@wix/pathgrade 1.0.25 → 1.0.27

package/dist/internal/direct-mcp-v2/acp-client.js

@@ -0,0 +1,310 @@
+/* oxlint-disable anti-slop/no-unknown-parameters, anti-slop/no-runtime-typeof -- ACP frames are an external JSON-RPC trust boundary. */
+import { spawn } from 'node:child_process';
+import { createInterface } from 'node:readline';
+function isJsonObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function jsonValue(value) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (Array.isArray(value))
+        return value.map(jsonValue);
+    if (value !== null && typeof value === 'object')
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, jsonValue(entry)]));
+    throw new Error('ACP response was not JSON');
+}
+function jsonObject(value) {
+    const parsed = jsonValue(value);
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw new Error('ACP frame was not a JSON object');
+    return parsed;
+}
+function errorFromResponse(method, value) {
+    if (!isJsonObject(value))
+        return new Error(`${method} failed with an invalid JSON-RPC error`);
+    const rawMessage = value.message;
+    const code = value.code;
+    const message = typeof rawMessage === 'string' ? rawMessage : 'unknown ACP error';
+    return Object.assign(new Error(`${method} failed: ${message}`), {
+        code: typeof code === 'number' || typeof code === 'string' ? code : undefined,
+        data: value.data,
+    });
+}
+export class AcpClientCore {
+    sendFrame;
+    onRequest;
+    nextId = 1;
+    pending = new Map();
+    notifications = [];
+    nextNotificationSequence = 0;
+    closed = false;
+    closeReason = 'ACP client is closed';
+    constructor(sendFrame, onRequest) {
+        this.sendFrame = sendFrame;
+        this.onRequest = onRequest;
+    }
+    request(method, params, timeoutMs = 120_000) {
+        if (this.closed)
+            return Promise.reject(new Error(this.closeReason));
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error(`ACP ${method} timed out after ${timeoutMs}ms`));
+            }, timeoutMs);
+            this.pending.set(id, { method, resolve, reject, timer });
+            this.sendFrame({ jsonrpc: '2.0', id, method, params });
+        });
+    }
+    notify(method, params) {
+        if (this.closed)
+            throw new Error(this.closeReason);
+        this.sendFrame({ jsonrpc: '2.0', method, params });
+    }
+    async receiveLine(line) {
+        let message;
+        try {
+            message = jsonObject(JSON.parse(line));
+        }
+        catch {
+            throw new Error('ACP emitted a non-JSON frame');
+        }
+        if (message.jsonrpc !== '2.0')
+            throw new Error('ACP emitted an invalid JSON-RPC frame');
+        const rawId = message.id;
+        const id = typeof rawId === 'string' || typeof rawId === 'number' ? rawId : undefined;
+        const rawMethod = message.method;
+        if (id !== undefined && rawMethod === undefined) {
+            const pending = this.pending.get(id);
+            if (!pending)
+                return;
+            this.pending.delete(id);
+            clearTimeout(pending.timer);
+            const responseError = message.error;
+            if (responseError !== undefined)
+                pending.reject(errorFromResponse(pending.method, responseError));
+            else
+                pending.resolve(message.result ?? null);
+            return;
+        }
+        if (typeof rawMethod !== 'string')
+            throw new Error('ACP JSON-RPC frame has no method');
+        if (id === undefined) {
+            this.notifications.push({ sequence: this.nextNotificationSequence++, message: jsonObject(message) });
+            return;
+        }
+        try {
+            const result = await this.onRequest(rawMethod, message.params ?? null);
+            this.sendFrame({ jsonrpc: '2.0', id, result });
+        }
+        catch (error) {
+            this.sendFrame({ jsonrpc: '2.0', id, error: { code: -32601, message: error instanceof Error ? error.message : String(error) } });
+        }
+    }
+    observedNotifications() {
+        return this.notifications.map(({ message }) => ({ ...message }));
+    }
+    notificationCheckpoint() {
+        return this.nextNotificationSequence;
+    }
+    drainNotifications(checkpoint) {
+        if (!Number.isSafeInteger(checkpoint) || checkpoint < 0 || checkpoint > this.nextNotificationSequence) {
