@zhivex-ai/harness 1.4.1 → 1.5.0

package/CHANGELOG.md

@@ -6,6 +6,9 @@ The project follows Semantic Versioning. During `0.x`, minor releases may change
 
 ## Unreleased
 
+## 1.5.0 - 2026-10-16
+
+- Prepare minor Harness 1.5.0 and Code 0.4.0 for npm `latest`. The minor covers the new experimental audit pack, provisional Bedrock and Azure OpenAI routes, and Code web task control; stable root exports and command contracts are unchanged. It ships with the exact Code engine pin, private Desktop binding and an additive representative mapping for `v1.5.0` using the unchanged Meta, Qwen and OpenAI models. Published `latest` is Harness 1.4.1 and Code 0.3.2. Tags and publication follow only through the protected release workflows.
 - Add provisional Amazon Bedrock and Azure OpenAI routes. Bedrock pins `@zhivex-ai/bedrock@2.0.7` (Converse uses the AWS credential chain and region and reports Tier B; `BEDROCK_RUNTIME=openai` is the Tier A path). Azure OpenAI pins `@zhivex-ai/azure-openai@0.7.8` (https endpoint, API key, optional API version and deployments map). Core is `@zhivex-ai/core@1.34.0`, which those adapters require. An incomplete Bedrock or Azure environment stays out of the durable transport fingerprint. Desktop forwards the selected route's environment credentials through the worker bootstrap. These routes are uncertified: no live calls, no default certification cohort, and no publish or tags.
 - Add an experimental audit pack on `@zhivex-ai/harness/audit`. `zhx export-audit <task-id> --out <directory>` writes one directory per run, or one directory containing every run on a guided task account. The pack reuses the governance report, every approval decision page up to 512 records, the durable redacted activity journal as JSONL, and the usage ledger projection plus transport summary. Approvals, usage, and the governance report come from one captured run snapshot. A change to that run, its journal, or the task account before signing fails with `AUDIT_PACK_STATE_CHANGED` and writes nothing. The 32 MiB limit includes `manifest.json`. `zhx verify-audit --out <directory>` checks the manifest hashes and an HMAC-SHA256 seal without resolving provider, store, or budget configuration. The signing key is `ZHIVEX_AUDIT_SIGNING_KEY` or `--signing-key-file` and is not stored in the pack. Stable root exports, stable declaration signatures, and existing command option contracts are unchanged. This note does not publish a release.
 - Add experimental Code web task definition, bounded exact delivery review, explicit human acceptance, requirement correction, and budgeted continuation through additive host-owned client commands. Keep check verification, human decisions, and provider usage uncertainty distinct. Failed pre-admission continuations retain scoped previous evidence without inventing budget admissions; ordinary chat cannot bypass a governed task's budget.

package/README.md

@@ -159,6 +159,6 @@ Contracts, stability tiers, and the experimental ACP and MCP entry points are in
 
 ## Releases
 
-Version `1.4.0` is the current public npm release. The paired Code package on npm `latest` is `0.3.0`. This checkout prepares Version `1.4.1` and Code `0.3.1` for `latest`. That publication is pending, so the quick start above follows the published `latest` tag. npm `next` is Harness `1.4.0-rc.8` and Code `0.3.0-rc.8`. Confirm dist-tags on the [Code versions](https://www.npmjs.com/package/@zhivex-ai/code?activeTab=versions) and [Harness versions](https://www.npmjs.com/package/@zhivex-ai/harness?activeTab=versions) pages before you install a prerelease.
+Version `1.4.1` is the current public npm release. The paired Code package on npm `latest` is `0.3.2`. This checkout prepares Version `1.5.0` and Code `0.4.0` for `latest`. That publication is pending, so the quick start above follows the published `latest` tag. npm `next` is Harness `1.4.0-rc.8` and Code `0.3.0-rc.8`. Confirm dist-tags on the [Code versions](https://www.npmjs.com/package/@zhivex-ai/code?activeTab=versions) and [Harness versions](https://www.npmjs.com/package/@zhivex-ai/harness?activeTab=versions) pages before you install a prerelease.
 
 Release channels, publication, and certification records are in the [release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md). Releases are verified with npm provenance. Source in this checkout can be newer than the public package. See the [changelog](CHANGELOG.md) and the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json).

package/SUPPORT.md

@@ -13,7 +13,7 @@ The 1.1 support scope is tracked in the [machine-readable support matrix](./docs
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published stable minor receives routine fixes. The exact `v1.3.0` tag passed the protected artifact, six-provider live and 42-case representative release jobs. Harness 1.3.x and Code 0.2.x are the supported stable lines until 1.4.1 and Code 0.3.1 complete verified publication. Gemini, Anthropic and Vertex remain provisional despite the release-bound live gates; the representative repository matrix covers only Meta, Qwen and OpenAI. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Only the most recent published stable minor receives routine fixes. The exact `v1.3.0` tag passed the protected artifact, six-provider live and 42-case representative release jobs. Harness 1.3.x and Code 0.2.x are the supported stable lines until 1.5.0 and Code 0.4.0 complete verified publication. Gemini, Anthropic and Vertex remain provisional despite the release-bound live gates; the representative repository matrix covers only Meta, Qwen and OpenAI. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Installation diagnostics
 

