@zhivex-ai/harness 1.5.0 → 1.6.3

package/CHANGELOG.md

@@ -6,6 +6,33 @@ The project follows Semantic Versioning. During `0.x`, minor releases may change
 
 ## Unreleased
 
+## 1.6.3 - 2026-11-10
+
+- Prepare a maintenance patch for npm `latest`, paired with Code 0.4.2 and the private Desktop engine binding. Existing public APIs, storage formats, model defaults and provider tiers are unchanged. Publication and release-bound live certification are pending.
+- Include the keyring 2.1.2 update and dependency security maintenance for the private Web/Desktop clients.
+- Update the development dependency `@agentclientprotocol/sdk` from 1.8.0 to 2.1.0. SDK 2.1 removes `ClientSideConnection`; the Docker interoperability client now uses `client().connect(...)` and the same ACP v1 methods. `@modelcontextprotocol/server` stays at 2.3.1 because that peer is optional and this client does not import it. The Harness ACP server is unchanged.
+- Pin `@zhivex-ai/core` 1.37.0, including the root override, the Code and web package pins, and a web override so the published Harness dependency uses that same runtime, and `@zhivex-ai/qwen` 0.18.1. Qwen 0.18.1 depends on Core `^1.37.0`. Harness and CLI defaults are unchanged. The Qwen adapter rejects non-string portable-decision instructions and adds PixVerse V6 request shaping; Harness does not expose that video surface.
+
+## 1.6.2 - 2026-10-24
+
+- Allow one continuity retry per provider in the release gate. Live certification of `v1.6.0` and `v1.6.1` (twice) failed only the multi-process continuity gate, each time on a different provider. A provider whose continuity run fails now gets one fresh retry of all phases and passes only if the retry passes. Every selected provider stays mandatory, and no other gate retries. The continuity evidence records which provider retried, the first attempt's sanitized cause, and the retry outcome. Runtime and CLI behavior and defaults are unchanged (#250).
+- 1.6.1 was tagged but not published, so 1.6.2 is the first npm release carrying the 1.6.1 compaction fix below.
+
+## 1.6.1 - 2026-10-24
+
+- Mark compacted recollections that precede later user messages. Compaction keeps user steering and recent assistant replies in separate lists, so a stale reply naming a replaced objective could read as newer than the user message that superseded it. In the `v1.6.0` live certification, meta and qwen repeated their previous answer in the continuity gate. Recent entries followed by a later user message now carry a `[before later user messages] ` prefix. The summary schema, strategy id, and defaults are unchanged (#248).
+
+## 1.6.0 - 2026-10-24
+
+- Prepare minor Harness 1.6.0 for npm `latest`. The minor is opt-in auto-approve. Code stays version 0.4.0. Its source pin moves to Harness 1.6.0 because installed acceptance rejects a candidate that differs from that pin. Published npm Code 0.4.0 remains pinned to Harness 1.5.0 and is not republished. Private Desktop binds to this engine. The representative mapping for `v1.6.0` uses the same Meta, Qwen, and OpenAI models as `v1.5.0`. This preparation creates no tag and dispatches no workflow.
+- Add opt-in auto-approve. Manual stays the default. `auto-edits` can apply file edits inside the workspace without a prompt. `auto-limits` adds commands whose executable is on the allowlist. Network or egress, secrets, `git push`, package publish, writes outside the workspace, and a reached spend or token limit still wait for a person. A mixed batch stays on the review screen. `--approval-mode auto` and `--yes` remain the older non-interactive switch and are not this feature. See [opt-in auto-approve](docs/AUTO_APPROVE.md).
+- Rework the local web workspace. Light-theme controls use theme tokens, the header is one bar, and the first message creates the session. A confirmed execution failure stays editable. The model library, composer, message bubbles, tool pills, and appearance control follow the Harness chat reference.
+- Name each terminal action. Read, search, and edit lines state the target. Consecutive edits of one file collapse to a net diff and an attempt count. The review names the change, counts each file, keeps indentation when a line wraps, and shows NUL, zero-width characters, bidi overrides, tabs, and trailing spaces. The decision is "Approve this change".
+- Keep NUL and other control bytes out of model-facing edit tool schemas. `propose_edits`, `apply_patch`, and the replacement and verified-edit inputs do not advertise `allowControlBytes`. Model-supplied text is still refused, and the host opt-in stays off unless a host call passes it outside the tool input. The stable declaration snapshot records that optional host argument.
+- Pin private Desktop Electron 44.9.3 and its optional `undici` dependency at 7.30.1. Electron 44.5.1 is inside GHSA-jr5w-w6x2-84p9 (`<44.9.1`), and undici 7.29.1 is inside GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472, and GHSA-xjj6-f33q-929c (`<7.30.1`). Desktop behavior is unchanged.
+- Pin the private web Playwright devDependency at 1.64.1 so `playwright install --with-deps chromium` can run on the Ubuntu 26.04 GitHub runner. Browser journeys still launch headless Chromium the same way.
+- Pin the published 2026-10-24 SDK batch: Core 1.36.0, Agents 1.12.0, OpenAI 0.17.0, Anthropic 0.15.0, Qwen 0.18.0, Gemini 0.14.0, Vertex 1.3.0, Azure OpenAI 0.8.0, Bedrock 2.1.0, and Meta 0.3.0. The web client pins React 0.10.0. The root Core override stays one runtime. `zod` is 4.6.7 and `google-auth-library` is 11.3.1 so the new adapter floors resolve to one copy. Harness and CLI defaults are unchanged: shared `topP`, `seed`, and `stopSequences` are not sent, `stopWhen` is not set, and voice is unused. `@types/bun` is 1.4.3. CodeQL init and analyze stay SHA-pinned at `6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee` (v4.39.0).
+
 ## 1.5.0 - 2026-10-16
 
