@zhivex-ai/harness 1.1.1 → 1.2.0-rc.13

package/CHANGELOG.md

@@ -4,6 +4,160 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 1.2.0-rc.13 - 2026-09-26
+
+- Store SQLite run history incrementally with published Core 1.26.0 and Agents 1.10.1. Keep the 4 MiB limit on the active checkpoint while retaining steps, tool results and compaction history separately; unchanged history is not rewritten.
+- Export backups above 64 MiB through a bounded, versioned segment stream, preserving legacy JSON imports, checksums and atomic publication.
+- Preserve full history through reopen and portable backup/restore, including legacy inline states. Report state-limit failures with bounded diagnostics and retain the SDK terminal failure checkpoint.
+- Add a 200-read, 99-compaction regression covering more than 11 MB of hydrated history with a checkpoint below 48 KB. Full hydrated loads and disk retention remain proportional to history size.
+- Prepare fresh exact-artifact, live and representative certification for RC13; RC12 publication evidence remains historical.
+
+## 1.2.0-rc.12 - 2026-09-26
+
+- Preserve optional edit/retry fields in OpenAI Responses tool schemas; keep runtime validation, read-bound digests and approval checks unchanged.
+
+- Strengthen release validation with representative fixtures v2, structural workflow checks and installed-runtime regressions; preserve historical evidence and publication gates.
+
+## 1.2.0-rc.11 - 2026-09-26
+
+- Consume Qwen 0.16.2 with Core 1.25.0, retaining typed malformed tool-argument and SSE-event diagnostics through benchmark and release reports without exposing provider payloads or adding automatic retries.
+
+## 1.2.0-rc.10 - 2026-09-26
+
+- Scope deterministic test discovery to maintained root and Desktop suites, excluding historical artifacts stored locally.
+- CLI: featured model ordering, Qwen-hosted GLM/DeepSeek/Kimi choices, phase/total timing, committed file receipts, bounded `/activity` history, and literal task queues isolated from approvals.
+
+- Add model-to-reasoning selection, `/reasoning` and `--reasoning`, with adapter-declared levels, personal-profile persistence and durable run bindings.
+- Reuse bounded rejected edit candidates after targeted reference recovery, without regenerating file contents or bypassing exact-payload approval.
+- Make Qwen's local compacted conversation authoritative instead of continuing remote response chains; retain reasoning and tool history.
+- Guide scoped implementations toward editing and checking without an unnecessary planning-only turn.
+
+## 1.2.0-rc.9 - 2026-09-26
+
+- Keep current user direction prominent across compaction, retain earlier task context, and migrate legacy summaries. Add a durable advisory for prolonged varied exploration without forcing edits or stopping legitimate investigation. Give the model actionable read-call and line-range corrections while preserving original error receipts and approvals.
+
+- Allow bounded, read-only dependency source and documentation inspection, with listing and literal search for discovering package-relative files. Remove the separate metadata/type approval flow while retaining filesystem restrictions and mutation approvals.
+- Keep routine exploration out of the conversation until a run or approval boundary; preserve visible edits and check outcomes, and explain known tool failures without dumping private payloads. Keep `/verbose` and machine output available.
+
+## 1.2.0-rc.8 - 2026-09-26
+
+- Include durable child and descendant OCI snapshots in parent completion checks. Report `OCI_CHILD_DELIVERY_PENDING` when a delegated edit has not reached the host; missing descendant state fails closed without requesting an import from the wrong workspace.
+
+- Prevent OCI runs from completing while edits remain only in their isolated snapshot. Detect pending delivery from actual host contents and modes, including resumed runs and command-created edits. Allow at most two read-only completion reminders, preserve import approvals and refusals, and persist an explicit incomplete-delivery result when delivery cannot finish.
+- Report pending OCI delivery separately from verifier failures in representative release diagnostics.
+
+- Prepare fresh exact-artifact certification for RC8. RC7 failed the Meta representative matrix before publication; its tag and evidence remain unchanged. Local Meta regression evidence does not replace certification of the new candidate.
+
+## 1.2.0-rc.7 - 2026-09-26
+
+- Split live approval/resume diagnostics into receipt count, tool success, file read/content, and journal count/status checkpoints. Include bounded receipt and journal counters without tool arguments, file contents or provider output. Preserve every release acceptance assertion and the unpublished RC6 failure evidence.
+
+- Prepare fresh exact-artifact certification for RC7 with the same Meta contributor, Qwen Flash and OpenAI Luna cohort. RC6 failed its base live gate before publication; its tag and evidence remain unchanged.
+
+## 1.2.0-rc.6 - 2026-09-26
+
+- Deduplicate identical unsigned Qwen reasoning summaries against their streamed text before context accounting, including restored sessions. Preserve distinct, signed, and encrypted provider data.
+- Treat the compaction threshold as a target that must fit the newest indivisible interaction, while keeping transport and run budgets authoritative. Validate repeated compaction followed by a real file edit and executable check.
