harness-everything 0.6.0 → 0.6.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.6.0",
+      "version": "0.6.1",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.6.1](https://github.com/dyphn1/Harness-everything/compare/v0.6.0...v0.6.1) (2026-09-17)
+
+### Bug Fixes
+
+* **hooks:** harden atomic commit and destructive action gates ([#132](https://github.com/dyphn1/Harness-everything/issues/132)) ([e7dee3a](https://github.com/dyphn1/Harness-everything/commit/e7dee3aed9bc2c2922151743e573f62ecdd60039)), closes [#90](https://github.com/dyphn1/Harness-everything/issues/90) [#100](https://github.com/dyphn1/Harness-everything/issues/100)
+
 ## [0.6.0](https://github.com/dyphn1/Harness-everything/compare/v0.5.3...v0.6.0) (2026-09-17)
 
 ### Features

package/ci/mechanism-2ac-atomic-commit-check.test.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const { execFileSync, spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const canonical = path.join(ROOT, 'hooks', 'scripts', 'atomic-commit-check.js');
+const plugin = path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'atomic-commit-check.js');
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-atomic-commit-'));
+const repo = path.join(temp, 'repo');
+const outside = path.join(temp, 'outside');
+const stateHome = path.join(temp, 'state');
+
+function git(args) {
+  return execFileSync('git', args, { cwd: repo, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+}
+
+function invoke({ session, tool = 'Edit', target, patch }) {
+  const toolInput = tool === 'apply_patch'
+    ? { patch }
+    : { file_path: target };
+  const payload = {
+    session_id: session,
+    hook_event_name: 'PostToolUse',
+    tool_name: tool,
+    tool_input: toolInput,
+    cwd: repo,
+  };
+  return spawnSync(process.execPath, [canonical], {
+    cwd: repo,
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    env: { ...process.env, HARNESS_STATE_HOME: stateHome },
+  });
+}
+
+function sixInvocations(args) {
+  const results = [];
+  for (let i = 0; i < 6; i++) results.push(invoke(args));
+  return results;
+}
+
+try {
+  fs.mkdirSync(repo, { recursive: true });
+  fs.mkdirSync(outside, { recursive: true });
+  git(['init']);
+  git(['config', 'user.email', 'harness@example.invalid']);
+  git(['config', 'user.name', 'Harness Test']);
+  fs.writeFileSync(path.join(repo, 'tracked.txt'), 'base\n', 'utf8');
+  git(['add', 'tracked.txt']);
+  git(['commit', '-m', 'initial']);
+
+  assert.strictEqual(
+    fs.readFileSync(canonical, 'utf8'),
+    fs.readFileSync(plugin, 'utf8'),
+    'canonical and packaged atomic-commit hooks must remain byte-identical',
+  );
+
+  // Negative control for #90: keep the repository dirty with a pre-existing,
+  // unrelated file. Six host edits outside the workspace must still never
+  // increment the repository edit counter or emit a commit nudge.
+  fs.writeFileSync(path.join(repo, 'pre-existing-unrelated.txt'), 'unrelated\n', 'utf8');
+  const outsideTarget = path.join(outside, 'scratch.txt');
+  const outsideResults = sixInvocations({ session: 'outside-edit', target: outsideTarget });
+  assert.ok(outsideResults.every(result => result.status === 0), 'outside-workspace Edit calls must never nudge even when the repo is already dirty');
+  assert.ok(outsideResults.every(result => !String(result.stderr || '').includes('Atomic Commit Check')), 'outside-workspace Edit calls must stay silent');
+
+  const outsidePatchResults = sixInvocations({
+    session: 'outside-patch',
+    tool: 'apply_patch',
+    patch: `*** Begin Patch\n*** Update File: ${outsideTarget}\n@@\n-old\n+new\n*** End Patch`,
+  });
+  assert.ok(outsidePatchResults.every(result => result.status === 0), 'outside-workspace apply_patch headers must not increment the count');
+  fs.rmSync(path.join(repo, 'pre-existing-unrelated.txt'));
+
+  // A clean worktree is never a valid reason to request a commit. The sixth
+  // in-workspace event therefore stays non-blocking and resets the stale count.
+  const cleanResults = sixInvocations({ session: 'clean-tree', target: path.join(repo, 'tracked.txt') });
+  assert.ok(cleanResults.every(result => result.status === 0), 'clean worktree must not nudge at the threshold');
+  assert.ok(cleanResults.every(result => !String(result.stderr || '').includes('Atomic Commit Check')), 'clean worktree must not print a commit reminder');
+
+  // Real in-workspace edits with Git-visible changes still preserve the nudge.
+  fs.writeFileSync(path.join(repo, 'tracked.txt'), 'changed\n', 'utf8');
+  const dirtyResults = sixInvocations({ session: 'dirty-tree', target: path.join(repo, 'tracked.txt') });
+  assert.ok(dirtyResults.slice(0, 5).every(result => result.status === 0), 'first five in-workspace edits remain non-blocking');
+  assert.strictEqual(dirtyResults[5].status, 2, 'sixth in-workspace edit with uncommitted changes nudges');
+  assert.match(String(dirtyResults[5].stderr || ''), /6 edits since the last commit/, 'nudge wording is tool-neutral');
+  assert.doesNotMatch(String(dirtyResults[5].stderr || ''), /apply_patch calls/, 'nudge no longer claims all edits are apply_patch calls');
+
+  // apply_patch paths inside the repository count too.
+  const patchResults = sixInvocations({
+    session: 'inside-patch',
+    tool: 'apply_patch',
+    patch: '*** Begin Patch\n*** Update File: tracked.txt\n@@\n-old\n+new\n*** End Patch',
+  });
+  assert.strictEqual(patchResults[5].status, 2, 'in-workspace apply_patch header participates in the threshold');
+
+  // Moving HEAD resets the counter for the same session.
+  git(['add', 'tracked.txt']);
+  git(['commit', '-m', 'save change']);
+  const afterCommit = invoke({ session: 'dirty-tree', target: path.join(repo, 'tracked.txt') });
+  assert.strictEqual(afterCommit.status, 0, 'counter resets after a commit moves HEAD');
+
+  console.log('PASS: atomic commit check scopes edits to the workspace and suppresses clean-tree false nudges');
+} finally {
+  fs.rmSync(temp, { recursive: true, force: true });
+}

