cowork-harness 0.10.0 → 0.13.0

package/CHANGELOG.md

@@ -4,6 +4,168 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). The project uses
 [Semantic Versioning](https://semver.org/); pre-1.0 minor versions may include breaking changes.
 
+## [Unreleased]
+
+## [0.13.0] — 2026-06-25
+
+### Added
+
+- **`inspect <run-id | run-dir>` — see what a run produced.** Lists the run's artifacts and prints a shallow
+  field preview of each JSON artifact (scalars inline, arrays as a count, nested objects collapsed), so
+  "did it do the job?" is a first-class check instead of hand-parsing `…/mnt/outputs/...`. `--output-format
+  json` emits a structured digest. When the work dir was torn down (a non-`--keep` container/microvm run),
+  the artifact manifest still prints from `result.json` and the preview notes it's unavailable.
+- **A whiffed gate no longer discards the paid run.** When a run exits on an unanswered gate
+  (`on_unanswered: fail`), the harness now salvages a **PARTIAL** `result.json` (+ `run.jsonl`/`trace.json`)
+  with the artifacts the agent wrote before the whiff, then still exits 2. The run dir is printed so you can
+  `inspect` it. `partial` and `unansweredGate` are new `RunResult` fields; `verify-run` and `scaffold`
+  refuse to treat a partial run's half-finished output as a passing result (scaffold still emits the gates,
+  drops the artifact/result asserts, and warns loudly).
+- **Capability pre-flight — fail fast.** A skill that declares `requires_capabilities` against an image that
+  provably omits them now **aborts before the (paid) run** (`exit 3`) instead of running ~12 min to a verdict
+  that's already known — unless the scenario asserts `allow_missing_capability: true`, which downgrades it to
+  a notice and proceeds. `doctor` also surfaces the full-parity remedy on its agent-image line.
+
+### Changed
+
+- **LLM decider tolerates a near-miss label.** `--decider-llm` now binds a reply like `Confirmed.` or
+  `"Confirmed"` to the label `Confirmed` (trailing sentence punctuation / surrounding quotes trimmed before
+  matching) instead of failing loud — common on binary confirm gates. The `:` of the `OTHER:` free-text
+  sentinel is never stripped, and fuzzy substring matching stays off, so the change can't mis-bind. The
+  tolerance lives in `matchLabel` itself, so the web_fetch-approval path gets it too (a `Deny.` reply now
+  binds `Deny`).
+- **`runs gc` → top-level `prune`; the `runs` namespace is dropped.** Pruning accumulated run dirs is now
+  `cowork-harness prune [--keep-last <n>] [--dry-run] [<runs-dir>]` (same flags). `runs` was a namespace with
+  a single member and collided confusingly with `run` (execute); removing it leaves `run` = execute,
+  inspection verbs (`trace`/`inspect`/`verify-run`/`scaffold`) top-level, and `prune` for cleanup.
+
+### Fixed
+
+- **Session-protocol over-cap test no longer flakes.** The over-cap control-out test read
+  `control-out.jsonl` synchronously, but the stream opens it asynchronously (`createWriteStream`, flags
+  `"a"`), so under load the file may not exist yet at the read — a flaky ENOENT. The over-cap frame is
+  rejected before any write, so a missing file means nothing was written; the test now treats absence as
+  empty.
+
+### Docs
+
+- **Documented the LLM-decider free-text path.** `--decider-llm` supplies free text via `OTHER: <value>`
+  on an options-bearing gate; a bare out-of-set answer (no matching label, no `OTHER:`) fails loud
+  (`UnansweredError` → exit 2), never stalling or guessing, and open-ended (no-option) gates need no
+  prefix. Noted in the decider section of `fidelity-and-answers.md` and cross-referenced from the lone
+  `OTHER:` mention in `SKILL.md` so the two don't drift.
+- **Documented the live real-document validation workflow.** A new SKILL.md section covers driving a skill
+  against real input documents (not recording a cassette): explore with `--decider-llm --intent`, script the
+  load-bearing and binary-confirm gates, budget ~1 re-run per file (a whiffed gate now salvages a partial
+  run), and `inspect` the outputs to judge correctness.
+
+## [0.12.0] — 2026-06-24
+
+### Added
+
+- **`record` now shows the offered options when a scripted answer matches none.** A `choose:` that names no
+  offered option previously failed with just "matched no offered option" — you had to dig through
+  `events.jsonl` for the real labels. The error now lists the **valid labels** and suggests the **closest
+  match**, so you can fix the anchor from the error alone. (The labels were already on the error object; the
+  record path just wasn't printing them — `run`/`skill` already did.)
+- **`doctor` detects the git-worktree `.env` trap.** Running from a git worktree where `./.env` is gitignored
+  (so absent) yields "no token"; when the **main checkout** has a `.env`, `doctor` now points you at
+  `--dotenv <main>/.env` instead of the generic remedy. (Keychain hint still takes precedence on macOS.)
+- **`scaffold` stamps a provenance header on generated scenarios.** Output now carries a
+  `# generated by cowork-harness v<ver> (scaffold)` comment (a comment, since the scenario schema is
+  `additionalProperties: false`), mirroring the cassette's `generator`/`$schema`/`cassetteVersion` provenance.
+  The shipped `example-pdf-skill` replay cassette — previously a hand-authored legacy fixture with no
+  signature and a stale embedded scenario — was re-recorded live so it now carries a genuine v6 signature +
+  fingerprint/artifacts/userVisibleRoots and matches the current scenario YAML (replays green;
+  `verify-cassettes` clean).
+
+### Changed
+
+- **`verify-run` answer-coverage now refuses against a *stale* kept run.** Every run persists a skill
+  fingerprint in `result.json`; on the answer-coverage path (`answers:` declared), `verify-run` recomputes it
+  live and, if the skill source changed since the run was kept, **exits 2** ("the kept run predates the current
+  skill") instead of vouching for answers against a stale gate snapshot. ⚠️ This closes a false-green: a
+  reworded/moved gate after `--keep` would previously green against the old labels. The plain `assert:`-only
+  re-eval (no `answers:`) is unaffected; a kept run recorded by an older harness (no fingerprint) → a warning,
+  not a refusal. `RunResult.fingerprint` is the new persisted field.
