anpord 0.1.21 → 0.1.23

package/dist/api-context.d.cts

@@ -1,4 +1,4 @@
-import { t as ApiCall } from "./api-mocks-BenVx0e8.cjs";
+import { t as ApiCall } from "./api-mocks-ofqP55P_.cjs";
 //#region src/mock-api/context.d.ts
 declare const apiContext: {
   url: (name: string) => Promise<string>;

package/dist/api-context.d.mts

@@ -1,4 +1,4 @@
-import { t as ApiCall } from "./api-mocks-BenVx0e8.mjs";
+import { t as ApiCall } from "./api-mocks-ofqP55P_.mjs";
 //#region src/mock-api/context.d.ts
 declare const apiContext: {
   url: (name: string) => Promise<string>;

package/dist/{api-mocks-BenVx0e8.d.cts → api-mocks-ofqP55P_.d.cts}

@@ -57,11 +57,11 @@ declare const ApiCall_base: Schema.Class<ApiCall, {
     truncated: typeof Schema.Boolean;
   }>>>;
 }>, never, {
+  readonly api: string;
+} & {
   readonly status: number;
 } & {
   readonly startedAt: number;
-} & {
-  readonly api: string;
 } & {
   readonly path: string;
 } & {

package/dist/{api-mocks-BenVx0e8.d.mts → api-mocks-ofqP55P_.d.mts}

@@ -57,11 +57,11 @@ declare const ApiCall_base: Schema.Class<ApiCall, {
     truncated: typeof Schema.Boolean;
   }>>>;
 }>, never, {
+  readonly api: string;
+} & {
   readonly status: number;
 } & {
   readonly startedAt: number;
-} & {
-  readonly api: string;
 } & {
   readonly path: string;
 } & {

package/dist/api-runtime.d.cts

@@ -1,4 +1,4 @@
-import { t as ApiCall } from "./api-mocks-BenVx0e8.cjs";
+import { t as ApiCall } from "./api-mocks-ofqP55P_.cjs";
 import { t as ApiDefinition } from "./define-NZvmQuIv.cjs";
 //#region src/mock-api/runtime.d.ts
 declare const withApi: <A>({ api, run }: {

package/dist/api-runtime.d.mts

@@ -1,4 +1,4 @@
-import { t as ApiCall } from "./api-mocks-BenVx0e8.mjs";
+import { t as ApiCall } from "./api-mocks-ofqP55P_.mjs";
 import { t as ApiDefinition } from "./define-NZvmQuIv.mjs";
 //#region src/mock-api/runtime.d.ts
 declare const withApi: <A>({ api, run }: {

package/dist/api.d.cts

@@ -1,4 +1,4 @@
-import { t as ApiCall } from "./api-mocks-BenVx0e8.cjs";
+import { t as ApiCall } from "./api-mocks-ofqP55P_.cjs";
 import { a as endpoint, i as api, n as ApiHandlerContext, r as EndpointDefinition, t as ApiDefinition } from "./define-NZvmQuIv.cjs";
 import { withApi } from "./api-runtime.cjs";
 export { type ApiCall, type ApiDefinition, type ApiHandlerContext, type EndpointDefinition, api, endpoint, withApi };

package/dist/api.d.mts

@@ -1,4 +1,4 @@
-import { t as ApiCall } from "./api-mocks-BenVx0e8.mjs";
+import { t as ApiCall } from "./api-mocks-ofqP55P_.mjs";
 import { a as endpoint, i as api, n as ApiHandlerContext, r as EndpointDefinition, t as ApiDefinition } from "./define-NZvmQuIv.mjs";
 import { withApi } from "./api-runtime.mjs";
 export { type ApiCall, type ApiDefinition, type ApiHandlerContext, type EndpointDefinition, api, endpoint, withApi };

