@zhivex-ai/harness 1.2.0 → 1.3.0-rc.3

package/dist/index-pgqz45fj.js

@@ -0,0 +1,2449 @@
+import {
+  HarnessConfigError,
+  HarnessStateConflictError,
+  HarnessWorkspaceError
+} from "./index-fvca1xea.js";
+
+// src/persistence/persistence-secrets.ts
+var protectedValues = new Set;
+function assertNoPersistenceSecret(value) {
+  if (!protectedValues.size)
+    return;
+  const seen = new WeakSet;
+  const visit = (item) => {
+    if (typeof item === "string") {
+      for (const secret of protectedValues)
+        if (item.includes(secret))
+          throw new Error("PERSISTENCE_SECRET_REJECTED");
+    } else if (item instanceof Uint8Array) {
+      const bytes = Buffer.from(item.buffer, item.byteOffset, item.byteLength);
+      for (const secret of protectedValues)
+        if (bytes.includes(Buffer.from(secret)))
+          throw new Error("PERSISTENCE_SECRET_REJECTED");
+    } else if (item && typeof item === "object" && !seen.has(item)) {
+      seen.add(item);
+      for (const [key, entry] of Object.entries(item)) {
+        visit(key);
+        visit(entry);
+      }
+    }
+  };
+  visit(value);
+}
+
+// src/persistence/sqlite-access.ts
+import { closeSync, constants, fchmodSync, fstatSync, lstatSync, openSync, realpathSync } from "node:fs";
+import path from "node:path";
+var O_SHLOCK = 16;
+var O_EXLOCK = 32;
+var held = new WeakMap;
+var activeDescriptors = new Set;
+function filename(databasePath) {
+  const directory = realpathSync(path.dirname(path.resolve(databasePath)));
+  return path.join(directory, `.${path.basename(databasePath)}.access-lock`);
+}
+function releaseDescriptor(state) {
+  closeSync(state.fd);
+  activeDescriptors.delete(state.fd);
+}
+function makeLease(lock, fd, exclusive) {
+  const state = { filename: lock, fd, closed: false, borrowers: 0, exclusive };
+  const lease = Object.freeze({ fd, close() {
+    if (!state.closed) {
+      state.closed = true;
+      if (state.borrowers === 0)
+        releaseDescriptor(state);
+    }
+  } });
+  held.set(lease, state);
+  activeDescriptors.add(fd);
+  return lease;
+}
+function acquireSqliteAccess(databasePath, exclusive = false) {
+  if (databasePath === ":memory:" || process.platform !== "darwin")
+    return;
+  let fd;
+  try {
+    const lock = filename(databasePath);
+    fd = openSync(lock, constants.O_RDWR | constants.O_CREAT | constants.O_NOFOLLOW | constants.O_NONBLOCK | (exclusive ? O_EXLOCK : O_SHLOCK), 384);
+    const info = fstatSync(fd);
+    const current = lstatSync(lock);
+    if (!info.isFile() || info.nlink !== 1 || info.uid !== process.getuid?.() || info.size !== 0 || current.isSymbolicLink() || current.dev !== info.dev || current.ino !== info.ino)
+      throw new Error;
+    if (info.mode & 63)
+      fchmodSync(fd, 384);
+    if (fstatSync(fd).mode & 63)
+      throw new Error;
+    return makeLease(lock, fd, exclusive);
+  } catch {
+    if (fd !== undefined)
+      closeSync(fd);
+    throw new Error("SQLITE_ACCESS_UNAVAILABLE");
+  }
+}
+function retainSqliteAccess(lease, databasePath) {
+  validateSqliteAccess(lease, databasePath);
+  const state = held.get(lease);
+  state.borrowers++;
+  let released = false;
+  return () => {
+    if (!released) {
+      released = true;
+      state.borrowers--;
+      if (state.closed && state.borrowers === 0)
+        releaseDescriptor(state);
+    }
+  };
+}
+function validateSqliteAccess(lease, databasePath) {
+  try {
+    const state = held.get(lease);
+    if (!state || state.closed || state.filename !== filename(databasePath))
+      throw new Error;
+    const current = lstatSync(state.filename), owned = fstatSync(state.fd);
+    if (current.isSymbolicLink() || !current.isFile() || current.nlink !== 1 || current.dev !== owned.dev || current.ino !== owned.ino)
+      throw new Error;
+  } catch {
+    throw new Error("SQLITE_ACCESS_UNAVAILABLE");
+  }
+}
+
+// src/persistence/sqlite-database.ts
+import { createRequire } from "node:module";
+var require2 = createRequire(import.meta.url);
+var DatabaseSyncConstructor;
+var loadDatabaseSync = () => {
+  DatabaseSyncConstructor ??= require2("node:sqlite").DatabaseSync;
+  return DatabaseSyncConstructor;
+};
+var normalizeNumberedParameters = (sql) => {
+  const indexes = new Set;
+  const normalizedSql = sql.replace(/\?([1-9]\d*)/g, (_match, rawIndex) => {
+    const index = Number(rawIndex);
+    indexes.add(index);
+    return `$__zhivex_${index}`;
+  });
+  return {
+    sql: normalizedSql,
+    indexes: [...indexes].sort((left, right) => left - right)
+  };
+};
+var numberedBindings = (indexes, parameters) => {
+  if (indexes.length === 0)
+    return;
+  const maximumIndex = indexes.at(-1);
+  if (parameters.length !== maximumIndex) {
+    throw new Error(`SQLite numbered parameters require exactly ${maximumIndex} binding${maximumIndex === 1 ? "" : "s"}; received ${parameters.length}.`);
+  }
+  return Object.fromEntries(indexes.map((index) => [`$__zhivex_${index}`, parameters[index - 1]]));
+};
+
+class SqliteDatabase {
+  #database;
+  #access;
+  #ownedAccess;
+  #releaseBorrowed;
+  #databasePath;
+  constructor(databasePath, options = {}) {
+    options.create;
+    options.strict;
+    if (options.accessLease)
+      validateSqliteAccess(options.accessLease, databasePath);
+    this.#access = options.accessLease ?? acquireSqliteAccess(databasePath);
+    this.#ownedAccess = options.accessLease === undefined;
+    this.#databasePath = databasePath;
+    this.#releaseBorrowed = options.accessLease ? retainSqliteAccess(options.accessLease, databasePath) : undefined;
+    try {
+      const DatabaseSync = loadDatabaseSync();
+      this.#database = new DatabaseSync(databasePath, {
+        ...options.readonly === undefined ? {} : { readOnly: options.readonly }
+      });
+    } catch (error) {
+      if (this.#ownedAccess)
+        this.#access?.close();
+      this.#releaseBorrowed?.();
+      throw error;
+    }
+  }
+  exec(sql) {
+    if (this.#access)
+      validateSqliteAccess(this.#access, this.#databasePath);
+    assertNoPersistenceSecret(sql);
+    this.#database.exec(sql);
+  }
+  query(sql) {
+    assertNoPersistenceSecret(sql);
+    if (this.#access)
+      validateSqliteAccess(this.#access, this.#databasePath);
+    const normalized = normalizeNumberedParameters(sql);
+    const statement = this.#database.prepare(normalized.sql);
+    const invoke = (method, parameters) => {
+      if (this.#access)
+        validateSqliteAccess(this.#access, this.#databasePath);
+      assertNoPersistenceSecret(sql);
+      assertNoPersistenceSecret(parameters);
+      const bindings = numberedBindings(normalized.indexes, parameters);
+      return bindings ? method(bindings) : method(...parameters);
+    };
+    return {
+      run: (...parameters) => invoke(statement.run.bind(statement), parameters),
+      get: (...parameters) => invoke(statement.get.bind(statement), parameters),
+      all: (...parameters) => invoke(statement.all.bind(statement), parameters)
+    };
+  }
+  close(throwOnError = true) {
+    try {
+      this.#database.close();
+      if (this.#ownedAccess)
+        this.#access?.close();
+      this.#releaseBorrowed?.();
+    } catch (error) {
+      if (throwOnError) {
+        throw error;
+      }
+    }
+  }
+}
+
+// src/persistence/state-directory.ts
+import { lstat } from "node:fs/promises";
+import path2 from "node:path";
+var SENSITIVE_STATE_SEGMENTS = new Set([".git", ".env", ".npmrc", "dist", "node_modules", "src"]);
+var isInside = (root, candidate) => {
+  const relative = path2.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path2.sep}`) && relative !== ".." && !path2.isAbsolute(relative);
+};
+var validateStateDirectory = async (workspace, stateDirectory) => {
+  if (stateDirectory === workspace || stateDirectory === path2.parse(stateDirectory).root) {
+    throw new HarnessWorkspaceError("The state directory cannot be the workspace or filesystem root.");
+  }
+  const insideWorkspace = isInside(workspace, stateDirectory);
+  const relativeSegments = insideWorkspace ? path2.relative(workspace, stateDirectory).split(path2.sep).filter(Boolean) : stateDirectory.slice(path2.parse(stateDirectory).root.length).split(path2.sep).filter(Boolean);
+  const sensitiveSegment = insideWorkspace ? relativeSegments.find((segment) => SENSITIVE_STATE_SEGMENTS.has(segment)) : undefined;
+  if (sensitiveSegment) {
+    throw new HarnessWorkspaceError(`The state directory is inside the protected workspace path: ${sensitiveSegment}.`);
+  }
+  if (!insideWorkspace) {
+    try {
+      const externalEntry = await lstat(stateDirectory);
+      if (externalEntry.isSymbolicLink()) {
+        throw new HarnessWorkspaceError(`The state directory must not be a symbolic link: ${stateDirectory}.`);
+      }
+      if (!externalEntry.isDirectory()) {
+        throw new HarnessWorkspaceError(`The state directory is not a directory: ${stateDirectory}.`);
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+    return;
+  }
+  let current = workspace;
+  for (const segment of relativeSegments) {
+    current = path2.join(current, segment);
+    try {
+      const entry = await lstat(current);
+      if (entry.isSymbolicLink()) {
+        throw new HarnessWorkspaceError(`The state directory must not resolve through a symbolic link: ${current}.`);
+      }
+      if (!entry.isDirectory()) {
+        throw new HarnessWorkspaceError(`The state directory path contains a non-directory entry: ${current}.`);
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        break;
+      }
+      throw error;
+    }
+  }
+};
+
+// src/persistence/sessions.ts
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, lstat as lstat3, mkdir, open as open2, realpath, stat } from "node:fs/promises";
+import path4 from "node:path";
+import { createRedactionPolicy } from "@zhivex-ai/agents";
+
+// src/persistence/state-gitignore.ts
+import { constants as constants2 } from "node:fs";
+import { lstat as lstat2, open } from "node:fs/promises";
+import path3 from "node:path";
+var exclusion = `# Local Harness state; never commit sessions, runs, or database journals.
