@zhivex-ai/harness 1.4.0-rc.6 → 1.4.0-rc.8

package/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 1.4.0-rc.8 - 2026-10-08
+
+- Prepare matched Harness 1.4.0-rc.8 and Code 0.3.0-rc.8 for npm `next`, with the exact Code engine pin, private Desktop binding and an additive representative mapping using unchanged models. Retain the SDK pins already on main (Core 1.31.0, Agents 1.11.0 and the existing provider packages). Stable `latest` stays Harness 1.3.0 and Code 0.2.0.
+- Refuse a second `delegate_*` call for a task that was already accepted in the same model response. The duplicate stays non-executable and the next turn tells the coordinator to use the completed result instead of retrying. A later model step can still recover from an invalid call that did not execute. Paused runs bound to the previous delegation fingerprint must be completed with the artifact that created them.
+- Document that Qwen live certification accepts `DASHSCOPE_API_KEY` alone. `QWEN_API_KEY`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, and `QWEN_REGION` remain optional overrides.
+- Preserve annotated `v1.4.0-rc.7` at `1f986a0b044fa2827166fc934c712684971127b5`. It was tagged but not published because live certification failed on Qwen in the bounded reviewer orchestration gate. No Code RC.7 tag was created. Published npm `next` remains Harness 1.4.0-rc.6 and Code 0.3.0-rc.6. That evidence does not certify RC.8.
+- Require fresh exact-source/artifact validation and separate explicit approval before any paid campaign, annotated tag or publication. Provider/API tiers remain unchanged.
+
+## 1.4.0-rc.7 - 2026-10-08
+
+- Prepare matched Harness 1.4.0-rc.7 and Code 0.3.0-rc.7 for npm `next`, with the exact Code engine pin, private Desktop binding and an additive representative mapping using unchanged models. Retain the SDK pins already on main (Core 1.31.0, Agents 1.11.0 and the existing provider packages). Stable `latest` stays Harness 1.3.0 and Code 0.2.0.
+- Include reviewed main since published 1.4.0-rc.6: optional Web task/project limits and immediate composer consumption (PR189); sanitized Qwen SSE transport/parser diagnostics in CLI JSON/JSONL and failed client runs, including message-only installed SDK compatibility, while provider payloads, parser causes and arbitrary exception text stay excluded (PR188); experimental guided Code task budget authority across turns, correction and restart (PR187); private Desktop Electron 44.5.1 (PR180); persisted task cancellation that fences late admissions (PR190, HAR-HU-71); and host-only task continuity over existing SQLite task, contract, journal and budget records (PR191, HAR-HU-72).
+- Keep one native SQLite writer and the SDK token coordinator. Reserve before primary and compaction dispatch, fence tools and checkpoints against the task lease, retain uncertain consumption and unknown exposure, and require explicit known-outcome continuation after cancellation. Preserve contract revisions, refuse stale approvals and missing or uncertain effect evidence, and revalidate receipts before Code keep. No automatic effect replay or new public web task projection.
+- Show authoritative task limits, confirmed/reserved/unknown usage, fresh checks and human decisions in Code; retain drafts when admission fails before a run checkpoint. Ordinary non-task retry and no-cap chat stay unchanged, and unlimited hosts still require explicit task token limits. Index transport usage by scope/run without changing pruning, redaction or mandatory persistence errors. Preserve explicit monetary output caps above 2,048.
+- Add numeric monotonic phase telemetry and a frozen synthetic offline evaluation scaffold. These fixtures validate runtime behavior, not real-task or model quality; real holdout selection, human review and any paid campaign remain pending. Logical JSON backups omit transport monetary tables and cannot restore task spending authority; incomplete restores fail closed.
+- Preserve published Harness `v1.4.0-rc.6` and Code `code-v0.3.0-rc.6` at `0adf4e2e96380864ef4c697ea94df64ad7c18eec`, the held RC.5 campaign, and the RC.4 failure history and SDK store migration requirements. Their evidence does not certify RC.7.
+- Require fresh exact-source/artifact validation and separate explicit approval before any paid campaign, annotated tag or publication. Provider/API tiers remain unchanged.
+
 ## 1.4.0-rc.6 - 2026-10-05
 
 - Prepare matched Harness 1.4.0-rc.6 and Code 0.3.0-rc.6 for npm `next`, with the exact Code engine pin, private Desktop binding and an additive representative mapping using unchanged models and SDK pins.

package/README.md

@@ -18,8 +18,9 @@ the reusable engine and its compatibility CLI. The `/task` delivery workflow in
 this checkout is an unreleased experimental Code addition, not a published feature.
 
