reeval 0.9.0 → 0.10.0

package/dist/options-CKqyPGxX.js

@@ -1,739 +0,0 @@
-import { n as UsageError } from "./errors-yDAEwmZo.js";
-import { t as parseDuration } from "./duration-JsJrIWXq.js";
-import { E as workspaceOf, S as sandboxOf, T as workspaceLabel, g as isMovingRef, i as applied, l as emptyEnvironment, m as isEnvironment, o as checkEgress, r as EMPTY_BASELINE, s as checkEnv, w as unbrokeredSecrets, x as plannedSecrets } from "./environment-1jE-HhO-.js";
-import { g as isAgentKind, i as plannedEgress, l as HARNESS_EXAMPLE, r as egressLabel } from "./egress-BhzNh7Yi.js";
-import { a as checkModelString, i as badJudgeList } from "./judge-CeYPN8P_.js";
-import { c as opencodeModelError } from "./harness-CeCp2GSW.js";
-import { createHash } from "node:crypto";
-//#region src/harness/effort.ts
-/**
-* The reasoning effort a harness asked for. Same user-facing name on every factory; the CLI's
-* native flag may say thinking. Undefined when the factory left it unset. Fast is not this.
-*/
-function harnessEffort(h) {
-	return "effort" in h && typeof h.effort === "string" ? h.effort : void 0;
-}
-/**
-* The reasoning effort a served-model label recorded, e.g. `gpt-5.6-luna[effort=medium]` →
-* `medium`. Fast (`[fast=true]`) is not effort and is ignored.
-*/
-function effortFromModelLabel(model) {
-	const inner = model?.match(/\[([^\]]+)]/)?.[1];
-	if (!inner) return void 0;
-	for (const part of inner.split(",")) {
-		const eq = part.indexOf("=");
-		if (eq < 0) continue;
-		const key = part.slice(0, eq).trim();
-		if (key === "fast") continue;
-		if (/^(?:reasoning_)?effort$|^thinking$/.test(key)) {
-			const value = part.slice(eq + 1).trim();
-			if (value) return value;
-		}
-	}
-}
-/** The first reasoning-effort suffix among served-model labels; undefined when none name one. */
-function servedEffortOf(models) {
-	if (!models) return void 0;
-	for (const model of models) {
-		const effort = effortFromModelLabel(model);
-		if (effort) return effort;
-	}
-}
-/** Unique reasoning-effort suffixes among served-model labels, in first-seen order. */
-function resolvedEffortOf(models) {
-	if (!models) return [];
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const model of models) {
-		const effort = effortFromModelLabel(model);
-		if (effort && !seen.has(effort)) {
-			seen.add(effort);
-			out.push(effort);
-		}
-	}
-	return out;
-}
-//#endregion
-//#region src/options.ts
-const KNOWN = [
-	"harness",
-	"sandbox",
-	"environment",
-	"compare",
-	"runs",
-	"gate",
-	"env",
-	"egress",
-	"judge",
-	"capture",
-	"timeout",
-	"tags",
-	"pin"
-];
-const SUGGEST = {
-	harnesses: "harness",
-	sandboxes: "sandbox",
-	environments: "environment",
-	baseline: "environment",
-	variants: "compare",
-	repeat: "runs",
-	repeats: "runs",
-	iterations: "runs",
-	trials: "runs",
-	secrets: "env",
-	vars: "env",
-	network: "egress",
-	networkPolicy: "egress",
-	tag: "tags",
-	pins: "pin",
-	passRate: "gate",
-	threshold: "gate"
-};
-/** Throws unless `value` is `'all'` or `{ passRate }` with a rate in (0, 1]. */
-function checkGate(value, where) {
-	if (value === "all") return;
-	const rate = value?.passRate;
-	if ((typeof value === "object" && value !== null ? Object.keys(value) : []).length === 1 && typeof rate === "number" && rate > 0 && rate <= 1) return;
-	throw new UsageError(`gate is 'all' (every attempt passes) or { passRate } with a share above 0 and at most 1, e.g. gate: { passRate: 0.8 } (got ${JSON.stringify(value)}) in ${where}`);
-}
-const PINNABLE = [
-	"harness",
-	"runs",
-	"compare"
-];
-const GATES = [
-	"variants",
-	"all",
-	"none"
-];
-const COMPARE_KEYS = [
-	"baseline",
-	"variants",
-	"gate",
-	"minLift",
-	"harness",
-	"questions",
-	"across"
-];
-const QUESTION_KEYS = [
-	"question",
-	"model",
-	"across"
-];
-const QUESTION_EXAMPLE = `questions: ['Which handles state more cleanly?']`;
-const PAIR_FACTORS = ["environment", "harness"];
-const ACROSS_HINT = `'environment' (vary the environment, same harness) or 'harness' (vary the harness, same environment)`;
-const ACROSS_MEAN = " Did you mean \"across\"? It is the factor you vary: across: 'environment'.";
-const ID = /^[A-Za-z0-9._:@+\-=[\]]+$/;
-const sanitize = (text) => (text.split("/").at(-1) ?? text).replace(/[^A-Za-z0-9._:@-]+/g, "-");
-function harnessId(h) {
-	if (h.id) return h.id;
-	const effort = harnessEffort(h);
-	const suffix = effort ? `[effort=${sanitize(effort)}]` : "";
-	if (h.kind === "fake") return `fake${suffix}`;
-	return `${h.model ? `${h.kind}:${sanitize(h.model)}` : h.kind}${suffix}`;
-}
-function installId(install) {
-	if (!install?.length) return "";
-	const key = JSON.stringify(install.map((step) => typeof step === "string" ? step : {
