harnery 0.35.0 → 0.36.0

package/dist/commands/backup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA4EnD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA6N/E"}
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA4EnD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAiO/E"}

package/dist/commands/backup.js

@@ -86,8 +86,8 @@ export function registerBackupCommand(program, emit) {
     backup
         .command("init")
         .description("Create the restic repository + password file (one-time).")
-        .option("--repo <path>", `Repository path (default: ${defaultRepo()})`)
-        .option("--password-file <path>", `Password file (default: ${defaultPasswordFile()}, autogenerated)`)
+        .option("--repo <path>", "Repository path (default: configured backup.repo)")
+        .option("--password-file <path>", "Password file (default: configured backup.password_file; autogenerated)")
         .action((opts) => {
         if (!checkRestic(emit)) {
             emit.setExitCode(1);
@@ -219,13 +219,12 @@ export function registerBackupCommand(program, emit) {
     // -- prune --
     // Prune-policy defaults come from backup.keep_* in config.jsonc (falling back
     // to 7/4/6); an explicit --keep-* flag still overrides per invocation.
-    const prunePolicy = backupConfig();
     backup
         .command("prune")
-        .description(`Forget + prune snapshots (default policy: keep ${prunePolicy.keepDaily} daily / ${prunePolicy.keepWeekly} weekly / ${prunePolicy.keepMonthly} monthly).`)
-        .option("--keep-daily <n>", "Daily snapshots to keep", String(prunePolicy.keepDaily))
-        .option("--keep-weekly <n>", "Weekly snapshots to keep", String(prunePolicy.keepWeekly))
-        .option("--keep-monthly <n>", "Monthly snapshots to keep", String(prunePolicy.keepMonthly))
+        .description("Forget + prune snapshots (default policy comes from backup.keep_* config).")
+        .option("--keep-daily <n>", "Daily snapshots to keep (default: configured backup.keep_daily)")
+        .option("--keep-weekly <n>", "Weekly snapshots to keep (default: configured backup.keep_weekly)")
+        .option("--keep-monthly <n>", "Monthly snapshots to keep (default: configured backup.keep_monthly)")
         .option("--dry-run", "Show what would be pruned without actually pruning")
         .option("--repo <path>", "Repository path")
         .option("--password-file <path>", "Password file")
@@ -234,14 +233,15 @@ export function registerBackupCommand(program, emit) {
             emit.setExitCode(1);
             return;
         }
+        const prunePolicy = backupConfig();
         const args = [
             "forget",
             "--keep-daily",
-            opts.keepDaily,
+            opts.keepDaily ?? String(prunePolicy.keepDaily),
             "--keep-weekly",
-            opts.keepWeekly,
+            opts.keepWeekly ?? String(prunePolicy.keepWeekly),
             "--keep-monthly",
-            opts.keepMonthly,
+            opts.keepMonthly ?? String(prunePolicy.keepMonthly),
         ];
         if (!opts.dryRun)
             args.push("--prune");

package/dist/commands/browse-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browse-session.d.ts","sourceRoot":"","sources":["../../src/commands/browse-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAOtE,UAAU,eAAe;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,WAAY,SAAQ,eAAe;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA4GtF;AAYD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,GAAG,qBAAqB,CAAC;AAC9F,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,KAAK,GACd,qBAAqB,GAAG,SAAS,CAAC;AAoDrC,wBAAsB,aAAa,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBpE"}
+{"version":3,"file":"browse-session.d.ts","sourceRoot":"","sources":["../../src/commands/browse-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAOtE,UAAU,eAAe;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,WAAY,SAAQ,eAAe;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAwHtF;AAYD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,GAAG,qBAAqB,CAAC;AAC9F,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,KAAK,GACd,qBAAqB,GAAG,SAAS,CAAC;AAoDrC,wBAAsB,aAAa,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBpE"}

