harness-everything 0.20.2 → 0.20.4

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.20.2",
+      "version": "0.20.4",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.20.2",
+  "version": "0.20.4",
   "author": {
     "name": "Miya Daniel"
   },

package/.github/workflows/release.yml

@@ -68,3 +68,11 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: "true"
         run: npx --no-install semantic-release
+
+      - name: Upload release SBOM artifact
+        if: ${{ hashFiles('sbom.cdx.json') != '' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-sbom
+          path: sbom.cdx.json
+          if-no-files-found: error

package/.releaserc.json

@@ -103,6 +103,12 @@
     [
       "@semantic-release/github",
       {
+        "assets": [
+          {
+            "path": "sbom.cdx.json",
+            "label": "CycloneDX SBOM"
+          }
+        ],
         "successComment": false,
         "failTitle": false,
         "labels": false,

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.20.4](https://github.com/dyphn1/Harness-everything/compare/v0.20.3...v0.20.4) (2026-09-22)
+
+### Bug Fixes
+
+* **release:** publish sbom release artifacts ([83eeb96](https://github.com/dyphn1/Harness-everything/commit/83eeb96c1746ccbffcdcba478ba6b54c522887a0)), closes [#222](https://github.com/dyphn1/Harness-everything/issues/222)
+
+## [0.20.3](https://github.com/dyphn1/Harness-everything/compare/v0.20.2...v0.20.3) (2026-09-22)
+
+### Bug Fixes
+
+* **distribution:** support windows cli shims ([f634e6d](https://github.com/dyphn1/Harness-everything/commit/f634e6d84fd8d0751604efa1d9b8acd5e7d90b8b)), closes [#221](https://github.com/dyphn1/Harness-everything/issues/221)
+
 ## [0.20.2](https://github.com/dyphn1/Harness-everything/compare/v0.20.1...v0.20.2) (2026-09-22)
 
 ### Bug Fixes

package/RELEASING.md

@@ -40,9 +40,9 @@ A push to `main` runs the full reusable CI gate and then semantic-release. A man
 6. Run `scripts/sync-release-version.js` to synchronize package, Claude, OpenAI/Codex, OpenCode, lockfile, and changed canonical skill version fields.
 7. Regenerate and verify plugin packages, then generate and validate the release-only `sbom.cdx.json` CycloneDX 1.7 file.
 8. Update `CHANGELOG.md` and create `chore(release): X.Y.Z [skip ci]`.
-9. Create tag `vX.Y.Z`, publish npm with provenance (including the generated SBOM), and create the GitHub Release.
+9. Create tag `vX.Y.Z`, publish npm with provenance (including the generated SBOM), create the GitHub Release with the SBOM attached, and retain the same file as an Actions artifact.
 
-The SBOM is generated from the release `package.json`/`package-lock.json` as CycloneDX 1.7, the current 1.x format, to satisfy consumers and regulatory baselines requiring CycloneDX 1.6 or later. It is intentionally not committed to Git. npm packaging is tested to ensure `sbom.cdx.json` is included in the published tarball.
+The SBOM is generated from the release `package.json`/`package-lock.json` as CycloneDX 1.7, the current 1.x format, to satisfy consumers and regulatory baselines requiring CycloneDX 1.6 or later. It is intentionally not committed to Git. The release publishes `sbom.cdx.json` in the npm tarball and as a GitHub Release asset, while the workflow also retains it as an Actions artifact.
 
 Release concurrency is serialized so two updates to `main` cannot publish competing versions.
 
@@ -90,7 +90,8 @@ The release workflow runs the reusable CI gate before semantic-release. After pu
 ```text
 gh run list --workflow release.yml --limit 5
 gh run view <run-id> --json conclusion,headSha,jobs
-gh release view v<version> --json tagName,publishedAt,url
+gh release view v<version> --json tagName,publishedAt,url,assets
+gh run view <run-id> --json conclusion,headSha,jobs,artifacts
 npm view harness-everything version dist-tags --json
 ```
 

package/ci/mechanism-2ao-plugin-sync.test.js

@@ -2,8 +2,10 @@
 
 const assert = require('assert');
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 const {
+  createContext,
   findMarketplace,
   findPlugin,
   parseJsonOutput,
@@ -178,6 +180,21 @@ assert.strictEqual(findPlugin({ plugins: [{ id: 'harness-everything@harness-ever
   assert.strictEqual(result.failed, 0);
 }
 
+if (process.platform === 'win32') {
+  const fixtureDir = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-plugin-sync-command-'));
+  const originalPath = process.env.PATH;
+  try {
+    fs.writeFileSync(path.join(fixtureDir, 'harness-codex-fixture.cmd'), '@echo off\r\necho codex-cli fixture\r\n');
+    process.env.PATH = `${fixtureDir};${originalPath || ''}`;
+    const context = createContext();
+    assert.strictEqual(context.commandAvailable('harness-codex-fixture'), true, 'Windows .cmd CLI shims must be detected');
+  } finally {
+    if (originalPath === undefined) delete process.env.PATH;
+    else process.env.PATH = originalPath;
+    fs.rmSync(fixtureDir, { recursive: true, force: true });
+  }
+}
+
 for (const wrapper of ['scripts/plugin-sync.sh', 'scripts/plugin-sync.ps1']) {
   const text = fs.readFileSync(path.join(ROOT, wrapper), 'utf8');
   assert.match(text, /plugin-sync\.js/);

package/ci/mechanism-2ap-sbom.test.js

@@ -24,6 +24,22 @@ assert.ok(execPlugin, 'semantic-release exec plugin is required for SBOM generat
 assert.match(execPlugin[1].prepareCmd, /generate-sbom\.js --output sbom\.cdx\.json --version \$\{nextRelease\.version\}/);
 assert.match(execPlugin[1].prepareCmd, /generate-sbom\.js --validate sbom\.cdx\.json --version \$\{nextRelease\.version\}/);
 
