metaharness 0.1.0

package/dist/threat-model.js

@@ -0,0 +1,236 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness threat-model <path>` — 20th subcommand (iter 112). Priority 5 from
+// the user's roadmap ("enterprise gold"). Surfaces the existing mcp-scan
+// findings as a clean, scannable threat-model artifact ready for a PR review
+// or security/compliance review.
+//
+// Output (the exact shape the user named):
+//   MCP Threat Model
+//   Allowed tools:        3
+//   Denied tools:         14
+//   Dangerous permissions: 0
+//   Secrets reachable:    no
+//   Network access:       no
+//   Shell access:         no
+//   File write:           no
+//
+// Modes: text (default) · --json · --bundle (ADR-031 schema-1 envelope) ·
+//        --out <file>.
+//
+// Verdict + exit code:
+//   - 0 — clean threat model (no dangerous perms, no secret exposure)
+//   - 1 — medium concerns (network OR file-write granted, OR no audit log)
+//   - 2 — high concerns (shell granted OR default-deny off OR secrets reachable)
+import { existsSync, statSync, writeFileSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { scanMcp } from './mcp-scan.js';
+function safeReadJson(path) {
+    try {
+        if (!existsSync(path))
+            return null;
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function buildThreatModel(dir, generatedAt = new Date().toISOString()) {
+    const root = resolve(dir);
+    const policy = safeReadJson(join(root, '.harness', 'mcp-policy.json'));
+    const settings = safeReadJson(join(root, '.claude', 'settings.json'));
+    const mcpInUse = policy != null || safeReadJson(join(root, '.mcp.json')) != null;
+    // mcp-scan returns the structured findings; we collapse to counters.
+    const scan = scanMcp(root);
+    const allow = settings?.permissions?.allow ?? [];
+    const deny = settings?.permissions?.deny ?? [];
+    const allowedTools = allow.length;
+    const deniedTools = deny.length;
+    const policyDefaultDeny = policy ? policy.defaultDeny === true : null;
+    const auditLog = policy ? policy.auditLog === true : null;
+    const shellAccess = policy?.allowShell === true;
+    const networkAccess = policy?.allowNetwork === true;
+    const fileWrite = policy?.allowFileWrite === true;
+    // "Secrets reachable" = there is no .env-blocking deny rule AND tools have
+    // some non-trivial read permission. Conservative: true if allow has any
+    // Read(*) rule and deny doesn't block .env.
+    const guardsEnv = deny.some((d) => /\.env/.test(d));
+    const hasReadAllow = allow.some((a) => /^Read/.test(a));
+    const secretsReachable = mcpInUse && !guardsEnv && hasReadAllow;
+    // Count "dangerous permissions" = high-severity findings from mcp-scan +
+    // the top-level boolean knobs the user named.
+    let dangerousPermissions = 0;
+    if (shellAccess)
+        dangerousPermissions++;
+    if (networkAccess)
+        dangerousPermissions++;
+    if (fileWrite)
+        dangerousPermissions++;
+    if (secretsReachable)
+        dangerousPermissions++;
+    if (policy && policyDefaultDeny === false)
+        dangerousPermissions++;
+    let verdict;
+    let exitCode;
+    if (shellAccess || policyDefaultDeny === false || secretsReachable) {
+        verdict = 'high';
+        exitCode = 2;
+    }
+    else if (networkAccess || fileWrite || (mcpInUse && auditLog === false)) {
+        verdict = 'medium';
+        exitCode = 1;
+    }
+    else {
+        verdict = 'clean';
+        exitCode = 0;
+    }
+    return {
+        schema: 1,
+        generatedAt,
+        dir: root,
+        mcpInUse,
+        allowedTools,
+        deniedTools,
+        dangerousPermissions,
+        secretsReachable,
+        networkAccess,
+        shellAccess,
+        fileWrite,
+        policyDefaultDeny,
+        auditLog,
+        findings: scan.findings.map((f) => ({ id: f.id, severity: f.severity, title: f.title })),
+        worst: scan.worst,
+        verdict,
+        exitCode,
+    };
+}
+// --- formatting ------------------------------------------------------------
+function yn(b) {
+    return b ? 'yes' : 'no';
+}
+export function formatThreatModel(tm) {
+    const out = [];
+    out.push('MCP Threat Model');
+    out.push('');
+    if (!tm.mcpInUse) {
+        out.push('  mcp surface:         off (no .mcp.json, no .harness/mcp-policy.json)');
+        out.push('  threat surface:      none — MCP is not in use');
+        out.push('');
+        out.push('Verdict: clean (exit 0)');
+        return out;
+    }
+    out.push(`  Allowed tools:        ${tm.allowedTools}`);
+    out.push(`  Denied tools:         ${tm.deniedTools}`);