package/dist/commands/browse-session.js

@@ -5,6 +5,7 @@ export function registerBrowseSessionCommand(program, emit) {
         .description("Control an opted-in headed browse session through an owner-only descriptor");
     session
         .command("status")
+        .description("Report whether the opted-in browser session is reachable")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")
         .action((opts) => runAction(emit, opts.controlFile, "status", {}));
     addLocatorOptions(session
@@ -16,37 +17,45 @@ export function registerBrowseSessionCommand(program, emit) {
     });
     session
         .command("screenshot")
+        .description("Capture the active tab to a new PNG file")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")
         .requiredOption("--out <path>", "New PNG path in an existing directory")
         .action((opts) => runAction(emit, opts.controlFile, "screenshot", { out: opts.out }));
     session
         .command("tabs")
+        .description("List open tabs with stable session-local indexes")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")
         .action((opts) => runAction(emit, opts.controlFile, "tabs", {}));
     session
         .command("select-tab")
+        .description("Select an open tab by its stable session-local index")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")
         .requiredOption("--index <n>", "Stable session-local tab index", parseIndex)
         .action((opts) => runAction(emit, opts.controlFile, "select_tab", { index: opts.index }));
     session
         .command("open-tab <url>")
+        .description("Open a URL in a new tab and select it")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")
         .action((url, opts) => runAction(emit, opts.controlFile, "open_tab", { url }));
     session
         .command("close-tab")
+        .description("Close an open tab by its stable session-local index")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")
         .requiredOption("--index <n>", "Stable session-local tab index", parseIndex)
         .action((opts) => runAction(emit, opts.controlFile, "close_tab", { index: opts.index }));
     session
         .command("goto <url>")
+        .description("Navigate the active tab to a URL")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")
         .action((url, opts) => runAction(emit, opts.controlFile, "goto", { url }));
     session
         .command("reload")
+        .description("Reload the active tab")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")
         .action((opts) => runAction(emit, opts.controlFile, "reload", {}));
     addLocatorOptions(session
         .command("click")
+        .description("Click one strict locator in the active tab")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")).action((opts) => runAction(emit, opts.controlFile, "click", { locator: parseLocatorOptions(opts, true) }));
     addLocatorOptions(session
         .command("fill")
@@ -60,13 +69,16 @@ export function registerBrowseSessionCommand(program, emit) {
     });
     session
         .command("press <key>")
+        .description("Press a keyboard key in the active tab")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")
         .action((key, opts) => runAction(emit, opts.controlFile, "press", { key }));
     addLocatorOptions(session
         .command("wait")
+        .description("Wait for one strict locator in the active tab")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")).action((opts) => runAction(emit, opts.controlFile, "wait", { locator: parseLocatorOptions(opts, true) }));
     session
         .command("close")
+        .description("Close the opted-in browser session")
         .requiredOption("--control-file <path>", "Owner-only session descriptor")
         .action((opts) => runAction(emit, opts.controlFile, "close", {}));
 }

package/dist/commands/browse.d.ts

@@ -1,4 +1,4 @@
 import type { Command } from "commander";
 import type { EmitContext, HarneryProgramContext } from "../commander.js";
-export declare function registerBrowseCommand(program: Command, emitParam: EmitContext, context?: HarneryProgramContext): void;
+export declare function registerBrowseCommand(program: Command, emitParam: EmitContext, context?: HarneryProgramContext, binName?: string): void;
 //# sourceMappingURL=browse.d.ts.map

package/dist/commands/browse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browse.d.ts","sourceRoot":"","sources":["../../src/commands/browse.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAgO1E,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CA+cN"}
+{"version":3,"file":"browse.d.ts","sourceRoot":"","sources":["../../src/commands/browse.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAgO1E,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,OAAO,CAAC,EAAE,qBAAqB,EAC/B,OAAO,SAAmB,GACzB,IAAI,CA+cN"}

