@mettlelabs/mettle 0.0.0-beta.1-linux-arm64 → 0.0.0-beta.2-darwin-arm64

package/harness/{chunk-xqyc4ca2.mjs → chunk-9dg1btk1.mjs}

@@ -1,154 +1,132 @@
 import {
+  IdSchema,
+  SourceLocationSchema,
   HarnessError,
   canonicalJson,
   sha256,
-  digest,
-  ROUTE_CAPABILITIES
-} from "./chunk-2gt4cy7x.mjs";
+  digest
+} from "./chunk-rd80vvc5.mjs";
+import {
+  CHILD_TIMEOUT_MAX_MS,
+  CommitSchema,
+  RepositoryPathSchema,
+  SemgrepProfileSchema,
+  GVISOR_RUNTIME,
+  SandboxRuntimeSchema,
+  SandboxConfigSchema,
+  sandboxRuntime,
+  sandboxAllowsExecution,
+  TaskNameSchema,
+  PROBE_TOOL,
+  SHELL_TOOL,
+  HTTP_HEADER_LIMIT,
+  HTTP_RESPONSE_LIMIT,
+  WEBSITE_RESPONSE_LIMIT,
+  withinHttpScope,
+  PublicAddressSchema,
+  PLAYWRIGHT_VERSION
+} from "./chunk-c7dx5mdd.mjs";
 import {
   exports_iso
 } from "./chunk-b71gpkxg.mjs";
 import {
+  toJSONSchema,
   string,
+  uuid,
   url,
   number,
   boolean,
+  _null,
   unknown,
   array,
   object,
   strictObject,
   looseObject,
+  union,
   discriminatedUnion,
   record,
   _enum,
   literal
 } from "./chunk-1sygmp11.mjs";
 
-// apps/harness/src/storage/observations.ts
-var CHILD_TIMEOUT_MAX_MS = 20000;
-var COMMIT_HEX = "[a-f0-9]{40}(?:[a-f0-9]{24})?";
-var CommitSchema = string().regex(new RegExp(`^${COMMIT_HEX}$`));
-var IdSchema = string().regex(/^[a-zA-Z0-9_-]{1,128}$/);
-var RepositoryPathSchema = string().min(1).max(512).refine((path) => !path.startsWith("/") && Array.from(path).every((character) => character.codePointAt(0) >= 32 && character.codePointAt(0) !== 127 && character !== "\\" && character !== ":") && path.split("/").every((part) => part !== "" && part !== "." && part !== ".."));
-var RepositoryConfigSchema = strictObject({
-  repository: string().min(1).max(256),
-  gitDirectory: string().refine((path) => path.startsWith("/")).optional(),
-  snapshotFile: string().startsWith("/").optional(),
-  snapshotSha256: string().regex(/^[a-f0-9]{64}$/).optional(),
-  commit: CommitSchema,
-  paths: array(RepositoryPathSchema).min(1).max(1e4)
+// apps/harness/src/storage/joern.ts
+var JOERN_TIMEOUT_MS = 180000;
+var JOERN_TASK_TIMEOUT_MS = 210000;
+var JOERN_QUERY_ID = "mettle.source-trace-dataflow-v1";
+var JoernProfileSchema = strictObject({
+  version: literal("4.0.647")
+});
+var JoernTraceSchema = strictObject({
+  source: SourceLocationSchema,
+  sink: SourceLocationSchema,
+  locations: array(SourceLocationSchema).min(2).max(16)
 });
-function hasRepositorySource(config) {
-  return config.gitDirectory !== undefined !== (config.snapshotFile !== undefined) && config.snapshotFile !== undefined === (config.snapshotSha256 !== undefined);
+function joernCandidate(finding, binding) {
+  if (finding.surface !== "code" || finding.claim !== "vulnerability" || finding.status !== "candidate" || finding.verification.result !== "pending" || finding.subject.kind !== "source" || finding.subject.repository !== binding.repository || finding.subject.revision !== binding.revision || !finding.sourceTrace || !finding.evidence.toolCalls.some((call) => ["semgrep_scan", "secret_scan", "dependency_scan"].includes(call.tool)))
+    return;
+  const steps = finding.sourceTrace.pathToImpact;
+  const inputs = steps.filter((step) => step.kind === "input");
+  const sinks = steps.filter((step) => step.kind === "sink");
+  const locations = steps.map((step) => step.location);
+  if (inputs.length !== 1 || sinks.length !== 1 || locations.some((location) => location.revision !== binding.revision || !binding.paths.includes(location.path) || !/\.(?:[cm]?js|jsx|[cm]?ts|tsx)$/.test(location.path)))
+    return;
+  return JoernTraceSchema.parse({
+    source: inputs[0].location,
+    sink: sinks[0].location,
+    locations
+  });
 }
-var RepositoryTestProfileSchema = strictObject({
-  id: IdSchema,
-  entrypoint: RepositoryPathSchema,
-  timeoutMs: number().int().min(100).max(CHILD_TIMEOUT_MAX_MS)
+
+// apps/harness/src/storage/scanners.ts
+var EcosystemSchema = _enum([
+  "npm",
+  "PyPI",
+  "Go",
+  "crates.io",
+  "Maven",
+  "Packagist",
+  "RubyGems"
+]);
+var MAX_DATABASE_BYTES = 268435456;
+var SEMGREP_VERSION_TIMEOUT_MS = 60000;
+var SEMGREP_SCAN_TIMEOUT_MS = 120000;
+var SEMGREP_TASK_TIMEOUT_MS = SEMGREP_VERSION_TIMEOUT_MS + SEMGREP_SCAN_TIMEOUT_MS + 30000;
+var SecretScanProfileSchema = strictObject({
+  version: literal("8.30.1")
 });
-var BashProfilesSchema = array(strictObject({
-  id: IdSchema,
-  description: string().min(1).max(256),
-  script: string().min(1).max(8192).refine((script) => !script.includes("\x00")),
-  timeoutMs: number().int().min(100).max(CHILD_TIMEOUT_MAX_MS)
-})).min(1).max(8).refine((profiles) => new Set(profiles.map((profile) => profile.id)).size === profiles.length);
-var SemgrepProfileSchema = strictObject({
-  version: string().regex(/^\d+\.\d+\.\d+$/),
-  rules: string().min(1).max(16384)
+var DependencyScanProfileSchema = strictObject({
+  version: literal("2.6.0"),
+  paths: array(RepositoryPathSchema).min(1).max(64).refine((paths) => new Set(paths).size === paths.length),
+  database: strictObject({
+    revision: string().min(1).max(128),
+    capturedAt: exports_iso.datetime(),
+    ecosystems: array(strictObject({
+      name: EcosystemSchema,
+      sha256: string().regex(/^[a-f0-9]{64}$/)
+    })).min(1).max(EcosystemSchema.options.length).refine((items) => new Set(items.map((item) => item.name)).size === items.length)
+  })
 });
-var WebCaptureSchema = strictObject({
-  id: IdSchema,
-  url: url().max(2048),
-  identity: string().min(1).max(128),
-  method: _enum(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]),
-  status: number().int().min(100).max(599),
-  body: string().max(8192)
+var SOURCE_SCANNER_LABEL = "org.mettle.source-scanners";
+var ScannerImageProfilesSchema = strictObject({
+  secretScan: SecretScanProfileSchema,
+  semgrep: SemgrepProfileSchema,
+  joern: JoernProfileSchema.optional(),
+  dependencyDatabase: DependencyScanProfileSchema.shape.database.optional()
 });
-var PermissionPolicySchema = strictObject({
-  id: string().min(1).max(128),
-  revision: string().min(1).max(128),
-  target: url().max(2048),
-  buildIdentityRef: string().min(1).max(2048),
-  approvedBy: string().min(1).max(256),
-  approvedAt: exports_iso.datetime(),
-  identities: array(strictObject({
-    id: IdSchema,
-    tenant: string().min(1).max(128),
-    role: string().min(1).max(128)
-  })).min(1).max(16),
-  rules: array(strictObject({
-    id: IdSchema,
-    identity: string().min(1).max(128),
-    resource: string().min(1).max(512),
-    action: string().min(1).max(128),
-    expected: _enum(["allow", "deny"])
-  })).min(1).max(64)
-}).superRefine((policy, context) => {
-  const identities = new Set(policy.identities.map((identity) => identity.id));
-  const rules = new Set(policy.rules.map((rule) => rule.id));
-  if (identities.size !== policy.identities.length || rules.size !== policy.rules.length || policy.rules.some((rule) => !identities.has(rule.identity)))
-    context.addIssue({
-      code: "custom",
-      message: "Policy identities and rules must be unique and bound."
-    });
-});
-var GVISOR_RUNTIME = "mettle-runsc";
-var SandboxRuntimeSchema = _enum([GVISOR_RUNTIME, "runc"]);
-var SandboxConfigSchema = strictObject({
-  socket: string().regex(/^\/(?:[^\0\r\n]+)$/).max(100),
-  image: string().regex(/^[a-z0-9][a-z0-9./:_-]*@sha256:[a-f0-9]{64}$/),
-  runtime: SandboxRuntimeSchema.optional(),
-  engineId: string().min(1).max(128).optional(),
-  location: _enum(["local", "vm"]).optional()
-}).refine((config) => config.location !== "vm" || sandboxRuntime(config) === GVISOR_RUNTIME && Boolean(config.engineId), "VM execution requires a pinned engine identity and mettle-runsc.");
-function sandboxRuntime(config) {
-  return config.runtime ?? GVISOR_RUNTIME;
-}
-function sandboxAllowsExecution(config, tool) {
-  return sandboxRuntime(config) === GVISOR_RUNTIME || !["sandbox_shell", "bash_run", "test_run"].includes(tool);
-}
-var TaskNameSchema = _enum([
-  "web_capture_read",
-  "web_capture_compare",
-  "repo_read",
-  "repo_search",
-  "change_inspect",
-  "test_run",
-  "semgrep_scan",
-  "secret_scan",
-  "dependency_scan",
-  "bash_run",
-  "http_request",
-  "web_discover",
-  "web_request",
-  "web_browse",
-  "session_health",
-  "browser_workflow",
-  "nuclei_scan",
-  "sqli_confirm",
-  "zap_scan"
+var SCANNER_FINDINGS_MAX = 40;
+var SOURCE_SCANNER_INPUT_LIMIT = 33554432;
+var SOURCE_SCANNER_TIMEOUT_MS = 120000;
+var SOURCE_SCANNER_VERSION_TIMEOUT_MS = 1e4;
+var SOURCE_SCANNER_TASK_TIMEOUT_MS = 150000;
+var ScannerStatusSchema = _enum([
+  "completed",
+  "failed",
+  "timed_out",
+  "output_limit",
+  "unavailable",
+  "version_mismatch",
+  "database_mismatch"
 ]);
-var SCANNER_CAPABILITIES = [
-  { profile: "secretScan", capability: "secrets" },
-  { profile: "dependencyScan", capability: "supply_chain" }
-];
-var SUBJECT_CAPABILITIES = {
-  runtime: ROUTE_CAPABILITIES.web,
-  source: [
-    ...new Set([
-      ...ROUTE_CAPABILITIES.repository,
-      ...ROUTE_CAPABILITIES.pull_request,
-      ...SCANNER_CAPABILITIES.map(({ capability }) => capability)
-    ])
-  ]
-};
-var PROBE_TOOL = "sandbox_probe";
-var SHELL_TOOL = "sandbox_shell";
-var SANDBOX_TOOLS = [
-  PROBE_TOOL,
-  SHELL_TOOL,
-  ...TaskNameSchema.options
-];
 
 // apps/harness/src/sandbox/worker.ts
 import { setTimeout as sleep } from "node:timers/promises";
@@ -193,9 +171,20 @@ class ToolRegistry {
       schema
     }));
   }
+  inventory() {
+    return [...this.tools.values()].map((tool) => ({
+      name: tool.name,
+      version: "1",
+      inputDigest: digest(toJSONSchema(tool.schema, { unrepresentable: "any" })),
+      outputDigest: digest(toJSONSchema(tool.outputSchema, { unrepresentable: "any" }))
+    })).sort((a, b) => a.name.localeCompare(b.name));
+  }
   select(names) {
     return new ToolRegistry([...this.tools.values()].filter((tool) => names.includes(tool.name)));
   }
+  unavailable(names, reason) {
+    return new ToolRegistry([...this.tools.values()].map((tool) => names.includes(tool.name) ? { ...tool, unavailableReason: reason } : tool));
+  }
   admit(name, input, canonical) {
     const tool = this.tools.get(name);
     if (!tool)
@@ -210,64 +199,22 @@ class ToolRegistry {
 // apps/harness/src/sandbox/docker.ts
 import { request } from "node:http";
 
-// apps/harness/src/storage/http-scope.ts
-var HTTP_HEADER_LIMIT = 16384;
-var HTTP_RESPONSE_LIMIT = 65536;
-var WEBSITE_RESPONSE_LIMIT = 1048576;
-function withinHttpScope(scope, url) {
-  return url.origin === scope.origin && !url.username && !url.password && !url.hash && !/%2f|%5c|%00|%25/i.test(url.pathname) && (url.pathname === scope.pathname || url.pathname.startsWith(scope.pathname.endsWith("/") ? scope.pathname : `${scope.pathname}/`));
-}
-
-// apps/harness/src/storage/scanners.ts
-var EcosystemSchema = _enum([
-  "npm",
-  "PyPI",
-  "Go",
-  "crates.io",
-  "Maven",
-  "Packagist",
-  "RubyGems"
-]);
-var MAX_DATABASE_BYTES = 268435456;
-var SEMGREP_VERSION_TIMEOUT_MS = 60000;
-var SEMGREP_SCAN_TIMEOUT_MS = 120000;
-var SEMGREP_TASK_TIMEOUT_MS = SEMGREP_VERSION_TIMEOUT_MS + SEMGREP_SCAN_TIMEOUT_MS + 30000;
-var SecretScanProfileSchema = strictObject({
-  version: literal("8.30.1")
-});
-var DependencyScanProfileSchema = strictObject({
-  version: literal("2.6.0"),
-  paths: array(RepositoryPathSchema).min(1).max(64).refine((paths) => new Set(paths).size === paths.length),
-  database: strictObject({
-    revision: string().min(1).max(128),
-    capturedAt: exports_iso.datetime(),
-    ecosystems: array(strictObject({
-      name: EcosystemSchema,
-      sha256: string().regex(/^[a-f0-9]{64}$/)
-    })).min(1).max(EcosystemSchema.options.length).refine((items) => new Set(items.map((item) => item.name)).size === items.length)
-  })
-});
-var SCANNER_FINDINGS_MAX = 40;
-var SOURCE_SCANNER_TIMEOUT_MS = 120000;
-var SOURCE_SCANNER_VERSION_TIMEOUT_MS = 1e4;
-var SOURCE_SCANNER_TASK_TIMEOUT_MS = 150000;
-var ScannerStatusSchema = _enum([
-  "completed",
-  "failed",
-  "timed_out",
-  "output_limit",
-  "unavailable",
-  "version_mismatch",
-  "database_mismatch"
-]);
-
 // apps/harness/src/sandbox/limits.ts
 var TASK_TIMEOUT_MS = 30000;
 var TASK_INPUT_LIMIT = 1048576;
+var TASK_INPUT_LIMITS = {
+  semgrep_scan: SOURCE_SCANNER_INPUT_LIMIT,
+  secret_scan: SOURCE_SCANNER_INPUT_LIMIT,
+  dependency_scan: SOURCE_SCANNER_INPUT_LIMIT,
+  joern_confirm: SOURCE_SCANNER_INPUT_LIMIT
+};
+var TASK_INPUT_MAX = Math.max(TASK_INPUT_LIMIT, ...Object.values(TASK_INPUT_LIMITS));
 var TASK_RESULT_LIMIT = 32768;
+var PDF_BYTES_LIMIT = 524288;
+var PDF_RESULT_LIMIT = 1048576;
 var BROKER_RESPONSE_LIMIT = 4 * Math.ceil(WEBSITE_RESPONSE_LIMIT / 3) + 12 * HTTP_HEADER_LIMIT + 1024;
 var CHILD_OUTPUT_KEEP = 4096;
-var TASK_CONTAINER_LIFETIME_S = Math.ceil(SEMGREP_TASK_TIMEOUT_MS / 1000) + 15;
+var TASK_CONTAINER_LIFETIME_S = Math.ceil(Math.max(SEMGREP_TASK_TIMEOUT_MS, JOERN_TASK_TIMEOUT_MS) / 1000) + 15;
 var SANDBOX_UID = 65534;
 var REPO_SEARCH_FILES = 100;
 var REPO_SEARCH_MATCHES = 20;
@@ -306,7 +253,7 @@ class DockerExchange {
         stream: true
       });
       this.framed = this.framed.subarray(length + 8);
-      if (Buffer.byteLength(this.lines) > 65536)
+      if (Buffer.byteLength(this.lines) > 524288)
         throw new Error;
       while (this.lines.includes(`
 `)) {
@@ -354,8 +301,8 @@ class DockerEngine {
   constructor(socket) {
     this.socket = socket;
   }
-  startExec(id, input, signal, timeoutMs, exchange) {
-    if (!/^[a-f0-9]{64}$/.test(id) || input.length > TASK_INPUT_LIMIT)
+  startExec(id, input, signal, timeoutMs, exchange, outputLimit = 65536) {
+    if (!/^[a-f0-9]{64}$/.test(id) || input.length > TASK_INPUT_MAX || !Number.isSafeInteger(outputLimit) || outputLimit < 65536 || outputLimit > 1064960)
       throw new HarnessError("sandbox_input_limit", "Invalid isolated exec input.");
     return new Promise((resolve, reject) => {
       let complete;
@@ -430,7 +377,7 @@ class DockerEngine {
             return;
           }
           size += chunk.length;
-          if (size > 65536)
+          if (size > outputLimit)
             fail("sandbox_output_limit");
           else
             chunks.push(chunk);
