harness-everything 0.41.2 → 0.42.0

package/hooks/scripts/lib/doc-reconciliation-provider.js

@@ -15,8 +15,8 @@
 //   qualification object ({ source: 'fake-test-fixture', faked: true }) is a
 //   test-only construct for mechanism tests; production passes no
 //   qualification and stays gated.
-// - Unsupported hosts (opencode/codex) never borrow the Claude exit mapping:
-//   both seam methods report `unavailable` with diagnostics.
+// - The Claude provider accepts only Claude. OpenCode has a separate
+//   fail-closed mapping and never borrows Claude's exit or reviewer rules.
 // - Exit mapping (owner decision row 1): for a given `tool_use_id`, a captured
 //   `PostToolUse` with `interrupted === false` and no `PostToolUseFailure`
 //   arrival maps to exit 0. This is a named mapping of the host's own
@@ -37,6 +37,10 @@ const path = require('path');
 
 const HOST_ID = 'claude-code';
 const CAPTURE_RECORD_VERSION = 'claude-capture-record/1';
+const OPENCODE_HOST_ID = 'opencode';
+const OPENCODE_CAPTURE_RECORD_VERSION = 'opencode-capture-record/1';
+const OPENCODE_CAPTURE_FILE = 'opencode-captures.jsonl';
+const OPENCODE_CAPTURE_LIMIT_BYTES = 4 * 1024 * 1024;
 const QUALIFICATION_EXPORT_SCHEMA = 'harness.doc-reconciliation.qualification.v1';
 const HEX64 = /^[0-9a-f]{64}$/;
 const PRE_CAPTURE_TOOLS = ['Bash', 'PowerShell', 'Task', 'Agent'];
@@ -522,10 +526,14 @@ function observedCorrelation(records) {
 
 // Validates the qualification export against the sanitized capture it names: schema, host, capture-record version, the
 // capture's digest, and every claimed kind, field and correlation. Returns null when valid, else the reason.
-function validateQualificationExport() {
+function validateQualificationExport(expectedHost = HOST_ID) {
   const exported = JSON.parse(fs.readFileSync(path.join(__dirname, EXPORT_FILE), 'utf8'));
   if (!recordOf(exported) || exported.schema !== QUALIFICATION_EXPORT_SCHEMA) return 'qualification export schema is not recognized';
-  if (exported.host !== HOST_ID || !textOf(exported.hostVersion)) return 'qualification export host or host version is missing';
+  if (!textOf(exported.hostVersion)) return 'qualification export host or host version is missing';
+  if (exported.host !== expectedHost) {
+    if (expectedHost === HOST_ID) return 'qualification export host or host version is missing';
+    return 'qualification export host does not match the selected provider';
+  }
   if (exported.captureRecordVersion !== CAPTURE_RECORD_VERSION) return 'qualification export capture record version is not supported';
   const source = recordOf(exported.sanitizedCapture) ? exported.sanitizedCapture : {};
   // The sanitized capture is a sibling of the export, so source and packaged copies resolve it the same way.
@@ -547,7 +555,7 @@ function validateQualificationExport() {
   return null;
 }
 
-function evaluateQualification(input) {
+function evaluateQualification(input, expectedHost = HOST_ID) {
   if (recordOf(input) && input.qualification !== undefined && input.qualification !== null) {
     const supplied = input.qualification;
     // Test-only DI path: an explicitly fake qualification object. Anything else
@@ -567,7 +575,7 @@ function evaluateQualification(input) {
   // against the sanitized capture it names. Nothing is read from the environment, capture flags or ancestor directories.
   let reason = null;
   try {
-    reason = validateQualificationExport();
+    reason = validateQualificationExport(expectedHost);
   } catch (error) {
     reason = `qualification evidence could not be read (${error.code || 'error'})`;
   }
@@ -582,11 +590,11 @@ function evaluateQualification(input) {
 
 // ---- Shared provider state ------------------------------------------------------
 
