harness-everything 0.16.4 → 0.16.6

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.16.4",
+      "version": "0.16.6",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.16.4",
+  "version": "0.16.6",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.16.6](https://github.com/dyphn1/Harness-everything/compare/v0.16.5...v0.16.6) (2026-09-21)
+
+### Bug Fixes
+
+* **environment-detection:** keep discovery read-only ([#214](https://github.com/dyphn1/Harness-everything/issues/214)) ([f6fa7ec](https://github.com/dyphn1/Harness-everything/commit/f6fa7ec57fb95072dce1177ee4e93718b77b21ef))
+
+## [0.16.5](https://github.com/dyphn1/Harness-everything/compare/v0.16.4...v0.16.5) (2026-09-21)
+
+### Bug Fixes
+
+* **codex:** make packaged helper runtime self-contained ([96cba55](https://github.com/dyphn1/Harness-everything/commit/96cba55b2347251c90306a727825377ba26465c2))
+
 ## [0.16.4](https://github.com/dyphn1/Harness-everything/compare/v0.16.3...v0.16.4) (2026-09-20)
 
 ### Bug Fixes

package/ci/mechanism-2am-openai-packaged-helper-runtime.test.js

@@ -0,0 +1,110 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const repoRoot = path.resolve(__dirname, '..');
+const packagedPlugin = path.join(repoRoot, 'plugins', 'harness-everything');
+
+function runNode(script, args, options) {
+  return spawnSync(process.execPath, [script, ...args], {
+    cwd: options.cwd,
+    env: { ...process.env, ...options.env },
+    input: options.input,
+    encoding: 'utf8'
+  });
+}
+
+function describe(result) {
+  return [result.stdout, result.stderr].filter(Boolean).join('\n');
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-openai-plugin-'));
+try {
+  const pluginRoot = path.join(tempRoot, 'plugin');
+  const workspaceRoot = path.join(tempRoot, 'workspace');
+  const stateHome = path.join(tempRoot, 'state');
+  fs.cpSync(packagedPlugin, pluginRoot, { recursive: true });
+  fs.mkdirSync(workspaceRoot, { recursive: true });
+  fs.mkdirSync(stateHome, { recursive: true });
+  fs.mkdirSync(path.join(workspaceRoot, '.git'), { recursive: true });
+  fs.writeFileSync(path.join(workspaceRoot, 'AGENTS.md'), '# managed workspace\n', 'utf8');
+
+  const env = {
+    HARNESS_STATE_HOME: stateHome,
+    HARNESS_WORKSPACE_ROOT: workspaceRoot,
+  };
+
+  const scriptsRoot = path.join(pluginRoot, 'skills', 'harness-everything', 'scripts');
+  const selfHeal = runNode(path.join(scriptsRoot, 'self-heal.js'), ['--check'], {
+    cwd: workspaceRoot,
+    env,
+  });
+  assert.strictEqual(selfHeal.status, 0, `packaged self-heal --check failed:\n${describe(selfHeal)}`);
+
+  // Public OpenAI skills-only submissions intentionally omit the plugin-root
+  // installer/runtime. The read-only audit must degrade safely instead of
+  // searching arbitrary parent/cache paths or failing skill execution.
+  const skillsOnlyRoot = path.join(tempRoot, 'skills-only');