@@ -590,6 +537,13 @@ var RESOURCE_PROFILES = {
     NanoCpus: 2000000000,
     PidsLimit: 512,
     Tmpfs: { "/tmp": "rw,noexec,nosuid,nodev,size=512m" }
+  },
+  analysis: {
+    Memory: 4294967296,
+    MemorySwap: 4294967296,
+    NanoCpus: 2000000000,
+    PidsLimit: 512,
+    Tmpfs: { "/tmp": "rw,noexec,nosuid,nodev,size=1024m" }
   }
 };
 var ShellCommandSchema = strictObject({
@@ -632,10 +586,12 @@ function sandboxConfig(environment = process.env) {
   const parsed = SandboxConfigSchema.safeParse({
     socket: environment.HARNESS_SANDBOX_SOCKET ?? "/var/run/docker.sock",
     image: environment.HARNESS_SANDBOX_IMAGE,
-    ...environment.HARNESS_SANDBOX_RUNTIME !== undefined ? { runtime: environment.HARNESS_SANDBOX_RUNTIME } : {}
+    ...environment.HARNESS_SANDBOX_RUNTIME !== undefined ? { runtime: environment.HARNESS_SANDBOX_RUNTIME } : {},
+    ...environment.HARNESS_SANDBOX_ENGINE_ID !== undefined ? { engineId: environment.HARNESS_SANDBOX_ENGINE_ID } : {},
+    ...environment.HARNESS_SANDBOX_LOCATION !== undefined ? { location: environment.HARNESS_SANDBOX_LOCATION } : {}
   });
   if (!parsed.success)
-    throw new HarnessError("sandbox_config", "Use an approved repository@sha256 image, a local Unix socket, and HARNESS_SANDBOX_RUNTIME=mettle-runsc or runc.");
+    throw new HarnessError("sandbox_config", "Use an approved repository@sha256 image or full local sha256 image ID, a local Unix socket, and HARNESS_SANDBOX_RUNTIME=mettle-runsc or runc.");
   return Object.freeze(parsed.data);
 }
 function launchSpec(image, script, labels, profile, runtime) {
@@ -725,6 +681,7 @@ var ACTIVE_SCAN_TOOLS = [
 ];
 var common = {
   id: IdSchema,
+  identity: IdSchema.optional(),
   url: url().max(2048),
   maxRequests: number().int().min(1).max(128),
   requestsPerSecond: number().int().min(1).max(5),
@@ -750,7 +707,15 @@ var ActiveScanProfileSchema = discriminatedUnion("tool", [
     tool: literal("sqli_confirm"),
     version: literal("1.10"),
     parameter: string().regex(/^[a-zA-Z0-9_]{1,64}$/),
-    technique: _enum(["B", "E"])
+    technique: _enum(["B", "E"]),
+    request: strictObject({
+      method: _enum(["POST", "PUT", "PATCH"]),
+      contentType: _enum([
+        "application/json",
+        "application/x-www-form-urlencoded"
+      ]),
+      body: string().min(1).max(4096)
+    }).optional()
   }),
   strictObject({
     ...common,
@@ -777,6 +742,18 @@ var ActiveScannersSchema = strictObject({
   })).min(1).max(4),
   profiles: array(ActiveScanProfileSchema).min(1).max(8)
 });
+function bodyParameters(body, contentType) {
+  if (contentType === "application/x-www-form-urlencoded") {
+    const entries = [...new URLSearchParams(body)];
+    return entries.length <= 32 && entries.every(([key]) => /^[a-zA-Z0-9_]{1,64}$/.test(key)) ? entries : undefined;
+  }
+  try {
+    const value = record(string().regex(/^[a-zA-Z0-9_]{1,64}$/), union([string(), number().finite(), boolean(), _null()])).parse(JSON.parse(body));
+    return Object.keys(value).length <= 32 && JSON.stringify(value) === body ? Object.entries(value) : undefined;
+  } catch {
+    return;
+  }
+}
 function scannerEndpoint(config, target, proposed) {
   const url2 = new URL(proposed);
   const scope = new URL(target);
@@ -798,8 +775,13 @@ function validateActiveScanners(config, target, buildIdentityRef) {
     if (profile.tool === "nuclei_scan")
       for (const path of profile.template.paths)
         scannerEndpoint(config, target, new URL(path, profile.url).href);
-    if (profile.tool === "sqli_confirm" && new URL(profile.url).searchParams.getAll(profile.parameter).length !== 1)
-      throw new HarnessError("scanner_denied", "SQLMap requires one approved query parameter and URL.");
+    if (profile.tool === "sqli_confirm") {
+      const query = new URL(profile.url).searchParams.getAll(profile.parameter);
+      const body = profile.request ? bodyParameters(profile.request.body, profile.request.contentType) : undefined;
+      const selected = body?.filter(([key]) => key === profile.parameter);
+      if (profile.request ? !body || selected?.length !== 1 || typeof selected[0]?.[1] !== "string" || query.length !== 0 : query.length !== 1)
+        throw new HarnessError("scanner_denied", "SQLMap requires one exact query or body parameter; JSON bodies must be canonical flat objects with a string test value.");
+    }
   }
 }
 var SCANNER_REQUEST_STRIP_HEADERS = [
@@ -813,12 +795,20 @@ var SCANNER_REQUEST_STRIP_HEADERS = [
   "keep-alive",
   "accept-encoding"
 ];
-function scannerRequestAllowed(profile, url2, method) {
+function scannerRequestAllowed(profile, url2, method, request) {
   const approved = new URL(profile.url);
   if (url2.origin !== approved.origin)
     return false;
   if (profile.tool === "zap_scan")
     return true;
+  if (profile.tool === "sqli_confirm" && profile.request) {
+    if (url2.href !== profile.url || method !== profile.request.method || request?.body === undefined || request.headers["content-type"] !== profile.request.contentType)
+      return false;
+    const actual = bodyParameters(request.body, profile.request.contentType);
+    const original = bodyParameters(profile.request.body, profile.request.contentType);
+    const fixed = (entries) => entries.filter(([key]) => key !== profile.parameter);
+    return Boolean(actual && original && actual.filter(([key]) => key === profile.parameter).length === 1 && digest(fixed(actual)) === digest(fixed(original)));
+  }
   if (method !== "GET" && method !== "HEAD")
     return false;
   if (profile.tool === "nuclei_scan")
@@ -829,7 +819,38 @@ function scannerRequestAllowed(profile, url2, method) {
   return JSON.stringify(fixed(url2)) === JSON.stringify(fixed(approved));
 }
 function sqlmapCandidate(finding, profile) {
-  return finding.status === "candidate" && finding.verification.result === "pending" && finding.cwe === "CWE-89" && finding.subject.kind === "runtime" && ("endpoint" in finding && finding.endpoint ? finding.endpoint.url === profile.url && finding.endpoint.method === "GET" && finding.endpoint.parameter === profile.parameter : finding.location === profile.url);
+  return finding.status === "candidate" && finding.verification.result === "pending" && finding.cwe === "CWE-89" && finding.subject.kind === "runtime" && ("endpoint" in finding && finding.endpoint ? finding.endpoint.url === profile.url && finding.endpoint.method === (profile.request?.method ?? "GET") && finding.endpoint.parameter === profile.parameter : !profile.request && finding.location === profile.url);
+}
+
+// apps/harness/src/storage/port-scan.ts
+var PORT_CONNECT_TIMEOUT_MS = 2000;
+var PORT_SCAN_TIMEOUT_MS = 120000;
+var PORT_SCAN_TASK_TIMEOUT_MS = 150000;
+var PortScanProfileSchema = strictObject({
+  version: literal("2.6.1"),
+  approvedBy: string().min(1).max(256),
+  expiresAt: exports_iso.datetime(),
+  host: string().min(1).max(253),
+  address: PublicAddressSchema,
+  ports: array(number().int().min(1).max(65535)).min(1).max(32).refine((ports) => new Set(ports).size === ports.length),
+  connectionsPerSecond: number().int().min(1).max(5)
+});
+var PortRequestSchema = strictObject({
+  address: PublicAddressSchema,
+  port: number().int().min(1).max(65535)
+});
+var PortOutcomeSchema = _enum([
+  "open",
+  "closed",
+  "timed_out",
+  "unreachable",
+  "cancelled"
+]);
+function portDestination(profile, target, input) {
+  const request = PortRequestSchema.parse(input);
+  if (new URL(target).hostname !== profile.host || request.address !== profile.address || !profile.ports.includes(request.port))
+    throw new HarnessError("scanner_denied", "TCP discovery requires the exact approved host, IPv4 address and port.");
+  return request;
 }
 
 // apps/harness/src/sandbox/active-program.ts
@@ -925,7 +946,7 @@ async function activeScan(tool, input, send) {
       const version = await run("/usr/bin/python3", ["/opt/mettle/sqlmap/sqlmap.py", "--version"], 10000);
       if (version.code !== 0 || version.stdout.split("\n")[0].trim() !== profile.version + "#stable") throw new Error("version_mismatch");
       await fs.writeFile(root + "/targets.txt", profile.url + "\n");
-      const scanned = await run("/usr/bin/python3", ["/opt/mettle/sqlmap/sqlmap.py", "-m", root + "/targets.txt", "-p", profile.parameter, "--technique=" + profile.technique, "--batch", "--skip-waf", "--level=1", "--risk=1", "--threads=1", "--timeout=5", "--retries=0", "--delay=" + String(1 / profile.requestsPerSecond), "--proxy=" + proxyUrl, "--ignore-redirects", "--disable-coloring", "--flush-session", "--output-dir=" + root + "/sqlmap", "--results-file=" + root + "/sqlmap.csv", "-v", "0"]);
+      const scanned = await run("/usr/bin/python3", ["/opt/mettle/sqlmap/sqlmap.py", "-m", root + "/targets.txt", "-p", profile.parameter, ...(profile.request ? ["--method=" + profile.request.method, "--data=" + profile.request.body, "--headers=Content-Type: " + profile.request.contentType] : []), "--technique=" + profile.technique, "--batch", "--skip-waf", "--level=1", "--risk=1", "--threads=1", "--timeout=5", "--retries=0", "--delay=" + String(1 / profile.requestsPerSecond), "--proxy=" + proxyUrl, "--ignore-redirects", "--disable-coloring", "--flush-session", "--output-dir=" + root + "/sqlmap", "--results-file=" + root + "/sqlmap.csv", "-v", "0"]);
       const errors = (scanned.stdout + scanned.stderr).split("\n").filter((line) => /\[(?:CRITICAL|ERROR)\]/.test(line));
       if (scanned.code !== 0 || errors.some((line) => !/\[(?:CRITICAL|ERROR)\] all tested parameters do not appear to be injectable\./.test(line))) throw new Error("scan_failed");
       const parsed = await run("/usr/bin/python3", ["-c", "import csv,json,sys; print(json.dumps(list(csv.DictReader(open(sys.argv[1],newline='')))))", root + "/sqlmap.csv"], 10000);
@@ -933,7 +954,8 @@ async function activeScan(tool, input, send) {
       findings = JSON.parse(parsed.stdout).flatMap((item) => {
         if (item['Target URL'] !== profile.url) throw new Error();
         if (!item['Technique(s)'] || item['Note(s)']) return [];
-        if (item.Place !== "GET" || item.Parameter !== profile.parameter) throw new Error();
+        const json = profile.request?.contentType === "application/json";
+        if (item.Place !== (profile.request ? json ? "(custom) POST" : "POST" : "GET") || item.Parameter !== (json ? "JSON " : "") + profile.parameter) throw new Error();
         return [{ ruleId: "sqlmap-" + profile.technique, url: profile.url, title: "SQL injection observation", parameter: profile.parameter }];
       });
     } else if (tool === "zap_scan") {
@@ -970,8 +992,375 @@ async function activeScan(tool, input, send) {
 }
 `;
 
+// apps/harness/src/sandbox/browser-page-program.ts
+var daemon = String.raw`
+const crypto = require("node:crypto"), net = require("node:net"), readline = require("node:readline");
+const retained = {};
+let busy = false;
+const server = net.createServer(async (socket) => {
+  if (busy) { socket.destroy(); return; }
+  busy = true;
+  const lines = readline.createInterface({ input: socket, crlfDelay: Infinity });
+  const iterator = lines[Symbol.asyncIterator]();
+  let disconnected = false;
+  socket.on("close", () => { disconnected = true; });
+  socket.on("error", () => {});
+  const next = async () => {
+    const line = await iterator.next();
+    if (line.done || Buffer.byteLength(line.value) > ${BROKER_RESPONSE_LIMIT}) throw new Error("browser_page_protocol");
+    return JSON.parse(line.value);
+  };
+  let queue = Promise.resolve();
+  const send = (request) => {
+    const result = queue.then(async () => {
+      if (disconnected) throw new Error("browser_page_disconnected");
+      socket.write(JSON.stringify({ request }) + "\n");
+      const response = await next();
+      if (!Object.hasOwn(response, "response")) throw new Error("browser_page_refused");
+      return response.response;
+    });
+    queue = result;
+    return result;
+  };
+  try {
+    const { input } = await next();
+    if ((input.page.operation === "open") === Boolean(retained.page)) throw new Error("browser_page_lost");
+    const value = await websiteBrowse(input, send, retained);
+    await queue;
+    socket.end(JSON.stringify({ value }) + "\n");
+    if (input.page.operation === "close") server.close();
+  } catch {
+    if (retained.browser) await retained.browser.close().catch(() => {});
+    socket.end(JSON.stringify({ error: "browser_page_failed" }) + "\n");
+    server.close();
+  } finally { lines.close(); busy = false; }
+});
+server.listen("/tmp/mettle-browser-page.sock", () => { process.send({ ready: true }); process.disconnect(); });
+server.on("error", () => process.exit(1));
+`;
+var BROWSER_PAGE_PROGRAM = String.raw`
+async function browseRetainedPage(input, send) {
+  if (input.page.operation === "open") {
+    const definitions = [websiteScope, restoreBrowserPrivateState, captureBrowserPrivateState, websiteBrowse].map((fn) => fn.toString()).join("\n");
+    const child = require("node:child_process").spawn(process.execPath, ["-e", definitions + "\n" + ${JSON.stringify(daemon)}], { detached: true, stdio: ["ignore", "ignore", "ignore", "ipc"] });
+    await new Promise((resolve, reject) => {
+      const timer = setTimeout(() => { child.kill(); reject(new Error("browser_page_start")); }, 10000);
+      child.once("error", (error) => { clearTimeout(timer); reject(error); });
+      child.once("exit", () => { clearTimeout(timer); reject(new Error("browser_page_start")); });
+      child.once("message", (message) => { clearTimeout(timer); message.ready === true ? resolve() : reject(new Error("browser_page_start")); });
+    });
+    child.unref();
+  }
+  const socket = require("node:net").connect("/tmp/mettle-browser-page.sock");
+  await new Promise((resolve, reject) => { socket.once("connect", resolve); socket.once("error", reject); });
+  const lines = readline.createInterface({ input: socket, crlfDelay: Infinity });
+  const encoded = JSON.stringify({ input });
+  if (Buffer.byteLength(encoded) > ${TASK_INPUT_LIMIT}) throw new Error("browser_page_input");
+  socket.write(encoded + "\n");
+  try {
+    for await (const line of lines) {
