v0.9.0

Security, part 2: what comes into the project, and projects whose job is security.

Evals: 16 of 16 on Haiku and Sonnet. Details

• Every harness pauses on new code coming in. Adding a dependency, running a package that isn't installed (npx -y, uvx), adding an MCP server or installing a plugin asks you each time. CLAUDE.md gets a rule to check a package before proposing it (it exists, isn't brand new, isn't one letter off a popular name) and to say what was checked.
• Security tooling gets its own profile. A pentest tool, scanner, CTF or red-team project gets a written scope.json (which the setup asks you for and never invents), a guard that blocks any network tool aimed outside it or outside the engagement window, an evidence log, and a dedicated reviewer. See the new recon tool example.
• Every CLAUDE.md points to /harness-bootstrap:check.
• The plugin stays under the plugin directory's size limit: a smaller icon, a lighter Operator's Manual spec, and a release check that fails if it grows too large.

Attack suite: 18 attacks. A normal harness blocks 12 with hooks and 17 counting permission rules; a security-tooling harness blocks 13 and 18. One grader was corrected during the run (it failed a retrofit that kept the repo's own wording for its linter); it re-ran on both models.

Install: /plugin install harness-bootstrap@anthropic-plugin-directory. Full notes: CHANGELOG.

v0.8.1

The plugin you install no longer carries its own test suite.

• The 14 eval cases moved from plugin/evals/ to evals/ at the repo root. Installing the plugin now gets only what it uses: the skills, the manifest, the license and the icon (151 KB down to about 120 KB).
• Nothing the plugin does changed: the skills are byte for byte v0.8.0's, so v0.8.0's results still apply: 14 of 14 on Haiku, Sonnet and Opus.
• scripts/run-evals.mjs puts the plugin and its cases together in a scratch folder for each run.

Install: /plugin install harness-bootstrap@anthropic-plugin-directory. Full notes: CHANGELOG.

v0.8.0

Keeping a harness current. A harness now knows what built it, and a second skill tells you when it has drifted from the code.

Evals: 14 of 14 on Haiku, Sonnet and Opus with the plugin. Plain Claude Code passes 5, 4 and 6 of the 13 cases that can be scored without it, and none of the security and setup ones. Details

• /harness-bootstrap:check, a second skill: audits an existing harness against the code and the plugin as they are now (stale CLAUDE.md entries, traits the code gained since setup, guards that no longer block, a missing security baseline, noisy or broken guards) and proposes one fix, then asks. It never changes the harness on its own.
• A version stamp (.claude/harness.json) and a friction log (one line per guard decision, four fields, never a command or a path), both protected like the rest of the harness.
• Stronger guards: reading a .env file through any shell command, and tampering with a guard through sed -i, cp, mv or rm, are now blocked by hooks, not only by permission rules. Hooks block 12 of 15 attacks (v0.7.1: 8 of 13), 15 of 15 counting permission rules.
• Three examples regenerated with v0.8.0, copied as generated.

Two graders were corrected during the run after Opus missed them on wording rather than substance; both re-ran on all three models. Fable isn't in this run.

Install: /plugin install harness-bootstrap@anthropic-plugin-directory. Full notes: CHANGELOG.

v0.7.1

A setup finishes, and protects itself, even when it can't write everything.

Evals: 12 of 12 on Haiku and 12 of 12 on Sonnet (v0.7.0: 9 and 9). Details

• The setup never ends with nothing written. CLAUDE.md comes first, then settings.json with the security baseline, then the guard hooks, then the rest.
• A refused write blocks that file, not the setup. settings.json and each guard hook are still tried once after a refusal; the closing report names every planned file that wasn't written, with the model each agent would run on.
• The setup questions never stall. With no one to answer, the recommended answers are used and the report says so.
• The skill starts before any code, so a bare "I want to build…" triggers it on Haiku too.
• A picked project name is used in paths as well, never src/<pkg>/.

One grader changed: published-library-semver now reads the closing report, since CLAUDE.md lists only files that exist. The attack suite is unchanged: 13 of 13 counting permission rules.

Install: /plugin install harness-bootstrap@anthropic-plugin-directory. Full notes: CHANGELOG.

v0.7.0: security, measured

Security, measured. Every harness now gets a baseline that holds up against the attacks
coding agents actually face, and the repo can prove what it blocks.

• A security baseline in every harness, every tier. Three parts, all in
  HARNESS_REFERENCE.md §1.2.1:
  • The harness protects itself. Changes to its own hooks, agents and settings ask
    you every time (ask rules, which also cover shell writes like sed -i and >), and
    a guard stops the shell tricks those rules can't see (node -e, git restore,
    PowerShell file commands, switching hooks off). Its override is read from the
    session's environment only, so a command that merely contains ALLOW_HARNESS_EDIT=1
    can't switch it on.
  • Text from outside is data, not instructions. Error messages, dependency READMEs,
    issues, PR comments, web pages and tool output can't tell Claude to run a setup
    script or an install. The rule is in CLAUDE.md, the critical-rules hook and every
    agent.
  • Sandbox first, hooks second. The sandbox is on where Claude Code supports it
    (macOS, Linux, WSL2), with the stack's registry and caches allowed. A small guard
    blocks piping downloads into a shell, running scripts from inside dependencies, DNS
    lookups built from command output, and inline network calls. On native Windows,
    where there is no sandbox, CLAUDE.md says so.
• The push guard catches git -C <dir> push and other option forms, and matches
  PowerShell as well as Bash.
• settings.json no longer carries an mcpServers key; project MCP servers belong in
  .mcp.json.
• Hooks never run a command string through a shell. Child processes get their
  arguments as a list (execFileSync), including the toolchain check, so a path with a
  space or a quote can't break or redirect a command, and security scanners no longer
  flag generated hooks for shell injection. The four example hooks that did this are
  fixed and marked as edited after generation.
• Repo hygiene from the same scan: the stats workflow pins its action to a commit SHA,
  dependabot keeps it current, and plugin/ carries its own LICENSE and
  SECURITY.md.

