@vercel/agent-eval 2.4.1 → 2.6.0

package/dist/lib/agents/redact.d.ts

@@ -23,10 +23,30 @@
  * JWT prefix match flags). The tradeoff is that a credential the framework never
  * saw is not covered: if a run refreshes its own token mid-flight, only the value
  * we started with is redacted.
+ *
+ * "Exact" includes the forms a JSON encoder gives the value. Transcripts are
+ * JSON: a credential containing a quote, a backslash, a newline, or non-ASCII
+ * text appears escaped there (`a\"b`, `line1\nline2`, `\u00e9`), and a literal
+ * match on the raw value would miss it while anyone could decode it back. See
+ * {@link encodedForms}.
  */
 import type { AgentRunResult } from './types.js';
 export declare const REDACTED = "[REDACTED]";
-/** Replace every occurrence of each secret with {@link REDACTED}. */
+/**
+ * The text a secret can turn into inside JSON output: as written, escaped once
+ * by the encoders the agent CLIs and common tools use, and escaped twice (JSON
+ * inside a JSON string, such as a tool's JSON output recorded in a JSONL
+ * transcript).
+ *
+ * Encoders agree on quotes, backslashes, and control characters but differ on
+ * the rest, so each style is covered: plain (JavaScript, Rust), ASCII-only with
+ * `\u` escapes for every non-ASCII character (Python's default), HTML-safe
+ * `<`, `>`, `&`, U+2028, and U+2029 (Go's default), and escaped slashes. Hex
+ * digits appear in both cases. A secret made only of characters no encoder
+ * escapes has a single form: itself.
+ */
+export declare function encodedForms(secret: string): string[];
+/** Replace every occurrence of each secret, in any of its {@link encodedForms}, with {@link REDACTED}. */
 export declare function redactSecrets(text: string, secrets: readonly (string | undefined)[]): string;
 /**
  * Buffer-level equivalent of {@link redactSecrets}.
@@ -37,8 +57,8 @@ export declare function redactSecrets(text: string, secrets: readonly (string |
  * exactly the files byte-fidelity exists to protect. Passing a Buffer to
  * {@link redactSecrets} is worse still — Buffer has no `split`, so it throws.
  *
- * Credentials are ASCII, so their UTF-8 byte sequence is located and spliced out
- * directly and every other byte is copied through untouched.
+ * Each secret form's UTF-8 byte sequence is located and spliced out directly,
+ * and every other byte is copied through untouched.
  */
 export declare function redactSecretsBuffer(content: Buffer, secrets: readonly (string | undefined)[]): Buffer;
 /**
@@ -52,4 +72,15 @@ export declare function redactSecretsBuffer(content: Buffer, secrets: readonly (
  * model names, deleted-file paths — are passed through untouched.
  */
 export declare function redactRunResult(result: AgentRunResult, secrets: readonly (string | undefined)[]): AgentRunResult;
+/**
+ * Redact every string (and Buffer) inside an arbitrary value. Used for payloads
+ * that leave the run as plain data, such as reporter events, where the value
+ * carries user-attached fields (`analysis`, `metadata`) that
+ * {@link redactRunResult} never saw.
+ *
+ * Returns a copy: arrays and plain objects are rebuilt, strings and Buffers are
+ * redacted, and everything else (numbers, functions, class instances such as
+ * Date) is passed through by reference. The input is not mutated.
+ */
+export declare function redactValue<T>(value: T, secrets: readonly (string | undefined)[]): T;
 //# sourceMappingURL=redact.d.ts.map

package/dist/lib/agents/redact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../../src/lib/agents/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,YAAY,CAAC;AAE/D,eAAO,MAAM,QAAQ,eAAe,CAAC;AAmBrC,qEAAqE;AACrE,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACvC,MAAM,CAQR;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACvC,MAAM,CAoBR;AASD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACvC,cAAc,CAmChB"}
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../../src/lib/agents/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,YAAY,CAAC;AAE/D,eAAO,MAAM,QAAQ,eAAe,CAAC;AA0CrC;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAYrD;AA+CD,0GAA0G;AAC1G,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACvC,MAAM,CAER;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACvC,MAAM,CAER;AAMD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACvC,cAAc,CAoChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,CAAC,CA4BpF"}