 Version `1.3.0` is the current public npm release on `latest`, with terminal-independent engine
-entrypoints and the separately published Code CLI `0.2.0` on `latest`. Harness publication passed registry integrity and provenance verification. Harness `1.4.0-rc.1` and
-Code `0.3.0-rc.1` are published on `next`. The RC.6 versions prepared in this
+entrypoints and the separately published Code CLI `0.2.0` on `latest`. Harness publication passed registry integrity and provenance verification. Harness `1.4.0-rc.6` and
+Code `0.3.0-rc.6` are published on `next`. Annotated `v1.4.0-rc.7` was tagged but
+not published after live certification failed. The RC.8 versions prepared in this
 checkout remain unpublished. Stable package numbering does
 not change API stability tiers: beta and experimental APIs retain their policies,
 Gemini/Anthropic/Vertex remain provisional, and Desktop remains a private alpha.
@@ -49,7 +50,7 @@ them. Ctrl+C stops active work; it does not undo completed changes.
 
 ## Release candidates
 
-This checkout prepares Harness `1.4.0-rc.6` and Code `0.3.0-rc.6` for `next`, with an exact engine pin. Project memory, compact terminal review and the local browser workspace ship together after protected validation. See the [release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md). RC.6 publication is pending. It includes the reviewed bounded activity snapshot fix; RC.5 remains held and its source/tag cannot be reused for this fix. The failed RC.4 attempt and immutable source are preserved; npm `next` currently points to Harness `1.4.0-rc.1` and Code `0.3.0-rc.1`. These prerelease candidates are separate from the stable `latest` channel.
+This checkout prepares Harness `1.4.0-rc.8` and Code `0.3.0-rc.8` for `next`, with an exact engine pin. Project memory, compact terminal review and the local browser workspace ship together after protected validation. See the [release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md). RC.8 publication is pending. It includes the reviewed duplicate-delegation fix on main after RC.7. Published npm `next` is Harness `1.4.0-rc.6` and Code `0.3.0-rc.6`. Annotated `v1.4.0-rc.7` was tagged but not published after Qwen live certification failed; that source and tag cannot certify RC.8. The held RC.5 campaign and failed RC.4 attempt remain preserved. These prerelease candidates are separate from the stable `latest` channel.
 
 Use candidates only for prerelease validation. Check [npm versions](https://www.npmjs.com/package/@zhivex-ai/harness?activeTab=versions)
 and the [release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md)
@@ -58,7 +59,7 @@ before installing a candidate; `next` can still point to an earlier RC.
 After publication of this exact candidate:
 
 ```sh
-npm install -g @zhivex-ai/harness@1.4.0-rc.6
+npm install -g @zhivex-ai/harness@1.4.0-rc.8
 ```
 
 ## A few commands are enough

package/contracts/engine-api.json

@@ -2735,6 +2735,61 @@
           "name": "checkEvidence",
           "kind": "runtime",
           "tier": "experimental"
+        },
+        {
+          "name": "initializeHarnessTaskBudget",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "inspectHarnessTaskBudget",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "requestHarnessTaskCancellation",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "persistHarnessTaskDraft",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "readHarnessTaskDraft",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "TASK_BUDGET_KEY",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "inspectTaskBudgetSummary",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "inspectHarnessTaskContinuity",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "createTaskTelemetry",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "runHarnessTask",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "HarnessTaskRunOptions",
+          "kind": "type",
+          "tier": "experimental"
         }
       ]
     },