+- Guide scoped implementation toward editing once the relevant code and check are known; clarify exact tool names and dependency lookup paths to avoid repeated blocked discovery.
+
+- Render pipe-delimited Markdown tables as aligned, wrapped terminal grids, with stacked cells on narrow terminals and Unicode-aware widths. Preserve plain redirected output and terminal-control sanitization.
+- Keep Meta Responses conversation history locally with `store: false` and encrypted reasoning replay, instead of depending on `previous_response_id` availability. Resume existing sessions from retained messages and tool receipts without rerunning completed tools; older turns without encrypted reasoning retain their visible history only.
+- Allow two bounded receipt-only continuation backoffs (1s and 2s) for legacy stateful requests. Add generate/stream replay regressions and an opt-in live check for encrypted replay across model instances.
+
+## 1.2.0-rc.5 - 2026-09-26
+
+- Adapt the assistant loop to explanation, investigation, design and implementation without imposing a repair ceremony on read-only work. Remove the `strict`/`repair` runtime profile choice; callers requiring verified completion use `requireVerifiedDelivery` or `--require-verified-delivery` directly. This is an intentional pre-promotion API/CLI break; saved connection profiles and subagent roles remain independent.
+- Unify bounded tool-error, invalid-argument and unknown-tool recovery across CLI, SDK and delegated runs, independently of the repair controller. Explicit fail-fast tool options remain available.
+- Return malformed application-owned delegation arguments through bounded SDK validation feedback without launching a child. Preserve hidden-tool rejection and exact task-ID authorization.
+- Preserve conversational decisions and bounded, redacted local error observations through repeated deterministic and model-assisted compaction. Context is working memory; approvals and verification remain tool-owned.
+- Prioritize recent user corrections over the historical objective and assistant recollections during compaction; retain more distinct user steering within the same summary budget.
+- Use the remaining repair output budget instead of an implicit 2,048-token per-response cap. Preserve explicit caps and provider transport compatibility. Finish after relevant checks and change review without requiring duplicate audits.
+- Refresh discovered directory guidance after normal edits instead of aborting the conversation; retain path, link, encoding and size protections.
+- Return the matching persisted context/accounting checkpoint in all runs, and detect repeated tool cycles even when the model changes its progress narration.
+- Invalidate failed or superseded model edit references and explain how to recover them before another approval. Keep partially failed changes pending verification and preserve closure capacity after rejected plans or out-of-scope reads.
+- Remove lifetime cutoffs for operator requests and discovered instruction counts; paginate task history and preserve repeated latest requests such as A → B → A. New user requests reset loop history while approval resumes retain it.
+- Share a finite 50-step default across API and chat, and accept explicit larger step/tool-call limits without the former arbitrary ceilings.
+- Preserve the newest correction before the historical objective under tight summary budgets, including corrections after a previous summary emptied the objective. Authenticate builtin output before semantic export; restored summaries retain user objectives and steering without exporting unproven tool diagnostics or excerpts.
+- Prepare fresh exact-artifact certification for RC5. RC4 passed base live certification but failed its representative matrix and was not published; its tag and evidence remain unchanged.
+
+## 1.2.0-rc.4 - 2026-09-26
+
+- Identify the precise live-execution assertion in sanitized release diagnostics: approved tool/arguments, import reference, run status, completion marker, approval/tool sequence, tool success, host content, environment binding or durable journal.
+- Preserve a failed run's structured cause instead of reducing it to an opaque status assertion. Existing assertions, cohort, budgets and all exact-artifact release gates remain enforced.
+- Preserve unpublished RC3 and its failed Qwen execution evidence. One local reproduction on the same RC3 tarball passed; it does not establish the CI failure's cause or certify RC4.
+
+## 1.2.0-rc.3 - 2026-09-25
+
+- Model-facing reviewed edits and OCI imports no longer require copying file digests or patch IDs. The runtime binds successful prior reads/inspections before requesting approval; persisted approvals and programmatic tool contracts retain their exact references.
+- Preserve rejection of stale files and changed OCI snapshots, including after restart. Missing reference evidence requires another read/inspection; explicit legacy references are never silently replaced.
+- Return sanitized argument-validation receipts in CLI and representative runs within existing step/error budgets. Distinguish provider syntax failures and patch inspections in release diagnostics without retaining provider payloads or adding retries.
+- Prepare the unchanged Meta/Qwen/OpenAI cohort and 42-case release gate for the exact RC3 artifact. RC2 failed representative validation and was not published.
+
+## 1.2.0-rc.2 - 2026-09-25
+
+- Speed up standalone CLI help/version loading, bounded workspace and OCI inventory reads, scoped-context validation and chat persistence reuse; enable bounded independent CLI reads with mutation barriers.
