@vaubaan/harness 0.0.0-stage → 1.3.2

package/dist/cli/index.js

@@ -0,0 +1,2924 @@
+#!/usr/bin/env node
+
+// src/cli/index.ts
+import { dirname as dirname8, resolve as resolve8 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { Command } from "commander";
+
+// src/linters/util.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync, statSync } from "fs";
+import { join, relative } from "path";
+import fg from "fast-glob";
+import matter from "gray-matter";
+function fileExists(repoRoot, relativePath) {
+  return existsSync(join(repoRoot, relativePath));
+}
+function readText(repoRoot, relativePath) {
+  return readFileSync(join(repoRoot, relativePath), "utf8");
+}
+function listMarkdown(repoRoot, dir) {
+  const cwd = join(repoRoot, dir);
+  if (!existsSync(cwd)) return [];
+  return fg.sync("**/*.md", { cwd, absolute: false, ignore: ["**/node_modules/**", "**/dist/**"] }).filter((f) => !f.endsWith("README.md")).map((f) => join(dir, f));
+}
+function dirExists(repoRoot, relativePath) {
+  const full = join(repoRoot, relativePath);
+  if (!existsSync(full)) return false;
+  return statSync(full).isDirectory();
+}
+function parseFrontmatter(text) {
+  const m = matter(text);
+  return { data: m.data, body: m.content };
+}
+function gitLastCommitForPath(repoRoot, relativePath) {
+  try {
+    const out = execFileSync("git", ["log", "-1", "--format=%H:%ct", "--", relativePath], {
+      cwd: repoRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (!out) return void 0;
+    const idx = out.indexOf(":");
+    if (idx < 0) return void 0;
+    const hash2 = out.slice(0, idx);
+    const ts = Number.parseInt(out.slice(idx + 1), 10);
+    return { hash: hash2, timestamp: ts };
+  } catch {
+    return void 0;
+  }
+}
+function gitCommitsSince(repoRoot, relativePath, sinceCommit) {
+  try {
+    const out = execFileSync(
+      "git",
+      ["log", `${sinceCommit}..HEAD`, "--format=%H", "--", relativePath],
+      {
+        cwd: repoRoot,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }
+    ).trim();
+    if (!out) return 0;
+    return out.split("\n").filter(Boolean).length;
+  } catch {
+    return 0;
+  }
+}
+function findLineNumber(text, needle) {
+  const lines = text.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    if (typeof needle === "string" ? line.includes(needle) : needle.test(line)) {
+      return i + 1;
+    }
+  }
+  return void 0;
+}
+
+// src/linters/adr-no-tracks.ts
+var ADR_DIR = "docs/decisions";
+var adrNoTracks = {
+  id: "lint:adr-no-tracks",
+  pillars: ["decisions"],
+  defaultSeverity: "error",
+  suggestedSkills: ["/decision"],
+  run(repoRoot) {
+    const issues = [];
+    const files = listMarkdown(repoRoot, ADR_DIR);
+    for (const f of files) {
+      const text = readText(repoRoot, f);
+      const { data } = parseFrontmatter(text);
+      if (!("tracks" in data)) continue;
+      const value = data.tracks;
+      if (Array.isArray(value) && value.length === 0) continue;
+      issues.push({
+        linter: this.id,
+        severity: "error",
+        file: f,
+        message: "ADRs must not declare `tracks:` (or must set it to []). ADRs document a decision frozen in time, not the current state of code \u2014 use status: superseded to mark them obsolete instead."
+      });
+    }
+    return issues;
+  }
+};
+
+// src/linters/cardinal-files.ts
+var REQUIRED_FILES = [
+  "docs/tests/integration-tests.md",
+  "docs/tests/e2e-tests.md",
+  "docs/workflow/coding-workflow.md"
+];
+var cardinalFiles = {
+  id: "lint:cardinal-files",
+  pillars: ["tests", "workflow"],
+  defaultSeverity: "error",
+  suggestedSkills: ["/test-plan", "/workflow"],
+  run(repoRoot) {
+    const issues = [];
+    for (const f of REQUIRED_FILES) {
+      if (!fileExists(repoRoot, f)) {
+        issues.push({
+          linter: this.id,
+          severity: "error",
+          file: f,
+          message: `missing required cardinal file: ${f}`
+        });
+      }
+    }
+    return issues;
+  }
+};
+
+// src/linters/config.ts
+import { cosmiconfigSync } from "cosmiconfig";
+var DEFAULT_CONFIG = { ignore: [] };
+function loadLintConfig(repoRoot) {
+  const explorer = cosmiconfigSync("harness", {
+    searchPlaces: [
+      "package.json",
+      ".harnessrc",
+      ".harnessrc.json",
+      ".harnessrc.yaml",
+      ".harnessrc.yml",
+      "harness.config.js",
+      "harness.config.cjs"
+    ]
+  });
+  const result = explorer.search(repoRoot);
+  if (!result || result.isEmpty) return DEFAULT_CONFIG;
+  const raw = result.config;
+  if (!raw) return DEFAULT_CONFIG;
+  const lint = raw.lint;
+  if (!lint) return DEFAULT_CONFIG;
+  const ignore = lint.ignore;
+  if (!Array.isArray(ignore)) return DEFAULT_CONFIG;
+  return { ignore: ignore.filter((x) => typeof x === "string") };
+}
+
+// src/linters/cross-links.ts
+import { existsSync as existsSync2 } from "fs";
+import { dirname, isAbsolute, join as join2, resolve } from "path";
+import fg2 from "fast-glob";
+var LINK_REGEX = /\[([^\]]+)\]\(([^)]+)\)/g;
+function maskCodeSpans(text) {
+  return text.replace(/```[\s\S]*?```/g, (m) => m.replace(/[^\n]/g, " ")).replace(/`[^`\n]*`/g, (m) => " ".repeat(m.length));
+}
+function isExternalOrAnchor(url) {
+  if (url.startsWith("http://") || url.startsWith("https://")) return true;
+  if (url.startsWith("mailto:")) return true;
+  if (url.startsWith("#")) return true;
+  return false;
+}
+function stripFragment(url) {
+  const i = url.indexOf("#");
+  return i < 0 ? url : url.slice(0, i);
+}
+function resolveLink(repoRoot, sourceFile, link) {
+  const noFrag = stripFragment(link);
+  if (isAbsolute(noFrag)) return join2(repoRoot, noFrag);
+  return resolve(dirname(join2(repoRoot, sourceFile)), noFrag);
+}
+var crossLinks = {
+  id: "lint:cross-links",
+  pillars: ["all"],
+  defaultSeverity: "error",
+  run(repoRoot, ctx) {
+    const extra = ctx?.config.ignore ?? [];
+    const issues = [];
+    const allDocs = fg2.sync("**/*.md", {
+      cwd: repoRoot,
+      absolute: false,
+      ignore: [
+        "**/node_modules/**",
+        "**/dist/**",
+        ".harness-overrides/**",
+        "skills/**",
+        "agents/**",
+        "commands/**",
+        "templates/**",
+        "**/*.skill.md",
+        "**/*.cmd.md",
+        "**/*.agent.md",
+        ...extra
+      ]
+    });
+    for (const f of allDocs) {
+      const text = maskCodeSpans(readText(repoRoot, f));
+      const lines = text.split("\n");
+      for (let lineNo = 0; lineNo < lines.length; lineNo++) {
+        const line = lines[lineNo] ?? "";
+        LINK_REGEX.lastIndex = 0;
+        let match;
+        match = LINK_REGEX.exec(line);
+        while (match !== null) {
+          const url = match[2];
+          if (url && !isExternalOrAnchor(url)) {
+            const noFrag = stripFragment(url);
+            if (noFrag !== "" && !noFrag.startsWith("data:")) {
+              const target = resolveLink(repoRoot, f, url);
+              if (!existsSync2(target)) {
+                issues.push({
+                  linter: this.id,
+                  severity: "error",
+                  file: f,
+                  line: lineNo + 1,
+                  message: `broken link: ${url}`
+                });
+              }
+            }
+          }
+          match = LINK_REGEX.exec(line);
+        }
+      }
+    }
+    return issues;
+  }
+};
+
+// src/linters/decision-schema.ts
+var REQUIRED_SECTIONS = [
+  { label: "Context", pattern: /^##\s+(Context|Contexte)\b/m },
+  { label: "Decision", pattern: /^##\s+(Decision|D[ée]cision)\b/m },
+  { label: "Consequences", pattern: /^##\s+(Consequences|Cons[ée]quences)\b/m },
+  {
+    label: "Rejected alternatives",
+    pattern: /^##\s+(Rejected\s+alternatives|Alternatives(\s+rejet[ée]es)?)\b/im
+  }
+];
+var decisionSchema = {
+  id: "lint:decision-schema",
+  pillars: ["decisions"],
+  defaultSeverity: "error",
+  suggestedSkills: ["/decision"],
+  run(repoRoot) {
+    const issues = [];
+    const files = listMarkdown(repoRoot, "docs/decisions");
+    for (const f of files) {
+      const text = readText(repoRoot, f);
+      for (const { label, pattern } of REQUIRED_SECTIONS) {
+        if (!pattern.test(text)) {
+          issues.push({
+            linter: this.id,
+            severity: "error",
+            file: f,
+            message: `missing required section: "${label}"`
+          });
+        }
+      }
+    }
+    return issues;
+  }
+};
+
+// src/linters/doc-layout.ts
+var REQUIRED_DIRS = [
+  "docs/spec",
+  "docs/decisions",
+  "docs/handbook",
+  "docs/tests",
+  "docs/workflow"
+];
+var docLayout = {
+  id: "lint:doc-layout",
+  pillars: ["all"],
+  defaultSeverity: "error",
+  run(repoRoot) {
+    const issues = [];
+    for (const dir of REQUIRED_DIRS) {
+      if (!dirExists(repoRoot, dir)) {
+        issues.push({
+          linter: this.id,
+          severity: "error",
+          file: dir,
+          message: `missing required directory: ${dir}/`
+        });
+      }
+    }
+    return issues;
+  }
+};
+
+// src/linters/frontmatter-tracks.ts
+import { existsSync as existsSync3 } from "fs";
+import { join as join3 } from "path";
+import fg3 from "fast-glob";
+var TRACKED_DIRS = ["docs/handbook", "docs/tests", "docs/workflow"];
+function trackedPathExists(repoRoot, pattern) {
+  if (pattern.includes("*")) {
+    return fg3.sync(pattern, { cwd: repoRoot, absolute: false }).length > 0;
+  }
+  return existsSync3(join3(repoRoot, pattern));
+}
+var frontmatterTracks = {
+  id: "lint:frontmatter-tracks",
+  pillars: ["handbook", "tests", "workflow"],
+  defaultSeverity: "error",
+  suggestedSkills: ["/handbook", "/test-plan", "/workflow"],
+  run(repoRoot) {
+    const issues = [];
+    for (const dir of TRACKED_DIRS) {
+      const files = listMarkdown(repoRoot, dir);
+      for (const f of files) {
+        const text = readText(repoRoot, f);
+        const { data } = parseFrontmatter(text);
+        if (!Array.isArray(data.tracks)) {
+          issues.push({
+            linter: this.id,
+            severity: "error",
+            file: f,
+            message: "missing frontmatter `tracks:` array"
+          });
+          continue;
+        }
+        for (const tracked of data.tracks) {
+          if (typeof tracked !== "string") {
+            issues.push({
+              linter: this.id,
+              severity: "error",
+              file: f,
+              message: "`tracks` entries must be strings"
+            });
+            continue;
+          }
+          if (!trackedPathExists(repoRoot, tracked)) {
+            issues.push({
+              linter: this.id,
+              severity: "error",
+              file: f,
+              message: `tracked path does not exist: ${tracked}`
+            });
+          }
+        }
+      }
+    }
+    return issues;
+  }
+};
+
+// src/linters/gitignore-harness.ts
+var REQUIRED_GITIGNORE_ENTRIES = [
+  ".harness-overrides/",
+  ".harness-manifest.json",
+  ".harness/",
+  ".claude/",
+  ".codex/",
+  ".opencode/",
+  ".agents/",
+  ".vaubaan/",
+  "AGENTS.md",
+  "CLAUDE.md",
+  ".mcp.json"
+];
+var gitignoreHarness = {
+  id: "lint:gitignore-harness",
+  pillars: ["repo-root"],
+  defaultSeverity: "error",
+  run(repoRoot) {
+    const issues = [];
+    if (!fileExists(repoRoot, ".gitignore")) {
+      issues.push({
+        linter: this.id,
+        severity: "error",
+        file: ".gitignore",
+        message: ".gitignore is missing at repo root"
+      });
+      return issues;
+    }
+    const text = readText(repoRoot, ".gitignore");
+    const lines = new Set(
+      text.split("\n").map((l) => l.trim()).filter(Boolean)
+    );
+    for (const entry of REQUIRED_GITIGNORE_ENTRIES) {
+      const variants = [entry, entry.replace(/\/$/, "")];
+      if (!variants.some((v) => lines.has(v))) {
+        issues.push({
+          linter: this.id,
+          severity: "error",
+          file: ".gitignore",
+          message: `.gitignore must contain "${entry}"`
+        });
+      }
+    }
+    return issues;
+  }
+};
+
+// src/linters/orphan-decisions.ts
+import { basename } from "path";
+import fg4 from "fast-glob";
+var orphanDecisions = {
+  id: "lint:orphan-decisions",
+  pillars: ["decisions"],
+  defaultSeverity: "warning",
+  suggestedSkills: ["/handbook"],
+  run(repoRoot, ctx) {
+    const extra = ctx?.config.ignore ?? [];
+    const issues = [];
+    const adrs = listMarkdown(repoRoot, "docs/decisions");
+    if (adrs.length === 0) return issues;
+    const otherDocs = fg4.sync("**/*.md", {
+      cwd: repoRoot,
+      absolute: false,
+      ignore: [
+        "**/node_modules/**",
+        "**/dist/**",
+        ".harness-overrides/**",
