harnessed 4.3.0 → 4.5.0

package/dist/index.mjs

@@ -1,6 +1,6 @@
 // package.json
 var package_default = {
-  version: "4.3.0"};
+  version: "4.5.0"};
 
 // src/index.ts
 var VERSION = package_default.version;

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../package.json","../src/index.ts"],"names":[],"mappings":";AAAA,IAAA,eAAA,GAAA;AAAA,EAEE,OAAA,EAAW,OAgGb,CAAA;;;AC7FO,IAAM,UAAU,eAAA,CAAI","file":"index.mjs","sourcesContent":["{\n  \"name\": \"harnessed\",\n  \"version\": \"4.3.0\",\n  \"description\": \"AI coding harness package manager + composition orchestrator\",\n  \"type\": \"module\",\n  \"license\": \"Apache-2.0\",\n  \"author\": \"easyinplay\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/easyinplay/harnessed.git\"\n  },\n  \"homepage\": \"https://github.com/easyinplay/harnessed#readme\",\n  \"bugs\": \"https://github.com/easyinplay/harnessed/issues\",\n  \"keywords\": [\n    \"claude-code\",\n    \"ai-harness\",\n    \"package-manager\",\n    \"composition\",\n    \"skill-pack\",\n    \"mcp\",\n    \"orchestrator\"\n  ],\n  \"engines\": {\n    \"node\": \">=22.0.0\"\n  },\n  \"packageManager\": \"pnpm@10.12.0\",\n  \"bin\": {\n    \"harnessed\": \"./dist/cli.mjs\"\n  },\n  \"main\": \"./dist/index.mjs\",\n  \"types\": \"./dist/index.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.mjs\",\n      \"default\": \"./dist/index.mjs\"\n    },\n    \"./schemas\": {\n      \"types\": \"./dist/schemas/index.d.ts\",\n      \"import\": \"./dist/schemas/index.mjs\"\n    },\n    \"./package.json\": \"./package.json\"\n  },\n  \"files\": [\n    \"dist\",\n    \"manifests\",\n    \"messages\",\n    \"workflows\",\n    \"routing\",\n    \"config-templates\",\n    \"schemas\",\n    \"README.md\",\n    \"LICENSE\",\n    \"NOTICE\",\n    \"THIRD-PARTY-NOTICES.md\"\n  ],\n  \"scripts\": {\n    \"dev\": \"tsup --watch\",\n    \"build\": \"tsc --noEmit && tsup\",\n    \"build:schema\": \"node ./scripts/build-schema.mjs\",\n    \"validate:schema\": \"node ./scripts/validate-schema.mjs\",\n    \"typecheck\": \"tsc --noEmit\",\n    \"test\": \"vitest run --passWithNoTests\",\n    \"test:watch\": \"vitest\",\n    \"test:coverage\": \"vitest run --coverage --passWithNoTests\",\n    \"bench\": \"vitest bench --run\",\n    \"lint\": \"biome check .\",\n    \"lint:fix\": \"biome check --write .\",\n    \"format\": \"biome format --write .\"\n  },\n  \"dependencies\": {\n    \"@anthropic-ai/claude-agent-sdk\": \"0.3.142\",\n    \"@clack/prompts\": \"^0.10.1\",\n    \"@sinclair/typebox\": \"^0.34.49\",\n    \"ajv\": \"^8.20.0\",\n    \"ajv-errors\": \"^3.0.0\",\n    \"ajv-formats\": \"^3.0.1\",\n    \"commander\": \"^13.0.0\",\n    \"diff\": \"^9.0.0\",\n    \"expr-eval\": \"^2.0.2\",\n    \"picocolors\": \"^1.1.1\",\n    \"proper-lockfile\": \"^4.1.2\",\n    \"yaml\": \"^2.9.0\"\n  },\n  \"devDependencies\": {\n    \"@biomejs/biome\": \"^2.0.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"@types/proper-lockfile\": \"^4.1.4\",\n    \"@vitest/coverage-v8\": \"^4.0.0\",\n    \"tsup\": \"^8.3.0\",\n    \"typescript\": \"^5.6.0\",\n    \"vitest\": \"^4.0.0\"\n  },\n  \"pnpm\": {\n    \"onlyBuiltDependencies\": [\n      \"esbuild\"\n    ]\n  }\n}\n","// Main library entry — re-exports public APIs.\n// phase 1.1 batch 1: skeleton only; schema validator wired in batch 2 (T3+).\n\nimport pkg from '../package.json' with { type: 'json' }\n\nexport const VERSION = pkg.version\n"]}
