harness-everything 0.3.6 → 0.4.1

package/scripts/lib/workspace.js

@@ -1,14 +1,246 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const crypto = require('crypto');
 
-function getWorkspaceRoot() {
-  let dir = path.resolve(process.cwd());
-  while (dir !== path.parse(dir).root) {
-    if (fs.existsSync(path.join(dir, '.git'))) return dir;
-    dir = path.dirname(dir);
+const WORKSPACE_CONTEXT_KEYS = [
+  'workspace_root', 'workspaceRoot', 'project_root', 'projectRoot',
+  'working_directory', 'workingDirectory', 'cwd', 'root'
+];
+const SESSION_CONTEXT_KEYS = ['session_id', 'sessionId'];
+const HOST_CONTEXT_KEYS = [
+  'host_id', 'hostId', 'agent_id', 'agentId', 'client_id', 'clientId',
+  'machine_id', 'machineId', 'runtime_id', 'runtimeId'
+];
+const SESSION_REGISTRY_DIR = 'session-workspaces';
+const SESSION_REGISTRY_VERSION = 1;
+const UNBOUND_WORKSPACE_KEY = 'unbound-workspace';
+
+function findWorkspaceRoot(startPath, allowNonGit = false) {
+  if (typeof startPath !== 'string' || !startPath.trim()) return null;
+  let dir = path.resolve(startPath);
+  while (true) {
+    if (fs.existsSync(path.join(dir, '.git'))) return canonicalPath(dir);
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return allowNonGit ? canonicalPath(startPath) : null;
+}
+
+function canonicalPath(value) {
+  if (typeof value !== 'string' || !value.trim()) return null;
+  const resolved = path.resolve(value);
+  try { return fs.realpathSync(resolved); } catch (err) { return resolved; }
+}
+
+function getSessionId(context) {
+  if (!context || typeof context !== 'object') return null;
+  for (const key of SESSION_CONTEXT_KEYS) {
+    if (typeof context[key] === 'string' && context[key].trim()) {
+      return context[key].trim();
+    }
+  }
+  for (const key of ['session', 'metadata', 'context']) {
+    if (context[key] && typeof context[key] === 'object') {
+      const nested = getSessionId(context[key]);
+      if (nested) return nested;
+    }
+  }
+  return null;
+}
+
+function getHostId(context) {
+  if (!context || typeof context !== 'object') return null;
+  for (const key of HOST_CONTEXT_KEYS) {
+    if (typeof context[key] === 'string' && context[key].trim()) return context[key].trim();
+  }
+  if (typeof context.host === 'string' && context.host.trim()) return context.host.trim();
+  if (context.host && typeof context.host === 'object') return getHostId(context.host);
+  for (const key of ['agent', 'client', 'machine', 'runtime', 'metadata', 'context']) {
+    if (context[key] && typeof context[key] === 'object') {
+      const nested = getHostId(context[key]);
+      if (nested) return nested;
+    }
+  }
+  return null;
+}
+
+function contextPath(context, depth = 0) {
+  if (typeof context === 'string' && context.trim()) return context.trim();
+  if (!context || typeof context !== 'object' || depth > 2) return null;
+
+  for (const key of WORKSPACE_CONTEXT_KEYS) {
+    const value = context[key];
+    if (typeof value === 'string' && value.trim()) return value.trim();
+    if (value && typeof value === 'object') {
+      const nested = contextPath(value, depth + 1);
+      if (nested) return nested;
+    }
+  }
+
+  for (const key of ['workspace', 'project', 'host', 'context']) {
+    const nested = contextPath(context[key], depth + 1);
+    if (nested) return nested;
+  }
+  return null;
+}
+
+function sessionRegistryPath(sessionId, hostId) {
+  const namespace = hostId ? `${hostId}\0${sessionId}` : String(sessionId);
+  const hash = crypto.createHash('sha256').update(namespace).digest('hex');
+  return path.join(getStateHome(), SESSION_REGISTRY_DIR, `${hash}.json`);
+}
+
+function readRegistryRecord(filePath) {
+  try {
+    const record = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    if (record.version !== SESSION_REGISTRY_VERSION || typeof record.workspaceRoot !== 'string') return null;
+    return record;
+  } catch (err) {
+    return null;
+  }
+}
+
+function findSessionRecords(sessionId) {
+  const registryDir = path.join(getStateHome(), SESSION_REGISTRY_DIR);
+  try {
+    return fs.readdirSync(registryDir, { withFileTypes: true })
+      .filter(entry => entry.isFile() && entry.name.endsWith('.json'))
+      .map(entry => readRegistryRecord(path.join(registryDir, entry.name)))
+      .filter(record => record && record.sessionId === sessionId);
+  } catch (err) {
+    return [];
+  }
+}
+
+function readWorkspaceSession(sessionId, context) {
+  if (!sessionId) return null;
+  const hostId = getHostId(context);
+  const records = [];
+  const preferred = readRegistryRecord(sessionRegistryPath(sessionId, hostId));
+  if (preferred && (!hostId || !preferred.hostId || preferred.hostId === hostId)) records.push(preferred);
+  if (hostId) {
+    // A session may have been first observed by a caller that did not expose
+    // host metadata. Reuse that unscoped binding rather than forking state.
