codeharness 0.25.1 → 0.25.3

package/dist/chunk-WABTXRJD.js

@@ -0,0 +1,3702 @@
+#!/usr/bin/env node
+
+// src/lib/docker/health.ts
+import { execFileSync } from "child_process";
+function isDockerAvailable() {
+  try {
+    execFileSync("docker", ["--version"], { stdio: "pipe", timeout: 1e4 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isDockerComposeAvailable() {
+  try {
+    execFileSync("docker", ["compose", "version"], { stdio: "pipe", timeout: 1e4 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getStackHealth(composeFile, projectName) {
+  const expectedServices = ["victoria-logs", "victoria-metrics", "victoria-traces", "otel-collector"];
+  try {
+    const args = projectName ? ["compose", "-p", projectName, "-f", composeFile, "ps", "--format", "json"] : ["compose", "-f", composeFile, "ps", "--format", "json"];
+    const output = execFileSync("docker", args, {
+      stdio: "pipe",
+      timeout: 15e3
+    });
+    const text = output.toString().trim();
+    const runningNames = /* @__PURE__ */ new Set();
+    if (text) {
+      const lines = text.split("\n").filter((l) => l.trim());
+      for (const line of lines) {
+        const svc = JSON.parse(line);
+        if (svc.State === "running" && svc.Service) {
+          runningNames.add(svc.Service);
+        }
+      }
+    }
+    const services = expectedServices.map((name) => ({
+      name,
+      running: runningNames.has(name)
+    }));
+    const healthy = services.every((s) => s.running);
+    const remedyCmd = projectName ? `docker compose -p ${projectName} -f ${composeFile} up -d` : `docker compose -f ${composeFile} up -d`;
+    return {
+      healthy,
+      services,
+      remedy: healthy ? void 0 : `Restart: ${remedyCmd}`
+    };
+  } catch {
+    const remedyCmd = projectName ? `docker compose -p ${projectName} -f ${composeFile} up -d` : `docker compose -f ${composeFile} up -d`;
+    const services = expectedServices.map((name) => ({
+      name,
+      running: false
+    }));
+    return {
+      healthy: false,
+      services,
+      remedy: `Restart: ${remedyCmd}`
+    };
+  }
+}
+function getCollectorHealth(composeFile) {
+  const expectedServices = ["otel-collector"];
+  try {
+    const output = execFileSync("docker", ["compose", "-p", "codeharness-collector", "-f", composeFile, "ps", "--format", "json"], {
+      stdio: "pipe",
+      timeout: 15e3
+    });
+    const text = output.toString().trim();
+    const runningNames = /* @__PURE__ */ new Set();
+    if (text) {
+      const lines = text.split("\n").filter((l) => l.trim());
+      for (const line of lines) {
+        const svc = JSON.parse(line);
+        if (svc.State === "running" && svc.Service) {
+          runningNames.add(svc.Service);
+        }
+      }
+    }
+    const services = expectedServices.map((name) => ({
+      name,
+      running: runningNames.has(name)
+    }));
+    const healthy = services.every((s) => s.running);
+    return {
+      healthy,
+      services,
+      remedy: healthy ? void 0 : `Restart: docker compose -p codeharness-collector -f ${composeFile} up -d`
+    };
+  } catch {
+    const services = expectedServices.map((name) => ({
+      name,
+      running: false
+    }));
+    return {
+      healthy: false,
+      services,
+      remedy: `Restart: docker compose -p codeharness-collector -f ${composeFile} up -d`
+    };
+  }
+}
+async function checkRemoteEndpoint(url) {
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5e3);
+    try {
+      await fetch(url, { signal: controller.signal });
+      return { reachable: true };
+    } finally {
+      clearTimeout(timeout);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { reachable: false, error: message };
+  }
+}
+
+// src/lib/docker/compose.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { writeFileSync as writeFileSync2 } from "fs";
+
+// src/lib/stack-path.ts
+import { homedir } from "os";
+import { join, isAbsolute } from "path";
+import { mkdirSync } from "fs";
+function getStackDir() {
+  const xdgDataHome = process.env["XDG_DATA_HOME"];
+  if (xdgDataHome && xdgDataHome.trim() !== "" && isAbsolute(xdgDataHome)) {
+    return join(xdgDataHome, "codeharness", "stack");
+  }
+  return join(homedir(), ".codeharness", "stack");
+}
+function getComposeFilePath() {
+  return join(getStackDir(), "docker-compose.harness.yml");
+}
+function getElkComposeFilePath() {
+  return join(getStackDir(), "docker-compose.elk.yml");
+}
+function getOtelConfigPath() {
+  return join(getStackDir(), "otel-collector-config.yaml");
+}
+function ensureStackDir() {
+  mkdirSync(getStackDir(), { recursive: true });
+}
+
+// src/lib/templates.ts
+import { mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { fileURLToPath } from "url";
+var __dirname = dirname(fileURLToPath(import.meta.url));
+function getPackageRoot() {
+  if (__dirname.endsWith("/src/lib") || __dirname.endsWith("\\src\\lib")) {
+    return resolve(__dirname, "..", "..");
+  }
+  return resolve(__dirname, "..");
+}
+function generateFile(targetPath, content) {
+  mkdirSync2(dirname(targetPath), { recursive: true });
+  writeFileSync(targetPath, content, "utf-8");
+}
+function renderTemplate(template, vars) {
+  return template.replace(/\{\{(\w+)\}\}/g, (match, key) => vars[key] ?? match);
+}
+function renderTemplateFile(templatePath, vars = {}) {
+  const fullPath = resolve(getPackageRoot(), templatePath);
+  const content = readFileSync(fullPath, "utf-8");
+  if (Object.keys(vars).length === 0) return content;
+  return renderTemplate(content, vars);
+}
+
+// src/templates/docker-compose.ts
+function dockerComposeCollectorOnlyTemplate() {
+  return renderTemplateFile("templates/compose/collector-only.yml");
+}
+function dockerComposeTemplate(_config) {
+  return renderTemplateFile("templates/compose/victoria.yml");
+}
+
+// src/templates/otel-config.ts
+function otelCollectorRemoteTemplate(config) {
+  const logsUrl = config.logsUrl.replace(/\/+$/, "");
+  const metricsUrl = config.metricsUrl.replace(/\/+$/, "");
+  const tracesUrl = config.tracesUrl.replace(/\/+$/, "");
+  return renderTemplateFile("templates/compose/otel-collector-remote.yaml", {
+    LOGS_URL: logsUrl,
+    METRICS_URL: metricsUrl,
+    TRACES_URL: tracesUrl
+  });
+}
+function otelCollectorConfigTemplate() {
+  return renderTemplateFile("templates/compose/otel-collector-base.yaml");
+}
+
+// src/lib/docker/compose.ts
+function isStackRunning(composeFile) {
+  try {
+    const output = execFileSync2("docker", ["compose", "-f", composeFile, "ps", "--format", "json"], {
+      stdio: "pipe",
+      timeout: 15e3
+    });
+    const text = output.toString().trim();
+    if (!text) return false;
+    const lines = text.split("\n").filter((l) => l.trim());
+    for (const line of lines) {
+      const svc = JSON.parse(line);
+      if (svc.State !== "running") return false;
+    }
+    return lines.length > 0;
+  } catch {
+    return false;
+  }
+}
+function isSharedStackRunning() {
+  try {
+    const composeFile = getComposeFilePath();
+    const output = execFileSync2("docker", ["compose", "-p", "codeharness-shared", "-f", composeFile, "ps", "--format", "json"], {
+      stdio: "pipe",
+      timeout: 15e3
+    });
+    const text = output.toString().trim();
+    if (!text) return false;
+    const lines = text.split("\n").filter((l) => l.trim());
+    for (const line of lines) {
+      const svc = JSON.parse(line);
+      if (svc.State !== "running") return false;
+    }
+    return lines.length > 0;
+  } catch {
+    return false;
+  }
+}
+function startStack(composeFile) {
+  try {
+    execFileSync2("docker", ["compose", "-f", composeFile, "up", "-d"], {
+      stdio: "pipe",
+      timeout: 3e4
+    });
+    const services = getRunningServices(composeFile);
+    return {
+      started: true,
+      services
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      started: false,
+      services: [],
+      error: message
+    };
+  }
+}
+function startSharedStack() {
+  try {
+    ensureStackDir();
+    const composeFile = getComposeFilePath();
+    const otelConfigFile = getOtelConfigPath();
+    const composeContent = dockerComposeTemplate({ shared: true });
+    writeFileSync2(composeFile, composeContent, "utf-8");
+    const otelContent = otelCollectorConfigTemplate();
+    writeFileSync2(otelConfigFile, otelContent, "utf-8");
+    execFileSync2("docker", ["compose", "-p", "codeharness-shared", "-f", composeFile, "up", "-d"], {
+      stdio: "pipe",
+      timeout: 3e4
+    });
+    const services = getRunningServices(composeFile, "codeharness-shared");
+    return {
+      started: true,
+      services
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      started: false,
+      services: [],
+      error: message
+    };
+  }
+}
+function stopStack(composeFile) {
+  execFileSync2("docker", ["compose", "-f", composeFile, "down", "-v"], {
+    stdio: "pipe",
+    timeout: 3e4
+  });
+}
+function stopSharedStack() {
+  const composeFile = getComposeFilePath();
+  execFileSync2("docker", ["compose", "-p", "codeharness-shared", "-f", composeFile, "down"], {
+    stdio: "pipe",
+    timeout: 3e4
+  });
+}
+function startCollectorOnly(logsUrl, metricsUrl, tracesUrl) {
+  try {
+    ensureStackDir();
+    const composeFile = getComposeFilePath();
+    const otelConfigFile = getOtelConfigPath();
+    const composeContent = dockerComposeCollectorOnlyTemplate();
+    writeFileSync2(composeFile, composeContent, "utf-8");
+    const otelContent = otelCollectorRemoteTemplate({ logsUrl, metricsUrl, tracesUrl });
+    writeFileSync2(otelConfigFile, otelContent, "utf-8");
+    execFileSync2("docker", ["compose", "-p", "codeharness-collector", "-f", composeFile, "up", "-d"], {
+      stdio: "pipe",
+      timeout: 3e4
+    });
+    const services = getRunningServices(composeFile, "codeharness-collector");
+    return {
+      started: true,
+      services
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      started: false,
+      services: [],
+      error: message
+    };
+  }
+}
+function isCollectorRunning() {
+  try {
+    const composeFile = getComposeFilePath();
+    const output = execFileSync2("docker", ["compose", "-p", "codeharness-collector", "-f", composeFile, "ps", "--format", "json"], {
+      stdio: "pipe",
+      timeout: 15e3
+    });
+    const text = output.toString().trim();
+    if (!text) return false;
+    const lines = text.split("\n").filter((l) => l.trim());
+    for (const line of lines) {
+      const svc = JSON.parse(line);
+      if (svc.State !== "running") return false;
+    }
+    return lines.length > 0;
+  } catch {
+    return false;
+  }
+}
+function stopCollectorOnly() {
+  const composeFile = getComposeFilePath();
+  execFileSync2("docker", ["compose", "-p", "codeharness-collector", "-f", composeFile, "down"], {
+    stdio: "pipe",
+    timeout: 3e4
+  });
+}
+function getRunningServices(composeFile, projectName) {
+  try {
+    const args = projectName ? ["compose", "-p", projectName, "-f", composeFile, "ps", "--format", "json"] : ["compose", "-f", composeFile, "ps", "--format", "json"];
+    const output = execFileSync2("docker", args, {
+      stdio: "pipe",
+      timeout: 15e3
+    });
+    const text = output.toString().trim();
+    if (!text) return [];
+    const lines = text.split("\n").filter((l) => l.trim());
+    const services = [];
+    for (const line of lines) {
+      const svc = JSON.parse(line);
+      const ports = (svc.Publishers ?? []).filter((p) => p.PublishedPort && p.PublishedPort > 0).map((p) => String(p.PublishedPort));
+      services.push({
+        name: svc.Service ?? "unknown",
+        status: svc.State ?? "unknown",
+        port: ports.join(",")
+      });
+    }
+    return services;
+  } catch {
+    return [];
+  }
+}
+
+// src/modules/infra/init-project.ts
+import { existsSync as existsSync14 } from "fs";
+import { basename as basename3, join as join15 } from "path";
+
+// src/lib/output.ts
+function ok(message, options) {
+  if (options?.json) {
+    jsonOutput({ status: "ok", message });
+    return;
+  }
+  console.log(`[OK] ${message}`);
+}
+function fail(message, options) {
+  if (options?.json) {
+    jsonOutput({ status: "fail", message });
+    return;
+  }
+  console.log(`[FAIL] ${message}`);
+}
+function warn(message, options) {
+  if (options?.json) {
+    jsonOutput({ status: "warn", message });
+    return;
+  }
+  console.log(`[WARN] ${message}`);
+}
+function info(message, options) {
+  if (options?.json) {
+    jsonOutput({ status: "info", message });
+    return;
+  }
+  console.log(`[INFO] ${message}`);
+}
+function jsonOutput(data) {
+  console.log(JSON.stringify(data));
+}
+
+// src/lib/stacks/registry.ts
+import { existsSync, readdirSync } from "fs";
+import { join as join2 } from "path";
+var providers = /* @__PURE__ */ new Map();
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "target",
+  "__pycache__",
+  "dist",
+  "build",
+  "coverage",
+  ".venv",
+  "venv",
+  ".tox",
+  ".mypy_cache",
+  ".cache"
+]);
+var STACK_PRIORITY = ["nodejs", "python", "rust"];
+function registerProvider(provider) {
+  providers.set(provider.name, provider);
+}
+function getStackProvider(name) {
+  return providers.get(name);
+}
+function detectStacks(dir = process.cwd()) {
+  const results = [];
+  const ordered = getOrderedProviders();
+  for (const provider of ordered) {
+    if (hasMarker(dir, provider.markers)) {
+      results.push({ stack: provider.name, dir: "." });
+    }
+  }
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch (_err) {
+    entries = [];
+  }
+  const subdirs = entries.filter((e) => e.isDirectory() && !SKIP_DIRS.has(e.name)).map((e) => e.name).sort();
+  for (const subdir of subdirs) {
+    const subdirPath = join2(dir, subdir);
+    for (const provider of ordered) {
+      if (hasMarker(subdirPath, provider.markers)) {
+        results.push({ stack: provider.name, dir: subdir });
+      }
+    }
+  }
+  return results;
+}
+function detectStack(dir = process.cwd()) {
+  const stacks = detectStacks(dir);
+  const rootStack = stacks.find((s) => s.dir === ".");
+  return rootStack ? rootStack.stack : null;
+}
+function hasMarker(dir, markers) {
+  return markers.some((marker) => existsSync(join2(dir, marker)));
+}
+function getOrderedProviders() {
+  const ordered = [];