-		run: step.run,
-		timeout: step.timeout
-	}));
-	return `+${createHash("sha256").update(key).digest("hex").slice(0, 8)}`;
-}
-function sandboxId(s) {
-	if (s.id) return s.id;
-	if (s.kind === "fake") return "fake";
-	const install = s.kind === "docker" ? installId(s.install) : "";
-	if (s.dockerfile) {
-		const [file = "", dir = ""] = s.dockerfile.split(/[\\/]/).reverse();
-		return `docker:${sanitize(file === "Dockerfile" ? dir || file : file)}${install}`;
-	}
-	const image = s.image ?? s.from;
-	return image ? `docker:${sanitize(image)}${install}` : `docker${install}`;
-}
-const cellKey = (harness, environment, sandbox) => `${harness}/${environment}/${sandbox}`;
-const isHarness = (v) => v?.kind === "fake" || isAgentKind(v?.kind);
-function checkMaxConcurrent(value, where) {
-	if (value === void 0 || Number.isInteger(value) && value >= 1) return;
-	throw new UsageError(`maxConcurrent must be a whole number of at least 1 (got ${String(value)}) for ${where}`);
-}
-const describe = (value) => {
-	if (Array.isArray(value)) return `a list of ${value.length}`;
-	if (typeof value === "object" && value !== null) {
-		const keys = Object.keys(value);
-		return keys.length ? `an object with ${keys.map((k) => `"${k}"`).join(", ")}` : "an object";
-	}
-	return JSON.stringify(value) ?? String(value);
-};
-/** A question's model is a language model: evaluation models score yes/no questions only. */
-const isEvaluationModel = (model) => model.startsWith("typesafe-ai/");
-function checkQuestion(item, where) {
-	if (typeof item === "string") {
-		if (item.trim()) return item;
-		throw new UsageError(`compare.questions in ${where} is an empty string. Ask something, e.g. ${QUESTION_EXAMPLE}.`);
-	}
-	if (typeof item !== "object" || item === null || Array.isArray(item)) throw new UsageError(`compare.questions in ${where} takes strings or { question, model?, across? } (got ${describe(item)}), e.g. ${QUESTION_EXAMPLE}.`);
-	const unknown = Object.keys(item).filter((k) => !QUESTION_KEYS.includes(k));
-	if (unknown.length) {
-		const hint = unknown.some((k) => k === "cut" || k === "cuts") ? ACROSS_MEAN : "";
-		throw new UsageError(`compare.questions in ${where} takes { question, model?, across? } (got ${unknown.map((k) => `"${k}"`).join(", ")}).${hint}`);
-	}
-	const { question, model, across } = item;
-	if (typeof question !== "string" || !question.trim()) throw new UsageError(`compare.questions in ${where} has an entry without its question (got ${describe(question)}), e.g. { question: 'Which is cleaner?', model: 'google/gemini-3.8-flash' }.`);
-	if (across !== void 0) checkAcross(across, where, question);
-	if (model !== void 0) {
-		if (typeof model !== "string" || checkModelString(model)) throw new UsageError(`compare.questions "${question}" in ${where}: model is a 'provider/model' string, e.g. 'google/gemini-3.8-flash' (got ${describe(model)})`);
-		if (isEvaluationModel(model)) throw new UsageError(`compare.questions "${question}" in ${where} names ${model}, an evaluation model: it scores yes/no questions and can't pick between two attempts. Use a language model, e.g. 'google/gemini-3.8-flash'.`);
-	}
-	return question;
-}
-function checkQuestions(value, where) {
-	if (!Array.isArray(value)) throw new UsageError(`compare.questions in ${where} is a list (got ${describe(value)}), e.g. ${QUESTION_EXAMPLE}.`);
-	const list = value;
-	if (list.length === 0) throw new UsageError(`compare.questions in ${where} is an empty list. Ask at least one, e.g. ${QUESTION_EXAMPLE}, or leave questions out.`);
-	const texts = list.map((item) => checkQuestion(item, where));
-	const dupe = texts.find((t, i) => texts.indexOf(t) !== i);
-	if (dupe) throw new UsageError(`compare.questions in ${where} asks "${dupe}" twice`);
-}
-function checkAcross(value, where, question) {
-	if (PAIR_FACTORS.includes(value)) return;
-	throw new UsageError(`compare.questions "${question}" in ${where}: across is ${ACROSS_HINT} (got ${describe(value)}). Leave it out to vary both.`);
-}
-function checkAcrosses(value, where) {
-	const list = Array.isArray(value) ? value : [value];
-	if (list.length === 0) throw new UsageError(`compare.across in ${where} is ${ACROSS_HINT}, or a list of those (got ${describe(value)}). Leave it out to vary both.`);
-	const seen = /* @__PURE__ */ new Set();
-	for (const item of list) {
-		if (!PAIR_FACTORS.includes(item)) throw new UsageError(`compare.across in ${where} is ${ACROSS_HINT}, or a list of those (got ${describe(item)}).`);
-		if (seen.has(item)) throw new UsageError(`compare.across in ${where} lists "${item}" twice`);
-		seen.add(item);
-	}
-}
-function checkCompare(value, where) {
