@tangle-network/agent-runtime 0.134.7 → 0.134.8

package/dist/run-layout-Be_Z0dF8.js

@@ -0,0 +1,288 @@
+import { randomUUID } from "node:crypto";
+import { join, resolve } from "node:path";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+//#region src/runtime/supervise/run-layout.ts
+/**
+* The on-disk supervisor-run layout: `<root>/.agent/supervisor/<id>`.
+*
+* This is the durable, cross-process face of a supervisor run — the counterpart to the in-process
+* `Inbox` seam in `./inbox`. A run persists its state under one directory so that any OTHER process
+* can find it after the fact: `@tangle-network/traces` reads exactly this layout via
+* `traces analyze --supervisor-run-dir`, a restarted host can rehydrate a run it no longer holds
+* handles to, and a human can steer a live worker by appending one NDJSON line. Until now the
+* layout was defined only in the unpublished `loops` repo (`src/supervisor-control.ts`) — a
+* published reader depending on an unpublished writer's convention — so the contract is promoted
+* here, names preserved.
+*
+* `.agent` is the one dot-dir for ALL agent-owned state (skills already write
+* `.agent/hypotheses/`, `.agent/skill-runs.jsonl`); supervisor runs live beside them rather than
+* under a product-branded dir. Runs written by older writers used `.loops/supervisor/<id>` —
+* readers that must see those keep a legacy fallback; this writer never creates `.loops` again.
+*
+* Layout, relative to `supervisorRunDir(root, id)`:
+*
+*   workers/<label>.inbox.ndjson   down-leg steer/answer requests for one worker (durable inbox);
+*                                  each line is a {@link WorkerSteerRequest}
+*   workers/<label>.ndjson         best-effort per-worker control-event log (delivery bookkeeping)
+*   cancellations/requests.ndjson  worker-scoped cancel requests (durable inbox); each line is a
+*                                  {@link WorkerCancelRequest}
+*   cancellations/<opId>.json      the acknowledgement for one cancel operation — a
+*                                  {@link WorkerCancellation} written ONLY by the runtime
+*                                  acknowledger (the coordination driver's turn loop)
+*
+* Reads are tolerant by contract: a partial trailing line (a writer mid-append) or a corrupt line
+* never poisons the rest of the file — later valid lines still matter.
+*
+* Promoted from `loops/src/supervisor-control.ts`. The one deliberate difference: the loops version
+* resolved a worker id to its label through the run journal before writing a steer; that resolution
+* stays with the caller (it is journal-format-specific), so `writeWorkerSteer` here takes the worker
+* LABEL directly.
+*
+* @experimental
+*/
+/** The root every supervisor run of one workspace lives under. */
+function supervisorRunsRoot(rootDir) {
+	return join(resolve(rootDir), ".agent", "supervisor");
+}
+/** The run directory every artifact of one supervisor run lives under. */
+function supervisorRunDir(rootDir, id) {
+	return join(supervisorRunsRoot(rootDir), id);
+}
+/**
+* Where a pre-rename writer put the same run (`<root>/.loops/supervisor/<id>`). Readers that must
+* see historical runs check {@link supervisorRunDir} first and fall back to this; nothing writes
+* here anymore.
+*/
+function legacySupervisorRunDir(rootDir, id) {
+	return join(legacySupervisorRunsRoot(rootDir), id);
+}
+/**
+* The pre-rename runs root (`<root>/.loops/supervisor`). Only readers that ENUMERATE historical
+* runs need this — the per-id form is {@link legacySupervisorRunDir}. Nothing writes here.
+*/
+function legacySupervisorRunsRoot(rootDir) {
+	return join(resolve(rootDir), ".loops", "supervisor");
+}
+/** A worker label reduced to a safe filename stem. Empty labels get a stable fallback. */
+function safeWorkerFile(label) {
+	const safe = label.replace(/[^A-Za-z0-9._-]/g, "_");
+	return safe.length > 0 ? safe : "worker";
+}
+/** The directory holding every per-worker file of one run (inboxes and control-event logs). */
+function supervisorWorkersDir(eventDir) {
+	return join(eventDir, "workers");
+}
+/** The durable inbox file for one worker of one run. */
+function workerInboxFile(rootDir, supervisorId, worker) {
+	return workerInboxFileFromEventDir(supervisorRunDir(rootDir, supervisorId), worker);
+}
+/** Same, addressed from an already-known run directory (the reader's usual entry point). */
+function workerInboxFileFromEventDir(eventDir, worker) {
+	return join(supervisorWorkersDir(eventDir), `${safeWorkerFile(worker)}.inbox.ndjson`);
+}
+/**
+* The best-effort control-event log for one worker (`workers/<label>.ndjson`) — delivery
+* bookkeeping for steers, plus whatever lifecycle events a writer chooses to append. Distinct from
+* the inbox: the inbox is the durable down-leg queue, this is the record of what happened to it.
+*/
+function workerControlLogFile(eventDir, worker) {
+	return join(supervisorWorkersDir(eventDir), `${safeWorkerFile(worker)}.ndjson`);
+}
+/**
+* Durably append one steer request to a worker's inbox and log the delivery attempt.
+*
+* The inbox append is the durable act; the control-event log is best-effort bookkeeping and may
+* silently fail without voiding the steer.
