@zhivex-ai/harness 0.6.1 → 0.8.0

package/dist/index.js

@@ -1,12 +1,359 @@
 // @bun
 // src/config.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { realpathSync } from "fs";
 import path from "path";
+
+// src/providers.ts
+import { createHash } from "crypto";
+import { createGemini } from "@zhivex-ai/gemini";
 import { createMeta } from "@zhivex-ai/meta";
 import { createOpenAI } from "@zhivex-ai/openai";
 import { createQwen } from "@zhivex-ai/qwen";
-var PROVIDERS = ["meta", "qwen", "openai"];
+var PROVIDERS = ["meta", "qwen", "openai", "gemini"];
+var HARNESS_PROVIDER_CAPABILITIES = [
+  "streaming",
+  "tool-calling",
+  "approval-resume"
+];
+var QWEN_REGIONS = [
+  "singapore",
+  "beijing",
+  "hong-kong",
+  "tokyo",
+  "frankfurt",
+  "virginia"
+];
+var PROVIDER_ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+var ENVIRONMENT_VARIABLE = /^[A-Z_][A-Z0-9_]{0,127}$/;
+var DIAGNOSTIC_KEY = /^[a-z][A-Za-z0-9]{0,63}$/;
+var requiredText = (name, value) => {
+  const normalized = value.trim();
+  if (!normalized || /[\u0000-\u001f\u007f]/.test(normalized)) {
+    throw new Error(`${name} must be a non-empty printable string.`);
+  }
+  return normalized;
+};
+var environmentVariable = (name, value) => {
+  if (!ENVIRONMENT_VARIABLE.test(value)) {
+    throw new Error(`${name} must be a valid environment variable name.`);
+  }
+  return value;
+};
+var diagnosticKey = (value) => {
+  if (!DIAGNOSTIC_KEY.test(value)) {
+    throw new Error(`Invalid provider diagnostic key: ${value}.`);
+  }
+  return value;
+};
+var normalizedDescriptor = (descriptor) => {
+  const id = descriptor.id.trim().toLowerCase();
+  if (descriptor.id !== id || !PROVIDER_ID.test(id)) {
+    throw new Error(`Invalid provider id: ${descriptor.id}. Use 1-64 lowercase letters, digits, dot, underscore, or hyphen.`);
+  }
+  if (!(descriptor.support === "certified" || descriptor.support === "provisional")) {
+    throw new Error(`Invalid support level for provider ${id}.`);
+  }
+  const credentialNames = [...new Set(descriptor.credentialNames.map((name) => environmentVariable(`Credential for provider ${id}`, name)))];
+  const capabilities = [...new Set(descriptor.capabilities)];
+  const invalidCapability = capabilities.find((capability) => !HARNESS_PROVIDER_CAPABILITIES.includes(capability));
+  if (invalidCapability) {
+    throw new Error(`Invalid capability for provider ${id}: ${invalidCapability}.`);
+  }
+  return Object.freeze({
+    id,
+    name: requiredText(`Name for provider ${id}`, descriptor.name),
+    defaultModel: requiredText(`Default model for provider ${id}`, descriptor.defaultModel),
+    credentialNames: Object.freeze(credentialNames),
+    capabilities: Object.freeze(capabilities),
+    support: descriptor.support
+  });
+};
+var normalizedDiagnostics = (provider, diagnostics) => {
+  const endpointEnvironmentVariable = diagnostics?.endpointEnvironmentVariable === undefined ? undefined : environmentVariable(`Endpoint diagnostic for provider ${provider}`, diagnostics.endpointEnvironmentVariable);
+  const seenKeys = new Set;
+  const presence = (diagnostics?.presence ?? []).map((entry) => {
+    const key = diagnosticKey(entry.key);
+    if (seenKeys.has(key)) {
+      throw new Error(`Duplicate diagnostic key for provider ${provider}: ${key}.`);
+    }
+    seenKeys.add(key);
+    return Object.freeze({
+      key,
+      environmentVariable: environmentVariable(`Presence diagnostic for provider ${provider}`, entry.environmentVariable)
+    });
+  });
+  const enums = (diagnostics?.enums ?? []).map((entry) => {
+    const key = diagnosticKey(entry.key);
+    if (seenKeys.has(key)) {
+      throw new Error(`Duplicate diagnostic key for provider ${provider}: ${key}.`);
+    }
+    seenKeys.add(key);
+    const allowedValues = [...new Set(entry.allowedValues.map((value) => requiredText(`Allowed diagnostic value for provider ${provider}`, value)))];
+    if (allowedValues.length === 0) {
+      throw new Error(`Enum diagnostic ${key} for provider ${provider} needs allowed values.`);
+    }
+    return Object.freeze({
+      key,
+      environmentVariable: environmentVariable(`Enum diagnostic for provider ${provider}`, entry.environmentVariable),
+      allowedValues: Object.freeze(allowedValues)
+    });
+  });
+  return Object.freeze({
+    ...endpointEnvironmentVariable ? { endpointEnvironmentVariable } : {},
+    ...presence.length > 0 ? { presence: Object.freeze(presence) } : {},
+    ...enums.length > 0 ? { enums: Object.freeze(enums) } : {}
+  });
+};
+var endpointConfiguration = (value) => {
+  const configured = Boolean(value?.trim());
+  if (!configured) {
+    return {
+      customEndpoint: false,
+      endpointValid: true,
+      endpointSecure: true
+    };
+  }
+  try {
+    const endpoint = new URL(value.trim());
+    const supportedProtocol = endpoint.protocol === "https:" || endpoint.protocol === "http:";
+    return {
+      customEndpoint: true,
+      endpointValid: supportedProtocol && !endpoint.username && !endpoint.password && !endpoint.hash && !endpoint.search,
+      endpointSecure: endpoint.protocol === "https:"
+    };
+  } catch {
+    return {
+      customEndpoint: true,
+      endpointValid: false,
+      endpointSecure: false
+    };
+  }
+};
+var createCredentials = (env, provider, names) => Object.freeze({
+  names,
+  get: (name) => {
+    if (!names.includes(name)) {
+      throw new Error(`Credential ${name} is not declared for provider ${provider}.`);
+    }
+    return env[name]?.trim() || undefined;
+  },
+  first: () => {
+    for (const name of names) {
+      const value = env[name]?.trim();
+      if (value) {
+        return value;
+      }
+    }
+    return;
+  },
+  require: () => {
+    for (const name of names) {
+      const value = env[name]?.trim();
+      if (value) {
+        return value;
+      }
+    }
+    throw new Error(names.length === 0 ? `Provider ${provider} does not declare a credential.` : `Missing credentials for ${provider}. Set ${names.join(" or ")} in the environment.`);
+  }
+});
+var normalizeRegistration = (registration) => {
+  if (typeof registration.factory !== "function") {
+    throw new Error("Provider registration factory must be a function.");
+  }
+  const descriptor = normalizedDescriptor(registration.descriptor);
+  return Object.freeze({
+    descriptor,
+    factory: registration.factory,
+    diagnostics: normalizedDiagnostics(descriptor.id, registration.diagnostics)
+  });
+};
+var providerConfiguration = (diagnostics, env) => {
+  const configuration = endpointConfiguration(diagnostics.endpointEnvironmentVariable ? env[diagnostics.endpointEnvironmentVariable] : undefined);
+  for (const entry of diagnostics.presence ?? []) {
+    configuration[`${entry.key}Configured`] = Boolean(env[entry.environmentVariable]?.trim());
+  }
+  for (const entry of diagnostics.enums ?? []) {
+    const value = env[entry.environmentVariable]?.trim();
+    configuration[`${entry.key}Configured`] = Boolean(value);
+    configuration[`${entry.key}Valid`] = !value || entry.allowedValues.includes(value);
+  }
+  return Object.freeze(configuration);
+};
+var parseWithRegistrations = (value, registrations) => {
+  const defaultProvider = registrations.has("openai") ? "openai" : registrations.keys().next().value;
+  const normalized = (value ?? defaultProvider ?? "").trim().toLowerCase();
+  if (registrations.has(normalized)) {
+    return normalized;
+  }
+  throw new Error(`Unknown provider: ${value}. Use ${[...registrations.keys()].join(", ")}.`);
+};
+var createProviderRegistry = (registrations) => {
+  if (registrations.length === 0) {
+    throw new Error("Provider registry must contain at least one provider.");
+  }
+  const entries = new Map;
+  for (const registration of registrations) {
+    const normalized = normalizeRegistration(registration);
+    if (entries.has(normalized.descriptor.id)) {
+      throw new Error(`Duplicate provider registration: ${normalized.descriptor.id}.`);
+    }
+    entries.set(normalized.descriptor.id, normalized);
+  }
+  const frozenRegistrations = Object.freeze([...entries.values()]);
+  const descriptors = Object.freeze(frozenRegistrations.map((entry) => entry.descriptor));
+  const registry = Object.freeze({
+    descriptors,
+    has: (provider) => entries.has(provider.trim().toLowerCase()),
+    parse: (value) => parseWithRegistrations(value, entries),
+    descriptor: (provider) => {
+      const registration = entries.get(provider);
+      if (!registration) {
+        throw new Error(`No descriptor is available for provider ${provider}.`);
+      }
+      return registration.descriptor;
+    },
+    createModel: (config, env = process.env) => {
+      const registration = entries.get(config.provider);
+      if (!registration) {
+        throw new Error(`No factory is available for provider ${config.provider}.`);
+      }
+      return registration.factory(Object.freeze({
+        provider: config.provider,
+        model: config.model,
+        env,
+        credentials: createCredentials(env, config.provider, registration.descriptor.credentialNames)
+      }));
+    },
+    availability: (env = process.env) => Object.freeze(frozenRegistrations.map((registration) => {
+      const credentials = Object.freeze(registration.descriptor.credentialNames.map((name) => Object.freeze({ name, present: Boolean(env[name]?.trim()) })));
+      return Object.freeze({
+        ...registration.descriptor,
+        configured: credentials.length === 0 || credentials.some((credential) => credential.present),
+        credentials,
+        configuration: providerConfiguration(registration.diagnostics, env)
+      });
+    })),
+    transportFingerprint: (env = process.env) => {
+      const transport = frozenRegistrations.map((registration) => {
+        const names = [
+          registration.diagnostics.endpointEnvironmentVariable,
+          ...(registration.diagnostics.presence ?? []).map((entry) => entry.environmentVariable),
+          ...(registration.diagnostics.enums ?? []).map((entry) => entry.environmentVariable)
+        ].filter((name) => Boolean(name));
+        return {
+          provider: registration.descriptor.id,
+          values: names.map((name) => [name, env[name]?.trim() ?? ""])
+        };
+      });
+      return `sha256:${createHash("sha256").update(JSON.stringify(transport)).digest("hex")}`;
+    },
+    extend: (additional) => createProviderRegistry([
+      ...frozenRegistrations,
+      ...additional
+    ])
+  });
+  return registry;
+};
+var optionalQwenRegion = (value) => {
+  if (!value) {
+    return;
+  }
+  if (QWEN_REGIONS.includes(value)) {
+    return value;
+  }
+  throw new Error(`Invalid QWEN_REGION: ${value}.`);
+};
+var BUILTIN_PROVIDER_REGISTRATIONS = Object.freeze([
+  {
+    descriptor: {
+      id: "meta",
+      name: "Meta Model API",
+      defaultModel: "muse-spark-1.2",
+      credentialNames: ["MODEL_API_KEY"],
+      capabilities: HARNESS_PROVIDER_CAPABILITIES,
+      support: "certified"
+    },
+    diagnostics: { endpointEnvironmentVariable: "META_BASE_URL" },
+    factory: ({ model, env, credentials }) => {
+      const baseURL = env.META_BASE_URL?.trim();
+      return createMeta({
+        apiKey: credentials.require(),
+        ...baseURL ? { baseURL } : {}
+      })(model);
+    }
+  },
+  {
+    descriptor: {
+      id: "qwen",
+      name: "Qwen / Alibaba Cloud Model Studio",
+      defaultModel: "qwen3.8-max",
+      credentialNames: ["DASHSCOPE_API_KEY", "QWEN_API_KEY"],
+      capabilities: HARNESS_PROVIDER_CAPABILITIES,
+      support: "certified"
+    },
+    diagnostics: {
+      endpointEnvironmentVariable: "QWEN_BASE_URL",
+      presence: [{ key: "workspaceId", environmentVariable: "QWEN_WORKSPACE_ID" }],
+      enums: [{
+        key: "region",
+        environmentVariable: "QWEN_REGION",
+        allowedValues: QWEN_REGIONS
+      }]
+    },
+    factory: ({ model, env, credentials }) => {
+      const baseURL = env.QWEN_BASE_URL?.trim();
+      const workspaceId = env.QWEN_WORKSPACE_ID?.trim();
+      const region = optionalQwenRegion(env.QWEN_REGION?.trim());
+      return createQwen({
+        apiKey: credentials.require(),
+        ...baseURL ? { baseURL } : {},
+        ...workspaceId ? { workspaceId } : {},
+        ...region ? { region } : {}
+      })(model);
+    }
+  },
+  {
+    descriptor: {
+      id: "openai",
+      name: "OpenAI",
+      defaultModel: "gpt-5.6-luna",
+      credentialNames: ["OPENAI_API_KEY"],
+      capabilities: HARNESS_PROVIDER_CAPABILITIES,
+      support: "certified"
+    },
+    diagnostics: { endpointEnvironmentVariable: "OPENAI_BASE_URL" },
+    factory: ({ model, env, credentials }) => {
+      const baseURL = env.OPENAI_BASE_URL?.trim();
+      return createOpenAI({
+        apiKey: credentials.require(),
+        ...baseURL ? { baseURL } : {}
+      })(model);
+    }
+  },
+  {
+    descriptor: {
+      id: "gemini",
+      name: "Google Gemini",
+      defaultModel: "gemini-3.6-flash",
+      credentialNames: ["GEMINI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
+      capabilities: HARNESS_PROVIDER_CAPABILITIES,
+      support: "provisional"
+    },
+    diagnostics: { endpointEnvironmentVariable: "GEMINI_BASE_URL" },
+    factory: ({ model, env, credentials }) => {
+      const baseURL = env.GEMINI_BASE_URL?.trim();
+      return createGemini({
+        apiKey: credentials.require(),
+        ...baseURL ? { baseURL } : {}
+      })(model);
+    }
+  }
+]);
+var DEFAULT_PROVIDER_REGISTRY = createProviderRegistry(BUILTIN_PROVIDER_REGISTRATIONS);
+var PROVIDER_DESCRIPTORS = DEFAULT_PROVIDER_REGISTRY.descriptors;
+
+// src/config.ts
 var DEFAULT_ALLOWED_CHECKS = ["test", "typecheck", "lint", "build"];
 var HARNESS_CONFIG_SCHEMA_VERSION = 4;
 var HARNESS_STORE_BACKENDS = ["sqlite", "file"];
@@ -62,45 +409,6 @@ var DEFAULT_SUBAGENT_BUDGET = {
   maxTotalTokens: 36000,
   includeChildRuns: false
 };
-var HARNESS_PROVIDER_CAPABILITIES = [
-  "streaming",
-  "tool-calling",
-  "approval-resume"
-];
-var PROVIDER_DESCRIPTORS = [
-  {
-    id: "meta",
-    name: "Meta Model API",
-    defaultModel: "muse-spark-1.2",
-    credentialNames: ["MODEL_API_KEY"],
-    capabilities: HARNESS_PROVIDER_CAPABILITIES,
-    support: "certified"
-  },
-  {
-    id: "qwen",
-    name: "Qwen / Alibaba Cloud Model Studio",
-    defaultModel: "qwen3.8-max",
-    credentialNames: ["DASHSCOPE_API_KEY", "QWEN_API_KEY"],
-    capabilities: HARNESS_PROVIDER_CAPABILITIES,
-    support: "certified"
-  },
-  {
-    id: "openai",
-    name: "OpenAI",
-    defaultModel: "gpt-5.4",
-    credentialNames: ["OPENAI_API_KEY"],
-    capabilities: HARNESS_PROVIDER_CAPABILITIES,
-    support: "certified"
-  }
-];
-var QWEN_REGIONS = [
-  "singapore",
-  "beijing",
-  "hong-kong",
-  "tokyo",
-  "frankfurt",
