harness-everything 0.20.5 → 0.20.7

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.20.5",
+      "version": "0.20.7",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.20.5",
+  "version": "0.20.7",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.20.7](https://github.com/dyphn1/Harness-everything/compare/v0.20.6...v0.20.7) (2026-09-22)
+
+### Bug Fixes
+
+* **distribution:** emit per-host progress so plugin-sync does not look hung ([d746871](https://github.com/dyphn1/Harness-everything/commit/d746871b7a39c10decc841e9982b27982271df1e)), closes [#238](https://github.com/dyphn1/Harness-everything/issues/238)
+
+## [0.20.6](https://github.com/dyphn1/Harness-everything/compare/v0.20.5...v0.20.6) (2026-09-22)
+
+### Bug Fixes
+
+* **distribution:** match resolve-on-path test extension casing to fixture files ([07f0e5a](https://github.com/dyphn1/Harness-everything/commit/07f0e5a815e779f5596d5c79d448b9ab383ee361))
+* **distribution:** resolve codex/claude on windows in path order, not exe preference ([048c5e4](https://github.com/dyphn1/Harness-everything/commit/048c5e40e0d4727700234c49e509fc6edfac4f01)), closes [#236](https://github.com/dyphn1/Harness-everything/issues/236)
+
 ## [0.20.5](https://github.com/dyphn1/Harness-everything/compare/v0.20.4...v0.20.5) (2026-09-22)
 
 ### Bug Fixes

package/ci/mechanism-2ao-plugin-sync.test.js

@@ -9,6 +9,7 @@ const {
   findMarketplace,
   findPlugin,
   parseJsonOutput,
+  resolveOnPath,
   sync
 } = require('../scripts/plugin-sync');
 
@@ -237,6 +238,60 @@ assert.strictEqual(findPlugin({ plugins: [{ id: 'harness-everything@harness-ever
   assert.ok(result.results.every(entry => entry.reasonCode === 'cli-not-found'), 'an absent CLI must stay distinguishable from a capability boundary');
 }
 
+{
+  // Each host sync is fully synchronous and does real network I/O; without a
+  // progress notice emitted before that work starts, the terminal stays
+  // silent for the whole run, which is indistinguishable from a hang.
+  const events = [];
+  const fake = fakeHost({ claudeInstalled: true, codexInstalled: true });
+  const runner = (command, args, opts) => {
+    events.push(`call:${command}`);
+    return fake.runner(command, args, opts);
+  };
+  const result = sync({ host: 'all', repository: 'dyphn1/Harness-everything', ref: 'main' }, {
+    runner,
+    commandAvailable: () => true,
+    log: () => {},
+    warn: message => events.push(`warn:${message}`)
+  });
+  assert.strictEqual(result.failed, 0);
+  assert.ok(events.includes('warn:[...] claude: syncing'), 'a claude progress notice must be emitted');
+  assert.ok(events.includes('warn:[...] codex: syncing'), 'a codex progress notice must be emitted');
+  assert.ok(events.indexOf('warn:[...] claude: syncing') < events.indexOf('call:claude'), 'the claude notice must be emitted before its first host command, not buffered until the run finishes');
+  assert.ok(events.indexOf('warn:[...] codex: syncing') < events.indexOf('call:codex'), 'the codex notice must be emitted before its first host command');
+}
+
+// resolveOnPath() is pure filesystem logic (platform choice happens only at
+// the defaultRunner call site), so its directory-order-first contract runs
+// on every CI OS, not only Windows.
+{
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-plugin-sync-resolve-'));
+  const cmdDir = path.join(base, 'cmd-dir');
+  const exeDir = path.join(base, 'exe-dir');
+  fs.mkdirSync(cmdDir);
+  fs.mkdirSync(exeDir);
+  fs.writeFileSync(path.join(cmdDir, 'harness-fixture.cmd'), '');
+  fs.writeFileSync(path.join(exeDir, 'harness-fixture.exe'), '');
+  try {
+    // Real PATHEXT is upper-case, but NTFS matches it case-insensitively
+    // against lower-case fixture files; this test also runs on Linux/macOS
+    // CI, whose case-sensitive filesystems would not, so the fixture extension
+    // casing matches the file names exactly. The point under test is
+    // directory order versus extension order, not PATHEXT's own casing.
+    const pathExt = '.com;.exe;.bat;.cmd';
+    const cmdFirst = resolveOnPath('harness-fixture', { pathValue: [cmdDir, exeDir].join(path.delimiter), pathExt });
+    assert.strictEqual(String(cmdFirst).toLowerCase(), path.join(cmdDir, 'harness-fixture.cmd').toLowerCase(), 'an earlier PATH directory must win even when a later one has the extension PATHEXT prefers');
+
+    const exeFirst = resolveOnPath('harness-fixture', { pathValue: [exeDir, cmdDir].join(path.delimiter), pathExt });
+    assert.strictEqual(String(exeFirst).toLowerCase(), path.join(exeDir, 'harness-fixture.exe').toLowerCase(), 'PATH order, not extension preference, must decide the match');
+
+    const missing = resolveOnPath('harness-fixture-does-not-exist', { pathValue: [cmdDir, exeDir].join(path.delimiter), pathExt });
+    assert.strictEqual(missing, null, 'an unresolved command must return null, not throw');
+  } finally {
+    fs.rmSync(base, { recursive: true, force: true });
+  }
+}
+
 if (process.platform === 'win32') {
   const fixtureDir = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-plugin-sync-command-'));
   const originalPath = process.env.PATH;
@@ -252,6 +307,33 @@ if (process.platform === 'win32') {
   }
 }
 
