niceeval 0.13.4-canary.39 → 0.13.4-canary.42

package/INDEX.md

@@ -28,7 +28,7 @@
 
 <!-- GENERATED:BEGIN bundled-docs-tree -->
 
-<!-- 本文件是构建产物(pnpm run build:index),勿手改:树区文案改对应页面的 frontmatter title/description,导语改 INDEX.template.md(生成逻辑见 scripts/generate-reference.ts) -->
+<!-- 本文件是构建产物(pnpm run build:index),勿手改:树区文案改对应页面的 frontmatter title/description,导语改 INDEX.template.md(生成逻辑见 packages/repo-tools/src/docs/reference-compiler.ts) -->
 
 ## `docs-site/zh/tutorials/`
 
@@ -38,7 +38,7 @@
 - `docs-site/zh/tutorials/authoring.mdx` — 编写评估用例: 单轮、多轮和测试集模式:用 defineEval 编写评估用例，包括单轮对话、多轮对话、数据驱动测试、Sandbox Workspace 和评估的生命周期与 Fixture。
 - `docs-site/zh/tutorials/ci-integration.mdx` — 在 CI 中运行 NiceEval:让 CI 使用退出状态判定门禁，保留最后的 receipt，并向平台提供 JUnit 文件。
 - `docs-site/zh/tutorials/compare-runs.mdx` — 比较多个固定 Run:用明确 Run ID 固定比较分母，核对结果覆盖，再比较通过率、得分、成本与时长，而不让新结果改变已打开的比较。
-- `docs-site/zh/tutorials/concurrency.mdx` — 调好并发：吞吐、共享状态与固定执行顺序:全局并发位和实验自己的 maxConcurrency 是两级并发限制。这一页说明各自管什么、共享状态怎么串行、执行顺序怎么固定，以及多开一个终端为什么能加速。
+- `docs-site/zh/tutorials/concurrency.mdx` — 调好并发：吞吐、共享状态与固定执行顺序:全局并发、实验上限与 Provider capacity 共同限制实际吞吐。这一页说明排队状态、共享状态与固定顺序。
 - `docs-site/zh/tutorials/configuration.mdx` — 把配置和密钥各放到该放的地方:跑几次、超时、并发、judge 这些值写进代码的哪一层，API key 和 provider token 用哪些环境变量。
 - `docs-site/zh/tutorials/connect-otel.mdx` — OTel 接入:把应用已有的 OTel span 发送给 NiceEval，在 niceeval view 中查看每轮调用瀑布图。评估用例断言仍以 Send 返回的事件和用量为准。
 - `docs-site/zh/tutorials/connect-your-agent.mdx` — 接入你的 Agent:写一个 Adapter、配置一个 Experiment，并运行第一条评估用例。再把配置和参数从 Experiment 传给 Adapter 与被测应用。
@@ -46,7 +46,7 @@
 - `docs-site/zh/tutorials/criteria-files.mdx` — 隐藏测试判分：让判据文件进缓存 fingerprint:用 loadText 在模块顶层读入隐藏测试、跑测脚本等判据文件，文件内容进入 fingerprint：改一字节自动重跑，不靠人工 --rerun。
 - `docs-site/zh/tutorials/custom-reports.mdx` — 编写自定义报告:用内建统计口径写出第一个 Report，再添加自定义 Measure、详情 overlay 和项目默认配置。
 - `docs-site/zh/tutorials/dataset-fanout.mdx` — 数据驱动测试（dataset fan-out）：用多份数据运行同一套评估用例:从 .eval.ts 文件导出数组或 keyed record，将一套评估逻辑展开为多个 case。用 loadYaml 或 loadJson 读取外部测试集，并获得稳定 ID。
-- `docs-site/zh/tutorials/debug-lifecycle-plan.mdx` — 运行前检查生命周期计划:用 niceeval debug 查看一个 Experiment 与评估用例配对的 Plugin、Sandbox、Agent、Fixture 和 teardown 顺序，而不创建任何运行资源。
+- `docs-site/zh/tutorials/debug-lifecycle-plan.mdx` — 运行前检查 Sandbox 计划:用 niceeval debug 查看 Experiment、评估组、评估用例与 Agent 的实际 action 顺序和数值，而不创建运行资源。
 - `docs-site/zh/tutorials/deploy-report-site.mdx` — 部署静态报告站:将 view --out 生成的完整自包含报告目录部署到任意静态托管服务。
 - `docs-site/zh/tutorials/docker-in-docker.mdx` — 让 Sandbox 使用 Docker:根据任务信任边界选择 Docker socket、raw privileged DinD 或受管 rootless DinD，并为 Agent 准备 Docker CLI 与 daemon。
 - `docs-site/zh/tutorials/eval-groups.mdx` — 用评估组复用 Sandbox:用 defineEvalGroup 显式声明兼容成员：同组按稳定 ID 串行复用一台 Sandbox，不同组继续并行，并把公共准备放到正确的 Sandbox Layer。
@@ -56,14 +56,14 @@
 - `docs-site/zh/tutorials/handle-execution-failures.mdx` — 在基础设施失败时停止无效运行:读懂自动重试，为确定性故障声明影响范围，修复后继续未完成的评估。
 - `docs-site/zh/tutorials/install-custom-sandbox-agent.mdx` — 为自定义 Sandbox Agent 安装 CLI:用 ensure 和 installer 检查、安装并复检自定义 coding-agent CLI 的精确版本。
 - `docs-site/zh/tutorials/nixos-managed-dind.mdx` — 在 NixOS 上配置 Managed DinD:使用 NiceEval 的 NixOS module 部署 managed rootless Docker profile，并通过 doctor 验证宿主环境。
-- `docs-site/zh/tutorials/plugins.mdx` — 用 Plugin 组合生命周期:用 definePlugin 为实验、评估组、Sandbox 和评估组合多个生命周期。
+- `docs-site/zh/tutorials/plugins.mdx` — 用 Plugin 复用完整运行条件:用 definePlugin 组合宿主生命周期与 command-only SandboxLayer，并在多个 owner 之间复用。
 - `docs-site/zh/tutorials/publish-report.mdx` — 发布静态报告:用 view --out 导出可离线打开、与源 Record 脱离且包含全部页面的自包含报告站。
 - `docs-site/zh/tutorials/quickstart.mdx` — 为你的 Agent 项目设置评估:安装 NiceEval，写三个文件，10 分钟内对你自己的应用跑通第一条评估用例。
 - `docs-site/zh/tutorials/reporters.mdx` — 将当前运行接入外部系统:使用 Reporter、JUnit 和 receipt 把当前 Invocation 的信息交给外部系统，同时保持 Record 的所有权边界。
 - `docs-site/zh/tutorials/rerun-and-cache.mdx` — 重跑与沿用结果:查看每个 slot 会执行、自动采用还是由操作者接受，并理解这些关系怎样进入 Record。
 - `docs-site/zh/tutorials/sandbox-agent.mdx` — Sandbox Agent：评估 Claude Code、Codex 和 bub:使用 NiceEval 内置 agents 或自定义 adapter，在 Docker 或云端 sandbox 中运行 coding-agent CLI。
 - `docs-site/zh/tutorials/sandbox-providers.mdx` — Sandbox:官方 Sandbox Docker、Vercel 或 E2B Provider。通过预制快照加速评估
-- `docs-site/zh/tutorials/sandbox-reuse.mdx` — 复用 Sandbox：一批评估共用环境，公共准备只付一次:在 Experiment 里声明 sandboxReuse 让多条 Attempt 共用 Sandbox：写对四层生命周期、配好 lifetimeMs。准备代码做不到幂等重放时改用并发，不要复用。
+- `docs-site/zh/tutorials/sandbox-reuse.mdx` — 在一批评估中复用 Sandbox:在 Experiment 里声明 sandboxReuse 让多条 Attempt 共用 Sandbox，让 before/after 可安全重放，并配好 lifetimeMs。无法安全保留状态时改用并发。
 - `docs-site/zh/tutorials/select-and-preview.mdx` — 选择并预览运行范围:先列出 Experiment，再用路径、评估用例前缀和 tag 收窄范围，最后用 --dry 确认计划后再花费模型与 Sandbox 成本。
 - `docs-site/zh/tutorials/theming.mdx` — 报告外观与安全边界:用 Report theme token 调整外观，同时保留唯一的产品 CSS、离线阅读与 View shell 边界。
 - `docs-site/zh/tutorials/verify-judge.mdx` — 配置并验证 Judge:连接 OpenAI 兼容 Judge 网关，用一条最小评估真实预检和判分，再从结果区分配置缺失、网络失败与低质量输出。
@@ -79,7 +79,7 @@
 - `docs-site/zh/explanation/evals.mdx` — NiceEval 中的评估用例：生命周期、verdict 与文件:评估用例是一个测试用例：描述和 test 函数，agent-neutral。了解评估用例如何被发现、调度、评分和报告。
 - `docs-site/zh/explanation/experiment.mdx` — 实验（Experiment）：评谁、怎么跑:Experiment 是可签入的运行配置：同一批评估用例对着哪个 agent、哪个模型、开哪些 flags、跑几次。评估用例与 experiment 分开的原因——晚绑定，让同一份评估用例换着对象跑。
 - `docs-site/zh/explanation/hitl.mdx` — 人工介入（HITL）：停轮、回答、继续:什么是 Human-in-the-loop，Claude Code / Codex / AI SDK 应用里它长什么样。NiceEval 如何把它变成可评的路径——waiting 停轮、input.requested 说明在等什么、t.respond 替人回答后同一轮继续。
-- `docs-site/zh/explanation/judge.mdx` — NiceEval 里的 Judge：评开放式输出:用 t.judge 和 turn.judge 直接登记 Judge Assertion，再在同一 handle 上配置阈值或分数。
+- `docs-site/zh/explanation/judge.mdx` — NiceEval 里的 Judge：评开放式输出:用 `check({ input, output }, factory(...))` 登记 Judge Assertion，并配置阈值或分数。
 - `docs-site/zh/explanation/overview.mdx` — NiceEval 的评估与报告路径:理解 Experiment、Record、Analysis 与 Report 如何组成一次可查看、可分享的评估。
 - `docs-site/zh/explanation/record.mdx` — Record：已发布结果:理解 Record 如何保存已发布的 Run，以及如何安全地选择、查看和分享结果。
 - `docs-site/zh/explanation/runner.mdx` — Runner 如何执行评估:了解 Runner 怎样建立 Run、选择执行或采用 Attempt，并返回可供后续读取的 receipt。

package/dist/agents/provisioner.cjs

@@ -388,7 +388,7 @@ function sameIdentity(a, b) {
 function probeMatches(ensure, sandbox, context, phase) {
     return effect_1.Effect.tryPromise({
         try: () => Promise.resolve(ensure.probe(sandbox, {
-            phase: "prepare",
+            phase: "before",
             owner: { kind: "experiment", id: `agent.ensure/${ensure.identity.agent}` },
             attempt: { id: "agent.ensure", index: 0 },
             signal: context.signal,

