harnessed 3.0.1 → 3.0.2

package/README.md

@@ -34,6 +34,10 @@
 npm install -g harnessed && harnessed setup
 ```
 
+> Windows PowerShell 5.x 不支持 `&&` 链接,需改 `;` 或分两行 (`npm install -g harnessed; harnessed setup`)。bash / zsh / PowerShell 7+ / cmd.exe 都正常。
+
+🤖 **或让 AI 帮你装** — 复制 [INSTALL-WITH-AI.md](./INSTALL-WITH-AI.md) 整段粘贴进 Claude Code (或任何 AI 助手),AI 自动处理 OS / 权限 / PATH / corepack 等 edge case。
+
 ---
 
 ## 📐 4-stage 流程图

package/dist/cli.mjs

@@ -793,7 +793,7 @@ var init_resume = __esm({
 
 // package.json
 var package_default = {
-  version: "3.0.1"};
+  version: "3.0.2"};
 
 // src/manifest/errors.ts
 function instancePathToKeyPath(instancePath) {
@@ -3404,6 +3404,9 @@ function runArgs(claudeArgs, cwd, timeoutMs = 15e3) {
     });
   });
 }
+function getMcpSpawnCwd() {
+  return homedir();
+}
 
 // src/installers/ccPluginMarketplace.ts
 function parseCmd(cmd) {
@@ -3455,8 +3458,8 @@ var installCcPluginMarketplace = async (ctx) => {
       }
     };
   }
-  const pluginName = parsed.pluginAtMkt.split("@")[0];
-  const installArgs = ["plugin", "install", parsed.pluginAtMkt, "--scope", "project"];
+  const pluginName = parsed.pluginAtMkt.split("@")[0] ?? parsed.pluginAtMkt;
+  const installArgs = ["plugin", "install", parsed.pluginAtMkt, "--scope", "user"];
   const allArgs = [];
   if (parsed.marketplaceRef !== null) {
     allArgs.push(["plugin", "marketplace", "add", parsed.marketplaceRef]);
@@ -3464,30 +3467,30 @@ var installCcPluginMarketplace = async (ctx) => {
   allArgs.push(installArgs);
   for (const argSet of allArgs) {
     for (const a of argSet) {
-      const violation2 = checkCmdString(a);
-      if (violation2) {
+      const violation = checkCmdString(a);
+      if (violation) {
         return {
           ok: false,
           phase: "preflight",
           error: err(
             ctx,
             "/spec/install/cmd",
-            `shell escape detected in constructed cc-plugin arg '${a.slice(0, 60)}': ${violation2.label} (${violation2.hint})`,
+            `shell escape detected in constructed cc-plugin arg '${a.slice(0, 60)}': ${violation.label} (${violation.hint})`,
             "security-gate-bypass"
           )
         };
       }
     }
   }
-  const settingsFile = `${ctx.cwd}/.claude/settings.json`;
+  const settingsFile = `${getMcpSpawnCwd()}/.claude.json`;
   const newEntry = JSON.stringify({ enabledPlugins: { [parsed.pluginAtMkt]: true } }, null, 2);
   const plan = {
     files: [
       {
         target: settingsFile,
-        scope: "PROJECT",
+        scope: "HOME",
         oldText: "",
-        newText: `// will be merged into .claude/settings.json enabledPlugins map by \`claude plugin install\`:
+        newText: `// will be merged into ~/.claude.json enabledPlugins map by \`claude plugin install --scope user\`:
 ${newEntry}
 `
       }
@@ -3502,15 +3505,13 @@ ${newEntry}
   if (ctx.opts.dryRun) return { aborted: true, reason: "user-cancel" };
   const bk = await backup(plan, ctx);
   if (!bk.ok) return { ok: false, phase: "preflight", error: bk.error };
+  const spawnCwd = install.cwd ?? getMcpSpawnCwd();
   let stepOneStderr = "";
   if (parsed.marketplaceRef !== null) {
-    const r1 = await runArgs(
-      ["plugin", "marketplace", "add", parsed.marketplaceRef],
-      install.cwd ?? ctx.cwd
-    );
+    const r1 = await runArgs(["plugin", "marketplace", "add", parsed.marketplaceRef], spawnCwd);