package/contracts/stable-api-signatures.json

@@ -133,7 +133,7 @@
     },
     {
       "name": "cancelHarnessRun",
-      "sha256": "sha256:5663bdef782a4ab08542d5ac8117735d5d541d0a0eb166a011238d4aa0500250"
+      "sha256": "sha256:209632058366e3993cc22c7bdadde31dd00a3f533dcfb4d61c8f5124de9c3aed"
     },
     {
       "name": "canonicalizeChangeEnvelope",
@@ -141,15 +141,15 @@
     },
     {
       "name": "cleanupHarnessRuns",
-      "sha256": "sha256:644f0b3d18d18792b85a93bd68c99c25b45e401604234243e7d0d12dcf5787bd"
+      "sha256": "sha256:0d91a941627459e31098d8f7b0f5abbde1ec518705c61e8eb4cd54ac1a2da4f8"
     },
     {
       "name": "cliJsonDocumentSchema",
-      "sha256": "sha256:1306fb65c1a58f30836b348a0b0889c1f283e841d0ce745df68a9f73a3438daa"
+      "sha256": "sha256:7e7a254c88c40eb537981b8e28cc9abeb1196e75d8ee025c12551cb8cfeab580"
     },
     {
       "name": "cliJsonLineDocumentSchema",
-      "sha256": "sha256:dc9292d7dc52a6d1764260aafc9fdf253d7febdcd7c7a805d9497d89865029c3"
+      "sha256": "sha256:94a0815632f10a637cc889ed54ffb406b9253aab373fff3bb045be68aa071d91"
     },
     {
       "name": "computeChangeEnvelopeDigest",
@@ -165,7 +165,7 @@
     },
     {
       "name": "createHarness",
-      "sha256": "sha256:b237f9c2a28c01dbc7e929afd2195af7082bb5533020bf151eba16a5626eba61"
+      "sha256": "sha256:8b682f88b2c92a5581a68f92dbd886b5dc6c8b49b04ca8e1214bed164708b9ea"
     },
     {
       "name": "createHarnessMcpTools",
@@ -177,7 +177,7 @@
     },
     {
       "name": "createHarnessStateBackup",
-      "sha256": "sha256:996add7e76050ca1278a63ecdd1d6f1f7e38cef8d970e1a43e7e3daf9f35b5b2"
+      "sha256": "sha256:f1fa095f7b2db71d64f07ff23d8823fc1ba57729d3cfdb1188969c5ab2172332"
     },
     {
       "name": "createHttpMcpClient",
@@ -185,7 +185,7 @@
     },
     {
       "name": "createProviderModel",
-      "sha256": "sha256:130bd6241a98312fe78d0542b7bc689bd7de28c0ab7f7371992f1c4838b7b48e"
+      "sha256": "sha256:482f0414ff0315198c7b1deaabf024ffdbb64b6c06e5e7d7832652931ec540bb"
     },
     {
       "name": "digestChangeEnvelopeArtifact",
@@ -193,31 +193,31 @@
     },
     {
       "name": "exportHarnessStateBackup",
-      "sha256": "sha256:9dbe5ecb1f1c62fcf8be6aa4aabdbca6a63f221eb096b6cb6f04453023a599c8"
+      "sha256": "sha256:f6a581444669735dcc3998ec24b4e6f9f389d18f4680e9c956f6287738076a12"
     },
     {
       "name": "harnessErrorDocument",
-      "sha256": "sha256:f9679ae46816d693c77acc0ecb2c35e99ab5952950f415407a1c94270bacee12"
+      "sha256": "sha256:5340a9d49948981bbaa3223ec63249351dbc6271b4caf717e34b0fcc05c8f1fd"
     },
     {
       "name": "importHarnessStateBackup",
-      "sha256": "sha256:899573e66f17237c4d9716cbab94d02e8b1609f60ea46819846507be8a0aa3de"
+      "sha256": "sha256:1929d2a2ba7de06801dc7b6b961b74e92e7fb871ac4f01e0ba9d79d9dfb97d0f"
     },
     {
       "name": "importHarnessStateBackupFile",
-      "sha256": "sha256:179e581a9c5343a7950008b3f6b55992aff8787ac0c8a3f830b1777ce0cfe30f"
+      "sha256": "sha256:07b707e8e8495a87972a075894c4ecf59161be6ac2cdce8f9a66bf71d1b51d40"
     },
     {
       "name": "inspectHarnessRun",
-      "sha256": "sha256:ab8a33265539f15910e0e4724c391b4cc944655a26c3b1ec1bfff57f38ce5cdc"
+      "sha256": "sha256:68e13aabfcd8974e92cebb7b06afdb5643c76d86b3473c2afeb127245329d4e5"
     },
     {
       "name": "inspectHarnessState",
-      "sha256": "sha256:5bb5b62cb9eec966daa96e64b932223edb5c4f2a837b79066baecd4d8a3aee48"
+      "sha256": "sha256:529d9bf8c0528942793786c345030a98e88d219c34f41ea2c3e31724cca66837"
     },
     {
       "name": "listHarnessRuns",
-      "sha256": "sha256:eece516c36ab24eef95c47ce5e7051dc53149bc9856da8b70e0e891f4fba5f3a"
+      "sha256": "sha256:2085baf7b5c69e79939dd8d13d6dbccb8166d163659823d93bd2eb10d6080acc"
     },
     {
       "name": "loadHarnessMcpConfiguration",
@@ -225,7 +225,7 @@
     },
     {
       "name": "migrateHarnessConfigInput",
-      "sha256": "sha256:3757847c7e64d66acd2a25471e2ada13576189e80e7b2bbea2c5e5f9ce9e606e"
+      "sha256": "sha256:719fcc2bef2415d972f7f04f3970b9120e285a4b9abd5df0fd01727e05befa2f"
     },
     {
       "name": "normalizeHarnessError",
@@ -241,15 +241,15 @@
     },
     {
       "name": "openHarnessPersistence",
-      "sha256": "sha256:55c8d0459d62242830e694b4650cef9971957b07d866ee609ac4267b2fb59c36"
+      "sha256": "sha256:91a4d79eb2c7a4e82cb1aa6ad199492538bd2d9599bd320eb603765fb6fca934"
     },
     {
       "name": "parseCliJsonDocument",