+        "docs/decisions/**",
+        "skills/**",
+        "agents/**",
+        "commands/**",
+        "templates/**",
+        ...extra
+      ]
+    });
+    const referenceCorpus = otherDocs.map((f) => readText(repoRoot, f)).join("\n");
+    for (const adr of adrs) {
+      const filename = basename(adr);
+      const stem = filename.replace(/\.md$/, "");
+      const referenced = referenceCorpus.includes(filename) || referenceCorpus.includes(stem);
+      if (!referenced) {
+        issues.push({
+          linter: this.id,
+          severity: "warning",
+          file: adr,
+          message: "ADR is not referenced by any other doc file (orphan)"
+        });
+      }
+    }
+    return issues;
+  }
+};
+
+// src/linters/quality-schema.ts
+var QUALITY_DIR = "docs/quality";
+var CARDINAL_FILE = `${QUALITY_DIR}/code-quality.md`;
+var REQUIRED_SECTIONS2 = [
+  {
+    label: "Mechanical checks",
+    pattern: /^##\s+(Mechanical\s+checks|V[ée]rifications\s+m[ée]caniques)\s*$/im
+  },
+  { label: "Project rules", pattern: /^##\s+(Project\s+rules|R[èe]gles\s+du\s+projet)\s*$/im },
+  {
+    label: "Accepted deviations",
+    pattern: /^##\s+(Accepted\s+deviations|[ÉE]carts\s+assum[ée]s)\s*$/im
+  }
+];
+var qualitySchema = {
+  id: "lint:quality-schema",
+  pillars: ["quality"],
+  defaultSeverity: "error",
+  run(repoRoot) {
+    if (!dirExists(repoRoot, QUALITY_DIR)) return [];
+    if (!fileExists(repoRoot, CARDINAL_FILE)) {
+      return [
+        {
+          linter: this.id,
+          severity: "error",
+          file: CARDINAL_FILE,
+          message: `missing required cardinal file: ${CARDINAL_FILE}`
+        }
+      ];
+    }
+    const text = readText(repoRoot, CARDINAL_FILE);
+    return REQUIRED_SECTIONS2.filter(({ pattern }) => !pattern.test(text)).map(({ label }) => ({
+      linter: this.id,
+      severity: "error",
+      file: CARDINAL_FILE,
+      message: `missing required section: "${label}"`
+    }));
+  }
+};
+
+// src/linters/readme-presence.ts
+var readmePresence = {
+  id: "lint:readme-presence",
+  pillars: ["readme"],
+  defaultSeverity: "error",
+  suggestedSkills: ["/readme"],
+  run(repoRoot) {
+    if (fileExists(repoRoot, "README.md")) return [];
+    return [
+      {
+        linter: this.id,
+        severity: "error",
+        file: "README.md",
+        message: "README.md is missing at repo root"
+      }
+    ];
+  }
+};
+
+// src/linters/readme-sections.ts
+var REQUIRED_SECTIONS3 = [
+  /^#\s+\S/m,
+  /^##?\s+(What is this|Quick start)/im,
+  /^##?\s+(Quick start|Install|Getting started)/im
+];
+var REQUIRED_LABELS = ["title (# H1)", "What is this / intro", "Quick start / Install"];
+var readmeSections = {
+  id: "lint:readme-sections",
+  pillars: ["readme"],
+  defaultSeverity: "error",
+  suggestedSkills: ["/readme"],
+  run(repoRoot) {
+    if (!fileExists(repoRoot, "README.md")) return [];
+    const text = readText(repoRoot, "README.md");
+    const issues = [];
+    for (let i = 0; i < REQUIRED_SECTIONS3.length; i++) {
+      const pattern = REQUIRED_SECTIONS3[i];
+      const label = REQUIRED_LABELS[i];
+      if (pattern && !pattern.test(text)) {
+        issues.push({
+          linter: this.id,
+          severity: "error",
+          file: "README.md",
+          message: `missing required section: ${label}`
+        });
+      }
+    }
+    return issues;
+  }
+};
+
+// src/linters/spec-has-content.ts
+var specHasContent = {
+  id: "lint:spec-has-content",
+  pillars: ["spec"],
+  defaultSeverity: "warning",
+  suggestedSkills: ["/spec"],
+  run(repoRoot) {
+    if (!dirExists(repoRoot, "docs/spec")) return [];
+    const files = listMarkdown(repoRoot, "docs/spec");
+    if (files.length > 0) return [];
+    return [
+      {
+        linter: this.id,
+        severity: "warning",
+        file: "docs/spec",
+        message: "docs/spec/ has no markdown files \u2014 write at least one spec document"
+      }
+    ];
+  }
+};
+
+// src/linters/spec-tech-agnostic.ts
+function maskFencedBlocks(text) {
+  return text.replace(/```[\s\S]*?```/g, (m) => m.replace(/[^\n]/g, " "));
+}
+var TECH_BLOCKLIST = [
+  { pattern: /\bNext\.?js\b/i, keyword: "Next.js" },
+  { pattern: /\bSupabase\b/i, keyword: "Supabase" },
+  { pattern: /\bVercel\b/i, keyword: "Vercel" },
+  { pattern: /\bReact\b/, keyword: "React" },
+  { pattern: /\bTypeScript\b/, keyword: "TypeScript" },
+  { pattern: /\bDocker\b/, keyword: "Docker" },
+  { pattern: /\bKubernetes\b/i, keyword: "Kubernetes" },
+  { pattern: /\bPostgres(QL)?\b/i, keyword: "Postgres" },
+  { pattern: /\bMySQL\b/i, keyword: "MySQL" },
+  { pattern: /\bRedis\b/i, keyword: "Redis" },
+  { pattern: /\bnpm\b/, keyword: "npm" },
+  { pattern: /\bpnpm\b/, keyword: "pnpm" },
+  { pattern: /\byarn\b/, keyword: "yarn" }
+];
+var specTechAgnostic = {
+  id: "lint:spec-tech-agnostic",
+  pillars: ["spec"],
+  defaultSeverity: "error",
+  suggestedSkills: ["/spec"],
+  run(repoRoot) {
+    const issues = [];
+    const files = listMarkdown(repoRoot, "docs/spec");
+    for (const f of files) {
+      const text = maskFencedBlocks(readText(repoRoot, f));
+      for (const { pattern, keyword } of TECH_BLOCKLIST) {
+        if (pattern.test(text)) {
+          const issue = {
+            linter: this.id,
+            severity: "error",
+            file: f,
+            message: `forbidden tech keyword "${keyword}" \u2014 should be in handbook/ or decisions/`
+          };
+          const line = findLineNumber(text, pattern);
+          if (line !== void 0) issue.line = line;
+          issues.push(issue);
+        }
+      }
+    }
+    return issues;
+  }
+};
+
+// src/linters/tracks-drift.ts
+import fg5 from "fast-glob";
+var TRACKED_DIRS2 = ["docs/handbook", "docs/tests", "docs/workflow"];
+var DEFAULT_DRIFT_THRESHOLD = 10;
+function expandGlob(repoRoot, pattern) {
+  if (pattern.includes("*")) {
+    return fg5.sync(pattern, { cwd: repoRoot, absolute: false });
+  }
+  return [pattern];
+}
+var tracksDrift = {
+  id: "lint:tracks-drift",
+  pillars: ["handbook", "tests", "workflow"],
+  defaultSeverity: "warning",
+  suggestedSkills: ["/drift", "/handbook"],
+  run(repoRoot) {
+    const issues = [];
+    for (const dir of TRACKED_DIRS2) {
+      const files = listMarkdown(repoRoot, dir);
+      for (const f of files) {
+        const text = readText(repoRoot, f);
+        const { data } = parseFrontmatter(text);
+        if (!Array.isArray(data.tracks)) continue;
+        const docCommit = gitLastCommitForPath(repoRoot, f);
+        if (!docCommit) continue;
+        const threshold = typeof data.driftThreshold === "number" && data.driftThreshold > 0 ? data.driftThreshold : DEFAULT_DRIFT_THRESHOLD;
+        let driftCount = 0;
+        for (const tracked of data.tracks) {
+          if (typeof tracked !== "string") continue;
+          const targets = expandGlob(repoRoot, tracked);
+          for (const t of targets.length > 0 ? targets : [tracked]) {
+            driftCount += gitCommitsSince(repoRoot, t, docCommit.hash);
+          }
+        }
+        if (driftCount > threshold) {
+          issues.push({
+            linter: this.id,
+            severity: "warning",
+            file: f,
+            message: `tracked files changed in ${driftCount} commits since doc last edit (threshold ${threshold})`
+          });
+        }
+      }
+    }
+    return issues;
+  }
+};
+
+// src/linters/index.ts
+var ALL_LINTERS = [
+  readmePresence,
+  readmeSections,
+  docLayout,
+  cardinalFiles,
+  decisionSchema,
+  adrNoTracks,
+  frontmatterTracks,
+  tracksDrift,
+  specTechAgnostic,
+  specHasContent,
+  crossLinks,
+  orphanDecisions,
+  gitignoreHarness,
+  qualitySchema
+];
+function runLinters(repoRoot, opts = {}) {
+  const config = loadLintConfig(repoRoot);
+  const ctx = { repoRoot, config };
+  const filtered = ALL_LINTERS.filter((l) => {
+    if (opts.only && !opts.only.includes(l.id)) return false;
+    if (opts.pillar && !l.pillars.includes(opts.pillar) && !l.pillars.includes("all")) return false;
+    return true;
+  });
+  const issues = [];
+  for (const linter of filtered) {
+    try {
+      issues.push(...linter.run(repoRoot, ctx));
+    } catch (err) {
+      issues.push({
+        linter: linter.id,
+        severity: "error",
+        file: "<internal>",
+        message: `linter crashed: ${err instanceof Error ? err.message : String(err)}`
+      });
+    }
+  }
+  const errors = issues.filter((i) => i.severity === "error").length;
+  const warnings = issues.filter((i) => i.severity === "warning").length;
+  return {
+    version: 1,
+    summary: { errors, warnings, pass: errors === 0 },
+    issues
+  };
+}
+function suggestedSkillsFor(linterId) {
+  const linter = ALL_LINTERS.find((l) => l.id === linterId);
+  return linter?.suggestedSkills ?? [];
+}
+function formatReportText(report) {
+  const lines = [];
+  for (const issue of report.issues) {
+    const location = issue.line !== void 0 ? `:${issue.line}` : "";
+    lines.push(`${issue.file}${location}: ${issue.severity}[${issue.linter}]
+  ${issue.message}`);
+    const hints = suggestedSkillsFor(issue.linter);
+    if (hints.length > 0) {
+      lines.push(`  \u2192 Try: ${hints.join(", ")}`);
+    }
+  }
+  const { errors, warnings, pass } = report.summary;
+  lines.push("");
+  lines.push(
+    `${errors} ${errors === 1 ? "error" : "errors"}, ${warnings} ${warnings === 1 ? "warning" : "warnings"}. ${pass ? "\u2714 CI passes." : "\u2718 CI fails."}`
+  );
+  return lines.join("\n");
+}
+
+// src/version.ts
+var VERSION = "1.3.2";
+
+// src/cli/check.ts
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { join as join4 } from "path";
+var REQUIRED_DIRS2 = [
+  "docs/spec",
+  "docs/decisions",
+  "docs/handbook",
+  "docs/tests",
+  "docs/workflow"
+];
+function checkCommand(repoRoot) {
+  const issues = [];
+  if (!existsSync4(join4(repoRoot, "README.md"))) {
+    issues.push("README.md missing at repo root");
+  }
+  for (const d of REQUIRED_DIRS2) {
+    if (!existsSync4(join4(repoRoot, d))) {
+      issues.push(`missing directory: ${d}/`);
+    }
+  }
+  const gitignorePath = join4(repoRoot, ".gitignore");
+  if (!existsSync4(gitignorePath)) {
+    issues.push(".gitignore missing at repo root");
+  } else {
+    const text = readFileSync2(gitignorePath, "utf8");
+    const lines = new Set(
+      text.split("\n").map((l) => l.trim()).filter(Boolean)
+    );
+    for (const entry of REQUIRED_GITIGNORE_ENTRIES) {
+      const variants = [entry, entry.replace(/\/$/, "")];
+      if (!variants.some((v) => lines.has(v))) {
+        issues.push(`.gitignore missing entry: ${entry}`);
+      }
+    }
+  }
+  return { pass: issues.length === 0, issues };
+}
+
+// src/cli/init.ts
+import { existsSync as existsSync10, mkdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname4, join as join11, resolve as resolve4 } from "path";
+import { fileURLToPath } from "url";
+
+// src/loader.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+import fg6 from "fast-glob";
+import { z as z2 } from "zod";
+
+// src/parser/common.ts
+import { readFileSync as readFileSync3 } from "fs";
+import matter2 from "gray-matter";
+
+// src/parser/schemas.ts
+import { z } from "zod";
+
+// src/types.ts
+var AGENT_IDS = ["coding", "review", "merge", "planning"];
+var ENGINES = ["claude-code", "codex-cli", "opencode"];
+var CAPABILITIES = ["multi-step", "slash-command", "inline-exec"];
+var CAPABILITIES_MATRIX = {
+  "claude-code": ["multi-step", "slash-command", "inline-exec"],
+  "codex-cli": ["multi-step", "slash-command", "inline-exec"],
+  opencode: ["multi-step", "slash-command", "inline-exec"]
+};
+var DEGRADED_CAPABILITIES = {
+  "codex-cli": ["multi-step"]
+};
+
+// src/parser/schemas.ts
+var IdSchema = z.string().min(1).regex(/^[a-z][a-z0-9-]*$/, "id must be kebab-case (lowercase + digits + hyphens)");
+var SkillFrontmatterSchema = z.object({
+  id: IdSchema,
+  description: z.string().min(1),
+  engines: z.array(z.enum(ENGINES)).min(1).optional(),
+  requires: z.array(z.enum(CAPABILITIES)).optional(),
+  tags: z.array(z.string()).optional()
+}).strict();
+var CmdArgEnumSchema = z.object({
+  name: z.string().min(1),
+  type: z.literal("enum"),
+  values: z.array(z.string()).min(1),
+  default: z.string().optional()
+}).strict();
+var CmdArgStringSchema = z.object({
+  name: z.string().min(1),
+  type: z.literal("string"),
+  default: z.string().optional()
+}).strict();
+var CmdArgSchema = z.discriminatedUnion("type", [CmdArgEnumSchema, CmdArgStringSchema]);
+var CmdFrontmatterSchema = z.object({
+  id: IdSchema,
+  trigger: z.string().regex(/^\/[a-z][a-z0-9-]*$/, "trigger must be /kebab-case"),
+  invokes_skill: IdSchema,
