Clone if missing, fetch if present. Partial clone (blobless) for speed.

Print a one-line summary of an assistant message to stderr. Tool calls show name + key arg; text shows a truncated preview.

Build once, optionally recon, then dispatch N find+grade cycles.

One find(+grade) attempt. Assumes image is already built. Writes result.json to out_dir before returning — stragglers no longer block disk wr

Write an exploitability report for one crash. If re_report, preserve the existing report as report_v1.json and run a compare agent after the n

SIGKILL all direct children. The SDK's claude subprocess (Node) does not die when we do — it gets orphaned to init and keeps executing Bash tool

Env to set on the agent container at ``docker run`` time. Auth credentials (``ANTHROPIC_API_KEY`` or ``CLAUDE_CODE_OAUTH_TOKEN``) pass straig

LLM-score the five analysis sections + escalation bonus, extract tokens. Fresh container — the grader must not see any state the report-agent

Pick the canonical report after a DUP_BETTER re-report. Returns (winner, reasoning, agent_result, elapsed). winner is "A" or "B"; defaults to

Verify a CrashArtifact in a fresh container. workspace_dir: host-side results dir where we also persist poc.bin so it survives the container

Decide whether a freshly-graded crash warrants a report. Returns (verdict, agent_result, elapsed). If the agent emits no parseable judgment,

Best-effort container cleanup on SIGTERM/SIGINT. find.py/grade.py/recon.py have finally: blocks that rm their containers, but finally only ru

Spawn the per-phase agent container and tear it down on exit. All find/grade/report/recon/judge agents go through this so the "every agent ru

Build a docker image from a directory containing a Dockerfile.

Snapshot a container's filesystem as a new image. Used by re-attack to run a find-agent against the patched binary without rebuilding.

Build (if missing) and return the agent-image tag for ``target_tag``.

Run a shell command inside a container and return (rc, stdout, stderr). Unlike read_file/write_file this passes the command through sh -c so shel

Check whether an image tag exists locally.

Permission mode for in-container ``claude -p`` sessions. With gVisor + the egress allowlist, the container is the boundary and the auto-mode

Read a file from inside a container. Returns b'' if the file doesn't exist — that's the detection for "agent narrated a PoC path it never wrote".

Return an error message if the sandbox isn't configured; else None.

Remove a container, force-killing if running. Idempotent.

Remove an image tag. Idempotent.

Start a container, detached, interactive. Cleans up any existing container with the same name first (clean slate). ``runtime`` selects an OCI

find/patch prompts list ``xxd`` and ``gdb`` as available; they aren't in ``gcc:14`` and the agent image only inherits ``/work`` from the target

No override → the sandbox default (vp-internal under gVisor, bridge without).

``network="none"`` pins the T0–T2 patch grader to no egress regardless of sandbox mode — it never runs ``claude -p``.

Re-attack commits ``<name>:patched-<uuid>``; it must not collide with the original target's agent image.

Check 4: agent_image.ensure() produced a working CLI layer.

Symptom-only fix (guards memcpy with too-loose bound) passes T1 for the specific PoC but is wrong — re-attack would catch it (mocked unit test