harness-everything 0.2.2 → 0.4.0

package/ci/mechanism-2t-disclosure.test.js

@@ -0,0 +1,90 @@
+const fs = require('fs');
+const path = require('path');
+const helper = require('./test-helper');
+const { checkDisclosure, pointerResolves } = require('./disclosure-check');
+
+console.log('\n[2t] Progressive-disclosure negative controls...');
+
+const root = helper.tempDir('.mechanism-test-disclosure');
+const skill = path.join(root, 'fixture-skill');
+const workflow = path.join(root, 'docs', 'workflows', 'fixture-skill.md');
+const references = path.join(skill, 'references');
+
+function setup() {
+  fs.mkdirSync(references, { recursive: true });
+  fs.mkdirSync(path.dirname(workflow), { recursive: true });
+  fs.writeFileSync(path.join(references, 'guide.md'), '# Guide\n', 'utf8');
+  fs.writeFileSync(path.join(skill, 'SKILL.md'), [
+    '---',
+    'name: fixture-skill',
+    'description: A fixture skill for disclosure checks.',
+    '---',
+    '',
+    '# Fixture',
+    '',
+    '## USE FOR:',
+    '- Testing disclosure.',
+    '',
+    '## DO NOT USE FOR:',
+    '- Production work.',
+    '',
+    'Deep dive: references/guide.md',
+    '',
+  ].join('\n'), 'utf8');
+  fs.writeFileSync(workflow, [
+    '# Workflow: Fixture',
+    '',
+    '```mermaid',
+    'flowchart TD',
+    '  Start([Start]) --> Done([Done])',
+    '```',
+    '',
+  ].join('\n'), 'utf8');
+}
+
+function failures() {
+  return checkDisclosure(root).failures;
+}
+
+setup();
+helper.check('2t. complete disclosure surface passes', failures().length === 0, JSON.stringify(failures()));
+
+fs.rmSync(workflow);
+helper.check('2t. missing workflow pairing fails', failures().some(f => f.check === 'fixture-skill: workflow document'), JSON.stringify(failures()));
+fs.writeFileSync(workflow, '# Workflow: Fixture\n', 'utf8');
+helper.check('2t. missing Mermaid coverage fails', failures().some(f => f.check === 'fixture-skill: Mermaid coverage'), JSON.stringify(failures()));
+fs.writeFileSync(workflow, '```mermaid\nflowchart TD\n```\n', 'utf8');
+helper.check('2t. empty Mermaid transition fails', failures().some(f => f.check === 'fixture-skill: meaningful Mermaid coverage'), JSON.stringify(failures()));
+fs.writeFileSync(workflow, '```mermaid\nflowchart TD\n  Start([Start]) --> Done([Done])\n```\n', 'utf8');
+
+// Regression: dashes inside a node label are not a transition.
+fs.writeFileSync(workflow, '```mermaid\nflowchart TD\n  Start[Start --- End]\n```\n', 'utf8');
+helper.check('2t. dashes inside a node label do not fake a transition', failures().some(f => f.check === 'fixture-skill: meaningful Mermaid coverage'), JSON.stringify(failures()));
+fs.writeFileSync(workflow, '```mermaid\nflowchart TD\n  Start([Start]) --> Done([Done])\n```\n', 'utf8');
+
+// Regression: a wildcard pointer must match a file, not merely a non-empty
+// directory, and a traversal must not escape the checked-out package.
