@lucid-agents/taskmarket 1.17.2 → 1.18.0

package/dist/chunk-L6ZVRENW.js

@@ -0,0 +1,868 @@
+import { createRequire as __tmCreateRequire } from 'node:module'; import { fileURLToPath as __tmFileURLToPath } from 'node:url'; import { dirname as __tmDirname } from 'node:path'; const require = __tmCreateRequire(import.meta.url); const __tmFilename = __tmFileURLToPath(import.meta.url); const __tmDirnameValue = __tmDirname(__tmFilename);
+import {
+  SandboxUnavailableError,
+  holderAlive,
+  isHostConfig,
+  isSecretLike,
+  pathMatcher,
+  unsafeHostPath,
+  withFileLock,
+  writeAtomic
+} from "./chunk-64HQ7ZF2.js";
+import {
+  buyComputeCredit,
+  fetchComputePricing,
+  listPendingComputePurchases,
+  loadComputeCreditConfig,
+  onComputeBalanceObserved,
+  readComputeCreditStatus
+} from "./chunk-W7CXEYST.js";
+import {
+  getTaskmarketHome
+} from "./chunk-75LS6XS6.js";
+import {
+  burnRate,
+  computeLow
+} from "./chunk-EB6OJBF5.js";
+import {
+  AgentLaunchError
+} from "./chunk-YM4S6IE4.js";
+
+// src/lib/agent/active-task.ts
+import { createHash } from "crypto";
+import { promises as fs } from "fs";
+import path from "path";
+var ACTIVE_TASK_VERSION = 1;
+function taskStage(record) {
+  if (record.state !== "claimed") return record.state;
+  if (record.deliverable) return "frozen";
+  return record.workspace?.state === "ready" ? "working" : "claimed";
+}
+function occupiesSlot(record) {
+  return !!record && record.state !== "submitted" && record.state !== "stopped";
+}
+function fileFor(wallet, chainId, home) {
+  const key = createHash("sha256").update(`${wallet.toLowerCase()}:${chainId}`).digest("hex").slice(0, 32);
+  return path.join(home, "agent", "active-task", `${key}.json`);
+}
+function parse(raw, wallet, chainId) {
+  const record = JSON.parse(raw);
+  if (record?.version !== ACTIVE_TASK_VERSION || typeof record.taskId !== "string" || typeof record.state !== "string" || record.chainId !== chainId || typeof record.wallet !== "string" || record.wallet.toLowerCase() !== wallet.toLowerCase()) {
+    throw new Error("The active task record is not one this version can read");
+  }
+  return record;
+}
+function fileActiveTaskStore(wallet, chainId, home = getTaskmarketHome()) {
+  const file = fileFor(wallet, chainId, home);
+  const load = async () => {
+    let raw;
+    try {
+      raw = await fs.readFile(file, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+    return parse(raw, wallet, chainId);
+  };
+  return {
+    load,
+    update: (change) => withFileLock(`${file}.lock`, "The active task record", async () => {
+      const { next, value } = await change(await load());
+      if (next) await writeAtomic(file, `${JSON.stringify(next, null, 2)}
+`);
+      return value;
+    })
+  };
+}
+
+// src/lib/agent/deliverable-store.ts
+import { promises as fs2 } from "fs";
+import path3 from "path";
+import { randomBytes } from "crypto";
+import { keccak256 } from "viem";
+
+// src/lib/agent/deliverable-check.ts
+import { createHash as createHash2 } from "crypto";
+import path2 from "path";
+var ARTIFACT_ROLES = ["preview", "source", "final", "attachment"];
+var TEST_OUTPUT_NAME = "taskmarket-test-output.txt";
+var DELIVERABLE_HARD_LIMITS = Object.freeze({
+  maxArtifacts: 19,
+  maxFileBytes: 16 * 1024 * 1024,
+  maxTotalBytes: 64 * 1024 * 1024,
+  maxReportBytes: 1024 * 1024,
+  maxTestOutputBytes: 1024 * 1024,
+  maxAttempts: 10,
+  maxValidators: 8,
+  maxValidatorSeconds: 1800,
+  maxBaselineFiles: 2e3
+});
+var DEFAULT_DELIVERABLE_LIMITS = Object.freeze({
+  maxArtifacts: 10,
+  maxFileBytes: 8 * 1024 * 1024,
+  maxTotalBytes: 32 * 1024 * 1024,
+  maxReportBytes: 256 * 1024,
+  maxTestOutputBytes: 64 * 1024
+});
+var DeliverableSpecError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DeliverableSpecError";
+  }
+};
+var HEX_COMMIT = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var TASK_ID = /^0x[0-9a-fA-F]{1,64}$/;
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function sha256Hex(data) {
+  return createHash2("sha256").update(data).digest("hex");
+}
+function specHash(spec) {
+  return sha256Hex(canonicalJson(spec));
+}
+function relativePathProblem(rel) {
+  if (typeof rel !== "string" || rel.length === 0) return "empty path";
