@odla-ai/harness 0.1.0

package/dist/code-runtime-cli.cjs

@@ -0,0 +1,2341 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/code-runtime-cli.ts
+var import_node_os3 = require("os");
+var import_promises8 = require("fs/promises");
+
+// src/code-runtime-client.ts
+var import_code = require("@odla-ai/camel/code");
+var CodeRuntimeControlError = class extends Error {
+  constructor(message2, status, code = "control_error") {
+    super(message2);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+  name = "CodeRuntimeControlError";
+};
+function createCodeRuntimeControlClient(options) {
+  const endpoint = validatedEndpoint(options.endpoint);
+  if (!/^odla_code_host_[0-9a-f]{64}$/.test(options.token)) throw new TypeError("invalid Code host credential");
+  const requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
+  if (!Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 1e3 || requestTimeoutMs > 12e4) {
+    throw new TypeError("requestTimeoutMs must be an integer from 1000 to 120000");
+  }
+  const modelRequestTimeoutMs = options.modelRequestTimeoutMs ?? 15 * 6e4;
+  if (!Number.isSafeInteger(modelRequestTimeoutMs) || modelRequestTimeoutMs < 3e4 || modelRequestTimeoutMs > 30 * 6e4) {
+    throw new TypeError("modelRequestTimeoutMs must be an integer from 30000 to 1800000");
+  }
+  const request = options.fetch ?? fetch;
+  const call = async (path, body, timeoutMs = requestTimeoutMs) => {
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+    let response2;
+    try {
+      response2 = await request(`${endpoint}${path}`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${options.token}`, "content-type": "application/json" },
+        body: JSON.stringify(body),
+        redirect: "error",
+        signal
+      });
+    } catch (cause) {
+      if (options.signal?.aborted) throw cause;
+      throw new CodeRuntimeControlError("Code runtime control plane is unavailable", 503, "transport_unavailable");
+    }
+    const value = await response2.json().catch(() => null);
+    if (!response2.ok) {
+      const problem = record(record(value)?.error);
+      throw new CodeRuntimeControlError(
+        typeof problem?.message === "string" ? problem.message : `Code runtime request failed (${response2.status})`,
+        response2.status,
+        typeof problem?.code === "string" ? problem.code : void 0
+      );
+    }
+    return value;
+  };
+  return {
+    heartbeat: async (version, capabilities) => {
+      validateHeartbeat(version, capabilities);
+      return parseSnapshot(await call("/registry/code/runtime/heartbeat", { runtimeVersion: version, capabilities }));
+    },
+    acknowledge: async (commandId, result) => {
+      if (!/^ccmd_[0-9a-f]{32}$/.test(commandId)) throw new TypeError("invalid Code runtime command id");
+      await call(`/registry/code/runtime/commands/${commandId}/ack`, result);
+    },
+    source: async (sessionId) => parseSource(
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
+    ),
+    infer: async (sessionId, inference) => {
+      const value = record(await call(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`,
+        inference,
+        modelRequestTimeoutMs
+      ));
+      if (!value || value.requestId !== inference.requestId || !record(value.response) || !record(value.receipt)) {
+        throw new CodeRuntimeControlError("invalid Code inference response", 502, "invalid_response");
+      }
+      return value;
+    },
+    review: async (sessionId, review) => parseReview(
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/review`, review, modelRequestTimeoutMs)
+    ),
+    submitCandidate: async (sessionId, checkpointId, verification) => {
+      if (!/^cpoint_[0-9a-f]{32}$/.test(checkpointId)) throw new TypeError("invalid Code checkpoint id");
+      return parseCandidate(await call(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/candidates`,
+        { checkpointId, verification }
+      ));
+    },
+    appendSessionEvent: async (sessionId, eventId, event) => {
+      const serialized = JSON.stringify(event);
+      if (!/^[A-Za-z0-9._:-]{1,120}$/.test(eventId) || !event || typeof event !== "object" || new TextEncoder().encode(serialized).byteLength > 24e3) {
+        throw new TypeError("invalid Code session event");
+      }
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
+    },
+    reportSessionFailure: async (sessionId, message2) => {
+      if (!message2.trim() || message2.length > 2e3) throw new TypeError("invalid Code session failure");
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
+    }
+  };
+}
+function validatedEndpoint(value) {
+  const endpoint = value.replace(/\/+$/, "");
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    throw new TypeError("endpoint must be an HTTPS URL");
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.username || url.password || url.protocol !== "https:" && !(loopback && url.protocol === "http:")) {
+    throw new TypeError("endpoint must use HTTPS (HTTP is allowed only for loopback testing)");
+  }
+  return endpoint;
+}
+function validSessionId(value) {
+  if (!/^csess_[0-9a-f]{32}$/.test(value)) throw new TypeError("invalid Code session id");
+  return value;
+}
+function validateHeartbeat(version, capabilities) {
+  if (!version.trim() || version.length > 80) throw new TypeError("runtimeVersion is required and at most 80 characters");
+  if (capabilities.protocolVersion !== CODE_RUNTIME_PROTOCOL_VERSION) throw new TypeError("unsupported Code runtime protocol version");
+  if (capabilities.platform !== "macos" && capabilities.platform !== "linux") throw new TypeError("invalid runtime platform");
+  if (!capabilities.arch || !capabilities.engines.length || !capabilities.engines.every((engine) => ["container", "podman", "docker"].includes(engine))) {
+    throw new TypeError("runtime arch and supported engine are required");
+  }
+  if (!Number.isSafeInteger(capabilities.cpuCount) || capabilities.cpuCount < 1 || !Number.isSafeInteger(capabilities.memoryBytes) || capabilities.memoryBytes < 1) {
+    throw new TypeError("runtime resources must be positive integers");
+  }
+}
+function parseSnapshot(value) {
+  const root = record(value);
+  const host = record(root?.host);
+  if (!host || typeof host.hostId !== "string" || typeof host.runtimeVersion !== "string" || !Number.isSafeInteger(host.lastSeenAt) || host.revokedAt !== null || !Array.isArray(root?.bindings) || root.bindings.length > 1024 || !Array.isArray(root?.commands) || root.commands.length > 64) throw invalid("heartbeat");
+  const bindingIds = /* @__PURE__ */ new Set();
+  const bindings = root.bindings.map((item) => {
+    const binding = record(item);
+    if (!binding || typeof binding.bindingId !== "string" || typeof binding.appId !== "string" || binding.env !== "dev" && binding.env !== "prod" || typeof binding.offerId !== "string" || binding.hostId !== host.hostId || !Number.isSafeInteger(binding.generation) || Number(binding.generation) < 1 || binding.revokedAt !== null || bindingIds.has(binding.bindingId)) {
+      throw invalid("binding");
+    }
+    bindingIds.add(binding.bindingId);
+    return binding;
+  });
+  const commandIds = /* @__PURE__ */ new Set();
+  const commandSequences = /* @__PURE__ */ new Set();
+  const commands = root.commands.map((item) => {
+    const command = record(item);
+    const binding = bindings.find((candidate) => candidate.bindingId === command?.bindingId);
+    const sequenceKey = `${String(command?.instanceId)}:${String(command?.sequence)}`;
+    if (!command || typeof command.commandId !== "string" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId) || typeof command.instanceId !== "string" || typeof command.sessionId !== "string" || !/^csess_[0-9a-f]{32}$/.test(command.sessionId) || typeof command.appId !== "string" || command.env !== "dev" && command.env !== "prod" || command.hostId !== host.hostId || !binding || binding.appId !== command.appId || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence) || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey) || !["start", "prompt", "checkpoint_stop", "resume"].includes(String(command.kind)) || !record(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid("command");
+    commandIds.add(command.commandId);
+    commandSequences.add(sequenceKey);
+    return command;
+  });
+  return { host, bindings, commands };
+}
+async function parseSource(value) {
+  const snapshot = record(record(value)?.snapshot);
+  if (!snapshot || typeof snapshot.repository !== "string" || typeof snapshot.commitSha !== "string" || typeof snapshot.treeDigest !== "string" || !Array.isArray(snapshot.files)) throw invalid("source");
+  const files = snapshot.files.map((value2) => {
+    const file = record(value2);
+    if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("source file");
+    return { path: file.path, content: file.content };
+  });
+  const referencesValue = snapshot.references === void 0 ? [] : snapshot.references;
+  if (!Array.isArray(referencesValue) || referencesValue.length > 5) throw invalid("reference sources");
+  const aliases = /* @__PURE__ */ new Set();
+  const references = [];
+  for (const item of referencesValue) {
+    const reference = record(item);
+    if (!reference || typeof reference.alias !== "string" || !/^[a-z][a-z0-9-]{0,39}$/.test(reference.alias) || aliases.has(reference.alias) || reference.alias === "primary" || typeof reference.repository !== "string" || typeof reference.commitSha !== "string" || typeof reference.treeDigest !== "string" || !Array.isArray(reference.files)) throw invalid("reference source");
+    aliases.add(reference.alias);
+    const referenceFiles = reference.files.map((entry) => {
+      const file = record(entry);
+      if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("reference source file");
+      return { path: file.path, content: file.content };
+    });
+    const source2 = { repository: reference.repository, commitSha: reference.commitSha, files: referenceFiles };
+    const referenceDigest = await (0, import_code.digestCodeRepositorySnapshot)(source2, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
+    if (referenceDigest !== reference.treeDigest) throw invalid("reference source digest");
+    references.push({ alias: reference.alias, ...source2, treeDigest: referenceDigest });
+  }
+  const source = { repository: snapshot.repository, commitSha: snapshot.commitSha, files };
+  const digest = await (0, import_code.digestCodeRepositorySnapshot)(source, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
+  if (digest !== snapshot.treeDigest) throw invalid("source digest");
+  return { ...source, treeDigest: digest, ...references.length ? { references } : {} };
+}
+function parseReview(value) {
+  const review = record(record(value)?.review);
+  if (!review || !["approved", "rejected"].includes(String(review.verdict)) || typeof review.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(review.reviewDigest) || typeof review.provider !== "string" || !review.provider || typeof review.model !== "string" || !review.model || !Number.isSafeInteger(review.policyVersion) || Number(review.policyVersion) < 1) throw invalid("review");
+  return review;
+}
+function parseCandidate(value) {
+  const candidate = record(record(value)?.candidate);
+  if (!candidate || typeof candidate.candidateId !== "string" || !/^ccand_[0-9a-f]{32}$/.test(candidate.candidateId) || !["submitted", "approved", "published", "failed"].includes(String(candidate.status))) {
+    throw invalid("candidate");
+  }
+  return { candidateId: candidate.candidateId, status: candidate.status };
+}
+var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var invalid = (part) => new CodeRuntimeControlError(`invalid Code runtime ${part} response`, 502, "invalid_response");
+
+// src/code-runtime.ts
+var CODE_RUNTIME_PROTOCOL_VERSION = 1;
+async function runCodeRuntimeHeartbeatLoop(options) {
+  const heartbeatMs = options.heartbeatMs ?? 15e3;
+  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1e3 || heartbeatMs > 3e5) {
+    throw new TypeError("heartbeatMs must be an integer from 1000 to 300000");
+  }
+  let retryMs = 1e3;
+  do {
+    if (options.signal?.aborted) return;
+    try {
+      const snapshot = await options.control.heartbeat(options.runtimeVersion, options.capabilities);
+      await options.onSnapshot?.(snapshot);
+      retryMs = 1e3;
+      if (options.once) return;
+      await wait(heartbeatMs, options.signal);
+    } catch (error) {
+      if (options.signal?.aborted) return;
+      if (options.once || !retryableControlFailure(error)) throw error;
+      await options.onRetry?.(error, retryMs);
+      await wait(retryMs, options.signal);
+      retryMs = Math.min(retryMs * 2, 3e4);
+    }
+  } while (!options.signal?.aborted);
+}
+var CodeRuntimeReconciler = class {
+  constructor(control, engine) {
+    this.control = control;
+    this.engine = engine;
+  }
+  control;
+  engine;
+  results = /* @__PURE__ */ new Map();
+  async reconcile(snapshot) {
+    for (const command of snapshot.commands) {
+      let completed = this.results.get(command.commandId);
+      if (!completed) {
+        let result;
+        try {
+          result = await this.engine.execute(command);
+        } catch (error) {
+          result = { status: "failed", message: (error instanceof Error ? error.message : String(error)).slice(0, 2e3) };
+        }
+        completed = { result, notified: false };
+        this.results.set(command.commandId, completed);
