@zhivex-ai/harness 1.2.0 → 1.3.0-rc.7

package/dist/index-z4e8d0ph.js

@@ -0,0 +1,1768 @@
+import {
+  closeMcpHostSession,
+  combineMcpHostSessions,
+  createHarnessMcpTools,
+  issueMcpHostSession
+} from "./index-t60rva31.js";
+import {
+  collectSnapshotInventory,
+  readSnapshotFile
+} from "./index-z0qxmkm2.js";
+import {
+  readRegularFileNoFollow,
+  runPortableProcess
+} from "./index-yb239ghk.js";
+
+// src/execution/mcp-workspace-snapshot.ts
+import { createHash } from "node:crypto";
+import { chmod, mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+var snapshots = new WeakMap;
+var hash = (value) => `sha256:${createHash("sha256").update(value).digest("hex")}`;
+var safePath = (value) => value.length > 0 && !value.startsWith("/") && !value.includes("\\") && !/[\x00-\x1f\x7f]/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
+async function prepareMcpWorkspaceSnapshot(workspace, maxWorkspaceBytes) {
+  if (!Number.isSafeInteger(maxWorkspaceBytes) || maxWorkspaceBytes < 1024 || maxWorkspaceBytes > 512 * 1024 * 1024) {
+    throw new Error("Invalid MCP snapshot byte limit.");
+  }
+  const root = await mkdtemp(path.join(tmpdir(), "zhx-mcp-snapshot-"));
+  await chmod(root, 448);
+  const directory = path.join(root, "workspace");
+  try {
+    const inventory = await collectSnapshotInventory(workspace, maxWorkspaceBytes, undefined, 20000);
+    const entries = [...inventory.values()].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    await mkdir(directory, { mode: 448 });
+    for (const expected of entries) {
+      if (!safePath(expected.path))
+        throw new Error("Invalid MCP snapshot path.");
+      const file = await readSnapshotFile(workspace, expected, undefined, true);
+      const target = path.join(directory, ...file.path.split("/"));
+      await mkdir(path.dirname(target), { recursive: true, mode: 448 });
+      await writeFile(target, file.contents, { flag: "wx", mode: 256 });
+    }
+    const value = Object.freeze({
+      digest: hash(JSON.stringify({ version: 1, entries })),
+      workspace: hash(workspace.root),
+      files: entries.length,
+      bytes: entries.reduce((sum, entry) => sum + entry.bytes, 0)
+    });
+    snapshots.set(value, { root, directory, entries, used: false });
+    return value;
+  } catch {
+    await rm(root, { recursive: true, force: true });
+    throw new Error("MCP workspace snapshot preparation failed.");
+  }
+}
+async function consumeMcpWorkspaceSnapshot(snapshot, expected, seed) {
+  const record = snapshots.get(snapshot);
+  if (!record || record.used)
+    throw new Error("Unknown or consumed MCP workspace snapshot.");
+  record.used = true;
+  try {
+    if (snapshot.digest !== expected.snapshotDigest || snapshot.workspace !== expected.workspace || snapshot.bytes > expected.maxWorkspaceBytes) {
+      throw new Error("MCP workspace snapshot identity changed.");
+    }
+    let delivered = 0;
+    async function* files() {
+      for (const entry of record.entries) {
+        const file = await readRegularFileNoFollow(path.join(record.directory, ...entry.path.split("/")), {
+          label: "MCP snapshot file",
+          maxBytes: entry.bytes,
+          requireSingleLink: true
+        });
+        if (file.contents.byteLength !== entry.bytes || hash(file.contents) !== entry.digest)
+          throw new Error("MCP private snapshot changed.");
+        delivered++;
+        yield { path: entry.path, contents: new Uint8Array(file.contents), executable: (entry.mode & 73) !== 0 };
+      }
+    }
+    await seed(files());
+    if (delivered !== record.entries.length)
+      throw new Error("MCP snapshot was not fully seeded.");
+  } catch {
+    throw new Error("MCP workspace snapshot handoff failed.");
+  } finally {
+    await rm(record.root, { recursive: true, force: true });
+    snapshots.delete(snapshot);
+  }
+}
+async function discardMcpWorkspaceSnapshot(snapshot) {
+  const record = snapshots.get(snapshot);
+  if (!record)
+    return;
+  if (record.used)
+    throw new Error("MCP workspace snapshot handoff is active.");
+  record.used = true;
+  try {
+    await rm(record.root, { recursive: true, force: true });
+  } finally {
+    snapshots.delete(snapshot);
+  }
+}
+
+// src/persistence/mcp-resource-journal.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { z } from "zod";
+var ownerInstance = randomUUID();
+var digest = z.string().regex(/^[a-f0-9]{64}$/);
+var image = z.string().regex(/^sha256:[a-f0-9]{64}$/);
+var uuid = z.string().uuid();
+var phases = ["reserved", "provisioning", "ready", "closing", "closed", "cleanup_required"];
+var mcpResourcePlanSchema = z.object({
+  schemaVersion: z.literal(1),
+  kind: z.literal("isolated-mcp-resources"),
+  leaseId: uuid,
+  scopeHash: digest,
+  hostHash: digest,
+  proposalHash: digest,
+  daemonId: z.string().min(1).max(128).regex(/^[A-Za-z0-9:_-]+$/),
+  ownerPid: z.number().int().positive(),
+  ownerInstance: uuid,
+  serverImageId: image,
+  provisionerImageId: image,
+  serverName: z.string(),
+  volumeName: z.string(),
+  seederName: z.string()
+}).strict().refine((value) => value.serverName === `zhx-mcp-server-${value.leaseId}` && value.volumeName === `zhx-mcp-${value.leaseId}` && value.seederName === `zhx-mcp-${value.leaseId}-seed`);
+var mcpResourceOutputSchema = z.object({ schemaVersion: z.literal(1), phase: z.enum(phases) }).strict();
+var hash2 = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
+var transitions = {
+  reserved: ["provisioning", "closing", "cleanup_required"],
+  provisioning: ["ready", "closing", "cleanup_required"],
+  ready: ["closing", "cleanup_required"],
+  closing: ["closed", "cleanup_required"],
+  cleanup_required: ["closing"],
+  closed: []
+};
+async function reserveMcpResources(options) {
+  if (!options.store.claimToolExecution || !options.store.loadToolCall || !options.store.saveToolCall || !options.hostId || options.hostId.length > 256 || options.runId !== options.proposal.scope.session || options.scope.tenantId !== options.proposal.scope.tenant || options.scope.userId !== options.proposal.scope.principal) {
+    throw new Error("MCP resource journal binding is invalid.");
+  }
+  const scope = structuredClone(options.scope), runId = options.runId;
+  const leaseId = randomUUID();
+  const plan = Object.freeze(mcpResourcePlanSchema.parse({
+    schemaVersion: 1,
+    kind: "isolated-mcp-resources",
+    leaseId,
+    scopeHash: hash2({ runId, scope }),
+    hostHash: hash2(options.hostId),
+    proposalHash: hash2(options.proposal),
+    daemonId: options.daemonId,
+    ownerPid: process.pid,
+    ownerInstance,
+    serverImageId: options.serverImageId,
+    provisionerImageId: options.provisionerImageId,
+    serverName: `zhx-mcp-server-${leaseId}`,
+    volumeName: `zhx-mcp-${leaseId}`,
+    seederName: `zhx-mcp-${leaseId}-seed`
+  }));
+  const id = `mcp_resources_${leaseId}`;
+  const claim = await options.store.claimToolExecution({
+    runId,
+    scope,
+    toolCallId: id,
+    toolName: "isolated_mcp_resources",
+    idempotencyKey: `${runId}:${id}`,
+    status: "pending",
+    revision: 0,
+    input: plan,
+    output: { schemaVersion: 1, phase: "reserved" },
+    updatedAt: Date.now()
+  });
+  if (!claim.claimed)
+    throw new Error("MCP resource reservation already exists.");
+  const load = options.store.loadToolCall.bind(options.store), save = options.store.saveToolCall.bind(options.store);
+  let queue = Promise.resolve();
+  const advance = async (next) => {
+    const current = await load(runId, id, scope);
+    if (!current || current.toolName !== "isolated_mcp_resources" || JSON.stringify(mcpResourcePlanSchema.parse(current.input)) !== JSON.stringify(plan)) {
+      throw new Error("MCP resource journal identity changed.");
+    }
+    const phase = mcpResourceOutputSchema.parse(current.output).phase;
+    if (phase === next)
+      return;
+    if (!transitions[phase].includes(next))
+      throw new Error("Invalid MCP resource lifecycle transition.");
+    const { error: _previousError, ...base } = current;
+    const entry = {
+      ...base,
+      status: next === "closed" ? "completed" : next === "cleanup_required" ? "failed" : "running",
+      output: { schemaVersion: 1, phase: next },
+      updatedAt: Date.now(),
+      ...next === "closed" ? { completedAt: Date.now() } : {},
+      ...next === "cleanup_required" ? { error: { message: "MCP_RESOURCE_CLEANUP_REQUIRED" } } : {}
+    };
+    await save(entry, { expectedRevision: current.revision });
+  };
+  return Object.freeze({
+    plan,
+    labels: Object.freeze({
+      "com.zhivex.harness.mcp": "v1",
+      "com.zhivex.harness.owner-pid": String(plan.ownerPid),
+      "com.zhivex.harness.mcp-lease": leaseId,
+      "com.zhivex.harness.mcp-scope": plan.scopeHash,
+      "com.zhivex.harness.mcp-host": plan.hostHash,
+      "com.zhivex.harness.mcp-owner": ownerInstance
+    }),
+    advance(phase) {
+      const result = queue.then(() => advance(phase));
+      queue = result.catch(() => {});
+      return result;
+    }
+  });
+}
+function mcpResourceLabels(plan) {
+  return Object.freeze({
+    "com.zhivex.harness.mcp": "v1",
+    "com.zhivex.harness.owner-pid": String(plan.ownerPid),
+    "com.zhivex.harness.mcp-lease": plan.leaseId,
+    "com.zhivex.harness.mcp-scope": plan.scopeHash,
+    "com.zhivex.harness.mcp-host": plan.hostHash,
+    "com.zhivex.harness.mcp-owner": plan.ownerInstance
+  });
+}
+function matchesMcpResourceScope(plan, runId, scope, hostId) {
+  return !!hostId && plan.hostHash === hash2(hostId) && plan.scopeHash === hash2({ runId, scope });
+}
+
+// src/execution/mcp-resource-recovery.ts
+function ownerIsDead(pid) {
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    return error.code === "ESRCH";
