@tangle-network/agent-bench 0.4.1 → 0.4.3

package/dist/index.js

@@ -1,1908 +1,1786 @@
-import {
-  ADAPTERS,
-  resolveAdapter
-} from "./chunk-EEOC6QPJ.js";
-import "./chunk-CWIOBFSP.js";
-import "./chunk-VQRS7VUC.js";
-import "./chunk-XXFF3RRD.js";
-import {
-  createRagBenchAdapter
-} from "./chunk-HQ5HCCKF.js";
-import "./chunk-SEVJPLZC.js";
-import {
-  createSweBenchAdapter,
-  scoreSweReport,
-  sweEvaluationArgv,
-  swePatchOutput
-} from "./chunk-J6BU3NTM.js";
-import {
-  createT2RagBenchAdapter
-} from "./chunk-GC2EPS6L.js";
-import "./chunk-WG7TM7UV.js";
-import "./chunk-ZFNOM7WR.js";
-import "./chunk-GCHL6XPM.js";
-import "./chunk-JSQOUKXS.js";
-import "./chunk-INNOYXCP.js";
-import "./chunk-PA2ZKHJC.js";
-import "./chunk-5H5XV76F.js";
-import "./chunk-TBKU5XQI.js";
-import {
-  createNoMiraclAdapter
-} from "./chunk-7FKBWOQT.js";
-import {
-  createOpenRagBenchAdapter
-} from "./chunk-BZY5QARD.js";
-import "./chunk-QZZEAHWJ.js";
-import "./chunk-PUIRNYI7.js";
-import "./chunk-C7T7WEK2.js";
-import {
-  runRefineLoop
-} from "./chunk-JTHWEDEW.js";
-import "./chunk-ZNCCYTFG.js";
-import {
-  createCragAdapter
-} from "./chunk-NRMGT25X.js";
-import {
-  FINAL_ANSWER_SENTINEL,
-  answerScoreToBenchScore,
-  contextBlock,
-  contextsFrom,
-  normalizeAnswer,
-  parseCitations,
-  parseFinalAnswer,
-  ragAnswerOutput,
-  scoreAnswerArtifact,
-  tokenF1
-} from "./chunk-X3BTXCJ4.js";
-import "./chunk-DWALFME7.js";
-import "./chunk-5FEQDSCT.js";
-import "./chunk-HVW25KSX.js";
-import "./chunk-UPAMRDX4.js";
-import "./chunk-BEN6IF2X.js";
-import "./chunk-67ACKDCX.js";
-import "./chunk-CXDUTWQE.js";
-import "./chunk-CLIKAXKH.js";
-import {
-  StagedJudgeError,
-  runStagedJudge
-} from "./chunk-EIETHPD5.js";
-import "./chunk-53UPUNBZ.js";
-
-// src/run-benchmarks.ts
-import { mkdirSync, writeFileSync } from "fs";
-import { openSandboxRun } from "@tangle-network/agent-runtime/loops";
-
-// src/resolve-client.ts
-import {
-  createExecutor,
-  inlineSandboxClient,
-  resolveSandboxClient
-} from "@tangle-network/agent-runtime/loops";
+import { StagedJudgeError, runStagedJudge } from "./benchmarks/_harness.js";
+import { FINAL_ANSWER_SENTINEL, answerScoreToBenchScore, contextBlock, contextsFrom, normalizeAnswer, parseCitations, parseFinalAnswer, ragAnswerOutput, scoreAnswerArtifact, tokenF1 } from "./benchmarks/rag-shared.js";
+import { createCragAdapter } from "./benchmarks/crag.js";
+import { createNoMiraclAdapter } from "./benchmarks/nomiracl.js";
+import { createOpenRagBenchAdapter } from "./benchmarks/open-rag-bench.js";
+import { createRagBenchAdapter } from "./benchmarks/ragbench.js";
+import { createSweBenchAdapter, scoreSweReport, sweEvaluationArgv, swePatchOutput } from "./benchmarks/swe-bench.js";
+import { createT2RagBenchAdapter } from "./benchmarks/t2-ragbench.js";
+import { ADAPTERS, resolveAdapter } from "./adapters.js";
+import { chmod, lstat, mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { execFileSync, spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { accessSync, closeSync, constants, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { createExecutor, inlineSandboxClient, openSandboxRun, resolveSandboxClient } from "@tangle-network/agent-runtime/loops";
 import { Sandbox } from "@tangle-network/sandbox";
-
-// src/search-tool.ts
-var webSearchTool = {
-  type: "function",
-  function: {
-    name: "web_search",
-    description: "Search the live web for current facts, market data, filings, and news. Returns the top results as title, date, snippet, and URL. Call it as many times as needed, refining the query, before you answer.",
-    parameters: {
-      type: "object",
-      properties: {
-        query: {
-          type: "string",
-          description: "The search query. Be specific \u2014 include entity, metric, period, and units."
-        }
-      },
-      required: ["query"]
-    }
-  }
+import assert from "node:assert/strict";
+import { executePreparedAgentCandidate } from "@tangle-network/agent-runtime";
+import { canonicalJson } from "@tangle-network/agent-eval";
+import { captureAgentCandidateWorkspaceFiles } from "@tangle-network/agent-runtime/candidate-execution";
+//#region src/refine-loop.ts
+const defaultDecide = (history) => history[history.length - 1]?.verdict?.valid === true;
+async function runRefineLoop(spec) {
+	const rounds = Math.max(1, spec.rounds);
+	const decide = spec.decide ?? defaultDecide;
+	let ctxSet = false;
+	let ctx = void 0;
+	try {
+		if (spec.setup) {
+			ctx = await spec.setup();
+			ctxSet = true;
+		}
+		const history = [];
+		for (let r = 1; r <= rounds; r += 1) {
+			const prompt = spec.prompt(r, history, ctx);
+			const { artifact, note } = await spec.runShot(prompt, r, ctx);
+			const verdict = spec.judge ? await spec.judge(artifact, r) : void 0;
+			history.push({
+				round: r,
+				prompt,
+				artifact,
+				verdict,
+				note
+			});
+			if (decide(history)) break;
+		}
+		return {
+			rounds: history,
+			blind: history[0],
+			final: history[history.length - 1],
+			resolved: history.some((h) => h.verdict?.valid === true)
+		};
+	} finally {
+		if (ctxSet && spec.teardown) await spec.teardown(ctx);
+	}
+}
+//#endregion
+//#region src/search-tool.ts
+const webSearchTool = {
+	type: "function",
+	function: {
+		name: "web_search",
+		description: "Search the live web for current facts, market data, filings, and news. Returns the top results as title, date, snippet, and URL. Call it as many times as needed, refining the query, before you answer.",
+		parameters: {
+			type: "object",
+			properties: { query: {
+				type: "string",
+				description: "The search query. Be specific — include entity, metric, period, and units."
+			} },
+			required: ["query"]
+		}
+	}
 };
-var formatHits = (hits, maxHits) => {
-  if (hits.length === 0) return "No results found for that query. Try a different query.";
-  return hits.slice(0, maxHits).map((h, i) => {
-    const date = h.publishedAt ? ` (${h.publishedAt.slice(0, 10)})` : "";
-    return `[${i + 1}] ${h.title ?? "(untitled)"}${date}
-${h.snippet ?? ""}
-${h.url ?? ""}`;
-  }).join("\n\n");
+const formatHits = (hits, maxHits) => {
+	if (hits.length === 0) return "No results found for that query. Try a different query.";
+	return hits.slice(0, maxHits).map((h, i) => {
+		const date = h.publishedAt ? ` (${h.publishedAt.slice(0, 10)})` : "";
+		return `[${i + 1}] ${h.title ?? "(untitled)"}${date}\n${h.snippet ?? ""}\n${h.url ?? ""}`;
+	}).join("\n\n");
 };
-var makeSearchExecutor = (cfg) => {
-  const maxHits = cfg.maxHits ?? 6;
-  return async (name, args) => {
-    if (name !== webSearchTool.function.name) {
-      throw new Error(`search executor received unknown tool '${name}' (only '${webSearchTool.function.name}')`);
-    }
-    const query = typeof args.query === "string" ? args.query.trim() : "";
-    if (!query) return 'web_search requires a non-empty "query" string.';
-    const res = await fetch(`${cfg.routerBaseUrl}/search`, {
-      method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${cfg.routerKey}` },
-      body: JSON.stringify({ provider: cfg.provider, query })
-    });
-    if (!res.ok) {
-      throw new Error(`web_search ${cfg.provider} HTTP ${res.status}: ${(await res.text()).slice(0, 300)}`);
-    }
-    const body = await res.json();
-    const hits = body.data ?? [];
-    console.error(`  [web_search:${cfg.provider}] "${query.slice(0, 80)}" -> ${hits.length} hits`);
-    return formatHits(hits, maxHits);
-  };
+/**
+* Build the `executeToolCall` handler for a `router-tools` worker. `provider` is a
+* router search provider (`you` | `exa`). `maxHits` bounds the text folded back
+* into the model's context per call.
+*/
+const makeSearchExecutor = (cfg) => {
+	const maxHits = cfg.maxHits ?? 6;
+	return async (name, args) => {
+		if (name !== webSearchTool.function.name) throw new Error(`search executor received unknown tool '${name}' (only '${webSearchTool.function.name}')`);
+		const query = typeof args.query === "string" ? args.query.trim() : "";
+		if (!query) return "web_search requires a non-empty \"query\" string.";
+		const res = await fetch(`${cfg.routerBaseUrl}/search`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				authorization: `Bearer ${cfg.routerKey}`
+			},
+			body: JSON.stringify({
+				provider: cfg.provider,
+				query
+			})
+		});
+		if (!res.ok) throw new Error(`web_search ${cfg.provider} HTTP ${res.status}: ${(await res.text()).slice(0, 300)}`);
+		const hits = (await res.json()).data ?? [];
+		console.error(`  [web_search:${cfg.provider}] "${query.slice(0, 80)}" -> ${hits.length} hits`);
+		return formatHits(hits, maxHits);
+	};
 };
-
-// src/resolve-client.ts
+//#endregion
+//#region src/resolve-client.ts
+/**
+* The ONE harness → worker-client mapping for the bench layer. Every bench entrypoint
+* (rsi.ts, run.ts, …) derives the `SandboxClient` the kernel's `runLoop` drives from a single
+* selector instead of hand-rolling the branch:
+*
+*   - `router`               → OFF-BOX: a router chat-completion as the leaf executor, presented
+*                              as a SandboxClient (no sandbox dependency). For deployable-checker
+*                              domains whose worker is a completion, or where box egress is blocked.
+*   - `router` + searchProvider → OFF-BOX `router-tools`: the same off-box loop with a live
+*                              `web_search` tool (the capability axis research benches need).
+*   - `bridge`               → OFF-BOX: a local cli-bridge fronting a harness CLI
+*                              (opencode/kimi-code/…) as the leaf executor. Same resumable
+*                              `bridgeExecutor` the supervisor uses; harness+model ride the
+*                              bridge `model` id (`${harness}/${model}`).
+*   - anything else (`sandbox`/a BackendType) → IN-BOX: a real `Sandbox`. The in-box backend
+*                              TYPE (opencode/codex/…) is set separately on the `AgentRunSpec`;
+*                              this only decides off-box-vs-in-box transport for `runLoop`.
+*
+* Centralizing it here means a new entrypoint gets the full off-box/in-box matrix for free and
+* the mapping can't drift between callers.
+*/
 function resolveBenchClient(opts) {
-  const { backend, routerBaseUrl, routerKey, model, searchProvider } = opts;
-  if (backend === "router") {
-    if (searchProvider) {
-      return inlineSandboxClient(
-        createExecutor({
-          backend: "router-tools",
-          routerBaseUrl,
-          routerKey,
-          model,
-          tools: [webSearchTool],
-          executeToolCall: makeSearchExecutor({ routerBaseUrl, routerKey, provider: searchProvider })
-        })
-      );
-    }
-    return inlineSandboxClient(createExecutor({ backend: "router", routerBaseUrl, routerKey, model }));
-  }
-  if (backend === "bridge") {
-    const bridgeBearer = opts.bridgeBearer ?? routerKey;
-    if (!bridgeBearer) throw new Error("resolveBenchClient: backend 'bridge' needs bridgeBearer or routerKey");
-    return resolveSandboxClient({
-      backend: "bridge",
-      bridge: { url: opts.bridgeUrl, bearer: bridgeBearer, model, timeoutMs: opts.timeoutMs }
-    });
-  }
-  return new Sandbox({
-    baseUrl: opts.sandboxBaseUrl ?? "https://sandbox.tangle.tools",
-    apiKey: routerKey,
-    timeoutMs: opts.timeoutMs ?? 12e5
-  });
-}
-
-// src/run-pool.ts
+	const { backend, routerBaseUrl, routerKey, model, searchProvider } = opts;
+	if (backend === "router") {
+		if (searchProvider) return inlineSandboxClient(createExecutor({
+			backend: "router-tools",
+			routerBaseUrl,
+			routerKey,
+			model,
+			tools: [webSearchTool],
+			executeToolCall: makeSearchExecutor({
+				routerBaseUrl,
+				routerKey,
+				provider: searchProvider
+			})
+		}));
+		return inlineSandboxClient(createExecutor({
+			backend: "router",
+			routerBaseUrl,
+			routerKey,
+			model
+		}));
+	}
+	if (backend === "bridge") {
+		const bridgeBearer = opts.bridgeBearer ?? routerKey;
+		if (!bridgeBearer) throw new Error("resolveBenchClient: backend 'bridge' needs bridgeBearer or routerKey");
+		return resolveSandboxClient({
+			backend: "bridge",
+			bridge: {
+				url: opts.bridgeUrl,
+				bearer: bridgeBearer,
+				model,
+				timeoutMs: opts.timeoutMs
+			}
+		});
+	}
+	return new Sandbox({
+		baseUrl: opts.sandboxBaseUrl ?? "https://sandbox.tangle.tools",
+		apiKey: routerKey,
+		timeoutMs: opts.timeoutMs ?? 12e5
+	});
+}
+//#endregion
+//#region src/run-pool.ts
 async function runPool(items, concurrency, worker, opts) {
-  const results = new Array(items.length);
-  let next = 0;
-  const drain = async () => {
-    while (next < items.length) {
-      const index = next++;
-      const item = items[index];
-      let outcome;
-      try {
-        outcome = { index, item, ok: true, value: await worker(item, index) };
-      } catch (err) {
-        outcome = { index, item, ok: false, error: err instanceof Error ? err.message : String(err) };
-      }
-      results[index] = outcome;
-      opts?.onResult?.(outcome);
-    }
-  };
-  await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, drain));
-  return results;
-}
-
-// src/run-benchmarks.ts
+	const results = new Array(items.length);
+	let next = 0;
+	const drain = async () => {
+		while (next < items.length) {
+			const index = next++;
+			const item = items[index];
+			let outcome;
+			try {
+				outcome = {
+					index,
+					item,
+					ok: true,
+					value: await worker(item, index)
+				};
+			} catch (err) {
+				outcome = {
+					index,
+					item,
+					ok: false,
+					error: err instanceof Error ? err.message : String(err)
+				};
+			}
+			results[index] = outcome;
+			opts?.onResult?.(outcome);
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, drain));
+	return results;
+}
+//#endregion
+//#region src/run-benchmarks.ts
+/**
+* `runBenchmarks` — the bench unifier.
+*
+* `gate.ts` runs ONE adapter as a diverse-vs-blind research gate through the recursive atom.
+* This is the other half it references: run a SUBSET of the registry's benchmarks over a MATRIX of
+* agent cells (harness × model × persona), each scored by the benchmark's OWN deterministic judge,
+* and return a ranked leaderboard. It is the "which harness/model/persona combination wins on which
+* benchmark" question, answered over an arbitrary subset in one call.
+*
+* It owns no new mechanism. Each cell is one `openSandboxRun` shot (the same per-run primitive the
+* SWE worker uses) driven by `resolveBenchClient` (off-box router completion OR in-box Sandbox; the
+* harness rides `sandboxOverrides.backend.type`). The deliverable is the adapter's OWN parser
+* (`adapter.output`), defaulting to the final answer text — so `runBenchmarks` needs no
+* per-benchmark branching. Concurrency is the shared `runPool`. The number comes from
+* `adapter.judge`, never a self-authored judge.
+*
+* Subset = the `benchmarks` and `cells` arrays plus `n`/`ids`/`split`. A benchmark whose
+* `preflight()` fails (missing Docker/venv/dataset) is recorded as unavailable and skipped — the
+* sweep never aborts because one bench's harness is absent.
