thunderjar 0.1.3-preview-eee7160 → 0.1.3-preview-e09ffa1

package/dist/cli.js

@@ -2047,7 +2047,7 @@ var program = new Command;
 // package.json
 var package_default = {
   name: "thunderjar",
-  version: "0.1.3-preview-eee7160",
+  version: "0.1.3-preview-e09ffa1",
   type: "module",
   description: "Thunderjar",
   license: "MIT",
@@ -2058,24 +2058,30 @@ var package_default = {
   bin: {
     thunderjar: "./dist/cli.js"
   },
-  main: "./src/index.ts",
-  types: "./src/index.ts",
+  main: "./src/api/index.ts",
+  types: "./src/api/index.ts",
+  exports: {
+    ".": "./src/api/index.ts"
+  },
   files: [
     "dist",
-    "src"
+    "src/api",
+    "!src/**/*.test.ts",
+    "!src/**/*.result.json"
   ],
   publishConfig: {
     access: "public"
   },
   scripts: {
     build: "bun build src/cli/index.ts --target bun --outfile dist/cli.js",
-    lint: "bun scripts/sync-oxlint-layout.ts && bun scripts/sync-oxlint-layout.ts --check && oxlint",
+    lint: "bun scripts/lint-layers.ts --check && oxlint",
+    "lint:generate": "bun scripts/lint-layers.ts",
     typecheck: "tsc --noEmit",
     test: "bun test",
-    "test:prepare": "bun scripts/prepare-tests.ts",
-    "test:docker": "THUNDERJAR_TEST_DOCKER=1 bun test docker",
+    "test:docker": "THUNDERJAR_DOCKER_TESTS=1 bun test --timeout 600000 .docker.test",
+    "test:agent": "THUNDERJAR_AGENT_TESTS=1 bun test --timeout 900000 .agent.test",
+    "test:package": "bun scripts/package-smoke-test.ts",
     fixture: "bun scripts/fixture.ts",
-    "dev:link": "bun scripts/dev-link.ts",
     "docs:dev": "vitepress dev docs",
     "docs:build": "vitepress build docs",
     "docs:build:versions": "bun scripts/build-versioned-docs.ts",
@@ -2100,242 +2106,213 @@ var package_default = {
   }
 };
 
-// src/platform/path.ts
-function isAbsolute(path2) {
-  return path2.startsWith("/");
-}
-function normalize(path2) {
-  if (path2 === "")
-    return ".";
-  const absolute = isAbsolute(path2);
-  const trailing = path2.endsWith("/");
-  const out = [];
-  for (const part of path2.split("/")) {
-    if (part === "" || part === ".")
-      continue;
-    if (part === "..") {
-      if (out.length > 0 && out.at(-1) !== "..")
-        out.pop();
-      else if (!absolute)
-        out.push("..");
-    } else
-      out.push(part);
-  }
-  let result = (absolute ? "/" : "") + out.join("/");
-  if (result === "")
-    result = absolute ? "/" : ".";
-  if (trailing && !result.endsWith("/"))
-    result += "/";
-  return result;
-}
-function join(...parts) {
-  const joined = parts.filter((part) => part !== "").join("/");
-  return joined === "" ? "." : normalize(joined);
-}
-function resolve(...parts) {
-  let path2 = "";
-  for (let i = parts.length - 1;i >= 0 && !isAbsolute(path2); i--) {
-    const part = parts[i];
-    if (part !== "")
-      path2 = path2 === "" ? part : `${part}/${path2}`;
-  }
-  if (!isAbsolute(path2))
-    path2 = `${process.cwd()}/${path2}`;
-  const normal = normalize(path2);
-  return normal.length > 1 && normal.endsWith("/") ? normal.slice(0, -1) : normal;
-}
-function relative(from, to) {
-  const a = resolve(from).split("/").filter(Boolean);
-  const b = resolve(to).split("/").filter(Boolean);
-  let common = 0;
-  while (common < a.length && common < b.length && a[common] === b[common])
-    common++;
-  return [...Array(a.length - common).fill(".."), ...b.slice(common)].join("/");
-}
-function dirname(path2) {
-  if (path2 === "")
-    return ".";
-  const trimmed = path2.length > 1 ? path2.replace(/\/+$/, "") : path2;
-  const at = trimmed.lastIndexOf("/");
-  if (at === -1)
-    return ".";
-  if (at === 0)
-    return "/";
-  return trimmed.slice(0, at);
-}
-function basename(path2, ext) {
-  const trimmed = path2.length > 1 ? path2.replace(/\/+$/, "") : path2;
-  const base = trimmed.slice(trimmed.lastIndexOf("/") + 1);
-  return ext && base !== ext && base.endsWith(ext) ? base.slice(0, -ext.length) : base;
-}
-function extname(path2) {
-  const base = basename(path2);
-  const at = base.lastIndexOf(".");
-  return at <= 0 ? "" : base.slice(at);
+// src/api/declarations.ts
+var DECLARED_BY = Symbol.for("thunderjar.declaredBy");
+function declaredBy(value) {
+  if ((typeof value !== "object" || value === null) && typeof value !== "function")
+    return;
+  const mark = value[DECLARED_BY];
+  return typeof mark === "string" ? mark : undefined;
 }
 
-// src/adapters/docker/docker.ts
-class DockerBuildError extends Error {
-  ref;
-  exitCode;
-  constructor(ref, exitCode) {
-    super(`docker build of ${ref} exited ${exitCode}`);
-    this.ref = ref;
-    this.exitCode = exitCode;
-  }
-}
+// src/config/loader.ts
+var FOLDER = ".thunderjar";
 
-class DockerCommandError extends Error {
-  args;
-  exitCode;
-  stderr;
-  constructor(args, exitCode, stderr) {
-    super(`docker ${args[0]} exited ${exitCode}${stderr.trim() ? `: ${stderr.trim().split(`
-`).at(-1)}` : ""}`);
-    this.args = args;
-    this.exitCode = exitCode;
-    this.stderr = stderr;
+class ConfigError extends Error {
+  problems;
+  constructor(...problems) {
+    super(problems.join(`
+`));
+    this.problems = problems;
   }
 }
-async function docker(binary, args, output) {
-  const stdio = {
-    collect: { stdout: "ignore", stderr: "pipe" },
-    stderr: { stdout: 2, stderr: 2 },
-    stdout: { stdout: "pipe", stderr: 2 }
-  };
-  const child = Bun.spawn([binary, ...args], { stdin: "ignore", ...stdio[output] });
-  const text = (stream) => stream instanceof ReadableStream ? new Response(stream).text() : Promise.resolve("");
-  const [stdout, stderr] = await Promise.all([text(child.stdout), text(child.stderr), child.exited]);
-  return { exitCode: child.exitCode ?? 1, stdout, stderr };
-}
-function dockerCli(binary = process.env.THUNDERJAR_DOCKER || "docker") {
-  const must = async (args) => {
-    const { exitCode, stderr } = await docker(binary, args, "collect");
-    if (exitCode !== 0)
-      throw new DockerCommandError(args, exitCode, stderr);
-  };
-  return {
-    async unreachable() {
-      try {
-        const { exitCode, stderr } = await docker(binary, ["version", "--format", "{{.Server.Version}}"], "collect");
-        if (exitCode === 0)
-          return;
-        return stderr.trim().split(`
-`).at(-1) || `\`${binary} version\` exited ${exitCode}`;
-      } catch (error) {
-        if (error.code === "ENOENT")
-          return `\`${binary}\` was not found`;
-        throw error;
-      }
-    },
-    async imageExists(ref) {
-      return (await docker(binary, ["image", "inspect", "--format", "{{.Id}}", ref], "collect")).exitCode === 0;
-    },
-    async build(contextDir, ref) {
-      const { exitCode } = await docker(binary, ["build", "--tag", ref, contextDir], "stderr");
-      if (exitCode !== 0)
-        throw new DockerBuildError(ref, exitCode);
-    },
-    async run(ref, name, script) {
-      const { exitCode, stdout } = await docker(binary, ["run", "--name", name, "--entrypoint", "sh", ref, "-c", script], "stdout");
-      return { exitCode, stdout };
-    },
-    async commit(name, ref, like) {
-      const format = "{{json .Config.Entrypoint}}\t{{json .Config.Cmd}}";
-      const inspected = await docker(binary, ["image", "inspect", "--format", format, like], "stdout");
-      if (inspected.exitCode !== 0)
-        throw new DockerCommandError(["image", "inspect", like], inspected.exitCode, "");
-      const [entrypoint, cmd] = inspected.stdout.trim().split("\t");
-      const changes = [`ENTRYPOINT ${entrypoint === "null" ? '[""]' : entrypoint}`, `CMD ${cmd === "null" ? '["sh"]' : cmd}`];
-      await must(["commit", ...changes.flatMap((change) => ["--change", change]), name, ref]);
-    },
-    create: (ref, name) => must(["create", "--name", name, "--entrypoint", "sh", ref]),
-    copyFrom: (name, path2, dest) => must(["cp", `${name}:${path2}`, dest]),
-    removeContainer: (name) => must(["rm", "--force", name])
-  };
-}
-
-// src/platform/fs.ts
-var {$ } = globalThis.Bun;
-function tmpdir() {
-  return (Bun.env.TMPDIR ?? "/tmp").replace(/\/+$/, "") || "/";
+function problemsError(problems) {
+  return new ConfigError(...problems.map(({ file, field, message }) => `${FOLDER}/${file}: ${field ? `${field}: ` : ""}${message}`));
 }
-async function makeTempDir(prefix) {
-  return (await $`mktemp -d ${join(tmpdir(), `${prefix}XXXXXX`)}`.quiet().text()).trim();
+async function isDirectory(path2) {
+  try {
+    return (await Bun.file(path2).stat()).isDirectory();
+  } catch {
+    return false;
+  }
 }
-async function makeDir(dir) {
-  await $`mkdir -p ${dir}`.quiet();
+async function existsIn(root, path2) {
+  return path2.endsWith("/") ? isDirectory(`${root}/${path2}`) : Bun.file(`${root}/${path2}`).exists();
 }
-async function remove(path2) {
-  await $`rm -rf ${path2}`.quiet();
+var parentOf = (dir) => dir.slice(0, dir.lastIndexOf("/")) || "/";
+async function findThunderjarRoot(startDir) {
+  let dir = startDir.replace(/(.)\/+$/, "$1");
+  for (;; ) {
+    const candidate = dir === "/" ? `/${FOLDER}` : `${dir}/${FOLDER}`;
+    if (await isDirectory(candidate))
+      return candidate;
+    if (dir === "/")
+      break;
+    dir = parentOf(dir);
+  }
+  throw new ConfigError(`No ${FOLDER}/ folder in ${startDir} or any folder above it. Run \`thunderjar init\` first.`);
 }
-async function copy(from, to) {
-  if (await isDirectory(from)) {
-    await makeDir(to);
-    await $`cp -RP ${from}/. ${to}`.quiet();
-  } else {
-    await $`cp -P ${from} ${to}`.quiet();
+async function loadDeclaration(root, file, declareFn, problems) {
+  if (!await existsIn(root, file)) {
+    problems.push({ file, message: `is missing. Export \`${declareFn}(...)\` from it as the default.` });
+    return;
+  }
+  let module;
+  try {
+    module = await import(`${root}/${file}`);
+  } catch (error) {
+    problems.push({ file, message: `could not be loaded: ${error instanceof Error ? error.message : String(error)}` });
+    return;
+  }
+  if (module.default === undefined) {
+    problems.push({ file, message: `has no default export. Export \`${declareFn}(...)\` as the default.` });
+    return;
+  }
+  const by = declaredBy(module.default);
+  if (by !== declareFn) {
+    problems.push({
+      file,
+      message: by ? `default export is wrapped in ${by}, expected ${declareFn}.` : `default export is not wrapped in ${declareFn}(...).`
+    });
+    return;
   }
+  return module.default;
 }
-async function move(from, to) {
-  await $`mv -f ${from} ${to}`.quiet();
+
+// src/config/permutations.ts
+var {CryptoHasher, Glob: Glob2 } = globalThis.Bun;
+
+// src/config/folders.ts
+var {Glob } = globalThis.Bun;
+var PARAMETERS = "test-case-parameters";
+var sorted = (names) => [...new Set(names)].toSorted();
+async function scan(root, dir, pattern, onlyFiles) {
+  if (!await existsIn(root, `${dir}/`))
+    return [];
+  try {
+    return sorted(new Glob(pattern).scanSync({ cwd: `${root}/${dir}`, onlyFiles }));
+  } catch (error) {
+    throw new ConfigError(`${FOLDER}/${dir}/ could not be read: ${error instanceof Error ? error.message : String(error)}`);
+  }
 }
-async function exists(path2) {
-  return (await $`test -e ${path2}`.quiet().nothrow()).exitCode === 0;
+async function foldersIn(root, dir) {
+  const folders = [];
+  for (const name of await scan(root, dir, "*", false)) {
+    if (await existsIn(root, `${dir}/${name}/`))
+      folders.push(name);
+  }
+  return folders;
 }
-async function isDirectory(path2) {
-  return (await $`test -d ${path2}`.quiet().nothrow()).exitCode === 0;
-}
-function existsSync(path2) {
-  return Bun.spawnSync(["test", "-e", path2]).exitCode === 0;
-}
-function isDirectorySync(path2) {
-  return Bun.spawnSync(["test", "-d", path2]).exitCode === 0;
-}
-function readBytesSync(path2) {
-  const result = Bun.spawnSync(["cat", "--", path2], { stderr: "pipe" });
-  if (result.exitCode !== 0)
-    throw new Error(`can't read ${path2}: ${result.stderr.toString().trim()}`);
-  return new Uint8Array(result.stdout);
-}
-function listFilesSync(dir) {
-  if (!isDirectorySync(dir))
-    throw new Error(`not a directory: ${dir}`);
-  return [...new Bun.Glob("**").scanSync({ cwd: dir, dot: true, onlyFiles: true, followSymlinks: false })].toSorted();
-}
-function listEntries(dir, { recursive = false } = {}) {
-  if (!isDirectorySync(dir))
-    throw new Error(`not a directory: ${dir}`);
-  const pattern = new Bun.Glob(recursive ? "**" : "*");
-  const scan = (onlyFiles) => [...pattern.scanSync({ cwd: dir, dot: true, onlyFiles, followSymlinks: false })];
-  const files = new Set(scan(true));
-  const isRealDirectory = (path2) => Bun.spawnSync(["sh", "-c", 'test -d "$1" && test ! -L "$1"', "sh", join(dir, path2)]).exitCode === 0;
-  return scan(false).toSorted().map((path2) => ({ path: path2, isDirectory: !files.has(path2) && isRealDirectory(path2) }));
+async function tsFilesIn(root, dir) {
+  return (await scan(root, dir, "*.ts", true)).map((path2) => path2.slice(0, -".ts".length));
 }
 
-// src/api/declarations.ts
-var DECLARED_BY = Symbol.for("thunderjar.declaredBy");
-function declaredBy(value) {
-  if ((typeof value !== "object" || value === null) && typeof value !== "function")
-    return;
-  const mark = value[DECLARED_BY];
-  return typeof mark === "string" ? mark : undefined;
+// src/config/permutations.ts
+var AXES = ["baseImage", "codeState", "promptSet", "harnessModel", "initialPrompt"];
+function matrixShape(testCase) {
+  return AXES.map((axis) => testCase[axis].length);
+}
+function expandPermutations(testCase) {
+  return AXES.reduce((permutations, axis) => permutations.flatMap((partial) => testCase[axis].map((name) => ({ ...partial, [axis]: name }))), [{}]);
+}
+var abbreviateHash = (hash) => hash.slice(0, 8);
+var sha256 = (data) => new CryptoHasher("sha256").update(data).digest("hex");
+var HARNESS_MAPS = new Set(["models.ts", "versions.ts"]);
+async function walk(dir, prefix = "", ancestors = new Set) {
+  const { dev, ino } = await Bun.file(dir).stat();
+  const id = `${dev}:${ino}`;
+  if (ancestors.has(id))
+    return [];
+  const within = new Set([...ancestors, id]);
+  const entries = [...new Glob2("*").scanSync({ cwd: dir, onlyFiles: false, dot: true })];
+  const nested = await Promise.all(entries.map(async (entry) => {
+    const stat = await Bun.file(`${dir}/${entry}`).stat().catch(() => {
+      return;
+    });
+    if (!stat)
+      return [{ file: `${prefix}${entry}`, dangling: true }];
+    if (stat.isDirectory())
+      return walk(`${dir}/${entry}`, `${prefix}${entry}/`, within);
+    return [{ file: `${prefix}${entry}` }];
+  }));
+  return nested.flat();
+}
+async function contentOf(root, path2, exclude = new Set) {
+  if (!path2.endsWith("/"))
+    return [["", sha256(await Bun.file(`${root}/${path2}`).arrayBuffer())]];
+  const files = (await walk(`${root}/${path2}`)).filter(({ file }) => !exclude.has(file)).toSorted((a, b) => a.file < b.file ? -1 : a.file > b.file ? 1 : 0);
+  return Promise.all(files.map(async ({ file, dangling }) => [
+    file,
+    dangling ? null : sha256(await Bun.file(`${root}/${path2}${file}`).arrayBuffer())
+  ]));
+}
+function parsePair(pair) {
+  const at = pair.indexOf("@");
+  const slash = pair.indexOf("/", at);
+  return { harness: pair.slice(0, at), version: pair.slice(at + 1, slash), model: pair.slice(slash + 1) };
+}
+var FOLDERS = {
+  baseImage: "baseImages",
+  codeState: "codeStates",
+  promptSet: "promptSets"
+};
+async function hashPermutations(root, testCase) {
+  const cache = new Map;
+  const cached = (key, compute) => {
+    if (!cache.has(key))
+      cache.set(key, compute());
+    return cache.get(key);
+  };
+  const problems = [];
+  const folderHash = (axis, name) => cached(`${axis}\x00${name}`, async () => sha256(JSON.stringify(await contentOf(root, `${PARAMETERS}/${FOLDERS[axis]}/${name}/`))));
+  const initialPromptHash = (name) => cached(`initialPrompt\x00${name}`, async () => sha256(JSON.stringify(await contentOf(root, `${PARAMETERS}/tasks/${testCase.task}/initial-prompts/${name}.ts`))));
+  const harnessMap = async (harness, file, declareFn) => await loadDeclaration(root, `${PARAMETERS}/harnessModels/${harness}/${file}`, declareFn, problems);
+  const harnessHash = (pair) => {
+    const { harness, version } = parsePair(pair);
+    return cached(`harness\x00${harness}@${version}`, async () => {
+      const files = await contentOf(root, `${PARAMETERS}/harnessModels/${harness}/`, HARNESS_MAPS);
+      const versions = await harnessMap(harness, "versions.ts", "declareHarnessVersions");
+      return sha256(JSON.stringify({ files, version: versions?.[version] }));
+    });
+  };
+  const modelId = (pair) => {
+    const { harness, model } = parsePair(pair);
+    return cached(`model\x00${harness}/${model}`, async () => String((await harnessMap(harness, "models.ts", "declareHarnessModels"))?.[model]));
+  };
+  const permutations = await Promise.all(expandPermutations(testCase).map(async (permutation) => {
+    const parts = await Promise.all([
+      folderHash("baseImage", permutation.baseImage),
+      folderHash("codeState", permutation.codeState),
+      folderHash("promptSet", permutation.promptSet),
+      harnessHash(permutation.harnessModel),
+      initialPromptHash(permutation.initialPrompt),
+      modelId(permutation.harnessModel)
+    ]);
+    const [baseImage, codeState, promptSet, harnessModel, initialPrompt, model] = parts;
+    return {
+      ...permutation,
+      hash: sha256(JSON.stringify(parts)),
+      parameterHashes: { baseImage, codeState, promptSet, harnessModel, initialPrompt },
+      modelId: model
+    };
+  }));
+  if (problems.length > 0)
+    throw problemsError(problems);
+  return permutations;
 }
 
+// src/config/measurements.ts
+var {CryptoHasher: CryptoHasher2 } = globalThis.Bun;
+
 // src/instruments/instruments.ts
-var aggregateMethods = {
-  fileCreated: ["rate", "count"],
-  grep: ["mean", "median", "min", "max", "sum"],
-  templateTest: ["sum", "mean"]
-};
 var show = (value) => JSON.stringify(value) ?? String(value);
-var checkPath = (field, value, what) => typeof value === "string" && value !== "" ? [] : [[field, `must be ${what}, got ${show(value)}`]];
+var checkString = (field, value, what) => typeof value === "string" && value !== "" ? [] : [[field, `must be ${what}, got ${show(value)}`]];
 var fileCreated = {
   async evaluate({ glob }, ctx) {
     return { outcome: "measured", data: (await ctx.glob(glob)).length > 0 };
   },
   checkConfig(config) {
-    return checkPath("config.glob", config?.glob, "a glob pattern");
+    return checkString("config.glob", config?.glob, "a glob pattern");
   }
 };
 var lines = (text) => text === "" ? [] : text.replace(/\r?\n$/, "").split(/\r?\n/);
@@ -2355,27 +2332,45 @@ var grep = {
   },
   checkConfig(config) {
     const { glob, pattern } = config ?? {};
-    const problems = checkPath("config.glob", glob, "a glob pattern");
-    if (typeof pattern !== "string") {
-      problems.push(["config.pattern", `must be a JavaScript regular expression, got ${show(pattern)}`]);
-    } else {
-      try {
-        new RegExp(pattern);
-      } catch (error) {
-        problems.push(["config.pattern", `${show(pattern)} is not a valid regular expression: ${error.message}`]);
-      }
+    return [...checkString("config.glob", glob, "a glob pattern"), ...checkPattern(pattern)];
+  }
+};
+function checkPattern(pattern) {
+  if (typeof pattern !== "string")
+    return [["config.pattern", `must be a JavaScript regular expression, got ${show(pattern)}`]];
+  try {
+    new RegExp(pattern);
+    return [];
+  } catch (error) {
+    const reason = error.message.replace(/^Invalid regular expression: /, "");
+    return [["config.pattern", `${show(pattern)} is not a valid regular expression: ${reason}`]];
+  }
+}
+var replyMatches = {
+  async evaluate({ pattern, turn }, ctx) {
+    const reply = turn === undefined ? ctx.reply : ctx.replies[turn - 1];
+    if (!reply)
+      return { outcome: "skipped", reason: `no turn ${turn}: the initial prompt has ${ctx.replies.length}` };
+    if (reply.outcome !== "collected")
+      return { outcome: "skipped", reason: `no reply: ${reply.reason}` };
+    return { outcome: "measured", data: new RegExp(pattern).test(reply.text) };
+  },
+  checkConfig(config) {
+    const { pattern, turn } = config ?? {};
+    const problems = checkPattern(pattern);
+    if (turn !== undefined && (typeof turn !== "number" || !Number.isInteger(turn) || turn < 1)) {
+      problems.push(["config.turn", `must be a turn, counting from 1, got ${show(turn)}`]);
     }
     return problems;
-  }
+  },
+  usesContainer: false
 };
 var shellWord = (text) => `'${text.replaceAll("'", `'\\''`)}'`;
-var LOADERS = {
-  ".js": "js",
-  ".mjs": "js",
-  ".cjs": "js",
-  ".jsx": "jsx",
-  ".tsx": "tsx"
-};
+var dirname = (path2) => path2.includes("/") ? path2.slice(0, path2.lastIndexOf("/")) : ".";
+var basename = (path2) => path2.slice(path2.lastIndexOf("/") + 1);
+var extname = (file) => file.lastIndexOf(".") > 0 ? file.slice(file.lastIndexOf(".")) : "";
+var join = (dir, file) => dir === "." ? file : `${dir}/${file}`;
+var LOADERS = { ".js": "js", ".mjs": "js", ".cjs": "js", ".jsx": "jsx", ".tsx": "tsx" };
 var identifier = (stem) => {
   const name = stem.replace(/[^\w$]/g, "_");
   return /^[0-9]/.test(name) ? `_${name}` : name || "subject";
@@ -2386,11 +2381,10 @@ class CannotBind extends Error {
 async function render(template, subject, ctx) {
   const dir = dirname(subject);
   const file = basename(subject);
-  const stem = basename(file, extname(file));
-  const loader = LOADERS[extname(file)] ?? "ts";
+  const stem = file.slice(0, file.length - extname(file).length);
   let exports;
   try {
-    exports = new Bun.Transpiler({ loader }).scan(await ctx.readFile(subject)).exports;
+    exports = new Bun.Transpiler({ loader: LOADERS[extname(file)] ?? "ts" }).scan(await ctx.readFile(subject)).exports;
   } catch (error) {
     throw new CannotBind(`can't read the exports of ${subject}: ${error.message}`);
   }
@@ -2403,8 +2397,9 @@ async function render(template, subject, ctx) {
   let subjectPath = `./${file}`;
   if (defaultExport === "default") {
     defaultExport = identifier(stem);
-    subjectPath = `./${stem}.templateTest.bind.ts`;
-    await ctx.writeFile(join(dir, subjectPath), `export { default as ${defaultExport} } from "./${file}";
+    const binding = `${stem}.templateTest.bind.ts`;
+    subjectPath = `./${binding}`;
+    await ctx.writeFile(join(dir, binding), `export { default as ${defaultExport} } from "./${file}";
 `);
   }
   const values = { defaultExport, subjectPath };
@@ -2423,11 +2418,14 @@ async function runTest(testPath, ctx) {
 ${stderr}`;
   const count = (label) => Number(new RegExp(`^\\s*(\\d+) ${label}$`, "m").exec(output)?.[1] ?? "0");
   const ran = /^Ran (\d+) tests? /m.exec(output);
-  if (!ran || ran[1] === "0")
-    throw new CannotBind(`bun test ${testPath} reported no results`);
+  if (!ran || ran[1] === "0") {
+    const said = output.trim().split(`
+`).at(-1);
+    throw new CannotBind(`bun test ./${testPath} reported no results${said ? `: ${said}` : ""}`);
+  }
   if (count("errors?") > 0) {
     const error = /^\w*error: .*$/im.exec(output)?.[0];
-    throw new CannotBind(`bun test ${testPath} failed outside any test${error ? `: ${error}` : ""}`);
+    throw new CannotBind(`bun test ./${testPath} failed outside any test${error ? `: ${error}` : ""}`);
   }
   return { passed: count("pass"), failed: count("fail") };
 }
@@ -2454,1061 +2452,1012 @@ var templateTest = {
   checkConfig(config) {
     const { subject, template } = config ?? {};
     return [
-      ...checkPath("config.subject", subject, "a glob pattern"),
-      ...checkPath("config.template", template, "a path relative to the measurement file")
+      ...checkString("config.subject", subject, "a glob pattern"),
+      ...checkString("config.template", template, "a path relative to the measurement's file")
     ];
   },
   bundledFiles: ["template"]
 };
-var instruments = { fileCreated, grep, templateTest };
+var instruments = { fileCreated, grep, templateTest, replyMatches };
+var aggregateMethods = {
+  fileCreated: ["rate", "count"],
+  grep: ["mean", "median", "min", "max", "sum"],
+  templateTest: ["sum", "mean"],
+  replyMatches: ["rate", "count"]
+};
 var isInstrumentName = (name) => typeof name === "string" && Object.hasOwn(instruments, name);
 
