reeval 0.11.0 → 0.13.0

package/dist/{src-ftu5wPSt.js → src-CIpKL45U.js}

@@ -1,4 +1,4 @@
-import { u as ownFileURL } from "./root-DICDHCtp.js";
+import { u as ownFileURL } from "./root-DNuLhaA5.js";
 import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, renameSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, posix, relative, win32 } from "node:path";
@@ -13,6 +13,7 @@ import http from "node:http";
 import http2 from "node:http2";
 import https from "node:https";
 import tls from "node:tls";
+import zlib from "node:zlib";
 import { lookup } from "node:dns/promises";
 //#region ../sandbox-docker/src/seccomp-profile.ts
 const DOCKER_SECCOMP_PROFILE = {
@@ -1508,12 +1509,22 @@ for (let i = 0; i < Number(seconds); i++) {
 	child.on("error", () => {});
 	child.unref();
 }
-async function dockerState(engine) {
+async function dockerState(engine, signal) {
+	let missing = false;
+	const format = engineSpec(engine).stateFormat;
 	const r = await docker([
 		"info",
 		"--format",
-		engineSpec(engine).stateFormat
-	], { engine }).catch(() => null);
+		format
+	], {
+		engine,
+		signal
+	}).catch((error) => {
+		if (signal?.aborted) throw signal.reason;
+		missing = error?.code === "ENOENT";
+		return null;
+	});
+	if (missing) return "missing";
 	const [version, os] = r?.exitCode === 0 ? r.stdout.toString("utf8").trim().split(/\s+/) : [];
 	if (!version) return "down";
 	return os === "windows" ? "windows-containers" : "running";
@@ -1601,20 +1612,20 @@ async function imageInfo(image, engine) {
 const HARNESS_PACKAGES = {
 	cursor: {
 		name: "@reeval/harness-cursor-sdk",
-		version: "0.1.5"
+		version: "0.1.6"
 	},
 	"claude-code": {
 		name: "@ai-sdk/harness-claude-code",
 		version: "1.0.160",
-		patch: "907f9184"
+		patch: "b17cde50"
 	},
 	antigravity: {
 		name: "@reeval/harness-antigravity",
-		version: "0.1.8"
+		version: "0.1.11"
 	},
 	opencode: {
 		name: "@reeval/harness-opencode",
-		version: "0.2.8"
+		version: "0.2.9"
 	},
 	goose: {
 		name: "@reeval/harness-goose",
@@ -1622,7 +1633,7 @@ const HARNESS_PACKAGES = {
 	},
 	pi: {
 		name: "@reeval/harness-pi",
-		version: "0.2.7"
+		version: "0.2.8"
 	},
 	codex: {
 		name: "@reeval/harness-codex",
@@ -1634,7 +1645,7 @@ const HARNESS_PACKAGES = {
 	},
 	"grok-build": {
 		name: "@reeval/harness-grok-build",
-		version: "0.1.0"
+		version: "0.1.2"
 	}
 };
 /** Every harness with an image, in {@link HARNESS_PACKAGES} order. */
@@ -1675,6 +1686,11 @@ const SANDBOX_HOME = `/home/${SANDBOX_USER}`;
 const SANDBOX_ROOT = "/reeval";
 /** The agent's working directory, relative to {@link SANDBOX_ROOT}. */
 const WORKSPACE_DIR = "workspace";
+/**
+* reeval's own state in the container, root's and mode 0700: outside {@link SANDBOX_ROOT}, which
+* {@link SANDBOX_USER} owns and so could rename it away and put its own in its place.
+*/
+const SANDBOX_STATE = "/var/lib/reeval";
 const BRIDGE_PORT = 43210;
 //#endregion
 //#region ../sandbox-docker/src/egress/cert.ts
@@ -1812,7 +1828,8 @@ function ipv6Bytes(address) {
 //#region ../sandbox-docker/src/egress/mux.ts
 /**
 * Many TCP streams over one byte pipe (a `docker exec` stdio), with per-stream credit so a slow
-* reader only stalls its own stream. Frames are `type u8, id u32, length u32, payload`.
+* reader only stalls its own stream. Frames are `type u8, id u32, length u32, payload`, and a
+* payload is at most 64 KiB.
 *
 * Must stay self-contained, with no imports or references to module scope: the forwarder runs
 * this function's source inside the container.
@@ -1826,9 +1843,43 @@ function createMux(options) {
 	const READY = 6;
 	const windowSize = options.window ?? 262144;
 	const maxPayload = 65536;
+	/** The payload length each type must have, or its range. */
+	const LENGTHS = {
+		[OPEN]: [
+			"OPEN",
+			2,
+			2
+		],
+		[DATA]: [
+			"DATA",
+			0,
+			maxPayload
+		],
+		[FIN]: [
+			"FIN",
+			0,
+			0
+		],
+		[RST]: [
+			"RST",
+			0,
+			0
+		],
+		[WINDOW]: [
+			"WINDOW",
+			4,
+			4
+		],
+		[READY]: [
+			"READY",
+			0,
+			0
+		]
+	};
 	const streams = /* @__PURE__ */ new Map();
 	let nextId = options.parity === 0 ? 2 : 1;
 	let pending = Buffer.alloc(0);
+	let broken = false;
 	const frame = (type, id, payload = Buffer.alloc(0)) => {
 		const header = Buffer.alloc(9);
 		header.writeUInt8(type, 0);
@@ -1881,6 +1932,25 @@ function createMux(options) {
 		streams.set(id, state);
 		return stream;
 	};
+	/** Why a frame's header breaks the protocol, or null. */
+	const malformed = (type, id, length) => {
+		const expected = LENGTHS[type];
+		if (!expected) return `a frame of unknown type ${type}`;
+		const [name, min, max] = expected;
+		if (length > maxPayload) return `a frame too large (${length} bytes)`;
+		if (length < min || length > max) return `a malformed ${name} frame (${length} bytes, not ${min === max ? min : `0 to ${max}`} bytes)`;
+		if (type === OPEN && (id % 2 === options.parity || streams.has(id))) return `an OPEN frame for stream ${id}, which this side allocates or has open`;
+		return null;
+	};
+	const fail = (message) => {
+		broken = true;
+		pending = Buffer.alloc(0);
+		for (const state of [...streams.values()]) {
+			state.reset = true;
+			state.stream.destroy();
+		}
+		options.onError?.(`the peer sent ${message}`);
+	};
 	const handle = (type, id, payload) => {
 		if (type === READY) return options.onReady?.();
 		if (type === OPEN) return options.onOpen(create(id), payload.readUInt16BE(0));
@@ -1909,15 +1979,22 @@ function createMux(options) {
 	};
 	return {
 		receive(chunk) {
+			if (broken) return;
 			pending = pending.length ? Buffer.concat([pending, chunk]) : chunk;
-			while (pending.length >= 9) {
-				const length = pending.readUInt32BE(5);
-				if (pending.length < 9 + length) break;
-				const type = pending.readUInt8(0);
-				const id = pending.readUInt32BE(1);
-				const payload = pending.subarray(9, 9 + length);
-				pending = pending.subarray(9 + length);
-				handle(type, id, payload);
+			try {
+				while (pending.length >= 9) {
+					const type = pending.readUInt8(0);
+					const id = pending.readUInt32BE(1);
+					const length = pending.readUInt32BE(5);
+					const problem = malformed(type, id, length);
+					if (problem) return fail(problem);
+					if (pending.length < 9 + length) break;
+					const payload = pending.subarray(9, 9 + length);
+					pending = pending.subarray(9 + length);
+					handle(type, id, payload);
+				}
+			} catch (error) {
+				fail(`a frame it couldn't handle: ${error.message}`);
 			}
 		},
 		open(port) {
@@ -1971,6 +2048,10 @@ function forwarderMain(io, makeMux, linkStreams, proxyPort) {
 				host: "127.0.0.1",
 				allowHalfOpen: true
 			}), stream);
+		},
+		onError(message) {
+			io.error(`reeval egress forwarder: ${message}`);
+			io.exit(1);
 		}
 	});
 	io.input.on("data", (chunk) => mux.receive(chunk));
@@ -2051,13 +2132,45 @@ const normalise = (host) => host.toLowerCase().replace(/\.$/, "").replace(/^\[|\
 * mustn't resolve into them, or anyone who can add a DNS record under the pattern's domain
 * reaches the worker's LAN.
 */
-const PRIVATE = blockList([
+const PRIVATE_RANGES = [
 	"10.0.0.0/8",
 	"100.64.0.0/10",
 	"172.16.0.0/12",
 	"192.168.0.0/16",
 	"fc00::/7"
+];
+const PRIVATE = blockList(PRIVATE_RANGES);
+/**
+* Reachable only with an `allowedCIDRs` entry that covers them, so never under allow-all: the
+* gateway connects from the worker, so these would reach its LAN, the Docker host's bridge, cloud
+* metadata on a unique-local or CGNAT address (AWS's `fd00:ec2::254`, Alibaba's
+* `100.100.100.200`), multicast and broadcast. NAT64 addresses are checked by their embedded
+* IPv4 address as well.
