harness-everything 0.31.0 → 0.31.2

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.31.0",
+      "version": "0.31.2",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.31.0",
+  "version": "0.31.2",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.31.2](https://github.com/dyphn1/Harness-everything/compare/v0.31.1...v0.31.2) (2026-10-15)
+
+### Bug Fixes
+
+* **cli:** support successful workflow disposition help ([2bf55f9](https://github.com/dyphn1/Harness-everything/commit/2bf55f92d9a6ffab5e41152dfb38a5ef01659f05)), closes [#310](https://github.com/dyphn1/Harness-everything/issues/310) [#310](https://github.com/dyphn1/Harness-everything/issues/310)
+
+## [0.31.1](https://github.com/dyphn1/Harness-everything/compare/v0.31.0...v0.31.1) (2026-10-13)
+
+### Bug Fixes
+
+* **verify:** pin wrapped checks to stable cd targets and declared cwd ([527b746](https://github.com/dyphn1/Harness-everything/commit/527b746d09db0db1a0b9310f1831bcaf312b1bf0)), closes [#307](https://github.com/dyphn1/Harness-everything/issues/307) [#306](https://github.com/dyphn1/Harness-everything/issues/306)
+* **verify:** recognize safe host cwd wrappers as verification evidence ([de7953f](https://github.com/dyphn1/Harness-everything/commit/de7953f9562bf4d31984cecf053725e1b4219eb2)), closes [#306](https://github.com/dyphn1/Harness-everything/issues/306)
+
 ## [0.31.0](https://github.com/dyphn1/Harness-everything/compare/v0.30.10...v0.31.0) (2026-10-13)
 
 ### Features
@@ -24,9 +37,15 @@ All notable changes to this project are documented in this file.
 * **workflow:** reject present non-array required/optional binding declarations before accepting a requirement plan, preserving workflow state on invalid input (#303 review).
 * **test:** isolate verification fixtures from an inherited project-check recursion guard while preserving explicit guard coverage.
 
+### Security
+
+* **deps:** update the locked `fast-uri` transitive dependency to patched version 3.1.8 (#309).
+
 ### Bug Fixes
 
+* **workflow:** make `workflow-disposition --help` and `-h` print usage successfully (#310).
 * **codex:** keep compatibility hooks and session labels in sync
+* **verify:** recognize a validated in-root host `cd <workspace> && <check>` prelude (Claude Code Windows Bash) as verification evidence for exactly one plain check; chaining, redirection, substitution, and out-of-root targets still never count, and verification evidence now requires a confirmed `PostToolUse` or zero exit (#306). Only CDPATH-stable `cd` targets (absolute or explicit `./`/`../`) are accepted, and a declared `.harness/verify.json` check counts only when run in its declared `cwd` (#307 review).
 
