harness-everything 0.2.2 → 0.4.0

package/hooks/scripts/boundary-guard.js

@@ -1,55 +1,55 @@
-#!/usr/bin/env node
-/**
- * Boundary Guard (PreToolUse: Grep|Glob|Read)
- * Hard-blocks two concrete sources of context bloat / hallucination risk:
- *   1. Reading a large file whole instead of a scoped chunk (offset/limit).
- *   2. Searching inside known noise directories (node_modules, .git, build
- *      output, etc.) that produce huge, low-signal result sets.
- * Fails open on any parse/lookup error - never blocks due to a bug here.
- */
-const fs = require('fs');
-
-const MAX_BYTES_WITHOUT_LIMIT = 512 * 1024; // 512KB
-const NOISE_DIRS = ['node_modules', '.git', 'dist', 'build', 'out', '.next', 'target', 'vendor', '__pycache__', '.venv', 'coverage'];
-
-let inputData = '';
-process.stdin.on('data', chunk => { inputData += chunk; });
-process.stdin.on('end', () => {
-  try {
-    const payload = JSON.parse(inputData);
-    const toolName = payload.tool_name;
-    const input = payload.tool_input || {};
-
-    if (toolName === 'Read') {
-      const filePath = input.file_path;
-      if (filePath && !input.limit && fs.existsSync(filePath)) {
-        const stat = fs.statSync(filePath);
-        if (stat.isFile() && stat.size > MAX_BYTES_WITHOUT_LIMIT) {
-          console.error(`[Boundary Guard] BLOCKED: "${filePath}" is ${(stat.size / 1024).toFixed(0)}KB.`);
-          console.error(`Reading a file this large in one call risks context bloat and "lost in the middle" degradation.`);
-          console.error(`Re-issue the Read with an explicit "offset"/"limit" to pull a targeted slice, or use Grep to locate the relevant section first.`);
-          process.exit(2);
-        }
-      }
-    }
-
-    if (toolName === 'Grep' || toolName === 'Glob') {
-      const searchPath = input.path || '';
-      const pattern = input.pattern || '';
-      const hitsNoiseDir = NOISE_DIRS.some(dir => {
-        const asPathSegment = new RegExp(`(^|[\\\\/])${dir}($|[\\\\/])`);
-        return asPathSegment.test(searchPath) || asPathSegment.test(pattern);
-      });
-      if (hitsNoiseDir) {
-        console.error(`[Boundary Guard] BLOCKED: search targets a noise directory (${NOISE_DIRS.join(', ')}).`);
-        console.error(`These produce huge, low-signal result sets and rarely contain what you're actually looking for.`);
-        console.error(`Scope the search to source directories instead, or state explicitly why this directory must be searched.`);
-        process.exit(2);
-      }
-    }
-
-    process.exit(0);
-  } catch (err) {
-    process.exit(0);
-  }
-});
+#!/usr/bin/env node
+/**
+ * Boundary Guard (PreToolUse: Grep|Glob|Read)
+ * Hard-blocks two concrete sources of context bloat / hallucination risk:
+ *   1. Reading a large file whole instead of a scoped chunk (offset/limit).
+ *   2. Searching inside known noise directories (node_modules, .git, build
+ *      output, etc.) that produce huge, low-signal result sets.
+ * Fails open on any parse/lookup error - never blocks due to a bug here.