+*/
+function writeWorkerSteer(rootDir, supervisorId, worker, message, source = "human") {
+	const trimmed = message.trim();
+	if (!trimmed) throw new Error("steer message is empty");
+	const dir = supervisorRunDir(rootDir, supervisorId);
+	mkdirSync(supervisorWorkersDir(dir), { recursive: true });
+	const request = {
+		id: randomUUID(),
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		source,
+		worker,
+		message: trimmed
+	};
+	const file = workerInboxFile(rootDir, supervisorId, worker);
+	appendFileSync(file, `${JSON.stringify(request)}\n`, "utf8");
+	appendWorkerControlEvent(dir, worker, {
+		kind: "message",
+		direction: "down",
+		source,
+		requestId: request.id,
+		message: trimmed,
+		queued: true,
+		delivered: false
+	});
+	return {
+		worker,
+		file,
+		request
+	};
+}
+/** Read every valid steer request in a worker's inbox. Corrupt or partial lines are skipped. */
+function readWorkerSteerRequests(eventDir, worker) {
+	const file = workerInboxFileFromEventDir(eventDir, worker);
+	if (!existsSync(file)) return [];
+	const out = [];
+	let raw = "";
+	try {
+		raw = readFileSync(file, "utf8");
+	} catch {
+		return out;
+	}
+	for (const line of raw.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		try {
+			const parsed = JSON.parse(trimmed);
+			if (isWorkerSteerRequest(parsed)) out.push(parsed);
+		} catch {}
+	}
+	return out;
+}
+/** The directory holding every cancellation artifact of one run (request inbox + acknowledgements). */
+function workerCancellationsDir(eventDir) {
+	return join(eventDir, "cancellations");
+}
+/** The durable cancel-request inbox of one run — one NDJSON line per {@link WorkerCancelRequest}. */
+function workerCancelRequestsFile(eventDir) {
+	return join(workerCancellationsDir(eventDir), "requests.ndjson");
+}
+/**
+* The acknowledgement file for one cancel operation. The filename is a sanitized stem of the
+* `operationId`; the record inside carries the exact id, and readers verify it so two distinct
+* ids that sanitize to one stem fail loud instead of answering for each other.
+*/
+function workerCancellationFile(eventDir, operationId) {
+	return join(workerCancellationsDir(eventDir), `${safeOperationFile(operationId)}.json`);
+}
+function safeOperationFile(operationId) {
+	const safe = operationId.replace(/[^A-Za-z0-9._-]/g, "_");
+	if (safe.length === 0) throw new Error("cancel operationId is empty");
+	return safe;
+}
+/** Read every valid cancel request in the run's cancellation inbox. Corrupt lines are skipped. */
+function readWorkerCancelRequests(eventDir) {
+	const file = workerCancelRequestsFile(eventDir);
+	if (!existsSync(file)) return [];
+	const out = [];
+	let raw = "";
+	try {
+		raw = readFileSync(file, "utf8");
+	} catch {
+		return out;
+	}
+	for (const line of raw.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		try {
+			const parsed = JSON.parse(trimmed);
+			if (isWorkerCancelRequest(parsed)) out.push(parsed);
+		} catch {}
+	}
+	return out;
+}
+/**
+* Read the acknowledgement for one cancel operation. `undefined` when the runtime has not
+* answered. A record whose stored `operationId` differs from the requested one is a filename
+* collision between two sanitized ids — fail loud rather than return another operation's answer.
+*/
+function readWorkerCancellation(eventDir, operationId) {
+	const file = workerCancellationFile(eventDir, operationId);
+	if (!existsSync(file)) return void 0;
+	const parsed = JSON.parse(readFileSync(file, "utf8"));
+	if (parsed.operationId !== operationId) throw new Error(`cancel acknowledgement collision: '${file}' holds operation '${parsed.operationId}', not '${operationId}' — use operation ids that stay distinct after filename sanitization`);
+	return parsed;
+}
+/**
+* Durably write one acknowledgement record. Write-then-rename, so a concurrent reader sees the
+* prior complete record or the new complete record, never a partial file.
+*
+* @internal The runtime acknowledger is the only intended writer; clients read via
+* {@link readWorkerCancellation} or {@link cancelWorker}.
+*/
+function writeWorkerCancellation(eventDir, record) {
+	mkdirSync(workerCancellationsDir(eventDir), { recursive: true });
+	const file = workerCancellationFile(eventDir, record.operationId);
+	const tmp = `${file}.${randomUUID()}.tmp`;
+	writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`, "utf8");
+	renameSync(tmp, file);
+}
+/**
+* Request the cancellation of ONE worker, idempotently, and return the operation's current
+* durable state.
+*
+* The write half of the acknowledged-cancellation contract (`writeWorkerSteer` is the steer
+* analog): append the request to the run's cancellation inbox, where the runtime's acknowledger
+* (the coordination driver's turn loop) applies it — aborting exactly that worker's subtree and
+* recording what it proved. This function never applies the cancellation itself; writing a
+* request file is not an acknowledgement.
+*
+* Idempotency is a lookup: when an acknowledgement for `operationId` already exists, it is
+* returned AS-IS and nothing is appended — repeating one operation can never apply twice. A
+* request the runtime has not answered yet returns `effect: 'unknown'` (never a success); call
+* again with the same `operationId` — or `readWorkerCancellation` — to read the acknowledged
+* result after a reconnect.
