fix(qwen): address review findings — native manifest, runtime dir, slug, enablement, settings.json

Address all 7 findings from phodal's review:

P1: Replace .qwen-plugin/plugin.json with native qwen-extension.json at
repo root, matching Qwen's EXTENSIONS_CONFIG_FILENAME contract.

P1: Separate QWEN_HOME (config) from QWEN_RUNTIME_DIR (session data)
in resolveScope; discoverSourceRoots now reads from runtimeDir.

P1: Match native sanitizeCwd exactly — replace every non-alphanumeric
character with '-', lowercase variant for Windows compatibility.

P1: Read qwen-extension.json for extension metadata; compute enablement
from extension-enablement.json overrides path rules instead of a
nonexistent disabled boolean.

P1: Read mcpServers and hooks from user/workspace settings.json in
addition to .mcp.json and hooks.json.

P2: Treat cancelled tool_result status as non-success.

P2: Thread qwenHome through providerScope, collectProviderInventory,
and userBase fallback in inventory.mjs.

Also: rebase onto current main, resolve test/agent-customize.test.mjs
conflict. 840 tests pass; pack:verify passes.

Author: GCGH159

.qwen-plugin/plugin.json

@@ -22,7 +22,7 @@ repository's native marketplace manifest.
 | Codex | Analysis-capable source-local host | `.codex-plugin/` | `scripts/agent-customize/providers/codex.mjs` | `scripts/session-analysis/platforms/codex.mjs` | self-contained HTML + Markdown | `.codex` + `.agents` + `AGENTS.md` | `harness prepare --platform codex` -> finalize with `html-report` validation |
 | Qoder | First-class product host | `.qoder-plugin/` | `scripts/agent-customize/providers/qoder.mjs` | `scripts/session-analysis/platforms/qoder.mjs` | `better-harness` | `.qoder/rules` + `AGENTS.md` + output templates | `better-harness harness render --mode qoder-canvas --validate` |
 | Cursor | Analysis-capable source-local host | `.cursor-plugin/` | `scripts/agent-customize/providers/cursor.mjs` | `scripts/session-analysis/platforms/cursor.mjs` | self-contained HTML + Markdown | `.cursor` + `.codex` compatibility + `AGENTS.md` | `agent --plugin-dir . --mode ask --print` -> Cursor evidence bundle -> validated `html` render |
-| Qwen Code | Analysis-capable source-local host | `.qwen-plugin/` | `scripts/agent-customize/providers/qwen.mjs` | `scripts/session-analysis/platforms/qwen.mjs` | self-contained HTML + Markdown | `.qwen` + `QWEN.md` + `AGENTS.md` | `harness prepare --platform qwen` -> finalize with `html-report` validation |
+| Qwen Code | Analysis-capable source-local host | `qwen-extension.json` | `scripts/agent-customize/providers/qwen.mjs` | `scripts/session-analysis/platforms/qwen.mjs` | self-contained HTML + Markdown | `.qwen` + `QWEN.md` + `AGENTS.md` | `harness prepare --platform qwen` -> finalize with `html-report` validation |
 
 ## Discovery And Evidence
 
@@ -52,8 +52,8 @@ repository's native marketplace manifest.
 - Qwen Code configured assets are inventoried through
   `scripts/agent-customize/providers/qwen.mjs`. Session evidence comes from
   `scripts/session-analysis/platforms/qwen.mjs`, which reads workspace-matching
-  JSONL transcripts under `~/.qwen/projects/<slug>/chats/`. The `.qwen-plugin/`
-  shell is install/discovery metadata included in the public npm package; it
+  JSONL transcripts under `~/.qwen/projects/<slug>/chats/`. The `qwen-extension.json`
+  manifest is native Qwen install/discovery metadata included in the public npm package; it
   does not own Qwen evidence collection.
 