package/contracts/stable-api-signatures.json

@@ -125,7 +125,7 @@
     },
     {
       "name": "Workspace",
-      "sha256": "sha256:3e26e6e06d28107c6191ff010e80470beaa34a548bef1556caa46c96a2f966fe"
+      "sha256": "sha256:42b53815d22e2734371ae5360f059779516f7304bc9a1941dc208d12b67f6a60"
     },
     {
       "name": "appendUserMessage",
@@ -165,7 +165,7 @@
     },
     {
       "name": "createHarness",
-      "sha256": "sha256:e93ba19038466b7ba57cdb6db2c8f0342e659473d09d522c019d3a631c575904"
+      "sha256": "sha256:0bf4f22db95c409dfa85fce488984f06efa84491fc7d4ef2351a053ea32701f3"
     },
     {
       "name": "createHarnessMcpTools",
@@ -173,7 +173,7 @@
     },
     {
       "name": "createHarnessOciExecutionEnvironment",
-      "sha256": "sha256:c4f8f25e3a78c2bcbdf4a6a2238e4afd2e80cf14bc91c414874088126d6f92cc"
+      "sha256": "sha256:6ae2d5238e49299c4c0ee9d9b5f0ddae4de86db9387c8469f7fd6f4518e20e6e"
     },
     {
       "name": "createHarnessStateBackup",
@@ -273,7 +273,7 @@
     },
     {
       "name": "runHarness",
-      "sha256": "sha256:d7bb7f4e0ebd6a3b1ad88bc60ec02847a13a6839c37abb2a0602d6b4250859fb"
+      "sha256": "sha256:82a768885893267b4c24aae1923726ae59c048f73c34ce1e92d0355981c6d46a"
     },
     {
       "name": "serializeStreamEvent",
@@ -427,7 +427,7 @@
     },
     {
       "name": "HarnessExecutionSession",
-      "sha256": "sha256:3bf8a21fccb5793b92bbbd10c6a99f07bf404096422246e8c18d93bff328c743"
+      "sha256": "sha256:15843c59747ef8d072a66f19c88031a2a2981be3cdebf3aabb836132b6f7c4b9"
     },
     {
       "name": "HarnessMcpConfiguration",
@@ -487,8 +487,8 @@
     },
     {
       "name": "ZhivexHarness",
-      "sha256": "sha256:c4af70e955997b69b0f48f52f52efca6f2374e13f9bc536760078a4ee08e984e"
+      "sha256": "sha256:2911bde71fdae2dff26f766d068c560375757fb6575f5aaec02ff3346c46ab94"
     }
   ],
-  "digest": "sha256:044531ba474a2576fadb3e9a091094daa81e9c8495b697d7ff6c69205b37d5e4"
+  "digest": "sha256:50be2a81cd0e7601d5610008081c406cecf9855c5ffd42d2faffba521b08873e"
 }

package/dist/acp-cli.js

@@ -11,14 +11,14 @@ import {
 } from "./index-3ah1f369.js";
 import {
   createHarnessClientAdapter
-} from "./index-02pqtbbg.js";
-import"./index-6599mpmy.js";
+} from "./index-vc7yxz50.js";
+import"./index-63gbp0cz.js";
 import {
   createHarness
-} from "./index-0zs2dz26.js";
-import"./index-f6mqa5gk.js";
-import"./index-dtb2c6ds.js";
-import"./index-d9zkmhz3.js";
+} from "./index-6fp7kdpx.js";
+import"./index-wwthv10a.js";
+import"./index-5zbq9ztj.js";
+import"./index-ggstwr0v.js";
 import {
   HARNESS_REQUIRED_CAPABILITIES,
   HARNESS_SUBAGENT_PROFILES,
@@ -31,17 +31,17 @@ import {
 } from "./index-1265j7t2.js";
 import"./index-c39197wq.js";
 import"./index-mzydbzp8.js";
-import"./index-wm9xeq1n.js";
+import"./index-bt2p8x7r.js";
 import {
   usagePricingSchema
-} from "./index-zxg4ve4j.js";
-import"./index-4fx5f3k5.js";
+} from "./index-fqqz1yt8.js";
+import"./index-pq3kz1r8.js";
 import {
   FileChangedWhileReadingError,
   FileSizeLimitError,
   UnsafeFileTypeError,
   readRegularFileNoFollow
-} from "./index-xdbkcccf.js";
+} from "./index-6dxrbnxm.js";
 import"./index-4gt045j0.js";
 import {
   HarnessConfigError,

package/dist/approvals/approval-diff.d.ts

@@ -14,6 +14,7 @@ declare const file: z.ZodObject<{
     operation: z.ZodOptional<z.ZodEnum<{
         create: "create";
         delete: "delete";
+        restore: "restore";
         update: "update";
     }>>;
 }, z.core.$strict>;
@@ -37,7 +38,7 @@ export declare function captureApprovalDiffs(state: AgentRunState, run: HarnessC
         afterDigest: string | null;
         beforeMode?: number | undefined;
         afterMode?: number | undefined;
-        operation?: "create" | "delete" | "update" | undefined;
+        operation?: "create" | "delete" | "restore" | "update" | undefined;
     }[];
 }[];
 /** Only expose saved content when exact journal effects certify every file. */

