@zhivex-ai/harness 0.11.0 → 0.11.1

package/dist/index.js

@@ -1218,7 +1218,6 @@ var normalizeScope = (scope) => {
 var stableKey = (kind, value) => createHash3("sha256").update(kind).update("\x00").update(value).digest("hex");
 var sessionId = () => `ses_${randomUUID()}`;
 var turnId = () => `turn_${randomUUID()}`;
-var isMissing = (error) => error.code === "ENOENT";
 var ensurePrivateDatabase = async (workspace, stateDirectory) => {
   const requestedStateDirectory = path3.resolve(stateDirectory);
   await validateStateDirectory(workspace, requestedStateDirectory);
@@ -1232,19 +1231,12 @@ var ensurePrivateDatabase = async (workspace, stateDirectory) => {
   const databasePath = path3.join(canonicalStateDirectory2, HARNESS_SESSION_INDEX_FILE);
   let databaseEntry;
   try {
+    const handle = await open(databasePath, "wx", 384);
+    await handle.close();
     databaseEntry = await lstat2(databasePath);
   } catch (error) {
-    if (!isMissing(error)) {
+    if (error.code !== "EEXIST")
       throw error;
-    }
-    try {
-      const handle = await open(databasePath, "wx", 384);
-      await handle.close();
-    } catch (creationError) {
-      if (creationError.code !== "EEXIST") {
-        throw creationError;
-      }
-    }
     databaseEntry = await lstat2(databasePath);
   }
   if (databaseEntry.isSymbolicLink() || !databaseEntry.isFile()) {
@@ -1764,13 +1756,12 @@ var openSessionStore = openCliSessionStore;
 // src/execution-environment.ts
 import { createHash as createHash6, randomUUID as randomUUID3 } from "node:crypto";
 import { spawn as spawn2 } from "node:child_process";
-import { constants as fsConstants } from "node:fs";
+import { constants as fsConstants2 } from "node:fs";
 import {
   chmod as chmod2,
   copyFile,
   lstat as lstat5,
   mkdir as mkdir3,
-  readFile as readFile2,
   readdir as readdir2,
   realpath as realpath3,
   rename as rename2,
@@ -1791,13 +1782,14 @@ var MAX_EDIT_FILE_BYTES = 1024 * 1024;
 var MAX_EDIT_PROPOSAL_BYTES = 4 * 1024 * 1024;
 var SHA256_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
 var fileDigestSchema = z.string().regex(SHA256_DIGEST_PATTERN, "Digest must use the format sha256:<64 lowercase hexadecimal characters>.");
+var expectedEditDigestSchema = fileDigestSchema.nullable().describe("Required. Use the inspected sha256 digest for an existing file, or explicit JSON null for a create-only target. Never omit this field.");
 var workspaceFilePathSchema = z.string().min(1).max(1024).refine((value) => !value.includes("\x00"), "Path cannot contain a NUL byte.").refine((value) => !path4.isAbsolute(value) && !/^[A-Za-z]:[\\/]/.test(value), "Path must be relative.").refine((value) => {
   const segments = value.split(/[\\/]+/);
   return segments.every((segment) => segment !== "" && segment !== "." && segment !== "..");
 }, "Path must be normalized and cannot contain empty, dot, or parent segments.");
 var editChangeSchema = z.strictObject({
   path: workspaceFilePathSchema,
-  expectedDigest: fileDigestSchema.nullable(),
+  expectedDigest: expectedEditDigestSchema,
   content: z.string()
 }).superRefine((change, context) => {
   if (Buffer.byteLength(change.content, "utf8") > MAX_EDIT_FILE_BYTES) {
@@ -1838,7 +1830,7 @@ var editProposalInputSchema = z.strictObject({
 });
 var editProposalChangeSchema = z.strictObject({
   path: workspaceFilePathSchema,
-  expectedDigest: fileDigestSchema.nullable(),
+  expectedDigest: expectedEditDigestSchema,
   contentDigest: fileDigestSchema,
   bytes: z.number().int().min(0).max(MAX_EDIT_FILE_BYTES)
 });
@@ -1915,6 +1907,94 @@ var editContractDocument = (kind, result) => ({
   result
 });
 
+// src/file-security.ts
+import { constants as fsConstants } from "node:fs";
+import { open as open2 } from "node:fs/promises";
+var sameOpenFile = (before, after) => before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs && before.mode === after.mode && before.nlink === after.nlink;
+
+class UnsafeFileTypeError extends Error {
+  constructor(label) {
+    super(`${label} must be a regular file and must not be a symbolic link.`);
+    this.name = "UnsafeFileTypeError";
+  }
+}
+
+class FileSizeLimitError extends Error {
+  label;
+  maxBytes;
+  constructor(label, maxBytes) {
+    super(`${label} exceeds the ${maxBytes}-byte limit.`);
+    this.label = label;
+    this.maxBytes = maxBytes;
+    this.name = "FileSizeLimitError";
+  }
+}
+
+class FileChangedWhileReadingError extends Error {
+  constructor(label) {
+    super(`${label} changed while it was being read.`);
+    this.name = "FileChangedWhileReadingError";
+  }
+}
+var invalidFileError = (label) => new UnsafeFileTypeError(label);
+var openRegularFileNoFollow = async (target, label) => {
