@inflexa-ai/harness 0.33.1 → 0.35.0

package/dist/tools/workspace/mutator.d.ts

@@ -3,20 +3,33 @@
  * working directory. The write-side counterpart to `WorkspaceFilesystem`
  * (see the harness-workspace-tools spec).
  *
- * It lives here (next to `run-exec`) rather than under `workspace/` because the
- * write path is sandbox-coupled: a write is one `SandboxClient` exec, not a
- * host `fs` call. The seam owns the whole gauntlet that `write_file` and
- * `edit_file` previously each re-implemented inline — resolve + confine to the
- * working directory, derive the in-sandbox path, and write the bytes through
- * the sandbox — so the confinement invariant is concentrated in one place
- * instead of being a per-tool convention.
+ * The seam owns the whole gauntlet that `write_file` and `edit_file` share —
+ * resolve + confine to the working directory, the symlink-hardened landing,
+ * the host `fs` write, and the provenance record — so the confinement
+ * invariant is concentrated in one place instead of being a per-tool
+ * convention.
+ *
+ * Two realizations serve the two agent contexts. `createWorkspaceMutator`
+ * closes over fixed per-step coordinates and records into the step-scoped
+ * lineage collector (the sandbox agents). `createSessionWorkspaceMutator`
+ * resolves its coordinates per call from the session's analysis scope — the
+ * write prefix is the analysis root — and emits a `write-file` session event
+ * through the provenance seam (the conversation agent, which runs under no
+ * run and no step).
+ *
+ * The landing is hardened beyond the lexical resolver: missing parent
+ * directories are created only inside the write prefix, the deepest existing
+ * ancestor is realpath-checked against the realpath'd prefix (a symlinked
+ * ancestor cannot re-aim the write), and the final open uses `O_NOFOLLOW`
+ * (a symlinked final component is refused, never followed).
  */
+import type { AgentSession } from "../../auth/types.js";
+import type { Logger } from "../../lib/logger.js";
+import type { RunStep } from "../../loop/types.js";
 import type { ProvenanceCollector } from "../../provenance/collector.js";
-import type { SandboxClient } from "../../sandbox/client.js";
-import type { SandboxRef } from "../../sandbox/types.js";
-import type { EmitFn } from "../define-tool.js";
-import { type BoundedExecResult } from "./result-bounds.js";
-/** Outcome of a confined write. Expected outcomes are data variants — never throws. */
+import { type ProvenanceSeam } from "../../provenance/seam.js";
+import { type ResolveWorkspaceRoot } from "../../workspace/paths.js";
+/** Outcome of a confined write. Expected outcomes are data variants — never throws on them. */
 export type WriteFileResult = {
     readonly status: "ok";
     readonly path: string;
@@ -27,10 +40,10 @@ export type WriteFileResult = {
 } | {
     readonly status: "out_of_prefix";
     readonly path: string;
-} | ({
-    readonly status: "write_failed";
+} | {
+    readonly status: "symlink_denied";
     readonly path: string;
-} & BoundedExecResult);
+};
 /**
  * Agent-visible name of the tool driving a confined write. Rides the write args
  * so a successful write is attributed to the invoking tool in provenance
@@ -39,25 +52,11 @@ export type WriteFileResult = {
  */
 export type MutateToolName = "write_file" | "edit_file";
 export interface WorkspaceMutatorDeps {
-    readonly sandboxClient: SandboxClient;
-    readonly sandbox: SandboxRef;
     /** Absolute host root of this analysis's workspace tree — used by the resolver. */
     readonly workspaceRoot: string;
     readonly analysisId: string;
-    readonly stepId: string;
-    readonly workflowId: string;
     /** Absolute host working directory: relative paths resolve here AND writes are confined here. */
