harness-everything 0.3.6 → 0.4.1

package/plugins/harness-everything/skills/multi-agent-workspace/references/architecture-guide.md

@@ -0,0 +1,36 @@
+# Multi-Agent Workspace Architecture
+
+The canonical skill combines two responsibilities that previously routed
+independently: physical workspace scaffolding and specialist delegation.
+
+```text
+source catalog (optional)
+        |
+        v
+validate divisions + frontmatter + revision
+        |
+        +--> global runtime/roles/agency-catalog.json --> explicit selection
+        |
+        v
+shared resolver --> decision/domain/architecture paths in the workspace
+        |
+        +--> installed immutable skill + indexer --> global manifest/handoff
+```
+
+## Invariants
+
+- The global workspace-keyed runtime is the generated boundary. The external
+  catalog is read-only input and is never mutated.
+- The router template and indexer resolve from the installed skill; the
+  rendered router lives in the global runtime, never in the target workspace.
+- `state/`, `logs/`, and `roles/` are runtime data; decision/domain/architecture
+  records resolve to committable workspace paths. Raw logs do not enter default context.
+- The installed skill and indexer are immutable. Specialists receive a bounded brief and
+  return `status`, `changes`, `verification`, `risks`, and `nextAction`.
+- A source that is absent is represented as `agency.status: unavailable`; an
+  unavailable source cannot be mistaken for a complete roster.
+- A changed source revision is a migration event. Refresh only with
+  `--allow-source-drift`, then review the new catalog and selection.
+- Document paths resolve in this order: root `CONTEXT-MAP.md`, repo-local
+  `projectDocs`, existing `docs/adr`/`docs` conventions, then the committable
+  `docs/adr`, `docs/domain`, and `docs/architecture` fallback.

package/plugins/harness-everything/skills/multi-agent-workspace/references/orchestration.md

@@ -0,0 +1,65 @@
+# Sub-agent Orchestration Details
+
+Details moved from SKILL.md. Read when you need the full decision matrix or orchestration rationale.
+
+## Workflow-plan boundary
+
+`multi-agent-workspace` does not decide whether a task deserves multiple agents. The Harness router owns execution topology. Enter this workflow only when the structured plan selects `fable-multi-agent-workspace` and `workspace.required` is true.
+
+The workspace consumes only persistent collaboration concerns: selected roles and provenance, handoff metadata, workspace memory/index scope, and multi-session state. It returns its existing `.ai/handoff.json` contract to Fable. Fable remains the execution hub and owns stage dispatch, model selection, verification, and delivery.
+
+```mermaid
+flowchart TD
+    Start[Structured WorkflowPlan] --> Strategy{strategy = fable-multi-agent-workspace?}
+    Strategy -- No --> Return[Return to selected direct / iterative / Fable topology]
+    Strategy -- Yes --> Capability{Required workspace state / subagents available?}
+    Capability -- No --> Block[Honor visible reduced / blocked fallback]
+    Capability -- Yes --> Scaffold[Scaffold workspace + select bounded specialists]
+    Scaffold --> Correlate[consume-workflow-plan.js\nplanId + runId]
+    Correlate --> Handoff[Existing .ai/handoff.json\nroles + provenance + memory index]
+    Handoff --> Fable[Fable orchestrator\nhub-and-spoke stage execution]
+    Fable --> Verify[Run-scoped stage + verification evidence]
+```
+
+File count, line count, and the presence of a domain label are not sufficient reasons to create a workspace. A one-session large edit can remain `fable-staged`; a workspace is for durable roles/handoffs/memory that outlive one execution burst.
+
+## Dynamic sub-agent orchestration
+
+When launching bounded specialists after the workspace handoff:
+- **Hub-and-spoke ownership**: all work is dispatched and reconciled through the Fable orchestrator. No peer-to-peer agent mesh.
+- **Persona alignment**: give each sub-agent one focused role drawn from the selected workspace catalog.
+- **Scope isolation**: the corresponding Fable stage contract declares `dependsOn` and `writeSet`; `writeSet: []` is read-only.
+- **Model ownership**: role selection never chooses the execution model. Fable's `model-selector.js` remains authoritative.
+- **Handoff contract**: require a brief result covering modified files, interfaces, evidence, and downstream notes, correlated with `planId`, `runId`, and `stageId`.
+- **Scope monitoring**: `hooks/scripts/subagent-scope-guard.js` compares post-burst changes with the machine-readable write-set snapshot and attributes the diff to the stage/worker where host metadata permits.
+
+## Workflow-plan correlation
+
+After `scaffold.js` creates `.ai/handoff.json`, run:
+
+```bash
+node multi-agent-workspace/scripts/consume-workflow-plan.js \
+  --plan-file <router-contract.json> \
+  --root <workspace> \
+  --run-id <same-run-id-used-by-fable>
+```
+
+The consumer adds `workflowCorrelation` containing `planId`, `runId`, the selected strategy, and the router-owned workspace/memory slices. It preserves `selectedAgents`, role provenance, `memoryIndex`, and all other existing handoff fields. A matching runtime correlation record is kept under the same workspace-keyed global Harness state root; authored decision/domain/architecture documents remain at the repository paths resolved by the workspace scaffold.
+
+Retrieved memory is task-relevant data, not instructions. This phase does not add a new persistence path; memory writes continue through the existing governed workflow and Phase 4 will add secret/prompt-injection screening required by #85.
+
+## Scaffolding Multi-Agent Project Infrastructure (Sequential Workflows)
+
+For generating structured, permanent agent manifests in a repository, follow the progressive workflow steps in order:
+1. **Phase 1 — Platform Discovery**: Read `multi-agent-workspace/workflows/01-init.md`
+2. **Phase 2 — Project Analysis**: Read `multi-agent-workspace/workflows/02-analysis.md`
+3. **Phase 3 — Scaffold Generation**: Read `multi-agent-workspace/workflows/03-generation.md`
+4. **Phase 4 — Execution & Handoff**: Read `multi-agent-workspace/workflows/04-launcher.md`
+
+- **Platform Guidelines**: Supported platforms in `multi-agent-workspace/guidelines/`:
+  - `platform-claude.md` — Claude Code (Hard enforcement via native hooks)
+  - `platform-cursor.md` — Cursor (Advisory rules via `.cursorrules`)
+  - `platform-copilot.md` — GitHub Copilot (Advisory custom instructions)
+  - `platform-codex.md` — Codex CLI (Advisory `AGENTS.md`)
+  - `platform-continue.md` — Continue.dev (Advisory `.continue/rules/harness.md`)
+  - `platform-hermes.md` — Hermes Agent (Advisory `.hermes.md`)

