cowork-harness 4.2.0 → 4.2.1

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, asserting artifacts, egress, or sub-agent dispatch, measuring how long each tool call took (toolDurations / trace), or debugging a failed run or verdict from its result.json or transcript. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. Also when iterating or hardening a skill across fixes, or grounding a skill's self-critique against its own run evidence — including a document-analysis skill (cap table, deck, financial model, transcript) that needs an uploaded file attached to be critiqued at all. Also for comparing two versions of a skill before merging an edit — did the change make its answers worse? (`eval`: paired, interleaved A/B of two plugin versions, pinned models). NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold / critique / stats / eval commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 4.2.0
-  tracks-harness: cowork-harness 4.2.0 (baseline desktop-2.16120.0)
+  version: 4.2.1
+  tracks-harness: cowork-harness 4.2.1 (baseline desktop-2.16120.0)
 ---
 
 # cowork-harness
@@ -26,7 +26,7 @@ allowlist). This skill exists mostly to keep you out of those traps — the *Inv
 full landmine catalog in [`references/gotchas.md`](references/gotchas.md) are the highest-value part.
 Read them.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.2.0` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 4.2.1` (baseline
 > `desktop-2.16120.0`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -43,7 +43,7 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.2.0**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.2.0" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.2.0"`. **Pin `@^4.2.0`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 4.2.1**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@^4.2.1" <cmd>` (Node ≥ 22), or install once with `npm i -g "cowork-harness@^4.2.1"`. **Pin `@^4.2.1`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
   This skill documents the CURRENT surface, not release history. If `cowork-harness --version` is
   OLDER than the floor, the per-release record of what you are missing is [CHANGELOG.md](https://github.com/yaniv-golan/cowork-harness/blob/main/CHANGELOG.md)

package/.claude/skills/cowork-harness/references/assertion-catalog.md

@@ -1,6 +1,6 @@
 # Assertion catalog
 
-Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`). Every `assert:` key with its semantics, and the
+Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`). Every `assert:` key with its semantics, and the
 verdict-signal table. Which keys survive `replay` is in [`scenario-schema.md`](./scenario-schema.md#replay-class);
 the scenario and session YAML fields are there too.
 

package/.claude/skills/cowork-harness/references/assertions-guide.md

@@ -1,6 +1,6 @@
 # Assertions guide
 
-Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
+Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`). Read it when choosing assertion keys: the two orthogonal axes and the goal → key map. The full catalog is `assertion-catalog.md`.
 
 ### Assertions: two orthogonal axes
 

package/.claude/skills/cowork-harness/references/authoring.md

@@ -1,6 +1,6 @@
 # Authoring a scenario
 
-Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
+Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`). Read it when composing a `scenarios/*.yaml`: session vs scenario, discovery, the fidelity tier, the answer path, `web_fetch`, and scaffold + lint.
 
 ## Part I — AUTHOR a scenario
 

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`).
+Self-contained reference. Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -82,7 +82,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@^4.2.0"
+- run: npm i -g "cowork-harness@^4.2.1"
 - run: cowork-harness lint scenarios/*.yaml --strict --min-severity WARN
                                                     # no silent false-greens. WITHOUT --strict this
                                                     # step cannot fail on a WARN-class rule (e.g.
@@ -395,7 +395,7 @@ jobs:
         with: { node-version: '24' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@^4.2.0"
+      - run: npm i -g "cowork-harness@^4.2.1"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -424,7 +424,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@^4.2.0"
+        run: npm i -g "cowork-harness@^4.2.1"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/critique.md

@@ -1,6 +1,6 @@
 # Critique — the facts a plugin install can't otherwise reach
 
-Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`). This is **not** a trim of the full
+Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`). This is **not** a trim of the full
 [`docs/critique.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/critique.md) (repo-only —
 flags, cost, reproduction discipline, known limitations all live there). This file covers exactly what a
 plugin install cannot otherwise discover: the run-dir artifact a harvester actually reads, the report's

package/.claude/skills/cowork-harness/references/debugging.md

@@ -1,6 +1,6 @@
 # Debugging a run
 
-Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
+Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`). Read it when a run misbehaved or a green looks wrong: triage, the observability output, and `chat`.
 
 ## Part III — Debug
 

package/.claude/skills/cowork-harness/references/eval.md

@@ -1,6 +1,6 @@
 # `eval` — paired before/after comparison of a skill edit (EXPERIMENTAL)
 
-Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`). The full guide is
+Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`). The full guide is
 [docs/eval.md](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/eval.md); this is the part you
 need while running it.
 

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`).
+Self-contained reference. Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`).
 
 > **This page vs. the repo docs.** This is the **offline snapshot** that ships inside the installed
 > plugin — it is self-contained on purpose. The repo carries four other fidelity views, each answering a

package/.claude/skills/cowork-harness/references/gotchas.md

@@ -1,6 +1,6 @@
 # Gotchas
 
-Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`). The full "✓ passed ≠ correct" landmine catalog.
+Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`). The full "✓ passed ≠ correct" landmine catalog.
 
 ## Gotchas — the "✓ passed ≠ correct" landmines
 

package/.claude/skills/cowork-harness/references/measurement.md

@@ -1,6 +1,6 @@
 # Measurement
 
-Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
+Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`). Read it before comparing runs: `--repeat`, `--ablate-skill`, and the hygiene that keeps a batch valid.
 
 ### Measure — before/after, with/without (`--repeat`, `--ablate-skill`)
 

package/.claude/skills/cowork-harness/references/run-record-replay.md

@@ -1,6 +1,6 @@
 # Run, record and lock
 
-Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
+Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`). Read it when running a scenario, recording or placing a cassette, reading verdict signals, checking a background run, or choosing CI lanes.
 
