harnery 0.46.0 → 0.47.0

package/schemas/config.schema.json

@@ -308,6 +308,89 @@
         }
       }
     },
+    "computer": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Opt-in desktop control through a pinned desktop driver (ADR 0228). Project config only; inert unless enabled is true.",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "default": false,
+          "description": "Allow `computer install`, `up`, `call`, and `lease acquire` in this project, and render the harn-computer skill on init."
+        },
+        "idle_seconds": {
+          "type": "number",
+          "exclusiveMinimum": 0,
+          "maximum": 86400,
+          "default": 120,
+          "description": "Desktop lease idle expiry. Every `computer call` by the holder refreshes it."
+        },
+        "wait_seconds": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 3600,
+          "default": 30,
+          "description": "How long `computer call` waits for another agent's lease before failing. `--wait` overrides per call."
+        }
+      }
+    },
+    "autoUpdate": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Activity-fired project self-update (ADR 0229). Project config only; inert unless enabled is true. Prompts, session starts, and host CLI commands check a throttle stamp; when it is stale a detached child compares HEAD with the upstream branch (git ls-remote, no fetch), fingerprints the watched paths, and runs the steps only when something changed. Step protocol: each step runs from the project root with HARNERY_AUTOUPDATE_CHILD=1; a stdout or stderr line starting `harnery-notice:` becomes a notice shown once to every agent session in this checkout on its next prompt; exit code 75 means the step did what it could but needs a person, which is reported and not retried as a failure; any other non-zero exit stops the run and retries after a backoff.",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "default": false,
+          "description": "Turn self-update on for this project. Anything other than true leaves it off."
+        },
+        "steps": {
+          "type": "array",
+          "default": [],
+          "description": "Commands run in order when the upstream branch moved, a watched path changed, or the last run failed. Each entry is an argv array (no shell). The first failure stops the run. The host owns these commands: Harnery never fetches, resets, or discards changes itself.",
+          "items": {
+            "type": "array",
+            "minItems": 1,
+            "items": { "type": "string", "minLength": 1 }
+          }
+        },
+        "dailySteps": {
+          "type": "array",
+          "default": [],
+          "description": "Commands run at most once every 24 hours even when the checkout is current, for example a health check. Same argv form and protocol as steps.",
+          "items": {
+            "type": "array",
+            "minItems": 1,
+            "items": { "type": "string", "minLength": 1 }
+          }
+        },
+        "watch": {
+          "type": "array",
+          "default": [],
+          "description": "Paths outside Git whose change forces a run, such as managed tools or generated hook settings. `~/` and `$VAR` expand; relative paths resolve from the project root. A directory is fingerprinted shallowly (its own mtime plus each direct child's mtime and size).",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "checkMinutes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1440,
+          "default": 15,
+          "description": "Minimum minutes between remote checks. Out-of-range values are clamped."
+        },
+        "timeoutMinutes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 240,
+          "default": 20,
+          "description": "Per-step timeout in minutes. A step that runs longer is stopped and counted as a failure. Out-of-range values are clamped."
+        },
+        "cleanup": {
+          "type": "boolean",
+          "default": true,
+          "description": "After a successful run, remove expired working artifacts (`artifacts clean --yes`) at most once a day."
+        }
+      }
+    },
     "files": {
       "type": "object",
       "additionalProperties": false,
@@ -395,7 +478,7 @@
           "type": "array",
           "items": { "type": "string" },
           "default": [],
-          "description": "Shipped Harnery skills this repo suppresses. Installed skill IDs are harn-decide, harn-council, and harn-end."
+          "description": "Shipped Harnery skills this repo suppresses. Installed skill IDs are harn-decide, harn-council, harn-end, harn-team, and (only when computer.enabled is true) harn-computer."
         }
       }
     },
@@ -440,6 +523,11 @@
               "description": "Windows command name the bridge installs, for example codex-wsl-hook. Only a bridge that implements the decision record 0197 contract should install it."
             }
           }
+        },
+        "portableCommands": {
+          "type": "boolean",
+          "default": false,
+          "description": "Write the same adapter hook commands on every OS: agent-hook from PATH as each hook's command, plus a matching Codex commandWindows, and have init --check treat that form as current everywhere. For a project that commits its adapter settings and is cloned on Windows, Linux, WSL and macOS; every clone needs agent-hook on PATH. Project config only."
         }
       }
     },

