harness-everything 0.41.0 → 0.41.2

package/hooks/scripts/lib/codex-action-authorization.js

@@ -0,0 +1,193 @@
+'use strict';
+
+// Cooperative Codex explicit-authorization state. This is NOT tamperproof:
+// it is local hook state keyed by host session. A local process or user can
+// delete or rewrite it. It records consent only; it never bypasses Codex's
+// native permission controls.
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+const { getWorkspaceRoot, getSessionDir } = require('./harness-state');
+
+const DIR_NAME = 'codex-action-authorization';
+const CHALLENGES = 'challenges';
+const GRANTS = 'grants';
+
+function sessionDirOf(payload, options) {
+  if (options && options.sessionDir) return options.sessionDir;
+  const root = (options && options.root) || getWorkspaceRoot(payload);
+  const sessionId = payload && (payload.session_id || payload.sessionId);
+  return getSessionDir(root, sessionId, payload);
+}
+
+function safeToken(value) {
+  return String(value || 'x').replace(/[^A-Za-z0-9._-]+/g, '_').slice(0, 160) || 'x';
+}
+
+function authDir(payload, options, leaf) {
+  return path.join(sessionDirOf(payload, options), DIR_NAME, leaf);
+}
+
+function challengesDir(payload, options) { return authDir(payload, options, CHALLENGES); }
+function grantsDir(payload, options) { return authDir(payload, options, GRANTS); }
+
+function ensureDir(dir) { fs.mkdirSync(dir, { recursive: true }); }
+
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch (_) { return null; }
+}
+
+function atomicWriteJson(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const temp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(temp, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+  fs.renameSync(temp, filePath);
+}
+
+function newChallengeId() {
+  return `ch-${crypto.randomBytes(12).toString('hex')}`;
+}
+
+// Canonical challenge ids are minted by this helper as ch-<24 hex>. A pending
+// grant is stored as exactly <challengeId>.json. Anything with an extra suffix
+// (.consumed, .consumed.json, etc.) is a claim/consumed record, not pending.
+const CANONICAL_CHALLENGE_ID = /^ch-[0-9a-f]{24}$/;
+function isPendingGrantFileName(name) {
+  if (typeof name !== 'string') return false;
+  const match = name.match(/^([^/\\]+)\.json$/);
+  if (!match) return false;
+  return CANONICAL_CHALLENGE_ID.test(match[1]);
+}
+
+function toolNameOf(payload) {
+  return String((payload && (payload.tool_name || payload.toolName)) || '');
+}
+
+function validIdentity(value) {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+function actionGateModule() {
+  try { return require(path.join(__dirname, '..', 'action-gate.js')); } catch (_) { return null; }
+}
+
+function canonicalDigest(payload) {
+  const ag = actionGateModule();
+  if (ag && typeof ag.exactPayloadText === 'function' && typeof ag.hashExact === 'function') {
+    return ag.hashExact(ag.exactPayloadText(payload));
+  }
+  const input = (payload && (payload.tool_input || payload.toolInput || payload.input)) || {};
+  return crypto.createHash('sha256').update(JSON.stringify(input), 'utf8').digest('hex');
+}
+
+function issueChallenge(payload, options) {
+  options = options || {};
+  const challengeId = options.challengeId || newChallengeId();
+  const dir = challengesDir(payload, options);
+  ensureDir(dir);
+  const file = path.join(dir, `${safeToken(challengeId)}.json`);
+  const record = {
+    schemaVersion: 1,
+    challengeId,
+    sessionId: payload && (payload.session_id || payload.sessionId) || null,
+    toolName: options.toolName || toolNameOf(payload),
+    digest: options.digest || canonicalDigest(payload),
+    createdAt: new Date().toISOString(),
+  };
+  atomicWriteJson(file, record);
+  return challengeId;
+}
+
+function bindConsent(payload, options) {
+  options = options || {};
+  const challengeId = options.challengeId;
+  if (!challengeId) return { bound: false, reason: 'missing-challenge-id' };
+
+  const dir = challengesDir(payload, options);
+  const file = path.join(dir, `${safeToken(challengeId)}.json`);
+  const challenge = readJson(file);
+  if (!challenge) return { bound: false, reason: 'challenge-not-found' };
+
+  const sessionId = payload && (payload.session_id || payload.sessionId);
+  if (challenge.sessionId && challenge.sessionId !== sessionId) {
+    return { bound: false, reason: 'session-mismatch' };
+  }
+
+  const consentTurn = payload && (payload.turn_id || payload.turnId);
+  if (!validIdentity(sessionId) || !validIdentity(consentTurn)) {
+    return { bound: false, reason: 'missing-identity' };
+  }
+  const gdir = grantsDir(payload, options);
+  ensureDir(gdir);
+  const grantFile = path.join(gdir, `${safeToken(challengeId)}.json`);
+  const grant = {
+    schemaVersion: 1,
+    challengeId,
+    sessionId,
+    consentTurn: consentTurn || null,
+    toolName: challenge.toolName,
+    digest: challenge.digest,
+    createdAt: new Date().toISOString(),
+    consumed: false,
+  };
+  atomicWriteJson(grantFile, grant);
+  return { bound: true, challenge };
+}
+
+function consumeGrantIfValid(payload, options) {
+  options = options || {};
+  const sessionId = payload && (payload.session_id || payload.sessionId);
+  const turnId = payload && (payload.turn_id || payload.turnId);
+  if (!validIdentity(sessionId) || !validIdentity(turnId)) {
+    return { authorized: false };
+  }
+  const toolName = toolNameOf(payload);
+  const digest = canonicalDigest(payload);
+
+  const dir = grantsDir(payload, options);
+  let files = [];
+  try { files = fs.readdirSync(dir).filter(isPendingGrantFileName); } catch (_) { files = []; }
+
+  for (const name of files) {
+    const file = path.join(dir, name);
+    const grant = readJson(file);
+    if (!grant || grant.consumed) continue;
+    if (grant.sessionId !== sessionId) continue;
+    if (grant.consentTurn !== turnId) continue; // cross-turn / expired
+    if (grant.toolName !== toolName) continue;
+    if (grant.digest !== digest) continue;
+
+    // Atomic consume: first rename wins.
+    const consumedFile = path.join(dir, `${path.basename(name, '.json')}.consumed`);
+    try {
+      fs.renameSync(file, consumedFile);
+    } catch (_) {
+      continue; // lost race or already consumed
+    }
+    grant.consumed = true;
+    grant.consumedAt = new Date().toISOString();
+    try { atomicWriteJson(consumedFile, grant); } catch (_) { /* best effort */ }
+    return { authorized: true };
+  }
+  return { authorized: false };
+}
+
+function isExactConsentPrompt(prompt) {
+  return /^HARNESS APPROVE [A-Za-z0-9._-]{8,}$/.test(String(prompt || ''));
+}
+
+function parseConsentPrompt(prompt) {
+  const match = String(prompt || '').match(/^HARNESS APPROVE ([A-Za-z0-9._-]{8,})$/);
+  return match ? match[1] : null;
+}
+
+module.exports = {
+  bindConsent,
+  consumeGrantIfValid,
+  issueChallenge,
+  isExactConsentPrompt,
+  parseConsentPrompt,
+  canonicalDigest,
+  toolNameOf,
+};

