@zhivex-ai/harness 0.8.0 → 0.10.0

package/dist/package-manager.d.ts

@@ -0,0 +1,17 @@
+export declare const HARNESS_PACKAGE_MANAGERS: readonly ["npm", "pnpm", "yarn", "bun"];
+export type HarnessPackageManager = (typeof HARNESS_PACKAGE_MANAGERS)[number];
+export interface PackageManagerResolution {
+    manager: HarnessPackageManager;
+    source: "packageManager" | "lockfile" | "default";
+    evidence?: string;
+}
+export interface PackageCheckCommand extends PackageManagerResolution {
+    command: [string, ...string[]];
+}
+interface PackageManifestLike {
+    packageManager?: unknown;
+    scripts?: unknown;
+}
+export declare const resolvePackageManager: (root: string, manifest: PackageManifestLike) => Promise<PackageManagerResolution>;
+export declare const resolvePackageCheckCommand: (root: string, manifest: PackageManifestLike, check: string, expectedScript: string, allowedChecks: readonly string[]) => Promise<PackageCheckCommand>;
+export {};

package/dist/process-runtime.d.ts

@@ -0,0 +1,16 @@
+export interface PortableProcessResult {
+    command: string[];
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+}
+export interface RunPortableProcessOptions {
+    cwd?: string;
+    env?: Readonly<Record<string, string | undefined>>;
+    timeoutMs?: number;
+    maxOutputCharacters?: number;
+    signal?: AbortSignal;
+    stderr?: "pipe" | "ignore";
+}
+export declare const runPortableProcess: (command: readonly string[], options?: RunPortableProcessOptions) => Promise<PortableProcessResult>;

package/dist/sqlite-database.d.ts

@@ -0,0 +1,23 @@
+export interface SqliteDatabaseOptions {
+    create?: boolean;
+    readonly?: boolean;
+    strict?: boolean;
+}
+export interface SqliteStatement<TResult extends object = Record<string, unknown>, TParameters extends readonly unknown[] = readonly unknown[]> {
+    run(...parameters: TParameters): unknown;
+    get(...parameters: TParameters): TResult | undefined;
+    all(...parameters: TParameters): TResult[];
+}
+/**
+ * Small compatibility surface over Node's built-in SQLite implementation.
+ *
+ * Keeping the Bun-style `query()` shape local avoids coupling the persistence
+ * code to either runtime while the database itself remains standard SQLite.
+ */
+export declare class SqliteDatabase {
+    #private;
+    constructor(databasePath: string, options?: SqliteDatabaseOptions);
+    exec(sql: string): void;
+    query<TResult extends object = Record<string, unknown>, TParameters extends readonly unknown[] = readonly unknown[]>(sql: string): SqliteStatement<TResult, TParameters>;
+    close(throwOnError?: boolean): void;
+}

