reeval 0.11.0 → 0.12.0

package/dist/{evaluate-DKIl54Hb.js → evaluate-CXQ1o-pd.js}

@@ -1,32 +1,34 @@
 import { t as isObjectLike } from "./object-CLf2-tNq.js";
 import { n as UsageError, r as isTimeout, t as TimeoutError } from "./errors-B6BSMs03.js";
 import { n as dataProblem, p as parseDuration } from "./shared-CA61BuPJ.js";
-import { D as decideState, E as badJudgeArtifacts, O as filePartsOf, T as artifactRefsOf, _ as unbrokeredError, a as evalPlan, d as refuseIllegalCompare, f as sandboxId, g as unbrokered, h as secretVarsIn, i as checkOptions, k as resolveJudgeArtifacts, l as matchesTags, m as sandboxSetBy, n as cascade, o as expand, p as sandboxProvider, s as harnessId, t as brokeredIn, v as mergeJudge, w as judgeProblem, y as resolveStateOptions } from "./options-C0d0AzeR.js";
-import { A as workspaceLabel, C as parseGitRepo, D as stepCommand, E as sandboxPaths, S as mcpHosts, a as callerDir, b as isSecret, d as environmentFrom, f as environmentPaths, h as globFilter, j as workspaceOf, m as filesOf, n as DEFAULT_SKILL_EXCLUDE, v as isHostFile, x as isSecretTemplate } from "./environment-Cca6a4wB.js";
-import { c as relativeFile, i as evalSlug, l as sha256, n as attemptKey, r as evalId, s as recordFileName, t as attemptId } from "./ids-Bp6ut7ZD.js";
-import { l as runJudge, s as judgeModelName, u as isApiError } from "./judge-DW_GDOmB.js";
-import { r as badCharacterAt, v as inCI } from "./config-DrVSEVN0.js";
-import { o as redactSecrets, s as registerSecret } from "./redact-DJ9JCShu.js";
+import { D as decideState, E as badJudgeArtifacts, O as filePartsOf, T as artifactRefsOf, _ as unbrokeredError, a as evalPlan, d as refuseIllegalCompare, f as sandboxId, g as unbrokered, h as secretVarsIn, i as checkOptions, k as resolveJudgeArtifacts, l as matchesTags, m as sandboxSetBy, n as cascade, o as expand, p as sandboxProvider, s as harnessId, t as brokeredIn, v as mergeJudge, w as judgeProblem, y as resolveStateOptions } from "./options-CPUW97_7.js";
+import { E as sandboxPaths, a as callerDir, d as environmentFrom, f as environmentPaths, h as globFilter, j as workspaceOf, m as filesOf } from "./environment-BBz1Yes9.js";
+import { c as relativeFile, i as evalSlug, n as attemptKey, r as evalId, s as recordFileName, t as attemptId } from "./ids-Bp6ut7ZD.js";
+import { c as judgeModelName, d as isApiError, u as runJudge } from "./judge-Dt6KW6_O.js";
+import "./config-Dv5MG7Rp.js";
+import { t as inCI } from "./env-BQqj93gu.js";
+import { t as MCP_TIMER, ut as shellQuote } from "./src-LekQrr_S.js";
+import { o as redactSecrets } from "./redact-DJ9JCShu.js";
+import { O as pluginSourceLabel, S as pluginBuildId, b as localSkills, c as PluginProblem, d as builtPlugins, f as droppedPaths, h as layeredPlugins, l as buildRefusal, m as fetchesAtStart, n as PLUGIN_DIR, o as PLUGIN_ROOT, p as duplicateLocalPlugin, r as PLUGIN_MANIFEST, s as PLUGIN_ROOT_VAR, v as localPlugin, w as pluginCall } from "./plugins-CUWMnSNb.js";
 import { t as InfraError } from "./types-C5vI3g1C.js";
-import { _ as layoutOf, a as unenforceable, h as expectedBlockedFor, n as allowedHosts, o as createFakeSandbox, p as brokeringFor, r as egressLabel, v as refusedMcp } from "./egress-2-qzPvGi.js";
-import { S as placeholder, nt as shellQuote, tt as run } from "./src-ftu5wPSt.js";
+import { S as writePluginFiles, _ as expectedBlockedFor, a as unenforceable, b as refusedMcp, f as agentMcp, h as claudeMcpServers, m as brokeringFor, n as allowedHosts, o as createFakeSandbox, r as egressLabel, x as refusedPlugins, y as layoutOf } from "./egress-BfK_O9ce.js";
 import { i as registerTest, n as getRunContext, o as SUBJECT, r as registerGroup, t as collectingFile } from "./runtime-PX_oXiCS.js";
 import { a as withDebug, i as debugTrace, n as attemptDebug, r as debugLog, t as AttemptDebug } from "./attempt-CGPV3BZY.js";
 import { t as attemptDebugDir } from "./files-Ca0d6Uq3.js";
-import { n as clip, r as formatDuration, t as capMiddle } from "./text-gEcKjAyp.js";
-import { a as writeCaptureSidecars, c as sandboxFor, d as workspaceFiles, l as diffSinceSnapshot, o as asCheck, r as serveCommand, s as createChecks, t as capturePage, u as snapshot } from "./capture-BQlGHiMC.js";
-import { t as contextTaker } from "./context-C1mxXh80.js";
+import { i as formatDuration, n as clip, t as capMiddle } from "./text-CrVy5ioL.js";
+import { a as writeCaptureSidecars, c as sandboxFor, d as workspaceFiles, l as diffSinceSnapshot, o as asCheck, r as serveCommand, s as createChecks, t as capturePage, u as snapshot } from "./capture-BiD7lVaM.js";
+import { t as contextTaker } from "./context-Dgn48BqT.js";
+import { a as skillFiles, i as resolveEnvironment } from "./resolve-C4zeccCH.js";
 import { t as PrepareError } from "./provider-CmAYTQQs.js";
-import { i as preparedWorkspace } from "./workspace-C4RA3srV.js";
-import { n as judgeDiff } from "./patch-B1bnfhN-.js";
-import { t as transcriptForJudge } from "./transcript-BNNANU8A.js";
+import { i as preparedWorkspace } from "./workspace-tjZFkjxC.js";
+import { n as judgeDiff } from "./patch-D4oluWzH.js";
+import { t as transcriptForJudge } from "./transcript-BTxJpW4R.js";
 import { r as withLease } from "./client-fcwgwOAD.js";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
-import { parse } from "yaml";
+import { dirname, join } from "node:path";
+import { parse, stringify } from "yaml";
 import { z } from "zod";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 //#region src/attempt/assertions.ts
 const MESSAGE_LIMIT = 1024;
 const LABEL_LIMIT = 60;
@@ -133,6 +135,11 @@ function traceEnvironment(debug, spec, env) {
 		setup: env.setup,
 		skills: env.skills.map((s) => s.name),
 		workspaceSkills: env.workspaceSkills.map((s) => s.name),
+		plugins: env.plugins.map((p) => ({
+			name: p.name,
+			parts: p.parts,
+			files: p.files.length
+		})),
 		mcp: Object.fromEntries(Object.entries(env.mcp).map(([name, m]) => [name, m.transport === "stdio" ? {
 			transport: m.transport,
 			command: m.command,
@@ -152,545 +159,36 @@ function traceEnvironment(debug, spec, env) {
 	}, "resolved environment");
 }
 //#endregion
-//#region src/environment/resolve.ts
-const SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-const DEFAULT_SETUP_TIMEOUT = "5m";
-function broker(secrets, name, value, hosts, where = ["header"], phase = "agent") {
-	const at = badCharacterAt(value);
-	if (at && where.includes("header")) throw new InfraError(`${name} has whitespace or a line break in it (character ${at}), so it can't go in a request header. A key copied from a wrapped terminal line picks these up; set it again as one line.`);
-	const sub = {
-		name,
-		placeholder: placeholder(),
-		value,
-		hosts: [...hosts],
-		in: [...where],
-		phase
-	};
-	secrets.brokered.push(sub);
-	return sub.placeholder;
-}
-/** The host value, or its placeholder when it's brokered to `secret.hosts` (else `hosts`). */
-function hostValue(name, secret, where, secrets, hosts = secret.hosts) {
-	const from = secret.from ?? name;
-	const value = process.env[from];
-	if (!value) {
-		if (secret.optional) {
-			secrets.unset.push(name);
-			return;
-		}
-		const source = from === name ? name : `${name} (from ${from})`;
-		throw new InfraError(`Secret ${source} for ${where} isn't set. Set it in the environment or .env.local.`);
-	}
-	registerSecret(value);
-	if (secret.to === "checks") secrets.checks.push(name);
-	else secrets.names.push(name);
-	if (!hosts) return value;
-	return broker(secrets, name, value, hosts, secret.in, secret.to === "checks" ? "checks" : "agent");
-}
-/** Each host variable in the template, or with `hosts` one placeholder per variable. */
-function template(value, where, secrets, hosts) {
-	const placeholders = /* @__PURE__ */ new Map();
-	return value.template.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, name) => {
-		const v = process.env[name];
-		if (!v) throw new InfraError(`secret.template for ${where} needs ${name}, which isn't set. Set it in the environment or .env.local.`);
-		registerSecret(v);
-		if (!hosts) return v;
-		const p = placeholders.get(name) ?? broker(secrets, name, v, hosts);
-		placeholders.set(name, p);
-		return p;
-	});
-}
-/** A `SKILL.md` split into its YAML frontmatter's `name` and `description` and its body. */
-function parseSkillMd(text, where) {
-	const match = /^---\r?\n(?:([\s\S]*?)\r?\n)?---[ \t]*(?:\r?\n|$)([\s\S]*)$/.exec(text);
-	if (!match) return { body: text };
-	let front;
-	try {
-		front = parse(match[1] ?? "");