package/ci/mechanism-2ad-action-gate-classifier-hardening.test.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const canonicalScript = path.join(ROOT, 'hooks', 'scripts', 'action-gate.js');
+const pluginScript = path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'action-gate.js');
+const canonicalRules = path.join(ROOT, 'hooks', 'scripts', 'action-gate-rules.json');
+const pluginRules = path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'action-gate-rules.json');
+const actionGate = require(canonicalScript);
+
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-action-gate-hardening-'));
+const sessionDir = path.join(temp, 'session');
+fs.mkdirSync(path.join(sessionDir, 'scratch'), { recursive: true });
+
+function payload(command, tool = 'Bash', cwd = ROOT) {
+  return {
+    session_id: 'classifier-hardening',
+    hook_event_name: 'PreToolUse',
+    tool_name: tool,
+    tool_input: { command },
+    cwd,
+  };
+}
+
+function matched(table, command, expected, tool = 'Bash', cwd = ROOT) {
+  const rule = actionGate.classify(payload(command, tool, cwd), table.rules, sessionDir);
+  assert.ok(rule, `${command} should match ${expected}`);
+  assert.strictEqual(rule.id, expected, `${command} should match ${expected}, got ${rule && rule.id}`);
+}
+
+function allowed(table, command, tool = 'Bash', cwd = ROOT) {
+  const rule = actionGate.classify(payload(command, tool, cwd), table.rules, sessionDir);
+  assert.strictEqual(rule, null, `${command} should not be classified as destructive`);
+}
+
+try {
+  assert.strictEqual(fs.readFileSync(canonicalScript, 'utf8'), fs.readFileSync(pluginScript, 'utf8'), 'canonical and packaged action-gate scripts must remain byte-identical');
+  assert.strictEqual(fs.readFileSync(canonicalRules, 'utf8'), fs.readFileSync(pluginRules, 'utf8'), 'canonical and packaged action-gate rule tables must remain byte-identical');
+
+  const table = actionGate.loadRuleTable(canonicalRules);
+  assert.strictEqual(table.degraded, false, 'production rule table must load normally');
+
+  const builtinById = new Map(actionGate.BUILTIN_RULES.map(rule => [rule.id, rule]));
+  for (const rule of table.rules) {
+    const fallback = builtinById.get(rule.id);
+    assert.ok(fallback, `built-in fallback must contain ${rule.id}`);
+    assert.deepStrictEqual(
+      { tools: fallback.tools, pattern: fallback.pattern, flags: fallback.flags, reason: fallback.reason, scope: fallback.scope },
+      { tools: rule.tools, pattern: rule.pattern, flags: rule.flags, reason: rule.reason, scope: rule.scope },
+      `built-in fallback must stay aligned with configured rule ${rule.id}`,
+    );
+  }
+
+  // Confirmed fail-open variants from #100.
+  matched(table, 'git -C . push --force origin main', 'git-force-push');
+  matched(table, 'git push origin +main', 'git-force-push');
+  matched(table, 'git push -uf origin main', 'git-force-push');
+  matched(table, 'git reset -q --hard HEAD~1', 'git-reset-hard');
+  matched(table, 'git -c key=value reset --hard', 'git-reset-hard');
+  matched(table, 'sudo rm -rf /opt/app', 'recursive-delete');
+  matched(table, 'bash -c "rm -rf C:/important"', 'recursive-delete');
+  matched(table, 'ri -Recurse -Force C:\\repo\\x', 'powershell-recursive-force-delete', 'PowerShell');
+  matched(table, 'rm -r -fo C:\\repo\\x', 'powershell-recursive-force-delete', 'PowerShell');
+
+  // Quoted/descriptive text is not an executable destructive command.
+  allowed(table, 'node -e "console.log(\'Remove-Item -Recurse -Force C:\\\\repo\\\\x\')"', 'Bash');
+  allowed(table, 'echo "never DROP TABLE users"');
+  allowed(table, 'grep -rn "npm publish" docs/');
+  allowed(table, 'git push origin main');
+
+  // Scratch cleanup keeps working for direct commands and PowerShell aliases.
+  const bashScratch = process.platform === 'win32' ? '/tmp/harness-action-gate-safe' : path.join(os.tmpdir(), 'harness-action-gate-safe');
+  allowed(table, `rm -rf "${bashScratch}"`, 'Bash');
+  const psScratch = path.join(sessionDir, 'scratch', 'build');
+  allowed(table, `rm -r -fo "${psScratch}"`, 'PowerShell');
+  allowed(table, `ri -Recurse -Force "${psScratch}"`, 'PowerShell');
+
+  // An unresolved variable remains conservative rather than creating a new
+  // fail-open path: the gate cannot prove that the target is scratch space.
+  matched(table, 'rm -rf "$S"', 'recursive-delete');
+
+  console.log('PASS: destructive-command classifier covers confirmed bypasses while suppressing quoted-text false positives');
+} finally {
+  fs.rmSync(temp, { recursive: true, force: true });
+}

