@te-river/opencode-team-mode 1.5.11 → 1.5.13

package/dist/tm/ptc/budgets.js

@@ -4,6 +4,12 @@
  * behavior unchanged.
  */
 import { tmError } from "../result.js";
+/** caller-facing arg key → resolved PtcBudgets key. */
+const BUDGET_FIELD_MAP = [
+    ["max_calls", "maxCalls"],
+    ["max_errors", "maxErrors"],
+    ["timeout_ms", "timeoutMs"],
+];
 /**
  * Clamp a caller-supplied budget against the resolved env ceiling.  Absent ->
  * the env ceiling; above the ceiling -> clamped DOWN (cannot loosen); below
@@ -20,13 +26,44 @@ function clampBudget(raw, ceiling, floor) {
         return floor;
     return i;
 }
-export function resolvePtcBudgets(cfg, budgets) {
-    const b = budgets && typeof budgets === "object" ? budgets : {};
-    return {
-        maxCalls: clampBudget(b.max_calls, cfg.ptcMaxCalls, PTC_BUDGET_BOUNDS_FLOOR.maxCalls),
-        maxErrors: clampBudget(b.max_errors, cfg.ptcMaxErrors, PTC_BUDGET_BOUNDS_FLOOR.maxErrors),
-        timeoutMs: clampBudget(b.timeout_ms, cfg.ptcTimeoutMs, PTC_BUDGET_BOUNDS_FLOOR.timeoutMs),
+/**
+ * Resolve budgets AND track provenance for the summary echo (fix batch T1):
+ * which fields the caller set, and which were clamped.  `resolvePtcBudgets`
+ * (plain) stays deepEqual-stable for existing callers; the echo arrays are
+ * attached by `parsePtcArgs`, never by the plain resolver.
+ */
+export function resolvePtcBudgetsDetailed(cfg, budgets) {
+    const b = budgets && typeof budgets === "object" && !Array.isArray(budgets)
+        ? budgets
+        : {};
+    const ceilings = {
+        maxCalls: cfg.ptcMaxCalls,
+        maxErrors: cfg.ptcMaxErrors,
+        timeoutMs: cfg.ptcTimeoutMs,
     };
+    const floors = {
+        maxCalls: PTC_BUDGET_BOUNDS_FLOOR.maxCalls,
+        maxErrors: PTC_BUDGET_BOUNDS_FLOOR.maxErrors,
+        timeoutMs: PTC_BUDGET_BOUNDS_FLOOR.timeoutMs,
+    };
+    const setByUser = [];
+    const clamped = [];
+    const out = {};
+    for (const [raw, key] of BUDGET_FIELD_MAP) {
+        out[key] = clampBudget(b[raw], ceilings[key], floors[key]);
+        const n = b[raw];
+        const num = typeof n === "number" ? n : n == null ? NaN : Number(n);
+        if (!Number.isFinite(num))
+            continue;
+        setByUser.push(raw);
+        const i = Math.trunc(num);
+        if (i !== out[key])
+            clamped.push(raw);
+    }
+    return { budgets: out, setByUser, clamped };
+}
+export function resolvePtcBudgets(cfg, budgets) {
+    return resolvePtcBudgetsDetailed(cfg, budgets).budgets;
 }
 // floors mirror config.ts PTC_BUDGET_BOUNDS (kept here so this module stays
 // self-contained for clamp tests without importing config internals).
@@ -36,7 +73,9 @@ export const PTC_LABEL_MAX = 80;
 /**
  * Validate + normalize tm_ptc_run args.  `program` over the length cap is a
  * hard args error (a program cannot be meaningfully truncated); `label` over
- * 80 is truncated; `budgets` are clamped toward the env ceilings.
+ * 80 is truncated; `budgets` are validated LOUDLY (fix batch T1: a wrong
+ * shape used to silently fall back to the ceiling — the caller never learned
+ * their budgets were ignored) and clamped toward the env ceilings.
  */
 export function parsePtcArgs(raw, cfg) {
     const a = raw ?? {};
@@ -53,7 +92,47 @@ export function parsePtcArgs(raw, cfg) {
     let label = typeof a.label === "string" && a.label.trim() ? a.label.trim() : "ptc-run";
     if (label.length > PTC_LABEL_MAX)
         label = label.slice(0, PTC_LABEL_MAX);
-    const budgets = resolvePtcBudgets(cfg, a.budgets);
+    // budgets — loud validation (fix batch T1)
+    const rawBudgets = a.budgets;
+    if (rawBudgets !== undefined) {
+        if (typeof rawBudgets !== "object" || rawBudgets === null || Array.isArray(rawBudgets)) {
+            return {
+                ok: false,
+                error: tmError("tm_ptc_run", "args", "budgets 必须是 { max_calls?, max_errors?, timeout_ms? } 对象"),
+            };
+        }
+        // Wave B Minor② — reject unknown keys.  A typo (max_call, missing the s)
+        // used to pass the type + per-field checks and then silently resolve to
+        // the ceiling default (T1's loud-validation goal violated: the caller
+        // never learned the budget was ignored).  The zod schema layer adds
+        // .strict() too, but this is the runtime backstop that always fires.
+        const knownKeys = new Set(BUDGET_FIELD_MAP.map(([raw]) => raw));
+        const unknownKeys = Object.keys(rawBudgets).filter((k) => !knownKeys.has(k));
+        if (unknownKeys.length > 0) {
+            return {
+                ok: false,
+                error: tmError("tm_ptc_run", "args", `budgets 含未知键 [${unknownKeys.join(", ")}]；合法键仅 max_calls / max_errors / timeout_ms（拼写必须完全一致，例如 max_call 漏 s 会被拒）`),
+            };
+        }
+        for (const [field] of BUDGET_FIELD_MAP) {
+            const v = rawBudgets[field];
+            if (v === undefined || v === null)
+                continue;
+            if (typeof v !== "number" || !Number.isFinite(v) || v < 1) {
+                return {
+                    ok: false,
+                    error: tmError("tm_ptc_run", "args", `budgets.${field} 必须是不小于 1 的数字（当前值：${JSON.stringify(v)}）`),
+                };
+            }
+        }
+    }
+    const resolution = resolvePtcBudgetsDetailed(cfg, rawBudgets);
+    // attach the echo provenance (setByUser / clamped) for the summary line
+    const budgets = {
+        ...resolution.budgets,
+        ...(resolution.setByUser.length ? { setByUser: resolution.setByUser } : {}),
+        ...(resolution.clamped.length ? { clamped: resolution.clamped } : {}),
+    };
     return { ok: true, args: { program, label, budgets } };
 }
 //# sourceMappingURL=budgets.js.map