+
+- Recover one terminal OCI patch-ID mismatch against an unchanged inspected snapshot through model feedback and a fresh approval; preserve the limit across resume.
+- Run release live provider gates against the validated tarball and require packaged Desktop restart, effect-recovery, cancellation and worktree smokes in CI.
+- Let Desktop offer stay/cancel before draining IPC blocked on an active run; retain draining before host shutdown.
+
+- Preserve OCI inspection references across approval restart and emit sanitized diagnostics distinguishing submitted patch-ID mismatch, snapshot drift, unavailable review evidence and execution-binding changes; retain exact-byte import rejection.
+
+## 1.2.0-rc.1 - 2026-09-25
+
+- Prepare the next-channel candidate with Meta `muse-spark-1.3`, Qwen `qwen3.8-flash` and OpenAI `gpt-6-luna` across live and representative certification. Fresh exact-artifact certification and publication remain pending.
+- Remove archived candidate notes and exploratory design assets from the working tree; preserve links to their Git history.
+
+- Integrate the coordinated stable SDK batch (Core 1.24 / Agents 1.10): SDK-owned auxiliary compaction reservations and durable receipts, catalog recommendation contracts, and opt-in MCP HTTP/OAuth transport. Preserve the existing MCP protocol by default.
+
+- Add opt-in model-assisted compaction with explicit provider/model selection, shared token budgets, and durable usage accounting; retain deterministic compaction by default.
+- Enrich the model catalog with sourced context/output limits, pricing evidence, and conservative compaction recommendations available through `/compaction`.
+- Load scoped repository instructions after authorized reads, detect repeated unproductive cycles, and execute approved independent local reads concurrently with mutation barriers.
+- Add experimental declarative tool policies, allowlisted MCP resources, an ACP text-session stdio adapter (`zhx-acp`), and reviewable workspace checkpoint restore APIs with crash recovery and portable backups.
+
+- Normalize fragmented Qwen reasoning losslessly in saved histories and new streams so repeated event envelopes do not exhaust compaction limits.
+
+
+- Prevent long `runHarness` streams from exhausting the SDK replay history; retain a bounded tail with full live delivery and observe completion rejections immediately.
+
+
+- Keep compact chat progress visible during model waits and retain grouped summaries of completed tools.
+
+
+- Local chat now defaults to 50 steps with `/limits` controls, exposes persisted step exhaustion, and uses compact approval cards with keyboard choices and stable activity rows.
+
+
+- Interactive Qwen service/region credentials, explicit endpoint conflict handling, optional `/connection` probe, and session-scoped `/approvals` menu.
+
+
+- Add local ask/auto/restricted approval modes and approval-gated, bounded dependency metadata/type reads with task-scoped consent.
+- Let local CLI runs recover from tool execution failures within existing error budgets and explain protected-path failures in terminal diagnostics.
+
+- Default new local interactive sessions to continued execution without cumulative token ceilings; preserve explicit limits, saved policies and bounded automation/SDK/service defaults.
+- Add `--token-budget` and `--context-tokens`, and distinguish retained context from cumulative usage and remaining budget in console diagnostics.
+
+- Check estimated request input against remaining cumulative input and total tokens before contacting the provider.
+- Update single-agent compaction thresholds with consumption from the current invocation; strict runs switch to an evidence-based final answer near their token budget.
+- Preserve reported usage in failed checkpoints when an over-budget response is rejected before its tools execute.
+
+## 1.1.4 - 2026-09-24
+
+- Preserve provider-independent rejection reasons in sanitized diagnostics and Actions summaries, with bounded response inspection and separate transport/stream failures.
+- Distinguish cleanup completion, result flushing and pending process exit; retain a completed provider failure when the supervisor later times out.
+- Preserve all five bounded entries in a completed driver failure after a supervisor timeout, including a provider diagnostic at the end of the chain.
+
+## 1.1.3 - 2026-09-24
+
+- Add bounded model/HTTP-attempt, tool and OCI timing spans, phase history, timeout budgets and per-case Actions evidence links.
+- Preserve bounded benchmark stage/event checkpoints across driver timeouts and display them in release summaries; reserve cleanup time within the existing deadline without accepting incomplete certification.
+
+## 1.1.2 - 2026-09-24
+
+- Update Qwen to 0.15.2 for the current QwenCloud Token Plan endpoint and supported Max/Flash models; document explicit credential and endpoint pairing.
+- Keep successful tool activity out of the interactive transcript, retain transient TTY status and `/verbose`, and preserve Markdown formatting across streaming pauses.
+- Repair safe owner-controlled SQLite lock permissions on macOS and exclude newly created local state from ordinary Git adds without deleting existing sessions.
+- Show bounded Meta HTTP failure reasons and suppress duplicate terminal errors. The reported live HTTP 400 remains unconfirmed; no blanket retry is added.
+
 ## 1.1.1 - 2026-09-23
 
