cowork-harness 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -6,6 +6,71 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.17.0] — 2026-06-26
+
+### Upgrade notes
+
+- **Re-record all cassettes after upgrading** (`cowork-harness record cassettes/ --rerecord-stale`).
+  The skill-hash delimiter changed (v6 → v7); `verify-cassettes` reports which cassettes need it.
+- **`transcript_no_host_path: false` is now rejected by the schema.** Remove the key or change it
+  to `true`. (It was never meaningful as `false`.)
+- **`is_null: false` on an absent path now fails loud** instead of silently passing. Add
+  `exists: true` if you intend to assert presence before the null check.
+
+### Fixed
+
+- **The microVM egress proxy port is now allocated via bind-port-0 instead of freePort().** The
+  previous approach (bind :0 → read port → close → re-bind real proxy) had a TOCTOU gap: another
+  process could grab the port between the probe close and the proxy bind. The proxy now binds on `:0`
+  directly; `actualPort` is read from the live socket and threaded into the guest firewall rule and
+  `HTTP(S)_PROXY` env after the proxy is already bound. L1 (container/hostloop) was unaffected
+  (uses a fixed port inside Docker's per-run network namespace); L0 (protocol) has no proxy.
+- **Cassette fingerprint format is v7.** The skill-hash uses a NUL byte (`\0`) to delimit entries
+  (`F:`, `D:`, `L:`) — unambiguous for all POSIX-valid filenames. `CONTENTSIG_ALGO` is 3.
+  `verify-cassettes` reports `recorded under an older hash format (v6 → v7)` for stale cassettes;
+  re-record with `--rerecord-stale` to clear.
+- **`transcript_no_host_path` only accepts `true`.** Omit the key to skip the check; `false` is
+  rejected by the schema (`const: true`).
+- **`is_null: false` requires the path to be present.** An absent path fails loud. To assert "exists
+  and is not null", write `exists: true` alongside `is_null: false`.
+- **The egress proxy no longer crashes on a double-end or EPIPE.** When an upstream TLS error
+  arrived after the response had already been ended (e.g. the client disconnected mid-stream),
+  calling `res.writeHead(502)` on an already-sent response threw, taking down the proxy for the
+  remainder of the run. The guard now skips the `writeHead` call when `res.headersSent` is true and
+  swallows the resulting EPIPE.
+- **L0 (protocol) containment check now uses `realpathSync` to guard against symlink escape.** The
+  previous path comparison used the raw strings; a symlinked workspace folder could resolve outside
+  the declared root and the check would miss it.
+- **Session `enabledPlugins` now emits the correct `{ "name@mp": true }` object-map** that
+  `claude --settings` requires, rather than an array of plugin-name strings that is silently ignored.
+  Plugin loading via `--settings` was silently broken for any session with `enabled_plugins:` set.
+- **`probeMicrovmOmitted` no longer issues a `limactl shell` probe when the Lima VM is not Running.**
+  A cold (Absent) or stopped VM cannot be probed; the harness now skips the capability probe
+  entirely and returns `null` rather than trying to shell into a non-running instance.
+- **`is_null: true` on an absent path now directs to `absent: true`** with a clear error rather than
+  silently treating absent-as-null (the two are semantically distinct: absent = the key doesn't
+  exist; null = it exists with a JSON null value).
+- **Boundary `/host` probe split into two independent checks.** The previous single-command probe
+  could false-pass when the host filesystem was sealed but the `/host` directory existed and was
+  empty. The probe now AND-combines a listing check and a no-denial text check.
+- **`--decider-llm` transport now bounded-retries a transient `claude -p` exit and surfaces *why* it
+  failed.** A single `claude -p` decider spawn can exit non-zero on a transient upstream hiccup
+  (rate-limit/overload/network) during a long back-to-back batch — observed 1/8 live runs, not reproducible
+  on demand. The non-zero-exit class is now retried (default 2 attempts, small linear backoff;
+  `COWORK_HARNESS_LLM_RETRIES=0` to disable) so a transient exit doesn't kill a 10-minute paid run at the
+  final gate. Retry never double-answers: the transport has no harness side effects, and a non-zero exit
+  delivers no answer, so the gate is answered exactly once downstream of a successful call. The timeout /
+  `maxBytes`-overflow / spawn-`ENOENT` classes are not transient and still fail loud on the first attempt.
