@zhivex-ai/harness 1.0.0 → 1.1.0-rc.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (181) hide show
  1. package/CHANGELOG.md +97 -1
  2. package/README.md +52 -306
  3. package/SECURITY.md +1 -1
  4. package/SUPPORT.md +7 -3
  5. package/benchmarks/README.md +3 -3
  6. package/contracts/client-protocol-v1.schema.json +341 -0
  7. package/contracts/public-api.json +100 -1
  8. package/contracts/stable-api-signatures.json +14 -14
  9. package/dist/approval-diff.d.ts +45 -0
  10. package/dist/approval-history.d.ts +38 -0
  11. package/dist/approval-preview.d.ts +26 -0
  12. package/dist/cli-credentials.d.ts +38 -0
  13. package/dist/cli-help.d.ts +3 -0
  14. package/dist/cli-options.d.ts +1 -1
  15. package/dist/cli-stream.d.ts +3 -3
  16. package/dist/cli.d.ts +15 -69
  17. package/dist/cli.js +13796 -10032
  18. package/dist/client-contract.d.ts +208 -0
  19. package/dist/console-commands.d.ts +6 -0
  20. package/dist/console-context.d.ts +5 -1
  21. package/dist/console-input.d.ts +44 -4
  22. package/dist/console-model-catalog.d.ts +25 -0
  23. package/dist/console-navigation.d.ts +27 -0
  24. package/dist/console-presentation.d.ts +18 -0
  25. package/dist/console-welcome.d.ts +13 -0
  26. package/dist/execution-environment.d.ts +4 -0
  27. package/dist/harness.d.ts +3 -0
  28. package/dist/hostile-repository-demo.js +1913 -798
  29. package/dist/index.d.ts +7 -0
  30. package/dist/index.js +7908 -6330
  31. package/dist/local-service.d.ts +34 -0
  32. package/dist/operations.d.ts +23 -1
  33. package/dist/orchestration.d.ts +3 -0
  34. package/dist/persistence-secrets.d.ts +2 -0
  35. package/dist/recorded-workspace.d.ts +4 -0
  36. package/dist/run-document.d.ts +91 -0
  37. package/dist/runtime-policy.d.ts +4 -4
  38. package/dist/service-cli.d.ts +2 -0
  39. package/dist/service-cli.js +10858 -0
  40. package/dist/service-client-cli.d.ts +2 -0
  41. package/dist/service-events.d.ts +50 -0
  42. package/dist/sessions.d.ts +3 -0
  43. package/dist/sqlite-access.d.ts +26 -0
  44. package/dist/sqlite-database.d.ts +2 -0
  45. package/dist/state-backup.d.ts +8 -0
  46. package/dist/task-memory.d.ts +2 -2
  47. package/dist/terminal-continuation.d.ts +3 -0
  48. package/dist/terminal-markdown.d.ts +1 -0
  49. package/dist/terminal-ui.d.ts +5 -0
  50. package/dist/usage-ledger.d.ts +84 -0
  51. package/dist/verify-historical-migrations.js +5699 -5191
  52. package/dist/workspace.d.ts +22 -0
  53. package/dist/zhx.js +13796 -10032
  54. package/docs/CLI.md +136 -30
  55. package/docs/CLIENT_PROTOCOL.md +212 -0
  56. package/docs/CREDENTIALS.md +59 -0
  57. package/docs/DURABLE_OPERATIONS.md +2 -2
  58. package/docs/FIRST_USE.md +82 -0
  59. package/docs/FIRST_USE_EXAMPLE.md +40 -0
  60. package/docs/HOSTILE_REPOSITORY_DEMO.md +1 -1
  61. package/docs/LOCAL_SERVICE.md +142 -0
  62. package/docs/README.md +24 -23
  63. package/docs/THREAT_MODEL.md +1 -1
  64. package/docs/TIME_TO_SAFE_FIX.md +2 -2
  65. package/docs/USAGE.md +181 -0
  66. package/evaluations/daily-cli-cohort.json +33 -0
  67. package/evaluations/representative-assembly-matrix.json +19 -1