+      if (Buffer.byteLength(line) > ${BROKER_RESPONSE_LIMIT}) throw new Error("browser_page_output");
+      const message = JSON.parse(line);
+      if (Object.keys(message).length !== 1) throw new Error("browser_page_protocol");
+      if (Object.hasOwn(message, "request")) socket.write(JSON.stringify({ response: await send(message.request) }) + "\n");
+      else if (Object.hasOwn(message, "value")) return message.value;
+      else throw new Error("browser_page_failed");
+    }
+    throw new Error("browser_page_lost");
+  } finally { lines.close(); socket.destroy(); }
+}
+`;
+
+// apps/harness/src/sandbox/port-program.ts
+var PORT_PROGRAM = String.raw`
+async function portScan(input, send) {
+  const fs = require("node:fs/promises");
+  const net = require("node:net");
+  const { spawn } = require("node:child_process");
+  const root = await fs.mkdtemp("/tmp/mettle-ports-");
+  const profile = input.profile;
+  const sockets = new Set();
+  const children = new Set();
+  const jobs = new Set();
+  let failure;
+  const run = (args, timeout) => new Promise((resolve, reject) => {
+    const child = spawn("/usr/local/bin/naabu", args, { cwd: root, env: { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: root, TMPDIR: root }, shell: false, stdio: ["ignore", "pipe", "pipe"] });
+    children.add(child);
+    let stdout = "", stderr = "", size = 0, error;
+    const timer = setTimeout(() => { error = new Error("timed_out"); child.kill("SIGKILL"); }, timeout);
+    for (const [stream, field] of [[child.stdout, "stdout"], [child.stderr, "stderr"]]) stream.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > 65536) { error = new Error("output_limit"); child.kill("SIGKILL"); return; }
+      if (field === "stdout") stdout += chunk.toString(); else stderr += chunk.toString();
+    });
+    child.once("error", (cause) => { error = cause; });
+    child.once("close", (code) => { clearTimeout(timer); children.delete(child); if (error) reject(error); else resolve({ code, stdout, stderr }); });
+  });
+  const proxy = net.createServer((socket) => {
+    let bytes = Buffer.alloc(0), phase = "greeting";
+    sockets.add(socket);
+    socket.on("close", () => sockets.delete(socket));
+    socket.on("error", (error) => { if (phase !== "done" || error.code !== "ECONNRESET") failure ??= error; });
+    socket.setTimeout(10000, () => { failure ??= new Error("proxy_timeout"); socket.destroy(); });
+    socket.on("data", (chunk) => {
+      try {
+        if (phase === "connecting" || phase === "done") throw new Error("payload_denied");
+        bytes = Buffer.concat([bytes, chunk]);
+        if (bytes.length > 512) throw new Error("proxy_input_limit");
+        if (phase === "greeting") {
+          if (bytes.length < 2) return;
+          if (bytes[0] !== 5 || bytes[1] !== 1) throw new Error("auth_denied");
+          if (bytes.length < 3) return;
+          if (bytes[2] !== 0) throw new Error("auth_denied");
+          bytes = bytes.subarray(3);
+          phase = "request";
+          socket.write(Buffer.from([5, 0]));
+        }
+        if (phase !== "request" || bytes.length < 4) return;
+        if (bytes[0] !== 5 || bytes[1] !== 1 || bytes[2] !== 0 || bytes[3] !== 1) throw new Error("connect_only_ipv4");
+        if (bytes.length < 10) return;
+        if (bytes.length !== 10) throw new Error("payload_denied");
+        const address = [...bytes.subarray(4, 8)].join(".");
+        const port = bytes.readUInt16BE(8);
+        if (address !== profile.address || !profile.ports.includes(port)) throw new Error("scope_denied");
+        phase = "connecting";
+        const job = send({ address, port }).then((response) => {
+          phase = "done";
+          const code = response.outcome === "open" ? 0 : response.outcome === "closed" ? 5 : 4;
+          socket.end(Buffer.from([5, code, 0, 1, 0, 0, 0, 0, 0, 0]));
+        }).catch((error) => { failure ??= error; socket.destroy(); });
+        jobs.add(job);
+        void job.finally(() => jobs.delete(job));
+      } catch (error) { failure ??= error; socket.destroy(); }
+    });
+  });
+  try {
+    const version = await run(["-version"], 10000);
+    if (version.code !== 0 || !(version.stdout + version.stderr).split(/\s+/).includes(profile.version)) throw new Error("version_mismatch");
+    await fs.writeFile(root + "/config.yaml", "{}\n", { flag: "wx", mode: 0o600 });
+    await new Promise((resolve, reject) => { proxy.once("error", reject); proxy.listen(0, "127.0.0.1", resolve); });
+    const result = await run(["-host", profile.address, "-p", profile.ports.join(","), "-s", "c", "-iv", "4", "-Pn", "-proxy", "127.0.0.1:" + proxy.address().port, "-config", root + "/config.yaml", "-no-stdin", "-disable-update-check", "-c", "1", "-rate", String(profile.connectionsPerSecond), "-retries", "1", "-timeout", "5000", "-warm-up-time", "0", "-silent", "-json"], ${PORT_SCAN_TIMEOUT_MS});
+    await Promise.all(jobs);
+    if (failure) throw failure;
+    if (result.code !== 0 || /\[(?:ERR|FTL)\]/.test(result.stderr)) throw new Error("scan_failed");
+    const openPorts = result.stdout.split("\n").filter(Boolean).map((line) => {
+      const entry = JSON.parse(line);
+      if (entry.ip !== profile.address || entry.protocol !== "tcp" || !profile.ports.includes(entry.port)) throw new Error("scan_output");
+      return entry.port;
+    });
+    return { status: "completed", version: profile.version, openPorts: [...new Set(openPorts)].sort((a, b) => a - b) };
+  } finally {
+    for (const child of children) child.kill("SIGKILL");
+    for (const socket of sockets) socket.destroy();
+    await new Promise((resolve) => proxy.close(resolve));
+    await fs.rm(root, { recursive: true, force: true });
+  }
+}
+`;
+
+// apps/harness/src/sandbox/browser-state-program.ts
+var BROWSER_STATE_PROGRAM = `
+async function restoreBrowserPrivateState(page, context, state, url) {
+  const origin = new URL(url).origin;
+  const saved = state.origins.find((entry) => entry.origin === origin);
+  if (!saved || (!saved.sessionStorage?.length && !saved.opfs?.length)) return;
+  const bootstrap = new URL(url);
+  bootstrap.searchParams.set("__mettle_restore", crypto.randomBytes(16).toString("hex"));
+  const route = async (request) => request.fulfill({ status: 200, contentType: "text/html", body: "<!doctype html><title>Restore private state</title>" });
+  await page.route(bootstrap.href, route);
+  try {
+    await page.goto(bootstrap.href, { waitUntil: "domcontentloaded" });
+    await page.evaluate(async (saved) => {
+      sessionStorage.clear();
+      for (const { name, value } of saved.sessionStorage || []) sessionStorage.setItem(name, value);
+      if (!saved.opfs?.length) return;
+      const root = await navigator.storage.getDirectory();
+      for (const entry of saved.opfs) {
+        const parts = entry.path.split("/"), name = parts.pop();
+        let parent = root;
+        for (const part of parts) parent = await parent.getDirectoryHandle(part, { create: true });
+        if (entry.kind === "directory") await parent.getDirectoryHandle(name, { create: true });
+        else {
+          const handle = await parent.getFileHandle(name, { create: true });
+          const writer = await handle.createWritable();
+          await writer.write(Uint8Array.from(atob(entry.base64), (char) => char.charCodeAt(0)));
+          await writer.close();
+        }
+      }
+    }, saved);
+  } finally { await page.unroute(bootstrap.href, route); }
+}
+
+async function captureBrowserPrivateState(page, context, target) {
+  if (new URL(page.url()).origin !== new URL(target).origin) throw new Error("browser_state_origin");
+  const extras = await page.evaluate(async () => {
+    const session = Object.entries(sessionStorage).map(([name, value]) => ({ name, value }));
+    if (session.length > 64 || session.some((entry) => entry.name.length > 256 || entry.value.length > 16384)) throw new Error("browser_state_limit");
+    const opfs = [];
+    let bytes = 0;
+    const visit = async (directory, prefix, depth) => {
+      if (depth > 8) throw new Error("browser_state_limit");
+      for await (const [name, handle] of directory.entries()) {
+        if (opfs.length >= 64) throw new Error("browser_state_limit");
+        const path = prefix + name;
+        if (handle.kind === "directory") {
+          opfs.push({ kind: "directory", path });
+          await visit(handle, path + "/", depth + 1);
+        } else {
+          const file = await handle.getFile();
+          bytes += file.size;
+          if (file.size > 65536 || bytes > 131072) throw new Error("browser_state_limit");
+          const buffer = new Uint8Array(await file.arrayBuffer());
+          let binary = "";
+          for (const byte of buffer) binary += String.fromCharCode(byte);
+          opfs.push({ kind: "file", path, base64: btoa(binary) });
+        }
+      }
+    };
+    if (navigator.storage?.getDirectory) await visit(await navigator.storage.getDirectory(), "", 1);
+    return { origin: location.origin, sessionStorage: session, opfs };
+  });
+  const state = await context.storageState({ indexedDB: true });
+  let entry = state.origins.find((entry) => entry.origin === extras.origin);
+  if (!entry) { entry = { origin: extras.origin, localStorage: [] }; state.origins.push(entry); }
+  Object.assign(entry, extras);
+  return state;
+}
+`;
+
+// apps/harness/src/sandbox/javascript-program.ts
+var JAVASCRIPT_PROGRAM = String.raw`
+const node = (value) => value && typeof value === "object" && ("type" in value) && typeof value.type === "string" ? value : undefined;
+function literal(value, depth = 0) {
+  const entry = node(value);
+  if (!entry || depth > 8)
+    return;
+  if (entry.type === "StringLiteral")
+    return typeof entry.value === "string" ? entry.value : undefined;
+  if (entry.type === "TemplateLiteral" && Array.isArray(entry.expressions) && !entry.expressions.length) {
+    const quasis = entry.quasis;
+    return quasis[0]?.value.cooked ?? undefined;
+  }
+  if (entry.type === "BinaryExpression" && entry.operator === "+") {
+    const left = literal(entry.left, depth + 1), right = literal(entry.right, depth + 1);
+    return left !== undefined && right !== undefined && left.length + right.length <= 2048 ? left + right : undefined;
+  }
+  return;
+}
+const property = (value) => {
+  const entry = node(value);
+  return entry?.type === "Identifier" ? String(entry.name) : literal(entry);
+};
+function javascriptDiscovery(source, base, contentType) {
+  const scripts = /text\/html/i.test(contentType) ? [...source.matchAll(/<script\b[^>]*>([\s\S]*?)<\/script\s*>/gi)].slice(0, 32).map((entry) => entry[1]) : /(?:javascript|ecmascript)/i.test(contentType) ? [source] : [];
+  if (!scripts.length)
+    return { leads: [], omitted: 0 };
+  const { parse } = require("/opt/mettle-parser/lib/index.js");
+  const leads = [];
+  let omitted = 0;
+  for (const script of scripts) {
+    if (Buffer.byteLength(script) > 262144) {
+      omitted++;
+      continue;
+    }
+    let ast;
+    try {
+      ast = parse(script, {
+        sourceType: "unambiguous",
+        errorRecovery: false,
+        allowReturnOutsideFunction: true
+      });
+    } catch {
+      omitted++;
+      continue;
+    }
+    const pending = [ast];
+    let visited = 0;
+    while (pending.length && visited++ < 40000) {
+      const current = node(pending.pop());
+      if (!current)
+        continue;
+      for (const [key, value] of Object.entries(current)) {
+        if (["loc", "start", "end", "comments", "tokens", "extra"].includes(key))
+          continue;
+        if (Array.isArray(value))
+          pending.push(...value);
+        else if (node(value))
+          pending.push(value);
+      }
+      if (current.type !== "CallExpression")
+        continue;
+      const callee = node(current.callee);
+      const name = callee?.type === "Identifier" ? String(callee.name) : callee?.type === "MemberExpression" ? property(callee.property) : undefined;
+      const receiver = callee?.type === "MemberExpression" ? property(callee.object) : undefined;
+      const args = Array.isArray(current.arguments) ? current.arguments : [];
+      let method, address;
+      if (name === "fetch" && (!receiver || ["window", "globalThis"].includes(receiver))) {
+        address = literal(args[0]);
+        method = "GET";
+        if (args[1] !== undefined) {
+          const options = node(args[1]);
+          if (options?.type !== "ObjectExpression" || !Array.isArray(options.properties)) {
+            omitted++;
+            continue;
+          }
+          for (const value of options.properties) {
+            const option = node(value);
+            if (option?.type !== "ObjectProperty" || option.computed) {
+              method = undefined;
+              break;
+            }
+            if (property(option.key) === "method")
+              method = literal(option.value)?.toUpperCase();
+          }
+        }
+      } else if (name === "open" && receiver) {
+        method = literal(args[0])?.toUpperCase();
+        address = literal(args[1]);
+      } else if (receiver === "axios" && name && ["get", "head", "options", "post", "put", "patch", "delete"].includes(name)) {
+        method = name.toUpperCase();
+        address = literal(args[0]);
+      } else
+        continue;
+      if (!address || address.length > 2048 || !method || !["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"].includes(method)) {
+        omitted++;
+        continue;
+      }
+      try {
+        const url = new URL(address, base);
+        url.hash = "";
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.href.length > 2048 || leads.length >= 200) {
+          omitted++;
+          continue;
+        }
+        leads.push({
+          url: url.href,
+          method,
+          kind: "javascript",
+          inputs: [],
+          contentType: null,
+          operation: null,
+          authentication: "unknown",
+          stateChanging: !["GET", "HEAD", "OPTIONS"].includes(method),
+          limitations: [
+            "Static syntax-tree request lead; execution, body values, authentication and dynamic bindings remain unproven."
