@zhivex-ai/harness 1.2.0 → 1.3.0-rc.3

package/dist/{service-client-cli-yx56n0hc.js → service-client-cli-gs78wrxe.js}

@@ -11,7 +11,7 @@ import {
   navigateConsole,
   sanitizeTerminalText,
   serializeStreamResult
-} from "./cli-entry-c2f58zj2.js";
+} from "./cli-entry-xmf48p6a.js";
 import {
   HARNESS_VERSION
 } from "./cli-entry-64pdp3k5.js";
@@ -22,7 +22,7 @@ import {
   HarnessStateConflictError,
   PROVIDERS,
   reasoningEffortSchema
-} from "./cli-entry-427869g9.js";
+} from "./cli-entry-0mmeag20.js";
 import {
   __require
 } from "./cli-entry-1bx83sw4.js";

package/dist/verify-historical-migrations.js

@@ -110,6 +110,7 @@ var createMetaContinuationFetch = (fetcher = fetch, backoff = [1000, 2000]) => {
 
 // src/providers/meta-replay.ts
 import { wrapLanguageModel as wrapLanguageModel2 } from "@zhivex-ai/core";
+import { withTimeoutSignal } from "@zhivex-ai/core/provider";
 import { createMeta } from "@zhivex-ai/meta";
 var replayPlan = (messages) => {
   let offset = 0;
@@ -183,7 +184,54 @@ var createMetaReplayModel = (options, modelId) => {
     },
     async wrapStream({ input }) {
       const prepared = prepare(input);
-      return prepared.model.stream(prepared.input);
+      const lifetime = withTimeoutSignal(prepared.input);
+      const { timeoutMs: _timeout, ...request } = prepared.input;
+      try {
+        const stream = await prepared.model.stream({ ...request, abortSignal: lifetime.signal });
+        const iterator = stream[Symbol.asyncIterator]();
+        const owned = {
+          [Symbol.asyncIterator]() {
+            return owned;
+          },
+          async next() {
+            try {
+              const result = await iterator.next();
+              if (result.done)
+                lifetime.cleanup();
+              return result;
+            } catch (error) {
+              lifetime.cleanup();
+              throw error;
+            }
+          },
+          async return() {
+            try {
+              return await iterator.return?.() ?? { done: true, value: undefined };
+            } finally {
+              lifetime.cleanup();
+            }
+          },
+          async throw(error) {
+            try {
+              if (iterator.throw) {
+                const result = await iterator.throw(error);
+                if (result.done)
+                  lifetime.cleanup();
+                return result;
+              }
+              await iterator.return?.();
+              throw error;
+            } catch (failure) {
+              lifetime.cleanup();
+              throw failure;
+            }
+          }
+        };
+        return owned;
+      } catch (error) {
+        lifetime.cleanup();
+        throw error;
+      }
     }
   }]);
 };
@@ -4038,6 +4086,16 @@ var editProposalSchema = z8.strictObject({
 var applyEditProposalInputSchema = z8.strictObject({
   proposalId: fileDigestSchema,
   changes: editChangesSchema
+}).superRefine((input, context) => {
+  if (!editProposalInputSchema.safeParse({ changes: input.changes }).success)
+    return;
+  if (createEditProposal({ changes: input.changes }).proposalId !== input.proposalId) {
+    context.addIssue({
+      code: "custom",
+      path: ["proposalId"],
+      message: "proposalId does not match the supplied paths, preconditions, and content. Read proposalId from the matching propose_edits result; do not invent it."
+    });
+  }
 });
 var moveFileInputSchema = z8.strictObject({
   source: workspaceFilePathSchema,

package/dist/zhx.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   shortCliHelp
-} from "./cli-entry-b1mfvmxe.js";
+} from "./cli-entry-7h9savv5.js";
 import {
   HARNESS_VERSION
 } from "./cli-entry-64pdp3k5.js";
@@ -18,6 +18,6 @@ if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${shortCliHelp(HARNESS_VERSION)}
 `);
 } else {
-  const { runCli } = await import("./cli-3jmy4h5h.js");
+  const { runCli } = await import("./cli-qgwvtk0w.js");
   await runCli(argv);
 }

