harness-everything 0.11.4 → 0.11.6

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.11.4",
+      "version": "0.11.6",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.11.4",
+  "version": "0.11.6",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.11.6](https://github.com/dyphn1/Harness-everything/compare/v0.11.5...v0.11.6) (2026-09-18)
+
+### Bug Fixes
+
+* **workflow:** avoid workflow rewrite after probe registration ([b9f2e06](https://github.com/dyphn1/Harness-everything/commit/b9f2e065114d70e927b6f75e7c0f7899d9e8392f))
+* **workflow:** correlate mutation probes by tool-use identity ([86cd1a1](https://github.com/dyphn1/Harness-everything/commit/86cd1a1c6eaef6518936160b0c35f94a3e652cae))
+* **workflow:** defer shell mutation accounting to observer ([c543fd0](https://github.com/dyphn1/Harness-everything/commit/c543fd0c41e18f05c21235ce4ffcf28864200940))
+* **workflow:** discard denied shell mutation probes ([7a8757c](https://github.com/dyphn1/Harness-everything/commit/7a8757cab821e524ccdd17e416e013bfbadc4f39))
+* **workflow:** fingerprint observed workspace effects ([9d8e316](https://github.com/dyphn1/Harness-everything/commit/9d8e316eb97ec7bbcd0e46ceb51491af90e57e9f))
+* **workflow:** fingerprint visible content independent of staging ([a1f370e](https://github.com/dyphn1/Harness-everything/commit/a1f370e64a97b04bee4d8df23e3ffdc7552377b8))
+* **workflow:** isolate mutation probes per tool call ([70d6052](https://github.com/dyphn1/Harness-everything/commit/70d6052ef02fce1125da9a20a14a4ad65d09ba93))
+* **workflow:** make mutation observation single-handler ordered ([ea166e1](https://github.com/dyphn1/Harness-everything/commit/ea166e1a94cdd1725cd7242feb5b0716a4dce8b8))
+* **workflow:** normalize deleted paths in fingerprint ([e5019da](https://github.com/dyphn1/Harness-everything/commit/e5019daee870e806d77d92c741a9624cd6c9bfe0))
+* **workflow:** observe shell effects before state persistence ([5271655](https://github.com/dyphn1/Harness-everything/commit/5271655627344eb71ffeb8dd36b007709862b9d0))
+* **workflow:** observe shell workspace mutations ([c547b39](https://github.com/dyphn1/Harness-everything/commit/c547b396bf2e3829b83ed03abeca594b7391f542))
+* **workflow:** remove parallel standalone mutation observer ([20027f6](https://github.com/dyphn1/Harness-everything/commit/20027f68f5b63719ea7a96a524f49c7103586644))
+* **workflow:** reserve shell mutation probes ([e7273f6](https://github.com/dyphn1/Harness-everything/commit/e7273f66010d5b0c740b87b8dbc020c8de616fe7))
+* **workflow:** settle mutation probes inside state persistence ([88feaf4](https://github.com/dyphn1/Harness-everything/commit/88feaf4ee3accbd8504b745fd4e79e548c31bd6d))
+
+## [0.11.5](https://github.com/dyphn1/Harness-everything/compare/v0.11.4...v0.11.5) (2026-09-18)
+
+### Bug Fixes
+
+* **workflow:** lex shell separators safely ([df1a92c](https://github.com/dyphn1/Harness-everything/commit/df1a92ca6129ea96390e463ebcaef769604742e2))
+
 ## [0.11.4](https://github.com/dyphn1/Harness-everything/compare/v0.11.3...v0.11.4) (2026-09-18)
 