     stepOneStderr = r1.stderr;
   }
-  const r2 = await runArgs(installArgs, install.cwd ?? ctx.cwd);
+  const r2 = await runArgs(installArgs, spawnCwd);
   if (r2.exitCode !== 0) {
     return {
       ok: false,
@@ -3524,43 +3525,34 @@ ${newEntry}
       )
     };
   }
-  const verifyShell = process.platform === "win32" ? "cmd.exe" : "/bin/sh";
-  const verifyFlag = process.platform === "win32" ? "/c" : "-c";
-  const verifyLine = `claude plugin list --json | grep -q ${pluginName}`;
-  const violation = checkCmdString(verifyLine);
-  if (violation) {
-    return {
-      ok: false,
-      phase: "verify",
-      backupId: bk.backupId,
-      error: err(
-        ctx,
-        "/spec/verify/cmd",
-        `verify shell escape: ${violation.label}`,
-        "security-gate-bypass"
-      )
-    };
-  }
   const vr = await new Promise((resolve9) => {
-    const child = spawn(verifyShell, [verifyFlag, verifyLine], { cwd: ctx.cwd, windowsHide: true });
+    const child = spawn("claude", ["plugin", "list", "--json"], {
+      cwd: spawnCwd,
+      shell: process.platform === "win32",
+      windowsHide: true
+    });
+    let stdout2 = "";
     let stderr = "";
+    child.stdout?.setEncoding("utf8").on("data", (c) => {
+      stdout2 += c;
+    });
     child.stderr?.setEncoding("utf8").on("data", (c) => {
       stderr += c;
     });
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
-      resolve9({ exitCode: -1, stderr: `${stderr}[timeout]` });
+      resolve9({ exitCode: -1, stderr: `${stderr}[timeout]`, stdout: stdout2 });
     }, 15e3);
     child.on("error", (e) => {
       clearTimeout(timer);
-      resolve9({ exitCode: -1, stderr: e.message });
+      resolve9({ exitCode: -1, stderr: e.message, stdout: stdout2 });
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve9({ exitCode: code ?? -1, stderr });
+      resolve9({ exitCode: code ?? -1, stderr, stdout: stdout2 });
     });
   });
-  if (vr.exitCode !== 0) {
+  if (vr.exitCode !== 0 || !vr.stdout.includes(pluginName)) {
     return {
       ok: false,
       phase: "verify",
@@ -3568,7 +3560,7 @@ ${newEntry}
       error: err(
         ctx,
         "/spec/verify/cmd",
-        `verify exit ${vr.exitCode}: ${vr.stderr.slice(0, 200)}`,
+        `verify exit ${vr.exitCode} or '${pluginName}' not in plugin list stdout: ${vr.stderr.slice(0, 200)}`,
         "verify-failed"
       )
     };
@@ -3576,8 +3568,9 @@ ${newEntry}
   await updateInstalled(ctx.cwd, ctx.manifest.metadata.name, install.git_ref, "");
   return { ok: true, backupId: bk.backupId, appliedFiles: [settingsFile] };
 };
-var DEFAULT_TIMEOUT_MS = 15e3;
-async function spawnCmd(ctx, cmd, args) {
+var DEFAULT_VERIFY_TIMEOUT_MS = 15e3;
+var DEFAULT_INSTALL_TIMEOUT_MS = 6e4;
+async function spawnCmd(ctx, cmd, args, timeoutMs) {
   const violation = checkCmdString(cmd);
   if (violation) {
     return {
@@ -3594,8 +3587,7 @@ async function spawnCmd(ctx, cmd, args) {
     };
   }
   const installCfg = ctx.manifest.spec.install;
-  const verifyCfg = ctx.manifest.spec.verify;
-  const timeoutMs = verifyCfg.timeout_ms ?? DEFAULT_TIMEOUT_MS;
+  const effectiveTimeoutMs = timeoutMs ?? DEFAULT_INSTALL_TIMEOUT_MS;
   const env = { ...process.env, ...installCfg.env ?? {} };
   const cwd = installCfg.cwd ?? ctx.cwd;
   let child;
@@ -3622,13 +3614,13 @@ async function spawnCmd(ctx, cmd, args) {
         error: {
