@mcpjam/inspector 3.12.3 → 3.12.4

package/dist/server/index.js

@@ -35,7 +35,7 @@ import {
   supportsOwnershipProof,
   terminateOwnedProcess,
   terminateOwnedProcessGroup
-} from "./chunk-WGJHSGJP.js";
+} from "./chunk-5T6DFO27.js";
 import {
   ALLOWED_HOSTS,
   BROWSER_CONSENT_HEADER,
@@ -665,6 +665,7 @@ __export(canonical_exports, {
   CanonicalJsonError: () => CanonicalJsonError,
   canonicalDigest: () => canonicalDigest,
   canonicalJson: () => canonicalJson,
+  canonicalJsonBounded: () => canonicalJsonBounded,
   sha256Hex: () => sha256Hex
 });
 
@@ -1068,7 +1069,7 @@ var sha256 = /* @__PURE__ */ createHasher(
   /* @__PURE__ */ oidNist(1)
 );
 
-// ../evaluators/dist/chunk-26FTBHQO.js
+// ../evaluators/dist/chunk-3KMKYC6O.js
 var CanonicalJsonError = class extends Error {
   constructor(message) {
     super(message);
@@ -1137,6 +1138,118 @@ function write(value, ancestors) {
     ancestors.delete(value);
   }
 }
+var OVER_BUDGET = Symbol("canonicalJsonBounded.overBudget");
+var BoundedOutput = class {
+  constructor(maxChars) {
+    this.maxChars = maxChars;
+  }
+  parts = [];
+  length = 0;
+  /** Characters still available before the budget is exceeded. */
+  remaining() {
+    return this.maxChars - this.length;
+  }
+  push(text2) {
+    if (text2.length > this.remaining()) throw OVER_BUDGET;
+    this.parts.push(text2);
+    this.length += text2.length;
+  }
+  /**
+   * `JSON.stringify(text)` is at least `text.length + 2` characters, so a
+   * string that cannot fit is refused BEFORE it is escaped. Escaping a
+   * multi-megabyte argument only to throw the result away is the work the
+   * budget exists to avoid.
+   */
+  pushString(text2, suffix = "") {
+    if (text2.length + 2 + suffix.length > this.remaining()) throw OVER_BUDGET;
+    this.push(JSON.stringify(text2) + suffix);
+  }
+  toString() {
+    return this.parts.join("");
+  }
+};
+function canonicalJsonBounded(value, maxChars) {
+  if (value === void 0) {
+    return {
+      ok: false,
+      reason: "uncanonical",
+      message: "Cannot canonicalize `undefined` at the root"
+    };
+  }
+  const out = new BoundedOutput(maxChars);
+  try {
+    writeBounded(value, /* @__PURE__ */ new Set(), out);
+  } catch (error) {
+    if (error === OVER_BUDGET) return { ok: false, reason: "overBudget" };
+    return {
+      ok: false,
+      reason: "uncanonical",
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+  return { ok: true, json: out.toString() };
+}
+function writeBounded(value, ancestors, out) {
+  if (value === null) {
+    out.push("null");
+    return;
+  }
+  switch (typeof value) {
+    case "boolean":
+      out.push(value ? "true" : "false");
+      return;
+    case "number":
+      out.push(canonicalizeNumber(value));
+      return;
+    case "string":
+      out.pushString(value);
+      return;
+    case "object":
+      break;
+    default:
+      throw new CanonicalJsonError(
+        `Cannot canonicalize value of type ${typeof value}`
+      );
+  }
+  if (ancestors.has(value)) {
+    throw new CanonicalJsonError("Cannot canonicalize a circular structure");
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      out.push("[");
+      const length = value.length;
+      for (let index = 0; index < length; index += 1) {
+        if (index > 0) out.push(",");
+        const entry3 = value[index];
+        if (entry3 === void 0) out.push("null");
+        else writeBounded(entry3, ancestors, out);
+      }
+      out.push("]");
+      return;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new CanonicalJsonError(
+        "Cannot canonicalize a non-plain object (only plain objects, arrays and JSON primitives are part of the contract)"
+      );
+    }
+    const record5 = value;
+    out.push("{");
+    let first = true;
+    for (const key of Object.keys(record5).sort()) {
+      const entry3 = record5[key];
+      if (entry3 === void 0) continue;
+      if (!first) out.push(",");
+      first = false;
+      out.pushString(key, ":");
+      writeBounded(entry3, ancestors, out);
+    }
+    out.push("}");
+  } finally {
+    ancestors.delete(value);
+  }
+}
 function sha256Hex(text2) {
   return bytesToHex(sha256(utf8ToBytes(text2)));
 }
@@ -1164,7 +1277,8 @@ __export(types_exports2, {
   requiresRenderObservations: () => requiresRenderObservations
 });
 
-// ../evaluators/dist/chunk-KNZKSVHH.js
+// ../evaluators/dist/chunk-YDCS7DHF.js
+import { RE2JS } from "re2js";
 var MAX_RESPONSE_CLOSE_TO_CHARS = 1e5;
 var MAX_RESPONSE_CLOSE_TO_CELLS = 4e6;
 var RESPONSE_CLOSE_TO_IMPLEMENTATION = {
@@ -1218,8 +1332,283 @@ function normalizedResponseDistance(message, reference, options) {
   }
   return previous[columns.length] / denominator;
 }
-
-// ../evaluators/dist/chunk-WNWTCUC2.js
+var MAX_MATCH_PATTERNS = 8;
+var MAX_MATCH_PATTERN_CHARS = 512;
+var MIN_MATCH_PATH_CHARS = 2;
+var MAX_MATCH_PATH_CHARS = 257;
+var MATCH_PATH_PATTERN = /^\/(?:[^/~]|~[01])+$/;
+var MAX_MATCH_SUBJECT_CHARS = 1e5;
+var MAX_DISPLAYED_PATTERN_CHARS = 120;
+var MATCH_PATTERN_FLAGS = [
+  "i",
+  "m",
+  "s",
+  "im",
+  "is",
+  "ms",
+  "ims"
+];
+var TOOL_INPUT_MATCHES_IMPLEMENTATION = {
+  implementationVersion: 1,
+  engine: "re2js",
+  encoding: "canonical-json-bounded",
+  maxSubjectChars: MAX_MATCH_SUBJECT_CHARS
+};
+var TOOL_RESULT_MATCHES_IMPLEMENTATION = {
+  implementationVersion: 1,
+  engine: "re2js",
+  encoding: "canonical-json-bounded",
+  maxSubjectChars: MAX_MATCH_SUBJECT_CHARS,
+  subject: "text,structuredContent,json",
+  pathSource: "structuredContent,json"
+};
+function matchFlagBits(flags) {
+  let bits = 0;
+  if (flags?.includes("i")) bits |= RE2JS.CASE_INSENSITIVE;
+  if (flags?.includes("m")) bits |= RE2JS.MULTILINE;
+  if (flags?.includes("s")) bits |= RE2JS.DOTALL;
+  return bits;
+}
+function isMatchPatternFlags(flags) {
+  return flags === void 0 || MATCH_PATTERN_FLAGS.includes(flags);
+}
+function compileMatchPattern(pattern, flags) {
+  try {
+    const compiled = RE2JS.compile(
+      RE2JS.translateRegExp(pattern),
+      matchFlagBits(flags)
+    );
+    return { ok: true, compiled };
+  } catch (error) {
+    return {
+      ok: false,
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function matchPatternError(pattern, flags) {
+  const result = compileMatchPattern(pattern, flags);
+  return result.ok ? void 0 : result.message;
+}
+function compileMatchPatterns(patterns, flags) {
+  const compiled = [];
+  for (let index = 0; index < patterns.length; index += 1) {
+    const result = compileMatchPattern(patterns[index], flags);
+    if (!result.ok) return { ok: false, index, message: result.message };
+    compiled.push(result.compiled);
+  }
+  return { ok: true, compiled };
+}
+function matchBoundsError(min, max, unit) {
+  if (min === 0 && max === void 0) {
+    return {
+      path: "min",
+      message: `min: 0 needs a max; on its own it passes every transcript (use max: 0 for "no ${unit} matches")`
+    };
+  }
+  if (max !== void 0 && max < (min ?? 1)) {
+    return {
+      path: "max",
+      message: `max must be at least min (${min ?? 1}${min === void 0 ? ", the default" : ""})`
+    };
+  }
+  return void 0;
+}
+function matchPathError(path8) {
+  if (typeof path8 !== "string") return "path must be a string";
+  if (path8.length === 0) {
+    return 'path "" is the whole value; omit path instead';
+  }
+  if (path8.length < MIN_MATCH_PATH_CHARS || path8.length > MAX_MATCH_PATH_CHARS) {
+    return `path must be ${MIN_MATCH_PATH_CHARS} to ${MAX_MATCH_PATH_CHARS} characters: "/" and the key, e.g. "/elements"`;
+  }
+  if (!path8.startsWith("/")) {
+    return 'path must be a JSON Pointer that starts with "/", e.g. "/elements"';
+  }
+  if (path8.indexOf("/", 1) !== -1) {
+    return 'path must name exactly one top-level key; nested paths are not supported yet (write a "/" inside a key as ~1)';
+  }
+  if (!MATCH_PATH_PATTERN.test(path8)) {
+    return 'path has an invalid escape: "~" must be followed by 0 or 1';
+  }
+  return void 0;
+}
+function parseMatchPath(path8) {
+  const error = matchPathError(path8);
+  if (error !== void 0) return { ok: false, message: error };
+  return {
+    ok: true,
+    key: path8.slice(1).replace(/~1/g, "/").replace(/~0/g, "~")
+  };
+}
+function matchRuleConfigError(kind, rule) {
+  const toolNameRequired = kind === "toolInputMatches";
+  if ((toolNameRequired || rule.toolName !== void 0) && (typeof rule.toolName !== "string" || rule.toolName.length === 0)) {
+    return toolNameRequired ? `${kind} requires a non-empty toolName` : `${kind} toolName, when set, must be non-empty`;
+  }
+  const patterns = rule.patterns;
+  if (!Array.isArray(patterns) || patterns.length < 1 || patterns.length > MAX_MATCH_PATTERNS) {
+    return `${kind} requires 1 to ${MAX_MATCH_PATTERNS} patterns`;
+  }
+  for (const pattern of patterns) {
+    if (typeof pattern !== "string" || pattern.length < 1 || pattern.length > MAX_MATCH_PATTERN_CHARS) {
+      return `every ${kind} pattern must be 1 to ${MAX_MATCH_PATTERN_CHARS} characters`;
+    }
+  }
+  if (!isMatchPatternFlags(rule.flags)) {
+    return `${kind} flags must be one of ${MATCH_PATTERN_FLAGS.join(", ")}`;
+  }
+  if (rule.path !== void 0) {
+    const pathError = matchPathError(rule.path);
+    if (pathError !== void 0) return `${kind} ${pathError}`;
+  }
+  for (const key of ["min", "max"]) {
+    const count5 = rule[key];
+    if (count5 !== void 0 && (typeof count5 !== "number" || !Number.isInteger(count5) || count5 < 0)) {
+      return `${kind} ${key} must be a non-negative integer`;
+    }
+  }
+  const bounds = matchBoundsError(
+    rule.min,
+    rule.max,
+    kind === "toolInputMatches" ? "call" : "result"
+  );
+  return bounds?.message;
+}
+function encodeJson(value, maxChars) {
+  const encoded = canonicalJsonBounded(value, maxChars);
+  return encoded.ok ? { kind: "subject", text: encoded.json } : { kind: "unreadable", reason: encoded.reason };
+}
+function encodeMatchValue(value, maxChars = MAX_MATCH_SUBJECT_CHARS) {
+  if (typeof value === "string") {
+    return value.length > maxChars ? { kind: "unreadable", reason: "overBudget" } : { kind: "subject", text: value };
+  }
+  return encodeJson(value, maxChars);
+}
+function ownValue(container, key) {
+  if (!container || typeof container !== "object" || Array.isArray(container) || !Object.prototype.hasOwnProperty.call(container, key)) {
+    return void 0;
+  }
+  return container[key];
+}
+function encodeCallSubject(args, key, maxChars = MAX_MATCH_SUBJECT_CHARS) {
+  const value = args ?? {};
+  if (key === void 0) return encodeJson(value, maxChars);
+  const at2 = ownValue(value, key);
+  return at2 === void 0 ? { kind: "missing" } : encodeMatchValue(at2, maxChars);
+}
+function resultValueAt(result, key) {
+  return ownValue(
+    result.structuredContent !== void 0 ? result.structuredContent : result.json,
+    key
+  );
+}
+function encodeResultSubject(result, key, maxChars = MAX_MATCH_SUBJECT_CHARS) {
+  if (key !== void 0) {
+    const at2 = resultValueAt(result, key);
+    return at2 === void 0 ? { kind: "missing" } : encodeMatchValue(at2, maxChars);
+  }
+  if (result.truncated === true) {
+    return { kind: "unreadable", reason: "truncated" };
+  }
+  const parts = [];
+  let used = 0;
+  const append = (encode) => {
+    const separator = parts.length === 0 ? 0 : 1;
+    const budget = maxChars - used - separator;
+    if (budget < 0) return { kind: "unreadable", reason: "overBudget" };
+    const part = encode(budget);
+    if (part.kind !== "subject") return part;
+    parts.push(part.text);
+    used += separator + part.text.length;
+    return void 0;
+  };
+  const text2 = result.text;
+  if (typeof text2 === "string") {
+    const refused2 = append((budget) => encodeMatchValue(text2, budget));
+    if (refused2) return refused2;
+  }
+  for (const payload of [result.structuredContent, result.json]) {
+    if (payload === void 0) continue;
+    const refused2 = append((budget) => encodeJson(payload, budget));
+    if (refused2) return refused2;
+  }
+  return { kind: "subject", text: parts.join("\n") };
+}
+function matchVerdict(tally, bounds, unseen = 0) {
+  const { matched } = tally;
+  const unknown = tally.unreadable + unseen;
+  const max = bounds.max ?? Number.POSITIVE_INFINITY;
+  if (matched >= bounds.min && matched + unknown <= max) return "pass";
+  if (matched + unknown < bounds.min || matched > max) return "fail";
+  return "unscored";
+}
+function countOf(count5, unit) {
+  return `${count5} ${unit}${count5 === 1 ? "" : "s"}`;
+}
+function describeMatchExpectation(bounds, unit) {
+  const { min, max } = bounds;
+  if (max === void 0) return `at least ${min} matching ${unit}(s)`;
+  if (max === 0) return `no matching ${unit}`;
+  if (min === max) return `exactly ${min} matching ${unit}(s)`;
+  if (min === 0) return `at most ${max} matching ${unit}(s)`;
+  return `${min} to ${max} matching ${unit}s`;
+}
+function allPatterns(patternCount) {
+  return patternCount === 1 ? "the pattern" : `all ${patternCount} patterns`;
+}
+function expectedClause(bounds, unit) {
+  return `expected ${describeMatchExpectation(bounds, unit)} (min/max count matching ${unit}s, not all ${unit}s)`;
+}
+function describeInputMatch(input) {
+  const { toolName: toolName3, key, tally, bounds, verdict } = input;
+  const all = allPatterns(input.patternCount);
+  const where = key === void 0 ? "its arguments" : `its "${key}" argument`;
+  const expected = expectedClause(bounds, "call");
+  const detail = `Patterns: ${input.patternsShown}`;
+  const got = input.samplesShown ? `. Got: ${input.samplesShown}` : "";
+  const missing = key !== void 0 && tally.missing > 0 ? `, ${countOf(tally.missing, "call")} had no "${key}" argument` : "";
+  const unreadable = tally.unreadable > 0 ? `, ${tally.unreadable} could not be read (over ${MAX_MATCH_SUBJECT_CHARS} characters or not serializable)` : "";
+  if (tally.units === 0) {
+    return verdict === "pass" ? `"${toolName3}" was not called, so no call matched; ${expected}. ${detail}` : `"${toolName3}" was never called; ${expected}. ${detail}`;
+  }
+  const matched = tally.matched === 0 ? `none matched ${all} in ${where}` : `${tally.matched} matched ${all} in ${where}`;
+  const tooMany4 = verdict === "fail" && bounds.max !== void 0 && tally.matched > bounds.max ? `, allowed at most ${bounds.max}` : "";
+  const head = `"${toolName3}" called ${tally.units}\xD7, ${matched}${tooMany4}${missing}${unreadable}`;
+  if (verdict === "pass") return `${head}; ${expected}. ${detail}`;
+  if (verdict === "unscored") {
+    return `${head}; ${expected}, and the unreadable call(s) could decide it either way. ${detail}`;
+  }
+  return `${head}; ${expected}. ${detail}${got}`;
+}
+function describeResultMatch(input) {
+  const { toolName: toolName3, key, tally, bounds, verdict, gap } = input;
+  const all = allPatterns(input.patternCount);
+  const where = key === void 0 ? "their content" : `their "${key}" field`;
+  const expected = expectedClause(bounds, "result");
+  const detail = `Patterns: ${input.patternsShown}`;
+  const got = input.samplesShown ? `. Got: ${input.samplesShown}` : "";
+  const missing = key !== void 0 && tally.missing > 0 ? `, ${countOf(tally.missing, "result")} had no "${key}" field` : "";
+  const unreadable = tally.unreadable > 0 ? `, ${tally.unreadable} could not be read (truncated for storage, over ${MAX_MATCH_SUBJECT_CHARS} characters, or not serializable)` : "";
+  if (tally.units === 0) {
+    if (verdict === "unscored") {
+      return `${gap ?? "no results were read"}; cannot count matching results; ${expected}. ${detail}`;
+    }
+    const none = toolName3 === void 0 ? "no tool returned a result" : `"${toolName3}" returned no results`;
+    return verdict === "pass" ? `${none}, so no result matched; ${expected}. ${detail}` : `${none}; ${expected}. ${detail}`;
+  }
+  const source = toolName3 === void 0 ? `tools returned ${countOf(tally.units, "result")}` : `"${toolName3}" returned ${countOf(tally.units, "result")}`;
+  const matched = tally.matched === 0 ? `none matched ${all} in ${where}` : `${tally.matched} matched ${all} in ${where}`;
+  const tooMany4 = verdict === "fail" && bounds.max !== void 0 && tally.matched > bounds.max ? `, allowed at most ${bounds.max}` : "";
+  const head = `${source}, ${matched}${tooMany4}${missing}${unreadable}`;
+  if (verdict === "pass") return `${head}; ${expected}. ${detail}`;
+  if (verdict === "unscored") {
+    return gap !== void 0 ? `${head}; ${expected}, but ${gap}; results that were not read could decide it. ${detail}` : `${head}; ${expected}, and the unreadable result(s) could decide it either way. ${detail}`;
+  }
+  return `${head}; ${expected}. ${detail}${got}`;
+}
+
+// ../evaluators/dist/chunk-HCLNEORA.js
 import { z } from "zod";
 var TURN_SCOPABLE_PREDICATE_KINDS = [
   "toolCalledWith",
@@ -1239,7 +1628,8 @@ var TURN_SCOPABLE_PREDICATE_KINDS = [
   // Read only the turn's own calls, which `buildTurnTranscript` carries.
   "toolCallCountUnder",
   "toolCalledBefore",
-  "noRepeatedIdenticalCall"
+  "noRepeatedIdenticalCall",
+  "toolInputMatches"
 ];
 function isTurnScopablePredicateKind(kind) {
   return TURN_SCOPABLE_PREDICATE_KINDS.includes(kind);
@@ -1293,6 +1683,40 @@ var checkPolicyShape = {
   role: z.enum(["gating", "advisory", "required"]).optional(),
   severity: z.literal("warn").optional()
 };
+var patternMatchShape = {
+  // Authored order is kept — it is part of the criterion id.
+  patterns: z.array(z.string().min(1).max(MAX_MATCH_PATTERN_CHARS)).min(1).max(MAX_MATCH_PATTERNS),
+  flags: z.enum(MATCH_PATTERN_FLAGS).optional(),
+  // A one-key JSON Pointer. The pattern is what the published JSON Schema
+  // carries; `matchPathError` says which part of it an author got wrong.
+  path: z.string().min(MIN_MATCH_PATH_CHARS).max(MAX_MATCH_PATH_CHARS).regex(MATCH_PATH_PATTERN, {
+    message: 'path must be a one-key JSON Pointer such as "/elements" ("~1" writes "/" and "~0" writes "~" inside the key)'
+  }).optional(),
+  min: z.number().int().nonnegative().optional(),
+  max: z.number().int().nonnegative().optional()
+};
+function refinePatternMatch(unit) {
+  return (value, ctx) => {
+    value.patterns.forEach((pattern, index) => {
+      const error = matchPatternError(pattern, value.flags);
+      if (error !== void 0) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ["patterns", index],
+          message: `pattern does not compile in re2js: ${error}`
+        });
+      }
+    });
+    const bounds = matchBoundsError(value.min, value.max, unit);
+    if (bounds) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [bounds.path],
+        message: bounds.message
+      });
+    }
+  };
+}
 var predicateUnion = z.discriminatedUnion("type", [
   z.object({
     type: z.literal("toolDescriptionsPresent"),
@@ -1452,6 +1876,20 @@ var predicateUnion = z.discriminatedUnion("type", [
     toolName: z.string().min(1).optional(),
     ...checkPolicyShape
   }),
+  z.object({
+    type: z.literal("toolInputMatches"),
+    toolName: z.string().min(1),
+    ...patternMatchShape,
+    ...checkPolicyShape
+  }).superRefine(refinePatternMatch("call")),
+  z.object({
+    type: z.literal("toolResultMatches"),
+    // Omitted = every tool's results, the same scope `toolResultContains`
+    // reads.
+    toolName: z.string().min(1).optional(),
+    ...patternMatchShape,
+    ...checkPolicyShape
+  }).superRefine(refinePatternMatch("result")),
   z.object({
     type: z.literal("noRepeatedIdenticalCall"),
     toolName: z.string().min(1).optional(),
@@ -1538,7 +1976,7 @@ __export(derive_exports, {
   skippedScoreResult: () => skippedScoreResult
 });
 
