@zhivex-ai/harness 0.7.0 → 0.9.0

package/dist/hostile-repository-demo.js

@@ -323,7 +323,7 @@ var BUILTIN_PROVIDER_REGISTRATIONS = Object.freeze([
     descriptor: {
       id: "openai",
       name: "OpenAI",
-      defaultModel: "gpt-5.4",
+      defaultModel: "gpt-5.6-luna",
       credentialNames: ["OPENAI_API_KEY"],
       capabilities: HARNESS_PROVIDER_CAPABILITIES,
       support: "certified"
@@ -365,7 +365,7 @@ var HARNESS_CONFIG_SCHEMA_VERSION = 4;
 var HARNESS_STORE_BACKENDS = ["sqlite", "file"];
 var HARNESS_EXECUTION_BACKENDS = ["none", "oci"];
 var HARNESS_OCI_RUNTIMES = ["docker", "podman"];
-var HARNESS_EXECUTION_POLICY_VERSION = "2026-08-17-v1";
+var HARNESS_EXECUTION_POLICY_VERSION = "2026-08-20-v2";
 var DEFAULT_OCI_EXECUTION = {
   runtime: "docker",
   image: "oven/bun:1.3.7-slim",
@@ -650,8 +650,10 @@ var createProviderModel = (config, env = process.env, registry = DEFAULT_PROVIDE
 
 // src/execution-environment.ts
 import { createHash as createHash5, randomUUID as randomUUID2 } from "crypto";
+import { constants as fsConstants } from "fs";
 import {
   chmod,
+  copyFile,
   lstat as lstat2,
   mkdir as mkdir2,
   readFile as readFile2,
@@ -808,6 +810,10 @@ var IGNORE_FILES = [".gitignore", ".zhivex-harnessignore"];
 var DEFAULT_CHECKS = ["test", "typecheck", "lint", "build"];
 var MAX_FILE_BYTES = 1024 * 1024;
 var MAX_TOOL_OUTPUT = 20000;
+var MAX_READ_BATCH_FILES = 20;
+var MAX_READ_BATCH_BYTES = 2 * MAX_FILE_BYTES;
+var MAX_SEARCH_MANY_QUERIES = 10;
+var MAX_SEARCH_MANY_MATCHES = 500;
 var isSensitiveName = (name) => {
   const normalized = name.toLocaleLowerCase();
   return normalized === ".env" || normalized.startsWith(".env.") && normalized !== ".env.example" || normalized === ".npmrc" || normalized === "id_rsa" || normalized === "id_ed25519" || normalized.endsWith(".key") || normalized.endsWith(".pem") || normalized.endsWith(".p12") || normalized.endsWith(".pfx");
@@ -829,6 +835,30 @@ var cursorDecode = (value) => {
     throw new Error("The pagination cursor is invalid.");
   }
 };
+var firstPathAtLeast = (files, target) => {
+  let low = 0;
+  let high = files.length;
+  while (low < high) {
+    const middle = low + Math.floor((high - low) / 2);
+    if ((files[middle]?.path ?? "") < target)
+      low = middle + 1;
+    else
+      high = middle;
+  }
+  return low;
+};
+var firstPathAfter = (files, target) => {
+  let low = 0;
+  let high = files.length;
+  while (low < high) {
+    const middle = low + Math.floor((high - low) / 2);
+    if ((files[middle]?.path ?? "") <= target)
+      low = middle + 1;
+    else
+      high = middle;
+  }
+  return low;
+};
 var escapeRegex = (value) => value.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
 var globRegex = (pattern) => {
   let source = "";
@@ -920,6 +950,11 @@ var spawnBounded = async (command, cwd, timeoutMs = 120000) => {
 class Workspace {
   root;
   auditEntries = [];
+  indexIdentity = randomUUID();
+  indexRevision = 0;
+  workspaceIndex;
+  indexBuild;
+  indexMetrics = { builds: 0, reuses: 0, stableFileReads: 0 };
   constructor(root) {
     this.root = root;
   }
@@ -971,6 +1006,7 @@ class Workspace {
     return { path: candidate, exists: true };
   }
   async readStableFile(relativePath, allowBinary = true) {
+    this.indexMetrics.stableFileReads += 1;
     const safe = await this.safePath(relativePath, { requireFile: true });
     const before = await lstat(safe.path);
     if (before.size > MAX_FILE_BYTES)
@@ -990,14 +1026,40 @@ class Workspace {
       mode: before.mode & 511
     };
   }
-  async rulesForDirectory(directory, base, inherited) {
+  fingerprint(relativePath, kind, entry, digest2) {
+    return {
+      path: relativePath || ".",
+      kind,
+      dev: entry.dev,
+      ino: entry.ino,
+      size: entry.size,
+      mtimeMs: entry.mtimeMs,
+      ctimeMs: entry.ctimeMs,
+      ...digest2 ? { digest: digest2 } : {}
+    };
+  }
+  sameFingerprint(entry, fingerprint) {
+    return entry.dev === fingerprint.dev && entry.ino === fingerprint.ino && entry.size === fingerprint.size && entry.mtimeMs === fingerprint.mtimeMs && entry.ctimeMs === fingerprint.ctimeMs;
+  }
+  async rulesForDirectory(directory, base, inherited, ignoreFiles) {
     const rules = [...inherited];
     for (const filename of IGNORE_FILES) {
       try {
         const ignorePath = path3.join(directory, filename);
-        const entry = await lstat(ignorePath);
-        if (entry.isFile() && entry.size <= MAX_FILE_BYTES) {
-          rules.push(...parseIgnoreRules(await readFile(ignorePath, "utf8"), base));
+        const before = await lstat(ignorePath);
+        if (before.isSymbolicLink() || !before.isFile())
+          continue;
+        if (before.size <= MAX_FILE_BYTES) {
+          const contents = await readFile(ignorePath);
+          const after = await lstat(ignorePath);
+          if (after.isSymbolicLink() || !after.isFile() || !this.sameFingerprint(after, this.fingerprint("", "ignore-file", before))) {
+            throw new Error(`The ignore file changed while the workspace was being indexed: ${wirePath(path3.relative(this.root, ignorePath))}`);
+          }
+          const digest2 = digestBytes(contents);
+          ignoreFiles.push(this.fingerprint(wirePath(path3.relative(this.root, ignorePath)), "ignore-file", after, digest2));
+          rules.push(...parseIgnoreRules(contents.toString("utf8"), base));
+        } else {
+          ignoreFiles.push(this.fingerprint(wirePath(path3.relative(this.root, ignorePath)), "ignore-file", before));
         }
       } catch (error) {
         if (error.code !== "ENOENT")
@@ -1006,10 +1068,17 @@ class Workspace {
     }
     return rules;
   }
-  async collectFiles() {
+  async collectFiles(version) {
     const files = [];
+    const directories = [];
+    const ignoreFiles = [];
     const walk = async (directory, base, inherited) => {
-      const rules = await this.rulesForDirectory(directory, base, inherited);
+      const directoryEntry = await lstat(directory);
+      if (directoryEntry.isSymbolicLink() || !directoryEntry.isDirectory()) {
+        throw new Error(`A workspace directory changed while it was being indexed: ${base || "."}`);
+      }
+      directories.push(this.fingerprint(base, "directory", directoryEntry));
+      const rules = await this.rulesForDirectory(directory, base, inherited, ignoreFiles);
       const entries = (await readdir(directory, { withFileTypes: true })).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
       for (const entry of entries) {
         const relative = base ? `${base}/${entry.name}` : entry.name;
@@ -1019,11 +1088,99 @@ class Workspace {
         if (entry.isDirectory())
           await walk(absolute, relative, rules);
         else if (entry.isFile())
-          files.push({ path: relative, size: (await lstat(absolute)).size });
+          files.push({ path: relative });
       }
     };
     await walk(this.root, "", []);
-    return files;
+    files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    return { version, files, directories, ignoreFiles };
+  }
+  async isWorkspaceIndexFresh(index) {
+    try {
+      for (const fingerprint of index.directories) {
+        const absolute = fingerprint.path === "." ? this.root : path3.join(this.root, fingerprint.path);
+        const entry = await lstat(absolute);
+        if (entry.isSymbolicLink() || !entry.isDirectory() || !this.sameFingerprint(entry, fingerprint))
+          return false;
+      }
+      for (const fingerprint of index.ignoreFiles) {
+        const absolute = path3.join(this.root, fingerprint.path);
+        const before = await lstat(absolute);
+        if (before.isSymbolicLink() || !before.isFile() || !this.sameFingerprint(before, fingerprint))
+          return false;
+        if (fingerprint.digest) {
+          const contents = await readFile(absolute);
+          const after = await lstat(absolute);
+          if (after.isSymbolicLink() || !after.isFile() || !this.sameFingerprint(after, fingerprint) || digestBytes(contents) !== fingerprint.digest)
+            return false;
+        }
+      }
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  invalidateWorkspaceIndex() {
+    this.indexRevision += 1;
+    this.workspaceIndex = undefined;
+  }
+  async buildWorkspaceIndex(revision) {
+    const version = `${this.indexIdentity}:${revision}`;