-// src/project/config.ts
-class ConfigError extends Error {
-}
-
-class ThunderjarRootNotFoundError extends ConfigError {
-  constructor(startDir) {
-    super(`error: no .thunderjar/ folder found in ${startDir} or any parent directory.
-Run \`thunderjar init\` first.`);
-  }
-}
-
-class TestCaseNotFoundError extends ConfigError {
-  constructor(name, path2) {
-    super(`error: no test case named "${name}" (expected ${path2})`);
-  }
-}
-
-class InvalidConfigError extends ConfigError {
-  problems;
-  constructor(problems) {
-    super(problems.map(({ file, field, message }) => `error: .thunderjar/${file}: ${field ? `${field}: ` : ""}${message}`).join(`
-`));
-    this.problems = problems;
-  }
-}
-function findThunderjarRoot(startDir = process.cwd()) {
-  let dir = resolve(startDir);
-  for (;; ) {
-    const candidate = join(dir, ".thunderjar");
-    if (existsSync(candidate))
-      return candidate;
-    const parent = dirname(dir);
-    if (parent === dir)
-      throw new ThunderjarRootNotFoundError(startDir);
-    dir = parent;
-  }
-}
-async function loadDeclaration(root, file, declareFn, problems) {
-  let module;
-  try {
-    module = await import(join(root, file));
-  } catch (error) {
-    problems.push({ file, message: `could not be loaded: ${error instanceof Error ? error.message : String(error)}` });
-    return;
-  }
-  if (!("default" in module) || module.default === undefined) {
-    problems.push({ file, message: `has no default export. Export \`${declareFn}(...)\` as the default.` });
-    return;
-  }
-  const by = declaredBy(module.default);
-  if (by !== declareFn) {
-    problems.push({
-      file,
-      message: by ? `default export is wrapped in ${by}, expected ${declareFn}.` : `default export is not wrapped in ${declareFn}(...).`
-    });
-    return;
-  }
-  return module.default;
-}
+// src/config/measurements.ts
 var show2 = (value) => JSON.stringify(value) ?? String(value);
-function requireFile(root, testCaseFile, field, name, file, problems) {
-  if (existsSync(join(root, file)))
-    return true;
-  problems.push({ file: testCaseFile, field, message: `${show2(name)} has no matching ${file}` });
-  return false;
-}
-var FOLDER_PARAMETERS = [
-  ["baseImage", "baseImages", "declareBaseImage"],
-  ["codeState", "codeStates", "declareCodeState"],
-  ["promptSet", "promptSets", "declarePromptSet"]
-];
-var ARRAY_FIELDS = ["baseImage", "codeState", "promptSet", "harnessModel", "initialPrompt"];
-var PAIR = /^([^@/]+)@([^/]+)\/(.+)$/;
-function parseHarnessModelPair(pair) {
-  const match = PAIR.exec(pair);
-  if (!match)
-    return;
-  const [, family, version, model] = match;
-  return { family, version, model };
+var sha2562 = (data) => new CryptoHasher2("sha256").update(data).digest("hex");
+function normalize(path2) {
+  const segments = [];
+  for (const segment of path2.split("/")) {
+    if (segment === "..")
+      segments.pop();
+    else if (segment !== "." && segment !== "")
+      segments.push(segment);
+  }
+  return `${path2.startsWith("/") ? "/" : ""}${segments.join("/")}`;
 }
-async function collectMeasurements(root, task, problems) {
-  const dir = `test-case-parameters/tasks/${task}/measurements`;
-  if (!existsSync(join(root, dir)))
-    return [];
-  const files = [...new Bun.Glob("*.ts").scanSync({ cwd: join(root, dir) })].filter((name) => !basename(name, ".ts").includes(".")).toSorted();
+async function checkMeasurements(root, task, problems) {
+  const dir = `${PARAMETERS}/tasks/${task}/measurements`;
   const measurements = [];
-  for (const name of files) {
-    const file = `${dir}/${name}`;
+  for (const name of (await tsFilesIn(root, dir)).filter((name2) => !name2.includes("."))) {
+    const file = `${dir}/${name}.ts`;
+    const problem = (field, message) => problems.push({ file, field, message });
     const declaration = await loadDeclaration(root, file, "declareMeasurement", problems);
     if (!declaration)
       continue;
     const { instrument, config, aggregate } = declaration;
     if (!isInstrumentName(instrument)) {
-      problems.push({
-        file,
-        field: "instrument",
-        message: `${show2(instrument)} is not a known instrument. Known instruments: ${Object.keys(instruments).join(", ")}`
-      });
+      problem("instrument", `${show2(instrument)} is not a known instrument. Known instruments: ${Object.keys(instruments).join(", ")}`);
       continue;
     }
     const before = problems.length;
     const { checkConfig, bundledFiles = [] } = instruments[instrument];
     const configProblems = checkConfig(config);
     for (const [field, message] of configProblems)
-      problems.push({ file, field, message });
+      problem(field, message);
+    const fields = { ...config };
+    const files = {};
     if (configProblems.length === 0) {
       for (const key of bundledFiles) {
-        const path2 = config[key];
-        requireFile(root, file, `config.${key}`, path2, join(dir, path2), problems);
+        const path2 = normalize(`${dir}/${fields[key]}`);
+        if (!await existsIn(root, path2)) {
+          problem(`config.${key}`, `${show2(fields[key])} has no matching ${FOLDER}/${path2}`);
+          continue;
+        }
+        fields[key] = `${root}/${path2}`;
+        files[key] = sha2562(await Bun.file(fields[key]).arrayBuffer());
       }
     }
     if (!Array.isArray(aggregate)) {
-      problems.push({ file, field: "aggregate", message: `must be an array of aggregation methods, got ${show2(aggregate)}` });
+      problem("aggregate", `must be an array of aggregation methods, got ${show2(aggregate)}`);
     } else {
-      const menu = aggregateMethods[instrument];
-      for (const method of aggregate) {
-        if (menu.includes(method))
-          continue;
-        problems.push({
-          file,
-          field: "aggregate",
-          message: `${show2(method)} is not a way ${instrument}'s values combine. Use one of: ${menu.join(", ")}`
-        });
+      const methods = aggregateMethods[instrument];
+      for (const method of aggregate.filter((method2) => !methods.includes(method2))) {
+        problem("aggregate", `${show2(method)} is not a way ${instrument}'s values combine. Use one of: ${methods.join(", ")}`);
       }
     }
     if (problems.length === before) {
-      measurements.push({ ...declaration, name: basename(name, ".ts"), dir: join(root, dir) });
+      measurements.push({
+        name,
+        declaration,
+        config: fields,
+        contentHash: sha2562(JSON.stringify({ instrument, config, files }))
+      });
     }
   }
   return measurements;
 }
 async function loadMeasurements(root, task) {
   const problems = [];
-  const measurements = await collectMeasurements(root, task, problems);
+  const measurements = await checkMeasurements(root, task, problems);
   if (problems.length > 0)
-    throw new InvalidConfigError(problems);
+    throw problemsError(problems);
   return measurements;
 }
-async function checkTestCase(root, file, testCase, problems) {
-  const parameters = "test-case-parameters";
-  const names = {};
-  for (const field of ARRAY_FIELDS) {
-    const value = testCase[field];
-    if (!Array.isArray(value)) {
-      problems.push({ file, field, message: `must be an array of names, got ${show2(value)}` });
-    } else if (value.length === 0) {
-      problems.push({ file, field, message: "must name at least one value, got []" });
-    } else if (value.some((v) => typeof v !== "string")) {
-      problems.push({ file, field, message: `must be an array of names, got ${show2(value)}` });
-    } else {
-      names[field] = value;
+
+// src/config/requiredEnv.ts
+var NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var show3 = (value) => JSON.stringify(value) ?? String(value);
+function requiredEnvProblem(requiredEnv) {
+  if (requiredEnv === undefined)
+    return;
+  if (!Array.isArray(requiredEnv))
+    return `must be an array of environment variable names, got ${show3(requiredEnv)}`;
+  const bad = requiredEnv.filter((name) => typeof name !== "string" || !NAME.test(name));
+  if (bad.length > 0)
+    return `${bad.map(show3).join(", ")} ${bad.length === 1 ? "is not an environment variable name" : "are not environment variable names"}`;
+  return;
+}
+var requiredEnvOf = (harness) => harness.requiredEnv ?? [];
+async function checkRequiredEnv(root, testCase, env = Bun.env) {
+  const harnesses = [...new Set(testCase.harnessModel.map((pair) => parsePair(pair).harness))];
+  const problems = [];
+  const missing = [];
+  for (const name of harnesses) {
+    const harness = await loadDeclaration(root, `${PARAMETERS}/harnessModels/${name}/index.ts`, "declareHarness", problems);
+    for (const variable of harness ? requiredEnvOf(harness) : []) {
+      if (!env[variable])
+        missing.push(`${name} needs ${variable}, which is not set.`);
+    }
+  }
+  if (problems.length > 0)
+    throw problemsError(problems);
+  if (missing.length === 0)
+    return;
+  const hint = `Export ${missing.length === 1 ? "it" : "them"} in the shell that runs thunderjar.`;
+  throw new ConfigError(...missing.slice(0, -1), `${missing.at(-1)}
+${hint}`);
+}
+
+// src/config/runOptions.ts
+var show4 = (value) => JSON.stringify(value) ?? String(value);
+var RESERVED = ["--name", "--pull", "--entrypoint", "--rm", "--detach", "-d"];
+function runOptionsProblem(runOptions) {
+  if (runOptions === undefined)
+    return;
+  if (!Array.isArray(runOptions) || runOptions.some((option) => typeof option !== "string")) {
+    return `must be an array of docker run options and their values, each a string, got ${show4(runOptions)}`;
+  }
+  const reserved = runOptions.filter((option) => RESERVED.includes(option.split("=")[0]));
+  if (reserved.length > 0)
+    return `${reserved.map(show4).join(", ")} can't be given: Thunderjar sets ${reserved.length === 1 ? "it" : "them"} itself`;
+  return;
+}
+
+// src/config/testCase.ts
+var show5 = (value) => JSON.stringify(value) ?? String(value);
+var PARAMETER_FOLDERS = [
+  ["baseImages", "base images"],
+  ["codeStates", "code states"],
+  ["promptSets", "prompt sets"],
+  ["harnessModels", "harnesses"],
+  ["tasks", "tasks"]
+];
+async function checkParameterFolders(root) {
+  const problems = [];
+  for (const [folder, what] of PARAMETER_FOLDERS) {
+    if ((await foldersIn(root, `${PARAMETERS}/${folder}`)).length === 0) {
+      problems.push(`${FOLDER}/${PARAMETERS}/${folder}/ has no ${what}`);
     }
   }
-  const iterations = testCase.iterations;
-  if (typeof iterations !== "number" || !Number.isInteger(iterations) || iterations < 1) {
-    problems.push({ file, field: "iterations", message: `must be a positive integer, got ${show2(iterations)}` });
+  if (problems.length > 0)
+    throw new ConfigError(...problems);
+}
+var FOLDER_FIELDS = [
+  ["baseImage", "baseImages", "declareBaseImage"],
+  ["codeState", "codeStates", "declareCodeState"],
+  ["promptSet", "promptSets", "declarePromptSet"]
+];
+var ARRAY_FIELDS = ["baseImage", "codeState", "promptSet", "harnessModel", "initialPrompt"];
+var HARNESS_MODEL = /^([^@/]+)@([^/]+)\/(.+)$/;
+
+class TestCaseChecker {
+  root;
+  file;
+  problems = [];
+  harnesses = new Map;
+  constructor(root, file) {
+    this.root = root;
+    this.file = file;
+  }
+  problem(field, message) {
+    this.problems.push({ file: this.file, field, message });
+  }
+  async requires(field, name, path2) {
+    if (await existsIn(this.root, path2))
+      return true;
+    this.problem(field, `${show5(name)} has no matching ${FOLDER}/${path2}`);
+    return false;
   }
-  for (const [field, folder, declareFn] of FOLDER_PARAMETERS) {
-    for (const name of names[field] ?? []) {
-      const index = `${parameters}/${folder}/${name}/index.ts`;
-      if (requireFile(root, file, field, name, index, problems)) {
-        await loadDeclaration(root, index, declareFn, problems);
+  arrays(testCase) {
+    const names = {};
+    for (const field of ARRAY_FIELDS) {
+      const value = testCase[field];
+      if (!Array.isArray(value) || value.some((name) => typeof name !== "string")) {
+        this.problem(field, `must be an array of names, got ${show5(value)}`);
+      } else if (value.length === 0) {
+        this.problem(field, "must name at least one value, got []");
+      } else {
+        names[field] = value;
       }
     }
+    return names;
   }
-  const task = testCase.task;
-  let taskExists = false;
-  if (typeof task !== "string") {
-    problems.push({ file, field: "task", message: `must be a task name, got ${show2(task)}` });
-  } else {
-    taskExists = requireFile(root, file, "task", task, `${parameters}/tasks/${task}/`, problems);
-  }
-  if (taskExists) {
-    await collectMeasurements(root, task, problems);
-    for (const name of names.initialPrompt ?? []) {
-      const prompt = `${parameters}/tasks/${task}/initial-prompts/${name}.ts`;
-      if (existsSync(join(root, prompt))) {
-        await loadDeclaration(root, prompt, "declareInitialPrompt", problems);
-        continue;
+  checkIterations(iterations) {
+    if (typeof iterations !== "number" || !Number.isInteger(iterations) || iterations < 1) {
+      this.problem("iterations", `must be a positive integer, got ${show5(iterations)}`);
+    }
+  }
+  async checkFolderFields(names) {
+    for (const [field, folder, declareFn] of FOLDER_FIELDS) {
+      for (const name of names[field] ?? []) {
+        const index = `${PARAMETERS}/${folder}/${name}/index.ts`;
+        if (await this.requires(field, name, index)) {
+          const declaration = await loadDeclaration(this.root, index, declareFn, this.problems);
+          const optionsProblem = field === "baseImage" && declaration && runOptionsProblem(declaration.runOptions);
+          if (optionsProblem)
+            this.problems.push({ file: index, field: "runOptions", message: optionsProblem });
+        }
       }
-      const owner = new Bun.Glob(`${parameters}/tasks/*/initial-prompts/${name}.ts`).scanSync({ cwd: root }).next().value;
-      problems.push({
-        file,
-        field: "initialPrompt",
-        message: owner ? `${show2(name)} belongs to task ${show2(owner.split("/")[2])}, not ${show2(task)}` : `${show2(name)} has no matching ${prompt}`
-      });
     }
   }
-  for (const pair of names.harnessModel ?? []) {
-    const parsed = parseHarnessModelPair(pair);
-    if (!parsed) {
-      problems.push({ file, field: "harnessModel", message: `${show2(pair)} is not of the form family@version/model` });
-      continue;
+  async checkTask(task, initialPrompts) {
+    if (typeof task !== "string") {
+      this.problem("task", `must be a task name, got ${show5(task)}`);
+      return;
     }
-    const { family, version, model } = parsed;
-    const familyDir = `${parameters}/harnessModels/${family}`;
-    if (!requireFile(root, file, "harnessModel", pair, `${familyDir}/`, problems))
-      continue;
-    const familyProblems = [];
-    await loadDeclaration(root, `${familyDir}/index.ts`, "declareHarness", familyProblems);
-    await loadDeclaration(root, `${familyDir}/collectTokenCosts.ts`, "declareTokenCostCollector", familyProblems);
-    const versions = await loadDeclaration(root, `${familyDir}/versions.ts`, "declareHarnessVersions", familyProblems);
-    const models = await loadDeclaration(root, `${familyDir}/models.ts`, "declareHarnessModels", familyProblems);
-    for (const p of familyProblems) {
-      if (!problems.some((q) => q.file === p.file && q.message === p.message))
-        problems.push(p);
-    }
-    if (versions && !Object.hasOwn(versions, version)) {
-      problems.push({
-        file,
-        field: "harnessModel",
-        message: `${show2(pair)}: version ${show2(version)} is not in ${familyDir}/versions.ts`
-      });
+    if (!await this.requires("task", task, `${PARAMETERS}/tasks/${task}/`))
+      return;
+    await checkMeasurements(this.root, task, this.problems);
+    for (const name of initialPrompts) {
+      const prompt = `${PARAMETERS}/tasks/${task}/initial-prompts/${name}.ts`;
+      if (await existsIn(this.root, prompt)) {
+        const declaration = await loadDeclaration(this.root, prompt, "declareInitialPrompt", this.problems);
+        const timeout = declaration?.timeoutSeconds;
+        if (declaration && (typeof timeout !== "number" || !Number.isFinite(timeout) || timeout <= 0)) {
+          this.problems.push({ file: prompt, field: "timeoutSeconds", message: `must be a number of seconds above 0, got ${show5(timeout)}` });
+        }
+        if (declaration)
+          this.checkPrompt(prompt, declaration);
+        continue;
+      }
+      const owner = new Bun.Glob(`${PARAMETERS}/tasks/*/initial-prompts/${name}.ts`).scanSync({ cwd: this.root }).next().value;
+      this.problem("initialPrompt", owner ? `${show5(name)} belongs to task ${show5(owner.split("/")[2])}, not ${show5(task)}` : `${show5(name)} has no matching ${FOLDER}/${prompt}`);
     }
-    if (models && !Object.hasOwn(models, model)) {
-      problems.push({
-        file,
-        field: "harnessModel",
-        message: `${show2(pair)}: model ${show2(model)} is not in ${familyDir}/models.ts`
-      });
+  }
+  checkPrompt(file, { prompt, turns }) {
+    const problem = (field, message) => this.problems.push({ file, field, message });
+    if (prompt !== undefined && turns !== undefined) {
+      problem("turns", "can't be given beside prompt. Give a single prompt, or a list of turns.");
+    } else if (turns !== undefined) {
+      if (!Array.isArray(turns) || turns.length === 0 || turns.some((turn) => typeof turn !== "string")) {
+        problem("turns", `must be a list of at least one prompt, got ${show5(turns)}`);
+      }
+    } else if (typeof prompt !== "string") {
+      problem("prompt", `must be the prompt's text, or give a list of turns instead, got ${show5(prompt)}`);
+    }
+  }
+  async harness(name) {
+    const loaded = this.harnesses.get(name);
+    if (loaded)
+      return loaded;
+    const dir = `${PARAMETERS}/harnessModels/${name}`;
+    const declaration = await loadDeclaration(this.root, `${dir}/index.ts`, "declareHarness", this.problems);
+    const envProblem = declaration && requiredEnvProblem(declaration.requiredEnv);
+    if (envProblem)
+      this.problems.push({ file: `${dir}/index.ts`, field: "requiredEnv", message: envProblem });
+    if (declaration && declaration.collectReply !== undefined && typeof declaration.collectReply !== "function") {
+      this.problems.push({ file: `${dir}/index.ts`, field: "collectReply", message: `must be a function of the result file's text, got ${show5(declaration.collectReply)}` });
+    }
+    await loadDeclaration(this.root, `${dir}/collectTokenCosts.ts`, "declareTokenCostCollector", this.problems);
+    const harness = {
+      versions: await loadDeclaration(this.root, `${dir}/versions.ts`, "declareHarnessVersions", this.problems),
+      models: await loadDeclaration(this.root, `${dir}/models.ts`, "declareHarnessModels", this.problems)
+    };
+    this.harnesses.set(name, harness);
+    return harness;
+  }
+  async checkHarnessModels(pairs) {
+    for (const pair of pairs) {
+      const match = HARNESS_MODEL.exec(pair);
+      if (!match) {
+        this.problem("harnessModel", `${show5(pair)} is not of the form harness@version/model`);
+        continue;
+      }
+      const [, name, version, model] = match;
+      const dir = `${PARAMETERS}/harnessModels/${name}`;
+      if (!await this.requires("harnessModel", pair, `${dir}/`))
+        continue;
+      const { versions, models } = await this.harness(name);
+      if (versions && !Object.hasOwn(versions, version)) {
+        this.problem("harnessModel", `${show5(pair)}: version ${show5(version)} is not in ${FOLDER}/${dir}/versions.ts`);
+      }
+      if (models && !Object.hasOwn(models, model)) {
+        this.problem("harnessModel", `${show5(pair)}: model ${show5(model)} is not in ${FOLDER}/${dir}/models.ts`);
+      }
     }
   }
+  async check(testCase) {
+    const names = this.arrays(testCase);
+    this.checkIterations(testCase.iterations);
+    await this.checkFolderFields(names);
+    await this.checkTask(testCase.task, names.initialPrompt ?? []);
+    await this.checkHarnessModels(names.harnessModel ?? []);
+  }
 }
 async function loadTestCase(root, name) {
+  await checkParameterFolders(root);
   const file = `test-cases/${name}.ts`;
-  const path2 = join(root, file);
-  if (!existsSync(path2))
-    throw new TestCaseNotFoundError(name, path2);
-  const problems = [];
-  const testCase = await loadDeclaration(root, file, "declareTestCase", problems);
+  if (!await existsIn(root, file)) {
+    throw new ConfigError(`No test case named "${name}": expected ${FOLDER}/${file}.`);
+  }
+  const checker = new TestCaseChecker(root, file);
+  const testCase = await loadDeclaration(root, file, "declareTestCase", checker.problems);
   if (testCase)
-    await checkTestCase(root, file, testCase, problems);
-  if (problems.length > 0)
-    throw new InvalidConfigError(problems);
+    await checker.check(testCase);
+  if (checker.problems.length > 0)
+    throw problemsError(checker.problems);
   return testCase;
 }
 
