harnery 0.40.0 → 0.42.0

package/dist/lib/guarded-remove.js

@@ -0,0 +1,310 @@
+import { spawnSync } from "node:child_process";
+import { lstatSync, readdirSync, readlinkSync, realpathSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, parse, relative, resolve, sep } from "node:path";
+const protectedNames = new Set([".git", ".harnery", ".credentials", ".ssh", ".gnupg"]);
+const MAX_ENTRIES = 10_000;
+/** Permanent removal is deliberately limited to inspected, untracked local outputs. */
+export function guardedRemove(paths, options, checkClaims = () => { }) {
+    const cwd = realpathSync(process.cwd());
+    const root = checkedPath(options.root, new Set(), true);
+    const allowed = allowedProtected(options.allowProtected ?? [], root, options.liveRoots ?? []);
+    const rootStat = lstatSync(root);
+    const rootFingerprint = fingerprint(rootStat);
+    if (!rootStat.isDirectory())
+        throw new Error("--root must be a directory");
+    if (root === parse(root).root || root === realpathSync(homedir()))
+        throw new Error("--root cannot be a filesystem root or home directory");
+    if (paths.length === 0 || paths.length > 100)
+        throw new Error("Supply 1-100 explicit targets");
+    const targets = paths.map((path) => checkedPath(path, allowed));
+    const snapshots = new Map();
+    const removedProtected = new Set();
+    const links = [];
+    const gitDirs = new Set();
+    let bytes = 0;
+    const devices = new Set();
+    for (const target of targets) {
+        const home = realpathSync(homedir());
+        if (target === home || strictlyInside(target, home))
+            throw new Error(`Cannot remove the home directory or its ancestor: ${target}`);
+        const systemRoots = process.platform === "win32"
+            ? [
+                process.env.SystemRoot,
+                process.env.ProgramFiles,
+                process.env["ProgramFiles(x86)"],
+            ].filter((value) => Boolean(value))
+            : [
+                "/etc",
+                "/usr",
+                "/boot",
+                "/dev",
+                "/proc",
+                "/sys",
+                "/bin",
+                "/sbin",
+                "/lib",
+                "/lib64",
+                "/run",
+            ];
+        if (systemRoots.some((system) => target === resolve(system) ||
+            strictlyInside(resolve(system), target) ||
+            strictlyInside(target, resolve(system))))
+            throw new Error(`System files are protected: ${target}`);
+        if (!strictlyInside(root, target))
+            throw new Error(`Target must be strictly inside --root: ${target}`);
+        if (target === cwd || strictlyInside(target, cwd))
+            throw new Error(`Cannot remove the working directory or its ancestor: ${target}`);
+        if (targets.some((other) => other !== target && strictlyInside(other, target)) ||
+            targets.filter((other) => other === target).length > 1)
+            throw new Error("Targets must not duplicate or contain one another");
+        const stat = lstatSync(target);
+        if (stat.dev !== rootStat.dev)
+            throw new Error(`Target crosses a mount boundary: ${target}`);
+        if (stat.isDirectory() && !options.recursive)
+            throw new Error(`Directory removal requires --recursive: ${target}`);
+        const device = stat.dev;
+        devices.add(device);
+        const pending = [target];
+        while (pending.length) {
+            const path = pending.pop();
+            const info = lstatSync(path);
+            if (basename(path) === ARTIFACT_RECORD && insideArtifactWorkspace(path, null))
+                throw new Error(`An artifact's record is managed by the artifact commands: ${path}`);
+            if (protectedNames.has(basename(path).toLowerCase())) {
+                if (!allowed.has(path))
+                    throw new Error(protectedMessage(path));
+                removedProtected.add(path);
+            }
+            if (info.isSymbolicLink()) {
+                // A link inside the tree is removed as a link; its target is never
+                // read, followed, or counted. (The target itself and its ancestors
+                // were already refused if they were links, in checkedPath.)
+                if (path === target)
+                    throw new Error(`Path contains a symlink: ${path}`);
+                if (snapshots.size >= MAX_ENTRIES)
+                    throw new Error(`Removal exceeds the ${MAX_ENTRIES}-entry limit; use the owning cleanup command`);
+                snapshots.set(path, fingerprint(info));
+                links.push({ path, target: readlinkSync(path) });
+                continue;
+            }
+            if (info.dev !== device || (!info.isDirectory() && !info.isFile()))
+                throw new Error(`Mount boundary or special file cannot be removed: ${path}`);
+            if (snapshots.size >= MAX_ENTRIES)
+                throw new Error(`Removal exceeds the ${MAX_ENTRIES}-entry limit; use the owning cleanup command`);
+            snapshots.set(path, fingerprint(info));
+            if (info.isFile())
+                bytes += info.size;
+            else {
+                const names = readdirSync(path);
+                if (names.includes("HEAD") &&
+                    names.includes("objects") &&
+                    names.includes("config") &&
+                    !insideAllowed(path, allowed))
+                    throw new Error(`Repository metadata cannot be removed: ${path}. To remove it on purpose, name it with --allow-protected ${path}`);
+                if (allowed.has(path))
+                    removedProtected.add(path);
+                if (isRepositoryMetadata(path))
+                    gitDirs.add(path);
+                for (const name of names)
+                    pending.push(resolve(path, name));
+            }
+        }
+        assertUntracked(target);
+    }
+    if (devices.size > 1)
+        throw new Error("Targets must be on one filesystem");
+    for (const path of allowed)
+        if (!removedProtected.has(path))
+            throw new Error(`--allow-protected names a path no target removes: ${path}`);
+    for (const dir of gitDirs)
+        assertNoUnpushedHistory(dir);
+    checkClaims(targets);
+    const report = {
+        schema: "harnery.removal/v1",
+        applied: false,
+        root,
+        targets,
+        entries: snapshots.size,
+        bytes,
+        protected: [...removedProtected].sort(),
+        links,
+    };
+    if (!options.yes || options.dryRun)
+        return report;
+    // Recheck the entire batch before its first mutation. Filesystem changes after
+    // these checks remain possible; this is a guard, not a transactional filesystem.
+    if (checkedPath(options.root, new Set(), true) !== root ||
+        fingerprint(lstatSync(root)) !== rootFingerprint)
+        throw new Error("Allowed root changed during inspection");
+    for (const target of targets) {
+        checkedPath(target, allowed);
+        assertUntracked(target);
+    }
+    for (const dir of gitDirs)
+        assertNoUnpushedHistory(dir);
+    checkClaims(targets);