package/dist/tm/ptc/budgets.js.map

@@ -1 +1 @@
-{"version":3,"file":"budgets.js","sourceRoot":"","sources":["../../../src/tm/ptc/budgets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAgBtC;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAY,EAAE,OAAe,EAAE,KAAa;IAC/D,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACzE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,OAAO,CAAA;IACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,GAAG,OAAO;QAAE,OAAO,OAAO,CAAA;IAC/B,IAAI,CAAC,GAAG,KAAK;QAAE,OAAO,KAAK,CAAA;IAC3B,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAa,EAAE,OAA4C;IAC3F,MAAM,CAAC,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/D,OAAO;QACL,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,uBAAuB,CAAC,QAAQ,CAAC;QACrF,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,YAAY,EAAE,uBAAuB,CAAC,SAAS,CAAC;QACzF,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,YAAY,EAAE,uBAAuB,CAAC,SAAS,CAAC;KAC1F,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAW,CAAA;AAEvF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAA;AAS/B;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAwC,EAAE,GAAa;IAClF,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE,CAAA;IACnB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,8DAA8D,CAAC,EAAE,CAAA;IAC5H,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,OAAO,CACZ,YAAY,EACZ,MAAM,EACN,kBAAkB,GAAG,CAAC,kBAAkB,UAAU,OAAO,CAAC,MAAM,sCAAsC,CACvG;SACF,CAAA;IACH,CAAC;IACD,IAAI,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACtF,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;IACvE,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,OAA2B,CAAC,CAAA;IACrE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAA;AACxD,CAAC"}
+{"version":3,"file":"budgets.js","sourceRoot":"","sources":["../../../src/tm/ptc/budgets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAoBtC,uDAAuD;AACvD,MAAM,gBAAgB,GAAG;IACvB,CAAC,WAAW,EAAE,UAAU,CAAC;IACzB,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,YAAY,EAAE,WAAW,CAAC;CACnB,CAAA;AAEV;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAY,EAAE,OAAe,EAAE,KAAa;IAC/D,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACzE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,OAAO,CAAA;IACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,GAAG,OAAO;QAAE,OAAO,OAAO,CAAA;IAC/B,IAAI,CAAC,GAAG,KAAK;QAAE,OAAO,KAAK,CAAA;IAC3B,OAAO,CAAC,CAAA;AACV,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAa,EACb,OAA4C;IAE5C,MAAM,CAAC,GACL,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAC/D,CAAC,CAAE,OAAmC;QACtC,CAAC,CAAC,EAAE,CAAA;IACR,MAAM,QAAQ,GAA2B;QACvC,QAAQ,EAAE,GAAG,CAAC,WAAW;QACzB,SAAS,EAAE,GAAG,CAAC,YAAY;QAC3B,SAAS,EAAE,GAAG,CAAC,YAAY;KAC5B,CAAA;IACD,MAAM,MAAM,GAA2B;QACrC,QAAQ,EAAE,uBAAuB,CAAC,QAAQ;QAC1C,SAAS,EAAE,uBAAuB,CAAC,SAAS;QAC5C,SAAS,EAAE,uBAAuB,CAAC,SAAS;KAC7C,CAAA;IACD,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAQ;QACnC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAA4B,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAa,EAAE,OAA4C;IAC3F,OAAO,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAA;AACxD,CAAC;AAED,4EAA4E;AAC5E,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAW,CAAA;AAEvF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAA;AAS/B;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAwC,EAAE,GAAa;IAClF,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE,CAAA;IACnB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,8DAA8D,CAAC,EAAE,CAAA;IAC5H,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,OAAO,CACZ,YAAY,EACZ,MAAM,EACN,kBAAkB,GAAG,CAAC,kBAAkB,UAAU,OAAO,CAAC,MAAM,sCAAsC,CACvG;SACF,CAAA;IACH,CAAC;IACD,IAAI,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACtF,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;IACvE,2CAA2C;IAC3C,MAAM,UAAU,GAAY,CAAC,CAAC,OAAO,CAAA;IACrC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,yDAAyD,CAAC;aAChG,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACvE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAqC,CAAC,CAAC,MAAM,CAC3E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CACzB,CAAA;QACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,OAAO,CACZ,YAAY,EACZ,MAAM,EACN,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,0EAA0E,CAClH;aACF,CAAA;QACH,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACvC,MAAM,CAAC,GAAI,UAAsC,CAAC,KAAK,CAAC,CAAA;YACxD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAQ;YAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,KAAK,qBAAqB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;iBAChG,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,EAAE,UAA8B,CAAC,CAAA;IACjF,wEAAwE;IACxE,MAAM,OAAO,GAAe;QAC1B,GAAG,UAAU,CAAC,OAAO;QACrB,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAA;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAA;AACxD,CAAC"}

