coding-agent-harness 1.0.8 → 1.1.0

package/dist/lib/module-registry.mjs

@@ -0,0 +1,296 @@
+import fs from "node:fs";
+import path from "node:path";
+import { collectTasks } from "./task-scanner.mjs";
+import { normalizeLocale, normalizeTarget, readBundledTemplate, readFileSafe, renderTaskTemplate, todayDate, toPosix } from "./core-shared.mjs";
+import { assertRenderableHarnessManifest, renderHarnessManifest } from "./harness-paths.mjs";
+import { moduleTemplateFiles } from "./task-lifecycle/template-files.mjs";
+export const allowedHarnessModuleStatuses = new Set([
+    "planned",
+    "in-progress",
+    "blocked",
+    "ready-for-sync",
+    "integrating",
+    "completed",
+    "paused",
+    "cancelled",
+]);
+export function normalizeHarnessModuleKey(value) {
+    const normalized = String(value || "").trim().toLowerCase().replace(/[_\s]+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
+    if (!/^[a-z][a-z0-9-]*$/.test(normalized))
+        throw new Error(`Invalid module key: ${value || "<empty>"}`);
+    return normalized;
+}
+export function readHarnessModules(targetInput) {
+    const target = asHarnessTarget(targetInput);
+    return normalizeHarnessModules(target, target.harness.manifest?.modules || null);
+}
+export function registeredHarnessModule(targetInput, moduleKey) {
+    const key = normalizeHarnessModuleKey(moduleKey);
+    const modules = readHarnessModules(targetInput);
+    return modules.items[key] || null;
+}
+export function prepareModuleRegistration(targetInput, moduleKey, input, { dryRun = false, allowExisting = false } = {}) {
+    const target = asHarnessTarget(targetInput);
+    ensureV2Harness(target);
+    const key = normalizeHarnessModuleKey(moduleKey);
+    const modules = readHarnessModules(target);
+    const existed = Boolean(modules.items[key]);
+    if (existed && !allowExisting)
+        throw new Error(`Module already registered: ${key}`);
+    const module = normalizeModuleDefinition(target, key, { ...(modules.items[key] || {}), ...input });
+    modules.items[key] = module;
+    return writeModuleRegistryMutation(target, modules, key, { dryRun, action: existed ? "sync-module-registry" : "register-module", scaffold: true, locale: input.locale });
+}
+export function prepareModuleStepRegistrationUpdate(targetInput, moduleKey, { stepId, state, dryRun = false }) {
+    const target = asHarnessTarget(targetInput);
+    ensureV2Harness(target);
+    const key = normalizeHarnessModuleKey(moduleKey);
+    const modules = readHarnessModules(target);
+    const module = modules.items[key];
+    if (!module)
+        throw new Error(`Unknown module: ${key}. Register it first with: harness module register ${key} --title <title> --prefix <PREFIX> --scope <path> ${target.projectRoot}`);
+    module.currentStep = stepId;
+    module.status = mapStepStateToModuleStatus(state);
+    module.updated = todayDate();
+    return writeModuleRegistryMutation(target, modules, key, { dryRun, action: "sync-module-registry" });
+}
+export function prepareModuleUnregister(targetInput, moduleKey, { dryRun = false } = {}) {
+    const target = asHarnessTarget(targetInput);
+    ensureV2Harness(target);
+    const key = normalizeHarnessModuleKey(moduleKey);
+    const modules = readHarnessModules(target);
+    if (!modules.items[key])
+        throw new Error(`Module is not registered: ${key}`);
+    const blockers = moduleUnregisterBlockers(target, key);
+    if (blockers.length > 0)
+        throw new Error(`Cannot unregister module ${key}; references still exist:\n${blockers.map((item) => `- ${item}`).join("\n")}`);
+    delete modules.items[key];
+    const result = writeModuleRegistryMutation(target, modules, key, { dryRun, action: "unregister-module" });
+    return { moduleKey: key, changes: result.changes };
+}
+export function prepareModuleScaffold(targetInput, moduleKey, { dryRun = false, locale = "" } = {}) {
+    const target = asHarnessTarget(targetInput);
+    ensureV2Harness(target);
+    const key = normalizeHarnessModuleKey(moduleKey);
