@tangle-network/agent-bench 0.3.5 → 0.3.6

package/dist/index.js

@@ -0,0 +1,1908 @@
+import {
+  ADAPTERS,
+  resolveAdapter
+} from "./chunk-5SBJCB6W.js";
+import "./chunk-2PVVP7GN.js";
+import "./chunk-VQRS7VUC.js";
+import "./chunk-Z7ML6L77.js";
+import {
+  createRagBenchAdapter
+} from "./chunk-R67DFVLO.js";
+import "./chunk-SEVJPLZC.js";
+import {
+  createSweBenchAdapter,
+  scoreSweReport,
+  sweEvaluationArgv,
+  swePatchOutput
+} from "./chunk-CKUVRZ2T.js";
+import {
+  createT2RagBenchAdapter
+} from "./chunk-Y6O2OCUO.js";
+import "./chunk-HBSWHQNJ.js";
+import "./chunk-UAIOHCUK.js";
+import "./chunk-R36V2VP7.js";
+import "./chunk-JRWWGMK7.js";
+import "./chunk-INNOYXCP.js";
+import "./chunk-PA2ZKHJC.js";
+import "./chunk-PPYSEKFM.js";
+import "./chunk-TBKU5XQI.js";
+import {
+  createNoMiraclAdapter
+} from "./chunk-TSWPNOYM.js";
+import {
+  createOpenRagBenchAdapter
+} from "./chunk-KDIKRJGB.js";
+import "./chunk-ZEWMTR5M.js";
+import "./chunk-PUIRNYI7.js";
+import "./chunk-C7T7WEK2.js";
+import {
+  runRefineLoop
+} from "./chunk-JTHWEDEW.js";
+import "./chunk-2XU6OGEN.js";
+import {
+  createCragAdapter
+} from "./chunk-HHXFIHXC.js";
+import {
+  FINAL_ANSWER_SENTINEL,
+  answerScoreToBenchScore,
+  contextBlock,
+  contextsFrom,
+  normalizeAnswer,
+  parseCitations,
+  parseFinalAnswer,
+  ragAnswerOutput,
+  scoreAnswerArtifact,
+  tokenF1
+} from "./chunk-X3BTXCJ4.js";
+import "./chunk-J3KDJNX2.js";
+import "./chunk-X5YKXC6V.js";
+import "./chunk-YCGY7UIZ.js";
+import "./chunk-UPAMRDX4.js";
+import "./chunk-ODT47UAY.js";
+import "./chunk-7WSD27QQ.js";
+import "./chunk-SYDW647C.js";
+import "./chunk-IFAV6KEM.js";
+import {
+  StagedJudgeError,
+  runStagedJudge
+} from "./chunk-LRRD7NAG.js";
+import "./chunk-53UPUNBZ.js";
+
+// src/run-benchmarks.ts
+import { mkdirSync, writeFileSync } from "fs";
+import { openSandboxRun } from "@tangle-network/agent-runtime/loops";
+
+// src/resolve-client.ts
+import {
+  createExecutor,
+  inlineSandboxClient,
+  resolveSandboxClient
+} from "@tangle-network/agent-runtime/loops";
+import { Sandbox } from "@tangle-network/sandbox";
+
+// src/search-tool.ts
+var webSearchTool = {
+  type: "function",
+  function: {
+    name: "web_search",
+    description: "Search the live web for current facts, market data, filings, and news. Returns the top results as title, date, snippet, and URL. Call it as many times as needed, refining the query, before you answer.",
+    parameters: {
+      type: "object",
+      properties: {
+        query: {
+          type: "string",
+          description: "The search query. Be specific \u2014 include entity, metric, period, and units."
+        }
+      },
+      required: ["query"]
+    }
+  }
+};
+var formatHits = (hits, maxHits) => {
+  if (hits.length === 0) return "No results found for that query. Try a different query.";
+  return hits.slice(0, maxHits).map((h, i) => {
+    const date = h.publishedAt ? ` (${h.publishedAt.slice(0, 10)})` : "";
+    return `[${i + 1}] ${h.title ?? "(untitled)"}${date}
+${h.snippet ?? ""}
+${h.url ?? ""}`;
+  }).join("\n\n");
+};
+var makeSearchExecutor = (cfg) => {
+  const maxHits = cfg.maxHits ?? 6;
+  return async (name, args) => {
+    if (name !== webSearchTool.function.name) {
+      throw new Error(`search executor received unknown tool '${name}' (only '${webSearchTool.function.name}')`);
+    }
+    const query = typeof args.query === "string" ? args.query.trim() : "";
+    if (!query) return 'web_search requires a non-empty "query" string.';
+    const res = await fetch(`${cfg.routerBaseUrl}/search`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${cfg.routerKey}` },
+      body: JSON.stringify({ provider: cfg.provider, query })
+    });
+    if (!res.ok) {
+      throw new Error(`web_search ${cfg.provider} HTTP ${res.status}: ${(await res.text()).slice(0, 300)}`);
+    }
+    const body = await res.json();
+    const hits = body.data ?? [];
+    console.error(`  [web_search:${cfg.provider}] "${query.slice(0, 80)}" -> ${hits.length} hits`);
+    return formatHits(hits, maxHits);
+  };
+};
+
+// src/resolve-client.ts
+function resolveBenchClient(opts) {
+  const { backend, routerBaseUrl, routerKey, model, searchProvider } = opts;
+  if (backend === "router") {
+    if (searchProvider) {
+      return inlineSandboxClient(
+        createExecutor({
+          backend: "router-tools",
+          routerBaseUrl,
+          routerKey,
+          model,
+          tools: [webSearchTool],
+          executeToolCall: makeSearchExecutor({ routerBaseUrl, routerKey, provider: searchProvider })
+        })
+      );
+    }
+    return inlineSandboxClient(createExecutor({ backend: "router", routerBaseUrl, routerKey, model }));
+  }
+  if (backend === "bridge") {
+    const bridgeBearer = opts.bridgeBearer ?? routerKey;
+    if (!bridgeBearer) throw new Error("resolveBenchClient: backend 'bridge' needs bridgeBearer or routerKey");
+    return resolveSandboxClient({
+      backend: "bridge",
+      bridge: { url: opts.bridgeUrl, bearer: bridgeBearer, model, timeoutMs: opts.timeoutMs }
+    });
+  }
+  return new Sandbox({
+    baseUrl: opts.sandboxBaseUrl ?? "https://sandbox.tangle.tools",
+    apiKey: routerKey,
+    timeoutMs: opts.timeoutMs ?? 12e5
+  });
+}
+
+// src/run-pool.ts
+async function runPool(items, concurrency, worker, opts) {
+  const results = new Array(items.length);
+  let next = 0;
+  const drain = async () => {
+    while (next < items.length) {
+      const index = next++;
+      const item = items[index];
+      let outcome;
+      try {
+        outcome = { index, item, ok: true, value: await worker(item, index) };
+      } catch (err) {
+        outcome = { index, item, ok: false, error: err instanceof Error ? err.message : String(err) };
+      }
+      results[index] = outcome;
+      opts?.onResult?.(outcome);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, drain));
+  return results;
+}
+
+// src/run-benchmarks.ts
+function finalText(events) {
+  let text = "";
+  for (const ev of events) {
+    const e = ev;
+    const data = e.data ?? {};
+    if (e.type === "message.part.updated") {
+      const part = data.part;
+      const partType = data.partType ?? part?.type;
+      if (partType === "text") {
+        if (typeof data.delta === "string") text += data.delta;
+        else if (typeof part?.text === "string") text = part.text;
+      }
+    } else if (typeof data.finalText === "string") text = data.finalText;
+    else if (typeof data.response === "string") text = data.response;
+  }
+  return text.trim();
+}
+var openSandboxShot = async ({ adapter, task, cell, prompt, routerBaseUrl, routerKey, bridgeUrl, bridgeBearer, sandboxBaseUrl, timeoutMs, resolveClient }) => {
+  const client = (resolveClient ?? resolveBenchClient)({
+    backend: cell.backend ?? "router",
+    routerBaseUrl,
+    routerKey,
+    model: cell.model,
+    ...bridgeUrl ? { bridgeUrl } : {},
+    ...bridgeBearer ? { bridgeBearer } : {},
+    ...sandboxBaseUrl ? { sandboxBaseUrl } : {},
+    ...cell.searchProvider ? { searchProvider: cell.searchProvider } : {},
+    ...timeoutMs ? { timeoutMs } : {}
+  });
+  const harness = cell.harness ?? cell.profile?.metadata?.backendType ?? "opencode";
+  const profile = cell.profile ?? { name: cell.label, metadata: { backendType: harness } };
+  const uniq = Math.random().toString(36).slice(2, 8);
+  const agentRun = {
+    profile,
+    name: cell.label,
+    taskToPrompt: () => "",
+    sandboxOverrides: {
+      name: `bench-${adapter.name}-${task.id}-${uniq}`.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 60),
+      environment: "universal",
+      backend: { type: harness, model: { provider: "openai", model: cell.model, baseUrl: routerBaseUrl } }
+    }
+  };
+  const deliverable = {
+    kind: "events",
+    fromEvents: (events) => adapter.output ? adapter.output.parse(events) : finalText(events)
+  };
+  const controller = new AbortController();
+  const timer = timeoutMs ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
+  const runOptions = {
+    agentRun,
+    signal: controller.signal,
+    runId: `bench:${adapter.name}:${task.id}:${uniq}`,
+    scenarioId: task.id
+  };
+  const boxSetup = adapter.boxSetup;
+  if (boxSetup) {
+    runOptions.beforeStart = async ({ box, sessionId }) => {
+      const setup = boxSetup(task);
+      const sres = await box.exec(setup.command, {
+        timeoutMs: 3e5,
+        sessionId,
+        ...setup.cwd ? { cwd: setup.cwd } : {}
+      });
+      if (sres.exitCode !== 0)
+        throw new Error(
+          `boxSetup failed (exit ${sres.exitCode}): ${(sres.stderr ?? "").slice(0, 200)}`