package/dist/approvals/approval-preview.d.ts

@@ -10,7 +10,7 @@ export interface ApprovalPreviewFile {
     afterDigest: string | null;
     beforeMode?: number;
     afterMode?: number;
-    operation?: "create" | "update" | "delete";
+    operation?: "create" | "update" | "delete" | "restore";
 }
 export type ApprovalFilePreview = {
     status: "complete";

package/dist/audit/index.js

@@ -1,26 +1,26 @@
 import {
   exportHarnessGovernanceReport,
   harnessGovernanceReportSchema
-} from "../index-j6zxnc8m.js";
-import"../index-sstgcsr0.js";
+} from "../index-jpdvn09j.js";
+import"../index-yx52bt4a.js";
 import {
   APPROVAL_HISTORY_KEY,
   approvalDecisionViews,
   harnessPolicyDecisionEventSchema
-} from "../index-wm9xeq1n.js";
+} from "../index-bt2p8x7r.js";
 import {
   TASK_BUDGET_ACCOUNT_KEY,
   TaskBudget,
   USAGE_LEDGER_KEY,
   UsageLedger,
   inspectUsageLedger
-} from "../index-zxg4ve4j.js";
+} from "../index-fqqz1yt8.js";
 import {
   HARNESS_VERSION
-} from "../index-4fx5f3k5.js";
+} from "../index-pq3kz1r8.js";
 import {
   readRegularFileNoFollow
-} from "../index-xdbkcccf.js";
+} from "../index-6dxrbnxm.js";
 import"../index-bpc596v3.js";
 import"../index-fm84men1.js";
 import"../index-1bx83sw4.js";

package/dist/{audit-pack-e4vaq7np.js → audit-pack-kvw7ng34.js}

@@ -1,7 +1,7 @@
 import {
   exportHarnessGovernanceReport,
   harnessGovernanceReportSchema
-} from "./cli-entry-rgs6bxmy.js";
+} from "./cli-entry-75j3r49b.js";
 import {
   APPROVAL_HISTORY_KEY,
   CliUsageError,
@@ -17,10 +17,10 @@ import {
   openHarnessPersistence,
   readRegularFileNoFollow,
   validateStateDirectory
-} from "./cli-entry-7f0cen32.js";
+} from "./cli-entry-928p8h41.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-3s63zn4w.js";
+} from "./cli-entry-q8bgkn9m.js";
 import {
   resolveHarnessConfig
 } from "./cli-entry-hdtfef27.js";

package/dist/{cli-entry-rgs6bxmy.js → cli-entry-75j3r49b.js}

@@ -10,10 +10,10 @@ import {
   readTaskAcceptanceLedger,
   taskCheckReceiptSchema,
   verifyChangeEnvelope
-} from "./cli-entry-7f0cen32.js";
+} from "./cli-entry-928p8h41.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-3s63zn4w.js";
+} from "./cli-entry-q8bgkn9m.js";
 
 // src/persistence/governance-report.ts
 import { createHash as createHash2 } from "node:crypto";

package/dist/{cli-entry-7f0cen32.js → cli-entry-928p8h41.js}

@@ -2,7 +2,7 @@ import {
   CLI_OPTION_DEFINITIONS,
   resolveHelpTopic,
   validateCliCommandOptions
-} from "./cli-entry-3s63zn4w.js";
+} from "./cli-entry-q8bgkn9m.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_EXECUTION_POLICY_VERSION,
@@ -3656,8 +3656,8 @@ var quarantineFileInputSchema = z10.strictObject({
 });
 var restoreFileInputSchema = z10.strictObject({
   quarantineId: z10.string().min(1).max(200).regex(/^[A-Za-z0-9._:-]+$/),
-  destination: workspaceFilePathSchema.optional(),
-  expectedDigest: fileDigestSchema.optional()
+  destination: workspaceFilePathSchema.describe("Required workspace path for the quarantined bytes. Restore does not fall back to the original path."),
+  expectedDigest: fileDigestSchema.describe("Required sha256 of the quarantined bytes the operator reviewed.")
 });
 var mutationOperationSchema = z10.enum(["create", "update", "move", "quarantine", "restore"]);
 var mutationAuditEntrySchema = z10.strictObject({
@@ -3997,10 +3997,10 @@ var runPortableProcess = async (command, options = {}) => {
 // src/workspace/path-policy.ts
 var HARD_IGNORES = new Set([".git", ".next", ".turbo", ".zhivex-harness", "coverage", "dist", "node_modules"]);
 var isSensitiveName = (name) => {
-  const normalized = name.toLocaleLowerCase();
+  const normalized = name.toLowerCase();
   return normalized === ".env" || normalized.startsWith(".env.") && normalized !== ".env.example" || normalized === ".npmrc" || normalized === "id_rsa" || normalized === "id_ed25519" || [".key", ".pem", ".p12", ".pfx"].some((extension) => normalized.endsWith(extension));
 };
-var isHardIgnored = (relativePath) => relativePath.split("/").some((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
+var isHardIgnored = (relativePath) => relativePath.split("/").some((segment) => HARD_IGNORES.has(segment.toLowerCase()) || isSensitiveName(segment));
 