package/docs/CODE_RELEASE.md

@@ -0,0 +1,93 @@
+# Code release procedure
+
+Code is released independently of Harness. The initial candidate is
+`@zhivex-ai/code@0.1.0-rc.1`, with the sole binary `zhivex-code`, npm tag `next`,
+and the exact dependency `@zhivex-ai/harness@1.3.0-rc.3`. Harness must first be
+published and verified through its protected release workflow. This document
+records preparation, not successful publication.
+
+## Release preparation
+
+1. Merge the Code release PR after required review and successful checks.
+2. Wait for the latest `ci.yml` and `codeql.yml` **push runs on main** to succeed
+   for the exact commit. Keep the Code manifest, version and engine pin unchanged
+   after selecting that commit.
+3. From a clean checkout of that main commit, create an annotated
+   `code-v0.1.0-rc.1` tag and push it. Never move or overwrite release tags.
+4. Dispatch `release-code.yml` **at that tag**, with input `tag` matching it and
+   `mode=bootstrap`. Dispatching main while supplying a different tag is rejected.
+
+```sh
+gh workflow run release-code.yml --ref code-v0.1.0-rc.1 \
+  -f tag=code-v0.1.0-rc.1 -f mode=bootstrap -f confirm_publication=false
+```
+
+The workflow validates tag identity, main ancestry, exact CI/CodeQL, Code source
+and package boundaries. It downloads the pinned Harness version from npm and
+verifies its integrity; missing publication or provenance stops the release.
+It builds Code once, inspects package contents, installs it against the actual
+registry dependency without overrides, and tests the retained Code and Harness
+artifacts with npm, pnpm, Yarn and Bun. The paired matrix uses explicit engine
+artifact overrides; the separate standalone installation proves npm resolution.
+This does not claim every future engine version or installation order is certified.
+
+The workflow generates genuine npm/Sigstore provenance using pinned npm 11.6.1
+inside the GitHub-hosted build job. It retains `code.tgz`, `code.sigstore.json`,
+`SHA512SUMS`, and installed acceptance in `code-release-<full-source-sha>`.
+Bootstrap mode **does not publish**. No npm token is copied into GitHub.
+
+## First publication
+
+npm requires the package to exist before configuring its trusted publisher;
+staged publishing also requires an existing package. An authenticated scope
+owner performs the first publication using the successful workflow's retained
+artifact and provenance bundle. Do not rebuild the tarball locally.
+
+Download the artifact from the exact successful run, then verify it in a clean
+checkout of its annotated Code tag. `CODE_EXPECTED_SHA` must be that tag's full
+commit SHA. Install npm 11.6.1 into an isolated tools directory and set
+`CODE_PROVENANCE_NPM_ROOT` to its `node_modules/npm` directory.
+
+```sh
+(cd release-code-artifacts && shasum -a 512 -c SHA512SUMS)
+bun run scripts/code-release.ts inspect release-code-artifacts/code.tgz
+CODE_EXPECTED_SHA="$(git rev-list -n 1 code-v0.1.0-rc.1)" \
+  node scripts/code-bootstrap-provenance.cjs verify \
+  release-code-artifacts/code.tgz release-code-artifacts/code.sigstore.json
+node "$CODE_PROVENANCE_NPM_ROOT/bin/npm-cli.js" publish \
+  ./release-code-artifacts/code.tgz --ignore-scripts --access public \
+  --tag next --provenance-file ./release-code-artifacts/code.sigstore.json
+bun run scripts/code-release.ts verify release-code-artifacts/code.tgz
+```
+
+The provenance verifier checks the Sigstore signature, GitHub issuer, exact
+workflow/tag identity, source commit and tarball digest. Complete any npm 2FA
+challenge directly; do not put a one-time code into documentation or logs. If npm
+accepts publication but verification fails, inspect registry state and retry
+verification with the same retained bytes. An existing different digest is a
+hard failure; never attempt to replace that version.
+
+## Subsequent releases with Trusted Publishing
+
+In npm package settings, configure GitHub Actions with organization `Zhivex`,
+repository `zhivex-harness`, workflow filename `release-code.yml`, and environment
+`npm`. Enable the allowed action `npm publish`; the OIDC job uses direct
+publishing after GitHub approval, not `npm stage publish`. Preserve the GitHub
+environment's required human approval. Then prepare a
+new Code RC/version and annotated tag through the same PR and main CI process.
+Dispatch its tag with `mode=oidc` and `confirm_publication=true`.
+
+All Code tags share one workflow concurrency group. Before publishing, the
+registry gate also rejects moving `next` back to an older RC, including when
+GitHub schedules queued workflows out of order.
+
+The publish job downloads the validated artifact without rebuilding it,
+rechecks identity and digest after protected approval, and uses npm OIDC plus
+provenance. It verifies registry tarball bytes, the `next` distribution tag and
+SLSA source/workflow identity. A successful dispatch or tag is not publication;
+only successful registry verification confirms the release. When a run has
+already published, rerun only the failed publish job to retain original bytes.
+
+Official references: [npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers/),
+[npm provenance](https://docs.npmjs.com/generating-provenance-statements/), and
+[npm staged publishing](https://docs.npmjs.com/staged-publishing/).