package/dist/bin.cjs

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 const require_eval_validations = require("./eval-validations-CZm7vVtQ.cjs");
 const require_api_mocks = require("./api-mocks-CgiC7T9U.cjs");
-const require_client = require("./client-BZDftC1x.cjs");
-const require_evals_api = require("./evals-api-CNoLlXL5.cjs");
+const require_client = require("./client-CWVAt_wk.cjs");
+const require_evals_api = require("./evals-api-DUiZWsyC.cjs");
 const require_eval_turns = require("./eval-turns-DcJ8_1qr.cjs");
 const require_errors = require("./errors-BX1wry8K.cjs");
 const require_config = require("./config.cjs");
-const require_compiler = require("./compiler-Cy85vNbp.cjs");
+const require_compiler = require("./compiler-B1UrHfCL.cjs");
 let effect = require("effect");
 let _effect_platform = require("@effect/platform");
 let node_fs_promises = require("node:fs/promises");
@@ -19,7 +19,7 @@ let yaml = require("yaml");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
 //#region package.json
-var version$1 = "0.1.21";
+var version$1 = "0.1.23";
 //#endregion
 //#region ../template/src/extract.ts
 /** Reads escapes too, so text the renderer leaves literal is never reported as
@@ -653,6 +653,31 @@ const importEval = _effect_cli.Command.make("import", {
 	return yield* note(summaryOf(suite.tally));
 }).pipe(effect.Effect.withSpan("Cli.evalImport"))).pipe(_effect_cli.Command.withDescription("Turn a case file a team already wrote into a suite"));
 //#endregion
+//#region ../eval/src/credentials/errors.ts
+var CredentialError = class extends effect.Data.TaggedError("CredentialError") {};
+//#endregion
+//#region ../eval/src/credentials/resolver.ts
+var CredentialResolver = class extends effect.Context.Tag("@anpord/eval/CredentialResolver")() {};
+//#endregion
+//#region ../eval/src/credentials/env-resolver.ts
+const environment = () => Object.fromEntries(Object.entries(process.env).flatMap(([name, value]) => value === void 0 ? [] : [[name, value]]));
+const resolved = (integrationId, values) => effect.Redacted.make({
+	authMethodId: "env",
+	connectionId: "local",
+	integrationId,
+	revision: 0,
+	values
+});
+const credentialResolverFrom = (values) => effect.Layer.succeed(CredentialResolver, CredentialResolver.of({
+	persist: () => effect.Effect.void,
+	resolve: ({ integrationId }) => effect.Effect.succeed(resolved(integrationId, values)),
+	resolveBound: ({ connectionId }) => effect.Effect.fail(new CredentialError({
+		code: "not-found",
+		message: `a local run has no stored connection, so ${connectionId} cannot be read`
+	}))
+}));
+const CredentialResolverFromEnv = effect.Layer.suspend(() => credentialResolverFrom(environment()));
+//#endregion
 //#region ../eval/src/domain/harness-profile.ts
 const profileOfRequest = (profile) => profile === void 0 ? null : {
 	env: profile.env ?? null,
@@ -3244,9 +3269,6 @@ const modelAccessFor = (credentials, organizationId) => effect.Effect.gen(functi
 	})));
 });
 //#endregion
-//#region ../eval/src/credentials/resolver.ts
-var CredentialResolver = class extends effect.Context.Tag("@anpord/eval/CredentialResolver")() {};
-//#endregion
 //#region ../eval/src/ports/simulated-user.ts
 var SimulatedUser = class extends effect.Context.Tag("@anpord/eval/SimulatedUser")() {};
 effect.Layer.succeed(SimulatedUser, { reply: () => effect.Effect.succeedNone });
@@ -3300,26 +3322,6 @@ const makeLlmUser = effect.Effect.gen(function* () {
 });
 const SimulatedUserLive = effect.Layer.effect(SimulatedUser, makeLlmUser);
 //#endregion
-//#region ../eval/src/credentials/errors.ts