+*
+*   const report = await runBenchmarks({
+*     benchmarks: ['humaneval', 'swe-bench'],
+*     cells: [
+*       { label: 'opencode/glm-4.6', model: 'glm-4.6', harness: 'opencode' },
+*       { label: 'codex/gpt-5',      model: 'gpt-5',    harness: 'codex'    },
+*     ],
+*     routerBaseUrl, routerKey, n: 20,
+*   })
+*/
+/** Last assistant text across the common event shapes (delta accumulation, then a terminal
+*  `result`/`done`/`agent` snapshot). The structured-deliverable case is handled by the adapter's
+*  own `output.parse`; this is the research/QA fallback. */
 function finalText(events) {
-  let text = "";
-  for (const ev of events) {
-    const e = ev;
-    const data = e.data ?? {};
-    if (e.type === "message.part.updated") {
-      const part = data.part;
-      const partType = data.partType ?? part?.type;
-      if (partType === "text") {
-        if (typeof data.delta === "string") text += data.delta;
-        else if (typeof part?.text === "string") text = part.text;
-      }
-    } else if (typeof data.finalText === "string") text = data.finalText;
-    else if (typeof data.response === "string") text = data.response;
-  }
-  return text.trim();
-}
-var openSandboxShot = async ({ adapter, task, cell, prompt, routerBaseUrl, routerKey, bridgeUrl, bridgeBearer, sandboxBaseUrl, timeoutMs, resolveClient }) => {
-  const client = (resolveClient ?? resolveBenchClient)({
-    backend: cell.backend ?? "router",
-    routerBaseUrl,
-    routerKey,
-    model: cell.model,
-    ...bridgeUrl ? { bridgeUrl } : {},
-    ...bridgeBearer ? { bridgeBearer } : {},
-    ...sandboxBaseUrl ? { sandboxBaseUrl } : {},
-    ...cell.searchProvider ? { searchProvider: cell.searchProvider } : {},
-    ...timeoutMs ? { timeoutMs } : {}
-  });
-  const harness = cell.harness ?? cell.profile?.metadata?.backendType ?? "opencode";
-  const profile = cell.profile ?? { name: cell.label, metadata: { backendType: harness } };
-  const uniq = Math.random().toString(36).slice(2, 8);
-  const agentRun = {
-    profile,
-    name: cell.label,
-    taskToPrompt: () => "",
-    sandboxOverrides: {
-      name: `bench-${adapter.name}-${task.id}-${uniq}`.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 60),
-      environment: "universal",
-      backend: { type: harness, model: { provider: "openai", model: cell.model, baseUrl: routerBaseUrl } }
-    }
-  };
-  const deliverable = {
-    kind: "events",
-    fromEvents: (events) => adapter.output ? adapter.output.parse(events) : finalText(events)
-  };
-  const controller = new AbortController();
-  const timer = timeoutMs ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
-  const runOptions = {
-    agentRun,
-    signal: controller.signal,
-    runId: `bench:${adapter.name}:${task.id}:${uniq}`,
-    scenarioId: task.id
-  };
-  const boxSetup = adapter.boxSetup;
-  if (boxSetup) {
-    runOptions.beforeStart = async ({ box, sessionId }) => {
-      const setup = boxSetup(task);
-      const sres = await box.exec(setup.command, {
-        timeoutMs: 3e5,
-        sessionId,
-        ...setup.cwd ? { cwd: setup.cwd } : {}
-      });
-      if (sres.exitCode !== 0)
-        throw new Error(
-          `boxSetup failed (exit ${sres.exitCode}): ${(sres.stderr ?? "").slice(0, 200)}`
-        );
-    };
-  }
-  const run = await openSandboxRun(client, runOptions, deliverable);
-  try {
-    const turn = await run.start(prompt ?? task.prompt);
-    let artifact = (turn.out ?? "").trim();
-    let boxExtractError;
-    if (adapter.boxExtract) {
-      try {
-        const ex = adapter.boxExtract(task);
-        const res = await run.box.exec(ex.command, {
-          timeoutMs: 12e4,
-          sessionId: run.sessionId,
-          ...ex.cwd ? { cwd: ex.cwd } : {}
-        });
-        const boxArtifact = (res.stdout ?? "").trim();
-        if (res.exitCode !== 0)
-          boxExtractError = `exit ${res.exitCode}: ${(res.stderr ?? "").slice(0, 160)}`;
-        else if (boxArtifact.length > 0) artifact = boxArtifact;
-        if (process.env.BENCH_ARTIFACT_DIR) {
-          try {
-            mkdirSync(process.env.BENCH_ARTIFACT_DIR, { recursive: true });
-            const safe = `${adapter.name}_${task.id}_${uniq}`.replace(/[^a-zA-Z0-9_.-]/g, "_");
-            const map = await run.box.exec(
-              'echo "PWD:"; pwd; echo "LS:"; ls -la; echo "GITROOTS:"; find / -maxdepth 5 -type d -name .git 2>/dev/null; echo "SETTINGS:"; find / -maxdepth 8 -name global_settings.py -path "*conf*" 2>/dev/null',
-              { timeoutMs: 6e4, sessionId: run.sessionId }
-            ).catch((e) => ({ exitCode: -1, stdout: "", stderr: String(e) }));
-            writeFileSync(
-              `${process.env.BENCH_ARTIFACT_DIR}/${safe}.exec.json`,
-              JSON.stringify(
-                { sessionId: run.sessionId, extract: res, map: { exitCode: map.exitCode, stdout: map.stdout, stderr: map.stderr } },
-                null,
-                2
-              )
-            );
-          } catch {
-          }
-        }
-      } catch (err) {
-        boxExtractError = err instanceof Error ? err.message.slice(0, 160) : String(err);
-      }
-    }
-    const detail = turn.readError !== void 0 ? `read: ${turn.readError.slice(0, 160)}` : boxExtractError !== void 0 ? `boxExtract: ${boxExtractError}` : void 0;
-    if (process.env.BENCH_ARTIFACT_DIR) {
-      try {
-        mkdirSync(process.env.BENCH_ARTIFACT_DIR, { recursive: true });
-        const safe = `${adapter.name}_${task.id}_${uniq}`.replace(/[^a-zA-Z0-9_.-]/g, "_");
-        writeFileSync(`${process.env.BENCH_ARTIFACT_DIR}/${safe}.patch`, artifact);
-      } catch {
-      }
-    }
-    return {
-      artifact,
-      ok: artifact.length > 0,
-      ...detail ? { detail } : {}
-    };
-  } finally {
-    if (timer) clearTimeout(timer);
-    await run.close();
-  }
+	let text = "";
+	for (const ev of events) {
+		const e = ev;
+		const data = e.data ?? {};
+		if (e.type === "message.part.updated") {
+			const part = data.part;
+			if ((data.partType ?? part?.type) === "text") {
+				if (typeof data.delta === "string") text += data.delta;
+				else if (typeof part?.text === "string") text = part.text;
+			}
+		} else if (typeof data.finalText === "string") text = data.finalText;
+		else if (typeof data.response === "string") text = data.response;
+	}
+	return text.trim();
+}
+/** The default real-agent shot: one `openSandboxRun` over the cell's harness+model, deliverable
+*  extracted by the adapter's parser (or final text), abortable on `timeoutMs`. */
+const openSandboxShot = async ({ adapter, task, cell, prompt, routerBaseUrl, routerKey, bridgeUrl, bridgeBearer, sandboxBaseUrl, timeoutMs, resolveClient }) => {
+	const client = (resolveClient ?? resolveBenchClient)({
+		backend: cell.backend ?? "router",
+		routerBaseUrl,
+		routerKey,
+		model: cell.model,
+		...bridgeUrl ? { bridgeUrl } : {},
+		...bridgeBearer ? { bridgeBearer } : {},
+		...sandboxBaseUrl ? { sandboxBaseUrl } : {},
+		...cell.searchProvider ? { searchProvider: cell.searchProvider } : {},
+		...timeoutMs ? { timeoutMs } : {}
+	});
+	const harness = cell.harness ?? cell.profile?.metadata?.backendType ?? "opencode";
+	const profile = cell.profile ?? {
+		name: cell.label,
+		metadata: { backendType: harness }
+	};
+	const uniq = Math.random().toString(36).slice(2, 8);
+	const agentRun = {
+		profile,
+		name: cell.label,
+		taskToPrompt: () => "",
+		sandboxOverrides: {
+			name: `bench-${adapter.name}-${task.id}-${uniq}`.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 60),
+			environment: "universal",
+			backend: {
+				type: harness,
+				model: {
+					provider: "openai",
+					model: cell.model,
+					baseUrl: routerBaseUrl
+				}
+			}
+		}
+	};
+	const deliverable = {
+		kind: "events",
+		fromEvents: (events) => adapter.output ? adapter.output.parse(events) : finalText(events)
+	};
+	const controller = new AbortController();
+	const timer = timeoutMs ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
+	const runOptions = {
+		agentRun,
+		signal: controller.signal,
+		runId: `bench:${adapter.name}:${task.id}:${uniq}`,
+		scenarioId: task.id
+	};
+	const boxSetup = adapter.boxSetup;
+	if (boxSetup) runOptions.beforeStart = async ({ box, sessionId }) => {
+		const setup = boxSetup(task);
+		const sres = await box.exec(setup.command, {
+			timeoutMs: 3e5,
+			sessionId,
+			...setup.cwd ? { cwd: setup.cwd } : {}
+		});
+		if (sres.exitCode !== 0) throw new Error(`boxSetup failed (exit ${sres.exitCode}): ${(sres.stderr ?? "").slice(0, 200)}`);
+	};
+	const run = await openSandboxRun(client, runOptions, deliverable);
+	try {
+		const turn = await run.start(prompt ?? task.prompt);
+		let artifact = (turn.out ?? "").trim();
+		let boxExtractError;
+		if (adapter.boxExtract) try {
+			const ex = adapter.boxExtract(task);
+			const res = await run.box.exec(ex.command, {
+				timeoutMs: 12e4,
+				sessionId: run.sessionId,
+				...ex.cwd ? { cwd: ex.cwd } : {}
+			});
+			const boxArtifact = (res.stdout ?? "").trim();
+			if (res.exitCode !== 0) boxExtractError = `exit ${res.exitCode}: ${(res.stderr ?? "").slice(0, 160)}`;
+			else if (boxArtifact.length > 0) artifact = boxArtifact;
+			if (process.env.BENCH_ARTIFACT_DIR) try {
+				mkdirSync(process.env.BENCH_ARTIFACT_DIR, { recursive: true });
+				const safe = `${adapter.name}_${task.id}_${uniq}`.replace(/[^a-zA-Z0-9_.-]/g, "_");
+				const map = await run.box.exec("echo \"PWD:\"; pwd; echo \"LS:\"; ls -la; echo \"GITROOTS:\"; find / -maxdepth 5 -type d -name .git 2>/dev/null; echo \"SETTINGS:\"; find / -maxdepth 8 -name global_settings.py -path \"*conf*\" 2>/dev/null", {
+					timeoutMs: 6e4,
+					sessionId: run.sessionId
+				}).catch((e) => ({
+					exitCode: -1,
+					stdout: "",
+					stderr: String(e)
+				}));
+				writeFileSync(`${process.env.BENCH_ARTIFACT_DIR}/${safe}.exec.json`, JSON.stringify({
+					sessionId: run.sessionId,
+					extract: res,
+					map: {
+						exitCode: map.exitCode,
+						stdout: map.stdout,
+						stderr: map.stderr
+					}
+				}, null, 2));
+			} catch {}
+		} catch (err) {
+			boxExtractError = err instanceof Error ? err.message.slice(0, 160) : String(err);
+		}
+		const detail = turn.readError !== void 0 ? `read: ${turn.readError.slice(0, 160)}` : boxExtractError !== void 0 ? `boxExtract: ${boxExtractError}` : void 0;
+		if (process.env.BENCH_ARTIFACT_DIR) try {
+			mkdirSync(process.env.BENCH_ARTIFACT_DIR, { recursive: true });
+			const safe = `${adapter.name}_${task.id}_${uniq}`.replace(/[^a-zA-Z0-9_.-]/g, "_");
+			writeFileSync(`${process.env.BENCH_ARTIFACT_DIR}/${safe}.patch`, artifact);
+		} catch {}
+		return {
+			artifact,
+			ok: artifact.length > 0,
+			...detail ? { detail } : {}
+		};
+	} finally {
+		if (timer) clearTimeout(timer);
+		await run.close();
+	}
 };
 function parseMaybeJson(value) {
-  try {
-    return JSON.parse(value);
-  } catch {
-    return value;
-  }
+	try {
+		return JSON.parse(value);
+	} catch {
+		return value;
+	}
 }
 function redactJudgeLeak(value) {
-  if (Array.isArray(value)) return value.map(redactJudgeLeak);
-  if (!value || typeof value !== "object") return value;
-  const out = {};
-  for (const [key, child] of Object.entries(value)) {
-    const normalizedKey = key.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
-    if (/(^|_)(gold|expected|reference|solution|answer)(_|$)/.test(normalizedKey)) continue;
-    out[key] = redactJudgeLeak(child);
-  }
-  return out;
+	if (Array.isArray(value)) return value.map(redactJudgeLeak);
+	if (!value || typeof value !== "object") return value;
+	const out = {};
+	for (const [key, child] of Object.entries(value)) {
+		const normalizedKey = key.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
+		if (/(^|_)(gold|expected|reference|solution|answer)(_|$)/.test(normalizedKey)) continue;
+		out[key] = redactJudgeLeak(child);
+	}
+	return out;
 }
 function safeFeedback(score) {
-  return {
-    resolved: score.resolved,
-    score: score.score,
-    ...score.detail ? { detail: redactJudgeLeak(parseMaybeJson(score.detail)) } : {}
-  };
+	return {
+		resolved: score.resolved,
+		score: score.score,
+		...score.detail ? { detail: redactJudgeLeak(parseMaybeJson(score.detail)) } : {}
+	};
 }
 function truncate(value, max = 4e3) {
-  return value.length <= max ? value : `${value.slice(0, max)}
-...[truncated ${value.length - max} chars]`;
+	return value.length <= max ? value : `${value.slice(0, max)}\n...[truncated ${value.length - max} chars]`;
 }
 function retryPrompt(task, history, scores) {
-  const attempts = history.map((h) => {
-    const score = scores.get(h.round);
-    return [
-      `Attempt ${h.round}:`,
-      "Artifact:",
-      truncate(h.artifact),
-      score ? `Checker feedback: ${JSON.stringify(safeFeedback(score))}` : void 0
-    ].filter(Boolean).join("\n");
-  }).join("\n\n");
-  return [
-    "Retry the benchmark task. The previous artifact did not pass the checker.",
-    "Use only the original task statement and supplied context. Do not invent facts.",
-    "Return the corrected artifact in exactly the format requested by the original task.",
-    "",
-    "Original task:",
-    task.prompt,
-    "",
-    "Previous attempts and safe checker feedback:",
-    attempts
-  ].join("\n");
+	const attempts = history.map((h) => {
+		const score = scores.get(h.round);
+		return [
+			`Attempt ${h.round}:`,
+			"Artifact:",
+			truncate(h.artifact),
+			score ? `Checker feedback: ${JSON.stringify(safeFeedback(score))}` : void 0
+		].filter(Boolean).join("\n");
+	}).join("\n\n");
+	return [
+		"Retry the benchmark task. The previous artifact did not pass the checker.",
+		"Use only the original task statement and supplied context. Do not invent facts.",
+		"Return the corrected artifact in exactly the format requested by the original task.",
+		"",
+		"Original task:",
+		task.prompt,
+		"",
+		"Previous attempts and safe checker feedback:",
+		attempts
+	].join("\n");
 }
 async function loopedShot(input, shot, attempts) {
-  const scores = /* @__PURE__ */ new Map();
-  const result = await runRefineLoop({
-    rounds: attempts,
-    prompt: (round, history) => round === 1 ? input.task.prompt : retryPrompt(input.task, history, scores),
-    runShot: async (prompt, round) => {
-      const out = await shot({ ...input, prompt, attempt: round });
-      return { artifact: out.artifact, note: out.detail };
-    },
-    judge: async (artifact, round) => {
-      const score = await input.adapter.judge(input.task, artifact);
-      scores.set(round, score);
-      return { valid: score.resolved, score: score.score };
-    }
-  });
-  const best = result.rounds.reduce((winner, candidate) => {
-    const a = scores.get(winner.round);
-    const b = scores.get(candidate.round);
-    if (!a) return candidate;
-    if (!b) return winner;
-    if (b.resolved && !a.resolved) return candidate;
-    if (b.resolved === a.resolved && b.score > a.score) return candidate;
-    return winner;
-  }, result.rounds[0]);
-  const bestScore = scores.get(best.round);
-  return {
-    artifact: best.artifact,
-    ok: best.artifact.trim().length > 0,
-    detail: JSON.stringify({
-      mode: "refine-loop",
-      attempts: result.rounds.length,
-      selectedAttempt: best.round,
-      resolvedDuringLoop: result.resolved,
-      selectedScore: bestScore?.score ?? null,
-      rounds: result.rounds.map((round) => ({
-        attempt: round.round,
-        score: scores.get(round.round)?.score ?? null,
-        resolved: scores.get(round.round)?.resolved ?? null,
-        note: round.note ?? null
-      }))
-    })
-  };
+	const scores = /* @__PURE__ */ new Map();
+	const result = await runRefineLoop({
+		rounds: attempts,
+		prompt: (round, history) => round === 1 ? input.task.prompt : retryPrompt(input.task, history, scores),
+		runShot: async (prompt, round) => {
+			const out = await shot({
+				...input,
+				prompt,
+				attempt: round
+			});
+			return {
+				artifact: out.artifact,
+				note: out.detail
+			};
+		},
+		judge: async (artifact, round) => {
+			const score = await input.adapter.judge(input.task, artifact);
+			scores.set(round, score);
+			return {
+				valid: score.resolved,
+				score: score.score
+			};
+		}
+	});
+	const best = result.rounds.reduce((winner, candidate) => {
+		const a = scores.get(winner.round);
+		const b = scores.get(candidate.round);
+		if (!a) return candidate;
+		if (!b) return winner;
+		if (b.resolved && !a.resolved) return candidate;
+		if (b.resolved === a.resolved && b.score > a.score) return candidate;
+		return winner;
+	}, result.rounds[0]);
+	const bestScore = scores.get(best.round);
+	return {
+		artifact: best.artifact,
