@mettlelabs/mettle 0.0.0-beta.1 → 0.0.0-beta.1-linux-x64

package/harness/chunk-xqyc4ca2.mjs

@@ -0,0 +1,1890 @@
+import {
+  HarnessError,
+  canonicalJson,
+  sha256,
+  digest,
+  ROUTE_CAPABILITIES
+} from "./chunk-2gt4cy7x.mjs";
+import {
+  exports_iso
+} from "./chunk-b71gpkxg.mjs";
+import {
+  string,
+  url,
+  number,
+  boolean,
+  unknown,
+  array,
+  object,
+  strictObject,
+  looseObject,
+  discriminatedUnion,
+  record,
+  _enum,
+  literal
+} from "./chunk-1sygmp11.mjs";
+
+// apps/harness/src/storage/observations.ts
+var CHILD_TIMEOUT_MAX_MS = 20000;
+var COMMIT_HEX = "[a-f0-9]{40}(?:[a-f0-9]{24})?";
+var CommitSchema = string().regex(new RegExp(`^${COMMIT_HEX}$`));
+var IdSchema = string().regex(/^[a-zA-Z0-9_-]{1,128}$/);
+var RepositoryPathSchema = string().min(1).max(512).refine((path) => !path.startsWith("/") && Array.from(path).every((character) => character.codePointAt(0) >= 32 && character.codePointAt(0) !== 127 && character !== "\\" && character !== ":") && path.split("/").every((part) => part !== "" && part !== "." && part !== ".."));
+var RepositoryConfigSchema = strictObject({
+  repository: string().min(1).max(256),
+  gitDirectory: string().refine((path) => path.startsWith("/")).optional(),
+  snapshotFile: string().startsWith("/").optional(),
+  snapshotSha256: string().regex(/^[a-f0-9]{64}$/).optional(),
+  commit: CommitSchema,
+  paths: array(RepositoryPathSchema).min(1).max(1e4)
+});
+function hasRepositorySource(config) {
+  return config.gitDirectory !== undefined !== (config.snapshotFile !== undefined) && config.snapshotFile !== undefined === (config.snapshotSha256 !== undefined);
+}
+var RepositoryTestProfileSchema = strictObject({
+  id: IdSchema,
+  entrypoint: RepositoryPathSchema,
+  timeoutMs: number().int().min(100).max(CHILD_TIMEOUT_MAX_MS)
+});
+var BashProfilesSchema = array(strictObject({
+  id: IdSchema,
+  description: string().min(1).max(256),
+  script: string().min(1).max(8192).refine((script) => !script.includes("\x00")),
+  timeoutMs: number().int().min(100).max(CHILD_TIMEOUT_MAX_MS)
+})).min(1).max(8).refine((profiles) => new Set(profiles.map((profile) => profile.id)).size === profiles.length);
+var SemgrepProfileSchema = strictObject({
+  version: string().regex(/^\d+\.\d+\.\d+$/),
+  rules: string().min(1).max(16384)
+});
+var WebCaptureSchema = strictObject({
+  id: IdSchema,
+  url: url().max(2048),
+  identity: string().min(1).max(128),
+  method: _enum(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]),
+  status: number().int().min(100).max(599),
+  body: string().max(8192)
+});
+var PermissionPolicySchema = strictObject({
+  id: string().min(1).max(128),
+  revision: string().min(1).max(128),
+  target: url().max(2048),
+  buildIdentityRef: string().min(1).max(2048),
+  approvedBy: string().min(1).max(256),
+  approvedAt: exports_iso.datetime(),
+  identities: array(strictObject({
+    id: IdSchema,
+    tenant: string().min(1).max(128),
+    role: string().min(1).max(128)
+  })).min(1).max(16),
+  rules: array(strictObject({
+    id: IdSchema,
+    identity: string().min(1).max(128),
+    resource: string().min(1).max(512),
+    action: string().min(1).max(128),
+    expected: _enum(["allow", "deny"])
+  })).min(1).max(64)
+}).superRefine((policy, context) => {
+  const identities = new Set(policy.identities.map((identity) => identity.id));
+  const rules = new Set(policy.rules.map((rule) => rule.id));
+  if (identities.size !== policy.identities.length || rules.size !== policy.rules.length || policy.rules.some((rule) => !identities.has(rule.identity)))
+    context.addIssue({
+      code: "custom",
+      message: "Policy identities and rules must be unique and bound."
+    });
+});
+var GVISOR_RUNTIME = "mettle-runsc";
+var SandboxRuntimeSchema = _enum([GVISOR_RUNTIME, "runc"]);
+var SandboxConfigSchema = strictObject({
+  socket: string().regex(/^\/(?:[^\0\r\n]+)$/).max(100),
+  image: string().regex(/^[a-z0-9][a-z0-9./:_-]*@sha256:[a-f0-9]{64}$/),
+  runtime: SandboxRuntimeSchema.optional(),
+  engineId: string().min(1).max(128).optional(),
+  location: _enum(["local", "vm"]).optional()
+}).refine((config) => config.location !== "vm" || sandboxRuntime(config) === GVISOR_RUNTIME && Boolean(config.engineId), "VM execution requires a pinned engine identity and mettle-runsc.");
+function sandboxRuntime(config) {
+  return config.runtime ?? GVISOR_RUNTIME;
+}
+function sandboxAllowsExecution(config, tool) {
+  return sandboxRuntime(config) === GVISOR_RUNTIME || !["sandbox_shell", "bash_run", "test_run"].includes(tool);
+}
+var TaskNameSchema = _enum([
+  "web_capture_read",
+  "web_capture_compare",
+  "repo_read",
+  "repo_search",
+  "change_inspect",
+  "test_run",
+  "semgrep_scan",
+  "secret_scan",
+  "dependency_scan",
+  "bash_run",
+  "http_request",
+  "web_discover",
+  "web_request",
+  "web_browse",
+  "session_health",
+  "browser_workflow",
+  "nuclei_scan",
+  "sqli_confirm",
+  "zap_scan"
+]);
+var SCANNER_CAPABILITIES = [
+  { profile: "secretScan", capability: "secrets" },
+  { profile: "dependencyScan", capability: "supply_chain" }
+];
+var SUBJECT_CAPABILITIES = {
+  runtime: ROUTE_CAPABILITIES.web,
+  source: [
+    ...new Set([
+      ...ROUTE_CAPABILITIES.repository,
+      ...ROUTE_CAPABILITIES.pull_request,
+      ...SCANNER_CAPABILITIES.map(({ capability }) => capability)
+    ])
+  ]
+};
+var PROBE_TOOL = "sandbox_probe";
+var SHELL_TOOL = "sandbox_shell";
+var SANDBOX_TOOLS = [
+  PROBE_TOOL,
+  SHELL_TOOL,
+  ...TaskNameSchema.options
+];
+
+// apps/harness/src/sandbox/worker.ts
+import { setTimeout as sleep } from "node:timers/promises";
+
+// apps/harness/src/tools/registry.ts
+function counted(count, noun, plural = `${noun}s`) {
+  return `${count} ${count === 1 ? noun : plural}`;
+}
+var RAN = {
+  completed: "Completed",
+  passed: "Passed",
+  failed: "Failed",
+  timed_out: "Timed out",
+  output_limit: "Output limit reached",
+  unavailable: "Unavailable"
+};
+function ran(status, exitCode) {
+  return exitCode === null ? RAN[status] : `${RAN[status]} (exit ${exitCode})`;
+}
+function scanned(scan, coverage) {
+  if (scan.status !== "completed")
+    return `Not completed (${scan.status.replaceAll("_", " ")})`;
+  const count = scan.findingCount ?? scan.findings.length;
+  return `${counted(count, "finding")} · ${coverage}`;
+}
+
+class ToolRegistry {
+  tools = new Map;
+  constructor(definitions) {
+    if (!definitions.length)
+      throw new HarnessError("invalid_tools", "At least one registered tool is required.");
+    for (const definition of definitions) {
+      if (!/^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(definition.name) || this.tools.has(definition.name) || !definition.description)
+        throw new HarnessError("invalid_tools", "Tool metadata is invalid or duplicated.");
+      this.tools.set(definition.name, Object.freeze({ ...definition }));
+    }
+  }
+  describe() {
+    return [...this.tools.values()].map(({ name, description, schema }) => ({
+      name,
+      description,
+      schema
+    }));
+  }
+  select(names) {
+    return new ToolRegistry([...this.tools.values()].filter((tool) => names.includes(tool.name)));
+  }
+  admit(name, input, canonical) {
+    const tool = this.tools.get(name);
+    if (!tool)
+      throw new HarnessError("tool_denied", "The tool is not registered for this run.");
+    const parsed = tool.schema.safeParse(input);
+    if (!parsed.success || canonicalJson(parsed.data) !== canonical)
+      throw new HarnessError("tool_denied", "Tool arguments must match the finalized proposal without transformation.");
+    return tool;
+  }
+}
+
+// apps/harness/src/sandbox/docker.ts
+import { request } from "node:http";
+
+// apps/harness/src/storage/http-scope.ts
+var HTTP_HEADER_LIMIT = 16384;
+var HTTP_RESPONSE_LIMIT = 65536;
+var WEBSITE_RESPONSE_LIMIT = 1048576;
+function withinHttpScope(scope, url) {
+  return url.origin === scope.origin && !url.username && !url.password && !url.hash && !/%2f|%5c|%00|%25/i.test(url.pathname) && (url.pathname === scope.pathname || url.pathname.startsWith(scope.pathname.endsWith("/") ? scope.pathname : `${scope.pathname}/`));
+}
+
+// apps/harness/src/storage/scanners.ts
+var EcosystemSchema = _enum([
+  "npm",
+  "PyPI",
+  "Go",
+  "crates.io",
+  "Maven",
+  "Packagist",
+  "RubyGems"
+]);
+var MAX_DATABASE_BYTES = 268435456;
+var SEMGREP_VERSION_TIMEOUT_MS = 60000;
+var SEMGREP_SCAN_TIMEOUT_MS = 120000;
+var SEMGREP_TASK_TIMEOUT_MS = SEMGREP_VERSION_TIMEOUT_MS + SEMGREP_SCAN_TIMEOUT_MS + 30000;
+var SecretScanProfileSchema = strictObject({
+  version: literal("8.30.1")
+});
+var DependencyScanProfileSchema = strictObject({
+  version: literal("2.6.0"),
+  paths: array(RepositoryPathSchema).min(1).max(64).refine((paths) => new Set(paths).size === paths.length),
+  database: strictObject({
+    revision: string().min(1).max(128),
+    capturedAt: exports_iso.datetime(),
+    ecosystems: array(strictObject({
+      name: EcosystemSchema,
+      sha256: string().regex(/^[a-f0-9]{64}$/)
+    })).min(1).max(EcosystemSchema.options.length).refine((items) => new Set(items.map((item) => item.name)).size === items.length)
+  })
+});
+var SCANNER_FINDINGS_MAX = 40;
+var SOURCE_SCANNER_TIMEOUT_MS = 120000;
+var SOURCE_SCANNER_VERSION_TIMEOUT_MS = 1e4;
+var SOURCE_SCANNER_TASK_TIMEOUT_MS = 150000;
+var ScannerStatusSchema = _enum([
+  "completed",
+  "failed",
+  "timed_out",
+  "output_limit",
+  "unavailable",
+  "version_mismatch",
+  "database_mismatch"
+]);
+
+// apps/harness/src/sandbox/limits.ts
+var TASK_TIMEOUT_MS = 30000;
+var TASK_INPUT_LIMIT = 1048576;
+var TASK_RESULT_LIMIT = 32768;
+var BROKER_RESPONSE_LIMIT = 4 * Math.ceil(WEBSITE_RESPONSE_LIMIT / 3) + 12 * HTTP_HEADER_LIMIT + 1024;
+var CHILD_OUTPUT_KEEP = 4096;
+var TASK_CONTAINER_LIFETIME_S = Math.ceil(SEMGREP_TASK_TIMEOUT_MS / 1000) + 15;
+var SANDBOX_UID = 65534;
+var REPO_SEARCH_FILES = 100;
+var REPO_SEARCH_MATCHES = 20;
+var REPO_EXCERPT = 256;
+
+// apps/harness/src/sandbox/exchange.ts
+class DockerExchange {
+  exchange;
+  write;
+  fail;
+  framed = Buffer.alloc(0);
+  lines = "";
+  total = 0;
+  pending = false;
+  final;
+  decoder = new TextDecoder("utf-8", { fatal: true });
+  constructor(exchange, write, fail) {
+    this.exchange = exchange;
+    this.write = write;
+    this.fail = fail;
+  }
+  receive(chunk) {
+    this.total += chunk.length;
+    if (this.total > 1048576)
+      throw new Error;
+    this.framed = Buffer.concat([this.framed, chunk]);
+    while (this.framed.length >= 8) {
+      if (this.framed[0] !== 1 || this.framed.readUIntBE(1, 3) !== 0)
+        throw new Error;
+      const length = this.framed.readUInt32BE(4);
+      if (length > 65536)
+        throw new Error;
+      if (this.framed.length < length + 8)
+        break;
+      this.lines += this.decoder.decode(this.framed.subarray(8, length + 8), {
+        stream: true
+      });
+      this.framed = this.framed.subarray(length + 8);
+      if (Buffer.byteLength(this.lines) > 65536)
+        throw new Error;
+      while (this.lines.includes(`
+`)) {
+        const boundary = this.lines.indexOf(`
+`);
+        const line = this.lines.slice(0, boundary);
+        this.lines = this.lines.slice(boundary + 1);
+        if (this.final || this.pending)
+          throw new Error;
+        const message = JSON.parse(line);
+        if (message && Object.keys(message).length === 1 && "request" in message) {
+          this.pending = true;
+          this.exchange(message.request).then((response) => Buffer.from(`${JSON.stringify({ response })}
+`), () => Buffer.from(`${JSON.stringify({ error: "refused" })}
+`)).then((encoded) => {
+            if (encoded.length > BROKER_RESPONSE_LIMIT)
+              throw new Error;
+            this.pending = false;
+            this.write(encoded);
+          }).catch(this.fail);