-	} catch (error) {
-		const reason = error.message.split("\n")[0];
-		throw new InfraError(`${where}: the SKILL.md frontmatter isn't valid YAML (${reason}). Quote values that contain ": ".`);
-	}
-	if (front != null && (typeof front !== "object" || Array.isArray(front))) throw new InfraError(`${where}: the SKILL.md frontmatter must be a YAML mapping, e.g. name: my-skill and description: … on their own lines`);
-	const field = (key) => {
-		const value = front?.[key];
-		if (value == null) return void 0;
-		if (typeof value !== "string") throw new InfraError(`${where}: the SKILL.md ${key} must be a string (got ${typeof value})`);
-		return value.trim() || void 0;
-	};
-	return {
-		name: field("name"),
-		description: field("description"),
-		body: match[2] ?? ""
-	};
-}
-/** A gitignore-style test for `DEFAULT_SKILL_EXCLUDE`-shaped patterns against a skill-relative path. */
-function excludeMatcher(patterns) {
-	const rules = patterns.map((pattern) => {
-		const dirOnly = pattern.endsWith("/");
-		const body = pattern.replace(/\/+$/, "");
-		const anchored = body.includes("/");
-		const glob = body.replace(/^\/+/, "").split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*");
-		return {
-			dirOnly,
-			re: new RegExp(`${anchored ? "^" : "(?:^|/)"}${glob}$`)
-		};
-	});
-	return (path, isDir) => rules.some((r) => (isDir || !r.dirOnly) && r.re.test(path));
-}
-function parseSkill(dir, source, exclude) {
-	const front = parseSkillMd(readFileSync(join(dir, "SKILL.md"), "utf8"), `Skill ${basename(dir)} in ${source}`);
-	const name = front.name || basename(dir);
-	checkSkill(name, front.description, source);
-	const skip = excludeMatcher(exclude);
-	const paths = [];
-	const excluded = [];
-	const walk = (rel) => {
-		for (const entry of readdirSync(join(dir, rel), { withFileTypes: true })) {
-			const path = rel ? `${rel}/${entry.name}` : entry.name;
-			const isDir = entry.isDirectory();
-			if (entry.name === ".git") continue;
-			if (skip(path, isDir)) excluded.push(isDir ? `${path}/` : path);
-			else if (isDir) walk(path);
-			else if (entry.isFile() && path !== "SKILL.md") paths.push(path);
-		}
-	};
-	walk("");
-	const files = paths.sort().map((path) => ({
-		path,
-		content: readFileSync(join(dir, path), "utf8")
-	}));
-	return {
-		skill: {
-			name,
-			description: front.description ?? "",
-			content: front.body,
-			files
-		},
-		excluded: excluded.sort()
-	};
-}
-function checkSkill(name, description, source) {
-	if (!SKILL_NAME.test(name)) throw new InfraError(`Skill "${name}" in ${source}: the name must be kebab-case, e.g. my-skill (lower-case letters, digits and -)`);
-	if (!description) throw new InfraError(`Skill "${name}" in ${source} has no description in its SKILL.md frontmatter. Add a description: line saying when to use it.`);
-}
-function loadSkills(dir, source, only, exclude = DEFAULT_SKILL_EXCLUDE) {
-	if (!existsSync(dir) || !statSync(dir).isDirectory()) throw new InfraError(`Skill source ${source} isn't a directory. Point it at a skill's directory, or at a directory of skills.`);
-	const dirs = existsSync(join(dir, "SKILL.md")) ? [dir] : readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync(join(dir, e.name, "SKILL.md"))).map((e) => join(dir, e.name)).sort();
-	if (dirs.length === 0) throw new InfraError(`Skill source ${source} has no SKILL.md (and no subdirectories with one)`);
-	const skills = dirs.map((d) => parseSkill(d, source, exclude));
-	if (!only) return skills;
-	const missing = only.filter((n) => !skills.some((s) => s.skill.name === n));
-	if (missing.length) throw new InfraError(`only: ${JSON.stringify(missing)} not found in ${source} (found: ${skills.map((s) => s.skill.name).join(", ")})`);
-	return skills.filter((s) => only.includes(s.skill.name));
-}
-async function git(args, cwd, what) {
-	const r = await run("git", args, { cwd });
-	if (r.exitCode !== 0) throw new InfraError(`${what} failed: ${r.stderr.trim()}`);
-	return r.stdout.trim();
-}
-/** One clone per source and ref per worker process; the commit is recorded. */
-const clones = /* @__PURE__ */ new Map();
-function cloneSkills(root, url, ref) {
-	const key = `${url}#${ref ?? ""}`;
-	let clone = clones.get(key);
-	if (!clone) {
-		clone = (async () => {
-			const dir = join(root, ".reeval", "cache", "skills", `${sha256(key).slice(0, 16)}-${process.pid}`);
-			await rm(dir, {
-				recursive: true,
-				force: true
-			});
-			await mkdir(dir, { recursive: true });
-			const what = `Cloning ${url}${ref ? ` at ${ref}` : ""}`;
-			await git(["init", "-q"], dir, what);
-			await git([
-				"fetch",
-				"-q",
-				"--depth",
-				"1",
-				url,
-				ref ?? "HEAD"
-			], dir, what);
-			await git([
-				"-c",
-				"advice.detachedHead=false",
-				"checkout",
-				"-q",
-				"FETCH_HEAD"
-			], dir, what);
-			return {
-				dir,
-				commit: await git(["rev-parse", "HEAD"], dir, what)
-			};
-		})();
-		clones.set(key, clone);
-		clone.catch(() => clones.delete(key));
-	}
-	return clone;
-}
-const packs = /* @__PURE__ */ new Map();
-/** `npm pack` into the cache, unpacked; returns the package directory. */
-function unpackNpm(root, spec) {
-	let pack = packs.get(spec);
-	if (!pack) {
-		pack = (async () => {
-			const dir = join(root, ".reeval", "cache", "skills", `npm-${sha256(spec).slice(0, 16)}-${process.pid}`);
-			await rm(dir, {
-				recursive: true,
-				force: true
-			});
-			await mkdir(dir, { recursive: true });
-			const packed = await run("npm", [
-				"pack",
-				spec,
-				"--silent",
-				"--pack-destination",
-				dir
-			], { cwd: dir });
-			const tarball = packed.stdout.trim().split("\n").at(-1);
-			if (packed.exitCode !== 0 || !tarball) throw new InfraError(`npm pack ${spec} failed: ${packed.stderr.trim()}`);
-			const untar = await run("tar", ["-xzf", tarball], { cwd: dir });
-			if (untar.exitCode !== 0) throw new InfraError(`Unpacking ${spec} failed: ${untar.stderr.trim()}`);
-			return join(dir, "package");
-		})();
-		packs.set(spec, pack);
-		pack.catch(() => packs.delete(spec));
-	}
-	return pack;
-}
-async function resolveSkills(root, s) {
-	switch (s.source) {
-		case "local": {
-			const label = `local:${relative(root, s.path).split(sep).join("/") || "."}`;
-			return {
-				skills: loadSkills(s.path, label, s.only, s.exclude),
-				source: label,
-				commit: null
-			};
-		}
-		case "git": {
-			const { url } = parseGitRepo(s.repo);
-			const { dir, commit } = await cloneSkills(root, url, s.ref);
-			const path = s.path ?? (!existsSync(join(dir, "SKILL.md")) && existsSync(join(dir, "skills")) ? "skills" : "");
-			const label = `${s.repo}${s.ref ? `#${s.ref}` : ""}${path ? `:${path}` : ""}`;
-			return {
-				skills: loadSkills(join(dir, path), label, s.only, s.exclude),
-				source: label,
-				commit
-			};
-		}
-		case "registry": {
-			const [repo = "", name = ""] = s.id.split("@");
-			const { dir, commit } = await cloneSkills(root, `https://github.com/${repo}.git`, s.version);
-			const label = `registry:${s.id}${s.version ? `#${s.version}` : ""}`;
-			return {
-				skills: loadSkills(existsSync(join(dir, "skills")) ? join(dir, "skills") : dir, label, [name]),
-				source: label,
-				commit
-			};
-		}
-		case "npm": {
-			const dir = await unpackNpm(root, s.spec);
-			const label = `npm:${isAbsolute(s.spec) ? relative(root, s.spec).split(sep).join("/") : s.spec}:${s.path}`;
-			return {
-				skills: loadSkills(join(dir, s.path), label, s.only, s.exclude),
-				source: label,
-				commit: null
-			};
-		}
-		case "inline": {
-			checkSkill(s.name, s.description, "skill.inline");
-			const files = Object.entries(s.files).sort(([a], [b]) => a < b ? -1 : 1).map(([path, content]) => ({
-				path,
-				content
-			}));
-			return {
-				skills: [{
-					skill: {
-						name: s.name,
-						description: s.description,
-						content: s.content,
-						files
-					},
-					excluded: []
-				}],
-				source: "inline",
-				commit: null
-			};
-		}
-	}
-}
-const skillHash = (s) => sha256(JSON.stringify(s));
-const readHostFile = (f, where) => {
-	if (!existsSync(f.path)) throw new InfraError(`${f.path} for ${where} doesn't exist. file() paths resolve against the file that calls it, or reeval.yaml's directory.`);
-	return readFileSync(f.path);
-};
-/**
-* Layers the environment (root first; a later layer wins on shared keys, and each such key is
-* an override), over the options `env` merged down the cascade. `where` names the attempt, and
-* `rulesFile` is the workspace file the harness's agent reads `rules` from.