  68. package/examples/README.md +26 -0
  69. package/examples/first-use/greeting.test.ts +3 -0
  70. package/examples/first-use/greeting.ts +1 -0
  71. package/examples/first-use/package.json +7 -0
  72. package/package.json +34 -9
  73. package/ROADMAP.md +0 -414
  74. package/benchmarks/baselines/context-navigation-2026-09-09.json +0 -94
  75. package/benchmarks/baselines/efficiency-2026-09-08.json +0 -233
  76. package/benchmarks/baselines/external-final-2026-09-08.json +0 -588
  77. package/benchmarks/baselines/external-intermediate-2026-09-08.json +0 -116
  78. package/benchmarks/baselines/external-matched-openai-2026-09-08.json +0 -1922
  79. package/benchmarks/baselines/external-matched-qwen-2026-09-08.json +0 -1706
  80. package/benchmarks/baselines/external-pilot-2026-09-08.json +0 -439
  81. package/benchmarks/baselines/external-qwen-flash-2026-09-08.json +0 -1570
  82. package/benchmarks/baselines/external-qwen-remediation-2026-09-09.json +0 -1509
  83. package/benchmarks/baselines/external-qwen-sdk-114-progress-2026-09-09.json +0 -2509
  84. package/benchmarks/baselines/external-sdk-upgrade-2026-09-08.json +0 -564
  85. package/benchmarks/baselines/external-verifier-recovery-2026-09-09.json +0 -794
  86. package/benchmarks/baselines/full-harness-review-2026-09-10.json +0 -134
  87. package/benchmarks/baselines/harness-audit-2026-09-09.json +0 -136
  88. package/benchmarks/baselines/harness-remediation-2026-09-09.json +0 -160
  89. package/benchmarks/baselines/oci-remediation-2026-09-10.json +0 -535
  90. package/benchmarks/baselines/rc14-holdout-2026-09-10.json +0 -854
  91. package/benchmarks/baselines/repair-architecture-audit-2026-09-09.json +0 -75
  92. package/benchmarks/baselines/time-to-safe-fix-live-expanded-2026-08-21.json +0 -186
  93. package/benchmarks/baselines/time-to-safe-fix-live-smoke-2026-08-21.json +0 -186
  94. package/docs/GA_READINESS.md +0 -29
  95. package/docs/GEMINI_1_0_DECISION.md +0 -9
  96. package/docs/LIVE_CERTIFICATION.md +0 -107
  97. package/docs/RC13_SECURITY_REVIEW.md +0 -28
  98. package/docs/RC14_DELEGATED_SECURITY_DECISION.md +0 -80
  99. package/docs/RC14_SECURITY_REVIEW.md +0 -40
  100. package/docs/RELEASE.md +0 -96
  101. package/docs/ROLLBACK.md +0 -9
  102. package/docs/SECURITY_REVIEW_EVIDENCE.md +0 -17
  103. package/docs/ga-readiness.json +0 -366
  104. package/docs/reports/EFFICIENCY_REVIEW.md +0 -156
  105. package/docs/reports/EXTERNAL_COMPARISON.md +0 -434
  106. package/docs/reports/FULL_HARNESS_REVIEW_2026-09-10.md +0 -200
  107. package/docs/reports/GA_BUDGET_REMEDIATION_2026-09-19.md +0 -38
  108. package/docs/reports/GA_REPAIR_RECOVERY_2026-09-19.md +0 -700
  109. package/docs/reports/GA_VALIDATION_2026-09-19.md +0 -111
  110. package/docs/reports/HARNESS_ARCHITECTURE_REVIEW_2026-09-09.md +0 -202
  111. package/docs/reports/HARNESS_AUDIT_2026-09-09.md +0 -306
  112. package/docs/reports/HARNESS_REMEDIATION_2026-09-09.md +0 -74
  113. package/docs/reports/HARNESS_REMEDIATION_2026-09-10.md +0 -90
  114. package/docs/reports/MODEL_COMPARISON_2026-09-09.md +0 -184