 ## Part II — RUN, RECORD & LOCK
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, replay class, web_fetch, authoring gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 4.2.0`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 4.2.1`
 (baseline `desktop-2.16120.0`). If your checkout is newer, prefer the live [`docs/scenario.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/scenario.md),
 [`docs/session.md`](https://github.com/yaniv-golan/cowork-harness/blob/main/docs/session.md), and `SPEC.md`.
 

package/.claude/skills/cowork-harness/references/task-recipes.md

@@ -2,7 +2,7 @@
 
 Each recipe composes facts that live scattered across SKILL.md and the other references into one
 decision path. Every one answers a question a real fleet owner had to work out the hard way.
-Tracks `cowork-harness 4.2.0` (baseline `desktop-2.16120.0`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
+Tracks `cowork-harness 4.2.1` (baseline `desktop-2.16120.0`), same as SKILL.md's front-matter. Recipe 2's `resolved-tier`/`unverifiable-tier` staleness classes and
 Recipe 3's `init-redact` shipped in 0.24.0 and are part of the current feature set — no version gate
 needed if your CLI meets SKILL.md's version floor.
 

package/CHANGELOG.md

@@ -6,6 +6,42 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [4.2.1] — 2026-10-01
+
+A security fix: the judge, the LLM decider and the `critique` evaluator run tool-less, isolated from your own Claude
+Code setup. **Needs Claude Code 2.1.197 or later on the host** for any run that uses them.
+
+### Upgrade notes
+
+- **Cassettes: no re-record needed.** Nothing under `src/runtime`, `src/hostloop`, `src/staging`, `src/session.ts`,
+  `baselines/` or `docker/` changed, and `CASSETTE_VERSION` is still 13. A committed cassette's recorded content and
+  fingerprints are unchanged; `verify-cassettes` and `replay --strict` pass on the bundled ones.
+
+### Security
+
+- **The LLM judge, the LLM decider and the `critique` evaluator call the host `claude` with no tools, isolated
+  from your own Claude Code setup.** All three read untrusted agent output. Up to 4.2.0 the call ran with Claude
+  Code's default tools: read-only tools (Read, Glob, Grep) always ran, and Write, Bash and web tools ran whenever
+  your settings allowed them — allow rules, an `auto`/`acceptEdits`/`bypassPermissions` default mode, or a
+  `PermissionRequest` hook — so text in a judged output could steer a tool call on the machine running the harness.
+  The call also loaded your CLAUDE.md, skills, plugins, hooks and MCP servers, and the project settings of the
+  directory the harness ran in, and saved a transcript into your session history. Every call passes `--safe-mode`,
+  `--strict-mcp-config`, `--no-session-persistence`, `--setting-sources user` and `--tools ""`. Your user settings
+  still apply (their `env`, `apiKeyHelper` and model settings), as do managed and policy settings; auth configured
+  only in a project's `.claude/settings.json` is not read. On a machine with an enterprise MCP config — a
+  `managed-mcp.json` in Claude Code's managed-settings directory
+  (`/Library/Application Support/ClaudeCode/` on macOS, `/etc/claude-code/` on Linux, `C:\Program Files\ClaudeCode\`
+  on Windows) — the call leaves out `--strict-mcp-config`, which Claude Code refuses beside one; `--safe-mode` still
+  keeps every MCP server out, your organisation's managed ones included, while its managed hooks and policy
+  settings still apply. A managed config at another path makes Claude Code refuse `--strict-mcp-config`; the call is
+  then retried once without it, before any model call.
+  **This needs Claude Code 2.1.197 or later on the host.** An older CLI is refused before any model call, saying
+  why and what to do. `run`, `record` and `skill` make that check before the agent spends when a scenario
+  has a `semantic_matches` assert graded by the host `claude`, or `on_unanswered: llm` / `--decider-llm` with no
+  external decider channel; `critique` makes it before its task turn and `decide --decider-llm` before its model
+  call — all exit 2. `eval` refuses each such run before its agent spends; the eval still writes its report, with
+  every run errored. Runs that use none of them are unaffected.
+
 ## [4.2.0] — 2026-09-30
 
 Groundwork for skill hillclimbing: `eval` for paired before/after comparisons of a skill edit, plus

package/README.md

@@ -36,7 +36,7 @@ npm ci && npm run build
 node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 ```
 
-(Installing globally — `npm install -g "cowork-harness@^4.2.0"` — gives you the `cowork-harness` CLI for your own
+(Installing globally — `npm install -g "cowork-harness@^4.2.1"` — gives you the `cowork-harness` CLI for your own
 scenarios and cassettes; the bundled example above also replays from a global install — see the `$(npm root -g)` path below.)
 
 Full setup → [Quick start](./docs/cli.md#quick-start).
@@ -49,8 +49,8 @@ Three ways to use this project. Each row is the whole hook — follow the link f
 
 | I want to… | Start here | Needs |
 |---|---|---|
-| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^4.2.0"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
-| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^4.2.0"` |
+| **Run scenarios myself** from a terminal | **[docs/cli.md](./docs/cli.md)**<br><br>`npm i -g "cowork-harness@^4.2.1"`<br>`cowork-harness replay examples/replays/example-pdf-skill.cassette.json` | Node ≥ 22. The replay demo above is token-free and needs nothing else; live tiers above `protocol` need Docker + a staged agent binary |
+| **Have Claude Code drive it** for me | **[docs/companion-skill.md](./docs/companion-skill.md)**<br><br>`/plugin marketplace add yaniv-golan/cowork-harness`<br>`/plugin install cowork-harness@cowork-harness` | Claude Code. The skill self-bootstraps the CLI via `npx "cowork-harness@^4.2.1"` |
 | **Gate my skill in CI** | **[docs/ci.md](./docs/ci.md)**<br><br>`- uses: yaniv-golan/cowork-harness@v4`<br>`  with: { command: replay, path: cassettes/ }` | Nothing for the token-free gate; the live lane needs a self-hosted runner with Docker + an agent binary |
 
 **In short:** three ways in (the table above). Five `fidelity:` tiers — `protocol`, `container`, `microvm`, `hostloop`,
@@ -186,6 +186,7 @@ run, under the constraints it will meet in production".
 >   - **Claude Desktop, opened once** — stages the agent; nothing is bundled.
 >   - **A Claude token** — real per-run cost, runs take minutes; mint one with `claude setup-token` (needs the **`claude` CLI**: `npm i -g @anthropic-ai/claude-code`).
 >   - **A runtime** — **Docker (arm64)** for `container` / `hostloop`, or **Lima (Apple-VZ)** for `microvm`.
+>   - **Claude Code 2.1.197 or later** on the host, if a scenario uses the `semantic_matches` judge or the LLM decider, or you run `critique` — those calls run isolated and tool-less, and an older CLI is refused up front.
 >   - The `protocol` tier skips the runtime + the staged agent but still calls a real model, so it still needs the token. Run `cowork-harness doctor --tier <t>` to check exactly what a given tier needs.
 > - **Platform:** best on **macOS Apple Silicon**; **Windows is not supported** for the live tiers (use the token-free `replay`); `sync` and `microvm` are **macOS-arm64 only**. Full detail in [Prerequisites](./docs/cli.md#prerequisites-for-anything-above-protocol-fidelity) on the CLI page.
 