 ## Output Modes

docs/adapters/README.md

@@ -32,7 +32,7 @@ This is the complete reference. For the common cases, see Start Here above.
 | Style grammar | Yes | `templates/style/` | Directive-only visual language; no runnable skeletons | Selected by report/style routing | Style-template tests and no copied runtime skeletons |
 | Structured knowledge | Candidate only | `knowledge-base/{official,community}/...` | `knowledge.md`, interim `schema.json`, fixtures, namespace uniqueness | Docs-only until registry spec, compiler, and binding tests exist | Namespace check, schema/fixture review, migration note |
 | Examples and operating models | Yes | `case-studies/` | Named example, scope, evidence boundary, non-runtime status | Reference material only unless separately bound | Link/path check; no runtime-policy claims |
-| Host shell and packaging | Thin, or generated only after a split trigger | `.claude-plugin/`, `.qoder-plugin/`, `.cursor-plugin/`, `.codex-plugin/`, `.qwen-plugin/`, future lifecycle shells | Install/discovery metadata and pointers to canonical owners | Public npm package includes all five current metadata roots; the Qoder runtime bundle includes only `.qoder-plugin/`, and generated host artifacts stay source-local | `scripts/npm-package/` verification, or split adapter note plus target builder |
+| Host shell and packaging | Thin, or generated only after a split trigger | `.claude-plugin/`, `.qoder-plugin/`, `.cursor-plugin/`, `.codex-plugin/`, `qwen-extension.json`, future lifecycle shells | Install/discovery metadata and pointers to canonical owners | Public npm package includes all five current metadata roots; the Qoder runtime bundle includes only `.qoder-plugin/`, and generated host artifacts stay source-local | `scripts/npm-package/` verification, or split adapter note plus target builder |
 
 ## Non-Extension Boundaries
 

docs/community.md

@@ -79,7 +79,7 @@ for extension surfaces, read [community.md](community.md).
 |---|---|---|
 | Skill | A repeatable agent workflow defined by `SKILL.md` frontmatter plus a concise workflow. | [community.md](community.md); report use: [report contract](../skills/better-harness/SKILL.md#report-output) |
 | Host adapter | Per-host discovery and evidence-shape glue (e.g. Qoder, Codex); keeps the engine host-neutral. | [adapters/README.md](adapters/README.md) |
-| Host shell | Thin host metadata (`.claude-plugin/`, `.qoder-plugin/`, `.cursor-plugin/`, `.codex-plugin/`, `.qwen-plugin/`, or a future lifecycle shell) that exposes canonical behavior without owning product logic; the public npm package ships all five current metadata roots, while the Qoder runtime bundle includes only `.qoder-plugin/`. | [ARCHITECTURE.md](ARCHITECTURE.md) |
+| Host shell | Thin host metadata (`.claude-plugin/`, `.qoder-plugin/`, `.cursor-plugin/`, `.codex-plugin/`, `qwen-extension.json`, or a future lifecycle shell) that exposes canonical behavior without owning product logic; the public npm package ships all five current metadata roots, while the Qoder runtime bundle includes only `.qoder-plugin/`. | [ARCHITECTURE.md](ARCHITECTURE.md) |
 | Canonical owner | The single directory that owns a behavior's product judgment; host shells and mirrors point back to it. | [ARCHITECTURE.md](ARCHITECTURE.md) |
 
 ## "I Want To… → Use"

docs/glossary.md

@@ -30,7 +30,7 @@
     ".codex-plugin/",
     ".cursor-plugin/",
     ".qoder-plugin/",
-    ".qwen-plugin/",
+    "qwen-extension.json",
     "AGENTS.md",
     "CHANGELOG.md",
     "CODE_OF_CONDUCT.md",

package.json

@@ -0,0 +1,8 @@
+{
+  "name": "better-harness",
+  "version": "0.3.0",
+  "displayName": "Better Harness",
+  "description": "Build an AI-ready engineering system for safe coding-agent delivery and continuous software improvement.",
+  "contextFileName": "QWEN.md",
+  "skills": "./skills/"
+}

qwen-extension.json

@@ -27,14 +27,47 @@ import {
   workspaceSourceLabel,
 } from "../core/items.mjs";
 