package/dist/lib/agents/redact.js

@@ -6,42 +6,93 @@ export const REDACTED = '[REDACTED]';
  * replace every empty string in the output.
  */
 const MIN_SECRET_LENGTH = 16;
-/** Usable secrets, deduped and ordered longest-first so overlaps redact whole. */
-function usableSecrets(secrets) {
-    const seen = new Set();
-    for (const s of secrets) {
-        if (s && s.length >= MIN_SECRET_LENGTH)
-            seen.add(s);
+/** Escape one UTF-16 code unit as `\uXXXX`. */
+function unicodeEscape(code, upper) {
+    const hex = code.toString(16).padStart(4, '0');
+    return `\\u${upper ? hex.toUpperCase() : hex}`;
+}
+const SHORT_ESCAPES = {
+    '"': '\\"',
+    '\\': '\\\\',
+    '\n': '\\n',
+    '\r': '\\r',
+    '\t': '\\t',
+    '\b': '\\b',
+    '\f': '\\f',
+};
+/**
+ * JSON string escaping with configurable `\uXXXX` coverage: control
+ * characters always, plus whatever `escapeAlso` selects.
+ */
+function escapeJson(text, escapeAlso, upper) {
+    let out = '';
+    for (let i = 0; i < text.length; i++) {
+        const char = text[i];
+        const code = text.charCodeAt(i);
+        if (SHORT_ESCAPES[char])
+            out += SHORT_ESCAPES[char];
+        else if (code < 0x20 || escapeAlso(code))
+            out += unicodeEscape(code, upper);
+        else
+            out += char;
     }
-    return [...seen].sort((a, b) => b.length - a.length);
+    return out;
 }
-/** Replace every occurrence of each secret with {@link REDACTED}. */
-export function redactSecrets(text, secrets) {
+/**
+ * The text a secret can turn into inside JSON output: as written, escaped once
+ * by the encoders the agent CLIs and common tools use, and escaped twice (JSON
+ * inside a JSON string, such as a tool's JSON output recorded in a JSONL
+ * transcript).
+ *
+ * Encoders agree on quotes, backslashes, and control characters but differ on
+ * the rest, so each style is covered: plain (JavaScript, Rust), ASCII-only with
+ * `\u` escapes for every non-ASCII character (Python's default), HTML-safe
+ * `<`, `>`, `&`, U+2028, and U+2029 (Go's default), and escaped slashes. Hex
+ * digits appear in both cases. A secret made only of characters no encoder
+ * escapes has a single form: itself.
+ */
+export function encodedForms(secret) {
+    const htmlUnsafe = (code) => code === 0x3c || code === 0x3e || code === 0x26 || code === 0x2028 || code === 0x2029;
+    const nonAscii = (code) => code > 0x7f;
+    const plain = JSON.stringify(secret).slice(1, -1);
+    const once = new Set([plain, plain.replace(/\//g, '\\/')]);
+    for (const upper of [false, true]) {
+        once.add(escapeJson(secret, nonAscii, upper));
+        once.add(escapeJson(secret, htmlUnsafe, upper));
+    }
+    const forms = new Set([secret, ...once]);
+    for (const form of once)
+        forms.add(JSON.stringify(form).slice(1, -1));
+    return [...forms];
+}
+/**
+ * Every string to replace for these secrets: each usable secret in all of its
+ * encoded forms, deduped and ordered longest-first so overlaps redact whole.
+ */
+function redactionNeedles(secrets) {
+    const needles = new Set();
+    for (const secret of secrets) {
+        if (!secret || secret.length < MIN_SECRET_LENGTH)
+            continue;
+        for (const form of encodedForms(secret))
+            needles.add(form);
+    }
+    return [...needles].sort((a, b) => b.length - a.length);
+}
+function replaceText(text, needles) {
     let out = text;
-    for (const secret of usableSecrets(secrets)) {
+    for (const needle of needles) {
         // split/join rather than RegExp: the secret is arbitrary text and must not be
         // interpreted as a pattern.
-        out = out.split(secret).join(REDACTED);
+        out = out.split(needle).join(REDACTED);
     }
     return out;
 }
 const REDACTED_BYTES = Buffer.from(REDACTED, 'utf-8');
-/**
- * Buffer-level equivalent of {@link redactSecrets}.
- *
- * `generatedFiles` holds raw bytes so that binary assets survive collection
- * intact. Redaction therefore cannot route through a string: decoding to UTF-8
- * and re-encoding replaces every non-UTF-8 byte with U+FFFD, which would corrupt
- * exactly the files byte-fidelity exists to protect. Passing a Buffer to
- * {@link redactSecrets} is worse still — Buffer has no `split`, so it throws.
- *
- * Credentials are ASCII, so their UTF-8 byte sequence is located and spliced out
- * directly and every other byte is copied through untouched.
- */
-export function redactSecretsBuffer(content, secrets) {
+function replaceBuffer(content, needles) {
     let out = content;
-    for (const secret of usableSecrets(secrets)) {
-        const needle = Buffer.from(secret, 'utf-8');
+    for (const text of needles) {
+        const needle = Buffer.from(text, 'utf-8');
         let found = out.indexOf(needle);
