@brainbase-labs/cli 0.25.0-eng1209.4 → 0.25.0-eng1209.6

package/dist/index.js

@@ -36008,7 +36008,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.25.0-eng1209.4",
+  version: "0.25.0-eng1209.6",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -78882,6 +78882,19 @@ class BenchmarkPhaseError extends Error {
     this.name = "BenchmarkPhaseError";
   }
 }
+
+class BenchmarkCommandExecutionError extends BenchmarkPhaseError {
+  stdout;
+  stderr;
+  durationMs;
+  constructor(code, message, stdout, stderr, durationMs) {
+    super(code, message);
+    this.stdout = stdout;
+    this.stderr = stderr;
+    this.durationMs = durationMs;
+    this.name = "BenchmarkCommandExecutionError";
+  }
+}
 var ZIP_EOCD_SIGNATURE = 101010256;
 var ZIP_CENTRAL_SIGNATURE = 33639248;
 var ZIP_LOCAL_SIGNATURE = 67324752;
@@ -79985,7 +79998,8 @@ async function runCommand(command, root, spec, context, additions = {}) {
   const remainingMs = context.deadline - Date.now();
   if (remainingMs <= 0)
     throw new BenchmarkPhaseError("phase_timeout", "phase budget expired");
-  const timeoutMs2 = Math.min(command.timeout_ms ?? remainingMs, remainingMs);
+  const reachesPhaseDeadline = command.timeout_ms === undefined || command.timeout_ms >= remainingMs;
+  const timeoutMs2 = reachesPhaseDeadline ? remainingMs : command.timeout_ms;
   const started = Date.now();
   return await new Promise((resolve, reject2) => {
     const child = spawn4(command.argv[0], command.argv.slice(1), {
@@ -80022,10 +80036,14 @@ async function runCommand(command, root, spec, context, additions = {}) {
     child.stdout?.on("data", (chunk2) => capture(stdout, chunk2));
     child.stderr?.on("data", (chunk2) => capture(stderr, chunk2));
     child.on("error", (error2) => {
-      fail(new BenchmarkPhaseError("command_start_failed", `failed to start ${command.id}: ${error2.message}`));
+      fail(new BenchmarkCommandExecutionError("command_start_failed", `failed to start ${command.id}: ${error2.message}`, Buffer.concat(stdout), Buffer.concat(stderr), Date.now() - started));
     });
     timer = setTimeout(() => {
-      fail(new BenchmarkPhaseError("command_timeout", `command timed out: ${command.id}`));
+      if (reachesPhaseDeadline) {
+        fail(new BenchmarkPhaseError("phase_timeout", "phase budget expired"));
+        return;
+      }
+      fail(new BenchmarkCommandExecutionError("command_timeout", `command timed out: ${command.id}`, Buffer.concat(stdout), Buffer.concat(stderr), Date.now() - started));
     }, timeoutMs2);
     child.on("close", (code, signal) => {
       if (settled)
@@ -80033,7 +80051,7 @@ async function runCommand(command, root, spec, context, additions = {}) {
       settled = true;
       clearTimeout(timer);
       if (code === null) {
-        reject2(new BenchmarkPhaseError("command_terminated", `command was terminated by ${signal ?? "an unknown signal"}: ${command.id}`));
+        reject2(new BenchmarkCommandExecutionError("command_terminated", `command was terminated by ${signal ?? "an unknown signal"}: ${command.id}`, Buffer.concat(stdout), Buffer.concat(stderr), Date.now() - started));
         return;
       }
       resolve({
@@ -80234,6 +80252,42 @@ async function workspaceManifest(spec, context) {
   }
   return records.sort((a3, b4) => a3.path.localeCompare(b4.path));
 }
+function treeBytes(root, context) {
+  let totalBytes = 0;
+  const stack = [path88.resolve(root)];
+  while (stack.length > 0) {
+    const directory = stack.pop();
+    const entries = fs81.readdirSync(directory, { withFileTypes: true });
+    for (const entry of entries) {
+      assertBudget(context);
+      const candidate = path88.join(directory, entry.name);
+      const stat = fs81.lstatSync(candidate);
+      if (stat.isDirectory()) {
+        stack.push(candidate);
+        continue;
+      }
+      if (stat.isFile()) {
+        totalBytes += stat.size;
+        continue;
+      }
