@tangle-network/agent-runtime 0.101.0 → 0.102.0

package/dist/{chunk-HGSHPVJ6.js → chunk-TGDHHHH4.js}

@@ -2531,6 +2531,182 @@ function retryLineageDigest(prepared, resultTimeoutMs) {
   });
 }
 
+// src/candidate-execution/verify.ts
+import { agentCandidateBundleSchema } from "@tangle-network/agent-interface";
+var verifiedCandidateState = /* @__PURE__ */ new WeakMap();
+var AGENT_CANDIDATE_EXECUTION_SUPPORT = Object.freeze({
+  outcomes: Object.freeze(["workspace", "output"]),
+  code: Object.freeze(["disabled", "no-op", "git-patch"]),
+  memory: Object.freeze(["disabled", "isolated"]),
+  knowledge: true,
+  profile: Object.freeze({
+    mcpTransports: Object.freeze(["stdio"]),
+    remoteMcp: false,
+    tools: false,
+    permissions: false,
+    modes: false,
+    confidential: false
+  })
+});
+async function verifyAgentCandidateBundle(input, ports) {
+  const parsed = agentCandidateBundleSchema.parse(input);
+  const withoutDigest = omitTopLevelDigest(parsed);
+  const actualDigest = canonicalCandidateDigest(withoutDigest);
+  if (actualDigest !== parsed.digest) {
+    throw new Error(`candidate bundle digest ${parsed.digest} does not match ${actualDigest}`);
+  }
+  const canonicalBytes = canonicalCandidateBytes(withoutDigest);
+  verifyBytes(canonicalBytes, parsed.digest, canonicalBytes.byteLength, "candidate bundle");
+  assertCandidateProfileExecutionSupport(parsed.profile);
+  const artifactBytes = /* @__PURE__ */ new Map();
+  const readArtifact = async (artifact) => {
+    const key = artifactCacheKey(artifact);
+    const existing = artifactBytes.get(key);
+    if (existing) return Uint8Array.from(existing);
+    const bytes = await readVerifiedArtifact(artifact, ports.artifacts);
+    artifactBytes.set(key, Uint8Array.from(bytes));
+    return bytes;
+  };
+  let patchBytes;
+  if (parsed.code.kind === "git-patch") {
+    patchBytes = await readArtifact(parsed.code.patch.artifact);
+  }
+  const materializedTree = await verifyCandidateCode(parsed.code, ports.repositories, patchBytes);
+  const resourceBytes = /* @__PURE__ */ new Map();
+  for (const resource of candidateResources(parsed)) {
+    const bytes = resource.kind === "inline" ? Buffer.from(resource.content, "utf8") : await readCandidateGitHubResource(resource, ports.repositories);
+    verifyBytes(
+      bytes,
+      resource.sha256,
+      resource.byteLength,
+      `candidate resource ${resource.name ?? (resource.kind === "github" ? resource.path : "<unnamed>")}`
+    );
+    resourceBytes.set(resourceKey(resource), Uint8Array.from(bytes));
+    resourceBytes.set(resource.sha256, Uint8Array.from(bytes));
+  }
+  if (parsed.execution.workspace) {
+    const workspace = await verifyWorkspaceSnapshotArtifacts(
+      parsed.execution.workspace,
+      ports.artifacts
+    );
+    artifactBytes.set(artifactCacheKey(parsed.execution.workspace.manifest), workspace.manifest);
+    artifactBytes.set(artifactCacheKey(parsed.execution.workspace.archive), workspace.archive);
+  }
+  if (parsed.knowledge) {
+    const knowledge = await verifyWorkspaceSnapshotArtifacts(
+      parsed.knowledge.snapshot,
+      ports.artifacts
+    );
+    artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.manifest), knowledge.manifest);
+    artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.archive), knowledge.archive);
+    if (parsed.knowledge.retrievalConfig) await readArtifact(parsed.knowledge.retrievalConfig);
+    await readArtifact(parsed.knowledge.evaluation);
+  }
+  if (parsed.memory.mode === "isolated" && parsed.memory.seed)
+    await readArtifact(parsed.memory.seed);
+  deepFreezeCandidate(parsed);
+  const verified = Object.freeze({
+    bundle: parsed,
+    ...materializedTree === void 0 ? {} : { materializedTree },
+    [verifiedCandidateBrand]: true
+  });
+  verifiedCandidateState.set(verified, { ports, artifactBytes, resourceBytes });
