@zhivex-ai/harness 1.4.1 → 1.6.2

package/CHANGELOG.md

@@ -6,6 +6,29 @@ The project follows Semantic Versioning. During `0.x`, minor releases may change
 
 ## Unreleased
 
+## 1.6.2 - 2026-10-24
+
+- Allow one continuity retry per provider in the release gate. Live certification of `v1.6.0` and `v1.6.1` (twice) failed only the multi-process continuity gate, each time on a different provider. A provider whose continuity run fails now gets one fresh retry of all phases and passes only if the retry passes. Every selected provider stays mandatory, and no other gate retries. The continuity evidence records which provider retried, the first attempt's sanitized cause, and the retry outcome. Runtime and CLI behavior and defaults are unchanged (#250).
+- 1.6.1 was tagged but not published, so 1.6.2 is the first npm release carrying the 1.6.1 compaction fix below.
+
+## 1.6.1 - 2026-10-24
+
+- Mark compacted recollections that precede later user messages. Compaction keeps user steering and recent assistant replies in separate lists, so a stale reply naming a replaced objective could read as newer than the user message that superseded it. In the `v1.6.0` live certification, meta and qwen repeated their previous answer in the continuity gate. Recent entries followed by a later user message now carry a `[before later user messages] ` prefix. The summary schema, strategy id, and defaults are unchanged (#248).
+
+## 1.6.0 - 2026-10-24
+
+- Prepare minor Harness 1.6.0 for npm `latest`. The minor is opt-in auto-approve. Code stays version 0.4.0. Its source pin moves to Harness 1.6.0 because installed acceptance rejects a candidate that differs from that pin. Published npm Code 0.4.0 remains pinned to Harness 1.5.0 and is not republished. Private Desktop binds to this engine. The representative mapping for `v1.6.0` uses the same Meta, Qwen, and OpenAI models as `v1.5.0`. This preparation creates no tag and dispatches no workflow.
+- Add opt-in auto-approve. Manual stays the default. `auto-edits` can apply file edits inside the workspace without a prompt. `auto-limits` adds commands whose executable is on the allowlist. Network or egress, secrets, `git push`, package publish, writes outside the workspace, and a reached spend or token limit still wait for a person. A mixed batch stays on the review screen. `--approval-mode auto` and `--yes` remain the older non-interactive switch and are not this feature. See [opt-in auto-approve](docs/AUTO_APPROVE.md).
+- Rework the local web workspace. Light-theme controls use theme tokens, the header is one bar, and the first message creates the session. A confirmed execution failure stays editable. The model library, composer, message bubbles, tool pills, and appearance control follow the Harness chat reference.
+- Name each terminal action. Read, search, and edit lines state the target. Consecutive edits of one file collapse to a net diff and an attempt count. The review names the change, counts each file, keeps indentation when a line wraps, and shows NUL, zero-width characters, bidi overrides, tabs, and trailing spaces. The decision is "Approve this change".
+- Keep NUL and other control bytes out of model-facing edit tool schemas. `propose_edits`, `apply_patch`, and the replacement and verified-edit inputs do not advertise `allowControlBytes`. Model-supplied text is still refused, and the host opt-in stays off unless a host call passes it outside the tool input. The stable declaration snapshot records that optional host argument.
+- Pin private Desktop Electron 44.9.3 and its optional `undici` dependency at 7.30.1. Electron 44.5.1 is inside GHSA-jr5w-w6x2-84p9 (`<44.9.1`), and undici 7.29.1 is inside GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472, and GHSA-xjj6-f33q-929c (`<7.30.1`). Desktop behavior is unchanged.
+- Pin the private web Playwright devDependency at 1.64.1 so `playwright install --with-deps chromium` can run on the Ubuntu 26.04 GitHub runner. Browser journeys still launch headless Chromium the same way.
+- Pin the published 2026-10-24 SDK batch: Core 1.36.0, Agents 1.12.0, OpenAI 0.17.0, Anthropic 0.15.0, Qwen 0.18.0, Gemini 0.14.0, Vertex 1.3.0, Azure OpenAI 0.8.0, Bedrock 2.1.0, and Meta 0.3.0. The web client pins React 0.10.0. The root Core override stays one runtime. `zod` is 4.6.7 and `google-auth-library` is 11.3.1 so the new adapter floors resolve to one copy. Harness and CLI defaults are unchanged: shared `topP`, `seed`, and `stopSequences` are not sent, `stopWhen` is not set, and voice is unused. `@types/bun` is 1.4.3. CodeQL init and analyze stay SHA-pinned at `6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee` (v4.39.0).
+
+## 1.5.0 - 2026-10-16
+
+- Prepare minor Harness 1.5.0 and Code 0.4.0 for npm `latest`. The minor covers the new experimental audit pack, provisional Bedrock and Azure OpenAI routes, and Code web task control; stable root exports and command contracts are unchanged. It ships with the exact Code engine pin, private Desktop binding and an additive representative mapping for `v1.5.0` using the unchanged Meta, Qwen and OpenAI models. Published `latest` is Harness 1.4.1 and Code 0.3.2. Tags and publication follow only through the protected release workflows.
 - Add provisional Amazon Bedrock and Azure OpenAI routes. Bedrock pins `@zhivex-ai/bedrock@2.0.7` (Converse uses the AWS credential chain and region and reports Tier B; `BEDROCK_RUNTIME=openai` is the Tier A path). Azure OpenAI pins `@zhivex-ai/azure-openai@0.7.8` (https endpoint, API key, optional API version and deployments map). Core is `@zhivex-ai/core@1.34.0`, which those adapters require. An incomplete Bedrock or Azure environment stays out of the durable transport fingerprint. Desktop forwards the selected route's environment credentials through the worker bootstrap. These routes are uncertified: no live calls, no default certification cohort, and no publish or tags.
 - Add an experimental audit pack on `@zhivex-ai/harness/audit`. `zhx export-audit <task-id> --out <directory>` writes one directory per run, or one directory containing every run on a guided task account. The pack reuses the governance report, every approval decision page up to 512 records, the durable redacted activity journal as JSONL, and the usage ledger projection plus transport summary. Approvals, usage, and the governance report come from one captured run snapshot. A change to that run, its journal, or the task account before signing fails with `AUDIT_PACK_STATE_CHANGED` and writes nothing. The 32 MiB limit includes `manifest.json`. `zhx verify-audit --out <directory>` checks the manifest hashes and an HMAC-SHA256 seal without resolving provider, store, or budget configuration. The signing key is `ZHIVEX_AUDIT_SIGNING_KEY` or `--signing-key-file` and is not stored in the pack. Stable root exports, stable declaration signatures, and existing command option contracts are unchanged. This note does not publish a release.
 - Add experimental Code web task definition, bounded exact delivery review, explicit human acceptance, requirement correction, and budgeted continuation through additive host-owned client commands. Keep check verification, human decisions, and provider usage uncertainty distinct. Failed pre-admission continuations retain scoped previous evidence without inventing budget admissions; ordinary chat cannot bypass a governed task's budget.