+        );
+    };
+  }
+  const run = await openSandboxRun(client, runOptions, deliverable);
+  try {
+    const turn = await run.start(prompt ?? task.prompt);
+    let artifact = (turn.out ?? "").trim();
+    let boxExtractError;
+    if (adapter.boxExtract) {
+      try {
+        const ex = adapter.boxExtract(task);
+        const res = await run.box.exec(ex.command, {
+          timeoutMs: 12e4,
+          sessionId: run.sessionId,
+          ...ex.cwd ? { cwd: ex.cwd } : {}
+        });
+        const boxArtifact = (res.stdout ?? "").trim();
+        if (res.exitCode !== 0)
+          boxExtractError = `exit ${res.exitCode}: ${(res.stderr ?? "").slice(0, 160)}`;
+        else if (boxArtifact.length > 0) artifact = boxArtifact;
+        if (process.env.BENCH_ARTIFACT_DIR) {
+          try {
+            mkdirSync(process.env.BENCH_ARTIFACT_DIR, { recursive: true });
+            const safe = `${adapter.name}_${task.id}_${uniq}`.replace(/[^a-zA-Z0-9_.-]/g, "_");
+            const map = await run.box.exec(
+              'echo "PWD:"; pwd; echo "LS:"; ls -la; echo "GITROOTS:"; find / -maxdepth 5 -type d -name .git 2>/dev/null; echo "SETTINGS:"; find / -maxdepth 8 -name global_settings.py -path "*conf*" 2>/dev/null',
+              { timeoutMs: 6e4, sessionId: run.sessionId }
+            ).catch((e) => ({ exitCode: -1, stdout: "", stderr: String(e) }));
+            writeFileSync(
+              `${process.env.BENCH_ARTIFACT_DIR}/${safe}.exec.json`,
+              JSON.stringify(
+                { sessionId: run.sessionId, extract: res, map: { exitCode: map.exitCode, stdout: map.stdout, stderr: map.stderr } },
+                null,
+                2
+              )
+            );
+          } catch {
+          }
+        }
+      } catch (err) {
+        boxExtractError = err instanceof Error ? err.message.slice(0, 160) : String(err);
+      }
+    }
+    const detail = turn.readError !== void 0 ? `read: ${turn.readError.slice(0, 160)}` : boxExtractError !== void 0 ? `boxExtract: ${boxExtractError}` : void 0;
+    if (process.env.BENCH_ARTIFACT_DIR) {
+      try {
+        mkdirSync(process.env.BENCH_ARTIFACT_DIR, { recursive: true });
+        const safe = `${adapter.name}_${task.id}_${uniq}`.replace(/[^a-zA-Z0-9_.-]/g, "_");
+        writeFileSync(`${process.env.BENCH_ARTIFACT_DIR}/${safe}.patch`, artifact);
+      } catch {
+      }
+    }
+    return {
+      artifact,
+      ok: artifact.length > 0,
+      ...detail ? { detail } : {}
+    };
+  } finally {
+    if (timer) clearTimeout(timer);
+    await run.close();
+  }
+};
+function parseMaybeJson(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+function redactJudgeLeak(value) {
+  if (Array.isArray(value)) return value.map(redactJudgeLeak);
+  if (!value || typeof value !== "object") return value;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const normalizedKey = key.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
+    if (/(^|_)(gold|expected|reference|solution|answer)(_|$)/.test(normalizedKey)) continue;
+    out[key] = redactJudgeLeak(child);
+  }
+  return out;
+}
+function safeFeedback(score) {
+  return {
+    resolved: score.resolved,
+    score: score.score,
+    ...score.detail ? { detail: redactJudgeLeak(parseMaybeJson(score.detail)) } : {}
+  };
+}
+function truncate(value, max = 4e3) {
+  return value.length <= max ? value : `${value.slice(0, max)}
+...[truncated ${value.length - max} chars]`;
+}
+function retryPrompt(task, history, scores) {
+  const attempts = history.map((h) => {
+    const score = scores.get(h.round);
+    return [
+      `Attempt ${h.round}:`,
+      "Artifact:",
+      truncate(h.artifact),
+      score ? `Checker feedback: ${JSON.stringify(safeFeedback(score))}` : void 0
+    ].filter(Boolean).join("\n");
+  }).join("\n\n");
+  return [
+    "Retry the benchmark task. The previous artifact did not pass the checker.",
+    "Use only the original task statement and supplied context. Do not invent facts.",
+    "Return the corrected artifact in exactly the format requested by the original task.",
+    "",
+    "Original task:",
+    task.prompt,
+    "",
+    "Previous attempts and safe checker feedback:",
+    attempts
+  ].join("\n");
+}
+async function loopedShot(input, shot, attempts) {
+  const scores = /* @__PURE__ */ new Map();
+  const result = await runRefineLoop({
+    rounds: attempts,
+    prompt: (round, history) => round === 1 ? input.task.prompt : retryPrompt(input.task, history, scores),
+    runShot: async (prompt, round) => {
+      const out = await shot({ ...input, prompt, attempt: round });
+      return { artifact: out.artifact, note: out.detail };
+    },
+    judge: async (artifact, round) => {
+      const score = await input.adapter.judge(input.task, artifact);
+      scores.set(round, score);
+      return { valid: score.resolved, score: score.score };
+    }
+  });
+  const best = result.rounds.reduce((winner, candidate) => {
+    const a = scores.get(winner.round);
+    const b = scores.get(candidate.round);
+    if (!a) return candidate;
+    if (!b) return winner;
+    if (b.resolved && !a.resolved) return candidate;
+    if (b.resolved === a.resolved && b.score > a.score) return candidate;
+    return winner;
+  }, result.rounds[0]);
+  const bestScore = scores.get(best.round);
+  return {
+    artifact: best.artifact,
+    ok: best.artifact.trim().length > 0,
+    detail: JSON.stringify({
+      mode: "refine-loop",
+      attempts: result.rounds.length,
+      selectedAttempt: best.round,
+      resolvedDuringLoop: result.resolved,
+      selectedScore: bestScore?.score ?? null,
+      rounds: result.rounds.map((round) => ({
+        attempt: round.round,
+        score: scores.get(round.round)?.score ?? null,
+        resolved: scores.get(round.round)?.resolved ?? null,
+        note: round.note ?? null
+      }))
+    })
+  };
+}
+function combineDetails(runDetail, scoreDetail) {
+  if (runDetail && scoreDetail) {
+    return JSON.stringify({ run: parseMaybeJson(runDetail), score: parseMaybeJson(scoreDetail) });
+  }
+  return runDetail ?? scoreDetail;
+}
+async function prepareBenchmarks(benchmarks, resolve4, opts) {
+  const ready = [];
+  const unavailable = [];
+  for (const benchmark of benchmarks) {
+    const adapter = resolve4(benchmark);
+    try {
+      await adapter.preflight();
+      const tasks = await adapter.loadTasks({
+        ...opts.n !== void 0 ? { limit: opts.n } : {},
+        ...opts.ids ? { ids: opts.ids } : {},
+        ...opts.split ? { split: opts.split } : {}
+      });
+      if (tasks.length === 0) {
+        unavailable.push({ benchmark, reason: "loadTasks returned no tasks" });
+        continue;
+      }
+      if (opts.verifyJudge !== false) {
+        const gold = await adapter.goldArtifact(tasks[0]);
+        if (gold !== void 0) {
+          const verdict = await adapter.judge(tasks[0], gold);
+          if (!verdict.resolved) {
+            unavailable.push({ benchmark, reason: `judge rejected its own gold on ${tasks[0].id} \u2014 judge is miscalibrated` });
+            continue;
+          }
+        }
+      }
+      ready.push({ benchmark, adapter, tasks });
+    } catch (err) {
+      unavailable.push({ benchmark, reason: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return { ready, unavailable };
+}
+async function runBenchmarks(opts) {
+  if (opts.benchmarks.length === 0) throw new Error("runBenchmarks: no benchmarks selected");
+  if (opts.cells.length === 0) throw new Error("runBenchmarks: no cells to run");
+  const reps = Math.max(1, opts.reps ?? 1);
+  const loopAttempts = Math.max(1, opts.loopAttempts ?? 1);
+  const shot = opts.runShot ?? openSandboxShot;
+  const { ready, unavailable } = await prepareBenchmarks(opts.benchmarks, opts.resolveAdapter ?? resolveAdapter, opts);
+  const jobs = [];
+  for (const { benchmark, adapter, tasks } of ready)
+    for (const cell of opts.cells) for (const task of tasks) for (let rep = 0; rep < reps; rep += 1) jobs.push({ benchmark, adapter, cell, task, rep });
+  const perTask = [];
+  await runPool(jobs, Math.max(1, opts.concurrency ?? 4), async (job, index) => {
+    const startedAt = Date.now();
+    let result;
+    try {
+      const shotInput = {
+        adapter: job.adapter,
+        task: job.task,
+        cell: job.cell,
+        routerBaseUrl: opts.routerBaseUrl,
+        routerKey: opts.routerKey,
+        ...opts.bridgeUrl ? { bridgeUrl: opts.bridgeUrl } : {},
+        ...opts.bridgeBearer ? { bridgeBearer: opts.bridgeBearer } : {},
+        ...opts.sandboxBaseUrl ? { sandboxBaseUrl: opts.sandboxBaseUrl } : {},