 - Prepare minor Harness 1.5.0 and Code 0.4.0 for npm `latest`. The minor covers the new experimental audit pack, provisional Bedrock and Azure OpenAI routes, and Code web task control; stable root exports and command contracts are unchanged. It ships with the exact Code engine pin, private Desktop binding and an additive representative mapping for `v1.5.0` using the unchanged Meta, Qwen and OpenAI models. Published `latest` is Harness 1.4.1 and Code 0.3.2. Tags and publication follow only through the protected release workflows.

package/README.md

@@ -159,6 +159,8 @@ Contracts, stability tiers, and the experimental ACP and MCP entry points are in
 
 ## Releases
 
-Version `1.4.1` is the current public npm release. The paired Code package on npm `latest` is `0.3.2`. This checkout prepares Version `1.5.0` and Code `0.4.0` for `latest`. That publication is pending, so the quick start above follows the published `latest` tag. npm `next` is Harness `1.4.0-rc.8` and Code `0.3.0-rc.8`. Confirm dist-tags on the [Code versions](https://www.npmjs.com/package/@zhivex-ai/code?activeTab=versions) and [Harness versions](https://www.npmjs.com/package/@zhivex-ai/harness?activeTab=versions) pages before you install a prerelease.
+Version `1.6.3` is the prepared source candidate, paired with Code `0.4.2`; publication and release-bound live certification are pending.
+
+Version `1.6.2` is the current public npm release. The Code package on npm `latest` is `0.4.1`, pinned exactly to Harness `1.6.2`. The quick start above follows the published `latest` tag. npm `next` is Harness `1.4.0-rc.8` and Code `0.3.0-rc.8`. Confirm dist-tags on the [Code versions](https://www.npmjs.com/package/@zhivex-ai/code?activeTab=versions) and [Harness versions](https://www.npmjs.com/package/@zhivex-ai/harness?activeTab=versions) pages before you install a prerelease.
 
 Release channels, publication, and certification records are in the [release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md). Releases are verified with npm provenance. Source in this checkout can be newer than the public package. See the [changelog](CHANGELOG.md) and the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json).

package/SUPPORT.md

@@ -13,7 +13,7 @@ The 1.1 support scope is tracked in the [machine-readable support matrix](./docs
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published stable minor receives routine fixes. The exact `v1.3.0` tag passed the protected artifact, six-provider live and 42-case representative release jobs. Harness 1.3.x and Code 0.2.x are the supported stable lines until 1.5.0 and Code 0.4.0 complete verified publication. Gemini, Anthropic and Vertex remain provisional despite the release-bound live gates; the representative repository matrix covers only Meta, Qwen and OpenAI. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Only the most recent published stable minor receives routine fixes. The exact `v1.3.0` tag passed the protected artifact, six-provider live and 42-case representative release jobs. Harness 1.5.0 and Code 0.4.0 are the published stable packages. Code 0.4.1, pinned exactly to Harness 1.6.2, is published on `latest`. Gemini, Anthropic and Vertex remain provisional despite the release-bound live gates; the representative repository matrix covers only Meta, Qwen and OpenAI. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Installation diagnostics
 