-  "virginia"
-];
 var integerOption = (name, input, envValue, fallback, minimum, maximum) => {
   const value = input ?? (envValue === undefined ? fallback : Number(envValue));
   if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
@@ -129,7 +437,7 @@ var nonNegativeNumberOption = (name, input, envValue) => {
   }
   return value;
 };
-var defaultHarnessNamespace = (workspace) => `workspace-${createHash("sha256").update(workspace).digest("hex").slice(0, 16)}`;
+var defaultHarnessNamespace = (workspace) => `workspace-${createHash2("sha256").update(workspace).digest("hex").slice(0, 16)}`;
 var canonicalStateDirectory = (requestedWorkspace, canonicalWorkspace, configured) => {
   if (!configured) {
     return path.join(canonicalWorkspace, ".zhivex-harness", "runs");
@@ -231,26 +539,14 @@ var canonicalWorkspaceFile = (requestedWorkspace, canonicalWorkspace, configured
   const insideRequestedWorkspace = relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
   return insideRequestedWorkspace ? path.resolve(canonicalWorkspace, relative) : requestedPath;
 };
-var parseProvider = (value) => {
-  const normalized = (value ?? "openai").trim().toLowerCase();
-  if (PROVIDERS.includes(normalized)) {
-    return normalized;
-  }
-  throw new Error(`Unknown provider: ${value}. Use meta, qwen, or openai.`);
-};
-var providerDescriptor = (provider) => {
-  const descriptor = PROVIDER_DESCRIPTORS.find((entry) => entry.id === provider);
-  if (!descriptor) {
-    throw new Error(`No descriptor is available for provider ${provider}.`);
-  }
-  return descriptor;
-};
-var resolveHarnessConfig = (input = {}) => {
+var parseProvider = (value, registry = DEFAULT_PROVIDER_REGISTRY) => registry.parse(value);
+var providerDescriptor = (provider, registry = DEFAULT_PROVIDER_REGISTRY) => registry.descriptor(provider);
+var resolveHarnessConfig = (input = {}, registry = DEFAULT_PROVIDER_REGISTRY) => {
   if (input.schemaVersion !== undefined && input.schemaVersion !== HARNESS_CONFIG_SCHEMA_VERSION) {
     throw new Error(`Unsupported config schema version: ${input.schemaVersion}. Expected ${HARNESS_CONFIG_SCHEMA_VERSION}.`);
   }
-  const provider = parseProvider(input.provider ?? process.env.ZHIVEX_HARNESS_PROVIDER);
-  const descriptor = providerDescriptor(provider);
+  const provider = parseProvider(input.provider ?? process.env.ZHIVEX_HARNESS_PROVIDER, registry);
+  const descriptor = providerDescriptor(provider, registry);
   const requestedWorkspace = path.resolve(input.workspace ?? process.cwd());
   let workspace = requestedWorkspace;
   try {
@@ -344,121 +640,896 @@ var resolveHarnessConfig = (input = {}) => {
     ...mcpConfigPath ? { mcpConfigPath } : {}
   };
 };
-var requiredCredential = (env, provider, names) => {
-  for (const name of names) {
-    const value = env[name]?.trim();
-    if (value) {
-      return value;
+var createProviderModel = (config, env = process.env, registry = DEFAULT_PROVIDER_REGISTRY) => registry.createModel(config, env);
+var providerAvailability = (env = process.env, registry = DEFAULT_PROVIDER_REGISTRY) => registry.availability(env);
+// src/routing.ts
+var routeError = (value) => new Error(`Invalid route: ${value}. Use <profile>=<provider>[:<model>].`);
+var parseHarnessModelRoute = (value, registry = DEFAULT_PROVIDER_REGISTRY) => {
+  const separator = value.indexOf("=");
+  if (separator <= 0 || separator === value.length - 1) {
+    throw routeError(value);
+  }
+  const profile = value.slice(0, separator).trim().toLowerCase();
+  if (!HARNESS_SUBAGENT_PROFILES.includes(profile)) {
+    throw routeError(value);
+  }
+  const target = value.slice(separator + 1).trim();
+  const modelSeparator = target.indexOf(":");
+  const providerInput = (modelSeparator === -1 ? target : target.slice(0, modelSeparator)).trim();
+  const provider = registry.parse(providerInput);
+  const configuredModel = modelSeparator === -1 ? "" : target.slice(modelSeparator + 1).trim();
+  if (modelSeparator !== -1 && !configuredModel) {
+    throw routeError(value);
+  }
+  const model = configuredModel || registry.descriptor(provider).defaultModel;
+  if (/[\u0000-\u001f\u007f]/.test(model) || model.length > 256) {
+    throw routeError(value);
+  }
+  return Object.freeze({
+    profile,
+    provider,
+    model
+  });
+};
+var resolveHarnessModelRoutes = (values = [], registry = DEFAULT_PROVIDER_REGISTRY) => {
+  const routes = new Map;
+  for (const value of values) {
+    const route = parseHarnessModelRoute(value, registry);
+    if (routes.has(route.profile)) {
+      throw new Error(`Duplicate model route for ${route.profile}.`);
     }
+    routes.set(route.profile, route);
   }
-  throw new Error(`Missing credentials for ${provider}. Set ${names.join(" or ")} in the environment.`);
+  return routes;
 };
-var optionalQwenRegion = (value) => {
-  if (!value) {
-    return;
+var createHarnessRouteModels = (routes, env = process.env, registry = DEFAULT_PROVIDER_REGISTRY) => Object.fromEntries([...routes].map(([profile, route]) => [
+  profile,
+  registry.createModel(route, env)
+]));
+var serializeHarnessModelRoutes = (routes) => Object.fromEntries([...routes].map(([profile, route]) => [
+  profile,
+  { provider: route.provider, model: route.model }
+]));
+// src/cli-stream.ts
+var CLI_JSON_SCHEMA_VERSION = 1;
+var CLI_EVENT_SCHEMA_VERSION = 1;
+var streamEventDocument = (event, sequence = 0) => {
+  if (!Number.isSafeInteger(sequence) || sequence < 0) {
+    throw new Error("JSONL event sequence must be a non-negative integer.");
+  }
+  const base = {
+    schemaVersion: CLI_EVENT_SCHEMA_VERSION,
+    kind: "run-event",
+    sequence,
+    type: event.type
+  };
+  switch (event.type) {
+    case "text-delta":
+      return { ...base, textDelta: event.textDelta };
+    case "tool-call":
+      return { ...base, toolCallId: event.toolCall.id, toolName: event.toolCall.name };
+    case "tool-result":
+      return {
+        ...base,
+        toolCallId: event.toolResult.toolCallId,
+        toolName: event.toolResult.toolName,
+        isError: event.toolResult.isError
+      };
+    case "tool-approval-request":
+    case "agent-approval-request":
+      return {
+        ...base,
+        approvalRequestId: event.approval.id,
+        approvalKind: event.approval.kind ?? "provider",
+        toolName: event.approval.name
+      };
+    case "agent-approval-resolved":
+      return {
+        ...base,
+        approvalRequestId: event.approval.approvalRequestId,
+        approved: event.approval.approve
+      };
+    case "provider-data":
+      return { ...base, provider: event.provider };
+    case "image-generation":
+      return {
+        ...base,
+        provider: event.provider,
+        partial: event.partial,
+        ...event.id ? { id: event.id } : {},
+        ...event.index !== undefined ? { index: event.index } : {}
+      };
+    case "finish":
+      return {
+        ...base,
+        ...event.finishReason ? { finishReason: event.finishReason } : {},
+        ...event.usage ? { usage: event.usage } : {}
+      };
+    case "error":
+      return { ...base, error: "Provider stream failed." };
+    case "agent-run-start":
+      return { ...base, currentStep: event.currentStep, maxSteps: event.maxSteps };
+    case "agent-step-start":
+      return { ...base, stepIndex: event.stepIndex };
+    case "agent-step-finish":
+      return {
+        ...base,
+        stepIndex: event.step.index,
+        status: event.step.status,
+        toolCalls: event.step.toolResults.length
+      };
+    case "agent-compaction":
+      return {
+        ...base,
+        compactionId: event.compaction.id,
+        reasons: event.compaction.reasons,
+        messageCountBefore: event.compaction.messageCountBefore,
+        messageCountAfter: event.compaction.messageCountAfter
+      };
+    case "agent-run-finish":
+      return {
+        ...base,
+        runId: event.state.runId,
+        status: event.status,
+        provider: event.state.provider,
+        model: event.state.modelId
+      };
   }
-  if (QWEN_REGIONS.includes(value)) {
-    return value;
+};
+var serializeStreamEvent = (event, sequence = 0) => JSON.stringify(streamEventDocument(event, sequence));
+var streamResultDocument = (result, sequence = 0) => {
+  if (!Number.isSafeInteger(sequence) || sequence < 0) {
+    throw new Error("JSONL result sequence must be a non-negative integer.");
   }
-  throw new Error(`Invalid QWEN_REGION: ${value}.`);
+  return {
+    schemaVersion: CLI_EVENT_SCHEMA_VERSION,
+    kind: "run-result",
+    sequence,
+    runId: result.runId,
+    status: result.status,
+    provider: result.provider,
+    model: result.model,
+    steps: result.steps,
+    toolCalls: result.toolCalls,
+    pendingApprovals: (result.pendingApprovals ?? []).map((approval) => ({
+      id: approval.id,
+      kind: approval.kind,
+      name: approval.name,
+      ...approval.childRunId ? { childRunId: approval.childRunId } : {},
+      ...approval.childAgentId ? { childAgentId: approval.childAgentId } : {}
+    })),
+    children: (result.children ?? []).map((child) => ({
+      runId: child.runId,
+      status: child.status
+    }))
+  };
 };
-var createProviderModel = (config, env = process.env) => {
-  switch (config.provider) {
-    case "meta": {
-      const baseURL = env.META_BASE_URL?.trim();
-      const provider = createMeta({
-        apiKey: requiredCredential(env, "meta", ["MODEL_API_KEY"]),
-        ...baseURL ? { baseURL } : {}
-      });
-      return provider(config.model);
-    }
-    case "qwen": {
-      const baseURL = env.QWEN_BASE_URL?.trim();
-      const workspaceId = env.QWEN_WORKSPACE_ID?.trim();
-      const region = optionalQwenRegion(env.QWEN_REGION?.trim());
-      const provider = createQwen({
-        apiKey: requiredCredential(env, "qwen", ["DASHSCOPE_API_KEY", "QWEN_API_KEY"]),
-        ...baseURL ? { baseURL } : {},
-        ...workspaceId ? { workspaceId } : {},
-        ...region ? { region } : {}
-      });
-      return provider(config.model);
+var serializeStreamResult = (result, sequence = 0) => JSON.stringify(streamResultDocument(result, sequence));
+// src/sessions.ts
+import { createHash as createHash3, randomUUID } from "crypto";
+import { chmod, lstat as lstat2, mkdir, open, realpath, stat } from "fs/promises";
+import path3 from "path";
+import { createRedactionPolicy } from "@zhivex-ai/agents";
+import { Database } from "bun:sqlite";
+
+// src/state-directory.ts
+import { lstat } from "fs/promises";
+import path2 from "path";
+var SENSITIVE_STATE_SEGMENTS = new Set([".git", ".env", ".npmrc", "dist", "node_modules", "src"]);
+var isInside = (root, candidate) => {
+  const relative = path2.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path2.sep}`) && relative !== ".." && !path2.isAbsolute(relative);
+};
+var validateStateDirectory = async (workspace, stateDirectory) => {
+  if (stateDirectory === workspace || stateDirectory === path2.parse(stateDirectory).root) {
+    throw new Error("The state directory cannot be the workspace or filesystem root.");
+  }
+  const insideWorkspace = isInside(workspace, stateDirectory);
+  const relativeSegments = insideWorkspace ? path2.relative(workspace, stateDirectory).split(path2.sep).filter(Boolean) : stateDirectory.slice(path2.parse(stateDirectory).root.length).split(path2.sep).filter(Boolean);
+  const sensitiveSegment = insideWorkspace ? relativeSegments.find((segment) => SENSITIVE_STATE_SEGMENTS.has(segment)) : undefined;
+  if (sensitiveSegment) {
+    throw new Error(`The state directory is inside the protected workspace path: ${sensitiveSegment}.`);
+  }
+  if (!insideWorkspace) {
+    try {
+      const externalEntry = await lstat(stateDirectory);
+      if (externalEntry.isSymbolicLink()) {
+        throw new Error(`The state directory must not be a symbolic link: ${stateDirectory}.`);
+      }
+      if (!externalEntry.isDirectory()) {
+        throw new Error(`The state directory is not a directory: ${stateDirectory}.`);
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
     }
-    case "openai": {
-      const baseURL = env.OPENAI_BASE_URL?.trim();
-      const provider = createOpenAI({
-        apiKey: requiredCredential(env, "openai", ["OPENAI_API_KEY"]),
-        ...baseURL ? { baseURL } : {}
-      });
-      return provider(config.model);
+    return;
+  }
+  let current = workspace;
+  for (const segment of relativeSegments) {
+    current = path2.join(current, segment);
+    try {
+      const entry = await lstat(current);
+      if (entry.isSymbolicLink()) {
+        throw new Error(`The state directory must not resolve through a symbolic link: ${current}.`);
+      }
+      if (!entry.isDirectory()) {
+        throw new Error(`The state directory path contains a non-directory entry: ${current}.`);
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        break;
+      }
+      throw error;
     }
   }
 };
-var endpointConfiguration = (value) => {
-  const configured = Boolean(value?.trim());
-  if (!configured) {
-    return {
-      customEndpoint: false,
-      endpointValid: true,
-      endpointSecure: true
-    };
+
+// src/sessions.ts
+var HARNESS_SESSION_INDEX_FILE = "operations.sqlite";
+var HARNESS_SESSION_SCHEMA_VERSION = 1;
+var SESSION_RUN_STATUSES = [
+  "created",
+  "running",
+  "waiting_approval",
+  "cancel_requested",
+  "completed",
+  "failed",
+  "cancelled",
+  "timed_out"
+];
+var TERMINAL_SESSION_RUN_STATUSES = [
+  "completed",
+  "failed",
+  "cancelled",
+  "timed_out"
+];
+var DEFAULT_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
+var DEFAULT_MAX_SESSIONS = 200;
+var DEFAULT_MAX_RUNS = 1000;
+var DEFAULT_MAX_METADATA_BYTES = 4096;
+var DEFAULT_MAX_INDEX_BYTES = 16 * 1024 * 1024;
+var MAX_LIST_LIMIT = 200;
+var ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:@/+\-]{0,255}$/;
+var TERMINAL_STATUSES = new Set(TERMINAL_SESSION_RUN_STATUSES);
+var ACTIVE_STATUSES = new Set([
+  "created",
+  "running",
+  "waiting_approval",
+  "cancel_requested"
+]);
+var STATUS_TRANSITIONS = {
+  created: new Set(["created", "running", "waiting_approval", "completed", "failed", "cancelled", "timed_out"]),
+  running: new Set(["running", "waiting_approval", "cancel_requested", "completed", "failed", "cancelled", "timed_out"]),
+  waiting_approval: new Set(["waiting_approval", "running", "cancel_requested", "completed", "failed", "cancelled", "timed_out"]),
+  cancel_requested: new Set(["cancel_requested", "cancelled", "failed", "timed_out"]),
+  completed: new Set(["completed"]),
+  failed: new Set(["failed"]),
+  cancelled: new Set(["cancelled"]),
+  timed_out: new Set(["timed_out"])
+};
+var metadataRedaction = createRedactionPolicy({
+  includeEmails: true,
+  rules: [
+    { name: "private-key", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g },
