@zhivex-ai/harness 1.4.1 → 1.5.0

package/dist/hostile-repository-demo.js

@@ -3816,8 +3816,8 @@ var quarantineFileInputSchema = z6.strictObject({
 });
 var restoreFileInputSchema = z6.strictObject({
   quarantineId: z6.string().min(1).max(200).regex(/^[A-Za-z0-9._:-]+$/),
-  destination: workspaceFilePathSchema.optional(),
-  expectedDigest: fileDigestSchema.optional()
+  destination: workspaceFilePathSchema.describe("Required workspace path for the quarantined bytes. Restore does not fall back to the original path."),
+  expectedDigest: fileDigestSchema.describe("Required sha256 of the quarantined bytes the operator reviewed.")
 });
 var mutationOperationSchema = z6.enum(["create", "update", "move", "quarantine", "restore"]);
 var mutationAuditEntrySchema = z6.strictObject({
@@ -4157,10 +4157,10 @@ var runPortableProcess = async (command, options = {}) => {
 // src/workspace/path-policy.ts
 var HARD_IGNORES = new Set([".git", ".next", ".turbo", ".zhivex-harness", "coverage", "dist", "node_modules"]);
 var isSensitiveName = (name) => {
-  const normalized = name.toLocaleLowerCase();
+  const normalized = name.toLowerCase();
   return normalized === ".env" || normalized.startsWith(".env.") && normalized !== ".env.example" || normalized === ".npmrc" || normalized === "id_rsa" || normalized === "id_ed25519" || [".key", ".pem", ".p12", ".pfx"].some((extension) => normalized.endsWith(extension));
 };
-var isHardIgnored = (relativePath) => relativePath.split("/").some((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
+var isHardIgnored = (relativePath) => relativePath.split("/").some((segment) => HARD_IGNORES.has(segment.toLowerCase()) || isSensitiveName(segment));
 