package/README.md

@@ -159,6 +159,6 @@ Contracts, stability tiers, and the experimental ACP and MCP entry points are in
 
 ## Releases
 
-Version `1.4.0` is the current public npm release. The paired Code package on npm `latest` is `0.3.0`. This checkout prepares Version `1.4.1` and Code `0.3.1` for `latest`. That publication is pending, so the quick start above follows the published `latest` tag. npm `next` is Harness `1.4.0-rc.8` and Code `0.3.0-rc.8`. Confirm dist-tags on the [Code versions](https://www.npmjs.com/package/@zhivex-ai/code?activeTab=versions) and [Harness versions](https://www.npmjs.com/package/@zhivex-ai/harness?activeTab=versions) pages before you install a prerelease.
+Version `1.5.0` is the current public npm release. The paired Code package on npm `latest` is `0.4.0`, pinned to that engine. This checkout prepares Version `1.6.2` for `latest`. Code stays version `0.4.0`, and its source pin is Harness `1.6.2` for installed acceptance. Published Code `0.4.0` stays on Harness `1.5.0`. That Harness publication is pending, so the quick start above follows the published `latest` tag. npm `next` is Harness `1.4.0-rc.8` and Code `0.3.0-rc.8`. Confirm dist-tags on the [Code versions](https://www.npmjs.com/package/@zhivex-ai/code?activeTab=versions) and [Harness versions](https://www.npmjs.com/package/@zhivex-ai/harness?activeTab=versions) pages before you install a prerelease.
 