+            throw new Error('invalid ACP notification checkpoint');
+        }
+        const drained = [];
+        for (let index = this.notifications.length - 1; index >= 0; index--) {
+            const entry = this.notifications[index];
+            if (entry.sequence < checkpoint)
+                continue;
+            drained.unshift({ ...entry.message });
+            this.notifications.splice(index, 1);
+        }
+        return drained;
+    }
+    close(reason = 'ACP client closed') {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.closeReason = reason;
+        for (const request of this.pending.values()) {
+            clearTimeout(request.timer);
+            request.reject(new Error(reason));
+        }
+        this.pending.clear();
+    }
+}
+function normalizeHandshake(provider, value) {
+    if (!isJsonObject(value) || value.protocolVersion !== 1 || !isJsonObject(value.agentCapabilities))
+        throw new Error('ACP initialize did not return protocol v1 capabilities');
+    const mcp = value.agentCapabilities.mcpCapabilities;
+    if (!isJsonObject(mcp) || mcp.http !== true)
+        throw new Error('ACP initialize did not advertise HTTP MCP');
+    const session = value.agentCapabilities.sessionCapabilities;
+    return {
+        normalizerVersion: 'pathgrade-acp-v1-capabilities-v1',
+        provider,
+        protocolVersion: 1,
+        httpMcp: true,
+        sessionClose: session !== undefined && isJsonObject(session) && session.close !== undefined && isJsonObject(session.close),
+    };
+}
+function readSessionId(value) {
+    const sessionId = isJsonObject(value) ? value.sessionId : undefined;
+    if (typeof sessionId !== 'string' || sessionId.length === 0)
+        throw new Error('ACP session/new returned no sessionId');
+    return sessionId;
+}
+function readPromptResult(value) {
+    const stopReason = isJsonObject(value) ? value.stopReason : undefined;
+    if (typeof stopReason !== 'string')
+        throw new Error('ACP session/prompt returned no stopReason');
+    return { stopReason };
+}
+function permissionRequest(params) {
+    if (!isJsonObject(params))
+        throw new Error('invalid ACP permission request');
+    const toolCall = params.toolCall !== undefined && isJsonObject(params.toolCall) ? params.toolCall : undefined;
+    const rawOptions = params.options;
+    if (!Array.isArray(rawOptions))
+        throw new Error('invalid ACP permission options');
+    const options = rawOptions.map((entry) => {
+        const optionId = isJsonObject(entry) ? entry.optionId : undefined;
+        const kind = isJsonObject(entry) ? entry.kind : undefined;
+        if (typeof optionId !== 'string' || typeof kind !== 'string')
+            throw new Error('invalid ACP permission option');
+        return { optionId, kind };
+    });
+    return {
+        sessionId: typeof params.sessionId === 'string' ? params.sessionId : undefined,
+        toolCallId: toolCall && typeof toolCall.toolCallId === 'string' ? toolCall.toolCallId : undefined,
+        options,
+    };
+}
+function includesProtectedValue(value, protectedValues) {
+    return protectedValues.some((secret) => secret.length > 0 && value.includes(secret));
+}
+export function spawnAcpClient(options) {
+    const argv = [options.command, ...options.args].join('\u0000');
+    const environmentText = Object.entries(options.environment).map(([name, value]) => `${name}=${value ?? ''}`).join('\u0000');
+    if (includesProtectedValue(argv, options.protectedValues) || includesProtectedValue(environmentText, options.protectedValues)) {
+        throw new Error('ACP protected value reached child argv or environment');
+    }
+    const spawnProcess = options.spawnProcess ?? ((command, args, childOptions) => spawn(command, [...args], childOptions));
+    const child = spawnProcess(options.command, options.args, { cwd: options.cwd, env: options.environment, stdio: ['pipe', 'pipe', 'pipe'] });
+    let open = true;
+    let cancelling = false;
+    let sessionClose = false;
+    let sessionId;
+    let outboundSecretFrames = 0;
+    let reflectedSecret = false;
+    const exit = new Promise((resolve) => {
+        child.once('exit', (code, signal) => {
+            open = false;
+            core.close(`ACP provider exited (${code ?? signal ?? 'unknown'})`);
+            resolve();
+        });
+        child.once('error', (error) => {
+            open = false;
