harness-everything 0.5.3 → 0.6.1

package/hooks/scripts/action-gate.js

@@ -20,15 +20,15 @@ const ALWAYS_ASK_POLICY = 'always-ask';
 // Fail-safe defaults are used only when the configured table is missing or
 // invalid. A valid-but-empty table stays empty so CI can catch policy erasure.
 const BUILTIN_RULES = [
-  ['git-force-push', ['Bash', 'PowerShell'], '\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
-  ['git-reset-hard', ['Bash', 'PowerShell'], '\\bgit\\s+reset\\s+--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
-  ['git-clean-force-delete', ['Bash', 'PowerShell'], '\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
-  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['powershell-recursive-force-delete', ['Bash', 'PowerShell'], '\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
-  ['package-publish', ['Bash', 'PowerShell'], '\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
-  ['github-release-create', ['Bash', 'PowerShell'], '\\bgh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
-  ['production-deploy', ['Bash', 'PowerShell'], '\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
+  ['git-force-push', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
+  ['git-reset-hard', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
+  ['git-clean-force-delete', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
+  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\"\']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['powershell-recursive-force-delete', ['PowerShell'], '(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
+  ['package-publish', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
+  ['github-release-create', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
+  ['production-deploy', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
 ].map(([id, tools, pattern, flags, reason, scope]) => ({ id, tools, pattern, flags, reason, scope }));
 
 function hashExact(value) {
@@ -153,9 +153,15 @@ function deleteTargets(command, ruleId) {
   const tails = [];
   let regex = null;
   if (ruleId === 'recursive-delete') {
-    regex = /(?:^|[;&|\n]\s*)rm\s+([^;&|\n]+)/ig;
+    regex = /(?:^|[;&|\n]\s*)(?:sudo(?:\s+-\S+)*\s+)?rm\s+([^;&|\n]+)/ig;
+    const wrapper = /(?:^|[;&|\n]\s*)(?:bash|sh)\s+(?:-\S+\s+)*-c\s+(["'])([\s\S]*?)\1/ig;
+    let wrapped;
+    while ((wrapped = wrapper.exec(text)) !== null) {
+      tails.push(...deleteTargets(wrapped[2], ruleId));
+      if (wrapped[0].length === 0) wrapper.lastIndex++;
+    }
   } else if (ruleId === 'powershell-recursive-force-delete') {
-    regex = /\bRemove-Item\b([^;|\n]+)/ig;
+    regex = /(?:^|[;|\n]\s*)(?:Remove-Item|ri|rm)\b([^;|\n]+)/ig;
   }
   if (!regex) return [];
 
@@ -190,6 +196,10 @@ function isWithin(target, root) {
 
 function scratchRoots(payload, sessionDir) {
   const roots = [os.tmpdir(), path.join(sessionDir, 'scratch')];
+  // Git Bash/MSYS exposes the Windows temp area as /tmp (and sometimes
+  // /var/tmp). Treat those aliases as scratch on Windows instead of gating a
+  // harmless temp cleanup merely because the host path syntax differs.
+  if (process.platform === 'win32') roots.push('/tmp', '/var/tmp');
   const declared = payload && (payload.scratchpad_path || payload.scratchpadPath || (payload.harness && payload.harness.scratchpadPath));
   if (declared) roots.push(declared);
   if (process.env.HARNESS_SCRATCH_DIR) roots.push(process.env.HARNESS_SCRATCH_DIR);

package/hooks/scripts/atomic-commit-check.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 /**
- * Atomic Commit Check (PostToolUse: apply_patch)
- * PostToolUse can't block - the edit/write already happened. So this counts
- * apply_patch calls since the last commit and, once the count crosses a
- * threshold, feeds a strong reminder back to Claude (exit 2) to commit the
- * completed chunk before piling on more changes. Resets whenever HEAD moves.
+ * Atomic Commit Check (PostToolUse: Edit/Write/apply_patch)
+ * PostToolUse can't block - the edit/write already happened. Count only edits
+ * whose targets resolve inside the current workspace. Once the count crosses
+ * the threshold, emit a strong reminder only when the Git worktree actually
+ * has uncommitted changes. Resets whenever HEAD moves.
  * Fails open on any error - this is a nudge, never a hard stop.
  */
 const { execSync } = require('child_process');
@@ -15,6 +15,90 @@ const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 const THRESHOLD = 6;
 const RENUDGE_EVERY = 3;
 
