@odla-ai/harness 0.1.0

package/dist/chunk-GMVZ4LZH.js

@@ -0,0 +1,1769 @@
+import {
+  assertPinnedImage,
+  runContainerAttempt,
+  stageWorkspace,
+  stageWorkspacePair,
+  verifyContainerEngineBoundary
+} from "./chunk-PHXQH4YM.js";
+import {
+  HARNESS_PROTOCOL_VERSION
+} from "./chunk-QTUEF2HZ.js";
+
+// src/workspace-digest.ts
+import { createHash } from "crypto";
+import { readFile, readdir } from "fs/promises";
+import { relative, resolve } from "path";
+async function digestStagedWorkspace(root, limits) {
+  const files = [];
+  const walk = async (directory) => {
+    const entries = await readdir(directory, { withFileTypes: true });
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+      if (entry.isSymbolicLink()) throw new TypeError("workspace digest refuses symbolic links");
+      const target = resolve(directory, entry.name);
+      if (entry.isDirectory()) await walk(target);
+      else if (entry.isFile()) {
+        files.push({ path: relative(root, target).split("\\").join("/"), target });
+        if (files.length > limits.maxFiles) throw new TypeError("workspace digest exceeds its file bound");
+      }
+    }
+  };
+  await walk(resolve(root));
+  const hash = createHash("sha256");
+  let bytes = 0;
+  for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
+    const content = await readFile(file.target);
+    bytes += Buffer.byteLength(file.path) + content.byteLength;
+    if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
+    hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content.byteLength}:`);
+    hash.update(content);
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+
+// src/code-runtime-client.ts
+import { digestCodeRepositorySnapshot } from "@odla-ai/camel/code";
+
+// src/code-runtime.ts
+var CODE_RUNTIME_PROTOCOL_VERSION = 1;
+async function runCodeRuntimeHeartbeatLoop(options) {
+  const heartbeatMs = options.heartbeatMs ?? 15e3;
+  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1e3 || heartbeatMs > 3e5) {
+    throw new TypeError("heartbeatMs must be an integer from 1000 to 300000");
+  }
+  let retryMs = 1e3;
+  do {
+    if (options.signal?.aborted) return;
+    try {
+      const snapshot = await options.control.heartbeat(options.runtimeVersion, options.capabilities);
+      await options.onSnapshot?.(snapshot);
+      retryMs = 1e3;
+      if (options.once) return;
+      await wait(heartbeatMs, options.signal);
+    } catch (error) {
+      if (options.signal?.aborted) return;
+      if (options.once || !retryableControlFailure(error)) throw error;
+      await options.onRetry?.(error, retryMs);
+      await wait(retryMs, options.signal);
+      retryMs = Math.min(retryMs * 2, 3e4);
+    }
+  } while (!options.signal?.aborted);
+}
+var CodeRuntimeReconciler = class {
+  constructor(control, engine) {
+    this.control = control;
+    this.engine = engine;
+  }
+  control;
+  engine;
+  results = /* @__PURE__ */ new Map();
+  async reconcile(snapshot) {
+    for (const command of snapshot.commands) {
+      let completed = this.results.get(command.commandId);
+      if (!completed) {
+        let result;
+        try {
+          result = await this.engine.execute(command);
+        } catch (error) {
+          result = { status: "failed", message: (error instanceof Error ? error.message : String(error)).slice(0, 2e3) };
+        }
+        completed = { result, notified: false };
+        this.results.set(command.commandId, completed);
+        if (this.results.size > 1024) this.results.delete(this.results.keys().next().value);
+      }
+      await this.control.acknowledge(command.commandId, completed.result);
+      if (!completed.notified) {
+        await this.engine.acknowledged?.(command, completed.result);
+        completed.notified = true;
+      }
+    }
+  }
+};
+function retryableControlFailure(value) {
+  if (!value || typeof value !== "object") return false;
+  const failure = value;
+  if (failure.code === "invalid_response" || typeof failure.status !== "number") return false;
+  return failure.status === 408 || failure.status === 425 || failure.status === 429 || failure.status >= 500;
+}
+function wait(ms, signal) {
+  return new Promise((resolve5) => {
+    if (signal?.aborted) return resolve5();
+    const timer = setTimeout(resolve5, ms);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      resolve5();
+    }, { once: true });
+  });
+}
+
+// src/code-runtime-client.ts
+var CodeRuntimeControlError = class extends Error {
+  constructor(message2, status, code = "control_error") {
+    super(message2);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+  name = "CodeRuntimeControlError";
+};
+function createCodeRuntimeControlClient(options) {
+  const endpoint = validatedEndpoint(options.endpoint);
+  if (!/^odla_code_host_[0-9a-f]{64}$/.test(options.token)) throw new TypeError("invalid Code host credential");
+  const requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
+  if (!Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 1e3 || requestTimeoutMs > 12e4) {
+    throw new TypeError("requestTimeoutMs must be an integer from 1000 to 120000");
+  }
+  const modelRequestTimeoutMs = options.modelRequestTimeoutMs ?? 15 * 6e4;
+  if (!Number.isSafeInteger(modelRequestTimeoutMs) || modelRequestTimeoutMs < 3e4 || modelRequestTimeoutMs > 30 * 6e4) {
+    throw new TypeError("modelRequestTimeoutMs must be an integer from 30000 to 1800000");
+  }
+  const request = options.fetch ?? fetch;
+  const call = async (path, body, timeoutMs = requestTimeoutMs) => {
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+    let response2;
+    try {
+      response2 = await request(`${endpoint}${path}`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${options.token}`, "content-type": "application/json" },
+        body: JSON.stringify(body),
+        redirect: "error",
+        signal
+      });
+    } catch (cause) {
+      if (options.signal?.aborted) throw cause;
+      throw new CodeRuntimeControlError("Code runtime control plane is unavailable", 503, "transport_unavailable");
+    }
+    const value = await response2.json().catch(() => null);
+    if (!response2.ok) {
+      const problem = record(record(value)?.error);
+      throw new CodeRuntimeControlError(
+        typeof problem?.message === "string" ? problem.message : `Code runtime request failed (${response2.status})`,
+        response2.status,
+        typeof problem?.code === "string" ? problem.code : void 0
+      );
+    }
+    return value;
+  };
+  return {
+    heartbeat: async (version, capabilities) => {
+      validateHeartbeat(version, capabilities);
+      return parseSnapshot(await call("/registry/code/runtime/heartbeat", { runtimeVersion: version, capabilities }));
+    },
+    acknowledge: async (commandId, result) => {
+      if (!/^ccmd_[0-9a-f]{32}$/.test(commandId)) throw new TypeError("invalid Code runtime command id");
+      await call(`/registry/code/runtime/commands/${commandId}/ack`, result);
+    },
+    source: async (sessionId) => parseSource(
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
+    ),
+    infer: async (sessionId, inference) => {
+      const value = record(await call(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`,
+        inference,
+        modelRequestTimeoutMs
+      ));
+      if (!value || value.requestId !== inference.requestId || !record(value.response) || !record(value.receipt)) {
+        throw new CodeRuntimeControlError("invalid Code inference response", 502, "invalid_response");
+      }
+      return value;
+    },
+    review: async (sessionId, review) => parseReview(
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/review`, review, modelRequestTimeoutMs)
+    ),
+    submitCandidate: async (sessionId, checkpointId, verification) => {
+      if (!/^cpoint_[0-9a-f]{32}$/.test(checkpointId)) throw new TypeError("invalid Code checkpoint id");
+      return parseCandidate(await call(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/candidates`,
+        { checkpointId, verification }
+      ));
+    },
+    appendSessionEvent: async (sessionId, eventId, event) => {
+      const serialized = JSON.stringify(event);
+      if (!/^[A-Za-z0-9._:-]{1,120}$/.test(eventId) || !event || typeof event !== "object" || new TextEncoder().encode(serialized).byteLength > 24e3) {
+        throw new TypeError("invalid Code session event");
+      }
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
+    },
+    reportSessionFailure: async (sessionId, message2) => {
+      if (!message2.trim() || message2.length > 2e3) throw new TypeError("invalid Code session failure");
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
+    }
+  };
+}
+function validatedEndpoint(value) {
+  const endpoint = value.replace(/\/+$/, "");
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    throw new TypeError("endpoint must be an HTTPS URL");
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.username || url.password || url.protocol !== "https:" && !(loopback && url.protocol === "http:")) {
+    throw new TypeError("endpoint must use HTTPS (HTTP is allowed only for loopback testing)");
+  }
+  return endpoint;
+}
+function validSessionId(value) {
+  if (!/^csess_[0-9a-f]{32}$/.test(value)) throw new TypeError("invalid Code session id");
+  return value;
+}
+function validateHeartbeat(version, capabilities) {
+  if (!version.trim() || version.length > 80) throw new TypeError("runtimeVersion is required and at most 80 characters");
+  if (capabilities.protocolVersion !== CODE_RUNTIME_PROTOCOL_VERSION) throw new TypeError("unsupported Code runtime protocol version");
+  if (capabilities.platform !== "macos" && capabilities.platform !== "linux") throw new TypeError("invalid runtime platform");
+  if (!capabilities.arch || !capabilities.engines.length || !capabilities.engines.every((engine) => ["container", "podman", "docker"].includes(engine))) {
+    throw new TypeError("runtime arch and supported engine are required");
+  }
+  if (!Number.isSafeInteger(capabilities.cpuCount) || capabilities.cpuCount < 1 || !Number.isSafeInteger(capabilities.memoryBytes) || capabilities.memoryBytes < 1) {
+    throw new TypeError("runtime resources must be positive integers");
+  }
+}
