@zhivex-ai/harness 1.2.0 → 1.3.0-rc.7

package/docs/VERTEX.md

@@ -0,0 +1,50 @@
+# Google Cloud Vertex AI (provisional)
+
+Vertex is a separate provider (`vertex`), using Google Cloud Application Default
+Credentials (ADC). A Gemini API key does not configure this route. The bundled
+`gemini-3.7-flash` selection is unverified; its pinned SDK requires `global`.
+Use a model enabled for your project and location. No live certification,
+pricing or context limits are inferred from the Gemini direct API.
+
+## Configuration
+
+Configure ADC on the host using your organization's Google Cloud workflow.
+Local application-default credentials, an explicit ADC credential file, and
+attached cloud identities are resolved by `google-auth-library`. Tokens are
+cached and renewed by that library, not stored in Harness sessions or Keychain.
+
+Set `GOOGLE_CLOUD_PROJECT` and `VERTEX_LOCATION` explicitly in the launching
+environment. Set `GOOGLE_APPLICATION_CREDENTIALS` to an ADC file if required by
+your deployment. Otherwise the host's standard ADC discovery applies. Harness
+does not edit credential files or run a login flow. Static `VERTEX_ACCESS_TOKEN`,
+`GOOGLE_ACCESS_TOKEN`, `VERTEX_API_KEY` and `GOOGLE_API_KEY` do not override ADC.
+Custom Vertex endpoints are not supported by this integration.
+
+Select `vertex` through the CLI provider selector or `--provider vertex`, then
+choose your model. The CLI credentials screen explains ADC instead of asking for
+an API key. In Desktop, launch the app with the same environment and select
+Google Cloud Vertex AI in the model selector. The credentials screen checks
+route configuration and can request an ADC token; it does not store/delete ADC.
+Restart Desktop after changing its project or location.
+
+Configuration presence is not an authentication or model-access check. ADC
+renewal and generation can still fail due to expired grants, missing credentials,
+IAM, model/region availability, quota or service errors. The ADC button only
+checks token acquisition; it does not certify model access or issue generation.
+
+## Durable execution and diagnostics
+
+Project, location and the explicit ADC-file path are hashed into the durable
+transport binding. A changed route cannot approve a run created on another route.
+Token renewal does not change the binding. Account changes behind the same ADC
+file remain governed by Google Cloud IAM; Harness does not fingerprint tokens.
+Unconfigured Vertex does not change existing provider transport bindings.
+
+Errors expose bounded categories for authentication, permission, unavailable
+model/route, rate limit and server failures. Raw Google payloads, token values,
+credential paths and service-account identities are not retained in errors.
+
+The integration pins `@zhivex-ai/vertex@1.1.2` with Core 1.26.0 and
+`google-auth-library@11.0.2`. Deterministic tests exercise the installed SDK's
+transport, streaming, signed continuation, approval/reopen and route mismatch.
+They are not evidence of a live project, renewable ADC or IAM authorization.