+*/
+const RESERVED = blockList([
+	...PRIVATE_RANGES,
+	"224.0.0.0/4",
+	"255.255.255.255/32",
+	"ff00::/8",
+	"64:ff9b::/96"
 ]);
+const NAT64 = blockList(["64:ff9b::/96"]);
+/** The IPv4 address in the last 32 bits of an IPv6 address, as `a.b.c.d`. */
+function embeddedIPv4(address) {
+	const tail = address.slice(address.lastIndexOf(":") + 1);
+	if (isIP(tail) === 4) return tail;
+	const groups = address.split(":");
+	const low = Number.parseInt(groups.at(-1) || "0", 16);
+	const high = groups.length > 1 ? Number.parseInt(groups.at(-2) || "0", 16) : 0;
+	return [
+		high >> 8,
+		high & 255,
+		low >> 8,
+		low & 255
+	].join(".");
+}
+/** The address, and for a NAT64 address the IPv4 address it reaches too. */
+const reaches = (address) => isIP(address) === 6 && inList(NAT64, address) ? [address, embeddedIPv4(address)] : [address];
 /** How `host` matches: listed as it is, only by a `*.` pattern (never an IP address), or not. */
 function hostMatch(patterns, host) {
 	const h = normalise(host);
@@ -2090,7 +2203,7 @@ function createPolicyCheck(policy, options = {}) {
 			reason: "the policy denies all egress"
 		};
 		const listed = hostMatch(custom?.allowedHosts ?? [], host);
-		if (custom && !listed && !custom.allowedCIDRs?.length) return {
+		if (custom && !listed && !(custom.allowedCIDRs?.length && isIP(host))) return {
 			allowed: false,
 			status: 403,
 			reason: `${host} isn't in the allowlist`
@@ -2111,16 +2224,26 @@ function createPolicyCheck(policy, options = {}) {
 			status: 502,
 			reason: `${host} has no addresses`
 		};
-		if (addresses.some((a) => inList(always, a))) return {
+		const reached = addresses.flatMap(reaches);
+		if (reached.some((a) => inList(always, a))) return {
 			allowed: false,
 			status: 403,
 			reason: `${host} is a loopback or link-local address`
 		};
+		const reserved = reached.find((a) => inList(RESERVED, a) && !inList(allowedCidrs, a));
+		if (reserved) {
+			const which = reserved === host ? host : `${host} (${reserved})`;
+			return {
+				allowed: false,
+				status: 403,
+				reason: custom ? `${which} is a private or reserved address; list the address itself in the allowlist to reach it` : `${which} is a private or reserved address, which allow-all doesn't reach; list the address in an allowlist to reach it`
+			};
+		}
 		if (!custom) return {
 			allowed: true,
 			address: first
 		};
-		if (addresses.some((a) => inList(deniedCidrs, a))) return {
+		if (reached.some((a) => inList(deniedCidrs, a))) return {
 			allowed: false,
 			status: 403,
 			reason: `${host} is in a denied range`
@@ -2175,6 +2298,35 @@ const onEndpoint = (endpoints, request) => endpoints.some((match) => matches({
 }, request));
 /** Whether the gateway must decrypt connections to `host`: some rule could apply there. */
 const decrypts = (rules, host) => rules.some((r) => normaliseHost(r.match.host) === normaliseHost(host));
+/** What a credential the sandbox never sent comes back as. */
+const REDACTED = "reeval_redacted_credential";
+/** Shorter values aren't credentials, and scrubbing them would mangle ordinary text. */
+const MIN_CREDENTIAL = 16;
+const schemeAndToken = (value) => /^([A-Za-z][\w-]*) +(\S+)$/.exec(value);
+/**
+* The values credential rules for `host` set (rules keyed on a header the sandbox sends, such as
+* a placeholder key), each paired with what the sandbox sent in its place, for scrubbing from
+* responses. A value with a scheme (`Bearer <key>`) is paired as a whole and by its token too.
+*/
+function credentialValues(rules, host) {
+	const pairs = /* @__PURE__ */ new Map();
+	const add = (value, shown) => {
+		if (value.length >= MIN_CREDENTIAL && value !== shown && !pairs.has(value)) pairs.set(value, shown);
+	};
+	for (const rule of rules) {
+		const keyed = rule.match.headers ?? [];
+		if (!keyed.length || normaliseHost(rule.match.host) !== normaliseHost(host)) continue;
+		for (const [name, value] of Object.entries(rule.transform.headers)) {
+			const sent = keyed.find((m) => m.key && "exact" in m.key && m.key.exact.toLowerCase() === name.toLowerCase())?.value;
+			const shown = sent && "exact" in sent ? sent.exact : REDACTED;
+			add(value, shown);
+			const token = schemeAndToken(value);
+			const shownToken = schemeAndToken(shown);
+			if (token?.[2]) add(token[2], shownToken?.[2] ?? REDACTED);
+		}
+	}
+	return [...pairs];
+}
 /**
 * The request's headers after every matching rule, in order, so later rules win. Returns the
 * (lower-case) names that were replaced, for logging without values. With `endpoints`, no rule
@@ -2283,59 +2435,75 @@ function scrubHeaders(subs, headers) {
 	const one = (v) => scrubValue(subs, v);
 	return Object.fromEntries(Object.entries(headers).map(([k, v]) => [k, v === void 0 ? v : Array.isArray(v) ? v.map(one) : one(String(v))]));
 }
+const bufferPairs = (pairs) => pairs.filter(([from]) => from.length > 0).map(([from, to]) => [Buffer.from(from), Buffer.from(to)]);
 /**
-* Replaces byte strings in a stream, including across chunk boundaries: it holds back the
-* longest `from` less one byte, so a match split between chunks is still found.
+* Replaces every whole match in `data` (original bytes only: output is never re-scanned), and
+* returns where the unscanned tail starts: `data.length` when `final`, else the start of the
+* shortest tail that could begin a match, so only bytes a later chunk might complete are held.
+*/
+function scan(pairs, data, final) {
+	const parts = [];
+	let pos = 0;
+	let count = 0;
+	for (;;) {
+		let best = -1;
+		let pair;
+		for (const p of pairs) {
+			const i = data.indexOf(p[0], pos);
+			if (i !== -1 && (best === -1 || i < best)) {
+				best = i;
+				pair = p;
+			}
+		}
+		if (best === -1 || !pair) break;
+		parts.push(data.subarray(pos, best), pair[1]);
+		pos = best + pair[0].length;
+		count++;
+	}
+	let rest = data.length;
+	if (!final) {
+		const hold = Math.max(0, ...pairs.map(([from]) => from.length - 1));
+		for (let i = Math.max(pos, data.length - hold); i < data.length; i++) {
+			const tail = data.subarray(i);
+			if (pairs.some(([from]) => from.subarray(0, tail.length).equals(tail))) {
+				rest = i;
+				break;
+			}
+		}
+	}
+	parts.push(data.subarray(pos, rest));
+	return {
+		out: Buffer.concat(parts),
+		rest,
+		count
+	};
+}
+/** `data` with every `from` replaced by its `to`, in one pass. */
+const replaceAll = (data, pairs) => scan(bufferPairs(pairs), data, true).out;
+/**
+* Replaces byte strings in a stream, including across chunk boundaries: it holds back a chunk's
+* tail while it could be the start of a match, so a match split between chunks is still found.
 */
 var ReplaceStream = class extends Transform {
 	#pairs;
-	#hold;
 	#tail = Buffer.alloc(0);
 	/** How many replacements were made. */
 	count = 0;
 	constructor(pairs) {
 		super();
-		this.#pairs = pairs.filter(([from]) => from.length > 0).map(([from, to]) => [Buffer.from(from), Buffer.from(to)]);
-		this.#hold = Math.max(0, ...this.#pairs.map(([from]) => from.length - 1));
-	}
-	/**
-	* Replaces every whole match in `data` (original bytes only: output is never re-scanned), and
-	* returns where the unscanned tail starts, which is `data.length` when `final`.