+  return verified;
+}
+function getVerifiedCandidateState(candidate) {
+  const state = verifiedCandidateState.get(candidate);
+  if (!state || candidate[verifiedCandidateBrand] !== true) {
+    throw new Error("candidate must come from verifyAgentCandidateBundle");
+  }
+  return state;
+}
+async function verifiedArtifactBytes(candidate, artifact) {
+  const state = getVerifiedCandidateState(candidate);
+  const key = artifactCacheKey(artifact);
+  const existing = state.artifactBytes.get(key);
+  if (existing) return Uint8Array.from(existing);
+  const bytes = await readVerifiedArtifact(artifact, state.ports.artifacts);
+  state.artifactBytes.set(key, Uint8Array.from(bytes));
+  return bytes;
+}
+function verifiedResourceTextByDigest(candidate) {
+  const output = /* @__PURE__ */ new Map();
+  for (const resource of candidateResources(candidate.bundle)) {
+    const bytes = getVerifiedCandidateState(candidate).resourceBytes.get(resource.sha256);
+    if (!bytes) throw new Error(`candidate resource digest was not verified: ${resource.sha256}`);
+    output.set(resource.sha256, new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  }
+  return output;
+}
+function candidateResources(bundle) {
+  const resources = bundle.profile.resources;
+  if (!resources) return [];
+  const output = [];
+  for (const mount of resources.files ?? []) output.push(mount.resource);
+  output.push(...resources.tools ?? []);
+  output.push(...resources.skills ?? []);
+  output.push(...resources.agents ?? []);
+  output.push(...resources.commands ?? []);
+  if (typeof resources.instructions === "object") output.push(resources.instructions);
+  return output;
+}
+function resourceKey(resource) {
+  return canonicalCandidateDigest(resource);
+}
+
+// src/candidate-execution/knowledge.ts
+import { mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join2, posix } from "path";
+import { hashKnowledgeBase } from "@tangle-network/agent-knowledge";
+var CANDIDATE_KNOWLEDGE_ROOT_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_ROOT";
+var CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG";
+function candidateKnowledgeExecutionPaths(taskRoot, hasRetrievalConfig) {
+  if (!posix.isAbsolute(taskRoot) || posix.normalize(taskRoot) !== taskRoot) {
+    throw new Error("candidate knowledge requires a normalized absolute task root");
+  }
+  const parent = posix.join(taskRoot, ".tangle");
+  return {
+    root: posix.join(parent, "knowledge"),
+    ...hasRetrievalConfig ? { retrievalConfig: posix.join(parent, "knowledge-retrieval-config.json") } : {}
+  };
+}
+async function prepareAgentCandidateKnowledge(candidate, ports, arm) {
+  const knowledge = candidate.bundle.knowledge;
+  if (!knowledge) return void 0;
+  const archive = await verifiedArtifactBytes(candidate, knowledge.snapshot.archive);
+  const retrievalConfig = knowledge.retrievalConfig ? await verifiedArtifactBytes(candidate, knowledge.retrievalConfig) : void 0;
+  const root = await mkdtemp2(join2(tmpdir2(), "agent-candidate-knowledge-"));
+  try {
+    await ports.workspaces.materialize({
+      role: "knowledge",
+      snapshot: knowledge.snapshot,
+      archive,
+      destination: root
+    });
+    const expectedHash = arm === "baseline" ? knowledge.candidate.baseHash : knowledge.candidate.candidateHash;
+    const actualHash = `sha256:${await hashKnowledgeBase(root)}`;
+    if (actualHash !== expectedHash) {
+      throw new Error(
+        `materialized ${arm} knowledge does not match its measured content: expected ${expectedHash}, got ${actualHash}`
+      );
+    }
+    const files = await readMaterializedWorkspaceFiles(root, knowledge.snapshot.material);
+    return Object.freeze({
+      candidate: knowledge.candidate,
+      snapshot: knowledge.snapshot,
+      files: Object.freeze(
+        files.map(