 ## [0.30.10](https://github.com/dyphn1/Harness-everything/compare/v0.30.9...v0.30.10) (2026-10-13)
 

package/benchmarks/results/live-host/claude-2026-10-13-issue-306/README.md

@@ -0,0 +1,44 @@
+# Claude Code live-host replay for issue #306
+
+**Date:** 2026-10-13
+
+**Host:** Claude Code 2.1.296 on Windows (headless `claude -p`, model haiku)
+
+**Plugin source:** `fix/306-verify-cwd-wrapper` worktree loaded with `--plugin-dir` (as `harness-everything@inline`); installed harness-everything plugin disabled via `--settings`. No cached harness-everything plugin appeared in the session's plugin list.
+
+**Task workspace:** disposable temporary git project with isolated `HARNESS_STATE_HOME`; no task files were written to this repository.
+
+## Observed behavior
+
+Runs 1-2 were made without `--include-hook-events`, so only SessionStart hook events appear in their streams. Runs 3-4 were made with `--include-hook-events`, which also exposes PreToolUse, PostToolUse, UserPromptSubmit and Stop hook events.
+
+| Check | Run 1 | Run 2 | Run 3 | Run 4 |
+|---|---|---|---|---|
+| Exit code | 0 | 0 | 0 | 0 |
+| Harness plugin loaded | `harness-everything@inline` at worktree | Same | Same | Same |
+| Bash command | `cd "<workspace>" && npm test` | Same | Same | Same |
+| Bash result | `1 test passed`, `is_error: false` | Same | Same | Same |
+| Edit landed (ws-diff) | yes | yes | yes | yes |
+| `lastEditAt` to `lastVerifyAt` | 88 ms, verify later | 89 ms, verify later | 93 ms, verify later | 126 ms, verify later |
+| `lastVerifyAt >= lastEditAt` | true | true | true | true |
+| `lastVerifyExitCode` | null | null | null | null |
+| `[Verification Reminder]` / `verification-after-edit-missing` | not observed (no Stop events in stream) | not observed | absent | absent |
+| Stop `[Workflow Reminder]` output | not observed | not observed | emitted once; 5 unresolved items, no verification item | emitted once; same |
+
+Stop observation in runs 3-4: six `Stop` hooks started and responded per run. Five harness Stop commands are registered in `hooks/hooks.json`, and the codex plugin registers one more (`stop-review-gate-hook.mjs`). One Stop response carried output, with exit code 0:
+
+- `"hook_name":"Stop","output":"[Workflow Reminder] Unresolved workflow evidence: decompose:pending, compose:pending, requirements:empty, workflow-selection:unconfirmed, execution:not-started. Resolve/verify before claiming completion.\n","exit_code":0,"outcome":"success"`
+
+The text matches `workflow-stop-gate.js`. The stream does not name the command for each `hook_id`, so this attribution is by message text. The other five Stop responses were empty with exit code 0. All nine PostToolUse and all PreToolUse responses in runs 3-4 were empty with exit code 0.
+
+## Evidence boundary
+
+- The `cd <workspace> && npm test` command was requested explicitly in the prompt. It matches the shape observed in the #297 trace, but here it was prompt-directed, not spontaneously generated by the host.
+- One host version (Claude Code 2.1.296) on Windows only.
+- Runs 3 and 4 were launched concurrently, not sequentially as instructed. Each used its own workspace and `HARNESS_STATE_HOME`, and both exited 0. This did not appear to affect results, but it was not the requested procedure.
+- The Stop attribution is by message text, not by a logged hook command. The sixth Stop invocation is unattributed.
+- No `[Verification Reminder]` line appears. The state and code are consistent with that absence (`stop-gate.js` returns early when `lastVerifyAt >= lastEditAt`), but the reminder path was not forced to fire, so it is not live-verified here.
+- `lastVerifyExitCode` is `null` in all runs. The Bash tool result reports only `is_error: false`, so the recorded verify event has no exit code.
+- `workflow-state.json` does not exist; `workflow-run.json` was inspected instead.
+- The raw streams and state files are kept outside the repository because they contain machine-specific paths.
+- This is live-host evidence for the #306 fix. It is not a token or behavior-improvement claim. Mechanism coverage lives in `ci/mechanism-35-verification-contract.test.js` and is a separate evidence layer.

package/ci/mechanism-2as-workflow-disposition-help.test.js

@@ -0,0 +1,41 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const scripts = [
+  path.join(ROOT, 'hooks/scripts/workflow-disposition.js'),
+  path.join(ROOT, 'plugins/harness-everything/hooks/scripts/workflow-disposition.js'),
+];
+const stateHome = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-workflow-help-'));
+
+function run(script, args) {
+  return spawnSync(process.execPath, [script, ...args], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    env: { ...process.env, HARNESS_STATE_HOME: stateHome },
+  });
+}
+
+for (const script of scripts) {
+  for (const flag of ['--help', '-h']) {
+    const result = run(script, [flag]);
+    assert.strictEqual(result.status, 0, `${path.relative(ROOT, script)} ${flag} exits successfully: ${result.stderr}`);
+    assert.match(result.stdout, /^Usage: workflow-disposition\.js </);
+    assert.strictEqual(result.stderr, '', 'help is written to stdout without an error');
+    assert.deepStrictEqual(fs.readdirSync(stateHome), [], 'help does not read or create session state');
+  }
+
+  for (const args of [[], ['unknown']]) {
+    const result = run(script, args);
+    assert.strictEqual(result.status, 2, `${path.relative(ROOT, script)} invalid invocation retains exit 2`);
+    assert.match(result.stderr, /Usage: workflow-disposition\.js/);
+  }
+}
+
+fs.rmSync(stateHome, { recursive: true, force: true });
+console.log('PASS workflow-disposition help is successful, read-only, and packaged');

package/ci/mechanism-35-verification-contract.test.js

@@ -410,7 +410,192 @@ try {
   assert.strictEqual(stop.status, 0);
   assert.doesNotMatch(String(stop.stderr || ''), /Verification Reminder/i);
 