+  }
+}
+function labelsMatch(actual, plan) {
+  if (!actual || typeof actual !== "object")
+    return false;
+  return Object.entries(mcpResourceLabels(plan)).every(([key, value]) => actual[key] === value);
+}
+async function recoverMcpResources(options) {
+  const { store, cli, runId, hostId } = options;
+  const scope = structuredClone(options.scope);
+  if (!store.listToolCalls || !store.saveToolCall || !hostId)
+    throw new Error("MCP recovery requires a durable host scope.");
+  const daemon = await cli(["info", "--format", "{{.ID}}"]);
+  const rows = await store.listToolCalls(runId, scope);
+  let closed = 0, deferred = 0;
+  for (const row of rows.filter((entry) => entry.toolName === "isolated_mcp_resources")) {
+    const plan = mcpResourcePlanSchema.parse(row.input);
+    if (mcpResourceOutputSchema.parse(row.output).phase === "closed")
+      continue;
+    if (row.toolCallId !== `mcp_resources_${plan.leaseId}` || !matchesMcpResourceScope(plan, runId, scope, hostId) || plan.daemonId !== daemon || !ownerIsDead(plan.ownerPid)) {
+      deferred++;
+      continue;
+    }
+    let current = row;
+    const record = async (phase) => {
+      const { error: _oldError, ...base } = current;
+      const entry = {
+        ...base,
+        output: { schemaVersion: 1, phase },
+        updatedAt: Date.now(),
+        status: phase === "closed" ? "completed" : phase === "cleanup_required" ? "failed" : "running",
+        ...phase === "closed" ? { completedAt: Date.now() } : {},
+        ...phase === "cleanup_required" ? { error: { message: "MCP_RESOURCE_CLEANUP_REQUIRED" } } : {}
+      };
+      current = await store.saveToolCall(entry, { expectedRevision: current.revision });
+    };
+    const inspectContainer = async (name, image2) => {
+      const ids = await cli(["ps", "--all", "--quiet", "--no-trunc", "--filter", `name=^/${name}$`]);
+      if (!ids)
+        return;
+      if (!/^[a-f0-9]{64}$/.test(ids))
+        throw new Error("MCP recovery container identity mismatch.");
+      const values = JSON.parse(await cli(["inspect", ids]));
+      const value = values[0];
+      if (values.length !== 1 || value?.Id !== ids || value?.Name !== `/${name}` || value?.Image !== image2 || !labelsMatch(value?.Config?.Labels, plan)) {
+        throw new Error("MCP recovery container ownership mismatch.");
+      }
+      return ids;
+    };
+    const inspectVolume = async () => {
+      const names = (await cli(["volume", "ls", "--quiet", "--filter", `name=${plan.volumeName}`])).split(`
+`);
+      if (!names.includes(plan.volumeName))
+        return false;
+      const values = JSON.parse(await cli(["volume", "inspect", plan.volumeName]));
+      if (values.length !== 1 || values[0]?.Name !== plan.volumeName || !labelsMatch(values[0]?.Labels, plan))
+        throw new Error("MCP recovery volume ownership mismatch.");
+      return true;
+    };
+    await record("closing");
+    try {
+      const server = await inspectContainer(plan.serverName, plan.serverImageId);
+      const seeder = await inspectContainer(plan.seederName, plan.provisionerImageId);
+      const volume = await inspectVolume();
+      if (await cli(["info", "--format", "{{.ID}}"]) !== daemon || !ownerIsDead(plan.ownerPid))
+        throw new Error("MCP recovery owner changed.");
+      for (const id of [server, seeder])
+        if (id)
+          await cli(["rm", "--force", id]);
+      if (volume) {
+        await inspectVolume();
+        await cli(["volume", "rm", plan.volumeName]);
+      }
+      if (await inspectContainer(plan.serverName, plan.serverImageId) || await inspectContainer(plan.seederName, plan.provisionerImageId) || await inspectVolume()) {
+        throw new Error("MCP recovery absence not confirmed.");
+      }
+      await record("closed");
+      closed++;
+    } catch {
+      await record("cleanup_required");
+      throw new Error("MCP resource recovery could not confirm cleanup.");
+    }
+  }
+  return { closed, deferred };
+}
+async function recoverDockerMcpResources(options) {
+  const env = Object.fromEntries(["HOME", "PATH", "DOCKER_CONFIG", "DOCKER_CONTEXT", "DOCKER_HOST", "DOCKER_TLS_VERIFY", "DOCKER_CERT_PATH", "XDG_RUNTIME_DIR"].flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
+  return recoverMcpResources({ ...options, cli: async (args) => {
+    const result = await runPortableProcess(["docker", ...args], { env, timeoutMs: 1e4, maxOutputCharacters: 1024 * 1024 });
+    if (result.exitCode !== 0 || result.timedOut)
+      throw new Error("MCP recovery Docker operation failed.");
+    return result.stdout.trim();
+  } });
+}
+
+// src/integrations/mcp-stdio-admission.ts
+import { createHash as createHash3 } from "node:crypto";
+import { z as z2 } from "zod";
+var name = z2.string().min(1).max(128).regex(/^[A-Za-z][A-Za-z0-9_-]*$/);
+var digest2 = z2.string().regex(/^sha256:[a-f0-9]{64}$/);
+var safeString = z2.string().max(4096).refine((value) => !/[\x00-\x1f\x7f]/.test(value));
+var relativeDirectory = z2.string().max(1024).refine((value) => value === "." || value.length > 0 && !value.startsWith("/") && !value.includes("\\") && value.split("/").every((part) => part !== "" && part !== "." && part !== "..") && !/[\x00-\x1f\x7f]/.test(value));
+var proposalSchema = z2.object({
+  schemaVersion: z2.literal(1),
+  serverId: name.max(64),
+  boundary: z2.literal("oci"),
+  image: z2.string().max(512).regex(/^[A-Za-z0-9][A-Za-z0-9./:_-]*@sha256:[a-f0-9]{64}$/),
+  executable: safeString.refine((value) => value.startsWith("/") && !value.includes("\\") && value.split("/").slice(1).every((part) => part !== "" && part !== "." && part !== "..")),
+  args: z2.array(safeString).max(128),
+  protocolVersion: z2.literal("2025-11-25"),
+  workingDirectory: relativeDirectory,
+  snapshotDigest: digest2,
+  scope: z2.object({ principal: name, tenant: name, session: name, workspace: digest2 }).strict(),
+  includeTools: z2.array(z2.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9_.:/-]*$/)).min(1).max(200),
+  permissions: z2.array(z2.enum(["read", "write"])).min(1).max(2),
+  environment: z2.record(z2.string().regex(/^ZHIVEX_MCP_[A-Z0-9_]{1,96}$/), safeString).refine((value) => Object.keys(value).length <= 64 && new TextEncoder().encode(JSON.stringify(value)).byteLength <= 32 * 1024).default({}),
+  secretReferences: z2.record(z2.string().regex(/^ZHIVEX_MCP_[A-Z0-9_]{1,96}$/), name).refine((value) => Object.keys(value).length <= 32).default({}),
+  limits: z2.object({
+    sessionMs: z2.number().int().min(100).max(600000),
+    callMs: z2.number().int().min(100).max(60000),
+    memoryMb: z2.number().int().min(16).max(2048),
+    maxCpus: z2.number().min(0.1).max(8).multipleOf(0.1),
+    maxPids: z2.number().int().min(1).max(128),
+    maxWorkspaceBytes: z2.number().int().min(1024).max(512 * 1024 * 1024),
+    maxFileWriteBytes: z2.number().int().min(1).max(64 * 1024 * 1024),
+    tmpfsMb: z2.number().int().min(1).max(256),
+    maxOutputBytes: z2.number().int().min(1024).max(4 * 1024 * 1024)
+  }).strict()
+}).strict().superRefine((value, context) => {
+  if (Object.keys(value.environment).some((key) => (key in value.secretReferences))) {
+    context.addIssue({ code: "custom", message: "Environment and secret names overlap" });
+  }
+  if (value.limits.callMs > value.limits.sessionMs)
+    context.addIssue({ code: "custom", message: "Call limit exceeds session limit" });
+  if (value.limits.maxFileWriteBytes > value.limits.maxWorkspaceBytes)
+    context.addIssue({ code: "custom", message: "Write limit exceeds workspace limit" });
+});
+
+class McpStdioAdmissionError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "McpStdioAdmissionError";
+  }
+}
+var canonical = (value) => {
+  if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`;
+  if (value !== null && typeof value === "object")
+    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+  return JSON.stringify(value);
+};
+var fingerprint = (proposal) => createHash3("sha256").update(canonical(proposal)).digest("hex");
+function normalize(input) {
+  const parsed = proposalSchema.safeParse(input);
+  if (!parsed.success)
+    throw new McpStdioAdmissionError("Invalid isolated MCP launch proposal.");
+  return parsed.data;
+}
+function freeze(value) {
+  if (value !== null && typeof value === "object") {
+    for (const child of Object.values(value))
+      freeze(child);
+    Object.freeze(value);
+  }
+  return value;
+}
+function createMcpStdioAdmissionAuthority(options) {
+  const limits = proposalSchema.shape.limits.parse(options.maximumLimits);
+  if (!options.policyVersion || typeof options.authorize !== "function")
+    throw new McpStdioAdmissionError("Host admission policy is required.");
+  const policyVersion = options.policyVersion;
+  const authorize = options.authorize;
+  const ttl = options.receiptTtlMs ?? 30000;
+  const timeoutMs = options.reviewTimeoutMs ?? 30000;
+  if (![ttl, timeoutMs].every((value) => Number.isSafeInteger(value) && value >= 1 && value <= 60000)) {
+    throw new McpStdioAdmissionError("Invalid admission deadline.");
+  }
+  const now = options.now ?? (() => performance.now());
+  const receipts = new WeakMap;
+  const checked = (input) => {
+    const proposal = normalize(input);
+    for (const key of Object.keys(limits)) {
+      if (proposal.limits[key] > limits[key])
+        throw new McpStdioAdmissionError("MCP launch exceeds host policy limits.");
+    }
+    return proposal;
+  };
+  return {
+    async admit(input) {
+      const proposal = freeze(checked(input));
+      let timer;
+      let approved;
+      try {
+        approved = await Promise.race([
+          Promise.resolve().then(() => authorize(proposal)),