+    for (let attempt = 0;attempt < 3; attempt += 1) {
+      try {
+        const index = await this.collectFiles(version);
+        if (await this.isWorkspaceIndexFresh(index))
+          return index;
+      } catch (error) {
+        const code = error.code;
+        const changedDuringIndexing = error instanceof Error && error.message.includes("while the workspace was being indexed");
+        if (attempt === 2 || code !== "ENOENT" && !changedDuringIndexing)
+          throw error;
+      }
+    }
+    throw new Error("The workspace kept changing while its file index was being built.");
+  }
+  async getWorkspaceIndex() {
+    const cached = this.workspaceIndex;
+    if (cached) {
+      if (await this.isWorkspaceIndexFresh(cached)) {
+        this.indexMetrics.reuses += 1;
+        return cached;
+      }
+      this.invalidateWorkspaceIndex();
+    }
+    const revision = this.indexRevision;
+    if (!this.indexBuild || this.indexBuild.revision !== revision) {
+      const promise = this.buildWorkspaceIndex(revision);
+      this.indexBuild = { revision, promise };
+    }
+    const build = this.indexBuild;
+    let index;
+    try {
+      index = await build.promise;
+    } catch (error) {
+      if (this.indexBuild === build)
+        this.indexBuild = undefined;
+      throw error;
+    }
+    if (revision !== this.indexRevision)
+      return this.getWorkspaceIndex();
+    if (this.indexBuild === build)
+      this.indexBuild = undefined;
+    if (this.workspaceIndex?.version !== index.version) {
+      this.workspaceIndex = index;
+      this.indexMetrics.builds += 1;
+    }
+    return this.workspaceIndex;
+  }
+  workspaceIndexDiagnostics() {
+    const index = this.workspaceIndex;
+    return {
+      ...this.indexMetrics,
+      ...index ? { version: index.version } : {},
+      files: index?.files.length ?? 0,
+      directories: index?.directories.length ?? 0
+    };
   }
   async listFiles(relativePath = ".", options = {}) {
     const start = await this.safePath(relativePath);
@@ -1035,36 +1192,52 @@ class Workspace {
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > 5000)
       throw new Error("limit must be between 1 and 5000.");
     let after = "";
+    let cursorIndexVersion;
     if (input.cursor) {
       const parsed = cursorDecode(input.cursor);
-      if (parsed.v !== 1 || parsed.kind !== "list" || parsed.path !== requestPath || parsed.limit !== limit || typeof parsed.after !== "string") {
+      if (parsed.v !== 2 || parsed.kind !== "list" || parsed.path !== requestPath || parsed.limit !== limit || typeof parsed.indexVersion !== "string" || typeof parsed.after !== "string") {
         throw new Error("The pagination cursor does not match this list request.");
       }
       after = parsed.after;
+      cursorIndexVersion = parsed.indexVersion;
+    }
+    const index = await this.getWorkspaceIndex();
+    if (cursorIndexVersion && cursorIndexVersion !== index.version) {
+      throw new Error("The pagination cursor is stale because the workspace changed.");
     }
     const prefix = requestPath === "." ? "" : `${requestPath}/`;
-    const candidates = (await this.collectFiles()).filter((file) => (requestPath === "." || file.path.startsWith(prefix)) && file.path > after);
-    const selected = candidates.slice(0, limit);
+    let candidateIndex = after ? firstPathAfter(index.files, after) : requestPath === "." ? 0 : firstPathAtLeast(index.files, prefix);
+    const selected = [];
+    while (candidateIndex < index.files.length && selected.length <= limit) {
+      const candidate = index.files[candidateIndex];
+      if (!candidate || requestPath !== "." && !candidate.path.startsWith(prefix))
+        break;
+      selected.push(candidate);
+      candidateIndex += 1;
+    }
+    const truncated = selected.length > limit;
+    if (truncated)
+      selected.pop();
     const files = [];
     for (const candidate of selected) {
       const file = await this.readStableFile(candidate.path);
       files.push({ path: file.path, size: file.contents.byteLength, digest: file.digest });
     }
-    const truncated = candidates.length > selected.length;
     const last = selected.at(-1);
     return {
       files,
       truncated,
-      ...truncated && last ? { nextCursor: cursorEncode({ v: 1, kind: "list", path: requestPath, limit, after: last.path }) } : {}
+      ...truncated && last ? {
+        nextCursor: cursorEncode({ v: 2, kind: "list", path: requestPath, limit, after: last.path, indexVersion: index.version })
+      } : {}
     };
   }
-  async readFile(relativePath, startLine = 1, endLine) {
+  renderReadFile(file, startLine = 1, endLine) {
     if (!Number.isSafeInteger(startLine) || startLine < 1)
       throw new Error("startLine must be a positive integer.");
     if (endLine !== undefined && (!Number.isSafeInteger(endLine) || endLine < startLine)) {
       throw new Error("endLine must be greater than or equal to startLine.");
     }
-    const file = await this.readStableFile(relativePath, false);
     const lines = file.contents.toString("utf8").split(/\r?\n/);
     const boundedEnd = Math.min(endLine ?? startLine + 399, startLine + 1999, lines.length);
     return {
@@ -1078,6 +1251,37 @@ class Workspace {
       truncated: boundedEnd < lines.length
     };
   }
+  async readFile(relativePath, startLine = 1, endLine) {
+    return this.renderReadFile(await this.readStableFile(relativePath, false), startLine, endLine);
+  }
+  async readFiles(requests) {
+    if (!Array.isArray(requests) || requests.length < 1 || requests.length > MAX_READ_BATCH_FILES) {
+      throw new Error(`readFiles requires between 1 and ${MAX_READ_BATCH_FILES} file requests.`);
+    }
+    const ordered = requests.map((request) => ({
+      ...request,
+      path: wirePath(path3.relative(this.root, this.lexicalPath(request.path)))
+    })).sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0) || (a.startLine ?? 1) - (b.startLine ?? 1) || (a.endLine ?? 0) - (b.endLine ?? 0));
+    const stableFiles = new Map;
+    let totalBytes = 0;
+    for (const request of ordered) {
+      if (!Number.isSafeInteger(request.startLine ?? 1) || (request.startLine ?? 1) < 1 || request.endLine !== undefined && (!Number.isSafeInteger(request.endLine) || request.endLine < (request.startLine ?? 1))) {
+        throw new Error(`Invalid line range for ${request.path}.`);
+      }
+      if (stableFiles.has(request.path))
+        continue;
+      const file = await this.readStableFile(request.path, false);
+      totalBytes += file.contents.byteLength;
+      if (totalBytes > MAX_READ_BATCH_BYTES) {
+        throw new Error(`readFiles exceeds the aggregate ${MAX_READ_BATCH_BYTES}-byte source limit.`);
+      }
+      stableFiles.set(request.path, file);
+    }
+    return {
+      files: ordered.map((request) => this.renderReadFile(stableFiles.get(request.path), request.startLine ?? 1, request.endLine)),
+      sourceBytes: totalBytes
+    };
+  }
   async inspectFile(relativePath) {
     const file = await this.readStableFile(relativePath);
     return {
@@ -1100,21 +1304,29 @@ class Workspace {
     const caseSensitive = options.caseSensitive ?? false;
     let afterPath = "";
     let afterLine = 0;
+    let cursorIndexVersion;
     if (options.cursor) {
       const parsed = cursorDecode(options.cursor);
-      if (parsed.v !== 1 || parsed.kind !== "search" || parsed.path !== requestPath || parsed.query !== query || parsed.caseSensitive !== caseSensitive || parsed.limit !== limit || typeof parsed.afterPath !== "string" || !Number.isSafeInteger(parsed.afterLine)) {
+      if (parsed.v !== 2 || parsed.kind !== "search" || parsed.path !== requestPath || parsed.query !== query || parsed.caseSensitive !== caseSensitive || parsed.limit !== limit || typeof parsed.afterPath !== "string" || !Number.isSafeInteger(parsed.afterLine) || typeof parsed.indexVersion !== "string") {
         throw new Error("The pagination cursor does not match this search request.");
       }
       afterPath = parsed.afterPath;
       afterLine = parsed.afterLine;
+      cursorIndexVersion = parsed.indexVersion;
+    }
+    const index = await this.getWorkspaceIndex();
+    if (cursorIndexVersion && cursorIndexVersion !== index.version) {
+      throw new Error("The pagination cursor is stale because the workspace changed.");