+    const unscoped = readRegistryRecord(sessionRegistryPath(sessionId, null));
+    if (unscoped && !unscoped.hostId) records.push(unscoped);
+  } else {
+    records.push(...findSessionRecords(sessionId));
   }
-  return process.cwd();
+
+  const unique = [...new Map(records.map(record => [
+    `${record.hostId || ''}\0${record.workspaceRoot}`,
+    record
+  ])).values()];
+  if (unique.length === 1) return unique[0];
+  if (unique.length > 1) {
+    // Hostless payloads are safe only when all known host bindings agree on
+    // the same workspace. Otherwise select nothing and require context.
+    const roots = new Set(unique.map(record => canonicalPath(record.workspaceRoot)));
+    if (roots.size === 1) return unique[0];
+  }
+  return null;
+}
+
+function bindWorkspaceSession(sessionId, workspaceRoot, context, force = false) {
+  if (!sessionId) return null;
+  const root = findWorkspaceRoot(workspaceRoot, true);
+  if (!root) return null;
+  const hostId = getHostId(context);
+  const target = sessionRegistryPath(sessionId, hostId);
+  const record = {
+    version: SESSION_REGISTRY_VERSION,
+    sessionId,
+    hostId: hostId || undefined,
+    workspaceRoot: root,
+    workspaceKey: getWorkspaceKey(root),
+    updatedAt: new Date().toISOString()
+  };
+  const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(temporary, JSON.stringify(record, null, 2), 'utf8');
+    // Keep the first successful binding when two hooks initialize together.
+    if (fs.existsSync(target)) {
+      if (readRegistryRecord(target) && !force) fs.unlinkSync(temporary);
+      else {
+        fs.unlinkSync(target);
+        fs.renameSync(temporary, target);
+      }
+    } else fs.renameSync(temporary, target);
+  } catch (err) {
+    // Identity persistence is best effort. The caller still receives the
+    // resolved root and the next invocation can retry the binding.
+    try { if (fs.existsSync(temporary)) fs.unlinkSync(temporary); } catch (cleanupErr) { /* ignore */ }
+  }
+  return root;
+}
+
+function isIdentityReset(context) {
+  if (!context || typeof context !== 'object') return false;
+  return context.workspace_identity_reset === true ||
+    context.workspaceIdentityReset === true ||
+    context.new_session === true ||
+    context.newSession === true;
+}
+
+function getWorkspaceRoot(context) {
+  const sessionId = getSessionId(context);
+  const existing = readWorkspaceSession(sessionId, context);
+  const explicit = contextPath(context);
+
+  // SessionStart is the host's authoritative opportunity to establish (or
+  // re-establish) the project identity. All later hook invocations keep that
+  // binding even if the agent changes cwd or reports a nested repository.