+*/
+function cancelWorker(eventDir, worker, operationId, options = {}) {
+	const ref = worker.trim();
+	if (!ref) throw new Error("cancelWorker: worker reference is empty");
+	const opId = operationId.trim();
+	if (!opId) throw new Error("cancelWorker: operationId is empty");
+	const acknowledged = readWorkerCancellation(eventDir, opId);
+	if (acknowledged) return acknowledged;
+	const source = options.source ?? "human";
+	const pending = readWorkerCancelRequests(eventDir).find((r) => r.operationId === opId);
+	const request = pending ?? {
+		operationId: opId,
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		source,
+		worker: ref,
+		...options.reason === void 0 ? {} : { reason: options.reason }
+	};
+	if (!pending) {
+		mkdirSync(workerCancellationsDir(eventDir), { recursive: true });
+		appendFileSync(workerCancelRequestsFile(eventDir), `${JSON.stringify(request)}\n`, "utf8");
+		appendWorkerControlEvent(eventDir, ref, {
+			kind: "cancel-request",
+			operationId: opId,
+			source,
+			queued: true,
+			...options.reason === void 0 ? {} : { reason: options.reason }
+		});
+	}
+	return {
+		operationId: opId,
+		worker: request.worker,
+		effect: "unknown",
+		requestedAt: request.at,
+		observedAt: request.at,
+		...request.reason === void 0 ? {} : { reason: request.reason },
+		detail: "request queued; no runtime acknowledger has answered yet",
+		terminated: []
+	};
+}
+function isWorkerCancelRequest(value) {
+	return typeof value.operationId === "string" && value.operationId.length > 0 && typeof value.at === "string" && typeof value.source === "string" && typeof value.worker === "string" && value.worker.length > 0 && (value.reason === void 0 || typeof value.reason === "string");
+}
+function appendWorkerControlEvent(eventDir, label, event) {
+	try {
+		mkdirSync(supervisorWorkersDir(eventDir), { recursive: true });
+		appendFileSync(workerControlLogFile(eventDir, label), `${JSON.stringify({
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			label,
+			...event
+		})}\n`, "utf8");
+	} catch {}
+}
+function isWorkerSteerRequest(value) {
+	return typeof value.id === "string" && typeof value.at === "string" && typeof value.source === "string" && typeof value.worker === "string" && typeof value.message === "string" && value.message.trim().length > 0;
+}
+//#endregion
+export { writeWorkerCancellation as _, readWorkerCancellation as a, supervisorRunDir as c, workerCancelRequestsFile as d, workerCancellationFile as f, workerInboxFileFromEventDir as g, workerInboxFile as h, readWorkerCancelRequests as i, supervisorRunsRoot as l, workerControlLogFile as m, legacySupervisorRunDir as n, readWorkerSteerRequests as o, workerCancellationsDir as p, legacySupervisorRunsRoot as r, safeWorkerFile as s, cancelWorker as t, supervisorWorkersDir as u, writeWorkerSteer as v };
+
+//# sourceMappingURL=run-layout-Be_Z0dF8.js.map

package/dist/run-layout-Be_Z0dF8.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-layout-Be_Z0dF8.js","names":[],"sources":["../src/runtime/supervise/run-layout.ts"],"sourcesContent":["/**\n * The on-disk supervisor-run layout: `<root>/.agent/supervisor/<id>`.\n *\n * This is the durable, cross-process face of a supervisor run — the counterpart to the in-process\n * `Inbox` seam in `./inbox`. A run persists its state under one directory so that any OTHER process\n * can find it after the fact: `@tangle-network/traces` reads exactly this layout via\n * `traces analyze --supervisor-run-dir`, a restarted host can rehydrate a run it no longer holds\n * handles to, and a human can steer a live worker by appending one NDJSON line. Until now the\n * layout was defined only in the unpublished `loops` repo (`src/supervisor-control.ts`) — a\n * published reader depending on an unpublished writer's convention — so the contract is promoted\n * here, names preserved.\n *\n * `.agent` is the one dot-dir for ALL agent-owned state (skills already write\n * `.agent/hypotheses/`, `.agent/skill-runs.jsonl`); supervisor runs live beside them rather than\n * under a product-branded dir. Runs written by older writers used `.loops/supervisor/<id>` —\n * readers that must see those keep a legacy fallback; this writer never creates `.loops` again.\n *\n * Layout, relative to `supervisorRunDir(root, id)`:\n *\n *   workers/<label>.inbox.ndjson   down-leg steer/answer requests for one worker (durable inbox);\n *                                  each line is a {@link WorkerSteerRequest}\n *   workers/<label>.ndjson         best-effort per-worker control-event log (delivery bookkeeping)\n *   cancellations/requests.ndjson  worker-scoped cancel requests (durable inbox); each line is a\n *                                  {@link WorkerCancelRequest}\n *   cancellations/<opId>.json      the acknowledgement for one cancel operation — a\n *                                  {@link WorkerCancellation} written ONLY by the runtime\n *                                  acknowledger (the coordination driver's turn loop)\n *\n * Reads are tolerant by contract: a partial trailing line (a writer mid-append) or a corrupt line\n * never poisons the rest of the file — later valid lines still matter.