+          ]
+        });
+      } catch {
+        omitted++;
+      }
+    }
+    if (pending.length)
+      omitted++;
+  }
+  return { leads, omitted };
+}
+`;
+
 // apps/harness/src/sandbox/website-program.ts
 var WEBSITE_PROGRAM = String.raw`
+${JAVASCRIPT_PROGRAM}
+${BROWSER_STATE_PROGRAM}
 function websiteScope(input, raw, method = "GET") {
   try {
     const url = new URL(raw);
@@ -983,59 +1372,93 @@ function websiteScope(input, raw, method = "GET") {
     });
   } catch { return false; }
 }
-function websiteLinks(body, base) {
-  const result = [];
-  for (const match of body.matchAll(/<(a|script|form)\b([^>]{0,8192})>/gi)) {
-    const tag = match[1].toLowerCase();
-    const attribute = tag === "script" ? "src" : tag === "form" ? "action" : "href";
-    const value = new RegExp("\\b" + attribute + "\\s*=\\s*[\"']([^\"'<>\\s]{1,2048})[\"']", "i").exec(match[2]);
-    if (!value) continue;
+function websiteAttribute(attributes, key) {
+  const match = new RegExp('(?:^|\\s)' + key + '\\s*=\\s*(?:"([^"<>]*)"|\'([^\'<>]*)\'|([^\\s<>]+))', 'i').exec(attributes);
+  return match ? (match[1] ?? match[2] ?? match[3]).replace(/&amp;/g, "&") : undefined;
+}
+function websiteLeads(body, base, contentType) {
+  const leads = [];
+  let omitted = 0;
+  const add = (raw, method, kind, fields = [], media = null, limitations = []) => {
     try {
-      const url = new URL(value[1].replace(/&amp;/g, "&"), base); url.hash = "";
-      if (!["https:", "http:"].includes(url.protocol) || url.href.length > 2048) continue;
-      const formMethod = /\bmethod\s*=\s*["']post["']/i.test(match[2]) ? "POST" : "GET";
-      result.push({ url: url.href, method: tag === "form" ? formMethod : "GET", kind: tag === "form" ? "form" : tag === "script" ? "script" : "page" });
-    } catch {}
+      const url = new URL(raw, base); url.hash = "";
+      if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.href.length > 2048 || leads.length >= 200) { omitted++; return; }
+      leads.push({ url: url.href, method, kind, inputs: fields, contentType: media, operation: null, authentication: "unknown", stateChanging: !["GET", "HEAD", "OPTIONS"].includes(method), limitations });
+    } catch { omitted++; }
+  };
+  if (/text\/html/i.test(contentType)) {
+    for (const match of body.matchAll(/<(a|script)\b([^>]{0,8192})>/gi)) {
+      const tag = match[1].toLowerCase();
+      const value = websiteAttribute(match[2], tag === "script" ? "src" : "href");
+      if (value !== undefined) add(value, "GET", tag === "script" ? "script" : "page");
+    }
+    for (const match of body.matchAll(/<form\b([^>]{0,8192})>([\s\S]{0,32768}?)(?:<\/form\s*>|$)/gi)) {
+      const method = (websiteAttribute(match[1], "method") || "GET").toUpperCase();
+      if (!["GET", "POST"].includes(method)) { omitted++; continue; }
+      const fields = [], names = new Set();
+      let missing = 0;
+      for (const control of match[2].matchAll(/<(?:input|select|textarea|button)\b([^>]{0,8192})>/gi)) {
+        const key = websiteAttribute(control[1], "name");
+        if (!key || /(?:^|\s)disabled(?:\s|=|$)/i.test(control[1]) || names.has(key)) continue;
+        names.add(key);
+        if (fields.length >= 64 || key.length > 256) { missing++; continue; }
+        fields.push({ location: method === "GET" ? "query" : "body", name: key, required: /(?:^|\s)required(?:\s|=|$)/i.test(control[1]), type: "string", identifier: false });
+      }
+      const media = method === "POST" ? (websiteAttribute(match[1], "enctype") || "application/x-www-form-urlencoded").toLowerCase() : null;
+      add(websiteAttribute(match[1], "action") || base, method, "form", fields, media, ["Form controls are leads; values, login state and workflow prerequisites are not synthesized.", ...(missing ? [missing + " form input names omitted by bounds."] : [])]);
+      omitted += missing;
+    }
   }
-  return result.sort((a, b) => (a.kind === "page" ? 0 : 1) - (b.kind === "page" ? 0 : 1));
+  const priority = { page: 0, javascript: 1, script: 2, form: 3 };
+  return { leads: leads.sort((a, b) => priority[a.kind] - priority[b.kind]), omitted };
 }
+function websiteRequestKey(request) { return request.method + " " + request.url; }
+function websiteLeadKey(lead) { return websiteRequestKey(lead) + " " + (lead.contentType || "") + " " + JSON.stringify((lead.inputs || []).map((input) => input.location + ":" + input.name).sort()); }
 async function websiteObserve(tool, input, send) {
-  const initial = { url: input.url || input.target, method: input.method || "GET", ...(input.body !== undefined ? { body: input.body } : {}), ...(input.headers ? { headers: input.headers } : {}) };
+  const initial = { url: input.url || input.target, method: input.method || "GET", ...(input.body !== undefined ? { body: input.body } : {}), ...(input.bodyBase64 !== undefined ? { bodyBase64: input.bodyBase64 } : {}), ...(input.headers ? { headers: input.headers } : {}) };
   const queue = [{ request: initial, depth: 0 }];
   const seen = new Set(), pages = [], endpoints = new Map(), leads = new Map();
   let omitted = 0, redirects = 0;
   while (queue.length && pages.length < input.maxPages && seen.size < 100) {
-    const next = queue.shift();
-    if (seen.has(next.request.url)) continue;
-    seen.add(next.request.url);
+    const next = queue.shift(), key = websiteRequestKey(next.request);
+    if (seen.has(key)) continue;
+    seen.add(key);
     const response = await send(next.request);
-    const body = Buffer.from(response.body, "base64").toString("utf8");
+    const textual = /^(text\/|application\/(.*json|.*xml|javascript|x-javascript))/i.test(response.contentType);
+    const body = textual ? Buffer.from(response.body, "base64").toString("utf8") : "";
     if ([301,302,303,307,308].includes(response.status)) {
       const location = response.headers && response.headers.location;
       if (typeof location === "string" && redirects++ < 5 && ["GET", "HEAD"].includes(next.request.method)) {
         const redirect = new URL(location, next.request.url); redirect.hash = "";
-        if (websiteScope(input, redirect.href, next.request.method)) queue.unshift({ request: { url: redirect.href, method: next.request.method }, depth: next.depth });
-        else { omitted++; leads.set(redirect.href, { url: redirect.href, method: "GET", kind: "redirect", inScope: false }); }
+        const lead = { url: redirect.href, method: next.request.method, kind: "redirect", inScope: websiteScope(input, redirect.href, next.request.method) };
+        if (leads.size < 40) leads.set(websiteLeadKey(lead), lead); else omitted++;
+        if (lead.inScope) queue.unshift({ request: { url: redirect.href, method: next.request.method }, depth: next.depth });
+        else omitted++;
       } else omitted++;
     }
     const url = new URL(next.request.url);
-    endpoints.set(url.href, { id: crypto.createHash("sha256").update(url.href).digest("hex"), url: url.href, method: next.request.method, parameters: [...new Set(url.searchParams.keys())].slice(0,16), observed: true });
-    const textual = /^(text\/|application\/(.*json|.*xml|javascript|x-javascript))/i.test(response.contentType);
-    pages.push({ url: url.href, status: response.status, contentType: response.contentType, excerpt: textual ? (response.excerpt ?? body).slice(0, tool === "web_request" ? 2048 : 512) : "[Binary response; body not retained as text]", truncated: textual && body.length > (tool === "web_request" ? 2048 : 512), ...(response.evidenceRef ? { evidenceRef: response.evidenceRef } : {}) });
-    if (!response.contentType.includes("text/html")) continue;
-    for (const link of websiteLinks(body, url.href)) {
-      const inScope = websiteScope(input, link.url, link.method);
-      if (leads.size < 40) leads.set(link.url, { ...link, inScope }); else omitted++;
+    const parameters = [...new Set(url.searchParams.keys())];
+    omitted += Math.max(0, parameters.length - 16);
+    if (endpoints.size < 40 || endpoints.has(key)) endpoints.set(key, { id: crypto.createHash("sha256").update(key).digest("hex"), url: url.href, method: next.request.method, parameters: parameters.slice(0,16), observed: true }); else omitted++;
+    pages.push({ url: url.href, status: response.status, contentType: response.contentType, excerpt: textual ? (response.excerpt ?? body).slice(0, tool === "web_request" ? 2048 : 512) : "[Binary response; body not retained as text]", truncated: Boolean(response.bodyTruncated) || textual && body.length > (tool === "web_request" ? 2048 : 512), ...(response.bodyTruncated ? { bodyTruncated: true } : {}), ...(response.evidenceRef ? { evidenceRef: response.evidenceRef } : {}) });
+    if (response.bodyTruncated) omitted++;
+    const discovered = websiteLeads(body, url.href, response.contentType);
+    const scripts = javascriptDiscovery(body, url.href, response.contentType);
+    discovered.leads.push(...scripts.leads);
+    omitted += discovered.omitted + scripts.omitted;
+    for (const link of discovered.leads) {
+      const inScope = websiteScope(input, link.url, link.method), linkKey = websiteRequestKey(link), leadKey = websiteLeadKey(link);
+      if (leads.size < 40 || leads.has(leadKey)) leads.set(leadKey, { ...link, inScope }); else omitted++;
       if (!inScope) { omitted++; continue; }
-      if (endpoints.size < 40 && !endpoints.has(link.url)) endpoints.set(link.url, { id: crypto.createHash("sha256").update(link.url).digest("hex"), url: link.url, method: link.method, parameters: [], observed: false });
-      if (tool !== "web_discover" || link.kind !== "page") continue;
+      if (endpoints.size < 40 && !endpoints.has(linkKey)) endpoints.set(linkKey, { id: crypto.createHash("sha256").update(linkKey).digest("hex"), url: link.url, method: link.method, parameters: [], observed: false });
+      if (tool !== "web_discover" || !["page", "script", "javascript"].includes(link.kind) || !["GET", "HEAD"].includes(link.method)) continue;
       if (/\.(?:css|png|jpe?g|gif|svg|ico|avif|webp|woff2?|ttf|mp4|pdf)(?:\?|$)/i.test(link.url)) continue;
-      if (next.depth < input.maxDepth && queue.length < 40 && !seen.has(link.url)) queue.push({ request: { url: link.url, method: "GET" }, depth: next.depth + 1 });
-      else if (!seen.has(link.url)) omitted++;
+      if (next.depth < input.maxDepth && queue.length < 40 && !seen.has(linkKey)) queue.push({ request: { url: link.url, method: link.method, ...(link.kind === "script" ? { resourceType: "script" } : {}) }, depth: next.depth + 1 });
+      else if (!seen.has(linkKey)) omitted++;
     }
   }
   const value = { pages, endpoints: [...endpoints.values()], leads: [...leads.values()], omitted: omitted + queue.length,
-    coverage: "Bounded HTTP observations and static page/script/form discovery. Linked origins do not grant access. Unvisited leads and authenticated/business workflows remain untested unless separately recorded.", complete: false, verification: "not-independent" };
+    coverage: "Bounded HTTP observations, page/form inputs and literal JavaScript/XHR hints. Hints remain leads until concrete responses are retained. External origins do not grant access; dynamic routes, omitted inputs and unexercised business workflows remain explicit gaps.", complete: false, verification: "not-independent" };
   while (Buffer.byteLength(JSON.stringify(value)) > 16000) {
     if (value.leads.length) value.leads.pop(); else if (value.endpoints.length) value.endpoints.pop(); else value.pages.pop();
     value.omitted++;
@@ -1043,27 +1466,56 @@ async function websiteObserve(tool, input, send) {
   return value;
 }
 
-async function websiteBrowse(input, send) {
+async function websiteBrowse(input, send, retained) {
   const version = require("/opt/mettle-browser/node_modules/playwright/package.json").version;
   if (version !== input.version) throw new Error("browser_version");
-  const { chromium } = require("/opt/mettle-browser/node_modules/playwright");
-  const browser = await chromium.launch({ headless: true, chromiumSandbox: false, timeout: 10000, args: ["--disable-dev-shm-usage"] });
+  const { chromium, errors } = require("/opt/mettle-browser/node_modules/playwright");
+  const browser = retained?.browser || await chromium.launch({ headless: true, chromiumSandbox: false, timeout: 10000, args: ["--disable-dev-shm-usage"] });
   const blocked = [];
-  let failure, requests = 0, pending = Promise.resolve(), accepting = true;
+  const websocketObserver = retained || {};
+  let context, page, routeHandler, consoleHandler, dialogHandler, pageHandler, keep = false;
+  let failure, requests = 0, pending = Promise.resolve(), accepting = true, blockedOmitted = 0;
+  websocketObserver.blockedWebSocket = (url) => {
+    if (blocked.length < 20) blocked.push({ url: url.slice(0, 2048), reason: "websocket" }); else blockedOmitted++;
+  };
   try {
-    const context = await browser.newContext({ serviceWorkers: "block", acceptDownloads: false });
+    const restored = input.persistSession ? await send({ sessionState: "load" }) : undefined;
+    if (retained?.context && (retained.startUrl !== input.url || retained.credentialRevision !== restored?.credentialRevision || retained.stateDigest !== restored?.stateDigest)) throw new Error("browser_page_binding");
+    context = retained?.context || await browser.newContext({ serviceWorkers: "block", acceptDownloads: false, ...(restored ? { storageState: { cookies: restored.state.cookies, origins: restored.state.origins.map(({ sessionStorage, opfs, ...origin }) => origin) } } : {}) });
+    const executionEvents = [];
+    let executionEventsOmitted = 0;
+    const executionEvent = (channel, kind, text, url) => {
+      if (executionEvents.length >= 32) { executionEventsOmitted++; return; }
+      executionEvents.push({ channel, kind: kind.slice(0,32), text: text.slice(0,256), url: url.slice(0,256), truncated: text.length > 256 || url.length > 256 });