 // src/workspace/workspace.ts
 var IGNORE_FILES = [".gitignore", ".zhivex-harnessignore"];
@@ -4440,7 +4440,7 @@ class Workspace {
       throw new HarnessWorkspaceError(`The path escapes the workspace: ${relativePath}`);
     const relative = wirePath(path8.relative(this.root, candidate));
     if (relative && isHardIgnored(relative)) {
-      const blocked = relative.split("/").find((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
+      const blocked = relative.split("/").find((segment) => HARD_IGNORES.has(segment.toLowerCase()) || isSensitiveName(segment));
       throw new HarnessWorkspaceError(`The path is protected by the harness policy: ${blocked}`);
     }
     return candidate;
@@ -5423,30 +5423,65 @@ class Workspace {
     const audit = await this.audit({ operation: "quarantine", path: parsed.path, beforeDigest: source.digest, quarantineId });
     return { quarantineId, path: parsed.path, digest: source.digest, audit };
   }
-  async restoreQuarantined(input) {
-    return withWorkspaceMutation(this.root, () => this.restoreQuarantinedLocked(input));
-  }
-  async restoreQuarantinedLocked(input) {
-    const parsed = restoreFileInputSchema.parse(input);
-    this.checkAuditCapacity();
+  async readRestorableQuarantine(quarantineId) {
     const directory = await this.secureQuarantineDirectory(false);
     let manifest;
     try {
-      const manifestFile = await this.readInternalRegularFile(path8.join(directory, `${parsed.quarantineId}.json`), "Quarantine manifest", 64 * 1024);
+      const manifestFile = await this.readInternalRegularFile(path8.join(directory, `${quarantineId}.json`), "Quarantine manifest", 64 * 1024);
       manifest = JSON.parse(manifestFile.contents.toString("utf8"));
     } catch {
-      throw new HarnessWorkspaceError(`Quarantine entry was not found: ${parsed.quarantineId}.`);
+      throw new HarnessWorkspaceError(`Quarantine entry was not found: ${quarantineId}.`);
     }
-    if (manifest.schemaVersion !== 1 || manifest.quarantineId !== parsed.quarantineId || manifest.status !== "quarantined") {
-      throw new HarnessWorkspaceError(`Quarantine entry is not restorable: ${parsed.quarantineId}.`);
+    if (manifest.schemaVersion !== 1 || manifest.quarantineId !== quarantineId || manifest.status !== "quarantined") {
+      throw new HarnessWorkspaceError(`Quarantine entry is not restorable: ${quarantineId}.`);
     }
-    const dataPath = path8.join(directory, `${parsed.quarantineId}.data`);
+    const dataPath = path8.join(directory, `${quarantineId}.data`);
     const dataFile = await this.readInternalRegularFile(dataPath, "Quarantine payload", MAX_FILE_BYTES);
     const digest2 = digestBytes(dataFile.contents);
-    if (digest2 !== manifest.digest || parsed.expectedDigest && parsed.expectedDigest !== digest2) {
+    if (digest2 !== manifest.digest) {
+      throw new HarnessWorkspaceError(`Quarantine digest mismatch: ${quarantineId}.`);
+    }
+    return { manifest, dataPath, dataFile, digest: digest2 };
+  }
+  async previewRestore(input) {
+    const parsed = restoreFileInputSchema.parse(input);
+    const quarantined = await this.readRestorableQuarantine(parsed.quarantineId);
+    if (parsed.expectedDigest !== quarantined.digest) {
       throw new HarnessWorkspaceError(`Quarantine digest mismatch: ${parsed.quarantineId}.`);
     }
-    const destinationPath = parsed.destination ?? manifest.originalPath;
+    const destination = await this.safePath(parsed.destination, { allowMissing: true });
+    if (destination.exists)
+      throw new HarnessWorkspaceError(`Restore destination already exists: ${parsed.destination}.`);
+    let after;
+    try {
+      after = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(quarantined.dataFile.contents);
+    } catch {
+      throw new HarnessWorkspaceError("Preview requires valid UTF-8 text.");
+    }
+    return {
+      proposalId: parsed.expectedDigest,
+      files: [{
+        path: parsed.destination,