\n *\n * Promoted from `loops/src/supervisor-control.ts`. The one deliberate difference: the loops version\n * resolved a worker id to its label through the run journal before writing a steer; that resolution\n * stays with the caller (it is journal-format-specific), so `writeWorkerSteer` here takes the worker\n * LABEL directly.\n *\n * @experimental\n */\n\nimport { randomUUID } from 'node:crypto'\nimport {\n  appendFileSync,\n  existsSync,\n  mkdirSync,\n  readFileSync,\n  renameSync,\n  writeFileSync,\n} from 'node:fs'\nimport { join, resolve } from 'node:path'\nimport type { RetainedRunEffect } from '../retained-run-types'\n\n/** One durable down-leg request appended to a worker's inbox file. */\nexport interface WorkerSteerRequest {\n  readonly id: string\n  /** ISO timestamp of the append. */\n  readonly at: string\n  /** Who asked — 'human', a brain label, a tool name. Provenance, not authorization. */\n  readonly source: string\n  /** The worker LABEL the request targets (already resolved by the caller). */\n  readonly worker: string\n  readonly message: string\n}\n\n/** One durable worker-scoped cancel request appended to the run's cancellation inbox. */\nexport interface WorkerCancelRequest {\n  /** Caller-minted stable operation identifier — the idempotency key of the whole operation. */\n  readonly operationId: string\n  /** ISO timestamp of the append. */\n  readonly at: string\n  /** Who asked — 'human', a brain label, a tool name. Provenance, not authorization. */\n  readonly source: string\n  /** The worker the request targets: a workerId (node id), a profile name, or a spawn label. */\n  readonly worker: string\n  readonly reason?: string\n}\n\n/**\n * The durable acknowledgement state for one worker-scoped cancel operation, keyed by\n * `operationId`. The runtime acknowledger is the ONLY writer; `cancelWorker` only reads it.\n *\n * `effect` reuses the retained-run vocabulary ({@link RetainedRunEffect}) so the runtime has one\n * spelling of the four cancellation states:\n *  - `'unknown'`          — not yet resolved by the runtime (also what `cancelWorker` returns for\n *                           a request no acknowledger has answered). Never a success.\n *  - `'cancel_requested'` — the runtime issued the worker's abort; termination not yet proven.\n *  - `'cancelled'`        — the worker reached a terminal `down` state on the settle path.\n *  - `'not_live'`         — the worker was not live to cancel (already settled, or it settled\n *                           `done` despite the abort). Never a success of THIS operation.\n */\nexport interface WorkerCancellation {\n  readonly operationId: string\n  /** The worker reference exactly as requested. */\n  readonly worker: string\n  readonly effect: RetainedRunEffect\n  /** ISO timestamp of the original request. */\n  readonly requestedAt: string\n  /** ISO timestamp of the runtime's most recent observation of this operation. */\n  readonly observedAt: string\n  /** The node id the acknowledger resolved `worker` to, once resolved. */\n  readonly workerId?: string\n  /** The caller's reason, carried verbatim from the request. */\n  readonly reason?: string\n  /** The runtime's explanation of how it arrived at `effect`. */\n  readonly detail?: string\n  /**\n   * Every node id this operation PROVED terminated: the requested worker plus each descendant of\n   * its subtree observed to reach a terminal `down`/`cancelled` journal record at or after\n   * `requestedAt` (a cancelled lead cascades to its subtree by design — the scope signal chain —\n   * so the acknowledgement names the set, not one id). Empty until termination is proven.\n   */\n  readonly terminated: ReadonlyArray<string>\n}\n\n/** The root every supervisor run of one workspace lives under. */\nexport function supervisorRunsRoot(rootDir: string): string {\n  return join(resolve(rootDir), '.agent', 'supervisor')\n}\n\n/** The run directory every artifact of one supervisor run lives under. */\nexport function supervisorRunDir(rootDir: string, id: string): string {\n  return join(supervisorRunsRoot(rootDir), id)\n}\n\n/**\n * Where a pre-rename writer put the same run (`<root>/.loops/supervisor/<id>`). Readers that must\n * see historical runs check {@link supervisorRunDir} first and fall back to this; nothing writes\n * here anymore.\n */\nexport function legacySupervisorRunDir(rootDir: string, id: string): string {\n  return join(legacySupervisorRunsRoot(rootDir), id)\n}\n\n/**\n * The pre-rename runs root (`<root>/.loops/supervisor`). Only readers that ENUMERATE historical\n * runs need this — the per-id form is {@link legacySupervisorRunDir}. Nothing writes here.