-var CredentialError = class extends effect.Data.TaggedError("CredentialError") {};
-//#endregion
-//#region ../eval/src/credentials/env-resolver.ts
-const resolved = (integrationId) => effect.Redacted.make({
-	authMethodId: "env",
-	connectionId: "local",
-	integrationId,
-	revision: 0,
-	values: Object.fromEntries(Object.entries(process.env).flatMap(([name, value]) => value === void 0 ? [] : [[name, value]]))
-});
-const CredentialResolverFromEnv = effect.Layer.succeed(CredentialResolver, CredentialResolver.of({
-	persist: () => effect.Effect.void,
-	resolve: ({ integrationId }) => effect.Effect.succeed(resolved(integrationId)),
-	resolveBound: ({ connectionId }) => effect.Effect.fail(new CredentialError({
-		code: "not-found",
-		message: `a local run has no stored connection, so ${connectionId} cannot be read`
-	}))
-}));
-//#endregion
 //#region ../eval/src/ports/sandbox.ts
 var SandboxProvider = class extends effect.Context.Tag("@anpord/eval/SandboxProvider")() {};
 var SandboxAdapters = class extends effect.Context.Tag("@anpord/eval/SandboxAdapters")() {};
@@ -4483,7 +4485,8 @@ const SandboxProviderLive = effect.Layer.effect(SandboxProvider, effect.Effect.g
 //#endregion
 //#region ../eval/src/local-layer.ts
 const LocalAdaptersLive = effect.Layer.effect(SandboxAdapters, effect.Effect.map(effect.Effect.cached(makeLocalAdapter), (local) => SandboxAdapters.of({ resolve: (provider) => provider === "local" ? local : effect.Effect.dieMessage(`a local run cannot open a ${provider} sandbox`) })));
-const EvalLocalLive = LocalTrialsLive.pipe(effect.Layer.provide(AgentTrialJudgedLive.pipe(effect.Layer.provide(AgentTrialLive.pipe(effect.Layer.provide(ScorerChecksLive.pipe(effect.Layer.provide(ScorerGroundTruthLive))), effect.Layer.provide(SuspenderSleeping), effect.Layer.provide(SimulatedUserLive.pipe(effect.Layer.provide(_effect_platform.FetchHttpClient.layer))))), effect.Layer.provide(JudgeModelLive.pipe(effect.Layer.provide(_effect_platform.FetchHttpClient.layer))), effect.Layer.provide(effect.Layer.mergeAll(HarnessesLive, HarnessVersionsLive)))), effect.Layer.provide(CredentialResolverFromEnv), effect.Layer.provide(SandboxProviderLive.pipe(effect.Layer.provide(LocalAdaptersLive))));
+const evalLocalWith = (credentials) => LocalTrialsLive.pipe(effect.Layer.provide(AgentTrialJudgedLive.pipe(effect.Layer.provide(AgentTrialLive.pipe(effect.Layer.provide(ScorerChecksLive.pipe(effect.Layer.provide(ScorerGroundTruthLive))), effect.Layer.provide(SuspenderSleeping), effect.Layer.provide(SimulatedUserLive.pipe(effect.Layer.provide(_effect_platform.FetchHttpClient.layer))))), effect.Layer.provide(JudgeModelLive.pipe(effect.Layer.provide(_effect_platform.FetchHttpClient.layer))), effect.Layer.provide(effect.Layer.mergeAll(HarnessesLive, HarnessVersionsLive)))), effect.Layer.provide(credentials), effect.Layer.provide(SandboxProviderLive.pipe(effect.Layer.provide(LocalAdaptersLive))), effect.Layer.provideMerge(HarnessVersionsLive));
+const EvalLocalLive = evalLocalWith(CredentialResolverFromEnv);
 //#endregion
 //#region src/cli/local-env.ts
 const FILES = [".env.local", ".env"];
@@ -4509,25 +4512,27 @@ const read = (directory, file) => {
 const localEnv = (directory) => Object.assign({}, ...FILES.map((file) => read(directory, file)).reverse(), parse(Object.entries(process.env).map(([name, value]) => `${name}=${value ?? ""}`).join("\n")));
 //#endregion
 //#region src/cli/eval-local.ts
-const runLocally = (request, onTrial) => effect.Effect.gen(function* () {
