cowork-harness 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -6,6 +6,125 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.18.0] — 2026-06-27
+
+### Fixed
+
+- `sync` no longer flags an unknown delta when `coworkEgressAllowedHosts` is absent from
+  `config.json` (the normal state for a fresh install with no user-configured custom egress
+  hosts). Previously the absent key was treated the same as a wrong-typed value and blocked
+  the baseline write entirely.
+- `sync` now regenerates the baseline `$comment` with the current capture date instead of
+  carrying the stale string forward from the prior baseline via the `...base` spread.
+- A misplaced GLOBAL flag (the space form `--dotenv <path>` / `--run-dir <path>` placed *after* the
+  subcommand, where the pre-0.17.0 docs put `--dotenv`) now fails with a position hint —
+  `--dotenv is a GLOBAL flag and must come BEFORE the subcommand (e.g. \`cowork-harness --dotenv <path> doctor …\`)`
+  — instead of a bare `unknown flag: --dotenv` (or, for some commands, an unrelated positional /
+  "unexpected argument" error) that sent users hunting for a per-command flag that doesn't exist. The
+  hint honors `--output-format json`, never pre-empts `--version`/`--help`, and only fires for a known
+  subcommand (a junk command still gets the accurate "unknown command"). The `--dotenv=<path>` equals
+  form is not matched — to avoid hijacking a legitimate value like `--answer "--dotenv=x=y"` — so a
+  misplaced equals form still gets the plain unknown-flag rejection. (A bare `--dotenv`/`--run-dir`
+  token used as another flag's omitted value, e.g. `decide --question --dotenv`, is pre-empted by the
+  hint rather than the more specific "requires a value" error; both exit 2.)
+- `doctor`'s no-token remedies now show `--dotenv` in its correct **leading** position
+  (`cowork-harness --dotenv <path> <cmd>`). The git-worktree remedy previously printed the pre-0.17.0
+  `<cmd> --dotenv` form — which the new position hint above now rejects — so `doctor` was suggesting a
+  command the harness refuses. The generic no-token remedy also now advertises the
+  `--dotenv <path> <cmd>` form, so pointing at a non-cwd `.env` is discoverable.
+- `skill --help` / `run --help` now label `--run-dir` as a **GLOBAL** flag that must precede the
+  subcommand. It was listed in each command's local "Output:" flag block, implying
+  `skill … --run-dir <path>`, which the command rejects (`--run-dir` is honored only before the
+  subcommand, like `--dotenv`).
+
+### Changed
+
+- Baseline bumped to `desktop-1.15962.0` (agent `2.1.187`). Content is unchanged from
+  `1.15200.0` — host-loop generator, system prompt, identity, gates, and egress domains are
+  all byte-identical per asar analysis. Version and fingerprint fields only. The live-contract
+  suite was re-run green against the staged `2.1.187` agent on this baseline, so the
+  "verified end-to-end" claims are earned. Cassettes recorded against the `1.15200.0` baseline will
+  report a non-failing baseline-drift warning on `replay` (a hard fail under `--strict` /
+  `verify-cassettes`); re-record to clear, or ignore it since the asar content is byte-identical.
+
+### Documentation
+
+- Audit-validated doc/DX fixes: corrected the `docs/cassette.md` cassette-version example
+  (`6`→`7`); rewrote the `protocol-smoke` row to stop referencing a rejected
+  `transcript_no_host_path: false` line; scoped the SKILL.md "agent binary" prerequisite to the
+  sandboxed live tiers (protocol/replay need none); added `python3` to the README requirements
+  (the `lint` linter shells out to it); moved the `/plugin` slash-command block off the `bash`
+  fence; pinned `cowork-harness@>=0.17.0` in the CI recipe; noted that `chat` excludes
+  `microvm`/`cowork`; and other small corrections (see `docs/internal/2026-06-26-doc-audit-*`).
+- Refreshed all verification/version stamps that still pinned `1.15200.0` / `2.1.181`
+  (README, DESIGN, SPEC, the spawn-contract reference, `docs/cassette.md` fingerprint example,
+  and the `hostloop-prompt.ts` re-verified comment) to `1.15962.0` / `2.1.187`.
+
+## [0.17.0] — 2026-06-26
+
+### Upgrade notes
+
+- **Re-record all cassettes after upgrading** (`cowork-harness record cassettes/ --rerecord-stale`).
+  The skill-hash delimiter changed (v6 → v7); `verify-cassettes` reports which cassettes need it.
+- **`transcript_no_host_path: false` is now rejected by the schema.** Remove the key or change it
+  to `true`. (It was never meaningful as `false`.)
+- **`is_null: false` on an absent path now fails loud** instead of silently passing. Add
+  `exists: true` if you intend to assert presence before the null check.
+
+### Fixed
+
+- **The microVM egress proxy port is now allocated via bind-port-0 instead of freePort().** The
+  previous approach (bind :0 → read port → close → re-bind real proxy) had a TOCTOU gap: another
+  process could grab the port between the probe close and the proxy bind. The proxy now binds on `:0`
+  directly; `actualPort` is read from the live socket and threaded into the guest firewall rule and
+  `HTTP(S)_PROXY` env after the proxy is already bound. L1 (container/hostloop) was unaffected
+  (uses a fixed port inside Docker's per-run network namespace); L0 (protocol) has no proxy.