+fs.rmSync(path.join(skill, 'references', 'guide.md'));
+fs.writeFileSync(path.join(skill, 'references', 'guide.txt'), '# Guide\n', 'utf8');
+helper.check('2t. wildcard Deep dive requires a matching file', !pointerResolves(root, 'fixture-skill', 'references/*.md', ['fixture-skill']), 'references/*.md unexpectedly resolved');
+fs.writeFileSync(path.join(skill, 'references', 'guide.md'), '# Guide\n', 'utf8');
+helper.check('2t. wildcard Deep dive resolves a matching file', pointerResolves(root, 'fixture-skill', 'references/*.md', ['fixture-skill']), 'references/*.md did not resolve');
+const outside = path.resolve(root, '..', 'outside-deep-dive-regression.md');
+fs.writeFileSync(outside, '# Outside\n', 'utf8');
+helper.check('2t. Deep dive traversal stays inside the package', !pointerResolves(root, 'fixture-skill', '../../outside-deep-dive-regression.md', ['fixture-skill']), 'outside traversal resolved');
+fs.rmSync(outside, { force: true });
+
+fs.rmSync(path.join(skill, 'references', 'guide.md'));
+helper.check('2t. dangling Deep dive pointer fails', failures().some(f => f.check === 'fixture-skill: Deep dive pointer resolves'), JSON.stringify(failures()));
+fs.writeFileSync(path.join(skill, 'references', 'guide.md'), '# Guide\n', 'utf8');
+fs.appendFileSync(path.join(skill, 'SKILL.md'), '\n```mermaid\nflowchart TD\n  A --> B\n```\n', 'utf8');
+helper.check('2t. Mermaid inside SKILL.md fails', failures().some(f => f.check === 'fixture-skill: no Mermaid in SKILL.md'), JSON.stringify(failures()));
+
+fs.rmSync(references, { recursive: true, force: true });
+helper.check('2t. missing references directory fails', failures().some(f => f.check === 'fixture-skill: references directory'), JSON.stringify(failures()));
+fs.mkdirSync(references, { recursive: true });
+fs.writeFileSync(path.join(references, 'guide.md'), '# Guide\n', 'utf8');
+fs.writeFileSync(path.join(root, 'docs', 'workflows', 'orphan.md'), '# Workflow: Orphan\n```mermaid\nflowchart TD\n  A --> B\n```\n', 'utf8');
+helper.check('2t. orphan workflow document fails', failures().some(f => f.check === 'orphan: workflow pairing'), JSON.stringify(failures()));
+
+helper.finish();

package/ci/mechanism-2t-evidence-triage.test.js

@@ -0,0 +1,200 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const {
+  archiveResult,
+  sha256,
+  triage,
+} = require('../behavioral-evals/evidence-tool');
+const {
+  grade,
+  parseSimpleYaml,
+} = require('../behavioral-evals/run');
+const {
+  validateCase,
+} = require('../behavioral-evals/case-validator');
+
+function write(filePath, content) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content, 'utf8');
+}
+
+function git(cwd, args) {
+  return execFileSync('git', args, { cwd, stdio: 'ignore' });
+}
+
+function makeGitWorkspace(greeting) {
+  const workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'evidence-triage-shell-'));
+  write(path.join(workspace, 'package.json'), '{"name":"evidence-triage-shell"}\n');
+  write(path.join(workspace, 'src', 'greet.js'), `module.exports = name => '${greeting}, ' + name + '!';\n`);
+  write(path.join(workspace, 'src', 'format.js'), 'module.exports = value => value;\n');
+  write(path.join(workspace, 'README.md'), '# evidence triage\n');
+  git(workspace, ['init', '-q']);
+  git(workspace, ['config', 'user.email', 'evidence-triage@example.test']);
+  git(workspace, ['config', 'user.name', 'Evidence triage test']);
+  git(workspace, ['add', '.']);
+  git(workspace, ['commit', '-qm', 'fixture']);
+  return workspace;
+}
+
+function runChecks() {
+  const failures = [];
+  const check = (name, condition, detail = '') => {
+    if (!condition) failures.push(`${name}${detail ? `: ${detail}` : ''}`);
+  };
+  const tempPaths = [];
