create-harness-vibe-coding 0.8.0 → 0.8.2

package/templates/common/scripts/wf-statusline.sh

@@ -1,48 +1,67 @@
-#!/bin/bash
-# wf-statusline.sh — Unix statusline badge for WF-MAX / WF-REVIEW
-# Reads Harness/.runtime/current-mode.json and outputs a colored badge.
-#
-# Usage in .claude/settings.json:
-#   "statusLine": { "type": "command", "command": "bash Harness/scripts/wf-statusline.sh" }
-#
-# Security: refuses symlinks, validates JSON, caps read size.
-
-MODE_FILE="$(dirname "$0")/../.runtime/current-mode.json"
-
-# Resolve relative path to absolute (from project root or script location)
-if [ ! -f "$MODE_FILE" ]; then
-  # Try relative to CWD (project root)
-  MODE_FILE="Harness/.runtime/current-mode.json"
-fi
-
-[ -L "$MODE_FILE" ] && exit 0   # Refuse symlinks
-[ ! -f "$MODE_FILE" ] && exit 0 # Missing file
-
-# Read with python for safe JSON parse (jq may not be installed).
-# Pass file path as argv to avoid shell injection via MODE_FILE content.
-MODE=$(python3 -c "
-import json, os, sys
-try:
-  fpath = sys.argv[1]
-  if os.path.getsize(fpath) > 4096: sys.exit(1)
-  with open(fpath, 'r') as f:
-    d = json.load(f)
-  if d.get('active') and d.get('role') == 'ceo':
-    print(d.get('mode','') + '|' + d.get('phase',''))
-except: pass
-" "$MODE_FILE" 2>/dev/null)
-
-[ -z "$MODE" ] && exit 0
-
-MODE_NAME="${MODE%%|*}"
-MODE_PHASE="${MODE##*|}"
-
-case "$MODE_NAME" in
-  wf-max)
-    PHASE_SHORT=$(echo "$MODE_PHASE" | sed 's/W._/W/')
-    printf '\033[38;5;75m[WF-MAX:%s]\033[0m' "$PHASE_SHORT"
-    ;;
-  wf-review)
-    printf '\033[38;5;178m[WF-REVIEW]\033[0m'
-    ;;
-esac
+#!/bin/bash
+# wf-statusline.sh — Unix statusline badge for WF-MAX / WF-REVIEW
+# Displays mode + agentRole from Harness/.runtime/current-mode.json
+# Role-aware: shows all roles (CEO/MGR/WRK/REV), not just CEO.
+#
+# Usage in .claude/settings.json:
+#   "statusLine": { "type": "command", "command": "bash Harness/scripts/wf-statusline.sh" }
+#
+# Security: refuses symlinks, validates JSON, caps read size.
+
+MODE_FILE="$(dirname "$0")/../.runtime/current-mode.json"
+
+# Resolve relative path to absolute (from project root or script location)
+if [ ! -f "$MODE_FILE" ]; then
+  MODE_FILE="Harness/.runtime/current-mode.json"
+fi
+
+[ -L "$MODE_FILE" ] && exit 0   # Refuse symlinks
+[ ! -f "$MODE_FILE" ] && exit 0 # Missing file
+
+# Read with python for safe JSON parse (jq may not be installed).
+MODE=$(python3 -c "
+import json, os, sys
+try:
+  fpath = sys.argv[1]
+  if os.path.getsize(fpath) > 16384: sys.exit(1)
+  with open(fpath, 'r') as f:
+    d = json.load(f)
+  if not d.get('active'): sys.exit(1)
+  agent_role = d.get('agentRole') or d.get('role') or ''
+  role_short = {'ceo':'CEO','manager':'MGR','worker':'WRK','reviewer':'REV'}.get(agent_role, '')
+  print(d.get('mode','') + '|' + d.get('phase','') + '|' + role_short)
+except: pass
+" "$MODE_FILE" 2>/dev/null)
+
+[ -z "$MODE" ] && exit 0
+
+MODE_NAME="${MODE%%|*}"
+REST="${MODE#*|}"
+MODE_PHASE="${REST%%|*}"
+MODE_ROLE="${REST##*|}"
+
+case "$MODE_NAME" in
+  wf-max)
+    PHASE_SHORT=$(echo "$MODE_PHASE" | sed 's/W._/W/')
+    if [ -n "$MODE_ROLE" ]; then
+      printf '\033[38;5;75m[WF-MAX:%s:%s]\033[0m' "$MODE_ROLE" "$PHASE_SHORT"
+    else
+      printf '\033[38;5;75m[WF-MAX:%s]\033[0m' "$PHASE_SHORT"
+    fi
+    ;;
+  wf-review)
+    printf '\033[38;5;178m[WF-REVIEW]\033[0m'
+    ;;
+  wf-auto-spark)
+    printf '\033[38;5;213m[SPARK]\033[0m'
+    ;;
+  wf-auto)
+    printf '\033[38;5;111m[WF-AUTO]\033[0m'
+    ;;
+  wf)
+    printf '\033[38;5;108m[WF]\033[0m'
+    ;;
+  wf-learn)
+    printf '\033[38;5;222m[WF-LEARN]\033[0m'
+    ;;
+esac