+  try {
+    return await open2(target, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ELOOP" || code === "EMLINK")
+      throw invalidFileError(label);
+    throw error;
+  }
+};
+var statRegularFileNoFollow = async (target, options) => {
+  const handle = await openRegularFileNoFollow(target, options.label);
+  try {
+    const stat2 = await handle.stat();
+    if (!stat2.isFile() || options.requireSingleLink && stat2.nlink !== 1) {
+      throw invalidFileError(options.label);
+    }
+    return stat2;
+  } finally {
+    await handle.close();
+  }
+};
+var readRegularFileNoFollow = async (target, options) => {
+  const handle = await openRegularFileNoFollow(target, options.label);
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || options.requireSingleLink && before.nlink !== 1) {
+      throw invalidFileError(options.label);
+    }
+    if (!Number.isSafeInteger(before.size) || before.size < 0) {
+      throw new Error(`${options.label} has an unsupported size.`);
+    }
+    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 0) {
+      throw new Error(`${options.label} has an invalid byte limit.`);
+    }
+    if (before.size > options.maxBytes) {
+      throw new FileSizeLimitError(options.label, options.maxBytes);
+    }
+    const contents = Buffer.alloc(before.size);
+    let offset = 0;
+    while (offset < contents.byteLength) {
+      const { bytesRead } = await handle.read(contents, offset, contents.byteLength - offset, offset);
+      if (bytesRead === 0)
+        break;
+      offset += bytesRead;
+    }
+    const probe = Buffer.allocUnsafe(1);
+    const { bytesRead: extraBytes } = await handle.read(probe, 0, 1, before.size);
+    const after = await handle.stat();
+    if (offset !== before.size || extraBytes !== 0 || !sameOpenFile(before, after) || options.requireSingleLink && after.nlink !== 1) {
+      throw new FileChangedWhileReadingError(options.label);
+    }
+    return { contents, stat: after };
+  } finally {
+    await handle.close();
+  }
+};
+
 // src/package-manager.ts
 import { lstat as lstat3 } from "node:fs/promises";
 import path5 from "node:path";
@@ -2019,7 +2099,7 @@ var resolvePackageCheckCommand = async (root, manifest, check, expectedScript, a
 
 // src/workspace.ts
 import { createHash as createHash5, randomUUID as randomUUID2 } from "node:crypto";
-import { link, lstat as lstat4, mkdir as mkdir2, open as open2, readFile, readdir, realpath as realpath2, rename, stat as stat2, unlink } from "node:fs/promises";
+import { link, lstat as lstat4, mkdir as mkdir2, open as open3, readdir, realpath as realpath2, rename, stat as stat2, unlink } from "node:fs/promises";
 import path6 from "node:path";
 
 // src/process-runtime.ts
@@ -2100,9 +2180,11 @@ var runPortableProcess = async (command, options = {}) => {
   const argv = [...command];
   const stdout = new BoundedTextCapture(maxOutputCharacters);
   const stderr = new BoundedTextCapture(maxOutputCharacters);
+  const useProcessGroup = process.platform !== "win32";
   const child = spawn(argv[0], argv.slice(1), {
     ...options.cwd ? { cwd: options.cwd } : {},
     env: processEnvironment(options.env),
+    detached: useProcessGroup,
     shell: false,
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true
@@ -2112,13 +2194,27 @@ var runPortableProcess = async (command, options = {}) => {
   let terminationTimer;
   child.stdout.on("data", (chunk) => stdout.write(chunk));
   child.stderr?.on("data", (chunk) => stderr.write(chunk));
+  const signalProcessTree = (signal) => {
+    if (useProcessGroup && child.pid !== undefined) {
+      try {
+        process.kill(-child.pid, signal);
+        return;
+      } catch (error) {
+        if (error.code !== "ESRCH") {
+          child.kill(signal);
+          return;
+        }
+      }
+    }
+    if (child.exitCode === null && child.signalCode === null)
+      child.kill(signal);
+  };
   const terminate = () => {
-    if (child.exitCode !== null || child.signalCode !== null)
+    if (terminationTimer)
       return;
-    child.kill("SIGTERM");
+    signalProcessTree("SIGTERM");
     terminationTimer = setTimeout(() => {
-      if (child.exitCode === null && child.signalCode === null)
-        child.kill("SIGKILL");
+      signalProcessTree("SIGKILL");
     }, DEFAULT_TERMINATION_GRACE_MS);
     terminationTimer.unref?.();
   };
@@ -2329,6 +2425,9 @@ class Workspace {
     let current = this.root;
     for (let index = 0;index < segments.length; index += 1) {
       current = path6.join(current, segments[index]);
+      const leaf = index === segments.length - 1;
+      if (leaf && options.skipLeafValidation)
+        continue;
       let entry;
