@zhivex-ai/harness 1.4.1 → 1.5.0

package/dist/integrations/mcp-stdio-tools.d.ts

@@ -1,12 +1,15 @@
 import { type McpClient, type ToolSet } from '@zhivex-ai/core';
 import type { McpStdioLaunchProposal } from './mcp-stdio-admission.js';
 import { createJournaledMcpClient } from '../persistence/mcp-execution-journal.js';
-/** Host tool bridge. Existing agent execution supplies durable interrupt approvals. */
+/** Host tool bridge. Tool results are untrusted data. Existing agent execution supplies durable interrupt approvals.
+ * flagEncodedSecrets is optional. Credential-bearing servers use it to mark encodings and high-entropy tokens; it does not rewrite discovery schemas. */
 export declare function createIsolatedMcpTools(options: {
     client: McpClient & {
         close(): Promise<void>;
     };
     proposal: Readonly<McpStdioLaunchProposal>;
     sensitiveValues?: readonly string[];
+    /** When set, tool results flag known encodings of sensitiveValues and other high-entropy encoded strings. */
+    flagEncodedSecrets?: boolean;
     journal?: Pick<Parameters<typeof createJournaledMcpClient>[0], 'store' | 'runId' | 'scope'>;
 }): Promise<ToolSet>;

package/dist/runtime/budget-ledger-scope.d.ts

@@ -0,0 +1,14 @@
+import type { AgentRunStore, AgentStoreScope } from "@zhivex-ai/core";
+/** SDK coordinators address ledgers with this namespace. The durable owner appends the source namespace. */
+export declare const BUDGET_LEDGER_NAMESPACE = "__zhivex_budget__";
+export declare const BUDGET_OWNER_NAMESPACE_KEY = "budgetOwnerNamespace";
+export declare const isReservedBudgetNamespace: (namespace: string | undefined) => boolean;
+/** Bind the caller's full namespace into the ledger owner. Collapsing every namespace to the SDK marker lets one tenant read another's ledger by run id. */
+export declare const budgetLedgerNamespace: (namespace: string) => string;
+/**
+ * A named source becomes `__zhivex_budget__:<namespace>`.
+ * An omitted namespace uses the trailing-colon owner, which `budgetLedgerNamespace` never produces, so it cannot join a named ledger.
+ */
+export declare const budgetLedgerScope: (scope: Pick<AgentStoreScope, "tenantId" | "userId" | "namespace">) => AgentStoreScope;
+/** Translate the SDK's collapsed namespace onto the bound owner before the file or SQLite store. */
+export declare const bindBudgetLedgerStore: (primary: AgentRunStore, scope: AgentStoreScope, budget?: AgentRunStore) => AgentRunStore;

package/dist/service-cli.js

@@ -2,22 +2,22 @@
 import {
   recoverHarnessLocalService,
   startHarnessLocalService
-} from "./index-crta5wzv.js";
-import"./index-02pqtbbg.js";
-import"./index-6599mpmy.js";
+} from "./index-vvzc5ezz.js";
+import"./index-vc7yxz50.js";
+import"./index-63gbp0cz.js";
 import {
   createHarness
-} from "./index-0zs2dz26.js";
-import"./index-f6mqa5gk.js";
-import"./index-dtb2c6ds.js";
-import"./index-d9zkmhz3.js";
+} from "./index-6fp7kdpx.js";
+import"./index-wwthv10a.js";
+import"./index-5zbq9ztj.js";
+import"./index-ggstwr0v.js";
 import"./index-1265j7t2.js";
 import"./index-c39197wq.js";
 import"./index-mzydbzp8.js";
-import"./index-wm9xeq1n.js";
-import"./index-zxg4ve4j.js";
-import"./index-4fx5f3k5.js";
-import"./index-xdbkcccf.js";
+import"./index-bt2p8x7r.js";
+import"./index-fqqz1yt8.js";
+import"./index-pq3kz1r8.js";
+import"./index-6dxrbnxm.js";
 import"./index-4gt045j0.js";
 import"./index-bpc596v3.js";
 import"./index-fm84men1.js";