package/contracts/stable-api-signatures.json

@@ -125,7 +125,7 @@
     },
     {
       "name": "Workspace",
-      "sha256": "sha256:42b53815d22e2734371ae5360f059779516f7304bc9a1941dc208d12b67f6a60"
+      "sha256": "sha256:9b8bc9eb0d44bb64e75995483aa9c68f73816359da93299844b8c8290c3a1480"
     },
     {
       "name": "appendUserMessage",
@@ -165,7 +165,7 @@
     },
     {
       "name": "createHarness",
-      "sha256": "sha256:0bf4f22db95c409dfa85fce488984f06efa84491fc7d4ef2351a053ea32701f3"
+      "sha256": "sha256:2a9567b8785aced05da16f6606cf6e71bad3229d2df0d0b1cf1f5f96e57852f2"
     },
     {
       "name": "createHarnessMcpTools",
@@ -173,7 +173,7 @@
     },
     {
       "name": "createHarnessOciExecutionEnvironment",
-      "sha256": "sha256:6ae2d5238e49299c4c0ee9d9b5f0ddae4de86db9387c8469f7fd6f4518e20e6e"
+      "sha256": "sha256:432ed8e25be522eb6adf03ca61bc01d1f04e3ccafcb9a9d380b6b55130f5a1c5"
     },
     {
       "name": "createHarnessStateBackup",
@@ -273,7 +273,7 @@
     },
     {
       "name": "runHarness",
-      "sha256": "sha256:82a768885893267b4c24aae1923726ae59c048f73c34ce1e92d0355981c6d46a"
+      "sha256": "sha256:e2da41119fb7a86ae2385a2edacee3221c44ab68bcc9360d5307f7df44bd4982"
     },
     {
       "name": "serializeStreamEvent",
@@ -427,7 +427,7 @@
     },
     {
       "name": "HarnessExecutionSession",
-      "sha256": "sha256:15843c59747ef8d072a66f19c88031a2a2981be3cdebf3aabb836132b6f7c4b9"
+      "sha256": "sha256:6ef99960a68c92cbcf6f1b0d6f65fde844f0b1ee1514b7d1b4df65d752cc4a37"
     },
     {
       "name": "HarnessMcpConfiguration",
@@ -487,8 +487,8 @@
     },
     {
       "name": "ZhivexHarness",
-      "sha256": "sha256:2911bde71fdae2dff26f766d068c560375757fb6575f5aaec02ff3346c46ab94"
+      "sha256": "sha256:959a37960c89176ada62c3d126bb30b49d0621b721b89a5972fcf58a184480c0"
     }
   ],
-  "digest": "sha256:50be2a81cd0e7601d5610008081c406cecf9855c5ffd42d2faffba521b08873e"
+  "digest": "sha256:ad2cd323cee44ab26037a02eb9079eecf713771601de3fde44ad2e3b4df85cbc"
 }

package/dist/acp-cli.js

@@ -11,14 +11,14 @@ import {
 } from "./index-3ah1f369.js";
 import {
   createHarnessClientAdapter
-} from "./index-vc7yxz50.js";
-import"./index-63gbp0cz.js";
+} from "./index-j466sekf.js";
+import"./index-4mn6m3bq.js";
 import {
   createHarness
-} from "./index-6fp7kdpx.js";
-import"./index-wwthv10a.js";
-import"./index-5zbq9ztj.js";
-import"./index-ggstwr0v.js";
+} from "./index-vn91b9z1.js";
+import"./index-amjttjaj.js";
+import"./index-hhrnrqfc.js";
+import"./index-w0m1nckc.js";
 import {
   HARNESS_REQUIRED_CAPABILITIES,
   HARNESS_SUBAGENT_PROFILES,
@@ -35,7 +35,7 @@ import"./index-bt2p8x7r.js";
 import {
   usagePricingSchema
 } from "./index-fqqz1yt8.js";
-import"./index-pq3kz1r8.js";
+import"./index-3wwfn5n6.js";
 import {
   FileChangedWhileReadingError,
   FileSizeLimitError,