package/templates/common/scripts/wf-update-check.mjs

@@ -4,21 +4,22 @@
  * Fetches remote checksums, compares locally, classifies all files instantly.
  * Only CONFLICT files need AI/user decision.
  *
- * Usage:
- *   node Harness/scripts/wf-update-check.mjs          # full plan
- *   node Harness/scripts/wf-update-check.mjs --apply  # apply SAFE+MERGE+NEW, report CONFLICT
- *   node Harness/scripts/wf-update-check.mjs --json   # JSON output for AI consumption
- */
+ * Usage:
+ *   node Harness/scripts/wf-update-check.mjs              # full dry-run plan
+ *   node Harness/scripts/wf-update-check.mjs --json       # JSON output for AI consumption
+ *   node Harness/scripts/wf-update-check.mjs --apply-safe # apply SAFE+NEW, leave CONFLICT for AI
+ *   node Harness/scripts/wf-update-check.mjs --apply      # apply only when no CONFLICT exists
+ */
 
 import { readFileSync, writeFileSync, existsSync, mkdirSync, lstatSync } from 'fs';
 import { createHash } from 'crypto';
 import { resolve, dirname, sep } from 'path';
 import { fileURLToPath } from 'url';
 
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const ROOT = process.env.WF_ROOT ? resolve(process.env.WF_ROOT) : resolve(__dirname, '..', '..');
-const VERSION_FILE = resolve(ROOT, 'Harness', '.harness-version');
-const SOURCE_BASE = 'https://raw.githubusercontent.com/zingspark/create-harness-vibe-coding/main/templates/common/';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROOT = process.env.WF_ROOT ? resolve(process.env.WF_ROOT) : resolve(__dirname, '..', '..');
+const VERSION_FILE = resolve(ROOT, 'Harness', '.harness-version');
+const DEFAULT_SOURCE_BASE = 'https://raw.githubusercontent.com/zingspark/create-harness-vibe-coding/main/templates/common/';
 
 // ── Tier classification ──────────────────────────────────────────
 
@@ -60,14 +61,26 @@ function safePath(file) {
 }
 
 /** Canonical normalization for classification matching. */
-function canonicalPath(file) {
-  return file.replace(/\\/g, '/').replace(/\/+/g, '/');
-}
-
-/** Detect template placeholders in remote content. */
-function isTemplate(raw) {
-  return /\{\{[a-zA-Z]+\}\}/.test(raw);
-}
+function canonicalPath(file) {
+  return file.replace(/\\/g, '/').replace(/\/+/g, '/');
+}
+
+function readFlagValue(args, flagName) {
+  const idx = args.indexOf(flagName);
+  if (idx === -1) return null;
+  const value = args[idx + 1];
+  if (!value || value.startsWith('--')) return null;
+  return value;
+}
+
+function normalizeSourceBase(sourceBase) {
+  return sourceBase.endsWith('/') ? sourceBase : sourceBase + '/';
+}
+
+/** Detect template placeholders in remote content. */
+function isTemplate(raw) {
+  return /\{\{[a-zA-Z]+\}\}/.test(raw);
+}
 
 function sha256(content) {
   return 'sha256-' + createHash('sha256').update(content).digest('hex');
@@ -98,9 +111,13 @@ function classify(file, localHash, storedHash) {
   return 'CONFLICT'; // modified runtime file — unexpected
 }
 
-async function fetchRemote(url, timeoutMs = 30000) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
+async function fetchRemote(url, timeoutMs = 30000) {
+  if (url.startsWith('file://')) {
+    return readFileSync(fileURLToPath(url), 'utf-8');
+  }
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const res = await fetch(url, { signal: controller.signal });
     if (!res.ok) throw new Error(`HTTP ${res.status}: ${url}`);
@@ -112,11 +129,13 @@ async function fetchRemote(url, timeoutMs = 30000) {
 