package/dist/{service-client-cli-eqrdc9zq.js → service-client-cli-v6qptg9x.js}

@@ -9,17 +9,17 @@ import {
   navigateConsole,
   printPolicyInspection,
   sanitizeTerminalText
-} from "./cli-entry-a890x3kq.js";
+} from "./cli-entry-h2yc9x37.js";
 import {
   CLI_EVENT_SCHEMA_VERSION,
   CLI_JSON_SCHEMA_VERSION,
   changeEnvelopeSchema,
   harnessPolicyDecisionEventSchema,
   serializeStreamResult
-} from "./cli-entry-7f0cen32.js";
+} from "./cli-entry-928p8h41.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-3s63zn4w.js";
+} from "./cli-entry-q8bgkn9m.js";
 import {
   HARNESS_ERROR_CODES,
   HARNESS_ERROR_SCHEMA_VERSION,
@@ -195,7 +195,7 @@ var harnessTaskProjectionSchema = z2.strictObject({
 // src/approvals/approval-diff.ts
 import { z as z3 } from "zod";
 var sha = z3.string().regex(/^sha256:[a-f0-9]{64}$/);
-var file = z3.object({ path: z3.string().max(1024), expectedDigest: sha.nullable(), before: z3.string().nullable(), after: z3.string().nullable(), afterDigest: sha.nullable(), beforeMode: z3.number().int().optional(), afterMode: z3.number().int().optional(), operation: z3.enum(["create", "update", "delete"]).optional() }).strict();
+var file = z3.object({ path: z3.string().max(1024), expectedDigest: sha.nullable(), before: z3.string().nullable(), after: z3.string().nullable(), afterDigest: sha.nullable(), beforeMode: z3.number().int().optional(), afterMode: z3.number().int().optional(), operation: z3.enum(["create", "update", "delete", "restore"]).optional() }).strict();
 var archive = z3.object({ approvalId: z3.string().max(256), digest: z3.string().regex(/^[a-f0-9]{64}$/), proposalId: sha, files: z3.array(file).min(1).max(50) }).strict();
 var archives = z3.array(archive).max(512);
 var maxBytes = 2 * 1024 * 1024;

package/dist/tools/workspace.d.ts

@@ -89,8 +89,8 @@ export declare const createWorkspaceTools: (workspace: Workspace, allowedChecks:
     }, z.core.$strict>, import("@zhivex-ai/core").JsonValue, unknown>;
     restore_file: import("@zhivex-ai/core").ToolDefinition<z.ZodObject<{
         quarantineId: z.ZodString;
-        destination: z.ZodOptional<z.ZodString>;
-        expectedDigest: z.ZodOptional<z.ZodString>;
+        destination: z.ZodString;
+        expectedDigest: z.ZodString;
     }, z.core.$strict>, import("@zhivex-ai/core").JsonValue, unknown>;
     run_check: import("@zhivex-ai/core").ToolDefinition<z.ZodObject<{
         check: z.ZodString;

package/dist/verify-historical-migrations.js

@@ -5567,8 +5567,8 @@ var quarantineFileInputSchema = z11.strictObject({
 });
 var restoreFileInputSchema = z11.strictObject({
   quarantineId: z11.string().min(1).max(200).regex(/^[A-Za-z0-9._:-]+$/),
-  destination: workspaceFilePathSchema.optional(),
-  expectedDigest: fileDigestSchema.optional()
+  destination: workspaceFilePathSchema.describe("Required workspace path for the quarantined bytes. Restore does not fall back to the original path."),
+  expectedDigest: fileDigestSchema.describe("Required sha256 of the quarantined bytes the operator reviewed.")
 });
 var mutationOperationSchema = z11.enum(["create", "update", "move", "quarantine", "restore"]);
 var mutationAuditEntrySchema = z11.strictObject({
@@ -5908,10 +5908,10 @@ var runPortableProcess = async (command, options = {}) => {
 // src/workspace/path-policy.ts
 var HARD_IGNORES = new Set([".git", ".next", ".turbo", ".zhivex-harness", "coverage", "dist", "node_modules"]);
 var isSensitiveName = (name) => {
-  const normalized = name.toLocaleLowerCase();
+  const normalized = name.toLowerCase();
   return normalized === ".env" || normalized.startsWith(".env.") && normalized !== ".env.example" || normalized === ".npmrc" || normalized === "id_rsa" || normalized === "id_ed25519" || [".key", ".pem", ".p12", ".pfx"].some((extension) => normalized.endsWith(extension));
 };
-var isHardIgnored = (relativePath) => relativePath.split("/").some((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
+var isHardIgnored = (relativePath) => relativePath.split("/").some((segment) => HARD_IGNORES.has(segment.toLowerCase()) || isSensitiveName(segment));
 
