harness-everything 0.11.3 → 0.11.5

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.11.3",
+      "version": "0.11.5",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.11.3",
+  "version": "0.11.5",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.11.5](https://github.com/dyphn1/Harness-everything/compare/v0.11.4...v0.11.5) (2026-09-18)
+
+### Bug Fixes
+
+* **workflow:** lex shell separators safely ([df1a92c](https://github.com/dyphn1/Harness-everything/commit/df1a92ca6129ea96390e463ebcaef769604742e2))
+
+## [0.11.4](https://github.com/dyphn1/Harness-everything/compare/v0.11.3...v0.11.4) (2026-09-18)
+
+### Bug Fixes
+
+* **workflow:** Stop classifyShell misclassifying safe read-only chains as mutations ([96d687a](https://github.com/dyphn1/Harness-everything/commit/96d687ab4437ab19e3a743d1b9bf5113cfe52525)), closes [82/#149](https://github.com/82/Harness-everything/issues/149) [#155](https://github.com/dyphn1/Harness-everything/issues/155) [#82](https://github.com/dyphn1/Harness-everything/issues/82) [#133](https://github.com/dyphn1/Harness-everything/issues/133) [#149](https://github.com/dyphn1/Harness-everything/issues/149) [#153](https://github.com/dyphn1/Harness-everything/issues/153)
+
 ## [0.11.3](https://github.com/dyphn1/Harness-everything/compare/v0.11.2...v0.11.3) (2026-09-18)
 
 ### Bug Fixes

package/ci/mechanism-2af-worktree-isolation.test.js

@@ -106,6 +106,52 @@ try {
   const readOnly = runGate('Bash', repo, { command: 'git status --short' });
   check(readOnly.status === 0, 'read-only discovery remains allowed before isolation');
 
+  // #82-family follow-up: chaining/redirects that are hidden behind the old
+  // blanket metacharacter reject must stay blocked, but a compound command
+  // whose every segment is independently trusted read-only must not burn
+  // iteration budget or the mutation-timestamp just because it uses `;`,
+  // `&&`, `|`, or a non-writing `2>&1` redirect.
+  for (const command of [
+    'git status --short; git log --oneline -1',
+    'git status --short && git log --oneline -1',
+    'git log --oneline -1 | head -1',
+    'echo hello',
+    'echo hello; git status --short',
+    'git status --short 2>&1',
+    'gh issue view 1 --repo octocat/hello-world --json number,title 2>&1',
+    'gh pr list --repo octocat/hello-world --json number | head -1',
+    'gh repo view octocat/hello-world --json name',
+    'gh auth status',
+    'cat README.md | grep fixture',
+    'grep -n "fixture\\|missing" README.md | head -20',
+    "grep -n 'fixture|missing' README.md | head -20",
+    'echo "fixture|missing" | grep fixture',
+    'git log --grep="fix|feat" | head -5',
+    "grep 'fixture;missing' README.md | head -1",
+    'grep fixture\\|missing README.md | head -1',
+    'echo "2>&1"',
+    'echo "safe; rm -rf src"',
+  ]) {
+    check(runGate('Bash', repo, { command }).status === 0, `trusted read-only chain remains allowed: ${command}`);
+  }
+
+  for (const command of [
+    'git status --short; rm -rf src',
+    'git status --short | rm -rf src',
+    'echo hi & rm -rf src',
+    'git status --short > tracked.txt',
+    'git status --short 2>tracked.txt',
+    'git worktree add "harness-chain-probe" -b harness-chain-probe; rm -rf src',
+    'gh issue comment 1 --body hi',
+    'gh issue close 1',
+    'git status --short || rm -rf src',
+    'grep "unterminated README.md | head -1',
+    "grep 'unterminated README.md | head -1",
+    'echo safe | rm -rf src',
+  ]) {
+    check(runGate('Bash', repo, { command }).status === 2, `chained/redirected command is not read-only: ${command}`);
+  }
+
   const setup = runGate('Bash', repo, { command: `git worktree add "${linked}" -b harness-isolation-test` });
   check(setup.status === 0, 'git worktree creation is allowed as the isolation transition');
 