+    out.push(`  Dangerous permissions: ${tm.dangerousPermissions}`);
+    out.push(`  Secrets reachable:    ${yn(tm.secretsReachable)}`);
+    out.push(`  Network access:       ${yn(tm.networkAccess)}`);
+    out.push(`  Shell access:         ${yn(tm.shellAccess)}`);
+    out.push(`  File write:           ${yn(tm.fileWrite)}`);
+    if (tm.policyDefaultDeny !== null) {
+        out.push(`  Default-deny policy:  ${yn(tm.policyDefaultDeny)}`);
+    }
+    if (tm.auditLog !== null) {
+        out.push(`  Audit log:            ${yn(tm.auditLog)}`);
+    }
+    if (tm.findings.length > 0) {
+        out.push('');
+        out.push('Findings:');
+        for (const f of tm.findings) {
+            out.push(`  [${f.severity.toUpperCase().padEnd(6)}] ${f.id} — ${f.title}`);
+        }
+    }
+    out.push('');
+    out.push(`Verdict: ${tm.verdict} (exit ${tm.exitCode})`);
+    if (tm.verdict !== 'clean') {
+        out.push('Run: harness mcp-scan ' + tm.dir + '   # for the full finding list');
+    }
+    return out;
+}
+// --- sanitisation (ADR-031) ------------------------------------------------
+const SECRET_RE = /(secret|token|key|password|passphrase)/i;
+function sanitise(v) {
+    if (v == null)
+        return v;
+    if (Array.isArray(v))
+        return v.map(sanitise);
+    if (typeof v === 'object') {
+        const out = {};
+        for (const [k, val] of Object.entries(v)) {
+            out[k] = SECRET_RE.test(k) ? '[REDACTED]' : sanitise(val);
+        }
+        return out;
+    }
+    return v;
+}
+// --- dispatch --------------------------------------------------------------
+function usage() {
+    return [
+        'Usage: harness threat-model <path> [--out <file>] [--json] [--bundle]',
+        '',
+        '  MCP threat-model artifact — scannable in a PR or compliance review.',
+        '  Reports allowed/denied tools, dangerous permissions, secret reachability,',
+        '  network/shell/file-write grants, default-deny policy posture.',
+        '',
+        '  --out <file>   Write the JSON artifact to <file>.',
+        '  --json         Emit JSON to stdout instead of text.',
+        '  --bundle       Emit the full report as an ADR-031 schema-1 envelope.',
+    ];
+}
+export async function threatModelCmd(args) {
+    const bundle = args.includes('--bundle');
+    const json = args.includes('--json');
+    let outPath = null;
+    const positional = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === '--out') {
+            outPath = args[++i] ?? null;
+            if (!outPath) {
+                const err = { schema: 1, error: 'missing-out-path', exitCode: 2 };
+                return { code: 2, lines: [bundle || json ? JSON.stringify(err, null, 2) : '--out requires a file path'] };
+            }
+        }
+        else if (a === '--bundle' || a === '--json') {
+            /* handled */
+        }
+        else if (a === '--help' || a === '-h') {
+            return { code: 0, lines: usage() };
+        }
+        else if (a && !a.startsWith('--')) {
+            positional.push(a);
+        }
+        else if (a) {
+            const err = { schema: 1, error: `unknown-flag-${a.replace(/^--?/, '')}`, exitCode: 2 };
+            return { code: 2, lines: [bundle || json ? JSON.stringify(err, null, 2) : `Unknown flag: ${a}`] };
+        }
+    }
+    if (positional.length === 0) {
+        return { code: 2, lines: usage() };
+    }
+    const dir = resolve(positional[0]);
+    if (!existsSync(dir) || !statSync(dir).isDirectory()) {
+        const generatedAt = new Date().toISOString();
+        const err = { schema: 1, generatedAt, error: 'not-a-directory', dir, exitCode: 2 };
+        if (bundle || json)
+            return { code: 2, lines: [JSON.stringify(err, null, 2)] };
+        return { code: 2, lines: [`harness threat-model: not a directory: ${dir}`] };
+    }
+    const tm = buildThreatModel(dir);
+    if (outPath) {
+        try {
+            writeFileSync(resolve(outPath), JSON.stringify(tm, null, 2) + '\n', 'utf-8');
+        }
+        catch (e) {
+            const err = { schema: 1, error: 'out-write-failed', detail: String(e), exitCode: 2 };
+            return { code: 2, lines: [bundle || json ? JSON.stringify(err, null, 2) : `harness threat-model: failed to write --out: ${String(e)}`] };
+        }
+    }
+    if (bundle) {
+        return { code: tm.exitCode, lines: [JSON.stringify(sanitise(tm), null, 2)] };
+    }
+    if (json) {
+        return { code: tm.exitCode, lines: [JSON.stringify(tm, null, 2)] };
+    }
+    return { code: tm.exitCode, lines: formatThreatModel(tm) };
+}
+//# sourceMappingURL=threat-model.js.map