 // src/workspace/workspace.ts
 var IGNORE_FILES = [".gitignore", ".zhivex-harnessignore"];
@@ -6191,7 +6191,7 @@ class Workspace {
       throw new HarnessWorkspaceError(`The path escapes the workspace: ${relativePath}`);
     const relative = wirePath(path11.relative(this.root, candidate));
     if (relative && isHardIgnored(relative)) {
-      const blocked = relative.split("/").find((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
+      const blocked = relative.split("/").find((segment) => HARD_IGNORES.has(segment.toLowerCase()) || isSensitiveName(segment));
       throw new HarnessWorkspaceError(`The path is protected by the harness policy: ${blocked}`);
     }
     return candidate;
@@ -7174,30 +7174,65 @@ class Workspace {
     const audit = await this.audit({ operation: "quarantine", path: parsed.path, beforeDigest: source.digest, quarantineId });
     return { quarantineId, path: parsed.path, digest: source.digest, audit };
   }
-  async restoreQuarantined(input) {
-    return withWorkspaceMutation(this.root, () => this.restoreQuarantinedLocked(input));
-  }
-  async restoreQuarantinedLocked(input) {
-    const parsed = restoreFileInputSchema.parse(input);
-    this.checkAuditCapacity();
+  async readRestorableQuarantine(quarantineId) {
     const directory = await this.secureQuarantineDirectory(false);
     let manifest;
     try {
-      const manifestFile = await this.readInternalRegularFile(path11.join(directory, `${parsed.quarantineId}.json`), "Quarantine manifest", 64 * 1024);
+      const manifestFile = await this.readInternalRegularFile(path11.join(directory, `${quarantineId}.json`), "Quarantine manifest", 64 * 1024);
       manifest = JSON.parse(manifestFile.contents.toString("utf8"));
     } catch {
-      throw new HarnessWorkspaceError(`Quarantine entry was not found: ${parsed.quarantineId}.`);
+      throw new HarnessWorkspaceError(`Quarantine entry was not found: ${quarantineId}.`);
     }
-    if (manifest.schemaVersion !== 1 || manifest.quarantineId !== parsed.quarantineId || manifest.status !== "quarantined") {
-      throw new HarnessWorkspaceError(`Quarantine entry is not restorable: ${parsed.quarantineId}.`);
+    if (manifest.schemaVersion !== 1 || manifest.quarantineId !== quarantineId || manifest.status !== "quarantined") {
+      throw new HarnessWorkspaceError(`Quarantine entry is not restorable: ${quarantineId}.`);
     }
-    const dataPath = path11.join(directory, `${parsed.quarantineId}.data`);
+    const dataPath = path11.join(directory, `${quarantineId}.data`);
     const dataFile = await this.readInternalRegularFile(dataPath, "Quarantine payload", MAX_FILE_BYTES);
     const digest3 = digestBytes(dataFile.contents);
-    if (digest3 !== manifest.digest || parsed.expectedDigest && parsed.expectedDigest !== digest3) {
+    if (digest3 !== manifest.digest) {
+      throw new HarnessWorkspaceError(`Quarantine digest mismatch: ${quarantineId}.`);
+    }
+    return { manifest, dataPath, dataFile, digest: digest3 };
+  }
+  async previewRestore(input) {
+    const parsed = restoreFileInputSchema.parse(input);
+    const quarantined = await this.readRestorableQuarantine(parsed.quarantineId);
+    if (parsed.expectedDigest !== quarantined.digest) {
       throw new HarnessWorkspaceError(`Quarantine digest mismatch: ${parsed.quarantineId}.`);
     }
-    const destinationPath = parsed.destination ?? manifest.originalPath;
+    const destination = await this.safePath(parsed.destination, { allowMissing: true });
+    if (destination.exists)
+      throw new HarnessWorkspaceError(`Restore destination already exists: ${parsed.destination}.`);
+    let after;
+    try {
+      after = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(quarantined.dataFile.contents);
+    } catch {
+      throw new HarnessWorkspaceError("Preview requires valid UTF-8 text.");
+    }
+    return {
+      proposalId: parsed.expectedDigest,
+      files: [{
+        path: parsed.destination,
+        expectedDigest: parsed.expectedDigest,
+        before: null,
+        after,
+        afterDigest: quarantined.digest,
+        operation: "restore"
+      }]
+    };
+  }
+  async restoreQuarantined(input) {
+    return withWorkspaceMutation(this.root, () => this.restoreQuarantinedLocked(input));
+  }
+  async restoreQuarantinedLocked(input) {
+    const parsed = restoreFileInputSchema.parse(input);
+    this.checkAuditCapacity();
+    const quarantined = await this.readRestorableQuarantine(parsed.quarantineId);
+    if (parsed.expectedDigest !== quarantined.digest) {
+      throw new HarnessWorkspaceError(`Quarantine digest mismatch: ${parsed.quarantineId}.`);
+    }
+    const { manifest, dataPath, dataFile, digest: digest3 } = quarantined;
+    const destinationPath = parsed.destination;
     const destination = await this.safePath(destinationPath, { allowMissing: true });
     if (destination.exists)
       throw new HarnessWorkspaceError(`Restore destination already exists: ${destinationPath}.`);
@@ -8420,7 +8455,7 @@ var importPatch = async (runId, expectedPatchId, host, base, current2, maxFileWr