 - Update the RC.10 SDK batch to its stable releases: Agents 1.9.0, Core 1.23.0, Gemini 0.12.2, Meta 0.2.7, OpenAI 0.13.5 and Qwen 0.15.1. Preserve approvals and exactly-once host effects across resume; the updated artifact still requires release certification.
@@ -841,3 +995,9 @@ No configuration, SQLite, approval, or execution-policy migration is required. E
   deduplicates replay and reconciles lost responses before allowing another send.
 - Verified packaged macOS chat with duplicate submission, failed check, expired
   snapshot, transport interruption, renderer reload and split-secret fixtures.
+
+- Local CLI continuity: align interactive tool/error/time limits with 50-step
+  turns; add `/continue` with retained results, exact session approvals for checks
+  and bounded dependency reads, a repeated-tool-failure circuit breaker and two
+  transport retries. Explicit policies, saved run receipts and automation defaults
+  remain authoritative.

package/README.md

@@ -6,18 +6,25 @@ Zhivex Harness is a local terminal assistant and TypeScript library. It supports
 OpenAI, Qwen and Meta, with provisional Gemini support. Conversations and pending
 approvals survive restarts.
 
-Version `1.1.1` is prepared for stable publication, with console, local service
-and governed delegation improvements. Publication remains pending until the
+Use it to understand a repository, discuss a design, investigate a failure or
+implement a change. Conversation context retains decisions, hypotheses and bounded
+diagnostic excerpts across compaction. Edits and command execution keep their
+own permission checks; a conversational summary never grants approval.
+
+Version `1.2.0-rc.13` is prepared as an unpublished release candidate for npm `next`,
+with incremental durable history and bounded active checkpoints for long conversations. Certification
+and publication remain pending. The
 [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json)
-records its verified artifact. The installation commands below target 1.1.1 once
-published. Desktop retains its separate private alpha status.
+preserves historical stable evidence. The installation commands below target
+1.2.0-rc.13 once published; stable users can install `@zhivex-ai/harness@latest`.
+Desktop retains its separate private alpha status.
 