 ### Bug Fixes

package/ci/mechanism-2af-worktree-isolation.test.js

@@ -123,6 +123,14 @@ try {
     'gh repo view octocat/hello-world --json name',
     'gh auth status',
     'cat README.md | grep fixture',
+    'grep -n "fixture\\|missing" README.md | head -20',
+    "grep -n 'fixture|missing' README.md | head -20",
+    'echo "fixture|missing" | grep fixture',
+    'git log --grep="fix|feat" | head -5',
+    "grep 'fixture;missing' README.md | head -1",
+    'grep fixture\\|missing README.md | head -1',
+    'echo "2>&1"',
+    'echo "safe; rm -rf src"',
   ]) {
     check(runGate('Bash', repo, { command }).status === 0, `trusted read-only chain remains allowed: ${command}`);
   }
@@ -136,6 +144,10 @@ try {
     'git worktree add "harness-chain-probe" -b harness-chain-probe; rm -rf src',
     'gh issue comment 1 --body hi',
     'gh issue close 1',
+    'git status --short || rm -rf src',
+    'grep "unterminated README.md | head -1',
+    "grep 'unterminated README.md | head -1",
+    'echo safe | rm -rf src',
   ]) {
     check(runGate('Bash', repo, { command }).status === 2, `chained/redirected command is not read-only: ${command}`);
   }

