@mcpjam/inspector 3.12.3 → 3.12.5

package/dist/server/chunk-3EDQFXTF.js

@@ -0,0 +1,4801 @@
+import {
+  LOCAL_HARNESS_MANIFEST,
+  LOCAL_HARNESS_POLICY_VERSION,
+  LOCAL_ISOLATION_POLICY_VERSION,
+  createLocalStateMutationLock,
+  currentLocalPlatform,
+  listGroupMembers,
+  localPackTarget,
+  logger,
+  manifestWithExpectedBundleDigest,
+  probeProcess,
+  probeProcessGroup,
+  readProcessBirthIdentity,
+  readProcessGroupId,
+  readRuntimeInstallStatus,
+  reserveRuntimeUse,
+  resolveLocalCompatibility,
+  resolveManagedBundle,
+  resolveSystemInstall,
+  revalidateRuntime,
+  runtimeInstallRoot,
+  supportsOwnershipProof,
+  terminateOwnedProcess,
+  terminateOwnedProcessGroup
+} from "./chunk-QA6VJT6A.js";
+import {
+  HOSTED_MODE,
+  LOCAL_HARNESS_ENABLED,
+  capabilityFingerprint,
+  capabilityMatches,
+  mintCapabilityToken,
+  persistCapabilityState
+} from "./chunk-SH24KJBI.js";
+
+// shared/harness-model-support-evidence.json
+var harness_model_support_evidence_default = {
+  $comment: `Harness x model compatibility evidence. Rows are evaluated in order; the first row whose harness matches, whose versionRange admits the runtime version and whose familyPattern matches the canonical model id wins. versionRange is "*" (any version, including an unknown one), "<=A.B.x" or ">A.B.x". When the runtime version is unknown and a version-specific row's pattern matches, the verdict is unknown. Mirrored byte-for-byte between mcpjam-inspector/shared/harness-model-support-evidence.json (source) and mcpjam-backend convex/lib/harnessModelSupportEvidence.json.`,
+  rows: [
+    {
+      harness: "claude-code",
+      versionRange: "*",
+      familyPattern: "^anthropic/claude-(haiku|sonnet|opus)-\\d+(\\.\\d+)?$",
+      status: "supported",
+      evidence: "Claude Code accepts the haiku/sonnet/opus family ids natively (toClaudeCodeModel maps them to CLI model names).",
+      observedAt: "2026-09-25"
+    },
+    {
+      harness: "claude-code",
+      versionRange: "*",
+      familyPattern: "^anthropic/",
+      status: "unknown",
+      evidence: "Anthropic model outside the haiku/sonnet/opus families: no native Claude Code model id has been verified.",
+      observedAt: "2026-09-25"
+    },
+    {
+      harness: "claude-code",
+      versionRange: "*",
+      familyPattern: ".*",
+      status: "unsupported",
+      evidence: "Claude Code only runs Anthropic models.",
+      observedAt: "2026-09-25"
+    },
+    {
+      harness: "codex",
+      versionRange: "<=0.149.x",
+      familyPattern: "^openai/gpt-5\\.6($|-)",
+      status: "unsupported",
+      evidence: "Loopback capture 2026-09-01: the pinned Codex CLI sends tools: [] for the gpt-5.6 line, so the model cannot call MCP tools.",
+      observedAt: "2026-09-01"
+    },
+    {
+      harness: "codex",
+      versionRange: ">0.149.x",
+      familyPattern: "^openai/gpt-5\\.6($|-)",
+      status: "unknown",
+      evidence: "The gpt-5.6 tool-less behavior was measured only on Codex <=0.149.x; newer CLI versions have not been captured.",
+      observedAt: "2026-09-01"
+    },
+    {
+      harness: "codex",
+      versionRange: "*",
+      familyPattern: "^openai/gpt-5",
+      status: "supported",
+      evidence: "Codex runs the OpenAI gpt-5 family natively (toCodexModel).",
+      observedAt: "2026-09-25"
+    },
+    {
+      harness: "codex",
+      versionRange: "*",
+      familyPattern: ".*",
+      status: "unsupported",
+      evidence: "Codex only runs OpenAI gpt-5 family models.",
+      observedAt: "2026-09-25"
+    },
+    {
+      harness: "cursor",
+      versionRange: "*",
+      familyPattern: "^cursor/auto$",
+      status: "supported",
+      evidence: "Cursor's agent CLI selects its own model; cursor/auto is the only selectable id.",
+      observedAt: "2026-09-25"
+    },
+    {
+      harness: "cursor",
+      versionRange: "*",
+      familyPattern: ".*",
+      status: "unsupported",
+      evidence: "Cursor's agent CLI does not accept an explicit model id.",
+      observedAt: "2026-09-25"
+    }
+  ]
+};
+
+// shared/harness-model-support.ts
+var HARNESS_MODEL_SUPPORT_ROWS = harness_model_support_evidence_default.rows;
+var HARNESS_PINNED_VERSIONS = {
+  "claude-code": "2.1.245",
+  codex: "0.149.1",
+  cursor: null
+};
+function harnessPinnedVersion(harnessId) {
+  return Object.prototype.hasOwnProperty.call(
+    HARNESS_PINNED_VERSIONS,
+    harnessId
+  ) ? HARNESS_PINNED_VERSIONS[harnessId] ?? void 0 : void 0;
+}
+var HARNESS_DISPLAY_NAMES = {
+  "claude-code": "Claude Code",
+  codex: "Codex",
+  cursor: "Cursor CLI"
+};
+function harnessDisplayName(harnessId) {
+  return HARNESS_DISPLAY_NAMES[harnessId] ?? harnessId;
+}
+function parseHarnessVersion(version) {
+  if (typeof version !== "string") return void 0;
+  const match = version.trim().match(/^v?(\d+)\.(\d+)(?:\.(\d+))?(?:[-+].*)?$/);
+  if (!match) return void 0;
+  return [Number(match[1]), Number(match[2]), Number(match[3] ?? 0)];
+}
+function compareMajorMinor(a, b) {
+  if (a[0] !== b[0]) return a[0] - b[0];
+  return a[1] - b[1];
+}
+function parseVersionRange(range) {
+  if (range === "*") return { kind: "any" };
+  const match = range.match(/^(<=|>)(\d+)\.(\d+)\.x$/);
+  if (!match) return void 0;
+  return {
+    kind: match[1] === "<=" ? "lte" : "gt",
+    bound: [Number(match[2]), Number(match[3])]
+  };
+}
+function harnessVersionInRange(range, version) {
+  const parsedRange = parseVersionRange(range);
+  if (!parsedRange) return false;
+  if (parsedRange.kind === "any") return true;
+  const parsed = parseHarnessVersion(version);
+  if (!parsed) return false;
+  const cmp = compareMajorMinor(parsed, parsedRange.bound);
+  return parsedRange.kind === "lte" ? cmp <= 0 : cmp > 0;
+}
+var CLAUDE_FAMILY_ID = /^claude-(haiku|sonnet|opus)-(\d+)(?:-\d{8}|[.-](\d+)(?:-\d{8})?)?$/;
+function normalizeHarnessModelId(modelId) {
+  let id = modelId.trim().toLowerCase();
+  if (!id.includes("/")) {
+    if (id.startsWith("claude-")) id = `anthropic/${id}`;
+    else if (id.startsWith("gpt-")) id = `openai/${id}`;
+  }
+  if (id.startsWith("anthropic/")) {
+    const slug = id.slice("anthropic/".length);
+    const match = slug.match(CLAUDE_FAMILY_ID);
+    if (match) {
+      const [, family, major, minor] = match;
+      id = `anthropic/claude-${family}-${major}${minor ? `.${minor}` : ""}`;
+    }
+  }
+  return id;
+}
+function notVerifiedReason(harnessId, runtimeVersion) {
+  const version = typeof runtimeVersion === "string" && runtimeVersion.trim() ? runtimeVersion.trim() : "(unknown version)";
+  return `not verified for ${harnessId} ${version}`;
+}
+function harnessModelUnsupportedReason(harnessId) {
+  const name = harnessDisplayName(harnessId);
+  return `the ${name} harness can't run this host's model \u2014 pick a ${name}-compatible model to run the real runtime`;
+}
+function harnessModelSupport(args) {
+  const rows = args.rows ?? HARNESS_MODEL_SUPPORT_ROWS;
+  const modelId = normalizeHarnessModelId(args.modelId);
+  const versionKnown = parseHarnessVersion(args.runtimeVersion) !== void 0;
+  const unknown = (evidence) => ({
+    status: "unknown",
+    reason: notVerifiedReason(args.harnessId, args.runtimeVersion),
+    ...evidence ? { evidence } : {}
+  });
+  for (const row of rows) {
+    if (row.harness !== args.harnessId) continue;
+    let pattern;
+    try {
+      pattern = new RegExp(row.familyPattern);
+    } catch {
+      continue;
+    }
+    if (!pattern.test(modelId)) continue;
+    if (row.versionRange !== "*") {
+      if (!versionKnown) return unknown(row);
+      if (!harnessVersionInRange(row.versionRange, args.runtimeVersion)) {
+        continue;
+      }
+    }
+    switch (row.status) {
+      case "supported":
+        return { status: "supported", reason: row.evidence, evidence: row };
+      case "unsupported":
+        return {
+          status: "unsupported",
+          reason: harnessModelUnsupportedReason(args.harnessId),
+          evidence: row
+        };
+      default:
+        return unknown(row);
+    }
+  }
+  return unknown();
+}
+
+// server/utils/harness/harness-model-broker.ts
+function harnessRuntimeVersionField(harnessId) {
+  const version = harnessPinnedVersion(harnessId);
+  return version ? { harnessRuntimeVersion: version } : {};
+}
+function getConvexHttpUrl() {
+  const convexHttpUrl = process.env.CONVEX_HTTP_URL;
+  if (!convexHttpUrl) {
+    throw new Error("CONVEX_HTTP_URL is required for harness model broker");
+  }
+  return convexHttpUrl;
+}
+function bearerHeader(bearer) {
+  const trimmed = bearer.trim();
+  return /^Bearer\s/i.test(trimmed) ? trimmed : `Bearer ${trimmed}`;
+}
+function boxRequestFields(box) {
+  return box.kind === "computer" ? {
+    projectId: box.projectId,
+    computerId: box.computerId,
+    ...box.executionScope ? { executionScope: box.executionScope } : {}
+  } : { sandboxRowId: box.sandboxRowId };
+}
+async function startHarnessModelBroker(args) {
+  let url;
+  try {
+    url = new URL(
+      "/web/harness/model-broker/start",
+      getConvexHttpUrl()
+    ).toString();
+  } catch (err) {
+    logger.error("[harness-model-broker] missing endpoint config", err);
+    return {
+      ok: false,
+      status: 500,
+      error: "Harness model-broker endpoint is not configured"
+    };
+  }
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: bearerHeader(args.bearer)
+      },
+      body: JSON.stringify({
+        ...boxRequestFields(args.box),
+        harnessId: args.harnessId,
+        ...harnessRuntimeVersionField(args.harnessId),
+        modelId: args.modelId,
+        ...args.runId ? { runId: args.runId } : {},
+        ...args.maxOutputTokens !== void 0 ? { maxOutputTokens: args.maxOutputTokens } : {}
+      }),
+      signal: args.signal
+    });
+  } catch (err) {
+    logger.error("[harness-model-broker] network error", err);
+    return {
+      ok: false,
+      status: 502,
+      error: "Failed to reach harness model-broker endpoint"
+    };
+  }
+  let payload = null;
+  try {
+    payload = await response.json();
+  } catch {
+    return {
+      ok: false,
+      status: response.ok ? 502 : response.status,
+      error: `Harness model-broker returned ${response.status} with non-JSON body`
+    };
+  }
+  const validShape = response.ok && payload?.ok === true && typeof payload?.runId === "string" && payload.runId.length > 0 && typeof payload?.proxyBaseUrl === "string" && payload.proxyBaseUrl.length > 0 && typeof payload?.expiresAt === "number" && Number.isFinite(payload.expiresAt) && (payload?.protocol === "anthropic" || payload?.protocol === "openai") && payload?.delivery === "e2b-network-transform";
+  if (!validShape) {
+    return {
+      ok: false,
+      status: response.ok ? 502 : response.status,
+      error: typeof payload?.error === "string" ? payload.error : `Harness model-broker failed (${response.status})`
+    };
+  }
+  return {
+    ok: true,
+    runId: payload.runId,
+    expiresAt: payload.expiresAt,
+    protocol: payload.protocol,
+    proxyBaseUrl: payload.proxyBaseUrl,
+    delivery: "e2b-network-transform"
+  };
+}
+async function registerLocalInstance(args) {
+  let url;
+  try {
+    url = new URL(
+      "/web/harness/local-instance/register",
+      getConvexHttpUrl()
+    ).toString();
+  } catch (err) {
+    logger.error("[harness-model-broker] missing register endpoint config", err);
+    return {
+      ok: false,
+      status: 500,
+      error: "Harness local-instance endpoint is not configured"
+    };
+  }
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: bearerHeader(args.bearer)
+      },
+      body: JSON.stringify({
+        machineId: args.machineId,
+        publicKey: args.publicKey
+      }),
+      ...args.signal ? { signal: args.signal } : {}
+    });
+  } catch (err) {
+    logger.error("[harness-model-broker] register network error", err);
+    return {
+      ok: false,
+      status: 502,
+      error: "Failed to reach the harness local-instance endpoint"
+    };
+  }
+  const payload = await response.json().catch(() => null);
+  if (!response.ok || payload?.ok !== true || typeof payload?.keyId !== "string") {
+    return {
+      ok: false,
+      status: response.ok ? 502 : response.status,
+      error: typeof payload?.error === "string" ? payload.error : `Local instance registration failed (${response.status})`
+    };
+  }
+  return { ok: true, keyId: payload.keyId };
+}
+async function startLoopbackModelBroker(args) {
+  let url;
+  try {
+    url = new URL(
+      "/web/harness/model-broker/start",
+      getConvexHttpUrl()
+    ).toString();
+  } catch (err) {
+    logger.error("[harness-model-broker] missing endpoint config", err);
+    return {
+      ok: false,
+      status: 500,
+      error: "Harness model-broker endpoint is not configured"
+    };
+  }
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: bearerHeader(args.bearer)
+      },
+      body: JSON.stringify({
+        // Declared, not inferred: the backend forks on this, and a caller that
+        // means "local" says so rather than being detected by an absent
+        // computerId. No box fields travel — the backend refuses a local
+        // request that carries one.
+        delivery: "inspector-loopback-gateway",
+        projectId: args.projectId,
+        harnessId: args.harnessId,
+        ...harnessRuntimeVersionField(args.harnessId),
+        modelId: args.modelId,
+        ...args.evalIterationId ? { evalIterationId: args.evalIterationId } : {},
+        ...args.journeyRunId ? { journeyRunId: args.journeyRunId, hostId: args.hostId, targetId: args.targetId, sessionIdx: args.sessionIdx } : {},
+        machineId: args.machineId,
+        keyId: args.keyId,
+        ...args.runId ? { runId: args.runId } : {},
+        ...args.maxOutputTokens !== void 0 ? { maxOutputTokens: args.maxOutputTokens } : {}
+      }),
+      ...args.signal ? { signal: args.signal } : {}
+    });
+  } catch (err) {
+    logger.error("[harness-model-broker] network error", err);
+    return {
+      ok: false,
+      status: 502,
+      error: "Failed to reach harness model-broker endpoint"
+    };
+  }
+  let payload = null;
+  try {
+    payload = await response.json();
+  } catch {
+    return {
+      ok: false,
+      status: response.ok ? 502 : response.status,
+      error: `Harness model-broker returned ${response.status} with non-JSON body`
+    };
+  }
+  const validShape = response.ok && payload?.ok === true && typeof payload?.runId === "string" && payload.runId.length > 0 && typeof payload?.proxyBaseUrl === "string" && payload.proxyBaseUrl.length > 0 && typeof payload?.expiresAt === "number" && Number.isFinite(payload.expiresAt) && (payload?.protocol === "anthropic" || payload?.protocol === "openai") && payload?.delivery === "inspector-loopback-gateway" && // The lease is the point of this delivery. A response without one is not a
+  // usable local start, whatever else it says.
+  typeof payload?.lease === "string" && payload.lease.length > 0;
+  if (!validShape) {
+    return {
+      ok: false,
+      status: response.ok ? 502 : response.status,
+      error: typeof payload?.error === "string" ? payload.error : `Harness model-broker failed (${response.status})`
+    };
+  }
+  return {
+    ok: true,
+    runId: payload.runId,
+    expiresAt: payload.expiresAt,
+    protocol: payload.protocol,
+    proxyBaseUrl: payload.proxyBaseUrl,
+    delivery: "inspector-loopback-gateway",
+    lease: payload.lease
+  };
+}
+async function revokeHarnessModelBroker(args) {
+  let url;
+  try {
+    url = new URL(
+      "/web/harness/model-broker/revoke",
+      getConvexHttpUrl()
+    ).toString();
+  } catch (err) {
+    logger.error("[harness-model-broker] missing revoke endpoint config", err);
+    return { ok: false };
+  }
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: bearerHeader(args.bearer)
+      },
+      body: JSON.stringify({
+        ...args.projectId ? { projectId: args.projectId } : {},
+        ...args.computerId ? { computerId: args.computerId } : {},
+        runId: args.runId
+      }),
+      signal: args.signal ? AbortSignal.any([args.signal, AbortSignal.timeout(1e4)]) : AbortSignal.timeout(1e4)
+    });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok || payload?.ok !== true) {
+      logger.warn(`[harness-model-broker] revoke returned ${response.status}`);
+      return { ok: false };
+    }
+    return {
+      ok: true,
+      revoked: payload.revoked,
+      networkCleared: payload.networkCleared
+    };
+  } catch (err) {
+    logger.warn("[harness-model-broker] revoke network error", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return { ok: false };
+  }
+}
+async function reserveHarnessBox(args) {
+  let url;
+  try {
+    url = new URL(
+      "/web/harness/model-broker/reserve",
+      getConvexHttpUrl()
+    ).toString();
+  } catch (err) {
+    logger.error("[harness-model-broker] missing reserve endpoint config", err);
+    return {
+      ok: false,
+      status: 500,
+      error: "Harness model-broker endpoint is not configured"
+    };
+  }
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: bearerHeader(args.bearer)
+      },
+      body: JSON.stringify({
+        ...boxRequestFields(args.box),
+        // The same harness + model the lease will name: the backend authorizes a
+        // reservation exactly as it authorizes a lease, which for an ephemeral
+        // box means checking both against what the run actually pinned.
+        harnessId: args.harnessId,
+        ...harnessRuntimeVersionField(args.harnessId),
+        modelId: args.modelId,
+        runId: args.runId
+      }),
+      signal: args.signal
+    });
+  } catch (err) {
+    logger.error("[harness-model-broker] reserve network error", err);
+    return {
+      ok: false,
+      status: 502,
+      error: "Failed to reach harness model-broker endpoint"
+    };
+  }
+  const payload = await response.json().catch(() => null);
+  if (!response.ok || payload?.ok !== true) {
+    return {
+      ok: false,
+      status: response.status,
+      error: typeof payload?.error === "string" ? payload.error : `Couldn't reserve the computer (${response.status})`
+    };
+  }
+  return {
+    ok: true,
+    ...typeof payload.expiresAt === "number" ? { expiresAt: payload.expiresAt } : {}
+  };
+}
+async function renewHarnessBoxReservation(args) {
+  let url;
+  try {
+    url = new URL(
+      "/web/harness/model-broker/reserve/renew",
+      getConvexHttpUrl()
+    ).toString();
+  } catch {
+    return { ok: false };
+  }
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: bearerHeader(args.bearer)
+      },
+      body: JSON.stringify({
+        ...boxRequestFields(args.box),
+        harnessId: args.harnessId,
+        modelId: args.modelId,
+        runId: args.runId
+      }),
+      signal: args.signal
+    });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok || payload?.ok !== true) {
+      logger.error(
+        `[harness-model-broker] reservation renewal returned ${response.status}`
+      );
+      return { ok: false };
+    }
+    return {
+      ok: true,
+      ...typeof payload.expiresAt === "number" ? { expiresAt: payload.expiresAt } : {}
+    };
+  } catch (err) {
+    logger.error(
+      "[harness-model-broker] reservation renewal network error",
+      err
+    );
+    return { ok: false };
+  }
+}
+async function releaseHarnessBoxReservation(args) {
+  let url;
+  try {
+    url = new URL(
+      "/web/harness/model-broker/reserve/release",
+      getConvexHttpUrl()
+    ).toString();
+  } catch {
+    return { ok: false };
+  }
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: bearerHeader(args.bearer)
+      },
+      body: JSON.stringify({
+        ...boxRequestFields(args.box),
+        harnessId: args.harnessId,
+        modelId: args.modelId,
+        runId: args.runId
+      }),
+      signal: args.signal
+    });
+    if (!response.ok) {
+      logger.warn(
+        `[harness-model-broker] reservation release returned ${response.status}`
+      );
+      return { ok: false };
+    }
+    return { ok: true };
+  } catch (err) {
+    logger.error("[harness-model-broker] reservation release network error", err);
+    return { ok: false };
+  }
+}
+
+// server/utils/harness/local/grants.ts
+import { randomUUID } from "crypto";
+import { mkdir, readFile, rename, writeFile, chmod } from "fs/promises";
+import { homedir } from "os";
+import { join, sep } from "path";
+import { realpath, stat } from "fs/promises";
+var LOCAL_HARNESS_GRANT_HEADER = "x-mcpjam-local-harness-grant";
+function localHarnessStateRoot() {
+  return join(homedir(), ".mcpjam", "harness-local");
+}
+function grantsFilePath() {
+  return join(localHarnessStateRoot(), "grants.json");
+}
+function machineFilePath() {
+  return join(localHarnessStateRoot(), "machine.json");
+}
+function emptyState() {
+  return { version: 1, workspaces: [], harnessGrants: [] };
+}
+var GRANT_TTL_MS = 12 * 60 * 60 * 1e3;
+var withGrantLock = createLocalStateMutationLock({
+  rootDir: localHarnessStateRoot,
+  lockFileName: "grants.lock",
+  resourceLabel: "grant store"
+});
+function hashGrantBinding(binding) {
+  return capabilityFingerprint(
+    JSON.stringify([
+      binding.scope ?? "attended",
+      binding.userId,
+      binding.machineId,
+      binding.projectId,
+      binding.workspaceGrantId,
+      binding.harnessId,
+      binding.targetKind,
+      binding.backend ?? null,
+      binding.runtimeId,
+      binding.permissionProfile,
+      binding.policyVersion,
+      // Only isolated bindings carry one, and only they hash it. A native
+      // binding has no isolation policy to be bound to, so folding a constant
+      // `null` into its hash would change every native hash for a value that
+      // means nothing there — invalidating consents that the local policy
+      // never touched. A native binding that carries one anyway is refused
+      // outright by `verifyLocalHarnessGrant`, not admitted by the hash.