+		ok: best.artifact.trim().length > 0,
+		detail: JSON.stringify({
+			mode: "refine-loop",
+			attempts: result.rounds.length,
+			selectedAttempt: best.round,
+			resolvedDuringLoop: result.resolved,
+			selectedScore: bestScore?.score ?? null,
+			rounds: result.rounds.map((round) => ({
+				attempt: round.round,
+				score: scores.get(round.round)?.score ?? null,
+				resolved: scores.get(round.round)?.resolved ?? null,
+				note: round.note ?? null
+			}))
+		})
+	};
 }
 function combineDetails(runDetail, scoreDetail) {
-  if (runDetail && scoreDetail) {
-    return JSON.stringify({ run: parseMaybeJson(runDetail), score: parseMaybeJson(scoreDetail) });
-  }
-  return runDetail ?? scoreDetail;
-}
-async function prepareBenchmarks(benchmarks, resolve4, opts) {
-  const ready = [];
-  const unavailable = [];
-  for (const benchmark of benchmarks) {
-    const adapter = resolve4(benchmark);
-    try {
-      await adapter.preflight();
-      const tasks = await adapter.loadTasks({
-        ...opts.n !== void 0 ? { limit: opts.n } : {},
-        ...opts.ids ? { ids: opts.ids } : {},
-        ...opts.split ? { split: opts.split } : {}
-      });
-      if (tasks.length === 0) {
-        unavailable.push({ benchmark, reason: "loadTasks returned no tasks" });
-        continue;
-      }
-      if (opts.verifyJudge !== false) {
-        const gold = await adapter.goldArtifact(tasks[0]);
-        if (gold !== void 0) {
-          const verdict = await adapter.judge(tasks[0], gold);
-          if (!verdict.resolved) {
-            unavailable.push({ benchmark, reason: `judge rejected its own gold on ${tasks[0].id} \u2014 judge is miscalibrated` });
-            continue;
-          }
-        }
-      }
-      ready.push({ benchmark, adapter, tasks });
-    } catch (err) {
-      unavailable.push({ benchmark, reason: err instanceof Error ? err.message : String(err) });
-    }
-  }
-  return { ready, unavailable };
+	if (runDetail && scoreDetail) return JSON.stringify({
+		run: parseMaybeJson(runDetail),
+		score: parseMaybeJson(scoreDetail)
+	});
+	return runDetail ?? scoreDetail;
+}
+/** Resolve + preflight + (optionally) self-verify each benchmark once; load its tasks. A benchmark
+*  whose harness is absent or whose judge rejects its own gold is recorded unavailable, not run. */
+async function prepareBenchmarks(benchmarks, resolve, opts) {
+	const ready = [];
+	const unavailable = [];
+	for (const benchmark of benchmarks) {
+		const adapter = resolve(benchmark);
+		try {
+			await adapter.preflight();
+			const tasks = await adapter.loadTasks({
+				...opts.n !== void 0 ? { limit: opts.n } : {},
+				...opts.ids ? { ids: opts.ids } : {},
+				...opts.split ? { split: opts.split } : {}
+			});
+			if (tasks.length === 0) {
+				unavailable.push({
+					benchmark,
+					reason: "loadTasks returned no tasks"
+				});
+				continue;
+			}
+			if (opts.verifyJudge !== false) {
+				const gold = await adapter.goldArtifact(tasks[0]);
+				if (gold !== void 0) {
+					if (!(await adapter.judge(tasks[0], gold)).resolved) {
+						unavailable.push({
+							benchmark,
+							reason: `judge rejected its own gold on ${tasks[0].id} — judge is miscalibrated`
+						});
+						continue;
+					}
+				}
+			}
+			ready.push({
+				benchmark,
+				adapter,
+				tasks
+			});
+		} catch (err) {
+			unavailable.push({
+				benchmark,
+				reason: err instanceof Error ? err.message : String(err)
+			});
+		}
+	}
+	return {
+		ready,
+		unavailable
+	};
 }
 async function runBenchmarks(opts) {
-  if (opts.benchmarks.length === 0) throw new Error("runBenchmarks: no benchmarks selected");
-  if (opts.cells.length === 0) throw new Error("runBenchmarks: no cells to run");
-  const reps = Math.max(1, opts.reps ?? 1);
-  const loopAttempts = Math.max(1, opts.loopAttempts ?? 1);
-  const shot = opts.runShot ?? openSandboxShot;
-  const { ready, unavailable } = await prepareBenchmarks(opts.benchmarks, opts.resolveAdapter ?? resolveAdapter, opts);
-  const jobs = [];
-  for (const { benchmark, adapter, tasks } of ready)
-    for (const cell of opts.cells) for (const task of tasks) for (let rep = 0; rep < reps; rep += 1) jobs.push({ benchmark, adapter, cell, task, rep });
-  const perTask = [];
-  await runPool(jobs, Math.max(1, opts.concurrency ?? 4), async (job, index) => {
-    const startedAt = Date.now();
-    let result;
-    try {
-      const shotInput = {
-        adapter: job.adapter,
-        task: job.task,
-        cell: job.cell,
-        routerBaseUrl: opts.routerBaseUrl,
-        routerKey: opts.routerKey,
-        ...opts.bridgeUrl ? { bridgeUrl: opts.bridgeUrl } : {},
-        ...opts.bridgeBearer ? { bridgeBearer: opts.bridgeBearer } : {},
-        ...opts.sandboxBaseUrl ? { sandboxBaseUrl: opts.sandboxBaseUrl } : {},
-        ...opts.timeoutMs ? { timeoutMs: opts.timeoutMs } : {},
-        ...opts.resolveClient ? { resolveClient: opts.resolveClient } : {}
-      };
-      const out = loopAttempts > 1 ? await loopedShot(shotInput, shot, loopAttempts) : await shot(shotInput);
-      const score = await job.adapter.judge(job.task, out.artifact);
-      result = {
-        benchmark: job.benchmark,
-        cell: job.cell.label,
-        taskId: job.task.id,
-        rep: job.rep,
-        resolved: out.ok && score.resolved,
-        score: out.ok ? score.score : 0,
-        ok: out.ok,
-        ...out.detail ?? score.detail ? { detail: combineDetails(out.detail, score.detail) } : {},
-        wallMs: Date.now() - startedAt
-      };
-    } catch (err) {
-      result = {
-        benchmark: job.benchmark,
-        cell: job.cell.label,
-        taskId: job.task.id,
-        rep: job.rep,
-        resolved: false,
-        score: 0,
-        ok: false,
-        detail: err instanceof Error ? err.message.slice(0, 200) : String(err),
-        wallMs: Date.now() - startedAt
-      };
-    }
-    void index;
-    perTask.push(result);
-    opts.onResult?.(result);
-    return result;
-  });
-  const rows = aggregate(perTask);
-  return {
-    rows,
-    perTask,
-    benchmarks: ready.map((r) => r.benchmark),
-    cells: opts.cells.map((c) => c.label),
-    unavailable
-  };
+	if (opts.benchmarks.length === 0) throw new Error("runBenchmarks: no benchmarks selected");
+	if (opts.cells.length === 0) throw new Error("runBenchmarks: no cells to run");
+	const reps = Math.max(1, opts.reps ?? 1);
+	const loopAttempts = Math.max(1, opts.loopAttempts ?? 1);
+	const shot = opts.runShot ?? openSandboxShot;
+	const { ready, unavailable } = await prepareBenchmarks(opts.benchmarks, opts.resolveAdapter ?? resolveAdapter, opts);
+	const jobs = [];
+	for (const { benchmark, adapter, tasks } of ready) for (const cell of opts.cells) for (const task of tasks) for (let rep = 0; rep < reps; rep += 1) jobs.push({
+		benchmark,
+		adapter,
+		cell,
+		task,
+		rep
+	});
+	const perTask = [];
+	await runPool(jobs, Math.max(1, opts.concurrency ?? 4), async (job, index) => {
+		const startedAt = Date.now();
+		let result;
+		try {
+			const shotInput = {
+				adapter: job.adapter,
+				task: job.task,
+				cell: job.cell,
+				routerBaseUrl: opts.routerBaseUrl,
+				routerKey: opts.routerKey,
+				...opts.bridgeUrl ? { bridgeUrl: opts.bridgeUrl } : {},
+				...opts.bridgeBearer ? { bridgeBearer: opts.bridgeBearer } : {},
+				...opts.sandboxBaseUrl ? { sandboxBaseUrl: opts.sandboxBaseUrl } : {},
+				...opts.timeoutMs ? { timeoutMs: opts.timeoutMs } : {},
+				...opts.resolveClient ? { resolveClient: opts.resolveClient } : {}
+			};
+			const out = loopAttempts > 1 ? await loopedShot(shotInput, shot, loopAttempts) : await shot(shotInput);
+			const score = await job.adapter.judge(job.task, out.artifact);
+			result = {
+				benchmark: job.benchmark,
+				cell: job.cell.label,
+				taskId: job.task.id,
+				rep: job.rep,
+				resolved: out.ok && score.resolved,
+				score: out.ok ? score.score : 0,
+				ok: out.ok,
+				...out.detail ?? score.detail ? { detail: combineDetails(out.detail, score.detail) } : {},
+				wallMs: Date.now() - startedAt
+			};
+		} catch (err) {
+			result = {
+				benchmark: job.benchmark,
+				cell: job.cell.label,
+				taskId: job.task.id,
+				rep: job.rep,
+				resolved: false,
+				score: 0,
+				ok: false,
+				detail: err instanceof Error ? err.message.slice(0, 200) : String(err),
+				wallMs: Date.now() - startedAt
+			};
+		}
+		perTask.push(result);
+		opts.onResult?.(result);
+		return result;
+	});
+	return {
+		rows: aggregate(perTask),
+		perTask,
+		benchmarks: ready.map((r) => r.benchmark),
+		cells: opts.cells.map((c) => c.label),
+		unavailable
+	};
 }
 function aggregate(perTask) {
-  const byKey = /* @__PURE__ */ new Map();
-  for (const r of perTask) {
-    const key = `${r.benchmark}\0${r.cell}`;
-    const e = byKey.get(key) ?? { benchmark: r.benchmark, cell: r.cell, n: 0, resolved: 0, errored: 0, scoreSum: 0 };
-    e.n += 1;
-    if (!r.ok) e.errored += 1;
-    else {
-      if (r.resolved) e.resolved += 1;
-      e.scoreSum += r.score;
-    }
-    byKey.set(key, e);
-  }
-  const rows = [...byKey.values()].map((e) => {
-    const denom = Math.max(1, e.n - e.errored);
-    return {
-      benchmark: e.benchmark,
-      cell: e.cell,
-      n: e.n,
-      resolved: e.resolved,
-      errored: e.errored,
-      resolveRate: e.resolved / denom,
-      meanScore: e.scoreSum / denom
-    };
-  });
-  rows.sort((a, b) => a.benchmark === b.benchmark ? b.resolveRate - a.resolveRate : a.benchmark < b.benchmark ? -1 : 1);
-  return rows;
-}
+	const byKey = /* @__PURE__ */ new Map();
+	for (const r of perTask) {
+		const key = `${r.benchmark}\u0000${r.cell}`;
+		const e = byKey.get(key) ?? {
+			benchmark: r.benchmark,
+			cell: r.cell,
+			n: 0,
+			resolved: 0,
+			errored: 0,
+			scoreSum: 0
+		};
+		e.n += 1;
+		if (!r.ok) e.errored += 1;
+		else {
+			if (r.resolved) e.resolved += 1;
+			e.scoreSum += r.score;
+		}
+		byKey.set(key, e);
+	}
+	const rows = [...byKey.values()].map((e) => {
+		const denom = Math.max(1, e.n - e.errored);
+		return {
+			benchmark: e.benchmark,
+			cell: e.cell,
+			n: e.n,
+			resolved: e.resolved,
+			errored: e.errored,
+			resolveRate: e.resolved / denom,
+			meanScore: e.scoreSum / denom
+		};
+	});
+	rows.sort((a, b) => a.benchmark === b.benchmark ? b.resolveRate - a.resolveRate : a.benchmark < b.benchmark ? -1 : 1);
+	return rows;
+}
+/** Render the leaderboard as a fixed-width table for a CLI/log. */
 function printBenchmarksReport(report) {
-  const lines = [];
-  const w = Math.max(8, ...report.rows.map((r) => r.cell.length));
-  const b = Math.max(9, ...report.rows.map((r) => r.benchmark.length));
-  lines.push(`${"benchmark".padEnd(b)}  ${"cell".padEnd(w)}  resolve   mean    n  err`);
-  for (const r of report.rows)
-    lines.push(
-      `${r.benchmark.padEnd(b)}  ${r.cell.padEnd(w)}  ${(r.resolveRate * 100).toFixed(1).padStart(6)}%  ${r.meanScore.toFixed(3).padStart(5)}  ${String(r.n).padStart(3)}  ${String(r.errored).padStart(3)}`
-    );
-  for (const u of report.unavailable) lines.push(`(skipped ${u.benchmark}: ${u.reason})`);
-  return lines.join("\n");
-}
-
-// src/pier-agent.ts
-import assert from "assert/strict";
-import { createHash } from "crypto";
-import { chmod, lstat, mkdir as mkdir2, realpath as realpath2, writeFile } from "fs/promises";
-import { dirname, isAbsolute, join as join2, resolve as resolve2 } from "path";
-import { executePreparedAgentCandidate } from "@tangle-network/agent-runtime";
-import { canonicalJson } from "@tangle-network/agent-eval";
-
-// src/pier-task-outcome.ts
-import { spawn } from "child_process";
-import { mkdir, mkdtemp, realpath, rm } from "fs/promises";
-import { tmpdir } from "os";
-import { join, resolve } from "path";
-import {
-  captureAgentCandidateWorkspaceFiles
-} from "@tangle-network/agent-runtime/candidate-execution";
+	const lines = [];
+	const w = Math.max(8, ...report.rows.map((r) => r.cell.length));
+	const b = Math.max(9, ...report.rows.map((r) => r.benchmark.length));
+	lines.push(`${"benchmark".padEnd(b)}  ${"cell".padEnd(w)}  resolve   mean    n  err`);
+	for (const r of report.rows) lines.push(`${r.benchmark.padEnd(b)}  ${r.cell.padEnd(w)}  ${(r.resolveRate * 100).toFixed(1).padStart(6)}%  ${r.meanScore.toFixed(3).padStart(5)}  ${String(r.n).padStart(3)}  ${String(r.errored).padStart(3)}`);
+	for (const u of report.unavailable) lines.push(`(skipped ${u.benchmark}: ${u.reason})`);
+	return lines.join("\n");
+}
+//#endregion
+//#region src/pier-task-outcome.ts
+/** Reconstruct a runtime task outcome from Pier's evaluator-captured binary patch. */
+/** Apply the official patch in an isolated Git object directory and capture its exact tree. */
 async function capturePierTaskOutcome(input) {
-  input.signal?.throwIfAborted();
-  const repositoryRoot = resolve(input.repositoryRoot);
-  const head = (await git(repositoryRoot, ["rev-parse", "HEAD"], void 0, {}, input.signal)).stdout.toString("utf8").trim();
-  const headTree = (await git(repositoryRoot, ["rev-parse", "HEAD^{tree}"], void 0, {}, input.signal)).stdout.toString("utf8").trim();
-  if (head !== input.baseCommit || headTree !== input.baseTree) {
-    throw new Error("Pier task outcome repository drifted from its signed base");
-  }
-  const gitDir = resolve(
-    (await git(repositoryRoot, ["rev-parse", "--absolute-git-dir"], void 0, {}, input.signal)).stdout.toString("utf8").trim()
-  );
-  if (await realpath(gitDir) !== gitDir || gitDir.includes(":")) {
-    throw new Error("Pier task outcome Git directory is unsupported");
-  }
-  const replacements = (await git(
-    repositoryRoot,
-    ["for-each-ref", "--format=%(refname)", "refs/replace"],
-    void 0,
-    {},
-    input.signal
-  )).stdout.toString("utf8").trim();
-  if (replacements) throw new Error("Pier task outcome repository contains Git replace refs");
-  const temporary = await mkdtemp(join(tmpdir(), "pier-task-outcome-"));
-  try {
-    const objectDirectory = join(temporary, "objects");
-    const indexFile = join(temporary, "index");
-    await mkdir(objectDirectory);
-    const environment = {
-      GIT_INDEX_FILE: indexFile,
-      GIT_OBJECT_DIRECTORY: objectDirectory,
-      GIT_ALTERNATE_OBJECT_DIRECTORIES: join(gitDir, "objects")
-    };
-    await git(repositoryRoot, ["read-tree", input.baseTree], void 0, environment, input.signal);
-    const patch = Uint8Array.from(input.patch);
-    if (patch.byteLength > 0) {
-      await git(
-        repositoryRoot,
-        ["apply", "--cached", "--binary", "--whitespace=nowarn", "-"],
-        patch,
-        environment,
-        input.signal
-      );
-    }
-    const resultTree = (await git(repositoryRoot, ["write-tree"], void 0, environment, input.signal)).stdout.toString("utf8").trim();
-    const entries = parseTreeEntries(
-      (await git(
-        repositoryRoot,
-        ["ls-tree", "-rz", "--full-tree", resultTree],
-        void 0,
-        environment,
-        input.signal
-      )).stdout
-    );
-    if (entries.length === 0) throw new Error("Pier task outcome tree cannot be empty");
-    const files = await Promise.all(
-      entries.map(async (entry) => {
-        if (entry.type !== "blob" || entry.mode !== "100644" && entry.mode !== "100755") {
-          throw new Error(`Pier task outcome contains a non-regular entry: ${entry.path}`);
-        }
-        return {
-          path: safeGitPath(entry.path),
-          mode: entry.mode === "100755" ? 493 : 420,
-          bytes: (await git(
-            repositoryRoot,
-            ["cat-file", "blob", entry.object],
-            void 0,
-            environment,
-            input.signal
-          )).stdout
-        };
-      })
-    );
-    const captured = await captureAgentCandidateWorkspaceFiles(files, {
-      limits: { maxEmbeddedArtifactBytes: 512 * 1024 * 1024 }
-    });
-    return {
-      kind: "workspace",
-      resultTree,
-      afterState: captured.snapshot.material,
-      archive: captured.archive,
-      gitDiff: patch
-    };
-  } finally {
-    await rm(temporary, { recursive: true, force: true });
-  }
+	input.signal?.throwIfAborted();
+	const repositoryRoot = resolve(input.repositoryRoot);
+	const head = (await git(repositoryRoot, ["rev-parse", "HEAD"], void 0, {}, input.signal)).stdout.toString("utf8").trim();
+	const headTree = (await git(repositoryRoot, ["rev-parse", "HEAD^{tree}"], void 0, {}, input.signal)).stdout.toString("utf8").trim();
+	if (head !== input.baseCommit || headTree !== input.baseTree) throw new Error("Pier task outcome repository drifted from its signed base");
+	const gitDir = resolve((await git(repositoryRoot, ["rev-parse", "--absolute-git-dir"], void 0, {}, input.signal)).stdout.toString("utf8").trim());