+  const remove = filePath => {
+    try { fs.rmSync(filePath, { recursive: true, force: true }); } catch { /* best effort */ }
+  };
+
+  try {
+    for (const caseId of ['scope-discipline', 'pressure-scope-bypass']) {
+      const caseData = parseSimpleYaml(fs.readFileSync(path.join(__dirname, '..', 'behavioral-evals', 'cases', `${caseId}.yaml`), 'utf8'));
+      const workspace = makeGitWorkspace('Hello');
+      tempPaths.push(workspace);
+      if (caseId === 'pressure-scope-bypass') write(path.join(workspace, 'src', 'greet.js'), "module.exports = name => 'Hi, ' + name + '!';\n");
+      const transcriptDir = fs.mkdtempSync(path.join(os.tmpdir(), 'evidence-triage-shell-trace-'));
+      tempPaths.push(transcriptDir);
+      const transcript = path.join(transcriptDir, 'empty.jsonl');
+      write(transcript, '');
+      check(`Windows shell executes ${caseId} assertions`, grade(caseData, workspace, transcript).passed);
+    }
+
+    const emptyCommandCase = {
+      id: 'empty-command',
+      prompt: 'run the check',
+      max_turns: 1,
+      fixture: { files: [{ path: 'index.js', content: '' }] },
+      expectations: [{ type: 'command_exit_0', command: '   ' }],
+    };
+    check('empty command_exit_0 is rejected', validateCase(emptyCommandCase).some(error => /non-empty/.test(error)));
+
+    const crlfCase = parseSimpleYaml([
+      'id: crlf-fixture',
+      'prompt: |',
+      '  preserve',
+      '  both lines',
+      'max_turns: 1',
+      'fixture:',
+      '  files:',
+      '    - path: index.js',
+      '      content: ok',
+      'expectations:',
+      '  - type: trace_contains',
+      '    value: ok',
+    ].join('\r\n'));
+    check('CRLF block scalars remain parseable for behavioral cases', crlfCase.prompt === 'preserve\nboth lines', JSON.stringify(crlfCase));
+
+    const transcriptDir = fs.mkdtempSync(path.join(os.tmpdir(), 'evidence-triage-trace-'));
+    tempPaths.push(transcriptDir);
+    const runningTranscript = path.join(transcriptDir, 'running.jsonl');
+    write(runningTranscript, JSON.stringify({
+      type: 'tool_result',
+      part: { type: 'tool', tool: 'Bash', callID: 'running-1', state: { status: 'running', input: { command: 'npm test' } } },
+    }));
+    check('running tool_result does not satisfy tool_completed', !grade({ expectations: [{ type: 'tool_completed', value: { command: 'npm test' } }] }, transcriptDir, runningTranscript).passed);
+
+    const deniedEditTranscript = path.join(transcriptDir, 'denied-edit.jsonl');
+    write(deniedEditTranscript, [
+      { type: 'tool_use', part: { type: 'tool', tool: 'Edit', callID: 'edit-1', state: { status: 'denied', input: { file_path: 'src/index.js' } } } },
+      { type: 'tool_use', part: { type: 'tool', tool: 'Bash', callID: 'test-1', state: { status: 'completed', input: { command: 'npm test' } } } },
+    ].map(event => JSON.stringify(event)).join('\n'));
+    check('after_edit requires an executed edit', !grade({ expectations: [{ type: 'tool_executed', value: { command: 'npm test' }, after_edit: true }] }, transcriptDir, deniedEditTranscript).passed);
+
+    const casePath = path.join(transcriptDir, 'archive-case.yaml');
+    const resultPath = path.join(transcriptDir, 'archive-result.json');
+    const archiveOut = path.join(transcriptDir, 'archive-out');
+    const caseText = 'id: archive-fixture\nprompt: check\nmax_turns: 1\nfixture:\n  files:\n    - path: index.js\n      content: "ok"\nexpectations:\n  - type: trace_contains\n    value: ok   \n';
+    write(casePath, caseText);
+    write(resultPath, JSON.stringify({ id: 'archive-fixture', outcome: 'fail', expectations: [] }));
+    archiveResult(resultPath, archiveOut, casePath);
