Security Scan workflow on main failed with 18 standard-library
vulnerabilities (GO-2025-4007..4015, GO-2025-4155, GO-2026-4337,
plus a few more). All are fixed in later 1.25.x patches. Lowest
1.25.x version that govulncheck accepts clean is 1.25.10.
go.sum unchanged — the repo's go.sum already pointed at
oss-telemetry v0.2.3 and go-runewidth v0.0.24, which is what
1.25.10 + tidy resolves to.
Verified locally with GOTOOLCHAIN=go1.25.10:
- go build ./... clean
- go test -count=1 ./... 20/20 packages pass
- govulncheck ./... No vulnerabilities found
go-version-file: go.mod in lint.yaml and security.yaml will
auto-pick the new version; no workflow changes needed.
Three robustness fixes for the apply pipeline:
1. Silent read errors on state/target files treated 'file absent' as
'file empty' and fast-forward-overwrote user edits. Add
common.ReadExistingFile that returns (nil,nil) only on
os.IsNotExist; other I/O errors propagate. Use it from apply.Run
and from every adapter's Render (claudecode, crush, kilo,
opencode, goose, zed).
2. apply.Run required callers to pre-construct *gitx.Repo; passing
nil silently skipped the commit. Run now auto-opens a repo from
Bundle.Root, gracefully no-ops when the root is not a git repo,
and uses a new gitx.HasStagedChanges() check to skip the no-op
'nothing to commit' that triggered the original silent-skip.
3. Each of 7 adapter packages re-implemented the same 25-line
Option/WithHome/New constructor. Hoist into adapter.Base +
adapter.BaseOption + NewBase. Each adapter embeds *Base and
reduces to a 9-line constructor. Public New(WithHome(h)) API
preserved; a.home becomes a.Home.
Tests:
- apply: 5 new (propagates-read-error, auto-opens-repo,
no-repo-skips-commit, skips-no-op-commit, commit-message-counts)
- gitx: 2 new (HasStagedChanges empty/after-add)
- adapter/common: 3 new (ReadExistingFile missing/content/perm)
- adapter: 4 new (NewBase default/WithHome/order/typed)
- existing adapter tests unchanged — verify a.Home still honoured.
The Zed Agent panel (new ACP-based UI) only discovers providers registered
under language_models.openai_compatible.<name>, not language_models.openai.
Each named entry appears as its own provider in the LLM Providers list.
- language_models.openai_compatible.harness-sync-gateway holds gateway URL + models
- agent.default_model.provider = 'harness-sync-gateway' (was 'openai')
- Model entries include capabilities {tools,images,parallel_tool_calls}
- Export common.GatewayProviderID so zed.go can reference it
- Fix staticcheck QF1001 (De Morgan's law) in io.go
- Fix struct field alignment in File (80→72 bytes)
- gofmt remaining files
opencode/kilo require top-level 'name' and a 'models' Record<modelID,Model>
in each provider entry for the harness UI to enumerate and display models.
Without 'name', the gateway appears unlabelled; without 'models', the provider
shows no model list in the selector.
26 bite-sized tasks across 7 phases (bootstrap, adapter framework,
render/git/merge, apply pipeline, per-harness adapters, CLI commands,
integration test + polish). TDD throughout, frequent commits, exact
code in every step. Adapter-specific schema steps include inspection
commands and reference actual harness configs on this machine.
Canonical config at ~/.config/harness-sync/ (git repo) propagates skills,
agents, MCP, LLM endpoints (via profiles), and global instructions into
each detected harness. Hybrid sync: symlinks where shapes match, rendered
files where they differ. Plugin-style adapters; conflict resolution via
git merge-file three-way merge tracked in state/.
lukaszraczyloandGitHub