package/ci/mechanism-2ah-workflow-lifecycle.test.js

@@ -158,6 +158,31 @@ try {
   check(route('Fix this checkout bug with a regression test').status === 0 && read(file).strategy === 'iterative-single', 'fresh bounded fix returns to Tier 2 iterative lifecycle');
   const iterationLimit = read(file).workflowPlan.limits.maxIterations;
   check(Number.isInteger(iterationLimit) && iterationLimit > 0, 'iterative route exposes a numeric iteration budget');
+
+  // #155/#157 regression lock: read-only shell composition, including quoted
+  // and escaped separator characters inside arguments, must never look like an
+  // iterative mutation or advance the mutation clock.
+  const beforeReadOnly = read(file);
+  const readOnlyIterations = beforeReadOnly.budget?.counters?.iterations || 0;
+  const readOnlyMutationAt = beforeReadOnly.lastMutationAt || 0;
+  const quotedReadOnly = [
+    'git status --short; git log --oneline -1',
+    'gh issue view 1 --repo octocat/hello-world --json number,title 2>&1',
+    'grep -n "fixture\\|missing" README.md | head -20',
+    "grep -n 'fixture|missing' README.md | head -20",
+    'echo "fixture|missing" | grep fixture',
+    "grep 'fixture;missing' README.md | head -1",
+  ];
+  for (let i = 0; i < iterationLimit + 2; i++) {
+    const command = quotedReadOnly[i % quotedReadOnly.length];
+    check(gate('Bash', { command }, repo).status === 0, 'quoted/escaped read-only shell command stays outside iteration budget: ' + command);
+  }
+  const afterReadOnly = read(file);
+  check((afterReadOnly.budget?.counters?.iterations || 0) === readOnlyIterations,
+    'read-only shell composition does not consume iterative budget');
+  check((afterReadOnly.lastMutationAt || 0) === readOnlyMutationAt,
+    'read-only shell composition does not advance lastMutationAt');
+
   for (let i = 0; i < iterationLimit; i++) {
     check(gate('Write', { file_path: path.join(repo, `small-${i}.js`) }, repo).status === 0, `iterative mutation ${i + 1}/${iterationLimit} stays within budget`);
   }

package/hooks/scripts/lib/workflow-isolation.js

@@ -43,16 +43,115 @@ function linkedWorktree(cwd, boundRoot) {
   return worktrees.some(field => field.startsWith('worktree ') && key(field.slice(9)) === key(top)) ? top : null;
 }
 
-// A conservative read subset, not a general shell sandbox.
+// A conservative read subset, not a general shell sandbox. Top-level chaining
+// (`;`, `&&`, `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect
+// are permitted only when every resulting segment independently matches the
+// trusted read-only set below. The scanner is deliberately lexical rather than
+// a raw regex split so quoted/escaped separator characters remain arguments.
+// Unsupported shell syntax still fails closed.
+const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
+const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
+
+function isReadOnlySegment(segment) {
+  return READ_ONLY_PREFIX_RE.test(segment) && !DANGEROUS_FLAG_RE.test(segment);
+}
+
+function splitShellSegments(text) {
+  const segments = [];
+  let current = '';
+  let quote = null;
+
+  const push = () => {
+    const segment = current.trim();
+    if (!segment) return false;
+    segments.push(segment);
+    current = '';
+    return true;
+  };
+
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+
+    if (quote === "'") {
+      current += ch;
+      if (ch === "'") quote = null;
+      continue;
+    }
+
+    if (quote === '"') {
+      if (ch === '$' || ch === '`') return null;
+      current += ch;
+      if (ch === '"') {
+        quote = null;
+      } else if (ch === '\\') {
+        if (i + 1 >= text.length) return null;
+        current += text[++i];
+      }
+      continue;
+    }
+
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+
+    if (ch === '\\') {
+      if (i + 1 >= text.length) return null;
+      current += ch + text[++i];
+      continue;
+    }
+
+    if (ch === '$' || ch === '`' || ch === '(' || ch === ')' || ch === '{' || ch === '}' ||
+        ch === '\r' || ch === '\n' || ch === '\x00') return null;
+
+    // Only treat fd duplication as syntax at a token boundary. Quoted text such
+    // as "2>&1" was handled above and remains literal argument content.
+    if ((ch === '1' || ch === '2') && text[i + 1] === '>' && text[i + 2] === '&' &&
+        (text[i + 3] === '1' || text[i + 3] === '2') &&
+        (i === 0 || /\s/.test(text[i - 1])) &&
+        (i + 4 === text.length || /[\s;|&]/.test(text[i + 4]))) {
+      current += ' ';
+      i += 3;
+      continue;
+    }
+
+    if (ch === '>' || ch === '<') return null;
+
+    if (ch === ';') {
+      if (!push()) return null;
+      continue;
+    }
+
+    if (ch === '|') {
+      if (!push()) return null;
+      if (text[i + 1] === '|') i++;
+      continue;
+    }
+
+    if (ch === '&') {
+      if (text[i + 1] !== '&' || !push()) return null;
+      i++;
+      continue;
+    }
+
+    current += ch;
+  }
+
+  if (quote || !push()) return null;
+  return segments;
+}
+
 function classifyShell(command) {
   const text = String(command || '').trim();
-  if (!text || /[;&|`\r\n<>$(){}\x00]/.test(text)) return 'mutation-or-unknown';
-  if (/^git\s+worktree\s+add\s+/i.test(text) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(text)) return 'worktree-setup';
-  if (/\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i.test(text)) return 'mutation-or-unknown';
-  if (/^git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)/i.test(text) ||
-      /^git\s+branch\s+--show-current$/i.test(text) || /^git\s+worktree\s+list(?:\s|$)/i.test(text) ||
-      /^(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$)/i.test(text)) return 'read-only';
-  return 'mutation-or-unknown';
+  if (!text) return 'mutation-or-unknown';
+  const segments = splitShellSegments(text);
+  if (!segments) return 'mutation-or-unknown';
+  if (segments.length === 1) {
+    if (/^git\s+worktree\s+add\s+/i.test(segments[0]) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(segments[0])) return 'worktree-setup';
+    return isReadOnlySegment(segments[0]) ? 'read-only' : 'mutation-or-unknown';
+  }
+  return segments.every(isReadOnlySegment) ? 'read-only' : 'mutation-or-unknown';
 }
 
 function inputOf(payload) { return payload?.tool_input ?? payload?.toolInput ?? payload?.input ?? {}; }