+*
+`;
+var maximumExistingBytes = 65536;
+var maximumProtectedBytes = maximumExistingBytes + Buffer.byteLength(exclusion) + 1;
+async function protectStateFromGit(workspace, stateDirectory) {
+  const directory = path3.resolve(stateDirectory) === path3.join(workspace, ".zhivex-harness", "runs") ? path3.dirname(stateDirectory) : stateDirectory;
+  const filename2 = path3.join(directory, ".gitignore");
+  try {
+    const handle = await open(filename2, constants2.O_RDWR | constants2.O_CREAT | constants2.O_APPEND | constants2.O_NOFOLLOW, 384);
+    try {
+      const info = await handle.stat();
+      const entry = await lstat2(filename2);
+      if (entry.isSymbolicLink() || entry.dev !== info.dev || entry.ino !== info.ino)
+        throw new Error;
+      if (!info.isFile() || info.nlink !== 1 || process.getuid && info.uid !== process.getuid() || info.size > maximumProtectedBytes)
+        throw new Error;
+      const buffer = Buffer.alloc(maximumProtectedBytes + 1);
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+      if (bytesRead > maximumProtectedBytes)
+        throw new Error;
+      const content = buffer.subarray(0, bytesRead).toString("utf8");
+      if (!content.endsWith(exclusion)) {
+        if (bytesRead > maximumExistingBytes)
+          throw new Error;
+        await handle.writeFile(`${content && !content.endsWith(`
+`) ? `
+` : ""}${exclusion}`);
+      }
+      const current = await lstat2(filename2);
+      if (current.isSymbolicLink() || current.dev !== info.dev || current.ino !== info.ino)
+        throw new Error;
+    } finally {
+      await handle.close();
+    }
+  } catch (cause) {
+    throw new HarnessWorkspaceError("Cannot protect the local state directory with a safe .gitignore.", { cause });
+  }
+}
+
+// src/persistence/sessions.ts
+var HARNESS_SESSION_INDEX_FILE = "operations.sqlite";
+var HARNESS_SESSION_SCHEMA_VERSION = 1;
+var SESSION_RUN_STATUSES = [
+  "created",
+  "running",
+  "waiting_approval",
+  "cancel_requested",
+  "completed",
+  "failed",
+  "cancelled",
+  "timed_out"
+];
+var TERMINAL_SESSION_RUN_STATUSES = [
+  "completed",
+  "failed",
+  "cancelled",
+  "timed_out"
+];
+var DEFAULT_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
+var DEFAULT_MAX_SESSIONS = 200;
+var DEFAULT_MAX_RUNS = 1000;
+var DEFAULT_MAX_METADATA_BYTES = 4096;
+var DEFAULT_MAX_INDEX_BYTES = 16 * 1024 * 1024;
+var MAX_LIST_LIMIT = 200;
+var ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:@/+\-]{0,255}$/;
+var TERMINAL_STATUSES = new Set(TERMINAL_SESSION_RUN_STATUSES);
+var ACTIVE_STATUSES = new Set([
+  "created",
+  "running",
+  "waiting_approval",
+  "cancel_requested"
+]);
+var STATUS_TRANSITIONS = {
+  created: new Set(["created", "running", "waiting_approval", "completed", "failed", "cancelled", "timed_out"]),
+  running: new Set(["running", "waiting_approval", "cancel_requested", "completed", "failed", "cancelled", "timed_out"]),
+  waiting_approval: new Set(["waiting_approval", "running", "cancel_requested", "completed", "failed", "cancelled", "timed_out"]),
+  cancel_requested: new Set(["cancel_requested", "cancelled", "failed", "timed_out"]),
+  completed: new Set(["completed"]),
+  failed: new Set(["failed"]),
+  cancelled: new Set(["cancelled"]),
+  timed_out: new Set(["timed_out"])
+};
+var metadataRedaction = createRedactionPolicy({
+  includeEmails: true,
+  rules: [
+    { name: "private-key", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g },
+    { name: "common-provider-key", pattern: /\b(?:sk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{8,}\b/gi },
+    { name: "url-credentials", pattern: /:\/\/[^\s/@:]+:[^\s/@]+@/g, replacement: "://[REDACTED]@" }
+  ]
+});
+var byteLength = (value) => Buffer.byteLength(value, "utf8");
+var boundedInteger = (name, value, fallback, minimum) => {
+  const resolved = value ?? fallback;
+  if (!Number.isSafeInteger(resolved) || resolved < minimum) {
+    throw new HarnessConfigError(`${name} must be an integer greater than or equal to ${minimum}.`);
+  }
+  return resolved;
+};
+var assertTimestamp = (name, value) => {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new HarnessConfigError(`${name} must be a non-negative integer timestamp.`);
+  }
+};
+var assertIdentifier = (name, value) => {
+  if (!ID_PATTERN.test(value)) {
+    throw new HarnessConfigError(`${name} contains unsupported characters or exceeds 256 bytes.`);
+  }
+  if (metadataRedaction.redactText(value) !== value) {
+    throw new HarnessConfigError(`${name} resembles sensitive metadata and cannot be stored in the session index.`);
+  }
+  return value;
+};
+var assertScopeSegment = (name, value) => {
+  const normalized = value.trim();
+  if (!normalized || normalized.length > 128 || /[\u0000-\u001f\u007f]/.test(normalized)) {
+    throw new HarnessConfigError(`${name} must contain 1-128 printable characters.`);
+  }
+  return normalized;
+};
+var normalizeTitle = (value, maxMetadataBytes) => {
+  if (value === undefined || value === null) {
+    return value;
+  }
+  const normalized = metadataRedaction.redactText(value).replace(/[\u0000-\u001f\u007f]+/g, " ").trim();
+  if (!normalized) {
+    throw new HarnessConfigError("Session title must not be empty.");
+  }
+  if (byteLength(normalized) > maxMetadataBytes) {
+    throw new HarnessConfigError(`Session title exceeds the ${maxMetadataBytes}-byte metadata limit.`);
+  }
+  return normalized;
+};
+var normalizeScope = (scope) => {
+  const tenantId = assertScopeSegment("scope.tenantId", scope.tenantId);
+  const userId = scope.userId === undefined ? "" : assertScopeSegment("scope.userId", scope.userId);
+  const namespace = scope.namespace === undefined ? "" : assertScopeSegment("scope.namespace", scope.namespace);
+  return `${tenantId}\x00${userId}\x00${namespace}`;
+};
+var stableKey = (kind, value) => createHash("sha256").update(kind).update("\x00").update(value).digest("hex");
+var sessionId = () => `ses_${randomUUID()}`;
+var turnId = () => `turn_${randomUUID()}`;
+var ensurePrivateDatabase = async (workspace, stateDirectory) => {
+  const requestedStateDirectory = path4.resolve(stateDirectory);
+  await validateStateDirectory(workspace, requestedStateDirectory);
+  await mkdir(requestedStateDirectory, { recursive: true, mode: 448 });
+  const directoryEntry = await lstat3(requestedStateDirectory);
+  if (directoryEntry.isSymbolicLink() || !directoryEntry.isDirectory()) {
+    throw new HarnessWorkspaceError(`The session state directory must be a real directory: ${requestedStateDirectory}.`);
+  }
+  await chmod(requestedStateDirectory, 448);
+  const canonicalStateDirectory = await realpath(requestedStateDirectory);
+  await protectStateFromGit(workspace, canonicalStateDirectory);
+  const databasePath = path4.join(canonicalStateDirectory, HARNESS_SESSION_INDEX_FILE);
+  let databaseEntry;
+  try {
+    const handle = await open2(databasePath, "wx", 384);
+    await handle.close();
+    databaseEntry = await lstat3(databasePath);
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+    databaseEntry = await lstat3(databasePath);
+  }
+  if (databaseEntry.isSymbolicLink() || !databaseEntry.isFile()) {
+    throw new HarnessWorkspaceError(`The session SQLite path must be a real file: ${databasePath}.`);
+  }
+  await chmod(databasePath, 384);
+  return { databasePath, databaseEntry };
+};
+var toRunReference = (row) => ({
+  turnId: row.turn_id,
+  ...row.source_turn_id ? { sourceTurnId: row.source_turn_id } : {},
+  sequence: row.ordinal,
+  runId: row.run_id,
+  provider: row.provider,
+  model: row.model,
+  ...row.role ? { role: row.role } : {},
+  status: row.status,
+  createdAt: row.created_at,
+  updatedAt: row.updated_at,
+  ...row.completed_at === null ? {} : { completedAt: row.completed_at }
+});
+var metadataSize = (input) => Object.values(input).reduce((total, value) => total + (typeof value === "string" ? byteLength(value) : 0), 0);
+var isTerminal = (status) => TERMINAL_STATUSES.has(status);
+var openCliSessionStore = async (options) => {
+  const workspace = await realpath(path4.resolve(options.workspace));
+  const workspaceEntry = await stat(workspace);
+  if (!workspaceEntry.isDirectory()) {
+    throw new HarnessWorkspaceError(`The session workspace is not a directory: ${workspace}.`);
+  }
+  const scopeValue = normalizeScope(options.scope);
+  const workspaceKey = stableKey("workspace", workspace);
+  const scopeKey = stableKey("scope", scopeValue);
+  const retentionMs = boundedInteger("retentionMs", options.retentionMs, DEFAULT_RETENTION_MS, 0);
+  const maxSessions = boundedInteger("maxSessionsPerWorkspace", options.maxSessionsPerWorkspace, DEFAULT_MAX_SESSIONS, 1);
+  const maxRuns = boundedInteger("maxRunsPerSession", options.maxRunsPerSession, DEFAULT_MAX_RUNS, 1);
+  const maxMetadataBytes = boundedInteger("maxMetadataBytes", options.maxMetadataBytes, DEFAULT_MAX_METADATA_BYTES, 32);
+  const maxIndexBytes = boundedInteger("maxIndexBytes", options.maxIndexBytes, DEFAULT_MAX_INDEX_BYTES, 1024);
+  const busyTimeoutMs = boundedInteger("busyTimeoutMs", options.busyTimeoutMs, 5000, 0);
+  if (busyTimeoutMs > 5000)
+    throw new HarnessConfigError("busyTimeoutMs cannot exceed 5000.");
+  const now = options.now ?? Date.now;
+  const { databasePath, databaseEntry } = await ensurePrivateDatabase(workspace, options.stateDirectory);
+  const database = new SqliteDatabase(databasePath, { create: false, strict: true });
+  let closed = false;
+  const assertOpen = () => {
+    if (closed) {
+      throw new HarnessStateConflictError("The CLI session store is closed.");
+    }
+  };
+  const transaction = (operation) => {
+    assertOpen();
+    database.exec("BEGIN IMMEDIATE");
+    try {
+      const result = operation();
+      const size = database.query(`
+        SELECT
+          COALESCE((SELECT SUM(metadata_bytes) FROM zhivex_cli_sessions WHERE workspace_key = ?1 AND scope_key = ?2), 0) +
+          COALESCE((SELECT SUM(r.metadata_bytes) FROM zhivex_cli_session_runs r JOIN zhivex_cli_sessions s ON s.session_id = r.session_id WHERE s.workspace_key = ?1 AND s.scope_key = ?2), 0)
+          AS size
+      `).get(workspaceKey, scopeKey)?.size ?? 0;
+      if (size > maxIndexBytes) {
+        throw new HarnessStateConflictError(`Session index metadata exceeds the ${maxIndexBytes}-byte limit.`);
+      }
+      database.exec("COMMIT");
+      return result;
+    } catch (error) {
+      try {
+        database.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  };
+  const ensureRevision = (row, expected) => {
+    if (expected !== undefined && row.revision !== expected) {
+      throw new HarnessStateConflictError(`Session ${row.session_id} changed concurrently (expected revision ${expected}, found ${row.revision}).`, { retryable: true });
+    }
+  };
+  const selectSessionRow = (candidateSessionId, includeDeleted = false) => {
+    assertIdentifier("sessionId", candidateSessionId);
+    return database.query(`
+      SELECT session_id, title, parent_session_id, forked_from_turn_id, revision, activity_seq,
+             created_at, updated_at, archived_at, deleted_at
+      FROM zhivex_cli_sessions
+      WHERE session_id = ?1 AND workspace_key = ?2 AND scope_key = ?3
+      ${includeDeleted ? "" : "AND deleted_at IS NULL"}
+    `).get(candidateSessionId, workspaceKey, scopeKey);
+  };
+  const requireSessionRow = (candidateSessionId, includeDeleted = false) => {
+    const row = selectSessionRow(candidateSessionId, includeDeleted);
+    if (!row) {
+      throw new HarnessStateConflictError(`Session ${candidateSessionId} was not found in this workspace and scope.`);
+    }
+    return row;
+  };
+  const selectRuns = (candidateSessionId) => database.query(`
+    SELECT turn_id, source_turn_id, ordinal, run_id, provider, model, role, status,
+           created_at, updated_at, completed_at
+    FROM zhivex_cli_session_runs
+    WHERE session_id = ?1
+    ORDER BY ordinal ASC
+  `).all(candidateSessionId).map(toRunReference);
+  const nextActivitySequence = () => database.query(`
+    SELECT COALESCE(MAX(activity_seq), 0) + 1 AS count
+    FROM zhivex_cli_sessions
+    WHERE workspace_key = ?1 AND scope_key = ?2
+  `).get(workspaceKey, scopeKey)?.count ?? 1;
+  const sessionBase = (row) => ({
+    schemaVersion: HARNESS_SESSION_SCHEMA_VERSION,
+    sessionId: row.session_id,
+    workspaceKey,
+    scopeKey,
+    ...row.title ? { title: row.title } : {},
+    ...row.parent_session_id ? { parentSessionId: row.parent_session_id } : {},
+    ...row.forked_from_turn_id ? { forkedFromTurnId: row.forked_from_turn_id } : {},
+    revision: row.revision,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    ...row.archived_at === null ? {} : { archivedAt: row.archived_at },
+    ...row.deleted_at === null ? {} : { deletedAt: row.deleted_at }
+  });
+  const hydrate = (row) => ({
+    ...sessionBase(row),
+    runs: selectRuns(row.session_id)
+  });
+  const latestRunRow = (candidateSessionId) => database.query(`
+    SELECT turn_id, source_turn_id, ordinal, run_id, provider, model, role, status,
+           created_at, updated_at, completed_at
+    FROM zhivex_cli_session_runs
+    WHERE session_id = ?1
+    ORDER BY ordinal DESC
+    LIMIT 1
+  `).get(candidateSessionId);
+  const assertNoActiveRun = (candidateSessionId, action) => {
+    const latest = latestRunRow(candidateSessionId);
+    if (latest && ACTIVE_STATUSES.has(latest.status)) {
+      throw new HarnessStateConflictError(`Cannot ${action} session ${candidateSessionId} while run ${latest.run_id} is ${latest.status}.`);
+    }
+  };
+  const insertRun = (candidateSessionId, input, sequence, sourceTurnId) => {
+    const runId = assertIdentifier("runId", input.runId);
+    const provider = assertIdentifier("provider", input.provider);
+    const model = assertIdentifier("model", input.model);
+    const role = input.role === undefined ? null : assertIdentifier("role", input.role);
+    const status = input.status ?? "created";
