harness-everything 0.18.1 → 0.19.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.18.1",
+      "version": "0.19.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.19.0](https://github.com/dyphn1/Harness-everything/compare/v0.18.1...v0.19.0) (2026-09-21)
+
+### Features
+
+* **distribution:** add cross-platform plugin install/update command ([0566bf3](https://github.com/dyphn1/Harness-everything/commit/0566bf347feab785af829e0f257fa22899f5c259))
+
 ## [0.18.1](https://github.com/dyphn1/Harness-everything/compare/v0.18.0...v0.18.1) (2026-09-21)
 
 ### Bug Fixes

package/README.md

@@ -58,6 +58,11 @@ Harness integrates directly into your workspace. There is no heavy daemon, no pa
 # Option B: install Harness hooks/skills/advisory integrations into your workspace
 npx github:dyphn1/Harness-everything install
 
+# Option C: install or update the native Claude Code/Codex plugin
+#   npx github:dyphn1/Harness-everything plugin-sync
+#   ./scripts/plugin-sync.sh              # POSIX shells / Git Bash
+#   powershell -File scripts/plugin-sync.ps1  # Windows PowerShell
+
 # OpenAI/Codex local plugin packaging is repository-owned under:
 #   .agents/plugins/marketplace.json
 #   plugins/harness-everything/.codex-plugin/plugin.json
@@ -90,6 +95,8 @@ For `--global`, the installer uses each host's supported user-level skill locati
 
 The repository also ships a separate local OpenAI/Codex plugin package under `plugins/harness-everything/` with marketplace metadata in `.agents/plugins/marketplace.json`. That package is not the same thing as the `--codex` advisory installer path. The public OpenAI Skills-only upload is narrower again; see [docs/openai-plugin.md](docs/openai-plugin.md).
 
+The native `plugin-sync` command detects the installed host CLIs and applies the state-specific operation: an absent plugin is installed, while an already-installed plugin is explicitly updated (Claude Code) or its configured marketplace is upgraded (Codex). If a host cannot report plugin state, the command fails closed without installing or updating blindly.
+
 The installer records its state directories in `.git/info/exclude` — a local-only git ignore file — so Harness state never lands in a commit and your working tree (including `.gitignore`) is never modified. Everything owned by the general installer is removed with the built-in uninstaller:
 
 ```bash

package/bin/cli.js

@@ -40,6 +40,9 @@ switch (command) {
   case 'codex-hooks':
     runCodexHooksCompat(args.slice(1));
     break;
+  case 'plugin-sync':
+    runPluginSync(args.slice(1));
+    break;
   default:
     console.error(`[Error] Unknown command: "${command}"`);
     showHelp();
@@ -104,6 +107,9 @@ Commands:
                      that fail to mount enabled plugin-bundled hooks.
                      Usage: harness codex-hooks <install|status|uninstall>
                      Does not trust hooks or modify Codex config.toml.
+  plugin-sync        Install or update the native Harness plugin on Claude Code
+                     and Codex. Existing installations always take the update
+                     path. Supports --host, --dry-run, and --json.
   verify             Run the pre-delivery verification gate (lint/test from the
                      nearest package.json). Exits non-zero if checks fail. This is
                      the explicit stand-in for a hard stop gate on platforms where
@@ -179,3 +185,13 @@ function runCodexHooksCompat(compatArgs) {
   const result = spawnSync('node', [script, ...compatArgs], { stdio: 'inherit' });
   process.exit(result.status === null ? 1 : result.status);
 }
+
+function runPluginSync(pluginArgs) {
+  const script = path.resolve(__dirname, '..', 'scripts', 'plugin-sync.js');
+  if (!fs.existsSync(script)) {
+    console.error('[Error] Native plugin synchronization script not found.');
+    process.exit(1);
+  }
+  const result = spawnSync('node', [script, ...pluginArgs], { stdio: 'inherit' });
+  process.exit(result.status === null ? 1 : result.status);
+}

package/ci/mechanism-2ao-plugin-sync.test.js

@@ -0,0 +1,163 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const {
+  findMarketplace,
+  findPlugin,
+  parseJsonOutput,
+  sync
+} = require('../scripts/plugin-sync');
+
+const ROOT = path.resolve(__dirname, '..');
+
+function fakeHost({ claudeInstalled = false, codexInstalled = false, claudeMarketplace = true, codexMarketplace = true, unknownClaudePluginState = false } = {}) {
+  const calls = [];
+  const state = {
+    claudeInstalled,
+    codexInstalled,
+    claudeMarketplace,
+    codexMarketplace
+  };
+  const runner = (command, args) => {
+    calls.push({ command, args: [...args] });
+    const joined = args.join(' ');
+
+    if (command === 'claude') {
+      if (joined.includes('marketplace list --json')) {
+        return { status: 0, stdout: JSON.stringify({ marketplaces: state.claudeMarketplace ? [{ name: 'harness-everything' }] : [] }), stderr: '' };
+      }
+      if (joined === 'plugin marketplace list') {
+        return { status: 0, stdout: state.claudeMarketplace ? 'harness-everything\n' : '', stderr: '' };
