harness-everything 0.11.3 → 0.11.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/.claude-plugin/marketplace.json +1 -1
  2. package/.claude-plugin/plugin.json +1 -1
  3. package/CHANGELOG.md +6 -0
  4. package/ci/mechanism-2af-worktree-isolation.test.js +34 -0
  5. package/hooks/scripts/lib/workflow-isolation.js +26 -8
  6. package/opencode-plugin/plugin.json +1 -1
  7. package/package.json +1 -1
  8. package/plugins/harness-everything/.codex-plugin/plugin.json +1 -1
  9. package/plugins/harness-everything/hooks/scripts/lib/workflow-isolation.js +26 -8
  10. package/plugins/harness-everything/plugin.json +1 -1
package/.claude-plugin/marketplace.json CHANGED
@@ -10,7 +10,7 @@
10
10
  "name": "harness-everything",
11
11
  "source": "./",
12
12
  "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
13
- "version": "0.11.3",
13
+ "version": "0.11.4",
14
14
  "author": {
15
15
  "name": "Miya Daniel"
16
16
  },
package/.claude-plugin/plugin.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "harness-everything",
3
3
  "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
4
- "version": "0.11.3",
4
+ "version": "0.11.4",
5
5
  "author": {
6
6
  "name": "Miya Daniel"
7
7
  },
package/CHANGELOG.md CHANGED
@@ -2,6 +2,12 @@
2
2
 
3
3
  All notable changes to this project are documented in this file.
4
4
 
5
+ ## [0.11.4](https://github.com/dyphn1/Harness-everything/compare/v0.11.3...v0.11.4) (2026-09-18)
6
+
7
+ ### Bug Fixes
8
+
9
+ * **workflow:** Stop classifyShell misclassifying safe read-only chains as mutations ([96d687a](https://github.com/dyphn1/Harness-everything/commit/96d687ab4437ab19e3a743d1b9bf5113cfe52525)), closes [82/#149](https://github.com/82/Harness-everything/issues/149) [#155](https://github.com/dyphn1/Harness-everything/issues/155) [#82](https://github.com/dyphn1/Harness-everything/issues/82) [#133](https://github.com/dyphn1/Harness-everything/issues/133) [#149](https://github.com/dyphn1/Harness-everything/issues/149) [#153](https://github.com/dyphn1/Harness-everything/issues/153)
10
+
5
11
  ## [0.11.3](https://github.com/dyphn1/Harness-everything/compare/v0.11.2...v0.11.3) (2026-09-18)
6
12
 
7
13
  ### Bug Fixes
package/ci/mechanism-2af-worktree-isolation.test.js CHANGED
@@ -106,6 +106,40 @@ try {
106
106
  const readOnly = runGate('Bash', repo, { command: 'git status --short' });
107
107
  check(readOnly.status === 0, 'read-only discovery remains allowed before isolation');
108
108
 
109
+ // #82-family follow-up: chaining/redirects that are hidden behind the old
110
+ // blanket metacharacter reject must stay blocked, but a compound command
111
+ // whose every segment is independently trusted read-only must not burn
112
+ // iteration budget or the mutation-timestamp just because it uses `;`,
113
+ // `&&`, `|`, or a non-writing `2>&1` redirect.
114
+ for (const command of [
115
+ 'git status --short; git log --oneline -1',
116
+ 'git status --short && git log --oneline -1',
117
+ 'git log --oneline -1 | head -1',
118
+ 'echo hello',
119
+ 'echo hello; git status --short',
120
+ 'git status --short 2>&1',
121
+ 'gh issue view 1 --repo octocat/hello-world --json number,title 2>&1',
122
+ 'gh pr list --repo octocat/hello-world --json number | head -1',
123
+ 'gh repo view octocat/hello-world --json name',
124
+ 'gh auth status',
125
+ 'cat README.md | grep fixture',
126
+ ]) {
127
+ check(runGate('Bash', repo, { command }).status === 0, `trusted read-only chain remains allowed: ${command}`);
128
+ }
129
+
130
+ for (const command of [
131
+ 'git status --short; rm -rf src',
132
+ 'git status --short | rm -rf src',
133
+ 'echo hi & rm -rf src',
134
+ 'git status --short > tracked.txt',
135
+ 'git status --short 2>tracked.txt',
136
+ 'git worktree add "harness-chain-probe" -b harness-chain-probe; rm -rf src',
137
+ 'gh issue comment 1 --body hi',
138
+ 'gh issue close 1',
139
+ ]) {
140
+ check(runGate('Bash', repo, { command }).status === 2, `chained/redirected command is not read-only: ${command}`);
141
+ }
142
+
109
143
  const setup = runGate('Bash', repo, { command: `git worktree add "${linked}" -b harness-isolation-test` });
110
144
  check(setup.status === 0, 'git worktree creation is allowed as the isolation transition');
111
145
 
