reeval 0.0.1

package/dist/src-DwwiVLqv.js

@@ -0,0 +1,2937 @@
+import { l as ownFileURL } from "./root-CFDjpWuc.js";
+import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync } from "node:fs";
+import { basename, dirname, join, posix, relative, win32 } from "node:path";
+import net, { BlockList, isIP } from "node:net";
+import { fileURLToPath } from "node:url";
+import { createHash, generateKeyPairSync, randomBytes, randomInt, sign } from "node:crypto";
+import { prepareSandboxForHarness } from "@ai-sdk/harness/agent";
+import { spawn } from "node:child_process";
+import { isUtf8 } from "node:buffer";
+import { Duplex, Readable, Transform } from "node:stream";
+import http from "node:http";
+import http2 from "node:http2";
+import https from "node:https";
+import tls from "node:tls";
+import { lookup } from "node:dns/promises";
+//#region ../sandbox-docker/src/build-failure.ts
+var ImageBuildError = class extends Error {
+	name = "ImageBuildError";
+	failure;
+	constructor(message, failure) {
+		super(message);
+		this.failure = failure;
+	}
+};
+const stripAnsi = (text) => text.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "");
+/** The failing step and its output from `--progress plain` build output. */
+function parseBuildOutput(text) {
+	const lines = stripAnsi(text).split(/\r?\n/);
+	let step = null;
+	let error = null;
+	for (const line of lines) {
+		const failed = /^#(\d+) ERROR: /.exec(line);
+		if (failed) step = failed[1] ?? null;
+		const top = /^ERROR: (.*)$/.exec(line);
+		if (top) error = top[1] ?? null;
+	}
+	error = (error ?? "").replace(/^(failed to build: )?(failed to solve: )?/, "").trim() || null;
+	const output = step ? lines.flatMap((line) => {
+		const m = new RegExp(`^#${step} \\d+\\.\\d+ (.*)$`).exec(line);
+		return m?.[1]?.trim() ? [m[1]] : [];
+	}) : [];
+	const code = /exit code: (\d+)/.exec(error ?? "")?.[1];
+	return {
+		error,
+		output: output.slice(-8),
+		exitCode: code ? Number(code) : null
+	};
+}
+/** ENOSPC or a SIGKILL (137, usually the out-of-memory killer), from anything the build printed. */
+function failureCause(text, exitCode) {
+	if (/no space left on device|ENOSPC/i.test(text)) return "enospc";
+	if (exitCode === 137 || /exit(?:ed| code:?) 137\b|signal: killed|OOMKilled/i.test(text)) return "oom";
+	return null;
+}
+const causeLine = (cause) => cause === "enospc" ? "out of disk space (ENOSPC): free space for Docker (docker system df, reeval clean --images) and rerun" : "killed (exit 137): usually out of memory; give Docker more memory or lower the concurrency";
+const DETERMINISTIC = /did not complete successfully|dockerfile parse error|unknown instruction|should not be blank|pull access denied|repository does not exist|manifest unknown|not found: manifest|: not found\b|unauthorized|denied:|reeval needs a Debian or Ubuntu based image/i;
+const TRANSIENT = /EAI_AGAIN|ECONNRESET|ETIMEDOUT|ECONNREFUSED|i\/o timeout|TLS handshake timeout|no such host|temporary failure in name resolution|connection reset by peer|dial tcp|net\/http: request canceled|unexpected EOF|\b(?:500|502|503|504) |429 Too Many Requests|toomanyrequests|Service Unavailable|Bad Gateway|Gateway Timeout|ENOTFOUND/i;
+/** A registry or network error: a pull, a metadata lookup, or a download in the harness bootstrap. */
+const isTransient = (text) => !DETERMINISTIC.test(text) && TRANSIENT.test(text);
+/** Up to `retries` more tries on a transient failure, after `delays` ms each; any other throws at once. */
+async function retryTransient(run, options = {}) {
+	const delays = options.delays ?? RETRY_DELAYS;
+	for (let i = 0;; i++) try {
+		return await run();
+	} catch (error) {
+		if (!(error instanceof ImageBuildError ? error.failure.transient : isTransient(error.message)) || i >= delays.length || options.signal?.aborted) throw error;
+		options.onRetry?.(error);
+		await new Promise((resolve) => setTimeout(resolve, delays[i]));
+	}
+}
+/** Two more tries, after 2 s and then 8 s. */
+const RETRY_DELAYS = [2e3, 8e3];
+/**
+* A failure's text: the headline (what failed and why), the named cause, the step's own last
+* lines, then the log. Never the generated Dockerfile.
+*/
+function failureMessage(parts) {
+	const lines = [parts.headline];
+	if (parts.cause) lines.push(causeLine(parts.cause));
+	if (parts.output.length) lines.push(...parts.output.map((l) => `  | ${l}`));
+	if (parts.log) lines.push(`(full log: ${parts.log})`);
+	return lines.join("\n");
+}
+/** The last lines of a bootstrap command's output, past the error's own first line. */
+function outputTail(text, max = 8) {
+	return stripAnsi(text).split(/\r?\n/).map((l) => l.trimEnd()).filter((l) => l.trim()).slice(-max);
+}
+//#endregion
+//#region ../sandbox-docker/src/process.ts
+const CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+const cmdEscape = (arg, twice) => {
+	const quoted = `"${arg.replace(/(\\*)"/g, "$1$1\\\"").replace(/(\\*)$/, "$1$1")}"`.replace(CMD_META, "^$1");
+	return twice ? quoted.replace(CMD_META, "^$1") : quoted;
+};
+/**
+* How to spawn `cmd` on Windows, where npm, npx and pnpm are `.cmd` scripts that only cmd.exe
+* runs: the program PATH and PATHEXT find, and for a script, cmd.exe with every argument escaped.
+*/
+function windowsSpawn(cmd, args, env = process.env, exists = existsSync) {
+	const exts = (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+	const file = (/[\\/]/.test(cmd) ? [""] : (env.PATH ?? env.Path ?? "").split(";").filter(Boolean)).flatMap((dir) => {
+		const base = dir ? win32.join(dir, cmd) : cmd;
+		return [...win32.extname(cmd) ? [base] : [], ...exts.map((ext) => base + ext.toLowerCase())];
+	}).find(exists) ?? cmd;
+	if (!/\.(cmd|bat)$/i.test(file)) return {
+		file,
+		args,
+		verbatim: false
+	};
+	const twice = /node_modules[\\/]\.bin[\\/][^\\/]+\.cmd$/i.test(file);
+	const line = [win32.normalize(file).replace(CMD_META, "^$1"), ...args.map((a) => cmdEscape(a, twice))].join(" ");
+	return {
+		file: env.ComSpec ?? "cmd.exe",
+		args: [
+			"/d",
+			"/s",
+			"/c",
+			`"${line}"`
+		],
+		verbatim: true
+	};
+}
+/**
+* Kills a process and everything it started: its process group on POSIX (a detached child leads
+* one), its process tree with `taskkill` on Windows, which has neither groups nor signals.
+*/
+function killTree(pid) {
+	if (process.platform === "win32") {
+		spawn("taskkill", [
+			"/pid",
+			String(pid),
+			"/t",
+			"/f"
+		], {
+			stdio: "ignore",
+			windowsHide: true
+		}).on("error", () => {});
+		return;
+	}
+	try {
+		process.kill(-pid, "SIGKILL");
+	} catch {
+		try {
+			process.kill(pid, "SIGKILL");
+		} catch {}
+	}
+}
+/** `s` as one single-quoted POSIX shell word. */
+const shellQuote = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
+function run(cmd, args, options = {}) {
+	const { signal } = options;
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) return reject(signal.reason);
+		const detached = options.detached ?? true;
+		const target = process.platform === "win32" ? windowsSpawn(cmd, args, options.env ? {
+			...process.env,
+			...options.env
+		} : process.env) : {
+			file: cmd,
+			args,
+			verbatim: false
+		};
+		const child = spawn(target.file, target.args, {
+			cwd: options.cwd,
+			stdio: "pipe",
+			detached: detached && !target.verbatim,
+			windowsHide: true,
+			windowsVerbatimArguments: target.verbatim,
+			env: options.env ? {
+				...process.env,
+				...options.env
+			} : process.env
+		});
+		const out = [];
+		let stderr = "";
+		child.stdout.on("data", (d) => out.push(d));
+		child.stderr.on("data", (d) => {
+			stderr += d;
+		});
+		const onAbort = () => {
+			if ((detached || process.platform === "win32") && child.pid) killTree(child.pid);
+			else child.kill("SIGKILL");
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+		child.on("error", reject);
+		child.on("close", (code) => {
+			signal?.removeEventListener("abort", onAbort);
+			if (signal?.aborted) return reject(signal.reason);
+			const stdout = Buffer.concat(out);
+			resolve({
+				exitCode: code ?? 1,
+				stdout: options.binary ? stdout : stdout.toString(),
+				stderr
+			});
+		});
+		if (child.pid) options.onSpawn?.(child.pid);
+		child.stdin.on("error", () => {});
+		child.stdin.end(options.input ?? "");
+	});
+}
+//#endregion
+//#region ../sandbox-docker/src/trace.ts
+/** Most of each stream a trace keeps; the rest is counted. */
+const MAX_STREAM = 4096;
+/** Most of each argument a trace keeps, e.g. the gateway's forwarder script. */
+const MAX_ARG = 300;
+let listener;
+/** Calls `fn` for every docker command this process runs, or stops with `undefined`. */
+function onDockerCommand(fn) {
+	listener = fn;
+}
+const clip = (text, max) => text.length > max ? `${text.slice(0, max)}… (${text.length - max} more)` : text;
+/** Text as is (clipped), or a byte count for binary output such as a file read with `cat`. */
+function streamPreview(data) {
+	if (typeof data === "string") return clip(data, MAX_STREAM);
+	if (data.includes(0) || !isUtf8(data)) return `<${data.length} bytes>`;
+	return clip(data.toString("utf8"), MAX_STREAM);
+}
+function traceDocker(args, startedAt, result) {
+	if (!listener) return;
+	const base = {
+		args: args.map((a) => clip(a, MAX_ARG)),
+		ms: Date.now() - startedAt
+	};
+	try {
+		if ("error" in result) {
+			const error = result.error instanceof Error ? result.error.message : String(result.error);
+			listener({
+				...base,
+				exitCode: null,
+				stdout: "",
+				stderr: "",
+				error
+			});
+			return;
+		}
+		listener({
+			...base,
+			exitCode: result.exitCode,
+			stdout: result.stdout === void 0 ? "" : streamPreview(result.stdout),
+			stderr: clip(result.stderr ?? "", MAX_STREAM),
+			...result.stdin ? { stdin: result.stdin } : {}
+		});
+	} catch {}
+}
+//#endregion
+//#region ../sandbox-docker/src/docker-cli.ts
+/** Runs the docker CLI. `env` values are passed via the CLI's environment, never argv. */
+async function docker(args, options = {}) {
+	const startedAt = Date.now();
+	const stdin = options.input?.length ?? 0;
+	try {
+		const r = await run("docker", args, {
+			...options,
+			binary: true
+		});
+		traceDocker(args, startedAt, {
+			...r,
+			stdin
+		});
+		return r;
+	} catch (error) {
+		traceDocker(args, startedAt, { error });
+		throw error;
+	}
+}
+async function dockerOk(args, opts) {
+	const r = await docker(args, opts);
+	if (r.exitCode !== 0) throw new Error(`docker ${args[0]} failed: ${r.stderr.trim()}`);
+	return r.stdout.toString("utf8").trim();
+}
+/** Removes a container in its own process group, so removal survives this process being killed. */
+function removeContainerDetached(id) {
+	return new Promise((resolve) => {
+		const keepAlive = setInterval(() => {}, 1e3);
+		const startedAt = Date.now();
+		const args = [
+			"rm",
+			"-f",
+			id
+		];
+		const done = (exitCode) => {
+			clearInterval(keepAlive);
+			traceDocker(args, startedAt, { exitCode });
+			resolve();
+		};
+		const child = spawn("docker", args, {
+			detached: true,
+			stdio: "ignore",
+			windowsHide: true
+		});
+		child.on("error", () => done(null));
+		child.on("close", done);
+	});
+}
+/**
+* Removes every container with `label` (`key=value`) for the next few seconds, in its own process
+* group so it outlives this process. For a `docker run` killed mid-way: the daemon may create the
+* container after the CLI dies, and its id never came back.
+*/
+function sweepLabelDetached(label, seconds = 15) {
+	const child = spawn(process.execPath, [
+		"-e",
+		`const { execFileSync } = require('node:child_process')
+const [filter, seconds] = process.argv.slice(1)
+const o = { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true }
+for (let i = 0; i < Number(seconds); i++) {
+  try {
+    const ids = execFileSync('docker', ['ps', '-aq', '--filter', filter], o).split(/\\s+/).filter(Boolean)
+    if (ids.length) execFileSync('docker', ['rm', '-f', ...ids], o)
+  } catch {}
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 1000)
+}`,
+		`label=${label}`,
+		String(seconds)
+	], {
+		detached: true,
+		stdio: "ignore",
+		windowsHide: true,
+		env: {
+			...process.env,
+			BUN_BE_BUN: "1"
+		}
+	});
+	child.on("error", () => {});
+	child.unref();
+}
+async function dockerState() {
+	const r = await docker([
+		"info",
+		"--format",
+		"{{.ServerVersion}} {{.OSType}}"
+	]).catch(() => null);
+	const [version, os] = r?.exitCode === 0 ? r.stdout.toString("utf8").trim().split(/\s+/) : [];
+	if (!version) return "down";
+	return os === "windows" ? "windows-containers" : "running";
+}
+/** Whether Docker is running Linux containers, as every sandbox needs. */
+async function dockerAvailable() {
+	return await dockerState() === "running";
+}
+/** CPUs and memory of the machine containers run on (the VM, under Docker Desktop). */
+async function dockerCapacity() {
+	const r = await docker([
+		"info",
+		"--format",
+		"{{.NCPU}} {{.MemTotal}}"
+	]).catch(() => null);
+	if (r?.exitCode !== 0) return null;
+	const [cpus, memoryBytes] = r.stdout.toString("utf8").trim().split(/\s+/).map(Number);
+	return cpus && memoryBytes ? {
+		cpus,
+		memoryBytes
+	} : null;
+}
+/**
+* Whether a RepoDigest shows the image is in a registry someone can pull from. The containerd
+* image store (Docker 29+, recent Docker Desktop) also gives locally built images a digest, under
+* their bare local name (`reeval-sandbox@sha256:…`). A bare name is Docker Hub's `library/`
+* namespace, which only official images can push to, so only a digest whose name has a registry
+* host or a namespace counts. Official images such as `busybox` count as local; no image with
+* the harness baked in is one.