+  for (const name of STACK_PRIORITY) {
+    const p = providers.get(name);
+    if (p) ordered.push(p);
+  }
+  for (const [name, provider] of providers) {
+    if (!STACK_PRIORITY.includes(name)) {
+      ordered.push(provider);
+    }
+  }
+  return ordered;
+}
+
+// src/lib/stacks/nodejs.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4 } from "path";
+
+// src/lib/stacks/utils.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+function readJsonSafe(path) {
+  try {
+    if (!existsSync2(path)) return null;
+    return JSON.parse(readFileSync2(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function readTextSafe(path) {
+  try {
+    if (!existsSync2(path)) return null;
+    return readFileSync2(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function getNodeDeps(pkg) {
+  const deps = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "devDependencies"]) {
+    const section = pkg[field];
+    if (section && typeof section === "object") {
+      for (const key of Object.keys(section)) {
+        deps.add(key);
+      }
+    }
+  }
+  return deps;
+}
+function getPythonDepsContent(dir) {
+  const files = ["requirements.txt", "pyproject.toml", "setup.py"];
+  const parts = [];
+  for (const file of files) {
+    const content = readTextSafe(join3(dir, file));
+    if (content) parts.push(content);
+  }
+  return parts.join("\n");
+}
+function hasPythonDep(content, dep) {
+  const escaped = dep.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pattern = new RegExp(`(?:^|[\\s"',])${escaped}(?:[\\[>=<~!;\\s"',]|$)`, "m");
+  return pattern.test(content);
+}
+function getCargoDepsSection(content) {
+  const match = content.match(/^\[dependencies\]\s*$/m);
+  if (!match || match.index === void 0) return "";
+  const start = match.index + match[0].length;
+  const nextSection = content.slice(start).search(/^\[/m);
+  return nextSection === -1 ? content.slice(start) : content.slice(start, start + nextSection);
+}
+function hasCargoDep(depsSection, dep) {
+  const escaped = dep.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pattern = new RegExp(`(?:^|\\s)${escaped}(?:\\s*=|\\s*\\{)`, "m");
+  return pattern.test(depsSection);
+}
+
+// src/lib/stacks/nodejs.ts
+var AGENT_DEPS = [
+  "anthropic",
+  "@anthropic-ai/sdk",
+  "openai",
+  "langchain",
+  "@langchain/core",
+  "llamaindex"
+];
+var WEB_FRAMEWORK_DEPS = [
+  "react",
+  "vue",
+  "svelte",
+  "angular",
+  "@angular/core",
+  "next",
+  "nuxt",
+  "vite",
+  "webpack"
+];
+var NODE_OTLP_PACKAGES = [
+  "@opentelemetry/auto-instrumentations-node",
+  "@opentelemetry/sdk-node",
+  "@opentelemetry/exporter-trace-otlp-http",
+  "@opentelemetry/exporter-metrics-otlp-http"
+];
+var NODE_REQUIRE_FLAG = "--require @opentelemetry/auto-instrumentations-node/register";
+var NodejsProvider = class {
+  name = "nodejs";
+  markers = ["package.json"];
+  displayName = "Node.js (package.json)";
+  // ── Task 1: detectAppType ──────────────────────────────────────────────
+  detectAppType(dir) {
+    const pkg = readJsonSafe(join4(dir, "package.json"));
+    if (!pkg) return "generic";
+    const deps = getNodeDeps(pkg);
+    if (AGENT_DEPS.some((d) => deps.has(d))) {
+      return "agent";
+    }
+    if (WEB_FRAMEWORK_DEPS.some((d) => deps.has(d))) {
+      return "web";
+    }
+    if (existsSync3(join4(dir, "index.html")) || existsSync3(join4(dir, "public", "index.html")) || existsSync3(join4(dir, "src", "index.html"))) {
+      return "web";
+    }
+    const bin = pkg["bin"];
+    const scripts = pkg["scripts"];
+    const hasStart = scripts?.["start"] !== void 0;
+    if (bin && !hasStart) {
+      return "cli";
+    }
+    if (hasStart) {
+      return "server";
+    }
+    return "generic";
+  }
+  // ── Task 2: getCoverageTool ────────────────────────────────────────────
+  getCoverageTool() {
+    return "c8";
+  }
+  // ── Task 3: detectCoverageConfig ───────────────────────────────────────
+  detectCoverageConfig(dir) {
+    const vitestConfigTs = join4(dir, "vitest.config.ts");
+    const vitestConfigJs = join4(dir, "vitest.config.js");
+    const hasVitestConfig = existsSync3(vitestConfigTs) || existsSync3(vitestConfigJs);
+    const pkg = readJsonSafe(join4(dir, "package.json"));
+    let hasVitestCoverageV8 = false;
+    let hasVitestCoverageIstanbul = false;
+    let hasC8 = false;
+    let hasJest = false;
+    if (pkg) {
+      const allDeps = getNodeDeps(pkg);
+      hasVitestCoverageV8 = allDeps.has("@vitest/coverage-v8");
+      hasVitestCoverageIstanbul = allDeps.has("@vitest/coverage-istanbul");
+      hasC8 = allDeps.has("c8");
+      hasJest = allDeps.has("jest");
+    }
+    if (hasVitestConfig || hasVitestCoverageV8 || hasVitestCoverageIstanbul) {
+      const configFile = existsSync3(vitestConfigTs) ? vitestConfigTs : existsSync3(vitestConfigJs) ? vitestConfigJs : void 0;
+      return { tool: "c8", configFile };
+    }
+    if (hasC8) {
+      return { tool: "c8" };
+    }
+    if (hasJest) {
+      return { tool: "c8" };
+    }
+    return { tool: "none" };
+  }
+  // ── Task 4: getOtlpPackages ────────────────────────────────────────────
+  getOtlpPackages() {
+    return [...NODE_OTLP_PACKAGES];
+  }
+  // ── Task 5: installOtlp ───────────────────────────────────────────────
+  installOtlp(dir) {
+    try {
+      execFileSync3("npm", ["install", ...NODE_OTLP_PACKAGES], {
+        cwd: dir,
+        stdio: "pipe",
+        timeout: 3e5
+      });
+      return {
+        success: true,
+        packagesInstalled: [...NODE_OTLP_PACKAGES]
+      };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Unknown error";
+      return {
+        success: false,
+        packagesInstalled: [],
+        error: `Failed to install Node.js OTLP packages: ${message.length > 200 ? message.slice(0, 200) + "... (truncated)" : message}`
+      };
+    }
+  }
+  // ── Task 6: patchStartScript ──────────────────────────────────────────
+  patchStartScript(dir) {
+    const pkgPath = join4(dir, "package.json");
+    if (!existsSync3(pkgPath)) return false;
+    let raw;
+    let pkg;
+    try {
+      raw = readFileSync3(pkgPath, "utf-8");
+      pkg = JSON.parse(raw);
+    } catch {
+      return false;
+    }
+    const scripts = pkg["scripts"];
+    if (!scripts) return false;
+    const targetKey = scripts["start"] ? "start" : scripts["dev"] ? "dev" : null;
+    if (!targetKey) return false;
+    const instrumentedKey = `${targetKey}:instrumented`;
+    if (scripts[instrumentedKey]?.includes(NODE_REQUIRE_FLAG)) {
+      return false;
+    }
+    scripts[instrumentedKey] = `NODE_OPTIONS='${NODE_REQUIRE_FLAG}' ${scripts[targetKey]}`;
+    writeFileSync3(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
+    return true;
+  }
+  // ── Task 7: getDockerfileTemplate ─────────────────────────────────────
+  getDockerfileTemplate() {
+    return renderTemplateFile("templates/dockerfiles/Dockerfile.nodejs");
+  }
+  // ── Task 8: getDockerBuildStage ───────────────────────────────────────
+  getDockerBuildStage() {
+    return `# === Build stage: nodejs ===
+FROM node:22-slim AS build-nodejs
+WORKDIR /build
+COPY package*.json ./
+RUN npm ci --production
+COPY . .
+`;
+  }
+  // ── Task 9: getRuntimeCopyDirectives ──────────────────────────────────
+  getRuntimeCopyDirectives() {
+    return [
+      "COPY --from=build-nodejs /build/node_modules ./node_modules",
+      "COPY --from=build-nodejs /build/ ./app/"
+    ].join("\n");
+  }
+  // ── Task 10: getBuildCommands ──────────────────────────────────────────
+  getBuildCommands() {
+    return ["npm install", "npm run build"];
+  }
+  // ── Task 11: getTestCommands ──────────────────────────────────────────
+  getTestCommands() {
+    return ["npm test"];
+  }
+  // ── Task 12: getSemgrepLanguages ──────────────────────────────────────
+  getSemgrepLanguages() {
+    return ["javascript", "typescript"];
+  }
+  // ── Task 13: parseTestOutput ──────────────────────────────────────────
+  parseTestOutput(output) {
+    const vitestMatch = /Tests\s+(\d+)\s+passed(?:\s*\|\s*(\d+)\s+failed)?(?:\s*\|\s*(\d+)\s+skipped)?/i.exec(output);
+    if (vitestMatch) {
+      const passed = parseInt(vitestMatch[1], 10);
+      const failed = vitestMatch[2] ? parseInt(vitestMatch[2], 10) : 0;
+      const skipped = vitestMatch[3] ? parseInt(vitestMatch[3], 10) : 0;
+      return { passed, failed, skipped, total: passed + failed + skipped };
+    }
+    const jestPassedMatch = /Tests:.*?(\d+)\s+passed/i.exec(output);
+    if (jestPassedMatch) {
+      const passed = parseInt(jestPassedMatch[1], 10);
+      const failedMatch = /Tests:.*?(\d+)\s+failed/i.exec(output);
+      const skippedMatch = /Tests:.*?(\d+)\s+skipped/i.exec(output);
+      const totalMatch = /Tests:.*?(\d+)\s+total/i.exec(output);
+      const failed = failedMatch ? parseInt(failedMatch[1], 10) : 0;
+      const skipped = skippedMatch ? parseInt(skippedMatch[1], 10) : 0;
+      const total = totalMatch ? parseInt(totalMatch[1], 10) : passed + failed + skipped;
+      return { passed, failed, skipped, total };
+    }
+    return { passed: 0, failed: 0, skipped: 0, total: 0 };
+  }
+  // ── Task 14: parseCoverageReport ──────────────────────────────────────
+  parseCoverageReport(dir) {
+    const candidates = [
+      join4(dir, "coverage", "coverage-summary.json"),
+      join4(dir, "src", "coverage", "coverage-summary.json")
+    ];
+    let reportPath = null;
+    for (const p of candidates) {
+      if (existsSync3(p)) {
+        reportPath = p;
+        break;
+      }
+    }
+    if (!reportPath) return 0;
+    try {
+      const report = JSON.parse(readFileSync3(reportPath, "utf-8"));
+      return report.total?.statements?.pct ?? 0;
+    } catch {
+      return 0;
+    }
+  }
+  // ── Task 15: getProjectName ───────────────────────────────────────────
+  // ── getVerifyDockerfileSection ──────────────────────────────────────
+  getVerifyDockerfileSection(_projectDir) {
+    return [
+      "# --- Node.js tooling ---",
+      "RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \\",
+      "    && apt-get install -y --no-install-recommends nodejs \\",
+      "    && rm -rf /var/lib/apt/lists/*",
+      "RUN npm install -g showboat @anthropic-ai/claude-code"
+    ].join("\n");
+  }
+  getProjectName(dir) {
+    const pkg = readJsonSafe(join4(dir, "package.json"));
+    if (pkg && typeof pkg.name === "string") {
+      return pkg.name;
+    }
+    return null;
+  }
+};
+
+// src/lib/stacks/python.ts
+import { execFileSync as execFileSync4 } from "child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+var AGENT_DEPS2 = [
+  "anthropic",
+  "openai",
+  "langchain",
+  "llama-index",
+  "traceloop-sdk"
+];
+var WEB_FRAMEWORK_DEPS2 = ["flask", "django", "fastapi", "streamlit"];
+var PYTHON_OTLP_PACKAGES = [
+  "opentelemetry-distro",
+  "opentelemetry-exporter-otlp"
+];
+var PythonProvider = class {
+  name = "python";
+  markers = ["requirements.txt", "pyproject.toml", "setup.py"];
+  displayName = "Python";
+  // ── Task 2: detectAppType ──────────────────────────────────────────────
+  detectAppType(dir) {
+    const content = getPythonDepsContent(dir);
+    if (AGENT_DEPS2.some((d) => hasPythonDep(content, d))) {
+      return "agent";
+    }
+    const hasWebFramework = WEB_FRAMEWORK_DEPS2.some((d) => hasPythonDep(content, d));
+    if (hasWebFramework) {
+      const hasTemplates = existsSync4(join5(dir, "templates"));
+      const hasStatic = existsSync4(join5(dir, "static"));
+      if (hasTemplates || hasStatic) {
+        return "web";
+      }
+      return "server";
+    }
+    if (existsSync4(join5(dir, "app.py")) || existsSync4(join5(dir, "main.py")) || existsSync4(join5(dir, "manage.py"))) {
+      return "server";
+    }
+    return "generic";
+  }
+  // ── Task 4: getCoverageTool ────────────────────────────────────────────
+  getCoverageTool() {
+    return "coverage-py";
+  }
+  // ── Task 5: detectCoverageConfig ───────────────────────────────────────
+  detectCoverageConfig(dir) {
+    const reqPath = join5(dir, "requirements.txt");
+    const reqContent = readTextSafe(reqPath);
+    if (reqContent) {
+      if (hasPythonDep(reqContent, "pytest-cov") || hasPythonDep(reqContent, "coverage")) {
+        return { tool: "coverage-py", configFile: reqPath };
+      }
+    }
+    const pyprojectPath = join5(dir, "pyproject.toml");
+    const pyprojectContent = readTextSafe(pyprojectPath);
+    if (pyprojectContent) {
+      if (hasPythonDep(pyprojectContent, "pytest-cov") || hasPythonDep(pyprojectContent, "coverage") || pyprojectContent.includes("[tool.coverage")) {
+        return { tool: "coverage-py", configFile: pyprojectPath };
+      }
+    }
+    return { tool: "none" };
+  }
+  // ── Task 6: getOtlpPackages ────────────────────────────────────────────
+  getOtlpPackages() {
+    return [...PYTHON_OTLP_PACKAGES];
+  }
+  // ── Task 7: installOtlp ───────────────────────────────────────────────
+  installOtlp(dir) {
+    try {
+      execFileSync4("pip", ["install", ...PYTHON_OTLP_PACKAGES], {
+        cwd: dir,
+        stdio: "pipe",
+        timeout: 3e5
+      });
+      return {
+        success: true,
+        packagesInstalled: [...PYTHON_OTLP_PACKAGES]
+      };
+    } catch {
+    }
+    const installed = [];
+    try {
+      for (const pkg of PYTHON_OTLP_PACKAGES) {
+        execFileSync4("pipx", ["install", pkg], {
+          cwd: dir,
+          stdio: "pipe",
+          timeout: 3e5
+        });
+        installed.push(pkg);
+      }
+      return {
+        success: true,
+        packagesInstalled: installed
+      };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Unknown error";
+      return {
+        success: false,
+        packagesInstalled: installed,
+        error: `Failed to install Python OTLP packages: ${message.length > 200 ? message.slice(0, 200) + "... (truncated)" : message}`
+      };
+    }
+  }
+  // ── Task 8: getDockerfileTemplate ─────────────────────────────────────
+  getDockerfileTemplate() {
+    return renderTemplateFile("templates/dockerfiles/Dockerfile.python");
+  }
+  // ── Task 9: getDockerBuildStage ───────────────────────────────────────
+  getDockerBuildStage() {
+    return `# === Build stage: python ===
+FROM python:3.12-slim AS build-python
+WORKDIR /build
+COPY . .
+RUN pip install --target=/build/dist .