package/dist/threat-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-model.js","sourceRoot":"","sources":["../src/threat-model.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,6EAA6E;AAC7E,iCAAiC;AACjC,EAAE;AACF,2CAA2C;AAC3C,qBAAqB;AACrB,4BAA4B;AAC5B,6BAA6B;AAC7B,6BAA6B;AAC7B,6BAA6B;AAC7B,6BAA6B;AAC7B,6BAA6B;AAC7B,6BAA6B;AAC7B,EAAE;AACF,0EAA0E;AAC1E,uBAAuB;AACvB,EAAE;AACF,uBAAuB;AACvB,sEAAsE;AACtE,2EAA2E;AAC3E,iFAAiF;AAEjF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAiB,MAAM,eAAe,CAAC;AAwBvD,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,cAAsB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAC1F,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,IAAI,CAAC;IAEjF,qEAAqE;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3B,MAAM,KAAK,GAAa,QAAQ,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAa,QAAQ,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;IAEzD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC;IAEhC,MAAM,iBAAiB,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;IAClD,2EAA2E;IAC3E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,QAAQ,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC;IAEhE,yEAAyE;IACzE,8CAA8C;IAC9C,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,WAAW;QAAE,oBAAoB,EAAE,CAAC;IACxC,IAAI,aAAa;QAAE,oBAAoB,EAAE,CAAC;IAC1C,IAAI,SAAS;QAAE,oBAAoB,EAAE,CAAC;IACtC,IAAI,gBAAgB;QAAE,oBAAoB,EAAE,CAAC;IAC7C,IAAI,MAAM,IAAI,iBAAiB,KAAK,KAAK;QAAE,oBAAoB,EAAE,CAAC;IAElE,IAAI,OAAoC,CAAC;IACzC,IAAI,QAAmB,CAAC;IACxB,IAAI,WAAW,IAAI,iBAAiB,KAAK,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACnE,OAAO,GAAG,MAAM,CAAC;QACjB,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,IAAI,aAAa,IAAI,SAAS,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,GAAG,QAAQ,CAAC;QACnB,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,OAAO,CAAC;QAClB,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IAED,OAAO;QACL,MAAM,EAAE,CAAC;QACT,WAAW;QACX,GAAG,EAAE,IAAI;QACT,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,oBAAoB;QACpB,gBAAgB;QAChB,aAAa;QACb,WAAW;QACX,SAAS;QACT,iBAAiB;QACjB,QAAQ;QACR,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxF,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO;QACP,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,SAAS,EAAE,CAAC,CAAU;IACpB,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAe;IAC/C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QACnF,GAAG,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;IACvD,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAChE,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC5D,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1D,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,EAAE,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,EAAE,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,UAAU,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzD,IAAI,EAAE,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC,GAAG,GAAG,gCAAgC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAE9E,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAE9E,SAAS,KAAK;IACZ,OAAO;QACL,uEAAuE;QACvE,EAAE;QACF,uEAAuE;QACvE,6EAA6E;QAC7E,iEAAiE;QACjE,EAAE;QACF,qDAAqD;QACrD,uDAAuD;QACvD,wEAAwE;KACzE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAc;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YAClB,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,CAAU,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;gBAC3E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,EAAE,CAAC;YAC5G,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC9C,aAAa;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACrC,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,CAAC,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,CAAU,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAChG,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC;QACpG,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,CAAU,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC5F,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,0CAA0C,GAAG,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,CAAU,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gDAAgD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3I,CAAC;IACH,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7D,CAAC"}