package/ci/mechanism-2ah-workflow-lifecycle.test.js

@@ -35,6 +35,46 @@ function git(args) {
 }
 const route = prompt => node('harness-everything/scripts/kernel-router.js', { ...payload, prompt });
 const gate = (tool, input, cwd = linked) => node('hooks/scripts/workflow-gate.js', { ...payload, cwd, tool_name: tool, tool_input: input });
+let toolUseSeq = 0;
+function beginShell(command, cwd = repo) {
+  const toolUseId = 'toolu_fixture_' + (++toolUseSeq);
+  const input = { ...payload, cwd, tool_name: 'Bash', tool_use_id: toolUseId, tool_input: { command } };
+  return { command, cwd, toolUseId, result: node('hooks/scripts/workflow-gate.js', input) };
+}
+function persistShell(call, response = {}, hookEvent = 'PostToolUse') {
+  const input = {
+    ...payload,
+    cwd: call.cwd,
+    hook_event_name: hookEvent,
+    tool_name: 'Bash',
+    tool_use_id: call.toolUseId,
+    tool_input: { command: call.command },
+  };
+  if (hookEvent === 'PostToolUseFailure') {
+    input.error = response.error || 'Exit code 1\nfixture failure';
+    input.is_interrupt = Boolean(response.is_interrupt);
+  } else {
+    input.tool_response = response;
+  }
+  return node('hooks/scripts/state-persist.js', input);
+}
+function denyShell(call) {
+  return node('hooks/scripts/workflow-mutation-denied.js', {
+    ...payload,
+    cwd: call.cwd,
+    hook_event_name: 'PermissionDenied',
+    permission_mode: 'auto',
+    tool_name: 'Bash',
+    tool_use_id: call.toolUseId,
+    tool_input: { command: call.command },
+    reason: 'Blocked by classifier',
+  });
+}
+const probeDir = path.join(sessionDir, 'mutation-probes');
+const probeFiles = () => {
+  try { return fs.readdirSync(probeDir).filter(name => /^[a-f0-9]{64}\.json$/.test(name)); }
+  catch (_) { return []; }
+};
 const stop = extra => node('hooks/scripts/workflow-stop-gate.js', { ...payload, ...extra });
 const control = (...args) => node('hooks/scripts/workflow-disposition.js', null, [args[0], '--session-id', sessionId, ...args.slice(1)]);
 const stages = [
@@ -158,10 +198,157 @@ try {
   check(route('Fix this checkout bug with a regression test').status === 0 && read(file).strategy === 'iterative-single', 'fresh bounded fix returns to Tier 2 iterative lifecycle');
   const iterationLimit = read(file).workflowPlan.limits.maxIterations;
   check(Number.isInteger(iterationLimit) && iterationLimit > 0, 'iterative route exposes a numeric iteration budget');
-  for (let i = 0; i < iterationLimit; i++) {
-    check(gate('Write', { file_path: path.join(repo, `small-${i}.js`) }, repo).status === 0, `iterative mutation ${i + 1}/${iterationLimit} stays within budget`);
+
+  // #155/#157 regression lock: read-only shell composition, including quoted
+  // and escaped separator characters inside arguments, must never look like an
+  // iterative mutation or advance the mutation clock.
+  const beforeReadOnly = read(file);
+  const readOnlyIterations = beforeReadOnly.budget?.counters?.iterations || 0;
+  const readOnlyMutationAt = beforeReadOnly.lastMutationAt || 0;
+  const quotedReadOnly = [
+    'git status --short; git log --oneline -1',
+    'gh issue view 1 --repo octocat/hello-world --json number,title 2>&1',
+    'grep -n "fixture\\|missing" README.md | head -20',
+    "grep -n 'fixture|missing' README.md | head -20",
+    'echo "fixture|missing" | grep fixture',
+    "grep 'fixture;missing' README.md | head -1",
+  ];
+  for (let i = 0; i < iterationLimit + 2; i++) {
+    const command = quotedReadOnly[i % quotedReadOnly.length];
+    check(gate('Bash', { command }, repo).status === 0, 'quoted/escaped read-only shell command stays outside iteration budget: ' + command);
+  }
+  const afterReadOnly = read(file);
+  check((afterReadOnly.budget?.counters?.iterations || 0) === readOnlyIterations,
+    'read-only shell composition does not consume iterative budget');
+  check((afterReadOnly.lastMutationAt || 0) === readOnlyMutationAt,
+    'read-only shell composition does not advance lastMutationAt');
+
+  // #159: safety classification is not mutation evidence. Commands that are
+  // not proven read-only are admitted under an opaque workspace probe while
+  // capacity remains, then accounted only if the visible workspace changed.
+  const untrustedReads = [
+    'git fetch origin --quiet 2>&1; git status; git log --oneline -1',
+    'git remote -v',
+    'gh run view 1 --json status',
+    'node -e "console.log(42)"',
+  ];
+  for (const command of untrustedReads) {
+    const before = read(file);
+    const call = beginShell(command);
+    check(call.result.status === 0, 'untrusted read/query is admitted under observation: ' + command);
+    const probes = probeFiles();
+    check(probes.length === 1 && !fs.readFileSync(path.join(probeDir, probes[0]), 'utf8').includes(command),
+      'mutation probe persists only opaque identity, not raw command text');
+    check(persistShell(call).status === 0, 'no-effect shell probe resolves through state-persist: ' + command);
