harness-everything 0.3.6 → 0.4.0

package/ci/issue99-runtime.test.js

@@ -0,0 +1,218 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawn, spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const actionGatePath = path.join(ROOT, 'hooks', 'scripts', 'action-gate.js');
+const pluginActionGatePath = path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'action-gate.js');
+const rulesPath = path.join(ROOT, 'hooks', 'scripts', 'action-gate-rules.json');
+const actionGate = require(actionGatePath);
+const claudePlatform = require(path.join(ROOT, 'hooks', 'scripts', 'lib', 'platforms', 'claude.js'));
+
+let failed = 0;
+function check(condition, message) {
+  if (condition) console.log(`  PASS ${message}`);
+  else {
+    console.error(`  FAIL ${message}`);
+    failed++;
+  }
+}
+
+function collectCommands(manifest) {
+  const commands = [];
+  for (const [event, groups] of Object.entries((manifest && manifest.hooks) || {})) {
+    for (const group of groups || []) {
+      for (const hook of group.hooks || []) {
+        if (hook.type === 'command' && hook.command) commands.push({ event, command: hook.command });
+      }
+    }
+  }
+  return commands;
+}
+
+function scriptFromClaudeCommand(command, pluginRoot) {
+  const match = String(command).match(/^node\s+"([^"]+)"/);
+  if (!match) return null;
+  return match[1].replace(/\$\{CLAUDE_PLUGIN_ROOT\}/g, pluginRoot);
+}
+
+function probeHookModule(entry, script, cwd) {
+  if (entry.event === 'SessionStart') {
+    return spawnSync(process.execPath, [script], {
+      cwd,
+      encoding: 'utf8',
+      input: JSON.stringify({
+        hook_event_name: 'SessionStart',
+        session_id: 'issue99-cwd-probe',
+        cwd,
+      }),
+      env: { ...process.env, CLAUDE_PLUGIN_ROOT: ROOT },
+    });
+  }
+  return spawnSync(process.execPath, ['-e', 'require(process.argv[1])', script], {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, CLAUDE_PLUGIN_ROOT: ROOT },
+  });
+}
+
+function readAudit(sessionDir, toolUseId) {
+  const file = path.join(sessionDir, 'action-gate', `${toolUseId}.json`);
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+function makePayload(command, options = {}) {
+  return {
+    session_id: options.sessionId || 'issue99',
+    hook_event_name: options.event || 'PreToolUse',
+    tool_name: options.tool || 'Bash',
+    tool_use_id: options.toolUseId || 'issue99-tool',
+    tool_input: { command },
+    cwd: options.cwd || ROOT,
+  };
+}
+
+function runTimerExitCase(scriptPath, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [scriptPath], {
+      cwd,
+      env: {
+        ...process.env,
+        HARNESS_ACTION_GATE_HOST: 'codex',
+        HARNESS_ACTION_GATE_STDIN_TIMEOUT_MS: '50',
+      },
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', chunk => { stdout += chunk.toString(); });
+    child.stderr.on('data', chunk => { stderr += chunk.toString(); });
+    child.on('error', reject);
+    child.on('close', code => resolve({ code, stdout, stderr }));
+
+    child.stdin.write(JSON.stringify(makePayload('git push --force origin main', {
+      toolUseId: 'timer-block',
+      cwd,
+    })));
+    setTimeout(() => child.stdin.end(), 140);
+  });
+}
+
+async function main() {
+  console.log('=== Issue #99 — runtime correctness ===');
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-issue99-'));
+  const sessionDir = path.join(tempRoot, 'session');
+  fs.mkdirSync(sessionDir, { recursive: true });
+
+  try {
+    const hooks = JSON.parse(fs.readFileSync(path.join(ROOT, 'hooks', 'hooks.json'), 'utf8'));
+    const commands = collectCommands(hooks);
+    check(commands.length > 0, 'canonical Claude hook manifest contains command hooks');
+    check(commands.every(entry => entry.command.includes('${CLAUDE_PLUGIN_ROOT}/')), 'every canonical Claude plugin hook is anchored to CLAUDE_PLUGIN_ROOT');
+
+    for (const entry of commands) {
+      const script = scriptFromClaudeCommand(entry.command, ROOT);
+      check(Boolean(script) && fs.existsSync(script), `${entry.event} hook resolves from plugin root: ${path.relative(ROOT, script || '')}`);
+      if (!script || !fs.existsSync(script)) continue;
+      const loaded = probeHookModule(entry, script, tempRoot);
+      check(
+        loaded.status === 0 && !/MODULE_NOT_FOUND|Cannot find module/i.test(`${loaded.stdout}\n${loaded.stderr}`),
+        `${entry.event} hook resolves and starts from unrelated cwd`,
+      );
+    }
+
+    const targetWorkspace = path.join(tempRoot, 'installed-project');
+    fs.mkdirSync(targetWorkspace, { recursive: true });
+    const claudeHooks = {
+      mergeHarnessHooks(config, resolved) { config.hooks = resolved; },
+      removeHarnessHooks() {},
+    };
+    const manifest = {
+      PACKAGE_NAME: 'harness-everything',
+      HARNESS_AUTHOR: 'Miya Daniel',