+        expectedDigest: parsed.expectedDigest,
+        before: null,
+        after,
+        afterDigest: quarantined.digest,
+        operation: "restore"
+      }]
+    };
+  }
+  async restoreQuarantined(input) {
+    return withWorkspaceMutation(this.root, () => this.restoreQuarantinedLocked(input));
+  }
+  async restoreQuarantinedLocked(input) {
+    const parsed = restoreFileInputSchema.parse(input);
+    this.checkAuditCapacity();
+    const quarantined = await this.readRestorableQuarantine(parsed.quarantineId);
+    if (parsed.expectedDigest !== quarantined.digest) {
+      throw new HarnessWorkspaceError(`Quarantine digest mismatch: ${parsed.quarantineId}.`);
+    }
+    const { manifest, dataPath, dataFile, digest: digest2 } = quarantined;
+    const destinationPath = parsed.destination;
     const destination = await this.safePath(destinationPath, { allowMissing: true });
     if (destination.exists)
       throw new HarnessWorkspaceError(`Restore destination already exists: ${destinationPath}.`);
@@ -6671,7 +6706,7 @@ var importPatch = async (runId, expectedPatchId, host, base, current, maxFileWri
     const rollbackErrors = [];
     for (const item of [...quarantined].reverse()) {
       try {
-        await host.restoreQuarantined({ quarantineId: item.quarantineId, expectedDigest: item.digest });
+        await host.restoreQuarantined({ quarantineId: item.quarantineId, destination: item.path, expectedDigest: item.digest });
       } catch (rollbackError) {
         rollbackErrors.push(rollbackError);
       }
@@ -7342,6 +7377,79 @@ var taskUsageAdmission = new AsyncLocalStorage3;
 import { AsyncLocalStorage as AsyncLocalStorage5 } from "node:async_hooks";
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { z as z12 } from "zod";
+
+// src/runtime/budget-ledger-scope.ts
+var BUDGET_LEDGER_NAMESPACE = "__zhivex_budget__";
+var BUDGET_OWNER_NAMESPACE_KEY = "budgetOwnerNamespace";
+var isReservedBudgetNamespace = (namespace) => namespace === BUDGET_LEDGER_NAMESPACE || (namespace?.startsWith(`${BUDGET_LEDGER_NAMESPACE}:`) ?? false);
+var budgetLedgerNamespace = (namespace) => {
+  if (!namespace || isReservedBudgetNamespace(namespace)) {
+    throw new HarnessStateConflictError("The budget ledger namespace is reserved.");
+  }
+  return `${BUDGET_LEDGER_NAMESPACE}:${namespace}`;
+};
+var budgetLedgerScope = (scope) => {
+  if (scope.namespace && isReservedBudgetNamespace(scope.namespace)) {
+    throw new HarnessStateConflictError("The budget ledger namespace is reserved.");
+  }
+  return {
+    tenantId: scope.tenantId,
+    ...scope.userId ? { userId: scope.userId } : {},
+    namespace: scope.namespace ? budgetLedgerNamespace(scope.namespace) : `${BUDGET_LEDGER_NAMESPACE}:`
+  };
+};
+var sameIdentity = (left, right) => left?.tenantId === right.tenantId && (left.userId ?? undefined) === (right.userId ?? undefined);
+var bindBudgetLedgerStore = (primary, scope, budget = primary) => {
+  const bound = budgetLedgerScope(scope);
+  const ownerNamespace = scope.namespace ?? "";
+  const isSdkBudget = (value) => sameIdentity(value, bound) && value?.namespace === BUDGET_LEDGER_NAMESPACE;
+  const isBoundBudget = (value) => sameIdentity(value, bound) && value?.namespace === bound.namespace;
+  const assertId = (id) => {
+    if (!/^budget_[a-f0-9]{64}$/.test(id))
+      throw new HarnessStateConflictError("Invalid budget ledger identity.");
+  };
+  const bindState = (state) => {
+    const metadata = { ...state.metadata ?? {} };
+    const owner = metadata[BUDGET_OWNER_NAMESPACE_KEY];
+    if (owner !== undefined && owner !== ownerNamespace) {
+      throw new HarnessStateConflictError("Budget ledger is bound to another namespace.");
+    }
+    return {
+      ...state,
+      scope: bound,
+      metadata: { ...metadata, [BUDGET_OWNER_NAMESPACE_KEY]: ownerNamespace }
+    };
+  };
+  const assertStored = (state) => {
+    if (!state)
+      return state;