-      "sha256": "sha256:e84e6cea6fc403ceab1ee4e557de16b67830018447f850407c3cb9bb08173ba2"
+      "sha256": "sha256:8d94b80ef3160b12119ce8b083937ef6beed2a1b068f46f94b5077e36d54a931"
     },
     {
       "name": "parseCliJsonLineDocument",
-      "sha256": "sha256:45980d82a95b8064d8b775b97ca949d80d18a53bce0a7c2b4068d71cc88731e2"
+      "sha256": "sha256:3f0c38ada9d89150fe2cedbb50380f8e170ad22dfb2d7a17690efc057be9bc3b"
     },
     {
       "name": "parseHarnessModelRoute",
@@ -269,11 +269,11 @@
     },
     {
       "name": "resolveHarnessConfig",
-      "sha256": "sha256:281376e0bee7c855bbd2edf72923def4defa3a2e648e69f4a53b74dcf6c2f744"
+      "sha256": "sha256:92dd51056d4745eea346f9163f29b9748ac6e1b9f9d0e28a3191111093703804"
     },
     {
       "name": "runHarness",
-      "sha256": "sha256:c5b58ddb5169da5b1a6c6cb0b4000c8e7bc48a07048530501d8e7407b5e28825"
+      "sha256": "sha256:aeed30705c782cb7af884a8d51abf9d47bf4a9b7010650c842209c5f608b6019"
     },
     {
       "name": "serializeStreamEvent",
@@ -319,11 +319,11 @@
     },
     {
       "name": "CliJsonDocument",
-      "sha256": "sha256:11d75d65f9565f16d06dcdd49521e56cc6d03e4600ccbd8c743bee593a01d892"
+      "sha256": "sha256:613a0da81316ffd657d18427c28804a8f7dc51017aec2e6893d7b2d64a5ff96e"
     },
     {
       "name": "CliJsonLineDocument",
-      "sha256": "sha256:5b9f7aee6a3cac014567452e1023fec83b9ae1499b52a3f68dab074b984c806a"
+      "sha256": "sha256:5dd40d8c335fd1e6e3414825e70fd4dd70117286e1bc0f5e96c53c45b6b6c91a"
     },
     {
       "name": "CliOptionDefinition",
@@ -339,7 +339,7 @@
     },
     {
       "name": "CliRunEventDocument",
-      "sha256": "sha256:626df354f498266b390947be13556fdca171efb11b7c480973d70398e08a11e9"
+      "sha256": "sha256:9ad681aea1b90debc0682dea6487f4098c50e5cd548e4694ae07db94b80279f0"
     },
     {
       "name": "CliRunInspectionDocument",
@@ -351,7 +351,7 @@
     },
     {
       "name": "CliRunResultDocument",
-      "sha256": "sha256:31efc5f7914df25f60ebec8408242b54bcae290d2bb0306869fc2fddcf357390"
+      "sha256": "sha256:1c14e0466d7e387aa80294d1271d9b2ff37fa4cbe41d9e1d7a1ad5faabe23318"
     },
     {
       "name": "CliSession",
@@ -367,7 +367,7 @@
     },
     {
       "name": "CliStreamErrorDocument",
-      "sha256": "sha256:5c6bd4cfde648e2987b541ec07e8b681c9694f22c3a6b29cac8b57b6a6e30653"
+      "sha256": "sha256:b9f92e4dc53013ec79690838dab8f5db19bdbba10a918549a914ddf41eb423b7"
     },
     {
       "name": "CliStreamResultDocument",
@@ -375,23 +375,23 @@
     },
     {
       "name": "CreateHarnessOptions",
-      "sha256": "sha256:596b95a410a0bd84feb53ae0188177c934b1f7432c155684f7d33e9d49fff898"
+      "sha256": "sha256:bf02d5a2b5cc10dfbc59a2dcceebe91d2a56add94f9912e8d73c61da4bb64a12"
     },
     {
       "name": "HarnessBudget",
-      "sha256": "sha256:86935e2a5d85184a15af839900cff28f8f46f58df68e62114327be88e287a249"
+      "sha256": "sha256:d5ab8916582847c82fb2c86eface15f44af12a710926aa5eca2c59eac97638c0"
     },
     {
       "name": "HarnessConfig",
-      "sha256": "sha256:2de5e71869d5a40fedb3b01ab1a7c766bc8a03b7806a597c328cca6053ceda93"
+      "sha256": "sha256:afd78cedcbe664b7decf1d11dd70a5bb7ad997ea090c9afaa894398f408cbd3d"
     },
     {
       "name": "HarnessConfigInput",
-      "sha256": "sha256:01093620aed18df40794324345600983230878d197c3a1cf2f01c17aae1c382e"
+      "sha256": "sha256:4679312a8a410043ee77890447460ac294b87dade7e2eb04e809295e3093b8c1"
     },
     {
       "name": "HarnessConfigMigrationResult",
-      "sha256": "sha256:b3b86d52652e9d24b7ab6013de95000976d6058fec5b41e0e604dd3ee31a9bd2"
+      "sha256": "sha256:4d9e7b61dd92f95be292571da2251ce8927c08fe488d7742d8c71cbc87e2eedb"
     },
     {
       "name": "HarnessContextBundle",
@@ -415,7 +415,7 @@
     },
     {
       "name": "HarnessErrorDocument",
-      "sha256": "sha256:255e3c8b57aa188ea21a548445577e71f7eb052984096452c9e402162d9e4ded"
+      "sha256": "sha256:1bd889952a59431c2439a14e23b7dc1fd03ce63a4da4cdfa208da25d6f4c1c77"
     },
     {
       "name": "HarnessExecutionBackend",
@@ -487,8 +487,8 @@
     },
     {
       "name": "ZhivexHarness",
-      "sha256": "sha256:76de0209fbf835d1427b6ab2764a919e8e814237a1be7b15c9bc0dc002f8fd6e"
+      "sha256": "sha256:4275565d750dbfd7d6dcaa7182f05d74136db32b057744446de24d6b69fe2061"
     }
   ],
-  "digest": "sha256:0c2cec6bd1dd8de467e8619c18b25e48d56416dec1866ff5a124798525b1a52b"
+  "digest": "sha256:e2ef392ba67e8a07f5d511c0274f8b4171888a1469205f541350fafb0b74f8cb"
 }