+    check(probeFiles().length === 0, 'completed shell call removes its mutation probe');
+    const after = read(file);
+    check((after.budget?.counters?.iterations || 0) === (before.budget?.counters?.iterations || 0),
+      'no-effect untrusted shell command consumes no iteration');
+    check((after.lastMutationAt || 0) === (before.lastMutationAt || 0),
+      'no-effect untrusted shell command does not advance lastMutationAt');
+  }
+
+  const deniedCall = beginShell('node denied-by-auto-mode.js');
+  check(deniedCall.result.status === 0 && probeFiles().length === 1,
+    'auto-mode candidate reserves mutation capacity before permission decision');
+  check(denyShell(deniedCall).status === 0 && probeFiles().length === 0,
+    'PermissionDenied releases the exact tool-use mutation probe');
+  const parallelA = beginShell('node repeated-read-only-wrapper.js');
+  const parallelB = beginShell('node repeated-read-only-wrapper.js');
+  check(parallelA.result.status === 0 && parallelB.result.status === 0 && probeFiles().length === 2,
+    'identical concurrent shell commands receive distinct tool-use probes');
+  check(denyShell(parallelA).status === 0 && persistShell(parallelB).status === 0 && probeFiles().length === 0,
+    'parallel tool-use probes settle independently without reservation leakage');
+
+  const metadataFetch = 'git fetch . HEAD:refs/remotes/origin/harness-probe';
+  const beforeMetadataFetch = read(file);
+  const metadataFetchCall = beginShell(metadataFetch);
+  check(metadataFetchCall.result.status === 0,
+    'metadata-only git fetch is admitted under observation');
+  git(['fetch', '.', 'HEAD:refs/remotes/origin/harness-probe']);
+  check(persistShell(metadataFetchCall).status === 0, 'real metadata-only git fetch probe resolves');
+  check((read(file).budget?.counters?.iterations || 0) === (beforeMetadataFetch.budget?.counters?.iterations || 0) &&
+    (read(file).lastMutationAt || 0) === (beforeMetadataFetch.lastMutationAt || 0),
+    'real git fetch changes Git metadata without consuming a code iteration');
+
+  let observedIterations = read(file).budget?.counters?.iterations || 0;
+  const mutateTracked = 'node mutate-tracked.js';
+  const mutateTrackedCall = beginShell(mutateTracked);
+  check(mutateTrackedCall.result.status === 0, 'unknown tracked-file mutator is admitted under observation');
+  fs.writeFileSync(path.join(repo, 'README.md'), 'fixture changed once\n');
+  check(persistShell(mutateTrackedCall).status === 0, 'tracked-file mutation is observed');
+  check(read(file).budget.counters.iterations === ++observedIterations, 'tracked-file mutation consumes exactly one iteration');
+  const firstObservedAt = read(file).lastMutationAt;
+
+  const mutateDirty = 'node mutate-dirty-again.js';
+  const mutateDirtyCall = beginShell(mutateDirty);
+  check(mutateDirtyCall.result.status === 0, 'unknown already-dirty mutator is admitted under observation');
+  fs.writeFileSync(path.join(repo, 'README.md'), 'fixture changed twice\n');
+  check(persistShell(mutateDirtyCall).status === 0, 'already-dirty content change is observed');
+  check(read(file).budget.counters.iterations === ++observedIterations && read(file).lastMutationAt >= firstObservedAt,
+    'already-dirty content change consumes one new iteration');
+
+  const createUntracked = 'node create-untracked.js';
+  const createUntrackedCall = beginShell(createUntracked);
+  check(createUntrackedCall.result.status === 0, 'unknown untracked-file mutator is admitted under observation');
+  fs.writeFileSync(path.join(repo, 'observed-untracked.txt'), 'one\n');
+  check(persistShell(createUntrackedCall).status === 0, 'untracked-file creation is observed');
+  check(read(file).budget.counters.iterations === ++observedIterations, 'untracked-file creation consumes exactly one iteration');
+
+  const failedMutation = 'node fail-after-write.js';
+  const failedMutationCall = beginShell(failedMutation);
+  check(failedMutationCall.result.status === 0, 'failing shell mutator is admitted under observation');
+  fs.writeFileSync(path.join(repo, 'observed-failed.txt'), 'written before failure\n');
+  check(persistShell(failedMutationCall, { error: 'Exit code 7\nfixture failure' }, 'PostToolUseFailure').status === 0,
+    'failed shell command still reports workspace mutation through failure lifecycle');
+  check(read(file).budget.counters.iterations === ++observedIterations,
+    'failed shell command that changed workspace still consumes one iteration');
+
+  const beforeStageOnly = read(file);
+  const stageOnly = 'git add README.md observed-untracked.txt';
+  const stageOnlyCall = beginShell(stageOnly);
+  check(stageOnlyCall.result.status === 0, 'staging-only git command is observed instead of pre-counted');
+  git(['add', 'README.md', 'observed-untracked.txt']);
+  check(persistShell(stageOnlyCall).status === 0, 'staging-only probe resolves');
+  check(read(file).budget.counters.iterations === beforeStageOnly.budget.counters.iterations,
+    'git add does not double-count tracked or previously-untracked visible content');