+      ...binding.targetKind === "local-isolated" ? [binding.isolationPolicyVersion ?? null] : []
+    ])
+  );
+}
+var GrantStateUnreadableError = class extends Error {
+};
+function isValidDate(value) {
+  return typeof value === "string" && Number.isFinite(Date.parse(value));
+}
+function isWorkspaceGrant(value) {
+  if (!value || typeof value !== "object") return false;
+  const workspace = value;
+  return typeof workspace.workspaceGrantId === "string" && workspace.workspaceGrantId.length > 0 && typeof workspace.canonicalPath === "string" && workspace.canonicalPath.length > 0 && isValidDate(workspace.createdAt);
+}
+function isHarnessGrantBinding(value) {
+  if (!value || typeof value !== "object") return false;
+  const binding = value;
+  const isolatedBackend = binding.backend === "linux-bwrap" || binding.backend === "darwin-seatbelt" || binding.backend === "oci-v1" || binding.backend === "vm-v1";
+  return typeof binding.userId === "string" && binding.userId.length > 0 && typeof binding.machineId === "string" && binding.machineId.length > 0 && (binding.scope === void 0 || binding.scope === "attended" || binding.scope === "unattended") && typeof binding.projectId === "string" && binding.projectId.length > 0 && typeof binding.workspaceGrantId === "string" && binding.workspaceGrantId.length > 0 && (binding.harnessId === "claude-code" || binding.harnessId === "codex") && (binding.targetKind === "local-native" || binding.targetKind === "local-isolated") && typeof binding.runtimeId === "string" && binding.runtimeId.length > 0 && (binding.permissionProfile === "read-only" || binding.permissionProfile === "workspace-edits" || binding.permissionProfile === "unrestricted") && typeof binding.policyVersion === "string" && binding.policyVersion.length > 0 && (binding.targetKind === "local-native" ? binding.backend === void 0 && binding.isolationPolicyVersion === void 0 : isolatedBackend && typeof binding.isolationPolicyVersion === "string" && binding.isolationPolicyVersion.length > 0);
+}
+function isPersistedHarnessGrant(value) {
+  if (!value || typeof value !== "object") return false;
+  const grant = value;
+  return typeof grant.grantId === "string" && grant.grantId.length > 0 && typeof grant.tokenHash === "string" && /^[0-9a-f]{64}$/.test(grant.tokenHash) && typeof grant.bindingHash === "string" && /^[0-9a-f]{64}$/.test(grant.bindingHash) && isHarnessGrantBinding(grant.binding) && isValidDate(grant.grantedAt) && isValidDate(grant.expiresAt);
+}
+async function readState() {
+  let raw;
+  try {
+    raw = await readFile(grantsFilePath(), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return emptyState();
+    throw new GrantStateUnreadableError(
+      `the local harness grant store could not be read: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new GrantStateUnreadableError(
+      "the local harness grant store is corrupt; refusing to treat it as empty or overwrite it"
+    );
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new GrantStateUnreadableError(
+      "the local harness grant store is not an object"
+    );
+  }
+  const record = parsed;
+  if (record.version !== 1 || !Array.isArray(record.workspaces) || !Array.isArray(record.harnessGrants) || !record.workspaces.every(isWorkspaceGrant) || !record.harnessGrants.every(isPersistedHarnessGrant)) {
+    throw new GrantStateUnreadableError(
+      "the local harness grant store has an unrecognized or malformed shape"
+    );
+  }
+  return {
+    version: 1,
+    workspaces: [...record.workspaces],
+    harnessGrants: [...record.harnessGrants]
+  };
+}
+async function writeState(state) {
+  const dir = localHarnessStateRoot();
+  await mkdir(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448).catch(() => {
+  });
+  await persistCapabilityState(grantsFilePath(), state);
+}
+async function getLocalMachineId() {
+  const readExisting = async () => {
+    let raw;
+    try {
+      raw = await readFile(machineFilePath(), "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw new GrantStateUnreadableError(
+        `the local harness machine identity could not be read: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new GrantStateUnreadableError(
+        "the local harness machine identity is corrupt; refusing to replace it"
+      );
+    }
+    if (!parsed || typeof parsed !== "object") {
+      throw new GrantStateUnreadableError(
+        "the local harness machine identity has an unrecognized shape"
+      );
+    }
+    const machineId = parsed.machineId;
+    if (typeof machineId !== "string" || machineId.length < 8) {
+      throw new GrantStateUnreadableError(
+        "the local harness machine identity has an invalid id"
+      );
+    }
+    return machineId;
+  };
+  const existing = await readExisting();
+  if (existing !== null) return existing;
+  return withGrantLock(async () => {
+    const raced = await readExisting();
+    if (raced !== null) return raced;
+    const machineId = `mach_${randomUUID()}`;
+    const dir = localHarnessStateRoot();
+    await mkdir(dir, { recursive: true, mode: 448 });
+    const file = machineFilePath();
+    const tmp = `${file}.tmp`;
+    await writeFile(tmp, JSON.stringify({ machineId }), { mode: 384 });
+    await rename(tmp, file);
+    return machineId;
+  });
+}
+function isFilesystemRoot(canonicalPath) {
+  return canonicalPath === sep || canonicalPath === "/" || // A drive root: `C:`, `C:\`, `C:/`.
+  /^[A-Za-z]:[\\/]?$/.test(canonicalPath) || // A UNC share root: `\\server\share` and its trailing-separator form, and
+  // a bare `\\server`. Scoping a session to a whole network share is the
+  // same mistake as scoping it to a whole volume, and the earlier rule
+  // covered only the volume. Anything BELOW the share
+  // (`\\server\share\project`) stays acceptable.
+  //
+  // Matched on the BACKSLASH form only. Accepting `//` here as well read a
+  // POSIX path with a doubled leading slash — `//tmp/project`, which POSIX
+  // expressly permits an implementation to keep — as a share root, and
+  // refused an ordinary directory. Windows has no such ambiguity to trade
+  // against: `realpath` and `path.resolve` both answer `\\server\share`
+  // there, so the canonical path this predicate is given is always the
+  // backslash form.
+  /^\\{2}[^\\/]+([\\/][^\\/]+)?[\\/]?$/.test(canonicalPath);
+}
+async function validateWorkspaceCandidate(rawPath) {
+  let canonicalPath;
+  try {
+    canonicalPath = await realpath(rawPath);
+    const info = await stat(canonicalPath);
+    if (!info.isDirectory()) {
+      return { ok: false, message: "the selection is not a directory" };
+    }
+  } catch (error) {
+    return {
+      ok: false,
+      message: `the selected workspace could not be resolved: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  const home = await realpath(homedir()).catch(() => homedir());
+  const appRoot = join(home, ".mcpjam");
+  const workspaces = join(appRoot, "harness-workspaces");
+  if (canonicalPath === home || isFilesystemRoot(canonicalPath) || (canonicalPath === appRoot || canonicalPath.startsWith(appRoot + sep)) && !canonicalPath.startsWith(workspaces + sep)) {
+    return {
+      ok: false,
+      message: "pick a project directory rather than your home directory or the filesystem root \u2014 the workspace is what the session is scoped to."
+    };
+  }
+  return { ok: true, canonicalPath };
+}
+function registerWorkspaceGrant(rawPath) {
+  return withGrantLock(async () => {
+    const candidate = await validateWorkspaceCandidate(rawPath);
+    if (!candidate.ok) {
+      return { ok: false, message: candidate.message };
+    }
+    const canonicalPath = candidate.canonicalPath;
+    const state = await readState();
+    const existing = state.workspaces.find(
+      (w) => w.canonicalPath === canonicalPath
+    );
+    if (existing) return { ok: true, grant: existing };
+    const grant = {
+      workspaceGrantId: `ws_${randomUUID()}`,
+      canonicalPath,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    state.workspaces.push(grant);
+    await writeState(state);
+    logger.info("[local-harness] workspace grant registered");
+    return { ok: true, grant };
+  });
+}
+async function resolveWorkspaceGrant(workspaceGrantId) {
+  let state;
+  try {
+    state = await readState();
+  } catch (error) {
+    return {
+      ok: false,
+      message: error instanceof Error ? error.message : "the local harness grant store could not be read"
+    };
+  }
+  const grant = state.workspaces.find(
+    (w) => w.workspaceGrantId === workspaceGrantId
+  );
+  if (!grant) {
+    return { ok: false, message: "unknown workspace grant" };
+  }
+  try {
+    const canonical = await realpath(grant.canonicalPath);
+    if (canonical !== grant.canonicalPath) {
+      return {
+        ok: false,
+        message: "the granted workspace now resolves somewhere else; re-select it before running locally"
+      };
+    }
+    const info = await stat(canonical);
+    if (!info.isDirectory()) {
+      return {
+        ok: false,
+        message: "the granted workspace is no longer a directory"
+      };
+    }
+    const candidate = await validateWorkspaceCandidate(canonical);
+    if (!candidate.ok) return candidate;
+    return { ok: true, canonicalPath: canonical };
+  } catch {
+    return {
+      ok: false,
+      message: "the granted workspace is no longer reachable"
+    };
+  }
+}
+function grantLocalHarnessConsent(binding, opts) {
+  return withGrantLock(async () => {
+    const now = opts?.now ?? Date.now();
+    const ttlMs = Math.min(opts?.ttlMs ?? GRANT_TTL_MS, GRANT_TTL_MS);
+    const token = mintCapabilityToken();
+    const grant = {
+      grantId: `grant_${randomUUID()}`,
+      tokenHash: capabilityFingerprint(token),
+      bindingHash: hashGrantBinding(binding),
+      binding,
+      grantedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + ttlMs).toISOString()
+    };
+    const state = await readState();
+    state.harnessGrants = state.harnessGrants.filter(
+      (g) => Date.parse(g.expiresAt) > now
+    );
+    state.harnessGrants.push(grant);
+    await writeState(state);
+    logger.info("[local-harness] consent granted", {
+      harnessId: binding.harnessId,
+      targetKind: binding.targetKind,
+      permissionProfile: binding.permissionProfile,
+      policyVersion: binding.policyVersion
+    });
+    return { grantId: grant.grantId, token, expiresAt: grant.expiresAt };
+  });
+}
+async function verifyLocalHarnessGrant(token, binding, opts) {
+  if (!token || token.length < 16 || token.length > 256) {
+    return {
+      ok: false,
+      reason: "invalid",
+      message: "no local harness grant was presented"
+    };
+  }
+  if (binding.policyVersion !== LOCAL_HARNESS_POLICY_VERSION) {
+    return {
+      ok: false,
+      reason: "binding-mismatch",
+      message: `this grant was minted under policy ${binding.policyVersion}; the current policy is ${LOCAL_HARNESS_POLICY_VERSION}. The terms changed, so consent is asked again.`
+    };
+  }
+  if (binding.targetKind === "local-isolated") {
+    if (binding.isolationPolicyVersion !== LOCAL_ISOLATION_POLICY_VERSION) {
+      return {
+        ok: false,
+        reason: "binding-mismatch",
+        message: `this grant was minted under isolation policy ${binding.isolationPolicyVersion ?? "(none)"}; the current isolation policy is ${LOCAL_ISOLATION_POLICY_VERSION}.`
+      };
+    }
+  } else if (binding.isolationPolicyVersion !== void 0) {
+    return {
+      ok: false,
+      reason: "binding-mismatch",
+      message: "a native grant must not carry an isolation policy version"
+    };
+  }
+  const bindingHash = hashGrantBinding(binding);
+  let state;
+  try {
+    state = await readState();
+  } catch (error) {
+    return {
+      ok: false,
+      reason: "invalid",
+      message: error instanceof Error ? error.message : "the local harness grant store could not be read"
+    };
+  }
+  const now = opts?.now ?? Date.now();
+  for (const grant of state.harnessGrants) {
+    if (!capabilityMatches(token, grant.tokenHash)) continue;
+    if (grant.bindingHash !== bindingHash) {
+      return {
+        ok: false,
+        reason: "binding-mismatch",
+        message: "the presented grant was issued for different terms (workspace, harness, runtime, target mode, permission profile, or policy version). Local execution never runs under terms the user did not see."
+      };
+    }
+    if (Date.parse(grant.expiresAt) <= now) {
+      return {
+        ok: false,
+        reason: "expired",
+        message: "the local harness grant expired; consent is attended and short-lived"
+      };
+    }
+    return { ok: true, grantId: grant.grantId };
+  }
+  return {
+    ok: false,
+    reason: "absent",
+    message: "no local harness grant matches the presented capability"
+  };
+}
+function revokeLocalHarnessGrants(selector) {
+  return withGrantLock(async () => {
+    const state = await readState();
+    const before = state.harnessGrants.length;
+    if (!selector) {
+      state.harnessGrants = [];
+    } else if (selector.userId) {
+      state.harnessGrants = state.harnessGrants.filter((g) => g.binding.userId !== selector.userId || selector.projectId !== void 0 && g.binding.projectId !== selector.projectId);
+    } else if (selector.grantId) {
+      state.harnessGrants = state.harnessGrants.filter(
+        (g) => g.grantId !== selector.grantId
+      );
+    } else if (selector.binding) {
+      const hash = hashGrantBinding(selector.binding);
+      state.harnessGrants = state.harnessGrants.filter(
+        (g) => g.bindingHash !== hash
+      );
+    }
+    const removed = before - state.harnessGrants.length;
+    if (removed > 0) {
+      await writeState(state);
+      logger.info("[local-harness] consent revoked", { removed });
+    }
+    return removed;
+  });
+}
+function pruneExpiredHarnessGrants(now = Date.now()) {
+  return withGrantLock(async () => {
+    const state = await readState();
+    const before = state.harnessGrants.length;
+    state.harnessGrants = state.harnessGrants.filter(
+      (g) => Date.parse(g.expiresAt) > now
+    );
+    const removed = before - state.harnessGrants.length;
+    if (removed > 0) await writeState(state);
+    return removed;
+  });
+}
+function forgetWorkspaceGrant(workspaceGrantId) {
+  return withGrantLock(async () => {
+    const state = await readState();
+    state.workspaces = state.workspaces.filter((w) => w.workspaceGrantId !== workspaceGrantId);
+    state.harnessGrants = state.harnessGrants.filter((g) => g.binding.workspaceGrantId !== workspaceGrantId);
+    await writeState(state);
+  });
+}
+
+// server/utils/harness/local/availability.ts
+function isActorEligibleForLocalHarness(actor, scope = "attended") {
+  return !actor.isGuest && !actor.isScenarioSession && (scope === "unattended" || !actor.isJourneySession && (actor.executionScopeKind === void 0 || actor.executionScopeKind === "project"));
+}
+function unavailable(status, message) {
+  return { available: false, status, message };
+}
+function localHarnessManifestsForDevelopment(manifests = LOCAL_HARNESS_MANIFEST) {
+  const version = process.env.MCPJAM_LOCAL_HARNESS_CONFORMANCE_VERSION?.trim();
+  if (HOSTED_MODE || process.env.ENVIRONMENT !== "dev" || !version) {
+    return manifests;
+  }
+  return Object.fromEntries(
+    Object.entries(manifests).map(([id, manifest]) => [
+      id,
+      manifest.lifecycleConformanceVersion || id !== "claude-code" ? manifest : { ...manifest, lifecycleConformanceVersion: version }
+    ])
+  );
+}
+async function resolveLocalHarnessAvailability(query) {
+  const hosted = query.hosted ?? HOSTED_MODE;
+  const enabled = query.killSwitchEnabled ?? LOCAL_HARNESS_ENABLED;
+  const platform = query.platform ?? process.platform;
+  if (hosted) {
+    return unavailable(
+      "hosted",
+      "a hosted Inspector never runs a harness on its own machine"
+    );
+  }
+  if (!enabled) {
+    return unavailable(
+      "server-disabled",
+      "local harness execution is disabled on this server (MCPJAM_LOCAL_HARNESS_ENABLED)"
+    );
+  }
+  if (!isActorEligibleForLocalHarness(query.actor, query.scope)) {
+    return unavailable(
+      "actor-not-eligible",
+      "local execution requires an attended, signed-in member running their own turn. Guests, shared scenario sessions, and swarm-scoped runs run hosted."
+    );
+  }
+  let localMachineId;
+  try {
+    localMachineId = query.localMachineId ?? await getLocalMachineId();
+  } catch (error) {
+    return unavailable(
+      "machine-identity-unavailable",
+      `this Inspector could not establish its local machine identity, so a machine-scoped consent grant cannot be checked: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (query.target.machineId !== localMachineId) {
+    return unavailable(
+      "machine-mismatch",
+      "this local execution target was granted on a different machine; consent is per-installation and must be granted again here"
+    );
+  }
+  if (!supportsOwnershipProof(platform)) {
+    return unavailable(
+      "ownership-unprovable",
+      `this Inspector cannot prove ownership of a process tree on ${platform}, so it could not guarantee that stopping a session stops everything it started`
+    );
+  }
+  const target = query.target;
+  const compatibility = resolveLocalCompatibility(
+    {
+      scope: query.scope,
+      harnessId: target.harnessId,
+      platform: currentLocalPlatform(platform),
+      targetKind: target.kind,
+      permissionProfile: target.permissionProfile,
+      ...target.kind === "local-isolated" ? { backend: target.backend } : {},
+      installedAdapterVersion: query.installedAdapterVersion
+    },
+    query.manifests ?? localHarnessManifestsForDevelopment()
+  );
+  if (!compatibility.ok) {
+    return unavailable(compatibility.status, compatibility.message);
+  }
+  const workspace = await resolveWorkspaceGrant(target.workspaceGrantId);
+  if (!workspace.ok) {
+    return unavailable("workspace-grant-invalid", workspace.message);
+  }
+  const runtimeResolution = compatibility.manifest.runtime.source === "managed-bundle" ? await resolveManagedBundle({
+    // Through `manifestWithExpectedBundleDigest`, so this path verifies
+    // against the digest the INSTALLER accepted rather than a second
+    // reading of the same table. They differ only under the documented
+    // development override — and there they differed fatally: a locally
+    // built pack installed and then could never run.
+    manifest: manifestWithExpectedBundleDigest(
+      compatibility.manifest,
+      compatibility.manifest.harnessId,
+      localPackTarget(platform)
+    ),
+    runtimeRoot: query.runtimeRoot,
+    platform: currentLocalPlatform(platform)
+  }) : await resolveSystemInstall({
+    manifest: compatibility.manifest,
+    platform: currentLocalPlatform(platform),
+    // The workspace is writable by the very agent we are about to start,
+    // so a runtime discovered inside it is not a runtime we can hold.
+    forbiddenRoots: [workspace.canonicalPath]
+  });
+  if (!runtimeResolution.ok) {
+    return unavailable("runtime-unavailable", runtimeResolution.message);
+  }
+  const revalidated = await revalidateRuntime(runtimeResolution.runtime);
+  if (!revalidated.ok) {
+    return unavailable("runtime-changed", revalidated.message);
+  }
+  if (runtimeResolution.runtime.runtimeId !== target.runtimeId) {
+    return unavailable(
+      "runtime-changed",
+      "the resolved runtime is not the one this target names; consent is bound to a runtime identity, so it must be re-granted"
+    );
+  }
+  const binding = {
+    scope: query.scope ?? "attended",
+    userId: query.userId,
+    machineId: target.machineId,
+    projectId: query.projectId,
+    workspaceGrantId: target.workspaceGrantId,
+    harnessId: target.harnessId,
+    targetKind: target.kind,
+    ...target.kind === "local-isolated" ? { backend: target.backend } : {},
+    runtimeId: runtimeResolution.runtime.runtimeId,
+    permissionProfile: target.permissionProfile,
+    // Every local target carries the local-harness policy version, because the
+    // argv denylist, environment allowlist, and permission mapping govern an
+    // isolated session as much as a native one. An isolated target ALSO
+    // carries the isolation policy version, so a change to either invalidates
+    // the grants that depend on it — the separation `targets.ts` documents.