+        ...opts.timeoutMs ? { timeoutMs: opts.timeoutMs } : {},
+        ...opts.resolveClient ? { resolveClient: opts.resolveClient } : {}
+      };
+      const out = loopAttempts > 1 ? await loopedShot(shotInput, shot, loopAttempts) : await shot(shotInput);
+      const score = await job.adapter.judge(job.task, out.artifact);
+      result = {
+        benchmark: job.benchmark,
+        cell: job.cell.label,
+        taskId: job.task.id,
+        rep: job.rep,
+        resolved: out.ok && score.resolved,
+        score: out.ok ? score.score : 0,
+        ok: out.ok,
+        ...out.detail ?? score.detail ? { detail: combineDetails(out.detail, score.detail) } : {},
+        wallMs: Date.now() - startedAt
+      };
+    } catch (err) {
+      result = {
+        benchmark: job.benchmark,
+        cell: job.cell.label,
+        taskId: job.task.id,
+        rep: job.rep,
+        resolved: false,
+        score: 0,
+        ok: false,
+        detail: err instanceof Error ? err.message.slice(0, 200) : String(err),
+        wallMs: Date.now() - startedAt
+      };
+    }
+    void index;
+    perTask.push(result);
+    opts.onResult?.(result);
+    return result;
+  });
+  const rows = aggregate(perTask);
+  return {
+    rows,
+    perTask,
+    benchmarks: ready.map((r) => r.benchmark),
+    cells: opts.cells.map((c) => c.label),
+    unavailable
+  };
+}
+function aggregate(perTask) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const r of perTask) {
+    const key = `${r.benchmark}\0${r.cell}`;
+    const e = byKey.get(key) ?? { benchmark: r.benchmark, cell: r.cell, n: 0, resolved: 0, errored: 0, scoreSum: 0 };
+    e.n += 1;
+    if (!r.ok) e.errored += 1;
+    else {
+      if (r.resolved) e.resolved += 1;
+      e.scoreSum += r.score;
+    }
+    byKey.set(key, e);
+  }
+  const rows = [...byKey.values()].map((e) => {
+    const denom = Math.max(1, e.n - e.errored);
+    return {
+      benchmark: e.benchmark,
+      cell: e.cell,
+      n: e.n,
+      resolved: e.resolved,
+      errored: e.errored,
+      resolveRate: e.resolved / denom,
+      meanScore: e.scoreSum / denom
+    };
+  });
+  rows.sort((a, b) => a.benchmark === b.benchmark ? b.resolveRate - a.resolveRate : a.benchmark < b.benchmark ? -1 : 1);
+  return rows;
+}
+function printBenchmarksReport(report) {
+  const lines = [];
+  const w = Math.max(8, ...report.rows.map((r) => r.cell.length));
+  const b = Math.max(9, ...report.rows.map((r) => r.benchmark.length));
+  lines.push(`${"benchmark".padEnd(b)}  ${"cell".padEnd(w)}  resolve   mean    n  err`);
+  for (const r of report.rows)
+    lines.push(
+      `${r.benchmark.padEnd(b)}  ${r.cell.padEnd(w)}  ${(r.resolveRate * 100).toFixed(1).padStart(6)}%  ${r.meanScore.toFixed(3).padStart(5)}  ${String(r.n).padStart(3)}  ${String(r.errored).padStart(3)}`
+    );
+  for (const u of report.unavailable) lines.push(`(skipped ${u.benchmark}: ${u.reason})`);
+  return lines.join("\n");
+}
+
+// src/pier-agent.ts
+import assert from "assert/strict";
+import { createHash } from "crypto";
+import { chmod, lstat, mkdir as mkdir2, realpath as realpath2, writeFile } from "fs/promises";
+import { dirname, isAbsolute, join as join2, resolve as resolve2 } from "path";
+import { executePreparedAgentCandidate } from "@tangle-network/agent-runtime";
+import { canonicalJson } from "@tangle-network/agent-eval";
+
+// src/pier-task-outcome.ts
+import { spawn } from "child_process";
+import { mkdir, mkdtemp, realpath, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join, resolve } from "path";
+import {
+  captureAgentCandidateWorkspaceFiles
+} from "@tangle-network/agent-runtime/candidate-execution";
+async function capturePierTaskOutcome(input) {
+  input.signal?.throwIfAborted();
+  const repositoryRoot = resolve(input.repositoryRoot);
+  const head = (await git(repositoryRoot, ["rev-parse", "HEAD"], void 0, {}, input.signal)).stdout.toString("utf8").trim();
+  const headTree = (await git(repositoryRoot, ["rev-parse", "HEAD^{tree}"], void 0, {}, input.signal)).stdout.toString("utf8").trim();
+  if (head !== input.baseCommit || headTree !== input.baseTree) {
+    throw new Error("Pier task outcome repository drifted from its signed base");
+  }
+  const gitDir = resolve(
+    (await git(repositoryRoot, ["rev-parse", "--absolute-git-dir"], void 0, {}, input.signal)).stdout.toString("utf8").trim()
+  );
+  if (await realpath(gitDir) !== gitDir || gitDir.includes(":")) {
+    throw new Error("Pier task outcome Git directory is unsupported");
+  }
+  const replacements = (await git(
+    repositoryRoot,
+    ["for-each-ref", "--format=%(refname)", "refs/replace"],
+    void 0,
+    {},
+    input.signal
+  )).stdout.toString("utf8").trim();
+  if (replacements) throw new Error("Pier task outcome repository contains Git replace refs");
+  const temporary = await mkdtemp(join(tmpdir(), "pier-task-outcome-"));
+  try {
+    const objectDirectory = join(temporary, "objects");
+    const indexFile = join(temporary, "index");
+    await mkdir(objectDirectory);
+    const environment = {
+      GIT_INDEX_FILE: indexFile,
+      GIT_OBJECT_DIRECTORY: objectDirectory,
+      GIT_ALTERNATE_OBJECT_DIRECTORIES: join(gitDir, "objects")
+    };
+    await git(repositoryRoot, ["read-tree", input.baseTree], void 0, environment, input.signal);
+    const patch = Uint8Array.from(input.patch);
+    if (patch.byteLength > 0) {
+      await git(
+        repositoryRoot,
+        ["apply", "--cached", "--binary", "--whitespace=nowarn", "-"],
+        patch,
+        environment,
+        input.signal
+      );
+    }
+    const resultTree = (await git(repositoryRoot, ["write-tree"], void 0, environment, input.signal)).stdout.toString("utf8").trim();
+    const entries = parseTreeEntries(
+      (await git(
+        repositoryRoot,
+        ["ls-tree", "-rz", "--full-tree", resultTree],
+        void 0,
+        environment,
+        input.signal
+      )).stdout
+    );
+    if (entries.length === 0) throw new Error("Pier task outcome tree cannot be empty");
+    const files = await Promise.all(
+      entries.map(async (entry) => {
+        if (entry.type !== "blob" || entry.mode !== "100644" && entry.mode !== "100755") {
+          throw new Error(`Pier task outcome contains a non-regular entry: ${entry.path}`);
+        }
+        return {
+          path: safeGitPath(entry.path),
+          mode: entry.mode === "100755" ? 493 : 420,
+          bytes: (await git(
+            repositoryRoot,
+            ["cat-file", "blob", entry.object],
+            void 0,
+            environment,
+            input.signal
+          )).stdout
+        };
+      })
+    );
+    const captured = await captureAgentCandidateWorkspaceFiles(files, {
+      limits: { maxEmbeddedArtifactBytes: 512 * 1024 * 1024 }
+    });
+    return {
+      kind: "workspace",
+      resultTree,
+      afterState: captured.snapshot.material,
+      archive: captured.archive,
+      gitDiff: patch
+    };
+  } finally {
+    await rm(temporary, { recursive: true, force: true });
+  }
+}
+function parseTreeEntries(bytes) {
+  const raw = Buffer.from(bytes);
+  const decoded = raw.toString("utf8");
+  if (!Buffer.from(decoded, "utf8").equals(raw)) {
+    throw new Error("Pier task outcome contains a non-UTF-8 path");
+  }
+  return decoded.split("\0").filter(Boolean).map((row) => {
+    const tab = row.indexOf("	");
+    const [mode, type, object] = row.slice(0, tab).split(" ");
+    const path = row.slice(tab + 1);
+    if (tab < 1 || !mode || !type || !object || !path) {
+      throw new Error("Pier task outcome contains a malformed Git entry");
+    }
+    return { mode, type, object, path };
+  });
+}
+function safeGitPath(path) {
+  const parts = path.split("/");
+  if (!path || path.startsWith("/") || path.includes("\\") || path.includes("\0") || parts.some((part) => !part || part === "." || part === "..") || parts[0]?.toLowerCase() === ".git") {
+    throw new Error(`Pier task outcome contains an unsafe Git path: ${path}`);
+  }
+  return path;
+}
+async function git(repositoryRoot, args, input, extraEnvironment, signal) {
+  signal?.throwIfAborted();
+  const environment = Object.fromEntries(
+    Object.entries(process.env).filter(([name]) => !name.startsWith("GIT_"))
+  );
+  Object.assign(environment, {
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_GLOBAL: "/dev/null",
+    GIT_CONFIG_SYSTEM: "/dev/null",
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_NO_REPLACE_OBJECTS: "1",
+    LC_ALL: "C",
+    ...extraEnvironment
+  });
+  return await new Promise((resolveResult, reject) => {