-// src/matrix/permutations.ts
-var AXES = ["baseImage", "codeState", "promptSet", "harnessModel", "initialPrompt"];
-function matrixShape(testCase) {
-  return AXES.map((axis) => testCase[axis].length);
-}
-function expandPermutations(testCase) {
-  const permutations = [];
-  for (const baseImage of testCase.baseImage)
-    for (const codeState of testCase.codeState)
-      for (const promptSet of testCase.promptSet)
-        for (const harnessModel of testCase.harnessModel)
-          for (const initialPrompt of testCase.initialPrompt)
-            permutations.push({ baseImage, codeState, promptSet, harnessModel, initialPrompt });
-  return permutations;
-}
-function permutationRows(permutations) {
-  const cells = permutations.map((p) => AXES.map((axis) => p[axis]));
-  const widths = AXES.map((_, i) => Math.max(...cells.map((row) => row[i].length)));
-  return cells.map((row) => row.map((cell, i) => i === AXES.length - 1 ? cell : cell.padEnd(widths[i])).join(" | "));
-}
+// src/docker/docker.ts
+var {$ } = globalThis.Bun;
 
-// src/matrix/hashing.ts
-var sha256 = (data) => new Bun.CryptoHasher("sha256").update(data).digest("hex");
-function canonical(value) {
-  if (typeof value === "function")
-    return JSON.stringify(value.toString());
-  if (Array.isArray(value))
-    return `[${value.map(canonical).join(",")}]`;
-  if (typeof value === "object" && value !== null) {
-    const keys = Object.keys(value).toSorted();
-    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonical(value[k])}`).join(",")}}`;
-  }
-  return JSON.stringify(value) ?? "null";
-}
-var hashValue = (value) => sha256(canonical(value));
-var abbreviateHash = (hash) => hash.slice(0, 8);
-function hashFolder(dir, exclude = []) {
-  const files = listFilesSync(dir).filter((file) => !exclude.includes(file));
-  return hashValue(files.map((file) => [file, sha256(readBytesSync(join(dir, file)))]));
-}
-var hashBaseImage = (path2) => hashFolder(path2);
-var hashCodeState = (path2) => hashFolder(path2);
-var hashPromptSet = (path2) => hashFolder(path2);
-var hashInitialPrompt = (path2) => sha256(readBytesSync(path2));
-var FAMILY_MAP_FILES = ["models.ts", "versions.ts", "collectTokenCosts.ts"];
-var EXECUTION_OVERRIDES = ["applyParameter", "cli", "requiredEnv"];
-async function loadMap(file) {
-  const module = await import(file);
-  return module.default ?? {};
-}
-async function hashHarnessModelPair(family, version, model) {
-  const versions = await loadMap(join(family, "versions.ts"));
-  const models = await loadMap(join(family, "models.ts"));
-  if (!Object.hasOwn(versions, version))
-    throw new Error(`version "${version}" is not in ${family}/versions.ts`);
-  if (!Object.hasOwn(models, model))
-    throw new Error(`model "${model}" is not in ${family}/models.ts`);
-  const entry = versions[version];
-  if (typeof entry.version !== "string") {
-    throw new Error(`version "${version}" in ${family}/versions.ts has no pinned version; floating versions are not supported yet`);
-  }
-  const overrides = Object.fromEntries(EXECUTION_OVERRIDES.filter((k) => (k in entry)).map((k) => [k, entry[k]]));
-  return hashValue({
-    shared: hashFolder(family, FAMILY_MAP_FILES),
-    version: entry.version,
-    overrides,
-    modelId: models[model]
-  });
-}
-var hashPermutation = (hashes) => hashValue(hashes);
-function hashMeasurement({ instrument, config, dir }) {
-  const keys = isInstrumentName(instrument) ? instruments[instrument].bundledFiles ?? [] : [];
-  if (keys.length === 0)
-    return hashValue({ instrument, config });
-  if (dir === undefined)
-    throw new Error(`a ${instrument} measurement's hash needs the folder its bundled files are in`);
-  const paths = config;
-  const files = Object.fromEntries(keys.map((key) => [key, sha256(readBytesSync(resolve(dir, paths[key])))]));
-  return hashValue({ instrument, config, files });
+class DockerUnavailableError extends Error {
 }
 
-// src/matrix/tags.ts
-var prerunTag = (permutationHash) => `prerun-h${abbreviateHash(permutationHash)}`;
-var postrunTag = (executionId, permutationHash, iterationIndex) => `postrun-e${executionId}-h${abbreviateHash(permutationHash)}-i${String(iterationIndex).padStart(2, "0")}`;
-var imageRef = (repository, tag) => `${repository}:${tag}`;
+class DockerBuildError extends Error {
+}
 
-// src/images/prerun.ts
-var LOCAL_REPOSITORY = "thunderjar";
-var prerunImageRef = (repository, permutationHash) => imageRef(repository, prerunTag(permutationHash));
-var PARAMETER_DIRS = {
-  baseImage: "parameters/baseImage",
-  harness: "parameters/harnessModel",
-  codeState: "parameters/codeState",
-  promptSet: "parameters/promptSet"
-};
-var importDefault = async (path2) => (await import(path2)).default;
-async function loadPrerunParameters(root, task, permutation) {
-  const parameters = join(root, "test-case-parameters");
-  const folder = async (dir, owner) => {
-    const { config, applyParameter } = await importDefault(join(dir, "index.ts"));
-    return { owner, dir, config, applyParameter };
-  };
-  const { family, version } = parseHarnessModelPair(permutation.harnessModel);
-  const familyDir = join(parameters, "harnessModels", family);
-  const harness = await importDefault(join(familyDir, "index.ts"));
-  const entry = (await importDefault(join(familyDir, "versions.ts")))[version];
-  if (!("version" in entry))
-    throw new Error(`${permutation.harnessModel}: floating versions are not supported yet`);
-  const initialPrompt = await importDefault(join(parameters, "tasks", task, "initial-prompts", `${permutation.initialPrompt}.ts`));
-  return {
-    baseImage: await folder(join(parameters, "baseImages", permutation.baseImage), `base image "${permutation.baseImage}"`),
-    harness: {
-      owner: `harness/model pair "${permutation.harnessModel}"`,
-      dir: familyDir,
-      exclude: FAMILY_MAP_FILES,
-      config: harness.config,
-      applyParameter: entry.applyParameter ?? harness.applyParameter,
-      version: entry.version
-    },
-    codeState: await folder(join(parameters, "codeStates", permutation.codeState), `code state "${permutation.codeState}"`),
-    promptSet: await folder(join(parameters, "promptSets", permutation.promptSet), `prompt set "${permutation.promptSet}"`),
-    initialPrompt: {
-      owner: `initial prompt "${permutation.initialPrompt}"`,
-      config: initialPrompt.config,
-      applyParameter: initialPrompt.applyParameter
+class DockerContainerError extends Error {
+}
+var dockerBinary = () => Bun.env.THUNDERJAR_DOCKER || "docker";
+var reasonOf = (stderr) => stderr.toString().trim().split(`
+`).at(-1);
+async function buildImage(contextDir, image) {
+  const binary = dockerBinary();
+  const result = await $`${binary} build -t ${image} ${contextDir}`.quiet().nothrow();
+  if (result.exitCode !== 0) {
+    throw new DockerBuildError(reasonOf(result.stderr) || `\`${binary} build\` exited ${result.exitCode}`);
+  }
+}
+async function imagesIn(repository) {
+  const binary = dockerBinary();
+  const result = await $`${binary} image ls --format ${"{{.Repository}}:{{.Tag}}"} ${repository}`.quiet().nothrow();
+  if (result.exitCode !== 0) {
+    throw new DockerUnavailableError(reasonOf(result.stderr) || `\`${binary} image ls\` exited ${result.exitCode}`);
+  }
+  return new Set(result.stdout.toString().split(`
+`).filter(Boolean));
+}
+async function mustRun(args) {
+  const binary = dockerBinary();
+  const result = await $`${binary} ${args}`.quiet().nothrow();
+  if (result.exitCode !== 0) {
+    throw new DockerContainerError(reasonOf(result.stderr) || `\`${binary} ${args[0]}\` exited ${result.exitCode}`);
+  }
+  return result.stdout.toString();
+}
+async function runContainer(image, name, script, { env = [], runOptions = [], timeoutSeconds } = {}) {
+  const binary = dockerBinary();
+  const passed = env.flatMap((variable) => ["-e", variable]);
+  const args = ["run", "--name", name, "--pull", "never", ...passed, ...runOptions, "--entrypoint", "sh", image, "-c", script];
+  const child = Bun.spawn([binary, ...args], { env: { ...Bun.env }, stdin: "ignore", stdout: "ignore", stderr: "pipe" });
+  let killing;
+  const timer = timeoutSeconds === undefined ? undefined : setTimeout(() => {
+    const killedAt2 = Date.now();
+    killing = mustRun(["kill", name]).then(() => killedAt2, () => {
+      return;
+    });
+  }, timeoutSeconds * 1000);
+  const [exitCode, stderr] = await Promise.all([child.exited, new Response(child.stderr).text()]);
+  clearTimeout(timer);
+  const killedAt = await killing;
+  if (killedAt !== undefined)
+    return { timedOut: true, killedAt };
+  if (exitCode !== 0) {
+    throw new DockerContainerError(reasonOf(stderr) || `\`${binary} run\` exited ${exitCode}`);
+  }
+  return { timedOut: false };
+}
+async function readContainerFile(name, path2) {
+  const dir = `${Bun.env.TMPDIR || "/tmp"}/thunderjar-cp-${crypto.randomUUID()}`;
+  await $`mkdir -p ${dir}`.quiet();
+  try {
+    const binary = dockerBinary();
+    const result = await $`${binary} cp ${`${name}:${path2}`} ${dir}/file`.quiet().nothrow();
+    if (result.exitCode !== 0) {
+      const reason = reasonOf(result.stderr);
+      if (reason?.includes("Could not find the file"))
+        return;
+      throw new DockerContainerError(reason || `\`${binary} cp\` exited ${result.exitCode}`);
     }
-  };
+    return await Bun.file(`${dir}/file`).text();
+  } finally {
+    await $`rm -rf ${dir}`.quiet();
+  }
 }
-var COMMIT = /^[0-9a-f]{4,64}$/i;
-function recordingGit(owner, needs) {
-  const checkCommit = (method, commit) => {
-    if (!COMMIT.test(commit)) {
-      throw new Error(`error: ${owner}: ctx.git.${method} needs a commit hash, got ${JSON.stringify(commit)}.`);
-    }
-  };
+async function commitContainer(name, image, like) {
+  const inspected = await mustRun(["image", "inspect", "--format", "{{json .Config.Entrypoint}}\t{{json .Config.Cmd}}", like]);
+  const [entrypoint, cmd] = inspected.trim().split("\t");
+  const changes = [`ENTRYPOINT ${entrypoint === "null" ? '[""]' : entrypoint}`, `CMD ${cmd === "null" ? '["sh"]' : cmd}`];
+  await mustRun(["commit", ...changes.flatMap((change) => ["--change", change]), name, image]);
+}
+async function removeContainer(name) {
+  await mustRun(["rm", "--force", name]);
+}
+async function startContainer(image, name) {
+  await mustRun(["run", "--detach", "--name", name, "--pull", "never", "--entrypoint", "sh", image, "-c", "exec sleep 2147483647"]);
+}
+async function execInContainer(name, workdir, command, stdin) {
+  const binary = dockerBinary();
+  const args = ["exec", ...stdin === undefined ? [] : ["--interactive"], "--workdir", workdir, name, ...command];
+  const result = stdin === undefined ? await $`${binary} ${args}`.quiet().nothrow() : await $`${binary} ${args} < ${new Response(stdin)}`.quiet().nothrow();
+  if (result.exitCode !== 0 && /^(Error response from daemon|OCI runtime exec failed|Cannot connect to the Docker daemon)/.test(result.stderr.toString())) {
+    throw new DockerContainerError(reasonOf(result.stderr) || `\`${binary} exec\` exited ${result.exitCode}`);
+  }
+  return { stdout: result.stdout.toString(), stderr: result.stderr.toString(), exitCode: result.exitCode };
+}
+
+// src/execution/images.ts
+var DEFAULT_IMAGE_PREFIX = "thunderjar";
+var NAME_COMPONENT = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*$/;
+function imagePrefixProblem(prefix) {
+  if (NAME_COMPONENT.test(prefix))
+    return;
+  return "must be lowercase letters and digits, joined by single separators (., _, __ or -), as a Docker repository name is.";
+}
+var prerunRepository = (prefix = DEFAULT_IMAGE_PREFIX) => `${prefix}-prerun`;
+var prerunImage = (hash, prefix = DEFAULT_IMAGE_PREFIX) => `${prerunRepository(prefix)}:${abbreviateHash(hash)}`;
+var postrunImage = (executionId, permutation, iteration, prefix = DEFAULT_IMAGE_PREFIX) => `${prefix}-postrun:${executionId}-${permutation}-${iteration}`;
+var containerName = (executionId, permutation, iteration, prefix = DEFAULT_IMAGE_PREFIX) => `${prefix}-run-${executionId}-${permutation}-${iteration}`;
+
+// src/execution/prerunBuilds.ts
+var {$: $3 } = globalThis.Bun;
+
+// src/git/git.ts
+var {$: $2 } = globalThis.Bun;
+var BUNDLE_BRANCH = "code-state";
+async function findRepository(dir) {
+  const common = await $2`git -C ${dir} rev-parse --path-format=absolute --git-common-dir`.quiet().nothrow();
+  if (common.exitCode !== 0)
+    return;
+  const objects = `${common.stdout.toString().trim()}/objects`;
   return {
-    bundle(commit) {
-      checkCommit("bundle", commit);
-      const path2 = `git/${commit}.bundle`;
-      needs.push({ kind: "bundle", owner, commit, path: path2 });
-      return path2;
+    async resolveCommit(commit) {
+      const result = await $2`git -C ${dir} rev-parse --verify --quiet ${`${commit}^{commit}`}`.quiet().nothrow();
+      return result.exitCode === 0 ? result.stdout.toString().trim() : undefined;
     },
-    show(commit, file) {
-      checkCommit("show", commit);
-      const normal = normalize(file);
-      if (file === "" || isAbsolute(file) || normal === "." || normal.split("/").includes("..")) {
-        throw new Error(`error: ${owner}: ctx.git.show needs a path inside the repository, got ${JSON.stringify(file)}.`);
+    async readFile(commit, path2) {
+      const result = await $2`git -C ${dir} show ${`${commit}:${path2}`}`.quiet().nothrow();
+      return result.exitCode === 0 ? new Uint8Array(result.stdout) : undefined;
+    },
+    async bundle(commit, dest) {
+      const scratch = `${Bun.env.TMPDIR || "/tmp"}/thunderjar-bundle-${crypto.randomUUID()}`;
+      try {
+        await $2`git init --quiet --bare ${scratch}`.quiet();
+        await Bun.write(`${scratch}/objects/info/alternates`, `${objects}
+`);
+        await $2`git --git-dir=${scratch} update-ref ${`refs/heads/${BUNDLE_BRANCH}`} ${commit}`.quiet();
+        await $2`git --git-dir=${scratch} symbolic-ref HEAD ${`refs/heads/${BUNDLE_BRANCH}`}`.quiet();
+        await $2`git --git-dir=${scratch} bundle create --quiet ${dest} HEAD ${BUNDLE_BRANCH}`.quiet();
+      } finally {
+        await $2`rm -rf ${scratch}`.quiet();
       }
-      const path2 = `git/${commit}/${normal}`;
-      needs.push({ kind: "file", owner, commit, file: normal, path: path2 });
-      return path2;
     }
   };
 }
-function renderPrerun(parameters) {
-  const git = [];
-  const ctx = (role) => ({ git: recordingGit(parameters[role].owner, git), dir: PARAMETER_DIRS[role] });
-  const { baseImage, harness, codeState, promptSet, initialPrompt } = parameters;
-  const steps = [
-    baseImage.applyParameter(baseImage.config, ctx("baseImage")),
-    harness.applyParameter(harness.config, { ...ctx("harness"), version: harness.version }),
-    "WORKDIR /workspace",
-    codeState.applyParameter(codeState.config, ctx("codeState")),
-    promptSet.applyParameter(promptSet.config, ctx("promptSet")),
-    initialPrompt.applyParameter(initialPrompt.config, { git: recordingGit(initialPrompt.owner, git) })
-  ];
-  return { dockerfile: `${steps.filter((step) => step.trim() !== "").join(`
-`)}
-`, git };
-}
 
-class MissingCommitsError extends Error {
-}
-async function checkCommits(needs, repository) {
+// src/execution/gitNeeds.ts
+async function checkGitNeeds(root, needs) {
+  if (needs.length === 0)
+    return;
+  const repository = await findRepository(root);
   const problems = new Set;
   const present = new Map;
   for (const need of needs) {
+    if (!repository) {
+      problems.add(`commit ${need.commit} (${need.owner}) can't be read: the project isn't in a git repository.`);
+      continue;
+    }
     if (!present.has(need.commit))
       present.set(need.commit, await repository.resolveCommit(need.commit) !== undefined);
     if (!present.get(need.commit)) {
-      problems.add(`error: commit ${need.commit} (${need.owner}) is not in this repository.
+      problems.add(`commit ${need.commit} (${need.owner}) is not in this repository.
 Fetch it, or check that it has been pushed.`);
     } else if (need.kind === "file" && await repository.readFile(need.commit, need.file) === undefined) {
-      problems.add(`error: ${need.file} is not in commit ${need.commit} (${need.owner}).`);
+      problems.add(`${need.file} is not in commit ${need.commit} (${need.owner}).`);
     }
   }
   if (problems.size > 0)
-    throw new MissingCommitsError([...problems].join(`
-`));
+    throw new ConfigError(...problems);
+  return repository;
 }
-async function assembleBuildContext(parameters, repository, dir) {
-  const { dockerfile, git } = renderPrerun(parameters);
-  await remove(dir);
-  await makeDir(dir);
-  await Bun.write(join(dir, "Dockerfile"), dockerfile);
-  for (const role of Object.keys(PARAMETER_DIRS)) {
-    const { dir: source, exclude = [] } = parameters[role];
-    const target = join(dir, PARAMETER_DIRS[role]);
-    await copy(source, target);
-    for (const path2 of exclude)
-      await remove(join(target, path2));
-  }
-  const written = new Set;
-  for (const need of git) {
-    if (written.has(need.path))
-      continue;
-    written.add(need.path);
+async function writeGitNeeds(repository, needs, contextDir) {
+  for (const need of needs) {
     if (!repository)
-      throw new Error(`${need.owner} reads commit ${need.commit}, but there is no repository to read it from`);
-    const dest = join(dir, need.path);
-    await makeDir(dirname(dest));
+      throw new Error(`${need.owner} reads commit ${need.commit}, but there is no repository to read it from.`);
+    const dest = `${contextDir}/${need.path}`;
     if (need.kind === "bundle") {
-      const full = await repository.resolveCommit(need.commit);
-      if (!full)
-        throw new Error(`commit ${need.commit} is not in the repository`);
-      await repository.bundle(full, dest);
+      await repository.bundle(await repository.resolveCommit(need.commit), dest);
     } else {
-      const contents = await repository.readFile(need.commit, need.file);
-      if (contents === undefined)
-        throw new Error(`${need.file} is not in commit ${need.commit}`);
-      await Bun.write(dest, contents);
+      await Bun.write(dest, await repository.readFile(need.commit, need.file));
     }
   }
 }
-async function prerunStatuses(docker2, repository, permutations) {
-  const unreachable = await docker2.unreachable();
-  if (unreachable !== undefined)
-    return { unreachable };
-  const statuses = new Map;
-  for (const { hash } of permutations) {
-    if (statuses.has(hash))
-      continue;
-    statuses.set(hash, await docker2.imageExists(prerunImageRef(repository, hash)) ? "exists" : "missing");
-  }
-  return { statuses };
-}
-var showPrerunStatus = (status) => status === "exists" ? " (exists, reused)" : status === "missing" ? " (will build)" : "";
-var unreachableNote = (reason) => `Docker can't be reached (${reason}), so whether each prerun image exists is unknown.`;
 