-function supportedHostCheck(input) {
-  if (recordOf(input) && input.hostId === HOST_ID) return null;
+function supportedHostCheck(input, expectedHost = HOST_ID) {
+  if ([HOST_ID, OPENCODE_HOST_ID].includes(expectedHost) && recordOf(input) && input.hostId === expectedHost) return null;
   const host = recordOf(input) && typeof input.hostId === 'string' ? input.hostId : 'unknown';
   return diagnostic('unsupported-host', {
-    reason: `unsupported host ${host} has no supported capture implementation; OpenCode/Codex must not borrow the Claude exit mapping`,
+    reason: `unsupported host ${host} has no matching capture implementation; hosts must not borrow another host's exit mapping`,
   });
 }
 
@@ -892,6 +900,127 @@ const createClaudeOriginProvider = input => {
   return { resolveContext, resolveEvent };
 };
 
+function opencodeContentSignature(cap) {
+  return captureJson({
+    hostId: cap.hostId,
+    tool: cap.tool === undefined ? null : cap.tool,
+    command: cap.command === undefined ? null : cap.command,
+    cwd: cap.cwd === undefined ? null : cap.cwd,
+    status: cap.status === undefined ? null : cap.status,
+    exit: cap.exit === undefined ? null : cap.exit,
+    resultDigest: cap.result_digest === undefined ? null : cap.result_digest,
+    error: cap.error === undefined ? null : cap.error,
+  });
+}
+
+const createOpencodeOriginProvider = input => {
+  const safeInput = recordOf(input) ? input : {};
+
+  function resolveContext(request) {
+    const hostFail = supportedHostCheck(safeInput, OPENCODE_HOST_ID);
+    if (hostFail) return { status: 'unavailable', diagnostics: [hostFail] };
+    const qualification = evaluateQualification(safeInput, OPENCODE_HOST_ID);
+    if (!qualification.open) return { status: 'unavailable', diagnostics: [qualification.fail] };
+    const workspaceRoot = textOf(safeInput.workspaceRoot) ? safeInput.workspaceRoot : (recordOf(request) && textOf(request.workspaceRoot) ? request.workspaceRoot : '');
+    const sessionId = textOf(safeInput.sessionId) ? safeInput.sessionId : '';
+    const workflowId = textOf(safeInput.workflowId) ? safeInput.workflowId : '';
+    const workflowRevision = Number.isInteger(safeInput.workflowRevision) ? safeInput.workflowRevision : null;
+    const taskId = textOf(safeInput.taskId) ? safeInput.taskId : '';
+    if (!workspaceRoot || !sessionId || !workflowId || workflowRevision === null || !taskId) {
+      return { status: 'unavailable', diagnostics: [diagnostic('invalid-input', { reason: 'OpenCode origin requires the recorded workspace, session, workflow, revision and task identity' })] };
+    }
+    const suppliedPrincipals = recordOf(safeInput.principals) ? safeInput.principals : {};
+    const author = textOf(suppliedPrincipals.author) ? suppliedPrincipals.author : sessionId;
+    const executors = Array.isArray(suppliedPrincipals.executors) ? suppliedPrincipals.executors.filter(textOf) : [sessionId];
+    const originRef = 'origin://opencode/' + digestText(captureJson({
+      hostId: OPENCODE_HOST_ID, sessionId, workspaceRoot, taskId, workflowId, workflowRevision,
+      author, executors, qualificationSource: qualification.source,
+    }));
+    return {
+      status: 'accepted', originRef,
+      context: {
+        workspaceId: 'ws-' + digestText(captureJson({ workspaceRoot })), sessionId, workflowId, workflowRevision, taskId,
+        principals: { author, executors: executors.slice() }, activeHost: OPENCODE_HOST_ID,
+        baselineReference: `retained-live-capture:opencode-341:${digestText(originRef)}`,
+        ...(recordOf(safeInput.baseline) && textOf(safeInput.baseline.commit) && textOf(safeInput.baseline.root)
+          ? { baseline: { commit: safeInput.baseline.commit, root: safeInput.baseline.root } } : {}),
+        workspaceRoot,
+      },
+    };
+  }
+
+  function resolveEvent(request) {
+    if (!recordOf(request) || !textOf(request.reference)) return unavailable('invalid-input', 'resolveEvent requires a nonempty event reference');
+    const hostFail = supportedHostCheck(safeInput, OPENCODE_HOST_ID);
+    if (hostFail) return { status: 'unavailable', diagnostics: [hostFail] };
+    const qualification = evaluateQualification(safeInput, OPENCODE_HOST_ID);
+    if (!qualification.open) return { status: 'unavailable', diagnostics: [qualification.fail] };
+    const [captureRef, capability] = String(request.reference).split('#');
+    const captures = Array.isArray(safeInput.captures) ? safeInput.captures : [];
+    const matches = captures.map((item, index) => ({ item, index })).filter(({ item }) => recordOf(item) && item.call_id === captureRef);
+    if (!matches.length) return unavailable('origin-unavailable', `no captured OpenCode event is retained for reference ${request.reference}`);
+    if (matches.length > 1) return rejected('replayed-record', 'multiple OpenCode records share this call id');
+    const { item: cap, index } = matches[0];
+    if (cap.hostId !== OPENCODE_HOST_ID || cap.schema !== OPENCODE_CAPTURE_RECORD_VERSION
+      || cap.session_id !== safeInput.sessionId) {
+      return rejected('record-origin-mismatch', 'the capture host and session must match this OpenCode provider invocation');
+    }
+    const observed = cap.observedIdentity;