+    policyVersion: target.kind === "local-native" ? target.policyVersion : LOCAL_HARNESS_POLICY_VERSION,
+    ...target.kind === "local-isolated" ? { isolationPolicyVersion: target.isolationPolicyVersion } : {}
+  };
+  const consent = await verifyLocalHarnessGrant(query.grantToken, binding);
+  if (!consent.ok) {
+    return unavailable("consent-required", consent.message);
+  }
+  return {
+    available: true,
+    plan: {
+      target,
+      manifest: compatibility.manifest,
+      runtime: runtimeResolution.runtime,
+      workspacePath: workspace.canonicalPath,
+      permissionMode: compatibility.permissionMode,
+      grantId: consent.grantId
+    }
+  };
+}
+
+// server/utils/harness/local/node-launcher.ts
+import { isAbsolute } from "path";
+var NodeLauncherError = class extends Error {
+};
+function resolveNodeLauncher(opts) {
+  const executable = opts.bundledNodePath;
+  if (!executable || !isAbsolute(executable)) {
+    throw new NodeLauncherError(
+      "the harness bridge launcher must be an absolute path to the Node binary inside the verified runtime pack"
+    );
+  }
+  return { executable, requiredEnv: {}, kind: "bundled" };
+}
+
+// server/utils/harness/local/model-gateway.ts
+import { randomBytes, timingSafeEqual } from "crypto";
+import { execFile as execFile2 } from "child_process";
+import { readdir as readdir2, readFile as readFile4, readlink as readlink2 } from "fs/promises";
+import {
+  createServer as createServer2
+} from "http";
+
+// server/utils/harness/local/bridge-endpoint.ts
+import { execFile } from "child_process";
+import { readdir, readFile as readFile2, readlink } from "fs/promises";
+import { createConnection, createServer } from "net";
+import { networkInterfaces } from "os";
+var LOOPBACK_HOST_V4 = "127.0.0.1";
+var LOOPBACK_HOST_V6 = "::1";
+var BridgeExposureError = class extends Error {
+};
+function localBridgeUrl(opts) {
+  if (!Number.isInteger(opts.port) || opts.port < 1 || opts.port > 65535) {
+    throw new BridgeExposureError(`implausible bridge port ${opts.port}`);
+  }
+  const scheme = opts.protocol === "ws" ? "ws" : "http";
+  return `${scheme}://${LOOPBACK_HOST_V4}:${opts.port}`;
+}
+function nonLoopbackLocalAddresses(interfaces = networkInterfaces()) {
+  const found = [];
+  for (const [name, entries] of Object.entries(interfaces)) {
+    for (const entry of entries ?? []) {
+      if (entry.internal) continue;
+      if (!entry.address) continue;
+      if (!isIpv6LinkLocal(entry.address)) {
+        found.push(entry.address);
+        continue;
+      }
+      if (entry.address.includes("%")) {
+        found.push(entry.address);
+        continue;
+      }
+      if (name) found.push(`${entry.address}%${name}`);
+    }
+  }
+  return found;
+}
+function isIpv6LinkLocal(address) {
+  const bare = address.split("%")[0].toLowerCase();
+  return /^fe[89ab][0-9a-f]:/.test(bare);
+}
+function canConnect(host, port, timeoutMs) {
+  return new Promise((resolvePromise) => {
+    let done = false;
+    const finish = (reachable) => {
+      if (done) return;
+      done = true;
+      try {
+        socket.destroy();
+      } catch {
+      }
+      resolvePromise(reachable);
+    };
+    const socket = createConnection({ host, port });
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => finish(true));
+    socket.once("timeout", () => finish(false));
+    socket.once("error", () => finish(false));
+  });
+}
+async function assertBridgePortUnclaimed(args) {
+  const connect = args.connect ?? canConnect;
+  const timeoutMs = args.timeoutMs ?? 500;
+  const hosts = args.hosts ?? [LOOPBACK_HOST_V4, LOOPBACK_HOST_V6];
+  for (const host of hosts) {
+    if (await connect(host, args.port, timeoutMs)) {
+      throw new BridgeExposureError(
+        `port ${args.port} is already accepting connections on ${host} before this session's bridge started, so a listener on it could not be attributed to the bridge. The session stops rather than talking to whatever is there.`
+      );
+    }
+  }
+}
+async function reserveLoopbackPort() {
+  return new Promise((resolvePromise, reject) => {
+    const probe = createServer();
+    probe.once("error", reject);
+    probe.listen(0, LOOPBACK_HOST_V4, () => {
+      const address = probe.address();
+      if (address === null || typeof address === "string") {
+        probe.close(() => reject(new Error("could not reserve a bridge port")));
+        return;
+      }
+      const { port } = address;
+      probe.close(() => resolvePromise(port));
+    });
+  });
+}
+async function waitForLoopbackListener(args) {
+  const connect = args.connect ?? canConnect;
+  const pollMs = args.pollMs ?? 50;
+  const deadline = Date.now() + (args.timeoutMs ?? 3e4);
+  for (; ; ) {
+    if (await connect(LOOPBACK_HOST_V4, args.port, 500)) return true;
+    if (Date.now() >= deadline) return false;
+    await new Promise((r) => setTimeout(r, pollMs));
+  }
+}
+async function assertBridgeLoopbackOnly(args) {
+  const assertAlive = async (when) => {
+    if (args.isBridgeAlive === void 0) return;
+    if (await args.isBridgeAlive()) return;
+    throw new BridgeExposureError(
+      `the supervised harness bridge was no longer running ${when}, so the listener on port ${args.port} cannot be attributed to it`
+    );
+  };
+  await assertAlive("while waiting for it to listen");
+  const ready = await waitForLoopbackListener({
+    port: args.port,
+    ...args.readinessTimeoutMs !== void 0 ? { timeoutMs: args.readinessTimeoutMs } : {},
+    ...args.connect ? { connect: args.connect } : {}
+  });
+  if (!ready) {
+    throw new BridgeExposureError(
+      `the harness bridge never started listening on ${LOOPBACK_HOST_V4}:${args.port}, so its binding could not be verified. The session stops rather than proceeding unverified.`
+    );
+  }
+  await assertBridgeIsLoopbackOnly(args);
+  if (args.bridgePid !== void 0) {
+    await assertBridgeBindingIsLoopback({
+      pid: args.bridgePid,
+      ...args.platform !== void 0 ? { platform: args.platform } : {},
+      ...args.readListenAddresses !== void 0 ? { read: args.readListenAddresses } : {}
+    });
+  }
+  await assertAlive("after its binding was verified");
+}
+async function assertBridgeIsLoopbackOnly(args) {
+  const addresses = args.addresses ?? nonLoopbackLocalAddresses();
+  if (addresses.length === 0) return;
+  const timeoutMs = Math.min(args.timeoutMs ?? 500, PROBE_BUDGET_MS);
+  const connect = args.connect ?? canConnect;
+  const results = await Promise.all(
+    addresses.map(async (address) => ({
+      address,
+      reachable: await connect(address, args.port, timeoutMs)
+    }))
+  );
+  const exposed = results.find((result) => result.reachable);
+  if (exposed !== void 0) {
+    throw new BridgeExposureError(
+      `the harness bridge on port ${args.port} accepted a connection on a non-loopback address, so it is reachable from the local network. Local execution stops rather than leaving an agent's control channel published to the LAN.`
+    );
+  }
+}
+var PROBE_BUDGET_MS = 1e3;
+async function readProcessListenAddresses(pid, platform = process.platform) {
+  if (platform === "darwin") return readDarwinListenAddresses(pid);
+  if (platform === "linux") return readLinuxListenAddresses(pid);
+  return null;
+}
+function readDarwinListenAddresses(pid) {
+  return new Promise((resolvePromise) => {
+    execFile(
+      "/usr/sbin/lsof",
+      ["-nP", "-a", "-p", String(pid), "-iTCP", "-sTCP:LISTEN"],
+      { timeout: 2e3, maxBuffer: 256 * 1024, encoding: "utf8", env: {} },
+      (error, stdout) => {
+        if (error && error.code !== 1) {
+          resolvePromise(null);
+          return;
+        }
+        const addresses = [];
+        for (const line of String(stdout).split("\n").slice(1)) {
+          const name = line.trim().split(/\s+/).at(-2);
+          if (name === void 0) continue;
+          const host = name.slice(0, name.lastIndexOf(":"));
+          if (host.length > 0) addresses.push(host);
+        }
+        resolvePromise(addresses);
+      }
+    );
+  });
+}
+async function readLinuxListenAddresses(pid) {
+  let sockets;
+  try {
+    const fds = await readdir(`/proc/${pid}/fd`);
+    const inodes = await Promise.all(
+      fds.map(async (fd) => {
+        try {
+          const link = await readlink(`/proc/${pid}/fd/${fd}`);
+          const match = /^socket:\[(\d+)\]$/.exec(link);
+          return match?.[1] ?? null;
+        } catch {
+          return null;
+        }
+      })
+    );
+    sockets = new Set(
+      inodes.filter((inode) => inode !== null)
+    );
+  } catch {
+    return null;
+  }
+  if (sockets.size === 0) return [];
+  const addresses = [];
+  for (const table of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+    let raw;
+    try {
+      raw = await readFile2(table, "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of raw.split("\n").slice(1)) {
+      const fields = line.trim().split(/\s+/);
+      if (fields.length < 10) continue;
+      if (fields[3] !== "0A") continue;
+      if (!sockets.has(fields[9])) continue;
+      const host = decodeProcNetAddress(fields[1].split(":")[0]);
+      if (host !== null) addresses.push(host);
+    }
+  }
+  return addresses;
+}
+function decodeProcNetAddress(hex) {
+  if (hex.length === 8) {
+    const octets = [6, 4, 2, 0].map((i) => parseInt(hex.slice(i, i + 2), 16));
+    return octets.join(".");
+  }
+  if (hex.length === 32) {
+    const words = [];
+    for (let word = 0; word < 4; word += 1) {
+      const chunk = hex.slice(word * 8, word * 8 + 8);
+      const beChunk = chunk.slice(6, 8) + chunk.slice(4, 6) + chunk.slice(2, 4) + chunk.slice(0, 2);
+      words.push(beChunk.slice(0, 4), beChunk.slice(4, 8));
+    }
+    return words.join(":");
+  }
+  return null;
+}
+function normalizeHexGroups(address) {
+  if (!address.includes(":")) return address;
+  return address.split(":").map(
+    (group) => /^[0-9a-f]+$/.test(group) ? group.replace(/^0+(?=.)/, "") : group
+  ).join(":");
+}
+function isLoopbackBoundAddress(address) {
+  const bare = normalizeHexGroups(
+    address.split("%")[0].trim().toLowerCase().replace(/^\[|\]$/g, "")
+  );
+  if (bare === "") return false;
+  if (/^127\./.test(bare)) return true;
+  if (bare === "::1" || bare === "0:0:0:0:0:0:0:1") return true;
+  const mapped = /^(?:::ffff:|0:0:0:0:0:ffff:)(.+)$/.exec(bare);
+  if (mapped !== null) {
+    const inner = mapped[1];
+    if (/^127\./.test(inner)) return true;
+    const hexWords = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(inner);
+    if (hexWords !== null && parseInt(hexWords[1], 16) >> 8 === 127)
+      return true;
+  }
+  return false;
+}
+async function assertBridgeBindingIsLoopback(args) {
+  const platform = args.platform ?? process.platform;
+  const read = args.read ?? readProcessListenAddresses;
+  const addresses = await read(args.pid, platform);
+  if (addresses === null) return;
+  const offBox = addresses.filter(
+    (address) => !isLoopbackBoundAddress(address)
+  );
+  if (offBox.length > 0) {
+    throw new BridgeExposureError(
+      `the operating system reports the harness bridge listening on ${offBox.join(", ")}, which is not loopback. Local execution stops rather than leaving an agent's control channel published to the LAN.`
+    );
+  }
+}
+
+// server/utils/harness/local/instance-key.ts
+import { createHash, generateKeyPairSync, sign as edSign } from "crypto";
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile3, stat as stat2, writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
+var POP_SCHEME_PREFIX = "mcpjam-pop-v1";
+var KEY_FILE = "instance-key.json";
+var KeystoreUnavailableError = class extends Error {
+};
+var keystore = null;
+var cached = null;
+var cachedKeyId = null;
+var loading = null;
+function keyFilePath() {
+  return join2(localHarnessStateRoot(), KEY_FILE);
+}
+function toBase64Url(bytes) {
+  return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+async function loadLocalInstanceKey() {
+  if (cached !== null) return cached;
+  if (loading !== null) return loading;
+  loading = (async () => {
+    const machineId = await getLocalMachineId();
+    const path = keyFilePath();
+    let stored = null;
+    let fileExists = true;
+    try {
+      stored = JSON.parse(await readFile3(path, "utf8"));
+    } catch (error) {
+      fileExists = error?.code !== "ENOENT";
+      stored = null;
+    }
+    if (stored !== null) {
+      try {
+        const privateKeyPem2 = unwrapPrivateKey(stored);
+        await repairKeyFileMode(path);
+        const loaded2 = {
+          machineId,
+          publicKey: stored.publicKey,
+          privateKeyPem: privateKeyPem2
+        };
+        cached = loaded2;
+        return loaded2;
+      } catch (error) {
+        if (error instanceof KeystoreUnavailableError) {
+          throw error;
+        }
+        logger.warn("[local-harness] instance key unreadable; minting a new one", {
+          message: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    const raw = publicKey.export({ type: "spki", format: "der" });
+    const rawPublic = Buffer.from(raw.subarray(raw.length - 32));
+    const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+    const next = {
+      protection: "plain",
+      privateKey: Buffer.from(privateKeyPem).toString("base64"),
+      publicKey: toBase64Url(rawPublic),
+      createdAt: Date.now()
+    };
+    if (keystore !== null && keystore.isAvailable()) {
+      next.protection = "os-keystore";
+      next.privateKey = keystore.encrypt(privateKeyPem);
+    }
+    await mkdir2(localHarnessStateRoot(), { recursive: true, mode: 448 });
+    const serialized = `${JSON.stringify(next, null, 2)}
+`;
+    if (!fileExists) {
+      try {
+        await writeFile2(path, serialized, { mode: 384, flag: "wx" });
+      } catch (error) {
+        if (error?.code !== "EEXIST") throw error;
+        const adopted = await adoptExistingKey(path, machineId);
+        if (adopted !== null) {
+          cached = adopted;
+          return adopted;
+        }
+        await writeFile2(path, serialized, { mode: 384 });
+      }
+    } else {
+      await writeFile2(path, serialized, { mode: 384 });
+    }
+    await repairKeyFileMode(path, true);
+    const loaded = {
+      machineId,
+      publicKey: next.publicKey,
+      privateKeyPem
+    };
+    cached = loaded;
+    return loaded;
+  })();
+  try {
+    return await loading;
+  } finally {
+    loading = null;
+  }
+}
+async function adoptExistingKey(path, machineId) {
+  try {
+    const stored = JSON.parse(await readFile3(path, "utf8"));
+    return {
+      machineId,
+      publicKey: stored.publicKey,
+      privateKeyPem: unwrapPrivateKey(stored)
+    };
+  } catch {
+    return null;
+  }
+}
+async function repairKeyFileMode(path, quiet = false) {
+  if (process.platform === "win32") return;
+  try {
+    const mode = (await stat2(path)).mode & 511;
+    if ((mode & 63) === 0) return;
+    await chmod2(path, 384);
+    if (!quiet) {
+      logger.warn("[local-harness] instance key file was not owner-only", {
+        // The mode, never the path: the path is a home directory.
+        mode: mode.toString(8)
+      });
+    }
+  } catch {
+  }
+}
+function unwrapPrivateKey(stored) {
+  if (stored.protection === "os-keystore") {
+    if (keystore === null || !keystore.isAvailable()) {
+      throw new KeystoreUnavailableError(
+        "this instance key is sealed by the OS keystore, which is not available"
+      );
+    }
+    return keystore.decrypt(stored.privateKey);
+  }
+  return Buffer.from(stored.privateKey, "base64").toString("utf8");
+}
+async function readLocalInstanceIdentity() {
+  const key = await loadLocalInstanceKey();
+  return {
+    machineId: key.machineId,
+    publicKey: key.publicKey,
+    keyId: cachedKeyId
+  };
+}
+function setRegisteredKeyId(keyId) {
+  cachedKeyId = keyId;
+}
+function getRegisteredKeyId() {
+  return cachedKeyId;
+}
+async function signProxiedRequest(args) {
+  const key = await loadLocalInstanceKey();
+  const timestampMs = args.timestampMs ?? Date.now();
+  const signingString = [
+    POP_SCHEME_PREFIX,
+    args.method.toUpperCase(),
+    args.path,
+    String(timestampMs),
+    args.nonce,
+    args.jti
+  ].join("\n");
+  const signature = edSign(
+    null,
+    Buffer.from(signingString, "utf8"),
+    key.privateKeyPem
+  );
+  return `${timestampMs}.${args.nonce}.${toBase64Url(signature)}`;
+}
+function leaseJti(lease) {
+  const parts = lease.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const payload = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString("utf8")
+    );
+    return typeof payload.jti === "string" && payload.jti.length > 0 ? payload.jti : null;
+  } catch {
+    return null;
+  }
+}
+function instanceKeyFingerprint(publicKey) {
+  return createHash("sha256").update(publicKey).digest("hex").slice(0, 12);
+}
+
+// server/utils/harness/local/model-gateway.ts
+var MAX_REQUEST_BYTES = 24 * 1024 * 1024;
+var UPSTREAM_TIMEOUT_MS = 10 * 60 * 1e3;
+var ALLOWED_PATHS = [
+  { method: "POST", prefix: "/v1/messages" },
+  { method: "POST", prefix: "/v1/messages/count_tokens" },
+  { method: "POST", prefix: "/chat/completions" },
+  { method: "POST", prefix: "/responses" }
+];
+var HELLO_PROBE = { method: "HEAD", path: "/api/hello" };
+async function startLocalModelGateway(options) {
+  const sessionCapability = randomBytes(32).toString("base64url");
+  const capabilityBytes = Buffer.from(sessionCapability, "utf8");
+  const parsedJti = leaseJti(options.lease);
+  if (parsedJti === null) {
+    throw new Error(
+      "the harness model lease is not a token this gateway can bind a proof of possession to"
+    );
+  }
+  const jti = parsedJti;
+  const upstream = new URL(options.upstreamBaseUrl);
+  if (upstream.protocol !== "https:" && !isLoopbackHost(upstream.host)) {
+    throw new Error(
+      "the harness model proxy must be reached over https unless it is on loopback; refusing to put the lease on the wire in the clear"
+    );
+  }
+  const upstreamBasePath = upstream.pathname.replace(/\/+$/, "");
+  const platform = options.platform ?? process.platform;
+  const doFetch = options.fetchImpl ?? fetch;
+  const resolvePeer = options.resolvePeerPid ?? resolvePeerPid;
+  let revoked = false;
+  const stats = {
+    requests: 0,
+    rejected: 0,
+    forwarded: 0,
+    upstreamErrors: 0
+  };
+  const refuse = (res, status, reason) => {
+    stats.rejected += 1;
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(
+      JSON.stringify({
+        type: "error",
+        error: { type: "authentication_error", message: reason }
+      })
+    );
+  };
+  const server = createServer2((req, res) => {
+    void handleRequest(req, res).catch((error) => {
+      logger.warn("[local-harness] gateway request failed", {
+        message: error instanceof Error ? error.message : String(error)
+      });
+      if (!res.headersSent) refuse(res, 500, "gateway error");
+      else res.end();
+    });
+  });
+  async function handleRequest(req, res) {
+    stats.requests += 1;
+    if (!isLoopbackHost(req.headers.host)) {
+      refuse(res, 403, "host not allowed");
+      return;
+    }
+    if (req.headers.origin !== void 0) {
+      refuse(res, 403, "origin not allowed");
+      return;
+    }
+    const method = (req.method ?? "GET").toUpperCase();
+    const path = req.url ?? "/";
+    if (method === HELLO_PROBE.method && stripQuery(path) === HELLO_PROBE.path) {
+      res.writeHead(200);
+      res.end();
+      return;
+    }
+    if (revoked) {
+      refuse(res, 401, "session ended");
+      return;
+    }
+    if (!isAllowedPath(method, path)) {
+      refuse(res, 404, "endpoint not allowed");
+      return;
+    }
+    if (!capabilityMatches2(req, capabilityBytes)) {
+      refuse(res, 401, "capability rejected");
+      return;
+    }
+    if (options.isSupervisedPid !== void 0) {
+      const peerPid = await resolvePeer(req.socket, platform);
+      if (peerPid !== null && !await options.isSupervisedPid(peerPid)) {
+        refuse(res, 403, "caller not part of this session");
+        return;
+      }
+    }
+    const body = await readBoundedBody(req);
+    if (body === null) {
+      refuse(res, 413, "request too large");
+      return;
+    }
+    const target = new URL(`${upstreamBasePath}${path}`, upstream.origin);
+    if (target.origin !== upstream.origin || !isUnderBasePath(target.pathname, upstreamBasePath)) {
+      refuse(res, 404, "endpoint not allowed");
+      return;
+    }
+    const pop = await signProxiedRequest({
+      method,
+      path: stripQuery(target.pathname),
+      jti,
+      nonce: randomBytes(16).toString("base64url")
+    });
+    let upstreamResponse;
+    try {
+      upstreamResponse = await doFetch(target.toString(), {
+        method,
+        headers: {
+          // Rebuilt, not forwarded: the child's headers are not ours to relay,
+          // and the two that matter here are ours to set.
+          "content-type": "application/json",
+          accept: String(req.headers.accept ?? "application/json"),
+          authorization: `Bearer ${options.lease}`,
+          "x-mcpjam-harness-lease": options.lease,
+          "x-mcpjam-pop": pop,
+          ...typeof req.headers["anthropic-version"] === "string" ? { "anthropic-version": req.headers["anthropic-version"] } : {},
+          ...typeof req.headers["anthropic-beta"] === "string" ? { "anthropic-beta": req.headers["anthropic-beta"] } : {}
+        },
+        body,
+        // A cross-origin redirect strips `Authorization` per the fetch spec and
+        // strips neither `x-mcpjam-harness-lease` nor the proof of possession,
+        // so following one would hand the lease to whoever the upstream named.
+        // Our upstream has no reason to redirect; if it does, that is a 502.