+    const modules = readHarnessModules(target);
+    const module = modules.items[key];
+    if (!module)
+        throw new Error(`Module is not registered: ${key}`);
+    return {
+        moduleKey: key,
+        changes: scaffoldModuleFiles(target, key, module, { dryRun, locale }),
+    };
+}
+export function moduleRegistryViewPath(targetInput) {
+    const target = asHarnessTarget(targetInput);
+    const modules = readHarnessModules(target);
+    const generatedView = modules.generatedView || defaultGeneratedView(target.harness);
+    return path.join(target.projectRoot, generatedView);
+}
+export function renderModuleRegistryView(targetInput, modulesInput = null) {
+    const target = asHarnessTarget(targetInput);
+    const modules = modulesInput || readHarnessModules(target);
+    const rows = Object.entries(modules.items || {}).sort(([left], [right]) => left.localeCompare(right)).map(([key, module]) => [
+        `M-${String(module.prefix || key).toUpperCase().replace(/[^A-Z0-9]+/g, "-")}`,
+        key,
+        module.title || key,
+        module.prefix || "",
+        module.branch || "",
+        module.currentStep || "",
+        module.status || "planned",
+        module.owner || "coordinator",
+        (module.scope || []).join("<br>") || "none",
+        (module.shared || []).join("<br>") || "none",
+        (module.dependsOn || []).join(", ") || "none",
+        module.plan || "none",
+        module.brief || "none",
+        module.updated || todayDate(),
+    ]);
+    return `# Module Registry
+
+Generated from \`harness.yaml\` \`modules.items\`. Do not edit this view directly.
+
+## Active Modules
+
+| ID | Key | Title | Prefix | Branch | Current Step | Status | Owner | Scope | Shared | Depends On | Plan | Brief | Updated |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+${rows.length ? rows.map((row) => `| ${row.map(escapeMarkdownCell).join(" | ")} |`).join("\n") : "| none | none | none | none | none | none | planned | none | none | none | none | none | none | none |"}
+`;
+}
+export function moduleRegistryRelativePaths(targetInput) {
+    const target = asHarnessTarget(targetInput);
+    return [
+        toPosix(path.relative(target.projectRoot, target.harness.manifestPath)),
+        toPosix(path.relative(target.projectRoot, moduleRegistryViewPath(target))),
+    ];
+}
+function writeModuleRegistryMutation(target, modules, moduleKey, { dryRun, action, scaffold = false, locale = "" }) {
+    assertRenderableHarnessManifest(target.harness.manifest);
+    const manifest = target.harness.manifest;
+    if (!manifest)
+        throw new Error("Missing harness.yaml");
+    const manifestRelative = toPosix(path.relative(target.projectRoot, target.harness.manifestPath));
+    const viewPath = moduleRegistryViewPath(target);
+    const viewRelative = toPosix(path.relative(target.projectRoot, viewPath));
+    const module = modules.items[moduleKey] || {};
+    const scaffoldChanges = scaffold ? scaffoldModuleFiles(target, moduleKey, module, { dryRun, locale }) : [];
+    if (!dryRun) {
+        manifest.modules = modules;
+        fs.mkdirSync(path.dirname(target.harness.manifestPath), { recursive: true });
+        fs.writeFileSync(target.harness.manifestPath, renderHarnessManifest({
+            locale: manifest.locale,
+            capabilities: manifest.capabilities || [],
+            structure: manifest.structure,
+            modules,
+        }));
+        fs.mkdirSync(path.dirname(viewPath), { recursive: true });
+        fs.writeFileSync(viewPath, renderModuleRegistryView(target, modules));
+    }
+    return {
+        moduleKey,
+        module,
+        changes: [
+            { destination: manifestRelative, action: dryRun ? `would-${action}` : action, surface: "harness-manifest" },
+            { destination: viewRelative, action: dryRun ? `would-${action}` : action, surface: "module-registry-view" },
+            ...scaffoldChanges,
+        ],
+    };
+}
+function scaffoldModuleFiles(target, moduleKey, module, { dryRun, locale }) {