     const rollbackErrors = [];
     for (const item of [...quarantined].reverse()) {
       try {
-        await host.restoreQuarantined({ quarantineId: item.quarantineId, expectedDigest: item.digest });
+        await host.restoreQuarantined({ quarantineId: item.quarantineId, destination: item.path, expectedDigest: item.digest });
       } catch (rollbackError) {
         rollbackErrors.push(rollbackError);
       }
@@ -9718,6 +9753,79 @@ import { createAgentRunLedger } from "@zhivex-ai/agents/control-plane";
 import { AsyncLocalStorage as AsyncLocalStorage5 } from "node:async_hooks";
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { z as z18 } from "zod";
+
+// src/runtime/budget-ledger-scope.ts
+var BUDGET_LEDGER_NAMESPACE = "__zhivex_budget__";
+var BUDGET_OWNER_NAMESPACE_KEY = "budgetOwnerNamespace";
+var isReservedBudgetNamespace = (namespace) => namespace === BUDGET_LEDGER_NAMESPACE || (namespace?.startsWith(`${BUDGET_LEDGER_NAMESPACE}:`) ?? false);
+var budgetLedgerNamespace = (namespace) => {
+  if (!namespace || isReservedBudgetNamespace(namespace)) {
+    throw new HarnessStateConflictError("The budget ledger namespace is reserved.");
+  }
+  return `${BUDGET_LEDGER_NAMESPACE}:${namespace}`;
+};
+var budgetLedgerScope = (scope) => {
+  if (scope.namespace && isReservedBudgetNamespace(scope.namespace)) {
+    throw new HarnessStateConflictError("The budget ledger namespace is reserved.");
+  }
+  return {
+    tenantId: scope.tenantId,
+    ...scope.userId ? { userId: scope.userId } : {},
+    namespace: scope.namespace ? budgetLedgerNamespace(scope.namespace) : `${BUDGET_LEDGER_NAMESPACE}:`
+  };
+};
+var sameIdentity = (left, right) => left?.tenantId === right.tenantId && (left.userId ?? undefined) === (right.userId ?? undefined);
+var bindBudgetLedgerStore = (primary, scope, budget = primary) => {
+  const bound = budgetLedgerScope(scope);
+  const ownerNamespace = scope.namespace ?? "";
+  const isSdkBudget = (value) => sameIdentity(value, bound) && value?.namespace === BUDGET_LEDGER_NAMESPACE;
+  const isBoundBudget = (value) => sameIdentity(value, bound) && value?.namespace === bound.namespace;
+  const assertId = (id) => {
+    if (!/^budget_[a-f0-9]{64}$/.test(id))
+      throw new HarnessStateConflictError("Invalid budget ledger identity.");
+  };
+  const bindState = (state) => {
+    const metadata = { ...state.metadata ?? {} };
+    const owner = metadata[BUDGET_OWNER_NAMESPACE_KEY];
+    if (owner !== undefined && owner !== ownerNamespace) {
+      throw new HarnessStateConflictError("Budget ledger is bound to another namespace.");
+    }
+    return {
+      ...state,
+      scope: bound,
+      metadata: { ...metadata, [BUDGET_OWNER_NAMESPACE_KEY]: ownerNamespace }
+    };
+  };
+  const assertStored = (state) => {
+    if (!state)
+      return state;
+    const owner = state.metadata?.[BUDGET_OWNER_NAMESPACE_KEY];
+    if (state.scope?.namespace !== bound.namespace || owner !== ownerNamespace) {
+      throw new HarnessStateConflictError("Budget ledger is not bound to this namespace.");
+    }
+    return state;
+  };
+  return {
+    ...primary,
+    load: async (id, requestedScope) => {
+      if (!isSdkBudget(requestedScope) && !isBoundBudget(requestedScope))
+        return primary.load(id, requestedScope);
+      assertId(id);
+      return assertStored(await budget.load(id, bound));
+    },
+    save: async (state, options) => {
+      if (!isSdkBudget(state.scope) && !isBoundBudget(state.scope))
+        return primary.save(state, options);
+      assertId(state.runId);
+      if (state.provider !== "zhivex" || state.modelId !== "budget-coordinator" || state.metadata?.budgetCoordinator !== true) {
+        throw new HarnessStateConflictError("Only SDK budget ledger states may use the reserved namespace.");
+      }
+      return budget.save(bindState(state), options);
+    }
+  };
+};
+
+// src/runtime/task-budget.ts
 import {
   createAgentBudgetCoordinator,
   fingerprintAgentHarness as fingerprintAgentHarness2,
@@ -9836,10 +9944,10 @@ class TaskBudget {
     this.accountRunId = TaskBudget.accountId(scope, taskId);
     this.policy = structuredClone(account.policy);
     const budgetId = this.accountRunId;
-    this.coordinator = createAgentBudgetCoordinator({ store, scope, budgetId, limits: this.policy.limits });
+    this.coordinator = createAgentBudgetCoordinator({ store: bindBudgetLedgerStore(store, scope), scope, budgetId, limits: this.policy.limits });
     this.coordinatorId = this.coordinator.id;
     this.budgetRunId = `budget_${fingerprintAgentHarness2({ budgetId, scope }).slice("sha256:".length)}`;
-    this.budgetScope = { tenantId: scope.tenantId, ...scope.userId ? { userId: scope.userId } : {}, namespace: "__zhivex_budget__" };
+    this.budgetScope = budgetLedgerScope(scope);
   }
   static accountId(scope, taskId) {
     return `task_budget_${fingerprintAgentHarness2({ scope, taskId }).slice("sha256:".length)}`;
@@ -10354,37 +10462,7 @@ class TaskBudget {
 }
 