+    };
+    consoleHandler = (message) => executionEvent("console", message.type(), message.text(), message.page()?.url() || "");
+    context.on("console", consoleHandler);
+    dialogHandler = (dialog) => {
+      executionEvent("dialog", dialog.type(), dialog.message(), dialog.page()?.url() || "");
+      void dialog.dismiss().catch((error) => { failure = error; });
+    };
+    context.on("dialog", dialogHandler);
+    pageHandler = (event) => executionEvent("error", "pageerror", event.error().message, event.page()?.url() || "");
+    context.on("weberror", pageHandler);
     context.setDefaultTimeout(5000);
-    await context.routeWebSocket("**/*", (socket) => { if (blocked.length < 20) blocked.push({ url: socket.url().slice(0, 2048), reason: "websocket" }); socket.close(); });
-    await context.route("**/*", async (route) => {
+    if (!retained?.context) {
+      await context.routeWebSocket("**/*", (socket) => {
+        websocketObserver.blockedWebSocket?.(socket.url());
+        socket.close();
+      });
+      if (retained) await context.route("**/*", (route) => route.abort());
+    }
+    routeHandler = async (route) => {
       const request = route.request();
       const url = request.url();
       const hints = request.headers();
       if (hints["next-router-prefetch"] === "1" || /(?:^|[\s,;])prefetch(?:$|[\s,;])/.test(hints["sec-purpose"] || hints.purpose || "")) {
-        if (blocked.length < 20) blocked.push({ url: url.slice(0, 2048), reason: "prefetch" });
+        if (blocked.length < 20) blocked.push({ url: url.slice(0, 2048), reason: "prefetch" }); else blockedOmitted++;
         await route.abort(); return;
       }
       if (!accepting || !websiteScope(input, url, request.method()) || ["image", "font", "media"].includes(request.resourceType()) || requests >= 40) {
         if (blocked.length < 20) blocked.push({ url: url.slice(0, 2048), reason: !accepting ? "workflow_complete" : !websiteScope(input, url, request.method()) ? "scope" : requests >= 40 ? "request_limit" : "asset" });
+        else blockedOmitted++;
         await route.abort(); return;
       }
       requests++;
@@ -1072,33 +1524,105 @@ async function websiteBrowse(input, send) {
           if (failure) { await route.abort(); return; }
           const headers = Object.fromEntries(Object.entries(await request.allHeaders()).filter(([name]) => input.requestHeaders.includes(name)));
           const resourceType = request.resourceType();
-          const response = await send({ url, method: request.method(), headers, ...(["script", "stylesheet"].includes(resourceType) ? { resourceType } : {}), ...(request.postData() !== null ? { body: request.postData() } : {}) });
+          const body = request.postDataBuffer();
+          const response = await send({ url, method: request.method(), headers, ...(["script", "stylesheet"].includes(resourceType) ? { resourceType } : {}), ...(body !== null ? { bodyBase64: body.toString("base64") } : {}) });
           const responseHeaders = Object.fromEntries(Object.entries(response.headers).filter(([, value]) => value !== undefined).map(([name, value]) => [name, Array.isArray(value) ? value.join(name === "set-cookie" ? "\n" : ", ") : value]));
           await route.fulfill({ status: response.status, headers: responseHeaders, body: Buffer.from(response.body, "base64") });
         } catch (error) { failure = error; await route.abort().catch(() => {}); }
       });
       pending = work;
       await work;
-    });
-    const page = await context.newPage();
-    await page.goto(input.url, { waitUntil: "domcontentloaded", timeout: 60000 });
-    for (const action of input.actions) {
-      if (action.type === "click") await page.locator(action.selector).click();
-      else if (action.type === "fill") await page.locator(action.selector).fill(action.value);
-      else if (action.type === "waitFor") await page.locator(action.selector).filter({ hasText: action.text }).waitFor({ state: "visible" });
-      else throw new Error("browser_action");
+    };
+    await context.route("**/*", routeHandler);
+    page = retained?.page || await context.newPage();
+    if (restored && !retained?.context) await restoreBrowserPrivateState(page, context, restored.state, input.url);
+    let workflow = { outcome: "completed" }, actions = 0, phase = "navigation";
+    try {
+      if (!retained?.page) await page.goto(input.url, { waitUntil: "domcontentloaded", timeout: 60000 });
+      phase = "action";
+      for (const action of input.actions) {
+        if (action.type === "click") await page.locator(action.selector).click();
+        else if (action.type === "fill") await page.locator(action.selector).fill(action.value);
+        else if (action.type === "waitFor") await page.locator(action.selector).filter({ hasText: action.text }).waitFor({ state: "visible" });
+        else if (action.type === "select") await page.locator(action.selector).selectOption({ label: action.label });
+        else if (action.type === "check") await page.locator(action.selector).setChecked(action.checked);
+        else if (action.type === "press") await page.locator(action.selector).press(action.key);
+        else throw new Error("browser_action");
+        actions++;
+      }
+    } catch (error) {
+      if (!(error instanceof errors.TimeoutError)) throw error;
+      workflow = { outcome: "timed_out", phase, ...(phase === "action" ? { actionIndex: actions } : {}) };
     }
     await pending;
     if (failure) throw failure;
-    const text = await page.locator("body").innerText();
-    const value = { url: page.url(), title: (await page.title()).slice(0, 256), text: text.slice(0, 4096), truncated: text.length > 4096, actions: input.actions.length, blocked,
-      complete: false, coverage: "One isolated browser workflow; blocked resources, omitted assets and all unexercised workflows remain untested. Cookies exist only within this call.", verification: "not-independent" };
+    const observe = { selector: "body", textOffset: 0, controlsOffset: 0, ...input.observe };
+    const snapshot = await page.locator(observe.selector).evaluateAll((regions, offsets) => {
+      const root = regions[0], items = [];
+      const controlSelector = 'input:not([type="hidden"]), button, select, textarea, a[href], [role="button"]';
+      const elements = root ? [...(root.matches(controlSelector) ? [root] : []), ...root.querySelectorAll(controlSelector)] : [];
+      let total = 0;
+      for (const element of elements) {
+        if (!element.getClientRects().length || getComputedStyle(element).visibility === "hidden") continue;
+        const index = total++;
+        if (index < offsets.controlsOffset || items.length >= 20) continue;
+        let selector = element.id ? "#" + CSS.escape(element.id) : "";
+        if (!selector || document.querySelectorAll(selector).length !== 1) {
+          const parts = [];
+          for (let node = element; node; node = node.parentElement) {
+            let index = 1;
+            for (let sibling = node.previousElementSibling; sibling; sibling = sibling.previousElementSibling) if (sibling.localName === node.localName) index++;
+            parts.unshift(CSS.escape(node.localName) + ":nth-of-type(" + index + ")");
+          }
+          selector = parts.join(" > ");
+        }
+        if (selector.length > 256) continue;
+        const label = element.getAttribute("aria-label") || Array.from(element.labels || []).map((label) => label.innerText).join(" ") || element.getAttribute("placeholder") || (element.localName === "input" ? "" : element.innerText) || "";
+        items.push({ index, selector, tag: element.localName, type: (element.getAttribute("type") || "").slice(0, 32), label: label.trim().slice(0, 128), disabled: element.matches(":disabled") || element.getAttribute("aria-disabled") === "true", ...(element.localName === "a" && element.href.length <= 2048 ? { href: element.href } : {}) });
+      }
+      const text = Array.from(root?.innerText || "");
+      return { controls: items, totalControls: total, matchedRegions: regions.length, text: text.slice(offsets.textOffset, offsets.textOffset + 4096).join(""), totalTextChars: text.length };
+    }, observe);
+    const url = page.url();
+    const value = { url: url.slice(0, 2048), title: (await page.title()).slice(0, 256), text: snapshot.text, truncated: snapshot.totalTextChars > observe.textOffset + Array.from(snapshot.text).length || observe.textOffset > 0 || snapshot.matchedRegions !== 1 || url.length > 2048, actions, workflow, controls: snapshot.controls, controlsOmitted: snapshot.totalControls - snapshot.controls.length, blocked, blockedOmitted,
+      observation: { ...observe, matchedRegions: snapshot.matchedRegions, totalTextChars: snapshot.totalTextChars, totalControls: snapshot.totalControls, nextTextOffset: null, nextControlsOffset: null },
+      complete: false, coverage: "One isolated browser workflow and a snapshot of the first matching DOM region. Missing or additional regions and omitted text/controls are not inspected. Offsets refer to this DOM snapshot. Continue a retained page to observe it without replaying actions; a call without page reloads the URL. A timed-out action may have had effects; inspect recorded traffic before deciding whether to retry. Remaining actions were not attempted. " + (input.persistSession ? "The approved identity retains bounded cookies, localStorage, IndexedDB, sessionStorage and OPFS across fresh contexts." : "Storage lasts for this browser page only."), verification: "not-independent" };
     accepting = false;
     await pending;
     if (failure) throw failure;
-    await context.close();
+    const saved = restored ? await send({ sessionState: "save", expectedRevision: restored.revision, state: await captureBrowserPrivateState(page, context, input.target) }) : undefined;
+    if (retained) {
+      Object.assign(retained, { browser, context, page, startUrl: input.url, credentialRevision: restored?.credentialRevision, stateDigest: saved?.stateDigest });
+      value.page = { id: input.page.id, state: input.page.operation === "close" ? "closed" : "retained" };
+      keep = input.page.operation !== "close";
+    } else await context.close();
+    value.blockedOmitted = blockedOmitted;
+    value.executionEvents = executionEvents;
+    value.executionEventsOmitted = executionEventsOmitted;
+    while (Buffer.byteLength(JSON.stringify(value)) > 15936) {
+      if (value.executionEvents.length) { value.executionEvents.pop(); value.executionEventsOmitted++; }
+      else if (value.blocked.length) { value.blocked.pop(); value.blockedOmitted++; }
+      else if (Array.from(value.text).length > 512) { value.text = Array.from(value.text).slice(0, Math.floor(Array.from(value.text).length / 2)).join(""); value.truncated = true; }
+      else if (value.controls.length) { value.controls.pop(); value.controlsOmitted++; }
+      else { value.text = Array.from(value.text).slice(0, Math.floor(Array.from(value.text).length / 2)).join(""); value.truncated = true; }
+    }
+    const textEnd = observe.textOffset + Array.from(value.text).length;
+    value.observation.nextTextOffset = textEnd < snapshot.totalTextChars ? textEnd : null;
+    const controlsEnd = value.controls.length ? value.controls.at(-1).index + 1 : snapshot.totalControls;
+    value.observation.nextControlsOffset = controlsEnd < snapshot.totalControls ? controlsEnd : null;
+    if (retained) value.coverage += " The live page retains DOM and JavaScript state until close, worker loss or expiry. HTTP is denied between commands; no idle-time execution assertion is made.";
     return value;
-  } finally { await browser.close(); }
+  } finally {
+    accepting = false;
+    delete websocketObserver.blockedWebSocket;
+    if (retained && context) {
+      if (routeHandler) await context.unroute("**/*", routeHandler);
+      if (consoleHandler) context.off("console", consoleHandler);
+      if (dialogHandler) context.off("dialog", dialogHandler);
+      if (pageHandler) context.off("weberror", pageHandler);
+    }
+    if (!keep) await browser.close();
+  }
 }
 `;
 
@@ -1110,6 +1634,8 @@ const lines = readline.createInterface({ input: process.stdin, crlfDelay: Infini
 const iterator = lines[Symbol.asyncIterator]();
 ${ACTIVE_PROGRAM}
 ${WEBSITE_PROGRAM}
+${PORT_PROGRAM}
+${BROWSER_PAGE_PROGRAM}
 (async () => {
   if (process.getuid() !== ${SANDBOX_UID}) throw new Error();
   const first = await iterator.next();
@@ -1129,10 +1655,12 @@ ${WEBSITE_PROGRAM}
     return result;
   };
   let value;
-  if (tool === "web_discover" || tool === "web_request") {
+  if (tool === "port_scan") {
+    value = await portScan(input, send);
+  } else if (tool === "web_discover" || tool === "web_request") {
     value = await websiteObserve(tool, input, send);
   } else if (tool === "web_browse") {
-    value = await websiteBrowse(input, send);
+    value = input.page ? await browseRetainedPage(input, send) : await websiteBrowse(input, send);
   } else if (tool === "http_request") {
     const response = await send({ ...input.request, requestId: input.requestId });
     const body = Buffer.from(response.body, "base64").toString("utf8");
@@ -1152,7 +1680,8 @@ ${WEBSITE_PROGRAM}
       await context.route("**/*", async (route) => {
         try {
           const request = route.request();
-          const response = await send({ url: request.url(), method: request.method(), ...(request.postData() !== null ? { body: request.postData() } : {}) });
+          const body = request.postDataBuffer();
+          const response = await send({ url: request.url(), method: request.method(), ...(body !== null ? { bodyBase64: body.toString("base64") } : {}) });