+    { name: "common-provider-key", pattern: /\b(?:sk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{8,}\b/gi },
+    { name: "url-credentials", pattern: /:\/\/[^\s/@:]+:[^\s/@]+@/g, replacement: "://[REDACTED]@" }
+  ]
+});
+var byteLength = (value) => Buffer.byteLength(value, "utf8");
+var boundedInteger = (name, value, fallback, minimum) => {
+  const resolved = value ?? fallback;
+  if (!Number.isSafeInteger(resolved) || resolved < minimum) {
+    throw new Error(`${name} must be an integer greater than or equal to ${minimum}.`);
   }
+  return resolved;
+};
+var assertTimestamp = (name, value) => {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`${name} must be a non-negative integer timestamp.`);
+  }
+};
+var assertIdentifier = (name, value) => {
+  if (!ID_PATTERN.test(value)) {
+    throw new Error(`${name} contains unsupported characters or exceeds 256 bytes.`);
+  }
+  if (metadataRedaction.redactText(value) !== value) {
+    throw new Error(`${name} resembles sensitive metadata and cannot be stored in the session index.`);
+  }
+  return value;
+};
+var assertScopeSegment = (name, value) => {
+  const normalized = value.trim();
+  if (!normalized || normalized.length > 128 || /[\u0000-\u001f\u007f]/.test(normalized)) {
+    throw new Error(`${name} must contain 1-128 printable characters.`);
+  }
+  return normalized;
+};
+var normalizeTitle = (value, maxMetadataBytes) => {
+  if (value === undefined || value === null) {
+    return value;
+  }
+  const normalized = metadataRedaction.redactText(value).replace(/[\u0000-\u001f\u007f]+/g, " ").trim();
+  if (!normalized) {
+    throw new Error("Session title must not be empty.");
+  }
+  if (byteLength(normalized) > maxMetadataBytes) {
+    throw new Error(`Session title exceeds the ${maxMetadataBytes}-byte metadata limit.`);
+  }
+  return normalized;
+};
+var normalizeScope = (scope) => {
+  const tenantId = assertScopeSegment("scope.tenantId", scope.tenantId);
+  const userId = scope.userId === undefined ? "" : assertScopeSegment("scope.userId", scope.userId);
+  const namespace = scope.namespace === undefined ? "" : assertScopeSegment("scope.namespace", scope.namespace);
+  return `${tenantId}\x00${userId}\x00${namespace}`;
+};
+var stableKey = (kind, value) => createHash3("sha256").update(kind).update("\x00").update(value).digest("hex");
+var sessionId = () => `ses_${randomUUID()}`;
+var turnId = () => `turn_${randomUUID()}`;
+var isMissing = (error) => error.code === "ENOENT";
+var ensurePrivateDatabase = async (workspace, stateDirectory) => {
+  const requestedStateDirectory = path3.resolve(stateDirectory);
+  await validateStateDirectory(workspace, requestedStateDirectory);
+  await mkdir(requestedStateDirectory, { recursive: true, mode: 448 });
+  const directoryEntry = await lstat2(requestedStateDirectory);
+  if (directoryEntry.isSymbolicLink() || !directoryEntry.isDirectory()) {
+    throw new Error(`The session state directory must be a real directory: ${requestedStateDirectory}.`);
+  }
+  await chmod(requestedStateDirectory, 448);
+  const canonicalStateDirectory2 = await realpath(requestedStateDirectory);
+  const databasePath = path3.join(canonicalStateDirectory2, HARNESS_SESSION_INDEX_FILE);
+  let databaseEntry;
   try {
-    const endpoint = new URL(value.trim());
-    const supportedProtocol = endpoint.protocol === "https:" || endpoint.protocol === "http:";
-    return {
-      customEndpoint: true,
-      endpointValid: supportedProtocol && !endpoint.username && !endpoint.password && !endpoint.hash,
-      endpointSecure: endpoint.protocol === "https:"
-    };
-  } catch {
-    return {
-      customEndpoint: true,
-      endpointValid: false,
-      endpointSecure: false
-    };
+    databaseEntry = await lstat2(databasePath);
+  } catch (error) {
+    if (!isMissing(error)) {
+      throw error;
+    }
+    try {
+      const handle = await open(databasePath, "wx", 384);
+      await handle.close();
+    } catch (creationError) {
+      if (creationError.code !== "EEXIST") {
+        throw creationError;
+      }
+    }
+    databaseEntry = await lstat2(databasePath);
+  }
+  if (databaseEntry.isSymbolicLink() || !databaseEntry.isFile()) {
+    throw new Error(`The session SQLite path must be a real file: ${databasePath}.`);
   }
+  await chmod(databasePath, 384);
+  return { databasePath, databaseEntry };
 };
-var providerAvailability = (env = process.env) => PROVIDER_DESCRIPTORS.map((descriptor) => {
-  const credentials = descriptor.credentialNames.map((name) => ({
-    name,
-    present: Boolean(env[name]?.trim())
-  }));
-  const endpointVariable = descriptor.id === "meta" ? "META_BASE_URL" : descriptor.id === "qwen" ? "QWEN_BASE_URL" : "OPENAI_BASE_URL";
-  const regionValue = descriptor.id === "qwen" ? env.QWEN_REGION?.trim() : undefined;
-  return {
-    ...descriptor,
-    configured: credentials.some((credential) => credential.present),
-    credentials,
-    configuration: {
-      ...endpointConfiguration(env[endpointVariable]),
-      ...descriptor.id === "qwen" ? {
-        workspaceIdConfigured: Boolean(env.QWEN_WORKSPACE_ID?.trim()),
-        regionConfigured: Boolean(regionValue),
-        regionValid: !regionValue || QWEN_REGIONS.includes(regionValue)
-      } : {}
+var toRunReference = (row) => ({
+  turnId: row.turn_id,
+  ...row.source_turn_id ? { sourceTurnId: row.source_turn_id } : {},
+  sequence: row.ordinal,
+  runId: row.run_id,
+  provider: row.provider,
+  model: row.model,
+  ...row.role ? { role: row.role } : {},
+  status: row.status,
+  createdAt: row.created_at,
+  updatedAt: row.updated_at,
+  ...row.completed_at === null ? {} : { completedAt: row.completed_at }
+});
+var metadataSize = (input) => Object.values(input).reduce((total, value) => total + (typeof value === "string" ? byteLength(value) : 0), 0);
+var isTerminal = (status) => TERMINAL_STATUSES.has(status);
+var openCliSessionStore = async (options) => {
+  const workspace = await realpath(path3.resolve(options.workspace));
+  const workspaceEntry = await stat(workspace);
+  if (!workspaceEntry.isDirectory()) {
+    throw new Error(`The session workspace is not a directory: ${workspace}.`);
+  }
+  const scopeValue2 = normalizeScope(options.scope);
+  const workspaceKey = stableKey("workspace", workspace);
+  const scopeKey = stableKey("scope", scopeValue2);
+  const retentionMs = boundedInteger("retentionMs", options.retentionMs, DEFAULT_RETENTION_MS, 0);
+  const maxSessions = boundedInteger("maxSessionsPerWorkspace", options.maxSessionsPerWorkspace, DEFAULT_MAX_SESSIONS, 1);
+  const maxRuns = boundedInteger("maxRunsPerSession", options.maxRunsPerSession, DEFAULT_MAX_RUNS, 1);
+  const maxMetadataBytes = boundedInteger("maxMetadataBytes", options.maxMetadataBytes, DEFAULT_MAX_METADATA_BYTES, 32);
+  const maxIndexBytes = boundedInteger("maxIndexBytes", options.maxIndexBytes, DEFAULT_MAX_INDEX_BYTES, 1024);
+  const now = options.now ?? Date.now;
+  const { databasePath, databaseEntry } = await ensurePrivateDatabase(workspace, options.stateDirectory);
+  const database = new Database(databasePath, { create: false, strict: true });
+  let closed = false;
+  const assertOpen = () => {
+    if (closed) {
+      throw new Error("The CLI session store is closed.");
     }
   };
-});
+  const transaction = (operation) => {
+    assertOpen();
+    database.exec("BEGIN IMMEDIATE");
+    try {
+      const result = operation();
+      const size = database.query(`
+        SELECT
+          COALESCE((SELECT SUM(metadata_bytes) FROM zhivex_cli_sessions WHERE workspace_key = ?1 AND scope_key = ?2), 0) +
+          COALESCE((SELECT SUM(r.metadata_bytes) FROM zhivex_cli_session_runs r JOIN zhivex_cli_sessions s ON s.session_id = r.session_id WHERE s.workspace_key = ?1 AND s.scope_key = ?2), 0)
+          AS size
+      `).get(workspaceKey, scopeKey)?.size ?? 0;
+      if (size > maxIndexBytes) {
+        throw new Error(`Session index metadata exceeds the ${maxIndexBytes}-byte limit.`);
+      }
+      database.exec("COMMIT");
+      return result;
+    } catch (error) {
+      try {
+        database.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  };
+  const ensureRevision = (row, expected) => {
+    if (expected !== undefined && row.revision !== expected) {
+      throw new Error(`Session ${row.session_id} changed concurrently (expected revision ${expected}, found ${row.revision}).`);
+    }
+  };
+  const selectSessionRow = (candidateSessionId, includeDeleted = false) => {
+    assertIdentifier("sessionId", candidateSessionId);
+    return database.query(`
+      SELECT session_id, title, parent_session_id, forked_from_turn_id, revision, activity_seq,
+             created_at, updated_at, archived_at, deleted_at
+      FROM zhivex_cli_sessions
+      WHERE session_id = ?1 AND workspace_key = ?2 AND scope_key = ?3
+      ${includeDeleted ? "" : "AND deleted_at IS NULL"}
+    `).get(candidateSessionId, workspaceKey, scopeKey);
+  };
+  const requireSessionRow = (candidateSessionId, includeDeleted = false) => {
+    const row = selectSessionRow(candidateSessionId, includeDeleted);
+    if (!row) {
+      throw new Error(`Session ${candidateSessionId} was not found in this workspace and scope.`);
+    }
+    return row;
+  };
+  const selectRuns = (candidateSessionId) => database.query(`
+    SELECT turn_id, source_turn_id, ordinal, run_id, provider, model, role, status,
+           created_at, updated_at, completed_at
+    FROM zhivex_cli_session_runs
+    WHERE session_id = ?1
+    ORDER BY ordinal ASC
+  `).all(candidateSessionId).map(toRunReference);
+  const nextActivitySequence = () => database.query(`
+    SELECT COALESCE(MAX(activity_seq), 0) + 1 AS count
+    FROM zhivex_cli_sessions
+    WHERE workspace_key = ?1 AND scope_key = ?2
+  `).get(workspaceKey, scopeKey)?.count ?? 1;
+  const sessionBase = (row) => ({
+    schemaVersion: HARNESS_SESSION_SCHEMA_VERSION,
+    sessionId: row.session_id,
+    workspaceKey,
+    scopeKey,
+    ...row.title ? { title: row.title } : {},
+    ...row.parent_session_id ? { parentSessionId: row.parent_session_id } : {},
+    ...row.forked_from_turn_id ? { forkedFromTurnId: row.forked_from_turn_id } : {},
+    revision: row.revision,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    ...row.archived_at === null ? {} : { archivedAt: row.archived_at },
+    ...row.deleted_at === null ? {} : { deletedAt: row.deleted_at }
+  });
+  const hydrate = (row) => ({
+    ...sessionBase(row),
+    runs: selectRuns(row.session_id)
+  });
+  const latestRunRow = (candidateSessionId) => database.query(`
+    SELECT turn_id, source_turn_id, ordinal, run_id, provider, model, role, status,
+           created_at, updated_at, completed_at
+    FROM zhivex_cli_session_runs
+    WHERE session_id = ?1
+    ORDER BY ordinal DESC
+    LIMIT 1
+  `).get(candidateSessionId);
+  const assertNoActiveRun = (candidateSessionId, action) => {
+    const latest = latestRunRow(candidateSessionId);
+    if (latest && ACTIVE_STATUSES.has(latest.status)) {
+      throw new Error(`Cannot ${action} session ${candidateSessionId} while run ${latest.run_id} is ${latest.status}.`);
+    }
+  };
+  const insertRun = (candidateSessionId, input, sequence, sourceTurnId) => {
+    const runId = assertIdentifier("runId", input.runId);
+    const provider = assertIdentifier("provider", input.provider);
+    const model = assertIdentifier("model", input.model);
+    const role = input.role === undefined ? null : assertIdentifier("role", input.role);
+    const status = input.status ?? "created";
+    if (!SESSION_RUN_STATUSES.includes(status)) {
+      throw new Error(`Unsupported session run status: ${String(status)}.`);
+    }
+    const createdAt = input.createdAt ?? now();
+    assertTimestamp("createdAt", createdAt);
+    const entryBytes = metadataSize({ runId, provider, model, role });
+    if (entryBytes > maxMetadataBytes) {
+      throw new Error(`Run reference metadata exceeds the ${maxMetadataBytes}-byte limit.`);
+    }
+    const candidateTurnId = turnId();
+    database.query(`
+      INSERT INTO zhivex_cli_session_runs (
+        turn_id, source_turn_id, session_id, ordinal, run_id, provider, model, role,
+        status, created_at, updated_at, completed_at, metadata_bytes
+      ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?10, ?11, ?12)
+    `).run(candidateTurnId, sourceTurnId ?? null, candidateSessionId, sequence, runId, provider, model, role, status, createdAt, isTerminal(status) ? createdAt : null, entryBytes);
+  };
+  try {
+    const openedEntry = await lstat2(databasePath);
+    if (openedEntry.isSymbolicLink() || !openedEntry.isFile() || openedEntry.dev !== databaseEntry.dev || openedEntry.ino !== databaseEntry.ino) {
+      throw new Error(`The session SQLite path changed while it was being opened: ${databasePath}.`);
+    }
+    database.exec("PRAGMA journal_mode = WAL");
+    database.exec("PRAGMA busy_timeout = 5000");
+    database.exec("PRAGMA foreign_keys = ON");
+    database.exec(`
+      CREATE TABLE IF NOT EXISTS zhivex_cli_session_schema (
+        singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+        version INTEGER NOT NULL
+      );
+      INSERT OR IGNORE INTO zhivex_cli_session_schema (singleton, version)
+      VALUES (1, ${HARNESS_SESSION_SCHEMA_VERSION});
+      CREATE TABLE IF NOT EXISTS zhivex_cli_sessions (
+        session_id TEXT PRIMARY KEY,
+        workspace_key TEXT NOT NULL,
+        scope_key TEXT NOT NULL,
+        title TEXT,
+        parent_session_id TEXT,
+        forked_from_turn_id TEXT,
+        revision INTEGER NOT NULL DEFAULT 0,
+        activity_seq INTEGER NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        archived_at INTEGER,
+        deleted_at INTEGER,
+        metadata_bytes INTEGER NOT NULL,
+        CHECK (length(session_id) <= 260),
+        CHECK (metadata_bytes >= 0)
+      );
+      CREATE INDEX IF NOT EXISTS zhivex_cli_sessions_latest
+        ON zhivex_cli_sessions (workspace_key, scope_key, deleted_at, archived_at, activity_seq DESC);
+      CREATE TABLE IF NOT EXISTS zhivex_cli_session_runs (
+        turn_id TEXT PRIMARY KEY,
+        source_turn_id TEXT,
+        session_id TEXT NOT NULL REFERENCES zhivex_cli_sessions(session_id) ON DELETE CASCADE,
+        ordinal INTEGER NOT NULL,
+        run_id TEXT NOT NULL,
+        provider TEXT NOT NULL,
+        model TEXT NOT NULL,
+        role TEXT,
+        status TEXT NOT NULL CHECK (status IN ('created', 'running', 'waiting_approval', 'cancel_requested', 'completed', 'failed', 'cancelled', 'timed_out')),
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        completed_at INTEGER,
+        metadata_bytes INTEGER NOT NULL,
+        UNIQUE (session_id, ordinal),
+        UNIQUE (session_id, run_id),
+        CHECK (ordinal >= 0),
+        CHECK (metadata_bytes >= 0)
