cowork-harness 0.5.0 → 0.6.0

package/.claude/skills/cowork-harness/scripts/assertion-keys.json

@@ -1,6 +1,7 @@
 {
   "$comment": "GENERATED from the Zod Assertion schema (src/types.ts) by scripts/gen-schema.ts — do not edit; run `npm run schema`.",
   "keys": [
+    "allow_l0_plugin_divergence",
     "allow_permissive_auto_allow",
     "artifact_json",
     "dispatch_count_max",

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -68,7 +68,7 @@ LIVE_ONLY_KEYS = {
 }
 EGRESS_KEYS = {"egress_denied", "egress_allowed"}
 # verdict modifiers — don't verify anything themselves (e.g. suppress a default-fail)
-VERDICT_MODIFIER_KEYS = {"allow_permissive_auto_allow"}
+VERDICT_MODIFIER_KEYS = {"allow_permissive_auto_allow", "allow_l0_plugin_divergence"}
 
 # Every key the replay-class logic knows how to handle. `replay_protocol_fidelity` is valid-but-not-authorable
 # (errored separately below). This is also the embedded fallback for ASSERT_KEYS — kept EQUAL to the generated

package/CHANGELOG.md

@@ -6,6 +6,87 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.6.0] — 2026-06-19
+
+### Breaking changes
+
+- **Exit code 3 for boundary/integrity violations.** Commands that previously exited `2` for a
+  boundary constraint (e.g. `skill` hitting the egress sandbox, `run` with a `boundary`-category
+  failure) now exit `3`. Exit `2` is narrowed to usage errors, unknown flags, and runtime errors.
+  Scripts that check `$? -eq 2` to detect boundary failures must be updated to `$? -eq 3`.
+- **`verify-cassettes --staleness-only` / `--privacy-only` removed.** Replaced by
+  `--skip-staleness` (run privacy scan only) and `--skip-privacy` (run staleness scan only). The
+  old flags are not aliased — they now exit `2` as unknown flags.
+- **`decide` with no configuration exits `2` instead of `1`.** Previously, calling `decide` with no
+  `--decider-*`, `--answer`, or `--answer-policy` would fall through to a `ScriptedDecider([])` and
+  exit `1` ("no rule matched"). It now fails early with exit `2` ("no decider configured") and a
+  clear message.
+
+### Added
+
+- **`chat` — full flag parity for interactive debugging:**
+  - `[prompt]` — optional seed prompt sent as the first turn before the REPL opens.
+  - `--upload <file>` (repeatable) — attach a file at `mnt/uploads/<basename>`; live at session start.
+  - `--folder <dir>` (repeatable) — connect a project folder at `mnt/.projects/<basename>` as a live bind mount.
+  - `--verbose` / `-V` — show thinking blocks, tool inputs, and the sub-agent tree (previously hardcoded off).
+  - `--fidelity protocol` — no-Docker fastest tier; accepted alongside `container` and `hostloop`.
+  - `--model` in `--raw` mode — previously silently dropped; now passed as `--model <id>` to the docker argv.
+  - Idle heartbeat wired in all three fidelity branches (protocol / hostloop / container).
+  - Run ID printed at session start (before first turn) so a mid-session crash still tells you where the transcript is.
+- **`assertions` command** — canonical rename of `assert`; `assert` is kept as a deprecated alias
+  that prints a migration notice. `assertions --list` is the new canonical form.
+- **`scaffold <run-id>` positional** — canonical form; `--from-run <id>` is kept as a deprecated
+  alias that prints a migration notice.
+- **`trace --view tools|questions|dispatches`** — replaces the three separate `--tools` / `--gates`
+  / `--dispatches` flags with a single `--view` enum. Legacy flags are kept as backward-compat
+  aliases (`--gates` maps to `--view questions`).
+- **Env-var defaults for all live commands:**