+function parseSnapshot(value) {
+  const root = record(value);
+  const host = record(root?.host);
+  if (!host || typeof host.hostId !== "string" || typeof host.runtimeVersion !== "string" || !Number.isSafeInteger(host.lastSeenAt) || host.revokedAt !== null || !Array.isArray(root?.bindings) || root.bindings.length > 1024 || !Array.isArray(root?.commands) || root.commands.length > 64) throw invalid("heartbeat");
+  const bindingIds = /* @__PURE__ */ new Set();
+  const bindings = root.bindings.map((item) => {
+    const binding = record(item);
+    if (!binding || typeof binding.bindingId !== "string" || typeof binding.appId !== "string" || binding.env !== "dev" && binding.env !== "prod" || typeof binding.offerId !== "string" || binding.hostId !== host.hostId || !Number.isSafeInteger(binding.generation) || Number(binding.generation) < 1 || binding.revokedAt !== null || bindingIds.has(binding.bindingId)) {
+      throw invalid("binding");
+    }
+    bindingIds.add(binding.bindingId);
+    return binding;
+  });
+  const commandIds = /* @__PURE__ */ new Set();
+  const commandSequences = /* @__PURE__ */ new Set();
+  const commands = root.commands.map((item) => {
+    const command = record(item);
+    const binding = bindings.find((candidate) => candidate.bindingId === command?.bindingId);
+    const sequenceKey = `${String(command?.instanceId)}:${String(command?.sequence)}`;
+    if (!command || typeof command.commandId !== "string" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId) || typeof command.instanceId !== "string" || typeof command.sessionId !== "string" || !/^csess_[0-9a-f]{32}$/.test(command.sessionId) || typeof command.appId !== "string" || command.env !== "dev" && command.env !== "prod" || command.hostId !== host.hostId || !binding || binding.appId !== command.appId || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence) || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey) || !["start", "prompt", "checkpoint_stop", "resume"].includes(String(command.kind)) || !record(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid("command");
+    commandIds.add(command.commandId);
+    commandSequences.add(sequenceKey);
+    return command;
+  });
+  return { host, bindings, commands };
+}
+async function parseSource(value) {
+  const snapshot = record(record(value)?.snapshot);
+  if (!snapshot || typeof snapshot.repository !== "string" || typeof snapshot.commitSha !== "string" || typeof snapshot.treeDigest !== "string" || !Array.isArray(snapshot.files)) throw invalid("source");
+  const files = snapshot.files.map((value2) => {
+    const file = record(value2);
+    if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("source file");
+    return { path: file.path, content: file.content };
+  });
+  const referencesValue = snapshot.references === void 0 ? [] : snapshot.references;
+  if (!Array.isArray(referencesValue) || referencesValue.length > 5) throw invalid("reference sources");
+  const aliases = /* @__PURE__ */ new Set();
+  const references = [];
+  for (const item of referencesValue) {
+    const reference = record(item);
+    if (!reference || typeof reference.alias !== "string" || !/^[a-z][a-z0-9-]{0,39}$/.test(reference.alias) || aliases.has(reference.alias) || reference.alias === "primary" || typeof reference.repository !== "string" || typeof reference.commitSha !== "string" || typeof reference.treeDigest !== "string" || !Array.isArray(reference.files)) throw invalid("reference source");
+    aliases.add(reference.alias);
+    const referenceFiles = reference.files.map((entry) => {
+      const file = record(entry);
+      if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("reference source file");
+      return { path: file.path, content: file.content };
+    });
+    const source2 = { repository: reference.repository, commitSha: reference.commitSha, files: referenceFiles };
+    const referenceDigest = await digestCodeRepositorySnapshot(source2, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
+    if (referenceDigest !== reference.treeDigest) throw invalid("reference source digest");
+    references.push({ alias: reference.alias, ...source2, treeDigest: referenceDigest });
+  }
+  const source = { repository: snapshot.repository, commitSha: snapshot.commitSha, files };
+  const digest = await digestCodeRepositorySnapshot(source, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
+  if (digest !== snapshot.treeDigest) throw invalid("source digest");
+  return { ...source, treeDigest: digest, ...references.length ? { references } : {} };
+}
+function parseReview(value) {
+  const review = record(record(value)?.review);
+  if (!review || !["approved", "rejected"].includes(String(review.verdict)) || typeof review.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(review.reviewDigest) || typeof review.provider !== "string" || !review.provider || typeof review.model !== "string" || !review.model || !Number.isSafeInteger(review.policyVersion) || Number(review.policyVersion) < 1) throw invalid("review");
+  return review;
+}
+function parseCandidate(value) {
+  const candidate = record(record(value)?.candidate);
+  if (!candidate || typeof candidate.candidateId !== "string" || !/^ccand_[0-9a-f]{32}$/.test(candidate.candidateId) || !["submitted", "approved", "published", "failed"].includes(String(candidate.status))) {
+    throw invalid("candidate");
+  }
+  return { candidateId: candidate.candidateId, status: candidate.status };
+}
+var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var invalid = (part) => new CodeRuntimeControlError(`invalid Code runtime ${part} response`, 502, "invalid_response");
+
+// src/code-checkpoint.ts
+import {
+  createCodePortableCheckpoint,
+  verifyCodePortableCheckpoint
+} from "@odla-ai/camel/code";
+
+// src/code-patch.ts
+import { spawn } from "child_process";
+import { lstat } from "fs/promises";
+import { resolve as resolve2, sep } from "path";
+var RESERVED = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
+var SECRET = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+var PATH = /^[A-Za-z0-9_@+.,-]+(?:\/[A-Za-z0-9_@+.,-]+)*$/;
+var FORBIDDEN = /^(?:GIT binary patch|Binary files |rename (?:from|to) |copy (?:from|to) |similarity index |old mode |new mode |deleted file mode 160000|new file mode 160000)/m;
+function validateCodePatch(patch2, maxBytes) {
+  if (!patch2 || Buffer.byteLength(patch2) > maxBytes || patch2.includes("\0") || patch2.includes("\r")) {
+    throw new TypeError("patch is empty, malformed, or exceeds its byte limit");
+  }
+  if (FORBIDDEN.test(patch2) || /(?:old|new)(?: file)? mode 120000/.test(patch2)) {
+    throw new TypeError("patch uses a forbidden binary, link, mode, rename, or copy operation");
+  }
+  const paths = [];
+  const lines = patch2.split("\n");
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
+    if (!line.startsWith("diff --git ")) continue;
+    const match = /^diff --git a\/(\S+) b\/(\S+)$/.exec(line);
+    const path = match?.[1];
+    if (!path || !match?.[2] || path !== match[2]) throw new TypeError("patch must use one unquoted relative path per diff");
+    validateRelativePath(path);
+    const header = lines.slice(index + 1).findIndex((candidate) => candidate.startsWith("diff --git "));
+    const section = lines.slice(index + 1, header < 0 ? lines.length : index + 1 + header);
+    const oldPath = section.find((candidate) => candidate.startsWith("--- "))?.slice(4);
+    const newPath = section.find((candidate) => candidate.startsWith("+++ "))?.slice(4);
+    if (!validHeaderPath(oldPath, path, "a") || !validHeaderPath(newPath, path, "b")) {
+      throw new TypeError("patch file headers do not match the declared path");
+    }
+    paths.push(path);
+  }
+  if (!paths.length || new Set(paths).size !== paths.length) throw new TypeError("patch has no diffs or repeats a path");
+  return paths;
+}
+function validHeaderPath(value, path, prefix) {
+  return value === "/dev/null" || value === `${prefix}/${path}`;
+}
+function validateRelativePath(path) {
+  const parts = path.split("/");
+  if (!PATH.test(path) || parts.some((part) => part === "." || part === ".." || RESERVED.has(part)) || parts.some((part) => SECRET.test(part))) {
+    throw new TypeError("path is outside the allowed staged source tree");
+  }
+}
+function resolveCodePath(workspaceDir, path) {
+  validateRelativePath(path);
+  const root = resolve2(workspaceDir);
+  const target = resolve2(root, path);
+  if (target !== root && !target.startsWith(`${root}${sep}`)) throw new TypeError("path escapes the staged workspace");
+  return target;
+}
+async function applyCodePatch(workspaceDir, patch2, paths) {
+  await gitApply(workspaceDir, patch2, true);
+  await gitApply(workspaceDir, patch2, false);
+  for (const path of paths) {
+    try {
+      const info = await lstat(resolveCodePath(workspaceDir, path));
+      if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
+        throw new TypeError("patch created a non-regular workspace entry");
+      }
+    } catch (reason) {
+      if (reason.code !== "ENOENT") throw reason;
+    }
+  }
+}
+function gitApply(cwd, patch2, check) {
+  return new Promise((accept, reject) => {
+    const args = ["apply", "--recount", "--whitespace=nowarn", ...check ? ["--check"] : [], "-"];
+    const child = spawn("git", args, {
+      cwd,
+      shell: false,
+      stdio: ["pipe", "ignore", "pipe"],
+      env: { PATH: process.env.PATH ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" }
+    });
+    let stderr = "";
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (text) => {
+      if (stderr.length < 4e3) stderr += text.slice(0, 4e3);
+    });
+    child.once("error", reject);
+    child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(`patch did not apply: ${stderr.trim().slice(0, 500)}`)));
+    child.stdin.end(patch2);
+  });
+}
+
+// src/code-checkpoint.ts
+async function createCodeWorkspaceCheckpoint(input) {
+  const maximum = input.maximumPatchBytes ?? 256 * 1024;
+  if (!Number.isSafeInteger(maximum) || maximum < 1 || maximum > 256 * 1024) {
+    throw new TypeError("checkpoint patch bound must be from 1 to 262144 bytes");
+  }
+  const patch2 = await input.workspace.patch(maximum);
+  if (patch2) validateCodePatch(patch2, maximum);
