@malmhq/intermesh-cli 0.1.0

package/dist/runtime/candidate-inspection/inspect.Dockerfile

@@ -0,0 +1,4 @@
+FROM node:22.23.2-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5
+RUN useradd --uid 10001 --create-home evaluator
+USER 10001:10001
+WORKDIR /work

package/dist/runtime/candidate-inspection/install.Dockerfile

@@ -0,0 +1,5 @@
+FROM node:22.23.2-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5
+RUN useradd --uid 10001 --create-home evaluator
+USER 10001:10001
+WORKDIR /work
+ENTRYPOINT ["npm"]

package/dist/runtime/candidate-inspection/registry-proxy.mjs

@@ -0,0 +1,37 @@
+import { createServer } from 'node:http';
+import { request } from 'node:https';
+
+const maximumBytes = 64 * 1024 * 1024;
+createServer((incoming, response) => {
+  if (!['GET', 'HEAD'].includes(incoming.method ?? '') || incoming.headers.authorization) {
+    response.writeHead(403).end();
+    return;
+  }
+  const target = new URL(incoming.url ?? '/', 'https://registry.npmjs.org');
+  if (target.origin !== 'https://registry.npmjs.org') {
+    response.writeHead(403).end();
+    return;
+  }
+  const outgoing = request(
+    target,
+    { method: incoming.method, headers: { accept: incoming.headers.accept ?? '*/*' } },
+    (upstream) => {
+      if ((upstream.statusCode ?? 500) >= 300 && (upstream.statusCode ?? 500) < 400) {
+        upstream.resume();
+        response.writeHead(502).end();
+        return;
+      }
+      let bytes = 0;
+      response.writeHead(upstream.statusCode ?? 502, upstream.headers);
+      upstream.on('data', (chunk) => {
+        bytes += chunk.length;
+        if (bytes > maximumBytes) upstream.destroy(new Error('response too large'));
+        else response.write(chunk);
+      });
+      upstream.on('end', () => response.end());
+      upstream.on('error', () => response.destroy());
+    },
+  );
+  outgoing.on('error', () => response.writeHead(502).end());
+  outgoing.end();
+}).listen(Number(process.env.PORT ?? '4873'), '0.0.0.0');