+  - `COWORK_HARNESS_FIDELITY` — default fidelity tier for `skill` and `chat` (validated; exits 2 on an invalid value).
+  - `COWORK_HARNESS_MODEL` — default model override for `skill` and `chat`.
+  - `COWORK_HARNESS_OUTPUT_FORMAT` — default `--output-format` for all commands (`text` or `json`).
+- **`decide` no-decider guard** — calling `decide` with no configuration fails immediately with a
+  clear message and exit `2` instead of falling through to a vacuous "no rule matched" exit `1`.
+- **`vm` per-subcommand `--help`** — `vm <sub> --help` prints the subcommand usage and exits `0`.
+- **`--quiet` / `-q` accepted in `decide`** — no-op flag for flag-surface consistency with `skill` / `run`.
+
+### Fixed
+
+- **`--rerecord-stale` now prefers on-disk scenario over embedded snapshot (G-1).** When a
+  `scenarios/<name>.yaml` exists alongside the cassette dir, `--rerecord-stale` re-records from it
+  instead of the embedded copy. Edits to the scenario (e.g. adding `skills:` for staleness scoping)
+  now take effect. Falls back to the embedded snapshot when no on-disk file is found, with a clear
+  warning.
+- **Staleness message distinguishes format-version bump from real content change (G-2).** After a
+  harness upgrade that changes the hash algorithm, `verify-cassettes` now reports
+  `recorded under an older hash format (vN → vM)` instead of the misleading
+  `local skill/plugin dir contents changed`.
+- **`.cowork-hashignore` leading-slash patterns now correctly anchor to the mount root (G-3).**
+  `/tests` previously compiled to a regex that never matched (no leading slash in relative paths);
+  it now matches only the top-level `tests/` dir, as expected.
+- **Scoped staleness findings now name the changed bucket (G-4).** When a cassette was recorded with
+  `skills: [<name>]` scoping, `verify-cassettes` now reports `skills/<name> changed` or
+  `shared root changed` rather than the generic `local skill/plugin dir contents changed`.
+- **Unknown flags in `chat` now exit `2`.** Previously ignored silently; any unrecognised flag now
+  exits `2` with a clear message.
+- **`chat --model` bounds-checked.** If `--model` is the last argument (no value following), the
+  command now exits `2` with a clear message instead of silently using `undefined`.
+- **`cmdSync` platform guard fires before argument parsing.** On non-macOS platforms the guard now
+  exits before `parseArgs`, so `sync --help` on Linux no longer crashes on a missing flag.
+- **`record` conflict check.** Passing both a positional and `--cassette` now exits `2` immediately
+  instead of silently preferring one.
+- **L0 plugin divergence signal.** `spawnProtocol` now reports whether the skill resolved at L0
+  (no container) vs. L1, so callers can surface the divergence accurately.
+- **System-prompt threading.** `systemPromptAppend` is now passed through all runtime paths that
+  previously dropped it.
+- **Strict agent binary resolution.** When the exact staged binary path is missing, the harness now
+  fails with a clear message pointing to `COWORK_HARNESS_ALLOW_AGENT_FALLBACK=1` instead of
+  silently falling back to an arbitrary sibling version.
+- **Path traversal guard on plugin sources.** Plugin source paths are now validated to be
+  directories (not files or traversal strings) before mounting.
+- **Cassette correctness (batch):** privacy/staleness coverage tracking, redaction verdict
+  preservation across re-records, base64-encoded artifact body scanning, and exhaustiveness
+  checks on the replay assertion set.
+
 ## [0.5.0] — 2026-06-18
 
