@zhivex-ai/harness 1.2.0 → 1.3.0-rc.7

package/dist/index-yb239ghk.js

@@ -0,0 +1,961 @@
+// src/workspace/edit-contracts.ts
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { z } from "zod";
+var EDIT_CONTRACT_SCHEMA_VERSION = 1;
+var EDIT_DIGEST_ALGORITHM = "sha256";
+var MAX_EDIT_CHANGES = 50;
+var MAX_EDIT_FILE_BYTES = 1024 * 1024;
+var MAX_EDIT_PROPOSAL_BYTES = 4 * 1024 * 1024;
+var SHA256_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+var fileDigestSchema = z.string().regex(SHA256_DIGEST_PATTERN, "Digest must use the format sha256:<64 lowercase hexadecimal characters>.");
+var expectedEditDigestSchema = fileDigestSchema.nullable().describe("Required. Use the inspected sha256 digest for an existing file, or explicit JSON null for a create-only target. Never omit this field.");
+var workspaceFilePathSchema = z.string().min(1).max(1024).refine((value) => !value.includes("\x00"), "Path cannot contain a NUL byte.").refine((value) => !path.isAbsolute(value) && !/^[A-Za-z]:[\\/]/.test(value), "Path must be relative.").refine((value) => {
+  const segments = value.split(/[\\/]+/);
+  return segments.every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}, "Path must be normalized and cannot contain empty, dot, or parent segments.");
+var editChangeSchema = z.strictObject({
+  path: workspaceFilePathSchema,
+  expectedDigest: expectedEditDigestSchema,
+  content: z.string()
+}).superRefine((change, context) => {
+  if (Buffer.byteLength(change.content, "utf8") > MAX_EDIT_FILE_BYTES) {
+    context.addIssue({
+      code: "custom",
+      path: ["content"],
+      message: `Content exceeds the ${MAX_EDIT_FILE_BYTES}-byte per-file limit.`
+    });
+  }
+});
+var editChangesSchema = z.array(editChangeSchema).min(1).max(MAX_EDIT_CHANGES).superRefine((changes, context) => {
+  const paths = new Set;
+  let totalBytes = 0;
+  for (let index = 0;index < changes.length; index += 1) {
+    const change = changes[index];
+    if (!change) {
+      continue;
+    }
+    if (paths.has(change.path)) {
+      context.addIssue({
+        code: "custom",
+        path: [index, "path"],
+        message: `Duplicate target path: ${change.path}.`
+      });
+    }
+    paths.add(change.path);
+    totalBytes += Buffer.byteLength(change.content, "utf8");
+  }
+  if (totalBytes > MAX_EDIT_PROPOSAL_BYTES) {
+    context.addIssue({
+      code: "custom",
+      message: `Proposal exceeds the ${MAX_EDIT_PROPOSAL_BYTES}-byte aggregate limit.`
+    });
+  }
+});
+var editProposalInputSchema = z.strictObject({
+  changes: editChangesSchema
+});
+var editProposalChangeSchema = z.strictObject({
+  path: workspaceFilePathSchema,
+  expectedDigest: expectedEditDigestSchema,
+  contentDigest: fileDigestSchema,
+  bytes: z.number().int().min(0).max(MAX_EDIT_FILE_BYTES)
+});
+var editProposalSchema = z.strictObject({
+  schemaVersion: z.literal(EDIT_CONTRACT_SCHEMA_VERSION),
+  kind: z.literal("edit-proposal"),
+  proposalId: fileDigestSchema,
+  digestAlgorithm: z.literal(EDIT_DIGEST_ALGORITHM),
+  changes: z.array(editProposalChangeSchema).min(1).max(MAX_EDIT_CHANGES)
+});
+var applyEditProposalInputSchema = z.strictObject({
+  proposalId: fileDigestSchema,
+  changes: editChangesSchema
+}).superRefine((input, context) => {
+  if (!editProposalInputSchema.safeParse({ changes: input.changes }).success)
+    return;
+  if (createEditProposal({ changes: input.changes }).proposalId !== input.proposalId) {
+    context.addIssue({
+      code: "custom",
+      path: ["proposalId"],
+      message: "proposalId does not match the supplied paths, preconditions, and content. Read proposalId from the matching propose_edits result; do not invent it."
+    });
+  }
+});
+var moveFileInputSchema = z.strictObject({
+  source: workspaceFilePathSchema,
+  destination: workspaceFilePathSchema,
+  expectedDigest: fileDigestSchema
+}).refine((input) => input.source !== input.destination, {
+  path: ["destination"],
+  message: "Move destination must differ from source."
