@zhivex-ai/harness 1.2.0 → 1.3.0-rc.7

package/dist/index-z0qxmkm2.js

@@ -0,0 +1,3389 @@
+import {
+  FileSizeLimitError,
+  MAX_EDIT_CHANGES,
+  MAX_EDIT_PROPOSAL_BYTES,
+  SqliteDatabase,
+  UnsafeFileTypeError,
+  assertTaskAcceptanceImport,
+  confirmTaskAcceptanceImport,
+  createEditProposal,
+  fileDigestSchema,
+  moveFileInputSchema,
+  mutationAuditEntrySchema,
+  quarantineFileInputSchema,
+  readRegularFileNoFollow,
+  resolvePackageCheckCommand,
+  restoreFileInputSchema,
+  runPortableProcess,
+  statRegularFileNoFollow,
+  taskAcceptanceChecks,
+  validateEditProposal,
+  workspaceFilePathSchema
+} from "./index-yb239ghk.js";
+import {
+  HARNESS_EXECUTION_POLICY_VERSION,
+  HarnessError,
+  HarnessExecutionError,
+  HarnessStateConflictError,
+  HarnessWorkspaceError
+} from "./index-gq9xagx2.js";
+
+// src/workspace/workspace-mutation-lock.ts
+import { createHash } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { lstat, mkdir, open, realpath } from "node:fs/promises";
+import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+var ownership = new AsyncLocalStorage;
+var withWorkspaceMutation = async (root, operation) => {
+  root = await realpath(root);
+  const inherited = ownership.getStore();
+  if (inherited?.get(root)?.active)
+    return operation();
+  const uid = process.getuid?.();
+  if (uid === undefined || !["darwin", "linux"].includes(process.platform)) {
+    throw new HarnessWorkspaceError("Workspace mutation locks require Linux or macOS user identity.");
+  }
+  const directory = path.join(process.platform === "darwin" ? "/private/tmp" : "/tmp", `zhivex-harness-mutation-locks-${uid}`);
+  await mkdir(directory, { mode: 448 }).catch((error) => {
+    if (error.code !== "EEXIST")
+      throw error;
+  });
+  const entry = await lstat(directory);
+  if (!entry.isDirectory() || entry.isSymbolicLink() || entry.uid !== uid || (entry.mode & 63) !== 0 || await realpath(directory) !== directory) {
+    throw new HarnessWorkspaceError("Workspace mutation lock requires a real state directory without symbolic links.");
+  }
+  const filename = path.join(directory, `${createHash("sha256").update(root).digest("hex")}.sqlite`);
+  try {
+    const created = await open(filename, "wx", 384);
+    await created.close();
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+  }
+  const before = await statRegularFileNoFollow(filename, { label: "Workspace mutation lock", requireSingleLink: true });
+  if (before.uid !== uid || (before.mode & 63) !== 0)
+    throw new HarnessWorkspaceError("Workspace mutation lock must be owner-only.");
+  const database = new SqliteDatabase(filename, { create: false });
+  let acquired = false;
+  const token = { active: true };
+  try {
+    const after = await statRegularFileNoFollow(filename, { label: "Workspace mutation lock", requireSingleLink: true });
+    if (before.dev !== after.dev || before.ino !== after.ino) {
+      throw new HarnessWorkspaceError("Workspace mutation lock changed while opening.");
+    }
+    database.exec("PRAGMA busy_timeout = 0");
+    const deadline = performance.now() + 15000;
+    for (;; ) {
+      try {
+        database.exec("BEGIN IMMEDIATE");
+        acquired = true;
+        break;
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "";
+        if (!/database (?:is )?(?:locked|busy)/i.test(message))
+          throw error;
+        if (performance.now() >= deadline)
+          throw new HarnessStateConflictError("Workspace mutation is owned by another writer.");
+        await delay(25);
+      }
+    }
+    return await ownership.run(new Map([...inherited ?? [], [root, token]]), operation);
+  } finally {
+    token.active = false;
+    try {
+      if (acquired)
+        database.exec("ROLLBACK");
+    } finally {
+      database.close(false);
+    }
+  }
+};
+
+// src/workspace/replacement-edits.ts
+import { z } from "zod";
+var replacementEditSchema = z.strictObject({
+  path: workspaceFilePathSchema,
+  expectedDigest: fileDigestSchema,
+  oldText: z.string().min(1).max(64000),
+  newText: z.string().max(64000)
+});
+
+// src/workspace/bounded-reads.ts
+async function* boundedBatches(items, operation, concurrency = 8) {
+  if (!Number.isSafeInteger(concurrency) || concurrency < 1)
+    throw new Error("Invalid concurrency.");
+  for (let offset = 0;offset < items.length; offset += concurrency) {
+    const results = await Promise.allSettled(items.slice(offset, offset + concurrency).map(async (item) => operation(item)));
+    const failure = results.find((result) => result.status !== "fulfilled");
+    if (failure?.status === "rejected")
+      throw failure.reason;
+    yield results.map((result) => result.value);
+  }
+}
+
+// src/workspace/workspace.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { link, lstat as lstat2, mkdir as mkdir2, open as open2, readdir, realpath as realpath2, rename, stat, unlink } from "node:fs/promises";
+import path2 from "node:path";
+
+// src/workspace/path-policy.ts
+var HARD_IGNORES = new Set([".git", ".next", ".turbo", ".zhivex-harness", "coverage", "dist", "node_modules"]);
+var isSensitiveName = (name) => {
+  const normalized = name.toLocaleLowerCase();
+  return normalized === ".env" || normalized.startsWith(".env.") && normalized !== ".env.example" || normalized === ".npmrc" || normalized === "id_rsa" || normalized === "id_ed25519" || [".key", ".pem", ".p12", ".pfx"].some((extension) => normalized.endsWith(extension));
+};
+var isHardIgnored = (relativePath) => relativePath.split("/").some((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
+
+// src/workspace/workspace.ts
+var IGNORE_FILES = [".gitignore", ".zhivex-harnessignore"];
+var DEFAULT_CHECKS = ["test", "typecheck", "lint", "build"];
+var MAX_FILE_BYTES = 1024 * 1024;
+var MAX_TOOL_OUTPUT = 20000;
+var MAX_READ_BATCH_FILES = 20;
+var MAX_READ_BATCH_BYTES = 2 * MAX_FILE_BYTES;
+var MAX_SEARCH_MANY_QUERIES = 10;
+var MAX_SEARCH_MANY_MATCHES = 500;
+var MAX_SEARCH_CHARACTERS = 28000;
+var searchCoverage = () => ({
+  inspectedFiles: 0,
+  skippedFiles: 0,
+  incomplete: false,
+  skippedReasons: { tooLarge: 0, unsafe: 0, unreadable: 0 }
+});
+var skipSearchFile = (coverage, error) => {
+  coverage.skippedFiles++;
+  coverage.incomplete = true;
+  coverage.skippedReasons[error instanceof FileSizeLimitError ? "tooLarge" : error instanceof UnsafeFileTypeError ? "unsafe" : "unreadable"]++;
+};
+var MAX_GIT_DISCOVERY_OUTPUT = 1e6;
+var MAX_GIT_DIFF_PATHS = 2048;
+var MAX_GIT_DIFF_ARGV_CHARACTERS = 128000;
+var GIT_SAFE_PREFIX = ["git", "-c", "core.fsmonitor=false"];
+var isInside = (root, candidate) => {
+  const relative = path2.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path2.sep}`) && relative !== ".." && !path2.isAbsolute(relative);
+};
+var wirePath = (value) => value.split(path2.sep).join("/");
+var digestBytes = (value) => `sha256:${createHash2("sha256").update(value).digest("hex")}`;
+var truncate = (value, maxLength = MAX_TOOL_OUTPUT) => value.length <= maxLength ? value : `${value.slice(0, maxLength)}
+… output truncated (${value.length - maxLength} characters omitted)`;
+var cursorEncode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+var cursorDecode = (value) => {
+  try {
+    return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch {
+    throw new HarnessWorkspaceError("The pagination cursor is invalid.");
+  }
+};
+var firstPathAtLeast = (files, target) => {
+  let low = 0;
+  let high = files.length;
+  while (low < high) {
+    const middle = low + Math.floor((high - low) / 2);
+    if ((files[middle]?.path ?? "") < target)
+      low = middle + 1;
+    else
+      high = middle;
+  }
+  return low;
+};
+var firstPathAfter = (files, target) => {
+  let low = 0;
+  let high = files.length;
+  while (low < high) {
+    const middle = low + Math.floor((high - low) / 2);
+    if ((files[middle]?.path ?? "") <= target)
+      low = middle + 1;
+    else
+      high = middle;
+  }
+  return low;
+};
+var escapeRegex = (value) => value.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+var globRegex = (pattern) => {
+  let source = "";
+  for (let index = 0;index < pattern.length; index += 1) {
+    const character = pattern[index] ?? "";
+    if (character === "*") {
+      if (pattern[index + 1] === "*") {
+        index += 1;
+        if (pattern[index + 1] === "/") {
+          index += 1;
+          source += "(?:.*/)?";
+        } else {
+          source += ".*";
+        }
+      } else {
+        source += "[^/]*";
+      }
+    } else if (character === "?") {
+      source += "[^/]";
+    } else {
+      source += escapeRegex(character);
+    }
+  }
+  return source;
+};
+var parseIgnoreRules = (contents, base) => {
+  const rules = [];
+  for (const rawLine of contents.split(/\r?\n/)) {
+    let line = rawLine.trimEnd();
+    if (!line || line.startsWith("#"))
+      continue;
+    if (line.startsWith("\\#") || line.startsWith("\\!"))
+      line = line.slice(1);
+    const negated = line.startsWith("!");
+    if (negated)
+      line = line.slice(1);
+    if (!line)
+      continue;
+    const directoryOnly = line.endsWith("/");
+    if (directoryOnly)
+      line = line.slice(0, -1);
+    const anchored = line.startsWith("/");
+    if (anchored)
+      line = line.slice(1);
+    if (!line)
+      continue;
+    const source = globRegex(line);
+    rules.push({
+      base,
+      negated,
+      directoryOnly,
+      regex: anchored || line.includes("/") ? new RegExp(`^${source}$`) : new RegExp(`(?:^|/)${source}$`)
+    });
+  }
+  return rules;
+};
+var isIgnoredByRules = (relativePath, isDirectory, rules) => {
+  let ignored = false;
+  for (const rule of rules) {
+    if (rule.directoryOnly && !isDirectory)
+      continue;
+    const local = rule.base ? relativePath === rule.base ? "" : relativePath.startsWith(`${rule.base}/`) ? relativePath.slice(rule.base.length + 1) : undefined : relativePath;
+    if (local && rule.regex.test(local))
+      ignored = !rule.negated;
+  }
+  return ignored;
+};
+var spawnBounded = async (command, cwd, timeoutMs = 120000) => {
+  return await runPortableProcess(command, { cwd, timeoutMs });
+};
+var gitCommand = (...args) => [...GIT_SAFE_PREFIX, ...args];
+var gitDiscovery = async (command, cwd) => await runPortableProcess(command, {
+  cwd,
+  timeoutMs: 15000,
+  maxOutputCharacters: MAX_GIT_DISCOVERY_OUTPUT,
+  stderr: "ignore"
+});
+var gitDiscoveryFailure = (result, label) => ({
+  command: result.command,
+  exitCode: result.exitCode,
+  stdout: "",
+  stderr: result.timedOut ? `${label} timed out without exposing repository-controlled output.` : `${label} failed without exposing repository-controlled output.`,
+  timedOut: result.timedOut
+});
+var nulFields = (result, label) => {
+  if (result.stdout === "")
+    return [];
+  if (!result.stdout.endsWith("\x00")) {
+    throw new HarnessWorkspaceError(`${label} exceeded its safe discovery bound or returned malformed output.`);
+  }
+  return result.stdout.slice(0, -1).split("\x00");
+};
+var safeGitPath = (candidate) => {
+  const normalized = wirePath(candidate);
+  return normalized !== "" && normalized !== "." && !path2.isAbsolute(candidate) && !normalized.startsWith("../") && !isHardIgnored(normalized);
+};
+var renderGitPath = (candidate) => /[\0\r\n\t]/.test(candidate) ? JSON.stringify(candidate) : candidate;
+var filteredGitStatus = (result) => {
+  if (result.exitCode !== 0 || result.timedOut)
+    return gitDiscoveryFailure(result, "Git status");
+  const fields = nulFields(result, "Git status");
+  const lines = [];
+  for (let index = 0;index < fields.length; index += 1) {
+    const field = fields[index] ?? "";
+    if (field.length < 4 || field[2] !== " ") {
+      throw new HarnessWorkspaceError("Git status returned malformed porcelain output.");
+    }
+    const status = field.slice(0, 2);
+    const target = field.slice(3);
+    const renamed = status.includes("R") || status.includes("C");
+    const source = renamed ? fields[index += 1] : undefined;
+    if (!safeGitPath(target) || source !== undefined && !safeGitPath(source))
+      continue;
+    lines.push(source === undefined ? `${status} ${renderGitPath(target)}` : `${status} ${renderGitPath(source)} -> ${renderGitPath(target)}`);
+  }
+  return { ...result, stdout: lines.length === 0 ? "" : `${lines.join(`
+`)}
+`, stderr: "" };
+};
+var filteredGitDiffPaths = (result, label) => {
+  if (result.exitCode !== 0 || result.timedOut)
+    return gitDiscoveryFailure(result, label);
+  const fields = nulFields(result, label);
+  const paths = [];
+  for (let index = 0;index < fields.length; ) {
+    const status = fields[index++] ?? "";
+    if (!/^[ACDMRTUXB][0-9]*$/.test(status)) {
+      throw new HarnessWorkspaceError(`${label} returned malformed name-status output.`);
+    }
+    const count = status.startsWith("R") || status.startsWith("C") ? 2 : 1;
+    const changePaths = fields.slice(index, index + count);
+    if (changePaths.length !== count) {
+      throw new HarnessWorkspaceError(`${label} returned incomplete name-status output.`);
+    }
+    index += count;
+    if (changePaths.every(safeGitPath))
+      paths.push(...changePaths);
+  }
+  return [...new Set(paths)];
+};
+var emptyGitDiff = (command) => ({
+  command,
+  exitCode: 0,
+  stdout: "",
+  stderr: "",
+  timedOut: false
+});
+var runFilteredGitDiff = async (discovery, cwd, cached) => {
+  const label = cached ? "Git staged diff discovery" : "Git diff discovery";
+  const paths = filteredGitDiffPaths(discovery, label);
+  if (!Array.isArray(paths))
+    return paths;
+  const command = gitCommand("diff", ...cached ? ["--cached"] : [], "--no-ext-diff", "--no-textconv", "--ignore-submodules=all", "--src-prefix=a/", "--dst-prefix=b/", "--", ...paths);
+  if (paths.length === 0)
+    return emptyGitDiff(command);
+  if (paths.length > MAX_GIT_DIFF_PATHS || command.reduce((total, value) => total + value.length + 1, 0) > MAX_GIT_DIFF_ARGV_CHARACTERS) {
+    return {
+      ...emptyGitDiff(command.slice(0, command.length - paths.length)),
+      exitCode: 1,
+      stderr: `${label} found too many changed paths to render safely.`
+    };
+  }
+  return await spawnBounded(command, cwd, 15000);
+};
+var workspaceIndexFreshness = new WeakMap;
+
+class Workspace {
+  auditPath;
+  root;
+  auditEntries = [];
+  indexIdentity = randomUUID();
+  indexRevision = 0;
+  workspaceIndex;
+  indexBuild;
+  indexMetrics = { builds: 0, reuses: 0, stableFileReads: 0 };
+  constructor(root, auditPath) {
+    this.auditPath = auditPath;
+    this.root = root;
+  }
+  static async open(root, options = {}) {
+    try {
+      const resolved = await realpath2(path2.resolve(root));
+      if (!(await stat(resolved)).isDirectory()) {
+        throw new HarnessWorkspaceError(`The workspace is not a directory: ${root}`);
+      }
+      const workspace = new Workspace(resolved, options.auditPath);
+      if (options.auditPath) {
+        try {
+          const data = await readRegularFileNoFollow(options.auditPath, { label: "Mutation audit", maxBytes: 8 * 1024 * 1024 });
+          const entries = JSON.parse(data.contents.toString("utf8"));
+          if (!Array.isArray(entries) || entries.length > 1e4)
+            throw new Error("Invalid mutation audit.");
+          workspace.auditEntries.push(...entries.map((entry) => mutationAuditEntrySchema.parse(entry)));
+        } catch (error) {
+          if (error.code !== "ENOENT")
+            throw error;
+        }
+      }
+      return workspace;
+    } catch (error) {
+      if (error instanceof HarnessWorkspaceError)
+        throw error;
+      throw new HarnessWorkspaceError(`The workspace could not be opened safely: ${root}`, { cause: error });
+    }
+  }
+  lexicalPath(relativePath) {
+    if (!relativePath || relativePath.includes("\x00"))
+      throw new HarnessWorkspaceError("The path must be a valid relative path.");
+    const candidate = path2.resolve(this.root, relativePath);
+    if (!isInside(this.root, candidate))
+      throw new HarnessWorkspaceError(`The path escapes the workspace: ${relativePath}`);
+    const relative = wirePath(path2.relative(this.root, candidate));
+    if (relative && isHardIgnored(relative)) {
+      const blocked = relative.split("/").find((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
+      throw new HarnessWorkspaceError(`The path is protected by the harness policy: ${blocked}`);
+    }
+    return candidate;
+  }
+  async safePath(relativePath, options = {}) {
+    const candidate = this.lexicalPath(relativePath);
+    if (candidate === this.root && options.requireFile)
+      throw new HarnessWorkspaceError("The workspace root is not a regular file.");
+    const segments = path2.relative(this.root, candidate).split(path2.sep).filter(Boolean);
+    let current = this.root;
+    for (let index = 0;index < segments.length; index += 1) {
+      current = path2.join(current, segments[index]);
+      const leaf = index === segments.length - 1;
+      if (leaf && options.skipLeafValidation)
+        continue;
+      let entry;
+      try {
+        entry = await lstat2(current);
+      } catch (error) {
+        if (options.allowMissing && error.code === "ENOENT") {
+          return { path: candidate, exists: false };
+        }
+        throw error;
+      }
+      if (entry.isSymbolicLink()) {
+        throw new HarnessWorkspaceError(`The path resolves outside the workspace or through a symbolic link: ${relativePath}`);
+      }
+      if (!leaf && !entry.isDirectory())
+        throw new HarnessWorkspaceError(`A path ancestor is not a directory: ${relativePath}`);
+      if (leaf && options.requireFile && !entry.isFile())
+        throw new HarnessWorkspaceError("The path does not point to a regular file.");
+    }
+    return { path: candidate, exists: true };
+  }
+  async readStableFile(relativePath, allowBinary = true) {
+    this.indexMetrics.stableFileReads += 1;
+    const safe = await this.safePath(relativePath, { skipLeafValidation: true });
+    const file = await readRegularFileNoFollow(safe.path, {
+      label: "The file",
+      maxBytes: MAX_FILE_BYTES
+    });
+    const { contents } = file;
+    if (!allowBinary && contents.includes(0))
+      throw new HarnessWorkspaceError("The file appears to be binary and cannot be read as text.");
+    return {
+      path: wirePath(path2.relative(this.root, safe.path)),
+      absolutePath: safe.path,
+      contents,
+      digest: digestBytes(contents),
