harnery 0.5.0 → 0.7.0

package/dist/core/agents/events/consume.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consume.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/events/consume.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAmBH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,oEAAoE;IACpE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,aAAa,CA4CrF;AAwDD,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3D;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAQpE"}
+{"version":3,"file":"consume.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/events/consume.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAwBH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,oEAAoE;IACpE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,aAAa,CAuDrF;AAgBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAWtC;AAiDD,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3D;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAQpE"}

package/dist/core/agents/events/consume.js

@@ -11,8 +11,12 @@
  * with a bounded **tail read** (reading only the last `tailBytes` of the file
  * and locating the cursor there) which turns an O(file-size) read into
  * O(window). If the cursor is older than the window (a long-idle system, or a
- * cursor that's been rotated out) we fall back to a full read. The fallback is
- * always correct, just slower, so undersizing the window can never lose events.
+ * cursor that's been rotated out) we fall back to a wider read that is itself
+ * capped (`fallbackCapBytes`): the stream is an append-only ledger that grows
+ * without bound, so a whole-file `readFileSync` throws V8's max-string-length
+ * error ("Cannot create a string longer than 0x1fffffe8 characters") once it
+ * passes ~512MB, which would abort the projection. Events older than the cap are
+ * stale for coord-state purposes, so a bounded replay is the correct fallback.
  *
  * Idempotency: projectors are idempotent by `event_id`. The
  * cursor file makes this cheap (we never replay an already-projected event by
@@ -25,6 +29,11 @@ import { coordEnv } from "../../../lib/env.js";
 const STREAM_REL = ".harnery/events.ndjson";
 const CURSOR_REL = ".harnery/.events-cursor";
 const DEFAULT_TAIL_BYTES = 2 * 1024 * 1024; // 2 MiB, thousands of events of headroom
+/** Cap for the fall-through read when the cursor misses the tail window. Well
+ * under V8's ~512MB max string length so it never throws on the unbounded
+ * ledger; comfortably larger than any realistic cursor drift (the global cursor
+ * advances on every agent's turn.stop, so it sits near EOF in practice). */
+const DEFAULT_FALLBACK_CAP_BYTES = 64 * 1024 * 1024; // 64 MiB
 /**
  * Read all events after the persisted cursor, in chronological (file) order.
  */
@@ -54,8 +63,19 @@ export function consumeSince(coordRoot, opts = {}) {
         }
         // Cursor older than the tail window → fall through to a full read.
     }
-    // Full read: first run, replayAll, small file, or cursor not found in tail.
-    const all = parseLines(readFileSync(streamPath, "utf8"));
+    // Bounded fall-through: first run, replayAll, small file, or cursor not found
+    // in the tail. This must NEVER read the whole file: the stream grows without
+    // bound and a >512MB readFileSync throws V8's max-string-length error, which
+    // would abort the projection. Read at most `cap` bytes from the tail; when we
+    // start mid-file, drop the (likely partial) first line.
+    const cap = resolveFallbackCap(opts.fallbackCapBytes);
+    const readBytes = Math.min(fileSize, cap);
+    let text = readTailUtf8(streamPath, fileSize, readBytes);
+    if (readBytes < fileSize) {
+        const firstNl = text.indexOf("\n");
+        text = firstNl >= 0 ? text.slice(firstNl + 1) : "";
+    }
+    const all = parseLines(text);
     const parsed = eventsAfterCursor(all, cursor);
     if (parsed.foundCursor) {
         return {
@@ -64,11 +84,18 @@ export function consumeSince(coordRoot, opts = {}) {
             streamBytes: fileSize,
         };
     }
-    // The cursor names an event that's been rotated out of the file, so replay
-    // everything (safer than silent state drift; the projector is idempotent by
-    // event_id).
+    // The cursor names an event older than the capped window (or rotated out), so
+    // replay what the window holds (safer than silent state drift; the projector
+    // is idempotent by event_id). lastEventId null keeps the cursor put.
     return { events: all, lastEventId: null, streamBytes: fileSize };
 }
+function resolveFallbackCap(override) {
+    if (override !== undefined && override > 0)
+        return override;
+    const env = coordEnv("AGENT_COORD_FALLBACK_CAP_BYTES");
+    const n = env ? Number(env) : Number.NaN;
+    return Number.isFinite(n) && n > 0 ? n : DEFAULT_FALLBACK_CAP_BYTES;
+}
 function resolveTailBytes(override) {
     if (override !== undefined && override > 0)
         return override;
@@ -76,6 +103,27 @@ function resolveTailBytes(override) {
     const n = env ? Number(env) : Number.NaN;
     return Number.isFinite(n) && n > 0 ? n : DEFAULT_TAIL_BYTES;
 }
+/**
+ * Read at most `capBytes` from the tail of the event stream as UTF-8, dropping
+ * the (partial) leading line when the file is larger than the cap. Shared
+ * bounded reader for CLI consumers (`agents trace` / `agents health`) that must
+ * never `readFileSync` the whole unbounded ledger — a >512MB read throws V8's
+ * max-string-length error. `truncated` is true when older bytes were skipped, so
+ * callers can surface the cap rather than silently under-reporting.
+ */
+export function readStreamTailBounded(streamPath, capBytes) {
+    if (!existsSync(streamPath))
+        return { text: "", truncated: false };
+    const fileSize = statSync(streamPath).size;
+    const readBytes = Math.min(fileSize, capBytes);
+    let text = readTailUtf8(streamPath, fileSize, readBytes);
+    const truncated = readBytes < fileSize;
+    if (truncated) {
+        const nl = text.indexOf("\n");
+        text = nl >= 0 ? text.slice(nl + 1) : "";
+    }
+    return { text, truncated };
+}
 /** Read the trailing `windowBytes` of a file as UTF-8 without loading the rest. */
 function readTailUtf8(streamPath, fileSize, windowBytes) {
     const start = Math.max(0, fileSize - windowBytes);