+  if (rel.length > 1024) return "path longer than 1024 characters";
+  if (rel.includes("\\")) return "backslash in path";
+  if (/[\n\r\t]/.test(rel)) return "control character in path";
+  const unsafe = unsafeHostPath(rel, "linux") ?? unsafeHostPath(rel);
+  if (unsafe) return unsafe;
+  return void 0;
+}
+function effectiveLimits(spec) {
+  const limits = { ...DEFAULT_DELIVERABLE_LIMITS, ...spec.limits };
+  return {
+    maxArtifacts: Math.min(limits.maxArtifacts, DELIVERABLE_HARD_LIMITS.maxArtifacts),
+    maxFileBytes: Math.min(limits.maxFileBytes, DELIVERABLE_HARD_LIMITS.maxFileBytes),
+    maxTotalBytes: Math.min(limits.maxTotalBytes, DELIVERABLE_HARD_LIMITS.maxTotalBytes),
+    maxReportBytes: Math.min(limits.maxReportBytes, DELIVERABLE_HARD_LIMITS.maxReportBytes),
+    maxTestOutputBytes: Math.min(
+      limits.maxTestOutputBytes,
+      DELIVERABLE_HARD_LIMITS.maxTestOutputBytes
+    )
+  };
+}
+var positiveInt = (n, max) => typeof n === "number" && Number.isInteger(n) && n >= 1 && n <= max;
+function assertDeliverableSpec(spec, sandboxRoot) {
+  const fail = (message) => {
+    throw new DeliverableSpecError(`Invalid deliverable spec: ${message}`);
+  };
+  if (spec?.version !== 1 || spec.vertical !== "coding") fail("unsupported version or vertical");
+  if (!TASK_ID.test(spec.taskId ?? "")) fail("taskId must be 0x-prefixed hex");
+  const ws = spec.workspace;
+  if (typeof ws !== "string" || !path2.posix.isAbsolute(ws) || path2.posix.normalize(ws) !== ws || !ws.startsWith(`${sandboxRoot}/`) || /[\n\r\0]/.test(ws)) {
+    fail(`workspace must be a normalized absolute path inside ${sandboxRoot}`);
+  }
+  if (!HEX_COMMIT.test(spec.baseline?.commit ?? ""))
+    fail("baseline.commit must be a git commit id");
+  const files = spec.baseline.files;
+  if (!Array.isArray(files) || files.length === 0)
+    fail("baseline.files must list the original files");
+  if (files.length > DELIVERABLE_HARD_LIMITS.maxBaselineFiles) fail("too many baseline files");
+  const seen = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    const problem = relativePathProblem(file?.path);
+    if (problem) fail(`baseline file ${file?.path}: ${problem}`);
+    if (!SHA256_HEX.test(file.sha256 ?? "")) fail(`baseline file ${file.path}: sha256 must be hex`);
+    if (seen.has(file.path)) fail(`baseline file ${file.path} listed twice`);
+    seen.add(file.path);
+  }
+  for (const [label, entry] of [
+    ["patch", spec.patch],
+    ["report", spec.report]
+  ]) {
+    const problem = relativePathProblem(entry?.path);
+    if (problem) fail(`${label}.path: ${problem}`);
+    if (!ARTIFACT_ROLES.includes(entry.role)) fail(`${label}.role is not an artifact role`);
+  }
+  if (spec.patch.path === spec.report.path) fail("patch and report must be different files");
+  for (const name of [spec.patch.path, spec.report.path]) {
+    if (path2.posix.basename(name) === TEST_OUTPUT_NAME) fail(`${TEST_OUTPUT_NAME} is reserved`);
+  }
+  if (spec.patch.mayChange !== void 0) {
+    if (!Array.isArray(spec.patch.mayChange) || spec.patch.mayChange.length === 0) {
+      fail("patch.mayChange, when given, must name at least one pattern");
+    }
+  }
+  const validators = spec.validators;
+  if (!Array.isArray(validators) || validators.length === 0) fail("at least one validator");
+  if (validators.length > DELIVERABLE_HARD_LIMITS.maxValidators) fail("too many validators");
+  for (const v of validators) {
+    if (typeof v?.name !== "string" || !/^[\w .:/-]{1,64}$/.test(v.name)) {
+      fail("validator names are 1-64 plain characters");
+    }
+    if (typeof v.command !== "string" || v.command.trim() === "" || v.command.length > 4096) {
+      fail(`validator ${v.name}: command must be 1-4096 characters`);
+    }
+    if (v.command.includes("\0")) fail(`validator ${v.name}: NUL in command`);
+    if (!positiveInt(v.timeoutSeconds, DELIVERABLE_HARD_LIMITS.maxValidatorSeconds)) {
+      fail(`validator ${v.name}: timeoutSeconds must be 1-1800`);
+    }
+  }
+  if (!positiveInt(spec.maxAttempts, DELIVERABLE_HARD_LIMITS.maxAttempts)) {
+    fail("maxAttempts must be 1-10");
+  }
+  if (!Number.isFinite(Date.parse(spec.deadline))) fail("deadline must be an ISO date");