+  args: z.array(CmdArgSchema).optional(),
+  description: z.string().min(1)
+}).strict();
+var AgentFrontmatterSchema = z.object({
+  id: z.enum(AGENT_IDS),
+  description: z.string().min(1)
+}).strict();
+var Schemas = {
+  Skill: SkillFrontmatterSchema,
+  Cmd: CmdFrontmatterSchema,
+  Agent: AgentFrontmatterSchema
+};
+var ParseError = class extends Error {
+  constructor(file, issues) {
+    const messages = issues.map((i) => `  - ${i.path.join(".") || "<root>"}: ${i.message}`).join("\n");
+    super(`Frontmatter validation failed for ${file}:
+${messages}`);
+    this.file = file;
+    this.issues = issues;
+    this.name = "ParseError";
+  }
+  file;
+  issues;
+};
+
+// src/parser/common.ts
+function parseWithSchema(filePath, source, schema) {
+  const parsed = matter2(source);
+  const result = schema.safeParse(parsed.data);
+  if (!result.success) {
+    throw new ParseError(filePath, result.error.issues);
+  }
+  return {
+    meta: result.data,
+    body: parsed.content.trim(),
+    sourcePath: filePath
+  };
+}
+
+// src/parser/agent.ts
+function parseAgent(filePath, source) {
+  return parseWithSchema(filePath, source, Schemas.Agent);
+}
+
+// src/parser/cmd.ts
+function parseCmd(filePath, source) {
+  return parseWithSchema(filePath, source, Schemas.Cmd);
+}
+
+// src/parser/skill.ts
+function parseSkill(filePath, source) {
+  return parseWithSchema(filePath, source, Schemas.Skill);
+}
+
+// src/util/yaml.ts
+import { parse as yamlParse } from "yaml";
+function parseYAML(source) {
+  return yamlParse(source);
+}
+
+// src/loader.ts
+var DisableYamlSchema = z2.object({ disable: z2.array(z2.string()).optional() }).passthrough();
+function loadHarness(packageDir, opts = {}) {
+  const agentsDir = opts.agentsDir ?? join5(packageDir, "agents");
+  const skillsDir = opts.skillsDir ?? join5(packageDir, "skills");
+  const commandsDir = opts.commandsDir ?? join5(packageDir, "commands");
+  const agentFiles = fg6.sync("*.agent.md", { cwd: agentsDir, absolute: true });
+  const skillFiles = fg6.sync("*.skill.md", { cwd: skillsDir, absolute: true });
+  const cmdFiles = fg6.sync("*.cmd.md", { cwd: commandsDir, absolute: true });
+  return {
+    agents: agentFiles.map((f) => parseAgent(f, readFileSync4(f, "utf8"))),
+    skills: skillFiles.map((f) => parseSkill(f, readFileSync4(f, "utf8"))),
+    cmds: cmdFiles.map((f) => parseCmd(f, readFileSync4(f, "utf8")))
+  };
+}
+function loadProjectSkills(targetDir) {
+  const skillsDir = join5(targetDir, "docs", "skills");
+  if (!existsSync5(skillsDir)) return [];
+  const skillFiles = fg6.sync("*.skill.md", { cwd: skillsDir, absolute: true });
+  return skillFiles.map((f) => parseSkill(f, readFileSync4(f, "utf8")));
+}
+function loadOverrides(worktreeDir) {
+  const overridesDir = join5(worktreeDir, ".harness-overrides");
+  if (!existsSync5(overridesDir)) return void 0;
+  const added = loadHarness(overridesDir, {
+    agentsDir: join5(overridesDir, "agents"),
+    skillsDir: join5(overridesDir, "skills"),
+    commandsDir: join5(overridesDir, "commands")
+  });
+  const disablePath = join5(overridesDir, "disable.yaml");
+  let disable = [];
+  if (existsSync5(disablePath)) {
+    try {
+      const parsed = DisableYamlSchema.safeParse(parseYAML(readFileSync4(disablePath, "utf8")));
+      if (parsed.success && parsed.data.disable) {
+        disable = parsed.data.disable;
+      }
+    } catch {
+    }
+  }
+  return { add: added, disable };
+}
+
+// src/mcp.ts
+var MCP_SERVER_IDS = ["context7"];
+var MCP_SERVERS = {
+  context7: {
+    id: "context7",
+    description: "Upstash Context7 \u2014 fetches up-to-date library docs via resolve-library-id + get-library-docs.",
+    command: "npx",
+    args: ["-y", "@upstash/context7-mcp"]
+  }
+};
+function resolveMcpIds(requested) {
+  return requested.map((id) => {
+    if (!MCP_SERVER_IDS.includes(id)) {
+      throw new Error(`unknown MCP server: ${id} (expected one of ${MCP_SERVER_IDS.join(", ")})`);
+    }
+    return id;
+  });
+}
+
+// src/renderers/common.ts
+import { stringify as yamlStringify } from "yaml";
+var STOP_HOOK_PACKAGE = "@vaubaan/harness";
+function checkSkillCapabilities(skill, engine) {
+  const blockingWarnings = [];
+  const degradedWarnings = [];
+  const supported = CAPABILITIES_MATRIX[engine];
+  const degraded = DEGRADED_CAPABILITIES[engine] ?? [];
+  if (!skill.meta.requires) return { blockingWarnings, degradedWarnings };
+  for (const cap of skill.meta.requires) {
+    if (!supported.includes(cap)) {
+      blockingWarnings.push(
+        `skill "${skill.meta.id}" requires "${cap}" not supported by "${engine}" \u2014 skipped`
+      );
+    } else if (degraded.includes(cap)) {
+      degradedWarnings.push(
+        `skill "${skill.meta.id}" requires "${cap}" \u2014 supported by "${engine}" with degradation`
+      );
+    }
+  }
+  return { blockingWarnings, degradedWarnings };
+}
+function isSkillEngineAllowed(skill, engine) {
+  if (!skill.meta.engines) return true;
+  return skill.meta.engines.includes(engine);
+}
+function yamlFrontmatter(data) {
+  const rendered = yamlStringify(data, { lineWidth: 0 }).trimEnd();
+  return `---
+${rendered}
+---
+`;
+}
+var SCALAR_NEEDS_QUOTE = /[^a-zA-Z0-9_./-]/;
+function tomlEscapeString(s) {
+  return `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n")}"`;
+}
+function tomlValue(v) {
+  if (Array.isArray(v)) {
+    return `[${v.map((x) => tomlValue(x)).join(", ")}]`;
+  }
+  if (typeof v === "string") {
+    if (v.includes("\n")) return tomlEscapeString(v);
+    return SCALAR_NEEDS_QUOTE.test(v) ? tomlEscapeString(v) : `"${v}"`;
+  }
+  if (typeof v === "boolean" || typeof v === "number") {
+    return String(v);
+  }
+  return tomlEscapeString(String(v));
+}
+function tomlMultilineString(s) {
+  const escaped = s.replace(/\\/g, "\\\\").replace(/"""/g, '""\\"');
+  return `"""
+${escaped}
+"""`;
+}
+function tomlQuoteString(s) {
+  return tomlValue(s);
+}
+function tomlInlineArray(items) {
+  return tomlValue([...items]);
+}
+function tomlInlineTable(table) {
+  const entries = Object.entries(table).map(([k, v]) => `${k} = ${tomlValue(v)}`);
+  return `{ ${entries.join(", ")} }`;
+}
+function frontmatterDataForSkill(skill) {
+  const data = {
+    name: skill.meta.id,
+    description: skill.meta.description
+  };
+  if (skill.meta.tags && skill.meta.tags.length > 0) data.tags = skill.meta.tags;
+  return data;
+}
+function frontmatterDataForCmd(cmd) {
+  const data = {
+    id: cmd.meta.id,
+    trigger: cmd.meta.trigger,
+    description: cmd.meta.description
+  };
+  if (cmd.meta.args && cmd.meta.args.length > 0) {
+    data.args = cmd.meta.args.map((a) => {
+      if (a.type === "enum") {
+        return a.default !== void 0 ? { name: a.name, type: a.type, values: a.values, default: a.default } : { name: a.name, type: a.type, values: a.values };
+      }
+      return a.default !== void 0 ? { name: a.name, type: a.type, default: a.default } : { name: a.name, type: a.type };
+    });
+  }
+  return data;
+}
+function buildAgentBody(agent) {
+  return `${agent.body.trim()}
+`;
+}
+function buildUmbrellaBody(_agents, extras) {
+  const triggerBySkill = new Map(
+    extras.availableCommands.map((c) => [c.meta.invokes_skill, c.meta.trigger])
+  );
+  const skillLines = extras.availableSkills.map((s) => {
+    const trigger = triggerBySkill.get(s.meta.id);
+    const label = trigger ? `\`${s.meta.id}\` (\`${trigger}\`)` : `\`${s.meta.id}\``;
+    return `- ${label} \u2014 ${s.meta.description.split("\n")[0]}`;
+  });
+  const sections = [
+    "# How we work",
+    "",
+    "This file describes **how to work in this project**. The **business context** (what the project does, how to run it, which subsystems it contains) lives in `README.md` and `docs/`. Read them first.",
+    "",
+    "## Project map",
+    "",
+    "- `README.md` \u2014 pitch, quick start, scripts. Entry point.",
+    "- `docs/spec/<subsystem>.md` \u2014 *what* and *why* (tech-agnostic).",
+    "- `docs/handbook/<feature>.md` \u2014 *how it actually works* today.",
+    "- `docs/decisions/<slug>.md` \u2014 ADRs: structural choices and rejected alternatives.",
+    "- `docs/tests/integration-tests.md` & `e2e-tests.md` \u2014 core scenarios.",
+    "- `docs/workflow/coding-workflow.md` \u2014 CI, branches, PR, release.",
+    ...extras.hasProjectSkills ? ["- `docs/skills/*.skill.md` \u2014 the project's domain skills."] : [],
+    ...extras.hasQualityDoc ? [
+      "- `docs/quality/code-quality.md` \u2014 the project's code-quality rules: mechanical checks, judgment rules, accepted deviations. Read it before writing or auditing code."
+    ] : [],
+    "",
+    "## Doc-first",
+    "",
+    "The order is: **understand the docs \u2192 fill the gaps \u2192 code \u2192 update the docs \u2192 commit**. If the docs are silent or stale on something you change, fill the gap upfront with the doc-skill writers \u2014 not downstream, not after the fact.",
+    "",
+    "- Missing spec for a subsystem you touch \u2192 **do not code**, report the gap.",
+    "- Implicit structural decision in your changes \u2192 an ADR (`/decision`).",
+    "- Changed feature behavior \u2192 update the matching handbook (`/handbook`).",
+    "- Suspected code \u2194 doc drift \u2192 `/drift` before moving on."
+  ];
+  if (skillLines.length > 0) {
+    sections.push("", "## Doc-skills", "", skillLines.join("\n"));
+  }
+  return `${sections.join("\n")}
+`;
+}
+
+// src/renderers/claude-code.ts
+var ENGINE = "claude-code";
+var BASE = ".claude";
+var claudeCodeRenderer = {
+  engine: ENGINE,
+  renderSkill(skill) {
+    if (!isSkillEngineAllowed(skill, ENGINE)) {
+      return {
+        files: [],
+        warnings: [`skill "${skill.meta.id}" excluded from engine "${ENGINE}"`]
+      };
+    }
+    const check = checkSkillCapabilities(skill, ENGINE);
+    if (check.blockingWarnings.length > 0) {
+      return { files: [], warnings: check.blockingWarnings };
+    }
+    const content = `${yamlFrontmatter(frontmatterDataForSkill(skill))}
+${skill.body}
+`;
+    return {
+      files: [{ path: `${BASE}/skills/${skill.meta.id}/SKILL.md`, content }],
+      warnings: check.degradedWarnings
+    };
+  },
+  renderCmd(cmd) {
+    const content = `${yamlFrontmatter(frontmatterDataForCmd(cmd))}
+${cmd.body}
+`;
+    return {
+      files: [{ path: `${BASE}/commands/${cmd.meta.id}.md`, content }],
+      warnings: []
+    };
+  },
+  renderAgents(agents) {
+    const files = [];
+    for (const agent of agents) {
+      const subagentFrontmatter = yamlFrontmatter({
+        name: agent.meta.id,
+        description: agent.meta.description
+      });
+      const body = buildAgentBody(agent);
+      const content = `${subagentFrontmatter}
+${body}`;
+      files.push({ path: `${BASE}/agents/${agent.meta.id}.md`, content });
+    }
+    return { files, warnings: [] };
+  },
+  renderMcp(servers) {
+    if (servers.length === 0) return { files: [], warnings: [] };
+    const mcpServers = {};
+    for (const s of servers) {
+      const entry = { command: s.command, args: [...s.args] };
+      if (s.env) entry.env = s.env;
+      mcpServers[s.id] = entry;
+    }
+    const content = `${JSON.stringify({ mcpServers }, null, 2)}
+`;
+    return { files: [{ path: ".mcp.json", content }], warnings: [] };
+  },
+  renderStopHook() {
+    const settings = {
+      hooks: {
+        Stop: [
+          {
+            matcher: "",
+            hooks: [
+              {
+                type: "command",
+                command: `npx -y ${STOP_HOOK_PACKAGE} stop-hook --engine claude`
+              }
+            ]
+          }
+        ]
+      }
+    };
+    return {
+      files: [{ path: `${BASE}/settings.json`, content: `${JSON.stringify(settings, null, 2)}
+` }],
+      warnings: []
+    };
+  }
+};
+
+// src/renderers/codex-cli.ts
+var ENGINE2 = "codex-cli";
+var BASE2 = ".codex";
+var SKILLS_BASE = ".agents/skills";
+var codexCliRenderer = {
+  engine: ENGINE2,
+  renderSkill(skill) {
+    if (!isSkillEngineAllowed(skill, ENGINE2)) {
+      return {
+        files: [],
+        warnings: [`skill "${skill.meta.id}" excluded from engine "${ENGINE2}"`]
+      };
+    }
+    const check = checkSkillCapabilities(skill, ENGINE2);
+    if (check.blockingWarnings.length > 0) {
+      return { files: [], warnings: check.blockingWarnings };
+    }
+    const content = `${yamlFrontmatter(frontmatterDataForSkill(skill))}
+${skill.body}
+`;
+    return {
+      files: [{ path: `${SKILLS_BASE}/${skill.meta.id}/SKILL.md`, content }],
+      warnings: check.degradedWarnings
+    };
+  },
+  // Codex custom prompts are deprecated in favour of skills: nothing to render.
