vigiles 33.1.0 → 33.3.0

package/dist/eval.d.ts

@@ -119,7 +119,11 @@ export interface EvalSpec<M extends Metrics> {
      * the cache, and never read from an env var. Omit for the harness default.
      */
     readonly effort?: string | number;
-    /** Tools the agent may use. Default: Read Edit Write Bash. */
+    /**
+     * Tools pre-approved for the run (`--allowedTools`, a permission allowlist);
+     * the default tools stay available either way. `[]` approves none.
+     * Default: Read Edit Write Bash.
+     */
     readonly allowedTools?: readonly string[];
     /** Per-run timeout ms. Default 240000. */
     readonly timeoutMs?: number;
@@ -164,8 +168,9 @@ export interface EvalSpec<M extends Metrics> {
      * **Ships default-OFF** because a too-narrow auth allowlist would silently break
      * the real `claude` CLI's authentication; leaving it off keeps every existing
      * eval (including one running right now) authenticating exactly as before. When
-     * absent / `false`, the per-trial env is byte-identical to today
-     * (`{ ...process.env, ...arm.env }`). See `docs/safety.md` (ephemerality) and
+     * absent / `false`, the per-trial env is the caller's (`{ ...process.env,
+     * ...arm.env }`) minus the harness's declared session identity, which no child
+     * run inherits in either mode. See `docs/safety.md` (ephemerality) and
      * `research/cross-platform-sandboxing.md`.
      */
     readonly ephemeralEnv?: boolean;
@@ -245,11 +250,13 @@ export interface EvalReport {
  * Resolve the environment a trial's subprocess actually runs with — the
  * SECURITY-CRITICAL decision behind `ephemeralEnv`. When `replaceEnv` is set, the
  * scrubbed `env` is the COMPLETE environment, so the real `$HOME` and inherited
- * secrets are DROPPED; otherwise `env` is an overlay on `base` (byte-identical to
- * the pre-ephemeral behaviour). Extracted from the `v8 ignore`d `spawnAgent` so
- * the one line that enforces the scrub is both unit- and behaviourally-tested — a
- * regression to an always-merge would otherwise silently defeat ephemerality and
- * leak the host environment into an untrusted, model-driven run.
+ * secrets are DROPPED; otherwise `env` is an overlay on `base`. In BOTH, the
+ * harness's declared session identity (`runEnv.sessionIdentity`) is removed: a
+ * run started from inside a live session must not run as that session, scrubbed
+ * or not. Extracted from the `v8 ignore`d `spawnAgent` so the one line that
+ * enforces the scrub is both unit- and behaviourally-tested — a regression to an
+ * always-merge would otherwise silently defeat ephemerality and leak the host
+ * environment into an untrusted, model-driven run.
  */
 export declare function resolveSpawnEnv(a: Pick<AgentRunArgs, "env" | "replaceEnv" | "effort">, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /**
@@ -264,10 +271,10 @@ export declare const EFFORT_ENV_VAR = "CLAUDE_CODE_EFFORT_LEVEL";
  *
  * WHY THIS EXISTS AND WHY IT IS NOT OPTIONAL. Effort has THREE inputs — the
  * `--effort` flag, the `effortLevel` settings key, and `CLAUDE_CODE_EFFORT_LEVEL`
- * — and the env var wins over the flag. `EPHEMERAL_ALLOW_PREFIXES` passes
- * `CLAUDE_*` through by design (the CLI reads several such knobs and dropping one
- * is the failure mode), so an ambient `CLAUDE_CODE_EFFORT_LEVEL=max` in the
- * author's shell survives even the SCRUBBED ephemeral env. Without this pin,
+ * — and the env var wins over the flag. The default (inherited) spawn env
+ * carries the caller's whole environment, so an ambient
+ * `CLAUDE_CODE_EFFORT_LEVEL=max` in the author's shell reaches the run unless
+ * something removes it. Without this pin,
  * hashing effort into the lock would make the lock CONFIDENTLY WRONG: it would
  * record `low` over a run that executed at `max` — the exact defect the feature
  * exists to prevent, reintroduced by the fix for it.