+});
+var quarantineFileInputSchema = z.strictObject({
+  path: workspaceFilePathSchema,
+  expectedDigest: fileDigestSchema
+});
+var restoreFileInputSchema = z.strictObject({
+  quarantineId: z.string().min(1).max(200).regex(/^[A-Za-z0-9._:-]+$/),
+  destination: workspaceFilePathSchema.optional(),
+  expectedDigest: fileDigestSchema.optional()
+});
+var mutationOperationSchema = z.enum(["create", "update", "move", "quarantine", "restore"]);
+var mutationAuditEntrySchema = z.strictObject({
+  id: z.string().min(1).max(200),
+  operation: mutationOperationSchema,
+  path: workspaceFilePathSchema,
+  destination: workspaceFilePathSchema.optional(),
+  beforeDigest: fileDigestSchema.optional(),
+  afterDigest: fileDigestSchema.optional(),
+  timestamp: z.iso.datetime(),
+  quarantineId: z.string().min(1).max(200).optional()
+});
+var digest = (value) => `sha256:${createHash("sha256").update(value).digest("hex")}`;
+var canonicalProposalPayload = (changes) => ({
+  schemaVersion: EDIT_CONTRACT_SCHEMA_VERSION,
+  kind: "edit-proposal",
+  digestAlgorithm: EDIT_DIGEST_ALGORITHM,
+  changes: [...changes].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0).map((change) => ({
+    path: change.path,
+    expectedDigest: change.expectedDigest,
+    contentDigest: digest(change.content),
+    bytes: Buffer.byteLength(change.content, "utf8")
+  }))
+});
+var createEditProposal = (input) => {
+  const parsed = editProposalInputSchema.parse(input);
+  const payload = canonicalProposalPayload(parsed.changes);
+  return editProposalSchema.parse({
+    ...payload,
+    proposalId: digest(JSON.stringify(payload))
+  });
+};
+var validateEditProposal = (input) => {
+  const parsed = applyEditProposalInputSchema.parse(input);
+  const proposal = createEditProposal({ changes: parsed.changes });
+  if (proposal.proposalId !== parsed.proposalId) {
+    throw new Error("proposalId does not match the supplied paths, preconditions, and content.");
+  }
+  return parsed;
+};
+var editContractDocument = (kind, result) => ({
+  schemaVersion: EDIT_CONTRACT_SCHEMA_VERSION,
+  kind,
+  result
+});
+
+// src/persistence/persistence-secrets.ts
+var protectedValues = new Set;
+function protectPersistenceSecret(secret) {
+  if (!secret)
+    return;
+  protectedValues.add(secret);
+  protectedValues.add(JSON.stringify(secret).slice(1, -1));
+}
+function assertNoPersistenceSecret(value) {
+  if (!protectedValues.size)
+    return;
+  const seen = new WeakSet;
+  const visit = (item) => {
+    if (typeof item === "string") {
+      for (const secret of protectedValues)
+        if (item.includes(secret))
+          throw new Error("PERSISTENCE_SECRET_REJECTED");
+    } else if (item instanceof Uint8Array) {
+      const bytes = Buffer.from(item.buffer, item.byteOffset, item.byteLength);
+      for (const secret of protectedValues)
+        if (bytes.includes(Buffer.from(secret)))
+          throw new Error("PERSISTENCE_SECRET_REJECTED");
+    } else if (item && typeof item === "object" && !seen.has(item)) {
+      seen.add(item);
+      for (const [key, entry] of Object.entries(item)) {
+        visit(key);
+        visit(entry);
+      }
+    }
+  };
+  visit(value);
+}
+
+// src/persistence/sqlite-access.ts
+import { closeSync, constants, fchmodSync, fstatSync, lstatSync, openSync, realpathSync } from "node:fs";
+import path2 from "node:path";
+var O_SHLOCK = 16;
+var O_EXLOCK = 32;
+var held = new WeakMap;
+var activeDescriptors = new Set;
+function filename(databasePath) {
+  const directory = realpathSync(path2.dirname(path2.resolve(databasePath)));
+  return path2.join(directory, `.${path2.basename(databasePath)}.access-lock`);
+}
+function releaseDescriptor(state) {
+  closeSync(state.fd);
+  activeDescriptors.delete(state.fd);
+}
+function makeLease(lock, fd, exclusive) {
+  const state = { filename: lock, fd, closed: false, borrowers: 0, exclusive };
+  const lease = Object.freeze({ fd, close() {
+    if (!state.closed) {
+      state.closed = true;
+      if (state.borrowers === 0)
+        releaseDescriptor(state);
+    }
+  } });
+  held.set(lease, state);
+  activeDescriptors.add(fd);
+  return lease;
+}
+function acquireSqliteAccess(databasePath, exclusive = false) {
+  if (databasePath === ":memory:" || process.platform !== "darwin")
+    return;
+  let fd;
+  try {
+    const lock = filename(databasePath);
+    fd = openSync(lock, constants.O_RDWR | constants.O_CREAT | constants.O_NOFOLLOW | constants.O_NONBLOCK | (exclusive ? O_EXLOCK : O_SHLOCK), 384);
+    const info = fstatSync(fd);
+    const current = lstatSync(lock);
+    if (!info.isFile() || info.nlink !== 1 || info.uid !== process.getuid?.() || info.size !== 0 || current.isSymbolicLink() || current.dev !== info.dev || current.ino !== info.ino)
+      throw new Error;
+    if (info.mode & 63)
+      fchmodSync(fd, 384);
+    if (fstatSync(fd).mode & 63)
+      throw new Error;
+    return makeLease(lock, fd, exclusive);
+  } catch {
+    if (fd !== undefined)
+      closeSync(fd);
+    throw new Error("SQLITE_ACCESS_UNAVAILABLE");
+  }
+}
+function retainSqliteAccess(lease, databasePath) {
+  validateSqliteAccess(lease, databasePath);
+  const state = held.get(lease);
+  state.borrowers++;