+        } else {
+          if (!message || Object.keys(message).sort().join(",") !== "inputDigest,value")
+            throw new Error;
+          const body = Buffer.from(line);
+          if (body.length > TASK_RESULT_LIMIT)
+            throw new Error;
+          const header = Buffer.alloc(8);
+          header[0] = 1;
+          header.writeUInt32BE(body.length, 4);
+          this.final = Buffer.concat([header, body]);
+        }
+      }
+    }
+  }
+  result() {
+    if (!this.final || this.pending || this.lines || this.framed.length || this.decoder.decode())
+      throw new HarnessError("sandbox_protocol", "The brokered task did not end with one complete, bound result.");
+    return this.final;
+  }
+}
+
+// apps/harness/src/sandbox/docker.ts
+class DockerEngine {
+  socket;
+  constructor(socket) {
+    this.socket = socket;
+  }
+  startExec(id, input, signal, timeoutMs, exchange) {
+    if (!/^[a-f0-9]{64}$/.test(id) || input.length > TASK_INPUT_LIMIT)
+      throw new HarnessError("sandbox_input_limit", "Invalid isolated exec input.");
+    return new Promise((resolve, reject) => {
+      let complete;
+      let rejectResult;
+      const result = new Promise((resolveResult, failResult) => {
+        complete = resolveResult;
+        rejectResult = failResult;
+      });
+      result.catch(() => {
+        return;
+      });
+      const payload = JSON.stringify({ Detach: false, Tty: false });
+      const chunks = [];
+      let size = 0;
+      let transport;
+      let finished = false;
+      const client = request({
+        socketPath: this.socket,
+        method: "POST",
+        path: `/v1.47/exec/${id}/start`,
+        agent: false,
+        headers: {
+          Connection: "Upgrade",
+          Upgrade: "tcp",
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(payload)
+        }
+      });
+      const release = () => {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", abort);
+      };
+      const fail = (code = "sandbox_transport") => {
+        if (finished)
+          return;
+        finished = true;
+        release();
+        const error = new HarnessError(code, "Isolated exec transport failed; no result is invented.");
+        reject(error);
+        rejectResult(error);
+        transport?.destroy();
+        client.destroy();
+      };
+      const abort = () => fail();
+      let timer = setTimeout(() => fail(), Math.min(2000, timeoutMs));
+      signal.addEventListener("abort", abort, { once: true });
+      client.once("error", () => fail());
+      client.once("response", (response) => {
+        response.destroy();
+        fail("sandbox_protocol");
+      });
+      client.once("upgrade", (response, socket, head) => {
+        transport = socket;
+        if (finished || response.statusCode !== 101 || response.headers.upgrade?.toLowerCase() !== "tcp") {
+          socket.destroy();
+          fail("sandbox_protocol");
+          return;
+        }
+        clearTimeout(timer);
+        timer = setTimeout(() => fail(), timeoutMs);
+        const interactive = exchange ? new DockerExchange(exchange, (bytes) => {
+          if (!finished)
+            socket.write(bytes);
+        }, () => fail("web_uncertain")) : undefined;
+        const receive = (chunk) => {
+          if (interactive) {
+            try {
+              interactive.receive(chunk);
+            } catch {
+              fail("web_uncertain");
+            }
+            return;
+          }
+          size += chunk.length;
+          if (size > 65536)
+            fail("sandbox_output_limit");
+          else
+            chunks.push(chunk);
+        };
+        socket.on("data", receive);
+        socket.once("error", () => fail());
+        socket.once("close", () => {
+          if (!finished)
+            fail();
+        });
+        socket.once("end", () => {
+          if (finished)
+            return;
+          let body;
+          try {
+            body = interactive ? interactive.result() : Buffer.concat(chunks);
+          } catch {
+            fail("web_uncertain");
+            return;
+          }
+          finished = true;
+          release();
+          complete({ status: 200, body });
+          socket.destroy();
+        });
+        receive(head);
+        if (finished)
+          return;
+        resolve({ result });
+        if (interactive)
+          socket.write(Buffer.concat([input, Buffer.from(`
+`)]));
+        else
+          socket.end(input);
+      });
+      if (signal.aborted)
+        fail();
+      else
+        client.end(payload);
+    });
+  }
+  call(method, path, body, signal, timeoutMs = 2000, limit = 65536) {
+    return new Promise((resolve, reject) => {
+      const payload = body === undefined ? undefined : JSON.stringify(body);
+      const client = request({
+        socketPath: this.socket,
+        method,
+        path: `/v1.47${path}`,
+        agent: false,
+        signal,
+        headers: payload ? {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(payload)
+        } : {}
+      }, (response) => {
+        const chunks = [];
+        let size = 0;
+        response.on("data", (chunk) => {
+          size += chunk.length;
+          if (size > limit) {
+            response.destroy();
+            client.destroy();
+            reject(new HarnessError("sandbox_output_limit", "Sandbox transport output exceeded its limit."));
+          } else
+            chunks.push(chunk);
+        });
+        response.once("end", () => {
+          clearTimeout(timer);
+          resolve({
+            status: response.statusCode ?? 0,
+            body: Buffer.concat(chunks)
+          });
+        });
+        response.once("error", fail);
+      });
+      const timer = setTimeout(() => client.destroy(), timeoutMs);
+      const fail = () => {
+        clearTimeout(timer);
+        reject(new HarnessError("sandbox_transport", "The local sandbox engine request failed; its effect may be uncertain."));
+      };
+      client.once("error", fail);
+      client.once("close", () => clearTimeout(timer));
+      client.end(payload);
+    });
+  }
+}
+function dockerJson(response, status = 200) {
+  if (response.status !== status)
+    throw new HarnessError("sandbox_engine", "The sandbox engine rejected an operation.");
+  try {
+    return JSON.parse(response.body.toString("utf8"));
+  } catch {
+    throw new HarnessError("sandbox_protocol", "The sandbox engine returned an invalid response.");
+  }
+}
+function dockerStatus(response, status) {
+  if (response.status !== status)
+    throw new HarnessError("sandbox_engine", "The sandbox engine rejected an operation.");
+}
+function dockerCreated(response) {
+  if (response.status === 409)
+    throw new HarnessError("sandbox_engine", "The sandbox engine reports a conflicting container name; it must be reconciled before reuse.");
+  if (response.status !== 201)
+    throw new HarnessError("sandbox_rejected", "The sandbox engine acknowledged and refused container creation; no container was created.");
+  return dockerJson(response, 201);
+}
+function dockerFrames(response, streams = "stdout") {
+  dockerStatus(response, 200);
+  const chunks = [];
+  let offset = 0;
+  while (offset < response.body.length) {
+    const header = response.body.subarray(offset, offset + 8);
+    if (header.length !== 8 || header[0] !== 1 && (streams === "stdout" || header[0] !== 2) || header.readUIntBE(1, 3) !== 0)
+      throw new HarnessError("sandbox_output", "The sandbox returned invalid output.");
+    const end = offset + 8 + header.readUInt32BE(4);
+    if (end > response.body.length)
+      throw new HarnessError("sandbox_output", "The sandbox output was truncated.");
+    chunks.push(response.body.subarray(offset + 8, end));
+    offset = end;
+  }
+  return Buffer.concat(chunks);
+}
+function dockerLogs(response, streams = "stdout") {
+  const bytes = dockerFrames(response, streams);
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new HarnessError("sandbox_output", "Sandbox output is not valid UTF-8.");
+  }
+}
+
+// apps/harness/src/sandbox/policy.ts
+var PROBE_MARKER = `mettle-sandbox-probe-v2
+`;
+var PROBE_TIMEOUT_MS = 1e4;
+var SHELL_OUTPUT_MAX = 16384;
+var SHELL_KILL_AFTER_S = PROBE_TIMEOUT_MS / 1000 + 5;
+var SHELL_LOG_LIMIT = 262144;
+var ENGINE_LAUNCH_TIMEOUT_MS = 30000;
+var RESOURCE_PROFILES = {
+  probe: {
+    Memory: 268435456,
+    MemorySwap: 268435456,
+    NanoCpus: 500000000,
+    PidsLimit: 32
+  },
+  tools: {
+    Memory: 1073741824,
+    MemorySwap: 1073741824,
+    NanoCpus: 1e9,
+    PidsLimit: 256,
+    Tmpfs: { "/tmp": "rw,noexec,nosuid,nodev,size=256m" }
+  },
+  browser: {
+    Memory: 2147483648,
+    MemorySwap: 2147483648,
+    NanoCpus: 2000000000,
+    PidsLimit: 512,
+    Tmpfs: { "/tmp": "rw,noexec,nosuid,nodev,size=512m" }
+  }
+};
+var ShellCommandSchema = strictObject({
+  command: string().min(1).max(2048).refine((command) => !command.includes("\x00"))
+});
+var RUNC_NETWORK_ASSERTION = [
+  "for flags_file in /sys/class/net/*/flags; do",
+  '  case "$flags_file" in */lo/flags) continue ;; esac',
+  '  flags=$(cat "$flags_file")',
+  '  test "$((flags & 1))" -eq 0',
+  "done",
+  `awk 'NR > 1 && $1 != "lo" { exit 1 }' /proc/net/route`,
+  "if test -e /proc/net/ipv6_route; then",
+  `  awk '$10 != "lo" { exit 1 }' /proc/net/ipv6_route`,
+  "fi"
+].join(`
+`);
+function probeScript(runtime) {
+  return [
+    "set -eu",
+    'test "$(id -u)" = 65534',
+    'test "$(id -g)" = 65534',
+    `awk '$1 == "CapEff:" { seen=1; if ($2 !~ /^0+$/) exit 1 } END { if (!seen) exit 1 }' /proc/self/status`,
+    `awk '$1 == "NoNewPrivs:" { seen=1; if ($2 != 1) exit 1 } END { if (!seen) exit 1 }' /proc/self/status`,
+    ...runtime === "runc" ? [
+      `awk '$1 == "Seccomp:" { seen=1; if ($2 != 2) exit 1 } END { if (!seen) exit 1 }' /proc/self/status`
+    ] : [],
+    `awk '$2 == "/" && $4 ~ /(^|,)ro(,|$)/ { seen=1 } END { if (!seen) exit 1 }' /proc/mounts`,
+    runtime === "runc" ? RUNC_NETWORK_ASSERTION : `awk -F: 'NR > 2 { name=$1; gsub(/ /, "", name); if (name != "lo") exit 1 }' /proc/net/dev`,
+    `/usr/local/bin/node -e 'const server = require("node:net").createServer(); server.on("error", () => process.exit(1)); server.listen(0, "127.0.0.1", () => server.close());'`,
+    "test ! -e /var/run/docker.sock",
+    "test ! -e /run/docker.sock",
+    "test ! -e /host",
+    "sleep 2",
+    "printf 'mettle-sandbox-probe-v2\\n'"
+  ].join(`
+`);
+}
+function sandboxConfig(environment = process.env) {
+  const parsed = SandboxConfigSchema.safeParse({
+    socket: environment.HARNESS_SANDBOX_SOCKET ?? "/var/run/docker.sock",
+    image: environment.HARNESS_SANDBOX_IMAGE,
+    ...environment.HARNESS_SANDBOX_RUNTIME !== undefined ? { runtime: environment.HARNESS_SANDBOX_RUNTIME } : {}
+  });
+  if (!parsed.success)
+    throw new HarnessError("sandbox_config", "Use an approved repository@sha256 image, a local Unix socket, and HARNESS_SANDBOX_RUNTIME=mettle-runsc or runc.");
+  return Object.freeze(parsed.data);
+}
+function launchSpec(image, script, labels, profile, runtime) {
+  return {
+    Image: image,
+    User: "65534:65534",
+    WorkingDir: "/",
+    Entrypoint: ["/bin/sh"],
+    Cmd: ["-c", script],
+    Env: ["PATH=/usr/bin:/bin"],
+    Labels: labels,
+    NetworkDisabled: false,
+    Tty: false,
+    OpenStdin: false,
+    Healthcheck: { Test: ["NONE"] },
+    HostConfig: {
+      Runtime: runtime,
+      NetworkMode: "none",
+      ReadonlyRootfs: true,
+      Privileged: false,
+      CapDrop: ["ALL"],
+      SecurityOpt: [
+        "no-new-privileges:true",
+        ...runtime === "runc" ? ["seccomp=builtin"] : []
+      ],
+      ...RESOURCE_PROFILES[profile],
+      RestartPolicy: { Name: "no", MaximumRetryCount: 0 },
+      LogConfig: {
+        Type: "json-file",
+        Config: { "max-size": "64k", "max-file": "1" }