+    const pin = recordOf(safeInput.baseline) ? safeInput.baseline : null;
+    if (!recordOf(observed)) return rejected('identity-missing', 'OpenCode capture lacks workflow identity observed at capture time');
+    const sameWorkflow = observed.workflowId === safeInput.workflowId && observed.workflowRevision === safeInput.workflowRevision;
+    const samePin = !pin || (recordOf(observed.baselinePin) && observed.baselinePin.commit === pin.commit && observed.baselinePin.root === pin.root);
+    if (!sameWorkflow || !samePin) return rejected('identity-mismatch', 'the observed workflow revision or baseline pin differs from the current one; stale evidence loses credit');
+    const signature = opencodeContentSignature(cap);
+    const firstOccurrence = captures.findIndex(item => recordOf(item) && opencodeContentSignature(item) === signature);
+    if (firstOccurrence !== index) return rejected('replayed-record', `identical OpenCode tool content already recorded (first occurrence index ${firstOccurrence})`);
+    if (cap.error !== undefined && cap.error !== null) return rejected('failure-not-credited', 'the native tool event carries an error');
+    if (typeof cap.status !== 'string' || !cap.status) return rejected('outcome-ambiguous', 'the native tool status is missing');
+    if (cap.status !== 'completed') return rejected(cap.status === 'error' ? 'failure-not-credited' : 'outcome-ambiguous', `native tool status ${cap.status} does not prove completion`);
+    const processTool = ['bash', 'shell', 'powershell', 'cmd'].includes(String(cap.tool).toLowerCase());
+    if (processTool && !Number.isInteger(cap.exit)) return rejected('outcome-ambiguous', 'a process result without a numeric native exit is ambiguous');
+    if (processTool && cap.exit !== 0) return rejected('failure-not-credited', `the native process exit was ${cap.exit}`);
+    if (!/^[0-9a-f]{64}$/.test(String(cap.result_digest || '')) || !Number.isInteger(cap.result_bytes) || cap.result_bytes < 0) {
+      return rejected('stdout-withheld', 'the native result digest and byte count are absent');
+    }
+    const author = recordOf(safeInput.principals) && textOf(safeInput.principals.author) ? safeInput.principals.author : safeInput.sessionId;
+    if (capability === 'quality-review') {
+      if (!textOf(cap.agent_id)) return rejected('reviewer-principal-missing', 'OpenCode supplied no host-issued reviewer identity');
+      if (cap.agent_id === author) return rejected('reviewer-not-independent', 'the reviewer identity equals the author session principal');
+      return rejected('reviewer-principal-missing', 'OpenCode supplied no host-issued independent-review record');
+    }
+    if (capability) {
+      if (!['doc-lint', 'link-check'].includes(capability)) return rejected('capability-mismatch', `OpenCode cannot supply capability ${capability}`);
+      if (!textOf(cap.command)) return rejected('command-missing', 'the native record has no command for a registered doc-check');
+      if (!textOf(cap.cwd)) return rejected('unregistered-command', 'the host omitted per-tool cwd, so the doc-check invocation cannot be validated');
+      const registered = resolveDocCheckInvocation(cap.command, cap.cwd);
+      if (registered.kind !== 'accepted') return rejected('unregistered-command', `doc-check invocation rejected (${registered.reason}); no credit`);
+      return rejected('stdout-withheld', 'the OpenCode result body is retained only as a digest and cannot prove doc-check output');
+    }
+    if (!textOf(cap.command)) return rejected('command-missing', 'captured OpenCode record has no retained process command');
+    if (!textOf(cap.cwd)) return rejected('outcome-ambiguous', 'the host omitted per-tool cwd');
+    if (!processTool) return rejected('capture-event-unsupported', `tool ${String(cap.tool)} has no OpenCode process mapping`);
+    if (!recordOf(request.identity)) return rejected('identity-missing', 'execution evidence needs a snapshot identity');
+    const contextResponse = resolveContext(request);
+    if (contextResponse.status !== 'accepted') return unavailable('origin-unavailable', 'origin context did not resolve');
+    const identity = JSON.parse(JSON.stringify(request.identity));
+    const resultRef = `opencode-result/${cap.call_id}/${cap.result_digest}`;
+    const event = {
+      eventId: 'opencode-exec-' + digestText(signature + ':execution'),
+      producerId: 'opencode-origin-provider', originRef: contextResponse.originRef,
+      principalId: cap.session_id, provenance: 'opencode-capture:' + cap.call_id,
+      capability: 'shell-command', kind: 'execution', command: cap.command, argv: [cap.command], cwd: cap.cwd,
+      exitCode: cap.exit, signal: null, toolCorrelationId: cap.call_id, resultRef,
+      identity, startIdentity: identity, endIdentity: identity,
+      paths: [], artifactDigests: {}, captured: { responseRef: resultRef, responseDigest: cap.result_digest },
+    };
+    return { status: 'accepted', originRef: contextResponse.originRef, event,
+      correlation: { toolCorrelationId: cap.call_id, resultRef } };
+  }
+
+  return { resolveContext, resolveEvent };
+};
+
 // ---- Capture record builder (consumed by state-persist.js) ----------------------
 