+        redirect: "error",
+        signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS)
+      });
+    } catch (error) {
+      stats.upstreamErrors += 1;
+      logger.warn("[local-harness] gateway upstream error", {
+        message: error instanceof Error ? error.message : String(error)
+      });
+      refuse(res, 502, "upstream unavailable");
+      return;
+    }
+    stats.forwarded += 1;
+    const responseHeaders = {};
+    upstreamResponse.headers.forEach((value, name) => {
+      if (name === "content-encoding" || name === "content-length" || name === "transfer-encoding" || name === "connection") {
+        return;
+      }
+      responseHeaders[name] = value;
+    });
+    res.writeHead(upstreamResponse.status, responseHeaders);
+    if (upstreamResponse.body === null) {
+      res.end();
+      return;
+    }
+    const reader = upstreamResponse.body.getReader();
+    let clientGone = false;
+    const noteClose = () => {
+      if (!res.writableFinished) clientGone = true;
+    };
+    res.on("close", noteClose);
+    let completed = false;
+    try {
+      while (!clientGone) {
+        const { done, value } = await reader.read();
+        if (done) {
+          completed = true;
+          break;
+        }
+        if (value === void 0 || clientGone) continue;
+        if (!res.write(Buffer.from(value))) await drained(res);
+      }
+    } finally {
+      res.off("close", noteClose);
+      if (!completed) await reader.cancel().catch(() => void 0);
+      reader.releaseLock();
+      res.end();
+    }
+  }
+  const port = await new Promise((resolvePromise, reject) => {
+    server.once("error", reject);
+    server.listen(0, LOOPBACK_HOST_V4, () => {
+      const address = server.address();
+      if (address === null || typeof address === "string") {
+        reject(new Error("the local model gateway did not bind a port"));
+        return;
+      }
+      resolvePromise(address.port);
+    });
+  });
+  return {
+    baseUrl: `http://${LOOPBACK_HOST_V4}:${port}`,
+    port,
+    sessionCapability,
+    revoke: () => {
+      revoked = true;
+    },
+    close: async () => {
+      revoked = true;
+      await closeServer(server);
+    },
+    stats: () => ({ ...stats })
+  };
+}
+function closeServer(server) {
+  return new Promise((resolvePromise) => {
+    server.close(() => resolvePromise());
+    server.closeAllConnections?.();
+  });
+}
+function drained(res) {
+  return new Promise((resolvePromise) => {
+    const finish = () => {
+      res.off("drain", finish);
+      res.off("close", finish);
+      resolvePromise();
+    };
+    res.once("drain", finish);
+    res.once("close", finish);
+  });
+}
+function isUnderBasePath(pathname, basePath) {
+  if (basePath === "") return pathname.startsWith("/");
+  return pathname === basePath || pathname.startsWith(`${basePath}/`);
+}
+function stripQuery(path) {
+  const index = path.indexOf("?");
+  return index === -1 ? path : path.slice(0, index);
+}
+function isLoopbackHost(host) {
+  if (host === void 0) return false;
+  const withoutPort = host.startsWith("[") ? host.slice(1, host.indexOf("]")) : host.split(":")[0] ?? "";
+  return withoutPort === "127.0.0.1" || withoutPort === "localhost" || withoutPort === "::1" || /^127\./.test(withoutPort);
+}
+function hasPlainSegments(bare) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(bare);
+  } catch {
+    return false;
+  }
+  if (/[\\\u0000-\u001f]/.test(decoded)) return false;
+  return decoded.split("/").every((segment) => segment !== "." && segment !== "..");
+}
+function isAllowedPath(method, path) {
+  const bare = stripQuery(path);
+  if (!hasPlainSegments(bare)) return false;
+  return ALLOWED_PATHS.some(
+    (entry) => entry.method === method && (bare === entry.prefix || bare.startsWith(`${entry.prefix}/`))
+  );
+}
+function capabilityMatches2(req, expected) {
+  const header = req.headers["x-api-key"] ?? req.headers.authorization;
+  const presented = typeof header === "string" ? header.replace(/^Bearer\s+/i, "") : Array.isArray(header) ? "" : "";
+  const presentedBytes = Buffer.from(presented, "utf8");
+  if (presentedBytes.length !== expected.length) return false;
+  return timingSafeEqual(presentedBytes, expected);
+}
+async function readBoundedBody(req) {
+  const declared = Number(req.headers["content-length"] ?? "0");
+  if (Number.isFinite(declared) && declared > MAX_REQUEST_BYTES) return null;
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of req) {
+    const buffer = chunk;
+    total += buffer.byteLength;
+    if (total > MAX_REQUEST_BYTES) return null;
+    chunks.push(buffer);
+  }
+  return Buffer.concat(chunks);
+}
+async function resolvePeerPid(socket, platform = process.platform) {
+  const remotePort = socket.remotePort;
+  if (remotePort === void 0) return null;
+  if (platform === "darwin") return resolveDarwinPeerPid(remotePort);
+  if (platform === "linux") return resolveLinuxPeerPid(remotePort);
+  return null;
+}
+function resolveDarwinPeerPid(remotePort) {
+  return new Promise((resolvePromise) => {
+    execFile2(
+      "/usr/sbin/lsof",
+      ["-nP", "-t", `-iTCP:${remotePort}`, "-sTCP:ESTABLISHED"],
+      { timeout: 1500, maxBuffer: 32 * 1024, encoding: "utf8", env: {} },
+      (error, stdout) => {
+        if (error && error.code !== 1) {
+          resolvePromise(null);
+          return;
+        }
+        const pids = String(stdout).split("\n").map((line) => Number(line.trim())).filter((pid) => Number.isInteger(pid) && pid > 0 && pid !== process.pid);
+        resolvePromise(pids.length === 1 ? pids[0] : null);
+      }
+    );
+  });
+}
+async function resolveLinuxPeerPid(remotePort) {
+  const inode = await findLocalSocketInode(remotePort);
+  if (inode === null) return null;
+  let entries;
+  try {
+    entries = await readdir2("/proc");
+  } catch {
+    return null;
+  }
+  for (const entry of entries) {
+    if (!/^\d+$/.test(entry)) continue;
+    const pid = Number(entry);
+    if (pid === process.pid) continue;
+    let fds;
+    try {
+      fds = await readdir2(`/proc/${entry}/fd`);
+    } catch {
+      continue;
+    }
+    for (const fd of fds) {
+      try {
+        const link = await readlink2(`/proc/${entry}/fd/${fd}`);
+        if (link === `socket:[${inode}]`) return pid;
+      } catch {
+        continue;
+      }
+    }
+  }
+  return null;
+}
+async function findLocalSocketInode(port) {
+  const hexPort = port.toString(16).toUpperCase().padStart(4, "0");
+  for (const table of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+    let raw;
+    try {
+      raw = await readFile4(table, "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of raw.split("\n").slice(1)) {
+      const fields = line.trim().split(/\s+/);
+      if (fields.length < 10) continue;
+      const local = fields[1] ?? "";
+      if (!local.endsWith(`:${hexPort}`)) continue;
+      return fields[9] ?? null;
+    }
+  }
+  return null;
+}
+
+// server/utils/harness/local/supervised-provider.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  lstat as lstat2,
+  mkdir as mkdir3,
+  open,
+  readlink as readlink4,
+  realpath as realpath3,
+  rename as rename2,
+  rm,
+  stat as stat3,
+  symlink
+} from "fs/promises";
+import {
+  basename,
+  dirname as dirname2,
+  isAbsolute as isAbsolute3,
+  join as join3,
+  posix as posix4,
+  resolve as resolve2,
+  sep as sep4
+} from "path";
+
+// server/utils/harness/local/confine.ts
+import { lstat, readlink as readlink3, realpath as realpath2 } from "fs/promises";
+import { dirname, isAbsolute as isAbsolute2, normalize, resolve, sep as sep2 } from "path";
+var MAX_PATH_LENGTH = 4096;
+var PathConfinementError = class extends Error {
+  constructor(message, requestedPath) {
+    super(message);
+    this.name = "PathConfinementError";
+    this.requestedPath = requestedPath;
+  }
+};
+function isUnder(candidate, root) {
+  return candidate === root || candidate.startsWith(root + sep2);
+}
+async function resolveExistingAncestor(path) {
+  const tail = [];
+  let current = path;
+  for (; ; ) {
+    try {
+      return { base: await realpath2(current), tail };
+    } catch {
+      const parent = dirname(current);
+      if (parent === current) {
+        return { base: current, tail };
+      }
+      const cut = parent.endsWith(sep2) ? parent.length : parent.length + 1;
+      tail.unshift(current.slice(cut));
+      current = parent;
+    }
+  }
+}
+var MAX_LINK_HOPS = 8;
+async function resolveDanglingLinks(base, tail, requested) {
+  let current = base;
+  for (let index = 0; index < tail.length; index += 1) {
+    let next = resolve(current, tail[index]);
+    let hops = 0;
+    for (; ; ) {
+      let isLink;
+      try {
+        isLink = (await lstat(next)).isSymbolicLink();
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          throw new PathConfinementError(
+            "path could not be resolved well enough to confine it",
+            requested
+          );
+        }
+        return resolve(next, ...tail.slice(index + 1));
+      }
+      if (!isLink) {
+        next = await realpath2(next).catch(() => next);
+        break;
+      }
+      if ((hops += 1) > MAX_LINK_HOPS) {
+        throw new PathConfinementError(
+          `path passes through more than ${MAX_LINK_HOPS} symbolic links`,
+          requested
+        );
+      }
+      const link = await readlink3(next);
+      next = isAbsolute2(link) ? normalize(link) : normalize(resolve(dirname(next), link));
+    }
+    current = next;
+  }
+  return current;
+}
+async function confinePath(requested, { roots }) {
+  if (typeof requested !== "string" || requested.length === 0) {
+    throw new PathConfinementError("no path was given", String(requested));
+  }
+  if (requested.length > MAX_PATH_LENGTH) {
+    throw new PathConfinementError(
+      `path exceeds ${MAX_PATH_LENGTH} characters`,
+      `${requested.slice(0, 64)}\u2026`
+    );
+  }
+  if (requested.includes("\0")) {
+    throw new PathConfinementError("path contains a NUL byte", "<redacted>");
+  }
+  if (!isAbsolute2(requested)) {
+    throw new PathConfinementError(
+      "path must be absolute; the local provider does not resolve relative paths against an ambient working directory",
+      requested
+    );
+  }
+  if (roots.length === 0) {
+    throw new PathConfinementError(
+      "no writable root is configured for this session",
+      requested
+    );
+  }
+  const normalized = normalize(requested);
+  const { base, tail } = await resolveExistingAncestor(normalized);
+  const canonical = await resolveDanglingLinks(base, tail, requested);
+  for (const root of roots) {
+    if (isUnder(canonical, root)) return canonical;
+  }
+  throw new PathConfinementError(
+    "path resolves outside every directory this session was granted. The workspace grant and the session state directory are the only roots the Inspector file API will touch.",
+    requested
+  );
+}
+
+// server/utils/harness/local/adapter-path.ts
+import { posix, win32 } from "path";
+var AdapterPathError = class extends Error {
+};
+var MSYS_DRIVE_PATH = /^\/([A-Za-z])(?:\/(.*))?$/;
+var NATIVE_DRIVE_PATH = /^([A-Za-z]):[\\/]/;
+function toAdapterPath(nativePath, platform = process.platform) {
+  if (platform !== "win32") return nativePath;
+  const normalized = win32.normalize(nativePath);
+  const drive = NATIVE_DRIVE_PATH.exec(normalized);
+  if (drive === null) {
+    throw new AdapterPathError(
+      `cannot present ${JSON.stringify(nativePath)} to the adapter: only a drive-letter absolute path has a POSIX-shaped spelling`
+    );
+  }
+  const rest = normalized.slice(drive[0].length).split(win32.sep).filter((segment) => segment.length > 0).join("/");
+  return rest.length === 0 ? `/${drive[1].toLowerCase()}` : `/${drive[1].toLowerCase()}/${rest}`;
+}
+function fromAdapterPath(adapterPath, platform = process.platform) {
+  if (platform !== "win32") return adapterPath;
+  const match = MSYS_DRIVE_PATH.exec(adapterPath);
+  if (match === null) return adapterPath;
+  const drive = `${match[1].toUpperCase()}:`;
+  const rest = match[2] ?? "";
+  const normalizedRest = posix.normalize(`/${rest}`);
+  return win32.normalize(`${drive}${normalizedRest}`);
+}
+
+// server/utils/harness/local/command-translation.ts
+import { normalize as normalize2, posix as posix2, sep as sep3 } from "path";
+
+// server/utils/harness/local/argv-policy.ts
+var MAX_ARG_LENGTH = 4096;
+var MAX_ARG_COUNT = 64;
+var DENIED_ARGV_FLAG_VALUES = {
+  "--ask-for-approval": ["never"],
+  "--sandbox": ["danger-full-access"],
+  "--sandbox-mode": ["danger-full-access"],
+  "--permission-mode": ["bypasspermissions"],
+  "--approval-policy": ["never"]
+};
+var DENIED_ARGV_CAPABILITIES = [
+  // Claude Code
+  "--dangerously-skip-permissions",
+  "--dangerously-allow-browser",
+  "--permission-mode=bypasspermissions",
+  "bypasspermissions",
+  // Codex / OpenAI
+  "--dangerously-bypass-approvals-and-sandbox",
+  "--yolo",
+  "--full-auto",
+  "danger-full-access",
+  "--ask-for-approval=never",
+  // Generic shapes seen across vendor CLIs
+  "--no-sandbox",
+  "--disable-sandbox",
+  "--skip-permissions",
+  "--allow-all",
+  "--trust-all"
+];
+var FORBIDDEN_ARG_CHARS = /[\0\n\r;|&`$<>]/;
+var ArgvPolicyViolation = class extends Error {
+  constructor(message, rule, argument) {
+    super(message);
+    this.name = "ArgvPolicyViolation";
+    this.rule = rule;
+    this.argument = argument;
+  }
+};
+function normalizeForCapabilityCheck(arg) {
+  const lower = arg.toLowerCase();
+  const eq = lower.indexOf("=");
+  return eq === -1 ? [lower] : [lower, lower.slice(0, eq), lower.slice(eq + 1)];
+}
+function assertArgumentAllowed(arg) {
+  if (typeof arg !== "string") {
+    throw new ArgvPolicyViolation(
+      "argv entries must be strings",
+      "structure",
+      String(arg)
+    );
+  }
+  if (arg.length === 0) {
+    throw new ArgvPolicyViolation("empty argv entry", "structure", arg);
+  }
+  if (arg.length > MAX_ARG_LENGTH) {
+    throw new ArgvPolicyViolation(
+      `argv entry exceeds ${MAX_ARG_LENGTH} characters`,
+      "structure",
+      `${arg.slice(0, 64)}\u2026`
+    );
+  }
+  const forbidden = FORBIDDEN_ARG_CHARS.exec(arg);
+  if (forbidden) {
+    throw new ArgvPolicyViolation(
+      `argv entry contains shell metacharacter ${JSON.stringify(
+        forbidden[0]
+      )} \u2014 the supervisor never uses a shell, so this argument was built from a command string rather than structured input`,
+      "structure",
+      arg
+    );
+  }
+  const eq = arg.indexOf("=");
+  if (eq !== -1) {
+    const flag = arg.slice(0, eq).toLowerCase();
+    const value = arg.slice(eq + 1).toLowerCase();
+    if (DENIED_ARGV_FLAG_VALUES[flag]?.includes(value)) {
+      throw new ArgvPolicyViolation(
+        `argv entry ${JSON.stringify(
+          arg
+        )} requests a value that disables the vendor permission controls local execution depends on`,
+        "capability",
+        arg
+      );
+    }
+  }
+  const candidates = normalizeForCapabilityCheck(arg);
+  for (const denied of DENIED_ARGV_CAPABILITIES) {
+    if (candidates.includes(denied)) {
+      throw new ArgvPolicyViolation(
+        `argv entry ${JSON.stringify(arg)} requests ${JSON.stringify(
+          denied
+        )}, which disables the vendor permission controls local execution depends on`,
+        "capability",
+        arg
+      );
+    }
+  }
+}
+function assertArgvAllowed(args) {
+  if (args.length > MAX_ARG_COUNT) {
+    throw new ArgvPolicyViolation(
+      `argv has ${args.length} entries (max ${MAX_ARG_COUNT})`,
+      "count",
+      ""
+    );
+  }
+  for (const arg of args) assertArgumentAllowed(arg);
+  for (let i = 0; i < args.length - 1; i += 1) {
+    const flag = args[i].toLowerCase();
+    const denied = DENIED_ARGV_FLAG_VALUES[flag];
+    if (denied && denied.includes(args[i + 1].toLowerCase())) {
+      throw new ArgvPolicyViolation(
+        `argv requests ${JSON.stringify(`${args[i]} ${args[i + 1]}`)}, which disables the vendor permission controls local execution depends on`,
+        "capability",
+        args[i]
+      );
+    }
+  }
+  return args;
+}
+
+// server/utils/harness/local/command-translation.ts
+var CommandTranslationError = class extends Error {
+  constructor(message, command) {
+    super(message);
+    this.name = "CommandTranslationError";
+    this.command = command;
+  }
+};
+var PWD_PROBE = "pwd";
+var HOME_PROBE = 'printf "%s" "$HOME"';
+var ENV_MKDIR_SHAPES = {
+  'mkdir -p "$BOOTSTRAP_DIR"': "BOOTSTRAP_DIR",
+  'mkdir -p "$WORK_DIR"': "WORK_DIR"
+};
+function splitQuotedTokens(operands, command) {
+  const paths = [];
+  let i = 0;
+  while (i < operands.length) {
+    if (operands[i] === " ") {
+      i += 1;
+      continue;
+    }
+    let token = "";
+    while (i < operands.length && operands[i] !== " ") {
+      if (operands[i] === "'") {
+        const end = operands.indexOf("'", i + 1);
+        if (end === -1) {
+          throw new CommandTranslationError(
+            "unterminated single quote in mkdir operands",
+            command
+          );
+        }
+        const inner = operands.slice(i + 1, end);
+        if (inner.includes("\\")) {
+          throw new CommandTranslationError(
+            "backslash escape in a quoted mkdir operand",
+            command
+          );
+        }
+        token += inner;
+        i = end + 1;
+        continue;
+      }
+      token += operands[i];
+      i += 1;
+    }
+    if (token.length > 0) paths.push(token);
+  }
+  return paths;
+}
+function assertPlainPathOperand(path, command) {
+  if (path.length === 0 || path.length > 4096) {
+    throw new CommandTranslationError("implausible path operand", command);
+  }
+  if (/[\0\n\r"`$*?[\]{}\\|&;<>()!~]/.test(path)) {
+    throw new CommandTranslationError(
+      `path operand ${JSON.stringify(
+        path
+      )} contains a shell metacharacter or glob \u2014 the adapters emit literal paths, so this is not a shape we know`,
+      command
+    );
+  }
+  if (!posix2.isAbsolute(path)) {
+    throw new CommandTranslationError(
+      `path operand ${JSON.stringify(path)} is not absolute`,
+      command
+    );
+  }
+}
+function underBootstrapDir(path, bootstrapDir) {
+  const p = posix2.normalize(path);
+  const root = posix2.normalize(bootstrapDir);
+  return p === root || p.startsWith(root + "/");
+}
+function remapBootstrapPath(path, ctx) {
+  const root = posix2.normalize(ctx.adapterBootstrapDir);
+  const normalizedPath = posix2.normalize(path);
+  if (!underBootstrapDir(normalizedPath, root)) {
+    throw new CommandTranslationError(
+      `path ${JSON.stringify(path)} was given where a path inside the adapter bootstrap directory was expected`,
+      path
+    );
+  }
+  const rest = normalizedPath.slice(root.length).replace(/^\//, "");
+  const mapped = rest ? `${ctx.managedBundleRoot}${sep3}${rest.split("/").join(sep3)}` : ctx.managedBundleRoot;
+  const normalized = normalize2(mapped);
+  if (normalized !== ctx.managedBundleRoot && !normalized.startsWith(ctx.managedBundleRoot + sep3)) {
+    throw new CommandTranslationError(
+      `bootstrap path ${JSON.stringify(path)} escapes the managed bundle root`,
+      path
+    );
+  }
+  return normalized;
+}
+var BOOTSTRAP_MARKER = /^\.bootstrap-[A-Za-z0-9._-]{1,128}\.ok$/;
+function classifyBootstrapPath(path, ctx) {
+  const root = posix2.normalize(ctx.adapterBootstrapDir);
+  const normalized = posix2.normalize(path);
+  if (!underBootstrapDir(normalized, root)) return { kind: "workspace" };
+  const relative = normalized.slice(root.length).replace(/^\//, "");
+  if (relative.length === 0) {
+    throw new CommandTranslationError(
+      `the adapter bootstrap directory itself is not a file`,
+      path
+    );
+  }
+  if (BOOTSTRAP_MARKER.test(relative)) {
+    return {
+      kind: "session-overlay",
+      overlayPath: `${ctx.bootstrapOverlayDir}${sep3}${relative}`
+    };
+  }
+  if (ctx.adapterBootstrapFiles.includes(relative)) {
+    return {
+      kind: "bundle-asset",
+      bundlePath: remapBootstrapPath(normalized, ctx),
+      relativePath: relative
+    };
+  }
+  throw new CommandTranslationError(
+    `file ${JSON.stringify(relative)} is not part of the pinned ${ctx.harnessId} bootstrap recipe, so this session will not create it. An adapter upgrade that adds a bootstrap file needs a manifest review.`,
+    path
+  );
+}
+function assertUnderSyntheticHome(path, ctx, command) {
+  const home = posix2.normalize(ctx.syntheticHome);
+  const p = posix2.normalize(path);
+  if (p === home || !p.startsWith(home + "/")) {
+    throw new CommandTranslationError(
+      `path operand ${JSON.stringify(path)} is outside the session's synthetic home; the skills-write shapes are only honoured there`,
+      command
+    );
+  }
+}
+async function translateSkillsMove(command, ctx) {
+  const ops = splitQuotedTokens(command.slice("mv -f ".length), command);
+  if (ops.length !== 2) {
+    throw new CommandTranslationError("mv -f needs exactly two operands", command);
+  }
+  for (const p of ops) {
+    assertPlainPathOperand(p, command);
+    assertUnderSyntheticHome(p, ctx, command);
+  }
+  return {
+    kind: "rename",
+    from: await ctx.confine(ops[0]),
+    to: await ctx.confine(ops[1])
+  };
+}
+async function translateSkillsProbe(command, ctx) {
+  const ops = splitQuotedTokens(command.slice("test ! -e ".length), command);
+  if (ops.length !== 1) {
+    throw new CommandTranslationError("test ! -e needs exactly one operand", command);
+  }
+  assertPlainPathOperand(ops[0], command);
+  assertUnderSyntheticHome(ops[0], ctx, command);
+  return { kind: "probe-absent", path: await ctx.confine(ops[0]) };
+}
+async function translateSkillsRemove(command, ctx) {
+  const ops = splitQuotedTokens(command.slice("rm -rf -- ".length), command);
+  if (ops.length === 0) {
+    throw new CommandTranslationError("rm -rf -- with no operands", command);
+  }
+  const paths = [];
+  for (const p of ops) {
+    assertPlainPathOperand(p, command);
+    assertUnderSyntheticHome(p, ctx, command);
+    paths.push(await ctx.confine(p));
+  }
+  return { kind: "remove", paths };
+}
+async function translateMkdir(command, ctx) {
+  const raw = splitQuotedTokens(command.slice("mkdir -p ".length), command);
+  if (raw.length === 0) {
+    throw new CommandTranslationError("mkdir -p with no operands", command);
+  }
+  const paths = [];
+  for (const path of raw) {
+    assertPlainPathOperand(path, command);
+    if (underBootstrapDir(path, posix2.normalize(ctx.adapterBootstrapDir))) {
+      continue;
+    }
+    paths.push(await ctx.confine(path));
+  }
+  if (paths.length === 0) {
+    return {
+      kind: "noop",
+      reason: "mkdir targeted only the managed runtime bundle, which exists"
+    };
+  }
+  return { kind: "mkdir", paths };
+}
+function matchBootstrapInstall(command, ctx) {
+  if (command === "pnpm install --frozen-lockfile --store-dir .pnpm-store") {
+    return {
+      kind: "noop",
+      reason: "vendor dependency graph is supplied by the digest-verified managed runtime bundle; no package manager runs during a session"