 Release channels, publication, and certification records are in the [release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md). Releases are verified with npm provenance. Source in this checkout can be newer than the public package. See the [changelog](CHANGELOG.md) and the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json).

package/SUPPORT.md

@@ -13,7 +13,7 @@ The 1.1 support scope is tracked in the [machine-readable support matrix](./docs
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published stable minor receives routine fixes. The exact `v1.3.0` tag passed the protected artifact, six-provider live and 42-case representative release jobs. Harness 1.3.x and Code 0.2.x are the supported stable lines until 1.4.1 and Code 0.3.1 complete verified publication. Gemini, Anthropic and Vertex remain provisional despite the release-bound live gates; the representative repository matrix covers only Meta, Qwen and OpenAI. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Only the most recent published stable minor receives routine fixes. The exact `v1.3.0` tag passed the protected artifact, six-provider live and 42-case representative release jobs. Harness 1.5.0 and Code 0.4.0 are the published stable packages. Code stays version 0.4.0. Its source pin is Harness 1.6.2 for installed acceptance, and published Code 0.4.0 remains pinned to Harness 1.5.0 until 1.6.2 completes verified publication. Gemini, Anthropic and Vertex remain provisional despite the release-bound live gates; the representative repository matrix covers only Meta, Qwen and OpenAI. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Installation diagnostics
 

package/contracts/stable-api-signatures.json

@@ -125,7 +125,7 @@
     },
     {
       "name": "Workspace",
-      "sha256": "sha256:3e26e6e06d28107c6191ff010e80470beaa34a548bef1556caa46c96a2f966fe"
+      "sha256": "sha256:9b8bc9eb0d44bb64e75995483aa9c68f73816359da93299844b8c8290c3a1480"
     },
     {
       "name": "appendUserMessage",
@@ -165,7 +165,7 @@
     },
     {
       "name": "createHarness",
-      "sha256": "sha256:e93ba19038466b7ba57cdb6db2c8f0342e659473d09d522c019d3a631c575904"
+      "sha256": "sha256:2a9567b8785aced05da16f6606cf6e71bad3229d2df0d0b1cf1f5f96e57852f2"
     },
     {
       "name": "createHarnessMcpTools",
@@ -173,7 +173,7 @@
     },
     {
       "name": "createHarnessOciExecutionEnvironment",
-      "sha256": "sha256:c4f8f25e3a78c2bcbdf4a6a2238e4afd2e80cf14bc91c414874088126d6f92cc"
+      "sha256": "sha256:432ed8e25be522eb6adf03ca61bc01d1f04e3ccafcb9a9d380b6b55130f5a1c5"
     },
     {
       "name": "createHarnessStateBackup",
@@ -273,7 +273,7 @@
     },
     {
       "name": "runHarness",
-      "sha256": "sha256:d7bb7f4e0ebd6a3b1ad88bc60ec02847a13a6839c37abb2a0602d6b4250859fb"
+      "sha256": "sha256:e2da41119fb7a86ae2385a2edacee3221c44ab68bcc9360d5307f7df44bd4982"
     },
     {
       "name": "serializeStreamEvent",
@@ -427,7 +427,7 @@
     },
     {
       "name": "HarnessExecutionSession",
-      "sha256": "sha256:3bf8a21fccb5793b92bbbd10c6a99f07bf404096422246e8c18d93bff328c743"
+      "sha256": "sha256:6ef99960a68c92cbcf6f1b0d6f65fde844f0b1ee1514b7d1b4df65d752cc4a37"
     },
     {
       "name": "HarnessMcpConfiguration",
@@ -487,8 +487,8 @@
     },
     {
       "name": "ZhivexHarness",
-      "sha256": "sha256:c4af70e955997b69b0f48f52f52efca6f2374e13f9bc536760078a4ee08e984e"
+      "sha256": "sha256:959a37960c89176ada62c3d126bb30b49d0621b721b89a5972fcf58a184480c0"
     }
   ],
-  "digest": "sha256:044531ba474a2576fadb3e9a091094daa81e9c8495b697d7ff6c69205b37d5e4"
+  "digest": "sha256:ad2cd323cee44ab26037a02eb9079eecf713771601de3fde44ad2e3b4df85cbc"
 }