-// src/images/repository.ts
-async function git(cwd, args) {
-  const child = Bun.spawn(["git", ...args], { cwd, stdio: ["ignore", "pipe", "pipe"] });
-  const [stdout, stderr] = await Promise.all([
-    new Response(child.stdout).arrayBuffer(),
-    new Response(child.stderr).text(),
-    child.exited
-  ]);
-  return { exitCode: child.exitCode ?? 1, stdout: Buffer.from(stdout), stderr };
+// src/api/checkoutCommit.ts
+var CHECKOUT_COMMIT = Symbol.for("thunderjar.checkoutCommit");
+
+// src/execution/prerunDockerfile.ts
+var PARAMETER_DIRS = {
+  baseImage: "parameters/baseImage",
+  codeState: "parameters/codeState",
+  promptSet: "parameters/promptSet",
+  harness: "parameters/harness"
+};
+var BUNDLE_PATH = "code.bundle";
+var ROLE_NAMES = {
+  baseImage: "base image",
+  codeState: "code state",
+  promptSet: "prompt set",
+  harness: "harness",
+  initialPrompt: "initial prompt"
+};
+var ownerOf = (role, file) => {
+  const segments = file.split("/");
+  const name = role === "initialPrompt" ? segments.at(-1).replace(/\.ts$/, "") : segments.at(-2);
+  return `${ROLE_NAMES[role]} ${JSON.stringify(name)}`;
+};
+var COMMIT = /^[0-9a-f]{4,64}$/i;
+function checkCommitHash(method, commit) {
+  if (typeof commit !== "string" || !COMMIT.test(commit)) {
+    throw new Error(`${method} needs a commit hash, got ${JSON.stringify(commit)}.`);
+  }
 }
-async function gitOrThrow(cwd, args) {
-  const result = await git(cwd, args);
-  if (result.exitCode !== 0)
-    throw new Error(`git ${args.join(" ")} failed in ${cwd}:
-${result.stderr.trim()}`);
-  return result.stdout;
+function repositoryPath(path2) {
+  const segments = typeof path2 === "string" ? path2.split("/").filter((segment) => segment !== "" && segment !== ".") : [];
+  if (typeof path2 !== "string" || path2.startsWith("/") || segments.length === 0 || segments.includes("..")) {
+    throw new Error(`ctx.git.show needs a path inside the repository, got ${JSON.stringify(path2)}.`);
+  }
+  return segments.join("/");
 }
-async function findRepository(dir) {
-  const { exitCode, stdout, stderr } = await git(dir, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
-  if (exitCode !== 0 && /not a git repository/i.test(stderr))
-    return;
-  if (exitCode !== 0)
-    throw new Error(`error: git can't read the repository ${dir} is in:
-${stderr.trim()}`);
-  const objects = join(stdout.toString("utf8").trim(), "objects");
+function recordingGit(owner, needs) {
   return {
-    async resolveCommit(commit) {
-      const { exitCode: exitCode2, stdout: stdout2 } = await git(dir, ["rev-parse", "--verify", "--quiet", `${commit}^{commit}`]);
-      return exitCode2 === 0 ? stdout2.toString("utf8").trim() : undefined;
-    },
-    async readFile(commit, path2) {
-      const { exitCode: exitCode2, stdout: stdout2 } = await git(dir, ["show", `${commit}:${path2}`]);
-      return exitCode2 === 0 ? stdout2 : undefined;
-    },
-    async bundle(commit, dest) {
-      const scratch = await makeTempDir("thunderjar-bundle-");
-      try {
-        await gitOrThrow(scratch, ["init", "--quiet", "--bare"]);
-        await Bun.write(join(scratch, "objects", "info", "alternates"), `${objects}
-`);
-        await gitOrThrow(scratch, ["update-ref", "refs/heads/code-state", commit]);
-        await gitOrThrow(scratch, ["symbolic-ref", "HEAD", "refs/heads/code-state"]);
-        await gitOrThrow(scratch, ["bundle", "create", "--quiet", dest, "HEAD", "code-state"]);
-      } finally {
-        await remove(scratch);
-      }
+    show(commit, path2) {
+      checkCommitHash("ctx.git.show", commit);
+      const file = repositoryPath(path2);
+      const need = { kind: "file", owner, commit, file, path: `git/${commit}/${file}` };
+      needs.push(need);
+      return need.path;
     }
   };
 }
-
-// src/images/prerun-builds.ts
-var buildContextDir = (rootDir, permutationHash) => join(rootDir, "builds", prerunTag(permutationHash));
-async function preparePrerunBuilds(options) {
-  const { root, task, permutations, docker: docker2, repository, rootDir, purpose } = options;
-  const found = await prerunStatuses(docker2, repository, permutations);
-  if ("unreachable" in found) {
-    throw new Error(`error: Docker can't be reached (${found.unreachable}). ${purpose} needs Docker.`);
-  }
-  const parameters = new Map;
-  for (const permutation of permutations) {
-    if (found.statuses.get(permutation.hash) !== "missing")
-      continue;
-    parameters.set(permutation.hash, await loadPrerunParameters(root, task, permutation));
-  }
-  const gitNeeds = [...parameters.values()].flatMap((p) => renderPrerun(p).git);
-  let repo;
-  if (gitNeeds.length > 0) {
-    const projectDir = dirname(root);
-    repo = await findRepository(projectDir);
-    if (!repo) {
-      const [{ owner, commit }] = gitNeeds;
-      throw new Error(`error: ${projectDir} is not in a git repository, but ${owner} reads commit ${commit} from it.`);
+var checkoutLines = (commit) => [
+  `COPY ${BUNDLE_PATH} /tmp/code.bundle`,
+  [
+    "RUN git clone --quiet /tmp/code.bundle /workspace",
+    `git -C /workspace checkout --quiet --detach ${commit}`,
+    `git -C /workspace branch --quiet --delete --force ${BUNDLE_BRANCH}`,
+    "git -C /workspace remote remove origin",
+    'git -C /workspace config user.name "Thunderjar agent"',
+    "git -C /workspace config user.email agent@thunderjar.invalid",
+    "rm /tmp/code.bundle"
+  ].join(" \\\n  && ")
+].join(`
+`);
+function renderPrerun(parameters) {
+  const problems = [];
+  const git = [];
+  const gitOf = (role) => recordingGit(ownerOf(role, parameters[role].file), git);
+  let checkout;
+  const codeStateCtx = {
+    dir: PARAMETER_DIRS.codeState,
+    git: gitOf("codeState"),
+    [CHECKOUT_COMMIT]: (commit) => {
+      checkCommitHash("checkoutCommit", commit);
+      if (checkout !== undefined)
+        throw new Error(`checkoutCommit was already called, with ${checkout}: a code state checks out one commit.`);
+      checkout = commit;
     }
-    await checkCommits(gitNeeds, repo);
-  }
-  const missing = new Set(parameters.keys());
-  return {
-    missing,
-    async build(permutationHash) {
-      const declared = parameters.get(permutationHash);
-      if (!declared || !missing.has(permutationHash))
-        throw new Error(`prerun image ${permutationHash} isn't missing`);
-      const ref = prerunImageRef(repository, permutationHash);
-      const contextDir = buildContextDir(rootDir, permutationHash);
-      await assembleBuildContext(declared, repo, contextDir);
-      try {
-        await docker2.build(contextDir, ref);
-      } catch (error) {
-        if (!(error instanceof DockerBuildError))
-          throw error;
-        throw new Error(`error: building ${ref} failed (docker build exited ${error.exitCode}).
-Its build context is kept in ${contextDir}`);
-      }
-      missing.delete(permutationHash);
+  };
+  const fragment = (role, ctx) => {
+    const { file, declaration } = parameters[role];
+    const problem = (message) => problems.push({ file, field: "applyParameter", message });
+    const applyParameter = declaration.applyParameter;
+    if (!applyParameter) {
+      if (role !== "baseImage")
+        return "";
+      problem("is missing. A base image's fragment provides the FROM.");
+      return;
+    }
+    let result;
+    try {
+      result = applyParameter(declaration.config, ctx);
+    } catch (error) {
+      problem(`threw: ${error instanceof Error ? error.message : String(error)}`);
+      return;
+    }
+    if (typeof result !== "string") {
+      problem(`must return a Dockerfile fragment, a string, got ${typeof result}.`);
+      return;
+    }
+    if (role === "baseImage" && !/^FROM\s/i.test(result.trim())) {
+      problem(`must return a fragment that starts with FROM, got ${JSON.stringify(result.trim().split(`
+`)[0])}.`);
+      return;
     }
+    return result.trim();
   };
+  const baseImage = fragment("baseImage", { dir: PARAMETER_DIRS.baseImage, git: gitOf("baseImage") });
+  const codeState = fragment("codeState", codeStateCtx);
+  const steps = [
+    baseImage,
+    checkout === undefined ? "" : checkoutLines(checkout),
+    "WORKDIR /workspace",
+    codeState,
+    fragment("promptSet", { dir: PARAMETER_DIRS.promptSet, git: gitOf("promptSet") }),
+    fragment("harness", { dir: PARAMETER_DIRS.harness, git: gitOf("harness"), version: parameters.harness.version }),
+    fragment("initialPrompt", { git: gitOf("initialPrompt") })
+  ];
+  if (problems.length > 0)
+    throw problemsError(problems);
+  if (checkout !== undefined) {
+    git.unshift({ kind: "bundle", owner: ownerOf("codeState", parameters.codeState.file), commit: checkout, path: BUNDLE_PATH });
+  }
+  return { dockerfile: `${steps.filter((step) => step !== "").join(`
+`)}
+`, git };
 }
-
-// src/matrix/resolve.ts
-async function resolveTestCase(root, testCase) {
-  const parameters = join(root, "test-case-parameters");
-  const hashParameter = {
-    baseImage: (n) => hashBaseImage(join(parameters, "baseImages", n)),
-    codeState: (n) => hashCodeState(join(parameters, "codeStates", n)),
-    promptSet: (n) => hashPromptSet(join(parameters, "promptSets", n)),
-    harnessModel: (n) => {
-      const { family, version, model } = parseHarnessModelPair(n);
-      return hashHarnessModelPair(join(parameters, "harnessModels", family), version, model);
-    },
-    initialPrompt: (n) => hashInitialPrompt(join(parameters, "tasks", testCase.task, "initial-prompts", `${n}.ts`))
+async function loadPrerunParameters(root, task, permutation) {
+  const problems = [];
+  const load = async (file, declareFn) => ({
+    file,
+    declaration: await loadDeclaration(root, file, declareFn, problems)
+  });
+  const { harness, version } = parsePair(permutation.harnessModel);
+  const harnessDir = `${PARAMETERS}/harnessModels/${harness}`;
+  const [baseImage, codeState, promptSet, harnessDeclaration, versions, initialPrompt] = await Promise.all([
+    load(`${PARAMETERS}/baseImages/${permutation.baseImage}/index.ts`, "declareBaseImage"),
+    load(`${PARAMETERS}/codeStates/${permutation.codeState}/index.ts`, "declareCodeState"),
+    load(`${PARAMETERS}/promptSets/${permutation.promptSet}/index.ts`, "declarePromptSet"),
+    load(`${harnessDir}/index.ts`, "declareHarness"),
+    load(`${harnessDir}/versions.ts`, "declareHarnessVersions"),
+    load(`${PARAMETERS}/tasks/${task}/initial-prompts/${permutation.initialPrompt}.ts`, "declareInitialPrompt")
+  ]);
+  if (problems.length > 0)
+    throw problemsError(problems);
+  return {
+    baseImage,
+    codeState,
+    promptSet,
+    harness: { ...harnessDeclaration, version: versions.declaration[version].version },
+    initialPrompt
   };
-  const hashes = {};
-  for (const axis of AXES) {
-    hashes[axis] = new Map;
-    for (const n of testCase[axis])
-      hashes[axis].set(n, await hashParameter[axis](n));
-  }
-  const permutations = expandPermutations(testCase).map((permutation) => ({
-    ...permutation,
-    hash: hashPermutation({
-      baseImage: hashes.baseImage.get(permutation.baseImage),
-      codeState: hashes.codeState.get(permutation.codeState),
-      promptSet: hashes.promptSet.get(permutation.promptSet),
-      harnessModel: hashes.harnessModel.get(permutation.harnessModel),
-      initialPrompt: hashes.initialPrompt.get(permutation.initialPrompt)
-    })
-  }));
-  return { hashes, permutations };
 }
 
-// src/platform/signals.ts
-var COMMON = {
-  SIGHUP: 1,
-  SIGINT: 2,
-  SIGQUIT: 3,
-  SIGILL: 4,
-  SIGTRAP: 5,
-  SIGABRT: 6,
-  SIGIOT: 6,
-  SIGFPE: 8,
-  SIGKILL: 9,
-  SIGSEGV: 11,
-  SIGPIPE: 13,
-  SIGALRM: 14,
-  SIGTERM: 15,
-  SIGXCPU: 24,
-  SIGXFSZ: 25,
-  SIGVTALRM: 26,
-  SIGPROF: 27,
-  SIGWINCH: 28
-};
-var LINUX = {
-  SIGBUS: 7,
-  SIGUSR1: 10,
-  SIGUSR2: 12,
-  SIGSTKFLT: 16,
-  SIGCHLD: 17,
-  SIGCONT: 18,
-  SIGSTOP: 19,
-  SIGTSTP: 20,
-  SIGTTIN: 21,
-  SIGTTOU: 22,
-  SIGURG: 23,
-  SIGIO: 29,
-  SIGPOLL: 29,
-  SIGPWR: 30,
-  SIGSYS: 31
-};
-var BSD = {
-  SIGEMT: 7,
-  SIGBUS: 10,
-  SIGSYS: 12,
-  SIGURG: 16,
-  SIGSTOP: 17,
-  SIGTSTP: 18,
-  SIGCONT: 19,
-  SIGCHLD: 20,
-  SIGTTIN: 21,
-  SIGTTOU: 22,
-  SIGIO: 23,
-  SIGINFO: 29,
-  SIGUSR1: 30,
-  SIGUSR2: 31
-};
-var SIGNALS = { ...COMMON, ...process.platform === "linux" ? LINUX : BSD };
-function signalNumber(signal) {
-  if (typeof signal === "number")
-    return signal;
-  const number = SIGNALS[signal];
-  if (number === undefined)
-    throw new Error(`unknown signal: ${signal}`);
-  return number;
+// src/execution/prerunBuilds.ts
+var parameterFolders = (permutation) => ({
+  baseImage: `${PARAMETERS}/baseImages/${permutation.baseImage}`,
+  codeState: `${PARAMETERS}/codeStates/${permutation.codeState}`,
+  promptSet: `${PARAMETERS}/promptSets/${permutation.promptSet}`,
+  harness: `${PARAMETERS}/harnessModels/${parsePair(permutation.harnessModel).harness}`
+});
+async function temporaryFolder() {
+  const dir = `${Bun.env.TMPDIR || "/tmp"}/thunderjar-build-${crypto.randomUUID()}`;
+  await $3`mkdir -p ${dir}`.quiet();
+  return dir;
 }
-
-// src/running/runner.ts
-var defaultRootDir = () => join(tmpdir(), "thunderjar");
-var exitCodeOf = (proc) => proc.exitCode ?? 128 + signalNumber(proc.signalCode);
-var shellQuote = (text) => `'${text.replaceAll("'", `'\\''`)}'`;
-var containerWrapper = (command, timeoutSeconds) => [
-  "mkdir -p /thunderjar",
-  "start=$(date +%s%3N)",
-  `timeout -k 5 ${timeoutSeconds} sh -c ${shellQuote(command)} >&2`,
-  "code=$?",
-  "end=$(date +%s%3N)",
-  `echo "{\\"startedAt\\":$start,\\"finishedAt\\":$end,\\"exitCode\\":$code}" > /thunderjar/run.json`,
-  "cat /thunderjar/run.json"
-].join(`
-`);
-function createDockerRunner(docker2, repository) {
-  return {
-    async runContainer(run) {
-      const prerun = imageRef(repository, run.prerunTag);
-      const name = `thunderjar-${run.postrunTag}-${crypto.randomUUID().slice(0, 8)}`;
-      try {
-        const { exitCode, stdout } = await docker2.run(prerun, name, containerWrapper(run.command, run.timeoutSeconds));
-        const runJson = stdout.trim().split(`
-`).at(-1) ?? "";
-        if (exitCode !== 0 || !runJson.startsWith("{")) {
-          throw new Error(`error: running a container from ${prerun} failed (docker run exited ${exitCode}).`);
-        }
-        await docker2.commit(name, imageRef(repository, run.postrunTag), prerun);
-        return JSON.parse(runJson);
-      } finally {
-        await docker2.removeContainer(name).catch(() => {});
-      }
+async function copyParameters(root, permutation, contextDir) {
+  const folders = parameterFolders(permutation);
+  for (const role of Object.keys(PARAMETER_DIRS)) {
+    const dest = `${contextDir}/${PARAMETER_DIRS[role]}`;
+    await $3`mkdir -p ${dest}`.quiet();
+    await $3`cp -RL ${root}/${folders[role]}/. ${dest}`.quiet();
+  }
+}
+async function buildPrerunImages(root, task, permutations, imagePrefix, hooks = {}) {
+  const unique = [...new Map(permutations.map((permutation) => [permutation.hash, permutation])).values()];
+  const existing = await imagesIn(prerunRepository(imagePrefix));
+  const images = unique.map((permutation) => ({ permutation, image: prerunImage(permutation.hash, imagePrefix) }));
+  const missing = images.filter(({ image }) => !existing.has(image));
+  const builds = await Promise.all(missing.map(async ({ permutation, image }) => ({
+    permutation,
+    image,
+    ...renderPrerun(await loadPrerunParameters(root, task, permutation))
+  })));
+  const repository = await checkGitNeeds(root, builds.flatMap(({ git }) => git));
+  for (const { permutation, image, dockerfile, git } of builds) {
+    hooks.onBuilding?.(image);
+    const contextDir = await temporaryFolder();
+    try {
+      await copyParameters(root, permutation, contextDir);
+      await writeGitNeeds(repository, git, contextDir);
+      await Bun.write(`${contextDir}/Dockerfile`, dockerfile);
+      await buildImage(contextDir, image);
+    } finally {
+      await $3`rm -rf ${contextDir}`.quiet();
     }
+    hooks.onBuilt?.(image);
+  }
+  return {
+    built: builds.map(({ image }) => image),
+    present: images.filter(({ image }) => existing.has(image)).map(({ image }) => image)
   };
 }
-async function exec(command, cwd) {
-  const child = Bun.spawn(["sh", "-c", command], { cwd, stdio: ["ignore", "pipe", "pipe"] });
-  const [stdout, stderr] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
-  return { stdout, stderr, exitCode: exitCodeOf(child) };
-}
-function createDockerMeasurementOpener(docker2, repository) {
-  return {
-    async openMeasurementContext(postrunTag2) {
-      const scratch = await makeTempDir("thunderjar-measure-");
-      const workdir = join(scratch, "workspace");
-      const name = `thunderjar-measure-${crypto.randomUUID().slice(0, 8)}`;
-      try {
-        await makeDir(workdir);
-        await docker2.create(imageRef(repository, postrunTag2), name);
-        await docker2.copyFrom(name, "/workspace/.", workdir);
-        const resultPath = join(scratch, "result.json");
-        await docker2.copyFrom(name, "/thunderjar/result.json", resultPath).catch(() => {});
-        const harnessResult = await exists(resultPath) ? await Bun.file(resultPath).text() : "";
-        return scratchContext(workdir, harnessResult, scratch);
-      } catch (error) {
-        await remove(scratch);
+
+// src/cli/configErrors.ts
+function reportingConfigErrors(action) {
+  return async (...args) => {
+    try {
+      await action(...args);
+    } catch (error) {
+      if (!(error instanceof ConfigError))
         throw error;
-      } finally {
-        await docker2.removeContainer(name).catch(() => {});
-      }
+      for (const problem of error.problems)
+        console.error(`Error: ${problem}`);
+      process.exitCode = 1;
     }
   };
 }
-function scratchContext(workdir, harnessResult, scratch) {
-  return {
-    workdir,
-    harnessResult,
-    exec: (command) => exec(command, workdir),
-    readFile: (path2) => Bun.file(resolve(workdir, path2)).text(),
-    async writeFile(path2, contents) {
-      await Bun.write(resolve(workdir, path2), contents);
-    },
-    glob: async (pattern) => (await Array.fromAsync(new Bun.Glob(pattern).scan({ cwd: workdir, dot: true }))).toSorted(),
-    close: () => remove(scratch)
-  };
-}
 
-// src/cli/commands/format.ts
-var count = (n, noun) => `${n} ${noun}${n === 1 ? "" : "s"}`;
-var showValue = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? `{${Object.entries(value).map(([key, v]) => `${key}: ${showValue(v)}`).join(", ")}}` : JSON.stringify(value) ?? String(value);
-var showOutcome = (outcome) => outcome.outcome === "measured" ? showValue(outcome.data) : outcome.outcome === "skipped" ? "skipped" : `erroredWhileMeasuring: ${outcome.error.message}`;
-var seconds = (ms) => `${(ms / 1000).toFixed(2)}s`;
-var duration = ({ startedAt, finishedAt }) => seconds(finishedAt - startedAt);
-var minute = (iso) => iso.slice(0, 16).replace("T", " ");
-
-// src/cli/commands/options.ts
-function valueOption(flags, description) {
-  return new Option(flags, description).argParser((value, previous) => {
-    if (previous !== undefined)
-      throw new InvalidArgumentError("It may only be given once.");
-    if (value.startsWith("-"))
-      throw new InvalidArgumentError("It needs a value, not another flag.");
-    return value;
+// src/cli/imagePrefix.ts
+function imagePrefixOption() {
+  return new Option("--image-prefix <name>", "start every image name with <name>, e.g. <name>-prerun:<hash>, instead of thunderjar").default(DEFAULT_IMAGE_PREFIX).argParser((prefix) => {
+    const problem = imagePrefixProblem(prefix);
+    if (problem)
+      throw new InvalidArgumentError(`It ${problem}`);
+    return prefix;
   });
 }
-var imagePrefixOption = (description) => valueOption("--image-prefix <name>", description);
-var dataDirOption = () => valueOption("--data-dir <dir>", "keep the run data store in this folder, in place of .thunderjar/.data/");
 
 // src/cli/commands/build/build.ts
-async function build(name, options = {}) {
-  const {
-    cwd = process.cwd(),
-    log = (text) => console.log(text),
-    docker: docker2 = dockerCli(),
-    dryRun = false,
-    repository = LOCAL_REPOSITORY,
-    rootDir = defaultRootDir(),
-    now = Date.now
-  } = options;
-  const root = findThunderjarRoot(cwd);
+async function dryRun(cwd, name, imagePrefix) {
+  const root = await findThunderjarRoot(cwd);
   const testCase = await loadTestCase(root, name);
-  const { permutations } = await resolveTestCase(root, testCase);
-  const rows = permutationRows(permutations);
-  const numberWidth = Math.max(2, String(permutations.length).length);
-  const pad = " ".repeat(numberWidth + 2);
-  if (dryRun) {
-    log(`Dockerfiles for ${name} (${count(permutations.length, "permutation")}). Nothing is built.`);
-    for (const [n, permutation] of permutations.entries()) {
-      const { dockerfile } = renderPrerun(await loadPrerunParameters(root, testCase.task, permutation));
-      log("");
-      log(`${String(n + 1).padStart(numberWidth)}  ${rows[n]}`);
-      log(`${pad}${prerunImageRef(repository, permutation.hash)}`);
-      log("");
-      log(dockerfile.trimEnd().replace(/^(?=.)/gm, pad));
-    }
-    return;
-  }
-  const builds = await preparePrerunBuilds({
-    root,
-    task: testCase.task,
-    permutations,
-    docker: docker2,
-    repository,
-    rootDir,
-    purpose: "Building prerun images"
-  });
-  const toBuild = builds.missing.size;
-  if (toBuild > 0) {
-    log(`Building ${count(toBuild, "prerun image")} for ${name} (${count(permutations.length, "permutation")})`);
-    log(`Build contexts in ${join(rootDir, "builds")}`);
-  } else {
-    log(`Every prerun image for ${name} exists (${count(permutations.length, "permutation")})`);
-  }
-  for (const [n, permutation] of permutations.entries()) {
-    const ref = prerunImageRef(repository, permutation.hash);
-    log("");
-    log(`${String(n + 1).padStart(numberWidth)}  ${rows[n]}`);
-    if (!builds.missing.has(permutation.hash)) {
-      log(`${pad}${ref}  reused`);
-      continue;
+  const permutations = await hashPermutations(root, testCase);
+  const unique = [...new Map(permutations.map((permutation) => [permutation.hash, permutation])).values()];
+  const rendered = await Promise.all(unique.map(async (permutation) => ({
+    image: prerunImage(permutation.hash, imagePrefix),
+    ...renderPrerun(await loadPrerunParameters(root, testCase.task, permutation))
+  })));
+  await checkGitNeeds(root, rendered.flatMap(({ git }) => git));
+  return rendered.map(({ image, dockerfile }) => `# ${image}
+${dockerfile.trimEnd()}`).join(`
+
+`);
+}
+async function build(cwd, name, imagePrefix) {
+  const root = await findThunderjarRoot(cwd);
+  const testCase = await loadTestCase(root, name);
+  const permutations = await hashPermutations(root, testCase);
+  let building;
+  try {
+    const { built, present } = await buildPrerunImages(root, testCase.task, permutations, imagePrefix, {
+      onBuilding: (image) => {
+        building = image;
+        process.stdout.write(`Building ${image} ... `);
+      },
+      onBuilt: () => {
+        building = undefined;
+        console.log("done");
+      }
+    });
+    console.log(`${built.length} built, ${present.length} already present`);
+  } catch (error) {
+    if (error instanceof DockerUnavailableError) {
+      console.error(`Error: Docker can't be reached, so no image can be built: ${error.message}`);
+    } else if (error instanceof DockerBuildError) {
+      console.log("failed");
+      console.error(`Error: Building ${building} failed: ${error.message}`);
+    } else {
+      throw error;
     }
-    const started = now();
-    await builds.build(permutation.hash);
-    log(`${pad}${ref}  built (${seconds(now() - started)})`);
+    process.exitCode = 1;
   }
-  log("");
-  log(`${count(permutations.length, "prerun image")}: ${toBuild} built, ${permutations.length - toBuild} reused`);
 }
 function createBuildCommand() {
-  return new Command("build").description("Build a test case's prerun images.").argument("<test case>", "the test case whose prerun images to build").option("--dry-run", "print each permutation's Dockerfile instead of building").addOption(imagePrefixOption("the image repository prerun images are tagged in")).action(async (name, options) => {
-    await build(name, { dryRun: options.dryRun ?? false, repository: options.imagePrefix });
-  });
+  return new Command("build").description("Build the prerun Docker image of each permutation of a test case, unless it already exists. Permutations with the same hash share one image.").argument("<test case>", `the name of a test case, declared in ${FOLDER}/test-cases/<test case>.ts`).option("--dry-run", "print each prerun image's name and Dockerfile, without building anything").addOption(imagePrefixOption()).action(reportingConfigErrors(async (name, options) => {
+    if (options.dryRun)
+      console.log(await dryRun(process.cwd(), name, options.imagePrefix));
+    else
+      await build(process.cwd(), name, options.imagePrefix);
+  }));
+}
+
+// src/store/runDataStore.ts
+var {$: $4, Glob: Glob3 } = globalThis.Bun;
+var executionFolder = (dataDir, executionId) => `${dataDir}/runs/${executionId}`;
+async function writeJson(path2, value) {
+  const temporary = `${path2}.${crypto.randomUUID()}.tmp`;
+  await Bun.write(temporary, `${JSON.stringify(value, null, 2)}
+`);
+  await $4`mv ${temporary} ${path2}`.quiet();
 }
 