+    };
+  }
+  if (ctx.harnessId === "claude-code" && command === "./node_modules/.bin/claude --version") {
+    return {
+      kind: "noop",
+      reason: "vendor CLI is installed and version-verified in the managed runtime bundle at build time; the session does not re-run its version probe"
+    };
+  }
+  return null;
+}
+async function matchBridgeLaunch(command, ctx) {
+  if (!command.startsWith("node ")) return null;
+  const tokens = splitQuotedTokens(command.slice("node ".length), command);
+  const expected = {
+    "claude-code": ["--workdir", "--bridge-state-dir"],
+    codex: ["--workdir", "--bridge-state-dir", "--cli-shim-dir"]
+  };
+  const flags = expected[ctx.harnessId];
+  if (tokens.length !== 1 + flags.length * 2) {
+    throw new CommandTranslationError(
+      `the ${ctx.harnessId} bridge launch must be the bridge path followed by exactly ${flags.join(", ")}, but ${tokens.length} tokens were given`,
+      command
+    );
+  }
+  const bridgeToken = tokens[0];
+  assertPlainPathOperand(bridgeToken, command);
+  const expectedBridge = `${ctx.adapterBootstrapDir}/bridge.mjs`;
+  if (posix2.normalize(bridgeToken) !== posix2.normalize(expectedBridge)) {
+    throw new CommandTranslationError(
+      `bridge launch names ${JSON.stringify(bridgeToken)}, but the only bridge this session may run is the one in its managed bundle`,
+      command
+    );
+  }
+  const args = [
+    ctx.bridgeLauncherPath ?? remapBootstrapPath(expectedBridge, ctx)
+  ];
+  for (let i = 0; i < flags.length; i += 1) {
+    const flag = tokens[1 + i * 2];
+    const value = tokens[2 + i * 2];
+    if (flag !== flags[i]) {
+      throw new CommandTranslationError(
+        `expected bridge flag ${JSON.stringify(flags[i])} at position ${i + 1}, found ${JSON.stringify(flag)}`,
+        command
+      );
+    }
+    assertPlainPathOperand(value, command);
+    args.push(flag, await ctx.confine(value));
+  }
+  assertArgvAllowed(args);
+  return {
+    kind: "exec",
+    executable: ctx.nodeExecutable,
+    args,
+    workingDirectory: await ctx.confine(ctx.sessionRoot)
+  };
+}
+async function translateAdapterCommand(invocation, ctx) {
+  const { command } = invocation;
+  if (typeof command !== "string" || command.length === 0) {
+    throw new CommandTranslationError("empty command", String(command));
+  }
+  if (command.length > 8192) {
+    throw new CommandTranslationError(
+      "command exceeds the length any pinned adapter shape can reach",
+      `${command.slice(0, 120)}\u2026`
+    );
+  }
+  if (command !== command.trim()) {
+    throw new CommandTranslationError(
+      "command has leading or trailing whitespace, which no pinned shape has",
+      command
+    );
+  }
+  if (command === PWD_PROBE) {
+    return { kind: "reply", stdout: ctx.sessionRoot };
+  }
+  if (command === HOME_PROBE) {
+    return { kind: "reply", stdout: ctx.syntheticHome };
+  }
+  const envVar = ENV_MKDIR_SHAPES[command];
+  if (envVar !== void 0) {
+    const target = invocation.env?.[envVar];
+    if (typeof target !== "string" || target.length === 0) {
+      throw new CommandTranslationError(
+        `${command} was issued without a ${envVar} value to create`,
+        command
+      );
+    }
+    assertPlainPathOperand(target, command);
+    if (underBootstrapDir(target, posix2.normalize(ctx.adapterBootstrapDir))) {
+      return {
+        kind: "noop",
+        reason: "mkdir targeted the adapter bootstrap directory, which is served by the read-only managed runtime bundle"
+      };
+    }
+    return { kind: "mkdir", paths: [await ctx.confine(target)] };
+  }
+  const bootstrapNoop = matchBootstrapInstall(command, ctx);
+  if (bootstrapNoop) {
+    const cwd = invocation.workingDirectory;
+    if (cwd !== void 0 && posix2.normalize(cwd) !== posix2.normalize(ctx.adapterBootstrapDir)) {
+      throw new CommandTranslationError(
+        `a bootstrap command was issued from ${JSON.stringify(cwd)} rather than the adapter's bootstrap directory`,
+        command
+      );
+    }
+    return bootstrapNoop;
+  }
+  const bridge = await matchBridgeLaunch(command, ctx);
+  if (bridge) return bridge;
+  if (command.startsWith("mkdir -p ")) {
+    return translateMkdir(command, ctx);
+  }
+  if (command.startsWith("mv -f ")) return translateSkillsMove(command, ctx);
+  if (command.startsWith("test ! -e ")) return translateSkillsProbe(command, ctx);
+  if (command.startsWith("rm -rf -- ")) return translateSkillsRemove(command, ctx);
+  throw new CommandTranslationError(
+    `command is not one of the ${ctx.harnessId} adapter shapes this Inspector is pinned to translate. Local execution never falls back to a shell, so the session fails closed. If this arrived from an adapter upgrade, the compatibility manifest and conformance suite must be re-reviewed before the new shape is accepted.`,
+    command
+  );
+}
+
+// server/utils/harness/local/session-env.ts
+import { readdirSync } from "fs";
+import { posix as posix3, win32 as win322 } from "path";
+function pathFor(platform) {
+  return platform === "win32" ? win322 : posix3;
+}
+var LOCAL_HARNESS_ENV_ALLOWLIST = [
+  // Locale and terminal shape. Vendor CLIs render differently without these
+  // and some refuse to start.
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "TZ",
+  "COLORTERM",
+  // Windows needs these for any process to start at all.
+  "SYSTEMROOT",
+  "SYSTEMDRIVE",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT",
+  "NUMBER_OF_PROCESSORS",
+  "PROCESSOR_ARCHITECTURE"
+];
+var SYSTEM_PATH_POSIX = ["/usr/bin", "/bin", "/usr/sbin", "/sbin"];
+function systemPath(platform, base) {
+  if (platform === "win32") {
+    const root = base.SYSTEMROOT ?? base.WINDIR ?? "C:\\Windows";
+    return [
+      root,
+      win322.join(root, "System32"),
+      win322.join(root, "System32", "Wbem")
+    ].join(win322.delimiter);
+  }
+  return SYSTEM_PATH_POSIX.join(posix3.delimiter);
+}
+var SCOPED_NAME_DENYLIST = /* @__PURE__ */ new Set([
+  // Executable, library, and config resolution.
+  "PATH",
+  "HOME",
+  "USERPROFILE",
+  "NODE_OPTIONS",
+  "NODE_PATH",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "DYLD_INSERT_LIBRARIES",
+  "DYLD_LIBRARY_PATH",
+  // Every generated path this module sets. Scoped values are applied LAST, so
+  // without these a caller could overwrite the synthetic config, cache, and
+  // temp roots and point the child back at the user's real configuration —
+  // undoing the whole reason a synthetic home exists.
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  // Same reason as TMPDIR, and the reason it is set at all: the vendor CLI
+  // extracts its native binary here, so a scoped override would put that
+  // extraction back outside the session's disposable state.
+  "CLAUDE_CODE_TMPDIR",
+  "XDG_CONFIG_HOME",
+  "XDG_CACHE_HOME",
+  "XDG_DATA_HOME",
+  "XDG_STATE_HOME",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "PWD",
+  "MCPJAM_LOCAL_CONTROL_ROOT",
+  "MCPJAM_LOCAL_DENIED_ROOTS",
+  // Names the shell the vendor CLI runs commands through. A scoped override
+  // would point it at any executable; the provider sets it from a path it
+  // has verified exists.
+  "CLAUDE_CODE_GIT_BASH_PATH"
+]);
+var LocalHarnessEnvError = class extends Error {
+};
+function buildLocalHarnessEnv(opts) {
+  const platform = opts.platform ?? process.platform;
+  const base = opts.base ?? process.env;
+  const path = pathFor(platform);
+  if (!path.isAbsolute(opts.syntheticHome)) {
+    throw new LocalHarnessEnvError("syntheticHome must be an absolute path");
+  }
+  if (!path.isAbsolute(opts.sessionRoot)) {
+    throw new LocalHarnessEnvError("sessionRoot must be an absolute path");
+  }
+  const env = {};
+  for (const name of LOCAL_HARNESS_ENV_ALLOWLIST) {
+    const value = base[name];
+    if (typeof value === "string" && value.length > 0) env[name] = value;
+  }
+  env.PATH = platform === "win32" && opts.gitBashPath ? `${path.dirname(opts.gitBashPath)}${path.delimiter}${systemPath(platform, base)}` : systemPath(platform, base);
+  env.HOME = opts.syntheticHome;
+  env.PWD = opts.sessionRoot;
+  env.MCPJAM_LOCAL_CONTROL_ROOT = path.dirname(path.dirname(opts.syntheticHome)).replace(/-sessions$/, "");
+  const deniedRoots = [];
+  const controlRoot = env.MCPJAM_LOCAL_CONTROL_ROOT;
+  for (const parent of [`${controlRoot}-sessions`, path.join(path.dirname(controlRoot), "harness-workspaces"), path.join(path.dirname(controlRoot), "harness-workspaces", "scratch")]) {
+    try {
+      for (const entry of readdirSync(parent, { withFileTypes: true })) {
+        const root = path.join(parent, entry.name);
+        if (entry.isDirectory() && ![opts.syntheticHome, opts.sessionRoot].some((active) => active === root || active.startsWith(root + path.sep))) deniedRoots.push(root);
+      }
+    } catch {
+    }
+  }
+  env.MCPJAM_LOCAL_DENIED_ROOTS = JSON.stringify(deniedRoots);
+  env.TMPDIR = path.join(opts.syntheticHome, "tmp");
+  env.CLAUDE_CODE_TMPDIR = env.TMPDIR;
+  env.XDG_CONFIG_HOME = path.join(opts.syntheticHome, ".config");
+  env.XDG_CACHE_HOME = path.join(opts.syntheticHome, ".cache");
+  env.XDG_DATA_HOME = path.join(opts.syntheticHome, ".local", "share");
+  env.XDG_STATE_HOME = path.join(opts.syntheticHome, ".local", "state");
+  if (platform === "win32") {
+    env.USERPROFILE = opts.syntheticHome;
+    env.APPDATA = path.join(opts.syntheticHome, "AppData", "Roaming");
+    env.LOCALAPPDATA = path.join(opts.syntheticHome, "AppData", "Local");
+    env.TEMP = env.TMPDIR;
+    env.TMP = env.TMPDIR;
+    if (opts.gitBashPath !== void 0) {
+      if (!path.isAbsolute(opts.gitBashPath)) {
+        throw new LocalHarnessEnvError("gitBashPath must be an absolute path");
+      }
+      env.CLAUDE_CODE_GIT_BASH_PATH = opts.gitBashPath;
+    }
+  }
+  env.CI = "1";
+  env.NO_COLOR = "1";
+  validateLocalHarnessScopedEnv(opts.scoped ?? {});
+  Object.assign(env, opts.scoped);
+  return env;
+}
+function validateLocalHarnessScopedEnv(scoped) {
+  for (const [name, value] of Object.entries(scoped)) {
+    if (SCOPED_NAME_DENYLIST.has(name.toUpperCase())) {
+      throw new LocalHarnessEnvError(
+        `scoped environment entry ${name} is not allowed: it would redirect executable, library, or config resolution for the child`
+      );
+    }
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+      throw new LocalHarnessEnvError(
+        `scoped environment name ${JSON.stringify(name)} is not a valid environment variable name`
+      );
+    }
+    if (/[\0\n\r]/.test(value)) {
+      throw new LocalHarnessEnvError(
+        `scoped environment value for ${name} contains a control character`
+      );
+    }
+  }
+}
+function validateLocalHarnessSecretEnv(scoped) {
+  validateLocalHarnessScopedEnv(scoped);
+  for (const name of Object.keys(scoped)) {
+    if (/^(ANTHROPIC_|AI_GATEWAY_|BRIDGE_|CLAUDE_CODE_)/i.test(name)) {
+      throw new LocalHarnessEnvError(
+        `Project secret ${name} conflicts with the local harness runtime.`
+      );
+    }
+  }
+}
+var BRIDGE_SUPPLIED_ENV_ALLOWLIST = [
+  // Bridge control channel.
+  "BRIDGE_CHANNEL_TOKEN",
+  "BRIDGE_WS_PORT",
+  "BRIDGE_REPLAY_FROM_DISK",
+  // Vendor model endpoints and credentials, as computed by the adapter from
+  // the explicit auth Inspector hands it.
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_BASE_URL",
+  "CODEX_API_KEY",
+  "OPENAI_API_KEY",
+  "OPENAI_BASE_URL",
+  "AI_GATEWAY_API_KEY",
+  "AI_GATEWAY_BASE_URL"
+];
+function filterBridgeSuppliedEnv(env) {
+  const filtered = {};
+  if (!env) return filtered;
+  for (const name of BRIDGE_SUPPLIED_ENV_ALLOWLIST) {
+    const value = env[name];
+    if (typeof value === "string" && !/[\0\n\r]/.test(value)) {
+      filtered[name] = value;
+    }
+  }
+  return filtered;
+}
+function syntheticHomeDirectories(syntheticHome, platform = process.platform) {
+  const path = pathFor(platform);
+  const dirs = [
+    syntheticHome,
+    path.join(syntheticHome, "tmp"),
+    path.join(syntheticHome, ".config"),
+    path.join(syntheticHome, ".cache"),
+    path.join(syntheticHome, ".local", "share"),
+    path.join(syntheticHome, ".local", "state")
+  ];
+  if (platform === "win32") {
+    dirs.push(
+      path.join(syntheticHome, "AppData", "Roaming"),
+      path.join(syntheticHome, "AppData", "Local")
+    );
+  }
+  return dirs;
+}
+
+// server/utils/harness/local/supervised-provider.ts
+var encoder = new TextEncoder();
+var DEFAULT_LOCAL_HARNESS_FILE_LIMIT_BYTES = 16 * 1024 * 1024;
+var LocalHarnessFileLimitError = class extends Error {
+};
+function completedProcess(stdout, exitCode = 0) {
+  const make = (text) => new ReadableStream({
+    start(controller) {
+      if (text.length > 0) controller.enqueue(encoder.encode(text));
+      controller.close();
+    }
+  });
+  return {
+    pid: void 0,
+    stdout: make(stdout),
+    stderr: make(""),
+    wait: async () => ({ exitCode }),
+    kill: async () => {
+    }
+  };
+}
+async function collectStreamBytes(stream, abortSignal, maxBytes = Number.MAX_SAFE_INTEGER) {
+  const reader = stream.getReader();
+  const chunks = [];
+  const abortError = () => abortSignal?.reason instanceof Error ? abortSignal.reason : new Error("aborted");
+  let removeAbortListener = () => {
+  };
+  let abortRace = null;
+  if (abortSignal !== void 0) {
+    abortRace = new Promise((_resolve, reject) => {
+      const onAbort = () => reject(abortError());
+      abortSignal.addEventListener("abort", onAbort, { once: true });
+      removeAbortListener = () => abortSignal.removeEventListener("abort", onAbort);
+    });
+    abortRace.catch(() => {
+    });
+  }
+  try {
+    let total2 = 0;
+    for (; ; ) {
+      if (abortSignal?.aborted) throw abortError();
+      const pending = reader.read();
+      pending.catch(() => {
+      });
+      const { done, value } = abortRace === null ? await pending : await Promise.race([pending, abortRace]);
+      if (done) break;
+      if (value) {
+        if (value.byteLength > maxBytes - total2) {
+          throw new LocalHarnessFileLimitError(
+            `file operation exceeds the ${maxBytes}-byte local harness limit`
+          );
+        }
+        total2 += value.byteLength;
+        chunks.push(value);
+      }
+    }
+  } catch (error) {
+    void reader.cancel(error).catch(() => {
+    });
+    throw error;
+  } finally {
+    removeAbortListener();
+    reader.releaseLock();
+  }
+  const total = chunks.reduce((n, c) => n + c.byteLength, 0);
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return merged;
+}
+async function openBoundedFileStream(path, maxBytes, abortSignal) {
+  let handle;
+  try {
+    handle = await open(path, "r");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  try {
+    const info = await handle.stat();
+    if (!info.isFile()) {
+      throw new Error(`refusing to read non-regular file ${path}`);
+    }
+    if (info.size > maxBytes) {
+      throw new LocalHarnessFileLimitError(
+        `file ${path} is ${info.size} bytes; the local harness limit is ${maxBytes} bytes`
+      );
+    }
+  } catch (error) {
+    await handle.close().catch(() => {
+    });
+    throw error;
+  }
+  let position = 0;
+  let closed = false;
+  const close = async () => {
+    if (closed) return;
+    closed = true;
+    await handle.close().catch(() => {
+    });
+  };
+  const abortError = () => abortSignal?.reason instanceof Error ? abortSignal.reason : new Error("aborted");
+  return new ReadableStream({
+    async pull(controller) {
+      try {
+        if (abortSignal?.aborted) throw abortError();
+        const room = Math.max(maxBytes - position, 0);
+        const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, room + 1));
+        const { bytesRead } = await handle.read(
+          buffer,
+          0,
+          buffer.byteLength,
+          position
+        );
+        if (abortSignal?.aborted) throw abortError();
+        if (bytesRead === 0) {
+          await close();
+          controller.close();
+          return;
+        }
+        if (bytesRead > room) {
+          throw new LocalHarnessFileLimitError(
+            `file ${path} grew beyond the ${maxBytes}-byte local harness limit`
+          );
+        }
+        position += bytesRead;
+        controller.enqueue(
+          new Uint8Array(buffer.buffer, buffer.byteOffset, bytesRead)
+        );
+      } catch (error) {
+        await close();
+        controller.error(error);
+      }
+    },
+    async cancel() {
+      await close();
+    }
+  });
+}
+async function readBoundedFileBytes(path, maxBytes, abortSignal) {
+  const stream = await openBoundedFileStream(path, maxBytes, abortSignal);
+  if (stream === null) return null;
+  return collectStreamBytes(stream, abortSignal, maxBytes);
+}
+async function writeBytesAtomically(path, bytes, abortSignal) {
+  const abortError = () => abortSignal?.reason instanceof Error ? abortSignal.reason : new Error("aborted");
+  if (abortSignal?.aborted) throw abortError();
+  const parent = dirname2(path);
+  await mkdir3(parent, { recursive: true, mode: 448 });
+  let mode = 384;
+  try {
+    mode = (await stat3(path)).mode & 511;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const temp = join3(parent, `.${basename(path)}.${randomUUID2()}.tmp`);
+  const handle = await open(temp, "wx", mode);
+  let closed = false;
+  try {
+    await handle.writeFile(
+      bytes,
+      abortSignal === void 0 ? void 0 : { signal: abortSignal }
+    );
+    await handle.sync();
+    if (abortSignal?.aborted) throw abortError();
+    await handle.close();
+    closed = true;
+    await rename2(temp, path);
+  } catch (error) {
+    if (!closed) await handle.close().catch(() => {
+    });
+    await rm(temp, { force: true }).catch(() => {
+    });
+    throw error;
+  }
+}
+async function resolveGitBashPath(platform) {
+  if (platform !== "win32") return void 0;
+  const configured = process.env.CLAUDE_CODE_GIT_BASH_PATH;
+  const candidates = [
+    ...configured && isAbsolute3(configured) ? [configured] : [],
+    join3(
+      process.env.ProgramFiles ?? "C:\\Program Files",
+      "Git",
+      "bin",
+      "bash.exe"
+    )
+  ];
+  for (const candidate of candidates) {
+    try {
+      if ((await stat3(candidate)).isFile()) return candidate;
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function readHead(stream, maxBytes, budgetMs) {
+  const decoder = new TextDecoder();
+  let head = "";
+  const deadline = Date.now() + budgetMs;
+  const reader = stream.getReader();
+  try {
+    while (head.length < maxBytes) {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) break;
+      const next = await Promise.race([
+        reader.read(),
+        new Promise(
+          (resolveRace) => setTimeout(() => resolveRace({ done: true }), remaining)
+        )
+      ]);
+      if (next.done || next.value === void 0) break;
+      head += decoder.decode(next.value, { stream: true });
+    }
+  } catch {
+  } finally {
+    reader.releaseLock();
+  }
+  return head.slice(0, maxBytes);
+}
+async function describeFailedBridge(handle, exitBeforeStop) {
+  const exit = exitBeforeStop !== null ? `exited on its own with code ${exitBeforeStop.exitCode}` : "was still running when the session was stopped";
+  const keptErr = handle.stderrHead?.() ?? "";
+  const keptOut = handle.stdoutHead?.() ?? "";
+  const [out, err] = await Promise.all([
+    keptOut.length > 0 ? Promise.resolve(keptOut) : readHead(handle.stdout, 1024, 500),
+    keptErr.length > 0 ? Promise.resolve(keptErr) : readHead(handle.stderr, 2048, 500)
+  ]);
+  const parts = [exit];
+  if (err.trim().length > 0) parts.push(`stderr: ${JSON.stringify(err.trim())}`);
+  if (out.trim().length > 0) parts.push(`stdout: ${JSON.stringify(out.trim())}`);
+  return parts.join("; ");
+}
+async function collectStream(stream) {
+  return new TextDecoder().decode(await collectStreamBytes(stream));
+}
+function createSupervisedLocalHarnessProvider(opts) {
+  const maxFileBytes = opts.maxFileBytes ?? DEFAULT_LOCAL_HARNESS_FILE_LIMIT_BYTES;
+  if (!Number.isSafeInteger(maxFileBytes) || maxFileBytes <= 0) {
+    throw new Error("maxFileBytes must be a positive safe integer");
+  }
+  const assertFileSize = (bytes) => {
+    if (bytes > maxFileBytes) {
+      throw new LocalHarnessFileLimitError(
+        `file operation is ${bytes} bytes; the local harness limit is ${maxFileBytes} bytes`
+      );
+    }
+  };
+  const syntheticHome = join3(opts.sessionStateDir, "home");
+  const bootstrapOverlay = join3(opts.sessionStateDir, "bootstrap");
+  const workRoot = join3(opts.sessionStateDir, "work");
+  const WORKSPACE_LINK_NAME = "project";
+  const platform = opts.platform ?? process.platform;
+  const adapterWorkRoot = toAdapterPath(workRoot, platform);
+  const adapterHome = toAdapterPath(syntheticHome, platform);
+  const linkWorkspace = async (link) => {
+    await symlink(
+      opts.workspacePath,
+      link,
+      platform === "win32" ? "junction" : void 0
+    );
+  };
+  const buildSession = async (sessionId, abortSignal) => {
+    for (const dir of syntheticHomeDirectories(syntheticHome, platform)) {
+      await mkdir3(dir, { recursive: true, mode: 448 });
+    }
+    await mkdir3(bootstrapOverlay, { recursive: true, mode: 448 });
+    await mkdir3(workRoot, { recursive: true, mode: 448 });
+    const workspaceLink = join3(workRoot, WORKSPACE_LINK_NAME);
+    try {
+      const existing = await lstat2(workspaceLink);
+      if (!existing.isSymbolicLink()) {
+        throw new Error(`${workspaceLink} exists and is not the workspace link`);
+      }
+      const current = await readlink4(workspaceLink);
+      const resolved = await realpath3(workspaceLink).catch(
+        (error) => {
+          if (error.code === "ENOENT") return null;
+          throw error;
+        }
+      );
+      const textAgrees = platform === "win32" ? true : current === opts.workspacePath;
+      if (!textAgrees || resolved !== opts.workspacePath) {
+        logger.warn("[local-harness] repointing a stale workspace link", {
+          sessionStateDir: opts.sessionStateDir
+        });
+        await rm(workspaceLink, { force: true });
+        await linkWorkspace(workspaceLink);
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      await linkWorkspace(workspaceLink);
+    }
+    const roots = [await realpath3(opts.sessionStateDir), opts.workspacePath];
+    const confine = (path) => confinePath(fromAdapterPath(path, platform), { roots });
+    const gitBashPath = await resolveGitBashPath(platform);
+    const env = {
+      ...buildLocalHarnessEnv({
+        syntheticHome,
+        sessionRoot: opts.workspacePath,
+        platform,
+        ...opts.scopedEnv ? { scoped: opts.scopedEnv } : {},
+        ...gitBashPath !== void 0 ? { gitBashPath } : {}
+      }),
+      ...opts.launcher.requiredEnv
+    };
+    const translationContext = {
+      harnessId: opts.harnessId,
+      // Resolved exactly as the framework resolves it — against the session's
+      // default working directory — so the translator matches the string the
+      // adapters will actually emit.