+  for (const [key, value] of Object.entries(spec.limits ?? {})) {
+    if (!(key in DEFAULT_DELIVERABLE_LIMITS)) fail(`unknown limit ${key}`);
+    if (!positiveInt(value, Number.MAX_SAFE_INTEGER))
+      fail(`limit ${key} must be a positive integer`);
+  }
+}
+function checkManifest(proposal, spec, limits = effectiveLimits(spec)) {
+  const problems = [];
+  const list = proposal && typeof proposal === "object" && "artifacts" in proposal ? proposal.artifacts : void 0;
+  if (!Array.isArray(list) || list.length === 0) {
+    return {
+      artifacts: [],
+      problems: [
+        {
+          code: "manifest_invalid",
+          detail: `the manifest must be { "artifacts": [{ "path": "...", "role": "..." }] } and list at least ${spec.patch.path} and ${spec.report.path}`
+        }
+      ]
+    };
+  }
+  if (list.length > limits.maxArtifacts) {
+    problems.push({
+      code: "too_many_artifacts",
+      detail: `${list.length} files proposed; at most ${limits.maxArtifacts}`
+    });
+    return { artifacts: [], problems };
+  }
+  const artifacts = [];
+  const names = /* @__PURE__ */ new Map();
+  for (const raw of list) {
+    const entry = raw;
+    const rel = typeof entry?.path === "string" ? entry.path.replace(/^\.\//, "") : void 0;
+    if (rel === void 0) {
+      problems.push({ code: "manifest_invalid", detail: "every artifact needs a string path" });
+      continue;
+    }
+    const pathProblem = relativePathProblem(rel);
+    if (pathProblem) {
+      problems.push({ code: "path_invalid", path: rel, detail: pathProblem });
+      continue;
+    }
+    if (isHostConfig(rel)) {
+      problems.push({
+        code: "path_host_config",
+        path: rel,
+        detail: "host configuration is never delivered"
+      });
+      continue;
+    }
+    if (isSecretLike(rel)) {
+      problems.push({
+        code: "path_secret",
+        path: rel,
+        detail: "secret-like files are never delivered"
+      });
+      continue;
+    }
+    const expected = rel === spec.patch.path ? spec.patch.role : rel === spec.report.path ? spec.report.role : void 0;
+    const role = entry.role === void 0 ? expected ?? "attachment" : entry.role;
+    if (!ARTIFACT_ROLES.includes(role)) {
+      problems.push({
+        code: "manifest_invalid",
+        path: rel,
+        detail: `role must be one of ${ARTIFACT_ROLES.join(", ")}`
+      });
+      continue;
+    }
+    if (expected && role !== expected) {
+      problems.push({
+        code: "role_mismatch",
+        path: rel,
+        detail: `this file is delivered with role ${expected}`
+      });
+      continue;
+    }
+    const name = path2.posix.basename(rel);
+    if (name.toLowerCase() === TEST_OUTPUT_NAME) {
+      problems.push({
+        code: "reserved_name",
+        path: rel,
+        detail: `${TEST_OUTPUT_NAME} is written by the controller from the validators it runs; it cannot be supplied`
+      });
+      continue;
+    }
+    const other = names.get(name.toLowerCase());
+    if (other !== void 0) {
+      problems.push({
+        code: "duplicate_name",
+        path: rel,
+        detail: other === rel ? "listed twice" : `same file name as ${other}`
+      });
+      continue;
+    }
+    names.set(name.toLowerCase(), rel);
+    artifacts.push({ path: rel, role });
+  }
+  for (const required of [spec.patch.path, spec.report.path]) {
+    if (!artifacts.some((a) => a.path === required) && !problems.some((p) => p.path === required)) {
+      problems.push({
+        code: "missing_artifact",
+        path: required,
+        detail: "required by the task and not in the manifest"
+      });
+    }
+  }
+  return { artifacts, problems };
+}
+var HEADER_LINE = /^(old mode|new mode|deleted file mode|new file mode|similarity index|dissimilarity index|rename from|rename to|copy from|copy to|index) (.*)$/;
+var HUNK = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
+function stripPrefix(name, prefix) {
+  if (name === "/dev/null") return void 0;
+  if (name.startsWith('"')) throw new Error(`quoted path ${name} (use plain ASCII file names)`);
+  if (name.includes("	")) throw new Error(`tab in path ${name}`);