+  return createCodePortableCheckpoint({ baseCommitSha: input.baseCommitSha, patch: patch2, state: input.state });
+}
+async function restoreCodeWorkspaceCheckpoint(input) {
+  const checkpoint = await verifyCodePortableCheckpoint(input.checkpoint);
+  if (checkpoint.baseCommitSha !== input.trustedBaseCommitSha) {
+    throw new TypeError("checkpoint trusted base does not match the fetched commit");
+  }
+  const workspace = await stageWorkspace(input.trustedBaseDir, input.stage);
+  try {
+    if (checkpoint.patch) {
+      const paths = validateCodePatch(checkpoint.patch, 256 * 1024);
+      await applyCodePatch(workspace.workspaceDir, checkpoint.patch, paths);
+    }
+    return { workspace, checkpoint };
+  } catch (error) {
+    await workspace.cleanup();
+    throw error;
+  }
+}
+function isCheckpointEffectCompleted(checkpoint, effectId, actionDigest) {
+  const completed = checkpoint.state.completedEffects.find((effect) => effect.effectId === effectId);
+  if (!completed) return false;
+  if (completed.actionDigest !== actionDigest) throw new TypeError("completed checkpoint effect id has another action digest");
+  return true;
+}
+
+// src/recipe-container.ts
+import { spawn as spawn2 } from "child_process";
+import { getgid, getuid } from "process";
+import { randomUUID } from "crypto";
+var ARTIFACT_PATH = /^[A-Za-z0-9_@+.,-]+(?:\/[A-Za-z0-9_@+.,-]+)*$/;
+var PRIVATE_ARTIFACT_PART = /^(?:\.git|\.odla|\.wrangler|\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json)$/i;
+function buildRecipeContainerArgs(engine, workspaceDir, recipe2, name = `odla-recipe-${randomUUID().slice(0, 12)}`) {
+  assertCodeBuildRecipe(recipe2);
+  if (/[,\r\n]/.test(workspaceDir)) throw new TypeError("workspace path contains unsupported mount characters");
+  const uid = typeof getuid === "function" ? getuid() : 1e3;
+  const gid = typeof getgid === "function" ? getgid() : 1e3;
+  const limits = {
+    cpus: recipe2.cpus ?? 1,
+    memory: recipe2.memory ?? "1g",
+    pids: recipe2.pids ?? 256,
+    tmpfs: recipe2.tmpfsBytes ?? 64 * 1024 * 1024
+  };
+  if (engine === "container") {
+    return [
+      "run",
+      "--rm",
+      `--name=${name}`,
+      "--network=none",
+      "--read-only",
+      "--cap-drop=ALL",
+      `--memory=${limits.memory}`,
+      `--cpus=${limits.cpus}`,
+      `--user=${uid}:${gid}`,
+      "--tmpfs=/tmp",
+      `--mount=type=bind,source=${workspaceDir},target=/workspace`,
+      "--workdir=/workspace",
+      "--env=CI=1",
+      recipe2.image,
+      ...recipe2.command
+    ];
+  }
+  return [
+    "run",
+    "--rm",
+    `--name=${name}`,
+    "--pull=never",
+    "--network=none",
+    "--read-only",
+    "--cap-drop=ALL",
+    "--security-opt=no-new-privileges",
+    `--pids-limit=${limits.pids}`,
+    `--memory=${limits.memory}`,
+    `--cpus=${limits.cpus}`,
+    `--user=${uid}:${gid}`,
+    `--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfs}`,
+    `--mount=type=bind,src=${workspaceDir},dst=/workspace`,
+    "--workdir=/workspace",
+    "--env=CI=1",
+    recipe2.image,
+    ...recipe2.command
+  ];
+}
+function createContainerRecipeExecutor(engine) {
+  return {
+    async run(input) {
+      await verifyContainerEngineBoundary(engine);
+      const name = `odla-recipe-${randomUUID().slice(0, 12)}`;
+      const args = buildRecipeContainerArgs(engine, input.workspaceDir, input.recipe, name);
+      return execute(engine, args, name, input.recipe, input.signal);
+    }
+  };
+}
+function assertCodeBuildRecipe(recipe2) {
+  const memoryBytes = parseMemory(recipe2.memory ?? "1g");
+  const tmpfsBytes = recipe2.tmpfsBytes ?? 64 * 1024 * 1024;
+  const artifacts = recipe2.expectedArtifacts ?? [];
+  assertPinnedImage(recipe2.image);
+  if (!/^[A-Za-z0-9._:-]{1,120}$/.test(recipe2.id) || recipe2.command.length < 1 || recipe2.command.length > 64 || recipe2.command.some((part) => !part || part.length > 4096 || /[\0\r\n]/.test(part)) || !Number.isSafeInteger(recipe2.timeoutMs) || recipe2.timeoutMs < 1 || recipe2.timeoutMs > 30 * 6e4 || !Number.isSafeInteger(recipe2.maxOutputBytes) || recipe2.maxOutputBytes < 1 || recipe2.maxOutputBytes > 16 * 1024 * 1024 || !Number.isFinite(recipe2.cpus ?? 1) || (recipe2.cpus ?? 1) < 0.1 || (recipe2.cpus ?? 1) > 32 || memoryBytes < 64 * 1024 * 1024 || memoryBytes > 32 * 1024 * 1024 * 1024 || !Number.isSafeInteger(recipe2.pids ?? 256) || (recipe2.pids ?? 256) < 16 || (recipe2.pids ?? 256) > 4096 || !Number.isSafeInteger(tmpfsBytes) || tmpfsBytes < 1024 * 1024 || tmpfsBytes > 1024 * 1024 * 1024 || artifacts.length > 64 || new Set(artifacts.map((item) => item.id)).size !== artifacts.length || artifacts.some((item) => !/^[A-Za-z0-9._:-]{1,120}$/.test(item.id) || !ARTIFACT_PATH.test(item.path) || item.path.split("/").some((part) => PRIVATE_ARTIFACT_PART.test(part)) || !Number.isSafeInteger(item.maximumBytes) || item.maximumBytes < 1 || item.maximumBytes > 512 * 1024 * 1024)) {
+    throw new TypeError("build recipe is malformed or exceeds its control bounds");
+  }
+}
+function parseMemory(value) {
+  const match = /^([1-9][0-9]{0,4})([kmg])$/.exec(value.toLowerCase());
+  if (!match?.[1] || !match[2]) return 0;
+  const scale = match[2] === "k" ? 1024 : match[2] === "m" ? 1024 ** 2 : 1024 ** 3;
+  return Number(match[1]) * scale;
+}
+function execute(engine, args, name, recipe2, signal) {
+  return new Promise((accept, reject) => {
+    const started = Date.now();
+    const child = spawn2(engine, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    let bytes = 0;
+    let outputLimitExceeded = false;
+    let timedOut = false;
+    let stopping = false;
+    const stop = (reason) => {
+      if (stopping) return;
+      stopping = true;
+      timedOut = reason === "timeout";
+      outputLimitExceeded = reason === "output";
+      const remove = engine === "container" ? ["delete", "--force", name] : ["rm", "-f", name];
+      const killer = spawn2(engine, remove, { shell: false, stdio: "ignore" });
+      killer.unref();
+      child.kill("SIGTERM");
+    };
+    const collect = (target) => (chunk) => {
+      bytes += chunk.byteLength;
+      if (bytes > recipe2.maxOutputBytes) stop("output");
+      else target.push(chunk);
+    };
+    child.stdout.on("data", collect(stdout));
+    child.stderr.on("data", collect(stderr));
+    const abort = () => stop("abort");
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) abort();
+    const timer = setTimeout(() => stop("timeout"), recipe2.timeoutMs);
+    child.once("error", (error) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      reject(error);
+    });
+    child.once("exit", (code) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      accept({
+        exitCode: code ?? 1,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        durationMs: Date.now() - started,
+        outputLimitExceeded,
+        timedOut
+      });
+    });
+  });
+}
+
+// src/code-verifier.ts
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { createReadStream } from "fs";
+import { lstat as lstat2 } from "fs/promises";
+import { join } from "path";
+import {
+  digestCodeVerificationReceipt
+} from "@odla-ai/camel/code";
+var SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
+var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var ID = /^[A-Za-z0-9._:-]{1,160}$/;
+var RULE = /^[A-Za-z0-9_@+.,/-]{1,160}$/;
+var DEFAULT_PREFIXES = ["test/", "tests/", "__tests__/"];
+var DEFAULT_SUFFIXES = [".test.js", ".test.ts", ".test.tsx", ".spec.js", ".spec.ts", ".spec.tsx"];
+async function verifyCodeCandidate(input) {
+  const policy = validate(input);
+  const limits = { maxFiles: policy.maximumFiles, maxBytes: policy.maximumBytes };
+  const staged = await stageWorkspace(input.trustedBaseDir, limits);
+  try {
+    const baseDigest = await digestStagedWorkspace(staged.workspaceDir, limits);
+    if (baseDigest !== input.trustedBaseDigest) throw new TypeError("trusted base does not match its registered digest");
+    const paths = validateCodePatch(input.candidatePatch, policy.maximumPatchBytes);
+    await applyCodePatch(staged.workspaceDir, input.candidatePatch, paths);
+    const sourceDigest = await digestStagedWorkspace(staged.workspaceDir, limits);
+    const policyDigest = digestPolicy(policy);
+    const patchDigest = digestBytes(input.candidatePatch);
+    const candidateDigest = digestJson({
+      trustedBaseCommitSha: input.trustedBaseCommitSha,
+      trustedBaseDigest: input.trustedBaseDigest,
+      patchDigest
+    });
+    const changedTests = changedTestPaths(paths, policy);
+    if (changedTests.length > policy.maximumChangedTests) throw new TypeError("candidate changes too many test files");
+    const recipes = [];
+    const logs = [];
+    for (const recipe2 of policy.recipes) {
+      const clean = await stageWorkspace(staged.workspaceDir, limits);
+      try {
+        if (await digestStagedWorkspace(clean.workspaceDir, limits) !== sourceDigest) {
+          throw new TypeError("clean verifier source changed before execution");
+        }
+        const result = checkedResult(await input.recipeExecutor.run({
+          workspaceDir: clean.workspaceDir,
+          recipe: recipe2,
+          signal: input.signal
+        }), recipe2.maxOutputBytes);
+        const artifacts = await inspectArtifacts(clean.workspaceDir, recipe2);
+        recipes.push(recipeReceipt(recipe2, result, artifacts));
+        logs.push({ recipeId: recipe2.id, ...boundedLogs(result, recipe2.maxOutputBytes) });
+      } finally {
+        await clean.cleanup();
+      }
+    }
+    const fields = {
+      schemaVersion: 1,
+      verificationId: input.verificationId ?? `verify-${randomUUID2()}`,
+      trustedBaseCommitSha: input.trustedBaseCommitSha,
+      trustedBaseDigest: input.trustedBaseDigest,
+      patchDigest,
+      candidateDigest,
+      sourceDigest,
+      policyDigest,
+      recipes,
+      changedTestCount: changedTests.length,
+      changedTestSetDigest: digestJson(changedTests),
+      changedTestsRequireReview: changedTests.length > 0,
+      outcome: recipes.every((recipe2) => recipe2.status === "passed") ? "passed" : "failed"
+    };
+    return {
+      receipt: { ...fields, receiptDigest: await digestCodeVerificationReceipt(fields) },