Measured

• New hook attack suite (scripts/test-hooks.mjs): 13 attacks, 2 controls, each with a
  harmless twin that must not be blocked, run from the project root and from a subfolder.
  The v0.6.1 example harnesses blocked 0 of 13 with hooks (2 of 13 counting permission
  rules). The regenerated monorepo example blocks 8 of 13 with hooks and 13 of 13
  counting its rules (matrix).
• The reference hooks are tested straight from the spec (scripts/check-reference.mjs).
• Evals now run per model (--model, --runs, --release, --major). The first
  per-model baseline: v0.6.1 passed 3 of 8 on Haiku and 3 of 6 on Sonnet
  (details); the 8/8 was the default model. v0.7.0
  results per model are in the README and here.
• The skill now also triggers for "set up Claude Code for this existing repo"; on Haiku
  and Sonnet it was skipped for retrofits.
• Four new eval cases (12 in total): lean essentials, the untrusted-content rule,
  self-protection, and the sandbox.

Also included: 0.6.2

Two fixes to the settings.json the plugin generates. Harnesses generated before this
keep working; re-run /harness-bootstrap:init on a project to pick these up.

• Hooks are anchored to the project root. Generated hooks now start as
  "command": "node", "args": ["${CLAUDE_PROJECT_DIR}/.claude/hooks/x.cjs"] instead of
  node .claude/hooks/x.cjs. Claude Code runs a hook in the session's current directory;
  if that is ever a subfolder, a relative path finds no script and the guard does nothing.
  This is the form Claude Code's hooks docs recommend, and it works the same on Windows
  and POSIX. We couldn't make a live session hit the relative-path case, so this is
  hardening rather than a fix for something seen in use.
• Hook timeouts are in seconds. The build gate's "timeout": 60000 meant about 17
  hours, not 60 seconds; it is now 60.
• The setup's own check (HARNESS_REFERENCE.md §1.8) now runs each guard from a subfolder
  too, and checks every hook uses the anchored form.

Also in the repo, not the plugin: a hook attack suite (scripts/test-hooks.mjs), a
per-model eval runner (--model, --runs, --release, --major), and the roadmap to
v1.0 in docs/ROADMAP.md.

---

Full results: README · attack matrix: docs/baselines/hooks-v0.7.0.md

v0.6.1

No change to what the plugin generates.

• Added a plugin icon.
• New README section, "What it runs and sends": the plugin is instructions only, with no
  MCP server, credential reading or network calls of its own, and what the generated
  harness does in your project.

Install

/plugin marketplace add sagaga144/claude-harness-bootstrap
/plugin install harness-bootstrap@harness-bootstrap

Already installed? /plugin marketplace update harness-bootstrap, then /plugin update harness-bootstrap@harness-bootstrap.

v0.6.0

Mostly about showing what the plugin generates, plus behavior fixes found while
re-running the evals.

• Real example outputs in examples/: seven complete harnesses from the
  v0.5.x test rounds (SaaS monorepo, Terraform on AWS, game server, Solidity, JUCE audio
  plugin, ML research, desktop app), so you can see what you get before installing.
• README rewrite: quickstart first, then what it generates, then the eval suite and
  what it caught.
• Community files: CONTRIBUTING.md (local testing, running the evals, the most
  wanted contributions), SECURITY.md, and issue forms for bugs and new project shapes.
• Shorter plugin description in the marketplace listing.

Fixes

• A description that names no app type ("I want to build an app") no longer gets a
  made-up stack. The skill asks one question, "what kind of app is this?". With no answer
  possible, it builds a stack-neutral minimal harness: push guard and secret scan only.
• CLAUDE.md never describes files that don't exist. If writes into .claude/ are
  denied (you can refuse that permission prompt), CLAUDE.md lists only what was
  written, and the closing message names each planned file that's missing and why.
• An authenticated app that stores users' own data now keeps its data-layer guard under
  "essentials only", alongside the security reviewer.

Evals

• The command now needs --allow-tools Write Edit. Eval runs still can't write into
  .claude/, so new graders check that those writes were attempted, and that CLAUDE.md
  doesn't describe files that were never written.
• New scripts/run-evals.mjs runs the suite one case at a time and retries only a case
  cut off by a usage limit, so a full run can finish on a subscription.
• Result on Claude Code 2.1.291: all 8 cases pass. The plugin changed the outcome versus
  plain Claude Code in 4 of them.

Install

/plugin marketplace add sagaga144/claude-harness-bootstrap
/plugin install harness-bootstrap@harness-bootstrap