package/dist/commands/browse.js

@@ -41,7 +41,7 @@ const VIEWPORT_PRESETS = {
 // cookies/read: the many helper functions in this large file close over
 // `emit` so action callbacks stay concise.
 let emit;
-export function registerBrowseCommand(program, emitParam, context) {
+export function registerBrowseCommand(program, emitParam, context, binName = resolveBinName()) {
     emit = emitParam;
     program
         .command("browse <url>")
@@ -50,7 +50,7 @@ export function registerBrowseCommand(program, emitParam, context) {
         .option("--no-screenshot", "Skip the .png in the trio (DOM + JSON only)")
         .option("--no-full-page", "Capture only the viewport, not the full scrollable page")
         .option("--snapshot", "Print body innerText to stdout (skips file writes)")
-        .option("--html", `Print raw outer HTML to stdout (skips file writes; pair with \`${resolveBinName()} read -\`)`)
+        .option("--html", `Print raw outer HTML to stdout (skips file writes; pair with \`${binName} read -\`)`)
         .option("--json", "Print full JSON envelope to stdout (skips file writes)")
         .option("--selector <css>", "Scope --html / --snapshot to one element")
         .option("--click <selector>", "Click this selector after navigation")
@@ -440,8 +440,9 @@ async function runBrowse(url, opts, context) {
         let critiqueTiles;
         let critiqueFullPage;
         if (opts.checkCritique !== undefined) {
+            const critiqueProvider = context?.critiqueProvider ?? (await context?.critiqueProviderLoader?.());
             const rubric = opts.checkCritiqueRubric ?? DEFAULT_CRITIQUE_RUBRIC;
-            const captured = await captureCritiqueTiles(browser, opts, context?.critiqueProvider?.tileBudgetPx);
+            const captured = await captureCritiqueTiles(browser, opts, critiqueProvider?.tileBudgetPx);
             critiqueTiles = captured.tiles;
             critiqueFullPage = captured.fullPage;
             let tilesToReview = captured.tiles;
@@ -485,7 +486,7 @@ async function runBrowse(url, opts, context) {
                 url: navResult.url,
                 rubric,
                 tiles: tilesToReview,
-                provider: context?.critiqueProvider,
+                provider: critiqueProvider,
             });
         }
         // Persist the QA baseline AFTER critique so a passing run's verdicts ride

package/dist/commands/conversations.d.ts

@@ -0,0 +1,10 @@
+import type { Command } from "commander";
+import type { EmitContext } from "../commander.js";
+import type { HarneryConversationCatalog } from "../core/conversations/catalog.js";
+import type { HarneryConversationRecordV1 } from "../core/conversations/contract.js";
+export interface RegisterConversationsOptions {
+    project_scope_id: string;
+    records?: () => readonly HarneryConversationRecordV1[];
+}
+export declare function registerConversationsCommand(program: Command, emit: EmitContext, catalog?: HarneryConversationCatalog, dependencies?: RegisterConversationsOptions): void;
+//# sourceMappingURL=conversations.d.ts.map

package/dist/commands/conversations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversations.d.ts","sourceRoot":"","sources":["../../src/commands/conversations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAEnF,OAAO,KAAK,EAEV,2BAA2B,EAE5B,MAAM,mCAAmC,CAAC;AAQ3C,MAAM,WAAW,4BAA4B;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,SAAS,2BAA2B,EAAE,CAAC;CACxD;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,0BAA0B,EACpC,YAAY,CAAC,EAAE,4BAA4B,GAC1C,IAAI,CAkJN"}