+  renderCmd(_cmd) {
+    return { files: [], warnings: [] };
+  },
+  renderAgents(agents) {
+    const files = [];
+    for (const agent of agents) {
+      const content = [
+        `name = ${tomlQuoteString(agent.meta.id)}`,
+        `description = ${tomlQuoteString(agent.meta.description)}`,
+        `developer_instructions = ${tomlMultilineString(buildAgentBody(agent).trimEnd())}`,
+        ""
+      ].join("\n");
+      files.push({ path: `${BASE2}/agents/${agent.meta.id}.toml`, content });
+    }
+    return { files, warnings: [] };
+  },
+  renderMcp(servers) {
+    if (servers.length === 0) return { files: [], warnings: [] };
+    const blocks = [];
+    for (const s of servers) {
+      const lines = [
+        `[mcp_servers.${s.id}]`,
+        `command = ${tomlQuoteString(s.command)}`,
+        `args = ${tomlInlineArray([...s.args])}`
+      ];
+      if (s.env) lines.push(`env = ${tomlInlineTable(s.env)}`);
+      blocks.push(lines.join("\n"));
+    }
+    const content = `${blocks.join("\n\n")}
+`;
+    return { files: [{ path: `${BASE2}/config.toml`, content }], warnings: [] };
+  },
+  renderStopHook() {
+    const hooks = {
+      hooks: {
+        Stop: [
+          {
+            hooks: [
+              {
+                type: "command",
+                command: `npx -y ${STOP_HOOK_PACKAGE} stop-hook --engine codex`
+              }
+            ]
+          }
+        ]
+      }
+    };
+    return {
+      files: [{ path: `${BASE2}/hooks.json`, content: `${JSON.stringify(hooks, null, 2)}
+` }],
+      warnings: []
+    };
+  }
+};
+
+// src/renderers/opencode.ts
+var ENGINE3 = "opencode";
+var BASE3 = ".opencode";
+var opencodeRenderer = {
+  engine: ENGINE3,
+  renderSkill(skill) {
+    if (!isSkillEngineAllowed(skill, ENGINE3)) {
+      return {
+        files: [],
+        warnings: [`skill "${skill.meta.id}" excluded from engine "${ENGINE3}"`]
+      };
+    }
+    const check = checkSkillCapabilities(skill, ENGINE3);
+    if (check.blockingWarnings.length > 0) {
+      return { files: [], warnings: check.blockingWarnings };
+    }
+    const content = `${yamlFrontmatter(frontmatterDataForSkill(skill))}
+${skill.body}
+`;
+    return {
+      files: [{ path: `${BASE3}/skills/${skill.meta.id}/SKILL.md`, content }],
+      warnings: check.degradedWarnings
+    };
+  },
+  renderCmd(cmd) {
+    const content = `${yamlFrontmatter({ description: cmd.meta.description })}
+${cmd.body}
+`;
+    return {
+      files: [{ path: `${BASE3}/commands/${cmd.meta.id}.md`, content }],
+      warnings: []
+    };
+  },
+  renderAgents(agents) {
+    const files = [];
+    for (const agent of agents) {
+      const fm = yamlFrontmatter({
+        description: agent.meta.description,
+        mode: "all"
+      });
+      const body = buildAgentBody(agent);
+      files.push({ path: `${BASE3}/agents/${agent.meta.id}.md`, content: `${fm}
+${body}` });
+    }
+    return { files, warnings: [] };
+  },
+  renderMcp(servers) {
+    if (servers.length === 0) return { files: [], warnings: [] };
+    const mcp = {};
+    for (const s of servers) {
+      const entry = {
+        type: "local",
+        command: [s.command, ...s.args],
+        enabled: true
+      };
+      if (s.env) entry.environment = s.env;
+      mcp[s.id] = entry;
+    }
+    const config = { $schema: "https://opencode.ai/config.json", mcp };
+    const content = `${JSON.stringify(config, null, 2)}
+`;
+    return { files: [{ path: `${BASE3}/opencode.json`, content }], warnings: [] };
+  },
+  renderStopHook() {
+    const content = `import { spawnSync } from "node:child_process";
+
+// Runs the harness lint and returns the report to inject, or "" when the
+// turn may end.
+const lintReport = (directory, sessionID) => {
+  const r = spawnSync(
+    "npx",
+    ["-y", "${STOP_HOOK_PACKAGE}", "stop-hook", "--engine", "opencode", "--cwd", directory],
+    { input: JSON.stringify({ sessionID }), encoding: "utf-8" },
+  );
+  const report = (r.stderr ?? "").trim();
+  return r.status === 2 ? report : "";
+};
+
+// OpenCode 1.x entry point, exposed as server() below.
+const HarnessStopHook = async ({ client, directory }) => ({
+  event: async ({ event }) => {
+    if (event.type !== "session.idle") return;
+    const sessionID = event.properties?.sessionID;
+    if (!sessionID) return;
+    const report = lintReport(directory, sessionID);
+    if (report === "") return;
+    // OpenCode defaults to its build agent when a prompt omits agent.
+    // Preserve the last conversation persona, excluding compaction summaries.
+    const history = await client.session.messages({ path: { id: sessionID } }).catch(() => undefined);
+    if (history?.error || !Array.isArray(history?.data)) return;
+    const current = history.data.findLast(({ info }) =>
+      (info.role === "user" || (info.role === "assistant" && !info.summary)) &&
+      typeof info.agent === "string" && info.agent.trim() !== "",
+    );
+    if (!current) return;
+    await client.session.prompt({
+      path: { id: sessionID },
+      body: { agent: current.info.agent, parts: [{ type: "text", text: report }] },
+    });
+  },
+});
+
+// One default export for both majors: OpenCode 1.x calls server(),
+// OpenCode 2.x calls setup(). A V2 session keeps its agent, so the report
+// is sent without naming the persona.
+export default {
+  id: "vaubaan-harness-stop-hook",
+  server: HarnessStopHook,
+  setup(context) {
+    const directory = context.location.directory;
+    const controller = new AbortController();
+    const listen = async () => {
+      for await (const event of context.event.subscribe({ signal: controller.signal })) {
+        if (event.type !== "session.idle") continue;
+        if (event.location?.directory && event.location.directory !== directory) continue;
+        const sessionID = event.data?.sessionID;
+        if (!sessionID) continue;
+        const report = lintReport(directory, sessionID);
+        if (report === "") continue;
+        await context.session.prompt({ sessionID, text: report }).catch(() => undefined);
+      }
+    };
+    listen().catch(() => undefined);
+    return () => controller.abort();
+  },
+};
+`;
+    return {
+      files: [{ path: `${BASE3}/plugins/harness-stop-hook.ts`, content }],
+      warnings: []
+    };
+  }
+};
+
+// src/renderers/index.ts
+var RENDERERS = {
+  "claude-code": claudeCodeRenderer,
+  "codex-cli": codexCliRenderer,
+  opencode: opencodeRenderer
+};
+function getRenderer(engine) {
+  return RENDERERS[engine];
+}
+
+// src/render.ts
+var RenderError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RenderError";
+  }
+};
+function mergeById(stock, added) {
+  const result = /* @__PURE__ */ new Map();
+  for (const item of stock) result.set(item.meta.id, item);
+  if (added) {
+    for (const item of added) result.set(item.meta.id, item);
+  }
+  return Array.from(result.values());
+}
+function removeByIds(items, disabled) {
+  if (disabled.length === 0) return [...items];
+  const disabledSet = new Set(disabled);
+  return items.filter((item) => !disabledSet.has(item.meta.id));
+}
+function applyOverrides(harness, overrides) {
+  const disabled = overrides?.disable ?? [];
+  return {
+    agents: removeByIds(mergeById(harness.agents, overrides?.add?.agents), disabled),
+    skills: removeByIds(mergeById(harness.skills, overrides?.add?.skills), disabled),
+    cmds: removeByIds(mergeById(harness.cmds, overrides?.add?.cmds), disabled)
+  };
+}
+var CLAUDE_MD_STUB = "@AGENTS.md\n";
+function opencodeLast(engines) {
+  return [...engines].sort((a, b) => Number(a === "opencode") - Number(b === "opencode"));
+}
+function render(input) {
+  const { engines } = input;
+  if (engines.length === 0) {
+    throw new RenderError("at least one engine must be selected");
+  }
+  const base = input.projectSkills?.length ? { ...input.harness, skills: mergeById(input.harness.skills, input.projectSkills) } : input.harness;
+  const harness = applyOverrides(base, input.overrides);
+  if (harness.agents.length === 0) {
+    throw new RenderError("No agents found in harness");
+  }
+  const files = [];
+  const warnings = [];
+  const exposedSkills = /* @__PURE__ */ new Map();
+  const exposedCmds = /* @__PURE__ */ new Map();
+  for (const engine of opencodeLast(engines)) {
+    const renderer = getRenderer(engine);
+    const renderedSkills = [];
+    for (const skill of harness.skills) {
+      const result = renderer.renderSkill(skill);
+      warnings.push(...result.warnings);
+      if (result.files.length > 0) {
+        const alreadyVisible = engine === "opencode" && exposedSkills.has(skill.meta.id);
+        if (!alreadyVisible) files.push(...result.files);
+        renderedSkills.push(skill);
+        exposedSkills.set(skill.meta.id, skill);
+      }
+    }
+    const renderedSkillIds = new Set(renderedSkills.map((s) => s.meta.id));
+    const renderedCmds = [];
+    for (const cmd of harness.cmds) {
+      if (!renderedSkillIds.has(cmd.meta.invokes_skill)) continue;
+      const result = renderer.renderCmd(cmd);
+      warnings.push(...result.warnings);
+      if (result.files.length > 0) {
+        files.push(...result.files);
+        renderedCmds.push(cmd);
+        exposedCmds.set(cmd.meta.id, cmd);
+      }
+    }
+    const agentsResult = renderer.renderAgents(harness.agents);
+    warnings.push(...agentsResult.warnings);
+    files.push(...agentsResult.files);
+    if (input.mcpServers && input.mcpServers.length > 0) {
+      const specs = input.mcpServers.map((id) => MCP_SERVERS[id]);
+      const mcpResult = renderer.renderMcp(specs);
+      warnings.push(...mcpResult.warnings);
+      files.push(...mcpResult.files);
+    }
+    if (input.withStopHook !== false) {
+      const hookResult = renderer.renderStopHook();
+      warnings.push(...hookResult.warnings);
+      files.push(...hookResult.files);
+    }
+  }
+  const hasProjectSkills = (input.projectSkills?.length ?? 0) > 0;
+  const umbrellaContent = buildUmbrellaBody(harness.agents, {
+    availableSkills: Array.from(exposedSkills.values()),
+    availableCommands: Array.from(exposedCmds.values()),
+    hasProjectSkills,
+    hasQualityDoc: input.hasQualityDoc === true
+  });
+  files.push({ path: "AGENTS.md", content: umbrellaContent });
+  if (engines.includes("claude-code")) {
+    files.push({ path: "CLAUDE.md", content: CLAUDE_MD_STUB });
+  }
+  return { files, warnings };
+}
+
+// src/cli/managed-paths.ts
+import { lstatSync, realpathSync, statSync as statSync2 } from "fs";
+import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute2, join as join6, resolve as resolve2, win32 } from "path";
+var MANAGED_FILES = /* @__PURE__ */ new Set([
+  "AGENTS.md",
+  "CLAUDE.md",
+  ".mcp.json",
+  ".harness-manifest.json",
+  ".claude/settings.json",
+  ".codex/config.toml",
+  ".codex/hooks.json",
+  ".opencode/opencode.json",
+  ".opencode/mcp.json"
+]);
+var MANAGED_DIRECTORIES = [
+  ".claude/agents/",
+  ".claude/commands/",
+  ".claude/skills/",
+  ".codex/agents/",
+  ".codex/commands/",
+  ".codex/skills/",
+  ".agents/skills/",
+  ".opencode/agents/",
+  ".opencode/commands/",
+  ".opencode/skills/",
+  ".opencode/plugins/"
+];
+function canonicalTargetRoot(root) {
+  let ancestor = resolve2(root);
+  const missing = [];
+  while (!lstatSync(ancestor, { throwIfNoEntry: false })) {
+    missing.unshift(basename2(ancestor));
+    ancestor = dirname2(ancestor);
+  }
+  const canonical = realpathSync(ancestor);
+  if (!statSync2(canonical).isDirectory()) {
+    throw new Error(`harness target is not a directory: ${root}`);
+  }
+  return join6(canonical, ...missing);
+}
+function assertManagedLocation(path) {
+  const invalidSegment = path.split("/").some((part) => part === "" || part === "." || part === "..");
+  if (isAbsolute2(path) || win32.isAbsolute(path) || path.includes("\\") || path.includes("\0") || invalidSegment) {
+    throw new Error(`unsafe harness path: ${path}`);
+  }
+  if (!MANAGED_FILES.has(path) && !MANAGED_DIRECTORIES.some((prefix) => path.startsWith(prefix))) {
+    throw new Error(`path is outside harness-managed locations: ${path}`);
+  }
+}
+function assertNoSymbolicComponents(root, path) {
+  const parts = path.split("/");
+  let current = root;
+  for (const [index, part] of parts.entries()) {
+    current = join6(current, part);
+    const info = lstatSync(current, { throwIfNoEntry: false });
+    if (!info) return;
+    if (info.isSymbolicLink()) {
+      throw new Error(`symbolic link in harness path: ${path}`);
+    }
+    const isLeaf = index === parts.length - 1;
+    if (isLeaf ? !info.isFile() : !info.isDirectory()) {
+      throw new Error(`unexpected file type in harness path: ${path}`);
+    }
+  }
+}
+function assertManagedPaths(root, files) {
+  for (const path of files) assertManagedLocation(path);
+  const canonicalRoot2 = canonicalTargetRoot(root);
+  for (const path of files) assertNoSymbolicComponents(canonicalRoot2, path);
+}
+
+// src/cli/manifest.ts
+import { createHash } from "crypto";
+import { chmodSync, existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync } from "fs";
+import { join as join9 } from "path";
+import { z as z5 } from "zod";
+
+// src/cli/opencode-config.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { join as join7 } from "path";
+import { isDeepStrictEqual } from "util";
+import { z as z3 } from "zod";
+var OPENCODE_CONFIG_PATH = ".opencode/opencode.json";
+var OPENCODE_SCHEMA = "https://opencode.ai/config.json";
+var ObjectSchema = z3.record(z3.unknown());