+  (A *deterministic* non-zero exit — bad `--decider-model`, auth — is also retried the full count before
+  failing loud; the cost is bounded and the captured output names the cause.) The exit error now folds in the
+  child's captured **stdout** (where `claude -p` writes its operational diagnosis — verified) and stderr, so
+  `exited 1` is no longer undiagnosable.
+- **`--decider-llm` now binds a markdown-/quote-wrapped `OTHER:` free-text directive.** A model often
+  code-fences a verbatim directive (`` `OTHER: …` ``, `"OTHER: …"`); the leading backtick/quote previously
+  defeated the `^\s*OTHER:` anchor and the gate whiffed → fail-loud stall (observed live). The sentinel now
+  matches on the `trimNearMiss` form (wrapping quotes/backticks stripped, `:` preserved), so a real
+  `OTHER:`-named option label still wins first via the exact-label tier.
+
 ## [0.16.0] — 2026-06-26
 
 ### Fixed

package/README.md

@@ -148,7 +148,7 @@ This repo ships a **companion skill** (`.claude/skills/cowork-harness/`) that te
 /plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.16.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.17.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://github.com/vercel-labs/skills) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) by pointing the `npx skills` CLI at `.claude/skills/cowork-harness` in this repo. (Working *inside* this repo, the skill auto-loads as a project skill — no install needed.)
 
@@ -481,7 +481,7 @@ Most runs need **none** of these — the defaults are correct. They're grouped b
 - `COWORK_CONTAINER_RUNTIME=podman` — use Podman instead of Docker.
 - `COWORK_AGENT_IMAGE=<tag>` — override the agent image name (default `cowork-agent-base:2`); `COWORK_AGENT_BINARY=<path>` — override the auto-detected staged agent ELF.
 - `COWORK_SKIP_CAPABILITY_PROBE=1` — skip the per-run capability probe (the harness otherwise probes the agent image/VM for the document/OCR/Office capabilities the real Cowork rootfs ships and **fails a run that uses one the image omits** — a likely false negative; suppress per-scenario with `allow_missing_capability: true`, or rebuild full parity).
-- `COWORK_HARNESS_DECIDER_MODEL` — the default `--decider-llm` answering model (overridden by the `--decider-model` flag; falls back to the Haiku default). `COWORK_HARNESS_DECIDER_DIR_POLL_MS` / `_TIMEOUT_MS` — tune the `--decider-dir` rendezvous poll/backstop; `COWORK_HARNESS_DECIDER_CMD_TIMEOUT_MS` / `COWORK_HARNESS_LLM_TIMEOUT_MS` — backstop a hung `--decider-cmd` helper / `--decider-llm` model call (default 600 s, fail loud); `COWORK_HARNESS_DIALOG_TIMEOUT_MS` — override the 6 s dialog auto-cancel.
+- `COWORK_HARNESS_DECIDER_MODEL` — the default `--decider-llm` answering model (overridden by the `--decider-model` flag; falls back to the Haiku default). `COWORK_HARNESS_DECIDER_DIR_POLL_MS` / `_TIMEOUT_MS` — tune the `--decider-dir` rendezvous poll/backstop; `COWORK_HARNESS_DECIDER_CMD_TIMEOUT_MS` / `COWORK_HARNESS_LLM_TIMEOUT_MS` — backstop a hung `--decider-cmd` helper / `--decider-llm` model call (default 600 s, fail loud); `COWORK_HARNESS_LLM_RETRIES` — bounded retries for a transient non-zero `claude -p` exit in the `--decider-llm` transport (default 2, clamped to 0–10; set `0` to disable, e.g. deterministic CI); `COWORK_HARNESS_DIALOG_TIMEOUT_MS` — override the 6 s dialog auto-cancel.
 - `COWORK_HARNESS_RUNS_DIR` (or the `--run-dir <path>` flag) — override the default run-output root `~/.cowork-harness/runs` (kept out of any working tree so sensitive skill inputs/outputs don't land in a repo). Precedence: `--run-dir` > env > default. The root is flat and machine-global (shared across projects); pinned `--session-id` runs are guarded against cross-project overwrite, and `prune` never prunes them. In CI, set it to a workspace path (e.g. `runs`) so artifact upload can collect the runs. `COWORK_HARNESS_ALLOW_FOREIGN_RESUME=1` overrides the guard that blocks `--resume` onto another project's pinned session.