+
+  const beforeCommitOnly = read(file);
+  const commitOnly = 'git commit -m observed-fixture';
+  const commitOnlyCall = beginShell(commitOnly);
+  check(commitOnlyCall.result.status === 0, 'pure commit is observed instead of pre-counted');
+  git(['-c', 'user.name=Harness Test', '-c', 'user.email=harness@example.invalid', 'commit', '-m', 'observed-fixture']);
+  check(persistShell(commitOnlyCall).status === 0, 'pure commit probe resolves');
+  check(read(file).budget.counters.iterations === beforeCommitOnly.budget.counters.iterations,
+    'pure commit of already-accounted content does not consume another code iteration');
+
+  const deleteTracked = 'node delete-tracked.js';
+  const deleteTrackedCall = beginShell(deleteTracked);
+  check(deleteTrackedCall.result.status === 0, 'unknown tracked-file deletion is admitted under observation');
+  fs.unlinkSync(path.join(repo, 'observed-untracked.txt'));
+  check(persistShell(deleteTrackedCall).status === 0, 'tracked-file deletion is observed');
+  check(read(file).budget.counters.iterations === ++observedIterations,
+    'tracked-file deletion consumes exactly one iteration');
+
+  const beforeStageDelete = read(file);
+  const stageDelete = 'git add -u observed-untracked.txt';
+  const stageDeleteCall = beginShell(stageDelete);
+  check(stageDeleteCall.result.status === 0, 'staging-only deletion is observed instead of pre-counted');
+  git(['add', '-u', 'observed-untracked.txt']);
+  check(persistShell(stageDeleteCall).status === 0, 'staging deletion probe resolves');
+  check(read(file).budget.counters.iterations === beforeStageDelete.budget.counters.iterations,
+    'git add -u does not double-count an already-observed deletion');
+
+  observedIterations = read(file).budget.counters.iterations;
+  for (let i = observedIterations; i < iterationLimit; i++) {
+    check(gate('Write', { file_path: path.join(repo, `small-${i}.js`) }, repo).status === 0, `confirmed mutation ${i + 1}/${iterationLimit} stays within budget`);
   }
-  check(gate('Write', { file_path: path.join(repo, 'small-overflow.js') }, repo).status === 2, 'iteration beyond maxIterations is blocked');
+  check(gate('Bash', { command: 'git status --short' }, repo).status === 0,
+    'proven read-only diagnosis remains allowed at the iteration limit');
+  check(gate('Bash', { command: 'git remote -v' }, repo).status === 2,
+    'untrusted shell command is blocked before execution once actual mutation budget is full');
+  check(gate('Write', { file_path: path.join(repo, 'small-overflow.js') }, repo).status === 2,
+    'blocked exhausted workflow still rejects direct mutation');
   const iterativeExhausted = read(file);
   check(iterativeExhausted.state === 'blocked' && iterativeExhausted.budget?.state === 'budget-exhausted' &&
     iterativeExhausted.budget?.reasonCode === 'iteration-budget-exhausted', 'iterative exhaustion records blocked budget state');
@@ -175,11 +362,16 @@ try {
   check(stop().status === 2, 'direct/iterative route cannot complete unverified mutation');
   check(stop({ stop_hook_active: true }).status === 0 && read(file).state === 'blocked', 'iterative retry reports incomplete state');
   check(control('start').status === 0, 'blocked iterative route can resume without a Fable stage map');
-  // Issue #153: a host is not guaranteed to report a numeric exit code at
-  // all (state-persist.js's own isFailed logic already treats "no exit code
-  // and no stderr" as success), so this must resolve rather than deadlock.
-  node('hooks/scripts/state-persist.js', { ...payload, tool_name: 'Bash', tool_input: { command: 'npm test' }, tool_response: { stdout: 'no code' } });
-  check(stop().status === 0 && read(file).state === 'satisfied', 'verification without a host-reported numeric exit status still resolves completion');
+  // #153 + #159 ordering: when one shell command mutates and then verifies,
+  // observed mutation must land before state-persist records verification.
+  const mutateAndVerify = 'node mutate.js && npm test';
+  const mutateAndVerifyCall = beginShell(mutateAndVerify);
+  check(mutateAndVerifyCall.result.status === 0, 'combined mutation+verification command is admitted under observation');
+  fs.writeFileSync(path.join(repo, 'README.md'), 'fixture verified mutation\n');
+  check(persistShell(mutateAndVerifyCall, { stdout: 'tests passed' }).status === 0,
+    'single state-persist handler records mutation before verification');
+  check(stop().status === 0 && read(file).state === 'satisfied',
+    'verification without a host-reported numeric exit status resolves after same-command mutation');
   node('hooks/scripts/state-persist.js', { ...payload, tool_name: 'Bash', tool_input: { command: 'npm test' }, tool_response: { exitCode: 0, stdout: 'passed' } });
   check(stop().status === 0 && read(file).state === 'satisfied', 'observed iterative verification resolves completion');
   console.log(`PASS: workflow lifecycle (${passed} assertions)`);

