dsh-eval-guard 0.7.2 → 0.7.4

package/lib/index.js

@@ -2,9 +2,9 @@ import { createRequire } from "node:module";
 import z from "@deepseek-ai/schemastery";
 import fs from "node:fs";
 import path from "node:path";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
-import { execFileSync, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 //#region src/config.ts
 /**
@@ -145,7 +145,16 @@ const PIP_MIRRORS = [
 * profile that lacks a plugin simply never mentions that plugin's tools.
 * @module dsh-eval-guard/policy
 */
-/** DSH-first default section. Only names that exist in the registry are surfaced. */
+/**
+* DSH-first default section. Only names that exist in the registry are surfaced
+* in prompts; the enforcement set keeps every name so a tool installed later
+* cannot slip through with an empty user document.
+*
+* The last block covers tools that can otherwise escape a one-shot evaluation:
+* goal rounds and schedules keep working after the wall-clock deadline, and the
+* drawio/canvas tools write host files directly (bypassing the fs sandbox) and
+* can cross workspace boundaries.
+*/
 const BASE_BLACKLIST = [
 	"web_search",
 	"web_fetch",
@@ -181,7 +190,20 @@ const BASE_BLACKLIST = [
 	"cordis_inspect_list",
 	"cordis_inspect_query",
 	"exit_plan_mode",
-	"ask_user_question"
+	"ask_user_question",
+	"create_goal",
+	"get_goal",
+	"update_goal",
+	"schedule_create",
+	"schedule_list",
+	"schedule_update",
+	"schedule_delete",
+	"drawio_edit",
+	"drawio_render",
+	"drawio_template",
+	"drawio_validate",
+	"canvas_state",
+	"view_canvas"
 ];
 /** Third-party tools that reach an external service, subagent, or agent channel. */
 const PLUGIN_BLACKLIST_PATTERNS = [
@@ -197,7 +219,12 @@ const PLUGIN_BLACKLIST_PATTERNS = [
 	/^computer_/,
 	/^ssh_/,
 	/^e2b_/,
-	/^mcp_/
+	/^mcp_/,
+	/^drawio_/,
+	/^schedule_/,
+	/^(?:create|get|update)_goal$/,
+	/^canvas_/,
+	/^view_canvas$/
 ];
 /** Parse one blacklist document into ordered tool names (comments removed). */
 function parseBlacklist(text) {
@@ -229,11 +256,13 @@ function generateDefaultBlacklist(installed) {
 	lines.push(...plugin);
 	return lines.join("\n");
 }
-/** Whether a name belongs to the always-present DSH base section. */
-function isBaseBlacklistName(name) {
-	return BASE_BLACKLIST.includes(name);
-}
-/** Parse the forbidden-paths document. Invalid lines are ignored. */
+/**
+* Parse the forbidden-paths document. Invalid lines are ignored.
+*
+* A line containing a glob character is treated as the prefix before the first
+* wildcard, so a line like /home/<anything>/secret means "everything under
+* /home"; this is deliberately conservative (never narrower than written).
+*/
 function parsePathRules(text) {
 	const rules = [];
 	for (const raw of text.split(/\r?\n/)) {
@@ -245,8 +274,10 @@ function parsePathRules(text) {
 			line = line.slice(1).trim();
 		}
 		if (!line.startsWith("/")) continue;
+		const wildcard = line.search(/[*?]/);
+		if (wildcard >= 0) line = line.slice(0, wildcard);
 		if (line.length > 1 && line.endsWith("/")) line = line.slice(0, -1);
-		if (line.includes("*") || line.includes("?")) continue;
+		if (line === "") line = "/";
 		rules.push({
 			allow,
 			path: path.normalize(line)
@@ -309,12 +340,30 @@ function applyRules(real, rules, base) {
 }
 /** Decide one absolute path for read or write access. */
 function checkPath(real, workspace, write, rules) {
-	if (under$1(real, workspace)) return true;
-	if (isNoTraceDevice(real) && !write) return true;
-	if (write) return isNoTraceDevice(real);
-	return applyRules(real, rules, baseReadAllowed(real, workspace));
+	const inWorkspace = under$1(real, workspace);
+	if (!write) {
+		if (inWorkspace) return true;
+		if (isNoTraceDevice(real)) return true;
+		return applyRules(real, rules, baseReadAllowed(real, workspace));
+	}
+	const base = inWorkspace || isNoTraceDevice(real);
+	if (!base) return false;
+	return applyRules(real, rules, base) && base;
 }
-/** Path-bearing argument keys audited for DSH-built-in and dsh-ops tools. */
+/** Keys whose value is task content, not another path to audit. */
+const CONTENT_KEYS = /* @__PURE__ */ new Set([
+	"content",
+	"old_string",
+	"new_string",
+	"text",
+	"code",
+	"prompt",
+	"description",
+	"justification",
+	"new_source",
+	"file_text"
+]);
+/** Path-bearing argument keys audited for DSH-built-in and installed tools. */
 const PATH_KEYS = /* @__PURE__ */ new Set([
 	"path",
 	"file",
@@ -330,7 +379,16 @@ const PATH_KEYS = /* @__PURE__ */ new Set([
 	"target",
 	"input",
 	"output",
-	"script_path"
+	"script_path",
+	"source_path",
+	"source_paths",
+	"file_paths",
+	"paths",
+	"input_path",
+	"output_path",
+	"image",
+	"images",
+	"out"
 ]);
 /** Tools whose path arguments are read-only accesses. */
 const READ_TOOLS = /* @__PURE__ */ new Set([
@@ -342,14 +400,18 @@ const READ_TOOLS = /* @__PURE__ */ new Set([
 	"load_workspace_dependencies",
 	"ops_inspect_local_file",
 	"ops_grep",
-	"ops_glob"
+	"ops_glob",
+	"drawio_validate"
 ]);
 /** Tools whose path arguments are mutations. */
 const WRITE_TOOLS = /* @__PURE__ */ new Set([
 	"write",
 	"edit",
 	"str_replace_editor",
-	"ops_replace"
+	"ops_replace",
+	"drawio_edit",
+	"drawio_render",
+	"drawio_template"
 ]);
 /** Tools we deliberately do not inspect: the process sandbox owns their effects. */
 const PROCESS_TOOLS = /* @__PURE__ */ new Set([
@@ -365,18 +427,24 @@ const PROCESS_TOOLS = /* @__PURE__ */ new Set([
 	"ops_job_list",
 	"ops_job_kill"
 ]);
+/** Whether one tool name takes file paths this module knows how to audit. */
+function isAuditedTool(name) {
+	return READ_TOOLS.has(name) || WRITE_TOOLS.has(name);
+}
 /** Collect every path-looking string under a known path key. */
 function collectPathArgs(value, out = []) {
 	if (Array.isArray(value)) {
 		for (const item of value) collectPathArgs(item, out);
 		return out;
 	}
-	if (value !== null && typeof value === "object") for (const [key, child] of Object.entries(value)) if (PATH_KEYS.has(key)) {
-		if (typeof child === "string") out.push(child);
-		else if (Array.isArray(child)) for (const item of child) if (typeof item === "string") out.push(item);
-		else collectPathArgs(item, out);
-		else collectPathArgs(child, out);
-	} else collectPathArgs(child, out);
+	if (value !== null && typeof value === "object") {
+		for (const [key, child] of Object.entries(value)) if (PATH_KEYS.has(key)) {
+			if (typeof child === "string") out.push(child);
+			else if (Array.isArray(child)) for (const item of child) if (typeof item === "string") out.push(item);
+			else collectPathArgs(item, out);
+			else collectPathArgs(child, out);
+		} else if (!CONTENT_KEYS.has(key)) collectPathArgs(child, out);
+	}
 	return out;
 }
 /** Audit the path arguments of one DSH/ops tool call. Non-targeted tools pass. */
@@ -386,12 +454,12 @@ function auditToolCall(name, args, workspace, rules) {
 		tool: name,
 		write: false
 	};
-	if (!READ_TOOLS.has(name) && !WRITE_TOOLS.has(name)) return {
+	if (!isAuditedTool(name)) return {
 		allow: true,
 		tool: name,
 		write: false
 	};
-	const write = WRITE_TOOLS.has(name);
+	const write = name === "str_replace_editor" && (args !== null && typeof args === "object" && !Array.isArray(args) ? args : void 0)?.["command"] === "view" ? false : WRITE_TOOLS.has(name);
 	const paths = collectPathArgs(args);
 	for (const target of paths) {
 		const real = resolveCheckPath(target, workspace);
@@ -400,7 +468,7 @@ function auditToolCall(name, args, workspace, rules) {
 			tool: name,
 			path: real,
 			write,
-			reason: write ? "只允许修改当前工作区；该写入已被阻止。" : "只允许读取当前工作区与系统路径；该读取已被阻止。"
+			reason: write ? "只允许修改当前工作区；该写入已被阻止。" : "只允许读取当前工作区与系统只读文件；该读取已被阻止。"
 		};
 	}
 	return {
@@ -427,6 +495,35 @@ function packageRoot() {
 function supervisorPath() {
 	return path.join(packageRoot(), "native", "dsh-eval-supervisor");
 }
+/**
+* Probe the two host capabilities the guard depends on: a usable bwrap binary
+* and unprivileged user namespaces. Returns a human-readable failure, or
+* undefined when confinement is expected to work.
