@zhivex-ai/harness 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 0.11.0 - 2026-08-21
+
+### Added
+
+- Add a dependency-free terminal presentation layer with sanitized/redacted activity events, complete governed approval cards, and `y`/`n`/`v`/`q` decision handling that never partially resolves a durable approval batch.
+- Add `/pending`, `/approve`, and `/deny` so a recovered chat session can inspect and resolve its durable approval without leaving the console; persisted provider, routing, context, and OCI policy are restored before resumption.
+- Add bounded project context/rule discovery, progressive `SKILL.md` disclosure, and version-bound trusted application lifecycle hooks. Repository configuration cannot register executable host hooks.
+- Add opt-in `run_environment_shell` through `--execution oci --oci-shell ask`. The exact script is approval-bound and interpreted only by `sh` inside the no-network OCI snapshot; host mutation still requires the separate content-bound import approval.
+
+### Changed
+
+- Advance resolved config schema to `5` and the OCI execution-policy fingerprint to `2026-08-21-v4`; complete paused `0.10.0` work with the published artifact rather than rebinding it to the changed tool/context surface.
+- Bound the live reviewer-delegation fixture to one read-only child tool call against a temporary repository with a known diff, avoiding provider-specific false failures caused by asking a reviewer to inspect an empty non-Git workspace.
+- Align the default mixed-provider live route with the certified cohort (OpenAI parent, Qwen reviewer); Gemini routing remains an explicit provisional certification target.
+- Await asynchronous harness shutdown throughout release, evaluation, smoke, and test callers so lifecycle hooks and OCI cleanup complete before process exit.
+- Emit `run-finished` only for terminal run states, and have `zhx doctor` load and validate configured project context before reporting readiness.
+
+### Migration from 0.10.x
+
+- Change schema-version-pinned configuration from `schemaVersion: 4` to `5`. Existing SQLite state remains readable, but paused approvals created by `0.10.x` must be completed or denied with the matching `0.10.x` artifact because context, hook, tool, and execution-policy fingerprints changed.
+- Await `harness.close()` in library cleanup paths. Lifecycle hooks can make shutdown asynchronous even when no execution environment is active.
+- Project context discovery is enabled by default. Use `--no-project-context` or `projectContext: false` when an embedding must ignore repository instructions; malformed explicit context manifests fail before provider execution.
+- OCI shell syntax remains opt-in. Existing OCI configurations keep `shellMode: "deny"`; set `--oci-shell ask` or `shellMode: "ask"` only when exact-script approval inside the no-network container is intended.
+
+### Security
+
+- Shell remains `deny` by default, is unavailable without OCI, never inherits host environment variables, and does not enable container networking. Command entrypoint lists do not claim to constrain every descendant process spawned inside the container.
+
 ## 0.10.0 - 2026-08-21
 
 ### Changed

package/README.md

@@ -13,7 +13,7 @@ Zhivex Harness runs coding agents against real repositories with conflict-safe e
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.10.0` is the source candidate for the Node-first runtime and package-manager-neutral repository checks. The latest public npm release is `0.9.0`; local validation does not imply that `0.10.0` has been published or release-certified. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+Version `0.11.0` is the current source release candidate. The latest public npm release remains the tagged Node-first `0.10.0` artifact until the reviewed release workflow publishes and verifies `0.11.0`; local validation alone does not publish or certify registry provenance. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
 
 ## Why Zhivex Harness
 
@@ -40,7 +40,15 @@ bun run demo:hostile
 
 The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
 
-## What 0.10 changes
+## What 0.11 changes
+
+- adds a dependency-free terminal presentation layer with redacted activity, complete approval cards, and durable `y`/`n`/`v`/`q` decisions;
+- lets recovered chat sessions inspect and resolve their current approval with `/pending`, `/approve`, and `/deny` after restoring the exact persisted provider, routing, context, and OCI policy;
+- loads bounded `AGENTS.md`, project context, rules, and progressively disclosed skills while binding their digests into durable compatibility;
+- adds trusted application lifecycle hooks with versioned identities, bounded events, timeouts, and redacted failures; and
+- exposes exact-script shell syntax only through explicit `--execution oci --oci-shell ask`, preserving denied network and the separate host-import approval.
+
+## What 0.10 changed
 
 - makes Node.js `>=22.13.0` the primary public CLI and library runtime while retaining Bun-compatible imports and Bun-managed contributor workflows;
 - replaces `bun:sqlite` and `Bun.spawn` with `node:sqlite` and argv-only `node:child_process` boundaries without changing the durable SQLite file format;
@@ -90,7 +98,7 @@ The expected result is a schema-versioned JSON proof with `secretExcluded`, `net
 - protection against path traversal, symlink escapes, unsafe state targets, secret-file reads, special files, concurrent non-overwrite races, and unbounded output;
 - Linux/macOS CI, installed-tarball smoke coverage, and opt-in live-provider certification.
 