     readonly workingDir: string;
-    /**
-     * In-sandbox absolute path of `workingDir` (mirrors `execute_command`'s
-     * `defaultCwd`). Passed as the write exec's `cwd` so sandbox-server roots
-     * its tree-differ here and reports the written file as a live delta — an
-     * empty `cwd` disables the differ, so write-only files (e.g. scripts/)
-     * would never reach the live file tree.
-     */
-    readonly sandboxWorkingDir: string;
-    readonly nextFunctionId: () => string;
-    readonly deadlineMs: () => number;
     /**
      * Step-scoped lineage collector. On a successful confined write the seam
      * records a file-tool provenance record here — hash and size computed
@@ -70,14 +69,51 @@ export interface WorkspaceMutator {
     /**
      * Resolve `path` against the working directory (relative) or analysis root
      * (absolute `/{analysisId}/...`), confine the result to the working
-     * directory, and write `content` through the sandbox. `toolName` names the
-     * invoking tool so a successful write is attributed to it in provenance.
+     * directory, and land `content` on the host filesystem. `toolName` names
+     * the invoking tool so a successful write is attributed to it in
+     * provenance. `invocationId` is the tool call's loop id — pass the tool
+     * context's `invocationId`: it rides the provenance record so the write's
+     * call activity gets a deterministic identity. `runStep` wraps the disk
+     * mutation in a replay-cached step — pass the tool context's `runStep`.
+     * `session` is the calling agent's session — pass the tool context's
+     * `session`: the step-scoped realization ignores it, the session-scoped
+     * one resolves its coordinates and its provenance attribution from it.
      */
     writeFile(args: {
         readonly path: string;
         readonly content: string;
         readonly toolName: MutateToolName;
-        readonly emit: EmitFn;
+        readonly invocationId: string;
+        readonly runStep: RunStep;
+        readonly session: AgentSession;
     }): Promise<WriteFileResult>;
 }
 export declare function createWorkspaceMutator(deps: WorkspaceMutatorDeps): WorkspaceMutator;
+/** Construction deps of the session-scoped realization — see {@link createSessionWorkspaceMutator}. */
+export interface SessionWorkspaceMutatorDeps {
+    /** Workspace-root resolution seam — the write coordinates resolve per call from the session's analysis scope. */
+    readonly resolveWorkspaceRoot: ResolveWorkspaceRoot;
+    /**
+     * The provenance seam. On a successful confined write the seam's session
+     * emit receives one `write-file` event — hash and size computed in-process
+     * from the exact bytes written, attributed to the session's analysis and
+     * thread. An unbound session emit records nothing; the write itself
+     * proceeds unchanged.
+     */
+    readonly provenance?: ProvenanceSeam;
+    readonly logger?: Logger;
+}
+/**
+ * The session-scoped `WorkspaceMutator` realization — the conversation agent's
+ * write path. Where `createWorkspaceMutator` closes over fixed per-step
+ * coordinates, this one serves every analysis from one construction: each call
+ * resolves the workspace root from the session's analysis scope, and the write
+ * prefix IS that root — the agent modifies its own analysis tree freely, while
+ * `..` traversal, a foreign analysis, and the symlink escapes stay refused by
+ * the same gauntlet.
+ *
+ * A write here runs under no run and no step, so its provenance is a session
+ * observation, not a collector record: each successful write emits one
+ * `write-file` session event (see `provenance/seam.ts`).
+ */
+export declare function createSessionWorkspaceMutator(deps: SessionWorkspaceMutatorDeps): WorkspaceMutator;