-	if (Array.isArray(value)) throw new UsageError(`compare must be an object in ${where}. Use compare: { baseline, variants: [...] }.`);
-	const spec = value;
-	if (typeof value !== "object" || value === null || !Array.isArray(spec.variants)) throw new UsageError(`compare takes { variants, baseline? } (got ${describe(value)}) in ${where}. Use compare: { variants: [a, b], baseline?, gate?, minLift?, harness?, questions?, across? }.`);
-	for (const key of Object.keys(value)) if (!COMPARE_KEYS.includes(key)) {
-		const hint = key === "question" ? `. Did you mean "questions"? It's a list: ${QUESTION_EXAMPLE}.` : key === "cut" || key === "cuts" ? `.${ACROSS_MEAN}` : "";
-		throw new UsageError(`Unknown compare option "${key}" in ${where}${hint}`);
-	}
-	const { baseline, variants, gate, minLift, harness, questions, across } = spec;
-	if (questions !== void 0) checkQuestions(questions, where);
-	if (across !== void 0) checkAcrosses(across, where);
-	if (baseline !== void 0 && !isEnvironment(baseline)) throw new UsageError(`compare.baseline in ${where} must be an environment from defineEnvironment (got ${describe(baseline)}). It is the control; variants are not layered on it or on the eval's environment. Leave it out to use the eval's environment as the control.`);
-	if (gate !== void 0 && !GATES.includes(gate)) throw new UsageError(`compare.gate must be one of ${GATES.join(", ")} in ${where}`);
-	if (minLift !== void 0 && !(typeof minLift === "number" && minLift >= -1 && minLift <= 1)) throw new UsageError(`compare.minLift is points from -1 to 1 (got ${minLift}) in ${where}`);
-	if (harness !== void 0 && !Array.isArray(harness)) throw new UsageError(`compare.harness must be a list of harness ids in ${where}`);
-	if (variants.length === 0) throw new UsageError(`compare has no variants in ${where}. Give at least one environment.`);
-	for (const v of variants) if (!isEnvironment(v)) throw new UsageError(`compare takes environments (got ${describe(v)}) in ${where}. Variants share the eval's prompt and checks; if a variant needs different checks, write a separate eval.`);
-}
-/** `compare: false` and `environment` beside `compare.baseline` are never legal options. */
-function refuseIllegalCompare(options, where) {
-	if (options.compare === false) throw new UsageError(`compare: false can't be set in ${where}. A profile turns compare off with limit.compare: false, which runs the baseline and strips the variants. On a group or eval, omit compare or pass compare: { baseline, variants }.`);
-	const baseline = options.compare !== null && typeof options.compare === "object" && "baseline" in options.compare ? options.compare.baseline : void 0;
-	if (options.environment !== void 0 && baseline !== void 0) throw new UsageError(`environment and compare.baseline can't both be set in ${where}. compare: { baseline, variants } names every arm, so drop environment, or drop baseline to make environment the control.`);
-}
-/** Throws on keys that aren't options, and on values of the wrong shape, suggesting a fix. */
-function checkOptions(options, where, allowed = KNOWN) {
-	for (const key of Object.keys(options)) {
-		if (allowed.includes(key)) continue;
-		const hint = key === "pool" ? " pool is an option of evaluate.each, beside the cases: evaluate.each(cases, { pool: false })." : SUGGEST[key] ? ` Did you mean "${SUGGEST[key]}"?` : "";
-		throw new UsageError(`Unknown option "${key}" in ${where}.${hint}`);
-	}
-	const o = options;
-	if (o.runs !== void 0 && !(Number.isInteger(o.runs) && o.runs >= 1)) throw new UsageError(`runs must be a whole number of at least 1 (got ${o.runs}) in ${where}`);
-	if (o.gate !== void 0) checkGate(o.gate, where);
-	if (o.tags !== void 0 && (!Array.isArray(o.tags) || o.tags.some((t) => typeof t !== "string"))) throw new UsageError(`tags must be a list of strings in ${where}`);
-	if (o.env !== void 0) checkEnv(o.env, where, UsageError);
-	if (o.egress !== void 0) checkEgress(o.egress, where, UsageError);
-	checkMaxConcurrent(o.judge?.maxConcurrent, `judge in ${where}`);
-	const threshold = o.judge?.threshold;
-	if (threshold !== void 0 && !(typeof threshold === "number" && threshold >= 0 && threshold <= 1)) throw new UsageError(`judge.threshold must be between 0 and 1 (got ${String(threshold)}) in ${where}`);
-	const badList = o.judge && badJudgeList(o.judge);
-	if (badList) throw new UsageError(`judge.${badList.key} must be a list of non-empty strings (got ${badList.got}) in ${where}`);
-	if (o.sandbox !== void 0) {
-		const kind = o.sandbox.kind;
-		if (kind !== "docker" && kind !== "fake") throw new UsageError(`sandbox in ${where} must come from docker() or fakeSandbox() (got ${describe(o.sandbox)})`);
-		const max = o.sandbox.maxConcurrent;