package/hooks/scripts/lib/workflow-isolation.js CHANGED
@@ -43,16 +43,34 @@ function linkedWorktree(cwd, boundRoot) {
43
43
  return worktrees.some(field => field.startsWith('worktree ') && key(field.slice(9)) === key(top)) ? top : null;
44
44
  }
45
45
 
46
- // A conservative read subset, not a general shell sandbox.
46
+ // A conservative read subset, not a general shell sandbox. Chaining (`;`, `&&`,
47
+ // `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect are permitted only
48
+ // when every resulting segment independently matches the trusted read-only set
49
+ // below; any other metacharacter (substitution, grouping, a lone `&`, a file
50
+ // redirect, `<`) still forces mutation-or-unknown for the whole command.
51
+ const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/;
52
+ const SAFE_FD_REDIRECT_RE = /[12]>&[12]/g;
53
+ const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
54
+ const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
55
+
56
+ function isReadOnlySegment(segment) {
57
+ return READ_ONLY_PREFIX_RE.test(segment) && !DANGEROUS_FLAG_RE.test(segment);
58
+ }
59
+
47
60
  function classifyShell(command) {
48
61
  const text = String(command || '').trim();
49
- if (!text || /[;&|`\r\n<>$(){}\x00]/.test(text)) return 'mutation-or-unknown';
50
- if (/^git\s+worktree\s+add\s+/i.test(text) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(text)) return 'worktree-setup';
51
- if (/\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i.test(text)) return 'mutation-or-unknown';
52
- if (/^git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)/i.test(text) ||
53
- /^git\s+branch\s+--show-current$/i.test(text) || /^git\s+worktree\s+list(?:\s|$)/i.test(text) ||
54
- /^(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$)/i.test(text)) return 'read-only';
55
- return 'mutation-or-unknown';
62
+ if (!text || /[`$(){}\r\n\x00]/.test(text)) return 'mutation-or-unknown';
63
+ // Strip the safe `2>&1`/`1>&2` fd-duplication redirect first: it contains a
64
+ // literal `&` that must not be mistaken for a lone backgrounding `&`.
65
+ const withoutSafeRedirects = text.replace(SAFE_FD_REDIRECT_RE, ' ');
66
+ if (/&/.test(withoutSafeRedirects.replace(/&&/g, ''))) return 'mutation-or-unknown';
67
+ if (/[<>]/.test(withoutSafeRedirects)) return 'mutation-or-unknown';
68
+ const segments = text.split(SHELL_SEPARATOR_RE).map(segment => segment.replace(SAFE_FD_REDIRECT_RE, '').trim());
69
+ if (segments.length === 1) {
70
+ if (/^git\s+worktree\s+add\s+/i.test(segments[0]) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(segments[0])) return 'worktree-setup';
71
+ return isReadOnlySegment(segments[0]) ? 'read-only' : 'mutation-or-unknown';
72
+ }
73
+ return segments.every(segment => segment && isReadOnlySegment(segment)) ? 'read-only' : 'mutation-or-unknown';
56
74
  }
57
75
 