package/dist/approvals/auto-approve.d.ts

@@ -0,0 +1,137 @@
+/** Opt-in approval policy. Manual is the default. Always-ask reasons are checked before any mode or allowlist. */
+export declare const AUTO_APPROVE_MODES: readonly ["manual", "auto-edits", "auto-limits"];
+export type AutoApproveMode = (typeof AUTO_APPROVE_MODES)[number];
+export interface AutoApprovePolicy {
+    mode: AutoApproveMode;
+    commandAllowlist: readonly string[];
+    rootDir: string;
+    overLimit?: boolean;
+}
+export interface ApprovalPath {
+    path: string;
+    operation?: "create" | "update" | "delete" | "move" | "restore";
+}
+export interface ApprovalFacts {
+    name: string;
+    paths: readonly ApprovalPath[];
+    commands: readonly string[];
+}
+export type AskReason = "manual" | "not-an-edit" | "not-allowlisted" | "unproven-path" | "network" | "delete-outside" | "write-outside" | "secret" | "git-push" | "package-publish" | "over-limit";
+export type ClassifyResult = {
+    decision: "ask";
+    reason: AskReason;
+} | {
+    decision: "auto";
+    reason: "edit-in-root" | "allowlisted-command";
+};
+export interface ApprovalConfigFile {
+    mode: AutoApproveMode;
+    commandAllowlist: string[];
+}
+export interface AutoApprovalSnapshot {
+    path: string;
+    before: string | null;
+    after: string | null;
+    undoable: boolean;
+}
+export interface AutoApprovalAuditEntry {
+    id: string;
+    approvalId: string;
+    name: string;
+    mode: Exclude<AutoApproveMode, "manual">;
+    reason: string;
+    timestamp: string;
+    snapshots: AutoApprovalSnapshot[];
+}
+export interface PublicAutoApproval {
+    id: string;
+    name: string;
+    mode: Exclude<AutoApproveMode, "manual">;
+    reason: string;
+    timestamp: string;
+    paths: string[];
+    undoable: boolean;
+}
+export declare const approvalConfigPath: (rootDir: string) => string;
+export declare const autoApprovalLogPath: (rootDir: string) => string;
+export declare const isAutoApproveMode: (value: string) => value is AutoApproveMode;
+/** Exact executable names only. Wildcards, paths and shell syntax are rejected. */
+export declare const parseAllowlist: (entries: readonly string[]) => string[];
+export declare const parseApprovalConfig: (text: string) => ApprovalConfigFile;
+export declare const resolveAutoApprovePolicy: (input: {
+    rootDir: string;
+    overLimit?: boolean;
+    file?: ApprovalConfigFile | null;
+    cliMode?: AutoApproveMode;
+    cliAllow?: readonly string[];
+    sessionMode?: AutoApproveMode;
+    sessionAllow?: readonly string[];
+}) => AutoApprovePolicy;
+export declare const isInsideRoot: (rootDir: string, candidate: string) => boolean;
+export declare const isSecretPath: (candidate: string) => boolean;
+/** Always-ask is decided before mode and before the command allowlist. There is no force flag. */
+export declare const classifyApproval: (facts: ApprovalFacts, policy: AutoApprovePolicy) => ClassifyResult;
+export declare const approvalFacts: (name: string, argumentsText: string) => ApprovalFacts;
+/** A whole pending batch auto-resolves only when every item is auto. One always-ask item keeps the batch for a person. */
+export declare const decideBatch: (items: readonly {
+    name?: string;
+    arguments?: string;
+}[], policy: AutoApprovePolicy) => {
+    auto: true;
+    results: {
+        decision: "auto";
+        reason: "edit-in-root" | "allowlisted-command";
+    }[];
+    reason?: never;
+} | {
+    results?: never;
+    auto: false;
+    reason: AskReason;
+};
+export declare const snapshotText: (bytes: Buffer | null) => {
+    text: null;
+    undoable: boolean;
+} | {
+    text: string;
+    undoable: boolean;
+};
+export declare const buildSnapshots: (argumentsText: string, read: (relativePath: string) => {
+    text: string | null;
+    undoable: boolean;
+}) => AutoApprovalSnapshot[];
+export declare const planUndo: (entry: AutoApprovalAuditEntry, current: ReadonlyMap<string, string | null>) => {
+    ok: false;
+    reason: string;
+    writes?: never;
+} | {
+    reason?: never;
+    ok: true;
+    writes: {
+        path: string;
+        contents: string | null;
+    }[];
+};
+export declare const publicAutoApproval: (entry: AutoApprovalAuditEntry) => PublicAutoApproval;
+export declare const readAutoApprovals: (rootDir: string) => Promise<AutoApprovalAuditEntry[]>;
+export declare const appendAutoApproval: (rootDir: string, entry: AutoApprovalAuditEntry) => Promise<void>;
+export declare const loadApprovalConfig: (rootDir: string) => Promise<ApprovalConfigFile>;
+export declare const writeApprovalConfig: (rootDir: string, config: ApprovalConfigFile) => Promise<void>;
+export declare const createAutoApprovalEntry: (input: {
+    approvalId: string;
+    name: string;
+    mode: Exclude<AutoApproveMode, "manual">;
+    reason: string;
+    snapshots: AutoApprovalSnapshot[];
+}) => AutoApprovalAuditEntry;
+export declare const readWorkspaceSnapshot: (rootDir: string, relativePath: string) => Promise<{
+    text: string | null;
+    undoable: boolean;
+}>;
+export declare const revertAutoApproval: (rootDir: string, id: string) => Promise<{
+    ok: false;
+    reason: string;
+    writes?: never;
+} | {
+    ok: true;
+    paths: string[];
+}>;