+    const child = spawn(
+      "git",
+      [
+        "-c",
+        "core.hooksPath=/dev/null",
+        "-c",
+        "protocol.file.allow=never",
+        "-C",
+        repositoryRoot,
+        ...args
+      ],
+      { env: environment, stdio: ["pipe", "pipe", "pipe"], signal }
+    );
+    const stdout = [];
+    const stderr = [];
+    let outputBytes = 0;
+    const collect = (target) => (chunk) => {
+      outputBytes += chunk.byteLength;
+      if (outputBytes > 64 * 1024 * 1024) {
+        child.kill("SIGKILL");
+        reject(new Error(`git ${args[0] ?? "<command>"} exceeded the output limit`));
+        return;
+      }
+      target.push(Buffer.from(chunk));
+    };
+    child.stdout.on("data", collect(stdout));
+    child.stderr.on("data", collect(stderr));
+    child.once("error", reject);
+    child.once("close", (code, childSignal) => {
+      const out = Buffer.concat(stdout);
+      const err = Buffer.concat(stderr);
+      if (code !== 0) {
+        reject(
+          new Error(
+            `git ${args[0] ?? "<command>"} failed (${childSignal ?? code}): ${err.toString("utf8").trim()}`
+          )
+        );
+        return;
+      }
+      resolveResult({ stdout: out, stderr: err });
+    });
+    child.stdin.end(input);
+  });
+}
+
+// src/pier-agent.ts
+var adapterImportPath = "pier_agents.tangle_candidate:TangleCandidateAgent";
+var sha256Pattern = /^sha256:[a-f0-9]{64}$/;
+function createPierCandidateRecoveryExecutor(controller) {
+  return {
+    execute: async () => {
+      throw new Error("recovery-only Pier executor cannot start a candidate");
+    },
+    stop: async (request) => {
+      assertTerminationAcknowledged(
+        await controller.terminateAndWait({
+          executionId: request.executionId,
+          executionPlanDigest: request.executionPlanDigest
+        })
+      );
+      return { stopped: true };
+    },
+    capture: async (request) => {
+      const result = await controller.captureResult(request);
+      if (!result) return {};
+      return {
+        evidence: Buffer.from(
+          canonicalJson({
+            schemaVersion: 1,
+            kind: "pier-candidate-recovery-capture",
+            executionPlanDigest: request.executionPlanDigest,
+            officialResult: Buffer.from(result.resultBytes).toString("base64"),
+            taskPatch: Buffer.from(result.taskPatch).toString("base64")
+          })
+        )
+      };
+    }
+  };
+}
+function sha256(bytes) {
+  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+function nonEmpty(value, label) {
+  if (!value || value.includes("\0")) throw new Error(`${label} must be non-empty without NUL`);
+  return value;
+}
+function absoluteHostPath(value, label) {
+  if (!isAbsolute(value)) throw new Error(`${label} must be an absolute host path`);
+  return resolve2(value);
+}
+function digest(value, label) {
+  if (!sha256Pattern.test(value)) throw new Error(`${label} is not a SHA-256 digest`);
+  return value;
+}
+function record(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function parseExactJson(bytes, label) {
+  try {
+    return JSON.parse(Buffer.from(bytes).toString("utf8"));
+  } catch (error) {
+    throw new Error(`${label} bytes are not UTF-8 JSON`, { cause: error });
+  }
+}
+function safeRelativePath(value, label) {
+  const parts = value.split("/");
+  if (!value || value.includes("\0") || value.includes("\\") || isAbsolute(value) || parts.some((part) => !part || part === "." || part === "..")) {
+    throw new Error(`${label} must be a canonical relative POSIX path`);
+  }
+  return value;
+}
+async function assertRealDirectory(path, label) {
+  const stats = await lstat(path);
+  if (!stats.isDirectory() || stats.isSymbolicLink()) {
+    throw new Error(`${label} must be a real directory`);
+  }
+  if (await realpath2(path) !== path) {
+    throw new Error(`${label} has a symlinked path component`);
+  }
+}
+async function materializeExecutorFiles(root, files, expected, label) {
+  const expectedByPath = new Map(expected.map((file) => [file.path, file]));
+  if (expectedByPath.size !== expected.length || files.length !== expected.length) {
+    throw new Error(`${label} file set differs from signed evidence`);
+  }
+  await mkdir2(root, { mode: 448 });
+  await assertRealDirectory(root, label);
+  for (const file of files) {
+    const relative = safeRelativePath(file.path, `${label} file path`);
+    const identity = expectedByPath.get(relative);
+    if (!identity) throw new Error(`${label} contains unsigned file ${relative}`);
+    if (file.mode !== identity.mode || sha256(file.bytes) !== identity.sha256 || identity.byteLength !== void 0 && file.bytes.byteLength !== identity.byteLength) {
+      throw new Error(`${label} file ${relative} differs from signed evidence`);
+    }
+    const target = join2(root, relative);
+    const parent = dirname(target);
+    if (parent !== root) await mkdir2(parent, { recursive: true, mode: 448 });
+    await writeFile(target, file.bytes, { flag: "wx", mode: 384 });
+    await chmod(target, file.mode);
+    const stats = await lstat(target);
+    if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink !== 1 || (stats.mode & 511) !== file.mode) {
+      throw new Error(`${label} file ${relative} is not a singly-linked regular file`);
+    }
+  }
+}
+function protectedEnvironment(prepared, request) {
+  const protectedEntries = [];
+  for (const [name, value] of Object.entries(request.launch.env)) {
+    const publicValue = prepared.launch.env[name];
+    if (publicValue === void 0) {
+      protectedEntries.push([name, value]);
+    } else if (publicValue !== value) {
+      throw new Error(`executor request changed signed public environment ${name}`);
+    }
+  }
+  for (const name of Object.keys(prepared.launch.env)) {
+    if (!(name in request.launch.env)) {
+      throw new Error(`executor request omitted signed public environment ${name}`);
+    }
+  }
+  return Object.freeze(Object.fromEntries(protectedEntries));
+}
+async function stagePreparedPierCandidateExecution(options, request) {
+  const { prepared } = options;
+  nonEmpty(options.pierVersion, "pierVersion");
+  const directory = absoluteHostPath(options.directory, "directory");
+  await mkdir2(directory, { mode: 448 });
+  await assertRealDirectory(directory, "directory");
+  if (request.memory.mode !== "disabled") {
+    throw new Error("Pier transport does not yet implement protected isolated memory");
+  }
+  const taskDirectory = join2(directory, "task");
+  const candidateDirectory = request.inputs.candidate ? join2(directory, "candidate") : void 0;
+  const profileDirectory = join2(directory, "profile");
+  await materializeExecutorFiles(
+    taskDirectory,
+    request.inputs.task.files,
+    request.inputs.task.snapshot.material.files,
+    "task executor input"
+  );
+  if (request.inputs.candidate && candidateDirectory) {
+    await materializeExecutorFiles(
+      candidateDirectory,
+      request.inputs.candidate.files,
+      request.inputs.candidate.snapshot.material.files,
+      "candidate executor input"
+    );
+  }
+  await materializeExecutorFiles(
+    profileDirectory,
+    request.profileActivation.files.map((file) => ({
+      path: file.path,
+      mode: file.mode,
+      bytes: Buffer.from(file.content, "utf8")
+    })),
+    request.profilePlan.value.material.files.map((file) => ({
+      path: file.relPath,
+      mode: file.mode,
+      sha256: file.contentSha256
+    })),
+    "profile executor input"
+  );
+  const planDigest = digest(request.executionPlan.value.digest, "execution plan digest");
+  if (sha256(request.executionPlan.bytes) !== planDigest) {
+    throw new Error("prepared execution-plan bytes do not match their runtime digest");
+  }
+  assert.deepEqual(
+    parseExactJson(request.executionPlan.bytes, "execution plan"),
+    request.executionPlan.value.material,
+    "prepared execution-plan bytes differ from runtime material"
+  );
+  const receiptDigest = digest(
+    request.materializationReceipt.digest,
+    "materialization receipt digest"
+  );
+  if (sha256(request.materializationReceipt.bytes) !== receiptDigest) {
+    throw new Error("prepared materialization-receipt bytes do not match their runtime digest");
+  }
+  const { digest: _receiptDigest, ...receiptMaterial } = request.materializationReceipt.value;
+  assert.deepEqual(
+    parseExactJson(request.materializationReceipt.bytes, "materialization receipt"),
+    receiptMaterial,
+    "prepared receipt bytes differ from runtime material"
+  );
+  const planPath = join2(directory, "execution-plan.json");
