@tangle-network/agent-eval 0.172.0 → 0.172.1

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to `@tangle-network/agent-eval` and its sibling `agent-eval-
 
 ---
 
+## [0.172.1] — 2026-09-01
+
+### Added
+
+- `runBoundedProcess` accepts `args`, an argument vector delivered to the program with no shell between.
+  The runner could only be given a command line for a shell to read, so `interpreter -flag <text>` was expressible only by quoting the text into that line.
+  A caller with text it did not author — a script body, a path, a pattern — therefore had to carry its own shell quoter, and a bug in that quoter is a command injection and not a wrong answer.
+  `{ command: 'bash', args: ['-n', '-c', body] }` now parses `body` whatever shell metacharacters it holds.
+  The argv form keeps the deadline, the detached process group, the group kill, the output cap, the `envMode` rule and every result flag.
+  `args` together with a truthy `shell` is contradictory, because a shell cannot interpret an argument vector: the call spawns nothing and reports `runnerError`, so the caller's bug reads as a failure and never as a pass.
+  The consumer this was added for is agent-knowledge's claim grader, which parses a claim's check under `bash -n -c` before it runs the check; it moves onto this runner in agent-knowledge 12.1.0 and holds no reference to it yet.
+  Two limits on `args` are the platform's, and are reported rather than thrown: a NUL byte in an entry cannot reach a process at all and comes back as a `runnerError`, and a non-string entry from an untypechecked caller is coerced with `String()`.
+  With `envMode: 'replace'` and no `PATH` named, the two forms do not search the same directories — the shell applies its own compiled-in default and the argv form falls back to `confstr(_CS_PATH)`, measured on Linux/glibc as `/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin` against `/bin:/usr/bin`. Name `PATH` and both forms search what was named.
+
+### Fixed
+
+- `runBoundedProcess` no longer REJECTS when `spawn` refuses an argument.
+  `spawn` validates `command` and each `args` entry synchronously and throws — a NUL byte, or an `args` that is not an array — and a throw inside the promise executor rejected, against this module's standing guarantee that a call always resolves.
+  The throw is now caught and reported as a `runnerError` result, so a caller running text it did not author scores that text as failed instead of dying on it.
+  The same hole existed for `command` on the shell form and is closed with it.
+
+### Changed
+
+- This release is a patch. `args` is optional and purely additive, and the package is pre-1.0, so the compatibility boundary sits at the minor.
+  Every consumer still declares `>=0.171.0 <0.172.0` — agent-runtime, agent-knowledge and agent-app — so all three are already one cohort behind 0.172.0 and have to move to reach it at all.
+  A `0.173.0` would open a third cohort for a change none of them consume; a patch keeps it inside the minor they are moving to.
+- Pin the four dependency manifests with digest `02565ef4ac091a2df7d995186bc2d952fc5f739d5ccad77be63e856d59b8fc07`. Three of the four carry the version, so the lock digest moves with every release.
+
+---
+
 ## [0.172.0] — 2026-09-01
 
 ### Added

package/dist/analyst/index.d.ts

@@ -1267,7 +1267,7 @@ declare function runAnalystBenchmarkCommand(argv: readonly string[], env?: NodeJ
 declare const ANALYST_BENCHMARK_IMPLEMENTATION_DIGEST_ALGORITHM = "sha256-canonical-source-manifest";
 declare const ANALYST_BENCHMARK_DEPENDENCY_LOCK_DIGEST_ALGORITHM = "sha256-canonical-file-manifest";
 declare const ANALYST_BENCHMARK_DEPENDENCY_LOCK_FILES: readonly string[];
-declare const ANALYST_BENCHMARK_DEPENDENCY_LOCK_SHA256 = "3f65588dbbec59d2c783edf245a9751653346fc67eae691d38af22c8b6b5b8ce";
+declare const ANALYST_BENCHMARK_DEPENDENCY_LOCK_SHA256 = "02565ef4ac091a2df7d995186bc2d952fc5f739d5ccad77be63e856d59b8fc07";
 declare const ANALYST_BENCHMARK_EVIDENCE_DEPENDENCY_LOCK_SHA256 = "1e03f2daed356d60316aabefb407ec1e437ac94d408d61eea4ae096e9c6fbb5b";
 declare const ANALYST_BENCHMARK_EVIDENCE_IMPLEMENTATION_SHA256 = "4dba263b6256a30d56c7fdb2d992d3a953c0035d731f359b704db806f68f75ac";
 declare const ANALYST_BENCHMARK_IMPLEMENTATION_FILES: readonly string[];