           await route.fulfill({ status: response.status, contentType: response.contentType, body: Buffer.from(response.body, "base64") });
         } catch (error) { failure = error; await route.abort(); }
       });
@@ -1182,6 +1711,327 @@ ${WEBSITE_PROGRAM}
 })().catch(() => { lines.close(); process.stdin.destroy(); process.exitCode = 1; });
 `;
 
+// apps/harness/src/sandbox/environment-program.ts
+var ENVIRONMENT_PROGRAM = String.raw`
+function environmentCheck(input) {
+  const child = require("node:child_process");
+  const checks = [];
+  const missing = [];
+  const run = (binary, args) => child.spawnSync(binary, args, { env: { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: "/tmp", TMPDIR: "/tmp", LC_ALL: "C", PLAYWRIGHT_BROWSERS_PATH: "/opt/mettle-browser/browsers", PYTHONDONTWRITEBYTECODE: "1", JAVA_TOOL_OPTIONS: "-Djava.awt.headless=true -Duser.home=/tmp" }, stdio: ["ignore", "pipe", "pipe"], timeout: 20000, killSignal: "SIGKILL", maxBuffer: 8192, encoding: "utf8", shell: false });
+  if (input.browserVersion) {
+    const script = "(async () => { const p = require('/opt/mettle-browser/node_modules/playwright'); if (require('/opt/mettle-browser/node_modules/playwright/package.json').version !== process.argv[1]) process.exit(2); const browser = await p.chromium.launch({headless:true,chromiumSandbox:false,args:['--disable-dev-shm-usage']}); await browser.close(); process.stdout.write('ready'); })().catch(() => process.exit(1));";
+    const result = run("/usr/local/bin/node", ["-e", script, input.browserVersion]);
+    (result.status === 0 && result.stdout === "ready" ? checks : missing).push("playwright/" + input.browserVersion);
+  }
+  for (const profile of input.scanners) {
+    let result, matched = false;
+    if (profile.tool === "port_scan") {
+      result = run("/usr/local/bin/naabu", ["-version"]);
+      matched = (result.stdout + result.stderr).split(/\s+/).includes(profile.version);
+    } else if (profile.tool === "nuclei_scan") {
+      result = run("/usr/local/bin/nuclei", ["-version"]);
+      matched = (result.stdout + result.stderr).split(/\s+/).includes("v" + profile.version);
+    } else if (profile.tool === "sqli_confirm") {
+      result = run("/usr/bin/python3", ["/opt/mettle/sqlmap/sqlmap.py", "--version"]);
+      matched = String(result.stdout).split("\n")[0].trim() === profile.version + "#stable";
+    } else if (profile.tool === "zap_scan") {
+      result = run("/zap/zap.sh", ["-Xmx768m", "-silent", "-cmd", "-dir", "/tmp/zap-preflight", "-version"]);
+      matched = String(result.stdout).split(/\s+/).includes(profile.version);
+    } else throw new Error("Unsupported admitted prerequisite");
+    (result.status === 0 && !result.error && matched ? checks : missing).push(profile.tool + "/" + profile.version);
+  }
+  return { status: missing.length ? "unavailable" : "ready", checks, missing };
+}
+`;
+
+// apps/harness/src/sandbox/experiment-program.ts
+var EXPERIMENT_PROGRAM = String.raw`
+function experimentRun(args, input) {
+  const path = require("node:path"), child = require("node:child_process");
+  const { policy } = input;
+  if (!policy.runtimes.includes(args.runtime) || !["node", "bash"].includes(args.runtime) || !Number.isInteger(policy.timeoutMs) || policy.timeoutMs < 100 || policy.timeoutMs > 10000 || !Number.isInteger(policy.maxScriptBytes) || policy.maxScriptBytes > 16384) throw new Error("experiment_policy");
+  const hash = (value) => crypto.createHash("sha256").update(value).digest("hex");
+  const run = (program) => {
+    if (typeof program !== "string" || !program.length || program.includes("\0") || Buffer.byteLength(program) > policy.maxScriptBytes) throw new Error("experiment_program");
+    const root = fs.mkdtempSync("/tmp/mettle-experiment-"), workspace = path.join(root, "workspace");
+    try {
+      materializeWorkspace(workspace, input.files);
+      const script = path.join(root, args.runtime === "node" ? "experiment.cjs" : "experiment.bash");
+      fs.writeFileSync(script, program, { flag: "wx", mode: 0o600 });
+      const result = child.spawnSync(args.runtime === "node" ? "/usr/local/bin/node" : "/bin/bash", args.runtime === "node" ? ["--", script] : ["--noprofile", "--norc", "-p", "--", script], {
+        cwd: workspace, env: { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: root, TMPDIR: root, LC_ALL: "C" },
+        stdio: ["ignore", "pipe", "pipe"], timeout: policy.timeoutMs, killSignal: "SIGKILL", maxBuffer: ${TASK_INPUT_LIMIT}, encoding: "utf8", shell: false
+      });
+      const stdout = result.stdout || "", stderr = result.stderr || "", exceeded = result.error?.code === "ENOBUFS";
+      return { scriptSha256: hash(program), status: spawnStatus(result, "completed", exceeded), exitCode: result.status, stdout: stdout.slice(0, ${CHILD_OUTPUT_KEEP}), stderr: stderr.slice(0, ${CHILD_OUTPUT_KEEP}), truncated: exceeded || stdout.length > ${CHILD_OUTPUT_KEEP} || stderr.length > ${CHILD_OUTPUT_KEEP} };
+    } finally { fs.rmSync(root, { recursive: true, force: true }); }
+  };
+  const control = run(args.negativeControl), probe = run(args.program);
+  return { subjectDigest: hash(JSON.stringify(input.subject)), filesDigest: hash(JSON.stringify(input.files)), runtime: args.runtime, control, probe, assertion: "inconclusive", verification: "not-independent" };
+}
+`;
+
+// apps/harness/src/sandbox/joern-program.ts
+var JOERN_QUERY = `
+import io.joern.dataflowengineoss.language.*
+import io.shiftleft.codepropertygraph.generated.nodes.CfgNode
+import io.shiftleft.semanticcpg.language.*
+import java.nio.file.{Files, Paths}
+
+@main def exec(cpgFile: String, traceFile: String, outFile: String): Unit = {
+  val request = ujson.read(Files.readString(Paths.get(traceFile)))
+  val expected = request("files").arr.map(_.str).toSet
+  val workspace = request("workspace").str + "/"
+  def relative(name: String): String = name.stripPrefix(workspace).stripPrefix("./")
+  val version = io.joern.joerncli.console.JoernConsole.version
+  if (version != request("version").str) throw new IllegalArgumentException("version_mismatch")
+  importCpg(cpgFile).getOrElse(throw new IllegalArgumentException("invalid_cpg"))
+  def matches(node: CfgNode, location: ujson.Value): Boolean =
+    relative(node.method.filename) == location("path").str && node.lineNumber.exists(line =>
+      line >= location("startLine").num.toInt && line <= location("endLine").num.toInt)
+  val sources = cpg.all.collect { case node: CfgNode if matches(node, request("source")) => node }.take(129).toList
+  val sinks = cpg.call.filter(node => matches(node, request("sink"))).argument.filter(_.argumentIndex > 0).take(129).toList
+  val parsed = cpg.file.name.map(relative).filter(expected.contains).toSet
+  var omitted = sources.size > 128 || sinks.size > 128
+  val flows = sinks.take(128).iterator.reachableByFlows(sources.take(128)).take(17).toList
+  omitted ||= flows.size > 16
+  val paths = flows.take(16).flatMap { flow =>
+    val located = flow.elements.collect {
+      case node: CfgNode if node.lineNumber.exists(_ > 0) && expected.contains(relative(node.method.filename)) =>
+        (relative(node.method.filename), node.lineNumber.get)
+    }.toList
+    val points = located.distinct
+    if (located.size != flow.elements.size || points.size > 32) omitted = true
+    if (points.size < 2 || points.size > 32) {
+      omitted = true
+      None
+    } else Some(ujson.Arr.from(points.map { case (path, line) => ujson.Obj("path" -> path, "line" -> line) }))
+  }
+  val result = ujson.Obj(
+    "version" -> version,
+    "sourceNodes" -> sources.size,
+    "sinkNodes" -> sinks.size,
+    "parsedFiles" -> ujson.Arr.from(parsed.toList.sorted),
+    "paths" -> ujson.Arr.from(paths),
+    "omitted" -> omitted,
+    "complete" -> (sources.nonEmpty && sinks.nonEmpty && parsed == expected && !omitted)
+  )
+  Files.writeString(Paths.get(outFile), result.toString)
+}
+`;
+var JOERN_PROGRAM = `
+function scanJoern(input, workspace, root) {
+  const path = require("node:path");
+  const child = require("node:child_process");
+  const query = ${JSON.stringify(JOERN_QUERY)};
+  const queryDigest = crypto.createHash("sha256").update(query).digest("hex");
+  const binding = { version: input.version, ruleId: ${JSON.stringify(JOERN_QUERY_ID)}, queryDigest };
+  const incomplete = (status) => ({ ...binding, status, complete: false, sourceNodes: 0, sinkNodes: 0, parsedFiles: [], paths: [], omitted: false });
+  const deadline = Date.now() + ${JOERN_TIMEOUT_MS};
+  const run = (binary, args) => child.spawnSync(binary, args, {
+    cwd: root, env: { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: root, TMPDIR: root, LC_ALL: "C.UTF-8", JAVA_TOOL_OPTIONS: "-Xmx2304m -XX:ActiveProcessorCount=2 -DZstdNativePath=/opt/mettle/joern/native/libzstd-jni.so -Djava.io.tmpdir=" + root + " -Duser.home=" + root, JOERN_HOME: "/opt/mettle/joern" },
+    stdio: ["ignore", "pipe", "pipe"], timeout: Math.max(1, deadline - Date.now()), killSignal: "SIGKILL", maxBuffer: 1048576, encoding: "utf8", shell: false,
+  });
+  const cpg = path.join(root, "cpg.bin");
+  const trace = path.join(root, "trace.json");
+  const script = path.join(root, "query.sc");
+  const report = path.join(root, "report.json");
+  fs.writeFileSync(trace, JSON.stringify({ ...input.trace, version: input.version, workspace, files: input.files.map((file) => file.path) }), { flag: "wx", mode: 0o600 });
+  fs.writeFileSync(script, query, { flag: "wx", mode: 0o600 });
+  const parsed = run("/opt/mettle/joern/frontends/jssrc2cpg/bin/jssrc2cpg", ["-J-Xmx2304m", "-J-XX:ActiveProcessorCount=2", "-Dlog4j.configurationFile=/opt/mettle/joern/conf/log4j2.xml", workspace, "--output", cpg, "--no-tsTypes"]);
+  if (parsed.error || parsed.status !== 0) return incomplete(spawnStatus(parsed));
+  const analyzed = run("/opt/mettle/joern/bin/repl-bridge", ["-J-Xmx2304m", "-J-XX:ActiveProcessorCount=2", "-Dlog4j.configurationFile=/opt/mettle/joern/conf/log4j2.xml", "--script", script, "--param", "cpgFile=" + cpg, "--param", "traceFile=" + trace, "--param", "outFile=" + report]);
+  if (analyzed.error || analyzed.status !== 0) return incomplete(String(analyzed.stdout).includes("version_mismatch") ? "version_mismatch" : spawnStatus(analyzed));
+  try {
+    if (fs.statSync(report).size > 24576) return incomplete("output_limit");
+    return { ...binding, ...JSON.parse(fs.readFileSync(report, "utf8")), status: "completed" };
+  } catch { return incomplete("failed"); }
+}
+`;
+
+// apps/harness/src/storage/package-probe.ts
+var PACKAGE_IMPORT_TIMEOUT_MS = 3000;
+var PACKAGE_CHANGE_LIMIT = 128;
+function packageJavaScript(path) {
+  return /\.[cm]?js$/.test(path);
+}
+var PackageImportObservationSchema = strictObject({
+  status: _enum([
+    "loaded",
+    "load_failed",
+    "timed_out",
+    "output_limit",
+    "unavailable",
+    "failed"
+  ]),
+  changes: array(strictObject({
+    target: string().min(1).max(64),
+    key: string().max(256),
+    kind: _enum(["added", "removed", "changed"]),
+    enumerable: boolean().nullable()
+  })).max(PACKAGE_CHANGE_LIMIT),
+  error: string().max(1024).nullable(),
+  truncated: boolean(),
+  stdout: string().max(4096),
+  stderr: string().max(4096)
+});
+var PackageImportResultSchema = PackageImportObservationSchema.extend({
+  repository: string().min(1).max(256),
+  revision: CommitSchema,
+  path: RepositoryPathSchema,
+  verification: literal("not-independent"),
+  complete: boolean()
+}).refine((value) => value.complete === (value.status === "loaded" && !value.truncated), { message: "Only an untruncated loaded import has complete observations." });
+
+// apps/harness/src/sandbox/package-program.ts
+var PACKAGE_IMPORT_PROGRAM = `
+const fs = require("node:fs");
+const { pathToFileURL } = require("node:url");
+const { isMainThread, Worker, MessageChannel, receiveMessageOnPort, parentPort, workerData } = require("node:worker_threads");
+if (isMainThread) {
+  const { port1, port2 } = new MessageChannel();
+  const worker = new Worker(__filename, { workerData: { path: process.argv[2], port: port2 }, transferList: [port2] });
+  let error = "The import worker did not return a complete observation.";
+  worker.on("error", cause => { error = String(cause).slice(0, 1024); });
+  worker.on("exit", code => {
+    const before = receiveMessageOnPort(port1)?.message;
+    const after = receiveMessageOnPort(port1)?.message;
+    port1.close();
+    const changes = [];
+    let truncated = false;
+    if (code !== 0 || !before || !after) {
+      fs.writeFileSync(3, JSON.stringify({ status: "failed", changes, error, truncated }));
+      process.exit(0);
+    }
+    for (let i = 0; i < before.length; i++) {
+      const [name, entries] = before[i];
+      const previous = new Map(entries.map(entry => [entry[0], entry]));
+      const current = new Map(after.targets[i][1].map(entry => [entry[0], entry]));
+      for (const key of new Set([...current.keys(), ...previous.keys()])) {
+        const old = previous.get(key), next = current.get(key);
+        if (old && next && old[2].every((value, index) => Object.is(value, next[2][index]))) continue;
+        if (changes.length === ${PACKAGE_CHANGE_LIMIT}) { truncated = true; continue; }
+        changes.push({ target: name, key: (next || old)[1], kind: !old ? "added" : !next ? "removed" : "changed", enumerable: next?.[3] ?? null });
+      }
+    }
+    fs.writeFileSync(3, JSON.stringify({ status: after.status, changes, error: after.error, truncated }));
+    process.exit(0);
+  });
+} else {
+const { path, port } = workerData;
+delete workerData.port;
+parentPort.close();
+const post = port.postMessage.bind(port);
+const ownKeys = Reflect.ownKeys;
+const descriptor = Object.getOwnPropertyDescriptor;
+const same = Object.is;
+const string = String;
+const slice = Function.call.bind(String.prototype.slice);