package/dist/upgrade-cmd.d.ts

@@ -0,0 +1,9 @@
+export type SubcommandResult = {
+    code: number;
+    lines: string[];
+};
+/**
+ * `harness upgrade [path] [--apply] [--conflict=inline|rej]`
+ */
+export declare function upgradeCmd(args: string[]): Promise<SubcommandResult>;
+//# sourceMappingURL=upgrade-cmd.d.ts.map

package/dist/upgrade-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-cmd.d.ts","sourceRoot":"","sources":["../src/upgrade-cmd.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAajE;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuE1E"}

package/dist/upgrade-cmd.js

@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness upgrade [path] [--apply] [--conflict=inline|rej]` CLI subcommand.
+//
+// Re-renders the harness's template against the current generator
+// version, computes the drift plan vs the manifest's recorded
+// fingerprints, and either prints the plan (dry-run default) or
+// applies it.
+//
+// Conflict handling:
+//   --conflict=inline (default)  write Git-style conflict markers in-place
+//   --conflict=rej               write the upstream version to `<file>.rej`
+import { resolve, join } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { planUpgrade, formatPlan, applyPlan } from './upgrade.js';
+import { walkTemplate, asFileMap } from './walker.js';
+import { templateDir } from './index.js';
+import { createHash } from 'node:crypto';
+function sha256(s) {
+    return createHash('sha256').update(s, 'utf-8').digest('hex');
+}
+/**
+ * `harness upgrade [path] [--apply] [--conflict=inline|rej]`
+ */
+export async function upgradeCmd(args) {
+    const positional = args.filter(a => !a.startsWith('--'));
+    const dir = resolve(positional[0] ?? process.cwd());
+    const apply = args.includes('--apply');
+    const conflictStyle = args.find(a => a.startsWith('--conflict='))?.slice('--conflict='.length) ?? 'inline';
+    const lines = [`harness upgrade — ${dir} ${apply ? '(APPLY)' : '(DRY-RUN)'}`];
+    if (!['inline', 'rej'].includes(conflictStyle)) {
+        lines.push(`  --conflict=${conflictStyle} unsupported (use inline or rej)`);
+        return { code: 2, lines };
+    }
+    const manifestPath = join(dir, '.harness', 'manifest.json');
+    if (!existsSync(manifestPath)) {
+        lines.push(`  no .harness/manifest.json at ${dir} — not a generated harness`);
+        return { code: 1, lines };
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(await readFile(manifestPath, 'utf-8'));
+    }
+    catch (e) {
+        lines.push(`  manifest is not valid JSON: ${e instanceof Error ? e.message : e}`);
+        return { code: 1, lines };
+    }
+    // Re-render the template that produced this harness, with the same vars,
+    // to get the LATEST expected file map.
+    const tdir = templateDir(manifest.template);
+    if (!existsSync(tdir)) {
+        lines.push(`  template "${manifest.template}" not found at ${tdir}`);
+        lines.push(`  (the create-agent-harness package may have evolved the template id)`);
+        return { code: 1, lines };
+    }
+    const rendered = await walkTemplate(tdir, manifest.vars, { strict: false });
+    const upstreamFiles = asFileMap(rendered);
+    const upstreamFingerprints = {};
+    for (const [path, content] of Object.entries(upstreamFiles)) {
+        upstreamFingerprints[path] = sha256(content);
+    }
+    const plan = await planUpgrade(dir, upstreamFingerprints);
+    lines.push('');
+    for (const planLine of formatPlan(plan).split('\n'))
+        lines.push('  ' + planLine);
+    const total = plan.added.length + plan.removed.length + plan.changed.length;
+    if (total === 0) {
+        lines.push('', '  No drift — harness is up-to-date with the template.');
+        return { code: 0, lines };
+    }
+    const conflicts = plan.changed.filter(c => c.kind === 'conflict');
+    if (!apply) {
+        lines.push('', `  DRY-RUN: re-run with --apply to apply this plan.`);
+        if (conflicts.length > 0) {
+            lines.push(`  ${conflicts.length} conflict(s) will use ${conflictStyle === 'inline' ? 'inline markers' : '.rej files'}.`);
+        }
+        return { code: 0, lines };
+    }
+    // APPLY
+    const modified = await applyPlan(dir, plan, upstreamFiles, { conflictStyle });
+    lines.push('', `  Modified ${modified.length} file(s).`);
+    if (conflicts.length > 0) {
+        lines.push(`  ${conflicts.length} conflict(s) written using ${conflictStyle === 'inline' ? 'inline markers' : '.rej files'} — review manually.`);
+        return { code: 1, lines }; // non-zero so CI flags unresolved conflicts
+    }
+    lines.push('  Clean apply — no conflicts.');
+    return { code: 0, lines };
+}
+//# sourceMappingURL=upgrade-cmd.js.map