+  // Issue #306: a host working-directory prelude (`cd <workspace> && <check>`)
+  // is recognized only for a validated in-root directory followed by exactly
+  // one plain verification command. Canonical and packaged copies must agree.
+  fs.rmSync(path.join(classifyRepo, '.harness', 'verify.json'));
+  const physicalRepo = fs.realpathSync.native(classifyRepo);
+  const posixRepo = physicalRepo.replace(/\\/g, '/');
+  const outside = fs.mkdtempSync(path.join(temp, 'outside-'));
+  fs.mkdirSync(path.join(classifyRepo, 'pkg'), { recursive: true });
+  fs.mkdirSync(path.join(classifyRepo, '--'), { recursive: true });
+  fs.mkdirSync(path.join(outside, 'pkg'), { recursive: true });
+  fs.writeFileSync(path.join(classifyRepo, 'not-a-dir.txt'), 'x\n');
+  const classifiers = {
+    canonical: require('../hooks/scripts/lib/workflow-isolation').isVerificationShell,
+    packaged: require('../plugins/harness-everything/hooks/scripts/lib/workflow-isolation').isVerificationShell,
+  };
+  const wrapperCases = (repo) => {
+    const positive = [
+      `cd "${physicalRepo}" && npm test`,
+      `cd '${physicalRepo}' && npm test`,
+      `cd '${posixRepo}' && npm test`,
+      `cd   "${physicalRepo}"   &&   npm   test`,
+      `cd "${physicalRepo}" && pre-commit run --all-files`,
+      `cd ./pkg && npm test`,
+      `cd "./pkg" && npm test`,
+      `cd . && npm test`,
+      'npm test',
+    ];
+    if (!/[^A-Za-z0-9_./:@%+,-]/.test(posixRepo)) positive.push(`cd ${posixRepo} && npm test`);
+    if (process.platform === 'win32') {
+      positive.push(`cd '/${physicalRepo[0].toLowerCase()}${posixRepo.slice(2)}' && npm test`);
+    }
+    const negative = [
+      `cd "${physicalRepo}" && npm test && rm -rf build`,
+      `cd "${physicalRepo}" && npm test || true`,
+      'npm test || true',
+      'npm test; rm -rf build',
+      `cd "${physicalRepo}" && npm test | tee out.txt`,
+      `cd "${physicalRepo}" && npm test > out.txt`,
+      `cd "${physicalRepo}" && npm test 2>&1`,
+      `cd "${physicalRepo}" && npm test $(rm -rf build)`,
+      `cd "${physicalRepo}" && npm test \`rm -rf build\``,
+      `cd "${physicalRepo}" && npm test &`,
+      `cd "${physicalRepo}" && (npm test)`,
+      `cd "${physicalRepo}" && npm test\nrm -rf build`,
+      `cd "${physicalRepo}" && echo npm test`,
+      'echo npm test',
+      `cd "${physicalRepo}" && cd "${physicalRepo}" && npm test`,
+      `cd "${physicalRepo}\\" && npm test" && rm -rf build`,
+      `cd "${physicalRepo};rm -rf build" && npm test`,
+      'cd "$HOME" && npm test',
+      'cd ~ && npm test',
+      `cd "${outside}" && npm test`,
+      `cd "${path.join(physicalRepo, '..')}" && npm test`,
+      `cd "${path.join(physicalRepo, 'missing')}" && npm test`,
+      `cd "${path.join(physicalRepo, 'not-a-dir.txt')}" && npm test`,
+      `cd "${physicalRepo}" ; npm test`,
+      `cd "${physicalRepo}" || npm test`,
+      `pushd "${physicalRepo}" && npm test`,
+      `cd "${physicalRepo}" &&`,
+      // Bash destination differs from a naive path.resolve: CDPATH-sensitive
+      // bare relatives and option-like targets fail closed (PR #307 review).
+      'cd pkg && npm test',
+      'cd "pkg" && npm test',
+      'cd -- && npm test',
+      'cd "--" && npm test',
+      'cd - && npm test',
+      `cd -P "${physicalRepo}" && npm test`,
+    ];
+    if (process.platform === 'win32') negative.push('cd /usr && npm test', 'cd /tmp && npm test');
+    return { positive, negative, repo };
+  };
+  for (const [label, classify] of Object.entries(classifiers)) {
+    const { positive, negative } = wrapperCases(classifyRepo);
+    for (const command of positive) {
+      assert.strictEqual(classify(command, { cwd: classifyRepo, root: classifyRepo }), true, `${label}: wrapper must count: ${command}`);
+    }
+    for (const command of negative) {
+      assert.strictEqual(classify(command, { cwd: classifyRepo, root: classifyRepo }), false, `${label}: must not count: ${JSON.stringify(command)}`);
+    }
+    // Unexpected inputs fail closed rather than throwing.
+    for (const value of [undefined, null, '', '   ', 42, 'cd', 'cd ""  && npm test']) {
+      assert.strictEqual(classify(value, { cwd: classifyRepo, root: classifyRepo }), false, `${label}: unexpected input ${JSON.stringify(value)}`);
+    }
+  }
+
+  // Where Bash is available, prove the CDPATH hazard is real: `cd pkg` leaves
+  // the repository even though <repo>/pkg exists, so the bare form must not count.
+  const bashProbe = spawnSync('bash', ['-c', 'cd pkg >/dev/null && pwd'], {
+    cwd: classifyRepo,
+    encoding: 'utf8',
+    // Native path on purpose: MSYS Bash converts it, while a `C:/...` spelling
+    // would be split at the drive colon as a CDPATH separator.
+    env: { ...process.env, CDPATH: outside },
+  });
+  if (!bashProbe.error && bashProbe.status === 0) {
+    assert.match(bashProbe.stdout.trim(), new RegExp(`${path.basename(outside)}[\\\\/]pkg$`), 'CDPATH redirects a bare cd outside the repository');
+  }
+
+  // A declared contract still governs the wrapped command: declared checks
+  // count through the wrapper only in their declared cwd; undeclared legacy
+  // commands and declared commands run elsewhere do not (PR #307 review).
+  writeJson(path.join(classifyRepo, '.harness', 'verify.json'), {
+    version: 1,
+    checks: [
+      { id: 'e2e', run: 'bash scripts/e2e.sh' },
+      { id: 'root-test', run: 'npm test', cwd: '.' },
+      { id: 'pkg-make', run: 'make test', cwd: 'pkg' },
+    ],
+  });
+  for (const [label, classify] of Object.entries(classifiers)) {
+    const options = { cwd: classifyRepo, root: classifyRepo };
+    const pkgOptions = { cwd: path.join(classifyRepo, 'pkg'), root: classifyRepo };