+            core.close(`ACP provider failed: ${error.message}`);
+            resolve();
+        });
+    });
+    const core = new AcpClientCore((message) => {
+        const frame = JSON.stringify(message);
+        if (includesProtectedValue(frame, options.protectedValues))
+            outboundSecretFrames += 1;
+        child.stdin.write(`${frame}\n`);
+    }, async (method, params) => {
+        if (method !== 'session/request_permission')
+            throw new Error(`unsupported ACP client request ${method}`);
+        const request = permissionRequest(params);
+        if (cancelling)
+            return { outcome: { outcome: 'cancelled' } };
+        const allowed = request.options.find((entry) => entry.kind === 'allow_once');
+        if (!allowed)
+            throw new Error('ACP permission request has no allow_once option');
+        return { outcome: { outcome: 'selected', optionId: allowed.optionId } };
+    });
+    const lines = createInterface({ input: child.stdout });
+    lines.on('line', (line) => {
+        if (includesProtectedValue(line, options.protectedValues)) {
+            reflectedSecret = true;
+            core.close('ACP provider reflected a protected control-plane value');
+            return;
+        }
+        void core.receiveLine(line).catch((error) => core.close(error instanceof Error ? error.message : String(error)));
+    });
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (chunk) => {
+        if (includesProtectedValue(chunk, options.protectedValues)) {
+            reflectedSecret = true;
+            core.close('ACP provider reflected a protected control-plane value');
+        }
+    });
+    return {
+        async initialize() {
+            const raw = await core.request('initialize', {
+                protocolVersion: 1,
+                clientCapabilities: {},
+                clientInfo: { name: 'pathgrade-direct-mcp', title: 'Pathgrade direct MCP', version: '2.0.0' },
+            }, 30_000);
+            const normalized = normalizeHandshake(options.provider, raw);
+            sessionClose = normalized.sessionClose;
+            return normalized;
+        },
+        async newSession(mcpServers) {
+            sessionId = readSessionId(await core.request('session/new', { cwd: options.cwd, mcpServers: [...mcpServers] }, 30_000));
+            return sessionId;
+        },
+        async prompt(currentSessionId, text) {
+            return readPromptResult(await core.request('session/prompt', { sessionId: currentSessionId, prompt: [{ type: 'text', text }] }, 180_000));
+        },
+        cancel(currentSessionId) { core.notify('session/cancel', { sessionId: currentSessionId }); },
+        async close() {
+            if (!open) {
+                await exit;
+                if (reflectedSecret)
+                    throw new Error('ACP provider reflected a protected control-plane value');
+                return;
+            }
+            if (sessionId && sessionClose)
+                await core.request('session/close', { sessionId }, 10_000).catch(() => undefined);
+            core.close();
+            lines.close();
+            child.stdin.end();
+            if (await waitForExit(exit, 1_000)) {
+                if (reflectedSecret)
+                    throw new Error('ACP provider reflected a protected control-plane value');
+                return;
+            }
+            child.kill('SIGTERM');
+            if (await waitForExit(exit, 2_000)) {
+                if (reflectedSecret)
+                    throw new Error('ACP provider reflected a protected control-plane value');
+                return;
+            }
+            child.kill('SIGKILL');
+            if (!await waitForExit(exit, 2_000))
+                throw new Error('ACP provider did not exit after SIGKILL');
+            if (reflectedSecret)
+                throw new Error('ACP provider reflected a protected control-plane value');
+        },
+        setCancelling(value) { cancelling = value; },
+        isOpen: () => open,
+        controlPlaneSecretFrames: () => outboundSecretFrames,
+        inboundSecretSeen: () => reflectedSecret,
+        notificationCheckpoint: () => core.notificationCheckpoint(),
+        drainNotifications: (checkpoint) => core.drainNotifications(checkpoint),
+        notifications: () => core.observedNotifications(),
+    };
+}
+async function waitForExit(exit, timeoutMs) {
+    let timer;
+    return Promise.race([