+// End-to-end: when a .cmd shim sits earlier on PATH than an unrelated real
+// .exe, the runner must actually execute the .cmd (not silently prefer
+// whichever candidate Node's non-shell spawn can launch directly).
+if (process.platform === 'win32') {
+  const fixtureDir = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-plugin-sync-order-'));
+  const shadowDir = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-plugin-sync-shadow-'));
+  const originalPath = process.env.PATH;
+  try {
+    fs.writeFileSync(path.join(fixtureDir, 'harness-order-fixture.cmd'), '@echo off\r\necho current-cmd-shim\r\n');
+    // A real, directly-launchable PE binary standing in for an unrelated,
+    // stale standalone install later on PATH. cmd.exe itself is a stable,
+    // always-present .exe to copy for this purpose.
+    fs.copyFileSync(path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'cmd.exe'), path.join(shadowDir, 'harness-order-fixture.exe'));
+    process.env.PATH = [fixtureDir, shadowDir, originalPath || ''].join(path.delimiter);
+
+    const context = createContext();
+    const result = context.runner('harness-order-fixture', []);
+    assert.strictEqual(result.status, 0, 'the earlier PATH entry must run successfully');
+    assert.match(result.stdout, /current-cmd-shim/, 'an earlier .cmd must be executed even though a later, directly-launchable .exe also matches');
+  } finally {
+    if (originalPath === undefined) delete process.env.PATH;
+    else process.env.PATH = originalPath;
+    fs.rmSync(fixtureDir, { recursive: true, force: true });
+    fs.rmSync(shadowDir, { recursive: true, force: true });
+  }
+}
+
 for (const wrapper of ['scripts/plugin-sync.sh', 'scripts/plugin-sync.ps1']) {
   const text = fs.readFileSync(path.join(ROOT, wrapper), 'utf8');
   assert.match(text, /plugin-sync\.js/);

package/docs/platform-capabilities.md

@@ -87,7 +87,7 @@ Mutating commands are issued with the current option set and retried without any
 
 The installed branch is intentionally an update branch even when the current release is already the newest version; the host command may report “already latest.” Codex marketplace upgrade is the current native refresh operation; the command does not edit private cache paths or `config.toml`. These are deterministic command/state tests, not live-host evidence, so `liveHostVerification` remains `Unknown` in the matrix.
 
-On Windows, the synchronizer retries through `ComSpec` when Node cannot directly start a CLI shim, so npm-installed `codex.cmd` and `claude.cmd` commands remain discoverable when the wrapper is launched from Git Bash.
+On Windows, the synchronizer resolves `codex`/`claude` the same way an interactive shell does: it walks `PATH` directories in order and tries `PATHEXT` extensions within each directory before moving on, so directory order — not which candidate happens to be a directly launchable `.exe` — decides the match. This matters because Node's non-shell `spawnSync` cannot execute a `.cmd`/`.bat` shim directly and, left to its own resolution, can silently prefer an unrelated, older standalone `.exe` elsewhere on `PATH` over a newer npm-installed shim with no error to signal it. Only the one case Windows genuinely requires an interpreter for — a resolved `.cmd`/`.bat` target — is run through `ComSpec`, using the already-resolved absolute path rather than re-resolving the bare command name.
 