package/dist/tm/ptc/contract.d.ts

@@ -11,12 +11,25 @@
  * semantics apply to every bridged call verbatim.  PTC is NOT a bypass layer.
  */
 import type { TmPhase } from "../result.js";
-/** The five PTC run statuses (design §2). */
-export declare const PTC_STATUS_VALUES: readonly ["ok", "stopped-error-budget", "stopped-call-budget", "timeout", "engine-error"];
+import type { PtcBudgets } from "./budgets.js";
+/** The six PTC run statuses (design §2; "program-error" added in the fix
+ *  batch to separate PROGRAM faults — the body threw, engine healthy, no
+ *  auto-degrade — from ENGINE faults). */
+export declare const PTC_STATUS_VALUES: readonly ["ok", "stopped-error-budget", "stopped-call-budget", "timeout", "engine-error", "program-error"];
 export type PtcStatus = (typeof PTC_STATUS_VALUES)[number];
-export type BridgeTool = "tm_read" | "tm_grep" | "tm_bash" | "tm_fetch";
-/** Bridge allow set — read-only; tm_ptc_run itself is excluded (no nesting). */
+export type BridgeTool = "tm_read" | "tm_grep" | "tm_bash" | "tm_fetch" | "tm_search" | "tm_webfetch";
+/**
+ * Bridge allow set — read-only; tm_ptc_run itself is excluded (no nesting).
+ * T6 added the two WEB bridges (tm_search / tm_webfetch): they are gated a
+ * second time at the bridge layer (TM_PTC_WEB_BRIDGE=off → the bridge returns
+ * an args error) and a THIRD time by the host ruleset — a bridged call runs
+ * the real tm_search/tm_webfetch execute with the CALLER's per-execute ctx, so
+ * ctx.ask evaluates against that agent's grant and a non-web role is denied
+ * with a permission error (zero new mechanism).
+ */
 export declare const BRIDGE_ALLOW: readonly BridgeTool[];
+/** The web bridge tools — the subset gated behind TM_PTC_WEB_BRIDGE + role. */
+export declare const WEB_BRIDGE_TOOLS: readonly BridgeTool[];
 /** Phases safe to retry once (idempotent read-only bridges; design §4.2). */
 export declare const RETRYABLE_PHASES: readonly TmPhase[];
 /** Error body the bridge surfaces (T1.4 shape: tool/phase/message/line?). */
@@ -43,6 +56,10 @@ export interface PtcRunRequest {
     program: string;
     /** monotonic token so a caller can correlate a call with its response. */
     startDeadlineMs: number;
+    /** wall-clock budget in ms — the worker engine sets it as the in-engine
+     *  vm script timeout (kills pre-await sync busy-loops in-engine,
+     *  complementary to the driver-side abort→terminate). */
+    timeoutMs?: number;
 }
 /** Engine → driver: a single bridged call to execute under the gate. */
 export interface PtcRpcRequest {
@@ -68,17 +85,26 @@ export type PtcEngineName = "worker" | "inline";
 /**
  * The engine seam — FROZEN.  InlineSequentialEngine shipped in M1,
  * WorkerEngine + InlineVmEngine in M2; a future engine implements this same
- * shape and neither the driver nor the tool changes.
+ * shape and neither the driver nor the tool changes.  (Fix batch: the
+ * OPTIONAL `opts` 4th param extends the seam source-compatibly — existing
+ * engines may ignore it; the worker engine turns `timeoutMs` into the
+ * in-engine vm script timeout.)
  */
 export interface PtcEngine {
     readonly name: PtcEngineName;
     /**
      * Run `program`, driving every bridge call through `bridge` (already
      * gate-wrapped by the driver). Resolve with the program's return value;
-     * reject with a `PtcStopSignal` for a budget/time stop, or any other Error
-     * for an engine/program fault. `signal` lets the driver race a timeout.
+     * reject with a `PtcStopSignal` for a budget/time stop, a
+     * `PtcProgramError` for a program fault, or any other Error for an
+     * engine fault. `signal` lets the driver race a timeout.
      */
-    run(program: string, bridge: PtcBridge, signal: AbortSignal): Promise<unknown>;
+    run(program: string, bridge: PtcBridge, signal: AbortSignal, opts?: PtcEngineRunOpts): Promise<unknown>;
+}
+/** Per-run hints handed to the engine (optional, ignorable). */
+export interface PtcEngineRunOpts {
+    startDeadlineMs?: number;
+    timeoutMs?: number;
 }
 /**
  * The stop signal unwinding a program on a budget/time hit.  Thrown by the
@@ -90,6 +116,16 @@ export declare class PtcStopSignal extends Error {
     readonly reason: "timeout" | "error-budget" | "call-budget";
     constructor(reason: "timeout" | "error-budget" | "call-budget");
 }
+/**
+ * A PROGRAM fault — the program body itself threw (the worker bootstrap
+ * posts kind:"program"; the inline-vm engine tags promise rejections).
+ * Distinct from an engine fault: the engine is healthy, so the driver maps
+ * it to status "program-error" and NEVER auto-degrades (re-running the same
+ * program would just throw again).
+ */
+export declare class PtcProgramError extends Error {
+    constructor(message: string, stack?: string);
+}
 /** Short display code for a ref: the `steps/<id>` step segment.  Shared by
  *  the gate (success table) and the summary renderer (error refs). */
 export declare function shortRefCode(ref: string): string;
@@ -124,8 +160,12 @@ export interface PtcRunOutcome {
     degraded: boolean;
     returnValue: unknown;
     returned: boolean;
-    /** set when the program threw (status=engine-error). */
+    /** set when the program or engine faulted (engine-error / program-error). */
     engineError?: PtcErrorBody;
+    /** budgets echo (fix batch T1): the EFFECTIVE values + which fields were
+     *  user-set / clamped — rendered as the summary's budgets line so the
+     *  operator sees clamping, not just the final numbers. */
+    budgets?: PtcBudgets;
     parentStepId: string;
 }
 //# sourceMappingURL=contract.d.ts.map