package/src/commander.ts

@@ -15,8 +15,8 @@
  * (Commander pattern).
  */
 
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Command } from "commander";
 import {
@@ -25,6 +25,7 @@ import {
   loadAllLazyCommands,
   registerLazyCommandBundles,
 } from "./lazy-commands.ts";
+import { coordEnv } from "./lib/env.ts";
 
 export {
   type LazyCommandBundle,
@@ -81,6 +82,9 @@ export interface EnvCheck {
  */
 export type EnvSection = () => Promise<EnvCheck[]>;
 
+/** Verdict from `HarneryProgramContext.headerPolicy` for one caller header. */
+export type FetchHeaderDecision = { allow: true } | { allow: false; message: string };
+
 export interface HarneryProgramContext {
   /** Project name (e.g., "my-monorepo"). Used in user-facing log lines + telemetry tags. */
   projectName?: string;
@@ -121,6 +125,17 @@ export interface HarneryProgramContext {
    * zones behind a WAF). harn standalone skips the callback entirely.
    */
   extraHeaders?: (url: string) => Record<string, string>;
+  /**
+   * Optional check run on every header the caller passed to `fetch` with
+   * `-H`, before any request leaves the process. Returning
+   * `{ allow: false, message }` stops the run with that message and a
+   * nonzero exit; there is no flag to override it. Only caller headers are
+   * checked: the default User-Agent and anything `extraHeaders` adds are the
+   * host's own. Redirect hops are not re-checked because a cross-origin hop
+   * already drops every caller header except a few browser headers. The
+   * message must not echo the header value. harn standalone checks nothing.
+   */
+  headerPolicy?: (host: string, name: string, value: string) => FetchHeaderDecision;
   /**
    * Optional callback that returns extra cookies to persist into the shared
    * jar before `fetch` / `browse` attach it. Runs only when a jar is in
@@ -130,12 +145,6 @@ export interface HarneryProgramContext {
    * harn standalone skips the callback entirely.
    */
   extraCookies?: import("./lib/cookies/index.ts").ExtraCookies;
-  /**
-   * When it returns true for a run, `fetch` follows redirects itself so the
-   * cookie header, `extraHeaders`, and Set-Cookie persistence apply to every
-   * hop instead of only the first request.
-   */
-  clientRedirects?: () => boolean;
   /**
    * Called once per `browse` run. Returns the guard that inspects that
    * session's live cookies before each request, after each response, and at
@@ -340,10 +349,75 @@ export function createHarneryProgram(opts: HarneryContextOpts = {}): Command {
     bundle.commands.every((command) => !skip.has(commandName(command.command))),
   );
   registerLazyCommandBundles(program, bundles);
+  program.hook("preAction", async (_root, actionCommand) => {
+    await triggerAutoUpdate(actionCommand, opts.context);
+  });
 