+  const skillsOnlyWorkspace = path.join(tempRoot, 'skills-only-workspace');
+  fs.cpSync(path.join(pluginRoot, 'skills'), path.join(skillsOnlyRoot, 'skills'), { recursive: true });
+  fs.mkdirSync(path.join(skillsOnlyWorkspace, '.git'), { recursive: true });
+  fs.writeFileSync(path.join(skillsOnlyWorkspace, 'AGENTS.md'), '# skills-only workspace\n', 'utf8');
+  const skillsOnlyAgentsBefore = fs.readFileSync(path.join(skillsOnlyWorkspace, 'AGENTS.md'), 'utf8');
+  const skillsOnlyCheck = runNode(
+    path.join(skillsOnlyRoot, 'skills', 'harness-everything', 'scripts', 'self-heal.js'),
+    ['--check'],
+    {
+      cwd: skillsOnlyWorkspace,
+      env: {
+        HARNESS_STATE_HOME: path.join(tempRoot, 'skills-only-state'),
+        HARNESS_WORKSPACE_ROOT: skillsOnlyWorkspace,
+      },
+    }
+  );
+  assert.strictEqual(skillsOnlyCheck.status, 0, `skills-only self-heal --check failed:\n${describe(skillsOnlyCheck)}`);
+  assert.match(describe(skillsOnlyCheck), /Local repair runtime unavailable on this distribution surface/);
+  assert.strictEqual(
+    fs.readFileSync(path.join(skillsOnlyWorkspace, 'AGENTS.md'), 'utf8'),
+    skillsOnlyAgentsBefore,
+    'skills-only read-only audit must not rewrite workspace integration files'
+  );
+
+  const installer = runNode(path.join(pluginRoot, 'scripts', 'installer.js'), ['--codex', '--no-skills', '--yes'], {
+    cwd: workspaceRoot,
+    env,
+  });
+  assert.strictEqual(installer.status, 0, `packaged installer failed:\n${describe(installer)}`);
+  assert.match(
+    fs.readFileSync(path.join(workspaceRoot, 'AGENTS.md'), 'utf8'),
+    /Harness OS Guidance \(Advisory\)/,
+    'packaged installer did not write the Codex advisory file'
+  );
+
+  const bootstrap = runNode(path.join(scriptsRoot, 'bootstrap.js'), [], {
+    cwd: workspaceRoot,
+    env,
+    input: JSON.stringify({ session_id: 'packaged-runtime-smoke', cwd: workspaceRoot }),
+  });
+  assert.strictEqual(bootstrap.status, 0, `packaged bootstrap failed:\n${describe(bootstrap)}`);
+  assert.match(describe(bootstrap), /Harness OS initialized/, 'packaged bootstrap did not initialize Harness');
+
+  const tierRouter = runNode(path.join(scriptsRoot, 'tier-router.js'), ['audit the repository and run tests'], {
+    cwd: workspaceRoot,
+    env,
+  });
+  assert.strictEqual(tierRouter.status, 0, `packaged tier-router failed:\n${describe(tierRouter)}`);
+  assert.doesNotMatch(
+    describe(tierRouter),
+    /BASE EXECUTION LOOP: Load 'todo-driven-workflow'/,
+    'direct packaged tier-router still emits retired mandatory todo guidance'
+  );
+  assert.match(describe(tierRouter), /WORKFLOW STRATEGY:/, 'packaged tier-router did not emit the workflow contract');
+
+  console.log('OpenAI packaged helper runtime smoke test passed');
+} finally {
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+}