+      getManifestPath(dir) { return path.join(dir, 'harness-manifest.json'); },
+    };
+    claudePlatform.install({
+      isGlobal: false,
+      targetWorkspaceRoot: targetWorkspace,
+      harnessSourceDir: ROOT,
+      packageVersion: 'issue99-test',
+      claudeHooks,
+      manifest,
+    });
+    const installedSettings = JSON.parse(fs.readFileSync(path.join(targetWorkspace, '.claude', 'settings.json'), 'utf8'));
+    const installedCommands = collectCommands(installedSettings);
+    check(installedCommands.length === commands.length, 'Claude installer preserves the full hook command set');
+    for (const entry of installedCommands) {
+      check(!entry.command.includes('${CLAUDE_PLUGIN_ROOT}'), `${entry.event} installer substitutes CLAUDE_PLUGIN_ROOT`);
+      const match = entry.command.match(/^node\s+"([^"]+)"/);
+      check(Boolean(match) && path.isAbsolute(match[1]) && fs.existsSync(match[1]), `${entry.event} installer writes an existing absolute hook path`);
+    }
+
+    const table = actionGate.loadRuleTable(rulesPath);
+    const outside = process.platform === 'win32' ? 'C:\\harness-issue99-critical' : '/opt/harness-issue99-critical';
+    const safeOne = path.join(os.tmpdir(), 'harness-issue99-safe-a');
+    const safeTwo = path.join(os.tmpdir(), 'harness-issue99-safe-b');
+
+    const chainedBash = makePayload(`rm -rf "${safeOne}" && rm -rf "${outside}"`, { toolUseId: 'bash-chain' });
+    const chainedBashDecision = actionGate.evaluatePreToolUse(chainedBash, { host: 'claude', sessionDir, ruleTable: table });
+    check(chainedBashDecision.kind === 'defer' && chainedBashDecision.rule.id === 'recursive-delete', 'chained rm checks every target and gates the outside-scratch delete');
+
+    const safeBashDecision = actionGate.evaluatePreToolUse(
+      makePayload(`rm -rf "${safeOne}" && rm -rf "${safeTwo}"`, { toolUseId: 'bash-safe-chain' }),
+      { host: 'claude', sessionDir, ruleTable: table },
+    );
+    check(safeBashDecision.kind === 'allow', 'chained rm remains exempt when every target is scratch/temp');
+
+    const chainedPs = makePayload(
+      `Remove-Item -Recurse -Force "${safeOne}"; Remove-Item -Recurse -Force "${outside}"`,
+      { tool: 'PowerShell', toolUseId: 'ps-chain' },
+    );
+    const chainedPsDecision = actionGate.evaluatePreToolUse(chainedPs, { host: 'claude', sessionDir, ruleTable: table });
+    check(chainedPsDecision.kind === 'defer' && chainedPsDecision.rule.id === 'powershell-recursive-force-delete', 'chained Remove-Item checks every target and gates the outside-scratch delete');
+
+    const pre = makePayload('npm publish', { toolUseId: 'post-error-preserve' });
+    actionGate.evaluatePreToolUse(pre, { host: 'claude', sessionDir, ruleTable: table });
+    actionGate.processEvent({ ...pre, hook_event_name: 'PostToolUse' }, { sessionDir });
+    const beforeError = readAudit(sessionDir, 'post-error-preserve');
+    check(beforeError.disposition === 'executed', 'setup: approved payload reaches executed before audit-error probe');
+
+    const postError = actionGate.internalErrorDecision(
+      { ...pre, hook_event_name: 'PostToolUse' },
+      new Error('synthetic post-tool audit failure'),
+      { host: 'claude', sessionDir },
+    );
+    check(postError.kind === 'audit-error' && postError.exitCode === 0 && postError.stdout === null, 'PostToolUse internal error never emits a PreToolUse ask decision');
+    check(readAudit(sessionDir, 'post-error-preserve').disposition === 'executed', 'PostToolUse internal error does not overwrite an executed audit record');
+
+    const stopError = actionGate.internalErrorDecision(
+      { ...pre, hook_event_name: 'Stop' },
+      new Error('synthetic stop audit failure'),
+      { host: 'claude', sessionDir },
+    );
+    check(stopError.kind === 'audit-error' && stopError.stdout === null, 'Stop internal error remains an audit error, not an authorization prompt');
+
+    check(fs.readFileSync(actionGatePath, 'utf8') === fs.readFileSync(pluginActionGatePath, 'utf8'), 'canonical and Codex/OpenAI plugin action-gate runtimes are byte-identical');
+
+    const timerResult = await runTimerExitCase(actionGatePath, tempRoot);
+    check(timerResult.code === 2, 'stdin timeout path preserves Codex exit-2 fail-closed decision');
+    check(/git-force-push/.test(timerResult.stderr), 'stdin timeout block still reports the matched destructive rule');
+  } catch (err) {
+    console.error(err.stack || err.message);
+    failed++;
+  } finally {
+    try { fs.rmSync(tempRoot, { recursive: true, force: true }); } catch (_) {}
+  }
+
+  console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: issue #99 runtime correctness (${failed} failure${failed === 1 ? '' : 's'})`);
+  process.exit(failed === 0 ? 0 : 1);
+}
+
+main().catch(err => {
+  console.error(err.stack || err.message);
+  process.exit(1);
+});

