uploading starts a background job. Shifu checks unfinished jobs before the next scheduled or manual sync; a file is complete only when the server reports its final result. A partial result stays pending for retry.
+Uploading starts a background job. Shifu checks unfinished jobs before the next scheduled or manual sync; a file is complete only when the server reports its final result. A partial result stays pending for retry. A completed file may have published claims, needs-evidence suggestions, or neither; suggestions are not verified claims.
 
 Files you add are sent to Shifu for parsing and sanitization; they are not redacted on this device. Only place files here if you want them processed. For named meeting transcripts, set your display name in Shifu Profile so your speaker turns can be matched.
 `;
@@ -543,41 +543,77 @@ function conciseTitle(statement, fallback) {
   return `${value.slice(0, MAX_TITLE_LENGTH - 1).trimEnd()}…`;
 }
 
-const ACTIVITY_CATEGORIES = [
-  { key: "interview_feedback", title: "Interview feedback", pattern: /\b(?:interview|candidate|hiring feedback)\b/i },
-  { key: "professional_writing", title: "Professional writing", pattern: /\b(?:linkedin|social post|article|newsletter|professional post|writing)\b/i },
-  { key: "product_discovery", title: "Product discovery", pattern: /\b(?:product discovery|user research|customer research|requirements?|roadmap)\b/i },
-  { key: "product_delivery", title: "Product and design delivery", pattern: /\b(?:landing page|website|user interface|user experience|design|prototype)\b/i },
-  { key: "research", title: "Research", pattern: /\b(?:research|investigat|compar|evaluat|analysis|analyz)\w*/i },
-  { key: "planning", title: "Planning", pattern: /\b(?:plan|strategy|prioriti|proposal|brief)\w*/i },
-  { key: "documentation", title: "Documentation", pattern: /\b(?:documentation|readme|guide|runbook)\b/i },
-  { key: "engineering", title: "Engineering", pattern: /\b(?:implement|code|bug|fix|test|api|database|frontend|backend|refactor|deploy)\w*/i },
+const WORK_ACTIONS = [
+  { key: "implemented", title: "Implemented", pattern: /^(?:I\s+|We\s+)?(?:implemented|added|built|shipped)\b/i },
+  { key: "fixed", title: "Fixed", pattern: /^(?:I\s+|We\s+)?(?:fixed|resolved|corrected)\b/i },
+  { key: "improved", title: "Improved", pattern: /^(?:I\s+|We\s+)?(?:improved|optimized|updated)\b/i },
+  { key: "refactored", title: "Refactored", pattern: /^(?:I\s+|We\s+)?refactored\b/i },
+  { key: "designed", title: "Designed", pattern: /^(?:I\s+|We\s+)?designed\b/i },
+  { key: "prepared", title: "Prepared", pattern: /^(?:I\s+|We\s+)?(?:prepared|drafted|wrote)\b/i },
+  { key: "reviewed", title: "Reviewed", pattern: /^(?:I\s+|We\s+)?(?:reviewed|audited)\b/i },
+  { key: "investigated", title: "Investigated", pattern: /^(?:I\s+|We\s+)?(?:investigated|researched|evaluated|compared)\b/i },
+  { key: "deployed", title: "Deployed", pattern: /^(?:I\s+|We\s+)?(?:deployed|published)\b/i },
 ];
 
