reeval 0.10.0 → 0.12.0

package/dist/{src-B7treWa8.js → src-LekQrr_S.js}

@@ -1,8 +1,7 @@
 import { u as ownFileURL } from "./root-DICDHCtp.js";
-import { n as shellQuote, t as run } from "./process-CSVO_jsc.js";
 import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, renameSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname, join, posix, relative } from "node:path";
+import { basename, dirname, join, posix, relative, win32 } from "node:path";
 import net, { BlockList, isIP } from "node:net";
 import { createHash, generateKeyPairSync, randomBytes, randomInt, sign } from "node:crypto";
 import { fileURLToPath } from "node:url";
@@ -1177,6 +1176,119 @@ function outputTail(text, max = 8) {
 	return stripAnsi(text).split(/\r?\n/).map((l) => l.trimEnd()).filter((l) => l.trim()).slice(-max);
 }
 //#endregion
+//#region ../sandbox-docker/src/process.ts
+const CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+const cmdEscape = (arg, twice) => {
+	const quoted = `"${arg.replace(/(\\*)"/g, "$1$1\\\"").replace(/(\\*)$/, "$1$1")}"`.replace(CMD_META, "^$1");
+	return twice ? quoted.replace(CMD_META, "^$1") : quoted;
+};
+/**
+* How to spawn `cmd` on Windows, where npm, npx and pnpm are `.cmd` scripts that only cmd.exe
+* runs: the program PATH and PATHEXT find, and for a script, cmd.exe with every argument escaped.
+*/
+function windowsSpawn(cmd, args, env = process.env, exists = existsSync) {
+	const exts = (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+	const file = (/[\\/]/.test(cmd) ? [""] : (env.PATH ?? env.Path ?? "").split(";").filter(Boolean)).flatMap((dir) => {
+		const base = dir ? win32.join(dir, cmd) : cmd;
+		return [...win32.extname(cmd) ? [base] : [], ...exts.map((ext) => base + ext.toLowerCase())];
+	}).find(exists) ?? cmd;
+	if (!/\.(cmd|bat)$/i.test(file)) return {
+		file,
+		args,
+		verbatim: false
+	};
+	const twice = /node_modules[\\/]\.bin[\\/][^\\/]+\.cmd$/i.test(file);
+	const line = [win32.normalize(file).replace(CMD_META, "^$1"), ...args.map((a) => cmdEscape(a, twice))].join(" ");
+	return {
+		file: env.ComSpec ?? "cmd.exe",
+		args: [
+			"/d",
+			"/s",
+			"/c",
+			`"${line}"`
+		],
+		verbatim: true
+	};
+}
+/**
+* Kills a process and everything it started: its process group on POSIX (a detached child leads
+* one), its process tree with `taskkill` on Windows, which has neither groups nor signals.
+*/
+function killTree(pid) {
+	if (process.platform === "win32") {
+		spawn("taskkill", [
+			"/pid",
+			String(pid),
+			"/t",
+			"/f"
+		], {
+			stdio: "ignore",
+			windowsHide: true
+		}).on("error", () => {});
+		return;
+	}
+	try {
+		process.kill(-pid, "SIGKILL");
+	} catch {
+		try {
+			process.kill(pid, "SIGKILL");
+		} catch {}
+	}
+}
+/** `s` as one single-quoted POSIX shell word. */
+const shellQuote = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
+function run(cmd, args, options = {}) {
+	const { signal } = options;
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) return reject(signal.reason);
+		const detached = options.detached ?? true;
+		const target = process.platform === "win32" ? windowsSpawn(cmd, args, options.env ? {
+			...process.env,
+			...options.env
+		} : process.env) : {
+			file: cmd,
+			args,
+			verbatim: false
+		};
+		const child = spawn(target.file, target.args, {
+			cwd: options.cwd,
+			stdio: "pipe",
+			detached: detached && !target.verbatim,
+			windowsHide: true,
+			windowsVerbatimArguments: target.verbatim,
+			env: options.env ? {
+				...process.env,
+				...options.env
+			} : process.env
+		});
+		const out = [];
+		let stderr = "";
+		child.stdout.on("data", (d) => out.push(d));
+		child.stderr.on("data", (d) => {
+			stderr += d;
+		});
+		const onAbort = () => {
