harness-everything 0.11.4 → 0.11.5

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.11.4",
+      "version": "0.11.5",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.11.5](https://github.com/dyphn1/Harness-everything/compare/v0.11.4...v0.11.5) (2026-09-18)
+
+### Bug Fixes
+
+* **workflow:** lex shell separators safely ([df1a92c](https://github.com/dyphn1/Harness-everything/commit/df1a92ca6129ea96390e463ebcaef769604742e2))
+
 ## [0.11.4](https://github.com/dyphn1/Harness-everything/compare/v0.11.3...v0.11.4) (2026-09-18)
 
 ### Bug Fixes

package/ci/mechanism-2af-worktree-isolation.test.js

@@ -123,6 +123,14 @@ try {
     'gh repo view octocat/hello-world --json name',
     'gh auth status',
     'cat README.md | grep fixture',
+    'grep -n "fixture\\|missing" README.md | head -20',
+    "grep -n 'fixture|missing' README.md | head -20",
+    'echo "fixture|missing" | grep fixture',
+    'git log --grep="fix|feat" | head -5',
+    "grep 'fixture;missing' README.md | head -1",
+    'grep fixture\\|missing README.md | head -1',
+    'echo "2>&1"',
+    'echo "safe; rm -rf src"',
   ]) {
     check(runGate('Bash', repo, { command }).status === 0, `trusted read-only chain remains allowed: ${command}`);
   }
@@ -136,6 +144,10 @@ try {
     'git worktree add "harness-chain-probe" -b harness-chain-probe; rm -rf src',
     'gh issue comment 1 --body hi',
     'gh issue close 1',
+    'git status --short || rm -rf src',
+    'grep "unterminated README.md | head -1',
+    "grep 'unterminated README.md | head -1",
+    'echo safe | rm -rf src',
   ]) {
     check(runGate('Bash', repo, { command }).status === 2, `chained/redirected command is not read-only: ${command}`);
   }

package/ci/mechanism-2ah-workflow-lifecycle.test.js

@@ -158,6 +158,31 @@ try {
   check(route('Fix this checkout bug with a regression test').status === 0 && read(file).strategy === 'iterative-single', 'fresh bounded fix returns to Tier 2 iterative lifecycle');
   const iterationLimit = read(file).workflowPlan.limits.maxIterations;
   check(Number.isInteger(iterationLimit) && iterationLimit > 0, 'iterative route exposes a numeric iteration budget');
+
+  // #155/#157 regression lock: read-only shell composition, including quoted
+  // and escaped separator characters inside arguments, must never look like an
+  // iterative mutation or advance the mutation clock.
+  const beforeReadOnly = read(file);
+  const readOnlyIterations = beforeReadOnly.budget?.counters?.iterations || 0;
+  const readOnlyMutationAt = beforeReadOnly.lastMutationAt || 0;
+  const quotedReadOnly = [
+    'git status --short; git log --oneline -1',
+    'gh issue view 1 --repo octocat/hello-world --json number,title 2>&1',
+    'grep -n "fixture\\|missing" README.md | head -20',
+    "grep -n 'fixture|missing' README.md | head -20",
+    'echo "fixture|missing" | grep fixture',
+    "grep 'fixture;missing' README.md | head -1",
+  ];
+  for (let i = 0; i < iterationLimit + 2; i++) {
+    const command = quotedReadOnly[i % quotedReadOnly.length];
+    check(gate('Bash', { command }, repo).status === 0, 'quoted/escaped read-only shell command stays outside iteration budget: ' + command);
+  }
+  const afterReadOnly = read(file);
+  check((afterReadOnly.budget?.counters?.iterations || 0) === readOnlyIterations,
+    'read-only shell composition does not consume iterative budget');
+  check((afterReadOnly.lastMutationAt || 0) === readOnlyMutationAt,
+    'read-only shell composition does not advance lastMutationAt');
+
   for (let i = 0; i < iterationLimit; i++) {
     check(gate('Write', { file_path: path.join(repo, `small-${i}.js`) }, repo).status === 0, `iterative mutation ${i + 1}/${iterationLimit} stays within budget`);
   }

package/hooks/scripts/lib/workflow-isolation.js

@@ -43,13 +43,12 @@ function linkedWorktree(cwd, boundRoot) {
   return worktrees.some(field => field.startsWith('worktree ') && key(field.slice(9)) === key(top)) ? top : null;
 }
 
