@tangle-network/agent-runtime 6.0.5 → 6.0.7

package/dist/{runtime-BNSsSOZ7.js → runtime-CBt8PWn5.js}

@@ -1,25 +1,25 @@
-import { A as isTraceAnalysisStore, Br as executableAgentProfileSnapshot, G as settledToIteration, Mt as coordinationProfileToolPrefix, Vr as executableAgentSpecSnapshot, X as rollingDispatch, ei as runAbortable, rn as insideCursorNamespace } from "./scope-DSm2RW5I.js";
+import { A as isTraceAnalysisStore, Br as executableAgentProfileSnapshot, G as settledToIteration, Mt as coordinationProfileToolPrefix, Vr as executableAgentSpecSnapshot, X as rollingDispatch, ei as runAbortable, rn as insideCursorNamespace } from "./scope-BF3RUg3U.js";
 import { i as ConfigError, m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-AzSuGI23.js";
-import { D as runAgentic, E as refine, M as renderReport, N as profileChatClient, O as sample, j as observe, k as ObservationError, v as loadAuthoredStrategy, x as strategyAuthorContract, y as requestStrategySource } from "./structural-rollout-B8PkKbfv.js";
+import { D as runAgentic, E as refine, M as renderReport, N as profileChatClient, O as sample, j as observe, k as ObservationError, v as loadAuthoredStrategy, x as strategyAuthorContract, y as requestStrategySource } from "./structural-rollout-ccetqcnq.js";
 import { I as armDeadlineTimer, T as zeroSpend, a as cloneSpend, c as errorMessage, d as isAbortError, f as isAsyncIterable, h as randomSuffix, i as chargedTokens, l as fnv1a32Hex, n as addSpend, p as mapWithConcurrency, u as hasCompleteCacheBreakdown, v as sleep, y as stringifySafe } from "./util-C_cdPNC4.js";
 import { M as contentAddress, _t as notifySandboxEventObserver, pt as createSandboxTurnEventCollector, r as runtimeFailureCauseSchema } from "./failure-cause-BzjUUsRz.js";
 import { n as detachedSnapshot, t as detachedFrozen } from "./snapshot-Cgj2Wzi6.js";
-import { C as createExecutor, D as runAgentRounds, O as assertBoxlessPromptOptions, P as defaultSelectWinner, V as routerBrain, _ as withDriverExecutor, b as createExecutorRegistry, bt as verdictFromJudgeScore, gt as CheckUnavailableError, j as createSandboxLineage, k as readPromptOptions, n as createSupervisor, q as createWorktreeCliExecutor, v as InMemoryResultBlobStore, vt as gateOnDeliverable, y as InMemorySpawnJournal, yt as mapExecutorResult } from "./supervisor-DpWSUrwB.js";
+import { C as createExecutor, D as runAgentRounds, O as assertBoxlessPromptOptions, P as defaultSelectWinner, V as routerBrain, _ as withDriverExecutor, b as createExecutorRegistry, bt as verdictFromJudgeScore, gt as CheckUnavailableError, j as createSandboxLineage, k as readPromptOptions, n as createSupervisor, q as createWorktreeCliExecutor, v as InMemoryResultBlobStore, vt as gateOnDeliverable, y as InMemorySpawnJournal, yt as mapExecutorResult } from "./supervisor-CigTbS9A.js";
 import { a as concreteProfileModel, c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, p as canonicalObservedModelParts, t as assertExecutableAgentProfile, v as harnessRunsAgent } from "./model-policy-JOcg3NRs.js";
 import { a as readCommittedJsonLines, c as appendCommittedJsonLine, i as readCommittedJsonFile, o as upsertCommittedJsonLine, s as withJsonlFileLock, t as isNoEntError } from "./jsonl-file-BeUa5EDx.js";
-import { I as immutableCandidateValue, M as canonicalCandidateDigest$1, R as sha256Bytes$1, S as captureMaterializedWorkspace, k as markPutStreamVerified, y as WorkspaceScanLimitError } from "./workspace-streams-uB9rRbms.js";
+import { A as markPutStreamVerified, L as immutableCandidateValue, N as canonicalCandidateDigest$1, S as captureMaterializedWorkspace, T as scanMaterializedWorkspaceManifest, g as persistCandidateOutputArtifact, y as WorkspaceScanLimitError, z as sha256Bytes$1 } from "./workspace-streams-B7yNMahl.js";
 import { a as writeAtomicDurableFile } from "./durable-file-DstVeHcj.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-CsW2pfFk.js";
-import { a as reconcileInterruptedSearchCalls, c as searchExecutor, r as dedicatedLane, x as runtimeShipDecision } from "./search-executor-CpQIJAdh.js";
-import { y as foldCoordinationRecords } from "./run-cancellation-ZmRSYLu5.js";
-import { a as downMessageRefusalReasons, p as createInMemoryRunContext } from "./coordination-manager-ds4pn4IC.js";
-import { M as kernelPromptRegistry, S as validateFlowGraph, T as validateGraphTopology, h as runBrainLoop, p as coordinationControlToolNames, t as supervise } from "./supervise-B3hzcqVU.js";
+import { a as reconcileInterruptedSearchCalls, c as searchExecutor, r as dedicatedLane, x as runtimeShipDecision } from "./search-executor-CoLgtigZ.js";
+import { y as foldCoordinationRecords } from "./run-cancellation-CqF01-zj.js";
+import { a as downMessageRefusalReasons, p as createInMemoryRunContext } from "./coordination-manager-Cow3jgu1.js";