+
+### Parity
+
+- **Synced the platform baseline to Claude Desktop 1.15200.0** (`baselines/desktop-1.15200.0.json`). The
+  staged agent ELF is **unchanged (2.1.181)** — the bump is host-side: `sync` re-derived egress / gates /
+  mount / web_fetch facts (no `unknown delta`; only the `asarFingerprint` moved). Re-verified end-to-end —
+  the live scenario suite (`protocol` + `container` tiers) passes against the new baseline.
+- **Re-paraphrased the reconstructed system-prompt + subagent appends for 1.15200.0**
+  (`baselines/prompts/desktop-1.15200.0/`). Cowork's identity constant was rewritten **first→third person**
+  (it no longer says "powering Cowork mode"; the load-bearing "is NOT Claude Code" correction is kept);
+  `file_handling` became a scratchpad-vs-workspace split, and `working_with_user_files` / `product_information`
+  blocks were added; the subagent-append VM clause changed to "not on the user's real computer." Host-only
+  affordances (`request_cowork_directory`, `computer://` links) are described as behavior, **not** injected as
+  instructions, so they don't induce dead tool calls on the container / microvm / protocol tiers. The host-loop
+  `## Shell access` generator was re-verified **byte-identical** (one new conditional sentence stays omitted —
+  our single-container topology never triggers it; comment + verification stamp refreshed).
+
+### Fixed
+
+- **Baseline-bump-stable staleness tests.** `staleness-roundtrip`, `manifest`, and `agent-scope` round-trip
+  tests hardcoded the baseline version (`1.14271.0`), so adding a new latest baseline re-staled them; they now
+  source it from `loadBaseline("latest")`, so a parity bump no longer breaks the green round-trips.
+- **`example-pdf-skill` asserts the workspace deliverable correctly.** The scenario connects a folder, so
+  `{{workspaceFolder}} = mnt/project` and the model writes the deliverable into the folder
+  (`mnt/project/outputs/actions.md`), not `mnt/outputs` — but the assert was `file_exists: outputs/actions.md`
+  (anchored at `mnt/`), so it failed. Switched to `user_visible_artifact: project/outputs/actions.md` (spans
+  the user-visible roots). A pre-existing scenario bug (fails identically on the old prompt), not a parity
+  regression; the `{{workspaceFolder}}` resolution is faithful to the Desktop builder `y8r`. Docs + skill now
+  teach `user_visible_artifact` vs `file_exists` for folder-connected deliverables.
+
+### Docs
+
+- **Baseline-pin sweep to `desktop-1.15200.0`** across README / DESIGN / SPEC / spawn-contract / skill docs
+  (agent ELF still 2.1.181). The `≥1.14271.0` mount/bare-name gate-boundary references are intentionally left
+  as-is — that boundary did not move.
+- Skill + scenario docs: the gate-centric answer-coverage currency rule; the cheap `--keep` → `trace
+  --view questions`/`verify-run` authoring loop (no token-free gate probe exists — gates are model-decided);
+  the mismatch-vs-unanswered hard-fail gotcha; "anchor only assert-relevant gates, prefer `on_unanswered:
+  first` elsewhere"; the keep-going batch semantics (`record <dir>`/`--rerecord-stale` record all and report
+  at the end — no one-at-a-time wrapper needed); and the git-worktree `.env` gotcha.
+
+### Security
+
+- **Hardened HTML-comment stripping in prompt assets (CodeQL `js/incomplete-multi-character-sanitization`).**
+  A one-shot `.replace(/<!--[\s\S]*?-->/g, "")` is incomplete multi-character sanitization: removing an inner
+  comment can recombine surrounding fragments into a fresh `<!--` the single pass leaves behind (e.g.
+  `<!<!-- -->-- x -->` → `<!-- x -->`). `stripComments` now loops until the string stabilizes and is shared
+  from `prompt.ts`; `hostloop.ts` reuses it instead of a duplicated inline regex. Resolves the finding at both
+  call sites; a regression test covers the recombination case.
+
+## [0.11.0] — 2026-06-24
+
+### Added
+
+- **`record --concurrency <N>` — parallel fleet re-records.** A directory batch (or `--rerecord-stale`) can
+  now record N cassettes at a time (`record cassettes/ --rerecord-stale --concurrency 3`) instead of one ~7–8
+  min run after another. Every run is already fully isolated (its own per-run Docker networks + egress proxy,
+  its own session dir), so parallelism is safe; `--concurrency` is purely a **bound** against Docker's address
+  pool and model API rate limits. Default `1` (unchanged behavior + ordered output), max `8`. A dir batch
+  where two scenarios' `name:` slugify to the same cassette path is now rejected up front (they would clobber
+  each other — a pre-existing footgun parallelism would have surfaced).
+- **Opt-in per-skill agent scoping for cassette staleness (`COWORK_HARNESS_AGENT_SCOPE=skill`).** By default a
+  plugin's `agents/` directory is a fleet-wide staleness root, so editing one skill's sub-agent contract
+  (`agents/cap-table.md`) re-stales *every* cassette. With this env set, a **skill-named** `agents/<name>.md`
+  is treated as skill `<name>`'s private input (refining a scenario's `skills:` scope), so it re-stales only
+  that skill's cassettes; generic (non-skill-named) agents stay shared. The setting is stamped into the
+  cassette fingerprint (`agentScope`), so flipping it is an honest one-time "re-record under the same setting"
+  (like `COWORK_HARNESS_GITSET`); cassettes recorded without it are unaffected. Caveat: assumes an agent named
+  after a skill belongs to that skill — keep it off if you share a skill-named agent across skills.
+
+### Fixed
+
+- **Clarified `verify-run` answer-coverage docs (gate-centric, not rule-centric).** `verify-run` checks that
+  every gate the run *actually fired* is covered by a matching `answer`; it does **not** penalize answer rules
+  that no fired gate matched (e.g. rules for conditional gates that didn't fire). The behavior was always
+  correct; `docs/scenario.md` now states it precisely (a scenario with 5 rules whose run fired 2 gates passes
+  at "2/2 matched").