-// A conservative read subset, not a general shell sandbox. Chaining (`;`, `&&`,
-// `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect are permitted only
-// when every resulting segment independently matches the trusted read-only set
-// below; any other metacharacter (substitution, grouping, a lone `&`, a file
-// redirect, `<`) still forces mutation-or-unknown for the whole command.
-const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/;
-const SAFE_FD_REDIRECT_RE = /[12]>&[12]/g;
+// A conservative read subset, not a general shell sandbox. Top-level chaining
+// (`;`, `&&`, `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect
+// are permitted only when every resulting segment independently matches the
+// trusted read-only set below. The scanner is deliberately lexical rather than
+// a raw regex split so quoted/escaped separator characters remain arguments.
+// Unsupported shell syntax still fails closed.
 const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
 const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
 
@@ -57,20 +56,102 @@ function isReadOnlySegment(segment) {
   return READ_ONLY_PREFIX_RE.test(segment) && !DANGEROUS_FLAG_RE.test(segment);
 }
 
+function splitShellSegments(text) {
+  const segments = [];
+  let current = '';
+  let quote = null;
+
+  const push = () => {
+    const segment = current.trim();
+    if (!segment) return false;
+    segments.push(segment);
+    current = '';
+    return true;
+  };
+
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+
+    if (quote === "'") {
+      current += ch;
+      if (ch === "'") quote = null;
+      continue;
+    }
+
+    if (quote === '"') {
+      if (ch === '$' || ch === '`') return null;
+      current += ch;
+      if (ch === '"') {
+        quote = null;
+      } else if (ch === '\\') {
+        if (i + 1 >= text.length) return null;
+        current += text[++i];
+      }
+      continue;
+    }
+
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+
+    if (ch === '\\') {
+      if (i + 1 >= text.length) return null;
+      current += ch + text[++i];
+      continue;
+    }
+
+    if (ch === '$' || ch === '`' || ch === '(' || ch === ')' || ch === '{' || ch === '}' ||
+        ch === '\r' || ch === '\n' || ch === '\x00') return null;
+
+    // Only treat fd duplication as syntax at a token boundary. Quoted text such
+    // as "2>&1" was handled above and remains literal argument content.
+    if ((ch === '1' || ch === '2') && text[i + 1] === '>' && text[i + 2] === '&' &&
+        (text[i + 3] === '1' || text[i + 3] === '2') &&
+        (i === 0 || /\s/.test(text[i - 1])) &&
+        (i + 4 === text.length || /[\s;|&]/.test(text[i + 4]))) {
+      current += ' ';
+      i += 3;
+      continue;
+    }
+
+    if (ch === '>' || ch === '<') return null;
+
+    if (ch === ';') {
+      if (!push()) return null;
+      continue;
+    }
+
+    if (ch === '|') {
+      if (!push()) return null;
+      if (text[i + 1] === '|') i++;
+      continue;
+    }
+
+    if (ch === '&') {
+      if (text[i + 1] !== '&' || !push()) return null;
+      i++;
+      continue;
+    }
+
+    current += ch;
+  }
+
+  if (quote || !push()) return null;
+  return segments;
+}
+
 function classifyShell(command) {
   const text = String(command || '').trim();
-  if (!text || /[`$(){}\r\n\x00]/.test(text)) return 'mutation-or-unknown';
-  // Strip the safe `2>&1`/`1>&2` fd-duplication redirect first: it contains a
-  // literal `&` that must not be mistaken for a lone backgrounding `&`.
-  const withoutSafeRedirects = text.replace(SAFE_FD_REDIRECT_RE, ' ');
-  if (/&/.test(withoutSafeRedirects.replace(/&&/g, ''))) return 'mutation-or-unknown';
-  if (/[<>]/.test(withoutSafeRedirects)) return 'mutation-or-unknown';
-  const segments = text.split(SHELL_SEPARATOR_RE).map(segment => segment.replace(SAFE_FD_REDIRECT_RE, '').trim());
+  if (!text) return 'mutation-or-unknown';
+  const segments = splitShellSegments(text);
+  if (!segments) return 'mutation-or-unknown';
   if (segments.length === 1) {
     if (/^git\s+worktree\s+add\s+/i.test(segments[0]) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(segments[0])) return 'worktree-setup';
     return isReadOnlySegment(segments[0]) ? 'read-only' : 'mutation-or-unknown';
   }
-  return segments.every(segment => segment && isReadOnlySegment(segment)) ? 'read-only' : 'mutation-or-unknown';
+  return segments.every(isReadOnlySegment) ? 'read-only' : 'mutation-or-unknown';
 }
 
 function inputOf(payload) { return payload?.tool_input ?? payload?.toolInput ?? payload?.input ?? {}; }

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/workflow-isolation.js

@@ -43,13 +43,12 @@ function linkedWorktree(cwd, boundRoot) {
   return worktrees.some(field => field.startsWith('worktree ') && key(field.slice(9)) === key(top)) ? top : null;
 }
 