+*/
+function probeConfinement() {
+	const version = spawnSync("bwrap", ["--version"], {
+		timeout: 2e3,
+		encoding: "utf8"
+	});
+	if (version.error !== void 0 || version.status !== 0) return "bubblewrap (bwrap) is unavailable; refusing to enable without process confinement";
+	const probe = spawnSync("bwrap", [
+		"--unshare-all",
+		"--die-with-parent",
+		"--ro-bind",
+		"/",
+		"/",
+		"--dev",
+		"/dev",
+		"--proc",
+		"/proc",
+		"--",
+		"/bin/true"
+	], {
+		timeout: 5e3,
+		encoding: "utf8"
+	});
+	if (probe.error !== void 0 || probe.status !== 0) return "bubblewrap cannot create an unprivileged user namespace on this host; refusing to enable without process confinement";
+}
 /** Launcher-provided facts; nothing here is a fixed install path. */
 let runtimeHome;
 let runtimeProfileDir;
@@ -481,6 +578,24 @@ const SYSTEM_READ_FILES = [
 	"/run/utmpx",
 	"/var/log/wtmp"
 ];
+/** Host environment variables that are safe to expose to a confined command. */
+const SAFE_ENV_KEYS = [
+	"USER",
+	"LOGNAME",
+	"SHELL",
+	"TZ",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"REQUESTS_CA_BUNDLE",
+	"CURL_CA_BUNDLE",
+	"NODE_EXTRA_CA_CERTS",
+	"GIT_SSL_CAINFO"
+];
+/** Whether `root` is `target` or an ancestor of it. */
+function containsPath(root, target) {
+	const relative = path.relative(root, target);
+	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+}
 /** Python stdlib/venv directories that may live next to a workspace. */
 function pythonRuntimeDirs(workspace) {
 	const dirs = /* @__PURE__ */ new Set();
@@ -508,14 +623,39 @@ function ancestorsOf(target) {
 	return out;
 }
 /** Resolve one package directory from the host launch world. */
+/** Likely roots for the running DSH installation (app, checkout, or profile). */
+function runtimeRoots() {
+	const roots = /* @__PURE__ */ new Set();
+	const starts = [fileURLToPath(new URL("..", import.meta.url)), process.cwd()];
+	if (process.argv[1] !== void 0) starts.push(path.dirname(process.argv[1]));
+	if (process.env.DSH_CHECKOUT !== void 0 && process.env.DSH_CHECKOUT !== "") starts.push(process.env.DSH_CHECKOUT);
+	for (const start of starts) {
+		let current = path.resolve(start);
+		for (let depth = 0; depth < 8; depth += 1) {
+			roots.add(current);
+			const parent = path.dirname(current);
+			if (parent === current) break;
+			current = parent;
+		}
+	}
+	return [...roots];
+}
+/** Checkout-relative guesses for DSH source layouts. */
+const CHECKOUT_PATHS = {
+	"@deepseek-ai/dsh-ptc-runtime-node": ["packages/ptc-runtime/ptc-runtime-node"],
+	"@deepseek-ai/dsh-subprocess": ["packages/subprocess/subprocess"]
+};
 function packageDir(name) {
 	const candidates = [];
-	try {
-		const require = createRequire(path.join(process.cwd(), "noop.js"));
-		candidates.push(path.dirname(require.resolve(name + "/package.json")));
-	} catch {}
-	if (name === "@deepseek-ai/dsh-ptc-runtime-node") candidates.push(path.join(process.cwd(), "packages", "ptc-runtime", "ptc-runtime-node"));
-	if (name === "@deepseek-ai/dsh-subprocess") candidates.push(path.join(process.cwd(), "packages", "subprocess", "subprocess"));
+	const roots = runtimeRoots();
+	for (const root of roots) {
+		try {
+			const require = createRequire(path.join(root, "noop.js"));
+			candidates.push(path.dirname(require.resolve(name + "/package.json")));
+		} catch {}
+		candidates.push(path.join(root, "node_modules", name));
+		for (const relative of CHECKOUT_PATHS[name] ?? []) candidates.push(path.join(root, relative));
+	}
 	for (const modules of profileNodeModules()) candidates.push(path.join(modules, name));
 	for (const candidate of candidates) try {
 		if (fs.statSync(path.join(candidate, "package.json")).isFile()) return fs.realpathSync.native(candidate);
@@ -650,6 +790,7 @@ function writePolicy(workspace, rules) {
 	}
 	for (const rule of rules) lines.push(line("rule", (rule.allow ? "allow " : "deny ") + rule.path));
 	if (!(workspace === "/tmp" || workspace.startsWith("/tmp/"))) lines.push(line("tmpbind", path.join(workspace, ".tmp")));
+	else lines.push(line("tmpfs", "/tmp"));
 	fs.writeFileSync(file, lines.join("\n") + "\n", {
 		encoding: "utf8",
 		mode: 384
@@ -657,7 +798,7 @@ function writePolicy(workspace, rules) {
 	return file;
 }
 /** Build the bwrap profile arguments for one workspace. */
-function bwrapArgs(workspace, cwd, rules, runtime) {
+function bwrapArgs(workspace, rules, runtime) {
 	const args = [
 		"--unshare-all",
 		"--die-with-parent",
@@ -681,7 +822,6 @@ function bwrapArgs(workspace, cwd, rules, runtime) {
 		args.push("--dir", "/var/log");
 	}
 	for (const file of systemFiles) args.push("--ro-bind", file, file);
-	args.push("--bind", workspace, workspace);
 	const tmp = path.join(workspace, ".tmp");
 	ensureDir(tmp);
 	const underHostTmp = workspace === "/tmp" || workspace.startsWith("/tmp/");
@@ -689,7 +829,9 @@ function bwrapArgs(workspace, cwd, rules, runtime) {
 	if (underHostTmp) {
 		args.push("--tmpfs", "/tmp");
 		tmpdirForChild = tmp;
-	} else args.push("--bind", tmp, "/tmp");
+	}
+	args.push("--bind", workspace, workspace);
+	if (!underHostTmp) args.push("--bind", tmp, "/tmp");
 	const supervisorFile = supervisorPath();
 	if (fs.existsSync(supervisorFile)) args.push("--ro-bind", supervisorFile, supervisorFile);
 	args.push("--ro-bind", runtime.node, runtime.node);
@@ -712,7 +854,12 @@ function bwrapArgs(workspace, cwd, rules, runtime) {
 		if (!rule.allow) continue;
 		try {
 			const real = fs.realpathSync.native(rule.path);
-			if (real !== workspace && !real.startsWith(workspace + "/")) args.push("--ro-bind", real, real);
+			if (containsPath(real, workspace) || containsPath(workspace, real)) continue;
+			if (containsPath(real, guardRoot()) || containsPath(guardRoot(), real)) continue;
+			if (containsPath(real, dshHome()) || containsPath(dshHome(), real)) continue;
+			if (real === "/tmp" || real.startsWith("/tmp/")) continue;
+			if (SYSTEM_READ_DIRS.some((system) => real === system || real.startsWith(system + "/"))) continue;
+			args.push("--ro-bind", real, real);
 		} catch {}
 	}
 	const home = path.join(workspace, ".home");
@@ -725,21 +872,11 @@ function bwrapArgs(workspace, cwd, rules, runtime) {
 		config,
 		data
 	]) ensureDir(dir);
-	for (const name of [
-		"LD_LIBRARY_PATH",
-		"PYTHONPATH",
-		"MVCAM_SDK_PATH",
-		"AMENT_PREFIX_PATH",
-		"COLCON_PREFIX_PATH",
-		"CMAKE_PREFIX_PATH",
-		"ROS_DISTRO",
-		"ROS_VERSION",
-		"ROS_PYTHON_VERSION",
-		"NODE_OPTIONS",
-		"NODE_PATH",
-		"PYTHONSTARTUP",
-		"PYTHONHOME"
-	]) args.push("--unsetenv", name);
+	args.push("--clearenv");
+	for (const name of SAFE_ENV_KEYS) {
+		const value = process.env[name];
+		if (value !== void 0 && value !== "") args.push("--setenv", name, value);
+	}
 	args.push("--setenv", "PATH", "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin");
 	args.push("--setenv", "HOME", home);
 	args.push("--setenv", "TMPDIR", tmpdirForChild);
@@ -750,13 +887,16 @@ function bwrapArgs(workspace, cwd, rules, runtime) {
 	args.push("--setenv", "LC_ALL", "C.UTF-8");
 	args.push("--setenv", "TERM", "dumb");
 	args.push("--setenv", "UV_USE_IO_URING", "0");
+	args.push("--setenv", "PIP_DISABLE_PIP_VERSION_CHECK", "1");
+	args.push("--setenv", "PIP_NO_INPUT", "1");
 	return args;
 }
 /**
 * Wrap one argv in the strict sandbox.
 * @param argv - the exact command the consumer was about to spawn.
 * @param workspace - session cwd.
-* @param cwd - working directory the consumer will use (same as workspace in practice).
+* @param cwd - explicit working directory override; the empty string lets the
+*   supervisor use its inherited cwd when that cwd lies inside the workspace.
 * @param rules - ordered forbidden-path rules.
 * @param auditFile - host-side audit path the supervisor appends to.
 */
@@ -771,6 +911,7 @@ function wrapSandbox(argv, workspace, cwd, rules, auditFile) {
 	ensureDir(path.join(workspace, ".config"));
 	ensureDir(path.join(workspace, ".local", "share"));
 	const policyFile = writePolicy(workspace, rules);
+	const args = bwrapArgs(workspace, rules, runtimeFiles());
 	return {
 		argv: [
 			supervisor,
@@ -778,9 +919,10 @@ function wrapSandbox(argv, workspace, cwd, rules, auditFile) {
 			policyFile,
 			"--audit",
 			auditFile,
+			...cwd === "" ? [] : ["--cwd", cwd],
 			"--",
 			"bwrap",
-			...bwrapArgs(workspace, cwd, rules, runtimeFiles()),
+			...args,
 			"--",
 			...argv
 		],
@@ -795,6 +937,39 @@ function wrapSandbox(argv, workspace, cwd, rules, auditFile) {
 * tool policy, wall-clock limit, run records, and audit events.
 * @module dsh-eval-guard/guard
 */
+/** The cwd a session is confined to, or undefined when the header has none. */
+function sessionCwd(session) {
+	const cwd = session?.header?.cwd;
+	return typeof cwd === "string" && cwd !== "" ? cwd : void 0;
+}
+/**
+* Whether a session is a subagent child.
+*
+* DSH uses `origin: 'subagent'` and/or `delegationDepth > 0` for subagents.
+* `parentSession` alone is NOT a subagent marker: a user-visible fork of a
+* normal conversation also sets `parentSession` (seed lineage), and treating
+* that as a subagent would leave the whole fork unguarded.