 - **Networking / loop:** `COWORK_EGRESS_PROXY` overrides the egress-proxy URL injected into the sandbox; `COWORK_PROXY_IMAGE` overrides the egress proxy Docker image name (default `cowork-egress-proxy:1`); `COWORK_DOCKER_NETWORK` pins the Docker network the agent container joins; `CLAUDE_FORCE_HOST_LOOP=1` forces the host-loop path regardless of the baseline's loop decision (the `cowork` tier's auto-pick). `COWORK_LIMACTL` overrides the `limactl` binary path (default `/opt/homebrew/bin/limactl`).
 - **Strictness escape hatches** (the harness fails loud by default): `COWORK_HARNESS_SOFT_MISSING=1` downgrades a missing mount source from a hard error to warn-and-exclude; `COWORK_HARNESS_ALLOW_CONFIG_DIR_WRITE=1` permits writing into an existing pinned `plugins.config_dir` (otherwise refused, to avoid clobbering a real Claude config).

package/dist/agent/session.js

@@ -153,8 +153,16 @@ export function deserializeDecision(req, body) {
     if (req.kind === "question") {
         // AskUserQuestion: body is { behavior:"allow", updatedInput:{ questions, answers } }
         // We read `answers` back; `questions` was preserved in recording for the O7 guard.
+        // Validate `answers` instead of a blind cast — a non-object, array, or answers map with
+        // non-string values coerces to {} which will NOT re-serialize to the recorded body, so the
+        // O7 replay_protocol_fidelity guard trips loud rather than silently coercing corrupt data.
         const ui = (body.updatedInput ?? {});
-        return { kind: "question", answers: (ui.answers ?? {}) };
+        const raw = ui.answers;
+        const isValidAnswers = raw !== null &&
+            typeof raw === "object" &&
+            !Array.isArray(raw) &&
+            Object.values(raw).every((v) => typeof v === "string");
+        return { kind: "question", answers: isValidAnswers ? raw : {} };
     }
     if (req.kind === "dialog") {
         return {
@@ -288,7 +296,13 @@ export class LiveAgentSession {
                     yield { type: "raw", line };
                     continue;
                 }
-                yield* this.translate(msg);
+                try {
+                    yield* this.translate(msg);
+                }
+                catch (e) {
+                    yield { type: "error", source: "protocol", message: e?.message ?? String(e) };
+                    return;
+                }
             }
             // stdout closed. Give a pending 'exit' one tick to land (NOT a blocking wait on 'close' — a
             // mock/fake child may never emit it), then surface a nonzero/signal exit as a typed error — a

package/dist/assert.js

@@ -163,12 +163,25 @@ function check(a, ctx) {
         results.push(ctx.toolResultTexts.some((t) => t.includes(a.tool_result_contains))
             ? ok()
             : fail(`no tool result contained "${a.tool_result_contains}"`));
-    if (a.tool_result_not_contains !== undefined)
-        results.push(ctx.toolResultsMissing
-            ? fail(`evidence unavailable: tool results absent from result.json — cannot evaluate tool_result_not_contains`)
-            : ctx.toolResultTexts.every((t) => !t.includes(a.tool_result_not_contains))
-                ? ok()
-                : fail(`a tool result unexpectedly contained "${a.tool_result_not_contains}"`));
+    if (a.tool_result_not_contains !== undefined) {
+        if (ctx.toolResultsMissing) {
+            results.push(fail(`evidence unavailable: tool results absent from result.json — cannot evaluate tool_result_not_contains`));
+        }
+        else {
+            const forbidden = a.tool_result_not_contains;
+            const positiveHit = ctx.toolResultTexts.some((t) => t.includes(forbidden));
+            if (positiveHit) {
+                results.push(fail(`a tool result unexpectedly contained "${forbidden}"`));
+            }
+            else {
+                const hasTruncatedAbsence = ctx.toolResultsTruncated !== undefined &&
+                    ctx.toolResultTexts.some((t, i) => !t.includes(forbidden) && ctx.toolResultsTruncated[i] === true);
+                results.push(hasTruncatedAbsence
+                    ? fail(`evidence unavailable: one or more tool results are display-truncated (no assertText) — cannot rule out forbidden substring`)
+                    : ok());
+            }
+        }
+    }
     // Fuzzy content for stochastic prose. All regex-building assertions are try/catch-wrapped —
     // `evaluate()` is a bare `.map(check)` with no error boundary, so a malformed pattern must be a
     // clean assertion failure, not an uncaught throw. Case-insensitive ("i").