 // src/workspace/workspace.ts
 var IGNORE_FILES = [".gitignore", ".zhivex-harnessignore"];
@@ -4280,7 +4280,7 @@ class Workspace {
       throw new HarnessWorkspaceError(`The path escapes the workspace: ${relativePath}`);
     const relative = wirePath(path11.relative(this.root, candidate));
     if (relative && isHardIgnored(relative)) {
-      const blocked = relative.split("/").find((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
+      const blocked = relative.split("/").find((segment) => HARD_IGNORES.has(segment.toLowerCase()) || isSensitiveName(segment));
       throw new HarnessWorkspaceError(`The path is protected by the harness policy: ${blocked}`);
     }
     return candidate;
@@ -5263,30 +5263,65 @@ class Workspace {
     const audit = await this.audit({ operation: "quarantine", path: parsed.path, beforeDigest: source.digest, quarantineId });
     return { quarantineId, path: parsed.path, digest: source.digest, audit };
   }
-  async restoreQuarantined(input) {
-    return withWorkspaceMutation(this.root, () => this.restoreQuarantinedLocked(input));
-  }
-  async restoreQuarantinedLocked(input) {
-    const parsed = restoreFileInputSchema.parse(input);
-    this.checkAuditCapacity();
+  async readRestorableQuarantine(quarantineId) {
     const directory = await this.secureQuarantineDirectory(false);
     let manifest;
     try {
-      const manifestFile = await this.readInternalRegularFile(path11.join(directory, `${parsed.quarantineId}.json`), "Quarantine manifest", 64 * 1024);
+      const manifestFile = await this.readInternalRegularFile(path11.join(directory, `${quarantineId}.json`), "Quarantine manifest", 64 * 1024);
       manifest = JSON.parse(manifestFile.contents.toString("utf8"));
     } catch {
-      throw new HarnessWorkspaceError(`Quarantine entry was not found: ${parsed.quarantineId}.`);
+      throw new HarnessWorkspaceError(`Quarantine entry was not found: ${quarantineId}.`);
     }
-    if (manifest.schemaVersion !== 1 || manifest.quarantineId !== parsed.quarantineId || manifest.status !== "quarantined") {
-      throw new HarnessWorkspaceError(`Quarantine entry is not restorable: ${parsed.quarantineId}.`);
+    if (manifest.schemaVersion !== 1 || manifest.quarantineId !== quarantineId || manifest.status !== "quarantined") {
+      throw new HarnessWorkspaceError(`Quarantine entry is not restorable: ${quarantineId}.`);
     }
-    const dataPath = path11.join(directory, `${parsed.quarantineId}.data`);
+    const dataPath = path11.join(directory, `${quarantineId}.data`);
     const dataFile = await this.readInternalRegularFile(dataPath, "Quarantine payload", MAX_FILE_BYTES);
     const digest3 = digestBytes(dataFile.contents);
-    if (digest3 !== manifest.digest || parsed.expectedDigest && parsed.expectedDigest !== digest3) {
+    if (digest3 !== manifest.digest) {
+      throw new HarnessWorkspaceError(`Quarantine digest mismatch: ${quarantineId}.`);
+    }
+    return { manifest, dataPath, dataFile, digest: digest3 };
+  }
+  async previewRestore(input) {
+    const parsed = restoreFileInputSchema.parse(input);
+    const quarantined = await this.readRestorableQuarantine(parsed.quarantineId);
+    if (parsed.expectedDigest !== quarantined.digest) {
+      throw new HarnessWorkspaceError(`Quarantine digest mismatch: ${parsed.quarantineId}.`);
+    }
+    const destination = await this.safePath(parsed.destination, { allowMissing: true });
+    if (destination.exists)
+      throw new HarnessWorkspaceError(`Restore destination already exists: ${parsed.destination}.`);
+    let after;
+    try {
+      after = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(quarantined.dataFile.contents);
+    } catch {
+      throw new HarnessWorkspaceError("Preview requires valid UTF-8 text.");
+    }
+    return {
+      proposalId: parsed.expectedDigest,
+      files: [{
+        path: parsed.destination,
+        expectedDigest: parsed.expectedDigest,
+        before: null,
+        after,
+        afterDigest: quarantined.digest,
+        operation: "restore"
+      }]
+    };
+  }
+  async restoreQuarantined(input) {
+    return withWorkspaceMutation(this.root, () => this.restoreQuarantinedLocked(input));
+  }
+  async restoreQuarantinedLocked(input) {
+    const parsed = restoreFileInputSchema.parse(input);
+    this.checkAuditCapacity();
+    const quarantined = await this.readRestorableQuarantine(parsed.quarantineId);
+    if (parsed.expectedDigest !== quarantined.digest) {
       throw new HarnessWorkspaceError(`Quarantine digest mismatch: ${parsed.quarantineId}.`);
     }
-    const destinationPath = parsed.destination ?? manifest.originalPath;
+    const { manifest, dataPath, dataFile, digest: digest3 } = quarantined;
+    const destinationPath = parsed.destination;
     const destination = await this.safePath(destinationPath, { allowMissing: true });
     if (destination.exists)
       throw new HarnessWorkspaceError(`Restore destination already exists: ${destinationPath}.`);
@@ -6511,7 +6546,7 @@ var importPatch = async (runId, expectedPatchId, host, base, current2, maxFileWr