package/dist/upgrade-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-cmd.js","sourceRoot":"","sources":["../src/upgrade-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,6EAA6E;AAC7E,EAAE;AACF,kEAAkE;AAClE,8DAA8D;AAC9D,gEAAgE;AAChE,cAAc;AACd,EAAE;AACF,qBAAqB;AACrB,2EAA2E;AAC3E,4EAA4E;AAE5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAYzC,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM,CAAiC,IAAI,QAAQ,CAAC;IAE3I,MAAM,KAAK,GAAa,CAAC,qBAAqB,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAExF,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,gBAAgB,aAAa,kCAAkC,CAAC,CAAC;QAC5E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,kCAAkC,GAAG,4BAA4B,CAAC,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,yEAAyE;IACzE,uCAAuC;IACvC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,QAAQ,kBAAkB,IAAI,EAAE,CAAC,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,oBAAoB,GAA2B,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5D,oBAAoB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;IAEjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5E,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,uDAAuD,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAElE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,oDAAoD,CAAC,CAAC;QACrE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,MAAM,yBAAyB,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;QAC5H,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,QAAQ;IACR,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,QAAQ,CAAC,MAAM,WAAW,CAAC,CAAC;IACzD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,MAAM,8BAA8B,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,qBAAqB,CAAC,CAAC;QACjJ,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAE,4CAA4C;IAC1E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/dist/upgrade.d.ts