-// src/store/run-data-store.ts
-var runDataStorePath = (cwd, dataDir) => join(dataDir === undefined ? join(findThunderjarRoot(cwd), ".data") : resolve(cwd, dataDir), "runs.json");
-function summarizeExecutions(records) {
-  const byId = new Map;
-  for (const { executionId, testCase, ranAt } of records) {
-    const summary = byId.get(executionId);
-    if (!summary)
-      byId.set(executionId, { executionId, testCase, ranAt, containerRuns: 1 });
-    else {
-      summary.containerRuns++;
-      if (ranAt < summary.ranAt)
-        summary.ranAt = ranAt;
-    }
-  }
-  const newestFirst = (a, b) => a < b ? 1 : a > b ? -1 : 0;
-  return [...byId.values()].toSorted((a, b) => newestFirst(a.ranAt, b.ranAt) || newestFirst(a.executionId, b.executionId));
-}
-function inExecutionOrder(records) {
-  const place = matrixPlaces(records);
-  return records.toSorted((a, b) => place.get(a.permutationHash) - place.get(b.permutationHash) || a.iteration - b.iteration);
-}
-function matrixPlaces(records) {
-  const place = new Map;
-  for (const { permutationHash } of records)
-    if (!place.has(permutationHash))
-      place.set(permutationHash, place.size);
-  return place;
-}
-function jsonFileStore(path2) {
-  const read = async () => {
-    let text;
+class RunDataStoreError extends Error {
+  path;
+  constructor(path2, message) {
+    super(message);
+    this.path = path2;
+  }
+}
+async function readJsonFiles(dir, pattern) {
+  const isDirectory2 = await Bun.file(dir).stat().then((stat) => stat.isDirectory()).catch(() => false);
+  if (!isDirectory2)
+    return [];
+  const files = await Array.fromAsync(new Glob3(pattern).scan({ cwd: dir }));
+  return Promise.all(files.map(async (file) => {
+    const path2 = `${dir}/${file}`;
     try {
-      text = await Bun.file(path2).text();
+      return await Bun.file(path2).json();
     } catch (error) {
-      if (error.code === "ENOENT")
-        return { containerRuns: [] };
-      throw error;
+      throw new RunDataStoreError(path2, error instanceof Error ? error.message : String(error));
     }
-    return JSON.parse(text);
-  };
-  const write = async (data) => {
-    await makeDir(dirname(path2));
-    const temp = `${path2}.${crypto.randomUUID()}.tmp`;
-    await Bun.write(temp, `${JSON.stringify(data, null, 2)}
-`);
-    await move(temp, path2);
-  };
+  }));
+}
+function fileStore(dataDir) {
   return {
-    async recordContainerRun(record) {
-      const data = await read();
-      data.containerRuns.push(record);
-      await write(data);
-    },
-    async recordMeasures(postrunImage, measures) {
-      const data = await read();
-      const record = data.containerRuns.find((r) => r.postrunImage === postrunImage);
-      if (!record)
-        throw new Error(`no container run recorded for ${postrunImage}`);
-      record.result = { ...record.result, ...measures };
-      await write(data);
-    },
-    async listExecutions(testCase) {
-      const { containerRuns } = await read();
-      return summarizeExecutions(testCase === undefined ? containerRuns : containerRuns.filter((r) => r.testCase === testCase));
+    async recordExecution(record) {
+      await writeJson(`${executionFolder(dataDir, record.executionId)}/execution.json`, record);
     },
-    async getExecution(executionId) {
-      const { containerRuns } = await read();
-      return inExecutionOrder(containerRuns.filter((r) => r.executionId === executionId));
-    },
-    async getContainerRun(postrunImage) {
-      const { containerRuns } = await read();
-      return containerRuns.find((r) => r.postrunImage === postrunImage);
+    async recordContainerRun(record) {
+      const dir = `${executionFolder(dataDir, record.executionId)}/container-runs`;
+      await writeJson(`${dir}/${record.permutation}-${record.iteration}.json`, record);
     },
-    async recordAggregationResult(result) {
-      const data = await read();
-      const results = data.aggregationResults ??= [];
-      const same = results.findIndex((r) => r.executionId === result.executionId && r.permutationHash === result.permutationHash);
-      if (same === -1)
-        results.push(result);
-      else
-        results[same] = result;
-      await write(data);
+    async listExecutions() {
+      const records = await readJsonFiles(`${dataDir}/runs`, "*/execution.json");
+      return records.toSorted((a, b) => a.executionId < b.executionId ? 1 : a.executionId > b.executionId ? -1 : 0);
     },
-    async getAggregationResults(executionId) {
-      const { containerRuns, aggregationResults = [] } = await read();
-      const place = matrixPlaces(containerRuns.filter((r) => r.executionId === executionId));
-      const placeOf = ({ permutationHash }) => place.get(permutationHash) ?? place.size;
-      return aggregationResults.filter((r) => r.executionId === executionId).toSorted((a, b) => placeOf(a) - placeOf(b));
+    async containerRunsOf(executionId) {
+      const records = await readJsonFiles(`${executionFolder(dataDir, executionId)}/container-runs`, "*.json");
+      return records.toSorted((a, b) => a.permutation - b.permutation || a.iteration - b.iteration);
     }
   };
 }
 
-// src/cli/commands/executions/executions.ts
-async function executions(testCase, { cwd = process.cwd(), dataDir } = {}) {
-  const store = jsonFileStore(runDataStorePath(cwd, dataDir));
-  const listed = await store.listExecutions(testCase);
-  if (listed.length === 0) {
-    return testCase === undefined ? "No executions recorded." : `No executions recorded for ${testCase}.`;
+// src/cli/dataDir.ts
+function dataDirOption() {
+  return new Option("--data-dir <dir>", `the folder holding the run data store, instead of ${FOLDER}/.data/`);
+}
+function resolvePath(cwd, path2) {
+  const segments = [];
+  for (const segment of (path2.startsWith("/") ? path2 : `${cwd}/${path2}`).split("/")) {
+    if (segment === "" || segment === ".")
+      continue;
+    if (segment === "..")
+      segments.pop();
+    else
+      segments.push(segment);
   }
-  const width = Math.max(...listed.map((e) => e.testCase.length));
-  return listed.map((e) => `${e.executionId}  ${e.testCase.padEnd(width)}  ${minute(e.ranAt)}`).join(`
-`);
+  return `/${segments.join("/")}`;
 }
-function createExecutionsCommand() {
-  return new Command("executions").description("List recorded executions.").argument("[test case]", "list only this test case's executions").addOption(dataDirOption()).action(async (testCase, options) => {
-    console.log(await executions(testCase, { dataDir: options.dataDir }));
-  });
+var dataDirOf = (cwd, root, dataDir) => dataDir === undefined ? `${root}/.data` : resolvePath(cwd, dataDir);
+function displayPath(cwd, path2) {
+  const base = resolvePath(cwd, ".");
+  return path2.startsWith(`${base}/`) ? path2.slice(base.length + 1) : path2;
 }
 
-// src/cli/commands/generate/parameter-names.ts
-async function listDirNames(dir) {
-  try {
-    return listEntries(dir).filter((entry) => entry.isDirectory).map((entry) => entry.path).sort();
-  } catch {
-    return [];
-  }
+// src/cli/format.ts
+function agentEnd(execution, harnessResult) {
+  if (execution.timedOut)
+    return `timed out after ${execution.timeoutSeconds}s`;
+  const ended = execution.exitCode === 0 ? "done" : `exited ${execution.exitCode}`;
+  return harnessResult === null ? `${ended}, no result file` : ended;
+}
+var endedCleanly = (execution, harnessResult) => !execution.timedOut && execution.exitCode === 0 && harnessResult !== null;
+var thousands = (n) => Math.round(n).toLocaleString("en-US");
+var tokensOf = ({ inputTokens, outputTokens, cacheCreationTokens, cacheReadTokens }) => inputTokens + outputTokens + cacheCreationTokens + cacheReadTokens;
+var totalTokens = (costs) => costs?.outcome === "collected" ? costs.models.reduce((sum, model) => sum + tokensOf(model), 0) : undefined;
+function knownCost(costs) {
+  if (costs?.outcome !== "collected" || costs.models.length === 0)
+    return;
+  if (costs.models.some(({ costUsd, costBasis }) => costUsd === undefined || costBasis === "unknown"))
+    return;
+  return costs.models.reduce((sum, { costUsd }) => sum + costUsd, 0);
 }
-async function listFileStems(dir) {
+var dollars = (usd) => usd > 0 && usd < 0.0005 ? "<$0.001" : `$${usd.toFixed(3)}`;
+var plural = (n, noun) => `${n} ${noun}${n === 1 ? "" : "s"}`;
+var minute = (iso) => new Date(iso).toISOString().slice(0, 16).replace("T", " ");
+
+// src/cli/commands/executions/executions.ts
+function renderExecutions(executions) {
+  const testCaseWidth = Math.max(...executions.map(({ testCase }) => testCase.length));
+  const matrices = executions.map(({ matrix }) => `${plural(matrix.permutations, "permutation")} \xD7 ${plural(matrix.iterations, "iteration")}`);
+  const width = Math.max(...matrices.map((matrix) => matrix.length));
+  return executions.map((execution, i) => `${execution.executionId}  ${execution.testCase.padEnd(testCaseWidth)}  ${minute(execution.startedAt)}  ${matrices[i].padEnd(width)}  ${execution.status}`).join(`
+`);
+}
+async function executions(cwd, testCase, dataDir) {
+  const store = dataDir === undefined ? dataDirOf(cwd, await findThunderjarRoot(cwd)) : resolvePath(cwd, dataDir);
+  let listed;
   try {
-    return listEntries(dir).filter((entry) => !entry.isDirectory && entry.path.endsWith(".ts")).map((entry) => entry.path.slice(0, -".ts".length)).sort();
-  } catch {
-    return [];
+    listed = await fileStore(store).listExecutions();
+  } catch (error) {
+    if (!(error instanceof RunDataStoreError))
+      throw error;
+    console.error(`Error: Can't read ${displayPath(cwd, error.path)}: ${error.message}`);
+    process.exitCode = 1;
+    return;
+  }
+  if (testCase !== undefined)
+    listed = listed.filter((execution) => execution.testCase === testCase);
+  if (listed.length === 0) {
+    console.log(testCase === undefined ? "No executions recorded." : `No executions of ${testCase} recorded.`);
+  } else {
+    console.log(renderExecutions(listed));
   }
 }
-async function loadFamilyNames(root, family, problems) {
-  const familyDir = `test-case-parameters/harnessModels/${family}`;
-  const models = await loadDeclaration(root, `${familyDir}/models.ts`, "declareHarnessModels", problems);
-  const versions = await loadDeclaration(root, `${familyDir}/versions.ts`, "declareHarnessVersions", problems);
-  return {
-    models: Object.keys(models ?? {}).sort(),
-    versions: Object.keys(versions ?? {}).sort()
-  };
+function createExecutionsCommand() {
+  return new Command("executions").description("List past executions from the run data store, newest first: each one's ID, its test case, when it started (in UTC), its permutations and iterations, and whether it's running, complete or failed.").argument("[test case]", `list only the executions of this test case, declared in ${FOLDER}/test-cases/<test case>.ts`).addOption(dataDirOption()).action(reportingConfigErrors(async (testCase, options) => {
+    await executions(process.cwd(), testCase, options.dataDir);
+  }));
+}
+
+// src/cli/commands/generate/parameterNames.ts
+var GENERATED_PATH = "_generated/parameterNames.d.ts";
+async function keysOfMap(root, file, declareFn, problems) {
+  if (!await existsIn(root, file))
+    return [];
+  return Object.keys(await loadDeclaration(root, file, declareFn, problems) ?? {}).toSorted();
 }
 async function collectParameterNames(root) {
-  const parameters = join(root, "test-case-parameters");
-  const [baseImages, codeStates, promptSets, taskNames, familyNames] = await Promise.all([
-    listDirNames(join(parameters, "baseImages")),
-    listDirNames(join(parameters, "codeStates")),
-    listDirNames(join(parameters, "promptSets")),
-    listDirNames(join(parameters, "tasks")),
-    listDirNames(join(parameters, "harnessModels"))
-  ]);
   const tasks = {};
-  for (const task of taskNames) {
-    tasks[task] = await listFileStems(join(parameters, "tasks", task, "initial-prompts"));
+  for (const task of await foldersIn(root, `${PARAMETERS}/tasks`)) {
+    tasks[task] = await tsFilesIn(root, `${PARAMETERS}/tasks/${task}/initial-prompts`);
   }
-  const harnessFamilies = {};
   const problems = [];
-  for (const family of familyNames) {
-    harnessFamilies[family] = await loadFamilyNames(root, family, problems);
+  const harnesses = {};
+  for (const harness of await foldersIn(root, `${PARAMETERS}/harnessModels`)) {
+    const dir = `${PARAMETERS}/harnessModels/${harness}`;
+    harnesses[harness] = {
+      versions: await keysOfMap(root, `${dir}/versions.ts`, "declareHarnessVersions", problems),
+      models: await keysOfMap(root, `${dir}/models.ts`, "declareHarnessModels", problems)
+    };
   }
   if (problems.length > 0)
-    throw new InvalidConfigError(problems);
-  return { baseImages, codeStates, promptSets, tasks, harnessFamilies };
+    throw problemsError(problems);
+  return {
+    baseImages: await foldersIn(root, `${PARAMETERS}/baseImages`),
+    codeStates: await foldersIn(root, `${PARAMETERS}/codeStates`),
+    promptSets: await foldersIn(root, `${PARAMETERS}/promptSets`),
+    tasks,
+    harnesses
+  };
 }
-function literalUnion(names) {
-  return names.length === 0 ? "never" : names.map((name) => JSON.stringify(name)).join(" | ");
+var union = (names) => names.length === 0 ? "never" : names.map((name) => JSON.stringify(name)).join(" | ");
+function harnessModelType(harnesses) {
+  const pairs = Object.entries(harnesses).filter(([, { versions, models }]) => versions.length > 0 && models.length > 0).map(([harness, { versions, models }]) => `\`${harness}@\${${union(versions)}}/\${${union(models)}}\``);
+  if (pairs.length <= 1)
+    return ` ${pairs[0] ?? "never"}`;
+  return pairs.map((pair) => `
+  | ${pair}`).join("");
+}
+function initialPromptType(tasks) {
+  const entries = Object.entries(tasks);
+  if (entries.length === 0)
+    return "{}";
+  return `{
+${entries.map(([task, prompts]) => `  ${JSON.stringify(task)}: ${union(prompts)};
+`).join("")}}`;
 }
 function renderParameterNames(names) {
-  const lines2 = [
-    "// _generated/parameter-names.d.ts \u2014 generated by `thunderjar generate`, not edited",
-    "",
-    `type BaseImageName = ${literalUnion(names.baseImages)};`,
-    `type CodeStateName = ${literalUnion(names.codeStates)};`,
-    `type PromptSetName = ${literalUnion(names.promptSets)};`,
-    `type TaskName = ${literalUnion(Object.keys(names.tasks))};`
-  ];
-  const tasks = Object.entries(names.tasks);
-  if (tasks.length === 0) {
-    lines2.push("type InitialPromptNames = Record<string, never>;");
-  } else {
-    lines2.push("type InitialPromptNames = {");
-    for (const [task, prompts] of tasks) {
-      lines2.push(`  ${JSON.stringify(task)}: ${literalUnion(prompts)};`);
-    }
-    lines2.push("};");
-  }
-  const pairs = Object.entries(names.harnessFamilies).filter(([, { versions, models }]) => versions.length > 0 && models.length > 0).map(([family, { versions, models }]) => "`" + family + "@${" + literalUnion(versions) + "}/${" + literalUnion(models) + "}`");
-  if (pairs.length === 0) {
-    lines2.push("type HarnessModelName = never;");
-  } else if (pairs.length === 1) {
-    lines2.push(`type HarnessModelName = ${pairs[0]};`);
-  } else {
-    lines2.push("type HarnessModelName =");
-    lines2.push(...pairs.map((pair) => `  | ${pair}`));
-    lines2[lines2.length - 1] += ";";
-  }
-  lines2.push("");
-  return lines2.join(`
-`);
+  return `// Generated by \`thunderjar generate\` from .thunderjar/${PARAMETERS}/. Don't edit it: run that again.
+
+type BaseImageName = ${union(names.baseImages)};
+type CodeStateName = ${union(names.codeStates)};
+type PromptSetName = ${union(names.promptSets)};
+type TaskName = ${union(Object.keys(names.tasks))};
+type InitialPromptNames = ${initialPromptType(names.tasks)};
+type HarnessModelName =${harnessModelType(names.harnesses)};
+
+interface ThunderjarParameterNames {
+  baseImage: BaseImageName;
+  codeState: CodeStateName;
+  promptSet: PromptSetName;
+  task: TaskName;
+  initialPrompt: InitialPromptNames;
+  harnessModel: HarnessModelName;
+}
+`;
 }
-async function writeGeneratedTypes(root) {
-  const names = await collectParameterNames(root);
-  const content = renderParameterNames(names);
-  const path2 = join(root, "_generated", "parameter-names.d.ts");
-  await Bun.write(path2, content);
-  return { path: path2, content };
+async function writeParameterNames(root) {
+  await Bun.write(`${root}/${GENERATED_PATH}`, renderParameterNames(await collectParameterNames(root)));
 }
 
 // src/cli/commands/generate/generate.ts
-async function generate(cwd = process.cwd()) {
-  const root = findThunderjarRoot(cwd);
-  const { path: path2 } = await writeGeneratedTypes(root);
-  return { path: path2 };
+function relativeTo(dir, path2) {
+  let up = "";
+  let base = dir.replace(/\/+$/, "");
+  while (!path2.startsWith(`${base}/`)) {
+    up += "../";
+    base = base.slice(0, base.lastIndexOf("/"));
+  }
+  return up + path2.slice(base.length + 1);
+}
+async function generate(cwd) {
+  const root = await findThunderjarRoot(cwd);
+  await writeParameterNames(root);
+  return `${root}/${GENERATED_PATH}`;
 }
 function createGenerateCommand() {
-  return new Command("generate").description("Write the parameter-name types for this project.").action(async () => {
-    const { path: path2 } = await generate();
-    console.log(`generated ${path2}`);
-  });
+  return new Command("generate").description(`Write the names declared under ${FOLDER}/test-case-parameters/ to ${FOLDER}/${GENERATED_PATH}, so a test case that names an undeclared parameter is a type error.`).action(reportingConfigErrors(async () => {
+    const path2 = await generate(process.cwd());
+    console.log(`Wrote ${relativeTo(process.cwd(), path2)}`);
+  }));
 }
 
-// src/cli/commands/init/init.ts
+// src/cli/commands/init/scaffold.ts
+var declaration = (fn, body) => `import { ${fn} } from "thunderjar";
+
+export default ${fn}(${body});
+`;
+var json = (value) => JSON.stringify(value, null, 2) + `
+`;
 var config = `import { declareConfig, sqliteStore } from "thunderjar";
 
 export default declareConfig({
@@ -3516,58 +3465,7 @@ export default declareConfig({
   runDataStore: sqliteStore({ path: "./.thunderjar/.data/runs.sqlite" }),
 });
 `;
-var stub = (fn, body) => `import { ${fn} } from "thunderjar";
-
-export default ${fn}(${body});
-`;
-var baseImage = stub("declareBaseImage", `{
-  applyParameter: () => \`FROM node:20-bookworm\`,
-}`);
-var codeState = `import { checkoutCommit, declareCodeState } from "thunderjar";
-
-export default declareCodeState({
-  config: { commit: "a1b2c3" },
-  applyParameter: (config, ctx) => \`\${checkoutCommit(ctx, config.commit)}\\nRUN npm ci\`,
-});
-`;
-var promptSet = stub("declarePromptSet", `{
-  config: { commit: "e4f5a6" },
-  applyParameter: (config, ctx) => \`COPY \${ctx.git.show(config.commit, "prompts/snerk.md")} /workspace/CLAUDE.md\`,
-}`);
-var harnessIndex = stub("declareHarness", `{
-  applyParameter: (_config, ctx) => \`RUN npm install -g @anthropic-ai/claude-code@\${ctx.version}\`,
-  cli: (ctx) => \`claude -p "\${ctx.initialPrompt}" --model \${ctx.modelId} > \${ctx.resultPath}\`,
-  requiredEnv: ["ANTHROPIC_API_KEY"],
-}`);
-var harnessModels = stub("declareHarnessModels", `{
-  "haiku-4-5": "claude-haiku-4-5-20251001",
-}`);
-var harnessVersions = stub("declareHarnessVersions", `{
-  "2.1.283": { version: "2.1.283" },
-}`);
-var collectTokenCosts = stub("declareTokenCostCollector", `(_raw, _ctx) => {
-  return { outcome: "unavailable", reason: "notReported" };
-}`);
-var initialPrompt = stub("declareInitialPrompt", `{
-  prompt: "Create a file isPrime.ts exporting a function that tests for primality.",
-  timeoutSeconds: 600,
-  applyParameter: () => \`\`,
-}`);
-var measurement = stub("declareMeasurement", `{
-  instrument: "fileCreated",
-  config: { glob: "**/isPrime.ts" },
-  aggregate: ["rate"],
-}`);
-var testCase = stub("declareTestCase", `{
-  baseImage: ["node20"],
-  codeState: ["baseline"],
-  promptSet: ["snerk"],
-  harnessModel: ["claude-code@2.1.283/haiku-4-5"],
-  task: "is-prime",
-  initialPrompt: ["plain"],
-  iterations: 1,
-}`);
-var tsconfig = JSON.stringify({
+var tsconfig = json({
   compilerOptions: {
     target: "ESNext",
     module: "ESNext",
@@ -3579,18 +3477,71 @@ var tsconfig = JSON.stringify({
   },
   include: ["**/*.ts"],
   exclude: ["node_modules", ".data", "**/*.template.ts"]
-}, null, 2) + `
+});
+var testCase = declaration("declareTestCase", `{
+  baseImage: ["node20"],
+  codeState: ["baseline"],
+  promptSet: ["snerk"],
+  harnessModel: ["claude-code@2.1.283/haiku-4-5"],
+  task: "is-prime",
+  initialPrompt: ["plain"],
+  iterations: 1,
+}`);
+var baseImage = declaration("declareBaseImage", `{
+  applyParameter: () => \`FROM node:20-bookworm\`,
+}`);
+var harness = `import { claudeCodeReply, declareHarness } from "thunderjar";
+
+// Claude Code, installed as root, then run as the image's non-root \`node\` user: it won't skip its
+// permission prompts as root, and nobody is there to answer them.
+export default declareHarness({
+  applyParameter: (_config, ctx) => \`RUN npm install -g @anthropic-ai/claude-code@\${ctx.version}
+RUN mkdir -p /thunderjar && chown -R node:node /workspace /thunderjar
+USER node\`,
+  // The prompt is read from its file, so quotes and newlines reach the agent intact. Turn 0 starts
+  // the session, and any later turn resumes it.
+  cli: (ctx) =>
+    \`claude -p "$(cat \${ctx.promptPath})" --model \${ctx.modelId} --output-format json --dangerously-skip-permissions\` +
+    \` \${ctx.turn === 0 ? "--session-id" : "--resume"} \${ctx.sessionId} > \${ctx.resultPath}\`,
+  collectReply: claudeCodeReply,
+  requiredEnv: ["ANTHROPIC_API_KEY"],
+});
+`;
+var harnessModels = declaration("declareHarnessModels", `{
+  "haiku-4-5": "claude-haiku-4-5-20251001",
+}`);
+var harnessVersions = declaration("declareHarnessVersions", `{
+  "2.1.283": { version: "2.1.283" },
+}`);
+var collectTokenCosts = `import { claudeCodeTokenCosts, declareTokenCostCollector } from "thunderjar";
+
+export default declareTokenCostCollector((raw) => claudeCodeTokenCosts(raw));
 `;
+var initialPrompt = declaration("declareInitialPrompt", `{
+  prompt: "Create a file isPrime.ts exporting a function that tests for primality.",
+  timeoutSeconds: 600,
+}`);
+var measurement = declaration("declareMeasurement", `{
+  instrument: "fileCreated",
+  config: { glob: "**/isPrime.ts" },
+  aggregate: ["rate"],
+}`);
 var P = "test-case-parameters";
-function scaffold() {
+function scaffold({ nestedPackage }) {
   return {
-    "thunderjar.config.ts": config,
+    ...nestedPackage && {
+      "package.json": json({ name: "thunderjar-config", private: true, type: "module", dependencies: { thunderjar: "latest" } })
+    },
     "tsconfig.json": tsconfig,
+    ".gitignore": ["_generated/", ".data/", ...nestedPackage ? ["node_modules/"] : []].join(`
+`) + `
+`,
+    "thunderjar.config.ts": config,
     "test-cases/example.ts": testCase,
     [`${P}/baseImages/node20/index.ts`]: baseImage,
-    [`${P}/codeStates/baseline/index.ts`]: codeState,
-    [`${P}/promptSets/snerk/index.ts`]: promptSet,
-    [`${P}/harnessModels/claude-code/index.ts`]: harnessIndex,
+    [`${P}/codeStates/baseline/index.ts`]: declaration("declareCodeState", "{}"),
+    [`${P}/promptSets/snerk/index.ts`]: declaration("declarePromptSet", "{}"),
+    [`${P}/harnessModels/claude-code/index.ts`]: harness,
     [`${P}/harnessModels/claude-code/models.ts`]: harnessModels,
     [`${P}/harnessModels/claude-code/versions.ts`]: harnessVersions,
     [`${P}/harnessModels/claude-code/collectTokenCosts.ts`]: collectTokenCosts,
@@ -3598,371 +3549,484 @@ function scaffold() {
     [`${P}/tasks/is-prime/measurements/isPrimeTsExists.ts`]: measurement
   };
 }
-async function init(projectRoot) {
-  const root = join(projectRoot, ".thunderjar");
-  const nested = !existsSync(join(projectRoot, "package.json"));
-  const files = scaffold();
-  if (nested) {
-    files["package.json"] = JSON.stringify({ name: "thunderjar-config", private: true, type: "module", dependencies: { thunderjar: "latest" } }, null, 2) + `
-`;
+
+// src/cli/commands/init/init.ts
+var FOLDER2 = ".thunderjar";
+async function isDirectory2(path2) {
+  try {
+    return (await Bun.file(path2).stat()).isDirectory();
+  } catch {
+    return false;
   }
-  files[".gitignore"] = ["_generated/", ".data/", ...nested ? ["node_modules/"] : []].join(`
-`) + `
-`;
-  const result = { created: [], skipped: [] };
-  for (const [rel, content] of Object.entries(files)) {
-    const path2 = join(root, rel);
-    if (existsSync(path2)) {
-      result.skipped.push(rel);
+}
+async function init(projectDir) {
+  const root = `${projectDir}/${FOLDER2}`;
+  const createdFolder = !await isDirectory2(root);
+  const nestedPackage = !await Bun.file(`${projectDir}/package.json`).exists();
+  const result = { createdFolder, created: [], existing: [] };
+  for (const [path2, content] of Object.entries(scaffold({ nestedPackage }))) {
+    const file = Bun.file(`${root}/${path2}`);
+    if (await file.exists()) {
+      result.existing.push(path2);
       continue;
     }
-    await Bun.write(path2, content);
-    result.created.push(rel);
+    await Bun.write(file, content);
+    result.created.push(path2);
   }
   return result;
 }
 function createInitCommand() {
-  return new Command("init").description("Create .thunderjar/ in this project.").action(async () => {
-    const { created, skipped } = await init(process.cwd());
-    for (const f of created)
-      console.log(`created  .thunderjar/${f}`);
-    for (const f of skipped)
-      console.log(`exists   .thunderjar/${f}`);
+  return new Command("init").description("Scaffold the .thunderjar/ configuration folder in the current directory, with an example test case. Existing files are left as they are.").action(async () => {
+    const { createdFolder, created, existing } = await init(process.cwd());
+    if (createdFolder)
+      console.log(`Created ${FOLDER2}/`);
+    for (const path2 of created)
+      console.log(`Created ${FOLDER2}/${path2}`);
+    for (const path2 of existing)
+      console.log(`Exists  ${FOLDER2}/${path2}`);
   });
 }
 