package/dist/tools/workspace/mutator.js

@@ -3,79 +3,227 @@
  * working directory. The write-side counterpart to `WorkspaceFilesystem`
  * (see the harness-workspace-tools spec).
  *
- * It lives here (next to `run-exec`) rather than under `workspace/` because the
- * write path is sandbox-coupled: a write is one `SandboxClient` exec, not a
- * host `fs` call. The seam owns the whole gauntlet that `write_file` and
- * `edit_file` previously each re-implemented inline — resolve + confine to the
- * working directory, derive the in-sandbox path, and write the bytes through
- * the sandbox — so the confinement invariant is concentrated in one place
- * instead of being a per-tool convention.
+ * The seam owns the whole gauntlet that `write_file` and `edit_file` share —
+ * resolve + confine to the working directory, the symlink-hardened landing,
+ * the host `fs` write, and the provenance record — so the confinement
+ * invariant is concentrated in one place instead of being a per-tool
+ * convention.
+ *
+ * Two realizations serve the two agent contexts. `createWorkspaceMutator`
+ * closes over fixed per-step coordinates and records into the step-scoped
+ * lineage collector (the sandbox agents). `createSessionWorkspaceMutator`
+ * resolves its coordinates per call from the session's analysis scope — the
+ * write prefix is the analysis root — and emits a `write-file` session event
+ * through the provenance seam (the conversation agent, which runs under no
+ * run and no step).
+ *
+ * The landing is hardened beyond the lexical resolver: missing parent
+ * directories are created only inside the write prefix, the deepest existing
+ * ancestor is realpath-checked against the realpath'd prefix (a symlinked
+ * ancestor cannot re-aim the write), and the final open uses `O_NOFOLLOW`
+ * (a symlinked final component is refused, never followed).
  */
+import { constants } from "node:fs";
+import { lstat, mkdir, open, realpath } from "node:fs/promises";
+import { basename, dirname, join as joinPath, relative as relativePath, resolve as resolvePath, sep } from "node:path";
+import { createNoopLogger } from "../../lib/console-logger.js";
 import { computeSha256 } from "../../lib/fs-helpers.js";
+import { tryFs, tryFsWrite } from "../../lib/fs-result.js";
+import { unwrapOrThrow } from "../../lib/result.js";
+import { bindSessionEmit } from "../../provenance/seam.js";
 import { resolveForWrite } from "../../workspace/paths.js";
-import { boundExecResult } from "./result-bounds.js";
-import { runSandboxExec } from "./run-exec.js";
-const WRITE_BYTES_PROGRAM = [
-    "import sys,base64,os",
-    "p=sys.argv[1]",
-    "os.makedirs(os.path.dirname(p), exist_ok=True)",
-    "open(p,'wb').write(base64.b64decode(sys.argv[2]))",
-].join("\n");
+/**
+ * Land `bytes` at `absolute`, hardened against a symlink re-aiming the write.
+ * `absolute` is already lexically confined under `prefix` by the resolver;
+ * this function guards the physical path:
+ *
+ *   1. Realpath the prefix (created if absent — it is workflow-owned
+ *      infrastructure, not agent input).
+ *   2. Realpath the deepest existing ancestor of the target and refuse when it
+ *      lands outside the realpath'd prefix — a symlinked ancestor inside the
+ *      prefix cannot point the write elsewhere. A dangling-symlink ancestor
+ *      has no landing at all and is refused too.
+ *   3. Create the missing parents under that canonical ancestor, then realpath
+ *      the created directory and refuse when it lands outside the prefix — a
+ *      symlink raced into a missing segment between the ancestor check and the
+ *      recursive mkdir would re-aim the tail of the path.
+ *   4. Refuse a symlinked final component (lstat), then open with
+ *      `O_NOFOLLOW` so a symlink raced in after the check still cannot be
+ *      followed.
+ *
+ * Refusals are data; a genuine I/O failure throws (the loop's dispatch catch
+ * maps it to an error tool result).
+ */
+async function landBytes(prefix, absolute, bytes) {
+    unwrapOrThrow(await tryFsWrite("mutator.mkdirPrefix", () => mkdir(prefix, { recursive: true }), { path: prefix }));
+    const realPrefix = unwrapOrThrow(await tryFs("mutator.realpathPrefix", () => realpath(prefix), { path: prefix }));
+    // Deepest existing ancestor of the target. The walk stops at the prefix,
+    // which exists — the resolver already confined the lexical path under it.
+    let deepest = dirname(absolute);
+    while (deepest !== prefix) {
+        const stat = unwrapOrThrow(await tryFs("mutator.lstatAncestor", () => lstat(deepest), { path: deepest, onAbsent: () => null }));
+        if (stat !== null)
+            break;
+        deepest = dirname(deepest);
+    }
+    const realDeepest = unwrapOrThrow(await tryFs("mutator.realpathAncestor", () => realpath(deepest), { path: deepest, onAbsent: () => null }));
+    if (realDeepest === null)
+        return "symlink_denied";
+    if (realDeepest !== realPrefix && !realDeepest.startsWith(realPrefix + sep))
+        return "out_of_prefix";
+    const targetDir = joinPath(realDeepest, relativePath(deepest, dirname(absolute)));
+    let landingDir = realDeepest;
+    if (targetDir !== realDeepest) {
