cowork-harness 0.15.0 → 0.17.0

package/CHANGELOG.md

@@ -6,6 +6,116 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.17.0] — 2026-06-26
+
+### Upgrade notes
+
+- **Re-record all cassettes after upgrading** (`cowork-harness record cassettes/ --rerecord-stale`).
+  The skill-hash delimiter changed (v6 → v7); `verify-cassettes` reports which cassettes need it.
+- **`transcript_no_host_path: false` is now rejected by the schema.** Remove the key or change it
+  to `true`. (It was never meaningful as `false`.)
+- **`is_null: false` on an absent path now fails loud** instead of silently passing. Add
+  `exists: true` if you intend to assert presence before the null check.
+
+### Fixed
+
+- **The microVM egress proxy port is now allocated via bind-port-0 instead of freePort().** The
+  previous approach (bind :0 → read port → close → re-bind real proxy) had a TOCTOU gap: another
+  process could grab the port between the probe close and the proxy bind. The proxy now binds on `:0`
+  directly; `actualPort` is read from the live socket and threaded into the guest firewall rule and
+  `HTTP(S)_PROXY` env after the proxy is already bound. L1 (container/hostloop) was unaffected
+  (uses a fixed port inside Docker's per-run network namespace); L0 (protocol) has no proxy.
+- **Cassette fingerprint format is v7.** The skill-hash uses a NUL byte (`\0`) to delimit entries
+  (`F:`, `D:`, `L:`) — unambiguous for all POSIX-valid filenames. `CONTENTSIG_ALGO` is 3.
+  `verify-cassettes` reports `recorded under an older hash format (v6 → v7)` for stale cassettes;
+  re-record with `--rerecord-stale` to clear.
+- **`transcript_no_host_path` only accepts `true`.** Omit the key to skip the check; `false` is
+  rejected by the schema (`const: true`).
+- **`is_null: false` requires the path to be present.** An absent path fails loud. To assert "exists
+  and is not null", write `exists: true` alongside `is_null: false`.
+- **The egress proxy no longer crashes on a double-end or EPIPE.** When an upstream TLS error
+  arrived after the response had already been ended (e.g. the client disconnected mid-stream),
+  calling `res.writeHead(502)` on an already-sent response threw, taking down the proxy for the
+  remainder of the run. The guard now skips the `writeHead` call when `res.headersSent` is true and
+  swallows the resulting EPIPE.
+- **L0 (protocol) containment check now uses `realpathSync` to guard against symlink escape.** The
+  previous path comparison used the raw strings; a symlinked workspace folder could resolve outside
+  the declared root and the check would miss it.
+- **Session `enabledPlugins` now emits the correct `{ "name@mp": true }` object-map** that
+  `claude --settings` requires, rather than an array of plugin-name strings that is silently ignored.
+  Plugin loading via `--settings` was silently broken for any session with `enabled_plugins:` set.
+- **`probeMicrovmOmitted` no longer issues a `limactl shell` probe when the Lima VM is not Running.**
+  A cold (Absent) or stopped VM cannot be probed; the harness now skips the capability probe
+  entirely and returns `null` rather than trying to shell into a non-running instance.
+- **`is_null: true` on an absent path now directs to `absent: true`** with a clear error rather than
+  silently treating absent-as-null (the two are semantically distinct: absent = the key doesn't
+  exist; null = it exists with a JSON null value).
+- **Boundary `/host` probe split into two independent checks.** The previous single-command probe
+  could false-pass when the host filesystem was sealed but the `/host` directory existed and was
+  empty. The probe now AND-combines a listing check and a no-denial text check.
+- **`--decider-llm` transport now bounded-retries a transient `claude -p` exit and surfaces *why* it
+  failed.** A single `claude -p` decider spawn can exit non-zero on a transient upstream hiccup
+  (rate-limit/overload/network) during a long back-to-back batch — observed 1/8 live runs, not reproducible
+  on demand. The non-zero-exit class is now retried (default 2 attempts, small linear backoff;
+  `COWORK_HARNESS_LLM_RETRIES=0` to disable) so a transient exit doesn't kill a 10-minute paid run at the
+  final gate. Retry never double-answers: the transport has no harness side effects, and a non-zero exit
+  delivers no answer, so the gate is answered exactly once downstream of a successful call. The timeout /
+  `maxBytes`-overflow / spawn-`ENOENT` classes are not transient and still fail loud on the first attempt.
+  (A *deterministic* non-zero exit — bad `--decider-model`, auth — is also retried the full count before
+  failing loud; the cost is bounded and the captured output names the cause.) The exit error now folds in the
+  child's captured **stdout** (where `claude -p` writes its operational diagnosis — verified) and stderr, so
+  `exited 1` is no longer undiagnosable.
+- **`--decider-llm` now binds a markdown-/quote-wrapped `OTHER:` free-text directive.** A model often
+  code-fences a verbatim directive (`` `OTHER: …` ``, `"OTHER: …"`); the leading backtick/quote previously
+  defeated the `^\s*OTHER:` anchor and the gate whiffed → fail-loud stall (observed live). The sentinel now
+  matches on the `trimNearMiss` form (wrapping quotes/backticks stripped, `:` preserved), so a real
+  `OTHER:`-named option label still wins first via the exact-label tier.
+
+## [0.16.0] — 2026-06-26
+
+### Fixed
+
+- **`--decider-llm` no longer whiffs when the answering model echoes the rendered option line (H10).** The
+  model is now prompted to reply with the option **NUMBER** (the prompt renders options numbered, with
+  descriptions on their own line) and the harness maps the number to the exact canonical label — so the
+  reproduced `"Seed / AI/ML: Seed stage…"` (model parroting the `label: description` bullet) and similar
+  whiffs can't occur on the common path. A backstop still binds a `label: description` echo (label is a
+  boundary-prefix of the reply at a `:` boundary, longest-wins) and the `(Recommended)` suffix; conversational
+  asides (`"No, I disagree…"`, `"Seed (probably) but Series A"`) and bare prose stay **loud, never a guess**.
+  The LLM decider's unanswered error now also surfaces the `closest:` label.
+- **`--decider-llm` now answers multi-select gates.** The LLM path had no `multiSelect` branch (a
+  "select all that apply" gate could pick only one option); it now accepts a comma-list of option numbers
+  (`1, 3`) and a mixed digit+label reply fails loud.
+
+### Added
+
+- **`--decider-model <id>`** (on `skill`, `decide`, and `record`) overrides the `--decider-llm` answering
+  model — flag > env `COWORK_HARNESS_DECIDER_MODEL` > the Haiku default. Use a stronger model for genuinely
+  ambiguous *judgment* gates; it does not make an under-specified gate deterministic. Requires `--decider-llm`.
+- **Scripted `choose:` (and `--answer`) accepts a stable partial anchor** for skills whose option labels
+  drift run-to-run: `choose: "Israeli company"` binds whichever single option starts with it (boundary-anchored,
+  uniqueness-guarded). It **fails loud** if the anchor matches two options — drift-tolerance, not strict CI
+  reproducibility (for that, pin a full exact label or use a free-text `answer:`).
+
+### Docs
+
+- **Added a debugging on-ramp (`docs/debugging.md`).** A router for "my skill misbehaved"
+  (`inspect` → `trace` → `chat` → `verify-run`) vs. "I don't trust this green" (the false-green hunt:
+  Gotchas, `lint`, `verify-cassettes`, `COWORK_HARNESS_DEBUG_SKILLHASH`), wired into every doc index
+  (README, `docs/README.md`, `llms.txt`, the companion skill).
+- **Documentation review sweep — doc-vs-code discrepancies corrected, DX/clarity/structure gaps closed
+  (26 files).** Adversarially verified against `src/`. Highlights: startup `--folder` is a **staged fresh
+  copy** (writes land in the run's `mnt/<folder>`, not the host original), not a live bind mount
+  (`fidelity-gaps.md`, `chat.md`); `microvm` is **Lima + Apple-VZ**, not Docker (`python/README.md`);
+  `llms.txt` command list corrected (`prune`/`inspect`, not the non-existent `runs gc`); the
+  `verify-cassettes` JSON envelope documents its `coverage{}` field (`SPEC.md`); the discovery version-gate
+  sits on **local** plugins while `.remote-plugins` is unconditional (`discovery.md`); `extra_allow` is
+  **session-level** (`DESIGN.md`); same-repo release-branch PRs **do** run the live scenario suite
+  (`RELEASING.md`); the `ci-recipe.md` live-lane gate uses a valid guard-step output (the prior
+  `if: ${{ secrets.… }}` is not a valid Actions context); plus assertion-operator (`artifact_json`'s `in`),
+  host-path-set, and exit-code corrections. DX: the `claude` CLI named as a prerequisite, the README
+  reordered to a zero-infra-first ramp, and the three doc indexes reconciled by audience.
+
 ## [0.15.0] — 2026-06-25
 