           file: ctx.manifest.metadata.name,
           path: "/spec/install/cmd",
-          message: `spawn timed out after ${timeoutMs}ms (cmd: ${cmd}); partial stderr: ${stderr.slice(0, 200)}`,
+          message: `spawn timed out after ${effectiveTimeoutMs}ms (cmd: ${cmd}); partial stderr: ${stderr.slice(0, 200)}`,
           line: null,
           column: null,
           keyword: "spawn-timeout"
         }
       });
-    }, timeoutMs);
+    }, effectiveTimeoutMs);
     child.on("error", (err2) => {
       clearTimeout(timer);
       resolve9({
@@ -3774,7 +3766,7 @@ var installGitCloneWithSetup = async (ctx) => {
   if (ctx.opts.dryRun) return { aborted: true, reason: "user-cancel" };
   const bk = await backup(plan, ctx);
   if (!bk.ok) return { ok: false, phase: "preflight", error: bk.error };
-  const sp = await spawnCmd(ctx, install.cmd, []);
+  const sp = await spawnCmd(ctx, install.cmd, [], DEFAULT_INSTALL_TIMEOUT_MS);
   if (!("exitCode" in sp)) return { ...sp, backupId: bk.backupId };
   if (sp.exitCode !== 0) {
     return {
@@ -3816,7 +3808,8 @@ var installGitCloneWithSetup = async (ctx) => {
       )
     };
   }
-  const vr = await spawnCmd(ctx, ctx.manifest.spec.verify.cmd, []);
+  const verifyTimeoutMs = ctx.manifest.spec.verify.timeout_ms ?? DEFAULT_VERIFY_TIMEOUT_MS;
+  const vr = await spawnCmd(ctx, ctx.manifest.spec.verify.cmd, [], verifyTimeoutMs);
   if (!("exitCode" in vr)) return { ...vr, backupId: bk.backupId };
   const expected = ctx.manifest.spec.verify.expected_exit_code ?? 0;
   if (vr.exitCode !== expected) {
@@ -3919,33 +3912,23 @@ var installMcpHttpAdd = async (ctx) => {
       }
     };
   }
-  const addArgs = [
-    "mcp",
-    "add",
-    "--scope",
-    "project",
-    "--transport",
-    "http",
-    ...hdr.flat,
-    name,
-    url
-  ];
+  const addArgs = ["mcp", "add", "--scope", "user", "--transport", "http", ...hdr.flat, name, url];
   for (const a of addArgs) {
-    const violation2 = checkCmdString(a);
-    if (violation2) {
+    const violation = checkCmdString(a);
+    if (violation) {
       return {
         ok: false,
         phase: "preflight",
         error: err(
           ctx,
           "/spec/install/cmd",
-          `shell escape detected in constructed mcp-http-add arg '${a.slice(0, 60)}': ${violation2.label} (${violation2.hint})`,
+          `shell escape detected in constructed mcp-http-add arg '${a.slice(0, 60)}': ${violation.label} (${violation.hint})`,
           "security-gate-bypass"
         )
       };
     }
   }
-  const mcpFile = `${ctx.cwd}/.mcp.json`;
+  const mcpFile = `${getMcpSpawnCwd()}/.claude.json`;
   const headersObj = {};
   for (let i = 0; i < hdr.flat.length; i += 2) {
     const kv = hdr.flat[i + 1];
@@ -3959,9 +3942,9 @@ var installMcpHttpAdd = async (ctx) => {
     files: [
       {
         target: mcpFile,
-        scope: "PROJECT",
+        scope: "HOME",
         oldText: "",
-        newText: `// will be merged into .mcp.json mcpServers map by \`claude mcp add\`:
+        newText: `// will be merged into ~/.claude.json mcpServers map by \`claude mcp add --scope user\`:
 ${newEntry}
 `
       }
@@ -3976,9 +3959,10 @@ ${newEntry}
   if (ctx.opts.dryRun) return { aborted: true, reason: "user-cancel" };
   const bk = await backup(plan, ctx);
   if (!bk.ok) return { ok: false, phase: "preflight", error: bk.error };