@@ -0,0 +1,37 @@
+export interface UpgradePlan {
+    /** Files that exist in old but not in new — should we delete them? */
+    removed: string[];
+    /** Files that are new in the upstream template. Safe to add. */
+    added: string[];
+    /** Files where the upstream version differs from what was generated. */
+    changed: Array<{
+        path: string;
+        /** 'clean' = local matches old (safe overwrite); 'conflict' = local diverged. */
+        kind: 'clean' | 'conflict';
+    }>;
+}
+/**
+ * Compute the upgrade plan without applying anything.
+ *
+ * @param projectDir — root of the harness install
+ * @param newFiles — fingerprint map for the LATEST template render
+ */
+export declare function planUpgrade(projectDir: string, newFiles: Record<string, string>): Promise<UpgradePlan>;
+/**
+ * Render a plan as a human-readable summary.
+ */
+export declare function formatPlan(plan: UpgradePlan): string;
+/**
+ * Write Git-style inline conflict markers into the local file.
+ * Used when planUpgrade reports a 'conflict' entry and the user wants
+ * inline markers (the default).
+ */
+export declare function inlineConflictMarkers(local: string, upstream: string): string;
+/**
+ * Apply an upgrade plan. Returns the list of paths actually modified.
+ * Best-effort — caller should review the plan first via formatPlan().
+ */
+export declare function applyPlan(projectDir: string, plan: UpgradePlan, newContents: Record<string, string>, opts?: {
+    conflictStyle?: 'inline' | 'rej';
+}): Promise<string[]>;
+//# sourceMappingURL=upgrade.d.ts.map

package/dist/upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../src/upgrade.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gEAAgE;IAChE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,iFAAiF;QACjF,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;KAC5B,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,WAAW,CAAC,CAiCtB;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAepD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,MAAM,CASR;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAA;CAAO,GAC9C,OAAO,CAAC,MAAM,EAAE,CAAC,CA2BnB"}

package/dist/upgrade.js

@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness upgrade` — copier-style regenerate-diff-merge.
+//
+// Algorithm (per ADR-008 + copier docs):
+//   1. Read the existing .harness/manifest.json — the source of truth for
+//      what choices were made at generation time.
+//   2. Re-run the scaffold with the SAME vars against the LATEST template
+//      version. Produce fresh fingerprints in-memory.
+//   3. Diff old-fingerprints vs new-fingerprints to find changed/added/
+//      removed files.
+//   4. For each changed file: compare CURRENT (on-disk) vs OLD (manifest)
+//      vs NEW (template). Three-way:
+//        - file unchanged from old -> overwrite with new
+//        - file changed from old, identical to new -> no-op
+//        - file changed from old, different from new -> CONFLICT
+//   5. Write conflicts as inline Git markers (<<<<<<< current ======= new
+//      >>>>>>> upstream) OR as .rej files alongside, depending on user's
+//      preference. Default: inline markers.
+import { readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { diffFingerprints, sha256 } from './manifest.js';
+/**
+ * Compute the upgrade plan without applying anything.
+ *
+ * @param projectDir — root of the harness install
+ * @param newFiles — fingerprint map for the LATEST template render
+ */
+export async function planUpgrade(projectDir, newFiles) {
+    const manifestPath = join(projectDir, '.harness', 'manifest.json');
+    if (!existsSync(manifestPath)) {
+        throw new Error(`No .harness/manifest.json at ${projectDir}. Was this directory created by create-agent-harness?`);
+    }
+    const m = JSON.parse(await readFile(manifestPath, 'utf-8'));
+    const oldFiles = m.files;
+    const diff = diffFingerprints(oldFiles, newFiles);
+    const plan = {
+        removed: diff.removed,
+        added: diff.added,
+        changed: [],
+    };
+    for (const path of diff.changed) {
+        const local = join(projectDir, ...path.split('/'));
+        let kind = 'clean';
+        if (existsSync(local)) {
+            const localHash = sha256(await readFile(local, 'utf-8'));
+            const oldHash = oldFiles[path];
+            if (localHash !== oldHash) {
+                // Local has diverged from the originally-generated content.
+                kind = 'conflict';
+            }
+        }
+        plan.changed.push({ path, kind });
+    }
+    return plan;
+}
+/**
+ * Render a plan as a human-readable summary.
+ */
+export function formatPlan(plan) {
+    const lines = [];
+    lines.push(`Upgrade plan:`);
+    lines.push(`  ${plan.added.length} added`);
+    lines.push(`  ${plan.removed.length} removed`);
+    lines.push(`  ${plan.changed.filter(c => c.kind === 'clean').length} clean-overwrite`);
+    lines.push(`  ${plan.changed.filter(c => c.kind === 'conflict').length} conflict (will need manual resolution)`);
+    if (plan.changed.some(c => c.kind === 'conflict')) {
+        lines.push('');
+        lines.push('Conflicting files:');
+        for (const c of plan.changed.filter(x => x.kind === 'conflict')) {
+            lines.push(`  - ${c.path}`);
+        }
+    }
+    return lines.join('\n');
+}
+/**
+ * Write Git-style inline conflict markers into the local file.
+ * Used when planUpgrade reports a 'conflict' entry and the user wants
+ * inline markers (the default).
+ */
+export function inlineConflictMarkers(local, upstream) {
+    return [
+        '<<<<<<< current',
+        local,
+        '=======',
+        upstream,
+        '>>>>>>> upstream',
+        '',
+    ].join('\n');
+}
+/**
+ * Apply an upgrade plan. Returns the list of paths actually modified.
+ * Best-effort — caller should review the plan first via formatPlan().
+ */
+export async function applyPlan(projectDir, plan, newContents, opts = {}) {
+    const modified = [];
+    const style = opts.conflictStyle ?? 'inline';
+    for (const path of plan.added) {
+        const target = join(projectDir, ...path.split('/'));
+        await writeFile(target, newContents[path] ?? '', 'utf-8');
+        modified.push(path);
+    }
+    for (const c of plan.changed) {
+        const target = join(projectDir, ...c.path.split('/'));
+        const upstream = newContents[c.path] ?? '';
+        if (c.kind === 'clean') {
+            await writeFile(target, upstream, 'utf-8');
+            modified.push(c.path);
+        }
+        else {
+            if (style === 'inline') {
+                const local = existsSync(target) ? await readFile(target, 'utf-8') : '';
+                await writeFile(target, inlineConflictMarkers(local, upstream), 'utf-8');
+            }
+            else {
+                await writeFile(target + '.rej', upstream, 'utf-8');
+            }
+            modified.push(c.path);
+        }
+    }
+    return modified;
+}
+//# sourceMappingURL=upgrade.js.map