package/ci/mechanism-2aa-codex-action-gate-policy.test.js

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const actionGate = require(path.join(ROOT, 'hooks', 'scripts', 'action-gate.js'));
+const permissionRequest = require(path.join(ROOT, 'hooks', 'scripts', 'codex-permission-request.js'));
+
+const pluginRoot = path.join(ROOT, 'plugins', 'harness-everything');
+const pluginHooksPath = path.join(pluginRoot, 'hooks', 'hooks.json');
+const canonicalPost = path.join(ROOT, 'hooks', 'scripts', 'codex-action-gate-post.js');
+const packagedPost = path.join(pluginRoot, 'hooks', 'scripts', 'codex-action-gate-post.js');
+const canonicalPermission = path.join(ROOT, 'hooks', 'scripts', 'codex-permission-request.js');
+const packagedPermission = path.join(pluginRoot, 'hooks', 'scripts', 'codex-permission-request.js');
+
+function payload(command, options = {}) {
+  return {
+    session_id: options.sessionId || 'codex-action-gate-policy-test',
+    hook_event_name: options.event || 'PreToolUse',
+    turn_id: options.turnId || 'turn_policy_test',
+    tool_name: options.tool || 'Bash',
+    tool_use_id: options.toolUseId || 'toolu_policy_test',
+    tool_input: options.tool === 'apply_patch' ? { patch: command } : { command },
+    permission_mode: options.permissionMode || 'default',
+    cwd: ROOT,
+  };
+}
+
+function commandPaths(hooks) {
+  const paths = [];
+  for (const groups of Object.values(hooks || {})) {
+    for (const group of groups || []) {
+      for (const hook of group.hooks || []) {
+        for (const field of ['command', 'commandWindows']) {
+          const command = hook[field];
+          if (typeof command !== 'string') continue;
+          const match = command.match(/(?:\$PLUGIN_ROOT|%PLUGIN_ROOT%)[\\/]([^"']+)/);
+          if (match) paths.push(match[1].replace(/\\/g, '/'));
+        }
+      }
+    }
+  }
+  return paths;
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-codex-policy-'));
+const sessionDir = path.join(tempRoot, 'session');
+fs.mkdirSync(sessionDir, { recursive: true });
+
+try {
+  assert.ok(fs.existsSync(canonicalPost), 'Codex PostToolUse adapter must live in canonical hooks/scripts so plugin:sync cannot delete it');
+  assert.ok(fs.existsSync(packagedPost), 'Codex PostToolUse adapter must be packaged');
+  assert.strictEqual(fs.readFileSync(canonicalPost, 'utf8'), fs.readFileSync(packagedPost, 'utf8'), 'canonical and packaged Codex PostToolUse adapters must be byte-equivalent');
+
+  assert.ok(fs.existsSync(canonicalPermission), 'Codex PermissionRequest adapter must live in canonical hooks/scripts');
+  assert.ok(fs.existsSync(packagedPermission), 'Codex PermissionRequest adapter must be packaged');
+  assert.strictEqual(fs.readFileSync(canonicalPermission, 'utf8'), fs.readFileSync(packagedPermission, 'utf8'), 'canonical and packaged PermissionRequest adapters must be byte-equivalent');
+
+  const hookConfig = JSON.parse(fs.readFileSync(pluginHooksPath, 'utf8'));
+  assert.ok(Array.isArray(hookConfig.hooks.PermissionRequest), 'Codex plugin must declare PermissionRequest');
+  assert.ok(!Object.prototype.hasOwnProperty.call(hookConfig.hooks, 'PostToolUseFailure'), 'Codex plugin must not invent PostToolUseFailure');
+  const permissionCommands = hookConfig.hooks.PermissionRequest.flatMap(group => (group.hooks || []).map(hook => hook.command || ''));
+  assert.ok(permissionCommands.some(command => command.includes('codex-permission-request.js')), 'PermissionRequest must invoke the native approval observer');
+
+  for (const relativePath of new Set(commandPaths(hookConfig.hooks))) {
