@tangle-network/agent-runtime 0.132.8 → 0.132.10

package/dist/{supervisor-Dr3AoSh0.js → supervisor-B9BzXJu9.js}

@@ -5932,6 +5932,7 @@ const cliSeamKey = "cli";
 const bridgeSeamKey = "bridge";
 const maxBridgeTimeoutMs = 2147483647;
 const bridgeModelCredentialHeader = "x-cli-bridge-model-credential";
+const bridgeModelBaseUrlHeader = "x-cli-bridge-model-base-url";
 const bridgeProfileMaterializationSchema = "cli-bridge.profile-materialization.v2";
 const bridgeUsageCostSchema = "cli-bridge.usage-cost.v1";
 const cliWorktreeSeamKey = "cli-worktree";
@@ -5953,10 +5954,19 @@ function isLoopbackBridgeUrl(value) {
 /** Validate and capture the non-serialisable credential service without reading its value. */
 function captureBridgeModelCredential(value, context) {
 	if (value === null || typeof value !== "object") throw new ValidationError(`${context}: modelCredential must be an object`);
-	assertExactConfigKeys(value, /* @__PURE__ */ new Set(["key", "provider"]), `${context} modelCredential`);
+	assertExactConfigKeys(value, /* @__PURE__ */ new Set([
+		"baseUrlKey",
+		"key",
+		"provider"
+	]), `${context} modelCredential`);
 	if (typeof value.key !== "string" || value.key.trim().length === 0) throw new ValidationError(`${context}: modelCredential.key must be a non-empty string`);
+	if (typeof value.baseUrlKey !== "string" || value.baseUrlKey.trim().length === 0) throw new ValidationError(`${context}: modelCredential.baseUrlKey must be a non-empty string`);
+	if (value.baseUrlKey === value.key) throw new ValidationError(`${context}: modelCredential.baseUrlKey must differ from key`);
 	if (!value.provider || typeof value.provider.get !== "function") throw new ValidationError(`${context}: modelCredential.provider must implement get(name)`);
-	const captured = { key: value.key };
+	const captured = {
+		key: value.key,
+		baseUrlKey: value.baseUrlKey
+	};
 	Object.defineProperty(captured, "provider", {
 		configurable: false,
 		enumerable: false,
@@ -5970,18 +5980,35 @@ function validateBridgeModelCredential(value, bridgeUrl, context) {
 	if (!isLoopbackBridgeUrl(bridgeUrl)) throw new ValidationError(`${context}: modelCredential is allowed only for a loopback bridge URL`);
 	return captureBridgeModelCredential(value, context);
 }
-/** Resolve only at the outbound boundary. Provider errors are redacted because they may contain
-*  the protected value; diagnostics identify the key name, never the value or provider error. */
-async function resolveBridgeModelCredential(credential, context) {
-	if (credential === void 0) return void 0;
-	let value;
+function resolveProtectedModelBaseUrl(value, context) {
+	let target;
 	try {
-		value = await credential.provider.get(credential.key);
+		target = new URL(value);
 	} catch {
-		throw new ValidationError(`${context}: modelCredential provider failed for '${credential.key}'`);
+		throw new ValidationError(`${context}: modelCredential.baseUrl must be an absolute HTTPS URL`);
 	}
-	if (typeof value !== "string" || value.length === 0 || /[\r\n]/u.test(value)) throw new ValidationError(`${context}: modelCredential provider has no usable value for '${credential.key}'`);
-	return value;
+	if (target.protocol !== "https:" || target.username || target.password || target.search || target.hash) throw new ValidationError(`${context}: modelCredential.baseUrl must be an HTTPS URL without credentials, query, or fragment`);
+	return target.toString().replace(/\/$/u, "");
+}
+/** Resolve only at the outbound boundary. Provider errors are redacted because they may contain
+*  the protected value; diagnostics identify key names, never values or provider errors. */
+async function resolveBridgeModelCredential(credential, context) {
+	if (credential === void 0) return void 0;
+	const resolveValue = async (key) => {
+		let value;
+		try {
+			value = await credential.provider.get(key);
+		} catch {
+			throw new ValidationError(`${context}: modelCredential provider failed for '${key}'`);
+		}
+		if (typeof value !== "string" || value.length === 0 || /[\r\n\0]/u.test(value)) throw new ValidationError(`${context}: modelCredential provider has no usable value for '${key}'`);