+      }
+    }
+  };
+}
+var SHELL_BOUND = `timeout -s KILL ${SHELL_KILL_AFTER_S} /bin/sh -c "$1" sh "$2"; exit "$?"`;
+var SHELL_CAPTURE = [
+  "exec 4>&1",
+  `status=$( { { /bin/sh -c "$1" 2>&1 3>&- 4>&-; echo "$?" >&3; } | { head -c ${SHELL_OUTPUT_MAX + 1} >&4; cat >/dev/null; }; } 3>&1 )`,
+  'exit "$status"'
+].join(`
+`);
+function shellSpec(image, command, labels, runtime) {
+  const base = launchSpec(image, SHELL_BOUND, labels, "probe", runtime);
+  return {
+    ...base,
+    Cmd: ["-c", SHELL_BOUND, "sh", SHELL_CAPTURE, command],
+    HostConfig: {
+      ...base.HostConfig,
+      LogConfig: {
+        Type: "json-file",
+        Config: { "max-size": "2m", "max-file": "1" }
+      }
+    }
+  };
+}
+function shellPolicyDigest(image, command, runtime) {
+  return digest({
+    spec: shellSpec(image, command, {}, runtime),
+    timeoutMs: PROBE_TIMEOUT_MS
+  });
+}
+function probePolicyDigest(image, runtime) {
+  return digest({
+    spec: launchSpec(image, probeScript(runtime), {}, "probe", runtime),
+    timeoutMs: PROBE_TIMEOUT_MS
+  });
+}
+function sandboxLabels(record) {
+  return {
+    "mettle.sandbox": "probe-v1",
+    "mettle.run": record.runId,
+    "mettle.call": record.callId,
+    "mettle.epoch": String(record.epoch),
+    "mettle.worker": record.workerId,
+    "mettle.policy": record.policyDigest
+  };
+}
+
+// apps/harness/src/storage/active-scanners.ts
+import { isIPv4 } from "node:net";
+var ACTIVE_SCAN_TIMEOUT_MS = 180000;
+var ACTIVE_SCAN_TASK_TIMEOUT_MS = 210000;
+var ACTIVE_SCAN_TOOLS = [
+  "nuclei_scan",
+  "sqli_confirm",
+  "zap_scan"
+];
+var common = {
+  id: IdSchema,
+  url: url().max(2048),
+  maxRequests: number().int().min(1).max(128),
+  requestsPerSecond: number().int().min(1).max(5),
+  maxResponseBytes: number().int().min(1024).max(HTTP_RESPONSE_LIMIT),
+  maxTotalBytes: number().int().min(1024).max(4194304)
+};
+var ActiveScanProfileSchema = discriminatedUnion("tool", [
+  strictObject({
+    ...common,
+    tool: literal("nuclei_scan"),
+    version: literal("3.11.1"),
+    template: strictObject({
+      id: IdSchema,
+      name: string().min(1).max(256),
+      public: boolean(),
+      paths: array(string().startsWith("/").max(512).refine((path) => !/[{}#\\\s]/.test(path))).min(1).max(8),
+      status: array(number().int().min(200).max(599)).min(1).max(8),
+      words: array(string().min(1).max(256)).min(1).max(8)
+    })
+  }),
+  strictObject({
+    ...common,
+    tool: literal("sqli_confirm"),
+    version: literal("1.10"),
+    parameter: string().regex(/^[a-zA-Z0-9_]{1,64}$/),
+    technique: _enum(["B", "E"])
+  }),
+  strictObject({
+    ...common,
+    tool: literal("zap_scan"),
+    version: literal("2.17.0"),
+    rules: array(number().int().positive().max(999999)).min(1).max(8).refine((rules) => new Set(rules).size === rules.length)
+  })
+]);
+var ActiveScannersSchema = strictObject({
+  approvedBy: string().min(1).max(256),
+  expiresAt: exports_iso.datetime(),
+  disposableTarget: strictObject({
+    instanceId: IdSchema,
+    buildIdentityRef: string().min(1).max(2048)
+  }),
+  endpoints: array(strictObject({
+    origin: url().max(2048),
+    address: string().refine((address) => {
+      if (!isIPv4(address))
+        return false;
+      const [first, second] = address.split(".").map(Number);
+      return first !== 0 && first < 224 && !(first === 169 && second === 254) && address !== "168.63.129.16" && address !== "100.100.100.200";
+    })
+  })).min(1).max(4),
+  profiles: array(ActiveScanProfileSchema).min(1).max(8)
+});
+function scannerEndpoint(config, target, proposed) {
+  const url2 = new URL(proposed);
+  const scope = new URL(target);
+  const endpoint = config.endpoints.find((entry) => entry.origin === url2.origin);
+  if (!endpoint || url2.href !== proposed || !["http:", "https:"].includes(url2.protocol) || !withinHttpScope(new URL(scope.pathname, endpoint.origin), url2))
+    throw new HarnessError("scanner_denied", "The scanner request is outside its approved origin, port or path.");
+  return endpoint;
+}
+function validateActiveScanners(config, target, buildIdentityRef) {
+  if (config.disposableTarget.buildIdentityRef !== buildIdentityRef || new Set(config.endpoints.map((entry) => entry.origin)).size !== config.endpoints.length || new Set(config.profiles.map((entry) => entry.id)).size !== config.profiles.length)
+    throw new HarnessError("scanner_denied", "Scanner grants require unique endpoints/profiles and the approved disposable build identity.");
+  for (const endpoint of config.endpoints) {
+    const url2 = new URL(endpoint.origin);
+    if (url2.origin !== endpoint.origin || url2.hostname !== new URL(target).hostname || !["http:", "https:"].includes(url2.protocol))
+      throw new HarnessError("scanner_denied", "Scanner origins must explicitly name the target's HTTP(S) ports.");
+  }
+  for (const profile of config.profiles) {
+    scannerEndpoint(config, target, profile.url);
+    if (profile.tool === "nuclei_scan")
+      for (const path of profile.template.paths)
+        scannerEndpoint(config, target, new URL(path, profile.url).href);
+    if (profile.tool === "sqli_confirm" && new URL(profile.url).searchParams.getAll(profile.parameter).length !== 1)
+      throw new HarnessError("scanner_denied", "SQLMap requires one approved query parameter and URL.");
+  }
+}
+var SCANNER_REQUEST_STRIP_HEADERS = [
+  "host",
+  "connection",
+  "content-length",
+  "transfer-encoding",
+  "upgrade",
+  "trailer",
+  "te",
+  "keep-alive",
+  "accept-encoding"
+];
+function scannerRequestAllowed(profile, url2, method) {
+  const approved = new URL(profile.url);
+  if (url2.origin !== approved.origin)
+    return false;
+  if (profile.tool === "zap_scan")
+    return true;
+  if (method !== "GET" && method !== "HEAD")
+    return false;
+  if (profile.tool === "nuclei_scan")
+    return profile.template.paths.some((path) => new URL(path, approved).href === url2.href);
+  if (url2.pathname !== approved.pathname || url2.searchParams.getAll(profile.parameter).length !== 1)
+    return false;
+  const fixed = (entry) => [...entry.searchParams].filter(([name]) => name !== profile.parameter);
+  return JSON.stringify(fixed(url2)) === JSON.stringify(fixed(approved));
+}
+function sqlmapCandidate(finding, profile) {
+  return finding.status === "candidate" && finding.verification.result === "pending" && finding.cwe === "CWE-89" && finding.subject.kind === "runtime" && ("endpoint" in finding && finding.endpoint ? finding.endpoint.url === profile.url && finding.endpoint.method === "GET" && finding.endpoint.parameter === profile.parameter : finding.location === profile.url);
+}
+
+// apps/harness/src/sandbox/active-program.ts
+var ACTIVE_PROGRAM = String.raw`
+async function activeScan(tool, input, send) {
+  const fs = require("node:fs/promises");
+  const http = require("node:http");
+  const tls = require("node:tls");
+  const { spawn } = require("node:child_process");
+  const root = await fs.mkdtemp("/tmp/mettle-active-");
+  const profile = input.profile;
+  const env = { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: root, TMPDIR: root, PYTHONDONTWRITEBYTECODE: "1", JAVA_TOOL_OPTIONS: "-Djava.awt.headless=true -Duser.home=" + root };
+  const processes = new Set();
+  const sockets = new Set();
+  const tunnels = new WeakMap();
+  let proxyFailure;
+  const run = (command, args, timeout = ${ACTIVE_SCAN_TIMEOUT_MS}) => new Promise((resolve, reject) => {
+    const child = spawn(command, args, { cwd: root, env, shell: false, stdio: ["ignore", "pipe", "pipe"], detached: true });
+    processes.add(child);
+    let bytes = 0;
+    let stdout = "";
+    let stderr = "";
+    let error;
+    const kill = () => { if (child.pid) { try { process.kill(-child.pid, "SIGKILL"); } catch {} } };
+    const timer = setTimeout(() => { error = new Error("timed_out"); kill(); }, timeout);
+    for (const [stream, field] of [[child.stdout, "stdout"], [child.stderr, "stderr"]]) stream.on("data", (chunk) => {
+      bytes += chunk.length;
+      if (field === "stdout") stdout += chunk.toString(); else stderr += chunk.toString();
+      if (bytes > 1048576) { error = new Error("output_limit"); kill(); }
+    });
+    child.once("error", (cause) => { error = cause; });
+    child.once("close", (code) => { clearTimeout(timer); processes.delete(child); if (error) reject(error); else resolve({ code, stdout, stderr }); });
+  });
+  const read = async (name) => {
+    const file = root + "/" + name;
+    const stat = await fs.lstat(file);
+    if (!stat.isFile() || stat.size > 1048576) throw new Error("output_limit");
+    return fs.readFile(file, "utf8");
+  };
+  const proxy = http.createServer({ maxHeaderSize: 16384 }, async (request, response) => {
+    try {
+      const origin = tunnels.get(request.socket);
+      const url = origin ? new URL(request.url, origin).href : request.url;
+      if (origin && new URL(url).origin !== origin) throw new Error();
+      let size = 0;
+      const chunks = [];
+      for await (const chunk of request) { size += chunk.length; if (size > 8192) throw new Error(); chunks.push(chunk); }
+      const headers = {};
+      for (const [key, value] of Object.entries(request.headers)) {
+        if (typeof value === "string" && !${JSON.stringify(SCANNER_REQUEST_STRIP_HEADERS)}.includes(key) && !key.startsWith("proxy-")) headers[key] = value;
+      }
+      const body = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+      const result = await send({ url, method: request.method, headers, ...(size ? { body } : {}) });
+      response.writeHead(result.status, { ...result.headers, "content-type": result.contentType, connection: "close" });
+      response.end(Buffer.from(result.body, "base64"));
+    } catch (error) { proxyFailure = error; response.writeHead(502); response.end(); }
+  });
+  proxy.on("connection", (socket) => { sockets.add(socket); socket.on("close", () => sockets.delete(socket)); socket.setTimeout(15000, () => socket.destroy()); });
+  proxy.on("upgrade", (_request, socket) => { proxyFailure = new Error("upgrade_denied"); socket.destroy(); });
+  proxy.on("clientError", (error, socket) => { proxyFailure = error; socket.destroy(); });
+  try {
+    const certificate = await run("/usr/bin/openssl", ["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "1", "-subj", "/CN=mettle-scanner-proxy", "-keyout", root + "/key.pem", "-out", root + "/cert.pem"], 10000);
+    if (certificate.code !== 0) throw new Error("proxy_unavailable");
+    const secureContext = tls.createSecureContext({ key: await read("key.pem"), cert: await read("cert.pem") });
+    proxy.on("connect", (request, socket, head) => {
+      try {
+        const url = new URL("https://" + request.url);
+        if (head.length || (request.url !== url.host && request.url !== url.hostname + ":443") || url.username || url.password || url.pathname !== "/") throw new Error();
+        socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        const secure = new tls.TLSSocket(socket, { isServer: true, secureContext });
+        tunnels.set(secure, url.origin);
+        secure.on("error", (error) => { proxyFailure = error; secure.destroy(); });
+        proxy.emit("connection", secure);
+      } catch (error) { proxyFailure = error; socket.destroy(); }
+    });
+    await new Promise((resolve, reject) => { proxy.once("error", reject); proxy.listen(0, "127.0.0.1", resolve); });
+    const proxyUrl = "http://127.0.0.1:" + proxy.address().port;
+    let findings = [];
+    if (tool === "nuclei_scan") {
+      const version = await run("/usr/local/bin/nuclei", ["-version"], 10000);
+      if (version.code !== 0 || !(version.stdout + version.stderr).includes("v" + profile.version)) throw new Error("version_mismatch");