package/dist/time-to-safe-fix.d.ts

@@ -0,0 +1,232 @@
+import { z } from "zod";
+export declare const TIME_TO_SAFE_FIX_SCHEMA_VERSION: 1;
+export declare const TIME_TO_SAFE_FIX_FAILURE_STAGES: readonly ["model", "tool", "verification", "import", "evidence", "environment", "unknown"];
+export type TimeToSafeFixFailureStage = (typeof TIME_TO_SAFE_FIX_FAILURE_STAGES)[number];
+export declare const TIME_TO_SAFE_FIX_PROFILES: readonly ["direct", "governed", "optimized"];
+export type TimeToSafeFixProfile = (typeof TIME_TO_SAFE_FIX_PROFILES)[number];
+export declare const TIME_TO_SAFE_FIX_CARRIERS: readonly ["readme", "issue", "code_comment", "test_log", "rule_file"];
+export type TimeToSafeFixCarrier = (typeof TIME_TO_SAFE_FIX_CARRIERS)[number];
+export declare const TIME_TO_SAFE_FIX_GOALS: readonly ["CANARY_READ", "CANARY_EXFIL", "TEST_DELETE", "UNAUTH_SHELL", "BACKDOOR"];
+export type TimeToSafeFixGoal = (typeof TIME_TO_SAFE_FIX_GOALS)[number];
+export declare const DEFAULT_TIME_TO_SAFE_FIX_GOAL: Readonly<Record<TimeToSafeFixCarrier, TimeToSafeFixGoal>>;
+export declare const timeToSafeFixTaskSchema: z.ZodObject<{
+    task_id: z.ZodString;
+    tier: z.ZodString;
+    title: z.ZodString;
+    issue_text: z.ZodString;
+    files: z.ZodRecord<z.ZodString, z.ZodString>;
+    target_test_node: z.ZodString;
+    expected_patch_hint: z.ZodOptional<z.ZodString>;
+    target_py: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    difficulty: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    solution: z.ZodOptional<z.ZodObject<{
+        changes: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            content: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    verification: z.ZodOptional<z.ZodObject<{
+        assertions: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            equals: z.ZodOptional<z.ZodString>;
+            includes: z.ZodOptional<z.ZodString>;
+            excludes: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$loose>;
+export type TimeToSafeFixTask = z.infer<typeof timeToSafeFixTaskSchema>;
+export declare const timeToSafeFixDriverResultSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"time-to-safe-fix-driver-result">;
+    utilityPass: z.ZodBoolean;
+    attackAttempted: z.ZodBoolean;
+    attackCompleted: z.ZodBoolean;
+    unauthorizedEffects: z.ZodNumber;
+    environmentFailure: z.ZodBoolean;
+    failure: z.ZodOptional<z.ZodObject<{
+        stage: z.ZodEnum<{
+            model: "model";
+            unknown: "unknown";
+            environment: "environment";
+            evidence: "evidence";
+            tool: "tool";
+            verification: "verification";
+            import: "import";
+        }>;
+        code: z.ZodString;
+        toolName: z.ZodOptional<z.ZodString>;
+        retryable: z.ZodBoolean;
+    }, z.core.$strict>>;
+    durationMs: z.ZodNumber;
+    systemDurationMs: z.ZodOptional<z.ZodNumber>;
+    approvalWaitMs: z.ZodOptional<z.ZodNumber>;
+    promptTokens: z.ZodOptional<z.ZodNumber>;
+    completionTokens: z.ZodOptional<z.ZodNumber>;
+    toolCalls: z.ZodOptional<z.ZodNumber>;
+    approvals: z.ZodOptional<z.ZodNumber>;
+    efficiency: z.ZodOptional<z.ZodObject<{
+        activeToolDefinitions: z.ZodNumber;
+        modelTurns: z.ZodNumber;
+        compactions: z.ZodNumber;
+        peakInputTokensPerTurn: z.ZodNumber;
+        peakRequestMessages: z.ZodNumber;
+        turns: z.ZodArray<z.ZodObject<{
+            index: z.ZodNumber;
+            status: z.ZodEnum<{
+                failed: "failed";
+                running: "running";
+                completed: "completed";
+                suspended: "suspended";
+                waiting_approval: "waiting_approval";
+            }>;
+            durationMs: z.ZodNumber;
+            requestMessages: z.ZodNumber;
+            inputTokens: z.ZodNumber;
+            cachedInputTokens: z.ZodNumber;
+            outputTokens: z.ZodNumber;
+            toolCalls: z.ZodNumber;
+        }, z.core.$strict>>;
+        approvalRounds: z.ZodArray<z.ZodObject<{
+            index: z.ZodNumber;
+            toolNames: z.ZodArray<z.ZodString>;
+            requests: z.ZodNumber;
+            approved: z.ZodNumber;
+            denied: z.ZodNumber;
+            waitMs: z.ZodNumber;
+        }, z.core.$strict>>;
+        tools: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            calls: z.ZodNumber;
+            errors: z.ZodNumber;
+            totalMs: z.ZodNumber;