package/hooks/scripts/action-gate-rules.json

@@ -4,7 +4,7 @@
     {
       "id": "git-force-push",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))",
       "flags": "i",
       "reason": "Force-pushing can rewrite remote history.",
       "scope": "always"
@@ -12,7 +12,7 @@
     {
       "id": "git-reset-hard",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+reset\\s+--hard\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b",
       "flags": "i",
       "reason": "git reset --hard can discard local work.",
       "scope": "always"
@@ -20,7 +20,7 @@
     {
       "id": "git-clean-force-delete",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))",
       "flags": "i",
       "reason": "git clean with force and directory deletion can remove untracked work.",
       "scope": "always"
@@ -28,15 +28,15 @@
     {
       "id": "recursive-delete",
       "tools": ["Bash"],
-      "pattern": "(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\\"']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
       "flags": "i",
       "reason": "Recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
     },
     {
       "id": "powershell-recursive-force-delete",
-      "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
+      "tools": ["PowerShell"],
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
       "flags": "i",
       "reason": "PowerShell recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
@@ -44,7 +44,7 @@
     {
       "id": "sql-destructive-ddl",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
       "flags": "i",
       "reason": "Destructive SQL DDL can irreversibly remove production data or schema state.",
       "scope": "always"
@@ -52,7 +52,7 @@
     {
       "id": "package-publish",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
       "flags": "i",
       "reason": "Publishing creates an external package/release side effect.",
       "scope": "always"
@@ -60,7 +60,7 @@
     {
       "id": "github-release-create",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgh\\s+release\\s+create\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b",
       "flags": "i",
       "reason": "Creating a GitHub release is an external irreversible publication action.",
       "scope": "always"
@@ -68,7 +68,7 @@
     {
       "id": "production-deploy",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
       "flags": "i",
       "reason": "Deployment changes an external environment and requires explicit approval.",
       "scope": "always"

