@tangle-network/agent-runtime 0.185.1 → 0.187.1

package/dist/{prepare-Tip-2ZoZ.js → prepare-BpIGs5Tc.js}

@@ -1,11 +1,11 @@
-import { x as contentAddress } from "./spawn-journal--N8Ten1q.js";
+import { x as contentAddress } from "./spawn-journal-CxRa-NJ2.js";
 import { i as redactProtectedValue, n as createProtectedRecordRedactor, r as redactProtectedReason, t as assertNoProtectedBytes } from "./protected-redaction--F3v1oo8.js";
 import { agentCandidateArtifactRefSchema, agentCandidateBenchmarkResultEvidenceSchema, agentCandidateBenchmarkSuiteSchema, agentCandidateBenchmarkTaskSchema, agentCandidateBundleSchema, agentCandidateContainerSchema, agentCandidateExecutionLimitsSchema, agentCandidateExecutionPlanEvidenceSchema, agentCandidateExecutionPlanMaterialSchema, agentCandidateMaterializationReceiptSchema, agentCandidateModelAccessNetworkSchema, agentCandidateModelSettlementEvidenceSchema, agentCandidateProfileActivationSchema, agentCandidateProfilePlanEvidenceSchema, agentCandidateProfileSchema, agentCandidateResolvedModelSchema, agentCandidateRunCellSchema, agentCandidateRunReceiptSchema, agentCandidateTaskOutcomeEvidenceSchema, agentCandidateTaskOutcomeSpecSchema, agentCandidateTerminationSchema, agentCandidateWorkspaceManifestMaterialSchema, agentCandidateWorkspaceSnapshotEvidenceSchema, agentProfileDiffSchema, agentProfileSchema, applyAgentProfileDiff, sha256DigestSchema } from "@tangle-network/agent-interface";
 import { REDACTION_VERSION, canonicalJson, isLlmSpan } from "@tangle-network/agent-eval";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { isAbsolute, join, posix, relative, resolve, sep } from "node:path";
+import { dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { applyAgentCandidateWorkspacePlan, isMaterializerHarness, materializeCandidateProfile } from "@tangle-network/agent-profile-materialize";
-import { lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rm, stat } from "node:fs/promises";
+import { lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rm, stat } from "node:fs/promises";
 import { constants } from "node:fs";
 import { spawn } from "node:child_process";
 import { tmpdir } from "node:os";
@@ -910,16 +910,28 @@ async function verifyWorkspaceSnapshotArtifacts(snapshot, port) {
 	};
 }
 async function verifyMaterializedWorkspace(root, expected, options = {}) {
-	assertWorkspaceManifest((await scanWorkspace(root, new Set(options.ignoredProtectedRootEntries ?? []))).manifest, expected);
+	assertWorkspaceManifest(await scanMaterializedWorkspaceManifest(root, options), expected);
+}
+/**
+* The canonical manifest of one materialized workspace, read without holding any file.
+*
+* Every file is digested by streaming, so the size of the largest file does not decide whether the
+* workspace can be described. `FileHandle.readFile` refuses anything above 2 GiB with
+* `ERR_FS_FILE_TOO_LARGE`, which made a workspace holding one such artifact impossible to verify
+* against a manifest it already matched. The digest is sha-256 over the same bytes either way, so
+* a manifest a buffered read produced is reproduced exactly.