+var OpenCodeConfigOwnershipSchema = z3.object({
+  createdFile: z3.boolean(),
+  addedMcp: z3.boolean(),
+  addedSchema: z3.boolean(),
+  entries: z3.record(ObjectSchema)
+});
+function parseConfig(content) {
+  try {
+    const config = ObjectSchema.parse(JSON.parse(content));
+    if (Object.hasOwn(config, "mcp")) ObjectSchema.parse(config.mcp);
+    return config;
+  } catch {
+    throw new Error(`invalid ${OPENCODE_CONFIG_PATH}: expected a JSON object with an MCP object`);
+  }
+}
+function removeOwnedEntries(config, ownership, warnings) {
+  if (Object.hasOwn(config, "mcp")) {
+    const mcp = ObjectSchema.parse(config.mcp);
+    for (const [id, installed] of Object.entries(ownership.entries)) {
+      if (!Object.hasOwn(mcp, id)) continue;
+      if (isDeepStrictEqual(mcp[id], installed)) delete mcp[id];
+      else warnings.push(`preserved modified OpenCode MCP server: ${id}`);
+    }
+    config.mcp = mcp;
+    if (ownership.addedMcp && Object.keys(mcp).length === 0) Reflect.deleteProperty(config, "mcp");
+  }
+  if (ownership.addedSchema && config.$schema === OPENCODE_SCHEMA)
+    Reflect.deleteProperty(config, "$schema");
+}
+function addMissingEntries(config, desired, createdFile, warnings) {
+  const requested = ObjectSchema.parse(parseConfig(desired.content).mcp);
+  const mcp = ObjectSchema.parse(config.mcp ?? {});
+  const entries = {};
+  for (const [id, entry] of Object.entries(requested)) {
+    if (Object.hasOwn(mcp, id)) {
+      if (!isDeepStrictEqual(mcp[id], entry)) {
+        warnings.push(`preserved existing OpenCode MCP server instead of replacing it: ${id}`);
+      }
+      continue;
+    }
+    entries[id] = ObjectSchema.parse(entry);
+    mcp[id] = entry;
+  }
+  if (Object.keys(entries).length === 0) return void 0;
+  const ownership = {
+    createdFile,
+    addedMcp: !Object.hasOwn(config, "mcp"),
+    addedSchema: !Object.hasOwn(config, "$schema"),
+    entries
+  };
+  config.mcp = mcp;
+  if (ownership.addedSchema) config.$schema = OPENCODE_SCHEMA;
+  return ownership;
+}
+function planOpenCodeConfig(root, desired, previous) {
+  const warnings = [];
+  if (!desired && !previous) return { remove: false, warnings };
+  const path = join7(root, OPENCODE_CONFIG_PATH);
+  const existed = existsSync6(path);
+  if (!existed && !desired) return { remove: false, warnings };
+  const original = existed ? readFileSync5(path, "utf8") : void 0;
+  const config = original === void 0 ? {} : parseConfig(original);
+  const before = structuredClone(config);
+  if (previous) removeOwnedEntries(config, previous, warnings);
+  const createdFile = !existed || previous?.createdFile === true;
+  const ownership = desired ? addMissingEntries(config, desired, createdFile, warnings) : void 0;
+  if (!ownership && createdFile && Object.keys(config).length === 0) {
+    return { remove: existed, warnings };
+  }
+  return {
+    remove: false,
+    ownership,
+    warnings,
+    ...!existed || !isDeepStrictEqual(before, config) ? { write: { path: OPENCODE_CONFIG_PATH, content: `${JSON.stringify(config, null, 2)}
+` } } : {}
+  };
+}
+
+// src/cli/update-config.ts
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { join as join8 } from "path";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { z as z4 } from "zod";
+var LEGACY_OPENCODE_CONFIG = ".opencode/mcp.json";
+var SHARED_CONFIG_PATHS = [
+  ".mcp.json",
+  ".codex/config.toml",
+  OPENCODE_CONFIG_PATH,
+  LEGACY_OPENCODE_CONFIG,
+  ".claude/settings.json",
+  ".codex/hooks.json"
+];
+var ObjectSchema2 = z4.record(z4.unknown());
+var HookEntrySchema = z4.object({ group: ObjectSchema2, hook: ObjectSchema2 });
+var HookConfigOwnershipSchema = z4.object({
+  createdFile: z4.boolean(),
+  addedHooks: z4.boolean(),
+  addedStop: z4.boolean(),
+  entries: z4.array(HookEntrySchema)
+});
+var HookConfigsOwnershipSchema = z4.object({
+  ".claude/settings.json": HookConfigOwnershipSchema.optional(),
+  ".codex/hooks.json": HookConfigOwnershipSchema.optional()
+}).strict();
+var HOOK_ENGINES = {
+  ".claude/settings.json": "claude-code",
+  ".codex/hooks.json": "codex-cli"
+};
+function parseObject(content, path) {
+  try {
+    return ObjectSchema2.parse(JSON.parse(content));
+  } catch {
+    throw new Error(`invalid shared configuration ${path}: expected a JSON object`);
+  }
+}
+function asObject(value) {
+  const parsed = ObjectSchema2.safeParse(value);
+  return parsed.success ? parsed.data : void 0;
+}
+function stopHooks(config, path) {
+  if (!Object.hasOwn(config, "hooks")) return [];
+  const hooks = asObject(config.hooks);
+  if (!hooks || Object.hasOwn(hooks, "Stop") && !Array.isArray(hooks.Stop)) {
+    throw new Error(`invalid shared configuration ${path}: expected hooks.Stop to be an array`);
+  }
+  return Array.isArray(hooks.Stop) ? hooks.Stop : [];
+}
+function groupMetadata(group) {
+  return Object.fromEntries(Object.entries(group).filter(([key]) => key !== "hooks"));
+}
+function sameEntry(left, right) {
+  return isDeepStrictEqual2(left.group, right.group) && isDeepStrictEqual2(left.hook, right.hook);
+}
+function appendEntry(entries, entry) {
+  if (!entries.some((existing) => sameEntry(existing, entry))) entries.push(entry);
+}
+function defaultStopGroup(engine) {
+  const file = getRenderer(engine).renderStopHook().files[0];
+  if (!file) throw new Error(`missing Stop hook renderer for ${engine}`);
+  const group = asObject(stopHooks(parseObject(file.content, file.path), file.path)[0]);
+  if (!group || !Array.isArray(group.hooks) || !asObject(group.hooks[0])) {
+    throw new Error(`invalid Stop hook renderer for ${engine}`);
+  }
+  return group;
+}
+function normalizeHarnessHooks(groups, expected, previous, claimExisting, warnings, path) {
+  const defaultHook = ObjectSchema2.parse(expected.hooks[0]);
+  const entries = [...previous?.entries ?? []];
+  let found = false;
+  const normalized = groups.map((value) => {
+    const group = asObject(value);
+    if (!group) return value;
+    const flat = group.type === "command" && group.command === defaultHook.command;
+    const hooks = flat ? [group] : Array.isArray(group.hooks) ? group.hooks : [];
+    const metadata = flat ? groupMetadata(expected) : groupMetadata(group);
+    for (const value2 of hooks) {
+      const hook = asObject(value2);
+      if (!hook || hook.type !== "command" || hook.command !== defaultHook.command) continue;
+      found = true;
+      const entry = { group: metadata, hook };
+      if (!claimExisting) continue;
+      if (previous && !previous.entries.some((old) => sameEntry(old, entry))) {
+        warnings.push(`preserved modified harness Stop hook: ${path}`);
+      } else {
+        appendEntry(entries, entry);
+      }
+    }
+    return flat && claimExisting ? { ...metadata, hooks: [group] } : value;
+  });
+  if (!found && !previous?.entries.length) {
+    normalized.push(expected);
+    appendEntry(entries, { group: groupMetadata(expected), hook: defaultHook });
+  } else if (!found) {
+    warnings.push(`preserved removed or modified harness Stop hook: ${path}`);
+  }
+  return { groups: normalized, entries };
+}
+function removeOwnedHooks(config, ownership, path, warnings) {
+  const groups = stopHooks(config, path);
+  const remaining = [];
+  const matched = /* @__PURE__ */ new Set();
+  for (const value of groups) {
+    const group = asObject(value);
+    if (!group || !Array.isArray(group.hooks)) {
+      remaining.push(value);
+      continue;
+    }
+    const metadata = groupMetadata(group);
+    const hooks2 = group.hooks.filter((value2) => {
+      const hook = asObject(value2);
+      const entry = hook && ownership.entries.find((old) => sameEntry(old, { group: metadata, hook }));
+      if (entry) matched.add(entry);
+      return !entry;
+    });
+    if (hooks2.length > 0 || hooks2.length === group.hooks.length) {
+      remaining.push({ ...group, hooks: hooks2 });
+    }
+  }
+  if (matched.size < ownership.entries.length) {
+    warnings.push(`preserved removed or modified harness Stop hook: ${path}`);
+  }
+  const hooks = asObject(config.hooks);
+  if (!hooks) return;
+  if (ownership.addedStop && remaining.length === 0) Reflect.deleteProperty(hooks, "Stop");
+  else if (Object.hasOwn(hooks, "Stop")) hooks.Stop = remaining;
+  if (ownership.addedHooks && Object.keys(hooks).length === 0)
+    Reflect.deleteProperty(config, "hooks");
+  else config.hooks = hooks;
+}
+function recordMutation(plan, path, before, after, createdFile) {
+  if (createdFile && Object.keys(after).length === 0) {
+    if (before) plan.removals.push(path);
+  } else if (!isDeepStrictEqual2(before, after)) {
+    plan.writes.push({ path, content: `${JSON.stringify(after, null, 2)}
+` });
+  }
+}
+function planHookConfigCleanup(root, ownership) {
+  const plan = { writes: [], removals: [], warnings: [] };
+  if (!ownership) return plan;
+  const validated = HookConfigsOwnershipSchema.parse(ownership);
+  assertManagedPaths(root, Object.keys(validated));
+  for (const path of Object.keys(HOOK_ENGINES)) {
+    const owned = validated[path];
+    if (!owned || !existsSync7(join8(root, path))) continue;
+    const before = parseObject(readFileSync6(join8(root, path), "utf8"), path);
+    const config = structuredClone(before);
+    removeOwnedHooks(config, owned, path, plan.warnings);
+    recordMutation(plan, path, before, config, owned.createdFile);
+  }
+  return plan;
+}
+function planActiveHook(root, path, previous, claimExisting, plan) {
+  assertManagedPaths(root, [path]);
+  const existed = existsSync7(join8(root, path));
+  if (!existed && previous?.entries.length) {
+    plan.warnings.push(`preserved removed harness Stop hook configuration: ${path}`);
+    return previous;
+  }
+  const before = existed ? parseObject(readFileSync6(join8(root, path), "utf8"), path) : void 0;
+  const config = structuredClone(before ?? {});
+  const groups = stopHooks(config, path);
+  const hooks = asObject(config.hooks) ?? {};
+  const normalized = normalizeHarnessHooks(
+    groups,
+    defaultStopGroup(HOOK_ENGINES[path]),
+    previous,
+    claimExisting,
+    plan.warnings,
+    path
+  );
+  const ownership = {
+    createdFile: !existed || previous?.createdFile === true,
+    addedHooks: previous?.addedHooks ?? !Object.hasOwn(config, "hooks"),
+    addedStop: previous?.addedStop ?? !Object.hasOwn(hooks, "Stop"),
+    entries: normalized.entries
+  };
+  if (!isDeepStrictEqual2(groups, normalized.groups)) {
+    config.hooks = { ...hooks, Stop: normalized.groups };
+  }
+  recordMutation(plan, path, before, config, ownership.createdFile);
+  return ownership.entries.length > 0 ? ownership : void 0;
+}
+function planLegacyOpenCode(root, previous, plan) {
+  if (!previous.files.includes(LEGACY_OPENCODE_CONFIG)) return;
+  const legacyPath = join8(root, LEGACY_OPENCODE_CONFIG);
+  if (!existsSync7(legacyPath)) return;
+  assertManagedPaths(root, [LEGACY_OPENCODE_CONFIG, OPENCODE_CONFIG_PATH]);
+  const legacy = parseObject(readFileSync6(legacyPath, "utf8"), LEGACY_OPENCODE_CONFIG);
+  if (!asObject(legacy.mcp)) {
+    throw new Error(
+      `invalid shared configuration ${LEGACY_OPENCODE_CONFIG}: expected an MCP object`
+    );
+  }
+  const merged = planOpenCodeConfig(
+    root,
+    { path: OPENCODE_CONFIG_PATH, content: JSON.stringify(legacy) },
+    void 0
+  );
+  if (merged.write) plan.writes.push(merged.write);
+  plan.warnings.push(...merged.warnings);
+  if (merged.ownership) {
+    const old = previous.opencodeConfig;
+    plan.opencodeConfig = {
+      createdFile: merged.ownership.createdFile || old?.createdFile === true,
+      addedMcp: merged.ownership.addedMcp || old?.addedMcp === true,
+      addedSchema: merged.ownership.addedSchema || old?.addedSchema === true,
+      entries: { ...old?.entries, ...merged.ownership.entries }
+    };
+  }
+  plan.removals.push(LEGACY_OPENCODE_CONFIG);
+}
+function planUpdateConfigs(root, previous, hookEngines) {
+  const plan = {
+    writes: [],
+    removals: [],
+    ownedFiles: [],
+    warnings: [],
+    ...previous.opencodeConfig ? { opencodeConfig: previous.opencodeConfig } : {}
+  };
+  planLegacyOpenCode(root, previous, plan);
+  const hookConfigs = {};
+  for (const path of Object.keys(HOOK_ENGINES)) {
+    const owned = previous.hookConfigs?.[path];
+    if (hookEngines.includes(HOOK_ENGINES[path])) {
+      hookConfigs[path] = planActiveHook(
+        root,
+        path,
+        owned,
+        previous.files.includes(path) || Boolean(owned),
+        plan
+      );
+    } else if (owned) {
+      const cleanup = planHookConfigCleanup(root, { [path]: owned });
+      plan.writes.push(...cleanup.writes);
+      plan.removals.push(...cleanup.removals);
+      plan.warnings.push(...cleanup.warnings);
+    }
+  }
+  if (Object.values(hookConfigs).some(Boolean)) plan.hookConfigs = hookConfigs;
+  if (hookEngines.includes("opencode")) {
+    const plugin = getRenderer("opencode").renderStopHook();
+    plan.writes.push(...plugin.files);
+    plan.ownedFiles.push(...plugin.files.map((file) => file.path));
+    plan.warnings.push(...plugin.warnings);
+  }
+  return plan;
+}
+
+// src/cli/manifest.ts
+var MANIFEST_FILENAME = ".harness-manifest.json";
+var MANIFEST_VERSION = "6";
+var ManifestSchema = z5.object({
+  version: z5.enum(["4", "5", MANIFEST_VERSION]),
+  engines: z5.array(z5.string()),
+  renderedAt: z5.string(),
+  files: z5.array(z5.string()),
+  stopHookInstalled: z5.boolean().optional(),
+  stopHookEngines: z5.array(z5.string()).optional(),