+const append = Function.call.bind(Array.prototype.push);
+const get = Function.call.bind(Map.prototype.get);
+const set = Function.call.bind(Map.prototype.set);
+const exit = process.exit.bind(process);
+const identities = new Map();
+let nextIdentity = 1;
+function identity(value) {
+  if (same(value, -0)) return 0;
+  let id = get(identities, value);
+  if (id === undefined) { id = nextIdentity++; set(identities, value, id); }
+  return id;
+}
+const targets = [
+  ["globalThis", globalThis], ["Object.prototype", Object.prototype],
+  ["Array.prototype", Array.prototype], ["Function.prototype", Function.prototype],
+  ["String.prototype", String.prototype], ["Number.prototype", Number.prototype],
+  ["Boolean.prototype", Boolean.prototype], ["Promise.prototype", Promise.prototype],
+  ["Map.prototype", Map.prototype], ["Set.prototype", Set.prototype],
+  ["RegExp.prototype", RegExp.prototype], ["Date.prototype", Date.prototype]
+];
+function snapshot() {
+  const result = [];
+  for (let i = 0; i < targets.length; i++) {
+    const [name, target] = targets[i];
+    const keys = ownKeys(target), entries = [];
+    for (let j = 0; j < keys.length; j++) {
+      const key = keys[j], value = descriptor(target, key);
+      append(entries, [identity(key), slice(string(key), 0, 256), [identity(value.value), identity(value.get), identity(value.set), value.writable, value.enumerable, value.configurable], value.enumerable]);
+    }
+    append(result, [name, entries]);
+  }
+  return result;
+}
+for (const key of ownKeys(globalThis)) descriptor(globalThis, key);
+post(snapshot());
+(async () => {
+  let status = "loaded", error = null;
+  try { await import(pathToFileURL(path).href); }
+  catch (cause) { status = "load_failed"; error = slice(string(cause), 0, 1024); }
+  post({ status, error, targets: snapshot() });
+  exit(0);
+})().catch(() => exit(1));
+}
+`;
+var PACKAGE_PROBE_PROGRAM = String.raw`
+function packageImportProbe(input, args, workspace, root) {
+  const child = require("node:child_process");
+  const path = require("node:path");
+  if (args.path !== input.path || !input.files.some(file => file.path === args.path) || !/\.[cm]?js$/.test(args.path)) throw new Error();
+  const script = path.join(root, "import-probe.cjs");
+  fs.writeFileSync(script, ${JSON.stringify(PACKAGE_IMPORT_PROGRAM)}, { flag: "wx", mode: 0o600 });
+  const result = child.spawnSync("/usr/local/bin/node", ["--max-old-space-size=128", script, path.join(workspace, args.path)], {
+    cwd: workspace, env: { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: root, TMPDIR: root },
+    timeout: ${PACKAGE_IMPORT_TIMEOUT_MS}, killSignal: "SIGKILL", maxBuffer: ${TASK_INPUT_LIMIT},
+    stdio: ["ignore", "pipe", "pipe", "pipe"], encoding: "utf8", shell: false
+  });
+  let value = { status: spawnStatus(result), changes: [], error: null, truncated: false };
+  if (value.status === "completed") {
+    try { value = JSON.parse(result.output[3]); }
+    catch { value.status = "failed"; value.error = "The import probe did not return a complete observation."; }
+  }
+  const stdout = result.stdout || "", stderr = result.stderr || "";
+  const observation = { ...value, stdout: stdout.slice(0, ${CHILD_OUTPUT_KEEP}), stderr: stderr.slice(0, ${CHILD_OUTPUT_KEEP}),
+    truncated: value.truncated || stdout.length > ${CHILD_OUTPUT_KEEP} || stderr.length > ${CHILD_OUTPUT_KEEP} || result.error?.code === "ENOBUFS" };
+  return Buffer.byteLength(JSON.stringify(observation)) > ${TASK_RESULT_LIMIT - 1024}
+    ? { status: "output_limit", changes: [], error: "The import observation exceeded the task evidence limit.", truncated: true, stdout: "", stderr: "" }
+    : observation;
+}
+`;
+
+// apps/harness/src/sandbox/report-program.ts
+var PDF_BROWSER_PROGRAM = `
+(async () => {
+  const fs = require("node:fs");
+  const crypto = require("node:crypto");
+  const input = JSON.parse(fs.readFileSync(0, "utf8"));
+  if (require("/opt/mettle-browser/node_modules/playwright/package.json").version !== input.version) throw new Error();
+  const { chromium } = require("/opt/mettle-browser/node_modules/playwright");
+  const browser = await chromium.launch({ headless: true, chromiumSandbox: false, timeout: 10000, args: ["--disable-dev-shm-usage"] });
+  try {
+    const context = await browser.newContext({ javaScriptEnabled: false, serviceWorkers: "block", acceptDownloads: false });
+    let blockedRequests = 0;
+    await context.route("**/*", async route => { blockedRequests++; await route.abort(); });
+    await context.routeWebSocket("**/*", socket => socket.close());
+    const page = await context.newPage();
+    await page.setContent(input.html, { waitUntil: "load", timeout: 10000 });
+    const body = await page.pdf({ format: "A4", printBackground: true, preferCSSPageSize: true, tagged: true, displayHeaderFooter: true, headerTemplate: "<span></span>", footerTemplate: '<div style="font-size:9px;width:100%;text-align:center">Mettle - <span class="pageNumber"></span> / <span class="totalPages"></span></div>', timeout: 10000 });
+    if (body.length > ${PDF_BYTES_LIMIT} || body.subarray(0, 5).toString() !== "%PDF-") throw new Error();
+    process.stdout.write(JSON.stringify({ content: body.toString("base64"), sha256: crypto.createHash("sha256").update(body).digest("hex"), htmlDigest: crypto.createHash("sha256").update(input.html).digest("hex"), blockedRequests }));
+    await context.close();
+  } finally { await browser.close(); }
+})().catch(() => { process.exitCode = 1; });
+`;
+var REPORT_PROGRAM = `
+function reportPdf(input) {
+  if (typeof input.html !== "string" || Buffer.byteLength(input.html) > ${PDF_BYTES_LIMIT} || input.version !== ${JSON.stringify(PLAYWRIGHT_VERSION)}) throw new Error();
+  const result = require("node:child_process").spawnSync("/usr/local/bin/node", ["-e", ${JSON.stringify(PDF_BROWSER_PROGRAM)}], {
+    input: JSON.stringify(input), encoding: "utf8", shell: false, timeout: 25000, killSignal: "SIGKILL", maxBuffer: ${PDF_RESULT_LIMIT},
+    env: { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: "/tmp", TMPDIR: "/tmp", PLAYWRIGHT_BROWSERS_PATH: "/opt/mettle-browser/browsers" }, stdio: ["pipe", "pipe", "pipe"]
+  });
+  if (result.status !== 0 || result.error) throw new Error();
+  return JSON.parse(result.stdout);
+}
+`;
+
 // apps/harness/src/sandbox/scanner-program.ts
 var SPAWN_STATUS_PROGRAM = `
 function spawnStatus(result, success = "completed", exceeded = false) {
@@ -1273,19 +2123,46 @@ function scanSource(tool, input, workspace, root) {
 }
 `;
 
+// apps/harness/src/sandbox/workspace-program.ts
+var WORKSPACE_PROGRAM = String.raw`
+function materializeWorkspace(workspace, files) {
+  const path = require("node:path");
+  fs.mkdirSync(workspace, { recursive: true });
+  for (const file of files) {
+    if (!file.path || file.path.startsWith("/") || file.path.includes("\\") || file.path.split("/").some((part) => !part || part === "." || part === "..")) throw new Error("workspace_path");
+    const destination = path.join(workspace, file.path);
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
+    fs.writeFileSync(destination, file.content, { flag: "wx", mode: 0o600 });
+  }
+}
+`;
+
 // apps/harness/src/sandbox/task-program.ts
 var TASK_PROGRAM = String.raw`
 const fs = require("node:fs");
 const crypto = require("node:crypto");
 ${SPAWN_STATUS_PROGRAM}
+${WORKSPACE_PROGRAM}
+${EXPERIMENT_PROGRAM}
 ${SOURCE_SCANNER_PROGRAM}
+${JOERN_PROGRAM}
+${ENVIRONMENT_PROGRAM}
+${REPORT_PROGRAM}
+${PACKAGE_PROBE_PROGRAM}
 try {
   const bytes = fs.readFileSync(0);
-  if (bytes.length > ${TASK_INPUT_LIMIT} || process.getuid() !== ${SANDBOX_UID}) throw new Error();
+  if (bytes.length > ${TASK_INPUT_MAX} || process.getuid() !== ${SANDBOX_UID}) throw new Error();
   const request = JSON.parse(bytes.toString("utf8"));
   const { tool, args, input } = request;
+  if (bytes.length > (${JSON.stringify(TASK_INPUT_LIMITS)}[tool] ?? ${TASK_INPUT_LIMIT})) throw new Error();
   let value;
-  if (tool === "web_capture_read") {
+  if (tool === "environment_check") {
+    value = environmentCheck(input);
+  } else if (tool === "experiment_run") {
+    value = experimentRun(args, input);
+  } else if (tool === "report_pdf") {
+    value = reportPdf(input);
+  } else if (tool === "web_capture_read") {
     if (args.id !== input.capture.id) throw new Error();
     value = { ...input.capture, provenance: "operator-supplied-unverified" };
   } else if (tool === "web_capture_compare") {
@@ -1299,19 +2176,17 @@ try {
     };
   } else if (tool === "change_inspect") {
     value = input;
-  } else if (["test_run", "semgrep_scan", "bash_run", "secret_scan", "dependency_scan"].includes(tool)) {
+  } else if (["test_run", "package_import_probe", "semgrep_scan", "bash_run", "secret_scan", "dependency_scan", "joern_confirm"].includes(tool)) {
     const path = require("node:path");
     const child = require("node:child_process");
     const root = fs.mkdtempSync("/tmp/mettle-task-");
     const workspace = path.join(root, "workspace");
-    fs.mkdirSync(workspace, { recursive: true });
-    for (const file of input.files) {
-      if (!file.path || file.path.startsWith("/") || file.path.includes("\\") || file.path.split("/").some((part) => !part || part === "." || part === "..")) throw new Error();
-      const destination = path.join(workspace, file.path);
-      fs.mkdirSync(path.dirname(destination), { recursive: true });
-      fs.writeFileSync(destination, file.content, { flag: "wx", mode: 0o600 });
-    }
-    if (tool === "secret_scan" || tool === "dependency_scan") {
+    materializeWorkspace(workspace, input.files);
+    if (tool === "package_import_probe") {
+      value = packageImportProbe(input, args, workspace, root);
+    } else if (tool === "joern_confirm") {
+      value = scanJoern(input, workspace, root);
+    } else if (tool === "secret_scan" || tool === "dependency_scan") {
       value = scanSource(tool, input, workspace, root);
     } else if (tool === "bash_run") {
       const profile = input.profile;
@@ -1401,24 +2276,32 @@ try {
     }
   } else throw new Error();
   const result = JSON.stringify({ inputDigest: crypto.createHash("sha256").update(bytes).digest("hex"), value });
-  if (Buffer.byteLength(result) > ${TASK_RESULT_LIMIT}) throw new Error();
+  if (Buffer.byteLength(result) > (tool === "report_pdf" ? ${PDF_RESULT_LIMIT} : ${TASK_RESULT_LIMIT})) throw new Error();
   fs.writeFileSync(1, result);
 } catch { process.exitCode = 1; }
 `;
 
 // apps/harness/src/sandbox/tasks.ts
-var SandboxReceiptSchema = strictObject({
+var sandboxReceipt = strictObject({
   runtime: SandboxRuntimeSchema,
   image: string(),
   policyDigest: string(),
   inputDigest: string(),
   cleanupVerified: literal(true)
 });
+var SandboxReceiptSchema = union([
+  sandboxReceipt,
+  sandboxReceipt.extend({
+    cleanupVerified: literal(false),
+    retainedPageId: uuid()
+  })
+]);
 function isolatedTask(tool, args, input, session) {
   TaskNameSchema.parse(tool);
   const bytes = Buffer.from(canonicalJson({ tool, args, input }), "utf8");
-  if (bytes.length > TASK_INPUT_LIMIT)
-    throw new HarnessError("sandbox_input_limit", "The isolated task exceeds its one-MiB input limit.");
+  const limit = TASK_INPUT_LIMITS[tool] ?? TASK_INPUT_LIMIT;
+  if (bytes.length > limit)
+    throw new HarnessError("sandbox_input_limit", `The isolated ${tool} task exceeds its ${limit}-byte input limit.`);
   return {
     tool,
     args,
@@ -1428,9 +2311,23 @@ function isolatedTask(tool, args, input, session) {
   };
 }
 function taskProfile(tool) {
-  return ["browser_workflow", "web_browse", "zap_scan"].includes(tool) ? "browser" : "tools";
+  if (tool === "joern_confirm")
+    return "analysis";
+  return [
+    "browser_workflow",
+    "web_browse",
+    "zap_scan",
+    "environment_check",
+    "report_pdf"
+  ].includes(tool) ? "browser" : "tools";
 }
 function taskTimeoutMs(tool) {
+  if (tool === "joern_confirm")
+    return JOERN_TASK_TIMEOUT_MS;
+  if (tool === "port_scan")
+    return PORT_SCAN_TASK_TIMEOUT_MS;
+  if (tool === "environment_check")
+    return 90000;
   if (["web_discover", "web_browse"].includes(tool))
     return ACTIVE_SCAN_TASK_TIMEOUT_MS;
   if (ACTIVE_SCAN_TOOLS.some((name) => name === tool))
@@ -1439,11 +2336,14 @@ function taskTimeoutMs(tool) {
     return SOURCE_SCANNER_TASK_TIMEOUT_MS;
   return tool === "semgrep_scan" ? SEMGREP_TASK_TIMEOUT_MS : TASK_TIMEOUT_MS;
 }
-function taskSpec(image, labels, profile, runtime) {
+function taskResultLimit(tool) {
+  return tool === "report_pdf" ? PDF_RESULT_LIMIT : TASK_RESULT_LIMIT;
+}
+function taskSpec(image, labels, profile, runtime, retained = false) {
   return {
     ...launchSpec(image, "", labels, profile, runtime),
     Entrypoint: ["/bin/sleep"],
-    Cmd: [String(TASK_CONTAINER_LIFETIME_S)]
+    Cmd: [String(retained ? 600 : TASK_CONTAINER_LIFETIME_S)]
   };
 }
 function taskExecSpec(live, runtime) {
@@ -1470,7 +2370,8 @@ function taskRuntimeDigest(image, runtime) {
   return digest({
     specs: {
       tools: taskSpec(image, {}, "tools", runtime),
-      browser: taskSpec(image, {}, "browser", runtime)
+      browser: taskSpec(image, {}, "browser", runtime),
+      analysis: taskSpec(image, {}, "analysis", runtime)
     },
     exec: taskExecSpec(false, runtime),
     liveExec: taskExecSpec(true, runtime),
@@ -1481,7 +2382,7 @@ function taskPolicyDigest(image, task, runtime) {
   const profile = taskProfile(task.tool);
   return digest({
     profile,
-    spec: taskSpec(image, {}, profile, runtime),
+    spec: taskSpec(image, {}, profile, runtime, Boolean(task.session?.page)),
     exec: taskExecSpec(isLiveTask(task.tool), runtime),
     tool: task.tool,
     inputDigest: task.inputDigest,
@@ -1490,6 +2391,7 @@ function taskPolicyDigest(image, task, runtime) {