+      const template = { id: profile.template.id, info: { name: profile.template.name, author: "mettle", severity: "info" }, http: [{ method: "GET", path: profile.template.paths.map((path) => new URL(path, profile.url).href), "matchers-condition": "and", matchers: [{ type: "status", status: profile.template.status }, { type: "word", part: "body", words: profile.template.words, condition: "and" }] }] };
+      await fs.writeFile(root + "/template.yaml", JSON.stringify(template));
+      await fs.writeFile(root + "/config.yaml", "{}\n");
+      const scanned = await run("/usr/local/bin/nuclei", ["-u", profile.url, "-t", root + "/template.yaml", "-config", root + "/config.yaml", "-o", root + "/nuclei.jsonl", "-jsonl", "-silent", "-omit-raw", "-omit-template", "-no-stdin", "-no-interactsh", "-disable-update-check", "-disable-redirects", "-no-httpx", "-proxy", proxyUrl, "-proxy-internal", "-rate-limit", String(profile.requestsPerSecond), "-c", "1", "-bs", "1", "-retries", "0", "-timeout", "5"]);
+      if (scanned.code !== 0 || /\[(?:ERR|FTL)\]/.test(scanned.stderr)) throw new Error("scan_failed");
+      findings = (await read("nuclei.jsonl")).split("\n").filter(Boolean).map((line) => {
+        const item = JSON.parse(line);
+        if (item["template-id"] !== profile.template.id || typeof item["matched-at"] !== "string") throw new Error();
+        return { ruleId: item["template-id"], url: item["matched-at"], title: profile.template.name };
+      });
+    } else if (tool === "sqli_confirm") {
+      const version = await run("/usr/bin/python3", ["/opt/mettle/sqlmap/sqlmap.py", "--version"], 10000);
+      if (version.code !== 0 || version.stdout.split("\n")[0].trim() !== profile.version + "#stable") throw new Error("version_mismatch");
+      await fs.writeFile(root + "/targets.txt", profile.url + "\n");
+      const scanned = await run("/usr/bin/python3", ["/opt/mettle/sqlmap/sqlmap.py", "-m", root + "/targets.txt", "-p", profile.parameter, "--technique=" + profile.technique, "--batch", "--skip-waf", "--level=1", "--risk=1", "--threads=1", "--timeout=5", "--retries=0", "--delay=" + String(1 / profile.requestsPerSecond), "--proxy=" + proxyUrl, "--ignore-redirects", "--disable-coloring", "--flush-session", "--output-dir=" + root + "/sqlmap", "--results-file=" + root + "/sqlmap.csv", "-v", "0"]);
+      const errors = (scanned.stdout + scanned.stderr).split("\n").filter((line) => /\[(?:CRITICAL|ERROR)\]/.test(line));
+      if (scanned.code !== 0 || errors.some((line) => !/\[(?:CRITICAL|ERROR)\] all tested parameters do not appear to be injectable\./.test(line))) throw new Error("scan_failed");
+      const parsed = await run("/usr/bin/python3", ["-c", "import csv,json,sys; print(json.dumps(list(csv.DictReader(open(sys.argv[1],newline='')))))", root + "/sqlmap.csv"], 10000);
+      if (parsed.code !== 0) throw new Error("scan_failed");
+      findings = JSON.parse(parsed.stdout).flatMap((item) => {
+        if (item['Target URL'] !== profile.url) throw new Error();
+        if (!item['Technique(s)'] || item['Note(s)']) return [];
+        if (item.Place !== "GET" || item.Parameter !== profile.parameter) throw new Error();
+        return [{ ruleId: "sqlmap-" + profile.technique, url: profile.url, title: "SQL injection observation", parameter: profile.parameter }];
+      });
+    } else if (tool === "zap_scan") {
+      const version = await run("/usr/bin/python3", ["-c", "import sys; from zipfile import ZipFile; archive = ZipFile('/zap/zap-' + sys.argv[1] + '.jar'); assert archive.getinfo('META-INF/MANIFEST.MF').file_size <= 16384; print(archive.read('META-INF/MANIFEST.MF').decode('utf-8'))", profile.version], 10000);
+      if (version.code !== 0 || !version.stdout.split(/\r?\n/).includes("Implementation-Version: " + profile.version)) throw new Error("version_mismatch");
+      const plan = { env: { contexts: [{ name: "approved", urls: [new URL(profile.url).origin + new URL(profile.url).pathname] }], parameters: { failOnError: true, failOnWarning: true, progressToStdout: false } }, jobs: [
+        { type: "passiveScan-config", parameters: { disableAllRules: true } },
+        { type: "activeScan-config", inputVectors: { scripts: false } },
+        { type: "requestor", parameters: {}, requests: [{ url: profile.url, method: "GET" }] },
+        { type: "activeScan", parameters: { context: "approved", maxRuleDurationInMins: 0, maxScanDurationInMins: 0, threadPerHost: 1, delayInMs: Math.ceil(1000 / profile.requestsPerSecond) }, policyDefinition: { defaultStrength: "Low", defaultThreshold: "Off", rules: profile.rules.map((id) => ({ id, strength: "Low", threshold: "Medium" })) } },
+        { type: "report", parameters: { template: "traditional-json", reportDir: root, reportFile: "zap.json" } }
+      ] };
+      await fs.writeFile(root + "/plan.yaml", JSON.stringify(plan));
+      const scanned = await run("/zap/zap.sh", ["-Xmx768m", "-silent", "-cmd", "-dir", root + "/zap", "-autorun", root + "/plan.yaml", "-config", "network.connection.httpProxy.enabled=true", "-config", "network.connection.httpProxy.host=127.0.0.1", "-config", "network.connection.httpProxy.port=" + proxy.address().port, "-config", "network.connection.timeoutInSecs=5", "-config", "autoupdate.checkOnStart=false", "-config", "autoupdate.downloadNewRelease=false", "-config", "autoupdate.installAddonUpdates=false"]);
+      if (scanned.code !== 0) throw new Error("scan_failed");
+      const report = JSON.parse(await read("zap.json"));
+      if (report['@version'] !== profile.version || !Array.isArray(report.site)) throw new Error();
+      findings = report.site.flatMap((site) => site.alerts.flatMap((alert) => {
+        if (!profile.rules.includes(Number(alert.pluginid))) throw new Error();
+        return alert.instances.map((item) => ({ ruleId: String(alert.pluginid), url: item.uri, title: String(alert.name).slice(0, 256) }));
+      }));
+    } else throw new Error();
+    if (proxyFailure) throw proxyFailure;
+    if (findings.some((finding) => typeof finding.url !== "string" || finding.url.length > 1024)) throw new Error();
+    return { status: "completed", version: profile.version, findingCount: findings.length, findings: findings.slice(0, 10), complete: findings.length <= 10 };
+  } catch {
+    return { status: "failed", version: profile.version, findingCount: 0, findings: [], complete: false };
+  } finally {
+    for (const child of processes) { try { process.kill(-child.pid, "SIGKILL"); } catch {} }
+    for (const socket of sockets) socket.destroy();
+    await new Promise((resolve) => proxy.close(resolve));
+    await fs.rm(root, { recursive: true, force: true });
+  }
+}
+`;
+
+// apps/harness/src/sandbox/website-program.ts
+var WEBSITE_PROGRAM = String.raw`
+function websiteScope(input, raw, method = "GET") {
+  try {
+    const url = new URL(raw);
+    return (input.scopes || [{ url: input.target, methods: ["GET", "HEAD"] }]).some((entry) => {
+      const scope = new URL(entry.url);
+      return entry.methods.includes(method) && url.origin === scope.origin && !url.username && !url.password && !url.hash &&
+        !/%(?:2f|5c|00|25)/i.test(url.pathname) &&
+        (url.pathname === scope.pathname || url.pathname.startsWith(scope.pathname.endsWith("/") ? scope.pathname : scope.pathname + "/"));
+    });
+  } catch { return false; }
+}
+function websiteLinks(body, base) {
+  const result = [];
+  for (const match of body.matchAll(/<(a|script|form)\b([^>]{0,8192})>/gi)) {
+    const tag = match[1].toLowerCase();
+    const attribute = tag === "script" ? "src" : tag === "form" ? "action" : "href";
+    const value = new RegExp("\\b" + attribute + "\\s*=\\s*[\"']([^\"'<>\\s]{1,2048})[\"']", "i").exec(match[2]);
+    if (!value) continue;
+    try {
+      const url = new URL(value[1].replace(/&amp;/g, "&"), base); url.hash = "";
+      if (!["https:", "http:"].includes(url.protocol) || url.href.length > 2048) continue;
+      const formMethod = /\bmethod\s*=\s*["']post["']/i.test(match[2]) ? "POST" : "GET";
+      result.push({ url: url.href, method: tag === "form" ? formMethod : "GET", kind: tag === "form" ? "form" : tag === "script" ? "script" : "page" });
+    } catch {}
+  }
+  return result.sort((a, b) => (a.kind === "page" ? 0 : 1) - (b.kind === "page" ? 0 : 1));
+}
+async function websiteObserve(tool, input, send) {
+  const initial = { url: input.url || input.target, method: input.method || "GET", ...(input.body !== undefined ? { body: input.body } : {}), ...(input.headers ? { headers: input.headers } : {}) };
+  const queue = [{ request: initial, depth: 0 }];
+  const seen = new Set(), pages = [], endpoints = new Map(), leads = new Map();
+  let omitted = 0, redirects = 0;
+  while (queue.length && pages.length < input.maxPages && seen.size < 100) {
+    const next = queue.shift();
+    if (seen.has(next.request.url)) continue;
+    seen.add(next.request.url);
+    const response = await send(next.request);
+    const body = Buffer.from(response.body, "base64").toString("utf8");
+    if ([301,302,303,307,308].includes(response.status)) {
+      const location = response.headers && response.headers.location;
+      if (typeof location === "string" && redirects++ < 5 && ["GET", "HEAD"].includes(next.request.method)) {
+        const redirect = new URL(location, next.request.url); redirect.hash = "";
+        if (websiteScope(input, redirect.href, next.request.method)) queue.unshift({ request: { url: redirect.href, method: next.request.method }, depth: next.depth });
+        else { omitted++; leads.set(redirect.href, { url: redirect.href, method: "GET", kind: "redirect", inScope: false }); }
+      } else omitted++;
+    }
+    const url = new URL(next.request.url);
+    endpoints.set(url.href, { id: crypto.createHash("sha256").update(url.href).digest("hex"), url: url.href, method: next.request.method, parameters: [...new Set(url.searchParams.keys())].slice(0,16), observed: true });
+    const textual = /^(text\/|application\/(.*json|.*xml|javascript|x-javascript))/i.test(response.contentType);
+    pages.push({ url: url.href, status: response.status, contentType: response.contentType, excerpt: textual ? (response.excerpt ?? body).slice(0, tool === "web_request" ? 2048 : 512) : "[Binary response; body not retained as text]", truncated: textual && body.length > (tool === "web_request" ? 2048 : 512), ...(response.evidenceRef ? { evidenceRef: response.evidenceRef } : {}) });
+    if (!response.contentType.includes("text/html")) continue;
+    for (const link of websiteLinks(body, url.href)) {
+      const inScope = websiteScope(input, link.url, link.method);
+      if (leads.size < 40) leads.set(link.url, { ...link, inScope }); else omitted++;
+      if (!inScope) { omitted++; continue; }
+      if (endpoints.size < 40 && !endpoints.has(link.url)) endpoints.set(link.url, { id: crypto.createHash("sha256").update(link.url).digest("hex"), url: link.url, method: link.method, parameters: [], observed: false });
+      if (tool !== "web_discover" || link.kind !== "page") continue;
+      if (/\.(?:css|png|jpe?g|gif|svg|ico|avif|webp|woff2?|ttf|mp4|pdf)(?:\?|$)/i.test(link.url)) continue;
+      if (next.depth < input.maxDepth && queue.length < 40 && !seen.has(link.url)) queue.push({ request: { url: link.url, method: "GET" }, depth: next.depth + 1 });
+      else if (!seen.has(link.url)) omitted++;
+    }
+  }
+  const value = { pages, endpoints: [...endpoints.values()], leads: [...leads.values()], omitted: omitted + queue.length,
+    coverage: "Bounded HTTP observations and static page/script/form discovery. Linked origins do not grant access. Unvisited leads and authenticated/business workflows remain untested unless separately recorded.", complete: false, verification: "not-independent" };
+  while (Buffer.byteLength(JSON.stringify(value)) > 16000) {
+    if (value.leads.length) value.leads.pop(); else if (value.endpoints.length) value.endpoints.pop(); else value.pages.pop();