+*/
+const isRegistryDigest = (digest) => (digest.split("@")[0] ?? "").includes("/");
+async function imageInfo(image) {
+	const r = await docker([
+		"image",
+		"inspect",
+		"--format",
+		"{\"config\":{{json .Config}},\"id\":{{json .Id}},\"repoDigests\":{{json .RepoDigests}}}",
+		image
+	]).catch(() => null);
+	if (r?.exitCode !== 0) return null;
+	const info = JSON.parse(r.stdout.toString("utf8"));
+	const repoDigests = (info.repoDigests ?? []).filter(isRegistryDigest);
+	return {
+		labels: info.config?.Labels ?? {},
+		id: info.id,
+		repoDigests
+	};
+}
+//#endregion
+//#region ../sandbox-docker/src/image.ts
+/**
+* The harness adapters an image can bake. Each pin must match the exact dependency (or
+* `workspace:<version>` for this repo's own adapters); a test enforces it. `patch` is the first 8
+* hex of the sha256 of the adapter's pnpm patch (`patchedDependencies` in pnpm-workspace.yaml),
+* whose bridge the image bakes; a test holds it to the patch file.
+*/
+const HARNESS_PACKAGES = {
+	cursor: {
+		name: "@reeval/harness-cursor-sdk",
+		version: "0.1.0"
+	},
+	"claude-code": {
+		name: "@ai-sdk/harness-claude-code",
+		version: "1.0.128",
+		patch: "5d1c985c"
+	},
+	antigravity: {
+		name: "@reeval/harness-antigravity",
+		version: "0.1.0"
+	},
+	opencode: {
+		name: "@reeval/harness-opencode",
+		version: "0.2.0"
+	},
+	goose: {
+		name: "@reeval/harness-goose",
+		version: "0.1.0"
+	},
+	pi: {
+		name: "@reeval/harness-pi",
+		version: "0.1.0"
+	},
+	codex: {
+		name: "@reeval/harness-codex",
+		version: "0.1.0"
+	}
+};
+/** Every harness with an image, in {@link HARNESS_PACKAGES} order. */
+const BAKED_HARNESSES = Object.keys(HARNESS_PACKAGES);
+const isBakedHarness = (kind) => Object.hasOwn(HARNESS_PACKAGES, kind);
+/** The adapter build reeval runs for a harness: its version, and its patch if reeval patches it. */
+const adapterVersion = (harness) => {
+	const { version, patch } = HARNESS_PACKAGES[harness];
+	return patch ? `${version}-patch.${patch}` : version;
+};
+const BASE_IMAGE = "reeval-sandbox-base:latest";
+/** reeval's image for a harness; the tag pins the adapter, whose bootstrap pins the CLI. */
+const imageFor = (harness) => `reeval-sandbox:${harness}-${adapterVersion(harness)}`;
+/** Cursor's image, which the fake harness also runs in by default. */
+const DEFAULT_IMAGE = imageFor("cursor");
+/** The `ai.reeval.harness` label value an image baked for `harness` carries. */
+const harnessLabel = (harness) => `${HARNESS_PACKAGES[harness].name}@${adapterVersion(harness)}`;
+const LABEL = {
+	managed: "ai.reeval.managed",
+	run: "ai.reeval.run",
+	/** Unique per session, so a create cut short can find what it made. */
+	session: "ai.reeval.session",
+	agentVersion: "ai.reeval.agent-version",
+	harness: "ai.reeval.harness",
+	/** On reeval's own images: the hash of the base image's build context, to tell a stale one. */
+	context: "ai.reeval.context",
+	/** On a `from` image: the digest (or, for a local-only base, the image id) it was built on. */
+	fromDigest: "ai.reeval.from-digest"
+};
+/**
+* The user the agent, setup steps and checks run as, which every image reeval builds creates. Image
+* builds (`install`, Dockerfiles) stay root.
+*/
+const SANDBOX_USER = "reeval";
+/** {@link SANDBOX_USER}'s home. */
+const SANDBOX_HOME = `/home/${SANDBOX_USER}`;
+/** The container's default working directory, as seen by the harness. */
+const SANDBOX_ROOT = "/reeval";
+/** The agent's working directory, relative to {@link SANDBOX_ROOT}. */
+const WORKSPACE_DIR = "workspace";
+const BRIDGE_PORT = 43210;
+//#endregion
+//#region ../sandbox-docker/src/egress/cert.ts
+const der = (tag, ...content) => {
+	const body = Buffer.concat(content);
+	const n = body.length;
+	const length = n < 128 ? Buffer.from([n]) : n < 256 ? Buffer.from([129, n]) : n < 65536 ? Buffer.from([
+		130,
+		n >> 8,
+		n & 255
+	]) : Buffer.from([
+		131,
+		n >> 16,
+		n >> 8 & 255,
+		n & 255
+	]);
+	return Buffer.concat([
+		Buffer.from([tag]),
+		length,
+		body
+	]);
+};
+const seq = (...items) => der(48, ...items);
+const set = (...items) => der(49, ...items);
+const octets = (bytes) => der(4, bytes);
+const utf8 = (text) => der(12, Buffer.from(text, "utf8"));
+const bool = (value) => der(1, Buffer.from([value ? 255 : 0]));
+const explicit = (n, inner) => der(160 + n, inner);
+const integer = (bytes) => {
+	let i = 0;
+	while (i < bytes.length - 1 && bytes[i] === 0 && bytes[i + 1] < 128) i++;
+	const trimmed = bytes.subarray(i);
+	return der(2, trimmed[0] >= 128 ? Buffer.concat([Buffer.from([0]), trimmed]) : trimmed);
+};
+const bits = (bytes, unused = 0) => der(3, Buffer.from([unused]), bytes);
+const oid = (dotted) => {
+	const [a = 0, b = 0, ...rest] = dotted.split(".").map(Number);
+	const out = [40 * a + b];
+	for (const arc of rest) {
+		const chunk = [arc & 127];
+		for (let v = arc >> 7; v > 0; v >>= 7) chunk.unshift(v & 127 | 128);
+		out.push(...chunk);
+	}
+	return der(6, Buffer.from(out));
+};
+const time = (date) => {
+	const iso = date.toISOString().replace(/[-:T]/g, "").slice(0, 14);
+	return date.getUTCFullYear() < 2050 ? der(23, Buffer.from(`${iso.slice(2)}Z`)) : der(24, Buffer.from(`${iso}Z`));
+};
+const ECDSA_SHA256 = seq(oid("1.2.840.10045.4.3.2"));
+const name = (commonName) => seq(set(seq(oid("2.5.4.10"), utf8("reeval"))), set(seq(oid("2.5.4.3"), utf8(commonName))));
+const extension = (id, critical, value) => seq(oid(id), ...critical ? [bool(true)] : [], octets(value));
+/** Key usage bits, most significant first, with DER's minimal "unused bits" count. */
+const keyUsage = (usage) => {
+	let unused = 0;
+	while (unused < 7 && !(usage & 1 << unused)) unused++;
+	return bits(Buffer.from([usage]), unused);
+};
+const keyId = (spki) => createHash("sha1").update(spki).digest();
+const pem = (bytes) => `-----BEGIN CERTIFICATE-----\n${bytes.toString("base64").replace(/.{64}/g, "$&\n").replace(/\n?$/, "\n")}-----END CERTIFICATE-----\n`;
+function issue(options) {
+	const spki = options.publicKey.export({
+		type: "spki",
+		format: "der"
+	});
+	const serial = randomBytes(16);
+	serial[0] = serial[0] & 127;
+	const notBefore = /* @__PURE__ */ new Date(Date.now() - 36e5);
+	const notAfter = new Date(notBefore.getTime() + options.days * 864e5);
+	const tbs = seq(explicit(0, integer(Buffer.from([2]))), integer(serial), ECDSA_SHA256, name(options.issuer), seq(time(notBefore), time(notAfter)), name(options.subject), spki, explicit(3, seq(extension("2.5.29.14", false, octets(keyId(spki))), extension("2.5.29.35", false, seq(der(128, options.authorityKeyId))), ...options.extensions)));
+	return pem(seq(tbs, ECDSA_SHA256, bits(sign("sha256", tbs, options.signer))));
+}
+const newKeyPair = () => generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+/** A CA for one gateway. Its private key only ever exists in this process's memory. */
+function createCertificateAuthority(days = 7) {
+	const { publicKey, privateKey } = newKeyPair();
+	const spki = publicKey.export({
+		type: "spki",
+		format: "der"
+	});
+	const subject = `reeval egress CA ${randomBytes(4).toString("hex")}`;
+	return {
+		cert: issue({
+			subject,
+			issuer: subject,
+			publicKey,
+			signer: privateKey,
+			authorityKeyId: keyId(spki),
+			days,
+			extensions: [extension("2.5.29.19", true, seq(bool(true), integer(Buffer.from([0])))), extension("2.5.29.15", true, keyUsage(134))]
+		}),
+		key: privateKey,
+		spki,
+		subject
+	};
+}
+/** A TLS server certificate for `host` (a DNS name or an IP address), signed by `ca`. */
+function issueServerCertificate(ca, host) {
+	const { publicKey, privateKey } = newKeyPair();
+	const version = isIP(host);
+	const altName = version ? der(135, Buffer.from(version === 4 ? host.split(".").map(Number) : ipv6Bytes(host))) : der(130, Buffer.from(host, "ascii"));
+	return {
+		cert: issue({
+			subject: host,
+			issuer: ca.subject,
+			publicKey,
+			signer: ca.key,
+			authorityKeyId: keyId(ca.spki),
+			days: 7,
+			extensions: [
+				extension("2.5.29.19", true, seq()),
+				extension("2.5.29.15", true, keyUsage(128)),
+				extension("2.5.29.37", false, seq(oid("1.3.6.1.5.5.7.3.1"))),
+				extension("2.5.29.17", false, seq(altName))
+			]
+		}),
+		key: privateKey
+	};
+}
+function ipv6Bytes(address) {
+	const [head = "", tail = ""] = address.split("::");
+	const parts = (s) => s ? s.split(":") : [];
+	const h = parts(head);
+	const t = parts(tail);
+	return [
+		...h,
+		...Array(8 - h.length - t.length).fill("0"),
+		...t
+	].flatMap((g) => {
+		const v = Number.parseInt(g, 16);
+		return [v >> 8, v & 255];
+	});
+}
+//#endregion
+//#region ../sandbox-docker/src/egress/mux.ts
+/**
+* Many TCP streams over one byte pipe (a `docker exec` stdio), with per-stream credit so a slow
+* reader only stalls its own stream. Frames are `type u8, id u32, length u32, payload`.
+*
+* Must stay self-contained, with no imports or references to module scope: the forwarder runs
+* this function's source inside the container.
+*/
+function createMux(options) {
+	const OPEN = 1;
+	const DATA = 2;
+	const FIN = 3;
+	const RST = 4;
+	const WINDOW = 5;
+	const READY = 6;
+	const windowSize = options.window ?? 262144;
+	const maxPayload = 65536;
+	const streams = /* @__PURE__ */ new Map();
+	let nextId = options.parity === 0 ? 2 : 1;
+	let pending = Buffer.alloc(0);
+	const frame = (type, id, payload = Buffer.alloc(0)) => {
+		const header = Buffer.alloc(9);
+		header.writeUInt8(type, 0);
+		header.writeUInt32BE(id, 1);
+		header.writeUInt32BE(payload.length, 5);
+		options.send(Buffer.concat([header, payload]));
+	};
+	const u32 = (n) => {
+		const b = Buffer.alloc(4);
+		b.writeUInt32BE(n, 0);
+		return b;
+	};
+	const create = (id) => {
+		const grant = () => {
+			if (state.unacked > 0 && !state.reset) frame(WINDOW, id, u32(state.unacked));
+			state.unacked = 0;
+		};
+		const stream = new options.Duplex({
+			allowHalfOpen: true,
+			read() {
+				grant();
+			},
+			write(chunk, _encoding, callback) {
+				for (let i = 0; i < chunk.length; i += maxPayload) frame(DATA, id, chunk.subarray(i, i + maxPayload));
+				state.credit -= chunk.length;
+				if (state.credit > 0) callback();
+				else state.blocked = callback;
+			},
+			final(callback) {
+				state.localEnded = true;
+				frame(FIN, id);
+				callback();
+			},
+			destroy(error, callback) {
+				streams.delete(id);
+				if (!state.reset && !(state.localEnded && state.remoteEnded)) frame(RST, id);
+				state.blocked = null;
+				callback(error);
+			}
+		});
+		const state = {
+			stream,
+			credit: windowSize,
+			unacked: 0,
+			blocked: null,
+			localEnded: false,
+			remoteEnded: false,
+			reset: false
+		};
+		streams.set(id, state);
+		return stream;
+	};
+	const handle = (type, id, payload) => {
+		if (type === READY) return options.onReady?.();
+		if (type === OPEN) return options.onOpen(create(id), payload.readUInt16BE(0));
+		const state = streams.get(id);
+		if (!state) return;
+		if (type === DATA) {
+			state.unacked += payload.length;
+			if (state.stream.push(payload) && state.unacked >= windowSize / 2) {
+				frame(WINDOW, id, u32(state.unacked));
+				state.unacked = 0;
+			}
+		} else if (type === WINDOW) {
+			state.credit += payload.readUInt32BE(0);
+			const blocked = state.blocked;
+			if (state.credit > 0 && blocked) {
+				state.blocked = null;
+				blocked();
+			}
+		} else if (type === FIN) {
+			state.remoteEnded = true;
+			state.stream.push(null);
+		} else if (type === RST) {
+			state.reset = true;
+			state.stream.destroy();
+		}
+	};
+	return {
+		receive(chunk) {
+			pending = pending.length ? Buffer.concat([pending, chunk]) : chunk;
+			while (pending.length >= 9) {
+				const length = pending.readUInt32BE(5);
+				if (pending.length < 9 + length) break;
+				const type = pending.readUInt8(0);
+				const id = pending.readUInt32BE(1);
+				const payload = pending.subarray(9, 9 + length);
+				pending = pending.subarray(9 + length);
+				handle(type, id, payload);
+			}
+		},
+		open(port) {
+			const id = nextId;
+			nextId += 2;
+			const stream = create(id);
+			const p = Buffer.alloc(2);
+			p.writeUInt16BE(port, 0);
+			frame(OPEN, id, p);
+			return stream;
+		},
+		ready() {
+			frame(READY, 0);
+		},
+		destroy() {
+			for (const state of [...streams.values()]) state.stream.destroy();
+		}
+	};
+}
+/**
+* Pipes two duplexes into each other. An error, or one side closing before its end, tears both
+* down; a clean end half-closes the other side through `pipe`.