package/dist/core/agents/events/emit.d.ts

@@ -5,7 +5,8 @@
  * event/schema types).
  *
  * Phase 4: agent-coord uses this from CLI handlers (state.task_set,
- * state.status_checked, state.scratch_append, council.*, presence.*).
+ * state.status_checked, state.scratch_append, council.*, decision.*,
+ * presence.*).
  */
 declare const SCHEMA_VERSION: 1;
 export type Harness = "claude-code" | "cursor" | "codex";

package/dist/core/agents/events/emit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/events/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,QAAA,MAAM,cAAc,EAAG,CAAU,CAAC;AAKlC,MAAM,MAAM,OAAO,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AACzD,MAAM,MAAM,MAAM,GAAG,aAAa,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvE,MAAM,WAAW,QAAQ;IACvB,cAAc,EAAE,OAAO,cAAc,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAexD;AAED,wBAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,QAAQ,CAwBlE"}
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/events/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,QAAA,MAAM,cAAc,EAAG,CAAU,CAAC;AAKlC,MAAM,MAAM,OAAO,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AACzD,MAAM,MAAM,MAAM,GAAG,aAAa,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvE,MAAM,WAAW,QAAQ;IACvB,cAAc,EAAE,OAAO,cAAc,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAexD;AAED,wBAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,QAAQ,CA4BlE"}

package/dist/core/agents/events/emit.js

@@ -5,10 +5,12 @@
  * event/schema types).
  *
  * Phase 4: agent-coord uses this from CLI handlers (state.task_set,
- * state.status_checked, state.scratch_append, council.*, presence.*).
+ * state.status_checked, state.scratch_append, council.*, decision.*,
+ * presence.*).
  */
 import { appendFileSync, closeSync, mkdirSync, openSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { maybeRotateEventStream } from "../../hooks/events/rotate.js";
 import { ulid } from "./ulid.js";
 const SCHEMA_VERSION = 1;
 const STREAM_FILE = ".harnery/events.ndjson";
@@ -34,6 +36,9 @@ export function emit(coordRoot, input) {
     const envelope = buildEnvelope(input);
     const streamPath = join(coordRoot, STREAM_FILE);
     const lockPath = join(coordRoot, LOCK_FILE);
+    // Size-triggered rotation (shared with the agent-hooks emitter): roll the
+    // active file to a dated archive when it crosses the cap. Fail-soft.
+    maybeRotateEventStream(coordRoot);
     ensureDir(dirname(streamPath));
     ensureFile(lockPath);
     let line = `${JSON.stringify(envelope)}\n`;

package/dist/core/agents/rules/claim-conflict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claim-conflict.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/rules/claim-conflict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAeF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,aAAa,CAyFjF"}
+{"version":3,"file":"claim-conflict.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/rules/claim-conflict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAeF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,aAAa,CAoGjF"}