+  if (existing && !isIdentityReset(context)) return existing.workspaceRoot;
+
+  const hostRoot = explicit || process.env.HARNESS_WORKSPACE_ROOT ||
+    process.env.CLAUDE_PROJECT_DIR || process.env.CODEX_PROJECT_DIR;
+  const root = findWorkspaceRoot(hostRoot || process.cwd(), Boolean(hostRoot));
+  if (sessionId) bindWorkspaceSession(sessionId, root, context, isIdentityReset(context));
+  return root;
+}
+
+// Single global root for ALL Harness runtime state (session counters,
+// circuit-breaker trips, audit logs, handoff timestamps, ...). Never
+// cwd-derived, so a script invoked from a fixture dir, worktree, submodule,
+// or any other nested non-git directory can never scatter files there
+// (issue #42). `$HARNESS_STATE_HOME` matches the env var the opencode
+// plugin already used for its own (differently-rooted) global state.
+function getStateHome() {
+  return process.env.HARNESS_STATE_HOME || path.join(os.homedir(), '.agents', 'harness-everything');
+}
+
+// Keys runtime state per real workspace instead of per invocation cwd, so
+// two different repos (or a repo and a stray subdirectory someone `cd`ed
+// into) never collide or fork the same state stream. Uses the resolved real
+// path (symlinks collapsed) hashed short, prefixed with a readable slug
+// purely so `~/.agents/harness-everything/workspaces/` stays eyeballable.
+function getWorkspaceKey(root) {
+  const workspaceRoot = typeof root === 'string' && root.trim() ? root : getWorkspaceRoot(root);
+  if (!workspaceRoot) return UNBOUND_WORKSPACE_KEY;
+  const resolved = path.resolve(workspaceRoot);
+  let real = resolved;
+  try { real = fs.realpathSync(resolved); } catch (err) { /* path may not exist yet (tests) */ }
+  const slug = path.basename(real).toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'workspace';
+  const hashInput = process.platform === 'win32' ? real.toLowerCase() : real;
+  const hash = crypto.createHash('sha1').update(hashInput).digest('hex').slice(0, 12);
+  return `${slug}-${hash}`;
+}
+
+function getWorkspaceStateDir(root) {
+  return path.join(getStateHome(), 'workspaces', getWorkspaceKey(root));
+}
+
+function resolveWorkspaceIdentity(context) {
+  const workspaceRoot = getWorkspaceRoot(context);
+  return {
+    workspaceRoot,
+    workspaceKey: getWorkspaceKey(workspaceRoot),
+    stateDir: getWorkspaceStateDir(workspaceRoot),
+    sessionId: getSessionId(context)
+  };
 }
 
 function getUserPromptsDir() {
@@ -25,4 +257,34 @@ function getUserPromptsDir() {
   }
 }
 
-module.exports = { getWorkspaceRoot, getUserPromptsDir };
+// The harness repo must never be "repaired" into carrying its own generated
+// advisory files. Identify it by repo identity, not by comparing the caller's
+// __dirname: when harness runs from an npx/global install against its own
+// source checkout, the installed path and the workspace path differ and a
+// path-based guard silently fails open (issue #40).
