harness-everything 0.11.2 → 0.11.4

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.11.2",
+      "version": "0.11.4",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.11.4](https://github.com/dyphn1/Harness-everything/compare/v0.11.3...v0.11.4) (2026-09-18)
+
+### Bug Fixes
+
+* **workflow:** Stop classifyShell misclassifying safe read-only chains as mutations ([96d687a](https://github.com/dyphn1/Harness-everything/commit/96d687ab4437ab19e3a743d1b9bf5113cfe52525)), closes [82/#149](https://github.com/82/Harness-everything/issues/149) [#155](https://github.com/dyphn1/Harness-everything/issues/155) [#82](https://github.com/dyphn1/Harness-everything/issues/82) [#133](https://github.com/dyphn1/Harness-everything/issues/133) [#149](https://github.com/dyphn1/Harness-everything/issues/149) [#153](https://github.com/dyphn1/Harness-everything/issues/153)
+
+## [0.11.3](https://github.com/dyphn1/Harness-everything/compare/v0.11.2...v0.11.3) (2026-09-18)
+
+### Bug Fixes
+
+* **workflow:** Resolve verification-after-edit-missing without a host exit code ([e5dae03](https://github.com/dyphn1/Harness-everything/commit/e5dae03799cca594ac3e4f9d0facca6209dec3c8)), closes [#153](https://github.com/dyphn1/Harness-everything/issues/153)
+
 ## [0.11.2](https://github.com/dyphn1/Harness-everything/compare/v0.11.1...v0.11.2) (2026-09-18)
 
 ### Bug Fixes

package/ci/mechanism-2af-worktree-isolation.test.js

@@ -106,6 +106,40 @@ try {
   const readOnly = runGate('Bash', repo, { command: 'git status --short' });
   check(readOnly.status === 0, 'read-only discovery remains allowed before isolation');
 
+  // #82-family follow-up: chaining/redirects that are hidden behind the old
+  // blanket metacharacter reject must stay blocked, but a compound command
+  // whose every segment is independently trusted read-only must not burn
+  // iteration budget or the mutation-timestamp just because it uses `;`,
+  // `&&`, `|`, or a non-writing `2>&1` redirect.
+  for (const command of [
+    'git status --short; git log --oneline -1',
+    'git status --short && git log --oneline -1',
+    'git log --oneline -1 | head -1',
+    'echo hello',
+    'echo hello; git status --short',
+    'git status --short 2>&1',
+    'gh issue view 1 --repo octocat/hello-world --json number,title 2>&1',
+    'gh pr list --repo octocat/hello-world --json number | head -1',
+    'gh repo view octocat/hello-world --json name',
+    'gh auth status',
+    'cat README.md | grep fixture',
+  ]) {
+    check(runGate('Bash', repo, { command }).status === 0, `trusted read-only chain remains allowed: ${command}`);
+  }
+
+  for (const command of [
+    'git status --short; rm -rf src',
+    'git status --short | rm -rf src',
+    'echo hi & rm -rf src',
+    'git status --short > tracked.txt',
+    'git status --short 2>tracked.txt',
+    'git worktree add "harness-chain-probe" -b harness-chain-probe; rm -rf src',
+    'gh issue comment 1 --body hi',
+    'gh issue close 1',
+  ]) {
+    check(runGate('Bash', repo, { command }).status === 2, `chained/redirected command is not read-only: ${command}`);
+  }
+
   const setup = runGate('Bash', repo, { command: `git worktree add "${linked}" -b harness-isolation-test` });
   check(setup.status === 0, 'git worktree creation is allowed as the isolation transition');
 