package/dist/core/agents/rules/claim-conflict.js

@@ -58,10 +58,21 @@ export function evaluateClaim(coordRoot, req) {
     }
     // Ordering check: if we hold any claim with path < req.path, fine.
     // Otherwise the new claim would create a backward-edge in the dependency
-    // graph and risk deadlock. Only applies when there are OTHER fresh peers:
-    // single-agent flow can't deadlock with itself, and the rule otherwise
-    // forces release-and-reacquire cycles on every reverse-order edit pair.
-    const hasFreshPeers = otherPeers.some((p) => isFresh(p.last_heartbeat) && p.files_touched.length > 0);
+    // graph and risk deadlock. Only applies when a fresh peer genuinely CONTENDS
+    // with us — i.e. holds a path that also sits in our own footprint (held
+    // claims ∪ the path we're now requesting). A wait-for cycle is a
+    // strongly-connected set of agents linked by shared files; if no fresh peer
+    // shares any file with our footprint, we're in a disjoint component of the
+    // resource graph and cannot be part of any cycle, so sorted-order acquisition
+    // buys nothing and the block is pure false-positive friction. Sharing a file
+    // is the necessary condition for a cycle through this agent, so this narrowing
+    // leaves the deadlock-prevention invariant intact for genuine contention while
+    // removing the dominant real-world cost — a peer editing unrelated files
+    // walling off every backward-order edit. (Single-agent flow can't deadlock
+    // with itself and never arms, since there are no other peers to contend.)
+    const myFootprint = new Set(myPeer?.files_touched ?? []);
+    myFootprint.add(req.path);
+    const hasContendingPeer = otherPeers.some((p) => isFresh(p.last_heartbeat) && p.files_touched.some((f) => myFootprint.has(f)));
     // Re-editing a path already in our own files_touched acquires no new lock
     // edge, so it can't create a circular wait — the ordering rule must not block
     // it. Without this exemption, an agent that edits a higher-sorting file and
@@ -70,7 +81,7 @@ export function evaluateClaim(coordRoot, req) {
     // both agent-Gibson holding README.md and agent-Ophelia holding AGENTS.md were
     // blocked re-editing those held files after touching a higher path, 2026-07-03).
     const alreadyHeld = myPeer?.files_touched.includes(req.path) ?? false;
-    if (hasFreshPeers && myPeer && myPeer.files_touched.length > 0 && !alreadyHeld) {
+    if (hasContendingPeer && myPeer && myPeer.files_touched.length > 0 && !alreadyHeld) {
         // Only ACTIVE (uncommitted) edits should constrain lock ordering. A claim on
         // a committed-clean file is a finished edit, not a held lock, so it must not
         // wall off a lower-sorted acquisition. Without this, a long session

package/dist/core/agents/state/scratch.d.ts

@@ -16,7 +16,7 @@ export declare function appendScratch(coordRoot: string, instanceId: string, cat
 };
 /**
  * Replace the scratchpad with new body, archiving prior contents and
- * appending an "(edited via UI by Ryan)" audit-marker note.
+ * appending an "(edited via UI by the operator)" audit-marker note.
  */
 export declare function editScratchpad(coordRoot: string, instanceId: string, newBody: string, summary: string): {
     ok: boolean;

package/dist/core/agents/state/scratch.js

@@ -58,7 +58,7 @@ export function appendScratch(coordRoot, instanceId, category, body) {
 }
 /**
  * Replace the scratchpad with new body, archiving prior contents and
- * appending an "(edited via UI by Ryan)" audit-marker note.
+ * appending an "(edited via UI by the operator)" audit-marker note.
  */
 export function editScratchpad(coordRoot, instanceId, newBody, summary) {
     if (typeof newBody !== "string") {
@@ -82,7 +82,7 @@ export function editScratchpad(coordRoot, instanceId, newBody, summary) {
             prior += "\n";
     }
     const summaryText = summary && summary.length > 0 ? summary : "(no summary)";
-    const auditMarker = `## [${ts}] note (edited via UI by Ryan)\n` +
+    const auditMarker = `## [${ts}] note (edited via UI by the operator)\n` +
         `${summaryText}\n` +
         `Pre-edit archived at .harnery/scratch/archived/${instanceId}-${archiveSuffix}.md\n\n`;
     atomicWriteText(target, prior + auditMarker + newBody + (newBody.endsWith("\n") ? "" : "\n"));