-		if (max !== void 0 && !(Number.isInteger(max) && max >= 1)) throw new UsageError(`sandbox.maxConcurrent in ${where} must be a whole number of at least 1 (got ${String(max)})`);
-	}
-	if (o.environment !== void 0) {
-		if (Array.isArray(o.environment)) throw new UsageError(`environment takes one environment, not a list (${where}). To compare environments, use compare: { baseline, variants: [a, b] }. baseline is the control; variants are not layered on it.`);
-		if (!isEnvironment(o.environment)) throw new UsageError(`environment in ${where} must come from defineEnvironment(…) (got ${describe(o.environment)})`);
-	}
-	refuseIllegalCompare(options, where);
-	if (o.compare !== void 0) checkCompare(o.compare, where);
-	if (o.pin !== void 0) {
-		const bad = Array.isArray(o.pin) ? o.pin.filter((k) => !PINNABLE.includes(k)) : [o.pin];
-		if (bad.length) throw new UsageError(`pin accepts harness, runs and compare (got ${bad.map(String).join(", ")}) in ${where}`);
-	}
-	if (o.capture !== void 0) checkCapture(o.capture, where);
-}
-const CAPTURE_KEYS = [
-	"viewport",
-	"timeout",
-	"browser",
-	"model"
-];
-const CAPTURE_SHAPE = "{ viewport?, timeout?, browser?, model? }";
-const CAPTURE_CALL_ONLY = /* @__PURE__ */ new Set([
-	"instructions",
-	"wait",
-	"name",
-	"path"
-]);
-/** Throws unless `capture` is a shallow-merge object with a viewport, timeout, browser and/or model. */
-function checkCapture(value, where) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new UsageError(`capture is ${CAPTURE_SHAPE} (got ${JSON.stringify(value)}) in ${where}`);
-	const o = value;
-	if (o.instructions !== void 0) throw new UsageError(`c.capture() instructions need a vision model in ${where}. instructions is call-only on the call.`);
-	const unknown = Object.keys(o).filter((k) => !CAPTURE_KEYS.includes(k));
-	if (unknown.length) {
-		const key = unknown[0] ?? "";
-		if (key === "use" || key === "fake") throw new UsageError(`Unknown capture key "${key}" in ${where}. Set capture.model. Tests pass fakeInstructions from reeval/testing as instructions.`);
-		if (CAPTURE_CALL_ONLY.has(key)) throw new UsageError(`c.capture() ${key} is call-only on the call in ${where}. Use viewport, timeout, browser, model.`);
-		throw new UsageError(`Unknown capture key "${key}" in ${where}. Use viewport, timeout, browser, model.`);
-	}
-	if (o.viewport !== void 0) checkViewport(o.viewport, where);
-	if (o.timeout !== void 0) parseDuration(o.timeout);
-	if (o.browser !== void 0 && typeof o.browser !== "boolean") throw new UsageError(`capture.browser is true or false (got ${JSON.stringify(o.browser)}) in ${where}`);
-	if (o.model !== void 0) checkCaptureModel(o.model, where);
-}
-function checkViewport(value, where) {
-	if (value === "full-page") return;
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new UsageError(`capture.viewport is { width, height } or 'full-page' (got ${JSON.stringify(value)}) in ${where}`);
-	const o = value;
-	const keys = Object.keys(o);
-	if (keys.includes("fullPage")) throw new UsageError(`capture.viewport is { width, height } or 'full-page' in ${where}, not { height, fullPage }. Use viewport: 'full-page' for a tall shot.`);
-	const width = o.width;
-	const height = o.height;
-	if (keys.some((k) => k !== "width" && k !== "height") || !(Number.isInteger(width) && width > 0) || !(Number.isInteger(height) && height > 0)) throw new UsageError(`capture.viewport is { width, height } or 'full-page' (got ${JSON.stringify(value)}) in ${where}`);
-}
-function checkCaptureModel(value, where) {
-	if (typeof value !== "string" || !value.includes("/")) throw new UsageError(`capture.model is a 'provider/model' string, e.g. 'google/gemini-3.8-flash' (got ${JSON.stringify(value)}) in ${where}`);
-	if (isEvaluationModel(value)) throw new UsageError(`capture.model "${value}" in ${where} is an evaluation model: it scores yes/no questions and can't drive a capture. Use a language model that accepts images, e.g. 'google/gemini-3.8-flash'.`);
-}
-function applyHarness(inherited, value, where) {
-	if (value === void 0) return inherited;
-	const next = typeof value === "function" ? value(inherited) : isHarnessEdit(value) ? editHarness(inherited, value, where) : value;
-	const list = Array.isArray(next) ? next : [next];
-	if (list.length === 0) throw new UsageError(`harness is an empty list in ${where}. Give at least one, e.g. harness: ${HARNESS_EXAMPLE}`);
-	checkHarnesses(list, where);
-	return list;
-}
-const isHarnessEdit = (v) => typeof v === "object" && v !== null && !Array.isArray(v) && !("kind" in v) && ("add" in v || "only" in v);
-/** `{ add }` appends to the inherited harnesses; `{ only }` keeps those with these ids. */