+  const receiptPath = join2(directory, "materialization-receipt.json");
+  await Promise.all([
+    writeFile(planPath, request.executionPlan.bytes, { mode: 384, flag: "wx" }),
+    writeFile(receiptPath, request.materializationReceipt.bytes, { mode: 384, flag: "wx" })
+  ]);
+  const agentArgs = [
+    "--agent-import-path",
+    adapterImportPath,
+    "--model",
+    nonEmpty(request.resolvedModel.requested, "resolved requested model"),
+    "--agent-kwarg",
+    `plan_path=${planPath}`,
+    "--agent-kwarg",
+    `receipt_path=${receiptPath}`,
+    "--agent-kwarg",
+    `expected_receipt_digest=${receiptDigest}`,
+    "--agent-kwarg",
+    `trace_run_id=${nonEmpty(request.trace.runId, "trace run id")}`,
+    "--agent-kwarg",
+    `task_dir=${taskDirectory}`,
+    "--agent-kwarg",
+    `profile_dir=${profileDirectory}`,
+    "--agent-kwarg",
+    `pier_version=${options.pierVersion}`
+  ];
+  if (candidateDirectory !== void 0) {
+    agentArgs.push("--agent-kwarg", `candidate_dir=${candidateDirectory}`);
+  }
+  return {
+    executionId: request.executionId,
+    directory,
+    taskDirectory,
+    ...candidateDirectory ? { candidateDirectory } : {},
+    profileDirectory,
+    planPath,
+    receiptPath,
+    agentArgs,
+    evaluatorEnv: protectedEnvironment(prepared, request),
+    attemptArgs: ["--n-attempts", "1", "--max-retries", "0"]
+  };
+}
+function exceptionType(value) {
+  const info = value && typeof value === "object" ? value : void 0;
+  for (const key of ["exception_type", "type", "name"]) {
+    if (typeof info?.[key] === "string") return info[key];
+  }
+  return void 0;
+}
+function protectedCaptureFromPierResult(request, value) {
+  const result = record(value, "Pier trial result");
+  const agentResult = record(result.agent_result, "Pier agent_result");
+  const metadata = record(agentResult.metadata, "Pier agent_result.metadata");
+  const expected = {
+    executionId: request.executionId,
+    bundleDigest: request.executionPlan.value.material.runCell.bundleDigest,
+    executionPlanDigest: request.executionPlan.value.digest,
+    materializationReceiptDigest: request.materializationReceipt.digest
+  };
+  for (const [name, identity] of Object.entries(expected)) {
+    if (metadata[name] !== identity) {
+      throw new Error(`Pier result ${name} does not match the prepared execution`);
+    }
+  }
+  const reported = record(metadata.termination, "Pier termination");
+  const type = exceptionType(result.exception_info);
+  if (type?.includes("AgentTimeout")) {
+    return {
+      executionId: request.executionId,
+      termination: {
+        kind: "timeout",
+        timeoutMs: request.hardLimits.timeoutMs
+      }
+    };
+  }
+  if (type?.includes("Cancelled") || reported.kind === "cancelled") {
+    return { executionId: request.executionId, termination: { kind: "cancelled" } };
+  }
+  if (reported.kind === "exit" && Number.isInteger(reported.exitCode)) {
+    return {
+      executionId: request.executionId,
+      termination: { kind: "exit", exitCode: reported.exitCode }
+    };
+  }
+  throw new Error(`Pier result has no recognized truthful termination${type ? ` (${type})` : ""}`);
+}
+function sealPierTrialResult(value) {
+  if (!(value.resultBytes instanceof Uint8Array) || !(value.taskPatch instanceof Uint8Array)) {
+    throw new Error("Pier trial result must contain raw result and patch bytes");
+  }
+  const parsed = parseExactJson(value.resultBytes, "Pier result.json");
+  assert.deepEqual(parsed, value.value, "Pier parsed result differs from result.json bytes");
+  const resultBytes = Uint8Array.from(value.resultBytes);
+  const taskPatch = Uint8Array.from(value.taskPatch);
+  return Object.freeze({
+    value: parsed,
+    get resultBytes() {
+      return Uint8Array.from(resultBytes);
+    },
+    get taskPatch() {
+      return Uint8Array.from(taskPatch);
+    }
+  });
+}
+function abortReason(signal) {
+  const reason = signal.reason;
+  if (reason instanceof Error) return reason;
+  return new Error(`Pier candidate execution aborted${reason ? `: ${String(reason)}` : ""}`);
+}
+function assertTerminationAcknowledged(acknowledgement) {
+  if (acknowledgement.processExited !== true || acknowledgement.containersRemoved !== true) {
+    throw new Error("Pier termination did not acknowledge process and container death");
+  }
+}
+async function awaitAbortableTrial(trial, signal) {
+  if (signal.aborted) {
+    assertTerminationAcknowledged(await trial.terminateAndWait());
+    throw abortReason(signal);
+  }
+  return await new Promise((resolveResult, reject) => {
+    let settled = false;
+    let aborting = false;
+    const settle = (callback) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      callback();
+    };
+    const onAbort = () => {
+      aborting = true;
+      void trial.terminateAndWait().then(
+        (acknowledgement) => {
+          try {
+            assertTerminationAcknowledged(acknowledgement);
+            settle(() => reject(abortReason(signal)));
+          } catch (error) {
+            settle(() => reject(error));
+          }
+        },
+        (error) => settle(() => reject(new Error("Pier termination failed", { cause: error })))
+      );
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    trial.result.then(
+      (result) => {
+        if (!aborting && !signal.aborted) settle(() => resolveResult(result));
+      },
+      (error) => {
+        if (!aborting && !signal.aborted) settle(() => reject(error));
+      }
+    );
+  });
+}
+async function executePreparedPierCandidate(options) {
+  const trials = /* @__PURE__ */ new Map();
+  const officialResults = /* @__PURE__ */ new Map();
+  const trialIdentity = (executionId, executionPlanDigest) => JSON.stringify([executionId, executionPlanDigest]);
+  const executor = {
+    execute: async (request, context) => {
+      context.signal.throwIfAborted();
+      const staged = await stagePreparedPierCandidateExecution(options, request);
+      context.signal.throwIfAborted();
+      const identity = trialIdentity(request.executionId, request.executionPlan.value.digest);
+      if (trials.has(identity)) throw new Error("Pier trial identity is already active");
+      const trial = options.controller.start(staged, {
+        request,
+        traceStore: context.traceStore,
+        signal: context.signal,
+        deadlineAtMs: context.deadlineAtMs
+      });
+      if (trial.identity.executionId !== request.executionId || trial.identity.executionPlanDigest !== request.executionPlan.value.digest) {
+        assertTerminationAcknowledged(await trial.terminateAndWait());
+        throw new Error("Pier controller returned a different durable trial identity");
+      }
+      const active = { handle: trial };
+      trials.set(identity, active);
+      const result = sealPierTrialResult(await awaitAbortableTrial(trial, context.signal));
+      active.result = result;
+      officialResults.set(request.executionId, result);
+      return protectedCaptureFromPierResult(request, result.value);
+    },
+    stop: async (request) => {
+      assertTerminationAcknowledged(
+        await options.controller.terminateAndWait({
+          executionId: request.executionId,
+          executionPlanDigest: request.executionPlanDigest
+        })
+      );
+      return { stopped: true };
+    },
+    capture: async (request) => {
+      const identity = trialIdentity(request.executionId, request.executionPlanDigest);
+      const active = trials.get(identity);
+      let result = active?.result;
+      if (!result && active) {
+        try {
+          result = sealPierTrialResult(await active.handle.result);
+        } catch {
+          result = void 0;
+        }
+      }
+      if (!result) {
+        const recovered = await options.controller.captureResult(request);
+        result = recovered ? sealPierTrialResult(recovered) : void 0;
+      }
+      if (!result) return {};
+      officialResults.set(request.executionId, result);
+      const task = options.prepared.benchmark.task;
+      const outcome = task.outcome;
+      if (outcome.kind !== "workspace") {
+        throw new Error("Pier candidate execution requires a workspace task outcome");
+      }
+      const repository = task.repository;
+      if (!repository) throw new Error("Pier workspace task is missing repository identity");
+      const taskOutcome = await capturePierTaskOutcome({
+        repositoryRoot: options.prepared.roots.staging.taskRoot,
+        baseCommit: repository.baseCommit,
+        baseTree: repository.baseTree,
+        patch: result.taskPatch
+      });
+      trials.delete(identity);