+- **Cassette fingerprint format is v7.** The skill-hash uses a NUL byte (`\0`) to delimit entries
+  (`F:`, `D:`, `L:`) — unambiguous for all POSIX-valid filenames. `CONTENTSIG_ALGO` is 3.
+  `verify-cassettes` reports `recorded under an older hash format (v6 → v7)` for stale cassettes;
+  re-record with `--rerecord-stale` to clear.
+- **`transcript_no_host_path` only accepts `true`.** Omit the key to skip the check; `false` is
+  rejected by the schema (`const: true`).
+- **`is_null: false` requires the path to be present.** An absent path fails loud. To assert "exists
+  and is not null", write `exists: true` alongside `is_null: false`.
+- **The egress proxy no longer crashes on a double-end or EPIPE.** When an upstream TLS error
+  arrived after the response had already been ended (e.g. the client disconnected mid-stream),
+  calling `res.writeHead(502)` on an already-sent response threw, taking down the proxy for the
+  remainder of the run. The guard now skips the `writeHead` call when `res.headersSent` is true and
+  swallows the resulting EPIPE.
+- **L0 (protocol) containment check now uses `realpathSync` to guard against symlink escape.** The
+  previous path comparison used the raw strings; a symlinked workspace folder could resolve outside
+  the declared root and the check would miss it.
+- **Session `enabledPlugins` now emits the correct `{ "name@mp": true }` object-map** that
+  `claude --settings` requires, rather than an array of plugin-name strings that is silently ignored.
+  Plugin loading via `--settings` was silently broken for any session with `enabled_plugins:` set.
+- **`probeMicrovmOmitted` no longer issues a `limactl shell` probe when the Lima VM is not Running.**
+  A cold (Absent) or stopped VM cannot be probed; the harness now skips the capability probe
+  entirely and returns `null` rather than trying to shell into a non-running instance.
+- **`is_null: true` on an absent path now directs to `absent: true`** with a clear error rather than
+  silently treating absent-as-null (the two are semantically distinct: absent = the key doesn't
+  exist; null = it exists with a JSON null value).
+- **Boundary `/host` probe split into two independent checks.** The previous single-command probe
+  could false-pass when the host filesystem was sealed but the `/host` directory existed and was
+  empty. The probe now AND-combines a listing check and a no-denial text check.
+- **`--decider-llm` transport now bounded-retries a transient `claude -p` exit and surfaces *why* it
+  failed.** A single `claude -p` decider spawn can exit non-zero on a transient upstream hiccup
+  (rate-limit/overload/network) during a long back-to-back batch — observed 1/8 live runs, not reproducible
+  on demand. The non-zero-exit class is now retried (default 2 attempts, small linear backoff;
+  `COWORK_HARNESS_LLM_RETRIES=0` to disable) so a transient exit doesn't kill a 10-minute paid run at the
+  final gate. Retry never double-answers: the transport has no harness side effects, and a non-zero exit
+  delivers no answer, so the gate is answered exactly once downstream of a successful call. The timeout /
+  `maxBytes`-overflow / spawn-`ENOENT` classes are not transient and still fail loud on the first attempt.
+  (A *deterministic* non-zero exit — bad `--decider-model`, auth — is also retried the full count before
+  failing loud; the cost is bounded and the captured output names the cause.) The exit error now folds in the
+  child's captured **stdout** (where `claude -p` writes its operational diagnosis — verified) and stderr, so
+  `exited 1` is no longer undiagnosable.
+- **`--decider-llm` now binds a markdown-/quote-wrapped `OTHER:` free-text directive.** A model often
+  code-fences a verbatim directive (`` `OTHER: …` ``, `"OTHER: …"`); the leading backtick/quote previously
+  defeated the `^\s*OTHER:` anchor and the gate whiffed → fail-loud stall (observed live). The sentinel now
+  matches on the `trimNearMiss` form (wrapping quotes/backticks stripped, `:` preserved), so a real
+  `OTHER:`-named option label still wins first via the exact-label tier.
+
 ## [0.16.0] — 2026-06-26
 
 ### Fixed

package/README.md

@@ -17,6 +17,7 @@ Scriptable, CI-friendly test harness that reproduces **Claude Cowork's observabl
 
 > **Requirements at a glance**
 > - **Free demo (`replay`):** Node ≥ 20 — nothing else (no Docker, token, or Claude Desktop).
+> - **`lint` (optional, token-free):** also needs **`python3`** on PATH — the scenario linter shells out to it (PyYAML is bundled); a missing `python3` is a hard `exit 127`.
 > - **Live tiers**: **Claude Desktop opened once** (stages the agent — nothing is bundled) · a **Claude token** (real per-run cost; runs take minutes — mint one with `claude setup-token`, which needs the **`claude` CLI**: `npm i -g @anthropic-ai/claude-code`) · plus a runtime — **Docker (arm64)** for `container` (default) / `hostloop`, or **Lima (Apple-VZ)** for `microvm`. The `protocol` tier skips the runtime + the staged agent but still calls a real model, so it needs the token. (`doctor --tier <t>` reports exactly what a given tier needs.)