+      changedTests: Object.freeze(changedTests),
+      logs: Object.freeze(logs)
+    };
+  } finally {
+    await staged.cleanup();
+  }
+}
+function validate(input) {
+  const policy = input.policy;
+  if (!SHA.test(input.trustedBaseCommitSha) || !DIGEST.test(input.trustedBaseDigest) || !ID.test(input.verificationId ?? "verify-generated") || !ID.test(policy.policyId) || policy.recipes.length < 1 || policy.recipes.length > 64 || new Set(policy.recipes.map((recipe2) => recipe2.id)).size !== policy.recipes.length) {
+    throw new TypeError("clean verification input is malformed");
+  }
+  for (const recipe2 of policy.recipes) assertCodeBuildRecipe(recipe2);
+  const result = {
+    policyId: policy.policyId,
+    recipes: policy.recipes,
+    testPathPrefixes: policy.testPathPrefixes ?? DEFAULT_PREFIXES,
+    testPathSuffixes: policy.testPathSuffixes ?? DEFAULT_SUFFIXES,
+    maximumChangedTests: policy.maximumChangedTests ?? 1e3,
+    maximumPatchBytes: policy.maximumPatchBytes ?? 256 * 1024,
+    maximumFiles: policy.maximumFiles ?? 2e4,
+    maximumBytes: policy.maximumBytes ?? 512 * 1024 * 1024
+  };
+  if ([...result.testPathPrefixes, ...result.testPathSuffixes].some((rule) => !RULE.test(rule)) || !integer(result.maximumChangedTests, 0, 1e4) || !integer(result.maximumPatchBytes, 1, 4 * 1024 * 1024) || !integer(result.maximumFiles, 1, 1e5) || !integer(result.maximumBytes, 1, 2 * 1024 * 1024 * 1024)) {
+    throw new TypeError("clean verification policy exceeds its bounds");
+  }
+  return result;
+}
+function changedTestPaths(paths, policy) {
+  return paths.filter((path) => policy.testPathSuffixes.some((suffix) => path.endsWith(suffix)) || policy.testPathPrefixes.some((prefix) => path.startsWith(prefix) || path.includes(`/${prefix}`))).sort();
+}
+function recipeReceipt(recipe2, result, artifacts) {
+  const status = result.timedOut ? "timed_out" : result.outputLimitExceeded ? "output_limited" : result.exitCode === 0 && artifacts.every((item) => item.status === "verified") ? "passed" : "failed";
+  return {
+    recipeId: recipe2.id,
+    recipeDigest: digestRecipe(recipe2),
+    status,
+    exitCode: result.exitCode,
+    durationMs: result.durationMs,
+    artifacts
+  };
+}
+async function inspectArtifacts(workspaceDir, recipe2) {
+  const receipts = [];
+  for (const artifact of recipe2.expectedArtifacts ?? []) {
+    try {
+      const path = join(workspaceDir, artifact.path);
+      const info = await lstat2(path);
+      if (!info.isFile() || info.isSymbolicLink()) {
+        receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
+      } else if (info.size > artifact.maximumBytes) {
+        receipts.push({ artifactId: artifact.id, status: "too_large", bytes: info.size, digest: null });
+      } else {
+        receipts.push({ artifactId: artifact.id, status: "verified", bytes: info.size, digest: await hashFile(path) });
+      }
+    } catch (reason) {
+      if (reason.code !== "ENOENT") throw reason;
+      receipts.push({ artifactId: artifact.id, status: "missing", bytes: null, digest: null });
+    }
+  }
+  return receipts;
+}
+function hashFile(path) {
+  return new Promise((accept, reject) => {
+    const hash = createHash2("sha256");
+    const stream = createReadStream(path);
+    stream.on("data", (chunk) => {
+      hash.update(chunk);
+    });
+    stream.once("error", reject);
+    stream.once("end", () => accept(`sha256:${hash.digest("hex")}`));
+  });
+}
+function checkedResult(result, maximumOutputBytes) {
+  if (!integer(result.exitCode, 0, 255) || !integer(result.durationMs, 0, 30 * 6e4) || typeof result.stdout !== "string" || typeof result.stderr !== "string" || typeof result.outputLimitExceeded !== "boolean" || typeof result.timedOut !== "boolean") {
+    throw new TypeError("recipe executor returned an invalid result");
+  }
+  const bytes = Buffer.byteLength(result.stdout) + Buffer.byteLength(result.stderr);
+  return bytes > maximumOutputBytes ? { ...result, outputLimitExceeded: true } : result;
+}
+function boundedLogs(result, maximum) {
+  const stdout = Buffer.from(result.stdout);
+  const stderr = Buffer.from(result.stderr);
+  const first = stdout.subarray(0, maximum);
+  return {
+    stdout: first.toString("utf8"),
+    stderr: stderr.subarray(0, Math.max(0, maximum - first.byteLength)).toString("utf8")
+  };
+}
+function digestPolicy(policy) {
+  return digestJson({
+    policyId: policy.policyId,
+    recipes: policy.recipes.map((recipe2) => normalizedRecipe(recipe2)),
+    testPathPrefixes: [...policy.testPathPrefixes].sort(),
+    testPathSuffixes: [...policy.testPathSuffixes].sort(),
+    maximumChangedTests: policy.maximumChangedTests,
+    maximumPatchBytes: policy.maximumPatchBytes,
+    maximumFiles: policy.maximumFiles,
+    maximumBytes: policy.maximumBytes
+  });
+}
+function digestRecipe(recipe2) {
+  return digestJson(normalizedRecipe(recipe2));
+}
+function normalizedRecipe(recipe2) {
+  return {
+    id: recipe2.id,
+    image: recipe2.image,
+    command: [...recipe2.command],
+    timeoutMs: recipe2.timeoutMs,
+    maxOutputBytes: recipe2.maxOutputBytes,
+    cpus: recipe2.cpus ?? 1,
+    memory: recipe2.memory ?? "1g",
+    pids: recipe2.pids ?? 256,
+    tmpfsBytes: recipe2.tmpfsBytes ?? 64 * 1024 * 1024,
+    expectedArtifacts: [...recipe2.expectedArtifacts ?? []].sort((left, right) => left.id.localeCompare(right.id)).map((artifact) => ({ id: artifact.id, path: artifact.path, maximumBytes: artifact.maximumBytes }))
+  };
+}
+function digestJson(value) {
+  return digestBytes(JSON.stringify(value));
+}
+function digestBytes(value) {
+  return `sha256:${createHash2("sha256").update(value).digest("hex")}`;
+}
+function integer(value, minimum, maximum) {
+  return Number.isSafeInteger(value) && value >= minimum && value <= maximum;
+}
+
+// src/code-runtime-checkpoint.ts
+async function prepareRuntimeCheckpoint(input) {
+  const patch2 = await input.workspace.patch(256 * 1024);
+  let verification = null;
+  let review = null;
+  let note = patch2 ? "Candidate remains untrusted" : "Checkpoint has no source changes";
+  if (patch2 && input.role === "coding") {
+    try {
+      const evidence = await verifyCodeCandidate({
+        verificationId: `verify-${input.sessionId.slice("csess_".length)}`,
+        trustedBaseDir: input.workspace.baselineDir,
+        trustedBaseCommitSha: input.baseCommitSha,
+        trustedBaseDigest: input.trustedBaseDigest,
+        candidatePatch: patch2,
+        policy: {
+          policyId: "code.runtime",
+          recipes: input.recipes,
+          maximumFiles: 2e4,
+          maximumBytes: 512 * 1024 * 1024
+        },
+        recipeExecutor: input.recipeExecutor
+      });
+      if (evidence.receipt.outcome === "passed") {
+        verification = evidence.receipt;
+        review = await input.review(patch2, verification);
+        note = review.verdict === "approved" ? "Clean verification and independent review passed" : "Clean verification passed; independent review rejected the candidate";
+      } else {
+        note = `Clean verification failed: ${evidence.receipt.recipes.filter((recipe2) => recipe2.status !== "passed").map((recipe2) => `${recipe2.recipeId}=${recipe2.status}`).join(", ")}`;
+      }
+    } catch (cause) {
+      note = `Candidate verification or review failed closed: ${message(cause)}`;
+    }
+  }
+  const reviewed = verification && review?.verdict === "approved";
+  const checkpoint = await createCodeWorkspaceCheckpoint({
+    workspace: input.workspace,
+    baseCommitSha: input.baseCommitSha,
+    state: {
+      planCursor: null,
+      conversationRefs: input.conversationRefs,
+      planningInputDigest: input.planningInputDigest,
+      buildPolicyDigest: verification?.policyDigest ?? input.fallbackPolicyDigest,
+      dependencyLayerDigest: null,
+      verificationDigest: verification?.receiptDigest ?? null,
+      reviewDigest: reviewed && review ? review.reviewDigest : null,
+      completedEffects: [],
+      unresolvedApprovals: [],
+      trustStatus: reviewed ? "reviewed" : verification ? "verified" : "candidate_untrusted"
+    }
+  });
+  return { checkpoint, verification, review, note };
+}
+var message = (value) => (value instanceof Error ? value.message : String(value)).slice(0, 500);
+
+// src/code-runtime-checkpoint-manager.ts
+var CodeRuntimeCheckpointManager = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  #pending = /* @__PURE__ */ new Map();
+  async prepare(command, active) {
+    active.abort.abort("checkpoint_stop");
+    await active.done;
+    const prepared = await prepareRuntimeCheckpoint({
+      sessionId: command.sessionId,
+      role: active.role,
+      workspace: active.workspace,
+      baseCommitSha: active.baseCommitSha,
+      trustedBaseDigest: active.trustedBaseDigest,
+      planningInputDigest: active.planningInputDigest,
+      conversationRefs: active.conversationRefs,
+      fallbackPolicyDigest: this.options.fallbackPolicyDigest,
+      recipes: this.options.recipes,
+      recipeExecutor: this.options.recipeExecutor,
+      review: (patch2, verification) => this.options.control.review(command.sessionId, { patch: patch2, verification })
+    });
+    if (prepared.review?.verdict === "approved" && prepared.verification) {
+      this.#pending.set(command.commandId, { verification: prepared.verification, refs: active.conversationRefs });
+    }
+    await this.options.event(command, { type: "message", actor: "system", body: prepared.note }, active.conversationRefs).catch(() => void 0);
+    await active.workspace.cleanup();
+    await this.options.event(command, { type: "status", status: "checkpointed" }, active.conversationRefs).catch(() => void 0);
+    return { status: "checkpointed", checkpoint: prepared.checkpoint, message: "Pi stopped at a portable checkpoint" };
+  }
+  async acknowledged(command, result) {
+    if (command.kind !== "checkpoint_stop" || result.status !== "checkpointed") return false;
+    const pending = this.#pending.get(command.commandId);
+    if (!pending) return true;
+    const checkpointId = `cpoint_${command.commandId.slice("ccmd_".length)}`;
+    const candidate = await this.options.control.submitCandidate(command.sessionId, checkpointId, pending.verification);
+    await this.options.event(command, {