+  let released = false;
+  return () => {
+    if (!released) {
+      released = true;
+      state.borrowers--;
+      if (state.closed && state.borrowers === 0)
+        releaseDescriptor(state);
+    }
+  };
+}
+function exclusiveSqliteAccessDescriptor(lease, databasePath) {
+  validateSqliteAccess(lease, databasePath);
+  const state = held.get(lease);
+  if (!state.exclusive || state.borrowers !== 0)
+    throw new Error("SQLITE_ACCESS_UNAVAILABLE");
+  return state.fd;
+}
+function adoptExclusiveSqliteAccess(databasePath, fd) {
+  try {
+    if (process.platform !== "darwin" || !Number.isInteger(fd) || fd < 4 || fd > 603 || activeDescriptors.has(fd))
+      throw new Error;
+    const lock = filename(databasePath), current = lstatSync(lock), owned = fstatSync(fd);
+    if (!owned.isFile() || owned.nlink !== 1 || owned.uid !== process.getuid?.() || owned.mode & 63 || owned.size !== 0 || current.isSymbolicLink() || current.dev !== owned.dev || current.ino !== owned.ino)
+      throw new Error;
+    return makeLease(lock, fd, true);
+  } catch {
+    throw new Error("SQLITE_ACCESS_UNAVAILABLE");
+  }
+}
+function validateSqliteAccess(lease, databasePath) {
+  try {
+    const state = held.get(lease);
+    if (!state || state.closed || state.filename !== filename(databasePath))
+      throw new Error;
+    const current = lstatSync(state.filename), owned = fstatSync(state.fd);
+    if (current.isSymbolicLink() || !current.isFile() || current.nlink !== 1 || current.dev !== owned.dev || current.ino !== owned.ino)
+      throw new Error;
+  } catch {
+    throw new Error("SQLITE_ACCESS_UNAVAILABLE");
+  }
+}
+
+// src/persistence/sqlite-database.ts
+import { createRequire } from "node:module";
+var require2 = createRequire(process.execPath);
+var DatabaseSyncConstructor;
+var loadDatabaseSync = () => {
+  DatabaseSyncConstructor ??= require2("node:sqlite").DatabaseSync;
+  return DatabaseSyncConstructor;
+};
+var normalizeNumberedParameters = (sql) => {
+  const indexes = new Set;
+  const normalizedSql = sql.replace(/\?([1-9]\d*)/g, (_match, rawIndex) => {
+    const index = Number(rawIndex);
+    indexes.add(index);
+    return `$__zhivex_${index}`;
+  });
+  return {
+    sql: normalizedSql,
+    indexes: [...indexes].sort((left, right) => left - right)
+  };
+};
+var numberedBindings = (indexes, parameters) => {
+  if (indexes.length === 0)
+    return;
+  const maximumIndex = indexes.at(-1);
+  if (parameters.length !== maximumIndex) {
+    throw new Error(`SQLite numbered parameters require exactly ${maximumIndex} binding${maximumIndex === 1 ? "" : "s"}; received ${parameters.length}.`);
+  }
+  return Object.fromEntries(indexes.map((index) => [`$__zhivex_${index}`, parameters[index - 1]]));
+};
+
+class SqliteDatabase {
+  #database;
+  #access;
+  #ownedAccess;
+  #releaseBorrowed;
+  #databasePath;
+  constructor(databasePath, options = {}) {
+    options.create;
+    options.strict;
+    if (options.accessLease)
+      validateSqliteAccess(options.accessLease, databasePath);
+    this.#access = options.accessLease ?? acquireSqliteAccess(databasePath);
+    this.#ownedAccess = options.accessLease === undefined;
+    this.#databasePath = databasePath;
+    this.#releaseBorrowed = options.accessLease ? retainSqliteAccess(options.accessLease, databasePath) : undefined;
+    try {
+      const DatabaseSync = loadDatabaseSync();
+      this.#database = new DatabaseSync(databasePath, {
+        ...options.readonly === undefined ? {} : { readOnly: options.readonly }
+      });
+    } catch (error) {
+      if (this.#ownedAccess)
+        this.#access?.close();
+      this.#releaseBorrowed?.();
+      throw error;
+    }
+  }
+  exec(sql) {
+    if (this.#access)
+      validateSqliteAccess(this.#access, this.#databasePath);
+    assertNoPersistenceSecret(sql);
+    this.#database.exec(sql);
+  }
+  query(sql) {
+    assertNoPersistenceSecret(sql);
+    if (this.#access)
+      validateSqliteAccess(this.#access, this.#databasePath);
+    const normalized = normalizeNumberedParameters(sql);
+    const statement = this.#database.prepare(normalized.sql);
+    const invoke = (method, parameters) => {
+      if (this.#access)
+        validateSqliteAccess(this.#access, this.#databasePath);
+      assertNoPersistenceSecret(sql);
+      assertNoPersistenceSecret(parameters);
+      const bindings = numberedBindings(normalized.indexes, parameters);
+      return bindings ? method(bindings) : method(...parameters);
+    };
+    return {
+      run: (...parameters) => invoke(statement.run.bind(statement), parameters),
+      get: (...parameters) => invoke(statement.get.bind(statement), parameters),
+      all: (...parameters) => invoke(statement.all.bind(statement), parameters)
+    };
+  }
+  close(throwOnError = true) {
+    try {
+      this.#database.close();
+      if (this.#ownedAccess)
+        this.#access?.close();
+      this.#releaseBorrowed?.();
+    } catch (error) {
+      if (throwOnError) {
+        throw error;
+      }
+    }
+  }
+}
+
+// src/workspace/file-security.ts
+import { constants as fsConstants } from "node:fs";
+import { open } from "node:fs/promises";
+import path3 from "node:path";