+      );
+      CREATE INDEX IF NOT EXISTS zhivex_cli_session_runs_latest
+        ON zhivex_cli_session_runs (session_id, ordinal DESC);
+    `);
+    const schemaVersion = database.query("SELECT version FROM zhivex_cli_session_schema WHERE singleton = 1").get()?.version;
+    if (schemaVersion !== HARNESS_SESSION_SCHEMA_VERSION) {
+      throw new Error(`Unsupported CLI session schema version: ${String(schemaVersion)}.`);
+    }
+    await chmod(databasePath, 384);
+  } catch (error) {
+    database.close(false);
+    throw error;
+  }
+  const prune = async (input = {}) => transaction(() => {
+    const before = input.before ?? Math.max(0, now() - retentionMs);
+    assertTimestamp("before", before);
+    const deletedSessions = database.query(`
+      SELECT COUNT(*) AS count FROM zhivex_cli_sessions
+      WHERE workspace_key = ?1 AND scope_key = ?2
+        AND updated_at < ?3
+        AND (archived_at IS NOT NULL OR deleted_at IS NOT NULL)
+    `).get(workspaceKey, scopeKey, before)?.count ?? 0;
+    database.query(`
+      DELETE FROM zhivex_cli_sessions
+      WHERE workspace_key = ?1 AND scope_key = ?2
+        AND updated_at < ?3
+        AND (archived_at IS NOT NULL OR deleted_at IS NOT NULL)
+    `).run(workspaceKey, scopeKey, before);
+    return { before, deletedSessions };
+  });
+  const store = {
+    databasePath,
+    workspaceKey,
+    scopeKey,
+    async create(input = {}) {
+      return transaction(() => {
+        const cutoff = Math.max(0, now() - retentionMs);
+        database.query(`
+          DELETE FROM zhivex_cli_sessions
+          WHERE workspace_key = ?1 AND scope_key = ?2 AND updated_at < ?3
+            AND (archived_at IS NOT NULL OR deleted_at IS NOT NULL)
+        `).run(workspaceKey, scopeKey, cutoff);
+        const count = database.query(`
+          SELECT COUNT(*) AS count FROM zhivex_cli_sessions
+          WHERE workspace_key = ?1 AND scope_key = ?2
+        `).get(workspaceKey, scopeKey)?.count ?? 0;
+        if (count >= maxSessions) {
+          throw new Error(`Session limit reached for this workspace and scope (${maxSessions}). Archive and prune an older session.`);
+        }
+        const createdAt = now();
+        assertTimestamp("now", createdAt);
+        const title = normalizeTitle(input.title, maxMetadataBytes) ?? null;
+        const candidateSessionId = sessionId();
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          INSERT INTO zhivex_cli_sessions (
+            session_id, workspace_key, scope_key, title, revision, created_at,
+            updated_at, activity_seq, metadata_bytes
+          ) VALUES (?1, ?2, ?3, ?4, 0, ?5, ?5, ?6, ?7)
+        `).run(candidateSessionId, workspaceKey, scopeKey, title, createdAt, activitySequence, metadataSize({ title }));
+        if (input.initialRun) {
+          insertRun(candidateSessionId, input.initialRun, 0);
+        }
+        return hydrate(requireSessionRow(candidateSessionId));
+      });
+    },
+    async get(candidateSessionId, input = {}) {
+      assertOpen();
+      const row = selectSessionRow(candidateSessionId, input.includeDeleted ?? false);
+      return row ? hydrate(row) : undefined;
+    },
+    async list(query = {}) {
+      assertOpen();
+      const limit = boundedInteger("limit", query.limit, 50, 1);
+      if (limit > MAX_LIST_LIMIT) {
+        throw new Error(`limit cannot exceed ${MAX_LIST_LIMIT}.`);
+      }
+      const rows = database.query(`
+        SELECT session_id, title, parent_session_id, forked_from_turn_id, revision, activity_seq,
+               created_at, updated_at, archived_at, deleted_at
+        FROM zhivex_cli_sessions
+        WHERE workspace_key = ?1 AND scope_key = ?2
+          ${query.includeArchived ? "" : "AND archived_at IS NULL"}
+          ${query.includeDeleted ? "" : "AND deleted_at IS NULL"}
+        ORDER BY activity_seq DESC
+        LIMIT ?3
+      `).all(workspaceKey, scopeKey, limit);
+      return rows.map((row) => {
+        const latest = latestRunRow(row.session_id);
+        const runCount = database.query("SELECT COUNT(*) AS count FROM zhivex_cli_session_runs WHERE session_id = ?1").get(row.session_id)?.count ?? 0;
+        return {
+          ...sessionBase(row),
+          runCount,
+          ...latest ? { latestRun: toRunReference(latest) } : {}
+        };
+      });
+    },
+    async latest(input = {}) {
+      assertOpen();
+      const row = database.query(`
+        SELECT session_id, title, parent_session_id, forked_from_turn_id, revision, activity_seq,
+               created_at, updated_at, archived_at, deleted_at
+        FROM zhivex_cli_sessions
+        WHERE workspace_key = ?1 AND scope_key = ?2 AND deleted_at IS NULL
+          ${input.includeArchived ? "" : "AND archived_at IS NULL"}
+        ORDER BY activity_seq DESC
+        LIMIT 1
+      `).get(workspaceKey, scopeKey);
+      return row ? hydrate(row) : undefined;
+    },
+    async update(candidateSessionId, input) {
+      return transaction(() => {
+        const row = requireSessionRow(candidateSessionId);
+        ensureRevision(row, input.expectedRevision);
+        if (input.archived === true) {
+          assertNoActiveRun(candidateSessionId, "archive");
+        }
+        const title = input.title === undefined ? row.title : normalizeTitle(input.title, maxMetadataBytes) ?? null;
+        const updatedAt = now();
+        assertTimestamp("now", updatedAt);
+        const archivedAt = input.archived === undefined ? row.archived_at : input.archived ? updatedAt : null;
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          UPDATE zhivex_cli_sessions
+          SET title = ?1, archived_at = ?2, updated_at = ?3, revision = revision + 1,
+              metadata_bytes = ?4, activity_seq = ?5
+          WHERE session_id = ?6 AND workspace_key = ?7 AND scope_key = ?8 AND revision = ?9
+        `).run(title, archivedAt, updatedAt, metadataSize({ title }), activitySequence, candidateSessionId, workspaceKey, scopeKey, row.revision);
+        return hydrate(requireSessionRow(candidateSessionId));
+      });
+    },
+    async rename(candidateSessionId, title, input = {}) {
+      return store.update(candidateSessionId, {
+        title,
+        ...input.expectedRevision === undefined ? {} : { expectedRevision: input.expectedRevision }
+      });
+    },
+    async appendRun(candidateSessionId, input, appendOptions = {}) {
+      return transaction(() => {
+        const row = requireSessionRow(candidateSessionId);
+        ensureRevision(row, appendOptions.expectedRevision);
+        if (row.archived_at !== null) {
+          throw new Error(`Cannot append a run to archived session ${candidateSessionId}.`);
+        }
+        const existing = database.query(`
+          SELECT turn_id, source_turn_id, ordinal, run_id, provider, model, role, status,
+                 created_at, updated_at, completed_at
+          FROM zhivex_cli_session_runs WHERE session_id = ?1 AND run_id = ?2
+        `).get(candidateSessionId, input.runId);
+        if (existing) {
+          const requestedStatus = input.status ?? "created";
+          if (existing.provider === input.provider && existing.model === input.model && (existing.role ?? undefined) === input.role && existing.status === requestedStatus) {
+            return hydrate(row);
+          }
+          throw new Error(`Run ${input.runId} is already immutably bound to ${existing.provider}/${existing.model} in this session.`);
+        }
+        assertNoActiveRun(candidateSessionId, "start another run in");
+        const count = database.query("SELECT COUNT(*) AS count FROM zhivex_cli_session_runs WHERE session_id = ?1").get(candidateSessionId)?.count ?? 0;
+        if (count >= maxRuns) {
+          throw new Error(`Run-reference limit reached for session ${candidateSessionId} (${maxRuns}).`);
+        }
+        insertRun(candidateSessionId, input, count);
+        const updatedAt = now();
+        assertTimestamp("now", updatedAt);
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          UPDATE zhivex_cli_sessions SET updated_at = ?1, activity_seq = ?2, revision = revision + 1
+          WHERE session_id = ?3 AND revision = ?4
+        `).run(updatedAt, activitySequence, candidateSessionId, row.revision);
+        return hydrate(requireSessionRow(candidateSessionId));
+      });
+    },
+    async updateRun(candidateSessionId, runId, input) {
+      return transaction(() => {
+        const session = requireSessionRow(candidateSessionId);
+        ensureRevision(session, input.expectedSessionRevision);
+        assertIdentifier("runId", runId);
+        const run = database.query(`
+          SELECT turn_id, source_turn_id, ordinal, run_id, provider, model, role, status,
+                 created_at, updated_at, completed_at
+          FROM zhivex_cli_session_runs WHERE session_id = ?1 AND run_id = ?2
+        `).get(candidateSessionId, runId);
+        if (!run) {
+          throw new Error(`Run ${runId} is not linked to session ${candidateSessionId}.`);
+        }
+        if (!STATUS_TRANSITIONS[run.status].has(input.status)) {
+          throw new Error(`Run ${runId} cannot transition from ${run.status} to ${input.status}.`);
+        }
+        const updatedAt = input.updatedAt ?? now();
+        assertTimestamp("updatedAt", updatedAt);
+        if (updatedAt < run.updated_at) {
+          throw new Error(`Run ${runId} update timestamp cannot move backwards.`);
+        }
+        const completedAt = isTerminal(input.status) ? input.completedAt ?? updatedAt : null;
+        if (completedAt !== null) {
+          assertTimestamp("completedAt", completedAt);
+          if (completedAt < run.created_at || completedAt > updatedAt) {
+            throw new Error("completedAt must be between the run creation and update timestamps.");
+          }
+        }
+        database.query(`
+          UPDATE zhivex_cli_session_runs
+          SET status = ?1, updated_at = ?2, completed_at = ?3
+          WHERE session_id = ?4 AND run_id = ?5
+        `).run(input.status, updatedAt, completedAt, candidateSessionId, runId);
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          UPDATE zhivex_cli_sessions SET updated_at = ?1, activity_seq = ?2, revision = revision + 1
+          WHERE session_id = ?3 AND revision = ?4
+        `).run(updatedAt, activitySequence, candidateSessionId, session.revision);
+        return hydrate(requireSessionRow(candidateSessionId));
+      });
+    },
+    async fork(candidateSessionId, input = {}) {
+      return transaction(() => {
+        const source = requireSessionRow(candidateSessionId);
+        ensureRevision(source, input.expectedRevision);
+        const sourceRuns = selectRuns(candidateSessionId);
+        let forkRuns = sourceRuns;
+        let forkedFromTurnId;
+        if (input.atTurnId) {
+          const index = sourceRuns.findIndex((run) => run.turnId === input.atTurnId);
+          if (index < 0) {
+            throw new Error(`Turn ${input.atTurnId} is not part of session ${candidateSessionId}.`);
+          }
+          forkRuns = sourceRuns.slice(0, index + 1);
+          forkedFromTurnId = input.atTurnId;
+        } else if (sourceRuns.length > 0) {
+          forkedFromTurnId = sourceRuns.at(-1).turnId;
+        }
+        const branchPoint = forkRuns.at(-1);
+        if (branchPoint && !isTerminal(branchPoint.status)) {
+          throw new Error(`Cannot fork from non-terminal run ${branchPoint.runId} (${branchPoint.status}).`);
+        }
+        if (forkRuns.length > maxRuns) {
+          throw new Error(`Fork history exceeds the ${maxRuns}-run limit.`);
+        }
+        const count = database.query(`
+          SELECT COUNT(*) AS count FROM zhivex_cli_sessions
+          WHERE workspace_key = ?1 AND scope_key = ?2
+        `).get(workspaceKey, scopeKey)?.count ?? 0;
+        if (count >= maxSessions) {
+          throw new Error(`Session limit reached for this workspace and scope (${maxSessions}).`);
+        }
+        const createdAt = now();
+        assertTimestamp("now", createdAt);
+        const title = normalizeTitle(input.title, maxMetadataBytes) ?? source.title;
+        const forkSessionId = sessionId();
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          INSERT INTO zhivex_cli_sessions (
+            session_id, workspace_key, scope_key, title, parent_session_id,
+            forked_from_turn_id, revision, created_at, updated_at, activity_seq, metadata_bytes
+          ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 0, ?7, ?7, ?8, ?9)
+        `).run(forkSessionId, workspaceKey, scopeKey, title, candidateSessionId, forkedFromTurnId ?? null, createdAt, activitySequence, metadataSize({ title }));
+        for (const [index, run] of forkRuns.entries()) {
+          insertRun(forkSessionId, {
+            runId: run.runId,
+            provider: run.provider,
+            model: run.model,
+            ...run.role ? { role: run.role } : {},
+            status: run.status,
+            createdAt: run.createdAt
+          }, index, run.turnId);
+          database.query(`
+            UPDATE zhivex_cli_session_runs
+            SET updated_at = ?1, completed_at = ?2
+            WHERE session_id = ?3 AND ordinal = ?4
+          `).run(run.updatedAt, run.completedAt ?? null, forkSessionId, index);
+        }
+        return hydrate(requireSessionRow(forkSessionId));
+      });
+    },
+    async archive(candidateSessionId, input = {}) {
+      return store.update(candidateSessionId, {
+        archived: true,
+        ...input.expectedRevision === undefined ? {} : { expectedRevision: input.expectedRevision }
+      });
+    },
+    async delete(candidateSessionId, input = {}) {
+      return transaction(() => {
+        const row = requireSessionRow(candidateSessionId);
+        ensureRevision(row, input.expectedRevision);
+        assertNoActiveRun(candidateSessionId, "delete");
+        const deletedAt = now();
+        assertTimestamp("now", deletedAt);
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          UPDATE zhivex_cli_sessions
+          SET deleted_at = ?1, updated_at = ?1, activity_seq = ?2, revision = revision + 1
+          WHERE session_id = ?3 AND revision = ?4
+        `).run(deletedAt, activitySequence, candidateSessionId, row.revision);
+        return hydrate(requireSessionRow(candidateSessionId, true));
+      });
+    },
+    prune,
+    close() {
+      if (!closed) {
+        closed = true;
+        database.close(false);
+      }
+    }
+  };
+  return store;
+};
+var openSessionStore = openCliSessionStore;
 // src/execution-environment.ts
-import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
 import {
-  chmod,
-  lstat as lstat2,
-  mkdir as mkdir2,
+  chmod as chmod2,
+  lstat as lstat4,
+  mkdir as mkdir3,
   readFile as readFile2,