+*/
+function sessionIsSubagent(session) {
+	const header = session?.header;
+	if (header === void 0) return false;
+	if (header.origin === "subagent") return true;
+	return typeof header.delegationDepth === "number" && header.delegationDepth > 0;
+}
+/** The session this one was forked/delegated from, if any. */
+function sessionParent(session) {
+	const parent = session?.header?.parentSession;
+	return typeof parent === "string" && parent !== "" ? parent : void 0;
+}
+/** Display title for the enable warning; DSH's header has none, so fall back. */
+function sessionTitle(session) {
+	const title = session?.header?.title;
+	if (typeof title === "string" && title !== "") return title;
+	const cwd = sessionCwd(session);
+	return cwd === void 0 ? void 0 : path.basename(cwd);
+}
+/** How long an idle session keeps its deadline alive before it is settled. */
+const IDLE_GRACE_MS = 5e3;
 /** Event ring + run audit writer. */
 var Guard = class {
 	ctx;
@@ -811,6 +986,7 @@ var Guard = class {
 	approvalPrev = /* @__PURE__ */ new Map();
 	deadlines = /* @__PURE__ */ new Map();
 	startedAt = /* @__PURE__ */ new Map();
+	lastActivity = /* @__PURE__ */ new Map();
 	runs = /* @__PURE__ */ new Map();
 	sessionRuns = /* @__PURE__ */ new Map();
 	offsets = /* @__PURE__ */ new Map();
@@ -818,6 +994,8 @@ var Guard = class {
 	toolCache = [];
 	disposers = [];
 	task;
+	lastError;
+	enableRetryAt = 0;
 	/** Optional hook invoked when any run binds to an agent. */
 	onRunAssociated;
 	/** Optional automatic task binding for every main conversation. */
@@ -892,13 +1070,21 @@ var Guard = class {
 		if (!this.rawConfig) return;
 		const next = this.configuration;
 		const wasEnabled = this.enabled;
-		if (!wasEnabled && next.enabled) this.enable();
-		else if (wasEnabled && !next.enabled) this.disable();
+		if (!wasEnabled && next.enabled) {
+			if (Date.now() < this.enableRetryAt) return;
+			this.enable().catch((error) => {
+				this.failEnable(error instanceof Error ? error.message : String(error));
+			});
+		} else if (wasEnabled && !next.enabled) this.disable();
 	}
 	/** Whether the guard is active. */
 	get active() {
 		return this.enabled;
 	}
+	/** Why the guard refused to enable, if it did. */
+	get lastFailure() {
+		return this.lastError;
+	}
 	/** Installed tool names currently visible in this deployment. */
 	refreshTools() {
 		try {
@@ -928,31 +1114,31 @@ var Guard = class {
 	pathRules() {
 		return parsePathRules(this.configuration.forbiddenPaths);
 	}
-	/** Live conversations for the enable warning. */
+	/** Jobs owned by one session (unowned/global jobs must never be attributed). */
+	ownJobs(sessionId) {
+		return (this.services.jobs?.list(sessionId) ?? []).filter((job) => job.owner === sessionId).filter((job) => job.status === "running" || job.status === "stopping");
+	}
+	/** Live main conversations for the enable warning. */
 	runningSessions() {
 		const out = [];
 		for (const agent of this.services.agents.list()) {
-			const jobs = this.services.jobs?.list(agent.id) ?? [];
+			if (!this.isMain(agent.session)) continue;
+			const jobs = this.ownJobs(agent.id);
 			const running = agent.status === "running";
-			const jobCount = jobs.filter((job) => job.status === "running" || job.status === "stopping").length;
-			if (!running && jobCount === 0) continue;
+			if (!running && jobs.length === 0) continue;
 			out.push({
 				sessionId: agent.id,
-				title: agent.session.header?.meta?.title ?? agent.id,
-				cwd: agent.session.header?.meta?.cwd ?? "",
+				title: sessionTitle(agent.session) ?? agent.id,
+				cwd: sessionCwd(agent.session) ?? "",
 				running,
-				jobs: jobCount
+				jobs: jobs.length
 			});
 		}
 		return out;
 	}
-	/** Whether a session is a user main conversation (not a subagent or plugin child). */
+	/** Whether a session is a user conversation (not a subagent/plugin child). */
 	isMain(session) {
-		if (session === void 0) return false;
-		const meta = session.header?.meta;
-		if (meta?.origin === "subagent") return false;
-		if (meta?.parentSession !== void 0 || meta?.delegationDepth !== void 0) return false;
-		return true;
+		return session !== void 0 && !sessionIsSubagent(session);
 	}
 	/** Approvals are auto-rejected while the guard is active. */
 	forceApproval(session) {
@@ -960,8 +1146,10 @@ var Guard = class {
 		if (approval === void 0) return;
 		const agent = this.services.agents.get(session.id);
 		if (agent === void 0) return;
-		if (!this.approvalPrev.has(session.id)) this.approvalPrev.set(session.id, approval.effectivePolicy(session));
-		approval.setPolicy(agent, "never");
+		try {
+			if (!this.approvalPrev.has(session.id)) this.approvalPrev.set(session.id, approval.effectivePolicy(session));
+			approval.setPolicy(agent, "never");
+		} catch {}
 	}
 	/** Restore the policy that existed before the guard touched this session. */
 	restoreApproval(sessionId) {
@@ -972,19 +1160,36 @@ var Guard = class {
 		const approval = this.services.approval;
 		if (agent !== void 0 && approval !== void 0) approval.setPolicy(agent, previous);
 	}
+	/** Record an enable-time refusal and back off before retrying. */
+	failEnable(error) {
+		this.lastError = error;
+		this.enableRetryAt = Date.now() + 5e3;
+		this.record({
+			kind: "notice",
+			detail: "评测守护启用失败：" + error
+		});
+		try {
+			this.ctx.logger.warn("eval-guard: %s", error);
+		} catch {}
+		return {
+			ok: false,
+			error
+		};
+	}
 	/** Turn the guard on. */
 	async enable() {
 		if (this.enabled) return { ok: true };
 		const sandbox = this.services.sandbox;
 		const policy = this.services.sandboxPolicy;
-		if (sandbox === void 0 || policy === void 0) return {
-			ok: false,
-			error: "sandbox service is unavailable; refusing to enable without process confinement"
-		};
-		if (!fs.existsSync(supervisorPath())) return {
-			ok: false,
-			error: "native supervisor is not built; run npm run build:native"
-		};
+		if (sandbox === void 0 || policy === void 0) return this.failEnable("sandbox service is unavailable; refusing to enable without process confinement");
+		if (!fs.existsSync(supervisorPath())) return this.failEnable("native supervisor is not built; run npm run build:native");
+		try {
+			fs.accessSync(supervisorPath(), fs.constants.X_OK);
+		} catch {
+			return this.failEnable("native supervisor is not executable; run npm run build:native");
+		}
+		const probe = probeConfinement();
+		if (probe !== void 0) return this.failEnable(probe);
 		this.sandboxObject = sandbox;
 		this.policyObject = policy;
 		this.origConfine = sandbox.confine.bind(sandbox);
@@ -994,12 +1199,12 @@ var Guard = class {
 			if (!guard.enabled) return guard.origConfine(argv, executionPolicy, signal);
 			const sessionId = typeof executionPolicy["sessionId"] === "string" ? executionPolicy["sessionId"] : void 0;
 			const session = sessionId === void 0 ? void 0 : guard.services.sessions.get(sessionId);
-			if (session === void 0 || !guard.isMain(session)) return guard.origConfine(argv, executionPolicy, signal);
-			const workspace = typeof executionPolicy["workspaceRoot"] === "string" ? executionPolicy["workspaceRoot"] : session.header?.meta?.cwd;
-			if (workspace === void 0 || workspace === "") throw new Error("dsh-eval-guard: session has no workspace");
+			if (session === void 0) return guard.origConfine(argv, executionPolicy, signal);
+			const workspace = sessionCwd(session);
+			if (workspace === void 0) throw new Error("dsh-eval-guard: session has no workspace");
 			const audit = guard.auditFileFor(session.id);
 			return {
-				argv: wrapSandbox(argv, workspace, workspace, guard.pathRules(), audit).argv,
+				argv: wrapSandbox(argv, workspace, "", guard.pathRules(), audit).argv,
 				enforcement: "full",
 				denialSignatures: [
 					"operation not permitted",
@@ -1012,29 +1217,60 @@ var Guard = class {
 		policy.resolve = function resolveHook(request = {}) {
 			const resolved = guard.origResolve(request);
 			if (!guard.enabled) return resolved;
-			const session = request["session"];
-			if (session === void 0 || !guard.isMain(session)) return resolved;
+			if (request["session"] === void 0) return resolved;
 			return {
 				...resolved,
 				mode: "workspace-write"
 			};
 		};
-		this.enabled = true;
-		for (const agent of this.services.agents.list()) if (this.isMain(agent.session)) this.forceApproval(agent.session);
-		this.record({
-			kind: "notice",
-			detail: "评测守护已启用。"
-		});
-		return { ok: true };
+		try {
+			for (const agent of this.services.agents.list()) if (this.isMain(agent.session)) this.forceApproval(agent.session);
+			try {
+				const runtime = runtimeFiles();
+				if (runtime.ptcProcess === void 0 || runtime.ptcControl === void 0) this.record({
+					kind: "notice",
+					detail: "未找到 run_code 运行时（PTC）文件；沙箱内 run_code 可能不可用。"
+				});
+			} catch {
+				this.record({
+					kind: "notice",
+					detail: "无法读取 run_code 运行时（PTC）文件；沙箱内 run_code 可能不可用。"
+				});
+			}
+			this.enabled = true;
+			this.lastError = void 0;
+			this.enableRetryAt = 0;
+			this.record({
+				kind: "notice",
+				detail: "评测守护已启用。"
+			});
+			return { ok: true };
+		} catch (error) {
+			this.enabled = false;
+			this.restoreHooks();
+			return this.failEnable(error instanceof Error ? error.message : String(error));
+		}
+	}
+	/** Restore the original sandbox/policy methods (idempotent). */
+	restoreHooks() {
+		if (this.sandboxObject !== void 0 && this.origConfine !== void 0) this.sandboxObject.confine = this.origConfine;
+		if (this.policyObject !== void 0 && this.origResolve !== void 0) this.policyObject.resolve = this.origResolve;
+		this.sandboxObject = void 0;
+		this.policyObject = void 0;
+		this.origConfine = void 0;
+		this.origResolve = void 0;
 	}
 	/** Turn the guard off without touching already-running confined processes. */