+  if (!name.startsWith(prefix)) throw new Error(`path ${name} does not start with ${prefix}`);
+  return name.slice(prefix.length);
+}
+function parseGitPatch(text) {
+  const lines = text.split("\n");
+  if (lines[lines.length - 1] === "") lines.pop();
+  const files = [];
+  let i = 0;
+  try {
+    if (lines.length === 0) throw new Error("the patch is empty");
+    while (i < lines.length) {
+      const line = lines[i];
+      if (!line.startsWith("diff --git ")) {
+        throw new Error(
+          `line ${i + 1} is outside any file section (a git patch starts each file with "diff --git"): ${line.slice(0, 80)}`
+        );
+      }
+      const names = line.slice("diff --git ".length);
+      if (names.includes('"'))
+        throw new Error(`quoted path on line ${i + 1} (use plain ASCII file names)`);
+      const file = { modes: [], binary: false };
+      const fromHeader = {};
+      i++;
+      while (i < lines.length) {
+        const header = HEADER_LINE.exec(lines[i]);
+        if (!header) break;
+        const [, key, value] = header;
+        if (key === "new file mode" || key === "new mode") file.modes.push(value);
+        if (key === "rename from" || key === "copy from") fromHeader.renameFrom = value;
+        if (key === "rename to" || key === "copy to") fromHeader.renameTo = value;
+        i++;
+      }
+      let sawPaths = false;
+      if (lines[i]?.startsWith("Binary files ")) {
+        file.binary = true;
+        i++;
+      } else if (lines[i] === "GIT binary patch") {
+        file.binary = true;
+        i++;
+        while (i < lines.length && !lines[i].startsWith("diff --git ")) i++;
+      } else if (lines[i]?.startsWith("--- ")) {
+        file.oldPath = stripPrefix(lines[i].slice(4), "a/");
+        if (!lines[i + 1]?.startsWith("+++ "))
+          throw new Error(`line ${i + 2} must be the "+++" line`);
+        file.newPath = stripPrefix(lines[i + 1].slice(4), "b/");
+        sawPaths = true;
+        i += 2;
+        if (!HUNK.test(lines[i] ?? "")) throw new Error(`line ${i + 1} must start a hunk ("@@")`);
+        while (i < lines.length && HUNK.test(lines[i])) {
+          const [, , oldCount, , newCount] = HUNK.exec(lines[i]);
+          let left = Number(oldCount ?? "1");
+          let right = Number(newCount ?? "1");
+          i++;
+          while (left > 0 || right > 0) {
+            const body = lines[i];
+            if (body === void 0) throw new Error("the patch ends inside a hunk");
+            const mark = body[0];
+            if (mark === " " || body === "") {
+              left--;
+              right--;
+            } else if (mark === "-") left--;
+            else if (mark === "+") right--;
+            else if (mark !== "\\") {
+              throw new Error(
+                `line ${i + 1} is not a hunk line; the hunk header's counts are wrong`
+              );
+            }
+            if (left < 0 || right < 0)
+              throw new Error(`the hunk before line ${i + 2} is longer than its header says`);
+            i++;
+          }
+          if (lines[i]?.startsWith("\\")) i++;
+        }
+      }
+      if (fromHeader.renameFrom !== void 0 || fromHeader.renameTo !== void 0) {
+        if (fromHeader.renameFrom === void 0 || fromHeader.renameTo === void 0) {
+          throw new Error("a rename or copy needs both its from and to lines");
+        }
+        if (fromHeader.renameFrom.startsWith('"') || fromHeader.renameTo.startsWith('"')) {
+          throw new Error("quoted path in a rename (use plain ASCII file names)");
+        }
+        file.oldPath = fromHeader.renameFrom;
+        file.newPath = fromHeader.renameTo;
+      } else if (!sawPaths) {
+        const half = (names.length - 5) / 2;
+        const name = Number.isInteger(half) ? names.slice(2, 2 + half) : "";
+        if (!name || names !== `a/${name} b/${name}`) {
+          throw new Error(`cannot read the file names on "${line.slice(0, 120)}"`);
+        }
+        file.oldPath = name;
+        file.newPath = name;
+      }
+      files.push(file);
+    }
+  } catch (error) {
+    return { valid: false, detail: error.message };
+  }
+  return { valid: true, files };
+}