+      }
+      if (joined.startsWith('plugin marketplace add')) {
+        state.claudeMarketplace = true;
+        return { status: 0, stdout: '', stderr: '' };
+      }
+      if (joined.startsWith('plugin marketplace update')) return { status: 0, stdout: '', stderr: '' };
+      if (joined.includes('plugin list --json')) {
+        if (unknownClaudePluginState) return { status: 1, stdout: '', stderr: 'unsupported --json' };
+        return { status: 0, stdout: JSON.stringify({ plugins: state.claudeInstalled ? [{ id: 'harness-everything@harness-everything' }] : [] }), stderr: '' };
+      }
+      if (joined === 'plugin list') {
+        if (unknownClaudePluginState) return { status: 1, stdout: '', stderr: 'unsupported list' };
+        return { status: 0, stdout: state.claudeInstalled ? 'harness-everything@harness-everything\n' : '', stderr: '' };
+      }
+      if (joined.startsWith('plugin install') || joined.startsWith('plugin update')) {
+        state.claudeInstalled = true;
+        return { status: 0, stdout: '{}', stderr: '' };
+      }
+    }
+
+    if (command === 'codex') {
+      if (joined.includes('marketplace list --json')) {
+        return { status: 0, stdout: JSON.stringify({ marketplaces: state.codexMarketplace ? [{ name: 'harness-everything' }] : [] }), stderr: '' };
+      }
+      if (joined === 'plugin marketplace list') {
+        return { status: 0, stdout: state.codexMarketplace ? 'harness-everything\n' : '', stderr: '' };
+      }
+      if (joined.startsWith('plugin marketplace add')) {
+        state.codexMarketplace = true;
+        return { status: 0, stdout: '{}', stderr: '' };
+      }
+      if (joined.startsWith('plugin marketplace upgrade')) return { status: 0, stdout: '{}', stderr: '' };
+      if (joined.includes('plugin list --marketplace harness-everything --json') || joined === 'plugin list --json') {
+        return { status: 0, stdout: JSON.stringify({ plugins: state.codexInstalled ? [{ name: 'harness-everything', marketplace: 'harness-everything' }] : [] }), stderr: '' };
+      }
+      if (joined === 'plugin list --marketplace harness-everything' || joined === 'plugin list') {
+        return { status: 0, stdout: state.codexInstalled ? 'harness-everything@harness-everything\n' : '', stderr: '' };
+      }
+      if (joined.startsWith('plugin add')) {
+        state.codexInstalled = true;
+        return { status: 0, stdout: '{}', stderr: '' };
+      }
+    }
+
+    return { status: 0, stdout: '', stderr: '' };
+  };
+
+  return {
+    calls,
+    runner,
+    commandAvailable: () => true
+  };
+}
+
+function callsFor(calls, command, prefix) {
+  return calls.filter(call => call.command === command && call.args.join(' ').startsWith(prefix));
+}
+
+function runHost(host, fake) {
+  return sync({ host, repository: 'dyphn1/Harness-everything', ref: 'main' }, {
+    ...fake,
+    log: () => {},
+    warn: () => {}
+  });
+}
+
+assert.strictEqual(parseJsonOutput('status\n{"ok":true}\n').ok, true);
+assert.strictEqual(findMarketplace({ marketplaces: [{ name: 'harness-everything' }] }, 'harness-everything'), true);
+assert.strictEqual(findPlugin({ plugins: [{ id: 'harness-everything@harness-everything' }] }, 'harness-everything', 'harness-everything'), true);
+
+{
+  const fake = fakeHost({ claudeInstalled: false });
+  const result = runHost('claude', fake);
+  assert.strictEqual(result.failed, 0);
+  assert.strictEqual(result.results[0].action, 'install');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin install').length, 1, 'absent Claude plugin must install');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin update').length, 0, 'absent Claude plugin must not update');
+}
+
+{
+  const fake = fakeHost({ claudeInstalled: true });
+  const result = runHost('claude', fake);
+  assert.strictEqual(result.failed, 0);
+  assert.strictEqual(result.results[0].action, 'update');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin update').length, 1, 'installed Claude plugin must update');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin install').length, 0, 'installed Claude plugin must not reinstall');
+}
+
+{
+  const fake = fakeHost({ codexInstalled: false });
+  const result = runHost('codex', fake);
+  assert.strictEqual(result.failed, 0);
+  assert.strictEqual(result.results[0].action, 'install');
+  assert.strictEqual(callsFor(fake.calls, 'codex', 'plugin add').length, 1, 'absent Codex plugin must install');
+}
+
+{
+  const fake = fakeHost({ codexInstalled: true });
+  const result = runHost('codex', fake);
+  assert.strictEqual(result.failed, 0);
+  assert.strictEqual(result.results[0].action, 'update');
+  assert.strictEqual(callsFor(fake.calls, 'codex', 'plugin marketplace upgrade').length, 1, 'installed Codex plugin must upgrade its marketplace');
+  assert.strictEqual(callsFor(fake.calls, 'codex', 'plugin add').length, 0, 'installed Codex plugin must not be re-added');
+}
+
+{
+  const fake = fakeHost({ unknownClaudePluginState: true });
+  const result = runHost('claude', fake);