-  const r = await runArgs(addArgs, install.cwd ?? ctx.cwd);
+  const spawnCwd = install.cwd ?? getMcpSpawnCwd();
+  const r = await runArgs(addArgs, spawnCwd);
   if (r.exitCode !== 0) {
-    if (r.stderr.includes("already exists in .mcp.json")) {
+    if (r.stderr.includes("already exists")) {
       return { ok: true, alreadyInstalled: true, backupId: bk.backupId };
     }
     return {
@@ -3993,43 +3977,34 @@ ${newEntry}
       )
     };
   }
-  const verifyShell = process.platform === "win32" ? "cmd.exe" : "/bin/sh";
-  const verifyFlag = process.platform === "win32" ? "/c" : "-c";
-  const verifyLine = `claude mcp list | grep -q ${name}`;
-  const violation = checkCmdString(verifyLine);
-  if (violation) {
-    return {
-      ok: false,
-      phase: "verify",
-      backupId: bk.backupId,
-      error: err(
-        ctx,
-        "/spec/verify/cmd",
-        `verify shell escape: ${violation.label}`,
-        "security-gate-bypass"
-      )
-    };
-  }
   const vr = await new Promise((resolve9) => {
-    const child = spawn(verifyShell, [verifyFlag, verifyLine], { cwd: ctx.cwd, windowsHide: true });
+    const child = spawn("claude", ["mcp", "list"], {
+      cwd: spawnCwd,
+      shell: process.platform === "win32",
+      windowsHide: true
+    });
+    let stdout2 = "";
     let stderr = "";
+    child.stdout?.setEncoding("utf8").on("data", (c) => {
+      stdout2 += c;
+    });
     child.stderr?.setEncoding("utf8").on("data", (c) => {
       stderr += c;
     });
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
-      resolve9({ exitCode: -1, stderr: `${stderr}[timeout]` });
+      resolve9({ exitCode: -1, stderr: `${stderr}[timeout]`, stdout: stdout2 });
     }, 15e3);
     child.on("error", (e) => {
       clearTimeout(timer);
-      resolve9({ exitCode: -1, stderr: e.message });
+      resolve9({ exitCode: -1, stderr: e.message, stdout: stdout2 });
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve9({ exitCode: code ?? -1, stderr });
+      resolve9({ exitCode: code ?? -1, stderr, stdout: stdout2 });
     });
   });
-  if (vr.exitCode !== 0) {
+  if (vr.exitCode !== 0 || !vr.stdout.includes(name)) {
     return {
       ok: false,
       phase: "verify",
@@ -4037,7 +4012,7 @@ ${newEntry}
       error: err(
         ctx,
         "/spec/verify/cmd",
-        `verify exit ${vr.exitCode}: ${vr.stderr.slice(0, 200)}`,
+        `verify exit ${vr.exitCode} or '${name}' not in mcp list stdout: ${vr.stderr.slice(0, 200)}`,
         "verify-failed"
       )
     };
@@ -4073,7 +4048,7 @@ var installMcpStdioAdd = async (ctx) => {
     "mcp",
     "add",
     "--scope",
-    "project",
+    "user",
     "--transport",
     "stdio",
     name,
@@ -4083,21 +4058,21 @@ var installMcpStdioAdd = async (ctx) => {
     `${pkg}@${ver}`
   ];
   for (const a of addArgs) {
-    const violation2 = checkCmdString(a);
-    if (violation2) {
+    const violation = checkCmdString(a);
+    if (violation) {
       return {
         ok: false,
         phase: "preflight",
         error: err(
           ctx,
           "/spec/install/cmd",
-          `shell escape detected in constructed mcp-add arg '${a.slice(0, 60)}': ${violation2.label} (${violation2.hint})`,
+          `shell escape detected in constructed mcp-add arg '${a.slice(0, 60)}': ${violation.label} (${violation.hint})`,
           "security-gate-bypass"
         )
       };
     }
   }