package/dist/acp-cli.js

@@ -11,14 +11,14 @@ import {
 } from "./index-3ah1f369.js";
 import {
   createHarnessClientAdapter
-} from "./index-02pqtbbg.js";
-import"./index-6599mpmy.js";
+} from "./index-paf7z8kn.js";
+import"./index-4mn6m3bq.js";
 import {
   createHarness
-} from "./index-0zs2dz26.js";
-import"./index-f6mqa5gk.js";
-import"./index-dtb2c6ds.js";
-import"./index-d9zkmhz3.js";
+} from "./index-pf73y4gt.js";
+import"./index-amjttjaj.js";
+import"./index-2r4f0p4n.js";
+import"./index-w0m1nckc.js";
 import {
   HARNESS_REQUIRED_CAPABILITIES,
   HARNESS_SUBAGENT_PROFILES,
@@ -31,17 +31,17 @@ import {
 } from "./index-1265j7t2.js";
 import"./index-c39197wq.js";
 import"./index-mzydbzp8.js";
-import"./index-wm9xeq1n.js";
+import"./index-bt2p8x7r.js";
 import {
   usagePricingSchema
-} from "./index-zxg4ve4j.js";
-import"./index-4fx5f3k5.js";
+} from "./index-fqqz1yt8.js";
+import"./index-rz7wmp71.js";
 import {
   FileChangedWhileReadingError,
   FileSizeLimitError,
   UnsafeFileTypeError,
   readRegularFileNoFollow
-} from "./index-xdbkcccf.js";
+} from "./index-6dxrbnxm.js";
 import"./index-4gt045j0.js";
 import {
   HarnessConfigError,

package/dist/approvals/approval-diff.d.ts

@@ -14,6 +14,7 @@ declare const file: z.ZodObject<{
     operation: z.ZodOptional<z.ZodEnum<{
         create: "create";
         delete: "delete";
+        restore: "restore";
         update: "update";
     }>>;
 }, z.core.$strict>;
@@ -37,7 +38,7 @@ export declare function captureApprovalDiffs(state: AgentRunState, run: HarnessC
         afterDigest: string | null;
         beforeMode?: number | undefined;
         afterMode?: number | undefined;
-        operation?: "create" | "delete" | "update" | undefined;
+        operation?: "create" | "delete" | "restore" | "update" | undefined;
     }[];
 }[];
 /** Only expose saved content when exact journal effects certify every file. */

package/dist/approvals/approval-preview.d.ts

@@ -10,7 +10,7 @@ export interface ApprovalPreviewFile {
     afterDigest: string | null;
     beforeMode?: number;
     afterMode?: number;
-    operation?: "create" | "update" | "delete";
+    operation?: "create" | "update" | "delete" | "restore";
 }
 export type ApprovalFilePreview = {
     status: "complete";