 ### Added

package/README.md

@@ -78,14 +78,15 @@ Skill testing is the headline use, but the tool is a general harness over the Co
 |---|---|---|
 | `skill <folder> "<prompt>"` | Run a local skill/plugin folder once against the staged agent | ad-hoc "is the skill alive / does it do X?" — the fast inner loop |
 | `run <scenario.yaml \| dir/>` | Run authored scenarios with `assert:` + a CI-ready exit code | you want a repeatable, **asserted regression test** |
-| `chat <folder>` | Interactive multi-turn REPL against a skill (TTY) | debugging a multi-turn flow by hand |
+| `chat <folder> [prompt]` | Interactive multi-turn REPL against a skill (TTY); optional seed prompt is sent as the first turn. `--upload <file>` / `--folder <dir>` (repeatable) attach files/project folders; `--verbose` / `-V` shows thinking blocks + tool inputs; `--fidelity protocol\|container\|hostloop` | debugging a multi-turn flow by hand |
 | `record` / `replay` | `record` saves a control-protocol cassette (one scenario, or batch a `dir/`; `--rerecord-stale` refreshes only drifted ones; `--max-artifact-bytes` raises the 64 KiB inline-body cap); `replay` runs a cassette **file or a `dir/` of `*.cassette.json`** deterministically (`<file\|dir>`, `--cassette <file>` for the explicit single form; `--strict` fails on a stale one; exits on the worst verdict) | **token-free, Docker-free CI** from a once-recorded run |
-| `verify-cassettes <file\|dir>` | Token-free CI gate over committed cassettes: a privacy scan (email/currency/domain → exit 1; whole-token allows via `--allow` / class-scoped `--allow-domain` / `--allow-email` / `--allow-file`) + a staleness check (`--staleness-only`). A dir argument scans `*.cassette.json` in that dir only (**non-recursive**) | gating **committed cassettes** against PII leaks + "edited the skill, forgot to re-record" |
+| `verify-cassettes <file\|dir>` | Token-free CI gate over committed cassettes: a privacy scan (email/currency/domain → exit 1; whole-token allows via `--allow` / class-scoped `--allow-domain` / `--allow-email` / `--allow-file`) + a staleness check (`--skip-privacy` or `--skip-staleness` to run only one half). A dir argument scans `*.cassette.json` in that dir only (**non-recursive**) | gating **committed cassettes** against PII leaks + "edited the skill, forgot to re-record" |
 | `verify-run <run-dir> <scenario.yaml>` | Re-evaluate a scenario's `assert:` against an already-kept run dir — **no live agent, no tokens, no Docker** (~1s) | iterating on a wrong assertion without a full live re-record |
-| `trace <run-id>` | Digest a run's `events.jsonl` (`--tools`, `--gates`, `--dispatches` for the sub-agent dispatch tree + total) | "how many sub-agents *actually* dispatched, and which?" |
-| `scaffold --from-run <id>` | Turn a kept run into a starter scenario YAML (gates→answers, artifacts→`file_exists`) | authoring a scenario from a real run instead of guessing |
+| `trace <run-id>` | Digest a run's `events.jsonl` (`--view tools\|questions\|dispatches`; legacy `--tools` / `--gates` / `--dispatches` aliases still accepted) | "how many sub-agents *actually* dispatched, and which?" |
+| `scaffold <run-id>` | Turn a kept run into a starter scenario YAML (gates→answers, artifacts→`file_exists`); `--from-run <id>` is a deprecated alias for the positional | authoring a scenario from a real run instead of guessing |
+| `python3 …/scenario.py scaffold --name <name> --skill <dir>` | Generate a starter scenario skeleton from scratch (the `…` is `.claude/skills/cowork-harness/scripts/`; `cowork-harness lint --help` shows the resolved path) | starting a new scenario when you have no prior run |
 | `lint <scenario.yaml>…` | Check scenarios for silent false-greens — assertions placed on the wrong CI lane, mixed content/live keys, missing `controlOut`-required keys (bundled `scenario.py`; needs python3 + PyYAML) | before committing a new scenario or after changing assertions |
-| `assert --list` | List the available scenario assertions (generated from the schema) | "what can I assert?" without grepping the source |
+| `assertions --list` | List the available scenario assertions (generated from the schema); `assert` is a deprecated alias | "what can I assert?" without grepping the source |
 | `decide` | Validate a decider against a sample question in ~2 s (no run) | sanity-check a `--decider-*` / `--answer` wiring before a long run |
 | `gates` / `answer` | Stream / answer in-band gates for `--decider-dir` | a **driving agent** answers live questions via a Monitor |
 | `boundary-check [baseline] [--session <file>]` | Prove the sandbox enforces Cowork's limitations; `--session` folds a session's `egress.extra_allow` into the probe allowlist | verifying the harness's own fidelity |
@@ -119,7 +120,7 @@ cowork-harness skill ~/my-plugin 'review this deck' --upload deck.pdf      # att
 cowork-harness skill ~/my-plugin "..." --session-id s1                     # pin a session…
 cowork-harness skill ~/my-plugin '<next turn>' --session-id s1 --resume    # …then resume it (gated/checkpoint skills)
 cowork-harness skill ~/my-plugin "..." --keep                            # then: trace the run
-cowork-harness trace <run-id> --tools                                     # tool calls + sub-agent dispatches from events.jsonl
+cowork-harness trace <run-id> --view tools                                # tool calls + sub-agent dispatches from events.jsonl
 cowork-harness skill --help                                               # full per-command flag reference
 