\n */\nexport function legacySupervisorRunsRoot(rootDir: string): string {\n  return join(resolve(rootDir), '.loops', 'supervisor')\n}\n\n/** A worker label reduced to a safe filename stem. Empty labels get a stable fallback. */\nexport function safeWorkerFile(label: string): string {\n  const safe = label.replace(/[^A-Za-z0-9._-]/g, '_')\n  return safe.length > 0 ? safe : 'worker'\n}\n\n/** The directory holding every per-worker file of one run (inboxes and control-event logs). */\nexport function supervisorWorkersDir(eventDir: string): string {\n  return join(eventDir, 'workers')\n}\n\n/** The durable inbox file for one worker of one run. */\nexport function workerInboxFile(rootDir: string, supervisorId: string, worker: string): string {\n  return workerInboxFileFromEventDir(supervisorRunDir(rootDir, supervisorId), worker)\n}\n\n/** Same, addressed from an already-known run directory (the reader's usual entry point). */\nexport function workerInboxFileFromEventDir(eventDir: string, worker: string): string {\n  return join(supervisorWorkersDir(eventDir), `${safeWorkerFile(worker)}.inbox.ndjson`)\n}\n\n/**\n * The best-effort control-event log for one worker (`workers/<label>.ndjson`) — delivery\n * bookkeeping for steers, plus whatever lifecycle events a writer chooses to append. Distinct from\n * the inbox: the inbox is the durable down-leg queue, this is the record of what happened to it.\n */\nexport function workerControlLogFile(eventDir: string, worker: string): string {\n  return join(supervisorWorkersDir(eventDir), `${safeWorkerFile(worker)}.ndjson`)\n}\n\n/**\n * Durably append one steer request to a worker's inbox and log the delivery attempt.\n *\n * The inbox append is the durable act; the control-event log is best-effort bookkeeping and may\n * silently fail without voiding the steer.\n */\nexport function writeWorkerSteer(\n  rootDir: string,\n  supervisorId: string,\n  worker: string,\n  message: string,\n  source = 'human',\n): { worker: string; file: string; request: WorkerSteerRequest } {\n  const trimmed = message.trim()\n  if (!trimmed) throw new Error('steer message is empty')\n  const dir = supervisorRunDir(rootDir, supervisorId)\n  mkdirSync(supervisorWorkersDir(dir), { recursive: true })\n  const request: WorkerSteerRequest = {\n    id: randomUUID(),\n    at: new Date().toISOString(),\n    source,\n    worker,\n    message: trimmed,\n  }\n  const file = workerInboxFile(rootDir, supervisorId, worker)\n  appendFileSync(file, `${JSON.stringify(request)}\\n`, 'utf8')\n  appendWorkerControlEvent(dir, worker, {\n    kind: 'message',\n    direction: 'down',\n    source,\n    requestId: request.id,\n    message: trimmed,\n    queued: true,\n    delivered: false,\n  })\n  return { worker, file, request }\n}\n\n/** Read every valid steer request in a worker's inbox. Corrupt or partial lines are skipped. */\nexport function readWorkerSteerRequests(eventDir: string, worker: string): WorkerSteerRequest[] {\n  const file = workerInboxFileFromEventDir(eventDir, worker)\n  if (!existsSync(file)) return []\n  const out: WorkerSteerRequest[] = []\n  let raw = ''\n  try {\n    raw = readFileSync(file, 'utf8')\n  } catch {\n    return out\n  }\n  for (const line of raw.split('\\n')) {\n    const trimmed = line.trim()\n    if (!trimmed) continue\n    try {\n      const parsed = JSON.parse(trimmed) as Partial<WorkerSteerRequest>\n      if (isWorkerSteerRequest(parsed)) out.push(parsed)\n    } catch {\n      // Ignore partial or corrupt input lines; later valid lines still matter.\n    }\n  }\n  return out\n}\n\n/** The directory holding every cancellation artifact of one run (request inbox + acknowledgements). */\nexport function workerCancellationsDir(eventDir: string): string {\n  return join(eventDir, 'cancellations')\n}\n\n/** The durable cancel-request inbox of one run — one NDJSON line per {@link WorkerCancelRequest}. */\nexport function workerCancelRequestsFile(eventDir: string): string {\n  return join(workerCancellationsDir(eventDir), 'requests.ndjson')\n}\n\n/**\n * The acknowledgement file for one cancel operation. The filename is a sanitized stem of the\n * `operationId`; the record inside carries the exact id, and readers verify it so two distinct\n * ids that sanitize to one stem fail loud instead of answering for each other.\n */\nexport function workerCancellationFile(eventDir: string, operationId: string): string {\n  return join(workerCancellationsDir(eventDir), `${safeOperationFile(operationId)}.json`)\n}\n\nfunction safeOperationFile(operationId: string): string {\n  const safe = operationId.replace(/[^A-Za-z0-9._-]/g, '_')\n  if (safe.length === 0) throw new Error('cancel operationId is empty')\n  return safe\n}\n\n/** Read every valid cancel request in the run's cancellation inbox. Corrupt lines are skipped. */\nexport function readWorkerCancelRequests(eventDir: string): WorkerCancelRequest[] {\n  const file = workerCancelRequestsFile(eventDir)\n  if (!existsSync(file)) return []\n  const out: WorkerCancelRequest[] = []\n  let raw = ''\n  try {\n    raw = readFileSync(file, 'utf8')\n  } catch {\n    return out\n  }\n  for (const line of raw.split('\\n')) {\n    const trimmed = line.trim()\n    if (!trimmed) continue\n    try {\n      const parsed = JSON.parse(trimmed) as Partial<WorkerCancelRequest>\n      if (isWorkerCancelRequest(parsed)) out.push(parsed)\n    } catch {\n      // Ignore partial or corrupt input lines; later valid lines still matter.\n    }\n  }\n  return out\n}\n\n/**\n * Read the acknowledgement for one cancel operation. `undefined` when the runtime has not\n * answered. A record whose stored `operationId` differs from the requested one is a filename\n * collision between two sanitized ids — fail loud rather than return another operation's answer.