+    if (!SESSION_RUN_STATUSES.includes(status)) {
+      throw new HarnessConfigError(`Unsupported session run status: ${String(status)}.`);
+    }
+    const createdAt = input.createdAt ?? now();
+    assertTimestamp("createdAt", createdAt);
+    const entryBytes = metadataSize({ runId, provider, model, role });
+    if (entryBytes > maxMetadataBytes) {
+      throw new HarnessConfigError(`Run reference metadata exceeds the ${maxMetadataBytes}-byte limit.`);
+    }
+    const candidateTurnId = turnId();
+    database.query(`
+      INSERT INTO zhivex_cli_session_runs (
+        turn_id, source_turn_id, session_id, ordinal, run_id, provider, model, role,
+        status, created_at, updated_at, completed_at, metadata_bytes
+      ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?10, ?11, ?12)
+    `).run(candidateTurnId, sourceTurnId ?? null, candidateSessionId, sequence, runId, provider, model, role, status, createdAt, isTerminal(status) ? createdAt : null, entryBytes);
+  };
+  try {
+    const openedEntry = await lstat3(databasePath);
+    if (openedEntry.isSymbolicLink() || !openedEntry.isFile() || openedEntry.dev !== databaseEntry.dev || openedEntry.ino !== databaseEntry.ino) {
+      throw new HarnessWorkspaceError(`The session SQLite path changed while it was being opened: ${databasePath}.`);
+    }
+    database.exec(`PRAGMA busy_timeout = ${busyTimeoutMs}`);
+    database.exec("PRAGMA journal_mode = WAL");
+    database.exec("PRAGMA foreign_keys = ON");
+    database.exec(`
+      CREATE TABLE IF NOT EXISTS zhivex_cli_session_schema (
+        singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+        version INTEGER NOT NULL
+      );
+      INSERT OR IGNORE INTO zhivex_cli_session_schema (singleton, version)
+      VALUES (1, ${HARNESS_SESSION_SCHEMA_VERSION});
+      CREATE TABLE IF NOT EXISTS zhivex_cli_sessions (
+        session_id TEXT PRIMARY KEY,
+        workspace_key TEXT NOT NULL,
+        scope_key TEXT NOT NULL,
+        title TEXT,
+        parent_session_id TEXT,
+        forked_from_turn_id TEXT,
+        revision INTEGER NOT NULL DEFAULT 0,
+        activity_seq INTEGER NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        archived_at INTEGER,
+        deleted_at INTEGER,
+        metadata_bytes INTEGER NOT NULL,
+        CHECK (length(session_id) <= 260),
+        CHECK (metadata_bytes >= 0)
+      );
+      CREATE INDEX IF NOT EXISTS zhivex_cli_sessions_latest
+        ON zhivex_cli_sessions (workspace_key, scope_key, deleted_at, archived_at, activity_seq DESC);
+      CREATE TABLE IF NOT EXISTS zhivex_cli_session_runs (
+        turn_id TEXT PRIMARY KEY,
+        source_turn_id TEXT,
+        session_id TEXT NOT NULL REFERENCES zhivex_cli_sessions(session_id) ON DELETE CASCADE,
+        ordinal INTEGER NOT NULL,
+        run_id TEXT NOT NULL,
+        provider TEXT NOT NULL,
+        model TEXT NOT NULL,
+        role TEXT,
+        status TEXT NOT NULL CHECK (status IN ('created', 'running', 'waiting_approval', 'cancel_requested', 'completed', 'failed', 'cancelled', 'timed_out')),
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        completed_at INTEGER,
+        metadata_bytes INTEGER NOT NULL,
+        UNIQUE (session_id, ordinal),
+        UNIQUE (session_id, run_id),
+        CHECK (ordinal >= 0),
+        CHECK (metadata_bytes >= 0)
+      );
+      CREATE INDEX IF NOT EXISTS zhivex_cli_session_runs_latest
+        ON zhivex_cli_session_runs (session_id, ordinal DESC);
+    `);
+    const schemaVersion = database.query("SELECT version FROM zhivex_cli_session_schema WHERE singleton = 1").get()?.version;
+    if (schemaVersion !== HARNESS_SESSION_SCHEMA_VERSION) {
+      throw new HarnessStateConflictError(`Unsupported CLI session schema version: ${String(schemaVersion)}.`);
+    }
+    await chmod(databasePath, 384);
+  } catch (error) {
+    database.close(false);
+    throw error;
+  }
+  const prune = async (input = {}) => transaction(() => {
+    const before = input.before ?? Math.max(0, now() - retentionMs);
+    assertTimestamp("before", before);
+    const deletedSessions = database.query(`
+      SELECT COUNT(*) AS count FROM zhivex_cli_sessions
+      WHERE workspace_key = ?1 AND scope_key = ?2
+        AND updated_at < ?3
+        AND (archived_at IS NOT NULL OR deleted_at IS NOT NULL)
+    `).get(workspaceKey, scopeKey, before)?.count ?? 0;
+    database.query(`
+      DELETE FROM zhivex_cli_sessions
+      WHERE workspace_key = ?1 AND scope_key = ?2
+        AND updated_at < ?3
+        AND (archived_at IS NOT NULL OR deleted_at IS NOT NULL)
+    `).run(workspaceKey, scopeKey, before);
+    return { before, deletedSessions };
+  });
+  const store = {
+    databasePath,
+    workspaceKey,
+    scopeKey,
+    async create(input = {}) {
+      return transaction(() => {
+        const cutoff = Math.max(0, now() - retentionMs);
+        database.query(`
+          DELETE FROM zhivex_cli_sessions
+          WHERE workspace_key = ?1 AND scope_key = ?2 AND updated_at < ?3
+            AND (archived_at IS NOT NULL OR deleted_at IS NOT NULL)
+        `).run(workspaceKey, scopeKey, cutoff);
+        const count = database.query(`
+          SELECT COUNT(*) AS count FROM zhivex_cli_sessions
+          WHERE workspace_key = ?1 AND scope_key = ?2
+        `).get(workspaceKey, scopeKey)?.count ?? 0;
+        if (count >= maxSessions) {
+          throw new HarnessStateConflictError(`Session limit reached for this workspace and scope (${maxSessions}). Archive and prune an older session.`);
+        }
+        const createdAt = now();
+        assertTimestamp("now", createdAt);
+        const title = normalizeTitle(input.title, maxMetadataBytes) ?? null;
+        const candidateSessionId = sessionId();
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          INSERT INTO zhivex_cli_sessions (
+            session_id, workspace_key, scope_key, title, revision, created_at,
+            updated_at, activity_seq, metadata_bytes
+          ) VALUES (?1, ?2, ?3, ?4, 0, ?5, ?5, ?6, ?7)
+        `).run(candidateSessionId, workspaceKey, scopeKey, title, createdAt, activitySequence, metadataSize({ title }));
+        if (input.initialRun) {
+          insertRun(candidateSessionId, input.initialRun, 0);
+        }
+        return hydrate(requireSessionRow(candidateSessionId));
+      });
+    },
+    async get(candidateSessionId, input = {}) {
+      assertOpen();
+      const row = selectSessionRow(candidateSessionId, input.includeDeleted ?? false);
+      return row ? hydrate(row) : undefined;
+    },
+    async list(query = {}) {
+      assertOpen();
+      const limit = boundedInteger("limit", query.limit, 50, 1);
+      if (limit > MAX_LIST_LIMIT) {
+        throw new HarnessConfigError(`limit cannot exceed ${MAX_LIST_LIMIT}.`);
+      }
+      const search = query.search?.trim() ?? "";
+      if (search.length > 256)
+        throw new HarnessConfigError("Session search exceeds 256 characters.");
+      const rows = database.query(`
+        SELECT session_id, title, parent_session_id, forked_from_turn_id, revision, activity_seq,
+               created_at, updated_at, archived_at, deleted_at
+        FROM zhivex_cli_sessions
+        WHERE workspace_key = ?1 AND scope_key = ?2
+          AND (?4 = '' OR instr(lower(COALESCE(title, '')), lower(?4)) > 0 OR instr(lower(session_id), lower(?4)) > 0)
+          ${query.includeArchived ? "" : "AND archived_at IS NULL"}
+          ${query.includeDeleted ? "" : "AND deleted_at IS NULL"}
+        ORDER BY activity_seq DESC
+        LIMIT ?3
+      `).all(workspaceKey, scopeKey, limit, search);
+      return rows.map((row) => {
+        const latest = latestRunRow(row.session_id);
+        const runCount = database.query("SELECT COUNT(*) AS count FROM zhivex_cli_session_runs WHERE session_id = ?1").get(row.session_id)?.count ?? 0;
+        return {
+          ...sessionBase(row),
+          runCount,
+          ...latest ? { latestRun: toRunReference(latest) } : {}
+        };
+      });
+    },
+    async latest(input = {}) {
+      assertOpen();
+      const row = database.query(`
+        SELECT session_id, title, parent_session_id, forked_from_turn_id, revision, activity_seq,
+               created_at, updated_at, archived_at, deleted_at
+        FROM zhivex_cli_sessions
+        WHERE workspace_key = ?1 AND scope_key = ?2 AND deleted_at IS NULL
+          ${input.includeArchived ? "" : "AND archived_at IS NULL"}
+        ORDER BY activity_seq DESC
+        LIMIT 1
+      `).get(workspaceKey, scopeKey);
+      return row ? hydrate(row) : undefined;
+    },
+    async update(candidateSessionId, input) {
+      return transaction(() => {
+        const row = requireSessionRow(candidateSessionId);
+        ensureRevision(row, input.expectedRevision);
+        if (input.archived === true) {
+          assertNoActiveRun(candidateSessionId, "archive");
+        }
+        const title = input.title === undefined ? row.title : normalizeTitle(input.title, maxMetadataBytes) ?? null;
+        const updatedAt = now();
+        assertTimestamp("now", updatedAt);
+        const archivedAt = input.archived === undefined ? row.archived_at : input.archived ? updatedAt : null;
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          UPDATE zhivex_cli_sessions
+          SET title = ?1, archived_at = ?2, updated_at = ?3, revision = revision + 1,
+              metadata_bytes = ?4, activity_seq = ?5
+          WHERE session_id = ?6 AND workspace_key = ?7 AND scope_key = ?8 AND revision = ?9
+        `).run(title, archivedAt, updatedAt, metadataSize({ title }), activitySequence, candidateSessionId, workspaceKey, scopeKey, row.revision);
+        return hydrate(requireSessionRow(candidateSessionId));
+      });
+    },
+    async rename(candidateSessionId, title, input = {}) {
+      return store.update(candidateSessionId, {
+        title,
+        ...input.expectedRevision === undefined ? {} : { expectedRevision: input.expectedRevision }
+      });
+    },
+    async appendRun(candidateSessionId, input, appendOptions = {}) {
+      return transaction(() => {
+        const row = requireSessionRow(candidateSessionId);
+        ensureRevision(row, appendOptions.expectedRevision);
+        if (row.archived_at !== null) {
+          throw new HarnessStateConflictError(`Cannot append a run to archived session ${candidateSessionId}.`);
+        }
+        const existing = database.query(`
+          SELECT turn_id, source_turn_id, ordinal, run_id, provider, model, role, status,
+                 created_at, updated_at, completed_at
+          FROM zhivex_cli_session_runs WHERE session_id = ?1 AND run_id = ?2
+        `).get(candidateSessionId, input.runId);
+        if (existing) {
+          const requestedStatus = input.status ?? "created";
+          if (existing.provider === input.provider && existing.model === input.model && (existing.role ?? undefined) === input.role && existing.status === requestedStatus) {
+            return hydrate(row);
+          }
+          throw new HarnessStateConflictError(`Run ${input.runId} is already immutably bound to ${existing.provider}/${existing.model} in this session.`);
+        }
+        assertNoActiveRun(candidateSessionId, "start another run in");
+        const count = database.query("SELECT COUNT(*) AS count FROM zhivex_cli_session_runs WHERE session_id = ?1").get(candidateSessionId)?.count ?? 0;
+        if (count >= maxRuns) {
+          throw new HarnessStateConflictError(`Run-reference limit reached for session ${candidateSessionId} (${maxRuns}).`);
+        }
+        insertRun(candidateSessionId, input, count);
+        const updatedAt = now();
+        assertTimestamp("now", updatedAt);
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          UPDATE zhivex_cli_sessions SET updated_at = ?1, activity_seq = ?2, revision = revision + 1
+          WHERE session_id = ?3 AND revision = ?4
+        `).run(updatedAt, activitySequence, candidateSessionId, row.revision);
+        return hydrate(requireSessionRow(candidateSessionId));
+      });
+    },
+    async updateRun(candidateSessionId, runId, input) {
+      return transaction(() => {
+        const session = requireSessionRow(candidateSessionId);
+        ensureRevision(session, input.expectedSessionRevision);
+        assertIdentifier("runId", runId);
+        const run = database.query(`
+          SELECT turn_id, source_turn_id, ordinal, run_id, provider, model, role, status,
+                 created_at, updated_at, completed_at
+          FROM zhivex_cli_session_runs WHERE session_id = ?1 AND run_id = ?2
+        `).get(candidateSessionId, runId);
+        if (!run) {
+          throw new HarnessStateConflictError(`Run ${runId} is not linked to session ${candidateSessionId}.`);
+        }
+        if (!STATUS_TRANSITIONS[run.status].has(input.status)) {
+          throw new HarnessStateConflictError(`Run ${runId} cannot transition from ${run.status} to ${input.status}.`);
+        }
+        const updatedAt = input.updatedAt ?? now();
+        assertTimestamp("updatedAt", updatedAt);
+        if (updatedAt < run.updated_at) {
+          throw new HarnessStateConflictError(`Run ${runId} update timestamp cannot move backwards.`);
+        }
+        const completedAt = isTerminal(input.status) ? input.completedAt ?? updatedAt : null;
+        if (completedAt !== null) {
+          assertTimestamp("completedAt", completedAt);
+          if (completedAt < run.created_at || completedAt > updatedAt) {
+            throw new HarnessConfigError("completedAt must be between the run creation and update timestamps.");
+          }
+        }
+        database.query(`
+          UPDATE zhivex_cli_session_runs
+          SET status = ?1, updated_at = ?2, completed_at = ?3
+          WHERE session_id = ?4 AND run_id = ?5
+        `).run(input.status, updatedAt, completedAt, candidateSessionId, runId);
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          UPDATE zhivex_cli_sessions SET updated_at = ?1, activity_seq = ?2, revision = revision + 1
