create-harness-vibe-coding 0.8.18 → 0.8.19

package/src/wf-ui-server/ws-terminal.mjs

@@ -0,0 +1,473 @@
+import crypto from 'node:crypto';
+import { validateToken } from './token.mjs';
+
+const KEEPALIVE_INTERVAL = 15000;
+const PING_TIMEOUT = 5000;
+const TICK_MS = Math.min(KEEPALIVE_INTERVAL, PING_TIMEOUT) / 2;
+const WS_GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
+
+// ── PTY process registry ──
+// Maps sessionId to ptyProcess for writing input, resizing, or killing.
+/** @type {Map<string, object>} */
+const ptyRegistry = new Map();
+
+/**
+ * Register a PTY process for a session so ws-terminal can write/resize/kill it.
+ * @param {string} sessionId
+ * @param {object} ptyProcess
+ */
+export function registerPtyProcess(sessionId, ptyProcess) {
+  ptyRegistry.set(sessionId, ptyProcess);
+}
+
+/**
+ * Unregister a PTY process when the session ends.
+ * @param {string} sessionId
+ */
+export function unregisterPtyProcess(sessionId) {
+  ptyRegistry.delete(sessionId);
+}
+
+export function writePtyInput(sessionId, data) {
+  const ptyProcess = ptyRegistry.get(sessionId);
+  if (!ptyProcess || typeof ptyProcess.write !== 'function') return false;
+  ptyProcess.write(data || '');
+  return true;
+}
+
+export function killPtyProcess(sessionId) {
+  const ptyProcess = ptyRegistry.get(sessionId);
+  if (!ptyProcess || typeof ptyProcess.kill !== 'function') return false;
+  ptyProcess.kill();
+  unregisterPtyProcess(sessionId);
+  return true;
+}
+
+// ── Frame helpers ──
+
+/**
+ * Write an unmasked text frame (opcode 0x1) to a socket.
+ * @param {import('net').Socket} socket
+ * @param {string} text
+ * @param {number} [opcode=0x1]
+ */
+function sendFrame(socket, text, opcode = 0x1) {
+  const data = Buffer.from(text, 'utf8');
+  const len = data.length;
+  let frame;
+  if (len < 126) {
+    frame = Buffer.alloc(2 + len);
+    frame[0] = 0x80 | opcode;
+    frame[1] = len;
+    data.copy(frame, 2);
+  } else if (len < 65536) {
+    frame = Buffer.alloc(4 + len);
+    frame[0] = 0x80 | opcode;
+    frame[1] = 126;
+    frame.writeUInt16BE(len, 2);
+    data.copy(frame, 4);
+  } else {
+    frame = Buffer.alloc(10 + len);
+    frame[0] = 0x80 | opcode;
+    frame[1] = 127;
+    frame.writeBigUInt64BE(BigInt(len), 2);
+    data.copy(frame, 10);
+  }
+  socket.write(frame);
+}
+
+/**
+ * Send a close frame with the given status code.
+ * @param {import('net').Socket} socket
+ * @param {number} [code=1000]
+ */
+function sendCloseFrame(socket, code = 1000) {
+  const payload = Buffer.alloc(2);
+  payload.writeUInt16BE(code, 0);
+  const header = Buffer.alloc(2);
+  header[0] = 0x88;
+  header[1] = 2;
+  socket.write(Buffer.concat([header, payload]));
+}
+
+/**
+ * Parse incoming WebSocket frames from a buffer of raw bytes.
+ * Handles masked client frames by unmasking the payload.
+ * @param {Buffer} buffer
+ * @returns {{ frames: Array<{ opcode: number, payload: Buffer }>, remainder: Buffer }}
+ */
+function parseFrames(buffer) {
+  const frames = [];
+  let offset = 0;
+  while (offset + 2 <= buffer.length) {
+    const b1 = buffer[offset];
+    const opcode = b1 & 0x0F;
+    const b2 = buffer[offset + 1];
+    const masked = (b2 & 0x80) !== 0;
+    let payloadLen = b2 & 0x7F;
+    let headerLen = 2;
+    if (payloadLen === 126) {
+      if (offset + 4 > buffer.length) break;
+      payloadLen = buffer.readUInt16BE(offset + 2);
+      headerLen = 4;
+    } else if (payloadLen === 127) {
+      if (offset + 10 > buffer.length) break;
+      payloadLen = Number(buffer.readBigUInt64BE(offset + 2));
+      headerLen = 10;
+    }
+    const maskLen = masked ? 4 : 0;
+    if (offset + headerLen + maskLen + payloadLen > buffer.length) break;
+    offset += headerLen;
+    let payload;