package/hooks/scripts/action-gate.js

@@ -20,15 +20,15 @@ const ALWAYS_ASK_POLICY = 'always-ask';
 // Fail-safe defaults are used only when the configured table is missing or
 // invalid. A valid-but-empty table stays empty so CI can catch policy erasure.
 const BUILTIN_RULES = [
-  ['git-force-push', ['Bash', 'PowerShell'], '\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
-  ['git-reset-hard', ['Bash', 'PowerShell'], '\\bgit\\s+reset\\s+--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
-  ['git-clean-force-delete', ['Bash', 'PowerShell'], '\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
-  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['powershell-recursive-force-delete', ['Bash', 'PowerShell'], '\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
-  ['package-publish', ['Bash', 'PowerShell'], '\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
-  ['github-release-create', ['Bash', 'PowerShell'], '\\bgh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
-  ['production-deploy', ['Bash', 'PowerShell'], '\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
+  ['git-force-push', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
+  ['git-reset-hard', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
+  ['git-clean-force-delete', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
+  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\"\']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['powershell-recursive-force-delete', ['PowerShell'], '(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
+  ['package-publish', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
+  ['github-release-create', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
+  ['production-deploy', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
 ].map(([id, tools, pattern, flags, reason, scope]) => ({ id, tools, pattern, flags, reason, scope }));
 
 function hashExact(value) {
@@ -153,9 +153,15 @@ function deleteTargets(command, ruleId) {
   const tails = [];
   let regex = null;
   if (ruleId === 'recursive-delete') {
-    regex = /(?:^|[;&|\n]\s*)rm\s+([^;&|\n]+)/ig;
+    regex = /(?:^|[;&|\n]\s*)(?:sudo(?:\s+-\S+)*\s+)?rm\s+([^;&|\n]+)/ig;
+    const wrapper = /(?:^|[;&|\n]\s*)(?:bash|sh)\s+(?:-\S+\s+)*-c\s+(["'])([\s\S]*?)\1/ig;
+    let wrapped;
+    while ((wrapped = wrapper.exec(text)) !== null) {
+      tails.push(...deleteTargets(wrapped[2], ruleId));
+      if (wrapped[0].length === 0) wrapper.lastIndex++;
+    }
   } else if (ruleId === 'powershell-recursive-force-delete') {
-    regex = /\bRemove-Item\b([^;|\n]+)/ig;
+    regex = /(?:^|[;|\n]\s*)(?:Remove-Item|ri|rm)\b([^;|\n]+)/ig;
   }
   if (!regex) return [];
 
@@ -190,6 +196,10 @@ function isWithin(target, root) {
 
 function scratchRoots(payload, sessionDir) {
   const roots = [os.tmpdir(), path.join(sessionDir, 'scratch')];
+  // Git Bash/MSYS exposes the Windows temp area as /tmp (and sometimes
+  // /var/tmp). Treat those aliases as scratch on Windows instead of gating a
+  // harmless temp cleanup merely because the host path syntax differs.
+  if (process.platform === 'win32') roots.push('/tmp', '/var/tmp');
   const declared = payload && (payload.scratchpad_path || payload.scratchpadPath || (payload.harness && payload.harness.scratchpadPath));
   if (declared) roots.push(declared);
   if (process.env.HARNESS_SCRATCH_DIR) roots.push(process.env.HARNESS_SCRATCH_DIR);