     const rollbackErrors = [];
     for (const item of [...quarantined].reverse()) {
       try {
-        await host.restoreQuarantined({ quarantineId: item.quarantineId, expectedDigest: item.digest });
+        await host.restoreQuarantined({ quarantineId: item.quarantineId, destination: item.path, expectedDigest: item.digest });
       } catch (rollbackError) {
         rollbackErrors.push(rollbackError);
       }
@@ -7885,6 +7920,79 @@ import { createAgentRunLedger } from "@zhivex-ai/agents/control-plane";
 import { AsyncLocalStorage as AsyncLocalStorage5 } from "node:async_hooks";
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { z as z17 } from "zod";
+
+// src/runtime/budget-ledger-scope.ts
+var BUDGET_LEDGER_NAMESPACE = "__zhivex_budget__";
+var BUDGET_OWNER_NAMESPACE_KEY = "budgetOwnerNamespace";
+var isReservedBudgetNamespace = (namespace) => namespace === BUDGET_LEDGER_NAMESPACE || (namespace?.startsWith(`${BUDGET_LEDGER_NAMESPACE}:`) ?? false);
+var budgetLedgerNamespace = (namespace) => {
+  if (!namespace || isReservedBudgetNamespace(namespace)) {
+    throw new HarnessStateConflictError("The budget ledger namespace is reserved.");
+  }
+  return `${BUDGET_LEDGER_NAMESPACE}:${namespace}`;
+};
+var budgetLedgerScope = (scope) => {
+  if (scope.namespace && isReservedBudgetNamespace(scope.namespace)) {
+    throw new HarnessStateConflictError("The budget ledger namespace is reserved.");
+  }
+  return {
+    tenantId: scope.tenantId,
+    ...scope.userId ? { userId: scope.userId } : {},
+    namespace: scope.namespace ? budgetLedgerNamespace(scope.namespace) : `${BUDGET_LEDGER_NAMESPACE}:`
+  };
+};
+var sameIdentity = (left, right) => left?.tenantId === right.tenantId && (left.userId ?? undefined) === (right.userId ?? undefined);
+var bindBudgetLedgerStore = (primary, scope, budget = primary) => {
+  const bound = budgetLedgerScope(scope);
+  const ownerNamespace = scope.namespace ?? "";
+  const isSdkBudget = (value) => sameIdentity(value, bound) && value?.namespace === BUDGET_LEDGER_NAMESPACE;
+  const isBoundBudget = (value) => sameIdentity(value, bound) && value?.namespace === bound.namespace;
+  const assertId = (id) => {
+    if (!/^budget_[a-f0-9]{64}$/.test(id))
+      throw new HarnessStateConflictError("Invalid budget ledger identity.");
+  };
+  const bindState = (state) => {
+    const metadata = { ...state.metadata ?? {} };
+    const owner = metadata[BUDGET_OWNER_NAMESPACE_KEY];
+    if (owner !== undefined && owner !== ownerNamespace) {
+      throw new HarnessStateConflictError("Budget ledger is bound to another namespace.");
+    }
+    return {
+      ...state,
+      scope: bound,
+      metadata: { ...metadata, [BUDGET_OWNER_NAMESPACE_KEY]: ownerNamespace }
+    };
+  };
+  const assertStored = (state) => {
+    if (!state)
+      return state;
+    const owner = state.metadata?.[BUDGET_OWNER_NAMESPACE_KEY];
+    if (state.scope?.namespace !== bound.namespace || owner !== ownerNamespace) {
+      throw new HarnessStateConflictError("Budget ledger is not bound to this namespace.");
+    }
+    return state;
+  };
+  return {
+    ...primary,
+    load: async (id, requestedScope) => {
+      if (!isSdkBudget(requestedScope) && !isBoundBudget(requestedScope))
+        return primary.load(id, requestedScope);
+      assertId(id);
+      return assertStored(await budget.load(id, bound));
+    },
+    save: async (state, options) => {
+      if (!isSdkBudget(state.scope) && !isBoundBudget(state.scope))
+        return primary.save(state, options);
+      assertId(state.runId);
+      if (state.provider !== "zhivex" || state.modelId !== "budget-coordinator" || state.metadata?.budgetCoordinator !== true) {
+        throw new HarnessStateConflictError("Only SDK budget ledger states may use the reserved namespace.");
+      }
+      return budget.save(bindState(state), options);
+    }
+  };
+};
+
+// src/runtime/task-budget.ts
 import {
   createAgentBudgetCoordinator,
   fingerprintAgentHarness as fingerprintAgentHarness2,
@@ -8003,10 +8111,10 @@ class TaskBudget {
     this.accountRunId = TaskBudget.accountId(scope, taskId);
     this.policy = structuredClone(account.policy);
     const budgetId = this.accountRunId;
-    this.coordinator = createAgentBudgetCoordinator({ store, scope, budgetId, limits: this.policy.limits });
+    this.coordinator = createAgentBudgetCoordinator({ store: bindBudgetLedgerStore(store, scope), scope, budgetId, limits: this.policy.limits });
     this.coordinatorId = this.coordinator.id;
     this.budgetRunId = `budget_${fingerprintAgentHarness2({ budgetId, scope }).slice("sha256:".length)}`;
-    this.budgetScope = { tenantId: scope.tenantId, ...scope.userId ? { userId: scope.userId } : {}, namespace: "__zhivex_budget__" };
+    this.budgetScope = budgetLedgerScope(scope);
   }
   static accountId(scope, taskId) {
     return `task_budget_${fingerprintAgentHarness2({ scope, taskId }).slice("sha256:".length)}`;
@@ -8521,37 +8629,7 @@ class TaskBudget {
 }
 