+    const owner = state.metadata?.[BUDGET_OWNER_NAMESPACE_KEY];
+    if (state.scope?.namespace !== bound.namespace || owner !== ownerNamespace) {
+      throw new HarnessStateConflictError("Budget ledger is not bound to this namespace.");
+    }
+    return state;
+  };
+  return {
+    ...primary,
+    load: async (id, requestedScope) => {
+      if (!isSdkBudget(requestedScope) && !isBoundBudget(requestedScope))
+        return primary.load(id, requestedScope);
+      assertId(id);
+      return assertStored(await budget.load(id, bound));
+    },
+    save: async (state, options) => {
+      if (!isSdkBudget(state.scope) && !isBoundBudget(state.scope))
+        return primary.save(state, options);
+      assertId(state.runId);
+      if (state.provider !== "zhivex" || state.modelId !== "budget-coordinator" || state.metadata?.budgetCoordinator !== true) {
+        throw new HarnessStateConflictError("Only SDK budget ledger states may use the reserved namespace.");
+      }
+      return budget.save(bindState(state), options);
+    }
+  };
+};
+
+// src/runtime/task-budget.ts
 import {
   createAgentBudgetCoordinator,
   fingerprintAgentHarness as fingerprintAgentHarness2,
@@ -8871,10 +8979,10 @@ class TaskBudget {
     this.accountRunId = TaskBudget.accountId(scope, taskId);
     this.policy = structuredClone(account.policy);
     const budgetId = this.accountRunId;
-    this.coordinator = createAgentBudgetCoordinator({ store, scope, budgetId, limits: this.policy.limits });
+    this.coordinator = createAgentBudgetCoordinator({ store: bindBudgetLedgerStore(store, scope), scope, budgetId, limits: this.policy.limits });
     this.coordinatorId = this.coordinator.id;
     this.budgetRunId = `budget_${fingerprintAgentHarness2({ budgetId, scope }).slice("sha256:".length)}`;
-    this.budgetScope = { tenantId: scope.tenantId, ...scope.userId ? { userId: scope.userId } : {}, namespace: "__zhivex_budget__" };
+    this.budgetScope = budgetLedgerScope(scope);
   }
   static accountId(scope, taskId) {
     return `task_budget_${fingerprintAgentHarness2({ scope, taskId }).slice("sha256:".length)}`;
@@ -13762,37 +13870,7 @@ import {
   createSqliteAgentRunStore
 } from "@zhivex-ai/agents/ops";
 import { createAgentRunLedger } from "@zhivex-ai/agents/control-plane";
-var budgetScopeFor = (config) => ({
-  tenantId: config.scope.tenantId,
-  ...config.scope.userId ? { userId: config.scope.userId } : {},
-  namespace: "__zhivex_budget__"
-});
-var withBudgetLedgerStore = (primary, budget, config) => {
-  const scope = budgetScopeFor(config);
-  const budgetScope = (value) => value?.namespace === scope.namespace && value.tenantId === scope.tenantId && (value.userId ?? undefined) === (scope.userId ?? undefined);
-  const assertId = (id) => {
-    if (!/^budget_[a-f0-9]{64}$/.test(id))
-      throw new HarnessStateConflictError("Invalid budget ledger identity.");
-  };
-  return {
-    ...primary,
-    load: async (id, requestedScope) => {
-      if (!budgetScope(requestedScope))
-        return primary.load(id, requestedScope);
-      assertId(id);
-      return budget.load(id, requestedScope);
-    },
-    save: async (state, options) => {
-      if (!budgetScope(state.scope))
-        return primary.save(state, options);
-      assertId(state.runId);
-      if (state.provider !== "zhivex" || state.modelId !== "budget-coordinator" || state.metadata?.budgetCoordinator !== true) {
-        throw new HarnessStateConflictError("Only SDK budget ledger states may use the reserved namespace.");
-      }
-      return budget.save(state, options);
-    }
-  };
-};
+var withBudgetLedgerStore = (primary, budget, config) => bindBudgetLedgerStore(primary, config.scope, budget);
 var HARNESS_SQLITE_FILE = "operations.sqlite";
 var HARNESS_OPERATIONS_SCHEMA_VERSION = 1;
 var runSummary = (state) => {
@@ -13963,13 +14041,12 @@ var migrateLegacyFileRuns = async (directory, target, config) => {
   return result;
 };