+function toolNameOf(payload) {
+  return String((payload && (payload.tool_name || payload.toolName)) || '');
+}
+
+function toolInputOf(payload) {
+  return (payload && (payload.tool_input || payload.toolInput || payload.input)) || {};
+}
+
+function pathApiFor(value) {
+  return /^[A-Za-z]:[\\/]/.test(String(value || '')) ? path.win32 : path;
+}
+
+function canonicalPath(value) {
+  const text = String(value || '');
+  if (!text) return null;
+  const api = pathApiFor(text);
+  const resolved = api.resolve(text);
+
+  // realpath() is necessary on macOS where /var is a symlink to /private/var.
+  // New Write targets may not exist yet, so canonicalize the nearest existing
+  // ancestor and append the missing path segments without requiring creation.
+  const missing = [];
+  let cursor = resolved;
+  while (cursor && !fs.existsSync(cursor)) {
+    const parent = api.dirname(cursor);
+    if (!parent || parent === cursor) break;
+    missing.unshift(api.basename(cursor));
+    cursor = parent;
+  }
+  if (!cursor || !fs.existsSync(cursor)) return resolved;
+
+  let real = fs.realpathSync.native ? fs.realpathSync.native(cursor) : fs.realpathSync(cursor);
+  for (const segment of missing) real = api.join(real, segment);
+  return api.normalize(real);
+}
+
+function isWithin(target, root) {
+  if (!target || !root) return false;
+  const api = pathApiFor(target) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  const resolvedTarget = canonicalPath(target);
+  const resolvedRoot = canonicalPath(root);
+  const relative = api.relative(resolvedRoot, resolvedTarget);
+  if (!relative) return true;
+  return relative !== '..' && !relative.startsWith(`..${api.sep}`) && !api.isAbsolute(relative);
+}
+
+function absoluteTarget(target, root) {
+  const text = String(target || '').trim();
+  if (!text) return null;
+  const api = pathApiFor(text) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  return api.isAbsolute(text) ? api.normalize(text) : api.resolve(root, text);
+}
+
+function patchTargets(patchText) {
+  const targets = [];
+  const regex = /^\*\*\* (?:Add|Update|Delete) File:\s*(.+?)\s*$/gm;
+  let match;
+  while ((match = regex.exec(String(patchText || ''))) !== null) targets.push(match[1]);
+  return targets;
+}
+
+function editTargets(payload) {
+  const tool = toolNameOf(payload);
+  const input = toolInputOf(payload);
+  if (tool === 'Edit' || tool === 'Write') {
+    const target = input.file_path || input.filePath || input.path;
+    return target ? [String(target)] : [];
+  }
+  if (tool === 'apply_patch') {
+    return patchTargets(input.patch || input.command || input.content || '');
+  }
+  return [];
+}
+
+function touchesWorkspace(payload, root) {
+  const targets = editTargets(payload);
+  if (targets.length === 0) return false;
+  return targets.some(target => isWithin(absoluteTarget(target, root), root));
+}
+
+function writeState(stateFile, state) {
+  fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+}
+
 function main(payload) {
   try {
     const root = getWorkspaceRoot(payload);
@@ -33,17 +117,32 @@ function main(payload) {
       state.editCount = 0;
     }
 
+    // Host scratchpads, memory stores, temp files, and any other target outside
+    // the repository must not contribute to a repository commit reminder.
+    if (!touchesWorkspace(payload, root)) {
+      writeState(stateFile, state);
+      process.exit(0);
+    }
+
     state.editCount += 1;
-    fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+    writeState(stateFile, state);
 
     const overThreshold = state.editCount >= THRESHOLD;
     const onNudgeBeat = overThreshold && (state.editCount - THRESHOLD) % RENUDGE_EVERY === 0;
 
     if (onNudgeBeat) {
       const statusRaw = execSync('git status --porcelain', { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-      const changedFiles = statusRaw ? statusRaw.split('\n').length : 0;
-      console.error(`[Atomic Commit Check] ${state.editCount} apply_patch calls since the last commit (${changedFiles} files currently changed).`);
-      console.error(`If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.`);
+      if (!statusRaw) {
+        // Calls that produced no Git-visible change (or work already reverted)
+        // must not leave a stale counter that immediately re-nudges later.
+        state.editCount = 0;
+        writeState(stateFile, state);
+        process.exit(0);
+      }
+
+      const changedFiles = statusRaw.split('\n').length;
+      console.error(`[Atomic Commit Check] ${state.editCount} edits since the last commit (${changedFiles} files currently changed).`);
+      console.error('If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.');
       process.exit(2);
     }
 