+const HARNESS_PACKAGE_NAME = 'harness-everything';
+
+function isHarnessRepo(workspaceRoot) {
+  try {
+    const pkgPath = path.join(workspaceRoot, 'package.json');
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    return pkg.name === HARNESS_PACKAGE_NAME;
+  } catch (err) {
+    return false;
+  }
+}
+
+module.exports = {
+  getWorkspaceRoot,
+  resolveWorkspaceIdentity,
+  bindWorkspaceSession,
+  readWorkspaceSession,
+  getSessionId,
+  getHostId,
+  getStateHome,
+  getWorkspaceKey,
+  getWorkspaceStateDir,
+  getUserPromptsDir,
+  isHarnessRepo,
+  HARNESS_PACKAGE_NAME,
+};

package/scripts/repository-contract.js

@@ -0,0 +1,213 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const ACTION_MINIMUMS = Object.freeze({ checkout: 7, setupNode: 7 });
+const MINIMUM_SUPPORTED_NODE_FLOOR = 22;
+
+function read(root, rel) {
+  return fs.readFileSync(path.join(root, rel), 'utf8');
+}
+
+function readJson(root, rel) {
+  return JSON.parse(read(root, rel));
+}
+
+function parseMinimumNode(engine) {
+  const match = String(engine || '').match(/>=\s*v?(\d+)/);
+  return match ? Number(match[1]) : null;
+}
+
+function parseMajor(text) {
+  const match = String(text || '').trim().match(/^v?(\d+)/);
+  return match ? Number(match[1]) : null;
+}
+
+function uniqSorted(values) {
+  return [...new Set(values.filter(Number.isInteger))].sort((a, b) => a - b);
+}
+
+function extractMajors(text, action) {
+  const escaped = action.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const re = new RegExp(`uses:\\s*${escaped}@v(\\d+)`, 'g');
+  const out = [];
+  let match;
+  while ((match = re.exec(text))) out.push(Number(match[1]));
+  return uniqSorted(out);
+}
+
+function extractNodeVersions(text) {
+  const out = [];
+  const re = /node-version:\s*["']?(\d+)(?:\.\d+)?["']?/g;
+  let match;
+  while ((match = re.exec(text))) out.push(Number(match[1]));
+  return uniqSorted(out);
+}
+
+function extractQualityGates(text) {
+  const gates = [];
+  if (/\bnpm\s+test\b/.test(text)) gates.push('test');
+  const re = /\bnpm\s+run\s+([A-Za-z0-9:_-]+)/g;
+  let match;
+  while ((match = re.exec(text))) gates.push(match[1]);
+  return [...new Set(gates)];
+}
+
+function listWorkflowFiles(root) {
+  const dir = path.join(root, '.github', 'workflows');
+  if (!fs.existsSync(dir)) return [];
+  return fs.readdirSync(dir)
+    .filter(name => /\.ya?ml$/i.test(name))
+    .sort();
+}
+
+function parseWorkflow(root, file) {
+  const rel = path.posix.join('.github/workflows', file);
+  const text = read(root, rel);
+  return {
+    file,
+    nodeVersions: extractNodeVersions(text),
+    checkoutMajors: extractMajors(text, 'actions/checkout'),
+    setupNodeMajors: extractMajors(text, 'actions/setup-node'),
+    scheduled: /^\s*schedule:\s*$/m.test(text),
+    workflowDispatch: /^\s*workflow_dispatch:\s*$/m.test(text),
+    workflowCall: /^\s*workflow_call:\s*$/m.test(text),
+    qualityGates: extractQualityGates(text),
+  };
+}
+
+function collectContract(root = ROOT) {
+  const pkg = readJson(root, 'package.json');
+  const nvmPath = path.join(root, '.nvmrc');
+  const primaryNode = fs.existsSync(nvmPath) ? parseMajor(read(root, '.nvmrc')) : null;
+  const dockerText = read(root, 'Dockerfile');
+  const dockerMatch = dockerText.match(/^FROM\s+node:(\d+)(?:[^\s]*)/m);
+  const workflows = listWorkflowFiles(root).map(file => parseWorkflow(root, file));
+  const ci = workflows.find(workflow => workflow.file === 'ci.yml' || workflow.file === 'ci.yaml');
+  const behavioral = workflows.find(workflow => /^behavioral-evals\.ya?ml$/.test(workflow.file));
+  const release = workflows.find(workflow => /^release\.ya?ml$/.test(workflow.file));
+
+  return {
+    runtime: {
+      packageEngine: pkg.engines?.node || null,
+      minimumNode: parseMinimumNode(pkg.engines?.node),
+      primaryNode,
+      dockerNode: dockerMatch ? Number(dockerMatch[1]) : null,
+    },
+    githubActions: {
+      checkoutMajors: uniqSorted(workflows.flatMap(workflow => workflow.checkoutMajors)),