package/dist/runtime/harbor/bootstrap/package-lock.json

@@ -0,0 +1,402 @@
+{
+  "name": "intermesh-opencode-bootstrap",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "intermesh-opencode-bootstrap",
+      "dependencies": {
+        "@opencode-ai/plugin": "1.18.25"
+      }
+    },
+    "node_modules/@ai-sdk/provider": {
+      "version": "3.0.8",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-3.0.8.tgz",
+      "integrity": "sha512-oGMAgGoQdBXbZqNG0Ze56CHjDZ1IDYOwGYxYjO5KLSlz5HiNQ9udIXsPZ61VWaHGZ5XW/jyjmr6t2xz2jGVwbQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "json-schema": "^0.4.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-arm64": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-arm64/-/msgpackr-extract-darwin-arm64-3.0.4.tgz",
+      "integrity": "sha512-LCkGo6JDfaBhgST7UpPWgNgLINpcpabaHfyz5OBx75nUYxBsaEPxjnyNjWpeb/xBup/682QnBfRBy2/LvPutZQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-x64": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-x64/-/msgpackr-extract-darwin-x64-3.0.4.tgz",
+      "integrity": "sha512-zExlW9zUJKZH/tOtVMttwjKa4Xm/3KcNjnE3dPN92uCktwavMxpgCA3MoJK/DOnTWsQgo224OaST27/mPNAf+w==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm/-/msgpackr-extract-linux-arm-3.0.4.tgz",
+      "integrity": "sha512-Tg3yX65f5GbtXLkrYEHE5oibZG9epyYWas7FogTTEJeDEF9JlXJzKgXaNhT3UXlTOeA+AfZpYZYZ0uPj7Cfquw==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm64": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm64/-/msgpackr-extract-linux-arm64-3.0.4.tgz",
+      "integrity": "sha512-dgX0P/9wGPJeHFBG+ZmhgE6bmtMt7NP5CRBGyyktpopdk/mW4POnrpQsSLtKI1dwpc+pPLuXHDh6vvskyQE/sw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-linux-x64": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-x64/-/msgpackr-extract-linux-x64-3.0.4.tgz",
+      "integrity": "sha512-8TNXMEjJc3QEy7R/x1INhgiU+XakDAFUzBhaz7+Rbrs8NH5UQeHQxxmzsSBJGyV6I1jW79undiQm8tOI+D+8FQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-win32-x64": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-win32-x64/-/msgpackr-extract-win32-x64-3.0.4.tgz",
+      "integrity": "sha512-CmCXPQrkbwExx3j946/PtHWHbYJiCRBRDl4BlkRQcJB/YOwQxJRTpoo7aTsortjgoJ1x7opzTSxn7C+ASSLVjQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@opencode-ai/plugin": {
+      "version": "1.18.25",
+      "resolved": "https://registry.npmjs.org/@opencode-ai/plugin/-/plugin-1.18.25.tgz",
+      "integrity": "sha512-Kb34zFqYosFNiMd1IuYiZGjX17z+18Srm7tHZMCz+uMVRTYNkEw1FTrfAK2FLbggwYdgzifGwKMNF1slLT8eLw==",
+      "license": "MIT",
+      "dependencies": {
+        "@ai-sdk/provider": "3.0.8",
+        "@opencode-ai/sdk": "1.18.25",
+        "effect": "4.0.0-beta.83",
+        "zod": "4.1.8"
+      },
+      "peerDependencies": {
+        "@opentui/core": ">=0.4.5",
+        "@opentui/keymap": ">=0.4.5",
+        "@opentui/solid": ">=0.4.5"
+      },
+      "peerDependenciesMeta": {
+        "@opentui/core": {
+          "optional": true
+        },
+        "@opentui/keymap": {
+          "optional": true
+        },
+        "@opentui/solid": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@opencode-ai/sdk": {
+      "version": "1.18.25",
+      "resolved": "https://registry.npmjs.org/@opencode-ai/sdk/-/sdk-1.18.25.tgz",
+      "integrity": "sha512-GwgwhW+vE8FWSDw730SjzqNhsWXB0uJjbFOiqFkmM+USFuG13HuTlGe6SR2ixt+WXxoD6FV1hILWqsXyqej9hQ==",
+      "license": "MIT",
+      "dependencies": {
+        "cross-spawn": "7.0.6"
+      }
+    },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "license": "MIT"
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/effect": {
+      "version": "4.0.0-beta.83",
+      "resolved": "https://registry.npmjs.org/effect/-/effect-4.0.0-beta.83.tgz",
+      "integrity": "sha512-0wsak8RtgGAr9UWSbVDgJHZcUqMSvicHcvaZv1MbMM7MCGgW4Rn/137J1MHQbwYPcwYGxT/IqehFd+UbYuj78w==",
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.1.0",
+        "fast-check": "^4.8.0",
+        "find-my-way-ts": "^0.1.6",
+        "ini": "^7.0.0",
+        "kubernetes-types": "^1.30.0",
+        "msgpackr": "^2.0.1",
+        "multipasta": "^0.2.7",
+        "toml": "^4.1.1",
+        "uuid": "^14.0.0",
+        "yaml": "^2.9.0"
+      }
+    },
+    "node_modules/fast-check": {