 // src/persistence/operations.ts
-var budgetScopeFor = (config) => ({
-  tenantId: config.scope.tenantId,
-  ...config.scope.userId ? { userId: config.scope.userId } : {},
-  namespace: "__zhivex_budget__"
-});
-var withBudgetLedgerStore = (primary, budget, config) => {
-  const scope = budgetScopeFor(config);
-  const budgetScope = (value) => value?.namespace === scope.namespace && value.tenantId === scope.tenantId && (value.userId ?? undefined) === (scope.userId ?? undefined);
-  const assertId = (id) => {
-    if (!/^budget_[a-f0-9]{64}$/.test(id))
-      throw new HarnessStateConflictError("Invalid budget ledger identity.");
-  };
-  return {
-    ...primary,
-    load: async (id, requestedScope) => {
-      if (!budgetScope(requestedScope))
-        return primary.load(id, requestedScope);
-      assertId(id);
-      return budget.load(id, requestedScope);
-    },
-    save: async (state, options) => {
-      if (!budgetScope(state.scope))
-        return primary.save(state, options);
-      assertId(state.runId);
-      if (state.provider !== "zhivex" || state.modelId !== "budget-coordinator" || state.metadata?.budgetCoordinator !== true) {
-        throw new HarnessStateConflictError("Only SDK budget ledger states may use the reserved namespace.");
-      }
-      return budget.save(state, options);
-    }
-  };
-};
+var withBudgetLedgerStore = (primary, budget, config) => bindBudgetLedgerStore(primary, config.scope, budget);
 var HARNESS_SQLITE_FILE = "operations.sqlite";
 var HARNESS_OPERATIONS_SCHEMA_VERSION = 1;
 var TERMINAL_RUN_STATUSES = ["completed", "failed", "cancelled", "timed_out"];
@@ -8806,13 +8884,12 @@ var migrateLegacyFileRuns = async (directory, target, config) => {
   return result;
 };
 var openHarnessPersistence = async (config, options = {}) => {
-  if (config.scope.namespace === "__zhivex_budget__")
-    throw new HarnessStateConflictError("The budget ledger namespace is reserved.");
+  const budgetScope = budgetLedgerScope(config.scope);
   await validateStateDirectory(config.workspace, config.stateDirectory);
   await ensurePrivateStateDirectory(config.stateDirectory);
   await protectStateFromGit(config.workspace, config.stateDirectory);
   if (config.storeBackend === "file") {
-    const store = withBudgetLedgerStore(createFileAgentRunStore({ directory: config.stateDirectory, scope: config.scope }), createFileAgentRunStore({ directory: config.stateDirectory, scope: budgetScopeFor(config) }), config);
+    const store = withBudgetLedgerStore(createFileAgentRunStore({ directory: config.stateDirectory, scope: config.scope }), createFileAgentRunStore({ directory: config.stateDirectory, scope: budgetScope }), config);
     const migration = shouldMigrateLegacyRuns(config, options.migrateLegacyFileStore) ? await migrateLegacyFileRuns(config.stateDirectory, store, config) : emptyMigration();
     return {
       backend: "file",
@@ -8857,7 +8934,7 @@ var openHarnessPersistence = async (config, options = {}) => {
     database.exec("PRAGMA foreign_keys = ON");
     await chmod3(databasePath, 384);
     const databaseLike = sqliteAdapter(database);
-    const store = withBudgetLedgerStore(createSqliteAgentRunStore({ db: databaseLike, scope: config.scope, history: "incremental" }), createSqliteAgentRunStore({ db: databaseLike, scope: budgetScopeFor(config) }), config);
+    const store = withBudgetLedgerStore(createSqliteAgentRunStore({ db: databaseLike, scope: config.scope, history: "incremental" }), createSqliteAgentRunStore({ db: databaseLike, scope: budgetScope }), config);
     database.exec(`CREATE TRIGGER IF NOT EXISTS zhivex_task_budget_retain_run
       BEFORE DELETE ON zhivex_agent_runs
       WHEN json_type(OLD.state_json, '$.metadata.zhivexTaskBudgetAccountV1') IS NOT NULL
@@ -9987,4 +10064,4 @@ var verifyChangeEnvelope = (input, options = {}) => {
   };
 };
 