+  assert.strictEqual(result.failed, 1, 'unknown installed state must fail closed');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin install').length, 0, 'unknown state must not install');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin update').length, 0, 'unknown state must not update blindly');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin marketplace update').length, 0, 'unknown state must not refresh the marketplace blindly');
+}
+
+{
+  const result = sync({ host: 'all' }, { commandAvailable: () => false, log: () => {}, warn: () => {} });
+  assert.strictEqual(result.skipped, 2);
+  assert.strictEqual(result.failed, 0);
+}
+
+for (const wrapper of ['scripts/plugin-sync.sh', 'scripts/plugin-sync.ps1']) {
+  const text = fs.readFileSync(path.join(ROOT, wrapper), 'utf8');
+  assert.match(text, /plugin-sync\.js/);
+  assert.doesNotMatch(text, /\.codex\/plugins\/cache|config\.toml/);
+}
+
+const cli = fs.readFileSync(path.join(ROOT, 'bin', 'cli.js'), 'utf8');
+assert.match(cli, /case 'plugin-sync'/);
+assert.match(cli, /Existing installations always take the update/);
+
+console.log('Native plugin sync verified: absent plugins install, installed plugins update, and unknown state fails closed.');

package/docs/platform-capabilities.md

@@ -27,9 +27,9 @@ This is a **repository/agent contract**, not an automatic upgrade to any platfor
 
 | Platform surface | Standalone skills | Plugin support | Hooks/lifecycle | Project scope | Global scope | Current evidence boundary |
 | --- | --- | --- | --- | --- | --- | --- |
-| Codex | `Supported` | `Mechanism verified` | `Mechanism verified` for the local OpenAI package, including session, prompt, supported-tool, subagent, and stop hooks | `.agents/skills/`, `AGENTS.md` | `~/.agents/skills/` | Local package hooks are mechanically checked; live loading and marketplace refresh remain `Unknown`. |
+| Codex | `Supported` | `Mechanism verified` | `Mechanism verified` for the local OpenAI package, including session, prompt, supported-tool, subagent, and stop hooks | `.agents/skills/`, `AGENTS.md` | `~/.agents/skills/` | Local package hooks and the state-specific marketplace sync command are mechanically checked; live loading and marketplace refresh remain unverified. |
 | ChatGPT / OpenAI Plugin | `Unknown` for a repository-local standalone path | `Mechanism verified` | `Partial`: local Work/Codex hooks are separate from ordinary Chat | Managed workspace marketplace | Not established | The public Skills-only bundle is mechanically reproducible; import, approval, and live behavior remain `Unknown`. |
-| Claude Code | `Supported` | `Supported` | `Mechanism verified` for Harness configuration | `.claude/skills/` | `~/.claude/skills/` | Native Claude surfaces are documented and package/installer checks pass; fresh-host execution is not preserved here. |
+| Claude Code | `Supported` | `Supported` | `Mechanism verified` for Harness configuration | `.claude/skills/` | `~/.claude/skills/` | Native Claude surfaces and the state-specific plugin sync command are mechanically checked; fresh-host execution is not preserved here. |
 | OpenCode | `Supported` | `Partial` live-host loading for the project-scope, `.js`-filename install path on OpenCode 1.18.31 (macOS); other install paths remain `Mechanism verified` | `Partial` live-host evidence for project-scope `.js` loading and edit/verification state; hard lock reported only, with no retained blocked-tool trace and a post-reset final snapshot | `.opencode/skills/`, `.agents/skills/`, `.opencode/plugins/` | `~/.config/opencode/skills/`, `~/.agents/skills/`, `~/.config/opencode/plugins/` | [Retained evidence](../benchmarks/results/live-host/opencode-2026-09-16/README.md): loading and state effects verified in one host session; final snapshot post-reset; hard lock only an interactive observation; reflection operator-seeded, then agent-rewritten; no raw transcript or behavioral-effectiveness claim. `.mjs` auto-discovery broken (issue #127); global scope, npm-package installation, and other host versions remain unverified. |
 | GitHub Copilot agent surfaces | `Supported` | `Unknown` for a Harness-specific plugin install | `Unknown` | `.github/skills/`, `.agents/skills/`, repository instructions | `~/.copilot/skills/`, `~/.agents/skills/` | GitHub Agent Skills paths and installer behavior are checked; no live Copilot session or plugin install is preserved. |
 | Cursor | `Supported` | `Mechanism verified` for the portable package shape | `Unknown` for Harness | `.cursor/skills/`, `.agents/skills/` | `~/.cursor/skills/`, `~/.agents/skills/` | Official paths and package shape are checked; Cursor plugin loading and hooks remain unverified. |
@@ -64,6 +64,26 @@ Codex has two paths that must not be collapsed:
 
 The package is tested at the mechanism layer and remains subject to the host’s hook review/trust flow. A fresh host session is still required before claiming that a particular ChatGPT/Codex installation loaded and fired the hooks or that the model followed read-before-skip.