 // ── Main ───────────────────────────────────────────────────────────
 
-async function main() {
-  const args = process.argv.slice(2);
-  const apply = args.includes('--apply');
-  const jsonOut = args.includes('--json');
-  const ignoreVersion = args.includes('--ignore-version') || args.includes('--force-check');
+async function main() {
+  const args = process.argv.slice(2);
+  const apply = args.includes('--apply');
+  const applySafe = args.includes('--apply-safe') || args.includes('--safe-only');
+  const jsonOut = args.includes('--json');
+  const ignoreVersion = args.includes('--ignore-version') || args.includes('--force-check');
+  const sourceBase = normalizeSourceBase(readFlagValue(args, '--source-base') || process.env.WF_SOURCE_BASE || DEFAULT_SOURCE_BASE);
 
   // 1. Read local state
   if (!existsSync(VERSION_FILE)) {
@@ -155,7 +174,7 @@ async function main() {
   // 2. Fetch remote version file
   let remoteVersion;
   try {
-    const raw = await fetchRemote(SOURCE_BASE + '.harness-version');
+    const raw = await fetchRemote(sourceBase + '.harness-version');
     if (isTemplate(raw)) {
       if (jsonOut) {
         console.log(JSON.stringify({ status: 'template-remote', message: 'Remote .harness-version has not been generated yet.' }));
@@ -188,15 +207,21 @@ async function main() {
     return 0;
   }
 
-  const localGen = localVersion.generator || '0.0.0';
-  const remoteGen = remoteVersion.generator || '0.0.0';
-
-  if (!ignoreVersion && cmpSemver(remoteGen, localGen) <= 0) {
-    if (jsonOut) {
-      console.log(JSON.stringify({ status: 'up-to-date', version: localGen, remote: remoteGen }));
-    } else if (cmpSemver(remoteGen, localGen) < 0) {
-      console.log(`⚠ Remote (v${remoteGen}) is OLDER than local (v${localGen}). Downgrade refused.`);
-    } else {
+  const localGen = localVersion.generator || '0.0.0';
+  const remoteGen = remoteVersion.generator || '0.0.0';
+  const versionCmp = cmpSemver(remoteGen, localGen);
+
+  if (!ignoreVersion && versionCmp <= 0) {
+    if (jsonOut) {
+      console.log(JSON.stringify({
+        status: versionCmp < 0 ? 'downgrade-refused' : 'up-to-date',
+        version: localGen,
+        remote: remoteGen,
+        sourceBase,
+      }));
+    } else if (versionCmp < 0) {
+      console.log(`⚠ Remote (v${remoteGen}) is OLDER than local (v${localGen}). Downgrade refused.`);
+    } else {
       console.log(`✅ Already up to date (v${localGen})`);
     }
     return;
@@ -210,11 +235,54 @@ async function main() {
   const remoteSources = remoteVersion.sources || {};
 
   /** Resolve the remote template-relative path for a dest-keyed file. Falls back to the key itself for back-compat. */
-  function remotePath(file) {
-    return remoteSources[file] || file;
-  }
-
-  const allFiles = new Set([...Object.keys(localChecksums), ...Object.keys(remoteChecksums)]);
+  function remotePath(file) {
+    return remoteSources[file] || file;
+  }
+
+  function withRemoteMeta(entry) {
+    if (!entry || !entry.file || !remoteChecksums[entry.file]) return entry;
+    const templateHint = remotePath(entry.file);
+    return {
+      ...entry,
+      templateHint,
+      remoteUrl: sourceBase + templateHint,
+    };
+  }
+
+  function withConflictActions(entry) {
+    return {
+      ...withRemoteMeta(entry),
+      choices: ['merge', 'keep-local', 'overwrite-from-template'],
+    };
+  }
+
+  function buildJsonPlan() {
+    return {
+      updated: plan.updated.map(withRemoteMeta),
+      created: plan.created.map(withRemoteMeta),
+      conflict: plan.conflict.map(withConflictActions),
+      skipped: plan.skipped.map(withRemoteMeta),
+    };
+  }
+
+  function buildAgentHints(jsonPlan) {
+    return {
+      mode: 'script-first-ai-conflicts',
+      dryRunJsonCommand: 'node Harness/scripts/wf-update-check.mjs --json',
+      safeApplyCommand: 'node Harness/scripts/wf-update-check.mjs --apply-safe',
+      strictApplyCommand: 'node Harness/scripts/wf-update-check.mjs --apply',
+      partialUpdate: localVersion.partialUpdate || null,
+      aiMergeRequired: jsonPlan.conflict,
+      aiMergeRequiredCount: jsonPlan.conflict.length,
+      conflictPolicy: 'Use the script for SAFE/NEW files. For each CONFLICT file, compare local content with templateHint/remoteUrl and choose merge, keep-local, or overwrite-from-template.',
+      postUpdateCommands: [
+        'node Harness/scripts/validate-harness.mjs --strict',
+        'node Harness/scripts/scan-clean.mjs',
+      ],
+    };
+  }
+
+  const allFiles = new Set([...Object.keys(localChecksums), ...Object.keys(remoteChecksums)]);
 
   const plan = { updated: [], created: [], conflict: [], skipped: [] };
 