package/hooks/scripts/state-persist.js

@@ -5,6 +5,30 @@ const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 const { cwdOf, classifyShell, isVerificationShell, directMutationInWorkspace } = require('./lib/workflow-isolation');
 const { observeTool } = require('./lib/telemetry');
 
+function isSuccessfulMetadataStep(command, cwd) {
+  // A line break starts a second shell command, so it can never be metadata-only.
+  if (/[\r\n]/.test(String(command || ''))) return false;
+  const text = String(command || '').trim();
+  if (/[$`%!^]/.test(text)) return false;
+  const value = '(?:"[^"\\r\\n]*"|\'[^\'\\r\\n]*\'|[^\\s;&|<>`$(){}]+)';
+  const pattern = new RegExp(
+    `^node\\s+(?<script>${value})\\s+step\\s+--session-id\\s+(?<session>${value})` +
+    `\\s+--step-id\\s+(?<step>${value})\\s+--disposition\\s+(?<disposition>pass|blocked)` +
+    `(?:\\s+--reason-code\\s+(?<reason>${value}))?\\s+--evidence\\s+(?<evidence>${value})$`
+  );
+  const match = pattern.exec(text);
+  if (!match) return false;
+  const unquote = token => token && token.length >= 2 &&
+    ((token[0] === '"' && token[token.length - 1] === '"') || (token[0] === "'" && token[token.length - 1] === "'"))
+    ? token.slice(1, -1) : token || '';
+  const { script, session, step, disposition, reason, evidence } = match.groups;
+  return path.resolve(cwd, unquote(script)) === path.join(__dirname, 'workflow-disposition.js')
+    && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(unquote(session))
+    && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(unquote(step))
+    && Boolean(unquote(evidence).trim())
+    && (disposition === 'pass' ? reason === undefined : /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(unquote(reason)));
+}
+
 // S2b doc-reconciliation pilot capture (docs/doc-workflow-reconciliation.md
 // § S2b "Activation and pilot-only scope", "Claude capture and origin-provider
 // contract"): pilot-only, fail-open to the host, and gated on the exact
@@ -75,7 +99,9 @@ function processState(payload) {
     const command = (payload.tool_input && payload.tool_input.command) || '';
     if (isShell) {
       const commandClass = classifyShell(command);
-      if (commandClass !== 'read-only' && commandClass !== 'worktree-setup') state.lastEditAt = Date.now();
+      const metadataStep = !isFailed && (isSuccessEvent || exitCode === 0)
+        && isSuccessfulMetadataStep(command, cwdOf(payload, root));
+      if (!metadataStep && commandClass !== 'read-only' && commandClass !== 'worktree-setup') state.lastEditAt = Date.now();
       // Verification evidence needs a confirmed success: a PostToolUse event or an explicit zero exit.
       // Pilot ON only: a registered, argv-validated doc-check that resolves to this install's own runtime is the document
       // verification evidence, and only at the shipped pin (R3-02). Any other path earns no verification evidence. OFF stays legacy.

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.41.0",
+  "version": "0.41.2",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.41.0",
+  "version": "0.41.2",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.41.0",
+  "version": "0.41.2",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/action-gate.js

@@ -9,6 +9,7 @@ const {
   getWorkspaceRoot,
   getSessionDir,
 } = require('./lib/harness-state');
+const codexActionAuthorization = require('./lib/codex-action-authorization');
 
 const RULES_PATH = process.env.HARNESS_ACTION_GATE_RULES_PATH || path.join(__dirname, 'action-gate-rules.json');
 const ASK_CAPABLE_HOSTS = new Set(['claude']);
@@ -52,10 +53,12 @@ function toolInputOf(payload) {
 function stableValue(value) {
   if (Array.isArray(value)) return value.map(stableValue);
   if (!value || typeof value !== 'object') return value;
+  // Use a null-prototype accumulator so an own `__proto__` key is stored as data
+  // instead of mutating the accumulator's prototype (which would drop it).
   return Object.keys(value).sort().reduce((acc, key) => {
     acc[key] = stableValue(value[key]);
     return acc;
-  }, {});
+  }, Object.create(null));
 }
 
 function exactPayloadText(payload) {
@@ -445,11 +448,45 @@ function recordDecision(payload, rule, table, host, disposition, options = {}, e
   return record;
 }
 