@@ -309,6 +316,22 @@ export declare function withEffortGuard(runner: AgentRunner): AgentRunner;
  * inline there could not be asserted at all. Mirrors `buildCodexArgs`.
  */
 export declare function buildAgentArgs(a: AgentRunArgs): string[];
+/**
+ * Why a run never reached the model, or null when it did. A run that exited
+ * non-zero with no `assistant` event and no `result` event asked the model
+ * nothing — a usage error in the command line, a missing binary — and scored as
+ * a trial it reads as a miss on every check that needs output and a pass on
+ * every bound it cannot break. A run that reached the model and then broke is a
+ * scored outcome, not this. Rate-limited runs are left to the retry loop.
+ */
+export declare function startFailure(out: Readonly<RunOut>): string | null;
+/**
+ * Wrap a runner so a run that never reached the model THROWS instead of being
+ * scored — the same choice, for the same reason, as {@link withEffortGuard}:
+ * the cause is usually deterministic, so every trial would fail it. Not `async`,
+ * for the reason that guard gives.
+ */
+export declare function withStartGuard(runner: AgentRunner): AgentRunner;
 /**
  * The real `claude`-spawning runner (composition root). Exported so other
  * real-model entries (e.g. the `audit` trigger tier) bind the same runner.
@@ -391,7 +414,7 @@ export interface MeasureSpec {
      * the cache, and never read from an env var. Omit for the harness default.
      */
     readonly effort?: string | number;
-    /** Tools the agent may use. */
+    /** Tools pre-approved for the run (`--allowedTools`); `[]` approves none. */
     readonly allowedTools?: readonly string[];
     /** Per-run timeout ms. */
     readonly timeoutMs?: number;
@@ -581,51 +604,48 @@ export declare function modelTier(id: string): number | null;
 export declare function belowModelFloor(model: string, floor: string): boolean;
 /**
  * Build an **ephemeral run environment** for a model-driven run: a NEW env object
- * with a *fresh* `HOME` (and `TMPDIR`) pointed at the throwaway `opts.home`, only
- * an allowlist of auth + runtime vars passed through from `base`, and everything
- * else DROPPED. Pure — no fs, no spawn.
+ * with a *fresh* `HOME` (and `TMPDIR`) pointed at the throwaway `opts.home`, the
+ * OS essentials (`PATH`, `LANG`, `LC_*`, `TERM`), the harness's OWN auth, and
+ * nothing else. Pure — no fs, no spawn.
  *
  * The rationale is "fresh HOME + only the harness credential injected, **not** a
  * blanket wipe": running a model-driven skill/agent is itself a side effect (the
  * *model*, not the author, chose the actions), so it should not be able to read
  * the real `~/.gitconfig` / `~/.ssh` / `~/.aws` or write to the real `~`. But the
- * real `claude` CLI must still AUTHENTICATE, so the harness's own credentials
- * ({@link EPHEMERAL_ALLOW} — `ANTHROPIC_*`, `CLAUDE_*`, locale/PATH) are
- * re-injected; a blanket `--clearenv`-style wipe would break every eval. Because
- * this needs no kernel features, it is the cross-platform STATE-protection floor
- * (lands on macOS immediately), orthogonal to the Linux bubblewrap HOST
- * confinement in `src/sandbox.ts`.
+ * real CLI must still AUTHENTICATE, so the auth names the harness declares
+ * (`runtime.runEnv.keep`) are re-injected, and the parent session's identity
+ * (`runtime.runEnv.sessionIdentity`) never is. Which names those are is the
+ * adapter's fact, not this file's: see `RunEnvPolicy` in `core/runtime.ts`.
+ * Because this needs no kernel features, it is the cross-platform
+ * STATE-protection floor (lands on macOS immediately), orthogonal to the Linux
+ * bubblewrap HOST confinement in `src/sandbox.ts`.
+ *
+ * Notably it does NOT pass through `GIT_*`, `GH_TOKEN`, `SSH_*`, `AWS_*` access
+ * keys, a config-dir override, or any other undeclared variable — those are
+ * exactly what an ephemeral run must not see. A too-narrow `keep` breaks auth
+ * loudly (the run fails to start); a too-broad one leaks silently, which is why
+ * it is an allowlist and not a prefix.
  *
  * @param base  the source environment to filter (usually `process.env`).