package/dist/agents/provisioner.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["provisioner.ts"],"names":[],"mappings":";;;AAuEA,kEAeC;AAoDD,8DAWC;AAED,8DAmBC;AACD,kCAIC;AACD,4CAEC;AAOD,sDA4BC;AAED,0DAEC;AAsGD,wCAsHC;AArbD,gFAAgF;AAChF,0DAA0D;AAC1D,EAAE;AACF,gEAAgE;AAChE,yDAAyD;AACzD,qCAAkC;AAClC,yCAAiC;AACjC,mCAAsE;AACtE,+CAAqC;AAErC,4DAA+F;AAC/F,sDAAmE;AAGnE,oDAAoD;AACvC,QAAA,+BAA+B,GAAG,wBAAiC,CAAC;AAsCjF,wDAAwD;AACxD,MAAa,gBAAiB,SAAQ,aAAI,CAAC,WAAW,CAAC,kBAAkB,CAKvE;CACD;AAND,4CAMC;AACD,MAAa,8BAA+B,SAAQ,aAAI,CAAC,WAAW,CAAC,gCAAgC,CAOnG;CACD;AARD,wEAQC;AACD,yDAAyD;AACzD,SAAgB,2BAA2B,CAAC,OAA0B,EAAE,OAA8B;IAClG,OAAO,eAAM,CAAC,UAAU,CAAC;QACrB,GAAG,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC;QACzC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,8BAA8B,CAAC;YACjD,OAAO;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;YAC3D,OAAO,EAAE,yDAAyD,WAAW,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE;SACnH,CAAC;KACL,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC;QAC3E,CAAC,CAAC,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,IAAI,8BAA8B,CAAC;YAC7C,OAAO;YACP,MAAM;YACN,OAAO,EAAE,oBAAoB,WAAW,CAAC,MAAM,CAAC,kCAAkC,WAAW,CAAC,OAAO,CAAC,GAAG;SAC5G,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AACD,MAAM,wBAAwB,GAAG,eAAM,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,MAAM,CAAC;QACjC,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAC7B,EAAE,EAAE,eAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3B,IAAI,EAAE,eAAM,CAAC,qBAAqB;QAClC,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;KACtC,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC9B,EAAE,EAAE,eAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,IAAI,EAAE,eAAM,CAAC,qBAAqB;KACrC,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAC/B,EAAE,EAAE,eAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7B,IAAI,EAAE,eAAM,CAAC,qBAAqB;KACrC,CAAC,CAAC;IACH,OAAO,EAAE,eAAM,CAAC,OAAO;IACvB,UAAU,EAAE,eAAM,CAAC,qBAAqB;IACxC,OAAO,EAAE,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,eAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC;CAClL,CAAC,CAAC;AACH,SAAS,sBAAsB,CAAC,KAAc,EAAE,QAAuB,EAAE,cAAqC;IAC1G,OAAO,eAAM,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC;QAC9G,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,WAAW;QAClB,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;KACzB,CAAC,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC5B,IAAI,CAAC,IAAA,uCAA0B,EAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClF,OAAO,eAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;gBACpC,MAAM,EAAE,kBAAkB;gBAC1B,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,OAAO,EAAE,IAAA,YAAC,EAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;aAC9E,CAAC,CAAC,CAAC;QACR,CAAC;QACD,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;YAChE,OAAO,eAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;gBACpC,MAAM,EAAE,kBAAkB;gBAC1B,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,OAAO,EAAE,8BAA8B,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,sCAAsC,WAAW,CAAC,cAAc,CAAC,GAAG;aAC3I,CAAC,CAAC,CAAC;QACR,CAAC;QACD,OAAO,eAAM,CAAC,OAAO,CAAC;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AACD,qCAAqC;AACrC,SAAgB,yBAAyB,CAAC,QAAuB;IAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,mCAAmC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;AACL,CAAC;AACD,gEAAgE;AAChE,SAAgB,yBAAyB,CAAC,QAAuB,EAAE,QAA4D;IAO3H,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO;QACH,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,CAAC,QAAQ;YACR,CAAC,CAAC;gBACE,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;gBACvC,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACnD;YACD,CAAC,CAAC,EAAE,CAAC;KACZ,CAAC;AACN,CAAC;AACD,SAAgB,WAAW,CAAC,QAA+B;IACvD,OAAO,QAAQ,CAAC,EAAE,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QACzD,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE;QACpD,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AACD,SAAgB,gBAAgB,CAAC,QAAuB,EAAE,QAA+B;IACrF,OAAO,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClG,CAAC;AACD;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CAAC,OAA0B;IAClE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;QACjC,gCAAgC;QAChC,gCAAgC;QAChC,uDAAuD;QACvD,6FAA6F;KAChG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACd,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO;QAClD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO;YACxC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,EAAE,KAAK,OAAO;QACd,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1F,IAAI,EAAE,KAAK,QAAQ;QACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACzG,CAAC;AACD,wDAAwD;AACxD,SAAgB,uBAAuB;IACnC,OAAO,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;AACpE,CAAC;AACD;;;;GAIG;AACH,MAAa,0BAA0B;IAClB,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC/C,QAAQ,GAAG,IAAI,GAAG,EAAoE,CAAC;IACvF,MAAM,CAAwC;IAC/D,YAAY,MAAkC;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IACD,4BAA4B;IAC5B,IAAI,CAAC,QAAuB,EAAE,QAA+B;QACzD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,eAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,SAEN,EAAE,QAA+B,EAAE,MAAmB;QACpD,MAAM,GAAG,GAAG,gBAAgB,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3D,OAAO,eAAM,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;YACrE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,iBAAQ,CAAC,IAAI,EAAyC,CAAC;YAC5E,uDAAuD;YACvD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,MAAM,KAAK,SAAS;oBACpB,OAAO,EAAE,IAAI,EAAE,QAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBACzD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,OAAO,KAAK,SAAS;oBACrB,OAAO,EAAE,IAAI,EAAE,UAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;gBAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC9B,OAAO,EAAE,IAAI,EAAE,QAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACxD,CAAC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;gBACxB,OAAO,MAAM,CAAC,QAAQ,CAAC;YAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;gBAC1B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,iBAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3D,sEAAsE;YACtE,4DAA4D;YAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvH,KAAK,CAAC,CAAC,iBAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC5C,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACpB,IAAI,aAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBACpB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,QAAQ;oBAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,CAAC,iBAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC,CAAC;IACR,CAAC;IACO,eAAe,CAAC,SAEtB,EAAE,QAA+B,EAAE,MAAmB,EAAE,QAAgB;QACtE,MAAM,QAAQ,GAAG,eAAM,CAAC,UAAU,CAAC;YAC/B,yDAAyD;YACzD,gFAAgF;YAChF,GAAG,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC;gBAC9D,cAAc,EAAE,QAAQ;gBACxB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;aACnD,CAAC,CAAC;YACH,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC;gBACnC,MAAM,EAAE,yBAAyB;gBACjC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,OAAO,EAAE,iBAAiB,CAAC;oBACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;iBAC1C,CAAC;aACL,CAAC;SACL,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtG,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS;YAC5B,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uCAA+B,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChI,CAAC;CACJ;AAvED,gEAuEC;AACD,SAAS,iBAAiB,CAAC,IAM1B;IACG,OAAO,IAAA,YAAC,EAAC,qBAAqB,EAAE;QAC5B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;QAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC/B,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE;QACjC,IAAI,EAAE,IAAI,CAAC,KAAK,KAAK,aAAa;YAC9B,CAAC,CAAC,IAAA,YAAC,EAAC,6BAA6B,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW;gBACxB,CAAC,CAAC,IAAA,YAAC,EAAC,mCAAmC,CAAC;gBACxC,CAAC,CAAC,IAAA,YAAC,EAAC,0BAA0B,CAAC;KAC1C,CAAC,CAAC;AACP,CAAC;AACD;;;GAGG;AACH,SAAgB,cAAc,CAAC,OAA+B,EAAE,UAAqC,EAAE,OAA0B,EAAE,OAA2B;IAC1J,MAAM,MAAM,GAAG,IAAA,0CAA0B,EAAC,OAAO,CAAC,CAAC;IACnD,OAAO,eAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,KAAK,CAAC,CAAC,eAAM,CAAC,GAAG,CAAC;gBACd,GAAG,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACrD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC;oBACnC,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC/B,CAAC;aACL,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAClE,IAAI,GAAG,EAAE,CAAC;gBACN,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;oBACvC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC5D,SAAS;YACb,CAAC;YACD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpG,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;oBAC/B,MAAM,EAAE,mBAAmB;oBAC3B,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;iBAChF,CAAC,CAAC;YACP,CAAC;YACD,IAAI,SAAS,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;oBAC/B,MAAM,EAAE,aAAa;oBACrB,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;iBAClF,CAAC,CAAC;YACP,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;YACxC,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC5F,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;oBAC/B,MAAM,EAAE,sBAAsB;oBAC9B,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,qBAAqB,WAAW,CAAC,QAAQ,CAAC,GAAG;iBAChI,CAAC,CAAC;YACP,CAAC;YACD,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACrC,IAAI,SAAS,CAAC,QAAQ,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC/C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;oBACzD,MAAM,EAAE,GAAG,EAAE,CAAC,eAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;wBAC3C,MAAM,EAAE,qBAAqB;wBAC7B,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,OAAO,EAAE,wDAAwD,MAAM,CAAC,QAAQ,CAAC,KAAK,GAAG;qBAC5F,CAAC,CAAC;oBACH,MAAM,EAAE,eAAM,CAAC,OAAO;iBACzB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACjF,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE;oBAC3D,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,cAAc,EAAE,QAAQ;oBACxB,QAAQ;oBACR,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC7B,CAAC,CAAC,CAAC;gBACJ,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;oBAC7D,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;oBACvC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACT,OAAO,EAAE,WAAW;oBACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,QAAQ;oBACrB,cAAc,EAAE,QAAQ;oBACxB,QAAQ;iBACX,CAAC,CAAC;YACP,CAAC;iBACI,CAAC;gBACF,IAAI,SAAS,CAAC,QAAQ,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC/C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBACjE,CAAC;gBACD,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE;oBAC3D,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,cAAc,EAAE,QAAQ;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC7B,CAAC,CAAC,CAAC;gBACJ,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;oBAC7D,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;oBACvC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACT,OAAO,EAAE,WAAW;oBACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,iBAAiB;oBAC9B,cAAc,EAAE,QAAQ;iBAC3B,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC,CAAC,CAAC;AACP,CAAC;AACD,SAAS,YAAY,CAAC,CAAgB,EAAE,CAAgB;IACpD,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC;AACvF,CAAC;AACD,SAAS,YAAY,CAAC,MAAmB,EAAE,OAA6B,EAAE,OAA2B,EAAE,KAA0B;IAC7H,OAAO,eAAM,CAAC,UAAU,CAAC;QACrB,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;YAC7C,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,gBAAgB,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE;YAC1E,OAAO,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE;YACzC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC;YACrB,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC;SACS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACpD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;KAC1B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,uCAAuB;QACvE,CAAC,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACvB,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;YAC/B,MAAM,EAAE,cAAc;YACtB,KAAK;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE;SAChG,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AACD,SAAS,YAAY,CAAC,SAEpB,EAAE,OAAmC;IACnC,OAAO,eAAM,CAAC,UAAU,CAAC;QACrB,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC;YACnC,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,OAAO,EAAE,iBAAiB,CAAC;gBACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;aAC1C,CAAC;SACL,CAAC;KACL,CAAC,CAAC;AACP,CAAC;AACD,SAAS,aAAa,CAAC,QAAuB;IAC1C,OAAO,IAAI,gBAAgB,CAAC;QACxB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,SAAS;QAChB,QAAQ;QACR,OAAO,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;KAC7D,CAAC,CAAC;AACP,CAAC;AACD,SAAS,YAAY,CAAC,KAAc;IAChC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC","sourcesContent":["// Agent Ensure 协议实现:probe → 缺失时按 identity 配对 installer → install → 同一 probe 复检。\n// 契约单源:docs/feature/adapters/architecture/agent-ensure.md\n//\n// Runner 接线(run.ts / attempt.ts)由串行合流节点完成;本模块导出可调用的 Ensure API、\n// Run 级 prepare single-flight 协调器,以及给 configHash 用的身份投影。\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { Data, Deferred, Effect, Exit, Option, Schema } from \"effect\";\nimport { t } from \"../i18n/index.ts\";\nimport type { SandboxOperations } from \"../sandbox/types.ts\";\nimport { createSandboxCommandTarget, SandboxCommandExitError } from \"../sandbox/operations.ts\";\nimport { isRegisteredSandboxContent } from \"../sandbox/content.ts\";\nimport type { SandboxCommandContext, SandboxCommandTarget } from \"../sandbox/commands.ts\";\nimport type { AgentArtifactPlatform, AgentEnsure, AgentIdentity, AgentInstaller, AgentStagedArtifact, } from \"./types.ts\";\n/** Run 级开放 activity key;落盘形状由 Record timing 线拥有。 */\nexport const AGENT_ARTIFACT_PREPARE_ACTIVITY = \"agent.artifact.prepare\" as const;\n/**\n * Timing recorder 钩子:Record 线尚未合流时可为 no-op / 注入测试观察器。\n * Runner 接线后传入真实 Run 级 recorder,把 prepare 记为 `agent.artifact.prepare`。\n */\nexport interface ArtifactPrepareTimingHook {\n    activity<A, E, R>(key: typeof AGENT_ARTIFACT_PREPARE_ACTIVITY, attrs: {\n        identity: AgentIdentity;\n        platform: AgentArtifactPlatform;\n        cacheKey: string;\n    }, run: Effect.Effect<A, E, R>): Effect.Effect<A, E, R>;\n}\nexport interface AgentEnsureContext {\n    /** Run 级 prepare 协调器;多 attempt 应共享同一实例。 */\n    readonly coordinator: Option.Option<ArtifactPrepareCoordinator>;\n    /** ProviderPlan 已经确定的目标平台；实际 uname/ldd 只负责验证它，不反向决定制品。 */\n    readonly targetPlatform: AgentArtifactPlatform;\n    readonly signal: AbortSignal;\n    progress(update: {\n        message: string;\n    }): void;\n}\nexport type AgentEnsureResult = {\n    readonly outcome: \"hit\";\n    readonly identity: AgentIdentity;\n} | {\n    readonly outcome: \"installed\";\n    readonly identity: AgentIdentity;\n    readonly installMode: \"staged\";\n    readonly targetPlatform: AgentArtifactPlatform;\n    readonly artifact: AgentStagedArtifact;\n} | {\n    readonly outcome: \"installed\";\n    readonly identity: AgentIdentity;\n    readonly installMode: \"sandbox-network\";\n    readonly targetPlatform: AgentArtifactPlatform;\n};\nexport type AgentEnsureFailureReason = \"coordinator-missing\" | \"probe-failed\" | \"installer-missing\" | \"verify-only\" | \"platform-detect-failed\" | \"platform-unsupported\" | \"artifact-prepare-failed\" | \"artifact-invalid\" | \"install-failed\" | \"recheck-missed\";\n/** Runner 的 agent.ensure 失败通道；attempt 层只消费这一种具名 ADT。 */\nexport class AgentEnsureError extends Data.TaggedError(\"AgentEnsureError\")<{\n    readonly reason: AgentEnsureFailureReason;\n    readonly phase: \"probe\" | \"installer\" | \"install\" | \"recheck\";\n    readonly identity: AgentIdentity;\n    readonly message: string;\n}> {\n}\nexport class SandboxTargetVerificationError extends Data.TaggedError(\"SandboxTargetVerificationError\")<{\n    readonly planned: AgentArtifactPlatform;\n    readonly actual: AgentArtifactPlatform | {\n        readonly _tag: \"Unreadable\";\n        readonly detail: string;\n    };\n    readonly message: string;\n}> {\n}\n/** Sandbox create 后的单一平台核验；planning 决定目标，本函数不得反向改写计划。 */\nexport function verifySandboxTargetPlatform(sandbox: SandboxOperations, planned: AgentArtifactPlatform): Effect.Effect<AgentArtifactPlatform, SandboxTargetVerificationError> {\n    return Effect.tryPromise({\n        try: () => detectSandboxPlatform(sandbox),\n        catch: (cause) => new SandboxTargetVerificationError({\n            planned,\n            actual: { _tag: \"Unreadable\", detail: errorMessage(cause) },\n            message: `Cannot verify Sandbox platform against planned target ${platformKey(planned)}: ${errorMessage(cause)}`,\n        }),\n    }).pipe(Effect.flatMap((actual) => platformKey(actual) === platformKey(planned)\n        ? Effect.succeed(actual)\n        : Effect.fail(new SandboxTargetVerificationError({\n            planned,\n            actual,\n            message: `Sandbox platform ${platformKey(actual)} does not match planned target ${platformKey(planned)}.`,\n        }))));\n}\nconst AgentStagedArtifactShape = Schema.Struct({\n    platform: Schema.Union(Schema.Struct({\n        _tag: Schema.Literal(\"Linux\"),\n        os: Schema.Literal(\"linux\"),\n        arch: Schema.NonEmptyTrimmedString,\n        libc: Schema.Literal(\"gnu\", \"musl\"),\n    }), Schema.Struct({\n        _tag: Schema.Literal(\"Darwin\"),\n        os: Schema.Literal(\"darwin\"),\n        arch: Schema.NonEmptyTrimmedString,\n    }), Schema.Struct({\n        _tag: Schema.Literal(\"Windows\"),\n        os: Schema.Literal(\"windows\"),\n        arch: Schema.NonEmptyTrimmedString,\n    })),\n    content: Schema.Unknown,\n    targetPath: Schema.NonEmptyTrimmedString,\n    install: Schema.Union(Schema.Struct({ kind: Schema.Literal(\"npm-tarball\") }), Schema.Struct({ kind: Schema.Literal(\"self-contained\"), binPath: Schema.NonEmptyTrimmedString })),\n});\nfunction decodePreparedArtifact(value: unknown, identity: AgentIdentity, targetPlatform: AgentArtifactPlatform): Effect.Effect<AgentStagedArtifact, AgentEnsureError> {\n    return Schema.decodeUnknown(AgentStagedArtifactShape)(value).pipe(Effect.mapError((cause) => new AgentEnsureError({\n        reason: \"artifact-invalid\",\n        phase: \"installer\",\n        identity,\n        message: String(cause),\n    })), Effect.flatMap((decoded) => {\n        if (!isRegisteredSandboxContent(decoded.content) || decoded.content.kind !== \"file\") {\n            return Effect.fail(new AgentEnsureError({\n                reason: \"artifact-invalid\",\n                phase: \"installer\",\n                identity,\n                message: t(\"agent.ensure.artifactMissingDigest\", { agent: identity.agent }),\n            }));\n        }\n        if (platformKey(decoded.platform) !== platformKey(targetPlatform)) {\n            return Effect.fail(new AgentEnsureError({\n                reason: \"artifact-invalid\",\n                phase: \"installer\",\n                identity,\n                message: `Prepared artifact platform ${platformKey(decoded.platform)} does not match requested platform ${platformKey(targetPlatform)}.`,\n            }));\n        }\n        return Effect.succeed({\n            platform: decoded.platform,\n            content: decoded.content,\n            targetPath: decoded.targetPath,\n            install: decoded.install,\n        });\n    }));\n}\n/** 拒绝无精确版本的身份;`latest` / 空串启动期报错。 */\nexport function assertStableAgentIdentity(identity: AgentIdentity): void {\n    const version = identity.version.trim();\n    if (!identity.agent.trim()) {\n        throw new Error(t(\"agent.ensure.identityMissingAgent\"));\n    }\n    if (!version || version.toLowerCase() === \"latest\" || version.includes(\"*\")) {\n        throw new Error(t(\"agent.ensure.unstableVersion\", { agent: identity.agent, version: identity.version }));\n    }\n    if (!identity.revision.trim()) {\n        throw new Error(t(\"agent.ensure.identityMissingRevision\", { agent: identity.agent }));\n    }\n}\n/** identity (+ 可选制品 digest/platform) → 指纹 / configHash 输入投影。 */\nexport function agentInstallIdentityInput(identity: AgentIdentity, artifact?: Pick<AgentStagedArtifact, \"content\" | \"platform\">): {\n    agent: string;\n    version: string;\n    revision: string;\n    artifactDigest?: string;\n    artifactPlatform?: string;\n} {\n    assertStableAgentIdentity(identity);\n    return {\n        agent: identity.agent,\n        version: identity.version,\n        revision: identity.revision,\n        ...(artifact\n            ? {\n                artifactDigest: artifact.content.digest,\n                artifactPlatform: platformKey(artifact.platform),\n            }\n            : {}),\n    };\n}\nexport function platformKey(platform: AgentArtifactPlatform): string {\n    return platform.os === \"linux\" && platform.libc !== undefined\n        ? `${platform.os}-${platform.arch}-${platform.libc}`\n        : `${platform.os}-${platform.arch}`;\n}\nexport function artifactCacheKey(identity: AgentIdentity, platform: AgentArtifactPlatform): string {\n    return `${identity.agent}@${identity.version}+r${identity.revision}|${platformKey(platform)}`;\n}\n/**\n * 从主 Sandbox 探测 staged payload 的**目标**平台。\n *\n * 制品要装进沙箱,不是装进宿主:cache key 与下载内容都必须按沙箱的 os / arch / libc 取。\n * 宿主 macOS-arm64 起一个 linux-x64 容器是常态,拿宿主平台去 prepare 会准备出跑不了的二进制。\n */\nexport async function detectSandboxPlatform(sandbox: SandboxOperations): Promise<AgentArtifactPlatform> {\n    const probe = await sandbox.runShell([\n        \"printf '%s\\\\n' \\\"$(uname -s)\\\"\",\n        \"printf '%s\\\\n' \\\"$(uname -m)\\\"\",\n        // musl 的 ldd 把版本写在 stderr;两条流都看,认不出就留空,由调用方决定要不要 libc。\n        \"if command -v ldd >/dev/null 2>&1; then ldd --version 2>&1 | head -1; else printf '\\\\n'; fi\",\n    ].join(\"\\n\"));\n    if (probe.exitCode !== 0) {\n        throw new Error(t(\"agent.ensure.platformDetectFailed\", { tail: (probe.stdout + probe.stderr).trim().slice(0, 200) }));\n    }\n    const [unameS = \"\", unameM = \"\", ldd = \"\"] = probe.stdout.split(\"\\n\").map((line) => line.trim());\n    const os = unameS.toLowerCase();\n    const arch = unameM === \"x86_64\" || unameM === \"amd64\"\n        ? \"x64\"\n        : unameM === \"aarch64\" || unameM === \"arm64\"\n            ? \"arm64\"\n            : unameM;\n    if (!os || !arch) {\n        throw new Error(t(\"agent.ensure.platformDetectFailed\", { tail: probe.stdout.trim().slice(0, 200) }));\n    }\n    if (os === \"linux\")\n        return { _tag: \"Linux\", os: \"linux\", arch, libc: /musl/i.test(ldd) ? \"musl\" : \"gnu\" };\n    if (os === \"darwin\")\n        return { _tag: \"Darwin\", os: \"darwin\", arch };\n    if (os === \"windows\" || os.startsWith(\"mingw\") || os.startsWith(\"msys\")) {\n        return { _tag: \"Windows\", os: \"windows\", arch };\n    }\n    throw new Error(t(\"agent.ensure.platformDetectFailed\", { tail: probe.stdout.trim().slice(0, 200) }));\n}\n/** 默认宿主 cache 根:`~/.cache/niceeval/agent-artifacts`。 */\nexport function defaultArtifactCacheDir(): string {\n    return join(homedir(), \".cache\", \"niceeval\", \"agent-artifacts\");\n}\n/**\n * Run 级 staged payload single-flight / cache。\n * 多个 attempt 共享同一 coordinator 实例;prepare 时间经 timing hook 记 `agent.artifact.prepare`。\n * coordinator 不 fork detached fiber:每个 Deferred 只从同步登记存活到同一终局 Exit 发布并清理。\n */\nexport class ArtifactPrepareCoordinator {\n    private readonly cache = new Map<string, AgentStagedArtifact>();\n    private readonly inflight = new Map<string, Deferred.Deferred<AgentStagedArtifact, AgentEnsureError>>();\n    private readonly timing: ArtifactPrepareTimingHook | undefined;\n    constructor(timing?: ArtifactPrepareTimingHook) {\n        this.timing = timing;\n    }\n    /** 已缓存的制品;没有则 undefined。 */\n    peek(identity: AgentIdentity, platform: AgentArtifactPlatform): Effect.Effect<AgentStagedArtifact | undefined> {\n        const key = artifactCacheKey(identity, platform);\n        return Effect.sync(() => this.cache.get(key));\n    }\n    prepare(installer: Extract<AgentInstaller, {\n        installMode: \"staged\";\n    }>, platform: AgentArtifactPlatform, signal: AbortSignal): Effect.Effect<AgentStagedArtifact, AgentEnsureError> {\n        const key = artifactCacheKey(installer.identity, platform);\n        return Effect.uninterruptibleMask((restore) => Effect.gen(this, function* () {\n            const fresh = yield* Deferred.make<AgentStagedArtifact, AgentEnsureError>();\n            // Map 的读写只在同步 Effect 中做:同 key 的并发 fiber 只会选出一个 leader。\n            const flight = yield* Effect.sync(() => {\n                const cached = this.cache.get(key);\n                if (cached !== undefined)\n                    return { _tag: \"Cached\" as const, artifact: cached };\n                const pending = this.inflight.get(key);\n                if (pending !== undefined)\n                    return { _tag: \"Follower\" as const, deferred: pending };\n                this.inflight.set(key, fresh);\n                return { _tag: \"Leader\" as const, deferred: fresh };\n            });\n            if (flight._tag === \"Cached\")\n                return flight.artifact;\n            if (flight._tag === \"Follower\")\n                return yield* restore(Deferred.await(flight.deferred));\n            // 从登记到完成/清理都处在 mask 内。restore 的 typed failure / defect / interruption\n            // 都先保留为 Exit，再发布给所有 follower，避免 leader 中断留下永远未完成的 Deferred。\n            const exit = yield* Effect.exit(restore(Effect.suspend(() => this.prepareArtifact(installer, platform, signal, key))));\n            yield* Deferred.done(flight.deferred, exit);\n            yield* Effect.sync(() => {\n                if (Exit.isSuccess(exit))\n                    this.cache.set(key, exit.value);\n                if (this.inflight.get(key) === flight.deferred)\n                    this.inflight.delete(key);\n            });\n            return yield* Deferred.await(flight.deferred);\n        }));\n    }\n    private prepareArtifact(installer: Extract<AgentInstaller, {\n        installMode: \"staged\";\n    }>, platform: AgentArtifactPlatform, signal: AbortSignal, cacheKey: string): Effect.Effect<AgentStagedArtifact, AgentEnsureError> {\n        const prepared = Effect.tryPromise({\n            // Node 24 的 AbortSignal.any 保留数组中第一个已中断 signal 的 reason。\n            // 调用方 signal 排在前面，Effect runtime signal 则确保 fiber interruption 能取消 SDK Promise。\n            try: (runtimeSignal) => Promise.resolve(installer.prepareArtifact({\n                targetPlatform: platform,\n                signal: AbortSignal.any([signal, runtimeSignal]),\n            })),\n            catch: (cause) => new AgentEnsureError({\n                reason: \"artifact-prepare-failed\",\n                phase: \"installer\",\n                identity: installer.identity,\n                message: formatEnsureError({\n                    identity: installer.identity,\n                    phase: \"installer\",\n                    result: { detail: errorMessage(cause) },\n                }),\n            }),\n        }).pipe(Effect.flatMap((artifact) => decodePreparedArtifact(artifact, installer.identity, platform)));\n        return this.timing === undefined\n            ? prepared\n            : this.timing.activity(AGENT_ARTIFACT_PREPARE_ACTIVITY, { identity: installer.identity, platform, cacheKey }, prepared);\n    }\n}\nfunction formatEnsureError(opts: {\n    identity: AgentIdentity;\n    phase: \"probe\" | \"recheck\" | \"verify-only\" | \"installer\";\n    result?: {\n        detail?: string;\n    };\n}): string {\n    return t(\"agent.ensure.failed\", {\n        agent: opts.identity.agent,\n        expected: opts.identity.version,\n        actual: \"(none)\",\n        phase: opts.phase,\n        detail: opts.result?.detail ?? \"\",\n        next: opts.phase === \"verify-only\"\n            ? t(\"agent.ensure.nextVerifyOnly\")\n            : opts.phase === \"installer\"\n                ? t(\"agent.ensure.nextInstallerMissing\")\n                : t(\"agent.ensure.nextRecheck\"),\n    });\n}\n/**\n * Runner 唯一调用的 Ensure 循环。Adapter 只声明 probe，不能在 setup 内自行绕过。\n * 不改题面网络、不按 template 名短路、三种模式失败后不静默降级。\n */\nexport function runAgentEnsure(ensures: readonly AgentEnsure[], installers: readonly AgentInstaller[], sandbox: SandboxOperations, context: AgentEnsureContext): Effect.Effect<readonly AgentEnsureResult[], AgentEnsureError> {\n    const target = createSandboxCommandTarget(sandbox);\n    return Effect.gen(function* () {\n        const results: AgentEnsureResult[] = [];\n        for (const ensure of ensures) {\n            yield* Effect.try({\n                try: () => assertStableAgentIdentity(ensure.identity),\n                catch: (cause) => new AgentEnsureError({\n                    reason: \"probe-failed\",\n                    phase: \"probe\",\n                    identity: ensure.identity,\n                    message: errorMessage(cause),\n                }),\n            });\n            if (ensure.progress?.checking !== undefined) {\n                context.progress({ message: ensure.progress.checking });\n            }\n            const hit = yield* probeMatches(ensure, target, context, \"probe\");\n            if (hit) {\n                if (ensure.progress?.ready !== undefined) {\n                    context.progress({ message: ensure.progress.ready });\n                }\n                results.push({ outcome: \"hit\", identity: ensure.identity });\n                continue;\n            }\n            const installer = installers.find((candidate) => sameIdentity(candidate.identity, ensure.identity));\n            if (installer === undefined) {\n                return yield* new AgentEnsureError({\n                    reason: \"installer-missing\",\n                    phase: \"installer\",\n                    identity: ensure.identity,\n                    message: formatEnsureError({ identity: ensure.identity, phase: \"installer\" }),\n                });\n            }\n            if (installer.installMode === \"verify-only\") {\n                return yield* new AgentEnsureError({\n                    reason: \"verify-only\",\n                    phase: \"installer\",\n                    identity: ensure.identity,\n                    message: formatEnsureError({ identity: ensure.identity, phase: \"verify-only\" }),\n                });\n            }\n            const platform = context.targetPlatform;\n            if (installer.platforms !== undefined && !installer.platforms.includes(platformKey(platform))) {\n                return yield* new AgentEnsureError({\n                    reason: \"platform-unsupported\",\n                    phase: \"installer\",\n                    identity: ensure.identity,\n                    message: `Agent installer for ${ensure.identity.agent}@${ensure.identity.version} does not support ${platformKey(platform)}.`,\n                });\n            }\n            if (installer.installMode === \"staged\") {\n                if (installer.progress?.installing !== undefined) {\n                    context.progress({ message: installer.progress.installing });\n                }\n                const coordinator = yield* Option.match(context.coordinator, {\n                    onNone: () => Effect.fail(new AgentEnsureError({\n                        reason: \"coordinator-missing\",\n                        phase: \"installer\",\n                        identity: ensure.identity,\n                        message: `Run-level ArtifactPrepareCoordinator is required for ${ensure.identity.agent}.`,\n                    })),\n                    onSome: Effect.succeed,\n                });\n                const artifact = yield* coordinator.prepare(installer, platform, context.signal);\n                yield* runInstaller(installer, () => installer.install(target, {\n                    identity: ensure.identity,\n                    targetPlatform: platform,\n                    artifact,\n                    signal: context.signal,\n                    progress: context.progress,\n                }));\n                if (ensure.progress?.checking !== undefined) {\n                    context.progress({ message: ensure.progress.checking });\n                }\n                if (!(yield* probeMatches(ensure, target, context, \"recheck\"))) {\n                    return yield* recheckMissed(ensure.identity);\n                }\n                if (ensure.progress?.ready !== undefined) {\n                    context.progress({ message: ensure.progress.ready });\n                }\n                results.push({\n                    outcome: \"installed\",\n                    identity: ensure.identity,\n                    installMode: \"staged\",\n                    targetPlatform: platform,\n                    artifact,\n                });\n            }\n            else {\n                if (installer.progress?.installing !== undefined) {\n                    context.progress({ message: installer.progress.installing });\n                }\n                yield* runInstaller(installer, () => installer.install(target, {\n                    identity: ensure.identity,\n                    targetPlatform: platform,\n                    signal: context.signal,\n                    progress: context.progress,\n                }));\n                if (ensure.progress?.checking !== undefined) {\n                    context.progress({ message: ensure.progress.checking });\n                }\n                if (!(yield* probeMatches(ensure, target, context, \"recheck\"))) {\n                    return yield* recheckMissed(ensure.identity);\n                }\n                if (ensure.progress?.ready !== undefined) {\n                    context.progress({ message: ensure.progress.ready });\n                }\n                results.push({\n                    outcome: \"installed\",\n                    identity: ensure.identity,\n                    installMode: \"sandbox-network\",\n                    targetPlatform: platform,\n                });\n            }\n        }\n        return results;\n    });\n}\nfunction sameIdentity(a: AgentIdentity, b: AgentIdentity): boolean {\n    return a.agent === b.agent && a.version === b.version && a.revision === b.revision;\n}\nfunction probeMatches(ensure: AgentEnsure, sandbox: SandboxCommandTarget, context: AgentEnsureContext, phase: \"probe\" | \"recheck\"): Effect.Effect<boolean, AgentEnsureError> {\n    return Effect.tryPromise({\n        try: () => Promise.resolve(ensure.probe(sandbox, {\n            phase: \"prepare\",\n            owner: { kind: \"experiment\", id: `agent.ensure/${ensure.identity.agent}` },\n            attempt: { id: \"agent.ensure\", index: 0 },\n            signal: context.signal,\n            progress: context.progress,\n            diagnostic: () => { },\n            onCleanup: () => { },\n        } satisfies SandboxCommandContext)).then(() => true),\n        catch: (cause) => cause,\n    }).pipe(Effect.catchAll((cause) => cause instanceof SandboxCommandExitError\n        ? Effect.succeed(false)\n        : Effect.fail(new AgentEnsureError({\n            reason: \"probe-failed\",\n            phase,\n            identity: ensure.identity,\n            message: `${formatEnsureError({ identity: ensure.identity, phase })}: ${errorMessage(cause)}`,\n        }))));\n}\nfunction runInstaller(installer: Exclude<AgentInstaller, {\n    installMode: \"verify-only\";\n}>, install: () => void | Promise<void>): Effect.Effect<void, AgentEnsureError> {\n    return Effect.tryPromise({\n        try: () => Promise.resolve(install()),\n        catch: (cause) => new AgentEnsureError({\n            reason: \"install-failed\",\n            phase: \"install\",\n            identity: installer.identity,\n            message: formatEnsureError({\n                identity: installer.identity,\n                phase: \"recheck\",\n                result: { detail: errorMessage(cause) },\n            }),\n        }),\n    });\n}\nfunction recheckMissed(identity: AgentIdentity): AgentEnsureError {\n    return new AgentEnsureError({\n        reason: \"recheck-missed\",\n        phase: \"recheck\",\n        identity,\n        message: formatEnsureError({ identity, phase: \"recheck\" }),\n    });\n}\nfunction errorMessage(cause: unknown): string {\n    return cause instanceof Error ? cause.message : String(cause);\n}\n"]}