-*/
-async function resolveEnvironment(environment, optionsEnv, root, where, rulesFile, egress = "allow-all", prepared = () => void 0) {
-	const envWhere = `environment ${environment.name} (${where})`;
-	const overrides = /* @__PURE__ */ new Set();
-	const env = { ...optionsEnv };
-	const files = /* @__PURE__ */ new Map();
-	const mcp = /* @__PURE__ */ new Map();
-	const skills = /* @__PURE__ */ new Map();
-	let rules;
-	const setup = [];
-	const seen = {
-		env: /* @__PURE__ */ new Set(),
-		files: /* @__PURE__ */ new Set(),
-		mcp: /* @__PURE__ */ new Set()
-	};
-	let egressSet = false;
-	let workspace;
-	let sandboxSet = false;
-	for (const { spec } of environment.layers) {
-		if (spec.sandbox !== void 0) {
-			if (sandboxSet) overrides.add("sandbox");
-			sandboxSet = true;
-		}
-		if (spec.workspace !== void 0) {
-			if (workspace) overrides.add("workspace");
-			workspace = spec.workspace;
-		}
-		if (spec.egress !== void 0) {
-			if (egressSet) overrides.add("egress");
-			egressSet = true;
-		}
-		for (const [k, v] of Object.entries(spec.env ?? {})) {
-			if (seen.env.has(k)) overrides.add(`env.${k}`);
-			seen.env.add(k);
-			env[k] = v;
-		}
-		for (const [path, v] of Object.entries(spec.files ?? {})) {
-			if (seen.files.has(path)) overrides.add(`files.${path}`);
-			seen.files.add(path);
-			files.set(path, v);
-		}
-		if (spec.rules !== void 0) {
-			if (rules !== void 0) overrides.add("rules");
-			rules = spec.rules;
-		}
-		for (const [name, server] of Object.entries(spec.mcp ?? {})) {
-			if (seen.mcp.has(name)) overrides.add(`mcp.${name}`);
-			seen.mcp.add(name);
-			mcp.set(name, server);
-		}
-		for (const step of spec.setup ?? []) {
-			const s = typeof step === "string" ? { run: step } : step;
-			setup.push({
-				run: s.run,
-				timeoutMs: parseDuration(s.timeout ?? DEFAULT_SETUP_TIMEOUT),
-				...s.cwd ? { cwd: s.cwd } : {}
-			});
-		}
-		const layerSkills = /* @__PURE__ */ new Set();
-		for (const source of spec.skills ?? []) {
-			const found = await resolveSkills(root, source);
-			for (const loaded of found.skills) {
-				const name = loaded.skill.name;
-				if (skills.has(name) && !layerSkills.has(name)) overrides.add(`skills.${name}`);
-				layerSkills.add(name);
-				skills.delete(name);
-				skills.set(name, {
-					...loaded,
-					placement: source.placement,
-					source: found.source,
-					commit: found.commit
-				});
-			}
-		}
-	}
-	const secrets = {
-		names: [],
-		checks: [],
-		unset: [],
-		brokered: []
-	};
-	const vars = {};
-	const checkVars = {};
-	for (const [name, value] of Object.entries(env)) {
-		if (!isSecret(value)) {
-			vars[name] = value;
-			continue;
-		}
-		const resolved = hostValue(name, value, envWhere, secrets);
-		if (resolved === void 0) continue;
-		if (value.to === "checks") checkVars[name] = resolved;
-		else vars[name] = resolved;
-	}
-	const secretOf = (value, key, hosts) => {
-		if (typeof value === "string") return value;
-		if (isSecretTemplate(value)) return template(value, envWhere, secrets, hosts);
-		return hostValue(key, value, envWhere, secrets, value.hosts ?? hosts);
-	};
-	const resolvedMcp = {};
-	for (const [name, s] of mcp) if (s.transport === "stdio") {
-		const e = {};
-		for (const [k, v] of Object.entries(s.env)) {
-			const r = secretOf(v, k);
-			if (r !== void 0) e[k] = r;
-		}
-		resolvedMcp[name] = {
-			transport: "stdio",
-			command: s.command,
-			args: s.args,
-			env: e
-		};
-	} else {
-		const h = {};
-		const hosts = mcpHosts(s.url);
-		for (const [k, v] of Object.entries(s.headers)) {
-			const r = secretOf(v, k, hosts);
-			if (r !== void 0) h[k] = r;
-		}
-		resolvedMcp[name] = {
-			transport: s.transport,
-			url: s.url,
-			headers: h
-		};
-	}
-	const fileList = [...files].map(([path, v]) => ({
-		path,
-		content: isHostFile(v) ? readHostFile(v, envWhere) : v,
-		...isHostFile(v) && statSync(v.path).mode & 64 ? { executable: true } : {}
-	}));
-	const rulesContent = rules === void 0 ? void 0 : isHostFile(rules) ? Buffer.from(readHostFile(rules, envWhere)).toString("utf8") : rules;
-	const skillList = [...skills.values()];
-	const skillRecords = skillList.map(({ skill, placement, source, commit, excluded }) => ({
-		name: skill.name,
-		source,
-		commit,
-		sha256: skillHash(skill),
-		placement,
-		excluded
-	}));
-	const fileRecords = fileList.map((f) => ({
-		path: f.path,
-		sha256: sha256(f.content)
-	}));
-	const executable = fileList.flatMap((f) => f.executable ? [f.path] : []);
-	const rulesRecord = rulesContent === void 0 ? void 0 : {
-		path: rulesFile,
-		sha256: sha256(rulesContent)
-	};
-	if (rulesContent !== void 0) fileList.push({
-		path: rulesFile,
-		content: rulesContent
-	});
-	const secretNames = [.../* @__PURE__ */ new Set([...secrets.names, ...secrets.checks])].sort();
-	const brokered = secrets.brokered.map((b) => JSON.stringify([
-		b.name,
-		b.hosts,
-		b.in,
-		b.phase
-	])).sort();
-	const brokeredNames = [...new Set(secrets.brokered.map((b) => b.name))].sort();
-	const varNames = Object.keys(vars).filter((n) => !secrets.names.includes(n)).sort();
-	const literalVars = Object.fromEntries(varNames.map((n) => [n, vars[n]]));
-	const mcpShape = Object.fromEntries(Object.entries(resolvedMcp).map(([name, s]) => s.transport === "stdio" ? [name, {
-		command: s.command,
-		args: s.args,
-		env: Object.keys(s.env).sort()
-	}] : [name, {
-		transport: s.transport,
-		url: s.url,
-		headers: Object.keys(s.headers).sort()
-	}]));
-	const tree = workspace && prepared(workspace);
-	if (workspace && !tree) throw new InfraError(`The workspace git(${JSON.stringify(workspaceLabel(workspace))}) for ${envWhere} wasn't prepared before the run started`);
-	const workspaceRecord = workspace && tree ? {
-		source: isAbsolute(workspace.url) ? relative(root, workspace.url).split(sep).join("/") || "." : workspace.repo,
-		ref: workspace.ref ?? null,
-		path: workspace.path ?? null,
-		commit: tree.commit,
-		tree: tree.tree,
-		...workspace.init ? { init: true } : {}
-	} : void 0;
-	const digest = `sha256:${sha256(JSON.stringify({
-		setup,
-		skills: skillRecords.map((s) => [
-			s.name,
-			s.sha256,
-			s.placement
-		]),