-// ../evaluators/dist/chunk-BQI45W3U.js
+// ../evaluators/dist/chunk-KAI5M4KO.js
 function resolveScoreDefinition(definition) {
   const fallback = isRequiredRole(definition.role) ? "fail" : "ignore";
   const { onError, onSkipped, ...rest } = definition;
@@ -1789,7 +2227,7 @@ __export(adapters_exports, {
   toolMatchScoreDefinition: () => toolMatchScoreDefinition
 });
 
-// ../evaluators/dist/chunk-FOXVFKYF.js
+// ../evaluators/dist/chunk-5E4WULER.js
 var TOOL_MATCH_SCORER_ID = "tool-match";
 var LEGACY_TEST_SCORER_ID = "legacy:test";
 var LEGACY_TEST_VERSION = "1";
@@ -1803,10 +2241,18 @@ function predicateScoreDefinition(predicate, options) {
     scorerId: explicit || generatedPredicateScorerId(predicate, options.ordinal),
     idSource: explicit ? "explicit" : "generated",
     scorerVersion: PREDICATES_VERSION,
+    // Kinds whose verdict depends on more than the authored rule — an engine,
+    // an encoding, a budget — digest that implementation beside the rule.
     implementationHash: canonicalDigest(
       predicate.type === "responseCloseTo" ? {
         ...RESPONSE_CLOSE_TO_IMPLEMENTATION,
         rule: stripCheckPolicy(predicate)
+      } : predicate.type === "toolInputMatches" ? {
+        ...TOOL_INPUT_MATCHES_IMPLEMENTATION,
+        rule: stripCheckPolicy(predicate)
+      } : predicate.type === "toolResultMatches" ? {
+        ...TOOL_RESULT_MATCHES_IMPLEMENTATION,
+        rule: stripCheckPolicy(predicate)
       } : stripCheckPolicy(predicate)
     ),
     label: predicate.type,
@@ -1953,7 +2399,7 @@ __export(evaluator_derive_exports, {
   toScoreRawOutcome: () => toScoreRawOutcome
 });
 
-// ../evaluators/dist/chunk-QKVB5E5P.js
+// ../evaluators/dist/chunk-QVKDBSXS.js
 function toEvaluatorResult(score2) {
   return {
     schemaVersion: EVALUATOR_RESULT_SCHEMA_VERSION,
@@ -2106,7 +2552,7 @@ var Semaphore = class {
 var DEFAULT_SCORER_TIMEOUT_MS = 6e4;
 var DEFAULT_SCORER_CONCURRENCY = 4;
 
-// ../evaluators/dist/chunk-PN2I3447.js
+// ../evaluators/dist/chunk-NRZVABEW.js
 var ScorerTimeoutError = class extends Error {
   constructor(timeoutMs) {
     super(`scorer timed out after ${timeoutMs}ms`);
@@ -2215,7 +2661,7 @@ function scoresPassed(scores, definitions2) {
   return true;
 }
 
-// ../evaluators/dist/chunk-BIUQHSWF.js
+// ../evaluators/dist/chunk-ZQI2XLYE.js
 function isCanonical(evaluator) {
   return typeof evaluator.evaluate === "function";
 }
@@ -2605,7 +3051,7 @@ function validateAgainstSchema(schema, instance) {
   }
 }
 