package/hooks/hooks.json

@@ -157,6 +157,19 @@
         "id": "harness:stop:skill-telemetry"
       }
     ],
+    "PermissionDenied": [
+      {
+        "matcher": "Bash|PowerShell",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/workflow-mutation-denied.js\""
+          }
+        ],
+        "description": "Release reserved mutation capacity when Claude auto mode denies a shell tool call",
+        "id": "harness:permission-denied:mutation-probe"
+      }
+    ],
     "PostToolUse": [
       {
         "matcher": "Bash|PowerShell|mcp__.*",
@@ -188,7 +201,7 @@
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/state-persist.js\""
           }
         ],
-        "description": "Save skill transition state",
+        "description": "Persist tool outcome, observed workspace mutation, and verification milestones",
         "id": "harness:post:state-persist"
       },
       {
@@ -259,6 +272,17 @@
         "description": "Track failed tool error signatures for Rule of 3",
         "id": "harness:post-failure:rule-of-3-tracker"
       },
+      {
+        "matcher": "Bash|PowerShell",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/state-persist.js\""
+          }
+        ],
+        "description": "Persist failed shell outcome and any workspace mutation that occurred before failure",
+        "id": "harness:post-failure:state-persist"
+      },
       {
         "matcher": "Skill",
         "hooks": [

package/hooks/scripts/lib/workflow-isolation.js

@@ -1,13 +1,89 @@
 'use strict';
 