package/dist/acp-cli.js

@@ -5,42 +5,44 @@ import {
   parseHarnessModelRoute,
   resolveHarnessModelRoutes,
   validateCliCommandOptions
-} from "./index-wq2tax80.js";
+} from "./index-pcn2bk8j.js";
 import {
   serveAcpStdio
 } from "./index-3ah1f369.js";
 import {
-  createHarness,
   createHarnessClientAdapter
-} from "./index-4j1h4j8c.js";
-import"./index-rd0s3gqj.js";
-import"./index-a1q355va.js";
+} from "./index-txrqqd2r.js";
+import"./index-sbzvrpm7.js";
+import {
+  createHarness
+} from "./index-nqhnh1hz.js";
 import {
   usagePricingSchema
-} from "./index-vtqfjnab.js";
-import"./index-0g939pfs.js";
-import"./index-e6r04a18.js";
+} from "./index-fny13znr.js";
+import"./index-w9pjt7td.js";
 import {
   FileChangedWhileReadingError,
   FileSizeLimitError,
   UnsafeFileTypeError,
   readRegularFileNoFollow
-} from "./index-r0tdj04h.js";
+} from "./index-zmx264xy.js";
 import {
   HARNESS_REQUIRED_CAPABILITIES,
   HARNESS_SUBAGENT_PROFILES,
-  HarnessConfigError,
-  HarnessError,
   PROVIDERS,
   createProviderModel,
   parseProvider,
   providerDescriptor,
   reasoningEffortSchema,
   resolveHarnessConfig
-} from "./index-gq9xagx2.js";
+} from "./index-09zphhwt.js";
 import"./index-8705zxpr.js";
 import"./index-xqxeypt5.js";
-import"./index-qfpz5y2v.js";
+import"./index-ngg2168h.js";
+import {
+  HarnessConfigError,
+  HarnessError
+} from "./index-jdb1q8yn.js";
 import {
   __require
 } from "./index-1bx83sw4.js";
@@ -924,7 +926,7 @@ var parseCliArgs = (argv) => {
 