+var sameOpenFile = (before, after) => before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs && before.mode === after.mode && before.nlink === after.nlink;
+
+class UnsafeFileTypeError extends Error {
+  constructor(label) {
+    super(`${label} must be a regular file and must not be a symbolic link.`);
+    this.name = "UnsafeFileTypeError";
+  }
+}
+
+class FileSizeLimitError extends Error {
+  label;
+  maxBytes;
+  constructor(label, maxBytes) {
+    super(`${label} exceeds the ${maxBytes}-byte limit.`);
+    this.label = label;
+    this.maxBytes = maxBytes;
+    this.name = "FileSizeLimitError";
+  }
+}
+
+class FileChangedWhileReadingError extends Error {
+  constructor(label) {
+    super(`${label} changed while it was being read.`);
+    this.name = "FileChangedWhileReadingError";
+  }
+}
+var invalidFileError = (label) => new UnsafeFileTypeError(label);
+var openRegularFileNoFollow = async (target, label) => {
+  try {
+    const flags = fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK;
+    let absolute = path3.resolve(target);
+    if (process.platform === "darwin") {
+      absolute = absolute.replace(/^\/(tmp|var|etc)(\/|$)/, "/private/$1$2");
+      return await open(absolute, fsConstants.O_RDONLY | fsConstants.O_NONBLOCK | 536870912, 384);
+    }
+    if (process.platform !== "linux")
+      throw new Error("Safe descriptor-relative reads require Linux or macOS.");
+    const segments = absolute.split("/").filter(Boolean);
+    const leaf = segments.pop();
+    if (!leaf)
+      throw invalidFileError(label);
+    let directory = await open("/", fsConstants.O_RDONLY | fsConstants.O_DIRECTORY);
+    try {
+      for (const segment of segments) {
+        const next = await open(`/proc/self/fd/${directory.fd}/${segment}`, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW);
+        await directory.close();
+        directory = next;
+      }
+      return await open(`/proc/self/fd/${directory.fd}/${leaf}`, flags);
+    } finally {
+      await directory.close();
+    }
+  } catch (error) {
+    const code = error.code;
+    if (code === "ELOOP" || code === "EMLINK" || code === "ENOTDIR")
+      throw invalidFileError(label);
+    throw error;
+  }
+};
+var statRegularFileNoFollow = async (target, options) => {
+  const handle = await openRegularFileNoFollow(target, options.label);
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || options.requireSingleLink && stat.nlink !== 1) {
+      throw invalidFileError(options.label);
+    }
+    return stat;
+  } finally {
+    await handle.close();
+  }
+};
+var readRegularFileNoFollow = async (target, options) => {
+  const handle = await openRegularFileNoFollow(target, options.label);
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || options.requireSingleLink && before.nlink !== 1) {
+      throw invalidFileError(options.label);
+    }
+    if (!Number.isSafeInteger(before.size) || before.size < 0) {
+      throw new Error(`${options.label} has an unsupported size.`);
+    }
+    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 0) {
+      throw new Error(`${options.label} has an invalid byte limit.`);
+    }
+    if (before.size > options.maxBytes) {
+      throw new FileSizeLimitError(options.label, options.maxBytes);
+    }
+    const contents = Buffer.alloc(before.size);
+    let offset = 0;
+    while (offset < contents.byteLength) {
+      const { bytesRead } = await handle.read(contents, offset, contents.byteLength - offset, offset);
+      if (bytesRead === 0)
+        break;
+      offset += bytesRead;
+    }
+    const probe = Buffer.allocUnsafe(1);
+    const { bytesRead: extraBytes } = await handle.read(probe, 0, 1, before.size);
+    const after = await handle.stat();
+    if (offset !== before.size || extraBytes !== 0 || !sameOpenFile(before, after) || options.requireSingleLink && after.nlink !== 1) {
+      throw new FileChangedWhileReadingError(options.label);
+    }
+    return { contents, stat: after };
+  } finally {
+    await handle.close();
+  }
+};
+async function* readRegularFileChunksNoFollow(target, options) {
+  const handle = await openRegularFileNoFollow(target, options.label);
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || options.requireSingleLink && before.nlink !== 1)
+      throw invalidFileError(options.label);
+    if (options.requirePrivate && (before.mode & 63) !== 0)
+      throw new Error(`${options.label} permissions must not grant group or other access.`);
+    let offset = 0;
+    while (offset < before.size) {
+      const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, before.size - offset));
+      const { bytesRead: bytesRead2 } = await handle.read(buffer, 0, buffer.length, offset);
+      if (!bytesRead2)
+        throw new FileChangedWhileReadingError(options.label);
+      offset += bytesRead2;
+      yield buffer.subarray(0, bytesRead2);
+    }
+    const probe = Buffer.allocUnsafe(1);
+    const { bytesRead } = await handle.read(probe, 0, 1, offset);
+    if (bytesRead || !sameOpenFile(before, await handle.stat()))
+      throw new FileChangedWhileReadingError(options.label);
+  } finally {
+    await handle.close();
+  }
+}
+
+// src/execution/package-manager.ts