+    const moduleDir = path.join(target.harness.modulesRoot, moduleKey);
+    const normalizedLocale = normalizeLocale(locale || target.harness.manifest?.locale || "en-US");
+    const changes = [];
+    for (const [destination, source] of moduleTemplateFiles({ locale: normalizedLocale })) {
+        const destinationPath = path.join(moduleDir, destination);
+        if (fs.existsSync(destinationPath))
+            continue;
+        const relative = toPosix(path.relative(target.projectRoot, destinationPath));
+        changes.push({
+            destination: relative,
+            action: dryRun ? "would-create-module-file" : "create-module-file",
+            surface: "module-scaffold",
+        });
+        if (dryRun)
+            continue;
+        fs.mkdirSync(path.dirname(destinationPath), { recursive: true });
+        fs.writeFileSync(destinationPath, renderTaskTemplate(readBundledTemplate(source), {
+            taskId: moduleKey,
+            title: module.title || moduleKey,
+            locale: normalizedLocale,
+            budget: "standard",
+            moduleKey,
+            target,
+        }));
+    }
+    return changes;
+}
+function normalizeHarnessModules(target, modules) {
+    return {
+        schema: modules?.schema || "harness-modules/v1",
+        generatedView: modules?.generatedView || defaultGeneratedView(target.harness),
+        items: { ...(modules?.items || {}) },
+    };
+}
+function normalizeModuleDefinition(target, key, input) {
+    const scope = normalizeStringList(input.scope || []);
+    const title = String(input.title || "").trim();
+    const prefix = String(input.prefix || "").trim().toUpperCase();
+    if (!title)
+        throw new Error(`Module ${key} requires --title`);
+    if (!/^[A-Z][A-Z0-9-]{1,12}$/.test(prefix))
+        throw new Error(`Module ${key} requires --prefix with 2-13 uppercase letters, digits, or dashes`);
+    if (scope.length === 0)
+        throw new Error(`Module ${key} requires at least one --scope path`);
+    const status = normalizeModuleStatus(input.status || "planned");
+    const moduleDir = toPosix(path.relative(target.projectRoot, path.join(target.harness.modulesRoot, key)));
+    const module = {
+        title,
+        prefix,
+        status,
+        branch: String(input.branch || `codex/${key}`).trim(),
+        owner: String(input.owner || "coordinator").trim(),
+        currentStep: String(input.currentStep || "").trim(),
+        scope,
+        shared: normalizeStringList(input.shared || []),
+        dependsOn: normalizeStringList(input.dependsOn || []),
+        plan: String(input.plan || `${moduleDir}/module_plan.md`).trim(),
+        brief: String(input.brief || `${moduleDir}/brief.md`).trim(),
+        updated: String(input.updated || todayDate()).trim(),
+    };
+    validateModulePaths(target, key, module);
+    return module;
+}
+function normalizeModuleStatus(value) {
+    const normalized = String(value || "planned").trim().toLowerCase().replaceAll("_", "-");
+    if (!allowedHarnessModuleStatuses.has(normalized))
+        throw new Error(`Invalid module status: ${value}. Expected one of: ${[...allowedHarnessModuleStatuses].join(", ")}`);
+    return normalized;
+}
+function normalizeStringList(values) {
+    return [...new Set((values || []).flatMap((value) => String(value || "").split(",")).map((value) => value.trim()).filter(Boolean))];
+}
+function validateModulePaths(target, key, module) {
+    for (const [field, values] of Object.entries({ scope: module.scope || [], shared: module.shared || [], plan: [module.plan || ""], brief: [module.brief || ""] })) {
+        for (const value of values)
+            validateProjectRelativePath(target, `modules.items.${key}.${field}`, value);
+    }
+}
+function validateProjectRelativePath(target, field, value) {
+    const raw = String(value || "").trim();
+    if (!raw || raw === "none")
+        return;
+    if (path.isAbsolute(raw) || raw.split(/[\\/]+/).includes(".."))