package/hooks/scripts/atomic-commit-check.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 /**
- * Atomic Commit Check (PostToolUse: apply_patch)
- * PostToolUse can't block - the edit/write already happened. So this counts
- * apply_patch calls since the last commit and, once the count crosses a
- * threshold, feeds a strong reminder back to Claude (exit 2) to commit the
- * completed chunk before piling on more changes. Resets whenever HEAD moves.
+ * Atomic Commit Check (PostToolUse: Edit/Write/apply_patch)
+ * PostToolUse can't block - the edit/write already happened. Count only edits
+ * whose targets resolve inside the current workspace. Once the count crosses
+ * the threshold, emit a strong reminder only when the Git worktree actually
+ * has uncommitted changes. Resets whenever HEAD moves.
  * Fails open on any error - this is a nudge, never a hard stop.
  */
 const { execSync } = require('child_process');
@@ -15,6 +15,90 @@ const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 const THRESHOLD = 6;
 const RENUDGE_EVERY = 3;
 
+function toolNameOf(payload) {
+  return String((payload && (payload.tool_name || payload.toolName)) || '');
+}
+
+function toolInputOf(payload) {
+  return (payload && (payload.tool_input || payload.toolInput || payload.input)) || {};
+}
+
+function pathApiFor(value) {
+  return /^[A-Za-z]:[\\/]/.test(String(value || '')) ? path.win32 : path;
+}
+
+function canonicalPath(value) {
+  const text = String(value || '');
+  if (!text) return null;
+  const api = pathApiFor(text);
+  const resolved = api.resolve(text);
+
+  // realpath() is necessary on macOS where /var is a symlink to /private/var.
+  // New Write targets may not exist yet, so canonicalize the nearest existing
+  // ancestor and append the missing path segments without requiring creation.
+  const missing = [];
+  let cursor = resolved;
+  while (cursor && !fs.existsSync(cursor)) {
+    const parent = api.dirname(cursor);
+    if (!parent || parent === cursor) break;
+    missing.unshift(api.basename(cursor));
+    cursor = parent;
+  }
+  if (!cursor || !fs.existsSync(cursor)) return resolved;
+
+  let real = fs.realpathSync.native ? fs.realpathSync.native(cursor) : fs.realpathSync(cursor);
+  for (const segment of missing) real = api.join(real, segment);
+  return api.normalize(real);
+}
+
+function isWithin(target, root) {
+  if (!target || !root) return false;
+  const api = pathApiFor(target) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  const resolvedTarget = canonicalPath(target);
+  const resolvedRoot = canonicalPath(root);
+  const relative = api.relative(resolvedRoot, resolvedTarget);
+  if (!relative) return true;
+  return relative !== '..' && !relative.startsWith(`..${api.sep}`) && !api.isAbsolute(relative);
+}
+
+function absoluteTarget(target, root) {
+  const text = String(target || '').trim();
+  if (!text) return null;
+  const api = pathApiFor(text) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  return api.isAbsolute(text) ? api.normalize(text) : api.resolve(root, text);
+}
+
+function patchTargets(patchText) {
+  const targets = [];
+  const regex = /^\*\*\* (?:Add|Update|Delete) File:\s*(.+?)\s*$/gm;
+  let match;
+  while ((match = regex.exec(String(patchText || ''))) !== null) targets.push(match[1]);
+  return targets;
+}
+
+function editTargets(payload) {
+  const tool = toolNameOf(payload);
+  const input = toolInputOf(payload);
+  if (tool === 'Edit' || tool === 'Write') {
+    const target = input.file_path || input.filePath || input.path;
+    return target ? [String(target)] : [];
+  }
+  if (tool === 'apply_patch') {
+    return patchTargets(input.patch || input.command || input.content || '');
+  }
+  return [];
+}
+
+function touchesWorkspace(payload, root) {
+  const targets = editTargets(payload);
+  if (targets.length === 0) return false;
+  return targets.some(target => isWithin(absoluteTarget(target, root), root));
+}
+
+function writeState(stateFile, state) {
+  fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+}
+
 function main(payload) {
   try {
     const root = getWorkspaceRoot(payload);
@@ -33,17 +117,32 @@ function main(payload) {
       state.editCount = 0;
     }
 