+var PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
+function holdsPrivateKey(data) {
+  return PRIVATE_KEY.test(data.toString("latin1"));
+}
+function checkPatchContent(data, spec) {
+  const rel = spec.patch.path;
+  const parsed = parseGitPatch(data.toString("utf8"));
+  if (!parsed.valid) {
+    return [
+      {
+        code: "patch_format",
+        path: rel,
+        detail: `${parsed.detail}. Produce it with git diff against the baseline commit ${spec.baseline.commit.slice(0, 12)}, e.g. git diff ${spec.baseline.commit.slice(0, 12)} -- <files> > ${rel}`
+      }
+    ];
+  }
+  if (parsed.files.length === 0) {
+    return [{ code: "patch_empty", path: rel, detail: "the patch changes nothing" }];
+  }
+  const problems = [];
+  const allowed = spec.patch.mayChange ? pathMatcher(spec.patch.mayChange) : void 0;
+  const touched = /* @__PURE__ */ new Set();
+  for (const file of parsed.files) {
+    for (const mode of file.modes) {
+      if (mode === "120000" || mode === "160000") {
+        problems.push({
+          code: "patch_mode",
+          path: rel,
+          detail: `the patch creates a ${mode === "120000" ? "symlink" : "submodule"} at ${file.newPath}`
+        });
+      }
+    }
+    for (const name of [file.oldPath, file.newPath]) if (name !== void 0) touched.add(name);
+  }
+  for (const name of [...touched].sort()) {
+    const problem = relativePathProblem(name);
+    const why = problem ? problem : isHostConfig(name) ? "host configuration" : isSecretLike(name) ? "a secret-like file" : allowed && !allowed(name) ? `outside what the task lets it change (${spec.patch.mayChange.join(", ")})` : void 0;
+    if (why)
+      problems.push({ code: "patch_path", path: rel, detail: `the patch changes ${name}: ${why}` });
+  }
+  return problems;
+}
+function checkReportContent(data, spec, limits) {
+  const rel = spec.report.path;
+  if (data.length > limits.maxReportBytes) {
+    return [
+      {
+        code: "report_too_large",
+        path: rel,
+        detail: `${data.length} bytes; at most ${limits.maxReportBytes}`
+      }
+    ];
+  }
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(data);
+  } catch {
+    return [{ code: "report_not_text", path: rel, detail: "the report must be UTF-8 text" }];
+  }
+  if (text.trim() === "") return [{ code: "empty", path: rel, detail: "the report is blank" }];
+  return [];
+}
+
+// src/lib/agent/deliverable-store.ts
+var DELIVERABLE_RECORD_VERSION = 1;
+var MAX_INTERRUPTED_ATTEMPTS = 3;
+var MAX_RECORDED_PROBLEMS = 50;
+var DeliverableError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "DeliverableError";
+  }
+};
+var DeliverableTamperedError = class extends DeliverableError {
+  constructor(detail) {
+    super(
+      "deliverable_tampered",
+      `The frozen deliverable was changed after it was frozen: ${detail}`
+    );
+    this.name = "DeliverableTamperedError";
+  }
+};
+var normalTaskId = (taskId) => taskId.toLowerCase();
+function deliverableDir(taskId, home = getTaskmarketHome()) {
+  const key = sha256Hex(normalTaskId(taskId)).slice(0, 32);
+  return path3.join(home, "agent", "tasks", key);
+}
+var recordFile = (taskId) => path3.join(deliverableDir(taskId), "deliverable.json");
+async function loadDeliverableRecord(taskId) {
+  let raw;
+  try {
+    raw = await fs2.readFile(recordFile(taskId), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new DeliverableTamperedError(`${recordFile(taskId)} is not readable JSON`);
+  }
+  if (parsed?.version !== DELIVERABLE_RECORD_VERSION || parsed.taskId !== normalTaskId(taskId) || !Array.isArray(parsed.attempts)) {
+    throw new DeliverableTamperedError(`${recordFile(taskId)} is not this task's record`);
+  }
+  return parsed;
+}
+async function withRecordLock(taskId, work) {
+  return withFileLock(
+    path3.join(deliverableDir(taskId), "deliverable.lock"),
+    "the task deliverable record",
+    work
+  );
+}
+async function updateDeliverableRecord(taskId, change) {
+  return withRecordLock(taskId, async () => {
+    const current = await loadDeliverableRecord(taskId);
+    const next = change(current);
+    if (next) await writeAtomic(recordFile(taskId), `${JSON.stringify(next, null, 2)}
+`);
+    return next ?? current;