-const QWEN_PLUGIN_MANIFEST = [".qwen-plugin", "plugin.json"];
+const QWEN_EXTENSION_MANIFEST = ["qwen-extension.json"];
 const QWEN_EXTENSION_INSTALL_FILE = ".qwen-extension-install.json";
 const QWEN_EXTENSION_ENABLEMENT_FILE = "extension-enablement.json";
 
 function defaultQwenHome() {
   return path.join(os.homedir(), ".qwen");
 }
 
+function ensureLeadingAndTrailingSlash(dirPath) {
+  let result = dirPath.replace(/\\/g, "/");
+  if (result.charAt(0) !== "/") result = "/" + result;
+  if (result.charAt(result.length - 1) !== "/") result = result + "/";
+  return result;
+}
+
+function overrideMatchesPath(rule, checkPath) {
+  const isDisable = rule.startsWith("!");
+  let base = isDisable ? rule.substring(1) : rule;
+  const includeSubdirs = base.endsWith("*");
+  if (includeSubdirs) base = base.substring(0, base.length - 1);
+  base = ensureLeadingAndTrailingSlash(base);
+  const glob = `${base}${includeSubdirs ? "*" : ""}`;
+  const regexString = glob
+    .replace(/[.+?^${}()|[\]\\]/g, "\\$&")
+    .replace(/(\/?)\*/g, "($1.*)?");
+  return new RegExp(`^${regexString}$`).test(checkPath);
+}
+
+function isExtensionEnabled(enablementConfig, extensionName, workspace) {
+  const extensionConfig = enablementConfig?.[extensionName];
+  let enabled = true;
+  const allOverrides = extensionConfig?.overrides ?? [];
+  const lexicalPath = ensureLeadingAndTrailingSlash(workspace);
+  for (const rule of allOverrides) {
+    if (overrideMatchesPath(rule, lexicalPath)) {
+      enabled = !rule.startsWith("!");
+    }
+  }
+  return enabled;
+}
+
 function qwenMarkdownRuleSource(workspace, sourceLabel, precedence = "after-provider-rules") {
   return {
     type: "file",
@@ -66,7 +99,7 @@ function normalizeProvidedQwenRecord(record) {
     source: record.source ?? "user",
     installMatch: record.installMatch ?? "provided",
     type: record.type ?? "link",
-    enablement: record.enablement ?? null,
+    enablementConfig: record.enablementConfig ?? null,
   };
 }
 
@@ -103,7 +136,7 @@ async function readQwenInstalledPluginState(options = {}) {
       source: installMarker.originSource ?? "user",
       installMatch: "qwen-extension-install",
       type: installMarker.type ?? "link",
-      enablement: enablement[name] ?? null,
+      enablementConfig: enablement,
     });
   }
   return {
@@ -113,32 +146,45 @@ async function readQwenInstalledPluginState(options = {}) {
   };
 }
 
-async function collectQwenPluginMcpItems(pluginRoot, sourceLabel) {
+async function collectQwenPluginMcpItems(pluginRoot, sourceLabel, manifest) {
+  const items = [];
+  if (manifest?.mcpServers && typeof manifest.mcpServers === "object") {
+    for (const [name, config] of Object.entries(manifest.mcpServers)) {
+      items.push({
+        name,
+        scope: "plugin",
+        sourceLabel,
+        command: config.command ?? null,
+        args: config.args ?? [],
+        evidence: evidence(path.join(pluginRoot, "qwen-extension.json"), pluginRoot),
+      });
+    }
+  }
   for (const candidate of [path.join(pluginRoot, ".mcp.json"), path.join(pluginRoot, "mcp.json")]) {
     if (await pathExists(candidate)) {
-      return collectMcpFromConfig(candidate, "plugin", sourceLabel, pluginRoot);
+      items.push(...(await collectMcpFromConfig(candidate, "plugin", sourceLabel, pluginRoot)));
     }
   }
-  return [];
+  return items;
 }
 