-// ../evaluators/dist/chunk-BIKNSDDD.js
+// ../evaluators/dist/chunk-JKPDKMTE.js
 var MAX_VALUE_CHARS = 200;
 var MAX_ERROR_MSG_CHARS = 200;
 var MAX_ITEMS_SHOWN = 3;
@@ -2878,6 +3324,50 @@ function hasContinuation(payload) {
 function estimatedTokens(bytes2) {
   return `\u2248${Math.ceil(bytes2 / 4).toLocaleString()} tokens (estimate)`;
 }
+function preparePatternMatch(predicate) {
+  const configError = matchRuleConfigError(
+    predicate.type,
+    predicate
+  );
+  if (configError !== void 0) return { ok: false, reason: configError };
+  const compiled = compileMatchPatterns(predicate.patterns, predicate.flags);
+  if (!compiled.ok) {
+    return {
+      ok: false,
+      reason: `${predicate.type} pattern ${compiled.index + 1} does not compile in re2js: ${truncate2(scrubText(compiled.message), MAX_VALUE_CHARS)}`
+    };
+  }
+  let key;
+  if (predicate.path !== void 0) {
+    const parsed = parseMatchPath(predicate.path);
+    if (!parsed.ok) return { ok: false, reason: parsed.message };
+    key = parsed.key;
+  }
+  const flags = predicate.flags ?? "";
+  const patternsShown = predicate.patterns.slice(0, MAX_ITEMS_SHOWN).map(
+    (pattern) => `/${truncate2(
+      scrubText(pattern),
+      MAX_DISPLAYED_PATTERN_CHARS
+    )}/${flags}`
+  ).join(", ") + (predicate.patterns.length > MAX_ITEMS_SHOWN ? `, +${predicate.patterns.length - MAX_ITEMS_SHOWN} more` : "");
+  return {
+    ok: true,
+    compiled: compiled.compiled,
+    key,
+    bounds: { min: predicate.min ?? 1, max: predicate.max },
+    patternsShown
+  };
+}
+function matchesEvery(compiled, subject) {
+  return compiled.every((pattern) => pattern.test(subject));
+}
+function samplesOnShortfall(verdict, tally, bounds, unmatched, sample) {
+  const tooMany4 = bounds.max !== void 0 && tally.matched > bounds.max;
+  if (verdict !== "fail" || tooMany4 || unmatched.length === 0) {
+    return void 0;
+  }
+  return `[${unmatched.slice(0, MAX_ITEMS_SHOWN).map(sample).join(", ")}${unmatched.length > MAX_ITEMS_SHOWN ? `, +${unmatched.length - MAX_ITEMS_SHOWN} more` : ""}]`;
+}
 function evaluatePredicate(transcript, predicate) {
   switch (predicate.type) {
     case "toolDescriptionsPresent":
@@ -3869,6 +4359,151 @@ function evaluatePredicate(transcript, predicate) {
         inspected === 0 ? `no full page from ${scopeLabel(predicate.toolName)} to inspect` : `all ${inspected} full page(s) carried continuation metadata`
       );
     }
+    case "toolInputMatches": {
+      const prepared = preparePatternMatch(predicate);
+      if (!prepared.ok) return evidenceError(predicate, prepared.reason);
+      const { compiled, key, bounds, patternsShown } = prepared;
+      const calls = callsTo(transcript, predicate.toolName);
+      const tally = {
+        units: calls.length,
+        matched: 0,
+        unreadable: 0,
+        missing: 0
+      };
+      const unmatched = [];
+      for (const call of calls) {
+        const subject = encodeCallSubject(call.arguments, key);
+        if (subject.kind === "missing") {
+          tally.missing += 1;
+          unmatched.push(call);
+        } else if (subject.kind === "unreadable") {
+          tally.unreadable += 1;
+        } else if (matchesEvery(compiled, subject.text)) {
+          tally.matched += 1;
+        } else {
+          unmatched.push(call);
+        }
+      }
+      const verdict = matchVerdict(tally, bounds);
+      const sample = (call) => {
+        const args = call.arguments ?? {};
+        if (key === void 0) return brief(args);
+        return Object.prototype.hasOwnProperty.call(args, key) ? brief({ [key]: args[key] }) : `(no "${key}")`;
+      };
+      const reason = describeInputMatch({
+        toolName: predicate.toolName,
+        key,
+        patternCount: predicate.patterns.length,
+        tally,
+        bounds,
+        verdict,
+        patternsShown,
+        samplesShown: samplesOnShortfall(
+          verdict,
+          tally,
+          bounds,
+          unmatched,
+          sample
+        )
+      });
+      if (verdict === "pass") return pass(predicate, reason);
+      if (verdict === "fail") return fail(predicate, reason);
+      return evidenceError(predicate, reason);
+    }
+    case "toolResultMatches": {
+      const prepared = preparePatternMatch(predicate);
+      if (!prepared.ok) return evidenceError(predicate, prepared.reason);
+      const { compiled, key, bounds, patternsShown } = prepared;
+      const scope = resultScope(transcript, predicate.toolName);
+      const describe = (tally2, verdict2, extra = {}) => describeResultMatch({
+        toolName: predicate.toolName,
+        key,
+        patternCount: predicate.patterns.length,
+        tally: tally2,
+        bounds,
+        verdict: verdict2,
+        patternsShown,
+        ...extra
+      });
+      if (scope.length === 0) {
+        const empty = emptyScopeIsScored(
+          transcript,
+          "toolResults",
+          predicate.toolName
+        );
+        const none = {
+          units: 0,
+          matched: 0,
+          unreadable: 0,
+          missing: 0
+        };
+        if (!empty.scored) {
+          return evidenceError(
+            predicate,
+            describe(none, "unscored", { gap: empty.reason })
+          );
+        }
+        const verdict2 = matchVerdict(none, bounds);
+        return verdict2 === "pass" ? pass(predicate, describe(none, verdict2)) : fail(predicate, describe(none, verdict2));
+      }
+      const tally = {
+        units: scope.length,
+        matched: 0,
+        unreadable: 0,
+        missing: 0
+      };
+      const unmatched = [];
+      for (const result of scope) {
+        const subject = encodeResultSubject(result, key);
+        if (subject.kind === "missing") {
+          tally.missing += 1;
+          unmatched.push(result);
+        } else if (subject.kind === "unreadable") {
+          tally.unreadable += 1;
+        } else if (matchesEvery(compiled, subject.text)) {
+          tally.matched += 1;
+        } else {
+          unmatched.push(result);
+        }
+      }
+      const gap = incompleteScopeReason(
+        transcript,
+        "toolResults",
+        scope.length
+      );
+      const verdict = matchVerdict(
+        tally,
+        bounds,
+        gap === void 0 ? 0 : Number.POSITIVE_INFINITY
+      );
+      const sample = (result) => {
+        const prefix = predicate.toolName === void 0 ? `"${result.toolName}" ` : "";
+        if (key !== void 0) {
+          const value = resultValueAt(result, key);
+          return value === void 0 ? `${prefix}(no "${key}")` : `${prefix}${scrubText(brief({ [key]: value }))}`;
+        }
+        const payload = result.structuredContent !== void 0 ? result.structuredContent : result.json;
+        if (payload !== void 0) {
+          return `${prefix}${scrubText(brief(payload))}`;
+        }
+        return `${prefix}${JSON.stringify(
+          truncate2(scrubText(result.text ?? ""), MAX_VALUE_CHARS)
+        )}`;
+      };
+      const reason = describe(tally, verdict, {
+        ...verdict === "unscored" && gap !== void 0 ? { gap } : {},
+        samplesShown: samplesOnShortfall(
+          verdict,
+          tally,
+          bounds,
+          unmatched,
+          sample
+        )
+      });
+      if (verdict === "pass") return pass(predicate, reason);
+      if (verdict === "fail") return fail(predicate, reason);
+      return evidenceError(predicate, reason);
+    }
     default: {
       const exhaustive = predicate;
       return {
@@ -4076,7 +4711,7 @@ __export(predicate_scorer_exports, {
   predicateScorer: () => predicateScorer
 });
 
-// ../evaluators/dist/chunk-DOG7TBJQ.js
+// ../evaluators/dist/chunk-RXIKS7LO.js
 function assertLocallyEvaluable(predicate) {
   if (!requiresRenderObservations(predicate.type)) return;
   throw new Error(
@@ -4105,7 +4740,7 @@ function predicateScorer(predicate, options) {
           rationale: "predicate evaluator returned no verdict"
         };
       }
-      if (predicate.type === "responseCloseTo" && result.status === "error")
+      if ((predicate.type === "responseCloseTo" || predicate.type === "toolInputMatches" || predicate.type === "toolResultMatches") && result.status === "error")
         throw new Error(result.reason);
       return {
         kind: "scored",
@@ -4154,7 +4789,7 @@ function toEvaluatorRawOutcome(outcome) {
   };
 }
 