+
 ## [0.10.0] — 2026-06-23
 
 ### Added

package/README.md

@@ -24,13 +24,18 @@ Scriptable, CI-friendly test harness that reproduces **Claude Cowork's observabl
 
 > **What this is and isn't.** This is an *emulator of the contract*, not the Desktop runtime. Cowork's real session control plane lives behind the Desktop renderer's IPC (per-build UUID + `senderFrame` origin checks) and the app ships with remote debugging disabled (verified: `--remote-debugging-port` opens no listener; Electron `EnableNodeCliInspectArguments` fuse is OFF). So you **cannot** drive the real Apple Virtualization.framework microVM from a script. What you *can* faithfully reproduce is everything that actually changes how a **skill** behaves: the same agent binary in **cowork mode** (`CLAUDE_CODE_IS_COWORK=1` — there is no `--cowork` flag), the same mount layout, the same egress allowlist, and the same permission/question protocol. That's what this project does.
 
-**Zero-friction preview — no token, no Docker.** A committed cassette replays on a fresh clone:
+**Zero-friction preview — no token, no Docker.** A committed cassette replays from a fresh clone (the example
+cassette ships in the repo; just Node ≥ 20):
 
 ```bash
-npm install -g cowork-harness
-cowork-harness replay examples/replays/example-pdf-skill.cassette.json
+git clone https://github.com/yaniv-golan/cowork-harness && cd cowork-harness
+npm ci && npm run build
+node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 ```
 
+(Installing globally — `npm install -g cowork-harness` — gives you the `cowork-harness` CLI for your own
+scenarios and cassettes; the bundled example above is replayed from a checkout.)
+
 Full setup → [Quick start](#quick-start).
 
 ---
@@ -88,20 +93,21 @@ Skill testing is the headline use, but the tool is a general harness over the Co
 | `skill <folder> "<prompt>"` | Run a local skill/plugin folder once against the staged agent | ad-hoc "is the skill alive / does it do X?" — the fast inner loop |
 | `run <scenario.yaml \| dir/>` | Run authored scenarios with `assert:` + a CI-ready exit code | you want a repeatable, **asserted regression test** |
 | `chat <folder> [prompt]` | Interactive multi-turn REPL against a skill (TTY); optional seed prompt is sent as the first turn. `--upload <file>` / `--folder <dir>` (repeatable) attach files/project folders; `--verbose` / `-V` shows thinking blocks + tool inputs; `--fidelity protocol\|container\|hostloop` | debugging a multi-turn flow by hand |
-| `record` / `replay` | `record` saves a control-protocol cassette (one scenario, or batch a `dir/`; `--rerecord-stale` refreshes only drifted ones; `--max-artifact-bytes` raises the 64 KiB inline-body cap; `--dry-run` previews the scenarios + token/binary checks without recording; answer gates **live during the recording** with `--decider-dir`/`--decider-llm`/`--on-unanswered first` instead of pre-scripting them — a live decider flags the cassette non-deterministic but it still replays deterministically); `replay <file.cassette.json \| dir/>` runs a cassette **file or a `dir/` of `*.cassette.json`** deterministically (`--strict` fails on a stale one; exits on the worst verdict) | **token-free, Docker-free CI** from a once-recorded run |
+| `record` / `replay` | `record` saves a control-protocol cassette (one scenario, or batch a `dir/`; `--rerecord-stale` refreshes only drifted ones; `--concurrency <N>` records a batch N at a time — runs are fully isolated, so it just bounds Docker/API pressure; `--max-artifact-bytes` raises the 64 KiB inline-body cap; `--dry-run` previews the scenarios + token/binary checks without recording; answer gates **live during the recording** with `--decider-dir`/`--decider-llm`/`--on-unanswered first` instead of pre-scripting them — a live decider flags the cassette non-deterministic but it still replays deterministically); `replay <file.cassette.json \| dir/>` runs a cassette **file or a `dir/` of `*.cassette.json`** deterministically (`--strict` fails on a stale one; exits on the worst verdict) | **token-free, Docker-free CI** from a once-recorded run |
 | `verify-cassettes <file\|dir>` | Token-free CI gate over committed cassettes: a privacy scan (email/currency/domain → exit 1; whole-token allows via `--allow` / class-scoped `--allow-domain` / `--allow-email` / `--allow-file`) + a staleness check (`--skip-privacy` or `--skip-staleness` to run only one half). A dir argument scans `*.cassette.json` in that dir only (**non-recursive**) | gating **committed cassettes** against PII leaks + "edited the skill, forgot to re-record" |
 | `verify-run <run-dir> <scenario.yaml>` | Re-evaluate a scenario's `assert:` (and, when the scenario declares `answers:`, whether they still match the run's actual gates) against an already-kept run dir — **no live agent, no tokens, no Docker** (~1s) | iterating on a wrong assertion or a drifted `answer` without a full live re-record |
 | `trace <run-id>` | Digest a run's `events.jsonl` (`--view tools\|questions\|dispatches`; legacy `--tools` / `--gates` / `--dispatches` aliases still accepted) | "how many sub-agents *actually* dispatched, and which?" |
+| `inspect <run-id>` | Show what a run **produced**: the artifacts + a shallow field preview of each JSON artifact (`--output-format json` for a digest). Works on a salvaged partial run too | "did it do the job?" — without hand-parsing `…/mnt/outputs/…` |
 | `scaffold <run-id>` | Turn a kept run into a starter scenario YAML (gates→answers, artifacts→`file_exists`); `--from-run <id>` is a deprecated alias for the positional | authoring a scenario from a real run instead of guessing |
 | `python3 …/scenario.py scaffold --name <name> --skill <dir>` | Generate a starter scenario skeleton from scratch (the `…` is `.claude/skills/cowork-harness/scripts/`) | starting a new scenario when you have no prior run |
 | `lint <scenario.yaml \| dir/>…` | Check scenarios for silent false-greens — assertions placed on the wrong CI lane, mixed content/live keys, missing `controlOut`-required keys (files or a directory of `*.yaml`/`*.yml`; bundled `scenario.py`; needs python3 — PyYAML is bundled) | before committing a new scenario or after changing assertions |