package/dist/approvals/auto-approve.d.ts

@@ -0,0 +1,137 @@
+/** Opt-in approval policy. Manual is the default. Always-ask reasons are checked before any mode or allowlist. */
+export declare const AUTO_APPROVE_MODES: readonly ["manual", "auto-edits", "auto-limits"];
+export type AutoApproveMode = (typeof AUTO_APPROVE_MODES)[number];
+export interface AutoApprovePolicy {
+    mode: AutoApproveMode;
+    commandAllowlist: readonly string[];
+    rootDir: string;
+    overLimit?: boolean;
+}
+export interface ApprovalPath {
+    path: string;
+    operation?: "create" | "update" | "delete" | "move" | "restore";
+}
+export interface ApprovalFacts {
+    name: string;
+    paths: readonly ApprovalPath[];
+    commands: readonly string[];
+}
+export type AskReason = "manual" | "not-an-edit" | "not-allowlisted" | "unproven-path" | "network" | "delete-outside" | "write-outside" | "secret" | "git-push" | "package-publish" | "over-limit";
+export type ClassifyResult = {
+    decision: "ask";
+    reason: AskReason;
+} | {
+    decision: "auto";
+    reason: "edit-in-root" | "allowlisted-command";
+};
+export interface ApprovalConfigFile {
+    mode: AutoApproveMode;
+    commandAllowlist: string[];
+}
+export interface AutoApprovalSnapshot {
+    path: string;
+    before: string | null;
+    after: string | null;
+    undoable: boolean;
+}
+export interface AutoApprovalAuditEntry {
+    id: string;
+    approvalId: string;
+    name: string;
+    mode: Exclude<AutoApproveMode, "manual">;
+    reason: string;
+    timestamp: string;
+    snapshots: AutoApprovalSnapshot[];
+}
+export interface PublicAutoApproval {
+    id: string;
+    name: string;
+    mode: Exclude<AutoApproveMode, "manual">;
+    reason: string;
+    timestamp: string;
+    paths: string[];
+    undoable: boolean;
+}
+export declare const approvalConfigPath: (rootDir: string) => string;
+export declare const autoApprovalLogPath: (rootDir: string) => string;
+export declare const isAutoApproveMode: (value: string) => value is AutoApproveMode;
+/** Exact executable names only. Wildcards, paths and shell syntax are rejected. */
+export declare const parseAllowlist: (entries: readonly string[]) => string[];
+export declare const parseApprovalConfig: (text: string) => ApprovalConfigFile;
+export declare const resolveAutoApprovePolicy: (input: {
+    rootDir: string;
+    overLimit?: boolean;
+    file?: ApprovalConfigFile | null;
+    cliMode?: AutoApproveMode;
+    cliAllow?: readonly string[];
+    sessionMode?: AutoApproveMode;
+    sessionAllow?: readonly string[];
+}) => AutoApprovePolicy;
+export declare const isInsideRoot: (rootDir: string, candidate: string) => boolean;
+export declare const isSecretPath: (candidate: string) => boolean;
+/** Always-ask is decided before mode and before the command allowlist. There is no force flag. */
+export declare const classifyApproval: (facts: ApprovalFacts, policy: AutoApprovePolicy) => ClassifyResult;
+export declare const approvalFacts: (name: string, argumentsText: string) => ApprovalFacts;
+/** A whole pending batch auto-resolves only when every item is auto. One always-ask item keeps the batch for a person. */
+export declare const decideBatch: (items: readonly {
+    name?: string;
+    arguments?: string;
+}[], policy: AutoApprovePolicy) => {
+    auto: true;
+    results: {
+        decision: "auto";
+        reason: "edit-in-root" | "allowlisted-command";
+    }[];
+    reason?: never;
+} | {
+    results?: never;
+    auto: false;
+    reason: AskReason;
+};
+export declare const snapshotText: (bytes: Buffer | null) => {
+    text: null;
+    undoable: boolean;
+} | {
+    text: string;
+    undoable: boolean;
+};
+export declare const buildSnapshots: (argumentsText: string, read: (relativePath: string) => {
+    text: string | null;
+    undoable: boolean;
+}) => AutoApprovalSnapshot[];
+export declare const planUndo: (entry: AutoApprovalAuditEntry, current: ReadonlyMap<string, string | null>) => {
+    ok: false;
+    reason: string;
+    writes?: never;
+} | {
+    reason?: never;
+    ok: true;
+    writes: {
+        path: string;
+        contents: string | null;
+    }[];
+};
+export declare const publicAutoApproval: (entry: AutoApprovalAuditEntry) => PublicAutoApproval;
+export declare const readAutoApprovals: (rootDir: string) => Promise<AutoApprovalAuditEntry[]>;
+export declare const appendAutoApproval: (rootDir: string, entry: AutoApprovalAuditEntry) => Promise<void>;
+export declare const loadApprovalConfig: (rootDir: string) => Promise<ApprovalConfigFile>;
+export declare const writeApprovalConfig: (rootDir: string, config: ApprovalConfigFile) => Promise<void>;
+export declare const createAutoApprovalEntry: (input: {
+    approvalId: string;
+    name: string;
+    mode: Exclude<AutoApproveMode, "manual">;
+    reason: string;
+    snapshots: AutoApprovalSnapshot[];
+}) => AutoApprovalAuditEntry;
+export declare const readWorkspaceSnapshot: (rootDir: string, relativePath: string) => Promise<{
+    text: string | null;
+    undoable: boolean;
+}>;
+export declare const revertAutoApproval: (rootDir: string, id: string) => Promise<{
+    ok: false;
+    reason: string;
+    writes?: never;
+} | {
+    ok: true;
+    paths: string[];
+}>;

package/dist/audit/index.js

@@ -1,26 +1,26 @@
 import {
   exportHarnessGovernanceReport,
   harnessGovernanceReportSchema
-} from "../index-j6zxnc8m.js";
-import"../index-sstgcsr0.js";
+} from "../index-zrz4rs7p.js";
+import"../index-yx52bt4a.js";
 import {
   APPROVAL_HISTORY_KEY,
   approvalDecisionViews,
   harnessPolicyDecisionEventSchema
-} from "../index-wm9xeq1n.js";
+} from "../index-bt2p8x7r.js";
 import {
   TASK_BUDGET_ACCOUNT_KEY,
   TaskBudget,
   USAGE_LEDGER_KEY,
   UsageLedger,
   inspectUsageLedger
-} from "../index-zxg4ve4j.js";
+} from "../index-fqqz1yt8.js";
 import {
   HARNESS_VERSION
-} from "../index-4fx5f3k5.js";
+} from "../index-rz7wmp71.js";
 import {
   readRegularFileNoFollow
-} from "../index-xdbkcccf.js";
+} from "../index-6dxrbnxm.js";
 import"../index-bpc596v3.js";
 import"../index-fm84men1.js";
 import"../index-1bx83sw4.js";