+      setupNodeMajors: uniqSorted(workflows.flatMap(workflow => workflow.setupNodeMajors)),
+    },
+    workflows: Object.fromEntries(workflows.map(workflow => [workflow.file, workflow])),
+    ci: ci || null,
+    behavioralEvals: behavioral || null,
+    release: release || null,
+  };
+}
+
+function renderContractMarkdown(contract) {
+  const runtime = contract.runtime;
+  const actionList = values => values.length ? values.map(v => `v${v}`).join(', ') : 'not used';
+  const rows = Object.values(contract.workflows).map(workflow => {
+    const nodes = workflow.nodeVersions.length ? workflow.nodeVersions.map(String).join(', ') : 'n/a';
+    const trigger = [workflow.scheduled && 'schedule', workflow.workflowDispatch && 'workflow_dispatch', workflow.workflowCall && 'workflow_call'].filter(Boolean).join(', ') || 'push/pull request or other';
+    const gates = workflow.qualityGates.length ? workflow.qualityGates.map(g => `\`${g}\``).join(', ') : 'n/a';
+    return `| \`${workflow.file}\` | ${nodes} | ${trigger} | ${gates} |`;
+  }).join('\n');
+
+  return `<!-- GENERATED by scripts/repository-contract.js. Run \`npm run docs:sync\` after workflow/runtime changes. -->\n# Repository runtime and workflow contract\n\nThis page is generated from checked-in runtime and workflow sources. Do not edit it by hand. Historical audit/evidence documents are intentionally outside this current-state contract.\n\n## Runtime\n\n- Minimum supported Node.js: **${runtime.minimumNode}** (from \`package.json#engines.node\`: \`${runtime.packageEngine}\`)\n- Primary development/CI Node.js: **${runtime.primaryNode}** (from \`.nvmrc\`)\n- Docker verification Node.js: **${runtime.dockerNode}** (from \`Dockerfile\`)\n\n## GitHub Actions runtime majors\n\n- \`actions/checkout\`: ${actionList(contract.githubActions.checkoutMajors)}\n- \`actions/setup-node\`: ${actionList(contract.githubActions.setupNodeMajors)}\n\n## Active workflows\n\n| Workflow | Node.js versions | Explicit triggers | npm quality gates |\n| --- | --- | --- | --- |\n${rows}\n\n## Drift prevention\n\n\`npm run test:repo-contract\` fails when runtime sources disagree, an active workflow reintroduces an unsupported Node version/action major, the Node ${runtime.minimumNode} compatibility floor is no longer exercised, or this generated document is stale.\n`;
+}
+
+function validateContract(contract, root = ROOT) {
+  const failures = [];
+  const fail = message => failures.push(message);
+  const { runtime } = contract;
+
+  if (!Number.isInteger(runtime.minimumNode) || runtime.minimumNode < MINIMUM_SUPPORTED_NODE_FLOOR) {
+    fail(`package.json must declare Node >=${MINIMUM_SUPPORTED_NODE_FLOOR}; got ${runtime.packageEngine || 'missing'}`);
+  }
+  if (!Number.isInteger(runtime.primaryNode) || runtime.primaryNode < runtime.minimumNode) {
+    fail(`.nvmrc primary Node must be >= minimum Node ${runtime.minimumNode}; got ${runtime.primaryNode ?? 'missing'}`);
+  }
+  if (runtime.dockerNode !== runtime.primaryNode) {
+    fail(`Dockerfile Node ${runtime.dockerNode ?? 'missing'} must match .nvmrc Node ${runtime.primaryNode ?? 'missing'}`);
+  }
+
+  for (const major of contract.githubActions.checkoutMajors) {
+    if (major < ACTION_MINIMUMS.checkout) fail(`actions/checkout@v${major} is below supported floor v${ACTION_MINIMUMS.checkout}`);
+  }
+  for (const major of contract.githubActions.setupNodeMajors) {
+    if (major < ACTION_MINIMUMS.setupNode) fail(`actions/setup-node@v${major} is below supported floor v${ACTION_MINIMUMS.setupNode}`);
+  }
+  if (contract.githubActions.checkoutMajors.length !== 1) fail(`active workflows must use one checkout major; found ${contract.githubActions.checkoutMajors.join(', ') || 'none'}`);
+  if (contract.githubActions.setupNodeMajors.length !== 1) fail(`active workflows must use one setup-node major; found ${contract.githubActions.setupNodeMajors.join(', ') || 'none'}`);
+
+  for (const workflow of Object.values(contract.workflows)) {