 ## Quick start
 
 Requires Node.js 22.13.0 or newer, Git and a provider API key.
 
 ```sh
-npm install -g @zhivex-ai/harness@1.1.1
+npm install -g @zhivex-ai/harness@1.2.0-rc.13
 cd /path/to/your/project
 zhx
 ```
@@ -72,8 +79,8 @@ Gemini remains provisional. See the [support matrix](docs/SUPPORT_MATRIX.md) and
 
 [Browse documentation](docs/README.md).
 
-Version `1.0.0` is the current public npm release. Source checkout changes can be
+Version `1.1.1` is the current public npm release. Source checkout changes can be
 newer than the published package. Consult the [changelog](CHANGELOG.md) and
 [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json)
-for release identity; [release evidence](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md)
+for the recorded 1.0.0 release; [release evidence](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md)
 records validation scope and limitations.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-Security fixes are provided for the latest published `1.0.x` patch. Older minors and private checkpoints are not supported release channels. Registry integrity and provenance do not substitute for the separate provider and execution evidence recorded in [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Security fixes are provided for the latest published `1.1.x` patch. Older minors and private checkpoints are not supported release channels. Registry integrity and provenance do not substitute for the separate provider and execution evidence recorded in [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Reporting a vulnerability
 

package/SUPPORT.md

@@ -1,8 +1,8 @@
 # Support
 
-Zhivex Harness `1.0.x` is the latest supported Node-first CLI and TypeScript library. Stable 1.x contracts follow [the stability policy](./docs/STABILITY.md); incompatible changes require a major release except documented urgent security corrections. Beta and experimental surfaces retain their declared policies. The mutable machine-readable public release state is recorded in the repository [release-status.json](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json), outside immutable npm artifacts.
+Zhivex Harness `1.1.x` is the latest supported Node-first CLI and TypeScript library. Stable 1.x contracts follow [the stability policy](./docs/STABILITY.md); incompatible changes require a major release except documented urgent security corrections. Beta and experimental surfaces retain their declared policies. The mutable machine-readable `release-status.json` record preserves the verified 1.0.0 release; check npm for the current published version.
 
-The 1.0 support scope is tracked in the [machine-readable support matrix](./docs/support-matrix.json) and its [human-readable view](./docs/SUPPORT_MATRIX.md). Compatibility and removals follow [DEPRECATIONS.md](./docs/DEPRECATIONS.md) for the published 1.x line.
+The 1.1 support scope is tracked in the [machine-readable support matrix](./docs/support-matrix-1.1.json) and its [human-readable view](./docs/SUPPORT_MATRIX_1_1.md). The [1.0 matrix](./docs/SUPPORT_MATRIX.md) remains historical. Compatibility and removals follow [DEPRECATIONS.md](./docs/DEPRECATIONS.md) for the published 1.x line.
 
 ## Supported baseline
 
@@ -13,7 +13,7 @@ The 1.0 support scope is tracked in the [machine-readable support matrix](./docs
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published `1.0.x` patch receives routine fixes. The exact `v1.0.0` tag passed protected release-bound base, orchestration, routing and model-directed execution for Meta, Qwen and OpenAI on 2026-09-20; the complete representative matrix passed on its authorized second attempt. Gemini remains provisional until its complete harness live matrix passes against an exact release candidate. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Only the most recent published `1.1.x` patch receives routine fixes. The exact `v1.1.1` tag passed the protected artifact, live-provider and representative release jobs. Gemini remains provisional until its complete harness live matrix passes against an exact release candidate. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Installation diagnostics
 

package/benchmarks/README.md

@@ -46,3 +46,20 @@ The opt-in [SWE-bench comparison](https://github.com/Zhivex/zhivex-harness/blob/
 mini-SWE-agent and the native Zhivex OCI harness, exports actual patches, and grades
 with the official SWE-bench evaluator. `bun run benchmark:swebench:test` validates
 its offline contracts. Paid runs require a prepared, pinned matrix and `--live`.
+
+## Bounded read and startup optimizations
+
+CLI runs, resumes and conversations now enable at most four independent trusted
+local read tools; mutation barriers and approval requirements remain in force.
+Workspace indexing traverses at most eight directories at once and coalesces
+only overlapping freshness checks. Later calls still validate directories and
+ignore-file contents; there is no TTL or persistent content cache.
+
+OCI inventory reserves each four-file batch against the aggregate workspace byte
+limit before reading contents. Descriptor-bound reads remain capped at each
+reserved size and fail if file identity or timestamps changed. Scoped instruction
+validation reads at most four files concurrently and preserves durable digest checks.
+
+The packaged CLI uses a separate lightweight help/version entrypoint and lazy
+runtime chunks. Package smoke coverage must exercise the installed CLI and aliases
+so missing chunks cannot pass as a working source checkout.