 > - **Platform:** best on **macOS Apple Silicon**; **Windows is not supported** for the live tiers (use the token-free `replay`); `sync` and `microvm` are **macOS-arm64 only**. Full detail in [Quick start → prerequisites](#quick-start).
 
@@ -92,7 +93,7 @@ Skill testing is the headline use, but the tool is a general harness over the Co
 |---|---|---|
 | `skill <folder> "<prompt>"` | Run a local skill/plugin folder once against the staged agent | ad-hoc "is the skill alive / does it do X?" — the fast inner loop |
 | `run <scenario.yaml \| dir/>` | Run authored scenarios with `assert:` + a CI-ready exit code | you want a repeatable, **asserted regression test** |
-| `chat <folder> [prompt]` | Interactive multi-turn REPL against a skill (TTY); optional seed prompt is sent as the first turn. `--upload <file>` / `--folder <dir>` (repeatable) attach files/project folders; `--verbose` / `-V` shows thinking blocks + tool inputs; `--fidelity protocol\|container\|hostloop` | debugging a multi-turn flow by hand |
+| `chat <folder> [prompt]` | Interactive multi-turn REPL against a skill (TTY); optional seed prompt is sent as the first turn. `--upload <file>` / `--folder <dir>` (repeatable) attach files/project folders; `--verbose` / `-V` shows thinking blocks + tool inputs; `--fidelity protocol\|container\|hostloop` (no `microvm`/`cowork` in the REPL) | debugging a multi-turn flow by hand |
 | `record` / `replay` | **Record a live run once → replay it token-free, Docker-free thereafter.** `record` saves a control-protocol cassette (one scenario, or batch a `dir/`; `--rerecord-stale` refreshes only drifted ones; `--concurrency <N>` records a batch N at a time — runs are fully isolated, so it just bounds Docker/API pressure; `--max-artifact-bytes` raises the 64 KiB inline-body cap; `--dry-run` previews the scenarios + token/binary checks without recording; answer gates **live during the recording** with `--decider-dir`/`--decider-llm`/`--on-unanswered first` instead of pre-scripting them — a live decider flags the cassette non-deterministic but it still replays deterministically); `replay <file.cassette.json \| dir/>` runs a cassette **file or a `dir/` of `*.cassette.json`** deterministically (`--strict` fails on any stale one, `--fail-on-skill-drift` only on skill-source drift; staleness is also reported per-result in `staleness[]` for a JSON gate; exits on the worst verdict) | **token-free, Docker-free CI** from a once-recorded run |
 | `verify-cassettes <file\|dir>` | Token-free CI gate over committed cassettes: a privacy scan (email/currency/domain → exit 1; whole-token allows via `--allow` / class-scoped `--allow-domain` / `--allow-email` / `--allow-file`) + a staleness check (`--skip-privacy` or `--skip-staleness` to run only one half). A dir argument scans `*.cassette.json` in that dir only (**non-recursive**) | gating **committed cassettes** against PII leaks + "edited the skill, forgot to re-record" |
 | `verify-run <run-dir> <scenario.yaml>` | Re-evaluate a scenario's `assert:` (and, when the scenario declares `answers:`, whether they still match the run's actual gates) against an already-kept run dir — **no live agent, no tokens, no Docker** (~1s) | iterating on a wrong assertion or a drifted `answer` without a full live re-record |
@@ -143,12 +144,12 @@ Only the committed-cassette `replay` above is fully self-contained. Live `run`/`
 
 This repo ships a **companion skill** (`.claude/skills/cowork-harness/`) that teaches an agent how to drive the harness — author scenarios, pick a fidelity tier, script answers, place assertions in the right CI lane, and avoid the "✓ passed ≠ correct" traps. Install it via the bundled marketplace — run these **in Claude Code** (slash commands, not your shell):
 
-```bash
+```text
 /plugin marketplace add yaniv-golan/cowork-harness
 /plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.16.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx cowork-harness@>=0.18.0` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://github.com/vercel-labs/skills) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) by pointing the `npx skills` CLI at `.claude/skills/cowork-harness` in this repo. (Working *inside* this repo, the skill auto-loads as a project skill — no install needed.)
 
@@ -336,7 +337,7 @@ assert:
 # Relative paths below resolve from THIS file's dir (absolute and ~ are used as-is).
 model: claude-opus-4-8
 effort: high
-max_thinking_tokens: 8000
+max_thinking_tokens: 8000               # kept low for example cost; real default 31999 (see docs/session.md)
 permission_mode: default
 permission_parity: cowork                   # cowork (allow unscripted tool calls, the default) | strict (deny unscripted)
 folders:
@@ -380,7 +381,7 @@ The harness builds a **clean managed `CLAUDE_CONFIG_DIR` per run** (with a gener
 
 ## What you get out (inspectable output)
 
-Every run writes to `~/.cowork-harness/runs/<scenario>/<sessionId>/` (out of any working tree; relocate with `--run-dir <path>` or `COWORK_HARNESS_RUNS_DIR`):
+Every run writes to `~/.cowork-harness/runs/<scenario>/<sessionId>/` (out of any working tree; relocate with the global `--run-dir <path>` flag — it goes *before* the subcommand — or `COWORK_HARNESS_RUNS_DIR`):
 
 ```
 events.jsonl        full stream-json event log (child→driver; the cassette source)
@@ -481,8 +482,8 @@ Most runs need **none** of these — the defaults are correct. They're grouped b
 - `COWORK_CONTAINER_RUNTIME=podman` — use Podman instead of Docker.