+        exit.then(() => true),
+        new Promise((resolve) => { timer = setTimeout(() => resolve(false), timeoutMs); }),
+    ]).finally(() => { if (timer)
+        clearTimeout(timer); });
+}

package/dist/internal/direct-mcp-v2/acp-direct-mcp.d.ts

@@ -0,0 +1,38 @@
+import { spawnAcpClient } from './acp-client.js';
+import { type CleanupReport } from './cleanup.js';
+import type { EvidenceEnvelope, RuntimeCapabilityProfile, ScenarioArtifact, ScenarioMachineV2 } from './types.js';
+export type AcpDirectMcpChecks = {
+    runtimeAdmitted: boolean;
+    secretFreeProject: boolean;
+    directCall: boolean;
+    structuredToolError: boolean;
+    fencedCancellation: boolean;
+    providerTerminal: boolean;
+    hostQuiescent: boolean;
+    postCancelReuse: boolean;
+    privateReplay: boolean;
+    cleanup: boolean;
+};
+export type AcpDirectMcpTrialResult = {
+    selected: true;
+    profileFingerprint: string;
+    artifact: ScenarioArtifact;
+    evidence: readonly EvidenceEnvelope[];
+    checks: AcpDirectMcpChecks;
+    cleanup: CleanupReport;
+    cancellationStatus: string;
+};
+export type AcpDirectMcpOptions = {
+    provider: 'cursor' | 'opencode';
+    scenario: ScenarioMachineV2;
+    environment: NodeJS.ProcessEnv;
+    profile: RuntimeCapabilityProfile;
+    artifactDirectory?: string;
+    createClient?: typeof spawnAcpClient;
+    localHomeLinks?: readonly {
+        relativePath: string;
+        hostPath: string;
+    }[];
+};
+export declare function curateAcpProcessEnvironment(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function runAcpDirectMcpTrial(options: AcpDirectMcpOptions): Promise<AcpDirectMcpTrialResult>;

package/dist/internal/direct-mcp-v2/acp-direct-mcp.js

@@ -0,0 +1,326 @@
+/* oxlint-disable anti-slop/no-unknown-parameters -- Provider promise rejections are normalized at the ACP boundary. */
+import { randomBytes } from 'node:crypto';
+import { mkdir, mkdtemp, realpath, rm, symlink } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, relative } from 'node:path';
+import { SAFE_HOST_VARS } from '../../providers/sandbox.js';
+import { spawnAcpClient } from './acp-client.js';
+import { IdempotentTrialCleaner, persistTrialArtifact, TrialExecutionError, TrialResourceRegistry, scanBearerSurfaces } from './cleanup.js';
+import { compileScenario } from './compiler.js';
+import { PrivateReplayVault, replayPrivateEvidence, verifyEvidenceChain } from './evidence.js';
+import { ScenarioHostReducer } from './host-reducer.js';
+import { materializeProjection } from './materialize.js';
+import { projectEndpoints } from './projection.js';
+import { admitRuntimeProfile } from './runtime-profile.js';
+import { createInvocationBarrier, startScenarioHttpHost } from './scenario-http-host.js';
+export function curateAcpProcessEnvironment(environment) {
+    const result = {};
+    for (const name of SAFE_HOST_VARS)
+        if (environment[name])
+            result[name] = environment[name];
+    return result;
+}
+export async function runAcpDirectMcpTrial(options) {
+    const compiled = compileScenario(options.scenario);
+    if (!compiled.ok)
+        throw new Error(`Scenario compilation failed: ${JSON.stringify(compiled.diagnostics)}`);
+    const cases = findContractCases(compiled.artifact);
+    const createdScratchParent = await mkdtemp(join(tmpdir(), `pathgrade-${options.provider}-direct-mcp-`));
+    let scratchParent;
+    try {
+        scratchParent = await realpath(createdScratchParent);
+    }
+    catch (error) {
+        await rm(createdScratchParent, { recursive: true, force: true }).catch(() => undefined);
+        throw error;
+    }
+    const scratchPath = join(scratchParent, 'trial');
+    const workspacePath = join(scratchPath, 'workspace');
+    const homePath = join(scratchPath, 'home');
+    const dataPath = join(scratchPath, 'data');
+    const configPath = join(scratchPath, 'config');
+    const cachePath = join(scratchPath, 'cache');
+    const tempPath = join(scratchPath, 'tmp');
+    try {
+        await Promise.all([workspacePath, homePath, dataPath, configPath, cachePath, tempPath].map((path) => mkdir(path, { recursive: true })));
+        for (const link of options.localHomeLinks ?? []) {
+            const difference = relative(homePath, join(homePath, link.relativePath));
+            if (link.relativePath.length === 0 || isAbsolute(link.relativePath) || difference.startsWith('..'))