  * @param opts.home  the throwaway dir to set as `HOME`/`TMPDIR`.
  * @param opts.allow  extra var NAMES to pass through (e.g. the `VIGILES_*` keys
- *   the eval already injects). Layered ON TOP of the default allowlist.
+ *   the eval already injects). Layered ON TOP of the harness's `keep`; a
+ *   session-identity name is dropped even when listed here.
  */
 export declare function ephemeralRunEnv(base: NodeJS.ProcessEnv | Record<string, string | undefined>, opts: {
     home: string;
     allow?: readonly string[];
 }): Record<string, string>;
-/**
- * Home-relative AUTH files to carry from the real HOME into the throwaway one.
- *
- * A local subscription credential (OAuth token) often lives in a FILE under HOME,
- * not an env var — so scrubbing HOME would lose it and break a local-authed run.
- * This is the file half of the auth allowlist; {@link EPHEMERAL_ALLOW} covers the
- * env-var / host-brokered half. Kept a named constant so it's easy to extend, and
- * deliberately NARROW — only the explicit auth files, never `.gitconfig` / `.ssh`
- * / `.aws`, which are exactly what an ephemeral run must not see.
- */
-export declare const EPHEMERAL_HOME_KEEP: readonly string[];
 /**
  * Seed the throwaway HOME with the harness's own auth FILE(s) — best-effort;
- * covers local file-based OAuth; the env-var/host-brokered path is covered by the
- * allowlist in `ephemeralRunEnv`.
+ * covers local file-based OAuth; the env-var/host-brokered path is covered by
+ * `ephemeralRunEnv`. The files are the runtime's declared `keepHomeFiles`.
  *
- * COPIES (never symlinks) each {@link EPHEMERAL_HOME_KEEP} path from `realHome`
- * into `throwawayHome`, creating parent dirs as needed; a symlink would let the
- * model-driven run write back to the real credential file, defeating ephemerality.
- * A path that doesn't exist in the real HOME is skipped silently (that user auths
- * via env-var / host broker instead). Pure fs — no env, no spawn.
+ * COPIES (never symlinks) each path from `realHome` into `throwawayHome`,
+ * creating parent dirs as needed; a symlink would let the model-driven run write
+ * back to the real credential file, defeating ephemerality. A path that doesn't
+ * exist in the real HOME is skipped silently (that user auths via env-var / host
+ * broker instead). Pure fs — no env, no spawn.
  */
 export declare function seedEphemeralHome(throwawayHome: string, realHome: string, keep?: readonly string[]): void;
 /** Whether a run's captured output looks like a rate-limit / overload. Pure. */
@@ -744,7 +764,10 @@ export interface TriggerRateSpec {
      * false-negative recall. Default `"sonnet"`. Lower it deliberately for a cheap run.
      */
     readonly minModel?: string;
-    /** Tools the agent may use. Default: Read Edit Write Bash Skill. */
+    /**
+     * Tools pre-approved for the run (`--allowedTools`); `[]` approves none.
+     * Default: Read Edit Write Bash Skill.
+     */
     readonly allowedTools?: readonly string[];
     /** Per-run timeout ms. Default 240000. */
     readonly timeoutMs?: number;

package/dist/eval.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.claudeCodeLiveDriver = exports.claudeEvalDriver = exports.EPHEMERAL_HOME_KEEP = exports.spawnAgent = exports.EFFORT_ENV_VAR = void 0;
+exports.claudeCodeLiveDriver = exports.claudeEvalDriver = exports.spawnAgent = exports.EFFORT_ENV_VAR = void 0;
 exports.resolveSpawnEnv = resolveSpawnEnv;
 exports.pinEffortEnv = pinEffortEnv;
 exports.effortRejection = effortRejection;
 exports.withEffortGuard = withEffortGuard;
 exports.buildAgentArgs = buildAgentArgs;
+exports.startFailure = startFailure;
+exports.withStartGuard = withStartGuard;
 exports.unregisteredSkillFiles = unregisteredSkillFiles;
 exports.runEval = runEval;
 exports.measureWith = measureWith;
@@ -74,6 +76,7 @@ const node_path_1 = require("node:path");
 const observe_js_1 = require("./observe.js");
 const plugin_loader_js_1 = require("./adapters/claude-code/plugin-loader.js");
 const runtime_js_1 = require("./adapters/claude-code/runtime.js");
+const run_env_js_1 = require("./core/run-env.js");
 const eval_cost_js_1 = require("./eval-cost.js");
 const proofs_js_1 = require("./core/proofs.js");
 const model_access_js_1 = require("./adapters/claude-code/model-access.js");
@@ -88,6 +91,14 @@ const tool_intercept_js_1 = require("./tool-intercept.js");
 const tool_stub_js_1 = require("./tool-stub.js");
 const tmp_root_js_1 = require("./core/tmp-root.js");
 const edit_distance_js_1 = require("./core/edit-distance.js");
+/**
+ * The harness the eval tier spawns. ONE binding on purpose: the paid tier is
+ * still wired to the Claude Code runner rather than chosen through the adapter's
+ * eval driver (#325), and every fact this file needs about that harness — its
+ * binary, its version key, which env a child may inherit — is read off this
+ * runtime's port fields, never spelled here.