+      if (stat.isSymbolicLink()) {
+        totalBytes += Buffer.byteLength(fs81.readlinkSync(candidate));
+        continue;
+      }
+      throw new BenchmarkPhaseError("unsafe_path", `evaluate output contains an unsupported filesystem entry: ${path88.relative(root, candidate)}`);
+    }
+  }
+  return totalBytes;
+}
+function assertEvaluateOutputBudget(spec, context, additionalBytes = 0) {
+  const actual = treeBytes(spec.logs_root, context) + additionalBytes;
+  if (actual > spec.workspace_limits.max_total_bytes) {
+    throw new BenchmarkPhaseError("workspace_limit_exceeded", "evaluate output bytes exceed the workspace byte limit", {
+      actual,
+      max_total_bytes: spec.workspace_limits.max_total_bytes
+    });
+  }
+}
 function candidateGlob(pattern) {
   let source = "^";
   for (let index = 0;index < pattern.length; index += 1) {
@@ -80392,13 +80446,48 @@ async function copyFrozenWorkspace(manifest, spec, context) {
   }
   return destinationRoot;
 }
-function evaluatorTestsPath(evaluator, spec) {
+async function copyEvaluatorTests(spec, context) {
+  const destinationRoot = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-tests-"));
+  fs81.chmodSync(destinationRoot, 448);
+  context.temporaryRoots.add(destinationRoot);
+  const stack = [{ source: spec.tests_root, destination: destinationRoot }];
+  while (stack.length > 0) {
+    assertBudget(context);
+    const current = stack.pop();
+    const entries = fs81.readdirSync(current.source, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+    for (const entry of entries) {
+      assertBudget(context);
+      const source = path88.join(current.source, entry.name);
+      const destination = path88.join(current.destination, entry.name);
+      const stat = fs81.lstatSync(source);
+      if (stat.isSymbolicLink()) {
+        throw new BenchmarkPhaseError("unsafe_path", `evaluator reference tree contains a symlink: ${path88.relative(spec.tests_root, source)}`);
+      }
+      if (stat.isDirectory()) {
+        fs81.mkdirSync(destination, { recursive: true, mode: stat.mode & 511 });
+        stack.push({ source, destination });
+        continue;
+      }
+      if (!stat.isFile()) {
+        throw new BenchmarkPhaseError("unsafe_path", `evaluator reference tree contains an unsupported filesystem entry: ${path88.relative(spec.tests_root, source)}`);
+      }
+      await atomicCopy(source, destination, stat.mode & 511, spec.tests_root);
+      const sourceRecord = await recordFile(spec.tests_root, source, "tests");
+      const copiedRecord = await recordFile(destinationRoot, destination, "tests");
+      if (copiedRecord.path !== sourceRecord.path || copiedRecord.sha256 !== sourceRecord.sha256 || copiedRecord.size !== sourceRecord.size || copiedRecord.mode !== sourceRecord.mode) {
+        throw new BenchmarkPhaseError("evidence_tampered", `evaluator reference changed while it was copied: ${sourceRecord.path}`);
+      }
+    }
+  }
+  return destinationRoot;
+}
+function evaluatorTestsPath(evaluator, testsRoot) {
   if (!evaluator.tests_path)
-    return spec.tests_root;
+    return testsRoot;
   const relative = normalizedRootRelative(evaluator.tests_path);
-  assertNoSymlinkTraversal(spec.tests_root, relative);
-  const candidate = path88.resolve(spec.tests_root, relative);
-  if (!isWithin(spec.tests_root, candidate) || !fs81.existsSync(candidate)) {
+  assertNoSymlinkTraversal(testsRoot, relative);
+  const candidate = path88.resolve(testsRoot, relative);
+  if (!isWithin(testsRoot, candidate) || !fs81.existsSync(candidate)) {
     throw new BenchmarkPhaseError("invalid_tests_path", `evaluator tests_path does not exist: ${evaluator.tests_path}`);
   }
   const stat = fs81.lstatSync(candidate);
@@ -80623,12 +80712,14 @@ async function evaluateOne(evaluator, spec, manifest, finalOutput, trajectory, f
     };
   }
   let isolatedWorkspace;
+  let isolatedTestsRoot;
   let privateResultRoot;