+          (file) => Object.freeze({ path: file.path, mode: file.mode, bytes: Uint8Array.from(file.bytes) })
+        )
+      ),
+      ...retrievalConfig ? { retrievalConfig: Uint8Array.from(retrievalConfig) } : {}
+    });
+  } finally {
+    await rm2(root, { recursive: true, force: true });
+  }
+}
+
 // src/candidate-execution/output-artifacts.ts
 import {
   agentCandidateArtifactRefSchema as agentCandidateArtifactRefSchema3
@@ -3348,9 +3524,9 @@ function compareStrings(a, b) {
 }
 
 // src/candidate-execution/outcome-evidence.ts
-import { mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join2 } from "path";
+import { mkdtemp as mkdtemp3, rm as rm3 } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join3 } from "path";
 import {
   agentCandidateBenchmarkResultEvidenceSchema,
   agentCandidateModelSettlementEvidenceSchema,
@@ -3846,7 +4022,7 @@ async function persistCandidateBenchmarkResult(state, termination, outcome, grad
   );
 }
 async function verifyTaskOutcomeArchive(state, snapshot, archive, protectedValues) {
-  const root = await mkdtemp2(join2(tmpdir2(), "agent-candidate-task-archive-"));
+  const root = await mkdtemp3(join3(tmpdir3(), "agent-candidate-task-archive-"));
   try {
     await state.ports.workspaces.materialize({
       role: "task",
@@ -3857,7 +4033,7 @@ async function verifyTaskOutcomeArchive(state, snapshot, archive, protectedValue
     const files = await readMaterializedWorkspaceFiles(root, snapshot.material);
     for (const file of files) assertNoProtectedBytes(file.bytes, protectedValues);
   } finally {
-    await rm2(root, { recursive: true, force: true });
+    await rm3(root, { recursive: true, force: true });
   }
 }
 async function verifyMemoryCapture(state, capture, protectedValues, signal) {
@@ -3878,7 +4054,7 @@ async function verifyMemoryCapture(state, capture, protectedValues, signal) {
     manifest: embeddedCandidateArtifact(manifestBytes),
     archive: embeddedCandidateArtifact(memory.archive)
   });
-  const root = await mkdtemp2(join2(tmpdir2(), "agent-candidate-memory-after-"));
+  const root = await mkdtemp3(join3(tmpdir3(), "agent-candidate-memory-after-"));
   try {
     await state.ports.workspaces.materialize({
       role: "memory",
@@ -3890,7 +4066,7 @@ async function verifyMemoryCapture(state, capture, protectedValues, signal) {
     for (const file of files) assertNoProtectedBytes(file.bytes, protectedValues);
     signal?.throwIfAborted();
   } finally {
-    await rm2(root, { recursive: true, force: true });
+    await rm3(root, { recursive: true, force: true });
   }
 }
 function normalizeEvaluation(evaluation, termination) {
@@ -4794,182 +4970,6 @@ var CandidateExecutionDeadlineError = class extends Error {
   }
 };
 
-// src/candidate-execution/verify.ts
-import { agentCandidateBundleSchema } from "@tangle-network/agent-interface";
-var verifiedCandidateState = /* @__PURE__ */ new WeakMap();
-var AGENT_CANDIDATE_EXECUTION_SUPPORT = Object.freeze({
-  outcomes: Object.freeze(["workspace", "output"]),
-  code: Object.freeze(["disabled", "no-op", "git-patch"]),
-  memory: Object.freeze(["disabled", "isolated"]),
-  knowledge: true,
-  profile: Object.freeze({
-    mcpTransports: Object.freeze(["stdio"]),
-    remoteMcp: false,
-    tools: false,
-    permissions: false,
-    modes: false,
-    confidential: false
-  })
-});
-async function verifyAgentCandidateBundle(input, ports) {
-  const parsed = agentCandidateBundleSchema.parse(input);
-  const withoutDigest = omitTopLevelDigest(parsed);
-  const actualDigest = canonicalCandidateDigest(withoutDigest);
-  if (actualDigest !== parsed.digest) {
-    throw new Error(`candidate bundle digest ${parsed.digest} does not match ${actualDigest}`);
-  }
-  const canonicalBytes = canonicalCandidateBytes(withoutDigest);
-  verifyBytes(canonicalBytes, parsed.digest, canonicalBytes.byteLength, "candidate bundle");