+      return { taskOutcome };
+    }
+  };
+  const grader = {
+    name: options.grader.name,
+    version: options.grader.version,
+    artifact: options.grader.artifact,
+    run: async (input) => {
+      const official = officialResults.get(input.executionId);
+      if (!official) throw new Error("Pier official result is missing for executable grading");
+      return await options.grader.run({
+        ...input,
+        officialResult: {
+          value: parseExactJson(official.resultBytes, "Pier result.json"),
+          bytes: Uint8Array.from(official.resultBytes)
+        }
+      });
+    }
+  };
+  try {
+    return await executePreparedAgentCandidate(options.prepared, {
+      executor,
+      grader,
+      outputArtifacts: options.outputArtifacts,
+      traceStore: options.traceStore,
+      claimStore: options.claimStore
+    });
+  } finally {
+    officialResults.clear();
+    trials.clear();
+  }
+}
+
+// src/pier-trial-controller.ts
+import { execFileSync, spawn as spawn2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import {
+  accessSync,
+  closeSync,
+  constants,
+  existsSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  openSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { isAbsolute as isAbsolute2, join as join3, resolve as resolve3 } from "path";
+import { fileURLToPath } from "url";
+var identityFile = "identity.json";
+var terminalFile = "terminal.json";
+var stopFile = "stop-requested";
+var sha256Pattern2 = /^sha256:[a-f0-9]{64}$/;
+var defaultDockerConnectionId = "local-default";
+function nonEmpty2(value, label) {
+  if (!value || value.includes("\0")) throw new Error(`${label} must be non-empty without NUL`);
+  return value;
+}
+function stableDockerConnectionId(value) {
+  if (!/^[A-Za-z0-9._:-]{1,200}$/.test(value)) {
+    throw new Error("Docker connection id must be a non-secret stable name");
+  }
+  return value;
+}
+function absolutePath(value, label) {
+  if (!isAbsolute2(value)) throw new Error(`${label} must be an absolute path`);
+  return resolve3(value);
+}
+function validateEnvironment(environment, label) {
+  for (const [name, value] of Object.entries(environment)) {
+    if (!name || name.includes("\0") || value?.includes("\0")) {
+      throw new Error(`${label} contains an invalid name or value`);
+    }
+  }
+}
+function resolveExecutable(command, searchPath, label) {
+  nonEmpty2(command, label);
+  const candidates = command.includes("/") ? [absolutePath(command, label)] : (searchPath ?? "").split(":").filter(Boolean).map((directory) => join3(directory, command));
+  for (const candidate of candidates) {
+    try {
+      accessSync(candidate, constants.X_OK);
+      return realpathSync(candidate);
+    } catch (error) {
+      if (error.code !== "ENOENT" && error.code !== "EACCES") {
+        throw error;
+      }
+    }
+  }
+  throw new Error(`${label} is not executable on the evaluator PATH`);
+}
+function syncDirectory(directory) {
+  const fd = openSync(directory, "r");
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+function writeJsonAtomic(directory, name, value) {
+  const target = join3(directory, name);
+  const temporary = join3(directory, `.${name}.${process.pid}.${Date.now()}.tmp`);
+  const fd = openSync(temporary, "wx", 384);
+  try {
+    writeFileSync2(fd, `${JSON.stringify(value)}
+`, "utf8");
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(temporary, target);
+  syncDirectory(directory);
+}
+function touchDurable(directory, name) {
+  try {
+    const fd = openSync(join3(directory, name), "wx", 384);
+    try {
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    syncDirectory(directory);
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+}
+function readJson(path, label) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    throw new Error(`${label} is not valid JSON`, { cause: error });
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function parseProcessIdentity(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  const record2 = value;
+  if (!Number.isSafeInteger(record2.pid) || !Number.isSafeInteger(record2.processGroupId) || !Number.isSafeInteger(record2.sessionId) || typeof record2.startTicks !== "string" || !/^\d+$/.test(record2.startTicks)) {
+    throw new Error(`${label} is malformed`);
+  }
+  return {
+    pid: record2.pid,
+    processGroupId: record2.processGroupId,
+    sessionId: record2.sessionId,
+    startTicks: record2.startTicks
+  };
+}
+function parsePersistedIdentity(path) {
+  const record2 = readJson(path, "Pier trial identity");
+  if (record2.schemaVersion !== 1 || record2.kind !== "pier-trial-identity" || !["allocating", "starting", "running"].includes(record2.state) || typeof record2.executionId !== "string" || typeof record2.executionPlanDigest !== "string" || !sha256Pattern2.test(record2.executionPlanDigest) || typeof record2.jobsDirectory !== "string" || typeof record2.jobName !== "string" || typeof record2.dockerCommand !== "string" || typeof record2.dockerConnectionId !== "string") {
+    throw new Error("Pier trial identity is malformed");
+  }
+  return {
+    schemaVersion: 1,
+    kind: "pier-trial-identity",
+    state: record2.state,
+    executionId: record2.executionId,
+    executionPlanDigest: record2.executionPlanDigest,
+    ...record2.supervisor ? { supervisor: parseProcessIdentity(record2.supervisor, "Pier supervisor identity") } : {},
+    ...record2.pier ? { pier: parseProcessIdentity(record2.pier, "Pier process identity") } : {},
+    jobsDirectory: absolutePath(record2.jobsDirectory, "persisted jobs directory"),
+    jobName: nonEmpty2(record2.jobName, "persisted job name"),
+    dockerCommand: nonEmpty2(record2.dockerCommand, "persisted Docker command"),
+    dockerConnectionId: stableDockerConnectionId(record2.dockerConnectionId)
+  };
+}
+function parseTerminal(path) {
+  const record2 = readJson(path, "Pier trial terminal");
+  const allowedKeys = /* @__PURE__ */ new Set([
+    "schemaVersion",
+    "kind",
+    "status",
+    "processExited",
+    "containersRemoved",
+    "removedContainers",
+    "exitCode",
+    "signal",
+    "error",
+    "recoveredByPid"
+  ]);
+  const hasMalformedOptionalField = record2.removedContainers !== void 0 && (!Number.isSafeInteger(record2.removedContainers) || record2.removedContainers < 0) || record2.exitCode !== void 0 && record2.exitCode !== null && !Number.isSafeInteger(record2.exitCode) || record2.signal !== void 0 && record2.signal !== null && (typeof record2.signal !== "string" || !/^SIG[A-Z0-9]+$/.test(record2.signal)) || record2.error !== void 0 && typeof record2.error !== "string" || record2.recoveredByPid !== void 0 && (!Number.isSafeInteger(record2.recoveredByPid) || record2.recoveredByPid < 1);
+  if (Object.keys(record2).some((key) => !allowedKeys.has(key)) || record2.schemaVersion !== 1 || record2.kind !== "pier-trial-terminal" || !["completed", "stopped", "failed"].includes(record2.status) || typeof record2.processExited !== "boolean" || typeof record2.containersRemoved !== "boolean" || hasMalformedOptionalField) {
+    throw new Error("Pier trial terminal is malformed");
+  }
+  return {
+    schemaVersion: 1,
+    kind: "pier-trial-terminal",
+    status: record2.status,
+    processExited: record2.processExited,
+    containersRemoved: record2.containersRemoved,
+    ...record2.removedContainers !== void 0 ? { removedContainers: record2.removedContainers } : {},
+    ...record2.exitCode !== void 0 ? { exitCode: record2.exitCode } : {},
+    ...record2.signal !== void 0 ? { signal: record2.signal } : {},
+    ...record2.error !== void 0 ? { error: record2.error } : {},
+    ...record2.recoveredByPid !== void 0 ? { recoveredByPid: record2.recoveredByPid } : {}
+  };
+}
+function processIdentity(pid) {
+  const text = readFileSync(`/proc/${pid}/stat`, "utf8");
+  const closing = text.lastIndexOf(")");
+  if (closing < 0) throw new Error(`cannot parse process identity for ${pid}`);
+  const fields = text.slice(closing + 2).trim().split(/\s+/);
+  const processGroupId = Number(fields[2]);
+  const sessionId = Number(fields[3]);
+  const startTicks = fields[19];
+  if (!Number.isSafeInteger(processGroupId) || !Number.isSafeInteger(sessionId) || !/^\d+$/.test(startTicks ?? "")) {
+    throw new Error(`cannot parse process identity for ${pid}`);
+  }
+  return { pid, processGroupId, sessionId, startTicks };
+}
+function processMatches(identity) {
+  try {
+    const current = processIdentity(identity.pid);
+    return current.startTicks === identity.startTicks && current.processGroupId === identity.processGroupId && current.sessionId === identity.sessionId;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+function signalProcess(identity, signal, group) {