-		mcp: mcpShape,
-		files: fileRecords,
-		...executable.length ? { executable } : {},
-		rules: rulesRecord?.sha256,
-		vars: literalVars,
-		secrets: secretNames,
-		checks: [...secrets.checks].sort(),
-		unset: [...secrets.unset].sort(),
-		brokered,
-		...egress === "allow-all" ? {} : { egress: typeof egress === "string" ? egress : [...egress.allow].sort() },
-		...workspaceRecord ? { workspace: workspaceRecord.init ? [workspaceRecord.tree, "init"] : workspaceRecord.tree } : {}
-	}))}`;
-	return {
-		record: {
-			name: environment.name,
-			parent: environment.parent,
-			overrides: [...overrides],
-			digest,
-			setup: setup.map(stepCommand),
-			skills: skillRecords,
-			mcp: Object.keys(resolvedMcp).sort(),
-			files: rulesRecord ? [...fileRecords, rulesRecord] : fileRecords,
-			vars: varNames,
-			secrets: secretNames,
-			brokered: brokeredNames,
-			unset: [...secrets.unset].sort(),
-			egress,
-			...workspaceRecord ? { workspace: workspaceRecord } : {}
-		},
-		setup,
-		skills: skillList.filter((s) => s.placement === "harness").map((s) => s.skill),
-		workspaceSkills: skillList.filter((s) => s.placement === "workspace").map((s) => s.skill),
-		mcp: resolvedMcp,
-		files: fileList,
-		vars,
-		checkVars,
-		substitutions: secrets.brokered,
-		...workspace && tree ? { workspace: {
-			tar: tree.tar,
-			label: workspaceLabel(workspace),
-			commit: tree.commit,
-			...workspace.init ? { init: true } : {}
-		} } : {}
-	};
-}
-/** A skill as a `SKILL.md` file plus its other files, for writing into a directory. */
-function skillFiles(skill) {
-	return [{
-		path: "SKILL.md",
-		content: `${`---\nname: ${skill.name}\ndescription: ${JSON.stringify(skill.description)}\n---\n`}${skill.content}`
-	}, ...skill.files];
-}
-//#endregion
 //#region src/harness/fake.ts
 const lineCount = (text) => text ? text.split("\n").length - (text.endsWith("\n") ? 1 : 0) : 0;
 /**
 * Writes canned files and returns a canned message on every turn, after running its `script`'s
 * real sandbox actions. Harness-placed skills are written under `~/` where its layout's adapter
-* puts them (`~/.agents/skills` by default, as Cursor's does).
+* puts them (`~/.agents/skills` by default, as Cursor's does). Plugins are already copied under
+* `~/.reeval/plugins/`; where its layout takes plugin items flat, their skills arrive in `skills`.
+* Where it takes them namespaced, it writes its layout's plugin files (Claude Code's settings)
+* and leaves the plugins' MCP servers to the plugins, as that agent does.
 */
 const createFakeHarness = (descriptor) => {
 	let starts = 0;
-	return { async start(sandbox, _signal, { skills, workspaceSkills, mcp }) {
+	return { async start(sandbox, _signal, { skills, workspaceSkills, mcp: all, plugins }) {
 		if (descriptor.failWith) throw new InfraError(descriptor.failWith);
 		const hangs = descriptor.startHangs;
 		if (hangs === true || starts++ < (hangs ?? 0)) return new Promise(() => {});
-		const dir = `~/${layoutOf(descriptor).harnessSkillDir}`;
+		const layout = layoutOf(descriptor);
+		const mcp = agentMcp(layout, all, plugins);
+		for (const path of await writePluginFiles(sandbox, layout, plugins)) debugLog("env", `plugin settings → ${path} by the fake agent`);
+		const dir = `~/${layout.harnessSkillDir}`;
 		for (const skill of skills) {
 			for (const f of skillFiles(skill)) await sandbox.writeFile(`${dir}/${skill.name}/${f.path}`, f.content);
 			debugLog("env", `skill ${skill.name} placed at ${dir}/${skill.name}/ by the fake agent`);
 		}
 		const names = [...skills.map((s) => s.name), ...workspaceSkills];
-		const loaded = [names.length ? `skills: ${names.join(", ")}` : "", Object.keys(mcp).length ? `mcp: ${Object.keys(mcp).join(", ")}` : ""].filter(Boolean);
+		const loaded = [
+			names.length ? `skills: ${names.join(", ")}` : "",
+			plugins.length ? `plugins: ${plugins.map((p) => `${p.name} (${p.parts.join(", ")})`).join(", ")}` : "",
+			Object.keys(mcp).length ? `mcp: ${Object.keys(mcp).join(", ")}` : ""
+		].filter(Boolean);
 		let calls = 0;
 		let turns = 0;
 		const skilled = names.length > 0 && descriptor.withSkill;
@@ -879,7 +377,7 @@ async function callMcpTool(sandbox, servers, name, tool, signal) {
 		"  trap '' PIPE",
 		`  printf '%s\\n' ${messages.join(" ")} 2>/dev/null`,
 		"  i=0",
-		`  while [ $i -lt 300 ] && [ ! -f "$d/code" ] && ! grep -Eq '"id": ?2[,}]' "$d/out"; do sleep 0.1; i=$((i + 1)); done`,
+		`  while [ $i -lt 900 ] && [ ! -f "$d/code" ] && ! grep -Eq '"id": ?2[,}]' "$d/out"; do sleep 0.1; i=$((i + 1)); done`,
 		`} | { ${command} > "$d/out" 2> "$d/err"; echo $? > "$d/code"; }`,
 		"code=$(cat \"$d/code\")",
 		"cat \"$d/out\"; cat \"$d/err\" >&2; rm -rf \"$d\"; exit $code"
@@ -912,7 +410,7 @@ async function callMcpTool(sandbox, servers, name, tool, signal) {
 //#region src/harness/index.ts
 async function createHarness(descriptor) {
 	if (descriptor.kind === "fake") return createFakeHarness(descriptor);
-	const { createAgentHarness } = await import("./agent-DpE80WPz.js");
+	const { createAgentHarness } = await import("./agent-CatUEo5h.js");
 	return createAgentHarness(descriptor);
 }
 /** Where each harness's agent looks for repo skills, relative to the workspace. */
@@ -926,7 +424,10 @@ const workspaceSkillDir = (descriptor) => layoutOf(descriptor).workspaceSkillDir
 */
 async function prepareEnvironment(a, root, runId, where, signal) {
 	const { spec, record } = a;
-	const env = await resolveEnvironment(spec.environment, spec.env, root, where, layoutOf(spec.harness).rulesFile, spec.egress.policy, (w) => preparedWorkspace(root, runId, w));
+	const env = await resolveEnvironment(spec.environment, spec.env, root, where, layoutOf(spec.harness).rulesFile, spec.egress.policy, (w) => preparedWorkspace(root, runId, w), {
+		harness: spec.harness,
+		allowed: allowedHosts(spec.egress)
+	});
 	a.env = env;
 	record.environment = env.record;
 	const { secrets, brokered } = env.record;
@@ -939,13 +440,29 @@ async function prepareEnvironment(a, root, runId, where, signal) {
 	if (debug) traceEnvironment(debug, spec, env);
 	record.image = null;
 	if (spec.sandbox.kind === "docker") {