+import { M as kernelPromptRegistry, S as validateFlowGraph, T as validateGraphTopology, h as runBrainLoop, p as coordinationControlToolNames, t as supervise } from "./supervise-BMqPWSv7.js";
 import { _ as compileGraphParameters, a as graphRegistry, b as graphRouteWhenSchema, d as recordGraphRun, g as bindGraphParameters, h as assertGraphTriggerBindings, i as graphFromStored, l as lookupGraph, m as taskShapeDigest, o as graphRunsFor, r as graphDigest, t as digestOfGraph, v as graphTriggerBindingsSchema, y as graphFileSchema } from "./graph-registry-DbCwfHMY.js";
-import "./run-state-Dt-v0Fr8.js";
+import "./run-state-CeMgqULw.js";
 import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction-DilFZch5.js";
-import "./provision-supervisor-CuX82sFT.js";
-import "./delegate-B2Z1CueR.js";
-import "./graph-flrNgUfu.js";
+import "./provision-supervisor-ZG-ZxIe9.js";
+import "./delegate-zUOoWutU.js";
+import "./graph-BS9p0hHV.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, sha256Bytes, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
@@ -735,6 +735,267 @@ function deterministicCompletion(check) {
 		};
 	} };
 }
+// src/runtime/isolated-checker-outputs.ts
+const MAX_FILES = 16;
+const MAX_BYTES = 67108864;
+const MAX_TIMEOUT_MS = 12e4;
+/** Validate authored declarations before starting a check. The returned paths are detached and frozen. */
+function validateIsolatedCheckOutputs(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new ValidationError("check outputs must be a declaration object");
+	const item = value;
+	if (Object.keys(item).some((key) => ![
+		"paths",
+		"maxFileBytes",
+		"maxTotalBytes",
+		"timeoutMs"
+	].includes(key))) throw new ValidationError("check outputs has an unknown field");
+	if (!Array.isArray(item.paths) || item.paths.length < 1 || item.paths.length > MAX_FILES) throw new ValidationError("check outputs must name between 1 and 16 files");
+	const paths = [];
+	for (const path of item.paths) {
+		if (typeof path !== "string" || path.length > 512 || !/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/u.test(path) || path.split("/").some((part) => part === "." || part === ".." || part === ".git" || part === ".sidecar") || paths.some((prior) => prior === path || prior.startsWith(`${path}/`) || path.startsWith(`${prior}/`))) throw new ValidationError("check outputs paths must be distinct portable relative files");
+		paths.push(path);
+	}
+	for (const key of ["maxFileBytes", "maxTotalBytes"]) if (typeof item[key] !== "number" || !Number.isSafeInteger(item[key]) || item[key] < 1 || item[key] > MAX_BYTES) throw new ValidationError("check output byte limits must be positive integers at most 64 MiB");
+	const maxFileBytes = item.maxFileBytes;
+	const maxTotalBytes = item.maxTotalBytes;
+	if (maxFileBytes > maxTotalBytes) throw new ValidationError("check outputs maxFileBytes must not exceed maxTotalBytes");
+	if (item.timeoutMs !== void 0 && (typeof item.timeoutMs !== "number" || !Number.isSafeInteger(item.timeoutMs) || item.timeoutMs < 1 || item.timeoutMs > MAX_TIMEOUT_MS)) throw new ValidationError("check outputs timeoutMs must be a positive integer at most 120000");
+	return Object.freeze({
+		paths: Object.freeze(paths),
+		maxFileBytes,
+		maxTotalBytes,
+		...item.timeoutMs === void 0 ? {} : { timeoutMs: item.timeoutMs }
+	});
+}
+/** Resolve and validate trusted ports before any isolated work starts. */
+function prepareIsolatedCheckOutputs(options) {
+	if (options === void 0) return void 0;
+	const { executionId, artifacts, ...declaration } = options;
+	const validated = validateIsolatedCheckOutputs(declaration);
+	if (typeof executionId !== "string" || executionId.trim() === "" || executionId.length > 200 || /\p{Cc}/u.test(executionId)) throw new ValidationError("check outputs executionId must be a nonempty bounded identifier");
+	if (typeof artifacts?.put !== "function" || typeof artifacts?.read !== "function") throw new ValidationError("check outputs requires a readable output artifact port");
+	return Object.freeze({
+		...validated,
+		executionId,
+		artifacts
+	});
+}
+var OutputCaptureError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(reason);
+		this.reason = reason;
+	}
+};
+/** Capture runs after command settlement, even on command failure or cancellation. There are no retries. */
+async function retainIsolatedCheckOutputs(options, inputDigest, read) {
+	const controller = new AbortController();
+	const clearTimer = armDeadlineTimer(options.timeoutMs ?? 3e4, () => controller.abort(), true);
+	const files = [];
+	const missing = [];
+	let totalBytes = 0;
+	try {
+		for (const path of options.paths) {
+			let phase = "capture-failed";
+			try {