-function safeActivityEvidence(notes, segment) {
-  const source = notes.map((note) => note.note).join("\n");
-  const categories = ACTIVITY_CATEGORIES.filter((category) => category.pattern.test(source));
-  if (categories.length === 0) return [];
-  return categories.map((category, index) => ({
-    kind: "activity",
-    title: category.title,
-    statement: `Used the harness for ${category.title.toLowerCase()}.`,
-    itemRef: `t${segment.fromTurn}_${category.key}_${index + 1}`,
-  }));
+const WORK_OBJECTS = [
+  { key: "interview_feedback", title: "interview feedback", pattern: /\b(?:interview feedback|candidate feedback|hiring feedback)\b/i },
+  { key: "professional_post", title: "professional writing", pattern: /\b(?:linkedin|social post|professional post|newsletter|article)\b/i },
+  { key: "home_review", title: "Home review", pattern: /\b(?:home review|work review|review on the home page)\b/i },
+  { key: "connection_key", title: "connection key validation", pattern: /\b(?:connection key|connector key|key validation)\b/i },
+  { key: "claim_extraction", title: "claim extraction", pattern: /\b(?:claim extraction|claim generation|claim matching)\b/i },
+  { key: "retry", title: "retry handling", pattern: /\b(?:retries|retry)\b/i },
+  { key: "cache", title: "cache behavior", pattern: /\b(?:cache|caching|ttl)\b/i },
+  { key: "navigation", title: "navigation", pattern: /\b(?:navigation|sidebar|sub.?nav)\b/i },
+  { key: "sync", title: "sync behavior", pattern: /\b(?:sync|synchronization|checkpoint)\b/i },
+  { key: "auth", title: "authentication", pattern: /\b(?:authentication|sign.?in|login)\b/i },
+  { key: "permissions", title: "access controls", pattern: /\b(?:authorization|permissions?|access control)\b/i },
+  { key: "database", title: "database migration", pattern: /\b(?:database migration|schema migration|postgres migration)\b/i },
+  { key: "api", title: "API endpoint", pattern: /\b(?:api|endpoint|http route)\b/i },
+  { key: "frontend", title: "frontend component", pattern: /\b(?:frontend|react component|ui component|user interface)\b/i },
+  { key: "test", title: "test coverage", pattern: /\b(?:test|tests|test suite|coverage)\b/i },
+  { key: "docs", title: "documentation", pattern: /\b(?:documentation|readme|guide|runbook)\b/i },
+  { key: "deploy", title: "deployment pipeline", pattern: /\b(?:deployment|deploy pipeline|ci pipeline|release pipeline)\b/i },
+  { key: "performance", title: "performance", pattern: /\b(?:performance|latency|throughput)\b/i },
+  { key: "security", title: "security controls", pattern: /\b(?:security|vulnerability|secret handling)\b/i },
+  { key: "research", title: "product research", pattern: /\b(?:product discovery|user research|customer research)\b/i },
+  { key: "planning", title: "project plan", pattern: /\b(?:roadmap|project plan|delivery plan)\b/i },
+];
+
+function safeActivityEvidence(notes) {
+  const evidence = [];
+  const seen = new Set();
+  for (const [noteIndex, { turn, note }] of notes.entries()) {
+    let inCodeBlock = false;
+    for (const [lineIndex, rawLine] of note.split("\n").entries()) {
+      if (rawLine.trim().startsWith("```")) { inCodeBlock = !inCodeBlock; continue; }
+      if (inCodeBlock) continue;
+      const line = rawLine.trim().replace(/^[-*]\s+/, "").split(/[.;—]/, 1)[0];
+      const action = WORK_ACTIONS.find((item) => item.pattern.test(line));
+      const object = WORK_OBJECTS.find((item) => item.pattern.test(line));
+      if (!action || !object) continue;
+      const key = `${action.key}:${object.key}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const title = `${action.title} ${object.title}`;
+      evidence.push({ kind: "activity", title, statement: `${title}.`, itemRef: `t${turn}_n${noteIndex + 1}_l${lineIndex + 1}` });
+      if (evidence.length === MAX_EVIDENCE_ITEMS) return evidence;
+    }
+  }
+  return evidence;
 }
 
 function payloadForSegment(harness, segment) {
   const { notes } = reviewSegment(harness, segment.sessionRef, segment.fromTurn, segment.toTurn);
-  const fallback = `${HARNESS_NAMES[harness]} activity across turns ${segment.fromTurn}–${segment.toTurn}.`;
-  const evidence = safeActivityEvidence(notes, segment).slice(0, MAX_EVIDENCE_ITEMS);
-  const title = evidence.length === 1 ? evidence[0].title : evidence.length > 1 ? "Multiple harness activities" : fallback;
-  const summary = evidence.length ? `Used ${HARNESS_NAMES[harness]} for ${evidence.map((item) => item.title.toLowerCase()).join(", ")}.` : fallback;
+  const evidence = safeActivityEvidence(notes);
+  const title = evidence.length ? evidence[0].title : "No supported work identified";
+  const summary = evidence.length > 1 ? `${evidence[0].statement} ${evidence.length - 1} more supported work items.` :
+    evidence.length === 1 ? evidence[0].statement : "This range had no supported work items.";
   return {
     harness,
     sessionRef: segment.sessionRef,
     fromTurn: segment.fromTurn,
     toTurn: segment.toTurn,
-    title: conciseTitle(title, fallback),
+    title: conciseTitle(title, "No supported work identified"),
     summary,
     evidence,
     verification: [],
@@ -667,7 +703,12 @@ async function confirm(question) {
 