+import { lstat } from "node:fs/promises";
+import path4 from "node:path";
+var HARNESS_PACKAGE_MANAGERS = ["npm", "pnpm", "yarn", "bun"];
+var LOCKFILES = {
+  npm: ["package-lock.json", "npm-shrinkwrap.json"],
+  pnpm: ["pnpm-lock.yaml"],
+  yarn: ["yarn.lock"],
+  bun: ["bun.lock", "bun.lockb"]
+};
+var isPackageManager = (value) => HARNESS_PACKAGE_MANAGERS.includes(value);
+var parsePackageManager = (value) => {
+  if (value === undefined)
+    return;
+  if (typeof value !== "string") {
+    throw new Error("package.json packageManager must be a string when present.");
+  }
+  const match = /^(npm|pnpm|yarn|bun)@([^\s]+)$/.exec(value.trim());
+  if (!match?.[1] || !match[2]) {
+    throw new Error("package.json packageManager must pin npm, pnpm, yarn, or bun using <manager>@<version>.");
+  }
+  if (!isPackageManager(match[1])) {
+    throw new Error(`Unsupported package manager: ${match[1]}.`);
+  }
+  return match[1];
+};
+var existingLockfiles = async (root) => {
+  const matches = [];
+  for (const manager of HARNESS_PACKAGE_MANAGERS) {
+    for (const file of LOCKFILES[manager]) {
+      try {
+        const entry = await lstat(path4.join(root, file));
+        if (entry.isSymbolicLink()) {
+          throw new Error(`Package-manager lockfile must not be a symbolic link: ${file}.`);
+        }
+        if (entry.isFile())
+          matches.push({ manager, file });
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+      }
+    }
+  }
+  return matches;
+};
+var resolvePackageManager = async (root, manifest) => {
+  const declared = parsePackageManager(manifest.packageManager);
+  if (declared) {
+    return {
+      manager: declared,
+      source: "packageManager",
+      evidence: manifest.packageManager
+    };
+  }
+  const lockfiles = await existingLockfiles(root);
+  const managers = [...new Set(lockfiles.map((entry) => entry.manager))];
+  if (managers.length > 1) {
+    throw new Error(`Ambiguous package manager: found lockfiles for ${managers.join(", ")}; declare packageManager explicitly.`);
+  }
+  const detected = managers[0];
+  if (detected) {
+    return {
+      manager: detected,
+      source: "lockfile",
+      evidence: lockfiles.filter((entry) => entry.manager === detected).map((entry) => entry.file).join(",")
+    };
+  }
+  return { manager: "npm", source: "default" };
+};
+var runCommand = (manager, check) => {
+  switch (manager) {
+    case "bun":
+      return ["bun", "--no-env-file", "run", check];
+    case "npm":
+      return ["npm", "--ignore-scripts", "run", check];
+    case "pnpm":
+      return ["pnpm", "--ignore-scripts", "run", check];
+    case "yarn":
+      return ["yarn", "run", check];
+  }
+};
+var resolvePackageCheckCommand = async (root, manifest, check, expectedScript, allowedChecks) => {
+  if (!/^[A-Za-z0-9:_-]+$/.test(check) || !allowedChecks.includes(check)) {
+    throw new Error(`The check "${check}" is not in the explicit allowlist.`);
+  }
+  const scripts = manifest.scripts && typeof manifest.scripts === "object" ? manifest.scripts : {};
+  const actual = scripts[check];
+  if (typeof actual !== "string") {
+    throw new Error(`package.json does not define the "${check}" script.`);
+  }
+  if (actual !== expectedScript) {
+    throw new Error(`The "${check}" script changed or does not match expectedScript.`);
+  }
+  for (const lifecycleName of [`pre${check}`, `post${check}`]) {
+    if (typeof scripts[lifecycleName] === "string") {
+      throw new Error(`The approved "${check}" check has an implicit ${lifecycleName} lifecycle script; approve a standalone script instead.`);
+    }
+  }
+  const resolution = await resolvePackageManager(root, manifest);
+  return { ...resolution, command: runCommand(resolution.manager, check) };
+};
+
+// src/execution/process-runtime.ts
+import { spawn } from "node:child_process";
+var DEFAULT_MAX_OUTPUT_CHARACTERS = 20000;
+var DEFAULT_TERMINATION_GRACE_MS = 1000;
+var PORTABLE_ENVIRONMENT_KEYS = [
+  "CI",
+  "FORCE_COLOR",
+  "LANG",
+  "LC_ALL",
+  "NO_COLOR",
+  "PATH",
+  "TEMP",
+  "TERM",
+  "TMP",
+  "TMPDIR"
+];
+
+class BoundedTextCapture {
+  decoder = new TextDecoder;
+  maxCharacters;
+  output = "";
+  totalCharacters = 0;
+  constructor(maxCharacters) {
+    this.maxCharacters = maxCharacters;
+  }
+  write(chunk) {
+    this.append(this.decoder.decode(chunk, { stream: true }));
+  }
+  finish() {
+    this.append(this.decoder.decode());
+    return this.totalCharacters <= this.maxCharacters ? this.output : `${this.output}
+… output truncated (${this.totalCharacters - this.maxCharacters} characters omitted)`;
+  }
+  append(value) {
+    this.totalCharacters += value.length;
+    if (this.output.length < this.maxCharacters) {
+      this.output += value.slice(0, this.maxCharacters - this.output.length);
+    }
+  }
+}
+var processEnvironment = (additional) => {
+  const env = {};
+  for (const key of PORTABLE_ENVIRONMENT_KEYS) {
+    const value = process.env[key];
+    if (value !== undefined)
+      env[key] = value;
+  }
+  for (const [key, value] of Object.entries(additional ?? {})) {
+    if (value === undefined)
+      delete env[key];
+    else
+      env[key] = value;
+  }
+  return env;
+};