+const runLocally = (request, options = {}) => effect.Effect.gen(function* () {
 	const trials = yield* LocalTrials;
+	const versions = yield* HarnessVersions;
 	const forwarded = localEnv(process.cwd());
 	const task = request.tasks[0];
 	if (task === void 0) return [];
+	const harnessVersion = yield* versions.version(task.harness);
 	return yield* effect.Effect.forEach(request.cases, (subject) => trials.run({
 		caseName: subject.name,
 		forwarded,
 		harness: task.harness,
-		harnessVersion: "local",
+		harnessVersion,
 		model: task.model,
 		prepare: subject.prepare ?? null,
 		profile: profileOfRequest(task.profile),
 		prompt: request.prompt,
-		source: { kind: "empty" },
+		source: subject.source ?? { kind: "empty" },
 		user: subject.user ?? null,
 		validator: subject.validator ?? null,
 		verifyCommand: subject.verify
-	}).pipe(effect.Effect.tap((outcome) => onTrial?.({
+	}).pipe(effect.Effect.tap((outcome) => options.onTrial?.({
 		caseName: subject.name,
 		events: outcome.events,
 		ordinal: 0,
@@ -4540,7 +4545,7 @@ const runLocally = (request, onTrial) => effect.Effect.gen(function* () {
 		name: subject.name,
 		status: outcome.outcome.status
 	}))), { concurrency: 1 });
-}).pipe(effect.Effect.provide(EvalLocalLive), effect.Effect.scoped, effect.Effect.withConfigProvider(effect.ConfigProvider.fromEnv().pipe(effect.ConfigProvider.orElse(() => effect.ConfigProvider.fromMap(/* @__PURE__ */ new Map([["ANPORD_LOCAL_SANDBOX", "true"]]))))));
+}).pipe(effect.Effect.provide(options.credentials === void 0 ? EvalLocalLive : evalLocalWith(credentialResolverFrom(options.credentials))), effect.Effect.scoped, effect.Effect.withConfigProvider(effect.ConfigProvider.fromEnv().pipe(effect.ConfigProvider.orElse(() => effect.ConfigProvider.fromMap(/* @__PURE__ */ new Map([["ANPORD_LOCAL_SANDBOX", "true"]]))))));
 const seconds = (ms) => `${(ms / 1e3).toFixed(1)}s`;
 const reportLocal = (file, cases) => effect.Effect.forEach([`${file}: ${cases.length} case(s) on this machine`, ...cases.map((one) => `  ${one.status} ${one.name} ${seconds(one.durationMs)}`)], note);
 const localProblems = (cases) => cases.flatMap((one) => one.status === "passed" ? [] : [`${one.name} ${one.status}`]);
@@ -4819,13 +4824,19 @@ const recordedLocally = (file) => effect.Effect.gen(function* () {
 		trigger
 	} });
 	yield* reportStarted(file, started.id);
-	const cases = yield* runLocally(payload, (trial) => api.evals.reportTrial({ payload: {
-		id: started.id,
-		trial
-	} }).pipe(effect.Effect.ignore));
-	yield* api.evals.finishRun({ payload: { id: started.id } }).pipe(effect.Effect.ignore);
-	return cases;
-}).pipe(effect.Effect.provide(require_config.ClientLayer));
+	yield* effect.Effect.addFinalizer(() => api.evals.finishRun({ payload: { id: started.id } }).pipe(effect.Effect.ignore));
+	const leased = yield* api.evals.credentials({ payload: {
+		harness: payload.tasks[0]?.harness ?? "codex",
+		id: started.id
+	} }).pipe(effect.Effect.map((lease) => lease.values), effect.Effect.catchAll(() => effect.Effect.succeed(void 0)));
+	return yield* runLocally(payload, {
+		credentials: leased,
+		onTrial: (trial) => api.evals.reportTrial({ payload: {
+			id: started.id,
+			trial
+		} }).pipe(effect.Effect.ignore)
+	});
+}).pipe(effect.Effect.scoped, effect.Effect.provide(require_config.ClientLayer));
 const runOneEvalLocally = (file) => require_config.apiKeyConfig.pipe(effect.Effect.matchEffect({
 	onFailure: () => require_compiler.compileEvalEffect(file).pipe(effect.Effect.flatMap((payload) => runLocally(payload))),
 	onSuccess: () => recordedLocally(file)