+*/
+async function scanMaterializedWorkspaceManifest(root, options = {}) {
+	return workspaceManifestFromEntries(await walkWorkspace(root, options, false));
 }
 async function captureMaterializedWorkspace(root, options = {}) {
-	const observed = await scanWorkspace(root, new Set(options.ignoredProtectedRootEntries ?? []), options.limits);
+	const entries = await walkWorkspace(root, options, true);
 	return {
-		manifest: observed.manifest,
-		files: observed.files.map((file) => ({
-			path: file.path,
-			mode: file.mode,
-			bytes: Uint8Array.from(file.bytes)
+		manifest: workspaceManifestFromEntries(entries),
+		files: entries.map((entry) => ({
+			path: entry.path,
+			mode: entry.mode,
+			bytes: Uint8Array.from(capturedBytes(entry))
 		}))
 	};
 }
@@ -933,36 +945,65 @@ async function readMaterializedWorkspaceFiles(root, expected, options = {}) {
 		bytes: Uint8Array.from(file.bytes)
 	}));
 }
-function candidateWorkspaceManifest(files) {
+function candidateWorkspaceManifest(files, options = {}) {
+	return workspaceManifestFromEntries(files.map((file) => ({
+		path: file.path,
+		mode: options.portableTree === true ? portableFileMode(file.mode) : file.mode,
+		sha256: sha256Bytes(file.bytes),
+		byteLength: file.bytes.byteLength
+	})));
+}
+function workspaceManifestFromEntries(entries) {
 	return {
 		kind: "agent-candidate-workspace-manifest",
-		files: files.map((file) => ({
-			path: file.path,
-			mode: file.mode,
-			sha256: sha256Bytes(file.bytes),
-			byteLength: file.bytes.byteLength
+		files: entries.map((entry) => ({
+			path: entry.path,
+			mode: entry.mode,
+			sha256: entry.sha256,
+			byteLength: entry.byteLength
 		})).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)
 	};
 }
+/** Git records exactly two file modes, and a portable-tree scan records the same two. */
+function portableFileMode(mode) {
+	return (mode & 73) !== 0 ? 493 : 420;
+}
+function capturedBytes(entry) {
+	if (!entry.bytes) throw new Error(`workspace file was digested without its bytes: ${entry.path}`);
+	return entry.bytes;
+}
 function assertWorkspaceManifest(observed, expected) {
-	if (!Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) throw new Error("materialized workspace files, modes, or bytes do not match the signed manifest");
+	if (Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) return;
+	if (Buffer.from(canonicalCandidateBytes(withPortableModes(observed))).equals(canonicalCandidateBytes(withPortableModes(expected)))) throw new Error("materialized workspace files do not match the signed manifest: only the file modes differ, so the capture and this verify disagree about portableTree");
+	throw new Error("materialized workspace files, modes, or bytes do not match the signed manifest");
+}
+function withPortableModes(material) {
+	return {
+		...material,
+		files: material.files.map((file) => ({
+			...file,
+			mode: portableFileMode(file.mode)
+		}))
+	};
 }
 async function verifyMaterializedProfileWorkspace(root, expected) {
-	const observedProfile = (await scanWorkspace(root, /* @__PURE__ */ new Set())).manifest.files.map(({ path, mode, sha256 }) => ({
+	const observedProfile = (await scanMaterializedWorkspaceManifest(root)).files.map(({ path, mode, sha256 }) => ({
 		relPath: path,
 		mode,
 		contentSha256: sha256
 	}));
 	if (!Buffer.from(canonicalCandidateBytes(observedProfile)).equals(canonicalCandidateBytes(expected.files))) throw new Error("profile staging files, modes, or bytes do not match the signed profile plan");
 }
-async function scanWorkspace(root, ignoredProtectedRootEntries, limits) {
+async function walkWorkspace(root, options, keepBytes) {
+	const ignoredProtectedRootEntries = new Set(options.ignoredProtectedRootEntries ?? []);
+	const limits = options.limits;
 	const requestedRoot = resolve(root);
 	const rootStats = await lstat(requestedRoot);
 	if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) throw new Error("workspace root must be a real directory");
 	const absoluteRoot = await realpath(requestedRoot);
 	const resolvedStats = await lstat(absoluteRoot);
 	if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) throw new Error("workspace root must resolve to a real directory");
-	const capturedFiles = [];