package/dist/analyst/index.js

@@ -6,7 +6,7 @@ import { a as DEFAULT_TRACE_ANALYST_KINDS, c as IMPROVEMENT_KIND_SPEC, d as Cont
 import { t as createDspyRlmTraceEngine } from "../dspy-rlm-engine-CS3qcCEk.js";
 import { a as diffFindings, i as defaultIsMaterial, n as runSemanticConceptJudge, r as FindingsStore, t as SEMANTIC_CONCEPT_JUDGE_VERSION } from "../semantic-concept-judge-I36eejJx.js";
 import { a as scoreAnalystFindings, i as summarizeAnalystBenchmarkRunner, n as runAnalystBenchmark, r as traceStoreEvidenceResolver, t as registryBenchmarkRunner } from "../benchmark-C4wk_Sjr.js";
-import { $ as ANALYST_BENCHMARK_LOCAL_RECEIPT_FILE, A as effectiveAnalystProtocolSha256, B as loadCodeTraceVerificationArtifacts, C as adaptPublicBenchmarkFindings, D as renderCodeTraceCalibrationMarkdown, E as readAnalystBenchmarkArtifact, F as publicBenchmarkProtocolSha256, G as ANALYST_BENCHMARK_EVIDENCE_DEPENDENCY_LOCK_SHA256, H as ANALYST_BENCHMARK_DEPENDENCY_LOCK_DIGEST_ALGORITHM, I as publicBenchmarkRlmInstructions, J as ANALYST_BENCHMARK_IMPLEMENTATION_FILES, K as ANALYST_BENCHMARK_EVIDENCE_IMPLEMENTATION_SHA256, L as publicBenchmarkSystemPrompt, M as CODE_TRACE_BENCH_ANALYST_PROMPT, N as MAX_INCORRECT_BLOCKS, O as summarizeCodeTraceCalibration, P as MAX_INCORRECT_BLOCK_STEPS, Q as ANALYST_BENCHMARK_COST_LEDGER_FILE, R as DEFAULT_MAX_VERIFICATION_ARTIFACT_BYTES, S as analystDefinitionProtocolSha256, T as expandCodeTraceFailureBlocks, U as ANALYST_BENCHMARK_DEPENDENCY_LOCK_FILES, V as parseVerificationOutcome, W as ANALYST_BENCHMARK_DEPENDENCY_LOCK_SHA256, X as analystBenchmarkDependencyLockDigest, Y as ANALYST_BENCHMARK_IMPLEMENTATION_SHA256, Z as analystBenchmarkImplementationDigest, _ as createPublicBenchmarkDirectRunner, a as primeCodeTraceAnalystDefinition, at as summarizeAgentRxCalibration, b as AnalystExpressivenessError, c as loadPublicBenchmarkRows, ct as agentRxBenchmarkCase, d as publicBenchmarkSelectionReport, dt as roundAgentRxStep, et as ANALYST_BENCHMARK_MANIFEST_FILE, f as selectPublicBenchmarkRows, ft as normalizeBenchmarkLabel, g as runReplVariableAnalystDefinition, h as rlmEngineLimits, i as primeAnalystProtocolSha256, it as renderAgentRxCalibrationMarkdown, j as readAnalystInstructionsOverride, k as analystInstructionsOverrideFromText, l as preparePublicAnalystBenchmark, lt as agentRxPredictionsToFindings, m as publicRlmAnalystDefinition, n as renderAnalystBenchmarkMarkdown, nt as compareAnalystRunners, o as runInlineAnalystDefinition, ot as codeTraceBenchCase, p as createPublicBenchmarkRlmRunner, q as ANALYST_BENCHMARK_IMPLEMENTATION_DIGEST_ALGORITHM, r as createPrimeBenchmarkRunner, rt as AGENT_RX_UPSTREAM_REVISION, s as nodeHttpPrimeBridgeTransport, st as codeTracerPredictionsToFindings, t as runAnalystBenchmarkCommand, tt as ANALYST_BENCHMARK_OBSERVATIONS_FILE, u as publicBenchmarkDistributions, ut as normalizeAgentRxCategory, v as publicDirectAnalystDefinition, w as emptyPublicBenchmarkRunner, x as analystDefinitionAsymmetries, y as runChunkedAnalystDefinition, z as appendVerificationArtifactsToOtlp } from "../benchmark-command-DoFcisuM.js";