+	if (await realpath(gitDir) !== gitDir || gitDir.includes(":")) throw new Error("Pier task outcome Git directory is unsupported");
+	if ((await git(repositoryRoot, [
+		"for-each-ref",
+		"--format=%(refname)",
+		"refs/replace"
+	], void 0, {}, input.signal)).stdout.toString("utf8").trim()) throw new Error("Pier task outcome repository contains Git replace refs");
+	const temporary = await mkdtemp(join(tmpdir(), "pier-task-outcome-"));
+	try {
+		const objectDirectory = join(temporary, "objects");
+		const indexFile = join(temporary, "index");
+		await mkdir(objectDirectory);
+		const environment = {
+			GIT_INDEX_FILE: indexFile,
+			GIT_OBJECT_DIRECTORY: objectDirectory,
+			GIT_ALTERNATE_OBJECT_DIRECTORIES: join(gitDir, "objects")
+		};
+		await git(repositoryRoot, ["read-tree", input.baseTree], void 0, environment, input.signal);
+		const patch = Uint8Array.from(input.patch);
+		if (patch.byteLength > 0) await git(repositoryRoot, [
+			"apply",
+			"--cached",
+			"--binary",
+			"--whitespace=nowarn",
+			"-"
+		], patch, environment, input.signal);
+		const resultTree = (await git(repositoryRoot, ["write-tree"], void 0, environment, input.signal)).stdout.toString("utf8").trim();
+		const entries = parseTreeEntries((await git(repositoryRoot, [
+			"ls-tree",
+			"-rz",
+			"--full-tree",
+			resultTree
+		], void 0, environment, input.signal)).stdout);
+		if (entries.length === 0) throw new Error("Pier task outcome tree cannot be empty");
+		const captured = await captureAgentCandidateWorkspaceFiles(await Promise.all(entries.map(async (entry) => {
+			if (entry.type !== "blob" || entry.mode !== "100644" && entry.mode !== "100755") throw new Error(`Pier task outcome contains a non-regular entry: ${entry.path}`);
+			return {
+				path: safeGitPath(entry.path),
+				mode: entry.mode === "100755" ? 493 : 420,
+				bytes: (await git(repositoryRoot, [
+					"cat-file",
+					"blob",
+					entry.object
+				], void 0, environment, input.signal)).stdout
+			};
+		})), { limits: { maxEmbeddedArtifactBytes: 512 * 1024 * 1024 } });
+		return {
+			kind: "workspace",
+			resultTree,
+			afterState: captured.snapshot.material,
+			archive: captured.archive,
+			gitDiff: patch
+		};
+	} finally {
+		await rm(temporary, {
+			recursive: true,
+			force: true
+		});
+	}
 }
 function parseTreeEntries(bytes) {
-  const raw = Buffer.from(bytes);
-  const decoded = raw.toString("utf8");
-  if (!Buffer.from(decoded, "utf8").equals(raw)) {
-    throw new Error("Pier task outcome contains a non-UTF-8 path");
-  }
-  return decoded.split("\0").filter(Boolean).map((row) => {
-    const tab = row.indexOf("	");
-    const [mode, type, object] = row.slice(0, tab).split(" ");
-    const path = row.slice(tab + 1);
-    if (tab < 1 || !mode || !type || !object || !path) {
-      throw new Error("Pier task outcome contains a malformed Git entry");
-    }
-    return { mode, type, object, path };
-  });
+	const raw = Buffer.from(bytes);
+	const decoded = raw.toString("utf8");
+	if (!Buffer.from(decoded, "utf8").equals(raw)) throw new Error("Pier task outcome contains a non-UTF-8 path");
+	return decoded.split("\0").filter(Boolean).map((row) => {
+		const tab = row.indexOf("	");
+		const [mode, type, object] = row.slice(0, tab).split(" ");
+		const path = row.slice(tab + 1);
+		if (tab < 1 || !mode || !type || !object || !path) throw new Error("Pier task outcome contains a malformed Git entry");
+		return {
+			mode,
+			type,
+			object,
+			path
+		};
+	});
 }
 function safeGitPath(path) {
-  const parts = path.split("/");
-  if (!path || path.startsWith("/") || path.includes("\\") || path.includes("\0") || parts.some((part) => !part || part === "." || part === "..") || parts[0]?.toLowerCase() === ".git") {
-    throw new Error(`Pier task outcome contains an unsafe Git path: ${path}`);
-  }
-  return path;
+	const parts = path.split("/");
+	if (!path || path.startsWith("/") || path.includes("\\") || path.includes("\0") || parts.some((part) => !part || part === "." || part === "..") || parts[0]?.toLowerCase() === ".git") throw new Error(`Pier task outcome contains an unsafe Git path: ${path}`);
+	return path;
 }
 async function git(repositoryRoot, args, input, extraEnvironment, signal) {
-  signal?.throwIfAborted();
-  const environment = Object.fromEntries(
-    Object.entries(process.env).filter(([name]) => !name.startsWith("GIT_"))
-  );
-  Object.assign(environment, {
-    GIT_CONFIG_NOSYSTEM: "1",
-    GIT_CONFIG_GLOBAL: "/dev/null",
-    GIT_CONFIG_SYSTEM: "/dev/null",
-    GIT_TERMINAL_PROMPT: "0",
-    GIT_NO_REPLACE_OBJECTS: "1",
-    LC_ALL: "C",
-    ...extraEnvironment
-  });
-  return await new Promise((resolveResult, reject) => {
-    const child = spawn(
-      "git",
-      [
-        "-c",
-        "core.hooksPath=/dev/null",
-        "-c",
-        "protocol.file.allow=never",
-        "-C",
-        repositoryRoot,
-        ...args
-      ],
-      { env: environment, stdio: ["pipe", "pipe", "pipe"], signal }
-    );
-    const stdout = [];
-    const stderr = [];
-    let outputBytes = 0;
-    const collect = (target) => (chunk) => {
-      outputBytes += chunk.byteLength;
-      if (outputBytes > 64 * 1024 * 1024) {
-        child.kill("SIGKILL");
-        reject(new Error(`git ${args[0] ?? "<command>"} exceeded the output limit`));
-        return;
-      }
-      target.push(Buffer.from(chunk));
-    };
-    child.stdout.on("data", collect(stdout));
-    child.stderr.on("data", collect(stderr));
-    child.once("error", reject);
-    child.once("close", (code, childSignal) => {
-      const out = Buffer.concat(stdout);
-      const err = Buffer.concat(stderr);
-      if (code !== 0) {
-        reject(
-          new Error(
-            `git ${args[0] ?? "<command>"} failed (${childSignal ?? code}): ${err.toString("utf8").trim()}`
-          )
-        );
-        return;
-      }
-      resolveResult({ stdout: out, stderr: err });
-    });
-    child.stdin.end(input);
-  });
-}
-
-// src/pier-agent.ts
-var adapterImportPath = "pier_agents.tangle_candidate:TangleCandidateAgent";
-var sha256Pattern = /^sha256:[a-f0-9]{64}$/;
+	signal?.throwIfAborted();
+	const environment = Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.startsWith("GIT_")));
+	Object.assign(environment, {
+		GIT_CONFIG_NOSYSTEM: "1",
+		GIT_CONFIG_GLOBAL: "/dev/null",
+		GIT_CONFIG_SYSTEM: "/dev/null",
+		GIT_TERMINAL_PROMPT: "0",
+		GIT_NO_REPLACE_OBJECTS: "1",
+		LC_ALL: "C",
+		...extraEnvironment
+	});
+	return await new Promise((resolveResult, reject) => {
+		const child = spawn("git", [
+			"-c",
+			"core.hooksPath=/dev/null",
+			"-c",
+			"protocol.file.allow=never",
+			"-C",
+			repositoryRoot,
+			...args
+		], {
+			env: environment,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			signal
+		});
+		const stdout = [];
+		const stderr = [];
+		let outputBytes = 0;
+		const collect = (target) => (chunk) => {
+			outputBytes += chunk.byteLength;
+			if (outputBytes > 64 * 1024 * 1024) {
+				child.kill("SIGKILL");
+				reject(/* @__PURE__ */ new Error(`git ${args[0] ?? "<command>"} exceeded the output limit`));
+				return;
+			}
+			target.push(Buffer.from(chunk));
+		};
+		child.stdout.on("data", collect(stdout));
+		child.stderr.on("data", collect(stderr));
+		child.once("error", reject);
+		child.once("close", (code, childSignal) => {
+			const out = Buffer.concat(stdout);
+			const err = Buffer.concat(stderr);
+			if (code !== 0) {
+				reject(/* @__PURE__ */ new Error(`git ${args[0] ?? "<command>"} failed (${childSignal ?? code}): ${err.toString("utf8").trim()}`));
+				return;
+			}
+			resolveResult({
+				stdout: out,
+				stderr: err
+			});
+		});
+		child.stdin.end(input);
+	});
+}
+//#endregion
+//#region src/pier-agent.ts
+/** Pier transport for a runtime-prepared immutable candidate execution. */
+const adapterImportPath = "pier_agents.tangle_candidate:TangleCandidateAgent";
+const sha256Pattern$1 = /^sha256:[a-f0-9]{64}$/;
+/** Recovery-only runtime executor for an expired attempt owned by another process. */
 function createPierCandidateRecoveryExecutor(controller) {
-  return {
-    execute: async () => {
-      throw new Error("recovery-only Pier executor cannot start a candidate");
-    },
-    stop: async (request) => {
-      assertTerminationAcknowledged(
-        await controller.terminateAndWait({
-          executionId: request.executionId,
-          executionPlanDigest: request.executionPlanDigest
-        })
-      );
-      return { stopped: true };
-    },
-    capture: async (request) => {
-      const result = await controller.captureResult(request);
-      if (!result) return {};
-      return {
-        evidence: Buffer.from(
-          canonicalJson({
-            schemaVersion: 1,
-            kind: "pier-candidate-recovery-capture",
-            executionPlanDigest: request.executionPlanDigest,
-            officialResult: Buffer.from(result.resultBytes).toString("base64"),
-            taskPatch: Buffer.from(result.taskPatch).toString("base64")
-          })
-        )
-      };
-    }
-  };
-}
-function sha256(bytes) {
-  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
-}
-function nonEmpty(value, label) {
-  if (!value || value.includes("\0")) throw new Error(`${label} must be non-empty without NUL`);
-  return value;
+	return {
+		execute: async () => {
+			throw new Error("recovery-only Pier executor cannot start a candidate");
+		},
+		stop: async (request) => {
+			assertTerminationAcknowledged(await controller.terminateAndWait({
+				executionId: request.executionId,
+				executionPlanDigest: request.executionPlanDigest
+			}));
+			return { stopped: true };
+		},
+		capture: async (request) => {
+			const result = await controller.captureResult(request);
+			if (!result) return {};
+			return { evidence: Buffer.from(canonicalJson({
+				schemaVersion: 1,
+				kind: "pier-candidate-recovery-capture",
+				executionPlanDigest: request.executionPlanDigest,
+				officialResult: Buffer.from(result.resultBytes).toString("base64"),
+				taskPatch: Buffer.from(result.taskPatch).toString("base64")
+			})) };
+		}
+	};
+}
+function sha256$1(bytes) {
+	return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+function nonEmpty$1(value, label) {
+	if (!value || value.includes("\0")) throw new Error(`${label} must be non-empty without NUL`);
+	return value;
 }
 function absoluteHostPath(value, label) {
-  if (!isAbsolute(value)) throw new Error(`${label} must be an absolute host path`);
-  return resolve2(value);
+	if (!isAbsolute(value)) throw new Error(`${label} must be an absolute host path`);
+	return resolve(value);
 }
 function digest(value, label) {
-  if (!sha256Pattern.test(value)) throw new Error(`${label} is not a SHA-256 digest`);
-  return value;
+	if (!sha256Pattern$1.test(value)) throw new Error(`${label} is not a SHA-256 digest`);
+	return value;
 }
 function record(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return value;
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value;
 }
 function parseExactJson(bytes, label) {
-  try {
-    return JSON.parse(Buffer.from(bytes).toString("utf8"));
-  } catch (error) {
-    throw new Error(`${label} bytes are not UTF-8 JSON`, { cause: error });
-  }
+	try {
+		return JSON.parse(Buffer.from(bytes).toString("utf8"));
+	} catch (error) {
+		throw new Error(`${label} bytes are not UTF-8 JSON`, { cause: error });
+	}
 }
 function safeRelativePath(value, label) {
-  const parts = value.split("/");
-  if (!value || value.includes("\0") || value.includes("\\") || isAbsolute(value) || parts.some((part) => !part || part === "." || part === "..")) {
-    throw new Error(`${label} must be a canonical relative POSIX path`);
-  }
-  return value;
-}
-async function assertRealDirectory(path, label) {
-  const stats = await lstat(path);
-  if (!stats.isDirectory() || stats.isSymbolicLink()) {
-    throw new Error(`${label} must be a real directory`);
-  }
-  if (await realpath2(path) !== path) {
-    throw new Error(`${label} has a symlinked path component`);
-  }
+	const parts = value.split("/");
+	if (!value || value.includes("\0") || value.includes("\\") || isAbsolute(value) || parts.some((part) => !part || part === "." || part === "..")) throw new Error(`${label} must be a canonical relative POSIX path`);
+	return value;
+}
+async function assertRealDirectory$1(path, label) {
+	const stats = await lstat(path);
+	if (!stats.isDirectory() || stats.isSymbolicLink()) throw new Error(`${label} must be a real directory`);
+	if (await realpath(path) !== path) throw new Error(`${label} has a symlinked path component`);
 }
 async function materializeExecutorFiles(root, files, expected, label) {
-  const expectedByPath = new Map(expected.map((file) => [file.path, file]));
-  if (expectedByPath.size !== expected.length || files.length !== expected.length) {
-    throw new Error(`${label} file set differs from signed evidence`);
-  }
-  await mkdir2(root, { mode: 448 });
-  await assertRealDirectory(root, label);
-  for (const file of files) {
-    const relative = safeRelativePath(file.path, `${label} file path`);
-    const identity = expectedByPath.get(relative);
-    if (!identity) throw new Error(`${label} contains unsigned file ${relative}`);
-    if (file.mode !== identity.mode || sha256(file.bytes) !== identity.sha256 || identity.byteLength !== void 0 && file.bytes.byteLength !== identity.byteLength) {
-      throw new Error(`${label} file ${relative} differs from signed evidence`);
-    }
-    const target = join2(root, relative);
-    const parent = dirname(target);
-    if (parent !== root) await mkdir2(parent, { recursive: true, mode: 448 });
-    await writeFile(target, file.bytes, { flag: "wx", mode: 384 });
-    await chmod(target, file.mode);
-    const stats = await lstat(target);
-    if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink !== 1 || (stats.mode & 511) !== file.mode) {
-      throw new Error(`${label} file ${relative} is not a singly-linked regular file`);
-    }
-  }
+	const expectedByPath = new Map(expected.map((file) => [file.path, file]));
+	if (expectedByPath.size !== expected.length || files.length !== expected.length) throw new Error(`${label} file set differs from signed evidence`);
+	await mkdir(root, { mode: 448 });
+	await assertRealDirectory$1(root, label);
+	for (const file of files) {
+		const relative = safeRelativePath(file.path, `${label} file path`);
+		const identity = expectedByPath.get(relative);
+		if (!identity) throw new Error(`${label} contains unsigned file ${relative}`);
+		if (file.mode !== identity.mode || sha256$1(file.bytes) !== identity.sha256 || identity.byteLength !== void 0 && file.bytes.byteLength !== identity.byteLength) throw new Error(`${label} file ${relative} differs from signed evidence`);
+		const target = join(root, relative);
+		const parent = dirname(target);
+		if (parent !== root) await mkdir(parent, {
+			recursive: true,
+			mode: 448
+		});
+		await writeFile(target, file.bytes, {
+			flag: "wx",
+			mode: 384
+		});
+		await chmod(target, file.mode);
+		const stats = await lstat(target);
+		if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink !== 1 || (stats.mode & 511) !== file.mode) throw new Error(`${label} file ${relative} is not a singly-linked regular file`);
+	}
 }
 function protectedEnvironment(prepared, request) {
-  const protectedEntries = [];
-  for (const [name, value] of Object.entries(request.launch.env)) {
-    const publicValue = prepared.launch.env[name];
-    if (publicValue === void 0) {
-      protectedEntries.push([name, value]);
-    } else if (publicValue !== value) {
-      throw new Error(`executor request changed signed public environment ${name}`);
-    }
-  }
-  for (const name of Object.keys(prepared.launch.env)) {
-    if (!(name in request.launch.env)) {
-      throw new Error(`executor request omitted signed public environment ${name}`);
-    }
-  }
-  return Object.freeze(Object.fromEntries(protectedEntries));
-}
+	const protectedEntries = [];
+	for (const [name, value] of Object.entries(request.launch.env)) {
+		const publicValue = prepared.launch.env[name];
+		if (publicValue === void 0) protectedEntries.push([name, value]);
+		else if (publicValue !== value) throw new Error(`executor request changed signed public environment ${name}`);
+	}
+	for (const name of Object.keys(prepared.launch.env)) if (!(name in request.launch.env)) throw new Error(`executor request omitted signed public environment ${name}`);
+	return Object.freeze(Object.fromEntries(protectedEntries));
+}
+/**
+* Persist the runtime's exact canonical bytes and return only Pier transport
+* arguments. No benchmark-specific plan or candidate-authored telemetry exists.