 ### Fixed

package/README.md

@@ -13,11 +13,11 @@
 
 Scriptable, CI-friendly test harness that reproduces **Claude Cowork's observable runtime contract** closely enough to test the skills you write — across many scenarios, headless, in CI — without the (locked) Desktop app. It reproduces not just Cowork's *behavior* but its *limitations*: sealed filesystem, default-deny egress, MCP-only cross-boundary — so a green test means green in real Cowork.
 
-**Contents:** [Why it works](#why-this-works-for-skill-testing) · [Fidelity tiers](#fidelity-tiers-pick-per-scenario--per-ci-job) · [Quick start](#quick-start) · [Session + scenario](#two-files-session--scenario) · [Boundary](#sandboxing-container-vs-the-real-vm) · [Discovery](#discovery-marketplaces-plugins-skills-mcp) · [Testing & CI/CD](#testing--cicd) · [Maintenance](#maintenance-parity-between-releases) · [Docs](#documentation)
+**Contents:** [Why it works](#why-this-works-for-skill-testing) · [Fidelity tiers](#fidelity-tiers-pick-per-scenario--per-ci-job) · [Quick start](#quick-start) · [Session + scenario](#two-files-session--scenario) · [Boundary](#sandboxing-container-vs-the-real-vm) · [Discovery](#discovery-marketplaces-plugins-skills-mcp) · [Debugging](./docs/debugging.md) · [Testing & CI/CD](#testing--cicd) · [Maintenance](#maintenance-parity-between-releases) · [Docs](#documentation)
 
 > **Requirements at a glance**
 > - **Free demo (`replay`):** Node ≥ 20 — nothing else (no Docker, token, or Claude Desktop).
-> - **Live tiers**: **Claude Desktop opened once** (stages the agent — nothing is bundled) · a **Claude token** (real per-run cost; runs take minutes) · plus a runtime — **Docker (arm64)** for `container` (default) / `hostloop`, or **Lima (Apple-VZ)** for `microvm`. The `protocol` tier skips the runtime + the staged agent but still calls a real model, so it needs the token. (`doctor --tier <t>` reports exactly what a given tier needs.)
+> - **Live tiers**: **Claude Desktop opened once** (stages the agent — nothing is bundled) · a **Claude token** (real per-run cost; runs take minutes — mint one with `claude setup-token`, which needs the **`claude` CLI**: `npm i -g @anthropic-ai/claude-code`) · plus a runtime — **Docker (arm64)** for `container` (default) / `hostloop`, or **Lima (Apple-VZ)** for `microvm`. The `protocol` tier skips the runtime + the staged agent but still calls a real model, so it needs the token. (`doctor --tier <t>` reports exactly what a given tier needs.)
 > - **Platform:** best on **macOS Apple Silicon**; **Windows is not supported** for the live tiers (use the token-free `replay`); `sync` and `microvm` are **macOS-arm64 only**. Full detail in [Quick start → prerequisites](#quick-start).
 