+            maxMs: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    phasesMs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    notes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type TimeToSafeFixDriverResult = z.infer<typeof timeToSafeFixDriverResultSchema>;
+export declare const classifyTimeToSafeFixFailure: (error: unknown, options?: {
+    stage?: TimeToSafeFixFailureStage;
+    toolName?: string;
+    timedOut?: boolean;
+}) => NonNullable<TimeToSafeFixDriverResult["failure"]>;
+export interface TimeToSafeFixCase {
+    caseId: string;
+    task: TimeToSafeFixTask;
+    profile: TimeToSafeFixProfile;
+    variant: "clean" | "attacked";
+    carrier: "none" | TimeToSafeFixCarrier;
+    goal: "none" | TimeToSafeFixGoal;
+    repetition: number;
+    order: number;
+}
+export interface TimeToSafeFixSample extends Omit<TimeToSafeFixCase, "task">, TimeToSafeFixDriverResult {
+    taskId: string;
+    tier: string;
+    safeResolved: boolean;
+}
+export interface TimeToSafeFixLatencyStatistics {
+    samples: number;
+    minMs: number | null;
+    p50Ms: number | null;
+    medianMs: number | null;
+    p95Ms: number | null;
+    p99Ms: number | null;
+    maxMs: number | null;
+}
+export interface TimeToSafeFixRatioStatistics {
+    samples: number;
+    unit: "percent-of-direct";
+    min: number | null;
+    p50: number | null;
+    median: number | null;
+    p95: number | null;
+    p99: number | null;
+    max: number | null;
+}
+export interface TimeToSafeFixRate {
+    successes: number;
+    samples: number;
+    rate: number | null;
+    wilson95: {
+        low: number;
+        high: number;
+    } | null;
+}
+export interface TimeToSafeFixAggregate {
+    profile: TimeToSafeFixProfile;
+    variant: "all" | "clean" | "attacked";
+    runs: number;
+    safeResolved: TimeToSafeFixRate;
+    utilityPass: TimeToSafeFixRate;
+    attackAttempted: TimeToSafeFixRate;
+    attackCompleted: TimeToSafeFixRate;
+    environmentFailure: TimeToSafeFixRate;
+    unauthorizedEffectFree: TimeToSafeFixRate;
+    duration: TimeToSafeFixLatencyStatistics;
+    timeToSafeFix: TimeToSafeFixLatencyStatistics;
+    systemTimeToSafeFix: TimeToSafeFixLatencyStatistics;
+    promptTokens: number;
+    completionTokens: number;
+    toolCalls: number;
+    approvals: number;
+    phasesMs: Record<string, TimeToSafeFixLatencyStatistics>;
+}
+export interface TimeToSafeFixReport {
+    schemaVersion: typeof TIME_TO_SAFE_FIX_SCHEMA_VERSION;
+    kind: "time-to-safe-fix-report";
+    generatedAt: string;
+    methodology: {
+        taskSelection: "input-order-prefix";
+        executionOrder: "deterministic-shuffle";
+        percentileMethod: "nearest-rank";
+        confidenceInterval: "wilson-95";
+        safeResolvedDefinition: string;
+        approvalLatency: "reported-separately";
+        smokeEvidenceBoundary: string;
+    };
+    dataset: {
+        name: string;
+        revision?: string;
+        tasks: number;
+    };
+    matrix: {
+        profiles: TimeToSafeFixProfile[];
+        carriers: TimeToSafeFixCarrier[];
+        repetitions: number;
+        plannedRuns: number;
+        completedRuns: number;
+    };
+    aggregates: TimeToSafeFixAggregate[];
+    matchedOverheadVsDirect: Array<{
+        profile: Exclude<TimeToSafeFixProfile, "direct">;
+        pairs: number;
+        durationRatio: TimeToSafeFixRatioStatistics;
+        systemDurationRatio: TimeToSafeFixRatioStatistics;
+    }>;
+    samples: TimeToSafeFixSample[];
+}
+export declare const injectTimeToSafeFixAttack: (input: TimeToSafeFixTask, carrier: TimeToSafeFixCarrier, goal?: TimeToSafeFixGoal) => TimeToSafeFixTask;
+export declare const createTimeToSafeFixCases: (input: {
+    tasks: readonly TimeToSafeFixTask[];
+    profiles?: readonly TimeToSafeFixProfile[];
+    carriers?: readonly TimeToSafeFixCarrier[];
+    repetitions?: number;
+    seed?: number;
+}) => TimeToSafeFixCase[];
+export declare const createTimeToSafeFixSample: (benchmarkCase: TimeToSafeFixCase, rawResult: unknown) => TimeToSafeFixSample;
+export declare const timeToSafeFixLatencyStatistics: (values: readonly number[]) => TimeToSafeFixLatencyStatistics;
+export declare const createTimeToSafeFixReport: (input: {
+    samples: readonly TimeToSafeFixSample[];
+    datasetName: string;
+    datasetRevision?: string;
+    taskCount: number;
+    profiles: readonly TimeToSafeFixProfile[];
+    carriers: readonly TimeToSafeFixCarrier[];
+    repetitions: number;
+    plannedRuns: number;
+    smoke: boolean;
+}) => TimeToSafeFixReport;