+          new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new McpStdioAdmissionError("MCP host admission timed out.")), timeoutMs);
+          })
+        ]);
+      } catch (error) {
+        if (error instanceof McpStdioAdmissionError)
+          throw error;
+        throw new McpStdioAdmissionError("MCP host admission failed.");
+      } finally {
+        if (timer !== undefined)
+          clearTimeout(timer);
+      }
+      if (approved !== true)
+        throw new McpStdioAdmissionError("MCP launch was not admitted by the host.");
+      const receipt = Object.freeze(Object.create(null));
+      receipts.set(receipt, { fingerprint: fingerprint(proposal), expires: now() + ttl, policy: policyVersion });
+      return receipt;
+    },
+    consume(receipt, input) {
+      const stored = receipt && typeof receipt === "object" ? receipts.get(receipt) : undefined;
+      if (!stored)
+        throw new McpStdioAdmissionError("Unknown or already consumed MCP admission.");
+      receipts.delete(receipt);
+      const proposal = checked(input);
+      if (stored.expires <= now() || stored.policy !== policyVersion || stored.fingerprint !== fingerprint(proposal)) {
+        throw new McpStdioAdmissionError("MCP admission expired or launch identity changed.");
+      }
+      return freeze(proposal);
+    }
+  };
+}
+
+// src/execution/mcp-oci-server.ts
+import { constants } from "node:fs";
+import { access, mkdtemp as mkdtemp2, realpath, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import path2 from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
+
+// src/execution/mcp-oci-channel.ts
+import { spawn } from "node:child_process";
+async function removeDockerMcpBoundary(cli, id) {
+  await cli(["stop", "--time", "2", id]).catch(() => {});
+  await cli(["rm", "--force", id]).catch(() => {});
+  const remaining = (await cli(["ps", "--all", "--no-trunc", "--quiet", "--filter", `id=${id}`])).trim();
+  if (remaining)
+    throw new Error("Docker MCP boundary removal was not confirmed.");
+}
+async function openDockerMcpChannel(options) {
+  if (!/^([a-f0-9]{64})$/.test(options.containerId) || !/^sha256:[a-f0-9]{64}$/.test(options.imageId))
+    throw new Error("Invalid isolated MCP container identity.");
+  for (const value of [options.sessionMs, options.maxOutputBytes]) {
+    if (!Number.isSafeInteger(value) || value < 1)
+      throw new Error("Invalid isolated MCP channel limit.");
+  }
+  const id = options.containerId;
+  const env = Object.fromEntries(["HOME", "PATH", "DOCKER_CONFIG", "DOCKER_CONTEXT", "DOCKER_HOST", "DOCKER_TLS_VERIFY", "DOCKER_CERT_PATH", "XDG_RUNTIME_DIR"].flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
+  const cli = async (args) => {
+    const result = await runPortableProcess(["docker", ...args], { env, timeoutMs: 1e4, maxOutputCharacters: 64 * 1024 });
+    if (result.exitCode !== 0 || result.timedOut)
+      throw new Error("Docker MCP boundary operation failed.");
+    return result.stdout;
+  };
+  const inspected = JSON.parse(await cli(["inspect", id]))[0];
+  const config = inspected?.HostConfig;
+  if (inspected?.Id !== id || inspected?.Image !== options.imageId || inspected?.State?.Running !== false || inspected?.Config?.Labels?.["com.zhivex.harness.mcp"] !== "v1" || inspected?.Config?.Labels?.["com.zhivex.harness.owner-pid"] !== String(process.pid) || inspected?.Config?.Tty !== false || inspected?.Config?.OpenStdin !== true || config?.NetworkMode !== "none" || config?.ReadonlyRootfs !== true || !config?.CapDrop?.includes("ALL") || !config?.SecurityOpt?.includes("no-new-privileges") || !(config?.Memory > 0) || !(config?.PidsLimit > 0) || !(config?.NanoCpus > 0) || !/^[1-9][0-9]*:[1-9][0-9]*$/.test(inspected?.Config?.User ?? "") || config?.Privileged || (config?.CapAdd?.length ?? 0) > 0 || (config?.Devices?.length ?? 0) > 0 || (config?.DeviceRequests?.length ?? 0) > 0 || (config?.VolumesFrom?.length ?? 0) > 0 || config?.PidMode === "host" || config?.IpcMode === "host" || (inspected?.Mounts ?? []).some((mount) => mount.Type === "bind")) {
+    throw new Error("Docker MCP boundary is not attested.");
+  }
+  options.attest?.(inspected);
+  const child = spawn("docker", ["start", "--attach", "--interactive", id], { stdio: ["pipe", "pipe", "pipe"], env });
+  let closed;
+  let total = 0;
+  let failure;
+  const exit = new Promise((resolve) => {
+    child.once("exit", () => resolve());
+    child.once("error", () => resolve());
+  });
+  const close = () => closed ??= (async () => {
+    clearTimeout(timer);
+    child.stdin.destroy();
+    try {
+      await removeDockerMcpBoundary(cli, id);
+    } finally {
+      child.kill("SIGTERM");
+      let deadline;
+      try {
+        await Promise.race([exit, new Promise((_, reject) => {
+          deadline = setTimeout(() => {
+            child.kill("SIGKILL");
+            reject(new Error("Docker MCP attachment did not exit."));
+          }, 1000);
+        })]);
+      } finally {
+        if (deadline)
+          clearTimeout(deadline);
+      }
+    }
+  })();
+  const stop = (message) => {
+    failure ??= new Error(message);
+    close().catch(() => {});
+  };
+  const timer = setTimeout(() => stop("Docker MCP session deadline exceeded."), options.sessionMs);
+  child.stdin.on("error", () => stop("Docker MCP input failed."));
+  child.stderr.on("error", () => stop("Docker MCP diagnostic stream failed."));
+  child.on("error", () => stop("Docker MCP attachment failed."));
+  child.stderr.on("data", (chunk) => {
+    total += chunk.byteLength;
+    if (total > options.maxOutputBytes)
+      stop("Docker MCP output limit exceeded.");
+  });
+  return {
+    stdout: { async* [Symbol.asyncIterator]() {
+      for await (const chunk of child.stdout) {
+        total += chunk.byteLength;
+        if (total > options.maxOutputBytes) {
+          stop("Docker MCP output limit exceeded.");
+          break;
+        }
+        yield new Uint8Array(chunk);
+      }
+      if (failure)
+        throw failure;
+    } },
+    write(frame) {
+      if (closed || failure || child.stdin.destroyed)
+        return Promise.reject(new Error("Docker MCP channel is closed."));
+      return new Promise((resolve, reject) => child.stdin.write(frame, (error) => error ? reject(new Error("Docker MCP write failed.")) : resolve()));
+    },
+    close
+  };
+}
+
+// src/execution/mcp-oci-workspace.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// src/integrations/mcp-stdio-framing.ts
+class McpStdioProtocolError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "McpStdioProtocolError";
+  }
+}
+var validId = (id) => typeof id === "string" ? id.length <= 256 : typeof id === "number" && Number.isSafeInteger(id);
+function parseMessage(bytes) {
+  let value;
+  try {
+    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    throw new McpStdioProtocolError("Invalid MCP stdio UTF-8 or JSON frame.");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new McpStdioProtocolError("Invalid MCP stdio message envelope.");
+  }
+  const message = value;
+  const has = (key) => Object.hasOwn(message, key);
+  const request = typeof message.method === "string" && message.method.length > 0 && message.method.length <= 256;
+  const response = !has("method") && has("id") && has("result") !== has("error");
+  if (message.jsonrpc !== "2.0" || !request && !response || request && (has("result") || has("error")) || has("id") && !validId(message.id) || has("params") && (!message.params || typeof message.params !== "object") || response && has("params")) {
+    throw new McpStdioProtocolError("Invalid MCP stdio message envelope.");
+  }
+  if (has("error")) {
+    const error = message.error;
+    if (!error || typeof error !== "object" || Array.isArray(error) || !Number.isSafeInteger(error.code) || typeof error.message !== "string") {
+      throw new McpStdioProtocolError("Invalid MCP stdio error envelope.");
+    }
+  }
+  return message;
+}
+
+class McpStdioFrameDecoder {
+  maxFrameBytes;
+  onMessage;
+  frame;
+  size = 0;
+  ended = false;
+  constructor(maxFrameBytes, onMessage) {
+    this.maxFrameBytes = maxFrameBytes;
+    this.onMessage = onMessage;
+    if (!Number.isSafeInteger(maxFrameBytes) || maxFrameBytes < 1 || maxFrameBytes > 1024 * 1024) {
+      throw new RangeError("MCP stdio frame limit must be between 1 and 1048576 bytes.");
+    }
+    this.frame = new Uint8Array(maxFrameBytes);
+  }
+  push(chunk) {
+    if (this.ended)
+      throw new McpStdioProtocolError("MCP stdio decoder is closed.");
+    try {
+      let offset = 0;
+      while (offset < chunk.length) {
+        const newline = chunk.indexOf(10, offset);
+        const end = newline === -1 ? chunk.length : newline;
+        const length = end - offset;
+        if (this.size + length > this.maxFrameBytes)
+          throw new McpStdioProtocolError("MCP stdio frame exceeds byte limit.");
+        if (length) {
+          this.frame.set(chunk.subarray(offset, end), this.size);
+          this.size += length;
+        }
+        if (newline === -1)
+          return;
+        const message = parseMessage(this.frame.subarray(0, this.size));
+        this.size = 0;
+        this.onMessage(message);
+        offset = newline + 1;
+      }
+    } catch (error) {
+      this.ended = true;
+      this.frame.fill(0);
+      this.size = 0;
+      throw error;
+    }
+  }
+  finish() {
+    if (this.ended)
+      return;
+    this.ended = true;
+    const incomplete = this.size > 0;
+    this.frame.fill(0);
+    this.size = 0;
+    if (incomplete)
+      throw new McpStdioProtocolError("MCP stdio ended with an incomplete frame.");
+  }
+}
+
+// src/integrations/mcp-stdio-client.ts
+class McpStdioClientError extends Error {
+  code;
+  outcomeUnknown;
+  constructor(code, message, outcomeUnknown = false) {