     }
     const prefix = requestPath === "." ? "" : `${requestPath}/`;
     const needle = caseSensitive ? query : query.toLocaleLowerCase();
     const matches = [];
     let hasMore = false;
-    for (const candidate of await this.collectFiles()) {
-      if (requestPath !== "." && !candidate.path.startsWith(prefix) || candidate.size > MAX_FILE_BYTES || candidate.path < afterPath)
-        continue;
+    let candidateIndex = afterPath ? firstPathAtLeast(index.files, afterPath) : requestPath === "." ? 0 : firstPathAtLeast(index.files, prefix);
+    for (;candidateIndex < index.files.length; candidateIndex += 1) {
+      const candidate = index.files[candidateIndex];
+      if (!candidate || requestPath !== "." && !candidate.path.startsWith(prefix))
+        break;
       let file;
       try {
         file = await this.readStableFile(candidate.path, false);
@@ -1122,11 +1334,11 @@ class Workspace {
         continue;
       }
       const lines = file.contents.toString("utf8").split(/\r?\n/);
-      for (let index = 0;index < lines.length; index += 1) {
-        const lineNumber = index + 1;
+      for (let index2 = 0;index2 < lines.length; index2 += 1) {
+        const lineNumber = index2 + 1;
         if (candidate.path === afterPath && lineNumber <= afterLine)
           continue;
-        const line = lines[index] ?? "";
+        const line = lines[index2] ?? "";
         if (!(caseSensitive ? line : line.toLocaleLowerCase()).includes(needle))
           continue;
         if (matches.length >= limit) {
@@ -1143,10 +1355,88 @@ class Workspace {
       matches,
       truncated: hasMore,
       ...hasMore && last ? {
-        nextCursor: cursorEncode({ v: 1, kind: "search", path: requestPath, query, caseSensitive, limit, afterPath: last.path, afterLine: last.line })
+        nextCursor: cursorEncode({
+          v: 2,
+          kind: "search",
+          path: requestPath,
+          query,
+          caseSensitive,
+          limit,
+          afterPath: last.path,
+          afterLine: last.line,
+          indexVersion: index.version
+        })
       } : {}
     };
   }
+  async searchMany(queries, relativePath = ".", options = {}) {
+    if (!Array.isArray(queries) || queries.length < 1 || queries.length > MAX_SEARCH_MANY_QUERIES) {
+      throw new Error(`searchMany requires between 1 and ${MAX_SEARCH_MANY_QUERIES} queries.`);
+    }
+    const limitPerQuery = options.limitPerQuery ?? 50;
+    if (!Number.isSafeInteger(limitPerQuery) || limitPerQuery < 1 || limitPerQuery > MAX_SEARCH_MANY_MATCHES || limitPerQuery * queries.length > MAX_SEARCH_MANY_MATCHES) {
+      throw new Error(`searchMany allows at most ${MAX_SEARCH_MANY_MATCHES} aggregate matches.`);
+    }
+    const seen = new Set;
+    const states = queries.map((input) => {
+      if (!input.query || input.query.length > 200)
+        throw new Error("Each search query must be between 1 and 200 characters.");
+      const caseSensitive = input.caseSensitive ?? false;
+      const key = `${caseSensitive ? "1" : "0"}\x00${input.query}`;
+      if (seen.has(key))
+        throw new Error("searchMany queries must be unique.");
+      seen.add(key);
+      return {
+        query: input.query,
+        caseSensitive,
+        needle: caseSensitive ? input.query : input.query.toLocaleLowerCase(),
+        matches: [],
+        truncated: false
+      };
+    });
+    const start = await this.safePath(relativePath);
+    if (!(await lstat(start.path)).isDirectory())
+      throw new Error("searchMany requires a directory.");
+    const requestPath = wirePath(path3.relative(this.root, start.path)) || ".";
+    const prefix = requestPath === "." ? "" : `${requestPath}/`;
+    const index = await this.getWorkspaceIndex();
+    let candidateIndex = requestPath === "." ? 0 : firstPathAtLeast(index.files, prefix);
+    for (;candidateIndex < index.files.length; candidateIndex += 1) {
+      const candidate = index.files[candidateIndex];
+      if (!candidate || requestPath !== "." && !candidate.path.startsWith(prefix))
+        break;
+      let file;
+      try {
+        file = await this.readStableFile(candidate.path, false);
+      } catch {
+        continue;
+      }
+      const lines = file.contents.toString("utf8").split(/\r?\n/);
+      for (let lineIndex = 0;lineIndex < lines.length; lineIndex += 1) {
+        const line = lines[lineIndex] ?? "";
+        const foldedLine = line.toLocaleLowerCase();
+        for (const state of states) {
+          if (state.truncated || !(state.caseSensitive ? line : foldedLine).includes(state.needle))
+            continue;
+          if (state.matches.length >= limitPerQuery) {
+            state.truncated = true;
+            continue;
+          }
+          state.matches.push({
+            path: candidate.path,
+            line: lineIndex + 1,
+            text: truncate(line, 500),
+            digest: file.digest
+          });
+        }
+      }
+      if (states.every((state) => state.truncated))
+        break;
+    }
+    return {
+      results: states.map(({ needle: _needle, ...state }) => state)
+    };
+  }
   audit(entry) {
     const record = { id: randomUUID(), timestamp: new Date().toISOString(), ...entry };
     this.auditEntries.push(record);
@@ -1310,6 +1600,7 @@ class Workspace {
         throw new AggregateError([error, ...rollbackErrors], "Patch failed and rollback was incomplete.");
       throw error;
     }
+    this.invalidateWorkspaceIndex();
     const changes = prepared.map((item) => this.audit({
       operation: item.before ? "update" : "create",
       path: item.change.path,
@@ -1370,6 +1661,7 @@ class Workspace {
         await unlink(destination.path).catch(() => {});
       throw error;
     }
+    this.invalidateWorkspaceIndex();
     const audit = this.audit({ operation: "move", path: parsed.source, destination: parsed.destination, beforeDigest: source.digest, afterDigest: source.digest });
     return { source: parsed.source, destination: parsed.destination, digest: source.digest, audit };
   }
@@ -1458,6 +1750,7 @@ class Workspace {
       await unlink(path3.join(directory, `${quarantineId}.json`)).catch(() => {});
       throw error;
     }
+    this.invalidateWorkspaceIndex();
     const audit = this.audit({ operation: "quarantine", path: parsed.path, beforeDigest: source.digest, quarantineId });
     return { quarantineId, path: parsed.path, digest: source.digest, audit };
   }
@@ -1526,6 +1819,7 @@ class Workspace {
       }
       throw rollbackErrors.length ? new AggregateError([error, ...rollbackErrors], "Restore failed and rollback was incomplete.") : error;
     }
+    this.invalidateWorkspaceIndex();
     const audit = this.audit({ operation: "restore", path: destinationPath, afterDigest: digest2, quarantineId: parsed.quarantineId });
     return { quarantineId: parsed.quarantineId, path: destinationPath, digest: digest2, audit };
   }
@@ -1546,7 +1840,11 @@ class Workspace {
       throw new Error(`package.json does not define the "${check}" script.`);
     if (scripts[check] !== expectedScript)
       throw new Error(`The "${check}" script changed or does not match expectedScript.`);
-    return spawnBounded(["bun", "--no-env-file", "run", check], this.root);
+    try {
+      return await spawnBounded(["bun", "--no-env-file", "run", check], this.root);
+    } finally {
+      this.invalidateWorkspaceIndex();
+    }
   }
   async gitDiff() {
     const [statusResult, diffResult, stagedResult] = await Promise.all([
@@ -1571,7 +1869,9 @@ var TERMINAL_STATUSES = new Set([
 var BUILT_IN_TOOL_NAMES = new Set([
   "list_files",
   "read_file",
+  "read_files",
   "search_files",
+  "search_many",
   "propose_edits",
   "apply_patch",
   "move_file",
@@ -1695,11 +1995,26 @@ var parseRuntimeVersion = (stdout, runtime) => {
 var validContainerIds = (stdout) => stdout.split(/\r?\n/).map((value) => value.trim()).filter((value) => /^[a-f0-9]{12,64}$/.test(value));
 var validVolumeNames = (stdout) => stdout.split(/\r?\n/).map((value) => value.trim()).filter((value) => /^zhivex-harness-[A-Za-z0-9_.-]+$/.test(value));
 var MAX_SYNC_ENTRIES = 1e4;
+var updateSnapshotMetadata = (target, kind, relative, entry) => {
+  target.update([
+    kind,
+    relative,
+    entry.dev,
+    entry.ino,
+    entry.size,
+    entry.mtimeMs,