package/dist/cli.js

@@ -11,7 +11,7 @@ import { loadSession, resolveSessionPaths, applySessionOverrides, resolveLaunchS
 import { executeScenario, parseScenarioFile, loadSessionFromFile, firstLine, unresolvedModelPreflight, scenarioInputRefusal, UnansweredError, BoundaryError, UsageError, SessionFileError, LegacyRunDirError, effectiveTier, } from "./run/execute.js";
 import { unresolvedModelRefusal, envModelDefault } from "./run/model-provenance.js";
 import { ScriptedDecider, ExternalDecider, LlmDecider, ABSTAIN, coerceLabel, } from "./decide/decider.js";
-import { claudeCliComplete } from "./decide/llm-transport.js";
+import { claudeCliComplete, isolationRefusal } from "./decide/llm-transport.js";
 import { vmInit, vmDelete, vmStatus, vmPrune, instanceName, vmProvisioned } from "./runtime/lima.js";
 import { resolveVmBaselineArg } from "./runtime/vm-baseline-arg.js";
 import { sync, canonicalizeEnv, syncedNetworkBlock } from "./sync/cowork-sync.js";
@@ -3368,6 +3368,12 @@ async function cmdDecide(args) {
         fail("decide", "usage", "--decider-llm conflicts with --answer/--answer-policy (one terminal decider — the scripted rules would never be used).", undefined, json);
     if (policy)
         rules.push(...loadAnswerPolicy("decide", policy, json));
+    // The LLM decider calls the host `claude`; one that cannot run isolated is a usage refusal (exit 2), like the run's.
+    if (deciderLlm) {
+        const refusal = isolationRefusal();
+        if (refusal)
+            fail("decide", "usage", refusal, undefined, json);
+    }
     const opts = options.length ? options : ["Looks right", "Change it", "Correct or add data"];
     const req = { id: "check", kind: "question", questions: [{ question, options: opts.map((label) => ({ label })) }] };
     const ctx = { task: "", transcript: () => "(sample transcript context)", toolLog: () => [], runId: "decide-check" };

package/dist/critique/command.js

@@ -14,6 +14,7 @@
 // microvm/protocol stay refused (see ./limitations.ts for why each).
 // A cross-tier resume is blocked fail-loud by the session-manifest fidelity stamp (src/run/execute.ts),
 // and at hostloop a writable connected folder requires --allow-host-writes (forwarded to both turns).
+import { isolationRefusal } from "../decide/llm-transport.js";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { lookupSkillFlag } from "../run/skill-flag-surface.js";
@@ -151,7 +152,8 @@ COST AND PREREQUISITES — read before running:
     total; on a real document-analysis run the ratio INVERTS (measured: task turn ~61%, evaluator ~30%).
     Read the per-run split off the cost line / costUsd rather than assuming either — a cheaper
     --evaluator-model buys you at most the evaluator's share, and it voids the armor's
-    injection-resistance verification, which covers the DEFAULT evaluator only. When the task turn
+    injection-resistance verification, which covers the DEFAULT evaluator only (a probe not yet repeated
+    with the evaluator tool-less and isolated). When the task turn
     dominates, the levers are --model, --timeout and probe scope.
   * container needs Docker/Lima; hostloop needs Docker (the bash/web_fetch sidecar) PLUS the staged native
     agent binary, and writes to the real host FS (a writable --folder requires --allow-host-writes). Both
@@ -1786,6 +1788,11 @@ async function main(argv = process.argv.slice(2)) {
     const forwardsModel = opts.forwardBoth.some((a) => a === "--model" || a.startsWith("--model="));
     if (!forwardsModel && envModelDefault() === undefined)
         return refuse("usage", `critique: ${unresolvedModelRefusal("this critique's task and reflection turns")}`);
+    // The evaluator runs the host `claude` isolated and tool-less, which needs a CLI that accepts the isolation flags.
+    // Checked here, before the task and reflection turns spend, not at the evaluator's first call after them.
+    const iso = isolationRefusal();
+    if (iso)
+        return refuse("usage", `critique: ${iso}`);
     // Past this point a turn WILL run. parseArgs guarantees a probe on every non-corpus-only line; the
     // narrowing is for the type, not a second validation.
     const prompt = opts.prompt;

package/dist/critique/evaluator.js

@@ -3,7 +3,8 @@ import { extractAllJsonObjects } from "../decide/semantic-judge.js";
 import { validateCitations } from "./evidence.js";
 import { armorEvidence, headTag, evidenceOpen, evidenceClose } from "./armor.js";
 import { ROOT_REFERENCE_SECTION_PREFIX, AGENT_SECTION_PREFIX } from "./package-evidence.js";
-// The two-pass, tool-less evaluator. Reuses the shared `claude -p` transport (same reasoning as
+// The two-pass, tool-less evaluator (the transport passes `--tools ""` — see ISOLATION_ARGS in
+// src/decide/llm-transport.ts). Reuses the shared `claude -p` transport (same reasoning as
 // `semantic-judge.ts`: the harness process itself is not behind the egress proxy, so a direct API call
 // would bypass the very allowlist the harness enforces; `claude -p` is egress-consistent). Unlike the
 // judge, this evaluator's output isn't a fixed indexed rubric — it's an open-ended set of findings — so