+      mode: file.stat.mode & 511
+    };
+  }
+  fingerprint(relativePath, kind, entry, digest) {
+    return {
+      path: relativePath || ".",
+      kind,
+      dev: entry.dev,
+      ino: entry.ino,
+      size: entry.size,
+      mtimeMs: entry.mtimeMs,
+      ctimeMs: entry.ctimeMs,
+      ...digest ? { digest } : {}
+    };
+  }
+  sameFingerprint(entry, fingerprint) {
+    return entry.dev === fingerprint.dev && entry.ino === fingerprint.ino && entry.size === fingerprint.size && entry.mtimeMs === fingerprint.mtimeMs && entry.ctimeMs === fingerprint.ctimeMs;
+  }
+  async rulesForDirectory(directory, base, inherited, ignoreFiles) {
+    const rules = [...inherited];
+    for (const filename of IGNORE_FILES) {
+      try {
+        const ignorePath = path2.join(directory, filename);
+        const inspected = await statRegularFileNoFollow(ignorePath, { label: "The ignore file" });
+        if (inspected.size > MAX_FILE_BYTES) {
+          ignoreFiles.push(this.fingerprint(wirePath(path2.relative(this.root, ignorePath)), "ignore-file", inspected));
+          continue;
+        }
+        const file = await readRegularFileNoFollow(ignorePath, {
+          label: "The ignore file",
+          maxBytes: MAX_FILE_BYTES
+        });
+        const digest = digestBytes(file.contents);
+        ignoreFiles.push(this.fingerprint(wirePath(path2.relative(this.root, ignorePath)), "ignore-file", file.stat, digest));
+        rules.push(...parseIgnoreRules(file.contents.toString("utf8"), base));
+      } catch (error) {
+        if (error.code !== "ENOENT" && !(error instanceof UnsafeFileTypeError))
+          throw error;
+      }
+    }
+    return rules;
+  }
+  async collectFiles(version) {
+    const files = [];
+    const directories = [];
+    const ignoreFiles = [];
+    let pending = [
+      { directory: this.root, base: "", inherited: [] }
+    ];
+    while (pending.length) {
+      const next = [];
+      for await (const batch of boundedBatches(pending, async ({ directory, base, inherited }) => {
+        const directoryEntry = await lstat2(directory);
+        if (directoryEntry.isSymbolicLink() || !directoryEntry.isDirectory()) {
+          throw new HarnessWorkspaceError(`A workspace directory changed while it was being indexed: ${base || "."}`);
+        }
+        directories.push(this.fingerprint(base, "directory", directoryEntry));
+        const rules = await this.rulesForDirectory(directory, base, inherited, ignoreFiles);
+        const children = [];
+        for (const entry of await readdir(directory, { withFileTypes: true })) {
+          const relative = base ? `${base}/${entry.name}` : entry.name;
+          if (isHardIgnored(relative) || entry.isSymbolicLink() || isIgnoredByRules(relative, entry.isDirectory(), rules))
+            continue;
+          if (entry.isDirectory())
+            children.push({ directory: path2.join(directory, entry.name), base: relative, inherited: rules });
+          else if (entry.isFile())
+            files.push({ path: relative });
+        }
+        return children;
+      }))
+        for (const children of batch)
+          next.push(...children);
+      pending = next;
+    }
+    directories.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    ignoreFiles.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    return { version, files, directories, ignoreFiles };
+  }
+  async isWorkspaceIndexFresh(index) {
+    try {
+      for await (const batch of boundedBatches(index.directories, async (fingerprint) => {
+        const absolute = fingerprint.path === "." ? this.root : path2.join(this.root, fingerprint.path);
+        const entry = await lstat2(absolute);
+        return !entry.isSymbolicLink() && entry.isDirectory() && this.sameFingerprint(entry, fingerprint);
+      }))
+        if (batch.some((fresh) => !fresh))
+          return false;
+      for await (const batch of boundedBatches(index.ignoreFiles, async (fingerprint) => {
+        const absolute = path2.join(this.root, fingerprint.path);
+        if (fingerprint.digest) {
+          const file = await readRegularFileNoFollow(absolute, {
+            label: "The ignore file",
+            maxBytes: MAX_FILE_BYTES
+          });
+          return this.sameFingerprint(file.stat, fingerprint) && digestBytes(file.contents) === fingerprint.digest;
+        }
+        const inspected = await statRegularFileNoFollow(absolute, { label: "The ignore file" });
+        return this.sameFingerprint(inspected, fingerprint);
+      }))
+        if (batch.some((fresh) => !fresh))
+          return false;
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  invalidateWorkspaceIndex() {
+    this.indexRevision += 1;
+    this.workspaceIndex = undefined;
+  }
+  async buildWorkspaceIndex(revision) {
+    const version = `${this.indexIdentity}:${revision}`;
+    for (let attempt = 0;attempt < 3; attempt += 1) {
+      try {
+        const index = await this.collectFiles(version);
+        if (await this.isWorkspaceIndexFresh(index))
+          return index;
+      } catch (error) {
+        const code = error.code;
+        const changedDuringIndexing = error instanceof Error && error.message.includes("while the workspace was being indexed");
+        if (attempt === 2 || code !== "ENOENT" && !changedDuringIndexing)
+          throw error;
+      }
+    }
+    throw new HarnessWorkspaceError("The workspace kept changing while its file index was being built.");
+  }
+  async getWorkspaceIndex() {
+    const cached = this.workspaceIndex;
+    if (cached) {
+      let freshness = workspaceIndexFreshness.get(this);
+      if (freshness?.index !== cached) {
+        const promise = this.isWorkspaceIndexFresh(cached).finally(() => {
+          if (workspaceIndexFreshness.get(this)?.promise === promise)
+            workspaceIndexFreshness.delete(this);
+        });
+        freshness = { index: cached, promise };
+        workspaceIndexFreshness.set(this, freshness);
+      }
+      const fresh = await freshness.promise;
+      if (this.workspaceIndex !== cached)
+        return this.getWorkspaceIndex();
+      if (fresh) {
+        this.indexMetrics.reuses += 1;
+        return cached;
+      }
+      this.invalidateWorkspaceIndex();
+    }
+    const revision = this.indexRevision;
+    if (!this.indexBuild || this.indexBuild.revision !== revision) {
+      const promise = this.buildWorkspaceIndex(revision);
+      this.indexBuild = { revision, promise };
+    }
+    const build = this.indexBuild;
+    let index;
+    try {
+      index = await build.promise;
+    } catch (error) {
+      if (this.indexBuild === build)
+        this.indexBuild = undefined;
+      throw error;
+    }
+    if (revision !== this.indexRevision)
+      return this.getWorkspaceIndex();
+    if (this.indexBuild === build)
+      this.indexBuild = undefined;
+    if (this.workspaceIndex?.version !== index.version) {
+      this.workspaceIndex = index;
+      this.indexMetrics.builds += 1;
+    }
+    return this.workspaceIndex;
+  }
+  workspaceIndexDiagnostics() {
+    const index = this.workspaceIndex;
+    return {
+      ...this.indexMetrics,
+      ...index ? { version: index.version } : {},
+      files: index?.files.length ?? 0,
+      directories: index?.directories.length ?? 0
+    };
+  }
+  async listFiles(relativePath = ".", options = {}) {
+    const start = await this.safePath(relativePath);
+    if (!(await lstat2(start.path)).isDirectory())
+      throw new HarnessWorkspaceError("list_files requires a directory.");
+    const requestPath = wirePath(path2.relative(this.root, start.path)) || ".";
+    const input = typeof options === "number" ? { limit: options } : options;
+    const limit = input.limit ?? 200;
+    const includeDigests = input.includeDigests ?? true;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 5000)
+      throw new HarnessWorkspaceError("limit must be between 1 and 5000.");
+    let after = "";
+    let cursorIndexVersion;
+    if (input.cursor) {
+      const parsed = cursorDecode(input.cursor);
+      if (parsed.v !== 2 || parsed.kind !== "list" || parsed.path !== requestPath || parsed.limit !== limit || parsed.includeDigests !== includeDigests || typeof parsed.indexVersion !== "string" || typeof parsed.after !== "string") {
+        throw new HarnessWorkspaceError("The pagination cursor does not match this list request.");
+      }
+      after = parsed.after;
+      cursorIndexVersion = parsed.indexVersion;
+    }
+    const index = await this.getWorkspaceIndex();
+    if (cursorIndexVersion && cursorIndexVersion !== index.version) {
+      throw new HarnessWorkspaceError("The pagination cursor is stale because the workspace changed.");
+    }
+    const prefix = requestPath === "." ? "" : `${requestPath}/`;
+    let candidateIndex = after ? firstPathAfter(index.files, after) : requestPath === "." ? 0 : firstPathAtLeast(index.files, prefix);
+    const selected = [];
+    while (candidateIndex < index.files.length && selected.length <= limit) {
+      const candidate = index.files[candidateIndex];
+      if (!candidate || requestPath !== "." && !candidate.path.startsWith(prefix))
+        break;
+      selected.push(candidate);
+      candidateIndex += 1;
+    }
+    const truncated = selected.length > limit;
+    if (truncated)
+      selected.pop();
+    const files = [];
+    if (includeDigests) {
+      for await (const batch of boundedBatches(selected, async (candidate) => {
+        const file = await this.readStableFile(candidate.path);
+        return { path: file.path, size: file.contents.byteLength, digest: file.digest };
+      }))
+        files.push(...batch);
+    } else {
+      files.push(...selected.map(({ path: candidatePath }) => ({ path: candidatePath })));
+    }
+    const last = selected.at(-1);
+    return {
+      files,
+      truncated,
+      ...truncated && last ? {
+        nextCursor: cursorEncode({
+          v: 2,
+          kind: "list",
+          path: requestPath,
+          limit,
+          includeDigests,
+          after: last.path,
+          indexVersion: index.version
+        })
+      } : {}
+    };
+  }
+  renderReadFile(file, startLine = 1, endLine, maxCharacters = 16000) {
+    if (!Number.isSafeInteger(startLine) || startLine < 1)
+      throw new HarnessWorkspaceError("startLine must be a positive integer.");
+    if (endLine !== undefined && (!Number.isSafeInteger(endLine) || endLine < startLine)) {
+      throw new HarnessWorkspaceError("endLine must be greater than or equal to startLine.");
+    }
+    const lines = file.contents.toString("utf8").split(/\r?\n/);
+    const boundedEnd = Math.min(endLine ?? startLine + 119, startLine + 1999, lines.length);
+    const rendered = [];
+    let characters = 0;
+    let clippedLine = false;
+    for (let index = startLine - 1;index < boundedEnd; index++) {
+      const line = `${index + 1}: ${lines[index]}`;
+      const remaining = maxCharacters - characters - (rendered.length ? 1 : 0);
+      if (line.length > remaining && rendered.length)
+        break;
+      rendered.push(line.slice(0, remaining));
+      characters += Math.min(line.length, remaining) + (rendered.length > 1 ? 1 : 0);
+      if (line.length > remaining) {
+        clippedLine = true;
+        break;
+      }
+    }
+    const returnedEnd = rendered.length ? startLine + rendered.length - 1 : boundedEnd;
+    return {
+      path: file.path,
+      digest: file.digest,
+      startLine,
+      endLine: returnedEnd,
+      totalLines: lines.length,
+      content: rendered.join(`
+`),
+      clippedLine,
+      truncated: clippedLine || returnedEnd < lines.length
+    };
+  }
+  async readFile(relativePath, startLine = 1, endLine) {
+    return this.renderReadFile(await this.readStableFile(relativePath, false), startLine, endLine);
+  }
+  async readFiles(requests) {
+    if (!Array.isArray(requests) || requests.length < 1 || requests.length > MAX_READ_BATCH_FILES) {
+      throw new HarnessWorkspaceError(`readFiles requires between 1 and ${MAX_READ_BATCH_FILES} file requests.`);
+    }
+    const ordered = requests.map((request) => ({
+      ...request,
+      path: wirePath(path2.relative(this.root, this.lexicalPath(request.path)))
+    })).sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0) || (a.startLine ?? 1) - (b.startLine ?? 1) || (a.endLine ?? 0) - (b.endLine ?? 0));
+    for (const request of ordered) {
+      if (!Number.isSafeInteger(request.startLine ?? 1) || (request.startLine ?? 1) < 1 || request.endLine !== undefined && (!Number.isSafeInteger(request.endLine) || request.endLine < (request.startLine ?? 1))) {
+        throw new HarnessWorkspaceError(`Invalid line range for ${request.path}.`);
+      }
+    }
+    const stableFiles = new Map;
+    let totalBytes = 0;
+    for await (const batch of boundedBatches([...new Set(ordered.map((request) => request.path))], (filePath) => this.readStableFile(filePath, false), 4)) {
+      for (const file of batch) {
+        totalBytes += file.contents.byteLength;
+        if (totalBytes > MAX_READ_BATCH_BYTES) {
+          throw new HarnessWorkspaceError(`readFiles exceeds the aggregate ${MAX_READ_BATCH_BYTES}-byte source limit.`);
+        }
+        stableFiles.set(file.path, file);
+      }
+    }
+    return {
+      files: ordered.map((request) => this.renderReadFile(stableFiles.get(request.path), request.startLine ?? 1, request.endLine, Math.min(16000, Math.floor(32000 / ordered.length)))),
+      sourceBytes: totalBytes
+    };
+  }
+  async inspectFile(relativePath) {
+    const file = await this.readStableFile(relativePath);
+    return {
+      path: file.path,
+      digest: file.digest,
+      mode: file.mode,
+      bytes: file.contents.byteLength
+    };
+  }
+  async searchFiles(query, relativePath = ".", options = {}) {
+    if (!query || query.length > 200)
+      throw new HarnessWorkspaceError("The search query must be between 1 and 200 characters.");
+    const start = await this.safePath(relativePath);
+    const isDirectory = (await lstat2(start.path)).isDirectory();
+    const requestPath = wirePath(path2.relative(this.root, start.path)) || ".";
+    const limit = options.limit ?? options.maxMatches ?? 100;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 500)
+      throw new HarnessWorkspaceError("limit must be between 1 and 500.");
+    const caseSensitive = options.caseSensitive ?? false;
+    let afterPath = "";
+    let afterLine = 0;
+    let cursorIndexVersion;
+    if (options.cursor) {
+      const parsed = cursorDecode(options.cursor);
+      if (parsed.v !== 2 || parsed.kind !== "search" || parsed.path !== requestPath || parsed.query !== query || parsed.caseSensitive !== caseSensitive || parsed.limit !== limit || typeof parsed.afterPath !== "string" || !Number.isSafeInteger(parsed.afterLine) || typeof parsed.indexVersion !== "string") {
+        throw new HarnessWorkspaceError("The pagination cursor does not match this search request.");
+      }
+      afterPath = parsed.afterPath;
+      afterLine = parsed.afterLine;
+      cursorIndexVersion = parsed.indexVersion;
+    }
+    const directFile = isDirectory ? undefined : await this.readStableFile(relativePath, false);
+    const index = isDirectory ? await this.getWorkspaceIndex() : { version: directFile.digest, files: [{ path: requestPath }] };
+    if (cursorIndexVersion && cursorIndexVersion !== index.version) {
+      throw new HarnessWorkspaceError("The pagination cursor is stale because the workspace changed.");
+    }
+    const prefix = requestPath === "." ? "" : `${requestPath}/`;
+    const needle = caseSensitive ? query : query.toLocaleLowerCase();
+    const matches = [];
+    let hasMore = false;
+    let characters = 0;
+    const coverage = searchCoverage();
+    const candidateIndex = afterPath ? firstPathAtLeast(index.files, afterPath) : requestPath === "." ? 0 : firstPathAtLeast(index.files, prefix);
+    for await (const batch of boundedBatches(isDirectory ? index.files.slice(candidateIndex, requestPath === "." ? undefined : firstPathAtLeast(index.files, `${requestPath}0`)) : [{ path: requestPath }], async (candidate) => {
+      try {
+        const file = directFile ?? await this.readStableFile(candidate.path, false);
+        coverage.inspectedFiles++;
+        return file;
+      } catch (error) {
+        skipSearchFile(coverage, error);
+        return;
+      }
+    })) {
+      for (const file of batch) {
+        if (!file)
+          continue;
+        const candidate = file;
+        const lines = file.contents.toString("utf8").split(/\r?\n/);
+        for (let index2 = 0;index2 < lines.length; index2 += 1) {
+          const lineNumber = index2 + 1;
+          if (candidate.path === afterPath && lineNumber <= afterLine)
+            continue;
+          const line = lines[index2] ?? "";
+          if (!(caseSensitive ? line : line.toLocaleLowerCase()).includes(needle))
+            continue;
+          const match = { path: candidate.path, line: lineNumber, text: truncate(line, 500), digest: file.digest };
+          const size = JSON.stringify(match).length + 1;
+          if (matches.length >= limit || characters + size > MAX_SEARCH_CHARACTERS) {
+            hasMore = true;
+            break;
+          }
+          matches.push(match);
+          characters += size;
+        }
+        if (hasMore)
+          break;
+      }
+      if (hasMore)
+        break;
+    }
+    const render = () => {
+      const last = matches.at(-1);
+      return {
+        matches,
+        coverage: { ...coverage, incomplete: coverage.incomplete || hasMore },
+        truncated: hasMore,
+        ...hasMore && last ? {
+          nextCursor: cursorEncode({
+            v: 2,
+            kind: "search",
+            path: requestPath,
+            query,
+            caseSensitive,
+            limit,
+            afterPath: last.path,
+            afterLine: last.line,
+            indexVersion: index.version
+          })
+        } : {}
+      };
+    };
+    while (JSON.stringify(render()).length > 32000) {
+      if (!matches.length)
+        throw new HarnessWorkspaceError("Search metadata exceeds the output limit; narrow the request.");
+      matches.pop();
+      hasMore = true;
+    }
+    return render();
+  }
+  async searchMany(queries, relativePath = ".", options = {}) {
+    if (!Array.isArray(queries) || queries.length < 1 || queries.length > MAX_SEARCH_MANY_QUERIES) {