-| `assertions --list` | List the available scenario assertions (generated from the schema); `assert` is a deprecated alias | "what can I assert?" without grepping the source |
+| `assertions --list` | List the available scenario assertions (generated from the schema) | "what can I assert?" without grepping the source |
 | `decide` | Validate a decider against a sample question in ~2 s (no run) | sanity-check a `--decider-*` / `--answer` wiring before a long run |
 | `gates` / `answer` | Stream / answer in-band gates for `--decider-dir` | a **driving agent** answers live questions via a Monitor |
 | `boundary-check [baseline] [--session <file>]` | Prove the sandbox enforces Cowork's limitations; `--session` folds a session's `egress.extra_allow` into the probe allowlist | verifying the harness's own fidelity |
 | `sync` / `list` | Derive/refresh & list platform baselines from the Desktop install | after Claude Desktop updates (baselines ship, so it's optional otherwise) |
 | `doctor [--tier <t>]` | Read-only prerequisite check, per tier (Docker + agent image for `container`/`hostloop`; **Lima** for `microvm`; plus staged agent, token, baseline); prints the exact `docker build` line if the agent image is missing | "can I run the live tiers — what's missing?" before a first live run |
-| `runs gc [--keep-last <n>]` | Prune accumulated run dirs (keeps the N most recent per scenario; pinned `--session-id` runs are never pruned); `--dry-run` | the machine-global runs root has grown and you want space back |
+| `prune [--keep-last <n>]` | Prune accumulated run dirs (keeps the N most recent per scenario; pinned `--session-id` runs are never pruned); `--dry-run` | the machine-global runs root has grown and you want space back |
 | `rehash <dir/>` | Migrate cassette fingerprints to the current format version when the content is provably unchanged (`--dry-run`); no re-record needed | a cassette-format bump flagged committed fixtures as stale |
 | `vm <init\|status\|delete\|prune>` | Manage the L2 Apple-VZ / Lima microVM (`prune` removes orphaned VMs left by config/agent-version changes) | running `--fidelity microvm` |
 
@@ -202,7 +208,7 @@ This repo ships a **companion skill** (`.claude/skills/cowork-harness/`) that te
 /plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.9.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.13.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://github.com/vercel-labs/skills) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) by pointing the `npx skills` CLI at `.claude/skills/cowork-harness` in this repo. (Working *inside* this repo, the skill auto-loads as a project skill — no install needed.)
 
@@ -261,7 +267,7 @@ cowork-harness lint examples/scenarios/*.yaml
 > `serializeDecision` as a token-free O7 guard (the AskUserQuestion `{questions,answers}` answer-shape
 > invariant). Evaluated on replay: `transcript_*`, `tool_*`, `subagent_*`, `dispatch_count_max`,
 > `result`, and the verdict modifiers `allow_permissive_auto_allow` / `allow_missing_capability` /
-`allow_l0_plugin_divergence` / `allow_stall` (no-op passes, kept on replay). **`question_asked`,
+> `allow_l0_plugin_divergence` / `allow_stall` (no-op passes, kept on replay). **`question_asked`,
 > `questions_count_max`, and `gate_answers_delivered` are also evaluated —
 > but only when the cassette carries `controlOut` (full-fidelity)**; old cassettes without it get a
 > loud warning and those three keys are excluded (not vacuously passed). **Filesystem assertions
@@ -293,7 +299,7 @@ Configuration splits the way Cowork itself splits — *what you set up before th
 # scenarios/pdf.yaml   ← the filename is the test's identity (name: is an optional override)
 baseline: latest                       # platform baseline (auto-synced from Desktop)
 session: ../sessions/default.yaml     # pre-prompt setup, resolved relative to THIS file
-fidelity: container                   # protocol | container | microvm
+fidelity: container                   # protocol | container | microvm | hostloop | cowork
 
 prompt: |
   Summarize report.pdf and write the action items to outputs/actions.md
@@ -468,10 +474,10 @@ Unit tests cover the scripted-answer logic, the egress allowlist matcher, the se
 - `COWORK_AGENT_IMAGE=<tag>` — override the agent image name (default `cowork-agent-base:2`); `COWORK_AGENT_BINARY=<path>` — override the auto-detected staged agent ELF.
 - `COWORK_SKIP_CAPABILITY_PROBE=1` — skip the per-run capability probe (the harness otherwise probes the agent image/VM for the document/OCR/Office capabilities the real Cowork rootfs ships and **fails a run that uses one the image omits** — a likely false negative; suppress per-scenario with `allow_missing_capability: true`, or rebuild full parity).
 - `COWORK_HARNESS_DECIDER_DIR_POLL_MS` / `_TIMEOUT_MS` — tune the `--decider-dir` rendezvous poll/backstop; `COWORK_HARNESS_DECIDER_CMD_TIMEOUT_MS` / `COWORK_HARNESS_LLM_TIMEOUT_MS` — backstop a hung `--decider-cmd` helper / `--decider-llm` model call (default 600 s, fail loud); `COWORK_HARNESS_DIALOG_TIMEOUT_MS` — override the 6 s dialog auto-cancel.
-- `COWORK_HARNESS_RUNS_DIR` (or the `--run-dir <path>` flag) — override the default run-output root `~/.cowork-harness/runs` (kept out of any working tree so sensitive skill inputs/outputs don't land in a repo). Precedence: `--run-dir` > env > default. The root is flat and machine-global (shared across projects); pinned `--session-id` runs are guarded against cross-project overwrite, and `runs gc` never prunes them. In CI, set it to a workspace path (e.g. `runs`) so artifact upload can collect the runs. `COWORK_HARNESS_ALLOW_FOREIGN_RESUME=1` overrides the guard that blocks `--resume` onto another project's pinned session.
+- `COWORK_HARNESS_RUNS_DIR` (or the `--run-dir <path>` flag) — override the default run-output root `~/.cowork-harness/runs` (kept out of any working tree so sensitive skill inputs/outputs don't land in a repo). Precedence: `--run-dir` > env > default. The root is flat and machine-global (shared across projects); pinned `--session-id` runs are guarded against cross-project overwrite, and `prune` never prunes them. In CI, set it to a workspace path (e.g. `runs`) so artifact upload can collect the runs. `COWORK_HARNESS_ALLOW_FOREIGN_RESUME=1` overrides the guard that blocks `--resume` onto another project's pinned session.
