reeval 0.12.0 → 0.13.0

package/dist/{src-LekQrr_S.js → src-CIpKL45U.js}

@@ -1,4 +1,4 @@
-import { u as ownFileURL } from "./root-DICDHCtp.js";
+import { u as ownFileURL } from "./root-DNuLhaA5.js";
 import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, renameSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, posix, relative, win32 } from "node:path";
@@ -13,6 +13,7 @@ import http from "node:http";
 import http2 from "node:http2";
 import https from "node:https";
 import tls from "node:tls";
+import zlib from "node:zlib";
 import { lookup } from "node:dns/promises";
 //#region ../sandbox-docker/src/seccomp-profile.ts
 const DOCKER_SECCOMP_PROFILE = {
@@ -1620,11 +1621,11 @@ const HARNESS_PACKAGES = {
 	},
 	antigravity: {
 		name: "@reeval/harness-antigravity",
-		version: "0.1.9"
+		version: "0.1.11"
 	},
 	opencode: {
 		name: "@reeval/harness-opencode",
-		version: "0.2.8"
+		version: "0.2.9"
 	},
 	goose: {
 		name: "@reeval/harness-goose",
@@ -1632,7 +1633,7 @@ const HARNESS_PACKAGES = {
 	},
 	pi: {
 		name: "@reeval/harness-pi",
-		version: "0.2.7"
+		version: "0.2.8"
 	},
 	codex: {
 		name: "@reeval/harness-codex",
@@ -1644,7 +1645,7 @@ const HARNESS_PACKAGES = {
 	},
 	"grok-build": {
 		name: "@reeval/harness-grok-build",
-		version: "0.1.1"
+		version: "0.1.2"
 	}
 };
 /** Every harness with an image, in {@link HARNESS_PACKAGES} order. */
@@ -1827,7 +1828,8 @@ function ipv6Bytes(address) {
 //#region ../sandbox-docker/src/egress/mux.ts
 /**
 * Many TCP streams over one byte pipe (a `docker exec` stdio), with per-stream credit so a slow
-* reader only stalls its own stream. Frames are `type u8, id u32, length u32, payload`.
+* reader only stalls its own stream. Frames are `type u8, id u32, length u32, payload`, and a
+* payload is at most 64 KiB.
 *
 * Must stay self-contained, with no imports or references to module scope: the forwarder runs
 * this function's source inside the container.
@@ -1841,9 +1843,43 @@ function createMux(options) {
 	const READY = 6;
 	const windowSize = options.window ?? 262144;
 	const maxPayload = 65536;
+	/** The payload length each type must have, or its range. */
+	const LENGTHS = {
+		[OPEN]: [
+			"OPEN",
+			2,
+			2
+		],
+		[DATA]: [
+			"DATA",
+			0,
+			maxPayload
+		],
+		[FIN]: [
+			"FIN",
+			0,
+			0
+		],
+		[RST]: [
+			"RST",
+			0,
+			0
+		],
+		[WINDOW]: [
+			"WINDOW",
+			4,
+			4
+		],
+		[READY]: [
+			"READY",
+			0,
+			0
+		]
+	};
 	const streams = /* @__PURE__ */ new Map();
 	let nextId = options.parity === 0 ? 2 : 1;
 	let pending = Buffer.alloc(0);
+	let broken = false;
 	const frame = (type, id, payload = Buffer.alloc(0)) => {
 		const header = Buffer.alloc(9);
 		header.writeUInt8(type, 0);
@@ -1896,6 +1932,25 @@ function createMux(options) {
 		streams.set(id, state);
 		return stream;
 	};
+	/** Why a frame's header breaks the protocol, or null. */
+	const malformed = (type, id, length) => {
+		const expected = LENGTHS[type];
+		if (!expected) return `a frame of unknown type ${type}`;
+		const [name, min, max] = expected;
+		if (length > maxPayload) return `a frame too large (${length} bytes)`;
+		if (length < min || length > max) return `a malformed ${name} frame (${length} bytes, not ${min === max ? min : `0 to ${max}`} bytes)`;
+		if (type === OPEN && (id % 2 === options.parity || streams.has(id))) return `an OPEN frame for stream ${id}, which this side allocates or has open`;
+		return null;
+	};
+	const fail = (message) => {
+		broken = true;
+		pending = Buffer.alloc(0);
+		for (const state of [...streams.values()]) {
+			state.reset = true;
+			state.stream.destroy();
+		}
+		options.onError?.(`the peer sent ${message}`);
+	};
 	const handle = (type, id, payload) => {
 		if (type === READY) return options.onReady?.();
 		if (type === OPEN) return options.onOpen(create(id), payload.readUInt16BE(0));
@@ -1924,15 +1979,22 @@ function createMux(options) {
 	};
 	return {
 		receive(chunk) {
+			if (broken) return;
 			pending = pending.length ? Buffer.concat([pending, chunk]) : chunk;
-			while (pending.length >= 9) {
-				const length = pending.readUInt32BE(5);
-				if (pending.length < 9 + length) break;
-				const type = pending.readUInt8(0);
-				const id = pending.readUInt32BE(1);
-				const payload = pending.subarray(9, 9 + length);
-				pending = pending.subarray(9 + length);
-				handle(type, id, payload);
+			try {
+				while (pending.length >= 9) {
+					const type = pending.readUInt8(0);
+					const id = pending.readUInt32BE(1);
+					const length = pending.readUInt32BE(5);
+					const problem = malformed(type, id, length);
+					if (problem) return fail(problem);
+					if (pending.length < 9 + length) break;
+					const payload = pending.subarray(9, 9 + length);
+					pending = pending.subarray(9 + length);
+					handle(type, id, payload);
+				}
+			} catch (error) {
+				fail(`a frame it couldn't handle: ${error.message}`);
 			}
 		},
 		open(port) {
@@ -1986,6 +2048,10 @@ function forwarderMain(io, makeMux, linkStreams, proxyPort) {
 				host: "127.0.0.1",
 				allowHalfOpen: true
 			}), stream);
+		},
+		onError(message) {
+			io.error(`reeval egress forwarder: ${message}`);
+			io.exit(1);
 		}
 	});
 	io.input.on("data", (chunk) => mux.receive(chunk));
@@ -2066,13 +2132,45 @@ const normalise = (host) => host.toLowerCase().replace(/\.$/, "").replace(/^\[|\
 * mustn't resolve into them, or anyone who can add a DNS record under the pattern's domain
 * reaches the worker's LAN.
 */
-const PRIVATE = blockList([
+const PRIVATE_RANGES = [
 	"10.0.0.0/8",
 	"100.64.0.0/10",
 	"172.16.0.0/12",
 	"192.168.0.0/16",
 	"fc00::/7"
+];
+const PRIVATE = blockList(PRIVATE_RANGES);
+/**
+* Reachable only with an `allowedCIDRs` entry that covers them, so never under allow-all: the
+* gateway connects from the worker, so these would reach its LAN, the Docker host's bridge, cloud
+* metadata on a unique-local or CGNAT address (AWS's `fd00:ec2::254`, Alibaba's
+* `100.100.100.200`), multicast and broadcast. NAT64 addresses are checked by their embedded
+* IPv4 address as well.