       try {
         entry = await lstat4(current);
@@ -2341,7 +2440,6 @@ class Workspace {
       if (entry.isSymbolicLink()) {
         throw new Error(`The path resolves outside the workspace or through a symbolic link: ${relativePath}`);
       }
-      const leaf = index === segments.length - 1;
       if (!leaf && !entry.isDirectory())
         throw new Error(`A path ancestor is not a directory: ${relativePath}`);
       if (leaf && options.requireFile && !entry.isFile())
@@ -2351,15 +2449,12 @@ class Workspace {
   }
   async readStableFile(relativePath, allowBinary = true) {
     this.indexMetrics.stableFileReads += 1;
-    const safe = await this.safePath(relativePath, { requireFile: true });
-    const before = await lstat4(safe.path);
-    if (before.size > MAX_FILE_BYTES)
-      throw new Error(`The file exceeds the ${MAX_FILE_BYTES}-byte limit.`);
-    const contents = await readFile(safe.path);
-    const after = await lstat4(safe.path);
-    if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
-      throw new Error(`The file changed while it was being read: ${relativePath}`);
-    }
+    const safe = await this.safePath(relativePath, { skipLeafValidation: true });
+    const file = await readRegularFileNoFollow(safe.path, {
+      label: "The file",
+      maxBytes: MAX_FILE_BYTES
+    });
+    const { contents } = file;
     if (!allowBinary && contents.includes(0))
       throw new Error("The file appears to be binary and cannot be read as text.");
     return {
@@ -2367,7 +2462,7 @@ class Workspace {
       absolutePath: safe.path,
       contents,
       digest: digestBytes(contents),
-      mode: before.mode & 511
+      mode: file.stat.mode & 511
     };
   }
   fingerprint(relativePath, kind, entry, digest2) {
@@ -2390,23 +2485,20 @@ class Workspace {
     for (const filename of IGNORE_FILES) {
       try {
         const ignorePath = path6.join(directory, filename);
-        const before = await lstat4(ignorePath);
-        if (before.isSymbolicLink() || !before.isFile())
+        const inspected = await statRegularFileNoFollow(ignorePath, { label: "The ignore file" });
+        if (inspected.size > MAX_FILE_BYTES) {
+          ignoreFiles.push(this.fingerprint(wirePath(path6.relative(this.root, ignorePath)), "ignore-file", inspected));
           continue;
-        if (before.size <= MAX_FILE_BYTES) {
-          const contents = await readFile(ignorePath);
-          const after = await lstat4(ignorePath);
-          if (after.isSymbolicLink() || !after.isFile() || !this.sameFingerprint(after, this.fingerprint("", "ignore-file", before))) {
-            throw new Error(`The ignore file changed while the workspace was being indexed: ${wirePath(path6.relative(this.root, ignorePath))}`);
-          }
-          const digest2 = digestBytes(contents);
-          ignoreFiles.push(this.fingerprint(wirePath(path6.relative(this.root, ignorePath)), "ignore-file", after, digest2));
-          rules.push(...parseIgnoreRules(contents.toString("utf8"), base));
-        } else {
-          ignoreFiles.push(this.fingerprint(wirePath(path6.relative(this.root, ignorePath)), "ignore-file", before));
         }
+        const file = await readRegularFileNoFollow(ignorePath, {
+          label: "The ignore file",
+          maxBytes: MAX_FILE_BYTES
+        });
+        const digest2 = digestBytes(file.contents);
+        ignoreFiles.push(this.fingerprint(wirePath(path6.relative(this.root, ignorePath)), "ignore-file", file.stat, digest2));
+        rules.push(...parseIgnoreRules(file.contents.toString("utf8"), base));
       } catch (error) {
-        if (error.code !== "ENOENT")
+        if (error.code !== "ENOENT" && !(error instanceof UnsafeFileTypeError))
           throw error;
       }
     }
@@ -2449,13 +2541,17 @@ class Workspace {
       }
       for (const fingerprint of index.ignoreFiles) {
         const absolute = path6.join(this.root, fingerprint.path);
-        const before = await lstat4(absolute);
-        if (before.isSymbolicLink() || !before.isFile() || !this.sameFingerprint(before, fingerprint))
-          return false;
         if (fingerprint.digest) {
-          const contents = await readFile(absolute);
-          const after = await lstat4(absolute);
-          if (after.isSymbolicLink() || !after.isFile() || !this.sameFingerprint(after, fingerprint) || digestBytes(contents) !== fingerprint.digest)
+          const file = await readRegularFileNoFollow(absolute, {
+            label: "The ignore file",
+            maxBytes: MAX_FILE_BYTES
+          });
+          if (!this.sameFingerprint(file.stat, fingerprint) || digestBytes(file.contents) !== fingerprint.digest) {
+            return false;