@@ -428,8 +441,13 @@ function check(a, ctx) {
                         }
                         if (aj.is_null !== undefined) {
                             any = true;
-                            const isNull = present && val === null;
-                            results.push(isNull === aj.is_null ? ok() : fail(`artifact_json: "${aj.path}" is_null=${isNull}, expected ${aj.is_null}`));
+                            if (!present) {
+                                results.push(fail(`artifact_json: "${aj.path ?? "(root)"}" is_null: path is absent — cannot determine null-ness (use absent: true to assert absence)`));
+                            }
+                            else {
+                                const isNull = val === null;
+                                results.push(isNull === aj.is_null ? ok() : fail(`artifact_json: "${aj.path ?? "(root)"}" is_null=${isNull}, expected ${aj.is_null}`));
+                            }
                         }
                         if (aj.equals !== undefined) {
                             any = true;

package/dist/baseline.js

@@ -151,7 +151,11 @@ export function resolveMounts(baseline, sessionId, projectId = "proj1") {
     const subst = (s) => s.replace("{sessionId}", sessionId).replace("{projectId}", projectId);
     const cwd = subst(baseline.mountLayout.cwd);
     const sessionRoot = subst(baseline.mountLayout.sessionRoot);
-    const mntRoot = subst(baseline.mountLayout.mntRoot ?? `${baseline.mountLayout.sessionRoot}/mnt`);
+    // TODO: container.ts:31 computes configGuest independently from sessionRoot and is NOT fixed here;
+    // the legacy desktop-1.11847.5 baseline (sessionRoot ending in /mnt, no spawn block) still produces
+    // a double-mnt configGuest path (/sessions/<id>/mnt/mnt/.claude) — that is a separate out-of-scope issue.
+    const rawSessionRoot = baseline.mountLayout.sessionRoot;
+    const mntRoot = subst(baseline.mountLayout.mntRoot ?? (rawSessionRoot.endsWith("/mnt") ? rawSessionRoot : `${rawSessionRoot}/mnt`));
     return {
         cwd,
         sessionRoot,

package/dist/boundary.js

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { mkdtempSync } from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir, userInfo, homedir } from "node:os";
 import { join } from "node:path";
 import { startEgressSidecar } from "./egress/sidecar.js";
@@ -20,7 +20,8 @@ export function runBoundaryChecks(baseline, session) {
     // Stand up the real per-run boundary (internal network + allowlist proxy), exactly
     // what a container-fidelity scenario uses. Tear it down at the end.
     const runId = `bchk${process.hrtime.bigint().toString(36)}`;
-    const sidecar = startEgressSidecar(boundaryAllowList(baseline, session), mkdtempSync(join(tmpdir(), "cowork-bchk-")), runId);
+    const tmpDir = mkdtempSync(join(tmpdir(), "cowork-bchk-"));
+    const sidecar = startEgressSidecar(boundaryAllowList(baseline, session), tmpDir, runId);
     const network = sidecar.network;
     const proxy = sidecar.proxyUrl;
     // Probes can throw (spawnSync setup errors, etc.); tear the sidecar down in `finally` so an unexpected
@@ -41,15 +42,20 @@ export function runBoundaryChecks(baseline, session) {
             shell,
         ], { encoding: "utf8", timeout: 30_000 });
         // 1. Host filesystem is NOT visible (no /Users, no host home bind).
+        // TWO independent probes so a leak on EITHER path fails the check — a combined-string
+        // probe can false-pass when one path leaks (real listing) but the other path's denial
+        // substring satisfies isHostFsSealed's `denied` regex on the joined output.
         {
-            const r = probe(`ls /Users 2>&1 || true; ls /host 2>&1 || true`);
-            const out = (r.stdout ?? "") + (r.stderr ?? "");
-            const blocked = isHostFsSealed(out);
+            const combine = (r) => (r.stdout ?? "") + (r.stderr ?? "");
+            const outUsers = combine(probe("ls /Users 2>&1 || true"));
+            const outHost = combine(probe("ls /host 2>&1 || true"));
+            const blocked = isHostFsSealed(outUsers) && isHostFsSealed(outHost);
+            const detail = (outUsers + "\n" + outHost).trim().slice(0, 200);
             results.push({
                 check: "host-fs-sealed",
                 expectation: "host paths (/Users, /host) invisible",
                 pass: blocked,
-                detail: out.trim().slice(0, 200),
+                detail,
             });
         }
         // 2. Direct (non-proxied) egress is impossible — no route off the internal net.