+                throw new Error(`unsafe local HOME link: ${link.relativePath}`);
+            const source = await realpath(link.hostPath);
+            const destination = join(homePath, link.relativePath);
+            await mkdir(dirname(destination), { recursive: true });
+            await symlink(source, destination, 'dir');
+        }
+    }
+    catch (error) {
+        await rm(scratchParent, { recursive: true, force: true }).catch(() => undefined);
+        throw error;
+    }
+    const runtimeEnvironment = {
+        ...options.environment,
+        HOME: homePath,
+        TMPDIR: tempPath,
+        TMP: tempPath,
+        TEMP: tempPath,
+        XDG_DATA_HOME: dataPath,
+        XDG_CONFIG_HOME: configPath,
+        XDG_CACHE_HOME: cachePath,
+    };
+    delete runtimeEnvironment.OPENCODE_CONFIG_CONTENT;
+    const trialId = `${options.provider}-${randomBytes(12).toString('hex')}`;
+    const macKey = randomBytes(32);
+    const replayVault = new PrivateReplayVault(randomBytes(32));
+    const reducer = new ScenarioHostReducer(trialId, compiled.artifact, macKey, replayVault);
+    reducer.markCompiled();
+    const barrier = createInvocationBarrier(cases.effectfulCaseId);
+    const host = await startScenarioHttpHost({ artifact: compiled.artifact, reducer, barrier, secretRef: `${options.provider}-direct-mcp-trial-bearer` }).catch(async (error) => {
+        macKey.fill(0);
+        replayVault.dispose();
+        reducer.dispose();
+        await rm(scratchParent, { recursive: true, force: true }).catch(() => undefined);
+        throw error;
+    });
+    const registry = new TrialResourceRegistry();
+    let hostOpen = true;
+    let client;
+    let hostQuiescent = false;
+    let persisted = false;
+    registry.register({ opaqueId: 'scenario-host', kind: 'listener', close: async () => { await host.dispose(); hostOpen = false; }, isOpen: () => hostOpen });
+    registry.register({ opaqueId: 'scenario-transports', kind: 'transport', close: () => host.dispose(), isOpen: () => host.activeTransportCount() !== 0 });
+    const cleaner = new IdempotentTrialCleaner({
+        registry,
+        scanRoots: [scratchPath],
+        scratchPath,
+        approvedScratchParent: scratchParent,
+        bearer: host.bearer.toString(),
+        persistRedacted: async (report, phase) => {
+            if (!options.artifactDirectory) {
+                if (phase === 'final')
+                    persisted = true;
+                return;
+            }
+            const path = join(options.artifactDirectory, 'trial-evidence.json');
+            await mkdir(dirname(path), { recursive: true });
+            const value = {
+                artifactDigest: compiled.artifact.artifactDigest,
+                scenarioArtifact: compiled.artifact,
+                evidence: reducer.ledger.events(),
+                replayVaultReference: {
+                    format: 'pathgrade-private-replay-vault-reference-v1',
+                    trialId,
+                    artifactDigest: compiled.artifact.artifactDigest,
+                },
+                admissionProfile: options.profile,
+                cleanup: { ...report, scans: report.scans.map((entry) => ({ ...entry, path: entry.path.replace(scratchParent, '<scratch>') })) },
+            };
+            await persistTrialArtifact(path, `${JSON.stringify(value)}\n`, phase);
+            if (phase === 'final')
+                persisted = true;
+        },
+        zeroBearer: () => { host.bearer.fill(0); macKey.fill(0); replayVault.dispose(); },
+    });
+    try {
+        const protectedValues = [host.bearer.toString(), `Bearer ${host.bearer.toString()}`];
+        const createClient = options.createClient ?? spawnAcpClient;
+        const admission = await admitRuntimeProfile(options.profile, {
+            provider: options.provider,
+            platform: process.platform,
+            architecture: process.arch,
+            environment: runtimeEnvironment,