package/docs/ENGINE_API.md

@@ -0,0 +1,111 @@
+# Engine API and Code integration
+
+This checkout adds terminal-independent package entrypoints for
+Harness 1.3.0-rc.3. They are not present in the previously published Harness 1.2.0.
+Publication is pending the protected workflow; use the documented
+local candidate smoke to validate these bytes. Do not install registry 1.2.0 and
+expect the new entrypoints to exist.
+
+## Entry points
+
+| Import | Use | Runtime |
+| --- | --- | --- |
+| `@zhivex-ai/harness/engine` | Configuration, execution, policies, approvals, tools, stores, providers and historical non-terminal library APIs | Node |
+| `@zhivex-ai/harness/protocol` | Wire request schemas, client types and JSON/event serialization | Browser or Node |
+| `@zhivex-ai/harness/client` | In-process client adapter, result projection and durable continuation helpers | Node |
+| `@zhivex-ai/harness/service` | Authenticated local service, recovery and activity events | Node |
+| `@zhivex-ai/harness/acp` | Experimental text-session ACP adapter and stream transport | Node |
+| `@zhivex-ai/harness/code-support` | Named host helpers used by Code, including a read-only SQLite diagnostic projection | Node |
+
+[`contracts/engine-api.json`](../contracts/engine-api.json) enumerates every named
+export and its stability tier. Existing aliases keep their root tier. New helpers
+have their explicitly recorded tier; importing through a new subpath does not
+upgrade an experimental API. The historical root export and its stable signature
+baseline remain supported. Host-loading JSON document schemas are available from
+`/engine`, not the browser protocol entrypoint.
+
+Imports do not open a terminal, start a service, create a Harness instance or
+prompt for credentials. Hosts explicitly construct and close the runtime, supply
+credentials/model instances, resolve approvals and choose their storage policy.
+Importing the engine does not itself execute a task or grant permissions.
+
+```ts
+import { createHarness } from "@zhivex-ai/harness/engine";
+import { createHarnessClientAdapter } from "@zhivex-ai/harness/client";
+
+const harness = await createHarness({
+  workspace: "/absolute/path/to/project",
+  provider: "openai",
+  model: "your-supported-model"
+});
+const client = await createHarnessClientAdapter(harness);
+try {
+  // Dispatch requests using the documented client protocol and explicit approvals.
+  // Keep the host alive for the work it starts; close only when it is finished.
+} finally {
+  client.close();
+  await harness.close();
+}
+```
+
+See [the client protocol](CLIENT_PROTOCOL.md), [local service](LOCAL_SERVICE.md)
+and [durable operations](DURABLE_OPERATIONS.md) for execution, approval and recovery
+semantics. Persistence and approval fingerprints are shared across clients;
+switching presentation does not migrate state or authorize new effects.
+
+## Terminal product
+
+`packages/code` is the independently built terminal product. Its current version
+is `0.1.0-rc.1`, prepared for independent publication to `next` with the exact
+engine dependency `@zhivex-ai/harness@1.3.0-rc.3`. Publication remains gated by
+reviewed main, CI and registry evidence in the [Code release procedure](CODE_RELEASE.md).
+Code imports declared package APIs, never Harness source paths. Its build leaves
+Harness external.
+
+Code owns `zhivex-code`. Harness 1.x continues to own `zhx`, `zhivex-harness` and
+`zhx-acp`, preserving commands, flags, exit codes, JSON contracts and state paths.
+The Code version/help identify the terminal product; engine diagnostics continue
+to identify Harness. The historical CLI stays a Harness compatibility snapshot,
+without a Harness dependency on Code. Desktop keeps its existing internal bridge
+until HAR-HU-39 migrates it separately.
+
+Node >=22.13.0 is the runtime requirement. Bun builds and tests the source but is
+not required to install or run the JavaScript tarballs. Consumer projects retain
+their own package manager and lockfile.
+
+## Contributor validation
+
+```sh
+bun run dev:code
+bun run typecheck:code
+bun run test:code
+bun run architecture:check
+bun run contract:check
+bun run smoke:engine-code
+```
+
+The smoke packs the current Harness candidate without changing its version. The
+release workflow supplies the exact tarball via `HARNESS_CODE_HARNESS_ARTIFACT`;
+its bytes are copied, never repacked. The report identifies hashes, installed
+versions and observed results. Node execution uses a restricted PATH excluding
+Bun. Local fixtures exercise approval, persistence and restart, Code execution
+and cancellation without live keys. This is deterministic installed evidence,
+not provider certification or a registry release. Historical HU37/38 reports
+used temporary 1.3.0-dev.0 metadata; those reports do not certify RC1.
+
+`dev:code` explicitly links the built local Harness for contributor tests; it
+preserves an existing dependency and is never run by package installation.
+Installed acceptance uses tarballs instead of that link. The CI workflow defines
+the same four-manager check on Node 22.13.0 and Node 24; a workflow definition is
+not evidence that remote CI has run.
+
+The architecture gate follows transitive imports, re-exports and type references
+from the engine surfaces, rejecting CLI/Desktop/Code dependencies and computed
+module loads. Code has separate checks for public-package imports and manifest/bin
+ownership. Stable root declaration signatures are checked without regenerating
+the baseline to accommodate this extraction.
+
+Publishing Code requires a compatible Harness release, authenticated scope/name
+verification and the release compatibility gates in
+[ADR 0001](https://github.com/Zhivex/zhivex-harness/blob/main/docs/adr/0001-harness-code-public-boundary.md).
+Local packing does not establish npm permissions or public availability.