+*/
+const RESERVED = blockList([
+	...PRIVATE_RANGES,
+	"224.0.0.0/4",
+	"255.255.255.255/32",
+	"ff00::/8",
+	"64:ff9b::/96"
 ]);
+const NAT64 = blockList(["64:ff9b::/96"]);
+/** The IPv4 address in the last 32 bits of an IPv6 address, as `a.b.c.d`. */
+function embeddedIPv4(address) {
+	const tail = address.slice(address.lastIndexOf(":") + 1);
+	if (isIP(tail) === 4) return tail;
+	const groups = address.split(":");
+	const low = Number.parseInt(groups.at(-1) || "0", 16);
+	const high = groups.length > 1 ? Number.parseInt(groups.at(-2) || "0", 16) : 0;
+	return [
+		high >> 8,
+		high & 255,
+		low >> 8,
+		low & 255
+	].join(".");
+}
+/** The address, and for a NAT64 address the IPv4 address it reaches too. */
+const reaches = (address) => isIP(address) === 6 && inList(NAT64, address) ? [address, embeddedIPv4(address)] : [address];
 /** How `host` matches: listed as it is, only by a `*.` pattern (never an IP address), or not. */
 function hostMatch(patterns, host) {
 	const h = normalise(host);
@@ -2105,7 +2203,7 @@ function createPolicyCheck(policy, options = {}) {
 			reason: "the policy denies all egress"
 		};
 		const listed = hostMatch(custom?.allowedHosts ?? [], host);
-		if (custom && !listed && !custom.allowedCIDRs?.length) return {
+		if (custom && !listed && !(custom.allowedCIDRs?.length && isIP(host))) return {
 			allowed: false,
 			status: 403,
 			reason: `${host} isn't in the allowlist`
@@ -2126,16 +2224,26 @@ function createPolicyCheck(policy, options = {}) {
 			status: 502,
 			reason: `${host} has no addresses`
 		};
-		if (addresses.some((a) => inList(always, a))) return {
+		const reached = addresses.flatMap(reaches);
+		if (reached.some((a) => inList(always, a))) return {
 			allowed: false,
 			status: 403,
 			reason: `${host} is a loopback or link-local address`
 		};
+		const reserved = reached.find((a) => inList(RESERVED, a) && !inList(allowedCidrs, a));
+		if (reserved) {
+			const which = reserved === host ? host : `${host} (${reserved})`;
+			return {
+				allowed: false,
+				status: 403,
+				reason: custom ? `${which} is a private or reserved address; list the address itself in the allowlist to reach it` : `${which} is a private or reserved address, which allow-all doesn't reach; list the address in an allowlist to reach it`
+			};
+		}
 		if (!custom) return {
 			allowed: true,
 			address: first
 		};
-		if (addresses.some((a) => inList(deniedCidrs, a))) return {
+		if (reached.some((a) => inList(deniedCidrs, a))) return {
 			allowed: false,
 			status: 403,
 			reason: `${host} is in a denied range`
@@ -2190,6 +2298,35 @@ const onEndpoint = (endpoints, request) => endpoints.some((match) => matches({
 }, request));
 /** Whether the gateway must decrypt connections to `host`: some rule could apply there. */
 const decrypts = (rules, host) => rules.some((r) => normaliseHost(r.match.host) === normaliseHost(host));
+/** What a credential the sandbox never sent comes back as. */
+const REDACTED = "reeval_redacted_credential";
+/** Shorter values aren't credentials, and scrubbing them would mangle ordinary text. */
+const MIN_CREDENTIAL = 16;
+const schemeAndToken = (value) => /^([A-Za-z][\w-]*) +(\S+)$/.exec(value);
+/**
+* The values credential rules for `host` set (rules keyed on a header the sandbox sends, such as
+* a placeholder key), each paired with what the sandbox sent in its place, for scrubbing from
+* responses. A value with a scheme (`Bearer <key>`) is paired as a whole and by its token too.
+*/
+function credentialValues(rules, host) {
+	const pairs = /* @__PURE__ */ new Map();
+	const add = (value, shown) => {
+		if (value.length >= MIN_CREDENTIAL && value !== shown && !pairs.has(value)) pairs.set(value, shown);
+	};
+	for (const rule of rules) {
+		const keyed = rule.match.headers ?? [];
+		if (!keyed.length || normaliseHost(rule.match.host) !== normaliseHost(host)) continue;
+		for (const [name, value] of Object.entries(rule.transform.headers)) {
+			const sent = keyed.find((m) => m.key && "exact" in m.key && m.key.exact.toLowerCase() === name.toLowerCase())?.value;
+			const shown = sent && "exact" in sent ? sent.exact : REDACTED;
+			add(value, shown);
+			const token = schemeAndToken(value);
+			const shownToken = schemeAndToken(shown);
+			if (token?.[2]) add(token[2], shownToken?.[2] ?? REDACTED);
+		}
+	}
+	return [...pairs];
+}
 /**
 * The request's headers after every matching rule, in order, so later rules win. Returns the
 * (lower-case) names that were replaced, for logging without values. With `endpoints`, no rule
@@ -2298,59 +2435,75 @@ function scrubHeaders(subs, headers) {
 	const one = (v) => scrubValue(subs, v);
 	return Object.fromEntries(Object.entries(headers).map(([k, v]) => [k, v === void 0 ? v : Array.isArray(v) ? v.map(one) : one(String(v))]));
 }
+const bufferPairs = (pairs) => pairs.filter(([from]) => from.length > 0).map(([from, to]) => [Buffer.from(from), Buffer.from(to)]);
+/**
+* Replaces every whole match in `data` (original bytes only: output is never re-scanned), and
+* returns where the unscanned tail starts: `data.length` when `final`, else the start of the
+* shortest tail that could begin a match, so only bytes a later chunk might complete are held.
+*/
+function scan(pairs, data, final) {
+	const parts = [];
+	let pos = 0;
+	let count = 0;
+	for (;;) {
+		let best = -1;
+		let pair;
+		for (const p of pairs) {
+			const i = data.indexOf(p[0], pos);
+			if (i !== -1 && (best === -1 || i < best)) {
+				best = i;
+				pair = p;
+			}
+		}
+		if (best === -1 || !pair) break;
+		parts.push(data.subarray(pos, best), pair[1]);
+		pos = best + pair[0].length;
+		count++;
+	}
+	let rest = data.length;
+	if (!final) {
+		const hold = Math.max(0, ...pairs.map(([from]) => from.length - 1));
+		for (let i = Math.max(pos, data.length - hold); i < data.length; i++) {
+			const tail = data.subarray(i);
+			if (pairs.some(([from]) => from.subarray(0, tail.length).equals(tail))) {
+				rest = i;
+				break;
+			}
+		}
+	}
+	parts.push(data.subarray(pos, rest));
+	return {
+		out: Buffer.concat(parts),
+		rest,
+		count
+	};
+}
+/** `data` with every `from` replaced by its `to`, in one pass. */
+const replaceAll = (data, pairs) => scan(bufferPairs(pairs), data, true).out;
 /**
-* Replaces byte strings in a stream, including across chunk boundaries: it holds back the
-* longest `from` less one byte, so a match split between chunks is still found.
+* Replaces byte strings in a stream, including across chunk boundaries: it holds back a chunk's
+* tail while it could be the start of a match, so a match split between chunks is still found.
 */
 var ReplaceStream = class extends Transform {
 	#pairs;
-	#hold;
 	#tail = Buffer.alloc(0);
 	/** How many replacements were made. */
 	count = 0;
 	constructor(pairs) {
 		super();
-		this.#pairs = pairs.filter(([from]) => from.length > 0).map(([from, to]) => [Buffer.from(from), Buffer.from(to)]);
-		this.#hold = Math.max(0, ...this.#pairs.map(([from]) => from.length - 1));
-	}
-	/**
-	* Replaces every whole match in `data` (original bytes only: output is never re-scanned), and
-	* returns where the unscanned tail starts, which is `data.length` when `final`.