+      throw new HarnessWorkspaceError(`searchMany requires between 1 and ${MAX_SEARCH_MANY_QUERIES} queries.`);
+    }
+    const limitPerQuery = options.limitPerQuery ?? 50;
+    if (!Number.isSafeInteger(limitPerQuery) || limitPerQuery < 1 || limitPerQuery > MAX_SEARCH_MANY_MATCHES || limitPerQuery * queries.length > MAX_SEARCH_MANY_MATCHES) {
+      throw new HarnessWorkspaceError(`searchMany allows at most ${MAX_SEARCH_MANY_MATCHES} aggregate matches.`);
+    }
+    const coverage = searchCoverage();
+    let characters = 0;
+    let outputFull = false;
+    const seen = new Set;
+    const states = queries.map((input) => {
+      if (!input.query || input.query.length > 200)
+        throw new HarnessWorkspaceError("Each search query must be between 1 and 200 characters.");
+      const caseSensitive = input.caseSensitive ?? false;
+      const key = `${caseSensitive ? "1" : "0"}\x00${input.query}`;
+      if (seen.has(key))
+        throw new HarnessWorkspaceError("searchMany queries must be unique.");
+      seen.add(key);
+      return {
+        query: input.query,
+        caseSensitive,
+        needle: caseSensitive ? input.query : input.query.toLocaleLowerCase(),
+        matches: [],
+        truncated: false
+      };
+    });
+    const start = await this.safePath(relativePath);
+    const isDirectory = (await lstat2(start.path)).isDirectory();
+    const requestPath = wirePath(path2.relative(this.root, start.path)) || ".";
+    const prefix = requestPath === "." ? "" : `${requestPath}/`;
+    const index = isDirectory ? await this.getWorkspaceIndex() : undefined;
+    const candidateIndex = requestPath === "." ? 0 : firstPathAtLeast(index?.files ?? [], prefix);
+    const candidates = index ? index.files.slice(candidateIndex, requestPath === "." ? undefined : firstPathAtLeast(index.files, `${requestPath}0`)) : [{ path: requestPath }];
+    for await (const batch of boundedBatches(candidates, async (candidate) => {
+      try {
+        const file = await this.readStableFile(candidate.path, false);
+        coverage.inspectedFiles++;
+        return file;
+      } catch (error) {
+        if (!isDirectory)
+          throw error;
+        skipSearchFile(coverage, error);
+        return;
+      }
+    })) {
+      for (const file of batch) {
+        if (!file)
+          continue;
+        const candidate = file;
+        const lines = file.contents.toString("utf8").split(/\r?\n/);
+        for (let lineIndex = 0;lineIndex < lines.length; lineIndex += 1) {
+          const line = lines[lineIndex] ?? "";
+          const foldedLine = line.toLocaleLowerCase();
+          for (const state of states) {
+            if (state.truncated || !(state.caseSensitive ? line : foldedLine).includes(state.needle))
+              continue;
+            if (state.matches.length >= limitPerQuery) {
+              state.truncated = true;
+              continue;
+            }
+            const match = {
+              path: candidate.path,
+              line: lineIndex + 1,
+              text: truncate(line, 500),
+              digest: file.digest
+            };
+            const size = JSON.stringify(match).length + 1;
+            if (characters + size > MAX_SEARCH_CHARACTERS) {
+              outputFull = true;
+              break;
+            }
+            state.matches.push(match);
+            characters += size;
+          }
+          if (outputFull)
+            break;
+        }
+        if (outputFull || states.every((state) => state.truncated))
+          break;
+      }
+      if (outputFull || states.every((state) => state.truncated))
+        break;
+    }
+    const render = () => ({
+      coverage: { ...coverage, incomplete: coverage.incomplete || outputFull || states.some((state) => state.truncated) },
+      outputTruncated: outputFull,
+      continuation: "For a truncated query, use search_files with that query and its nextCursor, or narrow to the returned file/line locations.",
+      results: states.map(({ needle: _needle, ...state }) => {
+        const last = state.matches.at(-1);
+        const truncated = state.truncated || outputFull;
+        return { ...state, truncated, ...truncated && last ? { nextCursor: cursorEncode({
+          v: 2,
+          kind: "search",
+          path: requestPath,
+          query: state.query,
+          caseSensitive: state.caseSensitive,
+          limit: limitPerQuery,
+          afterPath: last.path,
+          afterLine: last.line,
+          indexVersion: index?.version ?? last.digest
+        }) } : {} };
+      })
+    });
+    while (JSON.stringify(render()).length > 32000) {
+      const largest = states.filter((state) => state.matches.length).sort((a, b) => JSON.stringify(b.matches).length - JSON.stringify(a.matches).length)[0];
+      if (!largest)
+        throw new HarnessWorkspaceError("Search metadata exceeds the output limit; narrow the request.");
+      largest.matches.pop();
+      largest.truncated = true;
+      outputFull = true;
+    }
+    return render();
+  }
+  checkAuditCapacity(count = 1) {
+    if (this.auditPath && this.auditEntries.length + count > 1e4)
+      throw new HarnessWorkspaceError("Mutation audit capacity exceeded; retain evidence and start a new run.");
+  }
+  async audit(entry) {
+    const record = { id: randomUUID(), timestamp: new Date().toISOString(), ...entry };
+    this.auditEntries.push(record);
+    if (this.auditPath) {
+      const temporary = `${this.auditPath}.${randomUUID()}.tmp`;
+      const handle = await open2(temporary, "wx", 384);
+      try {
+        await handle.writeFile(JSON.stringify(this.auditEntries));
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      try {
+        await rename(temporary, this.auditPath);
+      } finally {
+        await unlink(temporary).catch(() => {});
+      }
+    }
+    return record;
+  }
+  mutationAudit() {
+    return this.auditEntries.map((entry) => ({ ...entry }));
+  }
+  async secureWorkspaceDirectory(directory, mode = 493) {
+    const resolvedInput = path2.resolve(directory);
+    if (!isInside(this.root, resolvedInput)) {
+      throw new HarnessWorkspaceError("A mutation directory escapes the workspace.");
+    }
+    const segments = path2.relative(this.root, resolvedInput).split(path2.sep).filter(Boolean);
+    let current = this.root;
+    for (const segment of segments) {
+      current = path2.join(current, segment);
+      try {
+        const entry = await lstat2(current);
+        if (entry.isSymbolicLink())
+          throw new HarnessWorkspaceError("A mutation directory must not contain a symbolic link.");
+        if (!entry.isDirectory())
+          throw new HarnessWorkspaceError("A mutation directory contains a non-directory entry.");
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+        try {
+          await mkdir2(current, { mode });
+        } catch (mkdirError) {
+          if (mkdirError.code !== "EEXIST")
+            throw mkdirError;
+          const raced = await lstat2(current);
+          if (raced.isSymbolicLink() || !raced.isDirectory()) {
+            throw new HarnessWorkspaceError("A mutation directory changed during creation.");
+          }
+        }
+      }
+    }
+    const canonical = await realpath2(current);
+    if (!isInside(this.root, canonical))
+      throw new HarnessWorkspaceError("A mutation directory resolves outside the workspace.");
+    return canonical;
+  }
+  async stageFile(target, contents, mode) {
+    const directory = await this.secureWorkspaceDirectory(path2.dirname(target));
+    const temporary = path2.join(directory, `.${path2.basename(target)}.zhivex-${randomUUID()}.tmp`);
+    const handle = await open2(temporary, "wx", mode);
+    try {
+      await handle.writeFile(contents);
+      await handle.chmod(mode);
+      await handle.sync();
+    } catch (error) {
+      await handle.close();
+      await unlink(temporary).catch(() => {});
+      throw error;
+    }
+    await handle.close();
+    return temporary;
+  }
+  async previewPatch(input) {
+    const proposal = validateEditProposal(input);
+    const files = [];
+    let bytes = 0;
+    for (const change of proposal.changes) {
+      const safe = await this.safePath(change.path, { allowMissing: true });
+      let before = null;
+      if (change.expectedDigest === null) {
+        if (safe.exists)
+          throw new HarnessWorkspaceError(`The patch target already exists: ${change.path}.`);
+      } else {
+        const file = await this.readStableFile(change.path, false);
+        if (file.digest !== change.expectedDigest)
+          throw new HarnessWorkspaceError(`Stale patch rejected for ${change.path}.`);
+        try {
+          before = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(file.contents);
+        } catch {
+          throw new HarnessWorkspaceError("Preview requires valid UTF-8 text.");
+        }
+      }
+      bytes += Buffer.byteLength(before ?? "") + Buffer.byteLength(change.content);
+      if (bytes > 4 * 1024 * 1024)
+        throw new HarnessWorkspaceError("Preview exceeds the complete-content byte limit.");
+      files.push({ path: change.path, expectedDigest: change.expectedDigest, before, after: change.content, afterDigest: digestBytes(Buffer.from(change.content)) });
+    }
+    return { proposalId: proposal.proposalId, files };
+  }
+  async previewReplacement(input) {
+    const changes = await this.replacementChanges(input);
+    return this.previewPatch({ proposalId: createEditProposal({ changes }).proposalId, changes });
+  }
+  async replacementChanges(input) {
+    const edit = replacementEditSchema.parse(input);
+    const file = await this.readStableFile(edit.path, false);
+    if (file.digest !== edit.expectedDigest)
+      throw new HarnessWorkspaceError(`Stale patch rejected for ${edit.path}.`);
+    let text;
+    try {
+      text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(file.contents);
+    } catch {
+      throw new HarnessWorkspaceError("Replacement requires valid UTF-8 text.");
+    }
+    const position = text.indexOf(edit.oldText);
+    if (position < 0 || text.indexOf(edit.oldText, position + 1) >= 0) {
+      throw new HarnessWorkspaceError("Replacement requires exactly one literal match; include more surrounding context.");
+    }
+    return [{ path: edit.path, expectedDigest: edit.expectedDigest, content: text.slice(0, position) + edit.newText + text.slice(position + edit.oldText.length) }];
+  }
+  async applyReplacement(input) {
+    const changes = await this.replacementChanges(input);
+    return this.applyPatch({ proposalId: createEditProposal({ changes }).proposalId, changes });
+  }
+  async applyPatch(input) {
+    return this.applyPatchWithModes(input, new Map);
+  }
+  async applyPatchWithModes(input, modes, assertActive) {
+    return withWorkspaceMutation(this.root, () => this.applyPatchWithModesLocked(input, modes, assertActive));
+  }
+  async applyPatchWithModesLocked(input, modes, assertActive) {
+    const proposal = validateEditProposal(input);
+    this.checkAuditCapacity(proposal.changes.length);
+    const targetPaths = new Set(proposal.changes.map((change) => change.path));
+    for (const [targetPath, binding] of modes) {
+      if (!targetPaths.has(targetPath)) {
+        throw new HarnessWorkspaceError(`Patch mode binding has no matching content target: ${targetPath}.`);
+      }
+      for (const [label, mode] of [["before", binding.beforeMode], ["after", binding.afterMode]]) {
+        if (mode !== undefined && (!Number.isSafeInteger(mode) || mode < 0 || mode > 511)) {
+          throw new HarnessWorkspaceError(`Patch ${label} mode must be an integer between 0 and 0777: ${targetPath}.`);
+        }
+      }
+    }
+    const ordered = [...proposal.changes].sort((a, b) => a.path < b.path ? -1 : 1);
+    for (let index = 1;index < ordered.length; index += 1) {
+      const previous = ordered[index - 1];
+      const current = ordered[index];
+      if (previous && current && current.path.startsWith(`${previous.path}/`)) {
+        throw new HarnessWorkspaceError(`Patch targets conflict as ancestor and descendant: ${previous.path}, ${current.path}.`);
+      }
+    }
+    const prepared = [];
+    try {
+      for (const change of proposal.changes) {
+        const safe = await this.safePath(change.path, { allowMissing: true });
+        const modeBinding = modes.get(change.path);
+        let before;
+        if (change.expectedDigest === null) {
+          if (safe.exists)
+            throw new HarnessWorkspaceError(`The patch target already exists: ${change.path}.`);
+          if (modeBinding?.beforeMode !== undefined) {
+            throw new HarnessWorkspaceError(`Create-only patch mode binding cannot declare a before mode: ${change.path}.`);
+          }
+        } else {
+          if (!safe.exists)
+            throw new HarnessWorkspaceError(`The patch target no longer exists: ${change.path}.`);
+          before = await this.readStableFile(change.path);
+          if (before.digest !== change.expectedDigest) {
+            throw new HarnessWorkspaceError(`Stale patch rejected for ${change.path}: expected ${change.expectedDigest}, found ${before.digest}.`);
+          }
+          if (modeBinding?.beforeMode !== undefined && before.mode !== modeBinding.beforeMode) {
+            throw new HarnessWorkspaceError(`Stale patch mode rejected for ${change.path}: expected ${modeBinding.beforeMode.toString(8)}, found ${before.mode.toString(8)}.`);
+          }
+        }
+        const temporary = await this.stageFile(safe.path, change.content, modeBinding?.afterMode ?? before?.mode ?? 420);
+        prepared.push({
+          change,
+          target: safe.path,
+          ...before ? { before } : {},
+          ...modeBinding ? { modeBinding } : {},
+          temporary
+        });
+      }
+    } catch (error) {
+      await Promise.all(prepared.map((item) => unlink(item.temporary).catch(() => {})));
+      throw error;
+    }
+    const committed = [];
+    try {
+      for (const item of prepared) {
+        await this.safePath(item.change.path, { allowMissing: item.change.expectedDigest === null });
+        if (item.before) {
+          const current = await this.readStableFile(item.change.path);
+          if (current.digest !== item.change.expectedDigest)
+            throw new HarnessWorkspaceError(`Stale patch rejected for ${item.change.path}.`);
+          if (item.modeBinding?.beforeMode !== undefined && current.mode !== item.modeBinding.beforeMode) {
+            throw new HarnessWorkspaceError(`Stale patch mode rejected for ${item.change.path}.`);
+          }
+          await assertActive?.();
+          await rename(item.temporary, item.target);
+        } else {
+          try {
+            await assertActive?.();
+            await link(item.temporary, item.target);
+          } catch (error) {
+            if (error.code === "EEXIST") {
+              throw new HarnessWorkspaceError(`The patch target was created concurrently: ${item.change.path}.`);
+            }
+            throw error;
+          }
+          await unlink(item.temporary);
+        }
+        committed.push(item);
+        await assertActive?.();
+      }
+    } catch (error) {
+      const rollbackErrors = [];
+      for (const item of [...committed].reverse()) {
+        try {
+          if (item.before) {
+            const rollback = await this.stageFile(item.target, item.before.contents, item.before.mode);
+            await rename(rollback, item.target);
+          } else {
+            await unlink(item.target);
+          }
+        } catch (rollbackError) {
+          rollbackErrors.push(rollbackError);
+        }
+      }
+      await Promise.all(prepared.map((item) => unlink(item.temporary).catch(() => {})));
+      if (rollbackErrors.length)
+        throw new AggregateError([error, ...rollbackErrors], "Patch failed and rollback was incomplete.");
+      throw error;
+    }
+    this.invalidateWorkspaceIndex();
+    const changes = [];
+    for (const item of prepared)
+      changes.push(await this.audit({
+        operation: item.before ? "update" : "create",
+        path: item.change.path,
+        ...item.before ? { beforeDigest: item.before.digest } : {},
+        afterDigest: digestBytes(item.change.content)
+      }));
+    return { proposalId: proposal.proposalId, changes };
+  }
+  async writeFile(relativePath, content, overwrite = false) {
+    const safe = await this.safePath(relativePath, { allowMissing: true });
+    if (safe.exists && !overwrite)
+      throw new HarnessWorkspaceError("The file already exists; use applyPatch with its expected digest.");
+    const before = safe.exists ? await this.readStableFile(relativePath) : undefined;
+    const changes = [{ path: relativePath, expectedDigest: before?.digest ?? null, content }];
+    const proposal = createEditProposal({ changes });
+    await this.applyPatch({ proposalId: proposal.proposalId, changes });
+    return { path: relativePath, bytes: Buffer.byteLength(content), overwritten: Boolean(before) };
+  }
+  async replaceInFile(relativePath, oldText, newText) {
+    if (!oldText)
+      throw new HarnessWorkspaceError("oldText cannot be empty.");
+    const before = await this.readStableFile(relativePath, false);
+    const contents = before.contents.toString("utf8");
+    const occurrences = contents.split(oldText).length - 1;
+    if (occurrences !== 1)
+      throw new HarnessWorkspaceError(`oldText must occur exactly once; found ${occurrences} occurrences.`);
+    const updated = contents.replace(oldText, newText);
+    const changes = [{ path: relativePath, expectedDigest: before.digest, content: updated }];
+    const proposal = createEditProposal({ changes });
+    await this.applyPatch({ proposalId: proposal.proposalId, changes });
+    return { path: relativePath, beforeBytes: before.contents.byteLength, afterBytes: Buffer.byteLength(updated) };
+  }
+  async moveFile(input) {
+    return withWorkspaceMutation(this.root, () => this.moveFileLocked(input));
+  }
+  async moveFileLocked(input) {
+    const parsed = moveFileInputSchema.parse(input);
+    this.checkAuditCapacity();
+    const source = await this.readStableFile(parsed.source);
+    if (source.digest !== parsed.expectedDigest)
+      throw new HarnessWorkspaceError(`Stale move rejected for ${parsed.source}.`);
+    const destination = await this.safePath(parsed.destination, { allowMissing: true });
+    if (destination.exists)