+    for (const [path, previous] of snapshots) {
+        if (fingerprint(lstatSync(path)) !== previous)
+            throw new Error(`Target changed during inspection: ${path}`);
+    }
+    for (const target of targets)
+        rmSync(target, { recursive: Boolean(options.recursive), force: false });
+    return { ...report, applied: true };
+}
+/** The metadata file the artifact commands keep in each artifact workspace. */
+const ARTIFACT_RECORD = ".harnery-artifact.json";
+/**
+ * True when `path` lies strictly inside one artifact workspace,
+ * <dir>/.harnery/artifacts/<id>/..., under the `.harnery` component `state`
+ * (any `.harnery` when null). Artifact workspaces hold local outputs, so their
+ * contents may be removed; the workspace itself, its record file, and the rest
+ * of Harnery state stay protected and follow the artifact commands. `orSelf`
+ * accepts the workspace directory itself (used for --root, which is never removed).
+ */
+function insideArtifactWorkspace(path, state, orSelf = false) {
+    const parts = path.split(sep);
+    for (let i = 0; i < parts.length; i++) {
+        if (parts[i].toLowerCase() !== ".harnery")
+            continue;
+        if (state !== null && parts.slice(0, i + 1).join(sep) !== state)
+            continue;
+        // .harnery / artifacts / <id> / <something>
+        return (parts[i + 1] === "artifacts" && Boolean(parts[i + 2]) && parts.length >= i + (orSelf ? 3 : 4));
+    }
+    return false;
+}
+function protectedMessage(path) {
+    return `Protected state cannot be removed: ${path}. To remove it on purpose, name it with --allow-protected ${path}`;
+}
+function insideAllowed(path, allowed) {
+    for (const entry of allowed)
+        if (path === entry || strictlyInside(entry, path))
+            return true;
+    return false;
+}
+/**
+ * Resolves the caller's --allow-protected paths. Each must be one exact
+ * protected path strictly inside the root, reached without symlinks, and
+ * never the Git metadata or Harnery state of a live workspace root.
+ */
+function allowedProtected(paths, root, liveRoots) {
+    const allowed = new Set();
+    const live = liveRoots.map((dir) => resolve(dir));
+    for (const input of paths) {
+        if (!input?.trim() || /[\0\r\n*?[\]$]/.test(input))
+            throw new Error("Use a nonempty explicit --allow-protected path without wildcards");
+        const path = resolve(input);
+        let cursor = dirname(path);
+        while (true) {
+            if (lstatSync(cursor).isSymbolicLink())
+                throw new Error(`--allow-protected path contains a symlink: ${cursor}`);
+            const parent = dirname(cursor);
+            if (parent === cursor)
+                break;
+            cursor = parent;
+        }
+        const info = lstatSync(path);
+        if (info.isSymbolicLink())
+            throw new Error(`--allow-protected path is a symlink: ${path}`);
+        if (!strictlyInside(root, path))
+            throw new Error(`--allow-protected path must be strictly inside --root: ${path}`);
+        const named = protectedNames.has(basename(path).toLowerCase());
+        if (!named && !(info.isDirectory() && isRepositoryMetadata(path)))
+            throw new Error(`--allow-protected must name a protected path itself: ${path}`);
+        for (const dir of live) {
+            const own = [".git", ".harnery"].map((name) => resolve(dir, name));
+            if (path === dir ||
+                strictlyInside(path, dir) ||
+                own.some((state) => path === state || strictlyInside(state, path)))
+                throw new Error(`The live workspace's own state cannot be allowed: ${path}`);
+        }
+        allowed.add(realpathSync(path));
+    }
+    return allowed;
+}
+function isRepositoryMetadata(dir) {
+    const names = readdirSync(dir);
+    return names.includes("HEAD") && names.includes("objects") && names.includes("config");
+}
+/**
+ * Removing a repository's metadata loses any commit that exists nowhere
+ * else. An allowed Git directory must have no branch or tag commit missing
+ * from its remotes; anything that cannot be checked is refused.
+ */
+function assertNoUnpushedHistory(gitDir) {
+    const result = spawnSync("git", [
+        "--git-dir",
+        gitDir,
+        "rev-list",
+        "--max-count=1",
+        "--branches",
+        "--tags",
+        "--not",
+        "--remotes",
+    ], {
+        encoding: "utf8",
+        timeout: 10_000,
+        env: { ...process.env, LC_ALL: "C", GIT_DIR: undefined, GIT_WORK_TREE: undefined },
+    });
+    if (result.error || result.status !== 0)
+        throw new Error(`Cannot confirm ${gitDir} holds no unpushed history`);
+    if (result.stdout.trim())
+        throw new Error(`Repository has commits not on any remote: ${gitDir}`);
+}
+function strictlyInside(parent, child) {
+    const rel = relative(parent, child);
+    return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function checkedPath(input, allowed = new Set(), isRoot = false) {
+    if (!input?.trim() || /[\0\r\n*?[\]$]/.test(input))
+        throw new Error("Use a nonempty explicit path without wildcards or unresolved variables");
+    const path = resolve(input);
+    let cursor = path;
+    while (true) {
+        if (protectedNames.has(basename(cursor).toLowerCase()) &&
+            !allowed.has(cursor) &&
+            !insideArtifactWorkspace(path, cursor, isRoot))
+            throw new Error(cursor === path ? protectedMessage(path) : `Protected state contains this path: ${cursor}`);
+        const info = lstatSync(cursor);
+        if (info.isSymbolicLink())
+            throw new Error(`Path contains a symlink: ${cursor}`);
+        const parent = dirname(cursor);
+        if (parent === cursor)
+            break;
+        cursor = parent;
+    }
+    return realpathSync(path);
+}
+function fingerprint(stat) {
+    return [stat.dev, stat.ino, stat.mode, stat.size, stat.mtimeMs, stat.ctimeMs].join(":");
+}
+function assertUntracked(target) {
+    const git = (args) => spawnSync("git", ["-C", dirname(target), ...args], {
+        encoding: "utf8",
+        timeout: 10_000,
+        maxBuffer: 4 * 1024 * 1024,
+        env: {
+            ...process.env,
+            LC_ALL: "C",
+            GIT_LITERAL_PATHSPECS: "1",
+            GIT_DIR: undefined,
+            GIT_WORK_TREE: undefined,
+            GIT_INDEX_FILE: undefined,
+        },
+    });
+    const detected = git(["rev-parse", "--show-toplevel"]);
+    if (detected.error)
+        throw new Error(`Cannot check Git ownership: ${detected.error.message}`);
+    if (detected.status !== 0) {
+        if (detected.status === 128 && detected.stderr.startsWith("fatal: not a git repository"))
+            return;
+        throw new Error(`Cannot check Git ownership: ${detected.stderr.trim()}`);
+    }
+    const repo = detected.stdout.trim();
+    const tracked = git(["ls-files", "--cached", "-z", "--full-name", "--", target]);
+    if (tracked.error || tracked.status !== 0)
+        throw new Error(`Cannot inspect Git index in ${repo}`);
+    if (tracked.stdout.length)
+        throw new Error(`Tracked files are protected; use git rm for intentional source removal: ${target}`);
+}