+          WHERE session_id = ?3 AND revision = ?4
+        `).run(updatedAt, activitySequence, candidateSessionId, session.revision);
+        return hydrate(requireSessionRow(candidateSessionId));
+      });
+    },
+    async fork(candidateSessionId, input = {}) {
+      return transaction(() => {
+        const source = requireSessionRow(candidateSessionId);
+        ensureRevision(source, input.expectedRevision);
+        const sourceRuns = selectRuns(candidateSessionId);
+        let forkRuns = sourceRuns;
+        let forkedFromTurnId;
+        if (input.atTurnId) {
+          const index = sourceRuns.findIndex((run) => run.turnId === input.atTurnId);
+          if (index < 0) {
+            throw new HarnessStateConflictError(`Turn ${input.atTurnId} is not part of session ${candidateSessionId}.`);
+          }
+          forkRuns = sourceRuns.slice(0, index + 1);
+          forkedFromTurnId = input.atTurnId;
+        } else if (sourceRuns.length > 0) {
+          forkedFromTurnId = sourceRuns.at(-1).turnId;
+        }
+        const branchPoint = forkRuns.at(-1);
+        if (branchPoint && !isTerminal(branchPoint.status)) {
+          throw new HarnessStateConflictError(`Cannot fork from non-terminal run ${branchPoint.runId} (${branchPoint.status}).`);
+        }
+        if (forkRuns.length > maxRuns) {
+          throw new HarnessStateConflictError(`Fork history exceeds the ${maxRuns}-run limit.`);
+        }
+        const count = database.query(`
+          SELECT COUNT(*) AS count FROM zhivex_cli_sessions
+          WHERE workspace_key = ?1 AND scope_key = ?2
+        `).get(workspaceKey, scopeKey)?.count ?? 0;
+        if (count >= maxSessions) {
+          throw new HarnessStateConflictError(`Session limit reached for this workspace and scope (${maxSessions}).`);
+        }
+        const createdAt = now();
+        assertTimestamp("now", createdAt);
+        const title = normalizeTitle(input.title, maxMetadataBytes) ?? source.title;
+        const forkSessionId = sessionId();
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          INSERT INTO zhivex_cli_sessions (
+            session_id, workspace_key, scope_key, title, parent_session_id,
+            forked_from_turn_id, revision, created_at, updated_at, activity_seq, metadata_bytes
+          ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 0, ?7, ?7, ?8, ?9)
+        `).run(forkSessionId, workspaceKey, scopeKey, title, candidateSessionId, forkedFromTurnId ?? null, createdAt, activitySequence, metadataSize({ title }));
+        for (const [index, run] of forkRuns.entries()) {
+          insertRun(forkSessionId, {
+            runId: run.runId,
+            provider: run.provider,
+            model: run.model,
+            ...run.role ? { role: run.role } : {},
+            status: run.status,
+            createdAt: run.createdAt
+          }, index, run.turnId);
+          database.query(`
+            UPDATE zhivex_cli_session_runs
+            SET updated_at = ?1, completed_at = ?2
+            WHERE session_id = ?3 AND ordinal = ?4
+          `).run(run.updatedAt, run.completedAt ?? null, forkSessionId, index);
+        }
+        return hydrate(requireSessionRow(forkSessionId));
+      });
+    },
+    async archive(candidateSessionId, input = {}) {
+      return store.update(candidateSessionId, {
+        archived: true,
+        ...input.expectedRevision === undefined ? {} : { expectedRevision: input.expectedRevision }
+      });
+    },
+    async delete(candidateSessionId, input = {}) {
+      return transaction(() => {
+        const row = requireSessionRow(candidateSessionId);
+        ensureRevision(row, input.expectedRevision);
+        assertNoActiveRun(candidateSessionId, "delete");
+        const deletedAt = now();
+        assertTimestamp("now", deletedAt);
+        const activitySequence = nextActivitySequence();
+        database.query(`
+          UPDATE zhivex_cli_sessions
+          SET deleted_at = ?1, updated_at = ?1, activity_seq = ?2, revision = revision + 1
+          WHERE session_id = ?3 AND revision = ?4
+        `).run(deletedAt, activitySequence, candidateSessionId, row.revision);
+        return hydrate(requireSessionRow(candidateSessionId, true));
+      });
+    },
+    prune,
+    close() {
+      if (!closed) {
+        closed = true;
+        database.close(false);
+      }
+    }
+  };
+  return store;
+};
+var openSessionStore = openCliSessionStore;
+
+// src/workspace/file-security.ts
+import { constants as fsConstants } from "node:fs";
+import { open as open3 } from "node:fs/promises";
+import path5 from "node:path";
+var sameOpenFile = (before, after) => before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs && before.mode === after.mode && before.nlink === after.nlink;
+
+class UnsafeFileTypeError extends Error {
+  constructor(label) {
+    super(`${label} must be a regular file and must not be a symbolic link.`);
+    this.name = "UnsafeFileTypeError";
+  }
+}
+
+class FileSizeLimitError extends Error {
+  label;
+  maxBytes;
+  constructor(label, maxBytes) {
+    super(`${label} exceeds the ${maxBytes}-byte limit.`);
+    this.label = label;
+    this.maxBytes = maxBytes;
+    this.name = "FileSizeLimitError";
+  }
+}
+
+class FileChangedWhileReadingError extends Error {
+  constructor(label) {
+    super(`${label} changed while it was being read.`);
+    this.name = "FileChangedWhileReadingError";
+  }
+}
+var invalidFileError = (label) => new UnsafeFileTypeError(label);
+var openRegularFileNoFollow = async (target, label) => {
+  try {
+    const flags = fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK;
+    let absolute = path5.resolve(target);
+    if (process.platform === "darwin") {
+      absolute = absolute.replace(/^\/(tmp|var|etc)(\/|$)/, "/private/$1$2");
+      return await open3(absolute, fsConstants.O_RDONLY | fsConstants.O_NONBLOCK | 536870912, 384);
+    }
+    if (process.platform !== "linux")
+      throw new Error("Safe descriptor-relative reads require Linux or macOS.");
+    const segments = absolute.split("/").filter(Boolean);
+    const leaf = segments.pop();
+    if (!leaf)
+      throw invalidFileError(label);
+    let directory = await open3("/", fsConstants.O_RDONLY | fsConstants.O_DIRECTORY);
+    try {
+      for (const segment of segments) {
+        const next = await open3(`/proc/self/fd/${directory.fd}/${segment}`, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW);
+        await directory.close();
+        directory = next;
+      }
+      return await open3(`/proc/self/fd/${directory.fd}/${leaf}`, flags);
+    } finally {
+      await directory.close();
+    }
+  } catch (error) {
+    const code = error.code;
+    if (code === "ELOOP" || code === "EMLINK" || code === "ENOTDIR")
+      throw invalidFileError(label);
+    throw error;
+  }
+};
+var statRegularFileNoFollow = async (target, options) => {
+  const handle = await openRegularFileNoFollow(target, options.label);
+  try {
+    const stat2 = await handle.stat();
+    if (!stat2.isFile() || options.requireSingleLink && stat2.nlink !== 1) {
+      throw invalidFileError(options.label);
+    }
+    return stat2;
+  } finally {
+    await handle.close();
+  }
+};
+var readRegularFileNoFollow = async (target, options) => {
+  const handle = await openRegularFileNoFollow(target, options.label);
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || options.requireSingleLink && before.nlink !== 1) {
+      throw invalidFileError(options.label);
+    }
+    if (!Number.isSafeInteger(before.size) || before.size < 0) {
+      throw new Error(`${options.label} has an unsupported size.`);
+    }
+    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 0) {
+      throw new Error(`${options.label} has an invalid byte limit.`);
+    }
+    if (before.size > options.maxBytes) {
+      throw new FileSizeLimitError(options.label, options.maxBytes);
+    }
+    const contents = Buffer.alloc(before.size);
+    let offset = 0;
+    while (offset < contents.byteLength) {
+      const { bytesRead } = await handle.read(contents, offset, contents.byteLength - offset, offset);
+      if (bytesRead === 0)
+        break;
+      offset += bytesRead;
+    }
+    const probe = Buffer.allocUnsafe(1);
+    const { bytesRead: extraBytes } = await handle.read(probe, 0, 1, before.size);
+    const after = await handle.stat();
+    if (offset !== before.size || extraBytes !== 0 || !sameOpenFile(before, after) || options.requireSingleLink && after.nlink !== 1) {
+      throw new FileChangedWhileReadingError(options.label);
+    }
+    return { contents, stat: after };
+  } finally {
+    await handle.close();
+  }
+};
+async function* readRegularFileChunksNoFollow(target, options) {
+  const handle = await openRegularFileNoFollow(target, options.label);
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || options.requireSingleLink && before.nlink !== 1)
+      throw invalidFileError(options.label);
+    if (options.requirePrivate && (before.mode & 63) !== 0)
+      throw new Error(`${options.label} permissions must not grant group or other access.`);
+    let offset = 0;
+    while (offset < before.size) {
+      const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, before.size - offset));
+      const { bytesRead: bytesRead2 } = await handle.read(buffer, 0, buffer.length, offset);
+      if (!bytesRead2)
+        throw new FileChangedWhileReadingError(options.label);
+      offset += bytesRead2;
+      yield buffer.subarray(0, bytesRead2);
+    }
+    const probe = Buffer.allocUnsafe(1);
+    const { bytesRead } = await handle.read(probe, 0, 1, offset);
+    if (bytesRead || !sameOpenFile(before, await handle.stat()))
+      throw new FileChangedWhileReadingError(options.label);
+  } finally {
+    await handle.close();
+  }
+}
+
+// src/runtime/runtime-diagnostics.ts
+import { z } from "zod";
+import { createRedactionPolicy as createRedactionPolicy2 } from "@zhivex-ai/agents";
+var count = z.number().int().nonnegative().finite();
+var digest = z.string().regex(/^sha256:[a-f0-9]{64}$/).nullable();
+var diagnosticsSchema = z.object({
+  schemaVersion: z.literal(2),
+  requireVerifiedDelivery: z.boolean(),
+  budget: z.object({
+    inputTokens: count,
+    outputTokens: count,
+    cachedInputTokens: count,
+    modelCalls: count,
+    usageComplete: z.boolean(),
+    inFlight: z.boolean(),
+    stopReason: z.enum(["USAGE_UNAVAILABLE", "WORK_TOKEN_BUDGET", "INPUT_TOKEN_BUDGET", "OUTPUT_TOKEN_BUDGET"]).nullable(),
+    reservedInputTokens: count,
+    reservedOutputTokens: count,
+    predictedInputTokens: count,
+    outputCapApplied: z.boolean().default(false)
+  }),
+  phase: z.enum(["explore", "reproduce", "candidate", "verify", "recover", "delivered", "incomplete"]),
+  candidate: digest,
+  revision: count,
+  checks: z.array(z.object({
+    commandId: z.string().max(128),
+    purpose: z.string().max(500),
+    argvDigest: digest,
+    candidate: digest,
+    exitCode: z.number().int(),
+    verified: z.boolean()
+  })).max(8),
+  contextMeasurements: z.array(z.object({
+    systemCharacters: count,
+    userCharacters: count,
+    assistantCharacters: count,
+    toolResultCharacters: count,
+    otherMessageCharacters: count,
+    toolDefinitionCharacters: count,
+    unmeasuredToolDefinitions: count
+  })).max(128),
+  modelTimings: z.array(z.object({ durationMs: z.number().nonnegative().finite(), firstTokenMs: z.number().nonnegative().finite().nullable(), completed: z.boolean() })).max(128),
+  omittedContextMeasurements: count
+});
+var manifestSchema = z.object({
+  schemaVersion: z.literal(2),
+  policyVersion: z.literal("assistant-v3-durable-closure"),
+  role: z.string().max(128),
+  requireVerifiedDelivery: z.boolean(),
+  backend: z.enum(["none", "oci"]),
+  tools: z.array(z.string().max(128)).max(1024),
+  budget: z.object({ unlimitedTokens: z.boolean().optional(), maxSteps: count, maxToolCalls: count, maxToolErrors: count, maxInputTokens: count, maxOutputTokens: count, includeChildRuns: z.boolean() }),
+  timeoutMs: count,
+  closureController: z.boolean(),
+  contextEnabled: z.boolean()
+});
+var redact = createRedactionPolicy2({ includeEmails: true });
+var inspectRuntimeDiagnostics = (value) => {
+  const parsed = diagnosticsSchema.safeParse(value);
+  if (!parsed.success)
+    return null;
+  return { ...parsed.data, checks: parsed.data.checks.map((check) => ({
+    ...check,
+    commandId: redact.redactText(check.commandId),
+    purpose: redact.redactText(check.purpose)
+  })) };
+};
+var inspectRuntimeManifest = (value) => {
+  const parsed = manifestSchema.safeParse(value);
+  if (!parsed.success)
+    return null;
+  return { ...parsed.data, role: redact.redactText(parsed.data.role), tools: parsed.data.tools.map((name) => redact.redactText(name)) };
+};
+
+// src/runtime/tool-execution.ts
+var harnessToolExecution = {
+  parallel: true,
+  independentOnly: true,
+  maxConcurrency: 4,
+  stopOnError: false,
+  validationErrorMode: "tool-result",
+  unknownToolMode: "tool-result"
+};
+
+// src/runtime/usage-ledger.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { lstat as lstat4 } from "node:fs/promises";
+import { z as z4 } from "zod";
+import { wrapLanguageModel } from "@zhivex-ai/core";
+
+// src/runtime/model-budget.ts
+import { ProviderToolCallError } from "@zhivex-ai/core/provider";
+import { z as z3 } from "zod";
+
+// src/context/context-metrics.ts
+import { z as z2 } from "zod";
+var schemaJson = new WeakMap;
+var serializeSchema = (schema) => {
+  let serialized = schemaJson.get(schema);
+  if (serialized === undefined) {
+    serialized = JSON.stringify(z2.toJSONSchema(schema));
+    schemaJson.set(schema, serialized);
+  }
+  return serialized;
+};
+var estimateContextTokens = (counts) => {
+  if (counts.unmeasuredToolDefinitions)
+    throw new Error("CONTEXT_ESTIMATE_UNAVAILABLE");