 - **Networking / loop:** `COWORK_EGRESS_PROXY` overrides the egress-proxy URL injected into the sandbox; `COWORK_PROXY_IMAGE` overrides the egress proxy Docker image name (default `cowork-egress-proxy:1`); `COWORK_DOCKER_NETWORK` pins the Docker network the agent container joins; `CLAUDE_FORCE_HOST_LOOP=1` forces the host-loop path regardless of the baseline's loop decision (the `cowork` tier's auto-pick). `COWORK_LIMACTL` overrides the `limactl` binary path (default `/opt/homebrew/bin/limactl`).
 - **Strictness escape hatches** (the harness fails loud by default): `COWORK_HARNESS_SOFT_MISSING=1` downgrades a missing mount source from a hard error to warn-and-exclude; `COWORK_HARNESS_ALLOW_CONFIG_DIR_WRITE=1` permits writing into an existing pinned `plugins.config_dir` (otherwise refused, to avoid clobbering a real Claude config).
-- **Staleness boundary:** the cassette-staleness skill hash uses the **git-tracked** file set of each skill/plugin source dir by default (a non-repo dir falls back to a raw walk; OS-junk like `.DS_Store` is always excluded). `COWORK_HARNESS_GITSET=0` opts out to the legacy raw walk for every dir. `COWORK_HARNESS_DEBUG_SKILLHASH=1` dumps the exact file set feeding the hash on a staleness mismatch (and flags OS-junk) so a drift source is one line. Declare per-plugin non-runtime paths in a `.cowork-hashignore` file (or the session `staleness.hash_ignore`).
+- **Staleness boundary:** the cassette-staleness skill hash uses the **git-tracked** file set of each skill/plugin source dir by default (a non-repo dir falls back to a raw walk; OS-junk like `.DS_Store` is always excluded). `COWORK_HARNESS_GITSET=0` opts out to the legacy raw walk for every dir. `COWORK_HARNESS_DEBUG_SKILLHASH=1` dumps the exact file set feeding the hash on a staleness mismatch (and flags OS-junk) so a drift source is one line. Declare per-plugin non-runtime paths in a `.cowork-hashignore` file (or the session `staleness.hash_ignore`). `COWORK_HARNESS_AGENT_SCOPE=skill` (opt-in) refines a scenario's `skills:` scope so a **skill-named** `agents/<name>.md` re-stales only that skill's cassettes instead of the whole fleet (generic agents stay shared; stamped into the fingerprint, so flipping it is a one-time re-record like `GITSET`).
 - **`skill` / `chat` defaults:** `COWORK_HARNESS_FIDELITY` sets the default fidelity tier for ad-hoc `skill`/`chat` runs (a `--fidelity` flag or a scenario's `fidelity:` still wins); `COWORK_HARNESS_MODEL` sets the default model; `COWORK_HARNESS_OUTPUT_FORMAT` (`text`|`json`) sets the default output format. Each is overridden by the matching explicit flag.
 - **Secret scrubbing:** `COWORK_HARNESS_SCRUB_KEYS=<KEY1,KEY2>` adds extra env-var names whose values are redacted from logs (beyond the known auth tokens + `ANTHROPIC_CUSTOM_HEADERS`); `COWORK_HARNESS_SCRUB_VALUES=<v1,v2>` redacts literal values regardless of env. **Committed-cassette redaction:** `COWORK_HARNESS_REDACT_PATTERNS=<rx1,rx2>` / `COWORK_HARNESS_REDACT_KEYS=<k1,k2>` extend the privacy layer that scrubs recorded `controlOut` before a cassette is written for commit.
 - L2 microVM: `COWORK_VM_GATEWAY` overrides the Lima host-proxy gateway IP (default `192.168.5.2`); `COWORK_VM_PROXY_PORT` the proxy port. The Lima instance is named `cowork-vm-<config-hash>` (a config change → a fresh VM); `COWORK_LIMA_INSTANCE` pins a fixed name, and `vm prune` removes orphaned ones.
@@ -549,7 +555,7 @@ This repo is built to be driven by agents, not just read by humans:
 
 ## Status
 
-**Verified end-to-end against the live staged agent (2.1.181 / asar 1.14271.0).**
+**Verified end-to-end against the live staged agent (2.1.181 / asar 1.15200.0).** Host-side parity (egress/gates/mount/web_fetch facts + the reconstructed prompt appends) re-derived for 1.15200.0 via `sync` + asar inspection; the live scenario suite passes against this baseline (the staged agent ELF is unchanged at 2.1.181).
 
 - ✅ **Three isolation tiers (L0/L1/L2) + two loop-mode overlays** — `protocol` (L0 control loop), `container` (L1 sandboxed arm64 + per-run default-deny egress sidecar), `microvm` (L2 real Apple-VZ Linux microVM + guest firewall); plus the loop-mode overlays `hostloop` (production split-execution: agent loop on host, shell/web via the workspace SDK-MCP server) and `cowork` (auto-picks host-loop vs container the way Cowork does — gate `1143815894`). Egress enforced at container/microvm/hostloop; `boundary-check` reports **ALL CONSTRAINTS ENFORCED**.
 - ✅ **Three-seam driver** — `AgentSession` (control protocol) → `Decider` (scripted + `on_unanswered` policy, no silent false-greens) → `Run` (turn loop, sub-agent dispatch tree, `RunRecord`). Multi-turn `chat`, deterministic cassette `record`/`replay` (no token), `run.jsonl`/`trace.json` logging with secret-scrub.