+				const bytes = await runAbortable(() => read(path, Math.min(options.maxFileBytes, options.maxTotalBytes - totalBytes), controller.signal), controller.signal, "output capture deadline exceeded");
+				totalBytes += bytes.byteLength;
+				phase = "store-failed";
+				const artifact = await runAbortable(() => persistCandidateOutputArtifact(options.artifacts, {
+					executionId: options.executionId,
+					purpose: "grader-evidence",
+					bytes,
+					signal: controller.signal
+				}), controller.signal, "output persistence deadline exceeded");
+				files.push({
+					path,
+					artifact
+				});
+			} catch (error) {
+				missing.push({
+					path,
+					reason: controller.signal.aborted ? "timeout" : error instanceof OutputCaptureError ? error.reason : phase
+				});
+			}
+		}
+	} finally {
+		clearTimer();
+	}
+	return Object.freeze({
+		executionId: options.executionId,
+		inputDigest,
+		status: missing.length === 0 ? "retained" : "incomplete",
+		files: Object.freeze(files.map((file) => Object.freeze(file))),
+		missing: Object.freeze(missing.map((file) => Object.freeze(file)))
+	});
+}
+/** The local namespace has exited; the trusted host must keep its private copy stable. */
+function localCheckOutputReader(root) {
+	return async (path, maxBytes, signal) => {
+		try {
+			const rootInfo = await lstat(root);
+			if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) throw new OutputCaptureError("unsafe-path");
+			let current = root;
+			const parts = path.split("/");
+			let expected;
+			for (let index = 0; index < parts.length; index++) {
+				current = join(current, parts[index]);
+				const info = await lstat(current, { bigint: true });
+				if (info.isSymbolicLink() || (index < parts.length - 1 ? !info.isDirectory() : !info.isFile() || info.nlink !== 1n)) throw new OutputCaptureError("unsafe-path");
+				expected = info;
+			}
+			signal.throwIfAborted();
+			const file = await open(current, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+			try {
+				const before = await file.stat({ bigint: true });
+				if (!before.isFile() || before.nlink !== 1n || before.dev !== expected?.dev || before.ino !== expected?.ino) throw new OutputCaptureError("unsafe-path");
+				if (before.size > BigInt(maxBytes)) throw new OutputCaptureError("size-limit");
+				const chunks = [];
+				let total = 0;
+				const buffer = Buffer.allocUnsafe(Math.min(65536, maxBytes + 1));
+				while (true) {
+					signal.throwIfAborted();
+					const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, maxBytes - total + 1), null);
+					if (bytesRead === 0) break;
+					total += bytesRead;
+					if (total > maxBytes) throw new OutputCaptureError("size-limit");
+					chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
+				}
+				const after = await file.stat({ bigint: true });
+				if (before.size !== BigInt(total) || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs || after.nlink !== 1n) throw new OutputCaptureError("capture-failed");
+				return Buffer.concat(chunks, total);
+			} finally {
+				await file.close();
+			}
+		} catch (error) {
+			if (error?.code === "ENOENT") throw new OutputCaptureError("missing");
+			if (["ELOOP", "ENOTDIR"].includes(error?.code ?? "")) throw new OutputCaptureError("unsafe-path");
+			throw error;
+		}
+	};
+}
+/** Preserve a whole box only after its native lifecycle owner confirms stopped state. */
+async function stopCheckBoxForRecovery(box) {
+	const controller = new AbortController();
+	const clearTimer = armDeadlineTimer(3e4, () => controller.abort(), true);
+	try {
+		await runAbortable(() => box.stop({
+			wait: true,
+			signal: controller.signal
+		}), controller.signal, "check recovery stop deadline exceeded");
+		return true;
+	} catch {
+		return false;
+	} finally {
+		clearTimer();
+	}
+}
+/** Whether kill and process exit were confirmed; recovery custody still needs a whole-box stop. */
+async function stopCheckProcess(child) {
+	const controller = new AbortController();
+	const clearTimer = armDeadlineTimer(5e3, () => controller.abort(), true);
+	try {
+		await runAbortable(async () => {
+			await child.kill("SIGKILL", { tree: true });
+			await child.wait();
+		}, controller.signal, "check process stop deadline exceeded");
+		return true;
+	} catch {
+		return false;
+	} finally {
+		clearTimer();
+	}
+}
+const isolatedCheckOutputCaptureProgram = `import base64, errno, hashlib, json, os, stat, sys
+fds=[]
+def fail(reason):
+ print(json.dumps({'error':reason})); sys.exit(0)
+try:
+ root,path,limit=sys.argv[1],sys.argv[2],int(sys.argv[3])
+ directory=os.open(root,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW); fds.append(directory)
+ parts=path.split('/')
+ for part in parts[:-1]:
+  directory=os.open(part,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW,dir_fd=directory); fds.append(directory)