+        if (this.results.size > 1024) this.results.delete(this.results.keys().next().value);
+      }
+      await this.control.acknowledge(command.commandId, completed.result);
+      if (!completed.notified) {
+        await this.engine.acknowledged?.(command, completed.result);
+        completed.notified = true;
+      }
+    }
+  }
+};
+function retryableControlFailure(value) {
+  if (!value || typeof value !== "object") return false;
+  const failure = value;
+  if (failure.code === "invalid_response" || typeof failure.status !== "number") return false;
+  return failure.status === 408 || failure.status === 425 || failure.status === 429 || failure.status >= 500;
+}
+function wait(ms, signal) {
+  return new Promise((resolve6) => {
+    if (signal?.aborted) return resolve6();
+    const timer = setTimeout(resolve6, ms);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      resolve6();
+    }, { once: true });
+  });
+}
+
+// src/code-checkpoint.ts
+var import_code2 = require("@odla-ai/camel/code");
+
+// src/code-patch.ts
+var import_node_child_process = require("child_process");
+var import_promises = require("fs/promises");
+var import_node_path = require("path");
+var RESERVED = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
+var SECRET = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+var PATH = /^[A-Za-z0-9_@+.,-]+(?:\/[A-Za-z0-9_@+.,-]+)*$/;
+var FORBIDDEN = /^(?:GIT binary patch|Binary files |rename (?:from|to) |copy (?:from|to) |similarity index |old mode |new mode |deleted file mode 160000|new file mode 160000)/m;
+function validateCodePatch(patch2, maxBytes) {
+  if (!patch2 || Buffer.byteLength(patch2) > maxBytes || patch2.includes("\0") || patch2.includes("\r")) {
+    throw new TypeError("patch is empty, malformed, or exceeds its byte limit");
+  }
+  if (FORBIDDEN.test(patch2) || /(?:old|new)(?: file)? mode 120000/.test(patch2)) {
+    throw new TypeError("patch uses a forbidden binary, link, mode, rename, or copy operation");
+  }
+  const paths = [];
+  const lines = patch2.split("\n");
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
+    if (!line.startsWith("diff --git ")) continue;
+    const match = /^diff --git a\/(\S+) b\/(\S+)$/.exec(line);
+    const path = match?.[1];
+    if (!path || !match?.[2] || path !== match[2]) throw new TypeError("patch must use one unquoted relative path per diff");
+    validateRelativePath(path);
+    const header = lines.slice(index + 1).findIndex((candidate) => candidate.startsWith("diff --git "));
+    const section = lines.slice(index + 1, header < 0 ? lines.length : index + 1 + header);
+    const oldPath = section.find((candidate) => candidate.startsWith("--- "))?.slice(4);
+    const newPath = section.find((candidate) => candidate.startsWith("+++ "))?.slice(4);
+    if (!validHeaderPath(oldPath, path, "a") || !validHeaderPath(newPath, path, "b")) {
+      throw new TypeError("patch file headers do not match the declared path");
+    }
+    paths.push(path);
+  }
+  if (!paths.length || new Set(paths).size !== paths.length) throw new TypeError("patch has no diffs or repeats a path");
+  return paths;
+}
+function validHeaderPath(value, path, prefix) {
+  return value === "/dev/null" || value === `${prefix}/${path}`;
+}
+function validateRelativePath(path) {
+  const parts = path.split("/");
+  if (!PATH.test(path) || parts.some((part) => part === "." || part === ".." || RESERVED.has(part)) || parts.some((part) => SECRET.test(part))) {
+    throw new TypeError("path is outside the allowed staged source tree");
+  }
+}
+function resolveCodePath(workspaceDir, path) {
+  validateRelativePath(path);
+  const root = (0, import_node_path.resolve)(workspaceDir);
+  const target = (0, import_node_path.resolve)(root, path);
+  if (target !== root && !target.startsWith(`${root}${import_node_path.sep}`)) throw new TypeError("path escapes the staged workspace");
+  return target;
+}
+async function applyCodePatch(workspaceDir, patch2, paths) {
+  await gitApply(workspaceDir, patch2, true);
+  await gitApply(workspaceDir, patch2, false);
+  for (const path of paths) {
+    try {
+      const info = await (0, import_promises.lstat)(resolveCodePath(workspaceDir, path));
+      if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
+        throw new TypeError("patch created a non-regular workspace entry");
+      }
+    } catch (reason) {
+      if (reason.code !== "ENOENT") throw reason;
+    }
+  }
+}
+function gitApply(cwd, patch2, check) {
+  return new Promise((accept, reject) => {
+    const args = ["apply", "--recount", "--whitespace=nowarn", ...check ? ["--check"] : [], "-"];
+    const child = (0, import_node_child_process.spawn)("git", args, {
+      cwd,
+      shell: false,
+      stdio: ["pipe", "ignore", "pipe"],
+      env: { PATH: process.env.PATH ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" }
+    });
+    let stderr = "";
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (text) => {
+      if (stderr.length < 4e3) stderr += text.slice(0, 4e3);
+    });
+    child.once("error", reject);
+    child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(`patch did not apply: ${stderr.trim().slice(0, 500)}`)));
+    child.stdin.end(patch2);
+  });
+}
+
+// src/workspace.ts
+var import_promises2 = require("fs/promises");
+var import_node_os = require("os");
+var import_node_path3 = require("path");
+var import_node_child_process2 = require("child_process");
+
+// src/workspace-policy.ts
+var import_node_path2 = require("path");
+var SKIP_WORKSPACE_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  ".odla",
+  ".wrangler",
+  "node_modules",
+  "dist",
+  "coverage"
+]);
+var SECRET_WORKSPACE_FILE = /^(?:\.env(?:\..+)?|\.dev\.vars|\.dev-token(?:\..+)?|credentials(?:\..+)?\.json|dev-token(?:\..+)?(?:\.json)?)$/i;
+function allowedWorkspacePath(relativePath) {
+  const parts = relativePath.split("/");
+  return !(0, import_node_path2.isAbsolute)(relativePath) && !relativePath.includes("\\") && !relativePath.includes("\0") && !parts.some((part) => !part || part === "." || part === ".." || SKIP_WORKSPACE_DIRS.has(part)) && !SECRET_WORKSPACE_FILE.test(parts.at(-1) ?? "");
+}
+
+// src/workspace.ts
+async function sourceFiles(sourceDir, maxFiles, maxBytes) {
+  const files = [];
+  let bytes = 0;
+  const walk = async (dir) => {
+    for (const entry of await (0, import_promises2.readdir)(dir, { withFileTypes: true })) {
+      if (entry.isDirectory() && SKIP_WORKSPACE_DIRS.has(entry.name)) continue;
+      if (!entry.isDirectory() && SECRET_WORKSPACE_FILE.test(entry.name)) continue;
+      const path = (0, import_node_path3.join)(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        await walk(path);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const metadata = await (0, import_promises2.stat)(path);
+      bytes += metadata.size;
+      if (files.length + 1 > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+      if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+      files.push({
+        source: path,
+        relativePath: (0, import_node_path3.relative)(sourceDir, path),
+        mode: metadata.mode & 511,
+        bytes: metadata.size
+      });
+    }
+  };
+  await walk(sourceDir);
+  return files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+}
+async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
+  const child = (0, import_node_child_process2.spawn)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    cwd: sourceDir,
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false
+  });
+  const stdout = [];
+  const stderr = [];
+  let outputBytes = 0;
+  child.stdout.on("data", (chunk) => {
+    outputBytes += chunk.byteLength;
+    if (outputBytes > 8 * 1024 * 1024) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (outputBytes > 8 * 1024 * 1024) throw new Error("git file inventory exceeds 8 MiB");
+  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  const paths = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
+  if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+  const root = (0, import_node_path3.resolve)(sourceDir);
+  const files = [];
+  let bytes = 0;
+  for (const relativePath of paths) {
+    if (!allowedWorkspacePath(relativePath)) continue;
+    const source = (0, import_node_path3.resolve)(root, relativePath);
+    if (!source.startsWith(`${root}${import_node_path3.sep}`)) throw new TypeError("git file path escapes workspace");
+    let metadata;
+    try {
+      metadata = await (0, import_promises2.lstat)(source);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    if (metadata.isSymbolicLink() || !metadata.isFile()) continue;
+    bytes += metadata.size;
+    if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+    files.push({ source, relativePath, mode: metadata.mode & 511, bytes: metadata.size });
+  }
+  return files;
+}
+async function copyTree(files, destination) {
+  for (const file of files) {
+    const target = (0, import_node_path3.join)(destination, file.relativePath);
+    await (0, import_promises2.mkdir)((0, import_node_path3.resolve)(target, ".."), { recursive: true });
+    await (0, import_promises2.copyFile)(file.source, target);
+    await (0, import_promises2.chmod)(target, file.mode);
+  }
+}
+async function captureGitDiff(root, maxBytes) {
+  const child = (0, import_node_child_process2.spawn)("git", [
+    "diff",
+    "--no-index",
+    "--binary",
+    "--no-ext-diff",
+    "--src-prefix=a/",
+    "--dst-prefix=b/",
+    "--",
+    "baseline",
+    "workspace"
+  ], { cwd: root, stdio: ["ignore", "pipe", "pipe"], shell: false });
+  const stdout = [];
+  const stderr = [];
+  let bytes = 0;
+  child.stdout.on("data", (chunk) => {
+    bytes += chunk.byteLength;
+    if (bytes > maxBytes) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (bytes > maxBytes) throw new Error(`patch exceeds ${maxBytes} bytes`);
+  if (code !== 0 && code !== 1) {
+    throw new Error(`git diff failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  }
+  return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("a/workspace/", "a/").replaceAll("b/baseline/", "b/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
+}
+async function stageWorkspace(source, options = {}) {
+  const sourceDir = await (0, import_promises2.realpath)((0, import_node_path3.resolve)(source));
+  const sourceStat = await (0, import_promises2.stat)(sourceDir);
+  if (!sourceStat.isDirectory()) throw new TypeError("workspace source must be a directory");
+  const root = await (0, import_promises2.mkdtemp)((0, import_node_path3.join)(options.tempRoot ?? (0, import_node_os.tmpdir)(), "odla-harness-"));
+  const baselineDir = (0, import_node_path3.join)(root, "baseline");
+  const workspaceDir = (0, import_node_path3.join)(root, "workspace");
+  await Promise.all([(0, import_promises2.mkdir)(baselineDir), (0, import_promises2.mkdir)(workspaceDir)]);
+  try {
+    const maxFiles = options.maxFiles ?? 2e4;
+    const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
+    const files = options.gitTrackedAndUnignored ? await gitSourceFiles(sourceDir, maxFiles, maxBytes) : await sourceFiles(sourceDir, maxFiles, maxBytes);
+    await Promise.all([copyTree(files, baselineDir), copyTree(files, workspaceDir)]);
+    return {
+      root,
+      baselineDir,
+      workspaceDir,
+      fileCount: files.length,
+      byteCount: files.reduce((sum, file) => sum + file.bytes, 0),
+      patch: (maxBytes2) => captureGitDiff(root, maxBytes2),
+      cleanup: () => (0, import_promises2.rm)(root, { recursive: true, force: true })
+    };
+  } catch (error) {
+    await (0, import_promises2.rm)(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+async function stageWorkspacePair(baselineSource, workspaceSource, options = {}) {
+  const baselineDirSource = await (0, import_promises2.realpath)((0, import_node_path3.resolve)(baselineSource));
+  const workspaceDirSource = await (0, import_promises2.realpath)((0, import_node_path3.resolve)(workspaceSource));
+  const maxFiles = options.maxFiles ?? 2e4;
+  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
+  const [baselineFiles, workspaceFiles] = await Promise.all([
+    sourceFiles(baselineDirSource, maxFiles, maxBytes),
+    sourceFiles(workspaceDirSource, maxFiles, maxBytes)
+  ]);
+  const root = await (0, import_promises2.mkdtemp)((0, import_node_path3.join)(options.tempRoot ?? (0, import_node_os.tmpdir)(), "odla-harness-"));
+  const baselineDir = (0, import_node_path3.join)(root, "baseline");
+  const workspaceDir = (0, import_node_path3.join)(root, "workspace");
+  await Promise.all([(0, import_promises2.mkdir)(baselineDir), (0, import_promises2.mkdir)(workspaceDir)]);
+  try {
+    await Promise.all([copyTree(baselineFiles, baselineDir), copyTree(workspaceFiles, workspaceDir)]);
+    return {
+      root,
+      baselineDir,
+      workspaceDir,
+      fileCount: workspaceFiles.length,
+      byteCount: workspaceFiles.reduce((sum, file) => sum + file.bytes, 0),
+      patch: (maxPatchBytes) => captureGitDiff(root, maxPatchBytes),
+      cleanup: () => (0, import_promises2.rm)(root, { recursive: true, force: true })
+    };
+  } catch (error) {
+    await (0, import_promises2.rm)(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+// src/code-checkpoint.ts
+async function createCodeWorkspaceCheckpoint(input) {
+  const maximum = input.maximumPatchBytes ?? 256 * 1024;
+  if (!Number.isSafeInteger(maximum) || maximum < 1 || maximum > 256 * 1024) {
+    throw new TypeError("checkpoint patch bound must be from 1 to 262144 bytes");