 async function readSecret(input = process.stdin) {
   const ownsInput = !input.isTTY;
-  if (ownsInput) input = new tty.ReadStream(fs.openSync(process.platform === "win32" ? "CONIN$" : "/dev/tty", "r"));
+  if (ownsInput) {
+    let descriptor;
+    try { descriptor = fs.openSync(process.platform === "win32" ? "CONIN$" : "/dev/tty", "r"); }
+    catch { throw new Error("This terminal cannot accept a hidden connection key. Run connect in your own interactive terminal."); }
+    input = new tty.ReadStream(descriptor);
+  }
   const wasRaw = input.isRaw;
   process.stderr.write("Connection key (hidden): ");
   input.setRawMode(true);
@@ -755,11 +796,11 @@ function install(harness, quiet = false) {
       .replaceAll('"codex"', '"opencode"')
       .replaceAll("--harness codex", "--harness opencode")
       .replaceAll("Codex", "OpenCode")
-      .replaceAll("npx @useshifu/coding-harness", `"${process.execPath}" "${installedRunnerPath()}"`);
+      .replaceAll("npx --yes @useshifu/coding-harness", `"${process.execPath}" "${installedRunnerPath()}"`);
     fs.writeFileSync(path.join(skillDest, "SKILL.md"), skillContent, { mode: 0o600 });
 
     const commandContent = fs.readFileSync(path.join(__dirname, "..", "commands", "shifu-sync.md"), "utf8")
-      .replaceAll("npx @useshifu/coding-harness", `"${process.execPath}" "${installedRunnerPath()}"`);
+      .replaceAll("npx --yes @useshifu/coding-harness", `"${process.execPath}" "${installedRunnerPath()}"`);
     for (const folder of ["command", "commands"]) {
       const commandDir = path.join(configDir, "opencode", folder);
       fs.mkdirSync(commandDir, { recursive: true, mode: 0o700 });
@@ -773,14 +814,14 @@ function install(harness, quiet = false) {
       .replaceAll('"codex"', `"${harness}"`)
       .replaceAll("--harness codex", `--harness ${harness}`)
       .replaceAll("Codex", HARNESS_NAMES[harness])
-      .replaceAll("npx @useshifu/coding-harness", `"${process.execPath}" "${installedRunnerPath()}"`);
+      .replaceAll("npx --yes @useshifu/coding-harness", `"${process.execPath}" "${installedRunnerPath()}"`);
     fs.writeFileSync(skill, content, { mode: 0o600 });
   }
   const removedHooks = harness === "codex" && removeCodexHooks();
   if (!quiet) {
     console.error(`Installed the Shifu sync instruction for ${HARNESS_NAMES[harness]}.`);
     if (removedHooks) console.error("Removed obsolete Codex lifecycle hooks.");
-    console.error(`Next: coding-harness connect --harness ${harness}`);
+    console.error(`Next: npx --yes @useshifu/coding-harness connect --harness ${harness}`);
   }
 }
 
@@ -849,6 +890,45 @@ function installSchedule(harness) {
   return artifact.file;
 }
 
+function removeSchedule(harness) {
+  const artifact = schedulerArtifact(harness, process.env.SHIFU_PLATFORM || process.platform);
+  if (process.env.SHIFU_SKIP_SCHEDULER_ACTIVATION !== "1") {
+    if (process.platform === "darwin") {
+      const domain = `gui/${process.getuid()}`;
+      const label = `com.useshifu.coding-harness.${harness}`;
+      const scheduleIsLoaded = () => {
+        let listing;
+        try { listing = execFileSync("launchctl", ["list"], { encoding: "utf8" }); }
+        catch { throw new Error("Could not check the Shifu schedule. Disconnect was cancelled."); }
+        return listing.split(/\r?\n/).some((line) => line.trim().split(/\s+/).at(-1) === label);
+      };
+      if (scheduleIsLoaded()) {
+        try { execFileSync("launchctl", ["bootout", domain, artifact.file], { stdio: "ignore" }); }
+        catch { throw new Error("Could not stop the Shifu schedule. Disconnect was cancelled."); }
+        if (scheduleIsLoaded()) throw new Error("The Shifu schedule is still running. Disconnect was cancelled.");
+      }
+    } else if (process.platform === "linux") {
+      if (fs.existsSync(artifact.file)) {
+        const timer = `shifu-coding-harness-${harness}.timer`;
+        try { execFileSync("systemctl", ["--user", "disable", "--now", timer], { stdio: "ignore" }); }
+        catch { throw new Error("Could not stop the Shifu schedule. Disconnect was cancelled."); }
+        let state;
+        try { state = execFileSync("systemctl", ["--user", "show", "--property=ActiveState", "--value", timer], { encoding: "utf8" }).trim(); }
+        catch { throw new Error("Could not verify that the Shifu schedule stopped. Disconnect was cancelled."); }
+        if (state === "active" || state === "activating") throw new Error("The Shifu schedule is still running. Disconnect was cancelled.");
+      }
+    } else if (process.platform === "win32") {
+      if (fs.existsSync(artifact.file)) {
+        try { execFileSync("schtasks.exe", ["/Delete", "/TN", `Shifu coding harness ${harness}`, "/F"], { stdio: "ignore" }); }
+        catch { throw new Error("Could not stop the Shifu schedule. Disconnect was cancelled."); }
+      }
+    }
+  }
+  for (const item of [artifact, ...(artifact.extraFiles || [])]) {
+    try { fs.unlinkSync(item.file); } catch (error) { if (error?.code !== "ENOENT") throw error; }
+  }
+}
+
 function scheduleNextRun(harness, intervalHours) {
   const state = readState(harness);
   state.schedule = { ...(state.schedule || {}), nextRunAt: Date.now() + intervalHours * 3_600_000 };
@@ -864,11 +944,28 @@ async function chooseSyncPolicy(existing) {
   };
 }
 