-		const { preparedFor } = await import("./preflight-DlQvbySb.js");
-		const { attemptImage, dockerProvider } = await import("./providers-B9yTdIqF.js");
+		const { preparedFor } = await import("./preflight-B6pY89bF.js");
+		const { attemptImage, dockerProvider, preparedImage } = await import("./providers-CXN2RFz-.js");
 		signal.throwIfAborted();
-		const prepared = preparedFor(root, runId, dockerProvider({ engine: spec.sandbox.engine ?? "docker" }), spec.sandbox, spec.harness);
+		const provider = dockerProvider({ engine: spec.sandbox.engine ?? "docker" });
+		const builds = builtPlugins(spec.environment.layers);
+		const prepared = preparedFor(root, runId, provider, spec.sandbox, spec.harness, builds);
 		if (!prepared) throw new InfraError(`The sandbox image for ${where} wasn't prepared before the run started`);
 		record.image = attemptImage(prepared);
 		a.image = record.image.ref;
+		const built = preparedImage(prepared).plugins ?? [];
+		for (const [i, plugin] of env.plugins.entries()) {
+			if (plugin.declared.build === void 0) continue;
+			const found = built.find((b) => b.id === pluginBuildId(plugin.declared));
+			if (!found) throw new InfraError(`The ${plugin.name} plugin's build for ${where} wasn't prepared before the run started`);
+			if (found.commit !== plugin.commit) throw new InfraError(`The ${plugin.name} plugin's ref moved during the run: it was built at ${found.commit?.slice(0, 12)} and is now ${plugin.commit?.slice(0, 12)}. Pin ref to a commit or tag.`);
+			plugin.built = {
+				dir: found.dir,
+				tag: found.tag
+			};
+			const pluginRecord = env.record.plugins?.[i];
+			if (pluginRecord) pluginRecord.build = found.tag;
+			debugLog("image", `plugin ${plugin.name} built in ${found.tag}`);
+		}
 		const { ref, id, base, install, agentCli } = record.image;
 		debugLog("image", `ready ${ref} (${id.replace(/^sha256:/, "").slice(0, 12)}) · prepared before the run${ref !== base ? ` · on ${base}` : ""}${agentCli ? ` · agent CLI ${agentCli}` : ""}${install.length ? ` · install: ${install.join(" && ")}` : ""}`);
 	} else debugLog("image", `none: the ${spec.sandbox.kind} sandbox runs on the host`);
@@ -1240,7 +757,7 @@ async function createSandbox(descriptor, options) {
 		switch (descriptor.kind) {
 			case "fake": return await createFakeSandbox(descriptor, options.env);
 			case "docker": {
-				const { createDockerSandbox } = await import("./docker-DNmMPOBb.js");
+				const { createDockerSandbox } = await import("./docker-DC69dKxB.js");
 				return await createDockerSandbox(descriptor, options);
 			}
 		}
@@ -1319,11 +836,12 @@ async function recordOom(a, sandbox) {
 }
 /**
 * The attempt's egress policy and, when its sandbox records it, what it contacted and was refused.
-* Refused hosts the harness always tries are `expectedBlocked`, summarised in one `-v` line.
+* Refused hosts the harness always tries (in a session like this one) are `expectedBlocked`,
+* summarised in one `-v` line.
 */
 function recordEgress(a, sandbox) {
 	const traffic = sandbox?.traffic?.();
-	const expected = expectedBlockedFor(a.spec.harness);
+	const expected = expectedBlockedFor(a.spec.harness, (a.env?.plugins.length ?? 0) > 0);
 	const refused = traffic?.blocked ?? [];
 	const isExpected = (h) => !!expected?.hosts.includes(h.host);
 	const expectedBlocked = refused.filter(isExpected);
@@ -1374,6 +892,118 @@ function turnErrors(transcripts) {
 	});
 }
 //#endregion
+//#region src/harness/unpack.ts
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const FRONTMATTER = /^\uFEFF?---\r?\n/;
+const FRONTMATTER_BLOCK = /^\uFEFF?---\r?\n(?:---|([\s\S]*?)\r?\n---)[ \t]*(?:\r?\n|$)/;
+const RULE = /^rules\/([^/]+)\.mdc?$/;
+const MARKDOWN = (dir) => new RegExp(`^${dir}/([^/]+)\\.md$`);
+/** A subagent's or command's Markdown with its frontmatter rewritten by `format`. */
+function reformatted(text, part, what, format) {
+	const block = FRONTMATTER_BLOCK.exec(text);
+	let front = {};
+	if (block) {
+		try {
+			front = parse(block[1] ?? "") ?? {};
+		} catch {
+			throw new InfraError(`${what}'s frontmatter isn't valid YAML`);
+		}
+		if (!isRecord(front)) throw new InfraError(`${what}'s frontmatter isn't a YAML mapping`);
+	}
+	const body = block ? text.slice(block[0].length).replace(/^\r?\n/, "") : text.replace(/^\uFEFF/, "");
+	const out = format(part, front);
+	const yaml = Object.keys(out).length ? stringify(out, { lineWidth: 0 }) : "";
+	return yaml ? `---\n${yaml}---\n\n${body}` : body;
+}
+/** Cursor's handlers for one plugin's `hooks/hooks.json`, by Cursor's event name. */
+function hookHandlers(plugin, text, hooks) {
+	const what = `the ${plugin.name} plugin's hooks/hooks.json`;
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch {
+		throw new InfraError(`${what} isn't valid JSON`);
+	}
+	const events = isRecord(raw) && isRecord(raw.hooks) ? raw.hooks : {};
+	const out = {};
+	for (const [event, groups] of Object.entries(events)) {
+		const named = hooks.events[event];
+		if (!named) throw new InfraError(`${what} has ${event} hooks, which the agent has no event for`);
+		for (const group of Array.isArray(groups) ? groups.filter(isRecord) : []) {
+			const matcher = hooks.matcher(event, typeof group.matcher === "string" ? group.matcher : void 0);
+			if (matcher === null) continue;
+			for (const h of Array.isArray(group.hooks) ? group.hooks.filter(isRecord) : []) {
+				if ((h.type ?? "command") !== "command" || typeof h.command !== "string") throw new InfraError(`${what} has a ${event} hook that isn't a command`);
+				out[named] ??= [];
+				out[named].push({
+					type: "command",
+					command: h.command.replaceAll(PLUGIN_ROOT, plugin.dir),
+					...typeof h.timeout === "number" ? { timeout: h.timeout } : {},
+					...matcher === void 0 ? {} : { matcher }
+				});
+			}
+		}
+	}
+	return out;
+}
+/**
+* The workspace files that give a flat agent the plugins' rules, subagents, commands and hooks,
+* by path relative to the workspace: each part `unpack` names and the plugin keeps, with
+* `${CLAUDE_PLUGIN_ROOT}` filled in with the plugin's `dir`. The hooks of every plugin go in one
+* file, after the handlers of `hooksFile` (the workspace's own, or null).