+  if (!processMatches(identity)) return;
+  try {
+    process.kill(group ? -identity.processGroupId : identity.pid, signal);
+  } catch (error) {
+    if (error.code !== "ESRCH") throw error;
+  }
+}
+function sessionMembers(sessionId) {
+  const members = [];
+  for (const entry of readdirSync("/proc", { withFileTypes: true })) {
+    if (!entry.isDirectory() || !/^\d+$/.test(entry.name)) continue;
+    try {
+      const identity = processIdentity(Number(entry.name));
+      if (identity.sessionId === sessionId) members.push(identity);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  return members;
+}
+async function signalSessionUntilEmpty(identity, signal, timeoutMs, intervalMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (true) {
+    const members = sessionMembers(identity.sessionId);
+    if (members.length === 0) return true;
+    for (const member of members) signalProcess(member, signal, false);
+    if (Date.now() >= deadline) return false;
+    await sleep(intervalMs);
+  }
+}
+function sanitizeProject(value) {
+  let project = value.toLowerCase();
+  if (!/^[a-z0-9]/.test(project)) project = `0${project}`;
+  return project.replace(/[^a-z0-9_-]/g, "-");
+}
+function trialProjects(identity) {
+  const jobRoot = join3(identity.jobsDirectory, identity.jobName);
+  if (!existsSync(jobRoot)) return [];
+  return readdirSync(jobRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink()).map((entry) => sanitizeProject(entry.name));
+}
+function matchingContainers(identity, dockerEnvironment) {
+  const projects = trialProjects(identity);
+  if (projects.length === 0) return [];
+  const output = execFileSync(
+    identity.dockerCommand,
+    ["ps", "-a", "--format", '{{.ID}}	{{.Label "com.docker.compose.project"}}'],
+    {
+      encoding: "utf8",
+      env: dockerEnvironment,
+      timeout: 3e4,
+      maxBuffer: 4 * 1024 * 1024
+    }
+  );
+  return output.split("\n").filter(Boolean).flatMap((line) => {
+    const tab = line.indexOf("	");
+    if (tab < 1) return [];
+    const id = line.slice(0, tab);
+    const project = line.slice(tab + 1);
+    return projects.some(
+      (expected) => project === expected || project.startsWith(`${expected}__verifier__`)
+    ) ? [id] : [];
+  });
+}
+function removeTrialContainers(identity, dockerEnvironment) {
+  const containers = matchingContainers(identity, dockerEnvironment);
+  if (containers.length > 0) {
+    try {
+      execFileSync(identity.dockerCommand, ["rm", "-f", ...containers], {
+        encoding: "utf8",
+        env: dockerEnvironment,
+        timeout: 3e4,
+        maxBuffer: 4 * 1024 * 1024
+      });
+    } catch (error) {
+      if (matchingContainers(identity, dockerEnvironment).length > 0) throw error;
+    }
+  }
+  const remaining = matchingContainers(identity, dockerEnvironment);
+  if (remaining.length > 0) {
+    throw new Error(`Pier task containers survived removal: ${remaining.join(", ")}`);
+  }
+  return containers.length;
+}
+function sleep(milliseconds) {
+  return new Promise((resolveSleep) => setTimeout(resolveSleep, milliseconds));
+}
+async function waitUntil(predicate, timeoutMs, intervalMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (!predicate()) {
+    if (Date.now() >= deadline) return false;
+    await sleep(intervalMs);
+  }
+  return true;
+}
+function trialKey(identity) {
+  if (!sha256Pattern2.test(identity.executionPlanDigest)) {
+    throw new Error("executionPlanDigest must be a SHA-256 digest");
+  }
+  return createHash2("sha256").update(JSON.stringify([nonEmpty2(identity.executionId, "executionId"), identity.executionPlanDigest])).digest("hex");
+}
+function assertRealDirectory2(path, label) {
+  const stats = lstatSync(path);
+  if (!stats.isDirectory() || stats.isSymbolicLink() || realpathSync(path) !== path) {
+    throw new Error(`${label} must be a real canonical directory`);
+  }
+}
+var FilePierCandidateTrialController = class {
+  directory;
+  launch;
+  readResult;
+  dockerConnection;
+  supervisorPath;
+  pollIntervalMs;
+  constructor(options) {
+    this.directory = absolutePath(options.directory, "Pier controller directory");
+    this.launch = options.launch;
+    this.readResult = options.readResult;
+    const configuredDocker = options.dockerConnection;
+    if (configuredDocker?.id === defaultDockerConnectionId) {
+      throw new Error(`${defaultDockerConnectionId} is reserved for the implicit local connection`);
+    }
+    const dockerConnection = configuredDocker ?? {
+      id: defaultDockerConnectionId,
+      env: {}
+    };
+    const connectionId = stableDockerConnectionId(dockerConnection.id);
+    validateEnvironment(dockerConnection.env, "Docker connection environment");
+    this.dockerConnection = Object.freeze({
+      id: connectionId,
+      env: Object.freeze({ ...dockerConnection.env })
+    });
+    this.supervisorPath = absolutePath(
+      options.supervisorPath ?? fileURLToPath(new URL("./pier-trial-supervisor.mjs", import.meta.url)),
+      "Pier supervisor path"
+    );
+    this.pollIntervalMs = options.pollIntervalMs ?? 25;
+    if (!Number.isSafeInteger(this.pollIntervalMs) || this.pollIntervalMs < 1) {
+      throw new Error("pollIntervalMs must be a positive integer");
+    }
+    mkdirSync2(this.directory, { recursive: true, mode: 448 });
+    assertRealDirectory2(this.directory, "Pier controller directory");
+  }
+  start(staged, context) {
+    if (!this.launch) throw new Error("this Pier controller is recovery-only");
+    const identity = {
+      executionId: context.request.executionId,
+      executionPlanDigest: context.request.executionPlan.value.digest
+    };
+    if (staged.executionId !== identity.executionId) {
+      throw new Error("staged Pier execution does not match the runtime request");
+    }
+    const spec = this.launch(staged, context);
+    this.validateSpec(spec);
+    for (const [name, value] of Object.entries(this.dockerConnection.env)) {
+      if (Object.prototype.hasOwnProperty.call(spec.env, name) && spec.env[name] !== value) {
+        throw new Error(`Pier child environment conflicts with Docker connection variable ${name}`);
+      }
+    }
+    const pierEnvironment = Object.freeze({
+      ...spec.env,
+      ...this.dockerConnection.env
+    });
+    mkdirSync2(spec.jobsDirectory, { recursive: true, mode: 448 });
+    assertRealDirectory2(spec.jobsDirectory, "Pier jobs directory");
+    const dockerCommand = resolveExecutable(
+      spec.dockerCommand ?? "docker",
+      process.env.PATH,
+      "Docker command"
+    );
+    const pierCommand = resolveExecutable(spec.command, pierEnvironment.PATH, "Pier command");
+    const controlDirectory = this.controlDirectory(identity);
+    try {
+      mkdirSync2(controlDirectory, { mode: 448 });
+    } catch (error) {
+      if (error.code === "EEXIST") {
+        throw new Error("Pier trial identity already has durable control state");
+      }
+      throw error;
+    }
+    assertRealDirectory2(controlDirectory, "Pier trial control directory");
+    const jobRoot = join3(spec.jobsDirectory, spec.jobName);
+    let jobRootCreated = false;
+    try {
+      mkdirSync2(jobRoot, { mode: 448 });
+      jobRootCreated = true;
+      assertRealDirectory2(jobRoot, "Pier job directory");
+    } catch (error) {
+      rmSync(controlDirectory, { recursive: true, force: true });
+      if (jobRootCreated) rmSync(jobRoot, { recursive: true, force: true });
+      if (error.code === "EEXIST") {
+        throw new Error("Pier job name must be unique; its job directory already exists");
+      }
+      throw error;
+    }
+    const allocating = {
+      schemaVersion: 1,
+      kind: "pier-trial-identity",
+      state: "allocating",
+      ...identity,
+      jobsDirectory: absolutePath(spec.jobsDirectory, "Pier jobs directory"),
+      jobName: nonEmpty2(spec.jobName, "Pier job name"),
+      dockerCommand: nonEmpty2(dockerCommand, "Docker command"),
+      dockerConnectionId: this.dockerConnection.id
+    };
+    try {
+      writeJsonAtomic(controlDirectory, identityFile, allocating);
+    } catch (error) {
+      rmSync(controlDirectory, { recursive: true, force: true });
+      rmSync(jobRoot, { recursive: true, force: true });
+      throw error;
+    }
+    const supervisor = spawn2(process.execPath, [this.supervisorPath, controlDirectory], {
+      detached: true,
+      // Launch data arrives over fd 3. The trusted supervisor receives only
+      // explicitly declared process variables, never the evaluator environment.