+    value.omitted++;
+  }
+  return value;
+}
+
+async function websiteBrowse(input, send) {
+  const version = require("/opt/mettle-browser/node_modules/playwright/package.json").version;
+  if (version !== input.version) throw new Error("browser_version");
+  const { chromium } = require("/opt/mettle-browser/node_modules/playwright");
+  const browser = await chromium.launch({ headless: true, chromiumSandbox: false, timeout: 10000, args: ["--disable-dev-shm-usage"] });
+  const blocked = [];
+  let failure, requests = 0, pending = Promise.resolve(), accepting = true;
+  try {
+    const context = await browser.newContext({ serviceWorkers: "block", acceptDownloads: false });
+    context.setDefaultTimeout(5000);
+    await context.routeWebSocket("**/*", (socket) => { if (blocked.length < 20) blocked.push({ url: socket.url().slice(0, 2048), reason: "websocket" }); socket.close(); });
+    await context.route("**/*", async (route) => {
+      const request = route.request();
+      const url = request.url();
+      const hints = request.headers();
+      if (hints["next-router-prefetch"] === "1" || /(?:^|[\s,;])prefetch(?:$|[\s,;])/.test(hints["sec-purpose"] || hints.purpose || "")) {
+        if (blocked.length < 20) blocked.push({ url: url.slice(0, 2048), reason: "prefetch" });
+        await route.abort(); return;
+      }
+      if (!accepting || !websiteScope(input, url, request.method()) || ["image", "font", "media"].includes(request.resourceType()) || requests >= 40) {
+        if (blocked.length < 20) blocked.push({ url: url.slice(0, 2048), reason: !accepting ? "workflow_complete" : !websiteScope(input, url, request.method()) ? "scope" : requests >= 40 ? "request_limit" : "asset" });
+        await route.abort(); return;
+      }
+      requests++;
+      const work = pending.then(async () => {
+        try {
+          if (failure) { await route.abort(); return; }
+          const headers = Object.fromEntries(Object.entries(await request.allHeaders()).filter(([name]) => input.requestHeaders.includes(name)));
+          const resourceType = request.resourceType();
+          const response = await send({ url, method: request.method(), headers, ...(["script", "stylesheet"].includes(resourceType) ? { resourceType } : {}), ...(request.postData() !== null ? { body: request.postData() } : {}) });
+          const responseHeaders = Object.fromEntries(Object.entries(response.headers).filter(([, value]) => value !== undefined).map(([name, value]) => [name, Array.isArray(value) ? value.join(name === "set-cookie" ? "\n" : ", ") : value]));
+          await route.fulfill({ status: response.status, headers: responseHeaders, body: Buffer.from(response.body, "base64") });
+        } catch (error) { failure = error; await route.abort().catch(() => {}); }
+      });
+      pending = work;
+      await work;
+    });
+    const page = await context.newPage();
+    await page.goto(input.url, { waitUntil: "domcontentloaded", timeout: 60000 });
+    for (const action of input.actions) {
+      if (action.type === "click") await page.locator(action.selector).click();
+      else if (action.type === "fill") await page.locator(action.selector).fill(action.value);
+      else if (action.type === "waitFor") await page.locator(action.selector).filter({ hasText: action.text }).waitFor({ state: "visible" });
+      else throw new Error("browser_action");
+    }
+    await pending;
+    if (failure) throw failure;
+    const text = await page.locator("body").innerText();
+    const value = { url: page.url(), title: (await page.title()).slice(0, 256), text: text.slice(0, 4096), truncated: text.length > 4096, actions: input.actions.length, blocked,
+      complete: false, coverage: "One isolated browser workflow; blocked resources, omitted assets and all unexercised workflows remain untested. Cookies exist only within this call.", verification: "not-independent" };
+    accepting = false;
+    await pending;
+    if (failure) throw failure;
+    await context.close();
+    return value;
+  } finally { await browser.close(); }
+}
+`;
+
+// apps/harness/src/sandbox/live-program.ts
+var LIVE_PROGRAM = String.raw`
+const readline = require("node:readline");
+const crypto = require("node:crypto");
+const lines = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
+const iterator = lines[Symbol.asyncIterator]();
+${ACTIVE_PROGRAM}
+${WEBSITE_PROGRAM}
+(async () => {
+  if (process.getuid() !== ${SANDBOX_UID}) throw new Error();
+  const first = await iterator.next();
+  if (first.done || Buffer.byteLength(first.value) > ${TASK_INPUT_LIMIT}) throw new Error();
+  const { tool, input } = JSON.parse(first.value);
+  let queue = Promise.resolve();
+  const send = (request) => {
+    const result = queue.then(async () => {
+      process.stdout.write(JSON.stringify({ request }) + "\n");
+      const next = await iterator.next();
+      if (next.done || Buffer.byteLength(next.value) > ${BROKER_RESPONSE_LIMIT}) throw new Error();
+      const message = JSON.parse(next.value);
+      if (!message || !("response" in message)) throw new Error();
+      return message.response;
+    });
+    queue = result;
+    return result;
+  };
+  let value;
+  if (tool === "web_discover" || tool === "web_request") {
+    value = await websiteObserve(tool, input, send);
+  } else if (tool === "web_browse") {
+    value = await websiteBrowse(input, send);
+  } else if (tool === "http_request") {
+    const response = await send({ ...input.request, requestId: input.requestId });
+    const body = Buffer.from(response.body, "base64").toString("utf8");
+    value = { requestId: input.requestId, status: response.status, contentType: response.contentType, body: body.slice(0, 8192), truncated: body.length > 8192 };
+  } else if (tool === "session_health") {
+    value = { status: "healthy" };
+  } else if (tool === "browser_workflow") {
+    const version = require("/opt/mettle-browser/node_modules/playwright/package.json").version;
+    if (version !== input.version) throw new Error();
+    const { chromium } = require("/opt/mettle-browser/node_modules/playwright");
+    const browser = await chromium.launch({ headless: true, chromiumSandbox: false, timeout: 10000, args: ["--disable-dev-shm-usage"] });
+    try {
+      const context = await browser.newContext({ serviceWorkers: "block", acceptDownloads: false });
+      context.setDefaultTimeout(3000);
+      await context.routeWebSocket("**/*", (socket) => socket.close());
+      let failure;
+      await context.route("**/*", async (route) => {
+        try {
+          const request = route.request();
+          const response = await send({ url: request.url(), method: request.method(), ...(request.postData() !== null ? { body: request.postData() } : {}) });
+          await route.fulfill({ status: response.status, contentType: response.contentType, body: Buffer.from(response.body, "base64") });
+        } catch (error) { failure = error; await route.abort(); }
+      });
+      const page = await context.newPage();
+      await page.goto(input.url, { waitUntil: "domcontentloaded", timeout: 10000 });
+      for (const action of input.actions) {
+        if (action.type === "click") await page.locator(action.selector).click();
+        else if (action.type === "fill") await page.locator(action.selector).fill(action.value);
+        else throw new Error();
+      }
+      await queue;
+      if (failure) throw failure;
+      const content = await page.locator("body").innerText();
+      value = { workflowId: input.workflowId, url: page.url(), title: await page.title(), text: content.slice(0, 8192), truncated: content.length > 8192, actions: input.actions.length };
+      await context.close();
+      await queue;
+      if (failure) throw failure;
+    } finally { await browser.close(); }
+  } else if (${JSON.stringify(ACTIVE_SCAN_TOOLS)}.includes(tool)) {
+    value = await activeScan(tool, input, send);
+  } else throw new Error();
+  const result = JSON.stringify({ inputDigest: crypto.createHash("sha256").update(first.value).digest("hex"), value });
+  if (Buffer.byteLength(result) > ${TASK_RESULT_LIMIT}) throw new Error();
+  process.stdout.write(result + "\n");
+  lines.close();
+  process.stdin.destroy();
+})().catch(() => { lines.close(); process.stdin.destroy(); process.exitCode = 1; });
+`;
+
+// apps/harness/src/sandbox/scanner-program.ts
+var SPAWN_STATUS_PROGRAM = `
+function spawnStatus(result, success = "completed", exceeded = false) {
+  return result.error?.code === "ETIMEDOUT" ? "timed_out" : result.error?.code === "ENOBUFS" || exceeded ? "output_limit" : result.error ? "unavailable" : result.status === 0 ? success : "failed";
+}
+`;
+var SOURCE_SCANNER_PROGRAM = String.raw`
+function scanSource(tool, input, workspace, root) {
+  const path = require("node:path");
+  const child = require("node:child_process");
+  const secret = tool === "secret_scan";
+  const binary = secret ? "/usr/local/bin/gitleaks" : "/usr/local/bin/osv-scanner";
+  const environment = { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: root, TMPDIR: root, LC_ALL: "C" };
+  if (!secret) environment.OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY = "/opt/mettle/osv";
+  const invoke = (args, timeout, maxBuffer) => child.spawnSync(binary, args, {
+    cwd: workspace, env: environment, stdio: ["ignore", "pipe", "pipe"],
+    timeout, killSignal: "SIGKILL", maxBuffer, encoding: "utf8", shell: false
+  });
+
+  const incomplete = (status) => ({ status, complete: false, findingCount: null, findings: [], scannedFiles: [] });
+  const version = invoke(secret ? ["version"] : ["--version"], ${SOURCE_SCANNER_VERSION_TIMEOUT_MS}, 4096);
+  if (version.error || version.status !== 0) return incomplete(spawnStatus(version));
+  if (!String(version.stdout).split(/\s+/).some((part) => part.replace(/^v/, "") === input.version)) return incomplete("version_mismatch");
+  const approved = new Set(input.files.map((file) => file.path));
+  const relative = (name) => {
+    if (typeof name !== "string") throw new Error();
+    const normalized = path.isAbsolute(name) ? path.relative(workspace, name) : name.replace(/^\.\//, "");
+    if (!approved.has(normalized)) throw new Error();
+    return normalized;
+  };
+  const bounded = (value, max = 256) => {
+    if (typeof value !== "string" || !value.length || value.length > max) throw new Error();
+    return value;
+  };
+  let args;
+  if (secret) {
+    fs.writeFileSync(path.join(root, "gitleaks.toml"), "[extend]\nuseDefault = true\n", { flag: "wx", mode: 0o600 });
+    fs.writeFileSync(path.join(root, "ignore"), "", { flag: "wx", mode: 0o600 });
+    args = ["dir", "--config", path.join(root, "gitleaks.toml"), "--gitleaks-ignore-path", path.join(root, "ignore"), "--ignore-gitleaks-allow", "--redact=100", "--no-banner", "--no-color", "--log-level", "error", "--exit-code", "10", "--max-archive-depth", "0", "--max-decode-depth", "0", "--report-format", "json", "--report-path", path.join(root, "gitleaks.json"), workspace];
+  } else {
+    try {
+      for (const entry of input.database.ecosystems) {
+        if (!${JSON.stringify(EcosystemSchema.options)}.includes(entry.name)) throw new Error();
+        const file = "/opt/mettle/osv/osv-scalibr/" + entry.name + "/all.zip";
+        const info = fs.statSync(file);
+        if (!info.isFile() || info.size <= 0 || info.size > ${MAX_DATABASE_BYTES}) throw new Error();
+        if (crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex") !== entry.sha256) throw new Error();
+      }
+    } catch { return incomplete("database_mismatch"); }
+    fs.writeFileSync(path.join(root, "osv.toml"), "", { flag: "wx", mode: 0o600 });
+    args = ["scan", "source", "--offline", "--no-call-analysis=all", "--no-resolve", "--no-ignore", "--all-packages", "--config", path.join(root, "osv.toml"), "--format", "json", "--recursive", workspace];