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.11.3",
+  "version": "0.11.5",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.11.3",
+  "version": "0.11.5",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.11.3",
+  "version": "0.11.5",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/workflow-isolation.js

@@ -43,16 +43,115 @@ function linkedWorktree(cwd, boundRoot) {
   return worktrees.some(field => field.startsWith('worktree ') && key(field.slice(9)) === key(top)) ? top : null;
 }
 
-// A conservative read subset, not a general shell sandbox.
+// A conservative read subset, not a general shell sandbox. Top-level chaining
+// (`;`, `&&`, `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect
+// are permitted only when every resulting segment independently matches the
+// trusted read-only set below. The scanner is deliberately lexical rather than
+// a raw regex split so quoted/escaped separator characters remain arguments.
+// Unsupported shell syntax still fails closed.
+const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
+const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
+
+function isReadOnlySegment(segment) {
+  return READ_ONLY_PREFIX_RE.test(segment) && !DANGEROUS_FLAG_RE.test(segment);
+}
+
+function splitShellSegments(text) {
+  const segments = [];
+  let current = '';
+  let quote = null;
+
+  const push = () => {
+    const segment = current.trim();
+    if (!segment) return false;
+    segments.push(segment);
+    current = '';
+    return true;
+  };
+
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+
+    if (quote === "'") {
+      current += ch;
+      if (ch === "'") quote = null;
+      continue;
+    }
+
+    if (quote === '"') {
+      if (ch === '$' || ch === '`') return null;
+      current += ch;
+      if (ch === '"') {
+        quote = null;
+      } else if (ch === '\\') {
+        if (i + 1 >= text.length) return null;
+        current += text[++i];
+      }
+      continue;
+    }
+
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+
+    if (ch === '\\') {
+      if (i + 1 >= text.length) return null;
+      current += ch + text[++i];
+      continue;
+    }
+
+    if (ch === '$' || ch === '`' || ch === '(' || ch === ')' || ch === '{' || ch === '}' ||
+        ch === '\r' || ch === '\n' || ch === '\x00') return null;
+
+    // Only treat fd duplication as syntax at a token boundary. Quoted text such
+    // as "2>&1" was handled above and remains literal argument content.
+    if ((ch === '1' || ch === '2') && text[i + 1] === '>' && text[i + 2] === '&' &&
+        (text[i + 3] === '1' || text[i + 3] === '2') &&
+        (i === 0 || /\s/.test(text[i - 1])) &&
+        (i + 4 === text.length || /[\s;|&]/.test(text[i + 4]))) {
+      current += ' ';
+      i += 3;
+      continue;
+    }
+
+    if (ch === '>' || ch === '<') return null;
+
+    if (ch === ';') {
+      if (!push()) return null;
+      continue;
+    }
+
+    if (ch === '|') {
+      if (!push()) return null;
+      if (text[i + 1] === '|') i++;
+      continue;
+    }
+
+    if (ch === '&') {
+      if (text[i + 1] !== '&' || !push()) return null;
+      i++;
+      continue;
+    }
+
+    current += ch;
+  }
+
+  if (quote || !push()) return null;
+  return segments;
+}
+
 function classifyShell(command) {
   const text = String(command || '').trim();
-  if (!text || /[;&|`\r\n<>$(){}\x00]/.test(text)) return 'mutation-or-unknown';
-  if (/^git\s+worktree\s+add\s+/i.test(text) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(text)) return 'worktree-setup';
-  if (/\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i.test(text)) return 'mutation-or-unknown';
-  if (/^git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)/i.test(text) ||
-      /^git\s+branch\s+--show-current$/i.test(text) || /^git\s+worktree\s+list(?:\s|$)/i.test(text) ||
-      /^(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$)/i.test(text)) return 'read-only';
-  return 'mutation-or-unknown';
+  if (!text) return 'mutation-or-unknown';
+  const segments = splitShellSegments(text);
+  if (!segments) return 'mutation-or-unknown';
+  if (segments.length === 1) {
+    if (/^git\s+worktree\s+add\s+/i.test(segments[0]) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(segments[0])) return 'worktree-setup';
+    return isReadOnlySegment(segments[0]) ? 'read-only' : 'mutation-or-unknown';
+  }
+  return segments.every(isReadOnlySegment) ? 'read-only' : 'mutation-or-unknown';
 }
 
 function inputOf(payload) { return payload?.tool_input ?? payload?.toolInput ?? payload?.input ?? {}; }

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.11.3",
+  "version": "0.11.5",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",