 > **New here?** Start by running a committed cassette `replay` and browsing [`examples/`](./examples/) (see [examples/README.md](./examples/README.md)) to see green runs before any setup — then read [docs/boundary.md](./docs/boundary.md) (the limitations model) and [docs/session.md](./docs/session.md) (the file you'll author).
@@ -93,7 +93,7 @@ Skill testing is the headline use, but the tool is a general harness over the Co
 | `skill <folder> "<prompt>"` | Run a local skill/plugin folder once against the staged agent | ad-hoc "is the skill alive / does it do X?" — the fast inner loop |
 | `run <scenario.yaml \| dir/>` | Run authored scenarios with `assert:` + a CI-ready exit code | you want a repeatable, **asserted regression test** |
 | `chat <folder> [prompt]` | Interactive multi-turn REPL against a skill (TTY); optional seed prompt is sent as the first turn. `--upload <file>` / `--folder <dir>` (repeatable) attach files/project folders; `--verbose` / `-V` shows thinking blocks + tool inputs; `--fidelity protocol\|container\|hostloop` | debugging a multi-turn flow by hand |
-| `record` / `replay` | `record` saves a control-protocol cassette (one scenario, or batch a `dir/`; `--rerecord-stale` refreshes only drifted ones; `--concurrency <N>` records a batch N at a time — runs are fully isolated, so it just bounds Docker/API pressure; `--max-artifact-bytes` raises the 64 KiB inline-body cap; `--dry-run` previews the scenarios + token/binary checks without recording; answer gates **live during the recording** with `--decider-dir`/`--decider-llm`/`--on-unanswered first` instead of pre-scripting them — a live decider flags the cassette non-deterministic but it still replays deterministically); `replay <file.cassette.json \| dir/>` runs a cassette **file or a `dir/` of `*.cassette.json`** deterministically (`--strict` fails on any stale one, `--fail-on-skill-drift` only on skill-source drift; staleness is also reported per-result in `staleness[]` for a JSON gate; exits on the worst verdict) | **token-free, Docker-free CI** from a once-recorded run |
+| `record` / `replay` | **Record a live run once → replay it token-free, Docker-free thereafter.** `record` saves a control-protocol cassette (one scenario, or batch a `dir/`; `--rerecord-stale` refreshes only drifted ones; `--concurrency <N>` records a batch N at a time — runs are fully isolated, so it just bounds Docker/API pressure; `--max-artifact-bytes` raises the 64 KiB inline-body cap; `--dry-run` previews the scenarios + token/binary checks without recording; answer gates **live during the recording** with `--decider-dir`/`--decider-llm`/`--on-unanswered first` instead of pre-scripting them — a live decider flags the cassette non-deterministic but it still replays deterministically); `replay <file.cassette.json \| dir/>` runs a cassette **file or a `dir/` of `*.cassette.json`** deterministically (`--strict` fails on any stale one, `--fail-on-skill-drift` only on skill-source drift; staleness is also reported per-result in `staleness[]` for a JSON gate; exits on the worst verdict) | **token-free, Docker-free CI** from a once-recorded run |
 | `verify-cassettes <file\|dir>` | Token-free CI gate over committed cassettes: a privacy scan (email/currency/domain → exit 1; whole-token allows via `--allow` / class-scoped `--allow-domain` / `--allow-email` / `--allow-file`) + a staleness check (`--skip-privacy` or `--skip-staleness` to run only one half). A dir argument scans `*.cassette.json` in that dir only (**non-recursive**) | gating **committed cassettes** against PII leaks + "edited the skill, forgot to re-record" |
 | `verify-run <run-dir> <scenario.yaml>` | Re-evaluate a scenario's `assert:` (and, when the scenario declares `answers:`, whether they still match the run's actual gates) against an already-kept run dir — **no live agent, no tokens, no Docker** (~1s) | iterating on a wrong assertion or a drifted `answer` without a full live re-record |
 | `trace <run-id>` | Digest a run's `events.jsonl` (`--view tools\|questions\|dispatches`; legacy `--tools` / `--gates` / `--dispatches` aliases still accepted) | "how many sub-agents *actually* dispatched, and which?" |
@@ -115,66 +115,6 @@ There's also a **Python `cowork` pytest lane** (`python/`) for driving any of th
 
 ---
 
-## Test a local skill in one command
-
-The fastest path — point at a **local folder**, no repo, no `claude plugin install`, no marketplace, no version bump, no cache layers. The folder is copied **fresh into the session on every run**, so you edit and re-run and your changes are live immediately:
-
-```bash
-# Auth once — export it, OR put it in a .env file (resolved: env > --dotenv > ./.env > <install>/.env):
-#   cp .env.example .env   &&   echo "CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token)" >> .env
-export CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token)
-
-cowork-harness skill ~/my-plugin 'Use my-skill to do X'                    # single-quote: no $ expansion
-cowork-harness skill ~/my-plugin --prompt-file ./prompt.txt               # prompt verbatim (raw bytes)
-cowork-harness skill ~/my-plugin "..." --answer "which format=Markdown"   # script AskUserQuestion
-cowork-harness skill ~/my-plugin "..." --fidelity protocol                # fast, no sandbox
-cowork-harness skill ~/my-plugin "..." --dry-run                          # resolve & print the launch plan, don't run
-cowork-harness skill ~/my-plugin "..." --keep                             # print the run dir to inspect
-cowork-harness skill ~/my-plugin "..." --output-format json                      # machine-readable result on stdout
-cowork-harness skill ~/my-plugin "..." --on-unanswered fail               # never fabricate an answer (CI/agents)
-cowork-harness skill ~/my-plugin "..." --decider-cmd 'node answer.js'     # answer LIVE stochastic questions via a helper
-cowork-harness skill ~/my-plugin 'review this deck' --upload deck.pdf      # attach a file → mnt/uploads (deck-review etc.)
-cowork-harness skill ~/my-plugin "..." --session-id s1                     # pin a session…
-cowork-harness skill ~/my-plugin '<next turn>' --session-id s1 --resume    # …then resume it (gated/checkpoint skills)
-cowork-harness skill ~/my-plugin "..." --keep                            # then: trace the run
-cowork-harness trace <run-id> --view tools                                # tool calls + sub-agent dispatches from events.jsonl
-cowork-harness skill --help                                               # full per-command flag reference
-
-cowork-harness chat ~/my-plugin                  # interactive multi-turn REPL (full harness: egress sandbox + control protocol)
-# chat --raw  → native interactive cowork mode via `docker run -it` (needs Docker + the arm64
-#               cowork-agent-base:2 image; the egress sandbox is NOT applied in --raw)
-```
-
-**Input policy — no silent false-greens.** When an AskUserQuestion arrives with no scripted
-`--answer`, the policy is explicit: `fail` (error + the exact `--answer` to add — the default for
-`run`/CI), `prompt` (ask at the TTY — the default for `skill` when interactive), or `first` (pick
-option 1, loudly warn). Pick with `--on-unanswered`; left unset, `skill` is **adaptive** (`prompt` on
-a TTY, `fail` when piped/CI) and `run` is always `fail`. Exit codes: `0`
-pass · `1` assertion/agent failure · `2` usage / unanswered-under-`fail` / runtime · `3` boundary/integrity.
-After a run, the footer **echoes every auto-answered
-question as a copy-pasteable `--answer "<q>=<choice>"` line** — run once exploratorily, then paste them
-back to lock in a deterministic re-run.
-
-**Output.** `skill` **renders the agent's work** (assistant text + tool calls) and a metered footer —
-you see *what it did*, not just a green. `run` is verdict-first but **prints the failing transcript
-inline** on a `FAIL` (no spelunking `runs/…`). Tune with `--quiet` (verdict only) / `--verbose`/`-V`
-(+ thinking, tool inputs, sub-agent tree). `--output-format json` emits a stable machine envelope on stdout
-(`{tool, version, command, ok, results[], error}`; errors are `{ok:false, error:{category,message,hint}}`)
-— see [SPEC §11](./SPEC.md). Human output is stderr, machine output is stdout, so `--output-format json` pipes
-cleanly. Honors `NO_COLOR`.
-
-**Test a specific local plugin version** — just point at the folder at that version (it's copied fresh; no install, no version bump). Add more with `--plugin`:
-```bash
-cowork-harness skill ~/my-plugin "..." --plugin ~/other-plugin
-```
-
-**Test a specific local marketplace version** — point at the marketplace dir (the one with `.claude-plugin/marketplace.json`); it's registered fresh each run via `claude plugin marketplace add`, no clone/cache:
-```bash
-cowork-harness skill --marketplace ~/my-marketplace --enable my-skill@my-marketplace "Use my-skill"
-```
-
-It mounts the folder(s) at the Cowork plugin path, runs the staged agent in cowork mode, and prints PASS/RESULT (add `--keep` to print the run dir, or `--output-format json` for the machine-readable result). No YAML to author. (Author `scenarios/*.yaml` only for repeatable, asserted regression tests.)
-
 ## Quick start
 