+*/
+function link(a, b) {
+	a.pipe(b);
+	b.pipe(a);
+	const kill = () => {
+		a.destroy();
+		b.destroy();
+	};
+	for (const s of [a, b]) {
+		s.on("error", kill);
+		s.on("close", () => {
+			if (!s.readableEnded) kill();
+		});
+	}
+}
+/**
+* The container side: listens on 127.0.0.1:`proxyPort` and sends each connection to the host,
+* and connects the host's streams to 127.0.0.1:<port> (the harness bridge). Self-contained for
+* the same reason as {@link createMux}.
+*/
+function forwarderMain(io, makeMux, linkStreams, proxyPort) {
+	const mux = makeMux({
+		Duplex: io.Duplex,
+		parity: 1,
+		send: (f) => io.output.write(f),
+		onOpen(stream, port) {
+			linkStreams(io.net.connect({
+				port,
+				host: "127.0.0.1",
+				allowHalfOpen: true
+			}), stream);
+		}
+	});
+	io.input.on("data", (chunk) => mux.receive(chunk));
+	io.input.on("end", () => io.exit(0));
+	const server = io.net.createServer({ allowHalfOpen: true }, (socket) => linkStreams(socket, mux.open(proxyPort)));
+	server.on("error", (error) => {
+		io.error(`reeval egress forwarder: ${error.message}`);
+		io.exit(1);
+	});
+	server.listen(proxyPort, "127.0.0.1", () => mux.ready());
+}
+/** The `node -e` script that runs {@link forwarderMain} in the container. */
+const forwarderScript = (proxyPort) => `(${forwarderMain.toString()})({ net: require('node:net'), Duplex: require('node:stream').Duplex, input: process.stdin, output: process.stdout, error: (m) => process.stderr.write(m + '\\n'), exit: (c) => process.exit(c) }, ${createMux.toString()}, ${link.toString()}, ${proxyPort})`;
+//#endregion
+//#region ../sandbox-docker/src/egress/policy.ts
+/** The Docker sandbox enforces every policy through its egress gateway, and records what passes. */
+const DOCKER_EGRESS = {
+	enforce: "allowlist",
+	record: true
+};
+/** The hosts each harness's CLI talks to at runtime. */
+const HARNESS_HOSTS = {
+	cursor: ["api2.cursor.sh", "*.cursor.sh"],
+	"claude-code": ["api.anthropic.com", "*.anthropic.com"],
+	antigravity: ["generativelanguage.googleapis.com"],
+	opencode: ["generativelanguage.googleapis.com", "mcp.exa.ai"],
+	goose: ["generativelanguage.googleapis.com"],
+	pi: ["generativelanguage.googleapis.com"],
+	codex: ["api.openai.com"]
+};
+/** The package registries and GitHub, for a restricted policy that still installs. */
+const PACKAGE_HOSTS = Object.freeze([
+	"registry.npmjs.org",
+	"registry.yarnpkg.com",
+	"github.com",
+	"*.github.com",
+	"*.githubusercontent.com",
+	"pypi.org",
+	"files.pythonhosted.org"
+]);
+/**
+* The harness's own hosts plus `PACKAGE_HOSTS`. Only that harness's hosts: a Cursor attempt
+* can't reach Anthropic.
+*/
+const defaultAllowedHosts = (harness) => [...HARNESS_HOSTS[harness], ...PACKAGE_HOSTS];
+/**
+* Never reachable through the gateway, whatever the policy: the worker's own loopback (the
+* container's `localhost` is its own) and link-local addresses such as cloud metadata. A
+* connection to an unspecified address (`0.0.0.0`, `::`) reaches the local host too.
+*/
+const ALWAYS_DENIED = [
+	"127.0.0.0/8",
+	"169.254.0.0/16",
+	"0.0.0.0/8",
+	"::/128",
+	"::1/128",
+	"fe80::/10"
+];
+const isRestricted = (policy) => policy.mode !== "allow-all";
+const blockList = (cidrs = []) => {
+	const list = new BlockList();
+	for (const cidr of cidrs) {
+		const [net = "", prefix] = cidr.split("/");
+		const type = isIP(net) === 6 ? "ipv6" : "ipv4";
+		list.addSubnet(net, Number(prefix ?? (type === "ipv6" ? 128 : 32)), type);
+	}
+	return list;
+};
+const inList = (list, address) => {
+	const v = isIP(address);
+	return v !== 0 && list.check(address, v === 6 ? "ipv6" : "ipv4");
+};
+const normalise = (host) => host.toLowerCase().replace(/\.$/, "").replace(/^\[|\]$/g, "");
+/**
+* Private, carrier-grade NAT and unique-local ranges: a name matched only by a `*.` pattern
+* mustn't resolve into them, or anyone who can add a DNS record under the pattern's domain
+* reaches the worker's LAN.
+*/
+const PRIVATE = blockList([
+	"10.0.0.0/8",
+	"100.64.0.0/10",
+	"172.16.0.0/12",
+	"192.168.0.0/16",
+	"fc00::/7"
+]);
+/** How `host` matches: listed as it is, only by a `*.` pattern (never an IP address), or not. */
+function hostMatch(patterns, host) {
+	const h = normalise(host);
+	const ps = patterns.map(normalise);
+	if (ps.includes(h)) return "exact";
+	if (isIP(h) || /(?:^|\.)\d+$/.test(h)) return void 0;
+	return ps.some((p) => p.startsWith("*.") && h.endsWith(p.slice(1))) ? "wildcard" : void 0;
+}
+/** `*.example.com` matches any subdomain of example.com, not example.com itself or an IP. */
+const hostAllowed = (patterns, host) => hostMatch(patterns, host) !== void 0;
+const defaultLookup = async (host) => (await lookup(host, {
+	all: true,
+	verbatim: true
+})).map((a) => a.address);
+/**
+* Decides whether `host` may be reached and which address to connect to. The gateway connects
+* to the address it checked, so a DNS answer can't change between the check and the connect.
+*/
+function createPolicyCheck(policy, options = {}) {
+	const lookup = options.lookup ?? defaultLookup;
+	const always = blockList(options.allowLoopback ? [] : ALWAYS_DENIED);
+	const custom = policy.mode === "custom" ? policy : void 0;
+	const allowedCidrs = blockList(custom?.allowedCIDRs);
+	const deniedCidrs = blockList(custom?.deniedCIDRs);
+	return async (rawHost) => {
+		const host = normalise(rawHost);
+		if (policy.mode === "deny-all") return {
+			allowed: false,
+			status: 403,
+			reason: "the policy denies all egress"
+		};
+		const listed = hostMatch(custom?.allowedHosts ?? [], host);
+		if (custom && !listed && !custom.allowedCIDRs?.length) return {
+			allowed: false,
+			status: 403,
+			reason: `${host} isn't in the allowlist`
+		};
+		let addresses;
+		try {
+			addresses = isIP(host) ? [host] : await lookup(host);
+		} catch (error) {
+			return {
+				allowed: false,
+				status: 502,
+				reason: `can't resolve ${host}: ${error.message}`
+			};
+		}
+		const first = addresses[0];
+		if (!first) return {
+			allowed: false,
+			status: 502,
+			reason: `${host} has no addresses`
+		};
+		if (addresses.some((a) => inList(always, a))) return {
+			allowed: false,
+			status: 403,
+			reason: `${host} is a loopback or link-local address`
+		};
+		if (!custom) return {
+			allowed: true,
+			address: first
+		};
+		if (addresses.some((a) => inList(deniedCidrs, a))) return {
+			allowed: false,
+			status: 403,
+			reason: `${host} is in a denied range`
+		};
+		if (listed === "wildcard" && addresses.some((a) => inList(PRIVATE, a))) return {
+			allowed: false,
+			status: 403,
+			reason: `${host} resolves to a private address, which a *. pattern doesn't allow; list the host itself`
+		};
+		if (listed) return {
+			allowed: true,
+			address: first
+		};
+		if (custom.allowedCIDRs?.length && addresses.every((a) => inList(allowedCidrs, a))) return {
+			allowed: true,
+			address: first
+		};
+		return {
+			allowed: false,
+			status: 403,
+			reason: `${host} isn't in the allowlist`
+		};
+	};
+}
+//#endregion
+//#region ../sandbox-docker/src/egress/rules.ts
+const normaliseHost = (host) => host.toLowerCase().replace(/\.$/, "");
+function matchPart(matcher, value, ignoreCase = false) {
+	const v = ignoreCase ? value.toLowerCase() : value;
+	if ("exact" in matcher) return v === (ignoreCase ? matcher.exact.toLowerCase() : matcher.exact);
+	if ("startsWith" in matcher) return v.startsWith(ignoreCase ? matcher.startsWith.toLowerCase() : matcher.startsWith);
+	return new RegExp(matcher.regex, ignoreCase ? "i" : "").test(value);
+}
+/** Every matcher must match at least one pair; keys compare case-insensitively for headers. */
+function matchPairs(matchers, pairs, ignoreKeyCase) {
+	return (matchers ?? []).every((m) => pairs.some(([k, v]) => (!m.key || matchPart(m.key, k, ignoreKeyCase)) && (!m.value || matchPart(m.value, v))));
+}
+const headerPairs = (headers) => Object.entries(headers).flatMap(([k, v]) => v === void 0 ? [] : (Array.isArray(v) ? v : [v]).map((x) => [k, x]));
+function matches(rule, request) {
+	const { match } = rule;
+	if (normaliseHost(match.host) !== normaliseHost(request.host)) return false;
+	const url = new URL(request.path, "https://placeholder.invalid");
+	if (match.path && !matchPart(match.path, url.pathname)) return false;
+	if (match.method && !match.method.some((m) => m.toUpperCase() === request.method.toUpperCase())) return false;
+	if (match.queryString && !matchPairs(match.queryString, [...url.searchParams], false)) return false;
+	return !match.headers || matchPairs(match.headers, headerPairs(request.headers), true);
+}
+/** Whether the request is one of the endpoints (host, path and method, where given). */
+const onEndpoint = (endpoints, request) => endpoints.some((match) => matches({
+	match,
+	transform: { headers: {} }
+}, request));
+/** Whether the gateway must decrypt connections to `host`: some rule could apply there. */
+const decrypts = (rules, host) => rules.some((r) => normaliseHost(r.match.host) === normaliseHost(host));
+/**
+* The request's headers after every matching rule, in order, so later rules win. Returns the
+* (lower-case) names that were replaced, for logging without values. With `endpoints`, no rule
+* applies off them, and a request carrying a rule's placeholder there is `refused`.
+*/
+function applyTransformations(rules, request, endpoints) {
+	const headers = { ...request.headers };
+	const replaced = /* @__PURE__ */ new Set();
+	const matching = rules.filter((rule) => matches(rule, request));
+	if (endpoints && matching.length && !onEndpoint(endpoints, request)) return {
+		headers,
+		replaced: [],
+		refused: matching.some((r) => r.match.headers?.length)
+	};
+	for (const rule of matching) for (const [name, value] of Object.entries(rule.transform.headers)) {
+		headers[name.toLowerCase()] = value;
+		replaced.add(name.toLowerCase());
+	}
+	return {
+		headers,
+		replaced: [...replaced],
+		refused: false
+	};
+}
+//#endregion
+//#region ../sandbox-docker/src/egress/substitution.ts
+const BASE62 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+/** A fresh `reeval_secret_<32 base62>`: URL-safe, so it survives any encoding a client applies. */
+function placeholder() {
+	let out = "reeval_secret_";
+	for (let i = 0; i < 32; i++) out += BASE62[randomInt(62)];
+	return out;
+}
+/** The substitutions whose hosts include `host`. */
+const substitutionsFor = (subs, host) => subs.filter((s) => hostAllowed(s.hosts, host));
+/** Whether the gateway must decrypt connections to `host` for some substitution. */
+const substitutes = (subs, host) => substitutionsFor(subs, host).length > 0;
+const replaceIn = (value, from, to) => value.includes(from) ? value.split(from).join(to) : value;
+/**
+* The request after its host's substitutions: placeholders replaced in header values, and in the
+* query string (URL-encoded) for those opted in. Returns the names substituted, for logging without values.
+*/
+function substituteRequest(subs, request) {
+	const own = substitutionsFor(subs, request.host);
+	const names = /* @__PURE__ */ new Set();
+	const headers = {};
+	for (const [key, value] of Object.entries(request.headers)) {
+		if (value === void 0) continue;
+		const one = (v) => {
+			let out = v;
+			for (const s of own) {
+				if (!s.in.includes("header") || !out.includes(s.placeholder)) continue;
+				out = replaceIn(out, s.placeholder, s.value);
+				names.add(s.name);
+			}
+			return out;
+		};
+		headers[key] = Array.isArray(value) ? value.map(one) : one(value);
+	}
+	let path = request.path;
+	const q = path.indexOf("?");
+	if (q !== -1) {
+		let query = path.slice(q);
+		for (const s of own) {
+			if (!s.in.includes("query") || !query.includes(s.placeholder)) continue;
+			query = replaceIn(query, s.placeholder, encodeURIComponent(s.value));
+			names.add(s.name);
+		}
+		path = path.slice(0, q) + query;
+	}
+	return {
+		headers,
+		path,
+		names: [...names]
+	};
+}
+/**
+* Where a request to the secrets' host still carries a placeholder the gateway leaves in place,
+* because the secret doesn't substitute there: the query without `in: ['query']`, or a header
+* with only `in: ['query']` or `['body']`. Such a request fails upstream; this names why.
+*/
+function unsubstituted(subs, request) {
+	const out = [];
+	const q = request.path.indexOf("?");
+	const query = q === -1 ? "" : request.path.slice(q);
+	const headers = Object.values(request.headers).flat().filter(Boolean).join("\n");
+	for (const s of substitutionsFor(subs, request.host)) {
+		if (!s.in.includes("query") && query.includes(s.placeholder)) out.push({
+			name: s.name,
+			where: "query",
+			in: s.in
+		});
+		if (!s.in.includes("header") && headers.includes(s.placeholder)) out.push({
+			name: s.name,
+			where: "header",
+			in: s.in
+		});
+	}
+	return out;
+}
+/** A response header value with every real value on the host put back as its placeholder. */
+const scrubValue = (subs, value) => subs.reduce((out, s) => replaceIn(out, s.value, s.placeholder), value);
+/** Response headers with every real value on the host put back as its placeholder. */
+function scrubHeaders(subs, headers) {
+	if (subs.length === 0) return headers;
+	const one = (v) => scrubValue(subs, v);
+	return Object.fromEntries(Object.entries(headers).map(([k, v]) => [k, v === void 0 ? v : Array.isArray(v) ? v.map(one) : one(String(v))]));
+}
+/**
+* Replaces byte strings in a stream, including across chunk boundaries: it holds back the
+* longest `from` less one byte, so a match split between chunks is still found.