-	*/
-	#scan(data, final) {
-		const parts = [];
-		let pos = 0;
-		for (;;) {
-			let best = -1;
-			let pair;
-			for (const p of this.#pairs) {
-				const i = data.indexOf(p[0], pos);
-				if (i !== -1 && (best === -1 || i < best)) {
-					best = i;
-					pair = p;
-				}
-			}
-			if (best === -1 || !pair) break;
-			parts.push(data.subarray(pos, best), pair[1]);
-			pos = best + pair[0].length;
-			this.count++;
-		}
-		const rest = final ? data.length : Math.max(pos, data.length - this.#hold);
-		parts.push(data.subarray(pos, rest));
-		return {
-			out: Buffer.concat(parts),
-			rest
-		};
+		this.#pairs = bufferPairs(pairs);
 	}
 	_transform(chunk, _enc, done) {
 		const data = Buffer.concat([this.#tail, chunk]);
-		const { out, rest } = this.#scan(data, false);
+		const { out, rest, count } = scan(this.#pairs, data, false);
+		this.count += count;
 		this.#tail = Buffer.from(data.subarray(rest));
 		if (out.length) this.push(out);
 		done();
 	}
 	_flush(done) {
-		const { out } = this.#scan(this.#tail, true);
+		const { out, count } = scan(this.#pairs, this.#tail, true);
+		this.count += count;
 		if (out.length) this.push(out);
 		done();
 	}
@@ -2406,6 +2559,85 @@ function tokeniseResponse(derived, body, known) {
 	};
 }
 //#endregion
+//#region ../sandbox-docker/src/egress/websocket.ts
+/** The most a message may hold while its frames are gathered to be scrubbed. */
+const MAX_MESSAGE = 16777216;
+/** One unmasked frame, as a server sends it. */
+function frame(first, payload) {
+	const n = payload.length;
+	if (n < 126) return Buffer.concat([Buffer.from([first, n]), payload]);
+	const head = Buffer.alloc(n < 65536 ? 4 : 10);
+	head[0] = first;
+	if (n < 65536) {
+		head[1] = 126;
+		head.writeUInt16BE(n, 2);
+	} else {
+		head[1] = 127;
+		head.writeBigUInt64BE(BigInt(n), 2);
+	}
+	return Buffer.concat([head, payload]);
+}
+/**
+* Server-to-client WebSocket frames with every real value put back as its placeholder. Each data
+* message is gathered whole, so a value split across its frames is still found, and sent on as
+* one frame; control frames pass straight through, even between a message's frames. A
+* compressed frame (the upgrade request goes up without extensions, so a server shouldn't send
+* one), or a message over 16 MiB, errors the stream rather than pass unread.
+*/
+function webSocketScrubber(subs) {
+	const pairs = subs.map((s) => [s.value, s.placeholder]);
+	let pending = Buffer.alloc(0);
+	let message = null;
+	return new Transform({ transform(chunk, _encoding, done) {
+		pending = pending.length ? Buffer.concat([pending, chunk]) : chunk;
+		const out = [];
+		while (pending.length >= 2) {
+			const first = pending[0] ?? 0;
+			const second = pending[1] ?? 0;
+			let length = second & 127;
+			let at = 2;
+			if (length === 126) {
+				if (pending.length < 4) break;
+				length = pending.readUInt16BE(2);
+				at = 4;
+			} else if (length === 127) {
+				if (pending.length < 10) break;
+				const big = pending.readBigUInt64BE(2);
+				if (big > BigInt(MAX_MESSAGE)) return done(/* @__PURE__ */ new Error("a WebSocket frame over 16 MiB"));
+				length = Number(big);
+				at = 10;
+			}
+			const masked = (second & 128) !== 0;
+			const maskAt = at;
+			if (masked) at += 4;
+			if (pending.length < at + length) break;
+			const payload = Buffer.from(pending.subarray(at, at + length));
+			if (masked) for (let i = 0; i < payload.length; i++) payload[i] = (payload[i] ?? 0) ^ (pending[maskAt + i % 4] ?? 0);
+			pending = pending.subarray(at + length);
+			const opcode = first & 15;
+			if (first & 112) return done(/* @__PURE__ */ new Error("a compressed or extended WebSocket frame, which can't be scrubbed"));
+			if (opcode >= 8) {
+				out.push(frame(first, payload));
+				continue;
+			}
+			if (opcode === 0 ? !message : message) return done(/* @__PURE__ */ new Error("WebSocket frames out of order"));
+			message ??= {
+				opcode,
+				parts: [],
+				size: 0
+			};
+			message.parts.push(payload);
+			message.size += payload.length;
+			if (message.size > MAX_MESSAGE) return done(/* @__PURE__ */ new Error("a WebSocket message over 16 MiB"));
+			if (first & 128) {
+				out.push(frame(128 | message.opcode, replaceAll(Buffer.concat(message.parts), pairs)));
+				message = null;
+			}
+		}
+		done(null, out.length ? Buffer.concat(out) : void 0);
+	} });
+}
+//#endregion
 //#region ../sandbox-docker/src/egress/proxy.ts
 const HOP_BY_HOP = /* @__PURE__ */ new Set([
 	"connection",
@@ -2429,6 +2661,11 @@ function parseAuthority(authority, defaultPort) {
 		port: Number(m?.[2] ?? defaultPort)
 	};
 }
+/** `host` or `host:port` for a Host header or URL, IPv6 in brackets. */
+const authorityOf = (host, port) => {
+	const name = net.isIPv6(host) ? `[${host}]` : host;
+	return port === 443 ? name : `${name}:${port}`;
+};
 const pathOnly = (path) => path.split("?")[0];
 function reply(socket, status, reason) {
 	const text = http.STATUS_CODES[status] ?? "";
@@ -2439,6 +2676,15 @@ const counter = (count) => new Transform({ transform(chunk, _encoding, done) {
 	count(chunk.length);
 	done(null, chunk);
 } });
+/** The response encodings the gateway can decode to scrub a body. */
+const DECODERS = {
+	gzip: () => zlib.createGunzip(),
+	"x-gzip": () => zlib.createGunzip(),
+	deflate: () => zlib.createInflate(),
+	br: () => zlib.createBrotliDecompress()
+};
+/** Text a credential could be echoed into, or no type at all. */
+const isText = (type) => !type.trim() || /^\s*(text\/|application\/(json|xml|javascript|x-www-form-urlencoded|x-ndjson|[\w.-]+\+(json|xml))\b)/i.test(type);
 const plainHeaders = (headers) => Object.fromEntries(Object.entries(headers).flatMap(([k, v]) => v === void 0 ? [] : [[k, Array.isArray(v) ? v.map(String) : String(v)]]));
 function createEgressProxy(options) {
 	const log = options.log ?? (() => {});
@@ -2685,25 +2931,39 @@ function createEgressProxy(options) {
 		} catch {
 			return res.writeHead(400).end("reeval egress gateway: expected an absolute URL\n");
 		}
-		if (url.protocol !== "http:") return res.writeHead(400).end("reeval egress gateway: http only\n");
-		const { host, port } = parseAuthority(url.host, 80);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return res.writeHead(400).end(`reeval egress gateway: expected an http:// or https:// URL, not ${url.protocol}\n`);
+		const secure = url.protocol === "https:";
+		const { host, port } = parseAuthority(url.host, secure ? 443 : 80);
+		const shown = secure ? `https://${host}` : `http://${host}:${port}`;
 		const done = requestEvent(res, {
 			method: req.method ?? "GET",
-			url: `http://${host}:${port}${url.pathname}`,
+			url: `${shown}${url.pathname}`,
 			host,
 			port,
-			via: "http",
+			via: secure ? "decrypted" : "http",
 			requestHeaders: plainHeaders(req.headers)
 		});
 		check(host).then((verdict) => {
 			if (!verdict.allowed) {
-				log(`reeval:egress ${req.method} http://${host}:${port} denied (${verdict.reason})`);
+				log(`reeval:egress ${req.method} ${shown} denied (${verdict.reason})`);
 				block(req.socket, host, port, verdict.reason);
 				done.refuse(verdict.reason);
 				return res.writeHead(verdict.status).end(`blocked by the reeval egress policy: ${verdict.reason}\n`);
 			}
-			log(`reeval:egress ${req.method} http://${host}:${port}${url.pathname}`);
 			contact(req.socket, host, port);
+			if (secure) {
+				const headers = {
+					...req.headers,
+					host: url.host
+				};
+				onDecrypted({
+					host,
+					port,
+					address: verdict.address
+				}, req, res, url.pathname + url.search, headers, done);
+				return;
+			}
+			log(`reeval:egress ${req.method} http://${host}:${port}${url.pathname}`);
 			const upstream = http.request({
 				host: verdict.address,
 				port,
@@ -2714,7 +2974,12 @@ function createEgressProxy(options) {
 					host: url.host
 				}
 			});
-			forwardHttp1(req.pipe(counter(done.sent)), res, upstream, [], void 0, done);
+			forwardHttp1(req.pipe(counter(done.sent)), res, upstream, {
+				own: [],
+				creds: [],
+				url: `${shown}${url.pathname}`,
+				t: done
+			});
 		});
 	});
 	front.on("upgrade", (_req, socket) => {
@@ -2739,6 +3004,21 @@ function createEgressProxy(options) {
 	* is refused (already logged): a Host that isn't the CONNECT target, or an unbrokered endpoint.