+{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["provisioner.ts"],"names":[],"mappings":";;;AAuEA,kEAeC;AAoDD,8DAWC;AAED,8DAmBC;AACD,kCAIC;AACD,4CAEC;AAOD,sDA4BC;AAED,0DAEC;AAsGD,wCAsHC;AArbD,gFAAgF;AAChF,0DAA0D;AAC1D,EAAE;AACF,gEAAgE;AAChE,yDAAyD;AACzD,qCAAkC;AAClC,yCAAiC;AACjC,mCAAsE;AACtE,+CAAqC;AAErC,4DAA+F;AAC/F,sDAAmE;AAGnE,oDAAoD;AACvC,QAAA,+BAA+B,GAAG,wBAAiC,CAAC;AAsCjF,wDAAwD;AACxD,MAAa,gBAAiB,SAAQ,aAAI,CAAC,WAAW,CAAC,kBAAkB,CAKvE;CACD;AAND,4CAMC;AACD,MAAa,8BAA+B,SAAQ,aAAI,CAAC,WAAW,CAAC,gCAAgC,CAOnG;CACD;AARD,wEAQC;AACD,yDAAyD;AACzD,SAAgB,2BAA2B,CAAC,OAA0B,EAAE,OAA8B;IAClG,OAAO,eAAM,CAAC,UAAU,CAAC;QACrB,GAAG,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC;QACzC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,8BAA8B,CAAC;YACjD,OAAO;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;YAC3D,OAAO,EAAE,yDAAyD,WAAW,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE;SACnH,CAAC;KACL,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC;QAC3E,CAAC,CAAC,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,IAAI,8BAA8B,CAAC;YAC7C,OAAO;YACP,MAAM;YACN,OAAO,EAAE,oBAAoB,WAAW,CAAC,MAAM,CAAC,kCAAkC,WAAW,CAAC,OAAO,CAAC,GAAG;SAC5G,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AACD,MAAM,wBAAwB,GAAG,eAAM,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,MAAM,CAAC;QACjC,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAC7B,EAAE,EAAE,eAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3B,IAAI,EAAE,eAAM,CAAC,qBAAqB;QAClC,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;KACtC,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC9B,EAAE,EAAE,eAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,IAAI,EAAE,eAAM,CAAC,qBAAqB;KACrC,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAC/B,EAAE,EAAE,eAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7B,IAAI,EAAE,eAAM,CAAC,qBAAqB;KACrC,CAAC,CAAC;IACH,OAAO,EAAE,eAAM,CAAC,OAAO;IACvB,UAAU,EAAE,eAAM,CAAC,qBAAqB;IACxC,OAAO,EAAE,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,eAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC;CAClL,CAAC,CAAC;AACH,SAAS,sBAAsB,CAAC,KAAc,EAAE,QAAuB,EAAE,cAAqC;IAC1G,OAAO,eAAM,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC;QAC9G,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,WAAW;QAClB,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;KACzB,CAAC,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC5B,IAAI,CAAC,IAAA,uCAA0B,EAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClF,OAAO,eAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;gBACpC,MAAM,EAAE,kBAAkB;gBAC1B,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,OAAO,EAAE,IAAA,YAAC,EAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;aAC9E,CAAC,CAAC,CAAC;QACR,CAAC;QACD,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;YAChE,OAAO,eAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;gBACpC,MAAM,EAAE,kBAAkB;gBAC1B,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,OAAO,EAAE,8BAA8B,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,sCAAsC,WAAW,CAAC,cAAc,CAAC,GAAG;aAC3I,CAAC,CAAC,CAAC;QACR,CAAC;QACD,OAAO,eAAM,CAAC,OAAO,CAAC;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AACD,qCAAqC;AACrC,SAAgB,yBAAyB,CAAC,QAAuB;IAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,mCAAmC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;AACL,CAAC;AACD,gEAAgE;AAChE,SAAgB,yBAAyB,CAAC,QAAuB,EAAE,QAA4D;IAO3H,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO;QACH,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,CAAC,QAAQ;YACR,CAAC,CAAC;gBACE,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;gBACvC,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACnD;YACD,CAAC,CAAC,EAAE,CAAC;KACZ,CAAC;AACN,CAAC;AACD,SAAgB,WAAW,CAAC,QAA+B;IACvD,OAAO,QAAQ,CAAC,EAAE,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QACzD,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE;QACpD,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AACD,SAAgB,gBAAgB,CAAC,QAAuB,EAAE,QAA+B;IACrF,OAAO,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClG,CAAC;AACD;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CAAC,OAA0B;IAClE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;QACjC,gCAAgC;QAChC,gCAAgC;QAChC,uDAAuD;QACvD,6FAA6F;KAChG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACd,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO;QAClD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO;YACxC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,EAAE,KAAK,OAAO;QACd,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1F,IAAI,EAAE,KAAK,QAAQ;QACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACzG,CAAC;AACD,wDAAwD;AACxD,SAAgB,uBAAuB;IACnC,OAAO,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;AACpE,CAAC;AACD;;;;GAIG;AACH,MAAa,0BAA0B;IAClB,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC/C,QAAQ,GAAG,IAAI,GAAG,EAAoE,CAAC;IACvF,MAAM,CAAwC;IAC/D,YAAY,MAAkC;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IACD,4BAA4B;IAC5B,IAAI,CAAC,QAAuB,EAAE,QAA+B;QACzD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,eAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,SAEN,EAAE,QAA+B,EAAE,MAAmB;QACpD,MAAM,GAAG,GAAG,gBAAgB,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3D,OAAO,eAAM,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;YACrE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,iBAAQ,CAAC,IAAI,EAAyC,CAAC;YAC5E,uDAAuD;YACvD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,MAAM,KAAK,SAAS;oBACpB,OAAO,EAAE,IAAI,EAAE,QAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBACzD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,OAAO,KAAK,SAAS;oBACrB,OAAO,EAAE,IAAI,EAAE,UAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;gBAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC9B,OAAO,EAAE,IAAI,EAAE,QAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACxD,CAAC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;gBACxB,OAAO,MAAM,CAAC,QAAQ,CAAC;YAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;gBAC1B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,iBAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3D,sEAAsE;YACtE,4DAA4D;YAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvH,KAAK,CAAC,CAAC,iBAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC5C,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACpB,IAAI,aAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBACpB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,QAAQ;oBAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,CAAC,iBAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC,CAAC;IACR,CAAC;IACO,eAAe,CAAC,SAEtB,EAAE,QAA+B,EAAE,MAAmB,EAAE,QAAgB;QACtE,MAAM,QAAQ,GAAG,eAAM,CAAC,UAAU,CAAC;YAC/B,yDAAyD;YACzD,gFAAgF;YAChF,GAAG,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC;gBAC9D,cAAc,EAAE,QAAQ;gBACxB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;aACnD,CAAC,CAAC;YACH,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC;gBACnC,MAAM,EAAE,yBAAyB;gBACjC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,OAAO,EAAE,iBAAiB,CAAC;oBACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;iBAC1C,CAAC;aACL,CAAC;SACL,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtG,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS;YAC5B,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uCAA+B,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChI,CAAC;CACJ;AAvED,gEAuEC;AACD,SAAS,iBAAiB,CAAC,IAM1B;IACG,OAAO,IAAA,YAAC,EAAC,qBAAqB,EAAE;QAC5B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;QAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC/B,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE;QACjC,IAAI,EAAE,IAAI,CAAC,KAAK,KAAK,aAAa;YAC9B,CAAC,CAAC,IAAA,YAAC,EAAC,6BAA6B,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW;gBACxB,CAAC,CAAC,IAAA,YAAC,EAAC,mCAAmC,CAAC;gBACxC,CAAC,CAAC,IAAA,YAAC,EAAC,0BAA0B,CAAC;KAC1C,CAAC,CAAC;AACP,CAAC;AACD;;;GAGG;AACH,SAAgB,cAAc,CAAC,OAA+B,EAAE,UAAqC,EAAE,OAAuD,EAAE,OAA2B;IACvL,MAAM,MAAM,GAAG,IAAA,0CAA0B,EAAC,OAAO,CAAC,CAAC;IACnD,OAAO,eAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,KAAK,CAAC,CAAC,eAAM,CAAC,GAAG,CAAC;gBACd,GAAG,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACrD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC;oBACnC,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC/B,CAAC;aACL,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAClE,IAAI,GAAG,EAAE,CAAC;gBACN,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;oBACvC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC5D,SAAS;YACb,CAAC;YACD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpG,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;oBAC/B,MAAM,EAAE,mBAAmB;oBAC3B,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;iBAChF,CAAC,CAAC;YACP,CAAC;YACD,IAAI,SAAS,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;oBAC/B,MAAM,EAAE,aAAa;oBACrB,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;iBAClF,CAAC,CAAC;YACP,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;YACxC,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC5F,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;oBAC/B,MAAM,EAAE,sBAAsB;oBAC9B,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,qBAAqB,WAAW,CAAC,QAAQ,CAAC,GAAG;iBAChI,CAAC,CAAC;YACP,CAAC;YACD,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACrC,IAAI,SAAS,CAAC,QAAQ,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC/C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;oBACzD,MAAM,EAAE,GAAG,EAAE,CAAC,eAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;wBAC3C,MAAM,EAAE,qBAAqB;wBAC7B,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,OAAO,EAAE,wDAAwD,MAAM,CAAC,QAAQ,CAAC,KAAK,GAAG;qBAC5F,CAAC,CAAC;oBACH,MAAM,EAAE,eAAM,CAAC,OAAO;iBACzB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACjF,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE;oBAC3D,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,cAAc,EAAE,QAAQ;oBACxB,QAAQ;oBACR,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC7B,CAAC,CAAC,CAAC;gBACJ,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;oBAC7D,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;oBACvC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACT,OAAO,EAAE,WAAW;oBACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,QAAQ;oBACrB,cAAc,EAAE,QAAQ;oBACxB,QAAQ;iBACX,CAAC,CAAC;YACP,CAAC;iBACI,CAAC;gBACF,IAAI,SAAS,CAAC,QAAQ,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC/C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBACjE,CAAC;gBACD,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE;oBAC3D,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,cAAc,EAAE,QAAQ;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC7B,CAAC,CAAC,CAAC;gBACJ,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;oBAC7D,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;oBACvC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACT,OAAO,EAAE,WAAW;oBACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,iBAAiB;oBAC9B,cAAc,EAAE,QAAQ;iBAC3B,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC,CAAC,CAAC;AACP,CAAC;AACD,SAAS,YAAY,CAAC,CAAgB,EAAE,CAAgB;IACpD,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC;AACvF,CAAC;AACD,SAAS,YAAY,CAAC,MAAmB,EAAE,OAA6B,EAAE,OAA2B,EAAE,KAA0B;IAC7H,OAAO,eAAM,CAAC,UAAU,CAAC;QACrB,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;YAC7C,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,gBAAgB,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE;YAC1E,OAAO,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE;YACzC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC;YACrB,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC;SACS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACpD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;KAC1B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,uCAAuB;QACvE,CAAC,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACvB,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;YAC/B,MAAM,EAAE,cAAc;YACtB,KAAK;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE;SAChG,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AACD,SAAS,YAAY,CAAC,SAEpB,EAAE,OAAmC;IACnC,OAAO,eAAM,CAAC,UAAU,CAAC;QACrB,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC;YACnC,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,OAAO,EAAE,iBAAiB,CAAC;gBACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;aAC1C,CAAC;SACL,CAAC;KACL,CAAC,CAAC;AACP,CAAC;AACD,SAAS,aAAa,CAAC,QAAuB;IAC1C,OAAO,IAAI,gBAAgB,CAAC;QACxB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,SAAS;QAChB,QAAQ;QACR,OAAO,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;KAC7D,CAAC,CAAC;AACP,CAAC;AACD,SAAS,YAAY,CAAC,KAAc;IAChC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC","sourcesContent":["// Agent Ensure 协议实现:probe → 缺失时按 identity 配对 installer → install → 同一 probe 复检。\n// 契约单源:docs/feature/adapters/architecture/agent-ensure.md\n//\n// Runner 接线(run.ts / attempt.ts)由串行合流节点完成;本模块导出可调用的 Ensure API、\n// Run 级 prepare single-flight 协调器,以及给 configHash 用的身份投影。\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { Data, Deferred, Effect, Exit, Option, Schema } from \"effect\";\nimport { t } from \"../i18n/index.ts\";\nimport type { Sandbox, SandboxOperations } from \"../sandbox/types.ts\";\nimport { createSandboxCommandTarget, SandboxCommandExitError } from \"../sandbox/operations.ts\";\nimport { isRegisteredSandboxContent } from \"../sandbox/content.ts\";\nimport type { SandboxCommandContext, SandboxCommandTarget } from \"../sandbox/commands.ts\";\nimport type { AgentArtifactPlatform, AgentEnsure, AgentIdentity, AgentInstaller, AgentStagedArtifact, } from \"./types.ts\";\n/** Run 级开放 activity key;落盘形状由 Record timing 线拥有。 */\nexport const AGENT_ARTIFACT_PREPARE_ACTIVITY = \"agent.artifact.prepare\" as const;\n/**\n * Timing recorder 钩子:Record 线尚未合流时可为 no-op / 注入测试观察器。\n * Runner 接线后传入真实 Run 级 recorder,把 prepare 记为 `agent.artifact.prepare`。\n */\nexport interface ArtifactPrepareTimingHook {\n    activity<A, E, R>(key: typeof AGENT_ARTIFACT_PREPARE_ACTIVITY, attrs: {\n        identity: AgentIdentity;\n        platform: AgentArtifactPlatform;\n        cacheKey: string;\n    }, run: Effect.Effect<A, E, R>): Effect.Effect<A, E, R>;\n}\nexport interface AgentEnsureContext {\n    /** Run 级 prepare 协调器;多 attempt 应共享同一实例。 */\n    readonly coordinator: Option.Option<ArtifactPrepareCoordinator>;\n    /** ProviderPlan 已经确定的目标平台；实际 uname/ldd 只负责验证它，不反向决定制品。 */\n    readonly targetPlatform: AgentArtifactPlatform;\n    readonly signal: AbortSignal;\n    progress(update: {\n        message: string;\n    }): void;\n}\nexport type AgentEnsureResult = {\n    readonly outcome: \"hit\";\n    readonly identity: AgentIdentity;\n} | {\n    readonly outcome: \"installed\";\n    readonly identity: AgentIdentity;\n    readonly installMode: \"staged\";\n    readonly targetPlatform: AgentArtifactPlatform;\n    readonly artifact: AgentStagedArtifact;\n} | {\n    readonly outcome: \"installed\";\n    readonly identity: AgentIdentity;\n    readonly installMode: \"sandbox-network\";\n    readonly targetPlatform: AgentArtifactPlatform;\n};\nexport type AgentEnsureFailureReason = \"coordinator-missing\" | \"probe-failed\" | \"installer-missing\" | \"verify-only\" | \"platform-detect-failed\" | \"platform-unsupported\" | \"artifact-prepare-failed\" | \"artifact-invalid\" | \"install-failed\" | \"recheck-missed\";\n/** Runner 的 agent.ensure 失败通道；attempt 层只消费这一种具名 ADT。 */\nexport class AgentEnsureError extends Data.TaggedError(\"AgentEnsureError\")<{\n    readonly reason: AgentEnsureFailureReason;\n    readonly phase: \"probe\" | \"installer\" | \"install\" | \"recheck\";\n    readonly identity: AgentIdentity;\n    readonly message: string;\n}> {\n}\nexport class SandboxTargetVerificationError extends Data.TaggedError(\"SandboxTargetVerificationError\")<{\n    readonly planned: AgentArtifactPlatform;\n    readonly actual: AgentArtifactPlatform | {\n        readonly _tag: \"Unreadable\";\n        readonly detail: string;\n    };\n    readonly message: string;\n}> {\n}\n/** Sandbox create 后的单一平台核验；planning 决定目标，本函数不得反向改写计划。 */\nexport function verifySandboxTargetPlatform(sandbox: SandboxOperations, planned: AgentArtifactPlatform): Effect.Effect<AgentArtifactPlatform, SandboxTargetVerificationError> {\n    return Effect.tryPromise({\n        try: () => detectSandboxPlatform(sandbox),\n        catch: (cause) => new SandboxTargetVerificationError({\n            planned,\n            actual: { _tag: \"Unreadable\", detail: errorMessage(cause) },\n            message: `Cannot verify Sandbox platform against planned target ${platformKey(planned)}: ${errorMessage(cause)}`,\n        }),\n    }).pipe(Effect.flatMap((actual) => platformKey(actual) === platformKey(planned)\n        ? Effect.succeed(actual)\n        : Effect.fail(new SandboxTargetVerificationError({\n            planned,\n            actual,\n            message: `Sandbox platform ${platformKey(actual)} does not match planned target ${platformKey(planned)}.`,\n        }))));\n}\nconst AgentStagedArtifactShape = Schema.Struct({\n    platform: Schema.Union(Schema.Struct({\n        _tag: Schema.Literal(\"Linux\"),\n        os: Schema.Literal(\"linux\"),\n        arch: Schema.NonEmptyTrimmedString,\n        libc: Schema.Literal(\"gnu\", \"musl\"),\n    }), Schema.Struct({\n        _tag: Schema.Literal(\"Darwin\"),\n        os: Schema.Literal(\"darwin\"),\n        arch: Schema.NonEmptyTrimmedString,\n    }), Schema.Struct({\n        _tag: Schema.Literal(\"Windows\"),\n        os: Schema.Literal(\"windows\"),\n        arch: Schema.NonEmptyTrimmedString,\n    })),\n    content: Schema.Unknown,\n    targetPath: Schema.NonEmptyTrimmedString,\n    install: Schema.Union(Schema.Struct({ kind: Schema.Literal(\"npm-tarball\") }), Schema.Struct({ kind: Schema.Literal(\"self-contained\"), binPath: Schema.NonEmptyTrimmedString })),\n});\nfunction decodePreparedArtifact(value: unknown, identity: AgentIdentity, targetPlatform: AgentArtifactPlatform): Effect.Effect<AgentStagedArtifact, AgentEnsureError> {\n    return Schema.decodeUnknown(AgentStagedArtifactShape)(value).pipe(Effect.mapError((cause) => new AgentEnsureError({\n        reason: \"artifact-invalid\",\n        phase: \"installer\",\n        identity,\n        message: String(cause),\n    })), Effect.flatMap((decoded) => {\n        if (!isRegisteredSandboxContent(decoded.content) || decoded.content.kind !== \"file\") {\n            return Effect.fail(new AgentEnsureError({\n                reason: \"artifact-invalid\",\n                phase: \"installer\",\n                identity,\n                message: t(\"agent.ensure.artifactMissingDigest\", { agent: identity.agent }),\n            }));\n        }\n        if (platformKey(decoded.platform) !== platformKey(targetPlatform)) {\n            return Effect.fail(new AgentEnsureError({\n                reason: \"artifact-invalid\",\n                phase: \"installer\",\n                identity,\n                message: `Prepared artifact platform ${platformKey(decoded.platform)} does not match requested platform ${platformKey(targetPlatform)}.`,\n            }));\n        }\n        return Effect.succeed({\n            platform: decoded.platform,\n            content: decoded.content,\n            targetPath: decoded.targetPath,\n            install: decoded.install,\n        });\n    }));\n}\n/** 拒绝无精确版本的身份;`latest` / 空串启动期报错。 */\nexport function assertStableAgentIdentity(identity: AgentIdentity): void {\n    const version = identity.version.trim();\n    if (!identity.agent.trim()) {\n        throw new Error(t(\"agent.ensure.identityMissingAgent\"));\n    }\n    if (!version || version.toLowerCase() === \"latest\" || version.includes(\"*\")) {\n        throw new Error(t(\"agent.ensure.unstableVersion\", { agent: identity.agent, version: identity.version }));\n    }\n    if (!identity.revision.trim()) {\n        throw new Error(t(\"agent.ensure.identityMissingRevision\", { agent: identity.agent }));\n    }\n}\n/** identity (+ 可选制品 digest/platform) → 指纹 / configHash 输入投影。 */\nexport function agentInstallIdentityInput(identity: AgentIdentity, artifact?: Pick<AgentStagedArtifact, \"content\" | \"platform\">): {\n    agent: string;\n    version: string;\n    revision: string;\n    artifactDigest?: string;\n    artifactPlatform?: string;\n} {\n    assertStableAgentIdentity(identity);\n    return {\n        agent: identity.agent,\n        version: identity.version,\n        revision: identity.revision,\n        ...(artifact\n            ? {\n                artifactDigest: artifact.content.digest,\n                artifactPlatform: platformKey(artifact.platform),\n            }\n            : {}),\n    };\n}\nexport function platformKey(platform: AgentArtifactPlatform): string {\n    return platform.os === \"linux\" && platform.libc !== undefined\n        ? `${platform.os}-${platform.arch}-${platform.libc}`\n        : `${platform.os}-${platform.arch}`;\n}\nexport function artifactCacheKey(identity: AgentIdentity, platform: AgentArtifactPlatform): string {\n    return `${identity.agent}@${identity.version}+r${identity.revision}|${platformKey(platform)}`;\n}\n/**\n * 从主 Sandbox 探测 staged payload 的**目标**平台。\n *\n * 制品要装进沙箱,不是装进宿主:cache key 与下载内容都必须按沙箱的 os / arch / libc 取。\n * 宿主 macOS-arm64 起一个 linux-x64 容器是常态,拿宿主平台去 prepare 会准备出跑不了的二进制。\n */\nexport async function detectSandboxPlatform(sandbox: SandboxOperations): Promise<AgentArtifactPlatform> {\n    const probe = await sandbox.runShell([\n        \"printf '%s\\\\n' \\\"$(uname -s)\\\"\",\n        \"printf '%s\\\\n' \\\"$(uname -m)\\\"\",\n        // musl 的 ldd 把版本写在 stderr;两条流都看,认不出就留空,由调用方决定要不要 libc。\n        \"if command -v ldd >/dev/null 2>&1; then ldd --version 2>&1 | head -1; else printf '\\\\n'; fi\",\n    ].join(\"\\n\"));\n    if (probe.exitCode !== 0) {\n        throw new Error(t(\"agent.ensure.platformDetectFailed\", { tail: (probe.stdout + probe.stderr).trim().slice(0, 200) }));\n    }\n    const [unameS = \"\", unameM = \"\", ldd = \"\"] = probe.stdout.split(\"\\n\").map((line) => line.trim());\n    const os = unameS.toLowerCase();\n    const arch = unameM === \"x86_64\" || unameM === \"amd64\"\n        ? \"x64\"\n        : unameM === \"aarch64\" || unameM === \"arm64\"\n            ? \"arm64\"\n            : unameM;\n    if (!os || !arch) {\n        throw new Error(t(\"agent.ensure.platformDetectFailed\", { tail: probe.stdout.trim().slice(0, 200) }));\n    }\n    if (os === \"linux\")\n        return { _tag: \"Linux\", os: \"linux\", arch, libc: /musl/i.test(ldd) ? \"musl\" : \"gnu\" };\n    if (os === \"darwin\")\n        return { _tag: \"Darwin\", os: \"darwin\", arch };\n    if (os === \"windows\" || os.startsWith(\"mingw\") || os.startsWith(\"msys\")) {\n        return { _tag: \"Windows\", os: \"windows\", arch };\n    }\n    throw new Error(t(\"agent.ensure.platformDetectFailed\", { tail: probe.stdout.trim().slice(0, 200) }));\n}\n/** 默认宿主 cache 根:`~/.cache/niceeval/agent-artifacts`。 */\nexport function defaultArtifactCacheDir(): string {\n    return join(homedir(), \".cache\", \"niceeval\", \"agent-artifacts\");\n}\n/**\n * Run 级 staged payload single-flight / cache。\n * 多个 attempt 共享同一 coordinator 实例;prepare 时间经 timing hook 记 `agent.artifact.prepare`。\n * coordinator 不 fork detached fiber:每个 Deferred 只从同步登记存活到同一终局 Exit 发布并清理。\n */\nexport class ArtifactPrepareCoordinator {\n    private readonly cache = new Map<string, AgentStagedArtifact>();\n    private readonly inflight = new Map<string, Deferred.Deferred<AgentStagedArtifact, AgentEnsureError>>();\n    private readonly timing: ArtifactPrepareTimingHook | undefined;\n    constructor(timing?: ArtifactPrepareTimingHook) {\n        this.timing = timing;\n    }\n    /** 已缓存的制品;没有则 undefined。 */\n    peek(identity: AgentIdentity, platform: AgentArtifactPlatform): Effect.Effect<AgentStagedArtifact | undefined> {\n        const key = artifactCacheKey(identity, platform);\n        return Effect.sync(() => this.cache.get(key));\n    }\n    prepare(installer: Extract<AgentInstaller, {\n        installMode: \"staged\";\n    }>, platform: AgentArtifactPlatform, signal: AbortSignal): Effect.Effect<AgentStagedArtifact, AgentEnsureError> {\n        const key = artifactCacheKey(installer.identity, platform);\n        return Effect.uninterruptibleMask((restore) => Effect.gen(this, function* () {\n            const fresh = yield* Deferred.make<AgentStagedArtifact, AgentEnsureError>();\n            // Map 的读写只在同步 Effect 中做:同 key 的并发 fiber 只会选出一个 leader。\n            const flight = yield* Effect.sync(() => {\n                const cached = this.cache.get(key);\n                if (cached !== undefined)\n                    return { _tag: \"Cached\" as const, artifact: cached };\n                const pending = this.inflight.get(key);\n                if (pending !== undefined)\n                    return { _tag: \"Follower\" as const, deferred: pending };\n                this.inflight.set(key, fresh);\n                return { _tag: \"Leader\" as const, deferred: fresh };\n            });\n            if (flight._tag === \"Cached\")\n                return flight.artifact;\n            if (flight._tag === \"Follower\")\n                return yield* restore(Deferred.await(flight.deferred));\n            // 从登记到完成/清理都处在 mask 内。restore 的 typed failure / defect / interruption\n            // 都先保留为 Exit，再发布给所有 follower，避免 leader 中断留下永远未完成的 Deferred。\n            const exit = yield* Effect.exit(restore(Effect.suspend(() => this.prepareArtifact(installer, platform, signal, key))));\n            yield* Deferred.done(flight.deferred, exit);\n            yield* Effect.sync(() => {\n                if (Exit.isSuccess(exit))\n                    this.cache.set(key, exit.value);\n                if (this.inflight.get(key) === flight.deferred)\n                    this.inflight.delete(key);\n            });\n            return yield* Deferred.await(flight.deferred);\n        }));\n    }\n    private prepareArtifact(installer: Extract<AgentInstaller, {\n        installMode: \"staged\";\n    }>, platform: AgentArtifactPlatform, signal: AbortSignal, cacheKey: string): Effect.Effect<AgentStagedArtifact, AgentEnsureError> {\n        const prepared = Effect.tryPromise({\n            // Node 24 的 AbortSignal.any 保留数组中第一个已中断 signal 的 reason。\n            // 调用方 signal 排在前面，Effect runtime signal 则确保 fiber interruption 能取消 SDK Promise。\n            try: (runtimeSignal) => Promise.resolve(installer.prepareArtifact({\n                targetPlatform: platform,\n                signal: AbortSignal.any([signal, runtimeSignal]),\n            })),\n            catch: (cause) => new AgentEnsureError({\n                reason: \"artifact-prepare-failed\",\n                phase: \"installer\",\n                identity: installer.identity,\n                message: formatEnsureError({\n                    identity: installer.identity,\n                    phase: \"installer\",\n                    result: { detail: errorMessage(cause) },\n                }),\n            }),\n        }).pipe(Effect.flatMap((artifact) => decodePreparedArtifact(artifact, installer.identity, platform)));\n        return this.timing === undefined\n            ? prepared\n            : this.timing.activity(AGENT_ARTIFACT_PREPARE_ACTIVITY, { identity: installer.identity, platform, cacheKey }, prepared);\n    }\n}\nfunction formatEnsureError(opts: {\n    identity: AgentIdentity;\n    phase: \"probe\" | \"recheck\" | \"verify-only\" | \"installer\";\n    result?: {\n        detail?: string;\n    };\n}): string {\n    return t(\"agent.ensure.failed\", {\n        agent: opts.identity.agent,\n        expected: opts.identity.version,\n        actual: \"(none)\",\n        phase: opts.phase,\n        detail: opts.result?.detail ?? \"\",\n        next: opts.phase === \"verify-only\"\n            ? t(\"agent.ensure.nextVerifyOnly\")\n            : opts.phase === \"installer\"\n                ? t(\"agent.ensure.nextInstallerMissing\")\n                : t(\"agent.ensure.nextRecheck\"),\n    });\n}\n/**\n * Runner 唯一调用的 Ensure 循环。Adapter 只声明 probe，不能在 setup 内自行绕过。\n * 不改题面网络、不按 template 名短路、三种模式失败后不静默降级。\n */\nexport function runAgentEnsure(ensures: readonly AgentEnsure[], installers: readonly AgentInstaller[], sandbox: SandboxOperations & Pick<Sandbox, \"sandboxId\">, context: AgentEnsureContext): Effect.Effect<readonly AgentEnsureResult[], AgentEnsureError> {\n    const target = createSandboxCommandTarget(sandbox);\n    return Effect.gen(function* () {\n        const results: AgentEnsureResult[] = [];\n        for (const ensure of ensures) {\n            yield* Effect.try({\n                try: () => assertStableAgentIdentity(ensure.identity),\n                catch: (cause) => new AgentEnsureError({\n                    reason: \"probe-failed\",\n                    phase: \"probe\",\n                    identity: ensure.identity,\n                    message: errorMessage(cause),\n                }),\n            });\n            if (ensure.progress?.checking !== undefined) {\n                context.progress({ message: ensure.progress.checking });\n            }\n            const hit = yield* probeMatches(ensure, target, context, \"probe\");\n            if (hit) {\n                if (ensure.progress?.ready !== undefined) {\n                    context.progress({ message: ensure.progress.ready });\n                }\n                results.push({ outcome: \"hit\", identity: ensure.identity });\n                continue;\n            }\n            const installer = installers.find((candidate) => sameIdentity(candidate.identity, ensure.identity));\n            if (installer === undefined) {\n                return yield* new AgentEnsureError({\n                    reason: \"installer-missing\",\n                    phase: \"installer\",\n                    identity: ensure.identity,\n                    message: formatEnsureError({ identity: ensure.identity, phase: \"installer\" }),\n                });\n            }\n            if (installer.installMode === \"verify-only\") {\n                return yield* new AgentEnsureError({\n                    reason: \"verify-only\",\n                    phase: \"installer\",\n                    identity: ensure.identity,\n                    message: formatEnsureError({ identity: ensure.identity, phase: \"verify-only\" }),\n                });\n            }\n            const platform = context.targetPlatform;\n            if (installer.platforms !== undefined && !installer.platforms.includes(platformKey(platform))) {\n                return yield* new AgentEnsureError({\n                    reason: \"platform-unsupported\",\n                    phase: \"installer\",\n                    identity: ensure.identity,\n                    message: `Agent installer for ${ensure.identity.agent}@${ensure.identity.version} does not support ${platformKey(platform)}.`,\n                });\n            }\n            if (installer.installMode === \"staged\") {\n                if (installer.progress?.installing !== undefined) {\n                    context.progress({ message: installer.progress.installing });\n                }\n                const coordinator = yield* Option.match(context.coordinator, {\n                    onNone: () => Effect.fail(new AgentEnsureError({\n                        reason: \"coordinator-missing\",\n                        phase: \"installer\",\n                        identity: ensure.identity,\n                        message: `Run-level ArtifactPrepareCoordinator is required for ${ensure.identity.agent}.`,\n                    })),\n                    onSome: Effect.succeed,\n                });\n                const artifact = yield* coordinator.prepare(installer, platform, context.signal);\n                yield* runInstaller(installer, () => installer.install(target, {\n                    identity: ensure.identity,\n                    targetPlatform: platform,\n                    artifact,\n                    signal: context.signal,\n                    progress: context.progress,\n                }));\n                if (ensure.progress?.checking !== undefined) {\n                    context.progress({ message: ensure.progress.checking });\n                }\n                if (!(yield* probeMatches(ensure, target, context, \"recheck\"))) {\n                    return yield* recheckMissed(ensure.identity);\n                }\n                if (ensure.progress?.ready !== undefined) {\n                    context.progress({ message: ensure.progress.ready });\n                }\n                results.push({\n                    outcome: \"installed\",\n                    identity: ensure.identity,\n                    installMode: \"staged\",\n                    targetPlatform: platform,\n                    artifact,\n                });\n            }\n            else {\n                if (installer.progress?.installing !== undefined) {\n                    context.progress({ message: installer.progress.installing });\n                }\n                yield* runInstaller(installer, () => installer.install(target, {\n                    identity: ensure.identity,\n                    targetPlatform: platform,\n                    signal: context.signal,\n                    progress: context.progress,\n                }));\n                if (ensure.progress?.checking !== undefined) {\n                    context.progress({ message: ensure.progress.checking });\n                }\n                if (!(yield* probeMatches(ensure, target, context, \"recheck\"))) {\n                    return yield* recheckMissed(ensure.identity);\n                }\n                if (ensure.progress?.ready !== undefined) {\n                    context.progress({ message: ensure.progress.ready });\n                }\n                results.push({\n                    outcome: \"installed\",\n                    identity: ensure.identity,\n                    installMode: \"sandbox-network\",\n                    targetPlatform: platform,\n                });\n            }\n        }\n        return results;\n    });\n}\nfunction sameIdentity(a: AgentIdentity, b: AgentIdentity): boolean {\n    return a.agent === b.agent && a.version === b.version && a.revision === b.revision;\n}\nfunction probeMatches(ensure: AgentEnsure, sandbox: SandboxCommandTarget, context: AgentEnsureContext, phase: \"probe\" | \"recheck\"): Effect.Effect<boolean, AgentEnsureError> {\n    return Effect.tryPromise({\n        try: () => Promise.resolve(ensure.probe(sandbox, {\n            phase: \"before\",\n            owner: { kind: \"experiment\", id: `agent.ensure/${ensure.identity.agent}` },\n            attempt: { id: \"agent.ensure\", index: 0 },\n            signal: context.signal,\n            progress: context.progress,\n            diagnostic: () => { },\n            onCleanup: () => { },\n        } satisfies SandboxCommandContext)).then(() => true),\n        catch: (cause) => cause,\n    }).pipe(Effect.catchAll((cause) => cause instanceof SandboxCommandExitError\n        ? Effect.succeed(false)\n        : Effect.fail(new AgentEnsureError({\n            reason: \"probe-failed\",\n            phase,\n            identity: ensure.identity,\n            message: `${formatEnsureError({ identity: ensure.identity, phase })}: ${errorMessage(cause)}`,\n        }))));\n}\nfunction runInstaller(installer: Exclude<AgentInstaller, {\n    installMode: \"verify-only\";\n}>, install: () => void | Promise<void>): Effect.Effect<void, AgentEnsureError> {\n    return Effect.tryPromise({\n        try: () => Promise.resolve(install()),\n        catch: (cause) => new AgentEnsureError({\n            reason: \"install-failed\",\n            phase: \"install\",\n            identity: installer.identity,\n            message: formatEnsureError({\n                identity: installer.identity,\n                phase: \"recheck\",\n                result: { detail: errorMessage(cause) },\n            }),\n        }),\n    });\n}\nfunction recheckMissed(identity: AgentIdentity): AgentEnsureError {\n    return new AgentEnsureError({\n        reason: \"recheck-missed\",\n        phase: \"recheck\",\n        identity,\n        message: formatEnsureError({ identity, phase: \"recheck\" }),\n    });\n}\nfunction errorMessage(cause: unknown): string {\n    return cause instanceof Error ? cause.message : String(cause);\n}\n"]}