\n */\nexport function readWorkerCancellation(\n  eventDir: string,\n  operationId: string,\n): WorkerCancellation | undefined {\n  const file = workerCancellationFile(eventDir, operationId)\n  if (!existsSync(file)) return undefined\n  const parsed = JSON.parse(readFileSync(file, 'utf8')) as WorkerCancellation\n  if (parsed.operationId !== operationId) {\n    throw new Error(\n      `cancel acknowledgement collision: '${file}' holds operation '${parsed.operationId}', ` +\n        `not '${operationId}' — use operation ids that stay distinct after filename sanitization`,\n    )\n  }\n  return parsed\n}\n\n/**\n * Durably write one acknowledgement record. Write-then-rename, so a concurrent reader sees the\n * prior complete record or the new complete record, never a partial file.\n *\n * @internal The runtime acknowledger is the only intended writer; clients read via\n * {@link readWorkerCancellation} or {@link cancelWorker}.\n */\nexport function writeWorkerCancellation(eventDir: string, record: WorkerCancellation): void {\n  const dir = workerCancellationsDir(eventDir)\n  mkdirSync(dir, { recursive: true })\n  const file = workerCancellationFile(eventDir, record.operationId)\n  const tmp = `${file}.${randomUUID()}.tmp`\n  writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\\n`, 'utf8')\n  renameSync(tmp, file)\n}\n\n/**\n * Request the cancellation of ONE worker, idempotently, and return the operation's current\n * durable state.\n *\n * The write half of the acknowledged-cancellation contract (`writeWorkerSteer` is the steer\n * analog): append the request to the run's cancellation inbox, where the runtime's acknowledger\n * (the coordination driver's turn loop) applies it — aborting exactly that worker's subtree and\n * recording what it proved. This function never applies the cancellation itself; writing a\n * request file is not an acknowledgement.\n *\n * Idempotency is a lookup: when an acknowledgement for `operationId` already exists, it is\n * returned AS-IS and nothing is appended — repeating one operation can never apply twice. A\n * request the runtime has not answered yet returns `effect: 'unknown'` (never a success); call\n * again with the same `operationId` — or `readWorkerCancellation` — to read the acknowledged\n * result after a reconnect.\n */\nexport function cancelWorker(\n  eventDir: string,\n  worker: string,\n  operationId: string,\n  options: { readonly reason?: string; readonly source?: string } = {},\n): WorkerCancellation {\n  const ref = worker.trim()\n  if (!ref) throw new Error('cancelWorker: worker reference is empty')\n  const opId = operationId.trim()\n  if (!opId) throw new Error('cancelWorker: operationId is empty')\n  const acknowledged = readWorkerCancellation(eventDir, opId)\n  if (acknowledged) return acknowledged\n  const source = options.source ?? 'human'\n  const pending = readWorkerCancelRequests(eventDir).find((r) => r.operationId === opId)\n  const request: WorkerCancelRequest = pending ?? {\n    operationId: opId,\n    at: new Date().toISOString(),\n    source,\n    worker: ref,\n    ...(options.reason === undefined ? {} : { reason: options.reason }),\n  }\n  if (!pending) {\n    mkdirSync(workerCancellationsDir(eventDir), { recursive: true })\n    appendFileSync(workerCancelRequestsFile(eventDir), `${JSON.stringify(request)}\\n`, 'utf8')\n    appendWorkerControlEvent(eventDir, ref, {\n      kind: 'cancel-request',\n      operationId: opId,\n      source,\n      queued: true,\n      ...(options.reason === undefined ? {} : { reason: options.reason }),\n    })\n  }\n  return {\n    operationId: opId,\n    worker: request.worker,\n    effect: 'unknown',\n    requestedAt: request.at,\n    observedAt: request.at,\n    ...(request.reason === undefined ? {} : { reason: request.reason }),\n    detail: 'request queued; no runtime acknowledger has answered yet',\n    terminated: [],\n  }\n}\n\nfunction isWorkerCancelRequest(value: Partial<WorkerCancelRequest>): value is WorkerCancelRequest {\n  return (\n    typeof value.operationId === 'string' &&\n    value.operationId.length > 0 &&\n    typeof value.at === 'string' &&\n    typeof value.source === 'string' &&\n    typeof value.worker === 'string' &&\n    value.worker.length > 0 &&\n    (value.reason === undefined || typeof value.reason === 'string')\n  )\n}\n\nfunction appendWorkerControlEvent(\n  eventDir: string,\n  label: string,\n  event: Record<string, unknown>,\n): void {\n  try {\n    mkdirSync(supervisorWorkersDir(eventDir), { recursive: true })\n    appendFileSync(\n      workerControlLogFile(eventDir, label),\n      `${JSON.stringify({ at: new Date().toISOString(), label, ...event })}\\n`,\n      'utf8',\n    )\n  } catch {\n    // Control logging is best-effort; the inbox write above is the durable part.