+  opencodeConfig: OpenCodeConfigOwnershipSchema.optional(),
+  hookConfigs: HookConfigsOwnershipSchema.optional(),
+  harnessVersion: z5.string().optional(),
+  overridesDir: z5.string().optional(),
+  fileHashes: z5.record(z5.string().regex(/^[a-f0-9]{64}$/)).optional(),
+  preservedFiles: z5.array(z5.string()).optional()
+});
+function manifestPath(targetDir) {
+  return join9(targetDir, MANIFEST_FILENAME);
+}
+function writeManifest(targetDir, engines, files, extras = {}) {
+  assertManagedPaths(targetDir, [MANIFEST_FILENAME]);
+  const manifest = {
+    version: MANIFEST_VERSION,
+    harnessVersion: VERSION,
+    engines: [...engines].sort(),
+    renderedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    files: [...files].sort(),
+    fileHashes: Object.fromEntries(
+      files.filter((file) => existsSync8(join9(targetDir, file))).sort().map((file) => [file, hashContent(readFileSync7(join9(targetDir, file)))])
+    ),
+    ...extras.overridesDir ? { overridesDir: extras.overridesDir } : {},
+    ...extras.preservedFiles ? { preservedFiles: extras.preservedFiles } : {},
+    ...extras.hookConfigs ? { hookConfigs: extras.hookConfigs } : {},
+    ...extras.opencodeConfig ? { opencodeConfig: extras.opencodeConfig } : {},
+    ...extras.stopHookInstalled !== void 0 ? { stopHookInstalled: extras.stopHookInstalled } : {},
+    ...extras.stopHookEngines !== void 0 ? { stopHookEngines: [...extras.stopHookEngines].sort() } : {}
+  };
+  const path = manifestPath(targetDir);
+  if (existsSync8(path)) chmodSync(path, 384);
+  writeFileSync(path, `${JSON.stringify(manifest, null, 2)}
+`, { mode: 384 });
+}
+function hashContent(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+function readManifest(targetDir) {
+  assertManagedPaths(targetDir, [MANIFEST_FILENAME]);
+  const path = manifestPath(targetDir);
+  if (!existsSync8(path)) return null;
+  const raw = JSON.parse(readFileSync7(path, "utf8"));
+  return ManifestSchema.parse(raw);
+}
+
+// src/cli/uninstall.ts
+import { existsSync as existsSync9, readdirSync, rmdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, join as join10, relative as relative2, resolve as resolve3 } from "path";
+function uninstallCommand(args) {
+  const root = resolve3(args.targetDir);
+  const warnings = [];
+  assertManagedPaths(root, [MANIFEST_FILENAME]);
+  const manifest = readManifest(root);
+  if (!manifest) {
+    warnings.push(`no manifest found at ${manifestPath(root)} \u2014 nothing to uninstall`);
+    return { filesRemoved: [], dirsPruned: [], warnings };
+  }
+  assertManagedPaths(root, [
+    ...manifest.files,
+    ...manifest.opencodeConfig ? [OPENCODE_CONFIG_PATH] : [],
+    ...Object.keys(manifest.hookConfigs ?? {})
+  ]);
+  const config = planOpenCodeConfig(root, void 0, manifest.opencodeConfig);
+  const hooks = planHookConfigCleanup(root, manifest.hookConfigs);
+  const sharedHooks = new Set(Object.keys(manifest.hookConfigs ?? {}));
+  const ownedFiles = manifest.files.filter(
+    (file) => file !== OPENCODE_CONFIG_PATH && !sharedHooks.has(file)
+  );
+  if (config.remove) ownedFiles.push(OPENCODE_CONFIG_PATH);
+  ownedFiles.push(...hooks.removals);
+  const { filesRemoved, dirsPruned, missing } = removeRenderedFiles(root, ownedFiles);
+  if (config.write) writeFileSync2(join10(root, config.write.path), config.write.content);
+  for (const file of hooks.writes) writeFileSync2(join10(root, file.path), file.content);
+  warnings.push(...config.warnings, ...hooks.warnings);
+  if (manifest.files.includes(OPENCODE_CONFIG_PATH) && !manifest.opencodeConfig) {
+    warnings.push(`preserved legacy shared configuration: ${OPENCODE_CONFIG_PATH}`);
+  }
+  for (const rel of missing) warnings.push(`file in manifest is already missing: ${rel}`);
+  unlinkSync(manifestPath(root));
+  return { filesRemoved, dirsPruned, warnings };
+}
+function removeRenderedFiles(root, files) {
+  assertManagedPaths(root, files);
+  const filesRemoved = [];
+  const missing = [];
+  const dirsToConsider = /* @__PURE__ */ new Set();
+  for (const rel of files) {
+    const full = join10(root, rel);
+    if (existsSync9(full)) {
+      unlinkSync(full);
+      filesRemoved.push(rel);
+      dirsToConsider.add(dirname3(full));
+    } else {
+      missing.push(rel);
+    }
+  }
+  return { filesRemoved, dirsPruned: pruneEmptyDirs(root, dirsToConsider), missing };
+}
+function pruneEmptyDirs(root, leaves) {
+  const candidates = /* @__PURE__ */ new Set();
+  for (const leaf of leaves) {
+    let cur = leaf;
+    while (cur !== root && cur.startsWith(`${root}/`)) {
+      candidates.add(cur);
+      cur = dirname3(cur);
+    }
+  }
+  const pruned = [];
+  const sorted = [...candidates].sort((a, b) => b.length - a.length);
+  for (const dir of sorted) {
+    if (!existsSync9(dir)) continue;
+    if (readdirSync(dir).length > 0) continue;
+    rmdirSync(dir);
+    pruned.push(relative2(root, dir));
+  }
+  return pruned;
+}
+
+// src/cli/init.ts
+var QUALITY_DOC_PATH = "docs/quality/code-quality.md";
+function resolveEngineList(requested) {
+  if (!requested || requested.length === 0) return [...ENGINES];
+  return requested.map((e) => {
+    if (!ENGINES.includes(e)) {
+      throw new Error(`unknown engine: ${e} (expected one of ${ENGINES.join(", ")})`);
+    }
+    return e;
+  });
+}
+function defaultPackageDir() {
+  const here = dirname4(fileURLToPath(import.meta.url));
+  if (existsSync10(join11(here, "agents"))) return here;
+  return resolve4(here, "..");
+}
+function planInit(args) {
+  const engines = resolveEngineList(args.engines);
+  const packageDir = args.packageDir ?? defaultPackageDir();
+  const harness = loadHarness(packageDir);
+  const overrides = args.overridesDir ? loadOverrides(args.overridesDir) : void 0;
+  const projectSkills = loadProjectSkills(args.targetDir);
+  const hasQualityDoc = existsSync10(join11(args.targetDir, QUALITY_DOC_PATH));
+  const mcpServers = args.mcpServers ? resolveMcpIds(args.mcpServers) : void 0;
+  const stopHookInstalled = args.withStopHook !== false;
+  const output = render({
+    harness,
+    engines,
+    overrides,
+    projectSkills,
+    hasQualityDoc,
+    mcpServers,
+    withStopHook: stopHookInstalled
+  });
+  return { engines, output, stopHookInstalled };
+}
+function writeFilesToTarget(files, targetDir) {
+  assertManagedPaths(
+    targetDir,
+    files.map((file) => file.path)
+  );
+  const written = [];
+  for (const f of files) {
+    const full = join11(targetDir, f.path);
+    mkdirSync(dirname4(full), { recursive: true });
+    writeFileSync3(full, f.content);
+    written.push(f.path);
+  }
+  return written;
+}
+function initCommand(args) {
+  const { engines, output, stopHookInstalled } = planInit(args);
+  const previous = readManifest(args.targetDir);
+  assertManagedPaths(args.targetDir, [
+    MANIFEST_FILENAME,
+    ...previous?.files ?? [],
+    ...output.files.map((file) => file.path),
+    ...previous?.opencodeConfig ? [OPENCODE_CONFIG_PATH] : []
+  ]);
+  const desiredConfig = output.files.find((file) => file.path === OPENCODE_CONFIG_PATH);
+  const config = planOpenCodeConfig(args.targetDir, desiredConfig, previous?.opencodeConfig);
+  const next = new Set(output.files.map((f) => f.path));
+  const stale = (previous?.files ?? []).filter((f) => !next.has(f) && f !== OPENCODE_CONFIG_PATH);
+  if (config.remove) stale.push(OPENCODE_CONFIG_PATH);
+  const staleFilesRemoved = removeRenderedFiles(resolve4(args.targetDir), stale).filesRemoved;
+  const ownedFiles = output.files.filter((file) => file.path !== OPENCODE_CONFIG_PATH);
+  const filesWritten = writeFilesToTarget(ownedFiles, args.targetDir);
+  if (config.write) writeFilesToTarget([config.write], args.targetDir);
+  writeManifest(args.targetDir, engines, filesWritten, {
+    stopHookInstalled,
+    stopHookEngines: stopHookInstalled ? engines : void 0,
+    opencodeConfig: config.ownership,
+    overridesDir: args.overridesDir ? resolve4(args.overridesDir) === resolve4(args.targetDir) ? "." : resolve4(args.overridesDir) : void 0
+  });
+  if (config.write) filesWritten.push(OPENCODE_CONFIG_PATH);
+  const warnings = [...output.warnings, ...config.warnings];
+  if (previous?.files.includes(OPENCODE_CONFIG_PATH) && !previous.opencodeConfig) {
+    warnings.push(`preserved legacy shared configuration: ${OPENCODE_CONFIG_PATH}`);
+  }
+  return { filesWritten, staleFilesRemoved, warnings, stopHookInstalled };
+}
+
+// src/cli/render.ts
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname5, join as join12 } from "path";
+function renderCommand(args) {
+  const engineList = args.engines && args.engines.length > 0 ? args.engines.map((e) => {
+    if (!ENGINES.includes(e)) {
+      throw new Error(`unknown engine: ${e}`);
+    }
+    return e;
+  }) : [...ENGINES];
+  const harness = loadHarness(args.packageDir);
+  const mcpServers = args.mcpServers ? resolveMcpIds(args.mcpServers) : void 0;
+  const output = render({
+    harness,
+    engines: engineList,
+    mcpServers,
+    withStopHook: args.withStopHook !== false
+  });
+  const filesWritten = [];
+  for (const f of output.files) {
+    const full = join12(args.outDir, f.path);
+    mkdirSync2(dirname5(full), { recursive: true });
+    writeFileSync4(full, f.content);
+    filesWritten.push(f.path);
+  }
+  return { filesWritten, warnings: output.warnings };
+}
+
+// src/cli/stop-hook.ts
+import { readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve5 } from "path";
+
+// src/stop-hook/adapters/claude.ts
+var claudeAdapter = {
+  parseInput(stdin) {
+    const parsed = stdin.trim() === "" ? {} : JSON.parse(stdin);
+    return {
+      sessionId: typeof parsed.session_id === "string" ? parsed.session_id : "default",
+      stopHookActive: parsed.stop_hook_active === true
+    };
+  },
+  respond(decision) {
+    if (decision.kind === "inject") {
+      return {
+        stdout: `${JSON.stringify({ decision: "block", reason: decision.reason ?? "" })}
+`,
+        stderr: "",
+        exitCode: 0
+      };
+    }
+    if (decision.kind === "terminate") {
+      return {
+        stdout: "",
+        stderr: `${decision.reason ?? ""}
+`,
+        exitCode: 0
+      };
+    }
+    return { stdout: "", stderr: "", exitCode: 0 };
+  }
+};
+
+// src/stop-hook/adapters/codex.ts
+var codexAdapter = {
+  parseInput(stdin) {
+    const parsed = stdin.trim() === "" ? {} : JSON.parse(stdin);
+    return {
+      sessionId: typeof parsed.session_id === "string" ? parsed.session_id : "default",
+      stopHookActive: parsed.stop_hook_active === true
+    };
+  },
+  respond(decision) {
+    if (decision.kind === "inject") {
+      return {
+        stdout: `${JSON.stringify({ decision: "block", reason: decision.reason ?? "" })}
+`,
+        stderr: "",
+        exitCode: 0
+      };
+    }
+    if (decision.kind === "terminate") {
+      return {
+        stdout: "",
+        stderr: `${decision.reason ?? ""}
+`,
+        exitCode: 0
+      };
+    }
+    return { stdout: "", stderr: "", exitCode: 0 };
+  }
+};
+
+// src/stop-hook/adapters/opencode.ts
+var opencodeAdapter = {
+  parseInput(stdin) {
+    const parsed = stdin.trim() === "" ? {} : JSON.parse(stdin);
+    const sessionId = typeof parsed.sessionID === "string" ? parsed.sessionID : typeof parsed.session_id === "string" ? parsed.session_id : "default";
+    return { sessionId, stopHookActive: false };
+  },
+  respond(decision) {
+    if (decision.kind === "inject") {
+      return { stdout: "", stderr: `${decision.reason ?? ""}
+`, exitCode: 2 };
+    }
+    if (decision.kind === "terminate") {
+      return { stdout: "", stderr: `${decision.reason ?? ""}
+`, exitCode: 0 };
+    }
+    return { stdout: "", stderr: "", exitCode: 0 };
+  }
+};
+
+// src/stop-hook/adapters/index.ts
+var ADAPTERS = {
+  claude: claudeAdapter,
+  codex: codexAdapter,
+  opencode: opencodeAdapter
+};
+function getAdapter(engine) {
+  return ADAPTERS[engine];
+}
+
+// src/stop-hook/core.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
+
+// src/stop-hook/state.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync8, rmSync, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname6, join as join13 } from "path";
+import { z as z6 } from "zod";
+var LintStateSchema = z6.object({
+  attempts: z6.number().int().nonnegative(),
+  lastLintHash: z6.string(),
+  updatedAt: z6.string()
+});
+var STATE_DIR = ".harness/state";
+function safeSessionId(sessionId) {
+  return sessionId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 80) || "default";
+}
+function statePath(cwd, sessionId) {
+  return join13(cwd, STATE_DIR, `lint-${safeSessionId(sessionId)}.json`);
+}
+function readState(cwd, sessionId) {
+  const path = statePath(cwd, sessionId);
+  if (!existsSync11(path)) return null;
+  try {
+    const raw = JSON.parse(readFileSync8(path, "utf8"));
+    return LintStateSchema.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function writeState(cwd, sessionId, state) {
+  const path = statePath(cwd, sessionId);
+  mkdirSync3(dirname6(path), { recursive: true });
+  writeFileSync5(path, `${JSON.stringify(state, null, 2)}
+`);
+}
+function resetState(cwd, sessionId) {
+  const path = statePath(cwd, sessionId);
+  if (existsSync11(path)) rmSync(path, { force: true });
+}
+
+// src/stop-hook/types.ts
+var STOP_HOOK_ENGINES = ["claude", "codex", "opencode"];
+var DEFAULT_MAX_ATTEMPTS = 3;
+
+// src/stop-hook/core.ts
+function exhaustedReason(attempts, lintOutput) {
+  return `Harness lint: still failing after ${attempts} attempts.