 cowork-harness chat ~/my-plugin                  # interactive multi-turn REPL (full harness: egress sandbox + control protocol)
@@ -132,8 +133,8 @@ cowork-harness chat ~/my-plugin                  # interactive multi-turn REPL (
 `run`/CI), `prompt` (ask at the TTY — the default for `skill` when interactive), or `first` (pick
 option 1, loudly warn). Pick with `--on-unanswered`; left unset, `skill` is **adaptive** (`prompt` on
 a TTY, `fail` when piped/CI) and `run` is always `fail`. Exit codes: `0`
-pass · `1` assertion/agent failure · `2` usage /
-unanswered-under-`fail` / boundary / runtime. After a run, the footer **echoes every auto-answered
+pass · `1` assertion/agent failure · `2` usage / unanswered-under-`fail` / runtime · `3` boundary/integrity.
+After a run, the footer **echoes every auto-answered
 question as a copy-pasteable `--answer "<q>=<choice>"` line** — run once exploratorily, then paste them
 back to lock in a deterministic re-run.
 
@@ -194,9 +195,11 @@ The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it
 
 It also follows the open [Agent Skills](https://github.com/vercel-labs/skills) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) by pointing the `npx skills` CLI at `.claude/skills/cowork-harness` in this repo. (Working *inside* this repo, the skill auto-loads as a project skill — no install needed.)
 
+> Note: `npm install -g cowork-harness` ships `scenario.py` and assertion keys (enough for `lint` in CI) but not the full SKILL.md teaching document; install via the marketplace command above to get the teaching skill.
+
 **Prerequisites for anything above `protocol` fidelity** (the `protocol` tier skips items 1–2 — no Docker, no staged agent — but still calls a real model via the host `claude`, so it needs item 3, the auth token; only a committed-cassette `replay` needs nothing at all):
 1. **Claude Desktop, opened once.** The Cowork agent binary is **bind-mounted from your own install** at run time — nothing Anthropic-owned is bundled. Open Cowork once so the agent ELF is staged (`…/claude-code-vm/<ver>/claude`); the harness auto-detects it, or set `COWORK_AGENT_BINARY=<path>` to point at it. Without a staged agent, container/cowork runs fail with "Open Cowork once to stage it…".
-2. **Docker (arm64)** + the agent image: `docker build --platform linux/arm64 -t cowork-agent-base:1 -f docker/Dockerfile.agent .` (override the tag with `COWORK_AGENT_IMAGE`). The `-f docker/Dockerfile.agent .` paths are **repo-relative** — run it from a source checkout, not a global `npm install -g` (where the Dockerfile lives under the package dir).
+2. **Docker (arm64)** + the agent image: `docker build --platform linux/arm64 -t cowork-agent-base:1 -f docker/Dockerfile.agent .` (override the tag with `COWORK_AGENT_IMAGE`). The `-f docker/Dockerfile.agent .` paths are **repo-relative** — run it from a source checkout, not a global `npm install -g` (where the Dockerfile lives under the package dir). (Global install? Run `cowork-harness doctor --tier container` — it prints the exact `docker build` command with the correct package-local Dockerfile path.)
 3. **An auth token** — either `export CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token)` or a **`.env`** file (copy `.env.example` → `.env`; gitignored). The token resolves in priority order: exported env > `--dotenv <path>` > `./.env` (cwd) > `<install>/.env` (the package root), so a `npm link`ed install works from any directory. Keep `.env` at a working-dir or install root, never inside a mounted skill/project folder. (Use `--dotenv`, not `--env-file` — Node reserves the latter.)
 