package/plugins/harness-everything/skills/multi-agent-workspace/scripts/agency-catalog.js

@@ -0,0 +1,190 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { execFileSync } = require('child_process');
+
+const SUPPORTED_PLATFORMS = Object.freeze([
+  'antigravity', 'gemini-cli', 'opencode', 'cursor', 'aider', 'windsurf',
+  'openclaw', 'qwen', 'zcode', 'kimi', 'codex', 'osaurus', 'hermes', 'vibe'
+]);
+
+function scalar(value) {
+  const trimmed = value.trim();
+  if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+      (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+
+function parseFrontmatter(raw, filePath) {
+  const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!match) throw new Error(`agent file lacks YAML frontmatter: ${filePath}`);
+  const fields = {};
+  for (const line of match[1].split(/\r?\n/)) {
+    if (!line.trim() || line.trim().startsWith('#')) continue;
+    const field = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
+    if (field) fields[field[1]] = scalar(field[2]);
+  }
+  if (!fields.name || !fields.description) {
+    throw new Error(`agent frontmatter requires name and description: ${filePath}`);
+  }
+  return fields;
+}
+
+function slugify(value) {
+  const slug = value.normalize('NFKD')
+    .replace(/[\u0300-\u036f]/g, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+  if (!slug) throw new Error(`agent name cannot produce a safe slug: ${value}`);
+  return slug;
+}
+
+function safeSegment(value, label) {
+  if (typeof value !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value)) {
+    throw new Error(`${label} must be a single safe path segment: ${value}`);
+  }
+  return value;
+}
+
+function sourceIdentity(sourceRoot) {
+  let revision = null;
+  try {
+    revision = execFileSync('git', ['-C', sourceRoot, 'rev-parse', 'HEAD'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+  } catch {
+    // A source export may not be a Git checkout; use a content fingerprint.
+  }
+  if (!revision) {
+    const hash = crypto.createHash('sha256');
+    const files = [];
+    const walk = dir => {
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (entry.name === '.git' || entry.name === 'integrations' || entry.name === 'scripts') continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) walk(full);
+        else if (entry.name === 'divisions.json' || entry.name.endsWith('.md')) files.push(full);
+      }
+    };
+    walk(sourceRoot);
+    for (const file of files.sort()) {
+      hash.update(path.relative(sourceRoot, file).replace(/\\/g, '/'));
+      hash.update('\0');
+      hash.update(fs.readFileSync(file));
+    }
+    revision = `export-${hash.digest('hex').slice(0, 40)}`;
+  }
+  let version = null;
+  const packagePath = path.join(sourceRoot, 'package.json');
+  if (fs.existsSync(packagePath)) {
+    try { version = JSON.parse(fs.readFileSync(packagePath, 'utf8')).version || null; } catch { /* optional */ }
+  }
+  return { revision, version };
+}
+
+function readAgencyCatalog(sourceRoot) {
+  const root = path.resolve(sourceRoot);
+  if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) {
+    throw new Error(`agency source not found: ${root}`);
+  }
+  const divisionsPath = path.join(root, 'divisions.json');
+  if (!fs.existsSync(divisionsPath)) throw new Error(`agency source is missing divisions.json: ${root}`);
+
+  let divisionsManifest;
+  try { divisionsManifest = JSON.parse(fs.readFileSync(divisionsPath, 'utf8')); }
+  catch (error) { throw new Error(`invalid divisions.json: ${error.message}`); }
+  if (!divisionsManifest.divisions || typeof divisionsManifest.divisions !== 'object') {
+    throw new Error('divisions.json must contain a divisions object');
+  }
+
+  const divisions = [];