+
+${lintOutput}`;
+}
+function noProgressReason(lintOutput) {
+  return `Harness lint: no progress between attempts.
+
+${lintOutput}`;
+}
+function hash(s) {
+  return createHash2("sha256").update(s).digest("hex").slice(0, 16);
+}
+function maxAttempts(env) {
+  const raw = env.HARNESS_LINT_MAX_ATTEMPTS;
+  if (!raw) return DEFAULT_MAX_ATTEMPTS;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : DEFAULT_MAX_ATTEMPTS;
+}
+function defaultGitStatus(cwd) {
+  try {
+    return execFileSync2("git", ["status", "--porcelain"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return "";
+  }
+}
+function defaultRunLint(cwd) {
+  const report = runLinters(cwd);
+  return { pass: report.summary.pass, output: formatReportText(report) };
+}
+function decide(payload, coreEnv) {
+  if (coreEnv.env.HARNESS_LINT_DISABLE === "1") {
+    return { kind: "passthrough" };
+  }
+  if (payload.stopHookActive) {
+    return { kind: "passthrough" };
+  }
+  const dirty = coreEnv.gitStatus(coreEnv.cwd);
+  if (dirty.trim() === "") {
+    resetState(coreEnv.cwd, payload.sessionId);
+    return { kind: "passthrough" };
+  }
+  const lintResult = coreEnv.runLint(coreEnv.cwd);
+  if (lintResult.pass) {
+    resetState(coreEnv.cwd, payload.sessionId);
+    return { kind: "passthrough" };
+  }
+  const lintHash = hash(lintResult.output);
+  const prev = readState(coreEnv.cwd, payload.sessionId);
+  if (prev && prev.attempts > 0 && prev.lastLintHash === lintHash) {
+    resetState(coreEnv.cwd, payload.sessionId);
+    return { kind: "terminate", reason: noProgressReason(lintResult.output) };
+  }
+  const nextAttempts = (prev?.attempts ?? 0) + 1;
+  const limit = maxAttempts(coreEnv.env);
+  if (nextAttempts > limit) {
+    resetState(coreEnv.cwd, payload.sessionId);
+    return { kind: "terminate", reason: exhaustedReason(limit, lintResult.output) };
+  }
+  writeState(coreEnv.cwd, payload.sessionId, {
+    attempts: nextAttempts,
+    lastLintHash: lintHash,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return { kind: "inject", reason: lintResult.output };
+}
+
+// src/cli/stop-hook.ts
+function readStdinSync() {
+  try {
+    return readFileSync9(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+function assertEngine(engine) {
+  if (!STOP_HOOK_ENGINES.includes(engine)) {
+    throw new Error(`unknown engine: ${engine} (expected one of ${STOP_HOOK_ENGINES.join(", ")})`);
+  }
+  return engine;
+}
+function stopHookCommand(args, stdin) {
+  const engine = assertEngine(args.engine);
+  const cwd = resolve5(args.cwd ?? ".");
+  const adapter = getAdapter(engine);
+  const payload = adapter.parseInput(stdin, process.env);
+  const decision = decide(payload, {
+    cwd,
+    env: process.env,
+    gitStatus: defaultGitStatus,
+    runLint: defaultRunLint
+  });
+  return adapter.respond(decision);
+}
+function stopHookCommandFromStdin(args) {
+  return stopHookCommand(args, readStdinSync());
+}
+
+// src/cli/update.ts
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { join as join16, resolve as resolve7 } from "path";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+
+// src/cli/update-manifest.ts
+import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
+import { join as join14 } from "path";
+import { z as z7 } from "zod";
+var EngineSchema = z7.enum(ENGINES);
+var LegacySchema = z7.object({
+  version: z7.enum(["1", "2", "3"]),
+  engine: EngineSchema.optional(),
+  engines: z7.array(EngineSchema).nonempty().optional(),
+  renderedAt: z7.string(),
+  files: z7.array(z7.string())
+});
+var HOOK_PATHS = {
+  "claude-code": [".claude/settings.json"],
+  "codex-cli": [".codex/hooks.json"],
+  opencode: [
+    ".opencode/plugins/harness-stop-hook/index.ts",
+    ".opencode/plugins/harness-stop-hook.ts"
+  ]
+};
+function readUpdateInstallation(root) {
+  assertManagedPaths(root, [MANIFEST_FILENAME]);
+  if (!existsSync12(join14(root, MANIFEST_FILENAME))) {
+    throw new Error("no harness manifest found; use init for a new installation");
+  }
+  const raw = JSON.parse(readFileSync10(join14(root, MANIFEST_FILENAME), "utf8"));
+  const sourceVersion = String(raw?.version);
+  let manifest;
+  if (["1", "2", "3"].includes(sourceVersion)) {
+    const legacy = LegacySchema.parse(raw);
+    const engines2 = legacy.version === "1" ? [EngineSchema.parse(legacy.engine)] : legacy.engines;
+    manifest = {
+      version: "4",
+      engines: z7.array(EngineSchema).nonempty().parse(engines2),
+      files: legacy.files,
+      renderedAt: legacy.renderedAt
+    };
+  } else {
+    const current = readManifest(root);
+    if (!current) throw new Error("harness manifest disappeared during planning");
+    manifest = current;
+  }
+  const engines = [...new Set(z7.array(EngineSchema).nonempty().parse(manifest.engines))];
+  const hookEngines = manifest.stopHookInstalled === false ? [] : manifest.stopHookEngines !== void 0 ? z7.array(EngineSchema).parse(manifest.stopHookEngines) : manifest.stopHookInstalled === true ? engines : engines.filter(
+    (engine) => HOOK_PATHS[engine].some((path) => manifest.files.includes(path))
+  );
+  if (hookEngines.some((engine) => !engines.includes(engine))) {
+    throw new Error("manifest stopHookEngines must be a subset of installed engines");
+  }
+  return { manifest, sourceVersion, engines, hookEngines: [...new Set(hookEngines)] };
+}
+
+// src/cli/update-transaction.ts
+import { createHash as createHash3, randomUUID } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  closeSync,
+  fsyncSync,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync4,
+  openSync,
+  readFileSync as readFileSync11,
+  readdirSync as readdirSync2,
+  realpathSync as realpathSync2,
+  rmdirSync as rmdirSync2,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync6
+} from "fs";
+import { homedir } from "os";
+import { basename as basename3, dirname as dirname7, isAbsolute as isAbsolute3, join as join15, relative as relative3, resolve as resolve6, sep } from "path";
+var MANIFEST_PATH = ".harness-manifest.json";
+var PRIVATE_FILES = /* @__PURE__ */ new Set([
+  MANIFEST_PATH,
+  ".mcp.json",
+  ".codex/config.toml",
+  ".codex/hooks.json",
+  ".claude/settings.json",
+  ".opencode/opencode.json",
+  ".opencode/mcp.json"
+]);
+function canonicalRoot(root) {
+  let ancestor = resolve6(root);
+  const missing = [];
+  while (!lstatSync2(ancestor, { throwIfNoEntry: false })) {
+    missing.unshift(basename3(ancestor));
+    ancestor = dirname7(ancestor);
+  }
+  return join15(realpathSync2(ancestor), ...missing);
+}
+function contains(parent, child) {
+  const path = relative3(parent, child);
+  return path === "" || !isAbsolute3(path) && path !== ".." && !path.startsWith(`..${sep}`);
+}
+function assertBackupLocation(root, backup) {
+  if (contains(root, backup) || contains(backup, root)) {
+    throw new Error(`update backup must be outside the target project: ${backup}`);
+  }
+  const ancestors = [];
+  for (let path = backup; ; path = dirname7(path)) {
+    ancestors.unshift(path);
+    if (dirname7(path) === path) break;
+  }
+  for (const path of ancestors) {
+    const info = lstatSync2(path, { throwIfNoEntry: false });
+    if (!info) continue;
+    if (info.isSymbolicLink() || !info.isDirectory()) {
+      throw new Error(`unsafe update backup directory: ${path}`);
+    }
+  }
+  if (lstatSync2(backup, { throwIfNoEntry: false })) {
+    throw new Error(`update backup directory already exists: ${backup}`);
+  }
+}
+function createDirectories(path, created, mode = 511) {
+  const missing = [];
+  for (let current = path; !lstatSync2(current, { throwIfNoEntry: false }); current = dirname7(current)) {
+    missing.unshift(current);
+  }
+  for (const directory of missing) {
+    mkdirSync4(directory, { mode });
+    created.push(directory);
+  }
+}
+function writeBackupFile(path, content) {
+  createDirectories(dirname7(path), [], 448);
+  const fd = openSync(path, "wx", 384);
+  try {
+    writeFileSync6(fd, content);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+function saveSnapshot(root, paths, backup) {
+  const entries = [];
+  createDirectories(dirname7(backup), [], 448);
+  mkdirSync4(backup, { mode: 448 });
+  for (const path of paths) {
+    const full = join15(root, path);
+    const info = lstatSync2(full, { throwIfNoEntry: false });
+    if (!info) {
+      entries.push({ path, exists: false });
+      continue;
+    }
+    const content = readFileSync11(full);
+    writeBackupFile(join15(backup, "files", path), content);
+    entries.push({
+      path,
+      exists: true,
+      mode: info.mode & 4095,
+      sha256: createHash3("sha256").update(content).digest("hex")
+    });
+  }
+  writeBackupFile(
+    join15(backup, "snapshot.json"),
+    `${JSON.stringify({ version: 1, root, createdAt: (/* @__PURE__ */ new Date()).toISOString(), entries }, null, 2)}
+`
+  );
+  return entries;
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function rollback(root, backup, entries, touched, createdDirectories) {
+  const errors = [];
+  for (const path of [...touched].reverse()) {
+    try {
+      assertManagedPaths(root, [path]);
+      const entry = entries.get(path);
+      const full = join15(root, path);
+      const current = lstatSync2(full, { throwIfNoEntry: false });
+      if (!entry?.exists) {
+        if (current) unlinkSync2(full);
+        continue;
+      }
+      const original = readFileSync11(join15(backup, "files", path));
+      if (!current || !readFileSync11(full).equals(original)) {
+        if (current) unlinkSync2(full);
+        writeFileSync6(full, original, { mode: 384 });
+      }
+      chmodSync2(full, entry.mode);
+    } catch (error) {
+      errors.push(`${path}: ${errorMessage(error)}`);
+    }
+  }
+  for (const directory of [...createdDirectories].reverse()) {
+    try {
+      if (readdirSync2(directory).length === 0) rmdirSync2(directory);
+    } catch (error) {
+      errors.push(`${directory}: ${errorMessage(error)}`);
+    }
+  }
+  return errors;
+}
+function applyUpdateTransaction(root, writes, removals, backupDir) {
+  const paths = [.../* @__PURE__ */ new Set([...removals, ...writes.map((file) => file.path)])];
+  assertManagedPaths(root, paths);
+  const target = canonicalRoot(root);
+  const backup = resolve6(
+    backupDir ?? join15(homedir(), ".local", "state", "vaubaan-harness", "backups", randomUUID())
+  );
+  assertBackupLocation(target, backup);
+  let snapshot;
+  try {
+    snapshot = saveSnapshot(target, paths, backup);
+  } catch (error) {
+    throw new Error(
+      `could not prepare update backup at ${backup}; project unchanged: ${errorMessage(error)}`,
+      { cause: error }
+    );
+  }
+  const entries = new Map(snapshot.map((entry) => [entry.path, entry]));
+  const touched = /* @__PURE__ */ new Set();
+  const createdDirectories = [];
+  try {
+    assertManagedPaths(target, paths);
+    for (const path of removals) {
+      if (!lstatSync2(join15(target, path), { throwIfNoEntry: false })) continue;
+      touched.add(path);
+      unlinkSync2(join15(target, path));
+    }
+    for (const file of writes) {
+      const full = join15(target, file.path);
+      createDirectories(dirname7(full), createdDirectories);
+      touched.add(file.path);
+      const entry = entries.get(file.path);
+      const mode = file.path === MANIFEST_PATH ? 384 : entry?.exists ? entry.mode : PRIVATE_FILES.has(file.path) ? 384 : 420;
+      if (entry?.exists && file.path === MANIFEST_PATH) chmodSync2(full, mode);
+      writeFileSync6(full, file.content, { mode });
+      if (entry?.exists) chmodSync2(full, mode);
+    }
+  } catch (error) {
+    const failures = rollback(target, backup, entries, touched, createdDirectories);
+    const restoration = failures.length > 0 ? `rollback errors: ${failures.join("; ")}` : "rollback completed";
+    throw new Error(`update failed; backup: ${backup}; ${restoration}: ${errorMessage(error)}`, {
+      cause: error
+    });
+  }
+  return { backupDir: backup };
+}
+
+// src/cli/update.ts
+function currentContent(root, path) {
+  return existsSync13(join16(root, path)) ? readFileSync12(join16(root, path), "utf8") : void 0;
+}
+function checkArtifactConflicts(root, previous, writes, removals) {
+  const desired = new Map(writes.map((file) => [file.path, file.content]));
+  for (const path of [...desired.keys(), ...removals]) {
+    if (SHARED_CONFIG_PATHS.includes(path)) continue;
+    const content = currentContent(root, path);
+    if (content === void 0) continue;
+    if (!previous.files.includes(path)) {