+        unwrapOrThrow(await tryFsWrite("mutator.mkdirParents", () => mkdir(targetDir, { recursive: true }), { path: targetDir }));
+        // Recursive mkdir follows a symlink that already occupies a segment, so
+        // a symlink raced into a missing segment after the ancestor check would
+        // re-aim the tail. The canonical path of the created directory exposes
+        // it; a directory that vanished before the check is hostile too. The
+        // open below uses the canonical path, so the write never traverses the
+        // raced segment again.
+        const realTarget = unwrapOrThrow(await tryFs("mutator.realpathTarget", () => realpath(targetDir), { path: targetDir, onAbsent: () => null }));
+        if (realTarget === null)
+            return "symlink_denied";
+        if (realTarget !== realPrefix && !realTarget.startsWith(realPrefix + sep))
+            return "out_of_prefix";
+        landingDir = realTarget;
+    }
+    const finalPath = joinPath(landingDir, basename(absolute));
+    const finalStat = unwrapOrThrow(await tryFs("mutator.lstatFinal", () => lstat(finalPath), { path: finalPath, onAbsent: () => null }));
+    if (finalStat !== null && finalStat.isSymbolicLink())
+        return "symlink_denied";
+    // `O_NOFOLLOW` backstops the lstat refusal: a symlink raced in between the
+    // two calls fails the open (`ELOOP`) instead of being followed.
+    const handle = unwrapOrThrow(await tryFsWrite("mutator.open", () => open(finalPath, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW), {
+        path: finalPath,
+    }));
+    try {
+        unwrapOrThrow(await tryFsWrite("mutator.writeBytes", () => handle.writeFile(bytes), { path: finalPath }));
+    }
+    finally {
+        unwrapOrThrow(await tryFsWrite("mutator.close", () => handle.close(), { path: finalPath }));
+    }
+    return "ok";
+}
+/**
+ * The shared write gauntlet both realizations run: resolve + confine
+ * (`resolveForWrite`), then the hardened landing wrapped in `runStep`. A
+ * refusal comes back as data; an ok carries what the caller's provenance
+ * record needs — the analysis-relative path and the exact bytes that landed.
+ */
+async function confinedWrite(args) {
+    const scoped = resolveForWrite({
+        workspaceRoot: args.workspaceRoot,
+        analysisId: args.analysisId,
+        workingDir: args.workingDir,
+        path: args.path,
+    });
+    if (scoped.kind === "out_of_scope")
+        return { status: "out_of_scope" };
+    if (scoped.kind === "out_of_prefix")
+        return { status: "out_of_prefix" };
+    // Analysis-root-relative, forward-slashed: the agent-facing result
+    // path prepends the `/{analysisId}` frame; a provenance record uses
+    // the bare tail (the collector normalizes it step-relative itself).
+    const relative = scoped.relative.split("\\").join("/");
+    const agentPath = `/${args.analysisId}/${relative}`;
+    const bytes = Buffer.from(args.content, "utf8");
+    const prefix = resolvePath(args.workingDir);
+    // The loop dispatches a workflow-mode tool body unwrapped (see
+    // `dispatchTools` in loop/run-agent.ts), so a DBOS replay re-runs
+    // this body. The step wrapper caches the landing: a replay returns
+    // the recorded outcome instead of touching the disk again. On the
+    // chat route the injected `runStep` is the passthrough — the same
+    // call, no durability, no fork of this path.
+    const landed = await args.runStep("write", () => landBytes(prefix, scoped.absolute, bytes));
+    if (landed !== "ok")
+        return { status: landed };
+    return { status: "ok", relative, agentPath, bytes };
+}
 export function createWorkspaceMutator(deps) {
     return {
-        async writeFile({ path, content, toolName, emit }) {
-            const scoped = resolveForWrite({
+        async writeFile({ path, content, toolName, invocationId, runStep }) {
+            const landed = await confinedWrite({
                 workspaceRoot: deps.workspaceRoot,
                 analysisId: deps.analysisId,
                 workingDir: deps.workingDir,
                 path,
+                content,
+                runStep,
             });
-            if (scoped.kind === "out_of_scope")
-                return { status: "out_of_scope", path };
-            if (scoped.kind === "out_of_prefix")
-                return { status: "out_of_prefix", path };
-            // Analysis-root-relative, forward-slashed: the sandbox path prepends
-            // the `/{analysisId}` mount; the provenance record uses the bare tail
-            // (the collector normalizes it step-relative itself).
-            const relative = scoped.relative.split("\\").join("/");
-            const sandboxPath = `/${deps.analysisId}/${relative}`;
-            const contentBytes = Buffer.from(content, "utf8");
-            const execId = `${deps.workflowId}:${deps.stepId}:${deps.nextFunctionId()}`;
-            const result = await runSandboxExec({
-                sandboxClient: deps.sandboxClient,
-                sandbox: deps.sandbox,
-                execId,
-                command: ["python3", "-c", WRITE_BYTES_PROGRAM, sandboxPath, contentBytes.toString("base64")],
-                cwd: deps.sandboxWorkingDir,