+  }
+  const patch2 = await input.workspace.patch(maximum);
+  if (patch2) validateCodePatch(patch2, maximum);
+  return (0, import_code2.createCodePortableCheckpoint)({ baseCommitSha: input.baseCommitSha, patch: patch2, state: input.state });
+}
+async function restoreCodeWorkspaceCheckpoint(input) {
+  const checkpoint = await (0, import_code2.verifyCodePortableCheckpoint)(input.checkpoint);
+  if (checkpoint.baseCommitSha !== input.trustedBaseCommitSha) {
+    throw new TypeError("checkpoint trusted base does not match the fetched commit");
+  }
+  const workspace = await stageWorkspace(input.trustedBaseDir, input.stage);
+  try {
+    if (checkpoint.patch) {
+      const paths = validateCodePatch(checkpoint.patch, 256 * 1024);
+      await applyCodePatch(workspace.workspaceDir, checkpoint.patch, paths);
+    }
+    return { workspace, checkpoint };
+  } catch (error) {
+    await workspace.cleanup();
+    throw error;
+  }
+}
+
+// src/code-verifier.ts
+var import_node_crypto3 = require("crypto");
+var import_node_fs2 = require("fs");
+var import_promises5 = require("fs/promises");
+var import_node_path6 = require("path");
+var import_code3 = require("@odla-ai/camel/code");
+
+// src/recipe-container.ts
+var import_node_child_process4 = require("child_process");
+var import_node_process2 = require("process");
+var import_node_crypto = require("crypto");
+
+// src/container.ts
+var import_node_child_process3 = require("child_process");
+var import_node_fs = require("fs");
+var import_promises3 = require("fs/promises");
+var import_node_path4 = require("path");
+var import_node_process = require("process");
+
+// src/types.ts
+var HARNESS_PROTOCOL_VERSION = 1;
+
+// src/protocol.ts
+var CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
+var HarnessProtocolError = class extends Error {
+  name = "HarnessProtocolError";
+};
+function record2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function boundedText(value, label, max) {
+  if (typeof value !== "string" || !value || value.length > max || CONTROL.test(value)) {
+    throw new HarnessProtocolError(`${label} must be a non-empty string of at most ${max} characters`);
+  }
+  return value;
+}
+function parseAgentOutput(line) {
+  if (Buffer.byteLength(line, "utf8") > 1e6) throw new HarnessProtocolError("agent message exceeds 1 MB");
+  let value;
+  try {
+    value = JSON.parse(line);
+  } catch {
+    throw new HarnessProtocolError("agent emitted invalid JSON");
+  }
+  const message2 = record2(value);
+  if (!message2 || message2.protocolVersion !== HARNESS_PROTOCOL_VERSION) {
+    throw new HarnessProtocolError(`agent protocolVersion must be ${HARNESS_PROTOCOL_VERSION}`);
+  }
+  if (message2.type === "event") {
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "event",
+      kind: boundedText(message2.kind, "event.kind", 120),
+      ...message2.payload === void 0 ? {} : { payload: message2.payload }
+    };
+  }
+  if (message2.type === "inference.request") {
+    const call = record2(message2.call);
+    if (!call || !Array.isArray(call.messages) || !Number.isSafeInteger(call.maxTokens)) {
+      throw new HarnessProtocolError("inference.request.call requires messages and maxTokens");
+    }
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "inference.request",
+      requestId: boundedText(message2.requestId, "requestId", 180),
+      call
+    };
+  }
+  if (message2.type === "tool.request") {
+    const input = record2(message2.input);
+    const tool = String(message2.tool);
+    if (!input || !["sandbox.read", "sandbox.apply_patch", "sandbox.run_recipe"].includes(tool)) {
+      throw new HarnessProtocolError("tool.request requires a registered tool and object input");
+    }
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "tool.request",
+      requestId: boundedText(message2.requestId, "requestId", 180),
+      tool,
+      input
+    };
+  }
+  if (message2.type === "attempt.complete") {
+    if (!(/* @__PURE__ */ new Set(["completed", "failed", "cancelled"])).has(String(message2.status))) {
+      throw new HarnessProtocolError("attempt.complete.status is invalid");
+    }
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "attempt.complete",
+      status: message2.status,
+      ...message2.result === void 0 ? {} : { result: message2.result }
+    };
+  }
+  throw new HarnessProtocolError("agent message type is unsupported");
+}
+function encodeAgentInput(message2) {
+  return `${JSON.stringify(message2)}
+`;
+}
+
+// src/container.ts
+var DIGEST_IMAGE = /^[a-z0-9][a-z0-9._/-]*(?::[a-zA-Z0-9._-]+)?@sha256:[0-9a-f]{64}$/;
+function assertPinnedImage(image) {
+  if (!DIGEST_IMAGE.test(image)) throw new TypeError("container image must be pinned by sha256 digest");
+}
+async function commandAvailable(engine) {
+  for (const directory of (process.env.PATH ?? "").split(import_node_path4.delimiter).filter(Boolean)) {
+    try {
+      await (0, import_promises3.access)((0, import_node_path4.join)(directory, engine), import_node_fs.constants.X_OK);
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function selectContainerEngine(requested = "auto", options = {}) {
+  const platform = options.platform ?? process.platform;
+  const arch = options.arch ?? process.arch;
+  const uid = options.uid ?? (typeof import_node_process.getuid === "function" ? (0, import_node_process.getuid)() : 1e3);
+  const available = options.available ?? commandAvailable;
+  const validate2 = async (engine) => {
+    if (engine === "container" && (platform !== "darwin" || arch !== "arm64")) {
+      throw new TypeError("Apple container requires Apple Silicon macOS");
+    }
+    if (engine === "podman" && platform === "linux" && uid === 0) {
+      throw new TypeError("the Linux harness requires rootless Podman; do not run the runner as root");
+    }
+    if (!await available(engine)) throw new TypeError(`${engine} is not installed or executable`);
+    return engine;
+  };
+  if (requested !== "auto") return validate2(requested);
+  const candidates = platform === "darwin" ? arch === "arm64" ? ["container", "podman"] : ["podman"] : platform === "linux" ? ["podman"] : [];
+  for (const engine of candidates) {
+    if (await available(engine)) return validate2(engine);
+  }
+  if (platform === "linux") {
+    throw new TypeError("no rootless Podman found; install Podman or explicitly choose --engine docker after reviewing its daemon boundary");
+  }
+  if (platform === "darwin") {
+    throw new TypeError("Apple container is not installed; on Apple Silicon macOS 26 run `brew install container`, then retry (Podman Machine is the fallback)");
+  }
+  throw new TypeError("no supported container engine found");
+}
+function inspectRootlessPodman() {
+  return new Promise((resolve6, reject) => {
+    (0, import_node_child_process3.execFile)(
+      "podman",
+      ["info", "--format", "{{.Host.Security.Rootless}}"],
+      { encoding: "utf8", maxBuffer: 16 * 1024, timeout: 1e4 },
+      (error, stdout) => {
+        if (error) {
+          reject(new TypeError("could not verify that the active Podman service is rootless"));
+          return;
+        }
+        resolve6(stdout.trim() === "true");
+      }
+    );
+  });
+}
+async function verifyContainerEngineBoundary(engine, options = {}) {
+  const platform = options.platform ?? process.platform;
+  const arch = options.arch ?? process.arch;
+  const uid = options.uid ?? (typeof import_node_process.getuid === "function" ? (0, import_node_process.getuid)() : 1e3);
+  if (engine === "container" && (platform !== "darwin" || arch !== "arm64")) {
+    throw new TypeError("Apple container requires Apple Silicon macOS");
+  }
+  if (engine !== "podman" || platform !== "linux") return;
+  if (uid === 0) throw new TypeError("the Linux harness requires rootless Podman; do not run the runner as root");
+  const rootless = await (options.podmanRootless ?? inspectRootlessPodman)();
+  if (!rootless) throw new TypeError("the active Podman service is not rootless; refusing to run the harness");
+}
+function buildContainerRunArgs(options) {
+  if (!options.allowUnpinnedImage) assertPinnedImage(options.image);
+  if (/[,\r\n]/.test(options.workspaceDir)) throw new TypeError("workspace path contains unsupported mount characters");
+  const uid = typeof import_node_process.getuid === "function" ? (0, import_node_process.getuid)() : 1e3;
+  const gid = typeof import_node_process.getgid === "function" ? (0, import_node_process.getgid)() : 1e3;
+  const safeAttempt = options.task.attemptId.toLowerCase().replace(/[^a-z0-9_.-]/g, "-").slice(0, 40);
+  const name = `odla-harness-${safeAttempt}-${crypto.randomUUID().slice(0, 8)}`;
+  const limits = options.limits ?? {};
+  const access2 = options.workspaceAccess ?? "read-write";
+  const appleMount = access2 === "none" ? [] : [`--mount=type=bind,source=${options.workspaceDir},target=/workspace${access2 === "read-only" ? ",readonly" : ""}`];
+  const ociMount = access2 === "none" ? [] : [`--mount=type=bind,src=${options.workspaceDir},dst=/workspace${access2 === "read-only" ? ",readonly" : ""}`];
+  if (options.engine === "container") {
+    return [
+      "run",
+      "--rm",
+      "--interactive",
+      `--name=${name}`,
+      "--network=none",
+      "--read-only",
+      "--cap-drop=ALL",
+      `--memory=${limits.memory ?? "1g"}`,
+      `--cpus=${limits.cpus ?? 1}`,
+      `--user=${uid}:${gid}`,
+      "--tmpfs=/tmp",
+      ...appleMount,
+      "--workdir=/workspace",
+      `--env=ODLA_HARNESS_PROTOCOL=${HARNESS_PROTOCOL_VERSION}`,
+      `--label=ai.odla.harness.attempt=${options.task.attemptId}`,
+      options.image
+    ];
+  }
+  return [
+    "run",
+    "--rm",
+    "--interactive",
+    `--name=${name}`,
+    "--pull=never",
+    "--network=none",
+    "--read-only",
+    "--cap-drop=ALL",
+    "--security-opt=no-new-privileges",
+    `--pids-limit=${limits.pids ?? 256}`,
+    `--memory=${limits.memory ?? "1g"}`,
+    `--cpus=${limits.cpus ?? 1}`,
+    `--user=${uid}:${gid}`,
+    `--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfsBytes ?? 64 * 1024 * 1024}`,
+    ...ociMount,
+    "--workdir=/workspace",
+    `--env=ODLA_HARNESS_PROTOCOL=${HARNESS_PROTOCOL_VERSION}`,
+    `--label=ai.odla.harness.attempt=${options.task.attemptId}`,
+    options.image
+  ];
+}
+function containerName(args) {
+  return args.find((arg) => arg.startsWith("--name=")).slice("--name=".length);
+}
+async function runContainerAttempt(options) {
+  if (options.signal?.aborted) return { exitCode: 1, status: "cancelled", stderr: "" };
+  await verifyContainerEngineBoundary(options.engine);
+  const args = buildContainerRunArgs(options);
+  const name = containerName(args);
+  const child = (0, import_node_child_process3.spawn)(options.engine, args, { stdio: ["pipe", "pipe", "pipe"], shell: false });
+  let stderr = "";
+  let outputBytes = 0;
+  let complete = null;
+  let stopped = false;
+  let exited = false;
+  child.stderr.setEncoding("utf8");
+  child.stderr.on("data", (text) => {
+    if (stderr.length < 64 * 1024) stderr += text.slice(0, 64 * 1024 - stderr.length);
+  });
+  const stop = (reason) => {
+    if (stopped || exited) return;
+    stopped = true;
+    if (!child.stdin.destroyed) {
+      const cancel = { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "attempt.cancel", reason };
+      child.stdin.write(encodeAgentInput(cancel));
+    }
+    const removeArgs = options.engine === "container" ? ["delete", "--force", name] : ["rm", "-f", name];
+    const killer = (0, import_node_child_process3.spawn)(options.engine, removeArgs, { stdio: "ignore", shell: false });
+    killer.unref();
+  };
+  const abort = () => stop("runner_cancelled");
+  options.signal?.addEventListener("abort", abort, { once: true });
+  const timeout = setTimeout(() => stop("timeout"), options.task.policy.timeoutMs);
+  const start = { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "task.start", task: options.task };
+  if (!stopped && !options.signal?.aborted) child.stdin.write(encodeAgentInput(start));
+  const consume = (async () => {
+    let pending = Buffer.alloc(0);
+    const handleLine = async (raw) => {
+      const bytes = raw.at(-1) === 13 ? raw.subarray(0, -1) : raw;
+      if (bytes.byteLength > 1e6) throw new Error("agent message exceeds 1 MB");
+      const line = bytes.toString("utf8");
+      if (!line.trim()) return;
+      const message2 = parseAgentOutput(line);
+      if (message2.type === "attempt.complete") complete = message2;
+      const response2 = await options.onMessage(message2);
+      if (response2 && !child.stdin.destroyed) child.stdin.write(encodeAgentInput(response2));
+    };
+    try {
+      for await (const raw of child.stdout) {
+        const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+        outputBytes += chunk.byteLength;
+        if (outputBytes > options.task.policy.maxOutputBytes) {
+          throw new Error(`agent output exceeds ${options.task.policy.maxOutputBytes} bytes`);
+        }
+        pending = Buffer.concat([pending, chunk]);
+        let newline = pending.indexOf(10);
+        while (newline >= 0) {
+          await handleLine(pending.subarray(0, newline));
+          pending = pending.subarray(newline + 1);
+          newline = pending.indexOf(10);
+        }
+        if (pending.byteLength > 1e6) throw new Error("agent message exceeds 1 MB");
+      }
+      if (pending.byteLength) await handleLine(pending);
+    } catch (error) {
+      stop("protocol_error");