+        throw new Error(`Invalid ${field}: path must stay project-relative: ${raw}`);
+    const resolved = path.resolve(target.projectRoot, raw.replace(/\*\*/g, "__glob__").replace(/\*/g, "__glob__"));
+    const relative = path.relative(target.projectRoot, resolved);
+    if (relative.startsWith("..") || path.isAbsolute(relative))
+        throw new Error(`Invalid ${field}: path escapes project root: ${raw}`);
+}
+function moduleUnregisterBlockers(target, key) {
+    const blockers = [];
+    const moduleDir = path.join(target.harness.modulesRoot, key);
+    const taskDir = path.join(moduleDir, "tasks");
+    if (fs.existsSync(taskDir) && fs.readdirSync(taskDir).length > 0)
+        blockers.push(toPosix(path.relative(target.projectRoot, taskDir)));
+    for (const task of collectTasks(target)) {
+        if (task.module === key)
+            blockers.push(String(task.id || task.taskPlanPath || key));
+    }
+    const ledger = readFileSafe(target.harness.ledgerPath);
+    if (ledger.includes(`| module | ${key} |`) || ledger.includes(`/modules/${key}/`))
+        blockers.push(toPosix(path.relative(target.projectRoot, target.harness.ledgerPath)));
+    return [...new Set(blockers)];
+}
+function defaultGeneratedView(paths) {
+    return toPosix(path.relative(paths.projectRoot, path.join(paths.modulesRoot, "Module-Registry.md")));
+}
+function mapStepStateToModuleStatus(state) {
+    if (state === "done")
+        return "completed";
+    if (state === "in-progress")
+        return "in-progress";
+    if (state === "blocked")
+        return "blocked";
+    if (state === "superseded")
+        return "cancelled";
+    return "planned";
+}
+function escapeMarkdownCell(value) {
+    return String(value || "").replace(/\|/g, "\\|").replace(/\r?\n/g, "<br>");
+}
+function ensureV2Harness(target) {
+    if (target.harness.version !== 2 || !target.harness.manifest)
+        throw new Error("Module registry requires a v2 harness.yaml manifest");
+}
+function asHarnessTarget(targetInput) {
+    const candidate = typeof targetInput === "string" ? normalizeTarget(targetInput) : targetInput;
+    if (isResolvedHarnessPaths(candidate.harness))
+        return { projectRoot: candidate.projectRoot, docsRoot: candidate.harness.docsRoot, harness: candidate.harness };
+    const normalized = normalizeTarget(candidate.projectRoot);
+    if (!isResolvedHarnessPaths(normalized.harness))
+        throw new Error("Could not resolve harness paths for module registry target");
+    return { projectRoot: normalized.projectRoot, docsRoot: normalized.harness.docsRoot, harness: normalized.harness };
+}
+function isResolvedHarnessPaths(value) {
+    return Boolean(value && typeof value === "object" && "version" in value && "manifestPath" in value && "modulesRoot" in value);
+}

package/dist/lib/preset-audit-contracts.mjs

@@ -6,7 +6,7 @@ export function validateTaskPresetAuditSnapshot(target, task, presetPackage) {
     const failures = [];
     if (!presetPackage?.audit?.manifestRequired)
         return failures;
-    const bundle = String(task.evidenceBundle || "").replace(/^TARGET:/, "").replace(/^\/+/, "");
+    const bundle = normalizeTargetRelativePath(task.evidenceBundle || "", "preset Evidence Bundle");
     if (!bundle) {
         failures.push(`${task.path} ${task.taskPreset} preset missing Evidence Bundle for manifest audit`);
         return failures;
@@ -36,5 +36,28 @@ export function validateTaskPresetAuditSnapshot(target, task, presetPackage) {
     else if (audit.manifestSha256 !== presetPackage.manifestSha256) {
         failures.push(`${task.path} ${task.taskPreset} preset manifest hash mismatch: task audit ${audit.manifestSha256}, current ${presetPackage.manifestSha256}`);
     }
+    const auditScriptSha256s = asRecord(audit.scriptSha256s);
+    const currentScriptSha256s = asRecord(presetPackage.scriptSha256s);
+    if (Object.keys(auditScriptSha256s).length > 0 && !recordsEqual(auditScriptSha256s, currentScriptSha256s)) {
+        failures.push(`${task.path} ${task.taskPreset} preset script hash mismatch`);
+    }
     return failures;
 }
+function asRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+function normalizeTargetRelativePath(value, label) {
+    const raw = String(value || "").replace(/^TARGET:/, "").replace(/^\/+/, "").trim();
+    if (!raw)
+        return "";
+    const normalized = toPosix(path.normalize(raw));
+    if (path.isAbsolute(raw) || normalized === "." || normalized === ".." || normalized.startsWith("../") || normalized.includes("/../")) {
+        throw new Error(`${label} escapes target root: ${raw}`);
+    }
+    return normalized;
+}
+function recordsEqual(left, right) {
+    const leftEntries = Object.entries(left).map(([key, value]) => [key, String(value)]).sort(([a], [b]) => a.localeCompare(b));
+    const rightEntries = Object.entries(right).map(([key, value]) => [key, String(value)]).sort(([a], [b]) => a.localeCompare(b));
+    return JSON.stringify(leftEntries) === JSON.stringify(rightEntries);
+}

package/dist/lib/preset-engine.mjs

@@ -1,10 +1,9 @@
-// @ts-nocheck
 // Preset task rendering stays behavior-first until preset/session domain types are modeled.