package/dist/tm/ptc/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/tm/ptc/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAK3C,6CAA6C;AAC7C,eAAO,MAAM,iBAAiB,2FAMpB,CAAA;AACV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE1D,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAA;AAEvE,gFAAgF;AAChF,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAAkD,CAAA;AAEhG,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,EAAE,SAAS,OAAO,EAAmC,CAAA;AAElF,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,kEAAkE;AAClE,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAA;AAEtC,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;CAC9E;AAID,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,MAAM,CAAA;IACT,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,QAAQ,CAAA;IACX,EAAE,EAAE,MAAM,CAAA;IACV,CAAC,EAAE,aAAa,CAAA;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,OAAO,CAAA;IACV,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,aAAa,CAAA;CACnD;AAED,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,cAAc,GAAG,WAAW,CAAA;AAE3E,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE/C;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/E;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,aAAa;gBAAlD,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,aAAa;CAIxE;AAED;sEACsE;AACtE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGhD;AAID,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,MAAM,CAAA;IACT,IAAI,EAAE,UAAU,CAAA;IAChB,EAAE,EAAE,OAAO,CAAA;IACX,EAAE,EAAE,MAAM,CAAA;IACV,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAA;IACd,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAA;IACZ,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,qBAAqB;IACrB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,SAAS,CAAA;IACjB,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;IACpB,QAAQ,EAAE,OAAO,CAAA;IACjB,wDAAwD;IACxD,WAAW,CAAC,EAAE,YAAY,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;CACrB"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/tm/ptc/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAI9C;;0CAE0C;AAC1C,eAAO,MAAM,iBAAiB,4GAOpB,CAAA;AACV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE1D,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,SAAS,GACT,UAAU,GACV,WAAW,GACX,aAAa,CAAA;AAEjB;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAO7C,CAAA;AAED,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAAiC,CAAA;AAEnF,6EAA6E;AAI7E,eAAO,MAAM,gBAAgB,EAAE,SAAS,OAAO,EAAmC,CAAA;AAElF,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,kEAAkE;AAClE,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAA;AAEtC,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;CAC9E;AAID,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAA;IACvB;;6DAEyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,MAAM,CAAA;IACT,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,QAAQ,CAAA;IACX,EAAE,EAAE,MAAM,CAAA;IACV,CAAC,EAAE,aAAa,CAAA;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,OAAO,CAAA;IACV,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,aAAa,CAAA;CACnD;AAED,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,cAAc,GAAG,WAAW,CAAA;AAE3E,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE/C;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B;;;;;;OAMG;IACH,GAAG,CACD,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,WAAW,EACnB,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,aAAa;gBAAlD,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,aAAa;CAIxE;AAED;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;CAK5C;AAED;sEACsE;AACtE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGhD;AAID,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,MAAM,CAAA;IACT,IAAI,EAAE,UAAU,CAAA;IAChB,EAAE,EAAE,OAAO,CAAA;IACX,EAAE,EAAE,MAAM,CAAA;IACV,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAA;IACd,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAA;IACZ,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,qBAAqB;IACrB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,SAAS,CAAA;IACjB,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;IACpB,QAAQ,EAAE,OAAO,CAAA;IACjB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,YAAY,CAAA;IAC1B;;8DAE0D;IAC1D,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;CACrB"}