package/ci/mechanism-2ah-workflow-lifecycle.test.js

@@ -175,8 +175,11 @@ try {
   check(stop().status === 2, 'direct/iterative route cannot complete unverified mutation');
   check(stop({ stop_hook_active: true }).status === 0 && read(file).state === 'blocked', 'iterative retry reports incomplete state');
   check(control('start').status === 0, 'blocked iterative route can resume without a Fable stage map');
+  // Issue #153: a host is not guaranteed to report a numeric exit code at
+  // all (state-persist.js's own isFailed logic already treats "no exit code
+  // and no stderr" as success), so this must resolve rather than deadlock.
   node('hooks/scripts/state-persist.js', { ...payload, tool_name: 'Bash', tool_input: { command: 'npm test' }, tool_response: { stdout: 'no code' } });
-  check(stop().status === 2, 'verification without numeric exit status is unknown');
+  check(stop().status === 0 && read(file).state === 'satisfied', 'verification without a host-reported numeric exit status still resolves completion');
   node('hooks/scripts/state-persist.js', { ...payload, tool_name: 'Bash', tool_input: { command: 'npm test' }, tool_response: { exitCode: 0, stdout: 'passed' } });
   check(stop().status === 0 && read(file).state === 'satisfied', 'observed iterative verification resolves completion');
   console.log(`PASS: workflow lifecycle (${passed} assertions)`);

package/ci/mechanism-2f-stop-gate.test.js

@@ -20,4 +20,57 @@ helper.check(
 );
 fs.unlinkSync(dirtyFile);
 
+console.log('\n[2f] workflow-stop-gate (iterative-single) verification signal...');
+
+const now = Date.now();
+
+// Bug reproduction (issue #153): a verify-classified command that genuinely
+// succeeded but whose host never reported a numeric exit code (observed on
+// at least one live host - state-persist.js writes lastVerifyExitCode: null
+// for any non-failing command when the PostToolUse payload has no numeric
+// exitCode) must not be treated as unverified.
+helper.writeState('workflow-run.json', {
+  schemaVersion: 1, sessionId: helper.SESSION_ID, strategy: 'iterative-single',
+  state: 'running', lastMutationAt: now - 5000,
+});
+helper.writeState('handoff-state.json', {
+  status: 'idle', lastEditAt: now - 5000, lastVerifyAt: now, lastVerifyExitCode: null,
+});
+const hostExitCodeUnavailable = helper.runHook('workflow-stop-gate.js', { session_id: helper.SESSION_ID });
+helper.check(
+  '2f. workflow-stop-gate resolves when verify ran after edit even without a numeric exit code',
+  hostExitCodeUnavailable.code === 0 && helper.readState('workflow-run.json').state === 'satisfied',
+  `Got exit=${hostExitCodeUnavailable.code}, stderr="${hostExitCodeUnavailable.stderr.slice(0, 300)}"`
+);
+
+// Regression guard: explicit exit 0 (host does report it) must still resolve.
+helper.writeState('workflow-run.json', {
+  schemaVersion: 1, sessionId: helper.SESSION_ID, strategy: 'iterative-single',
+  state: 'running', lastMutationAt: now - 5000,
+});
+helper.writeState('handoff-state.json', {
+  status: 'idle', lastEditAt: now - 5000, lastVerifyAt: now, lastVerifyExitCode: 0,
+});
+const hostExitCodeReported = helper.runHook('workflow-stop-gate.js', { session_id: helper.SESSION_ID });
+helper.check(
+  '2f. workflow-stop-gate still resolves when the host does report exit code 0',
+  hostExitCodeReported.code === 0 && helper.readState('workflow-run.json').state === 'satisfied',
+  `Got exit=${hostExitCodeReported.code}`
+);
+
+// Negative control: no verification ran after the edit at all -> stays blocked.
+helper.writeState('workflow-run.json', {
+  schemaVersion: 1, sessionId: helper.SESSION_ID, strategy: 'iterative-single',
+  state: 'running', lastMutationAt: now,
+});
+helper.writeState('handoff-state.json', {
+  status: 'idle', lastEditAt: now, lastVerifyAt: now - 5000, lastVerifyExitCode: null,
+});
+const staleVerify = helper.runHook('workflow-stop-gate.js', { session_id: helper.SESSION_ID });
+helper.check(
+  '2f. workflow-stop-gate still blocks when no verification ran after the edit',
+  staleVerify.code === 2 && staleVerify.stderr.includes('verification-after-edit-missing'),
+  `Got exit=${staleVerify.code}, stderr="${staleVerify.stderr.slice(0, 300)}"`
+);
+
 helper.finish();

package/hooks/scripts/lib/workflow-isolation.js

@@ -43,16 +43,34 @@ function linkedWorktree(cwd, boundRoot) {
   return worktrees.some(field => field.startsWith('worktree ') && key(field.slice(9)) === key(top)) ? top : null;
 }
 