         if (found === -1)
             continue;
@@ -57,8 +108,27 @@ export function redactSecretsBuffer(content, secrets) {
     }
     return out;
 }
-function redactScriptResult(result, secrets) {
-    return { ...result, output: redactSecrets(result.output, secrets) };
+/** Replace every occurrence of each secret, in any of its {@link encodedForms}, with {@link REDACTED}. */
+export function redactSecrets(text, secrets) {
+    return replaceText(text, redactionNeedles(secrets));
+}
+/**
+ * Buffer-level equivalent of {@link redactSecrets}.
+ *
+ * `generatedFiles` holds raw bytes so that binary assets survive collection
+ * intact. Redaction therefore cannot route through a string: decoding to UTF-8
+ * and re-encoding replaces every non-UTF-8 byte with U+FFFD, which would corrupt
+ * exactly the files byte-fidelity exists to protect. Passing a Buffer to
+ * {@link redactSecrets} is worse still — Buffer has no `split`, so it throws.
+ *
+ * Each secret form's UTF-8 byte sequence is located and spliced out directly,
+ * and every other byte is copied through untouched.
+ */
+export function redactSecretsBuffer(content, secrets) {
+    return replaceBuffer(content, redactionNeedles(secrets));
+}
+function redactScriptResult(result, needles) {
+    return { ...result, output: replaceText(result.output, needles) };
 }
 /**
  * Redact every text-bearing field of a run result. Returns a new object; the
@@ -71,33 +141,76 @@ function redactScriptResult(result, secrets) {
  * model names, deleted-file paths — are passed through untouched.
  */
 export function redactRunResult(result, secrets) {
-    if (usableSecrets(secrets).length === 0)
+    const needles = redactionNeedles(secrets);
+    if (needles.length === 0)
         return result;
     const redacted = {
         ...result,
-        output: redactSecrets(result.output, secrets),
+        output: replaceText(result.output, needles),
     };
     if (result.transcript !== undefined) {
-        redacted.transcript = redactSecrets(result.transcript, secrets);
+        redacted.transcript = replaceText(result.transcript, needles);
     }
     if (result.error !== undefined) {
-        redacted.error = redactSecrets(result.error, secrets);
+        redacted.error = replaceText(result.error, needles);
     }
     if (result.testResult) {
-        redacted.testResult = redactScriptResult(result.testResult, secrets);
+        redacted.testResult = redactScriptResult(result.testResult, needles);
     }
     if (result.scriptsResults) {
         redacted.scriptsResults = Object.fromEntries(Object.entries(result.scriptsResults).map(([name, script]) => [
             name,
-            redactScriptResult(script, secrets),
+            redactScriptResult(script, needles),
         ]));
     }
     if (result.generatedFiles) {
         redacted.generatedFiles = Object.fromEntries(Object.entries(result.generatedFiles).map(([path, content]) => [
             path,
-            redactSecretsBuffer(content, secrets),
+            replaceBuffer(content, needles),
         ]));
     }
     return redacted;
 }
+/**
+ * Redact every string (and Buffer) inside an arbitrary value. Used for payloads
+ * that leave the run as plain data, such as reporter events, where the value
+ * carries user-attached fields (`analysis`, `metadata`) that
+ * {@link redactRunResult} never saw.
+ *
+ * Returns a copy: arrays and plain objects are rebuilt, strings and Buffers are
+ * redacted, and everything else (numbers, functions, class instances such as
+ * Date) is passed through by reference. The input is not mutated.
+ */
+export function redactValue(value, secrets) {
+    const needles = redactionNeedles(secrets);
+    if (needles.length === 0)
+        return value;
+    const copies = new Map();
+    const visit = (current) => {
+        if (typeof current === 'string')
+            return replaceText(current, needles);
+        if (Buffer.isBuffer(current))
+            return replaceBuffer(current, needles);
+        if (current === null || typeof current !== 'object')
+            return current;
+        if (copies.has(current))
+            return copies.get(current);
+        if (Array.isArray(current)) {
+            const copy = [];
+            copies.set(current, copy);
+            for (const item of current)
+                copy.push(visit(item));
+            return copy;
+        }
+        const prototype = Object.getPrototypeOf(current);
+        if (prototype !== Object.prototype && prototype !== null)
+            return current;
+        const copy = {};
+        copies.set(current, copy);
+        for (const [key, item] of Object.entries(current))
+            copy[key] = visit(item);
+        return copy;
+    };
+    return visit(value);
+}
 //# sourceMappingURL=redact.js.map