+      throw error;
+    }
+  })();
+  const exit = new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code) => {
+      exited = true;
+      accept(code ?? 1);
+    });
+  });
+  try {
+    const [exitCode] = await Promise.all([exit, consume]);
+    if (stderr && options.onStderr) await options.onStderr(stderr);
+    if (options.signal?.aborted) return { exitCode, status: "cancelled", stderr };
+    const terminal = complete;
+    if (!terminal) return { exitCode, status: "failed", result: { error: "agent exited without completion" }, stderr };
+    return { exitCode, status: exitCode === 0 ? terminal.status : "failed", result: terminal.result, stderr };
+  } catch (error) {
+    stop("runner_error");
+    await exit.catch(() => 1);
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+    options.signal?.removeEventListener("abort", abort);
+  }
+}
+
+// src/recipe-container.ts
+var ARTIFACT_PATH = /^[A-Za-z0-9_@+.,-]+(?:\/[A-Za-z0-9_@+.,-]+)*$/;
+var PRIVATE_ARTIFACT_PART = /^(?:\.git|\.odla|\.wrangler|\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json)$/i;
+function buildRecipeContainerArgs(engine, workspaceDir, recipe2, name = `odla-recipe-${(0, import_node_crypto.randomUUID)().slice(0, 12)}`) {
+  assertCodeBuildRecipe(recipe2);
+  if (/[,\r\n]/.test(workspaceDir)) throw new TypeError("workspace path contains unsupported mount characters");
+  const uid = typeof import_node_process2.getuid === "function" ? (0, import_node_process2.getuid)() : 1e3;
+  const gid = typeof import_node_process2.getgid === "function" ? (0, import_node_process2.getgid)() : 1e3;
+  const limits = {
+    cpus: recipe2.cpus ?? 1,
+    memory: recipe2.memory ?? "1g",
+    pids: recipe2.pids ?? 256,
+    tmpfs: recipe2.tmpfsBytes ?? 64 * 1024 * 1024
+  };
+  if (engine === "container") {
+    return [
+      "run",
+      "--rm",
+      `--name=${name}`,
+      "--network=none",
+      "--read-only",
+      "--cap-drop=ALL",
+      `--memory=${limits.memory}`,
+      `--cpus=${limits.cpus}`,
+      `--user=${uid}:${gid}`,
+      "--tmpfs=/tmp",
+      `--mount=type=bind,source=${workspaceDir},target=/workspace`,
+      "--workdir=/workspace",
+      "--env=CI=1",
+      recipe2.image,
+      ...recipe2.command
+    ];
+  }
+  return [
+    "run",
+    "--rm",
+    `--name=${name}`,
+    "--pull=never",
+    "--network=none",
+    "--read-only",
+    "--cap-drop=ALL",
+    "--security-opt=no-new-privileges",
+    `--pids-limit=${limits.pids}`,
+    `--memory=${limits.memory}`,
+    `--cpus=${limits.cpus}`,
+    `--user=${uid}:${gid}`,
+    `--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfs}`,
+    `--mount=type=bind,src=${workspaceDir},dst=/workspace`,
+    "--workdir=/workspace",
+    "--env=CI=1",
+    recipe2.image,
+    ...recipe2.command
+  ];
+}
+function createContainerRecipeExecutor(engine) {
+  return {
+    async run(input) {
+      await verifyContainerEngineBoundary(engine);
+      const name = `odla-recipe-${(0, import_node_crypto.randomUUID)().slice(0, 12)}`;
+      const args = buildRecipeContainerArgs(engine, input.workspaceDir, input.recipe, name);
+      return execute(engine, args, name, input.recipe, input.signal);
+    }
+  };
+}
+function assertCodeBuildRecipe(recipe2) {
+  const memoryBytes = parseMemory(recipe2.memory ?? "1g");
+  const tmpfsBytes = recipe2.tmpfsBytes ?? 64 * 1024 * 1024;
+  const artifacts = recipe2.expectedArtifacts ?? [];
+  assertPinnedImage(recipe2.image);
+  if (!/^[A-Za-z0-9._:-]{1,120}$/.test(recipe2.id) || recipe2.command.length < 1 || recipe2.command.length > 64 || recipe2.command.some((part) => !part || part.length > 4096 || /[\0\r\n]/.test(part)) || !Number.isSafeInteger(recipe2.timeoutMs) || recipe2.timeoutMs < 1 || recipe2.timeoutMs > 30 * 6e4 || !Number.isSafeInteger(recipe2.maxOutputBytes) || recipe2.maxOutputBytes < 1 || recipe2.maxOutputBytes > 16 * 1024 * 1024 || !Number.isFinite(recipe2.cpus ?? 1) || (recipe2.cpus ?? 1) < 0.1 || (recipe2.cpus ?? 1) > 32 || memoryBytes < 64 * 1024 * 1024 || memoryBytes > 32 * 1024 * 1024 * 1024 || !Number.isSafeInteger(recipe2.pids ?? 256) || (recipe2.pids ?? 256) < 16 || (recipe2.pids ?? 256) > 4096 || !Number.isSafeInteger(tmpfsBytes) || tmpfsBytes < 1024 * 1024 || tmpfsBytes > 1024 * 1024 * 1024 || artifacts.length > 64 || new Set(artifacts.map((item) => item.id)).size !== artifacts.length || artifacts.some((item) => !/^[A-Za-z0-9._:-]{1,120}$/.test(item.id) || !ARTIFACT_PATH.test(item.path) || item.path.split("/").some((part) => PRIVATE_ARTIFACT_PART.test(part)) || !Number.isSafeInteger(item.maximumBytes) || item.maximumBytes < 1 || item.maximumBytes > 512 * 1024 * 1024)) {
+    throw new TypeError("build recipe is malformed or exceeds its control bounds");
+  }
+}
+function parseMemory(value) {
+  const match = /^([1-9][0-9]{0,4})([kmg])$/.exec(value.toLowerCase());
+  if (!match?.[1] || !match[2]) return 0;
+  const scale = match[2] === "k" ? 1024 : match[2] === "m" ? 1024 ** 2 : 1024 ** 3;
+  return Number(match[1]) * scale;
+}
+function execute(engine, args, name, recipe2, signal) {
+  return new Promise((accept, reject) => {
+    const started = Date.now();
+    const child = (0, import_node_child_process4.spawn)(engine, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    let bytes = 0;
+    let outputLimitExceeded = false;
+    let timedOut = false;
+    let stopping = false;
+    const stop = (reason) => {
+      if (stopping) return;
+      stopping = true;
+      timedOut = reason === "timeout";
+      outputLimitExceeded = reason === "output";
+      const remove = engine === "container" ? ["delete", "--force", name] : ["rm", "-f", name];
+      const killer = (0, import_node_child_process4.spawn)(engine, remove, { shell: false, stdio: "ignore" });
+      killer.unref();
+      child.kill("SIGTERM");
+    };
+    const collect = (target) => (chunk) => {
+      bytes += chunk.byteLength;
+      if (bytes > recipe2.maxOutputBytes) stop("output");
+      else target.push(chunk);
+    };
+    child.stdout.on("data", collect(stdout));
+    child.stderr.on("data", collect(stderr));
+    const abort = () => stop("abort");
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) abort();
+    const timer = setTimeout(() => stop("timeout"), recipe2.timeoutMs);
+    child.once("error", (error) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      reject(error);
+    });
+    child.once("exit", (code) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      accept({
+        exitCode: code ?? 1,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        durationMs: Date.now() - started,
+        outputLimitExceeded,
+        timedOut
+      });
+    });
+  });
+}
+
+// src/workspace-digest.ts
+var import_node_crypto2 = require("crypto");
+var import_promises4 = require("fs/promises");
+var import_node_path5 = require("path");
+async function digestStagedWorkspace(root, limits) {
+  const files = [];
+  const walk = async (directory) => {
+    const entries = await (0, import_promises4.readdir)(directory, { withFileTypes: true });
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+      if (entry.isSymbolicLink()) throw new TypeError("workspace digest refuses symbolic links");
+      const target = (0, import_node_path5.resolve)(directory, entry.name);
+      if (entry.isDirectory()) await walk(target);
+      else if (entry.isFile()) {
+        files.push({ path: (0, import_node_path5.relative)(root, target).split("\\").join("/"), target });
+        if (files.length > limits.maxFiles) throw new TypeError("workspace digest exceeds its file bound");
+      }
+    }
+  };
+  await walk((0, import_node_path5.resolve)(root));
+  const hash = (0, import_node_crypto2.createHash)("sha256");
+  let bytes = 0;
+  for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
+    const content = await (0, import_promises4.readFile)(file.target);
+    bytes += Buffer.byteLength(file.path) + content.byteLength;
+    if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
+    hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content.byteLength}:`);
+    hash.update(content);
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+
+// src/code-verifier.ts
+var SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
+var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var ID = /^[A-Za-z0-9._:-]{1,160}$/;
+var RULE = /^[A-Za-z0-9_@+.,/-]{1,160}$/;
+var DEFAULT_PREFIXES = ["test/", "tests/", "__tests__/"];
+var DEFAULT_SUFFIXES = [".test.js", ".test.ts", ".test.tsx", ".spec.js", ".spec.ts", ".spec.tsx"];
+async function verifyCodeCandidate(input) {
+  const policy = validate(input);
+  const limits = { maxFiles: policy.maximumFiles, maxBytes: policy.maximumBytes };
+  const staged = await stageWorkspace(input.trustedBaseDir, limits);
+  try {
+    const baseDigest = await digestStagedWorkspace(staged.workspaceDir, limits);
+    if (baseDigest !== input.trustedBaseDigest) throw new TypeError("trusted base does not match its registered digest");
+    const paths = validateCodePatch(input.candidatePatch, policy.maximumPatchBytes);
+    await applyCodePatch(staged.workspaceDir, input.candidatePatch, paths);
+    const sourceDigest = await digestStagedWorkspace(staged.workspaceDir, limits);
+    const policyDigest = digestPolicy(policy);
+    const patchDigest = digestBytes(input.candidatePatch);
+    const candidateDigest = digestJson({
+      trustedBaseCommitSha: input.trustedBaseCommitSha,
+      trustedBaseDigest: input.trustedBaseDigest,
+      patchDigest
+    });
+    const changedTests = changedTestPaths(paths, policy);
+    if (changedTests.length > policy.maximumChangedTests) throw new TypeError("candidate changes too many test files");
+    const recipes = [];
+    const logs = [];
+    for (const recipe2 of policy.recipes) {
+      const clean = await stageWorkspace(staged.workspaceDir, limits);
+      try {
+        if (await digestStagedWorkspace(clean.workspaceDir, limits) !== sourceDigest) {
+          throw new TypeError("clean verifier source changed before execution");
+        }
+        const result = checkedResult(await input.recipeExecutor.run({
+          workspaceDir: clean.workspaceDir,
+          recipe: recipe2,
+          signal: input.signal
+        }), recipe2.maxOutputBytes);
+        const artifacts = await inspectArtifacts(clean.workspaceDir, recipe2);
+        recipes.push(recipeReceipt(recipe2, result, artifacts));
+        logs.push({ recipeId: recipe2.id, ...boundedLogs(result, recipe2.maxOutputBytes) });
+      } finally {
+        await clean.cleanup();
+      }
+    }
+    const fields = {
+      schemaVersion: 1,
+      verificationId: input.verificationId ?? `verify-${(0, import_node_crypto3.randomUUID)()}`,
+      trustedBaseCommitSha: input.trustedBaseCommitSha,
+      trustedBaseDigest: input.trustedBaseDigest,
+      patchDigest,
+      candidateDigest,
+      sourceDigest,
+      policyDigest,
+      recipes,
+      changedTestCount: changedTests.length,
+      changedTestSetDigest: digestJson(changedTests),
+      changedTestsRequireReview: changedTests.length > 0,
+      outcome: recipes.every((recipe2) => recipe2.status === "passed") ? "passed" : "failed"
+    };
+    return {
+      receipt: { ...fields, receiptDigest: await (0, import_code3.digestCodeVerificationReceipt)(fields) },
+      changedTests: Object.freeze(changedTests),
+      logs: Object.freeze(logs)
+    };
+  } finally {
+    await staged.cleanup();
+  }
+}
+function validate(input) {
+  const policy = input.policy;
+  if (!SHA.test(input.trustedBaseCommitSha) || !DIGEST.test(input.trustedBaseDigest) || !ID.test(input.verificationId ?? "verify-generated") || !ID.test(policy.policyId) || policy.recipes.length < 1 || policy.recipes.length > 64 || new Set(policy.recipes.map((recipe2) => recipe2.id)).size !== policy.recipes.length) {
+    throw new TypeError("clean verification input is malformed");
+  }
+  for (const recipe2 of policy.recipes) assertCodeBuildRecipe(recipe2);
+  const result = {
+    policyId: policy.policyId,
+    recipes: policy.recipes,
+    testPathPrefixes: policy.testPathPrefixes ?? DEFAULT_PREFIXES,
+    testPathSuffixes: policy.testPathSuffixes ?? DEFAULT_SUFFIXES,
+    maximumChangedTests: policy.maximumChangedTests ?? 1e3,
+    maximumPatchBytes: policy.maximumPatchBytes ?? 256 * 1024,
+    maximumFiles: policy.maximumFiles ?? 2e4,
+    maximumBytes: policy.maximumBytes ?? 512 * 1024 * 1024
+  };
+  if ([...result.testPathPrefixes, ...result.testPathSuffixes].some((rule) => !RULE.test(rule)) || !integer(result.maximumChangedTests, 0, 1e4) || !integer(result.maximumPatchBytes, 1, 4 * 1024 * 1024) || !integer(result.maximumFiles, 1, 1e5) || !integer(result.maximumBytes, 1, 2 * 1024 * 1024 * 1024)) {
+    throw new TypeError("clean verification policy exceeds its bounds");
+  }
+  return result;
+}
+function changedTestPaths(paths, policy) {
+  return paths.filter((path) => policy.testPathSuffixes.some((suffix) => path.endsWith(suffix)) || policy.testPathPrefixes.some((prefix) => path.startsWith(prefix) || path.includes(`/${prefix}`))).sort();
+}
+function recipeReceipt(recipe2, result, artifacts) {
+  const status = result.timedOut ? "timed_out" : result.outputLimitExceeded ? "output_limited" : result.exitCode === 0 && artifacts.every((item) => item.status === "verified") ? "passed" : "failed";
+  return {
+    recipeId: recipe2.id,
+    recipeDigest: digestRecipe(recipe2),
+    status,
+    exitCode: result.exitCode,
+    durationMs: result.durationMs,
+    artifacts