package/dist/decide/llm-transport.js

@@ -1,12 +1,144 @@
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
 import { assertSpawnAllowed } from "../spawn-guard.js";
 import { warn, envPositiveNumber } from "../io.js";
 import { isUsageLimit } from "../usage-limit.js";
+/** Every `claude -p` the harness runs (the LLM judge, the LLM decider, the critique evaluator) runs ISOLATED from the
+ *  operator's own setup. The model reads untrusted agent output, so it must be able to call no tool (`--tools ""`;
+ *  without it, read-only tools always run and Write/Bash/Web run whenever the operator's settings allow them), and
+ *  nothing of the operator's environment may shape its answer: no CLAUDE.md, skills, plugins, hooks or MCP servers
+ *  (`--safe-mode`, `--strict-mcp-config`), no project or local settings from the harness's working directory
+ *  (`--setting-sources user` — user settings stay, so `apiKeyHelper` auth keeps working), and no transcript written
+ *  into the operator's session history (`--no-session-persistence`). Every flag exists in Claude Code 2.1.197 and
+ *  later; `assertIsolationSupported` refuses an older CLI before any model call.
+ *
+ *  `--tools` takes a variadic value, so it goes LAST: an empty value followed by more flags parses correctly on the
+ *  CLIs measured, but nothing after it can be swallowed if a future parser reads the variadic list greedily.
+ *
+ *  On a machine with an enterprise MCP config, `isolationArgs` leaves `--strict-mcp-config` out (see there). */
+export const ISOLATION_ARGS = [
+    "--safe-mode",
+    "--strict-mcp-config",
+    "--no-session-persistence",
+    "--setting-sources",
+    "user",
+    "--tools",
+    "",
+];
+/** The flags `ISOLATION_ARGS` needs the host CLI to accept, matched against its `--help`. */
+const ISOLATION_FLAGS = ["--safe-mode", "--strict-mcp-config", "--no-session-persistence", "--setting-sources", "--tools"];
+/** The oldest Claude Code version verified to accept every isolation flag. */
+export const ISOLATION_MIN_CLI = "2.1.197";
+/** True when `help` (a `claude --help` text) declares `flag` as an option: an option line starts with exactly two
+ *  spaces and the flag, then whitespace, `<`, `=` or the end. Anchored so the flag named inside another option's
+ *  wrapped description (`--strict-mcp-config` and `--tools` both appear there) does not count. An unrecognised help
+ *  format matches nothing, so the probe fails CLOSED. A plain line scan, so nothing in `flag` is read as a pattern. */
+export function helpDeclaresFlag(help, flag) {
+    const lead = `  ${flag}`;
+    return help.split("\n").some((line) => {
+        if (!line.startsWith(lead))
+            return false;
+        const next = line.charAt(lead.length);
+        return next === "" || next === "<" || next === "=" || /\s/.test(next);
+    });
+}
+/** Where Claude Code reads an enterprise MCP config (`managed-mcp.json` in its managed-settings directory). */
+export function defaultManagedMcpPath(platform = process.platform) {
+    if (platform === "darwin")
+        return "/Library/Application Support/ClaudeCode/managed-mcp.json";
+    if (platform === "win32")
+        return "C:\\Program Files\\ClaudeCode\\managed-mcp.json";
+    return "/etc/claude-code/managed-mcp.json";
+}
+const isolationChecked = new Map();
+let managedMcpPathOverride;
+/** Binaries whose Claude Code refused `--strict-mcp-config` for an enterprise MCP config at a path this harness does
+ *  not check: their calls leave the flag out from then on, as for one found at the managed-settings path. */
+const strictMcpRefused = new Set();
+/** The isolation flags for this machine. Claude Code refuses `--strict-mcp-config` outright while an enterprise MCP
+ *  config is present ("You cannot use --strict-mcp-config when an enterprise MCP config is present"), so there the
+ *  flag is left out. `--safe-mode` already keeps every MCP server out, the organisation's managed ones included: in
+ *  safe mode Claude Code's MCP loader returns no servers before it reads the enterprise or managed scope (verified in
+ *  the 2.1.197 and 2.1.286 binaries), and its safe-mode notice says managed MCP servers do not apply. A managed config
+ *  elsewhere (Claude Code can be pointed at another managed-settings path) is learnt from the CLI's own refusal; see
+ *  `claudeCliComplete`. */
+export function isolationArgs(bin, managedMcpPath = managedMcpPathOverride ?? defaultManagedMcpPath()) {
+    return existsSync(managedMcpPath) || strictMcpRefused.has(bin)
+        ? ISOLATION_ARGS.filter((a) => a !== "--strict-mcp-config")
+        : ISOLATION_ARGS;
+}
+/** Refuse a host `claude` that does not accept every isolation flag with a clear, actionable error before any model
+ *  call, instead of an unknown-option exit retried as if it were transient. One `--help` probe per binary per process
+ *  (no model call, no stdin). A probe that could not run (missing binary, timeout) is not cached. */
+export function assertIsolationSupported(bin) {
+    const cached = isolationChecked.get(bin);
+    if (cached !== undefined) {
+        if (cached !== true)
+            throw cached;
+        return;
+    }
+    const help = spawnSync(bin, ["--help"], { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8", timeout: 15_000 });
+    if (help.error) {
+        const code = help.error.code;
+        // Not a version problem, and not a verdict to remember: the probe itself did not complete.
+        if (code === "ETIMEDOUT")
+            throw new Error(`the host \`claude\` (${bin}) did not answer \`--help\` within 15s, so the harness cannot confirm it runs judge, decider and ` +
+                `critique-evaluator calls isolated — refusing rather than guessing. Retry, or check that ${bin} starts.`);
+        throw new Error(`LLM decider transport (${bin} -p) failed to spawn: ${help.error.message} — ensure 'claude' is installed and on PATH, or set COWORK_HARNESS_CLAUDE_BIN to its path`);
+    }
+    const text = `${help.stdout ?? ""}\n${help.stderr ?? ""}`;
+    // A `--help` that crashed or was killed and printed nothing says nothing about the version: refuse, uncached.
+    if ((help.status !== 0 || help.signal) && !text.trim())
+        throw new Error(`the host \`claude\` (${bin}) printed nothing for \`--help\` (${help.signal ? `killed by ${help.signal}` : `exit ${help.status}`}), so the ` +
+            `harness cannot confirm it runs judge, decider and critique-evaluator calls isolated — refusing rather than guessing. ` +
+            `Check that ${bin} --help works.`);
+    const missing = ISOLATION_FLAGS.filter((f) => !helpDeclaresFlag(text, f));
+    let verdict = true;
+    if (missing.length) {
+        const version = spawnSync(bin, ["--version"], { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8", timeout: 15_000 });
+        const v = (version.stdout ?? "").trim() || "unknown version";
+        verdict = new Error(`the host \`claude\` (${bin}, ${v}) does not accept ${missing.join(", ")} — ` +
+            `the harness runs every judge, decider and critique-evaluator call isolated from your own Claude Code setup, which ` +
+            `needs Claude Code ${ISOLATION_MIN_CLI} or later. To fix: upgrade the host \`claude\` (or point COWORK_HARNESS_CLAUDE_BIN at a newer one).`);
+    }
+    isolationChecked.set(bin, verdict);
+    if (verdict !== true)
+        throw verdict;
+}
+/** The pre-spend form of `assertIsolationSupported`: the refusal message for the configured host `claude`, or
+ *  undefined when it can run isolated. For commands that spend (an agent run, critique task turns) before their first