-  const mcpFile = `${ctx.cwd}/.mcp.json`;
+  const mcpFile = `${getMcpSpawnCwd()}/.claude.json`;
   const newEntry = JSON.stringify(
     { [name]: { type: "stdio", command: "npx", args: ["--yes", `${pkg}@${ver}`] } },
     null,
@@ -4107,9 +4082,9 @@ var installMcpStdioAdd = async (ctx) => {
     files: [
       {
         target: mcpFile,
-        scope: "PROJECT",
+        scope: "HOME",
         oldText: "",
-        newText: `// will be merged into .mcp.json mcpServers map by \`claude mcp add\`:
+        newText: `// will be merged into ~/.claude.json mcpServers map by \`claude mcp add --scope user\`:
 ${newEntry}
 `
       }
@@ -4124,9 +4099,10 @@ ${newEntry}
   if (ctx.opts.dryRun) return { aborted: true, reason: "user-cancel" };
   const bk = await backup(plan, ctx);
   if (!bk.ok) return { ok: false, phase: "preflight", error: bk.error };
-  const r = await runArgs(addArgs, install.cwd ?? ctx.cwd);
+  const spawnCwd = install.cwd ?? getMcpSpawnCwd();
+  const r = await runArgs(addArgs, spawnCwd);
   if (r.exitCode !== 0) {
-    if (r.stderr.includes("already exists in .mcp.json")) {
+    if (r.stderr.includes("already exists")) {
       return { ok: true, alreadyInstalled: true, backupId: bk.backupId };
     }
     return {
@@ -4141,43 +4117,34 @@ ${newEntry}
       )
     };
   }
-  const verifyShell = process.platform === "win32" ? "cmd.exe" : "/bin/sh";
-  const verifyFlag = process.platform === "win32" ? "/c" : "-c";
-  const verifyLine = `claude mcp list | grep -q ${name}`;
-  const violation = checkCmdString(verifyLine);
-  if (violation) {
-    return {
-      ok: false,
-      phase: "verify",
-      backupId: bk.backupId,
-      error: err(
-        ctx,
-        "/spec/verify/cmd",
-        `verify shell escape: ${violation.label}`,
-        "security-gate-bypass"
-      )
-    };
-  }
   const vr = await new Promise((resolve9) => {
-    const child = spawn(verifyShell, [verifyFlag, verifyLine], { cwd: ctx.cwd, windowsHide: true });
+    const child = spawn("claude", ["mcp", "list"], {
+      cwd: spawnCwd,
+      shell: process.platform === "win32",
+      windowsHide: true
+    });
+    let stdout2 = "";
     let stderr = "";
+    child.stdout?.setEncoding("utf8").on("data", (c) => {
+      stdout2 += c;
+    });
     child.stderr?.setEncoding("utf8").on("data", (c) => {
       stderr += c;
     });
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
-      resolve9({ exitCode: -1, stderr: `${stderr}[timeout]` });
+      resolve9({ exitCode: -1, stderr: `${stderr}[timeout]`, stdout: stdout2 });
     }, 15e3);
     child.on("error", (e) => {
       clearTimeout(timer);
-      resolve9({ exitCode: -1, stderr: e.message });
+      resolve9({ exitCode: -1, stderr: e.message, stdout: stdout2 });
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve9({ exitCode: code ?? -1, stderr });
+      resolve9({ exitCode: code ?? -1, stderr, stdout: stdout2 });
     });
   });
-  if (vr.exitCode !== 0) {
+  if (vr.exitCode !== 0 || !vr.stdout.includes(name)) {
     return {
       ok: false,
       phase: "verify",
@@ -4185,7 +4152,7 @@ ${newEntry}
       error: err(
         ctx,
         "/spec/verify/cmd",
-        `verify exit ${vr.exitCode}: ${vr.stderr.slice(0, 200)}`,
+        `verify exit ${vr.exitCode} or '${name}' not in mcp list stdout: ${vr.stderr.slice(0, 200)}`,
         "verify-failed"
       )
     };