-function editHarness(inherited, edit, where) {
-	if ("add" in edit && "only" in edit) throw new UsageError(`harness takes { add } or { only }, not both, in ${where}`);
-	if ("add" in edit) return [...inherited, ...Array.isArray(edit.add) ? edit.add : [edit.add]];
-	const ids = Array.isArray(edit.only) ? edit.only : [edit.only];
-	const have = inherited.map(harnessId);
-	const missing = ids.filter((id) => typeof id !== "string" || !have.includes(id));
-	if (missing.length) throw new UsageError(`harness { only: ${missing.map((id) => JSON.stringify(id)).join(", ")} } in ${where} names no inherited harness (inherited: ${have.join(", ")})`);
-	return inherited.filter((h) => ids.includes(harnessId(h)));
-}
-/** Each harness is one, with a valid `maxConcurrent`. */
-function checkHarnesses(list, where) {
-	for (const item of list) {
-		if (!isHarness(item)) throw new UsageError(`harness in ${where} must be like ${HARNESS_EXAMPLE} (got ${describe(item)})`);
-		if (item.kind === "opencode") {
-			const why = opencodeModelError(item.model);
-			if (why) throw new UsageError(`opencode() in ${where}: ${why}`);
-		}
-		checkMaxConcurrent(item.maxConcurrent, `harness in ${where}`);
-		const { startTimeout } = item;
-		if (startTimeout !== void 0) try {
-			parseDuration(startTimeout);
-		} catch (error) {
-			throw new UsageError(`startTimeout of harness in ${where}: ${error.message}`);
-		}
-	}
-}
-function checkUnique(list, where) {
-	const seen = /* @__PURE__ */ new Set();
-	for (const item of list) {
-		const key = harnessId(item);
-		if (!ID.test(key)) throw new UsageError(`The harness id "${key}" in ${where} may only use letters, digits and . _ : @ + - [ ] =`);
-		if (seen.has(key)) throw new UsageError(`Two harnesses in ${where} resolve to the id "${key}". Give one an id, e.g. cursor({ model: '…', id: '…' })`);
-		seen.add(key);
-	}
-}
-/** A question's own `across`, else the one `compare.across` names when it names exactly one. */
-const plannedAcross = (own, compare) => {
-	if (own) return own;
-	const list = compare === void 0 ? void 0 : Array.isArray(compare) ? compare : [compare];
-	return list?.length === 1 ? list[0] : void 0;
-};
-const plannedQuestions = (value, compareAcross) => (value ?? []).map((q) => {
-	if (typeof q === "string") {
-		const across = plannedAcross(void 0, compareAcross);
-		return across ? {
-			question: q,
-			across
-		} : { question: q };
-	}
-	const across = plannedAcross(q.across, compareAcross);
-	return {
-		question: q.question,
-		...q.model !== void 0 ? { model: q.model } : {},
-		...across ? { across } : {}
-	};
-});
-function normalizeCompare(value) {
-	if (value === void 0) return void 0;
-	return {
-		...value.baseline ? { baseline: value.baseline } : {
-			baseline: emptyEnvironment(EMPTY_BASELINE),
-			from: "empty"
-		},
-		variants: value.variants,
-		gate: value.gate ?? "variants",
-		...value.minLift !== void 0 ? { minLift: value.minLift } : {},
-		...value.harness ? { harness: value.harness.map((h) => typeof h === "string" ? h : harnessId(h)) } : {},
-		of: value.variants.length,
-		questions: plannedQuestions(value.questions, value.across)
-	};
-}
-function applyLevel(out, options, where, egress = "own") {
-	for (const [key, value] of Object.entries(options)) if (value !== void 0) out.sources = {
-		...out.sources,
-		[key]: where
-	};
-	if (options.egress !== void 0) out.egress[egress] = options.egress;
-	out.harness = applyHarness(out.harness, options.harness, where);
-	if (options.sandbox !== void 0) out.sandbox = options.sandbox;
-	if (options.environment !== void 0) out.environment = options.environment;
-	if (options.compare !== void 0) out.compare = normalizeCompare(options.compare);
-	if (options.runs !== void 0) out.runs = options.runs;
-	if (options.gate !== void 0) out.gate = options.gate;
-	if (options.timeout !== void 0) out.timeout = options.timeout;
-	Object.assign(out.env, options.env);
-	Object.assign(out.judge, options.judge);
-	if (options.capture !== void 0) {
-		const { viewport, ...rest } = options.capture;
-		out.capture = {
-			...out.capture,
-			...rest
-		};
-		if (viewport !== void 0) out.capture.viewport = viewport;
-	}
-	for (const tag of options.tags ?? []) if (!out.tags.includes(tag)) out.tags.push(tag);
-	for (const key of options.pin ?? []) if (!out.pin.includes(key)) out.pin.push(key);
-}
-/** What a profile sets over the config's judge: its `judge`, then its `defaults.judge`. */
-const profileJudge = (profile) => ({
-	...profile.judge,
-	...profile.defaults.judge
-});
-/**
-* Config, then the profile's defaults, then each enclosing group, then the eval; then the
-* profile's limit (narrowing only, except pinned keys); then `--runs`.