-async function connect(harness) {
+async function validateConnection(apiUrl, token, harness) {
+  let response;
+  try {
+    response = await fetch(`${apiUrl}/v1/connectors/coding-sessions/connection?harness=${encodeURIComponent(harness)}`, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(10_000),
+    });
+  } catch {
+    throw new Error("Could not reach Shifu to verify the connection key. Nothing was changed.");
+  }
+  if (response.status === 401 || response.status === 422) throw new Error("Shifu rejected this connection key for the selected coding tool. Nothing was changed.");
+  if (!response.ok) throw new Error(`Shifu could not verify the connection key (HTTP ${response.status}). Nothing was changed.`);
+  const result = await response.json().catch(() => null);
+  if (result?.data?.connected !== true) throw new Error("Shifu returned an invalid connection check. Nothing was changed.");
+}
+
+async function connect(harness, readKey = readSecret) {
   const existing = readJSON(configPath(harness), undefined);
-  const token = existing?.token || (await readSecret()).trim();
+  const token = (await readKey()).trim();
   if (!TOKEN_PATTERN.test(token)) throw new Error("The connection key is invalid.");
   const apiUrl = requireSafeApiUrl(option("--api-url") || existing?.apiUrl || process.env.SHIFU_API_URL || DEFAULT_API_URL);
+  await validateConnection(apiUrl, token, harness);
   const savedPolicy = existing && normalizedPolicy(existing);
   const currentPolicy = savedPolicy?.onboardingComplete ? savedPolicy : { intervalHours: DEFAULT_INTERVAL_HOURS, approvalMode: "automatic", excludedSessionRefs: savedPolicy?.excludedSessionRefs || [] };
   const selected = await chooseSyncPolicy(currentPolicy);
@@ -878,6 +975,11 @@ async function connect(harness) {
   install(harness, true);
   const scheduleFile = installSchedule(harness);
   writeJSON(configPath(harness), { ...existing, version: CONFIG_VERSION, apiUrl, token, harness, syncPolicy, inputFolder });
+  if (existing?.token && existing.token !== token) {
+    for (const file of [statePath(harness), pendingPath(harness)]) {
+      try { fs.unlinkSync(file); } catch (error) { if (error?.code !== "ENOENT") throw error; }
+    }
+  }
   scheduleNextRun(harness, syncPolicy.intervalHours);
   console.error(`${HARNESS_NAMES[harness]} is connected. It will sync every ${syncPolicy.intervalHours} hours with ${syncPolicy.approvalMode} approval.`);
   console.error(`Shifu sync folder: ${inputFolder}. Place .txt, .md, .rtf, or .docx files there. Only grounded contributions will become claims.`);
@@ -885,6 +987,16 @@ async function connect(harness) {
   console.error(`Schedule installed at ${scheduleFile}. No content was sent during setup.`);
 }
 
+function disconnect(harness) {
+  readConfig(harness);
+  if (fs.existsSync(lockPath(harness))) throw new Error("A Shifu sync is running. Try disconnecting again after it finishes.");
+  removeSchedule(harness);
+  for (const file of [configPath(harness), statePath(harness), pendingPath(harness)]) {
+    try { fs.unlinkSync(file); } catch (error) { if (error?.code !== "ENOENT") throw error; }
+  }
+  console.error(`${HARNESS_NAMES[harness]} is disconnected on this device. Revoke the old key in Shifu if you no longer want it usable.`);
+}
+
 async function updateConfig(harness) {
   const config = readConfig(harness);
   const savedPolicy = normalizedPolicy(config);
@@ -1059,7 +1171,24 @@ async function postWorkFile(config, file, contents) {
 function validWorkFileJob(receipt) {
   return typeof receipt?.id === "string" && receipt.id.length > 0 &&
     (ACTIVE_WORK_FILE_STATUSES.has(receipt.status) || FINAL_WORK_FILE_STATUSES.has(receipt.status) || receipt.status === "partial") &&
-    Number.isInteger(receipt.claimsCreated) && receipt.claimsCreated >= 0;
+    Number.isInteger(receipt.claimsCreated) && receipt.claimsCreated >= 0 &&
+    (receipt.candidateCount === undefined || (Number.isInteger(receipt.candidateCount) && receipt.candidateCount >= 0));
+}
+
+function workFileResult(job) {
+  const claims = `${job.claimsCreated} claim${job.claimsCreated === 1 ? "" : "s"}`;
+  const candidates = job.candidateCount > 0 ? `, ${job.candidateCount} needs-evidence suggestion${job.candidateCount === 1 ? "" : "s"}` : "";
+  return `${job.status} (${claims}${candidates})`;
+}
+
+function workFileEntries(state, folder) {
+  if (state.workFiles?.folder !== folder) return {};
+  const files = state.workFiles.files || {};
+  if (state.workFiles.version === WORK_FILE_SYNC_VERSION) return files;
+  // Replay old completed checkpoints once, but never abandon an accepted job.
+  return Object.fromEntries(Object.entries(files)
+    .filter(([, entry]) => entry && typeof entry === "object" && entry.jobId)
+    .map(([name, entry]) => [name, { ...entry, replayOnCompletion: true }]));
 }
 