package/dist/agents/provisioner.d.cts

@@ -1,5 +1,5 @@
 import { Effect, Option } from "effect";
-import type { SandboxOperations } from "../sandbox/types.cjs";
+import type { Sandbox, SandboxOperations } from "../sandbox/types.cjs";
 import type { AgentArtifactPlatform, AgentEnsure, AgentIdentity, AgentInstaller, AgentStagedArtifact } from "./types.cjs";
 /** Run 级开放 activity key;落盘形状由 Record timing 线拥有。 */
 export declare const AGENT_ARTIFACT_PREPARE_ACTIVITY: "agent.artifact.prepare";
@@ -107,5 +107,5 @@ export declare class ArtifactPrepareCoordinator {
  * Runner 唯一调用的 Ensure 循环。Adapter 只声明 probe，不能在 setup 内自行绕过。
  * 不改题面网络、不按 template 名短路、三种模式失败后不静默降级。
  */
-export declare function runAgentEnsure(ensures: readonly AgentEnsure[], installers: readonly AgentInstaller[], sandbox: SandboxOperations, context: AgentEnsureContext): Effect.Effect<readonly AgentEnsureResult[], AgentEnsureError>;
+export declare function runAgentEnsure(ensures: readonly AgentEnsure[], installers: readonly AgentInstaller[], sandbox: SandboxOperations & Pick<Sandbox, "sandboxId">, context: AgentEnsureContext): Effect.Effect<readonly AgentEnsureResult[], AgentEnsureError>;
 export {};