 var openHarnessPersistence = async (config, options = {}) => {
-  if (config.scope.namespace === "__zhivex_budget__")
-    throw new HarnessStateConflictError("The budget ledger namespace is reserved.");
+  const budgetScope = budgetLedgerScope(config.scope);
   await validateStateDirectory(config.workspace, config.stateDirectory);
   await ensurePrivateStateDirectory(config.stateDirectory);
   await protectStateFromGit(config.workspace, config.stateDirectory);
   if (config.storeBackend === "file") {
-    const store = withBudgetLedgerStore(createFileAgentRunStore({ directory: config.stateDirectory, scope: config.scope }), createFileAgentRunStore({ directory: config.stateDirectory, scope: budgetScopeFor(config) }), config);
+    const store = withBudgetLedgerStore(createFileAgentRunStore({ directory: config.stateDirectory, scope: config.scope }), createFileAgentRunStore({ directory: config.stateDirectory, scope: budgetScope }), config);
     const migration = shouldMigrateLegacyRuns(config, options.migrateLegacyFileStore) ? await migrateLegacyFileRuns(config.stateDirectory, store, config) : emptyMigration();
     return {
       backend: "file",
@@ -14014,7 +14091,7 @@ var openHarnessPersistence = async (config, options = {}) => {
     database.exec("PRAGMA foreign_keys = ON");
     await chmod3(databasePath, 384);
     const databaseLike = sqliteAdapter(database);
-    const store = withBudgetLedgerStore(createSqliteAgentRunStore({ db: databaseLike, scope: config.scope, history: "incremental" }), createSqliteAgentRunStore({ db: databaseLike, scope: budgetScopeFor(config) }), config);
+    const store = withBudgetLedgerStore(createSqliteAgentRunStore({ db: databaseLike, scope: config.scope, history: "incremental" }), createSqliteAgentRunStore({ db: databaseLike, scope: budgetScope }), config);
     database.exec(`CREATE TRIGGER IF NOT EXISTS zhivex_task_budget_retain_run
       BEFORE DELETE ON zhivex_agent_runs
       WHEN json_type(OLD.state_json, '$.metadata.zhivexTaskBudgetAccountV1') IS NOT NULL
@@ -14105,7 +14182,7 @@ var projectMemoryBinding = (workspace, scope) => {
     segment(scope.userId);
   if (scope.namespace !== undefined)
     segment(scope.namespace);
-  if (scope.namespace === "__zhivex_budget__")
+  if (isReservedBudgetNamespace(scope.namespace))
     throw new HarnessConfigError("Reserved memory namespace.");
   const key = (kind, value) => createHash24("sha256").update(kind).update("\x00").update(value).digest("hex");
   const workspaceKey = key("workspace", workspace);
@@ -14663,7 +14740,8 @@ var resolvers = {
     const parsed = moveFileInputSchema.parse(input);
     return [parsed.source, parsed.destination];
   },
-  quarantine_file: (input) => [quarantineFileInputSchema.parse(input).path]
+  quarantine_file: (input) => [quarantineFileInputSchema.parse(input).path],
+  restore_file: (input) => [restoreFileInputSchema.parse(input).destination]
 };
 var validateBuiltinToolPolicy = (policy, tools) => {
   for (const rule of policy.rules)
@@ -14797,7 +14875,7 @@ import { z as z32 } from "zod";
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.4.1",
+  version: "1.5.0",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",
@@ -16322,7 +16400,7 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
   }),
   restore_file: tool5({
     name: "restore_file",
-    description: "Restore a quarantined file to its original path or an explicit safe destination without overwriting content unexpectedly.",
+    description: "Restore a quarantined file to the required destination after the reviewed expectedDigest matches the quarantined bytes. Restore does not fall back to the original path and never overwrites an existing file.",
     schema: restoreFileInputSchema,
     ...mutationApproval,
     execute: async (input, context) => serializeJsonValue9(editContractDocument("restore-result", await (harnessExecutionSession(context)?.workspace ?? workspace).restoreQuarantined(input)))