-*/
-function cascade(base, levels, where, options = {}) {
-	const out = {
-		...base,
-		env: { ...base.env },
-		egress: { ...base.egress },
-		judge: { ...base.judge },
-		capture: { ...base.capture },
-		tags: [...base.tags],
-		pin: [...base.pin]
-	};
-	const { profile } = options;
-	const notes = [];
-	if (profile) applyLevel(out, {
-		...profile.defaults,
-		judge: profileJudge(profile)
-	}, `profiles.${profile.name}.defaults`, "inherited");
-	for (const { options: own, where: at } of levels) applyLevel(out, own, at);
-	if (out.compare?.from && out.environment) out.compare = {
-		...out.compare,
-		baseline: out.environment,
-		from: "environment"
-	};
-	checkUnique(out.harness, where);
-	if (profile?.defaults.harness !== void 0 && levels.some((l) => l.options.harness)) notes.push("harness set by the eval");
-	const ids = out.harness.map(harnessId);
-	const missing = (out.compare?.harness)?.filter((id) => !ids.includes(id)) ?? [];
-	if (missing.length) throw new UsageError(`compare.harness lists ${missing.join(", ")}, which ${where} doesn't run (it runs ${ids.join(", ")}).`);
-	for (const v of out.compare?.variants ?? []) if (v.name === out.compare?.baseline.name) throw new UsageError(out.compare.from === "empty" ? `compare in ${where} lists a variant named ${v.name}, the name of the empty control a compare without a baseline or environment runs. Rename the variant, or set compare.baseline.` : out.compare.from === "environment" ? `compare in ${where} lists ${v.name}, which is the control: compare has no baseline, so the eval's environment is. List only the other environments.` : `compare in ${where} lists ${v.name}, which is the baseline. List only the other environments.`);
-	const names = out.compare?.variants.map((v) => v.name) ?? [];
-	const dupe = names.find((n, i) => names.indexOf(n) !== i);
-	if (dupe) throw new UsageError(`compare in ${where} lists two variants named ${dupe}`);
-	let skip;
-	const limit = profile?.limit;
-	if (profile && limit) {
-		const tag = `profile ${profile.name}`;
-		const pinned = (key) => out.pin.includes(key);
-		if (limit.runs !== void 0 && options.runs === void 0 && !pinned("runs") && out.runs > limit.runs) {
-			notes.push(`runs ${out.runs} → ${limit.runs} (${tag})`);
-			out.runs = limit.runs;
-		}
-		if (limit.harness && !pinned("harness")) {
-			const kept = out.harness.filter((h) => limit.harness?.includes(harnessId(h)));
-			if (kept.length === 0) skip = `no harness left: ${tag} allows ${limit.harness.join(", ") || "none"}`;
-			else if (kept.length < out.harness.length) {
-				notes.push(`harnesses ${out.harness.length} → ${kept.length} (${tag})`);
-				out.harness = kept;
-			}
-		}
-		if (out.compare && limit.compare !== void 0 && !pinned("compare")) {
-			if (limit.compare === false) {
-				notes.push(`compare off (${tag})`);
-				out.compare = {
-					...out.compare,
-					variants: []
-				};
-			} else if (out.compare.variants.length > limit.compare.maxVariants) {
-				notes.push(`variants ${out.compare.variants.length} → ${limit.compare.maxVariants} (${tag})`);
-				out.compare = {
-					...out.compare,
-					variants: out.compare.variants.slice(0, limit.compare.maxVariants)
-				};
-			}
-			if (out.compare.variants.length === 0 && out.compare.questions.length) {
-				notes.push(`questions off (${tag})`);
-				out.compare = {
-					...out.compare,
-					questions: []
-				};
-			}
-		}
-		const pins = out.pin.filter((k) => k === "compare" ? limit.compare !== void 0 && out.compare : limit[k] !== void 0);
-		if (pins.length) notes.push(`pinned: ${pins.join(", ")}`);
-	}
-	if (options.runs !== void 0) out.runs = options.runs;
-	return {
-		resolved: out,
-		notes,
-		...skip ? { skip } : {}
-	};
-}
-/**
-* The sandbox an attempt runs in: the resolved environment's (including an `.extend()`
-* parent's), else the first variant's when this is an omitted-baseline empty control, else
-* the cascaded option (`defineConfig` / profile defaults / group / eval), else implicit Docker.
-* A named environment is a total override: the config environment's sandbox is not inherited.
-*/
-const attemptSandbox = (resolved, env) => {
-	const own = env.layers.findLast((l) => l.spec.sandbox)?.spec.sandbox;
-	if (own) return own;
-	const variant = resolved.compare?.from === "empty" && env.name === "baseline" ? resolved.compare.variants[0] : void 0;
-	return sandboxOf(variant?.layers ?? [], resolved.sandbox);
-};
-/**
-* Which level set this attempt's sandbox: the cascade source of the environment that named one
-* (an `.extend()` child still names that environment), else the first variant when this is an
-* omitted-baseline empty control, else the cascaded `sandbox` option, else the config (implicit
-* Docker).