+    assert.ok(fs.existsSync(path.join(pluginRoot, relativePath)), `hook command target must exist in plugin package: ${relativePath}`);
+  }
+
+  const table = actionGate.loadRuleTable(path.join(ROOT, 'hooks', 'scripts', 'action-gate-rules.json'));
+  const destructive = payload('git push --force origin main', { toolUseId: 'codex-hard-block' });
+  const pre = actionGate.evaluatePreToolUse(destructive, { host: 'codex', sessionDir, ruleTable: table });
+  assert.strictEqual(pre.kind, 'block', 'Codex destructive PreToolUse must remain fail-closed');
+  assert.strictEqual(pre.exitCode, 2, 'Codex destructive PreToolUse must use the supported exit-2 block fallback');
+  assert.strictEqual(pre.stdout, null, 'Codex PreToolUse must never emit permissionDecision=ask');
+  assert.ok(pre.stderr.includes('git-force-push'), 'Codex block reason must identify the matched rule');
+
+  const approvalPayload = payload('git push --force origin main', {
+    event: 'PermissionRequest',
+    toolUseId: undefined,
+    turnId: 'turn_native_approval',
+  });
+  delete approvalPayload.tool_use_id;
+  const approval = permissionRequest.processPayload(approvalPayload, { sessionDir, ruleTable: table });
+  assert.strictEqual(approval.kind, 'defer', 'PermissionRequest must defer to Codex native approval');
+  assert.strictEqual(approval.exitCode, 0, 'PermissionRequest observer must not block an approval already surfaced by Codex');
+  assert.strictEqual(approval.stdout, null, 'PermissionRequest observer must emit no allow/deny decision');
+  assert.strictEqual(approval.record.disposition, 'deferred-to-codex-approval');
+  assert.strictEqual(approval.record.matchedRule, 'git-force-push');
+  assert.strictEqual(approval.record.exactToolCallCorrelation, false, 'PermissionRequest audit must not claim unavailable tool_use_id correlation');
+  assert.strictEqual(approval.record.correlation, 'turn-id-and-payload-hash-only');
+  assert.ok(fs.existsSync(approval.auditFile), 'PermissionRequest audit evidence must be persisted');
+
+  const stored = JSON.parse(fs.readFileSync(approval.auditFile, 'utf8'));
+  assert.strictEqual(stored.payloadHash, permissionRequest.hashExact('git push --force origin main'), 'PermissionRequest audit must hash the exact tool payload');
+  assert.ok(!Object.prototype.hasOwnProperty.call(stored, 'command'), 'PermissionRequest audit must not persist raw command text');
+  assert.ok(!Object.prototype.hasOwnProperty.call(stored, 'toolInput'), 'PermissionRequest audit must not persist raw tool input');
+
+  const safeApproval = permissionRequest.processPayload(payload('git status', {
+    event: 'PermissionRequest',
+    turnId: 'turn_safe_native_approval',
+  }), { sessionDir, ruleTable: table });
+  assert.strictEqual(safeApproval.kind, 'defer');
+  assert.strictEqual(safeApproval.record.matchedRule, null, 'native approval audit may exist even when Harness classifier has no destructive match');
+
+  const error = permissionRequest.internalErrorResult(new Error('synthetic failure'));
+  assert.strictEqual(error.exitCode, 0, 'PermissionRequest audit failure must not override an approval Codex already surfaced');
+  assert.strictEqual(error.stdout, null, 'PermissionRequest audit failure must not emit allow/deny/ask');
+  assert.ok(/Native Codex approval flow remains authoritative/.test(error.stderr));
+
+  console.log('PASS: Codex action-gate uses supported hard blocking plus non-authorizing native PermissionRequest observation.');
+} finally {
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+}