+    if (masked) {
+      const mask = buffer.slice(offset, offset + 4);
+      offset += 4;
+      payload = Buffer.allocUnsafe(payloadLen);
+      for (let i = 0; i < payloadLen; i++) {
+        payload[i] = buffer[offset + i] ^ mask[i % 4];
+      }
+    } else {
+      payload = buffer.slice(offset, offset + payloadLen);
+    }
+    offset += payloadLen;
+    frames.push({ opcode, payload });
+  }
+  return { frames, remainder: buffer.slice(offset) };
+}
+
+/**
+ * Send a short HTTP error JSON response, then close the socket.
+ * @param {import('net').Socket} sock
+ * @param {number} statusCode
+ * @param {string} message
+ */
+function sendHttpError(sock, statusCode, message) {
+  let code;
+  if (statusCode === 401) code = 'UNAUTHORIZED';
+  else if (statusCode === 404) code = 'NOT_FOUND';
+  else code = 'ERROR';
+  const body = JSON.stringify({ error: { code, message } });
+  const reason = statusCode === 401 ? 'Unauthorized' : statusCode === 404 ? 'Not Found' : 'Error';
+  sock.write(
+    `HTTP/1.1 ${statusCode} ${reason}\r\n` +
+    'Content-Type: application/json\r\n' +
+    `Content-Length: ${body.length}\r\n` +
+    'Connection: close\r\n\r\n' + body
+  );
+  sock.end();
+}
+
+// ── Public API ──
+
+/**
+ * Attach a WebSocket /ws/terminal/:sessionId endpoint to an existing http.Server.
+ *
+ * On upgrade: validates `?token=` query param, validates sessionId exists in
+ * registry, performs WS upgrade, sends `session:state` handshake, and
+ * broadcasts PTY data to all WS clients for that session.
+ *
+ * Default mode is watch (read-only). pty:input is rejected unless
+ * session.attachMode === true.
+ *
+ * @param {import('http').Server} httpServer
+ * @param {string} expectedToken - The token clients must present.
+ * @param {import('./session-registry.mjs').SessionRegistry} sessionRegistry
+ * @param {{ keepaliveInterval?: number, pingTimeout?: number }} [options]
+ * @returns {{ close: () => Promise<void>, broadcastToSession: (sessionId: string, msg: object) => void }}
+ */
+export function attachTerminalWs(httpServer, expectedToken, sessionRegistry, options = {}) {
+  const keepaliveInterval = options.keepaliveInterval || KEEPALIVE_INTERVAL;
+  const pingTimeoutMs = options.pingTimeout || PING_TIMEOUT;
+  const tickMs = Math.min(keepaliveInterval, pingTimeoutMs) / 2;
+
+  /**
+   * Map<sessionId, Set<{ socket, connectionId, lastActivity, waitingPong, pingSentAt }>>
+   */
+  const sessionClients = new Map();
+  let keepaliveTimer = null;
+
+  // ── wire upgrade handler ──
+  httpServer.on('upgrade', (req, socket, head) => {
+    const url = new URL(req.url, `http://${req.headers.host || '127.0.0.1'}`);
+
+    // Match /ws/terminal/:sessionId
+    const match = url.pathname.match(/^\/ws\/terminal\/([^/]+)$/);
+    if (!match) {
+      // Not a terminal path — let another handler process it
+      return;
+    }
+
+    const sessionId = match[1];
+
+    if (!validateToken(url.searchParams.get('token'), expectedToken)) {
+      sendHttpError(socket, 401, 'Invalid or missing token');
+      return;
+    }
+
+    // Validate session exists
+    const session = sessionRegistry.get(sessionId);
+    if (!session) {
+      sendHttpError(socket, 404, `Session "${sessionId}" not found`);
+      return;
+    }
+
+    // WS upgrade handshake
+    const key = req.headers['sec-websocket-key'];
+    const digest = crypto.createHash('sha1').update(key + WS_GUID).digest('base64');
+    socket.write(
+      'HTTP/1.1 101 Switching Protocols\r\n' +
+      'Upgrade: websocket\r\n' +
+      'Connection: Upgrade\r\n' +
+      'Sec-WebSocket-Accept: ' + digest + '\r\n\r\n'
+    );
+
+    const connectionId = crypto.randomBytes(16).toString('hex');
+    const client = {
+      socket,
+      connectionId,