package/dist/tm/ptc/contract.js

@@ -12,17 +12,40 @@
  */
 import { shorten } from "../config.js";
 // ---------- statuses + bridge surface (design §2) ---------------------------
-/** The five PTC run statuses (design §2). */
+/** The six PTC run statuses (design §2; "program-error" added in the fix
+ *  batch to separate PROGRAM faults — the body threw, engine healthy, no
+ *  auto-degrade — from ENGINE faults). */
 export const PTC_STATUS_VALUES = [
     "ok",
     "stopped-error-budget",
     "stopped-call-budget",
     "timeout",
     "engine-error",
+    "program-error",
 ];
-/** Bridge allow set — read-only; tm_ptc_run itself is excluded (no nesting). */
-export const BRIDGE_ALLOW = ["tm_read", "tm_grep", "tm_bash", "tm_fetch"];
+/**
+ * Bridge allow set — read-only; tm_ptc_run itself is excluded (no nesting).
+ * T6 added the two WEB bridges (tm_search / tm_webfetch): they are gated a
+ * second time at the bridge layer (TM_PTC_WEB_BRIDGE=off → the bridge returns
+ * an args error) and a THIRD time by the host ruleset — a bridged call runs
+ * the real tm_search/tm_webfetch execute with the CALLER's per-execute ctx, so
+ * ctx.ask evaluates against that agent's grant and a non-web role is denied
+ * with a permission error (zero new mechanism).
+ */
+export const BRIDGE_ALLOW = [
+    "tm_read",
+    "tm_grep",
+    "tm_bash",
+    "tm_fetch",
+    "tm_search",
+    "tm_webfetch",
+];
+/** The web bridge tools — the subset gated behind TM_PTC_WEB_BRIDGE + role. */
+export const WEB_BRIDGE_TOOLS = ["tm_search", "tm_webfetch"];
 /** Phases safe to retry once (idempotent read-only bridges; design §4.2). */
+// T6: tm_search / tm_webfetch issue GETs — idempotent — so their transient
+// failures (client/execute/store phases) inherit the SAME one-retry policy;
+// a permission/args error is never retried (the role denial must stand).
 export const RETRYABLE_PHASES = ["client", "execute", "store"];
 /**
  * The stop signal unwinding a program on a budget/time hit.  Thrown by the
@@ -38,6 +61,21 @@ export class PtcStopSignal extends Error {
         this.name = "PtcStopSignal";
     }
 }
+/**
+ * A PROGRAM fault — the program body itself threw (the worker bootstrap
+ * posts kind:"program"; the inline-vm engine tags promise rejections).
+ * Distinct from an engine fault: the engine is healthy, so the driver maps
+ * it to status "program-error" and NEVER auto-degrades (re-running the same
+ * program would just throw again).
+ */
+export class PtcProgramError extends Error {
+    constructor(message, stack) {
+        super(message);
+        this.name = "PtcProgramError";
+        if (typeof stack === "string" && stack)
+            this.stack = stack;
+    }
+}
 /** Short display code for a ref: the `steps/<id>` step segment.  Shared by
  *  the gate (success table) and the summary renderer (error refs). */
 export function shortRefCode(ref) {

package/dist/tm/ptc/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/tm/ptc/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,+EAA+E;AAE/E,6CAA6C;AAC7C,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,IAAI;IACJ,sBAAsB;IACtB,qBAAqB;IACrB,SAAS;IACT,cAAc;CACN,CAAA;AAKV,gFAAgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAA0B,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAEhG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAuB,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;AAuElF;;;;;GAKG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACjB;IAArB,YAAqB,MAAkD;QACrE,KAAK,CAAC,YAAY,MAAM,EAAE,CAAC,CAAA;QADR,WAAM,GAAN,MAAM,CAA4C;QAErE,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC7B,CAAC;CACF;AAED;sEACsE;AACtE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;AACpC,CAAC"}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/tm/ptc/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAGtC,+EAA+E;AAE/E;;0CAE0C;AAC1C,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,IAAI;IACJ,sBAAsB;IACtB,qBAAqB;IACrB,SAAS;IACT,cAAc;IACd,eAAe;CACP,CAAA;AAWV;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAA0B;IACjD,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,WAAW;IACX,aAAa;CACd,CAAA;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAA0B,CAAC,WAAW,EAAE,aAAa,CAAC,CAAA;AAEnF,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAuB,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;AA0FlF;;;;;GAKG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACjB;IAArB,YAAqB,MAAkD;QACrE,KAAK,CAAC,YAAY,MAAM,EAAE,CAAC,CAAA;QADR,WAAM,GAAN,MAAM,CAA4C;QAErE,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC7B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe,EAAE,KAAc;QACzC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IAC5D,CAAC;CACF;AAED;sEACsE;AACtE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;AACpC,CAAC"}

package/dist/tm/ptc/driver.d.ts

@@ -18,8 +18,11 @@ export interface EngineSelection {
  *  - "worker": WorkerEngine only (throws on failure → engine-error status).
  *  - "inline": InlineVmEngine only (script timeout for pre-await busy-loops).
  *  - "auto" (default): worker-first — the REAL auto-degrade happens in
- *    runPtc, which re-runs the whole program on InlineVmEngine when a worker
- *    run returns engine-error.
+ *    runPtc, which re-runs the whole program on InlineVmEngine ONLY when a
+ *    worker run returns engine-error having made ZERO bridged calls (the
+ *    worker could not start).  A worker that started and then crashed is
+ *    reported program-error / engine-error-with-calls and is NEVER replayed
+ *    on the inline realm (C1: never re-run a started program).
  */
 export declare function selectEngine(mode: "auto" | "worker" | "inline", bridge: PtcBridge): EngineSelection;
 export interface RunPtcOptions {