 
+### Native plugin install/update synchronization
+
+The repository also ships a host-facing synchronization command for the native marketplace/plugin surfaces:
+
+```bash
+npx github:dyphn1/Harness-everything plugin-sync
+# or, from a checkout:
+./scripts/plugin-sync.sh
+powershell -File scripts/plugin-sync.ps1
+```
+
+The command detects Claude Code and Codex independently, ensures the Harness marketplace is configured, reads the installed-plugin state, then refreshes that marketplace before choosing the operation:
+
+- absent plugin → install;
+- existing Claude Code plugin → `claude plugin update harness-everything@harness-everything`;
+- existing Codex plugin → `codex plugin marketplace upgrade harness-everything`;
+- unknown plugin state → fail closed, with no blind install/re-add.
+
+The installed branch is intentionally an update branch even when the current release is already the newest version; the host command may report “already latest.” Codex marketplace upgrade is the current native refresh operation; the command does not edit private cache paths or `config.toml`. These are deterministic command/state tests, not live-host evidence, so `liveHostVerification` remains `Unknown` in the matrix.
+
 ### Explicit Codex user-hook compatibility fallback
 
 Current Codex documentation supports plugin-bundled hooks, so native plugin mounting remains the preferred path. Some host/source combinations have nevertheless failed to expose enabled plugin hooks for review/entry attribution (#122 and upstream Codex reports). Harness therefore provides an **explicit compatibility fallback**, not an automatic replacement for native plugin hooks:

package/docs/platform-compatibility.json

@@ -1,6 +1,6 @@
 {
   "format": "harness-platform-compatibility-v1",
-  "last_reviewed": "2026-09-19",
+  "last_reviewed": "2026-09-21",
   "status_vocabulary": {
     "Supported": "An official or native mechanism exists and the Harness behavior is verified.",
     "Mechanism verified": "Harness package, adapter, or installer checks pass, but a real host run is not confirmed.",
@@ -114,7 +114,7 @@
         "globalScope": {"status": "Mechanism verified", "paths": {"skills": ["~/.agents/skills"]}},
         "installUninstallSymmetry": {"status": "Mechanism verified", "notes": "General Harness installer ownership is mechanism-tested. The optional codex-hooks compatibility fallback separately has exact-entry update/uninstall ownership tests and preserves unrelated user hooks; live Codex trust/dispatch still requires host evidence."},
         "assetsReferences": {"status": "Mechanism verified", "notes": "Packaged skill references are checked and remain inside the package."},
-        "updateSync": {"status": "Unknown", "notes": "A real marketplace refresh has not been run in a Codex host."},
+        "updateSync": {"status": "Mechanism verified", "notes": "scripts/plugin-sync.js detects installed state and uses marketplace upgrade for an installed Codex plugin; no live Codex host refresh is preserved."},
         "liveHostVerification": {"status": "Unknown", "notes": "No preserved Codex plugin/session artifact proves current bundled-hook entry. Native plugin mounting is preferred; the explicit user-hook fallback is mechanism-verified only and does not solve host carriers that bypass hook dispatch."}
       }
     },
@@ -159,7 +159,7 @@
         "globalScope": {"status": "Mechanism verified", "paths": {"skills": ["~/.claude/skills"], "hooks": ["~/.claude/settings.json"]}},
         "installUninstallSymmetry": {"status": "Mechanism verified", "notes": "Owned settings, skills, agents, and user files are covered by round-trip tests."},
         "assetsReferences": {"status": "Mechanism verified", "notes": "Skill-local references, scripts, and templates are checked."},
-        "updateSync": {"status": "Unknown", "notes": "A live marketplace update has not been run in Claude Code."},
+        "updateSync": {"status": "Mechanism verified", "notes": "scripts/plugin-sync.js detects installed state and uses the explicit Claude plugin update command for an installed plugin; no live Claude host refresh is preserved."},
         "liveHostVerification": {"status": "Unknown", "notes": "No fresh Claude Code plugin session artifact is committed for this revision."}
       }
     },
@@ -267,4 +267,4 @@
       }
     }
   ]
-}
+}

package/docs/troubleshooting.md

@@ -189,6 +189,14 @@ If those checks pass but the host still shows an older copy:
 
 The local plugin mechanically injects the session policy and invariant-first routing contract, and its package includes mechanism-tested supported-tool, subagent, and stop adapters. If those events do not appear in a live session, verify the host loaded the current package and that changed command hooks were reviewed/trusted; package tests alone cannot prove host loading.
 
+For the native host install/update path, run:
+
+```bash
+npx github:dyphn1/Harness-everything plugin-sync --json
+```
+
+The command installs only when the plugin is absent. An installed Claude plugin uses the explicit Claude update command; an installed Codex plugin uses marketplace upgrade. If plugin state cannot be read, synchronization stops without re-adding or overwriting the plugin.
+
 See [openai-plugin.md](openai-plugin.md) for installation and validation details.