+			if ((detached || process.platform === "win32") && child.pid) killTree(child.pid);
+			else child.kill("SIGKILL");
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+		child.on("error", reject);
+		child.on("close", (code) => {
+			signal?.removeEventListener("abort", onAbort);
+			if (signal?.aborted) return reject(signal.reason);
+			const stdout = Buffer.concat(out);
+			resolve({
+				exitCode: code ?? 1,
+				stdout: options.binary ? stdout : stdout.toString(),
+				stderr
+			});
+		});
+		if (child.pid) options.onSpawn?.(child.pid);
+		child.stdin.on("error", () => {});
+		child.stdin.end(options.input ?? "");
+	});
+}
+//#endregion
 //#region ../sandbox-docker/src/trace.ts
 /** Most of each stream a trace keeps; the rest is counted. */
 const MAX_STREAM = 4096;
@@ -1396,12 +1508,22 @@ for (let i = 0; i < Number(seconds); i++) {
 	child.on("error", () => {});
 	child.unref();
 }
-async function dockerState(engine) {
+async function dockerState(engine, signal) {
+	let missing = false;
+	const format = engineSpec(engine).stateFormat;
 	const r = await docker([
 		"info",
 		"--format",
-		engineSpec(engine).stateFormat
-	], { engine }).catch(() => null);
+		format
+	], {
+		engine,
+		signal
+	}).catch((error) => {
+		if (signal?.aborted) throw signal.reason;
+		missing = error?.code === "ENOENT";
+		return null;
+	});
+	if (missing) return "missing";
 	const [version, os] = r?.exitCode === 0 ? r.stdout.toString("utf8").trim().split(/\s+/) : [];
 	if (!version) return "down";
 	return os === "windows" ? "windows-containers" : "running";
@@ -1489,16 +1611,16 @@ async function imageInfo(image, engine) {
 const HARNESS_PACKAGES = {
 	cursor: {
 		name: "@reeval/harness-cursor-sdk",
-		version: "0.1.5"
+		version: "0.1.6"
 	},
 	"claude-code": {
 		name: "@ai-sdk/harness-claude-code",
-		version: "1.0.158",
-		patch: "6c1cff12"
+		version: "1.0.160",
+		patch: "b17cde50"
 	},
 	antigravity: {
 		name: "@reeval/harness-antigravity",
-		version: "0.1.8"
+		version: "0.1.9"
 	},
 	opencode: {
 		name: "@reeval/harness-opencode",
@@ -1522,7 +1644,7 @@ const HARNESS_PACKAGES = {
 	},
 	"grok-build": {
 		name: "@reeval/harness-grok-build",
-		version: "0.1.0"
+		version: "0.1.1"
 	}
 };
 /** Every harness with an image, in {@link HARNESS_PACKAGES} order. */
@@ -1563,6 +1685,11 @@ const SANDBOX_HOME = `/home/${SANDBOX_USER}`;
 const SANDBOX_ROOT = "/reeval";
 /** The agent's working directory, relative to {@link SANDBOX_ROOT}. */
 const WORKSPACE_DIR = "workspace";
+/**
+* reeval's own state in the container, root's and mode 0700: outside {@link SANDBOX_ROOT}, which
+* {@link SANDBOX_USER} owns and so could rename it away and put its own in its place.
+*/
+const SANDBOX_STATE = "/var/lib/reeval";
 const BRIDGE_PORT = 43210;
 //#endregion
 //#region ../sandbox-docker/src/egress/cert.ts
@@ -3251,9 +3378,18 @@ async function confinementArgs(options) {
 }
 /** Runtime `npm i -g` goes to the sandbox user's own prefix, whose `bin` the images put on PATH. */
 const userEnv = (options) => options.root ? {} : { NPM_CONFIG_PREFIX: `${SANDBOX_HOME}/.local` };
+/** Root's PATH in a privileged exec: none of the sandbox user's own `bin` directories. */
+const SYSTEM_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 /** Set on every exec, so a kill can find the command's whole process tree in the container. */
 const EXEC_MARKER = "REEVAL_EXEC_ID";
 /**
+* Every exec that can create a file starts with this. An exec'd process inherits the umask of the
+* engine's shim, not the container's: since Docker 29.6 that's 0000 wherever dockerd starts
+* containerd itself (Docker-in-Docker, rootless, OrbStack), which makes homes, the workspace and
+* everything an agent writes world-writable, and tools such as fx and OpenSSH refuse them.