package/dist/core/config.d.ts

@@ -26,6 +26,16 @@ export declare function stripJsonComments(input: string): string;
  * `coordRoot` is resolved via `findCoordRoot()` when not passed.
  */
 export declare function resolveBinName(coordRoot?: string | null): string;
+/**
+ * The binName explicitly pinned in `<projectRoot>/.harnery/config.jsonc`, or
+ * null when absent. Unlike `resolveBinName()` this ignores `HARNERY_BIN` and
+ * never falls back to the default — it answers "did someone deliberately pin
+ * a name for THIS project?". `init` uses it so a re-run from a different host
+ * CLI can't silently re-stamp its own name over a committed pin (the harnery
+ * repo itself pins `"harn"` while living embedded in a host monorepo whose
+ * CLI would otherwise stamp the host's name into public, committed surfaces).
+ */
+export declare function pinnedBinName(projectRoot: string): string | null;
 /**
  * The host's git-hook (re)install command, for the "commit guard not wired"
  * nudge. Returns the configured `hooksSetupHint` (e.g. "scripts/setup-hooks.sh")

package/dist/core/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAgBvC,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqCvD;AAyBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAShE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK9E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAgBvC,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqCvD;AAyBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAShE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK9E"}

package/dist/core/config.js

@@ -106,6 +106,19 @@ export function resolveBinName(coordRoot) {
     }
     return DEFAULT_BIN_NAME;
 }
+/**
+ * The binName explicitly pinned in `<projectRoot>/.harnery/config.jsonc`, or
+ * null when absent. Unlike `resolveBinName()` this ignores `HARNERY_BIN` and
+ * never falls back to the default — it answers "did someone deliberately pin
+ * a name for THIS project?". `init` uses it so a re-run from a different host
+ * CLI can't silently re-stamp its own name over a committed pin (the harnery
+ * repo itself pins `"harn"` while living embedded in a host monorepo whose
+ * CLI would otherwise stamp the host's name into public, committed surfaces).
+ */
+export function pinnedBinName(projectRoot) {
+    const binName = readConfig(projectRoot).binName;
+    return typeof binName === "string" && binName.trim() ? binName.trim() : null;
+}
 /**
  * The host's git-hook (re)install command, for the "commit guard not wired"
  * nudge. Returns the configured `hooksSetupHint` (e.g. "scripts/setup-hooks.sh")

package/dist/core/hooks/cli.js

@@ -26,7 +26,7 @@ import { consumeSince, writeCursor } from "../agents/events/consume.js";
 import { evaluateStopHook } from "../agents/rules/stop-hook.js";
 import { projectHeartbeats } from "../agents/state/heartbeat-projector.js";
 import { shellMutationPaths } from "../agents/state/shell-mutation.js";
-import { captureImages, detectPresence, imageJanitor, playSound, resetSoundCounters, runTurnSummary, scratchArchive, scratchJanitor, scratchRecoveryCue, soundForEvent, syncClaudeSessions, } from "./effects/index.js";
+import { captureImages, detectPresence, imageJanitor, playSound, resetSoundCounters, runSessionSyncExtension, runTurnSummary, scratchArchive, scratchJanitor, scratchRecoveryCue, soundForEvent, } from "./effects/index.js";
 import { emit } from "./events/emit.js";
 import { canonicalize } from "./guard-path.js";
 import { detectHarness } from "./harness/detect.js";
@@ -441,7 +441,7 @@ async function main() {
         // session-telemetry sync (via HARNERY_CLAUDE_SESSIONS_FORCE=1).
         if (harness === "claude-code") {
             scratchArchive(coordRoot, owner.instance_id);
-            syncClaudeSessions(coordRoot, true);
+            runSessionSyncExtension(coordRoot, true);
         }
     }
     // Phase 8: SubagentStart: sync-project to create the subagent heartbeat,
@@ -528,7 +528,7 @@ async function main() {
         // CC effects: rate-limited session-telemetry sync + turn-summary Haiku
         // auto-summary.
         if (harness === "claude-code") {
-            syncClaudeSessions(coordRoot, false);
+            runSessionSyncExtension(coordRoot, false);
             runTurnSummary(coordRoot, owner.instance_id, sessionId, payload?.transcript_path);
         }
         // Master-state heartbeat projection. Drains events.ndjson since the last