+var exitCodeForSignal = (signal) => {
+  if (signal === "SIGKILL")
+    return 137;
+  if (signal === "SIGTERM")
+    return 143;
+  return 1;
+};
+var abortReason = (signal) => signal.reason instanceof Error ? signal.reason : new DOMException("The operation was aborted.", "AbortError");
+var runPortableProcess = async (command, options = {}) => {
+  if (command.length === 0 || !command[0])
+    throw new Error("The process command must not be empty.");
+  if (options.signal?.aborted)
+    throw abortReason(options.signal);
+  const maxOutputCharacters = options.maxOutputCharacters ?? DEFAULT_MAX_OUTPUT_CHARACTERS;
+  if (!Number.isSafeInteger(maxOutputCharacters) || maxOutputCharacters < 0) {
+    throw new Error("maxOutputCharacters must be a non-negative safe integer.");
+  }
+  if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0)) {
+    throw new Error("timeoutMs must be a positive safe integer.");
+  }
+  const argv = [...command];
+  const stdout = new BoundedTextCapture(maxOutputCharacters);
+  const stderr = new BoundedTextCapture(maxOutputCharacters);
+  const useProcessGroup = process.platform !== "win32";
+  const child = spawn(argv[0], argv.slice(1), {
+    ...options.cwd ? { cwd: options.cwd } : {},
+    env: processEnvironment(options.env),
+    detached: useProcessGroup,
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true
+  });
+  let timedOut = false;
+  let aborted = false;
+  let terminationTimer;
+  child.stdout.on("data", (chunk) => stdout.write(chunk));
+  child.stderr?.on("data", (chunk) => stderr.write(chunk));
+  const signalProcessTree = (signal) => {
+    if (useProcessGroup && child.pid !== undefined) {
+      try {
+        process.kill(-child.pid, signal);
+        return;
+      } catch (error) {
+        if (error.code !== "ESRCH") {
+          child.kill(signal);
+          return;
+        }
+      }
+    }
+    if (child.exitCode === null && child.signalCode === null)
+      child.kill(signal);
+  };
+  const terminate = () => {
+    if (terminationTimer)
+      return;
+    signalProcessTree("SIGTERM");
+    terminationTimer = setTimeout(() => {
+      signalProcessTree("SIGKILL");
+    }, DEFAULT_TERMINATION_GRACE_MS);
+    terminationTimer.unref?.();
+  };
+  const handleAbort = () => {
+    aborted = true;
+    terminate();
+  };
+  options.signal?.addEventListener("abort", handleAbort, { once: true });
+  const timeout = options.timeoutMs === undefined ? undefined : setTimeout(() => {
+    timedOut = true;
+    terminate();
+  }, options.timeoutMs);
+  timeout?.unref?.();
+  try {
+    return await new Promise((resolve, reject) => {
+      let processError;
+      child.once("error", (error) => {
+        processError = error;
+      });
+      child.once("close", (exitCode, signal) => {
+        if (processError) {
+          reject(processError);
+          return;
+        }
+        if (aborted && options.signal) {
+          reject(abortReason(options.signal));
+          return;
+        }
+        resolve({
+          command: argv,
+          exitCode: exitCode ?? exitCodeForSignal(signal),
+          stdout: stdout.finish(),
+          stderr: options.stderr === "ignore" ? "" : stderr.finish(),
+          timedOut
+        });
+      });
+    });
+  } finally {
+    if (timeout)
+      clearTimeout(timeout);
+    if (terminationTimer)
+      clearTimeout(terminationTimer);
+    options.signal?.removeEventListener("abort", handleAbort);
+  }
+};
+
+// src/runtime/task-acceptance-checks.ts
+import { createHash as createHash2 } from "node:crypto";
+import { z as z2 } from "zod";
+var sha = z2.string().regex(/^sha256:[a-f0-9]{64}$/);
+var taskCheckReceiptSchema = z2.strictObject({
+  schemaVersion: z2.literal(1),
+  checkId: z2.string().max(128),
+  contractDigest: sha,
+  contractRevision: z2.number().int().positive(),
+  runId: z2.string().max(512),
+  executionIdentity: z2.string().max(512),
+  patchId: sha,
+  snapshotDigest: sha,
+  argvDigest: sha,
+  exitCode: z2.number().int(),
+  timedOut: z2.boolean(),
+  unchanged: z2.boolean(),
+  source: z2.strictObject({ id: z2.string().min(1).max(512), name: z2.string().min(1).max(128), startedAt: z2.number().finite().nonnegative().optional() }).optional()
+});
+var argvDigest = (command, args) => "sha256:" + createHash2("sha256").update(JSON.stringify([command, ...args])).digest("hex");
+function createTaskAcceptanceChecks(ledger, previous = [], journal = []) {
+  const current = ledger.revisions.at(-1);
+  const receipts = new Map;
+  const parsed = z2.array(taskCheckReceiptSchema).max(32).safeParse(previous);
+  if (parsed.success)
+    for (const receipt of parsed.data) {
+      const check = current.contract.requiredChecks.find((c) => c.id === receipt.checkId);
+      if (check && receipt.contractDigest === current.digest && receipt.contractRevision === current.revision && receipt.argvDigest === argvDigest(check.command, check.args) && reconciledReceipt(receipt, journal))
+        receipts.set(check.id, receipt);
+    }
+  return {
+    matching(command, args) {
+      return current.contract.requiredChecks.filter((check) => argvDigest(check.command, check.args) === argvDigest(command, args));
+    },
+    begin(checkIds) {