\n  }\n}\n\nfunction isWorkerSteerRequest(value: Partial<WorkerSteerRequest>): value is WorkerSteerRequest {\n  return (\n    typeof value.id === 'string' &&\n    typeof value.at === 'string' &&\n    typeof value.source === 'string' &&\n    typeof value.worker === 'string' &&\n    typeof value.message === 'string' &&\n    value.message.trim().length > 0\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkHA,SAAgB,mBAAmB,SAAyB;CAC1D,OAAO,KAAK,QAAQ,OAAO,GAAG,UAAU,YAAY;AACtD;;AAGA,SAAgB,iBAAiB,SAAiB,IAAoB;CACpE,OAAO,KAAK,mBAAmB,OAAO,GAAG,EAAE;AAC7C;;;;;;AAOA,SAAgB,uBAAuB,SAAiB,IAAoB;CAC1E,OAAO,KAAK,yBAAyB,OAAO,GAAG,EAAE;AACnD;;;;;AAMA,SAAgB,yBAAyB,SAAyB;CAChE,OAAO,KAAK,QAAQ,OAAO,GAAG,UAAU,YAAY;AACtD;;AAGA,SAAgB,eAAe,OAAuB;CACpD,MAAM,OAAO,MAAM,QAAQ,oBAAoB,GAAG;CAClD,OAAO,KAAK,SAAS,IAAI,OAAO;AAClC;;AAGA,SAAgB,qBAAqB,UAA0B;CAC7D,OAAO,KAAK,UAAU,SAAS;AACjC;;AAGA,SAAgB,gBAAgB,SAAiB,cAAsB,QAAwB;CAC7F,OAAO,4BAA4B,iBAAiB,SAAS,YAAY,GAAG,MAAM;AACpF;;AAGA,SAAgB,4BAA4B,UAAkB,QAAwB;CACpF,OAAO,KAAK,qBAAqB,QAAQ,GAAG,GAAG,eAAe,MAAM,EAAE,cAAc;AACtF;;;;;;AAOA,SAAgB,qBAAqB,UAAkB,QAAwB;CAC7E,OAAO,KAAK,qBAAqB,QAAQ,GAAG,GAAG,eAAe,MAAM,EAAE,QAAQ;AAChF;;;;;;;AAQA,SAAgB,iBACd,SACA,cACA,QACA,SACA,SAAS,SACsD;CAC/D,MAAM,UAAU,QAAQ,KAAK;CAC7B,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wBAAwB;CACtD,MAAM,MAAM,iBAAiB,SAAS,YAAY;CAClD,UAAU,qBAAqB,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;CACxD,MAAM,UAA8B;EAClC,IAAI,WAAW;EACf,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;EAC3B;EACA;EACA,SAAS;CACX;CACA,MAAM,OAAO,gBAAgB,SAAS,cAAc,MAAM;CAC1D,eAAe,MAAM,GAAG,KAAK,UAAU,OAAO,EAAE,KAAK,MAAM;CAC3D,yBAAyB,KAAK,QAAQ;EACpC,MAAM;EACN,WAAW;EACX;EACA,WAAW,QAAQ;EACnB,SAAS;EACT,QAAQ;EACR,WAAW;CACb,CAAC;CACD,OAAO;EAAE;EAAQ;EAAM;CAAQ;AACjC;;AAGA,SAAgB,wBAAwB,UAAkB,QAAsC;CAC9F,MAAM,OAAO,4BAA4B,UAAU,MAAM;CACzD,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO,CAAC;CAC/B,MAAM,MAA4B,CAAC;CACnC,IAAI,MAAM;CACV,IAAI;EACF,MAAM,aAAa,MAAM,MAAM;CACjC,QAAQ;EACN,OAAO;CACT;CACA,KAAK,MAAM,QAAQ,IAAI,MAAM,IAAI,GAAG;EAClC,MAAM,UAAU,KAAK,KAAK;EAC1B,IAAI,CAAC,SAAS;EACd,IAAI;GACF,MAAM,SAAS,KAAK,MAAM,OAAO;GACjC,IAAI,qBAAqB,MAAM,GAAG,IAAI,KAAK,MAAM;EACnD,QAAQ,CAER;CACF;CACA,OAAO;AACT;;AAGA,SAAgB,uBAAuB,UAA0B;CAC/D,OAAO,KAAK,UAAU,eAAe;AACvC;;AAGA,SAAgB,yBAAyB,UAA0B;CACjE,OAAO,KAAK,uBAAuB,QAAQ,GAAG,iBAAiB;AACjE;;;;;;AAOA,SAAgB,uBAAuB,UAAkB,aAA6B;CACpF,OAAO,KAAK,uBAAuB,QAAQ,GAAG,GAAG,kBAAkB,WAAW,EAAE,MAAM;AACxF;AAEA,SAAS,kBAAkB,aAA6B;CACtD,MAAM,OAAO,YAAY,QAAQ,oBAAoB,GAAG;CACxD,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,6BAA6B;CACpE,OAAO;AACT;;AAGA,SAAgB,yBAAyB,UAAyC;CAChF,MAAM,OAAO,yBAAyB,QAAQ;CAC9C,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO,CAAC;CAC/B,MAAM,MAA6B,CAAC;CACpC,IAAI,MAAM;CACV,IAAI;EACF,MAAM,aAAa,MAAM,MAAM;CACjC,QAAQ;EACN,OAAO;CACT;CACA,KAAK,MAAM,QAAQ,IAAI,MAAM,IAAI,GAAG;EAClC,MAAM,UAAU,KAAK,KAAK;EAC1B,IAAI,CAAC,SAAS;EACd,IAAI;GACF,MAAM,SAAS,KAAK,MAAM,OAAO;GACjC,IAAI,sBAAsB,MAAM,GAAG,IAAI,KAAK,MAAM;EACpD,QAAQ,CAER;CACF;CACA,OAAO;AACT;;;;;;AAOA,SAAgB,uBACd,UACA,aACgC;CAChC,MAAM,OAAO,uBAAuB,UAAU,WAAW;CACzD,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO,KAAA;CAC9B,MAAM,SAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;CACpD,IAAI,OAAO,gBAAgB,aACzB,MAAM,IAAI,MACR,sCAAsC,KAAK,qBAAqB,OAAO,YAAY,UACzE,YAAY,qEACxB;CAEF,OAAO;AACT;;;;;;;;AASA,SAAgB,wBAAwB,UAAkB,QAAkC;CAE1F,UADY,uBAAuB,QACvB,GAAG,EAAE,WAAW,KAAK,CAAC;CAClC,MAAM,OAAO,uBAAuB,UAAU,OAAO,WAAW;CAChE,MAAM,MAAM,GAAG,KAAK,GAAG,WAAW,EAAE;CACpC,cAAc,KAAK,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,KAAK,MAAM;CACjE,WAAW,KAAK,IAAI;AACtB;;;;;;;;;;;;;;;;;AAkBA,SAAgB,aACd,UACA,QACA,aACA,UAAkE,CAAC,GAC/C;CACpB,MAAM,MAAM,OAAO,KAAK;CACxB,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,yCAAyC;CACnE,MAAM,OAAO,YAAY,KAAK;CAC9B,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,oCAAoC;CAC/D,MAAM,eAAe,uBAAuB,UAAU,IAAI;CAC1D,IAAI,cAAc,OAAO;CACzB,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,UAAU,yBAAyB,QAAQ,CAAC,CAAC,MAAM,MAAM,EAAE,gBAAgB,IAAI;CACrF,MAAM,UAA+B,WAAW;EAC9C,aAAa;EACb,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;EAC3B;EACA,QAAQ;EACR,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;CACnE;CACA,IAAI,CAAC,SAAS;EACZ,UAAU,uBAAuB,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EAC/D,eAAe,yBAAyB,QAAQ,GAAG,GAAG,KAAK,UAAU,OAAO,EAAE,KAAK,MAAM;EACzF,yBAAyB,UAAU,KAAK;GACtC,MAAM;GACN,aAAa;GACb;GACA,QAAQ;GACR,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;EACnE,CAAC;CACH;CACA,OAAO;EACL,aAAa;EACb,QAAQ,QAAQ;EAChB,QAAQ;EACR,aAAa,QAAQ;EACrB,YAAY,QAAQ;EACpB,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;EACjE,QAAQ;EACR,YAAY,CAAC;CACf;AACF;AAEA,SAAS,sBAAsB,OAAmE;CAChG,OACE,OAAO,MAAM,gBAAgB,YAC7B,MAAM,YAAY,SAAS,KAC3B,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,WAAW,YACxB,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,SAAS,MACrB,MAAM,WAAW,KAAA,KAAa,OAAO,MAAM,WAAW;AAE3D;AAEA,SAAS,yBACP,UACA,OACA,OACM;CACN,IAAI;EACF,UAAU,qBAAqB,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EAC7D,eACE,qBAAqB,UAAU,KAAK,GACpC,GAAG,KAAK,UAAU;GAAE,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;GAAG;GAAO,GAAG;EAAM,CAAC,EAAE,KACrE,MACF;CACF,QAAQ,CAER;AACF;AAEA,SAAS,qBAAqB,OAAiE;CAC7F,OACE,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,WAAW,YACxB,OAAO,MAAM,WAAW,YACxB,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,KAAK,CAAC,CAAC,SAAS;AAElC"}

package/dist/{runtime-CnQ_-DF_.js → runtime-BZsDYscs.js}

@@ -6,13 +6,13 @@ import { i as redactProtectedValue, r as redactProtectedReason } from "./protect
 import { a as notifySandboxEventObserver, c as parseCanonicalTransportEvent, s as extractTransportEventIdentity } from "./sandbox-events-CA2amHoA.js";
 import { c as profileProviderModel, i as concreteModelId, s as profileModelExecutionSettings, t as assertExecutableAgentProfile } from "./model-policy-UTTc9Z-A.js";