 // src/cli/cli-credentials.ts
 async function credentialModel(config, env, modelFactory) {
-  const { createProviderModel: createProviderModel2 } = await import("./config-j3jga5wh.js");
+  const { createProviderModel: createProviderModel2 } = await import("./config-depqpsae.js");
   const { wrapLanguageModel } = await import("@zhivex-ai/core");
   const secrets = providerDescriptor(config.provider).credentialNames.map((name) => env[name]).filter((value) => !!value);
   const safeError = (error) => {

package/dist/cli/arguments.d.ts

@@ -34,6 +34,9 @@ export interface CliOptions {
     maxToolCalls?: number;
     maxToolErrors?: number;
     unlimitedTokens?: boolean;
+    unlimitedSteps?: boolean;
+    unlimitedToolCalls?: boolean;
+    unlimitedDuration?: boolean;
     compactionMaxEstimatedInputTokens?: number;
     maxInputTokens?: number;
     maxOutputTokens?: number;

package/dist/cli/console/console-budget.d.ts

@@ -1,9 +1,15 @@
 import type { CliOptions } from "../arguments.js";
-import { type HarnessConfig } from "../../runtime/config.js";
+import { type HarnessConfig, type HarnessConfigInput } from "../../runtime/config.js";
 import type { TokenUsage } from "@zhivex-ai/core";
 /** Only new local console sessions change defaults. Explicit limits always opt
  * into bounded execution; SDK, service hosts and automation retain their policy. */
-export declare const consoleBudgetOptions: (options: CliOptions, env?: NodeJS.ProcessEnv) => CliOptions;
+export declare const consoleBudgetOptions: <T extends HarnessConfigInput>(options: T, env?: NodeJS.ProcessEnv) => T & {
+    maxToolErrors?: number;
+    unlimitedSteps: boolean;
+    unlimitedToolCalls: boolean;
+    unlimitedDuration: boolean;
+    unlimitedTokens: boolean;
+};
 /** A saved run owns its budget, including legacy runs without a mode flag. */
 export declare const restoreConsoleOptions: (current: CliOptions, saved: Partial<CliOptions>) => CliOptions;
 export declare const formatConsoleBudget: (config: HarnessConfig, usage?: TokenUsage) => string;