 // Builds the retained capture record for a Claude hook payload. The field names
@@ -1028,6 +1157,24 @@ function readCaptureView(sessionDir) {
   return { records: view, tampered: false };
 }
 
+function readOpencodeCaptureView(sessionDir) {
+  const file = path.join(sessionDir, OPENCODE_CAPTURE_FILE);
+  try {
+    if (fs.statSync(file).size > OPENCODE_CAPTURE_LIMIT_BYTES) return { records: [], tampered: true };
+    const text = fs.readFileSync(file, 'utf8');
+    const records = text.split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
+    if (!records.every(item => recordOf(item) && item.schema === OPENCODE_CAPTURE_RECORD_VERSION
+      && item.hostId === OPENCODE_HOST_ID && textOf(item.session_id) && textOf(item.call_id)
+      && textOf(item.tool) && Object.prototype.hasOwnProperty.call(item, 'status'))) {
+      return { records: [], tampered: true };
+    }
+    return { records, tampered: false };
+  } catch (error) {
+    if (error.code === 'ENOENT') return { records: [], tampered: false };
+    return { records: [], tampered: true };
+  }
+}
+
 // Observation-time identity: the workflow and pin the host event was captured under. Absent before a workflow starts.
 function observedIdentityFor(sessionDir) {
   try {
@@ -1053,7 +1200,8 @@ function reviewRecordIndependent(cap, captures, principals) {
 }
 