+    entry.ctimeMs,
+    entry.mode & 511
+  ].join("\x00"));
+  target.update("\x00");
+};
 var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspaceBytes, maxFileWriteBytes) => {
   let entries = 0;
   let totalBytes = 0;
+  const seal = createHash5("sha256");
+  const metadata = createHash5("sha256");
   const visit = async (directory, relativeDirectory = "") => {
-    for (const name of await readdir2(directory)) {
+    for (const name of (await readdir2(directory)).sort()) {
       const relative = relativeDirectory ? `${relativeDirectory}/${name}` : name;
       const absolute = path4.join(directory, name);
       if (!isInside2(stagedRoot, absolute) || relative.length > 1024) {
@@ -1718,22 +2033,32 @@ var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspace
         throw new Error(`OCI workspace export contains a symbolic link: ${relative}.`);
       }
       if (entry.isDirectory()) {
+        updateSnapshotMetadata(metadata, "directory", relative, entry);
+        seal.update(`directory\x00${relative}\x00${entry.mode & 511}\x00`);
         await visit(absolute, relative);
         continue;
       }
       if (!entry.isFile() || entry.nlink !== 1) {
         throw new Error(`OCI workspace export contains a special or linked file: ${relative}.`);
       }
+      const contents = await readFile2(absolute);
+      const after = await lstat2(absolute);
+      if (after.isSymbolicLink() || !after.isFile() || after.nlink !== 1 || entry.dev !== after.dev || entry.ino !== after.ino || entry.size !== after.size || entry.mtimeMs !== after.mtimeMs || entry.ctimeMs !== after.ctimeMs || (entry.mode & 511) !== (after.mode & 511)) {
+        throw new Error(`OCI workspace export changed while it was being validated: ${relative}.`);
+      }
       totalBytes += entry.size;
       if (totalBytes > maxWorkspaceBytes) {
         throw new Error(`OCI workspace export exceeds the ${maxWorkspaceBytes}-byte workspace limit.`);
       }
+      const contentDigest = digest2(contents);
+      updateSnapshotMetadata(metadata, "file", relative, after);
+      seal.update(`file\x00${relative}\x00${entry.mode & 511}\x00${entry.size}\x00${contentDigest}\x00`);
       if (entry.size > maxFileWriteBytes) {
         const previous = path4.join(previousRoot, ...relative.split("/"));
         let unchanged = false;
         try {
           const previousEntry = await lstat2(previous);
-          unchanged = previousEntry.isFile() && !previousEntry.isSymbolicLink() && previousEntry.size === entry.size && digest2(await readFile2(previous)) === digest2(await readFile2(absolute));
+          unchanged = previousEntry.isFile() && !previousEntry.isSymbolicLink() && previousEntry.size === entry.size && digest2(await readFile2(previous)) === contentDigest;
         } catch (error) {
           if (error.code !== "ENOENT")
             throw error;
@@ -1745,6 +2070,51 @@ var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspace
     }
   };
   await visit(stagedRoot);
+  return {
+    entries,
+    totalBytes,
+    seal: `sha256:${seal.digest("hex")}`,
+    metadataFingerprint: `sha256:${metadata.digest("hex")}`
+  };
+};
+var snapshotMetadataFingerprint = async (root, maxWorkspaceBytes) => {
+  let entries = 0;
+  let totalBytes = 0;
+  const metadata = createHash5("sha256");
+  const visit = async (directory, relativeDirectory = "") => {
+    for (const name of (await readdir2(directory)).sort()) {
+      const relative = relativeDirectory ? `${relativeDirectory}/${name}` : name;
+      if (relative === "node_modules")
+        continue;
+      const absolute = path4.join(directory, name);
+      if (!isInside2(root, absolute) || relative.length > 1024) {
+        throw new Error(`OCI workspace snapshot contains an invalid path: ${relative}.`);
+      }
+      entries += 1;
+      if (entries > MAX_SYNC_ENTRIES) {
+        throw new Error(`OCI workspace snapshot exceeds the ${MAX_SYNC_ENTRIES}-entry limit.`);
+      }
+      const entry = await lstat2(absolute);
+      if (entry.isSymbolicLink()) {
+        throw new Error(`OCI workspace snapshot contains a symbolic link: ${relative}.`);
+      }
+      if (entry.isDirectory()) {
+        updateSnapshotMetadata(metadata, "directory", relative, entry);
+        await visit(absolute, relative);
+        continue;
+      }
+      if (!entry.isFile() || entry.nlink !== 1) {
+        throw new Error(`OCI workspace snapshot contains a special or linked file: ${relative}.`);
+      }
+      totalBytes += entry.size;
+      if (totalBytes > maxWorkspaceBytes) {
+        throw new Error(`OCI workspace snapshot exceeds the ${maxWorkspaceBytes}-byte workspace limit.`);
+      }
+      updateSnapshotMetadata(metadata, "file", relative, entry);
+    }
+  };
+  await visit(root);
+  return `sha256:${metadata.digest("hex")}`;
 };
 var replaceSnapshot = async (snapshotRoot, stagedRoot) => {
   const backupRoot = `${snapshotRoot}.${randomUUID2()}.previous`;
@@ -1759,10 +2129,42 @@ var replaceSnapshot = async (snapshotRoot, stagedRoot) => {
   }
   await rm(backupRoot, { recursive: true, force: true });
 };
+var OCI_WORKSPACE_SEAL_SCRIPT = [
+  "import { createHash } from 'node:crypto';",
+  "import { lstat, readFile, readdir, readlink, rm } from 'node:fs/promises';",
+  "import path from 'node:path';",
+  "const root='/workspace';",
+  "const seal=createHash('sha256');",
+  "const modules=path.join(root,'node_modules');",
+  "if(process.env.ZHIVEX_HARNESS_HAS_DEPENDENCIES==='1'){const entry=await lstat(modules);if(!entry.isSymbolicLink()||(await readlink(modules))!=='/dependencies')throw new Error('read-only dependency mount was replaced');}else{await rm(modules,{recursive:true,force:true});}",
+  "const digest=(value)=>`sha256:${createHash('sha256').update(value).digest('hex')}`;",
+  "const same=(before,after)=>before.dev===after.dev&&before.ino===after.ino&&before.size===after.size&&before.mtimeMs===after.mtimeMs&&before.ctimeMs===after.ctimeMs&&(before.mode&0o777)===(after.mode&0o777);",
+  "const visit=async(directory,base='')=>{",
+  "for(const name of (await readdir(directory)).sort()){",
+  "const relative=base?`${base}/${name}`:name;",
+  "if(relative==='node_modules')continue;",
+  "const absolute=path.join(directory,name);",
+  "const entry=await lstat(absolute);",
+  "if(entry.isSymbolicLink())throw new Error(`symbolic link: ${relative}`);",
+  "if(entry.isDirectory()){seal.update(`directory\\0${relative}\\0${entry.mode&0o777}\\0`);await visit(absolute,relative);continue;}",
+  "if(!entry.isFile()||entry.nlink!==1)throw new Error(`special or linked file: ${relative}`);",
+  "const contents=await readFile(absolute);",
+  "const after=await lstat(absolute);",
+  "if(!same(entry,after))throw new Error(`changed while sealing: ${relative}`);",
+  "seal.update(`file\\0${relative}\\0${entry.mode&0o777}\\0${entry.size}\\0${digest(contents)}\\0`);",
+  "}",
+  "};",
+  "await visit(root);",
+  "for(const name of await readdir('/tmp'))await rm(path.join('/tmp',name),{recursive:true,force:true});",
+  "console.log(`sha256:${seal.digest('hex')}`);"
+].join("");
+var OCI_SESSION_CONTROLLER_SCRIPT = "setInterval(()=>{},2147483647);";
 
 class CliOciRuntimeAdapter {
   runtime;
   hostEnvironment;
+  sessions = new Map;
+  runQueues = new Map;
   constructor(runtime) {
     this.runtime = runtime;
     this.hostEnvironment = Object.fromEntries(["DOCKER_CONFIG", "DOCKER_CONTEXT", "DOCKER_HOST", "HOME", "PATH", "XDG_RUNTIME_DIR"].flatMap((name) => process.env[name] ? [[name, process.env[name]]] : []));
@@ -1815,10 +2217,44 @@ ${result.stdout}`)) {
       throw new Error(`${this.runtime} could not remove OCI workspace volume ${name}: ${result.stderr.trim()}`);
     }
   }
-  async run(request) {
+  requestFingerprint(request) {
+    return digest2(JSON.stringify({
+      runId: request.runId,
+      snapshotRoot: request.snapshotRoot,
+      dependencyRoot: request.dependencyRoot ?? null,
+      imageId: request.imageId,
+      limits: request.limits
+    }));
+  }
+  async withRunLock(runId, operation) {
+    const key = runHash(runId);
+    const previous = this.runQueues.get(key) ?? Promise.resolve();
+    let release;
+    const gate = new Promise((resolve) => {
+      release = resolve;
+    });
+    const tail = previous.then(() => gate, () => gate);
+    this.runQueues.set(key, tail);