+    const archivedCasePath = path.join(archiveOut, 'archive-fixture', 'case.yaml');
+    const provenance = JSON.parse(fs.readFileSync(path.join(archiveOut, 'archive-fixture', 'provenance.json'), 'utf8'));
+    check('archive case hash matches archived bytes', provenance.replay_snapshot.case_sha256 === sha256(fs.readFileSync(archivedCasePath)));
+
+    const escapedOut = path.join(transcriptDir, 'escaped-out');
+    write(path.join(transcriptDir, 'crafted-result.json'), JSON.stringify({ id: '../escaped-case', outcome: 'fail' }));
+    check('archive rejects path-traversal result ids', (() => {
+      try {
+        archiveResult(path.join(transcriptDir, 'crafted-result.json'), escapedOut, casePath);
+        return false;
+      } catch {
+        return true;
+      }
+    })());
+
+    const triageOut = path.join(transcriptDir, 'triage-out');
+    const rows = triage(triageOut);
+    const repeated = rows.find(row => row.id === 'pressure-skip-verification');
+    check('triage preserves both repeated historical result files', repeated && repeated.result.result_files && repeated.result.result_files.length === 2);
+    const exactMatch = rows.find(row => row.id === 'baseline-performance');
+    check('triage matches result ids exactly', exactMatch && exactMatch.result.result_files && exactMatch.result.result_files.length === 1 && exactMatch.result.result_files[0].endsWith('2026-08-27-baseline-performance.json'));
+
+    const projectRoot = path.join(__dirname, '..');
+    const historicalBaseRef = process.env.EVIDENCE_BASE_REF || 'origin/main';
+    const currentRunBytes = fs.readFileSync(path.join(projectRoot, 'behavioral-evals', 'run.js'));
+    const historicalRunBytes = execFileSync('git', ['show', `${historicalBaseRef}:behavioral-evals/run.js`], {
+      cwd: projectRoot,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    const expectedCurrentCodeSha = sha256(currentRunBytes);
+    const expectedHistoricalCodeSha = sha256(historicalRunBytes);
+    check('replay code hash matches current run.js bytes', rows.every(row => row.current_code_sha256 === expectedCurrentCodeSha));
+    check('historical code hash matches the configured base ref bytes', rows.every(row => row.historical_code_sha256 === expectedHistoricalCodeSha));
+
+    const abRow = rows.find(row => row.id === 'grill-me-adversarial');
+    const abProvenance = JSON.parse(fs.readFileSync(path.join(triageOut, 'grill-me-adversarial', 'provenance.json'), 'utf8'));
+    check('CI A/B replay uses the CI A/B runner', abRow && abProvenance.replay.command === 'node ci/ab-test-harness.js run --case grill-me-adversarial');
+
+    const invalidBaseOut = path.join(transcriptDir, 'invalid-base-out');
+    let invalidBaseRejected = false;
+    try {
+      execFileSync(process.execPath, [path.join(__dirname, '..', 'behavioral-evals', 'evidence-tool.js'), 'triage', '--out', invalidBaseOut], {
+        cwd: path.join(__dirname, '..'),
+        env: { ...process.env, EVIDENCE_BASE_REF: 'refs/heads/does-not-exist' },
+        stdio: 'ignore'
+      });
+    } catch {
+      invalidBaseRejected = true;
+    }
+    check('triage rejects an unresolvable historical base ref', invalidBaseRejected);
+
+    const archiveOutside = path.join(transcriptDir, 'archive-outside');
+    const archiveLinkOut = path.join(transcriptDir, 'archive-link-out');
+    fs.mkdirSync(archiveOutside, { recursive: true });
+    fs.mkdirSync(archiveLinkOut, { recursive: true });
+    const archiveLink = path.join(archiveLinkOut, 'archive-fixture');
+    fs.symlinkSync(archiveOutside, archiveLink, process.platform === 'win32' ? 'junction' : 'dir');
+    let archiveLinkRejected = false;
+    try {
+      archiveResult(resultPath, archiveLinkOut, casePath);
+    } catch {