+    super(message);
+    this.code = code;
+    this.outcomeUnknown = outcomeUnknown;
+    this.name = "McpStdioClientError";
+  }
+}
+
+class IsolatedMcpStdioClient {
+  channel;
+  limits;
+  nextId = 1;
+  pending;
+  stopped = false;
+  ready = false;
+  initializing = false;
+  closing;
+  decoder;
+  reading;
+  constructor(channel, limits) {
+    this.channel = channel;
+    this.limits = limits;
+    for (const value of [limits.callMs, limits.initializeMs, limits.sessionMs, limits.closeMs ?? 2000]) {
+      if (!Number.isSafeInteger(value) || value < 1 || value > 600000)
+        throw new RangeError("Invalid MCP deadline.");
+    }
+    this.decoder = new McpStdioFrameDecoder(limits.maxFrameBytes, (message) => this.receive(message));
+    this.reading = this.read();
+    this.sessionTimer = setTimeout(() => this.fail("timeout", "MCP session deadline exceeded."), limits.sessionMs);
+  }
+  sessionTimer;
+  receive(message) {
+    if (this.stopped)
+      return;
+    if ("method" in message) {
+      throw new McpStdioProtocolError("Unsolicited MCP server message.");
+    }
+    if (!this.pending || message.id !== this.pending.id)
+      throw new McpStdioProtocolError("Unknown or duplicate MCP response ID.");
+    const pending = this.pending;
+    this.pending = undefined;
+    if ("error" in message)
+      pending.reject(new McpStdioClientError("remote", "MCP server rejected the request.", pending.effectful));
+    else
+      pending.resolve(message.result);
+  }
+  async read() {
+    try {
+      for await (const chunk of this.channel.stdout) {
+        if (this.stopped)
+          break;
+        try {
+          this.decoder.push(chunk);
+        } catch {
+          this.fail("protocol", "MCP server output is invalid.");
+          break;
+        }
+      }
+      if (!this.stopped) {
+        this.decoder.finish();
+        this.fail("closed", "MCP server closed its output.");
+      }
+    } catch {
+      if (!this.stopped)
+        this.fail("protocol", "MCP server output is invalid.");
+    }
+  }
+  fail(code, message) {
+    if (this.stopped)
+      return;
+    this.stopped = true;
+    clearTimeout(this.sessionTimer);
+    const pending = this.pending;
+    this.pending = undefined;
+    pending?.reject(new McpStdioClientError(code, message, pending.effectful));
+    this.closing = this.boundedCleanup(Promise.resolve().then(() => this.channel.close())).catch(() => {
+      throw new McpStdioClientError("cleanup_required", "MCP isolated boundary cleanup was not confirmed.");
+    });
+    this.closing.catch(() => {});
+  }
+  async request(method, params, timeout, options, effectful = false) {
+    if (this.stopped)
+      throw new McpStdioClientError("closed", "MCP client is closed.");
+    if (this.pending)
+      throw new McpStdioClientError("busy", "MCP client already has an active request.");
+    if (options?.abortSignal?.aborted)
+      throw new McpStdioClientError("cancelled", "MCP request cancelled before dispatch.");
+    if (options?.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1))
+      throw new RangeError("Invalid MCP request deadline.");
+    const frame = new TextEncoder().encode(JSON.stringify({ jsonrpc: "2.0", id: this.nextId, method, params }) + `
+`);
+    if (frame.length - 1 > this.limits.maxFrameBytes)
+      throw new McpStdioClientError("protocol", "MCP request exceeds frame limit.");
+    let timer;
+    const abort = () => this.fail("cancelled", "MCP request cancelled after dispatch.");
+    try {
+      const result = await new Promise((resolve, reject) => {
+        this.pending = { id: this.nextId++, effectful, resolve, reject };
+        timer = setTimeout(() => this.fail("timeout", "MCP request deadline exceeded."), Math.min(timeout, options?.timeoutMs ?? timeout));
+        options?.abortSignal?.addEventListener("abort", abort, { once: true });
+        Promise.resolve().then(() => {
+          if (!this.stopped)
+            return this.channel.write(frame);
+        }).catch(() => this.fail("closed", "MCP request transport failed."));
+      });
+      if (this.stopped)
+        throw new McpStdioClientError("protocol", "MCP client stopped before response acceptance.", effectful);
+      return result;
+    } finally {
+      if (timer !== undefined)
+        clearTimeout(timer);
+      options?.abortSignal?.removeEventListener("abort", abort);
+    }
+  }
+  async initialize() {
+    try {
+      await this.initializeInternal();
+    } catch (error) {
+      this.fail("protocol", "MCP initialization failed.");
+      throw error;
+    }
+  }
+  async initializeInternal() {
+    if (this.ready || this.initializing)
+      throw new McpStdioClientError("protocol", "MCP client was already initialized.");
+    this.initializing = true;
+    const deadline = performance.now() + this.limits.initializeMs;
+    const result = await this.request("initialize", {
+      protocolVersion: "2025-11-25",
+      capabilities: {},
+      clientInfo: { name: "zhivex-harness", version: "1" }
+    }, this.limits.initializeMs);
+    if (!result || typeof result !== "object" || result.protocolVersion !== "2025-11-25") {
+      this.fail("protocol", "Unsupported MCP initialization response.");
+      throw new McpStdioClientError("protocol", "Unsupported MCP initialization response.");
+    }
+    try {
+      const remaining = deadline - performance.now();
+      if (remaining <= 0)
+        throw new Error("timeout");
+      let timer;
+      try {
+        await Promise.race([
+          this.channel.write(new TextEncoder().encode(`{"jsonrpc":"2.0","method":"notifications/initialized"}
+`)),
+          new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error("timeout")), remaining);
+          })
+        ]);
+      } finally {
+        if (timer !== undefined)
+          clearTimeout(timer);
+      }
+      if (this.stopped)
+        throw new Error("closed");
+      this.ready = true;
+    } catch {
+      this.fail("protocol", "MCP initialization did not complete.");
+      throw new McpStdioClientError("protocol", "MCP initialization did not complete.");
+    }
+  }
+  async listTools(input, options) {
+    if (!this.ready)
+      throw new McpStdioClientError("protocol", "MCP client is not initialized.");
+    const result = await this.request("tools/list", input ?? {}, this.limits.callMs, options);
+    if (!result || typeof result !== "object" || !Array.isArray(result.tools)) {
+      this.fail("protocol", "Invalid MCP tool listing.");
+      throw new McpStdioClientError("protocol", "Invalid MCP tool listing.");
+    }
+    return result;
+  }
+  async callTool(input, options) {
+    if (!this.ready)
+      throw new McpStdioClientError("protocol", "MCP client is not initialized.");
+    const result = await this.request("tools/call", input, this.limits.callMs, options, true);
+    if (!result || typeof result !== "object" || Array.isArray(result)) {
+      this.fail("protocol", "Invalid MCP tool result.");
+      throw new McpStdioClientError("protocol", "Invalid MCP tool result.", true);
+    }
+    return result;
+  }
+  async boundedCleanup(operation) {
+    let timer;
+    try {
+      await Promise.race([operation, new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new McpStdioClientError("cleanup_required", "MCP isolated boundary cleanup was not confirmed.")), this.limits.closeMs ?? 2000);
+      })]);
+    } finally {
+      if (timer !== undefined)
+        clearTimeout(timer);
+    }
+  }
+  async close() {
+    this.fail("closed", "MCP client was closed.");
+    await this.closing;
+    await this.boundedCleanup(this.reading);
+  }
+}
+
+// src/execution/mcp-oci-workspace.ts
+var SEEDER = String.raw`
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const readline = require('node:readline');
+const maximum = Number(process.env.ZHIVEX_MCP_WORKSPACE_BYTES);
+let bytes = 0, entries = 0, current, poisoned = false, serial = Promise.resolve();
+const safe = p => typeof p === 'string' && p.length > 0 && p.length <= 4096 && !p.startsWith('/') && !p.includes('\\') && !/[\x00-\x1f\x7f]/.test(p) && p.split('/').every(x => x && x !== '.' && x !== '..');
+async function receive(line) {
+ if (poisoned) return;
+ let request;
+ try {
+  if (Buffer.byteLength(line) > 128 * 1024) throw Error();
+  request = JSON.parse(line);
+  if (!('id' in request)) return;
+  let result;
+  if (request.method === 'initialize') result = { protocolVersion: '2025-11-25', capabilities: { tools: {} }, serverInfo: { name: 'workspace-seeder', version: '1' } };
+  else if (request.method === 'tools/call') {
+   const { name, arguments: input } = request.params;
+   if (name === 'begin') {
+    if (current || !safe(input.path) || ++entries > 20000) throw Error();
+    const target = path.join('/workspace', input.path);
+    await fs.mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+    current = await fs.open(target, 'wx', input.writable ? (input.executable ? 0o700 : 0o600) : (input.executable ? 0o500 : 0o400));
+   } else if (name === 'chunk') {
+    if (!current || typeof input.data !== 'string' || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(input.data)) throw Error();
+    const data = Buffer.from(input.data, 'base64');
+    if (data.length > 65536 || (bytes += data.length) > maximum) throw Error();
+    let offset = 0;
+    while (offset < data.length) {
+     const written = await current.write(data, offset, data.length - offset);
+     if (!written.bytesWritten) throw Error();
+     offset += written.bytesWritten;
+    }
+   } else if (name === 'end') {
+    if (!current) throw Error(); await current.close(); current = undefined;
+   } else if (name === 'complete') {
+    if (current || bytes !== input.bytes || entries !== input.entries) throw Error();