 	disable() {
+		this.enableRetryAt = 0;
 		if (!this.enabled) return;
 		this.enabled = false;
-		if (this.sandboxObject !== void 0 && this.origConfine !== void 0) this.sandboxObject.confine = this.origConfine;
-		if (this.policyObject !== void 0 && this.origResolve !== void 0) this.policyObject.resolve = this.origResolve;
-		for (const sessionId of [...this.approvalPrev.keys()]) this.restoreApproval(sessionId);
+		this.restoreHooks();
+		for (const sessionId of [...this.approvalPrev.keys()]) try {
+			this.restoreApproval(sessionId);
+		} catch {}
 		this.deadlines.clear();
+		this.lastActivity.clear();
 		this.record({
 			kind: "notice",
 			detail: "评测守护已停用。"
@@ -1045,24 +1281,31 @@ var Guard = class {
 		const config = this.configuration;
 		if (!config.timeLimitEnabled) return;
 		this.deadlines.set(sessionId, Date.now() + config.timeLimitMinutes * 6e4);
+		this.lastActivity.set(sessionId, Date.now());
 	}
 	/** A new main agent appeared. */
 	onAgentCreated(agent) {
 		if (!this.isMain(agent.session)) return;
 		this.knownAgents.add(agent.id);
 		if (this.enabled) this.forceApproval(agent.session);
-		const cwd = agent.session.header?.meta?.cwd;
-		if (cwd !== void 0) {
-			if (this.enabled) try {
+		const cwd = sessionCwd(agent.session);
+		if (cwd !== void 0 && this.enabled) {
+			const existingRunId = this.sessionRuns.get(agent.id);
+			const existing = existingRunId === void 0 ? void 0 : this.runs.get(existingRunId);
+			if (existing !== void 0 && (existing.status === "active" || existing.status === "prepared")) return;
+			try {
 				this.onAutoRun?.(agent, cwd);
 			} catch {}
 		}
 	}
 	/** An agent went away. */
 	onAgentDisposed(agent) {
-		this.restoreApproval(agent.id);
+		try {
+			this.restoreApproval(agent.id);
+		} catch {}
 		this.deadlines.delete(agent.id);
 		this.startedAt.delete(agent.id);
+		this.lastActivity.delete(agent.id);
 		const runId = this.sessionRuns.get(agent.id);
 		if (runId !== void 0) {
 			const run = this.runs.get(runId);
@@ -1087,7 +1330,7 @@ var Guard = class {
 		run.status = "active";
 		run.provider = agent.options?.provider;
 		run.model = agent.options?.model;
-		run.title = agent.session.header?.meta?.title;
+		run.title = sessionTitle(agent.session);
 		this.sessionRuns.set(agent.id, runId);
 		this.writeRun(run);
 		this.writeUsage(runId, this.zeroUsage(run.startedAt));
@@ -1098,8 +1341,10 @@ var Guard = class {
 	/** Session event intake. */
 	onSessionEvent(session, event) {
 		if (!this.enabled || session === void 0 || !this.isMain(session)) return;
+		this.lastActivity.set(session.id, Date.now());
 		const runId = this.sessionRuns.get(session.id);
 		const run = runId === void 0 ? void 0 : this.runs.get(runId);
+		const activeRun = run !== void 0 && run.status === "active";
 		if (event.type === "user/message") {
 			if ((event.data?.source)?.kind === "user") {
 				this.startedAt.set(session.id, Date.now());
@@ -1108,44 +1353,51 @@ var Guard = class {
 			}
 		} else if (event.type === "assistant/message") {
 			const usage = event.data?.usage;
-			if (usage !== void 0 && runId !== void 0) this.addUsage(runId, usage);
+			if (usage !== void 0 && runId !== void 0 && activeRun) this.addUsage(runId, usage);
 		} else if (event.type === "tool/call") {
-			if (runId !== void 0) this.addToolCall(runId);
+			if (runId !== void 0 && activeRun) this.addToolCall(runId);
 		} else if (event.type === "turn/end") {
-			if (runId !== void 0) this.addTurn(runId);
+			if (runId !== void 0 && activeRun) this.addTurn(runId);
 			this.maybeComplete(session.id);
 		} else if (event.type === "turn/start") {
 			if (run !== void 0 && run.startedAt === null) run.startedAt = Date.now();
 		}
 	}
-	/** Clear a turn deadline once no work remains for that session. */
+	/** Clear a turn deadline once no work remains for that session (with grace). */
 	maybeComplete(sessionId) {
-		const agent = this.services.agents.get(sessionId);
-		const jobs = (this.services.jobs?.list(sessionId) ?? []).filter((job) => job.status === "running" || job.status === "stopping");
-		if (agent?.status === "running" || jobs.length > 0) return;
+		if (this.services.agents.get(sessionId)?.status === "running" || this.ownJobs(sessionId).length > 0) return;
+		const last = this.lastActivity.get(sessionId) ?? 0;
+		if (Date.now() - last < IDLE_GRACE_MS) return;
 		this.deadlines.delete(sessionId);
 	}
 	/** One-second clock: expire deadlines and tail supervisor audits. */
 	tick() {
-		this.syncConfig();
-		if (!this.enabled) return;
-		const now = Date.now();
-		for (const [sessionId, deadline] of [...this.deadlines]) {
-			if (deadline > now) {
-				const agent = this.services.agents.get(sessionId);
-				const ownJobs = (this.services.jobs?.list(sessionId) ?? []).some((job) => job.status === "running" || job.status === "stopping");
-				const descendantRunning = this.descendants(sessionId).some((id) => {
-					if (this.services.agents.get(id)?.status === "running") return true;
-					return (this.services.jobs?.list(id) ?? []).some((job) => job.status === "running" || job.status === "stopping");
-				});
-				if (agent?.status !== "running" && !ownJobs && !descendantRunning) this.deadlines.delete(sessionId);
-				continue;
+		try {
+			this.syncConfig();
+			if (!this.enabled) return;
+			const now = Date.now();
+			for (const [sessionId, deadline] of [...this.deadlines]) {
+				if (deadline > now) {
+					const agent = this.services.agents.get(sessionId);
+					const ownJobs = this.ownJobs(sessionId).length > 0;
+					const last = this.lastActivity.get(sessionId) ?? 0;
+					const descendantRunning = this.descendants(sessionId).some((id) => {
+						if (this.services.agents.get(id)?.status === "running") return true;
+						return this.ownJobs(id).length > 0;
+					});
+					if (agent?.status !== "running" && !ownJobs && !descendantRunning && now - last >= IDLE_GRACE_MS) this.deadlines.delete(sessionId);
+					continue;
+				}
+				this.deadlines.delete(sessionId);
+				this.expire(sessionId);
 			}
-			this.deadlines.delete(sessionId);
-			this.expire(sessionId);
+			this.tailAudits();
+			this.cleanupTemp();
+		} catch (error) {
+			try {
+				this.ctx.logger.warn("eval-guard: tick failed: %s", error instanceof Error ? error.message : String(error));
+			} catch {}
 		}
-		this.tailAudits();
-		this.cleanupTemp();
 	}
 	/** Kill one session's turn, descendants, and jobs. */
 	expire(sessionId) {
@@ -1159,9 +1411,11 @@ var Guard = class {
 					reason
 				});
 			} catch {}
-			for (const job of this.services.jobs?.list(id) ?? []) if (job.status === "running" || job.status === "stopping") try {
+			for (const job of this.ownJobs(id)) try {
 				this.services.jobs?.kill(job.id, id, "评测时间上限");
 			} catch {}
+			this.deadlines.delete(id);
+			this.lastActivity.delete(id);
 		}
 		const runId = this.sessionRuns.get(sessionId);
 		if (runId !== void 0) {
@@ -1176,8 +1430,10 @@ var Guard = class {
 					sessionId,
 					detail: reason
 				});
+				return;
 			}
-		} else this.record({
+		}
+		this.record({
 			kind: "timeout",
 			sessionId,
 			detail: reason
@@ -1185,10 +1441,10 @@ var Guard = class {
 	}
 	/** Direct and transitive subagent sessions of one main session. */
 	descendants(sessionId) {
-		const all = this.services.agents.list();
 		const children = /* @__PURE__ */ new Map();
-		for (const agent of all) {
-			const parent = agent.session.header?.meta?.parentSession;
+		for (const agent of this.services.agents.list()) {
+			if (!sessionIsSubagent(agent.session)) continue;
+			const parent = sessionParent(agent.session);
 			if (parent === void 0) continue;
 			const list = children.get(parent) ?? [];
 			list.push(agent.id);
@@ -1208,7 +1464,7 @@ var Guard = class {
 	checkTool(exec) {
 		if (!this.enabled) return void 0;
 		const agent = exec.agent;
-		if (agent === void 0 || !this.isMain(agent.session)) return void 0;
+		if (agent === void 0) return void 0;
 		const name = String(exec.name);
 		if (WAIT_TOOLS.includes(name)) {
 			this.record({
@@ -1228,8 +1484,17 @@ var Guard = class {
 			});
 			return "该工具在本次评测的黑名单中，调用已被阻止。";
 		}
-		const workspace = agent.session.header?.meta?.cwd;
-		if (workspace === void 0 || workspace === "") return void 0;
+		const workspace = sessionCwd(agent.session);
+		if (workspace === void 0) {
+			if (!isAuditedTool(name)) return void 0;
+			this.record({
+				kind: "path-denied",
+				sessionId: agent.id,
+				tool: name,
+				detail: "会话没有工作区，无法审计路径。"
+			});
+			return "评测守护：无法确定会话工作区，文件类工具已被阻止。";
+		}
 		const decision = auditToolCall(name, exec.arguments, workspace, this.pathRules());
 		if (!decision.allow) {
 			this.record({
@@ -1420,13 +1685,7 @@ var Guard = class {
 	}
 	/** Build the prompt for one task with only installed tools listed. */
 	promptFor(workspacePath, source, task = this.task) {
-		const present = new Set(this.toolCache);
-		const blacklist = parseBlacklist(this.blacklistText()).filter((name) => isBaseBlacklistName(name) || present.has(name));
-		return task.prompt(blacklist, {
-			source,
-			workspacePath,
-			minutes: this.configuration.timeLimitMinutes
-		});
+		return task.prompt({ minutes: this.configuration.timeLimitMinutes });
 	}
 	/** The task definition. */
 	get definition() {
@@ -1440,6 +1699,45 @@ var Guard = class {
 //#endregion
 //#region src/jobs.ts
 /** Persistent background jobs for task setup and single-result evaluation. */
+/**
+* The only host environment variables a setup/evaluation child inherits.
+*
+* Evaluation children execute agent-authored build scripts and binaries, so
+* the ambient DSH environment (credentials, session secrets, proxy settings)
+* must not leak into them. Everything the task needs is passed explicitly via
+* the EVAL_* variables in StartOptions.env.