+
+function isScopedCodexStructuredMutation(structured, rule) {
+  return Boolean(
+    rule && rule.id === 'structured-mutate' &&
+    structured && structured.descriptor &&
+    structured.descriptor.toolFamily !== 'shell' &&
+    structured.descriptor.action === 'mutate' &&
+    structured.descriptor.classification === 'gated'
+  );
+}
+
+function safeInline(value) {
+  return String(value == null ? '' : value).replace(/[\r\n\t\u0000-\u001f\u007f]/g, '?').slice(0, 200);
+}
+
 function evaluatePreToolUse(payload, options = {}) {
   const context = sessionContext(payload, options.sessionDir);
   const table = options.ruleTable || loadRuleTable(options.rulePath || RULES_PATH);
   const structured = structuredRule(payload);
   const rule = structured.rule || classify(payload, table.rules, context.sessionDir);
+  const host = detectHost(payload, options.host);
+
+  // Codex explicit authorization applies only to scoped structured mutations.
+  // Shell-governed and other structured actions keep ordinary blocking.
+  if (host === 'codex' && isScopedCodexStructuredMutation(structured, rule)) {
+    const consumed = codexActionAuthorization.consumeGrantIfValid(payload, { sessionDir: context.sessionDir });
+    if (consumed && consumed.authorized) {
+      return {
+        kind: 'allow',
+        exitCode: 0,
+        stdout: null,
+        stderr: null,
+        rule: null,
+        table,
+        descriptor: structured.descriptor,
+      };
+    }
+  }
+
   if (!rule) {
     return {
       kind: 'allow',
@@ -462,7 +499,6 @@ function evaluatePreToolUse(payload, options = {}) {
     };
   }
 
-  const host = detectHost(payload, options.host);
   const reason = decisionReason(rule, table);
   if (hostSupportsAsk(host) && gatePolicy(options) === ALWAYS_ASK_POLICY) {
     const record = recordDecision(payload, rule, table, host, 'pending-approval', { ...options, sessionDir: context.sessionDir });
@@ -478,11 +514,25 @@ function evaluatePreToolUse(payload, options = {}) {
   const record = recordDecision(payload, rule, table, host, 'rejected', { ...options, sessionDir: context.sessionDir }, {
     rejectionReason: 'host-ask-decision-unverified-or-unsupported',
   });
+  let challengeSuffix = '';
+  let detailsSuffix = '';
+  if (host === 'codex' && isScopedCodexStructuredMutation(structured, rule)) {
+    const challengeId = codexActionAuthorization.issueChallenge(payload, {
+      sessionDir: context.sessionDir,
+      toolName: toolNameOf(payload),
+      digest: (structured.descriptor && structured.descriptor.payloadHash) || hashExact(exactPayloadText(payload)),
+    });
+    if (challengeId) {
+      challengeSuffix = ` challenge id: ${challengeId}`;
+      const digest = (structured.descriptor && structured.descriptor.payloadHash) || hashExact(exactPayloadText(payload));
+      detailsSuffix = ` Tool: ${safeInline(toolNameOf(payload))}. Input SHA-256: ${digest}. Approve with: HARNESS APPROVE ${challengeId}.`;
+    }
+  }
   return {
     kind: 'block',
     exitCode: 2,
     stdout: null,
-    stderr: `${reason} Host '${host}' has no Harness-verified ask-style decision path, so the action is blocked.`,
+    stderr: `${reason} Host '${host}' has no Harness-verified ask-style decision path, so the action is blocked.${challengeSuffix}${detailsSuffix}`,
     rule,
     table,
     record,