package/dist/{cli-s1rs15vv.js → cli-3bzvq594.js}

@@ -35,6 +35,7 @@ import {
   approvalDecisionViews,
   approvalResponses,
   assertRoutePricingIsSafe,
+  assertTaskBudgetBackupLinks,
   cancelHarnessRun,
   canonicalizeChangeEnvelope,
   changeEnvelopePreconditionsSchema,
@@ -123,16 +124,15 @@ import {
   withTemporaryHarnessProfiles,
   workspaceCheckpointSchema,
   workspaceRestoreOperationSchema
-} from "./cli-entry-9c2k0zwz.js";
+} from "./cli-entry-25xefnws.js";
 import {
   BUN_ENGINE_RANGE,
   HARNESS_VERSION,
   NODE_ENGINE_RANGE,
   formatCliHelp,
   shortCliHelp
-} from "./cli-entry-4k1cf0m3.js";
+} from "./cli-entry-qav71mxw.js";
 import {
-  DEFAULT_HARNESS_MAX_STEPS,
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_SUBAGENT_PROFILES,
   HarnessConfigError,
@@ -147,7 +147,7 @@ import {
   providerDescriptor,
   reasoningEffortSchema,
   resolveHarnessConfig
-} from "./cli-entry-d5788aay.js";
+} from "./cli-entry-yqwa1943.js";
 import {
   __require
 } from "./cli-entry-1bx83sw4.js";
@@ -953,21 +953,24 @@ var tokenEnvironment = [
 ];
 var consoleBudgetOptions = (options, env = process.env) => ({
   ...options,
-  ...options.maxSteps === undefined && env.ZHIVEX_HARNESS_MAX_STEPS === undefined ? { maxSteps: DEFAULT_HARNESS_MAX_STEPS } : {},
-  ...options.maxToolCalls === undefined && env.ZHIVEX_HARNESS_MAX_TOOL_CALLS === undefined ? { maxToolCalls: 200 } : {},
   ...options.maxToolErrors === undefined && env.ZHIVEX_HARNESS_MAX_TOOL_ERRORS === undefined ? { maxToolErrors: 20 } : {},
-  ...options.timeoutMs === undefined && env.ZHIVEX_HARNESS_TIMEOUT_MS === undefined ? { timeoutMs: 60 * 60000 } : {},
+  unlimitedSteps: options.unlimitedSteps ?? (options.maxSteps === undefined && env.ZHIVEX_HARNESS_MAX_STEPS === undefined),
+  unlimitedToolCalls: options.unlimitedToolCalls ?? (options.maxToolCalls === undefined && env.ZHIVEX_HARNESS_MAX_TOOL_CALLS === undefined),
+  unlimitedDuration: options.unlimitedDuration ?? (options.timeoutMs === undefined && env.ZHIVEX_HARNESS_TIMEOUT_MS === undefined),
   unlimitedTokens: options.unlimitedTokens ?? !(tokenOptions.some((key) => options[key] !== undefined) || tokenEnvironment.some((key) => env[key] !== undefined))
 });
 var restoreConsoleOptions = (current, saved) => ({
   ...current,
   ...saved,
   reasoningEffort: saved.reasoningEffort ?? "default",
-  unlimitedTokens: saved.unlimitedTokens ?? false
+  unlimitedTokens: saved.unlimitedTokens ?? false,
+  unlimitedSteps: saved.unlimitedSteps ?? false,
+  unlimitedToolCalls: saved.unlimitedToolCalls ?? false,
+  unlimitedDuration: saved.unlimitedDuration ?? false
 });
 var formatConsoleBudget = (config, usage) => {
-  const lines = [`Step limit: ${config.maxSteps} model iterations per turn.`, config.budget.unlimitedTokens ? "Cumulative token budget: unlimited (step, tool, time and monetary limits still apply)." : `Cumulative token limits per run: input ${config.budget.maxInputTokens}; output ${config.budget.maxOutputTokens}; total ${config.budget.maxTotalTokens}.`];
-  lines.push(`Tool limits: ${config.budget.maxToolCalls} calls / ${config.budget.maxToolErrors} errors; time: ${Math.round(config.timeoutMs / 60000)} minutes per run.`);
+  const lines = [`Step limit: ${config.budget.unlimitedSteps ? "none" : config.maxSteps} model iterations per turn.`, config.budget.unlimitedTokens ? "Cumulative token budget: unlimited; operation, model, state and safety controls still apply." : `Cumulative token limits per run: input ${config.budget.maxInputTokens}; output ${config.budget.maxOutputTokens}; total ${config.budget.maxTotalTokens}.`];
+  lines.push(`Tool limits: ${config.budget.unlimitedToolCalls ? "no cumulative cap on" : config.budget.maxToolCalls} calls / ${config.budget.maxToolErrors} errors; time: ${config.unlimitedDuration ? "no cumulative deadline" : `${Math.round(config.timeoutMs / 60000)} minutes per run`}.`);
   if (!usage)
     return [...lines, "Latest run usage: unavailable."].join(`
 `);
@@ -1732,7 +1735,7 @@ ${summarizeApproval(approval)}
           continue;
         if (command === "/limits" || command.startsWith("/limits ")) {
           const requested = command.slice("/limits".length).trim();
-          process.stderr.write(`Step limit: ${harness.config.maxSteps} model iterations per turn.
+          process.stderr.write(`Step limit: ${harness.config.budget.unlimitedSteps ? "none" : harness.config.maxSteps} model iterations per turn.