+      lastActivity: Date.now(),
+      waitingPong: false,
+      pingSentAt: 0,
+    };
+
+    // Add to session's client set
+    if (!sessionClients.has(sessionId)) {
+      sessionClients.set(sessionId, new Set());
+    }
+    sessionClients.get(sessionId).add(client);
+
+    // Increment wsClientCount
+    sessionRegistry.update(sessionId, { wsClientCount: (session.wsClientCount || 0) + 1 });
+
+    // Send session:state handshake
+    sendFrame(socket, JSON.stringify({
+      type: 'session:state',
+      sessionId,
+      state: session.status || 'starting',
+    }));
+
+    // Read incoming WS frames
+    let buffer = Buffer.alloc(0);
+    if (head && head.length > 0) buffer = Buffer.concat([buffer, head]);
+
+    socket.on('data', (chunk) => {
+      buffer = Buffer.concat([buffer, chunk]);
+      client.lastActivity = Date.now();
+
+      const result = parseFrames(buffer);
+      buffer = result.remainder;
+      for (const frame of result.frames) {
+        if (frame.opcode === 0x9) {
+          // Ping from client — respond with pong
+          sendFrame(socket, '', 0xA);
+        } else if (frame.opcode === 0xA) {
+          // Pong received
+          client.waitingPong = false;
+        } else if (frame.opcode === 0x8) {
+          // Close frame — echo back
+          sendCloseFrame(socket, 1000);
+          cleanupClient(sessionId, client);
+          socket.end();
+          return;
+        } else if (frame.opcode === 0x1) {
+          // Text frame — parse as JSON
+          try {
+            const msg = JSON.parse(frame.payload.toString('utf8'));
+            handleMessage(sessionId, msg, socket);
+          } catch {
+            // Ignore malformed JSON
+          }
+        }
+      }
+    });
+
+    socket.on('close', () => {
+      cleanupClient(sessionId, client);
+    });
+
+    socket.on('end', () => {
+      cleanupClient(sessionId, client);
+    });
+
+    socket.on('error', () => {
+      cleanupClient(sessionId, client);
+    });
+  });
+
+  /**
+   * Handle a parsed message frame for a session.
+   * @param {string} sessionId
+   * @param {object} msg
+   * @param {import('net').Socket} socket
+   */
+  function handleMessage(sessionId, msg, socket) {
+    const session = sessionRegistry.get(sessionId);
+    if (!session) return;
+
+    switch (msg.type) {
+      case 'pty:resize': {
+        const cols = typeof msg.cols === 'number' ? msg.cols : session.cols;
+        const rows = typeof msg.rows === 'number' ? msg.rows : session.rows;
+        if (cols === session.cols && rows === session.rows) break;
+        sessionRegistry.update(sessionId, { cols, rows });
+
+        // If a real PTY process exists, resize it
+        const ptyProcess = ptyRegistry.get(sessionId);
+        if (ptyProcess && typeof ptyProcess.resize === 'function') {
+          ptyProcess.resize(cols, rows);
+        }
+        break;
+      }
+
+      case 'pty:input': {
+        if (!session.attachMode) {
+          sendFrame(socket, JSON.stringify({
+            type: 'session:error',
+            sessionId,
+            message: 'Input rejected: session is in watch mode. Enable attach mode to send input.',
+          }));
+          return;
+        }
+
+        const ptyProcess = ptyRegistry.get(sessionId);
+        if (ptyProcess && typeof ptyProcess.write === 'function') {
+          // Write input to the real PTY process
+          ptyProcess.write(msg.data || '');
+          if (typeof options.onTerminalInput === 'function') {
+            options.onTerminalInput(session, msg.data || '');
+          }
+          sendFrame(socket, JSON.stringify({
+            type: 'pty:input-accepted',
+            sessionId,
+          }));
+        } else {
+          // No PTY attached — inform the client