+      throw new HarnessWorkspaceError(`Move destination already exists: ${parsed.destination}.`);
+    await this.secureWorkspaceDirectory(path2.dirname(destination.path));
+    const destinationRecheck = await this.safePath(parsed.destination, { allowMissing: true });
+    if (destinationRecheck.exists)
+      throw new HarnessWorkspaceError(`Move destination already exists: ${parsed.destination}.`);
+    if ((await this.readStableFile(parsed.source)).digest !== parsed.expectedDigest)
+      throw new HarnessWorkspaceError(`Stale move rejected for ${parsed.source}.`);
+    let linked = false;
+    try {
+      await link(source.absolutePath, destination.path);
+      linked = true;
+      const linkedFile = await this.readStableFile(parsed.destination);
+      if (linkedFile.digest !== source.digest) {
+        throw new HarnessWorkspaceError(`Move destination changed before commit: ${parsed.destination}.`);
+      }
+      await unlink(source.absolutePath);
+    } catch (error) {
+      if (linked)
+        await unlink(destination.path).catch(() => {});
+      throw error;
+    }
+    this.invalidateWorkspaceIndex();
+    const audit = await this.audit({ operation: "move", path: parsed.source, destination: parsed.destination, beforeDigest: source.digest, afterDigest: source.digest });
+    return { source: parsed.source, destination: parsed.destination, digest: source.digest, audit };
+  }
+  async secureQuarantineDirectory(create) {
+    const segments = [".zhivex-harness", "quarantine"];
+    let current = this.root;
+    for (const segment of segments) {
+      current = path2.join(current, segment);
+      try {
+        const entry = await lstat2(current);
+        if (entry.isSymbolicLink()) {
+          throw new HarnessWorkspaceError("Harness quarantine must not resolve through a symbolic link.");
+        }
+        if (!entry.isDirectory()) {
+          throw new HarnessWorkspaceError("Harness quarantine path contains a non-directory entry.");
+        }
+      } catch (error) {
+        if (error.code !== "ENOENT" || !create)
+          throw error;
+        try {
+          await mkdir2(current, { mode: 448 });
+        } catch (mkdirError) {
+          if (mkdirError.code !== "EEXIST")
+            throw mkdirError;
+          const racedEntry = await lstat2(current);
+          if (racedEntry.isSymbolicLink() || !racedEntry.isDirectory()) {
+            throw new HarnessWorkspaceError("Harness quarantine path changed during creation.");
+          }
+        }
+      }
+    }
+    const resolved = await realpath2(current);
+    if (!isInside(this.root, resolved))
+      throw new HarnessWorkspaceError("Harness quarantine resolves outside the workspace.");
+    return resolved;
+  }
+  async writeManifest(manifest) {
+    const directory = await this.secureQuarantineDirectory(true);
+    const target = path2.join(directory, `${manifest.quarantineId}.json`);
+    const temporary = await this.stageFile(target, `${JSON.stringify(manifest, null, 2)}
+`, 384);
+    await rename(temporary, target);
+  }
+  async readInternalRegularFile(target, label, maxBytes) {
+    return await readRegularFileNoFollow(target, { label, maxBytes });
+  }
+  async quarantineFile(input, assertActive) {
+    return withWorkspaceMutation(this.root, () => this.quarantineFileLocked(input, assertActive));
+  }
+  async quarantineFileLocked(input, assertActive) {
+    const parsed = quarantineFileInputSchema.parse(input);
+    this.checkAuditCapacity();
+    const source = await this.readStableFile(parsed.path);
+    if (source.digest !== parsed.expectedDigest)
+      throw new HarnessWorkspaceError(`Stale quarantine rejected for ${parsed.path}.`);
+    const quarantineId = `${Date.now()}-${randomUUID()}`;
+    const directory = await this.secureQuarantineDirectory(true);
+    const dataPath = path2.join(directory, `${quarantineId}.data`);
+    if ((await this.readStableFile(parsed.path)).digest !== parsed.expectedDigest)
+      throw new HarnessWorkspaceError(`Stale quarantine rejected for ${parsed.path}.`);
+    await link(source.absolutePath, dataPath);
+    if (digestBytes((await this.readInternalRegularFile(dataPath, "Quarantine payload", MAX_FILE_BYTES)).contents) !== source.digest) {
+      await unlink(dataPath).catch(() => {});
+      throw new HarnessWorkspaceError(`Quarantine payload changed before commit: ${parsed.path}.`);
+    }
+    const manifest = {
+      schemaVersion: 1,
+      quarantineId,
+      originalPath: parsed.path,
+      digest: source.digest,
+      mode: source.mode,
+      status: "quarantined",
+      createdAt: new Date().toISOString()
+    };
+    try {
+      await this.writeManifest(manifest);
+      await assertActive?.();
+      await unlink(source.absolutePath);
+    } catch (error) {
+      await unlink(dataPath).catch(() => {});
+      await unlink(path2.join(directory, `${quarantineId}.json`)).catch(() => {});
+      throw error;
+    }
+    this.invalidateWorkspaceIndex();
+    const audit = await this.audit({ operation: "quarantine", path: parsed.path, beforeDigest: source.digest, quarantineId });
+    return { quarantineId, path: parsed.path, digest: source.digest, audit };
+  }
+  async restoreQuarantined(input) {
+    return withWorkspaceMutation(this.root, () => this.restoreQuarantinedLocked(input));
+  }
+  async restoreQuarantinedLocked(input) {
+    const parsed = restoreFileInputSchema.parse(input);
+    this.checkAuditCapacity();
+    const directory = await this.secureQuarantineDirectory(false);
+    let manifest;
+    try {
+      const manifestFile = await this.readInternalRegularFile(path2.join(directory, `${parsed.quarantineId}.json`), "Quarantine manifest", 64 * 1024);
+      manifest = JSON.parse(manifestFile.contents.toString("utf8"));
+    } catch {
+      throw new HarnessWorkspaceError(`Quarantine entry was not found: ${parsed.quarantineId}.`);
+    }
+    if (manifest.schemaVersion !== 1 || manifest.quarantineId !== parsed.quarantineId || manifest.status !== "quarantined") {
+      throw new HarnessWorkspaceError(`Quarantine entry is not restorable: ${parsed.quarantineId}.`);
+    }
+    const dataPath = path2.join(directory, `${parsed.quarantineId}.data`);
+    const dataFile = await this.readInternalRegularFile(dataPath, "Quarantine payload", MAX_FILE_BYTES);
+    const digest = digestBytes(dataFile.contents);
+    if (digest !== manifest.digest || parsed.expectedDigest && parsed.expectedDigest !== digest) {
+      throw new HarnessWorkspaceError(`Quarantine digest mismatch: ${parsed.quarantineId}.`);
+    }
+    const destinationPath = parsed.destination ?? manifest.originalPath;
+    const destination = await this.safePath(destinationPath, { allowMissing: true });
+    if (destination.exists)
+      throw new HarnessWorkspaceError(`Restore destination already exists: ${destinationPath}.`);
+    await this.secureWorkspaceDirectory(path2.dirname(destination.path));
+    const destinationRecheck = await this.safePath(destinationPath, { allowMissing: true });
+    if (destinationRecheck.exists)
+      throw new HarnessWorkspaceError(`Restore destination already exists: ${destinationPath}.`);
+    const dataRecheck = await lstat2(dataPath);
+    if (dataRecheck.isSymbolicLink() || !dataRecheck.isFile() || dataRecheck.dev !== dataFile.stat.dev || dataRecheck.ino !== dataFile.stat.ino || dataRecheck.size !== dataFile.stat.size || dataRecheck.mtimeMs !== dataFile.stat.mtimeMs) {
+      throw new HarnessWorkspaceError("Quarantine payload changed before restore commit.");
+    }
+    await link(dataPath, destination.path);
+    const linkedDestination = await this.readInternalRegularFile(destination.path, "Restore destination", MAX_FILE_BYTES);
+    if (linkedDestination.stat.dev !== dataFile.stat.dev || linkedDestination.stat.ino !== dataFile.stat.ino || digestBytes(linkedDestination.contents) !== digest) {
+      await unlink(destination.path).catch(() => {});
+      throw new HarnessWorkspaceError("Restore destination did not match the quarantined payload.");
+    }
+    const restoredManifest = {
+      ...manifest,
+      status: "restored",
+      restoredAt: new Date().toISOString(),
+      restoredPath: destinationPath
+    };
+    try {
+      await this.writeManifest(restoredManifest);
+    } catch (error) {
+      await unlink(destination.path).catch(() => {});
+      throw error;
+    }
+    try {
+      await unlink(dataPath);
+    } catch (error) {
+      const rollbackErrors = [];
+      try {
+        await this.writeManifest(manifest);
+      } catch (rollbackError) {
+        rollbackErrors.push(rollbackError);
+      }
+      try {
+        await unlink(destination.path);
+      } catch (rollbackError) {
+        rollbackErrors.push(rollbackError);
+      }
+      throw rollbackErrors.length ? new AggregateError([error, ...rollbackErrors], "Restore failed and rollback was incomplete.") : error;
+    }
+    this.invalidateWorkspaceIndex();
+    const audit = await this.audit({ operation: "restore", path: destinationPath, afterDigest: digest, quarantineId: parsed.quarantineId });
+    return { quarantineId: parsed.quarantineId, path: destinationPath, digest, audit };
+  }
+  async runCheck(check, expectedScript, allowedChecks = DEFAULT_CHECKS) {
+    let manifest;
+    try {
+      manifest = JSON.parse((await this.readStableFile("package.json", false)).contents.toString("utf8"));
+    } catch (error) {
+      if (error.code === "ENOENT")
+        throw new HarnessWorkspaceError("The workspace does not contain a package.json file.");
+      throw error;
+    }
+    const resolved = await resolvePackageCheckCommand(this.root, manifest, check, expectedScript, allowedChecks);
+    try {
+      return await spawnBounded(resolved.command, this.root);
+    } finally {
+      this.invalidateWorkspaceIndex();
+    }
+  }
+  async gitDiff() {
+    const [statusDiscovery, diffDiscovery, stagedDiscovery] = await Promise.all([
+      gitDiscovery(gitCommand("status", "--short", "--untracked-files=all", "--ignore-submodules=all", "-z"), this.root),
+      gitDiscovery(gitCommand("diff", "--name-status", "-z", "--no-ext-diff", "--no-textconv", "--ignore-submodules=all"), this.root),
+      gitDiscovery(gitCommand("diff", "--cached", "--name-status", "-z", "--no-ext-diff", "--no-textconv", "--ignore-submodules=all"), this.root)
+    ]);
+    const statusResult = filteredGitStatus(statusDiscovery);
+    const [diffResult, stagedResult] = await Promise.all([
+      runFilteredGitDiff(diffDiscovery, this.root, false),
+      runFilteredGitDiff(stagedDiscovery, this.root, true)
+    ]);
+    return { status: statusResult, diff: diffResult, staged: stagedResult };
+  }
+}
+
+// src/execution/patch-diagnostics.ts
+class EnvironmentPatchDriftError extends Error {
+  diagnosticCode;
+  constructor(expected, current, lastInspected) {
+    super("Environment patch changed after review; inspect it again before import.");
+    this.diagnosticCode = typeof lastInspected !== "string" || !/^sha256:[a-f0-9]{64}$/.test(lastInspected) ? "OCI_PATCH_REVIEW_UNAVAILABLE" : expected === lastInspected ? "OCI_PATCH_SNAPSHOT_CHANGED" : current === lastInspected ? "OCI_PATCH_ID_MISMATCH" : "OCI_PATCH_REVIEW_UNAVAILABLE";
+  }
+}
+
+// src/execution/acceptance-snapshot.ts
+import { createHash as createHash3 } from "node:crypto";
+import { lstat as lstat3, readdir as readdir2 } from "node:fs/promises";
+import path3 from "node:path";
+async function acceptanceSnapshotDigest(root, maxBytes) {
+  const rows = [];
+  let bytes = 0;
+  async function visit(relative) {
+    const names = await readdir2(path3.join(root, relative));
+    names.sort();
+    for (const name of names) {
+      const item = relative ? relative + "/" + name : name;
+      if (rows.length >= 20000)
+        throw new Error("TASK_ACCEPTANCE_SNAPSHOT_CAPACITY");
+      const absolute = path3.join(root, item), entry = await lstat3(absolute);
+      if (entry.isSymbolicLink())
+        throw new Error("TASK_ACCEPTANCE_SNAPSHOT_UNSAFE");
+      if (entry.isDirectory()) {
+        rows.push([item, "directory", entry.mode & 511, null]);
+        await visit(item);
+      } else if (entry.isFile() && entry.nlink === 1) {
+        const file = await readRegularFileNoFollow(absolute, { label: "Acceptance snapshot file", maxBytes: maxBytes - bytes, requireSingleLink: true });
+        bytes += file.contents.byteLength;
+        rows.push([item, "file", file.stat.mode & 511, createHash3("sha256").update(file.contents).digest("hex")]);
+      } else
+        throw new Error("TASK_ACCEPTANCE_SNAPSHOT_UNSAFE");
+    }
+  }
+  await visit("");
+  return "sha256:" + createHash3("sha256").update(JSON.stringify(rows)).digest("hex");
+}
+
+// src/execution/oci-observability.ts
+import { channel } from "node:diagnostics_channel";
+var diagnostics = channel("zhivex.harness.oci.phase");
+var sequence = 0;
+async function observeOciPhase(operation, action) {
+  if (!diagnostics.hasSubscribers)
+    return action();
+  const id = ++sequence;
+  diagnostics.publish({ id, operation, outcome: "running" });
+  try {
+    const result = await action();
+    const timedOut = !!result && typeof result === "object" && "timedOut" in result && result.timedOut === true;
+    diagnostics.publish({ id, operation, outcome: timedOut ? "failed" : "completed", timedOut });
+    return result;
+  } catch (error) {
+    diagnostics.publish({ id, operation, outcome: "failed" });
+    throw error;
+  }
+}
+
+// src/execution/execution-environment.ts
+import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
+import { spawn } from "node:child_process";
+import { constants as fsConstants } from "node:fs";
+import {
+  chmod,
+  copyFile,
+  lstat as lstat4,
+  mkdir as mkdir3,
+  readdir as readdir3,
+  realpath as realpath3,
+  rename as rename2,
+  rm,
+  writeFile
+} from "node:fs/promises";
+import path4 from "node:path";
+import { createAgentExecutionEnvironmentBinding } from "@zhivex-ai/agents/beta";
+var HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION = 1;
+var HARNESS_OCI_LABEL = "com.zhivex.harness.execution";
+var HARNESS_OCI_LABEL_VALUE = "v1";
+var HARNESS_OCI_OWNER_PID_LABEL = "com.zhivex.harness.owner-pid";
+var TERMINAL_STATUSES = new Set([
+  "completed",
+  "failed",
+  "cancelled",
+  "timed_out"
+]);
+var EXECUTION_ARTIFACT_DIRECTORY_PATTERN = /^[a-f0-9]{24}$/;
+var STAGED_EXECUTION_ARTIFACT_DIRECTORY_PATTERN = /^\.cleanup-([a-f0-9]{24})-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/;
+var BUILT_IN_TOOL_NAMES = new Set([
+  "__harness_result_feedback",
+  "read_dependency",
+  "read_task",
+  "repair_plan",
+  "list_files",
+  "read_file",
+  "read_files",
+  "search_files",
+  "search_many",
+  "load_skill",
+  "propose_edits",
+  "apply_patch",
+  "apply_reviewed_edits",
+  "apply_reviewed_replacement",
+  "move_file",
+  "quarantine_file",
+  "restore_file",
+  "run_check",
+  "mutation_audit",
+  "git_diff",
+  "run_environment_command",
+  "run_environment_batch",
+  "run_environment_shell",
+  "inspect_environment_patch",
+  "apply_environment_patch",
+  "verify_and_apply_environment_patch",
+  "verify_and_apply_reviewed_edits",
+  "environment_status"
+]);
+var digest = (value) => `sha256:${createHash4("sha256").update(value).digest("hex")}`;
+var executionScopeKey = (scope) => {
+  if (scope) {
+    for (const value of [scope.tenantId, scope.userId, scope.namespace]) {
+      if (value !== undefined && (typeof value !== "string" || !value || value.includes("\x00"))) {
+        throw new Error("Invalid OCI execution scope.");
+      }
+    }
+    if (!scope.tenantId)
+      throw new Error("OCI execution scope requires tenantId.");
+  }
+  return JSON.stringify([scope?.tenantId ?? null, scope?.userId ?? null, scope?.namespace ?? null]);
+};
+var executionIdentity = (workspace, stateDirectory, runId, scopeKey) => digest(JSON.stringify(["scoped-oci-v2", workspace, stateDirectory, scopeKey, runId]));
+var runHash = (runId) => createHash4("sha256").update(runId).digest("hex").slice(0, 24);
+var isInside2 = (root, candidate) => {
+  const relative = path4.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path4.sep}`) && !path4.isAbsolute(relative);
+};
+var privateDirectory = async (directory) => {
+  await mkdir3(directory, { recursive: true, mode: 448 });
+  const entry = await lstat4(directory);
+  if (entry.isSymbolicLink() || !entry.isDirectory()) {
+    throw new Error(`Execution artifact directory must be a real directory: ${directory}.`);
+  }
+  await chmod(directory, 448);
+};
+var atomicJson = async (target, value) => {
+  const temporary = `${target}.${randomUUID2()}.tmp`;
+  await writeFile(temporary, `${JSON.stringify(value, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  await rename2(temporary, target);
+};
+var commandDisplay = (command) => command.map((value) => /^[A-Za-z0-9_./:=+-]+$/.test(value) ? value : JSON.stringify(value)).join(" ");
+var elapsedMilliseconds = (startedAt) => Number(process.hrtime.bigint() - startedAt) / 1e6;
+var spawnBounded2 = async (command, options) => {
+  const child = spawn(command[0], command.slice(1), {
+    ...options.cwd ? { cwd: options.cwd } : {},
+    env: options.env ?? {},
+    stdio: [options.input === undefined ? "ignore" : "pipe", "pipe", "pipe"]
+  });
+  if (options.input !== undefined) {
+    child.stdin?.on("error", () => {
+      return;
+    });
+    child.stdin?.end(options.input);
+  }
+  let timedOut = false;
+  let cancelled = false;
+  let outputLimitExceeded = false;
+  let stopped = false;
+  let retainedOutputBytes = 0;
+  let totalOutputBytes = 0;
+  const stop = (reason) => {
+    if (!stopped) {
+      stopped = true;
+      options.onStop?.(reason);
+      child.kill("SIGKILL");
+    }
+  };
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    stop("timeout");
+  }, options.timeoutMs);
+  const onAbort = () => {
+    cancelled = true;
+    stop("cancelled");
+  };
+  if (options.abortSignal?.aborted) {
+    onAbort();
+  } else {
+    options.abortSignal?.addEventListener("abort", onAbort, { once: true });
+  }
+  const consume = async (stream) => {
+    const chunks = [];
+    let omittedBytes = 0;
+    for await (const value of stream) {
+      const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
+      totalOutputBytes += chunk.byteLength;
+      if (retainedOutputBytes < options.maxOutputBytes) {
+        const remaining = options.maxOutputBytes - retainedOutputBytes;