+import { $ as ANALYST_BENCHMARK_LOCAL_RECEIPT_FILE, A as effectiveAnalystProtocolSha256, B as loadCodeTraceVerificationArtifacts, C as adaptPublicBenchmarkFindings, D as renderCodeTraceCalibrationMarkdown, E as readAnalystBenchmarkArtifact, F as publicBenchmarkProtocolSha256, G as ANALYST_BENCHMARK_EVIDENCE_DEPENDENCY_LOCK_SHA256, H as ANALYST_BENCHMARK_DEPENDENCY_LOCK_DIGEST_ALGORITHM, I as publicBenchmarkRlmInstructions, J as ANALYST_BENCHMARK_IMPLEMENTATION_FILES, K as ANALYST_BENCHMARK_EVIDENCE_IMPLEMENTATION_SHA256, L as publicBenchmarkSystemPrompt, M as CODE_TRACE_BENCH_ANALYST_PROMPT, N as MAX_INCORRECT_BLOCKS, O as summarizeCodeTraceCalibration, P as MAX_INCORRECT_BLOCK_STEPS, Q as ANALYST_BENCHMARK_COST_LEDGER_FILE, R as DEFAULT_MAX_VERIFICATION_ARTIFACT_BYTES, S as analystDefinitionProtocolSha256, T as expandCodeTraceFailureBlocks, U as ANALYST_BENCHMARK_DEPENDENCY_LOCK_FILES, V as parseVerificationOutcome, W as ANALYST_BENCHMARK_DEPENDENCY_LOCK_SHA256, X as analystBenchmarkDependencyLockDigest, Y as ANALYST_BENCHMARK_IMPLEMENTATION_SHA256, Z as analystBenchmarkImplementationDigest, _ as createPublicBenchmarkDirectRunner, a as primeCodeTraceAnalystDefinition, at as summarizeAgentRxCalibration, b as AnalystExpressivenessError, c as loadPublicBenchmarkRows, ct as agentRxBenchmarkCase, d as publicBenchmarkSelectionReport, dt as roundAgentRxStep, et as ANALYST_BENCHMARK_MANIFEST_FILE, f as selectPublicBenchmarkRows, ft as normalizeBenchmarkLabel, g as runReplVariableAnalystDefinition, h as rlmEngineLimits, i as primeAnalystProtocolSha256, it as renderAgentRxCalibrationMarkdown, j as readAnalystInstructionsOverride, k as analystInstructionsOverrideFromText, l as preparePublicAnalystBenchmark, lt as agentRxPredictionsToFindings, m as publicRlmAnalystDefinition, n as renderAnalystBenchmarkMarkdown, nt as compareAnalystRunners, o as runInlineAnalystDefinition, ot as codeTraceBenchCase, p as createPublicBenchmarkRlmRunner, q as ANALYST_BENCHMARK_IMPLEMENTATION_DIGEST_ALGORITHM, r as createPrimeBenchmarkRunner, rt as AGENT_RX_UPSTREAM_REVISION, s as nodeHttpPrimeBridgeTransport, st as codeTracerPredictionsToFindings, t as runAnalystBenchmarkCommand, tt as ANALYST_BENCHMARK_OBSERVATIONS_FILE, u as publicBenchmarkDistributions, ut as normalizeAgentRxCategory, v as publicDirectAnalystDefinition, w as emptyPublicBenchmarkRunner, x as analystDefinitionAsymmetries, y as runChunkedAnalystDefinition, z as appendVerificationArtifactsToOtlp } from "../benchmark-command--qeZUHbu.js";
 import { a as extractPrimeJsonObject, c as primeProtocolSha256, d as runPrimeExchange, f as decodeReplyRows, i as emptyPrimeRawUsage, l as primeReplyDefect, n as buildPrimePrompt, o as mergePrimeRawUsage, r as buildPrimeRepairPrompt, s as normalizePrimeUsage, t as analystUsageReceiptFromPrimeUsage, u as projectPrimeTrajectory } from "../prime-protocol-6tZTVsWm.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";