+ */
+const fs = require('fs');
+
+const MAX_BYTES_WITHOUT_LIMIT = 512 * 1024; // 512KB
+const NOISE_DIRS = ['node_modules', '.git', 'dist', 'build', 'out', '.next', 'target', 'vendor', '__pycache__', '.venv', 'coverage'];
+
+let inputData = '';
+process.stdin.on('data', chunk => { inputData += chunk; });
+process.stdin.on('end', () => {
+  try {
+    const payload = JSON.parse(inputData);
+    const toolName = payload.tool_name;
+    const input = payload.tool_input || {};
+
+    if (toolName === 'Read') {
+      const filePath = input.file_path;
+      if (filePath && !input.limit && fs.existsSync(filePath)) {
+        const stat = fs.statSync(filePath);
+        if (stat.isFile() && stat.size > MAX_BYTES_WITHOUT_LIMIT) {
+          console.error(`[Boundary Guard] BLOCKED: "${filePath}" is ${(stat.size / 1024).toFixed(0)}KB.`);
+          console.error(`Reading a file this large in one call risks context bloat and "lost in the middle" degradation.`);
+          console.error(`Re-issue the Read with an explicit "offset"/"limit" to pull a targeted slice, or use Grep to locate the relevant section first.`);
+          process.exit(2);
+        }
+      }
+    }
+
+    if (toolName === 'Grep' || toolName === 'Glob') {
+      const searchPath = input.path || '';
+      const pattern = input.pattern || '';
+      const hitsNoiseDir = NOISE_DIRS.some(dir => {
+        const asPathSegment = new RegExp(`(^|[\\\\/])${dir}($|[\\\\/])`);
+        return asPathSegment.test(searchPath) || asPathSegment.test(pattern);
+      });
+      if (hitsNoiseDir) {
+        console.error(`[Boundary Guard] BLOCKED: search targets a noise directory (${NOISE_DIRS.join(', ')}).`);
+        console.error(`These produce huge, low-signal result sets and rarely contain what you're actually looking for.`);
+        console.error(`Scope the search to source directories instead, or state explicitly why this directory must be searched.`);
+        process.exit(2);
+      }
+    }
+
+    process.exit(0);
+  } catch (err) {
+    process.exit(0);
+  }
+});

package/hooks/scripts/codex-action-gate-post.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+'use strict';
+
+const { finalizeExecution } = require('./action-gate');
+
+function inferOutcome(payload) {
+  const response = (payload && (payload.tool_response || payload.toolResponse)) || {};
+  const rawExitCode = response.exitCode ?? response.exit_code ?? payload?.exitCode ?? payload?.exit_code;
+  if (typeof rawExitCode === 'number') return rawExitCode === 0 ? 'success' : 'failure';
+  if (response.success === false || response.ok === false) return 'failure';
+
+  const stderr = response.stderr ?? payload?.stderr ?? '';
+  if (typeof stderr === 'string' && stderr.trim()) {
+    if (/\b(error|fail|failed|failure|exception|fatal|panic|traceback|denied|refused|cannot|unable)\b/i.test(stderr)) {
+      return 'failure';
+    }
+  }
+  return 'success';
+}
+
+function processPayload(payload) {
+  return finalizeExecution(payload, inferOutcome(payload));
+}
+
+function run() {
+  let raw = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', chunk => { raw += chunk; });
+  process.stdin.on('end', () => {
+    try {
+      processPayload(JSON.parse(raw || '{}'));
+    } catch (err) {
+      // PostToolUse runs after the side effect. Audit failures must never be
+      // misrepresented as a successful enforcement decision or block the host.
+      console.error(`[Harness actionGate] Codex post-tool audit failed: ${err.message}`);
+    }
+    process.exitCode = 0;
+  });
+}
+
+if (require.main === module) run();
+
+module.exports = {
+  inferOutcome,
+  processPayload,
+};

package/hooks/scripts/codex-permission-request.js

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const {
+  getWorkspaceRoot,
+  getSessionDir,
+} = require('./lib/harness-state');
+const {
+  RULES_PATH,
+  classify,
+  exactPayloadText,
+  loadRuleTable,
+} = require('./action-gate');
+
+function hookEventOf(payload) {
+  return String((payload && (payload.hook_event_name || payload.hookEventName)) || 'PermissionRequest');
+}
+
+function toolNameOf(payload) {
+  return String((payload && (payload.tool_name || payload.toolName)) || '');
+}
+
+function hashExact(value) {
+  return crypto.createHash('sha256').update(String(value || ''), 'utf8').digest('hex');
+}
+
+function safePart(value, fallback) {
+  const text = String(value || '').replace(/[^A-Za-z0-9._-]+/g, '_').slice(0, 120);
+  return text || fallback;
+}
+
+function sessionContext(payload, overrideSessionDir) {
+  if (overrideSessionDir) return { sessionDir: overrideSessionDir };
+  const root = getWorkspaceRoot(payload);
+  const sessionId = payload && (payload.session_id || payload.sessionId);
+  return { sessionDir: getSessionDir(root, sessionId, payload) };
+}
+
+function atomicWriteJson(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const temp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(temp, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+  fs.renameSync(temp, filePath);