+ *  judge, decider or evaluator call — they refuse up front (exit 2) instead of after the spend. */
+export function isolationRefusal() {
+    // Under the spawn guard nothing may be launched — not even a `--help` probe; the later model call is refused by
+    // the guard itself, so there is nothing to pre-empt here.
+    try {
+        assertSpawnAllowed("the host `claude` isolation probe");
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        assertIsolationSupported(process.env.COWORK_HARNESS_CLAUDE_BIN || "claude");
+        return undefined;
+    }
+    catch (e) {
+        return e.message;
+    }
+}
+/** Test seam: forget every cached probe, and (optionally) point the enterprise-MCP check at another path so a
+ *  test controls whether the machine "has" a managed config. */
+export function resetIsolationPreflight(managedMcpPath) {
+    managedMcpPathOverride = managedMcpPath;
+    strictMcpRefused.clear();
+    isolationChecked.clear();
+}
 /** A spawn rejection the retry wrapper may re-attempt: a TRANSIENT non-zero exit. Timeout / maxBytes /
  *  spawn-ENOENT failures leave this false so they fail loud on the first attempt (see claudeCliComplete).
  *  A usage-limit exit also sets it false — retrying into a spent quota just burns the batch. */
 class TransportExit extends Error {
     retryable;
+    /** Claude Code refused `--strict-mcp-config` for an enterprise MCP config: retry without that flag. */
+    strictMcpRefused = false;
     constructor(message, retryable = true) {
         super(message);
         this.retryable = retryable;
@@ -89,6 +221,14 @@ function tryExtractResultText(raw) {
  * envelope itself doesn't parse (e.g. a failure that never reached the CLI's own JSON emitter).
  */
 function spawnOnce(bin, prompt, model, timeoutMs, maxBytes) {
+    // The backstop for every host-`claude` call, whichever caller reaches it: never spawn the model call on a CLI
+    // that would drop (or reject) an isolation flag. Cached per binary, so a retry or a batch probes once.
+    try {
+        assertIsolationSupported(bin);
+    }
+    catch (e) {
+        return Promise.reject(e);
+    }
     return new Promise((resolve, reject) => {
         // bound the `claude -p` spawn — a hung-but-alive child would otherwise block the harness forever.
         // On expiry SIGKILL the child and reject LOUD; clear the timer on close/error so a fast call never leaks it.
@@ -96,7 +236,8 @@ function spawnOnce(bin, prompt, model, timeoutMs, maxBytes) {
         // The prompt is delivered on STDIN, not argv: an argv prompt is world-readable via `ps` for the life of
         // the child (verified: `echo '...' | claude -p --output-format json` with no positional prompt reads
         // from stdin and returns the identical success envelope) — stdin is process-private.
-        const child = spawn(bin, ["-p", "--model", model, "--output-format", "json"], { stdio: ["pipe", "pipe", "pipe"] });
+        const args = isolationArgs(bin);
+        const child = spawn(bin, ["-p", "--model", model, "--output-format", "json", ...args], { stdio: ["pipe", "pipe", "pipe"] });
         // A child that exits/errors before consuming stdin (e.g. ENOENT, or a fake bin that exits immediately)
         // delivers EPIPE asynchronously as an `error` event on stdin — without a listener Node escalates it to
         // an uncaughtException. The child's own "error"/"close" handlers below already reject loud, so swallow
@@ -172,6 +313,14 @@ function spawnOnce(bin, prompt, model, timeoutMs, maxBytes) {
             const o = tail(resultText ?? raw);
             const e = tail(err);
             const diag = [o && `stdout: ${o}`, e && `stderr: ${e}`].filter(Boolean).join(" | ");
+            // An enterprise MCP config somewhere other than the managed-settings path `isolationArgs` checks: Claude Code
+            // refused --strict-mcp-config before any model call. `claudeCliComplete` retries once without the flag.
+            if (/cannot use --strict-mcp-config when an enterprise MCP config is present/i.test(`${raw}\n${err}`)) {
+                const refused = new TransportExit(`LLM decider transport (${bin} -p): Claude Code refused --strict-mcp-config because an enterprise MCP config is present`, false);
+                refused.strictMcpRefused = args.includes("--strict-mcp-config");
+                reject(refused);
+                return;
+            }
             // Usage/quota limit: don't retry into a spent quota — fail loud & fast so a batch halts.
             if (resultText && isUsageLimit(resultText, tryExtractApiErrorStatus(raw))) {
                 reject(new TransportExit(`LLM decider transport (${bin} -p): usage/quota limit hit — retry after the limit resets. ${diag}`, false));
@@ -187,8 +336,8 @@ function spawnOnce(bin, prompt, model, timeoutMs, maxBytes) {
  * (only the spawned agent child is), so a direct API call would bypass the very allowlist the harness
  * enforces. `claude -p` reuses the run's own auth path and is dogfood-consistent. Requests
  * `--output-format json` so the resolved model (`modelUsage`) can be recorded for provenance
- * even when `model` is a floating alias like `"sonnet"`. One short, tool-less
- * call per gate (one call, no recursion into the harness; model is the decider default or --decider-model).
+ * even when `model` is a floating alias like `"sonnet"`. One short, isolated, tool-less call per gate (see
+ * `ISOLATION_ARGS`) (one call, no recursion into the harness; model is the decider default or --decider-model).
  *
  * Non-zero-exit retry: a single `claude -p` spawn can exit non-zero on a TRANSIENT upstream hiccup
  * (rate-limit/overload/network) during a long back-to-back batch — observed live, not reproducible on demand.
@@ -199,8 +348,8 @@ function spawnOnce(bin, prompt, model, timeoutMs, maxBytes) {
  * captured stdout names the cause, so we accept it rather than brittle stdout pattern-matching.
  *
  * Retry never double-answers: this transport has NO harness side effects (it returns a string; the gate is
- * answered exactly once, downstream of a SUCCESSFUL call — a non-zero exit delivers no string), and `claude
- * -p` runs headless with no tool approval, so the model call itself is read-only in practice. Only the
+ * answered exactly once, downstream of a SUCCESSFUL call — a non-zero exit delivers no string), and the call runs
+ * with no tools at all (`--tools ""`, `ISOLATION_ARGS`), so a retried call cannot act twice. Only the
  * non-zero-exit class retries; timeout / maxBytes-overflow / spawn-ENOENT are not transient and fail loud on
  * the first attempt. Set `COWORK_HARNESS_LLM_RETRIES=0` to disable (e.g. deterministic CI).
  */
@@ -229,6 +378,14 @@ export const claudeCliComplete = async (prompt, model) => {
         catch (e) {
             const err = e;
             lastErr = err;
+            // Once per binary, and not counted against the retries: the refusal comes before any model call, and the flag
+            // only adds to what --safe-mode already keeps out (see `isolationArgs`).
+            if (err.strictMcpRefused && !strictMcpRefused.has(bin)) {
+                strictMcpRefused.add(bin);
+                warn(`${err.message} — running without --strict-mcp-config; --safe-mode keeps every MCP server out`);
+                attempt--;
+                continue;
+            }
             if (!err.retryable || attempt === retries)
                 throw err;
             warn(`${err.message} — retrying (attempt ${attempt + 2}/${retries + 1})`);