   return program;
 }
 
+let autoUpdateTriggered = false;
+
+/** Top-level command name below the program for a Commander action command. */
+function topLevelCommandName(command: Command): string {
+  let current = command;
+  while (current.parent?.parent) current = current.parent;
+  return current.name();
+}
+
+/** Nearest enclosing directory carrying `.harnery/`, without spawning Git. */
+function cheapCoordRoot(context: HarneryProgramContext | undefined): string | null {
+  const override = coordEnv("COORD_ROOT_OVERRIDE");
+  if (override) return override;
+  if (context?.resolveCoordRoot) return context.resolveCoordRoot();
+  const starts = [process.env.CLAUDE_PROJECT_DIR, process.cwd()].filter(
+    (dir): dir is string => typeof dir === "string" && dir.length > 0,
+  );
+  for (const start of starts) {
+    let dir = resolve(start);
+    while (true) {
+      if (existsSync(join(dir, ".harnery"))) return dir;
+      const parent = dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+
+/**
+ * Host CLI activity fires the project self-update check (ADR 0229) once per
+ * process. A project without an `autoUpdate` section pays a directory walk
+ * and one small file read; the engine module loads only when the section is
+ * present. Never throws and never delays the command beyond the tick's stat.
+ */
+async function triggerAutoUpdate(
+  actionCommand: Command,
+  context: HarneryProgramContext | undefined,
+): Promise<void> {
+  if (autoUpdateTriggered) return;
+  autoUpdateTriggered = true;
+  try {
+    if (coordEnv("AUTOUPDATE_CHILD") === "1") return;
+    if (topLevelCommandName(actionCommand) === "autoupdate") return;
+    const root = cheapCoordRoot(context);
+    if (!root) return;
+    let text: string;
+    try {
+      text = readFileSync(join(root, ".harnery", "config.jsonc"), "utf8");
+    } catch {
+      return;
+    }
+    if (!text.includes('"autoUpdate"')) return;
+    const { readAutoUpdateConfig } = await import("./core/config.ts");
+    if (readAutoUpdateConfig(root)?.enabled !== true) return;
+    const { autoUpdateTick } = await import("./core/autoupdate/index.ts");
+    autoUpdateTick(root);
+  } catch {
+    // Self-update is best effort; the user's command always runs.
+  }
+}
+
 interface CommandBundleContext {
   emit: EmitContext;
   context: HarneryProgramContext | undefined;
@@ -545,6 +619,22 @@ function harneryCommandBundles({
       async (program) =>
         (await import("./commands/admission.ts")).registerAdmissionCommand(program, emit),
     ),
+    lazy(
+      "computer",
+      `Opt-in desktop control through a pinned desktop driver: \`computer status\`, \`install\`, \`up\`, \`call <tool> [json]\` under a desktop lease shared by every agent on the machine. Start with \`${binName} computer status\`.`,
+      async (program) =>
+        (await import("./commands/computer.ts")).registerComputerCommand(program, emit, binName),
+    ),
+    lazy(
+      "autoupdate",
+      `Activity-fired project self-update: \`autoupdate status\`, \`check\`, \`run\`. Configure steps under \`autoUpdate\` in .harnery/config.jsonc; start with \`${binName} autoupdate status\`.`,
+      async (program) =>
+        (await import("./commands/autoupdate.ts")).registerAutoUpdateCommand(
+          program,
+          emit,
+          binName,
+        ),
+    ),
     lazy(
       "browse-session",
       "Control an opted-in headed browse session through an owner-only descriptor",

package/src/commands/agents.ts

@@ -28,7 +28,7 @@ import { basename, join, resolve } from "node:path";
 import type { Command } from "commander";
 import type { EmitContext, HarneryProgramContext } from "../commander.ts";
 import type { Adapter } from "../core/adapter.ts";
-import { coordBinPath } from "../core/agents/coord-bin.ts";
+import { coordBinPath, spawnCoordBinSync } from "../core/agents/coord-bin.ts";
 import {
   checkGitFinalization,
   formatGitFinalizationFailure,
@@ -344,8 +344,14 @@ export function registerAgentsCommand(
 
   cmd
     .command("status")
-    .description("End-of-turn status box (name + session age + files held + peer count)")
+    .description(
+      "End-of-turn status box (name, task, lifecycle, files held, live peers, time; diagnostics only when they report a problem)",
+    )
     .option("--json", "JSON output instead of the box")
+    .option(
+      "--full",
+      "Print every diagnostic row (session age, changes, activity, parent, context, resources)",
+    )
     .option(
       "--end-turn",
       "Treat this as the turn's closing status: issue the box only when this session's held paths are committed and their repositories are pushed",
@@ -361,7 +367,13 @@ export function registerAgentsCommand(
         "The Stop hook payload includes session_id; pass it through.",
     )
     .action(
-      (opts: { endTurn?: boolean; endSession?: boolean; json?: boolean; sessionId?: string }) => {
+      (opts: {
+        endTurn?: boolean;
+        endSession?: boolean;
+        json?: boolean;
+        full?: boolean;
+        sessionId?: string;
+      }) => {
         runStatus(opts);
       },
     );
@@ -1915,7 +1927,7 @@ function ensureAdapterSession(root: string): void {
       : { source: "resume" }),
   });
 