package/ci/mechanism-2an-environment-detection-readonly.test.js

@@ -0,0 +1,113 @@
+'use strict';
+
+const assert = require('assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const SELF_HEAL = path.join(ROOT, 'harness-everything', 'scripts', 'self-heal.js');
+const SKILL = path.join(ROOT, 'environment-detection', 'SKILL.md');
+const OPENCODE = path.join(ROOT, 'opencode-plugin', 'index.mjs');
+
+function write(root, relative, content) {
+  const target = path.join(root, relative);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, content, 'utf8');
+  return target;
+}
+
+function treeDigest(root) {
+  const hash = crypto.createHash('sha256');
+  function walk(dir, relative = '') {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const rel = relative ? `${relative}/${entry.name}` : entry.name;
+      const full = path.join(dir, entry.name);
+      hash.update(`${entry.isDirectory() ? 'D' : 'F'}:${rel}\0`);
+      if (entry.isDirectory()) walk(full, rel);
+      else hash.update(fs.readFileSync(full));
+    }
+  }
+  walk(root);
+  return hash.digest('hex');
+}
+
+function run(workspace, home, args) {
+  const env = {
+    ...process.env,
+    HARNESS_WORKSPACE_ROOT: workspace,
+    HARNESS_STATE_HOME: path.join(home, 'state'),
+    HOME: home,
+    USERPROFILE: home,
+    APPDATA: path.join(home, 'AppData', 'Roaming'),
+    VSCODE_USER_PROMPTS_FOLDER: path.join(home, 'vscode-prompts'),
+  };
+  for (const key of ['CLAUDE', 'CLAUDECODE', 'CLAUDE_CODE', 'CURSOR_SANDBOX', 'GITHUB_COPILOT_CHAT', 'COPILOT_AGENT', 'AI_AGENT']) {
+    delete env[key];
+  }
+  return spawnSync(process.execPath, [SELF_HEAL, ...args], {
+    cwd: workspace,
+    env,
+    encoding: 'utf8',
+  });
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-213-readonly-'));
+try {
+  const workspace = path.join(tempRoot, 'workspace');
+  const home = path.join(tempRoot, 'home');
+  fs.mkdirSync(path.join(workspace, '.git'), { recursive: true });
+  fs.mkdirSync(home, { recursive: true });
+
+  // Seed all six installer/self-heal adapter surfaces with user-owned content.
+  write(workspace, '.claude/settings.json', JSON.stringify({ customSetting: true, hooks: {} }, null, 2));
+  write(workspace, '.cursorrules', 'user cursor rule\n');
+  write(workspace, '.github/copilot-instructions.md', 'user copilot instruction\n');
+  write(workspace, 'AGENTS.md', 'user codex instruction\n');
+  write(workspace, '.continue/rules/user.md', '# user continue rule\n');
+  write(workspace, '.hermes.md', 'user hermes context\n');
+
+  const beforeAudit = treeDigest(workspace);
+  const audit = run(workspace, home, ['--check']);
+  assert.strictEqual(audit.status, 0, `read-only audit failed:\n${audit.stdout}\n${audit.stderr}`);
+  assert.strictEqual(treeDigest(workspace), beforeAudit, '--check changed the workspace');
+  for (const label of ['Claude Code hooks', 'Cursor rules', 'Copilot instructions', 'Codex instructions', 'Continue.dev rules', 'Hermes Agent instructions']) {
+    assert.ok(audit.stdout.includes(label), `audit omitted ${label}`);
+  }
+
+  // Explicit repair remains available, preserves user-owned content, and is
+  // idempotent on the second run.
+  const repair = run(workspace, home, []);
+  assert.strictEqual(repair.status, 0, `explicit repair failed:\n${repair.stdout}\n${repair.stderr}`);
+  assert.strictEqual(JSON.parse(fs.readFileSync(path.join(workspace, '.claude/settings.json'), 'utf8')).customSetting, true);
+  assert.match(fs.readFileSync(path.join(workspace, '.cursorrules'), 'utf8'), /user cursor rule/);
+  assert.match(fs.readFileSync(path.join(workspace, '.github', 'copilot-instructions.md'), 'utf8'), /user copilot instruction/);
+  assert.match(fs.readFileSync(path.join(workspace, 'AGENTS.md'), 'utf8'), /user codex instruction/);
+  assert.match(fs.readFileSync(path.join(workspace, '.hermes.md'), 'utf8'), /user hermes context/);
+  assert.strictEqual(fs.readFileSync(path.join(workspace, '.continue', 'rules', 'user.md'), 'utf8'), '# user continue rule\n');
+
+  const afterRepair = treeDigest(workspace);
+  const secondRepair = run(workspace, home, []);
+  assert.strictEqual(secondRepair.status, 0, `second repair failed:\n${secondRepair.stdout}\n${secondRepair.stderr}`);
+  assert.strictEqual(treeDigest(workspace), afterRepair, 'explicit repair is not idempotent');
+
+  // The routed skill contract must keep default detection observational and
+  // use a portable sibling-skill path rather than a repository/cache root.
+  const skill = fs.readFileSync(SKILL, 'utf8');
+  assert.ok(skill.includes('self-heal.js" --check'));
+  assert.doesNotMatch(skill, /<skills-repo-root>/);
+  assert.match(skill, /Only explicit install\/setup\/repair intent may omit/);
+  assert.match(skill, /OpenCode has its own plugin runtime/);
+  assert.match(skill, /skills-only surfaces may lack repair/);
+
+  // OpenCode is a separate runtime surface; its session/plugin startup must
+  // not import or invoke the six-adapter installer/self-heal path implicitly.
+  const opencode = fs.readFileSync(OPENCODE, 'utf8');
+  assert.doesNotMatch(opencode, /self-heal\.js|scripts[\\/]installer\.js/);
+
+  console.log('Issue #213 verified: detection is read-only across six adapters, repair is explicit/idempotent, and OpenCode stays separate.');
+} finally {
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+}

package/ci/skill-routing-check.js

@@ -49,7 +49,7 @@ function discoverNestedSkills(skillDir) {
 
 function expectedMarker(skill) {
   if (skill === 'harness-everything') return 'RECOMMENDED TIER';
-  if (skill === 'todo-driven-workflow') return 'BASE EXECUTION LOOP';
+  if (skill === 'todo-driven-workflow') return 'WORKFLOW STRATEGY';
   return `${skill}/SKILL.md`;
 }
 