+      "version": "4.9.0",
+      "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-4.9.0.tgz",
+      "integrity": "sha512-7ms6T7SybUev/PQITciI0yLM2pOSFy5zpG8Ty7tQofcVaQUvrMXp6CBwqF6fThLCLOrfBtuHAtwq6Yu4XPCllg==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "pure-rand": "^8.0.0"
+      },
+      "engines": {
+        "node": ">=12.17.0"
+      }
+    },
+    "node_modules/find-my-way-ts": {
+      "version": "0.1.6",
+      "resolved": "https://registry.npmjs.org/find-my-way-ts/-/find-my-way-ts-0.1.6.tgz",
+      "integrity": "sha512-a85L9ZoXtNAey3Y6Z+eBWW658kO/MwR7zIafkIUPUMf3isZG0NCs2pjW2wtjxAKuJPxMAsHUIP4ZPGv0o5gyTA==",
+      "license": "MIT"
+    },
+    "node_modules/ini": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-7.0.0.tgz",
+      "integrity": "sha512-ifK0CgjALofS5bkrcTy4RaQ9Vx2Knf/eLeIO+NaswQEpH1UblrtTSCIvN71qQDMq0PeQ/SSPojvEJp9vvvfr+w==",
+      "license": "ISC",
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "license": "ISC"
+    },
+    "node_modules/json-schema": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/json-schema/-/json-schema-0.4.0.tgz",
+      "integrity": "sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==",
+      "license": "(AFL-2.1 OR BSD-3-Clause)"
+    },
+    "node_modules/kubernetes-types": {
+      "version": "1.30.0",
+      "resolved": "https://registry.npmjs.org/kubernetes-types/-/kubernetes-types-1.30.0.tgz",
+      "integrity": "sha512-Dew1okvhM/SQcIa2rcgujNndZwU8VnSapDgdxlYoB84ZlpAD43U6KLAFqYo17ykSFGHNPrg0qry0bP+GJd9v7Q==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/msgpackr": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-2.1.0.tgz",
+      "integrity": "sha512-p/pBCVO63CsvvpkomUnNNag6+n38rULuDA6HHe70o2gtC8ODI52foF/4ko2qQcp6OiErJXTmrZeXmsGGHsIQNQ==",
+      "license": "MIT",
+      "optionalDependencies": {
+        "msgpackr-extract": "^3.0.4"
+      }
+    },
+    "node_modules/msgpackr-extract": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/msgpackr-extract/-/msgpackr-extract-3.0.4.tgz",
+      "integrity": "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "node-gyp-build-optional-packages": "5.2.2"
+      },
+      "bin": {
+        "download-msgpackr-prebuilds": "bin/download-prebuilds.js"
+      },
+      "optionalDependencies": {
+        "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.4"
+      }
+    },
+    "node_modules/multipasta": {
+      "version": "0.2.8",
+      "resolved": "https://registry.npmjs.org/multipasta/-/multipasta-0.2.8.tgz",
+      "integrity": "sha512-ZPWuMKyv0cSO29f7hozp+k6+crZbQijV8ipMvxNxRf2SwtYGTX1ZX89Kd20VV4H9Znonx+EQn+iy1wGQsJ+b+Q==",
+      "license": "MIT"
+    },
+    "node_modules/node-gyp-build-optional-packages": {
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/node-gyp-build-optional-packages/-/node-gyp-build-optional-packages-5.2.2.tgz",
+      "integrity": "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "detect-libc": "^2.0.1"
+      },
+      "bin": {
+        "node-gyp-build-optional-packages": "bin.js",
+        "node-gyp-build-optional-packages-optional": "optional.js",
+        "node-gyp-build-optional-packages-test": "build-test.js"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/pure-rand": {
+      "version": "8.4.2",
+      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-8.4.2.tgz",
+      "integrity": "sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/toml": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/toml/-/toml-4.3.0.tgz",
+      "integrity": "sha512-lVb8X9BsPVuH0M4BKeS91tXAmJvCjQ5UIyAbQFaxkKGyUFK2RPkhwaFSQH8vbpl1d23eu/IBH+dwVMHWaq9A5A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/uuid": {
+      "version": "14.0.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz",
+      "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist-node/bin/uuid"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/yaml": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
+    "node_modules/zod": {
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.1.8.tgz",
+      "integrity": "sha512-5R1P+WwQqmmMIEACyzSvo4JXHY5WiAFHRMg+zBZKgKS+Q1viRa0C1hmUKtHltoIFKtIdki3pRxkmpP74jnNYHQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
+  }
+}