package/dist/{index-dtb2c6ds.js → index-5zbq9ztj.js}

@@ -1,9 +1,9 @@
 import {
   HARNESS_VERSION
-} from "./index-4fx5f3k5.js";
+} from "./index-pq3kz1r8.js";
 import {
   readRegularFileNoFollow
-} from "./index-xdbkcccf.js";
+} from "./index-6dxrbnxm.js";
 import {
   HarnessConfigError,
   HarnessError,

package/dist/{index-6599mpmy.js → index-63gbp0cz.js}

@@ -1,9 +1,9 @@
 import {
   withWorkspaceMutation
-} from "./index-d9zkmhz3.js";
+} from "./index-ggstwr0v.js";
 import {
   TERMINAL_SESSION_RUN_STATUSES
-} from "./index-zxg4ve4j.js";
+} from "./index-fqqz1yt8.js";
 import {
   SqliteDatabase,
   createEditProposal,
@@ -11,7 +11,7 @@ import {
   readRegularFileNoFollow,
   statRegularFileNoFollow,
   workspaceFilePathSchema
-} from "./index-xdbkcccf.js";
+} from "./index-6dxrbnxm.js";
 
 // src/persistence/workspace-checkpoints.ts
 import { createHash, randomUUID } from "node:crypto";

package/dist/{index-xdbkcccf.js → index-6dxrbnxm.js}

@@ -96,8 +96,8 @@ var quarantineFileInputSchema = z.strictObject({
 });
 var restoreFileInputSchema = z.strictObject({
   quarantineId: z.string().min(1).max(200).regex(/^[A-Za-z0-9._:-]+$/),
-  destination: workspaceFilePathSchema.optional(),
-  expectedDigest: fileDigestSchema.optional()
+  destination: workspaceFilePathSchema.describe("Required workspace path for the quarantined bytes. Restore does not fall back to the original path."),
+  expectedDigest: fileDigestSchema.describe("Required sha256 of the quarantined bytes the operator reviewed.")
 });
 var mutationOperationSchema = z.enum(["create", "update", "move", "quarantine", "restore"]);
 var mutationAuditEntrySchema = z.strictObject({

package/dist/{index-0zs2dz26.js → index-6fp7kdpx.js}

@@ -20,7 +20,7 @@ import {
   runtimeManifest,
   taskSources,
   tokenUsageCheckpointStore
-} from "./index-f6mqa5gk.js";
+} from "./index-wwthv10a.js";
 import {
   HARNESS_MCP_CONFIG_SCHEMA_VERSION,
   closeMcpHostSession,
@@ -29,7 +29,7 @@ import {
   mcpConfigurationFingerprintInput,
   normalizeHarnessMcpConfiguration,
   resolveMcpHostSession
-} from "./index-dtb2c6ds.js";
+} from "./index-5zbq9ztj.js";
 import {
   EnvironmentPatchDriftError,
   Workspace,
@@ -40,7 +40,7 @@ import {
   isHardIgnored,
   replacementEditSchema,
   resolvePackageCheckCommand
-} from "./index-d9zkmhz3.js";
+} from "./index-ggstwr0v.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_CONFIG_SCHEMA_VERSION,
@@ -60,7 +60,7 @@ import {
   publishHarnessPolicyDecision,
   publishPendingPolicyDecision,
   readApprovalDecisions
-} from "./index-wm9xeq1n.js";
+} from "./index-bt2p8x7r.js";
 import {
   MODEL_BUDGET_KEY,
   TASK_ACCEPTANCE_EVIDENCE_KEY,
@@ -85,10 +85,10 @@ import {
   withFreshSystemInstructions,
   withRuntimeInstruction,
   workBudgetReached
-} from "./index-zxg4ve4j.js";
+} from "./index-fqqz1yt8.js";
 import {
   HARNESS_VERSION
-} from "./index-4fx5f3k5.js";
+} from "./index-pq3kz1r8.js";
 import {
   FileSizeLimitError,
   MAX_EDIT_CHANGES,
@@ -108,7 +108,7 @@ import {
   validateEditProposal,
   withTaskAcceptanceDelivery,
   workspaceFilePathSchema
-} from "./index-xdbkcccf.js";
+} from "./index-6dxrbnxm.js";
 import {
   HarnessConfigError,
   HarnessError,
@@ -4199,7 +4199,8 @@ var resolvers = {
     const parsed = moveFileInputSchema.parse(input);
     return [parsed.source, parsed.destination];
   },
-  quarantine_file: (input) => [quarantineFileInputSchema.parse(input).path]
+  quarantine_file: (input) => [quarantineFileInputSchema.parse(input).path],
+  restore_file: (input) => [restoreFileInputSchema.parse(input).destination]
 };
 var validateBuiltinToolPolicy = (policy, tools) => {
   for (const rule of policy.rules)
@@ -4656,7 +4657,7 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
   }),
   restore_file: tool4({
     name: "restore_file",
-    description: "Restore a quarantined file to its original path or an explicit safe destination without overwriting content unexpectedly.",
+    description: "Restore a quarantined file to the required destination after the reviewed expectedDigest matches the quarantined bytes. Restore does not fall back to the original path and never overwrites an existing file.",
     schema: restoreFileInputSchema,
     ...mutationApproval,
     execute: async (input, context) => serializeJsonValue6(editContractDocument("restore-result", await (harnessExecutionSession(context)?.workspace ?? workspace).restoreQuarantined(input)))