 **Install from npm:**
@@ -187,7 +127,7 @@ npm install -g cowork-harness    # puts the `cowork-harness` command on your PAT
 
 ```bash
 git clone https://github.com/yaniv-golan/cowork-harness && cd cowork-harness
-npm install && npm run build && npm link    # puts the `cowork-harness` command on your PATH
+npm ci && npm run build && npm link    # puts the `cowork-harness` command on your PATH
 # …or skip the link and call it directly: node dist/cli.js <cmd>
 ```
 
@@ -201,14 +141,14 @@ Only the committed-cassette `replay` above is fully self-contained. Live `run`/`
 
 ### Drive it from Claude Code (companion skill)
 
-This repo ships a **companion skill** (`.claude/skills/cowork-harness/`) that teaches an agent how to drive the harness — author scenarios, pick a fidelity tier, script answers, place assertions in the right CI lane, and avoid the "✓ passed ≠ correct" traps. Install it into Claude Code via the bundled marketplace:
+This repo ships a **companion skill** (`.claude/skills/cowork-harness/`) that teaches an agent how to drive the harness — author scenarios, pick a fidelity tier, script answers, place assertions in the right CI lane, and avoid the "✓ passed ≠ correct" traps. Install it via the bundled marketplace — run these **in Claude Code** (slash commands, not your shell):
 
 ```bash
 /plugin marketplace add yaniv-golan/cowork-harness
 /plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.15.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.17.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://github.com/vercel-labs/skills) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) by pointing the `npx skills` CLI at `.claude/skills/cowork-harness` in this repo. (Working *inside* this repo, the skill auto-loads as a project skill — no install needed.)
 
@@ -219,7 +159,7 @@ It also follows the open [Agent Skills](https://github.com/vercel-labs/skills) s
 (The `protocol` tier skips items 1–2 — no Docker, no staged agent — but still calls a real model via the host `claude`, so it needs item 3, the auth token; only a committed-cassette `replay` needs nothing at all):
 1. **Claude Desktop, opened once.** The Cowork agent binary is **bind-mounted from your own install** at run time — nothing Anthropic-owned is bundled. Open Cowork once so the agent ELF is staged (`…/claude-code-vm/<ver>/claude`); the harness auto-detects it, or set `COWORK_AGENT_BINARY=<path>` to point at it. Without a staged agent, container/cowork runs fail with "Open Cowork once to stage it…".
 2. **Docker (arm64)** + the agent image: `docker build --platform linux/arm64 -t cowork-agent-base:2 -f docker/Dockerfile.agent .` (override the tag with `COWORK_AGENT_IMAGE`). This **core** image mirrors the real Cowork rootfs's document/data toolchain (Node 22, openpyxl/pandas/pdf/docx/pptx, …). For OCR / LibreOffice / markitdown / opencv / PDF-table skills, build the **full-parity** image instead: `docker build --platform linux/arm64 --build-arg COWORK_FULL_PARITY=1 -t cowork-agent-full:2 -f docker/Dockerfile.agent .` and point `COWORK_AGENT_IMAGE` at it. (A run on the core image that uses an omitted capability is flagged — see capability detection.) The `-f docker/Dockerfile.agent .` paths are **repo-relative** — run it from a source checkout, not a global `npm install -g`. (Global install? Run `cowork-harness doctor --tier container` — it prints the exact `docker build` command with the correct package-local Dockerfile path.) The **`microvm` (L2)** tier uses **Lima / Apple-VZ** instead of Docker (`brew install lima`; no agent image to build) — `doctor --tier microvm` checks for that, not Docker.
-3. **An auth token** — either `export CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token)` or a **`.env`** file (copy `.env.example` → `.env`; gitignored). The token resolves in priority order: exported env > `--dotenv <path>` > `./.env` (cwd) > `<install>/.env` (the package root), so a `npm link`ed install works from any directory. Keep `.env` at a working-dir or install root, never inside a mounted skill/project folder. (Use `--dotenv`, not `--env-file` — Node reserves the latter.)
+3. **An auth token** — either `export CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token)` (the `claude setup-token` step needs the **`claude` CLI**: `npm i -g @anthropic-ai/claude-code`) or a **`.env`** file (copy `.env.example` → `.env`; gitignored). The token resolves in priority order: exported env > `--dotenv <path>` > `./.env` (cwd) > `<install>/.env` (the package root), so a `npm link`ed install works from any directory. Keep `.env` at a working-dir or install root, never inside a mounted skill/project folder. (Use `--dotenv`, not `--env-file` — Node reserves the latter.)
 
 > `sync` (below) is **optional for a first run** — the repo ships `baselines/desktop-*.json`, so `baseline: latest` already resolves. Run `sync` only to refresh the platform baseline after Claude Desktop updates. (`sync` is **macOS-only** today; on Linux/Windows use the committed baselines — they work cross-platform.)
 
@@ -282,6 +222,70 @@ cowork-harness lint examples/scenarios/*.yaml
 `@pytest.mark.cowork` + a `cowork` fixture over the `--output-format json` surface, selectable with
 `-m cowork` (opt-in, beside your fast tests).
 
+## Test a local skill in one command
+
+> **First time here?** The commands below assume the `cowork-harness` CLI is installed and a token is set —
+> see [Quick start](#quick-start) for both, and run `cowork-harness doctor` to check what's missing. For the
+> zero-infra path (no Docker, no token), start with the token-free [`replay` demo](#quick-start).
+
+The fastest path — point at a **local folder**, no repo, no `claude plugin install`, no marketplace, no version bump, no cache layers. The folder is copied **fresh into the session on every run**, so you edit and re-run and your changes are live immediately:
+
+```bash
+# Auth once — export it, OR put it in a .env file (resolved: env > --dotenv > ./.env > <install>/.env):