-	*/
-	#scan(data, final) {
-		const parts = [];
-		let pos = 0;
-		for (;;) {
-			let best = -1;
-			let pair;
-			for (const p of this.#pairs) {
-				const i = data.indexOf(p[0], pos);
-				if (i !== -1 && (best === -1 || i < best)) {
-					best = i;
-					pair = p;
-				}
-			}
-			if (best === -1 || !pair) break;
-			parts.push(data.subarray(pos, best), pair[1]);
-			pos = best + pair[0].length;
-			this.count++;
-		}
-		const rest = final ? data.length : Math.max(pos, data.length - this.#hold);
-		parts.push(data.subarray(pos, rest));
-		return {
-			out: Buffer.concat(parts),
-			rest
-		};
+		this.#pairs = bufferPairs(pairs);
 	}
 	_transform(chunk, _enc, done) {
 		const data = Buffer.concat([this.#tail, chunk]);
-		const { out, rest } = this.#scan(data, false);
+		const { out, rest, count } = scan(this.#pairs, data, false);
+		this.count += count;
 		this.#tail = Buffer.from(data.subarray(rest));
 		if (out.length) this.push(out);
 		done();
 	}
 	_flush(done) {
-		const { out } = this.#scan(this.#tail, true);
+		const { out, count } = scan(this.#pairs, this.#tail, true);
+		this.count += count;
 		if (out.length) this.push(out);
 		done();
 	}
@@ -2391,6 +2559,85 @@ function tokeniseResponse(derived, body, known) {
 	};
 }
 //#endregion
+//#region ../sandbox-docker/src/egress/websocket.ts
+/** The most a message may hold while its frames are gathered to be scrubbed. */
+const MAX_MESSAGE = 16777216;
+/** One unmasked frame, as a server sends it. */
+function frame(first, payload) {
+	const n = payload.length;
+	if (n < 126) return Buffer.concat([Buffer.from([first, n]), payload]);
+	const head = Buffer.alloc(n < 65536 ? 4 : 10);
+	head[0] = first;
+	if (n < 65536) {
+		head[1] = 126;
+		head.writeUInt16BE(n, 2);
+	} else {
+		head[1] = 127;
+		head.writeBigUInt64BE(BigInt(n), 2);
+	}
+	return Buffer.concat([head, payload]);
+}
+/**
+* Server-to-client WebSocket frames with every real value put back as its placeholder. Each data
+* message is gathered whole, so a value split across its frames is still found, and sent on as
+* one frame; control frames pass straight through, even between a message's frames. A
+* compressed frame (the upgrade request goes up without extensions, so a server shouldn't send
+* one), or a message over 16 MiB, errors the stream rather than pass unread.
+*/
+function webSocketScrubber(subs) {
+	const pairs = subs.map((s) => [s.value, s.placeholder]);
+	let pending = Buffer.alloc(0);
+	let message = null;
+	return new Transform({ transform(chunk, _encoding, done) {
+		pending = pending.length ? Buffer.concat([pending, chunk]) : chunk;
+		const out = [];
+		while (pending.length >= 2) {
+			const first = pending[0] ?? 0;
+			const second = pending[1] ?? 0;
+			let length = second & 127;
+			let at = 2;
+			if (length === 126) {
+				if (pending.length < 4) break;
+				length = pending.readUInt16BE(2);
+				at = 4;
+			} else if (length === 127) {
+				if (pending.length < 10) break;
+				const big = pending.readBigUInt64BE(2);
+				if (big > BigInt(MAX_MESSAGE)) return done(/* @__PURE__ */ new Error("a WebSocket frame over 16 MiB"));
+				length = Number(big);
+				at = 10;
+			}
+			const masked = (second & 128) !== 0;
+			const maskAt = at;
+			if (masked) at += 4;
+			if (pending.length < at + length) break;
+			const payload = Buffer.from(pending.subarray(at, at + length));
+			if (masked) for (let i = 0; i < payload.length; i++) payload[i] = (payload[i] ?? 0) ^ (pending[maskAt + i % 4] ?? 0);
+			pending = pending.subarray(at + length);
+			const opcode = first & 15;
+			if (first & 112) return done(/* @__PURE__ */ new Error("a compressed or extended WebSocket frame, which can't be scrubbed"));
+			if (opcode >= 8) {
+				out.push(frame(first, payload));
+				continue;
+			}
+			if (opcode === 0 ? !message : message) return done(/* @__PURE__ */ new Error("WebSocket frames out of order"));
+			message ??= {
+				opcode,
+				parts: [],
+				size: 0
+			};
+			message.parts.push(payload);
+			message.size += payload.length;
+			if (message.size > MAX_MESSAGE) return done(/* @__PURE__ */ new Error("a WebSocket message over 16 MiB"));
+			if (first & 128) {
+				out.push(frame(128 | message.opcode, replaceAll(Buffer.concat(message.parts), pairs)));
+				message = null;
+			}
+		}
+		done(null, out.length ? Buffer.concat(out) : void 0);
+	} });
+}
+//#endregion
 //#region ../sandbox-docker/src/egress/proxy.ts
 const HOP_BY_HOP = /* @__PURE__ */ new Set([
 	"connection",
@@ -2414,6 +2661,11 @@ function parseAuthority(authority, defaultPort) {
 		port: Number(m?.[2] ?? defaultPort)
 	};
 }
+/** `host` or `host:port` for a Host header or URL, IPv6 in brackets. */
+const authorityOf = (host, port) => {
+	const name = net.isIPv6(host) ? `[${host}]` : host;
+	return port === 443 ? name : `${name}:${port}`;
+};
 const pathOnly = (path) => path.split("?")[0];
 function reply(socket, status, reason) {
 	const text = http.STATUS_CODES[status] ?? "";
@@ -2424,6 +2676,15 @@ const counter = (count) => new Transform({ transform(chunk, _encoding, done) {
 	count(chunk.length);
 	done(null, chunk);
 } });
+/** The response encodings the gateway can decode to scrub a body. */
+const DECODERS = {
+	gzip: () => zlib.createGunzip(),
+	"x-gzip": () => zlib.createGunzip(),
+	deflate: () => zlib.createInflate(),
+	br: () => zlib.createBrotliDecompress()
+};
+/** Text a credential could be echoed into, or no type at all. */
+const isText = (type) => !type.trim() || /^\s*(text\/|application\/(json|xml|javascript|x-www-form-urlencoded|x-ndjson|[\w.-]+\+(json|xml))\b)/i.test(type);
 const plainHeaders = (headers) => Object.fromEntries(Object.entries(headers).flatMap(([k, v]) => v === void 0 ? [] : [[k, Array.isArray(v) ? v.map(String) : String(v)]]));
 function createEgressProxy(options) {
 	const log = options.log ?? (() => {});
@@ -2670,25 +2931,39 @@ function createEgressProxy(options) {
 		} catch {
 			return res.writeHead(400).end("reeval egress gateway: expected an absolute URL\n");
 		}
-		if (url.protocol !== "http:") return res.writeHead(400).end("reeval egress gateway: http only\n");
-		const { host, port } = parseAuthority(url.host, 80);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return res.writeHead(400).end(`reeval egress gateway: expected an http:// or https:// URL, not ${url.protocol}\n`);
+		const secure = url.protocol === "https:";
+		const { host, port } = parseAuthority(url.host, secure ? 443 : 80);
+		const shown = secure ? `https://${host}` : `http://${host}:${port}`;
 		const done = requestEvent(res, {
 			method: req.method ?? "GET",
-			url: `http://${host}:${port}${url.pathname}`,
+			url: `${shown}${url.pathname}`,
 			host,
 			port,
-			via: "http",
+			via: secure ? "decrypted" : "http",
 			requestHeaders: plainHeaders(req.headers)
 		});
 		check(host).then((verdict) => {
 			if (!verdict.allowed) {
-				log(`reeval:egress ${req.method} http://${host}:${port} denied (${verdict.reason})`);
+				log(`reeval:egress ${req.method} ${shown} denied (${verdict.reason})`);
 				block(req.socket, host, port, verdict.reason);
 				done.refuse(verdict.reason);
 				return res.writeHead(verdict.status).end(`blocked by the reeval egress policy: ${verdict.reason}\n`);
 			}
-			log(`reeval:egress ${req.method} http://${host}:${port}${url.pathname}`);
 			contact(req.socket, host, port);
+			if (secure) {
+				const headers = {
+					...req.headers,
+					host: url.host
+				};
+				onDecrypted({
+					host,
+					port,
+					address: verdict.address
+				}, req, res, url.pathname + url.search, headers, done);
+				return;
+			}
+			log(`reeval:egress ${req.method} http://${host}:${port}${url.pathname}`);
 			const upstream = http.request({
 				host: verdict.address,
 				port,
@@ -2699,7 +2974,12 @@ function createEgressProxy(options) {
 					host: url.host
 				}
 			});
-			forwardHttp1(req.pipe(counter(done.sent)), res, upstream, [], void 0, done);
+			forwardHttp1(req.pipe(counter(done.sent)), res, upstream, {
+				own: [],
+				creds: [],
+				url: `${shown}${url.pathname}`,
+				t: done
+			});
 		});
 	});
 	front.on("upgrade", (_req, socket) => {
@@ -2724,6 +3004,21 @@ function createEgressProxy(options) {
 	* is refused (already logged): a Host that isn't the CONNECT target, or an unbrokered endpoint.