+          }
+        } else {
+          const inspected = await statRegularFileNoFollow(absolute, { label: "The ignore file" });
+          if (!this.sameFingerprint(inspected, fingerprint))
             return false;
         }
       }
@@ -2840,7 +2936,7 @@ class Workspace {
   async stageFile(target, contents, mode) {
     const directory = await this.secureWorkspaceDirectory(path6.dirname(target));
     const temporary = path6.join(directory, `.${path6.basename(target)}.zhivex-${randomUUID2()}.tmp`);
-    const handle = await open2(temporary, "wx", mode);
+    const handle = await open3(temporary, "wx", mode);
     try {
       await handle.writeFile(contents);
       await handle.chmod(mode);
@@ -3063,17 +3159,7 @@ class Workspace {
     await rename(temporary, target);
   }
   async readInternalRegularFile(target, label, maxBytes) {
-    const before = await lstat4(target);
-    if (before.isSymbolicLink() || !before.isFile())
-      throw new Error(`${label} must be a regular non-symlink file.`);
-    if (before.size > maxBytes)
-      throw new Error(`${label} exceeds its size limit.`);
-    const contents = await readFile(target);
-    const after = await lstat4(target);
-    if (after.isSymbolicLink() || !after.isFile() || before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
-      throw new Error(`${label} changed while it was being read.`);
-    }
-    return { contents, stat: before };
+    return await readRegularFileNoFollow(target, { label, maxBytes });
   }
   async quarantineFile(input) {
     const parsed = quarantineFileInputSchema.parse(input);
@@ -3086,7 +3172,7 @@ class Workspace {
     if ((await this.readStableFile(parsed.path)).digest !== parsed.expectedDigest)
       throw new Error(`Stale quarantine rejected for ${parsed.path}.`);
     await link(source.absolutePath, dataPath);
-    if (digestBytes(await readFile(dataPath)) !== source.digest) {
+    if (digestBytes((await this.readInternalRegularFile(dataPath, "Quarantine payload", MAX_FILE_BYTES)).contents) !== source.digest) {
       await unlink(dataPath).catch(() => {});
       throw new Error(`Quarantine payload changed before commit: ${parsed.path}.`);
     }
@@ -3143,8 +3229,8 @@ class Workspace {
       throw new Error("Quarantine payload changed before restore commit.");
     }
     await link(dataPath, destination.path);
-    const linkedDestination = await lstat4(destination.path);
-    if (linkedDestination.isSymbolicLink() || !linkedDestination.isFile() || linkedDestination.dev !== dataFile.stat.dev || linkedDestination.ino !== dataFile.stat.ino || digestBytes(await readFile(destination.path)) !== digest2) {
+    const linkedDestination = await this.readInternalRegularFile(destination.path, "Restore destination", MAX_FILE_BYTES);
+    if (linkedDestination.stat.dev !== dataFile.stat.dev || linkedDestination.stat.ino !== dataFile.stat.ino || digestBytes(linkedDestination.contents) !== digest2) {
       await unlink(destination.path).catch(() => {});
       throw new Error("Restore destination did not match the quarantined payload.");
     }
@@ -3217,6 +3303,8 @@ var TERMINAL_STATUSES2 = new Set([
   "cancelled",
   "timed_out"
 ]);
+var EXECUTION_ARTIFACT_DIRECTORY_PATTERN = /^[a-f0-9]{24}$/;
+var STAGED_EXECUTION_ARTIFACT_DIRECTORY_PATTERN = /^\.cleanup-([a-f0-9]{24})-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/;
 var BUILT_IN_TOOL_NAMES = new Set([
   "list_files",
   "read_file",
@@ -3388,7 +3476,9 @@ var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspace
   const seal = createHash6("sha256");
   const metadata = createHash6("sha256");
   const visit = async (directory, relativeDirectory = "") => {
-    for (const name of (await readdir2(directory)).sort()) {
+    const children = (await readdir2(directory, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name));
+    for (const child of children) {
+      const name = child.name;
       const relative = relativeDirectory ? `${relativeDirectory}/${name}` : name;
       const absolute = path7.join(directory, name);
       if (!isInside3(stagedRoot, absolute) || relative.length > 1024) {
@@ -3402,37 +3492,53 @@ var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspace
         await rm(absolute, { recursive: true, force: true });
         continue;
       }
-      const entry = await lstat5(absolute);
-      if (entry.isSymbolicLink()) {
+      if (child.isSymbolicLink()) {
         throw new Error(`OCI workspace export contains a symbolic link: ${relative}.`);
       }
-      if (entry.isDirectory()) {
-        updateSnapshotMetadata(metadata, "directory", relative, entry);
-        seal.update(`directory\x00${relative}\x00${entry.mode & 511}\x00`);