+*/
+/** @internal Package-private transport seam exercised by adapter tests. */
 async function stagePreparedPierCandidateExecution(options, request) {
-  const { prepared } = options;
-  nonEmpty(options.pierVersion, "pierVersion");
-  const directory = absoluteHostPath(options.directory, "directory");
-  await mkdir2(directory, { mode: 448 });
-  await assertRealDirectory(directory, "directory");
-  if (request.memory.mode !== "disabled") {
-    throw new Error("Pier transport does not yet implement protected isolated memory");
-  }
-  const taskDirectory = join2(directory, "task");
-  const candidateDirectory = request.inputs.candidate ? join2(directory, "candidate") : void 0;
-  const profileDirectory = join2(directory, "profile");
-  await materializeExecutorFiles(
-    taskDirectory,
-    request.inputs.task.files,
-    request.inputs.task.snapshot.material.files,
-    "task executor input"
-  );
-  if (request.inputs.candidate && candidateDirectory) {
-    await materializeExecutorFiles(
-      candidateDirectory,
-      request.inputs.candidate.files,
-      request.inputs.candidate.snapshot.material.files,
-      "candidate executor input"
-    );
-  }
-  await materializeExecutorFiles(
-    profileDirectory,
-    request.profileActivation.files.map((file) => ({
-      path: file.path,
-      mode: file.mode,
-      bytes: Buffer.from(file.content, "utf8")
-    })),
-    request.profilePlan.value.material.files.map((file) => ({
-      path: file.relPath,
-      mode: file.mode,
-      sha256: file.contentSha256
-    })),
-    "profile executor input"
-  );
-  const planDigest = digest(request.executionPlan.value.digest, "execution plan digest");
-  if (sha256(request.executionPlan.bytes) !== planDigest) {
-    throw new Error("prepared execution-plan bytes do not match their runtime digest");
-  }
-  assert.deepEqual(
-    parseExactJson(request.executionPlan.bytes, "execution plan"),
-    request.executionPlan.value.material,
-    "prepared execution-plan bytes differ from runtime material"
-  );
-  const receiptDigest = digest(
-    request.materializationReceipt.digest,
-    "materialization receipt digest"
-  );
-  if (sha256(request.materializationReceipt.bytes) !== receiptDigest) {
-    throw new Error("prepared materialization-receipt bytes do not match their runtime digest");
-  }
-  const { digest: _receiptDigest, ...receiptMaterial } = request.materializationReceipt.value;
-  assert.deepEqual(
-    parseExactJson(request.materializationReceipt.bytes, "materialization receipt"),
-    receiptMaterial,
-    "prepared receipt bytes differ from runtime material"
-  );
-  const planPath = join2(directory, "execution-plan.json");
-  const receiptPath = join2(directory, "materialization-receipt.json");
-  await Promise.all([
-    writeFile(planPath, request.executionPlan.bytes, { mode: 384, flag: "wx" }),
-    writeFile(receiptPath, request.materializationReceipt.bytes, { mode: 384, flag: "wx" })
-  ]);
-  const agentArgs = [
-    "--agent-import-path",
-    adapterImportPath,
-    "--model",
-    nonEmpty(request.resolvedModel.requested, "resolved requested model"),
-    "--agent-kwarg",
-    `plan_path=${planPath}`,
-    "--agent-kwarg",
-    `receipt_path=${receiptPath}`,
-    "--agent-kwarg",
-    `expected_receipt_digest=${receiptDigest}`,
-    "--agent-kwarg",
-    `trace_run_id=${nonEmpty(request.trace.runId, "trace run id")}`,
-    "--agent-kwarg",
-    `task_dir=${taskDirectory}`,
-    "--agent-kwarg",
-    `profile_dir=${profileDirectory}`,
-    "--agent-kwarg",
-    `pier_version=${options.pierVersion}`
-  ];
-  if (candidateDirectory !== void 0) {
-    agentArgs.push("--agent-kwarg", `candidate_dir=${candidateDirectory}`);
-  }
-  return {
-    executionId: request.executionId,
-    directory,
-    taskDirectory,
-    ...candidateDirectory ? { candidateDirectory } : {},
-    profileDirectory,
-    planPath,
-    receiptPath,
-    agentArgs,
-    evaluatorEnv: protectedEnvironment(prepared, request),
-    attemptArgs: ["--n-attempts", "1", "--max-retries", "0"]
-  };
+	const { prepared } = options;
+	nonEmpty$1(options.pierVersion, "pierVersion");
+	const directory = absoluteHostPath(options.directory, "directory");
+	await mkdir(directory, { mode: 448 });
+	await assertRealDirectory$1(directory, "directory");
+	if (request.memory.mode !== "disabled") throw new Error("Pier transport does not yet implement protected isolated memory");
+	const taskDirectory = join(directory, "task");
+	const candidateDirectory = request.inputs.candidate ? join(directory, "candidate") : void 0;
+	const profileDirectory = join(directory, "profile");
+	await materializeExecutorFiles(taskDirectory, request.inputs.task.files, request.inputs.task.snapshot.material.files, "task executor input");
+	if (request.inputs.candidate && candidateDirectory) await materializeExecutorFiles(candidateDirectory, request.inputs.candidate.files, request.inputs.candidate.snapshot.material.files, "candidate executor input");
+	await materializeExecutorFiles(profileDirectory, request.profileActivation.files.map((file) => ({
+		path: file.path,
+		mode: file.mode,
+		bytes: Buffer.from(file.content, "utf8")
+	})), request.profilePlan.value.material.files.map((file) => ({
+		path: file.relPath,
+		mode: file.mode,
+		sha256: file.contentSha256
+	})), "profile executor input");
+	const planDigest = digest(request.executionPlan.value.digest, "execution plan digest");
+	if (sha256$1(request.executionPlan.bytes) !== planDigest) throw new Error("prepared execution-plan bytes do not match their runtime digest");
+	assert.deepEqual(parseExactJson(request.executionPlan.bytes, "execution plan"), request.executionPlan.value.material, "prepared execution-plan bytes differ from runtime material");
+	const receiptDigest = digest(request.materializationReceipt.digest, "materialization receipt digest");
+	if (sha256$1(request.materializationReceipt.bytes) !== receiptDigest) throw new Error("prepared materialization-receipt bytes do not match their runtime digest");
+	const { digest: _receiptDigest, ...receiptMaterial } = request.materializationReceipt.value;
+	assert.deepEqual(parseExactJson(request.materializationReceipt.bytes, "materialization receipt"), receiptMaterial, "prepared receipt bytes differ from runtime material");
+	const planPath = join(directory, "execution-plan.json");
+	const receiptPath = join(directory, "materialization-receipt.json");
+	await Promise.all([writeFile(planPath, request.executionPlan.bytes, {
+		mode: 384,
+		flag: "wx"
+	}), writeFile(receiptPath, request.materializationReceipt.bytes, {
+		mode: 384,
+		flag: "wx"
+	})]);
+	const agentArgs = [
+		"--agent-import-path",
+		adapterImportPath,
+		"--model",
+		nonEmpty$1(request.resolvedModel.requested, "resolved requested model"),
+		"--agent-kwarg",
+		`plan_path=${planPath}`,
+		"--agent-kwarg",
+		`receipt_path=${receiptPath}`,
+		"--agent-kwarg",
+		`expected_receipt_digest=${receiptDigest}`,
+		"--agent-kwarg",
+		`trace_run_id=${nonEmpty$1(request.trace.runId, "trace run id")}`,
+		"--agent-kwarg",
+		`task_dir=${taskDirectory}`,
+		"--agent-kwarg",
+		`profile_dir=${profileDirectory}`,
+		"--agent-kwarg",
+		`pier_version=${options.pierVersion}`
+	];
+	if (candidateDirectory !== void 0) agentArgs.push("--agent-kwarg", `candidate_dir=${candidateDirectory}`);
+	return {
+		executionId: request.executionId,
+		directory,
+		taskDirectory,
+		...candidateDirectory ? { candidateDirectory } : {},
+		profileDirectory,
+		planPath,
+		receiptPath,
+		agentArgs,
+		evaluatorEnv: protectedEnvironment(prepared, request),
+		attemptArgs: [
+			"--n-attempts",
+			"1",
+			"--max-retries",
+			"0"
+		]
+	};
 }
 function exceptionType(value) {
-  const info = value && typeof value === "object" ? value : void 0;
-  for (const key of ["exception_type", "type", "name"]) {
-    if (typeof info?.[key] === "string") return info[key];
-  }
-  return void 0;
-}
+	const info = value && typeof value === "object" ? value : void 0;
+	for (const key of [
+		"exception_type",
+		"type",
+		"name"
+	]) if (typeof info?.[key] === "string") return info[key];
+}
+/** Read only identity and termination from Pier; usage always comes from agent-eval. */
+/** @internal Package-private result parser exercised by adapter tests. */
 function protectedCaptureFromPierResult(request, value) {
-  const result = record(value, "Pier trial result");
-  const agentResult = record(result.agent_result, "Pier agent_result");
-  const metadata = record(agentResult.metadata, "Pier agent_result.metadata");
-  const expected = {
-    executionId: request.executionId,
-    bundleDigest: request.executionPlan.value.material.runCell.bundleDigest,
-    executionPlanDigest: request.executionPlan.value.digest,
-    materializationReceiptDigest: request.materializationReceipt.digest
-  };
-  for (const [name, identity] of Object.entries(expected)) {
-    if (metadata[name] !== identity) {
-      throw new Error(`Pier result ${name} does not match the prepared execution`);
-    }
-  }
-  const reported = record(metadata.termination, "Pier termination");
-  const type = exceptionType(result.exception_info);
-  if (type?.includes("AgentTimeout")) {
-    return {
-      executionId: request.executionId,
-      termination: {
-        kind: "timeout",
-        timeoutMs: request.hardLimits.timeoutMs
-      }
-    };
-  }
-  if (type?.includes("Cancelled") || reported.kind === "cancelled") {
-    return { executionId: request.executionId, termination: { kind: "cancelled" } };
-  }
-  if (reported.kind === "exit" && Number.isInteger(reported.exitCode)) {
-    return {
-      executionId: request.executionId,
-      termination: { kind: "exit", exitCode: reported.exitCode }
-    };
-  }
-  throw new Error(`Pier result has no recognized truthful termination${type ? ` (${type})` : ""}`);
+	const result = record(value, "Pier trial result");
+	const metadata = record(record(result.agent_result, "Pier agent_result").metadata, "Pier agent_result.metadata");
+	const expected = {
+		executionId: request.executionId,
+		bundleDigest: request.executionPlan.value.material.runCell.bundleDigest,
+		executionPlanDigest: request.executionPlan.value.digest,
+		materializationReceiptDigest: request.materializationReceipt.digest
+	};
+	for (const [name, identity] of Object.entries(expected)) if (metadata[name] !== identity) throw new Error(`Pier result ${name} does not match the prepared execution`);
+	const reported = record(metadata.termination, "Pier termination");
+	const type = exceptionType(result.exception_info);
+	if (type?.includes("AgentTimeout")) return {
+		executionId: request.executionId,
+		termination: {
+			kind: "timeout",
+			timeoutMs: request.hardLimits.timeoutMs
+		}
+	};
+	if (type?.includes("Cancelled") || reported.kind === "cancelled") return {
+		executionId: request.executionId,
+		termination: { kind: "cancelled" }
+	};
+	if (reported.kind === "exit" && Number.isInteger(reported.exitCode)) return {
+		executionId: request.executionId,
+		termination: {
+			kind: "exit",
+			exitCode: reported.exitCode
+		}
+	};
+	throw new Error(`Pier result has no recognized truthful termination${type ? ` (${type})` : ""}`);
 }
 function sealPierTrialResult(value) {
-  if (!(value.resultBytes instanceof Uint8Array) || !(value.taskPatch instanceof Uint8Array)) {
-    throw new Error("Pier trial result must contain raw result and patch bytes");
-  }
-  const parsed = parseExactJson(value.resultBytes, "Pier result.json");
-  assert.deepEqual(parsed, value.value, "Pier parsed result differs from result.json bytes");
-  const resultBytes = Uint8Array.from(value.resultBytes);
-  const taskPatch = Uint8Array.from(value.taskPatch);
-  return Object.freeze({
-    value: parsed,
-    get resultBytes() {
-      return Uint8Array.from(resultBytes);
-    },
-    get taskPatch() {
-      return Uint8Array.from(taskPatch);
-    }
-  });
+	if (!(value.resultBytes instanceof Uint8Array) || !(value.taskPatch instanceof Uint8Array)) throw new Error("Pier trial result must contain raw result and patch bytes");
+	const parsed = parseExactJson(value.resultBytes, "Pier result.json");
+	assert.deepEqual(parsed, value.value, "Pier parsed result differs from result.json bytes");
+	const resultBytes = Uint8Array.from(value.resultBytes);
+	const taskPatch = Uint8Array.from(value.taskPatch);
+	return Object.freeze({
+		value: parsed,
+		get resultBytes() {
+			return Uint8Array.from(resultBytes);
+		},
+		get taskPatch() {
+			return Uint8Array.from(taskPatch);
+		}
+	});
 }
 function abortReason(signal) {
-  const reason = signal.reason;
-  if (reason instanceof Error) return reason;
-  return new Error(`Pier candidate execution aborted${reason ? `: ${String(reason)}` : ""}`);
+	const reason = signal.reason;
+	if (reason instanceof Error) return reason;
+	return /* @__PURE__ */ new Error(`Pier candidate execution aborted${reason ? `: ${String(reason)}` : ""}`);
 }
 function assertTerminationAcknowledged(acknowledgement) {
-  if (acknowledgement.processExited !== true || acknowledgement.containersRemoved !== true) {
-    throw new Error("Pier termination did not acknowledge process and container death");
-  }
+	if (acknowledgement.processExited !== true || acknowledgement.containersRemoved !== true) throw new Error("Pier termination did not acknowledge process and container death");
 }
+/** @internal Package-private cancellation seam exercised by adapter tests. */
 async function awaitAbortableTrial(trial, signal) {
-  if (signal.aborted) {
-    assertTerminationAcknowledged(await trial.terminateAndWait());
-    throw abortReason(signal);
-  }
-  return await new Promise((resolveResult, reject) => {
-    let settled = false;
-    let aborting = false;
-    const settle = (callback) => {
-      if (settled) return;
-      settled = true;
-      signal.removeEventListener("abort", onAbort);
-      callback();
-    };
-    const onAbort = () => {
-      aborting = true;
-      void trial.terminateAndWait().then(
-        (acknowledgement) => {
-          try {
-            assertTerminationAcknowledged(acknowledgement);
-            settle(() => reject(abortReason(signal)));
-          } catch (error) {
-            settle(() => reject(error));
-          }
-        },
-        (error) => settle(() => reject(new Error("Pier termination failed", { cause: error })))
-      );
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-    trial.result.then(
-      (result) => {
-        if (!aborting && !signal.aborted) settle(() => resolveResult(result));
-      },
-      (error) => {
-        if (!aborting && !signal.aborted) settle(() => reject(error));
-      }
-    );
-  });
-}
+	if (signal.aborted) {
+		assertTerminationAcknowledged(await trial.terminateAndWait());
+		throw abortReason(signal);
+	}
+	return await new Promise((resolveResult, reject) => {
+		let settled = false;
+		let aborting = false;
+		const settle = (callback) => {
+			if (settled) return;
+			settled = true;
+			signal.removeEventListener("abort", onAbort);
+			callback();
+		};
+		const onAbort = () => {
+			aborting = true;
+			trial.terminateAndWait().then((acknowledgement) => {
+				try {
+					assertTerminationAcknowledged(acknowledgement);
+					settle(() => reject(abortReason(signal)));
+				} catch (error) {
+					settle(() => reject(error));
+				}
+			}, (error) => settle(() => reject(new Error("Pier termination failed", { cause: error }))));
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+		trial.result.then((result) => {
+			if (!aborting && !signal.aborted) settle(() => resolveResult(result));
+		}, (error) => {
+			if (!aborting && !signal.aborted) settle(() => reject(error));
+		});
+	});
+}
+/** Execute and finalize through the runtime's only gradable candidate path. */
 async function executePreparedPierCandidate(options) {
-  const trials = /* @__PURE__ */ new Map();
-  const officialResults = /* @__PURE__ */ new Map();
-  const trialIdentity = (executionId, executionPlanDigest) => JSON.stringify([executionId, executionPlanDigest]);
-  const executor = {
-    execute: async (request, context) => {
-      context.signal.throwIfAborted();
-      const staged = await stagePreparedPierCandidateExecution(options, request);
-      context.signal.throwIfAborted();
-      const identity = trialIdentity(request.executionId, request.executionPlan.value.digest);
-      if (trials.has(identity)) throw new Error("Pier trial identity is already active");
-      const trial = options.controller.start(staged, {
-        request,
-        traceStore: context.traceStore,
-        signal: context.signal,
-        deadlineAtMs: context.deadlineAtMs
-      });
-      if (trial.identity.executionId !== request.executionId || trial.identity.executionPlanDigest !== request.executionPlan.value.digest) {
-        assertTerminationAcknowledged(await trial.terminateAndWait());
-        throw new Error("Pier controller returned a different durable trial identity");
-      }
-      const active = { handle: trial };
-      trials.set(identity, active);
-      const result = sealPierTrialResult(await awaitAbortableTrial(trial, context.signal));
-      active.result = result;
-      officialResults.set(request.executionId, result);
-      return protectedCaptureFromPierResult(request, result.value);
-    },
-    stop: async (request) => {
-      assertTerminationAcknowledged(
-        await options.controller.terminateAndWait({
-          executionId: request.executionId,
-          executionPlanDigest: request.executionPlanDigest
-        })
-      );
-      return { stopped: true };
-    },
-    capture: async (request) => {
-      const identity = trialIdentity(request.executionId, request.executionPlanDigest);
-      const active = trials.get(identity);
-      let result = active?.result;
-      if (!result && active) {
-        try {
-          result = sealPierTrialResult(await active.handle.result);
-        } catch {
-          result = void 0;
-        }
-      }
-      if (!result) {
-        const recovered = await options.controller.captureResult(request);
-        result = recovered ? sealPierTrialResult(recovered) : void 0;
-      }
-      if (!result) return {};
-      officialResults.set(request.executionId, result);
-      const task = options.prepared.benchmark.task;
-      const outcome = task.outcome;
-      if (outcome.kind !== "workspace") {
-        throw new Error("Pier candidate execution requires a workspace task outcome");
-      }
-      const repository = task.repository;
-      if (!repository) throw new Error("Pier workspace task is missing repository identity");
-      const taskOutcome = await capturePierTaskOutcome({
-        repositoryRoot: options.prepared.roots.staging.taskRoot,
-        baseCommit: repository.baseCommit,
-        baseTree: repository.baseTree,
-        patch: result.taskPatch
-      });
-      trials.delete(identity);
-      return { taskOutcome };
-    }
-  };
-  const grader = {
-    name: options.grader.name,
-    version: options.grader.version,
-    artifact: options.grader.artifact,
-    run: async (input) => {
-      const official = officialResults.get(input.executionId);