+ before=os.stat(parts[-1],dir_fd=directory,follow_symlinks=False)
+ if not stat.S_ISREG(before.st_mode) or before.st_nlink!=1: fail('unsafe-path')
+ fd=os.open(parts[-1],os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK,dir_fd=directory); fds.append(fd)
+ opened=os.fstat(fd)
+ if not stat.S_ISREG(opened.st_mode) or opened.st_nlink!=1 or (before.st_dev,before.st_ino)!=(opened.st_dev,opened.st_ino): fail('unsafe-path')
+ if opened.st_size>limit: fail('size-limit')
+ chunks=[]; total=0
+ while True:
+  chunk=os.read(fd,min(1048576,limit-total+1))
+  if not chunk: break
+  total+=len(chunk)
+  if total>limit: fail('size-limit')
+  chunks.append(chunk)
+ after=os.fstat(fd)
+ if (opened.st_size,opened.st_mtime_ns,opened.st_ctime_ns,opened.st_nlink)!=(after.st_size,after.st_mtime_ns,after.st_ctime_ns,after.st_nlink) or total!=opened.st_size: fail('capture-failed')
+ data=b''.join(chunks)
+ print(json.dumps({'content':base64.b64encode(data).decode('ascii'),'sha256':'sha256:'+hashlib.sha256(data).hexdigest()}))
+except OSError as error:
+ fail('missing' if error.errno==errno.ENOENT else 'unsafe-path' if error.errno in (errno.ELOOP,errno.ENOTDIR) else 'capture-failed')
+finally:
+ for fd in reversed(fds): os.close(fd)
+`;
+/** A box with declared outputs needs python3; missing capture tooling fails closed and keeps custody. */
+function boxCheckOutputReader(box, root, timeoutMs) {
+	return async (path, maxBytes, signal) => {
+		const child = await box.process.spawnExact("/usr/bin/python3", [
+			"-I",
+			"-S",
+			"-c",
+			isolatedCheckOutputCaptureProgram,
+			root,
+			path,
+			String(maxBytes)
+		], {
+			env: {
+				PATH: "/usr/bin:/bin",
+				LANG: "C"
+			},
+			inheritEnv: false,
+			timeoutMs
+		});
+		let stopping;
+		const stop = () => {
+			stopping ??= stopCheckProcess(child);
+		};
+		signal.addEventListener("abort", stop, { once: true });
+		if (signal.aborted) stop();
+		const chunks = [];
+		const limit = Math.ceil(maxBytes / 3) * 4 + 2048;
+		let length = 0;
+		let overflow = false;
+		const collect = async (stream, keep) => {
+			for await (const text of stream) {
+				length += Buffer.byteLength(text);
+				if (length > limit) {
+					overflow = true;
+					stop();
+				} else if (keep) chunks.push(text);
+			}
+		};
+		try {
+			await Promise.all([collect(child.stdout(), true), collect(child.stderr(), false)]);
+			if (overflow || await child.wait() !== 0) throw new OutputCaptureError("capture-failed");
+			signal.throwIfAborted();
+			const value = JSON.parse(chunks.join(""));
+			if (value.error === "missing" || value.error === "unsafe-path" || value.error === "size-limit" || value.error === "capture-failed") throw new OutputCaptureError(value.error);
+			if (typeof value.content !== "string" || typeof value.sha256 !== "string") throw new OutputCaptureError("capture-failed");
+			const bytes = Buffer.from(value.content, "base64");
+			if (bytes.byteLength > maxBytes) throw new OutputCaptureError("size-limit");
+			if (sha256Bytes$1(bytes) !== value.sha256) throw new OutputCaptureError("capture-failed");
+			return bytes;
+		} catch (error) {
+			stop();
+			throw error;
+		} finally {
+			signal.removeEventListener("abort", stop);
+			await stopping;
+		}
+	};
+}
 // src/runtime/isolated-checker.ts
 const toolchains = [
 	"/usr",
@@ -752,20 +1013,26 @@ const contains = (parent, child) => {
 *
 * Bubblewrap requires /usr/bin/bwrap and permission to create Linux namespaces.
 * Only trusted system toolchains, private proc/dev/tmp, and the writable copy are mounted.
-* The canonical input path remains the working directory; copy writes are discarded.
+* The canonical input path remains the working directory. Requested output files are retained
+* before cleanup; otherwise copy writes are discarded.
 * Time and output are bounded; input copy bytes and entries are bounded when requested.
 * The command's memory and generated files require a resource-limited placement.
 * Callers must keep the input and trusted toolchains stable while preparing the check.
 *
 * A box check creates one fresh box with no owner secrets and blocked egress (or strict egress to
 * the placement's named domains), delivers the tree's regular files verified by sha256, runs the
-* command there with only the environment `env` names, and deletes the box.
+* command there with only the environment `env` names, and deletes the box after successful
+* requested retention. Incomplete retention returns private recovery custody only after the
+* native owner confirms the box stopped. Box file capture requires /usr/bin/python3. Local recovery scratch is the
+* caller's responsibility; the resource-limited placement requirement still applies.