 	*/
 	function transformed(target, method, path, headers, version) {
+		if (!path.startsWith("/") && !(method === "OPTIONS" && path === "*")) {
+			const reason = `reeval egress gateway: expected a path in the request line on a connection to ${target.host}, not an absolute URL.`;
+			log(`reeval:egress ${method} https://${target.host} refused (absolute-form target)`);
+			return {
+				headers: {},
+				path,
+				own: [],
+				names: [],
+				credentials: [],
+				refused: {
+					status: 400,
+					reason
+				}
+			};
+		}
 		const named = String(headers[":authority"] ?? headers.host ?? "");
 		const asked = parseAuthority(named, target.port).host;
 		if (named && asked !== target.host) {
@@ -2806,7 +3086,7 @@ function createEgressProxy(options) {
 			path,
 			headers: {}
 		});
-		if (scrubbedInBodies(own).length || exchange || readsModel) delete substituted.headers["accept-encoding"];
+		if (scrubbedInBodies(own).length || credentialValues(rules, target.host).length || exchange || readsModel) delete substituted.headers["accept-encoding"];
 		const notes = [
 			replaced.length ? `set ${replaced.join(", ")}` : "",
 			substituted.names.length ? `substituted ${substituted.names.join(", ")}` : "",
@@ -2833,19 +3113,72 @@ function createEgressProxy(options) {
 		delete headers["content-length"];
 		return counted.pipe(bodySubstituter(own));
 	}
-	/** The response body as sent to the sandbox: real values put back as placeholders. */
 	const scrubs = options.scrubResponses !== false;
-	function responseBody(up, own, t, readsModel = false) {
+	/**
+	* The harness credentials the rules set on `host`, shaped as substitutions that are never
+	* swapped in, only scrubbed from responses.
+	*/
+	const credentialScrubs = (host) => credentialValues(rules, host).map(([value, shown]) => ({
+		name: "credential",
+		placeholder: shown,
+		value,
+		hosts: [host],
+		in: []
+	}));
+	function scrubPlan(status, headers, own, creds) {
+		if (!scrubs || status === 204 || status === 304) return { body: [] };
+		const type = String(headers["content-type"] ?? "");
+		const body = [...scrubbedInBodies(own), ...status >= 300 || isText(type) ? creds : []];
+		const encoding = String(headers["content-encoding"] ?? "identity").toLowerCase();
+		if (!body.length || encoding === "identity") return { body };
+		if (encoding in DECODERS) return {
+			body,
+			decode: encoding
+		};
+		return {
+			body,
+			refuse: `the response is ${encoding}-encoded, so it can't be scrubbed`
+		};
+	}
+	/**
+	* The response body as sent to the sandbox: decoded if the plan says so, with real values put
+	* back as placeholders. An error anywhere upstream of it (a corrupt encoding) errors it.
+	*/
+	function responseBody(up, plan, t, readsModel = false) {
 		if (readsModel && t) readModel(up, t);
-		const body = scrubbedInBodies(own).length && scrubs ? up.pipe(scrubber(own)) : up;
-		return t ? body.pipe(counter(t.received)) : body;
+		const into = (from, to) => {
+			from.once("error", (error) => to.destroy(error));
+			return from.pipe(to);
+		};
+		let body = up;
+		const decoder = plan.decode ? DECODERS[plan.decode] : void 0;
+		if (decoder) body = into(body, decoder());
+		if (plan.body.length) body = into(body, scrubber(plan.body));
+		return t ? into(body, counter(t.received)) : body;
 	}
-	const responseHeaders = (headers, own) => {
+	/** Header (and trailer) values with every real value put back as its placeholder. */
+	const scrubbedHeaders = (headers, all) => {
 		const out = endToEnd(headers);
-		if (!own.length || !scrubs) return out;
-		if (scrubbedInBodies(own).length) delete out["content-length"];
-		return scrubHeaders(own, out);
+		if (!all.length || !scrubs) return out;
+		return scrubHeaders(all, out);
 	};
+	const responseHeaders = (headers, own, creds, plan) => {
+		const out = scrubbedHeaders(headers, [...own, ...creds]);
+		if (plan.body.length) delete out["content-length"];
+		if (plan.decode) delete out["content-encoding"];
+		return out;
+	};
+	/** Answers a response the gateway won't pass on with a 502 saying why. */
+	function refuseResponse(res, up, url, why, t) {
+		log(`reeval:egress ${url} response refused (${why})`);
+		up.resume();
+		t?.set({
+			status: 502,
+			reason: why
+		});
+		if (res.headersSent) return res.destroy();
+		res.writeHead(502, { "content-type": "text/plain" }).end(`reeval egress gateway: ${why}\n`);
+	}
 	/**
 	* How far into a response the gateway looks for the model that served it: OpenAI's first event
 	* echoes the request's instructions and tools before it.
@@ -2874,7 +3207,7 @@ function createEgressProxy(options) {
 	* A token exchange's response, read whole, with each token replaced by a placeholder. A success
 	* that can't be read (compressed, too big, not JSON) is a 502: the real tokens never go through.