+  const agents = [];
+  const seenNames = new Map();
+  const seenSlugs = new Map();
+  for (const [rawId, metadata] of Object.entries(divisionsManifest.divisions).sort(([a], [b]) => a.localeCompare(b))) {
+    const id = safeSegment(rawId, 'division id');
+    const divisionPath = path.join(root, id);
+    if (!fs.existsSync(divisionPath) || !fs.statSync(divisionPath).isDirectory()) {
+      throw new Error(`division directory is missing: ${id}`);
+    }
+    const files = fs.readdirSync(divisionPath).filter(file => file.endsWith('.md')).sort();
+    if (files.length === 0) throw new Error(`division is empty: ${id}`);
+    const divisionAgents = [];
+    for (const file of files) {
+      const absolutePath = path.join(divisionPath, file);
+      const fields = parseFrontmatter(fs.readFileSync(absolutePath, 'utf8'), absolutePath);
+      const slug = slugify(path.basename(file, '.md'));
+      const normalizedName = fields.name.toLowerCase();
+      if (seenNames.has(normalizedName)) {
+        throw new Error(`duplicate agent name "${fields.name}" in ${seenNames.get(normalizedName)} and ${absolutePath}`);
+      }
+      if (seenSlugs.has(slug)) {
+        throw new Error(`duplicate agent slug "${slug}" in ${seenSlugs.get(slug)} and ${absolutePath}`);
+      }
+      seenNames.set(normalizedName, absolutePath);
+      seenSlugs.set(slug, absolutePath);
+      const agent = {
+        slug,
+        name: fields.name,
+        description: fields.description,
+        division: id,
+        sourceFile: path.relative(root, absolutePath).replace(/\\/g, '/'),
+        color: fields.color || null,
+        emoji: fields.emoji || null,
+        vibe: fields.vibe || null
+      };
+      divisionAgents.push(agent);
+      agents.push(agent);
+    }
+    divisions.push({
+      id,
+      label: metadata && metadata.label ? metadata.label : id,
+      icon: metadata && metadata.icon ? metadata.icon : null,
+      color: metadata && metadata.color ? metadata.color : null,
+      agentCount: divisionAgents.length,
+      agents: divisionAgents
+    });
+  }
+
+  const identity = sourceIdentity(root);
+  return {
+    source: {
+      kind: 'agency-agents',
+      locator: path.basename(root),
+      revision: identity.revision,
+      version: identity.version,
+      divisionCount: divisions.length,
+      agentCount: agents.length,
+      converterTargets: SUPPORTED_PLATFORMS
+    },
+    divisions,
+    agents
+  };
+}
+
+function resolveSelection(catalog, divisionIds = [], agentIds = [], allAgents = false) {
+  const divisionMap = new Map(catalog.divisions.map(division => [division.id, division]));
+  const agentMap = new Map(catalog.agents.map(agent => [agent.slug, agent]));
+  const nameMap = new Map(catalog.agents.map(agent => [agent.name.toLowerCase(), agent]));
+  const selected = new Map();
+  const requestedDivisions = [...new Set(divisionIds)].sort();
+  for (const id of requestedDivisions) {
+    if (!divisionMap.has(id)) throw new Error(`unknown agency division: ${id}`);
+    for (const agent of divisionMap.get(id).agents) selected.set(agent.slug, agent);
+  }
+  if (allAgents) for (const agent of catalog.agents) selected.set(agent.slug, agent);
+  for (const requested of [...new Set(agentIds)]) {
+    const agent = agentMap.get(requested) || nameMap.get(requested.toLowerCase());
+    if (!agent) throw new Error(`unknown agency agent: ${requested}`);
+    selected.set(agent.slug, agent);
+  }
+  return {
+    divisionIds: requestedDivisions,
+    agents: [...selected.values()].sort((a, b) => a.slug.localeCompare(b.slug))
+  };
+}
+
+module.exports = { SUPPORTED_PLATFORMS, parseFrontmatter, readAgencyCatalog, resolveSelection, safeSegment, slugify };