+#   cp .env.example .env   &&   echo "CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token)" >> .env
+export CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token)
+
+cowork-harness skill ~/my-plugin 'Use my-skill to do X'                    # single-quote: no $ expansion
+cowork-harness skill ~/my-plugin --prompt-file ./prompt.txt               # prompt verbatim (raw bytes)
+cowork-harness skill ~/my-plugin "..." --answer "which format=Markdown"   # script AskUserQuestion
+cowork-harness skill ~/my-plugin "..." --fidelity protocol                # fast, no sandbox
+cowork-harness skill ~/my-plugin "..." --dry-run                          # resolve & print the launch plan, don't run
+cowork-harness skill ~/my-plugin "..." --keep                             # print the run dir to inspect
+cowork-harness skill ~/my-plugin "..." --output-format json                      # machine-readable result on stdout
+cowork-harness skill ~/my-plugin "..." --on-unanswered fail               # never fabricate an answer (CI/agents)
+cowork-harness skill ~/my-plugin "..." --decider-cmd 'node answer.js'     # answer LIVE stochastic questions via a helper
+cowork-harness skill ~/my-plugin 'review this deck' --upload deck.pdf      # attach a file → mnt/uploads (deck-review etc.)
+cowork-harness skill ~/my-plugin "..." --session-id s1                     # pin a session…
+cowork-harness skill ~/my-plugin '<next turn>' --session-id s1 --resume    # …then resume it (gated/checkpoint skills)
+cowork-harness skill ~/my-plugin "..." --keep                            # then: trace the run
+cowork-harness trace <run-id> --view tools                                # tool calls + sub-agent dispatches from events.jsonl
+cowork-harness skill --help                                               # full per-command flag reference
+
+cowork-harness chat ~/my-plugin                  # interactive multi-turn REPL (full harness: egress sandbox + control protocol)
+# chat --raw  → native interactive cowork mode via `docker run -it` (needs Docker + the arm64
+#               cowork-agent-base:2 image; the egress sandbox is NOT applied in --raw)
+```
+
+**Input policy — no silent false-greens.** When an AskUserQuestion arrives with no scripted
+`--answer`, the policy is explicit: `fail` (error + the exact `--answer` to add — the default for
+`run`/CI), `prompt` (ask at the TTY — the default for `skill` when interactive), or `first` (pick
+option 1, loudly warn). Pick with `--on-unanswered`; left unset, `skill` is **adaptive** (`prompt` on
+a TTY, `fail` when piped/CI) and `run` is always `fail`. Exit codes: `0`
+pass · `1` assertion/agent failure · `2` usage / unanswered-under-`fail` / runtime · `3` boundary/integrity.
+After a run, the footer **echoes every auto-answered
+question as a copy-pasteable `--answer "<q>=<choice>"` line** — run once exploratorily, then paste them
+back to lock in a deterministic re-run.
+
+**Output.** `skill` **renders the agent's work** (assistant text + tool calls) and a metered footer —
+you see *what it did*, not just a green. `run` is verdict-first but **prints the failing transcript
+inline** on a `FAIL` (no spelunking `runs/…`). Tune with `--quiet` (verdict only) / `--verbose`/`-V`
+(+ thinking, tool inputs, sub-agent tree). `--output-format json` emits a stable machine envelope on stdout
+(`{tool, version, command, ok, results[], error}`; errors are `{ok:false, error:{category,message,hint}}`)
+— see [SPEC §11](./SPEC.md). Human output is stderr, machine output is stdout, so `--output-format json` pipes
+cleanly. Honors `NO_COLOR`.
+
+**Test a specific local plugin version** — just point at the folder at that version (it's copied fresh; no install, no version bump). Add more with `--plugin`:
+```bash
+cowork-harness skill ~/my-plugin "..." --plugin ~/other-plugin
+```
+
+**Test a specific local marketplace version** — point at the marketplace dir (the one with `.claude-plugin/marketplace.json`); it's registered fresh each run via `claude plugin marketplace add`, no clone/cache:
+```bash
+cowork-harness skill --marketplace ~/my-marketplace --enable my-skill@my-marketplace "Use my-skill"
+```
+
+It mounts the folder(s) at the Cowork plugin path, runs the staged agent in cowork mode, and prints PASS/RESULT (add `--keep` to print the run dir, or `--output-format json` for the machine-readable result). No YAML to author. (Author `scenarios/*.yaml` only for repeatable, asserted regression tests.)
+
 ---
 
 ## Two files: session + scenario
@@ -392,6 +396,8 @@ agent.stderr.log    the agent process's stderr (auth errors, flag rejects)
 
 Secrets (the injected OAuth token / API key) are scrubbed from every persisted log by value.
 
+**Debugging a run** — when a run misbehaves or a green looks too good to trust, [docs/debugging.md](./docs/debugging.md) is the map: `inspect` → `trace` → `chat` → `verify-run` for a misbehaving skill, and the false-green hunt for a green you don't trust.
+
 ---
 
 ## Architecture
@@ -469,11 +475,13 @@ Unit tests cover the scripted-answer logic, the egress allowlist matcher, the se
 
 ### Reproducibility knobs
 
+Most runs need **none** of these — the defaults are correct. They're grouped by theme below (container/runtime, networking/loop, strictness, staleness, secret-scrubbing, L2 microVM, `skill`/`chat` defaults); reach for one only when a default doesn't fit. Every var name is `COWORK_*` / `CLAUDE_*`, so a search across this section finds it fast.
+
 - `COWORK_LOCKDOWN=off` — relax container hardening for debugging (default `on`). With it `on`, an L2 microVM whose guest egress firewall fails to apply **aborts loudly** rather than running un-isolated.
 - `COWORK_CONTAINER_RUNTIME=podman` — use Podman instead of Docker.
 - `COWORK_AGENT_IMAGE=<tag>` — override the agent image name (default `cowork-agent-base:2`); `COWORK_AGENT_BINARY=<path>` — override the auto-detected staged agent ELF.
 - `COWORK_SKIP_CAPABILITY_PROBE=1` — skip the per-run capability probe (the harness otherwise probes the agent image/VM for the document/OCR/Office capabilities the real Cowork rootfs ships and **fails a run that uses one the image omits** — a likely false negative; suppress per-scenario with `allow_missing_capability: true`, or rebuild full parity).