 ### Explicit Codex user-hook compatibility fallback
 

package/docs/troubleshooting.md

@@ -202,7 +202,7 @@ Host CLIs differ in which options and subcommands they implement, so the synchro
 - An option the host rejects — `unknown option '--json'` (commander) or `unexpected argument '--json' found` (clap/Codex) — is dropped and the command is retried without it.
 - A Codex build that ships only `codex plugin marketplace` has no `codex plugin list`/`codex plugin add`. The marketplace source is still registered and the host is reported as `[skip] codex: …` with an actionable reason, not as a failure. Upgrade the Codex CLI, or enable the plugin from Codex, to complete installation.
 
-If several `codex` binaries are on `PATH` (for example an npm shim plus an installer-managed build), the synchronizer runs whichever one Node resolves first, which may be older than the one your interactive shell picks up. Compare `codex --version` with `node -e "console.log(require('child_process').spawnSync('codex',['--version'],{encoding:'utf8'}).stdout)"` when the reported capabilities look wrong.
+If several `codex`/`claude` binaries are on `PATH` (for example an npm shim plus a separately installed build), the synchronizer resolves the same one your interactive shell would: it walks `PATH` directories in order and, on Windows, tries `PATHEXT` extensions within each directory before moving to the next — matching `cmd.exe`/PowerShell/`which` resolution, so directory order decides the match, not which candidate happens to be a directly launchable `.exe`. If the reported capabilities still look stale, an orphaned install is genuinely earlier on `PATH` than the one you expect; check `where codex` (Windows) or `which -a codex` (POSIX) to see the full resolution order, and remove or reorder the stale entry.
 
 See [openai-plugin.md](openai-plugin.md) for installation and validation details.
 

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.20.5",
+  "version": "0.20.7",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.20.5",
+  "version": "0.20.7",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.20.5",
+  "version": "0.20.7",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.20.5",
+  "version": "0.20.7",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:2fe1f791-72b1-528d-91ab-182e028b8f11",
+  "serialNumber": "urn:uuid:12ceeeac-7f99-5fb2-82a3-768d5d708e00",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-22T14:48:08.473Z",
+    "timestamp": "2026-09-22T16:17:00.105Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.20.5"
+        "version": "0.20.7"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.20.5",
+      "bom-ref": "pkg:npm/harness-everything@0.20.7",
       "name": "harness-everything",
-      "version": "0.20.5",
-      "purl": "pkg:npm/harness-everything@0.20.5"
+      "version": "0.20.7",
+      "purl": "pkg:npm/harness-everything@0.20.7"
     }
   },
   "components": [
@@ -1999,7 +1999,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.20.5",
+      "ref": "pkg:npm/harness-everything@0.20.7",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",

package/scripts/plugin-sync.js

@@ -11,6 +11,8 @@
  */
 
 const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
 
 const DEFAULTS = Object.freeze({
   marketplace: 'harness-everything',
@@ -19,17 +21,83 @@ const DEFAULTS = Object.freeze({
   ref: process.env.HARNESS_PLUGIN_REF || 'main'
 });
 