package/dist/audit/index.js

@@ -1,7 +1,7 @@
 import {
   exportHarnessGovernanceReport,
   harnessGovernanceReportSchema
-} from "../index-jpdvn09j.js";
+} from "../index-5nmm0642.js";
 import"../index-yx52bt4a.js";
 import {
   APPROVAL_HISTORY_KEY,
@@ -17,7 +17,7 @@ import {
 } from "../index-fqqz1yt8.js";
 import {
   HARNESS_VERSION
-} from "../index-pq3kz1r8.js";
+} from "../index-3wwfn5n6.js";
 import {
   readRegularFileNoFollow
 } from "../index-6dxrbnxm.js";

package/dist/{audit-pack-kvw7ng34.js → audit-pack-s9n693by.js}

@@ -1,7 +1,7 @@
 import {
   exportHarnessGovernanceReport,
   harnessGovernanceReportSchema
-} from "./cli-entry-75j3r49b.js";
+} from "./cli-entry-1epvek01.js";
 import {
   APPROVAL_HISTORY_KEY,
   CliUsageError,
@@ -17,10 +17,10 @@ import {
   openHarnessPersistence,
   readRegularFileNoFollow,
   validateStateDirectory
-} from "./cli-entry-928p8h41.js";
+} from "./cli-entry-nyzyvf24.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-q8bgkn9m.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   resolveHarnessConfig
 } from "./cli-entry-hdtfef27.js";

package/dist/{cli-entry-75j3r49b.js → cli-entry-1epvek01.js}

@@ -10,10 +10,10 @@ import {
   readTaskAcceptanceLedger,
   taskCheckReceiptSchema,
   verifyChangeEnvelope
-} from "./cli-entry-928p8h41.js";
+} from "./cli-entry-nyzyvf24.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-q8bgkn9m.js";
+} from "./cli-entry-mbcq96nx.js";
 
 // src/persistence/governance-report.ts
 import { createHash as createHash2 } from "node:crypto";