 // src/persistence/operations.ts
-var budgetScopeFor = (config) => ({
-  tenantId: config.scope.tenantId,
-  ...config.scope.userId ? { userId: config.scope.userId } : {},
-  namespace: "__zhivex_budget__"
-});
-var withBudgetLedgerStore = (primary, budget, config) => {
-  const scope = budgetScopeFor(config);
-  const budgetScope = (value) => value?.namespace === scope.namespace && value.tenantId === scope.tenantId && (value.userId ?? undefined) === (scope.userId ?? undefined);
-  const assertId = (id) => {
-    if (!/^budget_[a-f0-9]{64}$/.test(id))
-      throw new HarnessStateConflictError("Invalid budget ledger identity.");
-  };
-  return {
-    ...primary,
-    load: async (id, requestedScope) => {
-      if (!budgetScope(requestedScope))
-        return primary.load(id, requestedScope);
-      assertId(id);
-      return budget.load(id, requestedScope);
-    },
-    save: async (state, options) => {
-      if (!budgetScope(state.scope))
-        return primary.save(state, options);
-      assertId(state.runId);
-      if (state.provider !== "zhivex" || state.modelId !== "budget-coordinator" || state.metadata?.budgetCoordinator !== true) {
-        throw new HarnessStateConflictError("Only SDK budget ledger states may use the reserved namespace.");
-      }
-      return budget.save(state, options);
-    }
-  };
-};
+var withBudgetLedgerStore = (primary, budget, config) => bindBudgetLedgerStore(primary, config.scope, budget);
 var HARNESS_SQLITE_FILE = "operations.sqlite";
 var HARNESS_OPERATIONS_SCHEMA_VERSION = 1;
 var runSummary = (state) => {
@@ -10555,13 +10633,12 @@ var migrateLegacyFileRuns = async (directory, target, config) => {
   return result;
 };
 var openHarnessPersistence = async (config, options = {}) => {
-  if (config.scope.namespace === "__zhivex_budget__")
-    throw new HarnessStateConflictError("The budget ledger namespace is reserved.");
+  const budgetScope = budgetLedgerScope(config.scope);
   await validateStateDirectory(config.workspace, config.stateDirectory);
   await ensurePrivateStateDirectory(config.stateDirectory);
   await protectStateFromGit(config.workspace, config.stateDirectory);
   if (config.storeBackend === "file") {
-    const store = withBudgetLedgerStore(createFileAgentRunStore({ directory: config.stateDirectory, scope: config.scope }), createFileAgentRunStore({ directory: config.stateDirectory, scope: budgetScopeFor(config) }), config);
+    const store = withBudgetLedgerStore(createFileAgentRunStore({ directory: config.stateDirectory, scope: config.scope }), createFileAgentRunStore({ directory: config.stateDirectory, scope: budgetScope }), config);
     const migration = shouldMigrateLegacyRuns(config, options.migrateLegacyFileStore) ? await migrateLegacyFileRuns(config.stateDirectory, store, config) : emptyMigration();
     return {
       backend: "file",
@@ -10606,7 +10683,7 @@ var openHarnessPersistence = async (config, options = {}) => {
     database.exec("PRAGMA foreign_keys = ON");
     await chmod3(databasePath, 384);
     const databaseLike = sqliteAdapter(database);
-    const store = withBudgetLedgerStore(createSqliteAgentRunStore({ db: databaseLike, scope: config.scope, history: "incremental" }), createSqliteAgentRunStore({ db: databaseLike, scope: budgetScopeFor(config) }), config);
+    const store = withBudgetLedgerStore(createSqliteAgentRunStore({ db: databaseLike, scope: config.scope, history: "incremental" }), createSqliteAgentRunStore({ db: databaseLike, scope: budgetScope }), config);
     database.exec(`CREATE TRIGGER IF NOT EXISTS zhivex_task_budget_retain_run
       BEFORE DELETE ON zhivex_agent_runs
       WHEN json_type(OLD.state_json, '$.metadata.zhivexTaskBudgetAccountV1') IS NOT NULL
@@ -10774,7 +10851,7 @@ var projectMemoryBinding = (workspace, scope) => {
     segment(scope.userId);
   if (scope.namespace !== undefined)
     segment(scope.namespace);
-  if (scope.namespace === "__zhivex_budget__")
+  if (isReservedBudgetNamespace(scope.namespace))
     throw new HarnessConfigError("Reserved memory namespace.");