package/plugins/harness-everything/hooks/scripts/codex-user-prompt.js

@@ -22,6 +22,26 @@ function finish() {
   if (finished) return;
   finished = true;
   clearTimeout(timer);
+
+  let payload = null;
+  try { payload = JSON.parse(input || '{}'); } catch (_) { payload = null; }
+
+  // Codex explicit authorization: only an exact host-submitted consent prompt
+  // may bind a pending challenge to the host session + consent turn. No
+  // natural-language inference, no tool-input claim.
+  if (payload && payload.hook_event_name === 'UserPromptSubmit') {
+    const prompt = payload.prompt;
+    const match = String(prompt || '').match(/^HARNESS APPROVE ([A-Za-z0-9._-]{8,})$/);
+    if (match) {
+      try {
+        const auth = require('./lib/codex-action-authorization');
+        auth.bindConsent(payload, { challengeId: match[1] });
+      } catch (_) { /* consent state is best-effort; failures do not authorize */ }
+      process.exit(0);
+      return;
+    }
+  }
+
   if (!ROUTER) process.exit(0);
   const result = spawnSync(process.execPath, [ROUTER], { input, encoding: 'utf8', env: process.env, timeout: 25000 });
   const stderr = String(result.stderr || '');

package/plugins/harness-everything/hooks/scripts/lib/codex-action-authorization.js