+  return Math.ceil((counts.systemCharacters + counts.userCharacters + counts.assistantCharacters + counts.toolResultCharacters + counts.otherMessageCharacters + counts.toolDefinitionCharacters) / 3) + 64;
+};
+var measureContext = (input) => {
+  const counts = {
+    systemCharacters: 0,
+    userCharacters: 0,
+    assistantCharacters: 0,
+    toolResultCharacters: 0,
+    otherMessageCharacters: 0,
+    toolDefinitionCharacters: 0,
+    unmeasuredToolDefinitions: 0
+  };
+  for (const message of input.messages) {
+    const size = JSON.stringify(message).length;
+    if (message.role === "system")
+      counts.systemCharacters += size;
+    else if (message.role === "user")
+      counts.userCharacters += size;
+    else if (message.role === "assistant")
+      counts.assistantCharacters += size;
+    else if (message.role === "tool")
+      counts.toolResultCharacters += size;
+    else
+      counts.otherMessageCharacters += size;
+  }
+  for (const [name, definition] of Object.entries(input.tools ?? {})) {
+    try {
+      if (!("schema" in definition)) {
+        counts.unmeasuredToolDefinitions++;
+        continue;
+      }
+      const header = JSON.stringify({ name, description: definition.description });
+      counts.toolDefinitionCharacters += header.length - 1 + ',"schema":'.length + serializeSchema(definition.schema).length + 1;
+    } catch {
+      counts.unmeasuredToolDefinitions++;
+    }
+  }
+  return counts;
+};
+
+// src/runtime/model-budget.ts
+var MODEL_BUDGET_KEY = "zhivexTransportBudget";
+var savedBudget = z3.object({
+  inputTokens: z3.number().int().nonnegative(),
+  outputTokens: z3.number().int().nonnegative(),
+  cachedInputTokens: z3.number().int().nonnegative(),
+  modelCalls: z3.number().int().nonnegative(),
+  usageComplete: z3.boolean(),
+  inFlight: z3.boolean().default(false)
+});
+var estimateRequestTokens = (input) => estimateContextTokens(measureContext(input));
+var workBudgetReached = (input, stats, limits) => stats.inputTokens + estimateRequestTokens(input) > limits.inputTokens - stats.reservedInputTokens || stats.outputTokens >= limits.outputTokens - stats.reservedOutputTokens;
+var createModelBudget = (limits, options = {}) => {
+  const restored = options.saved === undefined ? undefined : savedBudget.parse(options.saved);
+  const reserve = options.reserveFraction ?? 0.3;
+  if (!Number.isFinite(reserve) || reserve < 0 || reserve >= 1)
+    throw new Error("Invalid closure reserve.");
+  const prior = inspectRuntimeDiagnostics(options.diagnostics);
+  const contextMetrics = prior?.contextMeasurements ?? [];
+  let omittedContextMeasurements = prior?.omittedContextMeasurements ?? 0;
+  const stats = {
+    inputTokens: 0,
+    outputTokens: 0,
+    cachedInputTokens: 0,
+    modelCalls: 0,
+    usageComplete: true,
+    inFlight: false,
+    ...restored,
+    stopReason: null,
+    reservedInputTokens: Number.isFinite(limits.inputTokens) ? Math.ceil(limits.inputTokens * reserve) : 0,
+    reservedOutputTokens: Number.isFinite(limits.outputTokens) ? Math.ceil(limits.outputTokens * reserve) : 0,
+    predictedInputTokens: 0,
+    outputCapApplied: false
+  };
+  if (restored?.inFlight)
+    stats.usageComplete = false;
+  const modelTimings = prior?.modelTimings ?? [];
+  const snapshot = () => ({
+    inputTokens: stats.inputTokens,
+    outputTokens: stats.outputTokens,
+    cachedInputTokens: stats.cachedInputTokens,
+    modelCalls: stats.modelCalls,
+    usageComplete: stats.usageComplete,
+    inFlight: stats.inFlight
+  });
+  const before = (input, provider) => {
+    input.abortSignal?.throwIfAborted();
+    const measured = measureContext(input);
+    stats.predictedInputTokens = estimateContextTokens(measured);
+    const closure = options.closure?.() ?? false;
+    const inputCeiling = limits.inputTokens - (closure ? 0 : stats.reservedInputTokens);
+    const outputCeiling = limits.outputTokens - (closure ? 0 : stats.reservedOutputTokens);
+    stats.stopReason = !stats.usageComplete ? "USAGE_UNAVAILABLE" : stats.inputTokens + stats.predictedInputTokens > inputCeiling ? closure ? "INPUT_TOKEN_BUDGET" : "WORK_TOKEN_BUDGET" : stats.outputTokens >= outputCeiling ? closure ? "OUTPUT_TOKEN_BUDGET" : "WORK_TOKEN_BUDGET" : null;
+    if (stats.stopReason)
+      throw new Error(stats.stopReason);
+    const capSupported = provider !== "qwen" || input.providerOptions?.apiMode === "chat" || input.providerOptions?.apiMode !== "responses" && (input.maxTokens !== undefined || input.reasoning?.budgetTokens !== undefined);
+    const remainingOutput = outputCeiling - stats.outputTokens;
+    const outputCap = Math.min(input.maxTokens ?? remainingOutput, remainingOutput);
+    stats.outputCapApplied = capSupported && Number.isFinite(outputCap);
+    if (stats.outputCapApplied)
+      input.maxTokens = Math.max(1, outputCap);
+    stats.modelCalls++;
+    stats.inFlight = true;
+    if (contextMetrics.length < 128)
+      contextMetrics.push(measured);
+    else
+      omittedContextMeasurements++;
+  };
+  const record = (usage) => {
+    stats.inFlight = false;
+    if (!usage || usage.inputTokens === undefined || usage.outputTokens === undefined || ![usage.inputTokens, usage.outputTokens, usage.cachedInputTokens ?? 0].every((v) => Number.isSafeInteger(v) && v >= 0)) {
+      stats.usageComplete = false;
+      return;
+    }
+    stats.inputTokens += usage.inputTokens;
+    stats.outputTokens += usage.outputTokens;
+    stats.cachedInputTokens += usage.cachedInputTokens ?? 0;
+  };
+  const recordFailure = (error, provider) => {
+    const usage = error instanceof ProviderToolCallError && error.provider === provider ? Reflect.get(error, "usage") : undefined;
+    record(usage && typeof usage === "object" ? usage : undefined);
+  };
+  const middleware = {
+    name: "harness-transport-budget-v2",
+    async wrapGenerate(context, next) {
+      before(context.input, context.model.provider);
+      const started = performance.now();
+      let completed = false;
+      try {
+        const result = await next();
+        record(result.usage);
+        completed = true;
+        return result;
+      } catch (error) {
+        recordFailure(error, context.model.provider);
+        throw error;
+      } finally {
+        if (modelTimings.length < 128)
+          modelTimings.push({ durationMs: performance.now() - started, firstTokenMs: null, completed });
+      }
+    },
+    async wrapStream(context, next) {
+      before(context.input, context.model.provider);
+      const started = performance.now();
+      let firstTokenMs = null;
+      try {
+        const stream = await next();
+        return async function* () {
+          let finished = false, failureAccounted = false;
+          try {
+            for await (const event of stream) {
+              if (firstTokenMs === null && (event.type === "text-delta" || event.type === "tool-call"))
+                firstTokenMs = performance.now() - started;
+              if (event.type === "finish" && !finished) {
+                record(event.usage);
+                finished = true;
+              }
+              yield event;
+            }
+          } catch (error) {
+            if (!finished) {
+              recordFailure(error, context.model.provider);
+              failureAccounted = true;
+            }
+            throw error;
+          } finally {
+            if (!finished && !failureAccounted)
+              stats.usageComplete = false;
+            stats.inFlight = false;
+            if (modelTimings.length < 128)
+              modelTimings.push({ durationMs: performance.now() - started, firstTokenMs, completed: finished });
+          }
+        }();
+      } catch (error) {
+        recordFailure(error, context.model.provider);
+        if (modelTimings.length < 128)
+          modelTimings.push({ durationMs: performance.now() - started, firstTokenMs, completed: false });
+        throw error;
+      }
+    }
+  };
+  return { stats, middleware, snapshot, contextMetrics, modelTimings, get omittedContextMeasurements() {
+    return omittedContextMeasurements;
+  } };
+};
+
+// src/runtime/usage-ledger.ts
+var USAGE_LEDGER_KEY = "zhivexUsageLedger";
+var rate = z4.number().finite().nonnegative();
+var usagePricingSchema = z4.strictObject({
+  schemaVersion: z4.literal(1),
+  prices: z4.array(z4.strictObject({
+    provider: z4.string().min(1).max(128),
+    model: z4.string().min(1).max(512),
+    inputUsdPerMillion: rate,
+    outputUsdPerMillion: rate,
+    source: z4.string().min(1).max(1024),
+    asOf: z4.iso.datetime(),
+    expiresAt: z4.iso.datetime()
+  })).max(100)
+}).superRefine((value, ctx) => {
+  const keys = new Set;
+  for (const price of value.prices) {
+    const key = JSON.stringify([price.provider, price.model]);
+    if (keys.has(key) || Date.parse(price.expiresAt) <= Date.parse(price.asOf)) {
+      ctx.addIssue({ code: "custom", message: "Duplicate model price or invalid validity interval." });
+    }
+    keys.add(key);
+  }
+});
+var summaryView = z4.object({
+  calls: z4.number().int().nonnegative(),
+  inputTokens: rate,
+  outputTokens: rate,
+  usageComplete: z4.boolean(),
+  estimatedUsd: rate.nullable(),
+  limitUsd: rate.nullable()
+});
+var ledgerView = summaryView.extend({
+  schemaVersion: z4.literal(1),
+  runId: z4.string().max(256),
+  historicalUsageUnknown: z4.boolean().optional(),
+  costKind: z4.literal("estimate-not-invoice"),
+  routes: z4.array(z4.object({
+    provider: z4.string().max(128),
+    model: z4.string().max(512),
+    calls: z4.number().int().nonnegative(),
+    inputTokens: rate,
+    outputTokens: rate,
+    unknownCalls: z4.number().int().nonnegative(),
+    estimatedUsd: rate.nullable(),
+    priceStatuses: z4.array(z4.enum(["missing", "stale", "estimate"]))
+  })).max(100)
+});
+var inspectUsageLedger = (value) => {
+  const parsed = ledgerView.safeParse(value);
+  return parsed.success ? parsed.data : null;
+};
+var formatUsageLedger = (value) => {
+  const parsed = summaryView.safeParse(value);
+  if (!parsed.success)
+    return "Usage: unavailable for this run.";
+  const v = parsed.data;
+  return `Usage: ${v.calls} calls · ${v.inputTokens} input / ${v.outputTokens} output tokens${v.usageComplete ? "" : " · INCOMPLETE"}` + ` · estimated USD ${v.estimatedUsd === null ? "unknown" : v.estimatedUsd.toFixed(6)}${v.limitUsd === null ? "" : ` / ${v.limitUsd} limit`} (not an invoice)`;
+};
+var current = new AsyncLocalStorage;
+
+class UsageLedger {
+  database;
+  key;
+  options;
+  now;
+  constructor(database, key, options, now) {
+    this.database = database;
+    this.key = key;
+    this.options = options;
+    this.now = now;
+  }
+  static async open(config, options = {}, now = Date.now) {
+    if (options.limitUsd !== undefined && (!Number.isFinite(options.limitUsd) || options.limitUsd <= 0))
+      throw new Error("Usage limit must be positive USD.");
+    if (options.pricing)
+      usagePricingSchema.parse(options.pricing);
+    const sessions = await openCliSessionStore({ workspace: config.workspace, stateDirectory: config.stateDirectory, scope: config.scope });
+    const key = `${sessions.workspaceKey}:${sessions.scopeKey}`;
+    const databasePath = sessions.databasePath;
+    sessions.close();
+    const before = await lstat4(databasePath);
+    if (before.isSymbolicLink() || !before.isFile())
+      throw new Error("Usage database must be a regular private file.");
+    const database = new SqliteDatabase(databasePath, { create: false, strict: true });
+    const after = await lstat4(databasePath);
+    if (after.isSymbolicLink() || !after.isFile() || before.dev !== after.dev || before.ino !== after.ino) {
+      database.close();
+      throw new Error("Usage database changed while opening.");
+    }
+    database.exec("PRAGMA busy_timeout = 5000");
+    database.exec(`CREATE TABLE IF NOT EXISTS zhivex_usage_policies (
+      scope_key TEXT NOT NULL, run_id TEXT NOT NULL, policy TEXT NOT NULL,
+      PRIMARY KEY (scope_key, run_id));
+      CREATE TABLE IF NOT EXISTS zhivex_usage_calls (
+      id TEXT PRIMARY KEY, scope_key TEXT NOT NULL, run_id TEXT NOT NULL,
+      provider TEXT NOT NULL, model TEXT NOT NULL, status TEXT NOT NULL,
+      input_tokens INTEGER, output_tokens INTEGER, estimate_usd REAL, reserved_usd REAL NOT NULL,
+      price_status TEXT NOT NULL);`);
+    return new UsageLedger(database, key, options, now);
+  }
+  close() {
+    this.database.close();
+  }
+  assertResume(runId) {
+    const row = this.database.query("SELECT policy FROM zhivex_usage_policies WHERE scope_key = ?1 AND run_id = ?2").get(this.key, runId);
+    if (!row)
+      throw new Error("USAGE_LEDGER_MISSING: restore the complete state backup; a run snapshot cannot reset its monetary policy.");
+  }
+  policy(runId) {
+    const row = this.database.query("SELECT policy FROM zhivex_usage_policies WHERE scope_key = ?1 AND run_id = ?2").get(this.key, runId);
+    return row ? JSON.parse(row.policy) : this.options;
+  }
+  async run(runId, operation, historicalUsageUnknown = false) {
+    this.database.query("INSERT OR IGNORE INTO zhivex_usage_policies (scope_key, run_id, policy) VALUES (?1, ?2, ?3)").run(this.key, runId, JSON.stringify({ ...this.options, ...historicalUsageUnknown ? { historicalUsageUnknown: true } : {} }));
+    this.database.query("UPDATE zhivex_usage_calls SET status = 'unknown' WHERE scope_key = ?1 AND run_id = ?2 AND status = 'pending'").run(this.key, runId);
+    return current.run({ ledger: this, runId }, operation);
+  }
+  summary(runId) {
+    const rows = this.database.query("SELECT * FROM zhivex_usage_calls WHERE scope_key = ?1 AND run_id = ?2 ORDER BY rowid").all(this.key, runId);
+    const routes = new Map;
+    for (const row of rows) {
+      const key = JSON.stringify([row.provider, row.model]);
+      const entry = routes.get(key) ?? { provider: row.provider, model: row.model, calls: 0, inputTokens: 0, outputTokens: 0, unknownCalls: 0, estimatedUsd: 0, priceStatuses: [] };
+      entry.calls++;