+*/
+const EXEC_UMASK = "umask 022";
+/**
 * The container's cgroup counts every process the kernel killed at its memory limit: cgroup v2's
 * `memory.events` and v1's `memory.oom_control` both have an `oom_kill` line. Without either,
 * Docker's `OOMKilled` says only whether there was one.
@@ -3363,9 +3499,9 @@ async function createDockerSession(options) {
 			"--user",
 			"0:0",
 			id,
-			"mkdir",
-			"-p",
-			SANDBOX_ROOT
+			"sh",
+			"-c",
+			`${EXEC_UMASK} && mkdir -p ${SANDBOX_ROOT}`
 		], {
 			engine,
 			signal
@@ -3441,7 +3577,7 @@ async function createDockerSession(options) {
 		id,
 		"bash",
 		"-c",
-		command
+		`${EXEC_UMASK}; ${command}`
 	];
 	const nextMarker = () => `${id.slice(0, 12)}-${++execs}`;
 	/**
@@ -3474,6 +3610,39 @@ async function createDockerSession(options) {
 			throw error;
 		}
 	};
+	const runPrivileged = async (o) => {
+		const marker = nextMarker();
+		const args = [
+			"exec",
+			"--privileged",
+			"--user",
+			"0:0",
+			"--workdir",
+			o.workingDirectory ? posix.resolve(SANDBOX_ROOT, o.workingDirectory) : SANDBOX_ROOT,
+			"--env",
+			`${EXEC_MARKER}=${marker}`,
+			"--env",
+			`PATH=${SYSTEM_PATH}`,
+			id,
+			"/bin/sh",
+			"-c",
+			`${EXEC_UMASK}; ${o.command}`
+		];
+		try {
+			const r = await docker(args, {
+				signal: o.abortSignal,
+				engine
+			});
+			return {
+				exitCode: r.exitCode,
+				stdout: r.stdout.toString("utf8"),
+				stderr: r.stderr
+			};
+		} catch (error) {
+			if (o.abortSignal?.aborted) await killExec(marker);
+			throw error;
+		}
+	};
 	const readBinaryFile = async (o) => {
 		const r = await docker([
 			"exec",
@@ -3495,7 +3664,7 @@ async function createDockerSession(options) {
 			id,
 			"sh",
 			"-c",
-			`mkdir -p ${shellQuote(posix.dirname(path))} && cat > ${shellQuote(path)}`
+			`${EXEC_UMASK} && mkdir -p ${shellQuote(posix.dirname(path))} && cat > ${shellQuote(path)}`
 		], {
 			input: Buffer.from(o.content),
 			signal: o.abortSignal,
@@ -3536,6 +3705,7 @@ async function createDockerSession(options) {
 		...substituting,
 		oomKills: () => oomKills(id, engine),
 		run,
+		runPrivileged,
 		async spawn(o) {
 			const env = envFor(o.env);
 			const marker = nextMarker();
@@ -3661,10 +3831,16 @@ const slugify = (text, max) => text.toLowerCase().replace(/[^a-z0-9]+/g, "-").re
 /** The build context of reeval's base image, shipped in the package. */
 const DOCKER_CONTEXT = fileURLToPath(ownFileURL("docker"));
 /**
+* How reeval bakes a harness into an image, beyond the build context and the adapter: bump it when
+* that changes what a baked image holds, so every image baked before rebuilds on its next use.
+*/
+const BAKE_REVISION = 2;
+/**
 * The image `docker({ from })` evals run in: `from` plus Node, git and the harness's CLI. The hash
-* covers the toolchain layer too, so a change to the sandbox user or paths builds anew.