package/dist/commands/conversations.js

@@ -0,0 +1,201 @@
+import { buildConversationContextPack } from "../core/conversations/context-pack.js";
+import { planConversationPurge, validatePurgeExecutionRequest, } from "../core/conversations/lifecycle.js";
+import { queryConversationCatalog } from "../core/conversations/query.js";
+export function registerConversationsCommand(program, emit, catalog, dependencies) {
+    const pendingPlans = new Map();
+    const conversations = program.command("conversations").description("Query conversation evidence");
+    conversations
+        .command("list")
+        .option("--provider <id>")
+        .option("--project <id>")
+        .option("--json")
+        .action(async (options) => {
+        await run(emit, async () => {
+            const configured = requireConversations(catalog, dependencies);
+            const project = exactProject(configured.dependencies.project_scope_id, options.project);
+            const providers = options.provider
+                ? [configured.catalog.require(options.provider)]
+                : configured.catalog.list();
+            const rows = (await Promise.all(providers.map(async (provider) => provider.capabilities.can_list ? provider.list(project) : []))).flat();
+            if (options.json) {
+                emit.config({ format: "json" });
+                emit.data({ schema: "harnery.conversation-list/v1", project_scope_id: project, rows });
+            }
+            else
+                emit.rows(rows);
+        });
+    });
+    addQueryOptions(conversations.command("query"))
+        .option("--json")
+        .action(async (options) => {
+        await run(emit, async () => {
+            const configured = requireConversations(catalog, dependencies);
+            const result = await queryConversationCatalog(configured.catalog, request(configured.dependencies, options));
+            if (options.json) {
+                emit.config({ format: "json" });
+                emit.data(result);
+            }
+            else {
+                emit.rows(result.hits.map(({ record, citation }) => ({
+                    ...citation,
+                    content: record.content,
+                })));
+            }
+        });
+    });
+    addQueryOptions(conversations.command("context"))
+        .option("--max-tokens <count>", "Token ceiling", parsePositive, 2_000)
+        .option("--max-bytes <count>", "Byte ceiling", parsePositive, 16_000)
+        .option("--json")
+        .action(async (options) => {
+        await run(emit, async () => {
+            const configured = requireConversations(catalog, dependencies);
+            const result = await queryConversationCatalog(configured.catalog, request(configured.dependencies, options));
+            const pack = buildConversationContextPack(result, {
+                max_tokens: options.maxTokens,
+                max_bytes: options.maxBytes,
+            });
+            if (options.json)
+                emit.config({ format: "json" });
+            emit.data(pack);
+        });
+    });
+    conversations
+        .command("archive")
+        .requiredOption("--mode <mode>", "off | source | archive")
+        .option("--authority <mode>", "shadow | cutover | rollback", "shadow")
+        .option("--yes", "Reserved for a future checked capture transaction")
+        .action((options) => {
+        const validMode = ["off", "source", "archive"].includes(options.mode);
+        const validAuthority = ["shadow", "cutover", "rollback"].includes(options.authority);
+        if (!validMode || !validAuthority) {
+            emit.error({ code: "conversation_archive_mode_invalid", message: "invalid archive mode" });
+            emit.setExitCode(1);
+            return;
+        }
+        emit.data({
+            schema: "harnery.conversation-archive-plan/v1",
+            access_mode: options.mode,
+            authority_mode: options.authority,
+            dry_run: true,
+            writes: false,
+            execution_enabled: false,
+        });
+    });
+    conversations
+        .command("purge")
+        .option("--conversation <id>")
+        .option("--before <time>")
+        .option("--transaction <id>")
+        .option("--yes")
+        .option("--json")
+        .action((options) => {
+        try {
+            const configured = requireConversations(catalog, dependencies);
+            if (options.transaction) {
+                const plan = pendingPlans.get(options.transaction);
+                if (!plan)
+                    throw new Error(`unknown purge transaction: ${options.transaction}`);
+                const result = validatePurgeExecutionRequest(plan, options.transaction, options.yes ?? false);
+                if (options.json)
+                    emit.config({ format: "json" });
+                emit.data({ schema: "harnery.conversation-purge-result/v1", ...result });
+                if (result.reason_code !== "execution_disabled")
+                    emit.setExitCode(1);
+                return;
+            }
+            const plan = planConversationPurge({
+                records: configured.dependencies.records?.() ?? [],
+                project_scope_id: configured.dependencies.project_scope_id,
+                ...(options.conversation ? { conversation_id: options.conversation } : {}),
+                ...(options.before ? { before: options.before } : {}),
+            });
+            pendingPlans.set(plan.transaction_id, plan);
+            if (options.json)
+                emit.config({ format: "json" });
+            emit.data(plan);
+        }
+        catch (error) {
+            emit.error({
+                code: "conversation_purge_failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            emit.setExitCode(1);
+        }
+    });
+}
+function requireConversations(catalog, dependencies) {
+    if (!catalog || !dependencies)
+        throw new Error("conversation providers are not configured by this host");
+    return { catalog, dependencies };
+}
+function addQueryOptions(command) {
+    return command
+        .option("--text <literal>")
+        .option("--regex <pattern>")
+        .option("--role <role>")
+        .option("--since <time>")
+        .option("--until <time>")
+        .option("--project <id>")
+        .option("--provider <id>")
+        .option("--session <id>")
+        .option("--conversation <id>")
+        .option("--record <id>")
+        .option("--limit <count>", "Match ceiling", parsePositive, 20)
+        .option("--context-before <count>", "Earlier neighbors", parseNonnegative, 0)
+        .option("--context-after <count>", "Later neighbors", parseNonnegative, 0);
+}
+function request(dependencies, options) {
+    const role = options.role;
+    return {
+        project_scope_id: exactProject(dependencies.project_scope_id, options.project),
+        limit: options.limit,
+        context_before: options.contextBefore,
+        context_after: options.contextAfter,
+        budgets: {
+            max_source_records: 10_000,
+            max_decoded_bytes: 16 * 1_024 * 1_024,
+            max_matches: options.limit,
+            max_wall_ms: 5_000,
+            max_regex_chars: 256,
+        },
+        ...(options.text ? { text: options.text } : {}),
+        ...(options.regex ? { regex: options.regex } : {}),
+        ...(role ? { role } : {}),
+        ...(options.since ? { since: options.since } : {}),
+        ...(options.until ? { until: options.until } : {}),
+        ...(options.provider ? { provider_id: options.provider } : {}),
+        ...(options.session ? { session_id: options.session } : {}),
+        ...(options.conversation ? { conversation_id: options.conversation } : {}),
+        ...(options.record ? { record_id: options.record } : {}),
+    };
+}
+function exactProject(expected, requested) {
+    if (requested && requested !== expected)
+        throw new Error("cross-project conversation access denied");
+    return expected;
+}
+function parsePositive(value) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed <= 0)
+        throw new Error("expected a positive integer");
+    return parsed;
+}
+function parseNonnegative(value) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 0)
+        throw new Error("expected a nonnegative integer");
+    return parsed;
+}
+async function run(emit, action) {
+    try {
+        await action();
+    }
+    catch (error) {
+        emit.error({
+            code: "conversation_command_failed",
+            message: error instanceof Error ? error.message : String(error),
+        });
+        emit.setExitCode(1);
+    }
+}