 
 ### Public OpenAI Skills-only plugin behaves differently from local Codex plugin

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {
@@ -17,7 +17,7 @@
     "repo:contract": "node scripts/repository-contract.js",
     "docs:sync": "node scripts/sync-current-docs.js",
     "test:repo-contract": "node ci/repository-contract.test.js",
-    "test:consistency": "node ci/consistency-check.js && node ci/doc-capability-consistency.test.js && node ci/repository-contract.test.js",
+    "test:consistency": "node ci/consistency-check.js && node ci/doc-capability-consistency.test.js && node ci/repository-contract.test.js && node ci/mechanism-2ao-plugin-sync.test.js",
     "test:docs:capabilities": "node ci/doc-capability-consistency.test.js",
     "test:references": "node ci/reference-check.js",
     "test:release": "node ci/release-consistency-check.js && node ci/mechanism-2x-release-automation.test.js && node ci/mechanism-2x-release-commit-message.test.js",
@@ -28,10 +28,12 @@
     "test:routing": "node ci/routing-check.js",
     "test:routing:invariants": "node ci/invariant-routing.test.js && node ci/router-workflow-plan.test.js && node ci/workflow-execution-contract.test.js",
     "plugin:sync": "node scripts/sync-openai-plugin.js",
+    "plugin:hosts": "node scripts/plugin-sync.js",
     "test:plugin:claude": "node ci/mechanism-2z-claude-plugin-manifest.test.js",
     "plugin:claude:stage": "node scripts/stage-claude-plugin.js",
     "plugin:claude:validate": "node scripts/validate-claude-plugin.js",
     "test:plugin:openai": "node ci/openai-plugin-package.test.js && node ci/openai-plugin-runtime.test.js",
+    "test:plugin:hosts": "node ci/mechanism-2ao-plugin-sync.test.js",
     "plugin:submission:build": "node scripts/build-openai-submission.js",
     "test:plugin:submission": "node ci/openai-plugin-submission.test.js",
     "test:platform:compatibility": "node ci/mechanism-2w-platform-compatibility.test.js",

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/scripts/plugin-sync.js

@@ -0,0 +1,465 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Synchronize the native Harness Everything plugin on Claude Code and Codex.
+ *
+ * This is deliberately separate from installer.js: installer.js manages the
+ * portable skills layout, while this command talks to each host's native
+ * marketplace/plugin CLI. The installed-state branch is intentionally
+ * explicit: an existing plugin is updated, never silently re-added.
+ */
+
+const { spawnSync } = require('child_process');
+
+const DEFAULTS = Object.freeze({
+  marketplace: 'harness-everything',
+  plugin: 'harness-everything',
+  repository: process.env.HARNESS_PLUGIN_REPOSITORY || 'dyphn1/Harness-everything',
+  ref: process.env.HARNESS_PLUGIN_REF || 'main'
+});
+
+function defaultRunner(command, args) {
+  const result = spawnSync(command, args, {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    windowsHide: true
+  });
+  return {
+    status: result.status === null ? 1 : result.status,
+    stdout: result.stdout || '',
+    stderr: result.stderr || '',
+    error: result.error || null
+  };
+}
+
+function shellQuote(value) {
+  const text = String(value);
+  return /^[A-Za-z0-9_./:@%+=,-]+$/.test(text) ? text : JSON.stringify(text);
+}
+
+function commandLine(command, args) {
+  return [command, ...args].map(shellQuote).join(' ');
+}
+
+function parseJsonOutput(output) {
+  const text = String(output || '').trim();
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch (_) {
+    // Some host versions print a short status line before one-line JSON.
+    const lines = text.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+    for (let index = lines.length - 1; index >= 0; index--) {
+      try {
+        return JSON.parse(lines[index]);
+      } catch (__) {
+        // Keep looking for the machine-readable line.