package/docs/adr/0002-isolated-mcp-stdio.md

@@ -0,0 +1,135 @@
+# ADR 0002: Host-admitted MCP stdio inside OCI
+
+Status: proposed for implementation review (HAR-HU-46), 2026-09-29.
+This is a design contract and acceptance fixture specification. It does not
+activate stdio, change configuration schema 1, or claim isolated execution passed.
+
+## Evidence and compatibility baseline
+
+- `src/integrations/mcp.ts`: configuration accepts `http`/`custom`; custom clients
+  require explicit host injection. Tool/resource allowlists, output bounds and
+  durable approvals already exist.
+- `src/client/acp.ts`: client `mcpServers` must be empty. Preserve that rejection
+  until host admission and isolated launch are implemented together.
+- `src/execution/execution-environment.ts`: OCI enforces network denial, read-only
+  root filesystem, unprivileged user, dropped capabilities, bounded resources,
+  private workspace volume and optional read-only dependencies. Its adapter has
+  finite `run`/`runBatch`, not an interactive stdio process lease. All MCP is
+  currently rejected with OCI enforcement before discovery.
+- Installed `@zhivex-ai/core` 1.26.0 exposes `McpClient`, call options with abort,
+  timeout/idempotency key, and an HTTP transport; no executable stdio factory was
+  found in this dependency. The control-plane transport enum is not an executor.
+
+MCP stdio uses UTF-8 newline-delimited JSON-RPC on stdin/stdout; stderr is a
+separate diagnostic stream. Preserve message correlation and initialization.
+Source: [MCP transport specification, 2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports).
+The proposed initial protocol is explicitly 2025-11-25; unsupported negotiation
+fails before discovery. HTTP's existing version behavior remains unchanged.
+
+## Boundary and authority
+
+Choose the enforced OCI boundary, initially Docker with the existing platform
+support policy. A future backend must pass the same fixtures before advertising
+support. A process on the host, a filtered environment, a permission prompt or an
+SDK transport alone is not this boundary. Missing Docker, attestation, resource
+limits or interactive capability means rejection, never host fallback.
+
+A client sends a *proposal*, not an executable command. Proposed fields are:
+`schemaVersion: 1`, server ID, immutable image digest, absolute in-image executable,
+argv array, protocol version, relative snapshot working directory, explicit tool
+and resource allowlists, permissions, environment literals, secret references,
+resource/deadline limits and snapshot identity. Unknown fields are rejected.
+Host paths, shell command strings, PATH search, package installation at launch,
+mutable image tags and interpreter flags that load host configuration are denied.
+These are proposed host API fields, not accepted workspace configuration today.
+
+The host validates and presents executable/argv, image, filesystem scope, allowed
+tools, environment names, secret reference names and limits for explicit launch
+admission. No image pull, subprocess, initialize or discovery occurs merely from
+parsing configuration, opening a client session or importing a module. The host
+may admit an already provisioned image only; image provisioning is a separate
+host operation. The host issues an opaque single-use admission receipt bound to
+principal, tenant/scope, workspace snapshot digest, session, full normalized
+proposal digest, image identity, policy version and expiry. Client booleans,
+model text and tool annotations cannot manufacture that receipt.
+
+Admission checks are repeated immediately before launch. Configuration changes,
+workspace/scope changes, expired receipts and reuse invalidate it. Raw receipt
+capabilities are not serialized to the client or exported in run histories.
+Launch admission grants no approval to call mutating tools. Existing per-call
+approval remains required; server metadata cannot expand admitted permissions.
+
+## Execution policy v1
+
+| Surface | Required enforcement |
+| --- | --- |
+| Startup | Acquire isolated execution lease and private snapshot, attest image/policy, consume admission once, then start exact executable/argv without shell. Failure removes partial resources. |
+| Environment | Start empty except host-fixed HOME/TMPDIR inside bounded tmpfs and minimal runtime locale. Admit explicitly named literal values. Reject injection/control variables including PATH, NODE_OPTIONS, loader paths and runtime preload flags. Never inherit process.env. |
+| Secrets | None by default. Host resolves admitted opaque references immediately before launch and injects only named values in the isolated process environment. Missing/expired references fail closed. No secret values in argv, proposal, fingerprints, receipts, logs or fixtures. Redact stdout-derived diagnostics as well as stderr. The admitted server can read its granted secrets; isolation does not make it trustworthy. |
+| Network | Deny all egress/ingress, DNS and host/metadata access using OCI network none. No domain allowlist or proxy exception in v1. A server requiring network is unsupported. |
+| Filesystem | Read-only image root; private snapshot at /workspace; bounded tmpfs; optional declared read-only dependency tree. No host home, repository bind mount, credential directory, Docker socket or arbitrary volume. Read-only permission mounts workspace read-only. Write permission affects only private snapshot. |