package/dist/lib/agents/redact.js.map

@@ -1 +1 @@
-{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../../src/lib/agents/redact.ts"],"names":[],"mappings":"AA4BA,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,kFAAkF;AAClF,SAAS,aAAa,CAAC,OAAwC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,iBAAiB;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,OAAwC;IAExC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,8EAA8E;QAC9E,4BAA4B;QAC5B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,OAAwC;IAExC,IAAI,GAAG,GAAG,OAAO,CAAC;IAElB,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAE3B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,CAAC;YACzD,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAoB,EACpB,OAAwC;IAExC,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAsB,EACtB,OAAwC;IAExC,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAEvD,MAAM,QAAQ,GAAmB;QAC/B,GAAG,MAAM;QACT,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;KAC9C,CAAC;IAEF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,QAAQ,CAAC,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,QAAQ,CAAC,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,QAAQ,CAAC,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC,WAAW,CAC1C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC5D,IAAI;YACJ,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC;SACpC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC,WAAW,CAC1C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YAC7D,IAAI;YACJ,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC;SACtC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../../src/lib/agents/redact.ts"],"names":[],"mappings":"AAkCA,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,+CAA+C;AAC/C,SAAS,aAAa,CAAC,IAAY,EAAE,KAAc;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;CACZ,CAAC;AAEF;;;GAGG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,UAAqC,EAAE,KAAc;IACrF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;aAC/C,IAAI,IAAI,GAAG,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,GAAG,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;;YACvE,GAAG,IAAI,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC;IAC3H,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAwC;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB;YAAE,SAAS;QAC3D,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAA0B;IAC3D,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,8EAA8E;QAC9E,4BAA4B;QAC5B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAEtD,SAAS,aAAa,CAAC,OAAe,EAAE,OAA0B;IAChE,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAE3B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,CAAC;YACzD,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,OAAwC;IAExC,OAAO,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,OAAwC;IAExC,OAAO,aAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB,EAAE,OAA0B;IAC1E,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAsB,EACtB,OAAwC;IAExC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAExC,MAAM,QAAQ,GAAmB;QAC/B,GAAG,MAAM;QACT,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;KAC5C,CAAC;IAEF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,QAAQ,CAAC,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,QAAQ,CAAC,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,QAAQ,CAAC,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC,WAAW,CAC1C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC5D,IAAI;YACJ,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC;SACpC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC,WAAW,CAC1C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YAC7D,IAAI;YACJ,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAI,KAAQ,EAAE,OAAwC;IAC/E,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAW,EAAE;QAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QACpE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAc,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QAEzE,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO,KAAK,CAAC,KAAK,CAAM,CAAC;AAC3B,CAAC"}

package/dist/lib/agents/shared.d.ts

@@ -4,6 +4,7 @@
 import type { ScriptResult } from './types.js';
 import type { SandboxManager } from '../sandbox.js';
 import type { DockerSandboxManager } from '../docker-sandbox.js';
+import { type TokenUsage } from '../o11y/index.js';
 import type { ValidationMode } from '../types.js';
 /** Union type for sandbox implementations */
 type AnySandbox = SandboxManager | DockerSandboxManager;
@@ -75,11 +76,29 @@ export declare function ensureValidationRunner(sandbox: AnySandbox): Promise<voi
  * Run validation scripts in the sandbox.
  */
 export declare function runValidation(sandbox: AnySandbox, scripts: string[], validation?: ValidationMode, env?: Record<string, string>): Promise<ValidationResults>;
+/**
+ * Identity variables set on the agent and validation processes so the agent
+ * sees a generic user rather than the sandbox's own account name.
+ */
+export declare const NEUTRAL_WORKSPACE_ENV: Readonly<Record<string, string>>;
 export declare function prepareNeutralWorkspace(sandbox: AnySandbox): Promise<NeutralWorkspace>;
 export declare function initGitAndCommit(sandbox: AnySandbox): Promise<void>;
+/**
+ * Whether `path` is a canonical path inside the workspace, the only kind git
+ * prints for a tracked file: relative, with no `.` or `..` segments, no empty
+ * segments, no trailing slash, and nothing inside a `.git` directory.
+ *
+ * Diff capture runs git in the agent's sandbox, where the agent can put its own
+ * `git` first on PATH. Every path it reports is therefore untrusted input, and
+ * anything that fails this check is dropped before it is read, written, or
+ * deleted anywhere: `../` could otherwise reach outside a results directory on
+ * the host, and an alias like `./EVAL.ts` could slip past a glob.
+ */
+export declare function isWorkspacePath(path: string): boolean;
 /**
  * Capture source files generated by the agent.
  * Returns both modified/added files (with content) and deleted file paths.
+ * Paths that aren't canonical workspace paths are dropped (see {@link isWorkspacePath}).
  */
 export declare function captureGeneratedFiles(sandbox: AnySandbox): Promise<{
     generatedFiles: Record<string, Buffer>;
@@ -93,9 +112,13 @@ export declare function createVitestConfig(sandbox: AnySandbox): Promise<void>;
  * Inject transcript context into the sandbox so EVAL.ts tests can assert on agent behavior.
  * Writes parsed transcript summary to `__agent_eval__/results.json`.
  *
+ * `usage` is token usage the agent reported outside its transcript. It takes
+ * precedence over the transcript's own usage, the same order the run's result
+ * uses, so EVAL.ts and result.json agree.
+ *
  * This is best-effort: failures are silently ignored since it's supplementary data.
  */
-export declare function injectTranscriptContext(sandbox: AnySandbox, rawTranscript: string | undefined, agentName: string, model?: string): Promise<void>;
+export declare function injectTranscriptContext(sandbox: AnySandbox, rawTranscript: string | undefined, agentName: string, model?: string, usage?: TokenUsage): Promise<void>;
 /**
  * AI Gateway configuration.
  */