+`;
+  }
+  // ── Task 10: getRuntimeCopyDirectives ──────────────────────────────────
+  getRuntimeCopyDirectives() {
+    return "COPY --from=build-python /build/dist /opt/app/python/";
+  }
+  // ── Task 11: getBuildCommands ──────────────────────────────────────────
+  getBuildCommands() {
+    return ["pip install -r requirements.txt"];
+  }
+  // ── Task 12: getTestCommands ──────────────────────────────────────────
+  getTestCommands() {
+    return ["python -m pytest"];
+  }
+  // ── Task 13: getSemgrepLanguages ──────────────────────────────────────
+  getSemgrepLanguages() {
+    return ["python"];
+  }
+  // ── Task 14: parseTestOutput ──────────────────────────────────────────
+  parseTestOutput(output) {
+    const passedMatch = /(\d+)\s+passed/i.exec(output);
+    if (passedMatch) {
+      const passed = parseInt(passedMatch[1], 10);
+      const failedMatch = /(\d+)\s+failed/i.exec(output);
+      const skippedMatch = /(\d+)\s+skipped/i.exec(output);
+      const failed = failedMatch ? parseInt(failedMatch[1], 10) : 0;
+      const skipped = skippedMatch ? parseInt(skippedMatch[1], 10) : 0;
+      return { passed, failed, skipped, total: passed + failed + skipped };
+    }
+    return { passed: 0, failed: 0, skipped: 0, total: 0 };
+  }
+  // ── Task 15: parseCoverageReport ──────────────────────────────────────
+  parseCoverageReport(dir) {
+    const reportPath = join5(dir, "coverage.json");
+    if (!existsSync4(reportPath)) return 0;
+    try {
+      const report = JSON.parse(readFileSync4(reportPath, "utf-8"));
+      return report.totals?.percent_covered ?? 0;
+    } catch {
+      return 0;
+    }
+  }
+  // ── Task 16: getProjectName ───────────────────────────────────────────
+  // ── getVerifyDockerfileSection ──────────────────────────────────────
+  getVerifyDockerfileSection(_projectDir) {
+    return [
+      "# --- Python tooling ---",
+      "RUN apt-get update && apt-get install -y --no-install-recommends \\",
+      "    python3-pip python3-venv \\",
+      "    && rm -rf /var/lib/apt/lists/*",
+      "RUN pip install --break-system-packages coverage pytest"
+    ].join("\n");
+  }
+  getProjectName(dir) {
+    const pyprojectContent = readTextSafe(join5(dir, "pyproject.toml"));
+    if (pyprojectContent) {
+      const projectIdx = pyprojectContent.search(/^\[project\]\s*$/m);
+      if (projectIdx !== -1) {
+        const afterHeader = pyprojectContent.slice(
+          projectIdx + pyprojectContent.slice(projectIdx).indexOf("\n") + 1
+        );
+        const nextSectionIdx = afterHeader.search(/^\[/m);
+        const section = nextSectionIdx === -1 ? afterHeader : afterHeader.slice(0, nextSectionIdx);
+        const nameMatch = /^\s*name\s*=\s*["']([^"']+)["']/m.exec(section);
+        if (nameMatch) return nameMatch[1];
+      }
+    }
+    const setupContent = readTextSafe(join5(dir, "setup.py"));
+    if (setupContent) {
+      const match = /name\s*=\s*['"]([^'"]+)['"]/m.exec(setupContent);
+      if (match) return match[1];
+    }
+    return null;
+  }
+};
+
+// src/lib/stacks/rust.ts
+import { execFileSync as execFileSync5 } from "child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
+var RUST_AGENT_DEPS = ["async-openai", "anthropic", "llm-chain"];
+var RUST_WEB_FRAMEWORKS = ["actix-web", "axum", "rocket", "tide", "warp"];
+var RUST_OTLP_PACKAGES = [
+  "opentelemetry",
+  "opentelemetry-otlp",
+  "tracing-opentelemetry",
+  "tracing-subscriber"
+];
+var RustProvider = class {
+  name = "rust";
+  markers = ["Cargo.toml"];
+  displayName = "Rust (Cargo.toml)";
+  // ── Task 3: detectAppType ──────────────────────────────────────────────
+  detectAppType(dir) {
+    const cargoContent = readTextSafe(join6(dir, "Cargo.toml"));
+    if (!cargoContent) return "generic";
+    const depsSection = getCargoDepsSection(cargoContent);
+    if (RUST_AGENT_DEPS.some((d) => hasCargoDep(depsSection, d))) {
+      return "agent";
+    }
+    if (RUST_WEB_FRAMEWORKS.some((d) => hasCargoDep(depsSection, d))) {
+      return "server";
+    }
+    if (/^\[\[bin\]\]\s*$/m.test(cargoContent)) {
+      return "cli";
+    }
+    if (/^\[lib\]\s*$/m.test(cargoContent)) {
+      return "generic";
+    }
+    return "generic";
+  }
+  // ── Task 4: getCoverageTool ────────────────────────────────────────────
+  getCoverageTool() {
+    return "tarpaulin";
+  }
+  // ── Task 5: detectCoverageConfig ───────────────────────────────────────
+  detectCoverageConfig(dir) {
+    const cargoPath = join6(dir, "Cargo.toml");
+    if (!existsSync5(cargoPath)) {
+      return { tool: "none" };
+    }
+    return { tool: "tarpaulin", configFile: cargoPath };
+  }
+  // ── Task 6: getOtlpPackages ────────────────────────────────────────────
+  getOtlpPackages() {
+    return [...RUST_OTLP_PACKAGES];
+  }
+  // ── Task 7: installOtlp ───────────────────────────────────────────────
+  installOtlp(dir) {
+    try {
+      execFileSync5("cargo", ["add", ...RUST_OTLP_PACKAGES], {
+        cwd: dir,
+        stdio: "pipe",
+        timeout: 3e5
+      });
+      return {
+        success: true,
+        packagesInstalled: [...RUST_OTLP_PACKAGES]
+      };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Unknown error";
+      return {
+        success: false,
+        packagesInstalled: [],
+        error: `Failed to install Rust OTLP packages: ${message.length > 200 ? message.slice(0, 200) + "... (truncated)" : message}`
+      };
+    }
+  }
+  // ── Task 8: getDockerfileTemplate ─────────────────────────────────────
+  getDockerfileTemplate() {
+    return renderTemplateFile("templates/dockerfiles/Dockerfile.rust");
+  }
+  // ── Task 9: getDockerBuildStage ───────────────────────────────────────
+  getDockerBuildStage() {
+    return `# === Build stage: rust ===
+FROM rust:1.82-slim AS build-rust
+WORKDIR /build
+COPY . .
+RUN cargo build --release
+`;
+  }
+  // ── Task 10: getRuntimeCopyDirectives ──────────────────────────────────
+  getRuntimeCopyDirectives() {
+    return "COPY --from=build-rust /build/target/release/myapp /usr/local/bin/myapp";
+  }
+  // ── Task 11: getBuildCommands ──────────────────────────────────────────
+  getBuildCommands() {
+    return ["cargo build", "cargo test"];
+  }
+  // ── Task 12: getTestCommands ──────────────────────────────────────────
+  getTestCommands() {
+    return ["cargo test"];
+  }
+  // ── Task 13: getSemgrepLanguages ──────────────────────────────────────
+  getSemgrepLanguages() {
+    return ["rust"];
+  }
+  // ── Task 14: parseTestOutput ──────────────────────────────────────────
+  parseTestOutput(output) {
+    const pattern = /test result:.*?(\d+)\s+passed;\s*(\d+)\s+failed(?:;\s*(\d+)\s+ignored)?/g;
+    let passed = 0;
+    let failed = 0;
+    let skipped = 0;
+    let match;
+    while ((match = pattern.exec(output)) !== null) {
+      passed += parseInt(match[1], 10);
+      failed += parseInt(match[2], 10);
+      skipped += match[3] ? parseInt(match[3], 10) : 0;
+    }
+    const total = passed + failed + skipped;
+    return { passed, failed, skipped, total };
+  }
+  // ── Task 15: parseCoverageReport ──────────────────────────────────────
+  parseCoverageReport(dir) {
+    const reportPath = join6(dir, "coverage", "tarpaulin-report.json");
+    if (!existsSync5(reportPath)) return 0;
+    try {
+      const report = JSON.parse(readFileSync5(reportPath, "utf-8"));
+      return report.coverage ?? 0;
+    } catch {
+      return 0;
+    }
+  }
+  // ── Task 16: getProjectName ───────────────────────────────────────────
+  // ── getVerifyDockerfileSection ──────────────────────────────────────
+  getVerifyDockerfileSection(projectDir) {
+    const lines = [
+      "# --- Rust tooling ---",
+      'RUN curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable',
+      'ENV PATH="/root/.cargo/bin:$PATH"',
+      "RUN rustup component add clippy",
+      "RUN cargo install cargo-tarpaulin"
+    ];
+    const cargoContent = readTextSafe(join6(projectDir, "Cargo.toml"));
+    if (cargoContent) {
+      const depsSection = getCargoDepsSection(cargoContent);
+      if (hasCargoDep(depsSection, "bevy")) {
+        lines.push(
+          "RUN apt-get update && apt-get install -y --no-install-recommends \\",
+          "    libudev-dev libasound2-dev libwayland-dev libxkbcommon-dev \\",
+          "    libfontconfig1-dev libx11-dev \\",
+          "    && rm -rf /var/lib/apt/lists/*"
+        );
+      }
+    }
+    return lines.join("\n");
+  }
+  getProjectName(dir) {
+    const cargoContent = readTextSafe(join6(dir, "Cargo.toml"));
+    if (!cargoContent) return null;
+    const packageIdx = cargoContent.search(/^\[package\]\s*$/m);
+    if (packageIdx === -1) return null;
+    const afterHeader = cargoContent.slice(
+      packageIdx + cargoContent.slice(packageIdx).indexOf("\n") + 1
+    );
+    const nextSectionIdx = afterHeader.search(/^\[/m);
+    const section = nextSectionIdx === -1 ? afterHeader : afterHeader.slice(0, nextSectionIdx);
+    const nameMatch = /^\s*name\s*=\s*["']([^"']+)["']/m.exec(section);
+    return nameMatch ? nameMatch[1] : null;
+  }
+};
+
+// src/lib/stacks/index.ts
+registerProvider(new NodejsProvider());
+registerProvider(new PythonProvider());
+registerProvider(new RustProvider());
+function detectAppType(dir, stack) {
+  if (!stack) return "generic";
+  const provider = getStackProvider(stack);
+  if (!provider) return "generic";
+  return provider.detectAppType(dir);
+}
+
+// src/lib/state.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7 } from "path";
+import { parse, stringify } from "yaml";
+function migrateState(state) {
+  const raw = state;
+  if (state.otlp && !state.otlp.backend) {
+    state.otlp.backend = "victoria";
+  }
+  if (Array.isArray(raw.stacks) && raw.stacks.length > 0) {
+    state.stacks = raw.stacks;
+    state.stack = state.stacks[0] ?? null;
+    return state;
+  }
+  if (typeof raw.stack === "string" && raw.stack) {
+    state.stacks = [raw.stack];
+    return state;
+  }
+  state.stacks = [];
+  state.stack = null;
+  return state;
+}
+var STATE_DIR = ".claude";
+var STATE_FILE = "codeharness.local.md";
+var DEFAULT_BODY = "\n# Codeharness State\n\nThis file is managed by the codeharness CLI. Do not edit manually.\n";
+var COVERAGE_TOOL_DEFAULTS = {
+  python: "coverage.py",
+  rust: "cargo-tarpaulin"
+};
+function getDefaultCoverageTool(stack) {
+  if (stack && COVERAGE_TOOL_DEFAULTS[stack]) return COVERAGE_TOOL_DEFAULTS[stack];
+  return "c8";
+}
+function getDefaultState(stack) {
+  return {
+    harness_version: "0.1.0",
+    initialized: false,
+    stack: stack ?? null,
+    stacks: stack ? [stack] : [],
+    enforcement: {
+      frontend: true,
+      database: true,
+      api: true
+    },
+    coverage: {
+      target: 90,
+      baseline: null,
+      current: null,
+      tool: getDefaultCoverageTool(stack)
+    },
+    session_flags: {
+      logs_queried: false,
+      tests_passed: false,
+      coverage_met: false,
+      verification_run: false
+    },
+    verification_log: []
+  };
+}
+function getStatePath(dir) {
+  return join7(dir, STATE_DIR, STATE_FILE);
+}
+function writeState(state, dir, body) {
+  const baseDir = dir ?? process.cwd();
+  const claudeDir = join7(baseDir, STATE_DIR);
+  mkdirSync3(claudeDir, { recursive: true });
+  const toWrite = { ...state };
+  if (toWrite.stacks && toWrite.stacks.length > 0) {
+    toWrite.stack = toWrite.stacks[0];
+  }
+  const yamlContent = stringify(toWrite, { nullStr: "null" });
+  const markdownBody = body ?? DEFAULT_BODY;
+  const fileContent = `---
+${yamlContent}---
+${markdownBody}`;
+  writeFileSync4(join7(claudeDir, STATE_FILE), fileContent, "utf-8");
+}
+function readState(dir) {
+  const baseDir = dir ?? process.cwd();
+  const filePath = getStatePath(baseDir);
+  if (!existsSync6(filePath)) {
+    throw new StateFileNotFoundError();
+  }
+  const raw = readFileSync6(filePath, "utf-8");
+  const parts = raw.split("---");
+  if (parts.length < 3) {
+    return recoverCorruptedState(baseDir);
+  }
+  try {
+    const state = parse(parts[1]);
+    if (!isValidState(state)) {
+      return recoverCorruptedState(baseDir);
+    }
+    return migrateState(state);
+  } catch {
+    return recoverCorruptedState(baseDir);
+  }
+}
+function readStateWithBody(dir) {
+  const baseDir = dir ?? process.cwd();
+  const filePath = getStatePath(baseDir);
+  if (!existsSync6(filePath)) {
+    throw new StateFileNotFoundError();
+  }
+  const raw = readFileSync6(filePath, "utf-8");
+  const parts = raw.split("---");
+  if (parts.length < 3) {
+    const state = recoverCorruptedState(baseDir);
+    return { state, body: DEFAULT_BODY };
+  }
+  try {
+    const state = parse(parts[1]);
+    if (!isValidState(state)) {
+      const recovered = recoverCorruptedState(baseDir);
+      return { state: recovered, body: DEFAULT_BODY };
+    }
+    const body = parts.slice(2).join("---");
+    return { state: migrateState(state), body: body || DEFAULT_BODY };
+  } catch {
+    const state = recoverCorruptedState(baseDir);
+    return { state, body: DEFAULT_BODY };
+  }
+}
+function isValidState(state) {
+  if (!state || typeof state !== "object") return false;
+  const s = state;
+  if (typeof s.harness_version !== "string") return false;
+  if (typeof s.initialized !== "boolean") return false;
+  if (s.stack !== null && typeof s.stack !== "string") return false;
+  if (!s.enforcement || typeof s.enforcement !== "object") return false;
+  if (!s.coverage || typeof s.coverage !== "object") return false;
+  if (!s.session_flags || typeof s.session_flags !== "object") return false;
+  if (!Array.isArray(s.verification_log)) return false;
+  if (s.stacks !== void 0 && !Array.isArray(s.stacks)) return false;
+  if (Array.isArray(s.stacks) && s.stacks.some((v) => typeof v !== "string")) return false;
+  return true;
+}
+function recoverCorruptedState(dir) {
+  warn("State file corrupted \u2014 recreating from detected config");
+  const stack = detectStack(dir);
+  const allStacks = detectStacks(dir);
+  const state = getDefaultState(stack);
+  const uniqueStackNames = [...new Set(allStacks.map((s) => s.stack))];
+  state.stacks = uniqueStackNames;
+  if (state.stack === null && uniqueStackNames.length > 0) {
+    state.stack = uniqueStackNames[0];
+  }
+  writeState(state, dir);
+  return state;
+}
+var StateFileNotFoundError = class extends Error {
+  constructor() {
+    super("No state file found. Run 'codeharness init' first.");
+    this.name = "StateFileNotFoundError";
+  }
+};
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function validateKeyPath(keyPath) {
+  const keys = keyPath.split(".");
+  for (const key of keys) {
+    if (DANGEROUS_KEYS.has(key)) {
+      throw new Error(`Invalid key path: '${key}' is not allowed`);
+    }
+  }
+}
+function getNestedValue(obj, keyPath) {
+  validateKeyPath(keyPath);
+  const keys = keyPath.split(".");
+  let current = obj;