   try {
     const evaluatorWorkspace = await copyFrozenWorkspace(manifest, spec, context);
     isolatedWorkspace = evaluatorWorkspace;
-    const testsPath = evaluatorTestsPath(evaluator, spec);
-    const commandRoot = evaluator.root === "workspace" ? evaluatorWorkspace : spec.tests_root;
+    isolatedTestsRoot = await copyEvaluatorTests(spec, context);
+    const testsPath = evaluatorTestsPath(evaluator, isolatedTestsRoot);
+    const commandRoot = evaluator.root === "workspace" ? evaluatorWorkspace : isolatedTestsRoot;
     const command = { id: evaluator.id, ...evaluator.command };
     const environment = {
       BRAINBASE_BENCHMARK_WORKSPACE: evaluatorWorkspace,
@@ -80679,7 +80770,7 @@ async function evaluateOne(evaluator, spec, manifest, finalOutput, trajectory, f
       ...criterionResults ? { criterion_results: criterionResults } : {}
     };
   } finally {
-    for (const temporary of [privateResultRoot, isolatedWorkspace]) {
+    for (const temporary of [privateResultRoot, isolatedTestsRoot, isolatedWorkspace]) {
       if (!temporary)
         continue;
       fs81.rmSync(temporary, { recursive: true, force: true });
@@ -80728,6 +80819,7 @@ async function executeEvaluate(spec, context) {
   ];
   outputs.push(...frozenEvidenceRecords);
   context.outputs.push(...frozenEvidenceRecords);
+  assertEvaluateOutputBudget(spec, context);
   assertBudget(context);
   const manifest = await workspaceManifest(spec, context);
   const manifestPath2 = path88.join(spec.logs_root, "candidate-workspace-manifest.json");
@@ -80740,6 +80832,7 @@ async function executeEvaluate(spec, context) {
   const manifestRecord = await recordFile(spec.logs_root, manifestPath2, "logs");
   outputs.push(manifestRecord);
   context.outputs.push(manifestRecord);
+  assertEvaluateOutputBudget(spec, context);
   for (const artifactRelInput of spec.candidate_artifacts) {
     const artifactRel = workspaceRel(artifactRelInput);
     assertNoSymlinkTraversal(spec.workspace_root, artifactRel);
@@ -80757,11 +80850,13 @@ async function executeEvaluate(spec, context) {
     outputs.push(artifact);
     context.outputs.push(artifact);
   }
+  assertEvaluateOutputBudget(spec, context);
   for (const candidateOutput of spec.candidate_outputs) {
     const copied = await copyCandidateOutput(candidateOutput, manifest, spec, context);
     outputs.push(...copied);
     context.outputs.push(...copied);
   }
+  assertEvaluateOutputBudget(spec, context);
   if (spec.capture_workspace_archive) {
     const regularFiles = manifest.filter((entry) => entry.kind !== "symlink").map((entry) => entry.path);
     const archive = path88.join(spec.logs_root, "candidate-workspace.tar.gz");
@@ -80775,6 +80870,7 @@ async function executeEvaluate(spec, context) {
     const archiveRecord = await recordFile(spec.logs_root, archive, "logs");
     outputs.push(archiveRecord);
     context.outputs.push(archiveRecord);
+    assertEvaluateOutputBudget(spec, context);
   }
   await verifyRecordsUnchanged(manifest, spec);
   for (const reference of spec.references) {
@@ -80789,7 +80885,6 @@ async function executeEvaluate(spec, context) {
   for (const evaluator of executionOrder) {
     assertBudget(context);
     const started = Date.now();
-    let requiredResultError;
     try {
       const evaluated = await evaluateOne(evaluator, spec, manifest, finalOutput.buffer.toString("utf8"), trajectory, { finalOutputPath, trajectoryPath }, context);
       assertBudget(context);
@@ -80803,13 +80898,14 @@ async function executeEvaluate(spec, context) {
         outputs.push(evaluated.stderr);
         context.outputs.push(evaluated.stderr);
       }
-      if (evaluated.status === "errored" && evaluator.required) {
-        const errorCode = typeof evaluated.details?.error_code === "string" ? evaluated.details.error_code : "evaluator_execution_failed";