package/docs/FIRST_USE.md

@@ -1,13 +1,13 @@
 # First use
 
-This guide targets the prepared `1.2.0` stable release. Installation commands become available after protected publication to npm `latest`.
+This guide targets the prepared `1.3.0-rc.3` candidate. Installation commands become available after protected publication to npm `next`; stable users can keep npm `latest`.
 
 ## Install and start
 
 Install Node.js 22.13.0 or newer and Git. Then:
 
 ```sh
-npm install -g @zhivex-ai/harness@1.2.0
+npm install -g @zhivex-ai/harness@1.3.0-rc.3
 cd /path/to/your/project
 zhx
 ```
@@ -82,16 +82,16 @@ For command execution, configure [OCI isolation](EXECUTION_ENVIRONMENTS.md).
 With Bun 1.4.0 or newer and a supported Node runtime:
 
 ```sh
-bun add --global @zhivex-ai/harness@1.2.0
+bun add --global @zhivex-ai/harness@1.3.0-rc.3
 zhx
 ```
 
 For a disposable version/help/environment check without a global installation:
 
 ```sh
-bunx @zhivex-ai/harness@1.2.0 --version
-bunx @zhivex-ai/harness@1.2.0 --help
-bunx @zhivex-ai/harness@1.2.0 doctor
+bunx @zhivex-ai/harness@1.3.0-rc.3 --version
+bunx @zhivex-ai/harness@1.3.0-rc.3 --help
+bunx @zhivex-ai/harness@1.3.0-rc.3 doctor
 ```
 
 For source development, use the [contributor guide](https://github.com/Zhivex/zhivex-harness/blob/main/CONTRIBUTING.md).

package/docs/README.md

@@ -16,6 +16,9 @@ Start with [First use](FIRST_USE.md). You only need `zhx` for everyday conversat
 