+| Publication | Isolated writes never mutate the host tree. Capture reviewed patch, validate preimages/path rules and obtain separate durable host approval before importing, using the existing execution delivery contract. |
+| Resource limits | Host hard maxima intersect requested limits: memory, CPU, pids, workspace/write bytes, tmpfs, output and elapsed runtime. No client may increase a host limit. Reject unsupported enforcement. |
+| Lifetime | One isolated server per admitted session; no cross-tenant reuse. No auto-restart or adoption after host restart. Reconnect requires fresh launch admission. |
+
+The reusable execution policy remains authoritative; this proposal cannot weaken
+its limits. SDK `McpClient` describes messages, not confinement. Bridge the admitted
+process streams into an internal client implementing listTools/callTool and the
+resource subset already allowed by Harness. Keep HTTP and existing injected
+custom clients unchanged in non-OCI runs. Do not reinterpret arbitrary injected
+clients as isolated. Preserve allowlists, bounded pagination, schema validation,
+redaction and approval wrappers above the bridge.
+
+## Lifecycle, framing and uncertain effects
+
+Proposed lifecycle: proposed -> admitted -> starting -> initializing -> ready ->
+closing -> closed, with failed terminal outcome at any nonterminal stage. Bind all
+requests and audit events to admission and process-lease identities. Suggested
+host defaults: start 10 s, initialize 10 s, existing list 5 s/call 30 s bounds,
+maximum session 10 min, graceful stop 2 s followed by forced boundary removal.
+These are finite absolute deadlines; receiving partial output cannot extend them.
+Use the smaller host/request deadline and propagate AbortSignal. Limit in-flight
+requests to one initially, 1 MiB UTF-8 frame and 64 KiB retained redacted stderr;
+retain existing lower per-tool output limits. Apply backpressure with bounded
+queues. Oversized/incomplete frames, invalid UTF-8/JSON, duplicate or unknown
+response IDs and stdout log contamination close the transport with a typed error.
+Server-initiated execution/sampling/elicitation requests are unsupported and must
+not invoke host capabilities. Notifications cannot grant permissions.
+
+On cancellation or timeout: stop new calls, best-effort protocol cancellation,
+close stdin, terminate the isolated process tree, force-remove its boundary after
+grace, reap handles and release leases. EOF/exit fails outstanding calls. A crash
+or timeout after dispatch leaves a possibly effectful call `outcome_unknown` in
+host audit until reconciled. Reconciliation requires confirmed resource cleanup, an explicit host-authorized decision bound to the journal revision and an evidence digest. Preserve the prior uncertain status and keep the original call key unreplayable; a future call requires a new admission and approval. Never replay it automatically, even with an SDK
+idempotency key. Read-only calls are not automatically retried in v1 either.
+Do not report cleanup success until the runtime confirms resources are gone;
+otherwise retain a cleanup-required record for scoped orphan reconciliation.
+
+The current finite OCI adapter cannot fulfill this contract unchanged. A future
+optional interactive capability must expose attested launch, bounded stdin writes,
+stdout/stderr reads, exit observation and idempotent close; acquisition owns the
+lease. Missing capability fails before spawn. Do not implement stdio by calling
+host spawn from `createHarnessMcpTools` or by buffering a never-ending `run`.
+
+## Threats and review gates
+
+| Threat | Control and evidence required |
+| --- | --- |
+| Client commands run during session creation | Reject before admission; zero host/container processes and zero discovery calls. |
+| TOCTOU, swapped image/argv or replayed admission | Digest/identity recheck at launch; receipt scope/expiry/single-use tests. |
+| Secret/environment exfiltration | Empty inherited environment, restricted references, network denial, redacted audit; canary checks inside/outside boundary. |
+| Filesystem escape and host mutation | No bind mounts, no-follow snapshot/import rules, resource limits and reviewed publication; symlink/traversal fixtures. |
+| Tool metadata or prompt injection escalates authority | Independent host policy and per-call approvals; untrusted descriptions/results remain data. |
+| Hung/forking/noisy process | Absolute deadlines, frame/queue/stderr/resource bounds and whole-boundary cleanup. |
+| Cross-scope reuse or uncertain effect replay | Scoped leases/admission; persisted unknown outcome; no reconnect/restart replay. |
+| False isolation claim | Real OCI and installed-package gates, not mocks alone; unsupported backend denied. |
+
+The [fixture catalogue](../fixtures/mcp-stdio-contract-v1.json) specifies positive
+and negative acceptance before implementation. Every case is currently
+`specified_not_executed`, not a passed test. Implementation must supply observations
+for launch counts, process identity, network probes, host/snapshot digests, resource
+cleanup and sanitized errors as specified. A fake runtime may prove host admission
+logic; only real OCI can establish filesystem/network/process enforcement.
+Existing MCP/ACP regression tests protect today's rejection boundary. Delivery
+requires Node and Bun installed consumers plus real supported OCI execution,
+including crash/cancel/orphan fixtures, before changing support/ACP capabilities.