package/dist/lib/identities/assume.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assume.d.ts","sourceRoot":"","sources":["../../../src/lib/identities/assume.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuBH,MAAM,MAAM,uBAAuB,GAC/B,eAAe,GACf,iBAAiB,GACjB,sBAAsB,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,aAAa,GACb,mBAAmB,CAAC;AAExB,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,IAAI,EAAE,uBAAuB;gBAA7B,IAAI,EAAE,uBAAuB,EAC7C,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAOD;+EAC+E;AAC/E,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,SAAa,EAClB,mBAAmB,GAAE,WAAW,CAAC,MAAM,CAAa,GACnD,gBAAgB,GAAG,IAAI,CA6BzB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAyCT;AA0ED,gEAAgE;AAChE,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACjC,oBAAoB,CAyHtB"}
+{"version":3,"file":"assume.d.ts","sourceRoot":"","sources":["../../../src/lib/identities/assume.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA0BH,MAAM,MAAM,uBAAuB,GAC/B,eAAe,GACf,iBAAiB,GACjB,sBAAsB,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,aAAa,GACb,mBAAmB,CAAC;AAExB,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,IAAI,EAAE,uBAAuB;gBAA7B,IAAI,EAAE,uBAAuB,EAC7C,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAOD;+EAC+E;AAC/E,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,SAAa,EAClB,mBAAmB,GAAE,WAAW,CAAC,MAAM,CAAa,GACnD,gBAAgB,GAAG,IAAI,CA6BzB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAyCT;AAuED,gEAAgE;AAChE,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACjC,oBAAoB,CAyHtB"}