   readdir as readdir2,
-  realpath as realpath2,
+  realpath as realpath3,
   rename as rename2,
   rm,
   writeFile
 } from "fs/promises";
-import path4 from "path";
+import path6 from "path";
 import { createAgentExecutionEnvironmentBinding } from "@zhivex-ai/agents/beta";
 
 // src/edit-contracts.ts
-import { createHash as createHash2 } from "crypto";
-import path2 from "path";
+import { createHash as createHash4 } from "crypto";
+import path4 from "path";
 import { z } from "zod";
 var EDIT_CONTRACT_SCHEMA_VERSION = 1;
 var EDIT_DIGEST_ALGORITHM = "sha256";
@@ -467,7 +1538,7 @@ var MAX_EDIT_FILE_BYTES = 1024 * 1024;
 var MAX_EDIT_PROPOSAL_BYTES = 4 * 1024 * 1024;
 var SHA256_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
 var fileDigestSchema = z.string().regex(SHA256_DIGEST_PATTERN, "Digest must use the format sha256:<64 lowercase hexadecimal characters>.");
-var workspaceFilePathSchema = z.string().min(1).max(1024).refine((value) => !value.includes("\x00"), "Path cannot contain a NUL byte.").refine((value) => !path2.isAbsolute(value) && !/^[A-Za-z]:[\\/]/.test(value), "Path must be relative.").refine((value) => {
+var workspaceFilePathSchema = z.string().min(1).max(1024).refine((value) => !value.includes("\x00"), "Path cannot contain a NUL byte.").refine((value) => !path4.isAbsolute(value) && !/^[A-Za-z]:[\\/]/.test(value), "Path must be relative.").refine((value) => {
   const segments = value.split(/[\\/]+/);
   return segments.every((segment) => segment !== "" && segment !== "." && segment !== "..");
 }, "Path must be normalized and cannot contain empty, dot, or parent segments.");
@@ -557,7 +1628,7 @@ var mutationAuditEntrySchema = z.strictObject({
   timestamp: z.iso.datetime(),
   quarantineId: z.string().min(1).max(200).optional()
 });
-var digest = (value) => `sha256:${createHash2("sha256").update(value).digest("hex")}`;
+var digest = (value) => `sha256:${createHash4("sha256").update(value).digest("hex")}`;
 var canonicalProposalPayload = (changes) => ({
   schemaVersion: EDIT_CONTRACT_SCHEMA_VERSION,
   kind: "edit-proposal",
@@ -592,9 +1663,9 @@ var editContractDocument = (kind, result) => ({
 });
 
 // src/workspace.ts
-import { createHash as createHash3, randomUUID } from "crypto";
-import { link, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "fs/promises";
-import path3 from "path";
+import { createHash as createHash5, randomUUID as randomUUID2 } from "crypto";
+import { link, lstat as lstat3, mkdir as mkdir2, open as open2, readFile, readdir, realpath as realpath2, rename, stat as stat2, unlink } from "fs/promises";
+import path5 from "path";
 var HARD_IGNORES = new Set([".git", ".next", ".turbo", ".zhivex-harness", "coverage", "dist", "node_modules"]);
 var IGNORE_FILES = [".gitignore", ".zhivex-harnessignore"];
 var DEFAULT_CHECKS = ["test", "typecheck", "lint", "build"];
@@ -605,12 +1676,12 @@ var isSensitiveName = (name) => {
   return normalized === ".env" || normalized.startsWith(".env.") && normalized !== ".env.example" || normalized === ".npmrc" || normalized === "id_rsa" || normalized === "id_ed25519" || normalized.endsWith(".key") || normalized.endsWith(".pem") || normalized.endsWith(".p12") || normalized.endsWith(".pfx");
 };
 var isHardIgnored = (relativePath) => relativePath.split("/").some((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
-var isInside = (root, candidate) => {
-  const relative = path3.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path3.sep}`) && relative !== ".." && !path3.isAbsolute(relative);
+var isInside2 = (root, candidate) => {
+  const relative = path5.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path5.sep}`) && relative !== ".." && !path5.isAbsolute(relative);
 };
-var wirePath = (value) => value.split(path3.sep).join("/");
-var digestBytes = (value) => `sha256:${createHash3("sha256").update(value).digest("hex")}`;
+var wirePath = (value) => value.split(path5.sep).join("/");
+var digestBytes = (value) => `sha256:${createHash5("sha256").update(value).digest("hex")}`;
 var truncate = (value, maxLength = MAX_TOOL_OUTPUT) => value.length <= maxLength ? value : `${value.slice(0, maxLength)}
 \u2026 output truncated (${value.length - maxLength} characters omitted)`;
 var cursorEncode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
@@ -716,18 +1787,18 @@ class Workspace {
     this.root = root;
   }
   static async open(root) {
-    const resolved = await realpath(path3.resolve(root));
-    if (!(await stat(resolved)).isDirectory())
+    const resolved = await realpath2(path5.resolve(root));
+    if (!(await stat2(resolved)).isDirectory())
       throw new Error(`The workspace is not a directory: ${root}`);
     return new Workspace(resolved);
   }
   lexicalPath(relativePath) {
     if (!relativePath || relativePath.includes("\x00"))
       throw new Error("The path must be a valid relative path.");
-    const candidate = path3.resolve(this.root, relativePath);
-    if (!isInside(this.root, candidate))
+    const candidate = path5.resolve(this.root, relativePath);
+    if (!isInside2(this.root, candidate))
       throw new Error(`The path escapes the workspace: ${relativePath}`);
-    const relative = wirePath(path3.relative(this.root, candidate));
+    const relative = wirePath(path5.relative(this.root, candidate));
     if (relative && isHardIgnored(relative)) {
       const blocked = relative.split("/").find((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
       throw new Error(`The path is protected by the harness policy: ${blocked}`);
@@ -738,13 +1809,13 @@ class Workspace {
     const candidate = this.lexicalPath(relativePath);
     if (candidate === this.root && options.requireFile)
       throw new Error("The workspace root is not a regular file.");
-    const segments = path3.relative(this.root, candidate).split(path3.sep).filter(Boolean);
+    const segments = path5.relative(this.root, candidate).split(path5.sep).filter(Boolean);
     let current = this.root;
     for (let index = 0;index < segments.length; index += 1) {
-      current = path3.join(current, segments[index]);
+      current = path5.join(current, segments[index]);
       let entry;
       try {
-        entry = await lstat(current);
+        entry = await lstat3(current);
       } catch (error) {
         if (options.allowMissing && error.code === "ENOENT") {
           return { path: candidate, exists: false };
@@ -764,18 +1835,18 @@ class Workspace {
   }
   async readStableFile(relativePath, allowBinary = true) {
     const safe = await this.safePath(relativePath, { requireFile: true });
-    const before = await lstat(safe.path);
+    const before = await lstat3(safe.path);
     if (before.size > MAX_FILE_BYTES)
       throw new Error(`The file exceeds the ${MAX_FILE_BYTES}-byte limit.`);
     const contents = await readFile(safe.path);
-    const after = await lstat(safe.path);
+    const after = await lstat3(safe.path);
     if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
       throw new Error(`The file changed while it was being read: ${relativePath}`);
     }
     if (!allowBinary && contents.includes(0))
       throw new Error("The file appears to be binary and cannot be read as text.");
     return {
-      path: wirePath(path3.relative(this.root, safe.path)),
+      path: wirePath(path5.relative(this.root, safe.path)),
       absolutePath: safe.path,
       contents,
       digest: digestBytes(contents),
@@ -786,8 +1857,8 @@ class Workspace {
     const rules = [...inherited];
     for (const filename of IGNORE_FILES) {
       try {
-        const ignorePath = path3.join(directory, filename);
-        const entry = await lstat(ignorePath);
+        const ignorePath = path5.join(directory, filename);
+        const entry = await lstat3(ignorePath);
         if (entry.isFile() && entry.size <= MAX_FILE_BYTES) {
           rules.push(...parseIgnoreRules(await readFile(ignorePath, "utf8"), base));
         }
@@ -807,11 +1878,11 @@ class Workspace {
         const relative = base ? `${base}/${entry.name}` : entry.name;
         if (isHardIgnored(relative) || entry.isSymbolicLink() || isIgnoredByRules(relative, entry.isDirectory(), rules))
           continue;
-        const absolute = path3.join(directory, entry.name);
+        const absolute = path5.join(directory, entry.name);
         if (entry.isDirectory())
           await walk(absolute, relative, rules);
         else if (entry.isFile())
-          files.push({ path: relative, size: (await lstat(absolute)).size });
+          files.push({ path: relative, size: (await lstat3(absolute)).size });
       }
     };
     await walk(this.root, "", []);
@@ -819,9 +1890,9 @@ class Workspace {
   }
   async listFiles(relativePath = ".", options = {}) {
     const start = await this.safePath(relativePath);
-    if (!(await lstat(start.path)).isDirectory())
+    if (!(await lstat3(start.path)).isDirectory())
       throw new Error("list_files requires a directory.");
-    const requestPath = wirePath(path3.relative(this.root, start.path)) || ".";
+    const requestPath = wirePath(path5.relative(this.root, start.path)) || ".";
     const input = typeof options === "number" ? { limit: options } : options;
     const limit = input.limit ?? 200;
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > 5000)
@@ -883,9 +1954,9 @@ class Workspace {
     if (!query || query.length > 200)
       throw new Error("The search query must be between 1 and 200 characters.");
     const start = await this.safePath(relativePath);
-    if (!(await lstat(start.path)).isDirectory())
+    if (!(await lstat3(start.path)).isDirectory())
       throw new Error("search_files requires a directory.");
-    const requestPath = wirePath(path3.relative(this.root, start.path)) || ".";
+    const requestPath = wirePath(path5.relative(this.root, start.path)) || ".";
     const limit = options.limit ?? options.maxMatches ?? 100;
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > 500)
       throw new Error("limit must be between 1 and 500.");
@@ -940,7 +2011,7 @@ class Workspace {
     };
   }
   audit(entry) {
-    const record = { id: randomUUID(), timestamp: new Date().toISOString(), ...entry };
+    const record = { id: randomUUID2(), timestamp: new Date().toISOString(), ...entry };
     this.auditEntries.push(record);
     return record;
   }
@@ -948,16 +2019,16 @@ class Workspace {
     return this.auditEntries.map((entry) => ({ ...entry }));
   }
   async secureWorkspaceDirectory(directory, mode = 493) {
-    const resolvedInput = path3.resolve(directory);
-    if (!isInside(this.root, resolvedInput)) {
+    const resolvedInput = path5.resolve(directory);
+    if (!isInside2(this.root, resolvedInput)) {
       throw new Error("A mutation directory escapes the workspace.");
     }
-    const segments = path3.relative(this.root, resolvedInput).split(path3.sep).filter(Boolean);
+    const segments = path5.relative(this.root, resolvedInput).split(path5.sep).filter(Boolean);
     let current = this.root;
     for (const segment of segments) {
-      current = path3.join(current, segment);
+      current = path5.join(current, segment);
       try {
-        const entry = await lstat(current);
+        const entry = await lstat3(current);
         if (entry.isSymbolicLink())
           throw new Error("A mutation directory must not contain a symbolic link.");
         if (!entry.isDirectory())
@@ -966,26 +2037,26 @@ class Workspace {
         if (error.code !== "ENOENT")
           throw error;
         try {
-          await mkdir(current, { mode });
+          await mkdir2(current, { mode });
         } catch (mkdirError) {
           if (mkdirError.code !== "EEXIST")
             throw mkdirError;
-          const raced = await lstat(current);
+          const raced = await lstat3(current);
           if (raced.isSymbolicLink() || !raced.isDirectory()) {
             throw new Error("A mutation directory changed during creation.");
           }
         }
       }
     }
-    const canonical = await realpath(current);
-    if (!isInside(this.root, canonical))
+    const canonical = await realpath2(current);
+    if (!isInside2(this.root, canonical))
       throw new Error("A mutation directory resolves outside the workspace.");
     return canonical;
   }
   async stageFile(target, contents, mode) {
-    const directory = await this.secureWorkspaceDirectory(path3.dirname(target));
-    const temporary = path3.join(directory, `.${path3.basename(target)}.zhivex-${randomUUID()}.tmp`);
-    const handle = await open(temporary, "wx", mode);
+    const directory = await this.secureWorkspaceDirectory(path5.dirname(target));
+    const temporary = path5.join(directory, `.${path5.basename(target)}.zhivex-${randomUUID2()}.tmp`);
+    const handle = await open2(temporary, "wx", mode);
     try {
       await handle.writeFile(contents);
       await handle.chmod(mode);
@@ -1142,7 +2213,7 @@ class Workspace {
     const destination = await this.safePath(parsed.destination, { allowMissing: true });
     if (destination.exists)
       throw new Error(`Move destination already exists: ${parsed.destination}.`);
-    await this.secureWorkspaceDirectory(path3.dirname(destination.path));
+    await this.secureWorkspaceDirectory(path5.dirname(destination.path));
     const destinationRecheck = await this.safePath(parsed.destination, { allowMissing: true });
     if (destinationRecheck.exists)
       throw new Error(`Move destination already exists: ${parsed.destination}.`);
@@ -1169,9 +2240,9 @@ class Workspace {
     const segments = [".zhivex-harness", "quarantine"];
     let current = this.root;
     for (const segment of segments) {
-      current = path3.join(current, segment);
+      current = path5.join(current, segment);
       try {
-        const entry = await lstat(current);
+        const entry = await lstat3(current);
         if (entry.isSymbolicLink()) {
           throw new Error("Harness quarantine must not resolve through a symbolic link.");
         }
@@ -1182,37 +2253,37 @@ class Workspace {
         if (error.code !== "ENOENT" || !create)
           throw error;
         try {
-          await mkdir(current, { mode: 448 });
+          await mkdir2(current, { mode: 448 });
         } catch (mkdirError) {
           if (mkdirError.code !== "EEXIST")
             throw mkdirError;
-          const racedEntry = await lstat(current);
+          const racedEntry = await lstat3(current);
           if (racedEntry.isSymbolicLink() || !racedEntry.isDirectory()) {
             throw new Error("Harness quarantine path changed during creation.");
           }
         }
       }
     }
-    const resolved = await realpath(current);
-    if (!isInside(this.root, resolved))
+    const resolved = await realpath2(current);
+    if (!isInside2(this.root, resolved))
       throw new Error("Harness quarantine resolves outside the workspace.");