+{"version":3,"sources":["../package.json","../src/index.ts"],"names":[],"mappings":";AAAA,IAAA,eAAA,GAAA;AAAA,EAEE,OAAA,EAAW,OAkGb,CAAA;;;AC/FO,IAAM,UAAU,eAAA,CAAI","file":"index.mjs","sourcesContent":["{\n  \"name\": \"harnessed\",\n  \"version\": \"4.5.0\",\n  \"description\": \"AI coding harness package manager + composition orchestrator\",\n  \"type\": \"module\",\n  \"license\": \"Apache-2.0\",\n  \"author\": \"easyinplay\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/easyinplay/harnessed.git\"\n  },\n  \"homepage\": \"https://github.com/easyinplay/harnessed#readme\",\n  \"bugs\": \"https://github.com/easyinplay/harnessed/issues\",\n  \"keywords\": [\n    \"claude-code\",\n    \"ai-harness\",\n    \"package-manager\",\n    \"composition\",\n    \"skill-pack\",\n    \"mcp\",\n    \"orchestrator\"\n  ],\n  \"engines\": {\n    \"node\": \">=22.0.0\"\n  },\n  \"packageManager\": \"pnpm@10.12.0\",\n  \"bin\": {\n    \"harnessed\": \"./dist/cli.mjs\",\n    \"harnessed-inject-state\": \"./bin/harnessed-inject-state.mjs\"\n  },\n  \"main\": \"./dist/index.mjs\",\n  \"types\": \"./dist/index.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.mjs\",\n      \"default\": \"./dist/index.mjs\"\n    },\n    \"./schemas\": {\n      \"types\": \"./dist/schemas/index.d.ts\",\n      \"import\": \"./dist/schemas/index.mjs\"\n    },\n    \"./package.json\": \"./package.json\"\n  },\n  \"files\": [\n    \"dist\",\n    \"bin\",\n    \"manifests\",\n    \"messages\",\n    \"workflows\",\n    \"routing\",\n    \"config-templates\",\n    \"schemas\",\n    \"README.md\",\n    \"LICENSE\",\n    \"NOTICE\",\n    \"THIRD-PARTY-NOTICES.md\"\n  ],\n  \"scripts\": {\n    \"dev\": \"tsup --watch\",\n    \"build\": \"tsc --noEmit && tsup\",\n    \"build:schema\": \"node ./scripts/build-schema.mjs\",\n    \"validate:schema\": \"node ./scripts/validate-schema.mjs\",\n    \"typecheck\": \"tsc --noEmit\",\n    \"test\": \"vitest run --passWithNoTests\",\n    \"test:watch\": \"vitest\",\n    \"test:coverage\": \"vitest run --coverage --passWithNoTests\",\n    \"bench\": \"vitest bench --run\",\n    \"lint\": \"biome check .\",\n    \"lint:fix\": \"biome check --write .\",\n    \"format\": \"biome format --write .\"\n  },\n  \"dependencies\": {\n    \"@anthropic-ai/claude-agent-sdk\": \"0.3.142\",\n    \"@clack/prompts\": \"^0.10.1\",\n    \"@sinclair/typebox\": \"^0.34.49\",\n    \"ajv\": \"^8.20.0\",\n    \"ajv-errors\": \"^3.0.0\",\n    \"ajv-formats\": \"^3.0.1\",\n    \"commander\": \"^13.0.0\",\n    \"diff\": \"^9.0.0\",\n    \"expr-eval\": \"^2.0.2\",\n    \"picocolors\": \"^1.1.1\",\n    \"proper-lockfile\": \"^4.1.2\",\n    \"yaml\": \"^2.9.0\"\n  },\n  \"devDependencies\": {\n    \"@biomejs/biome\": \"^2.0.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"@types/proper-lockfile\": \"^4.1.4\",\n    \"@vitest/coverage-v8\": \"^4.0.0\",\n    \"tsup\": \"^8.3.0\",\n    \"typescript\": \"^5.6.0\",\n    \"vitest\": \"^4.0.0\"\n  },\n  \"pnpm\": {\n    \"onlyBuiltDependencies\": [\n      \"esbuild\"\n    ]\n  }\n}\n","// Main library entry — re-exports public APIs.\n// phase 1.1 batch 1: skeleton only; schema validator wired in batch 2 (T3+).\n\nimport pkg from '../package.json' with { type: 'json' }\n\nexport const VERSION = pkg.version\n"]}