 	*/
-	function tokenised(exchange, url, status, headers, up, res, own, t) {
+	function tokenised(exchange, url, status, headers, up, res, own, creds, t) {
 		const chunks = [];
 		let size = 0;
 		const refuse = (why) => {
@@ -2883,15 +3216,20 @@ function createEgressProxy(options) {
 `);
 			else res.destroy();
 		};
-		const scrubbed = responseBody(up, own, t);
+		const plan = scrubPlan(status, headers, own, creds);
+		if (plan.refuse) {
+			up.resume();
+			return refuse(plan.refuse);
+		}
+		const scrubbed = responseBody(up, plan, t);
 		scrubbed.on("data", (chunk) => {
 			size += chunk.length;
 			if (size <= EXCHANGE_LIMIT) chunks.push(chunk);
 		});
-		up.once("error", (error) => refuse(error.message));
+		scrubbed.once("error", (error) => refuse(error.message));
 		scrubbed.once("end", () => {
 			const body = Buffer.concat(chunks);
-			const out = responseHeaders(headers, own);
+			const out = responseHeaders(headers, own, creds, plan);
 			t?.set({ responseHeaders: plainHeaders(out) });
 			if (status < 200 || status >= 300) return res.writeHead(status, out).end(body);
 			const encoding = String(headers["content-encoding"] ?? "identity");
@@ -2913,10 +3251,10 @@ function createEgressProxy(options) {
 			}).end(text);
 		});
 	}
-	async function onDecrypted(target, req, res) {
+	async function onDecrypted(target, req, res, asked = req.url ?? "/", sent = req.headers, tracker) {
 		const method = req.method ?? "GET";
-		const url = `https://${target.host}${pathOnly(req.url ?? "/")}`;
-		const t = requestEvent(res, {
+		const url = `https://${target.host}${pathOnly(asked)}`;
+		const t = tracker ?? requestEvent(res, {
 			method,
 			url,
 			host: target.host,
@@ -2924,7 +3262,7 @@ function createEgressProxy(options) {
 			via: "decrypted",
 			requestHeaders: plainHeaders(req.headers)
 		});
-		const { headers, path, own, names, credentials, refused, exchange, readsModel } = transformed(target, method, req.url ?? "/", req.headers, req.httpVersion);
+		const { headers, path, own, names, credentials, refused, exchange, readsModel } = transformed(target, method, asked, sent, req.httpVersion);
 		t.set({
 			substituted: names,
 			credentials
@@ -2937,7 +3275,7 @@ function createEgressProxy(options) {
 		delete headers.upgrade;
 		delete headers.connection;
 		const body = requestBody(req, headers, own, t);
-		const authority = target.port === 443 ? target.host : `${target.host}:${target.port}`;
+		const authority = authorityOf(target.host, target.port);
 		const session = req.httpVersionMajor === 2 ? await upstreamSession(target) : null;
 		if (!session) return forwardHttp1(body, res, https.request({
 			host: target.address,
@@ -2951,10 +3289,14 @@ function createEgressProxy(options) {
 			},
 			agent,
 			ca
-		}), own, exchange && {
-			exchange,
-			url
-		}, t, readsModel);
+		}), {
+			own,
+			creds: credentialScrubs(target.host),
+			url,
+			...exchange ? { exchange } : {},
+			...t ? { t } : {},
+			readsModel: !!readsModel
+		});
 		const stream = session.request({
 			...headers,
 			":method": method,
@@ -2967,30 +3309,41 @@ function createEgressProxy(options) {
 			else res.destroy();
 		};
 		stream.once("error", fail);
+		const creds = credentialScrubs(target.host);
 		stream.once("response", (h) => {
-			if (exchange) return tokenised(exchange, url, Number(h[":status"]), h, stream, res, own, t);
-			const out = responseHeaders(h, own);
-			t.set({ responseHeaders: plainHeaders(out) });
-			res.writeHead(Number(h[":status"]), out);
-			stream.once("trailers", (trailers) => res.addTrailers(responseHeaders(trailers, own)));
-			responseBody(stream, own, t, readsModel).pipe(res);
+			const status = Number(h[":status"]);
+			if (exchange) return tokenised(exchange, url, status, h, stream, res, own, creds, t);
+			if (!respond(status, h, stream, res, own, creds, url, t, readsModel)) return;
+			stream.once("trailers", (trailers) => res.addTrailers(scrubbedHeaders(trailers, [...own, ...creds])));
 		});
 		body.pipe(stream);
 		req.once("aborted", () => stream.close(http2.constants.NGHTTP2_CANCEL));
 	}
-	function forwardHttp1(req, res, upstream, own = [], tokenise, t, readsModel = false) {
+	/**
+	* Sends an upstream response on to the sandbox, scrubbed. False when it was refused instead,
+	* already answered with a 502.
+	*/
+	function respond(status, headers, up, res, own, creds, url, t, readsModel = false) {
+		const plan = scrubPlan(status, headers, own, creds);
+		if (plan.refuse) {
+			refuseResponse(res, up, url, plan.refuse, t);
+			return false;
+		}
+		const out = responseHeaders(headers, own, creds, plan);
+		t?.set({ responseHeaders: plainHeaders(out) });
+		res.writeHead(status, out);
+		responseBody(up, plan, t, readsModel).once("error", () => res.destroy()).pipe(res);
+		return true;
+	}
+	function forwardHttp1(req, res, upstream, to) {
+		const { own, creds, url, exchange, t } = to;
 		upstream.once("response", (up) => {
-			if (tokenise) {
-				const { exchange, url } = tokenise;
-				return tokenised(exchange, url, up.statusCode ?? 502, up.headers, up, res, own, t);
-			}
-			const out = responseHeaders(up.headers, own);
-			t?.set({ responseHeaders: plainHeaders(out) });
-			res.writeHead(up.statusCode ?? 502, out);
+			const status = up.statusCode ?? 502;
+			if (exchange) return tokenised(exchange, url, status, up.headers, up, res, own, creds, t);
+			if (!respond(status, up.headers, up, res, own, creds, url, t, to.readsModel)) return;
 			up.once("end", () => {
-				if (Object.keys(up.trailers).length) res.addTrailers(responseHeaders(up.trailers, own));
+				if (Object.keys(up.trailers).length) res.addTrailers(scrubbedHeaders(up.trailers, [...own, ...creds]));
 			});
-			responseBody(up, own, t, readsModel).pipe(res);
 		});
 		upstream.once("error", (error) => {
 			t?.set({
@@ -3006,7 +3359,9 @@ function createEgressProxy(options) {
 		const method = req.method ?? "GET";
 		const startedAt = Date.now();
 		const { headers, path, own, names, credentials, refused } = transformed(target, method, req.url ?? "/", req.headers, req.httpVersion);
-		const scrubbed = (value) => scrubs ? scrubValue(own, value) : value;