-*/
-function sandboxSetBy(planned, resolved, configFile) {
-	if (!planned.environment.layers.some((l) => l.spec.sandbox)) {
-		if (resolved.compare?.from === "empty" && planned.cell.role === "control" && resolved.compare.variants[0]?.layers.some((l) => l.spec.sandbox)) return resolved.sources?.compare ?? configFile;
-		return resolved.sources?.sandbox ?? configFile;
-	}
-	if (resolved.compare) {
-		if (planned.cell.role === "control") {
-			if (resolved.compare.from === "environment") return resolved.sources?.environment ?? configFile;
-			if (resolved.compare.from === "empty") return configFile;
-			return resolved.sources?.compare ?? configFile;
-		}
-		return resolved.sources?.compare ?? configFile;
-	}
-	return resolved.sources?.environment ?? configFile;
-}
-/** Per harness: the control, then each variant it compares on; then run numbers. */
-function expand(resolved) {
-	const { compare } = resolved;
-	const control = applied(compare ? compare.baseline : resolved.environment);
-	const policy = resolved.gate ?? "all";
-	const gateIf = (gated) => gated ? policy : "none";
-	const attempts = [];
-	for (const harness of resolved.harness) {
-		const hid = harnessId(harness);
-		const cells = [(() => {
-			const sandbox = attemptSandbox(resolved, control);
-			const sid = sandboxId(sandbox);
-			return {
-				env: control,
-				sandbox,
-				cell: {
-					key: cellKey(hid, control.name, sid),
-					harness: hid,
-					environment: control.name,
-					sandbox: sid,
-					role: "control"
-				},
-				gate: gateIf(!compare || compare.gate === "all")
-			};
-		})()];
-		if (compare && (!compare.harness || compare.harness.includes(hid))) for (const v of compare.variants) {
-			const env = applied(v);
-			const sandbox = attemptSandbox(resolved, env);
-			const sid = sandboxId(sandbox);
-			cells.push({
-				env,
-				sandbox,
-				cell: {
-					key: cellKey(hid, env.name, sid),
-					harness: hid,
-					environment: env.name,
-					sandbox: sid,
-					role: "variant",
-					variant: v.name
-				},
-				gate: gateIf(compare.gate !== "none")
-			});
-		}
-		for (const { env, sandbox, cell, gate } of cells) {
-			const axes = [resolved.harness.length > 1 ? hid : "", compare ? cell.role === "control" ? "control" : env.name : ""].filter(Boolean);
-			for (let n = 1; n <= resolved.runs; n++) {
-				const label = [axes.join(" · "), resolved.runs > 1 ? `#${n}` : ""].filter(Boolean).join(" ");
-				attempts.push({
-					cell,
-					harness,
-					sandbox,
-					environment: env,
-					egress: plannedEgress(resolved.egress, harness, resolved.env, env.layers),
-					gate,
-					...cell.role === "variant" && compare?.minLift !== void 0 ? { minLift: compare.minLift } : {},
-					n,
-					label
-				});
-			}
-		}
-	}
-	return attempts;
-}
-/** Warnings about what an eval's environments pull in, e.g. skills at a moving git ref. */
-function environmentWarnings(attempts) {
-	const out = /* @__PURE__ */ new Set();
-	for (const a of attempts) {
-		const workspace = workspaceOf(a.environment.layers);
-		if (workspace && isMovingRef(workspace.ref)) {
-			const ref = workspace.ref ? `moving ref "${workspace.ref}"` : "no ref (the default branch)";
-			out.add(`workspace git(${workspace.repo}) uses ${ref}: results aren't comparable over time. Pin a tag or SHA (the resolved commit is recorded either way).`);
-		}
-		for (const layer of a.environment.layers) for (const s of layer.spec.skills ?? []) {
-			if (s.source === "git" && isMovingRef(s.ref)) {
-				const ref = s.ref ? `moving ref "${s.ref}"` : "no ref (the default branch)";
-				out.add(`skill.git(${s.repo}) uses ${ref}: results aren't comparable over time. Pin a tag or SHA (the resolved commit is recorded either way).`);
-			}
-			if (s.source === "registry" && !s.version) out.add(`skill.registry(${s.id}) has no version: results aren't comparable over time. Pin one (the resolved commit is recorded either way).`);
-		}
-	}
-	return [...out];
-}
-/** Secrets a Docker attempt would get as real values, because they have no `hosts`. */
-function unbrokered(env, attempts) {
-	const out = /* @__PURE__ */ new Map();
-	for (const a of attempts) {
-		if (a.sandbox.kind !== "docker") continue;
-		for (const s of unbrokeredSecrets(env, a.environment.layers)) out.set(s.label, s);
-	}
-	return [...out.values()];
-}
-/** An optional secret whose host variable isn't set never reaches the sandbox, so it gets no warning. */
-const reachesSandbox = (s) => !s.optional || Boolean(process.env[s.from]);
-/** `GEMINI_API_KEY → generativelanguage.googleapis.com` for each secret an attempt brokers. */
-const brokeredIn = (env, attempt) => [...new Set(plannedSecrets(env, attempt.environment.layers).flatMap((s) => s.hosts ? [`${s.label} → ${s.hosts.join(", ")}`] : []))];
-/** The host variables an attempt's secrets read, brokered or not. */
-const secretVarsIn = (env, attempt) => [...new Set(plannedSecrets(env, attempt.environment.layers).map((s) => s.from))];
-const brokerHint = (s) => /^mcp\.[^.]+\.headers\./.test(s.label) ? "give the MCP server an https:// URL (reeval brokers its header secrets to its own host, over HTTPS only)" : `add the hosts it's sent to, e.g. secret.fromEnv('${s.from}', { hosts: ['api.example.com'] })`;
-const unbrokeredWarning = (s) => s.checksOnly ? `${s.label} reaches the checks (c.exec, setup steps) as its real value; the agent never gets it. To give the checks only a placeholder, ${brokerHint(s)}.` : `${s.label} is in the sandbox as its real value. To give the agent only a placeholder, ${brokerHint(s)}.`;
-const unbrokeredError = (s, where, configFile) => `${s.label} in ${where} isn't brokered, and secrets.unbrokered is 'error' in ${configFile}. To broker it, ${brokerHint(s)}.`;
-const levelOf = (where) => where.startsWith("evaluate(") ? "eval" : where.startsWith("group(") ? "group" : where.startsWith("profiles.") ? "profile" : "config";
-/**
-* A warning per privilege an attempt's Docker sandbox adds, naming the level that set the
-* environment which owns that sandbox: the config when no profile, group or eval did.