+* covers the toolchain layer and {@link BAKE_REVISION} too, so a change to the sandbox user, paths
+* or how the harness is baked builds anew.
 */
-const harnessImageFor = (harness, from) => `${imageFor(harness)}-${slugify(from, 40) || "image"}-${sha256(toolchainDockerfile(from)).slice(0, 8)}`;
+const harnessImageFor = (harness, from) => `${imageFor(harness)}-${slugify(from, 40) || "image"}-${sha256(`${BAKE_REVISION}\0${toolchainDockerfile(from)}`).slice(0, 8)}`;
 /**
 * How each harness's CLI gets into an image: its adapter's bootstrap, and the binary it leaves
 * (or, for an adapter without one, a command that prints what it installed).
@@ -3674,22 +3850,22 @@ const BOOTSTRAPS = {
 		name: "Cursor",
 		cli: "@cursor/sdk",
 		version: `node -p "'@cursor/sdk ' + require(process.env.HOME + '/.ai-sdk-harness/.harness-bootstrap/cursor-sdk/node_modules/@cursor/sdk/package.json').version"`,
-		adapter: async () => (await import("./src-DTbrY1hi.js")).createCursorSdk()
+		adapter: async () => (await import("./src-C0xowZ3C.js")).createCursorSdk()
 	},
 	"claude-code": {
 		name: "Claude Code",
 		cli: "claude",
-		adapter: async () => (await import("./dist-B8hJImYt.js")).createClaudeCode()
+		adapter: async () => (await import("./dist-CMjp3qqF.js")).createClaudeCode()
 	},
 	antigravity: {
 		name: "Antigravity",
 		cli: "agy",
-		adapter: async () => (await import("./src-DNnG4e4R.js")).createAntigravity()
+		adapter: async () => (await import("./src-bCnsA6Vp.js")).createAntigravity()
 	},
 	opencode: {
 		name: "OpenCode",
 		cli: "opencode",
-		adapter: async () => (await import("./src-ofUaYbuY.js")).createOpenCode({
+		adapter: async () => (await import("./src-Bcah6ZkT.js")).createOpenCode({
 			auth: { GOOGLE_GENERATIVE_AI_API_KEY: "unused" },
 			model: "google/unused"
 		})
@@ -3697,7 +3873,7 @@ const BOOTSTRAPS = {
 	goose: {
 		name: "Goose",
 		cli: "goose",
-		adapter: async () => (await import("./src-DdyJEh2v.js")).createGoose({
+		adapter: async () => (await import("./src-DPIjmReZ.js")).createGoose({
 			auth: { GOOGLE_API_KEY: "unused" },
 			model: "unused"
 		})
@@ -3705,17 +3881,17 @@ const BOOTSTRAPS = {
 	pi: {
 		name: "pi",
 		cli: "pi",
-		adapter: async () => (await import("./src-jzagbuqH.js")).createPi({ auth: { GEMINI_API_KEY: "unused" } })
+		adapter: async () => (await import("./src-ynBVosfX.js")).createPi({ auth: { GEMINI_API_KEY: "unused" } })
 	},
 	codex: {
 		name: "Codex",
 		cli: "codex",
-		adapter: async () => (await import("./src-Dj9PAroc.js")).createCodex({ auth: { OPENAI_API_KEY: "unused" } })
+		adapter: async () => (await import("./src-DLtyz4w5.js")).createCodex({ auth: { OPENAI_API_KEY: "unused" } })
 	},
 	fx: {
 		name: "fx",
 		cli: "fx",
-		adapter: async () => (await import("./src-C_lPtowT.js")).createFx({
+		adapter: async () => (await import("./src-DXNh5mTr.js")).createFx({
 			auth: { AI_GATEWAY_API_KEY: "unused" },
 			model: "unused/unused"
 		})
@@ -3723,7 +3899,7 @@ const BOOTSTRAPS = {
 	"grok-build": {
 		name: "Grok Build",
 		cli: "grok",
-		adapter: async () => (await import("./src-Du8H85Qq.js")).createGrokBuild({
+		adapter: async () => (await import("./src-CHIfIKUu.js")).createGrokBuild({
 			auth: { XAI_API_KEY: "unused" },
 			model: "unused"
 		})
@@ -3911,9 +4087,13 @@ const removeQuietly = async (ref, engine) => {
 		ref
 	], { engine }).catch(() => {});
 };
-/** The hash of reeval's base image build context, which its images carry as a label. */
+/**
+* The hash of reeval's base image build context and {@link BAKE_REVISION}, which its images carry
+* as a label.