 async function getWorkFileJob(config, jobId) {
@@ -1090,7 +1219,7 @@ async function getWorkFileJob(config, jobId) {
 
 function saveWorkFileEntry(harness, folder, name, entry) {
   const state = readState(harness);
-  const files = state.workFiles?.folder === folder && state.workFiles.version === WORK_FILE_SYNC_VERSION ? state.workFiles.files || {} : {};
+  const files = workFileEntries(state, folder);
   state.workFiles = { folder, version: WORK_FILE_SYNC_VERSION, files: { ...files, [name]: entry } };
   saveState(harness, state);
 }
@@ -1099,7 +1228,7 @@ async function syncWorkFiles(harness, config = readConfig(harness)) {
   if (typeof config.inputFolder !== "string") throw new Error("No input folder is configured. Run connect again to enable file sync.");
   const folder = validateInputFolder(configuredInputFolder(config));
   const state = readState(harness);
-  const prior = state.workFiles?.folder === folder && state.workFiles.version === WORK_FILE_SYNC_VERSION ? state.workFiles.files || {} : {};
+  const prior = workFileEntries(state, folder);
   let submitted = 0;
   const failedFiles = new Set();
   const unverifiedJobs = new Set();
@@ -1108,9 +1237,14 @@ async function syncWorkFiles(harness, config = readConfig(harness)) {
     try {
       const job = await getWorkFileJob(config, entry.jobId);
       if (FINAL_WORK_FILE_STATUSES.has(job.status)) {
-        saveWorkFileEntry(harness, folder, name, entry.sha256);
-        prior[name] = entry.sha256;
-        console.error(`${name}: ${job.status} (${job.claimsCreated} claim${job.claimsCreated === 1 ? "" : "s"}).`);
+        console.error(`${name}: ${workFileResult(job)}.`);
+        if (entry.replayOnCompletion) {
+          prior[name] = { ...entry, status: "partial" };
+          saveWorkFileEntry(harness, folder, name, prior[name]);
+        } else {
+          saveWorkFileEntry(harness, folder, name, entry.sha256);
+          prior[name] = entry.sha256;
+        }
       } else {
         prior[name] = { ...entry, status: job.status };
         saveWorkFileEntry(harness, folder, name, prior[name]);
@@ -1136,7 +1270,7 @@ async function syncWorkFiles(harness, config = readConfig(harness)) {
       saveWorkFileEntry(harness, folder, name, entry);
       prior[name] = entry;
       submitted += 1;
-      console.error(`${name}: ${job.status}${FINAL_WORK_FILE_STATUSES.has(job.status) ? ` (${job.claimsCreated} claim${job.claimsCreated === 1 ? "" : "s"})` : " (processing in background)"}.`);
+      console.error(`${name}: ${FINAL_WORK_FILE_STATUSES.has(job.status) ? workFileResult(job) : `${job.status} (processing in background)`}.`);
     } catch (error) {
       failedFiles.add(name);
       console.error(`${name} remains pending: ${error.message}`);
@@ -1383,7 +1517,7 @@ function status(harness) {
   const state = readState(harness);
   const pending = readJSON(pendingPath(harness), { segments: [] });
   const folder = config.inputFolder ? configuredInputFolder(config) : null;
-  const entries = state.workFiles?.version === WORK_FILE_SYNC_VERSION && state.workFiles.folder === folder ? Object.values(state.workFiles.files || {}) : [];
+  const entries = folder ? Object.values(workFileEntries(state, folder)) : [];
   let unsupportedFiles = null;
   let inputFolderError = null;
   if (folder) {
@@ -1454,6 +1588,7 @@ async function main() {
   const harness = requireHarness(option("--harness"));
   if (command === "install") return install(harness);
   if (command === "connect") return connect(harness);
+  if (command === "disconnect") return disconnect(harness);
   if (command === "config" && subCommand === "update") return updateConfig(harness);
   if (command === "sync") return sync(harness);
   if (command === "sync-files") return syncFilesNow(harness);
@@ -1463,7 +1598,7 @@ async function main() {
   if (command === "status") return status(harness);
   if (command === "sessions" || command === "discover" || (command === "session" && (subCommand === "discover" || subCommand === "list" || !subCommand || subCommand.startsWith("-")))) return sessions(harness);
   if (command === "review") return review(harness);
-  throw new Error("Use install, connect, config update, status, sessions, review, sync, sync-files, pending, approve, or scheduled-sync.");
+  throw new Error("Use install, connect, disconnect, config update, status, sessions, review, sync, sync-files, pending, approve, or scheduled-sync.");
 }
 
