harness-everything 0.46.3 → 0.47.1

package/plugins/harness-everything/skills/self-evolve/scripts/lesson-candidate.js

@@ -18,14 +18,7 @@ for (const relative of [
   }
 }
 
-let getWorkspaceRoot;
-let getWorkspaceStateDir;
-try {
-  ({ getWorkspaceRoot, getWorkspaceStateDir } = require('../../scripts/lib/workspace'));
-} catch (_) {
-  getWorkspaceRoot = () => null;
-  getWorkspaceStateDir = () => null;
-}
+const { getWorkspaceRoot, getWorkspaceStateDir, workspaceError } = require('./workspace-helper');
 
 const SCHEMA_VERSION = 1;
 const TERMINAL = new Set(['rejected', 'validated', 'regressed', 'superseded']);
@@ -48,10 +41,10 @@ function readJson(filePath) {
 }
 
 function candidatePath(workspace, sessionId, candidateId) {
-  if (!workspace || !getWorkspaceStateDir(workspace)) throw new Error('workspace state root is unavailable');
+  const stateDir = getWorkspaceStateDir(workspace);
   if (!/^lesson-[a-f0-9]{24}$/.test(String(candidateId || ''))) throw new Error('invalid candidate id');
   return path.join(
-    getWorkspaceStateDir(workspace),
+    stateDir,
     'state',
     'sessions',
     safeSessionName(sessionId),
@@ -292,7 +285,10 @@ function observeCandidate(input) {
 function listCandidates({ workspace, sessionId }) {
   const base = path.join(getWorkspaceStateDir(workspace), 'state', 'sessions', safeSessionName(sessionId), 'learning-candidates');
   let files = [];
-  try { files = fs.readdirSync(base).filter(name => /^lesson-[a-f0-9]{24}\.json$/.test(name)); } catch (_) { return []; }
+  try { files = fs.readdirSync(base).filter(name => /^lesson-[a-f0-9]{24}\.json$/.test(name)); } catch (error) {
+    if (error.code === 'ENOENT') return [];
+    throw workspaceError('WORKSPACE_STATE_UNAVAILABLE', `cannot read candidate directory ${base}`, error);
+  }
   return files.map(name => readJson(path.join(base, name))).filter(Boolean);
 }
 
@@ -303,7 +299,8 @@ function option(args, name) {
 
 function parseCli(argv) {
   const command = argv[0];
-  const workspace = path.resolve(option(argv, '--workspace') || getWorkspaceRoot() || process.cwd());
+  const explicit = option(argv, '--workspace');
+  const workspace = getWorkspaceRoot(explicit ? { workspace_root: path.resolve(explicit) } : undefined);
   const base = {
     command,
     workspace,

package/plugins/harness-everything/skills/self-evolve/scripts/persist-memory.js

@@ -4,20 +4,7 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
-let getWorkspaceRoot;
-let getWorkspaceStateDir;
-let getWorkspaceKey;
-try {
-  ({ getWorkspaceRoot, getWorkspaceStateDir, getWorkspaceKey } = require('../../scripts/lib/workspace'));
-} catch (err) {
-  getWorkspaceRoot = () => null;
-  getWorkspaceStateDir = () => null;
-  getWorkspaceKey = () => null;
-}
-
-// NOTE: this script ships standalone - it is copied whole into every install
-// target. When the canonical workspace resolver is not present, persistence
-// fails closed rather than guessing a project root (issue #42).
+const { getWorkspaceRoot, getWorkspaceStateDir, getWorkspaceKey } = require('./workspace-helper');
 
 const SECRET_PATTERNS = [
   ['github-token', /\bgh[pousr]_[A-Za-z0-9]{20,}\b/],

package/plugins/harness-everything/skills/self-evolve/scripts/register-dynamic-skill.js

@@ -1,16 +1,12 @@
 #!/usr/bin/env node
 const fs = require('fs');
 const path = require('path');
-let getWorkspaceRoot;
-try {
-  ({ getWorkspaceRoot } = require('../../scripts/lib/workspace'));
-} catch (err) {
-  getWorkspaceRoot = () => null;
-}
+const { getWorkspaceRoot } = require('./workspace-helper');
 