package/dist/lib/identities/assume.js

@@ -20,7 +20,8 @@ import { recordLiveSweepObservationV3 } from "../../core/agents/live-lifecycle-v
 import { readLiveCoordinationRow, readLiveCoordinationRows, } from "../../core/agents/state/live-coordination-view.js";
 import { resolveForkAncestry } from "../../core/agents/state/names.js";
 import { instanceHasLivePid, removePidmapRowsForInstance } from "../../core/agents/state/pidmap.js";
-import { coordFreshnessSeconds } from "../../core/config.js";
+import { coordFreshnessSeconds, resolveBinName } from "../../core/config.js";
+import { eventAdapterIdV3FromPlatform, } from "../../core/events/v3/adapter-id.js";
 import { readRemoteMachines } from "../../core/presence/index.js";
 import { bareName, ensureIdentity, lookupById, lookupByName } from "./index.js";
 const ASSUME_LOCK = "identity-assume.lock";
@@ -175,13 +176,7 @@ function acquireLock(coordRoot) {
     throw new IdentityAssumeError("identity_busy", "another identity assumption is in progress; retry in a moment");
 }
 function adapterOf(platform) {
-    if (platform === "cursor")
-        return "cursor";
-    if (platform === "codex")
-        return "codex";
-    if (platform === "openclaw")
-        return "openclaw";
-    return "claude-code";
+    return eventAdapterIdV3FromPlatform(platform, { context: "identity-assume" });
 }
 /** Assume `target` for one live main session. Safe to retry. */
 export function assumeIdentity(coordRoot, instanceId, target, opts) {
@@ -189,7 +184,7 @@ export function assumeIdentity(coordRoot, instanceId, target, opts) {
     try {
         const hb = readLiveCoordinationRow(coordRoot, instanceId);
         if (!hb) {
-            throw new IdentityAssumeError("no_live_generation", `no authority-safe live V3 generation for instance '${instanceId}'`);
+            throw new IdentityAssumeError("no_live_generation", `no authority-safe live V3 generation for instance '${instanceId}'; run \`${resolveBinName(coordRoot)} agents lifecycle active\` to open a fresh generation for this continuing session, then assume again`);
         }
         if (hb.kind && hb.kind !== "session") {
             throw new IdentityAssumeError("not_session", `identity assumption is limited to main sessions (current kind: ${hb.kind})`);