package/dist/{index-mv8sb1ns.js → index-96ezrvg2.js}

@@ -3,15 +3,15 @@ import {
   combineMcpHostSessions,
   createHarnessMcpTools,
   issueMcpHostSession
-} from "./index-dtb2c6ds.js";
+} from "./index-5zbq9ztj.js";
 import {
   collectSnapshotInventory,
   readSnapshotFile,
   runPortableProcess
-} from "./index-d9zkmhz3.js";
+} from "./index-ggstwr0v.js";
 import {
   readRegularFileNoFollow
-} from "./index-xdbkcccf.js";
+} from "./index-6dxrbnxm.js";
 
 // src/execution/mcp-workspace-snapshot.ts
 import { createHash } from "node:crypto";
@@ -1254,6 +1254,38 @@ var resultSchema = z3.object({
   isError: z3.boolean().optional(),
   _meta: record.optional()
 }).strict().refine((value) => value.content !== undefined || value.structuredContent !== undefined);
+var ENCODED_MARK = "[ENCODED]";
+var ENTROPY_MARK = "[HIGH_ENTROPY]";
+function shannonEntropy(value) {
+  const counts = new Map;
+  for (const char of value)
+    counts.set(char, (counts.get(char) ?? 0) + 1);
+  let entropy = 0;
+  for (const count of counts.values()) {
+    const p = count / value.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+function secretEncodings(secret) {
+  if (Buffer.byteLength(secret) < 8)
+    return [];
+  const bytes = Buffer.from(secret, "utf8");
+  const base64 = bytes.toString("base64");
+  const base64Url = bytes.toString("base64url");
+  const hex = bytes.toString("hex");
+  return [...new Set([base64, base64.replace(/=+$/u, ""), base64Url, hex, hex.toUpperCase()])].filter((value) => value.length >= 8);
+}
+function flagEncodedSecrets(value, secrets) {
+  let text = value;
+  for (const encoding of secrets.flatMap(secretEncodings).sort((left, right) => right.length - left.length)) {
+    text = text.split(encoding).join(ENCODED_MARK);
+  }
+  const flag = (token) => shannonEntropy(token.replace(/=+$/u, "")) >= 3.5 ? ENTROPY_MARK : token;
+  text = text.replace(/[A-Za-z0-9+/_-]{24,}={0,2}/g, flag);
+  text = text.replace(/\b[a-fA-F0-9]{32,}\b/g, flag);
+  return text;
+}
 function compileSchema(schema) {
   const pending = [{ value: schema, depth: 0 }];
   let nodes = 0;
@@ -1286,21 +1318,25 @@ async function createIsolatedMcpTools(options) {
     throw new McpStdioClientError("protocol", message, effectful);
   };
   const secrets = [...new Set(options.sensitiveValues ?? [])].filter(Boolean).sort((a, b) => b.length - a.length);
+  const flagResults = options.flagEncodedSecrets === true;
   const redaction = createRedactionPolicy({ includeEmails: true });
-  const text = (value) => redaction.redactText(secrets.reduce((current, secret) => current.split(secret).join("[REDACTED]"), value));
-  const scrub = (value, depth = 0, budget = { nodes: 0 }) => {
+  const text = (value, flag) => {
+    const redacted = redaction.redactText(secrets.reduce((current, secret) => current.split(secret).join("[REDACTED]"), value));
+    return flag ? flagEncodedSecrets(redacted, secrets) : redacted;
+  };
+  const scrub = (value, flag, depth = 0, budget = { nodes: 0 }) => {
     if (depth > 32 || ++budget.nodes > 20000)
