[johnnyhuy]

Summary

CLI harness discovery now uses the OpenCode plugin's five-minute cache before probing PATH or npm-global. Invalid, stale and missing entries keep the existing fallback; successful npm and Homebrew installs always probe the live version.

Closes #17

This finishes the CLI step left after the app plugin and reader landed in #53.

Verification

• mise exec -- bun test cli/test/discovery-cache.test.ts - 16 pass, 0 fail.
• mise run ci:cli - typecheck passed, 25 tests passed, Linux x64 compiled binary built.
• mise exec -- bun build cli/src/index.ts --compile --outfile /tmp/hoist-cli-discovery-proof/hoist --target=bun-darwin-arm64 - native compiled binary built and exercised below.
• git diff --check - clean.
• Hosted checks passed on 7d91d20: CodeQL Actions, CodeQL JavaScript/TypeScript, CodeQL and Socket Security. GitHub did not schedule the app/CLI workflow for this PR; the CLI component gate above ran locally.

The new tests include fresh cache wins over PATH without running the cached binary or npm, discoverAll reads all plugin harness ids and normalises unknown versions, stale/malformed/missing/non-executable fallback cases, npm-global fallback and npm install bypasses a fresh cache to report the installed version plus its Homebrew equivalent. Tests use subprocesses with temporary HOME/PATH and fake executables. No live keys, provider requests or real installs were used.

The built binary ran against a temporary fixture with executable harnesses both outside and on PATH. Hidden harnesses were cached as cache-2.0; PATH scripts returned PATH-3.0. Invocation logs verified that fresh cache hits launched no tools, while stale/absent cache runs launched exactly three --version calls. The list transcript includes its harness section.

# Fresh plugin cache; tools are executable outside PATH. Cache and PATH versions differ.
$ hoist install
claude-code     Claude Code       installed · cache-2.0
opencode        OpenCode          installed · cache-2.0
codex           Codex             installed · cache-2.0
$ hoist list
Harnesses:
  claude-code     Claude Code       installed · cache-2.0
  opencode        OpenCode          installed · cache-2.0
  codex           Codex             installed · cache-2.0
# Recorded harness/npm invocations: 0
# Same cache with mtime older than five minutes
$ hoist install
claude-code     Claude Code       installed · PATH-3.0
opencode        OpenCode          installed · PATH-3.0
codex           Codex             installed · PATH-3.0
# Recorded harness --version invocations: 3
# Plugin cache removed
$ hoist install
claude-code     Claude Code       installed · PATH-3.0
opencode        OpenCode          installed · PATH-3.0
codex           Codex             installed · PATH-3.0
# Recorded harness --version invocations: 3

Risk

Cached versions can lag external upgrades by up to five minutes, matching the app contract. Hoist installs bypass the cache immediately. Shell fixture tests cover macOS/Linux and skip Windows, matching the plugin's v1 scope.

Review the CLI cache reader and post-install bypass in cli/src/lib/harnesses.ts. Only CLI files changed; app UI and the separate app/CLI release tasks are unchanged.