+    await previous.catch(() => {
+      return;
+    });
+    try {
+      return await operation();
+    } finally {
+      release();
+      if (this.runQueues.get(key) === tail)
+        this.runQueues.delete(key);
+    }
+  }
+  async destroySession(session) {
+    if (this.sessions.get(session.key) === session)
+      this.sessions.delete(session.key);
+    await this.forceRemove(session.name);
+    await this.removeVolume(session.volumeName);
+  }
+  async createSession(request, requestFingerprint, snapshotSeal, hostFingerprint) {
     const resourceName = `zhivex-harness-${runHash(request.runId)}-${randomUUID2().slice(0, 8)}`;
     const name = `${resourceName}-job`;
-    const exportName = `${resourceName}-export`;
     const volumeName = `${resourceName}-workspace`;
     const uid = process.getuid?.() ?? 65532;
     const gid = process.getgid?.() ?? 65532;
@@ -1874,8 +2310,6 @@ ${result.stdout}`)) {
       "BUN_INSTALL_CACHE_DIR=/tmp/bun-cache",
       "--env",
       "CI=1",
-      "--volume",
-      `${request.snapshotRoot}:/seed:ro`,
       ...request.dependencyRoot ? ["--volume", `${request.dependencyRoot}:/dependencies:ro`] : [],
       "--workdir",
       "/workspace",
@@ -1883,26 +2317,19 @@ ${result.stdout}`)) {
       "bun",
       request.imageId,
       "-e",
-      `await Bun.sleep(${request.limits.maxProcessRuntimeMs + 60000})`
+      OCI_SESSION_CONTROLLER_SCRIPT
     ];
-    let forcedRemoval;
-    const forceRemove = () => {
-      forcedRemoval ??= this.forceRemove(name);
-    };
+    let volumeCreated = false;
     try {
       await this.cli(volumeArgs);
+      volumeCreated = true;
       await this.cli(args);
       await this.cli(["start", name]);
       await this.cli([
-        "exec",
-        "--workdir",
-        "/workspace",
-        "--user",
-        `${uid}:${gid}`,
-        name,
-        "bun",
-        "-e",
-        "import { cp } from 'node:fs/promises'; await cp('/seed', '/workspace', { recursive: true, force: false, errorOnExist: true })"
+        "cp",
+        "-a",
+        `${request.snapshotRoot}${path4.sep}.`,
+        `${name}:/workspace`
       ], 60000);
       if (request.dependencyRoot) {
         await this.cli([
@@ -1917,88 +2344,183 @@ ${result.stdout}`)) {
           "import { symlink } from 'node:fs/promises'; await symlink('/dependencies', '/workspace/node_modules', 'dir')"
         ]);
       }
-      const result = await spawnBounded2([
-        this.runtime,
+      await this.cli(["pause", name]);
+      const session = {
+        key: runHash(request.runId),
+        requestFingerprint,
+        name,
+        volumeName,
+        snapshotSeal,
+        hostFingerprint,
+        paused: true
+      };
+      this.sessions.set(session.key, session);
+      return session;
+    } catch (error) {
+      await this.forceRemove(name);
+      if (volumeCreated)
+        await this.removeVolume(volumeName).catch(() => {
+          return;
+        });
+      throw error;
+    }
+  }
+  async onlyControllerProcessRemains(session) {
+    const result = await this.cli(this.runtime === "podman" ? ["top", session.name, "pid"] : ["top", session.name, "-eo", "pid"]);
+    const processIds = result.stdout.split(/\r?\n/).filter((line) => /^\s*\d+\s*$/.test(line));
+    return processIds.length === 1;
+  }
+  async containerWorkspaceSeal(session, uid, gid, hasDependencies) {
+    if (session.paused) {
+      await this.cli(["unpause", session.name]);
+      session.paused = false;
+    }
+    try {
+      const result = await this.cli([
         "exec",
         "--workdir",
         "/workspace",
         "--user",
         `${uid}:${gid}`,
-        name,
-        ...request.command
-      ], {
-        env: this.hostEnvironment,
-        timeoutMs: request.limits.maxProcessRuntimeMs,
-        maxOutputBytes: request.limits.maxProcessOutputBytes,
-        ...request.abortSignal ? { abortSignal: request.abortSignal } : {},
-        onStop: forceRemove
-      });
-      if (result.timedOut || result.cancelled || result.outputLimitExceeded) {
-        forceRemove();
-        await forcedRemoval;
-      } else if (result.exitCode === 0) {
-        await this.cli(["pause", name]);
-        const stagedRoot = path4.join(path4.dirname(request.snapshotRoot), `.workspace-sync-${randomUUID2()}`);
-        try {
-          await privateDirectory(stagedRoot);
-          try {
-            await this.cli([
-              "run",
-              "--rm",
-              "--name",
-              exportName,
-              "--label",
-              `${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
-              "--label",
-              `com.zhivex.harness.run=${runHash(request.runId)}`,
-              "--network",
-              "none",
-              "--read-only",
-              "--cap-drop",
-              "ALL",
-              "--security-opt",
-              "no-new-privileges",
-              "--pids-limit",
-              "32",
-              "--memory",
-              "256m",
-              "--cpus",
-              "1",
-              "--tmpfs",
-              "/tmp:rw,noexec,nosuid,nodev,size=16m",
-              "--user",
-              `${uid}:${gid}`,
-              "--volume",
-              `${volumeName}:/workspace:ro`,
-              "--volume",
-              `${stagedRoot}:/export:rw`,
-              "--workdir",
-              "/workspace",
-              "--entrypoint",
-              "bun",
-              request.imageId,
-              "-e",
-              "import { cp } from 'node:fs/promises'; await cp('/workspace', '/export', { recursive: true, force: false, errorOnExist: true })"
-            ], 60000);
-          } finally {
-            await this.forceRemove(exportName);
-          }
-          await validateSynchronizedSnapshot(stagedRoot, request.snapshotRoot, request.limits.maxWorkspaceBytes, request.limits.maxFileWriteBytes);
-          await replaceSnapshot(request.snapshotRoot, stagedRoot);
-        } finally {
-          await rm(stagedRoot, { recursive: true, force: true });
-        }
+        "--env",
+        `ZHIVEX_HARNESS_HAS_DEPENDENCIES=${hasDependencies ? "1" : "0"}`,
+        session.name,
+        "bun",
+        "-e",
+        OCI_WORKSPACE_SEAL_SCRIPT
+      ], 60000, 20000);
+      const seal = result.stdout.trim();
+      if (!/^sha256:[a-f0-9]{64}$/.test(seal)) {
+        throw new Error("OCI workspace seal helper returned an invalid digest.");
       }
-      return {
-        ...result,
-        command: request.command
-      };
+      return seal;
     } finally {
+      if (!session.paused) {
+        await this.cli(["pause", session.name]);
+        session.paused = true;
+      }
+    }
+  }
+  async runInSession(request, session, sessionReused) {
+    const uid = process.getuid?.() ?? 65532;
+    const gid = process.getgid?.() ?? 65532;
+    if (session.paused) {
+      await this.cli(["unpause", session.name]);
+      session.paused = false;
+    }
+    let forcedRemoval;
+    const forceRemove = () => {
+      forcedRemoval ??= this.forceRemove(session.name);
+    };
+    const result = await spawnBounded2([
+      this.runtime,
+      "exec",
+      "--workdir",
+      "/workspace",
+      "--user",
+      `${uid}:${gid}`,
+      session.name,
+      ...request.command
+    ], {
+      env: this.hostEnvironment,
+      timeoutMs: request.limits.maxProcessRuntimeMs,
+      maxOutputBytes: request.limits.maxProcessOutputBytes,
+      ...request.abortSignal ? { abortSignal: request.abortSignal } : {},
+      onStop: forceRemove
+    });
+    if (result.exitCode !== 0 || result.timedOut || result.cancelled || result.outputLimitExceeded) {
       forceRemove();
       await forcedRemoval;
-      await this.removeVolume(volumeName);
+      await this.destroySession(session);
+      return {
+        ...result,
+        command: request.command,
+        sessionReused,
+        workspacePublished: false,
+        workspaceExported: false
+      };
+    }
+    try {
+      if (!await this.onlyControllerProcessRemains(session)) {
+        await this.destroySession(session);
+        return {
+          ...result,
+          command: request.command,
+          exitCode: 126,
+          stderr: [
+            result.stderr,
+            "OCI command left background processes running; its workspace changes were discarded."