+      adapterBootstrapDir: posix4.resolve(
+        adapterWorkRoot,
+        opts.manifest.adapterBootstrapDir
+      ),
+      managedBundleRoot: opts.runtime.rootPath,
+      adapterBootstrapFiles: opts.manifest.adapterBootstrapFiles,
+      bootstrapOverlayDir: bootstrapOverlay,
+      nodeExecutable: opts.launcher.executable,
+      // Launch the pack's loopback wrapper rather than the remapped
+      // `bridge.mjs`, which stays byte-identical so the recipe compare holds.
+      bridgeLauncherPath: opts.runtime.launcherPath,
+      // The framework's default working directory (and the bridge's cwd), in
+      // the shape the adapter composes with. `confine` turns it native.
+      sessionRoot: adapterWorkRoot,
+      syntheticHome: adapterHome,
+      // The same symlink-aware check the file API uses. The translator awaits
+      // it for every session-scoped operand, including the bridge's own
+      // `--workdir` and `--bridge-state-dir`, which nothing downstream would
+      // otherwise check: they are consumed by the child, not by a filesystem
+      // call we make.
+      confine
+    };
+    const resolveForRead = async (path) => {
+      const target = classifyBootstrapPath(path, translationContext);
+      if (target.kind === "bundle-asset") return target.bundlePath;
+      if (target.kind === "session-overlay") return confine(target.overlayPath);
+      return confine(path);
+    };
+    const resolveForWrite = async (path, bytes, signal) => {
+      const target = classifyBootstrapPath(path, translationContext);
+      if (target.kind === "session-overlay") {
+        return confine(target.overlayPath);
+      }
+      if (target.kind === "workspace") return confine(path);
+      const existing = await readBoundedFileBytes(
+        target.bundlePath,
+        maxFileBytes,
+        signal
+      );
+      if (existing === null) {
+        throw new Error(
+          `the managed ${opts.harnessId} bundle does not contain ${target.relativePath}, which the pinned adapter's bootstrap recipe writes. The bundle and the pinned adapter disagree; refusing rather than installing it into the workspace.`
+        );
+      }
+      if (!Buffer.from(existing).equals(Buffer.from(bytes))) {
+        throw new Error(
+          `the pinned adapter's ${target.relativePath} differs from the copy in the verified managed bundle. Local sessions run the bundle's copy, so this session would not be running what the adapter bootstrapped; refusing until the bundle is rebuilt for this adapter version.`
+        );
+      }
+      logger.debug("[local-harness] bootstrap file satisfied by bundle", {
+        file: target.relativePath
+      });
+      return null;
+    };
+    const ports = [opts.bridgePort];
+    let bridgeClaimed = false;
+    const assertPortLeased = (port) => {
+      if (!ports.includes(port)) {
+        throw new Error(
+          `port ${port} is not leased to this session; the local provider only resolves ports it opened`
+        );
+      }
+    };
+    const assertRuntimeUnchanged = async () => {
+      const result = await revalidateRuntime(opts.runtime);
+      if (!result.ok) {
+        throw new Error(
+          `refusing to launch: ${result.message}. Local execution is bound to a runtime identity, so a changed runtime needs fresh consent.`
+        );
+      }
+    };
+    const envFor = (supplied) => ({
+      ...env,
+      ...filterBridgeSuppliedEnv(supplied)
+    });
+    const runTranslated = async (translated, abort, suppliedEnv) => {
+      switch (translated.kind) {
+        case "reply":
+          return {
+            exitCode: translated.exitCode ?? 0,
+            stdout: translated.stdout,
+            stderr: ""
+          };
+        // The framework's skills writer, performed with `node:fs`. Operands
+        // were confined to the synthetic home by the translator; no shell is
+        // involved at any point.
+        case "rename": {
+          await rename2(translated.from, translated.to);
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        case "remove": {
+          for (const path of translated.paths) {
+            await rm(path, { recursive: true, force: true });
+          }
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        case "probe-absent": {
+          try {
+            await stat3(translated.path);
+            return { exitCode: 1, stdout: "", stderr: "" };
+          } catch (error) {
+            if (error.code === "ENOENT") {
+              return { exitCode: 0, stdout: "", stderr: "" };
+            }
+            throw error;
+          }
+        }
+        case "noop":
+          logger.debug("[local-harness] adapter command satisfied by bundle", {
+            reason: translated.reason
+          });
+          return { exitCode: 0, stdout: "", stderr: "" };
+        case "mkdir": {
+          for (const path of translated.paths) {
+            await mkdir3(path, { recursive: true, mode: 448 });
+          }
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        case "exec": {
+          await assertRuntimeUnchanged();
+          const handle = await opts.supervisor.spawnSupervised({
+            sessionId,
+            executable: translated.executable,
+            args: translated.args,
+            workingDirectory: translated.workingDirectory,
+            env: envFor(suppliedEnv),
+            runtimeId: opts.runtime.runtimeId,
+            workspaceGrantId: opts.workspaceGrantId,
+            targetKind: opts.targetKind,
+            sessionStateDir: opts.sessionStateDir,
+            ...opts.runtime.jobLauncherPath !== void 0 ? { jobLauncherPath: opts.runtime.jobLauncherPath } : {},
+            role: "helper",
+            ...abort ? { abortSignal: abort } : {}
+          });
+          const [stdout, stderr, result] = await Promise.all([
+            collectStream(handle.stdout),
+            collectStream(handle.stderr),
+            handle.wait()
+          ]);
+          return { exitCode: result.exitCode, stdout, stderr };
+        }
+      }
+    };
+    let restrictedSession;
+    const session = {
+      id: sessionId,
+      // The granted workspace is the session's root. The harness framework
+      // nests `<workspace>/<harnessId>-<sessionId>` beneath it, which is where
+      // the agent actually works — the same shape as the hosted path, so a
+      // session's artefacts stay identifiable inside the user's own checkout.
+      // Staged materialization with diff-based apply-back is a separate step
+      // and is not pretended here.
+      defaultWorkingDirectory: adapterWorkRoot,
+      description: `Supervised local ${opts.harnessId} process on this machine. Working directory ${opts.workspacePath}. Bridge on loopback port ${opts.bridgePort}. This is NOT an isolated sandbox: the process runs with this operating-system user's authority, narrowed only by the harness's own permission settings.`,
+      // ── file I/O (confined to the granted roots) ──────────────────────
+      readTextFile: async ({
+        path,
+        abortSignal: signal,
+        encoding,
+        startLine,
+        endLine
+      }) => {
+        const canonical = await resolveForRead(path);
+        const bytes = await readBoundedFileBytes(
+          canonical,
+          maxFileBytes,
+          signal ?? abortSignal
+        );
+        if (bytes === null) return null;
+        const text = Buffer.from(bytes).toString(
+          encoding ?? "utf8"
+        );
+        if (startLine === void 0 && endLine === void 0) return text;
+        const lines = text.split("\n");
+        const from = Math.max((startLine ?? 1) - 1, 0);
+        const to = endLine === void 0 ? lines.length : Math.min(endLine, lines.length);
+        return lines.slice(from, to).join("\n");
+      },
+      readBinaryFile: async ({ path, abortSignal: signal }) => {
+        const canonical = await resolveForRead(path);
+        return readBoundedFileBytes(
+          canonical,
+          maxFileBytes,
+          signal ?? abortSignal
+        );
+      },
+      readFile: async ({ path, abortSignal: signal }) => {
+        const canonical = await resolveForRead(path);
+        return openBoundedFileStream(
+          canonical,
+          maxFileBytes,
+          signal ?? abortSignal
+        );
+      },
+      writeTextFile: async ({
+        path,
+        content,
+        encoding,
+        abortSignal: signal
+      }) => {
+        const charset = encoding ?? "utf8";
+        const bytes = Buffer.from(content, charset);
+        assertFileSize(bytes.byteLength);
+        const writeSignal = signal ?? abortSignal;
+        const canonical = await resolveForWrite(path, bytes, writeSignal);
+        if (canonical === null) return;
+        await writeBytesAtomically(canonical, bytes, writeSignal);
+      },
+      writeBinaryFile: async ({ path, content, abortSignal: signal }) => {
+        assertFileSize(content.byteLength);
+        const writeSignal = signal ?? abortSignal;
+        const canonical = await resolveForWrite(path, content, writeSignal);
+        if (canonical === null) return;
+        await writeBytesAtomically(canonical, content, writeSignal);
+      },
+      writeFile: async ({ path, content, abortSignal: signal }) => {
+        const bytes = await collectStreamBytes(
+          content,
+          signal ?? abortSignal,
+          maxFileBytes
+        );
+        const writeSignal = signal ?? abortSignal;
+        const canonical = await resolveForWrite(path, bytes, writeSignal);
+        if (canonical === null) return;
+        await writeBytesAtomically(canonical, bytes, writeSignal);
+      },
+      // ── exec ──────────────────────────────────────────────────────────
+      run: async ({
+        command,
+        workingDirectory,
+        abortSignal: signal,
+        env: suppliedEnv
+      }) => {
+        const translated = await translateAdapterCommand(
+          { command, workingDirectory, env: suppliedEnv },
+          translationContext
+        );
+        return runTranslated(translated, signal ?? abortSignal, suppliedEnv);
+      },
+      spawn: async ({
+        command,
+        workingDirectory,
+        abortSignal: signal,
+        env: suppliedEnv
+      }) => {
+        const translated = await translateAdapterCommand(
+          { command, workingDirectory, env: suppliedEnv },
+          translationContext
+        );
+        if (translated.kind !== "exec") {
+          const result = await runTranslated(
+            translated,
+            signal ?? abortSignal,
+            suppliedEnv
+          );
+          return completedProcess(result.stdout, result.exitCode);
+        }
+        const isBridge = !bridgeClaimed;
+        if (isBridge) bridgeClaimed = true;
+        const releaseBridgeClaim = () => {
+          if (isBridge) bridgeClaimed = false;
+        };
+        let handle;
+        try {
+          await assertRuntimeUnchanged();
+          if (isBridge) {
+            await assertBridgePortUnclaimed({ port: opts.bridgePort });
+          }
+          handle = await opts.supervisor.spawnSupervised({
+            sessionId,
+            executable: translated.executable,
+            args: translated.args,
+            workingDirectory: translated.workingDirectory,
+            env: envFor(suppliedEnv),
+            runtimeId: opts.runtime.runtimeId,
+            workspaceGrantId: opts.workspaceGrantId,
+            targetKind: opts.targetKind,
+            sessionStateDir: opts.sessionStateDir,
+            ...opts.runtime.jobLauncherPath !== void 0 ? { jobLauncherPath: opts.runtime.jobLauncherPath } : {},
+            // The first spawned process is the session's root: killing it must
+            // take the whole tree, and it is the record the janitor reclaims.
+            role: isBridge ? "root" : "helper",
+            ...signal ?? abortSignal ? { abortSignal: signal ?? abortSignal } : {}
+          });
+        } catch (error) {
+          releaseBridgeClaim();
+          throw error;
+        }
+        if (isBridge) {
+          try {
+            await assertBridgeLoopbackOnly({
+              port: opts.bridgePort,
+              ...opts.bridgeReadinessTimeoutMs !== void 0 ? { readinessTimeoutMs: opts.bridgeReadinessTimeoutMs } : {},
+              // Corroborates the connect probe by reading the binding out of
+              // the kernel, which catches an address the machine has but this
+              // process cannot route to — unreachable from here, still bound.
+              bridgePid: handle.pid,
+              // Ties the listener to the process we started: a port answering
+              // after our bridge died is somebody else's.
+              isBridgeAlive: async () => opts.supervisor.liveProcessCount(sessionId) > 0
+            });
+            if (opts.onBridgeStarted) {
+              await opts.onBridgeStarted({
+                pid: handle.pid,
+                port: opts.bridgePort
+              });
+            }
+          } catch (error) {
+            releaseBridgeClaim();
+            const exitBeforeStop = handle.exited?.() ?? null;
+            await opts.supervisor.stopSession(sessionId).catch(() => {
+            });
+            if (error instanceof Error) {
+              const said = await describeFailedBridge(
+                handle,
+                exitBeforeStop
+              ).catch(() => "no diagnosis could be read");
+              error.message = `${error.message} (bridge: ${said})`;
+            }
+            throw error;
+          }
+        }
+        return handle;
+      },
+      // ── infra surface ─────────────────────────────────────────────────
+      ports,
+      // Both resolvers answer from the same loopback authority. The stable
+      // contract made `getPortEndpoint` the required one and left `getPortUrl`
+      // in place as deprecated; a local provider must never let either return
+      // an address reachable from off-box.
+      getPortEndpoint: async ({ port, protocol }) => {
+        assertPortLeased(port);
+        return {
+          url: localBridgeUrl({ port, ...protocol ? { protocol } : {} })
+        };
+      },
+      getPortUrl: async ({ port, protocol }) => {
+        assertPortLeased(port);
+        return localBridgeUrl({ port, ...protocol ? { protocol } : {} });
+      },
+      setPorts: async (next) => {
+        ports.splice(0, ports.length, ...next);
+      },
+      // setNetworkPolicy is intentionally NOT implemented. A native provider
+      // has no primitive that would enforce one, and the contract treats a
+      // missing optional method as a no-op — so a misleading empty
+      // implementation would be strictly worse than its absence.
+      stop: async () => {
+        const result = await opts.supervisor.stopSession(sessionId);
+        if (!result.stopped) {
+          throw new Error(
+            `${result.escaped} supervised process tree(s) survived termination for session ${sessionId}; the session is NOT reported stopped`
+          );
+        }
+      },
+      destroy: async () => {
+        const result = await opts.supervisor.stopSession(sessionId);
+        if (!result.stopped) {
+          throw new Error(
+            `${result.escaped} supervised process tree(s) survived termination for session ${sessionId}`
+          );
+        }
+        await removeSessionStateDir(opts.sessionStateDir);
+      },
+      // A TypeScript annotation does not remove properties at runtime. Return
+      // a separately constructed capability object so user-tool code cannot
+      // cast its way to stop/destroy, port mutation, or endpoint resolution.
+      restricted: () => restrictedSession
+    };
+    restrictedSession = Object.freeze({
+      description: session.description,
+      readFile: session.readFile,
+      readBinaryFile: session.readBinaryFile,
+      readTextFile: session.readTextFile,
+      writeFile: session.writeFile,
+      writeBinaryFile: session.writeBinaryFile,
+      writeTextFile: session.writeTextFile,
+      spawn: session.spawn,
+      run: session.run
+    });
+    return session;
+  };
+  return {
+    specificationVersion: "harness-sandbox-v1",
+    providerId: "mcpjam-local-supervised",
+    // `bridgePorts` is gone from the stable contract: port discovery is the
+    // adapter's job now, reading `session.ports` and resolving through
+    // `getPortEndpoint`.
+    createSession: async (options) => {
+      const sessionId = options?.sessionId ?? `local-${Date.now()}`;
+      return buildSession(sessionId, options?.abortSignal);
+    },
+    // Resume reattaches to the SAME session state directory. Whether the
+    // bridge process is still alive is the supervisor's registry to answer;
+    // the adapter's own resume path reconnects to it when it is, and respawns
+    // when it is not.