+*/
+var ReplaceStream = class extends Transform {
+	#pairs;
+	#hold;
+	#tail = Buffer.alloc(0);
+	/** How many replacements were made. */
+	count = 0;
+	constructor(pairs) {
+		super();
+		this.#pairs = pairs.filter(([from]) => from.length > 0).map(([from, to]) => [Buffer.from(from), Buffer.from(to)]);
+		this.#hold = Math.max(0, ...this.#pairs.map(([from]) => from.length - 1));
+	}
+	/**
+	* Replaces every whole match in `data` (original bytes only: output is never re-scanned), and
+	* returns where the unscanned tail starts, which is `data.length` when `final`.
+	*/
+	#scan(data, final) {
+		const parts = [];
+		let pos = 0;
+		for (;;) {
+			let best = -1;
+			let pair;
+			for (const p of this.#pairs) {
+				const i = data.indexOf(p[0], pos);
+				if (i !== -1 && (best === -1 || i < best)) {
+					best = i;
+					pair = p;
+				}
+			}
+			if (best === -1 || !pair) break;
+			parts.push(data.subarray(pos, best), pair[1]);
+			pos = best + pair[0].length;
+			this.count++;
+		}
+		const rest = final ? data.length : Math.max(pos, data.length - this.#hold);
+		parts.push(data.subarray(pos, rest));
+		return {
+			out: Buffer.concat(parts),
+			rest
+		};
+	}
+	_transform(chunk, _enc, done) {
+		const data = Buffer.concat([this.#tail, chunk]);
+		const { out, rest } = this.#scan(data, false);
+		this.#tail = Buffer.from(data.subarray(rest));
+		if (out.length) this.push(out);
+		done();
+	}
+	_flush(done) {
+		const { out } = this.#scan(this.#tail, true);
+		if (out.length) this.push(out);
+		done();
+	}
+};
+/** The substitutions whose values are scrubbed from response bodies (see `scrubBodies`). */
+const scrubbedInBodies = (subs) => subs.filter((s) => s.scrubBodies !== false);
+/** A stream putting each real value back as its placeholder: for responses from brokered hosts. */
+const scrubber = (subs) => new ReplaceStream(scrubbedInBodies(subs).map((s) => [s.value, s.placeholder]));
+/** A stream swapping placeholders for values, for request bodies of secrets that opt in. */
+const bodySubstituter = (subs) => new ReplaceStream(subs.filter((s) => s.in.includes("body")).map((s) => [s.placeholder, s.value]));
+//#endregion
+//#region ../sandbox-docker/src/egress/tokens.ts
+const JWT = /^[\w-]+\.[\w-]+\.[\w-]+$/;
+/**
+* A placeholder for a token. A JWT keeps its header and claims, so a client reading its `exp` sees
+* the real one, and gets `reeval_secret_…` for a signature; anything else is a plain `reeval_secret_…`.
+*/
+function tokenPlaceholder(token) {
+	if (!JWT.test(token)) return placeholder();
+	const [header, claims] = token.split(".");
+	return `${header}.${claims}.${placeholder()}`;
+}
+/**
+* The exchange response with each token field replaced by a placeholder, and a substitution per
+* token. A token already seen keeps its placeholder. Throws when the body isn't a JSON object.
+*/
+function tokeniseResponse(derived, body, known) {
+	const parsed = JSON.parse(body);
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("the response is not a JSON object");
+	const out = { ...parsed };
+	const added = [];
+	const fields = [];
+	for (const field of derived.fields) {
+		const value = out[field];
+		if (typeof value !== "string" || value === "") continue;
+		const existing = [...known, ...added].find((s) => s.value === value);
+		const sub = existing ?? {
+			name: `${derived.name} ${field}`,
+			placeholder: tokenPlaceholder(value),
+			value,
+			hosts: derived.hosts,
+			in: ["header"],
+			scrubBodies: false
+		};
+		if (!existing) added.push(sub);
+		out[field] = sub.placeholder;
+		fields.push(field);
+	}
+	return {
+		body: JSON.stringify(out),
+		added,
+		fields
+	};
+}
+//#endregion
+//#region ../sandbox-docker/src/egress/proxy.ts
+const HOP_BY_HOP = /* @__PURE__ */ new Set([
+	"connection",
+	"keep-alive",
+	"proxy-connection",
+	"proxy-authorization",
+	"proxy-authenticate",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"http2-settings",
+	"host"
+]);
+const endToEnd = (headers, keep = []) => Object.fromEntries(Object.entries(headers).filter(([k, v]) => v !== void 0 && !k.startsWith(":") && (!HOP_BY_HOP.has(k) || keep.includes(k))));
+/** `host:port` from a CONNECT target or an authority, IPv6 in brackets. */
+function parseAuthority(authority, defaultPort) {
+	const m = /^\[([^\]]+)\](?::(\d+))?$/.exec(authority) ?? /^([^:]+)(?::(\d+))?$/.exec(authority);
+	return {
+		host: (m?.[1] ?? authority).toLowerCase(),
+		port: Number(m?.[2] ?? defaultPort)
+	};
+}
+const pathOnly = (path) => path.split("?")[0];
+function reply(socket, status, reason) {
+	const text = http.STATUS_CODES[status] ?? "";
+	socket.end(`HTTP/1.1 ${status} ${text}\r\ncontent-type: text/plain\r\nconnection: close\r\n\r\n${reason}\n`);
+}
+/** Counts the bytes passing through, without changing the flow. */
+const counter = (count) => new Transform({ transform(chunk, _encoding, done) {
+	count(chunk.length);
+	done(null, chunk);
+} });
+const plainHeaders = (headers) => Object.fromEntries(Object.entries(headers).flatMap(([k, v]) => v === void 0 ? [] : [[k, Array.isArray(v) ? v.map(String) : String(v)]]));
+function createEgressProxy(options) {
+	const log = options.log ?? (() => {});
+	const emit = (event) => {
+		try {
+			options.onEvent?.(event);
+		} catch {}
+	};
+	let rules = [];
+	let subs = [];
+	/** Substitutions for derived tokens, added as their exchanges answer; kept by setSubstitutions. */
+	let tokens = [];
+	const allSubs = () => tokens.length ? [...subs, ...tokens] : subs;
+	const derived = options.derivedTokens ?? [];
+	const tokenHosts = derived.flatMap((d) => [d.endpoint.host, ...d.hosts]);
+	let policyCheck = createPolicyCheck(options.policy, options);
+	const check = async (host) => {
+		const verdict = await policyCheck(host);
+		emit(verdict.allowed ? {
+			type: "dns",
+			host,
+			allowed: true,
+			address: verdict.address
+		} : {
+			type: "dns",
+			host,
+			allowed: false,
+			reason: verdict.reason
+		});
+		return verdict;
+	};
+	/** Bytes each sandbox connection carried, both ways, for its tunnel's event. */
+	const carried = /* @__PURE__ */ new WeakMap();
+	const leaves = /* @__PURE__ */ new Map();
+	const open = /* @__PURE__ */ new Set();
+	const sessions = /* @__PURE__ */ new Map();
+	const agent = new https.Agent({ keepAlive: true });
+	const ca = options.upstreamCA ? [...tls.rootCertificates, options.upstreamCA] : void 0;
+	const track = (s) => {
+		open.add(s);
+		s.once("close", () => open.delete(s));
+		return s;
+	};
+	const contacted = /* @__PURE__ */ new Map();
+	const blocked = /* @__PURE__ */ new Map();
+	/** The host each sandbox connection's bytes count towards: its latest allowed request's. */
+	const counting = /* @__PURE__ */ new WeakMap();
+	/** Bytes a connection sent before the policy decided whose they are: the request itself. */
+	const unclaimed = /* @__PURE__ */ new WeakMap();
+	const contact = (connection, host, port) => {
+		const key = `${host}:${port}`;
+		let entry = contacted.get(key);
+		if (!entry) {
+			entry = {
+				host,
+				port,
+				connections: 0,
+				sent: 0,
+				received: 0
+			};
+			contacted.set(key, entry);
+		}
+		entry.connections++;
+		entry.sent += unclaimed.get(connection) ?? 0;
+		unclaimed.delete(connection);
+		counting.set(connection, entry);
+	};
+	const block = (connection, host, port, reason) => {
+		const key = `${host}:${port}`;
+		const entry = blocked.get(key) ?? {
+			host,
+			port,
+			connections: 0,
+			reason
+		};
+		entry.connections++;
+		blocked.set(key, entry);
+		counting.delete(connection);
+		unclaimed.delete(connection);
+	};
+	/** Counts what the connection carries each way, without reading it or changing its flow. */
+	const countBytes = (connection) => {
+		const total = {
+			sent: 0,
+			received: 0
+		};
+		carried.set(connection, total);
+		const push = connection.push.bind(connection);
+		connection.push = (chunk, encoding) => {
+			const entry = counting.get(connection);
+			const n = chunk ? Buffer.byteLength(chunk) : 0;
+			total.sent += n;
+			if (entry) entry.sent += n;
+			else unclaimed.set(connection, (unclaimed.get(connection) ?? 0) + n);
+			return push(chunk, encoding);
+		};
+		const write = connection.write.bind(connection);
+		connection.write = ((chunk, ...rest) => {
+			const entry = counting.get(connection);
+			const n = chunk ? Buffer.byteLength(chunk) : 0;
+			total.received += n;
+			if (entry) entry.received += n;
+			return write(chunk, ...rest);
+		});
+	};
+	const byHost = (entries) => [...entries].map((e) => ({ ...e })).sort((a, b) => a.host.localeCompare(b.host) || a.port - b.port);
+	/** Collects one request's event as it goes, and emits it when the response closes. */
+	const requestEvent = (res, base) => {
+		const startedAt = Date.now();
+		const event = {
+			type: "request",
+			...base,
+			allowed: true,
+			sent: 0,
+			received: 0,
+			substituted: [],
+			credentials: [],
+			ms: 0
+		};
+		let emitted = false;
+		res.once("close", () => {
+			if (emitted) return;
+			emitted = true;
+			emit({
+				...event,
+				status: event.status ?? res.statusCode,
+				ms: Date.now() - startedAt
+			});
+		});
+		return {
+			refuse(reason) {
+				event.allowed = false;
+				event.reason = reason;
+			},
+			set(fields) {
+				Object.assign(event, fields);
+			},
+			sent: (n) => {
+				event.sent += n;
+			},
+			received: (n) => {
+				event.received += n;
+			}
+		};
+	};
+	const credentialsFor = (host) => {
+		let creds = leaves.get(host);
+		if (!creds) {
+			const leaf = issueServerCertificate(options.ca, host);
+			creds = {
+				key: leaf.key.export({
+					type: "pkcs8",
+					format: "pem"
+				}),
+				cert: leaf.cert + options.ca.cert
+			};
+			leaves.set(host, creds);
+		}
+		return creds;
+	};
+	const front = http.createServer();
+	front.on("connect", (req, socket, head) => {
+		const { host, port } = parseAuthority(req.url ?? "", 443);
+		const startedAt = Date.now();
+		const tunnel = {
+			type: "request",
+			method: "CONNECT",
+			url: `${host}:${port}`,
+			host,
+			port,
+			via: "tunnel",
+			substituted: [],
+			credentials: [],
+			requestHeaders: plainHeaders(req.headers)
+		};
+		check(host).then((verdict) => {
+			if (!verdict.allowed) {
+				log(`reeval:egress CONNECT ${host}:${port} denied (${verdict.reason})`);
+				block(socket, host, port, verdict.reason);
+				emit({
+					...tunnel,
+					allowed: false,
+					status: verdict.status,
+					reason: verdict.reason,
+					sent: 0,
+					received: 0,
+					ms: Date.now() - startedAt
+				});
+				return reply(socket, verdict.status, `blocked by the reeval egress policy: ${verdict.reason}`);
+			}
+			contact(socket, host, port);
+			const target = {
+				host,
+				port,
+				address: verdict.address
+			};
+			if (decrypts(rules, host) || substitutes(allSubs(), host) || hostAllowed(tokenHosts, host)) {
+				log(`reeval:egress CONNECT ${host}:${port} decrypt`);
+				socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+				if (head.length) socket.unshift(head);
+				return decrypt(socket, target);
+			}
+			log(`reeval:egress CONNECT ${host}:${port} tunnel`);
+			let status = 200;
+			let reason;
+			const before = { ...carried.get(socket) ?? {
+				sent: 0,
+				received: 0
+			} };
+			socket.once("close", () => {
+				const after = carried.get(socket) ?? before;
+				emit({
+					...tunnel,
+					allowed: true,
+					status,
+					...reason ? { reason } : {},
+					sent: after.sent - before.sent,
+					received: after.received - before.received,
+					ms: Date.now() - startedAt
+				});
+			});
+			const upstream = track(net.connect({
+				host: target.address,
+				port,
+				allowHalfOpen: true
+			}));
+			upstream.once("connect", () => {
+				socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+				if (head.length) upstream.write(head);
+				link(socket, upstream);
+			});
+			upstream.once("error", (error) => {
+				log(`reeval:egress CONNECT ${host}:${port} failed (${error.message})`);
+				status = 502;
+				reason = `couldn't reach ${host}:${port}: ${error.message}`;
+				reply(socket, 502, `reeval egress gateway couldn't reach ${host}:${port}: ${error.message}`);
+			});
+		});
+	});
+	front.on("request", (req, res) => {
+		let url;
+		try {
+			url = new URL(req.url ?? "");
+		} catch {
+			return res.writeHead(400).end("reeval egress gateway: expected an absolute URL\n");
+		}
+		if (url.protocol !== "http:") return res.writeHead(400).end("reeval egress gateway: http only\n");
+		const { host, port } = parseAuthority(url.host, 80);
+		const done = requestEvent(res, {
+			method: req.method ?? "GET",
+			url: `http://${host}:${port}${url.pathname}`,
+			host,
+			port,
+			via: "http",
+			requestHeaders: plainHeaders(req.headers)
+		});
+		check(host).then((verdict) => {
+			if (!verdict.allowed) {
+				log(`reeval:egress ${req.method} http://${host}:${port} denied (${verdict.reason})`);
+				block(req.socket, host, port, verdict.reason);
+				done.refuse(verdict.reason);
+				return res.writeHead(verdict.status).end(`blocked by the reeval egress policy: ${verdict.reason}\n`);
+			}
+			log(`reeval:egress ${req.method} http://${host}:${port}${url.pathname}`);
+			contact(req.socket, host, port);
+			const upstream = http.request({
+				host: verdict.address,
+				port,
+				method: req.method,
+				path: url.pathname + url.search,
+				headers: {
+					...endToEnd(req.headers),
+					host: url.host
+				}
+			});
+			forwardHttp1(req.pipe(counter(done.sent)), res, upstream, [], void 0, done);
+		});
+	});
+	front.on("upgrade", (_req, socket) => {
+		reply(socket, 501, "reeval egress gateway: use CONNECT for websockets");
+	});
+	/**
+	* Terminates TLS with a certificate for the CONNECT host. One server per connection, since the
+	* host comes from CONNECT; it serves HTTP/2 and HTTP/1.1 (with upgrades) by ALPN.