+  };
+}
+async function inspectArtifacts(workspaceDir, recipe2) {
+  const receipts = [];
+  for (const artifact of recipe2.expectedArtifacts ?? []) {
+    try {
+      const path = (0, import_node_path6.join)(workspaceDir, artifact.path);
+      const info = await (0, import_promises5.lstat)(path);
+      if (!info.isFile() || info.isSymbolicLink()) {
+        receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
+      } else if (info.size > artifact.maximumBytes) {
+        receipts.push({ artifactId: artifact.id, status: "too_large", bytes: info.size, digest: null });
+      } else {
+        receipts.push({ artifactId: artifact.id, status: "verified", bytes: info.size, digest: await hashFile(path) });
+      }
+    } catch (reason) {
+      if (reason.code !== "ENOENT") throw reason;
+      receipts.push({ artifactId: artifact.id, status: "missing", bytes: null, digest: null });
+    }
+  }
+  return receipts;
+}
+function hashFile(path) {
+  return new Promise((accept, reject) => {
+    const hash = (0, import_node_crypto3.createHash)("sha256");
+    const stream = (0, import_node_fs2.createReadStream)(path);
+    stream.on("data", (chunk) => {
+      hash.update(chunk);
+    });
+    stream.once("error", reject);
+    stream.once("end", () => accept(`sha256:${hash.digest("hex")}`));
+  });
+}
+function checkedResult(result, maximumOutputBytes) {
+  if (!integer(result.exitCode, 0, 255) || !integer(result.durationMs, 0, 30 * 6e4) || typeof result.stdout !== "string" || typeof result.stderr !== "string" || typeof result.outputLimitExceeded !== "boolean" || typeof result.timedOut !== "boolean") {
+    throw new TypeError("recipe executor returned an invalid result");
+  }
+  const bytes = Buffer.byteLength(result.stdout) + Buffer.byteLength(result.stderr);
+  return bytes > maximumOutputBytes ? { ...result, outputLimitExceeded: true } : result;
+}
+function boundedLogs(result, maximum) {
+  const stdout = Buffer.from(result.stdout);
+  const stderr = Buffer.from(result.stderr);
+  const first = stdout.subarray(0, maximum);
+  return {
+    stdout: first.toString("utf8"),
+    stderr: stderr.subarray(0, Math.max(0, maximum - first.byteLength)).toString("utf8")
+  };
+}
+function digestPolicy(policy) {
+  return digestJson({
+    policyId: policy.policyId,
+    recipes: policy.recipes.map((recipe2) => normalizedRecipe(recipe2)),
+    testPathPrefixes: [...policy.testPathPrefixes].sort(),
+    testPathSuffixes: [...policy.testPathSuffixes].sort(),
+    maximumChangedTests: policy.maximumChangedTests,
+    maximumPatchBytes: policy.maximumPatchBytes,
+    maximumFiles: policy.maximumFiles,
+    maximumBytes: policy.maximumBytes
+  });
+}
+function digestRecipe(recipe2) {
+  return digestJson(normalizedRecipe(recipe2));
+}
+function normalizedRecipe(recipe2) {
+  return {
+    id: recipe2.id,
+    image: recipe2.image,
+    command: [...recipe2.command],
+    timeoutMs: recipe2.timeoutMs,
+    maxOutputBytes: recipe2.maxOutputBytes,
+    cpus: recipe2.cpus ?? 1,
+    memory: recipe2.memory ?? "1g",
+    pids: recipe2.pids ?? 256,
+    tmpfsBytes: recipe2.tmpfsBytes ?? 64 * 1024 * 1024,
+    expectedArtifacts: [...recipe2.expectedArtifacts ?? []].sort((left, right) => left.id.localeCompare(right.id)).map((artifact) => ({ id: artifact.id, path: artifact.path, maximumBytes: artifact.maximumBytes }))
+  };
+}
+function digestJson(value) {
+  return digestBytes(JSON.stringify(value));
+}
+function digestBytes(value) {
+  return `sha256:${(0, import_node_crypto3.createHash)("sha256").update(value).digest("hex")}`;
+}
+function integer(value, minimum, maximum) {
+  return Number.isSafeInteger(value) && value >= minimum && value <= maximum;
+}
+
+// src/code-runtime-checkpoint.ts
+async function prepareRuntimeCheckpoint(input) {
+  const patch2 = await input.workspace.patch(256 * 1024);
+  let verification = null;
+  let review = null;
+  let note = patch2 ? "Candidate remains untrusted" : "Checkpoint has no source changes";
+  if (patch2 && input.role === "coding") {
+    try {
+      const evidence = await verifyCodeCandidate({
+        verificationId: `verify-${input.sessionId.slice("csess_".length)}`,
+        trustedBaseDir: input.workspace.baselineDir,
+        trustedBaseCommitSha: input.baseCommitSha,
+        trustedBaseDigest: input.trustedBaseDigest,
+        candidatePatch: patch2,
+        policy: {
+          policyId: "code.runtime",
+          recipes: input.recipes,
+          maximumFiles: 2e4,
+          maximumBytes: 512 * 1024 * 1024
+        },
+        recipeExecutor: input.recipeExecutor
+      });
+      if (evidence.receipt.outcome === "passed") {
+        verification = evidence.receipt;
+        review = await input.review(patch2, verification);
+        note = review.verdict === "approved" ? "Clean verification and independent review passed" : "Clean verification passed; independent review rejected the candidate";
+      } else {
+        note = `Clean verification failed: ${evidence.receipt.recipes.filter((recipe2) => recipe2.status !== "passed").map((recipe2) => `${recipe2.recipeId}=${recipe2.status}`).join(", ")}`;
+      }
+    } catch (cause) {
+      note = `Candidate verification or review failed closed: ${message(cause)}`;
+    }
+  }
+  const reviewed = verification && review?.verdict === "approved";
+  const checkpoint = await createCodeWorkspaceCheckpoint({
+    workspace: input.workspace,
+    baseCommitSha: input.baseCommitSha,
+    state: {
+      planCursor: null,
+      conversationRefs: input.conversationRefs,
+      planningInputDigest: input.planningInputDigest,
+      buildPolicyDigest: verification?.policyDigest ?? input.fallbackPolicyDigest,
+      dependencyLayerDigest: null,
+      verificationDigest: verification?.receiptDigest ?? null,
+      reviewDigest: reviewed && review ? review.reviewDigest : null,
+      completedEffects: [],
+      unresolvedApprovals: [],
+      trustStatus: reviewed ? "reviewed" : verification ? "verified" : "candidate_untrusted"
+    }
+  });
+  return { checkpoint, verification, review, note };
+}
+var message = (value) => (value instanceof Error ? value.message : String(value)).slice(0, 500);
+
+// src/code-runtime-checkpoint-manager.ts
+var CodeRuntimeCheckpointManager = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  #pending = /* @__PURE__ */ new Map();
+  async prepare(command, active) {
+    active.abort.abort("checkpoint_stop");
+    await active.done;
+    const prepared = await prepareRuntimeCheckpoint({
+      sessionId: command.sessionId,
+      role: active.role,
+      workspace: active.workspace,
+      baseCommitSha: active.baseCommitSha,
+      trustedBaseDigest: active.trustedBaseDigest,
+      planningInputDigest: active.planningInputDigest,
+      conversationRefs: active.conversationRefs,
+      fallbackPolicyDigest: this.options.fallbackPolicyDigest,
+      recipes: this.options.recipes,
+      recipeExecutor: this.options.recipeExecutor,
+      review: (patch2, verification) => this.options.control.review(command.sessionId, { patch: patch2, verification })
+    });
+    if (prepared.review?.verdict === "approved" && prepared.verification) {
+      this.#pending.set(command.commandId, { verification: prepared.verification, refs: active.conversationRefs });
+    }
+    await this.options.event(command, { type: "message", actor: "system", body: prepared.note }, active.conversationRefs).catch(() => void 0);
+    await active.workspace.cleanup();
+    await this.options.event(command, { type: "status", status: "checkpointed" }, active.conversationRefs).catch(() => void 0);
+    return { status: "checkpointed", checkpoint: prepared.checkpoint, message: "Pi stopped at a portable checkpoint" };
+  }
+  async acknowledged(command, result) {
+    if (command.kind !== "checkpoint_stop" || result.status !== "checkpointed") return false;
+    const pending = this.#pending.get(command.commandId);
+    if (!pending) return true;
+    const checkpointId = `cpoint_${command.commandId.slice("ccmd_".length)}`;
+    const candidate = await this.options.control.submitCandidate(command.sessionId, checkpointId, pending.verification);
+    await this.options.event(command, {
+      type: "message",
+      actor: "system",
+      body: command.payload.sourceSet ? `Candidate ${candidate.candidateId} was verified and delivered to the session PR branch` : `Candidate ${candidate.candidateId} is ready for legacy owner publication approval`
+    }, pending.refs);
+    this.#pending.delete(command.commandId);
+    return true;
+  }
+};
+
+// src/code-runtime-source.ts
+var import_promises6 = require("fs/promises");
+var import_node_os2 = require("os");
+var import_node_path7 = require("path");
+var RESERVED2 = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
+var SECRET2 = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_node_os2.tmpdir)()) {
+  if (!snapshot.files.length || snapshot.files.length > 1e4) throw new TypeError("Code source file count is invalid");
+  const root = await (0, import_promises6.mkdtemp)((0, import_node_path7.join)(tempRoot, "odla-code-source-"));
+  const sourceDir = (0, import_node_path7.join)(root, "source");
+  await (0, import_promises6.mkdir)(sourceDir);
+  const seen = /* @__PURE__ */ new Set();
+  let bytes = 0;
+  try {
+    for (const file of snapshot.files) {
+      validatePath(file.path);
+      if (seen.has(file.path)) throw new TypeError("Code source repeats a path");
+      seen.add(file.path);
+      bytes += Buffer.byteLength(file.path) + Buffer.byteLength(file.content);
+      if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
+      const target = (0, import_node_path7.resolve)(sourceDir, file.path);
+      if (!target.startsWith(`${(0, import_node_path7.resolve)(sourceDir)}${import_node_path7.sep}`)) throw new TypeError("Code source path escapes its root");
+      await (0, import_promises6.mkdir)((0, import_node_path7.dirname)(target), { recursive: true });
+      await (0, import_promises6.writeFile)(target, file.content, { flag: "wx", mode: 420 });
+    }
+    for (const reference of snapshot.references ?? []) {
+      validateAlias(reference.alias);
+      if (!reference.files.length || reference.files.length > 1e4) throw new TypeError("Code reference file count is invalid");
+      for (const file of reference.files) {
+        validatePath(file.path);
+        const path = `.odla-references/${reference.alias}/${file.path}`;
+        if (seen.has(path)) throw new TypeError("Code reference repeats a path");
+        seen.add(path);
+        bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);
+        if (bytes > 80 * 1024 * 1024) throw new TypeError("Code source set exceeds its byte bound");
+        const target = (0, import_node_path7.resolve)(sourceDir, path);
+        if (!target.startsWith(`${(0, import_node_path7.resolve)(sourceDir)}${import_node_path7.sep}`)) throw new TypeError("Code reference path escapes its root");
+        await (0, import_promises6.mkdir)((0, import_node_path7.dirname)(target), { recursive: true });
+        await (0, import_promises6.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+      }
+    }
+    return { sourceDir, cleanup: () => (0, import_promises6.rm)(root, { recursive: true, force: true }) };
+  } catch (cause) {
+    await (0, import_promises6.rm)(root, { recursive: true, force: true });
+    throw cause;
+  }
+}
+function validateAlias(alias) {
+  if (!/^[a-z][a-z0-9-]{0,39}$/.test(alias) || alias === "primary") {
+    throw new TypeError("Code reference alias is invalid");
+  }
+}
+async function attachCodeRuntimeReferences(workspace, references) {
+  let bytes = 0;
+  for (const reference of references) {
+    validateAlias(reference.alias);
+    for (const file of reference.files) {
+      validatePath(file.path);
+      const path = `.odla-references/${reference.alias}/${file.path}`;
+      bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);
+      if (bytes > 64 * 1024 * 1024) throw new TypeError("Code reference set exceeds its byte bound");
+      for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
+        const target = (0, import_node_path7.resolve)(root, path);
+        if (!target.startsWith(`${(0, import_node_path7.resolve)(root)}${import_node_path7.sep}`)) throw new TypeError("Code reference path escapes its root");
+        await (0, import_promises6.mkdir)((0, import_node_path7.dirname)(target), { recursive: true });
+        await (0, import_promises6.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+      }
+    }
+  }
+}
+function validatePath(path) {
+  const parts = path.split("/");
+  if (!path || path.startsWith("/") || path.includes("\\") || path.includes("\0") || parts.some((part) => !part || part === "." || part === ".." || RESERVED2.has(part) || SECRET2.test(part))) {
+    throw new TypeError("Code source contains an unsafe path");
+  }
+}
+
+// src/code-runtime-task.ts
+function codeCommandMetadata(payload, resume) {
+  const trusted = record3(payload.trustedBase);
+  const role = payload.role;
+  const title = payload.title;
+  const prompt = payload.prompt;
+  const maxTokensPerInteraction = payload.maxTokensPerInteraction ?? 32e3;
+  if (role !== "coding" && role !== "review" || typeof title !== "string" || typeof prompt !== "string") {
+    throw new TypeError(`invalid Code ${resume ? "resume" : "start"} metadata`);
+  }
+  const planning = trusted?.planningInputDigest;
+  const attestation = trusted?.attestationDigest;
+  const repository = trusted?.repository;