package/dist/bin.mjs

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { c as validationExecution, i as VALIDATION_TEXT_LIMIT, l as validationSnapshot, r as VALIDATION_FRAME, s as validationCapture, t as EvalValidation } from "./eval-validations-DNO-qwkU.mjs";
 import { a as ApiCall, i as API_READY, o as ApiManifest, r as API_PROGRAM, s as ApiProgram, t as API_JOURNAL } from "./api-mocks-BYWvJp9v.mjs";
-import { a as ChannelName, o as PromptId, s as VersionNumber, t as AnpordApi } from "./client-D0l3kwWV.mjs";
-import { a as EvalSandbox, i as EvalRun, p as EvalTrigger, r as HarnessEvent } from "./evals-api-CK3F1KoI.mjs";
+import { a as ChannelName, o as PromptId, s as VersionNumber, t as AnpordApi } from "./client-CfPf0hIc.mjs";
+import { a as EvalSandbox, i as EvalRun, p as EvalTrigger, r as HarnessEvent } from "./evals-api-NLUUV9tM.mjs";
 import { t as DEFAULT_USER_MODEL } from "./eval-turns-BC-GMHD-.mjs";
 import { i as tokenMatcher, r as asAnpordError } from "./errors-B0YknR5V.mjs";
 import { ClientLayer, apiKeyConfig, webUrlConfig } from "./config.mjs";
-import { r as compileEvalEffect } from "./compiler-DSQRHvXS.mjs";
+import { r as compileEvalEffect } from "./compiler-D9jidpZ0.mjs";
 import { Array as Array$1, Cause, Chunk, Clock, Config, ConfigProvider, Console, Context, Data, Deferred, Duration, Effect, Fiber, JSONSchema, Layer, Option, ParseResult, Random, Redacted, Ref, Schedule, Schema, Stream, pipe } from "effect";
 import { FetchHttpClient, FileSystem, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse } from "@effect/platform";
 import { cp, mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
@@ -19,7 +19,7 @@ import { parseDocument } from "yaml";
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
 //#region package.json
-var version$1 = "0.1.21";
+var version$1 = "0.1.23";
 //#endregion
 //#region ../template/src/extract.ts
 /** Reads escapes too, so text the renderer leaves literal is never reported as
@@ -653,6 +653,31 @@ const importEval = Command.make("import", {
 	return yield* note(summaryOf(suite.tally));
 }).pipe(Effect.withSpan("Cli.evalImport"))).pipe(Command.withDescription("Turn a case file a team already wrote into a suite"));
 //#endregion
+//#region ../eval/src/credentials/errors.ts
+var CredentialError = class extends Data.TaggedError("CredentialError") {};
+//#endregion
+//#region ../eval/src/credentials/resolver.ts
+var CredentialResolver = class extends Context.Tag("@anpord/eval/CredentialResolver")() {};
+//#endregion
+//#region ../eval/src/credentials/env-resolver.ts
+const environment = () => Object.fromEntries(Object.entries(process.env).flatMap(([name, value]) => value === void 0 ? [] : [[name, value]]));
+const resolved = (integrationId, values) => Redacted.make({
+	authMethodId: "env",
+	connectionId: "local",
+	integrationId,
+	revision: 0,
+	values
+});
+const credentialResolverFrom = (values) => Layer.succeed(CredentialResolver, CredentialResolver.of({
+	persist: () => Effect.void,
+	resolve: ({ integrationId }) => Effect.succeed(resolved(integrationId, values)),
+	resolveBound: ({ connectionId }) => Effect.fail(new CredentialError({
+		code: "not-found",
+		message: `a local run has no stored connection, so ${connectionId} cannot be read`
+	}))
+}));
+const CredentialResolverFromEnv = Layer.suspend(() => credentialResolverFrom(environment()));
+//#endregion
 //#region ../eval/src/domain/harness-profile.ts
 const profileOfRequest = (profile) => profile === void 0 ? null : {
 	env: profile.env ?? null,