+        const kept = chunk.byteLength <= remaining ? chunk : chunk.subarray(0, remaining);
+        chunks.push(kept);
+        retainedOutputBytes += kept.byteLength;
+        omittedBytes += chunk.byteLength - kept.byteLength;
+      } else {
+        omittedBytes += chunk.byteLength;
+      }
+      if (totalOutputBytes > options.maxOutputBytes) {
+        outputLimitExceeded = true;
+        stop("output-limit");
+      }
+    }
+    const text = new TextDecoder().decode(Buffer.concat(chunks));
+    return omittedBytes > 0 ? `${text}
+… output limit exceeded (${omittedBytes} bytes omitted)` : text;
+  };
+  const exited = new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (exitCode) => resolve(exitCode ?? 137));
+  });
+  try {
+    const [stdout, stderr, exitCode] = await Promise.all([
+      consume(child.stdout),
+      consume(child.stderr),
+      exited
+    ]);
+    return {
+      command,
+      exitCode,
+      stdout,
+      stderr,
+      timedOut,
+      cancelled,
+      outputLimitExceeded
+    };
+  } finally {
+    clearTimeout(timeout);
+    options.abortSignal?.removeEventListener("abort", onAbort);
+  }
+};
+var parseRuntimeVersion = (stdout, runtime) => {
+  const version = stdout.trim();
+  if (!version)
+    throw new Error(`${runtime} did not report a server version.`);
+  return version;
+};
+var validContainerIds = (stdout) => stdout.split(/\r?\n/).map((value) => value.trim()).filter((value) => /^[a-f0-9]{12,64}$/.test(value));
+var validVolumeNames = (stdout) => stdout.split(/\r?\n/).map((value) => value.trim()).filter((value) => /^zhivex-harness-[A-Za-z0-9_.-]+$/.test(value));
+var hostProcessIsAlive = (pid) => {
+  if (!Number.isSafeInteger(pid) || pid < 1)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
+var MAX_SYNC_ENTRIES = 1e4;
+var updateSnapshotMetadata = (target, kind, relative, entry) => {
+  target.update([
+    kind,
+    relative,
+    entry.dev,
+    entry.ino,
+    entry.size,
+    entry.mtimeMs,
+    entry.ctimeMs,
+    entry.mode & 511
+  ].join("\x00"));
+  target.update("\x00");
+};
+var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspaceBytes, maxFileWriteBytes) => {
+  let entries = 0;
+  let totalBytes = 0;
+  const seal = createHash4("sha256");
+  const metadata = createHash4("sha256");
+  const visit = async (directory, relativeDirectory = "") => {
+    const children = (await readdir3(directory, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name));
+    for (const child of children) {
+      const name = child.name;
+      const relative = relativeDirectory ? `${relativeDirectory}/${name}` : name;
+      const absolute = path4.join(directory, name);
+      if (!isInside2(stagedRoot, absolute) || relative.length > 1024) {
+        throw new Error(`OCI workspace export contains an invalid path: ${relative}.`);
+      }
+      entries += 1;
+      if (entries > MAX_SYNC_ENTRIES) {
+        throw new Error(`OCI workspace export exceeds the ${MAX_SYNC_ENTRIES}-entry limit.`);
+      }
+      if (relative === "node_modules") {
+        await rm(absolute, { recursive: true, force: true });
+        continue;
+      }
+      if (child.isSymbolicLink()) {
+        throw new Error(`OCI workspace export contains a symbolic link: ${relative}.`);
+      }
+      if (child.isDirectory()) {
+        const directoryEntry = await lstat4(absolute);
+        if (directoryEntry.isSymbolicLink() || !directoryEntry.isDirectory()) {
+          throw new Error(`OCI workspace export directory changed while it was being validated: ${relative}.`);
+        }
+        updateSnapshotMetadata(metadata, "directory", relative, directoryEntry);
+        seal.update(`directory\x00${relative}\x00${directoryEntry.mode & 511}\x00`);
+        await visit(absolute, relative);
+        continue;
+      }
+      if (!child.isFile()) {
+        throw new Error(`OCI workspace export contains a special or linked file: ${relative}.`);
+      }
+      let file;
+      try {
+        file = await readRegularFileNoFollow(absolute, {
+          label: `OCI workspace export file ${relative}`,
+          maxBytes: maxWorkspaceBytes - totalBytes,
+          requireSingleLink: true
+        });
+      } catch (error) {
+        if (error instanceof FileSizeLimitError) {
+          throw new Error(`OCI workspace export exceeds the ${maxWorkspaceBytes}-byte workspace limit.`);
+        }
+        throw error;
+      }
+      const contents = file.contents;
+      const entry = file.stat;
+      totalBytes += entry.size;
+      if (totalBytes > maxWorkspaceBytes) {
+        throw new Error(`OCI workspace export exceeds the ${maxWorkspaceBytes}-byte workspace limit.`);
+      }
+      const contentDigest = digest(contents);
+      updateSnapshotMetadata(metadata, "file", relative, entry);
+      seal.update(`file\x00${relative}\x00${entry.mode & 511}\x00${entry.size}\x00${contentDigest}\x00`);
+      if (entry.size > maxFileWriteBytes) {
+        const previous = path4.join(previousRoot, ...relative.split("/"));
+        let unchanged = false;
+        try {
+          const previousFile = await readRegularFileNoFollow(previous, {
+            label: `Previous OCI workspace file ${relative}`,
+            maxBytes: entry.size
+          });
+          unchanged = previousFile.stat.size === entry.size && digest(previousFile.contents) === contentDigest;
+        } catch (error) {
+          if (error.code !== "ENOENT")
+            throw error;
+        }
+        if (!unchanged) {
+          throw new Error(`OCI command wrote a file above the ${maxFileWriteBytes}-byte limit: ${relative}.`);
+        }
+      }
+    }
+  };
+  await visit(stagedRoot);
+  return {
+    entries,
+    totalBytes,
+    seal: `sha256:${seal.digest("hex")}`,
+    metadataFingerprint: `sha256:${metadata.digest("hex")}`
+  };
+};
+var snapshotMetadataFingerprint = async (root, maxWorkspaceBytes) => {
+  let entries = 0;
+  let totalBytes = 0;
+  const metadata = createHash4("sha256");
+  const visit = async (directory, relativeDirectory = "") => {
+    for (const name of (await readdir3(directory)).sort()) {
+      const relative = relativeDirectory ? `${relativeDirectory}/${name}` : name;
+      if (relative === "node_modules")
+        continue;
+      const absolute = path4.join(directory, name);
+      if (!isInside2(root, absolute) || relative.length > 1024) {
+        throw new Error(`OCI workspace snapshot contains an invalid path: ${relative}.`);
+      }
+      entries += 1;
+      if (entries > MAX_SYNC_ENTRIES) {
+        throw new Error(`OCI workspace snapshot exceeds the ${MAX_SYNC_ENTRIES}-entry limit.`);
+      }
+      const entry = await lstat4(absolute);
+      if (entry.isSymbolicLink()) {
+        throw new Error(`OCI workspace snapshot contains a symbolic link: ${relative}.`);
+      }
+      if (entry.isDirectory()) {
+        updateSnapshotMetadata(metadata, "directory", relative, entry);
+        await visit(absolute, relative);
+        continue;
+      }
+      if (!entry.isFile() || entry.nlink !== 1) {
+        throw new Error(`OCI workspace snapshot contains a special or linked file: ${relative}.`);
+      }
+      totalBytes += entry.size;
+      if (totalBytes > maxWorkspaceBytes) {
+        throw new Error(`OCI workspace snapshot exceeds the ${maxWorkspaceBytes}-byte workspace limit.`);
+      }
+      updateSnapshotMetadata(metadata, "file", relative, entry);
+    }
+  };
+  await visit(root);
+  return `sha256:${metadata.digest("hex")}`;
+};
+var replaceSnapshot = async (snapshotRoot, stagedRoot) => {
+  const backupRoot = `${snapshotRoot}.${randomUUID2()}.previous`;
+  await rename2(snapshotRoot, backupRoot);
+  try {
+    await rename2(stagedRoot, snapshotRoot);
+  } catch (error) {
+    await rename2(backupRoot, snapshotRoot).catch(() => {
+      return;
+    });
+    throw error;
+  }
+  await rm(backupRoot, { recursive: true, force: true });
+};
+var OCI_BACKGROUND_PROCESS_MARKER = "ZHIVEX_HARNESS_BACKGROUND_PROCESS";
+var OCI_COMMAND_TIMEOUT_MARKER = "ZHIVEX_HARNESS_COMMAND_TIMEOUT";
+var OCI_ATTESTATION_TIMEOUT_MS = 60000;
+var OCI_ATTESTATION_PROTOCOL_BYTES = 160;
+var OCI_ATTESTATION_PATTERN = /\nZHIVEX_HARNESS_ATTESTATION:(sha256:[a-f0-9]{64})\n$/;
+var OCI_COMMAND_RUNNER_SCRIPT = [
+  "import { createHash } from 'node:crypto';",
+  "import { spawn } from 'node:child_process';",
+  "import { readFileSync } from 'node:fs';",
+  "import { lstat, readFile, readdir, readlink, rm } from 'node:fs/promises';",
+  "import path from 'node:path';",
+  "const request=JSON.parse(readFileSync(0,'utf8'));",
+  "if(!Array.isArray(request.commands)||request.commands.length===0||!request.commands.every((command)=>Array.isArray(command)&&command.length>0&&command.every((value)=>typeof value==='string')))throw new Error('invalid OCI command batch');",
+  "if(!Number.isSafeInteger(request.maxProcessRuntimeMs)||request.maxProcessRuntimeMs<1)throw new Error('invalid OCI command timeout');",
+  "const deadline=Date.now()+request.maxProcessRuntimeMs;",
+  "const run=async(command,timeoutMs)=>await new Promise((resolve,reject)=>{",
+  "const child=spawn(command[0],command.slice(1),{stdio:['ignore','inherit','inherit'],detached:true});",
+  "let settled=false;let timedOut=false;",
+  "const finish=(value,error)=>{if(settled)return;settled=true;clearTimeout(timer);error?reject(error):resolve(value);};",
+  "const timer=setTimeout(()=>{timedOut=true;try{process.kill(-child.pid,'SIGKILL');}catch{}},timeoutMs);",
+  "child.once('error',(error)=>finish(undefined,error));",
+  "child.once('exit',(code)=>finish({exitCode:timedOut?124:(code??137),timedOut}));",
+  "});",
+  "for(const command of request.commands){const remaining=deadline-Date.now();if(remaining<=0){console.error('ZHIVEX_HARNESS_COMMAND_TIMEOUT');process.exit(124);}const result=await run(command,remaining);if(result.timedOut){console.error('ZHIVEX_HARNESS_COMMAND_TIMEOUT');process.exit(124);}if(result.exitCode!==0)process.exit(result.exitCode);}",
+  "const unexpectedProcesses=async()=>(await readdir('/proc')).filter((name)=>/^\\d+$/.test(name)).map(Number).filter((pid)=>pid!==1&&pid!==process.pid);",
+  "if((await unexpectedProcesses()).length>0){console.error('ZHIVEX_HARNESS_BACKGROUND_PROCESS');process.exit(126);}",
+  "const root='/workspace';",
+  "const seal=createHash('sha256');",
+  "const modules=path.join(root,'node_modules');",
+  "try{",
+  "if(request.hasDependencies===true){const entry=await lstat(modules);if(!entry.isSymbolicLink()||(await readlink(modules))!=='/dependencies')throw new Error('read-only dependency mount was replaced');}else{await rm(modules,{recursive:true,force:true});}",
+  "const digest=(value)=>`sha256:${createHash('sha256').update(value).digest('hex')}`;",
+  "const same=(before,after)=>before.dev===after.dev&&before.ino===after.ino&&before.size===after.size&&before.mtimeMs===after.mtimeMs&&before.ctimeMs===after.ctimeMs&&(before.mode&0o777)===(after.mode&0o777);",
+  "const visit=async(directory,base='')=>{",
+  "for(const name of (await readdir(directory)).sort()){",
+  "const relative=base?`${base}/${name}`:name;",
+  "if(relative==='node_modules')continue;",
+  "const absolute=path.join(directory,name);",
+  "const entry=await lstat(absolute);",
+  "if(entry.isSymbolicLink())throw new Error(`symbolic link: ${relative}`);",
+  "if(entry.isDirectory()){seal.update(`directory\\0${relative}\\0${entry.mode&0o777}\\0`);await visit(absolute,relative);continue;}",
+  "if(!entry.isFile()||entry.nlink!==1)throw new Error(`special or linked file: ${relative}`);",
+  "const contents=await readFile(absolute);",
+  "const after=await lstat(absolute);",
+  "if(!same(entry,after))throw new Error(`changed while sealing: ${relative}`);",
+  "seal.update(`file\\0${relative}\\0${entry.mode&0o777}\\0${entry.size}\\0${digest(contents)}\\0`);",
+  "}",
+  "};",
+  "await visit(root);",
+  "if((await unexpectedProcesses()).length>0){console.error('ZHIVEX_HARNESS_BACKGROUND_PROCESS');process.exit(126);}",
+  "for(const name of await readdir('/tmp'))await rm(path.join('/tmp',name),{recursive:true,force:true});",
+  "process.stdout.write(`\\nZHIVEX_HARNESS_ATTESTATION:sha256:${seal.digest('hex')}\\n`);",
+  "}catch(error){console.error(`ZHIVEX_HARNESS_ATTESTATION_FAILURE:${error instanceof Error?error.message:String(error)}`);process.exit(127);}"
+].join("");
+var OCI_SESSION_CONTROLLER_SCRIPT = "setInterval(()=>{},2147483647);";
+
+class CliOciRuntimeAdapter {
+  runtime;
+  hostEnvironment;
+  sessions = new Map;
+  runQueues = new Map;
+  constructor(runtime) {
+    this.runtime = runtime;
+    this.hostEnvironment = Object.fromEntries(["DOCKER_CONFIG", "DOCKER_CONTEXT", "DOCKER_HOST", "HOME", "PATH", "XDG_RUNTIME_DIR"].flatMap((name) => process.env[name] ? [[name, process.env[name]]] : []));
+  }
+  async cli(args, timeoutMs = 30000, maxOutputBytes = 1024 * 1024) {
+    const result = await spawnBounded2([this.runtime, ...args], {
+      env: this.hostEnvironment,
+      timeoutMs,
+      maxOutputBytes
+    });
+    if (result.exitCode !== 0 || result.timedOut || result.outputLimitExceeded) {
+      const detail = (result.stderr || result.stdout).trim();
+      throw new Error(`${this.runtime} ${args[0] ?? "command"} failed${detail ? `: ${detail}` : "."}`);
+    }
+    return result;
+  }
+  async inspectImage(image) {
+    return observeOciPhase("oci_inspect", () => this.inspectImageUnobserved(image));
+  }
+  async inspectImageUnobserved(image) {
+    const version = await this.cli(["version", "--format", "{{.Server.Version}}"]);
+    const inspected = await this.cli(["image", "inspect", image, "--format", "{{json .}}"]);
+    const document = JSON.parse(inspected.stdout);
+    if (typeof document.Id !== "string" || !/^sha256:[a-f0-9]{64}$/.test(document.Id)) {
+      throw new Error(`${this.runtime} returned an invalid immutable image id for ${image}.`);
+    }
+    const repoDigest = Array.isArray(document.RepoDigests) ? document.RepoDigests.find((value) => typeof value === "string" && /@sha256:[a-f0-9]{64}$/.test(value)) : undefined;
+    return {
+      runtime: this.runtime,
+      runtimeVersion: parseRuntimeVersion(version.stdout, this.runtime),
+      imageReference: image,
+      imageId: document.Id,
+      imageDigest: repoDigest?.slice(repoDigest.indexOf("@") + 1) ?? document.Id
+    };
+  }
+  async forceRemove(name) {
+    await spawnBounded2([this.runtime, "rm", "-f", name], {
+      env: this.hostEnvironment,
+      timeoutMs: 30000,
+      maxOutputBytes: 20000
+    }).catch(() => {
+      return;
+    });
+  }
+  async removeVolume(name) {
+    const result = await spawnBounded2([this.runtime, "volume", "rm", name], {
+      env: this.hostEnvironment,
+      timeoutMs: 30000,
+      maxOutputBytes: 20000
+    });
+    if (result.exitCode !== 0 && !/no such volume|not found/i.test(`${result.stderr}
+${result.stdout}`)) {
+      throw new Error(`${this.runtime} could not remove OCI workspace volume ${name}: ${result.stderr.trim()}`);
+    }
+  }
+  requestFingerprint(request) {
+    return digest(JSON.stringify({
+      runId: request.runId,
+      snapshotRoot: request.snapshotRoot,
+      dependencyRoot: request.dependencyRoot ?? null,
+      imageId: request.imageId,
+      limits: request.limits
+    }));
+  }
+  async withRunLock(runId, operation) {
+    const key = runHash(runId);
+    const previous = this.runQueues.get(key) ?? Promise.resolve();
+    let release;
+    const gate = new Promise((resolve) => {
+      release = resolve;
+    });
+    const tail = previous.then(() => gate, () => gate);
+    this.runQueues.set(key, tail);
+    await previous.catch(() => {
+      return;
+    });
+    try {
+      return await operation();
+    } finally {
+      release();
+      if (this.runQueues.get(key) === tail)
+        this.runQueues.delete(key);
+    }
+  }
+  async destroySession(...args) {
+    return observeOciPhase("oci_cleanup", () => this.destroySessionUnobserved(...args));
+  }
+  async destroySessionUnobserved(session) {
+    if (this.sessions.get(session.key) === session)
+      this.sessions.delete(session.key);
+    await this.forceRemove(session.name);
+    await this.removeVolume(session.volumeName);
+  }
+  async createSession(...args) {
+    return observeOciPhase("oci_create", () => this.createSessionUnobserved(...args));
+  }
+  async createSessionUnobserved(request, requestFingerprint, snapshotSeal, hostFingerprint) {
+    const resourceName = `zhivex-harness-${runHash(request.runId)}-${randomUUID2().slice(0, 8)}`;
+    const name = `${resourceName}-job`;
+    const volumeName = `${resourceName}-workspace`;
+    const uid = process.getuid?.() ?? 65532;
+    const gid = process.getgid?.() ?? 65532;
+    const volumeArgs = [
+      "volume",
+      "create",
+      "--driver",
+      "local",
+      "--opt",
+      "type=tmpfs",
+      "--opt",
+      "device=tmpfs",
+      "--opt",
+      `o=size=${request.limits.maxWorkspaceBytes},uid=${uid},gid=${gid},mode=0700,noexec,nosuid,nodev`,
+      "--label",
+      `${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
+      "--label",
+      `com.zhivex.harness.run=${runHash(request.runId)}`,
+      "--label",
+      `${HARNESS_OCI_OWNER_PID_LABEL}=${process.pid}`,
+      volumeName
+    ];
+    const args = [
+      "create",
+      "--name",
+      name,
+      "--label",
+      `${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
+      "--label",
+      `com.zhivex.harness.run=${runHash(request.runId)}`,
+      "--network",
+      "none",
+      "--read-only",
+      "--cap-drop",
+      "ALL",
+      "--security-opt",
+      "no-new-privileges",
+      "--pids-limit",
+      String(request.limits.maxPids),
+      "--memory",
+      `${request.limits.maxMemoryMb}m`,
+      "--cpus",
+      String(request.limits.maxCpus),
+      "--tmpfs",
+      `/tmp:rw,noexec,nosuid,nodev,size=${request.limits.tmpfsMb}m`,
+      "--volume",
+      `${volumeName}:/workspace`,
+      "--user",
+      `${uid}:${gid}`,
+      "--env",
+      "HOME=/tmp",
+      "--env",
+      "TMPDIR=/tmp",
+      "--env",
+      "NPM_CONFIG_CACHE=/tmp/npm-cache",
+      "--env",
+      "CI=1",
+      ...request.dependencyRoot ? ["--volume", `${request.dependencyRoot}:/dependencies:ro`] : [],
+      "--workdir",
+      "/workspace",
+      "--entrypoint",
+      "node",
+      request.imageId,
+      "--input-type=module",
+      "-e",
+      OCI_SESSION_CONTROLLER_SCRIPT
+    ];
+    let volumeCreated = false;
+    try {
+      await this.cli(volumeArgs);