+    resumeSession: async (options) => buildSession(options.sessionId, options.abortSignal)
+  };
+}
+async function removeSessionStateDir(dir) {
+  const root = resolve2(`${localHarnessStateRoot()}-sessions`);
+  const target = resolve2(dir);
+  if (target === root || !target.startsWith(root + sep4)) {
+    logger.warn("[local-harness] refusing to remove state outside the root", {
+      dir
+    });
+    return;
+  }
+  await rm(target, { recursive: true, force: true });
+}
+function sessionStateDirFor(stateRoot, sessionId) {
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(sessionId)) {
+    throw new Error(
+      `session id ${JSON.stringify(
+        sessionId
+      )} is not a single safe path segment`
+    );
+  }
+  return join3(`${stateRoot}-sessions`, sessionId);
+}
+
+// server/utils/harness/local/supervisor.ts
+import { spawn } from "child_process";
+import { mkdir as mkdir5, chmod as chmod4 } from "fs/promises";
+import { isAbsolute as isAbsolute4 } from "path";
+
+// server/utils/harness/local/process-registry.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import {
+  mkdir as mkdir4,
+  readFile as readFile5,
+  rename as rename3,
+  writeFile as writeFile3,
+  chmod as chmod3,
+  rm as rm2
+} from "fs/promises";
+import { join as join4, resolve as resolve3, sep as sep5 } from "path";
+function registryPath() {
+  return join4(localHarnessStateRoot(), "processes.json");
+}
+var withRegistryLock = createLocalStateMutationLock({
+  rootDir: localHarnessStateRoot,
+  lockFileName: "processes.lock",
+  resourceLabel: "process registry"
+});
+var RegistryUnreadableError = class extends Error {
+};
+async function readRegistry() {
+  let raw;
+  try {
+    raw = await readFile5(registryPath(), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { version: 1, records: [] };
+    }
+    throw new RegistryUnreadableError(
+      `the local harness process registry could not be read: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new RegistryUnreadableError(
+      "the local harness process registry is corrupt; refusing to overwrite it, because it may name process trees that are still running"
+    );
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new RegistryUnreadableError(
+      "the local harness process registry is not an object"
+    );
+  }
+  const record = parsed;
+  if (record.version !== 1 || !Array.isArray(record.records)) {
+    throw new RegistryUnreadableError(
+      "the local harness process registry has an unrecognized shape"
+    );
+  }
+  return { version: 1, records: record.records };
+}
+async function writeRegistry(registry) {
+  const dir = localHarnessStateRoot();
+  await mkdir4(dir, { recursive: true, mode: 448 });
+  await chmod3(dir, 448).catch(() => {
+  });
+  const file = registryPath();
+  const tmp = `${file}.tmp`;
+  await writeFile3(tmp, JSON.stringify(registry), { mode: 384 });
+  await rename3(tmp, file);
+}
+function mintSupervisorNonce() {
+  return `sup_${randomUUID3()}`;
+}
+function recordProcess(record) {
+  return withRegistryLock(async () => {
+    const registry = await readRegistry();
+    registry.records = registry.records.filter(
+      (r) => r.sessionId !== record.sessionId
+    );
+    registry.records.push(record);
+    await writeRegistry(registry);
+  });
+}
+function updateLifecycleState(sessionId, lifecycleState) {
+  return withRegistryLock(async () => {
+    const registry = await readRegistry();
+    const record = registry.records.find((r) => r.sessionId === sessionId);
+    if (!record) return;
+    record.lifecycleState = lifecycleState;
+    await writeRegistry(registry);
+  });
+}
+function forgetProcess(sessionId) {
+  return withRegistryLock(async () => {
+    const registry = await readRegistry();
+    const before = registry.records.length;
+    registry.records = registry.records.filter(
+      (r) => r.sessionId !== sessionId
+    );
+    if (registry.records.length !== before) await writeRegistry(registry);
+  });
+}
+async function listProcessRecords() {
+  return (await readRegistry()).records;
+}
+async function owningSupervisorProvablyExited(record, platform) {
+  if (record.supervisorPid === void 0 || record.supervisorBirthIdentity === void 0) {
+    return false;
+  }
+  const probe = await probeProcess(record.supervisorPid, platform);
+  if (probe.state === "gone") return true;
+  if (probe.state === "unknown") return false;
+  return probe.identity !== record.supervisorBirthIdentity;
+}
+function janitorOutcomeForUnsettled(outcome) {
+  if (outcome === "escaped") return "escaped";
+  if (outcome === "unknown") return "skipped-unprovable";
+  return "not-owned";
+}
+async function removeSessionState(dir) {
+  const root = resolve3(`${localHarnessStateRoot()}-sessions`);
+  const target = resolve3(dir);
+  if (target === root || !target.startsWith(root + sep5)) {
+    logger.warn("[local-harness] refusing to clean state outside the root", {
+      dir
+    });
+    return;
+  }
+  await rm2(target, { recursive: true, force: true }).catch(() => {
+  });
+}
+function reclaimAbandonedProcesses(args) {
+  return withRegistryLock(async () => {
+    const platform = args.platform ?? process.platform;
+    const registry = await readRegistry();
+    const results = [];
+    const survivors = [];
+    for (const record of registry.records) {
+      if (record.supervisorNonce === args.liveNonce) {
+        survivors.push(record);
+        results.push({
+          sessionId: record.sessionId,
+          outcome: "skipped-live-supervisor"
+        });
+        continue;
+      }
+      if (!supportsOwnershipProof(platform)) {
+        survivors.push(record);
+        results.push({
+          sessionId: record.sessionId,
+          outcome: "skipped-unprovable"
+        });
+        continue;
+      }
+      if (!await owningSupervisorProvablyExited(record, platform)) {
+        survivors.push(record);
+        results.push({
+          sessionId: record.sessionId,
+          outcome: "skipped-live-supervisor"
+        });
+        continue;
+      }
+      const rootProbe = await probeProcess(record.rootPid, platform);
+      if (rootProbe.state === "unknown") {
+        survivors.push(record);
+        results.push({
+          sessionId: record.sessionId,
+          outcome: "skipped-unprovable"
+        });
+        continue;
+      }
+      if (rootProbe.state === "gone") {
+        const group = await probeProcessGroup(record.rootPid, platform);
+        if (group === "live") {
+          survivors.push(record);
+          results.push({ sessionId: record.sessionId, outcome: "escaped" });
+          logger.warn(
+            "[local-harness] descendants outlived their root; record kept",
+            { sessionId: record.sessionId }
+          );
+          continue;
+        }
+        if (group === "unknown") {
+          survivors.push(record);
+          results.push({
+            sessionId: record.sessionId,
+            outcome: "skipped-unprovable"
+          });
+          continue;
+        }
+        await removeSessionState(record.sessionStateDir);
+        results.push({ sessionId: record.sessionId, outcome: "already-gone" });
+        continue;
+      }
+      if (rootProbe.identity !== record.processBirthIdentity) {
+        survivors.push(record);
+        results.push({ sessionId: record.sessionId, outcome: "not-owned" });
+        logger.warn("[local-harness] refusing to reclaim a reused pid", {
+          sessionId: record.sessionId
+        });
+        continue;
+      }
+      const outcome = await terminateOwnedProcessGroup({
+        pid: record.rootPid,
+        birthIdentity: record.processBirthIdentity,
+        graceMs: args.graceMs ?? 5e3,
+        platform
+      });
+      if (outcome.outcome === "graceful" || outcome.outcome === "forced") {
+        await removeSessionState(record.sessionStateDir);
+        results.push({ sessionId: record.sessionId, outcome: "terminated" });
+        continue;
+      }
+      if (outcome.outcome === "already-gone") {
+        await removeSessionState(record.sessionStateDir);
+        results.push({ sessionId: record.sessionId, outcome: "already-gone" });
+        continue;
+      }
+      survivors.push(record);
+      results.push({
+        sessionId: record.sessionId,
+        outcome: janitorOutcomeForUnsettled(outcome.outcome)
+      });
+    }
+    if (survivors.length !== registry.records.length) {
+      await writeRegistry({ version: 1, records: survivors });
+    }
+    return results;
+  });
+}
+
+// server/utils/harness/local/supervisor.ts
+var DEFAULT_SUPERVISOR_LIMITS = {
+  maxWallClockMs: 30 * 6e4,
+  maxOutputBytesPerStream: 8 * 1024 * 1024,
+  maxConcurrentProcesses: 4,
+  terminationGraceMs: 5e3
+};
+var SupervisorError = class extends Error {
+};
+var EXIT_SNAPSHOT_GRACE_MS = 250;
+function bufferedStream(maxBytes) {
+  let controller;
+  let written = 0;
+  let closed = false;
+  let truncated = false;
+  const stream = new ReadableStream({
+    start: (c) => {
+      controller = c;
+    },
+    // The consumer may stop reading (an aborted turn). Swallow the cancel so
+    // the push path below does not throw into the child's data handler.
+    cancel: () => {
+      closed = true;
+    }
+  });
+  return {
+    stream,
+    push: (chunk) => {
+      if (closed) return;
+      if (written >= maxBytes) {
+        truncated = true;
+        return;
+      }
+      const room = maxBytes - written;
+      const slice = chunk.byteLength <= room ? chunk : chunk.subarray(0, room);
+      if (slice.byteLength < chunk.byteLength) truncated = true;
+      written += slice.byteLength;
+      try {
+        controller.enqueue(slice);
+      } catch {
+        closed = true;
+      }
+    },
+    close: () => {
+      if (closed) return;
+      closed = true;
+      try {
+        controller.close();
+      } catch {
+      }
+    },
+    truncated: () => truncated
+  };
+}
+var LocalHarnessSupervisor = class {
+  constructor(opts) {
+    this.live = /* @__PURE__ */ new Map();
+    /**
+     * How many times each session has been stopped.
+     *
+     * Bumped SYNCHRONOUSLY when a stop begins. A launch reads it at entry and
+     * again before it spawns: a different value means a stop landed while this
+     * launch was in flight, so it refuses rather than starting a process the
+     * stop could not see and did not report.
+     *
+     * A COUNTER, not a tombstone. An earlier draft marked the id stopped
+     * forever, which also refused every legitimate later launch — including the
+     * provider's own bridge retry, whose whole purpose is that a failed first
+     * spawn (which stops the session on its way out) can be tried again and be
+     * re-checked as a bridge. Only launches that straddle a stop are refused.
+     */
+    this.stopGenerations = /* @__PURE__ */ new Map();
+    /**
+     * Launches that have reserved a slot but not yet registered a process.
+     *
+     * The reserved bucket is empty until the child exists, so without this the
+     * ceiling is computed from a count that has not caught up yet.
+     */
+    this.pendingLaunches = /* @__PURE__ */ new Map();
+    /**
+     * This Inspector process's own birth identity, recorded on every process it
+     * owns.
+     *
+     * A nonce says which supervisor created a record; it does NOT say whether
+     * that supervisor is still running. Without this, a second Inspector opened
+     * alongside the first would see the first's records under a foreign nonce
+     * and reclaim them — killing live sessions belonging to a healthy process.
+     * The janitor uses pid + birth identity to require that the owner is
+     * genuinely gone before it touches anything.
+     */
+    this.supervisorBirthIdentity = null;
+    /**
+     * Process-group cache for `ownsPid`.
+     *
+     * A group id does not change for the life of a process, and the gateway asks
+     * this on the model hot path — so the probe runs once per pid rather than
+     * once per request. Bounded by pruning entries for pids the session no longer
+     * has, on stop.
+     */
+    this.pidGroups = /* @__PURE__ */ new Map();
+    this.nonce = mintSupervisorNonce();
+    this.limits = { ...DEFAULT_SUPERVISOR_LIMITS, ...opts?.limits ?? {} };
+    this.platform = opts?.platform ?? process.platform;
+    this.supervisorIdentityReady = readProcessBirthIdentity(
+      process.pid,
+      this.platform
+    ).then((identity) => {
+      this.supervisorBirthIdentity = identity;
+    });
+  }
+  /**
+   * Reclaim trees abandoned by a previous Inspector process. Safe to call at
+   * startup and idempotent; records belonging to THIS supervisor are skipped.
+   */
+  async reclaimOrphans() {
+    return reclaimAbandonedProcesses({
+      liveNonce: this.nonce,
+      graceMs: this.limits.terminationGraceMs,
+      platform: this.platform
+    });
+  }
+  /** Create a directory inside the session's own state, owner-only. */
+  async ensureDirectory(path) {
+    await mkdir5(path, { recursive: true, mode: 448 });
+    await chmod4(path, 448).catch(() => {
+    });
+  }
+  /**
+   * Start a supervised process.
+   *
+   * Every rejection here is a refusal to start, never a downgrade: a launch
+   * that cannot satisfy the invariants does not happen.
+   */
+  async spawnSupervised(request) {
+    if (!isAbsolute4(request.executable)) {
+      throw new SupervisorError(
+        `refusing to spawn ${JSON.stringify(request.executable)}: the supervisor launches absolute, pre-verified paths only. A bare name would be resolved through a mutable PATH at spawn time, which is not the runtime consent was granted for.`
+      );
+    }
+    if (!isAbsolute4(request.workingDirectory)) {
+      throw new SupervisorError(
+        "refusing to spawn with a relative working directory"
+      );
+    }
+    if (request.role === "root" && !supportsOwnershipProof(this.platform)) {
+      throw new SupervisorError(
+        `local harness execution is not available on ${this.platform}: this Inspector cannot prove ownership of a process tree here, so it could not guarantee that stopping a session stops everything it started.`
+      );
+    }
+    assertArgvAllowed(request.args);
+    const jobLauncher = this.platform === "win32" ? request.jobLauncherPath : void 0;
+    if (this.platform === "win32" && jobLauncher === void 0) {
+      if (request.role === "root") {
+        throw new SupervisorError(
+          "refusing to start a root process on win32 without the verified Job Object launcher: without it, stopping the session could not be guaranteed to stop everything it started"
+        );
+      }
+    }
+    if (jobLauncher !== void 0 && !isAbsolute4(jobLauncher)) {
+      throw new SupervisorError(
+        "the Job Object launcher must be an absolute path inside the verified runtime pack"
+      );
+    }
+    const stopGenerationAtEntry = this.stopGenerations.get(request.sessionId) ?? 0;
+    const bucket = this.live.get(request.sessionId) ?? /* @__PURE__ */ new Set();
+    const pending = this.pendingLaunches.get(request.sessionId) ?? 0;
+    const active = [...bucket].filter((entry2) => !entry2.exited).length;
+    const admitted = active + pending;
+    if (admitted >= this.limits.maxConcurrentProcesses) {
+      throw new SupervisorError(
+        `session ${request.sessionId} already has ${admitted} supervised processes (ceiling ${this.limits.maxConcurrentProcesses})`
+      );
+    }
+    this.live.set(request.sessionId, bucket);
+    this.pendingLaunches.set(request.sessionId, pending + 1);
+    let pendingReleased = false;
+    const releasePending = () => {
+      if (pendingReleased) return;
+      pendingReleased = true;
+      const now = (this.pendingLaunches.get(request.sessionId) ?? 1) - 1;
+      if (now <= 0) this.pendingLaunches.delete(request.sessionId);
+      else this.pendingLaunches.set(request.sessionId, now);
+    };
+    const releaseReservation = () => {
+      releasePending();
+      if (bucket.size === 0 && this.live.get(request.sessionId) === bucket) {
+        this.live.delete(request.sessionId);
+      }
+    };
+    let ownerBirthIdentity;
+    if (request.role === "root") {
+      await this.supervisorIdentityReady;
+      if (this.supervisorBirthIdentity === null) {
+        releaseReservation();
+        throw new SupervisorError(
+          "this Inspector could not read its own process identity, so a supervised root would be recorded without a reclaimable owner; refusing to start it"
+        );
+      }
+      ownerBirthIdentity = this.supervisorBirthIdentity;
+    }
+    if ((this.stopGenerations.get(request.sessionId) ?? 0) !== stopGenerationAtEntry) {
+      releaseReservation();
+      throw new SupervisorError(
+        `session ${request.sessionId} was stopped while this launch was starting; refusing to spawn a process the stop cannot account for`
+      );
+    }
+    const [spawnExecutable, spawnArgs] = jobLauncher !== void 0 ? [jobLauncher, [request.executable, ...request.args]] : [request.executable, [...request.args]];
+    const child = spawn(spawnExecutable, spawnArgs, {
+      cwd: request.workingDirectory,
+      env: request.env,
+      stdio: [jobLauncher !== void 0 ? "pipe" : "ignore", "pipe", "pipe"],
+      // POSIX: become a process-group leader so the whole tree can be signalled.
+      detached: this.platform !== "win32",
+      // Belt and braces — the default is already false, but this is the single
+      // most important property in the file and it should be visible here.
+      shell: false,
+      windowsHide: true
+    });
+    const out = bufferedStream(this.limits.maxOutputBytesPerStream);
+    const err = bufferedStream(this.limits.maxOutputBytesPerStream);
+    let stdoutHead = "";
+    child.stdout?.on("data", (chunk) => {
+      if (stdoutHead.length < 1024) {
+        stdoutHead += chunk.toString(
+          "utf8",
+          0,
+          Math.min(chunk.length, 1024 - stdoutHead.length)
+        );
+      }
+      out.push(new Uint8Array(chunk));
+    });
+    let stderrHead = "";
+    child.stderr?.on("data", (chunk) => {
+      if (stderrHead.length < 2048) {
+        stderrHead += chunk.toString(
+          "utf8",
+          0,
+          Math.min(chunk.length, 2048 - stderrHead.length)
+        );
+      }
+      err.push(new Uint8Array(chunk));
+    });
+    let exitResult = null;
+    let notifyExit = null;
+    let entry;
+    const recordExit = (exitCode) => {
+      if (exitResult !== null) return;
+      exitResult = { exitCode };
+      if (entry !== void 0) entry.exited = true;
+      notifyExit?.(exitResult);
+    };
+    child.on("error", (error) => {
+      logger.warn("[local-harness] supervised process error", {
+        sessionId: request.sessionId,
+        error: error.message
+      });
+      recordExit(-1);
+    });
+    child.on("exit", () => {
+      if (request.role === "root" && entry !== void 0 && entry.orphanSnapshot === null) {
+        entry.orphanSnapshot = listGroupMembers(entry.pid, this.platform).catch(
+          () => null
+        );
+      }
+    });
+    child.on("close", (code, signal) => {
+      recordExit(code ?? (signal ? 124 : 1));
+    });
+    const pid = child.pid;
+    if (pid === void 0) {
+      releaseReservation();
+      throw new SupervisorError(
+        `the ${request.role} process failed to start (no pid was assigned)`
+      );
+    }
+    entry = {
+      child,
+      pid,
+      birthIdentity: null,
+      role: request.role,
+      killed: false,
+      exited: exitResult !== null,
+      orphanSnapshot: null
+    };
+    bucket.add(entry);
+    releasePending();
+    const abandon = async () => {
+      if (entry.birthIdentity !== null) {
+        await terminateOwnedProcessGroup({
+          pid,
+          birthIdentity: entry.birthIdentity,
+          graceMs: this.limits.terminationGraceMs,
+          platform: this.platform
+        }).catch(() => void 0);
+      } else {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }
+      bucket.delete(entry);
+      if (bucket.size === 0 && this.live.get(request.sessionId) === bucket) {
+        this.live.delete(request.sessionId);
+      }
+    };
+    const probe = await probeProcess(pid, this.platform);
+    const birthIdentity = probe.state === "alive" ? probe.identity : null;
+    entry.birthIdentity = birthIdentity;
+    if (request.role === "root" && birthIdentity === null) {
+      await abandon();
+      const recordedExit = () => exitResult;
+      const exit = recordedExit();
+      const why = probe.state === "gone" ? "the process had already exited" : probe.state === "unknown" ? `the probe could not look (${probe.reason})` : "the process could not be identified";
+      const exited2 = exit !== null ? `exit code ${exit.exitCode}` : "no exit recorded yet";
+      const said = stderrHead.trim().length > 0 ? `; stderr: ${JSON.stringify(stderrHead.trim().slice(0, 1024))}` : "";
+      throw new SupervisorError(
+        `could not read the process birth identity for the harness root \u2014 ${why} (${exited2})${said}; refusing to run a tree this Inspector cannot prove it owns`
+      );
+    }
+    if (request.role === "root") {
+      const record = {
+        sessionId: request.sessionId,
+        supervisorNonce: this.nonce,
+        supervisorPid: process.pid,
+        supervisorBirthIdentity: ownerBirthIdentity,
+        runtimeId: request.runtimeId,
+        rootPid: pid,
+        processBirthIdentity: birthIdentity,
+        processGroupIdentity: this.platform === "win32" ? void 0 : String(pid),
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        workspaceGrantId: request.workspaceGrantId,
+        targetKind: request.targetKind,
+        lifecycleState: "starting",
+        sessionStateDir: request.sessionStateDir
+      };
+      try {
+        await recordProcess(record);
+        await updateLifecycleState(request.sessionId, "running");
+      } catch (error) {
+        await abandon();
+        throw new SupervisorError(
+          `could not record the supervised process for session ${request.sessionId}, so it was terminated rather than left running unrecoverably: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+    const killTree = async () => {
+      if (entry.killed) return;
+      entry.killed = true;
+      if (entry.birthIdentity === null) {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+        return;
+      }
+      const outcome = await terminateOwnedProcessGroup({
+        pid,
+        birthIdentity: entry.birthIdentity,
+        graceMs: this.limits.terminationGraceMs,
+        platform: this.platform
+      });
+      if (outcome.outcome === "escaped") {
+        logger.error("[local-harness] process tree survived SIGKILL", {
+          sessionId: request.sessionId,
+          pid
+        });
+      }
+      if (outcome.outcome === "unknown") {
+        logger.warn("[local-harness] tree not proven stopped; will retry", {
+          sessionId: request.sessionId,
+          pid,
+          reason: outcome.reason
+        });
+      }
+      if (outcome.outcome === "escaped" || outcome.outcome === "unknown") {
+        entry.killed = false;
+      }
+    };
+    const onAbort = () => {
+      void killTree();
+    };
+    request.abortSignal?.addEventListener("abort", onAbort, { once: true });
+    const wallClockTimer = setTimeout(() => {
+      logger.warn("[local-harness] wall-clock ceiling reached", {
+        sessionId: request.sessionId,
+        pid
+      });
+      void killTree();
+    }, this.limits.maxWallClockMs);
+    wallClockTimer.unref?.();
+    const exited = new Promise((resolvePromise) => {
+      if (exitResult !== null) {
+        resolvePromise(exitResult);
+        return;
+      }
+      notifyExit = resolvePromise;
+    });
+    void exited.then(() => {
+      clearTimeout(wallClockTimer);
+      request.abortSignal?.removeEventListener("abort", onAbort);
+      if (out.truncated() || err.truncated()) {
+        logger.warn("[local-harness] output ceiling reached; output dropped", {
+          sessionId: request.sessionId,
+          pid,
+          stdout: out.truncated(),
+          stderr: err.truncated()
+        });
+      }
+      out.close();
+      err.close();
+    });
+    return {
+      pid,
+      stdout: out.stream,
+      stderr: err.stream,
+      wait: async () => {
+        const result = await exited;
+        return result;
+      },
+      kill: async () => {
+        await killTree();
+        await exited;
+      },
+      stderrHead: () => stderrHead,
+      stdoutHead: () => stdoutHead,
+      exited: () => exitResult
+    };
+  }
+  /**
+   * Stop everything this supervisor started for a session, and only report
+   * success once the trees are gone.