package/dist/lib/agents/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/lib/agents/shared.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,6CAA6C;AAC7C,KAAK,UAAU,GAAG,cAAc,GAAG,oBAAoB,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,gCAA2C,CAAC;AAMhF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,mCAA8C,CAAC;AAE5E,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,kCAA6C,CAAC;AAEhF,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,qCAAgD,CAAC;AAE/E;oFACoF;AACpF,eAAO,MAAM,iBAAiB,iCAA4C,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpF;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAgCD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/E;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,GAAE,cAAyB,EAIrC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAwC5B;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0B5F;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAYzE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAuC7E;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B3E;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,UAAU,EACnB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;CAIb,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,gBAAgB;;CAEnB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,aAAa;;CAEhB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,aAAa;;CAEhB,CAAC"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/lib/agents/shared.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,6CAA6C;AAC7C,KAAK,UAAU,GAAG,cAAc,GAAG,oBAAoB,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,gCAA2C,CAAC;AAMhF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,mCAA8C,CAAC;AAE5E,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,kCAA6C,CAAC;AAEhF,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,qCAAgD,CAAC;AAE/E;oFACoF;AACpF,eAAO,MAAM,iBAAiB,iCAA4C,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpF;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAgCD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/E;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,GAAE,cAAyB,EAIrC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAwC5B;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGjE,CAAC;AAEH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0B5F;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAYzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIrD;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAyC7E;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B3E;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,UAAU,EACnB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;CAIb,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,gBAAgB;;CAEnB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,aAAa;;CAEhB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,aAAa;;CAEhB,CAAC"}

package/dist/lib/agents/shared.js

@@ -1,6 +1,7 @@
 /**
  * Shared utilities for agent implementations.
  */
+import { posix } from 'node:path';
 import { parseTranscript } from '../o11y/index.js';
 /**
  * Well-known directory where transcript context is written inside the sandbox.
@@ -140,8 +141,16 @@ env) {
     }
     return results;
 }
+/**
+ * Identity variables set on the agent and validation processes so the agent
+ * sees a generic user rather than the sandbox's own account name.
+ */
+export const NEUTRAL_WORKSPACE_ENV = Object.freeze({
+    USER: 'user',
+    LOGNAME: 'user',
+});
 export async function prepareNeutralWorkspace(sandbox) {
-    const neutralEnv = { USER: 'user', LOGNAME: 'user' };
+    const neutralEnv = { ...NEUTRAL_WORKSPACE_ENV };
     const currentWorkingDirectory = sandbox.getWorkingDirectory();
     await sandbox.runShell('git remote remove origin 2>/dev/null || true; rm -rf .git/logs');
     if (!currentWorkingDirectory.includes('/vercel/')) {
@@ -171,24 +180,46 @@ export async function initGitAndCommit(sandbox) {
     // the generated files
     await sandbox.runShell('git init && git config user.email "agent-eval@localhost" && git config user.name "agent-eval" && git add . && git commit -m "init"');
 }
+/**
+ * Whether `path` is a canonical path inside the workspace, the only kind git
+ * prints for a tracked file: relative, with no `.` or `..` segments, no empty
+ * segments, no trailing slash, and nothing inside a `.git` directory.
+ *
+ * Diff capture runs git in the agent's sandbox, where the agent can put its own
+ * `git` first on PATH. Every path it reports is therefore untrusted input, and
+ * anything that fails this check is dropped before it is read, written, or
+ * deleted anywhere: `../` could otherwise reach outside a results directory on
+ * the host, and an alias like `./EVAL.ts` could slip past a glob.
+ */
+export function isWorkspacePath(path) {
+    if (!path || path.includes('\0') || path.startsWith('/'))
+        return false;
+    if (posix.normalize(path) !== path)
+        return false;
+    return path.split('/').every((segment) => segment !== '' && segment !== '.' && segment !== '..' && segment !== '.git');
+}
 /**
  * Capture source files generated by the agent.
  * Returns both modified/added files (with content) and deleted file paths.
+ * Paths that aren't canonical workspace paths are dropped (see {@link isWorkspacePath}).
  */
 export async function captureGeneratedFiles(sandbox) {
     const generatedFiles = {};
     const deletedFiles = [];
     try {
-        // Use --name-status to distinguish added/modified from deleted
-        const findResult = await sandbox.runShell("git add . && git diff HEAD --name-status");
-        const lines = findResult.stdout
-            .trim()
-            .split('\n')
-            .filter(Boolean);
-        for (const line of lines) {
-            const [status, ...rest] = line.split('\t');
-            const filePath = rest.join('\t');
-            if (!filePath)
+        // --name-status distinguishes added/modified from deleted. --no-renames is
+        // needed because `git diff` detects renames by default and reports a moved
+        // file as one `R<score>\t<old>\t<new>` entry, which would lose both the old
+        // path's deletion and the new path's content. -z keeps paths verbatim:
+        // without it, git C-quotes paths containing quotes, backslashes, control
+        // characters, or non-ASCII bytes, and the quoted form can't be read back.
+        const findResult = await sandbox.runShell('git add . && git diff HEAD --name-status --no-renames -z');
+        // Records are "<status>\0<path>\0".
+        const fields = findResult.stdout.split('\0');
+        for (let i = 0; i + 1 < fields.length; i += 2) {
+            const status = fields[i].trim();
+            const filePath = fields[i + 1];
+            if (!isWorkspacePath(filePath))
                 continue;
             if (status === 'D') {
                 deletedFiles.push(filePath);
@@ -247,15 +278,19 @@ export default defineConfig({
  * Inject transcript context into the sandbox so EVAL.ts tests can assert on agent behavior.
  * Writes parsed transcript summary to `__agent_eval__/results.json`.
  *
+ * `usage` is token usage the agent reported outside its transcript. It takes
+ * precedence over the transcript's own usage, the same order the run's result
+ * uses, so EVAL.ts and result.json agree.
+ *
  * This is best-effort: failures are silently ignored since it's supplementary data.
  */
-export async function injectTranscriptContext(sandbox, rawTranscript, agentName, model) {
+export async function injectTranscriptContext(sandbox, rawTranscript, agentName, model, usage) {
     try {
         const transcript = rawTranscript
             ? parseTranscript(rawTranscript, agentName, model)
             : null;
         const context = {
-            o11y: transcript?.summary ?? null,
+            o11y: transcript ? { ...transcript.summary, ...(usage ? { usage } : {}) } : null,
         };
         await sandbox.writeFiles({
             [TRANSCRIPT_CONTEXT_PATH]: JSON.stringify(context, null, 2),