+            forbiddenSecrets: protectedValues,
+            initializeControlPlane: async () => {
+                const initializedClient = createClient({
+                    provider: options.provider,
+                    command: options.profile.command.absolutePath,
+                    args: options.profile.command.args,
+                    cwd: workspacePath,
+                    environment: runtimeEnvironment,
+                    protectedValues,
+                });
+                client = initializedClient;
+                registry.register({ opaqueId: `${options.provider}-acp`, kind: 'process', close: () => initializedClient.close(), isOpen: () => initializedClient.isOpen() });
+                const normalizedHandshake = await initializedClient.initialize();
+                return { normalizedHandshake, capabilities: options.profile.requiredCapabilities, close: () => initializedClient.close() };
+            },
+        });
+        if (!admission.ok || !client)
+            throw new Error(`RUNTIME_NOT_ADMITTED: ${admission.ok ? 'ACP client unavailable' : admission.reason}`);
+        const admittedClient = client;
+        const projected = projectEndpoints(host.endpoints, admission.profile);
+        if (!Array.isArray(projected))
+            throw new Error(`RUNTIME_NOT_ADMITTED: ${projected.reason}`);
+        const mcpServers = projected.flatMap((plan) => {
+            const materialized = materializeProjection(plan, {
+                resolve(secretRef) {
+                    if (secretRef !== host.secretRef)
+                        throw new Error(`Unknown secret reference: ${secretRef}`);
+                    return `Bearer ${host.bearer.toString()}`;
+                },
+            });
+            if (materialized.kind !== 'acp-session' || materialized.provider !== options.provider)
+                throw new Error('ACP projection materialized for another provider');
+            return materialized.mcpServers.map((server) => ({
+                type: server.type,
+                name: server.name,
+                url: server.url,
+                headers: server.headers.map((header) => ({ name: header.name, value: header.value })),
+            }));
+        });
+        const protectedSurfaces = [...protectedValues, ...host.endpoints.map((endpoint) => endpoint.url)];
+        const sessionId = await admittedClient.newSession(mcpServers);
+        if (admittedClient.controlPlaneSecretFrames() !== 1 || admittedClient.inboundSecretSeen())
+            throw new Error('RUNTIME_NOT_ADMITTED: ACP secret isolation failed during session admission');
+        await assertProtectedSurfacesClean([scratchPath], protectedSurfaces, 'RUNTIME_NOT_ADMITTED: ACP protected projection reached a writable or unreadable surface');
+        reducer.markAdmitted();
+        reducer.markReady();
+        reducer.beginTurn('direct-call', options.provider);
+        await admittedClient.prompt(sessionId, normalPrompt(options.provider, cases));
+        await host.waitForQuiescence(30_000);
+        reducer.finalize('settled');
+        const normalEvidence = reducer.ledger.events();
+        if (!hasDecision(normalEvidence, cases.pureCaseId) || !hasDecision(normalEvidence, cases.errorCaseId))
+            throw new Error(`${options.provider} did not exercise direct success and structured tool error`);
+        reducer.beginTurn('cancelled-turn', options.provider);
+        const cancelled = admittedClient.prompt(sessionId, cancellationPrompt(cases)).then((result) => ({ kind: 'result', result }), (error) => ({ kind: 'error', error }));
+        const entered = await withTimeout(Promise.race([barrier.reached().then(() => 'barrier'), cancelled.then((result) => `terminal:${result.kind}`)]), 90_000, `${options.provider} blocking invocation`);
+        if (entered !== 'barrier')
+            throw new Error(`${options.provider} reached ${entered} before the blocking MCP transition`);
+        reducer.fence();