package/contracts/public-api.json

@@ -75,6 +75,7 @@
     "NODE_ENGINE_RANGE",
     "PROVIDERS",
     "PROVIDER_DESCRIPTORS",
+    "SEMANTIC_COMPACTION_VERSION",
     "SESSION_RUN_STATUSES",
     "TERMINAL_RUN_STATUSES",
     "TERMINAL_SESSION_RUN_STATUSES",
@@ -88,6 +89,7 @@
     "Workspace",
     "appendUserMessage",
     "applyEditProposalInputSchema",
+    "applyHarnessToolPolicy",
     "assertHarnessModelCapabilities",
     "cancelHarnessRun",
     "canonicalizeChangeEnvelope",
@@ -128,6 +130,7 @@
     "compactHarnessMessages",
     "computeChangeEnvelopeDigest",
     "computeChangeEnvelopeEvidenceDigest",
+    "createAcpConnection",
     "createChangeEnvelope",
     "createEditProposal",
     "createEmptyHarnessContextBundle",
@@ -140,9 +143,12 @@
     "createHarnessRouteModels",
     "createHarnessStateBackup",
     "createHarnessSubagents",
+    "createHarnessToolPolicy",
     "createHttpMcpClient",
+    "createProgressMonitor",
     "createProviderModel",
     "createProviderRegistry",
+    "createSemanticCompactor",
     "createTimeToSafeFixCases",
     "createTimeToSafeFixReport",
     "createTimeToSafeFixSample",
@@ -172,6 +178,7 @@
     "harnessLifecycleFingerprintInput",
     "harnessLocalCredentialsSchema",
     "harnessSkillLoadInputSchema",
+    "harnessToolPolicySchema",
     "importHarnessStateBackup",
     "importHarnessStateBackupFile",
     "injectTimeToSafeFixAttack",
@@ -194,6 +201,7 @@
     "openHarnessActivityStore",
     "openHarnessPersistence",
     "openSessionStore",
+    "openWorkspaceCheckpointStore",
     "parseCliJsonDocument",
     "parseCliJsonLineDocument",
     "parseHarnessModelRoute",
@@ -203,6 +211,7 @@
     "quarantineFileInputSchema",
     "readHarnessLocalCredentials",
     "readHarnessStateBackup",
+    "recommendCompactionModels",
     "recoverHarnessLocalService",
     "renderHarnessContextInstructions",
     "requestHarnessLocalService",
@@ -217,6 +226,7 @@
     "serializeHarnessModelRoutes",
     "serializeStreamEvent",
     "serializeStreamResult",
+    "serveAcpStdio",
     "startHarnessLocalService",
     "stateBackupBundleSchema",
     "streamEventDocument",
@@ -309,6 +319,7 @@
   "experimentalRuntimeExports": [
     "DEFAULT_TIME_TO_SAFE_FIX_GOAL",
     "HARNESS_CLIENT_PROTOCOL_VERSION",
+    "SEMANTIC_COMPACTION_VERSION",
     "TIME_TO_SAFE_FIX_CARRIERS",
     "TIME_TO_SAFE_FIX_DIAGNOSTIC_CODES",
     "TIME_TO_SAFE_FIX_FAILURE_ORIGINS",
@@ -316,19 +327,28 @@
     "TIME_TO_SAFE_FIX_GOALS",
     "TIME_TO_SAFE_FIX_PROFILES",
     "TIME_TO_SAFE_FIX_SCHEMA_VERSION",
+    "applyHarnessToolPolicy",
     "classifyTimeToSafeFixFailure",
+    "createAcpConnection",
     "createHarnessClientAdapter",
+    "createHarnessToolPolicy",
+    "createProgressMonitor",
+    "createSemanticCompactor",
     "createTimeToSafeFixCases",
     "createTimeToSafeFixReport",
     "createTimeToSafeFixSample",
     "harnessClientCommandSchema",
     "harnessClientRequestSchema",
     "harnessLocalCredentialsSchema",
+    "harnessToolPolicySchema",
     "injectTimeToSafeFixAttack",
     "openHarnessActivityStore",
+    "openWorkspaceCheckpointStore",
     "readHarnessLocalCredentials",
+    "recommendCompactionModels",
     "recoverHarnessLocalService",
     "requestHarnessLocalService",
+    "serveAcpStdio",
     "startHarnessLocalService",
     "timeToSafeFixDriverResultSchema",
     "timeToSafeFixLatencyStatistics",
@@ -498,6 +518,9 @@
     "CliStreamErrorDocument",
     "CliStreamResultDocument",
     "CommandResult",
+    "CompactionModelAssessment",
+    "CompactionModelRecommendations",