package/dist/{benchmark-command-DoFcisuM.js → benchmark-command--qeZUHbu.js}

@@ -1412,7 +1412,7 @@ const ANALYST_BENCHMARK_DEPENDENCY_LOCK_FILES = Object.freeze([
 	"package.json",
 	"pnpm-lock.yaml"
 ]);
-const ANALYST_BENCHMARK_DEPENDENCY_LOCK_SHA256 = "3f65588dbbec59d2c783edf245a9751653346fc67eae691d38af22c8b6b5b8ce";
+const ANALYST_BENCHMARK_DEPENDENCY_LOCK_SHA256 = "02565ef4ac091a2df7d995186bc2d952fc5f739d5ccad77be63e856d59b8fc07";
 const ANALYST_BENCHMARK_EVIDENCE_DEPENDENCY_LOCK_SHA256 = "1e03f2daed356d60316aabefb407ec1e437ac94d408d61eea4ae096e9c6fbb5b";
 const ANALYST_BENCHMARK_EVIDENCE_IMPLEMENTATION_SHA256 = "4dba263b6256a30d56c7fdb2d992d3a953c0035d731f359b704db806f68f75ac";
 const ANALYST_BENCHMARK_IMPLEMENTATION_FILES = Object.freeze([
@@ -6351,4 +6351,4 @@ function shellQuote(value) {
 //#endregion
 export { ANALYST_BENCHMARK_LOCAL_RECEIPT_FILE as $, effectiveAnalystProtocolSha256 as A, loadCodeTraceVerificationArtifacts as B, adaptPublicBenchmarkFindings as C, renderCodeTraceCalibrationMarkdown as D, readAnalystBenchmarkArtifact as E, publicBenchmarkProtocolSha256 as F, ANALYST_BENCHMARK_EVIDENCE_DEPENDENCY_LOCK_SHA256 as G, ANALYST_BENCHMARK_DEPENDENCY_LOCK_DIGEST_ALGORITHM as H, publicBenchmarkRlmInstructions as I, ANALYST_BENCHMARK_IMPLEMENTATION_FILES as J, ANALYST_BENCHMARK_EVIDENCE_IMPLEMENTATION_SHA256 as K, publicBenchmarkSystemPrompt as L, CODE_TRACE_BENCH_ANALYST_PROMPT as M, MAX_INCORRECT_BLOCKS as N, summarizeCodeTraceCalibration as O, MAX_INCORRECT_BLOCK_STEPS as P, ANALYST_BENCHMARK_COST_LEDGER_FILE as Q, DEFAULT_MAX_VERIFICATION_ARTIFACT_BYTES as R, analystDefinitionProtocolSha256 as S, expandCodeTraceFailureBlocks as T, ANALYST_BENCHMARK_DEPENDENCY_LOCK_FILES as U, parseVerificationOutcome as V, ANALYST_BENCHMARK_DEPENDENCY_LOCK_SHA256 as W, analystBenchmarkDependencyLockDigest as X, ANALYST_BENCHMARK_IMPLEMENTATION_SHA256 as Y, analystBenchmarkImplementationDigest as Z, createPublicBenchmarkDirectRunner as _, primeCodeTraceAnalystDefinition as a, summarizeAgentRxCalibration as at, AnalystExpressivenessError as b, loadPublicBenchmarkRows as c, agentRxBenchmarkCase as ct, publicBenchmarkSelectionReport as d, roundAgentRxStep as dt, ANALYST_BENCHMARK_MANIFEST_FILE as et, selectPublicBenchmarkRows as f, normalizeBenchmarkLabel as ft, runReplVariableAnalystDefinition as g, rlmEngineLimits as h, primeAnalystProtocolSha256 as i, renderAgentRxCalibrationMarkdown as it, readAnalystInstructionsOverride as j, analystInstructionsOverrideFromText as k, preparePublicAnalystBenchmark as l, agentRxPredictionsToFindings as lt, publicRlmAnalystDefinition as m, renderAnalystBenchmarkMarkdown as n, compareAnalystRunners as nt, runInlineAnalystDefinition as o, codeTraceBenchCase as ot, createPublicBenchmarkRlmRunner as p, ANALYST_BENCHMARK_IMPLEMENTATION_DIGEST_ALGORITHM as q, createPrimeBenchmarkRunner as r, AGENT_RX_UPSTREAM_REVISION as rt, nodeHttpPrimeBridgeTransport as s, codeTracerPredictionsToFindings as st, runAnalystBenchmarkCommand as t, ANALYST_BENCHMARK_OBSERVATIONS_FILE as tt, publicBenchmarkDistributions as u, normalizeAgentRxCategory as ut, publicDirectAnalystDefinition as v, emptyPublicBenchmarkRunner as w, analystDefinitionAsymmetries as x, runChunkedAnalystDefinition as y, appendVerificationArtifactsToOtlp as z };
 
-//# sourceMappingURL=benchmark-command-DoFcisuM.js.map
+//# sourceMappingURL=benchmark-command--qeZUHbu.js.map