+      for (const id of checkIds)
+        receipts.delete(id);
+    },
+    record(checkId, before, after, result, source) {
+      const check = current.contract.requiredChecks.find((c) => c.id === checkId);
+      if (!check)
+        throw new Error("TASK_ACCEPTANCE_UNKNOWN_CHECK");
+      const receipt = taskCheckReceiptSchema.parse({
+        schemaVersion: 1,
+        checkId,
+        contractDigest: current.digest,
+        contractRevision: current.revision,
+        ...before,
+        ...source ? { source: { id: source.id, name: source.name, ...source.startedAt !== undefined ? { startedAt: source.startedAt } : {} } } : {},
+        argvDigest: argvDigest(check.command, check.args),
+        exitCode: result.exitCode,
+        timedOut: result.timedOut,
+        unchanged: before.runId === after.runId && before.executionIdentity === after.executionIdentity && before.patchId === after.patchId && before.snapshotDigest === after.snapshotDigest
+      });
+      receipts.set(checkId, receipt);
+      return structuredClone(receipt);
+    },
+    missing(binding) {
+      return current.contract.requiredChecks.filter((check) => {
+        const receipt = receipts.get(check.id);
+        return !receipt || receipt.exitCode !== 0 || receipt.timedOut || !receipt.unchanged || receipt.runId !== binding.runId || receipt.executionIdentity !== binding.executionIdentity || receipt.patchId !== binding.patchId || receipt.snapshotDigest !== binding.snapshotDigest;
+      }).map((check) => check.id);
+    },
+    snapshot() {
+      return [...receipts.values()].map((receipt) => structuredClone(receipt));
+    }
+  };
+}
+var object = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+var commandDigest = (value) => {
+  const input = object(value);
+  return typeof input?.command === "string" && Array.isArray(input.args) && input.args.every((arg) => typeof arg === "string") ? argvDigest(input.command, input.args) : undefined;
+};
+function reconciledReceipt(receipt, journal) {
+  if (!receipt.source)
+    return false;
+  const matches = journal.filter((row2) => row2.runId === receipt.runId && row2.providerToolCallId === receipt.source.id && row2.toolName === receipt.source.name);
+  if (matches.length !== 1)
+    return false;
+  const row = matches[0];
+  const startedAt = receipt.source.startedAt ?? row.startedAt;
+  if (row.status !== "completed" || !Number.isFinite(startedAt) || !Number.isFinite(row.completedAt) || row.completedAt < startedAt)
+    return false;
+  if (!["run_environment_command", "run_check", "verify_and_apply_environment_patch", "verify_and_apply_reviewed_edits"].includes(row.toolName))
+    return false;
+  const output = object(row.output), result = object(output?.verification) ?? output;
+  if (!result || result.exitCode !== receipt.exitCode || result.timedOut !== receipt.timedOut || !Array.isArray(result.command) || !result.command.every((arg) => typeof arg === "string") || typeof result.command[0] !== "string" || argvDigest(result.command[0], result.command.slice(1)) !== receipt.argvDigest)
+    return false;
+  if (row.toolName !== "run_check" && commandDigest(row.input) !== receipt.argvDigest)
+    return false;
+  for (const attempt of journal) {
+    if (attempt === row || attempt.runId !== receipt.runId)
+      continue;
+    if (attempt.status === "pending" || attempt.status === "running")
+      return false;
+    const input = object(attempt.input);
+    const sameCheck = commandDigest(input) === receipt.argvDigest || attempt.toolName === "run_check" && row.toolName === "run_check" && input?.check === object(row.input)?.check || attempt.toolName === "run_environment_batch" && Array.isArray(input?.commands) && input.commands.some((command) => commandDigest(command) === receipt.argvDigest);
+    if (sameCheck && (!Number.isFinite(attempt.completedAt) || attempt.completedAt >= startedAt))
+      return false;
+  }
+  return true;
+}
+
+// src/runtime/task-acceptance-delivery.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+import { z as z3 } from "zod";
+var scopes = new AsyncLocalStorage;
+function withTaskAcceptanceDelivery(workspace, ledger, work, previousEvidence, journal = []) {
+  const latest = ledger.revisions.at(-1);
+  const previous = z3.object({ contractDigest: z3.literal(latest.digest), contractRevision: z3.literal(latest.revision), diagnostic: z3.strictObject({
+    code: z3.literal("TASK_ACCEPTANCE_SCOPE_VIOLATION"),
+    runId: z3.string().max(512),
+    patchId: z3.string().regex(/^sha256:[a-f0-9]{64}$/),
+    paths: z3.array(z3.string().max(1024)).max(256)
+  }) }).safeParse(previousEvidence);
+  const previousDelivery = z3.object({ contractDigest: z3.literal(latest.digest), contractRevision: z3.literal(latest.revision), delivery: z3.strictObject({
+    runId: z3.string().min(1).max(512),
+    executionIdentity: z3.string().min(1).max(512),
+    patchId: z3.string().regex(/^sha256:[a-f0-9]{64}$/),
+    snapshotDigest: z3.string().regex(/^sha256:[a-f0-9]{64}$/)
+  }) }).safeParse(previousEvidence);
+  return scopes.run({
+    ...previousDelivery.success ? { previousDelivery: previousDelivery.data.delivery } : {},
+    workspace,
+    revision: latest.revision,
+    digest: latest.digest,