+*/
 function contextHash() {
 	const hash = createHash("sha256");
+	hash.update(`bake ${BAKE_REVISION}\0`);
 	for (const path of contextFiles(DOCKER_CONTEXT, join(DOCKER_CONTEXT, "Dockerfile"))) {
 		hash.update(`${path}\0`);
 		hash.update(readFileSync(join(DOCKER_CONTEXT, path)));
@@ -4119,6 +4299,108 @@ async function buildInstallLayer(parent, steps, options = {}) {
 	}
 	return tag;
 }
+/** Where a plugin layer leaves each built plugin, by its build's hash. */
+const PLUGIN_BUILDS_DIR = `${SANDBOX_ROOT}/plugin-builds`;
+/**
+* The sha256 of a plugin build's source as the layer gets it: every file `docker build` sends from
+* `context` (less `.dockerignore` and `.git`), with its executable bit or symlink target.
+*/
+function sourceTreeHash(context) {
+	const hash = createHash("sha256");
+	for (const path of contextFiles(context, null)) {
+		if (path === ".git" || path.startsWith(".git/")) continue;
+		const full = join(context, path);
+		const stat = lstatSync(full);
+		hash.update(`${path}\0${stat.mode & 73 ? "x" : "-"}\0`);
+		hash.update(stat.isSymbolicLink() ? readlinkSync(full) : readFileSync(full));
+		hash.update("\0");
+	}
+	return hash.digest("hex");
+}
+/** The hash a plugin layer's tag and directory carry: commit, tree and build. */
+const pluginBuildKey = (b) => sha256(JSON.stringify({
+	commit: b.commit,
+	tree: b.tree,
+	path: b.path,
+	cwd: b.cwd,
+	run: b.steps
+}));
+/** The image a plugin build makes on `parent`: the parent's id, then the build's hash. */
+const pluginLayerTag = (parent, b) => `reeval-plugin:${parent.id.replace(/^sha256:/, "").slice(0, 12)}-${pluginBuildKey(b).slice(0, 16)}`;
+/** Where a plugin layer leaves the plugin's directory. */
+const pluginBuildDir = (b) => `${PLUGIN_BUILDS_DIR}/${pluginBuildKey(b).slice(0, 16)}`;
+/** The line a plugin build's script fails with when its `cwd` isn't in the source. */
+const noCwd = (cwd) => `reeval: build cwd ${cwd} isn't a directory in the source`;
+/**
+* A plugin build's commands as one script, run from `cwd` under `src` (the source's root), stopping
+* at the first failure as an install script does, or before any when `cwd` isn't there.
+*/
+const pluginBuildScript = (b, src) => installScript(b.steps).replaceAll("reeval: install ", "reeval: build ").replace(/^cd \/\n/, `cd ${shellQuote(`${src}/${b.cwd}`)} || { echo ${shellQuote(noCwd(b.cwd))} >&2; exit 1; }\n`);
+/**
+* Builds a plugin's layer on `parent` if it's missing: the whole source, then its commands from
+* `cwd` as root with the sandbox user's home as HOME (as an install layer runs), keeping only the
+* plugin's directory at {@link pluginBuildDir}. Secrets and the workspace never exist here.