       throw new Error("MCP payload complexity limit exceeded.");
     if (typeof value === "string")
-      return text(value);
+      return text(value, flag);
     if (Array.isArray(value))
-      return value.map((item) => scrub(item, depth + 1, budget));
+      return value.map((item) => scrub(item, flag, depth + 1, budget));
     if (value && typeof value === "object")
-      return Object.fromEntries(Object.entries(value).map(([key, item]) => [text(key), scrub(item, depth + 1, budget)]));
+      return Object.fromEntries(Object.entries(value).map(([key, item]) => [text(key, flag), scrub(item, flag, depth + 1, budget)]));
     return value;
   };
-  const bounded = (value) => {
-    const clean = scrub(value);
+  const bounded = (value, flag) => {
+    const clean = scrub(value, flag);
     if (Buffer.byteLength(JSON.stringify(value)) > proposal.limits.maxOutputBytes)
       throw new Error("MCP output limit exceeded.");
     return clean;
@@ -1319,7 +1355,7 @@ async function createIsolatedMcpTools(options) {
       const output = outputValidators.get(input.name);
       if (output && !parsed.isError && !output.safeParse(parsed.structuredContent).success)
         throw new Error("Output schema");
-      return bounded(parsed);
+      return bounded(parsed, flagResults);
     } catch {
       return invalidResponse("Isolated MCP result validation failed.", true);
     }
@@ -1330,7 +1366,7 @@ async function createIsolatedMcpTools(options) {
     async listTools(input, callOptions) {
       try {
         const response = await options.client.listTools(input, callOptions);
-        const clean = bounded(response);
+        const clean = bounded(response, false);
         if (JSON.stringify(clean) !== JSON.stringify(response))
           throw new Error("Sensitive discovery");
         const parsed = listing.parse(response);
@@ -1722,7 +1758,13 @@ async function launchMcpToolsOwned(options, groupRecoveryComplete) {
     return value;
   } });
   try {
-    const tools = await createIsolatedMcpTools({ client, proposal, sensitiveValues, journal });
+    const tools = await createIsolatedMcpTools({
+      client,
+      proposal,
+      sensitiveValues,
+      journal,
+      flagEncodedSecrets: Object.keys(proposal.secretReferences).length > 0
+    });
     const hostSession = issueMcpHostSession({ tools, ...journal, proposal, close: () => client.close() });
     return Object.freeze({ tools, hostSession, close: () => closeMcpHostSession(hostSession) });
   } catch {

package/dist/{index-wm9xeq1n.js → index-bt2p8x7r.js}

@@ -2,7 +2,7 @@ import {
   createEditProposal,
   editChangesSchema,
   workspaceFilePathSchema
-} from "./index-xdbkcccf.js";
+} from "./index-6dxrbnxm.js";
 
 // src/runtime/tool-policy.ts
 import { createHash } from "node:crypto";

package/dist/{index-sk3cap35.js → index-eps3c3g6.js}

@@ -1,6 +1,6 @@
 import {
   changeEnvelopeSchema
-} from "./index-sstgcsr0.js";
+} from "./index-yx52bt4a.js";
 import {
   PROVIDERS,
   reasoningEffortSchema