package/dist/lib/agents/shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/lib/agents/shared.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEvD,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,sBAAsB,eAAe,CAAC;AAEhF,kFAAkF;AAClF,gFAAgF;AAChF,oDAAoD;AAEpD,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,sBAAsB,kBAAkB,CAAC;AAE5E,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,sBAAsB,iBAAiB,CAAC;AAEhF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,sBAAsB,oBAAoB,CAAC;AAE/E;oFACoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,sBAAsB,gBAAgB,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,eAA6B;IAC9D,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AACzE,CAAC;AAgBD;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,OAAmB;IAC/C,IAAI,CAAC;QACH,iEAAiE;QACjE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAE/D,sDAAsD;YACtD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,oBAAoB;YACpB,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IAED,2DAA2D;IAC3D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAmB;IAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE;QAC9B,SAAS;QACT,WAAW;QACX,mBAAmB;QACnB,YAAY;QACZ,WAAW;QACX,UAAU,uBAAuB,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAmB,EACnB,OAAiB,EACjB,aAA6B,QAAQ;AACrC,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,GAA4B;IAE5B,MAAM,OAAO,GAAsB;QACjC,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,sDAAsD;QACtD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAE/C,yEAAyE;QACzE,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAEtC,oEAAoE;QACpE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3G,OAAO,CAAC,IAAI,GAAG;YACb,OAAO,EAAE,UAAU,CAAC,QAAQ,KAAK,CAAC;YAClC,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM;SAC9C,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,YAAY,CAAC,QAAQ,KAAK,CAAC;YACpC,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM;SAClD,CAAC;QAEF,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;QAEjC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAmB;IAC/D,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACrD,MAAM,uBAAuB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAE9D,MAAM,OAAO,CAAC,QAAQ,CAAC,gEAAgE,CAAC,CAAC;IAEzF,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,GAAG,EAAE,uBAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,oBAAoB,GAAG,YAAY,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CACvC;QACE,eAAe,oBAAoB,EAAE;QACrC,iBAAiB,oBAAoB,EAAE;QACvC,gBAAgB,oBAAoB,GAAG;QACvC,qCAAqC,oBAAoB,EAAE;KAC5D,CAAC,IAAI,CAAC,MAAM,CAAC,CACf,CAAC;IACF,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IAClD,OAAO,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAmB;IACxD,MAAM,OAAO,CAAC,UAAU,CAAC;QACvB,8EAA8E;QAC9E,6EAA6E;QAC7E,YAAY,EAAE,kCAAkC;KACjD,CAAC,CAAC;IAEH,4HAA4H;IAC5H,sBAAsB;IACtB,MAAM,OAAO,CAAC,QAAQ,CACpB,oIAAoI,CACrI,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAmB;IAEnB,MAAM,cAAc,GAA2B,EAAE,CAAC;IAClD,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,IAAI,CAAC;QACH,+DAA+D;QAC/D,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;QAEtF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM;aAC5B,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEjC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,oEAAoE;oBACpE,oEAAoE;oBACpE,mEAAmE;oBACnE,oCAAoC;oBACpC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;oBACvD,cAAc,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAmB;IAC1D,gCAAgC;IAChC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAE/C,yEAAyE;IACzE,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,UAAU,GAAG,GAAG,OAAO,CAAC,mBAAmB,EAAE,IAAI,gBAAgB,EAAE,CAAC;IAE1E,MAAM,OAAO,CAAC,UAAU,CAAC;QACvB,kBAAkB,EAAE;;;;iBAIP,QAAQ;;;;;;oBAML,UAAU;;;2CAGa,UAAU;;;CAGpD;KACE,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAmB,EACnB,aAAiC,EACjC,SAAiB,EACjB,KAAc;IAEd,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,eAAe,CAAC,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,UAAU,EAAE,OAAO,IAAI,IAAI;SAClC,CAAC;QAEF,MAAM,OAAO,CAAC,UAAU,CAAC;YACvB,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,8BAA8B;IACvC,aAAa,EAAE,iCAAiC;IAChD,YAAY,EAAE,oBAAoB;CAC1B,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,YAAY,EAAE,mBAAmB;CACzB,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,2BAA2B;IACpC,YAAY,EAAE,gBAAgB;CACtB,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,YAAY,EAAE,gBAAgB;CACtB,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,YAAY,EAAE,gBAAgB;CACtB,CAAC"}