+      volumeCreated = true;
+      await this.cli(args);
+      await this.cli(["start", name]);
+      await this.cli([
+        "cp",
+        "-a",
+        `${request.snapshotRoot}${path4.sep}.`,
+        `${name}:/workspace`
+      ], 60000);
+      if (request.dependencyRoot) {
+        await this.cli([
+          "exec",
+          "--workdir",
+          "/workspace",
+          "--user",
+          `${uid}:${gid}`,
+          name,
+          "node",
+          "--input-type=module",
+          "-e",
+          "import { symlink } from 'node:fs/promises'; await symlink('/dependencies', '/workspace/node_modules', 'dir')"
+        ]);
+      }
+      const session = {
+        key: runHash(request.runId),
+        requestFingerprint,
+        name,
+        volumeName,
+        snapshotSeal,
+        hostFingerprint
+      };
+      this.sessions.set(session.key, session);
+      return session;
+    } catch (error) {
+      await this.forceRemove(name);
+      if (volumeCreated)
+        await this.removeVolume(volumeName).catch(() => {
+          return;
+        });
+      throw error;
+    }
+  }
+  async runInSession(...args) {
+    return observeOciPhase("oci_execute", () => this.runInSessionUnobserved(...args));
+  }
+  async runInSessionUnobserved(request, session, sessionReused) {
+    const totalStartedAt = process.hrtime.bigint();
+    const uid = process.getuid?.() ?? 65532;
+    const gid = process.getgid?.() ?? 65532;
+    let forcedRemoval;
+    const forceRemove = () => {
+      forcedRemoval ??= this.forceRemove(session.name);
+    };
+    const commandStartedAt = process.hrtime.bigint();
+    const result = await spawnBounded2([
+      this.runtime,
+      "exec",
+      "-i",
+      "--workdir",
+      "/workspace",
+      "--user",
+      `${uid}:${gid}`,
+      session.name,
+      "node",
+      "--input-type=module",
+      "-e",
+      OCI_COMMAND_RUNNER_SCRIPT
+    ], {
+      env: this.hostEnvironment,
+      timeoutMs: request.limits.maxProcessRuntimeMs + OCI_ATTESTATION_TIMEOUT_MS,
+      maxOutputBytes: request.limits.maxProcessOutputBytes + OCI_ATTESTATION_PROTOCOL_BYTES,
+      input: JSON.stringify({
+        commands: request.commands,
+        maxProcessRuntimeMs: request.limits.maxProcessRuntimeMs,
+        hasDependencies: Boolean(request.dependencyRoot)
+      }),
+      ...request.abortSignal ? { abortSignal: request.abortSignal } : {},
+      onStop: forceRemove
+    });
+    const commandAndAttestationMs = elapsedMilliseconds(commandStartedAt);
+    const attestationMatch = result.exitCode === 0 ? result.stdout.match(OCI_ATTESTATION_PATTERN) : null;
+    const commandResult = attestationMatch ? { ...result, stdout: result.stdout.slice(0, -attestationMatch[0].length) } : result;
+    if (Buffer.byteLength(commandResult.stdout) + Buffer.byteLength(commandResult.stderr) > request.limits.maxProcessOutputBytes) {
+      commandResult.outputLimitExceeded = true;
+    }
+    const command = request.commands.length === 1 ? request.commands[0] : ["<oci-batch>", String(request.commands.length)];
+    const backgroundProcess = commandResult.exitCode === 126 && commandResult.stderr.includes(OCI_BACKGROUND_PROCESS_MARKER);
+    const commandTimedOut = commandResult.exitCode === 124 && commandResult.stderr.includes(OCI_COMMAND_TIMEOUT_MARKER);
+    const attestationFailure = commandResult.exitCode === 127 ? commandResult.stderr.match(/ZHIVEX_HARNESS_ATTESTATION_FAILURE:([^\r\n]*)/) : null;
+    if (commandResult.exitCode !== 0 || commandResult.timedOut || commandResult.cancelled || commandResult.outputLimitExceeded) {
+      forceRemove();
+      await forcedRemoval;
+      await this.destroySession(session);
+      if (attestationFailure) {
+        throw new Error(`OCI workspace attestation failed: ${attestationFailure[1] ?? "unknown failure"}.`);
+      }
+      return {
+        ...commandResult,
+        command,
+        commands: request.commands,
+        ...commandTimedOut ? { timedOut: true, exitCode: 124 } : {},
+        ...backgroundProcess ? {
+          exitCode: 126,
+          stderr: [
+            commandResult.stderr.replace(OCI_BACKGROUND_PROCESS_MARKER, "").trim(),
+            "OCI command left background processes running; its workspace changes were discarded."
+          ].filter(Boolean).join(`
+`)
+        } : {},
+        sessionReused,
+        workspacePublished: false,
+        workspaceExported: false,
+        phaseLatencies: {
+          commandAndAttestationMs,
+          totalMs: elapsedMilliseconds(totalStartedAt)
+        }
+      };
+    }
+    try {
+      if (!attestationMatch) {
+        throw new Error("OCI command attestation returned an invalid workspace seal.");
+      }
+      const workspaceSeal = attestationMatch[1];
+      if (workspaceSeal === session.snapshotSeal) {
+        return {
+          ...commandResult,
+          command,
+          commands: request.commands,
+          sessionReused,
+          workspacePublished: true,
+          workspaceExported: false,
+          phaseLatencies: {
+            commandAndAttestationMs,
+            totalMs: elapsedMilliseconds(totalStartedAt)
+          }
+        };
+      }
+      const workspaceExportStartedAt = process.hrtime.bigint();
+      const stagedRoot = path4.join(path4.dirname(request.snapshotRoot), `.workspace-sync-${randomUUID2()}`);
+      try {
+        await privateDirectory(stagedRoot);
+        await observeOciPhase("oci_export", () => this.cli(["cp", `${session.name}:/workspace/.`, stagedRoot], 60000));
+        const validated = await validateSynchronizedSnapshot(stagedRoot, request.snapshotRoot, request.limits.maxWorkspaceBytes, request.limits.maxFileWriteBytes);
+        await replaceSnapshot(request.snapshotRoot, stagedRoot);
+        session.snapshotSeal = validated.seal;
+        session.hostFingerprint = validated.metadataFingerprint;
+      } finally {
+        await rm(stagedRoot, { recursive: true, force: true });
+      }
+      return {
+        ...commandResult,
+        command,
+        commands: request.commands,
+        sessionReused,
+        workspacePublished: true,
+        workspaceExported: true,
+        phaseLatencies: {
+          commandAndAttestationMs,
+          workspaceExportMs: elapsedMilliseconds(workspaceExportStartedAt),
+          totalMs: elapsedMilliseconds(totalStartedAt)
+        }
+      };
+    } catch (error) {
+      await this.destroySession(session);
+      throw error;
+    }
+  }
+  async runBatchLocked(request) {
+    if (request.commands.length === 0 || request.commands.some((command) => command.length === 0)) {
+      throw new Error("OCI command batch must contain at least one non-empty argv command.");
+    }
+    const totalStartedAt = process.hrtime.bigint();
+    const key = runHash(request.runId);
+    const requestFingerprint = this.requestFingerprint(request);
+    let session = this.sessions.get(key);
+    let sessionReused = Boolean(session);
+    let validated;
+    let hostSynchronizationMs;
+    let sessionCreationMs;
+    if (session) {
+      const synchronizationStartedAt = process.hrtime.bigint();
+      const hostFingerprint = await snapshotMetadataFingerprint(request.snapshotRoot, request.limits.maxWorkspaceBytes);
+      if (session.requestFingerprint !== requestFingerprint || session.hostFingerprint !== hostFingerprint) {
+        await this.destroySession(session);
+        session = undefined;
+        sessionReused = false;
+      }
+      hostSynchronizationMs = elapsedMilliseconds(synchronizationStartedAt);
+    }
+    if (!session) {
+      const creationStartedAt = process.hrtime.bigint();
+      validated = await validateSynchronizedSnapshot(request.snapshotRoot, request.snapshotRoot, request.limits.maxWorkspaceBytes, request.limits.maxFileWriteBytes);
+      session = await this.createSession(request, requestFingerprint, validated.seal, validated.metadataFingerprint);
+      sessionCreationMs = elapsedMilliseconds(creationStartedAt);
+    }
+    try {
+      const result = await this.runInSession(request, session, sessionReused);
+      return {
+        ...result,
+        phaseLatencies: {
+          ...result.phaseLatencies,
+          ...hostSynchronizationMs !== undefined ? { hostSynchronizationMs } : {},
+          ...sessionCreationMs !== undefined ? { sessionCreationMs } : {},
+          totalMs: elapsedMilliseconds(totalStartedAt)
+        }
+      };
+    } catch (error) {
+      if (this.sessions.get(key) === session)
+        await this.destroySession(session).catch(() => {
+          return;
+        });
+      throw error;
+    }
+  }
+  async run(request) {
+    const { command, ...shared } = request;
+    const result = await this.runBatch({ ...shared, commands: [command] });
+    return { ...result, command };
+  }
+  async runBatch(request) {
+    return this.withRunLock(request.runId, () => this.runBatchLocked(request));
+  }
+  async removeByFilters(filters) {
+    const listed = await spawnBounded2([this.runtime, "ps", "-aq", ...filters.flatMap((filter) => ["--filter", filter])], {
+      env: this.hostEnvironment,
+      timeoutMs: 30000,
+      maxOutputBytes: 1024 * 1024
+    });
+    if (listed.exitCode !== 0)
+      return 0;
+    const ids = validContainerIds(listed.stdout);
+    if (ids.length === 0)
+      return 0;
+    const removed = await spawnBounded2([this.runtime, "rm", "-f", ...ids], {
+      env: this.hostEnvironment,
+      timeoutMs: 60000,
+      maxOutputBytes: 1024 * 1024
+    });
+    if (removed.exitCode !== 0) {
+      throw new Error(`${this.runtime} could not remove harness containers: ${removed.stderr.trim()}`);
+    }
+    return ids.length;
+  }
+  async removeVolumesByFilters(filters) {
+    const listed = await spawnBounded2([
+      this.runtime,
+      "volume",
+      "ls",
+      "-q",
+      ...filters.flatMap((filter) => ["--filter", filter])
+    ], {
+      env: this.hostEnvironment,
+      timeoutMs: 30000,
+      maxOutputBytes: 1024 * 1024
+    });
+    if (listed.exitCode !== 0)
+      return 0;
+    let removed = 0;
+    for (const name of validVolumeNames(listed.stdout)) {
+      try {
+        await this.removeVolume(name);
+        removed += 1;
+      } catch {}
+    }
+    return removed;
+  }
+  async removeRunningOrphans() {
+    const listed = await spawnBounded2([
+      this.runtime,
+      "ps",
+      "-q",
+      "--filter",
+      `label=${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
+      "--filter",
+      "status=running"
+    ], {
+      env: this.hostEnvironment,
+      timeoutMs: 30000,
+      maxOutputBytes: 1024 * 1024
+    });
+    if (listed.exitCode !== 0)
+      return 0;
+    let removed = 0;
+    for (const id of validContainerIds(listed.stdout)) {
+      const inspected = await this.cli([
+        "inspect",
+        id,
+        "--format",
+        "{{json .Config.Labels}}"
+      ], 30000, 20000);
+      const labels = JSON.parse(inspected.stdout);
+      const ownerPid = Number(labels[HARNESS_OCI_OWNER_PID_LABEL]);
+      if (hostProcessIsAlive(ownerPid))
+        continue;
+      await this.forceRemove(id);
+      removed += 1;
+    }
+    return removed;
+  }
+  async removeRunContainers(runId) {
+    const key = runHash(runId);
+    const session = this.sessions.get(key);
+    let cachedResources = 0;
+    if (session) {
+      await this.destroySession(session);
+      cachedResources = 2;
+    }
+    const filters = [
+      `label=${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
+      `label=com.zhivex.harness.run=${key}`
+    ];
+    const containers = await this.removeByFilters(filters);
+    const volumes = await this.removeVolumesByFilters(filters);
+    return cachedResources + containers + volumes;
+  }
+  async cleanupOrphans() {
+    let removed = 0;
+    for (const session of [...this.sessions.values()]) {
+      await this.destroySession(session);
+      removed += 2;
+    }
+    this.sessions.clear();
+    for (const status of ["created", "exited", "dead", "paused"]) {
+      removed += await this.removeByFilters([
+        `label=${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
+        `status=${status}`
+      ]);
+    }
+    removed += await this.removeRunningOrphans();
+    removed += await this.removeVolumesByFilters([
+      `label=${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`
+    ]);
+    return removed;
+  }
+}
+var SNAPSHOT_INVENTORY_PAGE_SIZE = 5000;
+var COPY_ON_WRITE_UNSUPPORTED_CODES = new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"]);
+var collectSnapshotInventory = async (workspace, maxWorkspaceBytes, metrics, maxEntries = Number.MAX_SAFE_INTEGER) => {
+  const files = new Map;
+  if (metrics)
+    metrics.inventoryPasses += 1;
+  let totalBytes = 0;
+  let cursor;
+  do {
+    const page = await workspace.listFiles(".", {
+      limit: SNAPSHOT_INVENTORY_PAGE_SIZE,
+      includeDigests: false,
+      ...cursor ? { cursor } : {}
+    });
+    if (metrics)
+      metrics.inventoryPages += 1;
+    for await (const candidates of boundedBatches(page.files, async (file) => {
+      const absolute = path4.join(workspace.root, ...file.path.split("/"));
+      if (!isInside2(workspace.root, absolute))
+        throw new Error(`Snapshot file escaped its workspace: ${file.path}.`);
+      if (await realpath3(absolute) !== absolute)
+        throw new Error("Snapshot inventory path traverses a symbolic link.");
+      const entry = await statRegularFileNoFollow(absolute, { label: "Snapshot inventory file" });
+      return { file, absolute, entry };
+    }, 4)) {
+      for (const { entry } of candidates) {
+        if (entry.size > maxWorkspaceBytes - totalBytes)
+          throw new FileSizeLimitError("Snapshot inventory file", maxWorkspaceBytes);
+        totalBytes += entry.size;
+      }
+      for await (const batch of boundedBatches(candidates, async ({ file, absolute, entry }) => {
+        const stable = await readRegularFileNoFollow(absolute, {
+          label: "Snapshot inventory file",
+          maxBytes: entry.size
+        });
+        if (stable.stat.dev !== entry.dev || stable.stat.ino !== entry.ino || stable.stat.size !== entry.size || stable.stat.mtimeMs !== entry.mtimeMs || stable.stat.ctimeMs !== entry.ctimeMs) {
+          throw new Error(`Snapshot inventory file changed while being read: ${file.path}.`);
+        }
+        return { path: file.path, digest: digest(stable.contents), mode: stable.stat.mode & 511, bytes: stable.contents.byteLength };
+      }, 4))
+        for (const file of batch) {
+          if (files.size >= maxEntries)
+            throw new Error("Workspace snapshot entry limit exceeded.");
+          files.set(file.path, file);
+        }
+    }
+    cursor = page.nextCursor;
+  } while (cursor);
+  return files;
+};
+var readSnapshotFile = async (workspace, expected, metrics, requireSingleLink = false) => {
+  const absolute = path4.join(workspace.root, ...expected.path.split("/"));
+  if (!isInside2(workspace.root, absolute)) {
+    throw new Error(`Snapshot file escaped its workspace: ${expected.path}.`);
+  }
+  if (await realpath3(absolute) !== absolute)
+    throw new Error("Snapshot source path traverses a symbolic link.");
+  const file = await readRegularFileNoFollow(absolute, {
+    label: `Snapshot source ${expected.path}`,
+    maxBytes: expected.bytes,
+    requireSingleLink
+  });
+  const { contents } = file;
+  const entry = file.stat;
+  const actualDigest = digest(contents);
+  if (actualDigest !== expected.digest || contents.byteLength !== expected.bytes || (entry.mode & 511) !== expected.mode) {
+    throw new Error(`Snapshot source changed after inventory: ${expected.path}.`);
+  }
+  if (metrics) {
+    metrics.verifiedContentReads += 1;
+    metrics.verifiedContentBytes += contents.byteLength;
+  }
+  return { ...expected, contents };
+};
+var copySnapshotFile = async (source, target, metrics) => {
+  try {
+    await copyFile(source, target, fsConstants.COPYFILE_FICLONE_FORCE);
+  } catch (error) {
+    const code = error.code;
+    if (!code || !COPY_ON_WRITE_UNSUPPORTED_CODES.has(code))
+      throw error;
+    if (metrics)
+      metrics.snapshotCloneFallbacks += 1;
+    await copyFile(source, target);
+  }
+};
+var copyWorkspaceSnapshot = async (source, baseRoot, snapshotRoot, maxWorkspaceBytes, metrics) => {
+  const files = await collectSnapshotInventory(source, maxWorkspaceBytes, metrics);
+  const totalBytes = [...files.values()].reduce((total, file) => total + file.bytes, 0);
+  if (totalBytes > maxWorkspaceBytes) {
+    throw new Error(`Workspace snapshot exceeds the ${maxWorkspaceBytes}-byte OCI limit.`);
+  }
+  for (const root of [baseRoot, snapshotRoot]) {
+    await rm(root, { recursive: true, force: true });
+    await privateDirectory(root);
+  }
+  for await (const _batch of boundedBatches([...files.values()], async (expected) => {
+    const file = await readSnapshotFile(source, expected, metrics);
+    const baseTarget = path4.join(baseRoot, ...file.path.split("/"));
+    const snapshotTarget = path4.join(snapshotRoot, ...file.path.split("/"));
+    await Promise.all([
+      mkdir3(path4.dirname(baseTarget), { recursive: true, mode: 448 }),
+      mkdir3(path4.dirname(snapshotTarget), { recursive: true, mode: 448 })
+    ]);
+    await writeFile(baseTarget, file.contents, { mode: file.mode });
+    await chmod(baseTarget, file.mode);
+    await copySnapshotFile(baseTarget, snapshotTarget, metrics);
+    await chmod(snapshotTarget, file.mode);
+  }, 4)) {}
+  if (metrics) {
+    metrics.snapshotFiles += files.size;
+    metrics.snapshotBytes += totalBytes;
+  }
+  return { files: files.size, bytes: totalBytes };
+};
+var deliveryPaths = (value) => {
+  if (value === undefined)
+    return [];
+  if (!Array.isArray(value) || value.length > MAX_SYNC_ENTRIES || value.some((item) => typeof item !== "string" || !item || item.length > 8192 || item.includes("\\") || item.includes("\x00") || path4.posix.isAbsolute(item) || item.split("/").some((segment) => !segment || segment === "." || segment === "..")) || Buffer.byteLength(JSON.stringify(value)) > 512 * 1024) {
+    throw new Error("Invalid or oversized OCI delivery path history.");
+  }
+  return [...new Set(value)];
+};
+var patchPayload = (runId, entries) => ({
+  schemaVersion: HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
+  kind: "environment-patch",
+  runId,
+  entries: entries.map(({ beforeContent: _before, afterContent: _after, ...entry }) => entry)