package/docs/fixtures/mcp-stdio-contract-v1.json

@@ -0,0 +1,189 @@
+{
+  "schemaVersion": 1,
+  "status": "design_only",
+  "cases": [
+    {
+      "id": "admitted_read",
+      "kind": "positive",
+      "given": "Host admits immutable image and read-only snapshot",
+      "when": "initialize, list and call allowed read tool",
+      "observationsRequired": [
+        "exact argv launched only inside OCI",
+        "bounded result returned",
+        "host digest unchanged",
+        "cleanup confirmed"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "admitted_write",
+      "kind": "positive",
+      "given": "Launch and mutating call approved separately",
+      "when": "write private snapshot and request delivery",
+      "observationsRequired": [
+        "no host change before import approval",
+        "reviewed preimage import applies once"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "secret_reference",
+      "kind": "positive",
+      "given": "Host admits one secret reference",
+      "when": "read allowed env name and emit canary diagnostics",
+      "observationsRequired": [
+        "only named secret inside process",
+        "canary absent from audit and exports"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "unadmitted_client",
+      "kind": "negative",
+      "given": "ACP/client supplies executable without host receipt",
+      "when": "open session and request discovery",
+      "observationsRequired": [
+        "no image pull",
+        "zero process starts",
+        "zero discovery calls"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "receipt_drift",
+      "kind": "negative",
+      "given": "Valid receipt then image, argv, snapshot or scope changes",
+      "when": "attempt launch for each independent mutation",
+      "observationsRequired": [
+        "rejected before process start"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "receipt_replay",
+      "kind": "negative",
+      "given": "Expired or consumed receipt",
+      "when": "attempt launch",
+      "observationsRequired": [
+        "rejected before process start"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "missing_backend",
+      "kind": "negative",
+      "given": "No interactive OCI capability or unavailable runtime",
+      "when": "admit request",
+      "observationsRequired": [
+        "unsupported error",
+        "no host fallback"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "environment_injection",
+      "kind": "negative",
+      "given": "Ambient credential canary and requested NODE_OPTIONS",
+      "when": "attempt admission",
+      "observationsRequired": [
+        "control variable rejected",
+        "ambient env never inherited"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "network_escape",
+      "kind": "negative",
+      "given": "Admitted malicious process",
+      "when": "probe DNS, public IP and metadata IP",
+      "observationsRequired": [
+        "all probes denied by real OCI",
+        "no host proxy"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "filesystem_escape",
+      "kind": "negative",
+      "given": "Snapshot contains symlink and traversal attempts",
+      "when": "read host home and write outside workspace",
+      "observationsRequired": [
+        "host files inaccessible",
+        "host digest unchanged",
+        "unsafe import denied"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "permission_escalation",
+      "kind": "negative",
+      "given": "Read tool annotation claims write is safe",
+      "when": "call undeclared or mutating tool",
+      "observationsRequired": [
+        "host permissions prevail",
+        "no mutation without approval"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "protocol_abuse",
+      "kind": "negative",
+      "given": "Noisy or hostile stdio server",
+      "when": "send oversized/incomplete frames, malformed UTF8, unknown/duplicate IDs and server requests",
+      "observationsRequired": [
+        "bounded buffers",
+        "typed error or unsupported-method response",
+        "no host execution"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "hung_call",
+      "kind": "negative",
+      "given": "Server receives an approved effectful call then hangs",
+      "when": "expire absolute deadline",
+      "observationsRequired": [
+        "unknown outcome retained",
+        "no automatic replay",
+        "process tree terminated"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "cancel_tree",
+      "kind": "negative",
+      "given": "Server forks children and ignores graceful termination",
+      "when": "cancel run",
+      "observationsRequired": [
+        "admission closed",
+        "forced removal after grace",
+        "no leaked descendants or leases"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "crash_restart",
+      "kind": "negative",
+      "given": "Host or server crashes after dispatch",
+      "when": "reopen host session",
+      "observationsRequired": [
+        "no replay",
+        "fresh admission required",
+        "orphan cleanup scoped to owner"
+      ],
+      "status": "specified_not_executed"
+    },
+    {
+      "id": "cleanup_failure",
+      "kind": "negative",
+      "given": "Runtime cannot confirm boundary removal",
+      "when": "close session",
+      "observationsRequired": [
+        "cleanup-required retained",
+        "no false closed-success",
+        "bounded reconciliation"
+      ],
+      "status": "specified_not_executed"
+    }
+  ]
+}