 // Keep the old state-persist seam as an alias; it points at the single resolver above.
-module.exports = { createClaudeOriginProvider, buildCaptureRecord, resolveDocCheckInvocation,
+module.exports = { createClaudeOriginProvider, createOpencodeOriginProvider, buildCaptureRecord, resolveDocCheckInvocation,
   registeredInstalledCheck: resolveDocCheckInvocation, installedDocCheck,
   fileDigest, SHIPPED_DOC_CHECK_DIGEST, trustRisk, journalExecutors, reviewRecordIndependent,
-  writeImmutableEvent, rebuildJournalView, readCaptureView, observedIdentityFor, _internals: { captureJson, captureDigest, digestText, canonicalCapture } };
+  writeImmutableEvent, rebuildJournalView, readCaptureView, readOpencodeCaptureView, observedIdentityFor,
+  _internals: { captureJson, captureDigest, digestText, canonicalCapture } };

package/hooks/scripts/workflow-stop-gate.js

@@ -14,6 +14,7 @@ function decide(payload) {
   try {
     const { planningUnresolved, unresolvedObligations } = require('./lib/workflow-obligations');
     const context = loadWorkflow(payload);
+    context.activeHost = payload && typeof payload.host_id === 'string' ? payload.host_id : undefined;
     const { workflow, sessionDir } = context;
     if (!workflow || workflow.state === 'deferred') return;
     const handoffFile = path.join(sessionDir, 'handoff-state.json');
@@ -93,4 +94,6 @@ function decide(payload) {
   } catch (error) { warn(error && error.message ? error.message : String(error)); }
 }
 
-readHookInput(decide);
+if (require.main === module) readHookInput(decide);
+
+module.exports = { decide };

package/opencode-plugin/index.mjs

@@ -1,9 +1,10 @@
 /**
  * Harness Enforcement Plugin for opencode
  *
- * A single self-contained ESM module, because that is what opencode actually
- * loads: a JS/TS file dropped in `.opencode/plugins/` (or referenced from
- * `opencode.json`) that exports a function returning a hooks object. There is
+ * An ESM entry module, because that is what opencode actually loads: a JS/TS
+ * file dropped in `.opencode/plugins/` (or referenced from `opencode.json`)
+ * that exports a function returning a hooks object. The optional workflow
+ * reconciliation path resolves the packaged sibling Stop consumer. There is
  * no JSON-manifest-to-script mechanism - the old plugin.json + hooks/*.js
  * split assumed one and was never invoked by opencode. See issue #37.
  *
@@ -37,11 +38,28 @@
 
 import { homedir } from "node:os"
 import { join, dirname, resolve, basename, relative, isAbsolute } from "node:path"
-import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, rmSync, realpathSync, readdirSync } from "node:fs"
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, rmSync, realpathSync, readdirSync, statSync } from "node:fs"
 import { execSync } from "node:child_process"
 import { createHash, randomUUID } from "node:crypto"
+import { createRequire } from "node:module"
+import { fileURLToPath } from "node:url"
 
 const EDIT_TOOLS = new Set(["edit", "write", "apply_patch"])
+const OPENCODE_CAPTURE_FILE = "opencode-captures.jsonl"
+const OPENCODE_CAPTURE_LIMIT_BYTES = 4 * 1024 * 1024
+const OPENCODE_CAPTURE_RECORD_LIMIT_BYTES = 16 * 1024
+const requireFromPlugin = createRequire(import.meta.url)
+const STOP_GATE_FILE = join(dirname(fileURLToPath(import.meta.url)), "..", "hooks", "scripts", "workflow-stop-gate.js")
+
+function canonicalJson(value) {
+  if (Array.isArray(value)) return value.map(canonicalJson)
+  if (isRecord(value)) return Object.fromEntries(Object.keys(value).sort().map(key => [key, canonicalJson(value[key])]))
+  return value
+}
+
+function captureDigest(value) {
+  return createHash("sha256").update(JSON.stringify(canonicalJson(value))).digest("hex")
+}
 