 	*/
 	function transformed(target, method, path, headers, version) {
+		if (!path.startsWith("/") && !(method === "OPTIONS" && path === "*")) {
+			const reason = `reeval egress gateway: expected a path in the request line on a connection to ${target.host}, not an absolute URL.`;
+			log(`reeval:egress ${method} https://${target.host} refused (absolute-form target)`);
+			return {
+				headers: {},
+				path,
+				own: [],
+				names: [],
+				credentials: [],
+				refused: {
+					status: 400,
+					reason
+				}
+			};
+		}
 		const named = String(headers[":authority"] ?? headers.host ?? "");
 		const asked = parseAuthority(named, target.port).host;
 		if (named && asked !== target.host) {
@@ -2791,7 +3086,7 @@ function createEgressProxy(options) {
 			path,
 			headers: {}
 		});
-		if (scrubbedInBodies(own).length || exchange || readsModel) delete substituted.headers["accept-encoding"];
+		if (scrubbedInBodies(own).length || credentialValues(rules, target.host).length || exchange || readsModel) delete substituted.headers["accept-encoding"];
 		const notes = [
 			replaced.length ? `set ${replaced.join(", ")}` : "",
 			substituted.names.length ? `substituted ${substituted.names.join(", ")}` : "",
@@ -2818,19 +3113,72 @@ function createEgressProxy(options) {
 		delete headers["content-length"];
 		return counted.pipe(bodySubstituter(own));
 	}
-	/** The response body as sent to the sandbox: real values put back as placeholders. */
 	const scrubs = options.scrubResponses !== false;
-	function responseBody(up, own, t, readsModel = false) {
+	/**
+	* The harness credentials the rules set on `host`, shaped as substitutions that are never
+	* swapped in, only scrubbed from responses.
+	*/
+	const credentialScrubs = (host) => credentialValues(rules, host).map(([value, shown]) => ({
+		name: "credential",
+		placeholder: shown,
+		value,
+		hosts: [host],
+		in: []
+	}));
+	function scrubPlan(status, headers, own, creds) {
+		if (!scrubs || status === 204 || status === 304) return { body: [] };
+		const type = String(headers["content-type"] ?? "");
+		const body = [...scrubbedInBodies(own), ...status >= 300 || isText(type) ? creds : []];
+		const encoding = String(headers["content-encoding"] ?? "identity").toLowerCase();
+		if (!body.length || encoding === "identity") return { body };
+		if (encoding in DECODERS) return {
+			body,
+			decode: encoding
+		};
+		return {
+			body,
+			refuse: `the response is ${encoding}-encoded, so it can't be scrubbed`
+		};
+	}
+	/**
+	* The response body as sent to the sandbox: decoded if the plan says so, with real values put
+	* back as placeholders. An error anywhere upstream of it (a corrupt encoding) errors it.
+	*/
+	function responseBody(up, plan, t, readsModel = false) {
 		if (readsModel && t) readModel(up, t);
-		const body = scrubbedInBodies(own).length && scrubs ? up.pipe(scrubber(own)) : up;
-		return t ? body.pipe(counter(t.received)) : body;
+		const into = (from, to) => {
+			from.once("error", (error) => to.destroy(error));
+			return from.pipe(to);
+		};
+		let body = up;
+		const decoder = plan.decode ? DECODERS[plan.decode] : void 0;
+		if (decoder) body = into(body, decoder());
+		if (plan.body.length) body = into(body, scrubber(plan.body));
+		return t ? into(body, counter(t.received)) : body;
 	}
-	const responseHeaders = (headers, own) => {
+	/** Header (and trailer) values with every real value put back as its placeholder. */
+	const scrubbedHeaders = (headers, all) => {
 		const out = endToEnd(headers);
-		if (!own.length || !scrubs) return out;
-		if (scrubbedInBodies(own).length) delete out["content-length"];
-		return scrubHeaders(own, out);
+		if (!all.length || !scrubs) return out;
+		return scrubHeaders(all, out);
 	};
+	const responseHeaders = (headers, own, creds, plan) => {
+		const out = scrubbedHeaders(headers, [...own, ...creds]);
+		if (plan.body.length) delete out["content-length"];
+		if (plan.decode) delete out["content-encoding"];
+		return out;
+	};
+	/** Answers a response the gateway won't pass on with a 502 saying why. */
+	function refuseResponse(res, up, url, why, t) {
+		log(`reeval:egress ${url} response refused (${why})`);
+		up.resume();
+		t?.set({
+			status: 502,
+			reason: why
+		});
+		if (res.headersSent) return res.destroy();
+		res.writeHead(502, { "content-type": "text/plain" }).end(`reeval egress gateway: ${why}\n`);
+	}
 	/**
 	* How far into a response the gateway looks for the model that served it: OpenAI's first event
 	* echoes the request's instructions and tools before it.
@@ -2859,7 +3207,7 @@ function createEgressProxy(options) {
 	* A token exchange's response, read whole, with each token replaced by a placeholder. A success
 	* that can't be read (compressed, too big, not JSON) is a 502: the real tokens never go through.
 	*/
-	function tokenised(exchange, url, status, headers, up, res, own, t) {
+	function tokenised(exchange, url, status, headers, up, res, own, creds, t) {
 		const chunks = [];
 		let size = 0;
 		const refuse = (why) => {
@@ -2868,15 +3216,20 @@ function createEgressProxy(options) {
 `);
 			else res.destroy();
 		};
-		const scrubbed = responseBody(up, own, t);
+		const plan = scrubPlan(status, headers, own, creds);
+		if (plan.refuse) {
+			up.resume();
+			return refuse(plan.refuse);
+		}
+		const scrubbed = responseBody(up, plan, t);
 		scrubbed.on("data", (chunk) => {
 			size += chunk.length;
 			if (size <= EXCHANGE_LIMIT) chunks.push(chunk);
 		});
-		up.once("error", (error) => refuse(error.message));
+		scrubbed.once("error", (error) => refuse(error.message));
 		scrubbed.once("end", () => {
 			const body = Buffer.concat(chunks);
-			const out = responseHeaders(headers, own);
+			const out = responseHeaders(headers, own, creds, plan);
 			t?.set({ responseHeaders: plainHeaders(out) });
 			if (status < 200 || status >= 300) return res.writeHead(status, out).end(body);
 			const encoding = String(headers["content-encoding"] ?? "identity");
@@ -2898,10 +3251,10 @@ function createEgressProxy(options) {
 			}).end(text);
 		});
 	}
-	async function onDecrypted(target, req, res) {
+	async function onDecrypted(target, req, res, asked = req.url ?? "/", sent = req.headers, tracker) {
 		const method = req.method ?? "GET";
-		const url = `https://${target.host}${pathOnly(req.url ?? "/")}`;
-		const t = requestEvent(res, {
+		const url = `https://${target.host}${pathOnly(asked)}`;
+		const t = tracker ?? requestEvent(res, {
 			method,
 			url,
 			host: target.host,
@@ -2909,7 +3262,7 @@ function createEgressProxy(options) {
 			via: "decrypted",
 			requestHeaders: plainHeaders(req.headers)
 		});
-		const { headers, path, own, names, credentials, refused, exchange, readsModel } = transformed(target, method, req.url ?? "/", req.headers, req.httpVersion);
+		const { headers, path, own, names, credentials, refused, exchange, readsModel } = transformed(target, method, asked, sent, req.httpVersion);
 		t.set({
 			substituted: names,
 			credentials
@@ -2922,7 +3275,7 @@ function createEgressProxy(options) {
 		delete headers.upgrade;
 		delete headers.connection;
 		const body = requestBody(req, headers, own, t);
-		const authority = target.port === 443 ? target.host : `${target.host}:${target.port}`;
+		const authority = authorityOf(target.host, target.port);
 		const session = req.httpVersionMajor === 2 ? await upstreamSession(target) : null;
 		if (!session) return forwardHttp1(body, res, https.request({
 			host: target.address,
@@ -2936,10 +3289,14 @@ function createEgressProxy(options) {
 			},
 			agent,
 			ca
-		}), own, exchange && {
-			exchange,
-			url
-		}, t, readsModel);
+		}), {
+			own,
+			creds: credentialScrubs(target.host),
+			url,
+			...exchange ? { exchange } : {},
+			...t ? { t } : {},
+			readsModel: !!readsModel
+		});
 		const stream = session.request({
 			...headers,
 			":method": method,
@@ -2952,30 +3309,41 @@ function createEgressProxy(options) {
 			else res.destroy();
 		};
 		stream.once("error", fail);
+		const creds = credentialScrubs(target.host);
 		stream.once("response", (h) => {
-			if (exchange) return tokenised(exchange, url, Number(h[":status"]), h, stream, res, own, t);
-			const out = responseHeaders(h, own);
-			t.set({ responseHeaders: plainHeaders(out) });
-			res.writeHead(Number(h[":status"]), out);
-			stream.once("trailers", (trailers) => res.addTrailers(responseHeaders(trailers, own)));
-			responseBody(stream, own, t, readsModel).pipe(res);
+			const status = Number(h[":status"]);
+			if (exchange) return tokenised(exchange, url, status, h, stream, res, own, creds, t);
+			if (!respond(status, h, stream, res, own, creds, url, t, readsModel)) return;
+			stream.once("trailers", (trailers) => res.addTrailers(scrubbedHeaders(trailers, [...own, ...creds])));
 		});
 		body.pipe(stream);
 		req.once("aborted", () => stream.close(http2.constants.NGHTTP2_CANCEL));
 	}
-	function forwardHttp1(req, res, upstream, own = [], tokenise, t, readsModel = false) {
+	/**
+	* Sends an upstream response on to the sandbox, scrubbed. False when it was refused instead,
+	* already answered with a 502.