+        admittedClient.setCancelling(true);
+        admittedClient.cancel(sessionId);
+        reducer.abortUncommitted('provider-cancelled');
+        barrier.release();
+        const cancellation = await withTimeout(cancelled, 45_000, `${options.provider} cancelled prompt`);
+        admittedClient.setCancelling(false);
+        if (cancellation.kind === 'error')
+            throw cancellation.error;
+        await host.waitForQuiescence(30_000);
+        hostQuiescent = host.activeTransportCount() === 0;
+        if (!hostQuiescent)
+            throw new Error(`Scenario host was not quiescent after ${options.provider} cancellation`);
+        if (cancellation.result.stopReason !== 'cancelled')
+            throw new Error(`${options.provider} cancellation terminal was ${cancellation.result.stopReason}`);
+        reducer.observeProviderTerminal();
+        reducer.finalize('cancelled-clean');
+        reducer.beginTurn('post-cancel-reuse', options.provider);
+        await admittedClient.prompt(sessionId, reusePrompt(cases));
+        await host.waitForQuiescence(30_000);
+        reducer.finalize('settled');
+        if (!hasDecision(reducer.ledger.events(), cases.effectfulCaseId))
+            throw new Error(`${options.provider} post-cancel reuse did not reach the scenario host`);
+        const replay = replayPrivateEvidence({ artifact: compiled.artifact, evidence: reducer.ledger.events(), vault: replayVault, macKey });
+        if (!replay.ok || replay.poisoned || replay.finalState !== reducer.state)
+            throw new Error(`Private replay failed: ${replay.ok ? 'state mismatch' : replay.reason}`);
+        const chain = verifyEvidenceChain(reducer.ledger.events(), compiled.artifact.artifactDigest);
+        if (!chain.ok)
+            throw new Error(`Evidence chain failed: ${chain.reason}`);
+        await assertProtectedSurfacesClean([scratchPath], protectedSurfaces, 'ACP protected projection reached a writable or unreadable surface');
+        reducer.dispose();
+        const cleanup = await cleaner.dispose();
+        await rm(scratchParent, { recursive: true, force: true });
+        if (!persisted || cleanup.failures.length > 0 || cleanup.bearerFound || !cleanup.scratchDeleted)
+            throw new Error(`CLEANUP_FAILED: ${JSON.stringify(cleanup.failures)}`);
+        return {
+            selected: true,
+            profileFingerprint: options.profile.profileFingerprint,
+            artifact: compiled.artifact,
+            evidence: reducer.ledger.events(),
+            checks: { runtimeAdmitted: true, secretFreeProject: true, directCall: true, structuredToolError: true, fencedCancellation: true, providerTerminal: true, hostQuiescent, postCancelReuse: true, privateReplay: true, cleanup: true },
+            cleanup,
+            cancellationStatus: cancellation.result.stopReason,
+        };
+    }
+    catch (error) {
+        barrier.release();
+        client?.setCancelling(true);
+        try {
+            if (reducer.phase === 'ACTIVE')
+                reducer.fence();
+            if (reducer.phase === 'FENCING')
+                reducer.abortUncommitted('trial-failed');
+            if (!['DISPOSED', 'NEW', 'COMPILED', 'ADMITTED'].includes(reducer.phase))
+                reducer.finalize('poisoned', 'trial-failed');
+        }
+        catch (lifecycleFailure) {
+            void lifecycleFailure;
+        }
+        reducer.dispose();
+        let cleanupError;
+        try {
+            const report = await cleaner.dispose();
+            if (report.failures.length > 0 || report.bearerFound || !report.scratchDeleted)
+                cleanupError = new Error(`CLEANUP_FAILED: ${JSON.stringify(report.failures)}`);
+        }
+        catch (failure) {
+            cleanupError = failure instanceof Error ? failure : new Error(String(failure));
+        }
+        await rm(scratchParent, { recursive: true, force: true }).catch(() => undefined);
+        if (cleanupError)