@@ -255,11 +323,15 @@ async function main() {
 
     const tier = classify(canonical, localHash, storedHash);
 
-    if (tier === 'PRESERVE') {
-      plan.skipped.push({ file, reason: 'PRESERVE — user data' });
-    } else if (tier === 'SAFE') {
-      plan.updated.push({ file, remoteHash });
-    } else if (tier === 'CONFLICT') {
+    if (tier === 'PRESERVE') {
+      plan.skipped.push({ file, reason: 'PRESERVE — user data' });
+    } else if (tier === 'SAFE') {
+      if (localHash === remoteHash) {
+        plan.skipped.push({ file, reason: 'already current' });
+      } else {
+        plan.updated.push({ file, remoteHash });
+      }
+    } else if (tier === 'CONFLICT') {
       plan.conflict.push({
         file,
         localHash,
@@ -272,20 +344,24 @@ async function main() {
     }
   }
 
-  // 3. Output
-  if (jsonOut) {
-    console.log(JSON.stringify({
-      status: 'update-available',
-      from: localGen,
-      to: remoteGen,
-      updated: plan.updated.length,
-      created: plan.created.length,
-      conflict: plan.conflict.length,
-      skipped: plan.skipped.length,
-      plan,
-    }, null, 2));
-    return;
-  }
+  // 3. Output
+  if (jsonOut) {
+    const jsonPlan = buildJsonPlan();
+    console.log(JSON.stringify({
+      status: localVersion.partialUpdate ? 'partial-update' : 'update-available',
+      from: localGen,
+      to: remoteGen,
+      sourceBase,
+      partialUpdate: localVersion.partialUpdate || null,
+      updated: plan.updated.length,
+      created: plan.created.length,
+      conflict: plan.conflict.length,
+      skipped: plan.skipped.length,
+      plan: jsonPlan,
+      agent: buildAgentHints(jsonPlan),
+    }, null, 2));
+    return;
+  }
 
   console.log(`\n🔄 Update: v${localGen} → v${remoteGen}`);
   console.log(`   ${plan.updated.length} safe update, ${plan.created.length} new, ${plan.conflict.length} conflict, ${plan.skipped.length} skipped\n`);
@@ -296,10 +372,13 @@ async function main() {
     for (const c of plan.conflict) {
       console.log(`   📄 ${c.file}  [${c.reason}]`);
     }
-    console.log('');
-  }
-
-  // Show what will be auto-updated
+    if (plan.updated.length + plan.created.length > 0) {
+      console.log('   Tip: run --apply-safe to apply SAFE/NEW files first, then merge conflicts.');
+    }
+    console.log('');
+  }
+
+  // Show what will be auto-updated
   if (plan.updated.length + plan.created.length > 0) {
     console.log('✅ AUTO (safe to apply):');
     for (const u of plan.updated) console.log(`   ↑ ${u.file}`);
@@ -308,15 +387,18 @@ async function main() {
   }
 
   // 4. Apply if requested
-  if (apply) {
+  if (apply || applySafe) {
     // Refuse to apply when conflicts exist — must resolve first
-    if (plan.conflict.length > 0) {
+    if (apply && !applySafe && plan.conflict.length > 0) {
       console.log(`❌ Cannot apply: ${plan.conflict.length} conflicts must be resolved first.`);
-      console.log('   Resolve conflicts manually, then re-run --apply.');
-      return plan;
-    }
-
-    const lexists = existsSync;
+      console.log('   Run --apply-safe to apply SAFE/NEW files first, or resolve conflicts manually then re-run --apply.');
+      return plan;
+    }
+    if (applySafe && plan.conflict.length > 0) {
+      console.log(`Applying SAFE/NEW files only; ${plan.conflict.length} conflicts will remain for AI/user merge.`);
+    }
+
+    const lexists = existsSync;
     let applied = 0;
     let failed = 0;
 