+    checks: createTaskAcceptanceChecks(ledger, previousEvidence && typeof previousEvidence === "object" && "checks" in previousEvidence ? previousEvidence.checks : [], journal),
+    allowed: new Set(latest.contract.allowedWritePaths),
+    protected: new Set(latest.contract.protectedFiles.map((file) => file.toLowerCase())),
+    ...previous.success ? { violation: previous.data.diagnostic } : {}
+  }, work);
+}
+function assertTaskAcceptanceImport(input) {
+  const scope = scopes.getStore();
+  if (!scope)
+    return;
+  const blocked = input.entries.filter((entry) => {
+    const candidate = entry.path.toLowerCase();
+    return input.workspace !== scope.workspace || !scope.allowed.has(entry.path) || [...scope.protected].some((file) => candidate === file || candidate.startsWith(file + "/") || file.startsWith(candidate + "/"));
+  });
+  if (blocked.length) {
+    scope.violation = { code: "TASK_ACCEPTANCE_SCOPE_VIOLATION", runId: input.runId, patchId: input.patchId, paths: blocked.map((entry) => entry.path).slice(0, 256) };
+    throw new Error("TASK_ACCEPTANCE_SCOPE_VIOLATION: the OCI patch touches files outside the task contract; no host import was performed.");
+  }
+  if (!input.executionIdentity || !input.snapshotDigest || scope.checks.missing({ runId: input.runId, patchId: input.patchId, executionIdentity: input.executionIdentity, snapshotDigest: input.snapshotDigest }).length) {
+    throw new Error("TASK_ACCEPTANCE_CHECKS_MISSING: every required check must succeed on the exact final snapshot and patch before import.");
+  }
+}
+var taskAcceptanceChecks = () => scopes.getStore()?.checks;
+function taskAcceptanceDeliveryDiagnostic(digest2, revision) {
+  const scope = scopes.getStore();
+  return scope?.digest === digest2 && scope.revision === revision && scope.violation ? structuredClone(scope.violation) : undefined;
+}
+function confirmTaskAcceptanceImport(binding, validate) {
+  const scope = scopes.getStore();
+  if (scope)
+    scope.imported = { binding: structuredClone(binding), validate };
+}
+async function evaluateTaskAcceptanceOutcome(state, ledger) {
+  const current = ledger.revisions.at(-1), scope = scopes.getStore();
+  const terminal = ["completed", "failed", "cancelled", "timed_out"].includes(state.status);
+  if (!scope || scope.digest !== current.digest || scope.revision !== current.revision) {
+    return { status: terminal ? "incomplete" : "pending", reason: "TASK_ACCEPTANCE_NO_DELIVERY_EVIDENCE" };
+  }
+  if (scope.violation)
+    return { status: "failed", reason: scope.violation.code };
+  if (state.status !== "completed")
+    return { status: state.status === "failed" ? "failed" : terminal ? "incomplete" : "pending", reason: "TASK_ACCEPTANCE_RUN_NOT_COMPLETED" };
+  if (state.finishReason !== "stop")
+    return { status: "incomplete", reason: "TASK_ACCEPTANCE_RUN_NOT_FINISHED" };
+  const imported = scope.imported;
+  if (!imported || imported.binding.runId !== state.runId)
+    return { status: "incomplete", reason: "TASK_ACCEPTANCE_IMPORT_UNCONFIRMED" };
+  const delivery = { ...imported.binding };
+  if (scope.checks.missing(delivery).length)
+    return { status: "incomplete", reason: "TASK_ACCEPTANCE_CHECKS_MISSING", delivery };
+  try {
+    if (!await imported.validate())
+      return { status: "incomplete", reason: "TASK_ACCEPTANCE_DELIVERY_DRIFT", delivery };
+  } catch {
+    return { status: "incomplete", reason: "TASK_ACCEPTANCE_DELIVERY_INSPECTION_FAILED", delivery };
+  }
+  return { status: current.contract.humanReview.length ? "pending_review" : "verified", reason: current.contract.humanReview.length ? "TASK_ACCEPTANCE_HUMAN_REVIEW_REQUIRED" : "TASK_ACCEPTANCE_VERIFIED", delivery };
+}
+async function taskAcceptanceOutcome(state, ledger) {
+  const outcome = await evaluateTaskAcceptanceOutcome(state, ledger);
+  const scope = scopes.getStore(), latest = ledger.revisions.at(-1);
+  const delivery = scope?.digest === latest.digest && scope.revision === latest.revision ? scope.imported?.binding ?? scope.previousDelivery : undefined;
+  return { ...outcome, ...delivery && delivery.runId === state.runId ? { delivery: structuredClone(delivery) } : {} };
+}
+
+export { EDIT_CONTRACT_SCHEMA_VERSION, EDIT_DIGEST_ALGORITHM, MAX_EDIT_CHANGES, MAX_EDIT_FILE_BYTES, MAX_EDIT_PROPOSAL_BYTES, fileDigestSchema, workspaceFilePathSchema, editChangeSchema, editChangesSchema, editProposalInputSchema, editProposalChangeSchema, editProposalSchema, applyEditProposalInputSchema, moveFileInputSchema, quarantineFileInputSchema, restoreFileInputSchema, mutationOperationSchema, mutationAuditEntrySchema, createEditProposal, validateEditProposal, editContractDocument, protectPersistenceSecret, acquireSqliteAccess, exclusiveSqliteAccessDescriptor, adoptExclusiveSqliteAccess, SqliteDatabase, UnsafeFileTypeError, FileSizeLimitError, FileChangedWhileReadingError, statRegularFileNoFollow, readRegularFileNoFollow, readRegularFileChunksNoFollow, taskCheckReceiptSchema, withTaskAcceptanceDelivery, assertTaskAcceptanceImport, taskAcceptanceChecks, taskAcceptanceDeliveryDiagnostic, confirmTaskAcceptanceImport, taskAcceptanceOutcome, resolvePackageManager, resolvePackageCheckCommand, runPortableProcess };