+ */
+const EVAL_RUNTIME = runtime_js_1.claudeCodeRuntime;
 function writeFiles(cwd, files) {
     for (const [p, content] of Object.entries(files)) {
         const full = (0, node_path_1.resolve)(cwd, p);
@@ -99,15 +110,17 @@ function writeFiles(cwd, files) {
  * Resolve the environment a trial's subprocess actually runs with — the
  * SECURITY-CRITICAL decision behind `ephemeralEnv`. When `replaceEnv` is set, the
  * scrubbed `env` is the COMPLETE environment, so the real `$HOME` and inherited
- * secrets are DROPPED; otherwise `env` is an overlay on `base` (byte-identical to
- * the pre-ephemeral behaviour). Extracted from the `v8 ignore`d `spawnAgent` so
- * the one line that enforces the scrub is both unit- and behaviourally-tested — a
- * regression to an always-merge would otherwise silently defeat ephemerality and
- * leak the host environment into an untrusted, model-driven run.
+ * secrets are DROPPED; otherwise `env` is an overlay on `base`. In BOTH, the
+ * harness's declared session identity (`runEnv.sessionIdentity`) is removed: a
+ * run started from inside a live session must not run as that session, scrubbed
+ * or not. Extracted from the `v8 ignore`d `spawnAgent` so the one line that
+ * enforces the scrub is both unit- and behaviourally-tested — a regression to an
+ * always-merge would otherwise silently defeat ephemerality and leak the host
+ * environment into an untrusted, model-driven run.
  */
 function resolveSpawnEnv(a, base = process.env) {
     const resolved = a.replaceEnv ? (a.env ?? {}) : { ...base, ...a.env };
-    return pinEffortEnv(resolved, a.effort);
+    return pinEffortEnv((0, run_env_js_1.withoutSessionIdentity)(resolved, EVAL_RUNTIME.runEnv), a.effort);
 }
 /**
  * The env var name the harness reads for the reasoning budget. It sits ABOVE the
@@ -121,10 +134,10 @@ exports.EFFORT_ENV_VAR = "CLAUDE_CODE_EFFORT_LEVEL";
  *
  * WHY THIS EXISTS AND WHY IT IS NOT OPTIONAL. Effort has THREE inputs — the
  * `--effort` flag, the `effortLevel` settings key, and `CLAUDE_CODE_EFFORT_LEVEL`
- * — and the env var wins over the flag. `EPHEMERAL_ALLOW_PREFIXES` passes
- * `CLAUDE_*` through by design (the CLI reads several such knobs and dropping one
- * is the failure mode), so an ambient `CLAUDE_CODE_EFFORT_LEVEL=max` in the
- * author's shell survives even the SCRUBBED ephemeral env. Without this pin,
+ * — and the env var wins over the flag. The default (inherited) spawn env
+ * carries the caller's whole environment, so an ambient
+ * `CLAUDE_CODE_EFFORT_LEVEL=max` in the author's shell reaches the run unless
+ * something removes it. Without this pin,
  * hashing effort into the lock would make the lock CONFIDENTLY WRONG: it would
  * record `low` over a run that executed at `max` — the exact defect the feature
  * exists to prevent, reintroduced by the fix for it.