-It does not include arbitrary host shell access, `stdio` MCP, permanent deletion, Git writes, a desktop UI, a remote worker, or a managed sandbox service. Without `--execution oci`, shell-class tools remain unavailable. With OCI enabled, repository tools, checks, and enabled subagents share the acquired snapshot; network MCP is rejected because it cannot truthfully satisfy the no-network execution policy.
+It does not include arbitrary host shell access, `stdio` MCP, permanent deletion, Git writes, a desktop UI, a remote worker, or a managed sandbox service. Without `--execution oci`, shell-class tools remain unavailable. The opt-in `--oci-shell ask` policy exposes approval-bound `sh` only inside OCI. With OCI enabled, repository tools, checks, and enabled subagents share the acquired snapshot; network MCP is rejected because it cannot truthfully satisfy the no-network execution policy.
 
 ## Requirements
 
@@ -101,19 +109,13 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ## Installation
 
-The currently published `0.9.0` package still uses the Bun-first runtime:
-
-```bash
-bunx --package @zhivex-ai/harness@0.9.0 zhx --version
-```
-
-After the exact `0.10.0` artifact is published and registry-verified, the Node-first installation is:
+Install the published Node-first `0.10.0` artifact with an exact version:
 
 ```bash
 npx --yes --package=@zhivex-ai/harness@0.10.0 zhx --version
 ```
 
-Do not omit the version while npm `latest` still resolves to `0.9.0`. To exercise the `0.10.0` source checkout now, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
+To exercise the source checkout, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
 
 ```bash
 bun install --frozen-lockfile
@@ -153,7 +155,9 @@ zhx chat --continue
 zhivex-harness --version
 ```
 
-Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/compact`, `/new`, `/rename`, and `/exit`.
+Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/pending`, `/approve`, `/deny`, `/compact`, `/new`, `/rename`, and `/exit`. Tool and step activity is rendered without tool payloads; approval cards sanitize terminal controls and keep governed edit/command payloads fully reviewable.
+
+Project context engineering is enabled by default. A root `AGENTS.md` plus an optional `.zhivex/harness.json` can declare bounded context files, rule files, and progressively loaded `SKILL.md` directories. Disable discovery with `--no-project-context` or select another manifest with `--context-config`.
 
 Show providers and detected configuration without printing secrets:
 
@@ -192,7 +196,7 @@ zhx run --provider openai --route explorer=qwen --route reviewer=gemini \
   "implement the change, then review it independently"
 ```
 
-Routing with `--max-cost-usd` remains rejected in `0.10.0`: aggregate usage cannot yet be priced correctly when roles use different models.
+Routing with `--max-cost-usd` remains rejected in `0.11.0`: aggregate usage cannot yet be priced correctly when roles use different models.
 
 Writes and checks pause for approval. In a non-interactive execution, state is saved in `.zhivex-harness/runs/operations.sqlite`:
 
@@ -269,9 +273,10 @@ Enable enforced local execution explicitly. The image must already exist locally
 docker pull node:24-bookworm-slim
 zhivex-harness doctor --execution oci
 zhivex-harness run --execution oci --yes "inspect, implement, test, review the environment patch, and import it"
+zhivex-harness run --execution oci --oci-shell ask "use a reviewed shell pipeline inside the isolated snapshot"
 ```
 
-`--yes` approves both command execution and the distinct host patch import. Omit it when a human should review each durable approval. Configuration, threat boundary, cleanup, and certification details are in [docs/EXECUTION_ENVIRONMENTS.md](./docs/EXECUTION_ENVIRONMENTS.md).
+`--yes` approves eligible command execution and the distinct host patch import; it cannot enable a shell whose policy is `deny`. Omit it when a human should review each durable approval. Configuration, threat boundary, cleanup, and certification details are in [docs/EXECUTION_ENVIRONMENTS.md](./docs/EXECUTION_ENVIRONMENTS.md).
 