-// A conservative read subset, not a general shell sandbox.
+// A conservative read subset, not a general shell sandbox. Chaining (`;`, `&&`,
+// `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect are permitted only
+// when every resulting segment independently matches the trusted read-only set
+// below; any other metacharacter (substitution, grouping, a lone `&`, a file
+// redirect, `<`) still forces mutation-or-unknown for the whole command.
+const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/;
+const SAFE_FD_REDIRECT_RE = /[12]>&[12]/g;
+const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
+const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
+
+function isReadOnlySegment(segment) {
+  return READ_ONLY_PREFIX_RE.test(segment) && !DANGEROUS_FLAG_RE.test(segment);
+}
+
 function classifyShell(command) {
   const text = String(command || '').trim();
-  if (!text || /[;&|`\r\n<>$(){}\x00]/.test(text)) return 'mutation-or-unknown';
-  if (/^git\s+worktree\s+add\s+/i.test(text) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(text)) return 'worktree-setup';
-  if (/\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i.test(text)) return 'mutation-or-unknown';
-  if (/^git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)/i.test(text) ||
-      /^git\s+branch\s+--show-current$/i.test(text) || /^git\s+worktree\s+list(?:\s|$)/i.test(text) ||
-      /^(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$)/i.test(text)) return 'read-only';
-  return 'mutation-or-unknown';
+  if (!text || /[`$(){}\r\n\x00]/.test(text)) return 'mutation-or-unknown';
+  // Strip the safe `2>&1`/`1>&2` fd-duplication redirect first: it contains a
+  // literal `&` that must not be mistaken for a lone backgrounding `&`.
+  const withoutSafeRedirects = text.replace(SAFE_FD_REDIRECT_RE, ' ');
+  if (/&/.test(withoutSafeRedirects.replace(/&&/g, ''))) return 'mutation-or-unknown';
+  if (/[<>]/.test(withoutSafeRedirects)) return 'mutation-or-unknown';
+  const segments = text.split(SHELL_SEPARATOR_RE).map(segment => segment.replace(SAFE_FD_REDIRECT_RE, '').trim());
+  if (segments.length === 1) {
+    if (/^git\s+worktree\s+add\s+/i.test(segments[0]) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(segments[0])) return 'worktree-setup';
+    return isReadOnlySegment(segments[0]) ? 'read-only' : 'mutation-or-unknown';
+  }
+  return segments.every(segment => segment && isReadOnlySegment(segment)) ? 'read-only' : 'mutation-or-unknown';
 }
 
 function inputOf(payload) { return payload?.tool_input ?? payload?.toolInput ?? payload?.input ?? {}; }

package/hooks/scripts/workflow-stop-gate.js

@@ -21,7 +21,15 @@ function decide(payload) {
   } else {
     const handoff = readJson(path.join(sessionDir, 'handoff-state.json'));
     const lastEdit = Math.max(workflow.lastMutationAt || 0, handoff?.lastEditAt || 0);
-    if (lastEdit && ((handoff?.lastVerifyAt || 0) < lastEdit || handoff?.lastVerifyExitCode !== 0)) unresolved = ['verification-after-edit-missing'];
+    // state-persist.js only ever records lastVerifyAt/lastVerifyExitCode from
+    // its `!isFailed` branch, so reaching this timestamp already proves the
+    // command succeeded. Do not additionally require lastVerifyExitCode===0:
+    // hosts are not guaranteed to report a numeric exit code at all (some
+    // PostToolUse payloads omit it entirely), in which case state-persist.js
+    // correctly records success with lastVerifyExitCode: null, and requiring
+    // a literal 0 here would make this gate permanently unresolvable on that
+    // host after any edit.
+    if (lastEdit && (handoff?.lastVerifyAt || 0) < lastEdit) unresolved = ['verification-after-edit-missing'];
   }
   if (unresolved.length) {
     workflow.unresolved = unresolved;