 // Global state root, matching the Node-side resolver at
 // scripts/lib/workspace.js#getStateHome (same env var precedence) - this
@@ -744,6 +762,50 @@ export const HarnessEnforcement = async ({ client, directory }) => {
     }
   }
 
+  function recordHostCapture(input, output) {
+    try {
+      if (!isRecord(output) || output.status === undefined || typeof input?.sessionID !== "string" || !input.sessionID
+        || typeof input.callID !== "string" || !input.callID || typeof input.tool !== "string" || !input.tool) return
+      const stateDir = pathsFor(input.sessionID).stateDir
+      const file = join(stateDir, OPENCODE_CAPTURE_FILE)
+      const args = isRecord(input.args) ? input.args : {}
+      const record = {
+        schema: "opencode-capture-record/1",
+        hostId: "opencode",
+        session_id: input.sessionID,
+        call_id: input.callID,
+        ...(typeof output.messageID === "string" ? { message_id: output.messageID } : {}),
+        tool: input.tool,
+        status: output.status,
+        ...(typeof args.command === "string" ? { command: args.command } : {}),
+        ...(typeof args.cwd === "string" ? { cwd: args.cwd } : {}),
+        ...(isRecord(output.result?.metadata) && typeof output.result.metadata.exit === "number" && Number.isFinite(output.result.metadata.exit)
+          ? { exit: output.result.metadata.exit } : {}),
+        ...(output.result !== undefined
+          ? { result_digest: captureDigest(output.result), result_bytes: Buffer.byteLength(JSON.stringify(canonicalJson(output.result))) } : {}),
+        ...(output.error !== undefined && output.error !== null
+          ? { error: isRecord(output.error)
+            ? Object.fromEntries(["name", "message", "code"].filter(key => typeof output.error[key] === "string").map(key => [key, output.error[key].slice(0, 300)]))
+            : typeof output.error === "string" ? { message: output.error.slice(0, 300) } : {} } : {}),
+        ts: new Date().toISOString(),
+      }
+      try {
+        const workflow = JSON.parse(readFileSync(join(stateDir, "workflow-run.json"), "utf8"))
+        if (typeof workflow.workflowId === "string" && Number.isInteger(workflow.revision)) {
+          const pin = isRecord(workflow.docReconciliationBaseline) ? workflow.docReconciliationBaseline : {}
+          record.observedIdentity = { workflowId: workflow.workflowId, workflowRevision: workflow.revision,
+            baselinePin: typeof pin.commit === "string" && typeof pin.root === "string" ? { commit: pin.commit, root: pin.root } : null }
+        }
+      } catch { /* pre-workflow events cannot be bound to a later workflow */ }
+      const line = `${JSON.stringify(record)}\n`
+      if (Buffer.byteLength(line) > OPENCODE_CAPTURE_RECORD_LIMIT_BYTES) return
+      mkdirSync(stateDir, { recursive: true })
+      const size = existsSync(file) ? statSync(file).size : 0
+      if (size + Buffer.byteLength(line) > OPENCODE_CAPTURE_LIMIT_BYTES) return
+      appendFileSync(file, line, "utf8")
+    } catch { /* capture is diagnostic only; an unavailable journal never grants credit */ }
+  }
+
   function resetSession(sessionID) {
     const { stateDir } = pathsFor(sessionID)
     const sessionsRoot = resolve(join(getStateRoot(workspace), "sessions"))
@@ -789,6 +851,7 @@ export const HarnessEnforcement = async ({ client, directory }) => {
 
     "tool.execute.after": async (input, output) => {
       telemetryAfter(input)
+      recordHostCapture(input, output)
       if (!EDIT_TOOLS.has(input.tool)) return
       const { editStateFile, breakerFile, complianceFile, reflectionFile } = pathsFor(input.sessionID)
 