@@ -66,3 +165,12 @@ process.stdin.on('error', () => {
   clearTimeout(timeout);
   main(null);
 });
+
+module.exports = {
+  absoluteTarget,
+  canonicalPath,
+  editTargets,
+  isWithin,
+  patchTargets,
+  touchesWorkspace,
+};

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.5.3",
+  "version": "0.6.1",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.5.3",
+  "version": "0.6.1",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {
@@ -40,6 +40,9 @@
     "eval:behavioral": "node behavioral-evals/run.js run",
     "eval:behavioral:validate": "node behavioral-evals/run.js validate",
     "eval:behavioral:plugin": "node behavioral-evals/run-with-plugin.js run",
+    "eval:opencode:hardlock-live": "node behavioral-evals/opencode-hardlock-live.js run",
+    "eval:paired": "node behavioral-evals/paired-benchmark.js run",
+    "eval:paired:summarize": "node behavioral-evals/paired-benchmark.js summarize",
     "test:ab": "node ci/ab-test-harness.js validate",
     "test:ab:run": "node ci/ab-test-harness.js run",
     "harness:reset": "node hooks/scripts/reset-circuit-breaker.js",

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.5.3",
+  "version": "0.6.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/action-gate-rules.json

@@ -4,7 +4,7 @@
     {
       "id": "git-force-push",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))",
       "flags": "i",
       "reason": "Force-pushing can rewrite remote history.",
       "scope": "always"
@@ -12,7 +12,7 @@
     {
       "id": "git-reset-hard",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+reset\\s+--hard\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b",
       "flags": "i",
       "reason": "git reset --hard can discard local work.",
       "scope": "always"
@@ -20,7 +20,7 @@
     {
       "id": "git-clean-force-delete",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))",
       "flags": "i",
       "reason": "git clean with force and directory deletion can remove untracked work.",
       "scope": "always"
@@ -28,15 +28,15 @@
     {
       "id": "recursive-delete",
       "tools": ["Bash"],
-      "pattern": "(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\\"']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
       "flags": "i",
       "reason": "Recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
     },
     {
       "id": "powershell-recursive-force-delete",
-      "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
+      "tools": ["PowerShell"],
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
       "flags": "i",
       "reason": "PowerShell recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
@@ -44,7 +44,7 @@
     {
       "id": "sql-destructive-ddl",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
       "flags": "i",
       "reason": "Destructive SQL DDL can irreversibly remove production data or schema state.",
       "scope": "always"
@@ -52,7 +52,7 @@
     {
       "id": "package-publish",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
       "flags": "i",
       "reason": "Publishing creates an external package/release side effect.",
       "scope": "always"
@@ -60,7 +60,7 @@
     {
       "id": "github-release-create",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgh\\s+release\\s+create\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b",
       "flags": "i",
       "reason": "Creating a GitHub release is an external irreversible publication action.",
       "scope": "always"
@@ -68,7 +68,7 @@
     {
       "id": "production-deploy",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
       "flags": "i",
       "reason": "Deployment changes an external environment and requires explicit approval.",
       "scope": "always"

package/plugins/harness-everything/hooks/scripts/action-gate.js

@@ -20,15 +20,15 @@ const ALWAYS_ASK_POLICY = 'always-ask';
 // Fail-safe defaults are used only when the configured table is missing or
 // invalid. A valid-but-empty table stays empty so CI can catch policy erasure.
 const BUILTIN_RULES = [
-  ['git-force-push', ['Bash', 'PowerShell'], '\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
-  ['git-reset-hard', ['Bash', 'PowerShell'], '\\bgit\\s+reset\\s+--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
-  ['git-clean-force-delete', ['Bash', 'PowerShell'], '\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
-  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['powershell-recursive-force-delete', ['Bash', 'PowerShell'], '\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
-  ['package-publish', ['Bash', 'PowerShell'], '\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
-  ['github-release-create', ['Bash', 'PowerShell'], '\\bgh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
-  ['production-deploy', ['Bash', 'PowerShell'], '\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
+  ['git-force-push', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
+  ['git-reset-hard', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
+  ['git-clean-force-delete', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
+  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\"\']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['powershell-recursive-force-delete', ['PowerShell'], '(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
+  ['package-publish', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
+  ['github-release-create', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
+  ['production-deploy', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
 ].map(([id, tools, pattern, flags, reason, scope]) => ({ id, tools, pattern, flags, reason, scope }));
 