   const key = (kind, value) => createHash15("sha256").update(kind).update("\x00").update(value).digest("hex");
   const workspaceKey = key("workspace", workspace);
@@ -11166,7 +11243,8 @@ var coordinatorIds = (runs) => new Set(runs.flatMap(({ state }) => {
 var validateBudgetLedger = (config, run, identities) => {
   const state = validatedRunState(run.state, `Budget ledger ${run.key}`);
   const identity = state.metadata?.budgetIdentity;
-  if (state.scope?.namespace !== "__zhivex_budget__" || state.scope?.tenantId !== config.scope.tenantId || (state.scope?.userId ?? undefined) !== (config.scope.userId ?? undefined) || state.provider !== "zhivex" || state.modelId !== "budget-coordinator" || state.metadata?.budgetCoordinator !== true || typeof identity !== "string" || !identities.has(identity) || !/^budget_[a-f0-9]{64}$/.test(state.runId) || !sdkRunKeyMatches(run.key, state.scope, state.runId)) {
+  const ownerNamespace = config.scope.namespace;
+  if (!ownerNamespace || state.scope?.namespace !== budgetLedgerNamespace(ownerNamespace) || state.metadata?.[BUDGET_OWNER_NAMESPACE_KEY] !== ownerNamespace || state.scope?.tenantId !== config.scope.tenantId || (state.scope?.userId ?? undefined) !== (config.scope.userId ?? undefined) || state.provider !== "zhivex" || state.modelId !== "budget-coordinator" || state.metadata?.budgetCoordinator !== true || typeof identity !== "string" || !identities.has(identity) || !/^budget_[a-f0-9]{64}$/.test(state.runId) || !sdkRunKeyMatches(run.key, state.scope, state.runId)) {
     throw new HarnessStateConflictError("Budget ledger is not bound to an exported run and durable scope.");
   }
   assertTerminalState(state, `Budget ledger ${run.key}`);
@@ -11300,7 +11378,9 @@ var readPayload = async (config, recordedWorkspace, accessLease) => {
       const metadata = state.metadata;
       if (typeof metadata?.budgetIdentity !== "string" || !identities.has(metadata.budgetIdentity)) {
         const scope = state.scope;
-        if (scope?.namespace === "__zhivex_budget__" && scope.tenantId === config.scope.tenantId && (scope.userId ?? undefined) === (config.scope.userId ?? undefined)) {
+        const sameTenant = scope?.tenantId === config.scope.tenantId && (scope?.userId ?? undefined) === (config.scope.userId ?? undefined);
+        const boundNamespace = config.scope.namespace ? budgetLedgerNamespace(config.scope.namespace) : undefined;
+        if (sameTenant && (scope?.namespace === BUDGET_LEDGER_NAMESPACE || scope?.namespace === boundNamespace)) {
           throw new HarnessStateConflictError("An unlinked shared budget ledger cannot be safely assigned to this backup scope; retain the original database.");
         }
         return [];
@@ -15140,7 +15220,8 @@ var resolvers = {
     const parsed = moveFileInputSchema.parse(input);
     return [parsed.source, parsed.destination];
   },
-  quarantine_file: (input) => [quarantineFileInputSchema.parse(input).path]
+  quarantine_file: (input) => [quarantineFileInputSchema.parse(input).path],
+  restore_file: (input) => [restoreFileInputSchema.parse(input).destination]
 };
 var validateBuiltinToolPolicy = (policy, tools) => {
   for (const rule of policy.rules)
@@ -15274,7 +15355,7 @@ import { z as z34 } from "zod";
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.4.1",
+  version: "1.5.0",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",
@@ -16799,7 +16880,7 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
   }),
   restore_file: tool5({
     name: "restore_file",
-    description: "Restore a quarantined file to its original path or an explicit safe destination without overwriting content unexpectedly.",
+    description: "Restore a quarantined file to the required destination after the reviewed expectedDigest matches the quarantined bytes. Restore does not fall back to the original path and never overwrites an existing file.",
     schema: restoreFileInputSchema,
     ...mutationApproval,
     execute: async (input, context) => serializeJsonValue9(editContractDocument("restore-result", await (harnessExecutionSession(context)?.workspace ?? workspace).restoreQuarantined(input)))