package/dist/{cli-entry-q8bgkn9m.js → cli-entry-mbcq96nx.js}

@@ -444,7 +444,7 @@ Use zhx help all for the full reference and exit codes.`;
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.5.0",
+  version: "1.6.3",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",
@@ -544,6 +544,7 @@ var package_default = {
     "LICENSE",
     "docs/CHANGE_ENVELOPES.md",
     "docs/CLI.md",
+    "docs/AUTO_APPROVE.md",
     "docs/WEB_LIMITS.md",
     "docs/CODE_RELEASE.md",
     "docs/CODE_WEB_TASKS.md",
@@ -660,26 +661,26 @@ var package_default = {
     "smoke:mcp:installed": "bun run build && bun scripts/mcp-installed-smoke.ts"
   },
   dependencies: {
-    "@zhivex-ai/agents": "1.11.0",
-    "@zhivex-ai/anthropic": "0.14.0",
-    "@zhivex-ai/azure-openai": "0.7.8",
-    "@zhivex-ai/bedrock": "2.0.7",
-    "@zhivex-ai/core": "1.34.0",
-    "@zhivex-ai/gemini": "0.13.0",
-    "@zhivex-ai/meta": "0.2.9",
-    "@zhivex-ai/openai": "0.16.0",
-    "@zhivex-ai/qwen": "0.16.4",
-    "@zhivex-ai/vertex": "1.2.7",
-    "google-auth-library": "11.1.0",
-    zod: "4.6.5"
+    "@zhivex-ai/agents": "1.12.0",
+    "@zhivex-ai/anthropic": "0.15.0",
+    "@zhivex-ai/azure-openai": "0.8.0",
+    "@zhivex-ai/bedrock": "2.1.0",
+    "@zhivex-ai/core": "1.37.0",
+    "@zhivex-ai/gemini": "0.14.0",
+    "@zhivex-ai/meta": "0.3.0",
+    "@zhivex-ai/openai": "0.17.0",
+    "@zhivex-ai/qwen": "0.18.1",
+    "@zhivex-ai/vertex": "1.3.0",
+    "google-auth-library": "11.3.1",
+    zod: "4.6.7"
   },
   overrides: {
-    "@zhivex-ai/core": "1.34.0"
+    "@zhivex-ai/core": "1.37.0"
   },
   devDependencies: {
-    "@agentclientprotocol/sdk": "1.8.0",
+    "@agentclientprotocol/sdk": "2.1.0",
     "@modelcontextprotocol/server": "2.3.1",
-    "@types/bun": "1.4.2",
+    "@types/bun": "1.4.4",
     "@types/node": "^26.6.5",
     typescript: "7.0.2",
     "typescript-compiler-api": "npm:typescript@6.0.3"
@@ -690,7 +691,7 @@ var package_default = {
   },
   packageManager: "bun@1.4.0",
   optionalDependencies: {
-    "@napi-rs/keyring": "2.1.1"
+    "@napi-rs/keyring": "2.1.2"
   }
 };
 

package/dist/{cli-entry-928p8h41.js → cli-entry-nyzyvf24.js}

@@ -2,7 +2,7 @@ import {
   CLI_OPTION_DEFINITIONS,
   resolveHelpTopic,
   validateCliCommandOptions
-} from "./cli-entry-q8bgkn9m.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_EXECUTION_POLICY_VERSION,
@@ -3994,6 +3994,55 @@ var runPortableProcess = async (command, options = {}) => {
   }
 };
 