package/docs/workflows/environment-detection.md

@@ -13,8 +13,12 @@ graph TD
   PreflightOk -->|yes| ParseOut[Parse OS shell PATH and CLIs]
   PreflightOk -->|no| FallbackProbe[Inspect environment_info and probe shell]
   FallbackProbe --> ParseOut
-  ParseOut --> SelfHealAudit[Audit harness touchpoints with self-heal.js]
-  SelfHealAudit --> AdoptSyntax[Adopt shell-specific syntax]
+  ParseOut --> SelfHealAudit[Run self-heal.js --check when supported]
+  SelfHealAudit --> Drift{Integration drift found?}
+  Drift -->|ordinary detection| ReportOnly[Report only; do not mutate]
+  Drift -->|explicit repair intent| Repair[Run supported platform repair]
+  ReportOnly --> AdoptSyntax[Adopt shell-specific syntax]
+  Repair --> AdoptSyntax
   AdoptSyntax --> DoneCtx([Session context aligned])
 ```
 
@@ -48,10 +52,11 @@ graph LR
 A session starts on Windows with PowerShell as the active shell. The agent needs to list files and check Node availability before running tests.
 
 1. Run `node "<skill-dir>/scripts/preflight.js"` to detect Windows + PowerShell + available CLIs.
-2. Adopt PowerShell syntax for paths and env vars instead of Git Bash assumptions.
-3. If `preflight.js` cannot run, inspect `<environment_info>` and probe with minimal echo/env commands, then adopt syntax.
-4. Stay inside `process.cwd()`; ignore other workspace, history, or temp paths shown by the IDE.
-5. If the same aligned command still fails three times, stop retrying the syntax and trigger `zoom-out`.
+2. Where the local Harness runtime exists, run self-heal in `--check` mode only; report drift without changing hooks or advisory files.
+3. If the helper/runtime is absent (for example a skills-only distribution), report that the local repair surface is unavailable and continue without searching parent/cache paths.
+4. Only an explicit install/setup/repair request may invoke mutating self-heal. OpenCode keeps its separate plugin installation/runtime boundary.
+5. Adopt PowerShell syntax for paths and env vars instead of Git Bash assumptions. If `preflight.js` cannot run, inspect `<environment_info>` and probe minimally.
+6. Stay inside `process.cwd()`; if the same aligned command still fails three times, trigger `zoom-out`.
 
 ```mermaid
 graph TD
@@ -68,6 +73,9 @@ graph TD
 - [ ] Detection ran at session start via `environment-detection/scripts/preflight.js`, with `<environment_info>` inspection and probing used only as fallback
 - [ ] Adopted syntax matches detected shell: Git Bash uses `/`, `$VAR`, Unix cmds without `dir`/`del`; PowerShell uses `$env:VAR` and cmdlets; CMD uses `\`, `%VAR%`, `dir`/`del`/`copy` without Unix cmds
 - [ ] All commands stayed inside `process.cwd()`; no commands ran outside the current project root
-- [ ] No toolchain installation was attempted; scope stayed to detection, alignment, and touchpoint repair
+- [ ] Ordinary detection changed no workspace integration files; touchpoint inspection used `--check` or safely skipped an unavailable local runtime
+- [ ] Mutating self-heal ran only for explicit install/setup/repair intent and only on a supported local platform surface
+- [ ] OpenCode was kept on its separate plugin runtime; skills-only distributions did not assume a local installer
+- [ ] No toolchain installation was attempted; scope stayed to detection and alignment
 - [ ] After three failures of the same command, execution stopped blind retry and triggered `zoom-out`
 - [ ] Shell detail followed `environment-detection/references/shell-syntax-rules.md` where needed

package/environment-detection/SKILL.md

@@ -4,38 +4,37 @@ description: Use at session start (Discover phase) to detect and align with the
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.16.6
 ---
 
 # Environment Detection & Shell Alignment
 
-Think > Try > Summarize > Record: detect before executing.
-
 ## 📋 Skill Contract
 
 | Component | Specification |
 | :--- | :--- |
 | **Trigger / Input** | Session start or complex terminal sequences. |
-| **Expected Output** | Detected OS, shell, PATH via script or heuristics. |
-| **State Mutations** | Session context adopts path/env-var syntax. |
-| **Enforcement Gate** | Preflight; fall back to `<environment_info>` inspection and probing. |
+| **Expected Output** | OS, shell, PATH, available CLIs. |
+| **State Mutations** | Read-only by default; explicit repair may update Harness files. |
+| **Enforcement Gate** | Preflight; fall back to `<environment_info>` and minimal probes. |
 
-Boundary: operate solely within `process.cwd()`; ignore other workspaces, history, or temp paths surfaced by the IDE — never run commands outside the current project root.
+Boundary: stay inside `process.cwd()`. Detection never writes integrations or searches parent/cache paths for another runtime.
 