+*/
+async function buildPluginLayer(parent, b, options) {
+	const { signal, engine } = options;
+	const tag = pluginLayerTag(parent, b);
+	if ((await docker([
+		"image",
+		"inspect",
+		"--format",
+		"{{.Created}}",
+		tag
+	], {
+		signal,
+		engine
+	})).exitCode === 0) return tag;
+	const src = "/tmp/reeval-plugin-src";
+	const script = pluginBuildScript(b, src);
+	const encoded = Buffer.from(script).toString("base64");
+	const home = `$(getent passwd ${SANDBOX_USER} | cut -d: -f6)`;
+	const dir = pluginBuildDir(b);
+	const dockerfile = [
+		`FROM ${parent.ref}`,
+		"USER root",
+		`COPY . ${src}`,
+		`RUN rm -rf ${src}/.git && echo ${encoded} | base64 -d > /tmp/reeval-plugin-build.sh \\`,
+		`  && if id -u ${SANDBOX_USER} >/dev/null 2>&1; then export HOME="${home}"; fi \\`,
+		"  && bash /tmp/reeval-plugin-build.sh && rm /tmp/reeval-plugin-build.sh \\",
+		`  && mkdir -p ${dir} && cp -a ${shellQuote(`${src}/${b.path}`)}/. ${dir}/ && rm -rf ${src} ${dir}/.git \\`,
+		`  && chmod -R a+rX ${dir} \\`,
+		`  && { ! id -u ${SANDBOX_USER} >/dev/null 2>&1 || find "$HOME" -xdev ! -user ${SANDBOX_USER} -exec chown -h ${SANDBOX_USER}: {} +; }`,
+		`WORKDIR ${SANDBOX_ROOT}`
+	].join("\n");
+	const build = await docker([
+		"build",
+		"--progress",
+		"plain",
+		...BUILT_BY,
+		"--tag",
+		tag,
+		"-f",
+		"-",
+		b.context
+	], {
+		input: dockerfile,
+		signal,
+		engine
+	});
+	const output = `${build.stdout.toString("utf8")}${build.stderr}`;
+	options.output?.write(`${script}\n${dockerfile}\n\n${output}`);
+	if (build.exitCode !== 0) {
+		const failed = /reeval: build (\d+\/\d+) exited (\d+): (.*)/.exec(output);
+		const missing = output.includes(noCwd(b.cwd));
+		throw buildError(output, {
+			stage: "plugin",
+			ref: tag,
+			headline: `Building ${options.name}`,
+			log: options.output?.path ?? null,
+			engine
+		}, () => missing ? noCwd(b.cwd).slice(8) : failed ? `build ${failed[1]} exited ${failed[2]}: ${clipLine(failed[3] ?? "")}` : null, (line) => !line.startsWith("reeval: build "));
+	}
+	return tag;
+}
 /** The build arg a Dockerfile can start `FROM` to layer on reeval's sandbox image. */
 const REEVAL_BASE_ARG = "REEVAL_BASE";
 /**
@@ -4156,11 +4438,14 @@ function dockerignoreMatcher(text) {
 		return excluded;
 	};
 }
-/** Files in the build context that `docker build` would send, sorted, relative to `context`. */
+/**
+* Files in the build context that `docker build` would send, sorted, relative to `context`. A
+* Dockerfile read from stdin (`dockerfile` null) has no `<Dockerfile>.dockerignore` of its own.