+	*/
+	function decrypt(socket, target) {
+		const server = http2.createSecureServer({
+			...credentialsFor(target.host),
+			allowHTTP1: true
+		}, (req, res) => void onDecrypted(target, req, res));
+		server.on("upgrade", (req, s, head) => onUpgrade(target, req, track(s), head));
+		server.on("tlsClientError", () => socket.destroy());
+		server.on("sessionError", () => socket.destroy());
+		server.emit("connection", socket);
+	}
+	/**
+	* The headers and path to send upstream, the substitutions that apply there, or why the request
+	* is refused (already logged): a Host that isn't the CONNECT target, or an unbrokered endpoint.
+	*/
+	function transformed(target, method, path, headers, version) {
+		const named = String(headers[":authority"] ?? headers.host ?? "");
+		const asked = parseAuthority(named, target.port).host;
+		if (named && asked !== target.host) {
+			const reason = `reeval egress gateway: the request names ${asked}, but the connection is to ${target.host}; send it on a connection to ${asked}.`;
+			log(`reeval:egress ${method} https://${target.host}${pathOnly(path)} refused (Host ${asked})`);
+			return {
+				headers: {},
+				path,
+				own: [],
+				names: [],
+				credentials: [],
+				refused: {
+					status: 421,
+					reason
+				}
+			};
+		}
+		const { headers: out, replaced, refused } = applyTransformations(rules, {
+			host: target.host,
+			method,
+			path,
+			headers: endToEnd(headers, ["upgrade", "connection"])
+		}, options.endpoints);
+		const url = `https://${target.host}${pathOnly(path)}`;
+		if (refused) {
+			log(`reeval:egress ${method} ${url} HTTP/${version} refused (not a brokered endpoint)`);
+			options.onRefused?.({
+				method,
+				url
+			});
+			return {
+				headers: {},
+				path,
+				own: [],
+				names: [],
+				credentials: [],
+				refused: {
+					status: 403,
+					reason: `reeval egress gateway: refused ${method} ${url}. It carries a brokered credential, and it isn't one of the endpoints reeval brokers it for.`
+				}
+			};
+		}
+		const own = substitutionsFor(allSubs(), target.host);
+		const request = {
+			host: target.host,
+			path,
+			headers: out
+		};
+		const substituted = substituteRequest(own, request);
+		const kept = unsubstituted(own, request);
+		for (const k of kept) options.onUnsubstituted?.({
+			...k,
+			method,
+			url
+		});
+		const exchange = derived.find((d) => onEndpoint([d.endpoint], {
+			host: target.host,
+			method,
+			path,
+			headers: {}
+		}));
+		const readsModel = onEndpoint(options.modelResponses ?? [], {
+			host: target.host,
+			method,
+			path,
+			headers: {}
+		});
+		if (scrubbedInBodies(own).length || exchange || readsModel) delete substituted.headers["accept-encoding"];
+		const notes = [
+			replaced.length ? `set ${replaced.join(", ")}` : "",
+			substituted.names.length ? `substituted ${substituted.names.join(", ")}` : "",
+			...kept.map((k) => `kept ${k.name}'s placeholder in the ${k.where}`)
+		].filter(Boolean);
+		log(`reeval:egress ${method} ${url} HTTP/${version}${notes.length ? ` (${notes.join("; ")})` : ""}`);
+		return {
+			headers: substituted.headers,
+			path: substituted.path,
+			own,
+			names: substituted.names,
+			credentials: replaced,
+			...exchange ? { exchange } : {},
+			...readsModel ? { readsModel } : {}
+		};
+	}
+	/**
+	* The request body as sent upstream: through the substituter when a secret there opts in to
+	* bodies, unless the body is encoded (gzip and the like), which is sent as is and fails closed.
+	*/
+	function requestBody(req, headers, own, t) {
+		const counted = t ? req.pipe(counter(t.sent)) : req;
+		if (String(headers["content-encoding"] ?? "identity") !== "identity" || !own.some((s) => s.in.includes("body"))) return counted;
+		delete headers["content-length"];
+		return counted.pipe(bodySubstituter(own));
+	}
+	/** The response body as sent to the sandbox: real values put back as placeholders. */
+	const scrubs = options.scrubResponses !== false;
+	function responseBody(up, own, t, readsModel = false) {
+		if (readsModel && t) readModel(up, t);
+		const body = scrubbedInBodies(own).length && scrubs ? up.pipe(scrubber(own)) : up;
+		return t ? body.pipe(counter(t.received)) : body;
+	}
+	const responseHeaders = (headers, own) => {
+		const out = endToEnd(headers);
+		if (!own.length || !scrubs) return out;
+		if (scrubbedInBodies(own).length) delete out["content-length"];
+		return scrubHeaders(own, out);
+	};
+	/**
+	* How far into a response the gateway looks for the model that served it: OpenAI's first event
+	* echoes the request's instructions and tools before it.
+	*/
+	const MODEL_WINDOW = 524288;
+	/**
+	* Records the first `"model"` value in the response body, and the `"effort"` of the
+	* `"reasoning"` object after it, reading alongside its flow. Inside a JSON string the quotes are
+	* escaped, so text that merely mentions them doesn't match.
+	*/
+	function readModel(up, t) {
+		let seen = "";
+		const onData = (chunk) => {
+			seen += chunk.toString("utf8");
+			const model = /"model"\s*:\s*"([^"\\]{1,200})"/.exec(seen);
+			const effort = model ? /"reasoning"\s*:\s*\{[^{}]*?"effort"\s*:\s*"(\w{1,40})"/.exec(seen.slice(model.index)) : null;
+			if (model) t.set({ responseModel: model[1] });
+			if (effort) t.set({ responseEffort: effort[1] });
+			if (effort || seen.length > MODEL_WINDOW) up.off("data", onData);
+		};
+		up.on("data", onData);
+	}
+	/** Most an exchange's response may be; it's a few hundred bytes of JSON. */
+	const EXCHANGE_LIMIT = 1 << 20;
+	/**
+	* A token exchange's response, read whole, with each token replaced by a placeholder. A success
+	* that can't be read (compressed, too big, not JSON) is a 502: the real tokens never go through.
+	*/
+	function tokenised(exchange, url, status, headers, up, res, own, t) {
+		const chunks = [];
+		let size = 0;
+		const refuse = (why) => {
+			log(`reeval:egress ${url} response refused (${why})`);
+			if (!res.headersSent) res.writeHead(502, { "content-type": "text/plain" }).end(`reeval egress gateway: couldn't keep ${exchange.name}'s tokens out of the sandbox: ${why}
+`);
+			else res.destroy();
+		};
+		const scrubbed = responseBody(up, own, t);
+		scrubbed.on("data", (chunk) => {
+			size += chunk.length;
+			if (size <= EXCHANGE_LIMIT) chunks.push(chunk);
+		});
+		up.once("error", (error) => refuse(error.message));
+		scrubbed.once("end", () => {
+			const body = Buffer.concat(chunks);
+			const out = responseHeaders(headers, own);
+			t?.set({ responseHeaders: plainHeaders(out) });
+			if (status < 200 || status >= 300) return res.writeHead(status, out).end(body);
+			const encoding = String(headers["content-encoding"] ?? "identity");
+			if (encoding !== "identity") return refuse(`the response is ${encoding}-encoded`);
+			if (size > EXCHANGE_LIMIT) return refuse(`the response is over ${EXCHANGE_LIMIT} bytes`);
+			let result;
+			try {
+				result = tokeniseResponse(exchange, body.toString("utf8"), tokens);
+			} catch (error) {
+				return refuse(error.message);
+			}
+			tokens = [...tokens, ...result.added];
+			log(`reeval:egress ${url} tokenised ${result.fields.join(", ") || "nothing"} (${exchange.name})`);
+			const text = Buffer.from(result.body);
+			delete out["content-encoding"];
+			res.writeHead(status, {
+				...out,
+				"content-length": String(text.length)
+			}).end(text);
+		});
+	}
+	async function onDecrypted(target, req, res) {
+		const method = req.method ?? "GET";
+		const url = `https://${target.host}${pathOnly(req.url ?? "/")}`;
+		const t = requestEvent(res, {
+			method,
+			url,
+			host: target.host,
+			port: target.port,
+			via: "decrypted",
+			requestHeaders: plainHeaders(req.headers)
+		});
+		const { headers, path, own, names, credentials, refused, exchange, readsModel } = transformed(target, method, req.url ?? "/", req.headers, req.httpVersion);
+		t.set({
+			substituted: names,
+			credentials
+		});
+		if (refused) {
+			t.refuse(refused.reason);
+			req.resume();
+			return res.writeHead(refused.status, { "content-type": "text/plain" }).end(`${refused.reason}\n`);
+		}
+		delete headers.upgrade;
+		delete headers.connection;
+		const body = requestBody(req, headers, own, t);
+		const authority = target.port === 443 ? target.host : `${target.host}:${target.port}`;
+		const session = req.httpVersionMajor === 2 ? await upstreamSession(target) : null;
+		if (!session) return forwardHttp1(body, res, https.request({
+			host: target.address,
+			servername: net.isIP(target.host) ? void 0 : target.host,
+			port: target.port,
+			method,
+			path,
+			headers: {
+				...headers,
+				host: authority
+			},
+			agent,
+			ca
+		}), own, exchange && {
+			exchange,
+			url
+		}, t, readsModel);
+		const stream = session.request({
+			...headers,
+			":method": method,
+			":path": path,
+			":scheme": "https",
+			":authority": authority
+		});
+		const fail = (error) => {
+			if (!res.headersSent) res.writeHead(502).end(`reeval egress gateway: ${error.message}\n`);
+			else res.destroy();
+		};
+		stream.once("error", fail);
+		stream.once("response", (h) => {
+			if (exchange) return tokenised(exchange, url, Number(h[":status"]), h, stream, res, own, t);
+			const out = responseHeaders(h, own);
+			t.set({ responseHeaders: plainHeaders(out) });
+			res.writeHead(Number(h[":status"]), out);
+			stream.once("trailers", (trailers) => res.addTrailers(responseHeaders(trailers, own)));
+			responseBody(stream, own, t, readsModel).pipe(res);
+		});
+		body.pipe(stream);
+		req.once("aborted", () => stream.close(http2.constants.NGHTTP2_CANCEL));
+	}
+	function forwardHttp1(req, res, upstream, own = [], tokenise, t, readsModel = false) {
+		upstream.once("response", (up) => {
+			if (tokenise) {
+				const { exchange, url } = tokenise;
+				return tokenised(exchange, url, up.statusCode ?? 502, up.headers, up, res, own, t);
+			}
+			const out = responseHeaders(up.headers, own);
+			t?.set({ responseHeaders: plainHeaders(out) });
+			res.writeHead(up.statusCode ?? 502, out);
+			up.once("end", () => {
+				if (Object.keys(up.trailers).length) res.addTrailers(responseHeaders(up.trailers, own));
+			});
+			responseBody(up, own, t, readsModel).pipe(res);
+		});
+		upstream.once("error", (error) => {
+			t?.set({
+				status: 502,
+				reason: error.message
+			});
+			if (!res.headersSent) res.writeHead(502).end(`reeval egress gateway: ${error.message}\n`);
+			else res.destroy();
+		});
+		req.pipe(upstream);
+	}
+	function onUpgrade(target, req, socket, head) {
+		const method = req.method ?? "GET";
+		const startedAt = Date.now();
+		const { headers, path, own, names, credentials, refused } = transformed(target, method, req.url ?? "/", req.headers, req.httpVersion);
+		const scrubbed = (value) => scrubs ? scrubValue(own, value) : value;
+		const upgraded = (fields) => emit({
+			type: "request",
+			method,
+			url: `https://${target.host}${pathOnly(req.url ?? "/")}`,
+			host: target.host,
+			port: target.port,
+			via: "decrypted",
+			allowed: true,
+			sent: 0,
+			received: 0,
+			substituted: names,
+			credentials,
+			requestHeaders: plainHeaders(req.headers),
+			...fields,
+			ms: Date.now() - startedAt
+		});
+		if (refused) {
+			upgraded({
+				allowed: false,
+				status: refused.status,
+				reason: refused.reason
+			});
+			return reply(socket, refused.status, refused.reason);
+		}
+		const upstream = https.request({
+			host: target.address,
+			servername: net.isIP(target.host) ? void 0 : target.host,
+			port: target.port,
+			method,
+			path,
+			headers: {
+				...headers,
+				host: target.host
+			},
+			ca
+		});
+		upstream.once("upgrade", (up, upSocket, upHead) => {
+			const out = scrubs ? scrubHeaders(own, up.headers) : up.headers;
+			upgraded({
+				status: up.statusCode,
+				responseHeaders: plainHeaders(out)
+			});
+			const lines = [`HTTP/1.1 ${up.statusCode} ${up.statusMessage}`];
+			for (let i = 0; i < up.rawHeaders.length; i += 2) lines.push(`${up.rawHeaders[i]}: ${scrubbed(up.rawHeaders[i + 1] ?? "")}`);
+			socket.write(`${lines.join("\r\n")}\r\n\r\n`);
+			if (upHead.length) socket.write(upHead);
+			if (head.length) upSocket.write(head);
+			link(socket, track(upSocket));
+		});
+		upstream.once("response", (up) => {
+			reply(socket, up.statusCode ?? 502, `upstream refused the upgrade (${up.statusCode})`);
+			up.resume();
+		});
+		upstream.once("error", (error) => reply(socket, 502, `reeval egress gateway: ${error.message}`));
+		upstream.end();
+	}
+	/** One HTTP/2 session per upstream, or null when it doesn't speak h2. */
+	function upstreamSession(target) {
+		const key = `${target.host}:${target.port}`;
+		const existing = sessions.get(key);
+		if (existing && !existing.closed && !existing.destroyed) return Promise.resolve(existing);
+		return new Promise((resolve) => {
+			const socket = tls.connect({
+				host: target.address,
+				port: target.port,
+				servername: net.isIP(target.host) ? void 0 : target.host,
+				ALPNProtocols: ["h2", "http/1.1"],
+				...ca ? { ca } : {}
+			});
+			socket.once("error", () => resolve(null));
+			socket.once("secureConnect", () => {
+				if (socket.alpnProtocol !== "h2") {
+					socket.destroy();
+					return resolve(null);
+				}
+				const session = http2.connect(`https://${key}`, { createConnection: () => socket });
+				session.on("error", () => {});
+				session.once("close", () => sessions.get(key) === session && sessions.delete(key));
+				session.once("goaway", () => sessions.get(key) === session && sessions.delete(key));
+				sessions.set(key, session);
+				resolve(session);
+			});
+		});
+	}
+	return {
+		handle(connection) {
+			track(connection);
+			countBytes(connection);
+			connection.on("error", () => connection.destroy());
+			front.emit("connection", connection);
+		},
+		traffic: () => ({
+			contacted: byHost(contacted.values()),
+			blocked: byHost(blocked.values())
+		}),
+		addTransformations(more) {
+			rules = [...rules, ...more];
+		},
+		setTransformations(all) {
+			rules = [...all];
+		},
+		setPolicy(policy) {
+			policyCheck = createPolicyCheck(policy, options);
+		},
+		setSubstitutions(all) {
+			subs = [...all];
+		},
+		close() {
+			for (const s of open) s.destroy();
+			for (const s of sessions.values()) s.destroy();
+			sessions.clear();
+			agent.destroy();
+		}
+	};
+}
+//#endregion
+//#region ../sandbox-docker/src/egress/gateway.ts
+/** Where the forwarder listens inside the container; every exec gets it as its HTTP(S) proxy. */
+const PROXY_PORT = 43128;
+/** The gateway's CA certificate in the container. The private key never leaves the host. */
+const CA_PATH = "/usr/local/share/ca-certificates/reeval-egress.crt";
+/** Debian's system bundle, which `update-ca-certificates` rebuilds with the gateway's CA in it. */
+const CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+const BUNDLED = "es:ca-bundle";
+const READY_TIMEOUT_MS = 15e3;
+/**
+* The gateway's side of the container runs as root, whoever the sandbox runs as: the sandbox user
+* can't signal, trace or replace the forwarder, or change the CA it installed.