+      type: "message",
+      actor: "system",
+      body: command.payload.sourceSet ? `Candidate ${candidate.candidateId} was verified and delivered to the session PR branch` : `Candidate ${candidate.candidateId} is ready for legacy owner publication approval`
+    }, pending.refs);
+    this.#pending.delete(command.commandId);
+    return true;
+  }
+};
+
+// src/code-runtime-source.ts
+import { mkdir, mkdtemp, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { dirname, join as join2, resolve as resolve3, sep as sep2 } from "path";
+var RESERVED2 = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
+var SECRET2 = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir()) {
+  if (!snapshot.files.length || snapshot.files.length > 1e4) throw new TypeError("Code source file count is invalid");
+  const root = await mkdtemp(join2(tempRoot, "odla-code-source-"));
+  const sourceDir = join2(root, "source");
+  await mkdir(sourceDir);
+  const seen = /* @__PURE__ */ new Set();
+  let bytes = 0;
+  try {
+    for (const file of snapshot.files) {
+      validatePath(file.path);
+      if (seen.has(file.path)) throw new TypeError("Code source repeats a path");
+      seen.add(file.path);
+      bytes += Buffer.byteLength(file.path) + Buffer.byteLength(file.content);
+      if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
+      const target = resolve3(sourceDir, file.path);
+      if (!target.startsWith(`${resolve3(sourceDir)}${sep2}`)) throw new TypeError("Code source path escapes its root");
+      await mkdir(dirname(target), { recursive: true });
+      await writeFile(target, file.content, { flag: "wx", mode: 420 });
+    }
+    for (const reference of snapshot.references ?? []) {
+      validateAlias(reference.alias);
+      if (!reference.files.length || reference.files.length > 1e4) throw new TypeError("Code reference file count is invalid");
+      for (const file of reference.files) {
+        validatePath(file.path);
+        const path = `.odla-references/${reference.alias}/${file.path}`;
+        if (seen.has(path)) throw new TypeError("Code reference repeats a path");
+        seen.add(path);
+        bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);
+        if (bytes > 80 * 1024 * 1024) throw new TypeError("Code source set exceeds its byte bound");
+        const target = resolve3(sourceDir, path);
+        if (!target.startsWith(`${resolve3(sourceDir)}${sep2}`)) throw new TypeError("Code reference path escapes its root");
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, file.content, { flag: "wx", mode: 292 });
+      }
+    }
+    return { sourceDir, cleanup: () => rm(root, { recursive: true, force: true }) };
+  } catch (cause) {
+    await rm(root, { recursive: true, force: true });
+    throw cause;
+  }
+}
+function validateAlias(alias) {
+  if (!/^[a-z][a-z0-9-]{0,39}$/.test(alias) || alias === "primary") {
+    throw new TypeError("Code reference alias is invalid");
+  }
+}
+async function attachCodeRuntimeReferences(workspace, references) {
+  let bytes = 0;
+  for (const reference of references) {
+    validateAlias(reference.alias);
+    for (const file of reference.files) {
+      validatePath(file.path);
+      const path = `.odla-references/${reference.alias}/${file.path}`;
+      bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);
+      if (bytes > 64 * 1024 * 1024) throw new TypeError("Code reference set exceeds its byte bound");
+      for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
+        const target = resolve3(root, path);
+        if (!target.startsWith(`${resolve3(root)}${sep2}`)) throw new TypeError("Code reference path escapes its root");
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, file.content, { flag: "wx", mode: 292 });
+      }
+    }
+  }
+}
+function validatePath(path) {
+  const parts = path.split("/");
+  if (!path || path.startsWith("/") || path.includes("\\") || path.includes("\0") || parts.some((part) => !part || part === "." || part === ".." || RESERVED2.has(part) || SECRET2.test(part))) {
+    throw new TypeError("Code source contains an unsafe path");
+  }
+}
+
+// src/code-tool-broker.ts
+import { readFile as readFile2, readdir as readdir2, stat } from "fs/promises";
+import { relative as relative2, resolve as resolve4 } from "path";
+
+// src/code-tool-policy.ts
+import {
+  conversionPolicyDigest,
+  createCamelIngress,
+  createConversionRegistry,
+  registeredIdRegistryDigest
+} from "@odla-ai/camel";
+import {
+  createEffectPolicy,
+  destinationRegistryDigest
+} from "@odla-ai/camel/policy";
+var DESTINATIONS = "code-workspaces.v1";
+var READ = descriptor("sandbox.read", "scoped_data_read", {
+  workspace: "destination",
+  authority: "authority",
+  path: "selector",
+  startLine: "selector",
+  endLine: "selector"
+});
+var PATCH = descriptor("sandbox.apply_patch", "reversible_mutation", {
+  workspace: "destination",
+  authority: "authority",
+  patch: "payload"
+});
+var RECIPE = descriptor("sandbox.run_recipe", "code_execution", {
+  workspace: "destination",
+  authority: "authority",
+  recipeId: "selector",
+  sourceDigest: "payload"
+});
+function createCodePolicyGate(options) {
+  return {
+    read: async (input) => {
+      const base = await environment(input, options, "sandbox.read");
+      const conversions = await conversionRegistry([
+        await registeredPolicy("code.path.v1", "code.paths.v1", input.paths),
+        await conversionPolicy("code.line.v1", { kind: "integer", minimum: 1, maximum: 1e6 })
+      ], { "code.paths.v1": input.paths });
+      const path = await conversions.operations.registeredId(unsafe(base, input.path, "path"), "code.path.v1");
+      const start = await conversions.operations.integer(unsafe(base, input.startLine, "start"), "code.line.v1");
+      const end = await conversions.operations.integer(unsafe(base, input.endLine, "end"), "code.line.v1");
+      if (end.value < start.value) return false;
+      return authorize(input, options, base, READ, {
+        ...base.fixedArgs,
+        path: { role: "selector", value: path },
+        startLine: { role: "selector", value: start },
+        endLine: { role: "selector", value: end }
+      }, [path, start, end]);
+    },
+    patch: async (input) => {
+      const base = await environment(input, options, "sandbox.apply_patch");
+      const patch2 = unsafe(base, input.patch, "patch");
+      return authorize(input, options, base, PATCH, {
+        ...base.fixedArgs,
+        patch: { role: "payload", value: patch2 }
+      }, []);
+    },
+    recipe: async (input) => {
+      const base = await environment(input, options, "sandbox.run_recipe");
+      const conversions = await conversionRegistry([
+        await registeredPolicy("code.recipe.v1", "code.recipes.v1", input.recipeIds)
+      ], { "code.recipes.v1": input.recipeIds });
+      const recipe2 = await conversions.operations.registeredId(unsafe(base, input.recipeId, "recipe"), "code.recipe.v1");
+      const source = unsafe(base, input.sourceDigest, "source");
+      return authorize(input, options, base, RECIPE, {
+        ...base.fixedArgs,
+        recipeId: { role: "selector", value: recipe2 },
+        sourceDigest: { role: "payload", value: source }
+      }, [recipe2]);
+    }
+  };
+}
+function descriptor(name, effect, argumentRoles) {
+  return { name, version: 1, effect, inputSchema: { type: "object" }, argumentRoles, policyId: `odla.code.${name}.v1` };
+}
+async function conversionPolicy(id, output) {
+  const definition = {
+    conversionId: id,
+    version: 1,
+    output,
+    maximumSourceBytes: 1e6,
+    maximumOutputsPerArtifact: 4,
+    presentation: "json_scalar"
+  };
+  return { ...definition, digest: await conversionPolicyDigest(definition) };
+}
+async function registeredPolicy(id, registryId, values) {
+  const mapping = Object.fromEntries(values.map((value) => [value, value]));
+  return conversionPolicy(id, {
+    kind: "registered_id",
+    registryId,
+    registryDigest: await registeredIdRegistryDigest(mapping)
+  });
+}
+async function conversionRegistry(policies, values) {
+  const registeredIds = Object.fromEntries(await Promise.all(Object.entries(values).map(async ([id, entries]) => {
+    const mapping = Object.fromEntries(entries.map((value) => [value, value]));
+    return [id, { values: mapping, digest: await registeredIdRegistryDigest(mapping) }];
+  })));
+  return createConversionRegistry({ policies, registeredIds });
+}
+async function environment(input, options, tool) {
+  const ingress = createCamelIngress([
+    { id: "workspace", value: input.workspaceId, readers: input.readers },
+    { id: "authority", value: `lease:${input.lease.leaseId}`, readers: input.readers },
+    { id: "reader", value: options.readerId, readers: input.readers }
+  ]);
+  const digest = await destinationRegistryDigest([input.workspaceId]);
+  const approvals = ["irreversible_mutation", "external_send", "financial", "secret_read"];
+  if (options.recipeAuthorization === "exact_approval") approvals.push("code_execution");
+  const policy = createEffectPolicy({
+    destinationRegistries: { [DESTINATIONS]: { digest, values: [input.workspaceId] } },
+    approvalEffects: approvals
+  });
+  const fixedArgs = {
+    workspace: { role: "destination", value: ingress.control("workspace"), registryId: DESTINATIONS, registryDigest: digest },
+    authority: { role: "authority", value: ingress.control("authority") }
+  };
+  return { ingress, policy, fixedArgs, reader: ingress.control("reader"), runId: `${input.request.requestId}:${tool}` };
+}
+function unsafe(base, value, field) {
+  return base.ingress.quarantinedOutput(value, {
+    readers: base.reader.label.readers,
+    runId: `${base.runId}:${field}`
+  });
+}
+async function authorize(input, options, base, tool, args, controlDependencies) {
+  const policy = await base.policy.evaluate({
+    planId: input.lease.task.taskId,
+    tool,
+    args,
+    controlDependencies,
+    intendedReaderIds: [base.reader]
+  });
+  let approvalConsumed = false;
+  if (policy.outcome === "require_approval" && options.consumeApproval) {
+    approvalConsumed = await options.consumeApproval(decision(input, policy, false, tool.name, policy.actionDigest));