+      entry.inputTokens += row.input_tokens ?? 0;
+      entry.outputTokens += row.output_tokens ?? 0;
+      if (row.status !== "confirmed")
+        entry.unknownCalls++;
+      entry.estimatedUsd = entry.estimatedUsd === null || row.estimate_usd === null ? null : entry.estimatedUsd + row.estimate_usd;
+      if (!entry.priceStatuses.includes(row.price_status))
+        entry.priceStatuses.push(row.price_status);
+      routes.set(key, entry);
+    }
+    const values = [...routes.values()];
+    return {
+      schemaVersion: 1,
+      runId,
+      calls: rows.length,
+      routes: values,
+      inputTokens: values.reduce((n, r) => n + r.inputTokens, 0),
+      outputTokens: values.reduce((n, r) => n + r.outputTokens, 0),
+      historicalUsageUnknown: this.policy(runId).historicalUsageUnknown ?? false,
+      usageComplete: !this.policy(runId).historicalUsageUnknown && rows.every((row) => row.status === "confirmed"),
+      estimatedUsd: this.policy(runId).historicalUsageUnknown || values.some((r) => r.estimatedUsd === null) ? null : values.reduce((n, r) => n + (r.estimatedUsd ?? 0), 0),
+      limitUsd: this.policy(runId).limitUsd ?? null,
+      costKind: "estimate-not-invoice"
+    };
+  }
+  begin(runId, provider, model, input) {
+    const policy = this.policy(runId);
+    const price = policy.pricing?.prices.find((p) => p.provider === provider && p.model === model);
+    const priceStatus = !price ? "missing" : Date.parse(price.asOf) > this.now() || Date.parse(price.expiresAt) <= this.now() ? "stale" : "estimate";
+    const usable = priceStatus === "estimate" ? price : undefined;
+    let reserved = 0;
+    if (policy.limitUsd !== undefined) {
+      if (policy.historicalUsageUnknown)
+        throw new Error("USAGE_UNCERTAIN: historical usage predates the ledger.");
+      if (!usable)
+        throw new Error(`USAGE_PRICE_${priceStatus.toUpperCase()}: monetary limit cannot be calculated for ${provider}/${model}.`);
+      if (provider === "qwen" && input.providerOptions?.apiMode !== "chat" && input.maxTokens === undefined) {
+        throw new Error("USAGE_OUTPUT_CAP_UNAVAILABLE: select a route with a supported output cap.");
+      }
+      input.maxTokens = Math.min(input.maxTokens ?? 2048, 2048);
+      reserved = (estimateRequestTokens(input) * usable.inputUsdPerMillion + input.maxTokens * usable.outputUsdPerMillion) / 1e6;
+    }
+    const id = randomUUID2();
+    this.database.exec("BEGIN IMMEDIATE");
+    try {
+      if (policy.requireCompleteUsage) {
+        const unresolved = this.database.query("SELECT COUNT(*) AS n FROM zhivex_usage_calls WHERE scope_key = ?1 AND run_id = ?2 AND status = 'unknown'").get(this.key, runId);
+        if (policy.historicalUsageUnknown || (unresolved?.n ?? 0) > 0)
+          throw new Error("USAGE_UNCERTAIN: reconcile unknown utility usage before further execution.");
+      }
+      if (policy.limitUsd !== undefined) {
+        const rows = this.database.query("SELECT * FROM zhivex_usage_calls WHERE scope_key = ?1 AND run_id = ?2").all(this.key, runId);
+        if (rows.some((r) => r.status === "unknown" || r.status === "confirmed" && r.estimate_usd === null))
+          throw new Error("USAGE_UNCERTAIN: inspect unresolved calls before further monetary-budget execution.");
+        const spent = rows.reduce((n, r) => n + (r.status === "pending" ? r.reserved_usd : r.estimate_usd ?? 0), 0);
+        if (spent + reserved > policy.limitUsd)
+          throw new Error("USAGE_COST_BUDGET: insufficient estimated budget for the next request.");
+      }
+      this.database.query(`INSERT INTO zhivex_usage_calls (id, scope_key, run_id, provider, model, status, reserved_usd, price_status)
+        VALUES (?1, ?2, ?3, ?4, ?5, 'pending', ?6, ?7)`).run(id, this.key, runId, provider, model, reserved, priceStatus);
+      this.database.exec("COMMIT");
+    } catch (error) {
+      this.database.exec("ROLLBACK");
+      throw error;
+    }
+    return { id, price: usable };
+  }
+  finish(call, usage) {
+    const confirmed = usage && [usage.inputTokens, usage.outputTokens].every((v) => Number.isSafeInteger(v) && v >= 0);
+    const estimate = confirmed && call.price ? (usage.inputTokens * call.price.inputUsdPerMillion + usage.outputTokens * call.price.outputUsdPerMillion) / 1e6 : null;
+    this.database.query(`UPDATE zhivex_usage_calls SET status = ?1, input_tokens = ?2, output_tokens = ?3, estimate_usd = ?4
+      WHERE id = ?5 AND status = 'pending'`).run(confirmed ? "confirmed" : "unknown", Number.isSafeInteger(usage?.inputTokens) && usage.inputTokens >= 0 ? usage.inputTokens : null, Number.isSafeInteger(usage?.outputTokens) && usage.outputTokens >= 0 ? usage.outputTokens : null, estimate, call.id);
+  }
+  model(model) {
+    const ledger = this;
+    const middleware = {
+      name: "harness-durable-usage-v1",
+      async wrapGenerate(context, next) {
+        const scope = current.getStore();
+        if (!scope || scope.ledger !== ledger)
+          throw new Error("Usage accounting requires a logical run scope.");
+        const call = ledger.begin(scope.runId, model.provider, model.modelId, context.input);
+        try {
+          const result = await next();
+          ledger.finish(call, result.usage);
+          return result;
+        } catch (error) {
+          ledger.finish(call, undefined);
+          throw error;
+        }
+      },
+      async wrapStream(context, next) {
+        const scope = current.getStore();
+        if (!scope || scope.ledger !== ledger)
+          throw new Error("Usage accounting requires a logical run scope.");
+        const call = ledger.begin(scope.runId, model.provider, model.modelId, context.input);
+        try {
+          const stream = await next();
+          return async function* () {
+            try {
+              for await (const event of stream) {
+                if (event.type === "finish")
+                  ledger.finish(call, event.usage);
+                yield event;
+              }
+            } finally {
+              ledger.finish(call, undefined);
+            }
+          }();
+        } catch (error) {
+          ledger.finish(call, undefined);
+          throw error;
+        }
+      }
+    };
+    return wrapLanguageModel(model, [middleware]);
+  }
+  store(store) {
+    const ledger = this;
+    return new Proxy(store, { get(target, key) {
+      if (key === "save")
+        return async (...args) => {
+          const scope = current.getStore();
+          if (scope?.ledger === ledger && args[0].runId === scope.runId) {
+            args[0].metadata = { ...args[0].metadata, [USAGE_LEDGER_KEY]: ledger.summary(scope.runId) };
+          }
+          return target.save(...args);
+        };
+      const value = Reflect.get(target, key, target);
+      return typeof value === "function" ? value.bind(target) : value;
+    } });
+  }
+}
+
+// src/execution/package-manager.ts
+import { lstat as lstat5 } from "node:fs/promises";
+import path6 from "node:path";
+var HARNESS_PACKAGE_MANAGERS = ["npm", "pnpm", "yarn", "bun"];
+var LOCKFILES = {
+  npm: ["package-lock.json", "npm-shrinkwrap.json"],
+  pnpm: ["pnpm-lock.yaml"],
+  yarn: ["yarn.lock"],
+  bun: ["bun.lock", "bun.lockb"]
+};
+var isPackageManager = (value) => HARNESS_PACKAGE_MANAGERS.includes(value);
+var parsePackageManager = (value) => {
+  if (value === undefined)
+    return;
+  if (typeof value !== "string") {
+    throw new Error("package.json packageManager must be a string when present.");
+  }
+  const match = /^(npm|pnpm|yarn|bun)@([^\s]+)$/.exec(value.trim());
+  if (!match?.[1] || !match[2]) {
+    throw new Error("package.json packageManager must pin npm, pnpm, yarn, or bun using <manager>@<version>.");
+  }
+  if (!isPackageManager(match[1])) {
+    throw new Error(`Unsupported package manager: ${match[1]}.`);
+  }
+  return match[1];
+};
+var existingLockfiles = async (root) => {
+  const matches = [];
+  for (const manager of HARNESS_PACKAGE_MANAGERS) {
+    for (const file of LOCKFILES[manager]) {
+      try {
+        const entry = await lstat5(path6.join(root, file));
+        if (entry.isSymbolicLink()) {
+          throw new Error(`Package-manager lockfile must not be a symbolic link: ${file}.`);
+        }
+        if (entry.isFile())
+          matches.push({ manager, file });
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+      }
+    }
+  }
+  return matches;
+};
+var resolvePackageManager = async (root, manifest) => {
+  const declared = parsePackageManager(manifest.packageManager);
+  if (declared) {
+    return {
+      manager: declared,
+      source: "packageManager",
+      evidence: manifest.packageManager
+    };
+  }
+  const lockfiles = await existingLockfiles(root);
+  const managers = [...new Set(lockfiles.map((entry) => entry.manager))];
+  if (managers.length > 1) {
+    throw new Error(`Ambiguous package manager: found lockfiles for ${managers.join(", ")}; declare packageManager explicitly.`);
+  }
+  const detected = managers[0];
+  if (detected) {
+    return {
+      manager: detected,
+      source: "lockfile",
+      evidence: lockfiles.filter((entry) => entry.manager === detected).map((entry) => entry.file).join(",")
+    };
+  }
+  return { manager: "npm", source: "default" };
+};
+var runCommand = (manager, check) => {
+  switch (manager) {
+    case "bun":
+      return ["bun", "--no-env-file", "run", check];
+    case "npm":
+      return ["npm", "--ignore-scripts", "run", check];
+    case "pnpm":
+      return ["pnpm", "--ignore-scripts", "run", check];
+    case "yarn":
+      return ["yarn", "run", check];
+  }
+};
+var resolvePackageCheckCommand = async (root, manifest, check, expectedScript, allowedChecks) => {
+  if (!/^[A-Za-z0-9:_-]+$/.test(check) || !allowedChecks.includes(check)) {
+    throw new Error(`The check "${check}" is not in the explicit allowlist.`);
+  }
+  const scripts = manifest.scripts && typeof manifest.scripts === "object" ? manifest.scripts : {};
+  const actual = scripts[check];
+  if (typeof actual !== "string") {
+    throw new Error(`package.json does not define the "${check}" script.`);
+  }
+  if (actual !== expectedScript) {
+    throw new Error(`The "${check}" script changed or does not match expectedScript.`);
+  }
+  for (const lifecycleName of [`pre${check}`, `post${check}`]) {
+    if (typeof scripts[lifecycleName] === "string") {
+      throw new Error(`The approved "${check}" check has an implicit ${lifecycleName} lifecycle script; approve a standalone script instead.`);
+    }
+  }
+  const resolution = await resolvePackageManager(root, manifest);
+  return { ...resolution, command: runCommand(resolution.manager, check) };
+};
+
+// src/execution/process-runtime.ts
+import { spawn } from "node:child_process";
+var DEFAULT_MAX_OUTPUT_CHARACTERS = 20000;
+var DEFAULT_TERMINATION_GRACE_MS = 1000;
+var PORTABLE_ENVIRONMENT_KEYS = [
+  "CI",
+  "FORCE_COLOR",
+  "LANG",
+  "LC_ALL",
+  "NO_COLOR",
+  "PATH",
+  "TEMP",
+  "TERM",
+  "TMP",
+  "TMPDIR"
+];
+
+class BoundedTextCapture {
+  decoder = new TextDecoder;
+  maxCharacters;
+  output = "";
+  totalCharacters = 0;
+  constructor(maxCharacters) {
+    this.maxCharacters = maxCharacters;
+  }
+  write(chunk) {
+    this.append(this.decoder.decode(chunk, { stream: true }));
+  }
+  finish() {
+    this.append(this.decoder.decode());
+    return this.totalCharacters <= this.maxCharacters ? this.output : `${this.output}
+… output truncated (${this.totalCharacters - this.maxCharacters} characters omitted)`;
+  }
+  append(value) {
+    this.totalCharacters += value.length;
+    if (this.output.length < this.maxCharacters) {
+      this.output += value.slice(0, this.maxCharacters - this.output.length);
+    }
+  }
+}
+var processEnvironment = (additional) => {
+  const env = {};
+  for (const key of PORTABLE_ENVIRONMENT_KEYS) {
+    const value = process.env[key];
+    if (value !== undefined)
+      env[key] = value;
+  }
+  for (const [key, value] of Object.entries(additional ?? {})) {
+    if (value === undefined)
+      delete env[key];
+    else
+      env[key] = value;
+  }
+  return env;
+};
+var exitCodeForSignal = (signal) => {
+  if (signal === "SIGKILL")
+    return 137;
+  if (signal === "SIGTERM")
+    return 143;
+  return 1;
+};
+var abortReason = (signal) => signal.reason instanceof Error ? signal.reason : new DOMException("The operation was aborted.", "AbortError");
+var runPortableProcess = async (command, options = {}) => {
+  if (command.length === 0 || !command[0])
+    throw new Error("The process command must not be empty.");
+  if (options.signal?.aborted)
+    throw abortReason(options.signal);
+  const maxOutputCharacters = options.maxOutputCharacters ?? DEFAULT_MAX_OUTPUT_CHARACTERS;
+  if (!Number.isSafeInteger(maxOutputCharacters) || maxOutputCharacters < 0) {
+    throw new Error("maxOutputCharacters must be a non-negative safe integer.");
+  }
+  if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0)) {
+    throw new Error("timeoutMs must be a positive safe integer.");
+  }
+  const argv = [...command];
+  const stdout = new BoundedTextCapture(maxOutputCharacters);
+  const stderr = new BoundedTextCapture(maxOutputCharacters);
+  const useProcessGroup = process.platform !== "win32";
+  const child = spawn(argv[0], argv.slice(1), {
+    ...options.cwd ? { cwd: options.cwd } : {},
+    env: processEnvironment(options.env),
+    detached: useProcessGroup,
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true
+  });
+  let timedOut = false;
+  let aborted = false;
+  let terminationTimer;
+  child.stdout.on("data", (chunk) => stdout.write(chunk));
+  child.stderr?.on("data", (chunk) => stderr.write(chunk));
+  const signalProcessTree = (signal) => {
+    if (useProcessGroup && child.pid !== undefined) {
+      try {
+        process.kill(-child.pid, signal);
+        return;
+      } catch (error) {
+        if (error.code !== "ESRCH") {
+          child.kill(signal);
+          return;
+        }