package/dist/core/hooks/effects/index.d.ts

@@ -37,14 +37,18 @@ export declare function scratchRecoveryCue(repoRoot: string): string;
 /** Archive the ending agent's scratchpad. Fire-and-forget. */
 export declare function scratchArchive(repoRoot: string, owner: string): void;
 /**
- * Sync Claude Code session JSONL → BigQuery (`harn claude-sessions sync`). Lives
- * in the host CLI (parses Claude Code's own ~/.claude/projects/**\/*.jsonl), so harnery
- * shells out to the harn binary rather than importing it. Detached + unref'd so a
- * slow BigQuery round-trip never blocks the hook. Stop-path syncs are rate-
- * limited inside `harn claude-sessions sync`; SessionEnd forces via env. Caller
- * gates to the claude-code harness.
+ * Fire the optional host session-sync extension on turn stop / session end.
+ * harnery core has no session-telemetry sink of its own; a host that wants one
+ * drops an executable at
+ * `scripts/hooks/harness/claude_code/extensions/session-sync.sh` under the coord
+ * root, and core runs it detached + unref'd so a slow sink never blocks the
+ * hook. `force` arrives as argv $1 ("1" on session end, "0" on turn stop) so the
+ * host can rate-limit the stop path and force-flush on end. No-op when the
+ * script is absent, so a plain public install spawns nothing. Mirrors
+ * `runTurnSummary`'s extension-script pattern. Caller gates to the claude-code
+ * harness.
  */
-export declare function syncClaudeSessions(repoRoot: string, force: boolean): void;
+export declare function runSessionSyncExtension(repoRoot: string, force: boolean): void;
 /**
  * Fire the turn-summary extension (Haiku auto-summary of the turn → heartbeat
  * `turn_summary`). Detached + unref'd; it makes an Anthropic API call and must

package/dist/core/hooks/effects/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/effects/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,SAAI,GACX,IAAI,CAYN;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW3F;AAOD,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAYrD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAa3D;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAYpE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAkBzE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,IAAI,CAqBN;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAa1D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAOnD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/effects/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,SAAI,GACX,IAAI,CAYN;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW3F;AAOD,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAYrD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAa3D;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAYpE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAqB9E;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,IAAI,CAqBN;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAa1D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAOnD"}

package/dist/core/hooks/effects/index.js

@@ -110,26 +110,24 @@ export function scratchArchive(repoRoot, owner) {
     }
 }
 /**
- * Sync Claude Code session JSONL → BigQuery (`harn claude-sessions sync`). Lives
- * in the host CLI (parses Claude Code's own ~/.claude/projects/**\/*.jsonl), so harnery
- * shells out to the harn binary rather than importing it. Detached + unref'd so a
- * slow BigQuery round-trip never blocks the hook. Stop-path syncs are rate-
- * limited inside `harn claude-sessions sync`; SessionEnd forces via env. Caller
- * gates to the claude-code harness.
+ * Fire the optional host session-sync extension on turn stop / session end.
+ * harnery core has no session-telemetry sink of its own; a host that wants one
+ * drops an executable at
+ * `scripts/hooks/harness/claude_code/extensions/session-sync.sh` under the coord
+ * root, and core runs it detached + unref'd so a slow sink never blocks the
+ * hook. `force` arrives as argv $1 ("1" on session end, "0" on turn stop) so the
+ * host can rate-limit the stop path and force-flush on end. No-op when the
+ * script is absent, so a plain public install spawns nothing. Mirrors
+ * `runTurnSummary`'s extension-script pattern. Caller gates to the claude-code
+ * harness.
  */
-export function syncClaudeSessions(repoRoot, force) {
+export function runSessionSyncExtension(repoRoot, force) {
     try {
-        const bin = join(repoRoot, "bin", "bp");
-        if (!existsSync(bin))
+        const script = join(repoRoot, "scripts", "hooks", "harness", "claude_code", "extensions", "session-sync.sh");
+        if (!existsSync(script))
             return;
-        const env = {
-            ...process.env,
-            HARNERY_OUTPUT_SESSION_TEE: "0",
-        };
-        if (force)
-            env.HARNERY_CLAUDE_SESSIONS_FORCE = "1";
-        const child = spawn("bash", [bin, "claude-sessions", "sync", "--quiet"], {
-            env,
+        const child = spawn("bash", [script, force ? "1" : "0"], {
+            env: { ...process.env, HARNERY_OUTPUT_SESSION_TEE: "0" },
             detached: true,
             stdio: "ignore",
         });