+	*/
+	function respond(status, headers, up, res, own, creds, url, t, readsModel = false) {
+		const plan = scrubPlan(status, headers, own, creds);
+		if (plan.refuse) {
+			refuseResponse(res, up, url, plan.refuse, t);
+			return false;
+		}
+		const out = responseHeaders(headers, own, creds, plan);
+		t?.set({ responseHeaders: plainHeaders(out) });
+		res.writeHead(status, out);
+		responseBody(up, plan, t, readsModel).once("error", () => res.destroy()).pipe(res);
+		return true;
+	}
+	function forwardHttp1(req, res, upstream, to) {
+		const { own, creds, url, exchange, t } = to;
 		upstream.once("response", (up) => {
-			if (tokenise) {
-				const { exchange, url } = tokenise;
-				return tokenised(exchange, url, up.statusCode ?? 502, up.headers, up, res, own, t);
-			}
-			const out = responseHeaders(up.headers, own);
-			t?.set({ responseHeaders: plainHeaders(out) });
-			res.writeHead(up.statusCode ?? 502, out);
+			const status = up.statusCode ?? 502;
+			if (exchange) return tokenised(exchange, url, status, up.headers, up, res, own, creds, t);
+			if (!respond(status, up.headers, up, res, own, creds, url, t, to.readsModel)) return;
 			up.once("end", () => {
-				if (Object.keys(up.trailers).length) res.addTrailers(responseHeaders(up.trailers, own));
+				if (Object.keys(up.trailers).length) res.addTrailers(scrubbedHeaders(up.trailers, [...own, ...creds]));
 			});
-			responseBody(up, own, t, readsModel).pipe(res);
 		});
 		upstream.once("error", (error) => {
 			t?.set({
@@ -2991,7 +3359,9 @@ function createEgressProxy(options) {
 		const method = req.method ?? "GET";
 		const startedAt = Date.now();
 		const { headers, path, own, names, credentials, refused } = transformed(target, method, req.url ?? "/", req.headers, req.httpVersion);
-		const scrubbed = (value) => scrubs ? scrubValue(own, value) : value;
+		const all = scrubs ? [...own, ...credentialScrubs(target.host)] : [];
+		const scrubbed = (value) => scrubValue(all, value);
+		if (all.length) delete headers["sec-websocket-extensions"];
 		const upgraded = (fields) => emit({
 			type: "request",
 			method,
@@ -3029,7 +3399,7 @@ function createEgressProxy(options) {
 			ca
 		});
 		upstream.once("upgrade", (up, upSocket, upHead) => {
-			const out = scrubs ? scrubHeaders(own, up.headers) : up.headers;
+			const out = scrubHeaders(all, up.headers);
 			upgraded({
 				status: up.statusCode,
 				responseHeaders: plainHeaders(out)
@@ -3037,9 +3407,20 @@ function createEgressProxy(options) {
 			const lines = [`HTTP/1.1 ${up.statusCode} ${up.statusMessage}`];
 			for (let i = 0; i < up.rawHeaders.length; i += 2) lines.push(`${up.rawHeaders[i]}: ${scrubbed(up.rawHeaders[i + 1] ?? "")}`);
 			socket.write(`${lines.join("\r\n")}\r\n\r\n`);
-			if (upHead.length) socket.write(upHead);
 			if (head.length) upSocket.write(head);
-			link(socket, track(upSocket));
+			track(upSocket);
+			if (!all.length) {
+				if (upHead.length) socket.write(upHead);
+				return link(socket, upSocket);
+			}
+			const frames = webSocketScrubber(all);
+			if (upHead.length) frames.write(upHead);
+			upSocket.pipe(frames);
+			upSocket.once("error", (error) => frames.destroy(error));
+			link(socket, Duplex.from({
+				readable: frames,
+				writable: upSocket
+			}));
 		});
 		upstream.once("response", (up) => {
 			reply(socket, up.statusCode ?? 502, `upstream refused the upgrade (${up.statusCode})`);
@@ -3067,7 +3448,7 @@ function createEgressProxy(options) {
 					socket.destroy();
 					return resolve(null);
 				}
-				const session = http2.connect(`https://${key}`, { createConnection: () => socket });
+				const session = http2.connect(`https://${authorityOf(target.host, target.port)}`, { createConnection: () => socket });
 				session.on("error", () => {});
 				session.once("close", () => sessions.get(key) === session && sessions.delete(key));
 				session.once("goaway", () => sessions.get(key) === session && sessions.delete(key));
@@ -3177,6 +3558,7 @@ async function startGateway(containerId, options, signal, engine) {
 	});
 	child.stdin.on("error", () => {});
 	let closed = false;
+	let started = false;
 	const mux = createMux({
 		Duplex,
 		parity: 0,
@@ -3187,7 +3569,15 @@ async function startGateway(containerId, options, signal, engine) {
 			if (port === 43128) proxy.handle(stream);
 			else stream.destroy();
 		},
-		onReady: () => ready.resolve()
+		onReady: () => {
+			started = true;
+			ready.resolve();
+		},
+		onError: (message) => {
+			if (!started) return;
+			stop(`the forwarder's output broke the protocol: ${message}`);
+			child.kill("SIGKILL");
+		}
 	});
 	const ready = {};
 	ready.promise = new Promise((resolve, reject) => Object.assign(ready, {
@@ -3199,17 +3589,18 @@ async function startGateway(containerId, options, signal, engine) {
 	const listeners = /* @__PURE__ */ new Map();
 	const tunnels = /* @__PURE__ */ new Set();
 	let stopped;
-	child.once("close", (code) => {
+	/** Stops on its own: nothing reaches the container any more, so connections are refused. */
+	const stop = (reason) => {
 		const asked = closed;
 		closed = true;
 		mux.destroy();
-		const reason = `the forwarder exited (${code}): ${stderr.trim().slice(-500)}`.replace(/: $/, "");
 		ready.reject(new Error(reason));
 		if (asked) return;
 		stopped = reason;
 		for (const socket of tunnels) socket.destroy();
 		for (const l of listeners.values()) l.then((s) => s.close());
-	});
+	};
+	child.once("close", (code) => stop(`the forwarder exited (${code}): ${stderr.trim().slice(-500)}`.replace(/: $/, "")));
 	const timer = setTimeout(() => ready.reject(/* @__PURE__ */ new Error(`the forwarder didn't start within ${READY_TIMEOUT_MS / 1e3}s`)), READY_TIMEOUT_MS);
 	const onAbort = () => ready.reject(signal?.reason);
 	signal?.addEventListener("abort", onAbort, { once: true });
@@ -3321,6 +3712,21 @@ const ROOT_CAPABILITIES = [
 	"SETUID",
 	"SETGID"
 ];
+/**
+* Every container's capabilities, for {@link DockerSession.runPrivileged}'s root execs: reading
+* and owning any file. The container's own process is root, and each exec names its user: an
+* exec as {@link SANDBOX_USER} holds none of them, and `no-new-privileges` keeps it from gaining
+* them. Podman gives a container's non-root user its added capabilities as ambient ones, which is
+* why the container itself isn't {@link SANDBOX_USER}.
+*/
+const PRIVILEGED_CAPABILITIES = [
+	"CHOWN",
+	"DAC_OVERRIDE",
+	"DAC_READ_SEARCH",
+	"FOWNER"
+];
+/** The user each of the sandbox's own execs runs as. */
+const execUser = (options) => options.root ? "0:0" : SANDBOX_USER;
 const hostCpus = /* @__PURE__ */ new Map();
 /** Docker refuses `--cpus` above the host's count, so cap it there. */
 async function cpuLimit(cpus, engine = "docker") {
@@ -3333,18 +3739,23 @@ async function cpuLimit(cpus, engine = "docker") {
 	return String(available ? Math.min(cpus, available) : cpus);
 }
 /**
-* The `docker run` flags that confine the container: its user, capabilities and limits, and on
-* Podman the bridge network and Docker's seccomp profile.
+* The `docker run` flags that confine the container: its capabilities and limits, and on Podman
+* the bridge network and Docker's seccomp profile. Its own process is root's `sleep`; every exec
+* names its user.
 */
 async function confinementArgs(options) {
 	const limits = {
 		...DEFAULT_LIMITS,
 		...options.limits
 	};
-	const caps = [...options.root ? ROOT_CAPABILITIES : [], ...options.capabilities ?? []];
+	const caps = [
+		...PRIVILEGED_CAPABILITIES,
+		...options.root ? ROOT_CAPABILITIES : [],
+		...options.capabilities ?? []
+	];
 	return [
 		"--user",
-		options.root ? "0:0" : SANDBOX_USER,
+		"0:0",
 		"--cap-drop",
 		"ALL",
 		...[...new Set(caps)].flatMap((c) => ["--cap-add", c]),
@@ -3363,16 +3774,27 @@ async function confinementArgs(options) {
 }
 /** Runtime `npm i -g` goes to the sandbox user's own prefix, whose `bin` the images put on PATH. */
 const userEnv = (options) => options.root ? {} : { NPM_CONFIG_PREFIX: `${SANDBOX_HOME}/.local` };
+/** Root's PATH in a privileged exec: none of the sandbox user's own `bin` directories. */
+const SYSTEM_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 /** Set on every exec, so a kill can find the command's whole process tree in the container. */
 const EXEC_MARKER = "REEVAL_EXEC_ID";
 /**
+* Every exec that can create a file starts with this. An exec'd process inherits the umask of the
+* engine's shim, not the container's: since Docker 29.6 that's 0000 wherever dockerd starts
+* containerd itself (Docker-in-Docker, rootless, OrbStack), which makes homes, the workspace and
+* everything an agent writes world-writable, and tools such as fx and OpenSSH refuse them.