+   } else throw Error();
+   result = { content: [], structuredContent: { bytes, entries } };
+  } else throw Error();
+  process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: request.id, result }) + '\n');
+ } catch {
+  poisoned = true;
+  if (current) await current.close().catch(() => {});
+  process.exitCode = 1; process.stdin.destroy();
+ }
+}
+readline.createInterface({ input: process.stdin }).on('line', line => { serial = serial.then(() => receive(line)); });
+`;
+async function createDockerMcpWorkspace(options) {
+  if (!/^sha256:[a-f0-9]{64}$/.test(options.provisionerImageId))
+    throw new Error("MCP provisioner requires an immutable local image.");
+  const env = Object.fromEntries(["HOME", "PATH", "DOCKER_CONFIG", "DOCKER_CONTEXT", "DOCKER_HOST", "DOCKER_TLS_VERIFY", "DOCKER_CERT_PATH", "XDG_RUNTIME_DIR"].flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
+  const cli = async (args) => {
+    const result = await runPortableProcess(["docker", ...args], { env, timeoutMs: 1e4, maxOutputCharacters: 64 * 1024 });
+    if (result.exitCode !== 0 || result.timedOut)
+      throw new Error("MCP workspace Docker operation failed.");
+    return result.stdout.trim();
+  };
+  const name2 = options.resources?.plan.volumeName ?? `zhx-mcp-${randomUUID2()}`;
+  const containerName = `${name2}-seed`;
+  const ownership = options.resources?.labels ?? { "com.zhivex.harness.mcp": "v1", "com.zhivex.harness.owner-pid": String(process.pid) };
+  const labels = Object.entries(ownership).flatMap(([key, value]) => ["--label", `${key}=${value}`]);
+  const limits = options.proposal.limits;
+  const volumeOptions = `size=${limits.maxWorkspaceBytes},uid=65532,gid=65532,mode=0700,noexec,nosuid,nodev`;
+  let container;
+  let client;
+  let volumeAttempted = false;
+  let containerAttempted = false;
+  let closing;
+  const stopSeeder = async () => {
+    if (client)
+      await client.close();
+    else if (container)
+      await removeDockerMcpBoundary(cli, container);
+    else if (containerAttempted) {
+      await cli(["rm", "--force", containerName]).catch(() => {});
+      if (await cli(["ps", "--all", "--quiet", "--filter", `name=^/${containerName}$`]))
+        throw new Error("MCP seeder cleanup was not confirmed.");
+    }
+  };
+  const close = () => closing ??= (async () => {
+    let failed = false;
+    try {
+      await stopSeeder();
+    } catch {
+      failed = true;
+    }
+    if (volumeAttempted) {
+      await cli(["volume", "rm", "--force", name2]).catch(() => {});
+      try {
+        const volumes = (await cli(["volume", "ls", "--quiet", "--filter", `name=${name2}`])).split(`
+`);
+        if (volumes.includes(name2))
+          failed = true;
+      } catch {
+        failed = true;
+      }
+    }
+    if (failed)
+      throw new Error("MCP workspace cleanup was not confirmed.");
+  })();
+  try {
+    const image2 = JSON.parse(await cli(["image", "inspect", options.provisionerImageId]))[0];
+    if (image2?.Id !== options.provisionerImageId || Object.keys(image2?.Config?.Volumes ?? {}).length > 0)
+      throw new Error("Invalid MCP provisioner image.");
+    volumeAttempted = true;
+    await cli(["volume", "create", "--driver", "local", "--opt", "type=tmpfs", "--opt", "device=tmpfs", "--opt", `o=${volumeOptions}`, ...labels, name2]);
+    const volume = JSON.parse(await cli(["volume", "inspect", name2]))[0];
+    if (volume?.Name !== name2 || volume?.Driver !== "local" || volume?.Options?.type !== "tmpfs" || volume?.Options?.device !== "tmpfs" || volume?.Options?.o !== volumeOptions || !Object.entries(ownership).every(([key, value]) => volume?.Labels?.[key] === value))
+      throw new Error("MCP workspace volume was not attested.");
+    containerAttempted = true;
+    container = await cli([
+      "create",
+      "--name",
+      containerName,
+      "--pull",
+      "never",
+      "--interactive",
+      "--network",
+      "none",
+      "--read-only",
+      "--cap-drop",
+      "ALL",
+      "--security-opt",
+      "no-new-privileges",
+      "--memory",
+      `${limits.memoryMb}m`,
+      "--memory-swap",
+      `${limits.memoryMb}m`,
+      "--pids-limit",
+      String(limits.maxPids),
+      "--cpus",
+      String(limits.maxCpus),
+      "--user",
+      "65532:65532",
+      ...labels,
+      "--mount",
+      `type=volume,src=${name2},dst=/workspace,volume-nocopy`,
+      "--env",
+      "NODE_OPTIONS=",
+      "--env",
+      "NODE_PATH=",
+      "--env",
+      "LD_PRELOAD=",
+      "--env",
+      "LD_LIBRARY_PATH=",
+      "--env",
+      `ZHIVEX_MCP_WORKSPACE_BYTES=${limits.maxWorkspaceBytes}`,
+      "--entrypoint",
+      "/usr/local/bin/node",
+      options.provisionerImageId,
+      "-e",
+      SEEDER
+    ]);
+    if (!/^[a-f0-9]{64}$/.test(container)) {
+      container = undefined;
+      throw new Error("Invalid MCP seeder identity.");
+    }
+    const actual = JSON.parse(await cli(["inspect", container]))[0];
+    const mounts = actual?.Mounts;
+    if (actual?.HostConfig?.Memory !== limits.memoryMb * 1024 * 1024 || actual?.HostConfig?.MemorySwap !== limits.memoryMb * 1024 * 1024 || actual?.HostConfig?.PidsLimit !== limits.maxPids || actual?.HostConfig?.NanoCpus !== Math.round(limits.maxCpus * 1e9) || !Array.isArray(mounts) || mounts.length !== 1 || mounts[0]?.Name !== name2 || mounts[0]?.Destination !== "/workspace" || mounts[0]?.RW !== true) {
+      throw new Error("MCP provisioner limits were not attested.");
+    }
+    const channel = await openDockerMcpChannel({
+      containerId: container,
+      imageId: options.provisionerImageId,
+      sessionMs: 60000,
+      maxOutputBytes: 8 * 1024 * 1024
+    });
+    client = new IsolatedMcpStdioClient(channel, { callMs: 5000, initializeMs: 5000, sessionMs: 60000, maxFrameBytes: 128 * 1024, closeMs: 35000 });
+    await client.initialize();
+    let bytes = 0, entries = 0;
+    for await (const file of options.files) {
+      if (++entries > 20000 || (bytes += file.contents.byteLength) > limits.maxWorkspaceBytes)
+        throw new Error("MCP seed exceeds admitted limits.");
+      await client.callTool({ name: "begin", arguments: { path: file.path, executable: file.executable, writable: options.proposal.permissions.includes("write") } });
+      for (let offset = 0;offset < file.contents.byteLength; offset += 65536) {
+        await client.callTool({ name: "chunk", arguments: { data: Buffer.from(file.contents.subarray(offset, offset + 65536)).toString("base64") } });
+      }
+      await client.callTool({ name: "end", arguments: {} });
+    }
+    await client.callTool({ name: "complete", arguments: { bytes, entries } });
+    return { volumeName: name2, stopSeeder, close };
+  } catch {
+    await close();
+    throw new Error("MCP workspace provisioning failed.");
+  }
+}
+
+// src/integrations/mcp-stdio-launch.ts
+async function withAdmittedMcpLaunch(options) {
+  let result;
+  try {
+    const proposal = options.authority.consume(options.receipt, options.proposal);
+    for (const key of ["principal", "tenant", "session", "workspace"]) {
+      if (proposal.scope[key] !== options.scope[key])
+        throw new McpStdioAdmissionError("MCP launch scope changed.");
+    }
+    await consumeMcpWorkspaceSnapshot(options.snapshot, {
+      snapshotDigest: proposal.snapshotDigest,
+      workspace: options.scope.workspace,
+      maxWorkspaceBytes: proposal.limits.maxWorkspaceBytes
+    }, async (files) => {
+      const environment = { HOME: "/tmp", TMPDIR: "/tmp", LANG: "C.UTF-8", HOSTNAME: "mcp", ...proposal.environment };
+      const controller = new AbortController;
+      let timer;
+      let secretBytes = 0;
+      try {
+        await Promise.race([
+          (async () => {
+            for (const [name2, reference] of Object.entries(proposal.secretReferences)) {
+              const value = await options.resolveSecret(reference, controller.signal);
+              if (controller.signal.aborted)
+                throw new Error("expired");
+              if (typeof value !== "string" || value.length === 0 || /[\x00\r\n]/.test(value))
+                throw new Error("invalid");
+              secretBytes += new TextEncoder().encode(value).byteLength;
+              if (secretBytes > 32 * 1024)
+                throw new Error("limit");
+              environment[name2] = value;
+            }
+          })(),
+          new Promise((_, reject) => {
+            timer = setTimeout(() => {
+              controller.abort();
+              reject(new Error("expired"));
+            }, 5000);
+          })
+        ]);
+      } finally {
+        if (timer !== undefined)
+          clearTimeout(timer);
+        controller.abort();
+      }
+      result = await options.seed({ proposal, environment: Object.freeze(environment), files });
+    });
+    return result;
+  } catch {
+    throw new McpStdioAdmissionError("MCP admitted launch handoff failed.");
+  } finally {
+    await discardMcpWorkspaceSnapshot(options.snapshot);
+  }
+}
+
+// src/integrations/mcp-stdio-tools.ts
+import { createRedactionPolicy } from "@zhivex-ai/core";
+import { z as z3 } from "zod";
+
+// src/persistence/mcp-execution-journal.ts
+import { createHash as createHash4 } from "node:crypto";
+class McpExecutionJournalError extends Error {
+  code;
+  outcomeUnknown;
+  constructor(code, outcomeUnknown) {
+    super(`MCP durable execution ${code}.`);
+    this.code = code;
+    this.outcomeUnknown = outcomeUnknown;
+    this.name = "McpExecutionJournalError";
+  }
+}
+function canonical2(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonical2).join(",")}]`;
+  if (value && typeof value === "object")
+    return `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => `${JSON.stringify(key)}:${canonical2(item)}`).join(",")}}`;