package/dist/core/hooks/events/emit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/events/emit.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,OAAO,EAEZ,KAAK,MAAM,EACZ,MAAM,aAAa,CAAC;AAQrB,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK;IACvD,UAAU,EAAE,KAAK,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,KAAK,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK,EAC1D,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAC7B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAe7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,IAAI,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK,EACjD,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAC7B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAqC7B"}
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/events/emit.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,OAAO,EAEZ,KAAK,MAAM,EACZ,MAAM,aAAa,CAAC;AAQrB,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK;IACvD,UAAU,EAAE,KAAK,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,KAAK,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK,EAC1D,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAC7B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAe7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,IAAI,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK,EACjD,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAC7B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAyC7B"}

package/dist/core/hooks/events/emit.js

@@ -1,5 +1,6 @@
 import { appendFileSync, closeSync, mkdirSync, openSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { maybeRotateEventStream } from "./rotate.js";
 import { SCHEMA_VERSION, } from "./schema.js";
 import { ulid } from "./ulid.js";
 const LOCK_FILE = ".harnery/events.ndjson.lock";
@@ -40,6 +41,9 @@ export function emit(coordRoot, input) {
     const envelope = buildEnvelope(input);
     const streamPath = join(coordRoot, STREAM_FILE);
     const lockPath = join(coordRoot, LOCK_FILE);
+    // Size-triggered rotation: roll the active file to a dated archive when it
+    // crosses the cap, so this append lands in a bounded fresh file. Fail-soft.
+    maybeRotateEventStream(coordRoot);
     ensureDir(dirname(streamPath));
     ensureFile(lockPath);
     let line = `${JSON.stringify(envelope)}\n`;

package/dist/core/hooks/events/rotate.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Size-triggered rotation for the canonical event stream
+ * `.harnery/events.ndjson`.
+ *
+ * The stream is a deliberately-immutable, append-only ledger. Left unbounded it
+ * grows past V8's ~512MB max string length, at which point any code that does a
+ * whole-file `readFileSync` throws ("Cannot create a string longer than
+ * 0x1fffffe8 characters"). Rather than police every current + future reader,
+ * we bound the *active* file: once it crosses a byte cap we rename it to a dated
+ * archive (`events-YYYY-MM-DD.ndjson`) and start a fresh active file. Archives
+ * are kept — the audit trail is preserved, just spread across files that readers
+ * glob newest-first.
+ *
+ * Both independent append paths (agent-hooks `hooks/events/emit.ts` and
+ * agent-coord `agents/events/emit.ts`) call `maybeRotateEventStream` before
+ * appending, so a roll is triggered continuously, not only at session
+ * boundaries.
+ *
+ * Concurrency: many short-lived hook processes append at once. The rename itself
+ * is atomic — a concurrent appender opening the path by name lands its line in
+ * whichever inode the name currently resolves to (old archive or new active
+ * file), never nowhere. The only hazard is two processes both renaming (the
+ * second would move the fresh empty file to a second archive name), which an
+ * `O_EXCL` roll-lock prevents.
+ *
+ * Design + rationale: harnery ADR 0009; decision docket
+ * `should-harnery-adopt-a-retention-2026-07-07-ed07`.
+ */
+/** Archive glob prefix. Readers enumerate `events-*.ndjson` newest-first.
+ * The pre-existing manual `events-legacy.ndjson` matches and is picked up for
+ * free. Kept in sync with the reader-side pattern in web/lib/coord-reader.ts. */
+export declare const ARCHIVE_PREFIX = "events-";
+export declare const ARCHIVE_SUFFIX = ".ndjson";
+/**
+ * Roll `events.ndjson` to a dated archive when it exceeds the byte cap. Cheap
+ * no-op (a single `statSync`) below the cap. Fail-soft: any error is swallowed
+ * so a rotation problem can never break the append that triggered it.
+ *
+ * `nowMs` is injectable for the stale-lock check in tests; production leaves it
+ * unset (the roll date always comes from the file's mtime, never `nowMs`).
+ */
+export declare function maybeRotateEventStream(coordRoot: string, nowMs?: number): boolean;
+//# sourceMappingURL=rotate.d.ts.map

package/dist/core/hooks/events/rotate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/events/rotate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAyBH;;iFAEiF;AACjF,eAAO,MAAM,cAAc,YAAY,CAAC;AACxC,eAAO,MAAM,cAAc,YAAY,CAAC;AA6BxC;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAmCjF"}