58
76
  function inputOf(payload) { return payload?.tool_input ?? payload?.toolInput ?? payload?.input ?? {}; }
package/opencode-plugin/plugin.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "harness-enforcement",
3
3
  "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
4
- "version": "0.11.3",
4
+ "version": "0.11.4",
5
5
  "runtime": "index.mjs",
6
6
  "hooks": {
7
7
  "verify": "hooks/verify.js"
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "harness-everything",
3
- "version": "0.11.3",
3
+ "version": "0.11.4",
4
4
  "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
5
5
  "main": "harness-everything/scripts/bootstrap.js",
6
6
  "bin": {
package/plugins/harness-everything/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "harness-everything",
3
- "version": "0.11.3",
3
+ "version": "0.11.4",
4
4
  "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
5
5
  "author": {
6
6
  "name": "Miya Daniel",
package/plugins/harness-everything/hooks/scripts/lib/workflow-isolation.js CHANGED
@@ -43,16 +43,34 @@ function linkedWorktree(cwd, boundRoot) {
43
43
  return worktrees.some(field => field.startsWith('worktree ') && key(field.slice(9)) === key(top)) ? top : null;
44
44
  }
45
45
 
46
- // A conservative read subset, not a general shell sandbox.
46
+ // A conservative read subset, not a general shell sandbox. Chaining (`;`, `&&`,
47
+ // `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect are permitted only
48
+ // when every resulting segment independently matches the trusted read-only set
49
+ // below; any other metacharacter (substitution, grouping, a lone `&`, a file
50
+ // redirect, `<`) still forces mutation-or-unknown for the whole command.
51
+ const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/;
52
+ const SAFE_FD_REDIRECT_RE = /[12]>&[12]/g;
53
+ const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
54
+ const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
55
+
56
+ function isReadOnlySegment(segment) {
57
+ return READ_ONLY_PREFIX_RE.test(segment) && !DANGEROUS_FLAG_RE.test(segment);
58
+ }
59
+
47
60
  function classifyShell(command) {
48
61
  const text = String(command || '').trim();
49
- if (!text || /[;&|`\r\n<>$(){}\x00]/.test(text)) return 'mutation-or-unknown';
50
- if (/^git\s+worktree\s+add\s+/i.test(text) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(text)) return 'worktree-setup';
51
- if (/\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i.test(text)) return 'mutation-or-unknown';
52
- if (/^git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)/i.test(text) ||
53
- /^git\s+branch\s+--show-current$/i.test(text) || /^git\s+worktree\s+list(?:\s|$)/i.test(text) ||
54
- /^(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$)/i.test(text)) return 'read-only';
55
- return 'mutation-or-unknown';
62
+ if (!text || /[`$(){}\r\n\x00]/.test(text)) return 'mutation-or-unknown';
63
+ // Strip the safe `2>&1`/`1>&2` fd-duplication redirect first: it contains a
64
+ // literal `&` that must not be mistaken for a lone backgrounding `&`.
65
+ const withoutSafeRedirects = text.replace(SAFE_FD_REDIRECT_RE, ' ');
66
+ if (/&/.test(withoutSafeRedirects.replace(/&&/g, ''))) return 'mutation-or-unknown';
67
+ if (/[<>]/.test(withoutSafeRedirects)) return 'mutation-or-unknown';
68
+ const segments = text.split(SHELL_SEPARATOR_RE).map(segment => segment.replace(SAFE_FD_REDIRECT_RE, '').trim());
69
+ if (segments.length === 1) {
70
+ if (/^git\s+worktree\s+add\s+/i.test(segments[0]) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(segments[0])) return 'worktree-setup';
71
+ return isReadOnlySegment(segments[0]) ? 'read-only' : 'mutation-or-unknown';
72
+ }
73
+ return segments.every(segment => segment && isReadOnlySegment(segment)) ? 'read-only' : 'mutation-or-unknown';
56
74
  }
57
75
 
58
76
  function inputOf(payload) { return payload?.tool_input ?? payload?.toolInput ?? payload?.input ?? {}; }
package/plugins/harness-everything/plugin.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
3
3
  "name": "harness-everything",
4
- "version": "0.11.3",
4
+ "version": "0.11.4",
5
5
  "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
6
6
  "author": {
7
7
  "name": "Miya Daniel",