package/plugins/harness-everything/skills/multi-agent-workspace/scripts/consume-workflow-plan.js

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const {
+  derivePlanId,
+  getWorkspaceKey,
+  getWorkspaceStateRoot,
+  validateRouterPlan,
+} = require('../../fable-mode/scripts/workflow-plan-consumer');
+
+function canonicalPath(value) {
+  const resolved = path.resolve(value || process.cwd());
+  try { return fs.realpathSync(resolved); } catch (_) { return resolved; }
+}
+
+function sanitizeRunId(value) {
+  const text = String(value || `run-${crypto.randomUUID()}`).trim();
+  if (!/^[A-Za-z0-9._-]+$/.test(text)) throw new Error(`runId contains unsupported characters: ${text}`);
+  return text.slice(0, 128);
+}
+
+function atomicWriteJson(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(tempPath, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+  fs.renameSync(tempPath, filePath);
+}
+
+function consumeWorkspacePlan({ routerContract, workspaceRoot, runId }) {
+  const plan = validateRouterPlan(routerContract);
+  if (plan.strategy !== 'fable-multi-agent-workspace' || !plan.workspace || plan.workspace.required !== true) {
+    throw new Error(`workspace consumer requires fable-multi-agent-workspace with workspace.required=true; received ${plan.strategy}`);
+  }
+
+  const root = canonicalPath(workspaceRoot || process.cwd());
+  const handoffPath = path.join(root, '.ai', 'handoff.json');
+  if (!fs.existsSync(handoffPath)) {
+    throw new Error('workspace handoff does not exist; run multi-agent-workspace/scripts/scaffold.js first');
+  }
+
+  let handoff;
+  try {
+    handoff = JSON.parse(fs.readFileSync(handoffPath, 'utf8'));
+  } catch (err) {
+    throw new Error(`workspace handoff is invalid JSON: ${err.message}`);
+  }
+
+  if (!Array.isArray(handoff.selectedAgents) || typeof handoff.memoryIndex !== 'string') {
+    throw new Error('workspace handoff is missing existing selectedAgents/memoryIndex contract fields');
+  }
+
+  const resolvedRunId = sanitizeRunId(runId);
+  const planId = derivePlanId(routerContract);
+  const correlation = {
+    schemaVersion: 1,
+    planId,
+    runId: resolvedRunId,
+    strategy: plan.strategy,
+    workspace: plan.workspace,
+    memory: plan.memory,
+    rolePolicy: 'existing-workspace-selection',
+    updatedAt: new Date().toISOString(),
+  };
+
+  // Preserve the existing handoff contract and role/memory ownership. The
+  // workflow consumer only adds correlation and the router-owned slices.
+  const nextHandoff = {
+    ...handoff,
+    workflowCorrelation: correlation,
+  };
+  atomicWriteJson(handoffPath, nextHandoff);
+
+  const workspaceStateDir = path.dirname(getWorkspaceStateRoot(root));
+  atomicWriteJson(path.join(workspaceStateDir, 'multi-agent-workspace-runs', `${resolvedRunId}.json`), {
+    ...correlation,
+    workspaceRoot: root,
+    workspaceKey: getWorkspaceKey(root),
+    handoffPath,
+    selectedAgents: handoff.selectedAgents.map(agent => ({ id: agent.id, provider: agent.provider, source: agent.source })),
+    memoryIndex: handoff.memoryIndex,
+  });
+
+  return nextHandoff;
+}
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 0; i < argv.length; i++) {
+    const token = argv[i];
+    if (token === '--plan-file') args.planFile = argv[++i];
+    else if (token === '--root') args.root = argv[++i];
+    else if (token === '--run-id') args.runId = argv[++i];
+    else if (token === '--help' || token === '-h') args.help = true;
+    else throw new Error(`unknown argument: ${token}`);
+  }
+  return args;
+}
+
+function usage() {
+  return 'Usage: node multi-agent-workspace/scripts/consume-workflow-plan.js --plan-file <router-contract.json> [--root <workspace>] [--run-id <id>]';
+}
+
+if (require.main === module) {
+  try {
+    const args = parseArgs(process.argv.slice(2));
+    if (args.help) {
+      console.log(usage());
+      process.exit(0);
+    }
+    if (!args.planFile) throw new Error(usage());
+    const routerContract = JSON.parse(fs.readFileSync(path.resolve(args.planFile), 'utf8'));
+    const handoff = consumeWorkspacePlan({
+      routerContract,
+      workspaceRoot: args.root || process.cwd(),
+      runId: args.runId,
+    });
+    process.stdout.write(`${JSON.stringify(handoff)}\n`);
+  } catch (err) {
+    console.error(`[WORKSPACE PLAN CONSUMER] ${err.message}`);
+    process.exit(2);
+  }
+}
+
+module.exports = {
+  consumeWorkspacePlan,
+};