-// ../evaluators/dist/chunk-5CFTXLA2.js
+// ../evaluators/dist/chunk-3VGEMHWF.js
 function assertLocallyEvaluable2(rule) {
   if (!requiresRenderObservations(rule.type)) return;
   throw new Error(
@@ -22753,6 +23388,10 @@ var ASSERTION_STAGE = {
   // ── Tool call: was the call itself well formed ──────────────────────────
   argumentsMatchToolSchema: "call",
   noRepeatedIdenticalCall: "call",
+  // What went INTO the call, so a wrong argument files as `argumentMismatch`.
+  // A never-called tool on its own also files here; pair it with a
+  // `toolCalledWith` (which files at `selection`, earlier) to attribute that.
+  toolInputMatches: "call",
   // ── Response: what the server answered with ─────────────────────────────
   //
   // `noToolErrors` MOVED HERE in analyzer 11, from `userValue` where it had
@@ -22766,6 +23405,8 @@ var ASSERTION_STAGE = {
   noToolErrors: "response",
   toolLatencyUnder: "response",
   toolResultContains: "response",
+  // What came OUT of the call, like the other `toolResult*` checks.
+  toolResultMatches: "response",
   toolResultMatchesSchema: "response",
   toolResultSizeUnder: "response",
   toolErrorNamesInput: "response",
@@ -27361,7 +28002,7 @@ var noopPosthog = {
 var posthog = isTelemetryDisabled ? noopPosthog : new PostHog("phc_dTOPniyUNU2kD8Jx8yHMXSqiZHM8I91uWopTMX6EBE9", {
   host: "https://us.i.posthog.com"
 });
-var SDK_VERSION = "8.17.0";
+var SDK_VERSION = "8.18.0";
 var SDK_RELEASE = `@mcpjam/sdk@${SDK_VERSION}`;
 var CAPTURED_ERROR_SYMBOL = Symbol.for("@mcpjam/sdk/captured-eval-error");
 init_internal();
@@ -27372,7 +28013,7 @@ init_eval_tool_execution();
 init_internal();
 init_internal();
 function readSdkVersion() {
-  return "8.17.0";
+  return "8.18.0";
 }
 var DEFAULT_PLATFORM_USER_AGENT = `mcpjam-sdk/${readSdkVersion()}`;
 init_HostRunner();
@@ -85378,7 +86019,7 @@ var NEGATIVE_TEST_MODE_DETAILS = {
   }
 };
 function readSdkVersion2() {
-  return "8.17.0";
+  return "8.18.0";
 }
 var CONFORMANCE_CHECKER_VERSION2 = readSdkVersion2();
 var MUST_POINTS2 = 95;
@@ -103040,8 +103681,8 @@ function cleanAbandonedLocalDownloads() {
         if (error.code !== "ESRCH") continue;
       }
       const path8 = join8(tmpdir(), name15);
-      const stat7 = await lstat2(path8).catch(() => void 0);
-      if (stat7?.isDirectory() && !stat7.isSymbolicLink() && (process.getuid === void 0 || stat7.uid === process.getuid()))
+      const stat8 = await lstat2(path8).catch(() => void 0);
+      if (stat8?.isDirectory() && !stat8.isSymbolicLink() && (process.getuid === void 0 || stat8.uid === process.getuid()))
         await rm(path8, { recursive: true, force: true });
     }
   })().catch(() => {
@@ -105058,9 +105699,9 @@ async function collectProfileEntries(profileDir, currentDir, entries, uncompress
     const archivePath = relative2(profileDir, absolutePath).split(sep3).join("/");
     assertSafeArchivePath(archivePath);
     if (isExcludedProfilePath(archivePath)) continue;
-    const stat7 = await lstat3(absolutePath);
-    if (stat7.isDirectory()) {
-      const header2 = makeTarHeader(archivePath, "directory", 0, stat7.mode);
+    const stat8 = await lstat3(absolutePath);
+    if (stat8.isDirectory()) {
+      const header2 = makeTarHeader(archivePath, "directory", 0, stat8.mode);
       entries.push(header2);
       uncompressedBytes.value += header2.byteLength;
       if (uncompressedBytes.value > MAX_BROWSER_PROFILE_UNCOMPRESSED_BYTES) {
@@ -105076,8 +105717,8 @@ async function collectProfileEntries(profileDir, currentDir, entries, uncompress
       );
       continue;
     }
-    if (!stat7.isFile()) continue;
-    if (uncompressedBytes.value + stat7.size > MAX_BROWSER_PROFILE_UNCOMPRESSED_BYTES) {
+    if (!stat8.isFile()) continue;
+    if (uncompressedBytes.value + stat8.size > MAX_BROWSER_PROFILE_UNCOMPRESSED_BYTES) {
       throw new Error("browser profile archive exceeds the expanded size limit");
     }
     const contents = await readFile(absolutePath);
@@ -105085,7 +105726,7 @@ async function collectProfileEntries(profileDir, currentDir, entries, uncompress
       archivePath,
       "file",
       contents.byteLength,
-      stat7.mode
+      stat8.mode
     );
     const padding = Buffer.alloc(
       (TAR_BLOCK_BYTES - contents.byteLength % TAR_BLOCK_BYTES) % TAR_BLOCK_BYTES
@@ -110375,7 +111016,7 @@ function isBlockedEgressHost(hostname3, blockPrivate) {
   let host = hostname3.trim().toLowerCase();
   if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
   host = host.replace(/\.+$/, "");
-  if (!host) return false;
+  if (!host) return true;
   if (host === "metadata.google.internal" || host === "metadata.goog") {
     return true;
   }
@@ -125820,13 +126461,13 @@ async function listFilesRecursive(dirPath, relativeTo = dirPath) {
         });
       } else if (entry3.isFile()) {
         try {
-          const stat7 = await fs.stat(fullPath);
+          const stat8 = await fs.stat(fullPath);
           const mimeType = getMimeType(entry3.name);
           files.push({
             path: relativePath,
             name: entry3.name,
             type: "file",
-            size: stat7.size,
+            size: stat8.size,
             mimeType,
             extension: ext || void 0
           });
@@ -126325,8 +126966,8 @@ function formatDisplayPath(fullPath) {
 }
 async function directoryExists2(dirPath) {
   try {
-    const stat7 = await fs2.stat(dirPath);
-    return stat7.isDirectory();
+    const stat8 = await fs2.stat(dirPath);
+    return stat8.isDirectory();
   } catch {
     return false;
   }
@@ -126415,10 +127056,10 @@ async function listLocalRuntimeSkillFiles(skillDir) {
           `"${file.path}" is not readable within the skill directory.`
         );
       }
-      const stat7 = await fs2.stat(absolute);
-      if (stat7.size > SKILL_FILE_MAX_READ_BYTES) {
+      const stat8 = await fs2.stat(absolute);
+      if (stat8.size > SKILL_FILE_MAX_READ_BYTES) {
         throw new Error(
-          `"${file.path}" is too large to read (${stat7.size} bytes).`
+          `"${file.path}" is too large to read (${stat8.size} bytes).`
         );
       }
       return new Uint8Array(await fs2.readFile(absolute));
@@ -127544,6 +128185,17 @@ function patchModernClaudeCodeBridgeContent(content) {
   }
   return patched;
 }
+function enforceStrictMcpConfig(content) {
+  const needle = "      mcpServers,\n      cwd: workdir,";
+  const replacement = "      mcpServers,\n      strictMcpConfig: true,\n      cwd: workdir,";
+  if (content.includes(replacement)) return content;
+  if (!content.includes(needle)) {
+    throw new Error(
+      "Unable to patch Claude Code bridge bootstrap: MCP query options shape changed"
+    );
+  }
+  return content.replace(needle, replacement);
+}
 function patchClaudeCodeBridgeContent(content) {
   let patched = content;
   if (patched.includes("handleStreamEvent(msg.event,")) {
@@ -127636,7 +128288,12 @@ function patchClaudeCodeHarnessBootstrap(harness2) {
         ...bootstrap,
         files: [
           ...bootstrap.files.map(
-            (file) => file.path.endsWith("/bridge.mjs") ? { ...file, content: patchClaudeCodeBridgeContent(file.content) } : file
+            (file) => file.path.endsWith("/bridge.mjs") ? {
+              ...file,
+              content: enforceStrictMcpConfig(
+                patchClaudeCodeBridgeContent(file.content)
+              )
+            } : file
           ),
           {
             path: `${bootstrap.bootstrapDir}/.npmrc`,
@@ -130844,9 +131501,6 @@ function parseHarnessToolName(rawToolName, keyToServerId) {
   const serverId = keyToServerId[key];
   return serverId ? { serverId, toolName: tool19 } : { toolName: rawToolName };
 }
-function serializeHarnessMcpJson(json) {
-  return JSON.stringify(json, null, 2);
-}
 var ACP_RESERVED_MCP_SERVER_NAME = "ai-sdk-harness-tools";
 function toAcpMcpServers(json) {
   const out = {};
@@ -131117,19 +131771,19 @@ var claudeCodeAdapter = {
   // tool-approval-request and resumes with the decision), same path as native.
   supportsHostExecutedToolApproval: true,
   // The CLI's own MCP client connects to the servers from inside the sandbox,
-  // via the `.mcp.json` written below — real native function calling. Read from
+  // via its session MCP configuration — real native function calling. Read from
   // the shared declaration so the host editor's promises about which knobs bite
   // move with this, instead of being re-asserted by hand on the client.
   mcpDelivery: HARNESS_MCP_DELIVERY["claude-code"],
-  // …by writing `.mcp.json` into the session workdir (see deliverMcpServers).
-  mcpNativeDelivery: "sandbox-files",
+  // …through the SDK session configuration, without writing into the workspace.
+  mcpNativeDelivery: "session-config",
   supportsSkills: true,
   skillsBaseDir: CLAUDE_CODE_SKILLS_BASE,
   // Mirrors `writeClaudeCodeSkills` in `@ai-sdk/harness-claude-code`.
   skillsWriteOptions: { trailingNewline: true },
   prepareSkills: prepareClaudeCodeSkills,
   // No native plugin-unit install: this adapter delivers a plugin's COMPONENTS
-  // (skills param + `.mcp.json`), which is not the same contract.
+  // (skills param + MCP configuration), which is not the same contract.
   supportsPluginBundles: false,
   // Claude Code does not emit file-change stream parts.
   fileChangeToolName: void 0,
@@ -131142,15 +131796,10 @@ var claudeCodeAdapter = {
   modelSupport: modelSupportFor("claude-code"),
   supportsModel: supportsModelFor("claude-code"),
   parseToolName: parseHarnessToolName,
-  async deliverMcpServers({ writeTextFile, sessionWorkDir, mcpJson }) {
-    await writeTextFile({
-      path: `${sessionWorkDir}/.mcp.json`,
-      content: serializeHarnessMcpJson(mcpJson)
-    });
-  },
-  createHarness({ modelId, auth }) {
+  createHarness({ modelId, auth, mcpJson }) {
     const nativeModel = toClaudeCodeModel(modelId);
     return createClaudeCodeHarness({
+      mcpServers: mcpJson.mcpServers,
       ...nativeModel ? { model: nativeModel } : {},
       auth,
       // Unset, Claude Code defaults to ADAPTIVE thinking, a first-party
@@ -133122,6 +133771,10 @@ var ASSERTION_STAGE2 = {
   // ── Tool call: was the call itself well formed ──────────────────────────
   argumentsMatchToolSchema: "call",
   noRepeatedIdenticalCall: "call",
+  // What went INTO the call, so a wrong argument files as `argumentMismatch`.
+  // A never-called tool on its own also files here; pair it with a
+  // `toolCalledWith` (which files at `selection`, earlier) to attribute that.
+  toolInputMatches: "call",
   // ── Response: what the server answered with ─────────────────────────────
   //
   // `noToolErrors` MOVED HERE in analyzer 11, from `userValue` where it had
@@ -133135,6 +133788,8 @@ var ASSERTION_STAGE2 = {
   noToolErrors: "response",
   toolLatencyUnder: "response",
   toolResultContains: "response",
+  // What came OUT of the call, like the other `toolResult*` checks.
+  toolResultMatches: "response",
   toolResultMatchesSchema: "response",
   toolResultSizeUnder: "response",
   toolErrorNamesInput: "response",
@@ -143443,6 +144098,18 @@ function isActorEligibleForLocalHarness(actor) {
 function unavailable(status, message) {
   return { available: false, status, message };
 }
+function localHarnessManifestsForDevelopment(manifests = LOCAL_HARNESS_MANIFEST) {
+  const version = process.env.MCPJAM_LOCAL_HARNESS_CONFORMANCE_VERSION?.trim();
+  if (HOSTED_MODE || process.env.ENVIRONMENT !== "dev" || !version) {
+    return manifests;
+  }
+  return Object.fromEntries(
+    Object.entries(manifests).map(([id3, manifest]) => [
+      id3,
+      manifest.lifecycleConformanceVersion || id3 !== "claude-code" ? manifest : { ...manifest, lifecycleConformanceVersion: version }
+    ])
+  );
+}
 async function resolveLocalHarnessAvailability(query) {
   const hosted = query.hosted ?? HOSTED_MODE;
   const enabled = query.killSwitchEnabled ?? LOCAL_HARNESS_ENABLED;
@@ -143496,7 +144163,7 @@ async function resolveLocalHarnessAvailability(query) {
       ...target.kind === "local-isolated" ? { backend: target.backend } : {},
       installedAdapterVersion: query.installedAdapterVersion
     },
-    query.manifests ?? LOCAL_HARNESS_MANIFEST
+    query.manifests ?? localHarnessManifestsForDevelopment()
   );
   if (!compatibility.ok) {
     return unavailable(compatibility.status, compatibility.message);
@@ -145096,7 +145763,12 @@ function buildLocalHarnessEnv(opts) {
   }
   env.CI = "1";
   env.NO_COLOR = "1";
-  for (const [name15, value] of Object.entries(opts.scoped ?? {})) {
+  validateLocalHarnessScopedEnv(opts.scoped ?? {});
+  Object.assign(env, opts.scoped);
+  return env;
+}
+function validateLocalHarnessScopedEnv(scoped) {
+  for (const [name15, value] of Object.entries(scoped)) {
     if (SCOPED_NAME_DENYLIST.has(name15.toUpperCase())) {
       throw new LocalHarnessEnvError(
         `scoped environment entry ${name15} is not allowed: it would redirect executable, library, or config resolution for the child`
@@ -145112,9 +145784,17 @@ function buildLocalHarnessEnv(opts) {
         `scoped environment value for ${name15} contains a control character`
       );
     }
-    env[name15] = value;
   }
-  return env;
+}
+function validateLocalHarnessSecretEnv(scoped) {
+  validateLocalHarnessScopedEnv(scoped);
+  for (const name15 of Object.keys(scoped)) {
+    if (/^(ANTHROPIC_|AI_GATEWAY_|BRIDGE_|CLAUDE_CODE_)/i.test(name15)) {
+      throw new LocalHarnessEnvError(
+        `Project secret ${name15} conflicts with the local harness runtime.`
+      );
+    }
+  }
 }
 var BRIDGE_SUPPLIED_ENV_ALLOWLIST = [
   // Bridge control channel.
@@ -145886,6 +146566,16 @@ async function removeSessionStateDir(dir) {
   }
   await rm3(target, { recursive: true, force: true });
 }
+function sessionStateDirFor(stateRoot, sessionId) {
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(sessionId)) {
+    throw new Error(
+      `session id ${JSON.stringify(
+        sessionId
+      )} is not a single safe path segment`
+    );
+  }
+  return join15(stateRoot, "sessions", sessionId);
+}
 
 // server/utils/harness/local/supervisor.ts
 import { spawn as spawn5 } from "child_process";
@@ -146700,6 +147390,9 @@ var unstopped = /* @__PURE__ */ new Set();
 function registerLocalHarnessSession(record5) {
   sessions2.set(record5.sessionId, record5);
 }
+function getLocalHarnessSession(sessionId) {
+  return sessions2.get(sessionId);
+}
 function forgetLocalHarnessSession(sessionId) {
   sessions2.delete(sessionId);
 }
@@ -146788,7 +147481,7 @@ function messageOf(error) {
 
 // server/utils/harness/local/local-turn.ts
 import { join as join17 } from "path";
-import { mkdir as mkdir11 } from "fs/promises";
+import { mkdir as mkdir11, stat as stat7 } from "fs/promises";
 import { createRequire as createRequire3 } from "module";
 var sharedSupervisor = null;
 function localHarnessSupervisor() {
@@ -146796,6 +147489,7 @@ function localHarnessSupervisor() {
   return sharedSupervisor;
 }
 async function prepareLocalHarnessTurn(args) {
+  validateLocalHarnessSecretEnv(args.scopedEnv ?? {});
   const verifyStartedAt = Date.now();
   const runtimeStatus = await readRuntimeInstallStatus({
     harnessId: "claude-code"
@@ -146854,6 +147548,17 @@ async function prepareWithReservedRuntime(outer) {
   const args = outer.args;
   const runtimeStatus = outer.runtimeStatus;
   const verifyStartedAt = outer.verifyStartedAt;
+  const sessionStateDir = sessionStateDirFor(
+    localHarnessStateRoot(),
+    args.sessionId
+  );
+  if (getLocalHarnessSession(args.sessionId)) {
+    return {
+      ok: false,
+      status: "session-still-running",
+      message: "The previous local turn is still stopping. Try again once it has stopped."
+    };
+  }
   const availability = await resolveLocalHarnessAvailability({
     target: {
       kind: "local-native",
@@ -146911,13 +147616,12 @@ async function prepareWithReservedRuntime(outer) {
     };
   }
   const supervisor = localHarnessSupervisor();
-  const sessionStateDir = join17(
-    localHarnessStateRoot(),
-    "sessions",
-    args.sessionId
-  );
   let gateway = null;
   try {
+    const sessionStateExists = await stat7(sessionStateDir).then((entry3) => entry3.isDirectory()).catch((error) => {
+      if (error.code === "ENOENT") return false;
+      throw error;
+    });
     await mkdir11(sessionStateDir, { recursive: true, mode: 448 });
     const gatewayStartedAt = Date.now();
     try {
@@ -146955,6 +147659,11 @@ async function prepareWithReservedRuntime(outer) {
       workspacePath: plan.workspacePath,
       workspaceGrantId: plan.target.workspaceGrantId,
       sessionStateDir,
+      ...args.onSecretEnvDelivered && Object.keys(args.scopedEnv ?? {}).length ? {
+        onBridgeStarted: async () => {
+          args.onSecretEnvDelivered?.();
+        }
+      } : {},
       targetKind: "local-native",
       bridgePort,
       scopedEnv: {
@@ -146972,6 +147681,7 @@ async function prepareWithReservedRuntime(outer) {
       releaseRuntime: outer.releaseRuntimeUse,
       startedAt: Date.now()
     };
+    let treeStopped = false;
     const teardownOnce = onceAsync(async () => {
       try {
         started2.revoke();
@@ -146980,6 +147690,7 @@ async function prepareWithReservedRuntime(outer) {
         await revokeLease(broker.runId, args.bearer);
         const stop = await supervisor.stopSession(args.sessionId);
         if (stop.stopped) {
+          treeStopped = true;
           forgetLocalHarnessSessionRecord(sessionRecord);
           await outer.releaseRuntimeUse();
         }
@@ -147006,10 +147717,18 @@ async function prepareWithReservedRuntime(outer) {
           ANTHROPIC_BASE_URL: started2.baseUrl
         },
         sandboxWorkDir: "project",
+        skillsBaseDir: toAdapterPath(
+          join17(sessionStateDir, "home", ".claude", "skills")
+        ),
+        sessionStateExists,
         permissionMode,
         brokerRunId: broker.runId,
         timings: { localRuntimeVerifyMs, localGatewayReadyMs },
-        teardown: teardownOnce
+        teardown: teardownOnce,
+        discardState: onceAsync(async () => {
+          await teardownOnce();
+          if (treeStopped) await removeSessionStateDir(sessionStateDir);
+        })
       }
     };
   } catch (error) {
@@ -147063,48 +147782,6 @@ function onceAsync(fn) {
   };
 }
 
-// server/utils/harness/resolve-sandbox.ts
-var HarnessSandboxResolutionError = class extends Error {
-  constructor(message, status) {
-    super(message);
-    this.name = "HarnessSandboxResolutionError";
-    this.status = status;
-  }
-};
-async function resolveHarnessSandbox(args) {
-  if (!isComputersDataPlaneConfigured()) {
-    throw new HarnessSandboxResolutionError(
-      "this server is not a computers data plane (deployed servers bootstrap credentials from INSPECTOR_SERVICE_TOKEN; see docs/project-computers.md)",
-      503
-    );
-  }
-  const ready = await ensureComputerReady({
-    bearer: args.bearer,
-    projectId: args.projectId,
-    ...args.executionScope ? { executionScope: args.executionScope } : {},
-    signal: args.signal,
-    timeoutMs: args.timeoutMs
-  });
-  if (!ready.ok) {
-    throw new HarnessSandboxResolutionError(ready.error, ready.status);
-  }
-  const info = await getComputerSandboxInfo({
-    computerId: ready.value.computerId,
-    signal: args.signal
-  });
-  if (!info.ok) {
-    throw new HarnessSandboxResolutionError(info.error, info.status);
-  }
-  const sandboxId = info.value.providerComputerId;
-  if (!sandboxId) {
-    throw new HarnessSandboxResolutionError(
-      `computer ${ready.value.computerId} has no provider sandbox id yet (status: ${info.value.status})`,
-      503
-    );
-  }
-  return { computerId: ready.value.computerId, sandboxId };
-}
-
 // server/utils/computers/convex-secrets-client.ts
 import { ConvexHttpClient as ConvexHttpClient7 } from "convex/browser";
 var FN3 = {
@@ -147197,6 +147874,72 @@ async function convexGetEnvironmentSecretSelection(bearer, args) {
   return environment?.secretSelection?.secretIds ?? [];
 }
 