 > `sync` (below) is **optional for a first run** — the repo ships `baselines/desktop-*.json`, so `baseline: latest` already resolves. Run `sync` only to refresh the platform baseline after Claude Desktop updates. (`sync` is **macOS-only** today; on Linux/Windows use the committed baselines — they work cross-platform.)
@@ -221,9 +224,6 @@ cowork-harness run examples/scenarios/ --output-format json
 cowork-harness record examples/scenarios/example-pdf-skill.yaml --out examples/replays/example-pdf-skill.cassette.json
 cowork-harness replay --cassette examples/replays/example-pdf-skill.cassette.json
 
-# A committed synthetic fixture is ready to replay on a fresh clone (no record step needed):
-cowork-harness replay --cassette examples/replays/example-pdf-skill.cassette.json
-
 # Cassettes are COMMITTED fixtures — record against synthetic data, and gate them in CI:
 cowork-harness verify-cassettes examples/replays/   # privacy scan (email/currency/domain) + staleness; exit 1 on a finding
 ```
@@ -239,7 +239,8 @@ cowork-harness verify-cassettes examples/replays/   # privacy scan (email/curren
 > orchestration from both, re-evaluates the **content** assertions, and re-exercises
 > `serializeDecision` as a token-free O7 guard (the AskUserQuestion `{questions,answers}` answer-shape
 > invariant). Evaluated on replay: `transcript_*`, `tool_*`, `subagent_*`, `dispatch_count_max`,
-> `result`. **`question_asked`, `questions_count_max`, and `gate_answers_delivered` are also evaluated —
+> `result`, `allow_permissive_auto_allow` (always-on Cowork-parity scan). **`question_asked`,
+> `questions_count_max`, and `gate_answers_delivered` are also evaluated —
 > but only when the cassette carries `controlOut` (full-fidelity)**; old cassettes without it get a
 > loud warning and those three keys are excluded (not vacuously passed). **Filesystem assertions
 > (`file_exists`, `user_visible_artifact`, `artifact_json`) are evaluated when the cassette carries an
@@ -296,7 +297,7 @@ assert:
 ```
 
 ```yaml
-# sessions/default.yaml  (abridged — see the file for every field)
+# examples/sessions/default.yaml  (abridged — see the file for every field)
 # Relative paths below resolve from THIS file's dir (absolute and ~ are used as-is).
 model: claude-opus-4-8
 effort: high
@@ -522,7 +523,7 @@ This repo is built to be driven by agents, not just read by humans:
 - ✅ **Three isolation tiers (L0/L1/L2) + two loop-mode overlays** — `protocol` (L0 control loop), `container` (L1 sandboxed arm64 + per-run default-deny egress sidecar), `microvm` (L2 real Apple-VZ Linux microVM + guest firewall); plus the loop-mode overlays `hostloop` (production split-execution: agent loop on host, shell/web via the workspace SDK-MCP server) and `cowork` (auto-picks host-loop vs container the way Cowork does — gate `1143815894`). Egress enforced at container/microvm/hostloop; `boundary-check` reports **ALL CONSTRAINTS ENFORCED**.
 - ✅ **Three-seam driver** — `AgentSession` (control protocol) → `Decider` (scripted + `on_unanswered` policy, no silent false-greens) → `Run` (turn loop, sub-agent dispatch tree, `RunRecord`). Multi-turn `chat`, deterministic cassette `record`/`replay` (no token), `run.jsonl`/`trace.json` logging with secret-scrub.
 - ✅ **Answering live questions, every way you'd need** — `--decider-llm --intent "<one line>"` (a small model picks per question, steered by your test intent — the ergonomic default; non-determinism is flagged so a green isn't mistaken for a scripted pass), `--answer-policy <yaml>`/`--answer "rx=c"` (declarative regex→label, deterministic CI), `--decider-cmd '<helper>'` (custom logic — the Python `serve_decider(fn)` adapter pre-builds the wire loop so the helper writes only the decision), and **`--decider-dir <dir>`** (the *driving agent* answers each gate **in-band** with full context — it arms a Monitor on `cowork-harness gates <dir> --follow` and replies with `cowork-harness answer <dir> --gate <N> --choose <label>`; the session-under-test stays live, no resume/re-worded question — binary-verified). Every channel keeps stdout free, so all compose with `--output-format json`. A question is **never silently answered with option 1** — unhandled fails loud. Validate any decider in ~2s with `cowork-harness decide`.