-async function collectQwenPlugin(record) {
+async function collectQwenPlugin(record, workspace) {
   const pluginRoot = path.resolve(expandHome(record.installPath));
   if (!(await pathExists(pluginRoot))) {
     return null;
   }
-  const metadataEvidencePath = await pluginMetadataEvidencePath(pluginRoot, [QWEN_PLUGIN_MANIFEST, ["package.json"]]);
-  const manifest = (await readJson(path.join(pluginRoot, ...QWEN_PLUGIN_MANIFEST))) ?? {};
+  const metadataEvidencePath = await pluginMetadataEvidencePath(pluginRoot, [QWEN_EXTENSION_MANIFEST, ["package.json"]]);
+  const manifest = (await readJson(path.join(pluginRoot, ...QWEN_EXTENSION_MANIFEST))) ?? {};
   const packageJson = (await readJson(path.join(pluginRoot, "package.json"))) ?? {};
   const readme = await readText(path.join(pluginRoot, "README.md"), 6000);
   const heading = readme.match(/^#\s+(.+)$/mu)?.[1]?.trim();
   const rawDisplayName =
-    manifest.interface?.displayName ||
     manifest.displayName ||
     packageJson.displayName ||
     heading ||
     titleCase(manifest.name || packageJson.name || record.name);
   const displayName = normalizePluginDisplayName(rawDisplayName, record.name);
+  const enabled = isExtensionEnabled(record.enablementConfig, record.name, workspace);
   const plugin = {
     id: record.id,
     qwenExtensionId: record.name,
@@ -148,23 +194,19 @@ async function collectQwenPlugin(record) {
     sourceLabel: displayName,
     name: manifest.name || packageJson.name || record.name,
     displayName,
-    description:
-      manifest.interface?.shortDescription ||
-      manifest.description ||
-      packageJson.description ||
-      "",
-    publisher: { displayName: manifest.author?.name || manifest.interface?.developerName || titleCase(record.marketplaceName) },
+    description: manifest.description || packageJson.description || "",
+    publisher: { displayName: titleCase(record.marketplaceName) },
     version: record.version || manifest.version || packageJson.version,
     installSources: record.sources,
     installSource: record.source,
     installMatch: record.installMatch,
     installType: record.type,
     installRecordPath: record.installMarkerPath,
-    enabled: record.enablement ? record.enablement.disabled !== true : true,
+    enabled,
     evidence: evidence(metadataEvidencePath, path.dirname(path.dirname(pluginRoot))),
   };
   plugin.skills = await collectSkillFiles(path.join(pluginRoot, "skills"), "plugin", displayName, pluginRoot);
-  plugin.mcpServers = await collectQwenPluginMcpItems(pluginRoot, displayName);
+  plugin.mcpServers = await collectQwenPluginMcpItems(pluginRoot, displayName, manifest);
   plugin.rules = await collectRuleSources([
     directoryRuleSource(path.join(pluginRoot, "rules"), "plugin", displayName, pluginRoot),
   ]);
@@ -177,10 +219,10 @@ async function collectQwenPlugin(record) {
   return plugin;
 }
 
-async function collectQwenPlugins(records) {
+async function collectQwenPlugins(records, workspace) {
   const plugins = [];
   for (const record of records) {
-    const plugin = await collectQwenPlugin(record);
+    const plugin = await collectQwenPlugin(record, workspace);
     if (plugin) {
       plugins.push(plugin);
     }
@@ -199,19 +241,74 @@ async function collectQwenUserPrimitives(qwenHome) {
   const mcps = await pathExists(mcpPath)
     ? (await collectMcpFromConfig(mcpPath, "user", "User", qwenHome)) ?? []
     : (await collectMcpItems(qwenHome, "user", "User", qwenHome)) ?? [];
+  const settings = (await readJson(path.join(qwenHome, "settings.json"))) ?? {};
+  if (settings.mcpServers && typeof settings.mcpServers === "object") {
+    for (const [name, config] of Object.entries(settings.mcpServers)) {
+      if (!mcps.some((m) => m.name === name)) {
+        mcps.push({
+          name,
+          scope: "user",
+          sourceLabel: "User",
+          command: config.command ?? null,
+          args: config.args ?? [],
+          evidence: evidence(path.join(qwenHome, "settings.json"), qwenHome),
+        });
+      }
+    }
+  }
+  const hooks = await collectHookItems(qwenHome, "user", "User", qwenHome);
+  if (Array.isArray(settings.hooks)) {
+    for (const hook of settings.hooks) {
+      if (hook?.command && !hooks.some((h) => h.command === hook.command)) {
+        hooks.push({
+          command: hook.command,
+          scope: "user",
+          sourceLabel: "User",
+          evidence: evidence(path.join(qwenHome, "settings.json"), qwenHome),
+        });
+      }
+    }
+  }
   return {
     skills: await collectSkillFiles(path.join(qwenHome, "skills"), "user", "User", qwenHome),
     subagents: await collectMarkdownItems(path.join(qwenHome, "agents"), "subagent", "user", "User", qwenHome),
     rules: await collectRuleSources([directoryRuleSource(path.join(qwenHome, "rules"), "user", "User", qwenHome)]),
     commands: await collectMarkdownItems(path.join(qwenHome, "commands"), "command", "user", "User", qwenHome),
-    hooks: await collectHookItems(qwenHome, "user", "User", qwenHome),
+    hooks,
     mcps,
   };
 }
 