+*/
 function contextFiles(context, dockerfile) {
-	const own = [`${dockerfile}.dockerignore`, join(context, ".dockerignore")].find(existsSync);
+	const own = [...dockerfile ? [`${dockerfile}.dockerignore`] : [], join(context, ".dockerignore")].find(existsSync);
 	const ignored = dockerignoreMatcher(own ? readFileSync(own, "utf8") : "");
-	const always = /* @__PURE__ */ new Set([relative(context, dockerfile), ".dockerignore"]);
+	const always = /* @__PURE__ */ new Set([...dockerfile ? [relative(context, dockerfile)] : [], ".dockerignore"]);
 	const files = [];
 	const walk = (rel) => {
 		for (const entry of readdirSync(join(context, rel), { withFileTypes: true })) {
@@ -4240,6 +4525,13 @@ async function buildDockerfile(dockerfile, options) {
 	return tag;
 }
 //#endregion
-export { removeContainerDetached as $, hostAllowed as A, WORKSPACE_DIR as B, applyTransformations as C, HARNESS_HOSTS as D, DOCKER_EGRESS as E, HARNESS_PACKAGES as F, docker as G, harnessLabel as H, LABEL as I, dockerOk as J, dockerAvailable as K, SANDBOX_HOME as L, BASE_IMAGE as M, BRIDGE_PORT as N, PACKAGE_HOSTS as O, DEFAULT_IMAGE as P, isRegistryDigest as Q, SANDBOX_ROOT as R, placeholder as S, onEndpoint as T, imageFor as U, adapterVersion as V, isBakedHarness as W, imageInfo as X, dockerState as Y, imageTags as Z, ROOT_CAPABILITIES as _, buildInstallLayer as a, isTransient as at, CA_PATH as b, dockerfileTag as c, ENGINES as ct, installLayerTag as d, normalizeImageId as dt, onDockerCommand as et, installScript as f, DEFAULT_LIMITS as g, usesReevalBase as h, buildImage as i, failureCause as it, BAKED_HARNESSES as j, defaultAllowedHosts as k, dockerignoreMatcher as l, dockerSeccompFile as lt, resolveFrom as m, REEVAL_BASE_ARG as n, RETRY_DELAYS as nt, contextFiles as o, parseBuildOutput as ot, pruneImages as p, dockerCapacity as q, buildDockerfile as r, causeLine as rt, contextHash as s, retryTransient as st, DOCKER_CONTEXT as t, ImageBuildError as tt, harnessImageFor as u, engineSpec as ut, createDockerSession as v, matches as w, PROXY_PORT as x, dockerSandboxProvider as y, SANDBOX_USER as z };
+//#region ../sandbox-docker/src/mcp-timer.ts
+/**
+* reeval's MCP start-up timer, shipped in the package: a Node script that runs a stdio MCP server
+* and logs when it answers `initialize` (see its header). It runs in any sandbox with `node`.
+*/
+const MCP_TIMER = fileURLToPath(ownFileURL("bin/mcp-timer.cjs"));
+//#endregion
+export { docker as $, applyTransformations as A, BRIDGE_PORT as B, DEFAULT_LIMITS as C, CA_PATH as D, dockerSandboxProvider as E, PACKAGE_HOSTS as F, SANDBOX_ROOT as G, HARNESS_PACKAGES as H, defaultAllowedHosts as I, WORKSPACE_DIR as J, SANDBOX_STATE as K, hostAllowed as L, onEndpoint as M, DOCKER_EGRESS as N, PROXY_PORT as O, HARNESS_HOSTS as P, isBakedHarness as Q, BAKED_HARNESSES as R, usesReevalBase as S, createDockerSession as T, LABEL as U, DEFAULT_IMAGE as V, SANDBOX_HOME as W, harnessLabel as X, adapterVersion as Y, imageFor as Z, pluginBuildKey as _, retryTransient as _t, buildDockerfile as a, imageTags as at, resolveFrom as b, engineSpec as bt, buildPluginLayer as c, onDockerCommand as ct, dockerfileTag as d, ImageBuildError as dt, dockerAvailable as et, dockerignoreMatcher as f, RETRY_DELAYS as ft, pluginBuildDir as g, parseBuildOutput as gt, installScript as h, isTransient as ht, REEVAL_BASE_ARG as i, imageInfo as it, matches as j, placeholder as k, contextFiles as l, run as lt, installLayerTag as m, failureCause as mt, DOCKER_CONTEXT as n, dockerOk as nt, buildImage as o, isRegistryDigest as ot, harnessImageFor as p, causeLine as pt, SANDBOX_USER as q, PLUGIN_BUILDS_DIR as r, dockerState as rt, buildInstallLayer as s, removeContainerDetached as st, MCP_TIMER as t, dockerCapacity as tt, contextHash as u, shellQuote as ut, pluginLayerTag as v, ENGINES as vt, ROOT_CAPABILITIES as w, sourceTreeHash as x, normalizeImageId as xt, pruneImages as y, dockerSeccompFile as yt, BASE_IMAGE as z };
 
-//# sourceMappingURL=src-B7treWa8.js.map
+//# sourceMappingURL=src-LekQrr_S.js.map