+      }
+    }
+  }
+  return null;
+}
+
+function collectObjects(value, out = [], keyHint = '') {
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) => collectObjects(entry, out, String(index)));
+  } else if (value && typeof value === 'object') {
+    out.push({ value, keyHint });
+    for (const [key, child] of Object.entries(value)) collectObjects(child, out, key);
+  }
+  return out;
+}
+
+function collectStrings(value, out = []) {
+  if (typeof value === 'string') out.push(value);
+  else if (Array.isArray(value)) value.forEach(entry => collectStrings(entry, out));
+  else if (value && typeof value === 'object') Object.values(value).forEach(entry => collectStrings(entry, out));
+  return out;
+}
+
+function exactString(value, expected) {
+  return typeof value === 'string' && value.trim() === expected;
+}
+
+function findMarketplace(payload, marketplace) {
+  if (collectStrings(payload).some(value => exactString(value, marketplace))) return true;
+  return collectObjects(payload).some(({ value }) => {
+    const candidates = [
+      value.name,
+      value.marketplace,
+      value.marketplaceName,
+      value.slug,
+      value.id,
+      value.source && value.source.name,
+      value.source && value.source.id
+    ];
+    return candidates.some(candidate => exactString(candidate, marketplace));
+  });
+}
+
+function findPlugin(payload, plugin, marketplace) {
+  const pluginId = `${plugin}@${marketplace}`;
+  return collectStrings(payload).some(value => value.trim() === pluginId) || collectObjects(payload).some(({ value, keyHint }) => {
+    const identifiers = [value.id, value.pluginId, value.identifier, keyHint];
+    if (identifiers.some(candidate => exactString(candidate, pluginId))) return true;
+    const names = [value.name, value.plugin, value.pluginName];
+    if (!names.some(candidate => exactString(candidate, plugin))) return false;
+    const sources = [
+      value.marketplace,
+      value.marketplaceName,
+      value.source && value.source.name,
+      value.source && value.source.id
+    ].filter(Boolean);
+    return sources.length === 0 || sources.some(source => exactString(source, marketplace));
+  });
+}
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function textHasMarketplace(output, marketplace) {
+  const expression = new RegExp(`(^|[\\s"'])${escapeRegExp(marketplace)}($|[\\s"'@])`, 'm');
+  return expression.test(String(output || ''));
+}
+
+function textHasPlugin(output, plugin, marketplace) {
+  const text = String(output || '');
+  if (text.includes(`${plugin}@${marketplace}`)) return true;
+  const expression = new RegExp(`(^|[\\s"'])${escapeRegExp(plugin)}($|[\\s"'@])`, 'm');
+  return expression.test(text);
+}
+
+function resultError(result) {
+  const detail = [result && result.stderr, result && result.stdout, result && result.error && result.error.message]
+    .map(value => String(value || '').trim())
+    .find(Boolean);
+  return detail || `exit status ${result && result.status !== undefined ? result.status : 'unknown'}`;
+}
+
+function createContext(options = {}) {
+  const runner = options.runner || defaultRunner;
+  const log = options.log || (message => console.log(message));
+  const warn = options.warn || (message => console.warn(message));
+  const context = {
+    ...DEFAULTS,
+    ...options,
+    runner,
+    log,
+    warn,
+    dryRun: Boolean(options.dryRun),
+    commandAvailable: options.commandAvailable || (command => {
+      const result = runner(command, ['--version'], { probe: true });
+      return result && result.status === 0 && !result.error;
+    })
+  };
+  context.repositorySource = options.repositorySource || (
+    /^https?:\/\//.test(context.repository) || /^git@/.test(context.repository)
+      ? context.repository
+      : `https://github.com/${context.repository}.git`
+  );
+  return context;
+}
+
+function invoke(context, command, args, { mutate = false, label = command } = {}) {
+  const rendered = commandLine(command, args);
+  if (mutate && context.dryRun) {
+    context.log(`[dry-run] ${rendered}`);
+    return { status: 0, stdout: '', stderr: '', dryRun: true };
+  }
+  const result = context.runner(command, args, { label });
+  if (!result || result.status !== 0) {
+    context.warn(`[failed] ${rendered}\n  ${resultError(result)}`);
+  }
+  return result || { status: 1, stdout: '', stderr: 'runner returned no result' };
+}
+
+function query(context, command, args) {
+  return context.runner(command, args, { query: true }) || { status: 1, stdout: '', stderr: 'runner returned no result' };
+}
+
+function listState(context, { command, jsonArgs, plainArgs, detectJson, detectText }) {
+  const jsonResult = query(context, command, jsonArgs);
+  if (jsonResult.status === 0) {
+    const payload = parseJsonOutput(jsonResult.stdout);
+    if (payload !== null) return { known: true, value: detectJson(payload), result: jsonResult };
+  }
+
+  const plainResult = query(context, command, plainArgs);
+  if (plainResult.status === 0 && String(plainResult.stdout || '').trim()) {
+    return { known: true, value: detectText(plainResult.stdout), result: plainResult };
+  }
+
+  return {
+    known: false,
+    value: false,
+    error: `${resultError(jsonResult)}; fallback: ${resultError(plainResult)}`
+  };
+}
+
+function queryClaudeMarketplace(context) {
+  return listState(context, {
+    command: 'claude',
+    jsonArgs: ['plugin', 'marketplace', 'list', '--json'],
+    plainArgs: ['plugin', 'marketplace', 'list'],
+    detectJson: payload => findMarketplace(payload, context.marketplace),
+    detectText: output => textHasMarketplace(output, context.marketplace)
+  });
+}
+
+function queryClaudePlugin(context) {
+  return listState(context, {
+    command: 'claude',
+    jsonArgs: ['plugin', 'list', '--json'],
+    plainArgs: ['plugin', 'list'],
+    detectJson: payload => findPlugin(payload, context.plugin, context.marketplace),
+    detectText: output => textHasPlugin(output, context.plugin, context.marketplace)
+  });
+}
+
+function queryCodexMarketplace(context) {
+  return listState(context, {
+    command: 'codex',
+    jsonArgs: ['plugin', 'marketplace', 'list', '--json'],
+    plainArgs: ['plugin', 'marketplace', 'list'],
+    detectJson: payload => findMarketplace(payload, context.marketplace),
+    detectText: output => textHasMarketplace(output, context.marketplace)
+  });
+}
+
+function queryCodexPlugin(context) {
+  const state = listState(context, {
+    command: 'codex',
+    jsonArgs: ['plugin', 'list', '--marketplace', context.marketplace, '--json'],
+    plainArgs: ['plugin', 'list', '--marketplace', context.marketplace],
+    detectJson: payload => findPlugin(payload, context.plugin, context.marketplace),
+    detectText: output => textHasPlugin(output, context.plugin, context.marketplace)
+  });
+  if (state.known) return state;
+
+  // Older Codex builds may not accept --marketplace on plugin list. A full
+  // list still lets us fail closed while supporting those builds when JSON is
+  // available.