 const fs = require('fs');
+const crypto = require('crypto');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
-function git(cwd, args) {
-  const result = spawnSync('git', args, { cwd, encoding: 'utf8', windowsHide: true, timeout: 5000 });
+function gitRaw(cwd, args) {
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8', windowsHide: true, timeout: 5000, maxBuffer: 16 * 1024 * 1024 });
   if (result.status !== 0) throw new Error('cannot verify Git worktree isolation');
-  return result.stdout.trim();
+  return result.stdout;
+}
+
+function git(cwd, args) {
+  return gitRaw(cwd, args).trim();
+}
+
+function hashWorktreePath(root, relative) {
+  const target = path.join(root, relative);
+  let stat;
+  try { stat = fs.lstatSync(target); }
+  catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  }
+  if (stat.isDirectory()) {
+    const result = spawnSync('git', ['-C', target, 'rev-parse', 'HEAD'], { encoding: 'utf8', windowsHide: true, timeout: 5000 });
+    return { mode: '160000', oid: result.status === 0 ? result.stdout.trim() : 'directory' };
+  }
+  const mode = stat.isSymbolicLink() ? '120000' : ((stat.mode & 0o111) ? '100755' : '100644');
+  const result = spawnSync('git', ['hash-object', '--path=' + relative, '--', relative], {
+    cwd: root, encoding: 'utf8', windowsHide: true, timeout: 5000,
+  });
+  if (result.status !== 0) throw new Error('cannot fingerprint workspace content');
+  return { mode, oid: result.stdout.trim() };
+}
+
+function workspaceFingerprint(cwd) {
+  const root = canonical(git(cwd, ['rev-parse', '--show-toplevel']));
+  const entries = new Map();
+  for (const record of gitRaw(root, ['ls-files', '-s', '-z']).split('\0')) {
+    if (!record) continue;
+    const tab = record.indexOf('\t');
+    if (tab < 0) throw new Error('cannot fingerprint workspace index');
+    const meta = record.slice(0, tab).trim().split(/\s+/);
+    const relative = record.slice(tab + 1);
+    const mode = meta[0];
+    const oid = meta[1];
+    entries.set(relative, { relative, mode, oid });
+  }
+
+  // Substitute current worktree content for tracked paths that differ from the
+  // index. This keeps the fingerprint stable across git add / git commit when
+  // visible workspace content did not change.
+  for (const relative of gitRaw(root, ['diff-files', '--name-only', '-z']).split('\0').filter(Boolean)) {
+    const value = hashWorktreePath(root, relative);
+    if (value) entries.set(relative, { relative, mode: value.mode, oid: value.oid });
+    else entries.delete(relative);
+  }
+
+  for (const relative of gitRaw(root, ['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean)) {
+    const value = hashWorktreePath(root, relative);
+    entries.set(relative, { relative, mode: value.mode, oid: value.oid });
+  }
+
+  const digest = crypto.createHash('sha256');
+  digest.update('harness-workspace-fingerprint-v1\0');
+  for (const entry of [...entries.values()].sort((a, b) => a.relative.localeCompare(b.relative))) {
+    digest.update(entry.relative); digest.update('\0');
+    digest.update(entry.mode); digest.update('\0');
+    digest.update(entry.oid); digest.update('\0');
+  }
+  return digest.digest('hex');
+}
+
+function shellProbeKey(payload, cwd) {
+  const toolUseId = String(payload?.tool_use_id || payload?.toolUseId || '').trim();
+  const tool = String(payload?.tool_name || payload?.tool || '');
+  const command = commandOf(payload);
+  return crypto.createHash('sha256')
+    .update('harness-shell-probe-v2\0')
+    .update(toolUseId || 'no-tool-use-id').update('\0')
+    .update(tool).update('\0')
+    .update(key(cwd)).update('\0')
+    .update(command)
+    .digest('hex');
 }
 
 function canonical(value) {
@@ -43,13 +119,12 @@ function linkedWorktree(cwd, boundRoot) {
   return worktrees.some(field => field.startsWith('worktree ') && key(field.slice(9)) === key(top)) ? top : null;
 }
 
-// A conservative read subset, not a general shell sandbox. Chaining (`;`, `&&`,
-// `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect are permitted only
-// when every resulting segment independently matches the trusted read-only set
-// below; any other metacharacter (substitution, grouping, a lone `&`, a file
-// redirect, `<`) still forces mutation-or-unknown for the whole command.
-const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/;
-const SAFE_FD_REDIRECT_RE = /[12]>&[12]/g;
+// A conservative read subset, not a general shell sandbox. Top-level chaining
+// (`;`, `&&`, `||`, `|`) and the `2>&1`/`1>&2` fd-duplication redirect
+// are permitted only when every resulting segment independently matches the
+// trusted read-only set below. The scanner is deliberately lexical rather than
+// a raw regex split so quoted/escaped separator characters remain arguments.
+// Unsupported shell syntax still fails closed.
 const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
 const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
 
@@ -57,20 +132,102 @@ function isReadOnlySegment(segment) {
   return READ_ONLY_PREFIX_RE.test(segment) && !DANGEROUS_FLAG_RE.test(segment);
 }
 