-  assertCandidateProfileExecutionSupport(parsed.profile);
-  const artifactBytes = /* @__PURE__ */ new Map();
-  const readArtifact = async (artifact) => {
-    const key = artifactCacheKey(artifact);
-    const existing = artifactBytes.get(key);
-    if (existing) return Uint8Array.from(existing);
-    const bytes = await readVerifiedArtifact(artifact, ports.artifacts);
-    artifactBytes.set(key, Uint8Array.from(bytes));
-    return bytes;
-  };
-  let patchBytes;
-  if (parsed.code.kind === "git-patch") {
-    patchBytes = await readArtifact(parsed.code.patch.artifact);
-  }
-  const materializedTree = await verifyCandidateCode(parsed.code, ports.repositories, patchBytes);
-  const resourceBytes = /* @__PURE__ */ new Map();
-  for (const resource of candidateResources(parsed)) {
-    const bytes = resource.kind === "inline" ? Buffer.from(resource.content, "utf8") : await readCandidateGitHubResource(resource, ports.repositories);
-    verifyBytes(
-      bytes,
-      resource.sha256,
-      resource.byteLength,
-      `candidate resource ${resource.name ?? (resource.kind === "github" ? resource.path : "<unnamed>")}`
-    );
-    resourceBytes.set(resourceKey(resource), Uint8Array.from(bytes));
-    resourceBytes.set(resource.sha256, Uint8Array.from(bytes));
-  }
-  if (parsed.execution.workspace) {
-    const workspace = await verifyWorkspaceSnapshotArtifacts(
-      parsed.execution.workspace,
-      ports.artifacts
-    );
-    artifactBytes.set(artifactCacheKey(parsed.execution.workspace.manifest), workspace.manifest);
-    artifactBytes.set(artifactCacheKey(parsed.execution.workspace.archive), workspace.archive);
-  }
-  if (parsed.knowledge) {
-    const knowledge = await verifyWorkspaceSnapshotArtifacts(
-      parsed.knowledge.snapshot,
-      ports.artifacts
-    );
-    artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.manifest), knowledge.manifest);
-    artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.archive), knowledge.archive);
-    if (parsed.knowledge.retrievalConfig) await readArtifact(parsed.knowledge.retrievalConfig);
-    await readArtifact(parsed.knowledge.evaluation);
-  }
-  if (parsed.memory.mode === "isolated" && parsed.memory.seed)
-    await readArtifact(parsed.memory.seed);
-  deepFreezeCandidate(parsed);
-  const verified = Object.freeze({
-    bundle: parsed,
-    ...materializedTree === void 0 ? {} : { materializedTree },
-    [verifiedCandidateBrand]: true
-  });
-  verifiedCandidateState.set(verified, { ports, artifactBytes, resourceBytes });
-  return verified;
-}
-function getVerifiedCandidateState(candidate) {
-  const state = verifiedCandidateState.get(candidate);
-  if (!state || candidate[verifiedCandidateBrand] !== true) {
-    throw new Error("candidate must come from verifyAgentCandidateBundle");
-  }
-  return state;
-}
-async function verifiedArtifactBytes(candidate, artifact) {
-  const state = getVerifiedCandidateState(candidate);
-  const key = artifactCacheKey(artifact);
-  const existing = state.artifactBytes.get(key);
-  if (existing) return Uint8Array.from(existing);
-  const bytes = await readVerifiedArtifact(artifact, state.ports.artifacts);
-  state.artifactBytes.set(key, Uint8Array.from(bytes));
-  return bytes;
-}
-function verifiedResourceTextByDigest(candidate) {
-  const output = /* @__PURE__ */ new Map();
-  for (const resource of candidateResources(candidate.bundle)) {
-    const bytes = getVerifiedCandidateState(candidate).resourceBytes.get(resource.sha256);
-    if (!bytes) throw new Error(`candidate resource digest was not verified: ${resource.sha256}`);
-    output.set(resource.sha256, new TextDecoder("utf-8", { fatal: true }).decode(bytes));
-  }
-  return output;
-}
-function candidateResources(bundle) {
-  const resources = bundle.profile.resources;
-  if (!resources) return [];
-  const output = [];
-  for (const mount of resources.files ?? []) output.push(mount.resource);