+  });
+}
+var SHA256 = /^[0-9a-f]{64}$/;
+function blobPath(taskId, sha256) {
+  if (!SHA256.test(sha256)) throw new Error("Not a SHA-256");
+  return path3.join(deliverableDir(taskId), "blobs", sha256);
+}
+async function saveDeliverableBlob(taskId, data) {
+  const sha256 = sha256Hex(data);
+  const file = blobPath(taskId, sha256);
+  const existing = await fs2.readFile(file).catch(() => void 0);
+  if (existing && sha256Hex(existing) === sha256) return sha256;
+  await writeAtomic(file, data);
+  return sha256;
+}
+async function loadDeliverableBlob(taskId, sha256) {
+  const data = await fs2.readFile(blobPath(taskId, sha256)).catch(() => void 0);
+  return data && sha256Hex(data) === sha256 ? data : void 0;
+}
+function describeArtifact(data, file) {
+  return {
+    ...file,
+    sizeBytes: data.length,
+    sha256Hash: sha256Hex(data),
+    keccak256Hash: keccak256(new Uint8Array(data))
+  };
+}
+function deliverableId(taskId, specHash2, artifacts) {
+  const files = [...artifacts].map(({ fileName, role, mimeType, sizeBytes, sha256Hash }) => ({
+    fileName,
+    role,
+    mimeType,
+    sizeBytes,
+    sha256Hash
+  })).sort((a, b) => a.fileName < b.fileName ? -1 : a.fileName > b.fileName ? 1 : 0);
+  return sha256Hex(
+    canonicalJson({ version: 1, taskId: normalTaskId(taskId), specHash: specHash2, artifacts: files })
+  );
+}
+function sealOf(frozen) {
+  return sha256Hex(canonicalJson({ ...frozen, seal: void 0 }));
+}
+var counted = (attempt) => attempt.outcome === "passed" || attempt.outcome === "failed";
+function attemptsUsed(record) {
+  return record ? record.attempts.filter(counted).length : 0;
+}
+async function beginAttempt(spec, hash, options) {
+  const now = options.now.toISOString();
+  const pid = options.pid ?? process.pid;
+  let start;
+  await updateDeliverableRecord(spec.taskId, (current) => {
+    const record = current ?? {
+      version: DELIVERABLE_RECORD_VERSION,
+      taskId: normalTaskId(spec.taskId),
+      specHash: hash,
+      maxAttempts: spec.maxAttempts,
+      deadline: spec.deadline,
+      attempts: []
+    };
+    if (record.specHash !== hash) {
+      throw new DeliverableError(
+        "spec_changed",
+        `Task ${spec.taskId} is already being validated against another deliverable spec (${record.specHash.slice(0, 12)}); a deliverable is checked against the spec approved for it.`
+      );
+    }
+    for (const attempt2 of record.attempts) {
+      if (attempt2.outcome === "running" && !holderAlive(attempt2.pid, attempt2.startedAt)) {
+        attempt2.outcome = "interrupted";
+        attempt2.endedAt = now;
+      }
+    }
+    const running = record.attempts.find((attempt2) => attempt2.outcome === "running");
+    if (running) {
+      throw new DeliverableError(
+        "validation_running",
+        `Attempt ${running.n} for task ${spec.taskId} is still running (process ${running.pid}); wait for it to finish.`
+      );
+    }
+    if (record.frozen) {
+      start = { kind: "frozen", record };
+      return record;
+    }
+    const exhausted = (reason) => {
+      start = { kind: "exhausted", reason, record };
+      return record;
+    };
+    if (attemptsUsed(record) >= record.maxAttempts) return exhausted("attempts");
+    const interrupted = record.attempts.filter((a) => a.outcome === "interrupted").length;
+    if (interrupted >= MAX_INTERRUPTED_ATTEMPTS) return exhausted("interrupted");
+    if (options.now.getTime() > Date.parse(record.deadline)) return exhausted("deadline");
+    if (options.budgetRefusal !== void 0) return exhausted("budget");
+    const attempt = {
+      n: record.attempts.length + 1,
+      pid,
+      nonce: randomBytes(8).toString("hex"),
+      startedAt: now,
+      outcome: "running"
+    };
+    record.attempts.push(attempt);
+    start = { kind: "started", attempt, record };
+    return record;
+  });
+  return start;
+}
+function ownAttempt(record, nonce) {
+  const attempt = record?.attempts.find((a) => a.nonce === nonce);
+  if (!attempt || attempt.outcome !== "running") {
+    throw new DeliverableError(
+      "attempt_not_running",
+      "This validation attempt is no longer running (another process marked it interrupted)."
