harness-everything 0.2.2 → 0.4.0

package/plugins/harness-everything/hooks/hooks.json

@@ -0,0 +1,197 @@
+{
+  "description": "Harness invariant-first routing and compact Cognitive OS policy for ChatGPT/Codex.",
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/session-start.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\session-start.js\"",
+            "timeout": 15,
+            "statusMessage": "Loading Harness cognitive policy",
+            "additionalContextLimit": 800
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/skills/harness-everything/scripts/kernel-router.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\skills\\harness-everything\\scripts\\kernel-router.js\"",
+            "timeout": 30,
+            "statusMessage": "Routing with Harness invariants",
+            "additionalContextLimit": 2500
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Bash|apply_patch",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/action-gate.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\action-gate.js\"",
+            "timeout": 15,
+            "statusMessage": "Checking Harness pre-action approval gate"
+          },
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/rule-of-3.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\rule-of-3.js\"",
+            "timeout": 15,
+            "statusMessage": "Checking Harness circuit breaker"
+          },
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/context-compact.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\context-compact.js\"",
+            "timeout": 15,
+            "statusMessage": "Checking Harness context size"
+          }
+        ]
+      },
+      {
+        "matcher": "Agent",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/subagent-scope-guard.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\subagent-scope-guard.js\"",
+            "timeout": 15,
+            "statusMessage": "Recording subagent scope baseline"
+          }
+        ]
+      }
+    ],
+    "PermissionRequest": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/codex-permission-request.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\codex-permission-request.js\"",
+            "timeout": 15,
+            "statusMessage": "Recording Codex native approval request"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Bash|apply_patch",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/codex-action-gate-post.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\codex-action-gate-post.js\"",
+            "timeout": 15,
+            "statusMessage": "Recording Harness action-gate execution outcome"
+          },
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/rule-of-3-tracker.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\rule-of-3-tracker.js\"",
+            "timeout": 15,
+            "statusMessage": "Recording Harness failure evidence"
+          },
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/state-persist.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\state-persist.js\"",
+            "timeout": 15,
+            "statusMessage": "Saving Harness session state"
+          }
+        ]
+      },
+      {
+        "matcher": "apply_patch",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/atomic-commit-check.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\atomic-commit-check.js\"",
+            "timeout": 15,
+            "statusMessage": "Checking atomic change boundaries"
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/contract-test.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\contract-test.js\"",
+            "timeout": 15,
+            "statusMessage": "Checking Harness stage contract"
+          }
+        ]
+      },
+      {
+        "matcher": "Agent",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/subagent-scope-guard.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\subagent-scope-guard.js\"",
+            "timeout": 15,
+            "statusMessage": "Reviewing subagent scope changes"
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/subagent-start.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\subagent-start.js\"",
+            "timeout": 15,
+            "statusMessage": "Loading Harness subagent scope"
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/subagent-stop.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\subagent-stop.js\"",
+            "timeout": 15,
+            "statusMessage": "Checking subagent scope changes"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/action-gate.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\action-gate.js\"",
+            "timeout": 15,
+            "statusMessage": "Closing unresolved Harness action approvals"
+          },
+          {
+            "type": "command",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/stop-gate.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\stop-gate.js\"",
+            "timeout": 15,
+            "statusMessage": "Checking Harness verification gate"
+          }
+        ]
+      }
+    ]
+  }
+}

package/plugins/harness-everything/hooks/scripts/action-gate-rules.json

@@ -0,0 +1,77 @@
+{
+  "schemaVersion": 1,
+  "rules": [
+    {
+      "id": "git-force-push",
+      "tools": ["Bash", "PowerShell"],
+      "pattern": "\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))",
+      "flags": "i",
+      "reason": "Force-pushing can rewrite remote history.",
+      "scope": "always"
+    },
+    {
+      "id": "git-reset-hard",
+      "tools": ["Bash", "PowerShell"],
+      "pattern": "\\bgit\\s+reset\\s+--hard\\b",
+      "flags": "i",
+      "reason": "git reset --hard can discard local work.",
+      "scope": "always"
+    },
+    {
+      "id": "git-clean-force-delete",
+      "tools": ["Bash", "PowerShell"],
+      "pattern": "\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))",
+      "flags": "i",
+      "reason": "git clean with force and directory deletion can remove untracked work.",
+      "scope": "always"
+    },
+    {
+      "id": "recursive-delete",
+      "tools": ["Bash"],
+      "pattern": "(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
+      "flags": "i",
+      "reason": "Recursive forced deletion outside approved scratch space is destructive.",
+      "scope": "outside-scratch"
+    },
+    {
+      "id": "powershell-recursive-force-delete",
+      "tools": ["Bash", "PowerShell"],
+      "pattern": "\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
+      "flags": "i",
+      "reason": "PowerShell recursive forced deletion outside approved scratch space is destructive.",
+      "scope": "outside-scratch"
+    },
+    {
+      "id": "sql-destructive-ddl",
+      "tools": ["Bash", "PowerShell"],
+      "pattern": "\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
+      "flags": "i",
+      "reason": "Destructive SQL DDL can irreversibly remove production data or schema state.",
+      "scope": "always"
+    },
+    {
+      "id": "package-publish",
+      "tools": ["Bash", "PowerShell"],
+      "pattern": "\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
+      "flags": "i",
+      "reason": "Publishing creates an external package/release side effect.",
+      "scope": "always"
+    },
+    {
+      "id": "github-release-create",
+      "tools": ["Bash", "PowerShell"],
+      "pattern": "\\bgh\\s+release\\s+create\\b",
+      "flags": "i",
+      "reason": "Creating a GitHub release is an external irreversible publication action.",
+      "scope": "always"
+    },
+    {
+      "id": "production-deploy",
+      "tools": ["Bash", "PowerShell"],
+      "pattern": "\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
+      "flags": "i",
+      "reason": "Deployment changes an external environment and requires explicit approval.",
+      "scope": "always"
+    }
+  ]
+}