+  return listState(context, {
+    command: 'codex',
+    jsonArgs: ['plugin', 'list', '--json'],
+    plainArgs: ['plugin', 'list'],
+    detectJson: payload => findPlugin(payload, context.plugin, context.marketplace),
+    detectText: output => textHasPlugin(output, context.plugin, context.marketplace)
+  });
+}
+
+function ensureClaudeMarketplace(context) {
+  const state = queryClaudeMarketplace(context);
+  if (!state.known) context.warn(`[notice] Claude marketplace state is unavailable; ensuring ${context.marketplace} is configured.`);
+  if (!state.known || !state.value) {
+    const added = invoke(context, 'claude', [
+      'plugin', 'marketplace', 'add', context.repository,
+      '--scope', 'user'
+    ], { mutate: true, label: 'claude marketplace add' });
+    if (added.status !== 0) return { ok: false, error: resultError(added) };
+  }
+  return { ok: true };
+}
+
+function ensureCodexMarketplace(context) {
+  const state = queryCodexMarketplace(context);
+  if (!state.known) context.warn(`[notice] Codex marketplace state is unavailable; ensuring ${context.marketplace} is configured.`);
+  if (!state.known || !state.value) {
+    const added = invoke(context, 'codex', [
+      'plugin', 'marketplace', 'add', context.repositorySource,
+      '--ref', context.ref,
+      '--json'
+    ], { mutate: true, label: 'codex marketplace add' });
+    if (added.status !== 0) return { ok: false, error: resultError(added) };
+  }
+  return { ok: true };
+}
+
+function refreshClaudeMarketplace(context) {
+  const updated = invoke(context, 'claude', [
+    'plugin', 'marketplace', 'update', context.marketplace
+  ], { mutate: true, label: 'claude marketplace update' });
+  return updated.status === 0
+    ? { ok: true }
+    : { ok: false, error: resultError(updated) };
+}
+
+function refreshCodexMarketplace(context) {
+  const upgraded = invoke(context, 'codex', [
+    'plugin', 'marketplace', 'upgrade', context.marketplace,
+    '--json'
+  ], { mutate: true, label: 'codex marketplace upgrade' });
+  return upgraded.status === 0
+    ? { ok: true }
+    : { ok: false, error: resultError(upgraded) };
+}
+
+function verifyPlugin(context, host, queryPlugin) {
+  if (context.dryRun) return { ok: true, skipped: true };
+  const state = queryPlugin(context);
+  if (!state.known) return { ok: false, error: `${host} plugin state could not be verified: ${state.error}` };
+  if (!state.value) return { ok: false, error: `${host} reports ${context.plugin}@${context.marketplace} is not installed after synchronization` };
+  return { ok: true };
+}
+
+function syncClaude(context) {
+  if (!context.commandAvailable('claude')) return { host: 'claude', status: 'skipped', reason: 'claude CLI not found' };
+  const marketplace = ensureClaudeMarketplace(context);
+  if (!marketplace.ok) return { host: 'claude', status: 'failed', error: marketplace.error };
+  const installed = queryClaudePlugin(context);
+  if (!installed.known) return { host: 'claude', status: 'failed', error: `Claude plugin state could not be determined: ${installed.error}` };
+  const refreshed = refreshClaudeMarketplace(context);
+  if (!refreshed.ok) return { host: 'claude', status: 'failed', error: refreshed.error };
+
+  const action = installed.value ? 'update' : 'install';
+  const result = invoke(context, 'claude', [
+    'plugin', action, `${context.plugin}@${context.marketplace}`,
+    '--scope', 'user', '--yes', '--json'
+  ], { mutate: true, label: `claude plugin ${action}` });
+  if (result.status !== 0) return { host: 'claude', status: 'failed', error: resultError(result) };
+
+  const verification = verifyPlugin(context, 'Claude', queryClaudePlugin);
+  if (!verification.ok) return { host: 'claude', status: 'failed', error: verification.error };
+  return { host: 'claude', status: 'synchronized', action };
+}
+
+function syncCodex(context) {
+  if (!context.commandAvailable('codex')) return { host: 'codex', status: 'skipped', reason: 'codex CLI not found' };
+  const marketplace = ensureCodexMarketplace(context);
+  if (!marketplace.ok) return { host: 'codex', status: 'failed', error: marketplace.error };
+  const installed = queryCodexPlugin(context);
+  if (!installed.known) return { host: 'codex', status: 'failed', error: `Codex plugin state could not be determined: ${installed.error}` };
+
+  let action;
+  let result;
+  if (installed.value) {
+    // Codex currently refreshes an installed marketplace plugin through the
+    // marketplace upgrade command. Do not fall back to `plugin add` here:
+    // an installed plugin must take the update path.