  115. package/docs/reports/QWEN_REMEDIATION_COMPARISON_2026-09-09.md +0 -142
  116. package/docs/reports/RC14_VALIDATION_2026-09-10.md +0 -45
  117. package/docs/reports/README.md +0 -26
  118. package/docs/reports/evidence/ga-budget-remediation-2026-09-19.json +0 -133
  119. package/docs/reports/evidence/ga-catalog-ablation-2026-09-19.json +0 -699
  120. package/docs/reports/evidence/ga-catalog-ablation-plan-2026-09-19.json +0 -40
  121. package/docs/reports/evidence/ga-catalog-observed-2026-09-19.json +0 -985
  122. package/docs/reports/evidence/ga-catalog-observed-plan-2026-09-19.json +0 -28
  123. package/docs/reports/evidence/ga-catalog-observed-status-2026-09-19.json +0 -15
  124. package/docs/reports/evidence/ga-complete-local-check-2026-09-19.json +0 -47
  125. package/docs/reports/evidence/ga-completion-reminder-2026-09-19.json +0 -22
  126. package/docs/reports/evidence/ga-fresh-cohort-plan-2026-09-19.json +0 -54
  127. package/docs/reports/evidence/ga-fresh-cohort-preparation-2026-09-19.json +0 -242
  128. package/docs/reports/evidence/ga-fresh-cohort-result-2026-09-19.json +0 -4318
  129. package/docs/reports/evidence/ga-local-validation-followup-2026-09-19.json +0 -66
  130. package/docs/reports/evidence/ga-node-consumers-2026-09-19.json +0 -31
  131. package/docs/reports/evidence/ga-package-content-validation-2026-09-19.json +0 -22
  132. package/docs/reports/evidence/ga-plan-completion-2026-09-19.json +0 -39
  133. package/docs/reports/evidence/ga-plan-reserve-2026-09-19.json +0 -573
  134. package/docs/reports/evidence/ga-plan-reserve-plan-2026-09-19.json +0 -24
  135. package/docs/reports/evidence/ga-plan-transition-2026-09-19.json +0 -19
  136. package/docs/reports/evidence/ga-private-verifier-plan-2026-09-19.json +0 -24
  137. package/docs/reports/evidence/ga-private-verifier-root-cause-2026-09-19.json +0 -41
  138. package/docs/reports/evidence/ga-published-sdk-2026-09-19.json +0 -35
  139. package/docs/reports/evidence/ga-python-checkout-imports-2026-09-19.json +0 -95
  140. package/docs/reports/evidence/ga-python-origin-delivery-2026-09-19.json +0 -211
  141. package/docs/reports/evidence/ga-python-origin-delivery-plan-2026-09-19.json +0 -27
  142. package/docs/reports/evidence/ga-qwen-patched-package-2026-09-19.json +0 -1092
  143. package/docs/reports/evidence/ga-qwen-patched-package-plan-2026-09-19.json +0 -18
  144. package/docs/reports/evidence/ga-qwen-published-2026-09-19.json +0 -571
  145. package/docs/reports/evidence/ga-qwen-published-plan-2026-09-19.json +0 -18
  146. package/docs/reports/evidence/ga-qwen-tool-choice-2026-09-19.json +0 -85
  147. package/docs/reports/evidence/ga-qwen-tool-choice-patched-2026-09-19.json +0 -85
  148. package/docs/reports/evidence/ga-recovery-development-2026-09-19.json +0 -1066
  149. package/docs/reports/evidence/ga-recovery-graded-development-2026-09-19.json +0 -1313
  150. package/docs/reports/evidence/ga-recovery-graded-v2-2026-09-19.json +0 -1151
  151. package/docs/reports/evidence/ga-recovery-v3-2026-09-19.json +0 -3943
  152. package/docs/reports/evidence/ga-recovery-v4-2026-09-19.json +0 -1055