+*/
+const AS_ROOT = ["--user", "0:0"];
+const installCa = (containerId, cert, signal) => docker([
+	"exec",
+	"--interactive",
+	...AS_ROOT,
+	containerId,
+	"sh",
+	"-c",
+	`umask 022 && mkdir -p "$(dirname ${CA_PATH})" && cat > ${CA_PATH} && { command -v update-ca-certificates >/dev/null && update-ca-certificates >/dev/null 2>&1 && grep -q "$(sed -n 2p ${CA_PATH})" ${CA_BUNDLE} && echo ${BUNDLED}; true; }`
+], {
+	input: cert,
+	signal
+});
+/**
+* Starts the egress gateway for one container: a forwarder inside it, tunnelled over one
+* `docker exec -i`, and the proxy in this process, which holds the real credentials.
+*/
+async function startGateway(containerId, options, signal) {
+	const ca = createCertificateAuthority();
+	const installed = await installCa(containerId, ca.cert, signal);
+	if (installed.exitCode !== 0) throw new Error(`couldn't install the gateway CA: ${installed.stderr.trim()}`);
+	const bundled = installed.stdout.toString("utf8").includes(BUNDLED);
+	const proxy = createEgressProxy({
+		...options,
+		ca
+	});
+	const args = [
+		"exec",
+		"--interactive",
+		...AS_ROOT,
+		containerId,
+		"node",
+		"-e",
+		forwarderScript(PROXY_PORT)
+	];
+	const startedAt = Date.now();
+	const child = spawn("docker", args, {
+		stdio: "pipe",
+		detached: true
+	});
+	child.once("close", (code) => traceDocker(args, startedAt, {
+		exitCode: code,
+		stderr
+	}));
+	let stderr = "";
+	child.stderr.on("data", (d) => {
+		stderr += d;
+	});
+	child.stdin.on("error", () => {});
+	let closed = false;
+	const mux = createMux({
+		Duplex,
+		parity: 0,
+		send: (frame) => {
+			if (!closed) child.stdin.write(frame);
+		},
+		onOpen(stream, port) {
+			if (port === 43128) proxy.handle(stream);
+			else stream.destroy();
+		},
+		onReady: () => ready.resolve()
+	});
+	const ready = {};
+	ready.promise = new Promise((resolve, reject) => Object.assign(ready, {
+		resolve,
+		reject
+	}));
+	child.stdout.on("data", (chunk) => mux.receive(chunk));
+	child.once("error", (error) => ready.reject(error));
+	const listeners = /* @__PURE__ */ new Map();
+	const tunnels = /* @__PURE__ */ new Set();
+	let stopped;
+	child.once("close", (code) => {
+		const asked = closed;
+		closed = true;
+		mux.destroy();
+		const reason = `the forwarder exited (${code}): ${stderr.trim().slice(-500)}`.replace(/: $/, "");
+		ready.reject(new Error(reason));
+		if (asked) return;
+		stopped = reason;
+		for (const socket of tunnels) socket.destroy();
+		for (const l of listeners.values()) l.then((s) => s.close());
+	});
+	const timer = setTimeout(() => ready.reject(/* @__PURE__ */ new Error(`the forwarder didn't start within ${READY_TIMEOUT_MS / 1e3}s`)), READY_TIMEOUT_MS);
+	const onAbort = () => ready.reject(signal?.reason);
+	signal?.addEventListener("abort", onAbort, { once: true });
+	const close = () => {
+		closed = true;
+		child.kill("SIGKILL");
+		mux.destroy();
+		proxy.close();
+		for (const l of listeners.values()) l.then((s) => s.close());
+	};
+	try {
+		await ready.promise;
+	} catch (error) {
+		close();
+		throw error;
+	} finally {
+		clearTimeout(timer);
+		signal?.removeEventListener("abort", onAbort);
+	}
+	const proxyUrl = `http://127.0.0.1:${PROXY_PORT}`;
+	const noProxy = "localhost,127.0.0.1,::1";
+	return {
+		env: {
+			HTTPS_PROXY: proxyUrl,
+			HTTP_PROXY: proxyUrl,
+			https_proxy: proxyUrl,
+			http_proxy: proxyUrl,
+			NO_PROXY: noProxy,
+			no_proxy: noProxy,
+			NODE_EXTRA_CA_CERTS: CA_PATH,
+			NODE_USE_ENV_PROXY: "1",
+			...bundled ? {
+				SSL_CERT_FILE: CA_BUNDLE,
+				REQUESTS_CA_BUNDLE: CA_BUNDLE,
+				CURL_CA_BUNDLE: CA_BUNDLE,
+				GIT_SSL_CAINFO: CA_BUNDLE
+			} : {}
+		},
+		addTransformations: proxy.addTransformations,
+		setTransformations: proxy.setTransformations,
+		setPolicy: proxy.setPolicy,
+		setSubstitutions: proxy.setSubstitutions,
+		traffic: proxy.traffic,
+		get stopped() {
+			return stopped;
+		},
+		async portUrl(port, protocol) {
+			if (stopped) throw new Error(`the egress gateway stopped: ${stopped}`);
+			let listening = listeners.get(port);
+			if (!listening) {
+				listening = new Promise((resolve, reject) => {
+					const server = net.createServer({ allowHalfOpen: true }, (socket) => {
+						if (stopped) return socket.destroy();
+						tunnels.add(socket);
+						socket.once("close", () => tunnels.delete(socket));
+						link(socket, mux.open(port));
+					});
+					server.once("error", reject);
+					server.listen(0, "127.0.0.1", () => resolve(server));
+				});
+				listeners.set(port, listening);
+			}
+			return `${protocol}://127.0.0.1:${(await listening).address().port}`;
+		},
+		close
+	};
+}
+//#endregion
+//#region ../sandbox-docker/src/session.ts
+const DEFAULT_LIMITS = {
+	memory: "4g",
+	cpus: 2,
+	pids: 1024
+};
+/** What `root` adds back: what `apt-get` (and its `_apt` sandbox) and `dpkg` need as root. */
+const ROOT_CAPABILITIES = [
+	"CHOWN",
+	"DAC_OVERRIDE",
+	"FOWNER",
+	"SETUID",
+	"SETGID"
+];
+let hostCpus;
+/** Docker refuses `--cpus` above the host's count, so cap it there. */
+async function cpuLimit(cpus) {
+	hostCpus ??= dockerCapacity().then((c) => c?.cpus, () => void 0);
+	const available = await hostCpus;
+	return String(available ? Math.min(cpus, available) : cpus);
+}
+/** The `docker run` flags that confine the container: its user, capabilities and limits. */
+async function confinementArgs(options) {
+	const limits = {
+		...DEFAULT_LIMITS,
+		...options.limits
+	};
+	const caps = [...options.root ? ROOT_CAPABILITIES : [], ...options.capabilities ?? []];
+	return [
+		"--user",
+		options.root ? "0:0" : SANDBOX_USER,
+		"--cap-drop",
+		"ALL",
+		...[...new Set(caps)].flatMap((c) => ["--cap-add", c]),
+		"--security-opt",
+		"no-new-privileges",
+		"--memory",
+		String(limits.memory),
+		"--memory-swap",
+		String(limits.memory),
+		"--pids-limit",
+		String(limits.pids),
+		"--cpus",
+		await cpuLimit(limits.cpus)
+	];
+}
+/** Runtime `npm i -g` goes to the sandbox user's own prefix, whose `bin` the images put on PATH. */
+const userEnv = (options) => options.root ? {} : { NPM_CONFIG_PREFIX: `${SANDBOX_HOME}/.local` };
+/** Set on every exec, so a kill can find the command's whole process tree in the container. */
+const EXEC_MARKER = "REEVAL_EXEC_ID";
+/** The Docker networks a container is attached to. */
+async function networksOf(id) {
+	const out = await dockerOk([
+		"inspect",
+		"--format",
+		"{{json .NetworkSettings.Networks}}",
+		id
+	]);
+	return Object.keys(JSON.parse(out) ?? {});
+}
+/**
+* A harness sandbox session backed by one local Docker container. Commands and file I/O go
+* through `docker exec`. With the egress gateway, ports are reached through its tunnel whatever
+* the network policy; without it, the bridge port is published on 127.0.0.1.
+*/
+async function createDockerSession(options) {
+	const nonce = randomBytes(8).toString("hex");
+	const labels = {
+		[LABEL.managed]: "true",
+		[LABEL.session]: nonce,
+		...options.labels
+	};
+	const lifetime = Math.ceil((options.lifetimeMs ?? 864e5) / 1e3);
+	const signal = options.abortSignal;
+	const env = {
+		...userEnv(options),
+		...options.env
+	};
+	const id = await dockerOk([
+		"run",
+		"--detach",
+		"--rm",
+		"--init",
+		...await confinementArgs(options),
+		...Object.entries(labels).flatMap(([k, v]) => ["--label", `${k}=${v}`]),
+		...Object.keys(env).flatMap((k) => ["--env", k]),
+		"--publish",
+		`127.0.0.1::${BRIDGE_PORT}`,
+		"--workdir",
+		SANDBOX_ROOT,
+		"--entrypoint",
+		"sleep",
+		options.image,
+		String(lifetime)
+	], {
+		signal,
+		env
+	}).catch((error) => {
+		if (signal?.aborted) sweepLabelDetached(`${LABEL.session}=${nonce}`);
+		if (/unable to find user/i.test(error.message)) {
+			sweepLabelDetached(`${LABEL.session}=${nonce}`);
+			throw new Error(`${options.image} has no ${SANDBOX_USER} user to run the sandbox as. Images reeval builds have one: rebuild it (reeval image build), or start from reeval's image or docker({ from }). An eval that needs root at run time can opt in with docker({ root: true }).`);
+		}
+		throw error;
+	});
+	let gateway;
+	let removed;
+	const remove = () => {
+		gateway?.close();
+		removed ??= removeContainerDetached(id);
+		return removed;
+	};
+	if (signal?.aborted) {
+		await remove();
+		throw signal.reason;
+	}
+	const egressOptions = options.egress === true ? {} : options.egress || void 0;
+	let egress;
+	let detached = [];
+	const attach = async (policy) => {
+		if (isRestricted(policy) && detached.length === 0) {
+			detached = await networksOf(id);
+			for (const n of detached) await dockerOk([
+				"network",
+				"disconnect",
+				"--force",
+				n,
+				id
+			]);
+		} else if (!isRestricted(policy) && detached.length > 0) {
+			for (const n of detached) await dockerOk([
+				"network",
+				"connect",
+				n,
+				id
+			]);
+			detached = [];
+		}
+	};
+	if (egressOptions) {
+		const { policy = { mode: "allow-all" }, ...rest } = egressOptions;
+		try {
+			await attach(policy);
+			gateway = await startGateway(id, {
+				...rest,
+				policy
+			}, signal);
+			egress = { active: true };
+		} catch (error) {
+			if (signal?.aborted || isRestricted(policy)) {
+				await remove();
+				if (signal?.aborted) throw signal.reason;
+				throw new Error(`Can't enforce the egress policy: ${error.message}`);
+			}
+			egress = {
+				active: false,
+				reason: error.message
+			};
+		}
+	}
+	const envFor = (env) => gateway ? {
+		...gateway.env,
+		...env
+	} : env;
+	let execs = 0;
+	const execArgs = (command, marker, cwd, env) => [
+		"exec",
+		"--interactive",
+		"--workdir",
+		cwd ? posix.resolve(SANDBOX_ROOT, cwd) : SANDBOX_ROOT,
+		"--env",
+		`${EXEC_MARKER}=${marker}`,
+		...Object.keys(env ?? {}).flatMap((k) => ["--env", k]),
+		id,
+		"bash",
+		"-c",
+		command
+	];
+	const nextMarker = () => `${id.slice(0, 12)}-${++execs}`;
+	/**
+	* Killing the host's `docker exec` client doesn't stop the command in the container, so kill
+	* every process there that inherited this exec's marker: the command and all it started.