+  }
+  const result = invoke(args, ${SOURCE_SCANNER_TIMEOUT_MS}, 1048576);
+  if (result.error || ![0, secret ? 10 : 1].includes(result.status)) return incomplete(spawnStatus(result));
+  try {
+    if (secret && fs.statSync(path.join(root, "gitleaks.json")).size > 1048576) return incomplete("output_limit");
+    const raw = JSON.parse(secret ? fs.readFileSync(path.join(root, "gitleaks.json"), "utf8") : result.stdout);
+    const findings = [];
+    const scanned = new Set();
+    let count = 0;
+    const add = (finding) => { count++; if (findings.length < ${SCANNER_FINDINGS_MAX}) findings.push(finding); };
+    if (secret) {
+      if (!Array.isArray(raw)) throw new Error();
+      for (const finding of raw) {
+        if (!Number.isInteger(finding.StartLine) || finding.StartLine < 1 || !Number.isInteger(finding.EndLine) || finding.EndLine < finding.StartLine) throw new Error();
+        add({ rule: bounded(finding.RuleID, 128), path: relative(finding.File), line: finding.StartLine, endLine: finding.EndLine });
+      }
+      if ((result.status === 10) !== (count > 0)) throw new Error();
+    } else {
+      if (!raw || !Array.isArray(raw.results)) throw new Error();
+      const ecosystems = new Set(input.database.ecosystems.map((entry) => entry.name));
+      for (const source of raw.results) {
+        const file = relative(source.source?.path);
+        if (!Array.isArray(source.packages)) throw new Error();
+        scanned.add(file);
+        for (const entry of source.packages) {
+          const ecosystem = bounded(entry.package?.ecosystem, 64);
+          if (!ecosystems.has(ecosystem) || !Array.isArray(entry.vulnerabilities ?? [])) throw new Error();
+          for (const advisory of entry.vulnerabilities ?? []) add({
+            path: file, ecosystem, package: bounded(entry.package.name), version: bounded(entry.package.version, 128), id: bounded(advisory.id, 128)
+          });
+        }
+      }
+      if ((result.status === 1) !== (count > 0) || !scanned.size) throw new Error();
+    }
+    const value = { status: "completed", complete: count <= ${SCANNER_FINDINGS_MAX} && (secret || scanned.size === approved.size), findingCount: count, findings, scannedFiles: secret ? "approved" : [...scanned] };
+    return Buffer.byteLength(JSON.stringify(value)) > ${TASK_RESULT_LIMIT - 1024} ? incomplete("output_limit") : value;
+  } catch { return incomplete("failed"); }
+}
+`;
+
+// apps/harness/src/sandbox/task-program.ts
+var TASK_PROGRAM = String.raw`
+const fs = require("node:fs");
+const crypto = require("node:crypto");
+${SPAWN_STATUS_PROGRAM}
+${SOURCE_SCANNER_PROGRAM}
+try {
+  const bytes = fs.readFileSync(0);
+  if (bytes.length > ${TASK_INPUT_LIMIT} || process.getuid() !== ${SANDBOX_UID}) throw new Error();
+  const request = JSON.parse(bytes.toString("utf8"));
+  const { tool, args, input } = request;
+  let value;
+  if (tool === "web_capture_read") {
+    if (args.id !== input.capture.id) throw new Error();
+    value = { ...input.capture, provenance: "operator-supplied-unverified" };
+  } else if (tool === "web_capture_compare") {
+    const { left, right } = input;
+    if (left.id !== args.left || right.id !== args.right || left.id === right.id || left.url !== right.url || left.method !== right.method) throw new Error();
+    value = {
+      left: left.id, right: right.id, url: left.url, method: left.method,
+      leftIdentity: left.identity, rightIdentity: right.identity,
+      leftStatus: left.status, rightStatus: right.status,
+      sameBody: left.body === right.body, provenance: "operator-supplied-unverified"
+    };
+  } else if (tool === "change_inspect") {
+    value = input;
+  } else if (["test_run", "semgrep_scan", "bash_run", "secret_scan", "dependency_scan"].includes(tool)) {
+    const path = require("node:path");
+    const child = require("node:child_process");
+    const root = fs.mkdtempSync("/tmp/mettle-task-");
+    const workspace = path.join(root, "workspace");
+    fs.mkdirSync(workspace, { recursive: true });
+    for (const file of input.files) {
+      if (!file.path || file.path.startsWith("/") || file.path.includes("\\") || file.path.split("/").some((part) => !part || part === "." || part === "..")) throw new Error();
+      const destination = path.join(workspace, file.path);
+      fs.mkdirSync(path.dirname(destination), { recursive: true });
+      fs.writeFileSync(destination, file.content, { flag: "wx", mode: 0o600 });
+    }
+    if (tool === "secret_scan" || tool === "dependency_scan") {
+      value = scanSource(tool, input, workspace, root);
+    } else if (tool === "bash_run") {
+      const profile = input.profile;
+      if (args.profileId !== profile.id || typeof profile.script !== "string" || !profile.script.length || profile.script.length > 8192 || profile.script.includes("\0") || !Number.isInteger(profile.timeoutMs) || profile.timeoutMs < 100 || profile.timeoutMs > ${CHILD_TIMEOUT_MAX_MS}) throw new Error();
+      const script = path.join(root, "approved.bash");
+      fs.writeFileSync(script, profile.script, { flag: "wx", mode: 0o600 });
+      const result = child.spawnSync("/bin/bash", ["--noprofile", "--norc", "-p", "--", script], {
+        cwd: workspace, env: { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: root, TMPDIR: root, LC_ALL: "C" },
+        stdio: ["ignore", "pipe", "pipe"], timeout: profile.timeoutMs, killSignal: "SIGKILL",
+        maxBuffer: ${TASK_INPUT_LIMIT}, encoding: "utf8", shell: false
+      });
+      const stdout = result.stdout || "";
+      const stderr = result.stderr || "";
+      const exceeded = result.error?.code === "ENOBUFS";
+      value = {
+        subject: input.subject, profileId: profile.id,
+        scriptSha256: crypto.createHash("sha256").update(profile.script).digest("hex"), verification: "not-independent",
+        status: spawnStatus(result, "completed", exceeded),
+        exitCode: result.status, signal: result.signal ?? null,
+        stdout: stdout.slice(0, ${CHILD_OUTPUT_KEEP}), stderr: stderr.slice(0, ${CHILD_OUTPUT_KEEP}),
+        truncated: stdout.length > ${CHILD_OUTPUT_KEEP} || stderr.length > ${CHILD_OUTPUT_KEEP} || exceeded
+      };
+    } else if (tool === "semgrep_scan") {
+      const environment = { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: root, TMPDIR: root, SEMGREP_SETTINGS_FILE: "/dev/null", SEMGREP_SEND_METRICS: "off", SEMGREP_ENABLE_VERSION_CHECK: "0" };
+      const version = child.spawnSync("/usr/local/bin/semgrep", ["--version"], { cwd: workspace, env: environment, timeout: ${SEMGREP_VERSION_TIMEOUT_MS}, killSignal: "SIGKILL", maxBuffer: 4096, encoding: "utf8", shell: false });
+      if (version.error?.code === "ETIMEDOUT") value = { status: "timed_out", output: "" };
+      else if (version.error || version.status !== 0) value = { status: "unavailable", output: "" };
+      else if (version.stdout.trim() !== input.version) value = { status: "version_mismatch", output: "" };
+      else {
+        const rules = path.join(root, "rules.yaml");
+        fs.writeFileSync(rules, input.rules, { flag: "wx", mode: 0o600 });
+        const scanned = child.spawnSync("/usr/local/bin/semgrep", ["scan", "--config", rules, "--json", "--quiet", "--metrics=off", "--disable-version-check", "--oss-only", "--jobs=1", "."], { cwd: workspace, env: environment, timeout: ${SEMGREP_SCAN_TIMEOUT_MS}, killSignal: "SIGKILL", maxBuffer: ${TASK_INPUT_LIMIT}, encoding: "utf8", shell: false });
+        let status = spawnStatus(scanned);
+        let output = "";
+        if (status === "completed") {
+          try {
+            const report = JSON.parse(scanned.stdout || "");
+            const results = Array.isArray(report.results) ? report.results : [];
+            output = JSON.stringify({
+              version: report.version,
+              errors: (Array.isArray(report.errors) ? report.errors : []).slice(0, 1000).map(() => ({})),
+              paths: { scanned: (report.paths && Array.isArray(report.paths.scanned) ? report.paths.scanned : []).slice(0, 10000) },
+              resultCount: results.length,
+              results: results.slice(0, ${SCANNER_FINDINGS_MAX}).map((entry) => ({ check_id: entry.check_id, path: entry.path, start: { line: entry.start.line }, end: { line: entry.end.line }, extra: { severity: entry.extra.severity, message: String(entry.extra.message).slice(0, 1024) } }))
+            });
+          } catch { status = "failed"; }
+        }
+        value = { status, output };
+      }
+    } else {
+    if (args.profileId !== input.profile.id || !input.files.some((file) => file.path === input.profile.entrypoint) || input.profile.timeoutMs < 100 || input.profile.timeoutMs > ${CHILD_TIMEOUT_MAX_MS}) throw new Error();
+    const result = child.spawnSync("/usr/local/bin/node", ["--test", "--", input.profile.entrypoint], {
+      cwd: workspace, env: { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: root, TMPDIR: root },
+      timeout: input.profile.timeoutMs, killSignal: "SIGKILL", maxBuffer: ${TASK_INPUT_LIMIT},
+      encoding: "utf8", shell: false
+    });
+    const stdout = result.stdout || "";
+    const stderr = result.stderr || "";
+    value = {
+      repository: input.repository, revision: input.revision, profileId: input.profile.id,
+      patchProposalId: input.patchProposalId, verification: "not-independent",
+      status: spawnStatus(result, "passed"),
+      exitCode: result.status, stdout: stdout.slice(0, ${CHILD_OUTPUT_KEEP}), stderr: stderr.slice(0, ${CHILD_OUTPUT_KEEP}),
+      truncated: stdout.length > ${CHILD_OUTPUT_KEEP} || stderr.length > ${CHILD_OUTPUT_KEEP} || result.error?.code === "ENOBUFS"
+    };
+    }
+  } else if (tool === "repo_read" || tool === "repo_search") {
+    const binding = { repository: input.repository, revision: input.revision };
+    if (tool === "repo_read") {
+      const file = input.files.find((entry) => entry.path === args.path);
+      if (!file) throw new Error();
+      value = { ...binding, path: file.path, content: file.content, sha256: crypto.createHash("sha256").update(file.content).digest("hex") };
+    } else {
+      const matches = [];
+      let scanned = 0;
+      let limited = false;
+      for (const file of input.files) {
+        for (const [index, line] of file.content.split("\n").entries()) {
+          if (!line.includes(args.text)) continue;
+          matches.push({ path: file.path, line: index + 1, excerpt: line.slice(0, ${REPO_EXCERPT}) });
+          if (matches.length === ${REPO_SEARCH_MATCHES}) { limited = true; break; }
+        }
+        if (limited) break;
+        scanned++;
+      }
+      value = { ...binding, scanned, total: input.total, complete: !limited && scanned === input.total, matches };
+    }
+  } else throw new Error();
+  const result = JSON.stringify({ inputDigest: crypto.createHash("sha256").update(bytes).digest("hex"), value });
+  if (Buffer.byteLength(result) > ${TASK_RESULT_LIMIT}) throw new Error();
+  fs.writeFileSync(1, result);
+} catch { process.exitCode = 1; }
+`;
+
+// apps/harness/src/sandbox/tasks.ts
+var SandboxReceiptSchema = strictObject({
+  runtime: SandboxRuntimeSchema,
+  image: string(),
+  policyDigest: string(),
+  inputDigest: string(),
+  cleanupVerified: literal(true)
+});
+function isolatedTask(tool, args, input, session) {
+  TaskNameSchema.parse(tool);
+  const bytes = Buffer.from(canonicalJson({ tool, args, input }), "utf8");
+  if (bytes.length > TASK_INPUT_LIMIT)
+    throw new HarnessError("sandbox_input_limit", "The isolated task exceeds its one-MiB input limit.");
+  return {
+    tool,
+    args,
+    input: bytes,
+    inputDigest: sha256(bytes.toString("utf8")),
+    session
+  };
+}
+function taskProfile(tool) {
+  return ["browser_workflow", "web_browse", "zap_scan"].includes(tool) ? "browser" : "tools";
+}