+// server/utils/harness/local/secret-delivery.ts
+async function assertLocalSecretDelivery(args) {
+  if (args.environmentUnresolvedReason) {
+    throw new Error(
+      "Cannot verify secret delivery for this local run's environment."
+    );
+  }
+  if (!args.environmentId) return;
+  const [bindings, selected] = await Promise.all([
+    convexListProjectSecretBindings(args.bearer, { projectId: args.projectId }),
+    convexGetEnvironmentSecretSelection(args.bearer, {
+      projectId: args.projectId,
+      environmentId: args.environmentId
+    })
+  ]);
+  if (bindings.some(
+    (binding) => binding.delivery === "brokered" && selected.includes(binding.secretId)
+  )) {
+    throw new Error(
+      "This environment selects brokered secrets, which require cloud execution. Local execution supports materialized secrets only."
+    );
+  }
+}
+
+// server/utils/harness/resolve-sandbox.ts
+var HarnessSandboxResolutionError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.name = "HarnessSandboxResolutionError";
+    this.status = status;
+  }
+};
+async function resolveHarnessSandbox(args) {
+  if (!isComputersDataPlaneConfigured()) {
+    throw new HarnessSandboxResolutionError(
+      "this server is not a computers data plane (deployed servers bootstrap credentials from INSPECTOR_SERVICE_TOKEN; see docs/project-computers.md)",
+      503
+    );
+  }
+  const ready = await ensureComputerReady({
+    bearer: args.bearer,
+    projectId: args.projectId,
+    ...args.executionScope ? { executionScope: args.executionScope } : {},
+    signal: args.signal,
+    timeoutMs: args.timeoutMs
+  });
+  if (!ready.ok) {
+    throw new HarnessSandboxResolutionError(ready.error, ready.status);
+  }
+  const info = await getComputerSandboxInfo({
+    computerId: ready.value.computerId,
+    signal: args.signal
+  });
+  if (!info.ok) {
+    throw new HarnessSandboxResolutionError(info.error, info.status);
+  }
+  const sandboxId = info.value.providerComputerId;
+  if (!sandboxId) {
+    throw new HarnessSandboxResolutionError(
+      `computer ${ready.value.computerId} has no provider sandbox id yet (status: ${info.value.status})`,
+      503
+    );
+  }
+  return { computerId: ready.value.computerId, sandboxId };
+}
+
 // server/utils/harness/runtime-secrets.ts
 async function fetchRuntimeSecrets(bearer, args) {
   if (!bearer || !args.projectId || !args.environmentId) {
@@ -149599,6 +150342,9 @@ function harnessRuntimeFingerprint(parts) {
   const pluginDimension = pluginVersionsFingerprint(parts.pluginVersions ?? []);
   const s = [
     String(HARNESS_RUNTIME_COMPAT_VERSION),
+    // Older Claude sessions have workspace .mcp.json files. Start a new lane
+    // when moving to SDK config so stale servers cannot be loaded from disk.
+    ...parts.harnessId === "claude-code" ? ["session-mcp-v1"] : [],
     (parts.selectedServers ?? []).slice().sort().join(","),
     parts.permissionMode,
     ...pluginDimension ? [pluginDimension] : [],
@@ -149718,6 +150464,8 @@ async function runHarnessTurn(options, streamSink) {
   let brokerRunId;
   let brokerRevoked = false;
   let localTeardown = null;
+  let discardLocalState;
+  let retainLocalState = false;
   let reservationHeld = false;
   let releaseBoxReservation;
   let reservationHeartbeatTimer;
@@ -149984,6 +150732,14 @@ async function runHarnessTurn(options, streamSink) {
       const skillsFetch = skillSource.mode !== "live" ? { ok: true, skills: skillSource.skills } : projectId && authHeader ? await fetchRuntimeSkills(authHeader, projectId, executionScope) : { ok: true, skills: [] };
       const runtimeSkills2 = skillsFetch.ok ? skillsFetch.skills : null;
       const skillsHash = runtimeSkills2 !== null ? skillsFingerprint(runtimeSkills2) : void 0;
+      if (harnessExecutionTarget) {
+        await assertLocalSecretDelivery({
+          bearer: authHeader,
+          projectId,
+          environmentId,
+          environmentUnresolvedReason
+        });
+      }
       const runtimeSecrets = runtimeSecretsOverride ?? null;
       const secretEnv = runtimeSecrets ? toSecretEnv(runtimeSecrets) : void 0;
       const externalAccountCredentialNames = harnessAdapter.modelAccess === "external-account" ? harnessAdapter.externalAccountCredentialEnv : void 0;
@@ -150167,6 +150923,18 @@ async function runHarnessTurn(options, streamSink) {
         }
       }
       tClaim = Date.now();
+      const localComputerId = harnessExecutionTarget ? `${harnessExecutionTarget.machineId}:${harnessExecutionTarget.runtimeId}` : void 0;
+      const localEligibility = localComputerId ? getHarnessResumeEligibility({
+        state: continuity?.state ?? null,
+        computerId: localComputerId,
+        sandboxId: continuity?.state?.harnessSessionId ?? ""
+      }) : void 0;
+      if (harnessExecutionTarget && isApprovalResume && !(localEligibility?.resume && continuity?.state?.awaitingApproval)) {
+        throw new Error(
+          "The local session for this approval is no longer available. Start a new turn."
+        );
+      }
+      const localSessionId = harnessExecutionTarget ? localEligibility?.resume ? continuity.state.harnessSessionId : `local-${crypto.randomUUID()}` : void 0;
       let localPrepared = null;
       if (harnessExecutionTarget) {
         const localRunId = crypto.randomUUID();
@@ -150174,7 +150942,7 @@ async function runHarnessTurn(options, streamSink) {
           target: harnessExecutionTarget,
           harnessId: harnessAdapter.id,
           modelId,
-          sessionId: `local-${localRunId}`,
+          sessionId: localSessionId,
           runId: localRunId,
           actor: {
             isGuest: false,
@@ -150185,6 +150953,8 @@ async function runHarnessTurn(options, streamSink) {
           projectId,
           bearer: authHeader,
           requireToolApproval,
+          scopedEnv: sessionSecretEnv,
+          onSecretEnvDelivered,
           ...abortSignal ? { signal: abortSignal } : {}
         });
         if (!preparation.ok) {
@@ -150194,6 +150964,7 @@ async function runHarnessTurn(options, streamSink) {
         }
         localPrepared = preparation.prepared;
         localTeardown = preparation.prepared.teardown;
+        discardLocalState = preparation.prepared.discardState;
         if (localPrepared.permissionMode !== permissionMode) {
           throw new Error(
             `Can't run this turn on your machine: the consented permission profile resolves to ${localPrepared.permissionMode} but the agent was configured for ${permissionMode}.`
@@ -150224,62 +150995,64 @@ async function runHarnessTurn(options, streamSink) {
         };
         sandboxId = resolved.sandboxId;
       }
-      const computerId = localPrepared !== null ? `${harnessExecutionTarget.machineId}:${localPrepared.plan.runtime.runtimeId}` : box.kind === "computer" ? box.computerId : box.sandboxRowId;
+      const computerId = localPrepared !== null ? localComputerId : box.kind === "computer" ? box.computerId : box.sandboxRowId;
       const uploadQuotaComputerId = box !== null && box.kind === "computer" ? box.computerId : void 0;
       tSandbox = Date.now();
       const turnRunId = crypto.randomUUID();
-      const reservation = await reserveHarnessBox({
-        box,
-        harnessId: harnessAdapter.id,
-        modelId,
-        runId: turnRunId,
-        bearer: authHeader,
-        ...abortSignal ? { signal: abortSignal } : {}
-      });
-      if (!reservation.ok) {
-        throw new Error(reservation.error);
-      }
-      reservationHeld = true;
-      releaseBoxReservation = async () => {
-        await releaseHarnessBoxReservation({
-          box,
-          harnessId: harnessAdapter.id,
-          modelId,
-          runId: turnRunId,
-          bearer: authHeader,
-          signal: AbortSignal.timeout(HARNESS_TEARDOWN_TIMEOUT_MS)
-        }).catch(() => {
-        });
-      };
-      reservationHeartbeatTimer = setInterval(() => {
-        if (!reservationHeld || reservationRenewalInFlight) return;
-        reservationRenewalInFlight = true;
-        void renewHarnessBoxReservation({
+      if (box !== null) {
+        const reservation = await reserveHarnessBox({
           box,
           harnessId: harnessAdapter.id,
           modelId,
           runId: turnRunId,
           bearer: authHeader,
-          signal: AbortSignal.timeout(HARNESS_TEARDOWN_TIMEOUT_MS)
-        }).then((renewed) => {
-          if (!renewed.ok && reservationHeld) {
-            logger.error(
-              "[harness] preparation reservation was lost; aborting the turn"
-            );
-            livenessAbort.abort(new Error("harness box reservation lost"));
-          }
-        }).catch((err) => {
-          if (reservationHeld) {
-            logger.error(
-              "[harness] preparation reservation renewal failed; aborting the turn",
-              err
-            );
-            livenessAbort.abort(new Error("harness box reservation lost"));
-          }
-        }).finally(() => {
-          reservationRenewalInFlight = false;
+          ...abortSignal ? { signal: abortSignal } : {}
         });
-      }, HARNESS_RESERVATION_HEARTBEAT_MS);
+        if (!reservation.ok) {
+          throw new Error(reservation.error);
+        }
+        reservationHeld = true;
+        releaseBoxReservation = async () => {
+          await releaseHarnessBoxReservation({
+            box,
+            harnessId: harnessAdapter.id,
+            modelId,
+            runId: turnRunId,
+            bearer: authHeader,
+            signal: AbortSignal.timeout(HARNESS_TEARDOWN_TIMEOUT_MS)
+          }).catch(() => {
+          });
+        };
+        reservationHeartbeatTimer = setInterval(() => {
+          if (!reservationHeld || reservationRenewalInFlight) return;
+          reservationRenewalInFlight = true;
+          void renewHarnessBoxReservation({
+            box,
+            harnessId: harnessAdapter.id,
+            modelId,
+            runId: turnRunId,
+            bearer: authHeader,
+            signal: AbortSignal.timeout(HARNESS_TEARDOWN_TIMEOUT_MS)
+          }).then((renewed) => {
+            if (!renewed.ok && reservationHeld) {
+              logger.error(
+                "[harness] preparation reservation was lost; aborting the turn"
+              );
+              livenessAbort.abort(new Error("harness box reservation lost"));
+            }
+          }).catch((err) => {
+            if (reservationHeld) {
+              logger.error(
+                "[harness] preparation reservation renewal failed; aborting the turn",
+                err
+              );
+              livenessAbort.abort(new Error("harness box reservation lost"));
+            }
+          }).finally(() => {
+            reservationRenewalInFlight = false;
+          });
+        }, HARNESS_RESERVATION_HEARTBEAT_MS);
+      }
       const resolvedHarnessWorkdir = resolveWorkingDirectory(
         harnessSandboxBinding?.workdir ?? computerWorkdir
       );
@@ -150359,9 +151132,11 @@ async function runHarnessTurn(options, streamSink) {
         const declared = definition?.needsApproval;
         return declared === true || typeof declared === "function";
       }).map(([name15]) => name15) : [];
+      const skillsBaseDir = localPrepared?.skillsBaseDir ?? harnessAdapter.skillsBaseDir;
       const agent2 = new HarnessAgent({
         harness: harnessRuntime,
         sandbox,
+        ...localPrepared ? { sandboxConfig: { workDir: localPrepared.sandboxWorkDir } } : {},
         // Deliver skills via the adapter's own param (host-agnostic: it writes
         // them natively at the real $HOME — Claude Code under `.claude/skills`,
         // Codex under `.agents/skills`). The per-adapter `prepareSkills` owns the
@@ -150423,20 +151198,20 @@ async function runHarnessTurn(options, streamSink) {
               session: session2,
               skills: deliveredSkills,
               skillsHash: skillsHash ?? "",
-              skillsBase: harnessAdapter.skillsBaseDir,
+              skillsBase: skillsBaseDir,
               ...abortSignal ? { signal: abortSignal } : {}
             }).catch(() => {
             });
             if (preparedSkills && preparedSkills.payload.length > 0) {
               await handOffLegacySkillDirs({
                 session: session2,
-                skillsBase: harnessAdapter.skillsBaseDir,
+                skillsBase: skillsBaseDir,
                 deliveredNames: deliveredSkills.map((s) => s.name),
                 ...abortSignal ? { signal: abortSignal } : {}
               });
               await preseedAdapterSkills({
                 session: session2,
-                skillsBase: harnessAdapter.skillsBaseDir,
+                skillsBase: skillsBaseDir,
                 payload: preparedSkills.payload,
                 trailingNewline: harnessAdapter.skillsWriteOptions.trailingNewline,