 */
 async function runIsolatedCheck(options) {
 	if (options.box) return runInBox(options, options.box);
 	let scratch;
+	let outputs;
 	let result;
 	try {
+		const retention = prepareIsolatedCheckOutputs(options.outputs);
 		if (process.platform !== "linux") throw new Error("Linux Bubblewrap namespaces are required");
 		const { timeoutMs, maxOutputBytes, maxInputBytes, maxInputEntries } = checkLimits(options);
 		if (options.signal?.aborted) return {
@@ -791,6 +1058,8 @@ async function runIsolatedCheck(options) {
 		if (contains(tree, scratch)) throw new Error("Temporary storage must be outside the input tree");
 		const copy = join(scratch, "tree");
 		await copyBoundedTree(tree, copy, maxInputBytes, maxInputEntries);
+		const input = retention ? await scanMaterializedWorkspaceManifest(copy) : void 0;
+		if (retention && input) assertOutputPathsUnoccupied(retention.paths, input);
 		result = await execute([
 			"--unshare-all",
 			"--die-with-parent",
@@ -827,6 +1096,17 @@ async function runIsolatedCheck(options) {
 			"--",
 			...options.command
 		], timeoutMs, maxOutputBytes, options.signal);
+		if (retention && input && (result.succeeded || result.reason !== "refused")) {
+			outputs = await retainIsolatedCheckOutputs(retention, canonicalCandidateDigest(input), localCheckOutputReader(copy));
+			if (outputs.status === "incomplete") outputs = {
+				...outputs,
+				source: {
+					kind: "local",
+					path: scratch
+				}
+			};
+			result = withRetainedOutputs(result, outputs);
+		}
 	} catch (error) {
 		result = {
 			succeeded: false,
@@ -834,7 +1114,7 @@ async function runIsolatedCheck(options) {
 			diagnostic: String(error)
 		};
 	}
-	if (scratch) try {
+	if (scratch && outputs?.status !== "incomplete") try {
 		await removeScratch(scratch);
 	} catch (error) {
 		const cleanupDiagnostic = String(error);
@@ -850,7 +1130,29 @@ async function runIsolatedCheck(options) {
 			cleanupDiagnostic
 		};
 	}
-	return result;
+	return outputs ? {
+		...result,
+		outputs
+	} : result;
+}
+/** A preexisting input file must never masquerade as newly produced evaluator evidence. */
+function assertOutputPathsUnoccupied(paths, input) {
+	for (const path of paths) if (input.files.some((file) => file.path === path || file.path.startsWith(`${path}/`) || path.startsWith(`${file.path}/`))) throw new Error("Declared check output path overlaps an input file");
+}
+function withRetainedOutputs(result, outputs) {
+	if (!result.succeeded || outputs.status === "retained") return {
+		...result,
+		outputs
+	};
+	return {
+		succeeded: false,
+		reason: "failed",
+		diagnostic: "Check outputs were not completely retained",
+		stdout: result.value.stdout,
+		stderr: result.value.stderr,
+		exitCode: 0,
+		outputs
+	};
 }
 function checkLimits(options) {
 	const timeoutMs = options.timeoutMs ?? 3e4;
@@ -929,7 +1231,7 @@ async function protectedTree(options) {
 }
 /** Box-workspace-relative directory that receives the tree and is the command's cwd. */
 const BOX_TREE = "tree";
-/** Bound on provisioning, delivery, and deletion; the box expires even if this process dies. */
+/** Setup headroom in the requested native lifetime policy; this is not a deletion guarantee. */
 const BOX_SETUP_SECONDS = 900;
 /** The box's own process timeout is a backstop behind this module's deadline. */
 const BOX_PROCESS_BACKSTOP_MS = 3e4;
@@ -938,9 +1240,16 @@ const BOX_EXEC_FAILURE = "process-supervisor: exec failed";
 async function runInBox(options, placement) {
 	let box;
 	let evidence;
+	let outputs;
+	let retention;
+	let maxLifetimeSeconds;
+	let commandAttempted = false;
+	let commandSettled = false;
 	let result;
 	try {
+		retention = prepareIsolatedCheckOutputs(options.outputs);
 		const { timeoutMs, maxOutputBytes, maxInputBytes, maxInputEntries } = checkLimits(options);
+		maxLifetimeSeconds = Math.ceil(timeoutMs / 1e3) + BOX_SETUP_SECONDS;
 		if (options.signal?.aborted) return {
 			succeeded: false,
 			reason: "cancelled",
@@ -953,6 +1262,7 @@ async function runInBox(options, placement) {
 			maxFileBytes: maxInputBytes ?? Number.MAX_SAFE_INTEGER,
 			maxTotalFileBytes: maxInputBytes ?? Number.MAX_SAFE_INTEGER
 		} });
+		if (retention) assertOutputPathsUnoccupied(retention.paths, captured.manifest);
 		if (placement.builderAccounts.length === 0 || placement.builderAccounts.some((id) => !id)) throw new Error("builderAccounts must name the account of every key the judged run holds");