package/dist/tm/ptc/driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../src/tm/ptc/driver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAa,MAAM,eAAe,CAAA;AAMnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAI9C,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAA;IACjB,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,EAAE,MAAM,EAAE,SAAS,GAAG,eAAe,CAQnG;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,UAAU,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE,QAAQ,CAAA;IACb,KAAK,CAAC,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,wBAAsB,MAAM,CAAC,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAwIrE"}
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../src/tm/ptc/driver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAa,MAAM,eAAe,CAAA;AAMnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAI9C,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAA;IACjB,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,EAAE,MAAM,EAAE,SAAS,GAAG,eAAe,CAQnG;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,UAAU,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE,QAAQ,CAAA;IACb,KAAK,CAAC,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,wBAAsB,MAAM,CAAC,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAoKrE"}

package/dist/tm/ptc/driver.js

@@ -5,7 +5,7 @@
  * behavior unchanged.
  */
 import * as crypto from "node:crypto";
-import { PtcStopSignal } from "./contract.js";
+import { PtcProgramError, PtcStopSignal } from "./contract.js";
 import { createGateBridge } from "./gate.js";
 import { InlineVmEngine, WorkerEngine } from "./engines.js";
 import { staticPscan } from "./pscan.js";
@@ -14,8 +14,11 @@ import { staticPscan } from "./pscan.js";
  *  - "worker": WorkerEngine only (throws on failure → engine-error status).
  *  - "inline": InlineVmEngine only (script timeout for pre-await busy-loops).
  *  - "auto" (default): worker-first — the REAL auto-degrade happens in
- *    runPtc, which re-runs the whole program on InlineVmEngine when a worker
- *    run returns engine-error.
+ *    runPtc, which re-runs the whole program on InlineVmEngine ONLY when a
+ *    worker run returns engine-error having made ZERO bridged calls (the
+ *    worker could not start).  A worker that started and then crashed is
+ *    reported program-error / engine-error-with-calls and is NEVER replayed
+ *    on the inline realm (C1: never re-run a started program).
  */
 export function selectEngine(mode, bridge) {
     void bridge;
@@ -64,14 +67,18 @@ export async function runPtc(o) {
                 phase: "args",
                 message: `程序包含禁止标识符（${pscan.tokens.join(", ")}），已拒绝执行。`,
             },
+            budgets: o.budgets,
             parentStepId: o.parentStepId,
         };
     }
-    // Auto-degrade: if the selected engine throws (not a PtcStopSignal),
-    // and we're in auto mode with no explicit override, retry with InlineVmEngine.
-    const tryRun = async (eng) => {
+    // Auto-degrade: if the selected engine reports an ENGINE fault (not a
+    // budget stop, not a program fault), and we're in auto mode, retry with
+    // InlineVmEngine.  A program fault is tagged PtcProgramError by the
+    // engines and mapped to "program-error" below — it never re-runs (the
+    // same program would just throw again).
+    const tryRun = async (eng, parentId = o.parentStepId) => {
         const state = { calls: 0, errors: 0, retries: 0, steps: [] };
-        const gate = createGateBridge(o.bridge, o.parentStepId, o.budgets, state, {
+        const gate = createGateBridge(o.bridge, parentId, o.budgets, state, {
             now,
             deadlineAt,
             store: o.store,
@@ -79,7 +86,7 @@ export async function runPtc(o) {
         // parent call event (design §6)
         o.store?.appendTrajectory({
             tool: "tm_ptc_run",
-            step_id: o.parentStepId,
+            step_id: parentId,
             event: "call",
             label: o.label,
             program_sha256: crypto.createHash("sha256").update(o.program).digest("hex"),
@@ -93,7 +100,10 @@ export async function runPtc(o) {
         let returned = false;
         let engineError;
         try {
-            returnValue = await eng.run(o.program, gate, ac.signal);
+            returnValue = await eng.run(o.program, gate, ac.signal, {
+                startDeadlineMs: deadlineAt,
+                timeoutMs: o.budgets.timeoutMs,
+            });
             returned = true;
             status = state.stopReason ? mapStop(state.stopReason) : "ok";
         }
@@ -101,6 +111,17 @@ export async function runPtc(o) {
             if (err instanceof PtcStopSignal) {
                 status = mapStop(err.reason);
             }
+            else if (err instanceof PtcProgramError) {
+                // T5: the PROGRAM threw — distinct status, NO auto-degrade re-run.
+                status = "program-error";
+                const line = extractLine(err);
+                engineError = {
+                    tool: "tm_ptc_run",
+                    phase: "execute",
+                    message: err.message,
+                    ...(line != null ? { line } : {}),
+                };
+            }
             else {
                 status = "engine-error";
                 const line = extractLine(err);
@@ -130,11 +151,12 @@ export async function runPtc(o) {
             returnValue,
             returned,
             ...(engineError ? { engineError } : {}),
-            parentStepId: o.parentStepId,
+            budgets: o.budgets,
+            parentStepId: parentId,
         };
         o.store?.appendTrajectory({
             tool: "tm_ptc_run",
-            step_id: o.parentStepId,
+            step_id: parentId,
             event: "finish",
             status: outcome.status,
             calls: outcome.calls,
@@ -144,15 +166,25 @@ export async function runPtc(o) {
         });
         return outcome;
     };
-    // Auto mode: try worker first; on engine-error → degrade to inline.
-    if (!o.engine && o.cfg.ptcEngine === "auto" && engine.name === "worker") {
+    // Auto mode: try worker first.  C1 (never replay a started program): degrade
+    // to the inline-vm engine ONLY when the worker could not START at all — an
+    // ENGINE fault with ZERO bridged calls dispatched (the program never ran).
+    // A worker that started and THEN crashed surfaces as `program-error` (the
+    // engines tag any post-online crash a program fault) or as an `engine-error`
+    // with calls > 0; in BOTH such cases we return as-is and do NOT re-run the
+    // program on the more-privileged inline/ESM realm — re-running a program
+    // that already executed is exactly the sandbox-escape amplification the
+    // reviewer's PoC turned on.  An INJECTED engine participates too (tests
+    // inject crashers); the fallback is always the real InlineVmEngine.
+    if (o.cfg.ptcEngine === "auto" && engine.name === "worker") {
         const result = await tryRun(engine);
-        if (result.status === "engine-error") {
+        if (result.status === "engine-error" && result.calls === 0) {
             // Degrade to inline-vm and re-run.
             const inlineEngine = new InlineVmEngine();
-            const fallback = await tryRun(inlineEngine);
+            const fallback = await tryRun(inlineEngine, `${o.parentStepId}.r2`);
             fallback.degraded = true;
             fallback.engine = "inline";
+            fallback.parentStepId = o.parentStepId;
             return fallback;
         }
         return result;