package/dist/commands/deinit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deinit.d.ts","sourceRoot":"","sources":["../../src/commands/deinit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAenD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAmHjG;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE;IACtC,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAEV;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C"}
+{"version":3,"file":"deinit.d.ts","sourceRoot":"","sources":["../../src/commands/deinit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAgBnD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAwHjG;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE;IACtC,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAEV;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C"}

package/dist/commands/deinit.js

@@ -31,6 +31,7 @@ import { relative, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { DEFAULT_BIN_NAME } from "../core/config.js";
 import { ADAPTER_SPECS } from "../core/hooks/adapter/events.js";
+import { removeIndexerExclusions } from "../lib/indexer-exclusions.js";
 import { removeInstructions } from "../lib/instructions/apply.js";
 import { removeGitHooks } from "../lib/instructions/git-hooks.js";
 import { unwireHooks } from "./init.js";
@@ -115,6 +116,10 @@ export function registerDeinitCommand(program, emit, binName) {
                     `(${remaining} other hook(s) kept)`);
             }
         }
+        // ── 1a′. editor indexer exclusions ─────────────────────────────────────
+        // Reverse only what init wrote: the managed .cursorindexingignore entry
+        // and the files.watcherExclude key. Consumer-authored entries stay.
+        actions.push(...removeIndexerExclusions(projectRoot, dryRun));
         // ── 1b. agent-facing instructions block + skills ───────────────────────
         const removed = removeInstructions(projectRoot, { adapter, dryRun });
         actions.push(...removed.actions, ...removed.warnings.map((w) => `! ${w}`));

package/dist/commands/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/commands/docs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAmC1E,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CAkON"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/commands/docs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAmC1E,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CA2ON"}

package/dist/commands/docs.js

@@ -70,10 +70,14 @@ export function registerDocsCommand(program, emitParam, context) {
         .command("validate")
         .description("Validate every managed Markdown file against harnery-doc/v2")
         .option("--repo <name>", "Limit to one submodule or '.' for parent")
+        .option("--cached", "Read paths and contents from the Git index")
         .action(async (opts) => {
         try {
             ensureContext(context);
-            const rows = await runDocsMetadataAudit(opts);
+            const rows = await runDocsMetadataAudit({
+                repo: opts.repo,
+                source: opts.cached ? "index" : "worktree",
+            });
             const errors = rows
                 .flatMap((row) => row.issues)
                 .filter((issue) => issue.severity === "error");
@@ -107,6 +111,7 @@ export function registerDocsCommand(program, emitParam, context) {
         .argument("[files...]", "Explicit repository-relative Markdown files; defaults to staged files")
         .option("--repo <name>", "Limit to one submodule or '.' for parent")
         .option("--check", "Report timestamp drift without writing")
+        .option("--cached", "Read current contents from the Git index (requires --check)")
         .option("--reviewed", "Record an explicit runbook review and move its due date")
         .action(async (files, opts) => {
         try {
@@ -163,6 +168,7 @@ export function registerDocsCommand(program, emitParam, context) {
         .description("Verify every repo matches the documentation contract (directory layout + naming rules)")
         .option("--fast", "Skip content-reading checks; filename/structure only (for pre-commit)")
         .option("--repo <name>", "Limit to one submodule or '.' for parent")
+        .option("--cached", "Read paths and contents from the Git index")
         .option("--format <type>", "Output format: human, json", "human")
         .action(async (opts) => {
         try {
@@ -254,13 +260,18 @@ async function handleDocs(opts) {
 }
 // --- `harn docs lint` ---
 async function handleLint(opts) {
-    const violations = await runLint({ fast: opts.fast, repo: opts.repo });
+    const violations = await runLint({
+        fast: opts.fast,
+        repo: opts.repo,
+        source: opts.cached ? "index" : "worktree",
+    });
     const errors = violations.filter((v) => v.severity === "error");
     const warnings = violations.filter((v) => v.severity === "warning");
     const cold = await countColdHandoffs();
     emit.data({
         fast: !!opts.fast,
         repo: opts.repo ?? null,
+        source: opts.cached ? "index" : "worktree",
         error_count: errors.length,
         warning_count: warnings.length,
         cold_handoffs: cold,