-const workspaceRoot = getWorkspaceRoot();
-if (!workspaceRoot) {
-  console.error('[self-evolve] Cannot register a dynamic skill without a resolved git workspace.');
+let workspaceRoot;
+try { workspaceRoot = getWorkspaceRoot(); }
+catch (error) {
+  console.error(`[self-evolve] ${error.message}`);
   process.exit(1);
 }
 

package/plugins/harness-everything/skills/self-evolve/scripts/workspace-helper.js

@@ -0,0 +1,98 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+function workspaceError(code, message, cause) {
+  const error = new Error(`${code}: ${message}${cause ? ` (${cause.code || cause.name}: ${cause.message})` : ''}`, { cause });
+  error.code = code;
+  return error;
+}
+
+function readMarker(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); }
+  catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw workspaceError('WORKSPACE_HELPER_UNAVAILABLE', `cannot read installation marker ${file}`, error);
+  }
+}
+
+let helper;
+function loadHelper() {
+  if (helper) return helper;
+  const sourceRoot = path.resolve(__dirname, '../..');
+  const sourceMarker = path.join(sourceRoot, 'package.json');
+  const source = readMarker(sourceMarker);
+  let installRoot;
+  // A source checkout may itself be named "skills". Its own package marker
+  // takes precedence, including when its helper is absent or broken.
+  if (source) {
+    if (source.name !== 'harness-everything') {
+      throw workspaceError('WORKSPACE_HELPER_UNAVAILABLE', `unrecognized source installation marker ${sourceMarker}`);
+    }
+    installRoot = sourceRoot;
+  } else {
+    const pluginRoot = path.dirname(sourceRoot);
+    const marker = path.join(pluginRoot, '.codex-plugin/plugin.json');
+    const plugin = path.basename(sourceRoot) === 'skills' ? readMarker(marker) : null;
+    if (!plugin || plugin.name !== 'harness-everything' || plugin.skills !== './skills/') {
+      throw workspaceError('WORKSPACE_HELPER_UNAVAILABLE', `unrecognized layout; expected ${sourceMarker} or packaged skills under ${marker}`);
+    }
+    installRoot = pluginRoot;
+  }
+  const candidate = path.join(installRoot, 'scripts/lib/workspace.js');
+  try {
+    const loaded = require(candidate);
+    for (const name of ['getWorkspaceRoot', 'getWorkspaceStateDir', 'getWorkspaceKey']) {
+      if (typeof loaded[name] !== 'function') throw new Error(`missing ${name} export`);
+    }
+    helper = loaded;
+    return helper;
+  } catch (error) {
+    throw workspaceError('WORKSPACE_HELPER_UNAVAILABLE', `cannot load selected installation helper ${candidate}`, error);
+  }
+}
+
+function getWorkspaceRoot(context) {
+  const loaded = loadHelper();
+  let root;
+  try { root = loaded.getWorkspaceRoot(context); }
+  catch (error) { throw workspaceError('WORKSPACE_ROOT_UNRESOLVED', 'canonical workspace resolution failed', error); }
+  if (typeof root !== 'string' || !root.trim()) {
+    throw workspaceError('WORKSPACE_ROOT_UNRESOLVED', 'canonical resolver returned no workspace identity');
+  }
+  return root;
+}
+
+function getWorkspaceStateDir(root) {
+  const loaded = loadHelper();
+  if (typeof root !== 'string' || !root.trim()) {
+    throw workspaceError('WORKSPACE_ROOT_UNRESOLVED', 'workspace identity is required for state access');
+  }
+  try {
+    const state = loaded.getWorkspaceStateDir(root);
+    if (typeof state !== 'string' || !state.trim()) throw new Error('canonical state path must be nonempty');
+    // Missing state is valid for a new workspace. Existing non-directory or
+    // inaccessible ancestors are not an empty candidate list.
+    let ancestor = state;
+    while (true) {
+      try {
+        if (!fs.statSync(ancestor).isDirectory()) throw new Error(`${ancestor} is not a directory`);
+        fs.accessSync(ancestor, fs.constants.R_OK);
+        break;
+      } catch (error) {
+        if (error.code !== 'ENOENT') throw error;
+        const parent = path.dirname(ancestor);
+        if (parent === ancestor) throw error;
+        ancestor = parent;
+      }
+    }
+    return state;
+  } catch (error) {
+    throw workspaceError('WORKSPACE_STATE_UNAVAILABLE', `cannot access canonical state for ${root}`, error);
+  }
+}
+
+function getWorkspaceKey(root) { return loadHelper().getWorkspaceKey(root); }
+
+module.exports = { getWorkspaceRoot, getWorkspaceStateDir, getWorkspaceKey, workspaceError };