package/dist/workspace/edit-contracts.d.ts

@@ -70,8 +70,8 @@ export declare const quarantineFileInputSchema: z.ZodObject<{
 export type QuarantineFileInput = z.infer<typeof quarantineFileInputSchema>;
 export declare const restoreFileInputSchema: z.ZodObject<{
     quarantineId: z.ZodString;
-    destination: z.ZodOptional<z.ZodString>;
-    expectedDigest: z.ZodOptional<z.ZodString>;
+    destination: z.ZodString;
+    expectedDigest: z.ZodString;
 }, z.core.$strict>;
 export type RestoreFileInput = z.infer<typeof restoreFileInputSchema>;
 export declare const mutationOperationSchema: z.ZodEnum<{

package/dist/workspace/path-policy.d.ts

@@ -1,4 +1,5 @@
-/** Shared lexical exclusions for workspace access and acceptance preflight. */
+/** Shared lexical exclusions for workspace access and acceptance preflight.
+ * Comparisons use toLowerCase so a Turkish locale cannot map ASCII I to dotless ı and skip .git or id_rsa. */
 export declare const HARD_IGNORES: Set<string>;
 export declare const isSensitiveName: (name: string) => boolean;
 export declare const isHardIgnored: (relativePath: string) => boolean;

package/dist/workspace/workspace.d.ts

@@ -214,6 +214,19 @@ export declare class Workspace {
     private readInternalRegularFile;
     quarantineFile(input: QuarantineFileInput, assertActive?: () => Promise<void>): Promise<QuarantineFileResult>;
     private quarantineFileLocked;
+    private readRestorableQuarantine;
+    /** Read-only preview of a pinned restore. Destination and digest are required, and nothing is written. */
+    previewRestore(input: unknown): Promise<{
+        proposalId: string;
+        files: {
+            path: string;
+            expectedDigest: string;
+            before: null;
+            after: string;
+            afterDigest: string;
+            operation: "restore";
+        }[];
+    }>;
     restoreQuarantined(input: RestoreFileInput): Promise<RestoreFileResult>;
     private restoreQuarantinedLocked;
     runCheck(check: HarnessCheck, expectedScript: string, allowedChecks?: readonly string[]): Promise<CommandResult>;

package/dist/zhx.js

@@ -3,7 +3,7 @@ import {
   HARNESS_VERSION,
   NODE_ENGINE_RANGE,
   shortCliHelp
-} from "./cli-entry-3s63zn4w.js";
+} from "./cli-entry-q8bgkn9m.js";
 import {
   __require
 } from "./cli-entry-1bx83sw4.js";
@@ -41,6 +41,6 @@ if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${shortCliHelp(HARNESS_VERSION)}
 `);
 } else {
-  const { runCli } = await import("./cli-1cf4dcnj.js");
+  const { runCli } = await import("./cli-vyrytn3m.js");
   await runCli(argv);
 }

package/docs/CODE_RELEASE.md

@@ -1,5 +1,16 @@
 # Code release procedure
 
+## Pending patch: 2026-10-16
+
+The source version is `1.5.0`, pending publication to `latest`. This checkout
+prepares Harness `1.5.0` and Code `0.4.0` for npm `latest`, with Code pinned
+exactly to the engine and private Desktop bound to the same Harness version.
+Published `latest` is Harness `1.4.1` and Code `0.3.2`. It adds the `v1.5.0`
+representative mapping with the same Meta, Qwen and OpenAI models as `v1.4.1`
+and does not change provider/API tiers. Annotated `v1.5.0` then `code-v0.4.0`
+on the same reviewed main SHA, `channel=latest`, run through the unchanged
+protected workflows and their environment approvals.
+
 ## Pending patch: 2026-10-14
 