package/ci/mechanism-2ab-openai-plugin-sync-integrity.test.js

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const crypto = require('crypto');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+
+function treeDigest(root) {
+  const hash = crypto.createHash('sha256');
+  function visit(dir, relative = '') {
+    const entries = fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const rel = relative ? `${relative}/${entry.name}` : entry.name;
+      const full = path.join(dir, entry.name);
+      hash.update(`${entry.isDirectory() ? 'D' : 'F'}:${rel}\0`);
+      if (entry.isDirectory()) visit(full, rel);
+      else if (entry.isFile()) hash.update(fs.readFileSync(full));
+    }
+  }
+  visit(root);
+  return hash.digest('hex');
+}
+
+const tempBase = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-plugin-sync-'));
+const copyRoot = path.join(tempBase, 'repo');
+
+try {
+  fs.cpSync(ROOT, copyRoot, {
+    recursive: true,
+    filter(source) {
+      const rel = path.relative(ROOT, source).replace(/\\/g, '/');
+      if (!rel) return true;
+      return !(
+        rel === '.git' || rel.startsWith('.git/') ||
+        rel === 'node_modules' || rel.startsWith('node_modules/') ||
+        rel === '.harness' || rel.startsWith('.harness/')
+      );
+    },
+  });
+
+  const pluginRoot = path.join(copyRoot, 'plugins', 'harness-everything');
+  const before = treeDigest(pluginRoot);
+  const run = spawnSync(process.execPath, [path.join(copyRoot, 'scripts', 'sync-openai-plugin.js')], {
+    cwd: copyRoot,
+    encoding: 'utf8',
+  });
+  assert.strictEqual(run.status, 0, `plugin:sync equivalent failed:\n${run.stdout}\n${run.stderr}`);
+  const after = treeDigest(pluginRoot);
+  assert.strictEqual(after, before, 'sync-openai-plugin.js must be idempotent against the committed plugin package');
+
+  const hooks = JSON.parse(fs.readFileSync(path.join(pluginRoot, 'hooks', 'hooks.json'), 'utf8'));
+  const referenced = new Set();
+  for (const groups of Object.values(hooks.hooks || {})) {
+    for (const group of groups || []) {
+      for (const hook of group.hooks || []) {
+        for (const field of ['command', 'commandWindows']) {
+          const command = hook[field];
+          if (typeof command !== 'string') continue;
+          const match = command.match(/(?:\$PLUGIN_ROOT|%PLUGIN_ROOT%)[\\/]([^"']+)/);
+          if (match) referenced.add(match[1].replace(/\\/g, '/'));
+        }
+      }
+    }
+  }
+  for (const relative of referenced) {
+    assert.ok(fs.existsSync(path.join(pluginRoot, relative)), `sync must preserve every hook target: ${relative}`);
+  }
+
+  assert.ok(fs.existsSync(path.join(pluginRoot, 'hooks', 'scripts', 'codex-action-gate-post.js')), 'sync must preserve the Codex PostToolUse adapter');
+  assert.ok(fs.existsSync(path.join(pluginRoot, 'hooks', 'scripts', 'codex-permission-request.js')), 'sync must preserve the Codex PermissionRequest adapter');
+
+  console.log('PASS: OpenAI/Codex plugin sync is idempotent and preserves every referenced hook runtime file.');
+} finally {
+  fs.rmSync(tempBase, { recursive: true, force: true });
+}