 }
 function isLiveTask(tool) {
   return [
+    "port_scan",
     "http_request",
     "web_discover",
     "web_request",
@@ -1510,21 +2412,25 @@ async function checkSandbox(config, engine) {
   if (selected === "runc" && (!Array.isArray(info.SecurityOptions) || !info.SecurityOptions.some((option) => typeof option === "string" && option.split(",").includes("name=seccomp"))))
     throw new HarnessError("sandbox_unavailable", "Local Docker requires kernel seccomp support and the explicit builtin profile.");
   const image = dockerJson(await engine.call("GET", `/images/${encodeURIComponent(config.image)}/json`));
-  if (!Array.isArray(image?.RepoDigests) || !image.RepoDigests.includes(config.image) || Object.keys(image.Config?.Volumes ?? {}).length !== 0)
+  if ((config.image.startsWith("sha256:") ? image?.Id !== config.image : !Array.isArray(image?.RepoDigests) || !image.RepoDigests.includes(config.image)) || Object.keys(image.Config?.Volumes ?? {}).length !== 0)
     throw new HarnessError("sandbox_image", "Preload the approved digest-pinned probe image without declared volumes.");
   return info.ID;
 }
 async function sandboxFromEnvironment(chat, environment = process.env) {
   if (!environment.HARNESS_SANDBOX_IMAGE) {
-    if (environment.HARNESS_SANDBOX_RUNTIME !== undefined)
-      throw new HarnessError("sandbox_config", "An explicit sandbox runtime requires HARNESS_SANDBOX_IMAGE.");
+    if (environment.HARNESS_SANDBOX_RUNTIME !== undefined || environment.HARNESS_SANDBOX_ENGINE_ID !== undefined || environment.HARNESS_SANDBOX_LOCATION !== undefined)
+      throw new HarnessError("sandbox_config", "Explicit sandbox settings require HARNESS_SANDBOX_IMAGE.");
     return;
   }
   if (!chat)
     throw new HarnessError("sandbox_config", "HARNESS_SANDBOX_IMAGE requires HARNESS_CHAT=1.");
   const config = sandboxConfig(environment);
-  await checkSandbox(config, new DockerEngine(config.socket));
-  return config;
+  const engineId = await checkSandbox(config, new DockerEngine(config.socket));
+  return Object.freeze({
+    ...config,
+    engineId,
+    location: config.location ?? "local"
+  });
 }
 var CONTAINMENT_FINDINGS = new Set([
   "sandbox_policy",
@@ -1542,7 +2448,7 @@ function cancelled(error) {
 function jobSpec(record2, job, runtime) {
   const labels = sandboxLabels(record2);
   if (job?.kind === "task")
-    return taskSpec(record2.image, labels, taskProfile(job.task.tool), runtime);
+    return taskSpec(record2.image, labels, taskProfile(job.task.tool), runtime, Boolean(job.task.session?.page));
   if (job?.kind === "shell")
     return shellSpec(record2.image, job.command, labels, runtime);
   return launchSpec(record2.image, probeScript(runtime), labels, "probe", runtime);
@@ -1730,7 +2636,11 @@ class SandboxWorker {
     const workerId = await checkSandbox(this.config, this.engine);
     if (signal.aborted)
       throw new HarnessError("stop_requested", "Sandbox execution was stopped before allocation.");
-    const record2 = await this.journal.reserve(callId, workerId, this.config.image, task ? taskPolicyDigest(this.config.image, task, this.runtime) : job?.kind === "shell" ? shellPolicyDigest(this.config.image, job.command, this.runtime) : probePolicyDigest(this.config.image, this.runtime), task ? { tool: task.tool, args: task.args } : job?.kind === "shell" ? { tool: SHELL_TOOL, args: { command: job.command } } : undefined);
+    const page = task?.tool === "web_browse" ? task.session?.page : undefined;
+    if (page && (!this.journal.acquirePage || !this.journal.releasePage))
+      throw new HarnessError("browser_page_denied", "Retained pages require durable lifecycle support.");
+    const reused = page && page.operation !== "open";
+    const record2 = reused ? await this.journal.acquirePage(callId, task.args, page) : await this.journal.reserve(callId, workerId, this.config.image, task ? taskPolicyDigest(this.config.image, task, this.runtime) : job?.kind === "shell" ? shellPolicyDigest(this.config.image, job.command, this.runtime) : probePolicyDigest(this.config.image, this.runtime), task ? { tool: task.tool, args: task.args } : job?.kind === "shell" ? { tool: SHELL_TOOL, args: { command: job.command } } : undefined, page);
     const deadline = AbortSignal.timeout(task ? taskTimeoutMs(task.tool) : PROBE_TIMEOUT_MS);
     const bounded = AbortSignal.any([signal, deadline]);
     let primary;
@@ -1738,23 +2648,27 @@ class SandboxWorker {
     let exitCode = null;
     let output = Buffer.alloc(0);
     try {
-      await this.journal.provision(record2, async () => {
-        const created = dockerCreated(await this.engine.call("POST", `/containers/create?name=${record2.name}`, jobSpec(record2, job, this.runtime), bounded, ENGINE_LAUNCH_TIMEOUT_MS));
-        if (!/^[a-f0-9]{64}$/.test(created?.Id ?? ""))
-          throw new HarnessError("sandbox_protocol", "Container creation did not return a valid identity.");
-        return created.Id;
-      });
+      if (!reused)
+        await this.journal.provision(record2, async () => {
+          const created = dockerCreated(await this.engine.call("POST", `/containers/create?name=${record2.name}`, jobSpec(record2, job, this.runtime), bounded, ENGINE_LAUNCH_TIMEOUT_MS));
+          if (!/^[a-f0-9]{64}$/.test(created?.Id ?? ""))
+            throw new HarnessError("sandbox_protocol", "Container creation did not return a valid identity.");
+          return created.Id;
+        });
       const container = await this.inspect(record2);
       if (!container)
         throw new HarnessError("sandbox_missing", "The created sandbox disappeared before execution.");
+      if (record2.workerId !== workerId || record2.image !== this.config.image)
+        throw new HarnessError("sandbox_identity", "The retained page belongs to a different engine or image.");
       this.assertPolicy(container, record2, job);
-      await this.journal.start(record2, async () => {
-        if (bounded.aborted)
-          throw new HarnessError("stop_requested", "Sandbox dispatch was cancelled.");
-        dockerStatus(await this.engine.call("POST", `/containers/${record2.containerId}/start`, undefined, bounded, ENGINE_LAUNCH_TIMEOUT_MS), 204);
-      });
+      if (!reused)
+        await this.journal.start(record2, async () => {
+          if (bounded.aborted)
+            throw new HarnessError("stop_requested", "Sandbox dispatch was cancelled.");
+          dockerStatus(await this.engine.call("POST", `/containers/${record2.containerId}/start`, undefined, bounded, ENGINE_LAUNCH_TIMEOUT_MS), 204);
+        });
       if (task)
-        value = await this.runIsolated(record2, task, bounded);
+        value = await this.runIsolated(record2, task, bounded, callId);
       else {
         const exit = await this.engine.call("POST", `/containers/${record2.containerId}/wait?condition=not-running`, undefined, bounded, PROBE_TIMEOUT_MS).then((response) => dockerJson(response), (error) => {
           if (shell && deadline.aborted && !signal.aborted && cancelled(error))
@@ -1779,8 +2693,16 @@ class SandboxWorker {
     } catch (error) {
       primary = containmentFinding(error) ? error : signal.aborted ? new HarnessError("stop_requested", "Sandbox execution was cancelled; no result is invented.") : deadline.aborted && cancelled(error) ? new HarnessError("sandbox_timeout", "The sandbox exceeded its wall deadline.") : error;
     }
+    const retained = Boolean(page && page.operation !== "close" && primary === undefined);
     try {
-      if (primary instanceof HarnessError && primary.code === "sandbox_rejected" && !record2.containerId)
+      if (retained) {
+        try {
+          await this.journal.releasePage(record2, callId);
+        } catch (error) {
+          await this.cleanup(record2, workerId);
+          throw error;
+        }
+      } else if (primary instanceof HarnessError && primary.code === "sandbox_rejected" && !record2.containerId)
         await this.journal.removed(record2);
       else
         await this.cleanup(record2, workerId);
@@ -1798,7 +2720,8 @@ class SandboxWorker {
           image: record2.image,
           policyDigest: record2.policyDigest,
           inputDigest: task.inputDigest,
-          cleanupVerified: true
+          cleanupVerified: !retained,
+          ...retained ? { retainedPageId: page.id } : {}
         }
       };
     if (job?.kind === "shell") {
@@ -1821,7 +2744,7 @@ class SandboxWorker {
       cleanupVerified: true
     };
   }
-  async runIsolated(record2, task, signal) {
+  async runIsolated(record2, task, signal, callId) {
     const live = isLiveTask(task.tool);
     if (live && !this.createBroker)
       throw new HarnessError("web_denied", "Live tasks require the operator-approved broker; no network fallback is allowed.");
@@ -1829,12 +2752,12 @@ class SandboxWorker {
     const created = dockerJson(await this.engine.call("POST", `/containers/${record2.containerId}/exec`, spec, signal), 201);
     if (!/^[a-f0-9]{64}$/.test(created?.Id ?? ""))
       throw new HarnessError("sandbox_protocol", "The engine did not return an isolated exec identity.");
-    const inspect = () => this.engine.call("GET", `/exec/${created.Id}/json`, undefined, signal).then((response) => dockerJson(response));
+    const inspect = () => this.engine.call("GET", `/exec/${created.Id}/json`, undefined, signal, undefined, Math.max(65536, Buffer.byteLength(canonicalJson(spec)) * 2 + 8192)).then((response) => dockerJson(response));
     const initial = await inspect();
     if (initial.ID !== created.Id || initial.ContainerID !== record2.containerId || initial.Running !== false || initial.OpenStdin !== true || initial.OpenStdout !== true || initial.OpenStderr !== true || initial.ProcessConfig?.privileged !== false || initial.ProcessConfig?.tty !== false || initial.ProcessConfig?.user !== spec.User || initial.ProcessConfig?.entrypoint !== spec.Cmd[0] || canonicalJson(initial.ProcessConfig?.arguments) !== canonicalJson(spec.Cmd.slice(1)))
       throw new HarnessError("sandbox_policy", "The engine did not retain the fixed isolated task command.");
     await this.journal.assertTaskRunning(record2);
-    const broker = live ? await this.createBroker(task, signal, record2.callId) : undefined;
+    const broker = live ? await this.createBroker(task, signal, callId) : undefined;
     let refusal;
     const exchange = broker ? async (request) => {
       try {
@@ -1848,21 +2771,26 @@ class SandboxWorker {
       }
     } : undefined;
     await this.journal.assertTaskRunning(record2);
-    const session = await this.engine.startExec(created.Id, task.input, signal, taskTimeoutMs(task.tool), exchange);
+    let failed = true;
     try {
-      return await this.collectIsolated(record2, task, created.Id, session, inspect, signal, broker);
+      const session = await this.engine.startExec(created.Id, task.input, signal, taskTimeoutMs(task.tool), exchange, Math.max(65536, taskResultLimit(task.tool) + 16384));
+      const result = await this.collectIsolated(record2, task, created.Id, session, inspect, signal, broker);
+      failed = false;
+      return result;
     } catch (error) {
       if (broker?.inFlight())
         throw new HarnessError("web_uncertain", "A live request was in flight when the task failed; inspect the journal before any retry.");
       if (refusal !== undefined)
         throw refusal;
       throw error;
+    } finally {
+      await broker?.close?.(failed);
     }
   }
   async collectIsolated(record2, task, execId, session, inspect, signal, broker) {
     const created = { Id: execId };
     const output = dockerLogs(await session.result);
-    if (Buffer.byteLength(output) > TASK_RESULT_LIMIT)
+    if (Buffer.byteLength(output) > taskResultLimit(task.tool))
       throw new HarnessError("sandbox_output_limit", "The isolated result exceeds its size limit.");
     while (true) {
       const status = await inspect();
@@ -1887,4 +2815,4 @@ class SandboxWorker {
   }
 }
 
-export { COMMIT_HEX, CommitSchema, IdSchema, RepositoryPathSchema, RepositoryConfigSchema, hasRepositorySource, RepositoryTestProfileSchema, BashProfilesSchema, SemgrepProfileSchema, WebCaptureSchema, PermissionPolicySchema, GVISOR_RUNTIME, SandboxConfigSchema, sandboxRuntime, sandboxAllowsExecution, SCANNER_CAPABILITIES, SUBJECT_CAPABILITIES, PROBE_TOOL, SHELL_TOOL, SANDBOX_TOOLS, counted, ran, scanned, ToolRegistry, HTTP_HEADER_LIMIT, HTTP_RESPONSE_LIMIT, WEBSITE_RESPONSE_LIMIT, withinHttpScope, SecretScanProfileSchema, DependencyScanProfileSchema, SCANNER_FINDINGS_MAX, ScannerStatusSchema, REPO_SEARCH_FILES, REPO_SEARCH_MATCHES, REPO_EXCERPT, DockerEngine, dockerJson, sandboxConfig, ACTIVE_SCAN_TASK_TIMEOUT_MS, ACTIVE_SCAN_TOOLS, ActiveScannersSchema, scannerEndpoint, validateActiveScanners, SCANNER_REQUEST_STRIP_HEADERS, scannerRequestAllowed, sqlmapCandidate, SandboxReceiptSchema, taskRuntimeDigest, checkSandbox, sandboxFromEnvironment, SandboxWorker };
+export { counted, ran, scanned, ToolRegistry, JOERN_QUERY_ID, JoernProfileSchema, joernCandidate, EcosystemSchema, MAX_DATABASE_BYTES, SecretScanProfileSchema, DependencyScanProfileSchema, SOURCE_SCANNER_LABEL, ScannerImageProfilesSchema, SCANNER_FINDINGS_MAX, ScannerStatusSchema, PDF_BYTES_LIMIT, PDF_RESULT_LIMIT, REPO_SEARCH_FILES, REPO_SEARCH_MATCHES, REPO_EXCERPT, DockerEngine, dockerJson, sandboxConfig, ACTIVE_SCAN_TASK_TIMEOUT_MS, ACTIVE_SCAN_TOOLS, ActiveScannersSchema, scannerEndpoint, validateActiveScanners, SCANNER_REQUEST_STRIP_HEADERS, scannerRequestAllowed, sqlmapCandidate, PORT_CONNECT_TIMEOUT_MS, PORT_SCAN_TASK_TIMEOUT_MS, PortScanProfileSchema, PortOutcomeSchema, portDestination, JOERN_QUERY, packageJavaScript, PackageImportObservationSchema, PackageImportResultSchema, SandboxReceiptSchema, taskRuntimeDigest, checkSandbox, sandboxFromEnvironment, SandboxWorker };