@@ -3244,9 +3269,6 @@ const modelAccessFor = (credentials, organizationId) => Effect.gen(function* ()
 	})));
 });
 //#endregion
-//#region ../eval/src/credentials/resolver.ts
-var CredentialResolver = class extends Context.Tag("@anpord/eval/CredentialResolver")() {};
-//#endregion
 //#region ../eval/src/ports/simulated-user.ts
 var SimulatedUser = class extends Context.Tag("@anpord/eval/SimulatedUser")() {};
 Layer.succeed(SimulatedUser, { reply: () => Effect.succeedNone });
@@ -3300,26 +3322,6 @@ const makeLlmUser = Effect.gen(function* () {
 });
 const SimulatedUserLive = Layer.effect(SimulatedUser, makeLlmUser);
 //#endregion
-//#region ../eval/src/credentials/errors.ts
-var CredentialError = class extends Data.TaggedError("CredentialError") {};
-//#endregion
-//#region ../eval/src/credentials/env-resolver.ts
-const resolved = (integrationId) => Redacted.make({
-	authMethodId: "env",
-	connectionId: "local",
-	integrationId,
-	revision: 0,
-	values: Object.fromEntries(Object.entries(process.env).flatMap(([name, value]) => value === void 0 ? [] : [[name, value]]))
-});
-const CredentialResolverFromEnv = Layer.succeed(CredentialResolver, CredentialResolver.of({
-	persist: () => Effect.void,
-	resolve: ({ integrationId }) => Effect.succeed(resolved(integrationId)),
-	resolveBound: ({ connectionId }) => Effect.fail(new CredentialError({
-		code: "not-found",
-		message: `a local run has no stored connection, so ${connectionId} cannot be read`
-	}))
-}));
-//#endregion
 //#region ../eval/src/ports/sandbox.ts
 var SandboxProvider = class extends Context.Tag("@anpord/eval/SandboxProvider")() {};
 var SandboxAdapters = class extends Context.Tag("@anpord/eval/SandboxAdapters")() {};
@@ -4483,7 +4485,8 @@ const SandboxProviderLive = Layer.effect(SandboxProvider, Effect.gen(function* (
 //#endregion
 //#region ../eval/src/local-layer.ts
 const LocalAdaptersLive = Layer.effect(SandboxAdapters, Effect.map(Effect.cached(makeLocalAdapter), (local) => SandboxAdapters.of({ resolve: (provider) => provider === "local" ? local : Effect.dieMessage(`a local run cannot open a ${provider} sandbox`) })));
-const EvalLocalLive = LocalTrialsLive.pipe(Layer.provide(AgentTrialJudgedLive.pipe(Layer.provide(AgentTrialLive.pipe(Layer.provide(ScorerChecksLive.pipe(Layer.provide(ScorerGroundTruthLive))), Layer.provide(SuspenderSleeping), Layer.provide(SimulatedUserLive.pipe(Layer.provide(FetchHttpClient.layer))))), Layer.provide(JudgeModelLive.pipe(Layer.provide(FetchHttpClient.layer))), Layer.provide(Layer.mergeAll(HarnessesLive, HarnessVersionsLive)))), Layer.provide(CredentialResolverFromEnv), Layer.provide(SandboxProviderLive.pipe(Layer.provide(LocalAdaptersLive))));
+const evalLocalWith = (credentials) => LocalTrialsLive.pipe(Layer.provide(AgentTrialJudgedLive.pipe(Layer.provide(AgentTrialLive.pipe(Layer.provide(ScorerChecksLive.pipe(Layer.provide(ScorerGroundTruthLive))), Layer.provide(SuspenderSleeping), Layer.provide(SimulatedUserLive.pipe(Layer.provide(FetchHttpClient.layer))))), Layer.provide(JudgeModelLive.pipe(Layer.provide(FetchHttpClient.layer))), Layer.provide(Layer.mergeAll(HarnessesLive, HarnessVersionsLive)))), Layer.provide(credentials), Layer.provide(SandboxProviderLive.pipe(Layer.provide(LocalAdaptersLive))), Layer.provideMerge(HarnessVersionsLive));
+const EvalLocalLive = evalLocalWith(CredentialResolverFromEnv);
 //#endregion
 //#region src/cli/local-env.ts
 const FILES = [".env.local", ".env"];
@@ -4509,25 +4512,27 @@ const read = (directory, file) => {