+	*/
+	const killExec = (marker) => docker([
+		"exec",
+		id,
+		"sh",
+		"-c",
+		`for e in /proc/[0-9]*/environ; do grep -qsxzF ${shellQuote(`${EXEC_MARKER}=${marker}`)} "$e" && kill -9 "$(basename "$(dirname "$e")")" 2>/dev/null; done; true`
+	]).then(() => {}, () => {});
+	const run = async (o) => {
+		const env = envFor(o.env);
+		const marker = nextMarker();
+		try {
+			const r = await docker(execArgs(o.command, marker, o.workingDirectory, env), {
+				env,
+				signal: o.abortSignal
+			});
+			return {
+				exitCode: r.exitCode,
+				stdout: r.stdout.toString("utf8"),
+				stderr: r.stderr
+			};
+		} catch (error) {
+			if (o.abortSignal?.aborted) await killExec(marker);
+			throw error;
+		}
+	};
+	const readBinaryFile = async (o) => {
+		const r = await docker([
+			"exec",
+			id,
+			"cat",
+			"--",
+			posix.resolve(SANDBOX_ROOT, o.path)
+		], { signal: o.abortSignal });
+		return r.exitCode === 0 ? new Uint8Array(r.stdout) : null;
+	};
+	const writeBinaryFile = async (o) => {
+		const path = posix.resolve(SANDBOX_ROOT, o.path);
+		await dockerOk([
+			"exec",
+			"--interactive",
+			id,
+			"sh",
+			"-c",
+			`mkdir -p ${shellQuote(posix.dirname(path))} && cat > ${shellQuote(path)}`
+		], {
+			input: Buffer.from(o.content),
+			signal: o.abortSignal
+		});
+	};
+	const brokering = gateway ? {
+		async setNetworkPolicy(policy) {
+			gateway?.setPolicy(policy);
+			await attach(policy);
+		},
+		async addRequestTransformations(rules) {
+			gateway?.addTransformations(rules);
+		},
+		async setRequestTransformations(rules) {
+			gateway?.setTransformations(rules);
+		}
+	} : {};
+	const substituting = gateway ? {
+		async setSubstitutions(subs) {
+			gateway?.setSubstitutions(subs);
+		},
+		traffic: () => gateway.traffic()
+	} : {};
+	const session = {
+		id,
+		description: `Docker container ${id.slice(0, 12)} (${options.image})`,
+		defaultWorkingDirectory: SANDBOX_ROOT,
+		ports: [BRIDGE_PORT],
+		get egress() {
+			if (egress?.active && gateway?.stopped) return {
+				active: false,
+				reason: gateway.stopped
+			};
+			return egress;
+		},
+		...brokering,
+		...substituting,
+		run,
+		async spawn(o) {
+			const env = envFor(o.env);
+			const marker = nextMarker();
+			const args = execArgs(o.command, marker, o.workingDirectory, env);
+			const startedAt = Date.now();
+			const child = spawn("docker", args, {
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				],
+				detached: true,
+				env: env ? {
+					...process.env,
+					...env
+				} : process.env
+			});
+			const exited = new Promise((resolve) => child.on("close", (code) => {
+				traceDocker(args, startedAt, {
+					exitCode: code,
+					stdout: "<streamed>"
+				});
+				resolve({ exitCode: code ?? 1 });
+			}));
+			const kill = async () => {
+				child.kill("SIGKILL");
+				await killExec(marker);
+			};
+			o.abortSignal?.addEventListener("abort", () => void kill(), { once: true });
+			return {
+				pid: child.pid,
+				stdout: Readable.toWeb(child.stdout),
+				stderr: Readable.toWeb(child.stderr),
+				wait: () => exited,
+				kill
+			};
+		},
+		readBinaryFile,
+		async readFile(o) {
+			const bytes = await readBinaryFile(o);
+			return bytes === null ? null : Readable.toWeb(Readable.from([bytes]));
+		},
+		async readTextFile(o) {
+			const bytes = await readBinaryFile(o);
+			if (bytes === null) return null;
+			const text = Buffer.from(bytes).toString("utf8");
+			if (o.startLine === void 0 && o.endLine === void 0) return text;
+			return text.split("\n").slice((o.startLine ?? 1) - 1, o.endLine).join("\n");
+		},
+		writeBinaryFile,
+		writeTextFile: (o) => writeBinaryFile({
+			...o,
+			content: Buffer.from(o.content, "utf8")
+		}),
+		async writeFile(o) {
+			const chunks = [];
+			for await (const chunk of o.content) chunks.push(chunk);
+			await writeBinaryFile({
+				...o,
+				content: Buffer.concat(chunks)
+			});
+		},
+		async getPortEndpoint({ port, protocol = "ws" }) {
+			const scheme = protocol === "ws" ? "ws" : "http";
+			if (gateway?.stopped) throw new Error(`Port ${port} of ${id.slice(0, 12)} isn't reachable: the egress gateway stopped: ${gateway.stopped}`);
+			if (gateway) return { url: await gateway.portUrl(port, scheme) };
+			const mapped = await docker([
+				"port",
+				id,
+				`${port}/tcp`
+			]);
+			const hostPort = mapped.stdout.toString("utf8").split("\n")[0]?.split(":").at(-1);
+			if (mapped.exitCode !== 0 || !hostPort) {
+				const reason = mapped.stderr.trim() || "Docker reports no host port for it";
+				throw new Error(`Port ${port} of ${id.slice(0, 12)} isn't reachable: ${reason}`);
+			}
+			return { url: `${scheme}://127.0.0.1:${hostPort}` };
+		},
+		async getPortUrl(o) {
+			return (await session.getPortEndpoint(o)).url;
+		},
+		stop: remove,
+		destroy: remove,
+		restricted: () => {
+			const { description, readFile, readBinaryFile, readTextFile, writeFile } = session;
+			const { writeBinaryFile, writeTextFile, spawn, run } = session;
+			return {
+				description,
+				readFile,
+				readBinaryFile,
+				readTextFile,
+				writeFile,
+				writeBinaryFile,
+				writeTextFile,
+				spawn,
+				run
+			};
+		}
+	};
+	return session;
+}
+/** The session as an AI SDK harness sandbox provider. */
+const dockerSandboxProvider = (options) => ({
+	specificationVersion: "harness-sandbox-v1",
+	providerId: "reeval-docker",
+	async createSession(o) {
+		const session = await createDockerSession({
+			...options,
+			abortSignal: o?.abortSignal
+		});
+		await o?.onFirstCreate?.(session, { abortSignal: o.abortSignal });
+		return session;
+	}
+});
+//#endregion
+//#region ../sandbox-docker/src/build-image.ts
+const PNPM_VERSION = "10.33.3";
+/** npm before 11.6 (node:22 ships 10.9) can crash on circular peer sets (npm/cli#8261); the same as docker/Dockerfile's. */
+const NPM_VERSION = "11.20.0";
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+const slugify = (text, max) => text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, max).replace(/-+$/, "");
+/** The build context of reeval's base image, shipped in the package. */
+const DOCKER_CONTEXT = fileURLToPath(ownFileURL("docker"));
+/**
+* The image `docker({ from })` evals run in: `from` plus Node, git and the harness's CLI. The hash
+* covers the toolchain layer too, so a change to the sandbox user or paths builds anew.
+*/
+const harnessImageFor = (harness, from) => `${imageFor(harness)}-${slugify(from, 40) || "image"}-${sha256(toolchainDockerfile(from)).slice(0, 8)}`;
+/**
+* How each harness's CLI gets into an image: its adapter's bootstrap, and the binary it leaves
+* (or, for an adapter without one, a command that prints what it installed).
+*/
+const BOOTSTRAPS = {
+	cursor: {
+		name: "Cursor",
+		cli: "@cursor/sdk",
+		version: `node -p "'@cursor/sdk ' + require(process.env.HOME + '/.ai-sdk-harness/.harness-bootstrap/cursor-sdk/node_modules/@cursor/sdk/package.json').version"`,
+		adapter: async () => (await import("./src-daS0wKH2.js")).createCursorSdk()
+	},
+	"claude-code": {
+		name: "Claude Code",
+		cli: "claude",
+		adapter: async () => (await import("./dist-BZXYHN2X.js")).createClaudeCode()
+	},
+	antigravity: {
+		name: "Antigravity",
+		cli: "agy",
+		adapter: async () => (await import("./src-W9g-y5X5.js")).createAntigravity()
+	},
+	opencode: {
+		name: "OpenCode",
+		cli: "opencode",
+		adapter: async () => (await import("./src-DEgff9Z7.js")).createOpenCode({
+			auth: { GOOGLE_GENERATIVE_AI_API_KEY: "unused" },
+			model: "google/unused"
+		})
+	},
+	goose: {
+		name: "Goose",
+		cli: "goose",
+		adapter: async () => (await import("./src-C-LHyTSV.js")).createGoose({
+			auth: { GOOGLE_API_KEY: "unused" },
+			model: "unused"
+		})
+	},
+	pi: {
+		name: "pi",
+		cli: "pi",
+		adapter: async () => (await import("./src-BDwSuyIo.js")).createPi({ auth: { GEMINI_API_KEY: "unused" } })
+	},
+	codex: {
+		name: "Codex",
+		cli: "codex",
+		adapter: async () => (await import("./src-55j1zNHH.js")).createCodex({ auth: { OPENAI_API_KEY: "unused" } })
+	}
+};
+/**
+* Adds what the harness bridge needs to a Debian or Ubuntu based toolchain image: Node (copied
+* from the official image, so the base's own toolchain is untouched), pnpm, git, curl and bash.
+*/
+const toolchainDockerfile = (from) => `FROM ${from}
+SHELL ["/bin/sh", "-c"]
+RUN command -v apt-get >/dev/null || { echo "reeval needs a Debian or Ubuntu based image (glibc and apt-get)" >&2; exit 1; } \\
+  && apt-get update \\
+  && apt-get install -y --no-install-recommends bash ca-certificates curl git procps \\
+  && rm -rf /var/lib/apt/lists/*
+COPY --from=node:22-bookworm-slim /usr/local/bin/node /usr/local/bin/node
+COPY --from=node:22-bookworm-slim /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -sf ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \\
+  && ln -sf ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \\
+  && npm install --global npm@${NPM_VERSION} \\
+  && npm install --global pnpm@${PNPM_VERSION} \\
+  && { id -u ${SANDBOX_USER} >/dev/null 2>&1 \\
+    || useradd --create-home --shell /bin/bash --uid 10001 --user-group ${SANDBOX_USER} 2>/dev/null \\
+    || useradd --create-home --shell /bin/bash --user-group ${SANDBOX_USER}; } \\
+  && mkdir -p ${SANDBOX_ROOT}/${WORKSPACE_DIR} && chown -R ${SANDBOX_USER}: ${SANDBOX_ROOT}
+ENV PATH=${SANDBOX_HOME}/.local/bin:$PATH
+WORKDIR ${SANDBOX_ROOT}/${WORKSPACE_DIR}
+`;
+const tail = (text) => text.trim().split("\n").slice(-15).join("\n");
+const clipLine = (text, max = 300) => text.length > max ? `${text.slice(0, max - 1)}…` : text;
+/** Why a `docker build` failed, in a line: the failing step's exit, or BuildKit's own error. */
+function buildReason(error) {
+	if (!error) return "docker build failed";
+	const exit = /^process ".*" did not complete successfully: exit code: (\d+)$/s.exec(error);
+	return exit ? `a RUN step exited ${exit[1]}` : clipLine(error.replace(/\s+/g, " "));
+}
+/**
+* A failed `docker build --progress plain` as an {@link ImageBuildError}: `headline` then the
+* reason, the named cause, and the failing step's own last lines.
+*/
+function buildError(output, what, reason, keep = () => true) {
+	const parsed = parseBuildOutput(output);
+	const text = [parsed.error ?? "", ...parsed.output].join("\n");
+	const cause = failureCause(text, parsed.exitCode);
+	parsed.output = parsed.output.filter(keep);
+	const why = reason?.(parsed) ?? buildReason(parsed.error);
+	return new ImageBuildError(failureMessage({
+		headline: `${what.headline} failed: ${why}`,
+		cause,
+		output: parsed.output,
+		log: what.log ?? null
+	}), {
+		stage: what.stage,
+		ref: what.ref,
+		transient: isTransient(text),
+		cause,
+		log: what.log ?? null
+	});
+}
+/** Every image reeval builds carries this label, so `reeval clean --images` can find what it left. */
+const BUILT_BY = ["--label", `${LABEL.managed}=image`];
+/**
+* Removes the images reeval built that nothing tags any more (a rebuild's old image) and the
+* intermediate `-base` tags of `from` builds. Returns how many it removed.
+*/
+async function pruneImages() {
+	const list = async (args) => (await docker([
+		"image",
+		"ls",
+		...args
+	])).stdout.toString("utf8").split("\n").map((l) => l.trim()).filter(Boolean);
+	const dangling = [...await list([
+		"-q",
+		"--filter",
+		"dangling=true",
+		"--filter",
+		`label=${LABEL.managed}=image`
+	]), ...await list([
+		"-q",
+		"--filter",
+		"dangling=true",
+		"--filter",
+		`label=${LABEL.harness}`
+	])];
+	const bases = (await list([
+		"--format",
+		"{{.Repository}}:{{.Tag}}",
+		"reeval-sandbox"
+	])).filter((ref) => ref.endsWith("-base"));
+	let removed = 0;
+	for (const ref of [...bases, ...new Set(dangling)]) if ((await docker([
+		"image",
+		"rm",
+		ref
+	]).catch(() => null))?.exitCode === 0) removed++;
+	return removed;
+}
+/**
+* What a `from` names now, without pulling: its registry digest, or for an image that's only
+* local, its id (`local`). `error` when neither resolves, e.g. a typo or no network.
+*/
+async function resolveFrom(from, signal) {
+	const pinned = /@(sha256:[0-9a-f]{64})$/.exec(from)?.[1];
+	if (pinned) return {
+		digest: pinned,
+		local: false
+	};
+	const remote = await docker([
+		"buildx",
+		"imagetools",
+		"inspect",
+		"--format",
+		"{{json .Manifest.Digest}}",
+		from
+	], { signal }).catch(() => null);
+	const digest = remote?.exitCode === 0 ? JSON.parse(remote.stdout.toString("utf8").trim()) : null;
+	if (typeof digest === "string" && digest.startsWith("sha256:")) return {
+		digest,
+		local: false
+	};
+	const local = await imageInfo(from);
+	if (local) return {
+		digest: local.id,
+		local: true
+	};
+	return { error: remote?.stderr.trim().replace(/^ERROR: /, "").replace(/\s+/g, " ") || `${from} doesn't resolve` };
+}
+/** Removes a tag or an image reeval replaced, unless something still uses it. */
+const removeQuietly = async (ref) => {
+	await docker([
+		"image",
+		"rm",
+		ref
+	]).catch(() => {});
+};
+/** The hash of reeval's base image build context, which its images carry as a label. */
+function contextHash() {
+	const hash = createHash("sha256");
+	for (const path of contextFiles(DOCKER_CONTEXT, join(DOCKER_CONTEXT, "Dockerfile"))) {
+		hash.update(`${path}\0`);
+		hash.update(readFileSync(join(DOCKER_CONTEXT, path)));
+		hash.update("\0");
+	}
+	return hash.digest("hex").slice(0, 16);
+}
+/**
+* Bakes a harness's bootstrap (which installs its agent's CLI) into an image, so the image tag
+* pins the CLI build. Rebuild after bumping the adapter. With `from`, the base is that toolchain
+* image instead of reeval's Node image. `log` gets progress lines, `output` the build's full output
+* (for a log file, whose path failures name). The previous image under the tag, and the
+* intermediate `-base` tag of a `from` build, are removed once the new one is committed.