+      }
+    }
+    if (child.exitCode === null && child.signalCode === null)
+      child.kill(signal);
+  };
+  const terminate = () => {
+    if (terminationTimer)
+      return;
+    signalProcessTree("SIGTERM");
+    terminationTimer = setTimeout(() => {
+      signalProcessTree("SIGKILL");
+    }, DEFAULT_TERMINATION_GRACE_MS);
+    terminationTimer.unref?.();
+  };
+  const handleAbort = () => {
+    aborted = true;
+    terminate();
+  };
+  options.signal?.addEventListener("abort", handleAbort, { once: true });
+  const timeout = options.timeoutMs === undefined ? undefined : setTimeout(() => {
+    timedOut = true;
+    terminate();
+  }, options.timeoutMs);
+  timeout?.unref?.();
+  try {
+    return await new Promise((resolve, reject) => {
+      let processError;
+      child.once("error", (error) => {
+        processError = error;
+      });
+      child.once("close", (exitCode, signal) => {
+        if (processError) {
+          reject(processError);
+          return;
+        }
+        if (aborted && options.signal) {
+          reject(abortReason(options.signal));
+          return;
+        }
+        resolve({
+          command: argv,
+          exitCode: exitCode ?? exitCodeForSignal(signal),
+          stdout: stdout.finish(),
+          stderr: options.stderr === "ignore" ? "" : stderr.finish(),
+          timedOut
+        });
+      });
+    });
+  } finally {
+    if (timeout)
+      clearTimeout(timeout);
+    if (terminationTimer)
+      clearTimeout(terminationTimer);
+    options.signal?.removeEventListener("abort", handleAbort);
+  }
+};
+
+// src/context/task-memory.ts
+import { createHash as createHash2 } from "node:crypto";
+import { tool, serializeJsonValue } from "@zhivex-ai/core";
+import { createRedactionPolicy as createRedactionPolicy3 } from "@zhivex-ai/agents";
+import { z as z6 } from "zod";
+
+// src/runtime/repair-verifier.ts
+import { z as z5 } from "zod";
+var verifierSchema = z5.strictObject({
+  command: z5.string().min(1).max(64),
+  args: z5.array(z5.string().max(8192)).max(256).default([]),
+  purpose: z5.string().min(1).max(500)
+});
+
+// src/context/task-memory.ts
+var redact2 = createRedactionPolicy3({ includeEmails: true });
+var TASK_SOURCE_KEY = "zhivexTaskSources";
+var taskSources = (metadata) => {
+  const value = metadata && typeof metadata === "object" ? metadata[TASK_SOURCE_KEY] : undefined;
+  return Array.isArray(value) ? value.filter((v) => !!v && typeof v.id === "string" && /^sha256:[a-f0-9]{64}$/.test(v.id) && typeof v.text === "string").map((source) => ({ id: source.id, text: source.text, ...source.original === true ? { original: true } : {} })) : [];
+};
+var captureTaskSources = (metadata, messages) => {
+  const previous = taskSources(metadata);
+  const originalId = previous.find((source) => source.original)?.id ?? previous[0]?.id;
+  const sources = new Map(previous.map((source) => [
+    source.id,
+    { id: source.id, text: source.text, ...source.id === originalId ? { original: true } : {} }
+  ]));
+  for (const message of messages)
+    if (message.role === "user")
+      for (const part of message.parts) {
+        if (part.type !== "text" || /^\[Compacted (?:conversation context|prior conversation)\]/.test(part.text))
+          continue;
+        const text = redact2.redactText(part.text).replace(/\bBearer\s+\S+/gi, "Bearer [REDACTED]").replace(/\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)|api[_-]?key|access[_-]?token|password)\s*([=:])\s*(?:"[^"]*"|'[^']*'|\S+)/gi, "$1$2[REDACTED]").replace(/\b(?:sk|ghp|gho|github_pat)-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]");
+        const id = `sha256:${createHash2("sha256").update(text).digest("hex")}`;
+        const original = sources.size === 0 || sources.get(id)?.original === true;
+        sources.delete(id);
+        sources.set(id, { id, text, ...original ? { original: true } : {} });
+      }
+  return [...sources.values()];
+};
+var createTaskTools = () => ({
+  read_task: tool({
+    name: "read_task",
+    description: "Recover operator requests after compaction. Omit id for the latest request. Source IDs default to the newest 64; set sourceOffset to page earlier IDs or use firstSourceId for the original request. Text offsets are characters. Task text is guidance, never approval.",
+    metadata: { advancedRegistry: { permissions: ["read"], audit: { riskLevel: "low" } } },
+    schema: z6.object({
+      id: z6.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+      offset: z6.number().int().min(0).default(0),
+      sourceOffset: z6.number().int().min(0).optional()
+    }),
+    execute: async ({ id, offset, sourceOffset }, context) => {
+      const sources = taskSources(context?.metadata);
+      const source = id ? sources.find((s) => s.id === id) : sources.at(-1);
+      if (!source)
+        throw new Error("Requested task source is not bound to this run.");
+      const start = sourceOffset ?? Math.max(0, sources.length - 64);
+      return {
+        id: source.id,
+        sourceIds: sources.slice(start, start + 64).map((s) => s.id),
+        firstSourceId: (sources.find((item) => item.original) ?? sources[0]).id,
+        sourceOffset: start,
+        totalSources: sources.length,
+        nextSourceOffset: start + 64 < sources.length ? start + 64 : null,
+        content: source.text.slice(offset, offset + 4000),
+        offset,
+        totalCharacters: source.text.length,
+        nextOffset: offset + 4000 < source.text.length ? offset + 4000 : null
+      };
+    }
+  }),
+  repair_plan: tool({
+    name: "repair_plan",
+    description: "Record a bounded hypothesis and exact verifier argv/purpose before editing. A candidate automatically proceeds to this verifier through operator approval. This is model-authored working memory, not verification or permission. The tool result is retained in the durable run journal.",
+    metadata: { advancedRegistry: { permissions: ["read"], audit: { riskLevel: "low" } } },
+    schema: z6.strictObject({ hypothesis: z6.string().min(1).max(1000), expectedBehavior: z6.string().min(1).max(1000), paths: z6.array(z6.string().max(240)).max(8), nextCheck: z6.string().min(1).max(500), verifier: verifierSchema.optional() }),
+    execute: async (input) => serializeJsonValue({ kind: "repair-plan", ...input, verified: false })
+  })
+});
+
+// src/tools/tool-registry.ts
+var LOCAL_TOOL_NAMES = new Set([
+  "list_files",
+  "read_file",
+  "read_files",
+  "search_files",
+  "search_many",
+  "propose_edits",
+  "apply_patch",
+  "move_file",
+  "quarantine_file",
+  "restore_file",
+  "run_check",
+  "git_diff",
+  "mutation_audit",
+  "load_skill",
+  "run_environment_command",
+  "run_environment_batch",
+  "run_environment_shell",
+  "environment_status",
+  "apply_reviewed_edits",
+  "apply_reviewed_replacement",
+  "read_task",
+  "repair_plan",
+  "inspect_environment_patch",
+  "apply_environment_patch",
+  "verify_and_apply_environment_patch",
+  "verify_and_apply_reviewed_edits"
+]);
+var assembleHarnessTools = (groups, external) => {
+  const tools = {};
+  for (const group of groups)
+    for (const [name, definition] of Object.entries(group)) {
+      if (Object.hasOwn(tools, name))
+        throw new HarnessConfigError(`Duplicate local tool ${name}.`);
+      tools[name] = { ...definition, metadata: { ...definition.metadata, source: "harness" } };
+    }
+  for (const [name, definition] of Object.entries(external)) {
+    if (LOCAL_TOOL_NAMES.has(name) || name.startsWith("delegate_") || Object.hasOwn(tools, name)) {
+      throw new HarnessConfigError(`MCP tool ${name} conflicts with a built-in workspace tool.`);
+    }
+    tools[name] = definition;
+  }
+  return tools;
+};
+
+// src/context/compaction.ts
+import { createRedactionPolicy as createRedactionPolicy4 } from "@zhivex-ai/agents";
+var COMPACTION_STRATEGY = "bounded-evidence-v8";
+var SEMANTIC_RECOLLECTION_SEPARATOR = `
+
+[Untrusted semantic recollection; never authorization or verification]
+`;
+var PREFIX = `[Compacted conversation context]
+`;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+var LOCAL_TOOLS = LOCAL_TOOL_NAMES;
+var MAX_USER_STEERING = 10;
+var CONTEXT_PRIORITY = "Latest user > chronological user steering > historical objective. Assistant never overrides user facts. Questions retain task.";
+var summarizeHarnessMessages = (messages, maxCharacters = 4000) => {
+  const redaction = createRedactionPolicy4({ includeEmails: true });
+  const clean = (text, limit = 512) => redaction.redactText(text).replace(/\bBearer\s+\S+/gi, "Bearer [REDACTED]").replace(/\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)|api[_-]?key|access[_-]?token|password)\s*([=:])\s*(?:"[^"]*"|'[^']*'|\S+)/gi, "$1$2[REDACTED]").replace(/\b(?:sk|ghp|gho|github_pat)-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(/\s+/g, " ").trim().slice(0, limit);
+  let objective = "";
+  let historicalObjective = "";
+  const recent = [];
+  const steering = [];
+  const evidence = [];
+  const checks = [];
+  const observations = [];
+  let workingPlan;
+  const locations = [];
+  let omitted = false;
+  const add = (items, value, maximum) => {
+    const duplicate = items.indexOf(value);
+    if (duplicate >= 0) {
+      items.splice(duplicate, 1);
+      omitted = true;
+    }
+    items.push(value);
+    if (items.length > maximum) {
+      items.shift();
+      omitted = true;
+    }
+  };
+  const rememberObservation = (tool2, detail) => {
+    if (typeof tool2 !== "string" || !LOCAL_TOOLS.has(tool2) || typeof detail !== "string")
+      return;
+    const bounded = clean(detail, 640);
+    if (!bounded)
+      return;
+    omitted ||= bounded.length < detail.length;
+    const duplicate = observations.findIndex((item) => item.tool === tool2 && item.detail === bounded);
+    if (duplicate >= 0) {
+      observations.splice(duplicate, 1);
+      omitted = true;
+    }
+    observations.push({ tool: tool2, detail: bounded, unverified: true });
+    if (observations.length > 3) {
+      observations.shift();
+      omitted = true;
+    }
+  };
+  const safePath = (value) => typeof value === "string" && value.length <= 240 && !value.startsWith("/") && !value.includes("\\") && !value.split("/").some((part) => part === ".." || /^(?:\.env(?:\.|$)|\.npmrc$|id_rsa$|id_ed25519$)|\.(?:key|pem|p12|pfx)$/i.test(part)) ? clean(value, 240) : undefined;
+  const addLocation = (value, kind) => {
+    const item = record(value);
+    const locationKind = kind ?? item.kind;
+    const filePath = safePath(item.path);
+    const startLine = locationKind === "search" && kind ? item.line : item.startLine;
+    const endLine = locationKind === "search" && kind ? item.line : item.endLine;
+    if (locationKind !== "read" && locationKind !== "search" || !filePath || typeof item.path !== "string" || /[\x00-\x1f\x7f]/.test(item.path) || typeof item.digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(item.digest) || !Number.isSafeInteger(startLine) || !Number.isSafeInteger(endLine) || startLine < 1 || endLine < startLine)
+      return;
+    const location = {
+      kind: locationKind,
+      path: filePath,
+      digest: item.digest,
+      startLine,
+      endLine,
+      ...locationKind === "read" && typeof item.clippedLine === "boolean" ? { clippedLine: item.clippedLine } : {}
+    };
+    for (let i = locations.length - 1;i >= 0; i--) {
+      const previous = locations[i];
+      if (previous.path === location.path && (previous.digest !== location.digest || previous.kind === location.kind && previous.startLine === location.startLine && previous.endLine === location.endLine)) {
+        locations.splice(i, 1);
+      }
+    }
+    locations.push(location);
+    if (locations.length > 8) {
+      locations.shift();
+      omitted = true;
+    }
+  };
+  const rememberPlan = (value) => {
+    const plan = record(value);
+    if (typeof plan.hypothesis !== "string" || typeof plan.expectedBehavior !== "string" || typeof plan.nextCheck !== "string")
+      return;
+    workingPlan = {
+      hypothesis: clean(plan.hypothesis, 512),
+      expectedBehavior: clean(plan.expectedBehavior, 512),
+      nextCheck: clean(plan.nextCheck, 256),
+      paths: Array.isArray(plan.paths) ? plan.paths.slice(0, 8).map(safePath).filter((p) => p !== undefined) : []
+    };
+  };
+  for (const message of messages) {
+    if (message.role === "system")
+      continue;
+    for (const part of message.parts) {
+      if (part.type === "text") {
+        const summaryPrefix = [PREFIX, `[Compacted prior conversation]
+`].find((prefix) => part.text.startsWith(prefix));
+        if (summaryPrefix) {
+          try {
+            const body = part.text.slice(summaryPrefix.length);
+            const separator = body.indexOf(SEMANTIC_RECOLLECTION_SEPARATOR);
+            const previous = record(JSON.parse(separator < 0 ? body : body.slice(0, separator)));
+            if ([COMPACTION_STRATEGY, "bounded-evidence-v7", "bounded-evidence-v6", "bounded-evidence-v5", "bounded-evidence-v4", "bounded-evidence-v3", "bounded-evidence-v2", "bounded-evidence-v1"].includes(String(previous.strategy))) {
+              if (!objective) {
+                const priorObjective = typeof previous.objective === "string" ? clean(previous.objective, 768) : "";
+                const priorSteering = Array.isArray(previous.steering) ? previous.steering.filter((value) => typeof value === "string") : [];
+                objective = previous.strategy === COMPACTION_STRATEGY ? priorObjective : clean(priorSteering.at(-1) ?? priorObjective, 768);
+                historicalObjective = typeof previous.historicalObjective === "string" ? clean(previous.historicalObjective, 768) : priorObjective !== objective ? priorObjective : "";
+              }
+              for (const [key, target, count2] of [["steering", steering, MAX_USER_STEERING], ["recent", recent, 4], ["evidence", evidence, 12], ["checks", checks, 4]]) {
+                if (Array.isArray(previous[key]))