 // src/cli/commands/plan/plan.ts
-var LABELS = ["baseImage", "codeState", "promptSet", "harnessModel", "task", "initialPrompt"];
-var LABEL_WIDTH = Math.max(...LABELS.map((label) => label.length)) + 2;
-async function plan(name, cwd = process.cwd(), options = {}) {
-  const { docker: docker2 = dockerCli(), repository = LOCAL_REPOSITORY } = options;
-  const root = findThunderjarRoot(cwd);
-  const testCase2 = await loadTestCase(root, name);
-  const { hashes, permutations } = await resolveTestCase(root, testCase2);
-  const found = await prerunStatuses(docker2, repository, permutations);
-  const status = (hash) => ("statuses" in found) ? showPrerunStatus(found.statuses.get(hash)) : "";
-  const parameterLines = LABELS.map((label) => {
-    const value = label === "task" ? testCase2.task : testCase2[label].map((n) => `${n} (${abbreviateHash(hashes[label].get(n))})`).join(", ");
-    return `${(label + ":").padEnd(LABEL_WIDTH)}${value}`;
-  });
-  const runs = permutations.length * testCase2.iterations;
-  const summary = `Matrix shape: ${matrixShape(testCase2).join("/")} ` + `(${count(permutations.length, "permutation")} \xD7 ${count(testCase2.iterations, "iteration")} = ${count(runs, "container run")})`;
-  const rows = permutationRows(permutations);
-  const numberWidth = Math.max(2, String(permutations.length).length);
-  const entries = permutations.map((permutation, n) => `${String(n + 1).padStart(numberWidth)}  ${rows[n]}
-` + `${" ".repeat(numberWidth + 2)}${prerunTag(permutation.hash)}${status(permutation.hash)}`);
-  const note = "unreachable" in found ? ["", unreachableNote(found.unreachable)] : [];
-  return [...parameterLines, "", summary, "", entries.join(`
-
-`), ...note].join(`
+var ROWS = [
+  ["baseImage", (t) => t.baseImage.join(", ")],
+  ["codeState", (t) => t.codeState.join(", ")],
+  ["promptSet", (t) => t.promptSet.join(", ")],
+  ["harnessModel", (t) => t.harnessModel.join(", ")],
+  ["task", (t) => t.task],
+  ["initialPrompt", (t) => t.initialPrompt.join(", ")]
+];
+var LABEL_WIDTH = Math.max(...ROWS.map(([label]) => `${label}: `.length));
+function renderSummary(testCase2) {
+  return ROWS.map(([label, values]) => `${`${label}:`.padEnd(LABEL_WIDTH)}${values(testCase2)}`).join(`
 `);
 }
-function createPlanCommand() {
-  return new Command("plan").description("Print what a run of a test case would do.").argument("<test case>", "the test case to plan").addOption(imagePrefixOption("the image repository prerun images are looked up in")).action(async (name, options) => {
-    console.log(await plan(name, process.cwd(), { repository: options.imagePrefix }));
+function renderMatrix(testCase2, permutations, statuses) {
+  const count = permutations.length;
+  const shape = `Matrix shape: ${matrixShape(testCase2).join("/")} (${count} ${count === 1 ? "permutation" : "permutations"})`;
+  const indexWidth = Math.max(2, String(count).length);
+  const widths = AXES.map((axis) => Math.max(...permutations.map((permutation) => permutation[axis].length)));
+  const rows = permutations.map((permutation, i) => {
+    const columns = AXES.map((axis, a) => permutation[axis].padEnd(widths[a])).join(" | ");
+    return `${String(i + 1).padStart(indexWidth)}  ${columns}   ${abbreviateHash(permutation.hash)}  ${statuses[i]}`;
   });
+  return [shape, "", ...rows].join(`
+`);
+}
+async function imageStatuses(permutations, imagePrefix) {
+  try {
+    const images = await imagesIn(prerunRepository(imagePrefix));
+    return { statuses: permutations.map((p) => images.has(prerunImage(p.hash, imagePrefix)) ? "built" : "missing") };
+  } catch (error) {
+    if (!(error instanceof DockerUnavailableError))
+      throw error;
+    return { statuses: permutations.map(() => "unknown"), unavailable: error.message };
+  }
 }
+async function plan(cwd, name, imagePrefix) {
+  const root = await findThunderjarRoot(cwd);
+  const testCase2 = await loadTestCase(root, name);
+  await checkRequiredEnv(root, testCase2);
+  const permutations = await hashPermutations(root, testCase2);
+  const { statuses, unavailable } = await imageStatuses(permutations, imagePrefix);
+  return {
+    output: `${renderSummary(testCase2)}
 
-// src/measuring/aggregate.ts
-var sum = (xs) => xs.reduce((a, b) => a + b, 0);
-var mean = (xs) => sum(xs) / xs.length;
-var median = (xs) => {
-  const sorted = xs.toSorted((a, b) => a - b);
-  const mid = sorted.length >> 1;
-  return sorted.length % 2 === 1 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2;
-};
-var byKey = (records, combine) => {
-  const keys = [...new Set(records.flatMap((r) => Object.keys(r)))];
-  return Object.fromEntries(keys.map((key) => [key, combine(records.map((r) => r[key] ?? 0))]));
-};
-var ofBooleans = {
-  rate: (bs) => bs.filter(Boolean).length / bs.length,
-  count: (bs) => bs.filter(Boolean).length
-};
-var ofNumbers = {
-  mean,
-  median,
-  min: (xs) => Math.min(...xs),
-  max: (xs) => Math.max(...xs),
-  sum
-};
-var ofRecords = {
-  sum: (rs) => byKey(rs, sum),
-  mean: (rs) => byKey(rs, mean)
-};
-var isRecordOfNumbers = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((v) => typeof v === "number");
-function menuFor(values) {
-  if (values.every((v) => typeof v === "boolean"))
-    return ["booleans", ofBooleans];
-  if (values.every((v) => typeof v === "number"))
-    return ["numbers", ofNumbers];
-  if (values.every(isRecordOfNumbers))
-    return ["records of numbers", ofRecords];
-  return;
+${renderMatrix(testCase2, permutations, statuses)}`,
+    warning: unavailable && `Warning: Docker can't be reached, so whether each prerun image is built is unknown: ${unavailable}`
+  };
 }
-function combine(values, methods) {
-  if (values.length === 0)
-    return {};
-  const menu = menuFor(values);
-  if (!menu)
-    throw new Error(`can't combine ${JSON.stringify(values)}: not all booleans, numbers or records of numbers`);
-  const [kind, menuMethods] = menu;
-  return Object.fromEntries(methods.map((method) => {
-    const apply = menuMethods[method];
-    if (!apply)
-      throw new Error(`"${method}" doesn't combine ${kind}`);
-    return [method, apply(values)];
+function createPlanCommand() {
+  return new Command("plan").description("Show what a test case would run, without running it: the parameters it names, each permutation of them with its hash, and whether its prerun image is built.").argument("<test case>", `the name of a test case, declared in ${FOLDER}/test-cases/<test case>.ts`).addOption(imagePrefixOption()).action(reportingConfigErrors(async (name, options) => {
+    const { output, warning } = await plan(process.cwd(), name, options.imagePrefix);
+    console.log(output);
+    if (warning)
+      console.error(warning);
   }));
 }
-function aggregatePermutation(records, measurements) {
-  const [first] = records;
-  if (!first)
-    throw new Error("no container runs to aggregate");
-  const { executionId, permutationHash } = first;
-  if (records.some((r) => r.executionId !== executionId || r.permutationHash !== permutationHash)) {
-    throw new Error("container runs to aggregate must be of one permutation of one execution");
-  }
-  const measures = {};
-  for (const { name, aggregate } of measurements) {
-    const values = records.flatMap(({ result }) => {
-      const outcome = result[name]?.outcome;
-      return outcome?.outcome === "measured" ? [outcome.data] : [];
-    });
-    measures[name] = { measured: values.length, ...combine(values, aggregate) };
-  }
-  const durations = records.map(({ execution }) => execution.finishedAt - execution.startedAt);
+
+// src/execution/planExecution.ts
+var RESULT_PATH = "/thunderjar/result.json";
+var PROMPT_PATH = "/thunderjar/prompt.txt";
+function turnPaths(turn, count) {
+  if (count === 1)
+    return { promptPath: PROMPT_PATH, resultPath: RESULT_PATH };
+  return { promptPath: `/thunderjar/turns/${turn + 1}/prompt.txt`, resultPath: `/thunderjar/turns/${turn + 1}/result.json` };
+}
+var promptsOf = (initialPrompt2) => initialPrompt2.turns ?? [initialPrompt2.prompt];
+async function loadHarness(root, task, permutation, problems) {
+  const { harness: name, version, model } = parsePair(permutation.harnessModel);
+  const dir = `${PARAMETERS}/harnessModels/${name}`;
+  const [baseImage2, harness2, collectTokenCosts2, versions, models, initialPrompt2] = await Promise.all([
+    loadDeclaration(root, `${PARAMETERS}/baseImages/${permutation.baseImage}/index.ts`, "declareBaseImage", problems),
+    loadDeclaration(root, `${dir}/index.ts`, "declareHarness", problems),
+    loadDeclaration(root, `${dir}/collectTokenCosts.ts`, "declareTokenCostCollector", problems),
+    loadDeclaration(root, `${dir}/versions.ts`, "declareHarnessVersions", problems),
+    loadDeclaration(root, `${dir}/models.ts`, "declareHarnessModels", problems),
+    loadDeclaration(root, `${PARAMETERS}/tasks/${task}/initial-prompts/${permutation.initialPrompt}.ts`, "declareInitialPrompt", problems)
+  ]);
+  if (!baseImage2 || !harness2 || !collectTokenCosts2 || !versions || !models || !initialPrompt2)
+    return;
+  const pinned = versions[version].version;
+  return { baseImage: baseImage2, harness: harness2, collectTokenCosts: collectTokenCosts2, version: pinned, modelId: models[model], initialPrompt: initialPrompt2 };
+}
+function planTurns({ harness: harness2, version, modelId, initialPrompt: initialPrompt2 }, sessionId) {
+  const prompts = promptsOf(initialPrompt2);
+  return prompts.map((prompt, turn) => {
+    const paths = turnPaths(turn, prompts.length);
+    const command = harness2.cli({ version, modelId, initialPrompt: prompt, ...paths, turn, sessionId });
+    return { prompt, ...paths, command };
+  });
+}
+async function planExecution(root, testCase2, executionId, imagePrefix = DEFAULT_IMAGE_PREFIX) {
+  const hashed = await hashPermutations(root, testCase2);
+  const problems = [];
+  const loaded = await Promise.all(hashed.map((permutation) => loadHarness(root, testCase2.task, permutation, problems)));
+  if (problems.length > 0)
+    throw problemsError(problems);
   return {
     executionId,
-    permutationHash,
-    iterations: records.length,
-    measures,
-    duration: { mean: mean(durations), max: Math.max(...durations) }
+    permutations: hashed.map((permutation, p) => {
+      const harnessed = loaded[p];
+      return {
+        number: p + 1,
+        permutation,
+        prerunImage: prerunImage(permutation.hash, imagePrefix),
+        env: requiredEnvOf(harnessed.harness),
+        runOptions: harnessed.baseImage.runOptions ?? [],
+        timeoutSeconds: harnessed.initialPrompt.timeoutSeconds,
+        harness: harnessed.harness,
+        collectTokenCosts: harnessed.collectTokenCosts,
+        version: harnessed.version,
+        modelId: harnessed.modelId,
+        iterations: Array.from({ length: testCase2.iterations }, (_, i) => {
+          const sessionId = crypto.randomUUID();
+          return {
+            number: i + 1,
+            postrunImage: postrunImage(executionId, p + 1, i + 1, imagePrefix),
+            sessionId,
+            turns: planTurns(harnessed, sessionId)
+          };
+        })
+      };
+    })
   };
 }
-async function recomputeAggregationResult(store, executionId, permutationHash, measurements) {
-  const records = (await store.getExecution(executionId)).filter((r) => r.permutationHash === permutationHash);
-  const result = aggregatePermutation(records, measurements);
-  await store.recordAggregationResult(result);
-  return result;
-}
 
-// src/measuring/measure.ts
-var message = (error) => error instanceof Error ? error.message : String(error);
-var recordable = (result) => result.outcome === "erroredWhileMeasuring" ? { outcome: "erroredWhileMeasuring", error: { message: message(result.error) } } : result;
-async function evaluate({ instrument, config: config2, dir }, ctx) {
+// src/execution/containerRun.ts
+var RUN_PATH = "/thunderjar/run.json";
+var shellQuote = (text) => `'${text.replaceAll("'", `'\\''`)}'`;
+var NOW_MS_FUNCTION = [
+  "now_ms() {",
+  "  ms=$(date +%s%3N)",
+  "  case $ms in",
+  `    ${"[0-9]".repeat(13)}) echo "$ms" ;;`,
+  "    *) echo $(( $(date +%s) * 1000 )) ;;",
+  "  esac",
+  "}"
+].join(`
+`);
+function executionWrapper(turns) {
+  const folders = [...new Set(["/thunderjar", ...turns.map(({ promptPath }) => promptPath.slice(0, promptPath.lastIndexOf("/")))])];
+  const many = turns.length > 1;
+  const runTurn = ({ command }, i) => {
+    const run = [
+      "turn_start=$(now_ms)",
+      `sh -c ${shellQuote(command)}`,
+      "code=$?",
+      ...many ? [`turns="$turns${i === 0 ? "" : ","}{\\"startedAt\\":$turn_start,\\"finishedAt\\":$(now_ms),\\"exitCode\\":$code}"`] : []
+    ];
+    return i === 0 ? run : ["if [ $code -eq 0 ]; then", ...run.map((line) => `  ${line}`), "fi"];
+  };
+  return [
+    `mkdir -p ${folders.join(" ")}`,
+    ...turns.map(({ prompt, promptPath }) => `printf '%s' ${shellQuote(prompt)} > ${promptPath}`),
+    NOW_MS_FUNCTION,
+    "start=$(now_ms)",
+    `echo "{\\"startedAt\\":$start}" > ${RUN_PATH}`,
+    ...many ? ['turns=""'] : [],
+    ...turns.flatMap(runTurn),
+    "end=$(now_ms)",
+    `echo "{\\"startedAt\\":$start,\\"finishedAt\\":$end,\\"exitCode\\":$code${many ? ",\\\"turns\\\":[$turns]" : ""}}" > ${RUN_PATH}`
+  ].join(`
+`);
+}
+var isEpochMs = (value) => Number.isInteger(value) && value >= 1000000000000 && value < 10000000000000;
+var isTurn = (value) => {
+  const { startedAt, finishedAt, exitCode } = value ?? {};
+  return isEpochMs(startedAt) && isEpochMs(finishedAt) && typeof exitCode === "number";
+};
+function parseExecution(text, timeoutSeconds, killedAt) {
+  let parsed;
   try {
-    if (!isInstrumentName(instrument))
-      throw new Error(`unknown instrument ${JSON.stringify(instrument)}`);
-    const chosen = instruments[instrument];
-    const fields = config2;
-    const bundled = Object.fromEntries((chosen.bundledFiles ?? []).map((key) => [key, resolve(dir, fields[key])]));
-    return recordable(await chosen.evaluate({ ...fields, ...bundled }, ctx));
-  } catch (error) {
-    return { outcome: "erroredWhileMeasuring", error: { message: message(error) } };
+    parsed = text === undefined ? undefined : JSON.parse(text);
+  } catch {
+    parsed = undefined;
+  }
+  const { startedAt, finishedAt, exitCode, turns } = parsed ?? {};
+  const invalid = () => new DockerContainerError(`The execution wrapper left no valid ${RUN_PATH}: ${text === undefined ? "there is none" : text.trim()}`);
+  if (!isEpochMs(startedAt))
+    throw invalid();
+  if (killedAt !== undefined)
+    return { startedAt, finishedAt: killedAt, exitCode: null, timedOut: true, timeoutSeconds };
+  if (!isEpochMs(finishedAt) || typeof exitCode !== "number")
+    throw invalid();
+  if (turns !== undefined && (!Array.isArray(turns) || !turns.every(isTurn)))
+    throw invalid();
+  return { startedAt, finishedAt, exitCode, timedOut: false, timeoutSeconds, ...turns && { turns } };
+}
+async function runInContainer(run) {
+  try {
+    const stop = await runContainer(run.prerunImage, run.container, executionWrapper(run.turns), {
+      env: run.env,
+      runOptions: run.runOptions,
+      timeoutSeconds: run.timeoutSeconds
+    });
+    const killedAt = stop.timedOut ? stop.killedAt : undefined;
+    const execution = parseExecution(await readContainerFile(run.container, RUN_PATH), run.timeoutSeconds, killedAt);
+    const harnessResults = [];
+    for (const { resultPath } of run.turns)
+      harnessResults.push(await readContainerFile(run.container, resultPath) ?? null);
+    await commitContainer(run.container, run.postrunImage, run.prerunImage);
+    return { execution, harnessResults };
+  } finally {
+    await removeContainer(run.container).catch(() => {});
   }
 }
-async function measureContainerRun(measurements, open, now = Date.now) {
+
+// src/execution/measure.ts
+var message = (error) => error instanceof Error ? error.message : String(error);
+var recordable = (result) => result.outcome === "erroredWhileMeasuring" ? { outcome: "erroredWhileMeasuring", error: { message: message(result.error) } } : result;
+async function measureContainerRun(measurements, open, now = () => new Date) {
   const result = {};
-  for (const measurement2 of measurements) {
-    const ctx = await open();
+  for (const { name, declaration: declaration2, config: config2, contentHash } of measurements) {
+    const instrument = instruments[declaration2.instrument];
+    const ctx = await open(instrument.usesContainer !== false);
     let outcome;
     try {
-      outcome = await evaluate(measurement2, ctx);
+      outcome = recordable(await instrument.evaluate(config2, ctx));
+    } catch (error) {
+      outcome = { outcome: "erroredWhileMeasuring", error: { message: message(error) } };
     } finally {
       await ctx.close();
     }
-    result[measurement2.name] = {
-      instrument: measurement2.instrument,
-      contentHash: hashMeasurement(measurement2),
-      measuredAt: new Date(now()).toISOString(),
-      outcome
-    };
+    result[name] = { instrument: declaration2.instrument, contentHash, measuredAt: now().toISOString(), outcome };
   }
   return result;
 }
 