+		const all = scrubs ? [...own, ...credentialScrubs(target.host)] : [];
+		const scrubbed = (value) => scrubValue(all, value);
+		if (all.length) delete headers["sec-websocket-extensions"];
 		const upgraded = (fields) => emit({
 			type: "request",
 			method,
@@ -3044,7 +3399,7 @@ function createEgressProxy(options) {
 			ca
 		});
 		upstream.once("upgrade", (up, upSocket, upHead) => {
-			const out = scrubs ? scrubHeaders(own, up.headers) : up.headers;
+			const out = scrubHeaders(all, up.headers);
 			upgraded({
 				status: up.statusCode,
 				responseHeaders: plainHeaders(out)
@@ -3052,9 +3407,20 @@ function createEgressProxy(options) {
 			const lines = [`HTTP/1.1 ${up.statusCode} ${up.statusMessage}`];
 			for (let i = 0; i < up.rawHeaders.length; i += 2) lines.push(`${up.rawHeaders[i]}: ${scrubbed(up.rawHeaders[i + 1] ?? "")}`);
 			socket.write(`${lines.join("\r\n")}\r\n\r\n`);
-			if (upHead.length) socket.write(upHead);
 			if (head.length) upSocket.write(head);
-			link(socket, track(upSocket));
+			track(upSocket);
+			if (!all.length) {
+				if (upHead.length) socket.write(upHead);
+				return link(socket, upSocket);
+			}
+			const frames = webSocketScrubber(all);
+			if (upHead.length) frames.write(upHead);
+			upSocket.pipe(frames);
+			upSocket.once("error", (error) => frames.destroy(error));
+			link(socket, Duplex.from({
+				readable: frames,
+				writable: upSocket
+			}));
 		});
 		upstream.once("response", (up) => {
 			reply(socket, up.statusCode ?? 502, `upstream refused the upgrade (${up.statusCode})`);
@@ -3082,7 +3448,7 @@ function createEgressProxy(options) {
 					socket.destroy();
 					return resolve(null);
 				}
-				const session = http2.connect(`https://${key}`, { createConnection: () => socket });
+				const session = http2.connect(`https://${authorityOf(target.host, target.port)}`, { createConnection: () => socket });
 				session.on("error", () => {});
 				session.once("close", () => sessions.get(key) === session && sessions.delete(key));
 				session.once("goaway", () => sessions.get(key) === session && sessions.delete(key));
@@ -3192,6 +3558,7 @@ async function startGateway(containerId, options, signal, engine) {
 	});
 	child.stdin.on("error", () => {});
 	let closed = false;
+	let started = false;
 	const mux = createMux({
 		Duplex,
 		parity: 0,
@@ -3202,7 +3569,15 @@ async function startGateway(containerId, options, signal, engine) {
 			if (port === 43128) proxy.handle(stream);
 			else stream.destroy();
 		},
-		onReady: () => ready.resolve()
+		onReady: () => {
+			started = true;
+			ready.resolve();
+		},
+		onError: (message) => {
+			if (!started) return;
+			stop(`the forwarder's output broke the protocol: ${message}`);
+			child.kill("SIGKILL");
+		}
 	});
 	const ready = {};
 	ready.promise = new Promise((resolve, reject) => Object.assign(ready, {
@@ -3214,17 +3589,18 @@ async function startGateway(containerId, options, signal, engine) {
 	const listeners = /* @__PURE__ */ new Map();
 	const tunnels = /* @__PURE__ */ new Set();
 	let stopped;
-	child.once("close", (code) => {
+	/** Stops on its own: nothing reaches the container any more, so connections are refused. */
+	const stop = (reason) => {
 		const asked = closed;
 		closed = true;
 		mux.destroy();
-		const reason = `the forwarder exited (${code}): ${stderr.trim().slice(-500)}`.replace(/: $/, "");
 		ready.reject(new Error(reason));
 		if (asked) return;
 		stopped = reason;
 		for (const socket of tunnels) socket.destroy();
 		for (const l of listeners.values()) l.then((s) => s.close());
-	});
+	};
+	child.once("close", (code) => stop(`the forwarder exited (${code}): ${stderr.trim().slice(-500)}`.replace(/: $/, "")));
 	const timer = setTimeout(() => ready.reject(/* @__PURE__ */ new Error(`the forwarder didn't start within ${READY_TIMEOUT_MS / 1e3}s`)), READY_TIMEOUT_MS);
 	const onAbort = () => ready.reject(signal?.reason);
 	signal?.addEventListener("abort", onAbort, { once: true });
@@ -3336,6 +3712,21 @@ const ROOT_CAPABILITIES = [
 	"SETUID",
 	"SETGID"
 ];
+/**
+* Every container's capabilities, for {@link DockerSession.runPrivileged}'s root execs: reading
+* and owning any file. The container's own process is root, and each exec names its user: an
+* exec as {@link SANDBOX_USER} holds none of them, and `no-new-privileges` keeps it from gaining
+* them. Podman gives a container's non-root user its added capabilities as ambient ones, which is
+* why the container itself isn't {@link SANDBOX_USER}.
+*/
+const PRIVILEGED_CAPABILITIES = [
+	"CHOWN",
+	"DAC_OVERRIDE",
+	"DAC_READ_SEARCH",
+	"FOWNER"
+];
+/** The user each of the sandbox's own execs runs as. */
+const execUser = (options) => options.root ? "0:0" : SANDBOX_USER;
 const hostCpus = /* @__PURE__ */ new Map();
 /** Docker refuses `--cpus` above the host's count, so cap it there. */
 async function cpuLimit(cpus, engine = "docker") {
@@ -3348,18 +3739,23 @@ async function cpuLimit(cpus, engine = "docker") {
 	return String(available ? Math.min(cpus, available) : cpus);
 }
 /**
-* The `docker run` flags that confine the container: its user, capabilities and limits, and on
-* Podman the bridge network and Docker's seccomp profile.
+* The `docker run` flags that confine the container: its capabilities and limits, and on Podman
+* the bridge network and Docker's seccomp profile. Its own process is root's `sleep`; every exec
+* names its user.
 */
 async function confinementArgs(options) {
 	const limits = {
 		...DEFAULT_LIMITS,
 		...options.limits
 	};
-	const caps = [...options.root ? ROOT_CAPABILITIES : [], ...options.capabilities ?? []];
+	const caps = [
+		...PRIVILEGED_CAPABILITIES,
+		...options.root ? ROOT_CAPABILITIES : [],
+		...options.capabilities ?? []
+	];
 	return [
 		"--user",
-		options.root ? "0:0" : SANDBOX_USER,
+		"0:0",
 		"--cap-drop",
 		"ALL",
 		...[...new Set(caps)].flatMap((c) => ["--cap-add", c]),
@@ -3394,9 +3790,11 @@ const EXEC_UMASK = "umask 022";
 * `memory.events` and v1's `memory.oom_control` both have an `oom_kill` line. Without either,
 * Docker's `OOMKilled` says only whether there was one.