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/lib/agents/shared.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAE,eAAe,EAAmB,MAAM,kBAAkB,CAAC;AAMpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEvD,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,sBAAsB,eAAe,CAAC;AAEhF,kFAAkF;AAClF,gFAAgF;AAChF,oDAAoD;AAEpD,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,sBAAsB,kBAAkB,CAAC;AAE5E,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,sBAAsB,iBAAiB,CAAC;AAEhF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,sBAAsB,oBAAoB,CAAC;AAE/E;oFACoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,sBAAsB,gBAAgB,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,eAA6B;IAC9D,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AACzE,CAAC;AAgBD;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,OAAmB;IAC/C,IAAI,CAAC;QACH,iEAAiE;QACjE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAE/D,sDAAsD;YACtD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,oBAAoB;YACpB,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IAED,2DAA2D;IAC3D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAmB;IAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE;QAC9B,SAAS;QACT,WAAW;QACX,mBAAmB;QACnB,YAAY;QACZ,WAAW;QACX,UAAU,uBAAuB,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAmB,EACnB,OAAiB,EACjB,aAA6B,QAAQ;AACrC,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,GAA4B;IAE5B,MAAM,OAAO,GAAsB;QACjC,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,sDAAsD;QACtD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAE/C,yEAAyE;QACzE,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAEtC,oEAAoE;QACpE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3G,OAAO,CAAC,IAAI,GAAG;YACb,OAAO,EAAE,UAAU,CAAC,QAAQ,KAAK,CAAC;YAClC,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM;SAC9C,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,YAAY,CAAC,QAAQ,KAAK,CAAC;YACpC,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM;SAClD,CAAC;QAEF,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;QAEjC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACnF,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,MAAM;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAmB;IAC/D,MAAM,UAAU,GAAG,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAChD,MAAM,uBAAuB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAE9D,MAAM,OAAO,CAAC,QAAQ,CAAC,gEAAgE,CAAC,CAAC;IAEzF,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,GAAG,EAAE,uBAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,oBAAoB,GAAG,YAAY,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CACvC;QACE,eAAe,oBAAoB,EAAE;QACrC,iBAAiB,oBAAoB,EAAE;QACvC,gBAAgB,oBAAoB,GAAG;QACvC,qCAAqC,oBAAoB,EAAE;KAC5D,CAAC,IAAI,CAAC,MAAM,CAAC,CACf,CAAC;IACF,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IAClD,OAAO,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAmB;IACxD,MAAM,OAAO,CAAC,UAAU,CAAC;QACvB,8EAA8E;QAC9E,6EAA6E;QAC7E,YAAY,EAAE,kCAAkC;KACjD,CAAC,CAAC;IAEH,4HAA4H;IAC5H,sBAAsB;IACtB,MAAM,OAAO,CAAC,QAAQ,CACpB,oIAAoI,CACrI,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC;AACzH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAmB;IAEnB,MAAM,cAAc,GAA2B,EAAE,CAAC;IAClD,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,IAAI,CAAC;QACH,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,0DAA0D,CAAC,CAAC;QAEtG,oCAAoC;QACpC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAE/B,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEzC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,oEAAoE;oBACpE,oEAAoE;oBACpE,mEAAmE;oBACnE,oCAAoC;oBACpC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;oBACvD,cAAc,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAmB;IAC1D,gCAAgC;IAChC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAE/C,yEAAyE;IACzE,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,UAAU,GAAG,GAAG,OAAO,CAAC,mBAAmB,EAAE,IAAI,gBAAgB,EAAE,CAAC;IAE1E,MAAM,OAAO,CAAC,UAAU,CAAC;QACvB,kBAAkB,EAAE;;;;iBAIP,QAAQ;;;;;;oBAML,UAAU;;;2CAGa,UAAU;;;CAGpD;KACE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAmB,EACnB,aAAiC,EACjC,SAAiB,EACjB,KAAc,EACd,KAAkB;IAElB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,eAAe,CAAC,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;SACjF,CAAC;QAEF,MAAM,OAAO,CAAC,UAAU,CAAC;YACvB,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,8BAA8B;IACvC,aAAa,EAAE,iCAAiC;IAChD,YAAY,EAAE,oBAAoB;CAC1B,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,YAAY,EAAE,mBAAmB;CACzB,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,2BAA2B;IACpC,YAAY,EAAE,gBAAgB;CACtB,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,YAAY,EAAE,gBAAgB;CACtB,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,YAAY,EAAE,gBAAgB;CACtB,CAAC"}