package/dist/{audit-pack-e4vaq7np.js → audit-pack-fckpqfsb.js}

@@ -1,7 +1,7 @@
 import {
   exportHarnessGovernanceReport,
   harnessGovernanceReportSchema
-} from "./cli-entry-rgs6bxmy.js";
+} from "./cli-entry-z1pbjrg4.js";
 import {
   APPROVAL_HISTORY_KEY,
   CliUsageError,
@@ -17,10 +17,10 @@ import {
   openHarnessPersistence,
   readRegularFileNoFollow,
   validateStateDirectory
-} from "./cli-entry-7f0cen32.js";
+} from "./cli-entry-6amx4mcc.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-3s63zn4w.js";
+} from "./cli-entry-10th5awp.js";
 import {
   resolveHarnessConfig
 } from "./cli-entry-hdtfef27.js";

package/dist/{cli-1cf4dcnj.js → cli-84en174d.js}

@@ -61,12 +61,14 @@ import {
   withTemporaryHarnessProfiles,
   workspaceCheckpointSchema,
   workspaceRestoreOperationSchema
-} from "./cli-entry-a890x3kq.js";
+} from "./cli-entry-4g2ewcnw.js";
 import {
   exportHarnessGovernanceReport,
   renderHarnessGovernanceMarkdown
-} from "./cli-entry-rgs6bxmy.js";
+} from "./cli-entry-z1pbjrg4.js";
 import {
+  BUDGET_LEDGER_NAMESPACE,
+  BUDGET_OWNER_NAMESPACE_KEY,
   CLI_CHANGES_COMMANDS,
   CLI_COMMANDS,
   CLI_JSON_SCHEMA_VERSION,
@@ -87,6 +89,7 @@ import {
   Workspace,
   applyCliProfile,
   assertTaskBudgetBackupLinks,
+  budgetLedgerNamespace,
   cancelHarnessRun,
   canonicalizeChangeEnvelope,
   changeEnvelopePreconditionsSchema,
@@ -122,14 +125,14 @@ import {
   updateCliProfile,
   validateStateDirectory,
   verifyChangeEnvelope
-} from "./cli-entry-7f0cen32.js";
+} from "./cli-entry-6amx4mcc.js";
 import {
   BUN_ENGINE_RANGE,
   HARNESS_VERSION,
   NODE_ENGINE_RANGE,
   formatCliHelp,
   shortCliHelp
-} from "./cli-entry-3s63zn4w.js";
+} from "./cli-entry-10th5awp.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_SUBAGENT_PROFILES,
@@ -3191,7 +3194,8 @@ var coordinatorIds = (runs) => new Set(runs.flatMap(({ state }) => {
 var validateBudgetLedger = (config, run, identities) => {
   const state = validatedRunState(run.state, `Budget ledger ${run.key}`);
   const identity = state.metadata?.budgetIdentity;
-  if (state.scope?.namespace !== "__zhivex_budget__" || state.scope?.tenantId !== config.scope.tenantId || (state.scope?.userId ?? undefined) !== (config.scope.userId ?? undefined) || state.provider !== "zhivex" || state.modelId !== "budget-coordinator" || state.metadata?.budgetCoordinator !== true || typeof identity !== "string" || !identities.has(identity) || !/^budget_[a-f0-9]{64}$/.test(state.runId) || !sdkRunKeyMatches(run.key, state.scope, state.runId)) {
+  const ownerNamespace = config.scope.namespace;
+  if (!ownerNamespace || state.scope?.namespace !== budgetLedgerNamespace(ownerNamespace) || state.metadata?.[BUDGET_OWNER_NAMESPACE_KEY] !== ownerNamespace || state.scope?.tenantId !== config.scope.tenantId || (state.scope?.userId ?? undefined) !== (config.scope.userId ?? undefined) || state.provider !== "zhivex" || state.modelId !== "budget-coordinator" || state.metadata?.budgetCoordinator !== true || typeof identity !== "string" || !identities.has(identity) || !/^budget_[a-f0-9]{64}$/.test(state.runId) || !sdkRunKeyMatches(run.key, state.scope, state.runId)) {
     throw new HarnessStateConflictError("Budget ledger is not bound to an exported run and durable scope.");
   }
   assertTerminalState(state, `Budget ledger ${run.key}`);
@@ -3325,7 +3329,9 @@ var readPayload = async (config, recordedWorkspace, accessLease) => {
       const metadata = state.metadata;
       if (typeof metadata?.budgetIdentity !== "string" || !identities.has(metadata.budgetIdentity)) {
         const scope = state.scope;
-        if (scope?.namespace === "__zhivex_budget__" && scope.tenantId === config.scope.tenantId && (scope.userId ?? undefined) === (config.scope.userId ?? undefined)) {
+        const sameTenant = scope?.tenantId === config.scope.tenantId && (scope?.userId ?? undefined) === (config.scope.userId ?? undefined);
+        const boundNamespace = config.scope.namespace ? budgetLedgerNamespace(config.scope.namespace) : undefined;
+        if (sameTenant && (scope?.namespace === BUDGET_LEDGER_NAMESPACE || scope?.namespace === boundNamespace)) {
           throw new HarnessStateConflictError("An unlinked shared budget ledger cannot be safely assigned to this backup scope; retain the original database.");
         }
         return [];
@@ -4085,7 +4091,7 @@ var main = async (argv = process.argv.slice(2)) => {
     parsedOptions = { ...parsedOptions, prompt: await readStdinTask() };
   }
   if (parsedOptions.serviceFile) {
-    const { runServiceCli } = await import("./service-client-cli-eqrdc9zq.js");
+    const { runServiceCli } = await import("./service-client-cli-pp5z4dmf.js");
     await runServiceCli(parsedOptions, annotateCliStreamError);
     return;
   }
@@ -4150,7 +4156,7 @@ var main = async (argv = process.argv.slice(2)) => {
       return;
     case "export-audit":
     case "verify-audit": {
-      const { auditPackCli } = await import("./audit-pack-e4vaq7np.js");
+      const { auditPackCli } = await import("./audit-pack-fckpqfsb.js");
       await auditPackCli(options);
       return;
     }