+  for (const key of keys) {
+    if (current === null || current === void 0 || typeof current !== "object") {
+      return void 0;
+    }
+    current = current[key];
+  }
+  return current;
+}
+function setNestedValue(obj, keyPath, value) {
+  validateKeyPath(keyPath);
+  const keys = keyPath.split(".");
+  let current = obj;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const key = keys[i];
+    if (current[key] === void 0 || current[key] === null || typeof current[key] !== "object") {
+      current[key] = {};
+    }
+    current = current[key];
+  }
+  current[keys[keys.length - 1]] = value;
+}
+function parseValue(raw) {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  if (raw === "null") return null;
+  const num = Number(raw);
+  if (!Number.isNaN(num) && raw.trim() !== "") return num;
+  return raw;
+}
+
+// src/lib/observability/instrument.ts
+import { execFileSync as execFileSync7 } from "child_process";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
+import { join as join9 } from "path";
+
+// src/lib/observability/config.ts
+import { execFileSync as execFileSync6 } from "child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { join as join8, basename } from "path";
+var WEB_OTLP_PACKAGES = [
+  "@opentelemetry/sdk-trace-web",
+  "@opentelemetry/instrumentation-fetch",
+  "@opentelemetry/instrumentation-xml-http-request"
+];
+var AGENT_OTLP_PACKAGES_NODE = ["@traceloop/node-server-sdk"];
+var AGENT_OTLP_PACKAGES_PYTHON = ["traceloop-sdk"];
+var NODE_REQUIRE_FLAG2 = "--require @opentelemetry/auto-instrumentations-node/register";
+function ensureServiceNameEnvVar(projectDir, serviceName) {
+  const envFilePath = join8(projectDir, ".env.codeharness");
+  const sanitized = serviceName.replace(/[^a-zA-Z0-9._-]/g, "-");
+  const envLine = `OTEL_SERVICE_NAME=${sanitized}`;
+  if (existsSync7(envFilePath)) {
+    const content = readFileSync7(envFilePath, "utf-8");
+    const lines = content.split("\n").filter((l, i, arr) => i < arr.length - 1 || l.trim() !== "");
+    const idx = lines.findIndex((l) => l.startsWith("OTEL_SERVICE_NAME="));
+    if (idx !== -1) {
+      lines[idx] = envLine;
+    } else {
+      lines.push(envLine);
+    }
+    writeFileSync5(envFilePath, lines.join("\n") + "\n", "utf-8");
+  } else {
+    writeFileSync5(envFilePath, envLine + "\n", "utf-8");
+  }
+}
+function ensureEndpointEnvVar(projectDir, endpoint) {
+  const envFilePath = join8(projectDir, ".env.codeharness");
+  const envLine = `OTEL_EXPORTER_OTLP_ENDPOINT=${endpoint}`;
+  if (existsSync7(envFilePath)) {
+    const content = readFileSync7(envFilePath, "utf-8");
+    const lines = content.split("\n").filter((l, i, arr) => i < arr.length - 1 || l.trim() !== "");
+    const idx = lines.findIndex((l) => l.startsWith("OTEL_EXPORTER_OTLP_ENDPOINT="));
+    if (idx !== -1) {
+      lines[idx] = envLine;
+    } else {
+      lines.push(envLine);
+    }
+    writeFileSync5(envFilePath, lines.join("\n") + "\n", "utf-8");
+  } else {
+    writeFileSync5(envFilePath, envLine + "\n", "utf-8");
+  }
+}
+function configureOtlpEnvVars(projectDir, stack, opts) {
+  const projectName = basename(projectDir);
+  const { state, body } = readStateWithBody(projectDir);
+  const stackOtlpFields = {
+    nodejs: { node_require: NODE_REQUIRE_FLAG2 },
+    python: { python_wrapper: "opentelemetry-instrument" },
+    rust: { rust_env_hint: "OTEL_EXPORTER_OTLP_ENDPOINT" }
+  };
+  state.otlp = {
+    enabled: true,
+    endpoint: opts?.endpoint ?? "http://localhost:4318",
+    service_name: projectName,
+    mode: state.otlp?.mode ?? "local-shared",
+    ...stack && stackOtlpFields[stack] ? stackOtlpFields[stack] : {}
+  };
+  state.otlp.resource_attributes = "service.instance.id=$(hostname)-$$";
+  writeState(state, projectDir, body);
+  ensureServiceNameEnvVar(projectDir, projectName);
+  const needsEndpointEnv = /* @__PURE__ */ new Set(["rust"]);
+  if (stack && needsEndpointEnv.has(stack)) {
+    ensureEndpointEnvVar(projectDir, state.otlp.endpoint);
+  }
+}
+function configureCli(projectDir) {
+  const { state, body } = readStateWithBody(projectDir);
+  if (!state.otlp) return;
+  state.otlp.cli_env_vars = {
+    OTEL_BSP_SCHEDULE_DELAY: "100",
+    OTEL_TRACES_SAMPLER: "always_on",
+    OTEL_BLRP_SCHEDULE_DELAY: "100"
+  };
+  writeState(state, projectDir, body);
+}
+function configureWeb(projectDir, stack) {
+  const webInstaller = {
+    nodejs: () => {
+      try {
+        execFileSync6("npm", ["install", ...WEB_OTLP_PACKAGES], { cwd: projectDir, stdio: "pipe", timeout: 3e5 });
+      } catch {
+      }
+    }
+  };
+  if (stack && webInstaller[stack]) {
+    webInstaller[stack]();
+  }
+  let endpoint = "http://localhost:4318";
+  try {
+    const currentState = readState(projectDir);
+    if (currentState.otlp?.endpoint) {
+      endpoint = currentState.otlp.endpoint;
+    }
+  } catch {
+  }
+  const snippet = `// OpenTelemetry Web SDK initialization \u2014 generated by codeharness
+import { WebTracerProvider } from '@opentelemetry/sdk-trace-web';
+import { BatchSpanProcessor } from '@opentelemetry/sdk-trace-base';
+import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
+import { FetchInstrumentation } from '@opentelemetry/instrumentation-fetch';
+import { XMLHttpRequestInstrumentation } from '@opentelemetry/instrumentation-xml-http-request';
+import { registerInstrumentations } from '@opentelemetry/instrumentation';
+
+const exporter = new OTLPTraceExporter({
+  url: '${endpoint}/v1/traces',
+});
+
+const provider = new WebTracerProvider();
+provider.addSpanProcessor(new BatchSpanProcessor(exporter));
+provider.register();
+
+registerInstrumentations({
+  instrumentations: [
+    new FetchInstrumentation(),
+    new XMLHttpRequestInstrumentation(),
+  ],
+});
+`;
+  const snippetPath = join8(projectDir, "otel-web-init.js");
+  writeFileSync5(snippetPath, snippet, "utf-8");
+  const { state, body } = readStateWithBody(projectDir);
+  if (state.otlp) {
+    state.otlp.web_snippet_path = "otel-web-init.js";
+  }
+  writeState(state, projectDir, body);
+}
+function configureAgent(projectDir, stack) {
+  const agentInstallers = {
+    nodejs: () => {
+      try {
+        execFileSync6("npm", ["install", ...AGENT_OTLP_PACKAGES_NODE], { cwd: projectDir, stdio: "pipe", timeout: 3e5 });
+      } catch {
+      }
+      return true;
+    },
+    python: () => {
+      try {
+        execFileSync6("pip", ["install", ...AGENT_OTLP_PACKAGES_PYTHON], { cwd: projectDir, stdio: "pipe", timeout: 3e5 });
+      } catch {
+        try {
+          for (const pkg of AGENT_OTLP_PACKAGES_PYTHON) {
+            execFileSync6("pipx", ["install", pkg], { cwd: projectDir, stdio: "pipe", timeout: 3e5 });
+          }
+        } catch {
+        }
+      }
+      return true;
+    },
+    rust: () => {
+      info("Rust agent SDK not yet supported \u2014 skipping agent configuration");
+      return false;
+    }
+  };
+  if (stack) {
+    const installer = agentInstallers[stack];
+    if (installer) {
+      const proceed = installer();
+      if (!proceed) return;
+    }
+  }
+  const { state, body } = readStateWithBody(projectDir);
+  if (state.otlp) {
+    state.otlp.agent_sdk = "traceloop";
+  }
+  writeState(state, projectDir, body);
+}
+
+// src/lib/observability/instrument.ts
+var NODE_OTLP_PACKAGES2 = [
+  "@opentelemetry/auto-instrumentations-node",
+  "@opentelemetry/sdk-node",
+  "@opentelemetry/exporter-trace-otlp-http",
+  "@opentelemetry/exporter-metrics-otlp-http"
+];
+var PYTHON_OTLP_PACKAGES2 = [
+  "opentelemetry-distro",
+  "opentelemetry-exporter-otlp"
+];
+var RUST_OTLP_PACKAGES2 = [
+  "opentelemetry",
+  "opentelemetry-otlp",
+  "tracing-opentelemetry",
+  "tracing-subscriber"
+];
+function truncateError(message, maxLength = 200) {
+  if (message.length <= maxLength) return message;
+  return message.slice(0, maxLength) + "... (truncated)";
+}
+function installNodeOtlp(projectDir) {
+  try {
+    execFileSync7("npm", ["install", ...NODE_OTLP_PACKAGES2], { cwd: projectDir, stdio: "pipe", timeout: 3e5 });
+    return {
+      status: "configured",
+      packages_installed: true,
+      start_script_patched: false,
+      env_vars_configured: false
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Unknown error";
+    return {
+      status: "failed",
+      packages_installed: false,
+      start_script_patched: false,
+      env_vars_configured: false,
+      error: `Failed to install Node.js OTLP packages: ${truncateError(message)}`
+    };
+  }
+}
+function patchNodeStartScript(projectDir) {
+  const pkgPath = join9(projectDir, "package.json");
+  if (!existsSync8(pkgPath)) {
+    return false;
+  }
+  let raw;
+  let pkg;
+  try {
+    raw = readFileSync8(pkgPath, "utf-8");
+    pkg = JSON.parse(raw);
+  } catch {
+    return false;
+  }
+  const scripts = pkg["scripts"];
+  if (!scripts) {
+    return false;
+  }
+  const targetKey = scripts["start"] ? "start" : scripts["dev"] ? "dev" : null;
+  if (!targetKey) {
+    return false;
+  }
+  const instrumentedKey = `${targetKey}:instrumented`;
+  if (scripts[instrumentedKey]?.includes(NODE_REQUIRE_FLAG2)) {
+    return false;
+  }
+  scripts[instrumentedKey] = `NODE_OPTIONS='${NODE_REQUIRE_FLAG2}' ${scripts[targetKey]}`;
+  writeFileSync6(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
+  return true;
+}
+function installPythonOtlp(projectDir) {
+  const installChains = [
+    [{ cmd: "pip", args: ["install", ...PYTHON_OTLP_PACKAGES2] }],
+    PYTHON_OTLP_PACKAGES2.map((pkg) => ({ cmd: "pipx", args: ["install", pkg] }))
+  ];
+  for (const chain of installChains) {
+    try {
+      for (const step of chain) {
+        execFileSync7(step.cmd, step.args, { cwd: projectDir, stdio: "pipe", timeout: 3e5 });
+      }
+      return {
+        status: "configured",
+        packages_installed: true,
+        start_script_patched: false,
+        env_vars_configured: false
+      };
+    } catch {
+      continue;
+    }
+  }
+  return {
+    status: "failed",
+    packages_installed: false,
+    start_script_patched: false,
+    env_vars_configured: false,
+    error: "Failed to install Python OTLP packages"
+  };
+}
+function installRustOtlp(projectDir) {
+  try {
+    execFileSync7("cargo", ["add", ...RUST_OTLP_PACKAGES2], { cwd: projectDir, stdio: "pipe", timeout: 3e5 });
+    return {
+      status: "configured",
+      packages_installed: true,
+      start_script_patched: false,
+      env_vars_configured: false
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Unknown error";
+    return {
+      status: "failed",
+      packages_installed: false,
+      start_script_patched: false,
+      env_vars_configured: false,
+      error: `Failed to install Rust OTLP packages: ${truncateError(message)}`
+    };
+  }
+}
+function instrumentProject(projectDir, stack, opts) {
+  const isJson = opts?.json === true;
+  const appType = opts?.appType;
+  const stackInstallers = {
+    nodejs: () => {
+      const r = installNodeOtlp(projectDir);
+      if (r.status === "configured") {
+        const patched = patchNodeStartScript(projectDir);
+        r.start_script_patched = patched;
+        if (!isJson) {
+          ok("OTLP: Node.js packages installed");
+          if (patched) {
+            ok("OTLP: start script patched with --require flag");
+          } else {
+            info("OTLP: no start/dev script found or already patched");
+          }
+        }
+      }
+      return r;
+    },
+    python: () => {
+      const r = installPythonOtlp(projectDir);
+      if (r.status === "configured" && !isJson) {
+        ok("OTLP: Python packages installed");
+        info("OTLP: wrap your command with: opentelemetry-instrument <command>");
+      }
+      return r;
+    },
+    rust: () => {
+      const r = installRustOtlp(projectDir);
+      if (r.status === "configured" && !isJson) {
+        ok("OTLP: Rust packages installed");
+      }
+      return r;
+    }
+  };
+  if (!stack || !stackInstallers[stack]) {
+    return {
+      status: "skipped",
+      packages_installed: false,
+      start_script_patched: false,
+      env_vars_configured: false,
+      error: "Unsupported stack for OTLP instrumentation"
+    };
+  }
+  const result = stackInstallers[stack]();
+  configureOtlpEnvVars(projectDir, stack, { appType });
+  result.env_vars_configured = true;
+  if (!isJson) {
+    ok("OTLP: environment variables configured");
+  }
+  if (result.status === "configured") {
+    if (appType === "cli") {
+      configureCli(projectDir);
+      if (!isJson) {
+        ok("OTLP: CLI instrumentation configured (fast flush, always_on sampler)");
+      }
+    } else if (appType === "web") {
+      configureWeb(projectDir, stack);
+      if (!isJson) {
+        ok("OTLP: Web instrumentation configured (browser SDK + CORS)");
+      }
+    } else if (appType === "agent") {
+      configureAgent(projectDir, stack);
+      if (!isJson) {
+        ok("OTLP: Agent/LLM instrumentation configured (OpenLLMetry/Traceloop)");
+      }
+    } else if (appType === "generic" && !isJson) {
+      info("App type: generic (manual OTLP setup may be needed)");
+    }
+  } else if (!isJson && result.error) {
+    info(`OTLP: ${result.error}`);
+  }
+  return result;
+}
+
+// src/types/result.ts
+function ok2(data) {
+  return { success: true, data };
+}
+function fail2(error, context) {
+  if (context !== void 0) {
+    return { success: false, error, context };
+  }
+  return { success: false, error };
+}
+function isOk(result) {
+  return result.success === true;
+}
+
+// src/modules/infra/types.ts
+var DEFAULT_PORTS = {
+  logs: 9428,
+  metrics: 8428,
+  traces: 16686,
+  otel_grpc: 4317,
+  otel_http: 4318
+};
+var ALL_STACK_PORTS = [
+  DEFAULT_PORTS.otel_grpc,
+  DEFAULT_PORTS.otel_http,
+  DEFAULT_PORTS.metrics,
+  DEFAULT_PORTS.logs,
+  DEFAULT_PORTS.traces
+];
+
+// src/modules/infra/docker-setup.ts
+function checkDocker(opts) {
+  if (opts.otelEndpoint || opts.logsUrl || opts.opensearchUrl) {
+    return ok2({ available: true, criticalFailure: false });
+  }
+  if (!isDockerAvailable()) {
+    if (opts.observability) {
+      const dockerResult = {
+        compose_file: "",
+        stack_running: false,
+        services: [],
+        ports: DEFAULT_PORTS
+      };
+      return ok2({ available: false, criticalFailure: true, dockerResult });
+    }
+    return ok2({ available: false, criticalFailure: false });
+  }
+  if (!opts.isJson) {
+    ok("Docker: available");
+  }
+  return ok2({ available: true, criticalFailure: false });
+}
+function setupDocker(opts) {
+  try {
+    let state = { ...opts.state };
+    if (!opts.observability) {
+      writeState(state, opts.projectDir);
+      if (!opts.isJson) {
+        info("Observability: disabled, skipping Docker stack");
+      }
+      return ok2({ docker: null, state });
+    }
+    if (opts.opensearchUrl) {
+      return handleOpenSearch(opts, state);
+    }