package/dist/lib/agents/types.d.ts

@@ -1,7 +1,8 @@
 /**
  * Agent interface and common types for all agents.
  */
-import type { JudgeConfig, ModelPolicy, ModelTier, SetupFunction, SandboxBackend, ValidationMode } from '../types.js';
+import type { JudgeConfig, ModelPolicy, ModelTier, RunProvenance, SetupFunction, SandboxBackend, ValidationMode, VerifierMode } from '../types.js';
+import type { TokenUsage } from '../o11y/types.js';
 import type { AgentDefinition } from './plugin/contract.js';
 /**
  * Common options for all agents.
@@ -59,6 +60,16 @@ export interface AgentRunOptions {
     /** Pin the agentic LLM judge to a fixed agent+model. Undefined → the judge
      * self-grades with this run's agent+model. */
     judge?: JudgeConfig;
+    /** Extra environment variables for the agent process only (see
+     * `ExperimentConfig.agentEnv`). Default undefined: the agent's environment is
+     * unchanged. */
+    agentEnv?: Record<string, string>;
+    /** Where validation runs (see `ExperimentConfig.verifier`). Default
+     * undefined: validation runs in the agent's sandbox, as before. */
+    verifier?: VerifierMode;
+    /** Globs the agent must not change (see `ExperimentConfig.protectedPaths`).
+     * Default undefined: no tampering report in shared mode. */
+    protectedPaths?: string[];
 }
 /**
  * Result from running a script.
@@ -95,6 +106,18 @@ export interface AgentRunResult {
     observedModel?: string;
     /** Codex only: model re-stated explicitly by the shell-tool repair (see RunnerResult.modelRepair) */
     modelRepair?: string;
+    /** Token usage reported by the agent. When omitted, agent-eval reads it from
+     * the transcript with the agent's transcript parser. */
+    usage?: TokenUsage;
+    /** What ran (harness and agent CLI versions, sandbox environment). Set by the
+     * shared orchestrator; custom agents may set it themselves. */
+    provenance?: RunProvenance;
+    /** `'separate'` when validation ran in a separate verifier sandbox. */
+    verifier?: VerifierMode;
+    /** Id of the separate verifier sandbox, for debugging. */
+    verifierSandboxId?: string;
+    /** Protected paths the agent changed, sorted (see `EvalRunResult.tampering`). */
+    tampering?: string[];
 }
 /**
  * Agent interface that all agents must implement.

package/dist/lib/agents/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/agents/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACtH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,qCAAqC;IACrC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC;IAClC;mFAC+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;qCAEiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;;;OAeG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;8DAC0D;IAC1D,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC;kDAC8C;IAC9C,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC9C,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IAEb,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IAEpB,iCAAiC;IACjC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5E,+DAA+D;IAC/D,eAAe,IAAI,MAAM,CAAC;IAE1B,2CAA2C;IAC3C,eAAe,IAAI,SAAS,CAAC;IAE7B;mFAC+E;IAC/E,UAAU,EAAE,eAAe,CAAC;CAC7B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/agents/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,qCAAqC;IACrC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC;IAClC;mFAC+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;qCAEiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;;;OAeG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;8DAC0D;IAC1D,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC;kDAC8C;IAC9C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;oBAEgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;uEACmE;IACnE,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;gEAC4D;IAC5D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC9C,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;4DACwD;IACxD,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB;mEAC+D;IAC/D,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,0DAA0D;IAC1D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IAEb,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IAEpB,iCAAiC;IACjC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5E,+DAA+D;IAC/D,eAAe,IAAI,MAAM,CAAC;IAE1B,2CAA2C;IAC3C,eAAe,IAAI,SAAS,CAAC;IAE7B;mFAC+E;IAC/E,UAAU,EAAE,eAAe,CAAC;CAC7B"}