                 ...abortSignal ? { signal: abortSignal } : {}
@@ -150446,7 +151221,7 @@ async function runHarnessTurn(options, streamSink) {
               await materializePinnedSkillFiles({
                 session: session2,
                 artifacts: pinnedHarnessSkills,
-                skillsBase: harnessAdapter.skillsBaseDir,
+                skillsBase: skillsBaseDir,
                 ...abortSignal ? { signal: abortSignal } : {}
               }).catch(() => {
               });
@@ -150455,7 +151230,7 @@ async function runHarnessTurn(options, streamSink) {
                 session: session2,
                 files: capabilitySkillFiles(effectiveCapabilities),
                 skillNamesById: deliveredSkillNamesById,
-                skillsBase: harnessAdapter.skillsBaseDir,
+                skillsBase: skillsBaseDir,
                 ...uploadQuotaComputerId ? { computerId: uploadQuotaComputerId } : {},
                 ...abortSignal ? { signal: abortSignal } : {}
               }).catch(() => {
@@ -150474,7 +151249,7 @@ async function runHarnessTurn(options, streamSink) {
               }
               const skillOrigins = deliveredPluginSkillOrigins({
                 set: effectiveCapabilities,
-                skillsBaseDir: harnessAdapter.skillsBaseDir,
+                skillsBaseDir,
                 deliveredNameBySkillId: deliveredSkillNamesById
               });
               if (skillOrigins.length > 0) {
@@ -150494,7 +151269,7 @@ async function runHarnessTurn(options, streamSink) {
                   session: session2,
                   files: fileResult.files,
                   skillNamesById: deliveredSkillNamesById,
-                  skillsBase: harnessAdapter.skillsBaseDir,
+                  skillsBase: skillsBaseDir,
                   ...uploadQuotaComputerId ? { computerId: uploadQuotaComputerId } : {},
                   ...abortSignal ? { signal: abortSignal } : {}
                 }).catch(() => {
@@ -150509,17 +151284,19 @@ async function runHarnessTurn(options, streamSink) {
           });
         }
       });
-      const eligibility = getHarnessResumeEligibility({
+      const eligibility = localEligibility ?? getHarnessResumeEligibility({
         state: continuity?.state ?? null,
         computerId,
-        // Null on the local path: there is no vendor sandbox id, and the
-        // continuity identity is the `<machineId>:<runtimeId>` in `computerId`
-        // above. Passing a placeholder would make a resumed local session look
-        // attachable to a box.
-        sandboxId: sandboxId ?? ""
-      });
-      const resumable = eligibility.resume ? continuity?.state ?? void 0 : void 0;
-      let resetReason = eligibility.reason === "sandbox-replaced" ? "sandbox-replaced" : void 0;
+        sandboxId
+      });
+      const localStateMissing = eligibility.resume && localPrepared?.sessionStateExists === false;
+      if (localStateMissing && isApprovalResume) {
+        throw new Error(
+          "The local session for this approval is no longer available. Start a new turn."
+        );
+      }
+      const resumable = eligibility.resume && !localStateMissing ? continuity?.state ?? void 0 : void 0;
+      let resetReason = localStateMissing ? "resume-failed" : eligibility.reason === "sandbox-replaced" ? "sandbox-replaced" : void 0;
       if (eligibility.reason === "legacy-cold-resume") {
         logger.warn(
           "[harness] resuming a pre-detach sidecar (cold/disk resume; continuity not guaranteed)",
@@ -150542,6 +151319,7 @@ async function runHarnessTurn(options, streamSink) {
           });
           resumedSession = true;
         } catch (resumeErr) {
+          if (localPrepared) throw resumeErr;
           logger.warn("[harness] resume failed; starting fresh", {
             error: resumeErr instanceof Error ? resumeErr.message : resumeErr
           });
@@ -150549,7 +151327,9 @@ async function runHarnessTurn(options, streamSink) {
           session = await agent2.createSession();
         }
       } else {
-        session = await agent2.createSession();
+        session = await agent2.createSession(
+          localSessionId ? { sessionId: localSessionId } : void 0
+        );
       }
       if (resetReason) {
         writer.write({
@@ -150567,7 +151347,7 @@ async function runHarnessTurn(options, streamSink) {
         await materializeSkillFrontmatter({
           session: sandboxFileSession,
           skills: deliveredSkills,
-          skillsBase: harnessAdapter.skillsBaseDir,
+          skillsBase: skillsBaseDir,
           ...abortSignal ? { signal: abortSignal } : {}
         }).catch(() => {
         });
@@ -151156,7 +151936,7 @@ async function runHarnessTurn(options, streamSink) {
               // Names already delivered as cloud skills this turn are the adapter's
               // own dirs — not adoptions.
               managedNames: new Set(deliveredSkills.map((s) => s.name)),
-              skillsBase: harnessAdapter.skillsBaseDir,
+              skillsBase: skillsBaseDir,
               // The turn's `abortSignal` bounded nothing here: this branch only
               // runs on a CLEAN success, where that signal is by definition not
               // aborted. Compose it with a deadline so a stalled adoption can't
@@ -151172,7 +151952,7 @@ async function runHarnessTurn(options, streamSink) {
               await appendManagedSkills({
                 session: fileSession,
                 skills: adopted,
-                skillsBase: harnessAdapter.skillsBaseDir
+                skillsBase: skillsBaseDir
               }).catch(() => {
               });
             }
@@ -151194,7 +151974,8 @@ async function runHarnessTurn(options, streamSink) {
               // hanging here is not.
               signal: AbortSignal.timeout(HARNESS_TEARDOWN_TIMEOUT_MS)
             });
-            if (!ok) await releaseHarnessLease?.();
+            retainLocalState = ok;
+            if (!ok && !localPrepared) await releaseHarnessLease?.();
           } else if (runSucceeded && !aborted && continuity) {
             const resumeState = await session.detach();
             capturedHarnessCommit = {
@@ -151216,7 +151997,7 @@ async function runHarnessTurn(options, streamSink) {
             };
           } else {
             await session.destroy();
-            if (continuity) await releaseHarnessLease?.();
+            if (continuity && !localPrepared) await releaseHarnessLease?.();
           }
         } catch (finalizeErr) {
           logger.warn(
@@ -151224,7 +152005,7 @@ async function runHarnessTurn(options, streamSink) {
             { error: finalizeErr }
           );
           capturedHarnessCommit = void 0;
-          await releaseHarnessLease?.();
+          if (!localPrepared) await releaseHarnessLease?.();
         }
       }
     } catch (err) {
@@ -151314,6 +152095,9 @@ async function runHarnessTurn(options, streamSink) {
           runSucceeded ? capturedHarnessCommit : void 0
         );
         persistOk = !onConversationComplete || persistOutcome === void 0 || persistOutcome.outcome === "saved" || persistOutcome.outcome === "duplicate";
+        if (capturedHarnessCommit && onConversationComplete && persistOk) {
+          retainLocalState = true;
+        }
         if (persistOutcome && chatSessionId) {
           writePersistReceipt(receiptWriter, persistOutcome, {
             chatSessionId,
@@ -151323,11 +152107,21 @@ async function runHarnessTurn(options, streamSink) {
       } catch (persistErr) {
         logger.error("[harness] onConversationComplete failed", persistErr);
       }
-      if (runSucceeded && capturedHarnessCommit && (!onConversationComplete || !persistOk)) {
+      if (runSucceeded && capturedHarnessCommit && !discardLocalState && (!onConversationComplete || !persistOk)) {
         await releaseHarnessLease?.();
       }
     }
-    if (!sessionEstablished) {
+    if (discardLocalState && !retainLocalState) {
+      await Promise.race([
+        discardLocalState().catch((error) => {
+          logger.warn("[harness] local session state cleanup failed", { error });
+        }),
+        new Promise(
+          (resolvePromise) => setTimeout(resolvePromise, HARNESS_TEARDOWN_TIMEOUT_MS).unref?.()
+        )
+      ]);
+    }
+    if (!sessionEstablished || discardLocalState && !retainLocalState) {
       await releaseHarnessLease?.();
     }
     try {
@@ -161939,7 +162733,7 @@ function platformRefusalHint(refusal) {
   return refusal.canTopUp === false ? `${when} This is a usage limit: topping up credits does not lift it.` : when;
 }
 function readSdkVersion3() {
-  return "8.17.0";
+  return "8.18.0";
 }
 var DEFAULT_PLATFORM_API_BASE_URL = "https://app.mcpjam.com/api/v1";
 function resolvePlatformRequestUrl(spec) {
@@ -166645,6 +167439,10 @@ var ASSERTION_STAGE3 = {
   // ── Tool call: was the call itself well formed ──────────────────────────
   argumentsMatchToolSchema: "call",
   noRepeatedIdenticalCall: "call",
+  // What went INTO the call, so a wrong argument files as `argumentMismatch`.
+  // A never-called tool on its own also files here; pair it with a
+  // `toolCalledWith` (which files at `selection`, earlier) to attribute that.
+  toolInputMatches: "call",
   // ── Response: what the server answered with ─────────────────────────────
   //
   // `noToolErrors` MOVED HERE in analyzer 11, from `userValue` where it had
@@ -166658,6 +167456,8 @@ var ASSERTION_STAGE3 = {
   noToolErrors: "response",
   toolLatencyUnder: "response",
   toolResultContains: "response",
+  // What came OUT of the call, like the other `toolResult*` checks.
+  toolResultMatches: "response",
   toolResultMatchesSchema: "response",
   toolResultSizeUnder: "response",
   toolErrorNamesInput: "response",
@@ -200366,7 +201166,7 @@ function boolOf(value) {
 function integrityOf(value) {
   return value === "valid" || value === "invalid" ? value : null;
 }
-function countOf(value) {
+function countOf2(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : 0;
 }
 function scoreContractSide(value) {
@@ -200374,8 +201174,8 @@ function scoreContractSide(value) {
   return {
     evaluationConfigHash: strOrNull(side.evaluationConfigHash),
     scoreIntegrity: integrityOf(side.scoreIntegrity),
-    scoredIterations: countOf(side.scoredIterations),
-    quarantinedIterations: countOf(side.quarantinedIterations)
+    scoredIterations: countOf2(side.scoredIterations),
+    quarantinedIterations: countOf2(side.quarantinedIterations)
   };
 }
 function scoreContract(value) {
@@ -200393,10 +201193,10 @@ function scoreContract(value) {
       passRate: numericDiff(scorer.passRate),
       meanValue: numericDiff(scorer.meanValue),
       errorCount: {
-        base: countOf(
+        base: countOf2(
           isRecord31(scorer.errorCount) ? scorer.errorCount.base : void 0
         ),
-        compare: countOf(
+        compare: countOf2(
           isRecord31(scorer.errorCount) ? scorer.errorCount.compare : void 0
         )
       }
@@ -200479,15 +201279,15 @@ function runSide(value) {
   const environment = isRecord31(run3.environment) ? run3.environment : null;
   return {
     id: str2(run3.id),
-    runNumber: countOf(run3.runNumber),
+    runNumber: countOf2(run3.runNumber),
     result: str2(run3.result),
-    createdAt: countOf(run3.createdAt),
+    createdAt: countOf2(run3.createdAt),
     completedAt: numOrNull(run3.completedAt),
     summary: summary ? {
-      total: countOf(summary.total),
-      passed: countOf(summary.passed),
-      failed: countOf(summary.failed),
-      passRate: countOf(summary.passRate)
+      total: countOf2(summary.total),
+      passed: countOf2(summary.passed),
+      failed: countOf2(summary.failed),
+      passRate: countOf2(summary.passRate)
     } : null,
     ...environment ? {
       environment: {
@@ -200517,10 +201317,10 @@ function skills(value) {
   const compare = isRecord31(value.compare) ? value.compare : {};
   const changes = Array.isArray(value.changes) ? value.changes : [];
   return {
-    base: { excluded: boolOf(base.excluded), count: countOf(base.count) },
+    base: { excluded: boolOf(base.excluded), count: countOf2(base.count) },
     compare: {
       excluded: boolOf(compare.excluded),
-      count: countOf(compare.count)
+      count: countOf2(compare.count)
     },
     changes: changes.filter(isRecord31).map((row2) => {
       const baseSide = skillSide(row2.base);
@@ -200537,7 +201337,7 @@ function skills(value) {
         ...typeof row2.versionDelta === "string" ? { versionDelta: row2.versionDelta } : {}
       };
     }),
-    unchangedCount: countOf(value.unchangedCount)
+    unchangedCount: countOf2(value.unchangedCount)
   };
 }
 function toRunCompareDto(diff, baseline) {
@@ -202768,6 +203568,34 @@ function evalSnapshotUploadTarget(convexAuthToken, iterationId) {
   } : void 0;
 }
 