+    if (opts.otelEndpoint) {
+      return handleRemoteDirect(opts, state);
+    }
+    if (opts.logsUrl && opts.metricsUrl && opts.tracesUrl) {
+      return handleRemoteRouted(opts, state);
+    }
+    if (opts.dockerAvailable) {
+      return handleLocalShared(opts, state);
+    }
+    const docker = {
+      compose_file: "",
+      stack_running: false,
+      services: [],
+      ports: DEFAULT_PORTS
+    };
+    writeState(state, opts.projectDir);
+    if (!opts.isJson) {
+      info("Observability: deferred (configure Docker or remote endpoint to activate)");
+    }
+    return ok2({ docker, state });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return fail2(`Docker setup failed: ${message}`);
+  }
+}
+function handleOpenSearch(opts, state) {
+  state = {
+    ...state,
+    otlp: {
+      ...state.otlp,
+      mode: "remote-direct"
+    },
+    opensearch: {
+      url: opts.opensearchUrl
+    }
+  };
+  writeState(state, opts.projectDir);
+  if (!opts.isJson) {
+    ok(`Observability: OpenSearch backend at ${opts.opensearchUrl}`);
+  }
+  return ok2({ docker: null, state });
+}
+function handleRemoteDirect(opts, state) {
+  state = {
+    ...state,
+    otlp: {
+      ...state.otlp,
+      endpoint: opts.otelEndpoint,
+      mode: "remote-direct"
+    }
+  };
+  writeState(state, opts.projectDir);
+  if (!opts.isJson) {
+    ok(`OTLP: configured for remote endpoint ${opts.otelEndpoint}`);
+  }
+  return ok2({ docker: null, state });
+}
+function handleRemoteRouted(opts, state) {
+  const collectorResult = startCollectorOnly(opts.logsUrl, opts.metricsUrl, opts.tracesUrl);
+  const sharedComposeFile = getComposeFilePath();
+  if (collectorResult.started) {
+    state = {
+      ...state,
+      otlp: { ...state.otlp, mode: "remote-routed" },
+      docker: {
+        compose_file: sharedComposeFile,
+        stack_running: true,
+        remote_endpoints: {
+          logs_url: opts.logsUrl,
+          metrics_url: opts.metricsUrl,
+          traces_url: opts.tracesUrl
+        },
+        ports: DEFAULT_PORTS
+      }
+    };
+    const docker2 = {
+      compose_file: sharedComposeFile,
+      stack_running: true,
+      services: collectorResult.services,
+      ports: DEFAULT_PORTS
+    };
+    writeState(state, opts.projectDir);
+    if (!opts.isJson) {
+      ok("Observability: OTel Collector started (routing to remote backends)");
+    }
+    return ok2({ docker: docker2, state });
+  }
+  if (!opts.isJson) {
+    fail("OTel Collector: failed to start");
+    if (collectorResult.error) {
+      info(`Error: ${collectorResult.error}`);
+    }
+  }
+  const docker = {
+    compose_file: sharedComposeFile,
+    stack_running: false,
+    services: [],
+    ports: DEFAULT_PORTS
+  };
+  return ok2({ docker, state });
+}
+function handleLocalShared(opts, state) {
+  const backend = state.otlp?.backend ?? "victoria";
+  const sharedComposeFile = backend === "elk" ? getElkComposeFilePath() : getComposeFilePath();
+  if (isSharedStackRunning()) {
+    if (!opts.isJson) {
+      ok("Observability stack: already running (shared)");
+      if (opts.appType === "web") {
+        info("Web app detected \u2014 verify OTel Collector has CORS enabled");
+      }
+    }
+    const docker2 = {
+      compose_file: sharedComposeFile,
+      stack_running: true,
+      services: [],
+      ports: DEFAULT_PORTS
+    };
+    state = {
+      ...state,
+      otlp: { ...state.otlp, mode: "local-shared" },
+      docker: {
+        compose_file: sharedComposeFile,
+        stack_running: true,
+        ports: DEFAULT_PORTS
+      }
+    };
+    writeState(state, opts.projectDir);
+    return ok2({ docker: docker2, state });
+  }
+  const startResult = startSharedStack();
+  if (startResult.started) {
+    if (!opts.isJson) {
+      ok("Observability stack: started (shared at ~/.codeharness/stack/)");
+    }
+    const docker2 = {
+      compose_file: sharedComposeFile,
+      stack_running: true,
+      services: startResult.services,
+      ports: DEFAULT_PORTS
+    };
+    state = {
+      ...state,
+      otlp: { ...state.otlp, mode: "local-shared" },
+      docker: {
+        compose_file: sharedComposeFile,
+        stack_running: true,
+        ports: DEFAULT_PORTS
+      }
+    };
+    writeState(state, opts.projectDir);
+    return ok2({ docker: docker2, state });
+  }
+  if (!opts.isJson) {
+    fail("Observability stack: failed to start");
+    if (startResult.error) {
+      info(`Error: ${startResult.error}`);
+    }
+  }
+  const docker = {
+    compose_file: sharedComposeFile,
+    stack_running: false,
+    services: [],
+    ports: DEFAULT_PORTS
+  };
+  return ok2({ docker, state });
+}
+
+// src/lib/deps.ts
+import { execFileSync as execFileSync8 } from "child_process";
+var DEPENDENCY_REGISTRY = [
+  {
+    name: "showboat",
+    displayName: "Showboat",
+    installCommands: [
+      { cmd: "pip", args: ["install", "showboat"] },
+      { cmd: "pipx", args: ["install", "showboat"] }
+    ],
+    checkCommand: { cmd: "showboat", args: ["--version"] },
+    critical: false
+  },
+  {
+    name: "agent-browser",
+    displayName: "agent-browser",
+    installCommands: [
+      { cmd: "npm", args: ["install", "-g", "@anthropic/agent-browser"] }
+    ],
+    checkCommand: { cmd: "agent-browser", args: ["--version"] },
+    critical: false
+  },
+  {
+    name: "beads",
+    displayName: "beads",
+    installCommands: [
+      { cmd: "pip", args: ["install", "beads"] },
+      { cmd: "pipx", args: ["install", "beads"] }
+    ],
+    checkCommand: { cmd: "bd", args: ["--version"] },
+    critical: false
+  },
+  {
+    name: "semgrep",
+    displayName: "Semgrep",
+    installCommands: [
+      { cmd: "pipx", args: ["install", "semgrep"] },
+      { cmd: "pip", args: ["install", "semgrep"] }
+    ],
+    checkCommand: { cmd: "semgrep", args: ["--version"] },
+    critical: false
+  },
+  {
+    name: "bats",
+    displayName: "BATS",
+    installCommands: [
+      { cmd: "brew", args: ["install", "bats-core"] },
+      { cmd: "npm", args: ["install", "-g", "bats"] }
+    ],
+    checkCommand: { cmd: "bats", args: ["--version"] },
+    critical: false
+  },
+  {
+    name: "cargo-tarpaulin",
+    displayName: "cargo-tarpaulin",
+    installCommands: [{ cmd: "cargo", args: ["install", "cargo-tarpaulin"] }],
+    checkCommand: { cmd: "cargo", args: ["tarpaulin", "--version"] },
+    critical: false
+  }
+];
+function checkInstalled(spec) {
+  try {
+    const output = execFileSync8(spec.checkCommand.cmd, spec.checkCommand.args, { stdio: "pipe", timeout: 15e3 }).toString().trim();
+    const version = parseVersion(output);
+    return { installed: true, version };
+  } catch {
+    return { installed: false, version: null };
+  }
+}
+function parseVersion(output) {
+  const match = /(\d+\.\d+[\w.-]*)/.exec(output);
+  return match ? match[1] : null;
+}
+function installDependency(spec) {
+  const check = checkInstalled(spec);
+  if (check.installed) {
+    return {
+      name: spec.name,
+      displayName: spec.displayName,
+      status: "already-installed",
+      version: check.version
+    };
+  }
+  for (const installCmd of spec.installCommands) {
+    try {
+      execFileSync8(installCmd.cmd, installCmd.args, { stdio: "pipe", timeout: 3e5 });
+      const postCheck = checkInstalled(spec);
+      if (postCheck.installed) {
+        return {
+          name: spec.name,
+          displayName: spec.displayName,
+          status: "installed",
+          version: postCheck.version
+        };
+      }
+    } catch {
+      continue;
+    }
+  }
+  const remedy = spec.installCommands.map((c) => [c.cmd, ...c.args].join(" ")).join(" or ");
+  return {
+    name: spec.name,
+    displayName: spec.displayName,
+    status: "failed",
+    version: null,
+    error: `Install failed. Try: ${remedy}`
+  };
+}
+function installAllDependencies(opts) {
+  const results = [];
+  for (const spec of DEPENDENCY_REGISTRY) {
+    const result = installDependency(spec);
+    results.push(result);
+    if (!opts.json) {
+      if (result.status === "installed") {
+        const versionStr = result.version ? ` (v${result.version})` : "";
+        ok(`${spec.displayName}: installed${versionStr}`);
+      } else if (result.status === "already-installed") {
+        const versionStr = result.version ? ` (v${result.version})` : "";
+        ok(`${spec.displayName}: already installed${versionStr}`);
+      } else if (result.status === "failed") {
+        fail(`${spec.displayName}: install failed. ${result.error ?? ""}`);
+        if (!spec.critical) {
+          info(`${spec.displayName} is optional \u2014 continuing without it`);
+        }
+      }
+    }
+    if (result.status === "failed" && spec.critical) {
+      throw new CriticalDependencyError(spec.displayName, result.error ?? "Install failed");
+    }
+  }
+  return results;
+}
+var CriticalDependencyError = class extends Error {
+  constructor(dependencyName, reason) {
+    super(`Critical dependency '${dependencyName}' failed to install: ${reason}`);
+    this.dependencyName = dependencyName;
+    this.reason = reason;
+    this.name = "CriticalDependencyError";
+  }
+};
+
+// src/modules/infra/deps-install.ts
+function installDeps(opts) {
+  try {
+    const depResults = installAllDependencies({ json: opts.isJson });
+    return ok2(depResults);
+  } catch (err) {
+    if (err instanceof CriticalDependencyError) {
+      return fail2(err.message);
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    return fail2(`Dependency install error: ${message}`);
+  }
+}
+function verifyDeps(isJson) {
+  const depResults = [];
+  for (const spec of DEPENDENCY_REGISTRY) {
+    const check = checkInstalled(spec);
+    const depResult = {
+      name: spec.name,
+      displayName: spec.displayName,
+      status: check.installed ? "already-installed" : "failed",
+      version: check.version
+    };
+    depResults.push(depResult);
+    if (!isJson) {
+      if (check.installed) {
+        const versionStr = check.version ? ` (v${check.version})` : "";
+        ok(`${spec.displayName}: already installed${versionStr}`);
+      } else {
+        fail(`${spec.displayName}: not found`);
+      }
+    }
+  }
+  return depResults;
+}
+
+// src/lib/bmad.ts
+import { execFileSync as execFileSync10 } from "child_process";
+import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
+import { join as join12 } from "path";
+
+// src/lib/patch-engine.ts
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+function validatePatchName(patchName) {
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(patchName)) {
+    throw new Error(
+      `Invalid patch name '${patchName}': must be kebab-case (lowercase letters, digits, hyphens)`
+    );
+  }
+}
+function getPatchMarkers(patchName) {
+  validatePatchName(patchName);
+  return {
+    start: `<!-- CODEHARNESS-PATCH-START:${patchName} -->`,
+    end: `<!-- CODEHARNESS-PATCH-END:${patchName} -->`
+  };
+}
+function applyPatch(filePath, patchName, patchContent) {
+  let content = readFileSync9(filePath, "utf-8");
+  const markers = getPatchMarkers(patchName);
+  const markerBlock = `${markers.start}
+${patchContent}
+${markers.end}`;
+  const startIdx = content.indexOf(markers.start);
+  const endIdx = content.indexOf(markers.end);
+  if (startIdx !== -1 !== (endIdx !== -1)) {
+    throw new Error(
+      `Corrupted patch markers for '${patchName}': only ${startIdx !== -1 ? "start" : "end"} marker found in ${filePath}`
+    );
+  }
+  if (startIdx !== -1 && endIdx !== -1) {
+    if (endIdx < startIdx) {
+      throw new Error(
+        `Corrupted patch markers for '${patchName}': end marker appears before start marker in ${filePath}`
+      );
+    }
+    const before = content.slice(0, startIdx);
+    const after = content.slice(endIdx + markers.end.length);
+    content = before + markerBlock + after;
+    writeFileSync7(filePath, content, "utf-8");
+    return { applied: true, updated: true };
+  }
+  const trimmed = content.trimEnd();
+  content = trimmed + "\n\n" + markerBlock + "\n";
+  writeFileSync7(filePath, content, "utf-8");
+  return { applied: true, updated: false };
+}
+function removePatch(filePath, patchName) {
+  let content = readFileSync9(filePath, "utf-8");
+  const markers = getPatchMarkers(patchName);
+  const startIdx = content.indexOf(markers.start);
+  const endIdx = content.indexOf(markers.end);
+  if (startIdx === -1 || endIdx === -1) {
+    return false;
+  }
+  if (endIdx < startIdx) {
+    throw new Error(
+      `Corrupted patch markers for '${patchName}': end marker appears before start marker in ${filePath}`
+    );
+  }
+  const before = content.slice(0, startIdx);
+  const after = content.slice(endIdx + markers.end.length);
+  content = before.trimEnd() + "\n" + after.trimStart();
+  writeFileSync7(filePath, content, "utf-8");
+  return true;
+}
+
+// src/templates/bmad-patches.ts
+import { readFileSync as readFileSync10, existsSync as existsSync9 } from "fs";
+import { join as join10, dirname as dirname2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
+function readPatchFile(role, name) {
+  const patchPath = join10(__dirname2, "..", "..", "patches", role, `${name}.md`);
+  try {
+    if (existsSync9(patchPath)) {
+      return readFileSync10(patchPath, "utf-8").trim();
+    }
+  } catch {
+  }
+  return null;
+}
+function storyVerificationPatch() {
+  return readPatchFile("verify", "story-verification") ?? `## Verification Requirements
+
+- [ ] Showboat proof document created (verification/<story-key>-proof.md)
+- [ ] All acceptance criteria verified with real-world evidence via docker exec
+- [ ] Test coverage meets target (100%)
+
+## Documentation Requirements
+
+- [ ] Relevant AGENTS.md files updated
+- [ ] Exec-plan created in docs/exec-plans/active/<story-key>.md
+
+## Testing Requirements
+
+- [ ] Unit tests written for all new/changed code
+- [ ] Coverage target: 100%`;
+}
+function devEnforcementPatch() {
+  return readPatchFile("dev", "enforcement") ?? `## Codeharness Enforcement
+
+### Observability Check
+- [ ] Query VictoriaLogs after test runs to verify telemetry flows
+
+### Documentation Update
+- [ ] AGENTS.md updated for all changed modules
+
+### Test Enforcement
+- [ ] All tests pass
+- [ ] Coverage gate: 100% of new/changed code`;
+}
+function reviewEnforcementPatch() {
+  return readPatchFile("review", "enforcement") ?? `## Codeharness Review Gates
+
+### Verification
+- [ ] Proof document exists and passes codeharness verify
+- [ ] All acceptance criteria have evidence in proof document
+
+### Coverage
+- [ ] No coverage regression in changed files`;
+}
+function retroEnforcementPatch() {
+  return readPatchFile("retro", "enforcement") ?? `## Codeharness Quality Metrics
+
+### Verification Effectiveness
+- [ ] How many ACs were caught by verification vs manual review?
+- [ ] Were there any false positives in proofs?