+          ].filter(Boolean).join(`
+`),
+          sessionReused,
+          workspacePublished: false,
+          workspaceExported: false
+        };
+      }
+      const workspaceSeal = await this.containerWorkspaceSeal(session, uid, gid, Boolean(request.dependencyRoot));
+      if (workspaceSeal === session.snapshotSeal) {
+        return {
+          ...result,
+          command: request.command,
+          sessionReused,
+          workspacePublished: true,
+          workspaceExported: false
+        };
+      }
+      const stagedRoot = path4.join(path4.dirname(request.snapshotRoot), `.workspace-sync-${randomUUID2()}`);
+      try {
+        await privateDirectory(stagedRoot);
+        await this.cli(["cp", `${session.name}:/workspace/.`, stagedRoot], 60000);
+        const validated = await validateSynchronizedSnapshot(stagedRoot, request.snapshotRoot, request.limits.maxWorkspaceBytes, request.limits.maxFileWriteBytes);
+        await replaceSnapshot(request.snapshotRoot, stagedRoot);
+        session.snapshotSeal = validated.seal;
+        session.hostFingerprint = validated.metadataFingerprint;
+      } finally {
+        await rm(stagedRoot, { recursive: true, force: true });
+      }
+      return {
+        ...result,
+        command: request.command,
+        sessionReused,
+        workspacePublished: true,
+        workspaceExported: true
+      };
+    } catch (error) {
+      await this.destroySession(session);
+      throw error;
     }
   }
+  async runLocked(request) {
+    const key = runHash(request.runId);
+    const requestFingerprint = this.requestFingerprint(request);
+    let session = this.sessions.get(key);
+    let sessionReused = Boolean(session);
+    let validated;
+    if (session) {
+      const hostFingerprint = await snapshotMetadataFingerprint(request.snapshotRoot, request.limits.maxWorkspaceBytes);
+      if (session.requestFingerprint !== requestFingerprint || session.hostFingerprint !== hostFingerprint) {
+        await this.destroySession(session);
+        session = undefined;
+        sessionReused = false;
+      }
+    }
+    if (!session) {
+      validated = await validateSynchronizedSnapshot(request.snapshotRoot, request.snapshotRoot, request.limits.maxWorkspaceBytes, request.limits.maxFileWriteBytes);
+      session = await this.createSession(request, requestFingerprint, validated.seal, validated.metadataFingerprint);
+    }
+    try {
+      return await this.runInSession(request, session, sessionReused);
+    } catch (error) {
+      if (this.sessions.get(key) === session)
+        await this.destroySession(session).catch(() => {
+          return;
+        });
+      throw error;
+    }
+  }
+  async run(request) {
+    return this.withRunLock(request.runId, () => this.runLocked(request));
+  }
   async removeByFilters(filters) {
     const listed = await spawnBounded2([this.runtime, "ps", "-aq", ...filters.flatMap((filter) => ["--filter", filter])], {
       env: this.hostEnvironment,
@@ -2044,15 +2566,23 @@ ${result.stdout}`)) {
     return removed;
   }
   async removeRunContainers(runId) {
+    const key = runHash(runId);
+    const session = this.sessions.get(key);
+    let cachedResources = 0;
+    if (session) {
+      await this.destroySession(session);
+      cachedResources = 2;
+    }
     const filters = [
       `label=${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
-      `label=com.zhivex.harness.run=${runHash(runId)}`
+      `label=com.zhivex.harness.run=${key}`
     ];
     const containers = await this.removeByFilters(filters);
     const volumes = await this.removeVolumesByFilters(filters);
-    return containers + volumes;
+    return cachedResources + containers + volumes;
   }
   async cleanupOrphans() {
+    this.sessions.clear();
     let removed = 0;
     for (const status of ["created", "exited", "dead", "paused"]) {
       removed += await this.removeByFilters([
@@ -2066,34 +2596,81 @@ ${result.stdout}`)) {
     return removed;
   }
 }
-var collectSnapshotFiles = async (workspace) => {
+var SNAPSHOT_INVENTORY_PAGE_SIZE = 5000;
+var COPY_ON_WRITE_UNSUPPORTED_CODES = new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"]);
+var collectSnapshotInventory = async (workspace, metrics) => {
   const files = new Map;
+  if (metrics)
+    metrics.inventoryPasses += 1;
   let cursor;
   do {
-    const page = await workspace.listFiles(".", { limit: 500, ...cursor ? { cursor } : {} });
+    const page = await workspace.listFiles(".", {
+      limit: SNAPSHOT_INVENTORY_PAGE_SIZE,
+      ...cursor ? { cursor } : {}
+    });
+    if (metrics)
+      metrics.inventoryPages += 1;
     for (const file of page.files) {
       const absolute = path4.join(workspace.root, ...file.path.split("/"));
       if (!isInside2(workspace.root, absolute))
         throw new Error(`Snapshot file escaped its workspace: ${file.path}.`);
-      const before = await lstat2(absolute);
-      if (before.isSymbolicLink() || !before.isFile())
+      const entry = await lstat2(absolute);
+      if (entry.isSymbolicLink() || !entry.isFile()) {
         throw new Error(`Snapshot source is not a regular file: ${file.path}.`);
-      const contents = await readFile2(absolute);
-      const after = await lstat2(absolute);
-      if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
-        throw new Error(`Snapshot source changed while reading: ${file.path}.`);
       }
-      if (digest2(contents) !== file.digest)
-        throw new Error(`Snapshot digest changed while reading: ${file.path}.`);
-      files.set(file.path, { path: file.path, digest: file.digest, contents, mode: before.mode & 511 });
+      if (entry.size !== file.size) {
+        throw new Error(`Snapshot source changed while inventorying: ${file.path}.`);
+      }
+      files.set(file.path, {
+        path: file.path,
+        digest: file.digest,
+        mode: entry.mode & 511,
+        bytes: file.size
+      });
     }
     cursor = page.nextCursor;
   } while (cursor);
   return files;
 };
-var copyWorkspaceSnapshot = async (source, baseRoot, snapshotRoot, maxWorkspaceBytes) => {
-  const files = await collectSnapshotFiles(source);
-  const totalBytes = [...files.values()].reduce((total, file) => total + file.contents.byteLength, 0);
+var readSnapshotFile = async (workspace, expected, metrics) => {
+  const absolute = path4.join(workspace.root, ...expected.path.split("/"));
+  if (!isInside2(workspace.root, absolute)) {
+    throw new Error(`Snapshot file escaped its workspace: ${expected.path}.`);
+  }
+  const before = await lstat2(absolute);
+  if (before.isSymbolicLink() || !before.isFile()) {
+    throw new Error(`Snapshot source is not a regular file: ${expected.path}.`);
+  }
+  const contents = await readFile2(absolute);
+  const after = await lstat2(absolute);
+  if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || (before.mode & 511) !== (after.mode & 511)) {
+    throw new Error(`Snapshot source changed while reading: ${expected.path}.`);
+  }
+  const actualDigest = digest2(contents);
+  if (actualDigest !== expected.digest || contents.byteLength !== expected.bytes || (before.mode & 511) !== expected.mode) {
+    throw new Error(`Snapshot source changed after inventory: ${expected.path}.`);
+  }
+  if (metrics) {
+    metrics.verifiedContentReads += 1;
+    metrics.verifiedContentBytes += contents.byteLength;
+  }
+  return { ...expected, contents };
+};
+var copySnapshotFile = async (source, target, metrics) => {
+  try {
+    await copyFile(source, target, fsConstants.COPYFILE_FICLONE_FORCE);
+  } catch (error) {
+    const code = error.code;
+    if (!code || !COPY_ON_WRITE_UNSUPPORTED_CODES.has(code))
+      throw error;
+    if (metrics)
+      metrics.snapshotCloneFallbacks += 1;