+});
+var textContent = (file, maxFileWriteBytes) => {
+  if (file.contents.byteLength > maxFileWriteBytes) {
+    throw new Error(`Environment patch file exceeds the ${maxFileWriteBytes}-byte import limit: ${file.path}.`);
+  }
+  if (file.contents.includes(0)) {
+    throw new Error(`Environment patch contains a binary file that cannot be imported: ${file.path}.`);
+  }
+  try {
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(file.contents);
+  } catch {
+    throw new Error("Environment patch requires valid UTF-8 text.");
+  }
+};
+var createEnvironmentPatch = async (runId, base, current, maxFileWriteBytes, maxWorkspaceBytes, metrics, identity) => {
+  const [before, after] = await Promise.all([
+    collectSnapshotInventory(base, maxWorkspaceBytes, metrics),
+    collectSnapshotInventory(current, maxWorkspaceBytes, metrics)
+  ]);
+  const paths = [...new Set([...before.keys(), ...after.keys()])].sort();
+  const entries = [];
+  let totalBytes = 0;
+  for (const filePath of paths) {
+    const oldFile = before.get(filePath);
+    const newFile = after.get(filePath);
+    if (oldFile?.digest === newFile?.digest && oldFile?.mode === newFile?.mode)
+      continue;
+    const operation = !oldFile ? "create" : !newFile ? "delete" : "update";
+    const beforeContent = oldFile ? textContent(await readSnapshotFile(base, oldFile, metrics), maxFileWriteBytes) : undefined;
+    const afterContent = newFile ? textContent(await readSnapshotFile(current, newFile, metrics), maxFileWriteBytes) : undefined;
+    const bytes = newFile?.bytes ?? 0;
+    totalBytes += bytes;
+    entries.push({
+      path: filePath,
+      operation,
+      ...oldFile ? { beforeDigest: oldFile.digest } : {},
+      ...oldFile ? { beforeMode: oldFile.mode } : {},
+      ...beforeContent !== undefined ? { beforeContent } : {},
+      ...newFile ? { afterDigest: newFile.digest } : {},
+      ...newFile ? { afterMode: newFile.mode } : {},
+      ...afterContent !== undefined ? { afterContent } : {},
+      bytes
+    });
+  }
+  if (entries.length > MAX_EDIT_CHANGES) {
+    throw new Error(`Environment patch exceeds the ${MAX_EDIT_CHANGES}-file import limit.`);
+  }
+  if (totalBytes > MAX_EDIT_PROPOSAL_BYTES) {
+    throw new Error(`Environment patch exceeds the ${MAX_EDIT_PROPOSAL_BYTES}-byte import limit.`);
+  }
+  const payload = patchPayload(runId, entries);
+  return { entries, totalBytes, patchId: digest(JSON.stringify({ ...payload, executionIdentity: identity ?? null })) };
+};
+var inspectHostPrecondition = async (workspace, filePath, expectedDigest, expectedMode) => {
+  try {
+    const current = await workspace.inspectFile(filePath);
+    if (!expectedDigest)
+      throw new Error(`Host patch target already exists: ${filePath}.`);
+    if (current.digest !== expectedDigest) {
+      throw new Error(`Host patch target changed after the environment snapshot: ${filePath}.`);
+    }
+    if (expectedMode !== undefined && current.mode !== expectedMode) {
+      throw new Error(`Host patch target mode changed after the environment snapshot: ${filePath}.`);
+    }
+  } catch (error) {
+    if (error.code === "ENOENT" && !expectedDigest)
+      return;
+    throw error;
+  }
+};
+var importPatch = async (runId, expectedPatchId, host, base, current, maxFileWriteBytes, maxWorkspaceBytes, metrics, assertActive, identity, lastInspectedPatchId) => withWorkspaceMutation(host.root, async () => {
+  await assertActive?.();
+  const patch = await createEnvironmentPatch(runId, base, current, maxFileWriteBytes, maxWorkspaceBytes, metrics, identity);
+  if (patch.patchId !== expectedPatchId) {
+    throw new EnvironmentPatchDriftError(expectedPatchId, patch.patchId, lastInspectedPatchId);
+  }
+  if (patch.entries.length === 0)
+    throw new Error("Environment patch contains no changes.");
+  const acceptanceBinding = taskAcceptanceChecks() ? {
+    runId,
+    patchId: patch.patchId,
+    executionIdentity: identity ?? runId,
+    snapshotDigest: await acceptanceSnapshotDigest(current.root, maxWorkspaceBytes)
+  } : undefined;
+  assertTaskAcceptanceImport({ workspace: host.root, runId, patchId: patch.patchId, entries: patch.entries, ...acceptanceBinding });
+  for (const entry of patch.entries) {
+    await inspectHostPrecondition(host, entry.path, entry.beforeDigest, entry.beforeMode);
+  }
+  const writes = patch.entries.filter((entry) => entry.operation !== "delete");
+  const deletes = patch.entries.filter((entry) => entry.operation === "delete");
+  const audits = [];
+  if (writes.length) {
+    const changes = writes.map((entry) => ({
+      path: entry.path,
+      expectedDigest: entry.beforeDigest ?? null,
+      content: entry.afterContent
+    }));
+    const proposal = createEditProposal({ changes });
+    const modes = new Map(writes.map((entry) => [entry.path, {
+      ...entry.beforeMode !== undefined ? { beforeMode: entry.beforeMode } : {},
+      afterMode: entry.afterMode
+    }]));
+    const result = await host.applyPatchWithModes({ proposalId: proposal.proposalId, changes }, modes, assertActive);
+    audits.push(...result.changes);
+  }
+  const quarantined = [];
+  try {
+    for (const entry of deletes) {
+      const result = await host.quarantineFile({ path: entry.path, expectedDigest: entry.beforeDigest }, assertActive);
+      quarantined.push(result);
+      audits.push(result.audit);
+    }
+    await assertActive?.();
+  } catch (error) {
+    const rollbackErrors = [];
+    for (const item of [...quarantined].reverse()) {
+      try {
+        await host.restoreQuarantined({ quarantineId: item.quarantineId, expectedDigest: item.digest });
+      } catch (rollbackError) {
+        rollbackErrors.push(rollbackError);
+      }
+    }
+    const updatedWrites = writes.filter((entry) => entry.operation === "update");
+    if (updatedWrites.length) {
+      try {
+        const changes = updatedWrites.map((entry) => ({
+          path: entry.path,
+          expectedDigest: entry.afterDigest,
+          content: entry.beforeContent
+        }));
+        const proposal = createEditProposal({ changes });
+        const modes = new Map(updatedWrites.map((entry) => [entry.path, {
+          beforeMode: entry.afterMode,
+          afterMode: entry.beforeMode
+        }]));
+        await host.applyPatchWithModes({ proposalId: proposal.proposalId, changes }, modes);
+      } catch (rollbackError) {
+        rollbackErrors.push(rollbackError);
+      }
+    }
+    for (const entry of writes.filter((candidate) => candidate.operation === "create").reverse()) {
+      try {
+        await host.quarantineFile({ path: entry.path, expectedDigest: entry.afterDigest });
+      } catch (rollbackError) {
+        rollbackErrors.push(rollbackError);
+      }
+    }
+    if (rollbackErrors.length) {
+      throw new AggregateError([error, ...rollbackErrors], "Environment patch deletion failed and rollback was incomplete.");
+    }
+    throw error;
+  }
+  if (acceptanceBinding)
+    confirmTaskAcceptanceImport(acceptanceBinding, () => withWorkspaceMutation(host.root, async () => {
+      if (await acceptanceSnapshotDigest(current.root, maxWorkspaceBytes) !== acceptanceBinding.snapshotDigest)
+        return false;
+      for (const entry of patch.entries) {
+        try {
+          const delivered = await host.inspectFile(entry.path);
+          if (entry.operation === "delete" || delivered.digest !== entry.afterDigest || delivered.mode !== entry.afterMode)
+            return false;
+        } catch (error) {
+          if (entry.operation !== "delete" || error.code !== "ENOENT")
+            throw error;
+        }
+      }
+      return true;
+    }));
+  return {
+    schemaVersion: HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
+    kind: "environment-patch-import",
+    patchId: patch.patchId,
+    runId,
+    changes: audits
+  };
+});
+var harnessExecutionSession = (context) => {
+  const candidate = context?.executionEnvironment;
+  return candidate?.kind === "zhivex-oci" ? candidate : undefined;
+};
+var createHarnessOciExecutionEnvironmentUnsafe = async (options) => {
+  const runtime = options.runtime ?? new CliOciRuntimeAdapter(options.config.runtime);
+  const image = await runtime.inspectImage(options.config.image);
+  const workspaceIdentity = digest(options.workspace.root);
+  const manifest = {
+    schemaVersion: 1,
+    id: `zhivex-harness-${options.config.runtime}-oci`,
+    version: `${HARNESS_EXECUTION_POLICY_VERSION}:${image.imageDigest}`,
+    backend: "container",
+    assurance: "enforced",
+    isolation: "per-run",
+    workspace: {
+      id: workspaceIdentity,
+      root: "/workspace",
+      cwd: "/workspace",
+      access: "read-write",
+      followSymlinks: false,
+      readablePaths: ["/workspace"],
+      writablePaths: ["/workspace", "/tmp"]
+    },
+    permissions: {
+      undeclaredTools: "deny",
+      filesystem: "read-write",
+      network: { mode: "deny", allowedDomains: [], allowedPorts: [], allowPrivateNetworks: false },
+      process: {
+        shell: options.config.shellMode === "ask" ? "allow" : "allowlist",
+        allowedCommands: [...options.config.allowedCommands]
+      },
+      environment: { inheritedVariables: [] }
+    },
+    limits: {
+      maxProcessRuntimeMs: options.config.maxProcessRuntimeMs,
+      maxProcessOutputBytes: options.config.maxProcessOutputBytes,
+      maxConcurrentProcesses: 1,
+      maxMemoryMb: options.config.maxMemoryMb,
+      maxWorkspaceBytes: options.config.maxWorkspaceBytes,
+      maxFileWriteBytes: options.config.maxFileWriteBytes,
+      maxNetworkRequests: 0,
+      maxNetworkBytes: 0
+    },
+    metadata: {
+      policyVersion: options.config.policyVersion,
+      runtime: image.runtime,
+      runtimeVersion: image.runtimeVersion,
+      imageReference: image.imageReference,
+      imageId: image.imageId,
+      imageDigest: image.imageDigest,
+      maxPids: options.config.maxPids,
+      maxCpus: options.config.maxCpus,
+      tmpfsMb: options.config.tmpfsMb,
+      containerLifecycle: "warm-per-acquired-run",
+      failedCommandRecovery: "discard-and-reseed",
+      patchImportApproval: true,
+      hostMutationMode: "reviewed-environment-patch",
+      shellMode: options.config.shellMode
+    }
+  };
+  const binding = createAgentExecutionEnvironmentBinding(manifest);
+  const environmentRoot = path4.join(options.stateDirectory, "environments");
+  const reviewSnapshot = async (request, allowAbsent = false) => {
+    let stateDirectory;
+    try {
+      stateDirectory = await realpath3(options.stateDirectory);
+    } catch (error) {
+      if (allowAbsent && error.code === "ENOENT")
+        return;
+      throw error;
+    }
+    const scopeKey = executionScopeKey(request.scope);
+    const identity = executionIdentity(options.workspace.root, stateDirectory, request.runId, scopeKey);
+    const root = path4.join(stateDirectory, "environments");
+    const directory = path4.join(root, runHash(identity));
+    for (const candidate of [root, directory, path4.join(directory, "base"), path4.join(directory, "workspace")]) {
+      let entry;
+      try {
+        entry = await lstat4(candidate);
+      } catch (error) {
+        if (allowAbsent && (candidate === root || candidate === directory) && error.code === "ENOENT")
+          return;
+        throw error;
+      }
+      if (entry.isSymbolicLink() || !entry.isDirectory() || await realpath3(candidate) !== candidate) {
+        throw new Error("Unsafe execution review directory.");
+      }
+    }
+    const file = await readRegularFileNoFollow(path4.join(directory, "environment.json"), {
+      label: "Execution metadata",
+      maxBytes: 1024 * 1024
+    });
+    const metadata = JSON.parse(file.contents.toString("utf8"));
+    if (metadata.schemaVersion !== HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION || metadata.runId !== request.runId || metadata.scopeKey !== scopeKey || metadata.stateDirectory !== stateDirectory || metadata.executionIdentity !== identity || metadata.hostWorkspace !== options.workspace.root || metadata.binding.fingerprint !== binding.fingerprint || metadata.binding.workspaceId !== binding.workspaceId) {
+      throw Object.assign(new Error("Execution review binding changed."), { diagnosticCode: "OCI_EXECUTION_BINDING_CHANGED" });
+    }
+    const base = await Workspace.open(path4.join(directory, "base"));
+    const current = await Workspace.open(path4.join(directory, "workspace"));
+    const patch = await createEnvironmentPatch(request.runId, base, current, options.config.maxFileWriteBytes, options.config.maxWorkspaceBytes, undefined, identity);
+    deliveryPaths(metadata.deliveryPaths);
+    return { metadata, patch, current };
+  };
+  return {
+    manifest,
+    image,
+    runtime,
+    async pendingDelivery(request) {
+      const reviewed = await reviewSnapshot(request, true);
+      if (!reviewed)
+        return false;
+      const paths = new Set([...reviewed.patch.entries.map((entry) => entry.path), ...deliveryPaths(reviewed.metadata.deliveryPaths)]);
+      const inspect = async (workspace, filePath) => {
+        try {
+          return await workspace.inspectFile(filePath);
+        } catch (error) {
+          if (error.code === "ENOENT")
+            return;
+          throw error;
+        }
+      };
+      for (const filePath of paths) {
+        const [current, host] = await Promise.all([
+          inspect(reviewed.current, filePath),
+          inspect(options.workspace, filePath)
+        ]);
+        if (current?.digest !== host?.digest || current?.mode !== host?.mode)
+          return true;
+      }
+      return false;
+    },
+    async previewPatch(request, expectedPatchId) {
+      const { metadata, patch } = await reviewSnapshot(request);
+      if (patch.patchId !== expectedPatchId)
+        throw new EnvironmentPatchDriftError(expectedPatchId, patch.patchId, metadata.lastInspectedPatchId);
+      for (const entry of patch.entries)
+        await inspectHostPrecondition(options.workspace, entry.path, entry.beforeDigest, entry.beforeMode);
+      return { patchId: patch.patchId, entries: patch.entries };
+    },
+    async acquire(request) {
+      const ioMetrics = {
+        inventoryPasses: 0,
+        inventoryPages: 0,
+        verifiedContentReads: 0,
+        verifiedContentBytes: 0,
+        snapshotFiles: 0,
+        snapshotBytes: 0,
+        snapshotCloneFallbacks: 0,
+        containerStarts: 0,
+        containerReuses: 0,
+        workspacePublishes: 0,
+        workspaceExports: 0
+      };
+      await privateDirectory(environmentRoot);
+      const stateDirectory = await realpath3(options.stateDirectory);
+      const scopeKey = executionScopeKey(request.scope);
+      const identity = executionIdentity(options.workspace.root, stateDirectory, request.runId, scopeKey);
+      const directory = path4.join(environmentRoot, runHash(identity));
+      await privateDirectory(directory);
+      const metadataPath = path4.join(directory, "environment.json");
+      const baseRoot = path4.join(directory, "base");
+      const snapshotRoot = path4.join(directory, "workspace");
+      let metadata;
+      try {
+        const metadataFile = await readRegularFileNoFollow(metadataPath, {
+          label: "Execution metadata",
+          maxBytes: 1024 * 1024
+        });
+        metadata = JSON.parse(metadataFile.contents.toString("utf8"));
+        if (metadata.schemaVersion !== HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION || metadata.runId !== request.runId || metadata.scopeKey !== scopeKey || metadata.stateDirectory !== stateDirectory || metadata.executionIdentity !== identity || metadata.hostWorkspace !== options.workspace.root || metadata.binding.fingerprint !== binding.fingerprint || metadata.binding.workspaceId !== binding.workspaceId) {
+          throw Object.assign(new Error("Execution artifact binding changed."), { diagnosticCode: "OCI_EXECUTION_BINDING_CHANGED" });
+        }
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+        try {
+          await lstat4(path4.join(environmentRoot, runHash(request.runId)));
+          throw new Error("Unscoped legacy OCI artifact requires its original runtime; start a new run.");
+        } catch (legacyError) {
+          if (legacyError.code !== "ENOENT")
+            throw legacyError;
+        }
+        const snapshot = await copyWorkspaceSnapshot(options.workspace, baseRoot, snapshotRoot, options.config.maxWorkspaceBytes, ioMetrics);
+        const now = new Date().toISOString();
+        metadata = {
+          schemaVersion: HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
+          runId: request.runId,
+          hostWorkspace: options.workspace.root,
+          stateDirectory,
+          scopeKey,
+          executionIdentity: identity,
+          binding,
+          image,
+          createdAt: now,
+          acquiredAt: now,
+          snapshot
+        };
+      }
+      deliveryPaths(metadata.deliveryPaths);
+      metadata.acquiredAt = new Date().toISOString();
+      delete metadata.releasedAt;
+      delete metadata.status;
+      await atomicJson(metadataPath, metadata);
+      const workspace = await Workspace.open(snapshotRoot, { auditPath: path4.join(directory, "mutation-audit.json") });
+      const base = await Workspace.open(baseRoot);
+      const dependencyPath = path4.join(options.workspace.root, "node_modules");
+      let dependencyRoot;
+      try {
+        const entry = await lstat4(dependencyPath);
+        if (entry.isSymbolicLink() || !entry.isDirectory()) {
+          throw new Error("node_modules must be a real directory before it can be mounted read-only.");
+        }
+        dependencyRoot = await realpath3(dependencyPath);
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          throw error;
+        }
+      }
+      const validateCommand = (command, args) => {
+        if (!options.config.allowedCommands.includes(command)) {
+          throw new Error(`The OCI command "${command}" is not in the explicit allowlist.`);
+        }
+        if (args.length > 256 || args.some((value) => value.length > 8192 || value.includes("\x00"))) {
+          throw new Error("OCI command arguments exceed the bounded argument contract.");
+        }
+        return [command, ...args];
+      };
+      const sharedRunRequest = (context) => ({
+        runId: identity,
+        snapshotRoot,