+    // Host scratchpads, memory stores, temp files, and any other target outside
+    // the repository must not contribute to a repository commit reminder.
+    if (!touchesWorkspace(payload, root)) {
+      writeState(stateFile, state);
+      process.exit(0);
+    }
+
     state.editCount += 1;
-    fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+    writeState(stateFile, state);
 
     const overThreshold = state.editCount >= THRESHOLD;
     const onNudgeBeat = overThreshold && (state.editCount - THRESHOLD) % RENUDGE_EVERY === 0;
 
     if (onNudgeBeat) {
       const statusRaw = execSync('git status --porcelain', { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-      const changedFiles = statusRaw ? statusRaw.split('\n').length : 0;
-      console.error(`[Atomic Commit Check] ${state.editCount} apply_patch calls since the last commit (${changedFiles} files currently changed).`);
-      console.error(`If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.`);
+      if (!statusRaw) {
+        // Calls that produced no Git-visible change (or work already reverted)
+        // must not leave a stale counter that immediately re-nudges later.
+        state.editCount = 0;
+        writeState(stateFile, state);
+        process.exit(0);
+      }
+
+      const changedFiles = statusRaw.split('\n').length;
+      console.error(`[Atomic Commit Check] ${state.editCount} edits since the last commit (${changedFiles} files currently changed).`);
+      console.error('If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.');
       process.exit(2);
     }
 
@@ -66,3 +165,12 @@ process.stdin.on('error', () => {
   clearTimeout(timeout);
   main(null);
 });
+
+module.exports = {
+  absoluteTarget,
+  canonicalPath,
+  editTargets,
+  isWithin,
+  patchTargets,
+  touchesWorkspace,
+};

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/action-gate-rules.json

@@ -4,7 +4,7 @@
     {
       "id": "git-force-push",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))",
       "flags": "i",
       "reason": "Force-pushing can rewrite remote history.",
       "scope": "always"
@@ -12,7 +12,7 @@
     {
       "id": "git-reset-hard",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+reset\\s+--hard\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b",
       "flags": "i",
       "reason": "git reset --hard can discard local work.",
       "scope": "always"
@@ -20,7 +20,7 @@
     {
       "id": "git-clean-force-delete",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))",
       "flags": "i",
       "reason": "git clean with force and directory deletion can remove untracked work.",
       "scope": "always"
@@ -28,15 +28,15 @@
     {
       "id": "recursive-delete",
       "tools": ["Bash"],
-      "pattern": "(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\\"']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
       "flags": "i",
       "reason": "Recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
     },
     {
       "id": "powershell-recursive-force-delete",
-      "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
+      "tools": ["PowerShell"],
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
       "flags": "i",
       "reason": "PowerShell recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
@@ -44,7 +44,7 @@
     {
       "id": "sql-destructive-ddl",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
       "flags": "i",
       "reason": "Destructive SQL DDL can irreversibly remove production data or schema state.",
       "scope": "always"
@@ -52,7 +52,7 @@
     {
       "id": "package-publish",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
       "flags": "i",
       "reason": "Publishing creates an external package/release side effect.",
       "scope": "always"
@@ -60,7 +60,7 @@
     {
       "id": "github-release-create",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgh\\s+release\\s+create\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b",
       "flags": "i",
       "reason": "Creating a GitHub release is an external irreversible publication action.",
       "scope": "always"
@@ -68,7 +68,7 @@
     {
       "id": "production-deploy",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
       "flags": "i",
       "reason": "Deployment changes an external environment and requires explicit approval.",
       "scope": "always"

package/plugins/harness-everything/hooks/scripts/action-gate.js

@@ -20,15 +20,15 @@ const ALWAYS_ASK_POLICY = 'always-ask';
 // Fail-safe defaults are used only when the configured table is missing or
 // invalid. A valid-but-empty table stays empty so CI can catch policy erasure.
 const BUILTIN_RULES = [
-  ['git-force-push', ['Bash', 'PowerShell'], '\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
-  ['git-reset-hard', ['Bash', 'PowerShell'], '\\bgit\\s+reset\\s+--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
-  ['git-clean-force-delete', ['Bash', 'PowerShell'], '\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
-  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['powershell-recursive-force-delete', ['Bash', 'PowerShell'], '\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
-  ['package-publish', ['Bash', 'PowerShell'], '\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
-  ['github-release-create', ['Bash', 'PowerShell'], '\\bgh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
-  ['production-deploy', ['Bash', 'PowerShell'], '\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
+  ['git-force-push', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
+  ['git-reset-hard', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
+  ['git-clean-force-delete', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
+  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\"\']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['powershell-recursive-force-delete', ['PowerShell'], '(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
+  ['package-publish', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
+  ['github-release-create', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
+  ['production-deploy', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
 ].map(([id, tools, pattern, flags, reason, scope]) => ({ id, tools, pattern, flags, reason, scope }));
 