+  return JSON.stringify(value);
+}
+var hash3 = (value) => createHash4("sha256").update(canonical2(value)).digest("hex");
+function createJournaledMcpClient(options) {
+  if (!options.store.claimToolExecution || !options.store.completeToolExecution || !options.store.listToolCalls || options.runId !== options.proposal.scope.session || options.scope.tenantId !== options.proposal.scope.tenant || options.scope.userId !== options.proposal.scope.principal)
+    throw new McpExecutionJournalError("identity_changed", false);
+  const scope = structuredClone(options.scope);
+  const runId = options.runId;
+  const proposalHash = hash3(options.proposal);
+  const serverId = options.proposal.serverId;
+  const claim = options.store.claimToolExecution.bind(options.store);
+  const complete = options.store.completeToolExecution.bind(options.store);
+  const list = options.store.listToolCalls.bind(options.store);
+  let stopped = false;
+  const stop = async (code, uncertain) => {
+    stopped = true;
+    try {
+      await options.client.close();
+    } catch {
+      throw new McpExecutionJournalError("cleanup_required", uncertain);
+    }
+    throw new McpExecutionJournalError(code, uncertain);
+  };
+  return {
+    listTools: (input, callOptions) => options.client.listTools(input, callOptions),
+    close: () => options.client.close(),
+    async callTool(input, callOptions) {
+      if (stopped)
+        throw new McpExecutionJournalError("outcome_unknown", true);
+      const idempotencyKey = callOptions?.idempotencyKey;
+      if (!idempotencyKey || idempotencyKey.length > 1024)
+        throw new McpExecutionJournalError("identity_changed", false);
+      if (callOptions?.abortSignal?.aborted)
+        throw new McpStdioClientError("cancelled", "MCP call cancelled before durable dispatch.");
+      let prior;
+      try {
+        prior = await list(runId, scope);
+      } catch {
+        throw new McpExecutionJournalError("persistence_failed", false);
+      }
+      if (prior.some((entry2) => entry2.toolName === "isolated_mcp_call" && (entry2.status === "pending" || entry2.status === "running" || entry2.error?.message === "MCP_OUTCOME_UNKNOWN"))) {
+        return stop("outcome_unknown", true);
+      }
+      const toolCallId = `mcp_execution_${hash3({ serverId, idempotencyKey })}`;
+      const identity = { schemaVersion: 1, kind: "isolated-mcp-call", proposalHash, argumentsHash: hash3(input), toolNameHash: hash3(input.name) };
+      let claimed;
+      try {
+        claimed = await claim({
+          runId,
+          scope,
+          toolCallId,
+          toolName: "isolated_mcp_call",
+          status: "pending",
+          idempotencyKey: `${runId}:${toolCallId}`,
+          revision: 0,
+          input: identity,
+          updatedAt: Date.now()
+        });
+      } catch {
+        throw new McpExecutionJournalError("persistence_failed", false);
+      }
+      if (!claimed.claimed) {
+        if (canonical2(claimed.entry.input) !== canonical2(identity))
+          throw new McpExecutionJournalError("identity_changed", false);
+        const uncertain = claimed.entry.status === "pending" || claimed.entry.status === "running" || claimed.entry.error?.message === "MCP_OUTCOME_UNKNOWN";
+        if (uncertain)
+          return stop("outcome_unknown", true);
+        throw new McpExecutionJournalError("replay_denied", false);
+      }
+      const entry = claimed.entry;
+      let output;
+      try {
+        output = await options.client.callTool(input, callOptions);
+      } catch (error) {
+        const uncertain = !(error instanceof McpStdioClientError) || error.outcomeUnknown;
+        try {
+          await complete({
+            ...entry,
+            status: "failed",
+            error: { message: uncertain ? "MCP_OUTCOME_UNKNOWN" : "MCP_NOT_DISPATCHED" },
+            completedAt: Date.now(),
+            updatedAt: Date.now()
+          }, { expectedRevision: entry.revision });
+        } catch {
+          return stop("persistence_failed", uncertain);
+        }
+        if (uncertain)
+          return stop("outcome_unknown", true);
+        throw new McpStdioClientError("closed", "MCP durable call failed before dispatch.");
+      }
+      try {
+        await complete({
+          ...entry,
+          status: "completed",
+          output: { outcome: "completed", outputHash: hash3(output) },
+          completedAt: Date.now(),
+          updatedAt: Date.now()
+        }, { expectedRevision: entry.revision });
+      } catch {
+        return stop("persistence_failed", true);
+      }
+      return output;
+    }
+  };
+}
+
+// src/integrations/mcp-stdio-tools.ts
+var record = z3.record(z3.string(), z3.unknown());
+var listing = z3.object({
+  tools: z3.array(z3.object({
+    name: z3.string().min(1).max(128),
+    description: z3.string().max(16000).optional(),
+    title: z3.string().max(300).optional(),
+    inputSchema: record.refine((value) => value.type === "object"),
+    outputSchema: record.refine((value) => value.type === "object").optional(),
+    annotations: record.optional()
+  }).passthrough()).max(200),
+  nextCursor: z3.string().min(1).max(2048).optional(),
+  _meta: record.optional()
+}).strict();
+var resultSchema = z3.object({
+  content: z3.array(z3.discriminatedUnion("type", [
+    z3.object({ type: z3.literal("text"), text: z3.string() }).passthrough(),
+    z3.object({ type: z3.literal("image"), data: z3.string(), mimeType: z3.string().min(1) }).passthrough(),
+    z3.object({ type: z3.literal("audio"), data: z3.string(), mimeType: z3.string().min(1) }).passthrough(),
+    z3.object({ type: z3.literal("resource_link"), uri: z3.string().min(1), name: z3.string().min(1) }).passthrough(),
+    z3.object({ type: z3.literal("resource"), resource: z3.object({ uri: z3.string().min(1), text: z3.string().optional(), blob: z3.string().optional() }).passthrough().refine((value) => value.text !== undefined || value.blob !== undefined) }).passthrough()
+  ])).max(500).optional(),
+  structuredContent: record.optional(),
+  isError: z3.boolean().optional(),
+  _meta: record.optional()
+}).strict().refine((value) => value.content !== undefined || value.structuredContent !== undefined);
+function compileSchema(schema) {
+  const pending = [{ value: schema, depth: 0 }];
+  let nodes = 0;
+  while (pending.length) {
+    const { value, depth } = pending.pop();
+    if (++nodes > 2000 || depth > 16)
+      throw new Error("MCP schema complexity limit exceeded.");
+    if (value && typeof value === "object") {
+      const item = value;
+      if (typeof item.pattern === "string" || item.patternProperties !== undefined || typeof item.$ref === "string" || typeof item.$dynamicRef === "string")
+        throw new Error("Unsupported isolated MCP schema feature.");
+      for (const child of Object.values(value))
+        pending.push({ value: child, depth: depth + 1 });
+    }
+  }
+  return z3.fromJSONSchema(schema);
+}
+async function createIsolatedMcpTools(options) {
+  const proposal = structuredClone(options.proposal);
+  const journal = options.journal ? { ...options.journal, scope: structuredClone(options.journal.scope) } : undefined;
+  const allow = new Set(proposal.includeTools);
+  const validators = new Map;
+  const outputValidators = new Map;
+  const invalidResponse = async (message, effectful = false) => {
+    try {
+      await options.client.close();
+    } catch {
+      throw new McpStdioClientError("cleanup_required", "Isolated MCP cleanup was not confirmed.", effectful);
+    }
+    throw new McpStdioClientError("protocol", message, effectful);
+  };
+  const secrets = [...new Set(options.sensitiveValues ?? [])].filter(Boolean).sort((a, b) => b.length - a.length);
+  const redaction = createRedactionPolicy({ includeEmails: true });
+  const text = (value) => redaction.redactText(secrets.reduce((current, secret) => current.split(secret).join("[REDACTED]"), value));
+  const scrub = (value, depth = 0, budget = { nodes: 0 }) => {
+    if (depth > 32 || ++budget.nodes > 20000)
+      throw new Error("MCP payload complexity limit exceeded.");
+    if (typeof value === "string")
+      return text(value);
+    if (Array.isArray(value))
+      return value.map((item) => scrub(item, depth + 1, budget));
+    if (value && typeof value === "object")
+      return Object.fromEntries(Object.entries(value).map(([key, item]) => [text(key), scrub(item, depth + 1, budget)]));
+    return value;
+  };
+  const bounded = (value) => {
+    const clean = scrub(value);
+    if (Buffer.byteLength(JSON.stringify(value)) > proposal.limits.maxOutputBytes)
+      throw new Error("MCP output limit exceeded.");
+    return clean;
+  };
+  const invoke = async (input, callOptions) => {
+    let response;
+    try {
+      response = await options.client.callTool(input, callOptions);
+    } catch (error) {
+      if (error instanceof McpStdioClientError)
+        throw new McpStdioClientError(error.code, "Isolated MCP call failed.", error.outcomeUnknown);
+      throw new Error("Isolated MCP call failed.");
+    }
+    try {
+      const parsed = resultSchema.parse(response);
+      const output = outputValidators.get(input.name);
+      if (output && !parsed.isError && !output.safeParse(parsed.structuredContent).success)
+        throw new Error("Output schema");
+      return bounded(parsed);
+    } catch {
+      return invalidResponse("Isolated MCP result validation failed.", true);
+    }
+  };
+  const validatedClient = { callTool: invoke, listTools: (input, callOptions) => options.client.listTools(input, callOptions), close: () => options.client.close() };