 - `COWORK_AGENT_IMAGE=<tag>` — override the agent image name (default `cowork-agent-base:2`); `COWORK_AGENT_BINARY=<path>` — override the auto-detected staged agent ELF.
 - `COWORK_SKIP_CAPABILITY_PROBE=1` — skip the per-run capability probe (the harness otherwise probes the agent image/VM for the document/OCR/Office capabilities the real Cowork rootfs ships and **fails a run that uses one the image omits** — a likely false negative; suppress per-scenario with `allow_missing_capability: true`, or rebuild full parity).
-- `COWORK_HARNESS_DECIDER_MODEL` — the default `--decider-llm` answering model (overridden by the `--decider-model` flag; falls back to the Haiku default). `COWORK_HARNESS_DECIDER_DIR_POLL_MS` / `_TIMEOUT_MS` — tune the `--decider-dir` rendezvous poll/backstop; `COWORK_HARNESS_DECIDER_CMD_TIMEOUT_MS` / `COWORK_HARNESS_LLM_TIMEOUT_MS` — backstop a hung `--decider-cmd` helper / `--decider-llm` model call (default 600 s, fail loud); `COWORK_HARNESS_DIALOG_TIMEOUT_MS` — override the 6 s dialog auto-cancel.
-- `COWORK_HARNESS_RUNS_DIR` (or the `--run-dir <path>` flag) — override the default run-output root `~/.cowork-harness/runs` (kept out of any working tree so sensitive skill inputs/outputs don't land in a repo). Precedence: `--run-dir` > env > default. The root is flat and machine-global (shared across projects); pinned `--session-id` runs are guarded against cross-project overwrite, and `prune` never prunes them. In CI, set it to a workspace path (e.g. `runs`) so artifact upload can collect the runs. `COWORK_HARNESS_ALLOW_FOREIGN_RESUME=1` overrides the guard that blocks `--resume` onto another project's pinned session.
+- `COWORK_HARNESS_DECIDER_MODEL` — the default `--decider-llm` answering model (overridden by the `--decider-model` flag; falls back to the Haiku default). `COWORK_HARNESS_DECIDER_DIR_POLL_MS` / `_TIMEOUT_MS` — tune the `--decider-dir` rendezvous poll/backstop; `COWORK_HARNESS_DECIDER_CMD_TIMEOUT_MS` / `COWORK_HARNESS_LLM_TIMEOUT_MS` — backstop a hung `--decider-cmd` helper / `--decider-llm` model call (default 600 s, fail loud); `COWORK_HARNESS_LLM_RETRIES` — bounded retries for a transient non-zero `claude -p` exit in the `--decider-llm` transport (default 2, clamped to 0–10; set `0` to disable, e.g. deterministic CI); `COWORK_HARNESS_DIALOG_TIMEOUT_MS` — override the 6 s dialog auto-cancel.
+- `COWORK_HARNESS_RUNS_DIR` (or the `--run-dir <path>` flag — a **global** flag that must precede the subcommand, like `--dotenv`) — override the default run-output root `~/.cowork-harness/runs` (kept out of any working tree so sensitive skill inputs/outputs don't land in a repo). Precedence: `--run-dir` > env > default. The root is flat and machine-global (shared across projects); pinned `--session-id` runs are guarded against cross-project overwrite, and `prune` never prunes them. In CI, set it to a workspace path (e.g. `runs`) so artifact upload can collect the runs. `COWORK_HARNESS_ALLOW_FOREIGN_RESUME=1` overrides the guard that blocks `--resume` onto another project's pinned session.
 - **Networking / loop:** `COWORK_EGRESS_PROXY` overrides the egress-proxy URL injected into the sandbox; `COWORK_PROXY_IMAGE` overrides the egress proxy Docker image name (default `cowork-egress-proxy:1`); `COWORK_DOCKER_NETWORK` pins the Docker network the agent container joins; `CLAUDE_FORCE_HOST_LOOP=1` forces the host-loop path regardless of the baseline's loop decision (the `cowork` tier's auto-pick). `COWORK_LIMACTL` overrides the `limactl` binary path (default `/opt/homebrew/bin/limactl`).
 - **Strictness escape hatches** (the harness fails loud by default): `COWORK_HARNESS_SOFT_MISSING=1` downgrades a missing mount source from a hard error to warn-and-exclude; `COWORK_HARNESS_ALLOW_CONFIG_DIR_WRITE=1` permits writing into an existing pinned `plugins.config_dir` (otherwise refused, to avoid clobbering a real Claude config).