 function hashExact(value) {
@@ -153,9 +153,15 @@ function deleteTargets(command, ruleId) {
   const tails = [];
   let regex = null;
   if (ruleId === 'recursive-delete') {
-    regex = /(?:^|[;&|\n]\s*)rm\s+([^;&|\n]+)/ig;
+    regex = /(?:^|[;&|\n]\s*)(?:sudo(?:\s+-\S+)*\s+)?rm\s+([^;&|\n]+)/ig;
+    const wrapper = /(?:^|[;&|\n]\s*)(?:bash|sh)\s+(?:-\S+\s+)*-c\s+(["'])([\s\S]*?)\1/ig;
+    let wrapped;
+    while ((wrapped = wrapper.exec(text)) !== null) {
+      tails.push(...deleteTargets(wrapped[2], ruleId));
+      if (wrapped[0].length === 0) wrapper.lastIndex++;
+    }
   } else if (ruleId === 'powershell-recursive-force-delete') {
-    regex = /\bRemove-Item\b([^;|\n]+)/ig;
+    regex = /(?:^|[;|\n]\s*)(?:Remove-Item|ri|rm)\b([^;|\n]+)/ig;
   }
   if (!regex) return [];
 
@@ -190,6 +196,10 @@ function isWithin(target, root) {
 
 function scratchRoots(payload, sessionDir) {
   const roots = [os.tmpdir(), path.join(sessionDir, 'scratch')];
+  // Git Bash/MSYS exposes the Windows temp area as /tmp (and sometimes
+  // /var/tmp). Treat those aliases as scratch on Windows instead of gating a
+  // harmless temp cleanup merely because the host path syntax differs.
+  if (process.platform === 'win32') roots.push('/tmp', '/var/tmp');
   const declared = payload && (payload.scratchpad_path || payload.scratchpadPath || (payload.harness && payload.harness.scratchpadPath));
   if (declared) roots.push(declared);
   if (process.env.HARNESS_SCRATCH_DIR) roots.push(process.env.HARNESS_SCRATCH_DIR);

package/plugins/harness-everything/hooks/scripts/atomic-commit-check.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 /**
- * Atomic Commit Check (PostToolUse: apply_patch)
- * PostToolUse can't block - the edit/write already happened. So this counts
- * apply_patch calls since the last commit and, once the count crosses a
- * threshold, feeds a strong reminder back to Claude (exit 2) to commit the
- * completed chunk before piling on more changes. Resets whenever HEAD moves.
+ * Atomic Commit Check (PostToolUse: Edit/Write/apply_patch)
+ * PostToolUse can't block - the edit/write already happened. Count only edits
+ * whose targets resolve inside the current workspace. Once the count crosses
+ * the threshold, emit a strong reminder only when the Git worktree actually
+ * has uncommitted changes. Resets whenever HEAD moves.
  * Fails open on any error - this is a nudge, never a hard stop.
  */
 const { execSync } = require('child_process');
@@ -15,6 +15,90 @@ const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 const THRESHOLD = 6;
 const RENUDGE_EVERY = 3;
 