 ## Providers and defaults
 
@@ -284,7 +289,7 @@ zhivex-harness run --execution oci --yes "inspect, implement, test, review the e
 
 Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
-Meta and Qwen retain the published support conclusion for the unchanged approval/restart and delegation paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. The Node-first `0.10.0` source candidate passes the local npm-installed artifact and real OCI boundary smokes; the Node 22/24 CI matrix and live-provider release certification remain pending. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+Meta and Qwen retain the published support conclusion for the unchanged approval/restart and delegation paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. The tagged Node-first `0.10.0` artifact is published; the `0.11.0` candidate requires its own clean CI, live-provider, artifact, registry, and provenance gates. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 

package/ROADMAP.md

@@ -3,7 +3,7 @@
 - Status: active
 - Baseline date: 2026-08-21
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.9.0` are published on npm. `0.10.0` is the source candidate for a Node-first public runtime and package-manager-neutral repository checks; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.10.0` are published on npm. Version `0.11.0` is the local source release candidate for interactive operation, context engineering, and opt-in OCI shell workflows; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -43,7 +43,8 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.7.0` | Multi-provider agent console | Durable sessions, extensible providers, safe role routing, and automation events | Published on npm | L |
 | `0.8.0` | SDK refresh and GPT-5.6 | One Core runtime, current adapters, and a GPT-5.6-first OpenAI path | Published on npm | M |
 | `0.9.0` | Fast governed change admission | Lower repository/OCI overhead plus portable offline evidence bound to exact patch bytes | Published on npm | L |
-| `0.10.0` | Node-first portability | Node CLI/library, portable SQLite/processes, manager-aware checks, and Node OCI | Source candidate | L |
+| `0.10.0` | Node-first portability | Node CLI/library, portable SQLite/processes, manager-aware checks, and Node OCI | Published on npm | L |
+| `0.11.0` | Daily-driver foundations | Richer terminal operation, governed context/skills/hooks, and opt-in OCI shell | Local release candidate | L |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -290,7 +291,7 @@ Exit criteria:
 
 ## 0.10.0 — Node-first runtime portability
 
-Status: source candidate. The full deterministic suite, evaluation, documentation, npm-installed exact-tarball smoke, direct Node/Bun imports, Bun-created approval resume under Node, and required real-Docker OCI boundary gate pass locally. The Node 22/24 CI matrix, live providers, clean release gate, tag, registry, and provenance remain separate.
+Status: published on npm with the `v0.10.0` tag. Later source work is not covered by that release's artifact or provenance evidence.
 
 Goal: remove Bun as an installation prerequisite without weakening governed execution or forcing target repositories to adopt one package manager.
 
@@ -310,6 +311,25 @@ Exit criteria:
 - Linux real-OCI validation passes on the preloaded Node 24 image with unchanged network/rootfs/resource/patch-import guarantees.
 - Documentation, typecheck, full tests, evaluation, build, package inspection, installed-artifact smoke, release checks, live matrix, tag, registry integrity, and provenance are closed independently.
 
+## 0.11.0 — daily-driver foundations
+
+Status: local source release candidate. It is not yet tagged or published as a new artifact.
+
+Goal: make the governed runtime practical for daily interactive work without giving repository content or shell syntax authority over host policy.
+
+Scope:
+
+- Render redacted step/tool activity and safe approval cards, and resolve recovered approvals from the durable chat console with `/pending`, `/approve`, and `/deny`.
+- Load bounded root/project context and rules, expose a metadata-only skill catalog, and load skill instructions progressively instead of injecting every skill into the initial prompt.
+- Add trusted application lifecycle hooks identified by version in the harness binding; repository manifests never introduce executable host hooks.
+- Expose full shell syntax only behind explicit `--execution oci --oci-shell ask`, with exact-script approval, denied container network, resource limits, and separate host patch-import approval.
+- Keep semantic search, IDE clients, remote workers, executable project hooks, and network-enabled sandbox profiles as later independently governed tracks.
+
+Exit criteria:
+
+- TTY, no-color, approval-resume, context traversal/symlink, skill disclosure, hook redaction/failure, and OCI shell policy regressions pass.
+- The full deterministic, package, and real-OCI gates pass from a clean commit before any release number, tag, or publication is claimed.
+
 ## 1.0.0 — Stable CLI and library contract
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
@@ -355,8 +375,8 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Complete the `0.10.0` Node-first source gate and inspect every runtime-facing diff, compatibility export, documentation contract, and lockfile change.
-2. Run required real-OCI validation against `node:24-bookworm-slim` plus installed-artifact smokes under Node 22/24 and secondary Bun import coverage.
-3. Dogfood npm, pnpm, Yarn, and Bun repositories, including ambiguous lockfiles, lifecycle hooks, custom OCI images, and durable state created by `0.9.x`.
-4. Complete the provider live matrices affected by the new OCI controller; keep uncertified paths provisional on any failure or missing evidence.
-5. Only after those gates, date the changelog, create the annotated tag, dispatch the reviewed release workflow, and verify registry integrity and provenance against the exact artifact.
+1. Review and commit the exact `0.11.0` source candidate on `main`, then require clean Linux/macOS CI and Node 22.13/24 artifact compatibility.
+2. Run the required real-OCI gate against `node:24-bookworm-slim` plus installed-artifact smoke coverage for terminal, context, lifecycle-hook, and OCI shell exports.
+3. Complete the provider live matrices affected by the changed context/tool fingerprint; keep any missing or failed path outside the certified release evidence.
+4. Create annotated tag `v0.11.0` from the reviewed release commit and dispatch the protected workflow only after confirming npm still lacks that immutable version.
+5. Verify the exact published tarball, `latest` tag, integrity, and SLSA provenance before calling `0.11.0` released.