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { readJsonSafe, repoRoot, taskContractMarker, toPosix, visualMapFile } from "./core-shared.mjs";
+import { harnessPathContext, readJsonSafe, repoRoot, resolveHarnessPathTemplate, taskContractMarker, toPosix, visualMapFile } from "./core-shared.mjs";
 import { verifyMigrationSession } from "./migration-planner.mjs";
 import { buildPresetAudit, renderPresetTemplate } from "./preset-registry.mjs";
 import { legacyPath, legacyPlanningRoot, legacyTaskRoot, v2HarnessRoot, } from "./harness-paths.mjs";
@@ -31,17 +30,18 @@ export function resolvePresetInputs(preset, { cliArgs = [], fromSession = "", ta
             let readError = null;
             const value = readJsonSafe(filePath, null, { onError: (error) => { readError = error; } });
             if (value === null)
-                throw new Error(`Invalid preset JSON input ${declaration.flag || name}: ${readError?.message || "unknown parse error"}`);
-            if (declaration.validateOperation && value.operation !== declaration.validateOperation) {
+                throw new Error(`Invalid preset JSON input ${declaration.flag || name}: ${errorMessage(readError)}`);
+            const sessionInput = asRecord(value);
+            if (declaration.validateOperation && sessionInput.operation !== declaration.validateOperation) {
                 throw new Error(`${preset.id} preset requires ${declaration.flag || name} operation ${declaration.validateOperation}`);
             }
-            if (declaration.rejectPlanOnly && value.planOnly)
+            if (declaration.rejectPlanOnly && sessionInput.planOnly)
                 throw new Error(`${preset.id} preset cannot use plan-only session evidence`);
-            if (declaration.requireTarget && (!value.target || !fs.existsSync(value.target)))
-                throw new Error(`Preset input target missing: ${value.target || "(none)"}`);
+            if (declaration.requireTarget && (!sessionInput.target || !fs.existsSync(String(sessionInput.target))))
+                throw new Error(`Preset input target missing: ${sessionInput.target || "(none)"}`);
             if (declaration.targetFromSession)
-                targetFromInput = value.target || targetFromInput;
-            inputs[name] = { ...value, sourcePath: filePath };
+                targetFromInput = String(sessionInput.target || targetFromInput);
+            inputs[name] = { ...sessionInput, sourcePath: filePath };
             continue;
         }
         inputs[name] = rawValue == null || rawValue === "" ? declaration.default || "" : String(rawValue);
@@ -51,7 +51,7 @@ export function resolvePresetInputs(preset, { cliArgs = [], fromSession = "", ta
         targetInput: targetFromInput || targetInput,
     };
 }
-export function evaluateTemplateValues(preset, resolvedInputs, { taskId = "", taskTitle = "", moduleKey = "" } = {}) {
+export function evaluateTemplateValues(preset, resolvedInputs, { taskId = "", taskTitle = "", moduleKey = "", target = null } = {}) {
     const computed = computedValues(preset, resolvedInputs);
     const base = {
         inputs: resolvedInputs,
@@ -67,11 +67,13 @@ export function evaluateTemplateValues(preset, resolvedInputs, { taskId = "", ta
             moduleKey,
             kind: preset.task?.kind || "general",
         },
+        paths: target ? harnessPathContext(target) : {},
     };
     const values = {
         preset: preset.id,
         presetVersion: String(preset.version),
         kind: preset.task?.kind || "general",
+        paths: base.paths,
         ...computed,
     };
     for (const [name, declaration] of Object.entries(preset.templateValues || {})) {
@@ -90,14 +92,16 @@ export function evaluateTemplateValues(preset, resolvedInputs, { taskId = "", ta
 export function buildPresetContext(preset, { target, taskDir, taskId, taskTitle, resolvedInputs, evaluatedValues }) {
     const taskRelativeDir = toPosix(path.relative(target.projectRoot, taskDir));
     const evidenceBundle = presetEvidenceBundle(preset, { target, taskDir, evaluatedValues });
+    const resolvedScopes = resolvePresetScopes(preset, target);
     const audit = buildPresetAudit(preset, {
         taskId,
         targetRoot: target.projectRoot,
         entrypoint: "newTask",
+        writeScopes: resolvedScopes.entrypoints.newTask || resolvedScopes.writeScopes,
         resolvedInputs,