+function toolNameOf(payload) {
+  return String((payload && (payload.tool_name || payload.toolName)) || '');
+}
+
+function toolInputOf(payload) {
+  return (payload && (payload.tool_input || payload.toolInput || payload.input)) || {};
+}
+
+function pathApiFor(value) {
+  return /^[A-Za-z]:[\\/]/.test(String(value || '')) ? path.win32 : path;
+}
+
+function canonicalPath(value) {
+  const text = String(value || '');
+  if (!text) return null;
+  const api = pathApiFor(text);
+  const resolved = api.resolve(text);
+
+  // realpath() is necessary on macOS where /var is a symlink to /private/var.
+  // New Write targets may not exist yet, so canonicalize the nearest existing
+  // ancestor and append the missing path segments without requiring creation.
+  const missing = [];
+  let cursor = resolved;
+  while (cursor && !fs.existsSync(cursor)) {
+    const parent = api.dirname(cursor);
+    if (!parent || parent === cursor) break;
+    missing.unshift(api.basename(cursor));
+    cursor = parent;
+  }
+  if (!cursor || !fs.existsSync(cursor)) return resolved;
+
+  let real = fs.realpathSync.native ? fs.realpathSync.native(cursor) : fs.realpathSync(cursor);
+  for (const segment of missing) real = api.join(real, segment);
+  return api.normalize(real);
+}
+
+function isWithin(target, root) {
+  if (!target || !root) return false;
+  const api = pathApiFor(target) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  const resolvedTarget = canonicalPath(target);
+  const resolvedRoot = canonicalPath(root);
+  const relative = api.relative(resolvedRoot, resolvedTarget);
+  if (!relative) return true;
+  return relative !== '..' && !relative.startsWith(`..${api.sep}`) && !api.isAbsolute(relative);
+}
+
+function absoluteTarget(target, root) {
+  const text = String(target || '').trim();
+  if (!text) return null;
+  const api = pathApiFor(text) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  return api.isAbsolute(text) ? api.normalize(text) : api.resolve(root, text);
+}
+
+function patchTargets(patchText) {
+  const targets = [];
+  const regex = /^\*\*\* (?:Add|Update|Delete) File:\s*(.+?)\s*$/gm;
+  let match;
+  while ((match = regex.exec(String(patchText || ''))) !== null) targets.push(match[1]);
+  return targets;
+}
+
+function editTargets(payload) {
+  const tool = toolNameOf(payload);
+  const input = toolInputOf(payload);
+  if (tool === 'Edit' || tool === 'Write') {
+    const target = input.file_path || input.filePath || input.path;
+    return target ? [String(target)] : [];
+  }
+  if (tool === 'apply_patch') {
+    return patchTargets(input.patch || input.command || input.content || '');
+  }
+  return [];
+}
+
+function touchesWorkspace(payload, root) {
+  const targets = editTargets(payload);
+  if (targets.length === 0) return false;
+  return targets.some(target => isWithin(absoluteTarget(target, root), root));
+}
+
+function writeState(stateFile, state) {
+  fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+}
+
 function main(payload) {
   try {
     const root = getWorkspaceRoot(payload);
@@ -33,17 +117,32 @@ function main(payload) {
       state.editCount = 0;
     }
 
+    // Host scratchpads, memory stores, temp files, and any other target outside
+    // the repository must not contribute to a repository commit reminder.
+    if (!touchesWorkspace(payload, root)) {
+      writeState(stateFile, state);
+      process.exit(0);
+    }
+
     state.editCount += 1;
-    fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+    writeState(stateFile, state);
 
     const overThreshold = state.editCount >= THRESHOLD;
     const onNudgeBeat = overThreshold && (state.editCount - THRESHOLD) % RENUDGE_EVERY === 0;
 
     if (onNudgeBeat) {
       const statusRaw = execSync('git status --porcelain', { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-      const changedFiles = statusRaw ? statusRaw.split('\n').length : 0;
-      console.error(`[Atomic Commit Check] ${state.editCount} apply_patch calls since the last commit (${changedFiles} files currently changed).`);
-      console.error(`If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.`);
+      if (!statusRaw) {
+        // Calls that produced no Git-visible change (or work already reverted)
+        // must not leave a stale counter that immediately re-nudges later.
+        state.editCount = 0;
+        writeState(stateFile, state);
+        process.exit(0);
+      }
+
+      const changedFiles = statusRaw.split('\n').length;
+      console.error(`[Atomic Commit Check] ${state.editCount} edits since the last commit (${changedFiles} files currently changed).`);
+      console.error('If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.');
       process.exit(2);
     }
 
@@ -66,3 +165,12 @@ process.stdin.on('error', () => {
   clearTimeout(timeout);
   main(null);
 });
+
+module.exports = {
+  absoluteTarget,
+  canonicalPath,
+  editTargets,
+  isWithin,
+  patchTargets,
+  touchesWorkspace,
+};

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.5.3",
+  "version": "0.6.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",