+
+### Test Quality
+- [ ] Coverage trend (improving, stable, declining)`;
+}
+function sprintBeadsPatch() {
+  return readPatchFile("sprint", "planning") ?? `## Codeharness Sprint Planning
+
+- [ ] Review unresolved retrospective action items
+- [ ] Import from all backlog sources before triage
+- [ ] Verify story ACs are testable via CLI + Docker`;
+}
+function sprintPlanningRetroPatch() {
+  return sprintBeadsPatch();
+}
+var PATCH_TEMPLATES = {
+  "story-verification": storyVerificationPatch,
+  "dev-enforcement": devEnforcementPatch,
+  "review-enforcement": reviewEnforcementPatch,
+  "retro-enforcement": retroEnforcementPatch,
+  "sprint-beads": sprintBeadsPatch,
+  "sprint-retro": sprintPlanningRetroPatch
+};
+
+// src/lib/beads.ts
+import { execFileSync as execFileSync9 } from "child_process";
+import { existsSync as existsSync10, readdirSync as readdirSync2 } from "fs";
+import { join as join11 } from "path";
+var BeadsError = class extends Error {
+  constructor(command, originalMessage) {
+    super(`Beads failed: ${originalMessage}. Command: ${command}`);
+    this.command = command;
+    this.originalMessage = originalMessage;
+    this.name = "BeadsError";
+  }
+};
+function isBeadsCLIInstalled() {
+  try {
+    execFileSync9("which", ["bd"], { stdio: "pipe", timeout: 5e3 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function bdCommand(args) {
+  const cmdStr = `bd ${args.join(" ")}`;
+  let text;
+  try {
+    const output = execFileSync9("bd", args, {
+      stdio: "pipe",
+      timeout: 3e4
+    });
+    text = output.toString().trim();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new BeadsError(cmdStr, message);
+  }
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new BeadsError(cmdStr, `Invalid JSON output from bd: ${text}`);
+  }
+}
+function createIssue(title, opts) {
+  const args = ["create", title, "--json"];
+  if (opts?.type) {
+    args.push("--type", opts.type);
+  }
+  if (opts?.priority !== void 0) {
+    args.push("--priority", String(opts.priority));
+  }
+  if (opts?.description) {
+    args.push("--description", opts.description);
+  }
+  if (opts?.deps && opts.deps.length > 0) {
+    for (const dep of opts.deps) {
+      args.push("--dep", dep);
+    }
+  }
+  return bdCommand(args);
+}
+function closeIssue(id) {
+  bdCommand(["close", id, "--json"]);
+}
+function updateIssue(id, opts) {
+  const args = ["update", id, "--json"];
+  if (opts.status !== void 0) {
+    args.push("--status", opts.status);
+  }
+  if (opts.priority !== void 0) {
+    args.push("--priority", String(opts.priority));
+  }
+  bdCommand(args);
+}
+function listIssues() {
+  return bdCommand(["list", "--json"]);
+}
+function isBeadsInitialized(dir) {
+  const beadsDir = join11(dir ?? process.cwd(), ".beads");
+  return existsSync10(beadsDir);
+}
+function initBeads(dir) {
+  if (isBeadsInitialized(dir)) {
+    return;
+  }
+  const cmdStr = "bd init";
+  try {
+    execFileSync9("bd", ["init"], {
+      stdio: "pipe",
+      timeout: 3e4,
+      cwd: dir ?? process.cwd()
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new BeadsError(cmdStr, message);
+  }
+}
+function detectBeadsHooks(dir) {
+  const hooksDir = join11(dir ?? process.cwd(), ".beads", "hooks");
+  if (!existsSync10(hooksDir)) {
+    return { hasHooks: false, hookTypes: [] };
+  }
+  try {
+    const entries = readdirSync2(hooksDir);
+    const hookTypes = entries.filter((e) => !e.startsWith("."));
+    return {
+      hasHooks: hookTypes.length > 0,
+      hookTypes
+    };
+  } catch {
+    return { hasHooks: false, hookTypes: [] };
+  }
+}
+function buildGapId(category, identifier) {
+  return `[gap:${category}:${identifier}]`;
+}
+function findExistingByGapId(gapId, issues) {
+  return issues.find(
+    (issue) => issue.status !== "done" && issue.description?.includes(gapId)
+  );
+}
+function appendGapId(existingDescription, gapId) {
+  if (!existingDescription) {
+    return gapId;
+  }
+  return `${existingDescription}
+${gapId}`;
+}
+function createOrFindIssue(title, gapId, opts) {
+  const issues = listIssues();
+  const existing = findExistingByGapId(gapId, issues);
+  if (existing) {
+    return { issue: existing, created: false };
+  }
+  const issue = createIssue(title, {
+    ...opts,
+    description: appendGapId(opts?.description, gapId)
+  });
+  return { issue, created: true };
+}
+function configureHookCoexistence(dir) {
+  const detection = detectBeadsHooks(dir);
+  if (!detection.hasHooks) {
+    return;
+  }
+  const gitHooksDir = join11(dir ?? process.cwd(), ".git", "hooks");
+  if (!existsSync10(gitHooksDir)) {
+    return;
+  }
+}
+
+// src/lib/bmad.ts
+var BmadError = class extends Error {
+  constructor(command, originalMessage) {
+    super(`BMAD failed: ${originalMessage}. Command: ${command}`);
+    this.command = command;
+    this.originalMessage = originalMessage;
+    this.name = "BmadError";
+  }
+};
+var PATCH_TARGETS = {
+  "story-verification": "bmm/workflows/4-implementation/create-story/template.md",
+  "dev-enforcement": "bmm/workflows/4-implementation/dev-story/instructions.xml",
+  "review-enforcement": "bmm/workflows/4-implementation/code-review/instructions.xml",
+  "retro-enforcement": "bmm/workflows/4-implementation/retrospective/instructions.md",
+  "sprint-beads": "bmm/workflows/4-implementation/sprint-planning/checklist.md",
+  "sprint-retro": "bmm/workflows/4-implementation/sprint-planning/instructions.md"
+};
+function isBmadInstalled(dir) {
+  const bmadDir = join12(dir ?? process.cwd(), "_bmad");
+  return existsSync11(bmadDir);
+}
+function detectBmadVersion(dir) {
+  const root = dir ?? process.cwd();
+  const moduleYamlPath = join12(root, "_bmad", "core", "module.yaml");
+  if (existsSync11(moduleYamlPath)) {
+    try {
+      const content = readFileSync11(moduleYamlPath, "utf-8");
+      const versionMatch = content.match(/version:\s*["']?([^\s"']+)["']?/);
+      if (versionMatch) {
+        return versionMatch[1];
+      }
+    } catch {
+    }
+  }
+  const versionFilePath = join12(root, "_bmad", "VERSION");
+  if (existsSync11(versionFilePath)) {
+    try {
+      return readFileSync11(versionFilePath, "utf-8").trim() || null;
+    } catch {
+    }
+  }
+  const packageJsonPath = join12(root, "_bmad", "package.json");
+  if (existsSync11(packageJsonPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync11(packageJsonPath, "utf-8"));
+      return pkg.version ?? null;
+    } catch {
+    }
+  }
+  return null;
+}
+function installBmad(dir) {
+  const root = dir ?? process.cwd();
+  if (isBmadInstalled(root)) {
+    const version2 = detectBmadVersion(root);
+    return {
+      status: "already-installed",
+      version: version2,
+      patches_applied: []
+    };
+  }
+  const cmdStr = "npx bmad-method install --yes --tools claude-code";
+  try {
+    execFileSync10("npx", ["bmad-method", "install", "--yes", "--tools", "claude-code"], {
+      stdio: "pipe",
+      timeout: 12e4,
+      // 2 min — npx may need to download the package first time
+      cwd: root
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new BmadError(cmdStr, message);
+  }
+  if (!isBmadInstalled(root)) {
+    throw new BmadError(cmdStr, "_bmad/ directory was not created after successful npx bmad-method install");
+  }
+  const version = detectBmadVersion(root);
+  return {
+    status: "installed",
+    version,
+    patches_applied: []
+  };
+}
+function applyAllPatches(dir, options) {
+  const root = dir ?? process.cwd();
+  const silent = options?.silent ?? false;
+  const results = [];
+  for (const [patchName, relativePath] of Object.entries(PATCH_TARGETS)) {
+    const targetFile = join12(root, "_bmad", relativePath);
+    if (!existsSync11(targetFile)) {
+      if (!silent) warn(`Patch target not found: ${relativePath}`);
+      results.push({
+        patchName,
+        targetFile,
+        applied: false,
+        updated: false,
+        error: `File not found: ${relativePath}`
+      });
+      continue;
+    }
+    const templateFn = PATCH_TEMPLATES[patchName];
+    if (!templateFn) {
+      results.push({
+        patchName,
+        targetFile,
+        applied: false,
+        updated: false,
+        error: `No template function for patch: ${patchName}`
+      });
+      continue;
+    }
+    try {
+      const patchContent = templateFn();
+      const patchResult = applyPatch(targetFile, patchName, patchContent);
+      results.push({
+        patchName,
+        targetFile,
+        applied: patchResult.applied,
+        updated: patchResult.updated
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      results.push({
+        patchName,
+        targetFile,
+        applied: false,
+        updated: false,
+        error: message
+      });
+    }
+  }
+  return results;
+}
+function detectBmalph(dir) {
+  const root = dir ?? process.cwd();
+  const files = [];
+  const ralphRcPath = join12(root, ".ralph", ".ralphrc");
+  if (existsSync11(ralphRcPath)) {
+    files.push(".ralph/.ralphrc");
+  }
+  const dotRalphDir = join12(root, ".ralph");
+  if (existsSync11(dotRalphDir)) {
+    if (files.length === 0) {
+      files.push(".ralph/");
+    }
+  }
+  return { detected: files.length > 0, files };
+}
+function generateStoryKey(epicNumber, storyNumber, title) {
+  const slug = title.toLowerCase().replace(/[^a-z0-9\s-]/g, "").replace(/\s+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  return `${epicNumber}-${storyNumber}-${slug}`;
+}
+function getStoryFilePath(storyKey) {
+  return `_bmad-output/implementation-artifacts/${storyKey}.md`;
+}
+function parseEpicsFile(filePath) {
+  if (!existsSync11(filePath)) {
+    return [];
+  }
+  const content = readFileSync11(filePath, "utf-8");
+  if (!content.trim()) {
+    return [];
+  }
+  const lines = content.split("\n");
+  const epics = [];
+  let currentEpic = null;
+  let currentStory = null;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const epicMatch = line.match(/^#{2,3}\s+Epic\s+(\d+):\s*(.+)$/);
+    if (epicMatch) {
+      if (currentStory && currentEpic) {
+        currentEpic.stories.push(finalizeStory(currentStory));
+        currentStory = null;
+      }
+      const epicNum = parseInt(epicMatch[1], 10);
+      const epicTitle = epicMatch[2].trim();
+      const existingIdx = epics.findIndex((e) => e.number === epicNum);
+      if (existingIdx !== -1) {
+        currentEpic = {
+          number: epicNum,
+          title: epicTitle,
+          stories: []
+        };
+        epics[existingIdx] = currentEpic;
+      } else {
+        currentEpic = {
+          number: epicNum,
+          title: epicTitle,
+          stories: []
+        };
+        epics.push(currentEpic);
+      }
+      continue;
+    }
+    const storyMatch = line.match(/^###\s+Story\s+(\d+)\.(\d+):\s*(.+)$/);
+    if (storyMatch) {
+      if (currentStory && currentEpic) {
+        currentEpic.stories.push(finalizeStory(currentStory));
+      }
+      currentStory = {
+        epicNumber: parseInt(storyMatch[1], 10),
+        storyNumber: parseInt(storyMatch[2], 10),
+        title: storyMatch[3].trim(),
+        lines: []
+      };
+      continue;
+    }
+    if (currentStory) {
+      currentStory.lines.push(line);
+    }
+  }
+  if (currentStory && currentEpic) {
+    currentEpic.stories.push(finalizeStory(currentStory));
+  }
+  return epics;
+}
+function finalizeStory(raw) {
+  const body = raw.lines.join("\n");
+  const userStoryMatch = body.match(
+    /As\s+a[n]?\s+.+?,\s*\n\s*I\s+want\s+.+?,\s*\n\s*So\s+that\s+.+?\./s
+  );
+  const userStory = userStoryMatch ? userStoryMatch[0].trim() : "";
+  const acceptanceCriteria = [];
+  const acBlockRegex = /\*\*Given\*\*\s+.+?(?=\n\n\*\*Given\*\*|\n\n\*\*Technical\s+notes|\n\n---|\n\n##|\n\n###|$)/gs;
+  let acMatch;
+  while ((acMatch = acBlockRegex.exec(body)) !== null) {
+    acceptanceCriteria.push(acMatch[0].trim());
+  }
+  let technicalNotes = null;
+  const techMatch = body.match(/\*\*Technical\s+notes:\*\*\s*\n([\s\S]*?)(?=\n\n---|\n\n##|\n\n###|$)/);
+  if (techMatch) {
+    technicalNotes = techMatch[1].trim() || null;
+  }
+  const key = generateStoryKey(raw.epicNumber, raw.storyNumber, raw.title);
+  return {
+    epicNumber: raw.epicNumber,
+    storyNumber: raw.storyNumber,
+    key,
+    title: raw.title,
+    userStory,
+    acceptanceCriteria,
+    technicalNotes
+  };
+}
+function importStoriesToBeads(stories, opts, beadsFns) {
+  const results = [];
+  let existingIssues = [];
+  try {
+    existingIssues = beadsFns.listIssues();
+  } catch {
+  }
+  const lastBeadsIdByEpic = /* @__PURE__ */ new Map();
+  let priority = 1;
+  for (const story of stories) {
+    const storyFilePath = getStoryFilePath(story.key);
+    const gapId = buildGapId("bridge", `${story.epicNumber}.${story.storyNumber}`);
+    const existingIssue = findExistingByGapId(gapId, existingIssues);
+    if (existingIssue) {
+      lastBeadsIdByEpic.set(story.epicNumber, existingIssue.id);
+      results.push({
+        storyKey: story.key,
+        title: story.title,
+        beadsId: existingIssue.id,
+        status: "exists",
+        storyFilePath
+      });
+      priority++;
+      continue;
+    }
+    if (opts.dryRun) {
+      results.push({
+        storyKey: story.key,
+        title: story.title,
+        beadsId: null,
+        status: "skipped",
+        storyFilePath
+      });
+      priority++;
+      continue;
+    }
+    const deps = [];
+    const prevId = lastBeadsIdByEpic.get(story.epicNumber);
+    if (prevId) {
+      deps.push(prevId);
+    }
+    try {
+      const description = appendGapId(storyFilePath, gapId);
+      const issue = beadsFns.createIssue(story.title, {
+        type: "story",
+        priority,
+        description,
+        deps: deps.length > 0 ? deps : void 0
+      });
+      lastBeadsIdByEpic.set(story.epicNumber, issue.id);
+      results.push({
+        storyKey: story.key,
+        title: story.title,
+        beadsId: issue.id,
+        status: "created",
+        storyFilePath
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      results.push({
+        storyKey: story.key,
+        title: story.title,
+        beadsId: null,
+        status: "failed",
+        storyFilePath,
+        error: message
+      });
+    }
+    priority++;
+  }
+  return results;
+}
+
+// src/modules/infra/bmad-setup.ts
+function setupBmad(opts) {
+  try {
+    const bmadAlreadyInstalled = isBmadInstalled(opts.projectDir);
+    let bmadResult;
+    if (bmadAlreadyInstalled) {
+      const version = detectBmadVersion(opts.projectDir);
+      const patchResults = applyAllPatches(opts.projectDir, { silent: opts.isJson });
+      const patchNames = patchResults.filter((r) => r.applied).map((r) => r.patchName);
+      bmadResult = {
+        status: "already-installed",
+        version,
+        patches_applied: patchNames,
+        bmalph_detected: false
+      };
+      if (!opts.isJson) {
+        info("BMAD: already installed, patches verified");
+      }
+    } else {
+      const installResult = installBmad(opts.projectDir);
+      const patchResults = applyAllPatches(opts.projectDir, { silent: opts.isJson });
+      const patchNames = patchResults.filter((r) => r.applied).map((r) => r.patchName);
+      bmadResult = {
+        status: installResult.status,
+        version: installResult.version,
+        patches_applied: patchNames,
+        bmalph_detected: false
+      };
+      if (!opts.isJson) {
+        ok(`BMAD: installed (v${installResult.version ?? "unknown"}), harness patches applied`);
+      }
+    }
+    const bmalpHDetection = detectBmalph(opts.projectDir);
+    if (bmalpHDetection.detected) {
+      bmadResult = { ...bmadResult, bmalph_detected: true };
+      if (!opts.isJson) {
+        warn("bmalph detected \u2014 superseded files noted for cleanup");
+      }
+    }
+    return ok2(bmadResult);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const bmadResult = {
+      status: "failed",
+      version: null,