-  output.push(...resources.tools ?? []);
-  output.push(...resources.skills ?? []);
-  output.push(...resources.agents ?? []);
-  output.push(...resources.commands ?? []);
-  if (typeof resources.instructions === "object") output.push(resources.instructions);
-  return output;
-}
-function resourceKey(resource) {
-  return canonicalCandidateDigest(resource);
-}
-
-// src/candidate-execution/knowledge.ts
-import { mkdtemp as mkdtemp3, rm as rm3 } from "fs/promises";
-import { tmpdir as tmpdir3 } from "os";
-import { join as join3, posix } from "path";
-import { hashKnowledgeBase } from "@tangle-network/agent-knowledge";
-var CANDIDATE_KNOWLEDGE_ROOT_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_ROOT";
-var CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG";
-function candidateKnowledgeExecutionPaths(taskRoot, hasRetrievalConfig) {
-  if (!posix.isAbsolute(taskRoot) || posix.normalize(taskRoot) !== taskRoot) {
-    throw new Error("candidate knowledge requires a normalized absolute task root");
-  }
-  const parent = posix.join(taskRoot, ".tangle");
-  return {
-    root: posix.join(parent, "knowledge"),
-    ...hasRetrievalConfig ? { retrievalConfig: posix.join(parent, "knowledge-retrieval-config.json") } : {}
-  };
-}
-async function prepareAgentCandidateKnowledge(candidate, ports, arm) {
-  const knowledge = candidate.bundle.knowledge;
-  if (!knowledge) return void 0;
-  const archive = await verifiedArtifactBytes(candidate, knowledge.snapshot.archive);
-  const retrievalConfig = knowledge.retrievalConfig ? await verifiedArtifactBytes(candidate, knowledge.retrievalConfig) : void 0;
-  const root = await mkdtemp3(join3(tmpdir3(), "agent-candidate-knowledge-"));
-  try {
-    await ports.workspaces.materialize({
-      role: "knowledge",
-      snapshot: knowledge.snapshot,
-      archive,
-      destination: root
-    });
-    const expectedHash = arm === "baseline" ? knowledge.candidate.baseHash : knowledge.candidate.candidateHash;
-    const actualHash = `sha256:${await hashKnowledgeBase(root)}`;
-    if (actualHash !== expectedHash) {
-      throw new Error(
-        `materialized ${arm} knowledge does not match its measured content: expected ${expectedHash}, got ${actualHash}`
-      );
-    }
-    const files = await readMaterializedWorkspaceFiles(root, knowledge.snapshot.material);
-    return Object.freeze({
-      candidate: knowledge.candidate,
-      snapshot: knowledge.snapshot,
-      files: Object.freeze(
-        files.map(
-          (file) => Object.freeze({ path: file.path, mode: file.mode, bytes: Uint8Array.from(file.bytes) })
-        )
-      ),
-      ...retrievalConfig ? { retrievalConfig: Uint8Array.from(retrievalConfig) } : {}
-    });
-  } finally {
-    await rm3(root, { recursive: true, force: true });
-  }
-}
-
 // src/candidate-execution/prepare.ts
 import { randomBytes as randomBytes3 } from "crypto";
 import { lstat as lstat2, readdir as readdir2 } from "fs/promises";
@@ -5802,17 +5802,17 @@ export {
   candidateClaimFileInternals,
   sealAgentCandidateModelSettlement,
   usdToNanos,
-  sealAgentCandidateExecutorStopAcknowledgement,
-  persistCandidateOutputArtifact,
-  persistCandidateModelSettlementEvidence,
-  RecoveryAgentCandidateTraceStore,
-  executePreparedAgentCandidate,
   AGENT_CANDIDATE_EXECUTION_SUPPORT,
   verifyAgentCandidateBundle,
   verifiedResourceTextByDigest,
   CANDIDATE_KNOWLEDGE_ROOT_ENV,
   CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV,
   candidateKnowledgeExecutionPaths,
+  sealAgentCandidateExecutorStopAcknowledgement,
+  persistCandidateOutputArtifact,
+  persistCandidateModelSettlementEvidence,
+  RecoveryAgentCandidateTraceStore,
+  executePreparedAgentCandidate,
   prepareAgentCandidateExecution
 };
-//# sourceMappingURL=chunk-HGSHPVJ6.js.map
+//# sourceMappingURL=chunk-TGDHHHH4.js.map