package/dist/{cli-entry-3s63zn4w.js → cli-entry-10th5awp.js}

@@ -444,7 +444,7 @@ Use zhx help all for the full reference and exit codes.`;
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.4.1",
+  version: "1.6.2",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",
@@ -544,6 +544,7 @@ var package_default = {
     "LICENSE",
     "docs/CHANGE_ENVELOPES.md",
     "docs/CLI.md",
+    "docs/AUTO_APPROVE.md",
     "docs/WEB_LIMITS.md",
     "docs/CODE_RELEASE.md",
     "docs/CODE_WEB_TASKS.md",
@@ -660,26 +661,26 @@ var package_default = {
     "smoke:mcp:installed": "bun run build && bun scripts/mcp-installed-smoke.ts"
   },
   dependencies: {
-    "@zhivex-ai/agents": "1.11.0",
-    "@zhivex-ai/anthropic": "0.14.0",
-    "@zhivex-ai/azure-openai": "0.7.8",
-    "@zhivex-ai/bedrock": "2.0.7",
-    "@zhivex-ai/core": "1.34.0",
-    "@zhivex-ai/gemini": "0.13.0",
-    "@zhivex-ai/meta": "0.2.9",
-    "@zhivex-ai/openai": "0.16.0",
-    "@zhivex-ai/qwen": "0.16.4",
-    "@zhivex-ai/vertex": "1.2.7",
-    "google-auth-library": "11.1.0",
-    zod: "4.6.5"
+    "@zhivex-ai/agents": "1.12.0",
+    "@zhivex-ai/anthropic": "0.15.0",
+    "@zhivex-ai/azure-openai": "0.8.0",
+    "@zhivex-ai/bedrock": "2.1.0",
+    "@zhivex-ai/core": "1.36.0",
+    "@zhivex-ai/gemini": "0.14.0",
+    "@zhivex-ai/meta": "0.3.0",
+    "@zhivex-ai/openai": "0.17.0",
+    "@zhivex-ai/qwen": "0.18.0",
+    "@zhivex-ai/vertex": "1.3.0",
+    "google-auth-library": "11.3.1",
+    zod: "4.6.7"
   },
   overrides: {
-    "@zhivex-ai/core": "1.34.0"
+    "@zhivex-ai/core": "1.36.0"
   },
   devDependencies: {
     "@agentclientprotocol/sdk": "1.8.0",
     "@modelcontextprotocol/server": "2.3.1",
-    "@types/bun": "1.4.2",
+    "@types/bun": "1.4.3",
     "@types/node": "^26.6.5",
     typescript: "7.0.2",
     "typescript-compiler-api": "npm:typescript@6.0.3"