@@ -215,10 +228,41 @@ function buildAgentArgs(a) {
             ? ["--plugin-dir", (0, node_path_1.resolve)(a.pluginDir)]
             : []),
         ...(a.hasSettings ? ["--settings", "settings.json"] : []),
-        "--allowedTools",
-        ...a.tools,
+        // A permission allowlist: an empty one approves nothing, so the flag is
+        // left out (a bare `--allowedTools` exits before any model turn).
+        ...(a.tools.length === 0 ? [] : ["--allowedTools", ...a.tools]),
     ];
 }
+/**
+ * Why a run never reached the model, or null when it did. A run that exited
+ * non-zero with no `assistant` event and no `result` event asked the model
+ * nothing — a usage error in the command line, a missing binary — and scored as
+ * a trial it reads as a miss on every check that needs output and a pass on
+ * every bound it cannot break. A run that reached the model and then broke is a
+ * scored outcome, not this. Rate-limited runs are left to the retry loop.
+ */
+function startFailure(out) {
+    if (out.code === 0 || (0, harness_test_js_1.parseResultEvent)(out.stdout) !== null)
+        return null;
+    if ((0, harness_test_js_1.reachedModel)(out.stdout) || isRateLimited(out))
+        return null;
+    const said = (out.stderr ?? "").trim().split("\n").slice(-5).join("\n");
+    return `the harness exited ${String(out.code)} before calling the model: ${said || "(no stderr)"}`;
+}
+/**
+ * Wrap a runner so a run that never reached the model THROWS instead of being
+ * scored — the same choice, for the same reason, as {@link withEffortGuard}:
+ * the cause is usually deterministic, so every trial would fail it. Not `async`,
+ * for the reason that guard gives.
+ */
+function withStartGuard(runner) {
+    return (a) => runner(a).then((out) => {
+        const failure = startFailure(out);
+        if (failure !== null)
+            throw new Error(failure);
+        return out;
+    });
+}
 /**
  * The real `claude`-spawning runner (composition root). Exported so other
  * real-model entries (e.g. the `audit` trigger tier) bind the same runner.
@@ -228,7 +272,7 @@ function buildAgentArgs(a) {
  * not yet written, is covered by construction. Guarding each call site instead is
  * the shape that left four of five compilers unprotected in #173.
  */
-exports.spawnAgent = withEffortGuard(spawnAgentRaw);
+exports.spawnAgent = withEffortGuard(withStartGuard(spawnAgentRaw));
 /* v8 ignore start -- real claude subprocess; exercised by bench/, not the unit gate */
 /** The unguarded spawn itself; wrapped by {@link spawnAgent}, never bound raw. */
 function spawnAgentRaw(a) {
@@ -236,7 +280,7 @@ function spawnAgentRaw(a) {
     (0, foreign_runner_js_1.refuseUnderForeignRunner)("spawning `claude`");
     return new Promise((resolvePromise) => {
         const args = buildAgentArgs(a);
-        const child = (0, node_child_process_1.spawn)(runtime_js_1.claudeCodeRuntime.agentBinary, args, {
+        const child = (0, node_child_process_1.spawn)(EVAL_RUNTIME.agentBinary, args, {
             cwd: a.cwd,
             // The security-critical env resolution (overlay vs. scrubbed replacement)
             // lives in the tested `resolveSpawnEnv` seam above, not inline here.
@@ -572,6 +616,7 @@ function parseClaudeRun(out) {
         toolCalls: (0, harness_test_js_1.parseToolCalls)(out.stdout),
         hooks: (0, harness_test_js_1.parseHooks)(out.stdout),
         subagents: (0, harness_test_js_1.parseSubagents)(out.stdout),
+        replies: (0, harness_test_js_1.parseReplies)(out.stdout),
         usage: usageFrom(result),
     };
 }
@@ -592,6 +637,7 @@ function makeContext(cwd, out, parse = parseClaudeRun) {
         hooks: p.hooks,
         output: p.output,
         subagents: p.subagents,
+        ...(p.replies === undefined ? {} : { replies: p.replies }),
         usage: p.usage,
         // The eval tier drives the real API (no mock between the agent and the model),
         // so the requests can't be captured here — modelRequests is harness-tier only.