+   *
+   * Idempotent. Called on stop, abort, timeout, lease expiry, and destroy —
+   * the lifecycle contract's terminal paths all converge here so none of them
+   * can forget a helper.
+   */
+  /**
+   * Give an already-dead root's `exit` handler the moment it needs to run.
+   *
+   * Node delivers `exit` asynchronously. A stop that arrives between the
+   * kernel reaping the root and that delivery sees `orphanSnapshot === null`
+   * and no live root, so the group is unanchored and correctly refuses to be
+   * signalled — leaving descendants running and the session reported
+   * `unknown`. Safe, but the tree survives, which is what the snapshot exists
+   * to prevent.
+   *
+   * Bounded and best-effort: if the root is genuinely still alive, there is
+   * nothing to wait for and this returns at once; if the event never arrives,
+   * the stop proceeds exactly as it did before.
+   */
+  async awaitPendingExitSnapshots(bucket) {
+    const pending = [...bucket].filter(
+      (entry) => entry.role === "root" && entry.orphanSnapshot === null && entry.child.exitCode === null && entry.child.signalCode === null
+    );
+    if (pending.length === 0) return;
+    const deadline = Date.now() + EXIT_SNAPSHOT_GRACE_MS;
+    while (Date.now() < deadline) {
+      const states = await Promise.all(
+        pending.map(
+          async (entry) => entry.orphanSnapshot !== null ? "settled" : (await probeProcess(entry.pid, this.platform)).state
+        )
+      );
+      if (!states.includes("gone")) return;
+      await new Promise((resolve4) => setTimeout(resolve4, 10));
+    }
+  }
+  async stopSession(sessionId) {
+    this.stopGenerations.set(
+      sessionId,
+      (this.stopGenerations.get(sessionId) ?? 0) + 1
+    );
+    const bucket = this.live.get(sessionId);
+    await updateLifecycleState(sessionId, "stopping");
+    let escaped = 0;
+    if (bucket) {
+      await this.awaitPendingExitSnapshots(bucket);
+      const outcomes = await Promise.all(
+        [...bucket].map(async (entry) => {
+          if (entry.birthIdentity === null) {
+            entry.child.kill("SIGKILL");
+            return {
+              entry,
+              result: {
+                outcome: "unknown",
+                reason: "the process was never identified, so only its own handle could be signalled"
+              }
+            };
+          }
+          return {
+            entry,
+            result: await terminateOwnedProcessGroup({
+              pid: entry.pid,
+              birthIdentity: entry.birthIdentity,
+              graceMs: this.limits.terminationGraceMs,
+              platform: this.platform
+            })
+          };
+        })
+      );
+      for (const { entry, result: initialResult } of outcomes) {
+        let result = initialResult;
+        if (result.outcome === "unknown" && entry.orphanSnapshot !== null) {
+          const members = await entry.orphanSnapshot ?? [];
+          const settled = [];
+          for (const member of members) {
+            settled.push({
+              pid: member.pid,
+              outcome: await terminateOwnedProcess({
+                pid: member.pid,
+                identity: member.identity,
+                graceMs: this.limits.terminationGraceMs,
+                platform: this.platform
+              })
+            });
+          }
+          const after = await probeProcessGroup(entry.pid, this.platform);
+          logger.debug("[local-harness] settled an unanchored process group", {
+            sessionId,
+            members: settled.length,
+            outcomes: settled.map((s) => s.outcome),
+            groupAfter: after
+          });
+          if (after === "empty") result = { outcome: "forced" };
+        }
+        if (result.outcome === "already-gone" || result.outcome === "graceful" || result.outcome === "forced") {
+          bucket.delete(entry);
+        } else {
+          escaped += 1;
+        }
+      }
+      if (bucket.size === 0 && this.live.get(sessionId) === bucket) {
+        this.live.delete(sessionId);
+      }
+    }
+    if (escaped === 0) {
+      await forgetProcess(sessionId);
+      return { stopped: true, escaped };
+    }
+    await updateLifecycleState(sessionId, "failed");
+    return { stopped: false, escaped };
+  }
+  /** Live supervised process count for a session (tests and diagnostics). */
+  liveProcessCount(sessionId) {
+    const bucket = this.live.get(sessionId);
+    if (!bucket) return 0;
+    return [...bucket].filter((entry) => !entry.exited).length;
+  }
+  /**
+   * Is `pid` a process this session started, or a descendant of one?
+   *
+   * The loopback model gateway asks this before serving a connection, so a
+   * process that learned the session capability — it reaches the child in its
+   * environment and is written to the bridge's start config — still cannot use
+   * it unless it is part of this tree.
+   *
+   * Descendants count, and are matched by process GROUP rather than by walking
+   * a parent chain: the vendor CLI is spawned by the bridge, not by us, so it
+   * is never in `live`, but the supervisor puts every root in its own group and
+   * the CLI inherits it. A platform that cannot report a group id answers
+   * `false` for the descendant half and the direct check still holds.
+   */
+  async ownsPid(sessionId, pid) {
+    const bucket = this.live.get(sessionId);
+    if (!bucket) return false;
+    const roots = [];
+    for (const entry of bucket) {
+      if (entry.exited) continue;
+      if (entry.pid === pid) return true;
+      if (entry.role === "root") roots.push(entry.pid);
+    }
+    if (roots.length === 0) return false;
+    const cached2 = this.pidGroups.get(pid);
+    if (cached2 !== void 0) return roots.includes(cached2);
+    const pgid = await readProcessGroupId(pid, this.platform);
+    if (pgid === null) return false;
+    this.pidGroups.set(pid, pgid);
+    return roots.includes(pgid);
+  }
+};
+
+// server/utils/harness/local/session-registry.ts
+var sessions = /* @__PURE__ */ new Map();
+var unstopped = /* @__PURE__ */ new Set();
+function registerLocalHarnessSession(record) {
+  sessions.set(record.sessionId, record);
+}
+function getLocalHarnessSession(sessionId) {
+  return sessions.get(sessionId);
+}
+function forgetLocalHarnessSession(sessionId) {
+  sessions.delete(sessionId);
+}
+function forgetLocalHarnessSessionRecord(record) {
+  unstopped.delete(record);
+  if (sessions.get(record.sessionId) !== record) return false;
+  sessions.delete(record.sessionId);
+  return true;
+}
+function claimRecord(record) {
+  const claimed = sessions.get(record.sessionId) === record || unstopped.has(record);
+  if (!claimed) return false;
+  if (sessions.get(record.sessionId) === record) {
+    sessions.delete(record.sessionId);
+  }
+  unstopped.delete(record);
+  return true;
+}
+async function endRecord(record) {
+  const sessionId = record.sessionId;
+  const errors = [];
+  try {
+    record.gateway?.revoke();
+  } catch (error) {
+    errors.push(`gateway revoke: ${messageOf(error)}`);
+  }
+  try {
+    await record.gateway?.close();
+  } catch (error) {
+    errors.push(`gateway close: ${messageOf(error)}`);
+  }
+  try {
+    await record.revokeLease?.();
+  } catch (error) {
+    errors.push(`lease revoke: ${messageOf(error)}`);
+  }
+  let stopped = true;
+  try {
+    const outcome = await record.stop();
+    if (outcome?.stopped !== true) {
+      stopped = false;
+      errors.push(
+        `stop: ${outcome?.escaped ?? "some"} process(es) escaped the session`
+      );
+    }
+  } catch (error) {
+    stopped = false;
+    errors.push(`stop: ${messageOf(error)}`);
+  }
+  if (stopped) {
+    unstopped.delete(record);
+    try {
+      await record.releaseRuntime?.();
+    } catch (error) {
+      errors.push(`runtime release: ${messageOf(error)}`);
+    }
+  } else {
+    unstopped.add(record);
+    if (!sessions.has(sessionId)) sessions.set(sessionId, record);
+  }
+  if (errors.length > 0) {
+    logger.warn("[local-harness] session teardown had failures", {
+      sessionId,
+      errors
+    });
+  }
+  return { stopped, errors };
+}
+async function stopAllLocalHarnessSessions() {
+  const candidates = [.../* @__PURE__ */ new Set([...sessions.values(), ...unstopped])];
+  const mine = candidates.filter(claimRecord);
+  const results = await Promise.all(
+    mine.map(
+      (record) => endRecord(record).catch(() => ({
+        stopped: false,
+        errors: ["unexpected"]
+      }))
+    )
+  );
+  const failed = results.filter((result) => !result.stopped).length;
+  return { ok: failed === 0, stopped: results.length - failed, failed };
+}
+function messageOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function stopLocalHarnessWorkspace(workspaceGrantId) {
+  const records = new Set([...sessions.values(), ...unstopped].filter((record) => record.workspaceGrantId === workspaceGrantId));
+  let stopped = true;
+  for (const record of records) {
+    if (claimRecord(record)) stopped = (await endRecord(record)).stopped && stopped;
+    else stopped = false;
+  }
+  return stopped;
+}
+async function stopLocalHarnessProject(userId, projectId) {
+  const records = new Set([...sessions.values(), ...unstopped].filter((record) => record.userId === userId && (projectId === void 0 || record.projectId === projectId)));
+  await Promise.all([...records].filter(claimRecord).map(endRecord));
+}
+
+// server/utils/harness/local/local-turn.ts
+import { join as join5 } from "path";
+import { mkdir as mkdir6, stat as stat4 } from "fs/promises";
+import { createRequire } from "module";
+var sharedSupervisor = null;
+function localHarnessSupervisor() {
+  sharedSupervisor ??= new LocalHarnessSupervisor();
+  return sharedSupervisor;
+}
+async function prepareLocalHarnessTurn(args) {
+  validateLocalHarnessSecretEnv(args.scopedEnv ?? {});
+  const verifyStartedAt = Date.now();
+  const runtimeStatus = await readRuntimeInstallStatus({
+    harnessId: "claude-code"
+  });
+  if (runtimeStatus.state !== "ready") {
+    return {
+      ok: false,
+      status: "runtime-unavailable",
+      message: runtimeStatus.state === "absent" ? "The local Claude Code runtime is not installed on this machine yet." : `The local Claude Code runtime is not usable (${runtimeStatus.state}).`
+    };
+  }
+  const target = localPackTarget();
+  const lifecycleKey = target === null ? null : {
+    runtimeRoot: runtimeInstallRoot(),
+    harnessId: "claude-code",
+    target,
+    packVersion: runtimeStatus.packVersion,
+    treeDigest: runtimeStatus.digest
+  };
+  let runtimeUse = null;
+  if (lifecycleKey !== null) {
+    try {
+      runtimeUse = await reserveRuntimeUse({
+        key: lifecycleKey,
+        runtimeRoot: runtimeStatus.runtimeRoot,
+        label: args.sessionId
+      });
+    } catch (error) {
+      return {
+        ok: false,
+        status: "runtime-unavailable",
+        message: `This Inspector could not reserve the local runtime, so it will not start a session that another process could replace underneath: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+  }
+  const releaseRuntimeUse = async () => {
+    const held = runtimeUse;
+    runtimeUse = null;
+    await held?.release();
+  };
+  try {
+    const prepared = await prepareWithReservedRuntime({
+      args,
+      runtimeStatus,
+      verifyStartedAt,
+      releaseRuntimeUse
+    });
+    if (!prepared.ok) await releaseRuntimeUse();
+    return prepared;
+  } catch (error) {
+    await releaseRuntimeUse();
+    throw error;
+  }
+}
+async function prepareWithReservedRuntime(outer) {
+  const args = outer.args;
+  const runtimeStatus = outer.runtimeStatus;
+  const verifyStartedAt = outer.verifyStartedAt;
+  const sessionStateDir = sessionStateDirFor(
+    localHarnessStateRoot(),
+    args.sessionId
+  );
+  if (getLocalHarnessSession(args.sessionId)) {
+    return {
+      ok: false,
+      status: "session-still-running",
+      message: "The previous local turn is still stopping. Try again once it has stopped."
+    };
+  }
+  const availability = await resolveLocalHarnessAvailability({
+    target: {
+      kind: "local-native",
+      harnessId: args.harnessId,
+      machineId: args.target.machineId,
+      workspaceGrantId: args.target.workspaceGrantId,
+      runtimeId: args.target.runtimeId,
+      permissionProfile: args.target.permissionProfile,
+      policyVersion: args.target.policyVersion
+    },
+    actor: args.actor,
+    scope: args.scope,
+    // Server-derived, never from a request body: consent binds to a user, and
+    // a user the caller names is a user the caller chose.
+    userId: args.target.actingUserId,
+    projectId: args.projectId,
+    grantToken: args.target.grantToken,
+    runtimeRoot: runtimeStatus.runtimeRoot,
+    installedAdapterVersion: args.installedAdapterVersion ?? await readInstalledAdapterVersion()
+  });
+  if (!availability.available) {
+    return {
+      ok: false,
+      status: availability.status,
+      message: availability.message
+    };
+  }
+  const plan = availability.plan;
+  const localRuntimeVerifyMs = Date.now() - verifyStartedAt;
+  const permissionMode = args.requireToolApproval ? "allow-reads" : plan.permissionMode;
+  const identity = await readLocalInstanceIdentity();
+  const keyId = identity.keyId ?? getRegisteredKeyId();
+  if (keyId === null) {
+    return {
+      ok: false,
+      status: "consent-required",
+      message: "This installation is not registered for local execution yet. Re-authorize local execution on this machine."
+    };
+  }
+  const broker = await startLoopbackModelBroker({
+    projectId: args.projectId,
+    evalIterationId: args.evalIterationId,
+    journeyRunId: args.journeyRunId,
+    targetId: args.targetId,
+    sessionIdx: args.sessionIdx,
+    hostId: args.hostId,
+    harnessId: args.harnessId,
+    modelId: args.modelId,
+    machineId: identity.machineId,
+    keyId,
+    runId: args.runId,
+    ...args.maxOutputTokens !== void 0 ? { maxOutputTokens: args.maxOutputTokens } : {},
+    bearer: args.bearer,
+    ...args.signal ? { signal: args.signal } : {}
+  });
+  if (!broker.ok) {
+    return {
+      ok: false,
+      status: "broker-unavailable",
+      message: broker.error
+    };
+  }
+  const supervisor = localHarnessSupervisor();
+  let gateway = null;
+  try {
+    const sessionStateExists = await stat4(sessionStateDir).then((entry) => entry.isDirectory()).catch((error) => {
+      if (error.code === "ENOENT") return false;
+      throw error;
+    });
+    await mkdir6(sessionStateDir, { recursive: true, mode: 448 });
+    const hooksPath = join5(sessionStateDir, "empty-git-hooks");
+    if (args.scope === "unattended") await mkdir6(hooksPath, { recursive: true, mode: 448 });
+    const gatewayStartedAt = Date.now();
+    try {
+      gateway = await startLocalModelGateway({
+        lease: broker.lease,
+        upstreamBaseUrl: broker.proxyBaseUrl,
+        // The gateway serves only processes in this session's supervised tree.
+        // Asked of the supervisor rather than captured as a pid set, because the
+        // tree grows: the bridge spawns the vendor CLI after the gateway is
+        // already listening.
+        isSupervisedPid: (pid) => supervisor.ownsPid(args.sessionId, pid)
+      });
+    } catch (error) {
+      await revokeLease(broker.runId, args.bearer);
+      return {
+        ok: false,
+        status: "gateway-unavailable",
+        message: `The local model gateway could not start: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+    const started = gateway;
+    const localGatewayReadyMs = Date.now() - gatewayStartedAt;
+    const bridgePort = await reserveLoopbackPort();
+    const launcher = resolveNodeLauncher({
+      // Inside the tree the digest just covered. The npx server's own execPath
+      // is not, and Electron cannot be a launcher at all.
+      bundledNodePath: plan.runtime.nodePath ?? ""
+    });
+    const sandbox = createSupervisedLocalHarnessProvider({
+      harnessId: "claude-code",
+      manifest: plan.manifest,
+      runtime: plan.runtime,
+      supervisor,
+      launcher,
+      workspacePath: plan.workspacePath,
+      workspaceGrantId: plan.target.workspaceGrantId,
+      sessionStateDir,
+      ...args.onSecretEnvDelivered && Object.keys(args.scopedEnv ?? {}).length ? {
+        onBridgeStarted: async () => {
+          args.onSecretEnvDelivered?.();
+        }
+      } : {},
+      targetKind: "local-native",
+      bridgePort,
+      scopedEnv: {
+        ...args.scopedEnv ?? {},
+        ...args.scope === "unattended" ? { GIT_CONFIG_NOSYSTEM: "1", GIT_TERMINAL_PROMPT: "0", GCM_INTERACTIVE: "never", GIT_CONFIG_COUNT: "2", GIT_CONFIG_KEY_0: "core.hooksPath", GIT_CONFIG_VALUE_0: hooksPath, GIT_CONFIG_KEY_1: "credential.helper", GIT_CONFIG_VALUE_1: "" } : {}
+      }
+    });
+    const sessionRecord = {
+      userId: args.target.actingUserId,
+      projectId: args.projectId,
+      sessionId: args.sessionId,
+      runtimeId: plan.runtime.runtimeId,
+      workspaceGrantId: plan.target.workspaceGrantId,
+      brokerRunId: broker.runId,
+      gateway: started,
+      stop: async () => await supervisor.stopSession(args.sessionId),
+      revokeLease: () => revokeLease(broker.runId, args.bearer),
+      releaseRuntime: outer.releaseRuntimeUse,
+      startedAt: Date.now()
+    };
+    let treeStopped = false;
+    const teardownOnce = onceAsync(async () => {
+      try {
+        started.revoke();
+        await started.close();
+      } finally {
+        await revokeLease(broker.runId, args.bearer);
+        const stop = await supervisor.stopSession(args.sessionId);
+        if (stop.stopped) {
+          treeStopped = true;
+          forgetLocalHarnessSessionRecord(sessionRecord);
+          await outer.releaseRuntimeUse();
+        }
+      }
+    });
+    registerLocalHarnessSession(sessionRecord);
+    logger.info("[local-harness] turn prepared", {
+      sessionId: args.sessionId,
+      runtimeId: plan.runtime.runtimeId,
+      permissionMode,
+      localRuntimeVerifyMs,
+      localGatewayReadyMs
+    });
+    return {
+      ok: true,
+      prepared: {
+        plan,
+        sandbox,
+        // The child's credential: the gateway, and a capability that means
+        // nothing anywhere else. The lease is not in here and never will be.
+        auth: {
+          ANTHROPIC_AUTH_TOKEN: started.sessionCapability,
+          ANTHROPIC_API_KEY: started.sessionCapability,
+          ANTHROPIC_BASE_URL: started.baseUrl
+        },
+        sandboxWorkDir: "project",
+        skillsBaseDir: toAdapterPath(
+          join5(sessionStateDir, "home", ".claude", "skills")
+        ),
+        sessionStateExists,
+        permissionMode,
+        brokerRunId: broker.runId,
+        timings: { localRuntimeVerifyMs, localGatewayReadyMs },
+        teardown: teardownOnce,
+        discardState: onceAsync(async () => {
+          await teardownOnce();
+          if (treeStopped) await removeSessionStateDir(sessionStateDir);
+        })
+      }
+    };
+  } catch (error) {
+    await abandonLocalSetup({
+      gateway,
+      sessionId: args.sessionId,
+      runId: broker.runId,
+      bearer: args.bearer
+    });
+    throw error;
+  }
+}
+async function abandonLocalSetup(args) {
+  try {
+    args.gateway?.revoke();
+    await args.gateway?.close();
+  } catch (error) {
+    logger.warn("[local-harness] gateway close during abandoned setup failed", {
+      message: error instanceof Error ? error.message : String(error)
+    });
+  }
+  forgetLocalHarnessSession(args.sessionId);
+  await revokeLease(args.runId, args.bearer);
+}
+async function revokeLease(runId, bearer) {
+  try {
+    await revokeHarnessModelBroker({ runId, bearer });
+  } catch (error) {
+    logger.warn("[local-harness] lease revoke failed", {
+      message: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
+var cachedAdapterVersion = null;
+async function readInstalledAdapterVersion() {
+  if (cachedAdapterVersion !== null) return cachedAdapterVersion;
+  if (typeof __MCPJAM_CLAUDE_ADAPTER_VERSION__ === "string") return __MCPJAM_CLAUDE_ADAPTER_VERSION__;
+  try {
+    const required = createRequire(import.meta.url);
+    const pkg = required("@ai-sdk/harness-claude-code/package.json");
+    cachedAdapterVersion = typeof pkg.version === "string" ? pkg.version : "";
+  } catch {
+    cachedAdapterVersion = "";
+  }
+  return cachedAdapterVersion;
+}
+function onceAsync(fn) {
+  let started = null;
+  return () => {
+    started ??= fn();
+    return started;
+  };
+}
+
+export {
+  LOCAL_HARNESS_GRANT_HEADER,
+  localHarnessStateRoot,
+  getLocalMachineId,
+  validateWorkspaceCandidate,
+  registerWorkspaceGrant,
+  resolveWorkspaceGrant,
+  grantLocalHarnessConsent,
+  revokeLocalHarnessGrants,
+  pruneExpiredHarnessGrants,
+  forgetWorkspaceGrant,
+  listProcessRecords,
+  harnessPinnedVersion,
+  harnessModelSupport,
+  startHarnessModelBroker,
+  registerLocalInstance,
+  revokeHarnessModelBroker,
+  reserveHarnessBox,
+  renewHarnessBoxReservation,
+  releaseHarnessBoxReservation,
+  localHarnessManifestsForDevelopment,
+  readLocalInstanceIdentity,
+  setRegisteredKeyId,
+  instanceKeyFingerprint,
+  resolveGitBashPath,
+  sessionStateDirFor,
+  stopAllLocalHarnessSessions,
+  stopLocalHarnessWorkspace,
+  stopLocalHarnessProject,
+  localHarnessSupervisor,
+  prepareLocalHarnessTurn
+};
+//# sourceMappingURL=chunk-3EDQFXTF.js.map