+      throw new Error(
+        `existing file outside harness manifest: ${path}; use overrides or --preserve`
+      );
+    }
+    const hash2 = previous.fileHashes?.[path];
+    if (hash2 && hash2 !== hashContent(content) && content !== desired.get(path)) {
+      throw new Error(`modified harness file: ${path}; move edits to overrides or use --preserve`);
+    }
+  }
+}
+function planUpdate(args) {
+  const root = resolve7(args.targetDir);
+  const { manifest: previous, sourceVersion, engines, hookEngines } = readUpdateInstallation(root);
+  const preserved = [
+    .../* @__PURE__ */ new Set([...previous.preservedFiles ?? [], ...args.preserveFiles ?? []])
+  ].sort();
+  if (preserved.includes(MANIFEST_FILENAME))
+    throw new Error("cannot preserve the harness manifest");
+  if (preserved.some((path) => SHARED_CONFIG_PATHS.includes(path))) {
+    throw new Error(
+      "--preserve applies to generated artifacts; shared configurations use entry-level preservation"
+    );
+  }
+  assertManagedPaths(root, [...previous.files, ...preserved, ...SHARED_CONFIG_PATHS]);
+  const requestedOverrides = args.overridesDir ?? previous.overridesDir;
+  const overridesDir = args.overridesDir ? resolve7(args.overridesDir) : previous.overridesDir ? resolve7(root, previous.overridesDir) : root;
+  if (requestedOverrides && !existsSync13(join16(overridesDir, ".harness-overrides"))) {
+    throw new Error(`recorded overrides are missing: ${overridesDir}/.harness-overrides`);
+  }
+  const hasOverrides = existsSync13(join16(overridesDir, ".harness-overrides"));
+  const disablePath = join16(overridesDir, ".harness-overrides", "disable.yaml");
+  if (existsSync13(disablePath)) {
+    try {
+      DisableYamlSchema.parse(parseYAML(readFileSync12(disablePath, "utf8")));
+    } catch {
+      throw new Error(`invalid override selection: ${disablePath}`);
+    }
+  }
+  const rendered = planInit({
+    targetDir: root,
+    packageDir: args.packageDir,
+    engines,
+    overridesDir: hasOverrides ? overridesDir : void 0,
+    withStopHook: false
+  });
+  const config = planUpdateConfigs(root, previous, hookEngines);
+  const output = [...rendered.output.files, ...config.writes].filter(
+    (file) => !preserved.includes(file.path)
+  );
+  const owned = [
+    .../* @__PURE__ */ new Set([...rendered.output.files.map((file) => file.path), ...config.ownedFiles])
+  ].filter((file) => !preserved.includes(file)).sort();
+  const removals = [
+    .../* @__PURE__ */ new Set([
+      ...previous.files.filter(
+        (file) => !owned.includes(file) && !SHARED_CONFIG_PATHS.includes(file)
+      ),
+      ...config.removals
+    ])
+  ].filter((file) => !preserved.includes(file));
+  assertManagedPaths(root, [...output.map((file) => file.path), ...removals]);
+  checkArtifactConflicts(root, previous, output, removals);
+  const hashes = Object.fromEntries(
+    owned.map((path) => {
+      const content = output.find((file) => file.path === path)?.content ?? currentContent(root, path);
+      if (content === void 0) throw new Error(`missing planned harness file: ${path}`);
+      return [path, hashContent(content)];
+    })
+  );
+  const manifest = {
+    version: MANIFEST_VERSION,
+    harnessVersion: VERSION,
+    engines: [...engines].sort(),
+    renderedAt: previous.renderedAt,
+    files: owned,
+    fileHashes: hashes,
+    stopHookInstalled: hookEngines.length > 0,
+    stopHookEngines: [...hookEngines].sort(),
+    ...hasOverrides ? { overridesDir: overridesDir === root ? "." : overridesDir } : {},
+    ...preserved.length ? { preservedFiles: preserved } : {},
+    ...config.opencodeConfig ? { opencodeConfig: config.opencodeConfig } : {},
+    ...config.hookConfigs ? { hookConfigs: config.hookConfigs } : {}
+  };
+  const writes = output.filter((file) => currentContent(root, file.path) !== file.content);
+  const existingRemovals = removals.filter((path) => existsSync13(join16(root, path)));
+  if (writes.length || existingRemovals.length || !isDeepStrictEqual3(previous, manifest)) {
+    manifest.renderedAt = (/* @__PURE__ */ new Date()).toISOString();
+    writes.push({ path: MANIFEST_FILENAME, content: `${JSON.stringify(manifest, null, 2)}
+` });
+  }
+  const warnings = [...rendered.output.warnings, ...config.warnings];
+  if (!previous.fileHashes) {
+    warnings.push(
+      "legacy manifest has no file fingerprints: managed artifacts will be regenerated; backup preserves their previous contents"
+    );
+  }
+  if (preserved.length) warnings.push(`preserved user-owned artifacts: ${preserved.join(", ")}`);
+  if (engines.includes("codex-cli"))
+    warnings.push("ensure .agents/ is ignored by Git (run harness check)");
+  return {
+    writes,
+    removals: existingRemovals,
+    result: {
+      version: VERSION,
+      fromManifestVersion: sourceVersion,
+      dryRun: args.dryRun === true,
+      upToDate: writes.length === 0 && existingRemovals.length === 0,
+      filesToWrite: writes.map((file) => file.path),
+      filesToRemove: existingRemovals,
+      warnings
+    }
+  };
+}
+function updateCommand(args) {
+  const plan = planUpdate(args);
+  if (args.dryRun || plan.result.upToDate) return plan.result;
+  const { backupDir } = applyUpdateTransaction(
+    resolve7(args.targetDir),
+    plan.writes,
+    plan.removals,
+    args.backupDir
+  );
+  return { ...plan.result, backupDir };
+}
+
+// src/cli/index.ts
+function resolvePackageDir() {
+  const here = dirname8(fileURLToPath2(import.meta.url));
+  return resolve8(here, "..");
+}
+var program = new Command();
+program.name("vaubaan-harness").description(
+  "Vaubaan harness \u2014 render skills, commands, and all agent personas into a target directory"
+).version(VERSION);
+program.command("init").description(
+  "Render the harness (all agents, skills, commands) into a target directory. Defaults to all engines."
+).argument("<target-dir>", "directory to render harness into").option(
+  "--engines <list>",
+  "comma-separated subset of engines (claude-code, codex-cli, opencode) \u2014 defaults to all 3"
+).option("--overrides-dir <dir>", "directory containing .harness-overrides/").option("--package-dir <dir>", "override harness package directory (for dev/test)").option(
+  "--with-mcp <list>",
+  "comma-separated MCP servers to render config for (context7) \u2014 opt-in"
+).option(
+  "--no-stop-hook",
+  "skip rendering the Stop-hook configs that run lint at end of each agent turn"
+).action((targetDir, opts) => {
+  const packageDir = opts.packageDir ?? resolvePackageDir();
+  const enginesRaw = opts.engines;
+  const engines = enginesRaw ? enginesRaw.split(",").map((s) => s.trim()) : void 0;
+  const withMcpRaw = opts.withMcp;
+  const mcpServers = withMcpRaw ? withMcpRaw.split(",").map((s) => s.trim()) : void 0;
+  const result = initCommand({
+    targetDir,
+    engines,
+    overridesDir: opts.overridesDir,
+    packageDir,
+    mcpServers,
+    withStopHook: opts.stopHook !== false
+  });
+  process.stdout.write(`rendered ${result.filesWritten.length} files to ${targetDir}
+`);
+  if (result.staleFilesRemoved.length > 0) {
+    process.stdout.write(
+      `removed ${result.staleFilesRemoved.length} stale files from a previous render
+`
+    );
+  }
+  if (result.stopHookInstalled) {
+    process.stdout.write("stop-hook installed (runs lint at end-of-turn)\n");
+    if (result.filesWritten.includes(".codex/hooks.json")) {
+      process.stdout.write(
+        "codex: the hook runs once you trust this project and approve the hook (startup review or /hooks)\n"
+      );
+    }
+  }
+  for (const w of result.warnings) process.stderr.write(`warning: ${w}
+`);
+});
+program.command("update").description(
+  "Migrate an existing harness installation, retaining its engines and project settings"
+).argument("[target-dir]", "project directory", ".").option("--dry-run", "preview changes without writing files or backups").option("--json", "print the migration summary as JSON").option("--backup-dir <dir>", "new backup directory outside the project").option("--overrides-dir <dir>", "directory containing .harness-overrides/").option("--preserve <paths>", "comma-separated generated files to leave under user ownership").action((targetDir, opts) => {
+  const result = updateCommand({
+    targetDir,
+    packageDir: resolvePackageDir(),
+    dryRun: opts.dryRun === true,
+    backupDir: opts.backupDir,
+    overridesDir: opts.overridesDir,
+    preserveFiles: opts.preserve?.split(",").map((path) => path.trim())
+  });
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    return;
+  }
+  if (result.upToDate) process.stdout.write(`harness ${VERSION}: already up to date
+`);
+  else
+    process.stdout.write(
+      `${result.dryRun ? "preview" : "updated"}: ${result.filesToWrite.length} writes, ${result.filesToRemove.length} removals (harness ${VERSION})
+`
+    );
+  if (result.backupDir) process.stdout.write(`backup: ${result.backupDir}
+`);
+  for (const warning of result.warnings) process.stderr.write(`warning: ${warning}
+`);
+});
+program.command("uninstall").description("Remove all files previously written by `init` into a target directory").argument("<target-dir>", "directory to uninstall harness from").action((targetDir) => {
+  const result = uninstallCommand({ targetDir });
+  process.stdout.write(
+    `removed ${result.filesRemoved.length} files and ${result.dirsPruned.length} empty dirs from ${targetDir}
+`
+  );
+  for (const w of result.warnings) process.stderr.write(`warning: ${w}
+`);
+});
+program.command("check").description("Verify repo layout: 6 pillars present and .gitignore correct").argument("<repo>", "path to repo to check").action((repo) => {
+  const result = checkCommand(repo);
+  if (result.pass) {
+    process.stdout.write("\u2714 layout OK\n");
+    process.exit(0);
+  }
+  for (const issue of result.issues) process.stdout.write(`\u2718 ${issue}
+`);
+  process.exit(1);
+});
+program.command("lint").description("Run all mechanical linters and exit non-zero on errors").option(
+  "--pillar <pillar>",
+  "filter by pillar (spec, decisions, handbook, tests, workflow, quality)"
+).option("--format <fmt>", "text | json", "text").option("--cwd <dir>", "repo root", ".").action((opts) => {
+  const repoRoot = resolve8(opts.cwd ?? ".");
+  const lintOpts = opts.pillar ? { pillar: opts.pillar } : {};
+  const report = runLinters(repoRoot, lintOpts);
+  if (opts.format === "json") {
+    process.stdout.write(`${JSON.stringify(report, null, 2)}
+`);
+  } else {
+    process.stdout.write(`${formatReportText(report)}
+`);
+  }
+  process.exit(report.summary.pass ? 0 : 1);
+});
+program.command("render").description("Render harness for preview (no overrides applied). Defaults to all engines.").option(
+  "--engines <list>",
+  "comma-separated subset of engines (claude-code, codex-cli, opencode) \u2014 defaults to all 3"
+).requiredOption("--out <dir>", "output directory").option("--package-dir <dir>", "override harness package directory").option(
+  "--with-mcp <list>",
+  "comma-separated MCP servers to render config for (context7) \u2014 opt-in"
+).option("--no-stop-hook", "skip rendering the Stop-hook configs").action((opts) => {
+  const packageDir = opts.packageDir ?? resolvePackageDir();
+  const enginesRaw = opts.engines;
+  const engines = enginesRaw ? enginesRaw.split(",").map((s) => s.trim()) : void 0;
+  const withMcpRaw = opts.withMcp;
+  const mcpServers = withMcpRaw ? withMcpRaw.split(",").map((s) => s.trim()) : void 0;
+  const result = renderCommand({
+    engines,
+    outDir: opts.out,
+    packageDir,
+    mcpServers,
+    withStopHook: opts.stopHook !== false
+  });
+  process.stdout.write(`rendered ${result.filesWritten.length} files to ${opts.out}
+`);
+  for (const w of result.warnings) process.stderr.write(`warning: ${w}
+`);
+});
+program.command("stop-hook").description(
+  "Stop-hook entrypoint invoked by each engine's hook config \u2014 runs lint and decides whether to inject the report into the running session, terminate, or passthrough"
+).requiredOption("--engine <engine>", "claude | codex | opencode").option("--cwd <dir>", "repo root", ".").action((opts) => {
+  const result = stopHookCommandFromStdin({
+    engine: opts.engine,
+    cwd: opts.cwd
+  });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  process.exit(result.exitCode);
+});
+program.parseAsync(process.argv).catch((err) => {
+  process.stderr.write(`error: ${err instanceof Error ? err.message : String(err)}
+`);
+  process.exit(1);
+});
+//# sourceMappingURL=index.js.map