-// src/measuring/remeasure.ts
-function measureStatus(recorded, measurement2) {
-  if (recorded === undefined || recorded.outcome.outcome === "erroredWhileMeasuring")
-    return "missing";
-  return recorded.contentHash === hashMeasurement(measurement2) ? "current" : "stale";
-}
-function planRemeasure(records, measurements) {
-  const runs = records.flatMap(({ executionId, postrunImage, result }) => {
-    const measurementNames = measurements.filter((measurement2) => measureStatus(result[measurement2.name], measurement2) !== "current").map(({ name }) => name).toSorted();
-    return measurementNames.length === 0 ? [] : [{ executionId, postrunImage, measurementNames }];
-  });
-  return { runs, executions: summarizeExecutions2(records, measurements) };
-}
-function summarizeExecutions2(records, measurements) {
-  const resultsByExecution = new Map;
-  for (const { executionId, result } of records) {
-    resultsByExecution.set(executionId, [...resultsByExecution.get(executionId) ?? [], result]);
-  }
-  const sorted = measurements.toSorted((a, b) => a.name < b.name ? -1 : 1);
-  const declared = new Set(measurements.map(({ name }) => name));
-  return [...resultsByExecution].map(([executionId, results]) => {
-    const summaries = sorted.map((measurement2) => {
-      const statuses = results.map((result) => measureStatus(result[measurement2.name], measurement2));
-      const status = statuses.includes("missing") ? "missing" : statuses.includes("stale") ? "stale" : "current";
-      return { name: measurement2.name, contentHash: hashMeasurement(measurement2), status };
-    });
-    const storedMeasures = new Map;
-    for (const name of results.flatMap((result) => Object.keys(result)).filter((name2) => !declared.has(name2))) {
-      storedMeasures.set(name, (storedMeasures.get(name) ?? 0) + 1);
-    }
-    const deleted = [...storedMeasures].toSorted(([a], [b]) => a < b ? -1 : 1).map(([name, count2]) => ({ name, storedMeasures: count2 }));
-    return { executionId, measurements: summaries, deleted };
-  });
+// src/execution/measurementContext.ts
+var WORKDIR = "/workspace";
+function recordedContext({ harnessResult, reply, replies }) {
+  const noContainer = async () => {
+    throw new Error("this instrument has no measurement container: it reads only what was recorded of the run");
+  };
+  return {
+    workdir: WORKDIR,
+    harnessResult,
+    reply,
+    replies,
+    exec: noContainer,
+    readFile: noContainer,
+    writeFile: noContainer,
+    glob: noContainer,
+    close: async () => {}
+  };
 }
-
-// src/cli/commands/remeasure/remeasure.ts
-var footer = (updated, recomputed) => [
-  `Updated ${count(updated, "container run")}. Recomputed ${count(recomputed, "aggregation result")}.`,
-  "The agent was not rerun."
-];
-var NOTHING_TO_DO = "Already current, nothing to do.";
-function measuredLines(measured) {
-  const taken = measured.flatMap(({ record, result }) => Object.entries(result).map((entry) => ({ record, entry })));
-  const width = Math.max(...taken.map(({ entry: [name] }) => name.length));
-  return taken.map(({ record: { permutationHash, iteration }, entry: [name, { outcome }] }) => `  ${abbreviateHash(permutationHash)} i${String(iteration).padStart(2, "0")}  ${name.padEnd(width)}  ${showOutcome(outcome)}`);
-}
-function executionReport(task, containerRuns, { executionId, measurements, deleted }, measured, recomputed) {
-  const rows = [
-    ...measurements.map(({ name, contentHash, status }) => [
-      name,
-      status === "current" ? "up to date" : `new / changed (${abbreviateHash(contentHash)})`
-    ]),
-    ...deleted.map(({ name, storedMeasures }) => [
-      name,
-      `deleted from task; ${count(storedMeasures, "stored measure")} kept, excluded from aggregates`
-    ])
-  ];
-  const width = Math.max(...rows.map(([name]) => name.length));
-  return [
-    `Execution ${executionId}  (${count(containerRuns, "container run")})`,
-    `Current measurements for task ${task}:`,
-    ...rows.map(([name, status]) => `  ${name.padEnd(width)}  ${status}`),
-    "",
-    ...measured.length === 0 ? [NOTHING_TO_DO] : ["Measuring from each postrun image:", ...measuredLines(measured), ""],
-    ...footer(measured.length, recomputed)
-  ].join(`
-`);
+async function openMeasurementContext(postrunImage2, container, { harnessResult, reply, replies }) {
+  try {
+    await startContainer(postrunImage2, container);
+  } catch (error) {
+    await removeContainer(container).catch(() => {});
+    throw error;
+  }
+  const run = (command, stdin) => execInContainer(container, WORKDIR, command, stdin);
+  const mustRun2 = async (what, command, stdin) => {
+    const result = await run(command, stdin);
+    if (result.exitCode !== 0)
+      throw new Error(`${what}: ${result.stderr.trim() || `exited ${result.exitCode}`}`);
+    return result.stdout;
+  };
+  return {
+    workdir: WORKDIR,
+    harnessResult,
+    reply,
+    replies,
+    exec: (command) => run(["sh", "-c", command]),
+    readFile: (path2) => mustRun2(`can't read ${path2}`, ["cat", "--", path2]),
+    async writeFile(path2, contents) {
+      await mustRun2(`can't write ${path2}`, ["sh", "-c", 'mkdir -p -- "$(dirname -- "$1")" && cat > "$1"', "sh", path2], contents);
+    },
+    async glob(pattern) {
+      const found = await mustRun2(`can't list the files in ${WORKDIR}`, ["find", ".", "(", "-type", "f", "-o", "-type", "l", ")"]);
+      const glob = new Bun.Glob(pattern);
+      return found.split(`
+`).filter(Boolean).map((path2) => path2.replace(/^\.\//, "")).filter((path2) => glob.match(path2)).toSorted();
+    },
+    close: () => removeContainer(container)
+  };
 }
-function testCaseReport(testCase2, executions2, updated, recomputed) {
-  const rows = executions2.map(({ executionId, containerRuns, ranAt, plan: plan2 }) => ({
-    executionId,
-    runs: count(containerRuns, "run"),
-    day: ranAt.slice(0, 10),
-    current: plan2.runs.length === 0
-  }));
-  const width = Math.max(...rows.map(({ runs }) => runs.length));
-  const total = executions2.reduce((sum2, { containerRuns }) => sum2 + containerRuns, 0);
-  return [
-    `${testCase2} has ${count(executions2.length, "execution")} (${count(total, "container run")})`,
-    ...rows.map(({ executionId, runs, day, current }) => `  ${executionId}  ${runs.padEnd(width)}  ${day}${current ? "  (already current, nothing to do)" : ""}`),
-    "",
-    updated === 0 ? NOTHING_TO_DO : `Measuring ${count(updated, "container run")}...  done`,
-    ...footer(updated, recomputed)
-  ].join(`
-`);
+
+// src/execution/reply.ts
+var message2 = (error) => error instanceof Error ? error.message : String(error);
+function collectReply(collect, harnessResult) {
+  if (harnessResult === null)
+    return { outcome: "unavailable", reason: "the agent left no result file" };
+  if (!collect)
+    return { outcome: "unavailable", reason: "its harness has no collectReply" };
+  let text;
+  try {
+    text = collect(harnessResult);
+  } catch (error) {
+    return { outcome: "unavailable", reason: `collectReply threw: ${message2(error)}` };
+  }
+  if (typeof text !== "string")
+    return { outcome: "unavailable", reason: `collectReply returned ${typeof text}, not a string` };
+  return { outcome: "collected", text };
 }
-async function remeasureExecution(cwd, store, opener, executionId) {
-  const records = await store.getExecution(executionId);
-  const measurements = await loadMeasurements(findThunderjarRoot(cwd), records[0].task);
-  const plan2 = planRemeasure(records, measurements);
-  const measured = [];
-  for (const { postrunImage, measurementNames } of plan2.runs) {
-    const record = records.find((r) => r.postrunImage === postrunImage);
-    const planned = measurementNames.map((name) => measurements.find((m) => m.name === name));
-    const result = await measureContainerRun(planned, () => opener.openMeasurementContext(record.postrunImage));
-    await store.recordMeasures(record.postrunImage, result);
-    measured.push({ record, result });
-  }
-  const permutationHashes = new Set(records.map(({ permutationHash }) => permutationHash));
-  for (const permutationHash of permutationHashes) {
-    await recomputeAggregationResult(store, executionId, permutationHash, measurements);
-  }
-  return { records, plan: plan2, measured, recomputed: permutationHashes.size };
-}
-async function remeasure(target, { cwd = process.cwd(), dataDir } = {}) {
-  const store = jsonFileStore(runDataStorePath(cwd, dataDir));
-  const opener = createDockerMeasurementOpener(dockerCli(), LOCAL_REPOSITORY);
-  if ((await store.getExecution(target)).length > 0) {
-    const { records, plan: plan2, measured, recomputed } = await remeasureExecution(cwd, store, opener, target);
-    return executionReport(records[0].task, records.length, plan2.executions[0], measured, recomputed);
-  }
-  const executions2 = await store.listExecutions(target);
-  if (executions2.length > 0) {
-    const planned = [];
-    let updated = 0;
-    let recomputed = 0;
-    for (const execution of executions2) {
-      const { plan: plan2, measured, recomputed: ofExecution } = await remeasureExecution(cwd, store, opener, execution.executionId);
-      planned.push({ ...execution, plan: plan2 });
-      updated += measured.length;
-      recomputed += ofExecution;
-    }
-    return testCaseReport(target, planned, updated, recomputed);
-  }
-  throw new Error(`${target} is not a recorded execution or test case`);
-}
-function createRemeasureCommand() {
-  return new Command("remeasure").description("Apply the current measurements to past runs.").argument("<target>", "an execution ID, or a test case, meaning every execution of it").addOption(dataDirOption()).action(async (target, options) => {
-    console.log(await remeasure(target, { dataDir: options.dataDir }));
+
+// src/execution/tokenCosts.ts
+var isCount = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0;
+function isTokenCosts(value) {
+  const costs = value;
+  if (typeof costs !== "object" || costs === null)
+    return false;
+  if (costs.outcome === "unavailable")
+    return ["absent", "unparseable", "notReported"].includes(costs.reason);
+  if (costs.outcome !== "collected" || !Array.isArray(costs.models))
+    return false;
+  if (costs.apiDurationMs !== undefined && !isCount(costs.apiDurationMs))
+    return false;
+  return costs.models.every((model) => {
+    const counts = [model.inputTokens, model.outputTokens, model.cacheCreationTokens, model.cacheReadTokens];
+    return typeof model.model === "string" && counts.every(isCount) && (model.costUsd === undefined || isCount(model.costUsd));
   });
 }
+function collectOne(collect, raw, ctx) {
+  if (raw === null)
+    return { outcome: "unavailable", reason: "absent" };
+  try {
+    const costs = collect(raw, ctx);
+    return isTokenCosts(costs) ? costs : { outcome: "unavailable", reason: "unparseable" };
+  } catch {
+    return { outcome: "unavailable", reason: "unparseable" };
+  }
+}
+function add(a, b) {
+  const costUsd = a.costUsd !== undefined && b.costUsd !== undefined ? a.costUsd + b.costUsd : undefined;
+  const costBasis = a.costBasis === b.costBasis ? a.costBasis : "unknown";
+  return {
+    model: a.model,
+    inputTokens: a.inputTokens + b.inputTokens,
+    outputTokens: a.outputTokens + b.outputTokens,
+    cacheCreationTokens: a.cacheCreationTokens + b.cacheCreationTokens,
+    cacheReadTokens: a.cacheReadTokens + b.cacheReadTokens,
+    ...costUsd !== undefined && { costUsd },
+    ...costBasis !== undefined && { costBasis }
+  };
+}
+function collectTokenCosts2(collect, harnessResults, ctx) {
+  const all = harnessResults.map((raw) => collectOne(collect, raw, ctx));
+  const collected = all.filter((costs) => costs.outcome === "collected");
+  if (collected.length === 0)
+    return all[0] ?? { outcome: "unavailable", reason: "absent" };
+  const byModel = new Map;
+  for (const model of collected.flatMap((costs) => costs.models)) {
+    const before = byModel.get(model.model);
+    byModel.set(model.model, before ? add(before, model) : model);
+  }
+  const durations = collected.map((costs) => costs.apiDurationMs);
+  const apiDurationMs = durations.every((ms) => ms !== undefined) ? durations.reduce((a, b) => a + b, 0) : undefined;
+  return { outcome: "collected", models: [...byModel.values()], ...apiDurationMs !== undefined && { apiDurationMs } };
+}
 
-// src/matrix/execution.ts
-var RESULT_PATH = "/thunderjar/result.json";
-var importDefault2 = async (path2) => (await import(path2)).default;
-async function renderCommand(root, task, permutation) {
-  const parameters = join(root, "test-case-parameters");
-  const { family, version, model } = parseHarnessModelPair(permutation.harnessModel);
-  const familyDir = join(parameters, "harnessModels", family);
-  const harness = await importDefault2(join(familyDir, "index.ts"));
-  const versions = await importDefault2(join(familyDir, "versions.ts"));
-  const models = await importDefault2(join(familyDir, "models.ts"));
-  const initialPrompt2 = await importDefault2(join(parameters, "tasks", task, "initial-prompts", `${permutation.initialPrompt}.ts`));
-  const entry = versions[version];
-  if (!("version" in entry)) {
-    throw new Error(`${permutation.harnessModel}: floating versions are not supported yet`);
-  }
-  const cli = entry.cli ?? harness.cli;
-  const ctx = { version: entry.version, modelId: models[model], initialPrompt: initialPrompt2.prompt };
+// src/execution/runExecution.ts
+function containerRunRecord({ plan: plan2, name, testCase: testCase2 }, { number: permutationNumber, permutation }, iteration, execution, turns, tokenCosts) {
+  const last = turns.at(-1);
+  const { harness: harness2, version, model } = parsePair(permutation.harnessModel);
   return {
-    renderCommand: (resultPath) => cli({ ...ctx, resultPath }),
-    timeoutSeconds: initialPrompt2.timeoutSeconds,
-    harnessModel: { family, version: ctx.version, modelId: ctx.modelId }
+    executionId: plan2.executionId,
+    testCase: name,
+    task: testCase2.task,
+    permutation: permutationNumber,
+    permutationHash: permutation.hash,
+    iteration: iteration.number,
+    postrunImage: iteration.postrunImage,
+    ranAt: new Date(execution.startedAt).toISOString(),
+    parameters: Object.fromEntries(AXES.map((axis) => [axis, { name: permutation[axis], parameterHash: permutation.parameterHashes[axis] }])),
+    harnessModel: { harness: harness2, version, model, modelId: permutation.modelId },
+    execution,
+    harnessResult: last.harnessResult,
+    reply: last.reply,
+    tokenCosts,
+    sessionId: iteration.sessionId,
+    ...turns.length > 1 && { turns },
+    result: {}
   };
 }
-async function planExecution(root, testCase2, executionId) {
-  const { hashes, permutations } = await resolveTestCase(root, testCase2);
-  const planned = [];
-  for (const permutation of permutations) {
-    const { renderCommand: render2, timeoutSeconds, harnessModel } = await renderCommand(root, testCase2.task, permutation);
-    const command = render2(RESULT_PATH);
-    const parameters = Object.fromEntries(AXES.map((axis) => [axis, { name: permutation[axis], parameterHash: hashes[axis].get(permutation[axis]) }]));
-    planned.push({
-      permutation,
-      parameters,
-      harnessModel,
-      prerunTag: prerunTag(permutation.hash),
-      runs: Array.from({ length: testCase2.iterations }, (_, iterationIndex) => ({
-        executionId,
-        iterationIndex,
-        prerunTag: prerunTag(permutation.hash),
-        postrunTag: postrunTag(executionId, permutation.hash, iterationIndex),
-        command,
-        renderCommand: render2,
-        timeoutSeconds
-      }))
-    });
+async function runExecution(run, store, hooks = {}) {
+  const { root, testCase: testCase2, plan: plan2, imagePrefix } = run;
+  const measurements = await loadMeasurements(root, testCase2.task);
+  await buildPrerunImages(root, testCase2.task, plan2.permutations.map(({ permutation }) => permutation), imagePrefix, hooks);
+  const startedAt = new Date().toISOString();
+  const executionRecord = (status2, finishedAt) => ({
+    executionId: plan2.executionId,
+    testCase: run.name,
+    task: testCase2.task,
+    startedAt,
+    finishedAt,
+    status: status2,
+    matrix: { shape: matrixShape(testCase2), permutations: plan2.permutations.length, iterations: testCase2.iterations }
+  });
+  await store.recordExecution(executionRecord("running"));
+  let status = "complete";
+  let finished;
+  try {
+    for (const permutation of plan2.permutations) {
+      for (const iteration of permutation.iterations) {
+        hooks.onRunning?.(permutation, iteration);
+        const container = containerName(plan2.executionId, permutation.number, iteration.number, imagePrefix);
+        const { execution, harnessResults } = await runInContainer({
+          prerunImage: permutation.prerunImage,
+          postrunImage: iteration.postrunImage,
+          turns: iteration.turns,
+          env: permutation.env,
+          runOptions: permutation.runOptions,
+          timeoutSeconds: permutation.timeoutSeconds,
+          container
+        });
+        const turns = harnessResults.map((harnessResult2) => ({ harnessResult: harnessResult2, reply: collectReply(permutation.harness.collectReply, harnessResult2) }));
+        const tokenCosts = collectTokenCosts2(permutation.collectTokenCosts, harnessResults, {
+          version: permutation.version,
+          modelId: permutation.modelId
+        });
+        const record = containerRunRecord(run, permutation, iteration, execution, turns, tokenCosts);
+        const { harnessResult, reply } = record;
+        await store.recordContainerRun(record);
+        if (execution.exitCode !== 0)
+          status = "failed";
+        hooks.onRan?.(permutation, iteration, record);
+        if (measurements.length === 0)
+          continue;
+        let opened = 0;
+        const recorded = { harnessResult: harnessResult ?? "", reply, replies: turns.map((turn) => turn.reply) };
+        const open = async (usesContainer) => usesContainer ? openMeasurementContext(iteration.postrunImage, `${container}-measure-${++opened}`, recorded) : recordedContext(recorded);
+        const result = await measureContainerRun(measurements, open);
+        await store.recordContainerRun({ ...record, result });
+        hooks.onMeasured?.(permutation, iteration, result);
+      }
+    }
+  } catch (error) {
+    status = "failed";
+    throw error;
+  } finally {
+    finished = executionRecord(status, new Date().toISOString());
+    await store.recordExecution(finished);
   }
-  return { executionId, iterations: testCase2.iterations, permutations: planned };
+  return finished;
 }
 
-// src/matrix/ulid.ts
+// src/execution/ulid.ts
 var ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz";
 function ulid(now = Date.now(), random = crypto.getRandomValues(new Uint8Array(10))) {
   if (!Number.isInteger(now) || now < 0 || now >= 2 ** 48)
@@ -3982,260 +4046,409 @@ function ulid(now = Date.now(), random = crypto.getRandomValues(new Uint8Array(1
 }
 
 // src/cli/commands/run/run.ts
-var indent = (text, spaces) => text.split(`
-`).map((line) => " ".repeat(spaces) + line).join(`
+var FIELD_INDENT = "    ";
+var LABEL_WIDTH2 = 10;
+var field = (label, value) => `${FIELD_INDENT}${`${label}:`.padEnd(LABEL_WIDTH2)}${value.split(`
+`).join(`
+${FIELD_INDENT}${" ".repeat(LABEL_WIDTH2)}`)}`;
+function renderExecution({ executionId, permutations }) {
+  const blocks = permutations.map((permutation) => [
+    `Permutation ${permutation.number}: prerun image ${permutation.prerunImage}`,
+    ...permutation.iterations.flatMap((iteration) => [
+      `  Iteration ${iteration.number}: postrun image ${iteration.postrunImage}`,
+      ...permutation.env.length > 0 ? [field("env", permutation.env.join(", "))] : [],
+      ...permutation.runOptions.length > 0 ? [field("docker", permutation.runOptions.join(" "))] : [],
+      ...iteration.turns.length === 1 ? [field("prompt", iteration.turns[0].prompt), field("command", iteration.turns[0].command)] : [
+        field("session", iteration.sessionId),
+        ...iteration.turns.flatMap(({ prompt, command }, t) => [field(`prompt ${t + 1}`, prompt), field(`turn ${t + 1}`, command)])
+      ]
+    ])
+  ].join(`
+`));
+  return [`Execution ${executionId}`, ...blocks].join(`
+
 `);
+}
+async function dryRun2(cwd, name, imagePrefix) {
+  const root = await findThunderjarRoot(cwd);
+  const executionId = ulid();
+  const testCase2 = await loadTestCase(root, name);
+  await checkRequiredEnv(root, testCase2);
+  return renderExecution(await planExecution(root, testCase2, executionId, imagePrefix));
+}
 var ordinal = (n, total) => `${String(n).padStart(String(total).length)}/${total}`;
-var shape = ({ permutations, iterations }) => `${count(permutations.length, "permutation")} \xD7 ${count(iterations, "iteration")}`;
-async function run(name, options) {
-  const {
-    dryRun,
-    cwd = process.cwd(),
-    log = (text) => console.log(text),
-    now = Date.now,
-    newExecutionId = () => ulid(now()),
-    rootDir = defaultRootDir(),
-    docker: docker2 = dockerCli(),
-    repository = LOCAL_REPOSITORY,
-    runner = createDockerRunner(docker2, repository),
-    measurementOpener = createDockerMeasurementOpener(docker2, repository),
-    dataDir
-  } = options;
-  const root = findThunderjarRoot(cwd);
+var duration = (ms) => ms < 1000 ? `${ms}ms` : `${(ms / 1000).toFixed(1)}s`;
+var showValue = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? `{${Object.entries(value).map(([key, v]) => `${key}: ${showValue(v)}`).join(", ")}}` : JSON.stringify(value) ?? String(value);
+var showOutcome = (outcome) => outcome.outcome === "measured" ? showValue(outcome.data) : outcome.outcome === "skipped" ? `skipped${outcome.reason ? ` (${outcome.reason})` : ""}` : `erroredWhileMeasuring (${outcome.error.message})`;
+var showMeasures = (result) => Object.entries(result).map(([name, { outcome }]) => `${name}: ${showOutcome(outcome)}`).join("   ");
+function label(testCase2, { permutation }) {
+  const varying = AXES.filter((axis) => axis !== "harnessModel" && axis !== "initialPrompt" && testCase2[axis].length > 1);
+  const harnesses = new Set(testCase2.harnessModel.map((pair) => parsePair(pair).harness));
+  const harness2 = harnesses.size === testCase2.harnessModel.length ? parsePair(permutation.harnessModel).harness : permutation.harnessModel;
+  return [...varying.map((axis) => permutation[axis]), harness2, permutation.initialPrompt].join(" | ");
+}
+async function run(cwd, name, imagePrefix, dataDir) {
+  const root = await findThunderjarRoot(cwd);
   const testCase2 = await loadTestCase(root, name);
-  const execution = await planExecution(root, testCase2, newExecutionId());
-  const { executionId, permutations, iterations } = execution;
-  const rows = permutationRows(permutations.map((p) => p.permutation));
-  const permutationLine = (n) => `Permutation ${ordinal(n + 1, permutations.length)}  ${rows[n]}`;
-  if (dryRun) {
-    const found = await prerunStatuses(docker2, repository, permutations.map((p) => p.permutation));
-    log(`Execution ${executionId} (dry run, ${shape(execution)})`);
-    if ("unreachable" in found)
-      log(unreachableNote(found.unreachable));
-    permutations.forEach(({ permutation, prerunTag: prerunTag2, runs }, n) => {
-      log("");
-      log([
-        permutationLine(n),
-        `  ${prerunTag2}${"statuses" in found ? showPrerunStatus(found.statuses.get(permutation.hash)) : ""}`,
-        ...runs.map(({ iterationIndex, postrunTag: postrunTag2, command }) => `  iteration ${ordinal(iterationIndex + 1, iterations)}  ${postrunTag2}
-${indent(command, 4)}`)
-      ].join(`
-`));
+  await checkRequiredEnv(root, testCase2);
+  const plan2 = await planExecution(root, testCase2, ulid(), imagePrefix);
+  const store = dataDirOf(cwd, root, dataDir);
+  const permutations = plan2.permutations.length;
+  console.log(`Execution ${plan2.executionId}`);
+  let building;
+  let lineOpen = false;
+  try {
+    const record = await runExecution({ root, name, testCase: testCase2, plan: plan2, imagePrefix }, fileStore(store), {
+      onBuilding: (image) => {
+        building = image;
+        lineOpen = true;
+        process.stdout.write(`Building ${image} ... `);
+      },
+      onBuilt: () => {
+        building = undefined;
+        lineOpen = false;
+        console.log("done");
+      },
+      onRunning: (permutation, iteration) => {
+        lineOpen = true;
+        process.stdout.write(` ${ordinal(permutation.number, permutations)}  iteration ${ordinal(iteration.number, testCase2.iterations)}  ${label(testCase2, permutation)}  ... `);
+      },
+      onRan: (_permutation, _iteration, { execution, harnessResult, tokenCosts }) => {
+        lineOpen = false;
+        const ended = agentEnd(execution, harnessResult);
+        const cost = knownCost(tokenCosts);
+        const tokens = totalTokens(tokenCosts);
+        const spent = cost !== undefined ? `, ${dollars(cost)}` : tokens !== undefined ? `, ${thousands(tokens)} tokens` : "";
+        console.log(execution.timedOut ? ended : `${ended} (${duration(execution.finishedAt - execution.startedAt)}${spent})`);
+      },
+      onMeasured: (permutation, _iteration, result) => {
+        console.log(`${" ".repeat(ordinal(permutation.number, permutations).length + 3)}${showMeasures(result)}`);
+      }
     });
-    return;
-  }
-  const measurements = await loadMeasurements(root, testCase2.task);
-  const nameWidth = Math.max(0, ...measurements.map((m) => m.name.length));
-  const storePath = runDataStorePath(cwd, dataDir);
-  const store = jsonFileStore(storePath);
-  const builds = await preparePrerunBuilds({
-    root,
-    task: testCase2.task,
-    permutations: permutations.map((p) => p.permutation),
-    docker: docker2,
-    repository,
-    rootDir,
-    purpose: "Running a test case"
-  });
-  log(`Execution ${executionId} (${shape(execution)})`);
-  log(`Images in ${repository}`);
-  if (builds.missing.size > 0)
-    log(`Build contexts in ${join(rootDir, "builds")}`);
-  const exitCodes = new Map;
-  for (const [n, { permutation, parameters, harnessModel, prerunTag: prerunTag2, runs }] of permutations.entries()) {
-    log("");
-    log(permutationLine(n));
-    if (builds.missing.has(permutation.hash)) {
-      const started = now();
-      await builds.build(permutation.hash);
-      log(`  ${prerunTag2}  built (${seconds(now() - started)})`);
+    console.log(`Wrote ${displayPath(cwd, executionFolder(store, plan2.executionId))}/`);
+    if (record.status === "failed")
+      process.exitCode = 1;
+  } catch (error) {
+    if (error instanceof DockerUnavailableError) {
+      console.error(`Error: Docker can't be reached, so nothing can be run: ${error.message}`);
+    } else if (error instanceof DockerBuildError) {
+      console.log("failed");
+      console.error(`Error: Building ${building} failed: ${error.message}`);
+    } else if (error instanceof DockerContainerError && lineOpen) {
+      console.log("failed");
+      console.error(`Error: Running a container failed: ${error.message}`);
+    } else if (error instanceof DockerContainerError) {
+      console.error(`Error: Measuring a container run failed: ${error.message}`);
     } else {
-      log(`  ${prerunTag2}  reused`);
-    }
-    for (const containerRun of runs) {
-      const { startedAt, finishedAt, exitCode } = await runner.runContainer(containerRun);
-      await store.recordContainerRun({
-        executionId,
-        testCase: name,
-        task: testCase2.task,
-        permutationHash: permutation.hash,
-        iteration: containerRun.iterationIndex,
-        postrunImage: containerRun.postrunTag,
-        ranAt: new Date(startedAt).toISOString(),
-        parameters,
-        harnessModel,
-        result: {},
-        execution: { startedAt, finishedAt, exitCode }
-      });
-      exitCodes.set(exitCode, (exitCodes.get(exitCode) ?? 0) + 1);
-      log(`  iteration ${ordinal(containerRun.iterationIndex + 1, iterations)}  ${containerRun.postrunTag}` + `  exit ${exitCode}  ${duration({ startedAt, finishedAt })}`);
-      if (measurements.length > 0) {
-        const open = () => measurementOpener.openMeasurementContext(containerRun.postrunTag);
-        const result = await measureContainerRun(measurements, open, now);
-        await store.recordMeasures(containerRun.postrunTag, result);
-        log(Object.entries(result).map(([name2, { outcome }]) => `    ${name2.padEnd(nameWidth)}  ${showOutcome(outcome)}`).join(`
-`));
-      }
-      await recomputeAggregationResult(store, executionId, permutation.hash, measurements);
+      throw error;
     }
+    process.exitCode = 1;
   }
-  const total = permutations.length * iterations;
-  const byCode = [...exitCodes].toSorted(([a], [b]) => a - b).map(([code, n]) => `${n} exited ${code}`);
-  log("");
-  log(`${count(total, "container run")}: ${byCode.join(", ")}`);
-  log(`Recorded in ${relative(cwd, storePath)}`);
 }
 function createRunCommand() {
-  return new Command("run").description("Run a test case.").argument("<test case>", "the test case to run").option("--dry-run", "print each container run instead of building or running anything").addOption(imagePrefixOption("the image repository prerun and postrun images are tagged in")).addOption(dataDirOption()).action(async (name, options) => {
-    await run(name, { dryRun: options.dryRun ?? false, repository: options.imagePrefix, dataDir: options.dataDir });
-  });
+  return new Command("run").description("Run a test case: one execution, with a new ID. Builds any missing prerun image, then runs each iteration of each permutation in a container from its prerun image, commits it into its postrun image, takes the task's measurements of it, each in a container from its postrun image, and records it in the run data store.").argument("<test case>", `the name of a test case, declared in ${FOLDER}/test-cases/<test case>.ts`).option("--dry-run", "print the images, environment variables, prompts and harness commands the execution would use, without running anything").addOption(imagePrefixOption()).addOption(dataDirOption()).action(reportingConfigErrors(async (name, options) => {
+    if (options.dryRun)
+      console.log(await dryRun2(process.cwd(), name, options.imagePrefix));
+    else
+      await run(process.cwd(), name, options.imagePrefix, options.dataDir);
+  }));
+}
+
+// src/execution/aggregate.ts
+var sum = (xs) => xs.reduce((a, b) => a + b, 0);
+var mean = (xs) => sum(xs) / xs.length;
+var median = (xs) => {
+  const sorted2 = xs.toSorted((a, b) => a - b);
+  const mid = sorted2.length >> 1;
+  return sorted2.length % 2 === 1 ? sorted2[mid] : (sorted2[mid - 1] + sorted2[mid]) / 2;
+};
+var byKey = (records, combine) => {
+  const keys = [...new Set(records.flatMap((record) => Object.keys(record)))];
+  return Object.fromEntries(keys.map((key) => [key, combine(records.map((record) => record[key] ?? 0))]));
+};
+var ofBooleans = {
+  rate: (bs) => bs.filter(Boolean).length / bs.length,
+  count: (bs) => bs.filter(Boolean).length
+};
+var ofNumbers = { mean, median, min: (xs) => Math.min(...xs), max: (xs) => Math.max(...xs), sum };
+var ofRecords = {
+  sum: (records) => byKey(records, sum),
+  mean: (records) => byKey(records, mean)
+};
+var isRecordOfNumbers = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((v) => typeof v === "number");
+function menuFor(values) {
+  if (values.every((v) => typeof v === "boolean"))
+    return ["booleans", ofBooleans];
+  if (values.every((v) => typeof v === "number"))
+    return ["numbers", ofNumbers];
+  if (values.every(isRecordOfNumbers))
+    return ["records of numbers", ofRecords];
+  return;
+}
+function aggregateValues(values, methods) {
+  if (values.length === 0)
+    return { values: {} };
+  const menu = menuFor([...values]);
+  if (!menu)
+    return { incompatible: "recorded values aren't all booleans, numbers or records of numbers" };
+  const [kind, menuMethods] = menu;
+  const unfit = methods.filter((method) => !menuMethods[method]);
+  if (unfit.length > 0) {
+    const list = unfit.map((method) => `"${method}"`).join(", ");
+    return { incompatible: `recorded values are ${kind}; ${list} ${unfit.length === 1 ? "doesn't" : "don't"} combine them` };
+  }
+  return {
+    values: Object.fromEntries(methods.map((method) => [method, menuMethods[method]([...values])]))
+  };
+}
+function aggregatePermutation(runs, measurements) {
+  return Object.fromEntries(measurements.map(({ name, declaration: declaration2 }) => {
+    const values = runs.flatMap(({ result }) => {
+      const outcome = result[name]?.outcome;
+      return outcome?.outcome === "measured" ? [outcome.data] : [];
+    });
+    const combined = aggregateValues(values, declaration2.aggregate);
+    const measure = "incompatible" in combined ? { measured: values.length, values: {}, incompatible: combined.incompatible } : { measured: values.length, values: combined.values };
+    return [name, measure];
+  }));
 }
 