package/dist/run/execute.js

@@ -55,7 +55,7 @@ import { readTimeline } from "../agent/timeline.js";
 import { toolDurationFields, foldSkillActivity, attributeSubagentSkills } from "./timeline-fold.js";
 import { captureSubagentReasoning } from "./subagent-reasoning.js";
 import { buildDecider, Chain, ExternalDecider, LlmDecider, UnansweredError } from "../decide/decider.js";
-import { claudeCliComplete } from "../decide/llm-transport.js";
+import { claudeCliComplete, isolationRefusal } from "../decide/llm-transport.js";
 import { Run, infraErrorsForResult, evidenceErrorsForResult, unionReferenceAccesses } from "./run.js";
 import { runsWriteRoot } from "./trace-view.js";
 import { summarizeGateProvenance } from "./gate-provenance.js";
@@ -703,6 +703,17 @@ export async function executeScenario(scenario, opts = {}) {
     // and spawns the agent. The unit lane sets COWORK_HARNESS_FORBID_SPAWN so a scenario a refusal should
     // have caught fails red instead of launching a real agent.
     assertSpawnAllowed(`scenario "${scenario.name}"`);
+    // A run that will call the host `claude` after the agent (the semantic_matches judge, the LLM decider) refuses one
+    // that cannot run isolated HERE, before the agent spends anything: those calls run isolated and tool-less, which
+    // needs a CLI that accepts the isolation flags. An injected judge
+    // (a test or library caller) never reaches the host CLI.
+    // An external channel replaces the LLM decider as the terminal, so `on_unanswered: llm` then never calls it.
+    if ((scenario.assert.some((a) => a.semantic_matches !== undefined) && !opts.semanticJudge) ||
+        (onUnanswered === "llm" && !opts.externalChannel)) {
+        const iso = isolationRefusal();
+        if (iso)
+            throw new UsageError(iso);
+    }
     // Pre-flight: if the skill DECLARES required capabilities and the image provably omits one, FAIL FAST here
     // — before any paid agent run — instead of burning ~12 min to reach a verdict the post-run guard already
     // knows. The author can opt out with `allow_missing_capability: true` (the fallback is equivalent), which

package/docs/ci.md

@@ -144,7 +144,7 @@ jobs:
           model: claude-sonnet-5 # used only where a scenario's session sets no `model:`
 ```
 
-Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — the recipes above pin `^4` instead, because leaving it at `latest` takes a CLI major the moment it is promoted even though your `uses:` ref never changed; pin an exact version for byte-reproducible CI. The companion skill's `cowork-harness@^4.2.0` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN; INFO never gates unless `lint` gets `--min-severity INFO` via `extra-args`; a reviewed `lint-skill` finding you accept, such as a size cap, is suppressed with `extra-args: --ignore-rule <rule>[=<glob>]`, which keeps every other WARN gating — see [cli.md](./cli.md#flags-worth-knowing)), and `analyze-skill` (any **`error`**-severity finding — advisory findings are precisely the class that does NOT gate); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only), `model` (live lane only: exported as `COWORK_HARNESS_MODEL`, which fills in where a session sets no `model:` and no `--model` is passed; a `run` that resolves no model is refused with exit 2). Outputs: `ok` (`"true"`/`"false"`, mirrors the exit code), `envelope-path` (path to the raw JSON envelope, for post-processing), `summary-md` (the rendered verdict table, exposed as an output — not just written to `$GITHUB_STEP_SUMMARY` — because that file is scoped to this action's own invocation and a caller's later step gets a fresh, empty one). See [`action.yml`](https://github.com/yaniv-golan/cowork-harness/blob/main/action.yml) for the full input/output reference.
+Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — the recipes above pin `^4` instead, because leaving it at `latest` takes a CLI major the moment it is promoted even though your `uses:` ref never changed; pin an exact version for byte-reproducible CI. The companion skill's `cowork-harness@^4.2.1` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN; INFO never gates unless `lint` gets `--min-severity INFO` via `extra-args`; a reviewed `lint-skill` finding you accept, such as a size cap, is suppressed with `extra-args: --ignore-rule <rule>[=<glob>]`, which keeps every other WARN gating — see [cli.md](./cli.md#flags-worth-knowing)), and `analyze-skill` (any **`error`**-severity finding — advisory findings are precisely the class that does NOT gate); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only), `model` (live lane only: exported as `COWORK_HARNESS_MODEL`, which fills in where a session sets no `model:` and no `--model` is passed; a `run` that resolves no model is refused with exit 2). Outputs: `ok` (`"true"`/`"false"`, mirrors the exit code), `envelope-path` (path to the raw JSON envelope, for post-processing), `summary-md` (the rendered verdict table, exposed as an output — not just written to `$GITHUB_STEP_SUMMARY` — because that file is scoped to this action's own invocation and a caller's later step gets a fresh, empty one). See [`action.yml`](https://github.com/yaniv-golan/cowork-harness/blob/main/action.yml) for the full input/output reference.
 
 CI uses `ANTHROPIC_API_KEY` specifically because there's no interactive browser available to run
 `claude setup-token`'s OAuth flow in a GitHub Actions runner; locally, the OAuth token is preferred because

package/docs/cli.md

@@ -18,7 +18,7 @@ companion skill, CI). This page is the CLI one.
 **Install from npm:**
 