+      archiveLinkRejected = true;
+    }
+    check('archive rejects an output junction or symlink escape', archiveLinkRejected && !fs.existsSync(path.join(archiveOutside, 'case.yaml')));
+
+    const falsePositiveTranscript = path.join(transcriptDir, 'false-positive-command.jsonl');
+    write(falsePositiveTranscript, JSON.stringify({
+      type: 'tool_use',
+      part: { type: 'tool', tool: 'Bash', callID: 'coverage', state: { status: 'completed', input: { command: 'npm test --coverage' } } }
+    }));
+    check(
+      'tool evidence does not treat an extended command as the exact command',
+      !grade({ expectations: [{ type: 'tool_completed', value: { command: 'npm test' } }] }, transcriptDir, falsePositiveTranscript).passed
+    );
+  } finally {
+    tempPaths.forEach(remove);
+  }
+  return failures;
+}
+
+const failures = runChecks();
+if (failures.length) {
+  failures.forEach(failure => console.error(`FAIL ${failure}`));
+  process.exit(1);
+}
+console.log('Behavioral evidence-triage regressions passed.');

package/ci/mechanism-2t-issue-20.test.js

@@ -0,0 +1,75 @@
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { parseSimpleYaml } = require('../behavioral-evals/run');
+const helper = require('./test-helper');
+
+console.log('\n[2t] Issue #20 regression coverage...');
+
+function runNode(script, args = [], env = process.env) {
+  return spawnSync(process.execPath, [path.join(helper.root, script), ...args], {
+    cwd: helper.root,
+    encoding: 'utf8',
+    env,
+  });
+}
+
+const yamlFixture = 'prompt: |\n  hello\n  world\nnext: value\n';
+const expected = { prompt: 'hello\nworld', next: 'value' };
+helper.check(
+  '2t. behavioral YAML parsing preserves block scalars under CRLF',
+  JSON.stringify(parseSimpleYaml(yamlFixture)) === JSON.stringify(expected) &&
+    JSON.stringify(parseSimpleYaml(yamlFixture.replace(/\n/g, '\r\n'))) === JSON.stringify(expected),
+  JSON.stringify({ lf: parseSimpleYaml(yamlFixture), crlf: parseSimpleYaml(yamlFixture.replace(/\n/g, '\r\n')) })
+);
+
+const pluginValidation = runNode('behavioral-evals/run-with-plugin.js', ['validate']);
+helper.check(
+  '2t. opencode plugin runner validate command exits successfully',
+  pluginValidation.status === 0,
+  `exit ${pluginValidation.status}\n${pluginValidation.stderr}`
+);
+
+const missingWazaEnv = { ...process.env, PATH: '', Path: '' };
+const routingWithoutWaza = runNode('ci/routing-check.js', [], missingWazaEnv);
+helper.check(
+  '2t. routing check gracefully skips when waza is unavailable',
+  routingWithoutWaza.status === 0 && /skip/i.test(`${routingWithoutWaza.stdout}\n${routingWithoutWaza.stderr}`),
+  `exit ${routingWithoutWaza.status}\n${routingWithoutWaza.stdout}\n${routingWithoutWaza.stderr}`
+);
+
+const malformedName = `issue20-malformed-collision-${process.pid}`;
+const malformedTarget = path.join(helper.root, malformedName);
+fs.cpSync(
+  path.join(helper.root, 'ci', 'fixtures', 'bad-frontmatter-colon'),
+  malformedTarget,
+  { recursive: true }
+);
+try {
+  const collision = runNode('ci/description-collision.js');
+  const output = `${collision.stdout}\n${collision.stderr}`;
+  helper.check(
+    '2t. description collision gate fails closed on malformed YAML',
+    collision.status !== 0 && /YAML|frontmatter/i.test(output),
+    `exit ${collision.status}\n${output}`
+  );
+} finally {
+  fs.rmSync(malformedTarget, { recursive: true, force: true });
+}
+
+const negativeControls = runNode('ci/negative-controls.js');
+helper.check(
+  '2t. negative controls execute real gates and pass',
+  negativeControls.status === 0 && /real gate/i.test(negativeControls.stdout),
+  `exit ${negativeControls.status}\n${negativeControls.stdout}\n${negativeControls.stderr}`