 ## Workflow
 
-1. Preflight from this skill's own directory; parse OS, shell, available CLIs: `node "<this-skill-dir>/scripts/preflight.js"`
-2. Self-heal harness touchpoints (idempotent): `node "<skills-repo-root>/harness-everything/scripts/self-heal.js"` — audits `<workspace>/.claude/settings.json`, `<workspace>/.cursorrules`, `<workspace>/.github/copilot-instructions.md`, `<workspace>/AGENTS.md`.
-3. Adopt syntax: Git Bash → forward `/`, `$VAR`, Unix cmds (`ls`, `rm -rf`), never `dir`/`del`/PowerShell · PowerShell → `$env:VAR`, cmdlets · CMD → `\`, `%VAR%`, `dir`/`del`/`copy`, never Unix.
-4. On failure don't blindly retry — suspect wrong-shell syntax. Three failures → trigger `zoom-out`.
+1. Run `node "<this-skill-dir>/scripts/preflight.js"`; detect OS, shell, CLIs.
+2. Where supported, audit read-only: `node "<this-skill-dir>/../harness-everything/scripts/self-heal.js" --check`. If unavailable, report and continue.
+3. Only explicit install/setup/repair intent may omit `--check`. Repair covers Claude, Codex, Copilot, Cursor, Continue, Hermes. OpenCode has its own plugin runtime; skills-only surfaces may lack repair.
+4. Adopt shell syntax: Git Bash → `/`, `$VAR`, Unix commands; PowerShell → `$env:VAR`, cmdlets; CMD → `\`, `%VAR%`, Windows commands. Three repeated failures → `zoom-out`.
 
 Deep dive: <this-skill-dir>/references/shell-syntax-rules.md
 
 ## USE FOR:
-- session-start OS/shell/toolchain detection
-- per-terminal command/path/env-var alignment
-- repairing missing harness touchpoints
+- session-start environment detection
+- shell/path/toolchain alignment
+- read-only audit or explicit repair
 
 ## DO NOT USE FOR:
-- operating outside the current workspace
-- installing toolchains from scratch
+- implicit repair during detection
+- six-adapter repair on OpenCode/skills-only surfaces
+- work outside the workspace or toolchain installation

package/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through the Harness kernel: classify T
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.16.3
+  version: 0.16.6
 ---
 
 # Harness Everything

package/harness-everything/scripts/bootstrap.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 const fs = require('fs');
 const path = require('path');
+const { getHarnessRoot, requireHarnessState, requireWorkspace } = require('./runtime-paths');
 const {
   getWorkspaceRoot,
   getSessionId,
   getSessionDir,
   writeCurrentSession,
   pruneStaleSessions,
-} = require('../../hooks/scripts/lib/harness-state');
+} = requireHarnessState();
 
 console.log("Bootstrapping Harness Skills OS...");
 
@@ -162,9 +163,9 @@ try {
   // npx/global install auditing the harness checkout itself compares two
   // different paths and wrongly advises a repair that self-heal then skips
   // (issue #40). Required lazily so a missing lib can never break session start.
-  const { isHarnessRepo } = require('../../scripts/lib/workspace');
+  const { isHarnessRepo } = requireWorkspace();
   const auditingSelf = isHarnessRepo(workspaceRoot)
-    || path.resolve(workspaceRoot) === path.resolve(__dirname, '..', '..');
+    || path.resolve(workspaceRoot) === path.resolve(getHarnessRoot());
 
   if (missing.length > 0 && !auditingSelf) {
     console.log(`\n[Self-Heal] Missing integration touchpoints: ${missing.join(', ')}`);