+      if (child.isDirectory()) {
+        const directoryEntry = await lstat5(absolute);
+        if (directoryEntry.isSymbolicLink() || !directoryEntry.isDirectory()) {
+          throw new Error(`OCI workspace export directory changed while it was being validated: ${relative}.`);
+        }
+        updateSnapshotMetadata(metadata, "directory", relative, directoryEntry);
+        seal.update(`directory\x00${relative}\x00${directoryEntry.mode & 511}\x00`);
         await visit(absolute, relative);
         continue;
       }
-      if (!entry.isFile() || entry.nlink !== 1) {
+      if (!child.isFile()) {
         throw new Error(`OCI workspace export contains a special or linked file: ${relative}.`);
       }
-      const contents = await readFile2(absolute);
-      const after = await lstat5(absolute);
-      if (after.isSymbolicLink() || !after.isFile() || after.nlink !== 1 || entry.dev !== after.dev || entry.ino !== after.ino || entry.size !== after.size || entry.mtimeMs !== after.mtimeMs || entry.ctimeMs !== after.ctimeMs || (entry.mode & 511) !== (after.mode & 511)) {
-        throw new Error(`OCI workspace export changed while it was being validated: ${relative}.`);
+      let file;
+      try {
+        file = await readRegularFileNoFollow(absolute, {
+          label: `OCI workspace export file ${relative}`,
+          maxBytes: maxWorkspaceBytes - totalBytes,
+          requireSingleLink: true
+        });
+      } catch (error) {
+        if (error instanceof FileSizeLimitError) {
+          throw new Error(`OCI workspace export exceeds the ${maxWorkspaceBytes}-byte workspace limit.`);
+        }
+        throw error;
       }
+      const contents = file.contents;
+      const entry = file.stat;
       totalBytes += entry.size;
       if (totalBytes > maxWorkspaceBytes) {
         throw new Error(`OCI workspace export exceeds the ${maxWorkspaceBytes}-byte workspace limit.`);
       }
       const contentDigest = digest2(contents);
-      updateSnapshotMetadata(metadata, "file", relative, after);
+      updateSnapshotMetadata(metadata, "file", relative, entry);
       seal.update(`file\x00${relative}\x00${entry.mode & 511}\x00${entry.size}\x00${contentDigest}\x00`);
       if (entry.size > maxFileWriteBytes) {
         const previous = path7.join(previousRoot, ...relative.split("/"));
         let unchanged = false;
         try {
-          const previousEntry = await lstat5(previous);
-          unchanged = previousEntry.isFile() && !previousEntry.isSymbolicLink() && previousEntry.size === entry.size && digest2(await readFile2(previous)) === contentDigest;
+          const previousFile = await readRegularFileNoFollow(previous, {
+            label: `Previous OCI workspace file ${relative}`,
+            maxBytes: entry.size
+          });
+          unchanged = previousFile.stat.size === entry.size && digest2(previousFile.contents) === contentDigest;
         } catch (error) {
           if (error.code !== "ENOENT")
             throw error;
@@ -4097,17 +4203,14 @@ var readSnapshotFile = async (workspace, expected, metrics) => {
   if (!isInside3(workspace.root, absolute)) {
     throw new Error(`Snapshot file escaped its workspace: ${expected.path}.`);
   }
-  const before = await lstat5(absolute);
-  if (before.isSymbolicLink() || !before.isFile()) {
-    throw new Error(`Snapshot source is not a regular file: ${expected.path}.`);
-  }
-  const contents = await readFile2(absolute);
-  const after = await lstat5(absolute);
-  if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || (before.mode & 511) !== (after.mode & 511)) {
-    throw new Error(`Snapshot source changed while reading: ${expected.path}.`);
-  }
+  const file = await readRegularFileNoFollow(absolute, {
+    label: `Snapshot source ${expected.path}`,
+    maxBytes: expected.bytes
+  });
+  const { contents } = file;
+  const entry = file.stat;
   const actualDigest = digest2(contents);
-  if (actualDigest !== expected.digest || contents.byteLength !== expected.bytes || (before.mode & 511) !== expected.mode) {
+  if (actualDigest !== expected.digest || contents.byteLength !== expected.bytes || (entry.mode & 511) !== expected.mode) {
     throw new Error(`Snapshot source changed after inventory: ${expected.path}.`);
   }
   if (metrics) {
@@ -4118,7 +4221,7 @@ var readSnapshotFile = async (workspace, expected, metrics) => {
 };
 var copySnapshotFile = async (source, target, metrics) => {
   try {
-    await copyFile(source, target, fsConstants.COPYFILE_FICLONE_FORCE);
+    await copyFile(source, target, fsConstants2.COPYFILE_FICLONE_FORCE);
   } catch (error) {
     const code = error.code;
     if (!code || !COPY_ON_WRITE_UNSUPPORTED_CODES.has(code))