package/dist/upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../src/upgrade.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,0DAA0D;AAC1D,EAAE;AACF,yCAAyC;AACzC,0EAA0E;AAC1E,kDAAkD;AAClD,0EAA0E;AAC1E,sDAAsD;AACtD,wEAAwE;AACxE,sBAAsB;AACtB,0EAA0E;AAC1E,qCAAqC;AACrC,yDAAyD;AACzD,4DAA4D;AAC5D,iEAAiE;AACjE,0EAA0E;AAC1E,yEAAyE;AACzE,4CAA4C;AAE5C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAezD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAkB,EAClB,QAAgC;IAEhC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,gCAAgC,UAAU,uDAAuD,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAoB,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC;IAEzB,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAElD,MAAM,IAAI,GAAgB;QACxB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,IAAI,GAAyB,OAAO,CAAC;QACzC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1B,4DAA4D;gBAC5D,IAAI,GAAG,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,kBAAkB,CAAC,CAAC;IACvF,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,MAAM,yCAAyC,CAAC,CAAC;IACjH,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,QAAgB;IAEhB,OAAO;QACL,iBAAiB;QACjB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,kBAAkB;QAClB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,UAAkB,EAClB,IAAiB,EACjB,WAAmC,EACnC,OAA6C,EAAE;IAE/C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,MAAM,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;YAC3E,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,CAAC,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtD,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/validate.d.ts

@@ -0,0 +1,7 @@
+export type SubcommandResult = {
+    code: number;
+    lines: string[];
+};
+/** Top-level dispatcher: `harness validate [path] [--skip-gcp] [--secret=NAME]`. */
+export declare function validate(args: string[]): Promise<SubcommandResult>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AA0BA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAsKjE,oFAAoF;AACpF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+DxE"}