package/harness-everything/scripts/runtime-paths.js

@@ -0,0 +1,37 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+// Helpers live in both the source checkout and the packaged plugin's skill
+// tree. Resolve the owning runtime root instead of assuming either layout.
+function candidateRoots() {
+  return [
+    path.resolve(__dirname, '..', '..'),
+    path.resolve(__dirname, '..', '..', '..'),
+  ];
+}
+
+function getHarnessRoot() {
+  const root = candidateRoots().find(candidate =>
+    fs.existsSync(path.join(candidate, 'scripts', 'lib', 'workspace.js'))
+  );
+  if (!root) {
+    throw new Error(`Harness runtime root not found from ${__dirname}`);
+  }
+  return root;
+}
+
+function requireWorkspace() {
+  return require(path.join(getHarnessRoot(), 'scripts', 'lib', 'workspace.js'));
+}
+
+function requireHarnessState() {
+  return require(path.join(getHarnessRoot(), 'hooks', 'scripts', 'lib', 'harness-state.js'));
+}
+
+module.exports = {
+  getHarnessRoot,
+  requireWorkspace,
+  requireHarnessState,
+};

package/harness-everything/scripts/self-heal.js

@@ -2,12 +2,12 @@
 /**
  * Self-healing installation audit for Harness OS.
  *
- * Audits the six platform integration touchpoints in the current workspace
- * and, when any are missing, re-runs the idempotent installer to repair them.
- * This makes the harness portable across editors: install once via Claude
- * Code, then open the same repo in Copilot/Cursor/Codex/Continue/Hermes and
- * the missing advisory instructions are backfilled automatically the first time
- * harness-everything (or the environment-detection Discover phase) runs.
+ * Audits the six platform integration touchpoints in the current workspace.
+ * Read-only callers use --check. Repair mode is explicit: only a direct run
+ * without --check may delegate to the idempotent installer.
+ *
+ * environment-detection uses the read-only path; ordinary Discover/preflight
+ * must never backfill hooks or advisory files as a side effect.
  *
  * Usage:
  *   node self-heal.js            Audit and repair anything missing.
@@ -23,7 +23,27 @@
 const fs = require('fs');
 const path = require('path');
 const { execSync } = require('child_process');
-const { getWorkspaceRoot, isHarnessRepo } = require('../../scripts/lib/workspace');
+const { getHarnessRoot, requireWorkspace } = require('./runtime-paths');
+
+function resolveLocalRuntime(checkOnly) {
+  try {
+    const { getWorkspaceRoot, isHarnessRepo } = requireWorkspace();
+    return { getWorkspaceRoot, isHarnessRepo, harnessSourceDir: getHarnessRoot() };
+  } catch (err) {
+    const message = err && err.message ? err.message : String(err);
+    if (!/Harness runtime root not found/.test(message)) throw err;
+
+    if (checkOnly) {
+      console.log('[Harness Self-Heal Audit]');
+      console.log('  SKIPPED  Local repair runtime unavailable on this distribution surface.');
+      console.log('\nRead-only audit skipped; no workspace files were changed.');
+      return null;
+    }
+
+    console.error('Cannot repair: local Harness installer/runtime is unavailable on this distribution surface.');
+    process.exit(1);
+  }
+}
 
 const MARKER = 'Harness OS Guidance (Advisory)';
 const HOOK_ID = 'harness:pre:bootstrap';
@@ -193,8 +213,11 @@ function main() {
   const checkOnly = process.argv.includes('--check');
   const forceSelf = process.argv.includes('--force-self');
 
+  const runtime = resolveLocalRuntime(checkOnly);
+  if (!runtime) return;
+
+  const { getWorkspaceRoot, isHarnessRepo, harnessSourceDir } = runtime;
   const workspaceRoot = getWorkspaceRoot();
-  const harnessSourceDir = path.resolve(__dirname, '..', '..');
   const installerPath = path.join(harnessSourceDir, 'scripts', 'installer.js');
 
   console.log(`Workspace: ${workspaceRoot}`);

package/harness-everything/scripts/tier-router.js

@@ -5,6 +5,7 @@ const {
   buildRouterContract,
   writeRouterContract,
 } = require('./router-contract');
+const { requireWorkspace } = require('./runtime-paths');
 
 const DEFAULT_ROUTING_CONFIG = {
   tiers: { tier3: [], tier2: [] },
@@ -163,7 +164,7 @@ function plannerInputsFromContext(context, promptLower) {
 function emitDynamicSkills(promptLower, context, recommendedGuides) {
   try {
     const userHome = process.env.HOME || process.env.USERPROFILE || '';
-    const { getWorkspaceRoot } = require('../../scripts/lib/workspace');
+    const { getWorkspaceRoot } = requireWorkspace();
     const workspaceRoot = getWorkspaceRoot(context);
 
     const manifestPaths = [
@@ -315,11 +316,6 @@ function run(userPrompt, context) {
   console.log(`\n=> RECOMMENDED TIER: ${recommendedTier}`);
   console.log(`=> RATIONALE: ${rationale}`);
 