-export { UnsafeFileTypeError, FileSizeLimitError, FileChangedWhileReadingError, statRegularFileNoFollow, readRegularFileNoFollow, readRegularFileChunksNoFollow, loadCliProfile, createCliProfile, updateCliProfile, applyCliProfile, resolveCliDefaults, parseHarnessModelRoute, resolveHarnessModelRoutes, createHarnessRouteModels, serializeHarnessModelRoutes, CLI_COMMANDS, CLI_RUNS_COMMANDS, CLI_SESSIONS_COMMANDS, CLI_CHANGES_COMMANDS, CLI_STATE_COMMANDS, CliUsageError, parseCliArgs, SqliteDatabase, validateStateDirectory, HARNESS_SESSION_SCHEMA_VERSION, TERMINAL_SESSION_RUN_STATUSES, ensurePrivateDatabase, openCliSessionStore, inspectRuntimeDiagnostics, inspectRuntimeManifest, estimateContextTokens, measureContext, MODEL_BUDGET_KEY, estimateRequestTokens, workBudgetReached, createModelBudget, USAGE_LEDGER_KEY, usagePricingSchema, inspectUsageLedger, formatUsageLedger, runUsageLedgerWithPolicy, UsageLedger, inspectTaskMonetaryUsage, CLI_JSON_SCHEMA_VERSION, CLI_EVENT_SCHEMA_VERSION, serializeStreamEvent, serializeStreamResult, MAX_EDIT_CHANGES, MAX_EDIT_FILE_BYTES, fileDigestSchema, workspaceFilePathSchema, editProposalInputSchema, applyEditProposalInputSchema, moveFileInputSchema, quarantineFileInputSchema, restoreFileInputSchema, createEditProposal, validateEditProposal, editContractDocument, APPROVAL_HISTORY_KEY, approvalInputDigest, readApprovalDecisions, approvalDecisionViews, createHarnessToolPolicy, applyHarnessToolPolicy, bindHarnessPolicyInspection, inspectHarnessPolicy, withRuntimeInstruction, withFreshSystemInstructions, TASK_BUDGET_KEY, TASK_BUDGET_ACCOUNT_KEY, inspectTaskBudgetSummary, assertTaskBudgetBackupLinks, TaskBudget, compileTaskAcceptanceContract, taskCheckReceiptSchema, createTaskAcceptanceChecks, withTaskAcceptanceDelivery, taskAcceptanceChecks, confirmTaskAcceptanceImport, TASK_ACCEPTANCE_KEY, TASK_ACCEPTANCE_EVIDENCE_KEY, readTaskAcceptanceLedger, nextTaskAcceptanceLedger, taskAcceptanceCheckpointStore, TASK_SOURCE_KEY, ASSISTANT_RESPONSE_KEY, assistantResponses, captureAssistantResponses, taskSources, captureTaskSources, createTaskTools, replacementEditSchema, EnvironmentPatchDriftError, harnessToolExecution, effectiveRuntimeBudget, createRuntimeBudget, runtimeManifest, childRuntimeSafety, createCheckpointTokenCap, withWorkspaceMutation, boundedBatches, resolvePackageManager, resolvePackageCheckCommand, runPortableProcess, isHardIgnored, Workspace, CliOciRuntimeAdapter, harnessExecutionSession, createHarnessOciExecutionEnvironment, cleanupHarnessExecutionArtifacts, executionFingerprintInput, createRepairController, createRepairProgress, RUNTIME_DIAGNOSTICS_KEY, assistantResponseCheckpointStore, runtimeCheckpointStore, tokenUsageCheckpointStore, HARNESS_SQLITE_FILE, HARNESS_OPERATIONS_SCHEMA_VERSION, listHarnessRuns, inspectHarnessRun, cancelHarnessRun, cleanupHarnessRuns, sqliteAdapter, openHarnessPersistence, harnessPolicyDecisionEventSchema, observeHarnessPolicyDecisions, publishHarnessPolicyDecision, observeBaselineToolPolicy, publishPendingPolicyDecision, createPolicyDecisionEvidence, changeEnvelopeSchema, digestChangeEnvelopeArtifact, createChangeEnvelope, canonicalizeChangeEnvelope, changeEnvelopePreconditionsSchema, verifyChangeEnvelope, openHarnessActivityStore };
+export { UnsafeFileTypeError, FileSizeLimitError, FileChangedWhileReadingError, statRegularFileNoFollow, readRegularFileNoFollow, readRegularFileChunksNoFollow, loadCliProfile, createCliProfile, updateCliProfile, applyCliProfile, resolveCliDefaults, parseHarnessModelRoute, resolveHarnessModelRoutes, createHarnessRouteModels, serializeHarnessModelRoutes, CLI_COMMANDS, CLI_RUNS_COMMANDS, CLI_SESSIONS_COMMANDS, CLI_CHANGES_COMMANDS, CLI_STATE_COMMANDS, CliUsageError, parseCliArgs, SqliteDatabase, validateStateDirectory, HARNESS_SESSION_SCHEMA_VERSION, TERMINAL_SESSION_RUN_STATUSES, ensurePrivateDatabase, openCliSessionStore, inspectRuntimeDiagnostics, inspectRuntimeManifest, estimateContextTokens, measureContext, MODEL_BUDGET_KEY, estimateRequestTokens, workBudgetReached, createModelBudget, USAGE_LEDGER_KEY, usagePricingSchema, inspectUsageLedger, formatUsageLedger, runUsageLedgerWithPolicy, UsageLedger, inspectTaskMonetaryUsage, CLI_JSON_SCHEMA_VERSION, CLI_EVENT_SCHEMA_VERSION, serializeStreamEvent, serializeStreamResult, MAX_EDIT_CHANGES, MAX_EDIT_FILE_BYTES, fileDigestSchema, workspaceFilePathSchema, editProposalInputSchema, applyEditProposalInputSchema, moveFileInputSchema, quarantineFileInputSchema, restoreFileInputSchema, createEditProposal, validateEditProposal, editContractDocument, APPROVAL_HISTORY_KEY, approvalInputDigest, readApprovalDecisions, approvalDecisionViews, createHarnessToolPolicy, applyHarnessToolPolicy, bindHarnessPolicyInspection, inspectHarnessPolicy, BUDGET_LEDGER_NAMESPACE, BUDGET_OWNER_NAMESPACE_KEY, isReservedBudgetNamespace, budgetLedgerNamespace, withRuntimeInstruction, withFreshSystemInstructions, TASK_BUDGET_KEY, TASK_BUDGET_ACCOUNT_KEY, inspectTaskBudgetSummary, assertTaskBudgetBackupLinks, TaskBudget, compileTaskAcceptanceContract, taskCheckReceiptSchema, createTaskAcceptanceChecks, withTaskAcceptanceDelivery, taskAcceptanceChecks, confirmTaskAcceptanceImport, TASK_ACCEPTANCE_KEY, TASK_ACCEPTANCE_EVIDENCE_KEY, readTaskAcceptanceLedger, nextTaskAcceptanceLedger, taskAcceptanceCheckpointStore, TASK_SOURCE_KEY, ASSISTANT_RESPONSE_KEY, assistantResponses, captureAssistantResponses, taskSources, captureTaskSources, createTaskTools, replacementEditSchema, EnvironmentPatchDriftError, harnessToolExecution, effectiveRuntimeBudget, createRuntimeBudget, runtimeManifest, childRuntimeSafety, createCheckpointTokenCap, withWorkspaceMutation, boundedBatches, resolvePackageManager, resolvePackageCheckCommand, runPortableProcess, isHardIgnored, Workspace, CliOciRuntimeAdapter, harnessExecutionSession, createHarnessOciExecutionEnvironment, cleanupHarnessExecutionArtifacts, executionFingerprintInput, createRepairController, createRepairProgress, RUNTIME_DIAGNOSTICS_KEY, assistantResponseCheckpointStore, runtimeCheckpointStore, tokenUsageCheckpointStore, HARNESS_SQLITE_FILE, HARNESS_OPERATIONS_SCHEMA_VERSION, listHarnessRuns, inspectHarnessRun, cancelHarnessRun, cleanupHarnessRuns, sqliteAdapter, openHarnessPersistence, harnessPolicyDecisionEventSchema, observeHarnessPolicyDecisions, publishHarnessPolicyDecision, observeBaselineToolPolicy, publishPendingPolicyDecision, createPolicyDecisionEvidence, changeEnvelopeSchema, digestChangeEnvelopeArtifact, createChangeEnvelope, canonicalizeChangeEnvelope, changeEnvelopePreconditionsSchema, verifyChangeEnvelope, openHarnessActivityStore };