 const localEnv = (directory) => Object.assign({}, ...FILES.map((file) => read(directory, file)).reverse(), parse(Object.entries(process.env).map(([name, value]) => `${name}=${value ?? ""}`).join("\n")));
 //#endregion
 //#region src/cli/eval-local.ts
-const runLocally = (request, onTrial) => Effect.gen(function* () {
+const runLocally = (request, options = {}) => Effect.gen(function* () {
 	const trials = yield* LocalTrials;
+	const versions = yield* HarnessVersions;
 	const forwarded = localEnv(process.cwd());
 	const task = request.tasks[0];
 	if (task === void 0) return [];
+	const harnessVersion = yield* versions.version(task.harness);
 	return yield* Effect.forEach(request.cases, (subject) => trials.run({
 		caseName: subject.name,
 		forwarded,
 		harness: task.harness,
-		harnessVersion: "local",
+		harnessVersion,
 		model: task.model,
 		prepare: subject.prepare ?? null,
 		profile: profileOfRequest(task.profile),
 		prompt: request.prompt,
-		source: { kind: "empty" },
+		source: subject.source ?? { kind: "empty" },
 		user: subject.user ?? null,
 		validator: subject.validator ?? null,
 		verifyCommand: subject.verify
-	}).pipe(Effect.tap((outcome) => onTrial?.({
+	}).pipe(Effect.tap((outcome) => options.onTrial?.({
 		caseName: subject.name,
 		events: outcome.events,
 		ordinal: 0,
@@ -4540,7 +4545,7 @@ const runLocally = (request, onTrial) => Effect.gen(function* () {
 		name: subject.name,
 		status: outcome.outcome.status
 	}))), { concurrency: 1 });
-}).pipe(Effect.provide(EvalLocalLive), Effect.scoped, Effect.withConfigProvider(ConfigProvider.fromEnv().pipe(ConfigProvider.orElse(() => ConfigProvider.fromMap(/* @__PURE__ */ new Map([["ANPORD_LOCAL_SANDBOX", "true"]]))))));
+}).pipe(Effect.provide(options.credentials === void 0 ? EvalLocalLive : evalLocalWith(credentialResolverFrom(options.credentials))), Effect.scoped, Effect.withConfigProvider(ConfigProvider.fromEnv().pipe(ConfigProvider.orElse(() => ConfigProvider.fromMap(/* @__PURE__ */ new Map([["ANPORD_LOCAL_SANDBOX", "true"]]))))));
 const seconds = (ms) => `${(ms / 1e3).toFixed(1)}s`;
 const reportLocal = (file, cases) => Effect.forEach([`${file}: ${cases.length} case(s) on this machine`, ...cases.map((one) => `  ${one.status} ${one.name} ${seconds(one.durationMs)}`)], note);
 const localProblems = (cases) => cases.flatMap((one) => one.status === "passed" ? [] : [`${one.name} ${one.status}`]);
@@ -4819,13 +4824,19 @@ const recordedLocally = (file) => Effect.gen(function* () {
 		trigger
 	} });
 	yield* reportStarted(file, started.id);
-	const cases = yield* runLocally(payload, (trial) => api.evals.reportTrial({ payload: {
-		id: started.id,
-		trial
-	} }).pipe(Effect.ignore));
-	yield* api.evals.finishRun({ payload: { id: started.id } }).pipe(Effect.ignore);
-	return cases;
-}).pipe(Effect.provide(ClientLayer));
+	yield* Effect.addFinalizer(() => api.evals.finishRun({ payload: { id: started.id } }).pipe(Effect.ignore));
+	const leased = yield* api.evals.credentials({ payload: {
+		harness: payload.tasks[0]?.harness ?? "codex",
+		id: started.id
+	} }).pipe(Effect.map((lease) => lease.values), Effect.catchAll(() => Effect.succeed(void 0)));
+	return yield* runLocally(payload, {
+		credentials: leased,
+		onTrial: (trial) => api.evals.reportTrial({ payload: {
+			id: started.id,
+			trial
+		} }).pipe(Effect.ignore)
+	});
+}).pipe(Effect.scoped, Effect.provide(ClientLayer));
 const runOneEvalLocally = (file) => apiKeyConfig.pipe(Effect.matchEffect({
 	onFailure: () => compileEvalEffect(file).pipe(Effect.flatMap((payload) => runLocally(payload))),
 	onSuccess: () => recordedLocally(file)