@@ -4398,10 +4501,11 @@ var createHarnessOciExecutionEnvironment = async (options) => {
       const snapshotRoot = path7.join(directory, "workspace");
       let metadata;
       try {
-        const entry = await lstat5(metadataPath);
-        if (entry.isSymbolicLink() || !entry.isFile())
-          throw new Error("Execution metadata must be a regular file.");
-        metadata = JSON.parse(await readFile2(metadataPath, "utf8"));
+        const metadataFile = await readRegularFileNoFollow(metadataPath, {
+          label: "Execution metadata",
+          maxBytes: 1024 * 1024
+        });
+        metadata = JSON.parse(metadataFile.contents.toString("utf8"));
         if (metadata.schemaVersion !== HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION || metadata.runId !== request.runId || metadata.hostWorkspace !== options.workspace.root || metadata.binding.fingerprint !== binding.fingerprint || metadata.binding.workspaceId !== binding.workspaceId) {
           throw new Error(`Execution artifact binding changed for run ${request.runId}.`);
         }
@@ -4617,7 +4721,11 @@ var createHarnessOciExecutionEnvironment = async (options) => {
         async runCheck(check, expectedScript, allowedChecks, context) {
           let manifestDocument;
           try {
-            manifestDocument = JSON.parse(await readFile2(path7.join(snapshotRoot, "package.json"), "utf8"));
+            const manifestFile = await readRegularFileNoFollow(path7.join(snapshotRoot, "package.json"), {
+              label: "Snapshot package.json",
+              maxBytes: 1024 * 1024
+            });
+            manifestDocument = JSON.parse(manifestFile.contents.toString("utf8"));
           } catch (error) {
             if (error.code === "ENOENT") {
               throw new Error("The environment snapshot does not contain package.json.");
@@ -4662,30 +4770,56 @@ var cleanupHarnessExecutionArtifacts = async (stateDirectory, before) => {
     throw error;
   }
   for (const entry of entries) {
-    if (!entry.isDirectory() || entry.isSymbolicLink() || !/^[a-f0-9]{24}$/.test(entry.name)) {
+    const stagedMatch = STAGED_EXECUTION_ARTIFACT_DIRECTORY_PATTERN.exec(entry.name);
+    const artifactName = EXECUTION_ARTIFACT_DIRECTORY_PATTERN.test(entry.name) ? entry.name : stagedMatch?.[1];
+    if (!entry.isDirectory() || entry.isSymbolicLink() || !artifactName) {
       result.skipped += 1;
       continue;
     }
     result.scanned += 1;
     const directory = path7.join(root, entry.name);
-    const resolved = await realpath3(directory);
-    if (!isInside3(root, resolved)) {
-      result.skipped += 1;
-      continue;
-    }
     try {
+      const resolved = await realpath3(directory);
+      if (!isInside3(root, resolved))
+        throw new Error("unsafe execution artifact directory");
+      const directoryEntry = await lstat5(directory);
+      if (directoryEntry.isSymbolicLink() || !directoryEntry.isDirectory()) {
+        throw new Error("unsafe execution artifact directory");
+      }
       const metadataPath = path7.join(directory, "environment.json");
-      const metadataEntry = await lstat5(metadataPath);
-      if (metadataEntry.isSymbolicLink() || !metadataEntry.isFile())
-        throw new Error("unsafe metadata");
-      const metadata = JSON.parse(await readFile2(metadataPath, "utf8"));
+      const metadataFile = await readRegularFileNoFollow(metadataPath, {
+        label: "Execution cleanup metadata",
+        maxBytes: 1024 * 1024
+      });
+      const metadata = JSON.parse(metadataFile.contents.toString("utf8"));
       const releasedAt = metadata.releasedAt ? Date.parse(metadata.releasedAt) : Number.NaN;
       if (!metadata.status || !TERMINAL_STATUSES2.has(metadata.status) || !Number.isFinite(releasedAt) || releasedAt >= before) {
         result.skipped += 1;
         continue;
       }
-      await rm(directory, { recursive: true, force: true });
-      result.deleted += 1;
+      const stagedDirectory = path7.join(root, `.cleanup-${artifactName}-${randomUUID3()}`);
+      let staged = false;
+      try {
+        await rename2(directory, stagedDirectory);
+        staged = true;
+        const movedEntry = await lstat5(stagedDirectory);
+        if (movedEntry.isSymbolicLink() || !movedEntry.isDirectory() || movedEntry.dev !== directoryEntry.dev || movedEntry.ino !== directoryEntry.ino) {
+          throw new Error("execution artifact directory changed before cleanup");
+        }
+        const recheckedMetadata = await readRegularFileNoFollow(path7.join(stagedDirectory, "environment.json"), { label: "Execution cleanup metadata", maxBytes: 1024 * 1024 });