+  }
+  await options.onDecision?.(decision(input, policy, approvalConsumed, tool.name));
+  return policy.outcome === "allow" || approvalConsumed;
+}
+function decision(input, policy, approvalConsumed, tool, actionDigest) {
+  return {
+    lease: input.lease,
+    request: input.request,
+    tool,
+    policy,
+    approvalConsumed,
+    actionDigest: actionDigest ?? (policy.outcome === "require_approval" ? policy.actionDigest : "")
+  };
+}
+
+// src/code-tool-broker.ts
+function createCodeToolBroker(options) {
+  validateOptions(options);
+  const recipes = new Map(options.recipes.map((recipe2) => [recipe2.id, recipe2]));
+  const policy = createCodePolicyGate(options);
+  let tail = Promise.resolve();
+  return {
+    execute(context, request) {
+      const result = tail.then(() => route(context, request, options, recipes, policy));
+      tail = result.then(() => void 0, () => void 0);
+      return result;
+    }
+  };
+}
+async function route(context, request, options, recipes, policy) {
+  try {
+    if (context.signal?.aborted) throw new TypeError("tool request was cancelled");
+    if (request.tool === "sandbox.read") return await read(context, request, options, policy);
+    if (request.tool === "sandbox.apply_patch") return await patch(context, request, options, policy);
+    return await recipe(context, request, options, recipes, policy);
+  } catch (reason) {
+    return response(request, false, reason instanceof TypeError ? reason.message : "tool failed closed");
+  }
+}
+async function read(context, request, options, policy) {
+  exactKeys(request.input, ["path", "startLine", "endLine"]);
+  const path = stringField(request.input, "path");
+  const startLine = optionalInteger(request.input.startLine) ?? 1;
+  const endLine = optionalInteger(request.input.endLine) ?? startLine + (options.maxReadLines ?? 2e3) - 1;
+  if (endLine < startLine || endLine - startLine + 1 > (options.maxReadLines ?? 2e3)) {
+    throw new TypeError("requested line range exceeds its bound");
+  }
+  const paths = await registeredFiles(context.workspaceDir, 2e4);
+  const allowed = await policy.read(policyContext(context, request, options, { paths, path, startLine, endLine }));
+  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  const target = resolveCodePath(context.workspaceDir, path);
+  const info = await stat(target);
+  if (!info.isFile() || info.size > Math.max(options.maxReadBytes ?? 128 * 1024, 2 * 1024 * 1024)) {
+    throw new TypeError("file is not a bounded regular source file");
+  }
+  const source = await readFile2(target);
+  if (source.includes(0)) throw new TypeError("binary files are not readable through this tool");
+  const lines = source.toString("utf8").split("\n");
+  const content = lines.slice(startLine - 1, endLine).join("\n");
+  if (Buffer.byteLength(content) > (options.maxReadBytes ?? 128 * 1024)) {
+    throw new TypeError("read result exceeds its byte bound");
+  }
+  return response(request, true, content, { path, startLine, endLine: Math.min(endLine, lines.length) });
+}
+async function patch(context, request, options, policy) {
+  exactKeys(request.input, ["patch"]);
+  const value = stringField(request.input, "patch");
+  const paths = validateCodePatch(value, options.maxPatchBytes ?? 256 * 1024);
+  if (paths.some((path) => options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))) {
+    throw new TypeError("patch targets a read-only reference source");
+  }
+  const allowed = await policy.patch(policyContext(context, request, options, { patch: value }));
+  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  await applyCodePatch(context.workspaceDir, value, paths);
+  return response(request, true, `Applied patch to ${paths.length} file(s).`, { paths });
+}
+async function recipe(context, request, options, recipes, policy) {
+  exactKeys(request.input, ["recipeId"]);
+  const recipeId = stringField(request.input, "recipeId");
+  const digestLimits = {
+    maxFiles: options.maxRecipeWorkspaceFiles ?? 2e4,
+    maxBytes: options.maxRecipeWorkspaceBytes ?? 512 * 1024 * 1024
+  };
+  const sourceDigest = await digestStagedWorkspace(context.workspaceDir, digestLimits);
+  const allowed = await policy.recipe(policyContext(context, request, options, {
+    recipeIds: [...recipes.keys()].sort(),
+    recipeId,
+    sourceDigest
+  }));
+  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  const selected = recipes.get(recipeId);
+  if (!selected) return response(request, false, "build recipe is not registered");
+  const staged = await stageWorkspace(context.workspaceDir, {
+    maxFiles: digestLimits.maxFiles,
+    maxBytes: digestLimits.maxBytes
+  });
+  try {
+    if (await digestStagedWorkspace(staged.workspaceDir, digestLimits) !== sourceDigest) {
+      throw new TypeError("workspace changed after recipe authorization");
+    }
+    const result = await options.recipeExecutor.run({
+      workspaceDir: staged.workspaceDir,
+      recipe: selected,
+      signal: context.signal
+    });
+    const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
+    const ok = result.exitCode === 0 && !result.outputLimitExceeded && !result.timedOut;
+    const status = result.timedOut ? "timed out" : result.outputLimitExceeded ? "exceeded output limit" : ok ? "passed" : `failed with exit ${result.exitCode}`;
+    return response(request, ok, `Recipe ${recipeId} ${status}.${output ? `
+${output}` : ""}`, {
+      recipeId,
+      exitCode: result.exitCode,
+      durationMs: result.durationMs,
+      outputLimitExceeded: result.outputLimitExceeded,
+      timedOut: result.timedOut
+    });
+  } finally {
+    await staged.cleanup();
+  }
+}
+function policyContext(context, request, options, extra) {
+  return {
+    lease: context.lease,
+    request,
+    workspaceId: `workspace:${context.lease.task.attemptId}`,
+    readers: { kind: "principals", principalIds: [options.readerId] },
+    ...extra
+  };
+}
+async function registeredFiles(root, limit) {
+  const paths = [];
+  const walk = async (directory) => {
+    for (const entry of await readdir2(directory, { withFileTypes: true })) {
+      if (entry.isSymbolicLink()) throw new TypeError("workspace contains a symbolic link");
+      const target = resolve4(directory, entry.name);
+      if (entry.isDirectory()) await walk(target);
+      else if (entry.isFile()) {
+        const path = relative2(root, target).split("\\").join("/");
+        try {
+          validateRelativePath(path);
+        } catch {
+          continue;
+        }
+        paths.push(path);
+        if (paths.length > limit) throw new TypeError("workspace file registry exceeds its bound");
+      }
+    }
+  };
+  await walk(resolve4(root));
+  return paths.sort();
+}
+function validateOptions(options) {
+  if (!options.readerId || !options.recipes.length || new Set(options.recipes.map((item) => item.id)).size !== options.recipes.length) {
+    throw new TypeError("Code tool broker requires a reader and unique registered recipes");
+  }
+  for (const recipe2 of options.recipes) assertCodeBuildRecipe(recipe2);
+  if (options.readOnlyPrefixes?.some((prefix) => !/^[A-Za-z0-9_.-]+$/.test(prefix) || prefix === "." || prefix === "..")) {
+    throw new TypeError("Code tool broker read-only prefix is invalid");
+  }
+}
+function exactKeys(input, allowed) {
+  if (Object.keys(input).some((key) => !allowed.includes(key))) throw new TypeError("tool input contains an unsupported field");
+}
+function stringField(input, name) {
+  const value = input[name];
+  if (typeof value !== "string" || !value) throw new TypeError(`${name} must be a non-empty string`);
+  return value;
+}
+function optionalInteger(value) {
+  if (value === void 0) return void 0;
+  if (!Number.isSafeInteger(value) || value < 1) throw new TypeError("line bounds must be positive integers");
+  return value;
+}
+function response(request, ok, content, details) {
+  return { requestId: request.requestId, ok, content, ...details ? { details } : {} };
+}
+
+// src/code-runtime-task.ts
+function codeCommandMetadata(payload, resume) {
+  const trusted = record2(payload.trustedBase);
+  const role = payload.role;
+  const title = payload.title;
+  const prompt = payload.prompt;
+  const maxTokensPerInteraction = payload.maxTokensPerInteraction ?? 32e3;
+  if (role !== "coding" && role !== "review" || typeof title !== "string" || typeof prompt !== "string") {
+    throw new TypeError(`invalid Code ${resume ? "resume" : "start"} metadata`);
+  }
+  const planning = trusted?.planningInputDigest;
+  const attestation = trusted?.attestationDigest;
+  const repository = trusted?.repository;
+  const baseCommitSha = trusted?.commitSha;
+  const sourceTreeDigest = trusted?.treeDigest;
+  if (typeof repository !== "string" || !repository.includes("/") || typeof baseCommitSha !== "string" || !/^[0-9a-f]{40}$/.test(baseCommitSha) || typeof sourceTreeDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(sourceTreeDigest)) {
+    throw new TypeError(`invalid Code ${resume ? "resume" : "start"} trusted base`);
+  }
+  if (!Number.isSafeInteger(maxTokensPerInteraction) || Number(maxTokensPerInteraction) < 4e3 || Number(maxTokensPerInteraction) > 2e5) {
+    throw new TypeError(`invalid Code ${resume ? "resume" : "start"} interaction token limit`);
+  }
+  return {
+    role,
+    title,
+    prompt,
+    maxTokensPerInteraction: Number(maxTokensPerInteraction),
+    planningInputDigest: typeof planning === "string" && /^sha256:[0-9a-f]{64}$/.test(planning) ? planning : null,
+    attestationDigest: typeof attestation === "string" ? attestation : "resume",
+    repository,
+    baseCommitSha,
+    sourceTreeDigest
+  };
+}
+function codeLocalSource(payload) {
+  const source = record2(payload.source);
+  if (!source) return null;
+  if (source.kind !== "local_checkout" || typeof source.repository !== "string" || typeof source.headCommitSha !== "string" || !/^[0-9a-f]{40}$/.test(source.headCommitSha) || typeof source.trustedBaseDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.trustedBaseDigest) || typeof source.developerPatchDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.developerPatchDigest) || typeof source.snapshotDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.snapshotDigest) || typeof source.modified !== "boolean" || !Number.isSafeInteger(source.fileCount) || Number(source.fileCount) < 1 || Number(source.fileCount) > 2e4 || !Number.isSafeInteger(source.byteCount) || Number(source.byteCount) < 1 || Number(source.byteCount) > 512 * 1024 * 1024 || !Number.isSafeInteger(source.capturedAt) || Number(source.capturedAt) < 1) {