+*/
+function baseEnvironment(source = process.env) {
+	const keep = [
+		"PATH",
+		"HOME",
+		"USER",
+		"LOGNAME",
+		"SHELL",
+		"LANG",
+		"LANGUAGE",
+		"LC_ALL",
+		"LC_CTYPE",
+		"LC_MESSAGES",
+		"TZ",
+		"TERM",
+		"TMPDIR",
+		"TMP",
+		"TEMP",
+		"SSL_CERT_FILE",
+		"SSL_CERT_DIR",
+		"GIT_SSL_CAINFO",
+		"REQUESTS_CA_BUNDLE",
+		"CURL_CA_BUNDLE",
+		"NODE_EXTRA_CA_CERTS"
+	];
+	const env = {};
+	for (const key of keep) {
+		const value = source[key];
+		if (value !== void 0) env[key] = value;
+	}
+	return env;
+}
 function now() {
 	return Date.now();
 }
@@ -1461,15 +1759,65 @@ var JobManager = class {
 			try {
 				const stored = JSON.parse(fs.readFileSync(file, "utf8"));
 				if (stored.status === "running" || stored.status === "queued") {
+					if (typeof stored.pid === "number" && stored.pid > 0 && this.stillOurProcess(stored)) try {
+						process.kill(-stored.pid, "SIGTERM");
+					} catch {
+						try {
+							process.kill(stored.pid, "SIGTERM");
+						} catch {}
+					}
 					stored.status = "interrupted";
 					stored.error = "服务重启，任务已中断";
 					stored.endedAt = now();
 					this.write(stored);
+					if (stored.kind === "install" && stored.cleanupWorkspace !== void 0) {
+						this.wipeInstallWorkspace(stored.cleanupWorkspace);
+						if (stored.cifarToken !== void 0) this.cleanupCifarLock(stored.cifarToken);
+					}
 				}
 				this.jobs.set(stored.id, stored);
 			} catch {}
 		}
 	}
+	/** Remove every top-level entry an interrupted install could have created. */
+	wipeInstallWorkspace(workspacePath) {
+		try {
+			for (const entry of fs.readdirSync(workspacePath)) fs.rmSync(path.join(workspacePath, entry), {
+				recursive: true,
+				force: true
+			});
+		} catch {}
+	}
+	/** Remove the CIFAR lock only when it carries this install's token. */
+	cleanupCifarLock(token) {
+		try {
+			const lock = path.join(guardRoot(), "cache", "cifar10", ".download.lock");
+			if (fs.existsSync(lock) && fs.readFileSync(lock, "utf8").includes("token=" + token)) fs.rmSync(lock, { force: true });
+		} catch {}
+	}
+	/** Read the Linux process start time from /proc/<pid>/stat (field 22). */
+	processStartTime(pid) {
+		try {
+			const stat = fs.readFileSync("/proc/" + String(pid) + "/stat", "utf8");
+			const end = stat.lastIndexOf(")");
+			if (end < 0) return void 0;
+			return stat.slice(end + 2).trim().split(/\s+/)[19];
+		} catch {
+			return;
+		}
+	}
+	/** Whether a persisted PID still names the process this job started. */
+	stillOurProcess(stored) {
+		if (stored.pidStartTime !== void 0 && this.processStartTime(stored.pid) !== stored.pidStartTime) return false;
+		if (stored.pidStartTime !== void 0) return true;
+		try {
+			const argv = fs.readFileSync("/proc/" + String(stored.pid) + "/cmdline", "utf8").split("\0").filter(Boolean);
+			if (argv.length === 0) return false;
+			return path.basename(argv[0]) === path.basename(stored.command[0] ?? "");
+		} catch {
+			return false;
+		}
+	}
 	dir(idValue) {
 		return path.join(this.root, idValue);
 	}
@@ -1497,7 +1845,9 @@ var JobManager = class {
 			command: options.command,
 			cwd: options.cwd,
 			logFile,
-			resultFile: path.join(directory, "result.json")
+			resultFile: path.join(directory, "result.json"),
+			...options.cleanupWorkspace === void 0 ? {} : { cleanupWorkspace: options.cleanupWorkspace },
+			...options.cifarToken === void 0 ? {} : { cifarToken: options.cifarToken }
 		};
 		this.jobs.set(jobId, job);
 		this.write(job);
@@ -1506,7 +1856,7 @@ var JobManager = class {
 			child = spawn(options.command[0], options.command.slice(1), {
 				cwd: options.cwd,
 				env: {
-					...process.env,
+					...baseEnvironment(),
 					...options.env ?? {},
 					PYTHONUNBUFFERED: "1",
 					EVAL_JOB_DIR: directory,
@@ -1528,6 +1878,11 @@ var JobManager = class {
 			return this.info(job);
 		}
 		this.children.set(jobId, child);
+		if (child.pid !== void 0) {
+			job.pid = child.pid;
+			job.pidStartTime = this.processStartTime(child.pid);
+			this.write(job);
+		}
 		if (options.onCancel !== void 0) this.cancelHandlers.set(jobId, options.onCancel);
 		const append = (chunk) => {
 			try {
@@ -1536,17 +1891,29 @@ var JobManager = class {
 		};
 		child.stdout?.on("data", (chunk) => append(chunk));
 		child.stderr?.on("data", (chunk) => append(chunk));
-		child.on("error", (error) => {
+		let failureNotified = false;
+		const fail = (error) => {
+			if (job.status !== "running" && job.status !== "queued") return;
 			job.status = "failed";
-			job.error = error.message;
+			job.error = error;
 			job.endedAt = now();
 			job.updatedAt = now();
 			this.write(job);
+			if (failureNotified) return;
+			failureNotified = true;
+			try {
+				options.onFailure?.(this.detail(jobId));
+			} catch {}
+		};
+		child.on("error", (error) => {
+			this.children.delete(jobId);
+			this.cancelHandlers.delete(jobId);
+			fail(error.message);
 		});
 		child.on("exit", (code, signal) => {
 			this.children.delete(jobId);
 			this.cancelHandlers.delete(jobId);
-			if (job.status === "cancelled") return;
+			if (job.status === "cancelled" || job.status === "failed") return;
 			if (code === 0) try {
 				const extra = options.onSuccess?.(this.detail(jobId));
 				if (extra !== void 0) {
@@ -1564,17 +1931,14 @@ var JobManager = class {
 			} catch (error) {
 				job.status = "failed";
 				job.error = error instanceof Error ? error.message : String(error);
-				try {
-					options.onFailure?.(this.detail(jobId));
-				} catch {}
-			}
-			else {
-				job.status = "failed";
-				job.error = signal !== null ? "进程被信号 " + signal + " 终止" : "退出码 " + String(code);
-				try {
-					options.onFailure?.(this.detail(jobId));
-				} catch {}
+				if (!failureNotified) {
+					failureNotified = true;
+					try {
+						options.onFailure?.(this.detail(jobId));
+					} catch {}
+				}
 			}
+			else fail(signal !== null ? "进程被信号 " + signal + " 终止" : "退出码 " + String(code));
 			job.endedAt = now();
 			job.updatedAt = now();
 			this.write(job);
@@ -1802,7 +2166,7 @@ const TASKS = [
 	{
 		id: NEURAL_PENDULUM_TASK,
 		label: NEURAL_PENDULUM_TASK_LABEL,
-		description: "从零实现纯 C++17 神经网络基础设施，用三个关节角度控制预编译三节摆起摆并稳定保持；评测固定初始状态，统计 t_can。",
+		description: "从零实现纯 C++17 神经网络基础设施（算子数值以评测侧 PyTorch 参考校验），用三个关节角度控制预编译三节摆起摆并稳定保持；评测固定初始状态，统计 t_can。",
 		timeLimitMinutes: 1440,
 		timeLimitEnabled: false,
 		needsSetup: true
@@ -1817,14 +2181,14 @@ const TANK_DEFINITION = {
 	timeLimitMinutes: 90,
 	timeLimitEnabled: true,
 	needsSetup: false,
-	prompt() {
+	prompt({ minutes }) {
 		return [
 			"按照要求编写尽可能强的坦克大战 bot。你的对手是其他顶尖 AI 模型写的 bot，它们可能主动设计战术。基准是一个中等强度、思路常规的 bot，它在正式比赛中是 0 分线；战胜基准不代表足够强，正式对手远强于基准。正式赛是 1 对 1 循环赛，用 Bradley-Terry 模型拟合实力值。",
 			"",
 			"解压 workspace.zip，阅读 README.md 和 RULES.md，然后开始。",
 			"",
-			"比赛是连续 90 分钟的单次任务：",
-			"- 你有 90 分钟修改 bot，从对话开始计时；到 90 分钟强制停止；",
+			"比赛是连续 " + minutes + " 分钟的单次任务：",
+			"- 你有 " + minutes + " 分钟修改 bot，从对话开始计时；到 " + minutes + " 分钟强制停止；",
 			"- 最终只看 bot 的强度，提前交卷没有任何好处；觉得没什么可改了，先换一个思路再试；",
 			"- 到点时 workspace/submission/bot.cpp 是什么就交什么：不要让它长时间停在编译不过的状态；",
 			"- 允许使用本地工具、对战和复盘；禁止联网，禁止求助其他模型（包括启动子代理：subagent、Task / Agent 工具、后台并行代理之类），除主办方发给你的材料外禁止查看其他选手的资料；",
@@ -1846,7 +2210,7 @@ const WAREHOUSE_DEFINITION = {
 	timeLimitMinutes: 90,
 	timeLimitEnabled: true,
 	needsSetup: false,
-	prompt() {
+	prompt({ minutes }) {
 		return [
 			"这是一场 AI 编程赛。你接手了一个代码混乱的老系统：src/ 里是一个仓储机器人调度仿真系统，功能正确，但运行很慢。你的任务：在输出完全不变的前提下，让它尽可能快。",
 			"",
@@ -1855,7 +2219,7 @@ const WAREHOUSE_DEFINITION = {
 			"要点（详见 TASK.md）：",
 			"- 只能修改 src/；编译命令固定为 g++ -O2 -std=c++20 src/*.cpp，只用 C++ 标准库；",
 			"- 对任何合法输入（以 tools/check_input.py --full 为准），输出都必须与基线逐字节相同；SPEC.md 是过时的旧文档，一切以基线代码的实际行为为准；",
-			"- 本次是连续 90 分钟的单次任务；clock.py 从解压那一刻开始计算，实际计时从对话开始计算，它只能作为参考，请尽快解压；",
+			"- 本次是连续 " + minutes + " 分钟的单次任务；clock.py 从解压那一刻开始计算，实际计时从对话开始计算，它只能作为参考，请尽快解压；",
 			"- 只能读写当前文件夹里的文件；可以使用本环境的所有工具，但不能联网搜索；",
 			"- 不要向我提问，也不要等待我确认，直到完成为止。",
 			"",
@@ -1872,11 +2236,11 @@ const LAND_DEFINITION = {
 	timeLimitMinutes: 90,
 	timeLimitEnabled: true,
 	needsSetup: false,
-	prompt() {
+	prompt({ minutes }) {
 		return [
 			"这是一场正式的 AI 编程对抗赛，你的对手是其他顶尖 AI 模型写的 bot，它们会主动切断你、抢你的地。比赛结果会公开排名，请拿出你的最高水平。",
 			"",
-			"请解压当前目录的 workspace.zip，进入 workspace 文件夹，按 TASK.md 的要求编写一个尽可能强的圈地对战 bot，保存为 workspace/submission/bot.cpp。时间预算约 60 分钟，请自己把握进度，做完就可以结束；超过 90 分钟会被强制停止。只能读写当前文件夹里的文件，不能联网搜索，不要向我提问。"
+			"请解压当前目录的 workspace.zip，进入 workspace 文件夹，按 TASK.md 的要求编写一个尽可能强的圈地对战 bot，保存为 workspace/submission/bot.cpp。时间预算约 " + Math.min(60, minutes) + " 分钟，请自己把握进度，做完就可以结束；超过 " + minutes + " 分钟会被强制停止。只能读写当前文件夹里的文件，不能联网搜索，不要向我提问。"