package/dist/{cli-entry-a890x3kq.js → cli-entry-4g2ewcnw.js}

@@ -59,6 +59,7 @@ import {
   inspectTaskMonetaryUsage,
   inspectUsageLedger,
   isHardIgnored,
+  isReservedBudgetNamespace,
   measureContext,
   moveFileInputSchema,
   nextTaskAcceptanceLedger,
@@ -96,10 +97,10 @@ import {
   withWorkspaceMutation,
   workBudgetReached,
   workspaceFilePathSchema
-} from "./cli-entry-7f0cen32.js";
+} from "./cli-entry-6amx4mcc.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-3s63zn4w.js";
+} from "./cli-entry-10th5awp.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_CONFIG_SCHEMA_VERSION,
@@ -4978,6 +4979,7 @@ var record = (value) => value !== null && typeof value === "object" && !Array.is
 var LOCAL_TOOLS = LOCAL_TOOL_NAMES;
 var MAX_USER_STEERING = 10;
 var CONTEXT_PRIORITY = "Latest user > chronological user steering > historical objective. Assistant never overrides user facts. Questions retain task.";
+var EARLIER = "[before later user messages] ";
 var summarizeHarnessMessages = (messages, maxCharacters = 4000) => {
   const redaction = createRedactionPolicy3({ includeEmails: true });
   const clean = (text, limit = 512) => redaction.redactText(text).replace(/\bBearer\s+\S+/gi, "Bearer [REDACTED]").replace(/\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)|api[_-]?key|access[_-]?token|password)\s*([=:])\s*(?:"[^"]*"|'[^']*'|\S+)/gi, "$1$2[REDACTED]").replace(/\b(?:sk|ghp|gho|github_pat)-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(/\s+/g, " ").trim().slice(0, limit);
@@ -5003,6 +5005,12 @@ var summarizeHarnessMessages = (messages, maxCharacters = 4000) => {
       omitted = true;
     }
   };
+  const markRecentEarlier = () => {
+    const marked = recent.map((value) => value.startsWith(EARLIER) ? value : `${EARLIER}${value}`);
+    recent.length = 0;
+    for (const value of marked)
+      add(recent, value, 4);
+  };
   const rememberObservation = (tool2, detail) => {
     if (typeof tool2 !== "string" || !LOCAL_TOOLS.has(tool2) || typeof detail !== "string")
       return;
@@ -5120,6 +5128,7 @@ var summarizeHarnessMessages = (messages, maxCharacters = 4000) => {
           objective = text;
           if (historicalObjective)
             add(steering, text, MAX_USER_STEERING);
+          markRecentEarlier();
         } else
           add(recent, `${message.role}: ${text}`, 4);
       } else if (part.type === "tool-call") {
@@ -6394,7 +6403,7 @@ var projectMemoryBinding = (workspace, scope) => {
     segment(scope.userId);
   if (scope.namespace !== undefined)
     segment(scope.namespace);
-  if (scope.namespace === "__zhivex_budget__")
+  if (isReservedBudgetNamespace(scope.namespace))
     throw new HarnessConfigError("Reserved memory namespace.");
   const key = (kind, value) => createHash10("sha256").update(kind).update("\x00").update(value).digest("hex");
   const workspaceKey = key("workspace", workspace);
@@ -6720,7 +6729,8 @@ var resolvers = {
     const parsed = moveFileInputSchema.parse(input);
     return [parsed.source, parsed.destination];
   },
-  quarantine_file: (input) => [quarantineFileInputSchema.parse(input).path]
+  quarantine_file: (input) => [quarantineFileInputSchema.parse(input).path],
+  restore_file: (input) => [restoreFileInputSchema.parse(input).destination]
 };
 var validateBuiltinToolPolicy = (policy, tools) => {
   for (const rule of policy.rules)
@@ -8153,7 +8163,7 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
   }),
   restore_file: tool4({
     name: "restore_file",
-    description: "Restore a quarantined file to its original path or an explicit safe destination without overwriting content unexpectedly.",
+    description: "Restore a quarantined file to the required destination after the reviewed expectedDigest matches the quarantined bytes. Restore does not fall back to the original path and never overwrites an existing file.",
     schema: restoreFileInputSchema,
     ...mutationApproval,
     execute: async (input, context) => serializeJsonValue6(editContractDocument("restore-result", await (harnessExecutionSession(context)?.workspace ?? workspace).restoreQuarantined(input)))