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:194f592d-6226-519c-a5b8-9f6750fb3c19",
+  "serialNumber": "urn:uuid:e76da8c1-2c84-5375-b676-2e0d5159ea62",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-28T05:22:07.321Z",
+    "timestamp": "2026-10-31T09:08:35.775Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.46.3"
+        "version": "0.47.1"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.46.3",
+      "bom-ref": "pkg:npm/harness-everything@0.47.1",
       "name": "harness-everything",
-      "version": "0.46.3",
-      "purl": "pkg:npm/harness-everything@0.46.3"
+      "version": "0.47.1",
+      "purl": "pkg:npm/harness-everything@0.47.1"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.46.3",
+      "ref": "pkg:npm/harness-everything@0.47.1",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",

package/self-evolve/SKILL.md

@@ -4,7 +4,7 @@ description: "Extract root causes from resolved problems and persist them as def
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.31.3
+  version: 0.47.1
 ---
 
 # Self-evolve

package/self-evolve/references/memory-resolution.md

@@ -35,6 +35,17 @@ For a simple rule, inspect/list the session candidate, evaluate it with a genera
 
 For a reusable multi-step procedure, load `skill-creator/SKILL.md`, create the draft skill, and use `register-dynamic-skill.js` to update each platform's `manifest.json` `generated[]` registry. The host agent remains responsible for deciding which evidence is relevant; these scripts do not discover session history.
 