     return resolved;
   }
   async writeManifest(manifest) {
     const directory = await this.secureQuarantineDirectory(true);
-    const target = path3.join(directory, `${manifest.quarantineId}.json`);
+    const target = path5.join(directory, `${manifest.quarantineId}.json`);
     const temporary = await this.stageFile(target, `${JSON.stringify(manifest, null, 2)}
 `, 384);
     await rename(temporary, target);
   }
   async readInternalRegularFile(target, label, maxBytes) {
-    const before = await lstat(target);
+    const before = await lstat3(target);
     if (before.isSymbolicLink() || !before.isFile())
       throw new Error(`${label} must be a regular non-symlink file.`);
     if (before.size > maxBytes)
       throw new Error(`${label} exceeds its size limit.`);
     const contents = await readFile(target);
-    const after = await lstat(target);
+    const after = await lstat3(target);
     if (after.isSymbolicLink() || !after.isFile() || before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
       throw new Error(`${label} changed while it was being read.`);
     }
@@ -1223,9 +2294,9 @@ class Workspace {
     const source = await this.readStableFile(parsed.path);
     if (source.digest !== parsed.expectedDigest)
       throw new Error(`Stale quarantine rejected for ${parsed.path}.`);
-    const quarantineId = `${Date.now()}-${randomUUID()}`;
+    const quarantineId = `${Date.now()}-${randomUUID2()}`;
     const directory = await this.secureQuarantineDirectory(true);
-    const dataPath = path3.join(directory, `${quarantineId}.data`);
+    const dataPath = path5.join(directory, `${quarantineId}.data`);
     if ((await this.readStableFile(parsed.path)).digest !== parsed.expectedDigest)
       throw new Error(`Stale quarantine rejected for ${parsed.path}.`);
     await link(source.absolutePath, dataPath);
@@ -1247,7 +2318,7 @@ class Workspace {
       await unlink(source.absolutePath);
     } catch (error) {
       await unlink(dataPath).catch(() => {});
-      await unlink(path3.join(directory, `${quarantineId}.json`)).catch(() => {});
+      await unlink(path5.join(directory, `${quarantineId}.json`)).catch(() => {});
       throw error;
     }
     const audit = this.audit({ operation: "quarantine", path: parsed.path, beforeDigest: source.digest, quarantineId });
@@ -1258,7 +2329,7 @@ class Workspace {
     const directory = await this.secureQuarantineDirectory(false);
     let manifest;
     try {
-      const manifestFile = await this.readInternalRegularFile(path3.join(directory, `${parsed.quarantineId}.json`), "Quarantine manifest", 64 * 1024);
+      const manifestFile = await this.readInternalRegularFile(path5.join(directory, `${parsed.quarantineId}.json`), "Quarantine manifest", 64 * 1024);
       manifest = JSON.parse(manifestFile.contents.toString("utf8"));
     } catch {
       throw new Error(`Quarantine entry was not found: ${parsed.quarantineId}.`);
@@ -1266,7 +2337,7 @@ class Workspace {
     if (manifest.schemaVersion !== 1 || manifest.quarantineId !== parsed.quarantineId || manifest.status !== "quarantined") {
       throw new Error(`Quarantine entry is not restorable: ${parsed.quarantineId}.`);
     }
-    const dataPath = path3.join(directory, `${parsed.quarantineId}.data`);
+    const dataPath = path5.join(directory, `${parsed.quarantineId}.data`);
     const dataFile = await this.readInternalRegularFile(dataPath, "Quarantine payload", MAX_FILE_BYTES);
     const digest2 = digestBytes(dataFile.contents);
     if (digest2 !== manifest.digest || parsed.expectedDigest && parsed.expectedDigest !== digest2) {
@@ -1276,16 +2347,16 @@ class Workspace {
     const destination = await this.safePath(destinationPath, { allowMissing: true });
     if (destination.exists)
       throw new Error(`Restore destination already exists: ${destinationPath}.`);
-    await this.secureWorkspaceDirectory(path3.dirname(destination.path));
+    await this.secureWorkspaceDirectory(path5.dirname(destination.path));
     const destinationRecheck = await this.safePath(destinationPath, { allowMissing: true });
     if (destinationRecheck.exists)
       throw new Error(`Restore destination already exists: ${destinationPath}.`);
-    const dataRecheck = await lstat(dataPath);
+    const dataRecheck = await lstat3(dataPath);
     if (dataRecheck.isSymbolicLink() || !dataRecheck.isFile() || dataRecheck.dev !== dataFile.stat.dev || dataRecheck.ino !== dataFile.stat.ino || dataRecheck.size !== dataFile.stat.size || dataRecheck.mtimeMs !== dataFile.stat.mtimeMs) {
       throw new Error("Quarantine payload changed before restore commit.");
     }
     await link(dataPath, destination.path);
-    const linkedDestination = await lstat(destination.path);
+    const linkedDestination = await lstat3(destination.path);
     if (linkedDestination.isSymbolicLink() || !linkedDestination.isFile() || linkedDestination.dev !== dataFile.stat.dev || linkedDestination.ino !== dataFile.stat.ino || digestBytes(await readFile(destination.path)) !== digest2) {
       await unlink(destination.path).catch(() => {});
       throw new Error("Restore destination did not match the quarantined payload.");
@@ -1354,7 +2425,7 @@ class Workspace {
 var HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION = 1;
 var HARNESS_OCI_LABEL = "com.zhivex.harness.execution";
 var HARNESS_OCI_LABEL_VALUE = "v1";
-var TERMINAL_STATUSES = new Set([
+var TERMINAL_STATUSES2 = new Set([
   "completed",
   "failed",
   "cancelled",
@@ -1377,22 +2448,22 @@ var BUILT_IN_TOOL_NAMES = new Set([
   "apply_environment_patch",
   "environment_status"
 ]);
-var digest2 = (value) => `sha256:${createHash4("sha256").update(value).digest("hex")}`;
-var runHash = (runId) => createHash4("sha256").update(runId).digest("hex").slice(0, 24);
-var isInside2 = (root, candidate) => {
-  const relative = path4.relative(root, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path4.sep}`) && !path4.isAbsolute(relative);
+var digest2 = (value) => `sha256:${createHash6("sha256").update(value).digest("hex")}`;
+var runHash = (runId) => createHash6("sha256").update(runId).digest("hex").slice(0, 24);
+var isInside3 = (root, candidate) => {
+  const relative = path6.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path6.sep}`) && !path6.isAbsolute(relative);
 };
 var privateDirectory = async (directory) => {
-  await mkdir2(directory, { recursive: true, mode: 448 });
-  const entry = await lstat2(directory);
+  await mkdir3(directory, { recursive: true, mode: 448 });
+  const entry = await lstat4(directory);
   if (entry.isSymbolicLink() || !entry.isDirectory()) {
     throw new Error(`Execution artifact directory must be a real directory: ${directory}.`);
   }
-  await chmod(directory, 448);
+  await chmod2(directory, 448);
 };
 var atomicJson = async (target, value) => {
-  const temporary = `${target}.${randomUUID2()}.tmp`;
+  const temporary = `${target}.${randomUUID3()}.tmp`;
   await writeFile(temporary, `${JSON.stringify(value, null, 2)}
 `, { encoding: "utf8", mode: 384 });
   await rename2(temporary, target);
@@ -1494,8 +2565,8 @@ var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspace
   const visit = async (directory, relativeDirectory = "") => {
     for (const name of await readdir2(directory)) {
       const relative = relativeDirectory ? `${relativeDirectory}/${name}` : name;
-      const absolute = path4.join(directory, name);
-      if (!isInside2(stagedRoot, absolute) || relative.length > 1024) {
+      const absolute = path6.join(directory, name);
+      if (!isInside3(stagedRoot, absolute) || relative.length > 1024) {
         throw new Error(`OCI workspace export contains an invalid path: ${relative}.`);
       }
       entries += 1;
@@ -1506,7 +2577,7 @@ var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspace
         await rm(absolute, { recursive: true, force: true });
         continue;
       }
-      const entry = await lstat2(absolute);
+      const entry = await lstat4(absolute);
       if (entry.isSymbolicLink()) {
         throw new Error(`OCI workspace export contains a symbolic link: ${relative}.`);
       }
@@ -1522,10 +2593,10 @@ var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspace
         throw new Error(`OCI workspace export exceeds the ${maxWorkspaceBytes}-byte workspace limit.`);
       }
       if (entry.size > maxFileWriteBytes) {
-        const previous = path4.join(previousRoot, ...relative.split("/"));
+        const previous = path6.join(previousRoot, ...relative.split("/"));
         let unchanged = false;
         try {
-          const previousEntry = await lstat2(previous);
+          const previousEntry = await lstat4(previous);
           unchanged = previousEntry.isFile() && !previousEntry.isSymbolicLink() && previousEntry.size === entry.size && digest2(await readFile2(previous)) === digest2(await readFile2(absolute));
         } catch (error) {
           if (error.code !== "ENOENT")
@@ -1540,7 +2611,7 @@ var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspace
   await visit(stagedRoot);
 };
 var replaceSnapshot = async (snapshotRoot, stagedRoot) => {
-  const backupRoot = `${snapshotRoot}.${randomUUID2()}.previous`;
+  const backupRoot = `${snapshotRoot}.${randomUUID3()}.previous`;
   await rename2(snapshotRoot, backupRoot);
   try {
     await rename2(stagedRoot, snapshotRoot);
@@ -1609,7 +2680,7 @@ ${result.stdout}`)) {
     }
   }
   async run(request) {
-    const resourceName = `zhivex-harness-${runHash(request.runId)}-${randomUUID2().slice(0, 8)}`;
+    const resourceName = `zhivex-harness-${runHash(request.runId)}-${randomUUID3().slice(0, 8)}`;
     const name = `${resourceName}-job`;
     const exportName = `${resourceName}-export`;
     const volumeName = `${resourceName}-workspace`;
@@ -1731,7 +2802,7 @@ ${result.stdout}`)) {
         await forcedRemoval;
       } else if (result.exitCode === 0) {
         await this.cli(["pause", name]);
-        const stagedRoot = path4.join(path4.dirname(request.snapshotRoot), `.workspace-sync-${randomUUID2()}`);
+        const stagedRoot = path6.join(path6.dirname(request.snapshotRoot), `.workspace-sync-${randomUUID3()}`);
         try {
           await privateDirectory(stagedRoot);
           try {
@@ -1865,14 +2936,14 @@ var collectSnapshotFiles = async (workspace) => {
   do {
     const page = await workspace.listFiles(".", { limit: 500, ...cursor ? { cursor } : {} });
     for (const file of page.files) {
-      const absolute = path4.join(workspace.root, ...file.path.split("/"));
-      if (!isInside2(workspace.root, absolute))
+      const absolute = path6.join(workspace.root, ...file.path.split("/"));
+      if (!isInside3(workspace.root, absolute))
         throw new Error(`Snapshot file escaped its workspace: ${file.path}.`);
-      const before = await lstat2(absolute);
+      const before = await lstat4(absolute);
       if (before.isSymbolicLink() || !before.isFile())
         throw new Error(`Snapshot source is not a regular file: ${file.path}.`);
       const contents = await readFile2(absolute);
-      const after = await lstat2(absolute);
+      const after = await lstat4(absolute);
       if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
         throw new Error(`Snapshot source changed while reading: ${file.path}.`);
       }
@@ -1896,10 +2967,10 @@ var copyWorkspaceSnapshot = async (source, baseRoot, snapshotRoot, maxWorkspaceB
   }
   for (const file of files.values()) {
     for (const root of [baseRoot, snapshotRoot]) {
-      const target = path4.join(root, ...file.path.split("/"));
-      await mkdir2(path4.dirname(target), { recursive: true, mode: 448 });
+      const target = path6.join(root, ...file.path.split("/"));
+      await mkdir3(path6.dirname(target), { recursive: true, mode: 448 });
       await writeFile(target, file.contents, { mode: file.mode });
-      await chmod(target, file.mode);
+      await chmod2(target, file.mode);
     }
   }
   return { files: files.size, bytes: totalBytes };
@@ -2110,21 +3181,21 @@ var createHarnessOciExecutionEnvironment = async (options) => {
     }
   };
   const binding = createAgentExecutionEnvironmentBinding(manifest);
-  const environmentRoot = path4.join(options.stateDirectory, "environments");
+  const environmentRoot = path6.join(options.stateDirectory, "environments");
   return {
     manifest,
     image,
     runtime,
     async acquire(request) {
       await privateDirectory(environmentRoot);
-      const directory = path4.join(environmentRoot, runHash(request.runId));
+      const directory = path6.join(environmentRoot, runHash(request.runId));
       await privateDirectory(directory);
-      const metadataPath = path4.join(directory, "environment.json");
-      const baseRoot = path4.join(directory, "base");
-      const snapshotRoot = path4.join(directory, "workspace");
+      const metadataPath = path6.join(directory, "environment.json");
+      const baseRoot = path6.join(directory, "base");
+      const snapshotRoot = path6.join(directory, "workspace");
       let metadata;
       try {
-        const entry = await lstat2(metadataPath);
+        const entry = await lstat4(metadataPath);
         if (entry.isSymbolicLink() || !entry.isFile())
           throw new Error("Execution metadata must be a regular file.");
         metadata = JSON.parse(await readFile2(metadataPath, "utf8"));
@@ -2153,14 +3224,14 @@ var createHarnessOciExecutionEnvironment = async (options) => {
       await atomicJson(metadataPath, metadata);
       const workspace = await Workspace.open(snapshotRoot);
       const base = await Workspace.open(baseRoot);
-      const dependencyPath = path4.join(options.workspace.root, "node_modules");
+      const dependencyPath = path6.join(options.workspace.root, "node_modules");
       let dependencyRoot;
       try {
-        const entry = await lstat2(dependencyPath);
+        const entry = await lstat4(dependencyPath);
         if (entry.isSymbolicLink() || !entry.isDirectory()) {
           throw new Error("node_modules must be a real directory before it can be mounted read-only.");
         }
-        dependencyRoot = await realpath2(dependencyPath);
+        dependencyRoot = await realpath3(dependencyPath);
       } catch (error) {
         if (error.code !== "ENOENT") {
           throw error;
@@ -2261,7 +3332,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
           }
           let manifestDocument;
           try {
-            manifestDocument = JSON.parse(await readFile2(path4.join(snapshotRoot, "package.json"), "utf8"));
+            manifestDocument = JSON.parse(await readFile2(path6.join(snapshotRoot, "package.json"), "utf8"));
           } catch (error) {
             if (error.code === "ENOENT") {
               throw new Error("The environment snapshot does not contain package.json.");