+    await copyFile(source, target);
+  }
+};
+var copyWorkspaceSnapshot = async (source, baseRoot, snapshotRoot, maxWorkspaceBytes, metrics) => {
+  const files = await collectSnapshotInventory(source, metrics);
+  const totalBytes = [...files.values()].reduce((total, file) => total + file.bytes, 0);
   if (totalBytes > maxWorkspaceBytes) {
     throw new Error(`Workspace snapshot exceeds the ${maxWorkspaceBytes}-byte OCI limit.`);
   }
@@ -2101,13 +2678,22 @@ var copyWorkspaceSnapshot = async (source, baseRoot, snapshotRoot, maxWorkspaceB
     await rm(root, { recursive: true, force: true });
     await privateDirectory(root);
   }
-  for (const file of files.values()) {
-    for (const root of [baseRoot, snapshotRoot]) {
-      const target = path4.join(root, ...file.path.split("/"));
-      await mkdir2(path4.dirname(target), { recursive: true, mode: 448 });
-      await writeFile(target, file.contents, { mode: file.mode });
-      await chmod(target, file.mode);
-    }
+  for (const expected of files.values()) {
+    const file = await readSnapshotFile(source, expected, metrics);
+    const baseTarget = path4.join(baseRoot, ...file.path.split("/"));
+    const snapshotTarget = path4.join(snapshotRoot, ...file.path.split("/"));
+    await Promise.all([
+      mkdir2(path4.dirname(baseTarget), { recursive: true, mode: 448 }),
+      mkdir2(path4.dirname(snapshotTarget), { recursive: true, mode: 448 })
+    ]);
+    await writeFile(baseTarget, file.contents, { mode: file.mode });
+    await chmod(baseTarget, file.mode);
+    await copySnapshotFile(baseTarget, snapshotTarget, metrics);
+    await chmod(snapshotTarget, file.mode);
+  }
+  if (metrics) {
+    metrics.snapshotFiles += files.size;
+    metrics.snapshotBytes += totalBytes;
   }
   return { files: files.size, bytes: totalBytes };
 };
@@ -2126,9 +2712,11 @@ var textContent = (file, maxFileWriteBytes) => {
   }
   return file.contents.toString("utf8");
 };
-var createEnvironmentPatch = async (runId, base, current, maxFileWriteBytes) => {
-  const before = await collectSnapshotFiles(base);
-  const after = await collectSnapshotFiles(current);
+var createEnvironmentPatch = async (runId, base, current, maxFileWriteBytes, metrics) => {
+  const [before, after] = await Promise.all([
+    collectSnapshotInventory(base, metrics),
+    collectSnapshotInventory(current, metrics)
+  ]);
   const paths = [...new Set([...before.keys(), ...after.keys()])].sort();
   const entries = [];
   let totalBytes = 0;
@@ -2138,9 +2726,9 @@ var createEnvironmentPatch = async (runId, base, current, maxFileWriteBytes) =>
     if (oldFile?.digest === newFile?.digest && oldFile?.mode === newFile?.mode)
       continue;
     const operation = !oldFile ? "create" : !newFile ? "delete" : "update";
-    const beforeContent = oldFile ? textContent(oldFile, maxFileWriteBytes) : undefined;
-    const afterContent = newFile ? textContent(newFile, maxFileWriteBytes) : undefined;
-    const bytes = newFile?.contents.byteLength ?? 0;
+    const beforeContent = oldFile ? textContent(await readSnapshotFile(base, oldFile, metrics), maxFileWriteBytes) : undefined;
+    const afterContent = newFile ? textContent(await readSnapshotFile(current, newFile, metrics), maxFileWriteBytes) : undefined;
+    const bytes = newFile?.bytes ?? 0;
     totalBytes += bytes;
     entries.push({
       path: filePath,
@@ -2180,8 +2768,8 @@ var inspectHostPrecondition = async (workspace, filePath, expectedDigest, expect
     throw error;
   }
 };
-var importPatch = async (runId, expectedPatchId, host, base, current, maxFileWriteBytes) => {
-  const patch = await createEnvironmentPatch(runId, base, current, maxFileWriteBytes);
+var importPatch = async (runId, expectedPatchId, host, base, current, maxFileWriteBytes, metrics) => {
+  const patch = await createEnvironmentPatch(runId, base, current, maxFileWriteBytes, metrics);
   if (patch.patchId !== expectedPatchId) {
     throw new Error("Environment patch changed after review; inspect it again before import.");
   }
@@ -2275,7 +2863,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
     version: `${HARNESS_EXECUTION_POLICY_VERSION}:${image.imageDigest}`,
     backend: "container",
     assurance: "enforced",
-    isolation: "per-tool-call",
+    isolation: "per-run",
     workspace: {
       id: workspaceIdentity,
       root: "/workspace",
@@ -2312,6 +2900,8 @@ var createHarnessOciExecutionEnvironment = async (options) => {
       maxPids: options.config.maxPids,
       maxCpus: options.config.maxCpus,
       tmpfsMb: options.config.tmpfsMb,
+      containerLifecycle: "warm-per-acquired-run",
+      failedCommandRecovery: "discard-and-reseed",
       patchImportApproval: true,
       hostMutationMode: "reviewed-environment-patch"
     }
@@ -2323,6 +2913,19 @@ var createHarnessOciExecutionEnvironment = async (options) => {
     image,
     runtime,
     async acquire(request) {
+      const ioMetrics = {
+        inventoryPasses: 0,
+        inventoryPages: 0,
+        verifiedContentReads: 0,
+        verifiedContentBytes: 0,
+        snapshotFiles: 0,
+        snapshotBytes: 0,
+        snapshotCloneFallbacks: 0,
+        containerStarts: 0,
+        containerReuses: 0,
+        workspacePublishes: 0,
+        workspaceExports: 0
+      };
       await privateDirectory(environmentRoot);
       const directory = path4.join(environmentRoot, runHash(request.runId));
       await privateDirectory(directory);
@@ -2341,7 +2944,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
       } catch (error) {
         if (error.code !== "ENOENT")
           throw error;
-        const snapshot = await copyWorkspaceSnapshot(options.workspace, baseRoot, snapshotRoot, options.config.maxWorkspaceBytes);
+        const snapshot = await copyWorkspaceSnapshot(options.workspace, baseRoot, snapshotRoot, options.config.maxWorkspaceBytes, ioMetrics);
         const now = new Date().toISOString();
         metadata = {
           schemaVersion: HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
@@ -2398,6 +3001,14 @@ var createHarnessOciExecutionEnvironment = async (options) => {
           },
           ...context?.abortSignal ?? request.abortSignal ? { abortSignal: context?.abortSignal ?? request.abortSignal } : {}
         });
+        if (result.sessionReused === false)
+          ioMetrics.containerStarts += 1;
+        if (result.sessionReused === true)
+          ioMetrics.containerReuses += 1;
+        if (result.workspacePublished === true)
+          ioMetrics.workspacePublishes += 1;
+        if (result.workspaceExported === true)
+          ioMetrics.workspaceExports += 1;
         const forcedExitCode = result.cancelled ? 130 : result.timedOut ? 124 : result.outputLimitExceeded ? 125 : result.exitCode;
         return {
           command: result.command,
@@ -2444,7 +3055,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
           return await operation();
         },
         async status() {
-          const patch = await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes);
+          const patch = await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes, ioMetrics);
           return {
             schemaVersion: HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
             kind: "environment-status",
@@ -2458,7 +3069,8 @@ var createHarnessOciExecutionEnvironment = async (options) => {
             rootFilesystem: "read-only",
             workspace: "ephemeral-snapshot",
             patchId: patch.patchId,
-            changedFiles: patch.entries.length
+            changedFiles: patch.entries.length,
+            io: { ...ioMetrics }
           };
         },
         runCommand,
@@ -2483,7 +3095,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