-        const errorMessage2 = typeof evaluated.details?.error_message === "string" ? evaluated.details.error_message : "required evaluator execution failed";
-        requiredResultError = new BenchmarkPhaseError(errorCode, errorMessage2);
-      }
     } catch (error2) {
       const normalized = stableError(error2);
+      let stdout;
+      let stderr;
+      if (error2 instanceof BenchmarkCommandExecutionError) {
+        stdout = await writeLog(spec.logs_root, `${evaluator.id}.stdout.log`, error2.stdout, spec);
+        stderr = await writeLog(spec.logs_root, `${evaluator.id}.stderr.log`, error2.stderr, spec);
+      }
       const errored = {
         id: evaluator.id,
         type: evaluator.type,
@@ -80819,26 +80915,38 @@ async function executeEvaluate(spec, context) {
         verdict: null,
         engine: "brainbase-cli",
         engine_version: VERSION,
-        duration_ms: Date.now() - started,
+        duration_ms: error2 instanceof BenchmarkCommandExecutionError ? error2.durationMs : Date.now() - started,
         details: {
           error_code: normalized?.code ?? "phase_failed",
           error_message: normalized?.message ?? "evaluator execution failed"
-        }
+        },
+        ...stdout ? { stdout } : {},
+        ...stderr ? { stderr } : {}
       };
       evaluators.push(errored);
       context.evaluators.push(errored);
-      if (evaluator.required)
+      if (stdout) {
+        outputs.push(stdout);
+        context.outputs.push(stdout);
+      }
+      if (stderr) {
+        outputs.push(stderr);
+        context.outputs.push(stderr);
+      }
+      if (!(error2 instanceof BenchmarkCommandExecutionError))
         throw error2;
       assertBudget(context);
     }
-    if (requiredResultError)
-      throw requiredResultError;
+    if (evaluator.type === "sandbox_command") {
+      assertEvaluateOutputBudget(spec, context);
+    }
   }
   await verifyRecordsUnchanged([...context.inputs, ...context.outputs.slice(0, frozenOutputCount)], spec);
   if (!verifyOwnedDirectory(spec.tests_root, "tests", spec) || !verifyOwnedDirectory(spec.logs_root, "logs", spec)) {
     throw new BenchmarkPhaseError("evidence_tampered", "benchmark evaluator changed an owned phase directory marker");
   }
   assertBudget(context);
+  assertEvaluateOutputBudget(spec, context);
   evaluators.sort((left, right) => evaluatorOrder.get(left.id) - evaluatorOrder.get(right.id));
   return { outputs, evaluators };
 }
@@ -81024,6 +81132,7 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
   let status = "failed";
   let error2;
   let context;
+  let validatedSpec;
   let resultPathValidated = false;
   try {
     let bytes;
@@ -81043,6 +81152,7 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
     }
     identity2 = rawIdentity(raw);
     const spec = BenchmarkSpecSchema.parse(raw);
+    validatedSpec = spec;
     if (expectedPhase && spec.phase !== expectedPhase) {
       throw new BenchmarkPhaseError("phase_mismatch", `the ${expectedPhase} command cannot execute a ${spec.phase} spec`);
     }
@@ -81122,6 +81232,17 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
   if (!resultPathValidated || !context?.logsOwned) {
     return { exitCode: status === "succeeded" ? 0 : 1, result: result2 };
   }
+  if (status === "succeeded" && validatedSpec?.phase === "evaluate") {
+    try {
+      const resultBytes = Buffer.byteLength(`${JSON.stringify(result2, null, 2)}
+`);
+      assertEvaluateOutputBudget(validatedSpec, context, resultBytes);
+    } catch (budgetError) {
+      status = "failed";
+      result2.status = "failed";
+      result2.error = stableError(budgetError);
+    }
+  }
   try {
     writeJsonAtomic(resultPath, result2);
   } catch (writeError) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainbase-labs/cli",
-  "version": "0.25.0-eng1209.4",
+  "version": "0.25.0-eng1209.6",
   "description": "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   "type": "module",
   "bin": {