package/dist/agents/provisioner.d.mts

@@ -1,5 +1,5 @@
 import { Effect, Option } from "effect";
-import type { SandboxOperations } from "../sandbox/types.mjs";
+import type { Sandbox, SandboxOperations } from "../sandbox/types.mjs";
 import type { AgentArtifactPlatform, AgentEnsure, AgentIdentity, AgentInstaller, AgentStagedArtifact } from "./types.mjs";
 /** Run 级开放 activity key;落盘形状由 Record timing 线拥有。 */
 export declare const AGENT_ARTIFACT_PREPARE_ACTIVITY: "agent.artifact.prepare";
@@ -107,5 +107,5 @@ export declare class ArtifactPrepareCoordinator {
  * Runner 唯一调用的 Ensure 循环。Adapter 只声明 probe，不能在 setup 内自行绕过。
  * 不改题面网络、不按 template 名短路、三种模式失败后不静默降级。
  */
-export declare function runAgentEnsure(ensures: readonly AgentEnsure[], installers: readonly AgentInstaller[], sandbox: SandboxOperations, context: AgentEnsureContext): Effect.Effect<readonly AgentEnsureResult[], AgentEnsureError>;
+export declare function runAgentEnsure(ensures: readonly AgentEnsure[], installers: readonly AgentInstaller[], sandbox: SandboxOperations & Pick<Sandbox, "sandboxId">, context: AgentEnsureContext): Effect.Effect<readonly AgentEnsureResult[], AgentEnsureError>;
 export {};

package/dist/agents/provisioner.d.ts

@@ -1,5 +1,5 @@
 import { Effect, Option } from "effect";
-import type { SandboxOperations } from "../sandbox/types.js";
+import type { Sandbox, SandboxOperations } from "../sandbox/types.js";
 import type { AgentArtifactPlatform, AgentEnsure, AgentIdentity, AgentInstaller, AgentStagedArtifact } from "./types.js";
 /** Run 级开放 activity key;落盘形状由 Record timing 线拥有。 */
 export declare const AGENT_ARTIFACT_PREPARE_ACTIVITY: "agent.artifact.prepare";
@@ -107,5 +107,5 @@ export declare class ArtifactPrepareCoordinator {
  * Runner 唯一调用的 Ensure 循环。Adapter 只声明 probe，不能在 setup 内自行绕过。
  * 不改题面网络、不按 template 名短路、三种模式失败后不静默降级。
  */
-export declare function runAgentEnsure(ensures: readonly AgentEnsure[], installers: readonly AgentInstaller[], sandbox: SandboxOperations, context: AgentEnsureContext): Effect.Effect<readonly AgentEnsureResult[], AgentEnsureError>;
+export declare function runAgentEnsure(ensures: readonly AgentEnsure[], installers: readonly AgentInstaller[], sandbox: SandboxOperations & Pick<Sandbox, "sandboxId">, context: AgentEnsureContext): Effect.Effect<readonly AgentEnsureResult[], AgentEnsureError>;
 export {};