-*/
-function sandboxWarnings(attempts, resolved, origin) {
-	const out = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const a of attempts) {
-		if (a.sandbox.kind !== "docker") continue;
-		const where = sandboxSetBy(a, resolved, origin.configFile);
-		const level = levelOf(where);
-		const file = level === "eval" || level === "group" ? origin.file : null;
-		if (a.sandbox.root) {
-			const message = `running as root in the sandbox: ${where} (docker({ root: true }))`;
-			const key = `${file}\0${message}`;
-			if (!seen.has(key)) {
-				seen.add(key);
-				out.push({
-					kind: "root",
-					level,
-					where,
-					file,
-					message
-				});
-			}
-		}
-		if (a.sandbox.capabilities?.length) {
-			const message = `extra capabilities in the sandbox: ${where} (docker({ capabilities: [${a.sandbox.capabilities.map((c) => `'${c}'`).join(", ")}] }))`;
-			const key = `${file}\0${message}`;
-			if (!seen.has(key)) {
-				seen.add(key);
-				out.push({
-					kind: "capabilities",
-					level,
-					where,
-					file,
-					capabilities: [...a.sandbox.capabilities],
-					message
-				});
-			}
-		}
-	}
-	return out;
-}
-/** The plan row for an eval. */
-function evalPlan(r, attempts, origin) {
-	const { resolved, skip } = r;
-	const capture = captureNote(resolved.capture);
-	const notes = capture ? [...r.notes, capture] : r.notes;
-	return {
-		harnesses: skip ? 0 : resolved.harness.length,
-		variants: resolved.compare ? {
-			run: resolved.compare.variants.length,
-			of: resolved.compare.of
-		} : null,
-		...resolved.compare ? { compare: {
-			baseline: resolved.compare.baseline.name,
-			...resolved.compare.from ? { from: resolved.compare.from } : {}
-		} } : {},
-		...!skip && resolved.compare?.questions.length ? { questions: resolved.compare.questions } : {},
-		runs: resolved.runs,
-		...resolved.gate !== void 0 ? { gate: resolved.gate } : {},
-		attempts: skip ? 0 : attempts.length,
-		notes,
-		...skip ? { skip } : {},
-		warnings: [...environmentWarnings(attempts), ...unbrokered(r.resolved.env, attempts).filter(reachesSandbox).map(unbrokeredWarning)],
-		sandboxWarnings: skip ? [] : sandboxWarnings(attempts, resolved, origin),
-		brokered: [...new Set(attempts.flatMap((a) => brokeredIn(r.resolved.env, a)))],
-		egress: [...new Set(attempts.map((a) => egressLabel(a.egress)).filter(Boolean))],
-		workspaces: [...new Set(attempts.flatMap((a) => {
-			const w = workspaceOf(a.environment.layers);
-			return w ? [workspaceLabel(w)] : [];
-		}))],
-		...capture ? { capture: resolved.capture } : {}
-	};
-}
-function captureNote(c) {
-	const parts = [];
-	if (c.viewport === "full-page") parts.push("full-page");
-	else if (c.viewport) parts.push(`${c.viewport.width}×${c.viewport.height}`);
-	if (c.timeout !== void 0) parts.push(typeof c.timeout === "number" ? `${c.timeout}ms` : c.timeout);
-	if (c.browser === false) parts.push("browser false");
-	if (c.model) parts.push(`model ${c.model}`);
-	return parts.length ? `capture: ${parts.join(" · ")}` : void 0;
-}
-/** `--tag a --tag !b`: every entry must hold. */
-function matchesTags(tags, filters) {
-	return filters.every((f) => f.startsWith("!") ? !tags.includes(f.slice(1)) : tags.includes(f));
-}
-//#endregion
-export { resolvedEffortOf as _, evalPlan as a, levelOf as c, sandboxId as d, sandboxSetBy as f, harnessEffort as g, unbrokeredError as h, checkOptions as i, matchesTags as l, unbrokered as m, cascade as n, expand as o, secretVarsIn as p, checkHarnesses as r, harnessId as s, brokeredIn as t, profileJudge as u, servedEffortOf as v };
-
-//# sourceMappingURL=options-CKqyPGxX.js.map