+		return value;
+	};
+	const [token, baseUrl] = await Promise.all([resolveValue(credential.key), resolveValue(credential.baseUrlKey)]);
+	return {
+		token,
+		baseUrl: resolveProtectedModelBaseUrl(baseUrl, context)
+	};
 }
 /** Deterministic content hash for an `outRef`. FNV-1a 32-bit over the canonical
 *  JSON of the result — not cryptographic, sufficient for content-addressing the
@@ -7554,7 +7581,10 @@ async function bridgeStreamPost(url, args) {
 				...args.traceHeaders,
 				"content-type": "application/json",
 				authorization: `Bearer ${args.bearer}`,
-				...modelCredential === void 0 ? {} : { [bridgeModelCredentialHeader]: modelCredential },
+				...modelCredential === void 0 ? {} : {
+					[bridgeModelCredentialHeader]: modelCredential.token,
+					[bridgeModelBaseUrlHeader]: modelCredential.baseUrl
+				},
 				"x-session-id": args.sessionId,
 				"x-run-id": args.runId,
 				...args.afterEventId > 0 ? { "last-event-id": String(args.afterEventId) } : {},
@@ -12229,4 +12259,4 @@ function isNonEmptySpend(s) {
 //#endregion
 export { runAgentRounds as $, bindReusableExecutorExecutionId as A, createWorktree as At, workerTraceHeaders as B, controlProfileMaterialization as Bt, queueOf as C, createRuntimeStreamEventCollector as Ct, assertValidBudget as D, runSettledCommand as Dt, teardownExecutor as E, sanitizeRuntimeStreamEvent as Et, snapshotExecutorConfig as F, localHarnessExecutable as Ft, decodeToolPart as G, promptModelProfileMaterialization as Gt, DEFAULT_SANDBOX_STEERING_MAX_TURNS as H, fullProfileMaterialization as Ht, createWorktreeCliExecutor as I, parseCodexTokenUsage as It, createActivityLog as J, renderProfileMaterializationIssues as Jt, sandboxSessionTraceSource as K, promptOnlyProfileMaterialization as Kt, WORKER_TRACE_PROPAGATION as L, CodexExecutionDiagnosticError as Lt, cliWorktreeExecutor as M, DEFAULT_LOCAL_HARNESS as Mt, createExecutor as N, LOCAL_HARNESSES as Nt, createBudgetPool as O, runWorktreeHarness as Ot, createExecutorRegistry as P, harnessSupportsReasoningEffort as Pt, defaultSelectWinner as Q, readWorkerTraceContext as R, AGENT_PROFILE_MATERIALIZATION_AXES as Rt, freeSlots as S, createRuntimeEventCollector as St, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as T, sanitizeKnowledgeReadinessReport as Tt, createSteerableSandboxSession as U, profileMaterializationAxes$1 as Ut, workerTraceSeamKey as V, defineProfileMaterializationContract as Vt, createPushTraceSource as W, promptControlProfileMaterialization as Wt, createInbox as X, validateProfileMaterialization as Xt, readWorkerProgress as Y, sandboxActProfileMaterialization as Yt, createSandboxForSpec as Z, worktreeCliProfileMaterialization as Zt, pollFor as _, generateSpanId as _t, pickBestDelivered as a, createPropagatingTraceEmitter as at, waitUntil as b, padTraceId as bt, driverChild as c, traceContextToEnv as ct, deriveNodeExecutionIdentity as d, buildLoopSpanNodes as dt, createSandboxLineage as et, recordScopeOwnerMaterialization as f, buildRuntimeEventOtelSpans as ft, isWaitOutcome as g, flatOtelSpan as gt, createWaitProbes as h, exportEvalRuns as ht, collectDelivered as i, runBrainLoop as it, captureReusableExecutorConfig as j, removeWorktree as jt, spendFromUsageEvents as k, captureWorktreeDiff as kt, withDriverExecutor as l, INTELLIGENCE_WIRE_VERSION as lt, settledToIteration as m, createOtelExporter as mt, createSupervisor as n, acquireSandbox as nt, runFinalizer as o, mergeTraceEnv as ot, scopeOwnerExecutorNodeContext as p, createOpenInferenceFileExporter as pt, DEFAULT_STALL_AFTER_MS as q, promptResourceProfileMaterialization as qt, bestDelivered as r, routerBrain as rt, runTree as s, readTraceContextFromEnv as st, createRootHandle as t, probeSandboxCapabilities as tt, createScope as u, buildLoopOtelSpans as ut, timerAt as v, loopEventToOtelSpan as vt, rollingDispatch as w, sanitizeAgentRuntimeEvent as wt, effectiveConcurrency as x, toOtelAttributes as xt, validateWaitSpec as y, padSpanId as yt, workerTraceEnv as z, assertProfileMaterialization as zt };
 
-//# sourceMappingURL=supervisor-Dr3AoSh0.js.map
+//# sourceMappingURL=supervisor-B9BzXJu9.js.map