@@ -927,6 +990,9 @@ export const HarnessEnforcement = async ({ client, directory }) => {
           saveJSON(editStateFile, failedState)
         }
       } finally {
+        try {
+          requireFromPlugin(STOP_GATE_FILE).decide({ session_id: activeSession, cwd: workspace, host_id: "opencode" })
+        } catch { /* the optional reconciliation consumer must never block OpenCode idle */ }
         activeVerifications.delete(activeSession)
       }
     },
@@ -971,7 +1037,13 @@ export default {
     await ctx.tool.hook("execute.before", (event) =>
       hooks["tool.execute.before"](toolEventInput(event), { args: event.input }))
     await ctx.tool.hook("execute.after", (event) =>
-      hooks["tool.execute.after"](toolEventInput(event), { args: event.input }))
+      hooks["tool.execute.after"](toolEventInput(event), {
+        args: event.input,
+        status: event.status,
+        result: event.result,
+        error: event.error,
+        messageID: event.messageID,
+      }))
 
     const events = new AbortController()
     void (async () => {

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.41.2",
+  "version": "0.42.0",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.41.2",
+  "version": "0.42.0",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.41.2",
+  "version": "0.42.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/action-gate.js

@@ -9,8 +9,6 @@ const {
   getWorkspaceRoot,
   getSessionDir,
 } = require('./lib/harness-state');
-const codexActionAuthorization = require('./lib/codex-action-authorization');
-
 const RULES_PATH = process.env.HARNESS_ACTION_GATE_RULES_PATH || path.join(__dirname, 'action-gate-rules.json');
 const ASK_CAPABLE_HOSTS = new Set(['claude']);
 const VALID_SCOPES = new Set(['always', 'outside-scratch']);
@@ -135,10 +133,25 @@ function normalizeActionDescriptor(payload) {
   };
 }
 
+function isRoutinePullRequestCreation(toolName) {
+  const name = String(toolName || '');
+  const segments = name.split('__');
+  const last = segments[segments.length - 1];
+  return (last === 'create_pull_request' || name === 'create_pull_request');
+}
+
 function structuredRule(payload) {
   const descriptor = normalizeActionDescriptor(payload);
   if (descriptor.toolFamily === 'shell') return { descriptor, rule: null };
   if (descriptor.classification === 'safe') return { descriptor, rule: null };
+  // Routine PR creation is a host-deferred mutation, not a Harness-gated one:
+  // the generic create=>mutate heuristic must not add an extra challenge. The
+  // descriptor stays a mutation (not read/safe). An explicit required
+  // actionGate hint still gates it.
+  const hint = routerActionGateHint(payload);
+  if (isRoutinePullRequestCreation(descriptor.toolName) && !(hint && hint.required)) {
+    return { descriptor, rule: null };
+  }
   if (descriptor.classification === 'gated') {
     return {
       descriptor,
@@ -148,7 +161,6 @@ function structuredRule(payload) {
       },
     };
   }
-  const hint = routerActionGateHint(payload);
   if (hint && hint.required) {
     return {
       descriptor,
@@ -449,19 +461,8 @@ function recordDecision(payload, rule, table, host, disposition, options = {}, e
 }
 
 
-function isScopedCodexStructuredMutation(structured, rule) {
-  return Boolean(
-    rule && rule.id === 'structured-mutate' &&
-    structured && structured.descriptor &&
-    structured.descriptor.toolFamily !== 'shell' &&
-    structured.descriptor.action === 'mutate' &&
-    structured.descriptor.classification === 'gated'
-  );
-}
 
-function safeInline(value) {
-  return String(value == null ? '' : value).replace(/[\r\n\t\u0000-\u001f\u007f]/g, '?').slice(0, 200);
-}
+
 
 function evaluatePreToolUse(payload, options = {}) {
   const context = sessionContext(payload, options.sessionDir);
@@ -470,23 +471,6 @@ function evaluatePreToolUse(payload, options = {}) {
   const rule = structured.rule || classify(payload, table.rules, context.sessionDir);
   const host = detectHost(payload, options.host);
 