+function taskTimeoutMs(tool) {
+  if (["web_discover", "web_browse"].includes(tool))
+    return ACTIVE_SCAN_TASK_TIMEOUT_MS;
+  if (ACTIVE_SCAN_TOOLS.some((name) => name === tool))
+    return ACTIVE_SCAN_TASK_TIMEOUT_MS;
+  if (["secret_scan", "dependency_scan"].includes(tool))
+    return SOURCE_SCANNER_TASK_TIMEOUT_MS;
+  return tool === "semgrep_scan" ? SEMGREP_TASK_TIMEOUT_MS : TASK_TIMEOUT_MS;
+}
+function taskSpec(image, labels, profile, runtime) {
+  return {
+    ...launchSpec(image, "", labels, profile, runtime),
+    Entrypoint: ["/bin/sleep"],
+    Cmd: [String(TASK_CONTAINER_LIFETIME_S)]
+  };
+}
+function taskExecSpec(live, runtime) {
+  const base = launchSpec("", "", {}, "probe", runtime);
+  const program = live ? LIVE_PROGRAM : TASK_PROGRAM;
+  return {
+    User: base.User,
+    Privileged: false,
+    Tty: false,
+    AttachStdin: true,
+    AttachStdout: true,
+    AttachStderr: true,
+    WorkingDir: base.WorkingDir,
+    Env: base.Env,
+    Cmd: [
+      "/usr/local/bin/node",
+      "-e",
+      runtime === "runc" ? `if (!/^Seccomp:\\s+2$/m.test(require("node:fs").readFileSync("/proc/self/status", "utf8"))) process.exit(1);
+${program}` : program
+    ]
+  };
+}
+function taskRuntimeDigest(image, runtime) {
+  return digest({
+    specs: {
+      tools: taskSpec(image, {}, "tools", runtime),
+      browser: taskSpec(image, {}, "browser", runtime)
+    },
+    exec: taskExecSpec(false, runtime),
+    liveExec: taskExecSpec(true, runtime),
+    timeoutMs: Object.fromEntries(TaskNameSchema.options.map((tool) => [tool, taskTimeoutMs(tool)]))
+  });
+}
+function taskPolicyDigest(image, task, runtime) {
+  const profile = taskProfile(task.tool);
+  return digest({
+    profile,
+    spec: taskSpec(image, {}, profile, runtime),
+    exec: taskExecSpec(isLiveTask(task.tool), runtime),
+    tool: task.tool,
+    inputDigest: task.inputDigest,
+    timeoutMs: taskTimeoutMs(task.tool)
+  });
+}
+function isLiveTask(tool) {
+  return [
+    "http_request",
+    "web_discover",
+    "web_request",
+    "web_browse",
+    "session_health",
+    "browser_workflow",
+    ...ACTIVE_SCAN_TOOLS
+  ].includes(tool);
+}
+
+// apps/harness/src/sandbox/worker.ts
+async function checkSandbox(config, engine) {
+  const info = dockerJson(await engine.call("GET", "/info"));
+  const selected = sandboxRuntime(SandboxConfigSchema.parse(config));
+  const runtime = info?.Runtimes?.[selected];
+  if (info?.OSType !== "linux" || typeof info.ID !== "string" || !info.ID || config.engineId !== undefined && info.ID !== config.engineId || !runtime || typeof runtime.path !== "string" || (selected === GVISOR_RUNTIME ? !/(^|\/)runsc$/.test(runtime.path) || !Array.isArray(runtime.runtimeArgs) || canonicalJson(runtime.runtimeArgs) !== canonicalJson(["--platform=systrap"]) : !/(^|\/)runc$/.test(runtime.path) || runtime.runtimeArgs !== undefined && (!Array.isArray(runtime.runtimeArgs) || runtime.runtimeArgs.length !== 0)) || info.MemoryLimit !== true || info.CpuCfsQuota !== true || info.PidsLimit !== true)
+    throw new HarnessError("sandbox_unavailable", `A Linux engine with ${selected === GVISOR_RUNTIME ? "mettle-runsc systrap" : "runc without custom runtime arguments"} and resource controllers is required; runtime fallback is forbidden.`);
+  if (selected === "runc" && (!Array.isArray(info.SecurityOptions) || !info.SecurityOptions.some((option) => typeof option === "string" && option.split(",").includes("name=seccomp"))))
+    throw new HarnessError("sandbox_unavailable", "Local Docker requires kernel seccomp support and the explicit builtin profile.");
+  const image = dockerJson(await engine.call("GET", `/images/${encodeURIComponent(config.image)}/json`));
+  if (!Array.isArray(image?.RepoDigests) || !image.RepoDigests.includes(config.image) || Object.keys(image.Config?.Volumes ?? {}).length !== 0)
+    throw new HarnessError("sandbox_image", "Preload the approved digest-pinned probe image without declared volumes.");
+  return info.ID;
+}
+async function sandboxFromEnvironment(chat, environment = process.env) {
+  if (!environment.HARNESS_SANDBOX_IMAGE) {
+    if (environment.HARNESS_SANDBOX_RUNTIME !== undefined)
+      throw new HarnessError("sandbox_config", "An explicit sandbox runtime requires HARNESS_SANDBOX_IMAGE.");
+    return;
+  }
+  if (!chat)
+    throw new HarnessError("sandbox_config", "HARNESS_SANDBOX_IMAGE requires HARNESS_CHAT=1.");
+  const config = sandboxConfig(environment);
+  await checkSandbox(config, new DockerEngine(config.socket));
+  return config;
+}
+var CONTAINMENT_FINDINGS = new Set([
+  "sandbox_policy",
+  "sandbox_identity",
+  "sandbox_probe_failed",
+  "sandbox_output",
+  "sandbox_missing"
+]);
+function containmentFinding(error) {
+  return error instanceof HarnessError && CONTAINMENT_FINDINGS.has(error.code);
+}
+function cancelled(error) {
+  return !(error instanceof HarnessError) || error.code === "sandbox_transport" || error.code === "stop_requested";
+}
+function jobSpec(record2, job, runtime) {
+  const labels = sandboxLabels(record2);
+  if (job?.kind === "task")
+    return taskSpec(record2.image, labels, taskProfile(job.task.tool), runtime);
+  if (job?.kind === "shell")
+    return shellSpec(record2.image, job.command, labels, runtime);
+  return launchSpec(record2.image, probeScript(runtime), labels, "probe", runtime);
+}
+
+class SandboxWorker {
+  engine;
+  journal;
+  createBroker;
+  config;
+  runtime;
+  constructor(config, engine, journal, createBroker) {
+    this.engine = engine;
+    this.journal = journal;
+    this.createBroker = createBroker;
+    this.config = Object.freeze(SandboxConfigSchema.parse(config));
+    this.runtime = sandboxRuntime(this.config);
+  }
+  tool() {
+    return {
+      name: PROBE_TOOL,
+      description: "Run the fixed offline sandbox installation probe; no target, shell arguments or file inputs are accepted.",
+      schema: strictObject({}),
+      outputSchema: strictObject({
+        probe: literal("passed"),
+        runtime: literal(this.runtime),
+        image: string(),
+        cleanupVerified: literal(true)
+      }),
+      label: () => "Check sandbox",
+      summarizeArgs: () => "",
+      summarizeResult: () => ({ summary: "Probe passed" }),
+      execute: (_input, signal, callId) => this.execute(callId, signal, undefined)
+    };
+  }
+  shellTools() {
+    return sandboxAllowsExecution(this.config, SHELL_TOOL) ? [this.shellTool()] : [];
+  }
+  shellTool() {
+    if (!sandboxAllowsExecution(this.config, SHELL_TOOL))
+      throw new HarnessError("sandbox_denied", "Shell and repository code execution require gVisor.");
+    return {
+      name: SHELL_TOOL,
+      description: `Run one POSIX shell command inside a disposable gVisor container: no network, no host files, no writable path, unprivileged user, ${PROBE_TIMEOUT_MS / 1000}-second limit, output cut at ${SHELL_OUTPUT_MAX} bytes. Returns exit code and captured output.`,
+      schema: ShellCommandSchema,
+      outputSchema: strictObject({
+        command: string(),
+        exitCode: number().int().nullable(),
+        timedOut: boolean(),
+        output: string(),
+        truncated: boolean(),
+        runtime: literal(this.runtime),
+        image: string(),
+        cleanupVerified: literal(true)
+      }),
+      label: () => "Run shell command",
+      summarizeArgs: (args) => {
+        const parsed = ShellCommandSchema.safeParse(args);
+        return parsed.success ? `$ ${parsed.data.command.split(`
+`)[0]}` : "shell command";
+      },
+      summarizeResult: (output) => {
+        const value = output;
+        const suffix = value.truncated ? " (truncated)" : "";
+        if (value.timedOut)
+          return { summary: `Timed out${suffix}` };
+        const lines = value.output ? value.output.split(`
+`).length : 0;
+        return {
+          summary: `Exit ${value.exitCode} · ${counted(lines, "line")}${suffix}`
+        };
+      },
+      execute: async (input, signal, callId) => {
+        const { command } = ShellCommandSchema.parse(input);
+        return this.execute(callId, signal, { kind: "shell", command });
+      }
+    };
+  }
+  runTask = (tool, args, input, signal, callId, session) => {
+    if (!sandboxAllowsExecution(this.config, tool))
+      return Promise.reject(new HarnessError("sandbox_denied", "Shell and repository code execution require gVisor."));
+    return this.execute(callId, signal, {
+      kind: "task",
+      task: isolatedTask(tool, args, input, session)
+    });
+  };
+  async inspect(record2) {
+    const response = await this.engine.call("GET", `/containers/${record2.containerId ?? record2.name}/json`);
+    if (response.status === 404)
+      return;
+    const container = dockerJson(response);
+    const expected = sandboxLabels(record2);
+    if (!/^[a-f0-9]{64}$/.test(container?.Id ?? "") || record2.containerId && container.Id !== record2.containerId || container.Name !== `/${record2.name}` || container.Config?.Image !== record2.image || Object.entries(expected).some(([key, value]) => container.Config?.Labels?.[key] !== value))
+      throw new HarnessError("sandbox_identity", "The container does not match its durable reservation; it will not be executed or removed.");
+    return container;
+  }
+  assertPolicy(container, record2, job) {
+    const spec = jobSpec(record2, job, this.runtime);
+    for (const key of [
+      "User",
+      "WorkingDir",
+      "Entrypoint",
+      "Cmd",
+      "Tty",
+      "OpenStdin",
+      "NetworkDisabled",
+      "Healthcheck"
+    ]) {
+      if (canonicalJson(container.Config?.[key] ?? (key === "NetworkDisabled" ? false : null)) !== canonicalJson(spec[key]))
+        throw new HarnessError("sandbox_policy", "The engine did not retain the required sandbox policy.");
+    }
+    for (const key of [
+      "Runtime",
+      "NetworkMode",
+      "ReadonlyRootfs",
+      "Privileged",
+      "CapDrop",
+      "SecurityOpt",
+      "Memory",
+      "MemorySwap",
+      "NanoCpus",
+      "PidsLimit",
+      "RestartPolicy"
+    ]) {
+      if (canonicalJson(container.HostConfig?.[key] ?? null) !== canonicalJson(spec.HostConfig[key]))
+        throw new HarnessError("sandbox_policy", "The engine did not retain the required sandbox policy.");
+    }
+    const env = container.Config?.Env ?? [];
+    if (!spec.Env.every((entry) => env.includes(entry)))
+      throw new HarnessError("sandbox_policy", "The engine did not retain the required sandbox environment.");
+    const log = container.HostConfig?.LogConfig;
+    if (log?.Type !== spec.HostConfig.LogConfig.Type || Object.entries(spec.HostConfig.LogConfig.Config).some(([key, value]) => log?.Config?.[key] !== value))
+      throw new HarnessError("sandbox_policy", "The engine did not retain the required sandbox log policy.");
+    const containment = object({
+      Mounts: array(looseObject({ Type: string(), Destination: string() })),
+      HostConfig: looseObject({
+        Binds: array(string()).nullable(),
+        Devices: array(unknown()).nullable(),
+        DeviceRequests: array(unknown()).nullable(),
+        CapAdd: array(string()).nullable(),
+        VolumesFrom: array(string()).nullable(),
+        PortBindings: record(string(), unknown()).nullable()
+      })
+    }).safeParse(container);
+    if (!containment.success)
+      throw new HarnessError("sandbox_policy", "The engine inspect response omitted a required containment field; an absent mount, device or port surface cannot be certified empty.");
+    const tmpfs = spec.HostConfig.Tmpfs ?? {};
+    const mounts = container.Mounts ?? [];