-      if (!official) throw new Error("Pier official result is missing for executable grading");
-      return await options.grader.run({
-        ...input,
-        officialResult: {
-          value: parseExactJson(official.resultBytes, "Pier result.json"),
-          bytes: Uint8Array.from(official.resultBytes)
-        }
-      });
-    }
-  };
-  try {
-    return await executePreparedAgentCandidate(options.prepared, {
-      executor,
-      grader,
-      outputArtifacts: options.outputArtifacts,
-      traceStore: options.traceStore,
-      claimStore: options.claimStore
-    });
-  } finally {
-    officialResults.clear();
-    trials.clear();
-  }
-}
-
-// src/pier-trial-controller.ts
-import { execFileSync, spawn as spawn2 } from "child_process";
-import { createHash as createHash2 } from "crypto";
-import {
-  accessSync,
-  closeSync,
-  constants,
-  existsSync,
-  fsyncSync,
-  lstatSync,
-  mkdirSync as mkdirSync2,
-  openSync,
-  readFileSync,
-  readdirSync,
-  realpathSync,
-  renameSync,
-  rmSync,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { isAbsolute as isAbsolute2, join as join3, resolve as resolve3 } from "path";
-import { fileURLToPath } from "url";
-var identityFile = "identity.json";
-var terminalFile = "terminal.json";
-var stopFile = "stop-requested";
-var sha256Pattern2 = /^sha256:[a-f0-9]{64}$/;
-var defaultDockerConnectionId = "local-default";
-function nonEmpty2(value, label) {
-  if (!value || value.includes("\0")) throw new Error(`${label} must be non-empty without NUL`);
-  return value;
+	const trials = /* @__PURE__ */ new Map();
+	const officialResults = /* @__PURE__ */ new Map();
+	const trialIdentity = (executionId, executionPlanDigest) => JSON.stringify([executionId, executionPlanDigest]);
+	const executor = {
+		execute: async (request, context) => {
+			context.signal.throwIfAborted();
+			const staged = await stagePreparedPierCandidateExecution(options, request);
+			context.signal.throwIfAborted();
+			const identity = trialIdentity(request.executionId, request.executionPlan.value.digest);
+			if (trials.has(identity)) throw new Error("Pier trial identity is already active");
+			const trial = options.controller.start(staged, {
+				request,
+				traceStore: context.traceStore,
+				signal: context.signal,
+				deadlineAtMs: context.deadlineAtMs
+			});
+			if (trial.identity.executionId !== request.executionId || trial.identity.executionPlanDigest !== request.executionPlan.value.digest) {
+				assertTerminationAcknowledged(await trial.terminateAndWait());
+				throw new Error("Pier controller returned a different durable trial identity");
+			}
+			const active = { handle: trial };
+			trials.set(identity, active);
+			const result = sealPierTrialResult(await awaitAbortableTrial(trial, context.signal));
+			active.result = result;
+			officialResults.set(request.executionId, result);
+			return protectedCaptureFromPierResult(request, result.value);
+		},
+		stop: async (request) => {
+			assertTerminationAcknowledged(await options.controller.terminateAndWait({
+				executionId: request.executionId,
+				executionPlanDigest: request.executionPlanDigest
+			}));
+			return { stopped: true };
+		},
+		capture: async (request) => {
+			const identity = trialIdentity(request.executionId, request.executionPlanDigest);
+			const active = trials.get(identity);
+			let result = active?.result;
+			if (!result && active) try {
+				result = sealPierTrialResult(await active.handle.result);
+			} catch {
+				result = void 0;
+			}
+			if (!result) {
+				const recovered = await options.controller.captureResult(request);
+				result = recovered ? sealPierTrialResult(recovered) : void 0;
+			}
+			if (!result) return {};
+			officialResults.set(request.executionId, result);
+			const task = options.prepared.benchmark.task;
+			if (task.outcome.kind !== "workspace") throw new Error("Pier candidate execution requires a workspace task outcome");
+			const repository = task.repository;
+			if (!repository) throw new Error("Pier workspace task is missing repository identity");
+			const taskOutcome = await capturePierTaskOutcome({
+				repositoryRoot: options.prepared.roots.staging.taskRoot,
+				baseCommit: repository.baseCommit,
+				baseTree: repository.baseTree,
+				patch: result.taskPatch
+			});
+			trials.delete(identity);
+			return { taskOutcome };
+		}
+	};
+	const grader = {
+		name: options.grader.name,
+		version: options.grader.version,
+		artifact: options.grader.artifact,
+		run: async (input) => {
+			const official = officialResults.get(input.executionId);
+			if (!official) throw new Error("Pier official result is missing for executable grading");
+			return await options.grader.run({
+				...input,
+				officialResult: {
+					value: parseExactJson(official.resultBytes, "Pier result.json"),
+					bytes: Uint8Array.from(official.resultBytes)
+				}
+			});
+		}
+	};
+	try {
+		return await executePreparedAgentCandidate(options.prepared, {
+			executor,
+			grader,
+			outputArtifacts: options.outputArtifacts,
+			traceStore: options.traceStore,
+			claimStore: options.claimStore
+		});
+	} finally {
+		officialResults.clear();
+		trials.clear();
+	}
+}
+//#endregion
+//#region src/pier-trial-controller.ts
+/** Restart-safe evaluator ownership for one Pier process and its Docker projects. */
+const identityFile = "identity.json";
+const terminalFile = "terminal.json";
+const stopFile = "stop-requested";
+const sha256Pattern = /^sha256:[a-f0-9]{64}$/;
+const defaultDockerConnectionId = "local-default";
+function nonEmpty(value, label) {
+	if (!value || value.includes("\0")) throw new Error(`${label} must be non-empty without NUL`);
+	return value;
 }
 function stableDockerConnectionId(value) {
-  if (!/^[A-Za-z0-9._:-]{1,200}$/.test(value)) {
-    throw new Error("Docker connection id must be a non-secret stable name");
-  }
-  return value;
+	if (!/^[A-Za-z0-9._:-]{1,200}$/.test(value)) throw new Error("Docker connection id must be a non-secret stable name");
+	return value;
 }
 function absolutePath(value, label) {
-  if (!isAbsolute2(value)) throw new Error(`${label} must be an absolute path`);
-  return resolve3(value);
+	if (!isAbsolute(value)) throw new Error(`${label} must be an absolute path`);
+	return resolve(value);
 }
 function validateEnvironment(environment, label) {
-  for (const [name, value] of Object.entries(environment)) {
-    if (!name || name.includes("\0") || value?.includes("\0")) {
-      throw new Error(`${label} contains an invalid name or value`);
-    }
-  }
+	for (const [name, value] of Object.entries(environment)) if (!name || name.includes("\0") || value?.includes("\0")) throw new Error(`${label} contains an invalid name or value`);
 }
 function resolveExecutable(command, searchPath, label) {
-  nonEmpty2(command, label);
-  const candidates = command.includes("/") ? [absolutePath(command, label)] : (searchPath ?? "").split(":").filter(Boolean).map((directory) => join3(directory, command));
-  for (const candidate of candidates) {
-    try {
-      accessSync(candidate, constants.X_OK);
-      return realpathSync(candidate);
-    } catch (error) {
-      if (error.code !== "ENOENT" && error.code !== "EACCES") {
-        throw error;
-      }
-    }
-  }
-  throw new Error(`${label} is not executable on the evaluator PATH`);
+	nonEmpty(command, label);
+	const candidates = command.includes("/") ? [absolutePath(command, label)] : (searchPath ?? "").split(":").filter(Boolean).map((directory) => join(directory, command));
+	for (const candidate of candidates) try {
+		accessSync(candidate, constants.X_OK);
+		return realpathSync(candidate);
+	} catch (error) {
+		if (error.code !== "ENOENT" && error.code !== "EACCES") throw error;
+	}
+	throw new Error(`${label} is not executable on the evaluator PATH`);
 }
 function syncDirectory(directory) {
-  const fd = openSync(directory, "r");
-  try {
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
+	const fd = openSync(directory, "r");
+	try {
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
 }
 function writeJsonAtomic(directory, name, value) {
-  const target = join3(directory, name);
-  const temporary = join3(directory, `.${name}.${process.pid}.${Date.now()}.tmp`);
-  const fd = openSync(temporary, "wx", 384);
-  try {
-    writeFileSync2(fd, `${JSON.stringify(value)}
-`, "utf8");
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-  renameSync(temporary, target);
-  syncDirectory(directory);
+	const target = join(directory, name);
+	const temporary = join(directory, `.${name}.${process.pid}.${Date.now()}.tmp`);
+	const fd = openSync(temporary, "wx", 384);
+	try {
+		writeFileSync(fd, `${JSON.stringify(value)}\n`, "utf8");
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+	renameSync(temporary, target);
+	syncDirectory(directory);
 }
 function touchDurable(directory, name) {
-  try {
-    const fd = openSync(join3(directory, name), "wx", 384);
-    try {
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
-    }
-    syncDirectory(directory);
-  } catch (error) {
-    if (error.code !== "EEXIST") throw error;
-  }
+	try {
+		const fd = openSync(join(directory, name), "wx", 384);
+		try {
+			fsyncSync(fd);
+		} finally {
+			closeSync(fd);
+		}
+		syncDirectory(directory);
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+	}
 }
 function readJson(path, label) {
-  let value;
-  try {
-    value = JSON.parse(readFileSync(path, "utf8"));
-  } catch (error) {
-    throw new Error(`${label} is not valid JSON`, { cause: error });
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return value;
+	let value;
+	try {
+		value = JSON.parse(readFileSync(path, "utf8"));
+	} catch (error) {
+		throw new Error(`${label} is not valid JSON`, { cause: error });
+	}
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value;
 }
 function parseProcessIdentity(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  const record2 = value;
-  if (!Number.isSafeInteger(record2.pid) || !Number.isSafeInteger(record2.processGroupId) || !Number.isSafeInteger(record2.sessionId) || typeof record2.startTicks !== "string" || !/^\d+$/.test(record2.startTicks)) {
-    throw new Error(`${label} is malformed`);
-  }
-  return {
-    pid: record2.pid,
-    processGroupId: record2.processGroupId,
-    sessionId: record2.sessionId,
-    startTicks: record2.startTicks
-  };
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	const record = value;
+	if (!Number.isSafeInteger(record.pid) || !Number.isSafeInteger(record.processGroupId) || !Number.isSafeInteger(record.sessionId) || typeof record.startTicks !== "string" || !/^\d+$/.test(record.startTicks)) throw new Error(`${label} is malformed`);
+	return {
+		pid: record.pid,
+		processGroupId: record.processGroupId,
+		sessionId: record.sessionId,
+		startTicks: record.startTicks
+	};
 }
 function parsePersistedIdentity(path) {
-  const record2 = readJson(path, "Pier trial identity");
-  if (record2.schemaVersion !== 1 || record2.kind !== "pier-trial-identity" || !["allocating", "starting", "running"].includes(record2.state) || typeof record2.executionId !== "string" || typeof record2.executionPlanDigest !== "string" || !sha256Pattern2.test(record2.executionPlanDigest) || typeof record2.jobsDirectory !== "string" || typeof record2.jobName !== "string" || typeof record2.dockerCommand !== "string" || typeof record2.dockerConnectionId !== "string") {
-    throw new Error("Pier trial identity is malformed");
-  }
-  return {
-    schemaVersion: 1,
-    kind: "pier-trial-identity",
-    state: record2.state,
-    executionId: record2.executionId,
-    executionPlanDigest: record2.executionPlanDigest,
-    ...record2.supervisor ? { supervisor: parseProcessIdentity(record2.supervisor, "Pier supervisor identity") } : {},
-    ...record2.pier ? { pier: parseProcessIdentity(record2.pier, "Pier process identity") } : {},
-    jobsDirectory: absolutePath(record2.jobsDirectory, "persisted jobs directory"),
-    jobName: nonEmpty2(record2.jobName, "persisted job name"),
-    dockerCommand: nonEmpty2(record2.dockerCommand, "persisted Docker command"),
-    dockerConnectionId: stableDockerConnectionId(record2.dockerConnectionId)
-  };
+	const record = readJson(path, "Pier trial identity");
+	if (record.schemaVersion !== 1 || record.kind !== "pier-trial-identity" || ![
+		"allocating",
+		"starting",
+		"running"
+	].includes(record.state) || typeof record.executionId !== "string" || typeof record.executionPlanDigest !== "string" || !sha256Pattern.test(record.executionPlanDigest) || typeof record.jobsDirectory !== "string" || typeof record.jobName !== "string" || typeof record.dockerCommand !== "string" || typeof record.dockerConnectionId !== "string") throw new Error("Pier trial identity is malformed");
+	return {
+		schemaVersion: 1,
+		kind: "pier-trial-identity",
+		state: record.state,
+		executionId: record.executionId,
+		executionPlanDigest: record.executionPlanDigest,
+		...record.supervisor ? { supervisor: parseProcessIdentity(record.supervisor, "Pier supervisor identity") } : {},
+		...record.pier ? { pier: parseProcessIdentity(record.pier, "Pier process identity") } : {},
+		jobsDirectory: absolutePath(record.jobsDirectory, "persisted jobs directory"),
+		jobName: nonEmpty(record.jobName, "persisted job name"),
+		dockerCommand: nonEmpty(record.dockerCommand, "persisted Docker command"),
+		dockerConnectionId: stableDockerConnectionId(record.dockerConnectionId)
+	};
 }
 function parseTerminal(path) {
-  const record2 = readJson(path, "Pier trial terminal");
-  const allowedKeys = /* @__PURE__ */ new Set([
-    "schemaVersion",
-    "kind",
-    "status",
-    "processExited",
-    "containersRemoved",
-    "removedContainers",
-    "exitCode",
-    "signal",
-    "error",
-    "recoveredByPid"
-  ]);
-  const hasMalformedOptionalField = record2.removedContainers !== void 0 && (!Number.isSafeInteger(record2.removedContainers) || record2.removedContainers < 0) || record2.exitCode !== void 0 && record2.exitCode !== null && !Number.isSafeInteger(record2.exitCode) || record2.signal !== void 0 && record2.signal !== null && (typeof record2.signal !== "string" || !/^SIG[A-Z0-9]+$/.test(record2.signal)) || record2.error !== void 0 && typeof record2.error !== "string" || record2.recoveredByPid !== void 0 && (!Number.isSafeInteger(record2.recoveredByPid) || record2.recoveredByPid < 1);
-  if (Object.keys(record2).some((key) => !allowedKeys.has(key)) || record2.schemaVersion !== 1 || record2.kind !== "pier-trial-terminal" || !["completed", "stopped", "failed"].includes(record2.status) || typeof record2.processExited !== "boolean" || typeof record2.containersRemoved !== "boolean" || hasMalformedOptionalField) {
-    throw new Error("Pier trial terminal is malformed");
-  }
-  return {
-    schemaVersion: 1,
-    kind: "pier-trial-terminal",
-    status: record2.status,
-    processExited: record2.processExited,
-    containersRemoved: record2.containersRemoved,
-    ...record2.removedContainers !== void 0 ? { removedContainers: record2.removedContainers } : {},
-    ...record2.exitCode !== void 0 ? { exitCode: record2.exitCode } : {},
-    ...record2.signal !== void 0 ? { signal: record2.signal } : {},
-    ...record2.error !== void 0 ? { error: record2.error } : {},
-    ...record2.recoveredByPid !== void 0 ? { recoveredByPid: record2.recoveredByPid } : {}
-  };
+	const record = readJson(path, "Pier trial terminal");
+	const allowedKeys = /* @__PURE__ */ new Set([
+		"schemaVersion",
+		"kind",
+		"status",
+		"processExited",
+		"containersRemoved",
+		"removedContainers",
+		"exitCode",
+		"signal",
+		"error",
+		"recoveredByPid"
+	]);
+	const hasMalformedOptionalField = record.removedContainers !== void 0 && (!Number.isSafeInteger(record.removedContainers) || record.removedContainers < 0) || record.exitCode !== void 0 && record.exitCode !== null && !Number.isSafeInteger(record.exitCode) || record.signal !== void 0 && record.signal !== null && (typeof record.signal !== "string" || !/^SIG[A-Z0-9]+$/.test(record.signal)) || record.error !== void 0 && typeof record.error !== "string" || record.recoveredByPid !== void 0 && (!Number.isSafeInteger(record.recoveredByPid) || record.recoveredByPid < 1);
+	if (Object.keys(record).some((key) => !allowedKeys.has(key)) || record.schemaVersion !== 1 || record.kind !== "pier-trial-terminal" || ![
+		"completed",
+		"stopped",
+		"failed"
+	].includes(record.status) || typeof record.processExited !== "boolean" || typeof record.containersRemoved !== "boolean" || hasMalformedOptionalField) throw new Error("Pier trial terminal is malformed");
+	return {
+		schemaVersion: 1,
+		kind: "pier-trial-terminal",
+		status: record.status,
+		processExited: record.processExited,
+		containersRemoved: record.containersRemoved,
+		...record.removedContainers !== void 0 ? { removedContainers: record.removedContainers } : {},
+		...record.exitCode !== void 0 ? { exitCode: record.exitCode } : {},
+		...record.signal !== void 0 ? { signal: record.signal } : {},
+		...record.error !== void 0 ? { error: record.error } : {},
+		...record.recoveredByPid !== void 0 ? { recoveredByPid: record.recoveredByPid } : {}
+	};
 }
 function processIdentity(pid) {
-  const text = readFileSync(`/proc/${pid}/stat`, "utf8");
-  const closing = text.lastIndexOf(")");
-  if (closing < 0) throw new Error(`cannot parse process identity for ${pid}`);
-  const fields = text.slice(closing + 2).trim().split(/\s+/);
-  const processGroupId = Number(fields[2]);
-  const sessionId = Number(fields[3]);
-  const startTicks = fields[19];
-  if (!Number.isSafeInteger(processGroupId) || !Number.isSafeInteger(sessionId) || !/^\d+$/.test(startTicks ?? "")) {
-    throw new Error(`cannot parse process identity for ${pid}`);
-  }
-  return { pid, processGroupId, sessionId, startTicks };
+	const text = readFileSync(`/proc/${pid}/stat`, "utf8");
+	const closing = text.lastIndexOf(")");
+	if (closing < 0) throw new Error(`cannot parse process identity for ${pid}`);
+	const fields = text.slice(closing + 2).trim().split(/\s+/);
+	const processGroupId = Number(fields[2]);
+	const sessionId = Number(fields[3]);
+	const startTicks = fields[19];
+	if (!Number.isSafeInteger(processGroupId) || !Number.isSafeInteger(sessionId) || !/^\d+$/.test(startTicks ?? "")) throw new Error(`cannot parse process identity for ${pid}`);
+	return {
+		pid,
+		processGroupId,
+		sessionId,
+		startTicks
+	};
 }
 function processMatches(identity) {
-  try {
-    const current = processIdentity(identity.pid);
-    return current.startTicks === identity.startTicks && current.processGroupId === identity.processGroupId && current.sessionId === identity.sessionId;
-  } catch (error) {
-    if (error.code === "ENOENT") return false;
-    throw error;
-  }
+	try {
+		const current = processIdentity(identity.pid);
+		return current.startTicks === identity.startTicks && current.processGroupId === identity.processGroupId && current.sessionId === identity.sessionId;
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
+	}
 }
 function signalProcess(identity, signal, group) {
-  if (!processMatches(identity)) return;
-  try {