package/dist/agents/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":";;AAAA,iDAAiD;AACjD,uDAAgE","sourcesContent":["// agent 域类型:Agent / Adapter 契约、会话与 tracing 导出配置。\nimport { AGENT_DOCKERFILE_CACHE_SAFE } from \"./cache-marker.ts\";\n// 「连到哪个被测对象、协议怎么说」的全部契约在这里(见 apps/docs-site/zh/explanation/adapter.mdx)。\n// 能力不再是问卷式声明:t 上解锁什么完全由构造证据决定(见 docs-site 「能力从哪来」一节)。\nimport type { DiagnosticInput, JsonValue, ProgressUpdate } from \"../shared/types.ts\";\nimport type { StreamEvent, TraceSpan, Usage } from \"../o11y/types.ts\";\nimport type { Sandbox } from \"../sandbox/types.ts\";\nimport type { AttemptRef, MaybePromise, SandboxCommandTarget, StableSandboxCommand } from \"../sandbox/commands.ts\";\nimport type { RegisteredSandboxContent } from \"../sandbox/content.ts\";\nimport type { SendFailureClassifier } from \"../context/send-failures.ts\";\nimport type { SessionSlot } from \"./session-slot.ts\";\nexport type { SessionSlot } from \"./session-slot.ts\";\n/**\n * 本地 stdio 形态的 MCP server:沙箱内起子进程,按 stdio 说 MCP 协议。\n * 与 {@link McpHttpServer} 按形状判别(有 `command` 的是 stdio,有 `url` 的是 HTTP)。\n */\nexport interface McpStdioServer {\n    /** 服务器唯一名(config key)。 */\n    name: string;\n    /** 启动命令(如 \"npx\"、\"node\"、\"uvx\")。 */\n    command: string;\n    /** 传给命令的参数。 */\n    args?: readonly string[];\n    /** 注入服务器进程的环境变量(可能含 secret,不进 manifest)。 */\n    env?: Readonly<globalThis.Record<string, string>>;\n    /** stdio 与 HTTP 是互斥完成态，不能把另一分支的字段混进来。 */\n    url?: never;\n    headers?: never;\n}\n/**\n * 远程 Streamable HTTP 形态的 MCP server:沙箱直接连一个 HTTP 端点。\n * `url` 必须沙箱内可达——宿主机上的服务先经隧道(cloudflared / tailscale 等)暴露。\n */\nexport interface McpHttpServer {\n    /** 服务器唯一名(config key)。 */\n    name: string;\n    /** Streamable HTTP 端点(如 https://mem.example.com/mcp/)。 */\n    url: string;\n    /** 逐字写进每个请求的 HTTP 头(常用于 Authorization;可能含 secret,不进 manifest)。 */\n    headers?: Readonly<globalThis.Record<string, string>>;\n    /** HTTP 与 stdio 是互斥完成态，不能把另一分支的字段混进来。 */\n    command?: never;\n    args?: never;\n    env?: never;\n}\n/**\n * MCP server 描述符 —— 支持 MCP 的 adapter(Claude Code / Codex)共用的工具服务单元,\n * 不是 native plugin 的一种。stdio 与 Streamable HTTP 两种形态按形状判别,不设 kind 标签\n * (两种形态各有唯一必填判别字段);同时给出 `command` 与 `url` 属配置错误,setup 报错点名。\n * 在 agent factory config 里声明,setup 阶段写进各自的配置文件。\n * 见 docs/feature/adapters/architecture/coding-agent-extensions.md「类型边界」。\n */\nexport type McpServer = McpStdioServer | McpHttpServer;\n/**\n * Skill 的来源描述 —— Claude Code / Codex / Bub 共用的**数据类型**:只统一「从哪里取得\n * 哪份 Skill」,安装位置、发现机制、要不要额外写 project instruction 由各 Adapter 决定。\n * 见 docs/feature/adapters/architecture/coding-agent-extensions.md「类型边界」。\n */\nexport type SkillSpec = {\n    kind: \"local\";\n    /** 相对项目根(跑 niceeval 的目录)的 Skill 文件或目录:`SKILL.md`、含 `SKILL.md` 的目录,或单个 `.md`。 */\n    path: string;\n    /** 展示名;省略时由文件或目录名推导(`<dir>/SKILL.md` → `<dir>`,`foo.md` → `foo`)。 */\n    name?: string;\n} | {\n    kind: \"repo\";\n    /** GitHub `owner/repo` 或 Git URL。 */\n    source: string;\n    /** 多 Skill Repo 中要启用的 Skill;repo 只有一个 Skill 时可省略,多个时省略即 setup 失败。 */\n    skills?: readonly string[];\n    /** Tag、Commit 或 Branch;省略表示 repo 默认 ref。 */\n    ref?: string;\n};\n/** Manifest 里的一条 Skill 安装记录:本地(带内容哈希)或 repo(带来源与 ref)。 */\nexport type AgentSetupSkill = {\n    kind: \"local\";\n    name: string;\n    path: string;\n    sha256: string;\n} | {\n    kind: \"repo\";\n    source: string;\n    ref?: string;\n    skills: string[];\n};\n/**\n * 一次 Agent setup 实际装了什么 —— 沙箱型 Coding Agent Adapter 在 setup 收尾经\n * `ctx.reportSetup()` 交回的安装清单。它是宿主侧内存对象,运行器把它作为 attempt artifact 存成\n * `agent-setup.json`(见 docs/feature/record/architecture.md);沙箱磁盘上不落它。不参与评分,\n * 只回答「这次实际装了什么」;**环境变量值与 secret 不写进来**(所以 mcpServers 只记\n * name/command/args)。\n */\nexport interface AgentSetupManifest {\n    /** 装进去的 Skill(按配置顺序;同名来自多个来源时逐条保留,不静默合并)。 */\n    skills: AgentSetupSkill[];\n    /** Agent 原生 Plugin(Claude Code / Codex 各自的 Marketplace 协议)。 */\n    nativePlugins?: Array<{\n        agent: \"claude-code\" | \"codex\";\n        marketplace: {\n            name: string;\n            source: string;\n            ref?: string;\n        };\n        name: string;\n        /** 安装后 CLI 报告的版本;取不到时省略。 */\n        resolvedVersion?: string;\n    }>;\n    /** 挂上的 MCP server(只记非 secret 字段:stdio 不含 env,HTTP 不含 headers)。 */\n    mcpServers?: Array<{\n        name: string;\n        command: string;\n        args?: string[];\n    } | {\n        name: string;\n        url: string;\n    }>;\n    /**\n     * 官方原生配置文件(Claude Code `settings.json` / Codex `config.toml`):只记 Agent 名、\n     * 项目相对来源路径与原始字节的 SHA-256,不落正文 —— 任意官方配置都可能携带敏感字符串,\n     * 不能靠字段白名单证明适合原样落盘。\n     */\n    nativeConfigFile?: {\n        agent: \"claude-code\" | \"codex\";\n        path: string;\n        sha256: string;\n    };\n    /** Bub 的 Python Plugin(规范化后的 package 串)。 */\n    pythonPlugins?: Array<{\n        package: string;\n    }>;\n}\n// ───────────────────────── 证据覆盖声明 ─────────────────────────\n/** 证据通道的覆盖状态；不存在隐含的 unknown 第四态。 */\nexport type EvidenceCoverageStatus = \"complete\" | \"partial\" | \"unavailable\";\n/** 非完整通道必须解释缺口；完整通道不能携带一个自相矛盾的 reason。 */\nexport type EvidenceCoverageEntry = {\n    readonly status: \"complete\";\n    readonly reason?: never;\n} | {\n    readonly status: Exclude<EvidenceCoverageStatus, \"complete\">;\n    readonly reason: string;\n};\n/**\n * 覆盖声明(EvidenceCoverage):完整性不是口头承诺,是随数据走的声明\n * (见 docs/feature/adapters/architecture/evidence.md)。两层:\n * - Agent 级默认(`defineAgent` / `defineSandboxAgent` 的 `evidenceCoverage`)必须逐一声明\n *   六个通道；官方 SDK 适配器可使用 `completeEvidenceCoverage`。\n * - Turn 级降级(`Turn.evidenceCoverage`)只用于相对 Agent 默认值降级。\n */\nexport interface EvidenceCoverage {\n    /** 完整事件流(event / notEvent / order 的依据)。 */\n    readonly events: EvidenceCoverageEntry;\n    /** action 生命周期(工具正负断言、顺序、失败的依据)。 */\n    readonly actions: EvidenceCoverageEntry;\n    /** assistant / user message（reply 与显式 message 值断言的依据）。 */\n    readonly messages: EvidenceCoverageEntry;\n    /** usage(token / cost 上限断言的依据)。 */\n    readonly usage: EvidenceCoverageEntry;\n    /** Turn status 的真实性(succeeded / parked 的依据)——恒 completed 的映射必须声明非 complete。 */\n    readonly status: EvidenceCoverageEntry;\n    /** Turn.data（供 `t.check(turn.data, match)` 检查结构化输出）。 */\n    readonly data: EvidenceCoverageEntry;\n}\n/** 单轮只列相对 Agent 默认值的降级通道；省略的通道沿用 Agent 声明。 */\nexport type TurnEvidenceCoverage = Partial<EvidenceCoverage>;\n/** 随一轮消息附带的文件(图片等多模态输入)。 */\nexport interface InputFile {\n    /** 文件名(可选,供 adapter / 模型参考)。 */\n    readonly filename?: string;\n    /** MIME 类型,如 `image/png`、`image/jpeg`。 */\n    readonly mimeType: string;\n    /** base64 编码的文件内容(JSON 友好,remote adapter 可直接放进请求体)。 */\n    readonly dataBase64: string;\n}\n/**\n * HITL 回答轮里,人的裁决以结构化形式随 `input.responses` 到达——adapter 不需要解析\n * `text` 去猜哪句回答对应哪个请求、算不算批准。见 apps/docs-site/zh/explanation/adapter.mdx\n * 「不同回答的入参」一节的四种典型形态。\n */\nexport type AnswerValue = {\n    readonly optionId: string;\n    readonly text?: never;\n} | {\n    readonly text: string;\n    readonly optionId?: never;\n};\nexport type InputResponse = {\n    /** 对应哪条 input.requested 请求;多个请求并停时靠它对位。 */\n    readonly requestId: string;\n} & AnswerValue;\nexport interface TurnInput {\n    readonly text: string;\n    /** 本轮附带的文件(图片等)。adapter 自行决定怎么投递;不支持多模态的 adapter 忽略它。 */\n    readonly files?: readonly InputFile[];\n    /** 仅回答轮(t.respond / t.respondAll):逐请求的结构化回答,按 requestId 对位。 */\n    readonly responses?: readonly InputResponse[];\n}\n/** adapter 的 send 返回值(事件流为核心)。 */\nexport interface Turn {\n    readonly events: StreamEvent[];\n    readonly data?: JsonValue;\n    readonly status: \"completed\" | \"failed\" | \"waiting\";\n    readonly usage?: Usage;\n    /**\n     * 本轮相对 Agent 默认覆盖的降级声明(这一轮流断了、拿不到 usage 等);\n     * 只能降级,不能把 Agent 未声明的通道升格成 complete(见 EvidenceCoverage)。\n     */\n    readonly evidenceCoverage?: TurnEvidenceCoverage;\n}\n/**\n * 本次运行的 OTLP traces 接收信息(仅当配置了 OTel 接入时有——agent 的 `tracing` 块 /\n * config 的 telemetry 存在)。经 ctx.telemetry 交给 agent。span 只进瀑布图,不喂断言。\n * 远程 HTTP 接入的 send 只需要 spread `headers`(每轮一个新 traceparent);接收端点是\n * 启动期配置(`defineConfig({ telemetry: { port } } )`)固定的,不从这里传。\n */\nexport interface Telemetry {\n    /** 接收端点(完整路径,形如 http://127.0.0.1:PORT/v1/traces)。 */\n    readonly endpoint: string;\n    /**\n     * env-based 导出的 env(= AgentTracing.env(endpoint) 的结果),ready-to-spread。\n     * adapter 的 send 直接 `{ ...ctx.telemetry?.env }` 注入,不必手搓 OTEL_* 拼装。\n     */\n    readonly env?: Readonly<globalThis.Record<string, string>>;\n    /**\n     * 本轮的 W3C trace context(traceparent),每轮一个新值。send 把它 spread 进 HTTP 请求头\n     * (或注入子进程 env)——应用埋点支持 context 传播时,本轮 span 挂到我们给的 trace 下,\n     * 并发跑 eval 的 span 归属才精确;不带则回退时间窗口归属(该 agent 自动降为串行)。\n     */\n    readonly headers?: Readonly<globalThis.Record<string, string>>;\n}\n/**\n * agent 的 OTLP 导出配置 —— 「沙箱里怎么让这个 CLI 把 trace 发到 endpoint」。\n * 刻意从 setup 里拆出来:setup 管运行配置,这里只管 otel 导出。CLI 安装归 `agent.ensure`。两种投递方式\n * (互不排斥,按 CLI 而定):\n *   · env-based(标准 OTEL_* 环境变量,如 bub/Python OTel SDK)—— 用 `env`;\n *   · file-based(CLI 自有配置文件,如 codex 的 config.toml [otel] 块)—— 用 `configure`。\n */\nexport interface AgentTracing {\n    /**\n     * 线协议(codex 发 OTLP/JSON、bub 发 OTLP/protobuf)。接收器按 content-type 自动解码,\n     * 此字段仅作声明/日志用,也为将来按协议分流留口。\n     */\n    protocol?: \"http/json\" | \"http/protobuf\";\n    /**\n     * 接收器粒度(仅非沙箱 agent;沙箱型每沙箱一个,与此无关):\n     *   · \"attempt\"(默认)—— 每个 attempt 一个接收器。适合每轮能切换导出端点的被测对象\n     *     (进程内 adapter,如内置 aiSdkAgent 的可切换 exporter),attempt 间天然隔离、可全并发。\n     *   · \"run\" —— 整个 run 共享一个接收器(每 agent 一个)。**长驻服务必选**:应用的 OTEL_*\n     *     env 进程启动时读一次,per-attempt 端口会在第一个 attempt 结束时失效。span 逐轮归属\n     *     (traceparent / 时间窗口 + 串行守卫),见 ctx.telemetry.headers。\n     * config 配了 `telemetry`(固定端口,无侵入接入的长驻服务场景)的非沙箱 agent 自动按 \"run\" 处理。\n     */\n    scope?: \"attempt\" | \"run\";\n    /**\n     * env-based 导出:给 endpoint → 返回要注入每轮 send 的 env(纯函数)。运行器把结果\n     * 放进 ctx.telemetry.env,send 直接 spread。\n     */\n    env?(endpoint: string): globalThis.Record<string, string>;\n    /**\n     * file-based 导出:给 sandbox + ctx(ctx.telemetry.endpoint 必有),自己写 / 追加配置文件。\n     * 运行器在 agent.setup 之后、首次 send 之前调一次(仅当 tracing 开 + 有 endpoint)。\n     * 注:codex 的 [otel.trace_exporter.otlp-http] 是子表,configure 在 setup 写完主配置后\n     * 追加到 config.toml 末尾,天然满足「子表在所有上层表之后」。\n     */\n    configure?(sandbox: Sandbox, ctx: SandboxAgentContext): Promise<void> | void;\n}\n/**\n * 一条会话线。核心承诺只有一句:**同一条会话线的每次 send 拿到同一个 `ctx.session`,\n * 新会话线(eval 第一轮 / t.newSession() 之后)拿到一个全新的。**\n * 服务端历史用 `id` / `capture`，客户端历史与 HITL 停轮现场用 Adapter\n * 私有的 typed slot。\"第一轮\"是新会话线的自然形态，没有要判断的分支。\n */\nexport interface AgentSession {\n    /** 会话续接:服务端记历史。本线记过的会话 id;新会话线是 undefined。 */\n    readonly id?: string;\n    /** 记回传的会话 id;只在还没记过时落地(first-writer-wins),空值忽略。 */\n    capture(id: string | undefined): void;\n    /** 读 Adapter 私有 slot；新会话线或未写过的 slot 为空。 */\n    get<T>(slot: SessionSlot<T>): T | undefined;\n    /** 写 Adapter 私有 slot；同一 slot 再写覆盖旧值。 */\n    set<T>(slot: SessionSlot<T>, value: T): void;\n    /** 读并删除 Adapter 私有 slot，只消费一次。 */\n    take<T>(slot: SessionSlot<T>): T | undefined;\n}\n/** Runner-owned Attempt resource registry; adapters use it for cross-send drivers. */\nexport interface AttemptResourceRegistry {\n    acquire<T>(acquire: () => Promise<T>, lifecycle: {\n        shutdown: (resource: T, signal: AbortSignal) => Promise<void>;\n        release: (resource: T, signal: AbortSignal) => Promise<void>;\n    }): Promise<T>;\n    shutdownAll(signal: AbortSignal): Promise<void>;\n}\nexport interface AgentContext {\n    /**\n     * 软取消信号:合并了 attempt 超时、run 级中断(用户 Ctrl+C)与评估用例自身的中断请求\n     * (见 src/runner/attempt.ts)。adapter 可以选择性检查它(或直接传给 `fetch`)以提前\n     * 优雅退出,但这不是唯一的硬边界——即便 adapter 完全忽略它,运行器也会用\n     * `Effect.timeoutTo` 兜底强制收尾(停 Sandbox 容器)。\n     */\n    readonly signal: AbortSignal;\n    /** 本次 attempt 用的模型名,透传自 experiment 的 `model` 字段。sandbox 型 agent 通常在 setup 里用它写配置,direct 型通常在 send 里用它选模型。 */\n    readonly model?: string;\n    /** 模型推理努力程度;归属同 model——实验决定,省略时不覆盖 agent 原生默认。 */\n    readonly reasoningEffort?: string;\n    /**\n     * experiment 的 `flags` 字段原样透传,内容和结构完全由 experiment 作者自定义\n     * (如 `{ webResearch: true }`、`{ systemPrompt: \"...\" }`)。adapter 按自己的约定\n     * 读取其中的字段;框架本身不解释、不校验它的内容。命名特意避开 CLI 解析出的\n     * `flag`(跑法层面的 --timeout/--budget 等),两者是不相关的概念。\n     */\n    readonly flags: Readonly<globalThis.Record<string, JsonValue>>;\n    /**\n     * 路径推导出的实验 id(与结果归属 `runWho` / `AgentRun.experimentId` 同源);不经\n     * experiment 跑(如脱离 CLI、直接构造 `AgentRun` 的场景)时为 undefined。典型用途:\n     * SandboxLayer command 按实验隔离跨 attempt 的基础设施内容，或 adapter 按实验切换鉴权 / 路由。\n     * 与 `flags`(实验条件的\n     * 具体取值)是两个维度——这里只是「跑的是哪个实验」的稳定标识,不携带条件内容。\n     */\n    readonly experimentId?: string;\n    /**\n     * 当前 Attempt 对应的 eval ID。NiceEval Runner 始终从 discovery 后的评估用例身份填入；\n     * 第三方直接构造 AgentContext 时可省略。Adapter 可用它定位与题目同目录的只读宿主资产，\n     * 但不能据此绕过 Sandbox 的隐藏判据隔离。\n     */\n    readonly evalId?: string;\n    /** 当前 Attempt 的评估组；未分组评估用例省略。 */\n    readonly evalGroup?: {\n        readonly id: string;\n        readonly definitionHash: string;\n    };\n    /** Runner 填入的当前 Attempt 引用；第三方直接构造上下文时可省略。 */\n    readonly attempt?: AttemptRef;\n    readonly session: AgentSession;\n    /**\n     * 仅当配置了 OTel 接入时有(agent 的 `tracing` 块 / config 的 telemetry 存在):\n     * 本次运行的 OTLP traces 接收信息(endpoint + env-based 导出 env)。\n     * 怎么把它交给 CLI 由 agent 的 `tracing` 块声明:env-based 的把 ctx.telemetry.env\n     * spread 进 send;file-based 的在 tracing.configure 里写配置。远程 HTTP 接入的 send\n     * 只需要把 headers spread 进请求头(每轮一个新 traceparent);端点是启动期配置\n     * (defineConfig({ telemetry: { port } }))固定的,不从这里传。\n     */\n    readonly telemetry?: Telemetry;\n    /**\n     * 作用域反馈:报告此刻正在做什么(turn / tool / 安装进度)。短命状态——Human profile\n     * 更新 active 行,`agent`/`ci` 不逐条打印,也不进最终结果;不要每个 token/delta 都调用。\n     * runner 按当前回调所处的生命周期阶段(agent.setup / agent.run / agent.teardown)归因,\n     * 调用方不能冒充其它阶段(见 docs/feature/experiments/library.md)。\n     */\n    progress(update: ProgressUpdate): void;\n    /**\n     * 作用域反馈:报告运行结束后仍应保留的问题(协议降级、数据不完整、cleanup 问题)。\n     * 永久事件,落进 attempt 的 diagnostics 并进各 profile 的永久输出;`dedupeKey` 去重。\n     * 即使 level 为 \"error\" 也不改变 Turn.status / verdict——无法继续时抛异常。\n     */\n    diagnostic(input: DiagnosticInput): void;\n    /**\n     * `progress({ message: msg })` 的别名,不是第二条通道(见 docs/feature/experiments/cli.md\n     * 「Attempt 阶段」)。超时失败时最近若干行会并入结果的 error 信息,方便定位卡在哪一步。\n     */\n    log(msg: string): void;\n}\n/** 仅 Sandbox Agent 可见的上下文；Direct Agent 不接收也不伪造 Sandbox。 */\nexport interface SandboxAgentContext extends AgentContext {\n    readonly sandbox: Sandbox;\n}\n/**\n * Agent `setup` 的上下文:沙箱上下文再加一条宿主侧安装清单回执通道。只有 `setup` 收得到它——\n * 安装事实在这一步产生,`send` / `teardown` 不再补写。\n */\nexport interface SandboxAgentSetupContext extends SandboxAgentContext {\n    /**\n     * 交回这次实际安装了什么(Skill / 原生 Plugin / MCP / 原生配置文件)。清单是宿主侧内存对象,\n     * 运行器直接存成 attempt artifact `agent-setup.json`;沙箱里不落任何框架文件\n     * (见 docs/observability.md「宿主侧行为断言:t.o11y」)。什么都没装就别调——空清单不生成\n     * artifact。同一次 `setup` 内多次调用后写覆盖先写。\n     */\n    reportSetup(manifest: AgentSetupManifest): void;\n}\n/**\n * agent 自己的沙箱运行时生命周期(每个 Attempt 一次,与「每轮 send」分开):\n * CLI 安装属于 runner 的 agent.ensure；`setup` 只写 model/base/auth 等本 Attempt 运行配置，`send` 只管把一轮 prompt\n * 跑起来(第一次 fresh / 后续 resume)+ 解析 transcript,`teardown` 清理。\n * 运行器在 layer prepare → agent.ensure → baseline 后、第一次 send 前调一次 `setup`,不返回值;\n * `teardown` 当且仅当本 attempt 走到过 `setup` 时点才执行(`setup` 抛错不豁免——半初始化\n * 的现场同样要扫尾),在 finally 里跑。要把 `setup` 里创建的句柄传给 `teardown`,以\n * `sandbox` 实例为键存取(同一个 Agent 实例服务并发 attempt,不要用实例字段或模块变量)。\n */\nexport type AgentSetup = (sandbox: Sandbox, ctx: SandboxAgentSetupContext) => Promise<void> | void;\nexport type AgentTeardown = (sandbox: Sandbox, ctx: SandboxAgentContext) => Promise<void> | void;\nexport type DirectAgentSetup = (ctx: AgentContext) => Promise<void> | void;\nexport type DirectAgentTeardown = (ctx: AgentContext) => Promise<void> | void;\n/**\n * 本 agent 的原生 OTLP span → canonical GenAI semconv 的薄 mapper。\n * 由 adapter 声明(和 tracing.env 一样属于「连到谁」的特殊性),core 只调接口——\n * 省略时 core 走通用 heuristic 兜底,不按 agent 名字分支。\n */\nexport type SpanMapper = (spans: TraceSpan[]) => TraceSpan[];\ninterface AgentBase {\n    readonly name: string;\n    /** 该 Adapter 的常态证据覆盖声明；六通道必填。 */\n    readonly evidenceCoverage: EvidenceCoverage;\n    /** 原生 span → canonical 的薄 mapper;省略走通用 heuristic。只影响瀑布图。 */\n    spanMapper?: SpanMapper;\n    /**\n     * 可选 send 执行失败分类器:归类 adapter reject 的 `SendFailure`；可信的 failed Turn\n     * 是领域结果，不进入这条链。\n     * 返回 `undefined` 表示不认识、回落保守兜底。链上排在实验的 `classifyFailure` 之后,\n     * 实验作者认领过的失败问不到这里。分类器只声明决策轴与诊断词,不影响重试策略(次数、\n     * 退避对所有 agent 一致);抛错按 `undefined` 回落并被吞掉,不掩盖原始失败。形状与分类链、\n     * 执行体时序见 docs/feature/error-classification/architecture.md。\n     */\n    classifySendFailure?: SendFailureClassifier;\n}\n// ───────────────────────── Agent Ensure / Installer ─────────────────────────\n/**\n * Agent 安装身份:纯数据,进 configHash 与 `run.json`。\n * 与 sandbox case 身份正交——改 Agent 版本不重建任务 BuildKey。\n * 见 docs/feature/adapters/architecture/agent-ensure.md。\n */\nexport interface AgentIdentity {\n    /** Agent 名(与 adapter 显示名对齐,如 `codex`)。 */\n    readonly agent: string;\n    /** 精确版本;禁止 `latest` 等无钉死取值——无稳定身份不参与可携带结果。 */\n    readonly version: string;\n    /** 配方修订(内置用数字字符串,自定义可用任意稳定串)。 */\n    readonly revision: string;\n}\n/**\n * 三种安装模式,全部显式;失败后不允许在模式之间静默降级。\n * - `staged`:制品在题面网络外准备,经文件 API 送入(内置默认)。\n * - `sandbox-network`:显式声明用沙箱内网络安装。\n * - `verify-only`:只接受预装命中;探测失败立即 errored。\n */\nexport type AgentInstallMode = \"staged\" | \"sandbox-network\" | \"verify-only\";\n/** staged payload 的完成态目标平台；Linux 的 libc 是身份的一部分，不能留成缺值。 */\nexport type AgentArtifactPlatform = {\n    readonly _tag: \"Linux\";\n    readonly os: \"linux\";\n    readonly arch: string;\n    readonly libc: \"gnu\" | \"musl\";\n} | {\n    readonly _tag: \"Darwin\";\n    readonly os: \"darwin\";\n    readonly arch: string;\n} | {\n    readonly _tag: \"Windows\";\n    readonly os: \"windows\";\n    readonly arch: string;\n};\n/**\n * Run 级准备好的锁定制品。digest + 实际 platform 只属于运行 provenance，不进入\n * configHash 或 Eval fingerprint；静态 installer identity/revision 与 ProviderPlan target 才是配置身份。\n * 安装时经主 Sandbox 文件 API 上传,不依赖题面网络。\n */\nexport interface AgentStagedArtifact {\n    readonly platform: AgentArtifactPlatform;\n    /** digest-backed 不可变内容句柄；不向 Attempt 泄露宿主路径。 */\n    readonly content: RegisteredSandboxContent;\n    /** 沙箱内落点，位于 workdir 外的 Agent 自有目录。 */\n    readonly targetPath: string;\n    /** 安装协议必须显式，不从缺失字段推断历史默认。 */\n    readonly install: AgentArtifactInstallShape;\n}\nexport type AgentArtifactInstallShape = {\n    readonly kind: \"npm-tarball\";\n} | {\n    readonly kind: \"self-contained\";\n    readonly binPath: string;\n};\n/** `agent.ensure` 的取值:区分 probe 命中与本次安装。 */\nexport type AgentEnsureOutcome = \"hit\" | \"installed\";\n/**\n * Adapter 声明的纯 Ensure 义务：身份与只读 probe。probe 的非零退出是未命中，不是\n * Agent 任务失败；Runner 决定是否交给 identity 精确匹配的 installer。\n */\nexport interface AgentEnsure {\n    readonly identity: AgentIdentity;\n    readonly probe: StableSandboxCommand;\n    /** Human-only transient labels; omitted adapters do not add an ensure detail. */\n    readonly progress?: {\n        readonly checking?: string;\n        readonly ready?: string;\n    };\n}\nexport interface AgentInstallContext {\n    readonly identity: AgentIdentity;\n    readonly targetPlatform: AgentArtifactPlatform;\n    readonly signal: AbortSignal;\n    progress(update: ProgressUpdate): void;\n}\nexport interface AgentArtifactContext {\n    readonly targetPlatform: AgentArtifactPlatform;\n    readonly signal: AbortSignal;\n}\nexport interface StagedAgentInstallContext extends AgentInstallContext {\n    readonly artifact: AgentStagedArtifact;\n}\ninterface AgentInstallerBase {\n    /** 必须与某条 ensure identity 完全相同；Runner 不做近似匹配。 */\n    readonly identity: AgentIdentity;\n    /** 支持的目标平台键(`linux-x64-gnu` 等)；省略表示 installer 自己支持所有平台。 */\n    readonly platforms?: readonly string[];\n    /** Human-only transient label; omitted installers do not add an install detail. */\n    readonly progress?: {\n        readonly installing?: string;\n    };\n    /** @internal 只由内置 cache-safe staged installer 写入。 */\n    readonly [AGENT_DOCKERFILE_CACHE_SAFE]?: true;\n}\nexport type AgentInstaller = (AgentInstallerBase & {\n    readonly installMode: \"staged\";\n    prepareArtifact(context: AgentArtifactContext): MaybePromise<AgentStagedArtifact>;\n    install(sandbox: SandboxCommandTarget, context: StagedAgentInstallContext): MaybePromise<void>;\n}) | (AgentInstallerBase & {\n    readonly installMode: \"sandbox-network\";\n    readonly prepareArtifact?: never;\n    install(sandbox: SandboxCommandTarget, context: AgentInstallContext): MaybePromise<void>;\n}) | (AgentInstallerBase & {\n    readonly installMode: \"verify-only\";\n    readonly prepareArtifact?: never;\n    readonly install?: never;\n});\n/** 在 NiceEval 管理的 Sandbox 内驱动 CLI 的 Agent。 */\nexport interface SandboxAgent extends AgentBase {\n    readonly kind: \"sandbox\";\n    /** Runner 在 author layers 后、setup 前按声明顺序执行。 */\n    readonly ensure: readonly AgentEnsure[];\n    /** 官方或第三方随 adapter 提供的安装层；仅 identity 精确匹配时可接手。 */\n    readonly installers: readonly AgentInstaller[];\n    setup?: AgentSetup;\n    tracing?: AgentTracing;\n    send(input: TurnInput, ctx: SandboxAgentContext): Promise<Turn>;\n    teardown?: AgentTeardown;\n}\n/** 由 runner 直接调用函数、SDK 或服务端点的 Agent；目标进程可以在本地或远端。 */\nexport interface DirectAgent extends AgentBase {\n    readonly kind: \"direct\";\n    setup?: DirectAgentSetup;\n    tracing?: Omit<AgentTracing, \"configure\">;\n    send(input: TurnInput, ctx: AgentContext): Promise<Turn>;\n    teardown?: DirectAgentTeardown;\n}\n/** 注册表里的 Agent；判别值描述驱动拓扑，不描述目标所在位置。 */\nexport type Agent = SandboxAgent | DirectAgent;\n/** `defineSandboxAgent()` 的入参形状(见 src/define.ts)——`kind: \"sandbox\"` 由 define 固定填入,不由用户声明。 */\nexport interface SandboxAgentDef {\n    /** agent 的显示名/标识,原样进入 `Agent.name`——不是注册表查找 key,只用于展示、结果归属与去重指纹。 */\n    name: string;\n    /** 该 Adapter 的常态证据覆盖声明；完整采集可用 `completeEvidenceCoverage`。 */\n    evidenceCoverage: EvidenceCoverage;\n    /** 单条或数组都按声明顺序规范化为 Agent layer。 */\n    ensure: AgentEnsure | readonly AgentEnsure[];\n    /**\n     * 配对安装层；省略表示这个 adapter 只提供 probe 协议，未命中时 Runner 在\n     * `agent.ensure` 点名缺失的精确 identity。工厂会把省略规范化成空数组。\n     */\n    installers?: readonly AgentInstaller[];\n    /**\n     * 每条 Attempt 一次(不是每轮 send 一次):写 config.toml / 鉴权配置(model/base/auth 等\n     * 本 Attempt 内不变的运行配置)。CLI 的 probe、安装与复检属于 `agent.ensure`。运行器在 Sandbox\n     * 备好(layer prepare/ensure/baseline 之后)、第一次 send 前调用一次,不返回值。\n     */\n    setup?: AgentSetup;\n    /** OTLP 导出配置:Sandbox 里怎么让 CLI 把 trace 发到 endpoint(env / 配置文件),从 setup 拆出。 */\n    tracing?: AgentTracing;\n    /** 原生 span → canonical 的薄 mapper;省略走通用 heuristic。只影响瀑布图。 */\n    spanMapper?: SpanMapper;\n    /** 每轮一次:跑 prompt(fresh / resume)+ 解析成 events。 */\n    send(input: TurnInput, ctx: SandboxAgentContext): Promise<Turn>;\n    /** 可选 send 执行失败分类器:见 `Agent.classifySendFailure`。 */\n    classifySendFailure?: SendFailureClassifier;\n    /** Sandbox 销毁前的清理,当且仅当本 attempt 走到过 `setup` 时点才执行(`setup` 抛错不豁免),\n     * 在 finally 里跑一次。 */\n    teardown?: AgentTeardown;\n}\n/** `defineAgent()` 的入参形状(见 src/define.ts)——`kind: \"direct\"` 由 define 固定填入,不由用户声明。 */\nexport interface DirectAgentDef {\n    /** agent 的显示名/标识,原样进入 `Agent.name`——不是注册表查找 key,只用于展示、结果归属与去重指纹。 */\n    name: string;\n    /** 该 Adapter 的常态证据覆盖声明；完整采集可用 `completeEvidenceCoverage`。 */\n    evidenceCoverage: EvidenceCoverage;\n    /**\n     * 每个 attempt 一次。Direct Agent 不接收 Sandbox；常用于建立连接、鉴权等一次性准备。\n     */\n    setup?: DirectAgentSetup;\n    /** OTLP 导出配置:被测对象怎么把 trace 发到 endpoint(env-based 注入)。 */\n    tracing?: Omit<AgentTracing, \"configure\">;\n    /** 原生 span → canonical 的薄 mapper;省略走通用 heuristic。只影响瀑布图。 */\n    spanMapper?: SpanMapper;\n    /** 每轮一次:把一轮 prompt 直接发给函数、SDK 或服务端点,解析响应成 events。 */\n    send(input: TurnInput, ctx: AgentContext): Promise<Turn>;\n    /** 可选 send 执行失败分类器:见 `Agent.classifySendFailure`。 */\n    classifySendFailure?: SendFailureClassifier;\n    /** 运行结束前的清理,当且仅当本 attempt 走到过 `setup` 时点才执行(`setup` 抛错不豁免),\n     * 在 finally 里跑一次。 */\n    teardown?: DirectAgentTeardown;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":";;AAAA,iDAAiD;AACjD,uDAAgE","sourcesContent":["// agent 域类型:Agent / Adapter 契约、会话与 tracing 导出配置。\nimport { AGENT_DOCKERFILE_CACHE_SAFE } from \"./cache-marker.ts\";\n// 「连到哪个被测对象、协议怎么说」的全部契约在这里(见 apps/docs-site/zh/explanation/adapter.mdx)。\n// 能力不再是问卷式声明:t 上解锁什么完全由构造证据决定(见 docs-site 「能力从哪来」一节)。