 import { E as executableAgentSpecSnapshot, T as executableAgentProfileSnapshot } from "./materialization-BP5zspr2.js";
-import { E as rollingDispatch, I as createExecutor, L as createExecutorRegistry, ct as canonicalObservedModel, g as settledToIteration, it as probeSandboxCapabilities, l as withDriverExecutor, n as createSupervisor, nt as runAgentRounds, ot as routerBrain, q as createPushTraceSource, rt as createSandboxLineage, st as runBrainLoop, tt as defaultSelectWinner, z as createWorktreeCliExecutor } from "./supervisor-BU01azdt.js";
+import { E as rollingDispatch, I as createExecutor, L as createExecutorRegistry, ct as canonicalObservedModel, g as settledToIteration, it as probeSandboxCapabilities, l as withDriverExecutor, n as createSupervisor, nt as runAgentRounds, ot as routerBrain, q as createPushTraceSource, rt as createSandboxLineage, st as runBrainLoop, tt as defaultSelectWinner, z as createWorktreeCliExecutor } from "./supervisor-Dl9Fk7g5.js";
 import "./environment-provider-CLNVqp6H.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-C7iJOWm3.js";
-import { C as observe, O as strategyAuthorMethod, T as profileChatClient, b as sample, v as refine, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-CbQjaMwW.js";
-import { It as gateOnDeliverable, Lt as mapExecutorResult, n as supervise } from "./supervise-B8Ykk8GO.js";
-import "./authoring-CK6iXftK.js";
-import "./graph-9KF7mJM3.js";
+import { C as observe, O as strategyAuthorMethod, T as profileChatClient, b as sample, v as refine, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-BMnPPcJP.js";
+import { It as gateOnDeliverable, Lt as mapExecutorResult, n as supervise } from "./supervise-B-nTWUCK.js";
+import "./authoring-DHVHhbJO.js";
+import "./graph-BWsEZmDL.js";
 import { CODING_HARNESSES, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { heldoutSignificance, runProfileMatrix } from "@tangle-network/agent-eval/campaign";
 import { AgentEnvironmentCapabilitiesSchema, AgentExactRunControlRefSchema, AgentNativeContextContinuationResultSchema, AgentRunCancellationAcknowledgementSchema, AgentRunCancellationRequestSchema, AgentTurnResultSchema, InteractionAcknowledgementSchema, InteractionResponseCommandSchema, NativeContextBoundaryProofSchema, NativeContextContinuationRequestSchema, RuntimeEventEnvelopeSchema, agentNativeContextContinuationResultMatchesRequest, agentProfileSchema, agentRunCancellationAcknowledgementMatchesRequest, agentRunCancellationRequestDigest, canonicalAgentProfileDigest, canonicalCandidateDigest, nativeContextContinuationTurnDigest, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
@@ -6672,4 +6672,4 @@ function tail(s) {
 //#endregion
 export { FileCorpus as $, pickChampion as A, renderLeaderboardMarkdown as At, runBenchmark as B, envKeyProvider as Bt, analyzeTrace as C, completionAuthorizes as Ct, chatWorkerSeam as D, leaderboard as Dt, chatTransportExecutor as E, stopSentinel as Et, strategyAuthorContract as F, McpSpawnFault as Ft, promotionGate as G, recoverRetainedRun as H, resolveMcpServerLaunch as Ht, strategyAuthorSystemPrompt as I, connectStdioMcp as It, definePersona as J, equalKOnCost as K, SandboxRunAbortError as L, materializeLocalMcp as Lt, selectChampion as M, renderPairwiseMarkdown as Mt, assertStrategyContract as N, auditIntent as Nt, createChatSessionStore as O, pairwiseSignificance as Ot, authorStrategy as P, defaultAuditorInstruction as Pt, registerShape as Q, openSandboxRun as R, createMcpEnvironment as Rt, withUntrackedArtifacts as S, superviseDispatch as St, runCoderChecks as T, sentinelCompletion as Tt, startRetainedRun as U, resolveSecretEnv as Ut, reconnectRetainedRun as V, mcpSecretEnvMetadataKey as Vt, startRetainedRunInEnvironment as W, secretEnvOfMcpServer as Wt, builtinShapes as X, runPersonified as Y, createShapeRegistry as Z, VERIFY_TAIL_CHARS as _, resolveSandboxClient as _t, localShell as a, panel as at, settledWorkerOut as b, loopCampaignDispatch as bt, createVerifierEnvironment as c, verify as ct, harvestSurfaceDiffs as d, buildSteerContext as dt, InMemoryCorpus as et, failuresAnalyst as f, createScopeAnalyst as ft, NOTE_MAX_CHARS as g, defineLeaderboard as gt, EVIDENCE_MAX_CHARS as h, harvestCorpus as ht, jjWorkspace as i, loopUntil as it, runStrategyEvolution as j, renderLeaderboardSvg as jt, discriminatingMeans as k, renderLeaderboardHtml as kt, boxSurfaceReader as l, widen as lt, worktreeFanout as m, inProcessSandboxClient as mt, makeFinding$1 as n, fanout as nt, runInWorkspace as o, pipeline as ot, superviseSurface as p, registryScopeAnalyst as pt, trajectoryReport as q, gitWorkspace as r, flatWidenGate as rt, createWaterfallCollector as s, selectValidWinner as st, computeFindingId$1 as t, renderCorpusToInstructions as tt, fsSurfaceReader as u, assertTraceDerivedFindings as ut, closingWorkerNote as v, localSandboxClient as vt, patchDelivered as w, deterministicCompletion as wt, copyUntrackedIntoClone as x, loopDispatch as xt, composeWorkerEvidence as y, inlineSandboxClient as yt, printBenchmarkReport as z, sanitizeMcpToolSchema as zt };
 
-//# sourceMappingURL=runtime-CnQ_-DF_.js.map
+//# sourceMappingURL=runtime-BZsDYscs.js.map