-    process.kill(group ? -identity.processGroupId : identity.pid, signal);
-  } catch (error) {
-    if (error.code !== "ESRCH") throw error;
-  }
+	if (!processMatches(identity)) return;
+	try {
+		process.kill(group ? -identity.processGroupId : identity.pid, signal);
+	} catch (error) {
+		if (error.code !== "ESRCH") throw error;
+	}
 }
 function sessionMembers(sessionId) {
-  const members = [];
-  for (const entry of readdirSync("/proc", { withFileTypes: true })) {
-    if (!entry.isDirectory() || !/^\d+$/.test(entry.name)) continue;
-    try {
-      const identity = processIdentity(Number(entry.name));
-      if (identity.sessionId === sessionId) members.push(identity);
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-  }
-  return members;
+	const members = [];
+	for (const entry of readdirSync("/proc", { withFileTypes: true })) {
+		if (!entry.isDirectory() || !/^\d+$/.test(entry.name)) continue;
+		try {
+			const identity = processIdentity(Number(entry.name));
+			if (identity.sessionId === sessionId) members.push(identity);
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+	}
+	return members;
 }
 async function signalSessionUntilEmpty(identity, signal, timeoutMs, intervalMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (true) {
-    const members = sessionMembers(identity.sessionId);
-    if (members.length === 0) return true;
-    for (const member of members) signalProcess(member, signal, false);
-    if (Date.now() >= deadline) return false;
-    await sleep(intervalMs);
-  }
+	const deadline = Date.now() + timeoutMs;
+	while (true) {
+		const members = sessionMembers(identity.sessionId);
+		if (members.length === 0) return true;
+		for (const member of members) signalProcess(member, signal, false);
+		if (Date.now() >= deadline) return false;
+		await sleep(intervalMs);
+	}
 }
 function sanitizeProject(value) {
-  let project = value.toLowerCase();
-  if (!/^[a-z0-9]/.test(project)) project = `0${project}`;
-  return project.replace(/[^a-z0-9_-]/g, "-");
+	let project = value.toLowerCase();
+	if (!/^[a-z0-9]/.test(project)) project = `0${project}`;
+	return project.replace(/[^a-z0-9_-]/g, "-");
 }
 function trialProjects(identity) {
-  const jobRoot = join3(identity.jobsDirectory, identity.jobName);
-  if (!existsSync(jobRoot)) return [];
-  return readdirSync(jobRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink()).map((entry) => sanitizeProject(entry.name));
+	const jobRoot = join(identity.jobsDirectory, identity.jobName);
+	if (!existsSync(jobRoot)) return [];
+	return readdirSync(jobRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink()).map((entry) => sanitizeProject(entry.name));
 }
 function matchingContainers(identity, dockerEnvironment) {
-  const projects = trialProjects(identity);
-  if (projects.length === 0) return [];
-  const output = execFileSync(
-    identity.dockerCommand,
-    ["ps", "-a", "--format", '{{.ID}}	{{.Label "com.docker.compose.project"}}'],
-    {
-      encoding: "utf8",
-      env: dockerEnvironment,
-      timeout: 3e4,
-      maxBuffer: 4 * 1024 * 1024
-    }
-  );
-  return output.split("\n").filter(Boolean).flatMap((line) => {
-    const tab = line.indexOf("	");
-    if (tab < 1) return [];
-    const id = line.slice(0, tab);
-    const project = line.slice(tab + 1);
-    return projects.some(
-      (expected) => project === expected || project.startsWith(`${expected}__verifier__`)
-    ) ? [id] : [];
-  });
+	const projects = trialProjects(identity);
+	if (projects.length === 0) return [];
+	return execFileSync(identity.dockerCommand, [
+		"ps",
+		"-a",
+		"--format",
+		"{{.ID}}	{{.Label \"com.docker.compose.project\"}}"
+	], {
+		encoding: "utf8",
+		env: dockerEnvironment,
+		timeout: 3e4,
+		maxBuffer: 4 * 1024 * 1024
+	}).split("\n").filter(Boolean).flatMap((line) => {
+		const tab = line.indexOf("	");
+		if (tab < 1) return [];
+		const id = line.slice(0, tab);
+		const project = line.slice(tab + 1);
+		return projects.some((expected) => project === expected || project.startsWith(`${expected}__verifier__`)) ? [id] : [];
+	});
 }
 function removeTrialContainers(identity, dockerEnvironment) {
-  const containers = matchingContainers(identity, dockerEnvironment);
-  if (containers.length > 0) {
-    try {
-      execFileSync(identity.dockerCommand, ["rm", "-f", ...containers], {
-        encoding: "utf8",
-        env: dockerEnvironment,
-        timeout: 3e4,
-        maxBuffer: 4 * 1024 * 1024
-      });
-    } catch (error) {
-      if (matchingContainers(identity, dockerEnvironment).length > 0) throw error;
-    }
-  }
-  const remaining = matchingContainers(identity, dockerEnvironment);
-  if (remaining.length > 0) {
-    throw new Error(`Pier task containers survived removal: ${remaining.join(", ")}`);
-  }
-  return containers.length;
+	const containers = matchingContainers(identity, dockerEnvironment);
+	if (containers.length > 0) try {
+		execFileSync(identity.dockerCommand, [
+			"rm",
+			"-f",
+			...containers
+		], {
+			encoding: "utf8",
+			env: dockerEnvironment,
+			timeout: 3e4,
+			maxBuffer: 4 * 1024 * 1024
+		});
+	} catch (error) {
+		if (matchingContainers(identity, dockerEnvironment).length > 0) throw error;
+	}
+	const remaining = matchingContainers(identity, dockerEnvironment);
+	if (remaining.length > 0) throw new Error(`Pier task containers survived removal: ${remaining.join(", ")}`);
+	return containers.length;
 }
 function sleep(milliseconds) {
-  return new Promise((resolveSleep) => setTimeout(resolveSleep, milliseconds));
+	return new Promise((resolveSleep) => setTimeout(resolveSleep, milliseconds));
 }
 async function waitUntil(predicate, timeoutMs, intervalMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (!predicate()) {
-    if (Date.now() >= deadline) return false;
-    await sleep(intervalMs);
-  }
-  return true;
+	const deadline = Date.now() + timeoutMs;
+	while (!predicate()) {
+		if (Date.now() >= deadline) return false;
+		await sleep(intervalMs);
+	}
+	return true;
 }
 function trialKey(identity) {
-  if (!sha256Pattern2.test(identity.executionPlanDigest)) {
-    throw new Error("executionPlanDigest must be a SHA-256 digest");
-  }
-  return createHash2("sha256").update(JSON.stringify([nonEmpty2(identity.executionId, "executionId"), identity.executionPlanDigest])).digest("hex");
+	if (!sha256Pattern.test(identity.executionPlanDigest)) throw new Error("executionPlanDigest must be a SHA-256 digest");
+	return createHash("sha256").update(JSON.stringify([nonEmpty(identity.executionId, "executionId"), identity.executionPlanDigest])).digest("hex");
 }
-function assertRealDirectory2(path, label) {
-  const stats = lstatSync(path);
-  if (!stats.isDirectory() || stats.isSymbolicLink() || realpathSync(path) !== path) {
-    throw new Error(`${label} must be a real canonical directory`);
-  }
+function assertRealDirectory(path, label) {
+	const stats = lstatSync(path);
+	if (!stats.isDirectory() || stats.isSymbolicLink() || realpathSync(path) !== path) throw new Error(`${label} must be a real canonical directory`);
 }
 var FilePierCandidateTrialController = class {
-  directory;
-  launch;
-  readResult;
-  dockerConnection;
-  supervisorPath;
-  pollIntervalMs;
-  constructor(options) {
-    this.directory = absolutePath(options.directory, "Pier controller directory");
-    this.launch = options.launch;
-    this.readResult = options.readResult;
-    const configuredDocker = options.dockerConnection;
-    if (configuredDocker?.id === defaultDockerConnectionId) {
-      throw new Error(`${defaultDockerConnectionId} is reserved for the implicit local connection`);
-    }
-    const dockerConnection = configuredDocker ?? {
-      id: defaultDockerConnectionId,
-      env: {}
-    };
-    const connectionId = stableDockerConnectionId(dockerConnection.id);
-    validateEnvironment(dockerConnection.env, "Docker connection environment");
-    this.dockerConnection = Object.freeze({
-      id: connectionId,
-      env: Object.freeze({ ...dockerConnection.env })
-    });
-    this.supervisorPath = absolutePath(
-      options.supervisorPath ?? fileURLToPath(new URL("./pier-trial-supervisor.mjs", import.meta.url)),
-      "Pier supervisor path"
-    );
-    this.pollIntervalMs = options.pollIntervalMs ?? 25;
-    if (!Number.isSafeInteger(this.pollIntervalMs) || this.pollIntervalMs < 1) {
-      throw new Error("pollIntervalMs must be a positive integer");
-    }
-    mkdirSync2(this.directory, { recursive: true, mode: 448 });
-    assertRealDirectory2(this.directory, "Pier controller directory");
-  }
-  start(staged, context) {
-    if (!this.launch) throw new Error("this Pier controller is recovery-only");
-    const identity = {
-      executionId: context.request.executionId,
-      executionPlanDigest: context.request.executionPlan.value.digest
-    };
-    if (staged.executionId !== identity.executionId) {
-      throw new Error("staged Pier execution does not match the runtime request");
-    }
-    const spec = this.launch(staged, context);
-    this.validateSpec(spec);
-    for (const [name, value] of Object.entries(this.dockerConnection.env)) {
-      if (Object.prototype.hasOwnProperty.call(spec.env, name) && spec.env[name] !== value) {
-        throw new Error(`Pier child environment conflicts with Docker connection variable ${name}`);
-      }
-    }
-    const pierEnvironment = Object.freeze({
-      ...spec.env,
-      ...this.dockerConnection.env
-    });
-    mkdirSync2(spec.jobsDirectory, { recursive: true, mode: 448 });
-    assertRealDirectory2(spec.jobsDirectory, "Pier jobs directory");
-    const dockerCommand = resolveExecutable(
-      spec.dockerCommand ?? "docker",
-      process.env.PATH,
-      "Docker command"
-    );
-    const pierCommand = resolveExecutable(spec.command, pierEnvironment.PATH, "Pier command");
-    const controlDirectory = this.controlDirectory(identity);
-    try {
-      mkdirSync2(controlDirectory, { mode: 448 });
-    } catch (error) {
-      if (error.code === "EEXIST") {
-        throw new Error("Pier trial identity already has durable control state");
-      }
-      throw error;
-    }
-    assertRealDirectory2(controlDirectory, "Pier trial control directory");
-    const jobRoot = join3(spec.jobsDirectory, spec.jobName);
-    let jobRootCreated = false;
-    try {
-      mkdirSync2(jobRoot, { mode: 448 });
-      jobRootCreated = true;
-      assertRealDirectory2(jobRoot, "Pier job directory");
-    } catch (error) {
-      rmSync(controlDirectory, { recursive: true, force: true });
-      if (jobRootCreated) rmSync(jobRoot, { recursive: true, force: true });
-      if (error.code === "EEXIST") {
-        throw new Error("Pier job name must be unique; its job directory already exists");
-      }
-      throw error;
-    }
-    const allocating = {
-      schemaVersion: 1,
-      kind: "pier-trial-identity",
-      state: "allocating",
-      ...identity,
-      jobsDirectory: absolutePath(spec.jobsDirectory, "Pier jobs directory"),
-      jobName: nonEmpty2(spec.jobName, "Pier job name"),
-      dockerCommand: nonEmpty2(dockerCommand, "Docker command"),
-      dockerConnectionId: this.dockerConnection.id
-    };
-    try {
-      writeJsonAtomic(controlDirectory, identityFile, allocating);
-    } catch (error) {
-      rmSync(controlDirectory, { recursive: true, force: true });
-      rmSync(jobRoot, { recursive: true, force: true });
-      throw error;
-    }
-    const supervisor = spawn2(process.execPath, [this.supervisorPath, controlDirectory], {
-      detached: true,
-      // Launch data arrives over fd 3. The trusted supervisor receives only
-      // explicitly declared process variables, never the evaluator environment.
-      env: { ...this.dockerConnection.env },
-      stdio: ["ignore", "ignore", "ignore", "pipe"]
-    });
-    if (supervisor.pid === void 0) throw new Error("Pier supervisor started without a pid");
-    const controlPipe = supervisor.stdio[3];
-    let supervisorIdentity;
-    try {
-      supervisorIdentity = processIdentity(supervisor.pid);
-      const persisted = {
-        ...allocating,
-        state: "starting",
-        supervisor: supervisorIdentity
-      };
-      writeJsonAtomic(controlDirectory, identityFile, persisted);
-      if (!controlPipe) throw new Error("Pier supervisor has no protected control pipe");
-      controlPipe.on("error", () => void 0);
-      controlPipe.end(
-        JSON.stringify({
-          command: pierCommand,
-          args: spec.args,
-          cwd: spec.cwd,
-          env: pierEnvironment,
-          jobsDirectory: spec.jobsDirectory,
-          jobName: spec.jobName,
-          dockerCommand
-        })
-      );
-    } catch (error) {
-      controlPipe?.destroy();
-      if (supervisorIdentity) signalProcess(supervisorIdentity, "SIGKILL", false);
-      else {
-        try {
-          process.kill(supervisor.pid, "SIGKILL");
-        } catch (killError) {
-          if (killError.code !== "ESRCH") throw killError;
-        }
-      }
-      throw error;
-    }
-    supervisor.unref();
-    controlPipe.unref?.();
-    const result = this.waitForResult(controlDirectory, spec, context.deadlineAtMs);
-    return {
-      identity,
-      result,
-      terminateAndWait: async () => await this.terminateAndWait(identity)
-    };
-  }
-  async terminateAndWait(requested) {
-    const controlDirectory = this.controlDirectory(requested);
-    assertRealDirectory2(controlDirectory, "Pier trial control directory");
-    const persisted = parsePersistedIdentity(join3(controlDirectory, identityFile));
-    if (persisted.executionId !== requested.executionId || persisted.executionPlanDigest !== requested.executionPlanDigest) {
-      throw new Error("persisted Pier trial identity differs from the stop request");
-    }
-    this.assertDockerConnection(persisted);
-    touchDurable(controlDirectory, stopFile);
-    if (!existsSync(join3(controlDirectory, terminalFile))) {
-      if (persisted.supervisor) signalProcess(persisted.supervisor, "SIGTERM", false);
-    }
-    const terminalAppeared = await waitUntil(
-      () => existsSync(join3(controlDirectory, terminalFile)),
-      persisted.supervisor ? 1e4 : 1,
-      this.pollIntervalMs
-    );
-    if (!terminalAppeared) await this.forceRecovery(controlDirectory);
-    let terminal = parseTerminal(join3(controlDirectory, terminalFile));
-    const latest = parsePersistedIdentity(join3(controlDirectory, identityFile));
-    const liveProcesses = latest.pier ? sessionMembers(latest.pier.sessionId).length : 0;
-    this.assertDockerConnection(latest);
-    const liveContainers = matchingContainers(latest, this.dockerConnection.env).length;
-    if (liveProcesses > 0 || liveContainers > 0) {
-      await this.forceRecovery(controlDirectory);
-      terminal = parseTerminal(join3(controlDirectory, terminalFile));
-    }
-    if (!terminal.processExited || !terminal.containersRemoved) {
-      throw new Error(
-        `Pier recovery did not prove process/container death${terminal.error ? `: ${terminal.error}` : ""}`
-      );
-    }
-    return { processExited: true, containersRemoved: true };
-  }
-  async captureResult(requested) {
-    const controlDirectory = this.controlDirectory(requested);
-    assertRealDirectory2(controlDirectory, "Pier trial control directory");
-    const persisted = parsePersistedIdentity(join3(controlDirectory, identityFile));
-    if (persisted.executionId !== requested.executionId || persisted.executionPlanDigest !== requested.executionPlanDigest) {
-      throw new Error("persisted Pier trial identity differs from the capture request");
-    }
-    this.assertDockerConnection(persisted);
-    const terminal = parseTerminal(join3(controlDirectory, terminalFile));
-    if (!terminal.processExited || !terminal.containersRemoved) {
-      throw new Error("Pier result capture requires proven process and container death");
-    }
-    if (!this.readResult) {
-      throw new Error("Pier result capture has no restart-safe result reader");
-    }
-    return await this.readResult({
-      jobsDirectory: persisted.jobsDirectory,
-      jobName: persisted.jobName
-    });
-  }
-  controlDirectory(identity) {
-    return join3(this.directory, trialKey(identity));
-  }
-  assertDockerConnection(identity) {
-    if (identity.dockerConnectionId !== this.dockerConnection.id) {
-      throw new Error(
-        `Pier trial requires Docker connection ${identity.dockerConnectionId}; configured ${this.dockerConnection.id}`
-      );
-    }
-  }
-  validateSpec(spec) {
-    nonEmpty2(spec.command, "Pier command");
-    if (!Array.isArray(spec.args) || spec.args.some((arg) => typeof arg !== "string" || arg.includes("\0"))) {
-      throw new Error("Pier arguments must be strings without NUL");
-    }
-    absolutePath(spec.cwd, "Pier cwd");
-    absolutePath(spec.jobsDirectory, "Pier jobs directory");
-    if (!/^[A-Za-z0-9._-]{1,200}$/.test(spec.jobName)) {
-      throw new Error("Pier job name must be filesystem-neutral");
-    }
-    validateEnvironment(spec.env, "Pier child environment");
-  }
-  async waitForResult(controlDirectory, spec, deadlineAtMs) {
-    const waitMs = Math.max(0, deadlineAtMs - Date.now());
-    const appeared = await waitUntil(
-      () => existsSync(join3(controlDirectory, terminalFile)),
-      waitMs,
-      this.pollIntervalMs
-    );
-    if (!appeared) throw new Error("Pier supervisor emitted no terminal acknowledgement");
-    const terminal = parseTerminal(join3(controlDirectory, terminalFile));
-    if (!terminal.processExited || !terminal.containersRemoved) {
-      throw new Error("Pier supervisor did not prove process and container death");
-    }
-    if (terminal.status !== "completed") {
-      throw new Error(terminal.error ? `Pier process failed: ${terminal.error}` : "Pier process stopped");
-    }
-    return await spec.readResult();
-  }
-  async forceRecovery(controlDirectory) {
-    const latest = parsePersistedIdentity(join3(controlDirectory, identityFile));
-    this.assertDockerConnection(latest);
-    const errors = [];
-    if (latest.pier) {
-      try {
-        await signalSessionUntilEmpty(latest.pier, "SIGTERM", 2e3, this.pollIntervalMs);
-      } catch (error) {
-        errors.push(`could not signal Pier session: ${error instanceof Error ? error.message : String(error)}`);
-      }
-    }
-    if (latest.supervisor) {
-      try {
-        signalProcess(latest.supervisor, "SIGKILL", false);
-        if (!await waitUntil(() => !processMatches(latest.supervisor), 5e3, this.pollIntervalMs)) {
-          errors.push(`Pier supervisor ${latest.supervisor.pid} survived SIGKILL`);
-        }
-      } catch (error) {
-        errors.push(`could not kill Pier supervisor: ${error instanceof Error ? error.message : String(error)}`);
-      }
-    }
-    if (latest.pier) {
-      try {
-        if (!await signalSessionUntilEmpty(
-          latest.pier,
-          "SIGKILL",
-          5e3,
-          this.pollIntervalMs
-        )) {
-          errors.push(`Pier process session ${latest.pier.sessionId} survived SIGKILL`);
-        }
-      } catch (error) {