-- ✅ **Sub-agent aggregation + `trace`** — recognizes the real `Agent` dispatch tool (binary-verified; `Task` is its alias) so `subagent_dispatched`/`dispatch_count_max` fire under `--fidelity cowork`, excluding the `TaskCreate` todo list; `cowork-harness trace <id> --tools` digests `events.jsonl` (each tool row now shows its **result status** `ok`/`error`), and `trace <id> --gates` shows the gate lifecycle (**question → injected answer → delivered result**); `result.json`/`--keep` surface the deep `mnt/outputs` deliverable path.
+- ✅ **Sub-agent aggregation + `trace`** — recognizes the real `Agent` dispatch tool (binary-verified; `Task` is its alias) so `subagent_dispatched`/`dispatch_count_max` fire under `--fidelity cowork`, excluding the `TaskCreate` todo list; `cowork-harness trace <id> --view tools` digests `events.jsonl` (each tool row now shows its **result status** `ok`/`error`), and `trace <id> --view questions` shows the gate lifecycle (**question → injected answer → delivered result**); `result.json`/`--keep` surface the deep `mnt/outputs` deliverable path.
 - ✅ **Answer delivery is verified, not assumed** — an AskUserQuestion answer is injected as the binary's full tool input (`{questions, answers}`, ELF-verified), so the answer actually reaches the model; `RunResult.gateDeliveries[]` + the `gate_answers_delivered` assertion catch any delivery failure, and `RunResult.toolCounts` gives the **truthful** per-tool call count (host-routed `WebSearch` shows here, not the always-0 `usage.server_tool_use`).
 - ✅ **Binary-grounded fidelity** — cwd `/sessions/<id>`, the three-channel MCP model (`--mcp-config` honored in plain cowork mode; host/API-routed `web_fetch`; SDK-server delivery), host-loop tool partition, auth-env token-only drop, and production GrowthBook gates pinned per release.
 - ✅ The agent binary is **bind-mounted from your own install** at run time — nothing Anthropic-owned is in any image or distributed.

package/dist/agent/session.js

@@ -361,8 +361,19 @@ export class LiveAgentSession {
         // (If large control frames ever become legitimate, switch to a drain-aware queue, making writes async.)
         if (line.length > 256 * 1024)
             throw new Error(`control frame is ${line.length} bytes (> 256 KiB safe limit) — refusing to write to avoid partial stdin buffering; this indicates an unexpectedly large control payload`);
+        // Bug 34: check stream writability before writing — a closed/destroyed stdin after a child crash
+        // loses decision frames silently. Throw immediately so callers surface the failure rather than
+        // hanging or silently dropping frames.
+        if (this.proc.stdin.destroyed || !this.proc.stdin.writable)
+            throw new Error("control-protocol write failed: child stdin is no longer writable (process may have crashed)");
         this.controlOut.write(line + "\n");
-        this.proc.stdin.write(line + "\n");
+        // Attach a one-shot error handler on the write so stream errors surface via rejectError rather
+        // than as unhandled 'error' events (the permanent 'error' handler on constructor covers stdin
+        // errors that fire outside a write, e.g. EPIPE after a crash).
+        this.proc.stdin.write(line + "\n", (err) => {
+            if (err && this.rejectError)
+                this.rejectError(err instanceof Error ? err : new Error(String(err)));
+        });
     }
 }
 /** Pure translation of one parsed stream-json message → AgentEvents (no side-effects). Shared by
@@ -447,15 +458,22 @@ export function parseMessage(msg) {
     }
     return ev;
 }
-/** Flatten a tool_result `content` (a string, or an array of `{type:"text",text}` blocks), capped at
+/** Flatten a tool_result `content` (a string, or an array of content blocks), capped at
  *  `max` chars. The 500-char DISPLAY value (toolResultText) keeps the recorder/trace compact; the larger
- *  PROVENANCE value (toolResultRaw) is what seeds web_fetch provenance, so a URL past char 500 isn't lost. */
+ *  PROVENANCE value (toolResultRaw) is what seeds web_fetch provenance, so a URL past char 500 isn't lost.