 if (require.main === module) {
@@ -1475,4 +1610,4 @@ if (require.main === module) {
     });
 }
 
-module.exports = { approvalNotificationInvocation, claudeReview, claudeSession, codexReview, codexSession, configPath, configuredSyncPolicy, defaultInputFolder, finalAssistantNote, install, installDestination, localSessions, normalizedPolicy, notificationSessionRef, opencodeQuery, opencodeReview, opencodeSessions, payloadForSegment, pendingSegments, prepareInputFolder, readSecret, removeHooks, requireSafeApiUrl, reviewCandidates, schedulerArtifact, statePath, syncWorkFiles, textIsSafe, unsyncedCodexSessions, validateInputFolder, validSyncReceipt, validateApprovalMode, validateIntervalHours, validateSync, workFiles };
+module.exports = { approvalNotificationInvocation, claudeReview, claudeSession, codexReview, codexSession, configPath, configuredSyncPolicy, connect, defaultInputFolder, disconnect, finalAssistantNote, install, installDestination, localSessions, normalizedPolicy, notificationSessionRef, opencodeQuery, opencodeReview, opencodeSessions, payloadForSegment, pendingSegments, prepareInputFolder, readSecret, removeHooks, requireSafeApiUrl, reviewCandidates, schedulerArtifact, statePath, syncWorkFiles, textIsSafe, unsyncedCodexSessions, validateConnection, validateInputFolder, validSyncReceipt, validateApprovalMode, validateIntervalHours, validateSync, workFiles };

package/commands/shifu-sync.md

@@ -2,9 +2,9 @@
 description: Inspect or sync redacted OpenCode activity using the saved Shifu policy.
 ---
 
-Run `npx @useshifu/coding-harness status --harness opencode` first.
+Run `npx --yes @useshifu/coding-harness status --harness opencode` first.
 
-For an explicit Shifu input-folder sync, run `sync-files --harness opencode`. It polls unfinished jobs before submitting new or changed `.txt`, `.md`, `.rtf`, and `.docx` files up to 20 MB. Upload starts asynchronous server processing; check status on the next manual or scheduled sync. Only a final `processed`, `no_claims`, or `duplicate` result completes the local checkpoint; a `partial` result remains retryable. Unsupported files are counted but not uploaded. No claim-review step is needed. Do not treat another speaker's work or a meeting action item as the user's contribution. The server parses and sanitizes files; the local runner does not redact file contents.
+For an explicit Shifu input-folder sync, run `sync-files --harness opencode`. It polls unfinished jobs before submitting new or changed `.txt`, `.md`, `.rtf`, and `.docx` files up to 20 MB. Upload starts asynchronous server processing; check status on the next manual or scheduled sync. Only a final `processed`, `no_claims`, or `duplicate` result completes the local checkpoint; a `partial` result remains retryable. Completed file checkpoints from the previous runner are replayed once; existing in-flight jobs are polled before replay. Report published claims and needs-evidence suggestions separately. `no_claims` may still include suggestions, which are not verified user contributions. Unsupported files are counted but not uploaded. No claim-review step is needed. Do not treat another speaker's work or a meeting action item as the user's contribution. The server parses and sanitizes files; the local runner does not redact file contents, and file text or excerpts must not appear in logs.
 
 If manual approval has queued scheduled work, run `pending --harness opencode`, show the complete redacted list, and ask once. After approval, run `approve --approved --harness opencode`.
 
@@ -12,8 +12,8 @@ For an explicit sync-now request:
 
 1. Run `sessions --harness opencode --hours 24`, using 48 or 72 only when requested.
 2. Review each returned segment with `review --harness opencode --session-ref <sessionRef> --hours <hours>`.
-3. Prepare a redaction-version-four payload from final assistant notes only. Use generic `activity` evidence for writing, feedback, research, planning, product work, and any work that is not clearly an engineering implementation or decision. Activity evidence has no technical scope. An empty evidence list is valid when only the safe session summary remains.
+3. Prepare a redaction-version-four payload from final assistant notes only. Use `activity` evidence for writing, feedback, research, planning, product work, and any work that is not clearly an engineering implementation or decision. Activity evidence has no technical scope. An empty evidence list advances the checkpoint without creating a claim.
 4. In automatic mode, pipe the payload to `sync --harness opencode` without asking again. In manual mode, show the exact payload, ask once, and then use `sync --approved --harness opencode`.
 5. Keep the returned session reference and turn range unchanged. Never upload prompts, raw transcripts, tool output, code, paths, commands, URLs, credentials, names, customer details, or proprietary identifiers.
 