-                deadlineMs: deps.deadlineMs(),
-                emit,
-            });
-            if (result.exitCode !== 0) {
-                return { status: "write_failed", path: sandboxPath, ...boundExecResult(result) };
-            }
+            if (landed.status !== "ok")
+                return { status: landed.status, path };
             // Attest the write in-process from the exact bytes just written — the
             // seam owns write provenance the same way it owns confinement. The
-            // sandbox exec frame this write produces is deliberately not fed to
-            // `feedExecFrame`: doing so would mint a `python3`+base64 command
-            // record, the very misattribution this file-tool record supersedes.
+            // record lands outside the write step on purpose: the collector is
+            // process-local state, so a recovered replay must re-record into the
+            // fresh collector even while the cached step skips the disk write.
             //
-            // `timestamp` is a write-time wall clock — normally a replay hazard in
-            // provenance, but safe here because the record contributes only producer
-            // IDENTITY downstream: the bridge drops it (the cli's file-tool ref has no
-            // timestamp field) and the signed `inflexa:FileToolWrite` activity carries
-            // just the tool name, so a re-execution's fresh stamp changes nothing in
-            // the attested graph. Do NOT start forwarding it into an identifier or a
-            // formal PROV position without making it replay-stable first.
+            // `invocationId` is replay-stable: the model turn that minted the tool
+            // call is a durably cached step, so a re-execution replays the same id.
+            // That is what lets the bridge key a DETERMINISTIC call-activity
+            // identifier on it — a wall-clock stamp here would be re-minted per
+            // replay and must never reach an identifier or a formal PROV position.
             if (deps.lineageCollector) {
                 deps.lineageCollector.recordFileToolWrite({
-                    path: relative,
-                    hash: computeSha256(contentBytes),
-                    size: contentBytes.length,
+                    path: landed.relative,
+                    hash: computeSha256(landed.bytes),
+                    size: landed.bytes.length,
                     toolName,
-                    timestamp: new Date().toISOString(),
+                    invocationId,
                 });
             }
-            return { status: "ok", path: sandboxPath, bytesWritten: contentBytes.length };
+            return { status: "ok", path: landed.agentPath, bytesWritten: landed.bytes.length };
+        },
+    };
+}
+/**
+ * The session-scoped `WorkspaceMutator` realization — the conversation agent's
+ * write path. Where `createWorkspaceMutator` closes over fixed per-step
+ * coordinates, this one serves every analysis from one construction: each call
+ * resolves the workspace root from the session's analysis scope, and the write
+ * prefix IS that root — the agent modifies its own analysis tree freely, while
+ * `..` traversal, a foreign analysis, and the symlink escapes stay refused by
+ * the same gauntlet.
+ *
+ * A write here runs under no run and no step, so its provenance is a session
+ * observation, not a collector record: each successful write emits one
+ * `write-file` session event (see `provenance/seam.ts`).
+ */
+export function createSessionWorkspaceMutator(deps) {
+    const logger = (deps.logger ?? createNoopLogger()).named("workspace-mutator");
+    const observe = bindSessionEmit(deps.provenance, logger);
+    return {
+        async writeFile({ path, content, toolName, invocationId, runStep, session }) {
+            // Only an analysis scope has a workspace tree; under any other
+            // scope there is nothing in scope to write.
+            const scope = session.scope;
+            if (scope.kind !== "analysis")
+                return { status: "out_of_scope", path };
+            // Throws on an unknown analysis — the loop's dispatch catch maps
+            // it to an error tool result, like any unexpected host failure.
+            const workspaceRoot = deps.resolveWorkspaceRoot(scope.analysisId);
+            const landed = await confinedWrite({
+                workspaceRoot,
+                analysisId: scope.analysisId,
+                workingDir: workspaceRoot,
+                path,
+                content,
+                runStep,
+            });
+            if (landed.status !== "ok")
+                return { status: landed.status, path };
+            observe({
+                type: "write-file",
+                analysisId: scope.analysisId,
+                ...(scope.threadId !== undefined ? { threadId: scope.threadId } : {}),
+                path: landed.relative,
+                hash: computeSha256(landed.bytes),
+                size: landed.bytes.length,
+                tool: toolName,
+                invocationId,
+            });
+            return { status: "ok", path: landed.agentPath, bytesWritten: landed.bytes.length };
         },
     };
 }