  153. package/docs/reports/evidence/ga-recovery-v5-2026-09-19.json +0 -1245
  154. package/docs/reports/evidence/ga-recovery-v6-2026-09-19.json +0 -699
  155. package/docs/reports/evidence/ga-recovery-v7-2026-09-19.json +0 -854
  156. package/docs/reports/evidence/ga-recovery-v8-2026-09-19.json +0 -596
  157. package/docs/reports/evidence/ga-required-delivery-2026-09-19.json +0 -25
  158. package/docs/reports/evidence/ga-required-delivery-live-2026-09-19.json +0 -1337
  159. package/docs/reports/evidence/ga-required-delivery-live-plan-2026-09-19.json +0 -25
  160. package/docs/reports/evidence/ga-retained-candidate-grading-2026-09-19.json +0 -30
  161. package/docs/reports/evidence/ga-tool-selection-live-2026-09-19.json +0 -559
  162. package/docs/reports/evidence/ga-tool-selection-live-plan-2026-09-19.json +0 -28
  163. package/docs/reports/evidence/ga-tool-selection-recovery-2026-09-19.json +0 -27
  164. package/docs/reports/evidence/ga-validation-2026-09-19.json +0 -236
  165. package/docs/reports/evidence/ga-verifier-discovery-live-2026-09-19.json +0 -1369
  166. package/docs/reports/evidence/ga-verifier-discovery-plan-2026-09-19.json +0 -29
  167. package/docs/reports/evidence/ga-verifier-failure-identification-2026-09-19.json +0 -30
  168. package/docs/reports/evidence/ga-verifier-feedback-2026-09-19.json +0 -65
  169. package/docs/reports/evidence/ga-verifier-hints-live-2026-09-19.json +0 -1297
  170. package/docs/reports/evidence/ga-verifier-hints-plan-2026-09-19.json +0 -27
  171. package/docs/reports/evidence/ga-work-boundary-context-analysis-2026-09-19.json +0 -113
  172. package/docs/reports/evidence/ga-work-boundary-live-2026-09-19.json +0 -301
  173. package/docs/reports/evidence/ga-work-boundary-live-plan-2026-09-19.json +0 -84
  174. package/docs/reports/evidence/ga-work-budget-planning-2026-09-19.json +0 -32
  175. package/docs/reports/evidence/ga-working-context-2026-09-19.json +0 -22
  176. package/docs/reports/evidence/rc14-delegated-security-review-2026-09-20.json +0 -81
  177. package/docs/reports/evidence/rc14-ga-gate-2026-09-20.json +0 -18
  178. package/docs/reports/evidence/rc14-representative-2026-09-20.json +0 -509
  179. package/docs/reports/evidence/rc14-security-regressions-2026-09-20.json +0 -64
  180. package/docs/reports/evidence/security-current-2026-09-19.json +0 -91
  181. package/docs/reports/evidence/security-remediation-2026-09-19.json +0 -97
@@ -1,66 +0,0 @@
1
- {
2
- "schemaVersion": 1,
3
- "kind": "local-validation-followup",
4
- "gitCommit": "c2b2bb917d0471e61afc5f731a61c00b44fa3731",
5
- "sources": {
6
- "package.json": "78989c243298fa78066ce1670439277c689a5a538d973b91f7ea7061281dd82a",
7
- "bun.lock": "dbabdf161b3dba306f475c81f37e5ab1620fb98052127bb3ed2a0a0cb611ede4",
8
- "src/config.ts": "67ed44b55505ff8dd94f60ba89c33c217759cd7c79de45ccda369f248309cdff",
9
- "src/harness.ts": "1d305078e3c56c24bb659c34aac37c96bf11a4e60af6607bb4b9d65964e84791",
10
- "src/repair-controller.ts": "41f1f09032131306f3284edbf105930577504af0bf764ba98a105c4eee70a1e7",
11