 This checkout prepares Code `0.3.1`, pinned exactly to Harness `1.4.1`, for npm
@@ -278,9 +289,17 @@ support remain unchanged; estimated budgets are not guaranteed financial caps.
    verification as ordered in [the Harness release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md).
    From a clean checkout of that main commit, create an annotated
    `code-v0.2.0` tag and push it. Never move or overwrite release tags.
-4. Dispatch `release-code.yml` **at that tag**, with input `tag` matching it and
-   `channel=latest`, `mode=oidc`, and `confirm_publication=true`. Dispatching
-   main while supplying a different tag is rejected.
+4. Dispatch `release-code.yml` **from that exact tag ref**, with input `tag`
+   matching it and `channel=latest`, `mode=oidc`, and `confirm_publication=true`.
+   A no-permission job is defense in depth, not the trust boundary, because
+   GitHub loads it from the dispatched ref. When it still runs, it requires
+   `GITHUB_REF` to be exactly `refs/tags/code-v0.2.0`, resolves that annotated
+   tag to the workflow commit, and requires the commit to be reachable from
+   `main` before provenance OIDC, provider-free validation, or npm publication
+   starts. Dispatch from `main` or any other ref is rejected, including when
+   the commit matches the tag. Publication still depends on the `npm`
+   environment allowing only selected `v*` and `code-v*` tags, and on the tag
+   ruleset in [Public repository security](PUBLIC_SECURITY.md).
 
 ```sh
 gh workflow run release-code.yml --ref code-v0.2.0 \
@@ -350,10 +369,13 @@ In npm package settings, configure GitHub Actions with organization `Zhivex`,
 repository `zhivex-harness`, workflow filename `release-code.yml`, and environment
 `npm`. Enable the allowed action `npm publish`; the OIDC job uses direct
 publishing after GitHub approval, not `npm stage publish`. Preserve the GitHub
-environment's required human approval. Then prepare a
+environment's required human approval and the selected-tag deployment rule in
+[Public repository security](PUBLIC_SECURITY.md). That environment rule, with
+the maintainer-only tag ruleset, is the trust boundary. The in-repo resolver is
+defense in depth, not the trust boundary. Then prepare a
 new Code stable or RC version and annotated tag through the same PR and main CI process.
-Dispatch its tag with the matching channel, `mode=oidc` and
-`confirm_publication=true`. Stable versions require `latest` and a stable exact
+Dispatch the workflow from that exact tag ref, with the matching channel, `mode=oidc` and
+`confirm_publication=true`. A dispatch from `main` is rejected. Stable versions require `latest` and a stable exact
 Harness dependency; canonical RC versions require `next`. Version/channel drift
 fails before engine downloads. An RC may pin a stable engine. Stable publication
 does not upgrade beta/experimental APIs, provisional providers or Desktop alpha.

package/docs/CODE_WEB_TASKS.md

@@ -11,7 +11,7 @@ action on a fresh review ticket; model prose and a completed run are not accepta
 
 ## Operator flow
 
-1. Open `zhivex-code web`, select an allowed workspace and create an empty session.
+1. Open `zhivex-code web`, open Sessions, choose an allowed project and create an empty session.
    Choose **Define task**. Enter the goal, exact existing editable files, package
    checks and explicit input/output/total token limits for the entire task.
 2. Review each proposed edit or check through the existing exact approval controls.

package/docs/ENGINE_API.md

@@ -1,7 +1,7 @@
 # Engine API and Code integration
 
 The terminal-independent package entrypoints shipped in Harness 1.3.0 and remain
-in published Harness 1.4.0 (npm `latest`). This checkout is Harness 1.4.1, pending publication. They are not present in Harness 1.2.0.
+in published Harness 1.4.0 (npm `latest`). This checkout is Harness 1.5.0, pending publication. They are not present in Harness 1.2.0.
 The protected workflow validated the exact stable tarball, live gates and
 registry integrity/provenance; local candidate smoke remains contributor evidence. Do not install registry 1.2.0 and
 expect the new entrypoints to exist.

package/docs/EXTENSIBILITY.md

@@ -81,14 +81,18 @@ Library callers can inject a custom `McpClient`. Trusted read-only annotations a
 
 ## MCP result boundary
 
-MCP descriptions and results are untrusted. The harness:
+MCP descriptions and results are untrusted data, including text that looks like an identifier, digest, or configuration value. The harness:
 
 - bounds discovery pages, discovered tools, time, and response bytes;
 - validates declared input and structured-output schemas through the SDK MCP registry;
 - propagates abort signals, timeout intent, and idempotency keys;
 - rejects common prompt-injection directives before they enter model context;
 - records server permissions and risk in tool metadata;
-- promotes network, write, or external-side-effect calls to durable interrupt approval.
+- promotes network, write, or external-side-effect calls to durable interrupt approval;
+- removes exact secret values before a result is published;
+- when a server was admitted with secret references, flags known encodings of those secrets and other high-entropy encoded tokens in tool results.
+
+That flagging is optional and incomplete. Split, encrypted, or low-entropy encodings can still appear. Discovery schemas are rejected rather than rewritten when they contain an exact secret. Treat every MCP result as data, not as instructions and not as proof that a credential is absent.
 
 The injection filter is deliberately conservative and may reject legitimate security documentation containing imperative attack text. Use a separate trusted preprocessing boundary if that content must be analyzed; do not disable the harness boundary for an untrusted server.
 

package/docs/FIRST_USE.md

@@ -1,13 +1,13 @@
 # First use
 
-This guide targets stable `1.4.1`, pending publication to npm `latest`. The versioned install commands below become available only after protected publication. npm `latest` remains stable 1.3.0 until that publication.
+This guide targets stable `1.5.0`, pending publication to npm `latest`. The versioned install commands below become available only after protected publication. npm `latest` remains stable 1.4.1 until that publication.
 
 ## Install and start
 
 Install Node.js 22.13.0 or newer and Git. Then:
 
 ```sh
-npm install -g @zhivex-ai/harness@1.4.1
+npm install -g @zhivex-ai/harness@1.5.0
 cd /path/to/your/project
 zhx
 ```
@@ -82,16 +82,16 @@ For command execution, configure [OCI isolation](EXECUTION_ENVIRONMENTS.md).
 With Bun 1.4.0 or newer and a supported Node runtime:
 
 ```sh
-bun add --global @zhivex-ai/harness@1.4.1
+bun add --global @zhivex-ai/harness@1.5.0
 zhx
 ```
 
 For a disposable version/help/environment check without a global installation:
 
 ```sh
-bunx @zhivex-ai/harness@1.4.1 --version
-bunx @zhivex-ai/harness@1.4.1 --help
-bunx @zhivex-ai/harness@1.4.1 doctor
+bunx @zhivex-ai/harness@1.5.0 --version
+bunx @zhivex-ai/harness@1.5.0 --help
+bunx @zhivex-ai/harness@1.5.0 doctor
 ```
 
 For source development, use the [contributor guide](https://github.com/Zhivex/zhivex-harness/blob/main/CONTRIBUTING.md).