+          sendFrame(socket, JSON.stringify({
+            type: 'session:error',
+            sessionId,
+            message: 'No PTY process attached to this session. Cannot send input.',
+          }));
+        }
+        break;
+      }
+
+      case 'control:attach-mode': {
+        const attachMode = Boolean(msg.attachMode);
+        sessionRegistry.update(sessionId, { attachMode });
+        if (typeof options.onAttachModeChange === 'function') {
+          options.onAttachModeChange(sessionRegistry.get(sessionId), attachMode);
+        }
+        sendFrame(socket, JSON.stringify({
+          type: 'session:state',
+          sessionId,
+          state: session.status || 'running',
+          attachMode,
+        }));
+        break;
+      }
+
+      case 'control:stop': {
+        killPtyProcess(sessionId);
+
+        sendFrame(socket, JSON.stringify({
+          type: 'session:state',
+          sessionId,
+          state: 'exited',
+        }));
+        sessionRegistry.update(sessionId, { status: 'exited' });
+        if (typeof options.onSessionState === 'function') {
+          options.onSessionState(sessionRegistry.get(sessionId), 'exited');
+        }
+        break;
+      }
+
+      default:
+        // Unknown frame type — ignore
+        break;
+    }
+  }
+
+  /**
+   * Remove a client from a session's client set and decrement wsClientCount.
+   * @param {string} sessionId
+   * @param {object} client
+   */
+  function cleanupClient(sessionId, client) {
+    // Guard against double-cleanup when both 'error' and 'close' fire
+    if (client._cleanedUp) return;
+    client._cleanedUp = true;
+
+    const clients = sessionClients.get(sessionId);
+    if (clients) {
+      clients.delete(client);
+      if (clients.size === 0) {
+        sessionClients.delete(sessionId);
+      }
+    }
+
+    const session = sessionRegistry.get(sessionId);
+    if (session) {
+      const count = Math.max(0, (session.wsClientCount || 1) - 1);
+      sessionRegistry.update(sessionId, { wsClientCount: count });
+    }
+  }
+
+  /**
+   * Broadcast a message to all WS clients for a specific session.
+   * @param {string} sessionId
+   * @param {object} msg - Plain object to JSON-serialize and send.
+   */
+  function broadcastToSession(sessionId, msg) {
+    const clients = sessionClients.get(sessionId);
+    if (!clients || clients.size === 0) return;
+
+    const payload = JSON.stringify(msg);
+    for (const c of clients) {
+      try {
+        sendFrame(c.socket, payload);
+      } catch {
+        /* ignore disconnected */
+      }
+    }
+  }
+
+  // ── keepalive timer ──
+  keepaliveTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [, clients] of sessionClients) {
+      for (const c of [...clients]) {
+        try {
+          if (c.waitingPong) {
+            if (now - c.pingSentAt >= pingTimeoutMs) {
+              sendCloseFrame(c.socket, 1001);
+              c.socket.end();
+              clients.delete(c);
+            }
+          } else if (now - c.lastActivity >= keepaliveInterval) {
+            sendFrame(c.socket, '', 0x9);
+            c.waitingPong = true;
+            c.pingSentAt = now;
+          }
+        } catch {
+          clients.delete(c);
+        }
+      }
+    }
+  }, Math.max(tickMs, 100));
+
+  // ── close ──
+  function close() {
+    return new Promise((resolve) => {
+      if (keepaliveTimer) clearInterval(keepaliveTimer);
+      for (const [, clients] of sessionClients) {
+        for (const c of [...clients]) {
+          try { sendCloseFrame(c.socket, 1001); c.socket.end(); } catch { /* ignore */ }
+        }
+      }
+      sessionClients.clear();
+      resolve();
+    });
+  }
+
+  return { close, broadcastToSession };
+}