@@ -0,0 +1,193 @@
+'use strict';
+
+// Cooperative Codex explicit-authorization state. This is NOT tamperproof:
+// it is local hook state keyed by host session. A local process or user can
+// delete or rewrite it. It records consent only; it never bypasses Codex's
+// native permission controls.
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+const { getWorkspaceRoot, getSessionDir } = require('./harness-state');
+
+const DIR_NAME = 'codex-action-authorization';
+const CHALLENGES = 'challenges';
+const GRANTS = 'grants';
+
+function sessionDirOf(payload, options) {
+  if (options && options.sessionDir) return options.sessionDir;
+  const root = (options && options.root) || getWorkspaceRoot(payload);
+  const sessionId = payload && (payload.session_id || payload.sessionId);
+  return getSessionDir(root, sessionId, payload);
+}
+
+function safeToken(value) {
+  return String(value || 'x').replace(/[^A-Za-z0-9._-]+/g, '_').slice(0, 160) || 'x';
+}
+
+function authDir(payload, options, leaf) {
+  return path.join(sessionDirOf(payload, options), DIR_NAME, leaf);
+}
+
+function challengesDir(payload, options) { return authDir(payload, options, CHALLENGES); }
+function grantsDir(payload, options) { return authDir(payload, options, GRANTS); }
+
+function ensureDir(dir) { fs.mkdirSync(dir, { recursive: true }); }
+
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch (_) { return null; }
+}
+
+function atomicWriteJson(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const temp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(temp, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+  fs.renameSync(temp, filePath);
+}
+
+function newChallengeId() {
+  return `ch-${crypto.randomBytes(12).toString('hex')}`;
+}
+
+// Canonical challenge ids are minted by this helper as ch-<24 hex>. A pending
+// grant is stored as exactly <challengeId>.json. Anything with an extra suffix
+// (.consumed, .consumed.json, etc.) is a claim/consumed record, not pending.
+const CANONICAL_CHALLENGE_ID = /^ch-[0-9a-f]{24}$/;
+function isPendingGrantFileName(name) {
+  if (typeof name !== 'string') return false;
+  const match = name.match(/^([^/\\]+)\.json$/);
+  if (!match) return false;
+  return CANONICAL_CHALLENGE_ID.test(match[1]);
+}
+
+function toolNameOf(payload) {
+  return String((payload && (payload.tool_name || payload.toolName)) || '');
+}
+
+function validIdentity(value) {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+function actionGateModule() {
+  try { return require(path.join(__dirname, '..', 'action-gate.js')); } catch (_) { return null; }
+}
+
+function canonicalDigest(payload) {
+  const ag = actionGateModule();
+  if (ag && typeof ag.exactPayloadText === 'function' && typeof ag.hashExact === 'function') {
+    return ag.hashExact(ag.exactPayloadText(payload));
+  }
+  const input = (payload && (payload.tool_input || payload.toolInput || payload.input)) || {};
+  return crypto.createHash('sha256').update(JSON.stringify(input), 'utf8').digest('hex');
+}
+
+function issueChallenge(payload, options) {
+  options = options || {};
+  const challengeId = options.challengeId || newChallengeId();
+  const dir = challengesDir(payload, options);
+  ensureDir(dir);
+  const file = path.join(dir, `${safeToken(challengeId)}.json`);
+  const record = {
+    schemaVersion: 1,
+    challengeId,
+    sessionId: payload && (payload.session_id || payload.sessionId) || null,
+    toolName: options.toolName || toolNameOf(payload),
+    digest: options.digest || canonicalDigest(payload),
+    createdAt: new Date().toISOString(),