 - **Staleness boundary:** the cassette-staleness skill hash uses the **git-tracked** file set of each skill/plugin source dir by default (a non-repo dir falls back to a raw walk; OS-junk like `.DS_Store` is always excluded). `COWORK_HARNESS_GITSET=0` opts out to the legacy raw walk for every dir. `COWORK_HARNESS_DEBUG_SKILLHASH=1` dumps the exact file set feeding the hash on a staleness mismatch (and flags OS-junk) so a drift source is one line. Declare per-plugin non-runtime paths in a `.cowork-hashignore` file (or the session `staleness.hash_ignore`). `COWORK_HARNESS_AGENT_SCOPE=skill` (opt-in) refines a scenario's `skills:` scope so a **skill-named** `agents/<name>.md` re-stales only that skill's cassettes instead of the whole fleet (generic agents stay shared; stamped into the fingerprint, so flipping it is a one-time re-record like `GITSET`).
@@ -565,7 +566,7 @@ This repo is built to be driven by agents, not just read by humans:
 
 ## Status
 
-**Verified end-to-end against the live staged agent (2.1.181 / asar 1.15200.0).** Host-side parity (egress/gates/mount/web_fetch facts + the reconstructed prompt appends) re-derived for 1.15200.0 via `sync` + asar inspection; the live scenario suite passes against this baseline (the staged agent ELF is unchanged at 2.1.181).
+**Verified end-to-end against the live staged agent (2.1.187 / asar 1.15962.0).** Host-side parity (egress/gates/mount/web_fetch facts + the reconstructed prompt appends) re-derived for 1.15962.0 via `sync` + asar inspection; the live scenario suite passes against this baseline (the 1.15962.0 asar content is byte-identical to 1.15200.0 — all runtime-shape fields unchanged).
 
 - ✅ **Three isolation tiers (L0/L1/L2) + two loop-mode overlays** — `protocol` (L0 control loop), `container` (L1 sandboxed arm64 + per-run default-deny egress sidecar), `microvm` (L2 real Apple-VZ Linux microVM + guest firewall); plus the loop-mode overlays `hostloop` (production split-execution: agent loop on host, shell/web via the workspace SDK-MCP server) and `cowork` (auto-picks host-loop vs container the way Cowork does — gate `1143815894`). Egress enforced at container/microvm/hostloop; `boundary-check` reports **ALL CONSTRAINTS ENFORCED**.
 - ✅ **Three-seam driver** — `AgentSession` (control protocol) → `Decider` (scripted + `on_unanswered` policy, no silent false-greens) → `Run` (turn loop, sub-agent dispatch tree, `RunRecord`). Multi-turn `chat`, deterministic cassette `record`/`replay` (no token), `run.jsonl`/`trace.json` logging with secret-scrub.

package/baselines/desktop-1.15962.0.json

@@ -0,0 +1,220 @@
+{
+  "baselineVersion": 1,
+  "appVersion": "1.15962.0",
+  "agentVersion": "2.1.187",
+  "agentBinary": {
+    "stagedPath": "~/Library/Application Support/Claude/claude-code-vm/2.1.187/claude",
+    "format": "elf-aarch64"
+  },
+  "guest": {
+    "os": "linux",
+    "arch": "arm64",
+    "baseImage": "ubuntu:22.04"
+  },
+  "spawn": {
+    "configDirInGuest": "mnt/.claude",
+    "settingSources": [
+      "user"
+    ],
+    "permissionMode": "default",
+    "maxThinkingTokens": 31999,
+    "effortDefault": "medium",
+    "tools": [
+      "Task",
+      "Bash",
+      "Glob",
+      "Grep",
+      "Read",
+      "Edit",
+      "Write",
+      "NotebookEdit",
+      "WebFetch",
+      "TaskCreate",
+      "TaskUpdate",
+      "TaskGet",
+      "TaskList",
+      "TaskStop",
+      "WebSearch",
+      "Skill",
+      "REPL",
+      "JavaScript",
+      "AskUserQuestion",
+      "ToolSearch"
+    ],
+    "allowedTools": [
+      "Task",
+      "Bash",
+      "Glob",
+      "Grep",
+      "Read",
+      "Edit",
+      "Write",
+      "NotebookEdit",
+      "WebFetch",
+      "TaskCreate",
+      "TaskUpdate",
+      "TaskGet",
+      "TaskList",
+      "TaskStop",
+      "WebSearch",
+      "Skill",
+      "REPL",
+      "JavaScript",
+      "ToolSearch"
+    ],
+    "env": {
+      "CLAUDE_CODE_IS_COWORK": "1",
+      "CLAUDE_CODE_ENTRYPOINT": "local-agent",
+      "CLAUDE_CODE_TAGS": "lam_session_type:chat",
+      "CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST": "1",
+      "CLAUDE_CODE_ENABLE_ASK_USER_QUESTION_TOOL": "true",
+      "CLAUDE_CODE_DISABLE_CRON": "1",
+      "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS": "1",
+      "CLAUDE_CODE_DISABLE_AGENTS_FLEET": "1",
+      "CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT": "1",
+      "CLAUDE_CODE_ENABLE_TASKS": "true",
+      "CLAUDE_CODE_DISABLE_TERMINAL_TITLE": "1",
+      "ENABLE_PROMPT_CACHING_1H": "1",
+      "DISABLE_MICROCOMPACT": "1",
+      "MCP_CONNECTION_NONBLOCKING": "true"
+    },
+    "promptTemplate": "prompts/desktop-1.15200.0/system-prompt-append.md",
+    "subagentAppend": "prompts/desktop-1.15200.0/subagent-append-vm.md",
+    "$comment": "Binary-verified Desktop->agent spawn contract (asar 1.12603.1). See docs/cowork-spawn-contract-1.12603.1.md.",
+    "$comment_notSet": "Deliberately NOT set: CLAUDE_CODE_USE_COWORK_PLUGINS (Desktop never sets it; would flip the agent to cowork_settings.json/cowork_plugins). Host-derived (TZ, account UUIDs, WORKSPACE_HOST_PATHS, OTEL) injected at runtime, not pinned.",
+    "$comment_prompts": "Reconstructed cowork-specific sections, re-paraphrased from asar 1.15200.0 const MZi (system prompt) + generator CVr (subagent) — not the full base prompt (not cleanly extractable), and excluding the generic refusal/safety tail. The main append is delivered via the --append-system-prompt CLI flag (layered on the agent's built-in base prompt), NOT the initialize handshake; only the subagent append goes over initialize (appendSubagentSystemPrompt), gated on CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT."