package/dist/runtime/harbor/bootstrap/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "intermesh-opencode-bootstrap",
+  "private": true,
+  "dependencies": {
+    "@opencode-ai/plugin": "1.18.25"
+  }
+}

package/dist/runtime/harbor/evaluation.Dockerfile

@@ -0,0 +1,31 @@
+FROM node:22.23.2-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5
+
+RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates git ripgrep \
+    && rm -rf /var/lib/apt/lists/* \
+    && npm install --global --ignore-scripts --no-audit --no-fund opencode-ai@1.18.25 \
+    && cd "$(npm root --global)/opencode-ai" \
+    && node postinstall.mjs \
+    && test "$(opencode --version)" = 1.18.25
+
+COPY candidate.tgz /opt/candidate/candidate.tgz
+RUN cd /opt/candidate && npm install --ignore-scripts --omit=dev --no-audit --no-fund ./candidate.tgz \
+    && chmod -R a-w /opt/candidate
+
+COPY bootstrap/ /home/node/.config/opencode/
+RUN cd /home/node/.config/opencode && npm ci --ignore-scripts --no-audit --no-fund \
+    && mkdir -p /workspace/outputs /installed-agent /home/node/.cache \
+    && chown -R node:node /workspace /home/node/.config
+ARG CANDIDATE_PACKAGE
+COPY candidate-skills/ /home/node/.config/opencode/skills/
+RUN touch /home/node/.config/opencode/opencode.json
+
+ENV PATH="/opt/candidate/node_modules/.bin:${PATH}"
+ENV SHELL=/bin/bash
+ENV XDG_DATA_HOME="/tmp/opencode/data"
+ENV XDG_CACHE_HOME="/home/node/.cache"
+ENV XDG_STATE_HOME="/tmp/opencode/state"
+ENV XDG_CONFIG_HOME="/home/node/.config"
+ENV OPENCODE_DISABLE_AUTOUPDATE=true
+ENV OPENCODE_DISABLE_CLAUDE_CODE=true
+USER node
+WORKDIR /workspace/outputs

package/dist/runtime/harbor/harbor_launcher.py

@@ -0,0 +1,62 @@
+import asyncio
+import json
+import signal
+import sys
+from importlib.metadata import version
+from pathlib import Path
+
+from harbor import Job
+from harbor.models.job.config import JobConfig
+from harbor.trial.hooks import TrialEvent
+
+async def main():
+    """Run one pinned Harbor job and retain trial mappings and progress without another scheduler."""
+    if version("harbor") != "0.22.0":
+        raise RuntimeError("Evaluation requires Harbor 0.22.0")
+    config = json.loads(Path(sys.argv[1]).read_text())
+    job_config = JobConfig.model_validate(config["job"])
+    job = await Job.create(job_config)
+    if config.get("mapping_path"):
+        counters = {}
+        slots = []
+        # The pinned Job creates all trial names before dispatch; keep this private API use here.
+        for trial in job._trial_configs:
+            task_path = str(trial.task.path)
+            counters[task_path] = counters.get(task_path, 0) + 1
+            slots.append({"task_path": task_path, "repetition": counters[task_path], "trial_name": trial.trial_name})
+        Path(config["mapping_path"]).write_text(json.dumps(slots) + "\n")
+
+    async def progress(event):
+        """Persist lifecycle facts only; raw agent output stays in Harbor's evidence files."""
+        if not config.get("progress_path"):
+            return
+        record = {"event": event.event.value, "task_path": str(event.config.task.path), "trial_name": event.trial_name, "trial_id": str(event.trial_id), "timestamp": event.timestamp.isoformat()}
+        with Path(config["progress_path"]).open("a") as output:
+            output.write(json.dumps(record) + "\n")
+            output.flush()
+        print(json.dumps(record), flush=True)
+        failure = event.result.exception_info
+        if event.event == TrialEvent.END and failure and (
+            event.result.agent_execution is None
+            or failure.exception_type in {"EvaluationSafetyError", "AgentAuthenticationError", "ApiRateLimitError", "AgentSetupTimeoutError", "EnvironmentStartTimeoutError"}
+        ):
+            Path(config["progress_path"]).with_name("stop-reason.json").write_text(
+                json.dumps({"stage": "safety" if failure.exception_type == "EvaluationSafetyError" else "infrastructure", "cause": failure.exception_type}) + "\n"
+            )
+            running.cancel()
+
+    for event in TrialEvent:
+        job.add_hook(event, progress)
+    running = asyncio.create_task(job.run())
+    loop = asyncio.get_running_loop()
+    for name in (signal.SIGINT, signal.SIGTERM):
+        loop.add_signal_handler(name, running.cancel)
+    try:
+        result = await running
+        Path(config["result_path"]).write_text(result.model_dump_json(indent=2) + "\n")
+    finally:
+        for name in (signal.SIGINT, signal.SIGTERM):
+            loop.remove_signal_handler(name)
+
+
+asyncio.run(main())