 `);
           if (await hasActiveTurn()) {
             process.stderr.write(`Finish or deny pending work before changing limits.
@@ -1752,7 +1755,7 @@ ${summarizeApproval(approval)}
 `);
             continue;
           }
-          await replaceHarness({ ...runtimeOptions, maxSteps: Number(next) }, routes);
+          await replaceHarness({ ...runtimeOptions, maxSteps: Number(next), unlimitedSteps: false }, routes);
           process.stderr.write(`Step limit updated: ${harness.config.maxSteps} for next turns.
 `);
           continue;
@@ -3718,6 +3721,7 @@ var readPayload = async (config, recordedWorkspace, accessLease) => {
       assertTerminalState(state, `Run ${row.run_id}`);
       return { key: row.run_id, state, updatedAt: row.updated_at_ms };
     });
+    assertTaskBudgetBackupLinks(runs.map((run) => run.state));
     const identities = coordinatorIds(runs);
     const budgetLedgers = allRunRows.flatMap((row) => {
       const state = parseJsonRecord(row.state_json, `Run ${row.run_id}`);
@@ -3975,6 +3979,7 @@ var validateBundleBinding = async (config, bundle) => {
       throw new HarnessStateConflictError(`Run ${run.key} does not match its bound scope and runId.`);
     }
   }
+  assertTaskBudgetBackupLinks(bundle.records.runs.map((run) => validatedRunState(run.state, `Run ${run.key}`)));
   const identities = coordinatorIds(bundle.records.runs);
   const ledgerIdentities = new Set;
   const ledgerKeys = new Set;
@@ -4177,8 +4182,22 @@ var importHarnessStateBackup = async (config, bundle, options = {}) => {
     if (destinationHasState && Object.keys(expectedKeys).some((name) => !setEquals(destinationKeys[name], expectedKeys[name]))) {
       throw new HarnessStateConflictError("State import requires an empty destination or an exactly identical prior import.");
     }
-    for (const run of [...bundle.records.runs, ...bundle.records.budgetLedgers ?? []])
-      insertOrCompare("zhivex_agent_runs", "run_id = ?", [run.key], "state_json, updated_at_ms", [JSON.stringify(run.state), run.updatedAt], "INSERT INTO zhivex_agent_runs (run_id, state_json, updated_at_ms) VALUES (?, ?, ?)", [run.key, JSON.stringify(run.state), run.updatedAt]);
+    for (const run of [...bundle.records.runs, ...bundle.records.budgetLedgers ?? []]) {
+      const metadata = run.state.metadata;
+      const draftOwner = metadata?.zhivexTaskDraftV1 !== undefined ? metadata.taskDraftOwnerId : undefined;
+      if (metadata?.zhivexTaskDraftV1 !== undefined && (typeof draftOwner !== "string" || !draftOwner))
+        throw new HarnessStateConflictError("TASK_DRAFT_IMPORT_OWNER_REQUIRED");
+      const importingDraft = !options.dryRun && typeof draftOwner === "string" && !database.query("SELECT run_id FROM zhivex_agent_runs WHERE run_id = ?").get(run.key);
+      if (importingDraft)
+        database.query(`INSERT INTO zhivex_agent_runs_leases (run_key, run_id, owner_id, expires_at_ms)
+        VALUES (?, ?, ?, ?) ON CONFLICT(run_key) DO UPDATE SET owner_id=excluded.owner_id, expires_at_ms=excluded.expires_at_ms`).run(run.key, run.state.runId, draftOwner, Date.now() + 30000);
+      try {
+        insertOrCompare("zhivex_agent_runs", "run_id = ?", [run.key], "state_json, updated_at_ms", [JSON.stringify(run.state), run.updatedAt], "INSERT INTO zhivex_agent_runs (run_id, state_json, updated_at_ms) VALUES (?, ?, ?)", [run.key, JSON.stringify(run.state), run.updatedAt]);
+      } finally {
+        if (importingDraft)
+          database.query("DELETE FROM zhivex_agent_runs_leases WHERE run_key = ? AND owner_id = ?").run(run.key, draftOwner);
+      }
+    }
     for (const entry of bundle.records.idempotency)
       insertOrCompare("zhivex_agent_runs_idempotency", "idempotency_key = ?", [entry.key], "run_id, updated_at_ms", [entry.runKey, entry.updatedAt], "INSERT INTO zhivex_agent_runs_idempotency (idempotency_key, run_id, updated_at_ms) VALUES (?, ?, ?)", [entry.key, entry.runKey, entry.updatedAt]);
     for (const entry of bundle.records.parents)
@@ -4469,7 +4488,7 @@ var main = async (argv = process.argv.slice(2)) => {
     parsedOptions = { ...parsedOptions, prompt: await readStdinTask() };
   }
   if (parsedOptions.serviceFile) {
-    const { runServiceCli } = await import("./service-client-cli-b52c67hx.js");
+    const { runServiceCli } = await import("./service-client-cli-ra3yzvjg.js");
     await runServiceCli(parsedOptions, annotateCliStreamError);
     return;
   }