+*/
+function unpackPlugins(plugins, unpack, hooksFile = null) {
+	const out = [];
+	let hooks;
+	for (const plugin of plugins) {
+		const keeps = (part, dir) => dir !== void 0 && plugin.parts.includes(part);
+		for (const f of plugin.files) {
+			const text = () => Buffer.from(f.content).toString("utf8").replaceAll(PLUGIN_ROOT, plugin.dir);
+			const rule = RULE.exec(f.path);
+			if (rule && keeps("rules", unpack.rules)) {
+				const body = text();
+				out.push({
+					path: `${unpack.rules}/${plugin.name}-${rule[1]}.mdc`,
+					content: FRONTMATTER.test(body) ? body : `---\nalwaysApply: true\n---\n\n${body}`
+				});
+				continue;
+			}
+			for (const [part, dir] of [["agents", unpack.agents], ["commands", unpack.commands]]) {
+				const name = MARKDOWN(part).exec(f.path)?.[1];
+				if (!name || !keeps(part, dir)) continue;
+				const what = `the ${plugin.name} plugin's ${part === "agents" ? "subagent" : "command"} ${f.path}`;
+				out.push({
+					path: `${dir}/${name}.md`,
+					content: unpack.frontmatter ? reformatted(text(), part, what, unpack.frontmatter) : text()
+				});
+			}
+			if (f.path === "hooks/hooks.json" && unpack.hooks && plugin.parts.includes("hooks")) {
+				if (!hooks) {
+					let own = {};
+					try {
+						own = hooksFile === null ? {} : JSON.parse(hooksFile);
+					} catch {
+						throw new InfraError(`The workspace's ${unpack.hooks.file} isn't valid JSON, so reeval can't add the plugins' hooks to it`);
+					}
+					hooks = isRecord(own) ? {
+						version: 1,
+						...own
+					} : { version: 1 };
+				}
+				const merged = isRecord(hooks.hooks) ? { ...hooks.hooks } : {};
+				const raw = Buffer.from(f.content).toString("utf8");
+				for (const [event, handlers] of Object.entries(hookHandlers(plugin, raw, unpack.hooks))) merged[event] = [...Array.isArray(merged[event]) ? merged[event] : [], ...handlers];
+				hooks.hooks = merged;
+			}
+		}
+	}
+	if (hooks && unpack.hooks) out.push({
+		path: unpack.hooks.file,
+		content: `${JSON.stringify(hooks, null, 2)}\n`
+	});
+	return out;
+}
+//#endregion
 //#region src/sandbox/phases.ts
 const strip = ({ phase: _, ...sub }) => sub;
 /**
@@ -1403,6 +1033,70 @@ function brokerPhases(box, subs) {
 	};
 }
 //#endregion
+//#region src/attempt/mcp-startup.ts
+/**
+* The timer and its log beside the workspace: `/reeval/bin/mcp-timer.cjs` in Docker. `.cjs`, since
+* a sandbox's directories may be in a `"type": "module"` package.
+*/
+const TIMER = "../bin/mcp-timer.cjs";
+const LOG = "../mcp-startup.jsonl";
+/** The attempt's error when an MCP server never answered `initialize`. */
+const mcpTimeoutMessage = (server) => `MCP server ${server} didn't answer initialize within 60s`;
+/**
+* Puts the timer in the sandbox and runs every stdio server through it, so whichever process
+* starts a server (the agent's CLI, once a session or once a turn, or the fake agent) logs when it
+* answered. Returns the servers unchanged, and no log, when none is stdio, or with `untimed`'s
+* reason when the sandbox has no `node` (an `image` used as is), rather than break them.
+*/
+async function timeMcpServers(box, servers, signal) {
+	if (!Object.values(servers).some((s) => s.transport === "stdio")) return { servers };
+	const found = await box.exec("command -v node", { signal });
+	const node = found.exitCode === 0 ? found.stdout.trim().split("\n")[0] : "";
+	if (!node) return {
+		servers,
+		untimed: "the sandbox has no node to run the timer"
+	};
+	await box.writeFile(TIMER, await readFile(MCP_TIMER, "utf8"));
+	await box.writeFile(LOG, "");
+	const timer = `${box.workdir.replace(/[\\/][^\\/]*$/, "")}/bin/mcp-timer.cjs`;
+	const wrapped = Object.fromEntries(Object.entries(servers).map(([name, s]) => [name, s.transport === "stdio" ? {
+		...s,
+		command: node,
+		args: [
+			timer,
+			"--name",
+			name,
+			"--",
+			s.command,
+			...s.args
+		]
+	} : s]));
+	let seen = 0;
+	return {
+		servers: wrapped,
+		log: { async read() {
+			const complete = (await box.readFile(LOG).catch(() => null) ?? "").split("\n").slice(0, -1);
+			const fresh = complete.slice(seen);
+			seen = complete.length;
+			return fresh.flatMap((line) => {
+				try {
+					const entry = JSON.parse(line);
+					return typeof entry.server === "string" ? [entry] : [];
+				} catch {
+					return [];
+				}
+			});
+		} }
+	};
+}
+/** Each server start in `entries`, with how long it took to answer `initialize`; null when it didn't. */
+const mcpStartupOf = (entries) => entries.map((e) => ({
+	server: e.server,
+	ms: e.initializedAt === void 0 ? null : Math.max(0, e.initializedAt - e.spawnedAt)
+}));
+/** The first server in `entries` that never answered `initialize`. */
+const timedOutServer = (entries) => entries.find((e) => e.timeout)?.server;
+//#endregion
 //#region src/attempt/state.ts
 /** Extra time an attempt gets, outside its eval timeout, when its image may need building. */
 const SETUP_BUDGET_MS = 12e5;
@@ -1563,6 +1257,131 @@ async function copyWorkspace(box, workspace, signal) {
 	debugLog("env", `workspace ${workspace.label} at ${workspace.commit.slice(0, 12)} (${tar.byteLength} bytes of tar${workspace.init ? ", with a .git" : ""}) in ${formatDuration(performance.now() - start)}`);
 }
 /**
+* A built plugin's directory, copied from where its layer left it in the image, less the parts
+* `only` leaves out, with the manifest as reeval read it.
+*/
+async function copyBuiltPlugin(a, box, plugin, dir) {
+	const dropped = droppedPaths(plugin.parts).map((p) => shellQuote(`${dir}/${p}`));
+	const r = await box.exec(`mkdir -p ${shellQuote(dir)} && cp -a ${shellQuote(plugin.built.dir)}/. ${shellQuote(dir)}/${dropped.length ? ` && rm -rf ${dropped.join(" ")}` : ""}`, { signal: a.signal });
+	if (r.exitCode !== 0) throw new InfraError(`Couldn't copy the ${plugin.name} plugin's build from ${plugin.built.tag}: ${tailOf(r.stderr || r.stdout)}`);
+	const manifest = plugin.files.find((f) => f.path === PLUGIN_MANIFEST);
+	if (manifest) await box.writeFile(`${dir}/${PLUGIN_MANIFEST}`, manifest.content);
+}
+/**
+* Copies each plugin to `PLUGIN_DIR/<name>/` before the workspace snapshot (a built one from its
+* layer in the image, any other from the host), and points its MCP servers' `${CLAUDE_PLUGIN_ROOT}`
+* at that directory, for the adapter to load from there.
+*/
+async function copyPlugins(a, box, env) {
+	const out = [];
+	for (const plugin of env.plugins) {
+		const at = `${PLUGIN_DIR}/${plugin.name}`;
+		const dir = `${box.home}/${at.slice(2)}`;
+		const { built } = plugin;
+		if (built) await copyBuiltPlugin(a, box, {
+			...plugin,
+			built
+		}, dir);
+		else for (const f of plugin.files) await box.writeFile(`${at}/${f.path}`, f.content);
+		const executable = built ? [] : plugin.files.flatMap((f) => f.executable ? [`${dir}/${f.path}`] : []);
+		if (executable.length) {
+			const r = await box.exec(`chmod +x ${executable.map(shellQuote).join(" ")}`, { signal: a.signal });
+			if (r.exitCode !== 0) throw new InfraError(`Couldn't make the ${plugin.name} plugin's ${executable.length} executable files executable: ${tailOf(r.stderr || r.stdout)}`);
+		}
+		const root = (v) => v.replaceAll(PLUGIN_ROOT, dir);
+		for (const key of plugin.servers) {
+			const server = env.mcp[key];
+			if (server?.transport !== "stdio") continue;
+			env.mcp[key] = {
+				...server,
+				command: root(server.command),
+				args: server.args.map(root),
+				env: {
+					...Object.fromEntries(Object.entries(server.env).map(([k, v]) => [k, root(v)])),
+					[PLUGIN_ROOT_VAR]: dir
+				}
+			};
+		}
+		out.push({
+			name: plugin.name,
+			dir,
+			parts: plugin.parts,
+			servers: plugin.servers
+		});
+		debugLog("env", `plugin ${plugin.name} → ${at}/ (${built ? `built in ${built.tag}` : `${plugin.files.length} files`}; ${plugin.parts.join(", ")})`);
+	}
+	return out;
+}
+/**
+* The parts a flat agent has unpacked, as a built plugin's copy in the sandbox has them: its
+* build's output, which `files` (the source before the build) may not match. Builds run on Docker
+* only, so the sandbox has `find`.
+*/
+async function unpackedFromCopy(a, box, dir) {
+	const r = await box.exec(`cd ${shellQuote(dir)} && find rules agents commands hooks -maxdepth 1 -type f 2>/dev/null; true`, { signal: a.signal });
+	const out = [];
+	for (const path of r.stdout.split("\n").filter(Boolean)) {
+		const content = await box.readFile(`${dir}/${path}`);
+		if (content !== null) out.push({
+			path,
+			content: Buffer.from(content)
+		});
+	}
+	return out;
+}
+/**
+* Unpacks the plugins' rules, subagents, commands and hooks into the workspace where a flat agent
+* reads them, before the snapshot, so the diff leaves them out. A file the workspace already has
+* is an infra error, except the hooks file, whose own handlers the plugins' join.