package/manifests/optional/codegraph.yaml

@@ -0,0 +1,46 @@
+# yaml-language-server: $schema=../../schemas/manifest.v1.schema.json
+# OPT-IN catalog manifest — lives in manifests/optional/ so `install-base` (which
+# globs only manifests/tools + manifests/skill-packs) never pulls it into the base
+# profile, and `harnessed install <name>` (tools + skill-packs only) never installs
+# it. CodeGraph ships its own installer; harnessed catalogs + detects only.
+apiVersion: harnessed/v1
+kind: Manifest
+metadata:
+  name: codegraph
+  display_name: CodeGraph
+  description: Pre-indexed code knowledge graph (semantic index) for Claude Code — fewer tokens/tool-calls. Opt-in, self-installed.
+  upstream:
+    source: codegraph
+    homepage: https://colbymchenry.github.io/codegraph/
+    repository: https://github.com/colbymchenry/codegraph.git
+    license: MIT
+    notice: |
+      CodeGraph by colbymchenry (MIT, 100% local). Optional semantic code index —
+      harnessed catalogs + detects only; CodeGraph self-installs via its own CLI
+      (`codegraph install` wires its MCP server into Claude Code). Not vendored.
+spec:
+  type: cli-npm
+  component_type: cli-binary
+  category: search
+  install_type: npm
+  install:
+    method: npm-cli
+    cmd: "npm i -g @colbymchenry/codegraph && codegraph install --yes"
+    npm_version: ^1.0.0
+    idempotent_check: "command -v codegraph"
+  verify:
+    cmd: "codegraph status"
+    timeout_ms: 10000
+    expected_exit_code: 0
+  uninstall:
+    cmd: "codegraph uninstall --yes"
+  upstream_health:
+    stability: stable
+    last_check: "2026-06-13"
+    last_known_good_version: "1.0.0"
+    fallback_action: warn
+  signed_by: easyinplay
+  platforms:
+    - linux
+    - darwin
+    - win32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harnessed",
-  "version": "4.3.0",
+  "version": "4.5.0",
   "description": "AI coding harness package manager + composition orchestrator",
   "type": "module",
   "license": "Apache-2.0",
@@ -25,7 +25,8 @@
   },
   "packageManager": "pnpm@10.12.0",
   "bin": {
-    "harnessed": "./dist/cli.mjs"
+    "harnessed": "./dist/cli.mjs",
+    "harnessed-inject-state": "./bin/harnessed-inject-state.mjs"
   },
   "main": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
@@ -43,6 +44,7 @@
   },
   "files": [
     "dist",
+    "bin",
     "manifests",
     "messages",
     "workflows",

package/workflows/capabilities.yaml

@@ -243,6 +243,15 @@ capabilities:
     fires_when:
       - subtask.needs_library_docs == true
 
+  codegraph:
+    impl: mcp
+    cmd: codegraph_explore
+    since: v7.0
+    category: tool-mcp
+    description: 语义代码索引 (symbol/call-graph query; opt-in self-installed, fewer tool-calls)
+    fires_when:
+      - subtask.type in ['code_navigation', 'symbol_lookup', 'call_graph']
+
   tavily-mcp:
     impl: mcp
     cmd: tavily_search
@@ -574,6 +583,14 @@ capabilities:
     description: cc-handoff Ideation→Onboarding + Plan→Execute + file-ownership-strict 跨 CC instance 协议
     discipline_ref: workflows/disciplines/protocols.yaml
 