@@ -755,7 +801,10 @@ async function runWithCache(runArgs, keyParts, runner, cfg) {
         trialIndex: keyParts.trialIndex,
     });
     const hit = (0, eval_cache_js_1.readCache)(cfg.cacheDir, key);
-    if (hit) {
+    // A run that never reached the model is not replayed: the real runner now
+    // throws on one, and an entry cached before that guard existed would
+    // otherwise be scored as a trial on every later run.
+    if (hit && startFailure(hit.out) === null) {
         (0, eval_cache_js_1.restoreDir)(runArgs.cwd, hit.files);
         return hit.out;
     }
@@ -828,7 +877,7 @@ let cachedHarnessVersion;
 function harnessVersion() {
     if (cachedHarnessVersion === undefined) {
         try {
-            cachedHarnessVersion = runtime_js_1.claudeCodeRuntime.versionKey((0, node_child_process_1.execSync)(`${runtime_js_1.claudeCodeRuntime.agentBinary} --version`, {
+            cachedHarnessVersion = EVAL_RUNTIME.versionKey((0, node_child_process_1.execSync)(`${EVAL_RUNTIME.agentBinary} --version`, {
                 encoding: "utf-8",
                 stdio: ["ignore", "pipe", "ignore"],
             }));
@@ -875,132 +924,68 @@ function withInterceptToolHook(settings, intercepts) {
         },
     };
 }
-/**
- * The default allowlist `ephemeralRunEnv` passes through from the real
- * environment. Two groups, both load-bearing for a real-model `claude` run:
- *
- * - **Auth** — the harness's OWN credentials. The eval drives the real `claude`
- *   CLI, which authenticates via the user's subscription (`~/.claude`, reached
- *   through the fresh HOME's allowed config — see below) OR via these env vars.
- *   We mirror the auth surface the runtime port already names
- *   (`ANTHROPIC_API_KEY` / `ANTHROPIC_BASE_URL`, see
- *   `adapters/claude-code/runtime.ts`) plus the OAuth/token + region variants the
- *   CLI accepts, so a token-authed user is not broken by a too-narrow list.
- * - **Runtime** — what any spawned process needs to *function*: `PATH` (resolve
- *   `node` / `claude`), the locale/terminal vars (`LANG` / `LC_*` / `TERM`), and
- *   `TMPDIR` (which we override to the fresh HOME). Mirrors what `bwrapArgs` /
- *   `setenvArgs` in `src/sandbox.ts` set back after `--clearenv`.
- *
- * Notably it does NOT pass through `GIT_*`, `GH_TOKEN`, `SSH_*`, `AWS_*`, or any
- * other non-allowlisted secret-shaped var — those are exactly what an ephemeral
- * run must not see. `CLAUDE_*` is allowlisted by prefix because the CLI reads
- * several `CLAUDE_*` knobs (config dir, etc.) and omitting one is the failure
- * mode this whole guard is conservative against.
- *
- * Conservative by design: a too-broad allowlist is safe (it just leaks a benign
- * var); a too-narrow one silently breaks auth — which is why the feature ships
- * default-OFF until validated against a real run.
- */
-const EPHEMERAL_ALLOW = [
-    // Runtime essentials (mirror sandbox.ts setenv-after-clearenv).
-    "PATH",
-    "LANG",
-    "TERM",
-    // Anthropic / Claude Code auth + endpoint (mirror runtime.ts + CLI auth vars).
-    runtime_js_1.claudeCodeRuntime.modelApiKeyEnv, // ANTHROPIC_API_KEY
-    runtime_js_1.claudeCodeRuntime.modelBaseUrlEnv, // ANTHROPIC_BASE_URL
-    "ANTHROPIC_AUTH_TOKEN",
-    "ANTHROPIC_API_URL",
-    "ANTHROPIC_MODEL",
-    "ANTHROPIC_DEFAULT_HEADERS",
-    "CLAUDE_CODE_USE_BEDROCK",
-    "CLAUDE_CODE_USE_VERTEX",
-    // Cloud-provider auth the CLI uses for Bedrock/Vertex backends (region/profile
-    // only — NOT the secret-shaped AWS_* access keys, which stay dropped).