+  const baseCommitSha = trusted?.commitSha;
+  const sourceTreeDigest = trusted?.treeDigest;
+  if (typeof repository !== "string" || !repository.includes("/") || typeof baseCommitSha !== "string" || !/^[0-9a-f]{40}$/.test(baseCommitSha) || typeof sourceTreeDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(sourceTreeDigest)) {
+    throw new TypeError(`invalid Code ${resume ? "resume" : "start"} trusted base`);
+  }
+  if (!Number.isSafeInteger(maxTokensPerInteraction) || Number(maxTokensPerInteraction) < 4e3 || Number(maxTokensPerInteraction) > 2e5) {
+    throw new TypeError(`invalid Code ${resume ? "resume" : "start"} interaction token limit`);
+  }
+  return {
+    role,
+    title,
+    prompt,
+    maxTokensPerInteraction: Number(maxTokensPerInteraction),
+    planningInputDigest: typeof planning === "string" && /^sha256:[0-9a-f]{64}$/.test(planning) ? planning : null,
+    attestationDigest: typeof attestation === "string" ? attestation : "resume",
+    repository,
+    baseCommitSha,
+    sourceTreeDigest
+  };
+}
+function codeLocalSource(payload) {
+  const source = record3(payload.source);
+  if (!source) return null;
+  if (source.kind !== "local_checkout" || typeof source.repository !== "string" || typeof source.headCommitSha !== "string" || !/^[0-9a-f]{40}$/.test(source.headCommitSha) || typeof source.trustedBaseDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.trustedBaseDigest) || typeof source.developerPatchDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.developerPatchDigest) || typeof source.snapshotDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.snapshotDigest) || typeof source.modified !== "boolean" || !Number.isSafeInteger(source.fileCount) || Number(source.fileCount) < 1 || Number(source.fileCount) > 2e4 || !Number.isSafeInteger(source.byteCount) || Number(source.byteCount) < 1 || Number(source.byteCount) > 512 * 1024 * 1024 || !Number.isSafeInteger(source.capturedAt) || Number(source.capturedAt) < 1) {
+    throw new TypeError("invalid local checkout source descriptor");
+  }
+  return source;
+}
+function codeCheckpointPayload(payload) {
+  const value = payload.checkpoint;
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError("resume checkpoint is missing");
+  return value;
+}
+function fakeCodeLease(command, metadata) {
+  return {
+    protocolVersion: HARNESS_PROTOCOL_VERSION,
+    leaseId: `code:${command.commandId}`,
+    generation: command.bindingGeneration,
+    expiresAt: Date.now() + 24 * 60 * 6e4,
+    task: {
+      taskId: command.sessionId,
+      attemptId: command.instanceId,
+      title: metadata.title,
+      prompt: metadata.prompt,
+      workspace: command.appId,
+      aiRoute: metadata.role,
+      policy: {
+        network: "none",
+        timeoutMs: 30 * 6e4,
+        maxOutputBytes: 4 * 1024 * 1024,
+        maxPatchBytes: 256 * 1024
+      }
+    }
+  };
+}
+var record3 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+
+// src/code-runtime-local-source.ts
+var SOURCE_LIMITS = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
+async function prepareRuntimeLocalSource(input) {
+  const { command, descriptor: descriptor2, available, repository, baseCommitSha, resume } = input;
+  if (!available || JSON.stringify(available.descriptor) !== JSON.stringify(descriptor2) || descriptor2.repository.toLowerCase() !== repository.toLowerCase() || descriptor2.headCommitSha !== baseCommitSha) {
+    throw new TypeError("the session's local checkout snapshot is not available on this terminal");
+  }
+  const workspace = resume ? (await restoreCodeWorkspaceCheckpoint({
+    trustedBaseDir: available.trustedBaseDir,
+    trustedBaseCommitSha: baseCommitSha,
+    checkpoint: codeCheckpointPayload(command.payload)
+  })).workspace : await stageWorkspacePair(available.trustedBaseDir, available.sourceDir, SOURCE_LIMITS);
+  const trustedBaseDigest = await digestStagedWorkspace(workspace.baselineDir, SOURCE_LIMITS);
+  if (trustedBaseDigest !== descriptor2.trustedBaseDigest) {
+    await workspace.cleanup();
+    throw new TypeError("trusted Git base digest changed after connection");
+  }
+  if (!resume && await digestStagedWorkspace(workspace.workspaceDir, SOURCE_LIMITS) !== descriptor2.snapshotDigest) {
+    await workspace.cleanup();
+    throw new TypeError("local checkout snapshot digest changed after connection");
+  }
+  return { workspace, sourceDigest: descriptor2.snapshotDigest, trustedBaseDigest };
+}
+
+// src/code-tool-broker.ts
+var import_promises7 = require("fs/promises");
+var import_node_path8 = require("path");
+
+// src/code-tool-policy.ts
+var import_camel = require("@odla-ai/camel");
+var import_policy = require("@odla-ai/camel/policy");
+var DESTINATIONS = "code-workspaces.v1";
+var READ = descriptor("sandbox.read", "scoped_data_read", {
+  workspace: "destination",
+  authority: "authority",
+  path: "selector",
+  startLine: "selector",
+  endLine: "selector"
+});
+var PATCH = descriptor("sandbox.apply_patch", "reversible_mutation", {
+  workspace: "destination",
+  authority: "authority",
+  patch: "payload"
+});
+var RECIPE = descriptor("sandbox.run_recipe", "code_execution", {
+  workspace: "destination",
+  authority: "authority",
+  recipeId: "selector",
+  sourceDigest: "payload"
+});
+function createCodePolicyGate(options) {
+  return {
+    read: async (input) => {
+      const base = await environment(input, options, "sandbox.read");
+      const conversions = await conversionRegistry([
+        await registeredPolicy("code.path.v1", "code.paths.v1", input.paths),
+        await conversionPolicy("code.line.v1", { kind: "integer", minimum: 1, maximum: 1e6 })
+      ], { "code.paths.v1": input.paths });
+      const path = await conversions.operations.registeredId(unsafe(base, input.path, "path"), "code.path.v1");
+      const start = await conversions.operations.integer(unsafe(base, input.startLine, "start"), "code.line.v1");
+      const end = await conversions.operations.integer(unsafe(base, input.endLine, "end"), "code.line.v1");
+      if (end.value < start.value) return false;
+      return authorize(input, options, base, READ, {
+        ...base.fixedArgs,
+        path: { role: "selector", value: path },
+        startLine: { role: "selector", value: start },
+        endLine: { role: "selector", value: end }
+      }, [path, start, end]);
+    },
+    patch: async (input) => {
+      const base = await environment(input, options, "sandbox.apply_patch");
+      const patch2 = unsafe(base, input.patch, "patch");
+      return authorize(input, options, base, PATCH, {
+        ...base.fixedArgs,
+        patch: { role: "payload", value: patch2 }
+      }, []);
+    },
+    recipe: async (input) => {
+      const base = await environment(input, options, "sandbox.run_recipe");
+      const conversions = await conversionRegistry([
+        await registeredPolicy("code.recipe.v1", "code.recipes.v1", input.recipeIds)
+      ], { "code.recipes.v1": input.recipeIds });
+      const recipe2 = await conversions.operations.registeredId(unsafe(base, input.recipeId, "recipe"), "code.recipe.v1");
+      const source = unsafe(base, input.sourceDigest, "source");
+      return authorize(input, options, base, RECIPE, {
+        ...base.fixedArgs,
+        recipeId: { role: "selector", value: recipe2 },
+        sourceDigest: { role: "payload", value: source }
+      }, [recipe2]);
+    }
+  };
+}
+function descriptor(name, effect, argumentRoles) {
+  return { name, version: 1, effect, inputSchema: { type: "object" }, argumentRoles, policyId: `odla.code.${name}.v1` };
+}
+async function conversionPolicy(id, output) {
+  const definition = {
+    conversionId: id,
+    version: 1,
+    output,
+    maximumSourceBytes: 1e6,
+    maximumOutputsPerArtifact: 4,
+    presentation: "json_scalar"
+  };
+  return { ...definition, digest: await (0, import_camel.conversionPolicyDigest)(definition) };
+}
+async function registeredPolicy(id, registryId, values) {
+  const mapping = Object.fromEntries(values.map((value) => [value, value]));
+  return conversionPolicy(id, {
+    kind: "registered_id",
+    registryId,
+    registryDigest: await (0, import_camel.registeredIdRegistryDigest)(mapping)
+  });
+}
+async function conversionRegistry(policies, values) {
+  const registeredIds = Object.fromEntries(await Promise.all(Object.entries(values).map(async ([id, entries]) => {
+    const mapping = Object.fromEntries(entries.map((value) => [value, value]));
+    return [id, { values: mapping, digest: await (0, import_camel.registeredIdRegistryDigest)(mapping) }];
+  })));
+  return (0, import_camel.createConversionRegistry)({ policies, registeredIds });
+}
+async function environment(input, options, tool) {
+  const ingress = (0, import_camel.createCamelIngress)([
+    { id: "workspace", value: input.workspaceId, readers: input.readers },
+    { id: "authority", value: `lease:${input.lease.leaseId}`, readers: input.readers },
+    { id: "reader", value: options.readerId, readers: input.readers }
+  ]);
+  const digest = await (0, import_policy.destinationRegistryDigest)([input.workspaceId]);
+  const approvals = ["irreversible_mutation", "external_send", "financial", "secret_read"];
+  if (options.recipeAuthorization === "exact_approval") approvals.push("code_execution");
+  const policy = (0, import_policy.createEffectPolicy)({
+    destinationRegistries: { [DESTINATIONS]: { digest, values: [input.workspaceId] } },
+    approvalEffects: approvals
+  });
+  const fixedArgs = {
+    workspace: { role: "destination", value: ingress.control("workspace"), registryId: DESTINATIONS, registryDigest: digest },
+    authority: { role: "authority", value: ingress.control("authority") }
+  };
+  return { ingress, policy, fixedArgs, reader: ingress.control("reader"), runId: `${input.request.requestId}:${tool}` };
+}
+function unsafe(base, value, field) {
+  return base.ingress.quarantinedOutput(value, {
+    readers: base.reader.label.readers,
+    runId: `${base.runId}:${field}`
+  });
+}
+async function authorize(input, options, base, tool, args, controlDependencies) {
+  const policy = await base.policy.evaluate({
+    planId: input.lease.task.taskId,
+    tool,
+    args,
+    controlDependencies,
+    intendedReaderIds: [base.reader]
+  });
+  let approvalConsumed = false;
+  if (policy.outcome === "require_approval" && options.consumeApproval) {
+    approvalConsumed = await options.consumeApproval(decision(input, policy, false, tool.name, policy.actionDigest));
+  }
+  await options.onDecision?.(decision(input, policy, approvalConsumed, tool.name));
+  return policy.outcome === "allow" || approvalConsumed;
+}
+function decision(input, policy, approvalConsumed, tool, actionDigest) {
+  return {
+    lease: input.lease,
+    request: input.request,
+    tool,
+    policy,
+    approvalConsumed,
+    actionDigest: actionDigest ?? (policy.outcome === "require_approval" ? policy.actionDigest : "")
+  };
+}
+
+// src/code-tool-broker.ts
+function createCodeToolBroker(options) {
+  validateOptions(options);
+  const recipes = new Map(options.recipes.map((recipe2) => [recipe2.id, recipe2]));
+  const policy = createCodePolicyGate(options);
+  let tail = Promise.resolve();
+  return {
+    execute(context, request) {
+      const result = tail.then(() => route(context, request, options, recipes, policy));
+      tail = result.then(() => void 0, () => void 0);
+      return result;
+    }
+  };
+}
+async function route(context, request, options, recipes, policy) {
+  try {
+    if (context.signal?.aborted) throw new TypeError("tool request was cancelled");
+    if (request.tool === "sandbox.read") return await read(context, request, options, policy);
+    if (request.tool === "sandbox.apply_patch") return await patch(context, request, options, policy);
+    return await recipe(context, request, options, recipes, policy);
+  } catch (reason) {
+    return response(request, false, reason instanceof TypeError ? reason.message : "tool failed closed");
+  }
+}
+async function read(context, request, options, policy) {
+  exactKeys(request.input, ["path", "startLine", "endLine"]);
+  const path = stringField(request.input, "path");
+  const startLine = optionalInteger(request.input.startLine) ?? 1;
+  const endLine = optionalInteger(request.input.endLine) ?? startLine + (options.maxReadLines ?? 2e3) - 1;
+  if (endLine < startLine || endLine - startLine + 1 > (options.maxReadLines ?? 2e3)) {
+    throw new TypeError("requested line range exceeds its bound");
+  }
+  const paths = await registeredFiles(context.workspaceDir, 2e4);
+  const allowed = await policy.read(policyContext(context, request, options, { paths, path, startLine, endLine }));
+  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  const target = resolveCodePath(context.workspaceDir, path);
+  const info = await (0, import_promises7.stat)(target);
+  if (!info.isFile() || info.size > Math.max(options.maxReadBytes ?? 128 * 1024, 2 * 1024 * 1024)) {
+    throw new TypeError("file is not a bounded regular source file");
+  }
+  const source = await (0, import_promises7.readFile)(target);
+  if (source.includes(0)) throw new TypeError("binary files are not readable through this tool");
+  const lines = source.toString("utf8").split("\n");
+  const content = lines.slice(startLine - 1, endLine).join("\n");
+  if (Buffer.byteLength(content) > (options.maxReadBytes ?? 128 * 1024)) {
+    throw new TypeError("read result exceeds its byte bound");
+  }