-To connect or finish onboarding, run `connect --harness opencode`. New connections use one-hour automatic sync and `~/Desktop/Shifu` on macOS by default. To change the interval, approval policy, or folder later, run `config update --harness opencode` with the desired flags (for example, `--input-folder <existing-readable-folder>`).
+To connect or replace a key, run `npx --yes @useshifu/coding-harness connect --harness opencode`. Connect asks for a key and verifies it with Shifu before reporting success. If this tool terminal cannot run the command or accept hidden input, ask the user to run it in their own interactive terminal and report the output; do not claim the connection succeeded. To disconnect locally, run `npx --yes @useshifu/coding-harness disconnect --harness opencode`. New connections use one-hour automatic sync and `~/Desktop/Shifu` on macOS by default. To change the interval, approval policy, or folder later, run `config update --harness opencode` with the desired flags (for example, `--input-folder <existing-readable-folder>`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@useshifu/coding-harness",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Scheduled, redacted coding-harness activity sync for Shifu",
   "bin": {
     "coding-harness": "bin/shifu-harness.js",

package/skills/shifu-sync/SKILL.md

@@ -16,42 +16,44 @@ Only describe work attributable to the user. A team action item, meeting discuss
 When the user asks to connect, run:
 
 ```sh
-npx @useshifu/coding-harness connect --harness codex
+npx --yes @useshifu/coding-harness connect --harness codex
 ```
 
-`connect` installs the current runner and a local schedule with no policy questions. New connections default to hourly automatic sync and `~/Desktop/Shifu` as the single input folder on macOS. It creates shortcuts at `~/Downloads/Shifu` and `~/Documents/Shifu` when possible without replacing conflicting items. Supported files are `.txt`, `.md`, `.rtf`, and `.docx` up to 20 MB directly inside the folder; images and screenshots are not supported. Unknown formats are counted but never uploaded. If a connection already exists, `connect` keeps its key, checkpoints, and chosen policy. It also excludes the setup session when the harness exposes its current opaque session reference. No content is sent during setup.
+`connect` asks for a key every time and verifies it against Shifu for this harness before reporting success. If this tool terminal cannot run npx or accept hidden input, ask the user to run the command in their own interactive terminal and report its output; do not claim the connection succeeded. It installs the current runner and a local schedule with no policy questions. New connections default to hourly automatic sync and `~/Desktop/Shifu` as the single input folder on macOS. It creates shortcuts at `~/Downloads/Shifu` and `~/Documents/Shifu` when possible without replacing conflicting items. Supported files are `.txt`, `.md`, `.rtf`, and `.docx` up to 20 MB directly inside the folder; images and screenshots are not supported. Unknown formats are counted but never uploaded. Replacing a key resets local checkpoints so work can sync to the new connection. It also excludes the setup session when the harness exposes its current opaque session reference. No content is sent during setup.
+
+To disconnect locally, run `npx --yes @useshifu/coding-harness disconnect --harness codex`. Tell the user to revoke the old key in Shifu if they no longer want it usable.
 
 When the user asks to change the interval, approval mode, or input folder, run:
 
 ```sh
-npx @useshifu/coding-harness config update --harness codex --input-folder <existing-readable-folder>
+npx --yes @useshifu/coding-harness config update --harness codex --input-folder <existing-readable-folder>
 ```
 
 Use only the flags the user wants to change; existing settings are preserved. The CLI validates a custom folder before saving. Do not add a second confirmation around either command.
 
 ## Inspect status or queued work
 
-Run `npx @useshifu/coding-harness status --harness codex` to inspect the saved policy, next scheduled run, pending count, and checkpoints.
+Run `npx --yes @useshifu/coding-harness status --harness codex` to inspect the saved policy, next scheduled run, pending count, and checkpoints.
 