- "scripts/swebench/telemetry.ts": "2c0b4828db3a108184df6d47276d7d3dbb6cf291126b40fc38d33f4b29101bc2",
12
- "tests/swebench.test.ts": "1f5004b779046282ec4ff18f2de76e315e189fa5d1f2c2e0a97472fbc2c0df8c",
13
- "tests/terminal-verification-recovery.test.ts": "5773a41422d8c9f0988af607e1965feee32970ba273263b325ad1f507f8b1e25"
14
- },
15
- "validation": {
16
- "fullSuiteBeforeOutputHints": {
17
- "passed": 568,
18
- "failed": 0,
19
- "files": 68
20
- },
21
- "focusedSuiteAfterOutputHints": {
22
- "passed": 19,
23
- "failed": 0
24
- },
25
- "typecheckToolingAfterOutputHints": "passed",
26
- "docsCheck": "passed",
27
- "preparationContract": "passed; one GA blocker open",
28
- "securityProbes": [
29
- {
30
- "id": "SEC-01",
31
- "passed": true,
32
- "acceptedConflictingWrites": 1,
33
- "finalContent": "second"
34
- },
35
- {
36
- "id": "CONTROL-sequential-stale-digest",
37
- "passed": true,
38
- "rejectedStale": true
39
- },
40
- {
41
- "id": "SEC-02",
42
- "passed": true,
43
- "replacementVisibleByDefault": true,
44
- "omissionNoticeVisible": false,
45
- "fullViewAvailable": true
46
- },
47
- {
48
- "id": "SEC-03",
49
- "passed": true,
50
- "missingTools": []
51
- },
52
- {
53
- "id": "SEC-04",
54
- "passed": true,
55
- "throughPublicRunHarness": true,
56
- "status": "completed",
57
- "differentTenantUserNamespace": true,
58
- "otherTenantCandidateInToolOutput": false
59
- }
60
- ]
61
- },
62
- "limitations": [
63
- "Full suite preceded the telemetry output-marker change; focused tests and tooling typecheck cover that change.",
64
- "Local validation does not certify live repair reliability, representative evaluation, fresh holdout or release provenance."
65
- ]
66
- }
@@ -1,31 +0,0 @@
1
- {
2
- "schemaVersion": 1,
3
- "kind": "local-node-consumer-matrix",
4
- "observedAt": "2026-09-19T18:46:04.607256+00:00",
5
- "sourceCommit": "41bd1cb4ab8481a7413f096a0817f612fe9806fe",
6
- "artifactSha512": "87fc85f2a219624b8da4de33c28d14ca774a1f70a6aa5ad83ac3ffc85b44c46d0b29c3071b5a9aff6c80c46ad17626a6398d1fdbb9b87c59097fe4ba1eaccb47",
7
- "packageVersion": "1.0.0-rc.14",
8
- "consumers": [
9
- {
10
- "node": "22.13.0",
11
- "platform": "darwin-arm64",
12
- "archiveSource": "https://nodejs.org/dist/v22.13.0/node-v22.13.0-darwin-arm64.tar.gz",
13
- "archiveSha256": "bc1e374e7393e2f4b20e5bbc157d02e9b1fb2c634b2f992136b38fb8ca2023b7",
14
- "officialChecksumMatched": true,
15
- "installedConsumer": "passed",
16
- "exitCode": 0,
17
- "logSha256": "b514c0029f5e87c141acb9993719a7921bd7e451e5d979be9baf4518a14b09b5"
18
- },
19
- {
20
- "node": "24.0.0",
21
- "platform": "darwin-arm64",
22
- "archiveSource": "https://nodejs.org/dist/v24.0.0/node-v24.0.0-darwin-arm64.tar.gz",
23
- "archiveSha256": "194e2f3dd3ec8c2adcaa713ed40f44c5ca38467880e160974ceac1659be60121",
24
- "officialChecksumMatched": true,
25
- "installedConsumer": "passed",
26
- "exitCode": 0,
27
- "logSha256": "b514c0029f5e87c141acb9993719a7921bd7e451e5d979be9baf4518a14b09b5"
28
- }
29
- ],
30
- "boundary": "Same local tarball installed independently; does not replace required remote CI, Linux coverage, release-bound certification or provenance."