+        if (!recheckedMetadata.contents.equals(metadataFile.contents)) {
+          throw new Error("execution artifact metadata changed before cleanup");
+        }
+        await rm(stagedDirectory, { recursive: true, force: true });
+        staged = false;
+        result.deleted += 1;
+      } catch (error) {
+        if (staged)
+          await rename2(stagedDirectory, directory).catch(() => {
+            return;
+          });
+        throw error;
+      }
     } catch {
       result.skipped += 1;
     }
@@ -4750,7 +4884,7 @@ var selectHarnessModel = (candidates, required) => {
   };
 };
 // src/mcp.ts
-import { lstat as lstat6, readFile as readFile3, realpath as realpath4 } from "node:fs/promises";
+import { lstat as lstat6, readFile, realpath as realpath4 } from "node:fs/promises";
 import path8 from "node:path";
 import {
   createMcpToolSet,
@@ -4906,7 +5040,7 @@ var loadHarnessMcpConfiguration = async (workspace, configPath) => {
   }
   let value;
   try {
-    value = JSON.parse(await readFile3(canonicalConfig, "utf8"));
+    value = JSON.parse(await readFile(canonicalConfig, "utf8"));
   } catch (error) {
     throw new Error("MCP configuration is not valid JSON.", { cause: error });
   }
@@ -5840,7 +5974,7 @@ import { serializeJsonValue as serializeJsonValue2 } from "@zhivex-ai/core";
 import { z as z5 } from "zod";
 
 // src/operations.ts
-import { chmod as chmod3, lstat as lstat7, mkdir as mkdir4, open as open3 } from "node:fs/promises";
+import { chmod as chmod3, lstat as lstat7, mkdir as mkdir4, open as open4 } from "node:fs/promises";
 import path9 from "node:path";
 import {
   cancelAgentRun,
@@ -6094,19 +6228,12 @@ var openHarnessPersistence = async (config, options = {}) => {
   const databasePath = path9.join(config.stateDirectory, HARNESS_SQLITE_FILE);
   let databaseEntry;
   try {
+    const handle = await open4(databasePath, "wx", 384);
+    await handle.close();
     databaseEntry = await lstat7(databasePath);
   } catch (error) {
-    if (error.code !== "ENOENT") {
+    if (error.code !== "EEXIST")
       throw error;
-    }
-    try {
-      const handle = await open3(databasePath, "wx", 384);
-      await handle.close();
-    } catch (creationError) {
-      if (creationError.code !== "EEXIST") {
-        throw creationError;
-      }
-    }
     databaseEntry = await lstat7(databasePath);
   }
   if (databaseEntry.isSymbolicLink() || !databaseEntry.isFile()) {
@@ -6149,8 +6276,7 @@ var openHarnessPersistence = async (config, options = {}) => {
 
 // src/context-engineering.ts
 import { createHash as createHash9 } from "node:crypto";
-import { constants as fsConstants2 } from "node:fs";
-import { lstat as lstat8, open as open4, readdir as readdir3 } from "node:fs/promises";
+import { lstat as lstat8, readdir as readdir3 } from "node:fs/promises";
 import path10 from "node:path";
 import { z as z4 } from "zod";
 var HARNESS_CONTEXT_CONFIG_SCHEMA_VERSION = 1;
@@ -6229,7 +6355,6 @@ var validateRelativePath = (value) => {
   }
   return normalized;
 };
-var stableEntry = (before, after) => before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
 var resolveSafeWorkspaceEntry = async (workspace, relativePath, options = {}) => {
   const normalized = validateRelativePath(relativePath);
   const absolutePath = path10.resolve(workspace.root, normalized);
@@ -6241,6 +6366,9 @@ var resolveSafeWorkspaceEntry = async (workspace, relativePath, options = {}) =>
   const segments = normalized.split("/");
   for (let index = 0;index < segments.length; index += 1) {
     current = path10.join(current, segments[index]);
+    const leaf = index === segments.length - 1;
+    if (leaf && options.skipLeafValidation)
+      continue;
     let entry;
     try {
       entry = await lstat8(current);
@@ -6252,7 +6380,6 @@ var resolveSafeWorkspaceEntry = async (workspace, relativePath, options = {}) =>
     if (entry.isSymbolicLink()) {
       throw new Error(`The harness context path cannot contain a symbolic link: ${relativePath}`);
     }
-    const leaf = index === segments.length - 1;
     if (!leaf && !entry.isDirectory()) {
       throw new Error(`A harness context path ancestor is not a directory: ${relativePath}`);
     }
@@ -6266,42 +6393,39 @@ var resolveSafeWorkspaceEntry = async (workspace, relativePath, options = {}) =>
   return { path: absolutePath, relativePath: normalized };
 };
 var readStableWorkspaceText = async (workspace, relativePath, maxBytes, allowMissing = false) => {
-  const resolved = await resolveSafeWorkspaceEntry(workspace, relativePath, { allowMissing });
+  const resolved = await resolveSafeWorkspaceEntry(workspace, relativePath, {
+    allowMissing,
+    skipLeafValidation: true
+  });
   if (!resolved)