+*/
+const EXEC_UMASK = "umask 022";
+/**
 * The container's cgroup counts every process the kernel killed at its memory limit: cgroup v2's
 * `memory.events` and v1's `memory.oom_control` both have an `oom_kill` line. Without either,
 * Docker's `OOMKilled` says only whether there was one.
 */
-async function oomKills(id, engine) {
+async function oomKills(id, engine, user = SANDBOX_USER) {
 	const events = await docker([
 		"exec",
+		"--user",
+		user,
 		id,
 		"sh",
 		"-c",
@@ -3450,12 +3872,7 @@ async function createDockerSession(options) {
 		env,
 		engine
 	}).catch((error) => {
-		const sweep = () => sweepLabelDetached(`${LABEL.session}=${nonce}`, void 0, engine);
-		if (signal?.aborted) sweep();
-		if (/unable to find user|no matching entries in passwd/i.test(error.message)) {
-			sweep();
-			throw new Error(`${options.image} has no ${SANDBOX_USER} user to run the sandbox as. Images reeval builds have one: rebuild it (reeval image build), or start from reeval's image or ${spec.fn}({ from }). An eval that needs root at run time can opt in with ${spec.fn}({ root: true }).`);
-		}
+		if (signal?.aborted) sweepLabelDetached(`${LABEL.session}=${nonce}`, void 0, engine);
 		throw error;
 	});
 	let gateway;
@@ -3469,27 +3886,33 @@ async function createDockerSession(options) {
 		await remove();
 		throw signal.reason;
 	}
-	if (!spec.createsWorkdir) {
-		const made = await docker([
-			"exec",
-			"--user",
-			"0:0",
-			id,
-			"mkdir",
-			"-p",
-			SANDBOX_ROOT
-		], {
-			engine,
-			signal
-		}).catch((error) => ({
-			exitCode: 1,
-			stderr: error.message
-		}));
-		if (made.exitCode !== 0) {
-			await remove();
-			if (signal?.aborted) throw signal.reason;
-			throw new Error(`Couldn't create ${SANDBOX_ROOT} in the container: ${made.stderr.trim()}`);
-		}
+	const NO_USER = "reeval:no-sandbox-user";
+	const made = await docker([
+		"exec",
+		"--user",
+		"0:0",
+		id,
+		"/bin/sh",
+		"-c",
+		[
+			EXEC_UMASK,
+			...options.root ? [] : [`{ id -u ${SANDBOX_USER} >/dev/null 2>&1 || { echo ${NO_USER}; exit 1; }; }`],
+			...spec.createsWorkdir ? [] : [`mkdir -p ${SANDBOX_ROOT}`],
+			`mkdir -p ${SANDBOX_STATE} && chown 0:0 ${SANDBOX_STATE} && chmod 700 ${SANDBOX_STATE}`
+		].join(" && ")
+	], {
+		engine,
+		signal
+	}).catch((error) => ({
+		exitCode: 1,
+		stdout: Buffer.alloc(0),
+		stderr: error.message
+	}));
+	if (made.exitCode !== 0) {
+		await remove();
+		if (signal?.aborted) throw signal.reason;
+		if (made.stdout.toString("utf8").includes(NO_USER)) throw new Error(`${options.image} has no ${SANDBOX_USER} user to run the sandbox as. Images reeval builds have one: rebuild it (reeval image build), or start from reeval's image or ${spec.fn}({ from }). An eval that needs root at run time can opt in with ${spec.fn}({ root: true }).`);
+		throw new Error(`Couldn't set up the container: ${made.stderr.trim()}`);
 	}
 	const egressOptions = options.egress === true ? {} : options.egress || void 0;
 	let egress;
@@ -3541,10 +3964,12 @@ async function createDockerSession(options) {
 		...gateway.env,
 		...env
 	} : env;
+	const user = ["--user", execUser(options)];
 	let execs = 0;
 	const execArgs = (command, marker, cwd, env) => [
 		"exec",
 		"--interactive",
+		...user,
 		"--workdir",
 		cwd ? posix.resolve(SANDBOX_ROOT, cwd) : SANDBOX_ROOT,
 		"--env",
@@ -3553,17 +3978,23 @@ async function createDockerSession(options) {
 		id,
 		"bash",
 		"-c",
-		command
+		`${EXEC_UMASK}; ${command}`
 	];
 	const nextMarker = () => `${id.slice(0, 12)}-${++execs}`;
 	/**
 	* Killing the host's `docker exec` client doesn't stop the command in the container, so kill
 	* every process there that inherited this exec's marker: the command and all it started.
 	*/
-	const killExec = (marker) => docker([
+	const killExec = (marker, asRoot = false) => docker([
 		"exec",
+		...asRoot ? [
+			"--user",
+			"0:0",
+			"--env",
+			`PATH=${SYSTEM_PATH}`
+		] : user,
 		id,
-		"sh",
+		"/bin/sh",
 		"-c",
 		`for e in /proc/[0-9]*/environ; do grep -qsxzF ${shellQuote(`${EXEC_MARKER}=${marker}`)} "$e" && kill -9 "$(basename "$(dirname "$e")")" 2>/dev/null; done; true`
 	], { engine }).then(() => {}, () => {});
@@ -3586,9 +4017,42 @@ async function createDockerSession(options) {
 			throw error;
 		}
 	};
+	const runPrivileged = async (o) => {
+		const marker = nextMarker();
+		const args = [
+			"exec",
+			"--user",
+			"0:0",
+			"--workdir",
+			SANDBOX_STATE,
+			"--env",
+			`${EXEC_MARKER}=${marker}`,
+			"--env",
+			`PATH=${SYSTEM_PATH}`,
+			id,
+			"/bin/sh",
+			"-c",
+			`${EXEC_UMASK}; ${o.command}`
+		];
+		try {
+			const r = await docker(args, {
+				signal: o.abortSignal,
+				engine
+			});
+			return {
+				exitCode: r.exitCode,
+				stdout: r.stdout.toString("utf8"),
+				stderr: r.stderr
+			};
+		} catch (error) {
+			if (o.abortSignal?.aborted) await killExec(marker, true);
+			throw error;
+		}
+	};
 	const readBinaryFile = async (o) => {
 		const r = await docker([
 			"exec",
+			...user,
 			id,
 			"cat",
 			"--",
@@ -3601,13 +4065,29 @@ async function createDockerSession(options) {
 	};
 	const writeBinaryFile = async (o) => {
 		const path = posix.resolve(SANDBOX_ROOT, o.path);
+		const make = `${EXEC_UMASK} && mkdir -p ${shellQuote(posix.dirname(path))}`;
+		if (o.content.byteLength === 0) {
+			await dockerOk([
+				"exec",
+				...user,
+				id,
+				"sh",
+				"-c",
+				`${make} && : > ${shellQuote(path)}`
+			], {
+				signal: o.abortSignal,
+				engine
+			});
+			return;
+		}
 		await dockerOk([
 			"exec",
 			"--interactive",
+			...user,
 			id,
 			"sh",
 			"-c",
-			`mkdir -p ${shellQuote(posix.dirname(path))} && cat > ${shellQuote(path)}`
+			`${make} && cat > ${shellQuote(path)}`
 		], {
 			input: Buffer.from(o.content),
 			signal: o.abortSignal,
@@ -3646,8 +4126,9 @@ async function createDockerSession(options) {
 		},
 		...brokering,
 		...substituting,
-		oomKills: () => oomKills(id, engine),
+		oomKills: () => oomKills(id, engine, execUser(options)),
 		run,
+		runPrivileged,
 		async spawn(o) {
 			const env = envFor(o.env);
 			const marker = nextMarker();
@@ -3773,10 +4254,16 @@ const slugify = (text, max) => text.toLowerCase().replace(/[^a-z0-9]+/g, "-").re
 /** The build context of reeval's base image, shipped in the package. */
 const DOCKER_CONTEXT = fileURLToPath(ownFileURL("docker"));
 /**
+* How reeval bakes a harness into an image, beyond the build context and the adapter: bump it when
+* that changes what a baked image holds, so every image baked before rebuilds on its next use.
+*/
+const BAKE_REVISION = 2;
+/**
 * The image `docker({ from })` evals run in: `from` plus Node, git and the harness's CLI. The hash
-* covers the toolchain layer too, so a change to the sandbox user or paths builds anew.
+* covers the toolchain layer and {@link BAKE_REVISION} too, so a change to the sandbox user, paths
+* or how the harness is baked builds anew.