+  doc-discipline:
+    impl: harnessed-bundled
+    cmd: '<not-applicable-behavioral>'
+    since: v6.0
+    category: behavioral
+    description: STATE digest <100L halt + one-fact-per-file + overview-pointer-no-inline-narrative + transient-archive + status-from-artifacts + responsibility-one-home (6 rules)
+    discipline_ref: workflows/disciplines/doc-discipline.yaml
+
   # ============================================================================
   # Bucket 7 — gstack 33 optional registry-only (D-12 NEW v3)
   # ============================================================================
@@ -806,6 +823,15 @@ capabilities:
     fires_when:
       - phase.stage == 'verify' AND phase.is_release_candidate == true
 
+  release-preflight:
+    impl: harnessed-bundled
+    cmd: harnessed release-preflight
+    since: v7.0
+    category: tool-cli
+    description: 只读发布就绪门 (CHANGELOG/version/git-clean/tag; PR ready != release ready)
+    fires_when:
+      - phase.stage == 'ship'
+
   setup-deploy:
     impl: gstack
     install_type: user-skill

package/workflows/disciplines/doc-discipline.yaml

@@ -0,0 +1,49 @@
+# workflows/disciplines/doc-discipline.yaml
+# 文档纪律 — bundled discipline (STATE digest line-limit + one-fact-per-file +
+# overview-pointer-no-inline-narrative + transient-consume-then-archive +
+# status-derived-from-artifacts + responsibility-matrix-one-home)
+# Phase v6.0 T11.1 — 7th L0 Discipline Substrate per D-09
+# Codifies CLAUDE.md 文档纪律 section (三层渐进式结构 + 反腐防膨胀铁律)
+
+schema_version: harnessed.discipline.v1
+discipline: doc
+enforcement_layer: commit
+auto_enforce: true
+
+rules:
+  - id: state-digest-line-limit
+    description: STATE.md >100 lines triggers halt; override via `HARNESSED_ALLOW_LONG_STATE=1`
+    enforcement: halt
+    trigger: "phase.type == 'commit' AND changed_files contains '.planning/STATE.md'"
+    check_method: external-cmd
+    # No auto_fix_cmd — halt rules do not auto-fix; override is env-based in TS
+
+  - id: one-fact-per-file
+    description: Decision docs must be single-topic; duplicate fact spread across files violates one-fact-per-file
+    enforcement: warn
+    trigger: "phase.type == 'commit' AND changed_files matches '\\.planning/'"
+    check_method: heuristic
+
+  - id: overview-pointer-no-inline-narrative
+    description: ROADMAP/overview docs must not inline closing narrative (叙事进 SUMMARY, not ROADMAP)
+    enforcement: warn
+    trigger: "phase.type == 'commit' AND changed_files matches 'ROADMAP\\.md|STATE\\.md'"
+    check_method: heuristic
+
+  - id: transient-consume-then-archive
+    description: HANDOFF and other transient artifacts must be archived after consumption, not accumulated at .planning/ root
+    enforcement: warn
+    trigger: "phase.type == 'commit' AND changed_files matches 'HANDOFF'"
+    check_method: heuristic
+
+  - id: status-derived-from-artifacts
+    description: Phase status must derive from VERIFICATION artifacts + test results, not hand-maintained booleans in STATE/ROADMAP
+    enforcement: warn
+    trigger: "phase.type == 'commit' AND changed_files contains '.planning/STATE.md'"
+    check_method: heuristic
+
+  - id: responsibility-matrix-one-home
+    description: Each fact has exactly one home per responsibility matrix (decision→ADR, requirement→REQUIREMENTS, etc.); cross-file duplication is a violation
+    enforcement: info
+    trigger: "phase.type == 'commit' AND changed_files matches '\\.planning/'"
+    check_method: heuristic