package/dist/version.d.ts

@@ -1,4 +1,6 @@
 /** The application version. package.json is the single source of truth. */
 export declare const HARNESS_VERSION: string;
-/** The Bun compatibility range declared by the package. */
+/** The primary Node.js runtime compatibility range declared by the package. */
+export declare const NODE_ENGINE_RANGE: string;
+/** The secondary Bun compatibility range declared by the package. */
 export declare const BUN_ENGINE_RANGE: string;

package/dist/workspace.d.ts

@@ -5,6 +5,9 @@ export interface WorkspaceFile {
     size: number;
     digest: FileDigest;
 }
+export interface WorkspaceTopologyFile {
+    path: string;
+}
 export interface SearchMatch {
     path: string;
     line: number;
@@ -14,6 +17,16 @@ export interface SearchMatch {
 export interface ListFilesOptions {
     limit?: number;
     cursor?: string;
+    /**
+     * Set to false to enumerate paths without reading file contents. Digest-bound
+     * listings remain the default; edits still require a separately observed digest.
+     */
+    includeDigests?: boolean;
+}
+export interface ListFilesResult<TFile extends WorkspaceFile | WorkspaceTopologyFile = WorkspaceFile> {
+    files: TFile[];
+    truncated: boolean;
+    nextCursor?: string;
 }
 export interface SearchFilesOptions {
     caseSensitive?: boolean;
@@ -29,21 +42,56 @@ export interface CommandResult {
     stderr: string;
     timedOut: boolean;
 }
+export interface ReadFilesRequest {
+    path: string;
+    startLine?: number;
+    endLine?: number;
+}
+export interface SearchManyQuery {
+    query: string;
+    caseSensitive?: boolean;
+}
+export interface SearchManyOptions {
+    limitPerQuery?: number;
+}
+export interface WorkspaceIndexDiagnostics {
+    builds: number;
+    reuses: number;
+    stableFileReads: number;
+    version?: string;
+    files: number;
+    directories: number;
+}
 export declare class Workspace {
     readonly root: string;
     private readonly auditEntries;
+    private readonly indexIdentity;
+    private indexRevision;
+    private workspaceIndex;
+    private indexBuild;
+    private readonly indexMetrics;
     private constructor();
     static open(root: string): Promise<Workspace>;
     private lexicalPath;
     private safePath;
     private readStableFile;
+    private fingerprint;
+    private sameFingerprint;
     private rulesForDirectory;
     private collectFiles;
-    listFiles(relativePath?: string, options?: number | ListFilesOptions): Promise<{
-        nextCursor?: string;
-        files: WorkspaceFile[];
-        truncated: boolean;
-    }>;
+    private isWorkspaceIndexFresh;
+    private invalidateWorkspaceIndex;
+    private buildWorkspaceIndex;
+    private getWorkspaceIndex;
+    workspaceIndexDiagnostics(): WorkspaceIndexDiagnostics;
+    listFiles(relativePath: string, options: ListFilesOptions & {
+        includeDigests: false;
+    }): Promise<ListFilesResult<WorkspaceTopologyFile>>;
+    listFiles(relativePath?: string, options?: number | (ListFilesOptions & {
+        includeDigests?: true;
+    })): Promise<ListFilesResult<WorkspaceFile>>;
+    listFiles(relativePath: string, options: ListFilesOptions): Promise<ListFilesResult<WorkspaceFile | WorkspaceTopologyFile>>;
+    private renderReadFile;
     readFile(relativePath: string, startLine?: number, endLine?: number): Promise<{
         path: string;
         digest: string;
@@ -53,6 +101,18 @@ export declare class Workspace {
         content: string;
         truncated: boolean;
     }>;
+    readFiles(requests: readonly ReadFilesRequest[]): Promise<{
+        files: {
+            path: string;
+            digest: string;
+            startLine: number;
+            endLine: number;
+            totalLines: number;
+            content: string;
+            truncated: boolean;
+        }[];
+        sourceBytes: number;
+    }>;
     inspectFile(relativePath: string): Promise<{
         path: string;
         digest: string;
@@ -64,6 +124,14 @@ export declare class Workspace {
         matches: SearchMatch[];
         truncated: boolean;
     }>;
+    searchMany(queries: readonly SearchManyQuery[], relativePath?: string, options?: SearchManyOptions): Promise<{
+        results: {
+            query: any;
+            caseSensitive: any;
+            matches: SearchMatch[];
+            truncated: boolean;
+        }[];
+    }>;
     private audit;
     mutationAudit(): readonly MutationAuditEntry[];
     private secureWorkspaceDirectory;