 		].join("\n");
 	}
 };
@@ -1889,8 +2253,8 @@ const BOMBERMAN_DEFINITION = {
 	timeLimitMinutes: 90,
 	timeLimitEnabled: true,
 	needsSetup: false,
-	prompt() {
-		return ["按照要求编写尽可能强bot，你的对手是全球其他顶尖ai，可能主动设计战术。基准只是很弱的bot，它在正式比赛为0分线。正式赛会对战多轮，用Bradley-Terry模型拟合实力值。", "解压 workspace.zip，阅读 README.md 和 RULES.md，编写支持2–10人的炸弹人 bot。尽量60分钟完成，90分钟必须交卷。允许本地工具、对战和复盘，禁止联网、调用其他AI或查看其他选手资料。提交 submission/bot.cpp，简述策略。"].join("\n");
+	prompt({ minutes }) {
+		return ["按照要求编写尽可能强bot，你的对手是全球其他顶尖ai，可能主动设计战术。基准只是很弱的bot，它在正式比赛为0分线。正式赛会对战多轮，用Bradley-Terry模型拟合实力值。", "解压 workspace.zip，阅读 README.md 和 RULES.md，编写支持2–10人的炸弹人 bot。尽量" + Math.min(60, minutes) + "分钟完成，" + minutes + "分钟必须交卷。允许本地工具、对战和复盘，禁止联网、调用其他AI或查看其他选手资料。提交 submission/bot.cpp，简述策略。"].join("\n");
 	}
 };
 /** CTF bot task: original participant prompt, unchanged. */
@@ -1902,28 +2266,17 @@ const CTF_DEFINITION = {
 	timeLimitMinutes: 90,
 	timeLimitEnabled: true,
 	needsSetup: false,
-	prompt() {
-		return ["按照要求编写尽可能强的 bot，你的对手是全球其他顶尖 AI，可能主动设计战术。基准是一个中等强度、思路常规的 bot，它在正式比赛是 0 分线；战胜基准不代表足够强，正式对手远强于基准。正式赛会对战多轮，用 Bradley-Terry 模型拟合实力值。", "解压 workspace.zip，阅读 README.md 和 RULES.md，编写支持 2–15 方的夺旗 bot。你有 60 分钟，只看最终 bot 的强度，提前交卷不加分，请充分利用时间持续改进；可以适当超时，但到 90 分钟会强制交卷。允许本地工具、对战和复盘，禁止联网、调用其他 AI 或查看其他选手资料。提交 workspace/submission/bot.cpp，简述策略。"].join("\n");
+	prompt({ minutes }) {
+		return ["按照要求编写尽可能强的 bot，你的对手是全球其他顶尖 AI，可能主动设计战术。基准是一个中等强度、思路常规的 bot，它在正式比赛是 0 分线；战胜基准不代表足够强，正式对手远强于基准。正式赛会对战多轮，用 Bradley-Terry 模型拟合实力值。", "解压 workspace.zip，阅读 README.md 和 RULES.md，编写支持 2–15 方的夺旗 bot。你有 " + Math.min(60, minutes) + " 分钟，只看最终 bot 的强度，提前交卷不加分，请充分利用时间持续改进；可以适当超时，但到 " + minutes + " 分钟会强制交卷。允许本地工具、对战和复盘，禁止联网、调用其他 AI 或查看其他选手资料。提交 workspace/submission/bot.cpp，简述策略。"].join("\n");
 	}
 };
-/** Run the task's host-side setup script with network access. */
-function runSetup(workspacePath) {
-	execFileSync("bash", ["setup.sh"], {
-		cwd: workspacePath,
-		stdio: "inherit",
-		env: {
-			...process.env,
-			GIT_TERMINAL_PROMPT: "0"
-		}
-	});
-}
 /** Commit0 single-library task. */
 const COMMIT0_DEFINITION = {
 	id: COMMIT0_TASK,
 	label: COMMIT0_TASK_LABEL,
 	description: TASKS[5].description,
 	asset: path.join(packageRoot(), "assets", "commit0", "workspace.zip"),
-	prepare: runSetup,
+	testMaterial: ["tests", "pytest.ini"],
 	timeLimitMinutes: 480,
 	timeLimitEnabled: false,
 	needsSetup: true,
@@ -1954,7 +2307,11 @@ const SWE_BENCH_PRO_DEFINITION = {
 	label: SWE_BENCH_PRO_TASK_LABEL,
 	description: TASKS[6].description,
 	asset: path.join(packageRoot(), "assets", "swe-bench-pro", "workspace.zip"),
-	prepare: runSetup,
+	testMaterial: [
+		"test",
+		"pytest.ini",
+		"conftest.py"
+	],
 	timeLimitMinutes: 1440,
 	timeLimitEnabled: false,
 	needsSetup: true,
@@ -1989,7 +2346,7 @@ const FEATUREBENCH_DEFINITION = {
 	label: FEATUREBENCH_TASK_LABEL,
 	description: TASKS[7].description,
 	asset: path.join(packageRoot(), "assets", "featurebench", "workspace.zip"),
-	prepare: runSetup,
+	testMaterial: ["tests", "conftest.py"],
 	timeLimitMinutes: 1440,
 	timeLimitEnabled: false,
 	needsSetup: true,
@@ -2123,16 +2480,18 @@ const NEURAL_PENDULUM_DEFINITION = {
 		return [
 			"你是一名控制与神经网络工程师。任务：从零实现纯 C++17、仅 CPU、fp32 的神经网络基础设施，并用它训练一个控制器，控制预编译的三节摆从接近全向下起摆，使三根杆全部进入竖直向上容差并尽可能长时间保持。",
 			"",
-			"请先完整阅读 TASK.md；它是权威规则。硬约束：仅 C++17 标准库、仅 CPU、fp32；不使用 Python/OpenCL/CUDA/BLAS/Eigen/第三方库；必须从提交源码构建出 build/control 与 build/libnn.a；基础设施需实现工作区公开头文件 include/nn/nn.hpp 的契约，隐藏测试由评测侧独立编译链接。",
+			"请先完整阅读 TASK.md；它是权威规则。硬约束：仅 C++17 标准库、仅 CPU、fp32；不使用 Python/OpenCL/CUDA/BLAS/Eigen/第三方库；必须从提交源码构建出 build/nn_task 与 build/control。",
 			"",
-			"环境细节：joint1 与 joint3 驱动，joint2 被动；控制频率 100 Hz；每回合最多 3000 步（30 s），达到上限后继续 step 返回 {\"error\":\"episode_finished\"}，必须 reset。环境只返回三个关节角度（弧度，不除 pi），不返回 reward/loss/cost/done；环境不提供杆长、质量、惯量、角速度或 tip。训练 reset 带小范围随机初始角度和角速度；评测使用固定初始状态，无随机扰动。",
+			"环境细节：joint1 与 joint3 驱动，joint2 被动；控制频率 100 Hz；每回合最多 3000 步（30 s），达到上限后继续 step 返回 {\"error\":\"episode_finished\"}，必须 reset。theta=0 表示竖直向下、theta=pi 表示竖直向上；观测 a_i=wrap(theta_i-pi)，即三个关节角度（弧度，不除 pi）。环境不返回 reward/loss/cost/done；不提供杆长、质量、惯量、角速度或 tip。训练 reset 带小范围随机初始角度和角速度；评测使用固定初始状态，无随机扰动。",
 			"",
 			"优化目标：从接近全向下起摆，使三根杆全部进入 0.05 rad 的竖直向上容差，并尽可能长时间保持；评测指标为 t_can。损失函数、奖励、优化器、网络结构和训练方法由你自行设计，不规定任何训练方案。",
 			"",
-			"评测会从干净副本重新构建提交源码，编译并运行宿主侧隐藏基础设施测试，然后在固定初始状态上驱动 build/control，统计连续全向上保持时间 t_can。不要把任何未提交的二进制、临时构建产物或外部进程当作交付依赖。",
+			"注意：评测侧用 PyTorch 计算算子参考值，但工作区/候选运行时不提供 PyTorch 或 numpy，也没有网络，无法 pip 安装；开发阶段请用 C++ 或 Python 标准库/独立 double 实现做数值对照。",
+			"",
+			"评测会从干净副本重新构建提交源码，先运行与 Neural-FP32/Neural-CIFAR 相同的算子数值评测：评测侧用 PyTorch 在相同数据上计算参考值，逐操作比较加权平均相对误差并对照阈值，任一算子不可执行、崩溃、超时、输出缺失或误差超阈值即判为基础设施失败；然后在固定初始状态上驱动 build/control，统计连续全向上保持时间 t_can。不要把任何未提交的二进制、临时构建产物或外部进程当作交付依赖。",
 			"使用宿主工具 eval_submit 提交当前源码快照，使用 eval_test 请求宿主评测最新提交。提交快照、事件、测试结果和最终分数全部保存在工作区之外的宿主目录；不要尝试读取或修改这些数据，也不要依赖任何工作区内的测试结果文件。最终评测使用最新提交快照，按宿主事件时间积分计算分数。",
 			"",
-			"工作方式：先完成最小可构建的基础设施和 control 协议；再持续做控制/训练实验并记录可复现结果；最终保证工作区从零构建、隐藏基础设施测试通过、control 可被评测驱动，并留下 NOTES.md/RESULTS.md。",
+			"工作方式：先完成最小可构建的基础设施和 control 协议；再持续做控制/训练实验并记录可复现结果；最终保证工作区从零构建、build/nn_task 算子数值评测通过、control 可被评测驱动，并留下 NOTES.md/RESULTS.md。",
 			"",
 			"不要向我提问，也不要等待确认，独立完成。"
 		].join("\n");
@@ -2153,7 +2512,47 @@ const TASK_DEFINITIONS = {
 	[NEURAL_CIFAR_TASK]: NEURAL_CIFAR_DEFINITION,
 	[NEURAL_PENDULUM_TASK]: NEURAL_PENDULUM_DEFINITION
 };
-var TaskService = class {
+/** SHA-256 of one file. */
+function sha256File(file) {
+	const hash = createHash("sha256");
+	hash.update(fs.readFileSync(file));
+	return hash.digest("hex");
+}
+/** Order-stable SHA-256 of a directory tree (relative paths + contents). */
+function sha256Tree(dir) {
+	const hash = createHash("sha256");
+	const walk = (current) => {
+		for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+			const full = path.join(current, entry.name);
+			hash.update(path.relative(dir, full));
+			if (entry.isDirectory()) walk(full);
+			else if (entry.isFile()) hash.update(fs.readFileSync(full));
+			else if (entry.isSymbolicLink()) hash.update("link:" + fs.readlinkSync(full));
+		}
+	};
+	walk(dir);
+	return hash.digest("hex");
+}
+/** The venv site-packages directories that exist under one workspace venv. */
+function sitePackageDirs(venv) {
+	const out = [];
+	for (const lib of ["lib", "lib64"]) {
+		const base = path.join(venv, lib);
+		let entries = [];
+		try {
+			entries = fs.readdirSync(base, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			if (!entry.isDirectory() || !entry.name.startsWith("python")) continue;
+			const site = path.join(base, entry.name, "site-packages");
+			if (fs.existsSync(site)) out.push(site);
+		}
+	}
+	return out;
+}
+var TaskService = class TaskService {
 	guard;
 	registry;
 	jobs;
@@ -2196,7 +2595,14 @@ var TaskService = class {
 			".submissions",
 			"node_modules",
 			"__pycache__",
-			".venv"
+			".venv",
+			".tmp",
+			".home",
+			".cache",
+			".config",
+			".local",
+			"data",
+			"work"
 		]);
 		let count = 0;
 		const walk = (dir) => {
@@ -2265,13 +2671,85 @@ var TaskService = class {
 			files
 		};
 	}
-	async runHostEval(workspaceId) {
+	/** Map an evaluator result that has no explicit stage (older evaluator builds). */
+	inferStage(value, error) {
+		if (value.infra_ok === true) return value.success === true ? "completed" : "scoring";
+		const text = error.toLowerCase();
+		if (text.includes("cmake") || text.includes("build")) return "compile";
+		if (text.includes("infrastructure") || text.includes("operator") || text.includes("mre")) return "infra";
+		if (text.includes("controller") || text.includes("torque")) return "controller";
+		return "simulation";
+	}
+	/** The target hold time used by the neural-pendulum scoring integral. */
+	static FINAL_T_TGT = 10;
+	/** One test event's instantaneous score, mirroring the task specification. */
+	static eventScore(event) {
+		const stage = String(event["stage"] ?? "");
+		if (stage !== "scoring" && stage !== "completed" && event["valid"] !== true) return -1;
+		const value = Number(event["t_can"] ?? 0);
+		if (!Number.isFinite(value)) return -1;
+		return (Math.min(Math.max(value, 0), TaskService.FINAL_T_TGT) - TaskService.FINAL_T_TGT) / TaskService.FINAL_T_TGT;
+	}
+	/**
+	* Host-side authoritative final score: integral of the per-test score over
+	* time, applying every test event at its REQUEST time and stopping at the
+	* first completed request. Mirrors neural-pendulum-eval/run_eval.py, but the
+	* host owns it because only the host knows the request timestamp and the
+	* current test's outcome before the next test arrives.