package/workflows/judgments/stage-routing.yaml

@@ -92,6 +92,13 @@ triggers:
     invokes:
       - capability: code-simplifier
 
+  # Phase 21 NEW — Stage ⑤ Ship master → ship-preflight always (release-readiness gate)
+  ship-preflight-always:
+    description: /ship master → /ship-preflight 总 fire (read-only release-readiness gate)。
+    fires_when: "phase.stage == 'ship'"
+    invokes:
+      - capability: release-preflight
+
   # v3.2.0 NEW — /auto super-master Phase 0.5 understanding check gate
   auto-research-unclear:
     description: |

package/workflows/ship/auto/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: ship
+description: |
+  Stage ⑤ Ship master orchestrator — the release stage after Verify. ship-preflight
+  必跑串行 (release-readiness gate) → 委派 PR/deploy 给 gstack /ship → publish 留
+  publish.yml CI (tag push 触发)。schema_version: harnessed.workflow.v3 with delegates_to
+  (1 sub: preflight serial order 1) + disciplines_applied (6 default) + tools_available
+  (release-preflight + ship + planning-with-files)。Triggered by `/ship` (bare per ADR 0030)
+  or `harnessed ship` after `harnessed verify`. Deploy boundary = TAG-READY (no push/publish/tag).
+trigger_phrases:
+  - "ship"
+  - "发布阶段"
+  - "stage 5 ship"
+  - "release stage"
+  - "send it"
+---
+
+# ship master orchestrator (v3) — Stage ⑤
+
+## Overview
+
+The 5th stage, after Verify. harnessed has the pieces (a release-preflight gate, gstack
+`/ship`, `publish.yml` CI) — this master orchestrates them into one repeatable release path,
+the way comet (archive), Trellis (finish-work), and Claude-Harness (`/harness-release`) each
+close their loop.
+
+| order/mode | sub | when fires |
+| ---------- | --- | ---------- |
+| 1 (serial) | `preflight` | always when stage=='ship' — read-only release-readiness gate |
+
+After preflight passes, the master delegates PR + deploy to gstack `/ship` (composition —
+harnessed does not reimplement it), and the actual `npm publish` + GitHub release happen in
+`publish.yml` CI on tag push.
+
+## Process
+
+1. **preflight (always)** — run `harnessed release-preflight`. If any check fails (most often
+   an empty `## [Unreleased]`), STOP and document the release / clean the tree first.
+2. **PR / deploy (delegate)** — invoke gstack `/ship` for PR creation + pre-land review.
+3. **publish (CI)** — push the `v<version>` tag (with explicit user approval) → `publish.yml`
+   runs `npm publish` + creates the GitHub release.
+
+## Boundary (important)
+
+This stage stops at **tag-ready**. It never pushes to the remote, never publishes to npm, and
+never creates a git tag on its own. Those are CI + explicit-approval actions, by design —
+"PR ready != release ready", and "release ready != already published".

package/workflows/ship/auto/workflow.yaml

@@ -0,0 +1,37 @@
+# workflows/ship/auto/workflow.yaml — Phase 21 (v7.0 follow-on)
+#
+# Stage ⑤ Ship master orchestrator — the release stage after Verify. Closes the
+# ship-stage gap vs comet (archive) / Trellis (finish-work) / Claude-Harness
+# (/harness-release). Composition, not reimplementation:
+#   ship-preflight (serial, always) → delegate PR/deploy to gstack /ship → publish
+#   stays in publish.yml CI on tag push.
+#
+# Deploy boundary = TAG-READY. This stage never pushes, publishes, or creates a tag.
+#
+# Master invariant (WorkflowSchemaV3 + check-workflow-schema K9):
+#   - phases 缺省 (master only has delegates_to[])
+#   - serial mode 必带 explicit order
+#
+# Sister refs:
+#   - workflows/ship/preflight/workflow.yaml — the preflight sub
+#   - workflows/judgments/stage-routing.yaml — ship-preflight-always trigger
+#   - workflows/capabilities.yaml — release-preflight + ship (gstack) + planning-with-files
+
+schema_version: harnessed.workflow.v3
+workflow: ship
+description: |
+  Stage ⑤ Ship master orchestrator — release stage after Verify. ship-preflight 必跑串行
+  (release-readiness gate) → 委派 PR/deploy 给 gstack /ship → publish 留 publish.yml CI
+  (tag push 触发)。Deploy 边界 = tag-ready;本 stage 不 push/publish/创建 tag。
+  Triggered by `/ship` (bare per ADR 0030 namespace policy) after `harnessed verify`.
+
+disciplines_applied: [karpathy, output-style, language, operational, priority, protocols]
+tools_available:
+  - release-preflight
+  - ship
+  - planning-with-files
+
+delegates_to:
+  - sub: preflight
+    mode: serial
+    order: 1