+## Workspace helper and diagnostics
+
+| Contract | Behavior |
+| --- | --- |
+| Trusted imports | Select one layout using its installation marker: source `package.json` takes precedence; packaged `skills/` requires `.codex-plugin/plugin.json`. Load only that root’s `scripts/lib/workspace.js`; never fall through to ancestor/project/cwd code. |
+| Identity and state | Use the canonical resolver and `HARNESS_STATE_HOME` precedence; source and plugin read the same workspace/session candidates. No alternate state root. |
+| Missing helper | `WORKSPACE_HELPER_UNAVAILABLE` identifies the selected helper path or invalid layout marker and cause; absent or broken helpers fail without trying another layout. |
+| Unresolved identity | `WORKSPACE_ROOT_UNRESOLVED` exits nonzero; do not substitute cwd when canonical resolution fails. |
+| Unusable state | `WORKSPACE_STATE_UNAVAILABLE` exits nonzero for invalid state paths or failed reads; only a genuinely absent candidate directory returns `[]`. |
+| Writes | Existing screening and workflow authorization still apply. Resolver failures never authorize persistence or state repair. |
+
 ## Candidate Lifecycle
 
 ```text

package/self-evolve/scripts/lesson-candidate.js

@@ -18,14 +18,7 @@ for (const relative of [
   }
 }
 
-let getWorkspaceRoot;
-let getWorkspaceStateDir;
-try {
-  ({ getWorkspaceRoot, getWorkspaceStateDir } = require('../../scripts/lib/workspace'));
-} catch (_) {
-  getWorkspaceRoot = () => null;
-  getWorkspaceStateDir = () => null;
-}
+const { getWorkspaceRoot, getWorkspaceStateDir, workspaceError } = require('./workspace-helper');
 
 const SCHEMA_VERSION = 1;
 const TERMINAL = new Set(['rejected', 'validated', 'regressed', 'superseded']);
@@ -48,10 +41,10 @@ function readJson(filePath) {
 }
 
 function candidatePath(workspace, sessionId, candidateId) {
-  if (!workspace || !getWorkspaceStateDir(workspace)) throw new Error('workspace state root is unavailable');
+  const stateDir = getWorkspaceStateDir(workspace);
   if (!/^lesson-[a-f0-9]{24}$/.test(String(candidateId || ''))) throw new Error('invalid candidate id');
   return path.join(
-    getWorkspaceStateDir(workspace),
+    stateDir,
     'state',
     'sessions',
     safeSessionName(sessionId),
@@ -292,7 +285,10 @@ function observeCandidate(input) {
 function listCandidates({ workspace, sessionId }) {
   const base = path.join(getWorkspaceStateDir(workspace), 'state', 'sessions', safeSessionName(sessionId), 'learning-candidates');
   let files = [];
-  try { files = fs.readdirSync(base).filter(name => /^lesson-[a-f0-9]{24}\.json$/.test(name)); } catch (_) { return []; }
+  try { files = fs.readdirSync(base).filter(name => /^lesson-[a-f0-9]{24}\.json$/.test(name)); } catch (error) {
+    if (error.code === 'ENOENT') return [];
+    throw workspaceError('WORKSPACE_STATE_UNAVAILABLE', `cannot read candidate directory ${base}`, error);
+  }
   return files.map(name => readJson(path.join(base, name))).filter(Boolean);
 }
 
@@ -303,7 +299,8 @@ function option(args, name) {
 
 function parseCli(argv) {
   const command = argv[0];
-  const workspace = path.resolve(option(argv, '--workspace') || getWorkspaceRoot() || process.cwd());
+  const explicit = option(argv, '--workspace');
+  const workspace = getWorkspaceRoot(explicit ? { workspace_root: path.resolve(explicit) } : undefined);
   const base = {
     command,
     workspace,

package/self-evolve/scripts/persist-memory.js

@@ -4,20 +4,7 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
-let getWorkspaceRoot;
-let getWorkspaceStateDir;
-let getWorkspaceKey;
-try {
-  ({ getWorkspaceRoot, getWorkspaceStateDir, getWorkspaceKey } = require('../../scripts/lib/workspace'));
-} catch (err) {
-  getWorkspaceRoot = () => null;
-  getWorkspaceStateDir = () => null;
-  getWorkspaceKey = () => null;
-}
-
-// NOTE: this script ships standalone - it is copied whole into every install
-// target. When the canonical workspace resolver is not present, persistence
-// fails closed rather than guessing a project root (issue #42).
+const { getWorkspaceRoot, getWorkspaceStateDir, getWorkspaceKey } = require('./workspace-helper');
 
 const SECRET_PATTERNS = [
   ['github-token', /\bgh[pousr]_[A-Za-z0-9]{20,}\b/],

package/self-evolve/scripts/register-dynamic-skill.js

@@ -1,16 +1,12 @@
 #!/usr/bin/env node
 const fs = require('fs');
 const path = require('path');
-let getWorkspaceRoot;
-try {
-  ({ getWorkspaceRoot } = require('../../scripts/lib/workspace'));