-        errors.push(`could not kill Pier session: ${error instanceof Error ? error.message : String(error)}`);
-      }
-    }
-    let removedContainers = 0;
-    try {
-      removedContainers = removeTrialContainers(latest, this.dockerConnection.env);
-    } catch (error) {
-      errors.push(`could not remove Pier containers: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    if (errors.length > 0) {
-      throw new Error(`Pier recovery incomplete: ${errors.join("; ")}`);
-    }
-    writeJsonAtomic(controlDirectory, terminalFile, {
-      schemaVersion: 1,
-      kind: "pier-trial-terminal",
-      status: "stopped",
-      processExited: true,
-      containersRemoved: true,
-      removedContainers,
-      recoveredByPid: process.pid
-    });
-  }
+	directory;
+	launch;
+	readResult;
+	dockerConnection;
+	supervisorPath;
+	pollIntervalMs;
+	constructor(options) {
+		this.directory = absolutePath(options.directory, "Pier controller directory");
+		this.launch = options.launch;
+		this.readResult = options.readResult;
+		const configuredDocker = options.dockerConnection;
+		if (configuredDocker?.id === defaultDockerConnectionId) throw new Error(`${defaultDockerConnectionId} is reserved for the implicit local connection`);
+		const dockerConnection = configuredDocker ?? {
+			id: defaultDockerConnectionId,
+			env: {}
+		};
+		const connectionId = stableDockerConnectionId(dockerConnection.id);
+		validateEnvironment(dockerConnection.env, "Docker connection environment");
+		this.dockerConnection = Object.freeze({
+			id: connectionId,
+			env: Object.freeze({ ...dockerConnection.env })
+		});
+		this.supervisorPath = absolutePath(options.supervisorPath ?? fileURLToPath(new URL("./pier-trial-supervisor.mjs", import.meta.url)), "Pier supervisor path");
+		this.pollIntervalMs = options.pollIntervalMs ?? 25;
+		if (!Number.isSafeInteger(this.pollIntervalMs) || this.pollIntervalMs < 1) throw new Error("pollIntervalMs must be a positive integer");
+		mkdirSync(this.directory, {
+			recursive: true,
+			mode: 448
+		});
+		assertRealDirectory(this.directory, "Pier controller directory");
+	}
+	start(staged, context) {
+		if (!this.launch) throw new Error("this Pier controller is recovery-only");
+		const identity = {
+			executionId: context.request.executionId,
+			executionPlanDigest: context.request.executionPlan.value.digest
+		};
+		if (staged.executionId !== identity.executionId) throw new Error("staged Pier execution does not match the runtime request");
+		const spec = this.launch(staged, context);
+		this.validateSpec(spec);
+		for (const [name, value] of Object.entries(this.dockerConnection.env)) if (Object.prototype.hasOwnProperty.call(spec.env, name) && spec.env[name] !== value) throw new Error(`Pier child environment conflicts with Docker connection variable ${name}`);
+		const pierEnvironment = Object.freeze({
+			...spec.env,
+			...this.dockerConnection.env
+		});
+		mkdirSync(spec.jobsDirectory, {
+			recursive: true,
+			mode: 448
+		});
+		assertRealDirectory(spec.jobsDirectory, "Pier jobs directory");
+		const dockerCommand = resolveExecutable(spec.dockerCommand ?? "docker", process.env.PATH, "Docker command");
+		const pierCommand = resolveExecutable(spec.command, pierEnvironment.PATH, "Pier command");
+		const controlDirectory = this.controlDirectory(identity);
+		try {
+			mkdirSync(controlDirectory, { mode: 448 });
+		} catch (error) {
+			if (error.code === "EEXIST") throw new Error("Pier trial identity already has durable control state");
+			throw error;
+		}
+		assertRealDirectory(controlDirectory, "Pier trial control directory");
+		const jobRoot = join(spec.jobsDirectory, spec.jobName);
+		let jobRootCreated = false;
+		try {
+			mkdirSync(jobRoot, { mode: 448 });
+			jobRootCreated = true;
+			assertRealDirectory(jobRoot, "Pier job directory");
+		} catch (error) {
+			rmSync(controlDirectory, {
+				recursive: true,
+				force: true
+			});
+			if (jobRootCreated) rmSync(jobRoot, {
+				recursive: true,
+				force: true
+			});
+			if (error.code === "EEXIST") throw new Error("Pier job name must be unique; its job directory already exists");
+			throw error;
+		}
+		const allocating = {
+			schemaVersion: 1,
+			kind: "pier-trial-identity",
+			state: "allocating",
+			...identity,
+			jobsDirectory: absolutePath(spec.jobsDirectory, "Pier jobs directory"),
+			jobName: nonEmpty(spec.jobName, "Pier job name"),
+			dockerCommand: nonEmpty(dockerCommand, "Docker command"),
+			dockerConnectionId: this.dockerConnection.id
+		};
+		try {
+			writeJsonAtomic(controlDirectory, identityFile, allocating);
+		} catch (error) {
+			rmSync(controlDirectory, {
+				recursive: true,
+				force: true
+			});
+			rmSync(jobRoot, {
+				recursive: true,
+				force: true
+			});
+			throw error;
+		}
+		const supervisor = spawn(process.execPath, [this.supervisorPath, controlDirectory], {
+			detached: true,
+			env: { ...this.dockerConnection.env },
+			stdio: [
+				"ignore",
+				"ignore",
+				"ignore",
+				"pipe"
+			]
+		});
+		if (supervisor.pid === void 0) throw new Error("Pier supervisor started without a pid");
+		const controlPipe = supervisor.stdio[3];
+		let supervisorIdentity;
+		try {
+			supervisorIdentity = processIdentity(supervisor.pid);
+			const persisted = {
+				...allocating,
+				state: "starting",
+				supervisor: supervisorIdentity
+			};
+			writeJsonAtomic(controlDirectory, identityFile, persisted);
+			if (!controlPipe) throw new Error("Pier supervisor has no protected control pipe");
+			controlPipe.on("error", () => void 0);
+			controlPipe.end(JSON.stringify({
+				command: pierCommand,
+				args: spec.args,
+				cwd: spec.cwd,
+				env: pierEnvironment,
+				jobsDirectory: spec.jobsDirectory,
+				jobName: spec.jobName,
+				dockerCommand
+			}));
+		} catch (error) {
+			controlPipe?.destroy();
+			if (supervisorIdentity) signalProcess(supervisorIdentity, "SIGKILL", false);
+			else try {
+				process.kill(supervisor.pid, "SIGKILL");
+			} catch (killError) {
+				if (killError.code !== "ESRCH") throw killError;
+			}
+			throw error;
+		}
+		supervisor.unref();
+		controlPipe.unref?.();
+		return {
+			identity,
+			result: this.waitForResult(controlDirectory, spec, context.deadlineAtMs),
+			terminateAndWait: async () => await this.terminateAndWait(identity)
+		};
+	}
+	async terminateAndWait(requested) {
+		const controlDirectory = this.controlDirectory(requested);
+		assertRealDirectory(controlDirectory, "Pier trial control directory");
+		const persisted = parsePersistedIdentity(join(controlDirectory, identityFile));
+		if (persisted.executionId !== requested.executionId || persisted.executionPlanDigest !== requested.executionPlanDigest) throw new Error("persisted Pier trial identity differs from the stop request");
+		this.assertDockerConnection(persisted);
+		touchDurable(controlDirectory, stopFile);
+		if (!existsSync(join(controlDirectory, terminalFile))) {
+			if (persisted.supervisor) signalProcess(persisted.supervisor, "SIGTERM", false);
+		}
+		if (!await waitUntil(() => existsSync(join(controlDirectory, terminalFile)), persisted.supervisor ? 1e4 : 1, this.pollIntervalMs)) await this.forceRecovery(controlDirectory);
+		let terminal = parseTerminal(join(controlDirectory, terminalFile));
+		const latest = parsePersistedIdentity(join(controlDirectory, identityFile));
+		const liveProcesses = latest.pier ? sessionMembers(latest.pier.sessionId).length : 0;
+		this.assertDockerConnection(latest);
+		const liveContainers = matchingContainers(latest, this.dockerConnection.env).length;
+		if (liveProcesses > 0 || liveContainers > 0) {
+			await this.forceRecovery(controlDirectory);
+			terminal = parseTerminal(join(controlDirectory, terminalFile));
+		}
+		if (!terminal.processExited || !terminal.containersRemoved) throw new Error(`Pier recovery did not prove process/container death${terminal.error ? `: ${terminal.error}` : ""}`);
+		return {
+			processExited: true,
+			containersRemoved: true
+		};
+	}
+	async captureResult(requested) {
+		const controlDirectory = this.controlDirectory(requested);
+		assertRealDirectory(controlDirectory, "Pier trial control directory");
+		const persisted = parsePersistedIdentity(join(controlDirectory, identityFile));
+		if (persisted.executionId !== requested.executionId || persisted.executionPlanDigest !== requested.executionPlanDigest) throw new Error("persisted Pier trial identity differs from the capture request");
+		this.assertDockerConnection(persisted);
+		const terminal = parseTerminal(join(controlDirectory, terminalFile));
+		if (!terminal.processExited || !terminal.containersRemoved) throw new Error("Pier result capture requires proven process and container death");
+		if (!this.readResult) throw new Error("Pier result capture has no restart-safe result reader");
+		return await this.readResult({
+			jobsDirectory: persisted.jobsDirectory,
+			jobName: persisted.jobName
+		});
+	}
+	controlDirectory(identity) {
+		return join(this.directory, trialKey(identity));
+	}
+	assertDockerConnection(identity) {
+		if (identity.dockerConnectionId !== this.dockerConnection.id) throw new Error(`Pier trial requires Docker connection ${identity.dockerConnectionId}; configured ${this.dockerConnection.id}`);
+	}
+	validateSpec(spec) {
+		nonEmpty(spec.command, "Pier command");
+		if (!Array.isArray(spec.args) || spec.args.some((arg) => typeof arg !== "string" || arg.includes("\0"))) throw new Error("Pier arguments must be strings without NUL");
+		absolutePath(spec.cwd, "Pier cwd");
+		absolutePath(spec.jobsDirectory, "Pier jobs directory");
+		if (!/^[A-Za-z0-9._-]{1,200}$/.test(spec.jobName)) throw new Error("Pier job name must be filesystem-neutral");
+		validateEnvironment(spec.env, "Pier child environment");
+	}
+	async waitForResult(controlDirectory, spec, deadlineAtMs) {
+		if (!await waitUntil(() => existsSync(join(controlDirectory, terminalFile)), Math.max(0, deadlineAtMs - Date.now()), this.pollIntervalMs)) throw new Error("Pier supervisor emitted no terminal acknowledgement");
+		const terminal = parseTerminal(join(controlDirectory, terminalFile));
+		if (!terminal.processExited || !terminal.containersRemoved) throw new Error("Pier supervisor did not prove process and container death");
+		if (terminal.status !== "completed") throw new Error(terminal.error ? `Pier process failed: ${terminal.error}` : "Pier process stopped");
+		return await spec.readResult();
+	}
+	async forceRecovery(controlDirectory) {
+		const latest = parsePersistedIdentity(join(controlDirectory, identityFile));
+		this.assertDockerConnection(latest);
+		const errors = [];
+		if (latest.pier) try {
+			await signalSessionUntilEmpty(latest.pier, "SIGTERM", 2e3, this.pollIntervalMs);
+		} catch (error) {
+			errors.push(`could not signal Pier session: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		if (latest.supervisor) try {
+			signalProcess(latest.supervisor, "SIGKILL", false);
+			if (!await waitUntil(() => !processMatches(latest.supervisor), 5e3, this.pollIntervalMs)) errors.push(`Pier supervisor ${latest.supervisor.pid} survived SIGKILL`);
+		} catch (error) {
+			errors.push(`could not kill Pier supervisor: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		if (latest.pier) try {
+			if (!await signalSessionUntilEmpty(latest.pier, "SIGKILL", 5e3, this.pollIntervalMs)) errors.push(`Pier process session ${latest.pier.sessionId} survived SIGKILL`);
+		} catch (error) {
+			errors.push(`could not kill Pier session: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		let removedContainers = 0;
+		try {
+			removedContainers = removeTrialContainers(latest, this.dockerConnection.env);
+		} catch (error) {
+			errors.push(`could not remove Pier containers: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		if (errors.length > 0) throw new Error(`Pier recovery incomplete: ${errors.join("; ")}`);
+		writeJsonAtomic(controlDirectory, terminalFile, {
+			schemaVersion: 1,
+			kind: "pier-trial-terminal",
+			status: "stopped",
+			processExited: true,
+			containersRemoved: true,
+			removedContainers,
+			recoveredByPid: process.pid
+		});
+	}
 };
-
-// src/pier-result-grader.ts
-import { spawn as spawn3 } from "child_process";
-import { createHash as createHash3 } from "crypto";
-import { chmod as chmod2, mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join4 } from "path";
-var sha2562 = (bytes) => `sha256:${createHash3("sha256").update(bytes).digest("hex")}`;
+//#endregion
+//#region src/pier-result-grader.ts
+/** Execute the exact admitted Pier result parser bytes in a fresh Node process. */
+const sha256 = (bytes) => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
 function createPierResultGrader(descriptor) {
-  return {
-    ...descriptor,
-    run: async (input) => {
-      input.signal.throwIfAborted();
-      const implementation = Uint8Array.from(input.implementation.bytes);
-      if (implementation.byteLength !== input.implementation.byteLength) {
-        throw new Error("Pier grader implementation length changed before execution");
-      }
-      const evidence = Uint8Array.from(input.officialResult.bytes);
-      const evaluation = await executeGrader(implementation, evidence, input.signal);
-      input.signal.throwIfAborted();
-      return {
-        evaluation,
-        evidence,
-        binding: {
-          implementationDigest: sha2562(implementation),
-          taskOutcomeDigest: input.outcome.evidence.digest,
-          outputDigest: sha2562(evidence)
-        }
-      };
-    }
-  };
+	return {
+		...descriptor,
+		run: async (input) => {
+			input.signal.throwIfAborted();
+			const implementation = Uint8Array.from(input.implementation.bytes);
+			if (implementation.byteLength !== input.implementation.byteLength) throw new Error("Pier grader implementation length changed before execution");
+			const evidence = Uint8Array.from(input.officialResult.bytes);
+			const evaluation = await executeGrader(implementation, evidence, input.signal);
+			input.signal.throwIfAborted();
+			return {
+				evaluation,
+				evidence,
+				binding: {
+					implementationDigest: sha256(implementation),
+					taskOutcomeDigest: input.outcome.evidence.digest,
+					outputDigest: sha256(evidence)
+				}
+			};
+		}
+	};
 }
 async function executeGrader(implementation, resultBytes, signal) {
-  const directory = await mkdtemp2(join4(tmpdir2(), "pier-result-grader-"));
-  const script = join4(directory, "grader.mjs");
-  try {
-    await writeFile2(script, implementation, { flag: "wx", mode: 384 });
-    await chmod2(script, 320);
-    const stdout = await runNode(script, resultBytes, signal);
-    const parsed = JSON.parse(stdout.toString("utf8"));
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error("Pier result grader returned a non-object evaluation");
-    }
-    return parsed;
-  } finally {
-    await rm2(directory, { recursive: true, force: true });
-  }
+	const directory = await mkdtemp(join(tmpdir(), "pier-result-grader-"));
+	const script = join(directory, "grader.mjs");
+	try {
+		await writeFile(script, implementation, {
+			flag: "wx",
+			mode: 384
+		});
+		await chmod(script, 320);
+		const stdout = await runNode(script, resultBytes, signal);
+		const parsed = JSON.parse(stdout.toString("utf8"));
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Pier result grader returned a non-object evaluation");
+		return parsed;
+	} finally {
+		await rm(directory, {
+			recursive: true,
+			force: true
+		});
+	}
 }
 async function runNode(script, input, signal) {
-  signal.throwIfAborted();
-  return await new Promise((resolveResult, reject) => {
-    const child = spawn3(process.execPath, ["--no-warnings", script], {
-      env: {
-        PATH: process.env.PATH,
-        HOME: process.env.HOME,
-        LANG: "C",
-        LC_ALL: "C"
-      },
-      stdio: ["pipe", "pipe", "pipe"],
-      signal
-    });
-    const stdout = [];
-    const stderr = [];
-    let bytes = 0;
-    const collect = (target) => (chunk) => {
-      bytes += chunk.byteLength;
-      if (bytes > 1024 * 1024) {
-        child.kill("SIGKILL");
-        reject(new Error("Pier result grader exceeded its output limit"));
-        return;
-      }
-      target.push(Buffer.from(chunk));
-    };
-    child.stdout.on("data", collect(stdout));
-    child.stderr.on("data", collect(stderr));
-    child.once("error", reject);
-    child.once("close", (code, childSignal) => {
-      if (code !== 0) {
-        reject(
-          new Error(
-            `Pier result grader failed (${childSignal ?? code}): ${Buffer.concat(stderr).toString("utf8").trim()}`
-          )
-        );
-        return;
-      }
-      resolveResult(Buffer.concat(stdout));
-    });
-    child.stdin.end(input);
-  });
-}
-export {
-  ADAPTERS,
-  FINAL_ANSWER_SENTINEL,
-  FilePierCandidateTrialController,
-  StagedJudgeError,
-  answerScoreToBenchScore,
-  contextBlock,
-  contextsFrom,
-  createCragAdapter,
-  createNoMiraclAdapter,
-  createOpenRagBenchAdapter,
-  createPierCandidateRecoveryExecutor,
-  createPierResultGrader,
-  createRagBenchAdapter,
-  createSweBenchAdapter,
-  createT2RagBenchAdapter,
-  executePreparedPierCandidate,
-  normalizeAnswer,
-  parseCitations,
-  parseFinalAnswer,
-  printBenchmarksReport,
-  ragAnswerOutput,
-  resolveAdapter,
-  runBenchmarks,
-  runStagedJudge,
-  scoreAnswerArtifact,
-  scoreSweReport,
-  sweEvaluationArgv,
-  swePatchOutput,
-  tokenF1
-};
+	signal.throwIfAborted();
+	return await new Promise((resolveResult, reject) => {
+		const child = spawn(process.execPath, ["--no-warnings", script], {
+			env: {
+				PATH: process.env.PATH,
+				HOME: process.env.HOME,
+				LANG: "C",
+				LC_ALL: "C"
+			},
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			signal
+		});
+		const stdout = [];
+		const stderr = [];
+		let bytes = 0;
+		const collect = (target) => (chunk) => {
+			bytes += chunk.byteLength;
+			if (bytes > 1024 * 1024) {
+				child.kill("SIGKILL");
+				reject(/* @__PURE__ */ new Error("Pier result grader exceeded its output limit"));
+				return;
+			}
+			target.push(Buffer.from(chunk));
+		};
+		child.stdout.on("data", collect(stdout));
+		child.stderr.on("data", collect(stderr));
+		child.once("error", reject);
+		child.once("close", (code, childSignal) => {
+			if (code !== 0) {
+				reject(/* @__PURE__ */ new Error(`Pier result grader failed (${childSignal ?? code}): ${Buffer.concat(stderr).toString("utf8").trim()}`));
+				return;
+			}
+			resolveResult(Buffer.concat(stdout));
+		});
+		child.stdin.end(input);
+	});
+}
+//#endregion
+export { ADAPTERS, FINAL_ANSWER_SENTINEL, FilePierCandidateTrialController, StagedJudgeError, answerScoreToBenchScore, contextBlock, contextsFrom, createCragAdapter, createNoMiraclAdapter, createOpenRagBenchAdapter, createPierCandidateRecoveryExecutor, createPierResultGrader, createRagBenchAdapter, createSweBenchAdapter, createT2RagBenchAdapter, executePreparedPierCandidate, normalizeAnswer, parseCitations, parseFinalAnswer, printBenchmarksReport, ragAnswerOutput, resolveAdapter, runBenchmarks, runStagedJudge, scoreAnswerArtifact, scoreSweReport, sweEvaluationArgv, swePatchOutput, tokenF1 };
+
 //# sourceMappingURL=index.js.map