 ## Integrate Harness
 
+- [Engine API and Code integration](ENGINE_API.md): terminal-independent imports and local candidate validation.
+- [Code release procedure](CODE_RELEASE.md): independent RC publication, exact artifact, bootstrap provenance and Trusted Publishing.
+
 - [CLI reference](CLI.md): command options, JSON/JSONL and exit codes.
 - [Extensibility](EXTENSIBILITY.md): providers, MCP, routing and subagents.
 - [API stability](STABILITY.md) and [deprecations](DEPRECATIONS.md).
@@ -26,6 +29,8 @@ Start with [First use](FIRST_USE.md). You only need `zhx` for everyday conversat
 
 ## Contribute and maintain
 
+- [Harness/Code boundary proposal (ADR 0001)](https://github.com/Zhivex/zhivex-harness/blob/main/docs/adr/0001-harness-code-public-boundary.md): ownership, public APIs and the proposed 1.x transition.
+
 [Contributor guide](https://github.com/Zhivex/zhivex-harness/blob/main/CONTRIBUTING.md) ·
 [Maintenance and release evidence](https://github.com/Zhivex/zhivex-harness/blob/main/docs/MAINTENANCE.md) ·
 [Changelog](../CHANGELOG.md)

package/docs/STABILITY.md

@@ -1,5 +1,11 @@
 # API stability
 
+The additive [engine entrypoints](ENGINE_API.md) are enumerated in
+[`../contracts/engine-api.json`](../contracts/engine-api.json). Aliases preserve
+their existing root tiers; newly exposed helpers have explicit tiers. The root
+compatibility surface remains unchanged. These entrypoints are source changes
+for the planned 1.3 line, not APIs available in the registry 1.2.0 package.
+
 [`../contracts/public-api.json`](../contracts/public-api.json) is the machine-checked 1.0 baseline for the package root, binaries, CLI commands/subcommands, exit codes, and document schemas. Every runtime and type export is present in the snapshot and belongs to exactly one explicit tier. Exports listed as stable form the intended 1.x compatibility surface; Time-to-Safe-Fix exports are experimental; the explicitly listed beta exports may evolve under the policy below.
 
 [`../contracts/stable-api-signatures.json`](../contracts/stable-api-signatures.json) binds every Stable runtime and type export to a reproducible SHA-256 signature derived from emitted TypeScript declarations. Each signature includes the local declaration dependency closure, so a Beta helper type cannot change the effective signature of a Stable API unnoticed. `bun run contract:check` regenerates declarations in a temporary directory and fails on drift; `bun run contract:signatures:update` is only for a reviewed compatible baseline update or the next major version. The installed-package smoke repeats the comparison against the exact tarball declarations.

package/evaluations/representative-assembly-matrix.json

@@ -45,7 +45,10 @@
     "v1.2.0-rc.11",
     "v1.2.0-rc.12",
     "v1.2.0-rc.13",
-    "v1.2.0"
+    "v1.2.0",
+    "v1.3.0-rc.1",
+    "v1.3.0-rc.2",
+    "v1.3.0-rc.3"
   ],
   "expectedModels": [
     {
@@ -399,6 +402,30 @@
         "qwen": "qwen3.8-flash",
         "openai": "gpt-6-luna"
       }
+    },
+    {
+      "releaseTag": "v1.3.0-rc.1",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
+    },
+    {
+      "releaseTag": "v1.3.0-rc.2",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
+    },
+    {
+      "releaseTag": "v1.3.0-rc.3",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
     }
   ],
   "expectedCases": [

