fix: desktop harness bundling + council top-5 harness fixes

.github/workflows/ci.yml

@@ -62,6 +62,28 @@ jobs:
       - name: Test
         run: bun run test
 
+      - name: Setup Elixir
+        uses: erlef/setup-beam@v1
+        with:
+          otp-version: "27"
+          elixir-version: "1.18"
+
+      - name: Cache Elixir deps
+        uses: actions/cache@v5
+        with:
+          path: |
+            apps/harness/_build
+            apps/harness/deps
+          key: ${{ runner.os }}-mix-${{ hashFiles('apps/harness/mix.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-mix-
+
+      - name: Elixir test
+        run: |
+          cd apps/harness
+          mix deps.get
+          mix test
+
       - name: Install browser test runtime
         run: |
           cd apps/web

apps/desktop/src/main.ts

@@ -1550,6 +1550,7 @@ if (process.platform !== "win32") {
     isQuitting = true;
     writeDesktopLogHeader("SIGINT received");
     clearUpdatePollTimer();
+    stopHarness();
     stopBackend();
     restoreStdIoCapture?.();
     app.quit();
@@ -1560,6 +1561,7 @@ if (process.platform !== "win32") {
     isQuitting = true;
     writeDesktopLogHeader("SIGTERM received");
     clearUpdatePollTimer();
+    stopHarness();
     stopBackend();
     restoreStdIoCapture?.();
     app.quit();

apps/harness/lib/harness/application.ex

@@ -17,7 +17,7 @@ defmodule Harness.Application do
       HarnessWeb.Endpoint
     ]
 
-    opts = [strategy: :one_for_one, name: Harness.Supervisor]
+    opts = [strategy: :rest_for_one, name: Harness.Supervisor]
     Supervisor.start_link(children, opts)
   end
 

apps/harness/lib/harness/providers/claude_session.ex

@@ -400,6 +400,7 @@ defmodule Harness.Providers.ClaudeSession do
   @impl true
   def terminate(_reason, state) do
     state = %{state | stopped: true}
+    emit_event(state, :session, "session/closed", %{})
 
     if state.port do
       try do

apps/harness/lib/harness/providers/codex_session.ex

@@ -459,6 +459,7 @@ defmodule Harness.Providers.CodexSession do
   @impl true
   def terminate(_reason, state) do
     state = %{state | stopping: true}
+    emit_event(state, :session, "session/closed", %{})
 
     if state.port do
       try do

apps/harness/lib/harness/providers/cursor_session.ex

@@ -346,6 +346,7 @@ defmodule Harness.Providers.CursorSession do
     state = %{state | stopped: true}
     maybe_complete_turn(state, "completed")
     cancel_all_pending(state)
+    emit_event(state, :session, "session/closed", %{})
 
     if port do
       try do

apps/harness/lib/harness/providers/mock_session.ex

@@ -195,6 +195,7 @@ defmodule Harness.Providers.MockSession do
   @impl true
   def terminate(_reason, state) do
     state = %{state | stopping: true}
+    emit_event(state, :session, "session/closed", %{})
 
     if state.port do
       try do

apps/harness/lib/harness/providers/opencode_session.ex

@@ -473,6 +473,7 @@ defmodule Harness.Providers.OpenCodeSession do
   @impl true
   def terminate(_reason, state) do
     state = %{state | stopped: true}
+    emit_event(state, :session, "session/closed", %{})
 
     # Cancel pending approvals/elicitations so SQLite rows are cleaned up
     cancel_all_pending(state)

apps/harness/lib/harness/snapshot_server.ex

@@ -376,12 +376,14 @@ defmodule Harness.SnapshotServer do
         {:ok, events} ->
           {:reply, {:ok, seq, events}, state}
 
-        {:error, _reason} ->
-          {:reply, {:ok, seq, []}, state}
+        {:error, reason} ->
+          Logger.warning("SQL replay failed (after_seq=#{after_seq}, seq=#{seq}): #{inspect(reason)}")
+          {:reply, {:gap, seq, after_seq}, state}
       end
     catch
-      :exit, _ ->
-        {:reply, {:ok, seq, []}, state}
+      :exit, reason ->
+        Logger.warning("SQL replay crashed (after_seq=#{after_seq}, seq=#{seq}): #{inspect(reason)}")
+        {:reply, {:gap, seq, after_seq}, state}
     end
   end
 

apps/harness/lib/harness_web/endpoint.ex

@@ -12,8 +12,32 @@ defmodule HarnessWeb.Endpoint do
     pass: ["application/json"],
     json_decoder: Phoenix.json_library()
 
+  plug :authenticate
   plug :route
 
+  defp authenticate(%{request_path: "/api/" <> _} = conn, _opts) do
+    expected = Application.get_env(:harness, :harness_secret, "dev-harness-secret")
+    conn = Plug.Conn.fetch_query_params(conn)
+
+    secret =
+      case Plug.Conn.get_req_header(conn, "authorization") do
+        ["Bearer " <> token] -> token
+        _ -> conn.query_params["secret"]
+      end
+
+    if is_binary(secret) and byte_size(secret) == byte_size(expected) and
+         Plug.Crypto.secure_compare(secret, expected) do
+      conn
+    else
+      conn
+      |> Plug.Conn.put_resp_content_type("application/json")
+      |> Plug.Conn.send_resp(401, Jason.encode!(%{ok: false, error: "Unauthorized"}))
+      |> Plug.Conn.halt()
+    end
+  end
+
+  defp authenticate(conn, _opts), do: conn
+
   defp route(%{request_path: "/api/snapshot"} = conn, _opts) do
     snapshot = Harness.SnapshotServer.get_snapshot()
     json_response(conn, 200, snapshot)

scripts/lib/t3-client.ts

@@ -106,7 +106,9 @@ export class T3Client {
         if (!settled) {
           settled = true;
           this.ws?.close();
-          reject(new Error(`Timed out waiting for server.welcome (${this.requestTimeout / 1000}s)`));
+          reject(
+            new Error(`Timed out waiting for server.welcome (${this.requestTimeout / 1000}s)`),
+          );
         }
       }, this.requestTimeout);