package/ci/mechanism-2j-behavioral-runner.test.js

@@ -1,5 +1,8 @@
 const helper = require('./test-helper');
-const { buildEngineInvocation } = require('../behavioral-evals/run');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { buildEngineInvocation, buildWorkspace } = require('../behavioral-evals/run');
 
 console.log('\n[2j] Behavioral runner argv integrity...');
 const prompt = "Add punctuation stripping to slug.js, then run npm test. Do not truncate this request.";
@@ -16,5 +19,44 @@ const baseline = buildEngineInvocation('claude', prompt, 'C:/fixture with spaces
 helper.check('2j. Claude baseline excludes user customizations', baseline.args.includes('--safe-mode') && baseline.args.includes('--setting-sources') && baseline.args.includes('project,local'), JSON.stringify(baseline.args));
 const treatment = buildEngineInvocation('claude', prompt, 'C:/fixture with spaces', 16, 'treatment');
 helper.check('2j. Claude treatment keeps only project/local customizations', treatment.args.includes('--setting-sources') && treatment.args.includes('project,local') && !treatment.args.includes('--safe-mode'), JSON.stringify(treatment.args));
+helper.check('2j. Claude emits parseable verbose stream JSON', treatment.args.includes('--output-format') && treatment.args.includes('stream-json') && treatment.args.includes('--verbose') && !treatment.args.includes('json'), JSON.stringify(treatment.args));
+
+let validWorkspace = null;
+try {
+  validWorkspace = buildWorkspace({
+    id: 'fixture-valid',
+    fixture: { files: [{ path: 'nested/fixture.txt', content: 'fixture smoke proof' }] },
+  });
+  helper.check(
+    '2j. behavioral workspace builder accepts a valid nested fixture through the public execution contract',
+    fs.readFileSync(path.join(validWorkspace, 'nested', 'fixture.txt'), 'utf8') === 'fixture smoke proof\n',
+    validWorkspace
+  );
+} catch (error) {
+  helper.check(
+    '2j. behavioral workspace builder accepts a valid nested fixture through the public execution contract',
+    false,
+    error && error.stack ? error.stack : String(error)
+  );
+} finally {
+  if (validWorkspace) fs.rmSync(validWorkspace, { recursive: true, force: true });
+}
+
+const traversalTarget = path.join(os.tmpdir(), `harness-behavioral-traversal-${process.pid}-${Date.now()}.txt`);
+let traversalError = null;
+try {
+  buildWorkspace({ id: 'fixture-traversal', fixture: { files: [{ path: `../${path.basename(traversalTarget)}`, content: 'path traversal proof' }] } });
+} catch (error) {
+  traversalError = error;
+}
+helper.check(
+  '2j. behavioral fixtures reject traversal for the expected boundary reason',
+  Boolean(
+    traversalError &&
+    /path must stay inside the generated workspace/.test(traversalError.message) &&
+    !fs.existsSync(traversalTarget)
+  ),
+  traversalError && traversalError.stack ? traversalError.stack : traversalTarget
+);
 
 helper.finish();

package/ci/mechanism-2k-reference-check.test.js

@@ -7,14 +7,69 @@ console.log('\n[2k] Skill reference checker negative control...');
 const root = helper.tempDir('.mechanism-test-reference-check');
 const skill = path.join(root, 'fixture-skill');
 fs.mkdirSync(skill, { recursive: true });
-fs.writeFileSync(path.join(skill, 'SKILL.md'), 'Run `scripts/missing.js` before editing.\n');
+fs.writeFileSync(path.join(skill, 'SKILL.md'), 'Run `<this-skill-dir>/scripts/missing.js` before editing.\n');
 let result = checkSkillReferences(root, ['fixture-skill']);
-helper.check('2k. dangling executable reference fails', result.failures.length === 1 && result.failures[0].reference === 'scripts/missing.js', JSON.stringify(result.failures));
+helper.check('2k. dangling executable reference fails', result.failures.length === 1 && result.failures[0].reference === '<this-skill-dir>/scripts/missing.js', JSON.stringify(result.failures));
 
 fs.mkdirSync(path.join(skill, 'scripts'), { recursive: true });
 fs.writeFileSync(path.join(skill, 'scripts', 'missing.js'), '');
 result = checkSkillReferences(root, ['fixture-skill']);
 helper.check('2k. existing executable reference passes', result.failures.length === 0, JSON.stringify(result.failures));
 