package/dist/tools/workspace/run-exec.d.ts

@@ -1,13 +1,13 @@
 /**
  * Internal helper used by dependency-bearing tools to drive one sandbox exec
  * through the `SandboxClient`. Centralises the submit/await pair, exec-id
- * derivation, and intermediate-event forwarding so all three tools share
- * one chokepoint. `write_file` / `edit_file` are layered on the workspace
- * mutator and environment introspection tools such as `list_available_refs`
- * use this same replay-safe submit/await path rather than a parallel protocol.
+ * derivation, and intermediate-event forwarding in one chokepoint.
+ * `execute_command` and environment introspection tools such as
+ * `list_available_refs` use this same replay-safe submit/await path rather
+ * than a parallel protocol.
  *
  * Not a registered tool — `defineTool` is called by the user-facing tools
- * (`execute-command.ts`, `write-file.ts`, `edit-file.ts`) which wrap this.
+ * (`execute-command.ts`) which wrap this.
  */
 import type { SandboxClient } from "../../sandbox/client.js";
 import type { ExecResult, SandboxRef } from "../../sandbox/types.js";

package/dist/tools/workspace/run-exec.js

@@ -1,13 +1,13 @@
 /**
  * Internal helper used by dependency-bearing tools to drive one sandbox exec
  * through the `SandboxClient`. Centralises the submit/await pair, exec-id
- * derivation, and intermediate-event forwarding so all three tools share
- * one chokepoint. `write_file` / `edit_file` are layered on the workspace
- * mutator and environment introspection tools such as `list_available_refs`
- * use this same replay-safe submit/await path rather than a parallel protocol.
+ * derivation, and intermediate-event forwarding in one chokepoint.
+ * `execute_command` and environment introspection tools such as
+ * `list_available_refs` use this same replay-safe submit/await path rather
+ * than a parallel protocol.
  *
  * Not a registered tool — `defineTool` is called by the user-facing tools
- * (`execute-command.ts`, `write-file.ts`, `edit-file.ts`) which wrap this.
+ * (`execute-command.ts`) which wrap this.
  */
 export async function runSandboxExec(args) {
     const body = {