package/dist/commands/doctor.d.ts

@@ -13,6 +13,7 @@
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.js";
 import { type CodexHookAuthorizationResult } from "../core/hooks/codex-authorization.js";
+import { type CodexWslBridgeStatus } from "../core/hooks/codex-wsl-bridge.js";
 type Severity = "ok" | "warn" | "fail";
 export interface Check {
     name: string;
@@ -22,6 +23,10 @@ export interface Check {
 }
 export declare function registerDoctorCommand(program: Command, emit: EmitContext): void;
 export declare function runChecks(): Promise<Check[]>;
+export declare function codexWslBridgeCheck(status: CodexWslBridgeStatus | null, recentMidFlightCount?: number): Check | null;
+/** Count bounded, privacy-safe recovery diagnostics so a healthy environment
+ * now does not hide an intermittent Codex-to-WSL identity drop. */
+export declare function countRecentCodexMidFlightOnboardings(coordRoot: string, nowMs?: number, windowMs?: number): number;
 export declare function codexAuthorizationCheck(result: CodexHookAuthorizationResult): Check;
 export {};
 //# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAKnD,OAAO,EACL,KAAK,4BAA4B,EAElC,MAAM,sCAAsC,CAAC;AAe9C,KAAK,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvC,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAOD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAmD/E;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAyBlD;AA4CD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,4BAA4B,GAAG,KAAK,CAoBnF"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AASnD,OAAO,EACL,KAAK,4BAA4B,EAElC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,mCAAmC,CAAC;AAW3C,KAAK,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvC,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAOD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAmD/E;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CA2BlD;AAgCD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,oBAAoB,GAAG,IAAI,EACnC,oBAAoB,SAAI,GACvB,KAAK,GAAG,IAAI,CAed;AAID;mEACmE;AACnE,wBAAgB,oCAAoC,CAClD,SAAS,EAAE,MAAM,EACjB,KAAK,SAAa,EAClB,QAAQ,SAAqC,GAC5C,MAAM,CA0CR;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,4BAA4B,GAAG,KAAK,CAoBnF"}