package/baselines/desktop-1.15200.0.json

@@ -0,0 +1,220 @@
+{
+  "baselineVersion": 1,
+  "appVersion": "1.15200.0",
+  "agentVersion": "2.1.181",
+  "agentBinary": {
+    "stagedPath": "~/Library/Application Support/Claude/claude-code-vm/2.1.181/claude",
+    "format": "elf-aarch64"
+  },
+  "guest": {
+    "os": "linux",
+    "arch": "arm64",
+    "baseImage": "ubuntu:22.04"
+  },
+  "spawn": {
+    "configDirInGuest": "mnt/.claude",
+    "settingSources": [
+      "user"
+    ],
+    "permissionMode": "default",
+    "maxThinkingTokens": 31999,
+    "effortDefault": "medium",
+    "tools": [
+      "Task",
+      "Bash",
+      "Glob",
+      "Grep",
+      "Read",
+      "Edit",
+      "Write",
+      "NotebookEdit",
+      "WebFetch",
+      "TaskCreate",
+      "TaskUpdate",
+      "TaskGet",
+      "TaskList",
+      "TaskStop",
+      "WebSearch",
+      "Skill",
+      "REPL",
+      "JavaScript",
+      "AskUserQuestion",
+      "ToolSearch"
+    ],
+    "allowedTools": [
+      "Task",
+      "Bash",
+      "Glob",
+      "Grep",
+      "Read",
+      "Edit",
+      "Write",
+      "NotebookEdit",
+      "WebFetch",
+      "TaskCreate",
+      "TaskUpdate",
+      "TaskGet",
+      "TaskList",
+      "TaskStop",
+      "WebSearch",
+      "Skill",
+      "REPL",
+      "JavaScript",
+      "ToolSearch"
+    ],
+    "env": {
+      "CLAUDE_CODE_IS_COWORK": "1",
+      "CLAUDE_CODE_ENTRYPOINT": "local-agent",
+      "CLAUDE_CODE_TAGS": "lam_session_type:chat",
+      "CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST": "1",
+      "CLAUDE_CODE_ENABLE_ASK_USER_QUESTION_TOOL": "true",
+      "CLAUDE_CODE_DISABLE_CRON": "1",
+      "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS": "1",
+      "CLAUDE_CODE_DISABLE_AGENTS_FLEET": "1",
+      "CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT": "1",
+      "CLAUDE_CODE_ENABLE_TASKS": "true",
+      "CLAUDE_CODE_DISABLE_TERMINAL_TITLE": "1",
+      "ENABLE_PROMPT_CACHING_1H": "1",
+      "DISABLE_MICROCOMPACT": "1",
+      "MCP_CONNECTION_NONBLOCKING": "true"
+    },
+    "promptTemplate": "prompts/desktop-1.15200.0/system-prompt-append.md",
+    "subagentAppend": "prompts/desktop-1.15200.0/subagent-append-vm.md",
+    "$comment": "Binary-verified Desktop->agent spawn contract (asar 1.12603.1). See docs/cowork-spawn-contract-1.12603.1.md.",
+    "$comment_notSet": "Deliberately NOT set: CLAUDE_CODE_USE_COWORK_PLUGINS (Desktop never sets it; would flip the agent to cowork_settings.json/cowork_plugins). Host-derived (TZ, account UUIDs, WORKSPACE_HOST_PATHS, OTEL) injected at runtime, not pinned.",
+    "$comment_prompts": "Reconstructed cowork-specific sections, re-paraphrased from asar 1.15200.0 const MZi (system prompt) + generator CVr (subagent) — not the full base prompt (not cleanly extractable), and excluding the generic refusal/safety tail. The main append is delivered via the --append-system-prompt CLI flag (layered on the agent's built-in base prompt), NOT the initialize handshake; only the subagent append goes over initialize (appendSubagentSystemPrompt), gated on CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT."
+  },
+  "mountLayout": {
+    "sessionRoot": "/sessions/{sessionId}",
+    "cwd": "/sessions/{sessionId}",
+    "mntRoot": "/sessions/{sessionId}/mnt",
+    "mounts": [
+      {
+        "name": "uploads",
+        "mountPath": "uploads",
+        "mode": "r",
+        "purpose": "user-uploaded files (read-only — asar 'ro')"
+      },
+      {
+        "name": "projects",
+        "mountPath": ".projects/{projectId}",
+        "mode": "rw",
+        "purpose": "RESERVED namespace (and the separate UUID project-sync feature) — NOT the work-folder path. From Desktop 1.14271.0 selected work folders mount at mnt/<collision-resolved-basename> (dynamic, derived per session by buildLaunchPlan; see MOUNT_BARE_NAME_MIN_VERSION). This decorative row is not consumed for binding (staged paths come from plan.mounts)."
+      },
+      {
+        "name": "local-plugins",
+        "mountPath": ".local-plugins/marketplaces",
+        "mode": "r",
+        "purpose": "marketplace skills/plugins, runtime-discovered"
+      },
+      {
+        "name": "remote-plugins",
+        "mountPath": ".remote-plugins",
+        "mode": "r",
+        "purpose": "org-remote plugins, runtime-discovered"
+      },
+      {
+        "name": "outputs",
+        "mountPath": "outputs",
+        "mode": "rw",
+        "purpose": "session outputs/artifacts — delete denied by default (asar IX); rwd only when approved"
+      }
+    ]
+  },
+  "network": {
+    "mode": "gvisor",
+    "allowKind": "allowlist",
+    "allowDomains": [
+      "sentry.io",
+      "preview.claude.ai",
+      "downloads.claude.ai",
+      "api.anthropic.com",
+      "a-cdn.anthropic.com",
+      "a-api.anthropic.com",
+      "assets.claude.ai",
+      "console.anthropic.com",
+      "api-staging.anthropic.com",
+      "www.anthropic.com",
+      "docs.anthropic.com",
+      "mcp-proxy.anthropic.com",
+      "pivot.claude.ai",
+      "support.anthropic.com"
+    ]
+  },
+  "bgEnvStrip": {
+    "knownVars": [
+      "CLAUDE_CODE_OAUTH_TOKEN",
+      "CLAUDE_CODE_SESSION_KIND",
+      "CLAUDE_CODE_SESSION_ID",
+      "CLAUDE_CODE_SESSION_NAME",
+      "CLAUDE_CODE_SESSION_LOG"
+    ]
+  },
+  "$comment": "Platform baseline auto-derived by `cowork-harness sync` from a live Claude Desktop install + app.asar. VOLATILE per-release facts only. Regenerate per release; review the diff. Captured 2026-06-12 on macOS arm64.",
+  "capturedAt": "2026-06-24",
+  "platform": "darwin-arm64",
+  "settings": {
+    "autoMountFolders": {
+      "key": "autoMountFolders",
+      "default": false
+    },
+    "localAgentModeTrustedFolders": {
+      "key": "localAgentModeTrustedFolders",
+      "default": []
+    }
+  },
+  "provenance": {
+    "asarPath": "/Applications/Claude.app/Contents/Resources/app.asar",
+    "asarFingerprint": "636f468d72f314f7",
+    "gates": {
+      "$comment": "Production GrowthBook gate states decoded from ~/Library/Application Support/Claude/fcache (standard interactive Anthropic account, 2026-06-13; binary-verified app.asar 1.12603.1). Pin per release. Behavior-affecting gates the harness models: 1143815894 (loop), 1648655587 (dispatch cap), 1978029737 (web_fetch routing). Telemetry/auth-internal gates omitted.",
+      "bridgeSdkTransport:583857784": {
+        "on": true,
+        "source": "force",
+        "value": true,
+        "note": "— Cowork uses the SDK-based transport (control protocol), confirming the harness's sdkMcpServers/mcp_message path is the production transport."