package/templates/common/.claude/commands/wf-help.md

@@ -23,6 +23,7 @@ which returns this same table without loading `Harness/MEMORY.md` or entering WF
 | `/wf-task-list` | direct command | `/wf-task-list` | List all task capsules with status, phase, and dependencies. |
 | `/wf-task-archive [--apply]` | direct command | `/wf-task-archive --apply` | Archive completed task capsules (dry-run by default). |
 | `/wf-command-create <wf-command-id>` | direct command | `/wf-command-create wf-report --direct` | Create or modify wf-* command surfaces atomically from the command registry. |
+| `/wf-ui` | direct command | `/wf-ui` | Start the local Harness backend and browser control panel. |
 
 Source of truth: `Harness/README.md#Skill Commands` plus installed skills under
 `.claude/skills/` (Claude Code and OpenCode adapters) or `.agents/skills/`

package/templates/common/.claude/commands/wf-task-list.md

@@ -21,4 +21,6 @@ Run: `node Harness/scripts/task-state.mjs list --json`
 ## Return
 
 - JSON output of all task capsules with status, phase, dependencies, and archive eligibility.
+- Includes a `graph` section: roots, dependency edges, block edges, and orphaned dependency warnings.
+- Human-readable mode renders the graph with ASCII arrows: `from ──▶ to` (depends) and `from ▸▸ to` (blocks).
 - If the command fails, report the error and do not retry.

package/templates/common/.claude/commands/wf-ui.md

@@ -0,0 +1,26 @@
+---
+description: Open the Harness browser control panel for task capsules, workflow graphs, agent peers, settings, and terminal observability
+---
+
+# /wf-ui
+
+Start the Harness browser control panel directly. This is a direct command.
+Do not invoke a skill, do not start WF mode, and do not dispatch agents.
+
+Run from the project root:
+
+```bash
+create-harness-vibe-coding wf-ui --project . --host 127.0.0.1 --port 0 --open
+```
+
+If the global binary is not available, use the package fallback:
+
+```bash
+npx create-harness-vibe-coding@0.8.19 wf-ui --project . --host 127.0.0.1 --port 0 --open
+```
+
+Rules:
+- Bind only to `127.0.0.1`.
+- Use port `0` unless the user asks for a fixed port.
+- Leave the server running until the user stops it.
+- Return the local URL printed by the command.

package/templates/common/.claude/commands/wf-update.md

@@ -22,7 +22,23 @@ targeted inspection.
 