+        ...dependencyRoot ? { dependencyRoot } : {},
+        imageId: image.imageId,
+        limits: {
+          maxProcessRuntimeMs: options.config.maxProcessRuntimeMs,
+          maxProcessOutputBytes: options.config.maxProcessOutputBytes,
+          maxMemoryMb: options.config.maxMemoryMb,
+          maxPids: options.config.maxPids,
+          maxCpus: options.config.maxCpus,
+          maxWorkspaceBytes: options.config.maxWorkspaceBytes,
+          maxFileWriteBytes: options.config.maxFileWriteBytes,
+          tmpfsMb: options.config.tmpfsMb
+        },
+        ...context?.abortSignal ?? request.abortSignal ? { abortSignal: context?.abortSignal ?? request.abortSignal } : {}
+      });
+      const normalizeResult = (result) => {
+        if (result.sessionReused === false)
+          ioMetrics.containerStarts += 1;
+        if (result.sessionReused === true)
+          ioMetrics.containerReuses += 1;
+        if (result.workspacePublished === true)
+          ioMetrics.workspacePublishes += 1;
+        if (result.workspaceExported === true)
+          ioMetrics.workspaceExports += 1;
+        const forcedExitCode = result.cancelled ? 130 : result.timedOut ? 124 : result.outputLimitExceeded ? 125 : result.exitCode;
+        return {
+          command: result.command,
+          exitCode: forcedExitCode,
+          stdout: result.stdout,
+          stderr: [
+            result.stderr,
+            ...result.cancelled ? ["OCI command cancelled."] : [],
+            ...result.timedOut ? ["OCI command timed out."] : [],
+            ...result.outputLimitExceeded ? ["OCI command exceeded the output limit."] : []
+          ].filter(Boolean).join(`
+`),
+          timedOut: result.timedOut,
+          ...result.phaseLatencies ? { phaseLatencies: result.phaseLatencies } : {},
+          ...result.sessionReused !== undefined ? { sessionReused: result.sessionReused } : {},
+          ...result.workspacePublished !== undefined ? { workspacePublished: result.workspacePublished } : {},
+          ...result.workspaceExported !== undefined ? { workspaceExported: result.workspaceExported } : {}
+        };
+      };
+      const runCommand = async (command, args, context) => {
+        const argv = validateCommand(command, args);
+        const checks = taskAcceptanceChecks(), matching = checks?.matching(command, args) ?? [];
+        checks?.begin(matching.map((check) => check.id));
+        const binding2 = async () => ({
+          runId: request.runId,
+          executionIdentity: identity,
+          patchId: (await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes, options.config.maxWorkspaceBytes, ioMetrics, identity)).patchId,
+          snapshotDigest: await acceptanceSnapshotDigest(workspace.root, options.config.maxWorkspaceBytes)
+        });
+        for (const check of matching)
+          if (check.kind === "package-script") {
+            const file = await readRegularFileNoFollow(path4.join(workspace.root, "package.json"), { label: "Acceptance package manifest", maxBytes: 256 * 1024, requireSingleLink: true });
+            const manifestDocument = JSON.parse(file.contents.toString("utf8"));
+            const resolved = await resolvePackageCheckCommand(workspace.root, manifestDocument, check.script, check.expectedScript, [check.script]);
+            if (JSON.stringify(resolved.command) !== JSON.stringify(argv))
+              throw new Error("TASK_ACCEPTANCE_CHECK_CHANGED");
+          }
+        const before = matching.length ? await binding2() : undefined;
+        const startedAt = Date.now();
+        const result = normalizeResult(await runtime.run({ ...sharedRunRequest(context), command: argv }));
+        if (before && checks) {
+          const after = await binding2();
+          for (const check of matching)
+            checks.record(check.id, before, after, result, context?.toolCall ? { id: context.toolCall.id, name: context.toolCall.name, startedAt } : undefined);
+        }
+        return result;
+      };
+      const runCommandBatch = async (commands, context) => {
+        if (commands.length === 0 || commands.length > 32) {
+          throw new Error("OCI command batch must contain between 1 and 32 commands.");
+        }
+        if (commands.reduce((total, item) => total + item.args.length, 0) > 256) {
+          throw new Error("OCI command batch exceeds the bounded argument-count contract.");
+        }
+        const argvCommands = commands.map(({ command, args }) => validateCommand(command, args));
+        if (runtime.runBatch && !taskAcceptanceChecks()) {
+          return normalizeResult(await runtime.runBatch({
+            ...sharedRunRequest(context),
+            commands: argvCommands
+          }));
+        }
+        const results = [];
+        for (const argv of argvCommands) {
+          const result = await runCommand(argv[0], argv.slice(1), context);
+          results.push(result);
+          if (result.exitCode !== 0)
+            break;
+        }
+        return {
+          command: ["<oci-batch>", String(commands.length)],
+          exitCode: results.at(-1)?.exitCode ?? 1,
+          stdout: results.map((result) => result.stdout).filter(Boolean).join(""),
+          stderr: results.map((result) => result.stderr).filter(Boolean).join(`
+`),
+          timedOut: results.some((result) => result.timedOut)
+        };
+      };
+      const runShell = async (script, context) => {
+        if (options.config.shellMode !== "ask") {
+          throw new Error("OCI shell execution is denied by policy.");
+        }
+        if (!script || script.length > 16384 || script.includes("\x00")) {
+          throw new Error("OCI shell script must contain between 1 and 16384 characters without NUL bytes.");
+        }
+        return normalizeResult(await runtime.run({
+          ...sharedRunRequest(context),
+          command: ["sh", "-lc", script, "zhivex-harness"]
+        }));
+      };
+      const session = {
+        kind: "zhivex-oci",
+        runId: request.runId,
+        manifest,
+        binding,
+        workspace,
+        async authorize(authorization) {
+          const name = authorization.tool.name;
+          if (!BUILT_IN_TOOL_NAMES.has(name) && !name.startsWith("delegate_")) {
+            return { decision: "deny", reason: `Tool "${name}" is undeclared by the enforced OCI policy.` };
+          }
+          if (name === "run_environment_command") {
+            const input = authorization.input;
+            if (typeof input.command !== "string" || !options.config.allowedCommands.includes(input.command)) {
+              return { decision: "deny", reason: "The requested OCI executable is not allowlisted." };
+            }
+          }
+          if (name === "run_environment_shell") {
+            const input = authorization.input;
+            if (options.config.shellMode !== "ask" || typeof input.script !== "string" || input.script.length < 1 || input.script.length > 16384 || input.script.includes("\x00")) {
+              return { decision: "deny", reason: "OCI shell execution is denied or the script is invalid." };
+            }
+          }
+          if (name === "verify_and_apply_environment_patch" || name === "verify_and_apply_reviewed_edits") {
+            const input = authorization.input;
+            const validBoundInput = name === "verify_and_apply_environment_patch" ? typeof input.patchId === "string" : Array.isArray(input.changes) && input.changes.length > 0;
+            if (!validBoundInput || typeof input.command !== "string" || !options.config.allowedCommands.includes(input.command) || !Array.isArray(input.args)) {
+              return { decision: "deny", reason: "The verified OCI transaction is invalid or contains a non-allowlisted executable." };
+            }
+          }
+          if (name === "run_environment_batch") {
+            const input = authorization.input;
+            if (!Array.isArray(input.commands) || input.commands.length < 1 || input.commands.length > 32 || input.commands.some((item) => {
+              const candidate = item;
+              return typeof candidate.command !== "string" || !options.config.allowedCommands.includes(candidate.command) || !Array.isArray(candidate.args);
+            })) {
+              return { decision: "deny", reason: "The requested OCI command batch is invalid or contains a non-allowlisted executable." };
+            }
+          }
+          return {
+            decision: "allow",
+            metadata: {
+              environmentId: binding.environmentId,
+              imageDigest: image.imageDigest,
+              network: "deny",
+              phase: authorization.phase
+            }
+          };
+        },
+        async execute(_authorization, operation) {
+          return await operation();
+        },
+        async status() {
+          const patch = await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes, options.config.maxWorkspaceBytes, ioMetrics, identity);
+          return {
+            schemaVersion: HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
+            kind: "environment-status",
+            runId: request.runId,
+            binding,
+            runtime: image.runtime,
+            runtimeVersion: image.runtimeVersion,
+            imageReference: image.imageReference,
+            imageDigest: image.imageDigest,
+            network: "deny",
+            rootFilesystem: "read-only",
+            workspace: "ephemeral-snapshot",
+            patchId: patch.patchId,
+            changedFiles: patch.entries.length,
+            io: { ...ioMetrics }
+          };
+        },
+        runCommand,
+        runCommandBatch,
+        runShell,
+        async runCheck(check, expectedScript, allowedChecks, context) {
+          let manifestDocument;
+          try {
+            const manifestFile = await readRegularFileNoFollow(path4.join(snapshotRoot, "package.json"), {
+              label: "Snapshot package.json",
+              maxBytes: 1024 * 1024
+            });
+            manifestDocument = JSON.parse(manifestFile.contents.toString("utf8"));
+          } catch (error) {
+            if (error.code === "ENOENT") {
+              throw new Error("The environment snapshot does not contain package.json.");
+            }
+            throw error;
+          }
+          const resolved = await resolvePackageCheckCommand(snapshotRoot, manifestDocument, check, expectedScript, allowedChecks);
+          return runCommand(resolved.command[0], resolved.command.slice(1), context);
+        },
+        async inspectPatch() {
+          const patch = await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes, options.config.maxWorkspaceBytes, ioMetrics, identity);
+          metadata.lastInspectedPatchId = patch.patchId;
+          await atomicJson(metadataPath, metadata);
+          const payload = patchPayload(request.runId, patch.entries);
+          return {
+            ...payload,
+            patchId: patch.patchId,
+            totalBytes: patch.totalBytes
+          };
+        },
+        async importPatch(host, patchId, assertActive) {
+          await assertActive?.();
+          const intended = await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes, options.config.maxWorkspaceBytes, ioMetrics, identity);
+          if (intended.patchId !== patchId) {
+            throw new EnvironmentPatchDriftError(patchId, intended.patchId, metadata.lastInspectedPatchId);
+          }
+          metadata.deliveryPaths = deliveryPaths([...new Set([
+            ...deliveryPaths(metadata.deliveryPaths),
+            ...intended.entries.map((entry) => entry.path)
+          ])]);
+          await atomicJson(metadataPath, metadata);
+          return importPatch(request.runId, patchId, host, base, workspace, options.config.maxFileWriteBytes, options.config.maxWorkspaceBytes, ioMetrics, assertActive, identity, metadata.lastInspectedPatchId);
+        },
+        async release(result) {
+          await runtime.removeRunContainers(identity);
+          metadata.releasedAt = new Date().toISOString();
+          metadata.status = result.status;
+          await atomicJson(metadataPath, metadata);
+        }
+      };
+      return session;
+    }
+  };
+};
+var executionBoundaryError = (error, message) => {
+  if (error instanceof HarnessError || error instanceof Error && error.name === "ToolExecutionSuspendedError") {
+    throw error;
+  }
+  throw new HarnessExecutionError(error instanceof Error ? error.message : message, {
+    cause: error,
+    retryable: true
+  });
+};
+var typedExecutionSession = (session) => new Proxy(session, {
+  get(target, property, receiver) {
+    const value = Reflect.get(target, property, receiver);
+    if (typeof value !== "function")
+      return value;
+    return async (...args) => {
+      try {
+        return await Reflect.apply(value, target, args);
+      } catch (error) {
+        return executionBoundaryError(error, "Enforced execution session failed.");
+      }
+    };
+  }
+});
+var createHarnessOciExecutionEnvironment = async (options) => {
+  try {
+    const environment = await createHarnessOciExecutionEnvironmentUnsafe(options);
+    return {
+      ...environment,
+      async pendingDelivery(request) {
+        try {
+          return await environment.pendingDelivery(request);
+        } catch (error) {
+          return executionBoundaryError(error, "Execution delivery inspection failed.");
+        }
+      },
+      async previewPatch(request, patchId) {
+        try {
+          return await environment.previewPatch(request, patchId);
+        } catch (error) {
+          return executionBoundaryError(error, "Execution patch review failed.");
+        }
+      },
+      async acquire(request) {
+        try {
+          return typedExecutionSession(await environment.acquire(request));
+        } catch (error) {
+          return executionBoundaryError(error, "Enforced execution environment acquisition failed.");
+        }
+      }
+    };
+  } catch (error) {
+    return executionBoundaryError(error, "Enforced execution environment could not be created.");
+  }
+};
+var cleanupHarnessExecutionArtifacts = async (stateDirectory, before, selection) => {
+  const root = path4.join(stateDirectory, "environments");
+  const result = { scanned: 0, deleted: 0, skipped: 0 };
+  let entries;
+  try {
+    entries = await readdir3(root, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return result;
+    throw error;
+  }
+  for (const entry of entries) {
+    const stagedMatch = STAGED_EXECUTION_ARTIFACT_DIRECTORY_PATTERN.exec(entry.name);
+    const artifactName = EXECUTION_ARTIFACT_DIRECTORY_PATTERN.test(entry.name) ? entry.name : stagedMatch?.[1];
+    if (!entry.isDirectory() || entry.isSymbolicLink() || !artifactName) {
+      result.skipped += 1;
+      continue;
+    }
+    result.scanned += 1;
+    const directory = path4.join(root, entry.name);
+    try {
+      const resolved = await realpath3(directory);
+      if (!isInside2(root, resolved))
+        throw new Error("unsafe execution artifact directory");
+      const directoryEntry = await lstat4(directory);
+      if (directoryEntry.isSymbolicLink() || !directoryEntry.isDirectory()) {
+        throw new Error("unsafe execution artifact directory");
+      }
+      const metadataPath = path4.join(directory, "environment.json");
+      const metadataFile = await readRegularFileNoFollow(metadataPath, {
+        label: "Execution cleanup metadata",
+        maxBytes: 1024 * 1024
+      });
+      const metadata = JSON.parse(metadataFile.contents.toString("utf8"));
+      if (selection && (metadata.hostWorkspace !== await realpath3(selection.workspace) || metadata.scopeKey !== executionScopeKey(selection.scope))) {
+        result.skipped += 1;
+        continue;
+      }
+      if (metadata.executionIdentity && (metadata.stateDirectory !== await realpath3(stateDirectory) || metadata.executionIdentity !== executionIdentity(metadata.hostWorkspace, metadata.stateDirectory, metadata.runId, metadata.scopeKey) || runHash(metadata.executionIdentity) !== artifactName)) {
+        result.skipped += 1;
+        continue;
+      }
+      const releasedAt = metadata.releasedAt ? Date.parse(metadata.releasedAt) : Number.NaN;
+      if (!metadata.status || !TERMINAL_STATUSES.has(metadata.status) || !Number.isFinite(releasedAt) || releasedAt >= before) {
+        result.skipped += 1;
+        continue;
+      }
+      const stagedDirectory = path4.join(root, `.cleanup-${artifactName}-${randomUUID2()}`);
+      let staged = false;
+      try {
+        await rename2(directory, stagedDirectory);
+        staged = true;
+        const movedEntry = await lstat4(stagedDirectory);
+        if (movedEntry.isSymbolicLink() || !movedEntry.isDirectory() || movedEntry.dev !== directoryEntry.dev || movedEntry.ino !== directoryEntry.ino) {
+          throw new Error("execution artifact directory changed before cleanup");
+        }
+        const recheckedMetadata = await readRegularFileNoFollow(path4.join(stagedDirectory, "environment.json"), { label: "Execution cleanup metadata", maxBytes: 1024 * 1024 });
+        if (!recheckedMetadata.contents.equals(metadataFile.contents)) {
+          throw new Error("execution artifact metadata changed before cleanup");
+        }
+        await rm(stagedDirectory, { recursive: true, force: true });
+        staged = false;
+        result.deleted += 1;
+      } catch (error) {
+        if (staged)
+          await rename2(stagedDirectory, directory).catch(() => {
+            return;
+          });
+        throw error;
+      }
+    } catch {
+      result.skipped += 1;
+    }
+  }
+  return result;
+};
+var executionFingerprintInput = (execution, environment) => execution.backend === "none" ? { backend: "none" } : {
+  ...execution,
+  image: environment?.image,
+  binding: environment ? createAgentExecutionEnvironmentBinding(environment.manifest) : undefined
+};
+var describeOciCommand = (command, args) => commandDisplay([command, ...args]);
+
+export { withWorkspaceMutation, EnvironmentPatchDriftError, boundedBatches, replacementEditSchema, isHardIgnored, Workspace, HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION, HARNESS_OCI_LABEL, HARNESS_OCI_LABEL_VALUE, CliOciRuntimeAdapter, collectSnapshotInventory, readSnapshotFile, harnessExecutionSession, createHarnessOciExecutionEnvironment, cleanupHarnessExecutionArtifacts, executionFingerprintInput, describeOciCommand };