 */
-async function oomKills(id, engine) {
+async function oomKills(id, engine, user = SANDBOX_USER) {
 	const events = await docker([
 		"exec",
+		"--user",
+		user,
 		id,
 		"sh",
 		"-c",
@@ -3474,12 +3872,7 @@ async function createDockerSession(options) {
 		env,
 		engine
 	}).catch((error) => {
-		const sweep = () => sweepLabelDetached(`${LABEL.session}=${nonce}`, void 0, engine);
-		if (signal?.aborted) sweep();
-		if (/unable to find user|no matching entries in passwd/i.test(error.message)) {
-			sweep();
-			throw new Error(`${options.image} has no ${SANDBOX_USER} user to run the sandbox as. Images reeval builds have one: rebuild it (reeval image build), or start from reeval's image or ${spec.fn}({ from }). An eval that needs root at run time can opt in with ${spec.fn}({ root: true }).`);
-		}
+		if (signal?.aborted) sweepLabelDetached(`${LABEL.session}=${nonce}`, void 0, engine);
 		throw error;
 	});
 	let gateway;
@@ -3493,27 +3886,33 @@ async function createDockerSession(options) {
 		await remove();
 		throw signal.reason;
 	}
-	if (!spec.createsWorkdir) {
-		const made = await docker([
-			"exec",
-			"--user",
-			"0:0",
-			id,
-			"sh",
-			"-c",
-			`${EXEC_UMASK} && mkdir -p ${SANDBOX_ROOT}`
-		], {
-			engine,
-			signal
-		}).catch((error) => ({
-			exitCode: 1,
-			stderr: error.message
-		}));
-		if (made.exitCode !== 0) {
-			await remove();
-			if (signal?.aborted) throw signal.reason;
-			throw new Error(`Couldn't create ${SANDBOX_ROOT} in the container: ${made.stderr.trim()}`);
-		}
+	const NO_USER = "reeval:no-sandbox-user";
+	const made = await docker([
+		"exec",
+		"--user",
+		"0:0",
+		id,
+		"/bin/sh",
+		"-c",
+		[
+			EXEC_UMASK,
+			...options.root ? [] : [`{ id -u ${SANDBOX_USER} >/dev/null 2>&1 || { echo ${NO_USER}; exit 1; }; }`],
+			...spec.createsWorkdir ? [] : [`mkdir -p ${SANDBOX_ROOT}`],
+			`mkdir -p ${SANDBOX_STATE} && chown 0:0 ${SANDBOX_STATE} && chmod 700 ${SANDBOX_STATE}`
+		].join(" && ")
+	], {
+		engine,
+		signal
+	}).catch((error) => ({
+		exitCode: 1,
+		stdout: Buffer.alloc(0),
+		stderr: error.message
+	}));
+	if (made.exitCode !== 0) {
+		await remove();
+		if (signal?.aborted) throw signal.reason;
+		if (made.stdout.toString("utf8").includes(NO_USER)) throw new Error(`${options.image} has no ${SANDBOX_USER} user to run the sandbox as. Images reeval builds have one: rebuild it (reeval image build), or start from reeval's image or ${spec.fn}({ from }). An eval that needs root at run time can opt in with ${spec.fn}({ root: true }).`);
+		throw new Error(`Couldn't set up the container: ${made.stderr.trim()}`);
 	}
 	const egressOptions = options.egress === true ? {} : options.egress || void 0;
 	let egress;
@@ -3565,10 +3964,12 @@ async function createDockerSession(options) {
 		...gateway.env,
 		...env
 	} : env;
+	const user = ["--user", execUser(options)];
 	let execs = 0;
 	const execArgs = (command, marker, cwd, env) => [
 		"exec",
 		"--interactive",
+		...user,
 		"--workdir",
 		cwd ? posix.resolve(SANDBOX_ROOT, cwd) : SANDBOX_ROOT,
 		"--env",
@@ -3584,10 +3985,16 @@ async function createDockerSession(options) {
 	* Killing the host's `docker exec` client doesn't stop the command in the container, so kill
 	* every process there that inherited this exec's marker: the command and all it started.
 	*/
-	const killExec = (marker) => docker([
+	const killExec = (marker, asRoot = false) => docker([
 		"exec",
+		...asRoot ? [
+			"--user",
+			"0:0",
+			"--env",
+			`PATH=${SYSTEM_PATH}`
+		] : user,
 		id,
-		"sh",
+		"/bin/sh",
 		"-c",
 		`for e in /proc/[0-9]*/environ; do grep -qsxzF ${shellQuote(`${EXEC_MARKER}=${marker}`)} "$e" && kill -9 "$(basename "$(dirname "$e")")" 2>/dev/null; done; true`
 	], { engine }).then(() => {}, () => {});
@@ -3614,11 +4021,10 @@ async function createDockerSession(options) {
 		const marker = nextMarker();
 		const args = [
 			"exec",
-			"--privileged",
 			"--user",
 			"0:0",
 			"--workdir",
-			o.workingDirectory ? posix.resolve(SANDBOX_ROOT, o.workingDirectory) : SANDBOX_ROOT,
+			SANDBOX_STATE,
 			"--env",
 			`${EXEC_MARKER}=${marker}`,
 			"--env",
@@ -3639,13 +4045,14 @@ async function createDockerSession(options) {
 				stderr: r.stderr
 			};
 		} catch (error) {
-			if (o.abortSignal?.aborted) await killExec(marker);
+			if (o.abortSignal?.aborted) await killExec(marker, true);
 			throw error;
 		}
 	};
 	const readBinaryFile = async (o) => {
 		const r = await docker([
 			"exec",
+			...user,
 			id,
 			"cat",
 			"--",
@@ -3658,13 +4065,29 @@ async function createDockerSession(options) {
 	};
 	const writeBinaryFile = async (o) => {
 		const path = posix.resolve(SANDBOX_ROOT, o.path);
+		const make = `${EXEC_UMASK} && mkdir -p ${shellQuote(posix.dirname(path))}`;
+		if (o.content.byteLength === 0) {
+			await dockerOk([
+				"exec",
+				...user,
+				id,
+				"sh",
+				"-c",
+				`${make} && : > ${shellQuote(path)}`
+			], {
+				signal: o.abortSignal,
+				engine
+			});
+			return;
+		}
 		await dockerOk([
 			"exec",
 			"--interactive",
+			...user,
 			id,
 			"sh",
 			"-c",
-			`${EXEC_UMASK} && mkdir -p ${shellQuote(posix.dirname(path))} && cat > ${shellQuote(path)}`
+			`${make} && cat > ${shellQuote(path)}`
 		], {
 			input: Buffer.from(o.content),
 			signal: o.abortSignal,
@@ -3703,7 +4126,7 @@ async function createDockerSession(options) {
 		},
 		...brokering,
 		...substituting,
-		oomKills: () => oomKills(id, engine),
+		oomKills: () => oomKills(id, engine, execUser(options)),
 		run,
 		runPrivileged,
 		async spawn(o) {
@@ -3850,22 +4273,22 @@ const BOOTSTRAPS = {
 		name: "Cursor",
 		cli: "@cursor/sdk",
 		version: `node -p "'@cursor/sdk ' + require(process.env.HOME + '/.ai-sdk-harness/.harness-bootstrap/cursor-sdk/node_modules/@cursor/sdk/package.json').version"`,
-		adapter: async () => (await import("./src-C0xowZ3C.js")).createCursorSdk()
+		adapter: async () => (await import("./src-DrJSnoMR.js")).createCursorSdk()
 	},
 	"claude-code": {
 		name: "Claude Code",
 		cli: "claude",
-		adapter: async () => (await import("./dist-CMjp3qqF.js")).createClaudeCode()
+		adapter: async () => (await import("./dist-Dp_AJgYN.js")).createClaudeCode()
 	},
 	antigravity: {
 		name: "Antigravity",
 		cli: "agy",
-		adapter: async () => (await import("./src-bCnsA6Vp.js")).createAntigravity()
+		adapter: async () => (await import("./src-BAyg6CtQ.js")).createAntigravity()
 	},
 	opencode: {
 		name: "OpenCode",
 		cli: "opencode",
-		adapter: async () => (await import("./src-Bcah6ZkT.js")).createOpenCode({
+		adapter: async () => (await import("./src-B3KCLZVk.js")).createOpenCode({
 			auth: { GOOGLE_GENERATIVE_AI_API_KEY: "unused" },
 			model: "google/unused"
 		})
@@ -3873,7 +4296,7 @@ const BOOTSTRAPS = {
 	goose: {
 		name: "Goose",
 		cli: "goose",
-		adapter: async () => (await import("./src-DPIjmReZ.js")).createGoose({
+		adapter: async () => (await import("./src-dhSTRN50.js")).createGoose({
 			auth: { GOOGLE_API_KEY: "unused" },
 			model: "unused"
 		})
@@ -3881,17 +4304,17 @@ const BOOTSTRAPS = {
 	pi: {
 		name: "pi",
 		cli: "pi",
-		adapter: async () => (await import("./src-ynBVosfX.js")).createPi({ auth: { GEMINI_API_KEY: "unused" } })
+		adapter: async () => (await import("./src-BezgGX4X.js")).createPi({ auth: { GEMINI_API_KEY: "unused" } })
 	},
 	codex: {
 		name: "Codex",
 		cli: "codex",
-		adapter: async () => (await import("./src-DLtyz4w5.js")).createCodex({ auth: { OPENAI_API_KEY: "unused" } })
+		adapter: async () => (await import("./src-ChBhk06Q.js")).createCodex({ auth: { OPENAI_API_KEY: "unused" } })
 	},
 	fx: {
 		name: "fx",
 		cli: "fx",
-		adapter: async () => (await import("./src-DXNh5mTr.js")).createFx({
+		adapter: async () => (await import("./src-CoqZYspK.js")).createFx({
 			auth: { AI_GATEWAY_API_KEY: "unused" },
 			model: "unused/unused"
 		})
@@ -3899,7 +4322,7 @@ const BOOTSTRAPS = {
 	"grok-build": {
 		name: "Grok Build",
 		cli: "grok",
-		adapter: async () => (await import("./src-CHIfIKUu.js")).createGrokBuild({
+		adapter: async () => (await import("./src-3mP821Pt.js")).createGrokBuild({
 			auth: { XAI_API_KEY: "unused" },
 			model: "unused"
 		})
@@ -3907,11 +4330,21 @@ const BOOTSTRAPS = {
 };
 /** Keeps the image's `PATH` in login shells, which Debian's `/etc/profile` resets. */
 const profilePathScript = () => readFileSync(join(DOCKER_CONTEXT, "reeval-path.sh")).toString("base64");
+/** `from` as it goes after `FROM`: one word, so it can't add a stage name or another instruction. */
+function imageReference(from) {
+	if (!/^\S+$/.test(from)) throw new Error(`docker({ from }) is an image reference without spaces or line breaks (got ${JSON.stringify(from)})`);
+	return from;
+}
+/**
+* A CLI's `--version` output as a label value in `docker commit --change`: its first line, without
+* quotes, backslashes or anything else that could end the value and add an instruction.