\nimport type { DiagnosticInput, JsonValue, ProgressUpdate } from \"../shared/types.ts\";\nimport type { StreamEvent, TraceSpan, Usage } from \"../o11y/types.ts\";\nimport type { Sandbox } from \"../sandbox/types.ts\";\nimport type { SandboxLayer } from \"../sandbox/layer.ts\";\nimport type { AttemptRef, MaybePromise, SandboxCommandTarget, StableSandboxCommand } from \"../sandbox/commands.ts\";\nimport type { RegisteredSandboxContent } from \"../sandbox/content.ts\";\nimport type { SendFailureClassifier } from \"../context/send-failures.ts\";\nimport type { SessionSlot } from \"./session-slot.ts\";\nexport type { SessionSlot } from \"./session-slot.ts\";\n/**\n * 本地 stdio 形态的 MCP server:沙箱内起子进程,按 stdio 说 MCP 协议。\n * 与 {@link McpHttpServer} 按形状判别(有 `command` 的是 stdio,有 `url` 的是 HTTP)。\n */\nexport interface McpStdioServer {\n    /** 服务器唯一名(config key)。 */\n    name: string;\n    /** 启动命令(如 \"npx\"、\"node\"、\"uvx\")。 */\n    command: string;\n    /** 传给命令的参数。 */\n    args?: readonly string[];\n    /** 注入服务器进程的环境变量(可能含 secret,不进 manifest)。 */\n    env?: Readonly<globalThis.Record<string, string>>;\n    /** stdio 与 HTTP 是互斥完成态，不能把另一分支的字段混进来。 */\n    url?: never;\n    headers?: never;\n}\n/**\n * 远程 Streamable HTTP 形态的 MCP server:沙箱直接连一个 HTTP 端点。\n * `url` 必须沙箱内可达——宿主机上的服务先经隧道(cloudflared / tailscale 等)暴露。\n */\nexport interface McpHttpServer {\n    /** 服务器唯一名(config key)。 */\n    name: string;\n    /** Streamable HTTP 端点(如 https://mem.example.com/mcp/)。 */\n    url: string;\n    /** 逐字写进每个请求的 HTTP 头(常用于 Authorization;可能含 secret,不进 manifest)。 */\n    headers?: Readonly<globalThis.Record<string, string>>;\n    /** HTTP 与 stdio 是互斥完成态，不能把另一分支的字段混进来。 */\n    command?: never;\n    args?: never;\n    env?: never;\n}\n/**\n * MCP server 描述符 —— 支持 MCP 的 adapter(Claude Code / Codex)共用的工具服务单元,\n * 不是 native plugin 的一种。stdio 与 Streamable HTTP 两种形态按形状判别,不设 kind 标签\n * (两种形态各有唯一必填判别字段);同时给出 `command` 与 `url` 属配置错误,setup 报错点名。\n * 在 agent factory config 里声明,setup 阶段写进各自的配置文件。\n * 见 docs/feature/adapters/architecture/coding-agent-extensions.md「类型边界」。\n */\nexport type McpServer = McpStdioServer | McpHttpServer;\n/**\n * Skill 的来源描述 —— Claude Code / Codex / Bub 共用的**数据类型**:只统一「从哪里取得\n * 哪份 Skill」,安装位置、发现机制、要不要额外写 project instruction 由各 Adapter 决定。\n * 见 docs/feature/adapters/architecture/coding-agent-extensions.md「类型边界」。\n */\nexport type SkillSpec = {\n    kind: \"local\";\n    /** 相对项目根(跑 niceeval 的目录)的 Skill 文件或目录:`SKILL.md`、含 `SKILL.md` 的目录,或单个 `.md`。 */\n    path: string;\n    /** 展示名;省略时由文件或目录名推导(`<dir>/SKILL.md` → `<dir>`,`foo.md` → `foo`)。 */\n    name?: string;\n} | {\n    kind: \"repo\";\n    /** GitHub `owner/repo` 或 Git URL。 */\n    source: string;\n    /** 多 Skill Repo 中要启用的 Skill;repo 只有一个 Skill 时可省略,多个时省略即 setup 失败。 */\n    skills?: readonly string[];\n    /** Tag、Commit 或 Branch;省略表示 repo 默认 ref。 */\n    ref?: string;\n};\n/** Manifest 里的一条 Skill 安装记录:本地(带内容哈希)或 repo(带来源与 ref)。 */\nexport type AgentSetupSkill = {\n    kind: \"local\";\n    name: string;\n    path: string;\n    sha256: string;\n} | {\n    kind: \"repo\";\n    source: string;\n    ref?: string;\n    skills: string[];\n};\n/**\n * 一次 Agent setup 实际装了什么 —— 沙箱型 Coding Agent Adapter 在 setup 收尾经\n * `ctx.reportSetup()` 交回的安装清单。它是宿主侧内存对象,运行器把它作为 attempt artifact 存成\n * `agent-setup.json`(见 docs/feature/record/architecture.md);沙箱磁盘上不落它。不参与评分,\n * 只回答「这次实际装了什么」;**环境变量值与 secret 不写进来**(所以 mcpServers 只记\n * name/command/args)。\n */\nexport interface AgentSetupManifest {\n    /** 装进去的 Skill(按配置顺序;同名来自多个来源时逐条保留,不静默合并)。 */\n    skills: AgentSetupSkill[];\n    /** Agent 原生 Plugin(Claude Code / Codex 各自的 Marketplace 协议)。 */\n    nativePlugins?: Array<{\n        agent: \"claude-code\" | \"codex\";\n        marketplace: {\n            name: string;\n            source: string;\n            ref?: string;\n        };\n        name: string;\n        /** 安装后 CLI 报告的版本;取不到时省略。 */\n        resolvedVersion?: string;\n    }>;\n    /** 挂上的 MCP server(只记非 secret 字段:stdio 不含 env,HTTP 不含 headers)。 */\n    mcpServers?: Array<{\n        name: string;\n        command: string;\n        args?: string[];\n    } | {\n        name: string;\n        url: string;\n    }>;\n    /**\n     * 官方原生配置文件(Claude Code `settings.json` / Codex `config.toml`):只记 Agent 名、\n     * 项目相对来源路径与原始字节的 SHA-256,不落正文 —— 任意官方配置都可能携带敏感字符串,\n     * 不能靠字段白名单证明适合原样落盘。\n     */\n    nativeConfigFile?: {\n        agent: \"claude-code\" | \"codex\";\n        path: string;\n        sha256: string;\n    };\n    /** Bub 的 Python Plugin(规范化后的 package 串)。 */\n    pythonPlugins?: Array<{\n        package: string;\n    }>;\n}\n// ───────────────────────── 证据覆盖声明 ─────────────────────────\n/** 证据通道的覆盖状态；不存在隐含的 unknown 第四态。 */\nexport type EvidenceCoverageStatus = \"complete\" | \"partial\" | \"unavailable\";\n/** 非完整通道必须解释缺口；完整通道不能携带一个自相矛盾的 reason。 */\nexport type EvidenceCoverageEntry = {\n    readonly status: \"complete\";\n    readonly reason?: never;\n} | {\n    readonly status: Exclude<EvidenceCoverageStatus, \"complete\">;\n    readonly reason: string;\n};\n/**\n * 覆盖声明(EvidenceCoverage):完整性不是口头承诺,是随数据走的声明\n * (见 docs/feature/adapters/architecture/evidence.md)。两层:\n * - Agent 级默认(`defineAgent` / `defineSandboxAgent` 的 `evidenceCoverage`)必须逐一声明\n *   六个通道；官方 SDK 适配器可使用 `completeEvidenceCoverage`。\n * - Turn 级降级(`Turn.evidenceCoverage`)只用于相对 Agent 默认值降级。\n */\nexport interface EvidenceCoverage {\n    /** 完整事件流(event / notEvent / order 的依据)。 */\n    readonly events: EvidenceCoverageEntry;\n    /** action 生命周期(工具正负断言、顺序、失败的依据)。 */\n    readonly actions: EvidenceCoverageEntry;\n    /** assistant / user message（reply 与显式 message 值断言的依据）。 */\n    readonly messages: EvidenceCoverageEntry;\n    /** usage(token / cost 上限断言的依据)。 */\n    readonly usage: EvidenceCoverageEntry;\n    /** Turn status 的真实性(succeeded / parked 的依据)——恒 completed 的映射必须声明非 complete。 */\n    readonly status: EvidenceCoverageEntry;\n    /** Turn.data（供 `t.check(turn.data, match)` 检查结构化输出）。 */\n    readonly data: EvidenceCoverageEntry;\n}\n/** 单轮只列相对 Agent 默认值的降级通道；省略的通道沿用 Agent 声明。 */\nexport type TurnEvidenceCoverage = Partial<EvidenceCoverage>;\n/** 随一轮消息附带的文件(图片等多模态输入)。 */\nexport interface InputFile {\n    /** 文件名(可选,供 adapter / 模型参考)。 */\n    readonly filename?: string;\n    /** MIME 类型,如 `image/png`、`image/jpeg`。 */\n    readonly mimeType: string;\n    /** base64 编码的文件内容(JSON 友好,remote adapter 可直接放进请求体)。 */\n    readonly dataBase64: string;\n}\n/**\n * HITL 回答轮里,人的裁决以结构化形式随 `input.responses` 到达——adapter 不需要解析\n * `text` 去猜哪句回答对应哪个请求、算不算批准。见 apps/docs-site/zh/explanation/adapter.mdx\n * 「不同回答的入参」一节的四种典型形态。\n */\nexport type AnswerValue = {\n    readonly optionId: string;\n    readonly text?: never;\n} | {\n    readonly text: string;\n    readonly optionId?: never;\n};\nexport type InputResponse = {\n    /** 对应哪条 input.requested 请求;多个请求并停时靠它对位。 */\n    readonly requestId: string;\n} & AnswerValue;\nexport interface TurnInput {\n    readonly text: string;\n    /** 本轮附带的文件(图片等)。adapter 自行决定怎么投递;不支持多模态的 adapter 忽略它。 */\n    readonly files?: readonly InputFile[];\n    /** 仅回答轮(t.respond / t.respondAll):逐请求的结构化回答,按 requestId 对位。 */\n    readonly responses?: readonly InputResponse[];\n}\n/** adapter 的 send 返回值(事件流为核心)。 */\nexport interface Turn {\n    readonly events: StreamEvent[];\n    readonly data?: JsonValue;\n    readonly status: \"completed\" | \"failed\" | \"waiting\";\n    readonly usage?: Usage;\n    /**\n     * 本轮相对 Agent 默认覆盖的降级声明(这一轮流断了、拿不到 usage 等);\n     * 只能降级,不能把 Agent 未声明的通道升格成 complete(见 EvidenceCoverage)。\n     */\n    readonly evidenceCoverage?: TurnEvidenceCoverage;\n}\n/**\n * 本次运行的 OTLP traces 接收信息(仅当配置了 OTel 接入时有——agent 的 `tracing` 块 /\n * config 的 telemetry 存在)。经 ctx.telemetry 交给 agent。span 只进瀑布图,不喂断言。\n * 远程 HTTP 接入的 send 只需要 spread `headers`(每轮一个新 traceparent);接收端点是\n * 启动期配置(`defineConfig({ telemetry: { port } } )`)固定的,不从这里传。\n */\nexport interface Telemetry {\n    /** 接收端点(完整路径,形如 http://127.0.0.1:PORT/v1/traces)。 */\n    readonly endpoint: string;\n    /**\n     * env-based 导出的 env(= AgentTracing.env(endpoint) 的结果),ready-to-spread。\n     * adapter 的 send 直接 `{ ...ctx.telemetry?.env }` 注入,不必手搓 OTEL_* 拼装。\n     */\n    readonly env?: Readonly<globalThis.Record<string, string>>;\n    /**\n     * 本轮的 W3C trace context(traceparent),每轮一个新值。send 把它 spread 进 HTTP 请求头\n     * (或注入子进程 env)——应用埋点支持 context 传播时,本轮 span 挂到我们给的 trace 下,\n     * 并发跑 eval 的 span 归属才精确;不带则回退时间窗口归属(该 agent 自动降为串行)。\n     */\n    readonly headers?: Readonly<globalThis.Record<string, string>>;\n}\n/**\n * agent 的 OTLP 导出配置 —— 「沙箱里怎么让这个 CLI 把 trace 发到 endpoint」。\n * 刻意从 setup 里拆出来:setup 管运行配置,这里只管 otel 导出。CLI 安装归 `agent.ensure`。两种投递方式\n * (互不排斥,按 CLI 而定):\n *   · env-based(标准 OTEL_* 环境变量,如 bub/Python OTel SDK)—— 用 `env`;\n *   · file-based(CLI 自有配置文件,如 codex 的 config.toml [otel] 块)—— 用 `configure`。\n */\nexport interface AgentTracing {\n    /**\n     * 线协议(codex 发 OTLP/JSON、bub 发 OTLP/protobuf)。接收器按 content-type 自动解码,\n     * 此字段仅作声明/日志用,也为将来按协议分流留口。\n     */\n    protocol?: \"http/json\" | \"http/protobuf\";\n    /**\n     * 接收器粒度(仅非沙箱 agent;沙箱型每沙箱一个,与此无关):\n     *   · \"attempt\"(默认)—— 每个 attempt 一个接收器。适合每轮能切换导出端点的被测对象\n     *     (进程内 adapter,如内置 aiSdkAgent 的可切换 exporter),attempt 间天然隔离、可全并发。\n     *   · \"run\" —— 整个 run 共享一个接收器(每 agent 一个)。**长驻服务必选**:应用的 OTEL_*\n     *     env 进程启动时读一次,per-attempt 端口会在第一个 attempt 结束时失效。span 逐轮归属\n     *     (traceparent / 时间窗口 + 串行守卫),见 ctx.telemetry.headers。\n     * config 配了 `telemetry`(固定端口,无侵入接入的长驻服务场景)的非沙箱 agent 自动按 \"run\" 处理。\n     */\n    scope?: \"attempt\" | \"run\";\n    /**\n     * env-based 导出:给 endpoint → 返回要注入每轮 send 的 env(纯函数)。运行器把结果\n     * 放进 ctx.telemetry.env,send 直接 spread。\n     */\n    env?(endpoint: string): globalThis.Record<string, string>;\n    /**\n     * file-based 导出:给 sandbox + ctx(ctx.telemetry.endpoint 必有),自己写 / 追加配置文件。\n     * 运行器在 agent.setup 之后、首次 send 之前调一次(仅当 tracing 开 + 有 endpoint)。\n     * 注:codex 的 [otel.trace_exporter.otlp-http] 是子表,configure 在 setup 写完主配置后\n     * 追加到 config.toml 末尾,天然满足「子表在所有上层表之后」。\n     */\n    configure?(sandbox: Sandbox, ctx: SandboxAgentContext): Promise<void> | void;\n}\n/**\n * 一条会话线。核心承诺只有一句:**同一条会话线的每次 send 拿到同一个 `ctx.session`,\n * 新会话线(eval 第一轮 / t.newSession() 之后)拿到一个全新的。**\n * 服务端历史用 `id` / `capture`，客户端历史与 HITL 停轮现场用 Adapter\n * 私有的 typed slot。\"第一轮\"是新会话线的自然形态，没有要判断的分支。\n */\nexport interface AgentSession {\n    /** 会话续接:服务端记历史。本线记过的会话 id;新会话线是 undefined。 */\n    readonly id?: string;\n    /** 记回传的会话 id;只在还没记过时落地(first-writer-wins),空值忽略。 */\n    capture(id: string | undefined): void;\n    /** 读 Adapter 私有 slot；新会话线或未写过的 slot 为空。 */\n    get<T>(slot: SessionSlot<T>): T | undefined;\n    /** 写 Adapter 私有 slot；同一 slot 再写覆盖旧值。 */\n    set<T>(slot: SessionSlot<T>, value: T): void;\n    /** 读并删除 Adapter 私有 slot，只消费一次。 */\n    take<T>(slot: SessionSlot<T>): T | undefined;\n}\n/** Runner-owned Attempt resource registry; adapters use it for cross-send drivers. */\nexport interface AttemptResourceRegistry {\n    acquire<T>(acquire: () => Promise<T>, lifecycle: {\n        shutdown: (resource: T, signal: AbortSignal) => Promise<void>;\n        release: (resource: T, signal: AbortSignal) => Promise<void>;\n    }): Promise<T>;\n    shutdownAll(signal: AbortSignal): Promise<void>;\n}\nexport interface AgentContext {\n    /**\n     * 软取消信号:合并了 attempt 超时、run 级中断(用户 Ctrl+C)与评估用例自身的中断请求\n     * (见 src/runner/attempt.ts)。adapter 可以选择性检查它(或直接传给 `fetch`)以提前\n     * 优雅退出,但这不是唯一的硬边界——即便 adapter 完全忽略它,运行器也会用\n     * `Effect.timeoutTo` 兜底强制收尾(停 Sandbox 容器)。\n     */\n    readonly signal: AbortSignal;\n    /** 本次 attempt 用的模型名,透传自 experiment 的 `model` 字段。sandbox 型 agent 通常在 setup 里用它写配置,direct 型通常在 send 里用它选模型。 */\n    readonly model?: string;\n    /** 模型推理努力程度;归属同 model——实验决定,省略时不覆盖 agent 原生默认。 */\n    readonly reasoningEffort?: string;\n    /**\n     * experiment 的 `flags` 字段原样透传,内容和结构完全由 experiment 作者自定义\n     * (如 `{ webResearch: true }`、`{ systemPrompt: \"...\" }`)。adapter 按自己的约定\n     * 读取其中的字段;框架本身不解释、不校验它的内容。命名特意避开 CLI 解析出的\n     * `flag`(跑法层面的 --timeout/--budget 等),两者是不相关的概念。\n     */\n    readonly flags: Readonly<globalThis.Record<string, JsonValue>>;\n    /**\n     * 路径推导出的实验 id(与结果归属 `runWho` / `AgentRun.experimentId` 同源);不经\n     * experiment 跑(如脱离 CLI、直接构造 `AgentRun` 的场景)时为 undefined。典型用途:\n     * SandboxLayer command 按实验隔离跨 attempt 的基础设施内容，或 adapter 按实验切换鉴权 / 路由。\n     * 与 `flags`(实验条件的\n     * 具体取值)是两个维度——这里只是「跑的是哪个实验」的稳定标识,不携带条件内容。\n     */\n    readonly experimentId?: string;\n    /**\n     * 当前 Attempt 对应的 eval ID。NiceEval Runner 始终从 discovery 后的评估用例身份填入；\n     * 第三方直接构造 AgentContext 时可省略。Adapter 可用它定位与题目同目录的只读宿主资产，\n     * 但不能据此绕过 Sandbox 的隐藏判据隔离。\n     */\n    readonly evalId?: string;\n    /** 当前 Attempt 的评估组；未分组评估用例省略。 */\n    readonly evalGroup?: {\n        readonly id: string;\n        readonly definitionHash: string;\n    };\n    /** Runner 填入的当前 Attempt 引用；第三方直接构造上下文时可省略。 */\n    readonly attempt?: AttemptRef;\n    readonly session: AgentSession;\n    /**\n     * 仅当配置了 OTel 接入时有(agent 的 `tracing` 块 / config 的 telemetry 存在):\n     * 本次运行的 OTLP traces 接收信息(endpoint + env-based 导出 env)。\n     * 怎么把它交给 CLI 由 agent 的 `tracing` 块声明:env-based 的把 ctx.telemetry.env\n     * spread 进 send;file-based 的在 tracing.configure 里写配置。远程 HTTP 接入的 send\n     * 只需要把 headers spread 进请求头(每轮一个新 traceparent);端点是启动期配置\n     * (defineConfig({ telemetry: { port } }))固定的,不从这里传。\n     */\n    readonly telemetry?: Telemetry;\n    /**\n     * 作用域反馈:报告此刻正在做什么(turn / tool / 安装进度)。短命状态——Human profile\n     * 更新 active 行,`agent`/`ci` 不逐条打印,也不进最终结果;不要每个 token/delta 都调用。\n     * runner 按当前回调所处的生命周期阶段(agent.setup / agent.run / agent.teardown)归因,\n     * 调用方不能冒充其它阶段(见 docs/feature/experiments/library.md)。\n     */\n    progress(update: ProgressUpdate): void;\n    /**\n     * 作用域反馈:报告运行结束后仍应保留的问题(协议降级、数据不完整、cleanup 问题)。\n     * 永久事件,落进 attempt 的 diagnostics 并进各 profile 的永久输出;`dedupeKey` 去重。\n     * 即使 level 为 \"error\" 也不改变 Turn.status / verdict——无法继续时抛异常。\n     */\n    diagnostic(input: DiagnosticInput): void;\n    /**\n     * `progress({ message: msg })` 的别名,不是第二条通道(见 docs/feature/experiments/cli.md\n     * 「Attempt 阶段」)。超时失败时最近若干行会并入结果的 error 信息,方便定位卡在哪一步。\n     */\n    log(msg: string): void;\n}\n/** 仅 Sandbox Agent 可见的上下文；Direct Agent 不接收也不伪造 Sandbox。 */\nexport interface SandboxAgentContext extends AgentContext {\n    readonly sandbox: Sandbox;\n}\n/** Per-send context; setup and teardown deliberately never receive a turn identity. */\nexport interface AgentSendContext extends AgentContext {\n    readonly turnId: import(\"../o11y/record/model.ts\").TurnId;\n}\nexport interface SandboxAgentSendContext extends SandboxAgentContext {\n    readonly turnId: import(\"../o11y/record/model.ts\").TurnId;\n}\n/**\n * Agent `setup` 的上下文:沙箱上下文再加一条宿主侧安装清单回执通道。只有 `setup` 收得到它——\n * 安装事实在这一步产生,`send` / `teardown` 不再补写。\n */\nexport interface SandboxAgentSetupContext extends SandboxAgentContext {\n    /**\n     * 交回这次实际安装了什么(Skill / 原生 Plugin / MCP / 原生配置文件)。清单是宿主侧内存对象,\n     * 运行器直接存成 attempt artifact `agent-setup.json`;沙箱里不落任何框架文件\n     * (见 docs/observability.md「宿主侧行为断言:t.o11y」)。什么都没装就别调——空清单不生成\n     * artifact。同一次 `setup` 内多次调用后写覆盖先写。\n     */\n    reportSetup(manifest: AgentSetupManifest): void;\n}\n/**\n * agent 自己的沙箱运行时生命周期(每个 Attempt 一次,与「每轮 send」分开):\n * CLI 安装属于 runner 的 agent.ensure；`setup` 只写 model/base/auth 等本 Attempt 运行配置，`send` 只管把一轮 prompt\n * 跑起来(第一次 fresh / 后续 resume)+ 解析 transcript,`teardown` 清理。\n * 运行器在 layer prepare → agent.ensure → baseline 后、第一次 send 前调一次 `setup`,不返回值;\n * `teardown` 当且仅当本 attempt 走到过 `setup` 时点才执行(`setup` 抛错不豁免——半初始化\n * 的现场同样要扫尾),在 finally 里跑。要把 `setup` 里创建的句柄传给 `teardown`,以\n * `sandbox` 实例为键存取(同一个 Agent 实例服务并发 attempt,不要用实例字段或模块变量)。\n */\nexport type AgentSetup = (sandbox: Sandbox, ctx: SandboxAgentSetupContext) => Promise<void> | void;\nexport type AgentTeardown = (sandbox: Sandbox, ctx: SandboxAgentContext) => Promise<void> | void;\nexport type DirectAgentSetup = (ctx: AgentContext) => Promise<void> | void;\nexport type DirectAgentTeardown = (ctx: AgentContext) => Promise<void> | void;\n/**\n * 本 agent 的原生 OTLP span → canonical GenAI semconv 的薄 mapper。\n * 由 adapter 声明(和 tracing.env 一样属于「连到谁」的特殊性),core 只调接口——\n * 省略时 core 走通用 heuristic 兜底,不按 agent 名字分支。\n */\nexport type SpanMapper = (spans: TraceSpan[]) => TraceSpan[];\ninterface AgentBase {\n    readonly name: string;\n    /** 该 Adapter 的常态证据覆盖声明；六通道必填。 */\n    readonly evidenceCoverage: EvidenceCoverage;\n    /** 原生 span → canonical 的薄 mapper;省略走通用 heuristic。只影响瀑布图。 */\n    spanMapper?: SpanMapper;\n    /**\n     * 可选 send 执行失败分类器:归类 adapter reject 的 `SendFailure`；可信的 failed Turn\n     * 是领域结果，不进入这条链。\n     * 返回 `undefined` 表示不认识、回落保守兜底。链上排在实验的 `classifyFailure` 之后,\n     * 实验作者认领过的失败问不到这里。分类器只声明决策轴与诊断词,不影响重试策略(次数、\n     * 退避对所有 agent 一致);抛错按 `undefined` 回落并被吞掉,不掩盖原始失败。形状与分类链、\n     * 执行体时序见 docs/feature/error-classification/architecture.md。\n     */\n    classifySendFailure?: SendFailureClassifier;\n}\n// ───────────────────────── Agent Ensure / Installer ─────────────────────────\n/**\n * Agent 安装身份:纯数据,进 configHash 与 `run.json`。\n * 与 sandbox case 身份正交——改 Agent 版本不重建任务 BuildKey。\n * 见 docs/feature/adapters/architecture/agent-ensure.md。\n */\nexport interface AgentIdentity {\n    /** Agent 名(与 adapter 显示名对齐,如 `codex`)。 */\n    readonly agent: string;\n    /** 精确版本;禁止 `latest` 等无钉死取值——无稳定身份不参与可携带结果。 */\n    readonly version: string;\n    /** 配方修订(内置用数字字符串,自定义可用任意稳定串)。 */\n    readonly revision: string;\n}\n/**\n * 三种安装模式,全部显式;失败后不允许在模式之间静默降级。\n * - `staged`:制品在题面网络外准备,经文件 API 送入(内置默认)。\n * - `sandbox-network`:显式声明用沙箱内网络安装。\n * - `verify-only`:只接受预装命中;探测失败立即 errored。\n */\nexport type AgentInstallMode = \"staged\" | \"sandbox-network\" | \"verify-only\";\n/** staged payload 的完成态目标平台；Linux 的 libc 是身份的一部分，不能留成缺值。 */\nexport type AgentArtifactPlatform = {\n    readonly _tag: \"Linux\";\n    readonly os: \"linux\";\n    readonly arch: string;\n    readonly libc: \"gnu\" | \"musl\";\n} | {\n    readonly _tag: \"Darwin\";\n    readonly os: \"darwin\";\n    readonly arch: string;\n} | {\n    readonly _tag: \"Windows\";\n    readonly os: \"windows\";\n    readonly arch: string;\n};\n/**\n * Run 级准备好的锁定制品。digest + 实际 platform 只属于运行 provenance，不进入\n * configHash 或 Eval fingerprint；静态 installer identity/revision 与 ProviderPlan target 才是配置身份。\n * 安装时经主 Sandbox 文件 API 上传,不依赖题面网络。\n */\nexport interface AgentStagedArtifact {\n    readonly platform: AgentArtifactPlatform;\n    /** digest-backed 不可变内容句柄；不向 Attempt 泄露宿主路径。 */\n    readonly content: RegisteredSandboxContent;\n    /** 沙箱内落点，位于 workdir 外的 Agent 自有目录。 */\n    readonly targetPath: string;\n    /** 安装协议必须显式，不从缺失字段推断历史默认。 */\n    readonly install: AgentArtifactInstallShape;\n}\nexport type AgentArtifactInstallShape = {\n    readonly kind: \"npm-tarball\";\n} | {\n    readonly kind: \"self-contained\";\n    readonly binPath: string;\n};\n/** `agent.ensure` 的取值:区分 probe 命中与本次安装。 */\nexport type AgentEnsureOutcome = \"hit\" | \"installed\";\n/**\n * Adapter 声明的纯 Ensure 义务：身份与只读 probe。probe 的非零退出是未命中，不是\n * Agent 任务失败；Runner 决定是否交给 identity 精确匹配的 installer。\n */\nexport interface AgentEnsure {\n    readonly identity: AgentIdentity;\n    readonly probe: StableSandboxCommand;\n    /** Human-only transient labels; omitted adapters do not add an ensure detail. */\n    readonly progress?: {\n        readonly checking?: string;\n        readonly ready?: string;\n    };\n}\nexport interface AgentInstallContext {\n    readonly identity: AgentIdentity;\n    readonly targetPlatform: AgentArtifactPlatform;\n    readonly signal: AbortSignal;\n    progress(update: ProgressUpdate): void;\n}\nexport interface AgentArtifactContext {\n    readonly targetPlatform: AgentArtifactPlatform;\n    readonly signal: AbortSignal;\n}\nexport interface StagedAgentInstallContext extends AgentInstallContext {\n    readonly artifact: AgentStagedArtifact;\n}\ninterface AgentInstallerBase {\n    /** 必须与某条 ensure identity 完全相同；Runner 不做近似匹配。 */\n    readonly identity: AgentIdentity;\n    /** 支持的目标平台键(`linux-x64-gnu` 等)；省略表示 installer 自己支持所有平台。 */\n    readonly platforms?: readonly string[];\n    /** Human-only transient label; omitted installers do not add an install detail. */\n    readonly progress?: {\n        readonly installing?: string;\n    };\n    /** @internal 只由内置 cache-safe staged installer 写入。 */\n    readonly [AGENT_DOCKERFILE_CACHE_SAFE]?: true;\n}\nexport type AgentInstaller = (AgentInstallerBase & {\n    readonly installMode: \"staged\";\n    prepareArtifact(context: AgentArtifactContext): MaybePromise<AgentStagedArtifact>;\n    install(sandbox: SandboxCommandTarget, context: StagedAgentInstallContext): MaybePromise<void>;\n}) | (AgentInstallerBase & {\n    readonly installMode: \"sandbox-network\";\n    readonly prepareArtifact?: never;\n    install(sandbox: SandboxCommandTarget, context: AgentInstallContext): MaybePromise<void>;\n}) | (AgentInstallerBase & {\n    readonly installMode: \"verify-only\";\n    readonly prepareArtifact?: never;\n    readonly install?: never;\n});\n/** 在 NiceEval 管理的 Sandbox 内驱动 CLI 的 Agent。 */\nexport interface SandboxAgent extends AgentBase {\n    readonly kind: \"sandbox\";\n    /** Adapter-owned command-only contribution to the unified Sandbox action DAG. */\n    readonly sandbox?: SandboxLayer<\"command-only\">;\n    /** Runner 在 author layers 后、setup 前按声明顺序执行。 */\n    readonly ensure: readonly AgentEnsure[];\n    /** 官方或第三方随 adapter 提供的安装层；仅 identity 精确匹配时可接手。 */\n    readonly installers: readonly AgentInstaller[];\n    setup?: AgentSetup;\n    tracing?: AgentTracing;\n    send(input: TurnInput, ctx: SandboxAgentSendContext): Promise<Turn>;\n    teardown?: AgentTeardown;\n}\n/** 由 runner 直接调用函数、SDK 或服务端点的 Agent；目标进程可以在本地或远端。 */\nexport interface DirectAgent extends AgentBase {\n    readonly kind: \"direct\";\n    setup?: DirectAgentSetup;\n    tracing?: Omit<AgentTracing, \"configure\">;\n    send(input: TurnInput, ctx: AgentSendContext): Promise<Turn>;\n    teardown?: DirectAgentTeardown;\n}\n/** 注册表里的 Agent；判别值描述驱动拓扑，不描述目标所在位置。 */\nexport type Agent = SandboxAgent | DirectAgent;\n/** `defineSandboxAgent()` 的入参形状(见 src/define.ts)——`kind: \"sandbox\"` 由 define 固定填入,不由用户声明。 */\nexport interface SandboxAgentDef {\n    /** agent 的显示名/标识,原样进入 `Agent.name`——不是注册表查找 key,只用于展示、结果归属与去重指纹。 */\n    name: string;\n    /** 该 Adapter 的常态证据覆盖声明；完整采集可用 `completeEvidenceCoverage`。 */\n    evidenceCoverage: EvidenceCoverage;\n    /** Adapter 自有的 Sandbox action；Agent 不能选择或贡献 template。 */\n    sandbox?: SandboxLayer<\"command-only\">;\n    /** 单条或数组都按声明顺序规范化为 Agent layer。 */\n    ensure: AgentEnsure | readonly AgentEnsure[];\n    /**\n     * 配对安装层；省略表示这个 adapter 只提供 probe 协议，未命中时 Runner 在\n     * `agent.ensure` 点名缺失的精确 identity。工厂会把省略规范化成空数组。\n     */\n    installers?: readonly AgentInstaller[];\n    /**\n     * 每条 Attempt 一次(不是每轮 send 一次):写 config.toml / 鉴权配置(model/base/auth 等\n     * 本 Attempt 内不变的运行配置)。CLI 的 probe、安装与复检属于 `agent.ensure`。运行器在 Sandbox\n     * 备好(layer prepare/ensure/baseline 之后)、第一次 send 前调用一次,不返回值。\n     */\n    setup?: AgentSetup;\n    /** OTLP 导出配置:Sandbox 里怎么让 CLI 把 trace 发到 endpoint(env / 配置文件),从 setup 拆出。 */\n    tracing?: AgentTracing;\n    /** 原生 span → canonical 的薄 mapper;省略走通用 heuristic。只影响瀑布图。 */\n    spanMapper?: SpanMapper;\n    /** 每轮一次:跑 prompt(fresh / resume)+ 解析成 events。 */\n    send(input: TurnInput, ctx: SandboxAgentSendContext): Promise<Turn>;\n    /** 可选 send 执行失败分类器:见 `Agent.classifySendFailure`。 */\n    classifySendFailure?: SendFailureClassifier;\n    /** Sandbox 销毁前的清理,当且仅当本 attempt 走到过 `setup` 时点才执行(`setup` 抛错不豁免),\n     * 在 finally 里跑一次。 */\n    teardown?: AgentTeardown;\n}\n/** `defineAgent()` 的入参形状(见 src/define.ts)——`kind: \"direct\"` 由 define 固定填入,不由用户声明。 */\nexport interface DirectAgentDef {\n    /** agent 的显示名/标识,原样进入 `Agent.name`——不是注册表查找 key,只用于展示、结果归属与去重指纹。 */\n    name: string;\n    /** 该 Adapter 的常态证据覆盖声明；完整采集可用 `completeEvidenceCoverage`。 */\n    evidenceCoverage: EvidenceCoverage;\n    /**\n     * 每个 attempt 一次。Direct Agent 不接收 Sandbox；常用于建立连接、鉴权等一次性准备。\n     */\n    setup?: DirectAgentSetup;\n    /** OTLP 导出配置:被测对象怎么把 trace 发到 endpoint(env-based 注入)。 */\n    tracing?: Omit<AgentTracing, \"configure\">;\n    /** 原生 span → canonical 的薄 mapper;省略走通用 heuristic。只影响瀑布图。 */\n    spanMapper?: SpanMapper;\n    /** 每轮一次:把一轮 prompt 直接发给函数、SDK 或服务端点,解析响应成 events。 */\n    send(input: TurnInput, ctx: AgentSendContext): Promise<Turn>;\n    /** 可选 send 执行失败分类器:见 `Agent.classifySendFailure`。 */\n    classifySendFailure?: SendFailureClassifier;\n    /** 运行结束前的清理,当且仅当本 attempt 走到过 `setup` 时点才执行(`setup` 抛错不豁免),\n     * 在 finally 里跑一次。 */\n    teardown?: DirectAgentTeardown;\n}\n"]}