 		const memoryMB = placement.resources?.memoryMB;
 		if (memoryMB !== void 0 && (!Number.isSafeInteger(memoryMB) || memoryMB < 1 || placement.resources?.advisory === true || placement.resources?.advisoryFields?.includes("memoryMB"))) throw new Error("Check box requires an explicit finite resources.memoryMB limit");
@@ -967,7 +1277,7 @@ async function runInBox(options, placement) {
 			ephemeral: placement.containers !== true,
 			egressPolicy: egressFor(placement),
 			...placement.resources ? { resources: placement.resources } : {},
-			maxLifetimeSeconds: Math.ceil(timeoutMs / 1e3) + BOX_SETUP_SECONDS,
+			maxLifetimeSeconds,
 			idempotencyKey: `agent-runtime-check-${randomUUID()}`
 		}, options.signal ? { signal: options.signal } : void 0);
 		const receipt = box.createReceipt();
@@ -1000,7 +1310,10 @@ async function runInBox(options, placement) {
 			input: captured.manifest,
 			inputDigest: canonicalCandidateDigest(captured.manifest)
 		};
-		result = await executeInBox(box, options.command, timeoutMs, maxOutputBytes, options.env ?? {}, options.signal);
+		commandAttempted = true;
+		const execution = await executeInBox(box, options.command, timeoutMs, maxOutputBytes, options.env ?? {}, options.signal);
+		result = execution.result;
+		commandSettled = execution.commandSettled;
 	} catch (error) {
 		result = {
 			succeeded: false,
@@ -1008,7 +1321,34 @@ async function runInBox(options, placement) {
 			diagnostic: String(error)
 		};
 	}
-	if (box) try {
+	if (box && evidence && retention && maxLifetimeSeconds !== void 0 && commandAttempted && (!commandSettled || result.succeeded || result.reason !== "refused")) {
+		outputs = commandSettled ? await retainIsolatedCheckOutputs(retention, evidence.inputDigest, boxCheckOutputReader(box, BOX_TREE, retention.timeoutMs ?? 3e4)) : {
+			executionId: retention.executionId,
+			inputDigest: evidence.inputDigest,
+			status: "incomplete",
+			files: [],
+			missing: retention.paths.map((path) => ({
+				path,
+				reason: "capture-failed"
+			}))
+		};
+		result = withRetainedOutputs(result, outputs);
+		if (outputs.status === "incomplete") {
+			if (await stopCheckBoxForRecovery(box)) outputs = {
+				...outputs,
+				source: {
+					kind: "sandbox",
+					sandboxId: box.id,
+					state: "stopped"
+				}
+			};
+			else if (!result.succeeded) result = {
+				...result,
+				cleanupDiagnostic: "Recovery source stop was not confirmed; box deletion was requested"
+			};
+		}
+	}
+	if (box && outputs?.source?.kind !== "sandbox") try {
 		await box.delete();
 	} catch (error) {
 		const cleanupDiagnostic = `Check box ${box.id} was not deleted: ${String(error)}`;
@@ -1021,13 +1361,14 @@ async function runInBox(options, placement) {
 			exitCode: 0
 		} : {
 			...result,
-			cleanupDiagnostic
+			cleanupDiagnostic: [result.cleanupDiagnostic, cleanupDiagnostic].filter(Boolean).join("; ")
 		};
 	}
-	return evidence ? {
+	return {
 		...result,
-		box: evidence
-	} : result;
+		...evidence ? { box: evidence } : {},
+		...outputs ? { outputs } : {}
+	};
 }
 /** Refuse unless the box reads each file with its manifest digest. `find` names the files: a box
 * process takes 256 arguments at most. A name holding a newline or backslash, which coreutils
@@ -1067,25 +1408,18 @@ function egressFor(placement) {
 }
 async function executeInBox(box, command, timeoutMs, limit, env, signal) {
 	const [executable, ...args] = command;
-	const child = await box.process.spawnExact(executable, args, {
-		cwd: BOX_TREE,
-		env: {
-			PATH: "/usr/bin:/bin",
-			HOME: "/tmp",
-			LANG: "C",
-			...env
-		},
-		inheritEnv: false,
-		timeoutMs: timeoutMs + BOX_PROCESS_BACKSTOP_MS
-	});
+	let child;
+	const deadline = new AbortController();
 	const stdout = [];
 	const stderr = [];
 	let bytes = 0;
 	let failure;
 	let stopping;
+	let stopped = false;
 	const stop = (reason) => {
 		failure ??= reason;
-		stopping ??= child.kill("SIGKILL", { tree: true }).catch(() => void 0);
+		deadline.abort();
+		if (child) stopping ??= stopCheckProcess(child);
 	};
 	const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
 	const cancel = () => stop("cancelled");
@@ -1093,6 +1427,7 @@ async function executeInBox(box, command, timeoutMs, limit, env, signal) {
 	if (signal?.aborted) cancel();
 	const capture = async (stream, target) => {
 		for await (const text of stream) {