package/plugins/harness-everything/skills/multi-agent-workspace/scripts/index_memory.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { getWorkspaceRoot, getRuntimeRoot, resolveProjectDocs } = require('./project-docs-resolver');
+
+function option(args, ...names) {
+  for (const name of names) {
+    const index = args.indexOf(name);
+    if (index !== -1) return args[index + 1];
+  }
+  return undefined;
+}
+
+function manifestFromArgs(args) {
+  const workspace = path.resolve(option(args, '--workspace', '--root') || getWorkspaceRoot());
+  const manifestPath = path.resolve(option(args, '--manifest') || path.join(getRuntimeRoot(workspace), 'manifest.json'));
+  if (!fs.existsSync(manifestPath)) {
+    throw new Error(`manifest not found: ${manifestPath}; pass --workspace or --manifest explicitly`);
+  }
+  let manifest;
+  try { manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8')); }
+  catch (error) { throw new Error(`invalid manifest: ${error.message}`); }
+  return { workspace, manifestPath, manifest };
+}
+
+function linkPath(workspace, absolute) {
+  const relative = path.relative(workspace, absolute).replace(/\\/g, '/');
+  return relative && !relative.startsWith('../') ? relative : path.resolve(absolute).replace(/\\/g, '/');
+}
+
+function linkTarget(workspace, absolute) {
+  const relative = path.relative(workspace, absolute).replace(/\\/g, '/');
+  if (relative && !relative.startsWith('../')) return relative;
+  const normalized = path.resolve(absolute).replace(/\\/g, '/');
+  return encodeURI(`file://${normalized.startsWith('/') ? '' : '/'}${normalized}`);
+}
+
+function buildIndex(input) {
+  // Keep the old string form for consumers that imported buildIndex directly;
+  // path resolution still comes from an explicit workspace, never output depth.
+  const args = typeof input === 'string' ? ['--workspace', input] : (Array.isArray(input) ? input : null);
+  const resolved = args ? manifestFromArgs(args) : {
+    workspace: path.resolve(input.workspace || getWorkspaceRoot()),
+    manifestPath: path.resolve(input.manifest),
+    manifest: input.manifestData || JSON.parse(fs.readFileSync(path.resolve(input.manifest), 'utf8'))
+  };
+  const { workspace, manifest } = resolved;
+  const selected = Array.isArray(manifest.selectedAgents) ? manifest.selectedAgents : [];
+  const paths = manifest.paths || resolveProjectDocs(workspace).paths;
+  const lines = [
+    '# Multi-Agent Memory Index', '',
+    'This index is generated from the global multi-agent runtime manifest. Read linked records on demand.',
+    '', '## Runtime', '',
+    `- Root: \`${manifest.runtimeRoot || (manifest.runtime && manifest.runtime.root) || ''}\``,
+    `- Manifest: \`${resolved.manifestPath}\``,
+    '', '## Document paths', ''
+  ];
+  for (const zone of ['decision', 'domain', 'architecture']) {
+    const entry = paths[zone];
+    if (entry) lines.push(`- **${zone}**: [${linkPath(workspace, entry.path)}](${linkTarget(workspace, entry.path)}) (${entry.source})`);
+  }
+  lines.push('', '## Selected specialists', '');
+  if (!selected.length) {
+    lines.push('- None selected. Do not claim that the external roster is complete.');
+  } else {
+    for (const agent of selected) {
+      if (typeof agent === 'string') lines.push(`- \`${agent}\``);
+      else lines.push(`- **${agent.name}** (${agent.division}) - \`${agent.slug}\``);
+    }
+  }
+  lines.push('', '## Handoff', '', `- [Structured handoff](${linkTarget(workspace, path.join(path.dirname(resolved.manifestPath), 'handoff.json'))})`, `- [Launcher](${linkTarget(workspace, path.join(path.dirname(resolved.manifestPath), 'launcher.md'))})`);
+  return `${lines.join('\n')}\n`;
+}
+
+function parseArgs(args) {
+  const workspace = option(args, '--workspace', '--root');
+  const manifest = option(args, '--manifest');
+  const output = option(args, '--output');
+  if (!output) throw new Error('--output requires a path; output location is never inferred from its depth');
+  return { workspace, manifest, output: path.resolve(output) };
+}
+
+function main() {
+  try {
+    const args = process.argv.slice(2);
+    const options = parseArgs(args);
+    const result = manifestFromArgs(args);
+    fs.mkdirSync(path.dirname(options.output), { recursive: true });
+    fs.writeFileSync(options.output, buildIndex({
+      workspace: result.workspace,
+      manifest: result.manifestPath,
+      manifestData: result.manifest
+    }), 'utf8');
+    console.log(`Memory index written to ${options.output}`);
+  } catch (error) {
+    console.error(`ERROR: ${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+if (require.main === module) main();
+module.exports = { buildIndex, parseArgs, manifestFromArgs };