+  };
+  atomicWriteJson(file, record);
+  return challengeId;
+}
+
+function bindConsent(payload, options) {
+  options = options || {};
+  const challengeId = options.challengeId;
+  if (!challengeId) return { bound: false, reason: 'missing-challenge-id' };
+
+  const dir = challengesDir(payload, options);
+  const file = path.join(dir, `${safeToken(challengeId)}.json`);
+  const challenge = readJson(file);
+  if (!challenge) return { bound: false, reason: 'challenge-not-found' };
+
+  const sessionId = payload && (payload.session_id || payload.sessionId);
+  if (challenge.sessionId && challenge.sessionId !== sessionId) {
+    return { bound: false, reason: 'session-mismatch' };
+  }
+
+  const consentTurn = payload && (payload.turn_id || payload.turnId);
+  if (!validIdentity(sessionId) || !validIdentity(consentTurn)) {
+    return { bound: false, reason: 'missing-identity' };
+  }
+  const gdir = grantsDir(payload, options);
+  ensureDir(gdir);
+  const grantFile = path.join(gdir, `${safeToken(challengeId)}.json`);
+  const grant = {
+    schemaVersion: 1,
+    challengeId,
+    sessionId,
+    consentTurn: consentTurn || null,
+    toolName: challenge.toolName,
+    digest: challenge.digest,
+    createdAt: new Date().toISOString(),
+    consumed: false,
+  };
+  atomicWriteJson(grantFile, grant);
+  return { bound: true, challenge };
+}
+
+function consumeGrantIfValid(payload, options) {
+  options = options || {};
+  const sessionId = payload && (payload.session_id || payload.sessionId);
+  const turnId = payload && (payload.turn_id || payload.turnId);
+  if (!validIdentity(sessionId) || !validIdentity(turnId)) {
+    return { authorized: false };
+  }
+  const toolName = toolNameOf(payload);
+  const digest = canonicalDigest(payload);
+
+  const dir = grantsDir(payload, options);
+  let files = [];
+  try { files = fs.readdirSync(dir).filter(isPendingGrantFileName); } catch (_) { files = []; }
+
+  for (const name of files) {
+    const file = path.join(dir, name);
+    const grant = readJson(file);
+    if (!grant || grant.consumed) continue;
+    if (grant.sessionId !== sessionId) continue;
+    if (grant.consentTurn !== turnId) continue; // cross-turn / expired
+    if (grant.toolName !== toolName) continue;
+    if (grant.digest !== digest) continue;
+
+    // Atomic consume: first rename wins.
+    const consumedFile = path.join(dir, `${path.basename(name, '.json')}.consumed`);
+    try {
+      fs.renameSync(file, consumedFile);
+    } catch (_) {
+      continue; // lost race or already consumed
+    }
+    grant.consumed = true;
+    grant.consumedAt = new Date().toISOString();
+    try { atomicWriteJson(consumedFile, grant); } catch (_) { /* best effort */ }
+    return { authorized: true };
+  }
+  return { authorized: false };
+}
+
+function isExactConsentPrompt(prompt) {
+  return /^HARNESS APPROVE [A-Za-z0-9._-]{8,}$/.test(String(prompt || ''));
+}
+
+function parseConsentPrompt(prompt) {
+  const match = String(prompt || '').match(/^HARNESS APPROVE ([A-Za-z0-9._-]{8,})$/);
+  return match ? match[1] : null;
+}
+
+module.exports = {
+  bindConsent,
+  consumeGrantIfValid,
+  issueChallenge,
+  isExactConsentPrompt,
+  parseConsentPrompt,
+  canonicalDigest,
+  toolNameOf,
+};

package/plugins/harness-everything/hooks/scripts/state-persist.js

@@ -5,6 +5,30 @@ const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 const { cwdOf, classifyShell, isVerificationShell, directMutationInWorkspace } = require('./lib/workflow-isolation');
 const { observeTool } = require('./lib/telemetry');
 