+      patches_applied: [],
+      bmalph_detected: false,
+      error: message
+    };
+    if (!opts.isJson) {
+      fail(`BMAD install failed: ${message}`);
+    }
+    return ok2(bmadResult);
+  }
+}
+function verifyBmadOnRerun(projectDir, isJson) {
+  if (!isBmadInstalled(projectDir)) {
+    return void 0;
+  }
+  try {
+    const patchResults = applyAllPatches(projectDir, { silent: isJson });
+    const patchNames = patchResults.filter((r) => r.applied).map((r) => r.patchName);
+    const version = detectBmadVersion(projectDir);
+    const bmalpHDetection = detectBmalph(projectDir);
+    const result = {
+      status: "already-installed",
+      version,
+      patches_applied: patchNames,
+      bmalph_detected: bmalpHDetection.detected
+    };
+    if (!isJson) {
+      info("BMAD: already installed, patches verified");
+      if (bmalpHDetection.detected) {
+        warn("bmalph detected \u2014 superseded files noted for cleanup");
+      }
+    }
+    return result;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/modules/infra/beads-init.ts
+function initializeBeads(projectDir, isJson) {
+  try {
+    let beadsResult;
+    if (isBeadsInitialized(projectDir)) {
+      beadsResult = { status: "already-initialized", hooks_detected: false };
+      if (!isJson) {
+        info("Beads: .beads/ already exists");
+      }
+    } else {
+      initBeads(projectDir);
+      beadsResult = { status: "initialized", hooks_detected: false };
+      if (!isJson) {
+        ok("Beads: initialized (.beads/ created)");
+      }
+    }
+    const hookDetection = detectBeadsHooks(projectDir);
+    beadsResult = { ...beadsResult, hooks_detected: hookDetection.hasHooks };
+    if (hookDetection.hasHooks) {
+      configureHookCoexistence(projectDir);
+      if (!isJson) {
+        info("Beads hooks detected \u2014 coexistence configured");
+      }
+    }
+    return beadsResult;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const beadsResult = {
+      status: "failed",
+      hooks_detected: false,
+      error: message
+    };
+    if (!isJson) {
+      warn(`Beads init failed: ${message}`);
+      info("Beads is optional \u2014 continuing without it");
+    }
+    return beadsResult;
+  }
+}
+
+// src/modules/infra/docs-scaffold.ts
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
+import { join as join13, basename as basename2 } from "path";
+
+// src/templates/readme.ts
+function readmeTemplate(config) {
+  const { projectName, stack, cliHelpOutput } = config;
+  const installCommand = getInstallCommand(stack);
+  return renderTemplateFile("templates/docs/readme.md.tmpl", {
+    PROJECT_NAME: projectName,
+    INSTALL_COMMAND: installCommand,
+    CLI_HELP_OUTPUT: cliHelpOutput.trimEnd()
+  });
+}
+function getInstallCommand(stack) {
+  if (Array.isArray(stack)) {
+    const commands = stack.map((s) => getSingleInstallCommand(s));
+    return [...new Set(commands)].join("\n");
+  }
+  return getSingleInstallCommand(stack);
+}
+var INSTALL_COMMANDS = {
+  python: "pip install codeharness",
+  rust: "cargo install codeharness"
+};
+function getSingleInstallCommand(stack) {
+  if (stack && INSTALL_COMMANDS[stack]) return INSTALL_COMMANDS[stack];
+  return "npm install -g codeharness";
+}
+
+// src/modules/infra/docs-scaffold.ts
+var DO_NOT_EDIT_HEADER = "<!-- DO NOT EDIT MANUALLY -->\n";
+function getProjectName(projectDir) {
+  try {
+    const pkgPath = join13(projectDir, "package.json");
+    if (existsSync12(pkgPath)) {
+      const pkg = JSON.parse(readFileSync12(pkgPath, "utf-8"));
+      if (pkg.name && typeof pkg.name === "string") {
+        return pkg.name;
+      }
+    }
+  } catch {
+  }
+  try {
+    const cargoPath = join13(projectDir, "Cargo.toml");
+    if (existsSync12(cargoPath)) {
+      const content = readFileSync12(cargoPath, "utf-8");
+      const packageMatch = content.match(/\[package\]([\s\S]*?)(?=\n\[|$)/s);
+      if (packageMatch) {
+        const nameMatch = packageMatch[1].match(/^\s*name\s*=\s*["']([^"']+)["']/m);
+        if (nameMatch) {
+          return nameMatch[1];
+        }
+      }
+    }
+  } catch {
+  }
+  return basename2(projectDir);
+}
+function getStackLabel(stack) {
+  if (Array.isArray(stack)) {
+    if (stack.length === 0) return "Unknown";
+    return stack.map((s) => getStackLabel(s)).join(" + ");
+  }
+  if (!stack) return "Unknown";
+  const provider = getStackProvider(stack);
+  return provider ? provider.displayName : "Unknown";
+}
+var STATE_COVERAGE_TOOLS = {
+  nodejs: "c8",
+  python: "coverage.py",
+  rust: "cargo-tarpaulin"
+};
+function getCoverageTool(stack) {
+  if (!stack) return "c8";
+  return STATE_COVERAGE_TOOLS[stack] ?? "c8";
+}
+function generateAgentsMdContent(projectDir, stack) {
+  if (Array.isArray(stack) && stack.length > 1) {
+    return generateMultiStackAgentsMd(projectDir, stack);
+  }
+  if (Array.isArray(stack)) {
+    stack = stack.length === 1 ? stack[0].stack : null;
+  }
+  const projectName = basename2(projectDir);
+  const provider = stack ? getStackProvider(stack) : void 0;
+  const stackLabel = provider ? stackDisplayName(stack) : "Unknown";
+  const lines = [
+    `# ${projectName}`,
+    "",
+    "## Stack",
+    "",
+    `- **Language/Runtime:** ${stackLabel}`,
+    "",
+    "## Build & Test Commands",
+    ""
+  ];
+  if (provider) {
+    appendBuildTestCommands(lines, provider.name, "");
+  } else {
+    lines.push("```bash", "# No recognized stack \u2014 add build/test commands here", "```");
+  }
+  lines.push(
+    "",
+    "## Project Structure",
+    "",
+    "```",
+    `${projectName}/`,
+    "\u251C\u2500\u2500 src/           # Source code",
+    "\u251C\u2500\u2500 tests/         # Test files",
+    "\u251C\u2500\u2500 docs/          # Documentation",
+    "\u2514\u2500\u2500 .claude/       # Codeharness state",
+    "```",
+    "",
+    "## Conventions",
+    "",
+    "- All changes must pass tests before commit",
+    "- Maintain test coverage targets",
+    "- Follow existing code style and patterns",
+    ""
+  );
+  return lines.join("\n");
+}
+function stackDisplayName(stack) {
+  const provider = getStackProvider(stack);
+  if (!provider) return "Unknown";
+  return provider.displayName.replace(/ \(.*\)$/, "");
+}
+function appendBuildTestCommands(lines, stack, prefix) {
+  const provider = getStackProvider(stack);
+  if (!provider) return;
+  const buildCmds = provider.getBuildCommands();
+  const testCmds = provider.getTestCommands();
+  lines.push("```bash");
+  for (const cmd of buildCmds) {
+    lines.push(`${prefix}${cmd}`);
+  }
+  for (const cmd of testCmds) {
+    lines.push(`${prefix}${cmd}`);
+  }
+  lines.push("```");
+}
+function generateMultiStackAgentsMd(projectDir, stacks) {
+  const projectName = basename2(projectDir);
+  const stackNames = stacks.map((s) => stackDisplayName(s.stack));
+  const lines = [
+    `# ${projectName}`,
+    "",
+    "## Stack",
+    "",
+    `- **Language/Runtime:** ${stackNames.join(" + ")}`,
+    "",
+    "## Build & Test Commands",
+    ""
+  ];
+  for (const detection of stacks) {
+    const label = stackDisplayName(detection.stack);
+    const heading = detection.dir === "." ? `### ${label}` : `### ${label} (${detection.dir}/)`;
+    const prefix = detection.dir === "." ? "" : `cd ${detection.dir} && `;
+    lines.push(heading, "");
+    appendBuildTestCommands(lines, detection.stack, prefix);
+    lines.push("");
+  }
+  lines.push(
+    "## Project Structure",
+    "",
+    "```",
+    `${projectName}/`,
+    "\u251C\u2500\u2500 src/           # Source code",
+    "\u251C\u2500\u2500 tests/         # Test files",
+    "\u251C\u2500\u2500 docs/          # Documentation",
+    "\u2514\u2500\u2500 .claude/       # Codeharness state",
+    "```",
+    "",
+    "## Conventions",
+    "",
+    "- All changes must pass tests before commit",
+    "- Maintain test coverage targets",
+    "- Follow existing code style and patterns",
+    ""
+  );
+  return lines.join("\n");
+}
+function generateDocsIndexContent() {
+  return [
+    "# Project Documentation",
+    "",
+    "## Planning Artifacts",
+    "- [Product Requirements](../_bmad-output/planning-artifacts/prd.md)",
+    "- [Architecture](../_bmad-output/planning-artifacts/architecture.md)",
+    "- [Epics & Stories](../_bmad-output/planning-artifacts/epics.md)",
+    "",
+    "## Execution",
+    "- [Active Exec Plans](exec-plans/active/)",
+    "- [Completed Exec Plans](exec-plans/completed/)",
+    "",
+    "## Quality",
+    "- [Quality Reports](quality/)",
+    "- [Generated Reports](generated/)",
+    ""
+  ].join("\n");
+}
+async function scaffoldDocs(opts) {
+  try {
+    let agentsMd = "skipped";
+    let docsScaffold = "skipped";
+    let readme = "skipped";
+    const agentsMdPath = join13(opts.projectDir, "AGENTS.md");
+    if (!existsSync12(agentsMdPath)) {
+      const stackArg = opts.stacks && opts.stacks.length > 1 ? opts.stacks : opts.stack;
+      const content = generateAgentsMdContent(opts.projectDir, stackArg);
+      generateFile(agentsMdPath, content);
+      agentsMd = "created";
+    } else {
+      agentsMd = "exists";
+    }
+    const docsDir = join13(opts.projectDir, "docs");
+    if (!existsSync12(docsDir)) {
+      generateFile(join13(docsDir, "index.md"), generateDocsIndexContent());
+      generateFile(join13(docsDir, "exec-plans", "active", ".gitkeep"), "");
+      generateFile(join13(docsDir, "exec-plans", "completed", ".gitkeep"), "");
+      generateFile(join13(docsDir, "quality", ".gitkeep"), DO_NOT_EDIT_HEADER);
+      generateFile(join13(docsDir, "generated", ".gitkeep"), DO_NOT_EDIT_HEADER);
+      docsScaffold = "created";
+    } else {
+      docsScaffold = "exists";
+    }
+    const readmePath = join13(opts.projectDir, "README.md");
+    if (!existsSync12(readmePath)) {
+      let cliHelpOutput = "";
+      try {
+        const { execFileSync: execFileSync13 } = await import("child_process");
+        cliHelpOutput = execFileSync13(process.execPath, [process.argv[1], "--help"], {
+          stdio: "pipe",
+          timeout: 1e4
+        }).toString();
+      } catch {
+        cliHelpOutput = "Run: codeharness --help";
+      }
+      const readmeStack = opts.stacks && opts.stacks.length > 1 ? opts.stacks.map((s) => s.stack) : opts.stack;
+      const readmeContent = readmeTemplate({
+        projectName: getProjectName(opts.projectDir),
+        stack: readmeStack,
+        cliHelpOutput
+      });
+      generateFile(readmePath, readmeContent);
+      readme = "created";
+    } else {
+      readme = "exists";
+    }
+    const result = { agents_md: agentsMd, docs_scaffold: docsScaffold, readme };
+    if (!opts.isJson) {
+      if (result.agents_md === "created" || result.docs_scaffold === "created") {
+        ok("Documentation: AGENTS.md + docs/ scaffold created");
+      }
+      if (result.readme === "created") {
+        ok("Documentation: README.md created");
+      }
+    }
+    return ok2(result);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return fail2(`Documentation scaffold failed: ${message}`);
+  }
+}
+
+// src/modules/infra/dockerfile-template.ts
+import { existsSync as existsSync13, writeFileSync as writeFileSync8 } from "fs";
+import { join as join14 } from "path";
+function genericTemplate() {
+  return renderTemplateFile("templates/dockerfiles/Dockerfile.generic");
+}
+function runtimeCopyDirectives(stacks) {
+  const lines = [];
+  for (const stack of stacks) {
+    const provider = getStackProvider(stack);
+    if (provider) {
+      lines.push(provider.getRuntimeCopyDirectives());
+    }
+  }
+  return lines.join("\n");
+}
+function multiStageTemplate(detections) {
+  const supported = detections.filter((d) => getStackProvider(d.stack) !== void 0);
+  if (supported.length === 0) {
+    return genericTemplate();
+  }
+  const stacks = supported.map((d) => d.stack);
+  const buildStages = [];
+  for (const stack of stacks) {
+    const provider = getStackProvider(stack);
+    if (provider) {
+      buildStages.push(provider.getDockerBuildStage());
+    }
+  }
+  const copyLines = runtimeCopyDirectives(stacks);
+  return renderTemplateFile("templates/dockerfiles/Dockerfile.multi-stage.tmpl", {
+    BUILD_STAGES: buildStages.join("\n"),
+    COPY_DIRECTIVES: copyLines
+  });
+}
+function generateDockerfileTemplate(projectDir, stackOrDetections) {
+  if (!projectDir) {
+    return fail2("projectDir is required");
+  }
+  const dockerfilePath = join14(projectDir, "Dockerfile");
+  if (existsSync13(dockerfilePath)) {
+    return fail2("Dockerfile already exists");
+  }
+  if (Array.isArray(stackOrDetections) && stackOrDetections.length > 1) {
+    const content2 = multiStageTemplate(stackOrDetections);
+    const stacks = stackOrDetections.map((d) => d.stack);
+    try {
+      writeFileSync8(dockerfilePath, content2, "utf-8");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return fail2(`Failed to write Dockerfile: ${message}`);
+    }
+    return ok2({ path: dockerfilePath, stack: stacks[0], stacks });
+  }
+  const stack = Array.isArray(stackOrDetections) ? stackOrDetections.length === 1 ? stackOrDetections[0].stack : null : stackOrDetections;
+  let content;
+  let resolvedStack;
+  const provider = stack ? getStackProvider(stack) : void 0;
+  if (provider) {
+    content = provider.getDockerfileTemplate();
+    resolvedStack = provider.name;
+  } else {
+    content = genericTemplate();
+    resolvedStack = "generic";
+  }
+  try {
+    writeFileSync8(dockerfilePath, content, "utf-8");
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return fail2(`Failed to write Dockerfile: ${message}`);
+  }
+  return ok2({ path: dockerfilePath, stack: resolvedStack, stacks: [resolvedStack] });
+}
+
+// src/modules/infra/init-project.ts
+var HARNESS_VERSION = true ? "0.25.3" : "0.0.0-dev";
+function failResult(opts, error) {
+  return {
+    status: "fail",
+    stack: null,
+    stacks: [],
+    error,
+    enforcement: { frontend: opts.frontend, database: opts.database, api: opts.api },
+    documentation: { agents_md: "skipped", docs_scaffold: "skipped", readme: "skipped" }
+  };
+}
+function emitError(error, isJson) {
+  if (isJson) {
+    jsonOutput({ status: "fail", error });
+  } else {
+    fail(error);
+  }
+  process.exitCode = 1;
+}
+async function initProject(opts) {
+  try {
+    return await initProjectInner(opts);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return fail2(`Unexpected init error: ${message}`);
+  }
+}
+async function initProjectInner(opts) {
+  const { projectDir, json: isJson = false } = opts;
+  const result = {
+    status: "ok",
+    stack: null,
+    stacks: [],
+    enforcement: { frontend: opts.frontend, database: opts.database, api: opts.api },
+    documentation: { agents_md: "skipped", docs_scaffold: "skipped", readme: "skipped" }
+  };
+  const rerunResult = handleRerun(opts, result);
+  if (rerunResult !== null) return rerunResult;
+  const validBackends = ["victoria", "elk", "none"];
+  if (opts.observabilityBackend !== void 0 && !validBackends.includes(opts.observabilityBackend)) {
+    const msg = `Invalid --observability-backend '${opts.observabilityBackend}'. Must be one of: ${validBackends.join(", ")}`;
+    emitError(msg, isJson);
+    return ok2(failResult(opts, msg));
+  }
+  const urlError = validateRemoteUrls(opts);
+  if (urlError !== null) {
+    emitError(urlError, isJson);
+    return ok2(failResult(opts, urlError));
+  }
+  const allStacks = detectStacks(projectDir);
+  const rootDetection = allStacks.find((s) => s.dir === ".");
+  const stack = rootDetection ? rootDetection.stack : null;
+  if (!stack && !isJson) warn("No recognized stack detected");
+  result.stack = stack;
+  result.stacks = [...new Set(allStacks.map((s) => s.stack))];
+  const appType = detectAppType(projectDir, stack);
+  result.app_type = appType;
+  if (!isJson) {
+    if (result.stacks.length > 0) {
+      info(`Stack detected: ${getStackLabel(result.stacks)}`);