 async function collectQwenWorkspacePrimitives(workspace) {
   const sourceLabel = await workspaceSourceLabel(workspace);
   const project = await collectWorkspaceRootPrimitives(path.join(workspace, ".qwen"), sourceLabel, workspace);
+  const settings = (await readJson(path.join(workspace, ".qwen", "settings.json"))) ?? {};
+  if (settings.mcpServers && typeof settings.mcpServers === "object") {
+    for (const [name, config] of Object.entries(settings.mcpServers)) {
+      if (!project.mcps.some((m) => m.name === name)) {
+        project.mcps.push({
+          name,
+          scope: "project",
+          sourceLabel,
+          command: config.command ?? null,
+          args: config.args ?? [],
+          evidence: evidence(path.join(workspace, ".qwen", "settings.json"), workspace),
+        });
+      }
+    }
+  }
+  if (Array.isArray(settings.hooks)) {
+    for (const hook of settings.hooks) {
+      if (hook?.command && !project.hooks.some((h) => h.command === hook.command)) {
+        project.hooks.push({
+          command: hook.command,
+          scope: "project",
+          sourceLabel,
+          evidence: evidence(path.join(workspace, ".qwen", "settings.json"), workspace),
+        });
+      }
+    }
+  }
   return {
     ...project,
     rules: [
@@ -237,7 +334,7 @@ export async function collectQwenCustomizeInventory(options = {}) {
     ? await readQwenInstalledPluginState({ ...options, qwenHome })
     : { records: [], source: "not-authorized", installRecordFiles: [] };
   const [plugins, user, project] = await Promise.all([
-    includeUserHome ? collectQwenPlugins(installState.records ?? []) : [],
+    includeUserHome ? collectQwenPlugins(installState.records ?? [], workspace) : [],
     includeUserHome ? collectQwenUserPrimitives(qwenHome) : emptyPrimitives(),
     collectQwenWorkspacePrimitives(workspace),
   ]);

scripts/agent-customize/providers/qwen.mjs

@@ -447,6 +447,7 @@ function providerScope(options = {}, platform = options.platform ?? "qoder") {
     codexAppPath: options.codexAppPath ?? options["codex-app-path"],
     claudeHome: options.claudeHome ?? options["claude-home"],
     claudeStatePath: options.claudeStatePath ?? options["claude-state"] ?? options["claude-state-path"],
+    qwenHome: options.qwenHome ?? options["qwen-home"],
   };
 }
 
@@ -535,7 +536,7 @@ function customizeSurface({ provider, group, scope, type, label, basePath, items
 async function buildConfiguredAssetSurfaces(inventory, scope) {
   const provider = scope.platform;
   const projectBase = scope.workspace;
-  const userBase = inventory.cursorHome ?? inventory.qoderHome ?? inventory.codexHome ?? inventory.claudeHome;
+  const userBase = inventory.cursorHome ?? inventory.qoderHome ?? inventory.codexHome ?? inventory.claudeHome ?? inventory.qwenHome;
   const surfaceTypes = [
     ["skills", "skills", "Skills"],
     ["subagents", "agents", "Agents"],
@@ -637,6 +638,7 @@ export async function collectProviderInventory(options = {}) {
     codexAppPath: scope.codexAppPath,
     claudeHome: scope.claudeHome,
     claudeStatePath: scope.claudeStatePath,
+    qwenHome: scope.qwenHome,
     includeUserHome: scope.includeUserHome,
     includeGlobalHooks: scope.includeGlobalHooks,
   });