 function hashExact(value) {
@@ -153,9 +153,15 @@ function deleteTargets(command, ruleId) {
   const tails = [];
   let regex = null;
   if (ruleId === 'recursive-delete') {
-    regex = /(?:^|[;&|\n]\s*)rm\s+([^;&|\n]+)/ig;
+    regex = /(?:^|[;&|\n]\s*)(?:sudo(?:\s+-\S+)*\s+)?rm\s+([^;&|\n]+)/ig;
+    const wrapper = /(?:^|[;&|\n]\s*)(?:bash|sh)\s+(?:-\S+\s+)*-c\s+(["'])([\s\S]*?)\1/ig;
+    let wrapped;
+    while ((wrapped = wrapper.exec(text)) !== null) {
+      tails.push(...deleteTargets(wrapped[2], ruleId));
+      if (wrapped[0].length === 0) wrapper.lastIndex++;
+    }
   } else if (ruleId === 'powershell-recursive-force-delete') {
-    regex = /\bRemove-Item\b([^;|\n]+)/ig;
+    regex = /(?:^|[;|\n]\s*)(?:Remove-Item|ri|rm)\b([^;|\n]+)/ig;
   }
   if (!regex) return [];
 
@@ -190,6 +196,10 @@ function isWithin(target, root) {
 
 function scratchRoots(payload, sessionDir) {
   const roots = [os.tmpdir(), path.join(sessionDir, 'scratch')];
+  // Git Bash/MSYS exposes the Windows temp area as /tmp (and sometimes
+  // /var/tmp). Treat those aliases as scratch on Windows instead of gating a
+  // harmless temp cleanup merely because the host path syntax differs.
+  if (process.platform === 'win32') roots.push('/tmp', '/var/tmp');
   const declared = payload && (payload.scratchpad_path || payload.scratchpadPath || (payload.harness && payload.harness.scratchpadPath));
   if (declared) roots.push(declared);
   if (process.env.HARNESS_SCRATCH_DIR) roots.push(process.env.HARNESS_SCRATCH_DIR);

package/plugins/harness-everything/hooks/scripts/atomic-commit-check.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 /**
- * Atomic Commit Check (PostToolUse: apply_patch)
- * PostToolUse can't block - the edit/write already happened. So this counts
- * apply_patch calls since the last commit and, once the count crosses a
- * threshold, feeds a strong reminder back to Claude (exit 2) to commit the
- * completed chunk before piling on more changes. Resets whenever HEAD moves.
+ * Atomic Commit Check (PostToolUse: Edit/Write/apply_patch)
+ * PostToolUse can't block - the edit/write already happened. Count only edits
+ * whose targets resolve inside the current workspace. Once the count crosses
+ * the threshold, emit a strong reminder only when the Git worktree actually
+ * has uncommitted changes. Resets whenever HEAD moves.
  * Fails open on any error - this is a nudge, never a hard stop.
  */
 const { execSync } = require('child_process');
@@ -15,6 +15,90 @@ const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 const THRESHOLD = 6;
 const RENUDGE_EVERY = 3;
 