+    assert.strictEqual(classify(`cd "${physicalRepo}" && bash scripts/e2e.sh`, options), true, `${label}: declared contract check through wrapper`);
+    assert.strictEqual(classify(`cd "${physicalRepo}" && npx jest`, options), false, `${label}: wrapper must not bypass the declared contract`);
+    assert.strictEqual(classify(`cd "${physicalRepo}" && bash scripts/e2e.sh && rm -rf build`, options), false, `${label}: chained contract check`);
+    assert.strictEqual(classify(`cd "${physicalRepo}" && npm test`, options), true, `${label}: root check in its declared cwd`);
+    assert.strictEqual(classify('cd ./pkg && npm test', options), false, `${label}: root check run in a subproject is not root verification`);
+    assert.strictEqual(classify(`cd "${path.join(physicalRepo, 'pkg')}" && npm test`, options), false, `${label}: absolute wrong-cwd root check`);
+    assert.strictEqual(classify('cd ./pkg && make test', options), true, `${label}: subproject check in its declared cwd`);
+    assert.strictEqual(classify(`cd "${physicalRepo}" && make test`, options), false, `${label}: subproject check run at root`);
+    assert.strictEqual(classify('npm test', options), true, `${label}: standalone root check at root`);
+    assert.strictEqual(classify('npm test', pkgOptions), false, `${label}: standalone root check from the wrong cwd`);
+    assert.strictEqual(classify('make test', pkgOptions), true, `${label}: standalone subproject check in its cwd`);
+  }
+  fs.writeFileSync(path.join(classifyRepo, '.harness', 'verify.json'), '{ broken');
+  assert.strictEqual(isVerificationShell(`cd "${physicalRepo}" && npm test`, { cwd: classifyRepo }), false, 'invalid contract still fails closed through the wrapper');
+  fs.rmSync(path.join(classifyRepo, '.harness', 'verify.json'));
+
+  // End-to-end hook replay (Windows-Bash-shaped Claude payload, no exit code):
+  // edit -> wrapped verification -> Stop is clean. Repeated twice for determinism.
+  const wrappedCommand = `cd "${physicalRepo}" && npm test`;
+  for (const scripts of [
+    { label: 'canonical', persist: statePersist, stop: stopGate },
+    { label: 'packaged', persist: path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'state-persist.js'), stop: path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'stop-gate.js') },
+  ]) {
+    for (let round = 0; round < 2; round++) {
+      const wrapSession = `verify-wrapper-${scripts.label}-${round}`;
+      const wrapStateFile = path.join(stateHome, 'workspaces', getWorkspaceKey(classifyRepo), 'state', 'sessions', wrapSession, 'handoff-state.json');
+      const readWrapState = () => JSON.parse(fs.readFileSync(wrapStateFile, 'utf8'));
+      const bash = (command, extra = {}) => invokeHook(scripts.persist, {
+        session_id: wrapSession,
+        cwd: classifyRepo,
+        hook_event_name: 'PostToolUse',
+        tool_name: 'Bash',
+        tool_input: { command },
+        tool_response: { stdout: 'ok', stderr: '' },
+        ...extra,
+      });
+
+      assert.strictEqual(invokeHook(scripts.persist, {
+        session_id: wrapSession,
+        cwd: classifyRepo,
+        hook_event_name: 'PostToolUse',
+        tool_name: 'Edit',
+        tool_input: { file_path: path.join(classifyRepo, 'README.md') },
+        tool_response: { stdout: '' },
+      }).status, 0);
+      const editedAt = readWrapState().lastEditAt;
+      assert.ok(Number.isFinite(editedAt), `${scripts.label}: edit recorded`);
+
+      // Failed or unconfirmed outcomes never mark a passing verification.
+      assert.strictEqual(bash(wrappedCommand, { hook_event_name: 'PostToolUseFailure', tool_response: { stderr: 'boom' } }).status, 0);
+      assert.ok(!readWrapState().lastVerifyAt, `${scripts.label}: PostToolUseFailure must not verify`);
+      assert.strictEqual(bash(wrappedCommand, { tool_response: { stdout: '', stderr: 'boom', exitCode: 1 } }).status, 0);
+      assert.ok(!readWrapState().lastVerifyAt, `${scripts.label}: nonzero exit must not verify`);
+      assert.strictEqual(bash(wrappedCommand, { hook_event_name: undefined }).status, 0);
+      assert.ok(!readWrapState().lastVerifyAt, `${scripts.label}: unknown event without exit code must not verify`);
+      assert.strictEqual(bash(`${wrappedCommand} && rm -rf build`).status, 0);
+      assert.ok(!readWrapState().lastVerifyAt, `${scripts.label}: chained wrapper must not verify`);
+
+      const failingStop = invokeHook(scripts.stop, { session_id: wrapSession, cwd: classifyRepo });
+      assert.strictEqual(failingStop.status, 0, `${scripts.label}: Stop stays fail-open`);
+      assert.match(String(failingStop.stderr || ''), /Verification Reminder/i, `${scripts.label}: reminder before verification`);
+
+      assert.strictEqual(bash(wrappedCommand).status, 0);
+      const verified = readWrapState();
+      assert.ok(verified.lastVerifyAt >= verified.lastEditAt, `${scripts.label}: wrapper verification recorded ${JSON.stringify(verified)}`);
+      assert.strictEqual(verified.lastVerifyExitCode, null);
+      const cleanStop = invokeHook(scripts.stop, { session_id: wrapSession, cwd: classifyRepo });
+      assert.strictEqual(cleanStop.status, 0);
+      assert.doesNotMatch(String(cleanStop.stderr || ''), /Verification Reminder/i, `${scripts.label}: clean Stop after wrapped verification`);
+    }
+  }
+
   console.log('Issue #242 verification contract: taxonomy, discovery, execution safety, multi-root scope, hook recognition, and Stop evidence verified.');
+  console.log('Issue #306 host cwd wrapper: validated prelude recognition, negative chaining/injection/out-of-root cases, contract governance, canonical/packaged parity, and hook-to-Stop replay verified.');
 } finally {
   fs.rmSync(temp, { recursive: true, force: true });
 }