+// Regression: skill-local paths must say which base they use. A bare path
+// used to pass because the checker guessed the current skill directory.
+fs.mkdirSync(path.join(skill, 'references'), { recursive: true });
+fs.writeFileSync(path.join(skill, 'references', 'guide.md'), '');
+fs.writeFileSync(path.join(skill, 'SKILL.md'), 'Deep dive: `references/guide.md`\n');
+result = checkSkillReferences(root, ['fixture-skill']);
+helper.check(
+  '2k. bare skill-local paths fail the explicit marker rule',
+  result.failures.length === 1 && result.failures[0].reference === 'references/guide.md' && result.failures[0].target.includes('bare path'),
+  JSON.stringify(result.failures)
+);
+fs.writeFileSync(path.join(skill, 'SKILL.md'), 'Deep dive: `<this-skill-dir>/references/guide.md`\n');
+result = checkSkillReferences(root, ['fixture-skill']);
+helper.check('2k. explicit skill-local paths pass', result.failures.length === 0, JSON.stringify(result.failures));
+
+// --- placeholder heads are authoritative and unknown ones fail ------------
+// Regression: `<this-skill-dir>/hooks/x.js` used to jump to the repo root
+// because a hardcoded ROOT_PREFIXES list outranked the explicit placeholder.
+fs.mkdirSync(path.join(root, 'hooks'), { recursive: true });
+fs.writeFileSync(path.join(root, 'hooks', 'shared.js'), '');
+fs.writeFileSync(path.join(skill, 'SKILL.md'), 'Run `<this-skill-dir>/hooks/shared.js` first.\n');
+result = checkSkillReferences(root, ['fixture-skill']);
+helper.check(
+  '2k. <this-skill-dir>/ is authoritative and never falls back to the repo root',
+  result.failures.length === 1 && result.failures[0].target.split(path.sep).join('/') === 'fixture-skill/hooks/shared.js',
+  JSON.stringify(result.failures)
+);
+
+fs.mkdirSync(path.join(skill, 'hooks'), { recursive: true });
+fs.writeFileSync(path.join(skill, 'hooks', 'shared.js'), '');
+result = checkSkillReferences(root, ['fixture-skill']);
+helper.check('2k. <this-skill-dir>/ resolves under the skill itself', result.failures.length === 0, JSON.stringify(result.failures));
+
+// `../` reaches a sibling of the skill directory.
+fs.writeFileSync(path.join(root, 'shared-note.md'), '');
+fs.writeFileSync(path.join(skill, 'SKILL.md'), 'Deep dive: `<this-skill-dir>/../shared-note.md`\n');
+result = checkSkillReferences(root, ['fixture-skill']);
+helper.check('2k. <this-skill-dir>/../ reaches a sibling', result.failures.length === 0, JSON.stringify(result.failures));
+
+// Regression: a typo'd placeholder used to be skipped silently, which made
+// every path in the file invisible to this gate instead of failing it.
+fs.writeFileSync(path.join(skill, 'SKILL.md'), 'Deep dive: `<this_folder>/../shared-note.md`\n');
+result = checkSkillReferences(root, ['fixture-skill']);
+helper.check(
+  '2k. unknown placeholder fails instead of being skipped',
+  result.failures.length === 1 && result.failures[0].target.indexOf('unknown placeholder <this_folder>') === 0,
+  JSON.stringify(result.failures)
+);
+
+// `<workspace>/` names a path in the USER's project, so it is deliberately
+// recorded as unchecked rather than resolved against this repo.
+fs.writeFileSync(path.join(skill, 'SKILL.md'), 'Writes `<workspace>/tasks/todo.md` as it goes.\n');
+result = checkSkillReferences(root, ['fixture-skill']);
+helper.check('2k. <workspace>/ paths are skipped, not resolved locally', result.failures.length === 0, JSON.stringify(result.failures));
+
 fs.rmSync(root, { recursive: true, force: true });
 helper.finish();