harness-everything 0.42.0 → 0.42.1

package/plugins/harness-everything/hooks/scripts/action-gate.js

@@ -108,12 +108,14 @@ function safeResource(input, explicit) {
   return null;
 }
 
-function normalizeActionDescriptor(payload) {
+function normalizeActionDescriptor(payload, options = {}) {
   const tool = toolNameOf(payload);
   const input = toolInputOf(payload);
   const explicit = explicitActionDescriptor(payload);
-  const toolFamily = inferToolFamily(tool, explicit);
-  const action = inferStructuredAction(tool, explicit);
+  const codexPrUpdate = detectHost(payload, options.host) === 'codex' && isPullRequestUpdateTool(tool);
+  const toolFamily = inferToolFamily(tool, codexPrUpdate ? null : explicit);
+  const inferred = inferStructuredAction(tool, explicit);
+  const action = codexPrUpdate && !STRUCTURED_GATED_ACTIONS.has(inferred) ? 'mutate' : inferred;
   const classification = STRUCTURED_GATED_ACTIONS.has(action)
     ? 'gated'
     : (STRUCTURED_SAFE_ACTIONS.has(action) ? 'safe' : 'unknown');
@@ -140,8 +142,23 @@ function isRoutinePullRequestCreation(toolName) {
   return (last === 'create_pull_request' || name === 'create_pull_request');
 }
 
-function structuredRule(payload) {
-  const descriptor = normalizeActionDescriptor(payload);
+function isPullRequestUpdateTool(name) {
+  return name.split('__').pop() === 'update_pull_request' || name === 'mcp__codex_apps__github_update_pull_request';
+}
+
+function isPullRequestMetadataUpdate(payload) {
+  if (!isPullRequestUpdateTool(toolNameOf(payload))) return false;
+  const input = toolInputOf(payload);
+  if (!input || typeof input !== 'object' || Array.isArray(input)) return false;
+  const keys = Object.keys(input);
+  const allowed = new Set(['repository_full_name', 'pr_number', 'owner', 'repo', 'pullNumber', 'pull_number', 'title', 'body']);
+  return keys.every(key => allowed.has(key))
+    && keys.some(key => key === 'title' || key === 'body')
+    && keys.filter(key => key === 'title' || key === 'body').every(key => typeof input[key] === 'string');
+}
+
+function structuredRule(payload, options = {}) {
+  const descriptor = normalizeActionDescriptor(payload, options);
   if (descriptor.toolFamily === 'shell') return { descriptor, rule: null };
   if (descriptor.classification === 'safe') return { descriptor, rule: null };
   // Routine PR creation is a host-deferred mutation, not a Harness-gated one:
@@ -152,6 +169,10 @@ function structuredRule(payload) {
   if (isRoutinePullRequestCreation(descriptor.toolName) && !(hint && hint.required)) {
     return { descriptor, rule: null };
   }
+  if (detectHost(payload, options.host) === 'codex' && descriptor.action === 'mutate'
+      && isPullRequestMetadataUpdate(payload) && !(hint && hint.required)) {
+    return { descriptor, rule: null, hostDeferred: true };
+  }
   if (descriptor.classification === 'gated') {
     return {
       descriptor,
@@ -367,7 +388,8 @@ function routerActionGateHint(payload) {
     payload && payload.routerContract && payload.routerContract.workflowPlan && payload.routerContract.workflowPlan.actionGate,
     payload && payload.harness && payload.harness.workflowPlan && payload.harness.workflowPlan.actionGate,
   ];
-  const gate = candidates.find(candidate => candidate && typeof candidate === 'object');
+  const gate = candidates.find(candidate => candidate && typeof candidate === 'object' && candidate.required)
+    || candidates.find(candidate => candidate && typeof candidate === 'object');
   if (!gate) return null;
   return {
     required: Boolean(gate.required),
@@ -435,7 +457,7 @@ function recordDecision(payload, rule, table, host, disposition, options = {}, e
   const exact = exactPayloadText(payload);
   const commandHash = hashExact(exact);
   const now = new Date().toISOString();
-  const descriptor = normalizeActionDescriptor(payload);
+  const descriptor = normalizeActionDescriptor(payload, { host });
   const record = {
     schemaVersion: 1,
     toolName: toolNameOf(payload),
@@ -467,11 +489,15 @@ function recordDecision(payload, rule, table, host, disposition, options = {}, e
 function evaluatePreToolUse(payload, options = {}) {
   const context = sessionContext(payload, options.sessionDir);
   const table = options.ruleTable || loadRuleTable(options.rulePath || RULES_PATH);
-  const structured = structuredRule(payload);
+  const structured = structuredRule(payload, options);
   const rule = structured.rule || classify(payload, table.rules, context.sessionDir);
   const host = detectHost(payload, options.host);
 
   if (!rule) {
+    const record = structured.hostDeferred ? recordDecision(payload, {
+      id: 'routine-pr-metadata-update',
+      reason: 'Codex PR title/body metadata update defers to native task scope and permissions.',
+    }, table, host, 'deferred-to-host', { ...options, sessionDir: context.sessionDir }) : null;
     return {
       kind: 'allow',
       exitCode: 0,
@@ -480,6 +506,7 @@ function evaluatePreToolUse(payload, options = {}) {
       rule: null,
       table,
       descriptor: structured.descriptor,
+      ...(record ? { record } : {}),
     };
   }
 

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.42.0",
+  "version": "0.42.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:72e1dfda-07d6-5dc0-a4a1-3cc122ec6c96",
+  "serialNumber": "urn:uuid:e3ce04bb-3f54-5090-bffc-a7fca1d360db",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-25T08:17:49.469Z",
+    "timestamp": "2026-10-26T06:57:43.886Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.42.0"
+        "version": "0.42.1"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.42.0",
+      "bom-ref": "pkg:npm/harness-everything@0.42.1",
       "name": "harness-everything",
-      "version": "0.42.0",
-      "purl": "pkg:npm/harness-everything@0.42.0"
+      "version": "0.42.1",
+      "purl": "pkg:npm/harness-everything@0.42.1"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.42.0",
+      "ref": "pkg:npm/harness-everything@0.42.1",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",