+      env: { ...this.dockerConnection.env },
+      stdio: ["ignore", "ignore", "ignore", "pipe"]
+    });
+    if (supervisor.pid === void 0) throw new Error("Pier supervisor started without a pid");
+    const controlPipe = supervisor.stdio[3];
+    let supervisorIdentity;
+    try {
+      supervisorIdentity = processIdentity(supervisor.pid);
+      const persisted = {
+        ...allocating,
+        state: "starting",
+        supervisor: supervisorIdentity
+      };
+      writeJsonAtomic(controlDirectory, identityFile, persisted);
+      if (!controlPipe) throw new Error("Pier supervisor has no protected control pipe");
+      controlPipe.on("error", () => void 0);
+      controlPipe.end(
+        JSON.stringify({
+          command: pierCommand,
+          args: spec.args,
+          cwd: spec.cwd,
+          env: pierEnvironment,
+          jobsDirectory: spec.jobsDirectory,
+          jobName: spec.jobName,
+          dockerCommand
+        })
+      );
+    } catch (error) {
+      controlPipe?.destroy();
+      if (supervisorIdentity) signalProcess(supervisorIdentity, "SIGKILL", false);
+      else {
+        try {
+          process.kill(supervisor.pid, "SIGKILL");
+        } catch (killError) {
+          if (killError.code !== "ESRCH") throw killError;
+        }
+      }
+      throw error;
+    }
+    supervisor.unref();
+    controlPipe.unref?.();
+    const result = this.waitForResult(controlDirectory, spec, context.deadlineAtMs);
+    return {
+      identity,
+      result,
+      terminateAndWait: async () => await this.terminateAndWait(identity)
+    };
+  }
+  async terminateAndWait(requested) {
+    const controlDirectory = this.controlDirectory(requested);
+    assertRealDirectory2(controlDirectory, "Pier trial control directory");
+    const persisted = parsePersistedIdentity(join3(controlDirectory, identityFile));
+    if (persisted.executionId !== requested.executionId || persisted.executionPlanDigest !== requested.executionPlanDigest) {
+      throw new Error("persisted Pier trial identity differs from the stop request");
+    }
+    this.assertDockerConnection(persisted);
+    touchDurable(controlDirectory, stopFile);
+    if (!existsSync(join3(controlDirectory, terminalFile))) {
+      if (persisted.supervisor) signalProcess(persisted.supervisor, "SIGTERM", false);
+    }
+    const terminalAppeared = await waitUntil(
+      () => existsSync(join3(controlDirectory, terminalFile)),
+      persisted.supervisor ? 1e4 : 1,
+      this.pollIntervalMs
+    );
+    if (!terminalAppeared) await this.forceRecovery(controlDirectory);
+    let terminal = parseTerminal(join3(controlDirectory, terminalFile));
+    const latest = parsePersistedIdentity(join3(controlDirectory, identityFile));
+    const liveProcesses = latest.pier ? sessionMembers(latest.pier.sessionId).length : 0;
+    this.assertDockerConnection(latest);
+    const liveContainers = matchingContainers(latest, this.dockerConnection.env).length;
+    if (liveProcesses > 0 || liveContainers > 0) {
+      await this.forceRecovery(controlDirectory);
+      terminal = parseTerminal(join3(controlDirectory, terminalFile));
+    }
+    if (!terminal.processExited || !terminal.containersRemoved) {
+      throw new Error(
+        `Pier recovery did not prove process/container death${terminal.error ? `: ${terminal.error}` : ""}`
+      );
+    }
+    return { processExited: true, containersRemoved: true };
+  }
+  async captureResult(requested) {
+    const controlDirectory = this.controlDirectory(requested);
+    assertRealDirectory2(controlDirectory, "Pier trial control directory");
+    const persisted = parsePersistedIdentity(join3(controlDirectory, identityFile));
+    if (persisted.executionId !== requested.executionId || persisted.executionPlanDigest !== requested.executionPlanDigest) {
+      throw new Error("persisted Pier trial identity differs from the capture request");
+    }
+    this.assertDockerConnection(persisted);
+    const terminal = parseTerminal(join3(controlDirectory, terminalFile));
+    if (!terminal.processExited || !terminal.containersRemoved) {
+      throw new Error("Pier result capture requires proven process and container death");
+    }
+    if (!this.readResult) {
+      throw new Error("Pier result capture has no restart-safe result reader");
+    }
+    return await this.readResult({
+      jobsDirectory: persisted.jobsDirectory,
+      jobName: persisted.jobName
+    });
+  }
+  controlDirectory(identity) {
+    return join3(this.directory, trialKey(identity));
+  }
+  assertDockerConnection(identity) {
+    if (identity.dockerConnectionId !== this.dockerConnection.id) {
+      throw new Error(
+        `Pier trial requires Docker connection ${identity.dockerConnectionId}; configured ${this.dockerConnection.id}`
+      );
+    }
+  }
+  validateSpec(spec) {
+    nonEmpty2(spec.command, "Pier command");
+    if (!Array.isArray(spec.args) || spec.args.some((arg) => typeof arg !== "string" || arg.includes("\0"))) {
+      throw new Error("Pier arguments must be strings without NUL");
+    }
+    absolutePath(spec.cwd, "Pier cwd");
+    absolutePath(spec.jobsDirectory, "Pier jobs directory");
+    if (!/^[A-Za-z0-9._-]{1,200}$/.test(spec.jobName)) {
+      throw new Error("Pier job name must be filesystem-neutral");
+    }
+    validateEnvironment(spec.env, "Pier child environment");
+  }
+  async waitForResult(controlDirectory, spec, deadlineAtMs) {
+    const waitMs = Math.max(0, deadlineAtMs - Date.now());
+    const appeared = await waitUntil(
+      () => existsSync(join3(controlDirectory, terminalFile)),
+      waitMs,
+      this.pollIntervalMs
+    );
+    if (!appeared) throw new Error("Pier supervisor emitted no terminal acknowledgement");
+    const terminal = parseTerminal(join3(controlDirectory, terminalFile));
+    if (!terminal.processExited || !terminal.containersRemoved) {
+      throw new Error("Pier supervisor did not prove process and container death");
+    }
+    if (terminal.status !== "completed") {
+      throw new Error(terminal.error ? `Pier process failed: ${terminal.error}` : "Pier process stopped");
+    }
+    return await spec.readResult();
+  }
+  async forceRecovery(controlDirectory) {
+    const latest = parsePersistedIdentity(join3(controlDirectory, identityFile));
+    this.assertDockerConnection(latest);
+    const errors = [];
+    if (latest.pier) {
+      try {
+        await signalSessionUntilEmpty(latest.pier, "SIGTERM", 2e3, this.pollIntervalMs);
+      } catch (error) {
+        errors.push(`could not signal Pier session: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+    if (latest.supervisor) {
+      try {
+        signalProcess(latest.supervisor, "SIGKILL", false);
+        if (!await waitUntil(() => !processMatches(latest.supervisor), 5e3, this.pollIntervalMs)) {
+          errors.push(`Pier supervisor ${latest.supervisor.pid} survived SIGKILL`);
+        }
+      } catch (error) {
+        errors.push(`could not kill Pier supervisor: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+    if (latest.pier) {
+      try {
+        if (!await signalSessionUntilEmpty(
+          latest.pier,
+          "SIGKILL",
+          5e3,
+          this.pollIntervalMs
+        )) {
+          errors.push(`Pier process session ${latest.pier.sessionId} survived SIGKILL`);
+        }
+      } catch (error) {
+        errors.push(`could not kill Pier session: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+    let removedContainers = 0;
+    try {
+      removedContainers = removeTrialContainers(latest, this.dockerConnection.env);
+    } catch (error) {
+      errors.push(`could not remove Pier containers: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (errors.length > 0) {
+      throw new Error(`Pier recovery incomplete: ${errors.join("; ")}`);
+    }
+    writeJsonAtomic(controlDirectory, terminalFile, {
+      schemaVersion: 1,
+      kind: "pier-trial-terminal",
+      status: "stopped",
+      processExited: true,
+      containersRemoved: true,
+      removedContainers,
+      recoveredByPid: process.pid
+    });
+  }
+};
+
+// src/pier-result-grader.ts
+import { spawn as spawn3 } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import { chmod as chmod2, mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join4 } from "path";
+var sha2562 = (bytes) => `sha256:${createHash3("sha256").update(bytes).digest("hex")}`;
+function createPierResultGrader(descriptor) {
+  return {
+    ...descriptor,
+    run: async (input) => {
+      input.signal.throwIfAborted();
+      const implementation = Uint8Array.from(input.implementation.bytes);
+      if (implementation.byteLength !== input.implementation.byteLength) {
+        throw new Error("Pier grader implementation length changed before execution");
+      }
+      const evidence = Uint8Array.from(input.officialResult.bytes);
+      const evaluation = await executeGrader(implementation, evidence, input.signal);
+      input.signal.throwIfAborted();
+      return {
+        evaluation,
+        evidence,
+        binding: {
+          implementationDigest: sha2562(implementation),
+          taskOutcomeDigest: input.outcome.evidence.digest,
+          outputDigest: sha2562(evidence)
+        }
+      };
+    }
+  };
+}
+async function executeGrader(implementation, resultBytes, signal) {
+  const directory = await mkdtemp2(join4(tmpdir2(), "pier-result-grader-"));
+  const script = join4(directory, "grader.mjs");
+  try {
+    await writeFile2(script, implementation, { flag: "wx", mode: 384 });
+    await chmod2(script, 320);
+    const stdout = await runNode(script, resultBytes, signal);
+    const parsed = JSON.parse(stdout.toString("utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("Pier result grader returned a non-object evaluation");
+    }
+    return parsed;
+  } finally {
+    await rm2(directory, { recursive: true, force: true });
+  }
+}
+async function runNode(script, input, signal) {
+  signal.throwIfAborted();
+  return await new Promise((resolveResult, reject) => {
+    const child = spawn3(process.execPath, ["--no-warnings", script], {
+      env: {
+        PATH: process.env.PATH,
+        HOME: process.env.HOME,
+        LANG: "C",
+        LC_ALL: "C"
+      },
+      stdio: ["pipe", "pipe", "pipe"],
+      signal
+    });
+    const stdout = [];
+    const stderr = [];
+    let bytes = 0;
+    const collect = (target) => (chunk) => {
+      bytes += chunk.byteLength;
+      if (bytes > 1024 * 1024) {
+        child.kill("SIGKILL");
+        reject(new Error("Pier result grader exceeded its output limit"));
+        return;
+      }
+      target.push(Buffer.from(chunk));
+    };
+    child.stdout.on("data", collect(stdout));
+    child.stderr.on("data", collect(stderr));
+    child.once("error", reject);
+    child.once("close", (code, childSignal) => {
+      if (code !== 0) {
+        reject(
+          new Error(
+            `Pier result grader failed (${childSignal ?? code}): ${Buffer.concat(stderr).toString("utf8").trim()}`
+          )
+        );
+        return;
+      }
+      resolveResult(Buffer.concat(stdout));
+    });
+    child.stdin.end(input);
+  });
+}
+export {
+  ADAPTERS,
+  FINAL_ANSWER_SENTINEL,
+  FilePierCandidateTrialController,
+  StagedJudgeError,
+  answerScoreToBenchScore,
+  contextBlock,
+  contextsFrom,
+  createCragAdapter,
+  createNoMiraclAdapter,
+  createOpenRagBenchAdapter,
+  createPierCandidateRecoveryExecutor,
+  createPierResultGrader,
+  createRagBenchAdapter,
+  createSweBenchAdapter,
+  createT2RagBenchAdapter,
+  executePreparedPierCandidate,
+  normalizeAnswer,
+  parseCitations,
+  parseFinalAnswer,
+  printBenchmarksReport,
+  ragAnswerOutput,
+  resolveAdapter,
+  runBenchmarks,
+  runStagedJudge,
+  scoreAnswerArtifact,
+  scoreSweReport,
+  sweEvaluationArgv,
+  swePatchOutput,
+  tokenF1
+};
+//# sourceMappingURL=index.js.map