-  spawnSync("bash", [agentHook, "session-start", "--adapter", bootstrap.adapter], {
+  spawnCoordBinSync(agentHook, ["session-start", "--adapter", bootstrap.adapter], {
     input: payload,
     cwd: root,
     encoding: "utf8",
@@ -1977,7 +1989,7 @@ function runReleaseClaim(path: string): void {
   if (path.startsWith(`${root}/`)) canonical = path.slice(root.length + 1);
 
   const helper = agentCoordOrExit(root);
-  const result = spawnSync(helper, ["release-claim", myOwner, canonical], {
+  const result = spawnCoordBinSync(helper, ["release-claim", myOwner, canonical], {
     encoding: "utf8",
     ...coordHelperOpts(root),
   });
@@ -2036,7 +2048,7 @@ function runSetTask(task: string, opts?: { sessionId?: string }): void {
 
   // Heartbeat mutation goes through agent-coord (atomic temp+rename).
   const helper = agentCoordOrExit(root);
-  const result = spawnSync(helper, ["set-task", myOwner, task], {
+  const result = spawnCoordBinSync(helper, ["set-task", myOwner, task], {
     encoding: "utf8",
     ...coordHelperOpts(root),
   });
@@ -2364,6 +2376,7 @@ function runStatus(opts: {
   endTurn?: boolean;
   endSession?: boolean;
   json?: boolean;
+  full?: boolean;
   sessionId?: string;
 }): void {
   const root = monorepoRoot();
@@ -2616,29 +2629,30 @@ function runStatus(opts: {
     return;
   }
 
-  const rows: Array<[string, string]> = [
-    ["session", formatAge(ageSecs)],
-    ...(turnElapsed ? ([["turn", turnElapsed.value]] as Array<[string, string]>) : []),
-    ["changes", turnChanges.value],
-    ["activity", activityOf(hb)],
-    ["lifecycle", lifecycleLabel(hb)],
-    ["parent", describeParentReference(data.parent_reference)],
-    ["context", ctxStr],
-    ["resources", formatResourceSummary(resources)],
-    ["files", filesStr],
-    ["peers", peersStr],
-    ["time", timeStr],
-  ];
-  // Task gets full text; formatBox word-wraps to MAX_BOX_CONTENT_WIDTH. It sits
-  // directly above `activity`, which keeps it under the session/turn clocks
-  // whether or not the turn row rendered.
-  if (hb.task && hb.task.length > 0) {
-    rows.splice(
-      rows.findIndex((row) => row[0] === "activity"),
-      0,
-      ["task", hb.task],
-    );
-  }
+  const contextPercent = !ctxUsage
+    ? null
+    : ctxUsage.percentOnly
+      ? ctxUsage.usedPercent
+      : (ctxUsage.used / ctxUsage.window) * 100;
+  const rows = statusBoxRows({
+    full: opts.full === true,
+    session: formatAge(ageSecs),
+    turn: turnElapsed?.value ?? null,
+    changes: turnChanges.value,
+    task: hb.task ?? "",
+    activity: activityOf(hb),
+    lifecycle: lifecycleLabel(hb),
+    parent: describeParentReference(data.parent_reference),
+    parentProblem: data.parent_reference.state === "conflict",
+    context: ctxStr,
+    contextProblem: contextPercent !== null && contextPercent >= STATUS_CONTEXT_WARN_PERCENT,
+    resources: formatResourceSummary(resources),
+    resourcesProblem:
+      resources.assessment.state === "elevated" || resources.assessment.state === "critical",
+    files: filesStr,
+    peers: peersStr,
+    time: timeStr,
+  });
   if (pendingCouncils.length > 0) {
     // Slot the council line right before `time` so it stays in the "what's
     // active for me" cluster of rows. Show the first ID + count; full list
@@ -2672,6 +2686,60 @@ function runStatus(opts: {
   process.stdout.write(`${formatBox(displayName, rows)}\n`); // lint-ok-emission: chat-paste path; emit.text() auto-suppresses non-TTY
 }
 