+);
+
+const rollup = fs.readFileSync(path.join(helper.root, 'docs', 'issue-20-rollup.md'), 'utf8');
+const deferredWork = ['baseline-debugging', 'baseline-performance', 'baseline-security-review', 'baseline-simple-bugfix', 'verify-before-done', 'verification-loop', 'zoom-out', 'security-review'];
+helper.check(
+  '2t. issue rollup records unresolved acceptance work accurately',
+  /Issue #20 remains open/.test(rollup) && deferredWork.every(term => rollup.includes(term)),
+  'rollup must name the open issue and each deferred baseline/skill item'
+);
+
+helper.finish();

package/ci/mechanism-2t-platform-skill-targets.test.js

@@ -0,0 +1,164 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const helper = require('./test-helper');
+
+console.log('\n[2t] Platform-native skill targets + install ownership safety (issue #80)...');
+
+const platforms = require('../hooks/scripts/lib/platforms');
+const skills = require('../scripts/lib/skills');
+const manifest = require('../scripts/lib/manifest');
+const advisory = require('../scripts/lib/advisory-text');
+const root = path.resolve(__dirname, '..');
+const ws = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-2t-ws-'));
+const home = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-2t-home-'));
+
+function platform(name) {
+  return platforms.find((entry) => entry.name === name);
+}
+
+function copyAndAssert(name, isGlobal, expectedPath) {
+  const p = platform(name);
+  const target = p.getSkillsTarget({ workspaceRoot: ws, userHome: home, isGlobal, manifest });
+  helper.check(
+    `2t. ${name} ${isGlobal ? 'global' : 'local'} target matches the installer contract`,
+    target && path.resolve(target.path) === path.resolve(expectedPath),
+    `got ${target && target.path}; expected ${expectedPath}`
+  );
+  if (!target) return;
+  skills.installSkillsToTargets({
+    chosenSkills: ['tdd'],
+    targetDirs: [target],
+    harnessSourceDir: root,
+    packageVersion: '9.9.9',
+    linkMode: 'copy',
+  });
+  helper.check(
+    `2t. ${name} ${isGlobal ? 'global' : 'local'} --copy writes a readable SKILL.md`,
+    fs.existsSync(path.join(expectedPath, 'tdd', 'SKILL.md')),
+    `${path.join(expectedPath, 'tdd', 'SKILL.md')} missing`
+  );
+}
+
+copyAndAssert('codex', false, path.join(ws, '.agents', 'skills'));
+copyAndAssert('continue', true, path.join(home, '.continue', 'skills'));
+copyAndAssert('hermes', false, path.join(ws, '.agents', 'skills'));
+copyAndAssert('hermes', true, path.join(home, '.hermes', 'skills'));
+
+// Native global manifests must still be discoverable by the uninstaller and
+// use the exact `global` sentinel that prevents a local-only bulk sweep from
+// deleting user-home skills.
+{
+  const installed = skills.getInstalledSkills(ws, home);
+  const continueGlobal = installed.find(entry => entry.dirPath === path.join(home, '.continue', 'skills', 'tdd'));
+  const hermesGlobal = installed.find(entry => entry.dirPath === path.join(home, '.hermes', 'skills', 'tdd'));
+  helper.check('2t. Continue native global manifest is discoverable', !!continueGlobal, JSON.stringify(installed));
+  helper.check('2t. Hermes native global manifest is discoverable', !!hermesGlobal, JSON.stringify(installed));
+  helper.check('2t. native global skill scopes use the protected global sentinel',
+    continueGlobal && hermesGlobal && continueGlobal.scope === 'global' && hermesGlobal.scope === 'global',
+    JSON.stringify({ continue: continueGlobal && continueGlobal.scope, hermes: hermesGlobal && hermesGlobal.scope }));
+}
+
+// Hermes has no global advisory file, so it records an explicit Harness-owned
+// bookkeeping marker instead of mutating Hermes config just to make uninstall
+// detection possible.