+    );
+  }
+  return attempt;
+}
+async function finishAttempt(taskId, nonce, result, now) {
+  const record = await updateDeliverableRecord(taskId, (current) => {
+    const attempt = ownAttempt(current, nonce);
+    Object.assign(attempt, {
+      ...result,
+      problems: result.problems?.slice(0, MAX_RECORDED_PROBLEMS),
+      endedAt: now.toISOString()
+    });
+    return current;
+  });
+  return record;
+}
+async function freezeDeliverable(taskId, nonce, frozen, attempt, now) {
+  let result;
+  await updateDeliverableRecord(taskId, (current) => {
+    const own = ownAttempt(current, nonce);
+    const record = current;
+    Object.assign(own, { ...attempt, outcome: "passed", endedAt: now.toISOString() });
+    if (record.frozen && record.frozen.deliverableId !== frozen.deliverableId) {
+      throw new DeliverableError(
+        "already_frozen",
+        `Task ${taskId} already has a frozen deliverable (${record.frozen.deliverableId}); it is not replaced.`
+      );
+    }
+    record.frozen ??= frozen;
+    result = record.frozen;
+    return record;
+  });
+  return result;
+}
+async function loadFrozenDeliverable(taskId) {
+  const record = await loadDeliverableRecord(taskId);
+  const frozen = record?.frozen;
+  if (!frozen) return void 0;
+  if (deliverableId(frozen.taskId, frozen.specHash, frozen.artifacts) !== frozen.deliverableId) {
+    throw new DeliverableTamperedError("the record no longer matches its deliverable id");
+  }
+  if (frozen.specHash !== record.specHash || frozen.taskId !== record.taskId) {
+    throw new DeliverableTamperedError("the record names another task or spec");
+  }
+  if (sealOf(frozen) !== frozen.seal) {
+    throw new DeliverableTamperedError("the frozen record was edited");
+  }
+  const files = [];
+  for (const artifact of [...frozen.artifacts, frozen.testOutput]) {
+    const data = await fs2.readFile(blobPath(taskId, artifact.sha256Hash)).catch(() => void 0);
+    if (!data) throw new DeliverableTamperedError(`${artifact.fileName} is missing`);
+    if (data.length !== artifact.sizeBytes || sha256Hex(data) !== artifact.sha256Hash || keccak256(new Uint8Array(data)) !== artifact.keccak256Hash) {
+      throw new DeliverableTamperedError(`${artifact.fileName} no longer matches its hashes`);
+    }
+    files.push({ ...artifact, data });
+  }
+  return { deliverable: frozen, files };
+}
+
+// src/lib/agent/compute.ts
+async function readComputeView(options = {}) {
+  const warning = options.warning ?? null;
+  const empty = {
+    availableCredits: null,
+    reservedCredits: null,
+    burnCreditsPerHour: null,
+    low: warning === "low_credit" || warning === "credit_exhausted",
+    warning,
+    pendingPurchases: 0,
+    autoTopUp: null
+  };
+  let config;
+  try {
+    config = await loadComputeCreditConfig();
+  } catch (error) {
+    return { configured: false, ...empty, error: error.message };
+  }
+  if (!config) return { configured: false, ...empty };
+  try {
+    let status = await readComputeCreditStatus();
+    if (options.observe && await options.observe({ availableCredits: status.balance.availableCredits })) {
+      status = await readComputeCreditStatus();
+    }
+    const burn = burnRate(status.debits);
+    const autoTopUp = config.autoTopUp ? {
+      thresholdCredits: config.autoTopUp.thresholdCredits,
+      amountUsd: config.autoTopUp.amountUsd,
+      maxChunksPerDay: config.autoTopUp.maxChunksPerDay
+    } : null;
+    return {
+      configured: true,
+      availableCredits: status.balance.availableCredits,