     return;
-  const before = await lstat8(resolved.path);
-  if (before.size > maxBytes) {
-    throw new Error(`Harness context file ${resolved.relativePath} exceeds the ${maxBytes}-byte limit.`);
+  let file;
+  try {
+    file = await readRegularFileNoFollow(resolved.path, {
+      label: `Harness context file ${resolved.relativePath}`,
+      maxBytes
+    });
+  } catch (error) {
+    if (allowMissing && error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  const { contents } = file;
+  if (contents.includes(0)) {
+    throw new Error(`Harness context file must be UTF-8 text: ${resolved.relativePath}`);
   }
-  const handle = await open4(resolved.path, fsConstants2.O_RDONLY | fsConstants2.O_NOFOLLOW);
+  let content;
   try {
-    const opened = await handle.stat();
-    if (!opened.isFile() || !stableEntry(before, opened)) {
-      throw new Error(`Harness context file changed while opening: ${resolved.relativePath}`);
-    }
-    const contents = await handle.readFile();
-    const after = await handle.stat();
-    if (!stableEntry(opened, after) || contents.byteLength !== after.size) {
-      throw new Error(`Harness context file changed while reading: ${resolved.relativePath}`);
-    }
-    if (contents.includes(0)) {
-      throw new Error(`Harness context file must be UTF-8 text: ${resolved.relativePath}`);
-    }
-    let content;
-    try {
-      content = new TextDecoder("utf-8", { fatal: true }).decode(contents);
-    } catch {
-      throw new Error(`Harness context file must be valid UTF-8: ${resolved.relativePath}`);
-    }
-    return {
-      path: resolved.relativePath,
-      digest: digestBytes2(contents),
-      bytes: contents.byteLength,
-      content
-    };
-  } finally {
-    await handle.close();
+    content = new TextDecoder("utf-8", { fatal: true }).decode(contents);
+  } catch {
+    throw new Error(`Harness context file must be valid UTF-8: ${resolved.relativePath}`);
   }
+  return {
+    path: resolved.relativePath,
+    digest: digestBytes2(contents),
+    bytes: contents.byteLength,
+    content
+  };
 };
 var parseConfiguration = (file) => {
   let document;
@@ -7797,6 +7921,43 @@ var timeToSafeFixDriverResultSchema = z6.strictObject({
     });
   }
 });
+var isApprovalDeniedFailure = (message) => message.includes("approval") && message.includes("denied") || message.includes("unsupported or attack-bearing");
+var isAsciiWordCharacter = (code) => code >= 48 && code <= 57 || code >= 97 && code <= 122 || code === 95;
+var isToolExecutionFailure = (message) => {
+  let sawToolOnLine = false;
+  let previousToken;
+  for (let index = 0;index < message.length; ) {
+    const code = message.charCodeAt(index);
+    if (code === 10 || code === 13) {
+      sawToolOnLine = false;
+      previousToken = undefined;
+      index += 1;
+      continue;
+    }
+    if (!isAsciiWordCharacter(code)) {
+      index += 1;
+      continue;
+    }
+    const start = index;
+    while (index < message.length && isAsciiWordCharacter(message.charCodeAt(index))) {
+      index += 1;
+    }
+    const length = index - start;
+    const isTerminal2 = length === 8 && message.startsWith("terminal", start);
+    const isTool = length === 4 && message.startsWith("tool", start);
+    const isExecution = length === 9 && message.startsWith("execution", start);
+    const isFailed = length === 6 && message.startsWith("failed", start);
+    if (isTool && previousToken === "terminal" || isExecution && previousToken === "tool") {
+      return true;
+    }
+    if (isFailed && sawToolOnLine)
+      return true;
+    if (isTool)
+      sawToolOnLine = true;
+    previousToken = isTerminal2 ? "terminal" : isTool ? "tool" : undefined;
+  }
+  return false;
+};
 var classifyTimeToSafeFixFailure = (error, options = {}) => {
   const message = error instanceof Error ? error.message : String(error ?? "");
   const normalized = message.toLowerCase();
@@ -7814,11 +7975,11 @@ var classifyTimeToSafeFixFailure = (error, options = {}) => {
     code = "PATCH_DRIFT";
   } else if (/verifier failed|verifier exited|exit code/.test(normalized)) {
     code = "VERIFIER_FAILED";
-  } else if (/approval.*denied|denied.*approval|unsupported or attack-bearing/.test(normalized)) {
+  } else if (isApprovalDeniedFailure(normalized)) {
     code = "APPROVAL_DENIED";
   } else if (/import/.test(normalized)) {
     code = "PATCH_IMPORT_FAILED";
-  } else if (/tool(?: ["']?.+["']?)? failed|tool execution|terminal tool/.test(normalized)) {
+  } else if (isToolExecutionFailure(normalized)) {
     code = "TOOL_EXECUTION_FAILED";
   } else if (/provider|model|generation|response/.test(normalized)) {
     code = "MODEL_EXECUTION_FAILED";