-  // Codex explicit authorization applies only to scoped structured mutations.
-  // Shell-governed and other structured actions keep ordinary blocking.
-  if (host === 'codex' && isScopedCodexStructuredMutation(structured, rule)) {
-    const consumed = codexActionAuthorization.consumeGrantIfValid(payload, { sessionDir: context.sessionDir });
-    if (consumed && consumed.authorized) {
-      return {
-        kind: 'allow',
-        exitCode: 0,
-        stdout: null,
-        stderr: null,
-        rule: null,
-        table,
-        descriptor: structured.descriptor,
-      };
-    }
-  }
-
   if (!rule) {
     return {
       kind: 'allow',
@@ -514,25 +498,11 @@ function evaluatePreToolUse(payload, options = {}) {
   const record = recordDecision(payload, rule, table, host, 'rejected', { ...options, sessionDir: context.sessionDir }, {
     rejectionReason: 'host-ask-decision-unverified-or-unsupported',
   });
-  let challengeSuffix = '';
-  let detailsSuffix = '';
-  if (host === 'codex' && isScopedCodexStructuredMutation(structured, rule)) {
-    const challengeId = codexActionAuthorization.issueChallenge(payload, {
-      sessionDir: context.sessionDir,
-      toolName: toolNameOf(payload),
-      digest: (structured.descriptor && structured.descriptor.payloadHash) || hashExact(exactPayloadText(payload)),
-    });
-    if (challengeId) {
-      challengeSuffix = ` challenge id: ${challengeId}`;
-      const digest = (structured.descriptor && structured.descriptor.payloadHash) || hashExact(exactPayloadText(payload));
-      detailsSuffix = ` Tool: ${safeInline(toolNameOf(payload))}. Input SHA-256: ${digest}. Approve with: HARNESS APPROVE ${challengeId}.`;
-    }
-  }
   return {
     kind: 'block',
     exitCode: 2,
     stdout: null,
-    stderr: `${reason} Host '${host}' has no Harness-verified ask-style decision path, so the action is blocked.${challengeSuffix}${detailsSuffix}`,
+    stderr: `${reason} Host '${host}' has no Harness-verified ask-style decision path, so the action is blocked.`,
     rule,
     table,
     record,
@@ -705,4 +675,5 @@ module.exports = {
   validateRuleTable,
   normalizeActionDescriptor,
   structuredRule,
+  isRoutinePullRequestCreation,
 };

package/plugins/harness-everything/hooks/scripts/codex-user-prompt.js

@@ -26,22 +26,10 @@ function finish() {
   let payload = null;
   try { payload = JSON.parse(input || '{}'); } catch (_) { payload = null; }
 
-  // Codex explicit authorization: only an exact host-submitted consent prompt
-  // may bind a pending challenge to the host session + consent turn. No
-  // natural-language inference, no tool-input claim.
-  if (payload && payload.hook_event_name === 'UserPromptSubmit') {
-    const prompt = payload.prompt;
-    const match = String(prompt || '').match(/^HARNESS APPROVE ([A-Za-z0-9._-]{8,})$/);
-    if (match) {
-      try {
-        const auth = require('./lib/codex-action-authorization');
-        auth.bindConsent(payload, { challengeId: match[1] });
-      } catch (_) { /* consent state is best-effort; failures do not authorize */ }
-      process.exit(0);
-      return;
-    }
-  }
-
+  // All prompts, including any legacy approval spelling, pass through unchanged
+  // to the normal router. Harness does not parse or intercept authorization
+  // syntax in user prompts; native agent/task scope and native permissions
+  // remain authoritative.
   if (!ROUTER) process.exit(0);
   const result = spawnSync(process.execPath, [ROUTER], { input, encoding: 'utf8', env: process.env, timeout: 25000 });
   const stderr = String(result.stderr || '');