+function isSuccessfulMetadataStep(command, cwd) {
+  // A line break starts a second shell command, so it can never be metadata-only.
+  if (/[\r\n]/.test(String(command || ''))) return false;
+  const text = String(command || '').trim();
+  if (/[$`%!^]/.test(text)) return false;
+  const value = '(?:"[^"\\r\\n]*"|\'[^\'\\r\\n]*\'|[^\\s;&|<>`$(){}]+)';
+  const pattern = new RegExp(
+    `^node\\s+(?<script>${value})\\s+step\\s+--session-id\\s+(?<session>${value})` +
+    `\\s+--step-id\\s+(?<step>${value})\\s+--disposition\\s+(?<disposition>pass|blocked)` +
+    `(?:\\s+--reason-code\\s+(?<reason>${value}))?\\s+--evidence\\s+(?<evidence>${value})$`
+  );
+  const match = pattern.exec(text);
+  if (!match) return false;
+  const unquote = token => token && token.length >= 2 &&
+    ((token[0] === '"' && token[token.length - 1] === '"') || (token[0] === "'" && token[token.length - 1] === "'"))
+    ? token.slice(1, -1) : token || '';
+  const { script, session, step, disposition, reason, evidence } = match.groups;
+  return path.resolve(cwd, unquote(script)) === path.join(__dirname, 'workflow-disposition.js')
+    && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(unquote(session))
+    && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(unquote(step))
+    && Boolean(unquote(evidence).trim())
+    && (disposition === 'pass' ? reason === undefined : /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(unquote(reason)));
+}
+
 // S2b doc-reconciliation pilot capture (docs/doc-workflow-reconciliation.md
 // § S2b "Activation and pilot-only scope", "Claude capture and origin-provider
 // contract"): pilot-only, fail-open to the host, and gated on the exact
@@ -75,7 +99,9 @@ function processState(payload) {
     const command = (payload.tool_input && payload.tool_input.command) || '';
     if (isShell) {
       const commandClass = classifyShell(command);
-      if (commandClass !== 'read-only' && commandClass !== 'worktree-setup') state.lastEditAt = Date.now();
+      const metadataStep = !isFailed && (isSuccessEvent || exitCode === 0)
+        && isSuccessfulMetadataStep(command, cwdOf(payload, root));
+      if (!metadataStep && commandClass !== 'read-only' && commandClass !== 'worktree-setup') state.lastEditAt = Date.now();
       // Verification evidence needs a confirmed success: a PostToolUse event or an explicit zero exit.
       // Pilot ON only: a registered, argv-validated doc-check that resolves to this install's own runtime is the document
       // verification evidence, and only at the shipped pin (R3-02). Any other path earns no verification evidence. OFF stays legacy.

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.41.0",
+  "version": "0.41.2",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:aa55b54e-8557-5a93-860d-8137bcfa2772",
+  "serialNumber": "urn:uuid:7e234a8b-69cb-55df-a4b5-86c44515fd0c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-23T18:32:45.895Z",
+    "timestamp": "2026-10-25T03:28:58.892Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.41.0"
+        "version": "0.41.2"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.41.0",
+      "bom-ref": "pkg:npm/harness-everything@0.41.2",
       "name": "harness-everything",
-      "version": "0.41.0",
-      "purl": "pkg:npm/harness-everything@0.41.0"
+      "version": "0.41.2",
+      "purl": "pkg:npm/harness-everything@0.41.2"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.41.0",
+      "ref": "pkg:npm/harness-everything@0.41.2",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",