+// server/utils/upload-receipt.ts
+async function confirmUploadedObject(args) {
+  if (args.uploadGrantId === void 0) return;
+  if (!args.serviceToken)
+    throw new Error("Upload receipt requires service credentials");
+  const response = await fetch(
+    `${args.convexHttpUrl}/internal/v1/uploads/complete`,
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${args.bearer}`,
+        "Content-Type": "application/json",
+        [INSPECTOR_SERVICE_TOKEN_HEADER]: args.serviceToken
+      },
+      body: JSON.stringify({
+        uploadGrantId: args.uploadGrantId,
+        storageId: args.storageId
+      }),
+      redirect: "error",
+      signal: AbortSignal.any([args.signal, AbortSignal.timeout(1e4)])
+    }
+  );
+  const body = await response.json().catch(() => null);
+  if (!response.ok || body?.ok !== true) {
+    throw new Error("Upload receipt was refused");
+  }
+}
+
 // server/utils/storage-destination.ts
 function isUsableStorageDestination(value) {
   if (typeof value !== "string" || !value) return false;
@@ -203007,10 +203835,13 @@ async function requestReplayVideoDestination(target, serviceToken3, signal) {
       `Replay video upload was refused (${response.status})${typeof body?.error === "string" ? `: ${body.error}` : ""}`
     );
   }
-  if (!isUsableStorageDestination(body?.uploadUrl)) {
+  if (!isUsableStorageDestination(body?.uploadUrl) || body?.uploadGrantId !== void 0 && (typeof body.uploadGrantId !== "string" || !body.uploadGrantId)) {
     throw new Error("Replay video upload got no usable destination");
   }
-  return body.uploadUrl;
+  return {
+    uploadUrl: body.uploadUrl,
+    uploadGrantId: body.uploadGrantId
+  };
 }
 async function storeReplayVideo(target, body, contentType, signal) {
   const serviceToken3 = getConfiguredInspectorServiceToken();
@@ -203025,7 +203856,7 @@ async function storeReplayVideo(target, body, contentType, signal) {
     serviceToken3,
     signal
   );
-  const response = await fetch(destination, {
+  const response = await fetch(destination.uploadUrl, {
     method: "POST",
     headers: { "Content-Type": contentType },
     body,
@@ -203041,7 +203872,17 @@ async function storeReplayVideo(target, body, contentType, signal) {
   } catch (err) {
     if (signal.aborted) throw err;
   }
-  return typeof stored?.storageId === "string" && stored.storageId ? stored.storageId : void 0;
+  if (typeof stored?.storageId !== "string" || !stored.storageId)
+    return void 0;
+  await confirmUploadedObject({
+    convexHttpUrl: process.env.CONVEX_HTTP_URL,
+    bearer: target.convexAuthToken,
+    serviceToken: serviceToken3,
+    uploadGrantId: destination.uploadGrantId,
+    storageId: stored.storageId,
+    signal
+  });
+  return stored.storageId;
 }
 async function uploadVideoBlob(target, bytes2, options = {}) {
   const contentType = options.contentType || DEFAULT_REPLAY_VIDEO_MIME;
@@ -203078,7 +203919,9 @@ async function captureMcpAppWidgetSnapshots(params) {
   const snapshots = await Promise.all(
     sources.map(async (source) => {
       try {
-        const toolMetadata = params.mcpClientManager.getAllToolsMetadata(source.serverId)?.[source.toolName];
+        const toolMetadata = params.mcpClientManager.getAllToolsMetadata(
+          source.serverId
+        )?.[source.toolName];
         if (!isRecord36(toolMetadata) || !isMcpAppTool(toolMetadata)) {
           return null;
         }
@@ -203133,13 +203976,16 @@ async function captureMcpAppWidgetSnapshots(params) {
           }
           snapshot2.injectedOpenAiCompat = shouldInjectOpenAiCompat;
         } catch (error) {
-          logger.warn(`${LOG_PREFIX} Failed to capture MCP App widget snapshot`, {
-            toolCallId: source.toolCallId,
-            toolName: source.toolName,
-            serverId: source.serverId,
-            resourceUri,
-            error: error instanceof Error ? error.message : String(error)
-          });
+          logger.warn(
+            `${LOG_PREFIX} Failed to capture MCP App widget snapshot`,
+            {
+              toolCallId: source.toolCallId,
+              toolName: source.toolName,
+              serverId: source.serverId,
+              resourceUri,
+              error: error instanceof Error ? error.message : String(error)
+            }
+          );
         }
         return snapshot2;
       } catch (error) {
@@ -204862,9 +205708,21 @@ function environmentServerNames(resolved) {
 function environmentServerRefsForManager(resolved, manager) {
   const serverIds = environmentServerIds(resolved);
   const serverNames = environmentServerNames(resolved);
-  return serverIds.map(
+  const refs = serverIds.map(
     (serverId, index) => manager.hasServer(serverId) ? serverId : serverNames[index] ?? serverId
   );
+  const selection = resolved.environmentRef.serverSelection;
+  if (selection?.mode === "local") {
+    if (resolved.runtimeVenue !== "local") {
+      throw new WebRouteError(
+        409,
+        ErrorCode.CONFLICT,
+        "This environment requires a local runner."
+      );
+    }
+    refs.push(...selection.names);
+  }
+  return [...new Set(refs)];
 }
 function environmentEffectiveServerIds(resolved) {
   return resolved.effectiveServerIds ?? resolved.selectedServerIds;
@@ -204887,7 +205745,9 @@ async function resolveEnvironmentForLaunch(convexClient6, args) {
         "This deployment cannot resolve project environments yet. Retry after the backend deploys."
       );
     }
-    if (args.serverSource && /Object contains extra field [`'"]?serverSource(?:[`'"]|\b)/i.test(message)) {
+    if (args.serverSource && /Object contains extra field [`'"]?serverSource(?:[`'"]|\b)/i.test(
+      message
+    )) {
       if (!loggedServerSourceDowngrade) {
         loggedServerSourceDowngrade = true;
         logger.warn(
@@ -204910,7 +205770,10 @@ async function resolveEnvironmentForLaunch(convexClient6, args) {
       "Environment not found (it may have been archived). Update the suite's environments and retry."
     );
   }
-  return resolved;
+  return {
+    ...resolved,
+    ...args.runtimeVenue ? { runtimeVenue: args.runtimeVenue } : {}
+  };
 }
 function isEnvironmentLaunchConflict(error) {
   const data = error?.data;
@@ -204955,10 +205818,15 @@ function environmentLaunchRejectionError(error) {
   const status = LAUNCH_REJECTION_STATUS[code];
   if (!status) return null;
   if (status === 404) {
-    return new WebRouteError(404, ErrorCode.NOT_FOUND, "Environment not found", {
-      code: "ENV_NOT_FOUND",
-      reason: "env_not_found"
-    });
+    return new WebRouteError(
+      404,
+      ErrorCode.NOT_FOUND,
+      "Environment not found",
+      {
+        code: "ENV_NOT_FOUND",
+        reason: "env_not_found"
+      }
+    );
   }
   const message = typeof record5.message === "string" && record5.message.trim() ? record5.message : "This eval run could not be started as requested.";
   const details = record5.details && typeof record5.details === "object" && !Array.isArray(record5.details) ? record5.details : {};
@@ -205306,6 +206174,7 @@ var startSuiteRunWithRecorder = async ({
   namedHostId,
   runGroupId,
   environmentId,
+  runtimeVenue,
   expectedEnvironmentRevision,
   expectedEnvironmentHostConfigId,
   expectedEnvironmentServerIds,
@@ -205338,6 +206207,7 @@ var startSuiteRunWithRecorder = async ({
       ...namedHostId ? { namedHostId } : {},
       ...runGroupId ? { runGroupId } : {},
       ...environmentId ? { environmentId } : {},
+      ...runtimeVenue ? { runtimeVenue } : {},
       ...expectedEnvironmentRevision !== void 0 ? { expectedEnvironmentRevision } : {},
       ...expectedEnvironmentHostConfigId !== void 0 ? { expectedEnvironmentHostConfigId } : {},
       ...expectedEnvironmentServerIds !== void 0 ? { expectedEnvironmentServerIds } : {},
@@ -207630,6 +208500,7 @@ function createStepExecutionState() {
     toolCalls: [],
     toolCallsByTurn: [],
     toolErrors: [],
+    spans: [],
     widgetRenderObservations: [],
     assertionResults: [],
     interactionFailures: [],
@@ -207649,8 +208520,10 @@ function recordToolCalls(state, turn, calls) {
 }
 function applyOutcome(state, outcome, turn) {
   if (outcome.messages?.length) state.messages.push(...outcome.messages);
-  if (outcome.toolCalls?.length) recordToolCalls(state, turn, outcome.toolCalls);
+  if (outcome.toolCalls?.length)
+    recordToolCalls(state, turn, outcome.toolCalls);
   if (outcome.toolErrors?.length) state.toolErrors.push(...outcome.toolErrors);
+  if (outcome.spans?.length) state.spans.push(...outcome.spans);
   if (outcome.usage) {
     state.usage.inputTokens += outcome.usage.inputTokens ?? 0;
     state.usage.outputTokens += outcome.usage.outputTokens ?? 0;
@@ -207659,8 +208532,16 @@ function applyOutcome(state, outcome, turn) {
 }
 function snapshotTranscript(state) {
   const finalAssistantMessage = extractFinalAssistantMessage(state.messages);
+  const evidence = extractTranscriptEvidence({
+    messages: state.messages,
+    spans: state.spans
+  });
   return buildIterationTranscript({
     toolCalls: state.toolCalls,
+    toolResults: evidence.toolResults,
+    resultsCaptured: evidence.resultsCaptured,
+    toolCallTimings: evidence.toolCallTimings,
+    timingsCaptured: evidence.timingsCaptured,
     ...finalAssistantMessage !== void 0 ? { finalAssistantMessage } : {},
     usage: state.usage.inputTokens || state.usage.outputTokens || state.usage.totalTokens ? state.usage : void 0,
     renderObservations: summarizeRenderObservations(
@@ -207704,7 +208585,11 @@ async function drainAndDriveFollowUps(stepLabel, stepIndex, turn, browser, handl
         return void 0;
       }
       remaining -= 1;
-      const outcome = await handlers.onFollowUp({ text: text2, stepIndex, turnOrdinal: turn });
+      const outcome = await handlers.onFollowUp({
+        text: text2,
+        stepIndex,
+        turnOrdinal: turn
+      });
       applyOutcome(state, outcome, turn);
       if (outcome.cancelled || outcome.iterationError) return outcome;
     }
@@ -207817,7 +208702,8 @@ async function executeSteps(args) {
       emitStatus(stepIndex, "running");
       const outcome = await handlers.onPrompt({ step, stepIndex, turnOrdinal });
       applyOutcome(state, outcome, turnOrdinal);
-      if (outcome.cancelled) return { state, cancelled: true, setupFailure: false };
+      if (outcome.cancelled)
+        return { state, cancelled: true, setupFailure: false };
       if (outcome.iterationError) {
         emitStatus(stepIndex, "fail");
         recordSkippedSteps(
@@ -207856,7 +208742,8 @@ async function executeSteps(args) {
         turnOrdinal
       });
       applyOutcome(state, outcome, turnOrdinal);
-      if (outcome.cancelled) return { state, cancelled: true, setupFailure: false };
+      if (outcome.cancelled)
+        return { state, cancelled: true, setupFailure: false };
       if (outcome.iterationError) {
         emitStatus(stepIndex, "fail");
         recordSkippedSteps(
@@ -208511,6 +209398,7 @@ function buildLocalStepHandlers(ctx) {
   const acc = ctx.acc;
   async function drive(promptTurn, turnOrdinal) {
     const messagesBefore = acc.conversationMessages.length;
+    const spansBefore = acc.capturedSpans.length;
     const inBefore = acc.accumulatedUsage.inputTokens ?? 0;
     const outBefore = acc.accumulatedUsage.outputTokens ?? 0;
     const totalBefore = acc.accumulatedUsage.totalTokens ?? 0;
@@ -208523,6 +209411,7 @@ function buildLocalStepHandlers(ctx) {
       sinks: buildSinks?.(turnOrdinal, promptTurn.prompt)
     });
     const messages = acc.conversationMessages.slice(messagesBefore);
+    const spans = acc.capturedSpans.slice(spansBefore);
     const toolCalls = acc.toolsCalledByPrompt[turnOrdinal] ?? [];
     const toolErrors = acc.toolErrorsByPrompt[turnOrdinal] ?? [];
     const usage = {
@@ -208535,6 +209424,7 @@ function buildLocalStepHandlers(ctx) {
       ...messages.length ? { messages } : {},
       ...toolCalls.length ? { toolCalls } : {},
       ...toolErrors.length ? { toolErrors } : {},
+      ...spans.length ? { spans } : {},
       usage,
       // Optional-chained: `driveLocalEvalTurn` always returns an outcome, but
       // this bridge has no business crashing over one it did not get.
@@ -208578,6 +209468,7 @@ function buildLocalStepHandlers(ctx) {
       ...messages.length ? { messages } : {},
       ...toolCalls.length ? { toolCalls } : {},
       ...toolErrors.length ? { toolErrors } : {},
+      ...spans.length ? { spans } : {},
       usage,
       // Optional-chained: `driveLocalEvalTurn` always returns an outcome, but
       // this bridge has no business crashing over one it did not get.
@@ -208618,6 +209509,7 @@ function buildHostedStepHandlers(ctx) {
   const acc = ctx.acc;
   async function drivePrompt(prompt, turnOrdinal) {
     const messagesBefore = acc.messageHistory.length;
+    const spansBefore = acc.capturedSpans.length;
     const inBefore = acc.accumulatedUsage.inputTokens ?? 0;
     const outBefore = acc.accumulatedUsage.outputTokens ?? 0;
     const totalBefore = acc.accumulatedUsage.totalTokens ?? 0;
@@ -208628,6 +209520,7 @@ function buildHostedStepHandlers(ctx) {
       acc
     });
     const messages = acc.messageHistory.slice(messagesBefore);
+    const spans = acc.capturedSpans.slice(spansBefore);
     const toolCalls = acc.toolsCalledByPrompt[turnOrdinal] ?? [];
     const usage = {
       inputTokens: (acc.accumulatedUsage.inputTokens ?? 0) - inBefore,
@@ -208637,6 +209530,7 @@ function buildHostedStepHandlers(ctx) {
     return {
       ...messages.length ? { messages } : {},
       ...toolCalls.length ? { toolCalls } : {},
+      ...spans.length ? { spans } : {},
       usage,
       ...outcome.kind === "cancelled" ? { cancelled: true } : {},
       ...outcome.kind === "failed" ? {
@@ -208685,6 +209579,7 @@ function buildHostedStepHandlers(ctx) {
       ...messages.length ? { messages } : {},
       ...toolCalls.length ? { toolCalls } : {},
       ...toolErrors.length ? { toolErrors } : {},
+      ...spans.length ? { spans } : {},
       usage,
       ...outcome.kind === "cancelled" ? { cancelled: true } : {},
       ...outcome.kind === "failed" ? {
@@ -210020,6 +210915,7 @@ async function commitEnvironmentQuickRun(convexClient6, args) {