+function toolNameOf(payload) {
+  return String((payload && (payload.tool_name || payload.toolName)) || '');
+}
+
+function toolInputOf(payload) {
+  return (payload && (payload.tool_input || payload.toolInput || payload.input)) || {};
+}
+
+function pathApiFor(value) {
+  return /^[A-Za-z]:[\\/]/.test(String(value || '')) ? path.win32 : path;
+}
+
+function canonicalPath(value) {
+  const text = String(value || '');
+  if (!text) return null;
+  const api = pathApiFor(text);
+  const resolved = api.resolve(text);
+
+  // realpath() is necessary on macOS where /var is a symlink to /private/var.
+  // New Write targets may not exist yet, so canonicalize the nearest existing
+  // ancestor and append the missing path segments without requiring creation.
+  const missing = [];
+  let cursor = resolved;
+  while (cursor && !fs.existsSync(cursor)) {
+    const parent = api.dirname(cursor);
+    if (!parent || parent === cursor) break;
+    missing.unshift(api.basename(cursor));
+    cursor = parent;
+  }
+  if (!cursor || !fs.existsSync(cursor)) return resolved;
+
+  let real = fs.realpathSync.native ? fs.realpathSync.native(cursor) : fs.realpathSync(cursor);
+  for (const segment of missing) real = api.join(real, segment);
+  return api.normalize(real);
+}
+
+function isWithin(target, root) {
+  if (!target || !root) return false;
+  const api = pathApiFor(target) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  const resolvedTarget = canonicalPath(target);
+  const resolvedRoot = canonicalPath(root);
+  const relative = api.relative(resolvedRoot, resolvedTarget);
+  if (!relative) return true;
+  return relative !== '..' && !relative.startsWith(`..${api.sep}`) && !api.isAbsolute(relative);
+}
+
+function absoluteTarget(target, root) {
+  const text = String(target || '').trim();
+  if (!text) return null;
+  const api = pathApiFor(text) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  return api.isAbsolute(text) ? api.normalize(text) : api.resolve(root, text);
+}
+
+function patchTargets(patchText) {
+  const targets = [];
+  const regex = /^\*\*\* (?:Add|Update|Delete) File:\s*(.+?)\s*$/gm;
+  let match;
+  while ((match = regex.exec(String(patchText || ''))) !== null) targets.push(match[1]);
+  return targets;
+}
+
+function editTargets(payload) {
+  const tool = toolNameOf(payload);
+  const input = toolInputOf(payload);
+  if (tool === 'Edit' || tool === 'Write') {
+    const target = input.file_path || input.filePath || input.path;
+    return target ? [String(target)] : [];
+  }
+  if (tool === 'apply_patch') {
+    return patchTargets(input.patch || input.command || input.content || '');
+  }
+  return [];
+}
+
+function touchesWorkspace(payload, root) {
+  const targets = editTargets(payload);
+  if (targets.length === 0) return false;
+  return targets.some(target => isWithin(absoluteTarget(target, root), root));
+}
+
+function writeState(stateFile, state) {
+  fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+}
+
 function main(payload) {
   try {
     const root = getWorkspaceRoot(payload);
@@ -33,17 +117,32 @@ function main(payload) {
       state.editCount = 0;
     }
 
+    // Host scratchpads, memory stores, temp files, and any other target outside
+    // the repository must not contribute to a repository commit reminder.
+    if (!touchesWorkspace(payload, root)) {
+      writeState(stateFile, state);
+      process.exit(0);
+    }
+
     state.editCount += 1;
-    fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+    writeState(stateFile, state);
 
     const overThreshold = state.editCount >= THRESHOLD;
     const onNudgeBeat = overThreshold && (state.editCount - THRESHOLD) % RENUDGE_EVERY === 0;
 
     if (onNudgeBeat) {
       const statusRaw = execSync('git status --porcelain', { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-      const changedFiles = statusRaw ? statusRaw.split('\n').length : 0;
-      console.error(`[Atomic Commit Check] ${state.editCount} apply_patch calls since the last commit (${changedFiles} files currently changed).`);
-      console.error(`If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.`);
+      if (!statusRaw) {
+        // Calls that produced no Git-visible change (or work already reverted)
+        // must not leave a stale counter that immediately re-nudges later.
+        state.editCount = 0;
+        writeState(stateFile, state);
+        process.exit(0);
+      }
+
+      const changedFiles = statusRaw.split('\n').length;
+      console.error(`[Atomic Commit Check] ${state.editCount} edits since the last commit (${changedFiles} files currently changed).`);
+      console.error('If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.');
       process.exit(2);
     }
 
@@ -66,3 +165,12 @@ process.stdin.on('error', () => {
   clearTimeout(timeout);
   main(null);
 });
+
+module.exports = {
+  absoluteTarget,
+  canonicalPath,
+  editTargets,
+  isWithin,
+  patchTargets,
+  touchesWorkspace,
+};

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",