+  const audited = journal ? createJournaledMcpClient({ ...journal, client: validatedClient, proposal }) : validatedClient;
+  const client = {
+    async listTools(input, callOptions) {
+      try {
+        const response = await options.client.listTools(input, callOptions);
+        const clean = bounded(response);
+        if (JSON.stringify(clean) !== JSON.stringify(response))
+          throw new Error("Sensitive discovery");
+        const parsed = listing.parse(response);
+        for (const tool of parsed.tools) {
+          if (!allow.has(tool.name))
+            continue;
+          if (validators.has(tool.name))
+            throw new Error("Duplicate tool");
+          validators.set(tool.name, compileSchema(tool.inputSchema));
+          if (tool.outputSchema)
+            outputValidators.set(tool.name, compileSchema(tool.outputSchema));
+        }
+        return parsed;
+      } catch {
+        return invalidResponse("Isolated MCP discovery validation failed.");
+      }
+    },
+    async callTool(input, callOptions) {
+      const validator = validators.get(input.name);
+      if (!allow.has(input.name) || !validator)
+        throw new Error("MCP tool was not admitted.");
+      const argumentsResult = validator.safeParse(input.arguments ?? {});
+      if (!argumentsResult.success)
+        throw new Error("MCP tool arguments failed validation.");
+      return audited.callTool({ name: input.name, arguments: argumentsResult.data }, callOptions);
+    }
+  };
+  const configuration = { schemaVersion: 1, servers: [{
+    name: proposal.serverId,
+    transport: "custom",
+    includeTools: [...allow],
+    includeResources: [],
+    excludeTools: [],
+    toolNamePrefix: `mcp_${proposal.serverId.replace(/-/g, "_")}_`,
+    permissions: [...proposal.permissions],
+    headerEnv: {},
+    trustServerToolAnnotations: false,
+    maxListPages: 5,
+    maxListedTools: 200,
+    listToolsTimeoutMs: proposal.limits.callMs,
+    callToolTimeoutMs: proposal.limits.callMs,
+    maxOutputBytes: proposal.limits.maxOutputBytes
+  }] };
+  try {
+    const tools = await createHarnessMcpTools(configuration, { clients: { [proposal.serverId]: client } });
+    if (Object.keys(tools).length !== allow.size)
+      throw new Error("Admitted tools are missing.");
+    for (const name2 of allow) {
+      const key = `${configuration.servers[0].toolNamePrefix}${name2}`;
+      const definition = tools[key];
+      if (!definition || !("execute" in definition))
+        throw new Error("Missing callable tool.");
+      tools[key] = { ...definition, schema: validators.get(name2), execute: async (input, context) => {
+        if (journal && (context?.runId !== journal.runId || context.scope?.tenantId !== journal.scope.tenantId || context.scope?.userId !== journal.scope.userId || context.scope?.namespace !== journal.scope.namespace || context.toolCall?.name !== key)) {
+          throw new Error("MCP execution context does not match its admitted scope.");
+        }
+        return definition.execute(input, context);
+      } };
+    }
+    return tools;
+  } catch (error) {
+    if (error instanceof McpStdioClientError && error.code === "cleanup_required")
+      throw error;
+    return invalidResponse("Isolated MCP tool discovery failed.");
+  }
+}
+
+// src/execution/mcp-oci-server.ts
+var endpointKeys = ["HOME", "DOCKER_CONFIG", "DOCKER_CONTEXT", "DOCKER_HOST", "DOCKER_TLS_VERIFY", "DOCKER_CERT_PATH", "XDG_RUNTIME_DIR"];
+async function dockerExecutable() {
+  for (const directory of (process.env.PATH ?? "").split(path2.delimiter).filter(Boolean)) {
+    const candidate = path2.resolve(directory, "docker");
+    try {
+      await access(candidate, constants.X_OK);
+      return await realpath(candidate);
+    } catch {}
+  }
+  throw new Error("Docker is unavailable.");
+}
+function effectiveMcpContainerEnvironment(input) {
+  if (!Array.isArray(input))
+    throw new Error("Invalid MCP container environment.");
+  const result = Object.create(null);
+  const seen = new Set;
+  for (const entry of input) {
+    if (typeof entry !== "string")
+      throw new Error("Invalid MCP container environment.");
+    const index = entry.indexOf("=");
+    const name2 = index < 0 ? entry : entry.slice(0, index);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name2) || seen.has(name2))
+      throw new Error("Invalid MCP container environment.");
+    seen.add(name2);
+    if (index >= 0)
+      result[name2] = entry.slice(index + 1);
+  }
+  return result;
+}
+var same = (actual, expected) => JSON.stringify(actual) === JSON.stringify(expected);
+function attestMcpServer(inspection, expected) {
+  const value = inspection;
+  const proposal = expected.proposal, limits = proposal.limits;
+  const config = value?.Config, host = value?.HostConfig;
+  const environment = effectiveMcpContainerEnvironment(config?.Env);
+  const wanted = expected.environment;
+  const mounts = value?.Mounts;
+  const tmpfs = `/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfsMb}m,uid=65532,gid=65532,mode=0700`;
+  const checks = {
+    identity: value?.Image === expected.imageId && value?.State?.Status === "created",
+    command: same(config?.Entrypoint, [proposal.executable]) && same(config?.Cmd ?? [], proposal.args),
+    user: config?.User === "65532:65532" && config?.Hostname === "mcp",
+    cwd: config?.WorkingDir === (proposal.workingDirectory === "." ? "/workspace" : `/workspace/${proposal.workingDirectory}`),
+    auxiliary: config?.Healthcheck?.Test?.[0] === "NONE" && host?.RestartPolicy?.Name === "no" && host?.LogConfig?.Type === "none" && host?.IpcMode === "none",
+    memory: host?.Memory === limits.memoryMb * 1024 * 1024 && host?.MemorySwap === limits.memoryMb * 1024 * 1024,
+    processes: host?.PidsLimit === limits.maxPids && host?.NanoCpus === Math.round(limits.maxCpus * 1e9),
+    tmpfs: same(host?.Tmpfs, { "/tmp": tmpfs.slice(5) }),
+    writes: same(host?.Ulimits, [{ Name: "fsize", Hard: limits.maxFileWriteBytes, Soft: limits.maxFileWriteBytes }]),
+    environment: Object.keys(environment).length === Object.keys(wanted).length && Object.keys(wanted).every((key) => environment[key] === wanted[key]),
+    mount: Array.isArray(mounts) && mounts.length === 1 && mounts[0]?.Type === "volume" && mounts[0]?.Name === expected.volumeName && mounts[0]?.Destination === "/workspace" && mounts[0]?.RW === proposal.permissions.includes("write")
+  };
+  const failed = Object.keys(checks).filter((key) => !checks[key]);
+  if (failed.length)
+    throw new McpServerAttestationError(failed);
+}
+
+class McpServerAttestationError extends Error {
+  fields;
+  constructor(fields) {
+    super("MCP server does not match its admission.");
+    this.fields = fields;
+  }
+}
+async function launchDockerMcpServer(options) {
+  let workspace;
+  let channel;
+  let client;
+  let container;
+  let attempted = false;
+  let resources;
+  let containerName = `zhx-mcp-server-${randomUUID3()}`;
+  let cli;
+  let privateRoot;
+  let phase = "admission";
+  const confirmResourceAbsence = async () => {
+    if (!resources || !cli)
+      return;
+    for (const name2 of [resources.plan.serverName, resources.plan.seederName]) {
+      if (await cli(["ps", "--all", "--quiet", "--filter", `name=^/${name2}$`]))
+        throw new Error("MCP resource remains.");
+    }
+    if ((await cli(["volume", "ls", "--quiet", "--filter", `name=${resources.plan.volumeName}`])).split(`
+`).includes(resources.plan.volumeName)) {
+      throw new Error("MCP resource remains.");
+    }
+  };
+  try {
+    return await withAdmittedMcpLaunch({ ...options, seed: async ({ proposal, environment, files }) => {
+      phase = "image-inspection";
+      const executable = await dockerExecutable();
+      const endpoint = Object.fromEntries(endpointKeys.flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
+      cli = async (args, additions) => {
+        const result = await runPortableProcess([executable, ...args], { env: { ...endpoint, ...additions }, timeoutMs: 1e4, maxOutputCharacters: 1024 * 1024 });
+        if (result.exitCode !== 0 || result.timedOut)
+          throw new Error("MCP server Docker operation failed.");
+        return result.stdout.trim();
+      };
+      const image2 = JSON.parse(await cli(["image", "inspect", proposal.image]))[0];
+      if (!/^sha256:[a-f0-9]{64}$/.test(image2?.Id ?? "") || Object.keys(image2?.Config?.Volumes ?? {}).length > 0)
+        throw new Error("Invalid MCP server image.");
+      const inherited = effectiveMcpContainerEnvironment(image2?.Config?.Env ?? []);
+      const removed = Object.keys(inherited).filter((key) => !(key in environment));
+      if (removed.some((key) => endpointKeys.includes(key)))
+        throw new Error("MCP image environment conflicts with Docker control.");
+      const createEnvironment = Object.fromEntries(removed.map((key) => [key, undefined]));
+      privateRoot = await mkdtemp2(path2.join(tmpdir2(), "zhx-mcp-env-"));
+      const envFile = path2.join(privateRoot, "environment");
+      await writeFile2(envFile, Object.entries(environment).map(([key, value]) => `${key}=${value}`).join(`
+`) + `
+`, { mode: 384, flag: "wx" });
+      if (options.resourceJournal) {
+        phase = "resource-reservation";
+        resources = await reserveMcpResources({
+          ...options.resourceJournal,
+          proposal,
+          serverImageId: image2.Id,
+          provisionerImageId: options.provisionerImageId,
+          daemonId: await cli(["info", "--format", "{{.ID}}"])
+        });
+        containerName = resources.plan.serverName;
+        await resources.advance("provisioning");
+      }
+      phase = "workspace";
+      workspace = await createDockerMcpWorkspace({ provisionerImageId: options.provisionerImageId, proposal, files, ...resources ? { resources } : {} });