     });
     const context = {
-        kind: evaluatedValues.kind || preset.task?.kind || "general",
+        kind: String(evaluatedValues.kind || preset.task?.kind || "general"),
         preset: preset.id,
         presetVersion: String(preset.version),
         presetPackage: preset,
@@ -114,8 +118,8 @@ export function buildPresetContext(preset, { target, taskDir, taskId, taskTitle,
         migrationAchievedLevel: evaluatedValues.migrationAchievedLevel || "",
         evidenceBundle,
     };
-    context.evidenceFiles = generateEvidenceFiles(preset, { target, taskDir, context });
-    const resources = generateResourceFiles(preset, { context });
+    context.evidenceFiles = generateEvidenceFiles(preset, { target, context });
+    const resources = generateResourceFiles(preset, { target, context });
     context.resourceFiles = resources.files;
     context.resourceIndexRows = resources.indexRows;
     return context;
@@ -138,7 +142,7 @@ export function renderPresetTaskTemplate(destination, content, presetContext) {
         "review.md": "reviewSeed",
         [visualMapFile]: "visualMapAppend",
     }[destination];
-    const templatePath = presetContext.presetPackage?.newTaskTemplates?.[templateKey];
+    const templatePath = templateKey ? presetContext.presetPackage?.newTaskTemplates?.[templateKey] : "";
     if (templatePath) {
         next = `${next.trimEnd()}\n\n${renderPresetTemplate(presetContext.presetPackage, templatePath, presetContext.values).trimEnd()}\n`;
     }
@@ -162,17 +166,36 @@ export function renderPresetResourceIndex(content, kind, rows) {
     }
     return `${String(content || "").trimEnd()}\n${renderedRows.join("\n")}\n`;
 }
-export function assertPresetWriteScope(preset, relativePath) {
+export function assertPresetWriteScope(preset, relativePath, target = null) {
+    return assertPresetWriteScopeForTarget(preset, relativePath, target);
+}
+export function assertPresetWriteScopeForTarget(preset, relativePath, target = null) {
     const normalized = toPosix(path.normalize(relativePath));
     if (normalized.startsWith("../") || path.isAbsolute(normalized)) {
         throw new Error(`Preset write scope violation for ${relativePath}`);
     }
-    if (!preset.writeScopes.some((scope) => normalizedPresetScopes(scope.path).some((candidate) => matchesScope(candidate, normalized)))) {
+    const scopes = target ? resolvePresetScopes(preset, target).writeScopes : preset.writeScopes.flatMap((scope) => normalizedPresetScopes(scope.path));
+    if (!scopes.some((candidate) => matchesScope(candidate, normalized))) {
         throw new Error(`Preset write scope violation for ${normalized}`);
     }
 }
-function normalizedPresetScopes(scopePath) {
-    const scope = toPosix(path.normalize(String(scopePath || "")));
+export function resolvePresetScopes(preset, target) {
+    const writeScopes = preset.writeScopes.flatMap((scope) => normalizedPresetScopes(scope.path, target));
+    const entrypoints = {};
+    for (const [name, entrypoint] of Object.entries(preset.entrypoints || {})) {
+        entrypoints[name] = (entrypoint.writes || []).flatMap((scope) => normalizedPresetScopes(scope, target));
+    }
+    const reads = {};
+    for (const [name, entrypoint] of Object.entries(preset.entrypoints || {})) {
+        reads[name] = (entrypoint.reads || []).flatMap((scope) => normalizedPresetScopes(scope, target));
+    }
+    return { writeScopes, entrypoints, reads };
+}
+function normalizedPresetScopes(scopePath, target = null) {
+    const raw = String(scopePath || "");
+    const scope = target && raw.includes("{{")
+        ? resolveHarnessPathTemplate(raw, target, "preset scope")
+        : toPosix(path.normalize(raw));
     const taskRoot = legacyPath(legacyTaskRoot);
     const planningRoot = legacyPath(legacyPlanningRoot);
     const scopes = [scope];
@@ -199,7 +222,7 @@ function inputValue(declaration, { cliArgs, fromSession }) {
 }
 function computedValues(preset, inputs) {
     const values = {};
-    const migrationSession = Object.values(inputs).find((value) => value && typeof value === "object" && value.operation === "migrate-run");
+    const migrationSession = Object.values(inputs).find((value) => isRecord(value) && value.operation === "migrate-run");
     if (migrationSession) {
         values.migrationTargetLevel = preset.task?.migrationTargetLevel || "migration-baseline";