+    "CompactionRecommendationRequest",
     "CreateChangeEnvelopeInput",
     "CreateHarnessOciEnvironmentOptions",
     "CreateHarnessOptions",
@@ -560,7 +583,9 @@
     "HarnessLocalServiceOptions",
     "HarnessMcpClients",
     "HarnessMcpConfiguration",
+    "HarnessMcpHttpOptions",
     "HarnessMcpPermission",
+    "HarnessMcpResourceClient",
     "HarnessMcpServerConfig",
     "HarnessMcpTransport",
     "HarnessMigrationResult",
@@ -588,6 +613,8 @@
     "HarnessSubagentProfile",
     "HarnessSubagentProfileDescriptor",
     "HarnessSubagentRuntime",
+    "HarnessToolPolicy",
+    "HarnessToolPolicyDecision",
     "ListFilesOptions",
     "ListFilesResult",
     "ListSessionsQuery",
@@ -605,6 +632,8 @@
     "OciRunBatchRequest",
     "OciRunRequest",
     "OpenSessionStoreOptions",
+    "ProgressMonitorState",
+    "ProgressSignal",
     "ProviderAvailability",
     "ProviderCapability",
     "ProviderCredentials",
@@ -649,8 +678,10 @@
     "TimeToSafeFixTask",
     "UpdateSessionInput",
     "UpdateSessionRunInput",
+    "WorkspaceCheckpoint",
     "WorkspaceFile",
     "WorkspaceIndexDiagnostics",
+    "WorkspaceRestoreOperation",
     "WorkspaceTopologyFile",
     "ZhivexHarness"
   ],
@@ -815,6 +846,9 @@
     "WorkspaceTopologyFile"
   ],
   "experimentalTypeExports": [
+    "CompactionModelAssessment",
+    "CompactionModelRecommendations",
+    "CompactionRecommendationRequest",
     "HarnessActivityEvent",
     "HarnessActivityOptions",
     "HarnessActivityPage",
@@ -833,6 +867,12 @@
     "HarnessLocalCredentials",
     "HarnessLocalService",
     "HarnessLocalServiceOptions",
+    "HarnessMcpHttpOptions",
+    "HarnessMcpResourceClient",
+    "HarnessToolPolicy",
+    "HarnessToolPolicyDecision",
+    "ProgressMonitorState",
+    "ProgressSignal",
     "TimeToSafeFixAggregate",
     "TimeToSafeFixCarrier",
     "TimeToSafeFixCase",
@@ -847,7 +887,9 @@
     "TimeToSafeFixRatioStatistics",
     "TimeToSafeFixReport",
     "TimeToSafeFixSample",
-    "TimeToSafeFixTask"
+    "TimeToSafeFixTask",
+    "WorkspaceCheckpoint",
+    "WorkspaceRestoreOperation"
   ],
   "cli": {
     "commands": [
@@ -905,6 +947,7 @@
         "allowed": [
           "--provider",
           "--model",
+          "--reasoning",
           "--profile",
           "--update",
           "--json"
@@ -917,10 +960,13 @@
         "allowed": [
           "--service",
           "--session",
+          "--compaction-model",
+          "--compaction-provider",
           "--pricing-file",
           "--usage-limit-usd",
           "--provider",
           "--model",
+          "--reasoning",
           "--profile",
           "--route",
           "--workspace",
@@ -932,7 +978,7 @@
           "--mcp-config",
           "--context-config",
           "--no-project-context",
-          "--agent-profile",
+          "--require-verified-delivery",
           "--execution",
           "--oci-runtime",
           "--oci-image",
@@ -946,6 +992,8 @@
           "--oci-max-workspace-bytes",
           "--oci-max-file-write-bytes",
           "--oci-tmpfs-mb",
+          "--token-budget",
+          "--context-tokens",
           "--no-token-budget",
           "--max-steps",
           "--timeout-ms",
@@ -968,6 +1016,7 @@
           "--require-capability",
           "--subagent",
           "--idempotency-key",
+          "--approval-mode",
           "--yes",
           "--json",
           "--jsonl"
@@ -986,6 +1035,12 @@
             "--input-cost-per-million",
             "--output-cost-per-million"
           ],
+          "--token-budget": [