package/dist/commands/doctor.js

@@ -11,11 +11,12 @@
  * Exits 0 unless a required dep is missing.
  */
 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { BUILTIN_ADAPTER_IDS } from "../core/adapters/index.js";
 import { resolveBinName, ripgrepAutoInstall } from "../core/config.js";
+import { countSummarizedSinceV3, listDiagnosticSummariesV3, } from "../core/events/v3/producers/diagnostic-summaries.js";
 import { ADAPTER_SPECS } from "../core/hooks/adapter/events.js";
 import { loadAdapterWiring, summarizeAdapterWiring } from "../core/hooks/adapter/wiring.js";
 import { probeCodexHookAuthorization, } from "../core/hooks/codex-authorization.js";
@@ -69,8 +70,10 @@ export function registerDoctorCommand(program, emit) {
     });
 }
 export async function runChecks() {
+    const root = findCoordProjectRoot();
     const codexWslStatus = inspectCodexWslBridge();
-    const codexWslBridge = checkCodexWslBridge(codexWslStatus);
+    const recentCodexMidFlightCount = root ? countRecentCodexMidFlightOnboardings(root) : 0;
+    const codexWslBridge = codexWslBridgeCheck(codexWslStatus, recentCodexMidFlightCount);
     // Probe the adapter CLIs before the hook check runs, not in output order:
     // an unwired adapter only matters if its CLI is actually installed, and
     // probing once here keeps that join to one spawn per CLI.
@@ -123,18 +126,59 @@ function checkGitHookRegions() {
         };
     }
 }
-function checkCodexWslBridge(status) {
-    if (!status)
+export function codexWslBridgeCheck(status, recentMidFlightCount = 0) {
+    if (!status && recentMidFlightCount === 0)
         return null;
+    const historical = recentMidFlightCount === 0
+        ? null
+        : `${recentMidFlightCount} Codex mid-flight onboarding${recentMidFlightCount === 1 ? "" : "s"} recorded in the last 48h`;
     return {
         name: "codex:WSL bridge",
-        severity: status.ok ? "ok" : "warn",
-        detail: status.detail,
-        hint: status.ok
+        severity: status?.ok && !historical ? "ok" : "warn",
+        detail: [status?.detail, historical].filter(Boolean).join("; "),
+        hint: status?.ok && !historical
             ? undefined
             : "forward CODEX_THREAD_ID through WSLENV in the Codex shell environment policy, then start a fresh task",
     };
 }
+const CODEX_MID_FLIGHT_HISTORY_WINDOW_MS = 48 * 60 * 60 * 1000;
+/** Count bounded, privacy-safe recovery diagnostics so a healthy environment
+ * now does not hide an intermittent Codex-to-WSL identity drop. */
+export function countRecentCodexMidFlightOnboardings(coordRoot, nowMs = Date.now(), windowMs = CODEX_MID_FLIGHT_HISTORY_WINDOW_MS) {
+    // Occurrences past the producer's loose-exemplar bound live in summary
+    // files instead of loose diagnostics; count them too so the mitigation
+    // cannot hide an active Codex identity drop from this warning.
+    let count = 0;
+    try {
+        const listing = listDiagnosticSummariesV3(coordRoot);
+        count += countSummarizedSinceV3(listing.summaries, nowMs - windowMs, (summary) => summary.category === "mid_flight_onboarding" && summary.metadata.adapter === "codex", nowMs);
+    }
+    catch {
+        // Summary reads are best-effort; loose diagnostics below still count.
+    }
+    const directory = path.join(coordRoot, ".harnery", "ledgers", "v3", "diagnostics");
+    if (!existsSync(directory))
+        return count;
+    for (const name of readdirSync(directory)) {
+        if (!name.startsWith("mid_flight_onboarding-") || !name.endsWith(".json"))
+            continue;
+        try {
+            const row = JSON.parse(readFileSync(path.join(directory, name), "utf8"));
+            const recordedAt = typeof row.recorded_at === "string" ? Date.parse(row.recorded_at) : NaN;
+            if (row.category === "mid_flight_onboarding" &&
+                row.adapter === "codex" &&
+                Number.isFinite(recordedAt) &&
+                recordedAt <= nowMs &&
+                nowMs - recordedAt <= windowMs) {
+                count += 1;
+            }
+        }
+        catch {
+            // A malformed best-effort diagnostic cannot make doctor fail.
+        }
+    }
+    return count;
+}
 export function codexAuthorizationCheck(result) {
     const reviewHint = "terminal UI: run `/hooks`; Codex Desktop: open Settings > Hooks; after approval, start a fresh task";
     if (result.status === "runnable") {

package/dist/commands/fetch.js

@@ -63,13 +63,14 @@ async function runFetch(url, opts, emit, context) {
             redirect: opts.redirect,
             signal: ac.signal,
             extraHeaders: context?.extraHeaders,
+            responseType: "bytes",
         });
     }
     finally {
         clearTimeout(timer);
     }
     if (opts.json) {
-        emit.data(result);
+        emit.data({ ...result, body: new TextDecoder().decode(result.body) });
         return;
     }
     if (opts.status) {
@@ -83,15 +84,15 @@ async function runFetch(url, opts, emit, context) {
     if (opts.output) {
         writeFileSync(opts.output, result.body);
         emit.file(opts.output, {
-            bytes: result.body.length,
+            bytes: result.body.byteLength,
             status: result.status,
             status_text: result.statusText,
         });
     }
     else {
-        // Body is potentially binary; route as text since most fetch responses
-        // are text/HTML/JSON. Binary callers should use --output.
-        emit.text(result.body);
+        // Text destinations decode at the presentation boundary. File output
+        // above keeps the response bytes intact regardless of MIME type.
+        emit.text(new TextDecoder().decode(result.body));
     }
     if (jar && result.cookiesSaved > 0) {
         emit.log(`saved ${result.cookiesSaved} cookie${result.cookiesSaved === 1 ? "" : "s"} to ${jar.path}`, "info");