-For an explicit input-folder sync, run `npx @useshifu/coding-harness sync-files --harness codex`. It first polls previously accepted file jobs, then submits new or changed supported files. Uploading starts background processing; it does not wait for extraction. A later manual or scheduled sync polls status again. Only `processed`, `no_claims`, or `duplicate` advances a file's completed checkpoint; `partial` is retried on the next sync. No claim review or manual approval is needed for files. Report submitted, processing, retry-needed, and unsupported counts separately. Do not claim a submitted file was fully processed. If a file fails, leave it pending and report the error.
+For an explicit input-folder sync, run `npx --yes @useshifu/coding-harness sync-files --harness codex`. It first polls previously accepted file jobs, then submits new or changed supported files. Uploading starts background processing; it does not wait for extraction. A later manual or scheduled sync polls status again. Only `processed`, `no_claims`, or `duplicate` advances a file's completed checkpoint; `partial` is retried on the next sync. The upgraded runner replays old completed checkpoints once, while preserving and polling in-flight jobs before their replay. No claim review or manual approval is needed for files. Report submitted, processing, retry-needed, unsupported, published-claim, and needs-evidence suggestion counts separately. Do not claim a submitted file was fully processed. If a file fails, leave it pending and report the error. Never print file text, candidate statements, or excerpts into logs.
 
-The folder runner accepts nonempty `.txt`, `.md`, `.rtf`, and `.docx` files up to 20 MB; the server accepts at most 500,000 extractable characters per file and splits that text into bounded chunks. Empty, malformed, binary, and renamed unsupported files cannot yield claims. A `no_claims` result means processing finished but no sufficiently grounded contribution could be attributed to the user; it does not mean upload failed. For a named transcript, confirm the user's Shifu Profile display name matches their speaker label before expecting automated attribution. Never promise a claim from every file or infer one from an action item. The upload has a transport deadline, but model processing has no upload-request timeout; failed chunks back off and can be retried without republishing completed chunks.
+The folder runner accepts nonempty `.txt`, `.md`, `.rtf`, and `.docx` files up to 20 MB; the server accepts at most 500,000 extractable characters per file and splits that text into bounded chunks. Empty, malformed, binary, and renamed unsupported files cannot yield claims. A `no_claims` result means processing finished with no published claims; it may still have retained needs-evidence suggestions. Suggestions are possible contributions with unresolved evidence or attribution, not verified claims. If both counts are zero, no attributable contribution was extracted; upload itself may still have succeeded. For a named transcript, confirm the user's Shifu Profile display name matches their speaker label before expecting automated attribution. Never promise a claim from every file or infer one from an action item. The upload has a transport deadline, but model processing has no upload-request timeout; failed chunks back off and can be retried without republishing completed chunks.
 
 In manual mode, scheduled runs accumulate redacted segments locally. Run:
 
 ```sh
-npx @useshifu/coding-harness pending --harness codex
+npx --yes @useshifu/coding-harness pending --harness codex
 ```
 
-Show the returned list and ask for one approval for the whole list. After approval, run `npx @useshifu/coding-harness approve --approved --harness codex`. Do not ask again.
+Show the returned list and ask for one approval for the whole list. After approval, run `npx --yes @useshifu/coding-harness approve --approved --harness codex`. Do not ask again.
 
 ## Sync now
 
 For an explicit sync request, first read `status` to determine the saved approval mode. Use the time window the user names; otherwise use 24 hours. Supported interactive windows are 24, 48, and 72 hours.
 
-1. Run `npx @useshifu/coding-harness sessions --harness codex --hours <24|48|72>`.
+1. Run `npx --yes @useshifu/coding-harness sessions --harness codex --hours <24|48|72>`.
 2. Ignore `blockedSessions` unless the user specifically selects one. For a selected older backlog, add `--session-ref <sessionRef> --all`.
-3. For each returned segment, run `npx @useshifu/coding-harness review --harness codex --session-ref <sessionRef> --hours <24|48|72>`.
+3. For each returned segment, run `npx --yes @useshifu/coding-harness review --harness codex --session-ref <sessionRef> --hours <24|48|72>`.
 4. Prepare a version-four payload from the returned final-assistant notes. Keep the returned `sessionRef`, `fromTurn`, and `toTurn` unchanged.
 5. In automatic mode, send it without another approval. In manual mode, show the exact payload and ask once; after approval, pass `--approved` to the sync command.
 6. Repeat discovery after accepted segments until the selected window is exhausted.
@@ -76,13 +78,13 @@ Use `kind: "activity"` for general harness work; it does not require a technical
 Automatic mode:
 
 ```sh
-printf '%s' '<redacted JSON>' | npx @useshifu/coding-harness sync --harness codex
+printf '%s' '<redacted JSON>' | npx --yes @useshifu/coding-harness sync --harness codex
 ```
 
 Manual mode, only after the user's single approval:
 
 ```sh
-printf '%s' '<redacted JSON>' | npx @useshifu/coding-harness sync --approved --harness codex
+printf '%s' '<redacted JSON>' | npx --yes @useshifu/coding-harness sync --approved --harness codex
 ```
 
 If a transport or server error remains after the runner's retries, report that the checkpoint was not advanced. Do not alter the segment or skip ahead.