-- `COWORK_HARNESS_DECIDER_DIR_POLL_MS` / `_TIMEOUT_MS` — tune the `--decider-dir` rendezvous poll/backstop; `COWORK_HARNESS_DECIDER_CMD_TIMEOUT_MS` / `COWORK_HARNESS_LLM_TIMEOUT_MS` — backstop a hung `--decider-cmd` helper / `--decider-llm` model call (default 600 s, fail loud); `COWORK_HARNESS_DIALOG_TIMEOUT_MS` — override the 6 s dialog auto-cancel.
+- `COWORK_HARNESS_DECIDER_MODEL` — the default `--decider-llm` answering model (overridden by the `--decider-model` flag; falls back to the Haiku default). `COWORK_HARNESS_DECIDER_DIR_POLL_MS` / `_TIMEOUT_MS` — tune the `--decider-dir` rendezvous poll/backstop; `COWORK_HARNESS_DECIDER_CMD_TIMEOUT_MS` / `COWORK_HARNESS_LLM_TIMEOUT_MS` — backstop a hung `--decider-cmd` helper / `--decider-llm` model call (default 600 s, fail loud); `COWORK_HARNESS_LLM_RETRIES` — bounded retries for a transient non-zero `claude -p` exit in the `--decider-llm` transport (default 2, clamped to 0–10; set `0` to disable, e.g. deterministic CI); `COWORK_HARNESS_DIALOG_TIMEOUT_MS` — override the 6 s dialog auto-cancel.
 - `COWORK_HARNESS_RUNS_DIR` (or the `--run-dir <path>` flag) — override the default run-output root `~/.cowork-harness/runs` (kept out of any working tree so sensitive skill inputs/outputs don't land in a repo). Precedence: `--run-dir` > env > default. The root is flat and machine-global (shared across projects); pinned `--session-id` runs are guarded against cross-project overwrite, and `prune` never prunes them. In CI, set it to a workspace path (e.g. `runs`) so artifact upload can collect the runs. `COWORK_HARNESS_ALLOW_FOREIGN_RESUME=1` overrides the guard that blocks `--resume` onto another project's pinned session.
 - **Networking / loop:** `COWORK_EGRESS_PROXY` overrides the egress-proxy URL injected into the sandbox; `COWORK_PROXY_IMAGE` overrides the egress proxy Docker image name (default `cowork-egress-proxy:1`); `COWORK_DOCKER_NETWORK` pins the Docker network the agent container joins; `CLAUDE_FORCE_HOST_LOOP=1` forces the host-loop path regardless of the baseline's loop decision (the `cowork` tier's auto-pick). `COWORK_LIMACTL` overrides the `limactl` binary path (default `/opt/homebrew/bin/limactl`).
 - **Strictness escape hatches** (the harness fails loud by default): `COWORK_HARNESS_SOFT_MISSING=1` downgrades a missing mount source from a hard error to warn-and-exclude; `COWORK_HARNESS_ALLOW_CONFIG_DIR_WRITE=1` permits writing into an existing pinned `plugins.config_dir` (otherwise refused, to avoid clobbering a real Claude config).
@@ -541,6 +549,7 @@ This repo is built to be driven by agents, not just read by humans:
 | [docs/session.md](./docs/session.md) | Every `sessions/*.yaml` field and its Cowork mapping. |
 | [docs/scenario.md](./docs/scenario.md) | `scenarios/*.yaml` — prompt, scripted answers, assertions. |
 | [docs/chat.md](./docs/chat.md) | The interactive `chat` REPL — multi-turn debugging, flags, attaching files/folders. |
+| [docs/debugging.md](./docs/debugging.md) | Debugging a run — `inspect`/`trace`/`chat`/`verify-run` for a misbehaving skill; the false-green hunt for a green you don't trust. |
 | [docs/cassette.md](./docs/cassette.md) | `record`/`replay` cassettes — what replay checks, which assertions are skipped. |
 | [docs/fidelity-gaps.md](./docs/fidelity-gaps.md) | The known deltas vs. real Cowork — what the harness does and doesn't reproduce. |
 | [docs/decider-dir.md](./docs/decider-dir.md) | The `--decider-dir` recipe — a driving agent answers live gates in-band via `gates`/`answer` + a Monitor. |
@@ -552,6 +561,7 @@ This repo is built to be driven by agents, not just read by humans:
 | [python/README.md](./python/README.md) | The `cowork` pytest lane for driving the harness from Python. |
 | [examples/README.md](./examples/README.md) | The worked examples to copy — sessions, scenarios, and skills you can run end-to-end. |
 | [SECURITY.md](./SECURITY.md) | Threat model — the sandbox is a fidelity fixture, not a security boundary. |
+| [RELEASING.md](./RELEASING.md) | The release flow — branch → PR → tag → npm publish. |
 
 ## Status
 
@@ -559,7 +569,7 @@ This repo is built to be driven by agents, not just read by humans:
 
 - ✅ **Three isolation tiers (L0/L1/L2) + two loop-mode overlays** — `protocol` (L0 control loop), `container` (L1 sandboxed arm64 + per-run default-deny egress sidecar), `microvm` (L2 real Apple-VZ Linux microVM + guest firewall); plus the loop-mode overlays `hostloop` (production split-execution: agent loop on host, shell/web via the workspace SDK-MCP server) and `cowork` (auto-picks host-loop vs container the way Cowork does — gate `1143815894`). Egress enforced at container/microvm/hostloop; `boundary-check` reports **ALL CONSTRAINTS ENFORCED**.
 - ✅ **Three-seam driver** — `AgentSession` (control protocol) → `Decider` (scripted + `on_unanswered` policy, no silent false-greens) → `Run` (turn loop, sub-agent dispatch tree, `RunRecord`). Multi-turn `chat`, deterministic cassette `record`/`replay` (no token), `run.jsonl`/`trace.json` logging with secret-scrub.
-- ✅ **Answering live questions, every way you'd need** — `--decider-llm --intent "<one line>"` (a small model picks per question, steered by your test intent — the ergonomic default; non-determinism is flagged so a green isn't mistaken for a scripted pass), `--answer-policy <yaml>`/`--answer "rx=c"` (declarative regex→label, deterministic CI), `--decider-cmd '<helper>'` (custom logic — the Python `serve_decider(fn)` adapter pre-builds the wire loop so the helper writes only the decision), and **`--decider-dir <dir>`** (the *driving agent* answers each gate **in-band** with full context — it arms a Monitor on `cowork-harness gates <dir> --follow` and replies with `cowork-harness answer <dir> --gate <N> --choose <label>`; the session-under-test stays live, no resume/re-worded question — binary-verified). **multiSelect gates** are answerable on every channel — repeat `--choose` (or send a JSON-array reply from a `--decider-cmd` helper / hand-written `resp-N.json`); all deliver the binary-verified `", "`-joined wire shape. Every channel keeps stdout free, so all compose with `--output-format json`. A question is **never silently answered with option 1** — unhandled fails loud. Validate any decider in ~2s with `cowork-harness decide`.