+    throw new TypeError("invalid local checkout source descriptor");
+  }
+  return source;
+}
+function codeCheckpointPayload(payload) {
+  const value = payload.checkpoint;
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError("resume checkpoint is missing");
+  return value;
+}
+function fakeCodeLease(command, metadata) {
+  return {
+    protocolVersion: HARNESS_PROTOCOL_VERSION,
+    leaseId: `code:${command.commandId}`,
+    generation: command.bindingGeneration,
+    expiresAt: Date.now() + 24 * 60 * 6e4,
+    task: {
+      taskId: command.sessionId,
+      attemptId: command.instanceId,
+      title: metadata.title,
+      prompt: metadata.prompt,
+      workspace: command.appId,
+      aiRoute: metadata.role,
+      policy: {
+        network: "none",
+        timeoutMs: 30 * 6e4,
+        maxOutputBytes: 4 * 1024 * 1024,
+        maxPatchBytes: 256 * 1024
+      }
+    }
+  };
+}
+var record2 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+
+// src/code-runtime-local-source.ts
+var SOURCE_LIMITS = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
+async function prepareRuntimeLocalSource(input) {
+  const { command, descriptor: descriptor2, available, repository, baseCommitSha, resume } = input;
+  if (!available || JSON.stringify(available.descriptor) !== JSON.stringify(descriptor2) || descriptor2.repository.toLowerCase() !== repository.toLowerCase() || descriptor2.headCommitSha !== baseCommitSha) {
+    throw new TypeError("the session's local checkout snapshot is not available on this terminal");
+  }
+  const workspace = resume ? (await restoreCodeWorkspaceCheckpoint({
+    trustedBaseDir: available.trustedBaseDir,
+    trustedBaseCommitSha: baseCommitSha,
+    checkpoint: codeCheckpointPayload(command.payload)
+  })).workspace : await stageWorkspacePair(available.trustedBaseDir, available.sourceDir, SOURCE_LIMITS);
+  const trustedBaseDigest = await digestStagedWorkspace(workspace.baselineDir, SOURCE_LIMITS);
+  if (trustedBaseDigest !== descriptor2.trustedBaseDigest) {
+    await workspace.cleanup();
+    throw new TypeError("trusted Git base digest changed after connection");
+  }
+  if (!resume && await digestStagedWorkspace(workspace.workspaceDir, SOURCE_LIMITS) !== descriptor2.snapshotDigest) {
+    await workspace.cleanup();
+    throw new TypeError("local checkout snapshot digest changed after connection");
+  }
+  return { workspace, sourceDigest: descriptor2.snapshotDigest, trustedBaseDigest };
+}
+
+// src/code-runtime-broker.ts
+function createCodeRuntimeToolBroker(input, lease, role) {
+  const broker = createCodeToolBroker({
+    recipes: input.recipes,
+    recipeExecutor: createContainerRecipeExecutor(input.engine),
+    recipeAuthorization: input.recipeAuthorization ?? "registered_recipe",
+    readerId: `code-session:${lease.task.taskId}`,
+    readOnlyPrefixes: [".odla-references"]
+  });
+  return role === "coding" ? broker : { execute: (context, request) => request.tool === "sandbox.read" ? broker.execute(context, request) : Promise.resolve({ requestId: request.requestId, ok: false, content: "review sessions are read-only" }) };
+}
+
+// src/code-runtime-inference.ts
+async function handleCodeRuntimeInference(input) {
+  const { command, metadata, request, state } = input;
+  if (state.tokens >= metadata.maxTokensPerInteraction) {
+    if (!state.noticeEmitted) {
+      state.noticeEmitted = true;
+      await input.event({
+        type: "message",
+        actor: "system",
+        body: `Pi paused at the ${metadata.maxTokensPerInteraction.toLocaleString("en-US")}-token per-interaction limit. Send a new instruction to continue.`
+      }).catch(() => void 0);
+    }
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "inference.response",
+      requestId: request.requestId,
+      response: {
+        id: `budget:${command.commandId}`,
+        provider: "openai",
+        model: "interaction-budget",
+        role: "assistant",
+        content: [{ type: "text", text: "Pause now. The owner-set token limit for this interaction has been reached." }],
+        stopReason: "end_turn",
+        usage: { inputTokens: 0, outputTokens: 0 }
+      }
+    };
+  }
+  const startedAt = Date.now();
+  const response2 = await input.control.infer(command.sessionId, {
+    requestId: request.requestId,
+    interactionId: command.commandId,
+    call: request.call
+  });
+  state.tokens += response2.receipt.inputTokens + response2.receipt.outputTokens;
+  await input.event({
+    type: "usage",
+    provider: response2.receipt.provider,
+    model: response2.receipt.model,
+    inputTokens: response2.receipt.inputTokens,
+    outputTokens: response2.receipt.outputTokens,
+    durationMs: Date.now() - startedAt,
+    interactionId: command.commandId,
+    interactionTokens: state.tokens,
+    interactionMaxTokens: metadata.maxTokensPerInteraction
+  }).catch(() => void 0);
+  return {
+    protocolVersion: HARNESS_PROTOCOL_VERSION,
+    type: "inference.response",
+    requestId: request.requestId,
+    response: response2.response
+  };
+}
+
+// src/code-runtime-events.ts
+import { createHash as createHash3 } from "crypto";
+async function appendCodeRuntimeEvent(control, command, event, refs) {
+  const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;
+  refs.push(eventId);
+  const bounded = event.type === "message" ? { ...event, body: event.body.trim().slice(0, 2e4) || `${event.actor} event` } : event;
+  await control.appendSessionEvent(command.sessionId, eventId, bounded);
+}
+var digestRuntimeValue = (value) => `sha256:${createHash3("sha256").update(value).digest("hex")}`;
+var runtimeErrorMessage = (value) => value instanceof Error ? value.message : String(value);
+var runtimeRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var safeRuntimeJson = (value) => {
+  try {
+    return JSON.stringify(value).slice(0, 1e4);
+  } catch {
+    return "[event]";
+  }
+};
+function runtimeResultText(value) {
+  const record3 = runtimeRecord(value);
+  if (record3 && typeof record3.text === "string") return record3.text.slice(0, 2e4);
+  if (record3 && typeof record3.error === "string") return `Pi failed: ${record3.error.slice(0, 19989)}`;
+  return null;
+}
+function runtimeResultError(value) {
+  const record3 = runtimeRecord(value);
+  return record3 && typeof record3.error === "string" && record3.error.trim() ? record3.error.trim().slice(0, 2e3) : null;
+}
+
+// src/code-runtime-engine.ts
+var CodePiRuntimeEngine = class {
+  constructor(options) {
+    this.options = options;
+    if (options.imageAuthorization === "cli_embedded" && !/^odla-ai\/pi-agent:embedded-sha256-[0-9a-f]{64}$/.test(options.image)) throw new TypeError("CLI-embedded Pi image must use its content-addressed local tag");
+    this.#run = options.runAttempt ?? runContainerAttempt;
+    this.#buildPolicyDigest = digestRuntimeValue(JSON.stringify(options.recipes));
+    this.#checkpoints = new CodeRuntimeCheckpointManager({
+      control: options.control,
+      recipes: options.recipes,
+      recipeExecutor: options.recipeExecutor ?? createContainerRecipeExecutor(options.engine),
+      fallbackPolicyDigest: this.#buildPolicyDigest,
+      event: (command, event, refs) => this.#event(command, event, refs)
+    });
+  }
+  options;
+  #active = /* @__PURE__ */ new Map();
+  #run;
+  #buildPolicyDigest;
+  #checkpoints;
+  execute(command) {
+    if (command.kind === "checkpoint_stop") return this.#checkpoint(command);
+    if (command.kind === "prompt") return this.#prompt(command);
+    return this.#start(command, command.kind === "resume");
+  }
+  async acknowledged(command, result) {
+    if (await this.#checkpoints.acknowledged(command, result)) return;
+    const active = this.#active.get(command.sessionId);
+    if (!active || result.status !== "running") return;
+    active.acknowledged = true;
+    if (active.failure) await this.options.control.reportSessionFailure(command.sessionId, active.failure).catch(() => void 0);
+  }
+  async close() {
+    const sessions = [...this.#active.values()];
+    for (const session of sessions) session.abort.abort("runtime_shutdown");
+    await Promise.allSettled(sessions.map((session) => session.done));
+    await Promise.allSettled(sessions.map((session) => session.workspace.cleanup()));
+    this.#active.clear();
+  }
+  async #start(command, resume) {
+    if (this.#active.has(command.sessionId)) throw new TypeError("Code session is already active on this runtime");
+    const metadata = codeCommandMetadata(command.payload, resume);
+    const requestedLocal = codeLocalSource(command.payload);
+    let workspace;
+    let sourceDigest;
+    let localTrustedBaseDigest;
+    if (requestedLocal) {
+      const prepared = await prepareRuntimeLocalSource({
+        command,
+        descriptor: requestedLocal,
+        available: this.options.localSource,
+        repository: metadata.repository,
+        baseCommitSha: metadata.baseCommitSha,
+        resume
+      });
+      ({ workspace, sourceDigest, trustedBaseDigest: localTrustedBaseDigest } = prepared);
+      if (command.payload.sourceSet) {
+        const selected = await this.options.control.source(command.sessionId);
+        if (selected.repository !== metadata.repository || selected.commitSha !== metadata.baseCommitSha || selected.treeDigest !== metadata.sourceTreeDigest) {
+          await workspace.cleanup();
+          throw new TypeError("Code local source does not match the selected GitHub primary source");
+        }
+        await attachCodeRuntimeReferences(workspace, selected.references ?? []);
+      }
+    } else {
+      const source = await this.options.control.source(command.sessionId);
+      const materialized = await materializeCodeRuntimeSource(source);
+      try {
+        workspace = resume ? (await restoreCodeWorkspaceCheckpoint({
+          trustedBaseDir: materialized.sourceDir,