+}
+
+function auditPermissionRequest(payload, options = {}) {
+  const event = hookEventOf(payload);
+  if (event !== 'PermissionRequest') return { kind: 'noop', exitCode: 0, record: null, auditFile: null };
+
+  const context = sessionContext(payload, options.sessionDir);
+  const table = options.ruleTable || loadRuleTable(options.rulePath || RULES_PATH);
+  const rule = classify(payload, table.rules, context.sessionDir);
+  const exact = exactPayloadText(payload);
+  const payloadHash = hashExact(exact);
+  const turnId = (payload && (payload.turn_id || payload.turnId)) || null;
+  const now = new Date().toISOString();
+  const record = {
+    schemaVersion: 1,
+    event: 'PermissionRequest',
+    host: 'codex',
+    turnId,
+    toolName: toolNameOf(payload),
+    payloadHash,
+    matchedRule: rule ? rule.id : null,
+    ruleReason: rule ? rule.reason : null,
+    permissionMode: (payload && (payload.permission_mode || payload.permissionMode)) || null,
+    disposition: 'deferred-to-codex-approval',
+    correlation: 'turn-id-and-payload-hash-only',
+    exactToolCallCorrelation: false,
+    ruleTableSource: table.source,
+    degradedRuleTable: table.degraded,
+    degradationReason: table.degradationReason,
+    createdAt: now,
+    updatedAt: now,
+  };
+
+  const dir = path.join(context.sessionDir, 'action-gate', 'codex-permission-request');
+  const file = path.join(dir, `${safePart(turnId, 'turn')}-${payloadHash.slice(0, 24)}.json`);
+  atomicWriteJson(file, record);
+
+  // PermissionRequest means Codex is already entering its native approval flow.
+  // Returning no allow/deny decision preserves that flow. This hook must never
+  // be treated as a way to manufacture an approval prompt for an otherwise
+  // permitted action.
+  return { kind: 'defer', exitCode: 0, stdout: null, stderr: null, record, auditFile: file };
+}
+
+function internalErrorResult(err) {
+  return {
+    kind: 'audit-error',
+    exitCode: 0,
+    stdout: null,
+    stderr: `[Harness actionGate] Codex PermissionRequest audit failed: ${err.message}. Native Codex approval flow remains authoritative.`,
+  };
+}
+
+function processPayload(payload, options = {}) {
+  try {
+    return auditPermissionRequest(payload, options);
+  } catch (err) {
+    return internalErrorResult(err);
+  }
+}
+
+function emitResult(result) {
+  if (result.stderr) console.error(result.stderr);
+  if (result.stdout) process.stdout.write(`${JSON.stringify(result.stdout)}\n`);
+  return result.exitCode || 0;
+}
+
+function run() {
+  let raw = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', chunk => { raw += chunk; });
+  process.stdin.on('end', () => {
+    let payload = {};
+    try {
+      payload = JSON.parse(raw || '{}');
+    } catch (err) {
+      process.exitCode = emitResult(internalErrorResult(new Error(`invalid hook JSON: ${err.message}`)));
+      return;
+    }
+    process.exitCode = emitResult(processPayload(payload));
+  });
+  process.stdin.on('error', err => {
+    process.exitCode = emitResult(internalErrorResult(err));
+  });
+}
+
+if (require.main === module) run();
+
+module.exports = {
+  auditPermissionRequest,
+  hashExact,
+  internalErrorResult,
+  processPayload,
+};

package/hooks/scripts/context-compact.js

@@ -1,114 +1,115 @@
-#!/usr/bin/env node
-const { execSync } = require('child_process');
-const fs = require('fs');
-const path = require('path');
-const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
-
-function main(payload) {
-  try {
-    // Let's run a quick Git check to estimate context size from modified files
-    const statusRaw = execSync('git status --porcelain', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-    if (!statusRaw) {
-      process.exit(0);
-    }
-
-    const lines = statusRaw.split('\n').filter(Boolean);
-    const modifiedCount = lines.length;
-
-    let totalDiffLines = 0;
-    try {
-      const diffStat = execSync('git diff --numstat', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-      if (diffStat) {
-        diffStat.split('\n').forEach(line => {
-          const [added, deleted] = line.split('\t');
-          if (added && added !== '-' && deleted && deleted !== '-') {
-            totalDiffLines += parseInt(added) + parseInt(deleted);
-          }
-        });
-      }
-    } catch (err) {
-      // Ignore git errors
-    }
-
-    // Thresholds for warning
-    const HIGH_FILE_LIMIT = 6;
-    const HIGH_LINE_LIMIT = 400;
-
-    const overThreshold = modifiedCount >= HIGH_FILE_LIMIT || totalDiffLines >= HIGH_LINE_LIMIT;
-
-    // Throttle: this hook fires on EVERY Bash/Edit/Write call, and a warning
-    // about context bloat that repeats on every call becomes context bloat
-    // itself (and trains the model to ignore hook output). Warn on the first
-    // crossing, then only every 10th call while still over - or when the diff
-    // has grown another 50% since the last warning.