 ## Flow
 
-1. Run `node Harness/scripts/wf-update-check.mjs --json` first and use the
+Scope resolution is deterministic:
+
+- Current project has `Harness/scripts/wf-update-check.mjs`: update the project
+  install from that script.
+- A global runtime is discoverable from `Harness/.harness-version.globalDir`,
+  `HARNESS_GLOBAL_HOME`, or the default `~/.harness/create-harness-vibe-coding`:
+  update that runtime too, then sync its Claude/Codex/OpenCode host-global
+  copies.
+- Current project has no Harness install: update only the global runtime and
+  host-global copies. Do not scaffold or modify the project unless the user
+  explicitly asks to install Harness there.
+`Harness/scripts/wf-update-runner.mjs` implements this multi-scope routing.
+Older installs that do not have the runner fall back to
+`Harness/scripts/wf-update-check.mjs`.
+
+1. Run `node Harness/scripts/wf-update-runner.mjs --json` first when present;
+   otherwise run `node Harness/scripts/wf-update-check.mjs --json`. Use the
    `agent` block as the action plan. Preserve `agent.releaseHighlights` for the
    user-facing update summary. Current updaters try npm
    `create-harness-vibe-coding@latest` first, then the canonical GitHub source
@@ -33,9 +49,11 @@ targeted inspection.
    starter files may be created, and checksum-matching legacy architecture can
    move to `Harness/project/architecture.md`. Harness/README.md is merge-tier,
    not PRESERVE.
-3. If `agent.safeApplyCommand` is present, run it to apply SAFE, NEW, and
-   adopted metadata-only files before spending AI time on conflicts. Default
-   command: `node Harness/scripts/wf-update-check.mjs --apply-safe`.
+3. If `agent.safeApplyCommand` is present, run the runner apply path to apply
+   SAFE, NEW, and adopted metadata-only files across every discovered scope
+   before spending AI time on conflicts. Default multi-scope command:
+   `node Harness/scripts/wf-update-runner.mjs --apply-safe --json`. Single-scope
+   fallback command: `node Harness/scripts/wf-update-check.mjs --apply-safe`.
    Framework-owned templates, commands, skills, agents, and scripts are
    script-owned and should be overwritten by the updater after checksum
    validation.
@@ -53,11 +71,38 @@ targeted inspection.
    `--accept-local <file>`, `--accept-merged <file>`, or
    `--accept-template <file>`; do not hand-edit `Harness/.harness-version`.
    Ask the user only when the intent is ambiguous.
-7. Run `node Harness/scripts/wf-update-check.mjs --finalize` after all
-   conflicts have script-recorded decisions. Use strict `--apply` only when the
-   JSON plan has zero conflicts.
-8. After update, run `node Harness/scripts/validate-harness.mjs` and then
-   `node Harness/scripts/scan-clean.mjs`.
+7. Run `node Harness/scripts/wf-update-runner.mjs --finalize --json` after all
+   conflicts have script-recorded decisions. Single-scope fallback:
+   `node Harness/scripts/wf-update-check.mjs --finalize`. Use strict `--apply` only when
+   the JSON plan has zero conflicts.
+8. After update, sync and validate all machine surfaces:
+   ```
+   node Harness/scripts/sync-host-global.mjs --json
+   node Harness/scripts/sync-host-global.mjs --apply --json
+   node Harness/scripts/validate-harness.mjs
+   node Harness/scripts/validate-harness.mjs --manifest-audit
+   node Harness/scripts/scan-clean.mjs --json
+   ```
+   `sync-host-global.mjs` is a no-op for project-only installs. For global
+   installs it compares host-global files against the runtime sources listed in
+   `.harness-version.hostGlobal.targets`; missing or Harness-marked stale copies
+   are repaired by script, while user-looking files stay conflicts.
+9. If the update reports "Already up to date" but files are missing (e.g.,
+   new commands not showing up on a platform), run:
+   ```
+   node Harness/scripts/wf-update-runner.mjs --repair --json
+   node Harness/scripts/wf-update-runner.mjs --repair --apply-safe --json
+   node Harness/scripts/wf-update-runner.mjs --repair --finalize --json
+   node Harness/scripts/wf-update-check.mjs --repair --json
+   node Harness/scripts/wf-update-check.mjs --repair --apply-safe
+   node Harness/scripts/wf-update-check.mjs --repair --finalize
+   node Harness/scripts/sync-host-global.mjs --apply --json
+   node Harness/scripts/validate-harness.mjs --manifest-audit
+   ```
+   `--repair` bypasses the version check and forces a full file diff against
+   the latest remote template. This catches files that were missed during a
+   previous partial update where the version was bumped but not all files
+   were written.
 