package/dist/agents/types.d.cts

@@ -2,6 +2,7 @@ import { AGENT_DOCKERFILE_CACHE_SAFE } from "./cache-marker.cjs";
 import type { DiagnosticInput, JsonValue, ProgressUpdate } from "../shared/types.cjs";
 import type { StreamEvent, TraceSpan, Usage } from "../o11y/types.cjs";
 import type { Sandbox } from "../sandbox/types.cjs";
+import type { SandboxLayer } from "../sandbox/layer.cjs";
 import type { AttemptRef, MaybePromise, SandboxCommandTarget, StableSandboxCommand } from "../sandbox/commands.cjs";
 import type { RegisteredSandboxContent } from "../sandbox/content.cjs";
 import type { SendFailureClassifier } from "../context/send-failures.cjs";
@@ -359,6 +360,13 @@ export interface AgentContext {
 export interface SandboxAgentContext extends AgentContext {
     readonly sandbox: Sandbox;
 }
+/** Per-send context; setup and teardown deliberately never receive a turn identity. */
+export interface AgentSendContext extends AgentContext {
+    readonly turnId: import("../o11y/record/model.cjs").TurnId;
+}
+export interface SandboxAgentSendContext extends SandboxAgentContext {
+    readonly turnId: import("../o11y/record/model.cjs").TurnId;
+}
 /**
  * Agent `setup` 的上下文:沙箱上下文再加一条宿主侧安装清单回执通道。只有 `setup` 收得到它——
  * 安装事实在这一步产生,`send` / `teardown` 不再补写。
@@ -518,13 +526,15 @@ export type AgentInstaller = (AgentInstallerBase & {
 /** 在 NiceEval 管理的 Sandbox 内驱动 CLI 的 Agent。 */
 export interface SandboxAgent extends AgentBase {
     readonly kind: "sandbox";
+    /** Adapter-owned command-only contribution to the unified Sandbox action DAG. */
+    readonly sandbox?: SandboxLayer<"command-only">;
     /** Runner 在 author layers 后、setup 前按声明顺序执行。 */
     readonly ensure: readonly AgentEnsure[];
     /** 官方或第三方随 adapter 提供的安装层；仅 identity 精确匹配时可接手。 */
     readonly installers: readonly AgentInstaller[];
     setup?: AgentSetup;
     tracing?: AgentTracing;
-    send(input: TurnInput, ctx: SandboxAgentContext): Promise<Turn>;
+    send(input: TurnInput, ctx: SandboxAgentSendContext): Promise<Turn>;
     teardown?: AgentTeardown;
 }
 /** 由 runner 直接调用函数、SDK 或服务端点的 Agent；目标进程可以在本地或远端。 */
@@ -532,7 +542,7 @@ export interface DirectAgent extends AgentBase {
     readonly kind: "direct";
     setup?: DirectAgentSetup;
     tracing?: Omit<AgentTracing, "configure">;
-    send(input: TurnInput, ctx: AgentContext): Promise<Turn>;
+    send(input: TurnInput, ctx: AgentSendContext): Promise<Turn>;
     teardown?: DirectAgentTeardown;
 }
 /** 注册表里的 Agent；判别值描述驱动拓扑，不描述目标所在位置。 */
@@ -543,6 +553,8 @@ export interface SandboxAgentDef {
     name: string;
     /** 该 Adapter 的常态证据覆盖声明；完整采集可用 `completeEvidenceCoverage`。 */
     evidenceCoverage: EvidenceCoverage;
+    /** Adapter 自有的 Sandbox action；Agent 不能选择或贡献 template。 */
+    sandbox?: SandboxLayer<"command-only">;
     /** 单条或数组都按声明顺序规范化为 Agent layer。 */
     ensure: AgentEnsure | readonly AgentEnsure[];
     /**
@@ -561,7 +573,7 @@ export interface SandboxAgentDef {
     /** 原生 span → canonical 的薄 mapper;省略走通用 heuristic。只影响瀑布图。 */
     spanMapper?: SpanMapper;
     /** 每轮一次:跑 prompt(fresh / resume)+ 解析成 events。 */
-    send(input: TurnInput, ctx: SandboxAgentContext): Promise<Turn>;
+    send(input: TurnInput, ctx: SandboxAgentSendContext): Promise<Turn>;
     /** 可选 send 执行失败分类器:见 `Agent.classifySendFailure`。 */
     classifySendFailure?: SendFailureClassifier;
     /** Sandbox 销毁前的清理,当且仅当本 attempt 走到过 `setup` 时点才执行(`setup` 抛错不豁免),
@@ -583,7 +595,7 @@ export interface DirectAgentDef {
     /** 原生 span → canonical 的薄 mapper;省略走通用 heuristic。只影响瀑布图。 */
     spanMapper?: SpanMapper;
     /** 每轮一次:把一轮 prompt 直接发给函数、SDK 或服务端点,解析响应成 events。 */
-    send(input: TurnInput, ctx: AgentContext): Promise<Turn>;
+    send(input: TurnInput, ctx: AgentSendContext): Promise<Turn>;
     /** 可选 send 执行失败分类器:见 `Agent.classifySendFailure`。 */
     classifySendFailure?: SendFailureClassifier;
     /** 运行结束前的清理,当且仅当本 attempt 走到过 `setup` 时点才执行(`setup` 抛错不豁免),