package/dist/cli.d.ts

@@ -55,6 +55,7 @@ export interface CliOptions {
     ociRuntime?: string;
     ociImage?: string;
     ociAllowedCommands?: string[];
+    ociShellMode?: string;
     ociMaxProcessRuntimeMs?: number;
     ociMaxProcessOutputBytes?: number;
     ociMaxMemoryMb?: number;
@@ -64,6 +65,8 @@ export interface CliOptions {
     ociMaxFileWriteBytes?: number;
     ociTmpfsMb?: number;
     mcpConfigPath?: string;
+    contextConfigPath?: string;
+    projectContext?: boolean;
     prompt?: string;
     runId?: string;
     idempotencyKey?: string;
@@ -200,6 +203,7 @@ export interface DoctorReport {
         allowedChecks: readonly string[];
         requiredCapabilities: ReturnType<typeof resolveHarnessConfig>["requiredCapabilities"];
         orchestration: ReturnType<typeof resolveHarnessConfig>["orchestration"];
+        context: ReturnType<typeof resolveHarnessConfig>["context"];
         execution: ReturnType<typeof resolveHarnessConfig>["execution"];
         mcpConfigPath?: string;
     };
@@ -213,7 +217,7 @@ export interface DoctorContext {
     bunVersion?: string;
     ociRuntimeAdapter?: HarnessOciRuntimeAdapter;
 }
-export declare const createDoctorReport: (options?: Pick<CliOptions, "provider" | "model" | "workspace" | "stateDirectory" | "storeBackend" | "tenantId" | "userId" | "namespace" | "maxSteps" | "timeoutMs" | "maxToolCalls" | "maxToolErrors" | "maxInputTokens" | "maxOutputTokens" | "maxTotalTokens" | "maxCostUsd" | "inputCostPerMillion" | "outputCostPerMillion" | "allowedChecks" | "requiredCapabilities" | "subagentProfiles" | "subagentMaxSteps" | "subagentMaxToolCalls" | "subagentMaxToolErrors" | "subagentMaxInputTokens" | "subagentMaxOutputTokens" | "subagentMaxTotalTokens" | "subagentTimeoutMs" | "maxParallelReviews" | "executionBackend" | "ociRuntime" | "ociImage" | "ociAllowedCommands" | "ociMaxProcessRuntimeMs" | "ociMaxProcessOutputBytes" | "ociMaxMemoryMb" | "ociMaxPids" | "ociMaxCpus" | "ociMaxWorkspaceBytes" | "ociMaxFileWriteBytes" | "ociTmpfsMb" | "mcpConfigPath">, context?: DoctorContext) => Promise<DoctorReport>;
+export declare const createDoctorReport: (options?: Pick<CliOptions, "provider" | "model" | "workspace" | "stateDirectory" | "storeBackend" | "tenantId" | "userId" | "namespace" | "maxSteps" | "timeoutMs" | "maxToolCalls" | "maxToolErrors" | "maxInputTokens" | "maxOutputTokens" | "maxTotalTokens" | "maxCostUsd" | "inputCostPerMillion" | "outputCostPerMillion" | "allowedChecks" | "requiredCapabilities" | "subagentProfiles" | "subagentMaxSteps" | "subagentMaxToolCalls" | "subagentMaxToolErrors" | "subagentMaxInputTokens" | "subagentMaxOutputTokens" | "subagentMaxTotalTokens" | "subagentTimeoutMs" | "maxParallelReviews" | "executionBackend" | "ociRuntime" | "ociImage" | "ociAllowedCommands" | "ociShellMode" | "ociMaxProcessRuntimeMs" | "ociMaxProcessOutputBytes" | "ociMaxMemoryMb" | "ociMaxPids" | "ociMaxCpus" | "ociMaxWorkspaceBytes" | "ociMaxFileWriteBytes" | "ociTmpfsMb" | "mcpConfigPath" | "contextConfigPath" | "projectContext">, context?: DoctorContext) => Promise<DoctorReport>;
 export declare const formatDoctorReport: (report: DoctorReport) => string;
 export declare const cliExitCodeForError: (error: unknown) => 1 | 2;
 export declare const main: (argv?: string[]) => Promise<void>;