+    action = 'update';
+    result = refreshCodexMarketplace(context);
+    if (result.ok) result = { status: 0, stdout: '', stderr: '' };
+    else result = { status: 1, stdout: '', stderr: result.error };
+  } else {
+    action = 'install';
+    result = refreshCodexMarketplace(context);
+    if (result.ok) {
+      result = invoke(context, 'codex', [
+        'plugin', 'add', `${context.plugin}@${context.marketplace}`, '--json'
+      ], { mutate: true, label: 'codex plugin install' });
+    } else {
+      result = { status: 1, stdout: '', stderr: result.error };
+    }
+  }
+  if (result.status !== 0) return { host: 'codex', status: 'failed', error: resultError(result) };
+
+  const verification = verifyPlugin(context, 'Codex', queryCodexPlugin);
+  if (!verification.ok) return { host: 'codex', status: 'failed', error: verification.error };
+  return { host: 'codex', status: 'synchronized', action };
+}
+
+function parseArgs(argv) {
+  const options = { host: 'all', dryRun: false, json: false };
+  for (let index = 0; index < argv.length; index++) {
+    const arg = argv[index];
+    if (arg === '--help' || arg === '-h') options.help = true;
+    else if (arg === '--dry-run') options.dryRun = true;
+    else if (arg === '--json') options.json = true;
+    else if (arg === '--host') {
+      options.host = argv[++index];
+      if (!options.host) throw new Error('--host requires all, claude, or codex');
+    } else if (arg === '--repository') {
+      options.repository = argv[++index];
+      if (!options.repository) throw new Error('--repository requires a repository or URL');
+    } else if (arg === '--ref') {
+      options.ref = argv[++index];
+      if (!options.ref) throw new Error('--ref requires a git ref');
+    } else {
+      throw new Error(`Unknown option: ${arg}`);
+    }
+  }
+  options.host = String(options.host).toLowerCase();
+  if (!['all', 'claude', 'codex'].includes(options.host)) throw new Error(`Unsupported host: ${options.host}`);
+  return options;
+}
+
+function help() {
+  return `Usage: node scripts/plugin-sync.js [options]
+
+Synchronize the native Harness Everything plugin on installed host CLIs.
+Existing installations take the explicit update/upgrade path; absent
+installations take the install path.
+
+Options:
+  --host <all|claude|codex>  Limit synchronization to one host (default: all)
+  --repository <repo|url>   Marketplace source (default: dyphn1/Harness-everything)
+  --ref <git-ref>           Codex marketplace ref (default: main)
+  --dry-run                 Detect state and print mutating commands
+  --json                    Print a machine-readable summary
+  -h, --help                Show this help
+`;
+}
+
+function sync(options, dependencies = {}) {
+  const context = createContext({ ...options, ...dependencies });
+  const hosts = context.host === 'all' ? ['claude', 'codex'] : [context.host];
+  const results = hosts.map(host => host === 'claude' ? syncClaude(context) : syncCodex(context));
+  const summary = {
+    repository: context.repository,
+    marketplace: context.marketplace,
+    plugin: context.plugin,
+    dryRun: context.dryRun,
+    results,
+    synchronized: results.filter(result => result.status === 'synchronized').length,
+    skipped: results.filter(result => result.status === 'skipped').length,
+    failed: results.filter(result => result.status === 'failed').length
+  };
+  return summary;
+}
+
+function main(argv = process.argv.slice(2)) {
+  let options;
+  try {
+    options = parseArgs(argv);
+  } catch (error) {
+    console.error(`[Error] ${error.message}`);
+    console.error(help());
+    return 2;
+  }
+  if (options.help) {
+    console.log(help());
+    return 0;
+  }
+
+  const summary = sync(options);
+  if (options.json) console.log(JSON.stringify(summary, null, 2));
+  else {
+    for (const result of summary.results) {
+      if (result.status === 'synchronized') console.log(`[ok] ${result.host}: ${result.action}`);
+      else if (result.status === 'skipped') console.log(`[skip] ${result.host}: ${result.reason}`);
+      else console.error(`[fail] ${result.host}: ${result.error}`);
+    }
+    if (summary.synchronized === 0 && summary.failed === 0) {
+      console.error('No supported host CLI was found. Install Claude Code and/or Codex, then retry.');
+    }
+  }
+  return summary.failed > 0 || summary.synchronized === 0 ? 1 : 0;
+}
+
+if (require.main === module) process.exitCode = main();
+
+module.exports = {
+  DEFAULTS,
+  commandLine,
+  createContext,
+  findMarketplace,
+  findPlugin,
+  main,
+  parseArgs,
+  parseJsonOutput,
+  sync,
+  textHasMarketplace,
+  textHasPlugin
+};

package/scripts/plugin-sync.ps1

@@ -0,0 +1,5 @@
+$ErrorActionPreference = 'Stop'
+
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Definition
+& node (Join-Path $scriptDir 'plugin-sync.js') @args
+exit $LASTEXITCODE

package/scripts/plugin-sync.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec node "$SCRIPT_DIR/plugin-sync.js" "$@"