+- ✅ **Answering live questions, every way you'd need** — `--decider-llm --intent "<one line>"` (a small model picks per question, steered by your test intent — the ergonomic default; it replies with the option **number**, mapped to the exact label, so it can't whiff by parroting the label text, and an out-of-set reply fails loud; raise the answering model for ambiguous judgment gates with **`--decider-model <id>`**; non-determinism is flagged so a green isn't mistaken for a scripted pass), `--answer-policy <yaml>`/`--answer "rx=c"` (declarative regex→label, deterministic CI — accepts a **stable partial anchor** for skills whose labels drift run-to-run), `--decider-cmd '<helper>'` (custom logic — the Python `serve_decider(fn)` adapter pre-builds the wire loop so the helper writes only the decision), and **`--decider-dir <dir>`** (the *driving agent* answers each gate **in-band** with full context — it arms a Monitor on `cowork-harness gates <dir> --follow` and replies with `cowork-harness answer <dir> --gate <N> --choose <label>`; the session-under-test stays live, no resume/re-worded question — binary-verified). **multiSelect gates** are answerable on every channel — repeat `--choose` (or, for `--decider-llm`, a comma-list of option numbers; or a JSON-array reply from a `--decider-cmd` helper / hand-written `resp-N.json`); all deliver the binary-verified `", "`-joined wire shape. Every channel keeps stdout free, so all compose with `--output-format json`. A question is **never silently answered with option 1** — unhandled fails loud. Validate any decider in ~2s with `cowork-harness decide`.
 - ✅ **Sub-agent aggregation + `trace`** — recognizes the real `Agent` dispatch tool (binary-verified; `Task` is its alias) so `subagent_dispatched`/`dispatch_count_max` fire under `--fidelity cowork`, excluding the `TaskCreate` todo list; `cowork-harness trace <id> --view tools` digests `events.jsonl` (each tool row now shows its **result status** `ok`/`error`), and `trace <id> --view questions` shows the gate lifecycle (**question → injected answer → delivered result**); `result.json`/`--keep` surface the deep `mnt/outputs` deliverable path.
 - ✅ **Answer delivery is verified, not assumed** — an AskUserQuestion answer is injected as the binary's full tool input (`{questions, answers}`, ELF-verified), so the answer actually reaches the model; `RunResult.gateDeliveries[]` + the `gate_answers_delivered` assertion catch any delivery failure, and `RunResult.toolCounts` gives the **truthful** per-tool call count (host-routed `WebSearch` shows here, not the always-0 `usage.server_tool_use`).
 - ✅ **Binary-grounded fidelity** — cwd `/sessions/<id>`, the three-channel MCP model (`--mcp-config` honored in plain cowork mode; host/API-routed `web_fetch`; SDK-server delivery), host-loop tool partition, auth-env token-only drop, and production GrowthBook gates pinned per release.

package/dist/agent/session.js

@@ -153,8 +153,16 @@ export function deserializeDecision(req, body) {
     if (req.kind === "question") {
         // AskUserQuestion: body is { behavior:"allow", updatedInput:{ questions, answers } }
         // We read `answers` back; `questions` was preserved in recording for the O7 guard.
+        // Validate `answers` instead of a blind cast — a non-object, array, or answers map with
+        // non-string values coerces to {} which will NOT re-serialize to the recorded body, so the
+        // O7 replay_protocol_fidelity guard trips loud rather than silently coercing corrupt data.
         const ui = (body.updatedInput ?? {});
-        return { kind: "question", answers: (ui.answers ?? {}) };
+        const raw = ui.answers;
+        const isValidAnswers = raw !== null &&
+            typeof raw === "object" &&
+            !Array.isArray(raw) &&
+            Object.values(raw).every((v) => typeof v === "string");
+        return { kind: "question", answers: isValidAnswers ? raw : {} };
     }
     if (req.kind === "dialog") {
         return {
@@ -288,7 +296,13 @@ export class LiveAgentSession {
                     yield { type: "raw", line };
                     continue;
                 }
-                yield* this.translate(msg);
+                try {
+                    yield* this.translate(msg);
+                }
+                catch (e) {
+                    yield { type: "error", source: "protocol", message: e?.message ?? String(e) };
+                    return;
+                }
             }
             // stdout closed. Give a pending 'exit' one tick to land (NOT a blocking wait on 'close' — a
             // mock/fake child may never emit it), then surface a nonzero/signal exit as a typed error — a

package/dist/assert.js

@@ -163,12 +163,25 @@ function check(a, ctx) {
         results.push(ctx.toolResultTexts.some((t) => t.includes(a.tool_result_contains))
             ? ok()
             : fail(`no tool result contained "${a.tool_result_contains}"`));
-    if (a.tool_result_not_contains !== undefined)
-        results.push(ctx.toolResultsMissing
-            ? fail(`evidence unavailable: tool results absent from result.json — cannot evaluate tool_result_not_contains`)
-            : ctx.toolResultTexts.every((t) => !t.includes(a.tool_result_not_contains))
-                ? ok()
-                : fail(`a tool result unexpectedly contained "${a.tool_result_not_contains}"`));
+    if (a.tool_result_not_contains !== undefined) {
+        if (ctx.toolResultsMissing) {
+            results.push(fail(`evidence unavailable: tool results absent from result.json — cannot evaluate tool_result_not_contains`));
+        }
+        else {