+    } else if (stack) {
+      info(`Stack detected: ${getStackLabel(stack)}`);
+    }
+    info(`App type: ${appType}`);
+  }
+  const dfResult = generateDockerfileTemplate(projectDir, allStacks);
+  if (isOk(dfResult)) {
+    result.dockerfile = { generated: true, stack: dfResult.data.stack, stacks: dfResult.data.stacks };
+    if (!isJson) info(`Generated Dockerfile for ${dfResult.data.stacks.join("+") || dfResult.data.stack} project.`);
+  } else {
+    if (!isJson) info("Dockerfile already exists -- skipping template generation.");
+  }
+  const dockerCheck = checkDocker({ observability: opts.observability, otelEndpoint: opts.otelEndpoint, logsUrl: opts.logsUrl, opensearchUrl: opts.opensearchUrl, isJson });
+  if (!isOk(dockerCheck)) return fail2(dockerCheck.error);
+  const { available: dockerAvailable, criticalFailure, dockerResult: criticalDockerResult } = dockerCheck.data;
+  if (criticalFailure) {
+    result.status = "fail";
+    result.error = "Docker not installed";
+    result.docker = criticalDockerResult;
+    if (isJson) {
+      jsonOutput(result);
+    } else {
+      fail("Docker not installed");
+      info("\u2192 Install Docker: https://docs.docker.com/engine/install/");
+      info("\u2192 Or skip observability: codeharness init --no-observability");
+    }
+    process.exitCode = 1;
+    return ok2(result);
+  }
+  const depResult = installDeps({ isJson });
+  if (!isOk(depResult)) {
+    result.status = "fail";
+    result.error = depResult.error;
+    if (isJson) {
+      jsonOutput(result);
+    } else {
+      info("Critical dependency failed \u2014 aborting init");
+    }
+    process.exitCode = 1;
+    return ok2(result);
+  }
+  result.dependencies = depResult.data;
+  result.beads = initializeBeads(projectDir, isJson);
+  const bmadResult = setupBmad({ projectDir, isJson });
+  if (isOk(bmadResult)) result.bmad = bmadResult.data;
+  let state = getDefaultState(stack);
+  state.harness_version = HARNESS_VERSION;
+  state.initialized = true;
+  state.app_type = appType;
+  state.enforcement = { frontend: opts.frontend, database: opts.database, api: opts.api };
+  const coverageTools = {};
+  for (const detection of allStacks) {
+    coverageTools[detection.stack] = getCoverageTool(detection.stack);
+  }
+  state.coverage.tool = getCoverageTool(stack);
+  state.coverage.tools = coverageTools;
+  state.stacks = result.stacks;
+  writeState(state, projectDir);
+  if (!isJson) ok("State file: .claude/codeharness.local.md created");
+  const docsResult = await scaffoldDocs({ projectDir, stack, stacks: allStacks, isJson });
+  if (isOk(docsResult)) result.documentation = docsResult.data;
+  const obsBackend = opts.observabilityBackend ?? "victoria";
+  if (obsBackend === "none") {
+    state.otlp = { enabled: false, endpoint: "", service_name: basename3(projectDir), mode: "local-shared", backend: "none" };
+    writeState(state, projectDir);
+    result.otlp = { status: "skipped", packages_installed: false, start_script_patched: false, env_vars_configured: false };
+    if (!isJson) info("Observability: disabled (--observability-backend none)");
+    if (!isJson) {
+      const e = state.enforcement;
+      const fmt = (v) => v ? "ON" : "OFF";
+      ok(`Enforcement: frontend:${fmt(e.frontend)} database:${fmt(e.database)} api:${fmt(e.api)} observability:OFF`);
+      info("Harness initialized. Run: codeharness bridge --epics <path>");
+    }
+    if (isJson) jsonOutput(result);
+    return ok2(result);
+  }
+  if (!opts.observability) {
+    result.otlp = { status: "skipped", packages_installed: false, start_script_patched: false, env_vars_configured: false };
+    if (!isJson) info("OTLP: skipped (--no-observability)");
+  } else {
+    for (const detection of allStacks) {
+      const stackDir = detection.dir === "." ? projectDir : join15(projectDir, detection.dir);
+      const stackOtlp = instrumentProject(stackDir, detection.stack, { json: isJson, appType });
+      if (detection.dir === "." && detection.stack === stack) {
+        result.otlp = stackOtlp;
+      }
+    }
+    if (!result.otlp) {
+      result.otlp = instrumentProject(projectDir, stack, { json: isJson, appType });
+    }
+  }
+  try {
+    const u = readState(projectDir);
+    if (u.otlp) state.otlp = u.otlp;
+  } catch {
+  }
+  if (!state.otlp) {
+    state.otlp = { enabled: true, endpoint: "http://localhost:4318", service_name: basename3(projectDir), mode: "local-shared" };
+  }
+  state.otlp.backend = obsBackend;
+  writeState(state, projectDir);
+  const dockerSetup = setupDocker({
+    observability: opts.observability,
+    otelEndpoint: opts.otelEndpoint,
+    opensearchUrl: opts.opensearchUrl,
+    logsUrl: opts.logsUrl,
+    metricsUrl: opts.metricsUrl,
+    tracesUrl: opts.tracesUrl,
+    isJson,
+    dockerAvailable,
+    appType,
+    state,
+    projectDir
+  });
+  if (isOk(dockerSetup)) result.docker = dockerSetup.data.docker;
+  if (!isJson) {
+    const e = state.enforcement;
+    const fmt = (v) => v ? "ON" : "OFF";
+    ok(`Enforcement: frontend:${fmt(e.frontend)} database:${fmt(e.database)} api:${fmt(e.api)} observability:ON`);
+    info("Harness initialized. Run: codeharness bridge --epics <path>");
+  }
+  if (isJson) jsonOutput(result);
+  return ok2(result);
+}
+function handleRerun(opts, result) {
+  const { projectDir, json: isJson = false } = opts;
+  if (!existsSync14(getStatePath(projectDir))) return null;
+  try {
+    const existingState = readState(projectDir);
+    const legacyObsDisabled = existingState.enforcement.observability === false;
+    if (!existingState.initialized || legacyObsDisabled) {
+      if (legacyObsDisabled && !isJson) info("Observability upgraded from disabled to enabled");
+      return null;
+    }
+    result.stack = existingState.stack;
+    result.stacks = existingState.stacks ?? [];
+    result.enforcement = existingState.enforcement;
+    result.documentation = { agents_md: "exists", docs_scaffold: "exists", readme: "exists" };
+    result.dependencies = verifyDeps(isJson);
+    result.docker = existingState.docker ? { compose_file: existingState.docker.compose_file, stack_running: existingState.docker.stack_running, services: [], ports: existingState.docker.ports } : null;
+    const bmadResult = verifyBmadOnRerun(projectDir, isJson);
+    if (bmadResult) result.bmad = bmadResult;
+    if (isJson) {
+      jsonOutput(result);
+    } else {
+      info("Harness already initialized \u2014 verifying configuration");
+      ok("Configuration verified");
+    }
+    return ok2(result);
+  } catch {
+    return null;
+  }
+}
+function validateRemoteUrls(opts) {
+  const remoteUrls = [opts.otelEndpoint, opts.opensearchUrl, opts.logsUrl, opts.metricsUrl, opts.tracesUrl].filter(Boolean);
+  for (const url of remoteUrls) {
+    if (!/^https?:\/\//i.test(url)) return `Invalid URL: '${url}' \u2014 must start with http:// or https://`;
+  }
+  if (opts.otelEndpoint && (opts.logsUrl || opts.metricsUrl || opts.tracesUrl)) {
+    return "Cannot combine --otel-endpoint with --logs-url/--metrics-url/--traces-url";
+  }
+  const hasAny = opts.logsUrl || opts.metricsUrl || opts.tracesUrl;
+  if (hasAny && !(opts.logsUrl && opts.metricsUrl && opts.tracesUrl)) {
+    return "When using remote backends, all three are required: --logs-url, --metrics-url, --traces-url";
+  }
+  return null;
+}
+
+// src/modules/infra/stack-management.ts
+import { execFileSync as execFileSync11 } from "child_process";
+
+// src/modules/infra/container-cleanup.ts
+import { execFileSync as execFileSync12 } from "child_process";
+var STALE_PATTERNS = ["codeharness-shared-", "codeharness-collector-", "codeharness-verify-"];
+function cleanupContainers() {
+  try {
+    if (!isDockerAvailable()) {
+      return ok2({ containersRemoved: 0, names: [] });
+    }
+    const staleNames = [];
+    for (const pattern of STALE_PATTERNS) {
+      try {
+        const output = execFileSync12(
+          "docker",
+          [
+            "ps",
+            "-a",
+            "--filter",
+            `name=${pattern}`,
+            "--filter",
+            "status=exited",
+            "--filter",
+            "status=dead",
+            "--format",
+            "{{.Names}}"
+          ],
+          { stdio: "pipe", timeout: 1e4 }
+        );
+        const names = output.toString().trim().split("\n").filter((n) => n.trim());
+        staleNames.push(...names);
+      } catch {
+      }
+    }
+    if (staleNames.length === 0) {
+      return ok2({ containersRemoved: 0, names: [] });
+    }
+    const removed = [];
+    for (const name of staleNames) {
+      try {
+        execFileSync12("docker", ["rm", "-f", name], {
+          stdio: "pipe",
+          timeout: 1e4
+        });
+        removed.push(name);
+      } catch {
+      }
+    }
+    return ok2({ containersRemoved: removed.length, names: removed });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return fail2(`Container cleanup failed: ${message}`);
+  }
+}
+
+// src/modules/infra/victoria-backend.ts
+var DEFAULT_LOGS_URL = `http://localhost:${DEFAULT_PORTS.logs}`;
+var DEFAULT_METRICS_URL = `http://localhost:${DEFAULT_PORTS.metrics}`;
+var DEFAULT_TRACES_URL = `http://localhost:${DEFAULT_PORTS.traces}`;
+
+// src/modules/infra/dockerfile-validator.ts
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
+import { join as join16 } from "path";
+var DEFAULT_RULES = {
+  requirePinnedFrom: true,
+  requireBinaryOnPath: true,
+  verificationTools: ["curl", "jq"],
+  forbidSourceCopy: true,
+  requireNonRootUser: true,
+  requireCacheCleanup: true
+};
+function dfGap(rule, description, suggestedFix, line) {
+  const g = { rule, description, suggestedFix };
+  if (line !== void 0) return { ...g, line };
+  return g;
+}
+function loadRules(projectDir) {
+  const rulesPath = join16(projectDir, "patches", "infra", "dockerfile-rules.md");
+  if (!existsSync15(rulesPath)) {
+    return {
+      rules: DEFAULT_RULES,
+      warnings: ["dockerfile-rules.md not found -- using defaults."]
+    };
+  }
+  return { rules: DEFAULT_RULES, warnings: [] };
+}
+function checkPinnedFrom(lines) {
+  const gaps = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!/^\s*FROM\s+/i.test(lines[i])) continue;
+    const ref = lines[i].replace(/^\s*FROM\s+/i, "").split(/\s+/)[0];
+    if (ref.endsWith(":latest")) {
+      gaps.push(dfGap("pinned-from", `unpinned base image -- use specific version.`, `Pin ${ref} to a specific version tag`, i + 1));
+    } else if (!ref.includes(":") && !ref.includes("@")) {
+      gaps.push(dfGap("pinned-from", `unpinned base image -- use specific version.`, `Pin ${ref} to a specific version tag (e.g., ${ref}:22-slim)`, i + 1));
+    }
+  }
+  return gaps;
+}
+function checkBinaryOnPath(lines) {
+  const content = lines.join("\n");
+  const hasBinary = /npm\s+install\s+(-g|--global)\b/i.test(content) || /pip\s+install\b/i.test(content) || /COPY\s+--from=/i.test(content);
+  if (!hasBinary) {
+    return [dfGap("binary-on-path", "project binary not installed.", "Add npm install -g, pip install, or COPY --from to install the project binary")];
+  }
+  return [];
+}
+function checkVerificationTools(lines, tools) {
+  const gaps = [];
+  for (const tool of tools) {
+    let found = false;
+    for (const line of lines) {
+      const lower = line.toLowerCase();
+      const isInstallLine = lower.includes("apt-get install") || lower.includes("apk add");
+      if (isInstallLine && new RegExp(`\\b${tool.toLowerCase()}\\b`).test(lower)) {
+        found = true;
+        break;
+      }
+    }
+    if (!found) {
+      gaps.push(dfGap("verification-tools", `verification tool missing: ${tool}`, `Install ${tool} via apt-get install or apk add`));
+    }
+  }
+  return gaps;
+}
+function checkNoSourceCopy(lines) {
+  const gaps = [];
+  const sourcePatterns = [/COPY\s+(?:--\S+\s+)*src\//i, /COPY\s+(?:--\S+\s+)*lib\//i, /COPY\s+(?:--\S+\s+)*test\//i];
+  for (let i = 0; i < lines.length; i++) {
+    for (const pattern of sourcePatterns) {
+      if (pattern.test(lines[i])) {
+        gaps.push(dfGap("no-source-copy", "source code copied into container -- use build artifact instead.", "Use COPY --from=builder or COPY dist/ instead of copying source", i + 1));
+      }
+    }
+  }
+  return gaps;
+}
+function checkNonRootUser(lines) {
+  const userLines = lines.filter((l) => /^\s*USER\s+/i.test(l));
+  if (userLines.length === 0) {
+    return [dfGap("non-root-user", "no non-root USER instruction found.", "Add USER <non-root-user> instruction (e.g., USER node)")];
+  }
+  const hasNonRoot = userLines.some((l) => {
+    const user = l.replace(/^\s*USER\s+/i, "").trim().split(/\s+/)[0];
+    return user.toLowerCase() !== "root";
+  });
+  if (!hasNonRoot) {
+    return [dfGap("non-root-user", "no non-root USER instruction found.", "Add USER <non-root-user> instruction (e.g., USER node)")];
+  }
+  return [];
+}
+function checkCacheCleanup(lines) {
+  const content = lines.join("\n");
+  const hasCleanup = /rm\s+-rf\s+\/var\/lib\/apt\/lists/i.test(content) || /rm\s+-rf\s+\/var\/cache\/apk/i.test(content) || /npm\s+cache\s+clean/i.test(content) || /pip\s+cache\s+purge/i.test(content);
+  if (!hasCleanup) {
+    return [dfGap("cache-cleanup", "no cache cleanup detected.", "Add cache cleanup: rm -rf /var/lib/apt/lists/*, npm cache clean --force, or pip cache purge")];
+  }
+  return [];
+}
+function validateDockerfile(projectDir) {
+  const dfPath = join16(projectDir, "Dockerfile");
+  if (!existsSync15(dfPath)) {
+    return fail2("No Dockerfile found");
+  }
+  let content;
+  try {
+    content = readFileSync13(dfPath, "utf-8");
+  } catch {
+    return fail2("Dockerfile exists but could not be read");
+  }
+  const lines = content.split("\n");
+  const fromLines = lines.filter((l) => /^\s*FROM\s+/i.test(l));
+  if (fromLines.length === 0) {
+    return fail2("Dockerfile has no FROM instruction");
+  }
+  const { rules, warnings } = loadRules(projectDir);
+  const gaps = [];
+  if (rules.requirePinnedFrom) gaps.push(...checkPinnedFrom(lines));
+  if (rules.requireBinaryOnPath) gaps.push(...checkBinaryOnPath(lines));
+  gaps.push(...checkVerificationTools(lines, rules.verificationTools));
+  if (rules.forbidSourceCopy) gaps.push(...checkNoSourceCopy(lines));
+  if (rules.requireNonRootUser) gaps.push(...checkNonRootUser(lines));
+  if (rules.requireCacheCleanup) gaps.push(...checkCacheCleanup(lines));
+  return ok2({
+    passed: gaps.length === 0,
+    gaps,
+    warnings
+  });
+}
+
+// src/modules/infra/index.ts
+async function initProject2(opts) {
+  return initProject(opts);
+}
+function cleanupContainers2() {
+  return cleanupContainers();
+}
+
+// src/lib/docker/cleanup.ts
+function cleanupOrphanedContainers() {
+  const result = cleanupContainers2();
+  return result.success ? result.data.containersRemoved : 0;
+}
+function cleanupVerifyEnv() {
+}
+
+export {
+  ok,
+  fail,
+  warn,
+  info,
+  jsonOutput,
+  getStackProvider,
+  detectStacks,
+  detectStack,
+  renderTemplateFile,
+  getStatePath,
+  writeState,
+  readState,
+  readStateWithBody,
+  StateFileNotFoundError,
+  getNestedValue,
+  setNestedValue,
+  parseValue,
+  NODE_REQUIRE_FLAG2 as NODE_REQUIRE_FLAG,
+  ok2,
+  fail2,
+  isOk,
+  isDockerAvailable,
+  isDockerComposeAvailable,
+  getStackHealth,
+  getCollectorHealth,
+  checkRemoteEndpoint,
+  getStackDir,
+  getComposeFilePath,
+  getElkComposeFilePath,
+  isStackRunning,
+  isSharedStackRunning,
+  startStack,
+  startSharedStack,
+  stopStack,
+  stopSharedStack,
+  startCollectorOnly,
+  isCollectorRunning,
+  stopCollectorOnly,
+  cleanupOrphanedContainers,
+  cleanupVerifyEnv,
+  removePatch,
+  isBeadsCLIInstalled,
+  createIssue,
+  closeIssue,
+  updateIssue,
+  listIssues,
+  isBeadsInitialized,
+  buildGapId,
+  createOrFindIssue,
+  PATCH_TARGETS,
+  isBmadInstalled,
+  parseEpicsFile,
+  importStoriesToBeads,
+  validateDockerfile,
+  initProject2 as initProject,
+  cleanupContainers2 as cleanupContainers
+};