+  return response(request, true, content, { path, startLine, endLine: Math.min(endLine, lines.length) });
+}
+async function patch(context, request, options, policy) {
+  exactKeys(request.input, ["patch"]);
+  const value = stringField(request.input, "patch");
+  const paths = validateCodePatch(value, options.maxPatchBytes ?? 256 * 1024);
+  if (paths.some((path) => options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))) {
+    throw new TypeError("patch targets a read-only reference source");
+  }
+  const allowed = await policy.patch(policyContext(context, request, options, { patch: value }));
+  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  await applyCodePatch(context.workspaceDir, value, paths);
+  return response(request, true, `Applied patch to ${paths.length} file(s).`, { paths });
+}
+async function recipe(context, request, options, recipes, policy) {
+  exactKeys(request.input, ["recipeId"]);
+  const recipeId = stringField(request.input, "recipeId");
+  const digestLimits = {
+    maxFiles: options.maxRecipeWorkspaceFiles ?? 2e4,
+    maxBytes: options.maxRecipeWorkspaceBytes ?? 512 * 1024 * 1024
+  };
+  const sourceDigest = await digestStagedWorkspace(context.workspaceDir, digestLimits);
+  const allowed = await policy.recipe(policyContext(context, request, options, {
+    recipeIds: [...recipes.keys()].sort(),
+    recipeId,
+    sourceDigest
+  }));
+  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  const selected = recipes.get(recipeId);
+  if (!selected) return response(request, false, "build recipe is not registered");
+  const staged = await stageWorkspace(context.workspaceDir, {
+    maxFiles: digestLimits.maxFiles,
+    maxBytes: digestLimits.maxBytes
+  });
+  try {
+    if (await digestStagedWorkspace(staged.workspaceDir, digestLimits) !== sourceDigest) {
+      throw new TypeError("workspace changed after recipe authorization");
+    }
+    const result = await options.recipeExecutor.run({
+      workspaceDir: staged.workspaceDir,
+      recipe: selected,
+      signal: context.signal
+    });
+    const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
+    const ok = result.exitCode === 0 && !result.outputLimitExceeded && !result.timedOut;
+    const status = result.timedOut ? "timed out" : result.outputLimitExceeded ? "exceeded output limit" : ok ? "passed" : `failed with exit ${result.exitCode}`;
+    return response(request, ok, `Recipe ${recipeId} ${status}.${output ? `
+${output}` : ""}`, {
+      recipeId,
+      exitCode: result.exitCode,
+      durationMs: result.durationMs,
+      outputLimitExceeded: result.outputLimitExceeded,
+      timedOut: result.timedOut
+    });
+  } finally {
+    await staged.cleanup();
+  }
+}
+function policyContext(context, request, options, extra) {
+  return {
+    lease: context.lease,
+    request,
+    workspaceId: `workspace:${context.lease.task.attemptId}`,
+    readers: { kind: "principals", principalIds: [options.readerId] },
+    ...extra
+  };
+}
+async function registeredFiles(root, limit) {
+  const paths = [];
+  const walk = async (directory) => {
+    for (const entry of await (0, import_promises7.readdir)(directory, { withFileTypes: true })) {
+      if (entry.isSymbolicLink()) throw new TypeError("workspace contains a symbolic link");
+      const target = (0, import_node_path8.resolve)(directory, entry.name);
+      if (entry.isDirectory()) await walk(target);
+      else if (entry.isFile()) {
+        const path = (0, import_node_path8.relative)(root, target).split("\\").join("/");
+        try {
+          validateRelativePath(path);
+        } catch {
+          continue;
+        }
+        paths.push(path);
+        if (paths.length > limit) throw new TypeError("workspace file registry exceeds its bound");
+      }
+    }
+  };
+  await walk((0, import_node_path8.resolve)(root));
+  return paths.sort();
+}
+function validateOptions(options) {
+  if (!options.readerId || !options.recipes.length || new Set(options.recipes.map((item) => item.id)).size !== options.recipes.length) {
+    throw new TypeError("Code tool broker requires a reader and unique registered recipes");
+  }
+  for (const recipe2 of options.recipes) assertCodeBuildRecipe(recipe2);
+  if (options.readOnlyPrefixes?.some((prefix) => !/^[A-Za-z0-9_.-]+$/.test(prefix) || prefix === "." || prefix === "..")) {
+    throw new TypeError("Code tool broker read-only prefix is invalid");
+  }
+}
+function exactKeys(input, allowed) {
+  if (Object.keys(input).some((key) => !allowed.includes(key))) throw new TypeError("tool input contains an unsupported field");
+}
+function stringField(input, name) {
+  const value = input[name];
+  if (typeof value !== "string" || !value) throw new TypeError(`${name} must be a non-empty string`);
+  return value;
+}
+function optionalInteger(value) {
+  if (value === void 0) return void 0;
+  if (!Number.isSafeInteger(value) || value < 1) throw new TypeError("line bounds must be positive integers");
+  return value;
+}
+function response(request, ok, content, details) {
+  return { requestId: request.requestId, ok, content, ...details ? { details } : {} };
+}
+
+// src/code-runtime-broker.ts
+function createCodeRuntimeToolBroker(input, lease, role) {
+  const broker = createCodeToolBroker({
+    recipes: input.recipes,
+    recipeExecutor: createContainerRecipeExecutor(input.engine),
+    recipeAuthorization: input.recipeAuthorization ?? "registered_recipe",
+    readerId: `code-session:${lease.task.taskId}`,
+    readOnlyPrefixes: [".odla-references"]
+  });
+  return role === "coding" ? broker : { execute: (context, request) => request.tool === "sandbox.read" ? broker.execute(context, request) : Promise.resolve({ requestId: request.requestId, ok: false, content: "review sessions are read-only" }) };
+}
+
+// src/code-runtime-inference.ts
+async function handleCodeRuntimeInference(input) {
+  const { command, metadata, request, state } = input;
+  if (state.tokens >= metadata.maxTokensPerInteraction) {
+    if (!state.noticeEmitted) {
+      state.noticeEmitted = true;
+      await input.event({
+        type: "message",
+        actor: "system",
+        body: `Pi paused at the ${metadata.maxTokensPerInteraction.toLocaleString("en-US")}-token per-interaction limit. Send a new instruction to continue.`
+      }).catch(() => void 0);
+    }
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "inference.response",
+      requestId: request.requestId,
+      response: {
+        id: `budget:${command.commandId}`,
+        provider: "openai",
+        model: "interaction-budget",
+        role: "assistant",
+        content: [{ type: "text", text: "Pause now. The owner-set token limit for this interaction has been reached." }],
+        stopReason: "end_turn",
+        usage: { inputTokens: 0, outputTokens: 0 }
+      }
+    };
+  }
+  const startedAt = Date.now();
+  const response2 = await input.control.infer(command.sessionId, {
+    requestId: request.requestId,
+    interactionId: command.commandId,
+    call: request.call
+  });
+  state.tokens += response2.receipt.inputTokens + response2.receipt.outputTokens;
+  await input.event({
+    type: "usage",
+    provider: response2.receipt.provider,
+    model: response2.receipt.model,
+    inputTokens: response2.receipt.inputTokens,
+    outputTokens: response2.receipt.outputTokens,
+    durationMs: Date.now() - startedAt,
+    interactionId: command.commandId,
+    interactionTokens: state.tokens,
+    interactionMaxTokens: metadata.maxTokensPerInteraction
+  }).catch(() => void 0);
+  return {
+    protocolVersion: HARNESS_PROTOCOL_VERSION,
+    type: "inference.response",
+    requestId: request.requestId,
+    response: response2.response
+  };
+}
+
+// src/code-runtime-events.ts
+var import_node_crypto4 = require("crypto");
+async function appendCodeRuntimeEvent(control, command, event, refs) {
+  const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;
+  refs.push(eventId);
+  const bounded = event.type === "message" ? { ...event, body: event.body.trim().slice(0, 2e4) || `${event.actor} event` } : event;
+  await control.appendSessionEvent(command.sessionId, eventId, bounded);
+}
+var digestRuntimeValue = (value) => `sha256:${(0, import_node_crypto4.createHash)("sha256").update(value).digest("hex")}`;
+var runtimeErrorMessage = (value) => value instanceof Error ? value.message : String(value);
+var runtimeRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var safeRuntimeJson = (value) => {
+  try {
+    return JSON.stringify(value).slice(0, 1e4);
+  } catch {
+    return "[event]";
+  }
+};
+function runtimeResultText(value) {
+  const record4 = runtimeRecord(value);
+  if (record4 && typeof record4.text === "string") return record4.text.slice(0, 2e4);
+  if (record4 && typeof record4.error === "string") return `Pi failed: ${record4.error.slice(0, 19989)}`;
+  return null;
+}
+function runtimeResultError(value) {
+  const record4 = runtimeRecord(value);
+  return record4 && typeof record4.error === "string" && record4.error.trim() ? record4.error.trim().slice(0, 2e3) : null;
+}
+
+// src/code-runtime-engine.ts
+var CodePiRuntimeEngine = class {
+  constructor(options) {
+    this.options = options;
+    if (options.imageAuthorization === "cli_embedded" && !/^odla-ai\/pi-agent:embedded-sha256-[0-9a-f]{64}$/.test(options.image)) throw new TypeError("CLI-embedded Pi image must use its content-addressed local tag");
+    this.#run = options.runAttempt ?? runContainerAttempt;
+    this.#buildPolicyDigest = digestRuntimeValue(JSON.stringify(options.recipes));
+    this.#checkpoints = new CodeRuntimeCheckpointManager({
+      control: options.control,
+      recipes: options.recipes,
+      recipeExecutor: options.recipeExecutor ?? createContainerRecipeExecutor(options.engine),
+      fallbackPolicyDigest: this.#buildPolicyDigest,
+      event: (command, event, refs) => this.#event(command, event, refs)
+    });
+  }
+  options;
+  #active = /* @__PURE__ */ new Map();
+  #run;
+  #buildPolicyDigest;
+  #checkpoints;
+  execute(command) {
+    if (command.kind === "checkpoint_stop") return this.#checkpoint(command);
+    if (command.kind === "prompt") return this.#prompt(command);
+    return this.#start(command, command.kind === "resume");
+  }
+  async acknowledged(command, result) {
+    if (await this.#checkpoints.acknowledged(command, result)) return;
+    const active = this.#active.get(command.sessionId);
+    if (!active || result.status !== "running") return;
+    active.acknowledged = true;
+    if (active.failure) await this.options.control.reportSessionFailure(command.sessionId, active.failure).catch(() => void 0);
+  }
+  async close() {
+    const sessions = [...this.#active.values()];
+    for (const session of sessions) session.abort.abort("runtime_shutdown");
+    await Promise.allSettled(sessions.map((session) => session.done));
+    await Promise.allSettled(sessions.map((session) => session.workspace.cleanup()));
+    this.#active.clear();
+  }
+  async #start(command, resume) {
+    if (this.#active.has(command.sessionId)) throw new TypeError("Code session is already active on this runtime");
+    const metadata = codeCommandMetadata(command.payload, resume);
+    const requestedLocal = codeLocalSource(command.payload);
+    let workspace;
+    let sourceDigest;
+    let localTrustedBaseDigest;
+    if (requestedLocal) {
+      const prepared = await prepareRuntimeLocalSource({
+        command,
+        descriptor: requestedLocal,
+        available: this.options.localSource,
+        repository: metadata.repository,
+        baseCommitSha: metadata.baseCommitSha,
+        resume
+      });
+      ({ workspace, sourceDigest, trustedBaseDigest: localTrustedBaseDigest } = prepared);
+      if (command.payload.sourceSet) {
+        const selected = await this.options.control.source(command.sessionId);
+        if (selected.repository !== metadata.repository || selected.commitSha !== metadata.baseCommitSha || selected.treeDigest !== metadata.sourceTreeDigest) {
+          await workspace.cleanup();
+          throw new TypeError("Code local source does not match the selected GitHub primary source");
+        }
+        await attachCodeRuntimeReferences(workspace, selected.references ?? []);
+      }
+    } else {
+      const source = await this.options.control.source(command.sessionId);
+      const materialized = await materializeCodeRuntimeSource(source);
+      try {
+        workspace = resume ? (await restoreCodeWorkspaceCheckpoint({
+          trustedBaseDir: materialized.sourceDir,
+          trustedBaseCommitSha: source.commitSha,
+          checkpoint: codeCheckpointPayload(command.payload)
+        })).workspace : await stageWorkspace(materialized.sourceDir);
+      } finally {
+        await materialized.cleanup();
+      }
+      sourceDigest = source.treeDigest;
+    }
+    const abort = new AbortController();
+    const conversationRefs = [];
+    const active = {
+      workspace,
+      abort,
+      conversationRefs,
+      acknowledged: false,
+      role: metadata.role,
+      title: metadata.title,
+      maxTokensPerInteraction: metadata.maxTokensPerInteraction,
+      baseCommitSha: metadata.baseCommitSha,
+      repository: metadata.repository,
+      sourceTreeDigest: metadata.sourceTreeDigest,
+      trustedBaseDigest: requestedLocal ? localTrustedBaseDigest : await digestStagedWorkspace(workspace.baselineDir, {
+        maxFiles: 2e4,
+        maxBytes: 512 * 1024 * 1024
+      }),