@@ -89,6 +95,12 @@ export function runBoundaryChecks(baseline, session) {
     }
     finally {
         sidecar.teardown();
+        try {
+            rmSync(tmpDir, { recursive: true, force: true });
+        }
+        catch {
+            /* best-effort: bind-mounted log may be root-owned on Linux */
+        }
     }
 }
 /** Escape regex metacharacters in a literal so it can be embedded in a RegExp. */

package/dist/cli.js

@@ -310,6 +310,26 @@ const COMMANDS = [
     "rehash",
     "prune",
 ];
+// #29: --dotenv / --run-dir are GLOBAL flags honored ONLY in leading position (before the subcommand),
+// so a per-command value beginning with `--dotenv=`/`--run-dir=` (e.g. `skill ./s "p" --answer
+// "--dotenv=x=foo"`) is never hijacked by the pre-dispatch scan. Walk from the front consuming only
+// leading global-flag tokens (and their space-form values); stop at the first token that isn't one —
+// that token is the subcommand. Returns the count of leading tokens; the scans slice argv to it. Because
+// the region is a prefix, an index found within it is the same index into argv (so the later splice/value
+// reads against argv stay aligned). MUST be recomputed after a splice mutates argv.
+function leadingGlobalCount(av) {
+    let i = 0;
+    while (i < av.length) {
+        const t = av[i];
+        if (t === "--dotenv" || t === "--run-dir")
+            i += 2; // flag + space-form value
+        else if (t.startsWith("--dotenv=") || t.startsWith("--run-dir="))
+            i += 1; // equals form
+        else
+            break; // first non-global token = subcommand
+    }
+    return i;
+}
 async function main() {
     const argv = process.argv.slice(2);
     // `--dotenv <path>` is a GLOBAL flag — parse + strip it before command dispatch so a skill run from
@@ -321,8 +341,11 @@ async function main() {
     // form was missed by indexOf("--dotenv") → the whole `--dotenv=...` token fell through to dispatch as
     // the command name ("unknown command"). Find either spelling and apply the SAME existence + command-
     // name guards.
-    const eqIdx = argv.findIndex((a) => a.startsWith("--dotenv="));
-    const spaceIdx = argv.indexOf("--dotenv");
+    // Scan only the leading global-flag region (computed over the not-yet-mutated argv), so a `--dotenv=…`
+    // token sitting AFTER the subcommand (as a per-command flag value) is left for the command parser (#29).
+    const dotenvLead = argv.slice(0, leadingGlobalCount(argv));
+    const eqIdx = dotenvLead.findIndex((a) => a.startsWith("--dotenv="));
+    const spaceIdx = dotenvLead.indexOf("--dotenv");
     const envFileIdx = spaceIdx >= 0 ? spaceIdx : eqIdx;
     const isEquals = spaceIdx < 0 && eqIdx >= 0;
     const explicitEnvFile = isEquals ? argv[eqIdx].slice("--dotenv=".length) : envFileIdx >= 0 ? argv[envFileIdx + 1] : undefined;
@@ -354,8 +377,12 @@ async function main() {
     // shim over COWORK_HARNESS_RUNS_DIR: setting it here makes runsWriteRoot()/runsRoot() pick it up with no
     // writer/reader changes. Precedence: flag > COWORK_HARNESS_RUNS_DIR > ~/.cowork-harness/runs. Unlike
     // --dotenv it does NOT require the path to exist (it's an output dir, created on first write).
-    const rdEq = argv.findIndex((a) => a.startsWith("--run-dir="));
-    const rdSpace = argv.indexOf("--run-dir");
+    // Recompute the leading region over the CURRENT (post-dotenv-splice) argv — the --dotenv strip above may
+    // have shifted token positions, so a lead captured before it would be stale and misalign the indices the
+    // splice below relies on (#29).