+    for (const node of workflow.nodeVersions) {
+      if (node < runtime.minimumNode) fail(`${workflow.file} uses Node ${node}, below minimum ${runtime.minimumNode}`);
+    }
+  }
+
+  if (!contract.ci) fail('ci.yml is missing');
+  else {
+    if (!contract.ci.nodeVersions.includes(runtime.primaryNode)) fail(`ci.yml must exercise primary Node ${runtime.primaryNode}`);
+    if (!contract.ci.nodeVersions.includes(runtime.minimumNode)) fail(`ci.yml must exercise minimum supported Node ${runtime.minimumNode}`);
+  }
+  if (!contract.behavioralEvals) fail('behavioral-evals.yml is missing');
+  else {
+    if (!contract.behavioralEvals.scheduled) fail('behavioral-evals.yml must retain its scheduled trigger');
+    if (!contract.behavioralEvals.nodeVersions.includes(runtime.primaryNode)) fail(`behavioral-evals.yml must use primary Node ${runtime.primaryNode}`);
+  }
+  if (!contract.release) fail('release.yml is missing');
+  else if (!contract.release.nodeVersions.includes(runtime.primaryNode)) {
+    fail(`release.yml must use primary Node ${runtime.primaryNode}`);
+  }
+
+  const generatedPath = path.join(root, 'docs', 'repository-contract.md');
+  if (!fs.existsSync(generatedPath)) {
+    fail('docs/repository-contract.md is missing; run npm run docs:sync');
+  } else {
+    const actual = fs.readFileSync(generatedPath, 'utf8').replace(/\r\n/g, '\n');
+    const expected = renderContractMarkdown(contract).replace(/\r\n/g, '\n');
+    if (actual !== expected) fail('docs/repository-contract.md is stale; run npm run docs:sync');
+  }
+
+  return failures;
+}
+
+function printSummary(contract) {
+  console.log(`Node: >=${contract.runtime.minimumNode} supported; ${contract.runtime.primaryNode} primary; ${contract.runtime.dockerNode} Docker`);
+  console.log(`Actions: checkout ${contract.githubActions.checkoutMajors.map(v => `v${v}`).join(', ')}; setup-node ${contract.githubActions.setupNodeMajors.map(v => `v${v}`).join(', ')}`);
+  for (const workflow of Object.values(contract.workflows)) {
+    console.log(`${workflow.file}: Node ${workflow.nodeVersions.join(', ') || 'n/a'}; gates ${workflow.qualityGates.join(', ') || 'n/a'}`);
+  }
+}
+
+if (require.main === module) {
+  const args = new Set(process.argv.slice(2));
+  const contract = collectContract();
+  if (args.has('--json')) {
+    process.stdout.write(`${JSON.stringify(contract, null, 2)}\n`);
+  } else if (args.has('--check')) {
+    const failures = validateContract(contract);
+    if (failures.length) {
+      for (const failure of failures) console.error(`❌ ${failure}`);
+      process.exitCode = 1;
+    } else {
+      console.log('✅ Repository runtime/workflow contract is consistent.');
+    }
+  } else {
+    printSummary(contract);
+  }
+}
+
+module.exports = {
+  ACTION_MINIMUMS,
+  MINIMUM_SUPPORTED_NODE_FLOOR,
+  collectContract,
+  renderContractMarkdown,
+  validateContract,
+};

package/scripts/sync-current-docs.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { collectContract, renderContractMarkdown } = require('./repository-contract');
+
+const ROOT = path.resolve(__dirname, '..');
+const output = path.join(ROOT, 'docs', 'repository-contract.md');
+fs.mkdirSync(path.dirname(output), { recursive: true });
+fs.writeFileSync(output, renderContractMarkdown(collectContract(ROOT)), 'utf8');
+console.log(`Updated ${path.relative(ROOT, output).replace(/\\/g, '/')}`);

package/scripts/sync-openai-plugin.js

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, '.claude-plugin', 'plugin.json'), 'utf8'));
+const pluginSkillsRoot = path.join(ROOT, 'plugins', 'harness-everything', 'skills');
+const pluginRoot = path.join(ROOT, 'plugins', 'harness-everything');
+const pluginHooksRoot = path.join(pluginRoot, 'hooks');
+const sourceHooksScriptsRoot = path.join(ROOT, 'hooks', 'scripts');
+
+function normalizeText(file) {
+  const bytes = fs.readFileSync(file);
+  // Skills and hooks are text, but keeping binary assets byte-preserving makes
+  // this copier safe if a referenced asset is added later.