+// src/workspace/text-integrity.ts
+var controlLabel = (code) => code === 0 ? "NUL byte" : `U+${code.toString(16).padStart(4, "0")}`;
+var firstDisallowedControl = (text) => {
+  let line = 1;
+  for (let index = 0;index < text.length; index += 1) {
+    const code = text.charCodeAt(index);
+    if (code === 10) {
+      line += 1;
+      continue;
+    }
+    if (code === 9 || code === 13)
+      continue;
+    if (code < 32 || code === 127 || code >= 128 && code <= 159)
+      return { line, label: controlLabel(code) };
+  }
+  return;
+};
+var firstDisallowedControlBytes = (bytes) => {
+  let line = 1;
+  for (let index = 0;index < bytes.length; index += 1) {
+    const code = bytes[index] ?? 0;
+    if (code === 10) {
+      line += 1;
+      continue;
+    }
+    if (code === 9 || code === 13)
+      continue;
+    if (code < 32 || code === 127)
+      return { line, label: controlLabel(code) };
+  }
+  return;
+};
+var refuseControlMessage = (hit) => `Refusing to write a control byte into a text file: ${hit.label} at L${hit.line}. The file was not changed. Remove the control byte.`;
+var binaryAfterEditMessage = (hit) => `file is binary after edit: ${hit.label} at L${hit.line}. The edit was reverted. Read the file again before retrying.`;
+var textGuards = {
+  beforeWrite(content, allowControlBytes) {
+    if (allowControlBytes)
+      return;
+    const problem = firstDisallowedControl(content);
+    if (problem)
+      throw new HarnessWorkspaceError(refuseControlMessage(problem));
+  },
+  afterWrite(bytes, allowControlBytes) {
+    if (allowControlBytes)
+      return;
+    return firstDisallowedControlBytes(bytes);
+  }
+};
+
 // src/workspace/path-policy.ts
 var HARD_IGNORES = new Set([".git", ".next", ".turbo", ".zhivex-harness", "coverage", "dist", "node_modules"]);
 var isSensitiveName = (name) => {
@@ -4323,8 +4372,11 @@ class Workspace {
       maxBytes: MAX_FILE_BYTES
     });
     const { contents } = file;
-    if (!allowBinary && contents.includes(0))
-      throw new HarnessWorkspaceError("The file appears to be binary and cannot be read as text.");
+    if (!allowBinary && contents.includes(0)) {
+      const hit = firstDisallowedControlBytes(contents);
+      const where = hit ? `: ${hit.label} at L${hit.line}` : "";
+      throw new HarnessWorkspaceError(`The file appears to be binary and cannot be read as text${where}.`);
+    }
     return {
       path: wirePath(path11.relative(this.root, safe.path)),
       absolutePath: safe.path,
@@ -4991,19 +5043,23 @@ class Workspace {
     if (position < 0 || text.indexOf(edit.oldText, position + 1) >= 0) {
       throw new HarnessWorkspaceError("Replacement requires exactly one literal match; include more surrounding context.");
     }
-    return [{ path: edit.path, expectedDigest: edit.expectedDigest, content: text.slice(0, position) + edit.newText + text.slice(position + edit.oldText.length) }];
+    return [{
+      path: edit.path,
+      expectedDigest: edit.expectedDigest,
+      content: text.slice(0, position) + edit.newText + text.slice(position + edit.oldText.length)
+    }];
   }
-  async applyReplacement(input) {
+  async applyReplacement(input, host = {}) {
     const changes = await this.replacementChanges(input);
-    return this.applyPatch({ proposalId: createEditProposal({ changes }).proposalId, changes });
+    return this.applyPatch({ proposalId: createEditProposal({ changes }).proposalId, changes }, host);
   }
-  async applyPatch(input) {
-    return this.applyPatchWithModes(input, new Map);
+  async applyPatch(input, host = {}) {
+    return this.applyPatchWithModes(input, new Map, undefined, host);
   }
-  async applyPatchWithModes(input, modes, assertActive) {
-    return withWorkspaceMutation(this.root, () => this.applyPatchWithModesLocked(input, modes, assertActive));
+  async applyPatchWithModes(input, modes, assertActive, host = {}) {
+    return withWorkspaceMutation(this.root, () => this.applyPatchWithModesLocked(input, modes, assertActive, host));
   }
-  async applyPatchWithModesLocked(input, modes, assertActive) {
+  async applyPatchWithModesLocked(input, modes, assertActive, host = {}) {
     const proposal = validateEditProposal(input);
     this.checkAuditCapacity(proposal.changes.length);
     const targetPaths = new Set(proposal.changes.map((change) => change.path));
@@ -5048,6 +5104,7 @@ class Workspace {
             throw new HarnessWorkspaceError(`Stale patch mode rejected for ${change.path}: expected ${modeBinding.beforeMode.toString(8)}, found ${before.mode.toString(8)}.`);
           }
         }
+        textGuards.beforeWrite(change.content, host.allowControlBytes === true);
         const temporary = await this.stageFile(safe.path, change.content, modeBinding?.afterMode ?? before?.mode ?? 420);
         prepared.push({
           change,
@@ -5087,6 +5144,13 @@ class Workspace {
           await unlink2(item.temporary);
         }
         committed.push(item);
+        const published = await readRegularFileNoFollow(item.target, {
+          label: "The published file",
+          maxBytes: MAX_FILE_BYTES
+        });
+        const corrupt = textGuards.afterWrite(published.contents, host.allowControlBytes === true);
+        if (corrupt)
+          throw new HarnessWorkspaceError(binaryAfterEditMessage(corrupt));
         await assertActive?.();
       }
     } catch (error) {