package/hooks/scripts/state-persist.js

@@ -43,7 +43,8 @@ function processState(payload) {
     if (isShell) {
       const commandClass = classifyShell(command);
       if (commandClass !== 'read-only' && commandClass !== 'worktree-setup') state.lastEditAt = Date.now();
-      if (!isFailed && isVerificationShell(command, { cwd: cwdOf(payload, root), root })) { state.lastVerifyAt = Date.now(); state.lastVerifyExitCode = exitCode ?? null; }
+      // Verification evidence needs a confirmed success: a PostToolUse event or an explicit zero exit.
+      if (!isFailed && (isSuccessEvent || exitCode === 0) && isVerificationShell(command, { cwd: cwdOf(payload, root), root })) { state.lastVerifyAt = Date.now(); state.lastVerifyExitCode = exitCode ?? null; }
     }
     fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
     observeTool(payload);

package/hooks/scripts/workflow-disposition.js

@@ -149,6 +149,10 @@ function activatePlan(workflow, plan) {
 }
 
 function main() {
+  if (process.argv[2] === '--help' || process.argv[2] === '-h') {
+    process.stdout.write(usage() + '\n');
+    return;
+  }
   const args = parseArgs(process.argv.slice(2));
   if (!WORKFLOW_CONTROLLER_COMMANDS.has(args.command)) throw new Error(usage());
   const sessionId = args.sessionId || readCurrentSession(getWorkspaceRoot());

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.31.0",
+  "version": "0.31.2",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.31.0",
+  "version": "0.31.2",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.31.0",
+  "version": "0.31.2",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/state-persist.js