+    const runDirLead = argv.slice(0, leadingGlobalCount(argv));
+    const rdEq = runDirLead.findIndex((a) => a.startsWith("--run-dir="));
+    const rdSpace = runDirLead.indexOf("--run-dir");
     const rdIdx = rdSpace >= 0 ? rdSpace : rdEq;
     const rdIsEquals = rdSpace < 0 && rdEq >= 0;
     const runDirVal = rdIsEquals ? argv[rdEq].slice("--run-dir=".length) : rdIdx >= 0 ? argv[rdIdx + 1] : undefined;
@@ -396,6 +423,16 @@ async function main() {
     // absent from the map and fall through to their own handling).
     if (hasHelp(rest) && cmd in SUBCOMMAND_USAGE)
         return void log(SUBCOMMAND_USAGE[cmd]);
+    // #27: validate COWORK_HARNESS_OUTPUT_FORMAT here — AFTER the --version/--help/per-subcommand-help
+    // short-circuits above (so `COWORK_HARNESS_OUTPUT_FORMAT=garbage cowork-harness --version|--help` is NOT
+    // a regression-causing usage error, matching the --output-format flag which never blocks --version) and
+    // BEFORE dispatch (so every dispatched command sees a validated env, and #4's env fallback only ever
+    // reads text|json|unset). The --output-format flag rejects an invalid value with exit 2; the env form
+    // silently degraded to text — bring it to parity. An explicit --output-format=json flag still selects the
+    // json error envelope via isJsonOutput (the garbage env value falls back to text there).
+    const envOutFmt = process.env.COWORK_HARNESS_OUTPUT_FORMAT;
+    if (envOutFmt !== undefined && envOutFmt !== "text" && envOutFmt !== "json")
+        fail(cmd, "usage", `COWORK_HARNESS_OUTPUT_FORMAT must be "text" or "json" (got "${envOutFmt}")`, undefined, isJsonOutput(rest));
     switch (cmd) {
         case "run":
             return cmdRun(rest);
@@ -447,15 +484,23 @@ async function main() {
             process.exit(2);
     }
 }
-/** Shared json-output predicate so the parser and the top-level catch can never drift. */
+/** Shared json-output predicate so the parser and the top-level catch can never drift. An explicit
+ *  `--output-format text|json` flag (first occurrence wins, matching parseOutputFormat's
+ *  first-occurrence-authoritative semantics) takes precedence; absent any flag, fall back to the
+ *  documented COWORK_HARNESS_OUTPUT_FORMAT env var so an env-only JSON consumer still gets an envelope
+ *  from the top-level catch (#4). */
 function isJsonOutput(args) {
     for (let i = 0; i < args.length; i++) {
         if (args[i] === "--output-format" && args[i + 1] === "json")
             return true;
         if (args[i] === "--output-format=json")
             return true;
+        if (args[i] === "--output-format" && args[i + 1] === "text")
+            return false;
+        if (args[i] === "--output-format=text")
+            return false;
     }
-    return false;
+    return process.env.COWORK_HARNESS_OUTPUT_FORMAT === "json";
 }
 /** Validate `--output-format` is text|json for the ad-hoc commands (trace/decide/gates) the way the
  *  common parser already does for run/skill — an invalid value is a usage error, not a silent text degrade. */
@@ -762,7 +807,9 @@ async function cmdRun(rawArgs) {
         const a = rawArgs[i];
         if (a === "--decider-model") {
             deciderModel = rawArgs[++i];
-            if (deciderModel === undefined || deciderModel.startsWith("-"))
+            // #28: reject "" too — the equals branch below rejects an empty value, so the spaced form must match
+            // (otherwise `--decider-model ""` forwards an empty model id and fails obscurely later).
+            if (deciderModel === undefined || deciderModel === "" || deciderModel.startsWith("-"))
                 fail("run", "usage", "--decider-model requires a value (a model id)", undefined, isJsonOutput(rawArgs));
         }
         else if (a.startsWith("--decider-model=")) {
@@ -1086,18 +1133,15 @@ function baselineFilePath(name) {
  *  harness understands, guest-image hints, the resolved VM instance + its current status, and any
  *  warnings (e.g. status the VM tooling could not determine). Keep the shape additive — JSON callers
  *  pin field names, so add fields rather than rename/remove. */
-function vmStatusEnvelope(baselineName, baseline, instance, status) {
-    const warnings = [];
-    // vmStatus returns "Absent" when no Lima VM exists for this config hash (see lima.ts) — surface that
-    // as a warning so a JSON caller doesn't read "Absent" as a running VM.
-    if (status === "Absent")
-        warnings.push(`no VM exists for ${instance} (run \`vm init\` to create it)`);
+// Shared vm JSON envelope shell. Every subcommand (#7: init/delete/prune too, not just status) emits the
+// same tool/command/instance/baseline/image block under a per-subcommand discriminator, with the
+// subcommand-specific outcome spread in by the caller.