-    "AWS_REGION",
-    "AWS_DEFAULT_REGION",
-    "AWS_PROFILE",
-    "CLOUD_ML_REGION",
-    "GOOGLE_CLOUD_PROJECT",
-    "GOOGLE_APPLICATION_CREDENTIALS",
-];
-/** Prefixes passed through wholesale — the CLI reads several `CLAUDE_*` knobs and
- *  a `LC_*` locale family; allowlist by prefix so omitting one isn't the silent
- *  auth/locale break this guard exists to avoid. */
-const EPHEMERAL_ALLOW_PREFIXES = ["CLAUDE_", "LC_"];
 /**
  * Build an **ephemeral run environment** for a model-driven run: a NEW env object
- * with a *fresh* `HOME` (and `TMPDIR`) pointed at the throwaway `opts.home`, only
- * an allowlist of auth + runtime vars passed through from `base`, and everything
- * else DROPPED. Pure — no fs, no spawn.
+ * with a *fresh* `HOME` (and `TMPDIR`) pointed at the throwaway `opts.home`, the
+ * OS essentials (`PATH`, `LANG`, `LC_*`, `TERM`), the harness's OWN auth, and
+ * nothing else. Pure — no fs, no spawn.
  *
  * The rationale is "fresh HOME + only the harness credential injected, **not** a
  * blanket wipe": running a model-driven skill/agent is itself a side effect (the
  * *model*, not the author, chose the actions), so it should not be able to read
  * the real `~/.gitconfig` / `~/.ssh` / `~/.aws` or write to the real `~`. But the
- * real `claude` CLI must still AUTHENTICATE, so the harness's own credentials
- * ({@link EPHEMERAL_ALLOW} — `ANTHROPIC_*`, `CLAUDE_*`, locale/PATH) are
- * re-injected; a blanket `--clearenv`-style wipe would break every eval. Because
- * this needs no kernel features, it is the cross-platform STATE-protection floor
- * (lands on macOS immediately), orthogonal to the Linux bubblewrap HOST
- * confinement in `src/sandbox.ts`.
+ * real CLI must still AUTHENTICATE, so the auth names the harness declares
+ * (`runtime.runEnv.keep`) are re-injected, and the parent session's identity
+ * (`runtime.runEnv.sessionIdentity`) never is. Which names those are is the
+ * adapter's fact, not this file's: see `RunEnvPolicy` in `core/runtime.ts`.
+ * Because this needs no kernel features, it is the cross-platform
+ * STATE-protection floor (lands on macOS immediately), orthogonal to the Linux
+ * bubblewrap HOST confinement in `src/sandbox.ts`.
+ *
+ * Notably it does NOT pass through `GIT_*`, `GH_TOKEN`, `SSH_*`, `AWS_*` access
+ * keys, a config-dir override, or any other undeclared variable — those are
+ * exactly what an ephemeral run must not see. A too-narrow `keep` breaks auth
+ * loudly (the run fails to start); a too-broad one leaks silently, which is why
+ * it is an allowlist and not a prefix.
  *
  * @param base  the source environment to filter (usually `process.env`).
  * @param opts.home  the throwaway dir to set as `HOME`/`TMPDIR`.
  * @param opts.allow  extra var NAMES to pass through (e.g. the `VIGILES_*` keys
- *   the eval already injects). Layered ON TOP of the default allowlist.
+ *   the eval already injects). Layered ON TOP of the harness's `keep`; a
+ *   session-identity name is dropped even when listed here.
  */
 function ephemeralRunEnv(base, opts) {
-    const out = {};
-    const allowExact = new Set([
-        ...EPHEMERAL_ALLOW,
-        ...(opts.allow ?? []),
-    ]);
-    for (const [k, v] of Object.entries(base)) {
-        if (v === undefined)
-            continue;
-        const allowed = allowExact.has(k) ||
-            EPHEMERAL_ALLOW_PREFIXES.some((p) => k.startsWith(p));
-        if (allowed)
-            out[k] = v;
-    }
-    // Fresh HOME + TMPDIR last so they always win over anything passed through.