@@ -4251,7 +4218,7 @@ var installNpmCli = async (ctx) => {
   if (ctx.opts.dryRun) return { aborted: true, reason: "user-cancel" };
   const bk = await backup(plan, ctx);
   if (!bk.ok) return { ok: false, phase: "preflight", error: bk.error };
-  const sp = await spawnCmd(ctx, cmd, []);
+  const sp = await spawnCmd(ctx, cmd, [], DEFAULT_INSTALL_TIMEOUT_MS);
   if (!("exitCode" in sp)) return { ...sp, backupId: bk.backupId };
   if (sp.exitCode !== 0) {
     return {
@@ -4266,7 +4233,8 @@ var installNpmCli = async (ctx) => {
       )
     };
   }
-  const vr = await spawnCmd(ctx, ctx.manifest.spec.verify.cmd, []);
+  const verifyTimeoutMs = ctx.manifest.spec.verify.timeout_ms ?? DEFAULT_VERIFY_TIMEOUT_MS;
+  const vr = await spawnCmd(ctx, ctx.manifest.spec.verify.cmd, [], verifyTimeoutMs);
   if (!("exitCode" in vr)) return { ...vr, backupId: bk.backupId };
   const expected = ctx.manifest.spec.verify.expected_exit_code ?? 0;
   if (vr.exitCode !== expected) {
@@ -4367,7 +4335,7 @@ var installNpxSkillInstaller = async (ctx) => {
   if (ctx.opts.dryRun) return { aborted: true, reason: "user-cancel" };
   const bk = await backup(plan, ctx);
   if (!bk.ok) return { ok: false, phase: "preflight", error: bk.error };
-  const sp = await spawnCmd(ctx, install.cmd, []);
+  const sp = await spawnCmd(ctx, install.cmd, [], DEFAULT_INSTALL_TIMEOUT_MS);
   if (!("exitCode" in sp)) return { ...sp, backupId: bk.backupId };
   if (sp.exitCode !== 0) {
     return {
@@ -4400,7 +4368,8 @@ var installNpxSkillInstaller = async (ctx) => {
       }
     };
   }
-  const vr = await spawnCmd(ctx, ctx.manifest.spec.verify.cmd, []);
+  const verifyTimeoutMs = ctx.manifest.spec.verify.timeout_ms ?? DEFAULT_VERIFY_TIMEOUT_MS;
+  const vr = await spawnCmd(ctx, ctx.manifest.spec.verify.cmd, [], verifyTimeoutMs);
   if (!("exitCode" in vr)) return { ...vr, backupId: bk.backupId };
   const expected = ctx.manifest.spec.verify.expected_exit_code ?? 0;
   if (vr.exitCode !== expected) {
@@ -4896,7 +4865,7 @@ async function warnIfAgentTeamsMissing() {
   console.warn("\n\u26A0\uFE0F  Agent Teams \u672A\u542F\u7528 \u2014 parallelism-gate \u5347\u7EA7\u8DEF\u5F84\u4E0D\u53EF\u7528");
   console.warn("   \u4FEE\u590D: claude config set env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS 1");
   console.warn(
-    "   \u8BF4\u660E: harnessed v2.0 \u4E09\u5C42\u6808\u65B9\u6CD5\u8BBA parallelism-gate \u5347\u7EA7\u8DEF\u5F84\u9700 CC 2.1.133+ Agent Teams enable (sister ~/.claude/rules/agent-teams.md)"
+    "   \u8BF4\u660E: harnessed v3.0 \u4E09\u5C42\u6808\u65B9\u6CD5\u8BBA parallelism-gate \u5347\u7EA7\u8DEF\u5F84\u9700 CC 2.1.133+ Agent Teams enable"
   );
   console.warn(
     "   \u4E0D\u963B\u585E setup,\u540E\u7EED parallelism-gate workflow phase \u89E6\u53D1\u65F6\u81EA\u52A8\u964D\u7EA7 subagent fan-out\n"
@@ -5052,7 +5021,7 @@ MCP servers configured. Run \`/mcp\` in Claude Code to verify each server's conn
       );
     }
     console.log(
-      "\n\u2713 harnessed v2.0 \u4E09\u5C42\u6808\u65B9\u6CD5\u8BBA bundled \u2014 4 workflows + 6 judgments + 37 capabilities ready"
+      "\n\u2713 harnessed v3.0 \u4E09\u5C42\u6808\u65B9\u6CD5\u8BBA bundled \u2014 23 workflows (4 master + 18 sub + 1 standalone) + 6 disciplines + 10 judgments + ~83 capabilities ready"
     );
     console.log(
       "  workflows in <packageRoot>/workflows/ (Pure bundled, NOT user-dir override per D-01)"