+// Windows CLIs that ship as a .cmd/.bat shim are not executable via the same
+// direct CreateProcess call Node uses for a .exe, and — unlike a real shell —
+// Node's non-shell spawnSync does not search PATHEXT-suffixed candidates for
+// a bare command name at all. When more than one `codex`/`claude` is on
+// PATH (an npm shim plus a separately installed .exe is a common pairing),
+// the non-shell spawn silently resolves whichever entry happens to be a real
+// .exe, regardless of PATH order — so an unrelated, older standalone install
+// can shadow a newer npm-updated shim with no error to signal it.
+//
+// resolveOnPath() replicates what a real shell / `where.exe` does instead:
+// walk PATH directories in order, and within each directory try PATHEXT
+// extensions in order, returning the first match. Directory order wins over
+// extension preference, exactly like cmd.exe and PowerShell's own lookup, so
+// the result matches what typing the command in a terminal would run.
+function resolveOnPath(command, { pathValue = process.env.PATH || process.env.Path || '', pathExt = process.env.PATHEXT || '.COM;.EXE;.BAT;.CMD' } = {}) {
+  if (path.isAbsolute(command)) return fs.existsSync(command) ? command : null;
+
+  const dirs = pathValue.split(path.delimiter).filter(Boolean);
+  const extensions = pathExt.split(';').map(ext => ext.trim()).filter(Boolean);
+  const hasKnownExtension = extensions.some(ext => command.toLowerCase().endsWith(ext.toLowerCase()));
+
+  for (const dir of dirs) {
+    if (hasKnownExtension) {
+      const candidate = path.join(dir, command);
+      if (fs.existsSync(candidate)) return candidate;
+      continue;
+    }
+    for (const ext of extensions) {
+      const candidate = path.join(dir, command + ext);
+      if (fs.existsSync(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
+// A .bat/.cmd target is not a Win32 executable image; Windows requires the
+// cmd.exe interpreter to run one at all, the same way a shebang-less script
+// needs an explicit interpreter on POSIX. This is the one case a shell is
+// unavoidable, and only that resolved file is passed to it — never the bare
+// command name or user-controlled arguments re-interpreted as a command line.
+const SHELL_REQUIRED_EXTENSIONS = new Set(['.bat', '.cmd']);
+
+function runResolved(resolved, args, options) {
+  const ext = path.extname(resolved).toLowerCase();
+  if (SHELL_REQUIRED_EXTENSIONS.has(ext)) {
+    const comspec = process.env.ComSpec || process.env.COMSPEC || 'cmd.exe';
+    return spawnSync(comspec, ['/d', '/c', resolved, ...args], options);
+  }
+  return spawnSync(resolved, args, options);
+}
+
 function defaultRunner(command, args) {
   const options = {
     encoding: 'utf8',
     stdio: ['ignore', 'pipe', 'pipe'],
     windowsHide: true
   };
+
+  if (process.platform === 'win32') {
+    const resolved = resolveOnPath(command);
+    if (resolved) {
+      const result = runResolved(resolved, args, options);
+      return {
+        status: result.status === null ? 1 : result.status,
+        stdout: result.stdout || '',
+        stderr: result.stderr || '',
+        error: result.error || null
+      };
+    }
+  }
+
   let result = spawnSync(command, args, options);
 
-  // npm-installed Windows CLIs are often .cmd shims. Node can report those
-  // shims as an executable-resolution error when this script is launched from
-  // Git Bash, even though the same command is available to the shell.
+  // Resolution above only checks the filesystem; if PATH itself could not be
+  // read, or the command is reachable through a mechanism resolveOnPath does
+  // not model (e.g. an App Execution Alias), fall back to letting the shell
+  // do its own resolution rather than failing outright.
   if (process.platform === 'win32' && result.error && ['EACCES', 'EINVAL', 'ENOENT'].includes(result.error.code)) {
     const comspec = process.env.ComSpec || process.env.COMSPEC || 'cmd.exe';
     result = spawnSync(comspec, ['/d', '/c', command, ...args], options);
@@ -507,7 +575,15 @@ Options:
 function sync(options, dependencies = {}) {
   const context = createContext({ ...options, ...dependencies });
   const hosts = context.host === 'all' ? ['claude', 'codex'] : [context.host];
-  const results = hosts.map(host => host === 'claude' ? syncClaude(context) : syncCodex(context));
+  // Each host sync is fully synchronous and the marketplace update/refresh
+  // step does real network I/O (observed ~10s+ for Claude alone), so without
+  // this the terminal stays completely silent until every host finishes —
+  // indistinguishable from a hang. This goes to stderr (context.warn), not
+  // stdout, so `--json` consumers' stdout stays pure JSON.
+  const results = hosts.map(host => {
+    context.warn(`[...] ${host}: syncing`);
+    return host === 'claude' ? syncClaude(context) : syncCodex(context);
+  });
   const summary = {
     repository: context.repository,
     marketplace: context.marketplace,
@@ -563,6 +639,7 @@ module.exports = {
   main,
   parseArgs,
   parseJsonOutput,
+  resolveOnPath,
   sync,
   textHasMarketplace,
   textHasPlugin