package/dist/lib/instructions/apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../../src/lib/instructions/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAyFH,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAYlE;AAmBD,UAAU,SAAS;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,WAAW,CAoInF;AAED,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,WAAW,CA8FrF;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IACpC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzC,WAAW,CA2Db"}
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../../src/lib/instructions/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA2FH,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAYlE;AAmBD,UAAU,SAAS;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,WAAW,CAoInF;AAED,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,WAAW,CA8FrF;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IACpC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzC,WAAW,CA2Db"}

package/dist/lib/instructions/apply.js

@@ -33,6 +33,8 @@ const ADAPTER_SKILLS_DIR = {
     "claude-code": join(".claude", "skills"),
     cursor: join(".agents", "skills"),
     codex: join(".agents", "skills"),
+    // OpenCode natively discovers .agents/skills (and .claude/skills); no mirror needed.
+    opencode: join(".agents", "skills"),
 };
 function adapterSkillsDir(adapter) {
     return ADAPTER_SKILLS_DIR[adapter] ?? null;

package/dist/lib/instructions/templates.js

@@ -67,8 +67,7 @@ export function renderInstructionsBlock(binName, skills = { decide: true, counci
     return `## harnery coordination
 
 This project runs [harnery](https://harnery.com) for multi-agent coordination.
-You share this checkout with other agents; the surfaces below keep you oriented
-and out of each other's way, and let you dispatch a team of your own when a job
+You share this checkout with other agents; the surfaces below keep you oriented and out of each other's way, and let you dispatch a team of your own when a job
 is bigger than one session. Run \`${b} <command> --help\` for any command's full
 surface. ${deeper}
 
@@ -81,8 +80,7 @@ widely-shared files.
 **Task lifecycle.** Beside the activity peers already see, declare whether your
 objective is still open: \`${b} agents lifecycle blocked --reason "<why>"\` when
 it cannot proceed, \`${b} agents lifecycle done\` when it is complete, and
-\`${b} agents lifecycle active\` to reopen. \`done\` requires a current task and
-a passing Git finalization check (dirty or unpushed work refuses, and nothing is
+\`${b} agents lifecycle active\` to reopen. \`done\` requires a current task and a passing Git finalization check (dirty or unpushed work refuses, and nothing is
 written). Ordinary \`set-task\` calls never change lifecycle, and a transition
 that re-mints the session title tells you the new name to copy. ${endPointer}
 
@@ -107,8 +105,7 @@ It reclaims an abandoned namesake (no live process) and refuses only when anothe
 live process still holds the name; never hand-edit Harnery's history, heartbeat,
 or derived identity cache.
 
-**Declare intent on shell commands.** Every command you run is captured to the
-coordination ledger (\`.harnery/ledgers/v3/\`). Lead a shell command with a
+**Declare intent on shell commands.** Every command you run is captured to the coordination ledger (\`.harnery/ledgers/v3/\`). Lead a shell command with a
 \`# intent: <why>\` comment (or set the tool's description) so the recorded event
 carries a reason instead of \`(no intent)\`; the [tool-intent
 guide](https://harnery.com/guides/tool-intent/) owns the details.
@@ -132,6 +129,10 @@ After review, use \`${b} artifacts discard <id> --reason "<why no longer needed>
 Do not create a repo-root temp directory; \`${b} artifacts clean\` previews
 expired cleanup and requires \`--yes\` to delete anything.
 