@@ -328,7 +410,7 @@ async function main() {
         if (lexists(dest)) {
           try { if (lstatSync(dest).isSymbolicLink()) { console.error(`   ✗ Symlink rejected: ${u.file}`); failed++; continue; } } catch (_) {}
         }
-        const content = await fetchRemote(SOURCE_BASE + remotePath(u.file));
+        const content = await fetchRemote(sourceBase + remotePath(u.file));
         const normalized = content.replace(/\r\n/g, '\n');
         const fetchedHash = sha256(normalized);
         if (fetchedHash !== u.remoteHash) {
@@ -354,7 +436,7 @@ async function main() {
           console.error(`   ✗ File created since plan: ${c.file} — treating as CONFLICT`);
           failed++; continue;
         }
-        const content = await fetchRemote(SOURCE_BASE + remotePath(c.file));
+        const content = await fetchRemote(sourceBase + remotePath(c.file));
         const normalized = content.replace(/\r\n/g, '\n');
         const fetchedHash = sha256(normalized);
         if (fetchedHash !== c.remoteHash) {
@@ -370,15 +452,31 @@ async function main() {
       }
     }
 
-    // Only update version on complete success
-    if (failed === 0) {
-      localVersion.generator = remoteGen;
-      localVersion.generated = new Date().toISOString();
-      for (const u of plan.updated) localVersion.checksums[u.file] = u.remoteHash;
-      for (const c of plan.created) localVersion.checksums[c.file] = c.remoteHash;
-      writeFileSync(VERSION_FILE, JSON.stringify(localVersion, null, 2) + '\n', 'utf-8');
-      console.log(`✅ Applied ${applied} files. Version updated to ${remoteVersion.generator}.`);
-    } else {
+    // Only version-track applied files after complete script success.
+    if (failed === 0) {
+      const appliedAt = new Date().toISOString();
+      localVersion.checksums = localVersion.checksums || {};
+      for (const u of plan.updated) localVersion.checksums[u.file] = u.remoteHash;
+      for (const c of plan.created) localVersion.checksums[c.file] = c.remoteHash;
+      if (plan.conflict.length === 0) {
+        localVersion.generator = remoteGen;
+        localVersion.generated = appliedAt;
+        delete localVersion.partialUpdate;
+      } else {
+        localVersion.partialUpdate = {
+          targetGenerator: remoteGen,
+          updatedAt: appliedAt,
+          appliedFiles: [...plan.updated, ...plan.created].map(x => x.file),
+          conflicts: plan.conflict.map(x => x.file),
+        };
+      }
+      writeFileSync(VERSION_FILE, JSON.stringify(localVersion, null, 2) + '\n', 'utf-8');
+      if (plan.conflict.length === 0) {
+        console.log(`✅ Applied ${applied} files. Version updated to ${remoteVersion.generator}.`);
+      } else {
+        console.log(`✅ Applied ${applied} SAFE/NEW files. Version remains ${localGen}; ${plan.conflict.length} conflicts still need merge.`);
+      }
+    } else {
       console.log(`❌ ${failed} failures. NO files were version-tracked. Fix and re-run.`);
     }
   }

package/templates/optional/catalog.json

@@ -46,15 +46,15 @@
       "title": "Superpowers",
       "description": "Community skill registry for agent workflows and reusable coding skills.",
       "installMode": "recommend-only",
-      "installHint": "run skill discovery first, then install only the selected Superpowers skills after user approval",
+      "url": "https://github.com/obra/Superpowers",
       "tags": ["skills", "community", "subagents"]
     },
     {
       "id": "caveman",
       "title": "Caveman",
-      "description": "External workflow/style capability to evaluate for strict, low-abstraction implementation behavior.",
+      "description": "External terse-agent capability to evaluate for low-token behavior and memory compression.",
       "installMode": "recommend-only",
-      "installHint": "search the configured skill/plugin sources for Caveman and install only after checking provenance",
+      "url": "https://github.com/JuliusBrussee/caveman",
       "tags": ["workflow", "implementation", "style"]
     },
     {
@@ -62,7 +62,7 @@
       "title": "Agent Research",
       "description": "External research-agent capability for broader product, dependency, and ecosystem investigation.",
       "installMode": "recommend-only",
-      "installHint": "use available skill/plugin discovery for agent research and record the chosen source in Harness/MEMORY.md",
+      "url": "https://github.com/lingzhi227/agent-research-skills",
       "tags": ["research", "agents", "discovery"]
     },
     {
@@ -70,7 +70,7 @@
       "title": "Code Graph",
       "description": "External code graph or repository map capability for dependency and architecture exploration.",
       "installMode": "recommend-only",
-      "installHint": "use available code graph tooling only after confirming it supports the project language and privacy constraints",
+      "url": "https://github.com/colbymchenry/codegraph",
       "tags": ["code graph", "architecture", "analysis"]
     }
   ]