           return runCommand("bun", ["--no-env-file", "run", check], context);
         },
         async inspectPatch() {
-          const patch = await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes);
+          const patch = await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes, ioMetrics);
           const payload = patchPayload(request.runId, patch.entries);
           return {
             ...payload,
@@ -2492,7 +3104,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
           };
         },
         importPatch(host, patchId) {
-          return importPatch(request.runId, patchId, host, base, workspace, options.config.maxFileWriteBytes);
+          return importPatch(request.runId, patchId, host, base, workspace, options.config.maxFileWriteBytes, ioMetrics);
         },
         async release(result) {
           await runtime.removeRunContainers(request.runId);
@@ -3311,7 +3923,7 @@ var HARNESS_SUBAGENT_PROFILE_DESCRIPTORS = [
     toolName: "delegate_explorer",
     description: "Delegate bounded repository discovery to a read-only explorer.",
     instructions: "Inspect the repository with read-only tools. Return evidence with paths and concrete findings. Never propose or perform mutations.",
-    toolNames: ["list_files", "read_file", "search_files", "git_diff"]
+    toolNames: ["list_files", "read_file", "read_files", "search_files", "search_many", "git_diff"]
   },
   {
     id: "implementer",
@@ -3325,14 +3937,14 @@ var HARNESS_SUBAGENT_PROFILE_DESCRIPTORS = [
     toolName: "delegate_tester",
     description: "Delegate focused verification to a tester with read-only inspection and approved Bun checks.",
     instructions: "Verify the delegated behavior with repository evidence and declared Bun checks. Do not edit files. Report exact failures and limits.",
-    toolNames: ["list_files", "read_file", "search_files", "run_check", "git_diff"]
+    toolNames: ["list_files", "read_file", "read_files", "search_files", "search_many", "run_check", "git_diff"]
   },
   {
     id: "reviewer",
     toolName: "delegate_reviewer",
     description: "Delegate an independent read-only review of correctness, safety, and regressions.",
     instructions: "Review the requested scope independently. Inspect concrete code and diffs, prioritize actionable defects, and do not mutate the workspace.",
-    toolNames: ["list_files", "read_file", "search_files", "mutation_audit", "git_diff"]
+    toolNames: ["list_files", "read_file", "read_files", "search_files", "search_many", "mutation_audit", "git_diff"]
   }
 ];
 var pickTools = (tools, names) => {
@@ -3429,7 +4041,7 @@ var createHarnessSubagents = (options) => {
 
 // src/harness.ts
 var APPROVAL_VERSION = "2026-08-17-v5";
-var TOOL_CONTRACT_VERSION = "enforced-execution-v1";
+var TOOL_CONTRACT_VERSION = "workspace-batch-v2";
 var createHarnessBinding = (config, mcpConfiguration, model, subagentModels, providerTransportFingerprint, executionEnvironment) => ({
   schemaVersion: 1,
   id: "zhivex-harness",
@@ -3459,11 +4071,12 @@ var HARNESS_INSTRUCTIONS = `You are Zhivex Harness, a provider-portable coding a
 
 Rules:
 - Match the user's language.
-- Inspect the repository before proposing changes. Prefer search_files and read_file over assumptions.
+- Inspect the repository before proposing changes. Prefer search_many and read_files for independent lookups, then use search_files or read_file when pagination or one focused read is clearer.
 - Use only workspace-relative paths. Never request or expose secrets.
 - Make the smallest coherent change that fully addresses the task.
 - For every file edit, first read its digest and call propose_edits. Apply exactly that reviewed proposal with apply_patch.
 - apply_patch, move_file, quarantine_file, restore_file, and run_check require explicit approval from the operator.
+- Calling an approval-gated tool is how you request that approval: call the tool with its complete reviewed arguments, then let the runtime pause before execution. Never replace the tool call with a textual approval request.
 - With enforced OCI execution enabled, workspace tools operate on an ephemeral snapshot. Use inspect_environment_patch and obtain a separate approval through apply_environment_patch before changing the host workspace.
 - run_environment_command executes one allowlisted argv command without a host shell. Network, privileges, resources, environment variables, and output are bounded by the OCI policy.
 - Never overwrite stale content. If an expected digest no longer matches, inspect the file again and create a new proposal.
@@ -3530,6 +4143,23 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
     metadata: readOnlyMetadata,
     execute: async ({ path: path8, startLine, endLine }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).readFile(path8, startLine, endLine))
   }),
+  read_files: tool({
+    name: "read_files",
+    description: "Read up to 20 independent UTF-8 file slices in one bounded call. Duplicate paths are read once and results use deterministic path/range order.",
+    schema: z3.object({
+      files: z3.array(z3.object({
+        path: z3.string().min(1),
+        startLine: z3.number().int().min(1).default(1),
+        endLine: z3.number().int().min(1).optional()
+      })).min(1).max(20)
+    }),
+    metadata: readOnlyMetadata,
+    execute: async ({ files }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).readFiles(files.map(({ path: path8, startLine, endLine }) => ({
+      path: path8,
+      startLine,
+      ...endLine !== undefined ? { endLine } : {}
+    }))))
+  }),
   search_files: tool({
     name: "search_files",
     description: "Search for a literal string in text files using a stable cursor.",
@@ -3547,6 +4177,28 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
       ...cursor ? { cursor } : {}
     }))
   }),
+  search_many: tool({
+    name: "search_many",
+    description: "Search up to 10 independent literal queries in one workspace pass, with at most 500 aggregate matches.",
+    schema: z3.object({
+      queries: z3.array(z3.object({
+        query: z3.string().min(1).max(200),
+        caseSensitive: z3.boolean().default(false)
+      })).min(1).max(10),
+      path: z3.string().min(1).default("."),
+      limitPerQuery: z3.number().int().min(1).max(500).default(50)
+    }).superRefine((input, context) => {
+      if (input.queries.length * input.limitPerQuery > 500) {
+        context.addIssue({
+          code: "custom",
+          path: ["limitPerQuery"],
+          message: "search_many allows at most 500 aggregate matches."
+        });
+      }
+    }),
+    metadata: readOnlyMetadata,
+    execute: async ({ queries, path: path8, limitPerQuery }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).searchMany(queries, path8, { limitPerQuery }))
+  }),
   propose_edits: tool({
     name: "propose_edits",
     description: "Validate a bounded multi-file edit against current SHA-256 digests and return a deterministic proposalId for operator review. This tool does not write files.",
@@ -3559,7 +4211,7 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
   }),
   apply_patch: tool({
     name: "apply_patch",
-    description: "Atomically apply one reviewed multi-file proposal. Every existing file requires its exact expected digest; expectedDigest=null is create-only.",
+    description: "Request approval to atomically apply one reviewed multi-file proposal; the runtime pauses before execution. Every existing file requires its exact expected digest; expectedDigest=null is create-only. Call this tool instead of asking for approval in text.",
     schema: applyEditProposalInputSchema,
     ...mutationApproval,
     execute: async (input, context) => {