31
- }
@@ -1,22 +0,0 @@
1
- {
2
- "schemaVersion": 1,
3
- "kind": "local-release-artifact-validation",
4
- "baseCommit": "26f5fcd68826952dc3d706b89d5d72a9ba9b344a",
5
- "sourceChange": "Replace unpackaged relative dossier link with published SDK PR 103",
6
- "artifactSha512": "c46708a7053628e4b38a4b059b632fed6e4bc065ff9b91e2b40b04f49f613f06d1aa10600c9eef40d4d85a71d490e0e6626ffa58dd783d3b2e117adcdd39eb0d",
7
- "files": 204,
8
- "bytes": 1055949,
9
- "artifactCheck": "passed",
10
- "documentationCheck": "passed",
11
- "forbiddenPathMatches": [],
12
- "checks": [
13
- "Archive path allowlist, required files and duplicate paths",
14
- "All relative Markdown links resolve within archive",
15
- "Package identity, engines and publication policy",
16
- "Node runtime and CLI compatibility"
17
- ],
18
- "limitations": [
19
- "Local package only; not published and not provenance-attested",
20
- "Path scan does not establish absence of every possible secret in content"
21
- ]
22
- }
@@ -1,39 +0,0 @@
1
- {
2
- "schemaVersion": 1,
3
- "kind": "local-plan-completion-validation",
4
- "baseCommit": "41bd1cb4ab8481a7413f096a0817f612fe9806fe",
5
- "candidate": "uncommitted working tree, no release attestation",
6
- "sourceSha256": {
7
- "src/harness.ts": "866115b64d90c0b2ffa3e07da6a015210afae0babe46052912d0cc288e23bc4b",
8
- "src/repair-controller.ts": "280aa4d33918ab5b38b170059603eb1368a28e910f2ec2a39afa854af8082cc8",
9
- "src/runtime-checkpoints.ts": "e3b75a0b86fb5d21992b1a126b35446110ba5fcaf4317ed5005b1a44555118dc",
10
- "tests/full-remediation.test.ts": "587bd801afeaa7ff7425ab5b406126c4bba96016e90fc7fa69e714ed98a72af9",
11
- "tests/terminal-verification-recovery.test.ts": "93653288eceb58901dc3003a79ef700dcc84f9141c8b07dc0564e662f7f3d3d7",
12
- "scripts/validate-openai-stream-usage.ts": "76f5cd2c3ca055196a73c002fca78924db0c0d631157aab1b50e3daedaa791ea",
13
- "package.json": "a4a2507e3ad876d72cad49a16e149192d33521fb4175bb40a3eb077ccfdf43a1",
14
- "bun.lock": "e370459197ce52c3961770f3c5ccaab7ff35ddbe641ef72e8bd61f87a8b8e3fe"
15
- },
16
- "suite": {
17
- "passed": 534,
18
- "failed": 0,
19
- "files": 61
20
- },
21
- "checks": {
22
- "runtimeTypes": "passed",
23
- "toolingTypes": "passed",
24
- "docs": "passed",
25
- "preparationContract": "passed",
26
- "installedPackage": "passed"
27
- },
28
- "openaiAccountingProbe": {
29
- "status": "failed",
30
- "network": "mock-only",
31
- "expectedInputTokens": 12,
32
- "expectedOutputTokens": 8,
33
- "usageObserved": false,
34
- "incompleteToolCallRejected": true,
35
- "emittedToolCalls": 0
36
- },
37
- "liveAcceptance": "not yet measured for plan completion change",
38
- "ga": "not ready"
39
- }