+  if (bytes.includes(0)) return;
+  const normalized = bytes.toString('utf8').replace(/\r\n/g, '\n');
+  fs.writeFileSync(file, normalized, 'utf8');
+}
+
+function normalizeTree(root) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const full = path.join(root, entry.name);
+    if (entry.isDirectory()) normalizeTree(full);
+    else if (entry.isFile()) normalizeText(full);
+  }
+}
+
+function syncTree(source, destination) {
+  fs.rmSync(destination, { recursive: true, force: true });
+  fs.mkdirSync(path.dirname(destination), { recursive: true });
+  if (fs.statSync(source).isDirectory()) {
+    fs.cpSync(source, destination, { recursive: true });
+    normalizeTree(destination);
+  } else {
+    fs.copyFileSync(source, destination);
+    normalizeText(destination);
+  }
+}
+
+fs.mkdirSync(pluginSkillsRoot, { recursive: true });
+
+const expected = new Set();
+for (const entry of manifest.skills || []) {
+  const source = path.resolve(ROOT, entry);
+  const name = path.basename(source);
+  const destination = path.join(pluginSkillsRoot, name);
+  expected.add(name);
+  syncTree(source, destination);
+  console.log(`synced ${name}`);
+}
+
+for (const name of fs.readdirSync(pluginSkillsRoot)) {
+  if (!expected.has(name)) fs.rmSync(path.join(pluginSkillsRoot, name), { recursive: true, force: true });
+}
+
+// The Claude hook definitions are host-specific, but their enforcement
+// scripts are shared. Package the scripts plus the small runtime libraries
+// they require so every OpenAI hook is self-contained under PLUGIN_ROOT.
+const packageHookScriptsRoot = path.join(pluginHooksRoot, 'scripts');
+syncTree(sourceHooksScriptsRoot, packageHookScriptsRoot);
+
+const packageWorkspace = path.join(packageHookScriptsRoot, 'lib', 'workspace.js');
+syncTree(path.join(ROOT, 'scripts', 'lib', 'workspace.js'), packageWorkspace);
+
+const packageAdvisoryText = path.join(pluginRoot, 'scripts', 'lib', 'advisory-text.js');
+syncTree(path.join(ROOT, 'scripts', 'lib', 'advisory-text.js'), packageAdvisoryText);
+
+// The source hook state module is shared with Claude and uses the repository
+// layout. Rewrite only that import in the packaged copy; all other relative
+// imports remain inside the package tree.
+const packageState = path.join(packageHookScriptsRoot, 'lib', 'harness-state.js');
+const stateSource = fs.readFileSync(packageState, 'utf8');
+fs.writeFileSync(
+  packageState,
+  stateSource.replace("require('../../../scripts/lib/workspace')", "require('./workspace')"),
+  'utf8'
+);
+
+const packageSessionStart = path.join(pluginHooksRoot, 'session-start.js');
+syncTree(path.join(sourceHooksScriptsRoot, 'openai-session-start.js'), packageSessionStart);
+const sessionSource = fs.readFileSync(packageSessionStart, 'utf8');
+fs.writeFileSync(
+  packageSessionStart,
+  sessionSource.replace("require('./lib/harness-state')", "require('./scripts/lib/harness-state')"),
+  'utf8'
+);
+
+console.log(`OpenAI plugin skills and runtime synchronized: ${expected.size} skills`);