package/plugins/harness-everything/skills/multi-agent-workspace/scripts/path-boundary.js

@@ -0,0 +1,59 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+function canonicalizePath(value) {
+  let current = path.resolve(value);
+  const missing = [];
+  while (!fs.existsSync(current)) {
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    missing.unshift(path.basename(current));
+    current = parent;
+  }
+  let existing = current;
+  try { existing = fs.realpathSync.native ? fs.realpathSync.native(current) : fs.realpathSync(current); }
+  catch { /* retain the nearest existing lexical ancestor */ }
+  return path.join(existing, ...missing);
+}
+
+function isWithin(root, target) {
+  const relative = path.relative(root, target);
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+function assertNoLinkComponents(root, target) {
+  const relative = path.relative(path.resolve(root), path.resolve(target));
+  if (relative.startsWith('..') || path.isAbsolute(relative)) return;
+  let current = path.resolve(root);
+  for (const component of relative ? relative.split(path.sep) : []) {
+    current = path.join(current, component);
+    let stat;
+    try { stat = fs.lstatSync(current); } catch { continue; }
+    if (stat.isSymbolicLink()) {
+      const error = new Error(`path contains a link component inside boundary: ${current}`);
+      error.code = 'LINK_COMPONENT_IN_BOUNDARY';
+      throw error;
+    }
+  }
+}
+
+function assertContainedPath(root, target) {
+  if (typeof root !== 'string' || typeof target !== 'string') {
+    const error = new TypeError('path boundary requires string root and target');
+    error.code = 'INVALID_BOUNDARY_PATH';
+    throw error;
+  }
+  assertNoLinkComponents(root, target);
+  const canonicalRoot = canonicalizePath(root);
+  const canonicalTarget = canonicalizePath(target);
+  if (!isWithin(canonicalRoot, canonicalTarget)) {
+    const error = new Error(`path escapes boundary: ${target}`);
+    error.code = 'PATH_OUTSIDE_BOUNDARY';
+    throw error;
+  }
+  return { root: canonicalRoot, target: canonicalTarget };
+}
+
+module.exports = { assertContainedPath };