-    const stateFile = path.join(getSessionDir(getWorkspaceRoot(), payload && payload.session_id), 'context-compact-state.json');
-    let state = { overCount: 0, lastWarnedLines: 0 };
-    try {
-      if (fs.existsSync(stateFile)) state = JSON.parse(fs.readFileSync(stateFile, 'utf8'));
-    } catch (err) { /* use default */ }
-
-    if (!overThreshold) {
-      if (state.overCount > 0) {
-        try {
-          fs.writeFileSync(stateFile, JSON.stringify({ overCount: 0, lastWarnedLines: 0 }), 'utf8');
-        } catch (err) { /* ignore */ }
-      }
-      process.exit(0);
-    }
-
-    state.overCount += 1;
-    const onBeat = state.overCount === 1 || state.overCount % 10 === 0;
-    const grewALot = totalDiffLines >= (state.lastWarnedLines || 0) * 1.5 && totalDiffLines > state.lastWarnedLines;
-    const shouldWarn = onBeat || grewALot;
-    if (shouldWarn) state.lastWarnedLines = totalDiffLines;
-    try {
-      fs.writeFileSync(stateFile, JSON.stringify(state), 'utf8');
-    } catch (err) { /* ignore */ }
-
-    if (shouldWarn) {
-      // Plain stdout on exit 0 is only surfaced to Claude for UserPromptSubmit/
-      // SessionStart - for PreToolUse it's written to a debug log Claude never
-      // sees. To actually get an advisory (non-blocking) message in front of
-      // Claude here, it has to go through hookSpecificOutput.additionalContext.
-      const message = [
-        `Harness OS - Context Bloat Warning`,
-        `- Modified Files: ${modifiedCount}`,
-        `- Accumulated Diff: ${totalDiffLines} lines`,
-        ``,
-        `Caution: Large number of modified files or big diffs will bloat the Agent context window, leading to:`,
-        `  1. "Lost in the Middle" reasoning degradation`,
-        `  2. Rapidly inflating token costs`,
-        ``,
-        `Recommended Action:`,
-        `  - Run atomic commits or stage completed files.`,
-        `  - Use targeted sub-folders rather than broad searches.`,
-        `  - Ask user to run '/compact' or '/clear' if supported.`
-      ].join('\n');
-
-      console.log(JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          additionalContext: message
-        }
-      }));
-    }
-  } catch (err) {
-    // Fail open - never block user execution on compaction checker
-  }
-
-  process.exit(0);
-}
-
-let inputData = '';
-const timeout = setTimeout(() => { main(null); }, 200);
-process.stdin.on('data', chunk => { inputData += chunk; });
-process.stdin.on('end', () => {
-  clearTimeout(timeout);
-  let payload = null;
-  try { payload = JSON.parse(inputData.trim()); } catch (err) { /* no payload */ }
-  main(payload);
-});
-process.stdin.on('error', () => {
-  clearTimeout(timeout);
-  main(null);
-});
+#!/usr/bin/env node
+const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
+
+function main(payload) {
+  try {
+    // Let's run a quick Git check to estimate context size from modified files
+    const root = getWorkspaceRoot(payload);
+    const statusRaw = execSync('git status --porcelain', { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    if (!statusRaw) {
+      process.exit(0);
+    }
+
+    const lines = statusRaw.split('\n').filter(Boolean);
+    const modifiedCount = lines.length;
+
+    let totalDiffLines = 0;
+    try {
+      const diffStat = execSync('git diff --numstat', { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+      if (diffStat) {
+        diffStat.split('\n').forEach(line => {
+          const [added, deleted] = line.split('\t');
+          if (added && added !== '-' && deleted && deleted !== '-') {
+            totalDiffLines += parseInt(added) + parseInt(deleted);
+          }
+        });
+      }
+    } catch (err) {
+      // Ignore git errors
+    }
+
+    // Thresholds for warning
+    const HIGH_FILE_LIMIT = 6;
+    const HIGH_LINE_LIMIT = 400;
+
+    const overThreshold = modifiedCount >= HIGH_FILE_LIMIT || totalDiffLines >= HIGH_LINE_LIMIT;
+
+    // Throttle: this hook fires on EVERY Bash/Edit/Write call, and a warning
+    // about context bloat that repeats on every call becomes context bloat
+    // itself (and trains the model to ignore hook output). Warn on the first
+    // crossing, then only every 10th call while still over - or when the diff
+    // has grown another 50% since the last warning.