 // src/cli/commands/show/show.ts
+var GAP = "   ";
 var labelled = (lines2) => {
-  const width = Math.max(...lines2.map(([label]) => label.length));
-  return lines2.map(([label, value]) => `${label.padEnd(width)}  ${value}`);
+  const width = Math.max(...lines2.map(([label2]) => label2.length));
+  return lines2.map(([label2, value]) => `${label2.padEnd(width)}  ${value}`);
 };
-function table(rows) {
+function columns(rows) {
   const widths = rows[0].map((_, i) => Math.max(...rows.map((row) => row[i]?.length ?? 0)));
-  return rows.map((row) => row.length === 0 ? "" : `  ${row.map((cell, i) => i === row.length - 1 ? cell : cell.padEnd(widths[i])).join("  ")}`);
+  return rows.map((row) => `  ${row.map((cell, i) => cell.padEnd(widths[i])).join("  ")}`.trimEnd());
 }
-var permutationOf = ({ parameters }) => Object.fromEntries(AXES.map((axis) => [axis, parameters[axis].name]));
-var PLACES = { rate: 2, mean: 1, median: 1 };
-function aggregatedValue(method, value) {
-  const places = PLACES[method];
-  const number = (n) => places === undefined ? showValue(n) : n.toFixed(places);
+var decimal = (n, places) => places === undefined ? String(n) : n.toFixed(places);
+function showValue2(value, places) {
   if (typeof value === "number")
-    return number(value);
-  return `{${Object.entries(value).map(([key, n]) => `${key}: ${number(n)}`).join(", ")}}`;
-}
-function aggregateCell({ measured, ...methods }) {
-  if (measured === 0)
-    return "\u2014";
-  return Object.entries(methods).map(([method, value]) => `${method} ${aggregatedValue(method, value)}`).join(", ");
-}
-function exits(runs) {
-  const byCode = new Map;
-  for (const { execution } of runs)
-    byCode.set(execution.exitCode, (byCode.get(execution.exitCode) ?? 0) + 1);
-  return [...byCode].toSorted(([a], [b]) => a - b).map(([code, n]) => `${n}/${runs.length} exited ${code}`).join(", ");
-}
-var summary = (label, value) => `  ${label.padEnd(11)}${value}`;
-function staleness(measurements) {
-  const currentHashes = new Map(measurements.map((measurement2) => [measurement2.name, hashMeasurement(measurement2)]));
-  return (name, { contentHash }) => {
-    const current = currentHashes.get(name);
-    return current !== undefined && current !== contentHash;
-  };
+    return decimal(value, places);
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    const entries = Object.entries(value).map(([key, v]) => `${key}: ${typeof v === "number" ? decimal(v, places) : JSON.stringify(v)}`);
+    return `{${entries.join(", ")}}`;
+  }
+  return JSON.stringify(value) ?? String(value);
+}
+function showAggregate(method, value, measured) {
+  if (method === "rate" && typeof value === "number")
+    return `${Math.round(value * measured)}/${measured}`;
+  return showValue2(value, method === "mean" || method === "median" ? 1 : undefined);
+}
+function showOutcome2(outcome) {
+  if (outcome === undefined)
+    return "not measured";
+  if (outcome.outcome === "skipped")
+    return `skipped${outcome.reason === undefined ? "" : `  (${outcome.reason})`}`;
+  if (outcome.outcome === "erroredWhileMeasuring")
+    return `errored while measuring  (${outcome.error.message})`;
+  return showValue2(outcome.data);
+}
+function duration2(ms) {
+  const seconds = Math.round(ms / 1000);
+  return `${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, "0")}`;
+}
+var runName = ({ permutation, iteration }) => `${permutation}-${iteration}`;
+var notCollected = (costs) => costs === undefined ? "not recorded" : costs.outcome === "unavailable" ? `not reported  (${costs.reason})` : "";
+function costColumns(runs) {
+  const mean2 = (xs) => xs.reduce((a, b) => a + b, 0) / xs.length;
+  const tokens = runs.flatMap(({ tokenCosts }) => totalTokens(tokenCosts) ?? []);
+  const costs = runs.flatMap(({ tokenCosts }) => knownCost(tokenCosts) ?? []);
+  const star = (n) => n < runs.length ? "*" : "";
+  return [
+    tokens.length === 0 ? "not reported" : `${thousands(mean2(tokens))}${star(tokens.length)}`,
+    costs.length === 0 ? "\u2014" : `${dollars(mean2(costs))}${star(costs.length)}`
+  ];
 }
-function aggregationTable({ iterations, measures }, runs, isStale) {
-  const names = Object.keys(measures).toSorted();
-  if (names.length === 0)
-    return ["  no measures"];
-  const staleRow = (name) => runs.some(({ result }) => {
-    const measure = result[name];
-    return measure?.outcome.outcome === "measured" && isStale(name, measure);
-  });
-  return table([
-    ["MEASURE", "MEASURED", "AGGREGATE"],
-    ...names.map((name) => [
-      name,
-      `${measures[name].measured}/${iterations}`,
-      `${aggregateCell(measures[name])}${staleRow(name) ? "  stale, run `remeasure`" : ""}`
+function tokenCostLines(costs) {
+  if (costs.outcome === "unavailable")
+    return [`  none  (${costs.reason})`];
+  const cost = ({ costUsd, costBasis }) => costUsd === undefined ? "not reported" : costBasis === "unknown" ? `not reported  (its price table doesn't know the model)` : dollars(costUsd);
+  return columns([
+    ["model", "input", "output", "cache write", "cache read", "cost"],
+    ...costs.models.map((model) => [
+      model.model,
+      thousands(model.inputTokens),
+      thousands(model.outputTokens),
+      thousands(model.cacheCreationTokens),
+      thousands(model.cacheReadTokens),
+      cost(model)
     ])
   ]);
 }
-var detailed = (outcome) => outcome.outcome === "measured" ? showValue(outcome.data) : outcome.outcome === "skipped" ? `skipped${outcome.reason === undefined ? "" : `  (${outcome.reason})`}` : `error  (${outcome.error.message})`;
-function byPermutation(records) {
-  const groups = new Map;
-  for (const record of records) {
-    const group = groups.get(record.permutationHash);
-    if (group)
-      group.push(record);
-    else
-      groups.set(record.permutationHash, [record]);
-  }
-  return [...groups.values()];
-}
-function showExecution(records, aggregations, measurements, latestOf) {
-  const [{ executionId, testCase: testCase2, task }] = records;
-  const ranAt = records.map((r) => r.ranAt).toSorted()[0];
-  const lines2 = labelled([
-    ["Execution", `${executionId}${latestOf === undefined ? "" : `  (latest of ${latestOf})`}`],
+function varyingAxes(runs) {
+  const varying = AXES.filter((axis) => new Set(runs.map(({ parameters }) => parameters[axis].name)).size > 1);
+  return varying.length > 0 ? varying : [...AXES];
+}
+function permutationTable(execution, runs, measurements) {
+  const axes = varyingAxes(runs);
+  const methodColumns = measurements.flatMap(({ name, declaration: declaration2 }) => declaration2.aggregate.map((method, i) => ({ name, method, first: i === 0 })));
+  const numberWidth = String(execution.matrix.permutations).length;
+  const withCosts = runs.some(({ tokenCosts }) => tokenCosts !== undefined);
+  const rows = [];
+  const leftOut = [];
+  const incompatible = new Map;
+  for (let permutation = 1;permutation <= execution.matrix.permutations; permutation++) {
+    const number = String(permutation).padStart(numberWidth);
+    const own = runs.filter((run2) => run2.permutation === permutation);
+    const [first] = own;
+    if (!first) {
+      rows.push([number, "no container runs"]);
+      continue;
+    }
+    const measures = aggregatePermutation(own, measurements);
+    for (const [name, measure] of Object.entries(measures)) {
+      if (measure.incompatible !== undefined)
+        incompatible.set(name, (incompatible.get(name) ?? new Set).add(measure.incompatible));
+    }
+    for (const { name } of measurements) {
+      for (const run2 of own) {
+        const outcome = run2.result[name]?.outcome;
+        if (outcome?.outcome !== "measured")
+          leftOut.push([runName(run2), name, showOutcome2(outcome)]);
+      }
+    }
+    const costs = withCosts ? costColumns(own) : [];
+    if (withCosts) {
+      for (const run2 of own) {
+        if (run2.tokenCosts?.outcome !== "collected")
+          leftOut.push([runName(run2), "tokens", notCollected(run2.tokenCosts)]);
+      }
+    }
+    rows.push([
+      number,
+      axes.map((axis) => first.parameters[axis].name).join(" | "),
+      `${own.length}/${execution.matrix.iterations}`,
+      ...methodColumns.map(({ name, method }) => {
+        const { measured, values, incompatible: incompatible2 } = measures[name];
+        if (incompatible2 !== undefined)
+          return "?";
+        const value = values[method];
+        if (value === undefined)
+          return "\u2014";
+        return `${showAggregate(method, value, measured)}${measured < own.length ? "*" : ""}`;
+      }),
+      ...costs
+    ]);
+  }
+  const header = ["", axes.join(" | "), "runs", ...methodColumns.map(({ method }) => method), ...withCosts ? ["tokens (mean)", "cost (mean)"] : []];
+  const widths = header.map((cell, i) => Math.max(cell.length, ...rows.map((row) => row[i]?.length ?? 0)));
+  for (const { name, declaration: declaration2 } of measurements) {
+    const start = 3 + methodColumns.findIndex((column2) => column2.name === name);
+    const end = start + declaration2.aggregate.length - 1;
+    const span = widths.slice(start, end + 1).reduce((a, b) => a + b, 0) + GAP.length * (end - start);
+    if (span < name.length)
+      widths[end] += name.length - span;
+  }
+  const line = (cells) => ` ${cells.map((cell, i) => cell.padEnd(widths[i])).join(GAP)}`.trimEnd();
+  const column = (i) => 1 + widths.slice(0, i).reduce((a, b) => a + b + GAP.length, 0);
+  const names = methodColumns.reduce((text, { name, first }, i) => first ? `${text.padEnd(column(3 + i))}${name}` : text, "");
+  const lines2 = [...measurements.length > 0 ? [names] : [], line(header), ...rows.map(line)];
+  const unclean = runs.filter(({ execution: execution2, harnessResult }) => !endedCleanly(execution2, harnessResult));
+  if (unclean.length > 0) {
+    lines2.push("", "! Agents that didn't end cleanly:", ...columns(unclean.map((run2) => [runName(run2), agentEnd(run2.execution, run2.harnessResult)])));
+  }
+  if (leftOut.length > 0)
+    lines2.push("", "* Left out of the aggregate:", ...columns(leftOut));
+  if (incompatible.size > 0) {
+    const reasons = [...incompatible].flatMap(([name, why]) => [...why].map((reason) => [`${name}:`, `${reason} (remeasure)`]));
+    lines2.push("", "? Can't aggregate as declared today:", ...columns(reasons));
+  }
+  return lines2;
+}
+function renderExecution2(execution, runs, measurements) {
+  const { executionId, testCase: testCase2, task, startedAt, status, matrix } = execution;
+  const header = labelled([
+    ["Execution", executionId],
     ["Test case", testCase2],
     ["Task", task],
-    ["Date", minute(ranAt)]
+    ["Started", minute(startedAt)],
+    ["Status", status],
+    ["Matrix", `${plural(matrix.permutations, "permutation")} \xD7 ${plural(matrix.iterations, "iteration")}`]
   ]);
-  const permutations = byPermutation(records);
-  const rows = permutationRows(permutations.map(([first]) => permutationOf(first)));
-  const byHash = new Map(aggregations.map((a) => [a.permutationHash, a]));
-  const isStale = staleness(measurements);
-  permutations.forEach((runs, n) => {
-    const aggregation = byHash.get(runs[0].permutationHash);
-    lines2.push("", `Permutation ${abbreviateHash(runs[0].permutationHash)}  (${count(runs.length, "iteration")})`, `  ${rows[n]}`, "", ...aggregation ? aggregationTable(aggregation, runs, isStale) : ["  no aggregation result recorded"], "", summary("exit", exits(runs)), ...aggregation ? [summary("duration", `mean ${seconds(aggregation.duration.mean)}, max ${seconds(aggregation.duration.max)}`)] : []);
-  });
-  return lines2.join(`
+  const body = runs.length === 0 ? ["No container runs recorded."] : permutationTable(execution, runs, measurements);
+  return [...header, "", ...body].join(`
 `);
 }
-function showContainerRun(record, measurements) {
-  const { postrunImage, executionId, testCase: testCase2, permutationHash, iteration, ranAt, parameters, result, execution } = record;
+var showReply = (reply, label2 = "") => {
+  const lines2 = reply.outcome === "collected" ? reply.text.split(`
+`) : [`none  (${reply.reason})`];
+  return lines2.map((line, i) => `  ${i === 0 ? label2 : " ".repeat(label2.length)}${line}`.trimEnd());
+};
+var showReplies = ({ reply, turns }) => turns ? turns.flatMap((turn, i) => showReply(turn.reply, `Turn ${i + 1}:  `)) : showReply(reply);
+function renderContainerRun(record) {
+  const { executionId, testCase: testCase2, permutation, permutationHash, iteration, postrunImage: postrunImage2, ranAt, parameters, harnessModel, execution, harnessResult, reply, result } = record;
+  const turnsRan = execution.turns === undefined ? [] : [["Turns", `${execution.turns.length} of ${record.turns?.length ?? "?"} ran`]];
   const names = Object.keys(result).toSorted();
-  const isStale = staleness(measurements);
-  const cell = (name) => `${detailed(result[name].outcome)}${isStale(name, result[name]) ? " (stale)" : ""}`;
   return [
     ...labelled([
-      ["Container run", postrunImage],
+      ["Container run", runName(record)],
       ["Execution", `${executionId}  (${testCase2})`],
-      ["Permutation", `${abbreviateHash(permutationHash)}, iteration ${iteration + 1}`],
+      ["Permutation", `${permutation}  (${abbreviateHash(permutationHash)}), iteration ${iteration}`],
+      ["Postrun image", postrunImage2],
       ["Ran at", minute(ranAt)]
     ]),
     "",
     "Parameters",
-    ...table(AXES.map((axis) => [axis, parameters[axis].name, parameters[axis].parameterHash.slice(0, 4)])),
+    ...columns(AXES.map((axis) => [axis, parameters[axis].name, abbreviateHash(parameters[axis].parameterHash)])),
     "",
-    "Measures",
-    ...names.length === 0 ? ["  none"] : table(names.map((name) => [name, cell(name)])),
+    ...labelled([
+      ["Harness", `${harnessModel.harness} ${harnessModel.version}`],
+      ["Model", `${harnessModel.model}  (${harnessModel.modelId})`],
+      ["Duration", duration2(execution.finishedAt - execution.startedAt)],
+      ["Exit", execution.timedOut ? `timed out after ${execution.timeoutSeconds}s` : String(execution.exitCode)],
+      ...turnsRan,
+      ["Result file", harnessResult === null ? "none" : plural(new TextEncoder().encode(harnessResult).length, "byte")]
+    ]),
     "",
-    `Duration  ${duration(execution)}   exit code ${execution.exitCode}`
+    ...reply === undefined ? [] : ["Reply", ...showReplies(record), ""],
+    ...record.tokenCosts === undefined ? [] : ["Token costs", ...tokenCostLines(record.tokenCosts), ""],
+    "Measures",
+    ...names.length === 0 ? ["  none"] : columns(names.map((name) => [name, showOutcome2(result[name].outcome)]))
   ].join(`
 `);
 }
-async function show3(target, { cwd = process.cwd(), dataDir } = {}) {
-  const store = jsonFileStore(runDataStorePath(cwd, dataDir));
-  const todays = (task) => loadMeasurements(findThunderjarRoot(cwd), task);
-  const containerRun = await store.getContainerRun(target);
-  if (containerRun)
-    return showContainerRun(containerRun, await todays(containerRun.task));
-  const execution = await store.getExecution(target);
-  if (execution.length > 0) {
-    return showExecution(execution, await store.getAggregationResults(target), await todays(execution[0].task));
+function fail(message3) {
+  console.error(`Error: ${message3}`);
+  process.exitCode = 1;
+}
+async function show6(cwd, executionId, containerRun, dataDir) {
+  const root = containerRun === undefined || dataDir === undefined ? await findThunderjarRoot(cwd) : undefined;
+  const store = fileStore(dataDir === undefined ? dataDirOf(cwd, root) : resolvePath(cwd, dataDir));
+  let execution;
+  let runs;
+  try {
+    execution = (await store.listExecutions()).find((record2) => record2.executionId === executionId);
+    if (!execution)
+      return fail(`No execution ${executionId} recorded. List them with \`thunderjar executions\`.`);
+    runs = await store.containerRunsOf(executionId);
+  } catch (error) {
+    if (!(error instanceof RunDataStoreError))
+      throw error;
+    return fail(`Can't read ${displayPath(cwd, error.path)}: ${error.message}`);
   }
-  const [latest] = await store.listExecutions(target);
-  if (latest) {
-    const { executionId } = latest;
-    const records = await store.getExecution(executionId);
-    return showExecution(records, await store.getAggregationResults(executionId), await todays(records[0].task), target);
+  if (containerRun === undefined) {
+    console.log(renderExecution2(execution, runs, await loadMeasurements(root, execution.task)));
+    return;
   }
-  throw new Error(`${target} is not a recorded container run, execution or test case`);
+  const record = runs.find((run2) => runName(run2) === containerRun || run2.postrunImage === containerRun);
+  if (!record)
+    return fail(`Execution ${executionId} has no container run ${containerRun}.`);
+  console.log(renderContainerRun(record));
 }
 function createShowCommand() {
-  return new Command("show").description("Show a test case, an execution or a container run.").argument("<target>", "a container run's postrun tag, an execution ID, or a test case, meaning its latest execution").addOption(dataDirOption()).action(async (target, options) => {
-    console.log(await show3(target, { dataDir: options.dataDir }));
-  });
+  return new Command("show").description("Show an execution's recorded results: a row per permutation, with each measure aggregated across its iterations by its measurement's methods. Given a container run, show that one iteration instead: its parameters, how the agent ran, and each measure.").argument("<execution>", "the execution's ID, as listed by `thunderjar executions`").argument("[container run]", "one of its container runs, as `<permutation>-<iteration>`, e.g. `1-1`, or its postrun image").addOption(dataDirOption()).action(reportingConfigErrors(async (executionId, containerRun, options) => {
+    await show6(process.cwd(), executionId, containerRun, options.dataDir);
+  }));
 }
 
 // src/cli/program.ts
 function createProgram() {
-  const program2 = new Command().name("thunderjar").description(package_default.description).version(package_default.version).showHelpAfterError().addCommand(createInitCommand()).addCommand(createGenerateCommand()).addCommand(createPlanCommand()).addCommand(createBuildCommand()).addCommand(createRunCommand()).addCommand(createExecutionsCommand()).addCommand(createShowCommand()).addCommand(createRemeasureCommand());
-  for (const command of program2.commands)
-    command.showHelpAfterError();
-  return program2;
+  return new Command().name("thunderjar").description(package_default.description).version(package_default.version).addCommand(createInitCommand()).addCommand(createGenerateCommand()).addCommand(createPlanCommand()).addCommand(createBuildCommand()).addCommand(createRunCommand()).addCommand(createExecutionsCommand()).addCommand(createShowCommand());
 }
 
 // src/cli/index.ts
-try {
-  await createProgram().parseAsync();
-} catch (error) {
-  console.error(error instanceof Error ? error.message : error);
-  process.exitCode = 1;
-}
+await createProgram().parseAsync();