@@ -43,7 +43,8 @@ function processState(payload) {
     if (isShell) {
       const commandClass = classifyShell(command);
       if (commandClass !== 'read-only' && commandClass !== 'worktree-setup') state.lastEditAt = Date.now();
-      if (!isFailed && isVerificationShell(command, { cwd: cwdOf(payload, root), root })) { state.lastVerifyAt = Date.now(); state.lastVerifyExitCode = exitCode ?? null; }
+      // Verification evidence needs a confirmed success: a PostToolUse event or an explicit zero exit.
+      if (!isFailed && (isSuccessEvent || exitCode === 0) && isVerificationShell(command, { cwd: cwdOf(payload, root), root })) { state.lastVerifyAt = Date.now(); state.lastVerifyExitCode = exitCode ?? null; }
     }
     fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
     observeTool(payload);

package/plugins/harness-everything/hooks/scripts/workflow-disposition.js

@@ -149,6 +149,10 @@ function activatePlan(workflow, plan) {
 }
 
 function main() {
+  if (process.argv[2] === '--help' || process.argv[2] === '-h') {
+    process.stdout.write(usage() + '\n');
+    return;
+  }
   const args = parseArgs(process.argv.slice(2));
   if (!WORKFLOW_CONTROLLER_COMMANDS.has(args.command)) throw new Error(usage());
   const sessionId = args.sessionId || readCurrentSession(getWorkspaceRoot());

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.31.0",
+  "version": "0.31.2",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/scripts/lib/verification-contract.js

@@ -303,6 +303,7 @@ function verificationCommandSet(cwd, options = {}) {
       contract,
       contractInvalid: false,
       commands: contract.checks.map(check => check.run),
+      checks: contract.checks.map(check => ({ run: check.run, cwd: check.cwd })),
       commitHookDeclared: contract.checks.some(check => /^pre-commit\s+/i.test(normalizeCommand(check.run))),
     };
   }
@@ -323,7 +324,75 @@ function verificationCommandSet(cwd, options = {}) {
   };
 }
 
+// Hosts such as Claude Code on Windows Bash may prefix a shell call with a
+// working-directory prelude: `cd <workspace> && <command>`. Recognize exactly
+// one such prelude lexically (never evaluating shell text) and only when the
+// target is an existing directory inside the repository root. Only spellings
+// whose Bash destination is stable are accepted: absolute paths or explicit
+// ./ and ../ relatives. Bare relatives are CDPATH-sensitive, and option-like
+// targets (-, --, -P ...) change cd semantics, so both fail closed. The remaining
+// command must be one plain command: no further control operators,
+// redirection, substitution, expansion, subshell, or background syntax.
+const CWD_PRELUDE_RE = /^cd\s+(?:"([^"]*)"|'([^']*)'|([A-Za-z0-9_./:@%+,-]+))\s*&&\s*([\s\S]+)$/;
+const UNSAFE_WRAPPED_RE = /[`$<>&|;()\r\n]/;
+const UNSAFE_DOUBLE_QUOTED_RE = /[$`!]|\\[\\"$`]|\\$/;
+
+function hostPathToNative(value, platform = process.platform) {
+  if (platform !== 'win32') return value;
+  const drive = value.match(/^\/([A-Za-z])(?:\/([\s\S]*))?$/);
+  return drive ? `${drive[1].toUpperCase()}:\\${(drive[2] || '').replace(/\//g, '\\')}` : value;
+}
+
+function stableCdTarget(target, platform = process.platform) {
+  if (target.startsWith('-')) return false;
+  if (/^\.\.?(?:\/|$)/.test(target)) return true;
+  if (platform === 'win32') {
+    if (/^\.\.?\\/.test(target) || /^[A-Za-z]:[\\/]/.test(target)) return true;
+    // Git Bash maps only /<drive>/... onto Windows paths; other absolute
+    // POSIX paths (/tmp, /usr) are MSYS mounts that Node cannot resolve alike.
+    return /^\/[A-Za-z](?:\/|$)/.test(target);
+  }
+  return target.startsWith('/');
+}
+
+function parseCwdPrelude(command, options = {}) {
+  const match = String(command || '').trim().match(CWD_PRELUDE_RE);
+  if (!match) return null;
+  const [, doubleQuoted, singleQuoted, bare, restRaw] = match;
+  const target = doubleQuoted ?? singleQuoted ?? bare;
+  const rest = restRaw.trim();
+  if (!target || !rest) return null;
+  if (doubleQuoted !== undefined && UNSAFE_DOUBLE_QUOTED_RE.test(target)) return null;
+  if (UNSAFE_WRAPPED_RE.test(rest) || hasControlOperators(rest)) return null;
+  if (!stableCdTarget(target, options.platform)) return null;
+
+  const cwd = path.resolve(options.cwd || process.cwd());
+  let resolved;
+  let root;
+  try {
+    resolved = fs.realpathSync.native(path.resolve(cwd, hostPathToNative(target, options.platform)));
+    if (!fs.statSync(resolved).isDirectory()) return null;
+    root = fs.realpathSync.native(path.resolve(options.root || findGitRoot(cwd)));
+  } catch (_) {
+    return null;
+  }
+  if (!within(root, resolved)) return null;
+  return { cwd: resolved, command: rest };
+}
+
 function isVerificationCommand(command, options = {}) {
+  const wrapped = parseCwdPrelude(command, options);
+  if (wrapped) return isPlainVerificationCommand(wrapped.command, { ...options, cwd: wrapped.cwd });
+  return isPlainVerificationCommand(command, options);
+}
+
+function cwdKey(dir) {
+  let resolved = path.resolve(dir);
+  try { resolved = fs.realpathSync.native(resolved); } catch (_) {}
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+
+function isPlainVerificationCommand(command, options = {}) {
   const cwd = path.resolve(options.cwd || process.cwd());
   const actual = normalizeCommand(command);
   if (!actual || hasControlOperators(actual)) return false;
@@ -333,8 +402,15 @@ function isVerificationCommand(command, options = {}) {
   if (isGitCommit(actual)) {
     return !!set.commitHookDeclared && !bypassesHooks(actual) && hasCommitHook(set.repoRoot);
   }
+  // A declared contract check counts only when it ran in its declared cwd;
+  // otherwise a matching command in another directory (e.g. a subproject)
+  // would be credited as the root check.
+  if (set.contract) {
+    const executed = cwdKey(cwd);
+    return set.checks.some(check => commandMatches(actual, check.run) && cwdKey(check.cwd) === executed);
+  }
   if (set.commands.some(expected => commandMatches(actual, expected))) return true;
-  return !set.contract && legacyVerificationCommand(actual);
+  return legacyVerificationCommand(actual);
 }
 