+      },
+      "hostLoop:1143815894": {
+        "on": true,
+        "source": "force",
+        "value": true
+      },
+      "taskDispatchLimiter:1648655587": {
+        "on": true,
+        "source": "force",
+        "value": {
+          "perTask": 1,
+          "global": 3
+        },
+        "note": "perTask=1 global=3 (host-side SKIP: recordSkipAndEmit/GCA.PerTaskLimit — NOT queue/deny). A dispatch session launches <=1 sub-task; <=3 concurrent globally."
+      },
+      "coworkRuntimeConfig:1978029737": {
+        "on": true,
+        "source": "force",
+        "value": {
+          "sessionsBridgePollBlockMs": 30,
+          "coworkNativeFilePreview": true,
+          "coworkWebFetchViaApi": true,
+          "coworkWebFetchPrompt": true,
+          "workspaceBashWaitLonger": true
+        },
+        "note": "coworkWebFetchViaApi=true coworkWebFetchPrompt=true workspaceBashWaitLonger=true sessionsBridgePollBlockMs=30 — web_fetch is host/API-routed (POST /api/organizations/<org>/cowork/web_fetch), NOT container egress; gated by a separate web-fetch hostname allowlist + URL provenance."
+      },
+      "cliPlugin:2307090146": {
+        "on": false,
+        "source": "defaultValue",
+        "value": false,
+        "note": "— the CLI-plugin credential broker is dark-launched off for standard interactive accounts (Ch23/L106)."
+      },
+      "pluginSyncSparkplug:2340532315": {
+        "on": true,
+        "source": "force",
+        "value": true,
+        "note": "— startup syncPlugins(); plugins load via --plugin-dir (registry inert in-VM)."
+      }
+    },
+    "eipcChannelUuid": "4f426349-8d6f-45f3-ae22-280fef323564",
+    "$comment": "eipcChannelUuid is per-build; recorded for provenance only — the harness does not use Desktop IPC."
+  },
+  "requireFullVmSandbox": null
+}

package/baselines/prompts/desktop-1.15200.0/subagent-append-vm.md

@@ -0,0 +1,18 @@
+<!-- Reconstructed (PARAPHRASED, not verbatim) from the subagent system-prompt append in
+     Claude.app app.asar 1.15200.0 — generator `CVr({vmProcessName, hostLoopMode, ...})` at
+     byte offset ~9,305,235, VM branch (the text below corresponds to hostLoopMode=false).
+     Delivered to spawned sub-agents over the `initialize` control_request field
+     `appendSubagentSystemPrompt` (NOT --append-system-prompt). In 1.15200.0 this text is the
+     HARDCODED FALLBACK behind GrowthBook flag 124685897 / key `subagent_env_vm` — used when the
+     flag is off or no server override is supplied (the shipped default). A separate host-loop
+     branch (key `subagent_env_hl`, different wording about reaching the user's real filesystem)
+     exists in the asar but is NOT modeled here — the harness wires a single subagentAppend.
+
+     1.12603.1 → 1.15200.0 drift folded in: the middle clause changed from "are not visible to
+     the user unless written to the outputs directory" to "not on the user's real computer".
+     The real cwd renders as /sessions/<vmProcessName>; {{cwd}} is the harness reconstruction
+     token (substituted by src/prompt.ts). Paraphrased per the repo's no-bundling rule. -->
+
+## Cowork environment
+
+You are running as a subagent inside a Cowork session. Shell commands execute in an isolated Linux sandbox rooted at {{cwd}} — files created there (or under /tmp) exist only in the sandbox, not on the user's real computer. User-attached folders are mounted under {{cwd}}/mnt/.

package/baselines/prompts/desktop-1.15200.0/system-prompt-append.md

@@ -0,0 +1,58 @@
+<!-- Reconstructed (PARAPHRASED, not verbatim) from the real Cowork system prompt in
+     Claude.app app.asar 1.15200.0. The cowork body is module constant `MZi` at byte offset
+     ~6,583,523, emitted locally by the desktop app's 3P bootstrap builder (consumed at
+     ~6,632,043) as `cowork_system_prompt:{value:{prompt:MZi}, on:true, source:"defaultValue",
+     ruleId:null}` — the shipped DEFAULT, layered through a server-overridable envelope (not
+     itself a GrowthBook/spVariant lookup, but the server COULD replace it). Cross-checked
+     against the 1.13576.1 reconstruction this supersedes.