+      reservedCredits: status.balance.reservedCredits,
+      burnCreditsPerHour: burn,
+      low: computeLow({
+        availableCredits: status.balance.availableCredits,
+        burnCreditsPerHour: burn,
+        warning,
+        ...autoTopUp ? { thresholdCredits: autoTopUp.thresholdCredits } : {}
+      }),
+      warning,
+      pendingPurchases: (await listPendingComputePurchases()).length,
+      autoTopUp
+    };
+  } catch (error) {
+    return {
+      configured: true,
+      ...empty,
+      error: error.code ?? error.message
+    };
+  }
+}
+async function computeAllocationId() {
+  return (await loadComputeCreditConfig().catch(() => void 0))?.allocationId;
+}
+async function computeCreditOffer() {
+  const pricing = await fetchComputePricing();
+  return {
+    usdPerCredit: pricing.usdPerCredit,
+    denominations: pricing.denominations.map((entry) => ({
+      amountUsd: entry.amountUsd,
+      credits: entry.credits,
+      default: entry.default
+    }))
+  };
+}
+async function buyComputeChunk(amountUsd) {
+  const pricing = await fetchComputePricing();
+  const size = amountUsd ?? (pricing.denominations.find((entry) => entry.default) ?? pricing.denominations[0])?.amountUsd;
+  if (size === void 0) {
+    throw new AgentLaunchError("invalid_amount", "The API sells no compute credit sizes");
+  }
+  const bought = await buyComputeCredit({ amountUsd: size });
+  return { purchase: bought.purchase, balance: bought.balance, amountUsd: size };
+}
+function computeCreditObserver(log) {
+  return async (observation) => {
+    try {
+      const { topUp } = await onComputeBalanceObserved(observation);
+      if (topUp.action === "bought") log("Compute credit auto-top-up bought one chunk");
+      else if (topUp.action === "skipped")
+        log(`Compute credit auto-top-up skipped: ${topUp.reason}`);
+      return topUp.action === "bought";
+    } catch (error) {
+      log(
+        `Compute credit auto-top-up failed: ${error.code ?? error.message}`
+      );
+      return false;
+    }
+  };
+}
+function insufficientCredit(error) {
+  return error instanceof SandboxUnavailableError && /\binsufficient_credit\b/.test(error.reason);
+}
+async function openSandbox(createBroker, observe) {
+  const first = createBroker();
+  try {
+    await first.connect("start");
+    return first;
+  } catch (error) {
+    if (!insufficientCredit(error)) throw error;
+    if (!await observe({ creditWarning: "credit_exhausted" })) {
+      throw new AgentLaunchError("insufficient_credit", error.reason);
+    }
+  }
+  const retry = createBroker();
+  try {
+    await retry.connect("start");
+    return retry;
+  } catch (error) {
+    if (insufficientCredit(error)) throw new AgentLaunchError("insufficient_credit", error.reason);
+    throw error;
+  }
+}
+
+export {
+  taskStage,
+  occupiesSlot,
+  fileActiveTaskStore,
+  TEST_OUTPUT_NAME,
+  DELIVERABLE_HARD_LIMITS,
+  DeliverableSpecError,
+  sha256Hex,
+  specHash,
+  relativePathProblem,
+  effectiveLimits,
+  assertDeliverableSpec,
+  checkManifest,
+  holdsPrivateKey,
+  checkPatchContent,
+  checkReportContent,
+  DeliverableError,
+  DeliverableTamperedError,
+  deliverableDir,
+  loadDeliverableRecord,
+  saveDeliverableBlob,
+  loadDeliverableBlob,
+  describeArtifact,
+  deliverableId,
+  sealOf,
+  attemptsUsed,
+  beginAttempt,
+  finishAttempt,
+  freezeDeliverable,
+  loadFrozenDeliverable,
+  readComputeView,
+  computeAllocationId,
+  computeCreditOffer,
+  buyComputeChunk,
+  computeCreditObserver,
+  openSandbox
+};