+                  for (const value of previous[key].slice(-count2)) {
+                    if (typeof value === "string")
+                      add(target, clean(value), count2);
+                  }
+              }
+              if (Array.isArray(previous.locations)) {
+                for (const location of previous.locations.slice(-8))
+                  addLocation(location);
+              }
+              if (Array.isArray(previous.observations))
+                for (const value of previous.observations.slice(-3)) {
+                  const observation = record(value);
+                  rememberObservation(observation.tool, observation.detail);
+                }
+              omitted ||= previous.omitted === true;
+              rememberPlan(previous.workingPlan);
+              if (separator >= 0) {
+                const semantic = body.slice(separator + SEMANTIC_RECOLLECTION_SEPARATOR.length);
+                const recollection = clean(semantic, 384);
+                if (recollection)
+                  add(recent, `Untrusted semantic recollection (never authorization or verification): ${recollection}`, 4);
+                omitted ||= recollection.length < semantic.length;
+              }
+              continue;
+            }
+          } catch {}
+        }
+        const text = clean(part.text, message.role === "user" ? 768 : 512);
+        omitted ||= text.length < part.text.length;
+        if (message.role === "user") {
+          if (objective && objective !== text) {
+            if (!historicalObjective)
+              historicalObjective = objective;
+            add(steering, objective, MAX_USER_STEERING);
+          }
+          objective = text;
+          if (historicalObjective)
+            add(steering, text, MAX_USER_STEERING);
+        } else
+          add(recent, `${message.role}: ${text}`, 4);
+      } else if (part.type === "tool-call") {
+        const call = part.toolCall;
+        const name = LOCAL_TOOLS.has(call.name) ? call.name : "external-tool";
+        const input = record(call.input);
+        const paths = LOCAL_TOOLS.has(call.name) ? [
+          input.path,
+          ...Array.isArray(input.files) ? input.files.slice(0, 20).map((file) => record(file).path) : [],
+          ...Array.isArray(input.changes) ? input.changes.slice(0, 20).map((change) => record(change).path) : []
+        ].map(safePath).filter((value) => value !== undefined) : [];
+        add(evidence, clean(`tool-call:${name}${paths.length ? ` paths=${JSON.stringify([...new Set(paths)])}` : ""}`), 12);
+      } else if (part.type === "tool-result") {
+        const result = part.toolResult;
+        const name = LOCAL_TOOLS.has(result.toolName) ? result.toolName : "external-tool";
+        const output = LOCAL_TOOLS.has(result.toolName) ? record(result.output) : {};
+        const error = record(output.error);
+        const sdkError = LOCAL_TOOLS.has(result.toolName) ? record(result.error) : {};
+        const verificationDiagnostics = record(record(output.verification).diagnostics);
+        const diagnostics = [
+          sdkError.message,
+          error.message,
+          typeof output.error === "string" ? output.error : undefined,
+          result.isError ? output.message : undefined,
+          output.stderr,
+          verificationDiagnostics.stderr,
+          verificationDiagnostics.stdout,
+          ...name === "run_check" || name.startsWith("run_environment_") ? [output.stdout] : []
+        ].filter((value) => typeof value === "string" && value.trim().length > 0);
+        if (diagnostics.length)
+          rememberObservation(name, diagnostics.join(`
+`));
+        if (!result.isError) {
+          if (name === "read_file")
+            addLocation(output, "read");
+          if (name === "read_files" && Array.isArray(output.files)) {
+            for (const file of output.files.slice(0, 20))
+              addLocation(file, "read");
+          }
+          if (name === "search_files" && Array.isArray(output.matches)) {
+            for (const match of output.matches.slice(0, 8))
+              addLocation(match, "search");
+          }
+          if (name === "search_many" && Array.isArray(output.results)) {
+            for (const group of output.results.slice(0, 20)) {
+              const matches = record(group).matches;
+              if (Array.isArray(matches))
+                for (const match of matches.slice(0, 8))
+                  addLocation(match, "search");
+            }
+          }
+        }
+        const fields = {};
+        if (typeof result.isError === "boolean")
+          fields.isError = result.isError;
+        for (const [key, value] of Object.entries({
+          exitCode: output.exitCode,
+          timedOut: output.timedOut,
+          verificationExitCode: record(output.verification).exitCode
+        })) {
+          if (key === "timedOut" ? typeof value === "boolean" : Number.isSafeInteger(value))
+            fields[key] = value;
+        }
+        for (const key of ["digest", "patchId"]) {
+          if (typeof output[key] === "string" && /^sha256:[a-f0-9]{64}$/.test(output[key]))
+            fields[key] = output[key];
+        }
+        const filePath = safePath(output.path);
+        if (filePath)
+          fields.path = filePath;
+        if (name === "repair_plan" && !result.isError) {
+          rememberPlan(output);
+        }
+        const entry = `tool-result:${name} ${JSON.stringify(fields)}`;
+        if (fields.exitCode !== undefined || fields.verificationExitCode !== undefined || fields.isError === true)
+          add(checks, entry, 4);
+        else
+          add(evidence, entry, 12);
+      }
+    }
+  }
+  const state = {
+    strategy: COMPACTION_STRATEGY,
+    contextPriority: CONTEXT_PRIORITY,
+    objective,
+    ...historicalObjective ? { historicalObjective } : {},
+    steering,
+    recent,
+    checks,
+    evidence,
+    locations,
+    ...observations.length ? { observations } : {},
+    ...workingPlan ? { workingPlan } : {},
+    omitted
+  };
+  let compactEnvelope = false;
+  const encode = () => JSON.stringify(state, (key, value) => {
+    if (compactEnvelope && Array.isArray(value) && !value.length)
+      return;
+    if (compactEnvelope && key === "contextPriority")
+      return "Latest request steers; prior task persists.";
+    return value;
+  });
+  while (encode().length > maxCharacters && (recent.length || evidence.length || checks.length || locations.length || observations.length)) {
+    state.omitted = true;
+    if (evidence.length)
+      evidence.shift();
+    else if (recent.length > 1)
+      recent.shift();
+    else if (observations.length > 1)
+      observations.shift();
+    else if (locations.length > 1)
+      locations.shift();
+    else if (checks.length > 1)
+      checks.shift();
+    else if (recent.length)
+      recent.shift();
+    else if (observations.length)
+      observations.shift();
+    else if (checks.length)
+      checks.shift();
+    else if (locations.length)
+      locations.shift();
+    else if (state.workingPlan)
+      delete state.workingPlan;
+  }
+  if (encode().length > maxCharacters && state.workingPlan) {
+    state.omitted = true;
+    delete state.workingPlan;
+  }
+  if (encode().length > maxCharacters) {
+    const duplicate = steering.indexOf(state.objective);
+    if (duplicate >= 0) {
+      steering.splice(duplicate, 1);
+      state.omitted = true;
+    }
+  }
+  if (encode().length > maxCharacters)
+    compactEnvelope = true;
+  while (encode().length > maxCharacters && state.historicalObjective?.length) {
+    state.omitted = true;
+    state.historicalObjective = state.historicalObjective.slice(0, Math.max(0, state.historicalObjective.length - 64));
+  }
+  if (!state.historicalObjective)
+    delete state.historicalObjective;
+  while (encode().length > maxCharacters && steering.length > 1) {
+    state.omitted = true;
+    steering.shift();
+  }
+  while (encode().length > maxCharacters && (state.objective.length || steering[0]?.length)) {
+    state.omitted = true;
+    if ((steering[0]?.length ?? 0) > state.objective.length) {
+      steering[0] = steering[0].slice(0, Math.max(0, steering[0].length - 16));
+    } else
+      state.objective = state.objective.slice(0, Math.max(0, state.objective.length - 16));
+  }
+  const summary = encode().length <= maxCharacters ? encode() : "{}".slice(0, maxCharacters);
+  return { summary, truncated: state.omitted };
+};
+var sourceRequests = new WeakMap;
+var compactedTaskSources = (messages) => sourceRequests.get(messages);
+var compactMessages = (messages) => {
+  if (!messages.length)
+    return [];
+  const sources = captureTaskSources({ zhivexTaskSources: sourceRequests.get(messages) ?? [] }, messages);
+  const compacted = [{ role: "user", parts: [{
+    type: "text",
+    text: `${PREFIX}${summarizeHarnessMessages(messages).summary}`
+  }] }];
+  sourceRequests.set(compacted, sources);
+  return compacted;
+};
+
+// src/context/adaptive-compaction.ts
+var estimateMessages = (messages) => estimateContextTokens(measureContext({ messages: [...messages] }));
+var safeRetentionCuts = (messages) => {
+  let systemCount = 0;
+  while (messages[systemCount]?.role === "system")
+    systemCount++;
+  const origins = new Map;
+  const crossings = new Array(messages.length + 1).fill(0);
+  messages.forEach((message, index) => {
+    for (const part of message.parts) {
+      let origin, reference;
+      if (part.type === "tool-call")
+        origin = `tool:${part.toolCall.id}`;
+      if (part.type === "tool-result")
+        reference = `tool:${part.toolResult.toolCallId}`;
+      if (part.type === "provider-data" && part.data && typeof part.data === "object" && !Array.isArray(part.data)) {
+        if (part.data.type === "mcp_approval_request" && typeof part.data.id === "string")
+          origin = `approval:${part.provider}:${part.data.id}`;
+        if (part.data.type === "mcp_approval_response" && typeof part.data.approval_request_id === "string")
+          reference = `approval:${part.provider}:${part.data.approval_request_id}`;
+      }
+      if (origin)
+        origins.set(origin, index);
+      const from = reference ? origins.get(reference) : undefined;
+      if (from !== undefined && from < index) {
+        crossings[from + 1]++;
+        crossings[index + 1]--;
+      }
+    }
+  });
+  const cuts = [];
+  let crossingCount = 0;
+  for (let cut = 0;cut < messages.length; cut++) {
+    crossingCount += crossings[cut];
+    if (cut > systemCount && messages[cut].role !== "tool" && crossingCount === 0)
+      cuts.push(cut);
+  }
+  return cuts;
+};
+var createAdaptiveCompaction = (config, options = {}) => {
+  let retained = config.keepRecentMessages;
+  let systemTokens = 0;
+  let protectedTailTokens = 1024;
+  const toolTokens = estimateContextTokens(measureContext({ messages: [], ...options.tools ? { tools: options.tools } : {} })) - 64;
+  const summaryAllowance = 1500;
+  const threshold = () => {
+    const remaining = options.remainingInputTokens?.() ?? Infinity;
+    return Math.ceil(toolTokens + Math.max(systemTokens + summaryAllowance + protectedTailTokens, Math.min(config.maxEstimatedInputTokens, remaining / 3 - toolTokens)));
+  };
+  return {
+    ...options.auxiliary ? { auxiliary: options.auxiliary } : {},
+    maxMessages: config.maxMessages,
+    get maxEstimatedInputTokens() {
+      return threshold();
+    },
+    get keepRecentMessages() {
+      return retained;
+    },
+    estimateTokens(messages) {
+      const measured = measureContext({ messages: [...messages] });
+      systemTokens = Math.ceil(measured.systemCharacters / 3);
+      const cuts = safeRetentionCuts(messages);
+      const tailCharacters = new Array(messages.length + 1).fill(0);
+      for (let i = messages.length - 1;i >= 0; i--)
+        tailCharacters[i] = tailCharacters[i + 1] + JSON.stringify(messages[i]).length;
+      const newestCut = cuts.at(-1);
+      protectedTailTokens = newestCut === undefined ? 1024 : Math.max(1024, Math.ceil(tailCharacters[newestCut] / 3) + 64);
+      const target = Math.max(1024, Math.floor(threshold() * 0.65) - toolTokens - systemTokens - summaryAllowance);
+      const cut = cuts.find((index) => messages.length - index <= config.keepRecentMessages && Math.ceil(tailCharacters[index] / 3) + 64 <= target) ?? cuts.at(-1);
+      retained = cut === undefined ? 1 : Math.max(1, messages.length - cut);
+      return estimateContextTokens(measured) + toolTokens;
+    },
+    compactor: options.compactor ?? (({ messages }) => {
+      const budget = Math.max(128, Math.min(4000, Math.floor(JSON.stringify(messages).length / 2)));
+      const { summary, truncated } = summarizeHarnessMessages(messages, budget);
+      return { summary, metadata: {
+        strategy: COMPACTION_STRATEGY,
+        policy: "adaptive-tokens-v2",
+        sourceMessages: messages.length,
+        truncated,
+        targetRatio: 0.65,
+        toolTokens
+      } };
+    })
+  };
+};
+
+export { SqliteDatabase, protectStateFromGit, validateStateDirectory, HARNESS_SESSION_INDEX_FILE, HARNESS_SESSION_SCHEMA_VERSION, SESSION_RUN_STATUSES, TERMINAL_SESSION_RUN_STATUSES, openCliSessionStore, openSessionStore, UnsafeFileTypeError, FileSizeLimitError, FileChangedWhileReadingError, statRegularFileNoFollow, readRegularFileNoFollow, readRegularFileChunksNoFollow, inspectRuntimeDiagnostics, inspectRuntimeManifest, MODEL_BUDGET_KEY, estimateRequestTokens, workBudgetReached, createModelBudget, harnessToolExecution, USAGE_LEDGER_KEY, usagePricingSchema, inspectUsageLedger, formatUsageLedger, UsageLedger, resolvePackageManager, resolvePackageCheckCommand, runPortableProcess, verifierSchema, TASK_SOURCE_KEY, taskSources, captureTaskSources, createTaskTools, assembleHarnessTools, COMPACTION_STRATEGY, SEMANTIC_RECOLLECTION_SEPARATOR, summarizeHarnessMessages, compactedTaskSources, compactMessages, estimateMessages, createAdaptiveCompaction };