+const githubPlugin = releaseConfig.plugins.find(plugin => Array.isArray(plugin) && plugin[0] === '@semantic-release/github');
+assert.ok(githubPlugin, 'semantic-release github plugin is required for release publication');
+assert.ok(Array.isArray(githubPlugin[1].assets), 'GitHub Release assets must be configured');
+assert.ok(
+  githubPlugin[1].assets.some(asset => asset && typeof asset === 'object' && asset.path === 'sbom.cdx.json'),
+  'GitHub Release must publish the generated SBOM as an asset'
+);
+
+const releaseWorkflow = fs.readFileSync(path.join(ROOT, '.github/workflows/release.yml'), 'utf8');
+assert.match(releaseWorkflow, /uses:\s+actions\/upload-artifact@v4/,
+  'release workflow must retain the generated SBOM as an Actions artifact');
+assert.match(releaseWorkflow, /if:\s+\$\{\{\s*hashFiles\('sbom\.cdx\.json'\)\s*!=\s*''\s*\}\}/,
+  'release workflow must skip artifact upload when semantic-release has no release');
+assert.match(releaseWorkflow, /path:\s+sbom\.cdx\.json/,
+  'release workflow artifact must point at the generated SBOM');
+
 const bom = buildBom(ROOT, {
   version: packageJson.version,
   timestamp: '2026-09-21T00:00:00.000Z',

package/docs/platform-capabilities.md

@@ -84,6 +84,8 @@ The command detects Claude Code and Codex independently, ensures the Harness mar
 
 The installed branch is intentionally an update branch even when the current release is already the newest version; the host command may report “already latest.” Codex marketplace upgrade is the current native refresh operation; the command does not edit private cache paths or `config.toml`. These are deterministic command/state tests, not live-host evidence, so `liveHostVerification` remains `Unknown` in the matrix.
 
+On Windows, the synchronizer retries through `ComSpec` when Node cannot directly start a CLI shim, so npm-installed `codex.cmd` and `claude.cmd` commands remain discoverable when the wrapper is launched from Git Bash.
+
 ### Explicit Codex user-hook compatibility fallback
 
 Current Codex documentation supports plugin-bundled hooks, so native plugin mounting remains the preferred path. Some host/source combinations have nevertheless failed to expose enabled plugin hooks for review/entry attribution (#122 and upstream Codex reports). Harness therefore provides an **explicit compatibility fallback**, not an automatic replacement for native plugin hooks:

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.20.2",
+  "version": "0.20.4",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.20.2",
+  "version": "0.20.4",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.20.2",
+  "version": "0.20.4",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.20.2",
+  "version": "0.20.4",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:338bfdd5-e2e1-5e75-b6b1-f114ba76e2f5",
+  "serialNumber": "urn:uuid:478ab7f0-6aaf-55ae-9e1a-9e950ea30f9d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-22T01:26:05.707Z",
+    "timestamp": "2026-09-22T02:13:44.851Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.20.2"
+        "version": "0.20.4"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.20.2",
+      "bom-ref": "pkg:npm/harness-everything@0.20.4",
       "name": "harness-everything",
-      "version": "0.20.2",
-      "purl": "pkg:npm/harness-everything@0.20.2"
+      "version": "0.20.4",
+      "purl": "pkg:npm/harness-everything@0.20.4"
     }
   },
   "components": [
@@ -1999,7 +1999,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.20.2",
+      "ref": "pkg:npm/harness-everything@0.20.4",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",

package/scripts/plugin-sync.js

@@ -20,11 +20,21 @@ const DEFAULTS = Object.freeze({
 });
 
 function defaultRunner(command, args) {
-  const result = spawnSync(command, args, {
+  const options = {
     encoding: 'utf8',
     stdio: ['ignore', 'pipe', 'pipe'],
     windowsHide: true
-  });
+  };
+  let result = spawnSync(command, args, options);
+
+  // npm-installed Windows CLIs are often .cmd shims. Node can report those
+  // shims as an executable-resolution error when this script is launched from
+  // Git Bash, even though the same command is available to the shell.
+  if (process.platform === 'win32' && result.error && ['EACCES', 'EINVAL', 'ENOENT'].includes(result.error.code)) {
+    const comspec = process.env.ComSpec || process.env.COMSPEC || 'cmd.exe';
+    result = spawnSync(comspec, ['/d', '/c', command, ...args], options);
+  }
+
   return {
     status: result.status === null ? 1 : result.status,
     stdout: result.stdout || '',