@@ -2299,7 +3370,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
   };
 };
 var cleanupHarnessExecutionArtifacts = async (stateDirectory, before) => {
-  const root = path4.join(stateDirectory, "environments");
+  const root = path6.join(stateDirectory, "environments");
   const result = { scanned: 0, deleted: 0, skipped: 0 };
   let entries;
   try {
@@ -2315,20 +3386,20 @@ var cleanupHarnessExecutionArtifacts = async (stateDirectory, before) => {
       continue;
     }
     result.scanned += 1;
-    const directory = path4.join(root, entry.name);
-    const resolved = await realpath2(directory);
-    if (!isInside2(root, resolved)) {
+    const directory = path6.join(root, entry.name);
+    const resolved = await realpath3(directory);
+    if (!isInside3(root, resolved)) {
       result.skipped += 1;
       continue;
     }
     try {
-      const metadataPath = path4.join(directory, "environment.json");
-      const metadataEntry = await lstat2(metadataPath);
+      const metadataPath = path6.join(directory, "environment.json");
+      const metadataEntry = await lstat4(metadataPath);
       if (metadataEntry.isSymbolicLink() || !metadataEntry.isFile())
         throw new Error("unsafe metadata");
       const metadata = JSON.parse(await readFile2(metadataPath, "utf8"));
       const releasedAt = metadata.releasedAt ? Date.parse(metadata.releasedAt) : Number.NaN;
-      if (!metadata.status || !TERMINAL_STATUSES.has(metadata.status) || !Number.isFinite(releasedAt) || releasedAt >= before) {
+      if (!metadata.status || !TERMINAL_STATUSES2.has(metadata.status) || !Number.isFinite(releasedAt) || releasedAt >= before) {
         result.skipped += 1;
         continue;
       }
@@ -2398,8 +3469,8 @@ var selectHarnessModel = (candidates, required) => {
   };
 };
 // src/mcp.ts
-import { lstat as lstat3, readFile as readFile3, realpath as realpath3 } from "fs/promises";
-import path5 from "path";
+import { lstat as lstat5, readFile as readFile3, realpath as realpath4 } from "fs/promises";
+import path7 from "path";
 import {
   createMcpToolSet,
   serializeJsonValue
@@ -2449,8 +3520,8 @@ var configurationSchema = z2.object({
   servers: z2.array(serverSchema).max(20)
 }).strict();
 var isInsidePath = (root, candidate) => {
-  const relative = path5.relative(root, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path5.sep}`) && !path5.isAbsolute(relative);
+  const relative = path7.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path7.sep}`) && !path7.isAbsolute(relative);
 };
 var validatedHttpUrl = (value, serverName) => {
   let url;
@@ -2534,7 +3605,7 @@ var normalizeHarnessMcpConfiguration = (value) => {
   return { schemaVersion: HARNESS_MCP_CONFIG_SCHEMA_VERSION, servers };
 };
 var loadHarnessMcpConfiguration = async (workspace, configPath) => {
-  const entry = await lstat3(configPath);
+  const entry = await lstat5(configPath);
   if (entry.isSymbolicLink() || !entry.isFile()) {
     throw new Error(`MCP configuration must be a regular non-symlink file: ${configPath}.`);
   }
@@ -2542,8 +3613,8 @@ var loadHarnessMcpConfiguration = async (workspace, configPath) => {
     throw new Error("MCP configuration cannot exceed 1 MiB.");
   }
   const [canonicalWorkspace, canonicalConfig] = await Promise.all([
-    realpath3(workspace),
-    realpath3(configPath)
+    realpath4(workspace),
+    realpath4(configPath)
   ]);
   if (!isInsidePath(canonicalWorkspace, canonicalConfig)) {
     throw new Error("MCP configuration must remain inside the canonical workspace.");
@@ -2649,7 +3720,7 @@ var createHttpMcpClient = (server, env = process.env, fetchImplementation = fetc
     throw new Error(`MCP server ${server.name} is not configured for HTTP transport.`);
   }
   const staticHeaders = resolveHeaders(server, env);
-  let sessionId;
+  let sessionId2;
   let requestId = 0;
   let initialization;
   const post = async (payload, options = {}, expectResponse = true) => {
@@ -2661,7 +3732,7 @@ var createHttpMcpClient = (server, env = process.env, fetchImplementation = fetc
         "content-type": "application/json",
         accept: "application/json, text/event-stream",
         "mcp-protocol-version": "2025-06-18",
-        ...sessionId ? { "mcp-session-id": sessionId } : {}
+        ...sessionId2 ? { "mcp-session-id": sessionId2 } : {}
       },
       body: JSON.stringify(payload),
       ...options.abortSignal ? { signal: options.abortSignal } : {}
@@ -2670,7 +3741,7 @@ var createHttpMcpClient = (server, env = process.env, fetchImplementation = fetc
       await response.body?.cancel();
       throw new Error(`MCP server ${server.name} returned HTTP ${response.status}.`);
     }
-    sessionId = response.headers.get("mcp-session-id") ?? sessionId;
+    sessionId2 = response.headers.get("mcp-session-id") ?? sessionId2;
     if (!expectResponse) {
       await response.body?.cancel();
       return;
@@ -2788,7 +3859,7 @@ var createHarnessMcpTools = async (configuration, options = {}) => {
 };
 var mcpConfigurationFingerprintInput = (configuration) => serializeJsonValue(configuration);
 // src/orchestration.ts
-import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash7, randomUUID as randomUUID4 } from "crypto";
 import {
   applySafetyPolicyToAgent,
   createBudgetGuard,
@@ -2835,7 +3906,7 @@ var childHarnessBinding = (parent, profile, model, toolNames, config) => ({
   schemaVersion: 1,
   id: `${parent.id}-${profile}`,
   version: parent.version,
-  fingerprint: `sha256:${createHash5("sha256").update(JSON.stringify({
+  fingerprint: `sha256:${createHash7("sha256").update(JSON.stringify({
     parent: parent.fingerprint,
     profile,
     model: {
@@ -2935,7 +4006,7 @@ var runHarnessReviewGroup = async (runtime, input, profiles = ["explorer", "revi
     }
     return { name: profile, agent };
   });
-  const groupId = input.groupId ?? `review_${randomUUID3()}`;
+  const groupId = input.groupId ?? `review_${randomUUID4()}`;
   const result = await runAgentGroup(members, {
     prompt: input.prompt,
     ...input.scope ? { scope: input.scope } : {},
@@ -2958,13 +4029,13 @@ var runHarnessReviewGroup = async (runtime, input, profiles = ["explorer", "revi
   };
 };
 // src/harness.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import {
   Agent,
   applySafetyPolicyToAgent as applySafetyPolicyToAgent2,
   createBudgetGuard as createBudgetGuard2,
   createProductionSafetyPolicy as createProductionSafetyPolicy2,
-  createRedactionPolicy as createRedactionPolicy2,
+  createRedactionPolicy as createRedactionPolicy3,
   getAgentBudgetStatus as getAgentBudgetStatus2,
   tool
 } from "@zhivex-ai/agents";
@@ -2976,12 +4047,12 @@ import { serializeJsonValue as serializeJsonValue2 } from "@zhivex-ai/core";
 import { z as z3 } from "zod";
 
 // src/operations.ts
-import { chmod as chmod2, lstat as lstat5, mkdir as mkdir3, open as open2 } from "fs/promises";
-import path7 from "path";
+import { chmod as chmod3, lstat as lstat6, mkdir as mkdir4, open as open3 } from "fs/promises";
+import path8 from "path";
 import {
   cancelAgentRun,
   cancelAgentRunTree,
-  createRedactionPolicy,
+  createRedactionPolicy as createRedactionPolicy2,
   getAgentBudgetStatus
 } from "@zhivex-ai/agents";
 import {
@@ -2994,63 +4065,7 @@ import {
   createSqliteAgentRunStore
 } from "@zhivex-ai/agents/ops";
 import { createAgentRunLedger } from "@zhivex-ai/agents/control-plane";
-import { Database } from "bun:sqlite";
-
-// src/state-directory.ts
-import { lstat as lstat4 } from "fs/promises";
-import path6 from "path";
-var SENSITIVE_STATE_SEGMENTS = new Set([".git", ".env", ".npmrc", "dist", "node_modules", "src"]);
-var isInside3 = (root, candidate) => {
-  const relative = path6.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path6.sep}`) && relative !== ".." && !path6.isAbsolute(relative);
-};
-var validateStateDirectory = async (workspace, stateDirectory) => {
-  if (stateDirectory === workspace || stateDirectory === path6.parse(stateDirectory).root) {
-    throw new Error("The state directory cannot be the workspace or filesystem root.");
-  }
-  const insideWorkspace = isInside3(workspace, stateDirectory);
-  const relativeSegments = insideWorkspace ? path6.relative(workspace, stateDirectory).split(path6.sep).filter(Boolean) : stateDirectory.slice(path6.parse(stateDirectory).root.length).split(path6.sep).filter(Boolean);
-  const sensitiveSegment = insideWorkspace ? relativeSegments.find((segment) => SENSITIVE_STATE_SEGMENTS.has(segment)) : undefined;
-  if (sensitiveSegment) {
-    throw new Error(`The state directory is inside the protected workspace path: ${sensitiveSegment}.`);
-  }
-  if (!insideWorkspace) {
-    try {
-      const externalEntry = await lstat4(stateDirectory);
-      if (externalEntry.isSymbolicLink()) {
-        throw new Error(`The state directory must not be a symbolic link: ${stateDirectory}.`);
-      }
-      if (!externalEntry.isDirectory()) {
-        throw new Error(`The state directory is not a directory: ${stateDirectory}.`);
-      }
-    } catch (error) {
-      if (error.code !== "ENOENT") {
-        throw error;
-      }
-    }
-    return;
-  }
-  let current = workspace;
-  for (const segment of relativeSegments) {
-    current = path6.join(current, segment);
-    try {
-      const entry = await lstat4(current);
-      if (entry.isSymbolicLink()) {
-        throw new Error(`The state directory must not resolve through a symbolic link: ${current}.`);
-      }
-      if (!entry.isDirectory()) {
-        throw new Error(`The state directory path contains a non-directory entry: ${current}.`);
-      }
-    } catch (error) {
-      if (error.code === "ENOENT") {
-        break;
-      }
-      throw error;
-    }
-  }
-};
-
-// src/operations.ts
+import { Database as Database2 } from "bun:sqlite";
 var HARNESS_SQLITE_FILE = "operations.sqlite";
 var HARNESS_OPERATIONS_SCHEMA_VERSION = 1;
 var TERMINAL_RUN_STATUSES = ["completed", "failed", "cancelled", "timed_out"];
@@ -3098,7 +4113,7 @@ var inspectHarnessRun = async (store, config, runId) => {
   if (!state) {
     throw new Error(`Run ${runId} was not found in ${config.stateDirectory}.`);
   }
-  const redaction = createRedactionPolicy({ includeEmails: true });
+  const redaction = createRedactionPolicy2({ includeEmails: true });
   const traceOptions = createProductionTraceOptions({
     includeMessages: false,
     includeToolInputs: false,
@@ -3220,12 +4235,12 @@ var sqliteAdapter = (database) => ({
   }
 });
 var ensurePrivateStateDirectory = async (directory) => {
-  await mkdir3(directory, { recursive: true, mode: 448 });
-  const entry = await lstat5(directory);
+  await mkdir4(directory, { recursive: true, mode: 448 });
+  const entry = await lstat6(directory);
   if (entry.isSymbolicLink() || !entry.isDirectory()) {
     throw new Error(`The state directory must be a real directory: ${directory}.`);
   }
-  await chmod2(directory, 448);
+  await chmod3(directory, 448);
 };
 var migrateJournalEntry = (entry, state, config) => ({
   ...entry,
@@ -3277,35 +4292,35 @@ var openHarnessPersistence = async (config, options = {}) => {
       backend: "file",
       store,
       memory: createFileAgentMemoryStore({
-        directory: path7.join(config.stateDirectory, "memory"),
+        directory: path8.join(config.stateDirectory, "memory"),
         scope: config.scope
       }),
       migration,
       close() {}
     };
   }
-  const databasePath = path7.join(config.stateDirectory, HARNESS_SQLITE_FILE);
+  const databasePath = path8.join(config.stateDirectory, HARNESS_SQLITE_FILE);
   let databaseEntry;
   try {
-    databaseEntry = await lstat5(databasePath);
+    databaseEntry = await lstat6(databasePath);
   } catch (error) {
     if (error.code !== "ENOENT") {
       throw error;
     }
     try {
-      const handle = await open2(databasePath, "wx", 384);
+      const handle = await open3(databasePath, "wx", 384);
       await handle.close();
     } catch (creationError) {
       if (creationError.code !== "EEXIST") {
         throw creationError;
       }
     }
-    databaseEntry = await lstat5(databasePath);
+    databaseEntry = await lstat6(databasePath);
   }
   if (databaseEntry.isSymbolicLink() || !databaseEntry.isFile()) {
     throw new Error(`The SQLite state path must be a real file: ${databasePath}.`);
   }
-  const database = new Database(databasePath, { create: false, strict: true });
+  const database = new Database2(databasePath, { create: false, strict: true });
   let closed = false;
   const closeDatabase = () => {
     if (!closed) {
@@ -3314,14 +4329,14 @@ var openHarnessPersistence = async (config, options = {}) => {
     }
   };
   try {
-    const openedEntry = await lstat5(databasePath);
+    const openedEntry = await lstat6(databasePath);
     if (openedEntry.isSymbolicLink() || !openedEntry.isFile() || openedEntry.dev !== databaseEntry.dev || openedEntry.ino !== databaseEntry.ino) {
       throw new Error(`The SQLite state path changed while it was being opened: ${databasePath}.`);
     }
     database.exec("PRAGMA journal_mode = WAL");
     database.exec("PRAGMA busy_timeout = 5000");
     database.exec("PRAGMA foreign_keys = ON");
-    await chmod2(databasePath, 384);
+    await chmod3(databasePath, 384);
     const databaseLike = sqliteAdapter(database);
     const store = createSqliteAgentRunStore({ db: databaseLike, scope: config.scope });
     const memory = createSqliteAgentMemoryStore({ db: databaseLike, scope: config.scope });
@@ -3343,11 +4358,11 @@ var openHarnessPersistence = async (config, options = {}) => {
 // src/harness.ts
 var APPROVAL_VERSION = "2026-08-17-v5";
 var TOOL_CONTRACT_VERSION = "enforced-execution-v1";
-var createHarnessBinding = (config, mcpConfiguration, model, subagentModels, executionEnvironment) => ({
+var createHarnessBinding = (config, mcpConfiguration, model, subagentModels, providerTransportFingerprint, executionEnvironment) => ({
   schemaVersion: 1,
   id: "zhivex-harness",
   version: HARNESS_VERSION,
-  fingerprint: `sha256:${createHash6("sha256").update(JSON.stringify({
+  fingerprint: `sha256:${createHash8("sha256").update(JSON.stringify({
     configSchemaVersion: HARNESS_CONFIG_SCHEMA_VERSION,
     approvalVersion: APPROVAL_VERSION,
     toolContractVersion: TOOL_CONTRACT_VERSION,
@@ -3355,6 +4370,7 @@ var createHarnessBinding = (config, mcpConfiguration, model, subagentModels, exe
     provider: config.provider,
     model: config.model,
     runtimeModel: inspectHarnessModelCapabilities(model),
+    providerTransportFingerprint,
     subagentModels: Object.fromEntries(config.orchestration.profiles.map((profile) => [
       profile,
       inspectHarnessModelCapabilities(subagentModels?.[profile] ?? model)
@@ -3376,6 +4392,7 @@ Rules:
 - Make the smallest coherent change that fully addresses the task.