+function vmEnvelopeBase(subcommand, baselineName, baseline, instance, warnings) {
     return {
         tool: "cowork-harness",
         command: "vm",
-        subcommand: "status",
+        subcommand,
         instance,
-        status,
         baseline: {
             name: baselineName,
             path: baselineFilePath(baselineName),
@@ -1114,6 +1158,14 @@ function vmStatusEnvelope(baselineName, baseline, instance, status) {
         warnings,
     };
 }
+function vmStatusEnvelope(baselineName, baseline, instance, status) {
+    const warnings = [];
+    // vmStatus returns "Absent" when no Lima VM exists for this config hash (see lima.ts) — surface that
+    // as a warning so a JSON caller doesn't read "Absent" as a running VM.
+    if (status === "Absent")
+        warnings.push(`no VM exists for ${instance} (run \`vm init\` to create it)`);
+    return { ...vmEnvelopeBase("status", baselineName, baseline, instance, warnings), status };
+}
 const VM_SUB_HELP = {
     init: "usage: vm init [<baseline>] [--output-format text|json]   — create the L2 Apple-VZ microVM",
     status: "usage: vm status [<baseline>] [--output-format text|json] — show running VM state",
@@ -1174,15 +1226,25 @@ function cmdVm(args) {
     }
     else if (sub === "init") {
         const { status } = vmInit(baseline);
-        log(`${instance}: ${status}`);
+        // #7: honor --output-format json (init/delete/prune printed text unconditionally; only status did).
+        if (vmJson)
+            out(JSON.stringify({ ...vmEnvelopeBase("init", baselineName, baseline, instance, []), status }));
+        else
+            log(`${instance}: ${status}`);
     }
     else if (sub === "delete") {
         vmDelete(instance);
-        log(`${instance} deleted`);
+        if (vmJson)
+            out(JSON.stringify({ ...vmEnvelopeBase("delete", baselineName, baseline, instance, []), deleted: true }));
+        else
+            log(`${instance} deleted`);
     }
     else if (sub === "prune") {
         const pruned = vmPrune(instance);
-        log(pruned.length ? `pruned ${pruned.length} orphaned VM(s): ${pruned.join(", ")}` : `no orphaned VMs (current: ${instance})`);
+        if (vmJson)
+            out(JSON.stringify({ ...vmEnvelopeBase("prune", baselineName, baseline, instance, []), pruned }));
+        else
+            log(pruned.length ? `pruned ${pruned.length} orphaned VM(s): ${pruned.join(", ")}` : `no orphaned VMs (current: ${instance})`);
     }
     else {
         // #11: an invalid/absent subcommand must exit non-zero — a bare `log` exits 0, so a CI script
@@ -1342,7 +1404,10 @@ function cmdSync(args) {
         for (const g of Object.values(res.gates)) {
             const key = `${g.name}:${g.id}`;
             const prev = baseGates[key];
-            const prevOn = typeof prev === "string" ? /on|true|force/i.test(prev) : !!prev?.on;
+            // #30: for a legacy prose entry the authoritative state is the LEADING `on(...)`/`off(...)` token
+            // (the note stripper just below anchors on the same pattern) — a bare substring scan of the whole
+            // string would let a human note containing "on"/"force" mask a real off→on flip.
+            const prevOn = typeof prev === "string" ? /^\s*on\(/i.test(prev) : !!prev?.on;
             // Preserve the human annotation: from a prose string, drop the leading "on(force) " token; from
             // a structured entry, keep its `note`.
             const prevNote = typeof prev === "string"
@@ -1495,6 +1560,11 @@ async function cmdDecide(args) {
         // stray positional (isJsonOutput/ensureOutputFormat handle the actual parsing).
         else if (a === "--output-format")
             i++;
+        // #5: the equals form is fully supported by the parser; recognize it here as a no-op (it carries its
+        // own value) so it doesn't fall through to the unknown-flag guard below and exit 2 like an outlier.
+        else if (a === "--output-format=json" || a === "--output-format=text") {
+            /* recognized; parsed by isJsonOutput/ensureOutputFormat */
+        }
         // --decider-dir is rejected explicitly below with a redirect message; consume its value here so the
         // value isn't flagged as a stray positional before that guard fires.
         // check that the next token exists and doesn't look like a flag before consuming it.
@@ -1628,7 +1698,11 @@ function cmdAnswer(args) {
     ensureOutputFormat("answer", args);
     const json = isJsonOutput(args);
     // #15: skip flag values so `answer --gate 1 --choose Yes <dir>` doesn't read `1` as the directory.