 module.exports = {
@@ -350,6 +426,7 @@ module.exports = {
   isVerificationCommand,
   legacyVerificationCommand,
   normalizeCommand,
+  parseCwdPrelude,
   readContract,
   resolveContained,
   verificationCommandSet,

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:f36b4c60-cf13-5d9d-a29b-1c3c673c2096",
+  "serialNumber": "urn:uuid:9d3ce484-1be2-5a01-aaf1-830f69f479f8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-13T07:28:22.558Z",
+    "timestamp": "2026-10-15T15:15:14.070Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.31.0"
+        "version": "0.31.2"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.31.0",
+      "bom-ref": "pkg:npm/harness-everything@0.31.2",
       "name": "harness-everything",
-      "version": "0.31.0",
-      "purl": "pkg:npm/harness-everything@0.31.0"
+      "version": "0.31.2",
+      "purl": "pkg:npm/harness-everything@0.31.2"
     }
   },
   "components": [
@@ -920,15 +920,15 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/fast-uri@3.1.6",
+      "bom-ref": "pkg:npm/fast-uri@3.1.8",
       "name": "fast-uri",
-      "version": "3.1.6",
+      "version": "3.1.8",
       "scope": "excluded",
-      "purl": "pkg:npm/fast-uri@3.1.6",
+      "purl": "pkg:npm/fast-uri@3.1.8",
       "hashes": [
         {
           "alg": "SHA-512",
-          "content": "7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q=="
+          "content": "GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg=="
         }
       ]
     },
@@ -1896,7 +1896,7 @@
       "ref": "pkg:npm/ajv@8.20.0",
       "dependsOn": [
         "pkg:npm/fast-deep-equal@3.1.3",
-        "pkg:npm/fast-uri@3.1.6",
+        "pkg:npm/fast-uri@3.1.8",
         "pkg:npm/json-schema-traverse@1.0.0",
         "pkg:npm/require-from-string@2.0.2"
       ]
@@ -1999,7 +1999,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.31.0",
+      "ref": "pkg:npm/harness-everything@0.31.2",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",

package/scripts/lib/verification-contract.js

@@ -303,6 +303,7 @@ function verificationCommandSet(cwd, options = {}) {
       contract,
       contractInvalid: false,
       commands: contract.checks.map(check => check.run),
+      checks: contract.checks.map(check => ({ run: check.run, cwd: check.cwd })),
       commitHookDeclared: contract.checks.some(check => /^pre-commit\s+/i.test(normalizeCommand(check.run))),
     };
   }
@@ -323,7 +324,75 @@ function verificationCommandSet(cwd, options = {}) {
   };
 }
 