package/docs/support-matrix.json

@@ -24,6 +24,8 @@
     { "id": "provider-meta", "dimension": "provider", "target": "Meta muse-spark-1.2", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", "release-status.json"] },
     { "id": "provider-qwen", "dimension": "provider", "target": "Qwen qwen3.8-max", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", "release-status.json"] },
     { "id": "provider-openai", "dimension": "provider", "target": "OpenAI gpt-5.6-luna", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", "release-status.json"] },
+    { "id": "provider-vertex", "dimension": "provider", "target": "Google Cloud Vertex AI (ADC)", "level": "provisional", "evidence": ["docs/VERTEX.md", "tests/vertex-provider.test.ts", "tests/vertex-auth.test.ts"] },
+    { "id": "provider-anthropic", "dimension": "provider", "target": "Anthropic direct API / claude-sonnet-5", "level": "provisional", "evidence": ["docs/ANTHROPIC.md"] },
     { "id": "provider-gemini", "dimension": "provider", "target": "Gemini gemini-3.6-flash / 3.7-flash", "level": "provisional", "evidence": ["docs/LIVE_CERTIFICATION.md"] }
   ]
 }

package/evaluations/representative-assembly-matrix.json

@@ -45,7 +45,14 @@
     "v1.2.0-rc.11",
     "v1.2.0-rc.12",
     "v1.2.0-rc.13",
-    "v1.2.0"
+    "v1.2.0",
+    "v1.3.0-rc.1",
+    "v1.3.0-rc.2",
+    "v1.3.0-rc.3",
+    "v1.3.0-rc.4",
+    "v1.3.0-rc.5",
+    "v1.3.0-rc.6",
+    "v1.3.0-rc.7"
   ],
   "expectedModels": [
     {
@@ -399,6 +406,62 @@
         "qwen": "qwen3.8-flash",
         "openai": "gpt-6-luna"
       }
+    },
+    {
+      "releaseTag": "v1.3.0-rc.1",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
+    },
+    {
+      "releaseTag": "v1.3.0-rc.2",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
+    },
+    {
+      "releaseTag": "v1.3.0-rc.3",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
+    },
+    {
+      "releaseTag": "v1.3.0-rc.4",
+      "models": {
+        "meta": "muse-spark-1.3",
+        "qwen": "qwen3.8-max",
+        "openai": "gpt-6-luna"
+      }
+    },
+    {
+      "releaseTag": "v1.3.0-rc.5",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
+    },
+    {
+      "releaseTag": "v1.3.0-rc.6",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
+    },
+    {
+      "releaseTag": "v1.3.0-rc.7",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
     }
   ],
   "expectedCases": [

package/evaluations/task-acceptance-routes.json

@@ -0,0 +1,7 @@
+[
+  { "provider": "openai", "model": "gpt-6-luna", "route": "direct-api" },
+  { "provider": "qwen", "model": "qwen3.8-flash", "route": "direct-api" },
+  { "provider": "meta", "model": "muse-spark-1.3-contributor", "route": "direct-api" },
+  { "provider": "gemini", "model": "gemini-3.6-flash", "route": "direct-api" },
+  { "provider": "anthropic", "model": "claude-sonnet-5", "route": "direct-api" }
+]