-  if (recommendedTier.startsWith('Tier 2') || recommendedTier.startsWith('Tier 3')) {
-    console.log(`\n=> BASE EXECUTION LOOP: Load 'todo-driven-workflow' and initialize its checklist (3-7 verifiable sub-tasks) BEFORE editing any file.`);
-    console.log(`   Track exactly ONE item in-progress at a time; verify with real evidence before marking completed.`);
-  }
-
   const requestedFableModel = detectFableModel(promptLower);
   if (requestedFableModel) {
     console.log(`\n=> REQUESTED FABLE MODEL MODE: ${requestedFableModel}`);

package/hooks/scripts/lib/platforms/claude.js

@@ -107,7 +107,7 @@ module.exports = {
       manifestPath: manifest.getManifestPath(claudeDir)
     };
   },
-  install({ isGlobal, targetWorkspaceRoot, harnessSourceDir, packageVersion, claudeHooks, manifest }) {
+  install({ isGlobal, targetWorkspaceRoot, harnessSourceDir, harnessRuntimeRoot = harnessSourceDir, packageVersion, claudeHooks, manifest }) {
     const userHome = require('os').homedir();
     const claudeDir = isGlobal ? path.join(userHome, '.claude') : path.join(targetWorkspaceRoot, '.claude');
     if (!fs.existsSync(claudeDir)) {
@@ -124,7 +124,7 @@ module.exports = {
       }
     }
 
-    const sourceHooksFile = path.join(harnessSourceDir, 'hooks', 'hooks.json');
+    const sourceHooksFile = path.join(harnessRuntimeRoot, 'hooks', 'hooks.json');
     if (fs.existsSync(sourceHooksFile)) {
       const sourceHooksObj = JSON.parse(fs.readFileSync(sourceHooksFile, 'utf8'));
       const resolvedHooks = {};
@@ -134,7 +134,7 @@ module.exports = {
           if (cloned.hooks) {
             cloned.hooks = cloned.hooks.map(h => {
               if (h.type === 'command' && h.command) {
-                h.command = resolveClaudeHookCommand(h.command, harnessSourceDir);
+                h.command = resolveClaudeHookCommand(h.command, harnessRuntimeRoot);
               }
               return h;
             });

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.16.4",
+  "version": "0.16.6",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.16.4",
+  "version": "0.16.6",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.16.4",
+  "version": "0.16.6",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/platforms/claude.js

@@ -107,7 +107,7 @@ module.exports = {
       manifestPath: manifest.getManifestPath(claudeDir)
     };
   },
-  install({ isGlobal, targetWorkspaceRoot, harnessSourceDir, packageVersion, claudeHooks, manifest }) {
+  install({ isGlobal, targetWorkspaceRoot, harnessSourceDir, harnessRuntimeRoot = harnessSourceDir, packageVersion, claudeHooks, manifest }) {
     const userHome = require('os').homedir();
     const claudeDir = isGlobal ? path.join(userHome, '.claude') : path.join(targetWorkspaceRoot, '.claude');
     if (!fs.existsSync(claudeDir)) {
@@ -124,7 +124,7 @@ module.exports = {
       }
     }
 
-    const sourceHooksFile = path.join(harnessSourceDir, 'hooks', 'hooks.json');
+    const sourceHooksFile = path.join(harnessRuntimeRoot, 'hooks', 'hooks.json');
     if (fs.existsSync(sourceHooksFile)) {
       const sourceHooksObj = JSON.parse(fs.readFileSync(sourceHooksFile, 'utf8'));
       const resolvedHooks = {};
@@ -134,7 +134,7 @@ module.exports = {
           if (cloned.hooks) {
             cloned.hooks = cloned.hooks.map(h => {
               if (h.type === 'command' && h.command) {
-                h.command = resolveClaudeHookCommand(h.command, harnessSourceDir);
+                h.command = resolveClaudeHookCommand(h.command, harnessRuntimeRoot);
               }
               return h;
             });

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.16.4",
+  "version": "0.16.6",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",