         values.migrationAchievedLevel = migrationSession.strictDeferred ? "migration-deferred" : migrationSession.result === "complete" ? "migration-full-cutover" : "migration-baseline";
@@ -222,7 +245,7 @@ function presetEvidenceBundle(preset, { target, taskDir, evaluatedValues }) {
 function generateEvidenceFiles(preset, { target, context }) {
     const files = [];
     const add = (relativePath, source, content) => {
-        assertPresetWriteScope(preset, relativePath);
+        assertPresetWriteScope(preset, relativePath, target);
         files.push({ relativePath, source, content });
     };
     const evidenceFiles = preset.evidence?.files || {};
@@ -236,11 +259,11 @@ function generateEvidenceFiles(preset, { target, context }) {
     }
     return files;
 }
-function generateResourceFiles(preset, { context }) {
+function generateResourceFiles(preset, { target, context }) {
     const files = [];
     const indexRows = { references: [], artifacts: [] };
     const add = (relativePath, source, content) => {
-        assertPresetWriteScope(preset, relativePath);
+        assertPresetWriteScope(preset, relativePath, target);
         files.push({ relativePath, source, content });
     };
     for (const resource of Object.values(preset.resources?.references || {})) {
@@ -365,7 +388,7 @@ function renderPresetMetadata(content, context) {
         ...declaredMetadataLines(context),
     ].filter(Boolean).join("\n");
     let next = String(content).replace(new RegExp(`^(${escapeRegExp(taskContractMarker)}\\s*)$`, "im"), `$1\n${metadata}`);
-    const outcome = context.presetPackage.task?.defaultOutcome || "";
+    const outcome = String(context.presetPackage.task?.defaultOutcome || "");
     if (outcome) {
         next = next
             .replace("[State the outcome this task must deliver in one sentence.]", outcome)
@@ -391,19 +414,19 @@ function declaredMetadataLines(context) {
         const label = declaration.label || name;
         let value = "";
         if (Object.prototype.hasOwnProperty.call(declaration, "from")) {
-            value = getPath(base, declaration.from);
+            value = String(getPath(base, declaration.from) || "");
         }
         else if (Object.prototype.hasOwnProperty.call(declaration, "value")) {
-            value = declaration.value;
+            value = String(declaration.value || "");
         }
         else if (Object.prototype.hasOwnProperty.call(declaration, "default")) {
-            value = declaration.default;
+            value = String(declaration.default || "");
         }
         return value == null || value === "" ? "" : `${label}: ${value}`;
     });
 }
 function migrationSession(context) {
-    const session = Object.values(context.resolvedInputs || {}).find((value) => value && typeof value === "object" && value.operation === "migrate-run");
+    const session = Object.values(context.resolvedInputs || {}).find((value) => isRecord(value) && value.operation === "migrate-run");
     if (!session)
         throw new Error("Preset evidence requires migrate-run session input");
     return session;
@@ -486,7 +509,7 @@ function targetCommit(projectRoot) {
 }
 function packageVersion() {
     try {
-        return readJsonSafe(path.join(repoRoot, "package.json"), {}).version || "unknown";
+        return String(asRecord(readJsonSafe(path.join(repoRoot, "package.json"), {})).version || "unknown");
     }
     catch {
         return "unknown";
@@ -495,7 +518,13 @@ function packageVersion() {
 function getPath(values, key) {
     if (!key)
         return values;
-    return String(key).split(".").reduce((cursor, part) => (cursor && Object.prototype.hasOwnProperty.call(cursor, part) ? cursor[part] : undefined), values);
+    let cursor = values;
+    for (const part of String(key).split(".")) {
+        if (!isRecord(cursor) || !Object.prototype.hasOwnProperty.call(cursor, part))
+            return undefined;
+        cursor = cursor[part];
+    }
+    return cursor;
 }
 function renderInline(value, values) {
     return String(value || "").replace(/\{\{\s*([A-Za-z0-9_.-]+)\s*\}\}/g, (_match, key) => {
@@ -515,3 +544,12 @@ function presetIndexSkeleton(kind) {
 function escapeRegExp(value) {
     return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asRecord(value) {
+    return isRecord(value) ? value : {};
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : "unknown parse error";
+}