package/dist/runtime/harbor/intermesh_opencode.py

@@ -0,0 +1,44 @@
+import json
+import os
+from urllib.parse import quote
+
+from harbor.agents.installed.opencode import OpenCode
+
+
+class EvaluationSafetyError(RuntimeError):
+    """A supplied credential appeared in streamed agent output."""
+
+
+class IntermeshOpenCode(OpenCode):
+    async def run(self, instruction, environment, context):
+        """Stop on observed credential leakage; missing or bypassed output is not proof of safety."""
+        keys = [os.environ.get("INTERMESH_MODEL_CREDENTIAL", ""),
+                os.environ.get(os.environ.get("INTERMESH_CUSTOMER_CREDENTIAL_NAME", ""), "")]
+        forms = {value for key in keys if key for value in
+                 (key, json.dumps(key, ensure_ascii=False)[1:-1], quote(key, safe="~()*!.'-"))}
+        overlap = max(map(len, forms), default=1) - 1
+        tails = {}
+
+        async def check_output(text, stream):
+            """Keep only enough overlap to detect credentials split between chunks."""
+            combined = tails.get(stream, "") + text
+            if any(value in combined for value in forms):
+                raise EvaluationSafetyError("Credential leakage detected in agent output")
+            tails[stream] = combined[-overlap:] if overlap else ""
+
+        with environment.scoped_output_callback(check_output):
+            await super().run(instruction, environment, context)
+
+    def _build_register_config_command(self):
+        """Use the reviewed read-only config mounted by the task instead of rewriting the image."""
+        return None
+
+    async def install(self, environment):
+        """Verify the pinned agent without copying its read-only configuration or Skills."""
+        result = await self.exec_as_agent(
+            environment,
+            command='node --version && opencode --version',
+        )
+        versions = (result.stdout or "").strip().splitlines()
+        if result.return_code != 0 or versions != ["v22.23.2", "1.18.25"]:
+            raise RuntimeError("Prepared evaluation image has unexpected Node/OpenCode versions")

package/dist/runtime/harbor/model-forwarder.mjs

@@ -0,0 +1,52 @@
+import { createServer } from 'node:http';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+
+const key = process.env.DEEPSEEK_API_KEY;
+if (!key) throw new Error('Model forwarding credential is missing');
+
+/** Forward only bounded requests for the approved model; never expose the provider key or proxy arbitrary URLs. */
+async function forward(request, response) {
+  if (request.method !== 'POST' || request.url !== '/chat/completions') {
+    response.writeHead(403).end();
+    return;
+  }
+  const chunks = [];
+  let bytes = 0;
+  try {
+    for await (const chunk of request) {
+      bytes += chunk.length;
+      if (bytes > 4 * 1024 * 1024) {
+        response.writeHead(413).end();
+        return;
+      }
+      chunks.push(chunk);
+    }
+    const body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    if (body.model !== 'deepseek-v4-pro') {
+      response.writeHead(403).end();
+      return;
+    }
+    const controller = new AbortController();
+    response.once('close', () => controller.abort());
+    const upstream = await fetch('https://api.deepseek.com/chat/completions', {
+      method: 'POST',
+      headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+      signal: AbortSignal.any([controller.signal, AbortSignal.timeout(600_000)]),
+      redirect: 'error',
+    });
+    response.writeHead(upstream.status, {
+      'content-type': upstream.headers.get('content-type') ?? 'application/json',
+    });
+    if (upstream.body) await pipeline(Readable.fromWeb(upstream.body), response);
+    else response.end();
+  } catch {
+    if (!response.headersSent) response.writeHead(502);
+    response.end();
+  }
+}
+
+createServer((request, response) => {
+  void forward(request, response);
+}).listen(8787, '0.0.0.0');

package/dist/runtime/live-task.md

@@ -0,0 +1,13 @@
+# User task
+
+{{task}}
+
+## Approved inputs
+
+{{inputs}}
+
+## Approved access
+
+{{access}}
+
+Use the supplied CLI and Skills. Only approved read-only API actions and local output files are allowed. Report unavailable access or data; do not attempt remote writes.