-    out.HOME = opts.home;
-    out.TMPDIR = opts.home;
-    return out;
+    // A fresh object: the trial layers its overlay and stub PATH onto it.
+    return {
+        ...(0, run_env_js_1.scrubbedRunEnv)(base, {
+            home: opts.home,
+            policy: EVAL_RUNTIME.runEnv,
+            allow: opts.allow,
+        }),
+    };
 }
-/**
- * Home-relative AUTH files to carry from the real HOME into the throwaway one.
- *
- * A local subscription credential (OAuth token) often lives in a FILE under HOME,
- * not an env var — so scrubbing HOME would lose it and break a local-authed run.
- * This is the file half of the auth allowlist; {@link EPHEMERAL_ALLOW} covers the
- * env-var / host-brokered half. Kept a named constant so it's easy to extend, and
- * deliberately NARROW — only the explicit auth files, never `.gitconfig` / `.ssh`
- * / `.aws`, which are exactly what an ephemeral run must not see.
- */
-exports.EPHEMERAL_HOME_KEEP = [
-    ".claude/.credentials.json", // the Claude Code OAuth token
-];
 /**
  * Seed the throwaway HOME with the harness's own auth FILE(s) — best-effort;
- * covers local file-based OAuth; the env-var/host-brokered path is covered by the
- * allowlist in `ephemeralRunEnv`.
+ * covers local file-based OAuth; the env-var/host-brokered path is covered by
+ * `ephemeralRunEnv`. The files are the runtime's declared `keepHomeFiles`.
  *
- * COPIES (never symlinks) each {@link EPHEMERAL_HOME_KEEP} path from `realHome`
- * into `throwawayHome`, creating parent dirs as needed; a symlink would let the
- * model-driven run write back to the real credential file, defeating ephemerality.
- * A path that doesn't exist in the real HOME is skipped silently (that user auths
- * via env-var / host broker instead). Pure fs — no env, no spawn.
+ * COPIES (never symlinks) each path from `realHome` into `throwawayHome`,
+ * creating parent dirs as needed; a symlink would let the model-driven run write
+ * back to the real credential file, defeating ephemerality. A path that doesn't
+ * exist in the real HOME is skipped silently (that user auths via env-var / host
+ * broker instead). Pure fs — no env, no spawn.
  */
-function seedEphemeralHome(throwawayHome, realHome, keep = exports.EPHEMERAL_HOME_KEEP) {
+function seedEphemeralHome(throwawayHome, realHome, keep = EVAL_RUNTIME.runEnv?.keepHomeFiles ?? []) {
     for (const rel of keep) {
         const src = (0, node_path_1.join)(realHome, rel);
         if (!(0, node_fs_1.existsSync)(src))
             continue; // env-var / host-brokered auth covers this.
         const dest = (0, node_path_1.join)(throwawayHome, rel);
         (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(dest), { recursive: true });
-        (0, node_fs_1.cpSync)(src, dest); // copy, not symlink — keep the real credential read-only.
+        // The DATA, never a link: `cpSync` recreates a symlinked credential
+        // (dotfiles, a secret manager) as a link, and the run would write through
+        // it into the real file. `copyFileSync` always copies the contents.
+        (0, node_fs_1.copyFileSync)(src, dest);
     }
 }
 /** Execute one trial in a fresh sandbox; returns its metric row + usage. */
@@ -1122,14 +1107,25 @@ async function runWithRetry(runArgs, runner, retries, baseMs) {
 /** Map `worker` over `items` with at most `concurrency` in flight, order preserved. */
 async function runPool(items, concurrency, worker) {
     const results = new Array(items.length);
+    // A worker that throws rejects the whole pool; the others must stop taking
+    // items then, or they keep starting (and paying for) work nobody will read.
+    const stop = new AbortController();
     let next = 0;
     const drain = async () => {
         for (;;) {
+            if (stop.signal.aborted)
+                return;
             const i = next++;
             const item = items[i];
             if (i >= items.length || item === undefined)
                 return;
-            results[i] = await worker(item);
+            try {
+                results[i] = await worker(item);
+            }
+            catch (e) {
+                stop.abort();
+                throw e;
+            }
         }
     };
     const workers = Math.max(1, Math.min(concurrency, items.length || 1));