package/examples/README.md

@@ -8,7 +8,7 @@ Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After pro
 harness_demo_dir=$(mktemp -d)
 cd "$harness_demo_dir"
 printf '{"name":"harness-first-run","private":true}\n' > package.json
-bun add --exact --ignore-scripts @zhivex-ai/harness@1.2.0
+bun add --exact --ignore-scripts @zhivex-ai/harness@1.3.0-rc.7
 ./node_modules/.bin/zhx --version
 ./node_modules/.bin/zhx --help
 ./node_modules/.bin/zhx doctor --provider openai --json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhivex-ai/harness",
-  "version": "1.2.0",
+  "version": "1.3.0-rc.7",
   "description": "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   "type": "module",
   "license": "MIT",
@@ -45,6 +45,46 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./engine": {
+      "types": "./dist/engine/index.d.ts",
+      "import": "./dist/engine/index.js"
+    },
+    "./protocol": {
+      "types": "./dist/engine/protocol.d.ts",
+      "import": "./dist/engine/protocol.js"
+    },
+    "./client": {
+      "types": "./dist/engine/client.d.ts",
+      "import": "./dist/engine/client.js"
+    },
+    "./service": {
+      "types": "./dist/engine/service.d.ts",
+      "import": "./dist/engine/service.js"
+    },
+    "./acp": {
+      "types": "./dist/engine/acp.d.ts",
+      "import": "./dist/engine/acp.js"
+    },
+    "./code-support": {
+      "types": "./dist/compat/code-support.d.ts",
+      "import": "./dist/compat/code-support.js"
+    },
+    "./models": {
+      "types": "./dist/engine/models.d.ts",
+      "import": "./dist/engine/models.js"
+    },
+    "./desktop/v1/state": {
+      "types": "./dist/engine/desktop-state-v1.d.ts",
+      "import": "./dist/engine/desktop-state-v1.js"
+    },
+    "./desktop/v1/providers": {
+      "types": "./dist/engine/desktop-providers-v1.d.ts",
+      "import": "./dist/engine/desktop-providers-v1.js"
+    },
+    "./mcp/stdio/v1": {
+      "types": "./dist/engine/mcp-stdio-v1.d.ts",
+      "import": "./dist/engine/mcp-stdio-v1.js"
     }
   },
   "files": [
@@ -56,6 +96,7 @@
     "LICENSE",
     "docs/CHANGE_ENVELOPES.md",
     "docs/CLI.md",
+    "docs/CODE_RELEASE.md",
     "docs/images/cli-conversation.png",
     "docs/CLIENT_PROTOCOL.md",
     "docs/CONTEXT_ENGINEERING.md",
@@ -87,14 +128,21 @@
     "evaluations/*.jsonl",
     "benchmarks/README.md",
     "docs/ACP.md",
-    "docs/WORKSPACE_CHECKPOINTS.md"
+    "docs/WORKSPACE_CHECKPOINTS.md",
+    "docs/ENGINE_API.md",
+    "docs/ANTHROPIC.md",
+    "docs/MCP_STDIO.md",
+    "docs/adr/0002-isolated-mcp-stdio.md",
+    "docs/VERTEX.md",
+    "docs/TOOL_POLICY.md",
+    "docs/fixtures/mcp-stdio-contract-v1.json"
   ],
   "scripts": {
     "models:check": "bun run scripts/validate-model-catalog.ts",
     "models:import": "bun run scripts/generate-console-models.ts",
     "dev": "bun run build && node --env-file-if-exists=.env dist/cli.js",
     "start": "node dist/cli.js",
-    "build": "bun run scripts/clean-dist.ts && bun build ./src/index.ts ./src/service-cli.ts ./src/acp-cli.ts --outdir ./dist --target node --packages external && bun build ./src/cli-entry.ts --outdir ./dist --target node --packages external --splitting && mv ./dist/cli-entry.js ./dist/cli.js && cp ./dist/cli.js ./dist/zhx.js && bun build ./scripts/verify-historical-migrations.ts --outfile ./dist/verify-historical-migrations.js --target node --packages external && bun build ./scripts/hostile-repository-demo.ts --outfile ./dist/hostile-repository-demo.js --target node --packages external && tsc --emitDeclarationOnly",