package/dist/core/hooks/events/rotate.js

@@ -0,0 +1,142 @@
+/**
+ * Size-triggered rotation for the canonical event stream
+ * `.harnery/events.ndjson`.
+ *
+ * The stream is a deliberately-immutable, append-only ledger. Left unbounded it
+ * grows past V8's ~512MB max string length, at which point any code that does a
+ * whole-file `readFileSync` throws ("Cannot create a string longer than
+ * 0x1fffffe8 characters"). Rather than police every current + future reader,
+ * we bound the *active* file: once it crosses a byte cap we rename it to a dated
+ * archive (`events-YYYY-MM-DD.ndjson`) and start a fresh active file. Archives
+ * are kept — the audit trail is preserved, just spread across files that readers
+ * glob newest-first.
+ *
+ * Both independent append paths (agent-hooks `hooks/events/emit.ts` and
+ * agent-coord `agents/events/emit.ts`) call `maybeRotateEventStream` before
+ * appending, so a roll is triggered continuously, not only at session
+ * boundaries.
+ *
+ * Concurrency: many short-lived hook processes append at once. The rename itself
+ * is atomic — a concurrent appender opening the path by name lands its line in
+ * whichever inode the name currently resolves to (old archive or new active
+ * file), never nowhere. The only hazard is two processes both renaming (the
+ * second would move the fresh empty file to a second archive name), which an
+ * `O_EXCL` roll-lock prevents.
+ *
+ * Design + rationale: harnery ADR 0009; decision docket
+ * `should-harnery-adopt-a-retention-2026-07-07-ed07`.
+ */
+import { closeSync, existsSync, mkdirSync, openSync, renameSync, statSync, unlinkSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { coordEnv } from "../../../lib/env.js";
+const STREAM_FILE = ".harnery/events.ndjson";
+const ROLL_LOCK_FILE = ".harnery/events.ndjson.roll.lock";
+/** Default active-file cap: 256 MiB — half of V8's ~512MB string cliff, so even
+ * a reader that loads the whole active file whole stays clear of the limit. */
+const DEFAULT_ROLL_BYTES = 256 * 1024 * 1024;
+/** A roll-lock older than this is treated as abandoned (a crashed roller) and
+ * stolen. Rolls are sub-millisecond, so 60s is orders of magnitude of slack. */
+const STALE_LOCK_MS = 60_000;
+/** Archive glob prefix. Readers enumerate `events-*.ndjson` newest-first.
+ * The pre-existing manual `events-legacy.ndjson` matches and is picked up for
+ * free. Kept in sync with the reader-side pattern in web/lib/coord-reader.ts. */
+export const ARCHIVE_PREFIX = "events-";
+export const ARCHIVE_SUFFIX = ".ndjson";
+function resolveRollBytes() {
+    const env = coordEnv("EVENTS_ROLL_BYTES");
+    const n = env ? Number(env) : Number.NaN;
+    return Number.isFinite(n) && n > 0 ? n : DEFAULT_ROLL_BYTES;
+}
+/** `YYYY-MM-DD` (UTC) from a millisecond timestamp. Uses the file's own mtime
+ * rather than `Date.now()` so it's deterministic and independent of the harness
+ * runtime's clock surface. */
+function utcDateStamp(mtimeMs) {
+    const d = new Date(mtimeMs);
+    const y = d.getUTCFullYear();
+    const mo = String(d.getUTCMonth() + 1).padStart(2, "0");
+    const day = String(d.getUTCDate()).padStart(2, "0");
+    return `${y}-${mo}-${day}`;
+}
+/** First non-colliding `events-<stamp>[.N].ndjson` path under `coordDir`. */
+function archivePathFor(coordDir, stamp) {
+    const base = join(coordDir, `${ARCHIVE_PREFIX}${stamp}${ARCHIVE_SUFFIX}`);
+    if (!existsSync(base))
+        return base;
+    for (let n = 1;; n++) {
+        const cand = join(coordDir, `${ARCHIVE_PREFIX}${stamp}.${n}${ARCHIVE_SUFFIX}`);
+        if (!existsSync(cand))
+            return cand;
+    }
+}
+/**
+ * Roll `events.ndjson` to a dated archive when it exceeds the byte cap. Cheap
+ * no-op (a single `statSync`) below the cap. Fail-soft: any error is swallowed
+ * so a rotation problem can never break the append that triggered it.
+ *
+ * `nowMs` is injectable for the stale-lock check in tests; production leaves it
+ * unset (the roll date always comes from the file's mtime, never `nowMs`).
+ */
+export function maybeRotateEventStream(coordRoot, nowMs) {
+    try {
+        const streamPath = join(coordRoot, STREAM_FILE);
+        if (!existsSync(streamPath))
+            return false;
+        const cap = resolveRollBytes();
+        let st = statSync(streamPath);
+        if (st.size < cap)
+            return false;
+        const coordDir = dirname(streamPath);
+        const lockPath = join(coordRoot, ROLL_LOCK_FILE);
+        mkdirSync(coordDir, { recursive: true });
+        if (!acquireRollLock(lockPath, nowMs))
+            return false; // another roller active
+        try {
+            // Re-check under the lock: a concurrent process may have just rolled.
+            if (!existsSync(streamPath))
+                return false;
+            st = statSync(streamPath);
+            if (st.size < cap)
+                return false;
+            const archive = archivePathFor(coordDir, utcDateStamp(st.mtimeMs));
+            renameSync(streamPath, archive);
+            // Recreate an empty active file so the very next append (and any reader's
+            // existsSync) sees a valid, present stream.
+            closeSync(openSync(streamPath, "a"));
+            return true;
+        }
+        finally {
+            try {
+                unlinkSync(lockPath);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+    }
+    catch {
+        return false; // fail-soft: never break the caller's append
+    }
+}
+/** Create the roll-lock with O_EXCL. Returns true on acquisition. On collision,
+ * steals a stale lock (crashed roller) once, else returns false. */
+function acquireRollLock(lockPath, nowMs) {
+    try {
+        closeSync(openSync(lockPath, "wx"));
+        return true;
+    }
+    catch {
+        // Exists: steal if abandoned.
+        try {
+            const age = (nowMs ?? Date.now()) - statSync(lockPath).mtimeMs;
+            if (age > STALE_LOCK_MS) {
+                unlinkSync(lockPath);
+                closeSync(openSync(lockPath, "wx"));
+                return true;
+            }
+        }
+        catch {
+            /* lost the steal race — someone else holds it */
+        }
+        return false;
+    }
+}