 - For every file edit, first read its digest and call propose_edits. Apply exactly that reviewed proposal with apply_patch.
 - apply_patch, move_file, quarantine_file, restore_file, and run_check require explicit approval from the operator.
+- Calling an approval-gated tool is how you request that approval: call the tool with its complete reviewed arguments, then let the runtime pause before execution. Never replace the tool call with a textual approval request.
 - With enforced OCI execution enabled, workspace tools operate on an ephemeral snapshot. Use inspect_environment_patch and obtain a separate approval through apply_environment_patch before changing the host workspace.
 - run_environment_command executes one allowlisted argv command without a host shell. Network, privileges, resources, environment variables, and output are bounded by the OCI policy.
 - Never overwrite stale content. If an expected digest no longer matches, inspect the file again and create a new proposal.
@@ -3426,7 +4443,7 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
       cursor: z3.string().min(1).max(2000).optional()
     }),
     metadata: readOnlyMetadata,
-    execute: async ({ path: path8, limit, cursor }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).listFiles(path8, {
+    execute: async ({ path: path9, limit, cursor }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).listFiles(path9, {
       limit,
       ...cursor ? { cursor } : {}
     }))
@@ -3440,7 +4457,7 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
       endLine: z3.number().int().min(1).optional()
     }),
     metadata: readOnlyMetadata,
-    execute: async ({ path: path8, startLine, endLine }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).readFile(path8, startLine, endLine))
+    execute: async ({ path: path9, startLine, endLine }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).readFile(path9, startLine, endLine))
   }),
   search_files: tool({
     name: "search_files",
@@ -3453,7 +4470,7 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
       cursor: z3.string().min(1).max(2000).optional()
     }),
     metadata: readOnlyMetadata,
-    execute: async ({ query, path: path8, caseSensitive, limit, cursor }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).searchFiles(query, path8, {
+    execute: async ({ query, path: path9, caseSensitive, limit, cursor }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).searchFiles(query, path9, {
       caseSensitive,
       limit,
       ...cursor ? { cursor } : {}
@@ -3471,7 +4488,7 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
   }),
   apply_patch: tool({
     name: "apply_patch",
-    description: "Atomically apply one reviewed multi-file proposal. Every existing file requires its exact expected digest; expectedDigest=null is create-only.",
+    description: "Request approval to atomically apply one reviewed multi-file proposal; the runtime pauses before execution. Every existing file requires its exact expected digest; expectedDigest=null is create-only. Call this tool instead of asking for approval in text.",
     schema: applyEditProposalInputSchema,
     ...mutationApproval,
     execute: async (input, context) => {
@@ -3577,32 +4594,49 @@ var createExecutionEnvironmentTools = (workspace) => ({
   })
 });
 var estimateMessageTokens = (messages) => Math.max(1, Math.ceil(JSON.stringify(messages).length / 4));
-var createHarnessCompactor = () => {
-  const redaction = createRedactionPolicy2({ includeEmails: true });
-  return async ({ messages }) => {
-    const summaries = messages.map((message, index) => {
-      const record = message;
-      const parts = (record.parts ?? []).map((part) => {
-        if (part.type === "text" && typeof part.text === "string") {
-          const text = redaction.redactText(part.text).replace(/\s+/g, " ").trim();
-          return text.length > 160 ? `${text.slice(0, 160)}\u2026` : text;
-        }
-        if (part.type === "tool-call") {
-          const call = part.toolCall;
-          return `tool-call:${typeof call?.name === "string" ? call.name : "unknown"}`;
-        }
-        if (part.type === "tool-result") {
-          const result = part.toolResult;
-          return `tool-result:${typeof result?.toolName === "string" ? result.toolName : "unknown"}`;
-        }
-        return typeof part.type === "string" ? part.type : "part";
-      });
-      return `${index + 1}. ${record.role ?? "message"}: ${parts.join(" | ")}`;
+var summarizeHarnessMessages = (messages) => {
+  const redaction = createRedactionPolicy3({ includeEmails: true });
+  const summaries = messages.map((message, index) => {
+    const record = message;
+    const parts = (record.parts ?? []).map((part) => {
+      if (part.type === "text" && typeof part.text === "string") {
+        const text = redaction.redactText(part.text).replace(/\bBearer\s+\S+/gi, "Bearer [REDACTED]").replace(/\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)|api[_-]?key|access[_-]?token|password)\s*([=:])\s*(?:"[^"]*"|'[^']*'|\S+)/gi, "$1$2[REDACTED]").replace(/\b(?:sk|ghp|gho|github_pat)-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(/\s+/g, " ").trim();
+        return text.length > 160 ? `${text.slice(0, 160)}\u2026` : text;
+      }
+      if (part.type === "tool-call") {
+        const call = part.toolCall;
+        return `tool-call:${typeof call?.name === "string" ? call.name : "unknown"}`;
+      }
+      if (part.type === "tool-result") {
+        const result = part.toolResult;
+        return `tool-result:${typeof result?.toolName === "string" ? result.toolName : "unknown"}`;
+      }
+      return typeof part.type === "string" ? part.type : "part";
     });
-    const summary = summaries.join(`
+    return `${index + 1}. ${record.role ?? "message"}: ${parts.join(" | ")}`;
+  });
+  const summary = summaries.join(`
 `);
+  return summary.length > 4000 ? `${summary.slice(0, 4000)}\u2026` : summary;
+};
+var compactHarnessMessages = (messages) => {
+  if (messages.length === 0)
+    return [];
+  return [
+    {
+      role: "user",
+      parts: [{
+        type: "text",
+        text: `[Compacted conversation context]
+${summarizeHarnessMessages(messages)}`
+      }]
+    }
+  ];
+};
+var createHarnessCompactor = () => {
+  return async ({ messages }) => {
     return {
-      summary: summary.length > 4000 ? `${summary.slice(0, 4000)}\u2026` : summary,
+      summary: summarizeHarnessMessages(messages),
       metadata: {
         strategy: "deterministic-redacted-transcript",
         sourceMessages: messages.length
@@ -3665,7 +4699,7 @@ var createProviderCompatibleBudget = (config) => {
   };
 };
 var createHarness = async (options = {}) => {
-  const config = resolveHarnessConfig(options);
+  const config = resolveHarnessConfig(options, options.providerRegistry);
   const workspace = await Workspace.open(config.workspace);
   await validateStateDirectory(config.workspace, config.stateDirectory);
   const executionEnvironment = config.execution.backend === "oci" ? await createHarnessOciExecutionEnvironment({
@@ -3674,7 +4708,7 @@ var createHarness = async (options = {}) => {
     stateDirectory: config.stateDirectory,
     ...options.ociRuntimeAdapter ? { runtime: options.ociRuntimeAdapter } : {}
   }) : undefined;
-  const model = options.modelInstance ?? createProviderModel(config, options.env ?? process.env);
+  const model = options.modelInstance ?? createProviderModel(config, options.env ?? process.env, options.providerRegistry);
   const capabilityRequirements = [...new Set([
     ...config.requiredCapabilities,
     ...config.orchestration.profiles.length > 0 || config.mcpConfigPath || options.mcpConfiguration ? ["tools", "streaming"] : []
@@ -3716,7 +4750,7 @@ var createHarness = async (options = {}) => {
     await options.onTelemetryEvent?.(event);
   };
   const costGuardrails = createCostGuardrails(config);
-  const binding = createHarnessBinding(config, mcpConfiguration, model, options.subagentModels, executionEnvironment);
+  const binding = createHarnessBinding(config, mcpConfiguration, model, options.subagentModels, (options.providerRegistry ?? DEFAULT_PROVIDER_REGISTRY).transportFingerprint(options.env ?? process.env), executionEnvironment);
   const subagentRuntime = createHarnessSubagents({
     config,
     parentBinding: binding,
@@ -3847,16 +4881,25 @@ export {
   workspaceFilePathSchema,
   validateStateDirectory,
   validateEditProposal,
+  streamResultDocument,
+  streamEventDocument,
+  serializeStreamResult,
+  serializeStreamEvent,
+  serializeHarnessModelRoutes,
   selectHarnessModel,
   runHarnessReviewGroup,
   runHarness,
   restoreFileInputSchema,
+  resolveHarnessModelRoutes,
   resolveHarnessConfig,
   quarantineFileInputSchema,
   providerDescriptor,
   providerAvailability,
   parseProvider,
+  parseHarnessModelRoute,
+  openSessionStore,
   openHarnessPersistence,
+  openCliSessionStore,
   normalizeHarnessMcpConfiguration,
   mutationOperationSchema,
   mutationAuditEntrySchema,
@@ -3869,6 +4912,7 @@ export {
   harnessExecutionSession,
   fileDigestSchema,
   executionFingerprintInput,
+  estimateMessageTokens,
   editProposalSchema,
   editProposalInputSchema,
   editProposalChangeSchema,
@@ -3877,14 +4921,17 @@ export {
   editChangeSchema,
   describeOciCommand,
   defaultHarnessNamespace,
+  createProviderRegistry,
   createProviderModel,
   createHttpMcpClient,
   createHarnessSubagents,
+  createHarnessRouteModels,
   createHarnessOciExecutionEnvironment,
   createHarnessMcpTools,
   createHarness,
   createExecutionEnvironmentTools,
   createEditProposal,
+  compactHarnessMessages,
   cleanupHarnessRuns,
   cleanupHarnessExecutionArtifacts,
   cancelHarnessRun,
@@ -3892,7 +4939,9 @@ export {
   applyEditProposalInputSchema,
   appendUserMessage,
   Workspace,
+  TERMINAL_SESSION_RUN_STATUSES,
   TERMINAL_RUN_STATUSES,
+  SESSION_RUN_STATUSES,
   PROVIDER_DESCRIPTORS,
   PROVIDERS,
   MAX_EDIT_PROPOSAL_BYTES,
@@ -3902,6 +4951,8 @@ export {
   HARNESS_SUBAGENT_PROFILE_DESCRIPTORS,
   HARNESS_SUBAGENT_PROFILES,
   HARNESS_SQLITE_FILE,
+  HARNESS_SESSION_SCHEMA_VERSION,
+  HARNESS_SESSION_INDEX_FILE,
   HARNESS_REQUIRED_CAPABILITIES,
   HARNESS_OPERATIONS_SCHEMA_VERSION,
   HARNESS_OCI_RUNTIMES,
@@ -3917,8 +4968,12 @@ export {
   EDIT_DIGEST_ALGORITHM,
   EDIT_CONTRACT_SCHEMA_VERSION,
   DEFAULT_SUBAGENT_BUDGET,
+  DEFAULT_PROVIDER_REGISTRY,
   DEFAULT_OCI_EXECUTION,
   DEFAULT_ALLOWED_CHECKS,
   CliOciRuntimeAdapter,
-  BUN_ENGINE_RANGE
+  CLI_JSON_SCHEMA_VERSION,
+  CLI_EVENT_SCHEMA_VERSION,
+  BUN_ENGINE_RANGE,
+  BUILTIN_PROVIDER_REGISTRATIONS
 };