+    "build": "bun run scripts/clean-dist.ts && bun build ./src/index.ts ./src/service-cli.ts ./src/acp-cli.ts ./src/engine/index.ts ./src/engine/protocol.ts ./src/engine/client.ts ./src/engine/service.ts ./src/engine/acp.ts ./src/engine/models.ts ./src/engine/desktop-state-v1.ts ./src/engine/desktop-providers-v1.ts ./src/compat/code-support.ts ./src/engine/mcp-stdio-v1.ts --root ./src --outdir ./dist --target node --packages external --splitting && bun build ./src/engine/protocol.ts ./src/engine/models.ts --outdir ./dist/engine --target browser --packages external && bun build ./src/cli-entry.ts --outdir ./dist --target node --packages external --splitting && mv ./dist/cli-entry.js ./dist/cli.js && cp ./dist/cli.js ./dist/zhx.js && bun build ./scripts/verify-historical-migrations.ts --outfile ./dist/verify-historical-migrations.js --target node --packages external && bun build ./scripts/hostile-repository-demo.ts --outfile ./dist/hostile-repository-demo.js --target node --packages external && tsc --emitDeclarationOnly",
     "prepack": "bun run build",
     "architecture:check": "bun run scripts/check-architecture.ts",
     "docs:check": "bun run scripts/check-docs.ts",
@@ -143,24 +191,38 @@
     "smoke:console": "bun run build && python3 scripts/console-pty-smoke.py && python3 scripts/console-entry-smoke.py",
     "smoke:credentials": "node --experimental-strip-types scripts/credential-store-smoke.ts",
     "release:preflight": "bun run scripts/release-preflight.ts",
-    "release:prepare": "bun run scripts/prepare-release.ts"
+    "release:prepare": "bun run scripts/prepare-release.ts",
+    "build:code": "bun run --cwd packages/code build",
+    "test:code": "bun run --cwd packages/code test",
+    "smoke:engine-code": "bun run scripts/smoke-engine-code.ts",
+    "smoke:state-upgrade": "bun run scripts/smoke-state-upgrade.ts",
+    "smoke:global-code": "node scripts/smoke-global-code.mjs",
+    "dev:code": "bun run build && bun run packages/code/scripts/link-local-engine.ts && bun run build:code",
+    "typecheck:code": "bun run --cwd packages/code typecheck",
+    "evaluate:tasks": "bun run scripts/task-acceptance.ts",
+    "prepare:desktop": "bun run build && bun pm pack --ignore-scripts --quiet --filename desktop/.harness-candidate.tgz && bun run desktop/scripts/prepare-harness.ts desktop/.harness-candidate.tgz",
+    "smoke:mcp:installed": "bun run build && bun scripts/mcp-installed-smoke.ts"
   },
   "dependencies": {
-    "@zhivex-ai/agents": "1.10.1",
-    "@zhivex-ai/core": "1.26.0",
-    "@zhivex-ai/gemini": "0.12.3",
+    "@zhivex-ai/agents": "1.10.2",
+    "@zhivex-ai/anthropic": "0.13.1",
+    "@zhivex-ai/core": "1.28.0",
+    "@zhivex-ai/gemini": "0.13.0",
     "@zhivex-ai/meta": "0.2.8",
-    "@zhivex-ai/openai": "0.13.6",
-    "@zhivex-ai/qwen": "0.16.2",
+    "@zhivex-ai/openai": "0.13.7",
+    "@zhivex-ai/qwen": "0.16.3",
+    "@zhivex-ai/vertex": "1.2.2",
+    "google-auth-library": "11.1.0",
     "zod": "4.6.5"
   },
   "overrides": {
-    "@zhivex-ai/core": "1.26.0"
+    "@zhivex-ai/core": "1.28.0"
   },
   "devDependencies": {
-    "@modelcontextprotocol/server": "2.0.0",
+    "@agentclientprotocol/sdk": "1.5.1",
+    "@modelcontextprotocol/server": "2.2.0",
     "@types/bun": "1.4.2",
-    "@types/node": "^26.6.2",
+    "@types/node": "^26.6.3",
     "typescript": "7.0.2",
     "typescript-compiler-api": "npm:typescript@6.0.3"
   },

package/dist/cli-entry-64pdp3k5.js

@@ -1,17 +0,0 @@
-// src/version.ts
-import { createRequire } from "node:module";
-var packageMetadata = createRequire(import.meta.url)("../package.json");
-if (typeof packageMetadata.version !== "string" || packageMetadata.version.length === 0) {
-  throw new Error("package.json must contain a non-empty version.");
-}
-if (typeof packageMetadata.engines?.node !== "string" || packageMetadata.engines.node.length === 0) {
-  throw new Error("package.json must contain a non-empty engines.node requirement.");
-}
-if (typeof packageMetadata.engines?.bun !== "string" || packageMetadata.engines.bun.length === 0) {
-  throw new Error("package.json must contain a non-empty engines.bun requirement.");
-}
-var HARNESS_VERSION = packageMetadata.version;
-var NODE_ENGINE_RANGE = packageMetadata.engines.node;
-var BUN_ENGINE_RANGE = packageMetadata.engines.bun;
-
-export { HARNESS_VERSION, NODE_ENGINE_RANGE, BUN_ENGINE_RANGE };