+          trustedBaseCommitSha: source.commitSha,
+          checkpoint: codeCheckpointPayload(command.payload)
+        })).workspace : await stageWorkspace(materialized.sourceDir);
+      } finally {
+        await materialized.cleanup();
+      }
+      sourceDigest = source.treeDigest;
+    }
+    const abort = new AbortController();
+    const conversationRefs = [];
+    const active = {
+      workspace,
+      abort,
+      conversationRefs,
+      acknowledged: false,
+      role: metadata.role,
+      title: metadata.title,
+      maxTokensPerInteraction: metadata.maxTokensPerInteraction,
+      baseCommitSha: metadata.baseCommitSha,
+      repository: metadata.repository,
+      sourceTreeDigest: metadata.sourceTreeDigest,
+      trustedBaseDigest: requestedLocal ? localTrustedBaseDigest : await digestStagedWorkspace(workspace.baselineDir, {
+        maxFiles: 2e4,
+        maxBytes: 512 * 1024 * 1024
+      }),
+      planningInputDigest: metadata.planningInputDigest ?? digestRuntimeValue(
+        JSON.stringify({ attestation: metadata.attestationDigest, prompt: metadata.prompt, tree: sourceDigest })
+      ),
+      done: Promise.resolve(null)
+    };
+    this.#active.set(command.sessionId, active);
+    if (requestedLocal) {
+      await this.#event(command, {
+        type: "message",
+        actor: "system",
+        body: `Source snapshot: local checkout ${requestedLocal.snapshotDigest} \xB7 ${requestedLocal.modified ? "modified" : "clean"} \xB7 Git ${requestedLocal.headCommitSha}`
+      }, conversationRefs);
+    }
+    active.done = this.#runAttempt(command, metadata, active).catch(async (cause) => {
+      const detail = runtimeErrorMessage(cause);
+      await this.#event(command, { type: "message", actor: "system", body: `Pi failed: ${detail}` }, conversationRefs).catch(() => void 0);
+      await this.#diagnostic(command, active, detail);
+      await this.#event(command, { type: "status", status: "failed" }, conversationRefs).catch(() => void 0);
+      await this.#failure(command, active, detail);
+      return null;
+    });
+    return { status: "running", message: resume ? "Pi resumed from a portable checkpoint" : "Pi started" };
+  }
+  async #prompt(command) {
+    const active = this.#active.get(command.sessionId);
+    const prompt = command.payload.prompt;
+    if (!active || typeof prompt !== "string" || !prompt.trim() || prompt.length > 2e4) {
+      throw new TypeError("prompt requires an active Code session and bounded text");
+    }
+    const requestedLimit = command.payload.maxTokensPerInteraction ?? active.maxTokensPerInteraction;
+    if (!Number.isSafeInteger(requestedLimit) || Number(requestedLimit) < 4e3 || Number(requestedLimit) > 2e5) {
+      throw new TypeError("prompt requires a valid interaction token limit");
+    }
+    active.maxTokensPerInteraction = Number(requestedLimit);
+    await active.done;
+    active.abort = new AbortController();
+    active.acknowledged = false;
+    active.failure = void 0;
+    active.done = this.#runAttempt(command, {
+      role: active.role,
+      title: active.title,
+      prompt,
+      maxTokensPerInteraction: active.maxTokensPerInteraction,
+      planningInputDigest: active.planningInputDigest,
+      attestationDigest: "follow-up",
+      repository: active.repository,
+      baseCommitSha: active.baseCommitSha,
+      sourceTreeDigest: active.sourceTreeDigest
+    }, active).catch(async (cause) => {
+      const detail = runtimeErrorMessage(cause);
+      await this.#event(
+        command,
+        { type: "message", actor: "system", body: `Pi failed: ${detail}` },
+        active.conversationRefs
+      ).catch(() => void 0);
+      await this.#diagnostic(command, active, detail);
+      await this.#event(command, { type: "status", status: "failed" }, active.conversationRefs).catch(() => void 0);
+      await this.#failure(command, active, detail);
+      return null;
+    });
+    return { status: "running", message: "Pi accepted the owner prompt" };
+  }
+  async #runAttempt(command, metadata, active) {
+    const lease = fakeCodeLease(command, metadata);
+    const broker = createCodeRuntimeToolBroker({
+      recipes: this.options.recipes,
+      engine: this.options.engine,
+      recipeAuthorization: this.options.recipeAuthorization
+    }, lease, metadata.role);
+    const startedAt = Date.now();
+    let completionSeen = false;
+    const interaction = { tokens: 0, noticeEmitted: false };
+    const result = await this.#run({
+      engine: this.options.engine,
+      image: this.options.image,
+      allowUnpinnedImage: this.options.imageAuthorization === "cli_embedded",
+      workspaceDir: active.workspace.workspaceDir,
+      workspaceAccess: "none",
+      task: lease.task,
+      limits: this.options.limits,
+      signal: active.abort.signal,
+      onStderr: (text) => this.#event(command, {
+        type: "message",
+        actor: "system",
+        body: text.slice(0, 4e3)
+      }, active.conversationRefs),
+      onMessage: async (output) => {
+        if (output.type === "inference.request") {
+          return handleCodeRuntimeInference({
+            command,
+            metadata,
+            request: output,
+            state: interaction,
+            control: this.options.control,
+            event: (event) => this.#event(
+              command,
+              event,
+              active.conversationRefs
+            )
+          });
+        }
+        if (output.type === "tool.request") {
+          const toolStarted = Date.now();
+          await this.#event(
+            command,
+            { type: "tool", phase: "started", tool: output.tool },
+            active.conversationRefs
+          ).catch(() => void 0);
+          const response2 = await broker.execute({
+            lease,
+            workspaceDir: active.workspace.workspaceDir,
+            signal: active.abort.signal
+          }, output);
+          await this.#event(command, {
+            type: "tool",
+            phase: "completed",
+            tool: output.tool,
+            ok: response2.ok,
+            durationMs: Date.now() - toolStarted
+          }, active.conversationRefs).catch(() => void 0);
+          return { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "tool.response", ...response2 };
+        }
+        if (output.type === "event") {
+          const payload = runtimeRecord(output.payload);
+          if (output.kind === "pi.started") {
+            await this.#event(command, { type: "status", status: "running" }, active.conversationRefs);
+          } else if (output.kind === "pi.thinking" && payload?.available === true && Number.isSafeInteger(payload.durationMs) && Number(payload.durationMs) >= 0) {
+            await this.#event(command, {
+              type: "thinking",
+              available: true,
+              durationMs: Math.min(Number(payload.durationMs), 864e5)
+            }, active.conversationRefs);
+          } else {
+            await this.#event(command, {
+              type: "message",
+              actor: "system",
+              body: `${output.kind}${output.payload === void 0 ? "" : ` ${safeRuntimeJson(output.payload)}`}`
+            }, active.conversationRefs);
+          }
+        } else if (output.type === "attempt.complete") {
+          completionSeen = true;
+          const body = runtimeResultText(output.result) ?? `Pi ${output.status}.`;
+          await this.#event(command, {
+            type: "message",
+            actor: output.status === "completed" ? "agent" : "system",
+            body
+          }, active.conversationRefs);
+          await this.#event(command, {
+            type: "status",
+            status: output.status === "completed" ? "idle" : "failed",
+            durationMs: Date.now() - startedAt
+          }, active.conversationRefs);
+        }
+      }
+    });
+    if (result.status === "failed" && result.stderr) {
+      await this.#event(command, { type: "message", actor: "system", body: result.stderr.slice(0, 4e3) }, active.conversationRefs);
+    }
+    if (!completionSeen) await this.#event(command, {
+      type: "status",
+      status: result.status === "completed" ? "idle" : "failed",
+      durationMs: Date.now() - startedAt
+    }, active.conversationRefs).catch(() => void 0);
+    if (result.status === "failed") {
+      const detail = (runtimeResultError(result.result) ?? result.stderr.trim()) || "Pi container failed";
+      await this.#diagnostic(command, active, detail);
+      await this.#failure(command, active, detail);
+    }
+    return result;
+  }
+  async #checkpoint(command) {
+    const active = this.#active.get(command.sessionId);
+    if (!active) throw new TypeError("Code session workspace is not active on this runtime");
+    const result = await this.#checkpoints.prepare(command, active);
+    this.#active.delete(command.sessionId);
+    return result;
+  }
+  async #failure(command, active, value) {
+    active.failure = value.slice(0, 2e3);
+    if (active.acknowledged) {
+      await this.options.control.reportSessionFailure(command.sessionId, active.failure).catch(() => void 0);
+    }
+  }
+  async #diagnostic(command, active, value) {
+    const detail = value.trim().slice(0, 2e3) || "Pi runtime failed";
+    this.options.onDiagnostic?.(detail);
+    await this.#event(
+      command,
+      { type: "diagnostic", level: "error", message: detail },
+      active.conversationRefs
+    ).catch(() => void 0);
+  }
+  async #event(command, event, refs) {
+    await appendCodeRuntimeEvent(this.options.control, command, event, refs);
+  }
+};
+
+export {
+  digestStagedWorkspace,
+  CodeRuntimeControlError,
+  createCodeRuntimeControlClient,
+  CODE_RUNTIME_PROTOCOL_VERSION,
+  runCodeRuntimeHeartbeatLoop,
+  CodeRuntimeReconciler,
+  createCodeWorkspaceCheckpoint,
+  restoreCodeWorkspaceCheckpoint,
+  isCheckpointEffectCompleted,
+  buildRecipeContainerArgs,
+  createContainerRecipeExecutor,
+  assertCodeBuildRecipe,
+  verifyCodeCandidate,
+  prepareRuntimeCheckpoint,
+  CodeRuntimeCheckpointManager,
+  materializeCodeRuntimeSource,
+  attachCodeRuntimeReferences,
+  createCodeToolBroker,
+  CodePiRuntimeEngine
+};
+//# sourceMappingURL=chunk-GMVZ4LZH.js.map