+*/
+async function writeUnpackedPlugins(a, box, env, plugins, unpack) {
+	const placed = [];
+	for (const p of plugins) {
+		const resolved = env.plugins.find((r) => r.name === p.name);
+		const files = resolved?.built ? await unpackedFromCopy(a, box, p.dir) : resolved?.files ?? [];
+		placed.push({
+			...p,
+			files
+		});
+	}
+	const files = unpackPlugins(placed, unpack, unpack.hooks ? await box.readFile(unpack.hooks.file) : null);
+	const fresh = files.filter((f) => f.path !== unpack.hooks?.file);
+	if (fresh.length) {
+		const taken = (await box.exec(`for p in ${fresh.map((f) => shellQuote(f.path)).join(" ")}; do { [ -e "$p" ] || [ -L "$p" ]; } && echo "$p"; done; true`, { signal: a.signal })).stdout.trim().split("\n").filter(Boolean);
+		if (taken.length) throw new InfraError(`The workspace already has ${taken.join(", ")}, which a plugin would replace: rename the plugin's file, or leave the plugin out of this cell`);
+	}
+	for (const f of files) {
+		await box.writeFile(f.path, f.content);
+		debugLog("env", `plugin part → ${f.path} (unpacked for the agent)`);
+	}
+}
+/**
+* For an agent that starts a plugin's MCP servers from the plugin itself: rewrites each placed
+* plugin's `.mcp.json` to the servers as reeval resolved them, through the MCP timer, so they're
+* timed like the environment's. A manifest that declares `mcpServers` is pointed at that file.
+* Only namespaced layouts, which refuse a plugin server reading a host secret, so no secret value
+* lands in the file.
+*/
+async function writePluginMcp(box, env, plugins, servers) {
+	for (const placed of plugins) {
+		if (!placed.servers.length) continue;
+		const own = Object.fromEntries(placed.servers.flatMap((key) => {
+			const s = servers[key];
+			return s ? [[key.slice(placed.name.length + 1), s]] : [];
+		}));
+		const at = `${PLUGIN_DIR}/${placed.name}`;
+		const json = (v) => `${JSON.stringify(v, null, 2)}\n`;
+		await box.writeFile(`${at}/.mcp.json`, json({ mcpServers: claudeMcpServers(own) }));
+		const manifest = env.plugins.find((p) => p.name === placed.name)?.files.find((f) => f.path === PLUGIN_MANIFEST);
+		const parsed = manifest ? JSON.parse(Buffer.from(manifest.content).toString("utf8")) : {};
+		if (parsed.mcpServers !== void 0) await box.writeFile(`${at}/${PLUGIN_MANIFEST}`, json({
+			...parsed,
+			mcpServers: "./.mcp.json"
+		}));
+		debugLog("env", `plugin ${placed.name}'s MCP servers → ${at}/.mcp.json, through the timer`);
+	}
+}
+/**
 * Starts the harness session within its `startTimeout`. A start that doesn't become ready in time
 * is aborted (and closed, should it finish later) and started once more: a stuck bootstrap is
 * usually transient, and nothing has run yet, so the retry can't change what the attempt
@@ -1594,7 +1413,7 @@ async function startHarness(a, harness, box, options) {
 }
 /**
 * Starts the sandbox (with the brokered secrets its gateway swaps in), writes the
-* environment's files and workspace skills, runs its setup steps, snapshots the workspace for
+* environment's files, workspace skills and plugins, runs its setup steps, snapshots the workspace for
 * the diff, and starts the harness session with the harness-placed skills and MCP servers.
 */
 async function startSession(a, runId) {
@@ -1608,7 +1427,7 @@ async function startSession(a, runId) {
 		env: env.vars,
 		image: a.image,
 		brokering: brokeringFor(spec.harness),
-		expectedBlocked: expectedBlockedFor(spec.harness)?.hosts,
+		expectedBlocked: expectedBlockedFor(spec.harness, env.plugins.length > 0)?.hosts,
 		substitutions: env.substitutions,
 		egress: spec.egress
 	});
@@ -1640,19 +1459,28 @@ async function startSession(a, runId) {
 		for (const f of files) await box.writeFile(`${skillDir}/${skill.name}/${f.path}`, f.content);
 		debugLog("env", `skill ${skill.name} → ${skillDir}/${skill.name}/ (${files.length} files, workspace)`);
 	}
+	const plugins = await copyPlugins(a, box, env);
 	const layout = layoutOf(spec.harness);
+	if (layout.pluginUnpack && plugins.length) await writeUnpackedPlugins(a, box, env, plugins, layout.pluginUnpack);
 	for (const skill of env.skills) debugLog("env", `skill ${skill.name} → the harness adapter places it (~/${layout.harnessSkillDir}/${skill.name}/ for ${spec.harness.kind === "fake" ? `the fake ${spec.harness.layout ?? "cursor"} layout` : spec.harness.kind})`);
 	for (const [name, server] of Object.entries(env.mcp)) debugLog("env", `mcp ${name} (${server.transport}${server.transport === "stdio" ? `: ${server.command} ${server.args.join(" ")}` : `: ${server.url}`}) → the harness adapter writes its MCP config`);
 	await runSetup(a, box, env);
 	await snapshot(box, a.signal);
 	debugLog("env", "workspace snapshot taken: the diff starts here");
+	const timed = await timeMcpServers(box, env.mcp, a.signal);
+	if (timed.log) {
+		a.mcpStartup = timed.log;
+		debugLog("env", "stdio MCP servers start through reeval's MCP timer");
+	} else if (timed.untimed) debugLog("env", `stdio MCP servers start untimed: ${timed.untimed}`);
+	if (layout.pluginPlacement === "namespaced") await writePluginMcp(box, env, plugins, timed.servers);
 	const harness = await createHarness(spec.harness);
 	const harnessStart = performance.now();
 	debugLog("harness", `starting ${harnessId(spec.harness)}: bootstrap and session`);
 	const session = await startHarness(a, harness, box, {
 		skills: env.skills,
 		workspaceSkills: env.workspaceSkills.map((s) => s.name),
-		mcp: env.mcp
+		mcp: timed.servers,
+		plugins
 	});
 	debugLog("harness", `${harnessId(spec.harness)} session ready in ${formatDuration(performance.now() - harnessStart)}`);
 	a.session = session;
@@ -1709,6 +1537,46 @@ function cutOff(signal, startedAt, grace = TURN_STOP_GRACE_MS) {
 		cancel
 	};
 }
+/** How often a turn reads the MCP timer's log for a server that never answered `initialize`. */
+const MCP_POLL_MS = 2e3;
+/**
+* Reads the MCP timer's log through a turn. `signal` aborts as soon as a server has timed out, so
+* an agent stuck waiting for it stops; `end` takes the turn's last entries.