+            throw new TrialExecutionError(error instanceof Error ? error.message : `${options.provider} direct MCP trial failed`, { primary: error, secondary: [cleanupError] });
+        throw error;
+    }
+}
+async function assertProtectedSurfacesClean(roots, protectedValues, message) {
+    for (const value of protectedValues) {
+        const scans = await scanBearerSurfaces(roots, value);
+        if (scans.some((entry) => entry.status !== 'clean'))
+            throw new Error(message);
+    }
+}
+function findContractCases(artifact) {
+    const state = artifact.canonicalIr.states[artifact.canonicalIr.initialState];
+    const entries = Object.entries(state.tools);
+    const effectful = entries.find(([, tool]) => tool.effectful && tool.cases.some((entry) => entry.transition && entry.outcome.kind === 'success' && 'exactArgs' in entry.when));
+    const error = entries.find(([, tool]) => tool.cases.some((entry) => entry.outcome.kind === 'tool-error' && 'exactArgs' in entry.when));
+    const pure = entries.find(([, tool]) => !tool.effectful && tool.cases.some((entry) => entry.outcome.kind === 'success'));
+    if (!effectful || !error || !pure)
+        throw new Error('ACP vertical requires an effectful success, structured error, and pure success in the initial state');
+    const successCase = effectful[1].cases.find((entry) => entry.transition && entry.outcome.kind === 'success' && 'exactArgs' in entry.when);
+    const errorCase = error[1].cases.find((entry) => entry.outcome.kind === 'tool-error' && 'exactArgs' in entry.when);
+    const pureCase = pure[1].cases.find((entry) => entry.outcome.kind === 'success');
+    const [serverId, effectfulToolId] = effectful[0].split('/');
+    return {
+        serverId,
+        effectfulToolId,
+        effectfulCaseId: successCase.id,
+        successArgs: exactArgs(successCase),
+        errorCaseId: errorCase.id,
+        errorArgs: exactArgs(errorCase),
+        pureToolId: pure[0].split('/')[1],
+        pureCaseId: pureCase.id,
+        pureArgs: 'exactArgs' in pureCase.when ? pureCase.when.exactArgs : deriveArgs(pureCase.when.all),
+    };
+}
+function exactArgs(scenarioCase) {
+    if (!('exactArgs' in scenarioCase.when))
+        throw new Error('ACP contract case requires exact arguments');
+    return scenarioCase.when.exactArgs;
+}
+function deriveArgs(predicates) {
+    const result = {};
+    for (const predicate of predicates)
+        if (predicate.pointer.startsWith('/') && 'equals' in predicate)
+            result[predicate.pointer.slice(1)] = predicate.equals;
+    return result;
+}
+function normalPrompt(provider, cases) {
+    return `Use only MCP server ${cases.serverId}. Invoke ${cases.pureToolId} exactly once with ${JSON.stringify(cases.pureArgs)}, then invoke ${cases.effectfulToolId} exactly once with ${JSON.stringify(cases.errorArgs)}. The second result is an expected tool error; do not retry it. Do not use shell or any other tool. Then answer ${provider.toUpperCase()}_DIRECT_DONE.`;
+}
+function cancellationPrompt(cases) {
+    return `Use only MCP server ${cases.serverId}. Invoke ${cases.effectfulToolId} exactly once with ${JSON.stringify(cases.successArgs)}. Wait for its result and do not use any other tool.`;
+}
+function reusePrompt(cases) {
+    return `Use only MCP server ${cases.serverId}. Invoke ${cases.effectfulToolId} exactly once with ${JSON.stringify(cases.successArgs)}. Wait for its result and do not use any other tool.`;
+}
+function hasDecision(evidence, caseId) {
+    return evidence.some((event) => event.payload.type === 'mcp.decision' && event.payload.caseId === caseId && event.payload.authority === 'scenario-host');
+}
+async function withTimeout(promise, timeoutMs, label) {
+    let timer;
+    return Promise.race([
+        promise,
+        new Promise((_resolve, reject) => { timer = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs); }),
+    ]).finally(() => { if (timer)
+        clearTimeout(timer); });
+}