 */
-const harnessImageFor = (harness, from) => `${imageFor(harness)}-${slugify(from, 40) || "image"}-${sha256(toolchainDockerfile(from)).slice(0, 8)}`;
+const harnessImageFor = (harness, from) => `${imageFor(harness)}-${slugify(from, 40) || "image"}-${sha256(`${BAKE_REVISION}\0${toolchainDockerfile(from)}`).slice(0, 8)}`;
 /**
 * How each harness's CLI gets into an image: its adapter's bootstrap, and the binary it leaves
 * (or, for an adapter without one, a command that prints what it installed).
@@ -3786,22 +4273,22 @@ const BOOTSTRAPS = {
 		name: "Cursor",
 		cli: "@cursor/sdk",
 		version: `node -p "'@cursor/sdk ' + require(process.env.HOME + '/.ai-sdk-harness/.harness-bootstrap/cursor-sdk/node_modules/@cursor/sdk/package.json').version"`,
-		adapter: async () => (await import("./src-WD-zgQYZ.js")).createCursorSdk()
+		adapter: async () => (await import("./src-DrJSnoMR.js")).createCursorSdk()
 	},
 	"claude-code": {
 		name: "Claude Code",
 		cli: "claude",
-		adapter: async () => (await import("./dist-CuY4ehEk.js")).createClaudeCode()
+		adapter: async () => (await import("./dist-Dp_AJgYN.js")).createClaudeCode()
 	},
 	antigravity: {
 		name: "Antigravity",
 		cli: "agy",
-		adapter: async () => (await import("./src-_oI9AePb.js")).createAntigravity()
+		adapter: async () => (await import("./src-BAyg6CtQ.js")).createAntigravity()
 	},
 	opencode: {
 		name: "OpenCode",
 		cli: "opencode",
-		adapter: async () => (await import("./src-CLoOMVWI.js")).createOpenCode({
+		adapter: async () => (await import("./src-B3KCLZVk.js")).createOpenCode({
 			auth: { GOOGLE_GENERATIVE_AI_API_KEY: "unused" },
 			model: "google/unused"
 		})
@@ -3809,7 +4296,7 @@ const BOOTSTRAPS = {
 	goose: {
 		name: "Goose",
 		cli: "goose",
-		adapter: async () => (await import("./src-qsKCqv7a.js")).createGoose({
+		adapter: async () => (await import("./src-dhSTRN50.js")).createGoose({
 			auth: { GOOGLE_API_KEY: "unused" },
 			model: "unused"
 		})
@@ -3817,17 +4304,17 @@ const BOOTSTRAPS = {
 	pi: {
 		name: "pi",
 		cli: "pi",
-		adapter: async () => (await import("./src-DSYYPEOj.js")).createPi({ auth: { GEMINI_API_KEY: "unused" } })
+		adapter: async () => (await import("./src-BezgGX4X.js")).createPi({ auth: { GEMINI_API_KEY: "unused" } })
 	},
 	codex: {
 		name: "Codex",
 		cli: "codex",
-		adapter: async () => (await import("./src-DCFtJRp0.js")).createCodex({ auth: { OPENAI_API_KEY: "unused" } })
+		adapter: async () => (await import("./src-ChBhk06Q.js")).createCodex({ auth: { OPENAI_API_KEY: "unused" } })
 	},
 	fx: {
 		name: "fx",
 		cli: "fx",
-		adapter: async () => (await import("./src-BxfCKA3_.js")).createFx({
+		adapter: async () => (await import("./src-CoqZYspK.js")).createFx({
 			auth: { AI_GATEWAY_API_KEY: "unused" },
 			model: "unused/unused"
 		})
@@ -3835,7 +4322,7 @@ const BOOTSTRAPS = {
 	"grok-build": {
 		name: "Grok Build",
 		cli: "grok",
-		adapter: async () => (await import("./src-CcrQbpG8.js")).createGrokBuild({
+		adapter: async () => (await import("./src-3mP821Pt.js")).createGrokBuild({
 			auth: { XAI_API_KEY: "unused" },
 			model: "unused"
 		})
@@ -3843,11 +4330,21 @@ const BOOTSTRAPS = {
 };
 /** Keeps the image's `PATH` in login shells, which Debian's `/etc/profile` resets. */
 const profilePathScript = () => readFileSync(join(DOCKER_CONTEXT, "reeval-path.sh")).toString("base64");
+/** `from` as it goes after `FROM`: one word, so it can't add a stage name or another instruction. */
+function imageReference(from) {
+	if (!/^\S+$/.test(from)) throw new Error(`docker({ from }) is an image reference without spaces or line breaks (got ${JSON.stringify(from)})`);
+	return from;
+}
+/**
+* A CLI's `--version` output as a label value in `docker commit --change`: its first line, without
+* quotes, backslashes or anything else that could end the value and add an instruction.
+*/
+const versionLabel = (output) => (output.split(/\r?\n/)[0] ?? "").replace(/[^\w .+:/()@,~-]/g, "").trim().slice(0, 100) || "unknown";
 /**
 * Adds what the harness bridge needs to a Debian or Ubuntu based toolchain image: Node (copied
 * from the official image, so the base's own toolchain is untouched), pnpm, git, curl and bash.
 */
-const toolchainDockerfile = (from) => `FROM ${from}
+const toolchainDockerfile = (from) => `FROM ${imageReference(from)}
 SHELL ["/bin/sh", "-c"]
 RUN command -v apt-get >/dev/null || { echo "reeval needs a Debian or Ubuntu based image (glibc and apt-get)" >&2; exit 1; } \\
   && apt-get update \\
@@ -4023,9 +4520,13 @@ const removeQuietly = async (ref, engine) => {
 		ref
 	], { engine }).catch(() => {});
 };
-/** The hash of reeval's base image build context, which its images carry as a label. */
+/**
+* The hash of reeval's base image build context and {@link BAKE_REVISION}, which its images carry
+* as a label.
+*/
 function contextHash() {
 	const hash = createHash("sha256");
+	hash.update(`bake ${BAKE_REVISION}\0`);
 	for (const path of contextFiles(DOCKER_CONTEXT, join(DOCKER_CONTEXT, "Dockerfile"))) {
 		hash.update(`${path}\0`);
 		hash.update(readFileSync(join(DOCKER_CONTEXT, path)));
@@ -4157,7 +4658,7 @@ async function bake(session, bootstrap) {
 	}
 	const version = await session.run({ command: probe });
 	if (bootstrap.version && version.exitCode !== 0) throw new Error(`The harness bootstrap did not install ${bootstrap.cli}:\n${tail(version.stderr)}`);
-	return version.stdout.trim() || "unknown";
+	return versionLabel(version.stdout.trim());
 }
 /**
 * The image `docker({ install })` runs in: the commands on top of `parent`, tagged by the parent's
@@ -4231,6 +4732,108 @@ async function buildInstallLayer(parent, steps, options = {}) {
 	}
 	return tag;
 }
+/** Where a plugin layer leaves each built plugin, by its build's hash. */
+const PLUGIN_BUILDS_DIR = `${SANDBOX_ROOT}/plugin-builds`;
+/**
+* The sha256 of a plugin build's source as the layer gets it: every file `docker build` sends from
+* `context` (less `.dockerignore` and `.git`), with its executable bit or symlink target.
+*/
+function sourceTreeHash(context) {
+	const hash = createHash("sha256");
+	for (const path of contextFiles(context, null)) {
+		if (path === ".git" || path.startsWith(".git/")) continue;
+		const full = join(context, path);
+		const stat = lstatSync(full);
+		hash.update(`${path}\0${stat.mode & 73 ? "x" : "-"}\0`);
+		hash.update(stat.isSymbolicLink() ? readlinkSync(full) : readFileSync(full));
+		hash.update("\0");
+	}
+	return hash.digest("hex");
+}
+/** The hash a plugin layer's tag and directory carry: commit, tree and build. */
+const pluginBuildKey = (b) => sha256(JSON.stringify({
+	commit: b.commit,
+	tree: b.tree,
+	path: b.path,
+	cwd: b.cwd,
+	run: b.steps
+}));
+/** The image a plugin build makes on `parent`: the parent's id, then the build's hash. */
+const pluginLayerTag = (parent, b) => `reeval-plugin:${parent.id.replace(/^sha256:/, "").slice(0, 12)}-${pluginBuildKey(b).slice(0, 16)}`;
+/** Where a plugin layer leaves the plugin's directory. */
+const pluginBuildDir = (b) => `${PLUGIN_BUILDS_DIR}/${pluginBuildKey(b).slice(0, 16)}`;
+/** The line a plugin build's script fails with when its `cwd` isn't in the source. */
+const noCwd = (cwd) => `reeval: build cwd ${cwd} isn't a directory in the source`;
+/**
+* A plugin build's commands as one script, run from `cwd` under `src` (the source's root), stopping
+* at the first failure as an install script does, or before any when `cwd` isn't there.