package/workflows/ship/preflight/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: ship-preflight
+description: |
+  Stage ⑤.a Ship sub — release-preflight gate. Runs `harnessed release-preflight`
+  (read-only: CHANGELOG [Unreleased] non-empty + version + git-clean + tag-absent).
+  A failing gate blocks shipping. Nothing is pushed/published/tagged here.
+trigger_phrases:
+  - "release preflight"
+  - "release ready"
+  - "ship preflight"
+  - "发布就绪检查"
+---
+
+# ship-preflight (Stage ⑤.a)
+
+## Overview
+
+The machine-checkable "PR ready != release ready" gate. Runs the harnessed-native
+`harnessed release-preflight` command, which inspects (read-only) whether the repo is
+ready to tag a release:
+
+| check | passes when |
+| ----- | ----------- |
+| `changelog` | `## [Unreleased]` has entries (this release is documented) |
+| `version` | `package.json` has a valid semver |
+| `git-clean` | the working tree has no uncommitted changes |
+| `tag-absent` | a `v<version>` tag does NOT already exist |
+
+## Process
+
+1. Run `harnessed release-preflight`.
+2. If any check fails, STOP — surface the `fix:` hints and do not proceed to PR/tag.
+   - Empty `[Unreleased]` is the most common failure: document the release first.
+3. If all pass, the repo is **tag-ready**. The ship master continues to PR/deploy.
+
+## Boundary
+
+This gate is READ-ONLY. It never pushes, publishes, or creates a tag. The actual
+`npm publish` + GitHub release happen in `publish.yml` CI when a `v<version>` tag is
+pushed (with explicit user approval).

package/workflows/ship/preflight/workflow.yaml

@@ -0,0 +1,29 @@
+# workflows/ship/preflight/workflow.yaml — Phase 21 (v7.0 follow-on)
+#
+# Stage ⑤.a Ship sub-workflow — release-preflight gate ("PR ready != release ready").
+# Read-only: checks CHANGELOG [Unreleased] / version / git-clean / tag-absence via
+# `harnessed release-preflight`. Mutates nothing — publish stays in publish.yml CI.
+#
+# Sister refs:
+#   - workflows/judgments/stage-routing.yaml ship-preflight-always trigger
+#   - workflows/capabilities.yaml — release-preflight (harnessed-bundled CLI gate)
+#   - src/cli/lib/release-preflight.ts collectPreflight
+
+schema_version: harnessed.workflow.v3
+workflow: ship-preflight
+description: |
+  Stage ⑤.a release-preflight gate — runs `harnessed release-preflight` (read-only:
+  CHANGELOG [Unreleased] non-empty + package.json version + git working tree clean +
+  v<version> tag absent). A failing gate BLOCKS shipping until the release is documented
+  and the tree is clean. Nothing is pushed, published, or tagged here.
+
+disciplines_applied: [karpathy, output-style, language, operational, priority, protocols]
+tools_available: [release-preflight]
+
+phases:
+  - id: 01-release-preflight
+    name: release-preflight (read-only release-readiness gate; blocks on any failure)
+    upstream: harnessed
+    capability: '{{ capabilities.release-preflight.cmd }}'
+    model: haiku
+    max_iterations: 1