+    const stateFile = path.join(getSessionDir(root, payload && (payload.session_id || payload.sessionId)), 'context-compact-state.json');
+    let state = { overCount: 0, lastWarnedLines: 0 };
+    try {
+      if (fs.existsSync(stateFile)) state = JSON.parse(fs.readFileSync(stateFile, 'utf8'));
+    } catch (err) { /* use default */ }
+
+    if (!overThreshold) {
+      if (state.overCount > 0) {
+        try {
+          fs.writeFileSync(stateFile, JSON.stringify({ overCount: 0, lastWarnedLines: 0 }), 'utf8');
+        } catch (err) { /* ignore */ }
+      }
+      process.exit(0);
+    }
+
+    state.overCount += 1;
+    const onBeat = state.overCount === 1 || state.overCount % 10 === 0;
+    const grewALot = totalDiffLines >= (state.lastWarnedLines || 0) * 1.5 && totalDiffLines > state.lastWarnedLines;
+    const shouldWarn = onBeat || grewALot;
+    if (shouldWarn) state.lastWarnedLines = totalDiffLines;
+    try {
+      fs.writeFileSync(stateFile, JSON.stringify(state), 'utf8');
+    } catch (err) { /* ignore */ }
+
+    if (shouldWarn) {
+      // Plain stdout on exit 0 is only surfaced to Claude for UserPromptSubmit/
+      // SessionStart - for PreToolUse it's written to a debug log Claude never
+      // sees. To actually get an advisory (non-blocking) message in front of
+      // Claude here, it has to go through hookSpecificOutput.additionalContext.
+      const message = [
+        `Harness OS - Context Bloat Warning`,
+        `- Modified Files: ${modifiedCount}`,
+        `- Accumulated Diff: ${totalDiffLines} lines`,
+        ``,
+        `Caution: Large number of modified files or big diffs will bloat the Agent context window, leading to:`,
+        `  1. "Lost in the Middle" reasoning degradation`,
+        `  2. Rapidly inflating token costs`,
+        ``,
+        `Recommended Action:`,
+        `  - Run atomic commits or stage completed files.`,
+        `  - Use targeted sub-folders rather than broad searches.`,
+        `  - Ask user to run '/compact' or '/clear' if supported.`
+      ].join('\n');
+
+      console.log(JSON.stringify({
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          additionalContext: message
+        }
+      }));
+    }
+  } catch (err) {
+    // Fail open - never block user execution on compaction checker
+  }
+
+  process.exit(0);
+}
+
+let inputData = '';
+const timeout = setTimeout(() => { main(null); }, 200);
+process.stdin.on('data', chunk => { inputData += chunk; });
+process.stdin.on('end', () => {
+  clearTimeout(timeout);
+  let payload = null;
+  try { payload = JSON.parse(inputData.trim()); } catch (err) { /* no payload */ }
+  main(payload);
+});
+process.stdin.on('error', () => {
+  clearTimeout(timeout);
+  main(null);
+});