+            "--no-token-budget"
+          ],
+          "--no-token-budget": [
+            "--token-budget"
+          ],
           "--max-cost-usd": [
             "--usage-limit-usd"
           ],
@@ -995,6 +1050,12 @@
           "--output-cost-per-million": [
             "--usage-limit-usd"
           ],
+          "--approval-mode": [
+            "--yes"
+          ],
+          "--yes": [
+            "--approval-mode"
+          ],
           "--json": [
             "--jsonl"
           ],
@@ -1009,6 +1070,7 @@
           "--usage-limit-usd",
           "--provider",
           "--model",
+          "--reasoning",
           "--profile",
           "--route",
           "--workspace",
@@ -1043,10 +1105,13 @@
       "chat": {
         "allowed": [
           "--service",
+          "--compaction-model",
+          "--compaction-provider",
           "--pricing-file",
           "--usage-limit-usd",
           "--provider",
           "--model",
+          "--reasoning",
           "--profile",
           "--route",
           "--workspace",
@@ -1058,7 +1123,7 @@
           "--mcp-config",
           "--context-config",
           "--no-project-context",
-          "--agent-profile",
+          "--require-verified-delivery",
           "--execution",
           "--oci-runtime",
           "--oci-image",
@@ -1072,6 +1137,8 @@
           "--oci-max-workspace-bytes",
           "--oci-max-file-write-bytes",
           "--oci-tmpfs-mb",
+          "--token-budget",
+          "--context-tokens",
           "--no-token-budget",
           "--max-steps",
           "--timeout-ms",
@@ -1093,6 +1160,7 @@
           "--allow-check",
           "--require-capability",
           "--subagent",
+          "--approval-mode",
           "--yes",
           "--session",
           "--continue"
@@ -1111,6 +1179,12 @@
             "--input-cost-per-million",
             "--output-cost-per-million"
           ],
+          "--token-budget": [
+            "--no-token-budget"
+          ],
+          "--no-token-budget": [
+            "--token-budget"
+          ],
           "--max-cost-usd": [
             "--usage-limit-usd"
           ],
@@ -1120,6 +1194,12 @@
           "--output-cost-per-million": [
             "--usage-limit-usd"
           ],
+          "--approval-mode": [
+            "--yes"
+          ],
+          "--yes": [
+            "--approval-mode"
+          ],
           "--session": [
             "--continue"
           ],
@@ -1140,6 +1220,7 @@
         "allowed": [
           "--provider",
           "--model",
+          "--reasoning",
           "--profile",
           "--workspace",
           "--state-dir",
@@ -1150,7 +1231,7 @@
           "--mcp-config",
           "--context-config",
           "--no-project-context",
-          "--agent-profile",
+          "--require-verified-delivery",
           "--execution",
           "--oci-runtime",
           "--oci-image",
@@ -1164,6 +1245,8 @@
           "--oci-max-workspace-bytes",
           "--oci-max-file-write-bytes",
           "--oci-tmpfs-mb",
+          "--token-budget",
+          "--context-tokens",
           "--no-token-budget",
           "--max-steps",
           "--timeout-ms",
@@ -1194,7 +1277,14 @@
           "--require-capability",
           "--subagent"
         ],
-        "conflicts": {}
+        "conflicts": {
+          "--token-budget": [
+            "--no-token-budget"
+          ],
+          "--no-token-budget": [
+            "--token-budget"
+          ]
+        }
       },
       "resume": {
         "allowed": [