package/dist/tm/ptc/driver.js.map

@@ -1 +1 @@
-{"version":3,"file":"driver.js","sourceRoot":"","sources":["../../../src/tm/ptc/driver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAIrC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAWxC;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAkC,EAAE,MAAiB;IAChF,KAAK,MAAM,CAAA;IACX,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,IAAI,cAAc,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IAC1D,CAAC;IACD,sEAAsE;IACtE,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,IAAI,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AACxD,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,CAAgB;IAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAC7B,MAAM,KAAK,GAAG,GAAG,EAAE,CAAA;IACnB,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAA;IAC9C,0EAA0E;IAC1E,IAAI,MAAiB,CAAA;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,CAAC,MAAM,CAAA;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;QACnB,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;IACzB,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,gCAAgC;IAChC,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,CAAC;YACR,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,QAAQ;YACR,WAAW,EAAE,SAAS;YACtB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,aAAa,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU;aACxD;YACD,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAA;IACH,CAAC;IAED,qEAAqE;IACrE,+EAA+E;IAC/E,MAAM,MAAM,GAAG,KAAK,EAAE,GAAc,EAA0B,EAAE;QAC9D,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;QACvE,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE;YACxE,GAAG;YACH,UAAU;YACV,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAA;QAEF,gCAAgC;QAChC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC;YACxB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,CAAC,CAAC,YAAY;YACvB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3E,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAA;QAEF,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,GAAG,EAAE,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;QAErD,IAAI,MAAiB,CAAA;QACrB,IAAI,WAAoB,CAAA;QACxB,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,WAAyC,CAAA;QAC7C,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;YACvD,QAAQ,GAAG,IAAI,CAAA;YACf,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,cAAc,CAAA;gBACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;gBAC7B,WAAW,GAAG;oBACZ,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,cAAc,CAAC;oBAC3E,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClC,CAAA;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,CAAA;QACxB,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;YAC/C,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;YACjD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,EAAE;YACF,MAAM,EAAE,GAAG,CAAC,IAAI;YAChB,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAA;QACD,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC;YACxB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,CAAC,CAAC,YAAY;YACvB,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,QAAQ;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,oEAAoE;IACpE,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACrC,mCAAmC;YACnC,MAAM,YAAY,GAAG,IAAI,cAAc,EAAE,CAAA;YACzC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;YAC3C,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAA;YACxB,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAA;YAC1B,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,OAAO,CAAC,MAAkD;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,IAAI,MAAM,KAAK,cAAc;QAAE,OAAO,sBAAsB,CAAA;IAC5D,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3B,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,EAAE,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvC,CAAC"}
+{"version":3,"file":"driver.js","sourceRoot":"","sources":["../../../src/tm/ptc/driver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAIrC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAWxC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,IAAkC,EAAE,MAAiB;IAChF,KAAK,MAAM,CAAA;IACX,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,IAAI,cAAc,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IAC1D,CAAC;IACD,sEAAsE;IACtE,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,IAAI,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AACxD,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,CAAgB;IAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAC7B,MAAM,KAAK,GAAG,GAAG,EAAE,CAAA;IACnB,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAA;IAC9C,0EAA0E;IAC1E,IAAI,MAAiB,CAAA;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,CAAC,MAAM,CAAA;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;QACnB,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;IACzB,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,gCAAgC;IAChC,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,CAAC;YACR,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,QAAQ;YACR,WAAW,EAAE,SAAS;YACtB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,aAAa,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU;aACxD;YACD,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAA;IACH,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,sEAAsE;IACtE,wCAAwC;IACxC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAc,EAAE,WAAmB,CAAC,CAAC,YAAY,EAA0B,EAAE;QACjG,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;QACvE,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE;YAClE,GAAG;YACH,UAAU;YACV,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAA;QAEF,gCAAgC;QAChC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC;YACxB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3E,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAA;QAEF,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,GAAG,EAAE,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;QAErD,IAAI,MAAiB,CAAA;QACrB,IAAI,WAAoB,CAAA;QACxB,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,WAAyC,CAAA;QAC7C,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE;gBACtD,eAAe,EAAE,UAAU;gBAC3B,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS;aAC/B,CAAC,CAAA;YACF,QAAQ,GAAG,IAAI,CAAA;YACf,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9B,CAAC;iBAAM,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;gBAC1C,mEAAmE;gBACnE,MAAM,GAAG,eAAe,CAAA;gBACxB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;gBAC7B,WAAW,GAAG;oBACZ,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClC,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,cAAc,CAAA;gBACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;gBAC7B,WAAW,GAAG;oBACZ,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,cAAc,CAAC;oBAC3E,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClC,CAAA;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,CAAA;QACxB,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;YAC/C,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;YACjD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,EAAE;YACF,MAAM,EAAE,GAAG,CAAC,IAAI;YAChB,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,YAAY,EAAE,QAAQ;SACvB,CAAA;QACD,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC;YACxB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,QAAQ;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YAC3D,mCAAmC;YACnC,MAAM,YAAY,GAAG,IAAI,cAAc,EAAE,CAAA;YACzC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAA;YACnE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAA;YACxB,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAA;YAC1B,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAA;YACtC,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,OAAO,CAAC,MAAkD;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,IAAI,MAAM,KAAK,cAAc;QAAE,OAAO,sBAAsB,CAAA;IAC5D,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3B,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,EAAE,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvC,CAAC"}