package/dist/core/hooks/harness/events.d.ts

@@ -30,6 +30,12 @@ export interface HarnessSpec {
     entryShape: HookEntryShape;
     /** When set, ensure this top-level `version` key in the file (Cursor requires `1`). */
     rootVersion?: number;
+    /** Harness-owned entries from older specs that `init` should remove during migration. */
+    legacyEvents?: HookEvent[];
+    /** Strict top-level settings keys accepted by this harness, when its parser is closed. */
+    allowedTopLevelKeys?: string[];
+    /** Strict hook event keys accepted by this harness, including events harnery does not wire. */
+    allowedEventKeys?: string[];
 }
 /** Claude Code: `.claude/settings.json`. */
 export declare const CLAUDE_CODE_EVENTS: HookEvent[];
@@ -38,8 +44,12 @@ export declare const CLAUDE_CODE_EVENTS: HookEvent[];
  * no `StopFailure` event, but a distinct `beforeShellExecution` (shell-mutation warn).
  */
 export declare const CURSOR_EVENTS: HookEvent[];
-/** Codex: `.codex/hooks.json`. PascalCase keys + the same entry shape as Claude Code. */
+/** Codex events that harnery uses from the current native lifecycle surface. */
 export declare const CODEX_EVENTS: HookEvent[];
+/** Entries written by harnery before Codex adopted a strict native hook schema. */
+export declare const LEGACY_CODEX_EVENTS: HookEvent[];
+/** Every hook key accepted by Codex 0.144, including events harnery does not consume. */
+export declare const CODEX_ALLOWED_EVENT_KEYS: string[];
 /** Every supported harness, fully wireable by `harn init`. */
 export declare const HARNESS_SPECS: Record<HarnessId, HarnessSpec>;
 //# sourceMappingURL=events.d.ts.map

package/dist/core/hooks/harness/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/harness/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,SAAS;IACxB,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,cAAc,CAAC;IAC3B,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,SAAS,EAWzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,EAWpC,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,YAAY,EAAE,SAAS,EAWnC,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,CAiBxD,CAAC"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/harness/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,SAAS;IACxB,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,cAAc,CAAC;IAC3B,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,SAAS,EAWzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,EAWpC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,EAAE,SAAS,EAQnC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,EAAE,SAAS,EAI1C,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,wBAAwB,UAWpC,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,CAoBxD,CAAC"}