+	*/
+	static finalScoreFromEvents(startedAt, events, now) {
+		const tests = events.filter((item) => (item["event"] ?? item["type"]) === "test");
+		if (tests.length === 0) return -1 * Math.max(0, now - startedAt);
+		let doneAt;
+		let previous = startedAt;
+		let current = -1;
+		let total = 0;
+		for (const item of tests) {
+			const raw = Number(item["time"] ?? item["at"] ?? previous);
+			const at = Number.isFinite(raw) ? Math.max(raw, previous) : previous;
+			total += current * (at - previous);
+			current = TaskService.eventScore(item);
+			previous = at;
+			if (item["completed"] === true) {
+				doneAt = at;
+				break;
+			}
+		}
+		total += current * Math.max(0, (doneAt ?? now) - previous);
+		return total;
+	}
+	/** Read host test events; malformed lines are ignored. */
+	readHostEvents(workspaceId) {
+		const file = this.hostEvents(workspaceId);
+		if (!fs.existsSync(file)) return [];
+		const out = [];
+		for (const line of fs.readFileSync(file, "utf8").split("\n")) {
+			if (line.trim() === "") continue;
+			try {
+				const value = JSON.parse(line);
+				if (value !== null && typeof value === "object" && !Array.isArray(value)) out.push(value);
+			} catch {}
+		}
+		return out;
+	}
+	/** The task start time recorded at first submission, falling back to the run creation time. */
+	hostStartedAt(workspaceId, run) {
+		try {
+			const meta = JSON.parse(fs.readFileSync(path.join(this.hostDir(workspaceId), "meta.json"), "utf8"));
+			const value = Number(meta.started_at);
+			if (Number.isFinite(value) && value > 0) return value;
+		} catch {}
+		return run.createdAt / 1e3;
+	}
+	/** @param startedAtSeconds - task start in epoch seconds (from host meta). */
+	async runHostEval(workspaceId, startedAtSeconds) {
 		const latest = this.hostLatestSubmission(workspaceId);
 		if (latest === void 0) return {
 			stage: "no_submission",
 			t_can: 0,
 			completed: false,
-			error: ""
+			error: "",
+			final_score: 0
 		};
 		const temp = fs.mkdtempSync(path.join(guardRoot(), "pend-eval-"));
 		try {
@@ -2281,16 +2759,14 @@ var TaskService = class {
 			const events = this.hostEvents(workspaceId);
 			fs.writeFileSync(path.join(temp, ".eval", "events.jsonl"), fs.existsSync(events) ? fs.readFileSync(events) : "", "utf8");
 			fs.writeFileSync(path.join(temp, ".eval", "meta.json"), JSON.stringify({
-				started_at: Date.now() / 1e3,
+				started_at: startedAtSeconds,
 				t_tgt: 10
 			}), "utf8");
 			const resultFile = path.join(temp, "result.json");
 			const script = path.join(packageRoot(), "neural-pendulum-eval", "run_eval.py");
 			const env = {
-				...process.env,
-				EVAL_RESULT_FILE: resultFile,
-				PYTHONPATH: "",
-				PYTHONHOME: ""
+				...baseEnvironment(),
+				EVAL_RESULT_FILE: resultFile
 			};
 			const child = spawn("python3", [
 				"-X",
@@ -2298,35 +2774,61 @@ var TaskService = class {
 				script,
 				"--workspace",
 				temp
-			], { env });
+			], {
+				env,
+				detached: true
+			});
 			let stderr = "";
 			child.stderr?.on("data", (chunk) => {
 				stderr += String(chunk);
 			});
+			let timedOut = false;
 			await new Promise((resolve, reject) => {
-				child.on("error", reject);
-				child.on("close", () => resolve());
+				const timer = setTimeout(() => {
+					timedOut = true;
+					try {
+						if (child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
+					} catch {}
+					try {
+						child.kill("SIGKILL");
+					} catch {}
+					resolve();
+				}, 12e5);
+				child.on("error", (error) => {
+					clearTimeout(timer);
+					reject(error);
+				});
+				child.on("close", () => {
+					clearTimeout(timer);
+					resolve();
+				});
 			});
+			if (timedOut) return {
+				stage: "infra",
+				t_can: 0,
+				completed: false,
+				error: "evaluation timed out after 20 minutes",
+				final_score: 0
+			};
 			if (!fs.existsSync(resultFile)) return {
-				stage: "controller",
+				stage: "infra",
 				t_can: 0,
 				completed: false,
-				error: stderr || "evaluator failed"
+				error: stderr || "evaluator failed",
+				final_score: 0
 			};
 			const value = JSON.parse(fs.readFileSync(resultFile, "utf8"));
 			const error = String(value.error ?? "");
-			let stage = "controller";
-			if (error.includes("cmake") || error.includes("build")) stage = "compile";
-			else if (error.includes("selftest") || value.infra_ok === false) stage = "infra";
-			else if (error.includes("controller")) stage = "controller";
-			else if (value.success === true) stage = "completed";
-			else if (value.infra_ok === true) stage = "scoring";
-			else stage = "simulation";
+			const rawStage = String(value.stage ?? "");
+			const stage = rawStage !== "" ? rawStage : this.inferStage(value, error);
+			const tCan = Number(value.t_can ?? 0);
+			const finalScore = Number(value.final_score ?? 0);
 			return {
 				stage,
-				t_can: Number(value.t_can ?? 0),
-				completed: value.success === true,
-				error
+				t_can: Number.isFinite(tCan) ? tCan : 0,
+				completed: stage === "completed" && value.success === true,
+				error,
+				final_score: Number.isFinite(finalScore) ? finalScore : 0
 			};
 		} finally {
 			fs.rmSync(temp, {
@@ -2343,11 +2845,12 @@ var TaskService = class {
 			stage: "completed",
 			error: "task already completed"
 		};
+		const requestedAt = Date.now() / 1e3;
 		const latest = this.hostLatestSubmission(run.workspaceId);
 		if (latest === void 0) {
 			this.appendHostEvent(run.workspaceId, {
 				event: "test",
-				time: Date.now() / 1e3,
+				time: requestedAt,
 				submission_id: "",
 				stage: "no_submission",
 				t_can: 0,
@@ -2362,20 +2865,29 @@ var TaskService = class {
 				error: ""
 			};
 		}
-		const value = await this.runHostEval(run.workspaceId);
+		const startedAt = this.hostStartedAt(run.workspaceId, run);
+		const value = await this.runHostEval(run.workspaceId, startedAt);
 		const stage = String(value.stage ?? "simulation");
 		const tCan = Number(value.t_can ?? 0);
-		const completed = stage === "completed" && Number.isFinite(tCan);
-		this.appendHostEvent(run.workspaceId, {
+		const completed = stage === "completed" && Number.isFinite(tCan) && tCan >= 10;
+		const event = {
 			event: "test",
-			time: Date.now() / 1e3,
+			time: requestedAt,
 			submission_id: latest.id,
 			stage,
 			t_can: tCan,
 			completed,
 			error: String(value.error ?? "")
-		});
-		if (completed) fs.writeFileSync(done, String(Date.now() / 1e3), "utf8");
+		};
+		const finalScore = TaskService.finalScoreFromEvents(startedAt, [...this.readHostEvents(run.workspaceId), event], Date.now() / 1e3);
+		event["final_score"] = finalScore;
+		this.appendHostEvent(run.workspaceId, event);
+		if (completed) fs.writeFileSync(done, JSON.stringify({
+			at: requestedAt,
+			stage,
+			t_can: tCan,
+			final_score: finalScore
+		}) + "\n", "utf8");
 		return {
 			ok: true,
 			stage,
@@ -2386,17 +2898,28 @@ var TaskService = class {
 	}
 	/** Build a temporary workspace containing the host-side authoritative state. */
 	stageHostWorkspace(workspaceId) {
-		if (this.hostLatestSubmission(workspaceId) === void 0) return void 0;
+		const latest = this.hostLatestSubmission(workspaceId);
+		if (latest === void 0) return void 0;
 		const temp = fs.mkdtempSync(path.join(guardRoot(), "pend-eval-view-"));
 		const state = path.join(temp, ".eval");
 		fs.mkdirSync(path.join(state, "submissions"), { recursive: true });
-		const root = path.join(this.hostDir(workspaceId), "submissions");
-		for (const entry of fs.readdirSync(root, { withFileTypes: true })) if (entry.isDirectory()) fs.cpSync(path.join(root, entry.name), path.join(state, "submissions", entry.name), { recursive: true });
+		fs.cpSync(latest.path, path.join(state, "submissions", latest.id), { recursive: true });
 		const events = this.hostEvents(workspaceId);
 		fs.writeFileSync(path.join(state, "events.jsonl"), fs.existsSync(events) ? fs.readFileSync(events) : "", "utf8");
 		const meta = path.join(this.hostDir(workspaceId), "meta.json");
+		let fallbackStart = Date.now() / 1e3;
+		try {
+			for (const line of (fs.existsSync(events) ? fs.readFileSync(events, "utf8") : "").split("\n")) {
+				if (line.trim() === "") continue;
+				const time = Number(JSON.parse(line).time);
+				if (Number.isFinite(time) && time > 0) {
+					fallbackStart = time;
+					break;
+				}
+			}
+		} catch {}
 		fs.writeFileSync(path.join(state, "meta.json"), fs.existsSync(meta) ? fs.readFileSync(meta) : JSON.stringify({
-			started_at: Date.now() / 1e3,
+			started_at: fallbackStart,
 			t_tgt: 10
 		}), "utf8");
 		return temp;
@@ -2455,6 +2978,67 @@ var TaskService = class {
 		if (index === "custom") return (options.customPipUrl ?? "").trim() || "https://pypi.org/simple";
 		return PIP_MIRRORS.find((item) => item.id === index)?.url ?? "https://pypi.org/simple";
 	}
+	/** Host-side pristine material for one workspace (tests, venv manifest). */
+	baselineDir(workspaceId) {
+		return path.join(guardRoot(), "task-baseline", workspaceId.replace(/[^A-Za-z0-9_.-]/g, "_"));
+	}
+	/**
+	* Snapshot the test material a benchmark task ships with, so an agent cannot
+	* pass by editing or weakening the tests. Runs once after a successful
+	* install; the evaluator restores it before scoring.