 ```bash
-npm install -g "cowork-harness@^4.2.0"    # puts the `cowork-harness` command on your PATH
+npm install -g "cowork-harness@^4.2.1"    # puts the `cowork-harness` command on your PATH
 ```
 
 **Or build from source:**
@@ -38,7 +38,7 @@ node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 
 > **Installed globally instead?** Once linked/installed, the same command is `cowork-harness replay
 > <cassette>` — but the relative path above only resolves from a source checkout's `examples/replays/`.
-> From a global install (`npm i -g "cowork-harness@^4.2.0"`), point at the package root instead:
+> From a global install (`npm i -g "cowork-harness@^4.2.1"`), point at the package root instead:
 > `cowork-harness replay "$(npm root -g)/cowork-harness/examples/replays/example-pdf-skill.cassette.json"`
 > (or copy the cassette into your own project and pass that path).
 
@@ -48,7 +48,7 @@ Live `run`/`skill` need the prerequisites in the next section — note the `prot
 > - **Replay only (zero setup):** `cowork-harness replay <cassette>` — no token, no Docker, no agent. The command above.
 > - **`protocol` (real model, no Docker):** needs only the auth token (item 3 below).
 > - **Live `container` / `microvm` / `hostloop` / `cowork`:** needs Docker (or Lima for `microvm`), a staged agent, and the token — run `cowork-harness doctor` first.
-> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@^4.2.0"`.
+> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@^4.2.1"`.
 
 Two more worked examples worth knowing about: `examples/scenarios/protocol-smoke.yaml` (zero-Docker smoke
 test) and `examples/scenarios/skill-loads.yaml` (container-tier acceptance check) — see
@@ -116,6 +116,7 @@ So **Linux live == `container` only**: `microvm` is Apple-VZ (macOS), and `hostl
    - **Which file supplied your credential:** loading is silent, with one exception. When `CLAUDE_CODE_OAUTH_TOKEN`, `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` comes from `<install>/.env` and you are running from another directory, stderr gets one line naming the variables and the file (never the values): `[env] using CLAUDE_CODE_OAUTH_TOKEN from ~/code/cowork-harness/.env (the install's .env, not this directory's)`. A run started with `node <clone>/dist/cli.js` from elsewhere is billed to that clone's credential; to use another, export it, put it in `./.env` or pass `--dotenv`. A `--dotenv` given after the subcommand is read later, so when it replaces that credential a second line names it: `[env] CLAUDE_CODE_OAUTH_TOKEN from ~/work/my.env (replacing the install's .env)`. `COWORK_HARNESS_DEBUG=1` lists every loaded key.
    - **Placement:** keep `.env` at a working-dir or install root, never inside a mounted skill/project folder.
    - **Global install:** find the package root with `` `$(npm root -g)/cowork-harness` `` (e.g. `$(npm root -g)/cowork-harness/.env`) — or simpler, just use `--dotenv <path>` / `./.env` in your working directory, which take priority over the package root anyway.
+4. **Claude Code 2.1.197 or later on the host, for the judge, the LLM decider and `critique`.** A `semantic_matches` assert, `on_unanswered: llm` / `--decider-llm` and `critique` call the host `claude`, isolated from your own setup (see `COWORK_HARNESS_CLAUDE_BIN` under [Advanced / internal escape hatches](#advanced--internal-escape-hatches)); an older CLI is refused before the run spends anything. Runs that use none of them do not need it.
 
 > `sync` (below) is **optional for a first run** — the repo ships `baselines/desktop-*.json`, so `baseline: latest` already resolves. Run `sync` only to refresh the platform baseline after Claude Desktop updates. (`sync` is **macOS-only** today; on Linux/Windows use the committed baselines — they work cross-platform.)
 
@@ -125,7 +126,7 @@ The parts people ask about. **`package.json`'s `files[]` is the exhaustive, mach
 this table is the readable summary of it, and deliberately omits the infrastructure that always ships
 (`baselines/`, `schema/`, `fixtures/`, `scripts/`, `docker/`).
 
-| What ships | npm global (`npm install -g "cowork-harness@^4.2.0"`) | Source checkout (`git clone` + `npm ci`) |
+| What ships | npm global (`npm install -g "cowork-harness@^4.2.1"`) | Source checkout (`git clone` + `npm ci`) |
 |---|---|---|
 | CLI, `scenario.py` + assertion keys (enough for `lint` in CI) | ✓ | ✓ |
 | `SKILL.md`, all of `docs/`, `SPEC.md`/`DESIGN.md`/`AGENTS.md` | ✓ | ✓ |
@@ -140,7 +141,7 @@ since a global install puts nothing in your working directory. The matrix, answe
 examples are the only ones that still need a source checkout. The **marketplace skill install** is
 narrower again — it pulls only `.claude/skills/cowork-harness/` (SKILL.md + `references/` +
 `scenario.py`/assertion keys, per `.claude-plugin/marketplace.json`'s `source`); everything in the npm column
-arrives when the skill's first command self-bootstraps `npx "cowork-harness@^4.2.0"` — the last row stays
+arrives when the skill's first command self-bootstraps `npx "cowork-harness@^4.2.1"` — the last row stays
 ✗ either way, since `matrices/`, `answer-policies/` and `probes/` are not published at all. See
 [docs/companion-skill.md](./companion-skill.md) for that install path.
 
@@ -677,7 +678,20 @@ Rarely needed.
 
 - `PYTHON` — overrides the interpreter for `lint` / scenario tooling (default `python3`).
 - `COWORK_HARNESS_DEBUG=1` — surfaces which `.env` files were loaded.
-- `COWORK_HARNESS_CLAUDE_BIN=<path>` — points the `--decider-llm` transport at a specific `claude` binary.
+- `COWORK_HARNESS_CLAUDE_BIN=<path>` — points the host `claude` calls at a specific binary. Every model call the
+  harness makes through it — the `semantic_matches` judge, the LLM decider and the `critique` evaluator — runs
+  **isolated from your own Claude Code setup**: no tools (`--tools ""`), no CLAUDE.md, skills, plugins, hooks or MCP
+  servers (`--safe-mode`, `--strict-mcp-config`), no project or local settings from the directory the harness runs
+  in (`--setting-sources user`), and no session saved (`--no-session-persistence`). Your user settings still apply