package/dist/tools/workspace/write-file.d.ts

@@ -1,10 +1,10 @@
 /**
- * `write_file` — sandbox-gated workspace write, confined to the agent's
- * writable working directory.
+ * `write_file` — workspace write, confined to the agent's writable working
+ * directory.
  *
  * A thin adapter over the `WorkspaceMutator` seam (see the harness-durable-runtime / harness-workspace-tools specs): the
- * mutator owns resolve + confine + sandbox write + provenance. This tool only
- * declares the input schema and forwards. `edit_file` rides the same seam.
+ * mutator owns resolve + confine + hardened host write + provenance. This tool
+ * only declares the input schema and forwards. `edit_file` rides the same seam.
  */
 import type { WorkspaceMutator } from "./mutator.js";
 export interface WriteFileDeps {

package/dist/tools/workspace/write-file.js

@@ -1,10 +1,10 @@
 /**
- * `write_file` — sandbox-gated workspace write, confined to the agent's
- * writable working directory.
+ * `write_file` — workspace write, confined to the agent's writable working
+ * directory.
  *
  * A thin adapter over the `WorkspaceMutator` seam (see the harness-durable-runtime / harness-workspace-tools specs): the
- * mutator owns resolve + confine + sandbox write + provenance. This tool only
- * declares the input schema and forwards. `edit_file` rides the same seam.
+ * mutator owns resolve + confine + hardened host write + provenance. This tool
+ * only declares the input schema and forwards. `edit_file` rides the same seam.
  */
 import { ok } from "neverthrow";
 import { z } from "zod";
@@ -21,7 +21,8 @@ const WriteFileInputSchema = z.object({
 export function createWriteFileTool(deps) {
     return defineTool({
         id: "write_file",
-        // Body-only `awaitExec`-recv → runs unwrapped in the workflow body (see the harness-tools spec).
+        // The mutator wraps the disk mutation in `ctx.runStep` itself, so the
+        // body runs unwrapped in the workflow body (see the harness-tools spec).
         executionMode: "workflow",
         description: "Write a UTF-8 text file in your working directory. Relative paths " +
             "resolve against it; a path outside it returns an `out_of_prefix` data " +
@@ -31,6 +32,13 @@ export function createWriteFileTool(deps) {
         // The path only. `content` is a whole file and must never ride a display
         // channel, which the emit-site length cap enforces regardless.
         describeCall: ({ path }) => path,
-        execute: async ({ path, content }, ctx) => ok(await deps.mutator.writeFile({ path, content, toolName: "write_file", emit: ctx.emit })),
+        execute: async ({ path, content }, ctx) => ok(await deps.mutator.writeFile({
+            path,
+            content,
+            toolName: "write_file",
+            invocationId: ctx.invocationId,
+            runStep: ctx.runStep,
+            session: ctx.session,
+        })),
     });
 }

package/dist/workspace/paths.d.ts

@@ -155,7 +155,7 @@ export declare function tailWritePrefix(args: {
  * in-sandbox absolute path. The tree is bind-mounted at `/{resourceId}`, so
  * the sandbox path is the resource id plus the root-relative tail — the host
  * location of the root never leaks into the container. Single source of truth
- * for the `execute_command` / `write_file` cwd and for the working directory
+ * for the `execute_command` cwd and for the working directory
  * a step briefing names (see the harness-workspace-tools spec).
  */
 export declare function toSandboxPath(workspaceRoot: string, resourceId: string, hostAbsPath: string): string;

package/dist/workspace/paths.js

@@ -137,7 +137,7 @@ export function tailWritePrefix(args) {
  * in-sandbox absolute path. The tree is bind-mounted at `/{resourceId}`, so
  * the sandbox path is the resource id plus the root-relative tail — the host
  * location of the root never leaks into the container. Single source of truth
- * for the `execute_command` / `write_file` cwd and for the working directory
+ * for the `execute_command` cwd and for the working directory
  * a step briefing names (see the harness-workspace-tools spec).
  */
 export function toSandboxPath(workspaceRoot, resourceId, hostAbsPath) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@inflexa-ai/harness",
-    "version": "0.33.1",
+    "version": "0.35.0",
     "description": "Host-agnostic bioinformatics agent harness — hand-rolled agent loop, DBOS-durable workflows, sandboxed compute.",
     "license": "Apache-2.0",
     "type": "module",