+	*/
+	snapshotTestMaterial(definition, workspaceId, workspacePath) {
+		const names = definition.testMaterial ?? [];
+		if (names.length === 0) return;
+		const target = this.baselineDir(workspaceId);
+		fs.mkdirSync(target, { recursive: true });
+		for (const name of names) {
+			const source = path.join(workspacePath, name);
+			if (!fs.existsSync(source)) continue;
+			const destination = path.join(target, name);
+			fs.rmSync(destination, {
+				recursive: true,
+				force: true
+			});
+			fs.cpSync(source, destination, {
+				recursive: true,
+				dereference: false
+			});
+		}
+		fs.writeFileSync(path.join(target, "manifest.json"), JSON.stringify({
+			task: definition.id,
+			names
+		}, null, 2) + "\n", "utf8");
+	}
+	/**
+	* Record a fingerprint of the venv's control plane (python target, pyvenv.cfg,
+	* .pth files, pytest packages). The evaluator refuses to trust a venv whose
+	* fingerprint no longer matches, which closes the "replace bin/python or
+	* patch pytest" forgery path.
+	*/
+	snapshotVenv(workspaceId, workspacePath) {
+		const venv = path.join(workspacePath, ".venv");
+		if (!fs.existsSync(venv)) return;
+		const target = this.baselineDir(workspaceId);
+		fs.mkdirSync(target, { recursive: true });
+		const manifest = { files: {} };
+		const python = path.join(venv, "bin", "python");
+		try {
+			manifest.python = fs.realpathSync.native(python);
+		} catch {}
+		const cfg = path.join(venv, "pyvenv.cfg");
+		if (fs.existsSync(cfg)) manifest.files["pyvenv.cfg"] = sha256File(cfg);
+		for (const site of sitePackageDirs(venv)) {
+			for (const entry of fs.readdirSync(site, { withFileTypes: true })) {
+				if (!entry.isFile() || !entry.name.endsWith(".pth")) continue;
+				const file = path.join(site, entry.name);
+				manifest.files[path.relative(venv, file)] = sha256File(file);
+			}
+			const pytest = path.join(site, "pytest");
+			if (fs.existsSync(pytest)) manifest.pytest = sha256Tree(pytest);
+		}
+		fs.writeFileSync(path.join(target, "venv.json"), JSON.stringify(manifest, null, 2) + "\n", "utf8");
+	}
 	/** Check one workspace before install. */
 	check(workspaceId) {
 		const workspace = this.registry.get(workspaceId);
@@ -2548,7 +3132,7 @@ var TaskService = class {
 	}
 	/** Remove the shared CIFAR lock only when it belongs to this install. */
 	cleanupCifarLock(token) {
-		const lock = path.join(os.homedir(), ".dsh", "eval-guard", "cache", "cifar10", ".download.lock");
+		const lock = path.join(dshHome(), "eval-guard", "cache", "cifar10", ".download.lock");
 		try {
 			if (!fs.existsSync(lock)) return;
 			if (fs.readFileSync(lock, "utf8").includes("token=" + token)) fs.rmSync(lock, { force: true });
@@ -2613,10 +3197,16 @@ var TaskService = class {
 			command,
 			cwd: checked.path,
 			env,
+			cleanupWorkspace: checked.path,
+			cifarToken: installToken,
 			onCancel: cleanupInstall,
 			onFailure: cleanupInstall,
 			onSuccess: () => {
 				if (definition.needsSetup) this.cleanupWorkspace(checked.path);
+				try {
+					this.snapshotTestMaterial(definition, workspaceId, checked.path);
+					this.snapshotVenv(workspaceId, checked.path);
+				} catch {}
 				return { prompt: this.promptNotice(this.guard.promptFor(checked.path, this.materialZip(taskId), definition)) };
 			}
 		});
@@ -2646,30 +3236,53 @@ var TaskService = class {
 			ok: false,
 			error: "评测脚本不存在：" + script
 		};
-		const evalWorkspace = (taskId === "neural-pendulum" ? this.stageHostWorkspace(workspaceId) : void 0) ?? checked.path;
+		const hostView = taskId === "neural-pendulum" ? this.stageHostWorkspace(workspaceId) : void 0;
+		const evalWorkspace = hostView ?? checked.path;
+		const cleanupHostView = () => {
+			if (hostView === void 0) return;
+			try {
+				fs.rmSync(hostView, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+		};
+		const baseline = this.baselineDir(workspaceId);
+		const baselineEnv = fs.existsSync(baseline) ? { EVAL_BASELINE_DIR: baseline } : {};
+		const job = this.jobs.start({
+			kind: "eval",
+			task: taskId,
+			workspaceId,
+			command: [
+				"python3",
+				"-X",
+				"utf8",
+				script,
+				"--workspace",
+				evalWorkspace
+			],
+			cwd: packageRoot(),
+			env: {
+				PYTHONPATH: "",
+				PYTHONHOME: "",
+				EVAL_CIFAR_PROXY: this.proxyValue(this.guard.configuration.cifarProxyUrl),
+				EVAL_CIFAR_URL: this.cifarUrl(this.guard.configuration),
+				...baselineEnv
+			},
+			onSuccess: cleanupHostView,
+			onCancel: cleanupHostView,
+			onFailure: cleanupHostView
+		});
+		if (job.status === "failed") {
+			cleanupHostView();
+			return {
+				ok: false,
+				error: job.error ?? "评测启动失败"
+			};
+		}
 		return {
 			ok: true,
-			jobId: this.jobs.start({
-				kind: "eval",
-				task: taskId,
-				workspaceId,
-				command: [
-					"python3",
-					"-X",
-					"utf8",
-					script,
-					"--workspace",
-					evalWorkspace
-				],
-				cwd: packageRoot(),
-				env: {
-					PYTHONPATH: "",
-					PYTHONHOME: "",
-					EVAL_CIFAR_PROXY: this.proxyValue(this.guard.configuration.cifarProxyUrl),
-					EVAL_CIFAR_URL: this.cifarUrl(this.guard.configuration),
-					EVAL_SUBMISSIONS_ROOT: path.join(guardRoot(), "submissions", workspaceId.replace(/[^A-Za-z0-9_.-]/g, "_"))
-				}
-			}).id
+			jobId: job.id
 		};
 	}
 	/** Add the optional shared-machine notice to a task prompt. */
@@ -2695,54 +3308,6 @@ var TaskService = class {
 		if (stale) fs.copyFileSync(source, target);
 		return target;
 	}
-	/** Install the selected task pack into an empty workspace. */
-	install(workspaceId, taskId = TANK_TASK, promptOverride) {
-		const definition = TASK_DEFINITIONS[taskId];
-		if (definition === void 0) return {
-			ok: false,
-			workspaceId,
-			error: "未知任务：" + taskId
-		};
-		const checked = this.check(workspaceId);
-		if (!checked.ok) return {
-			ok: false,
-			error: checked.error,
-			workspaceId
-		};
-		if (!checked.empty) return {
-			ok: false,
-			workspaceId,
-			workspacePath: checked.path,
-			error: "工作区不是空的；未执行任何操作。请换一个空工作区，或按手动通道处理。"
-		};
-		if (!this.guard.active) return {
-			ok: false,
-			workspaceId,
-			workspacePath: checked.path,
-			error: "请先启用评测守护，再安装评测任务。"
-		};
-		try {
-			fs.copyFileSync(this.materialZip(taskId), path.join(checked.path, "workspace.zip"));
-			if (definition.needsSetup) this.extractMaterial(checked.path);
-			if (definition.prepare !== void 0) definition.prepare(checked.path);
-			if (definition.needsSetup) this.cleanupWorkspace(checked.path);
-		} catch (error) {
-			if (checked.empty) this.wipeInstallWorkspace(checked.path);
-			return {
-				ok: false,
-				workspaceId,
-				workspacePath: checked.path,
-				error: "任务准备失败：" + (error instanceof Error ? error.message : String(error))
-			};
-		}
-		const prompt = this.promptNotice(promptOverride ?? this.guard.promptFor(checked.path, this.materialZip(taskId), definition));
-		return {
-			ok: true,
-			workspaceId,
-			workspacePath: checked.path,
-			prompt
-		};
-	}
 	/** The prompt for manual copying, without installing anything. */
 	prompt(workspaceId, taskId = TANK_TASK) {
 		const definition = TASK_DEFINITIONS[taskId];
@@ -2794,6 +3359,14 @@ function under(target, root) {
 	const relative = path.relative(root, target);
 	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
 }
+/** Resolve symlinks where possible; keep the lexical path when it does not exist. */
+function realOrSelf(target) {
+	try {
+		return fs.realpathSync.native(target);
+	} catch {
+		return path.resolve(target);
+	}
+}
 /**
 * Register every route this plugin owns.
 * @param ctx - host context.
@@ -2818,6 +3391,7 @@ function registerRoutes(ctx, guard, tasks) {
 			fetch: async () => {
 				return json({
 					enabled: guard.active,
+					...guard.lastFailure === void 0 ? {} : { error: guard.lastFailure },
 					running: guard.runningSessions(),
 					tasks: [...TASKS],
 					defaultBlacklist: guard.defaultBlacklist(),
@@ -2964,15 +3538,25 @@ function registerRoutes(ctx, guard, tasks) {
 				}
 				const target = typeof body.path === "string" ? path.resolve(body.path) : "";
 				if (target === "") return json({ error: "path is required" }, 400);
-				const material = path.resolve(guardRoot(), "material");
-				const workspaces = child.get("workspaceRegistry")?.list?.() ?? [];
-				if (!(under(target, material) || workspaces.some((workspace) => under(target, workspace.path)))) return json({ error: "path is not revealable" }, 403);
 				if (!fs.existsSync(target)) return json({ error: "path does not exist" }, 404);
+				const real = realOrSelf(target);
+				const material = realOrSelf(path.join(guardRoot(), "material"));
+				const workspaces = child.get("workspaceRegistry")?.list?.() ?? [];
+				if (!(under(real, material) || workspaces.some((workspace) => under(real, realOrSelf(workspace.path))))) return json({ error: "path is not revealable" }, 403);
 				try {
-					spawn("xdg-open", [target], {
-						detached: true,
-						stdio: "ignore"
-					}).unref();
+					await new Promise((resolve, reject) => {
+						const childProcess = spawn("xdg-open", [real], {
+							detached: true,
+							stdio: "ignore"
+						});
+						childProcess.once("spawn", () => {
+							childProcess.unref();
+							resolve();
+						});
+						childProcess.once("error", (error) => {
+							reject(error);
+						});
+					});
 				} catch (error) {
 					return json({ error: error instanceof Error ? error.message : String(error) }, 500);
 				}
@@ -3008,6 +3592,7 @@ function resolve(guard, exec) {
 	const run = guard.runForSession(exec.agent?.id);
 	if (run === void 0) throw new Error("eval task run is not active for this session");
 	if (run.task !== "neural-pendulum") throw new Error("this tool is only available for the neural-pendulum task");
+	if (run.status !== "active") throw new Error("eval task run is not active (status: " + run.status + ")");
 	return run;
 }
 /** Install the task tools into one agent's own scoped registry. */
@@ -3037,7 +3622,7 @@ function registerAgentSubmissionTools(agent, guard, tasks) {
 			schema: OUTPUT_SCHEMA,
 			render
 		},
-		timeoutMs: 9e5,
+		timeoutMs: 132e4,
 		execute: async (_args, exec) => tasks.hostTest(resolve(guard, exec))
 	};
 	let registered = false;