+            const forbidden = a.tool_result_not_contains;
+            const positiveHit = ctx.toolResultTexts.some((t) => t.includes(forbidden));
+            if (positiveHit) {
+                results.push(fail(`a tool result unexpectedly contained "${forbidden}"`));
+            }
+            else {
+                const hasTruncatedAbsence = ctx.toolResultsTruncated !== undefined &&
+                    ctx.toolResultTexts.some((t, i) => !t.includes(forbidden) && ctx.toolResultsTruncated[i] === true);
+                results.push(hasTruncatedAbsence
+                    ? fail(`evidence unavailable: one or more tool results are display-truncated (no assertText) — cannot rule out forbidden substring`)
+                    : ok());
+            }
+        }
+    }
     // Fuzzy content for stochastic prose. All regex-building assertions are try/catch-wrapped —
     // `evaluate()` is a bare `.map(check)` with no error boundary, so a malformed pattern must be a
     // clean assertion failure, not an uncaught throw. Case-insensitive ("i").
@@ -428,8 +441,13 @@ function check(a, ctx) {
                         }
                         if (aj.is_null !== undefined) {
                             any = true;
-                            const isNull = present && val === null;
-                            results.push(isNull === aj.is_null ? ok() : fail(`artifact_json: "${aj.path}" is_null=${isNull}, expected ${aj.is_null}`));
+                            if (!present) {
+                                results.push(fail(`artifact_json: "${aj.path ?? "(root)"}" is_null: path is absent — cannot determine null-ness (use absent: true to assert absence)`));
+                            }
+                            else {
+                                const isNull = val === null;
+                                results.push(isNull === aj.is_null ? ok() : fail(`artifact_json: "${aj.path ?? "(root)"}" is_null=${isNull}, expected ${aj.is_null}`));
+                            }
                         }
                         if (aj.equals !== undefined) {
                             any = true;

package/dist/baseline.js

@@ -151,7 +151,11 @@ export function resolveMounts(baseline, sessionId, projectId = "proj1") {
     const subst = (s) => s.replace("{sessionId}", sessionId).replace("{projectId}", projectId);
     const cwd = subst(baseline.mountLayout.cwd);
     const sessionRoot = subst(baseline.mountLayout.sessionRoot);
-    const mntRoot = subst(baseline.mountLayout.mntRoot ?? `${baseline.mountLayout.sessionRoot}/mnt`);
+    // TODO: container.ts:31 computes configGuest independently from sessionRoot and is NOT fixed here;
+    // the legacy desktop-1.11847.5 baseline (sessionRoot ending in /mnt, no spawn block) still produces
+    // a double-mnt configGuest path (/sessions/<id>/mnt/mnt/.claude) — that is a separate out-of-scope issue.
+    const rawSessionRoot = baseline.mountLayout.sessionRoot;
+    const mntRoot = subst(baseline.mountLayout.mntRoot ?? (rawSessionRoot.endsWith("/mnt") ? rawSessionRoot : `${rawSessionRoot}/mnt`));
     return {
         cwd,
         sessionRoot,

package/dist/boundary.js

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { mkdtempSync } from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir, userInfo, homedir } from "node:os";
 import { join } from "node:path";
 import { startEgressSidecar } from "./egress/sidecar.js";
@@ -20,7 +20,8 @@ export function runBoundaryChecks(baseline, session) {
     // Stand up the real per-run boundary (internal network + allowlist proxy), exactly
     // what a container-fidelity scenario uses. Tear it down at the end.
     const runId = `bchk${process.hrtime.bigint().toString(36)}`;
-    const sidecar = startEgressSidecar(boundaryAllowList(baseline, session), mkdtempSync(join(tmpdir(), "cowork-bchk-")), runId);
+    const tmpDir = mkdtempSync(join(tmpdir(), "cowork-bchk-"));
+    const sidecar = startEgressSidecar(boundaryAllowList(baseline, session), tmpDir, runId);
     const network = sidecar.network;
     const proxy = sidecar.proxyUrl;
     // Probes can throw (spawnSync setup errors, etc.); tear the sidecar down in `finally` so an unexpected
@@ -41,15 +42,20 @@ export function runBoundaryChecks(baseline, session) {
             shell,
         ], { encoding: "utf8", timeout: 30_000 });
         // 1. Host filesystem is NOT visible (no /Users, no host home bind).
+        // TWO independent probes so a leak on EITHER path fails the check — a combined-string
+        // probe can false-pass when one path leaks (real listing) but the other path's denial
+        // substring satisfies isHostFsSealed's `denied` regex on the joined output.
         {
-            const r = probe(`ls /Users 2>&1 || true; ls /host 2>&1 || true`);
-            const out = (r.stdout ?? "") + (r.stderr ?? "");
-            const blocked = isHostFsSealed(out);
+            const combine = (r) => (r.stdout ?? "") + (r.stderr ?? "");
+            const outUsers = combine(probe("ls /Users 2>&1 || true"));
+            const outHost = combine(probe("ls /host 2>&1 || true"));
+            const blocked = isHostFsSealed(outUsers) && isHostFsSealed(outHost);
+            const detail = (outUsers + "\n" + outHost).trim().slice(0, 200);
             results.push({
                 check: "host-fs-sealed",
                 expectation: "host paths (/Users, /host) invisible",
                 pass: blocked,
-                detail: out.trim().slice(0, 200),
+                detail,
             });
         }
         // 2. Direct (non-proxied) egress is impossible — no route off the internal net.
@@ -89,6 +95,12 @@ export function runBoundaryChecks(baseline, session) {
     }
     finally {
         sidecar.teardown();
+        try {
+            rmSync(tmpDir, { recursive: true, force: true });
+        }
+        catch {
+            /* best-effort: bind-mounted log may be root-owned on Linux */
+        }
     }
 }
 /** Escape regex metacharacters in a literal so it can be embedded in a RegExp. */