+    if (canonicalJson(container.HostConfig?.Tmpfs ?? {}) !== canonicalJson(tmpfs) || mounts.some((mount) => mount?.Type !== "tmpfs" || !Object.hasOwn(tmpfs, mount.Destination)) || container.HostConfig?.Binds?.length || container.HostConfig?.Devices?.length || container.HostConfig?.CapAdd?.length || container.HostConfig?.VolumesFrom?.length || container.HostConfig?.DeviceRequests?.length || container.HostConfig?.PublishAllPorts || Object.keys(container.HostConfig?.PortBindings ?? {}).length || ["PidMode", "IpcMode", "UTSMode", "UsernsMode"].some((key) => container.HostConfig?.[key] === "host" || String(container.HostConfig?.[key] ?? "").startsWith("container:")))
+      throw new HarnessError("sandbox_policy", "Unexpected sandbox mounts, devices or capabilities are forbidden.");
+  }
+  async cleanup(record2, workerId) {
+    if (record2.workerId !== workerId)
+      throw new HarnessError("sandbox_worker_mismatch", "Cleanup must run against the original Docker engine.");
+    const container = await this.inspect(record2);
+    if (!container) {
+      if (!record2.containerId)
+        throw new HarnessError("sandbox_uncertain", "Container creation was not acknowledged; absence cannot prove that a delayed create will not arrive.");
+    } else {
+      dockerStatus(await this.engine.call("DELETE", `/containers/${container.Id}?force=true`), 204);
+      const absent = await this.engine.call("GET", `/containers/${container.Id}/json`);
+      if (absent.status !== 404)
+        throw new HarnessError("sandbox_cleanup_failed", "Container removal has not been verified.");
+    }
+    await this.journal.removed(record2);
+  }
+  async engineId() {
+    const info = dockerJson(await this.engine.call("GET", "/info"));
+    if (typeof info?.ID !== "string" || !info.ID)
+      throw new HarnessError("sandbox_unavailable", "The original Docker engine identity is required.");
+    return info.ID;
+  }
+  async reap(workerId) {
+    const id = workerId ?? await this.engineId();
+    const pending = await this.journal.pending();
+    for (const record2 of pending)
+      await this.cleanup(record2, id);
+    return pending.length;
+  }
+  async execute(callId, signal, job) {
+    const task = job?.kind === "task" ? job.task : undefined;
+    const shell = job?.kind === "shell";
+    if (signal.aborted)
+      throw new HarnessError("stop_requested", "Sandbox execution was stopped before admission.");
+    const workerId = await checkSandbox(this.config, this.engine);
+    if (signal.aborted)
+      throw new HarnessError("stop_requested", "Sandbox execution was stopped before allocation.");
+    const record2 = await this.journal.reserve(callId, workerId, this.config.image, task ? taskPolicyDigest(this.config.image, task, this.runtime) : job?.kind === "shell" ? shellPolicyDigest(this.config.image, job.command, this.runtime) : probePolicyDigest(this.config.image, this.runtime), task ? { tool: task.tool, args: task.args } : job?.kind === "shell" ? { tool: SHELL_TOOL, args: { command: job.command } } : undefined);
+    const deadline = AbortSignal.timeout(task ? taskTimeoutMs(task.tool) : PROBE_TIMEOUT_MS);
+    const bounded = AbortSignal.any([signal, deadline]);
+    let primary;
+    let value;
+    let exitCode = null;
+    let output = Buffer.alloc(0);
+    try {
+      await this.journal.provision(record2, async () => {
+        const created = dockerCreated(await this.engine.call("POST", `/containers/create?name=${record2.name}`, jobSpec(record2, job, this.runtime), bounded, ENGINE_LAUNCH_TIMEOUT_MS));
+        if (!/^[a-f0-9]{64}$/.test(created?.Id ?? ""))
+          throw new HarnessError("sandbox_protocol", "Container creation did not return a valid identity.");
+        return created.Id;
+      });
+      const container = await this.inspect(record2);
+      if (!container)
+        throw new HarnessError("sandbox_missing", "The created sandbox disappeared before execution.");
+      this.assertPolicy(container, record2, job);
+      await this.journal.start(record2, async () => {
+        if (bounded.aborted)
+          throw new HarnessError("stop_requested", "Sandbox dispatch was cancelled.");
+        dockerStatus(await this.engine.call("POST", `/containers/${record2.containerId}/start`, undefined, bounded, ENGINE_LAUNCH_TIMEOUT_MS), 204);
+      });
+      if (task)
+        value = await this.runIsolated(record2, task, bounded);
+      else {
+        const exit = await this.engine.call("POST", `/containers/${record2.containerId}/wait?condition=not-running`, undefined, bounded, PROBE_TIMEOUT_MS).then((response) => dockerJson(response), (error) => {
+          if (shell && deadline.aborted && !signal.aborted && cancelled(error))
+            return;
+          throw error;
+        });
+        if (exit !== undefined) {
+          if (!Number.isInteger(exit?.StatusCode) || exit.Error)
+            throw new HarnessError("sandbox_protocol", "The sandbox engine did not report a valid exit status.");
+          if (!shell && exit.StatusCode !== 0)
+            throw new HarnessError("sandbox_probe_failed", "The fixed sandbox probe did not exit successfully.");
+          exitCode = exit.StatusCode;
+        }
+        const logs = await this.engine.call("GET", `/containers/${record2.containerId}/logs?stdout=true${shell ? "&stderr=true" : ""}`, undefined, shell ? signal : bounded, undefined, shell ? SHELL_LOG_LIMIT : undefined);
+        if (shell)
+          output = dockerFrames(logs, "both");
+        else if (dockerLogs(logs) !== PROBE_MARKER)
+          throw new HarnessError("sandbox_probe_failed", "The fixed sandbox probe returned unexpected output.");
+      }
+      if (signal.aborted || !shell && deadline.aborted)
+        throw new HarnessError("stop_requested", "Sandbox execution was cancelled.");
+    } catch (error) {
+      primary = containmentFinding(error) ? error : signal.aborted ? new HarnessError("stop_requested", "Sandbox execution was cancelled; no result is invented.") : deadline.aborted && cancelled(error) ? new HarnessError("sandbox_timeout", "The sandbox exceeded its wall deadline.") : error;
+    }
+    try {
+      if (primary instanceof HarnessError && primary.code === "sandbox_rejected" && !record2.containerId)
+        await this.journal.removed(record2);
+      else
+        await this.cleanup(record2, workerId);
+    } catch (cleanupError) {
+      if (!containmentFinding(primary))
+        primary = cleanupError;
+    }
+    if (primary !== undefined)
+      throw primary;
+    if (task)
+      return {
+        ...value,
+        sandbox: {
+          runtime: this.runtime,
+          image: record2.image,
+          policyDigest: record2.policyDigest,
+          inputDigest: task.inputDigest,
+          cleanupVerified: true
+        }
+      };
+    if (job?.kind === "shell") {
+      const truncated = output.length > SHELL_OUTPUT_MAX;
+      return {
+        command: job.command,
+        exitCode,
+        timedOut: exitCode === null,
+        output: new TextDecoder("utf-8").decode(output.subarray(0, SHELL_OUTPUT_MAX), { stream: truncated }),
+        truncated,
+        runtime: this.runtime,
+        image: record2.image,
+        cleanupVerified: true
+      };
+    }
+    return {
+      probe: "passed",
+      runtime: this.runtime,
+      image: record2.image,
+      cleanupVerified: true
+    };
+  }
+  async runIsolated(record2, task, signal) {
+    const live = isLiveTask(task.tool);
+    if (live && !this.createBroker)
+      throw new HarnessError("web_denied", "Live tasks require the operator-approved broker; no network fallback is allowed.");
+    const spec = taskExecSpec(live, this.runtime);
+    const created = dockerJson(await this.engine.call("POST", `/containers/${record2.containerId}/exec`, spec, signal), 201);
+    if (!/^[a-f0-9]{64}$/.test(created?.Id ?? ""))
+      throw new HarnessError("sandbox_protocol", "The engine did not return an isolated exec identity.");
+    const inspect = () => this.engine.call("GET", `/exec/${created.Id}/json`, undefined, signal).then((response) => dockerJson(response));
+    const initial = await inspect();
+    if (initial.ID !== created.Id || initial.ContainerID !== record2.containerId || initial.Running !== false || initial.OpenStdin !== true || initial.OpenStdout !== true || initial.OpenStderr !== true || initial.ProcessConfig?.privileged !== false || initial.ProcessConfig?.tty !== false || initial.ProcessConfig?.user !== spec.User || initial.ProcessConfig?.entrypoint !== spec.Cmd[0] || canonicalJson(initial.ProcessConfig?.arguments) !== canonicalJson(spec.Cmd.slice(1)))
+      throw new HarnessError("sandbox_policy", "The engine did not retain the fixed isolated task command.");
+    await this.journal.assertTaskRunning(record2);
+    const broker = live ? await this.createBroker(task, signal, record2.callId) : undefined;
+    let refusal;
+    const exchange = broker ? async (request) => {
+      try {
+        await this.journal.assertTaskRunning(record2);
+        const response = await broker.request(request);
+        await this.journal.assertTaskRunning(record2);
+        return response;
+      } catch (error) {
+        refusal ??= error;
+        throw error;
+      }
+    } : undefined;
+    await this.journal.assertTaskRunning(record2);
+    const session = await this.engine.startExec(created.Id, task.input, signal, taskTimeoutMs(task.tool), exchange);
+    try {
+      return await this.collectIsolated(record2, task, created.Id, session, inspect, signal, broker);
+    } catch (error) {
+      if (broker?.inFlight())
+        throw new HarnessError("web_uncertain", "A live request was in flight when the task failed; inspect the journal before any retry.");
+      if (refusal !== undefined)
+        throw refusal;
+      throw error;
+    }
+  }
+  async collectIsolated(record2, task, execId, session, inspect, signal, broker) {
+    const created = { Id: execId };
+    const output = dockerLogs(await session.result);
+    if (Buffer.byteLength(output) > TASK_RESULT_LIMIT)
+      throw new HarnessError("sandbox_output_limit", "The isolated result exceeds its size limit.");
+    while (true) {
+      const status = await inspect();
+      if (status.ID !== created.Id || status.ContainerID !== record2.containerId || typeof status.Running !== "boolean")
+        throw new HarnessError("sandbox_identity", "The exec changed container identity.");
+      if (!status.Running) {
+        if (status.ExitCode !== 0)
+          throw new HarnessError("sandbox_task_failed", "The fixed isolated observation failed; no result is invented.");
+        break;
+      }
+      await sleep(50, undefined, { signal });
+    }
+    let result;
+    try {
+      result = JSON.parse(output);
+    } catch {
+      throw new HarnessError("sandbox_output", "The isolated result is not JSON.");
+    }
+    if (!result || result.inputDigest !== task.inputDigest || !result.value || typeof result.value !== "object" || Array.isArray(result.value))
+      throw new HarnessError("sandbox_output", "The isolated output does not match its exact input.");
+    return broker ? broker.finish(result.value) : result.value;
+  }
+}
+
+export { COMMIT_HEX, CommitSchema, IdSchema, RepositoryPathSchema, RepositoryConfigSchema, hasRepositorySource, RepositoryTestProfileSchema, BashProfilesSchema, SemgrepProfileSchema, WebCaptureSchema, PermissionPolicySchema, GVISOR_RUNTIME, SandboxConfigSchema, sandboxRuntime, sandboxAllowsExecution, SCANNER_CAPABILITIES, SUBJECT_CAPABILITIES, PROBE_TOOL, SHELL_TOOL, SANDBOX_TOOLS, counted, ran, scanned, ToolRegistry, HTTP_HEADER_LIMIT, HTTP_RESPONSE_LIMIT, WEBSITE_RESPONSE_LIMIT, withinHttpScope, SecretScanProfileSchema, DependencyScanProfileSchema, SCANNER_FINDINGS_MAX, ScannerStatusSchema, REPO_SEARCH_FILES, REPO_SEARCH_MATCHES, REPO_EXCERPT, DockerEngine, dockerJson, sandboxConfig, ACTIVE_SCAN_TASK_TIMEOUT_MS, ACTIVE_SCAN_TOOLS, ActiveScannersSchema, scannerEndpoint, validateActiveScanners, SCANNER_REQUEST_STRIP_HEADERS, scannerRequestAllowed, sqlmapCandidate, SandboxReceiptSchema, taskRuntimeDigest, checkSandbox, sandboxFromEnvironment, SandboxWorker };