package/dist/{cli-entry-a890x3kq.js → cli-entry-h2yc9x37.js}

@@ -59,6 +59,7 @@ import {
   inspectTaskMonetaryUsage,
   inspectUsageLedger,
   isHardIgnored,
+  isReservedBudgetNamespace,
   measureContext,
   moveFileInputSchema,
   nextTaskAcceptanceLedger,
@@ -96,10 +97,10 @@ import {
   withWorkspaceMutation,
   workBudgetReached,
   workspaceFilePathSchema
-} from "./cli-entry-7f0cen32.js";
+} from "./cli-entry-928p8h41.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-3s63zn4w.js";
+} from "./cli-entry-q8bgkn9m.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_CONFIG_SCHEMA_VERSION,
@@ -6394,7 +6395,7 @@ var projectMemoryBinding = (workspace, scope) => {
     segment(scope.userId);
   if (scope.namespace !== undefined)
     segment(scope.namespace);
-  if (scope.namespace === "__zhivex_budget__")
+  if (isReservedBudgetNamespace(scope.namespace))
     throw new HarnessConfigError("Reserved memory namespace.");
   const key = (kind, value) => createHash10("sha256").update(kind).update("\x00").update(value).digest("hex");
   const workspaceKey = key("workspace", workspace);
@@ -6720,7 +6721,8 @@ var resolvers = {
     const parsed = moveFileInputSchema.parse(input);
     return [parsed.source, parsed.destination];
   },
-  quarantine_file: (input) => [quarantineFileInputSchema.parse(input).path]
+  quarantine_file: (input) => [quarantineFileInputSchema.parse(input).path],
+  restore_file: (input) => [restoreFileInputSchema.parse(input).destination]
 };
 var validateBuiltinToolPolicy = (policy, tools) => {
   for (const rule of policy.rules)
@@ -8153,7 +8155,7 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
   }),
   restore_file: tool4({
     name: "restore_file",
-    description: "Restore a quarantined file to its original path or an explicit safe destination without overwriting content unexpectedly.",
+    description: "Restore a quarantined file to the required destination after the reviewed expectedDigest matches the quarantined bytes. Restore does not fall back to the original path and never overwrites an existing file.",
     schema: restoreFileInputSchema,
     ...mutationApproval,
     execute: async (input, context) => serializeJsonValue6(editContractDocument("restore-result", await (harnessExecutionSession(context)?.workspace ?? workspace).restoreQuarantined(input)))

package/dist/{cli-entry-3s63zn4w.js → cli-entry-q8bgkn9m.js}

@@ -444,7 +444,7 @@ Use zhx help all for the full reference and exit codes.`;
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.4.1",
+  version: "1.5.0",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",