+			if (deadline.signal.aborted) break;
 			const chunk = Buffer.from(text);
 			const remaining = Math.max(0, limit - bytes);
 			bytes += chunk.length;
@@ -1100,55 +1435,85 @@ async function executeInBox(box, command, timeoutMs, limit, env, signal) {
 			if (bytes > limit) stop("output-limit");
 		}
 	};
-	let exitCode;
-	let exitSignal;
+	let completion;
 	try {
-		await Promise.all([capture(child.stdout(), stdout), capture(child.stderr(), stderr)]);
-		exitCode = await child.wait();
-		exitSignal = (await child.status()).exitSignal;
+		child = await runAbortable(() => {
+			const launching = box.process.spawnExact(executable, args, {
+				cwd: BOX_TREE,
+				env: {
+					PATH: "/usr/bin:/bin",
+					HOME: "/tmp",
+					LANG: "C",
+					...env
+				},
+				inheritEnv: false,
+				timeoutMs: timeoutMs + BOX_PROCESS_BACKSTOP_MS
+			});
+			launching.then((late) => {
+				if (deadline.signal.aborted) stopCheckProcess(late);
+			}, () => void 0);
+			return launching;
+		}, deadline.signal, "Check interrupted");
+		const running = child;
+		completion = await runAbortable(async () => {
+			await Promise.all([capture(running.stdout(), stdout), capture(running.stderr(), stderr)]);
+			return {
+				exitCode: await running.wait(),
+				exitSignal: (await running.status()).exitSignal
+			};
+		}, deadline.signal, "Check interrupted");
+	} catch (error) {
+		if (child) stopping ??= stopCheckProcess(child);
+		if (!failure) throw error;
 	} finally {
 		clearTimer();
 		signal?.removeEventListener("abort", cancel);
-		await stopping;
+		stopped = await stopping === true;
 	}
 	const out = Buffer.concat(stdout).toString();
 	const err = Buffer.concat(stderr).toString();
+	const exitCode = completion?.exitCode ?? null;
+	const exitSignal = completion?.exitSignal;
 	const evidence = {
 		stdout: out,
 		stderr: err,
 		exitCode: exitSignal ? null : exitCode
 	};
-	if (failure) return {
+	const finish = (result) => ({
+		result,
+		commandSettled: completion !== void 0 || stopped
+	});
+	if (failure) return finish({
 		succeeded: false,
 		reason: failure,
 		diagnostic: err || failure,
 		...evidence
-	};
-	if (exitCode === 127 && err.startsWith(BOX_EXEC_FAILURE)) return {
+	});
+	if (exitCode === 127 && err.startsWith(BOX_EXEC_FAILURE)) return finish({
 		succeeded: false,
 		reason: "refused",
 		diagnostic: err,
 		...evidence
-	};
-	if (exitSignal) return {
+	});
+	if (exitSignal) return finish({
 		succeeded: false,
 		reason: "failed",
 		diagnostic: err || `Check killed by ${exitSignal}`,
 		...evidence
-	};
-	if (exitCode !== 0) return {
+	});
+	if (exitCode !== 0) return finish({
 		succeeded: false,
 		reason: "failed",
 		diagnostic: err || out || `Check exited ${exitCode}`,
 		...evidence
-	};
-	return {
+	});
+	return finish({
 		succeeded: true,
 		value: {
 			stdout: out,
 			stderr: err
 		}
-	};
+	});
 }
 function execute(args, timeoutMs, limit, signal) {
 	return new Promise((done) => {
@@ -10097,6 +10462,6 @@ async function runInWorkspace(ws, body, opts = {}) {
 function tail(s) {
 	return s.slice(-400);
 }
-export { runBenchmark as $, renderLeaderboardHtml as $t, searchPresets as A, sanitizeMcpToolSchema as At, graphFromSessionFacts as B, assertDeclaredCheck as Bt, withUntrackedArtifacts as C, harvestCorpus as Ct, SEARCH_SPEC_CORRELATION_KEY as D, connectStdioMcp as Dt, createFencedSqlRunContext as E, McpSpawnFault as Et, loadProfile as F, secretEnvOfMcpServer as Ft, chatWorkerSeam as G, readDeclaredCheck as Gt, loadGraphFile as H, declaredCheckDeliverable as Ht, pickBestProfile as I, inlineSandboxClient as It, strategyTournament as J, deterministicCompletion as Jt, createChatSessionStore as K, runIsolatedCheck as Kt, profileRegistry as L, loopCampaignDispatch as Lt, connectRemoteSupervisor as M, mcpSecretEnvMetadataKey as Mt, connectRemoteSupervisorControl as N, resolveMcpServerLaunch as Nt, assertSearchSpec as O, materializeLocalMcp as Ot, bestProfileFor as P, resolveSecretEnv as Pt, printBenchmarkReport as Q, pairwiseSignificance as Qt, profileRunsForName as R, loopDispatch as Rt, copyUntrackedIntoClone as S, HarvestError as St, validateStoredGraph as T, resolveSandboxClient as Tt, graphDesignerExtraTools as U, declaredCheckDigest as Ut, GraphFileResolutionError as V, checkProgramDigest as Vt, chatTransportExecutor as W, declaredCheckJudge as Wt, openSandboxRun as X, stopSentinel as