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/workflow-isolation.js

@@ -43,16 +43,34 @@ function linkedWorktree(cwd, boundRoot) {
   return worktrees.some(field => field.startsWith('worktree ') && key(field.slice(9)) === key(top)) ? top : null;
 }
 
-// A conservative read subset, not a general shell sandbox.
+// A conservative read subset, not a general shell sandbox. Chaining (`;`, `&&`,
+// `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect are permitted only
+// when every resulting segment independently matches the trusted read-only set
+// below; any other metacharacter (substitution, grouping, a lone `&`, a file
+// redirect, `<`) still forces mutation-or-unknown for the whole command.
+const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/;
+const SAFE_FD_REDIRECT_RE = /[12]>&[12]/g;
+const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
+const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
+
+function isReadOnlySegment(segment) {
+  return READ_ONLY_PREFIX_RE.test(segment) && !DANGEROUS_FLAG_RE.test(segment);
+}
+
 function classifyShell(command) {
   const text = String(command || '').trim();
-  if (!text || /[;&|`\r\n<>$(){}\x00]/.test(text)) return 'mutation-or-unknown';
-  if (/^git\s+worktree\s+add\s+/i.test(text) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(text)) return 'worktree-setup';
-  if (/\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i.test(text)) return 'mutation-or-unknown';
-  if (/^git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)/i.test(text) ||
-      /^git\s+branch\s+--show-current$/i.test(text) || /^git\s+worktree\s+list(?:\s|$)/i.test(text) ||
-      /^(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$)/i.test(text)) return 'read-only';
-  return 'mutation-or-unknown';
+  if (!text || /[`$(){}\r\n\x00]/.test(text)) return 'mutation-or-unknown';
+  // Strip the safe `2>&1`/`1>&2` fd-duplication redirect first: it contains a
+  // literal `&` that must not be mistaken for a lone backgrounding `&`.
+  const withoutSafeRedirects = text.replace(SAFE_FD_REDIRECT_RE, ' ');
+  if (/&/.test(withoutSafeRedirects.replace(/&&/g, ''))) return 'mutation-or-unknown';
+  if (/[<>]/.test(withoutSafeRedirects)) return 'mutation-or-unknown';
+  const segments = text.split(SHELL_SEPARATOR_RE).map(segment => segment.replace(SAFE_FD_REDIRECT_RE, '').trim());
+  if (segments.length === 1) {
+    if (/^git\s+worktree\s+add\s+/i.test(segments[0]) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(segments[0])) return 'worktree-setup';
+    return isReadOnlySegment(segments[0]) ? 'read-only' : 'mutation-or-unknown';
+  }
+  return segments.every(segment => segment && isReadOnlySegment(segment)) ? 'read-only' : 'mutation-or-unknown';
 }
 
 function inputOf(payload) { return payload?.tool_input ?? payload?.toolInput ?? payload?.input ?? {}; }

package/plugins/harness-everything/hooks/scripts/workflow-stop-gate.js

@@ -21,7 +21,15 @@ function decide(payload) {
   } else {
     const handoff = readJson(path.join(sessionDir, 'handoff-state.json'));
     const lastEdit = Math.max(workflow.lastMutationAt || 0, handoff?.lastEditAt || 0);
-    if (lastEdit && ((handoff?.lastVerifyAt || 0) < lastEdit || handoff?.lastVerifyExitCode !== 0)) unresolved = ['verification-after-edit-missing'];
+    // state-persist.js only ever records lastVerifyAt/lastVerifyExitCode from
+    // its `!isFailed` branch, so reaching this timestamp already proves the
+    // command succeeded. Do not additionally require lastVerifyExitCode===0:
+    // hosts are not guaranteed to report a numeric exit code at all (some
+    // PostToolUse payloads omit it entirely), in which case state-persist.js
+    // correctly records success with lastVerifyExitCode: null, and requiring
+    // a literal 0 here would make this gate permanently unresolvable on that
+    // host after any edit.
+    if (lastEdit && (handoff?.lastVerifyAt || 0) < lastEdit) unresolved = ['verification-after-edit-missing'];
   }
   if (unresolved.length) {
     workflow.unresolved = unresolved;

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",