+  },
+  "mountLayout": {
+    "sessionRoot": "/sessions/{sessionId}",
+    "cwd": "/sessions/{sessionId}",
+    "mntRoot": "/sessions/{sessionId}/mnt",
+    "mounts": [
+      {
+        "name": "uploads",
+        "mountPath": "uploads",
+        "mode": "r",
+        "purpose": "user-uploaded files (read-only — asar 'ro')"
+      },
+      {
+        "name": "projects",
+        "mountPath": ".projects/{projectId}",
+        "mode": "rw",
+        "purpose": "RESERVED namespace (and the separate UUID project-sync feature) — NOT the work-folder path. From Desktop 1.14271.0 selected work folders mount at mnt/<collision-resolved-basename> (dynamic, derived per session by buildLaunchPlan; see MOUNT_BARE_NAME_MIN_VERSION). This decorative row is not consumed for binding (staged paths come from plan.mounts)."
+      },
+      {
+        "name": "local-plugins",
+        "mountPath": ".local-plugins/marketplaces",
+        "mode": "r",
+        "purpose": "marketplace skills/plugins, runtime-discovered"
+      },
+      {
+        "name": "remote-plugins",
+        "mountPath": ".remote-plugins",
+        "mode": "r",
+        "purpose": "org-remote plugins, runtime-discovered"
+      },
+      {
+        "name": "outputs",
+        "mountPath": "outputs",
+        "mode": "rw",
+        "purpose": "session outputs/artifacts — delete denied by default (asar IX); rwd only when approved"
+      }
+    ]
+  },
+  "network": {
+    "mode": "gvisor",
+    "allowKind": "allowlist",
+    "allowDomains": [
+      "sentry.io",
+      "preview.claude.ai",
+      "downloads.claude.ai",
+      "api.anthropic.com",
+      "a-cdn.anthropic.com",
+      "a-api.anthropic.com",
+      "assets.claude.ai",
+      "console.anthropic.com",
+      "api-staging.anthropic.com",
+      "www.anthropic.com",
+      "docs.anthropic.com",
+      "mcp-proxy.anthropic.com",
+      "pivot.claude.ai",
+      "support.anthropic.com"
+    ]
+  },
+  "bgEnvStrip": {
+    "knownVars": [
+      "CLAUDE_CODE_OAUTH_TOKEN",
+      "CLAUDE_CODE_SESSION_KIND",
+      "CLAUDE_CODE_SESSION_ID",
+      "CLAUDE_CODE_SESSION_NAME",
+      "CLAUDE_CODE_SESSION_LOG"
+    ]
+  },
+  "$comment": "Platform baseline auto-derived by `cowork-harness sync` from a live Claude Desktop install + app.asar. VOLATILE per-release facts only. Regenerate per release; review the diff. Captured 2026-06-26 on macOS arm64.",
+  "capturedAt": "2026-06-26",
+  "platform": "darwin-arm64",
+  "settings": {
+    "autoMountFolders": {
+      "key": "autoMountFolders",
+      "default": false
+    },
+    "localAgentModeTrustedFolders": {
+      "key": "localAgentModeTrustedFolders",
+      "default": []
+    }
+  },
+  "provenance": {
+    "asarPath": "/Applications/Claude.app/Contents/Resources/app.asar",
+    "asarFingerprint": "0fe570e50d97404f",
+    "gates": {
+      "$comment": "Production GrowthBook gate states decoded from ~/Library/Application Support/Claude/fcache (standard interactive Anthropic account, 2026-06-13; binary-verified app.asar 1.12603.1). Pin per release. Behavior-affecting gates the harness models: 1143815894 (loop), 1648655587 (dispatch cap), 1978029737 (web_fetch routing). Telemetry/auth-internal gates omitted.",
+      "bridgeSdkTransport:583857784": {
+        "on": true,
+        "source": "force",
+        "value": true,
+        "note": "— Cowork uses the SDK-based transport (control protocol), confirming the harness's sdkMcpServers/mcp_message path is the production transport."