package/examples/README.md

@@ -8,7 +8,7 @@ Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After pro
 harness_demo_dir=$(mktemp -d)
 cd "$harness_demo_dir"
 printf '{"name":"harness-first-run","private":true}\n' > package.json
-bun add --exact --ignore-scripts @zhivex-ai/harness@1.2.0
+bun add --exact --ignore-scripts @zhivex-ai/harness@1.3.0-rc.3
 ./node_modules/.bin/zhx --version
 ./node_modules/.bin/zhx --help
 ./node_modules/.bin/zhx doctor --provider openai --json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhivex-ai/harness",
-  "version": "1.2.0",
+  "version": "1.3.0-rc.3",
   "description": "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   "type": "module",
   "license": "MIT",
@@ -45,6 +45,30 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./engine": {
+      "types": "./dist/engine/index.d.ts",
+      "import": "./dist/engine/index.js"
+    },
+    "./protocol": {
+      "types": "./dist/engine/protocol.d.ts",
+      "import": "./dist/engine/protocol.js"
+    },
+    "./client": {
+      "types": "./dist/engine/client.d.ts",
+      "import": "./dist/engine/client.js"
+    },
+    "./service": {
+      "types": "./dist/engine/service.d.ts",
+      "import": "./dist/engine/service.js"
+    },
+    "./acp": {
+      "types": "./dist/engine/acp.d.ts",
+      "import": "./dist/engine/acp.js"
+    },
+    "./code-support": {
+      "types": "./dist/compat/code-support.d.ts",
+      "import": "./dist/compat/code-support.js"
     }
   },
   "files": [
@@ -56,6 +80,7 @@
     "LICENSE",
     "docs/CHANGE_ENVELOPES.md",
     "docs/CLI.md",
+    "docs/CODE_RELEASE.md",
     "docs/images/cli-conversation.png",
     "docs/CLIENT_PROTOCOL.md",
     "docs/CONTEXT_ENGINEERING.md",
@@ -87,14 +112,15 @@
     "evaluations/*.jsonl",
     "benchmarks/README.md",
     "docs/ACP.md",
-    "docs/WORKSPACE_CHECKPOINTS.md"
+    "docs/WORKSPACE_CHECKPOINTS.md",
+    "docs/ENGINE_API.md"
   ],
   "scripts": {
     "models:check": "bun run scripts/validate-model-catalog.ts",
     "models:import": "bun run scripts/generate-console-models.ts",
     "dev": "bun run build && node --env-file-if-exists=.env dist/cli.js",
     "start": "node dist/cli.js",
-    "build": "bun run scripts/clean-dist.ts && bun build ./src/index.ts ./src/service-cli.ts ./src/acp-cli.ts --outdir ./dist --target node --packages external && bun build ./src/cli-entry.ts --outdir ./dist --target node --packages external --splitting && mv ./dist/cli-entry.js ./dist/cli.js && cp ./dist/cli.js ./dist/zhx.js && bun build ./scripts/verify-historical-migrations.ts --outfile ./dist/verify-historical-migrations.js --target node --packages external && bun build ./scripts/hostile-repository-demo.ts --outfile ./dist/hostile-repository-demo.js --target node --packages external && tsc --emitDeclarationOnly",
+    "build": "bun run scripts/clean-dist.ts && bun build ./src/index.ts ./src/service-cli.ts ./src/acp-cli.ts ./src/engine/index.ts ./src/engine/protocol.ts ./src/engine/client.ts ./src/engine/service.ts ./src/engine/acp.ts ./src/compat/code-support.ts --root ./src --outdir ./dist --target node --packages external --splitting && bun build ./src/engine/protocol.ts --outdir ./dist/engine --target browser --packages external && bun build ./src/cli-entry.ts --outdir ./dist --target node --packages external --splitting && mv ./dist/cli-entry.js ./dist/cli.js && cp ./dist/cli.js ./dist/zhx.js && bun build ./scripts/verify-historical-migrations.ts --outfile ./dist/verify-historical-migrations.js --target node --packages external && bun build ./scripts/hostile-repository-demo.ts --outfile ./dist/hostile-repository-demo.js --target node --packages external && tsc --emitDeclarationOnly",
     "prepack": "bun run build",
     "architecture:check": "bun run scripts/check-architecture.ts",
     "docs:check": "bun run scripts/check-docs.ts",
@@ -143,7 +169,12 @@
     "smoke:console": "bun run build && python3 scripts/console-pty-smoke.py && python3 scripts/console-entry-smoke.py",
     "smoke:credentials": "node --experimental-strip-types scripts/credential-store-smoke.ts",
     "release:preflight": "bun run scripts/release-preflight.ts",
-    "release:prepare": "bun run scripts/prepare-release.ts"
+    "release:prepare": "bun run scripts/prepare-release.ts",
+    "build:code": "bun run --cwd packages/code build",
+    "test:code": "bun run --cwd packages/code test",
+    "smoke:engine-code": "bun run scripts/smoke-engine-code.ts",
+    "dev:code": "bun run build && bun run packages/code/scripts/link-local-engine.ts && bun run build:code",
+    "typecheck:code": "bun run --cwd packages/code typecheck"
   },
   "dependencies": {
     "@zhivex-ai/agents": "1.10.1",