+*/
+function watchMcpStartup(log) {
+	const stop = new AbortController();
+	const entries = [];
+	let timedOut;
+	let at = 0;
+	let reading;
+	const poll = async () => {
+		entries.push(...await log.read());
+		timedOut ??= timedOutServer(entries);
+		if (timedOut && !stop.signal.aborted) {
+			at = Date.now();
+			stop.abort(new InfraError(mcpTimeoutMessage(timedOut)));
+		}
+	};
+	const timer = setInterval(() => {
+		reading ??= poll().finally(() => {
+			reading = void 0;
+		});
+	}, MCP_POLL_MS);
+	return {
+		signal: stop.signal,
+		close: () => clearInterval(timer),
+		async end() {
+			clearInterval(timer);
+			await reading;
+			await poll();
+			return {
+				entries,
+				timedOut,
+				at: at || Date.now()
+			};
+		}
+	};
+}
 /**
 * One turn. Sends the prompt to the started session, records the turn as it goes (an
 * errored entry first, so a turn that throws is still in the record), takes the agent's context
@@ -1739,11 +1607,48 @@ function turnSender(a, takeContext, checks) {
 			turn: turnNumber,
 			prompt
 		}, `turn ${turnNumber} prompt`);
-		const { cutoff, cancel } = cutOff(a.signal, entry.startedAt);
+		const watch = a.mcpStartup && watchMcpStartup(a.mcpStartup);
+		const signal = watch ? AbortSignal.any([a.signal, watch.signal]) : a.signal;
+		const { cutoff, cancel } = cutOff(signal, entry.startedAt);
 		const sendStarted = Date.now();
-		const { raw, ...result } = await a.timed("agentMs", () => Promise.race([agent.send(prompt, a.signal), cutoff])).finally(cancel);
+		const sending = agent.send(prompt, signal).catch((error) => {
+			if (!watch?.signal.aborted || a.signal.aborted) throw error;
+			return {
+				text: "",
+				status: "aborted",
+				transcript: [],
+				usage: null,
+				model: null,
+				unreported: [],
+				startedAt: entry.startedAt,
+				durationMs: Date.now() - sendStarted
+			};
+		});
+		const { raw, ...sent } = await a.timed("agentMs", () => Promise.race([sending, cutoff])).catch(async (error) => {
+			if (watch) entry.mcpStartup = mcpStartupOf((await watch.end()).entries);
+			throw error;
+		}).finally(() => {
+			cancel();
+			watch?.close();
+		});
 		const sendWallMs = Date.now() - sendStarted;
-		Object.assign(entry, result, raw ? { raw } : {}, { durationMs: Math.max(result.durationMs, sendWallMs) });
+		const startup = await watch?.end();
+		const timedOut = startup?.timedOut && mcpTimeoutMessage(startup.timedOut);
+		const seenAt = startup?.at ?? Date.now();
+		const result = timedOut ? {
+			...sent,
+			status: "error",
+			transcript: [...sent.transcript, {
+				type: "error",
+				message: timedOut,
+				ts: new Date(seenAt).toISOString(),
+				atMs: Math.max(0, seenAt - Date.parse(sent.startedAt))
+			}].sort((x, y) => x.atMs - y.atMs)
+		} : sent;
+		Object.assign(entry, result, raw ? { raw } : {}, {
+			durationMs: Math.max(result.durationMs, sendWallMs),
+			...startup ? { mcpStartup: mcpStartupOf(startup.entries) } : {}
+		});
 		for (const event of result.transcript) debugTrace("harness", "transcript", {
 			turn: turnNumber,
 			...event
@@ -1762,6 +1667,12 @@ function turnSender(a, takeContext, checks) {
 		});
 		const plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
 		debugLog("harness", `turn ${turnNumber} ${result.status} in ${formatDuration(result.durationMs)} · ${plural(count("tool", "web-search", "web-fetch"), "tool call")} · ${plural(count("file-edit"), "file edit")}${failure && "message" in failure ? ` · error: ${clip(String(failure.message), 200)}` : ""}${result.model ? ` · model ${result.model}` : ""}`);
+		for (const s of entry.mcpStartup ?? []) debugLog("harness", `turn ${turnNumber} mcp ${s.server} ${s.ms === null ? "didn't answer initialize" : `answered initialize in ${formatDuration(s.ms)}`}`);
+		if (timedOut) {
+			const error = new InfraError(timedOut);
+			a.startFailure ??= { error };
+			throw error;
+		}
 		a.signal.throwIfAborted();
 		const diff = await a.timed("diffMs", () => diffSinceSnapshot(box, a.signal));
 		a.record.diff = diff;
@@ -1993,11 +1904,18 @@ function planEval(declaration, ctx) {
 		const [first] = unbrokered(resolved.env, plannedAttempts);
 		if (first) throw new UsageError(unbrokeredError(first, where, ctx.config.file));
 	}
+	const pluginNotes = [];
+	const pluginLabels = /* @__PURE__ */ new Map();
 	for (const planned of plannedAttempts) {
 		const why = unenforceable(planned.egress, planned.sandbox, where);
 		if (why) throw new UsageError(why);
+		const on = `${where} on ${harnessId(planned.harness)}`;
 		const mcp = refusedMcp(planned.harness, planned.environment.layers);
-		if (mcp) throw new UsageError(`${where} on ${harnessId(planned.harness)}: ${mcp}`);
+		if (mcp) throw new UsageError(`${on}: ${mcp}`);
+		const plugins = planPlugins(planned, ctx.config.root);
+		if (plugins.refusal) throw new UsageError(`${on}: ${plugins.refusal}`);
+		for (const note of plugins.notes) if (!pluginNotes.includes(note)) pluginNotes.push(note);
+		if (plugins.labels.length) pluginLabels.set(planned, plugins.labels);
 	}
 	const path = ctx.file ? relativeFile(ctx.config.root, ctx.file) : null;
 	const rankFile = relativeFile(ctx.config.root, ctx.file ?? "");
@@ -2010,6 +1928,7 @@ function planEval(declaration, ctx) {
 		configFile: ctx.config.file,
 		file: path
 	});
+	plan.notes.push(...pluginNotes);
 	const setByOf = (planned) => ({
 		sandbox: sandboxSetBy(planned, resolved, ctx.config.file),
 		harness: harnessBy
@@ -2045,7 +1964,11 @@ function planEval(declaration, ctx) {
 		if (!cells.includes(planned.cell.key)) cells.push(planned.cell.key);
 		const workspace = workspaceOf(planned.environment.layers);
 		const files = filesOf(planned.environment.layers);
-		const setBy = setByOf(planned);
+		const builds = builtPlugins(planned.environment.layers);
+		const setBy = builds.length ? {
+			...setByOf(planned),
+			pluginBuilds: `environment ${planned.environment.name}${path ? ` in ${path}` : ""}`
+		} : setByOf(planned);
 		const id = evalId(rankFile, [...groups, name]);
 		const key = attemptKey(id, planned.cell.key, planned.n);
 		const skip = ctx.completed?.includes(key) ? "already completed in this run" : void 0;
@@ -2066,6 +1989,8 @@ function planEval(declaration, ctx) {
 			egress: planned.egress,
 			...workspace ? { workspace } : {},
 			...files.length ? { files } : {},
+			...pluginLabels.has(planned) ? { plugins: pluginLabels.get(planned) } : {},
+			...builds.length ? { pluginBuilds: builds } : {},
 			plan: skip ? {
 				...plan,
 				skip
@@ -2105,6 +2030,61 @@ function planEval(declaration, ctx) {
 		};
 	});
 }
+/**
+* What the plan can tell of an attempt's plugins before any is fetched: a build outside Docker, a
+* local plugin's content, and the harness's refusal, as a refusal; the commands that fetch a
+* package at start, as notes under `allow-all`; and a label for each plugin. Git and npm plugins
+* are read when the attempt resolves its environment, which refuses them the same way.
+*/
+function planPlugins(planned, root) {
+	const { layers } = planned.environment;
+	const sources = layeredPlugins(layers);
+	if (sources.length === 0) return {
+		notes: [],
+		labels: []
+	};
+	const read = [];
+	const unread = [];
+	const labels = [];
+	for (const source of sources) {
+		const call = pluginCall(source, root);
+		const p = localPlugin(source, root);
+		if (p instanceof PluginProblem) return {
+			refusal: p.message,
+			notes: [],
+			labels
+		};
+		const build = buildRefusal(source, planned.sandbox, p?.name, root);
+		if (build) return {
+			refusal: build,
+			notes: [],
+			labels
+		};
+		if (p) read.push(p);
+		else unread.push(call);
+		labels.push(p ? `${p.name} (${p.kept.join(", ")})` : pluginSourceLabel(source, root));
+	}
+	const twice = duplicateLocalPlugin(layers, root);
+	if (twice) return {
+		refusal: twice,
+		notes: [],
+		labels
+	};
+	const own = {
+		skills: localSkills(layers, root),
+		mcp: [...new Set(layers.flatMap((l) => Object.keys(l.spec.mcp ?? {})))]
+	};
+	const refusal = refusedPlugins(planned.harness, read, own, unread);
+	if (refusal) return {
+		refusal,
+		notes: [],
+		labels
+	};
+	return {
+		...fetchesAtStart(read, allowedHosts(planned.egress)),
+		labels
+	};
+}
 /** The run-wide cap, plus the sandbox provider's and harness's own caps when they set one. */
 function attemptLimits(planned, concurrency) {
 	const limits = { attempts: concurrency };
@@ -2345,4 +2325,4 @@ function optionsFrom(written, where, base) {
 //#endregion
 export { assertionRecords as i, evaluate as n, group as r, declareTree as t };
 
-//# sourceMappingURL=evaluate-DKIl54Hb.js.map
+//# sourceMappingURL=evaluate-CXQ1o-pd.js.map