+  (their `env`, `apiKeyHelper` and model settings), as do managed and policy settings; auth configured only in a
+  project's `.claude/settings.json` is not read. On a machine with an enterprise MCP config — a
+  `managed-mcp.json` in Claude Code's managed-settings directory
+  (`/Library/Application Support/ClaudeCode/` on macOS, `/etc/claude-code/` on Linux, `C:\Program Files\ClaudeCode\`
+  on Windows) — the call leaves out `--strict-mcp-config`, which Claude Code refuses beside one; `--safe-mode` still
+  keeps every MCP server out, your organisation's managed ones included, while its managed hooks and policy
+  settings still apply. A managed config at another path makes Claude Code refuse `--strict-mcp-config`; the call is
+  then retried once without it, before any model call. This needs **Claude Code 2.1.197 or later** on
+  the host; an older one is refused before any model call, saying why and what to do.
 - `COWORK_HARNESS_ALLOW_AGENT_FALLBACK=1` — lets the harness use the newest sibling agent binary when the baseline-pinned version is missing (a fidelity compromise — off by default). A same-major.minor **patch** bump of the staged NATIVE binary is auto-accepted without this flag (the native binary carries no sha256 pin, so a patch drift is safe by default; it prints a loud stderr note naming the pinned and substituted versions). At `hostloop`, and at `cowork` **only when it resolves to host-loop** on the synced baseline, the staged **VM ELF** is auto-accepted on a patch bump too, because on that path it's a non-executed parity mount into the bash sidecar; a `cowork` baseline that resolves to VM-loop instead executes the ELF directly, so it keeps the strict sha-pinned exact-version match, same as `container`/`microvm`, which always keep it (the ELF is the executed agent there), so the flag remains required for any ELF drift on those tiers/paths, and for a major/minor gap everywhere.
 - `COWORK_MANAGED_CONFIG=1` — forces the managed-config path on `protocol`, and `=0` suppresses the token-derived managed branch there (leaving the `ANTHROPIC_API_KEY` CI path intact); any other value is rejected rather than silently picking a branch.
 - `COWORK_HARNESS_ALLOW_MISSING_PROMPT=1` — downgrades a missing prompt asset to a warning.

package/docs/companion-skill.md

@@ -28,7 +28,7 @@ claude plugin marketplace add yaniv-golan/cowork-harness
 claude plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@^4.2.0"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 22). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@^4.2.1"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 22). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://agentskills.io) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) via [`npx skills`](https://github.com/vercel-labs/skills) (Vercel Labs' CLI implementation of that spec):
 
@@ -43,7 +43,7 @@ npx skills add yaniv-golan/cowork-harness --skill cowork-harness
 short entrypoint (routing, the false-green invariants, short workflows); the detail it routes to lives in
 `references/`, which the agent reads on demand. Everything
 else (the CLI, `docs/`, the worked examples, the pytest lane) arrives when the skill's first command
-self-bootstraps `npx "cowork-harness@^4.2.0"`, which pulls the same npm package as a global install.
+self-bootstraps `npx "cowork-harness@^4.2.1"`, which pulls the same npm package as a global install.
 
 For the full package-contents table — what a global install gives you versus a source checkout — see
 [docs/cli.md → What ships](./cli.md#what-ships). It is maintained there, once.

package/docs/critique.md

@@ -283,7 +283,9 @@ It does **not** record their contents — see Known limitations.
   (gate on `costUsd.complete` — `false` means the total undercounts), then decide. Caveat: the armor's
   injection-resistance is verified for the
   shipped **default** evaluator model only — changing it voids that specific verification (matters when
-  critiquing skills you did not write).
+  critiquing skills you did not write). That verification was measured with an evaluator that had tools; it has not
+  been repeated with the tool-less evaluator, isolated from your own Claude Code setup (see
+  `COWORK_HARNESS_CLAUDE_BIN` in the CLI guide).
 - **Trending spend across critiques: use the run index, not the reports.** Each critique appends a
   roll-up row (`critiqueRole:"rollup"`) carrying `critiqueTotalUsd`; its `costUsd` is the evaluator
   passes only, so `sum(costUsd)` over every row is exactly true spend — the two graded turns already
@@ -576,7 +578,9 @@ planes; it cannot make a reader immune to persuasion. Treat critique output on a
 which is how you should treat it anyway.
 
 Resistance is also **per-model and perishable**: it is verified for the shipped default evaluator model.
-Changing the evaluator model invalidates that verification.
+Changing the evaluator model invalidates that verification. It was also measured before the evaluator ran
+tool-less and isolated from your own Claude Code setup; the isolation removes what an injection could reach (no
+tool can run), but the probe has not been repeated under it.
 
 This is the same "advisory, not an attestation" property named under [Known limitations](#known-limitations):
 a skill you did not write can steer the grade, so its output is a lead to run down — never proof.

package/examples/replays/README.md

@@ -16,7 +16,7 @@ DOES exercise a real gate exchange, see `example-multiselect-gate.cassette.json`
 
 Run it with:
 
-> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@^4.2.0"`. (`replay` itself needs nothing else — no token, no Docker.)
+> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@^4.2.1"`. (`replay` itself needs nothing else — no token, no Docker.)
 
 ```sh
 cowork-harness replay examples/replays/example-pdf-skill.cassette.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-harness",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "description": "Scriptable, CI-friendly harness for Claude Cowork's runtime contract for testing skills across scenarios \u2014 same agent, mounts, egress allowlist, permission protocol, and sandbox limitations.",
   "license": "MIT",
   "type": "module",