+      },
+      "hostLoop:1143815894": {
+        "on": true,
+        "source": "force",
+        "value": true
+      },
+      "taskDispatchLimiter:1648655587": {
+        "on": true,
+        "source": "force",
+        "value": {
+          "perTask": 1,
+          "global": 3
+        },
+        "note": "perTask=1 global=3 (host-side SKIP: recordSkipAndEmit/GCA.PerTaskLimit — NOT queue/deny). A dispatch session launches <=1 sub-task; <=3 concurrent globally."
+      },
+      "coworkRuntimeConfig:1978029737": {
+        "on": true,
+        "source": "force",
+        "value": {
+          "sessionsBridgePollBlockMs": 30,
+          "coworkNativeFilePreview": true,
+          "coworkWebFetchViaApi": true,
+          "coworkWebFetchPrompt": true,
+          "workspaceBashWaitLonger": true
+        },
+        "note": "coworkWebFetchViaApi=true coworkWebFetchPrompt=true workspaceBashWaitLonger=true sessionsBridgePollBlockMs=30 — web_fetch is host/API-routed (POST /api/organizations/<org>/cowork/web_fetch), NOT container egress; gated by a separate web-fetch hostname allowlist + URL provenance."
+      },
+      "cliPlugin:2307090146": {
+        "on": false,
+        "source": "defaultValue",
+        "value": false,
+        "note": "— the CLI-plugin credential broker is dark-launched off for standard interactive accounts (Ch23/L106)."
+      },
+      "pluginSyncSparkplug:2340532315": {
+        "on": true,
+        "source": "force",
+        "value": true,
+        "note": "— startup syncPlugins(); plugins load via --plugin-dir (registry inert in-VM)."
+      }
+    },
+    "eipcChannelUuid": "4f426349-8d6f-45f3-ae22-280fef323564",
+    "$comment": "eipcChannelUuid is per-build; recorded for provenance only — the harness does not use Desktop IPC."
+  },
+  "requireFullVmSandbox": null
+}

package/dist/agent/session.js

@@ -153,8 +153,16 @@ export function deserializeDecision(req, body) {
     if (req.kind === "question") {
         // AskUserQuestion: body is { behavior:"allow", updatedInput:{ questions, answers } }
         // We read `answers` back; `questions` was preserved in recording for the O7 guard.
+        // Validate `answers` instead of a blind cast — a non-object, array, or answers map with
+        // non-string values coerces to {} which will NOT re-serialize to the recorded body, so the
+        // O7 replay_protocol_fidelity guard trips loud rather than silently coercing corrupt data.
         const ui = (body.updatedInput ?? {});
-        return { kind: "question", answers: (ui.answers ?? {}) };
+        const raw = ui.answers;
+        const isValidAnswers = raw !== null &&
+            typeof raw === "object" &&
+            !Array.isArray(raw) &&
+            Object.values(raw).every((v) => typeof v === "string");
+        return { kind: "question", answers: isValidAnswers ? raw : {} };
     }
     if (req.kind === "dialog") {
         return {
@@ -288,7 +296,13 @@ export class LiveAgentSession {
                     yield { type: "raw", line };
                     continue;
                 }
-                yield* this.translate(msg);
+                try {
+                    yield* this.translate(msg);
+                }
+                catch (e) {
+                    yield { type: "error", source: "protocol", message: e?.message ?? String(e) };
+                    return;
+                }
             }
             // stdout closed. Give a pending 'exit' one tick to land (NOT a blocking wait on 'close' — a
             // mock/fake child may never emit it), then surface a nonzero/signal exit as a typed error — a

package/dist/assert.js

@@ -163,12 +163,25 @@ function check(a, ctx) {
         results.push(ctx.toolResultTexts.some((t) => t.includes(a.tool_result_contains))
             ? ok()
             : fail(`no tool result contained "${a.tool_result_contains}"`));
-    if (a.tool_result_not_contains !== undefined)
-        results.push(ctx.toolResultsMissing
-            ? fail(`evidence unavailable: tool results absent from result.json — cannot evaluate tool_result_not_contains`)
-            : ctx.toolResultTexts.every((t) => !t.includes(a.tool_result_not_contains))
-                ? ok()
-                : fail(`a tool result unexpectedly contained "${a.tool_result_not_contains}"`));
+    if (a.tool_result_not_contains !== undefined) {
+        if (ctx.toolResultsMissing) {
+            results.push(fail(`evidence unavailable: tool results absent from result.json — cannot evaluate tool_result_not_contains`));
+        }
+        else {
+            const forbidden = a.tool_result_not_contains;
+            const positiveHit = ctx.toolResultTexts.some((t) => t.includes(forbidden));
+            if (positiveHit) {
+                results.push(fail(`a tool result unexpectedly contained "${forbidden}"`));
+            }
+            else {
+                const hasTruncatedAbsence = ctx.toolResultsTruncated !== undefined &&
+                    ctx.toolResultTexts.some((t, i) => !t.includes(forbidden) && ctx.toolResultsTruncated[i] === true);
+                results.push(hasTruncatedAbsence
+                    ? fail(`evidence unavailable: one or more tool results are display-truncated (no assertText) — cannot rule out forbidden substring`)
+                    : ok());
+            }
+        }
+    }
     // Fuzzy content for stochastic prose. All regex-building assertions are try/catch-wrapped —
     // `evaluate()` is a bare `.map(check)` with no error boundary, so a malformed pattern must be a
     // clean assertion failure, not an uncaught throw. Case-insensitive ("i").