-} catch (err) {
-  getWorkspaceRoot = () => null;
-}
+const { getWorkspaceRoot } = require('./workspace-helper');
 
-const workspaceRoot = getWorkspaceRoot();
-if (!workspaceRoot) {
-  console.error('[self-evolve] Cannot register a dynamic skill without a resolved git workspace.');
+let workspaceRoot;
+try { workspaceRoot = getWorkspaceRoot(); }
+catch (error) {
+  console.error(`[self-evolve] ${error.message}`);
   process.exit(1);
 }
 

package/self-evolve/scripts/workspace-helper.js

@@ -0,0 +1,98 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+function workspaceError(code, message, cause) {
+  const error = new Error(`${code}: ${message}${cause ? ` (${cause.code || cause.name}: ${cause.message})` : ''}`, { cause });
+  error.code = code;
+  return error;
+}
+
+function readMarker(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); }
+  catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw workspaceError('WORKSPACE_HELPER_UNAVAILABLE', `cannot read installation marker ${file}`, error);
+  }
+}
+
+let helper;
+function loadHelper() {
+  if (helper) return helper;
+  const sourceRoot = path.resolve(__dirname, '../..');
+  const sourceMarker = path.join(sourceRoot, 'package.json');
+  const source = readMarker(sourceMarker);
+  let installRoot;
+  // A source checkout may itself be named "skills". Its own package marker
+  // takes precedence, including when its helper is absent or broken.
+  if (source) {
+    if (source.name !== 'harness-everything') {
+      throw workspaceError('WORKSPACE_HELPER_UNAVAILABLE', `unrecognized source installation marker ${sourceMarker}`);
+    }
+    installRoot = sourceRoot;
+  } else {
+    const pluginRoot = path.dirname(sourceRoot);
+    const marker = path.join(pluginRoot, '.codex-plugin/plugin.json');
+    const plugin = path.basename(sourceRoot) === 'skills' ? readMarker(marker) : null;
+    if (!plugin || plugin.name !== 'harness-everything' || plugin.skills !== './skills/') {
+      throw workspaceError('WORKSPACE_HELPER_UNAVAILABLE', `unrecognized layout; expected ${sourceMarker} or packaged skills under ${marker}`);
+    }
+    installRoot = pluginRoot;
+  }
+  const candidate = path.join(installRoot, 'scripts/lib/workspace.js');
+  try {
+    const loaded = require(candidate);
+    for (const name of ['getWorkspaceRoot', 'getWorkspaceStateDir', 'getWorkspaceKey']) {
+      if (typeof loaded[name] !== 'function') throw new Error(`missing ${name} export`);
+    }
+    helper = loaded;
+    return helper;
+  } catch (error) {
+    throw workspaceError('WORKSPACE_HELPER_UNAVAILABLE', `cannot load selected installation helper ${candidate}`, error);
+  }
+}
+
+function getWorkspaceRoot(context) {
+  const loaded = loadHelper();
+  let root;
+  try { root = loaded.getWorkspaceRoot(context); }
+  catch (error) { throw workspaceError('WORKSPACE_ROOT_UNRESOLVED', 'canonical workspace resolution failed', error); }
+  if (typeof root !== 'string' || !root.trim()) {
+    throw workspaceError('WORKSPACE_ROOT_UNRESOLVED', 'canonical resolver returned no workspace identity');
+  }
+  return root;
+}
+
+function getWorkspaceStateDir(root) {
+  const loaded = loadHelper();
+  if (typeof root !== 'string' || !root.trim()) {
+    throw workspaceError('WORKSPACE_ROOT_UNRESOLVED', 'workspace identity is required for state access');
+  }
+  try {
+    const state = loaded.getWorkspaceStateDir(root);
+    if (typeof state !== 'string' || !state.trim()) throw new Error('canonical state path must be nonempty');
+    // Missing state is valid for a new workspace. Existing non-directory or
+    // inaccessible ancestors are not an empty candidate list.
+    let ancestor = state;
+    while (true) {
+      try {
+        if (!fs.statSync(ancestor).isDirectory()) throw new Error(`${ancestor} is not a directory`);
+        fs.accessSync(ancestor, fs.constants.R_OK);
+        break;
+      } catch (error) {
+        if (error.code !== 'ENOENT') throw error;
+        const parent = path.dirname(ancestor);
+        if (parent === ancestor) throw error;
+        ancestor = parent;
+      }
+    }
+    return state;
+  } catch (error) {
+    throw workspaceError('WORKSPACE_STATE_UNAVAILABLE', `cannot access canonical state for ${root}`, error);
+  }
+}
+
+function getWorkspaceKey(root) { return loadHelper().getWorkspaceKey(root); }
+
+module.exports = { getWorkspaceRoot, getWorkspaceStateDir, getWorkspaceKey, workspaceError };