+// Hosts such as Claude Code on Windows Bash may prefix a shell call with a
+// working-directory prelude: `cd <workspace> && <command>`. Recognize exactly
+// one such prelude lexically (never evaluating shell text) and only when the
+// target is an existing directory inside the repository root. Only spellings
+// whose Bash destination is stable are accepted: absolute paths or explicit
+// ./ and ../ relatives. Bare relatives are CDPATH-sensitive, and option-like
+// targets (-, --, -P ...) change cd semantics, so both fail closed. The remaining
+// command must be one plain command: no further control operators,
+// redirection, substitution, expansion, subshell, or background syntax.
+const CWD_PRELUDE_RE = /^cd\s+(?:"([^"]*)"|'([^']*)'|([A-Za-z0-9_./:@%+,-]+))\s*&&\s*([\s\S]+)$/;
+const UNSAFE_WRAPPED_RE = /[`$<>&|;()\r\n]/;
+const UNSAFE_DOUBLE_QUOTED_RE = /[$`!]|\\[\\"$`]|\\$/;
+
+function hostPathToNative(value, platform = process.platform) {
+  if (platform !== 'win32') return value;
+  const drive = value.match(/^\/([A-Za-z])(?:\/([\s\S]*))?$/);
+  return drive ? `${drive[1].toUpperCase()}:\\${(drive[2] || '').replace(/\//g, '\\')}` : value;
+}
+
+function stableCdTarget(target, platform = process.platform) {
+  if (target.startsWith('-')) return false;
+  if (/^\.\.?(?:\/|$)/.test(target)) return true;
+  if (platform === 'win32') {
+    if (/^\.\.?\\/.test(target) || /^[A-Za-z]:[\\/]/.test(target)) return true;
+    // Git Bash maps only /<drive>/... onto Windows paths; other absolute
+    // POSIX paths (/tmp, /usr) are MSYS mounts that Node cannot resolve alike.
+    return /^\/[A-Za-z](?:\/|$)/.test(target);
+  }
+  return target.startsWith('/');
+}
+
+function parseCwdPrelude(command, options = {}) {
+  const match = String(command || '').trim().match(CWD_PRELUDE_RE);
+  if (!match) return null;
+  const [, doubleQuoted, singleQuoted, bare, restRaw] = match;
+  const target = doubleQuoted ?? singleQuoted ?? bare;
+  const rest = restRaw.trim();
+  if (!target || !rest) return null;
+  if (doubleQuoted !== undefined && UNSAFE_DOUBLE_QUOTED_RE.test(target)) return null;
+  if (UNSAFE_WRAPPED_RE.test(rest) || hasControlOperators(rest)) return null;
+  if (!stableCdTarget(target, options.platform)) return null;
+
+  const cwd = path.resolve(options.cwd || process.cwd());
+  let resolved;
+  let root;
+  try {
+    resolved = fs.realpathSync.native(path.resolve(cwd, hostPathToNative(target, options.platform)));
+    if (!fs.statSync(resolved).isDirectory()) return null;
+    root = fs.realpathSync.native(path.resolve(options.root || findGitRoot(cwd)));
+  } catch (_) {
+    return null;
+  }
+  if (!within(root, resolved)) return null;
+  return { cwd: resolved, command: rest };
+}
+
 function isVerificationCommand(command, options = {}) {
+  const wrapped = parseCwdPrelude(command, options);
+  if (wrapped) return isPlainVerificationCommand(wrapped.command, { ...options, cwd: wrapped.cwd });
+  return isPlainVerificationCommand(command, options);
+}
+
+function cwdKey(dir) {
+  let resolved = path.resolve(dir);
+  try { resolved = fs.realpathSync.native(resolved); } catch (_) {}
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+
+function isPlainVerificationCommand(command, options = {}) {
   const cwd = path.resolve(options.cwd || process.cwd());
   const actual = normalizeCommand(command);
   if (!actual || hasControlOperators(actual)) return false;
@@ -333,8 +402,15 @@ function isVerificationCommand(command, options = {}) {
   if (isGitCommit(actual)) {
     return !!set.commitHookDeclared && !bypassesHooks(actual) && hasCommitHook(set.repoRoot);
   }
+  // A declared contract check counts only when it ran in its declared cwd;
+  // otherwise a matching command in another directory (e.g. a subproject)
+  // would be credited as the root check.
+  if (set.contract) {
+    const executed = cwdKey(cwd);
+    return set.checks.some(check => commandMatches(actual, check.run) && cwdKey(check.cwd) === executed);
+  }
   if (set.commands.some(expected => commandMatches(actual, expected))) return true;
-  return !set.contract && legacyVerificationCommand(actual);
+  return legacyVerificationCommand(actual);
 }
 
 module.exports = {
@@ -350,6 +426,7 @@ module.exports = {
   isVerificationCommand,
   legacyVerificationCommand,
   normalizeCommand,
+  parseCwdPrelude,
   readContract,
   resolveContained,
   verificationCommandSet,