package/dist/tm/ptc/engines.d.ts

@@ -7,19 +7,30 @@
  * irrecoverably).
  * M2 primary: WorkerEngine (worker_threads + MessagePort RPC, env:{},
  * resourceLimits, hard `terminate()` wall-clock kill; bootstrap as a
- * build-time string, strict-mode program body).
- * M2 fallback: InlineVmEngine (node:vm runInNewContext — the script timeout
+ * build-time string; the program body runs inside a node:vm sandbox —
+ * whitelist { tm, console, setTimeout, clearTimeout }, no node globals —
+ * with the run's timeoutMs as the in-engine script timeout).
+ * M2 fallback: InlineVmEngine (node:vm runInContext — the script timeout
  * kills PRE-await synchronous busy-loops; a POST-await busy loop blocks the
  * host event loop irrecoverably, documented — prefer worker/auto).
+ *
+ * C1 fix batch: BOTH vm engines now build their `tm` facade IN-CONTEXT via
+ * `vm.compileFunction` (parsingContext) and compile the context with
+ * `codeGeneration:{strings:false,wasm:false}`, so an injected facade's
+ * `.constructor` is the sandbox Function
+ * and `tm.read.constructor("return process")()` / `eval` / `new Function` THROW
+ * instead of escaping into the worker/plugin realm.  A started worker that
+ * then crashes is reported as a program fault (never auto-replayed on the
+ * more-privileged inline realm) — see engines WorkerEngine error/exit handling.
  */
-import type { PtcBridge, PtcEngine, PtcEngineName } from "./contract.js";
+import type { PtcBridge, PtcEngine, PtcEngineName, PtcEngineRunOpts } from "./contract.js";
 export declare class InlineSequentialEngine implements PtcEngine {
     readonly name: PtcEngineName;
     run(program: string, bridge: PtcBridge, signal: AbortSignal): Promise<unknown>;
 }
 export declare class WorkerEngine implements PtcEngine {
     readonly name: PtcEngineName;
-    run(program: string, bridge: PtcBridge, signal: AbortSignal): Promise<unknown>;
+    run(program: string, bridge: PtcBridge, signal: AbortSignal, opts?: PtcEngineRunOpts): Promise<unknown>;
 }
 export declare class InlineVmEngine implements PtcEngine {
     readonly name: PtcEngineName;

package/dist/tm/ptc/engines.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engines.d.ts","sourceRoot":"","sources":["../../../src/tm/ptc/engines.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAiC,MAAM,eAAe,CAAA;AAYvG,qBAAa,sBAAuB,YAAW,SAAS;IACtD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAW;IACjC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CAyBrF;AAID,qBAAa,YAAa,YAAW,SAAS;IAC5C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAW;IAEjC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CA8GrF;AAID,qBAAa,cAAe,YAAW,SAAS;IAC9C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAW;IACvC;mEAC+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;gBAC7B,gBAAgB,SAAS;IAI/B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CAuBrF"}
+{"version":3,"file":"engines.d.ts","sourceRoot":"","sources":["../../../src/tm/ptc/engines.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAiC,MAAM,eAAe,CAAA;AAuHzH,qBAAa,sBAAuB,YAAW,SAAS;IACtD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAW;IACjC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CAyBrF;AAID,qBAAa,YAAa,YAAW,SAAS;IAC5C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAW;IAEjC,GAAG,CACP,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,WAAW,EACnB,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,OAAO,CAAC;CAkOpB;AAID,qBAAa,cAAe,YAAW,SAAS;IAC9C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAW;IACvC;mEAC+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;gBAC7B,gBAAgB,SAAS;IAI/B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CAoFrF"}