+      planningInputDigest: metadata.planningInputDigest ?? digestRuntimeValue(
+        JSON.stringify({ attestation: metadata.attestationDigest, prompt: metadata.prompt, tree: sourceDigest })
+      ),
+      done: Promise.resolve(null)
+    };
+    this.#active.set(command.sessionId, active);
+    if (requestedLocal) {
+      await this.#event(command, {
+        type: "message",
+        actor: "system",
+        body: `Source snapshot: local checkout ${requestedLocal.snapshotDigest} \xB7 ${requestedLocal.modified ? "modified" : "clean"} \xB7 Git ${requestedLocal.headCommitSha}`
+      }, conversationRefs);
+    }
+    active.done = this.#runAttempt(command, metadata, active).catch(async (cause) => {
+      const detail = runtimeErrorMessage(cause);
+      await this.#event(command, { type: "message", actor: "system", body: `Pi failed: ${detail}` }, conversationRefs).catch(() => void 0);
+      await this.#diagnostic(command, active, detail);
+      await this.#event(command, { type: "status", status: "failed" }, conversationRefs).catch(() => void 0);
+      await this.#failure(command, active, detail);
+      return null;
+    });
+    return { status: "running", message: resume ? "Pi resumed from a portable checkpoint" : "Pi started" };
+  }
+  async #prompt(command) {
+    const active = this.#active.get(command.sessionId);
+    const prompt = command.payload.prompt;
+    if (!active || typeof prompt !== "string" || !prompt.trim() || prompt.length > 2e4) {
+      throw new TypeError("prompt requires an active Code session and bounded text");
+    }
+    const requestedLimit = command.payload.maxTokensPerInteraction ?? active.maxTokensPerInteraction;
+    if (!Number.isSafeInteger(requestedLimit) || Number(requestedLimit) < 4e3 || Number(requestedLimit) > 2e5) {
+      throw new TypeError("prompt requires a valid interaction token limit");
+    }
+    active.maxTokensPerInteraction = Number(requestedLimit);
+    await active.done;
+    active.abort = new AbortController();
+    active.acknowledged = false;
+    active.failure = void 0;
+    active.done = this.#runAttempt(command, {
+      role: active.role,
+      title: active.title,
+      prompt,
+      maxTokensPerInteraction: active.maxTokensPerInteraction,
+      planningInputDigest: active.planningInputDigest,
+      attestationDigest: "follow-up",
+      repository: active.repository,
+      baseCommitSha: active.baseCommitSha,
+      sourceTreeDigest: active.sourceTreeDigest
+    }, active).catch(async (cause) => {
+      const detail = runtimeErrorMessage(cause);
+      await this.#event(
+        command,
+        { type: "message", actor: "system", body: `Pi failed: ${detail}` },
+        active.conversationRefs
+      ).catch(() => void 0);
+      await this.#diagnostic(command, active, detail);
+      await this.#event(command, { type: "status", status: "failed" }, active.conversationRefs).catch(() => void 0);
+      await this.#failure(command, active, detail);
+      return null;
+    });
+    return { status: "running", message: "Pi accepted the owner prompt" };
+  }
+  async #runAttempt(command, metadata, active) {
+    const lease = fakeCodeLease(command, metadata);
+    const broker = createCodeRuntimeToolBroker({
+      recipes: this.options.recipes,
+      engine: this.options.engine,
+      recipeAuthorization: this.options.recipeAuthorization
+    }, lease, metadata.role);
+    const startedAt = Date.now();
+    let completionSeen = false;
+    const interaction = { tokens: 0, noticeEmitted: false };
+    const result = await this.#run({
+      engine: this.options.engine,
+      image: this.options.image,
+      allowUnpinnedImage: this.options.imageAuthorization === "cli_embedded",
+      workspaceDir: active.workspace.workspaceDir,
+      workspaceAccess: "none",
+      task: lease.task,
+      limits: this.options.limits,
+      signal: active.abort.signal,
+      onStderr: (text) => this.#event(command, {
+        type: "message",
+        actor: "system",
+        body: text.slice(0, 4e3)
+      }, active.conversationRefs),
+      onMessage: async (output) => {
+        if (output.type === "inference.request") {
+          return handleCodeRuntimeInference({
+            command,
+            metadata,
+            request: output,
+            state: interaction,
+            control: this.options.control,
+            event: (event) => this.#event(
+              command,
+              event,
+              active.conversationRefs
+            )
+          });
+        }
+        if (output.type === "tool.request") {
+          const toolStarted = Date.now();
+          await this.#event(
+            command,
+            { type: "tool", phase: "started", tool: output.tool },
+            active.conversationRefs
+          ).catch(() => void 0);
+          const response2 = await broker.execute({
+            lease,
+            workspaceDir: active.workspace.workspaceDir,
+            signal: active.abort.signal
+          }, output);
+          await this.#event(command, {
+            type: "tool",
+            phase: "completed",
+            tool: output.tool,
+            ok: response2.ok,
+            durationMs: Date.now() - toolStarted
+          }, active.conversationRefs).catch(() => void 0);
+          return { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "tool.response", ...response2 };
+        }
+        if (output.type === "event") {
+          const payload = runtimeRecord(output.payload);
+          if (output.kind === "pi.started") {
+            await this.#event(command, { type: "status", status: "running" }, active.conversationRefs);
+          } else if (output.kind === "pi.thinking" && payload?.available === true && Number.isSafeInteger(payload.durationMs) && Number(payload.durationMs) >= 0) {
+            await this.#event(command, {
+              type: "thinking",
+              available: true,
+              durationMs: Math.min(Number(payload.durationMs), 864e5)
+            }, active.conversationRefs);
+          } else {
+            await this.#event(command, {
+              type: "message",
+              actor: "system",
+              body: `${output.kind}${output.payload === void 0 ? "" : ` ${safeRuntimeJson(output.payload)}`}`
+            }, active.conversationRefs);
+          }
+        } else if (output.type === "attempt.complete") {
+          completionSeen = true;
+          const body = runtimeResultText(output.result) ?? `Pi ${output.status}.`;
+          await this.#event(command, {
+            type: "message",
+            actor: output.status === "completed" ? "agent" : "system",
+            body
+          }, active.conversationRefs);
+          await this.#event(command, {
+            type: "status",
+            status: output.status === "completed" ? "idle" : "failed",
+            durationMs: Date.now() - startedAt
+          }, active.conversationRefs);
+        }
+      }
+    });
+    if (result.status === "failed" && result.stderr) {
+      await this.#event(command, { type: "message", actor: "system", body: result.stderr.slice(0, 4e3) }, active.conversationRefs);
+    }
+    if (!completionSeen) await this.#event(command, {
+      type: "status",
+      status: result.status === "completed" ? "idle" : "failed",
+      durationMs: Date.now() - startedAt
+    }, active.conversationRefs).catch(() => void 0);
+    if (result.status === "failed") {
+      const detail = (runtimeResultError(result.result) ?? result.stderr.trim()) || "Pi container failed";
+      await this.#diagnostic(command, active, detail);
+      await this.#failure(command, active, detail);
+    }
+    return result;
+  }
+  async #checkpoint(command) {
+    const active = this.#active.get(command.sessionId);
+    if (!active) throw new TypeError("Code session workspace is not active on this runtime");
+    const result = await this.#checkpoints.prepare(command, active);
+    this.#active.delete(command.sessionId);
+    return result;
+  }
+  async #failure(command, active, value) {
+    active.failure = value.slice(0, 2e3);
+    if (active.acknowledged) {
+      await this.options.control.reportSessionFailure(command.sessionId, active.failure).catch(() => void 0);
+    }
+  }
+  async #diagnostic(command, active, value) {
+    const detail = value.trim().slice(0, 2e3) || "Pi runtime failed";
+    this.options.onDiagnostic?.(detail);
+    await this.#event(
+      command,
+      { type: "diagnostic", level: "error", message: detail },
+      active.conversationRefs
+    ).catch(() => void 0);
+  }
+  async #event(command, event, refs) {
+    await appendCodeRuntimeEvent(this.options.control, command, event, refs);
+  }
+};
+
+// src/code-runtime-cli.ts
+var VERSION = "0.1.0";
+function usage() {
+  return `Usage:
+  ODLA_CODE_HOST_TOKEN=odla_code_host_... odla-code-runtime \\
+    --endpoint https://odla.ai --image registry/odla-pi@sha256:... \\
+    --build-policy ./odla-code-build.json [--engine auto|container|podman|docker] [--once]
+
+The host token is read only from ODLA_CODE_HOST_TOKEN. The runtime makes
+outbound HTTPS heartbeats and never opens a listener.`;
+}
+function parse(argv) {
+  const values = /* @__PURE__ */ new Map();
+  const flags = /* @__PURE__ */ new Set();
+  for (let index = 0; index < argv.length; index++) {
+    const arg = argv[index];
+    if (arg === "--once") {
+      flags.add(arg);
+      continue;
+    }
+    if (!arg.startsWith("--") || !argv[index + 1]) throw new TypeError(usage());
+    values.set(arg, argv[++index]);
+  }
+  const endpoint = values.get("--endpoint");
+  const image = values.get("--image");
+  const buildPolicy = values.get("--build-policy");
+  const engine = values.get("--engine") ?? "auto";
+  const heartbeatMs = Number(values.get("--heartbeat-ms") ?? 15e3);
+  if (!endpoint || !image || !buildPolicy || !["auto", "container", "podman", "docker"].includes(engine)) {
+    throw new TypeError(usage());
+  }
+  assertPinnedImage(image);
+  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1e3 || heartbeatMs > 3e5) {
+    throw new TypeError("--heartbeat-ms must be an integer from 1000 to 300000");
+  }
+  return {
+    endpoint,
+    image,
+    buildPolicy,
+    engine,
+    heartbeatMs,
+    once: flags.has("--once")
+  };
+}
+async function readPolicy(path) {
+  const value = JSON.parse(await (0, import_promises8.readFile)(path, "utf8"));
+  if (!value || Object.keys(value).some((key) => !["recipes", "recipeAuthorization"].includes(key)) || !Array.isArray(value.recipes) || !value.recipes.length || value.recipeAuthorization !== void 0 && value.recipeAuthorization !== "registered_recipe" && value.recipeAuthorization !== "exact_approval") throw new TypeError("invalid Code build policy file");
+  const recipes = value.recipes;
+  for (const recipe2 of recipes) assertCodeBuildRecipe(recipe2);
+  const recipeAuthorization = value.recipeAuthorization === "exact_approval" ? "exact_approval" : "registered_recipe";
+  return { recipes, recipeAuthorization };
+}
+async function main() {
+  const token = process.env.ODLA_CODE_HOST_TOKEN;
+  if (!token) throw new TypeError("ODLA_CODE_HOST_TOKEN is required");
+  const options = parse(process.argv.slice(2));
+  if (process.platform !== "darwin" && process.platform !== "linux") throw new TypeError("Code runtime requires macOS or Linux");
+  const engine = await selectContainerEngine(options.engine);
+  const policy = await readPolicy(options.buildPolicy);
+  const capabilities = {
+    protocolVersion: CODE_RUNTIME_PROTOCOL_VERSION,
+    platform: process.platform === "darwin" ? "macos" : "linux",
+    arch: process.arch,
+    engines: [engine],
+    cpuCount: (0, import_node_os3.cpus)().length,
+    memoryBytes: (0, import_node_os3.totalmem)()
+  };
+  const controller = new AbortController();
+  for (const signal of ["SIGINT", "SIGTERM"]) process.once(signal, () => controller.abort(signal));
+  const control = createCodeRuntimeControlClient({ endpoint: options.endpoint, token, signal: controller.signal });
+  const commandEngine = new CodePiRuntimeEngine({
+    control,
+    engine,
+    image: options.image,
+    recipes: policy.recipes,
+    recipeAuthorization: policy.recipeAuthorization,
+    onDiagnostic: (message2) => process.stderr.write(`[odla-code-runtime] Pi failed \xB7 ${message2}
+`)
+  });
+  const reconciler = new CodeRuntimeReconciler(control, commandEngine);
+  try {
+    await runCodeRuntimeHeartbeatLoop({
+      control,
+      runtimeVersion: VERSION,
+      capabilities,
+      heartbeatMs: options.heartbeatMs,
+      once: options.once,
+      signal: controller.signal,
+      onSnapshot: async (snapshot) => {
+        process.stderr.write(
+          `[odla-code-runtime] host ${snapshot.host.hostId} online \xB7 ${snapshot.bindings.length} active binding(s) \xB7 ${snapshot.commands.length} command(s)
+`
+        );
+        if (options.once && snapshot.commands.length) {
+          throw new TypeError("--once is diagnostic-only and refuses pending Code commands");
+        }
+        await reconciler.reconcile(snapshot);
+      },
+      onRetry: (error, delayMs) => {
+        process.stderr.write(
+          `[odla-code-runtime] control plane unavailable; retrying in ${delayMs}ms \xB7 ${error instanceof Error ? error.message : String(error)}
+`
+        );
+      }
+    });
+  } finally {
+    await commandEngine.close();
+  }
+}
+main().catch((error) => {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}
+`);
+  process.exitCode = 1;
+});
+//# sourceMappingURL=code-runtime-cli.cjs.map