-    const dir = positionals(args, ["--gate", "--choose", "--answer", "--output-format"])[0];
+    const answerPositionals = positionals(args, ["--gate", "--choose", "--answer", "--output-format"]);
+    // #31: reject extra positionals rather than silently writing to the first dir (mirrors `gates`).
+    if (answerPositionals.length > 1)
+        return void fail("answer", "usage", "answer takes one <dir>", undefined, json);
+    const dir = answerPositionals[0];
     let seq;
     // --choose accumulates: a single value answers a single-select gate; multiple values answer a
     // multiSelect gate (validated once the gate is read — a multi --choose on a single-select gate is
@@ -1719,20 +1793,30 @@ function cmdScaffold(args) {
     // Reject unknown flags rather than silently ignoring a typo (e.g. `--form-run`).
     rejectUnknownFlags("scaffold", args, ["--from-run", "--out", "--output-format", "--output-format=json", "--output-format=text"], json);
     // Validate --out FIRST (flag-looking value is a usage error regardless of --from-run presence).
-    const outIdx = args.indexOf("--out");
+    // #6: honor BOTH the spaced (`--out foo`) and equals (`--out=foo`) forms — indexOf("--out") missed the
+    // equals token, so `--out=foo.yaml` was accepted by rejectUnknownFlags then silently ignored (output went
+    // to stdout). The equals value also gets the same flag-looking guard the spaced form has.
+    const outSpaceIdx = args.indexOf("--out");
+    const outEqIdx = args.findIndex((a) => a.startsWith("--out="));
     let outPath;
-    if (outIdx >= 0) {
-        outPath = flagValue(args, outIdx, "--out");
-        if (outPath.startsWith("-"))
-            return void fail("scaffold", "usage", `--out requires a file path, got a flag: ${outPath}`, undefined, json);
-    }
+    if (outSpaceIdx >= 0)
+        outPath = flagValue(args, outSpaceIdx, "--out");
+    else if (outEqIdx >= 0)
+        outPath = args[outEqIdx].slice("--out=".length);
+    if (outPath !== undefined && (outPath === "" || outPath.startsWith("-")))
+        return void fail("scaffold", "usage", `--out requires a file path${outPath === "" ? " (got empty)" : `, got a flag: ${outPath}`}`, undefined, json);
     // Validate --from-run flag-looking value before computing positionals (so the error is specific).
-    const fromIdx = args.indexOf("--from-run");
+    // #6: same dual-form handling for --from-run (the equals form fell through to a spurious usage failure).
+    const fromSpaceIdx = args.indexOf("--from-run");
+    const fromEqIdx = args.findIndex((a) => a.startsWith("--from-run="));
     let fromRunVal;
-    if (fromIdx >= 0) {
-        fromRunVal = flagValue(args, fromIdx, "--from-run");
-        if (fromRunVal.startsWith("-"))
-            return void fail("scaffold", "usage", `--from-run requires a run id/dir, got a flag: ${fromRunVal}`, undefined, json);
+    if (fromSpaceIdx >= 0)
+        fromRunVal = flagValue(args, fromSpaceIdx, "--from-run");
+    else if (fromEqIdx >= 0)
+        fromRunVal = args[fromEqIdx].slice("--from-run=".length);
+    if (fromRunVal !== undefined) {
+        if (fromRunVal === "" || fromRunVal.startsWith("-"))
+            return void fail("scaffold", "usage", `--from-run requires a run id/dir${fromRunVal === "" ? " (got empty)" : `, got a flag: ${fromRunVal}`}`, undefined, json);
         log("note: --from-run is deprecated; prefer: scaffold <run-id | run-dir>\n");
     }
     // Positional is canonical; --from-run is a backward-compatible alias.
@@ -1925,6 +2009,7 @@ async function cmdVerifyRun(args) {
         subagents: result.subagents ?? [],
         gateDeliveries: result.gateDeliveries ?? [],
         toolResultTexts: (result.toolResults ?? []).map((r) => r.assertText ?? r.text),
+        toolResultsTruncated: (result.toolResults ?? []).map((r) => r.assertText === undefined),
         transcriptMissing: sidecarTranscript === null,
         questionsMissing: sidecarQuestions === null,
         // Evidence-missing flags: set ONLY when the underlying field is undefined (partial/old result.json),