-// A conservative read subset, not a general shell sandbox. Chaining (`;`, `&&`,
-// `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect are permitted only
-// when every resulting segment independently matches the trusted read-only set
-// below; any other metacharacter (substitution, grouping, a lone `&`, a file
-// redirect, `<`) still forces mutation-or-unknown for the whole command.
-const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/;
-const SAFE_FD_REDIRECT_RE = /[12]>&[12]/g;
+// A conservative read subset, not a general shell sandbox. Top-level chaining
+// (`;`, `&&`, `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect
+// are permitted only when every resulting segment independently matches the
+// trusted read-only set below. The scanner is deliberately lexical rather than
+// a raw regex split so quoted/escaped separator characters remain arguments.
+// Unsupported shell syntax still fails closed.
 const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
 const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
 
@@ -57,20 +56,102 @@ function isReadOnlySegment(segment) {
   return READ_ONLY_PREFIX_RE.test(segment) && !DANGEROUS_FLAG_RE.test(segment);
 }
 
+function splitShellSegments(text) {
+  const segments = [];
+  let current = '';
+  let quote = null;
+
+  const push = () => {
+    const segment = current.trim();
+    if (!segment) return false;
+    segments.push(segment);
+    current = '';
+    return true;
+  };
+
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+
+    if (quote === "'") {
+      current += ch;
+      if (ch === "'") quote = null;
+      continue;
+    }
+
+    if (quote === '"') {
+      if (ch === '$' || ch === '`') return null;
+      current += ch;
+      if (ch === '"') {
+        quote = null;
+      } else if (ch === '\\') {
+        if (i + 1 >= text.length) return null;
+        current += text[++i];
+      }
+      continue;
+    }
+
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+
+    if (ch === '\\') {
+      if (i + 1 >= text.length) return null;
+      current += ch + text[++i];
+      continue;
+    }
+
+    if (ch === '$' || ch === '`' || ch === '(' || ch === ')' || ch === '{' || ch === '}' ||
+        ch === '\r' || ch === '\n' || ch === '\x00') return null;
+
+    // Only treat fd duplication as syntax at a token boundary. Quoted text such
+    // as "2>&1" was handled above and remains literal argument content.
+    if ((ch === '1' || ch === '2') && text[i + 1] === '>' && text[i + 2] === '&' &&
+        (text[i + 3] === '1' || text[i + 3] === '2') &&
+        (i === 0 || /\s/.test(text[i - 1])) &&
+        (i + 4 === text.length || /[\s;|&]/.test(text[i + 4]))) {
+      current += ' ';
+      i += 3;
+      continue;
+    }
+
+    if (ch === '>' || ch === '<') return null;
+
+    if (ch === ';') {
+      if (!push()) return null;
+      continue;
+    }
+
+    if (ch === '|') {
+      if (!push()) return null;
+      if (text[i + 1] === '|') i++;
+      continue;
+    }
+
+    if (ch === '&') {
+      if (text[i + 1] !== '&' || !push()) return null;
+      i++;
+      continue;
+    }
+
+    current += ch;
+  }
+
+  if (quote || !push()) return null;
+  return segments;
+}
+
 function classifyShell(command) {
   const text = String(command || '').trim();
-  if (!text || /[`$(){}\r\n\x00]/.test(text)) return 'mutation-or-unknown';
-  // Strip the safe `2>&1`/`1>&2` fd-duplication redirect first: it contains a
-  // literal `&` that must not be mistaken for a lone backgrounding `&`.
-  const withoutSafeRedirects = text.replace(SAFE_FD_REDIRECT_RE, ' ');
-  if (/&/.test(withoutSafeRedirects.replace(/&&/g, ''))) return 'mutation-or-unknown';
-  if (/[<>]/.test(withoutSafeRedirects)) return 'mutation-or-unknown';
-  const segments = text.split(SHELL_SEPARATOR_RE).map(segment => segment.replace(SAFE_FD_REDIRECT_RE, '').trim());
+  if (!text) return 'mutation-or-unknown';
+  const segments = splitShellSegments(text);
+  if (!segments) return 'mutation-or-unknown';
   if (segments.length === 1) {
     if (/^git\s+worktree\s+add\s+/i.test(segments[0]) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(segments[0])) return 'worktree-setup';
     return isReadOnlySegment(segments[0]) ? 'read-only' : 'mutation-or-unknown';
   }
-  return segments.every(segment => segment && isReadOnlySegment(segment)) ? 'read-only' : 'mutation-or-unknown';
+  return segments.every(isReadOnlySegment) ? 'read-only' : 'mutation-or-unknown';
 }
 
 function inputOf(payload) { return payload?.tool_input ?? payload?.toolInput ?? payload?.input ?? {}; }

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",