package/dist/{cli-entry-h2yc9x37.js → cli-entry-rsx0wpvs.js}

@@ -97,10 +97,10 @@ import {
   withWorkspaceMutation,
   workBudgetReached,
   workspaceFilePathSchema
-} from "./cli-entry-928p8h41.js";
+} from "./cli-entry-nyzyvf24.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-q8bgkn9m.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_CONFIG_SCHEMA_VERSION,
@@ -4979,6 +4979,7 @@ var record = (value) => value !== null && typeof value === "object" && !Array.is
 var LOCAL_TOOLS = LOCAL_TOOL_NAMES;
 var MAX_USER_STEERING = 10;
 var CONTEXT_PRIORITY = "Latest user > chronological user steering > historical objective. Assistant never overrides user facts. Questions retain task.";
+var EARLIER = "[before later user messages] ";
 var summarizeHarnessMessages = (messages, maxCharacters = 4000) => {
   const redaction = createRedactionPolicy3({ includeEmails: true });
   const clean = (text, limit = 512) => redaction.redactText(text).replace(/\bBearer\s+\S+/gi, "Bearer [REDACTED]").replace(/\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)|api[_-]?key|access[_-]?token|password)\s*([=:])\s*(?:"[^"]*"|'[^']*'|\S+)/gi, "$1$2[REDACTED]").replace(/\b(?:sk|ghp|gho|github_pat)-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(/\s+/g, " ").trim().slice(0, limit);
@@ -5004,6 +5005,12 @@ var summarizeHarnessMessages = (messages, maxCharacters = 4000) => {
       omitted = true;
     }
   };
+  const markRecentEarlier = () => {
+    const marked = recent.map((value) => value.startsWith(EARLIER) ? value : `${EARLIER}${value}`);
+    recent.length = 0;
+    for (const value of marked)
+      add(recent, value, 4);
+  };
   const rememberObservation = (tool2, detail) => {
     if (typeof tool2 !== "string" || !LOCAL_TOOLS.has(tool2) || typeof detail !== "string")
       return;
@@ -5121,6 +5128,7 @@ var summarizeHarnessMessages = (messages, maxCharacters = 4000) => {
           objective = text;
           if (historicalObjective)
             add(steering, text, MAX_USER_STEERING);
+          markRecentEarlier();
         } else
           add(recent, `${message.role}: ${text}`, 4);
       } else if (part.type === "tool-call") {

package/dist/{cli-vyrytn3m.js → cli-yxvq8qf1.js}

@@ -61,11 +61,11 @@ import {
   withTemporaryHarnessProfiles,
   workspaceCheckpointSchema,
   workspaceRestoreOperationSchema
-} from "./cli-entry-h2yc9x37.js";
+} from "./cli-entry-rsx0wpvs.js";
 import {
   exportHarnessGovernanceReport,
   renderHarnessGovernanceMarkdown
-} from "./cli-entry-75j3r49b.js";
+} from "./cli-entry-1epvek01.js";
 import {
   BUDGET_LEDGER_NAMESPACE,
   BUDGET_OWNER_NAMESPACE_KEY,
@@ -125,14 +125,14 @@ import {
   updateCliProfile,
   validateStateDirectory,
   verifyChangeEnvelope
-} from "./cli-entry-928p8h41.js";
+} from "./cli-entry-nyzyvf24.js";
 import {
   BUN_ENGINE_RANGE,
   HARNESS_VERSION,
   NODE_ENGINE_RANGE,
   formatCliHelp,
   shortCliHelp
-} from "./cli-entry-q8bgkn9m.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_SUBAGENT_PROFILES,
@@ -4091,7 +4091,7 @@ var main = async (argv = process.argv.slice(2)) => {
     parsedOptions = { ...parsedOptions, prompt: await readStdinTask() };
   }
   if (parsedOptions.serviceFile) {
-    const { runServiceCli } = await import("./service-client-cli-v6qptg9x.js");
+    const { runServiceCli } = await import("./service-client-cli-xbj7j5kj.js");
     await runServiceCli(parsedOptions, annotateCliStreamError);
     return;
   }
@@ -4156,7 +4156,7 @@ var main = async (argv = process.argv.slice(2)) => {
       return;
     case "export-audit":
     case "verify-audit": {
-      const { auditPackCli } = await import("./audit-pack-kvw7ng34.js");
+      const { auditPackCli } = await import("./audit-pack-s9n693by.js");
       await auditPackCli(options);
       return;
     }

package/dist/cli.js

@@ -3,7 +3,7 @@ import {
   HARNESS_VERSION,
   NODE_ENGINE_RANGE,
   shortCliHelp
-} from "./cli-entry-q8bgkn9m.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   __require
 } from "./cli-entry-1bx83sw4.js";
@@ -41,6 +41,6 @@ if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${shortCliHelp(HARNESS_VERSION)}
 `);
 } else {
-  const { runCli } = await import("./cli-vyrytn3m.js");
+  const { runCli } = await import("./cli-yxvq8qf1.js");
   await runCli(argv);
 }