@@ -428,8 +441,13 @@ function check(a, ctx) {
                         }
                         if (aj.is_null !== undefined) {
                             any = true;
-                            const isNull = present && val === null;
-                            results.push(isNull === aj.is_null ? ok() : fail(`artifact_json: "${aj.path}" is_null=${isNull}, expected ${aj.is_null}`));
+                            if (!present) {
+                                results.push(fail(`artifact_json: "${aj.path ?? "(root)"}" is_null: path is absent — cannot determine null-ness (use absent: true to assert absence)`));
+                            }
+                            else {
+                                const isNull = val === null;
+                                results.push(isNull === aj.is_null ? ok() : fail(`artifact_json: "${aj.path ?? "(root)"}" is_null=${isNull}, expected ${aj.is_null}`));
+                            }
                         }
                         if (aj.equals !== undefined) {
                             any = true;

package/dist/baseline.js

@@ -151,7 +151,11 @@ export function resolveMounts(baseline, sessionId, projectId = "proj1") {
     const subst = (s) => s.replace("{sessionId}", sessionId).replace("{projectId}", projectId);
     const cwd = subst(baseline.mountLayout.cwd);
     const sessionRoot = subst(baseline.mountLayout.sessionRoot);
-    const mntRoot = subst(baseline.mountLayout.mntRoot ?? `${baseline.mountLayout.sessionRoot}/mnt`);
+    // TODO: container.ts:31 computes configGuest independently from sessionRoot and is NOT fixed here;
+    // the legacy desktop-1.11847.5 baseline (sessionRoot ending in /mnt, no spawn block) still produces
+    // a double-mnt configGuest path (/sessions/<id>/mnt/mnt/.claude) — that is a separate out-of-scope issue.
+    const rawSessionRoot = baseline.mountLayout.sessionRoot;
+    const mntRoot = subst(baseline.mountLayout.mntRoot ?? (rawSessionRoot.endsWith("/mnt") ? rawSessionRoot : `${rawSessionRoot}/mnt`));
     return {
         cwd,
         sessionRoot,

package/dist/boundary.js

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { mkdtempSync } from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir, userInfo, homedir } from "node:os";
 import { join } from "node:path";
 import { startEgressSidecar } from "./egress/sidecar.js";
@@ -20,7 +20,8 @@ export function runBoundaryChecks(baseline, session) {
     // Stand up the real per-run boundary (internal network + allowlist proxy), exactly
     // what a container-fidelity scenario uses. Tear it down at the end.
     const runId = `bchk${process.hrtime.bigint().toString(36)}`;
-    const sidecar = startEgressSidecar(boundaryAllowList(baseline, session), mkdtempSync(join(tmpdir(), "cowork-bchk-")), runId);
+    const tmpDir = mkdtempSync(join(tmpdir(), "cowork-bchk-"));
+    const sidecar = startEgressSidecar(boundaryAllowList(baseline, session), tmpDir, runId);
     const network = sidecar.network;
     const proxy = sidecar.proxyUrl;
     // Probes can throw (spawnSync setup errors, etc.); tear the sidecar down in `finally` so an unexpected
@@ -41,15 +42,20 @@ export function runBoundaryChecks(baseline, session) {
             shell,
         ], { encoding: "utf8", timeout: 30_000 });
         // 1. Host filesystem is NOT visible (no /Users, no host home bind).
+        // TWO independent probes so a leak on EITHER path fails the check — a combined-string
+        // probe can false-pass when one path leaks (real listing) but the other path's denial
+        // substring satisfies isHostFsSealed's `denied` regex on the joined output.
         {
-            const r = probe(`ls /Users 2>&1 || true; ls /host 2>&1 || true`);
-            const out = (r.stdout ?? "") + (r.stderr ?? "");
-            const blocked = isHostFsSealed(out);
+            const combine = (r) => (r.stdout ?? "") + (r.stderr ?? "");
+            const outUsers = combine(probe("ls /Users 2>&1 || true"));
+            const outHost = combine(probe("ls /host 2>&1 || true"));
+            const blocked = isHostFsSealed(outUsers) && isHostFsSealed(outHost);
+            const detail = (outUsers + "\n" + outHost).trim().slice(0, 200);
             results.push({
                 check: "host-fs-sealed",
                 expectation: "host paths (/Users, /host) invisible",
                 pass: blocked,
-                detail: out.trim().slice(0, 200),
+                detail,
             });
         }
         // 2. Direct (non-proxied) egress is impossible — no route off the internal net.
@@ -89,6 +95,12 @@ export function runBoundaryChecks(baseline, session) {
     }
     finally {
         sidecar.teardown();
+        try {
+            rmSync(tmpDir, { recursive: true, force: true });
+        }
+        catch {
+            /* best-effort: bind-mounted log may be root-owned on Linux */
+        }
     }
 }
 /** Escape regex metacharacters in a literal so it can be embedded in a RegExp. */