+*/
+const versionLabel = (output) => (output.split(/\r?\n/)[0] ?? "").replace(/[^\w .+:/()@,~-]/g, "").trim().slice(0, 100) || "unknown";
 /**
 * Adds what the harness bridge needs to a Debian or Ubuntu based toolchain image: Node (copied
 * from the official image, so the base's own toolchain is untouched), pnpm, git, curl and bash.
 */
-const toolchainDockerfile = (from) => `FROM ${from}
+const toolchainDockerfile = (from) => `FROM ${imageReference(from)}
 SHELL ["/bin/sh", "-c"]
 RUN command -v apt-get >/dev/null || { echo "reeval needs a Debian or Ubuntu based image (glibc and apt-get)" >&2; exit 1; } \\
   && apt-get update \\
@@ -4225,7 +4658,7 @@ async function bake(session, bootstrap) {
 	}
 	const version = await session.run({ command: probe });
 	if (bootstrap.version && version.exitCode !== 0) throw new Error(`The harness bootstrap did not install ${bootstrap.cli}:\n${tail(version.stderr)}`);
-	return version.stdout.trim() || "unknown";
+	return versionLabel(version.stdout.trim());
 }
 /**
 * The image `docker({ install })` runs in: the commands on top of `parent`, tagged by the parent's
@@ -4532,6 +4965,6 @@ async function buildDockerfile(dockerfile, options) {
 */
 const MCP_TIMER = fileURLToPath(ownFileURL("bin/mcp-timer.cjs"));
 //#endregion
-export { docker as $, applyTransformations as A, BRIDGE_PORT as B, DEFAULT_LIMITS as C, CA_PATH as D, dockerSandboxProvider as E, PACKAGE_HOSTS as F, SANDBOX_ROOT as G, HARNESS_PACKAGES as H, defaultAllowedHosts as I, WORKSPACE_DIR as J, SANDBOX_STATE as K, hostAllowed as L, onEndpoint as M, DOCKER_EGRESS as N, PROXY_PORT as O, HARNESS_HOSTS as P, isBakedHarness as Q, BAKED_HARNESSES as R, usesReevalBase as S, createDockerSession as T, LABEL as U, DEFAULT_IMAGE as V, SANDBOX_HOME as W, harnessLabel as X, adapterVersion as Y, imageFor as Z, pluginBuildKey as _, retryTransient as _t, buildDockerfile as a, imageTags as at, resolveFrom as b, engineSpec as bt, buildPluginLayer as c, onDockerCommand as ct, dockerfileTag as d, ImageBuildError as dt, dockerAvailable as et, dockerignoreMatcher as f, RETRY_DELAYS as ft, pluginBuildDir as g, parseBuildOutput as gt, installScript as h, isTransient as ht, REEVAL_BASE_ARG as i, imageInfo as it, matches as j, placeholder as k, contextFiles as l, run as lt, installLayerTag as m, failureCause as mt, DOCKER_CONTEXT as n, dockerOk as nt, buildImage as o, isRegistryDigest as ot, harnessImageFor as p, causeLine as pt, SANDBOX_USER as q, PLUGIN_BUILDS_DIR as r, dockerState as rt, buildInstallLayer as s, removeContainerDetached as st, MCP_TIMER as t, dockerCapacity as tt, contextHash as u, shellQuote as ut, pluginLayerTag as v, ENGINES as vt, ROOT_CAPABILITIES as w, sourceTreeHash as x, normalizeImageId as xt, pruneImages as y, dockerSeccompFile as yt, BASE_IMAGE as z };
+export { isBakedHarness as $, placeholder as A, BASE_IMAGE as B, DEFAULT_LIMITS as C, dockerSandboxProvider as D, createDockerSession as E, HARNESS_HOSTS as F, SANDBOX_HOME as G, DEFAULT_IMAGE as H, PACKAGE_HOSTS as I, SANDBOX_USER as J, SANDBOX_ROOT as K, defaultAllowedHosts as L, matches as M, onEndpoint as N, CA_PATH as O, DOCKER_EGRESS as P, imageFor as Q, hostAllowed as R, usesReevalBase as S, normalizeImageId as St, ROOT_CAPABILITIES as T, HARNESS_PACKAGES as U, BRIDGE_PORT as V, LABEL as W, adapterVersion as X, WORKSPACE_DIR as Y, harnessLabel as Z, pluginBuildKey as _, parseBuildOutput as _t, buildDockerfile as a, imageInfo as at, resolveFrom as b, dockerSeccompFile as bt, buildPluginLayer as c, removeContainerDetached as ct, dockerfileTag as d, shellQuote as dt, docker as et, dockerignoreMatcher as f, ImageBuildError as ft, pluginBuildDir as g, isTransient as gt, installScript as h, failureCause as ht, REEVAL_BASE_ARG as i, dockerState as it, applyTransformations as j, PROXY_PORT as k, contextFiles as l, onDockerCommand as lt, installLayerTag as m, causeLine as mt, DOCKER_CONTEXT as n, dockerCapacity as nt, buildImage as o, imageTags as ot, harnessImageFor as p, RETRY_DELAYS as pt, SANDBOX_STATE as q, PLUGIN_BUILDS_DIR as r, dockerOk as rt, buildInstallLayer as s, isRegistryDigest as st, MCP_TIMER as t, dockerAvailable as tt, contextHash as u, run as ut, pluginLayerTag as v, retryTransient as vt, PRIVILEGED_CAPABILITIES as w, sourceTreeHash as x, engineSpec as xt, pruneImages as y, ENGINES as yt, BAKED_HARNESSES as z };
 
-//# sourceMappingURL=src-LekQrr_S.js.map
+//# sourceMappingURL=src-CIpKL45U.js.map