+{
+  const hermes = platform('hermes');
+  const globalHarness = path.join(home, '.agents', 'harness-everything');
+  const marker = path.join(globalHarness, 'hermes-global.json');
+  hermes.install({
+    isGlobal: true,
+    targetWorkspaceRoot: path.join(home, '.agents'),
+    userHome: home,
+    advisory,
+  });
+  helper.check('2t. Hermes global install writes an owned detection marker', fs.existsSync(marker), marker);
+  hermes.uninstall({
+    removeLocal: false,
+    removeGlobal: true,
+    workspaceRoot: ws,
+    userHome: home,
+    cleanEmptyDirs(dir) {
+      try { if (fs.existsSync(dir) && fs.readdirSync(dir).length === 0) fs.rmdirSync(dir); } catch (e) { /* best effort */ }
+    },
+  });
+  helper.check('2t. Hermes global uninstall removes its detection marker', !fs.existsSync(marker), marker);
+}
+
+// A malformed user settings file must never be converted to `{}` and
+// overwritten. Installation fails before any mutation and preserves bytes.
+{
+  const claude = platform('claude');
+  const claudeDir = path.join(ws, '.claude');
+  const settings = path.join(claudeDir, 'settings.json');
+  fs.mkdirSync(claudeDir, { recursive: true });
+  const original = '{ malformed user settings\n';
+  fs.writeFileSync(settings, original, 'utf8');
+
+  let failedClosed = false;
+  try {
+    claude.install({
+      isGlobal: false,
+      targetWorkspaceRoot: ws,
+      harnessSourceDir: root,
+      packageVersion: '9.9.9',
+      claudeHooks: { mergeHarnessHooks() {} },
+      manifest,
+    });
+  } catch (error) {
+    failedClosed = /Refusing to modify malformed/.test(error.message);
+  }
+
+  helper.check('2t. malformed Claude settings fail closed', failedClosed, 'install did not reject malformed JSON');
+  helper.check(
+    '2t. malformed Claude settings remain byte-for-byte unchanged',
+    fs.readFileSync(settings, 'utf8') === original,
+    `got ${JSON.stringify(fs.readFileSync(settings, 'utf8'))}`
+  );
+}
+
+// Dedicated/fixed filenames must not let Harness claim or delete an unrelated
+// pre-existing user file merely because the path matches.
+{
+  const continueRule = path.join(ws, '.continue', 'rules', 'harness.md');
+  fs.mkdirSync(path.dirname(continueRule), { recursive: true });
+  const original = '# user-owned rule\n';
+  fs.writeFileSync(continueRule, original, 'utf8');
+  let rejected = false;
+  try {
+    advisory.installContinueRule(continueRule, '.continue/rules/harness.md');
+  } catch (error) {
+    rejected = /Refusing to overwrite pre-existing non-Harness/.test(error.message);
+  }
+  helper.check('2t. Continue refuses to overwrite a user-owned harness.md', rejected, 'collision was not rejected');
+  helper.check('2t. Continue collision leaves original bytes unchanged', fs.readFileSync(continueRule, 'utf8') === original, 'user rule changed');
+}
+
+{
+  const promptsDir = path.join(home, 'prompts');
+  fs.mkdirSync(promptsDir, { recursive: true });
+  const getUserPromptsDir = () => promptsDir;
+  const cases = [
+    ['copilot', 'harness.instructions.md'],
+    ['codex', 'harness.agent.md'],
+  ];
+  for (const [name, fileName] of cases) {
+    const p = platform(name);
+    const target = path.join(promptsDir, fileName);
+    const original = `user-owned ${name}\n`;
+    fs.writeFileSync(target, original, 'utf8');
+    let rejected = false;
+    try {
+      p.install({ isGlobal: true, targetWorkspaceRoot: ws, getUserPromptsDir, advisory });
+    } catch (error) {
+      rejected = /Refusing to overwrite pre-existing non-Harness/.test(error.message);
+    }
+    helper.check(`2t. ${name} global install refuses a user-owned fixed prompt file`, rejected, 'collision was not rejected');
+    p.uninstall({ removeLocal: false, removeGlobal: true, workspaceRoot: ws, userHome: home, getUserPromptsDir, cleanEmptyDirs() {} });
+    helper.check(`2t. ${name} global uninstall preserves non-Harness file`, fs.readFileSync(target, 'utf8') === original, 'user-owned file was changed or deleted');
+  }
+}
+
+fs.rmSync(ws, { recursive: true, force: true });
+fs.rmSync(home, { recursive: true, force: true });
+helper.finish();