+*/
+async function buildImage(log, options) {
+	const { harness, from, signal } = options;
+	const resolved = from ? await resolveFrom(from, signal) : null;
+	const digest = resolved && "digest" in resolved ? resolved.digest : null;
+	const pinned = from && digest && resolved && "local" in resolved && !resolved.local && !from.includes("@") ? `${from}@${digest}` : from;
+	const bootstrap = BOOTSTRAPS[harness];
+	const base = from ? `${harnessImageFor(harness, from)}-base` : BASE_IMAGE;
+	const target = from ? harnessImageFor(harness, from) : imageFor(harness);
+	const previous = [(await imageInfo(target))?.id, from ? null : (await imageInfo(base))?.id];
+	log(`Building ${base}${from ? ` from ${from}` : ""}`);
+	const build = from ? await docker([
+		"build",
+		"--progress",
+		"plain",
+		...BUILT_BY,
+		...options.pull ? ["--pull"] : [],
+		"--tag",
+		base,
+		"-"
+	], {
+		input: toolchainDockerfile(pinned ?? from),
+		signal
+	}) : await docker([
+		"build",
+		"--progress",
+		"plain",
+		...BUILT_BY,
+		"--tag",
+		base,
+		DOCKER_CONTEXT
+	], { signal });
+	const output = `${build.stdout.toString("utf8")}${build.stderr}`;
+	options.output?.write(output);
+	if (build.exitCode !== 0) throw buildError(output, {
+		stage: from ? "from" : "harness",
+		ref: target,
+		headline: from ? `Building the toolchain layer FROM ${from}` : "Building reeval's base image",
+		log: options.output?.path ?? null
+	}, (parsed) => parsed.output.find((l) => l.startsWith("reeval needs a Debian")) ?? null);
+	log(`Installing the ${bootstrap.name} harness bootstrap`);
+	const session = await createDockerSession({
+		image: base,
+		lifetimeMs: 18e5,
+		...signal ? { abortSignal: signal } : {}
+	});
+	let agentVersion;
+	try {
+		agentVersion = await bake(session, bootstrap);
+		log(`${bootstrap.name} ${bootstrap.version ? "" : "CLI "}${agentVersion}`);
+		await dockerOk([
+			"commit",
+			"--change",
+			`LABEL ${LABEL.agentVersion}="${agentVersion}" ${LABEL.harness}="${harnessLabel(harness)}"${from ? digest ? ` ${LABEL.fromDigest}="${digest}"` : "" : ` ${LABEL.context}="${contextHash()}"`}`,
+			"--change",
+			`WORKDIR ${SANDBOX_ROOT}`,
+			"--change",
+			"USER root",
+			"--change",
+			"ENTRYPOINT []",
+			"--change",
+			"CMD [\"bash\"]",
+			session.id,
+			target
+		]);
+	} catch (error) {
+		if (signal?.aborted || error instanceof ImageBuildError) throw error;
+		const [first = "", ...rest] = error.message.split("\n");
+		const cause = failureCause(error.message, null);
+		options.output?.write(`${output}\n${error.message}\n`);
+		throw new ImageBuildError(failureMessage({
+			headline: `Baking the ${bootstrap.name} CLI onto ${from ?? "reeval-sandbox-base:latest"} failed: ${clipLine(first)}`,
+			cause,
+			output: outputTail(rest.join("\n")),
+			log: options.output?.path ?? null
+		}), {
+			stage: "harness",
+			ref: target,
+			transient: isTransient(error.message),
+			cause,
+			log: options.output?.path ?? null
+		});
+	} finally {
+		await session.destroy();
+	}
+	if (from) await removeQuietly(base);
+	const now = (await imageInfo(target))?.id;
+	for (const id of previous) if (id && id !== now) await removeQuietly(id);
+	return {
+		image: target,
+		agentVersion
+	};
+}
+/** Runs the harness bootstrap in `session` and returns the CLI version it installed. */
+async function bake(session, bootstrap) {
+	await prepareSandboxForHarness({
+		session,
+		harnesses: [await bootstrap.adapter()],
+		sandboxConfig: { workDir: WORKSPACE_DIR }
+	});
+	let probe = bootstrap.version;
+	if (!probe) {
+		const bin = (await session.run({ command: `find "$HOME/.ai-sdk-harness" -name ${bootstrap.cli} \\( -type f -o -type l \\) -perm -u+x | head -1` })).stdout.trim();
+		if (!bin) throw new Error(`The harness bootstrap did not install the ${bootstrap.name} CLI`);
+		probe = `'${bin}' --version`;
+	}
+	const version = await session.run({ command: probe });
+	if (bootstrap.version && version.exitCode !== 0) throw new Error(`The harness bootstrap did not install ${bootstrap.cli}:\n${tail(version.stderr)}`);
+	return version.stdout.trim() || "unknown";
+}
+/**
+* The image `docker({ install })` runs in: the commands on top of `parent`, tagged by the parent's
+* id and the exact list, so it's built once. Secrets and the workspace never exist here.
+*/
+const installLayerTag = (parent, steps) => `reeval-install:${sha256(JSON.stringify({
+	parent: parent.id,
+	steps
+})).slice(0, 16)}`;
+/** The commands as one bash script: in order, from `/`, stopping at the first that fails. */
+function installScript(steps) {
+	const lines = ["cd /"];
+	for (const [i, step] of steps.entries()) {
+		const n = `${i + 1}/${steps.length}`;
+		const run = step.timeoutMs ? `timeout --kill-after=10 ${Math.ceil(step.timeoutMs / 1e3)} bash -c ${shellQuote(step.run)}` : `bash -c ${shellQuote(step.run)}`;
+		const label = shellQuote(step.run.split("\n")[0] ?? "");
+		lines.push(`echo "reeval: install ${n}: "${label}`, `${run} || { code=$?; echo "reeval: install ${n} exited $code: "${label} >&2; exit $code; }`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+/** Builds the install layer if it's missing. `output` gets the build's output, for a log file. */
+async function buildInstallLayer(parent, steps, options = {}) {
+	const { signal } = options;
+	const tag = installLayerTag(parent, steps);
+	if ((await docker([
+		"image",
+		"inspect",
+		"--format",
+		"{{.Id}}",
+		tag
+	], { signal })).exitCode === 0) return tag;
+	const script = installScript(steps);
+	const encoded = Buffer.from(script).toString("base64");
+	const home = `$(getent passwd ${SANDBOX_USER} | cut -d: -f6)`;
+	const dockerfile = [
+		`FROM ${parent.ref}`,
+		"USER root",
+		`RUN echo ${encoded} | base64 -d > /tmp/reeval-install.sh \\`,
+		`  && if id -u ${SANDBOX_USER} >/dev/null 2>&1; then export HOME="${home}"; fi \\`,
+		"  && bash /tmp/reeval-install.sh && rm /tmp/reeval-install.sh \\",
+		`  && { ! id -u ${SANDBOX_USER} >/dev/null 2>&1 || find "$HOME" -xdev ! -user ${SANDBOX_USER} -exec chown -h ${SANDBOX_USER}: {} +; }`,
+		`WORKDIR ${SANDBOX_ROOT}`
+	].join("\n");
+	const build = await docker([
+		"build",
+		"--progress",
+		"plain",
+		...BUILT_BY,
+		"--tag",
+		tag,
+		"-"
+	], {
+		input: dockerfile,
+		signal
+	});
+	const output = `${build.stdout.toString("utf8")}${build.stderr}`;
+	options.output?.write(`${script}\n${dockerfile}\n\n${output}`);
+	if (build.exitCode !== 0) {
+		const failed = /reeval: install (\d+\/\d+) exited (\d+): (.*)/.exec(output);
+		throw buildError(output, {
+			stage: "install",
+			ref: tag,
+			headline: `Building the install layer (${`${steps.length} command${steps.length === 1 ? "" : "s"}`})`,
+			log: options.output?.path ?? null
+		}, () => failed ? `install ${failed[1]} exited ${failed[2]}: ${clipLine(failed[3] ?? "")}` : null, (line) => !line.startsWith("reeval: install "));
+	}
+	return tag;
+}
+/** The build arg a Dockerfile can start `FROM` to layer on reeval's sandbox image. */
+const REEVAL_BASE_ARG = "REEVAL_BASE";
+/**
+* `.dockerignore` rules as Docker reads them: paths from the context root, `*`, `?` and `**`
+* globs, a pattern that matches a directory excludes what's in it, `!` re-includes, and the last
+* matching rule wins.
+*/
+function dockerignoreMatcher(text) {
+	const rules = text.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).map((line) => {
+		const negate = line.startsWith("!");
+		const body = (negate ? line.slice(1) : line).trim().replace(/^(?:\.?\/)+/, "").replace(/\/+$/, "");
+		let re = "";
+		for (let i = 0; i < body.length; i++) {
+			const c = body[i];
+			if (c === "*" && body[i + 1] === "*") {
+				i++;
+				if (body[i + 1] === "/") {
+					i++;
+					re += "(?:.*/)?";
+				} else re += ".*";
+			} else if (c === "*") re += "[^/]*";
+			else if (c === "?") re += "[^/]";
+			else re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+		}
+		return {
+			negate,
+			re: new RegExp(`^${re}$`)
+		};
+	});
+	return (path) => {
+		const parts = path.split("/");
+		const prefixes = parts.map((_, i) => parts.slice(0, i + 1).join("/"));
+		let excluded = false;
+		for (const rule of rules) if (prefixes.some((p) => rule.re.test(p))) excluded = !rule.negate;
+		return excluded;
+	};
+}
+/** Files in the build context that `docker build` would send, sorted, relative to `context`. */
+function contextFiles(context, dockerfile) {
+	const own = [`${dockerfile}.dockerignore`, join(context, ".dockerignore")].find(existsSync);
+	const ignored = dockerignoreMatcher(own ? readFileSync(own, "utf8") : "");
+	const always = /* @__PURE__ */ new Set([relative(context, dockerfile), ".dockerignore"]);
+	const files = [];
+	const walk = (rel) => {
+		for (const entry of readdirSync(join(context, rel), { withFileTypes: true })) {
+			const path = rel ? `${rel}/${entry.name}` : entry.name;
+			if (ignored(path) && !always.has(path)) continue;
+			if (entry.isDirectory()) walk(path);
+			else files.push(path);
+		}
+	};
+	walk("");
+	return files.sort();
+}
+/** Whether the Dockerfile starts from reeval's sandbox image, which then has to exist first. */
+const usesEsBase = (dockerfile) => new RegExp(`\\$\\{?${REEVAL_BASE_ARG}\\b`).test(readFileSync(dockerfile, "utf8"));
+/**
+* The tag of a `docker({ dockerfile })` build for a harness: a hash of the Dockerfile, every file
+* of its build context (its directory, less `.dockerignore`) and, for a Dockerfile `FROM
+* ${REEVAL_BASE}`, the id of the harness's image it names, so an edit to any of them, or a rebuilt reeval
+* image, builds anew. `esBase` is that id (null when it isn't built).
+*/
+function dockerfileTag(dockerfile, harness, esBase = null) {
+	const context = dirname(dockerfile);
+	const base = usesEsBase(dockerfile) ? `${imageFor(harness)}@${esBase ?? "unbuilt"}` : "";
+	const hash = createHash("sha256").update(`${REEVAL_BASE_ARG}=${base}\0`);
+	for (const path of contextFiles(context, dockerfile)) {
+		const full = join(context, path);
+		const stat = lstatSync(full);
+		hash.update(`${path}\0${stat.mode & 73 ? "x" : "-"}\0`);
+		hash.update(stat.isSymbolicLink() ? readlinkSync(full) : readFileSync(full));
+		hash.update("\0");
+	}
+	const digest = hash.digest("hex");
+	return {
+		tag: `reeval-dockerfile:${slugify(basename(dockerfile) === "Dockerfile" ? basename(context) : basename(dockerfile), 40) || "image"}-${digest.slice(0, 16)}`,
+		sha256: digest
+	};
+}
+/**
+* Builds the user's Dockerfile with plain `docker build` (so Docker's layer cache applies), from
+* its directory, with `REEVAL_BASE` set to the harness's sandbox image (whose id is `esBase`).
+* Rebuilds even when the tag exists with `force`, as `reeval image build` does, and then removes the
+* image the tag pointed at before. `name` is the path failures name.
+*/
+async function buildDockerfile(dockerfile, options) {
+	const { harness, signal } = options;
+	const { tag } = dockerfileTag(dockerfile, harness, options.esBase ?? null);
+	const previous = (await imageInfo(tag))?.id;
+	if (previous && !options.force) return tag;
+	const build = await docker([
+		"build",
+		"--progress",
+		"plain",
+		...BUILT_BY,
+		...options.pull ? ["--pull"] : [],
+		"--file",
+		dockerfile,
+		"--build-arg",
+		`${REEVAL_BASE_ARG}=${imageFor(harness)}`,
+		"--tag",
+		tag,
+		dirname(dockerfile)
+	], { signal });
+	const output = `${build.stdout.toString("utf8")}${build.stderr}`;
+	options.output?.write(output);
+	if (build.exitCode !== 0) throw buildError(output, {
+		stage: "dockerfile",
+		ref: tag,
+		headline: `Building ${options.name ?? dockerfile}`,
+		log: options.output?.path ?? null
+	});
+	const now = (await imageInfo(tag))?.id;
+	if (previous && previous !== now) await removeQuietly(previous);
+	return tag;
+}
+//#endregion
+export { onDockerCommand as $, hostAllowed as A, WORKSPACE_DIR as B, applyTransformations as C, HARNESS_HOSTS as D, DOCKER_EGRESS as E, HARNESS_PACKAGES as F, docker as G, harnessLabel as H, LABEL as I, dockerOk as J, dockerAvailable as K, SANDBOX_HOME as L, BASE_IMAGE as M, BRIDGE_PORT as N, PACKAGE_HOSTS as O, DEFAULT_IMAGE as P, removeContainerDetached as Q, SANDBOX_ROOT as R, placeholder as S, onEndpoint as T, imageFor as U, adapterVersion as V, isBakedHarness as W, imageInfo as X, dockerState as Y, isRegistryDigest as Z, ROOT_CAPABILITIES as _, buildInstallLayer as a, failureCause as at, CA_PATH as b, dockerfileTag as c, retryTransient as ct, installLayerTag as d, run as et, installScript as f, DEFAULT_LIMITS as g, usesEsBase as h, buildImage as i, causeLine as it, BAKED_HARNESSES as j, defaultAllowedHosts as k, dockerignoreMatcher as l, resolveFrom as m, REEVAL_BASE_ARG as n, ImageBuildError as nt, contextFiles as o, isTransient as ot, pruneImages as p, dockerCapacity as q, buildDockerfile as r, RETRY_DELAYS as rt, contextHash as s, parseBuildOutput as st, DOCKER_CONTEXT as t, shellQuote as tt, harnessImageFor as u, createDockerSession as v, matches as w, PROXY_PORT as x, dockerSandboxProvider as y, SANDBOX_USER as z };
+
+//# sourceMappingURL=src-DwwiVLqv.js.map