Xt, SandboxRunAbortError as Y, sentinelCompletion as Yt, createS3PrivateCasStore as Z, leaderboard as Zt, NOTE_MAX_CHARS as _, buildSteerContext as _t, localShell as a, FileCorpus as at, composeWorkerEvidence as b, observationFromRegistry as bt, createVerifierEnvironment as c, fanout as ct, harvestSurfaceDiffs as d, panel as dt, renderLeaderboardMarkdown as en, createPrivateCasArtifactPort as et, analystsFromRegistry as f, pipeline as ft, EVIDENCE_MAX_CHARS as g, assertTraceDerivedFindings as gt, runCoderChecks as h, widen as ht, jjWorkspace as i, openSqlRunStore as in, runPersonified as it, searchSpecDigest as j, envKeyProvider as jt, compileSearchSpec as k, createMcpEnvironment as kt, boxSurfaceReader as l, flatWidenGate as lt, worktreeFanout as m, verify as mt, makeFinding$1 as n, renderPairwiseMarkdown as nn, trajectoryReport as nt, runInWorkspace as o, InMemoryCorpus as ot, failuresAnalyst as p, selectValidWinner as pt, runStrategyEvolution as q, completionAuthorizes as qt, gitWorkspace as r, SqlRunOwnershipError as rn, definePersona as rt, createWaterfallCollector as s, renderCorpusToInstructions as st, computeFindingId$1 as t, renderLeaderboardSvg as tn, equalKOnCost as tt, fsSurfaceReader as u, loopUntil as ut, VERIFY_TAIL_CHARS as v, createScopeAnalyst as vt, analyzeTrace as w, defineLeaderboard as wt, settledWorkerOut as x, inProcessSandboxClient as xt, closingWorkerNote as y, registryScopeAnalyst as yt, recordProfileRun as z, superviseDispatch as zt };
+export { runBenchmark as $, pairwiseSignificance as $t, searchPresets as A, sanitizeMcpToolSchema as At, graphFromSessionFacts as B, assertDeclaredCheck as Bt, withUntrackedArtifacts as C, harvestCorpus as Ct, SEARCH_SPEC_CORRELATION_KEY as D, connectStdioMcp as Dt, createFencedSqlRunContext as E, McpSpawnFault as Et, loadProfile as F, secretEnvOfMcpServer as Ft, chatWorkerSeam as G, readDeclaredCheck as Gt, loadGraphFile as H, declaredCheckDeliverable as Ht, pickBestProfile as I, inlineSandboxClient as It, strategyTournament as J, completionAuthorizes as Jt, createChatSessionStore as K, runIsolatedCheck as Kt, profileRegistry as L, loopCampaignDispatch as Lt, connectRemoteSupervisor as M, mcpSecretEnvMetadataKey as Mt, connectRemoteSupervisorControl as N, resolveMcpServerLaunch as Nt, assertSearchSpec as O, materializeLocalMcp as Ot, bestProfileFor as P, resolveSecretEnv as Pt, printBenchmarkReport as Q, leaderboard as Qt, profileRunsForName as R, loopDispatch as Rt, copyUntrackedIntoClone as S, HarvestError as St, validateStoredGraph as T, resolveSandboxClient as Tt, graphDesignerExtraTools as U, declaredCheckDigest as Ut, GraphFileResolutionError as V, checkProgramDigest as Vt, chatTransportExecutor as W, declaredCheckJudge as Wt, openSandboxRun as X, sentinelCompletion as Xt, SandboxRunAbortError as Y, deterministicCompletion as Yt, createS3PrivateCasStore as Z, stopSentinel as Zt, NOTE_MAX_CHARS as _, buildSteerContext as _t, localShell as a, openSqlRunStore as an, FileCorpus as at, composeWorkerEvidence as b, observationFromRegistry as bt, createVerifierEnvironment as c, fanout as ct, harvestSurfaceDiffs as d, panel as dt, renderLeaderboardHtml as en, createPrivateCasArtifactPort as et, analystsFromRegistry as f, pipeline as ft, EVIDENCE_MAX_CHARS as g, assertTraceDerivedFindings as gt, runCoderChecks as h, widen as ht, jjWorkspace as i, SqlRunOwnershipError as in, runPersonified as it, searchSpecDigest as j, envKeyProvider as jt, compileSearchSpec as k, createMcpEnvironment as kt, boxSurfaceReader as l, flatWidenGate as lt, worktreeFanout as m, verify as mt, makeFinding$1 as n, renderLeaderboardSvg as nn, trajectoryReport as nt, runInWorkspace as o, InMemoryCorpus as ot, failuresAnalyst as p, selectValidWinner as pt, runStrategyEvolution as q, validateIsolatedCheckOutputs as qt, gitWorkspace as r, renderPairwiseMarkdown as rn, definePersona as rt, createWaterfallCollector as s, renderCorpusToInstructions as st, computeFindingId$1 as t, renderLeaderboardMarkdown as tn, equalKOnCost as tt, fsSurfaceReader as u, loopUntil as ut, VERIFY_TAIL_CHARS as v, createScopeAnalyst as vt, analyzeTrace as w, defineLeaderboard as wt, settledWorkerOut as x, inProcessSandboxClient as xt, closingWorkerNote as y, registryScopeAnalyst as yt, recordProfileRun as z, superviseDispatch as zt };
 
-//# sourceMappingURL=runtime-BNSsSOZ7.js.map
+//# sourceMappingURL=runtime-CBt8PWn5.js.map