         startedAt: args.startedAt,
         environment: {
           environmentId: args.resolved.environmentRef.environmentId,
+          ...args.resolved.runtimeVenue === "local" ? { runtimeVenue: "local" } : {},
           expectedRevision: args.resolved.environmentRef.revision,
           ...args.resolved.hostConfigId ? { expectedHostConfigId: args.resolved.hostConfigId } : {},
           expectedServerIds: environmentEffectiveServerIds(args.resolved)
@@ -218323,6 +219219,7 @@ async function prepareEvalRun(clientManager, request3) {
     }
     environmentLaunch = resolvedEnvironment && resolvedEnvironment.environmentRef.environmentId === environmentId ? resolvedEnvironment : await resolveEnvironmentForLaunch(convexClient6, {
       serverSource: EVAL_LAUNCH_SERVER_SOURCE,
+      ...request3.runtimeVenue ? { runtimeVenue: request3.runtimeVenue } : {},
       projectId,
       environmentId
     }).catch((error) => {
@@ -218418,6 +219315,7 @@ async function prepareEvalRun(clientManager, request3) {
     // environment resolves to at an unchanged revision. Echoing all three lets
     // the mutation reject that drift instead of starting a run whose tool
     // snapshot describes a different configuration than it executes.
+    ...environmentLaunch?.runtimeVenue === "local" ? { runtimeVenue: "local" } : {},
     expectedEnvironmentRevision: environmentLaunch?.environmentRef.revision,
     expectedEnvironmentHostConfigId: environmentLaunch?.hostConfigId,
     expectedEnvironmentServerIds: environmentLaunch ? environmentEffectiveServerIds(environmentLaunch) : void 0,
@@ -218818,6 +219716,7 @@ async function prepareSingleCaseExecution(clientManager, request3) {
     assertNoConflictingEnvironmentOverrides(request3);
     environmentLaunch = request3.resolvedEnvironment && request3.resolvedEnvironment.environmentRef.environmentId === environmentId ? request3.resolvedEnvironment : await resolveEnvironmentForLaunch(convexClient6, {
       serverSource: EVAL_LAUNCH_SERVER_SOURCE,
+      ...request3.runtimeVenue ? { runtimeVenue: request3.runtimeVenue } : {},
       projectId,
       environmentId
     }).catch((error) => {
@@ -219166,6 +220065,7 @@ async function resolveGenerationServers(clientManager, request3) {
       createConvexClients(request3.convexAuthToken).convexClient,
       {
         serverSource: EVAL_LAUNCH_SERVER_SOURCE,
+        ...request3.runtimeVenue ? { runtimeVenue: request3.runtimeVenue } : {},
         projectId: request3.projectId,
         environmentId: request3.environmentId
       }
@@ -227421,10 +228321,10 @@ evals2.post("/run", async (c) => {
         400
       );
     }
-    const prepared = await prepareEvalRun(
-      c.mcpClientManager,
-      validationResult.data
-    );
+    const prepared = await prepareEvalRun(c.mcpClientManager, {
+      ...validationResult.data,
+      runtimeVenue: "local"
+    });
     detachPreparedEvalRun({
       prepared,
       convexAuthToken: validationResult.data.convexAuthToken,
@@ -227590,10 +228490,10 @@ evals2.post("/run-test-case", async (c) => {
       );
     }
     return c.json(
-      await runEvalTestCaseWithManager(
-        c.mcpClientManager,
-        validationResult.data
-      )
+      await runEvalTestCaseWithManager(c.mcpClientManager, {
+        ...validationResult.data,
+        runtimeVenue: "local"
+      })
     );
   } catch (error) {
     reportRouteFailure("[Error running test case]", error, {
@@ -227619,7 +228519,7 @@ evals2.post("/stream-test-case", async (c) => {
     }
     const stream = await streamEvalTestCaseWithManager(
       c.mcpClientManager,
-      validationResult.data,
+      { ...validationResult.data, runtimeVenue: "local" },
       // Client disconnect aborts the run (including any awaited task).
       { requestSignal: c.req.raw.signal }
     );
@@ -227686,10 +228586,10 @@ evals2.post("/generate-tests", async (c) => {
       );
     }
     return c.json(
-      await generateEvalTestsWithManager(
-        c.mcpClientManager,
-        validationResult.data
-      )
+      await generateEvalTestsWithManager(c.mcpClientManager, {
+        ...validationResult.data,
+        runtimeVenue: "local"
+      })
     );
   } catch (error) {
     reportRouteFailure("Error in /evals/generate-tests", error, {
@@ -227713,10 +228613,10 @@ evals2.post("/generate-negative-tests", async (c) => {
       );
     }
     return c.json(
-      await generateNegativeEvalTestsWithManager(
-        c.mcpClientManager,
-        validationResult.data
-      )
+      await generateNegativeEvalTestsWithManager(c.mcpClientManager, {
+        ...validationResult.data,
+        runtimeVenue: "local"
+      })
     );
   } catch (error) {
     reportRouteFailure("Error in /evals/generate-negative-tests", error, {
@@ -230171,8 +231071,8 @@ function formatDisplayPath2(fullPath) {
 }
 async function directoryExists3(dirPath) {
   try {
-    const stat7 = await fs3.stat(dirPath);
-    return stat7.isDirectory();
+    const stat8 = await fs3.stat(dirPath);
+    return stat8.isDirectory();
   } catch {
     return false;
   }
@@ -230569,8 +231469,8 @@ skills2.post("/read-file", async (c) => {
     }
     const fullPath = path7.join(skillDir, filePath);
     try {
-      const stat7 = await fs3.stat(fullPath);
-      if (!stat7.isFile()) {
+      const stat8 = await fs3.stat(fullPath);
+      if (!stat8.isFile()) {
         return c.json({ success: false, error: "Path is not a file" }, 400);
       }
       const mimeType = getMimeType(filePath);
@@ -230580,15 +231480,15 @@ skills2.post("/read-file", async (c) => {
         path: filePath,
         name: fileName,
         mimeType,
-        size: stat7.size,
+        size: stat8.size,
         isText
       };
       const maxSize = isText ? 1024 * 1024 : 5 * 1024 * 1024;
-      if (stat7.size > maxSize) {
+      if (stat8.size > maxSize) {
         return c.json(
           {
             success: false,
-            error: `File too large (${(stat7.size / 1024 / 1024).toFixed(2)}MB). Maximum is ${maxSize / 1024 / 1024}MB`
+            error: `File too large (${(stat8.size / 1024 / 1024).toFixed(2)}MB). Maximum is ${maxSize / 1024 / 1024}MB`
           },
           400
         );
@@ -256573,14 +257473,17 @@ async function requestArchiveDestination(c, projectId) {
         typeof body?.error === "string" ? body.error : "Backend error"
       );
     }
-    if (!isUsableStorageDestination(body?.uploadUrl)) {
+    if (!isUsableStorageDestination(body?.uploadUrl) || body?.uploadGrantId !== void 0 && (typeof body.uploadGrantId !== "string" || !body.uploadGrantId)) {
       throw new WebRouteError(
         502,
         ErrorCode.INTERNAL_ERROR,
         UPLOAD_FAILED_MESSAGE
       );
     }
-    return body.uploadUrl;
+    return {
+      uploadUrl: body.uploadUrl,
+      uploadGrantId: body.uploadGrantId
+    };
   } catch (error) {
     if (error instanceof WebRouteError) throw error;
     if (controller.signal.aborted) {
@@ -256659,7 +257562,7 @@ function handleBrowserProfileUpload(c) {
       ARCHIVE_UPLOAD_TIMEOUT_MS
     );
     try {
-      const response = await fetch(destination, {
+      const response = await fetch(destination.uploadUrl, {
         method: "POST",
         headers: {
           "Content-Type": "application/octet-stream",
@@ -256684,6 +257587,14 @@ function handleBrowserProfileUpload(c) {
           UPLOAD_FAILED_MESSAGE
         );
       }
+      await confirmUploadedObject({
+        convexHttpUrl: convexHttpUrl2(),
+        bearer: await getConvexBearerForRequest(c),
+        serviceToken: getConfiguredInspectorServiceToken(),
+        uploadGrantId: destination.uploadGrantId,
+        storageId: stored.storageId,
+        signal: AbortSignal.any([controller.signal, c.req.raw.signal])
+      });
       return { storageId: stored.storageId };
     } catch (error) {
       if (error instanceof WebRouteError) throw error;
@@ -274186,7 +275097,11 @@ var AGENT_API_BASE_PROMPT_LINES = [
   "- Author cases as `steps` arrays; prefer a `prompt` step plus `toolCalledWith`-style assertions on the tools the conversation showed. Set `expectedOutput` when the user stated one.",
   "- For new AI-authored cases, use generate_eval_cases and its spend approval flow. Use create/update case tools only for explicit user payloads or already reviewed drafts. Keep each full workflow as ordered steps.",
   `- When creating a suite, set the suite \`model\` explicitly to \`${DEFAULT_SUITE_MODEL}\` unless the user asks for a different model.`,
-  "- Some actions SPEND the user's quota or credits (running a suite or a case, generating cases, cancelling a run). Calling those tools does NOT perform them: it PROPOSES the action and returns an approval id, and a person must click to confirm. Say that you've proposed it and what it will do. NEVER say it has started, is running, or has been cancelled.",
+  // Names the marker `buildGatedProposalTools` puts on every gated tool's
+  // description instead of enumerating the gated operations. The tier follows
+  // each operation's `risk`, so a list here went stale with every new gated
+  // op; the examples are illustrative, not the definition.
+  "- Tools whose description says REQUIRES HUMAN APPROVAL do NOT perform the action when you call them (for example running a suite, a case, or a goal run, generating cases, cancelling a run, setting a schedule, or calling a tool on the user's own server). Calling one PROPOSES the action and returns an approval id, and a person must click to confirm. Say that you've proposed it and what it will do. NEVER say it has started, is running, or has been cancelled.",
   "- If a proposal tool is not available to you, you cannot run anything at all. Say so plainly and report the ids the user needs \u2014 do not imply you started something.",
   "- Always report the ids of anything you created.",
   "- When a tool result carries a `permalinks` array, hand the user that `url` EXACTLY as written. NEVER invent, shorten, or rewrite an MCPJam app URL, and never build one from an id: a hand-made link opens whichever project the reader last selected, which is usually not the one you are talking about. If a result has no permalink, give the id and say where to find it.",
@@ -289420,7 +290335,10 @@ var BENCH_SERVICE_ROUTES = {
 async function postServiceRoute5(path8, body, options) {
   const env = benchServiceConfig();
   const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), SERVICE_ROUTE_TIMEOUT_MS5);
+  const timeout = setTimeout(
+    () => controller.abort(),
+    SERVICE_ROUTE_TIMEOUT_MS5
+  );
   try {
     const response = await fetch(`${env.convexUrl}${path8}`, {
       method: "POST",
@@ -289530,7 +290448,12 @@ function decodeClaimedJob(body) {
     grant,
     ...readNumber3(credentials, "grantExpiresAt") !== void 0 ? { grantExpiresAt: readNumber3(credentials, "grantExpiresAt") } : {},
     runnerBearer,
-    ...readNumber3(credentials, "runnerBearerExpiresAt") !== void 0 ? { runnerBearerExpiresAt: readNumber3(credentials, "runnerBearerExpiresAt") } : {},
+    ...readNumber3(credentials, "runnerBearerExpiresAt") !== void 0 ? {
+      runnerBearerExpiresAt: readNumber3(
+        credentials,
+        "runnerBearerExpiresAt"
+      )
+    } : {},
     ...Array.isArray(body.artifacts) ? { artifacts: body.artifacts } : {}
   };
 }
@@ -289653,7 +290576,9 @@ async function reportExecutionComplete(args) {
     { grant: args.job.grant }
   );
   if (isLeaseLostResponse(status, body)) {
-    throw new LeaseLostError2("execution-complete rejected the lease generation");
+    throw new LeaseLostError2(
+      "execution-complete rejected the lease generation"
+    );
   }
   if (status !== 200 || !body?.ok) {
     throw new Error(`execution-complete rejected (${status})`);
@@ -289736,7 +290661,7 @@ function resolveEvalCellSpec(job, entry3) {
   const missing = [
     cellId ? null : "cellId (roster row)",
     suiteId ? null : "suiteId (claim pins)",
-    environmentId || namedHostId ? null : "environmentId/namedHostId (the cell's pinned model and client profile)"
+    environmentId ? null : "environmentId (the cell's pinned execution configuration)"
   ].filter((field) => field !== null);
   if (missing.length > 0) {
     throw new JobUnexecutableError(
@@ -289818,7 +290743,9 @@ function assertClaimExecutable(job) {
     throw new JobUnexecutableError("the claim carried no benchmark run id");
   }
   if (!job.pins?.definitionHash) {
-    throw new JobUnexecutableError("the claim carried no pinned definition hash");
+    throw new JobUnexecutableError(
+      "the claim carried no pinned definition hash"
+    );
   }
   for (const entry3 of job.roster ?? []) {
     if (TERMINAL_EVIDENCE_STATUSES.has(entry3.status)) continue;
@@ -289882,6 +290809,11 @@ function buildWriteGuard(cell, benchmarkRunId, ledger) {
 }
 async function defaultRunEvalCell(args) {
   const { job, cell } = args;
+  if (!cell.environmentId) {
+    throw new JobUnexecutableError(
+      "Benchmark cell has no prepared environment."
+    );
+  }
   const writeGuard = buildWriteGuard(cell, job.benchmarkRunId, args.ledger);
   const authorized = await createAuthorizedManager(
     {},
@@ -289916,11 +290848,9 @@ async function defaultRunEvalCell(args) {
       // child ends up filed under the wrong benchmark.
       source: "benchmark",
       benchmarkRunId: job.benchmarkRunId,
-      // An environment cell runs through the environment core. The exam
-      // suite does not run environments, so the launch is ephemeral: the
-      // backend resolves the cell's environment without attaching it. The
-      // host pin is only the fallback for a backend that sends none.
-      ...cell.environmentId ? { environmentId: cell.environmentId, ephemeralEnvironment: true } : cell.namedHostId ? { namedHostId: cell.namedHostId } : {},
+      // Benchmark cells share the canonical environment launch core.
+      environmentId: cell.environmentId,
+      ephemeralEnvironment: true,
       // The CELL's pinned repetition count, not the suite's `runs` default.
       // The scorer's `minimumRepetitionsPerRequiredCell` is a publication
       // floor, so a cell declared at 3 that runs once is not merely thinner