+function splitShellSegments(text) {
+  const segments = [];
+  let current = '';
+  let quote = null;
+
+  const push = () => {
+    const segment = current.trim();
+    if (!segment) return false;
+    segments.push(segment);
+    current = '';
+    return true;
+  };
+
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+
+    if (quote === "'") {
+      current += ch;
+      if (ch === "'") quote = null;
+      continue;
+    }
+
+    if (quote === '"') {
+      if (ch === '$' || ch === '`') return null;
+      current += ch;
+      if (ch === '"') {
+        quote = null;
+      } else if (ch === '\\') {
+        if (i + 1 >= text.length) return null;
+        current += text[++i];
+      }
+      continue;
+    }
+
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+
+    if (ch === '\\') {
+      if (i + 1 >= text.length) return null;
+      current += ch + text[++i];
+      continue;
+    }
+
+    if (ch === '$' || ch === '`' || ch === '(' || ch === ')' || ch === '{' || ch === '}' ||
+        ch === '\r' || ch === '\n' || ch === '\x00') return null;
+
+    // Only treat fd duplication as syntax at a token boundary. Quoted text such
+    // as "2>&1" was handled above and remains literal argument content.
+    if ((ch === '1' || ch === '2') && text[i + 1] === '>' && text[i + 2] === '&' &&
+        (text[i + 3] === '1' || text[i + 3] === '2') &&
+        (i === 0 || /\s/.test(text[i - 1])) &&
+        (i + 4 === text.length || /[\s;|&]/.test(text[i + 4]))) {
+      current += ' ';
+      i += 3;
+      continue;
+    }
+
+    if (ch === '>' || ch === '<') return null;
+
+    if (ch === ';') {
+      if (!push()) return null;
+      continue;
+    }
+
+    if (ch === '|') {
+      if (!push()) return null;
+      if (text[i + 1] === '|') i++;
+      continue;
+    }
+
+    if (ch === '&') {
+      if (text[i + 1] !== '&' || !push()) return null;
+      i++;
+      continue;
+    }
+
+    current += ch;
+  }
+
+  if (quote || !push()) return null;
+  return segments;
+}
+
 function classifyShell(command) {
   const text = String(command || '').trim();
-  if (!text || /[`$(){}\r\n\x00]/.test(text)) return 'mutation-or-unknown';
-  // Strip the safe `2>&1`/`1>&2` fd-duplication redirect first: it contains a
-  // literal `&` that must not be mistaken for a lone backgrounding `&`.
-  const withoutSafeRedirects = text.replace(SAFE_FD_REDIRECT_RE, ' ');
-  if (/&/.test(withoutSafeRedirects.replace(/&&/g, ''))) return 'mutation-or-unknown';
-  if (/[<>]/.test(withoutSafeRedirects)) return 'mutation-or-unknown';
-  const segments = text.split(SHELL_SEPARATOR_RE).map(segment => segment.replace(SAFE_FD_REDIRECT_RE, '').trim());
+  if (!text) return 'untrusted';
+  const segments = splitShellSegments(text);
+  if (!segments) return 'untrusted';
   if (segments.length === 1) {
     if (/^git\s+worktree\s+add\s+/i.test(segments[0]) && !/\s--(?:force|checkout|detach)(?:\s|=|$)/i.test(segments[0])) return 'worktree-setup';
     return isReadOnlySegment(segments[0]) ? 'read-only' : 'mutation-or-unknown';
   }
-  return segments.every(segment => segment && isReadOnlySegment(segment)) ? 'read-only' : 'mutation-or-unknown';
+  return segments.every(isReadOnlySegment) ? 'read-only' : 'mutation-or-unknown';
 }
 
 function inputOf(payload) { return payload?.tool_input ?? payload?.toolInput ?? payload?.input ?? {}; }
@@ -117,4 +274,4 @@ function assertShellScope(command, cwd, isolatedRoot) {
   }
 }
 
-module.exports = { canonical, key, within, linkedWorktree, classifyShell, inputOf, cwdOf, commandOf, mutationPaths, assertTargets, assertShellScope };
+module.exports = { canonical, key, within, linkedWorktree, classifyShell, workspaceFingerprint, shellProbeKey, inputOf, cwdOf, commandOf, mutationPaths, assertTargets, assertShellScope };