+      const limits = proposal.limits;
+      attempted = true;
+      phase = "container-create";
+      container = await cli([
+        "create",
+        "--name",
+        containerName,
+        "--hostname",
+        "mcp",
+        "--pull",
+        "never",
+        "--interactive",
+        "--network",
+        "none",
+        "--read-only",
+        "--cap-drop",
+        "ALL",
+        "--security-opt",
+        "no-new-privileges",
+        "--user",
+        "65532:65532",
+        "--ipc",
+        "none",
+        "--no-healthcheck",
+        "--restart",
+        "no",
+        "--log-driver",
+        "none",
+        "--memory",
+        `${limits.memoryMb}m`,
+        "--memory-swap",
+        `${limits.memoryMb}m`,
+        "--pids-limit",
+        String(limits.maxPids),
+        "--cpus",
+        String(limits.maxCpus),
+        "--ulimit",
+        `fsize=${limits.maxFileWriteBytes}:${limits.maxFileWriteBytes}`,
+        "--tmpfs",
+        `/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfsMb}m,uid=65532,gid=65532,mode=0700`,
+        ...Object.entries(resources?.labels ?? { "com.zhivex.harness.mcp": "v1", "com.zhivex.harness.owner-pid": String(process.pid) }).flatMap(([key, value]) => ["--label", `${key}=${value}`]),
+        "--mount",
+        `type=volume,src=${workspace.volumeName},dst=/workspace,volume-nocopy${proposal.permissions.includes("write") ? "" : ",readonly"}`,
+        ...removed.flatMap((key) => ["--env", key]),
+        "--env-file",
+        envFile,
+        "--workdir",
+        proposal.workingDirectory === "." ? "/workspace" : `/workspace/${proposal.workingDirectory}`,
+        "--entrypoint",
+        proposal.executable,
+        image2.Id,
+        ...proposal.args
+      ], createEnvironment);
+      if (!/^[a-f0-9]{64}$/.test(container)) {
+        container = undefined;
+        throw new Error("Invalid MCP container identity.");
+      }
+      await rm2(privateRoot, { recursive: true, force: true });
+      privateRoot = undefined;
+      phase = "attestation";
+      channel = await openDockerMcpChannel({
+        containerId: container,
+        imageId: image2.Id,
+        sessionMs: limits.sessionMs,
+        maxOutputBytes: limits.maxOutputBytes,
+        attest: (inspection) => {
+          try {
+            attestMcpServer(inspection, { imageId: image2.Id, volumeName: workspace.volumeName, proposal, environment });
+          } catch (error) {
+            if (error instanceof McpServerAttestationError)
+              phase = `attestation:${error.fields.join(",")}`;
+            throw error;
+          }
+        }
+      });
+      const serverChannel = channel, ownedWorkspace = workspace;
+      const managed = {
+        stdout: channel.stdout,
+        write: (frame) => serverChannel.write(frame),
+        async close() {
+          let journalFailed = false, cleanupFailed = false;
+          try {
+            await resources?.advance("closing");
+          } catch {
+            journalFailed = true;
+          }
+          try {
+            await serverChannel.close();
+          } catch {
+            cleanupFailed = true;
+          }
+          try {
+            await ownedWorkspace.close();
+          } catch {
+            cleanupFailed = true;
+          }
+          try {
+            await confirmResourceAbsence();
+          } catch {
+            cleanupFailed = true;
+          }
+          try {
+            await resources?.advance(cleanupFailed ? "cleanup_required" : "closed");
+          } catch {
+            journalFailed = true;
+          }
+          if (cleanupFailed || journalFailed)
+            throw new Error("MCP resource cleanup or its durable record was not confirmed.");
+        }
+      };
+      client = new IsolatedMcpStdioClient(managed, {
+        callMs: limits.callMs,
+        initializeMs: Math.min(1e4, limits.sessionMs),
+        sessionMs: limits.sessionMs,
+        maxFrameBytes: Math.min(1024 * 1024, limits.maxOutputBytes),
+        closeMs: 60000
+      });
+      phase = "initialization";
+      await client.initialize();
+      phase = "seeder-stop";
+      await workspace.stopSeeder();
+      await resources?.advance("ready");
+      return client;
+    } });
+  } catch {
+    let cleanupFailed = false;
+    if (!client) {
+      try {
+        await resources?.advance("closing");
+      } catch {
+        cleanupFailed = true;
+      }
+    }
+    try {
+      if (client)
+        await client.close();
+      else if (channel)
+        await channel.close();
+      else if (container && cli)
+        await removeDockerMcpBoundary(cli, container);
+      else if (attempted && cli) {
+        await cli(["rm", "--force", containerName]).catch(() => {});
+        if (await cli(["ps", "--all", "--quiet", "--filter", `name=^/${containerName}$`]))
+          throw new Error("cleanup");
+      }
+    } catch {
+      cleanupFailed = true;
+    }
+    try {
+      await workspace?.close();
+    } catch {
+      cleanupFailed = true;
+    }
+    try {
+      await confirmResourceAbsence();
+    } catch {
+      cleanupFailed = true;
+    }
+    if (!client) {
+      try {
+        await resources?.advance(cleanupFailed ? "cleanup_required" : "closed");
+      } catch {
+        cleanupFailed = true;
+      }
+    }
+    if (cleanupFailed)
+      throw new Error("MCP server cleanup was not confirmed.");
+    throw new Error(`MCP admitted server launch failed (${phase}).`);
+  } finally {
+    if (privateRoot)
+      await rm2(privateRoot, { recursive: true, force: true });
+  }
+}
+async function launchDockerMcpTools(options) {
+  return launchMcpToolsOwned(options, false);
+}
+async function launchMcpToolsOwned(options, groupRecoveryComplete) {
+  const journal = options.journal ? { ...options.journal, scope: structuredClone(options.journal.scope) } : undefined;
+  if (!journal || !journal.hostId || !journal.store?.loadToolCall || !journal.store.saveToolCall || !journal.store?.claimToolExecution || !journal.store.completeToolExecution || !journal.store.listToolCalls || journal.runId !== options.scope.session || journal.scope?.tenantId !== options.scope.tenant || journal.scope.userId !== options.scope.principal) {
+    await discardMcpWorkspaceSnapshot(options.snapshot);
+    throw new Error("MCP tool launch requires a matching durable journal.");
+  }
+  try {
+    const recovery = groupRecoveryComplete ? { deferred: 0 } : await recoverDockerMcpResources(journal);
+    if (recovery.deferred > 0)
+      throw new Error("Unresolved MCP resources.");
+  } catch {
+    await discardMcpWorkspaceSnapshot(options.snapshot);
+    throw new Error("MCP tool launch requires confirmed recovery of prior resources.");
+  }
+  const proposal = structuredClone(options.proposal);
+  const sensitiveValues = Object.values(proposal.environment);
+  const client = await launchDockerMcpServer({ ...options, resourceJournal: journal, proposal, resolveSecret: async (reference, signal) => {
+    const value = await options.resolveSecret(reference, signal);
+    if (value !== undefined)
+      sensitiveValues.push(value);
+    return value;
+  } });
+  try {
+    const tools = await createIsolatedMcpTools({ client, proposal, sensitiveValues, journal });
+    const hostSession = issueMcpHostSession({ tools, ...journal, proposal, close: () => client.close() });
+    return Object.freeze({ tools, hostSession, close: () => closeMcpHostSession(hostSession) });
+  } catch {
+    await client.close();
+    throw new Error("MCP admitted tool setup failed.");
+  }
+}
+async function launchDockerMcpGroup(input, signal) {
+  const launched = [];
+  try {
+    if (!input.length || input.length > 8)
+      throw new Error("Invalid MCP group size.");
+    const first = input[0];
+    const prefixes = new Set;
+    for (const item of input) {
+      if (!item.journal || !first.journal || item.journal.store !== first.journal.store || item.journal.hostId !== first.journal.hostId || item.journal.runId !== first.journal.runId || item.journal.scope.tenantId !== first.journal.scope.tenantId || item.journal.scope.userId !== first.journal.scope.userId || item.journal.scope.namespace !== first.journal.scope.namespace || item.scope.workspace !== first.scope.workspace || item.proposal.snapshotDigest !== first.proposal.snapshotDigest)
+        throw new Error("MCP group identity mismatch.");
+      const prefix = item.proposal.serverId.replace(/-/g, "_");
+      if (prefixes.has(prefix))
+        throw new Error("MCP group namespace collision.");
+      prefixes.add(prefix);
+    }
+    for (const item of input) {
+      if (signal?.aborted)
+        throw new Error("MCP group launch cancelled.");
+      launched.push(await launchMcpToolsOwned(item, launched.length > 0));
+    }
+    if (signal?.aborted)
+      throw new Error("MCP group launch cancelled.");
+    const hostSession = combineMcpHostSessions(launched.map((session) => session.hostSession));
+    return Object.freeze({ hostSession, close: () => closeMcpHostSession(hostSession) });
+  } catch {
+    const cleanup = await Promise.allSettled([
+      ...launched.map((session) => session.close()),
+      ...input.map((item) => discardMcpWorkspaceSnapshot(item.snapshot))
+    ]);
+    if (cleanup.some((result) => result.status === "rejected"))
+      throw new Error("MCP group cleanup was not confirmed.");
+    throw new Error("MCP group admission or launch failed.");
+  }
+}
+
+export { prepareMcpWorkspaceSnapshot, discardMcpWorkspaceSnapshot, mcpResourcePlanSchema, mcpResourceOutputSchema, matchesMcpResourceScope, recoverDockerMcpResources, McpStdioAdmissionError, createMcpStdioAdmissionAuthority, launchDockerMcpTools, launchDockerMcpGroup };