 Codex users without a direct command surface: use `$wf-update` (skill path) or
 `node Harness/scripts/wf-update-check.mjs`.

package/templates/common/.claude/rules/ecc/common.md

@@ -8,7 +8,7 @@ alwaysApply: true
 ## Context
 
 - Start with `CLAUDE.md`. When `Harness/` exists, also read `Harness/memory/startup-hints.md` (L2 lightweight digest, not full router).
-- When the user explicitly invokes a workflow command (`/wf-*`, `$wf-*`, or `/skills wf-*`), excluding `/wf-help`, `$wf-help`, `/skills wf-help`, `/wf-update`, `$wf-update`, `/skills wf-update`, `/wf-task-record`, `$wf-task-record`, `/skills wf-task-record`, `/wf-task-list`, `$wf-task-list`, `/skills wf-task-list`, `/wf-task-archive`, `$wf-task-archive`, `/skills wf-task-archive`, `/wf-command-create`, `$wf-command-create`, and `/skills wf-command-create`, load `Harness/MEMORY.md` and `Harness/README.md`.
+- When the user explicitly invokes a workflow command (`/wf-*`, `$wf-*`, or `/skills wf-*`), excluding `/wf-help`, `$wf-help`, `/skills wf-help`, `/wf-update`, `$wf-update`, `/skills wf-update`, `/wf-task-record`, `$wf-task-record`, `/skills wf-task-record`, `/wf-task-list`, `$wf-task-list`, `/skills wf-task-list`, `/wf-task-archive`, `$wf-task-archive`, `/skills wf-task-archive`, `/wf-command-create`, `$wf-command-create`, `/skills wf-command-create`, `/wf-ui`, `$wf-ui`, and `/skills wf-ui`, load `Harness/MEMORY.md` and `Harness/README.md`.
 - For simple single-step tasks without `/wf-*`, operate in direct mode: skip the Harness router and execute directly.
 - Do not bulk-read `Harness/`. Load by router trigger.
 - Keep `Harness/tasks/<task-id>/PROGRESS.md` and `Harness/tasks/<task-id>/PLAN.md` current when work has multiple steps, files, or agents.

package/templates/common/.claude/skills/wf-auto/SKILL.md

@@ -48,7 +48,7 @@ that auto scanning costs more than it helps.
    obligations are covered, two different confirmation strategies are empty,
    and unresolved uncertainty is recorded.
 2. CEO never edits production source. CEO may write only
-   `Harness/tasks/auto/PLAN.md` and `Harness/tasks/auto/PROGRESS.md`.
+   `Harness/tasks/continuous/PLAN.md` and `Harness/tasks/continuous/PROGRESS.md`.
 3. Build a project profile each W0 cycle and dispatch only the selected probes;
    invoke oracle and spark searchers when evidence justifies them.
 4. One accepted finding per cycle: <=3 files and <=50 changed lines. Larger
@@ -61,8 +61,8 @@ that auto scanning costs more than it helps.
    below 3.
 8. Intent Checkpoint is adaptive: 2 -> 5 -> 10 cycles, exactly two questions.
 9. Record compact evidence per cycle; do not paste full logs or transcripts.
-10. A bounded test tick still creates or updates `Harness/tasks/auto/PLAN.md`
-    and `Harness/tasks/auto/PROGRESS.md`; missing auto capsule evidence is a
+10. A bounded test tick still creates or updates `Harness/tasks/continuous/PLAN.md`
+    and `Harness/tasks/continuous/PROGRESS.md`; missing auto capsule evidence is a
     failed cycle record.
 
 ## Loop

package/templates/common/.claude/skills/wf-auto-spark/SKILL.md

@@ -44,5 +44,5 @@ replaying search transcripts.
 6. Value reflection is required every cycle: source, why it matters, deviation,
    evidence, and milestone progress.
 
-Active roadmap: `Harness/tasks/auto/SPARK-ROADMAP.md`.
-Per-cycle evidence: `Harness/tasks/auto/PROGRESS.md`.
+Active roadmap: `Harness/tasks/continuous/SPARK-ROADMAP.md`.
+Per-cycle evidence: `Harness/tasks/continuous/PROGRESS.md`.