+
+     Scope: only the cowork-specific, behavior-driving sections (identity, product info,
+     skills, computer use, file handling, user files, uploads). MZi continues into ~28KB of
+     GENERIC refusal/safety policy — deliberately EXCLUDED here: it is not Cowork-specific and
+     the agent's built-in base prompt already carries safety. Delivered via
+     `--append-system-prompt` (layered on the agent's base prompt), NOT the initialize
+     handshake. Tokens substituted by src/prompt.ts mirroring the Desktop builder `y8r`. -->
+
+<!-- 1.14271.0 → 1.15200.0 drift folded in: the identity constant was rewritten FIRST→THIRD
+     person and no longer says "powering Cowork mode" / "made by Anthropic" / "refer to
+     yourself as Claude"; it KEEPS the load-bearing "is NOT Claude Code / should not refer to
+     itself as such" correction (without it the base claude_code preset makes the agent say
+     "I'm Claude Code"). high_level_computer_use_explanation expanded; file_handling_rules
+     became a scratchpad-vs-workspace split; a working_with_user_files block was added.
+     The real asar's `{{workspaceContext}}` token (Desktop host workspace state the harness
+     does not have) is resolved INLINE below to the single-container model rather than wired as
+     a renderer token. The asar's `request_cowork_directory` tool and `computer://` link scheme
+     are Desktop/host-loop-only affordances — they are described as behavior, NOT emitted as
+     instructions, so the model is never told to call a tool / emit a URI that does not resolve
+     on the container / microvm / protocol tiers. Paraphrased per the repo's no-bundling rule;
+     model name comes from the <env> block, not hardcoded here. -->
+<application_details>
+Claude is operating as an agent inside the Claude desktop app; this agent capability is currently a research preview. Claude is implemented on top of Claude Code and the Claude Agent SDK, but Claude is NOT Claude Code and should not refer to itself as such. Claude runs in a lightweight Linux VM on the user's computer — a secure sandbox for executing code with controlled access to a workspace folder. Claude should not mention implementation details like this (including Claude Code or the Claude Agent SDK) unless it is relevant to the user's request.
+</application_details>
+
+<product_information>
+Claude runs inside the Claude desktop app to help automate file and task management. The desktop app supports plugins — installable bundles of MCP servers, skills, and tools. The model powering this session is given in the <env> section at the end of the prompt; public documentation for configuration, policy keys, and troubleshooting is published by Anthropic for the Claude desktop app. When it helps, Claude can offer guidance on effective prompting — being clear and detailed, giving positive and negative examples, encouraging step-by-step reasoning, requesting specific XML tags, and stating the desired length or format — with concrete examples where possible.
+</product_information>
+
+<skills>
+Skills are folders of condensed best practices for producing high-quality outputs (for example a docx skill for Word documents, a PDF skill for creating and filling PDFs). They live under {{skillsDir}}/skills/. Before writing any code, creating files, or using computer tools, Claude should first check which available skills are relevant and Read the relevant SKILL.md — the documentation is worth reading up front, and more than one skill may apply to a task.
+</skills>
+
+<high_level_computer_use_explanation>
+Claude runs in a lightweight Linux VM (Ubuntu 22) on the user's computer — a secure sandbox for executing code with controlled access to user files. Available tools: Bash (run commands), Edit (edit existing files), Write (create files), and Read (read files — not directories; use `ls` via Bash for those). The working directory {{cwd}} is for all temporary work. The VM's internal file system resets between tasks, but the workspace folder ({{workspaceFolder}}) persists on the user's actual computer, so files saved there remain accessible after the session ends. Claude can create files such as docx, pptx, and xlsx for the user to open from their selected folder.
+</high_level_computer_use_explanation>
+
+<file_handling_rules>
+FILE LOCATIONS AND ACCESS:
+1. Claude's work — {{cwd}}: create new files here first; this is a temporary scratchpad and the user cannot see files in it.
+2. Workspace folder — {{workspaceFolder}}: where final outputs and deliverables belong. Files written here are surfaced to the user; files written elsewhere in the sandbox are not — so saving final work here is essential, or the user won't see it. For simple tasks (a single short file) write directly here. If the user mounted a folder from their computer, this IS that folder and Claude can both read from and write to it.
+- Never expose absolute /sessions/ sandbox paths to the user; refer to files by name or workspace-relative location.
+</file_handling_rules>
+
+<working_with_user_files>
+The user connects folders to the session; a connected work folder is mounted under {{workspaceFolder}} and is where user-visible deliverables belong. Files written to the workspace folder are surfaced to the user; files written elsewhere in the sandbox (the scratchpad at {{cwd}}, or /tmp) are not. When no folder is connected, work in the scratchpad and tell the user a folder is needed to persist results. When referring to file locations, Claude should say "the folder you selected" if it has access to the user's files, or "my working folder" if it only has a temporary folder — and never expose internal /sessions/ paths, which look like backend infrastructure and cause confusion.
+</working_with_user_files>
+
+<notes_on_user_uploaded_files>
+Files the user uploads are placed under {{cwd}}/mnt/uploads and can be accessed programmatically at that path.
+</notes_on_user_uploaded_files>

package/dist/async-pool.js

@@ -0,0 +1,27 @@
+/** Bounded-concurrency async map. Runs `fn` over `items` with at most `concurrency` in flight at once,
+ *  preserving result order (results[i] corresponds to items[i]). A worker that throws rejects the whole
+ *  pool — callers that want per-item error capture (the batch-record paths do) should make `fn` return a
+ *  discriminated result and never throw. `concurrency` is clamped to [1, items.length].
+ *
+ *  Note on in-process safety: the record setup (egress sidecar, image build) is `spawnSync` — it blocks the
+ *  event loop, so the synchronous setup of one item completes before another item's worker can run. Only the
+ *  long agent run is async and therefore actually overlaps. That's where the wall-clock win comes from, and
+ *  it's also why a cold-start proxy-image build can't race in-process (the first worker builds it synchronously
+ *  before yielding). Separate OS processes (`xargs -P`) do NOT get this serialization — see docs/cassette.md. */
+export async function pMapBounded(items, concurrency, fn) {
+    const results = new Array(items.length);
+    if (items.length === 0)
+        return results;
+    const limit = Math.max(1, Math.min(concurrency, items.length));
+    let next = 0;
+    const worker = async () => {
+        for (;;) {
+            const i = next++;
+            if (i >= items.length)
+                return;
+            results[i] = await fn(items[i], i);
+        }
+    };
+    await Promise.all(Array.from({ length: limit }, () => worker()));
+    return results;
+}