+ *  Bug 35: preserve all content block types — text blocks use their text value; all other block types
+ *  (json, resource, link, unknown shapes) are JSON-stringified so no content is silently dropped. */
 function flattenToolResult(content, max) {
     if (typeof content === "string")
         return content.slice(0, max);
     if (Array.isArray(content))
         return content
-            .map((b) => (b && typeof b === "object" && "text" in b ? String(b.text) : ""))
+            .map((b) => {
+            if (b && typeof b === "object" && "text" in b)
+                return String(b.text);
+            // Non-text blocks (json, resource, link, unknown): JSON-stringify to preserve all content.
+            return JSON.stringify(b);
+        })
             .join(" ")
             .slice(0, max);
     return "";

package/dist/assert.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { resolve, relative, isAbsolute, sep } from "node:path";
 import { compileUserRegex } from "./regex.js";
 /** Resolve a user-authored assertion path under `workRoot`, rejecting absolute paths and any `..` that
@@ -209,6 +209,9 @@ function check(a, ctx) {
         // evidence the assertion requires, so it fails loud ("no silent false-greens"). `delivered:
         // false` is a real errored tool_result; `null` is "no tool_result observed for this gate".
         if (a.gate_answers_delivered) {
+            if (ctx.gateDeliveries.length === 0) {
+                results.push(fail("gate_answers_delivered: no gates were recorded during this run — either no gate fired, or gate delivery tracking is not wired. Expected at least one delivered gate."));
+            }
             const bad = ctx.gateDeliveries.filter((g) => g.delivered !== true);
             results.push(bad.length === 0
                 ? ok()
@@ -236,8 +239,15 @@ function check(a, ctx) {
         else {
             let doc;
             let parsed = true;
+            const fileSizeLimit = 10 * 1024 * 1024;
+            const fileSize = statSync(file).size;
+            if (fileSize > fileSizeLimit) {
+                results.push(fail(`artifact_json: file too large to parse as JSON (${fileSize} bytes, limit 10 MiB)`));
+                parsed = false;
+            }
             try {
-                doc = JSON.parse(readFileSync(file, "utf8"));
+                if (parsed)
+                    doc = JSON.parse(readFileSync(file, "utf8"));
             }
             catch (e) {
                 parsed = false;

package/dist/baseline.js

@@ -15,13 +15,20 @@ export function resolveAgentBinary(baseline) {
     const staged = (baseline.agentBinary?.stagedPath ?? "").replace(/^~(?=$|\/)/, homedir());
     if (staged && existsSync(staged))
         return resolve(staged);
-    // The baseline's exact version dir is gone (e.g. Claude Desktop updated). Fall back to the
-    // newest sibling binary under the same claude-code-vm/ root before giving up.
+    // The baseline's exact version dir is gone (e.g. Claude Desktop updated).
+    // By default this is a hard failure — a different agent version can silently change behavior.
+    // Set COWORK_HARNESS_ALLOW_AGENT_FALLBACK=1 to opt in to using the newest sibling binary.
+    const exactPath = staged || "(unknown)";
     const fallback = staged ? newestStagedBinary(staged) : undefined;
-    if (fallback) {
+    if (fallback && process.env.COWORK_HARNESS_ALLOW_AGENT_FALLBACK === "1") {
         process.stderr.write(`cowork-harness: staged agent binary "${staged}" not found; ` + `falling back to newest sibling "${fallback}".\n`);
         return fallback;
     }
+    if (fallback) {
+        // A fallback exists but the opt-in env is not set — fail explicitly rather than silently using a
+        // different agent version that could make the run appear green while running the wrong binary.
+        throw new Error(`cowork-harness: baseline agent binary not found: ${exactPath}. Set COWORK_HARNESS_ALLOW_AGENT_FALLBACK=1 to use the newest available.`);
+    }
     throw new Error(`Staged agent binary not found at "${staged}". It is extracted from your Claude Desktop install ` +
         `(claude-code-vm/<ver>/claude). Open Cowork once to stage it, or set COWORK_AGENT_BINARY to its path.`);
 }