+*/
+const pluginBuildScript = (b, src) => installScript(b.steps).replaceAll("reeval: install ", "reeval: build ").replace(/^cd \/\n/, `cd ${shellQuote(`${src}/${b.cwd}`)} || { echo ${shellQuote(noCwd(b.cwd))} >&2; exit 1; }\n`);
+/**
+* Builds a plugin's layer on `parent` if it's missing: the whole source, then its commands from
+* `cwd` as root with the sandbox user's home as HOME (as an install layer runs), keeping only the
+* plugin's directory at {@link pluginBuildDir}. Secrets and the workspace never exist here.
+*/
+async function buildPluginLayer(parent, b, options) {
+	const { signal, engine } = options;
+	const tag = pluginLayerTag(parent, b);
+	if ((await docker([
+		"image",
+		"inspect",
+		"--format",
+		"{{.Created}}",
+		tag
+	], {
+		signal,
+		engine
+	})).exitCode === 0) return tag;
+	const src = "/tmp/reeval-plugin-src";
+	const script = pluginBuildScript(b, src);
+	const encoded = Buffer.from(script).toString("base64");
+	const home = `$(getent passwd ${SANDBOX_USER} | cut -d: -f6)`;
+	const dir = pluginBuildDir(b);
+	const dockerfile = [
+		`FROM ${parent.ref}`,
+		"USER root",
+		`COPY . ${src}`,
+		`RUN rm -rf ${src}/.git && echo ${encoded} | base64 -d > /tmp/reeval-plugin-build.sh \\`,
+		`  && if id -u ${SANDBOX_USER} >/dev/null 2>&1; then export HOME="${home}"; fi \\`,
+		"  && bash /tmp/reeval-plugin-build.sh && rm /tmp/reeval-plugin-build.sh \\",
+		`  && mkdir -p ${dir} && cp -a ${shellQuote(`${src}/${b.path}`)}/. ${dir}/ && rm -rf ${src} ${dir}/.git \\`,
+		`  && chmod -R a+rX ${dir} \\`,
+		`  && { ! id -u ${SANDBOX_USER} >/dev/null 2>&1 || find "$HOME" -xdev ! -user ${SANDBOX_USER} -exec chown -h ${SANDBOX_USER}: {} +; }`,
+		`WORKDIR ${SANDBOX_ROOT}`
+	].join("\n");
+	const build = await docker([
+		"build",
+		"--progress",
+		"plain",
+		...BUILT_BY,
+		"--tag",
+		tag,
+		"-f",
+		"-",
+		b.context
+	], {
+		input: dockerfile,
+		signal,
+		engine
+	});
+	const output = `${build.stdout.toString("utf8")}${build.stderr}`;
+	options.output?.write(`${script}\n${dockerfile}\n\n${output}`);
+	if (build.exitCode !== 0) {
+		const failed = /reeval: build (\d+\/\d+) exited (\d+): (.*)/.exec(output);
+		const missing = output.includes(noCwd(b.cwd));
+		throw buildError(output, {
+			stage: "plugin",
+			ref: tag,
+			headline: `Building ${options.name}`,
+			log: options.output?.path ?? null,
+			engine
+		}, () => missing ? noCwd(b.cwd).slice(8) : failed ? `build ${failed[1]} exited ${failed[2]}: ${clipLine(failed[3] ?? "")}` : null, (line) => !line.startsWith("reeval: build "));
+	}
+	return tag;
+}
 /** The build arg a Dockerfile can start `FROM` to layer on reeval's sandbox image. */
 const REEVAL_BASE_ARG = "REEVAL_BASE";
 /**
@@ -4268,11 +4871,14 @@ function dockerignoreMatcher(text) {
 		return excluded;
 	};
 }
-/** Files in the build context that `docker build` would send, sorted, relative to `context`. */
+/**
+* Files in the build context that `docker build` would send, sorted, relative to `context`. A
+* Dockerfile read from stdin (`dockerfile` null) has no `<Dockerfile>.dockerignore` of its own.
+*/
 function contextFiles(context, dockerfile) {
-	const own = [`${dockerfile}.dockerignore`, join(context, ".dockerignore")].find(existsSync);
+	const own = [...dockerfile ? [`${dockerfile}.dockerignore`] : [], join(context, ".dockerignore")].find(existsSync);
 	const ignored = dockerignoreMatcher(own ? readFileSync(own, "utf8") : "");
-	const always = /* @__PURE__ */ new Set([relative(context, dockerfile), ".dockerignore"]);
+	const always = /* @__PURE__ */ new Set([...dockerfile ? [relative(context, dockerfile)] : [], ".dockerignore"]);
 	const files = [];
 	const walk = (rel) => {
 		for (const entry of readdirSync(join(context, rel), { withFileTypes: true })) {
@@ -4352,6 +4958,13 @@ async function buildDockerfile(dockerfile, options) {
 	return tag;
 }
 //#endregion
-export { removeContainerDetached as $, hostAllowed as A, WORKSPACE_DIR as B, applyTransformations as C, HARNESS_HOSTS as D, DOCKER_EGRESS as E, HARNESS_PACKAGES as F, docker as G, harnessLabel as H, LABEL as I, dockerOk as J, dockerAvailable as K, SANDBOX_HOME as L, BASE_IMAGE as M, BRIDGE_PORT as N, PACKAGE_HOSTS as O, DEFAULT_IMAGE as P, isRegistryDigest as Q, SANDBOX_ROOT as R, placeholder as S, onEndpoint as T, imageFor as U, adapterVersion as V, isBakedHarness as W, imageInfo as X, dockerState as Y, imageTags as Z, ROOT_CAPABILITIES as _, buildInstallLayer as a, causeLine as at, CA_PATH as b, dockerfileTag as c, parseBuildOutput as ct, installLayerTag as d, dockerSeccompFile as dt, onDockerCommand as et, installScript as f, engineSpec as ft, DEFAULT_LIMITS as g, usesReevalBase as h, buildImage as i, RETRY_DELAYS as it, BAKED_HARNESSES as j, defaultAllowedHosts as k, dockerignoreMatcher as l, retryTransient as lt, resolveFrom as m, REEVAL_BASE_ARG as n, shellQuote as nt, contextFiles as o, failureCause as ot, pruneImages as p, normalizeImageId as pt, dockerCapacity as q, buildDockerfile as r, ImageBuildError as rt, contextHash as s, isTransient as st, DOCKER_CONTEXT as t, run as tt, harnessImageFor as u, ENGINES as ut, createDockerSession as v, matches as w, PROXY_PORT as x, dockerSandboxProvider as y, SANDBOX_USER as z };
+//#region ../sandbox-docker/src/mcp-timer.ts
+/**
+* reeval's MCP start-up timer, shipped in the package: a Node script that runs a stdio MCP server
+* and logs when it answers `initialize` (see its header). It runs in any sandbox with `node`.
+*/
+const MCP_TIMER = fileURLToPath(ownFileURL("bin/mcp-timer.cjs"));
+//#endregion
+export { isBakedHarness as $, placeholder as A, BASE_IMAGE as B, DEFAULT_LIMITS as C, dockerSandboxProvider as D, createDockerSession as E, HARNESS_HOSTS as F, SANDBOX_HOME as G, DEFAULT_IMAGE as H, PACKAGE_HOSTS as I, SANDBOX_USER as J, SANDBOX_ROOT as K, defaultAllowedHosts as L, matches as M, onEndpoint as N, CA_PATH as O, DOCKER_EGRESS as P, imageFor as Q, hostAllowed as R, usesReevalBase as S, normalizeImageId as St, ROOT_CAPABILITIES as T, HARNESS_PACKAGES as U, BRIDGE_PORT as V, LABEL as W, adapterVersion as X, WORKSPACE_DIR as Y, harnessLabel as Z, pluginBuildKey as _, parseBuildOutput as _t, buildDockerfile as a, imageInfo as at, resolveFrom as b, dockerSeccompFile as bt, buildPluginLayer as c, removeContainerDetached as ct, dockerfileTag as d, shellQuote as dt, docker as et, dockerignoreMatcher as f, ImageBuildError as ft, pluginBuildDir as g, isTransient as gt, installScript as h, failureCause as ht, REEVAL_BASE_ARG as i, dockerState as it, applyTransformations as j, PROXY_PORT as k, contextFiles as l, onDockerCommand as lt, installLayerTag as m, causeLine as mt, DOCKER_CONTEXT as n, dockerCapacity as nt, buildImage as o, imageTags as ot, harnessImageFor as p, RETRY_DELAYS as pt, SANDBOX_STATE as q, PLUGIN_BUILDS_DIR as r, dockerOk as rt, buildInstallLayer as s, isRegistryDigest as st, MCP_TIMER as t, dockerAvailable as tt, contextHash as u, run as ut, pluginLayerTag as v, retryTransient as vt, PRIVILEGED_CAPABILITIES as w, sourceTreeHash as x, engineSpec as xt, pruneImages as y, ENGINES as yt, BAKED_HARNESSES as z };
 
-//# sourceMappingURL=src-ftu5wPSt.js.map
+//# sourceMappingURL=src-CIpKL45U.js.map