+**Removing local outputs.** Use \`${b} rm --root <directory> <paths...>\` instead of shell \`rm\`, which skips resolved-path, Git ownership, and peer-claim checks. Preview
+is the default; \`--yes\` deletes permanently and \`--recursive\` permits directories.
+Use \`git rm\` for tracked source and the artifact commands for managed evidence.
+
 **Local file links.** When the operator should open a local repo file, mint the
 URL with \`${b} files url <repo-relative-path>\` instead of guessing it. HTML opens
 as a real page with working scripts and relative assets; other files open in the
@@ -142,8 +143,7 @@ can't resolve from the repo, file it instead. \`${b} decision file "<question>"\
 records it and lets you proceed on a stated default; \`${b} decision search "<terms>"\`
 surfaces prior decisions, so check for precedent before re-deciding. ${decidePointer}
 
-**Councils.** For a hard or contested decision, convene a council of agents.
-\`${b} council create "<objective>"\` runs structured rounds toward a decision. ${councilPointer}`;
+**Councils.** For a hard or contested decision, convene a council of agents. \`${b} council create "<objective>"\` runs structured rounds toward a decision. ${councilPointer}`;
 }
 function decideBody(b) {
     return `The decision docket is a persistent queue for decisions you would otherwise

package/dist/lib/pace/index.d.ts

@@ -0,0 +1,2 @@
+export { commandPaceGate, DEFAULT_PACE_LEDGER, DEFAULT_PACE_MAX_MS, DEFAULT_PACE_MIN_MS, describePaceWait, PaceGate, type PaceGateDeps, type PacePolicy, type PaceWait, pacePolicyFromEnv, paceSiteKey, sleepSync, } from "./pace.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/pace/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/pace/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,iBAAiB,EACjB,WAAW,EACX,SAAS,GACV,MAAM,WAAW,CAAC"}

package/dist/lib/pace/index.js

@@ -0,0 +1 @@
+export { commandPaceGate, DEFAULT_PACE_LEDGER, DEFAULT_PACE_MAX_MS, DEFAULT_PACE_MIN_MS, describePaceWait, PaceGate, pacePolicyFromEnv, paceSiteKey, sleepSync, } from "./pace.js";