+/** Context use at which the compact status box adds its context row. */
+const STATUS_CONTEXT_WARN_PERCENT = 80;
+
+/**
+ * Rows of the status box. The compact default carries what an operator acts
+ * on (task, lifecycle, files held, live peers, time, with the turn duration
+ * beside the time); diagnostic rows appear only when they report a problem.
+ * `--full` restores every row. The Stop hook detects the box by its
+ * `┌─ agent-` title, never by a row, so trimming rows cannot break it.
+ */
+export function statusBoxRows(input: {
+  full: boolean;
+  session: string;
+  turn: string | null;
+  changes: string;
+  task: string;
+  activity: string;
+  lifecycle: string;
+  parent: string;
+  parentProblem: boolean;
+  context: string;
+  contextProblem: boolean;
+  resources: string;
+  resourcesProblem: boolean;
+  files: string;
+  peers: string;
+  time: string;
+}): Array<[string, string]> {
+  const task: Array<[string, string]> = input.task ? [["task", input.task]] : [];
+  if (input.full) {
+    return [
+      ["session", input.session],
+      ...(input.turn ? ([["turn", input.turn]] as Array<[string, string]>) : []),
+      ["changes", input.changes],
+      ...task,
+      ["activity", input.activity],
+      ["lifecycle", input.lifecycle],
+      ["parent", input.parent],
+      ["context", input.context],
+      ["resources", input.resources],
+      ["files", input.files],
+      ["peers", input.peers],
+      ["time", input.time],
+    ];
+  }
+  const rows: Array<[string, string]> = [...task, ["lifecycle", input.lifecycle]];
+  if (input.parentProblem) rows.push(["parent", input.parent]);
+  if (input.contextProblem) rows.push(["context", input.context]);
+  if (input.resourcesProblem) rows.push(["resources", input.resources]);
+  rows.push(["files", input.files], ["peers", input.peers]);
+  rows.push(["time", input.turn ? `${input.time} (turn ${input.turn})` : input.time]);
+  return rows;
+}
+
 function qualityForStatus(
   mode: "off" | "shadow" | "report",
   snapshot: RunQualitySnapshot | null,
@@ -4792,7 +4860,7 @@ function replayAdapterSamples(
       }
 
       const subcommand = EVENT_SUBCOMMAND[event] ?? event;
-      const dispatch = spawnSync("bash", [agentHook, subcommand, "--adapter", adapterFlag], {
+      const dispatch = spawnCoordBinSync(agentHook, [subcommand, "--adapter", adapterFlag], {
         cwd: sandbox,
         encoding: "utf8",
         input: JSON.stringify(payloadObj),
@@ -5371,7 +5439,7 @@ function runHeal(opts: {
 
   // Both recovery actions are handled by the bundled agent-coord binary.
   const helper = agentCoordOrExit(root);
-  let proc = spawnSync(helper, helperArgs, {
+  let proc = spawnCoordBinSync(helper, helperArgs, {
     encoding: "utf8",
     ...coordHelperOpts(root),
   });
@@ -5412,7 +5480,7 @@ function runHeal(opts: {
         "the current native session could not establish authority; no fallback cache was accepted",
       );
     }
-    proc = spawnSync(helper, helperArgs, {
+    proc = spawnCoordBinSync(helper, helperArgs, {
       encoding: "utf8",
       ...coordHelperOpts(root),
     });