package/dist/lib/pace/pace.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Human-pace gate for page loads.
+ *
+ * Every Harnery surface that loads a web page (`browse`, `browse-ai`, `fetch`,
+ * and the headed browse-session verbs) reserves a slot here before the request
+ * goes out. Consecutive loads against the same registrable site are spaced by
+ * a random gap inside `[minMs, maxMs]`, the way a person reads one page before
+ * opening the next. Loads against different sites do not wait on each other.
+ * Loopback, private-network, single-label, and reserved-suffix hosts are exempt
+ * so local development and page QA keep running at machine speed.
+ *
+ * The ledger is a small machine-local JSON file (`~/.cache/harnery/pace.json`)
+ * shared by every process, so separate `harn fetch` calls in a shell loop are
+ * paced the same as one long `harn browse` session. A caller reserves the next
+ * slot before it sleeps, so concurrent processes queue behind each other
+ * instead of all firing at once.
+ *
+ * The gate is on by default. `HARNERY_PACE=off` disables it machine-wide and
+ * each command carries `--no-pace` for a single run.
+ */
+export declare const DEFAULT_PACE_MIN_MS = 3000;
+export declare const DEFAULT_PACE_MAX_MS = 9000;
+export declare const DEFAULT_PACE_LEDGER: string;
+export interface PacePolicy {
+    /** False turns the gate into a no-op. Default true. */
+    enabled: boolean;
+    /** Shortest gap between two loads of the same site, in ms. */
+    minMs: number;
+    /** Longest gap between two loads of the same site, in ms. */
+    maxMs: number;
+    /** Extra exempt host suffixes (`example.test` matches itself and `*.example.test`). */
+    exemptSuffixes: string[];
+    /** Path of the shared reservation ledger. */
+    ledgerPath: string;
+}
+export interface PaceWait {
+    /** Registrable site the reservation was made against. */
+    site: string;
+    /** Milliseconds the caller waited (0 when the slot was free). */
+    waitMs: number;
+}
+export interface PaceGateDeps {
+    now?: () => number;
+    random?: () => number;
+    /** Called after a reservation, whether or not it waited. */
+    onWait?: (wait: PaceWait) => void;
+}
+/**
+ * Resolve the pace policy from the environment.
+ *
+ * - `HARNERY_PACE`: `off` (or `0`, `false`, `no`) disables the gate. Unset or
+ *   `human` keeps the default.
+ * - `HARNERY_PACE_MIN_MS` / `HARNERY_PACE_MAX_MS`: gap bounds in ms. Both must
+ *   be non-negative integers with min <= max.
+ * - `HARNERY_PACE_EXEMPT`: comma-separated host suffixes that never wait.
+ * - `HARNERY_PACE_LEDGER`: ledger path override.
+ */
+export declare function pacePolicyFromEnv(env?: NodeJS.ProcessEnv): PacePolicy;
+/**
+ * Registrable site a URL belongs to for pacing purposes, or `null` when the
+ * URL is exempt: a non-HTTP scheme, a loopback or private address, a
+ * single-label or reserved-suffix host, or a configured exemption.
+ */
+export declare function paceSiteKey(url: string, exemptSuffixes?: readonly string[]): string | null;
+/** Block the current thread for `ms`. Used by clients that drive a child process synchronously. */
+export declare function sleepSync(ms: number): void;
+export declare class PaceGate {
+    readonly policy: PacePolicy;
+    private readonly now;
+    private readonly random;
+    private readonly onWait;
+    constructor(policy: PacePolicy, deps?: PaceGateDeps);
+    /** A gate that never waits, for callers that opted out. */
+    static disabled(): PaceGate;
+    /**
+     * Reserve the next slot for `url` without sleeping. Returns how long the
+     * caller should wait before loading, or `null` when the URL is exempt or the
+     * gate is disabled. The reservation is recorded even when the wait is zero,
+     * so the next load of the same site owes a gap.
+     */
+    reserve(url: string): PaceWait | null;
+    /** Reserve a slot and wait it out asynchronously. */
+    before(url: string): Promise<PaceWait | null>;
+    /** Reserve a slot and block the thread for it. For `spawnSync`-driven clients. */
+    beforeSync(url: string): PaceWait | null;
+}
+/**
+ * Gate for a CLI command run. `null` when the run passed `--no-pace`;
+ * otherwise the environment policy, with every non-zero wait reported through
+ * `log` so the operator can see why a load took longer.
+ */
+export declare function commandPaceGate(optedIn: boolean, log: (message: string) => void): PaceGate | null;
+/** Describe a wait for a human-facing log line. */
+export declare function describePaceWait(wait: PaceWait): string;
+//# sourceMappingURL=pace.d.ts.map

package/dist/lib/pace/pace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pace.d.ts","sourceRoot":"","sources":["../../../src/lib/pace/pace.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AACzC,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AACzC,eAAO,MAAM,mBAAmB,QAAuD,CAAC;AAUxF,MAAM,WAAW,UAAU;IACzB,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACvB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;CACnC;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CAuBlF;AAwED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,GAAG,IAAI,CAmB9F;AAED,mGAAmG;AACnG,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAG1C;AAED,qBAAa,QAAQ;IAMjB,QAAQ,CAAC,MAAM,EAAE,UAAU;IAL7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAGrD,MAAM,EAAE,UAAU,EAC3B,IAAI,GAAE,YAAiB;IAOzB,2DAA2D;IAC3D,MAAM,CAAC,QAAQ,IAAI,QAAQ;IAI3B;;;;;OAKG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAqBrC,qDAAqD;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAQnD,kFAAkF;IAClF,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;CAKzC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,QAAQ,GAAG,IAAI,CAOjG;AAED,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAGvD"}