+	const scanned = [];
 	let totalBytes = 0;
 	async function visit(directory) {
 		const entries = await readdir(directory, { withFileTypes: true });
@@ -973,28 +1014,30 @@ async function scanWorkspace(root, ignoredProtectedRootEntries, limits) {
 			const relPath = relative(absoluteRoot, absolute).split(sep).join("/");
 			if (!relPath || relPath.startsWith("../") || relPath.includes("/../")) throw new Error(`workspace entry escapes root: ${relPath}`);
 			const stats = await lstat(absolute);
-			if (stats.isSymbolicLink()) throw new Error(`workspace contains a symlink: ${relPath}`);
+			if (stats.isSymbolicLink()) throw new Error(await symlinkRefusal(absolute, relPath, absoluteRoot));
 			if (stats.isDirectory()) {
 				await visit(absolute);
 				continue;
 			}
 			if (!stats.isFile()) throw new Error(`workspace contains a non-regular entry: ${relPath}`);
-			if (limits && capturedFiles.length >= limits.maxFiles) throw new Error("workspace exceeds maxFiles");
+			if (limits && scanned.length >= limits.maxFiles) throw new Error("workspace exceeds maxFiles");
 			const descriptor = await open(absolute, constants.O_RDONLY | (typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0));
 			try {
 				const openedStats = await descriptor.stat();
 				if (!openedStats.isFile()) throw new Error(`workspace contains a non-regular entry: ${relPath}`);
 				if (openedStats.nlink !== 1) throw new Error(`workspace contains a hard-linked file: ${relPath}`);
-				const mode = openedStats.mode & 511;
+				const mode = options.portableTree === true ? portableFileMode(openedStats.mode) : openedStats.mode & 511;
 				if (limits && openedStats.size > limits.maxFileBytes) throw new Error(`workspace file exceeds maxFileBytes: ${relPath}`);
 				const remainingBytes = limits ? limits.maxTotalFileBytes - totalBytes : void 0;
 				if (remainingBytes !== void 0 && openedStats.size > remainingBytes) throw new Error("workspace exceeds maxTotalFileBytes");
-				const bytes = await readBoundedFile(descriptor, limits ? Math.min(limits.maxFileBytes, remainingBytes ?? limits.maxFileBytes) : void 0, relPath);
-				totalBytes += bytes.byteLength;
-				capturedFiles.push({
+				const read = await readWorkspaceFile(descriptor, limits ? Math.min(limits.maxFileBytes, remainingBytes ?? limits.maxFileBytes) : void 0, keepBytes, relPath);
+				totalBytes += read.byteLength;
+				scanned.push({
 					path: relPath,
 					mode,
-					bytes: Uint8Array.from(bytes)
+					sha256: read.sha256,
+					byteLength: read.byteLength,
+					...read.bytes === void 0 ? {} : { bytes: read.bytes }
 				});
 			} finally {
 				await descriptor.close();
@@ -1002,25 +1045,65 @@ async function scanWorkspace(root, ignoredProtectedRootEntries, limits) {
 		}
 	}
 	await visit(absoluteRoot);
-	return {
-		manifest: candidateWorkspaceManifest(capturedFiles),
-		files: capturedFiles
-	};
+	return scanned;
+}
+/**
+* Why one symbolic link is refused, in the terms that separate a portable link from a link that
+* reaches outside the tree.
+*
+* Every link is refused, in both mode policies. `AgentCandidateWorkspaceManifestMaterial` has no
+* representation for one — `mode`, `sha256` and `byteLength` describe a regular file — so a link
+* recorded as a file would let two different trees share one digest. The reason says which kind of
+* link it was, so a caller can tell a link it can rewrite from one it cannot.
+*/
+async function symlinkRefusal(absolute, relPath, absoluteRoot) {
+	const target = await readlink(absolute);
+	if (isAbsolute(target)) return `workspace contains an absolute symlink: ${relPath} -> ${target}`;
+	if (!isWithin(absoluteRoot, resolve(dirname(absolute), target))) return `workspace contains a symlink that escapes its tree: ${relPath} -> ${target}`;
+	let physical;
+	try {
+		physical = await realpath(absolute);
+	} catch {
+		return `workspace contains an unresolved symlink: ${relPath} -> ${target}`;
+	}
+	if (!isWithin(absoluteRoot, physical)) return `workspace contains a symlink that resolves outside its tree: ${relPath} -> ${target}`;
+	return `workspace contains a symlink: ${relPath} -> ${target}`;
 }
-async function readBoundedFile(descriptor, maxBytes, path) {
-	if (maxBytes === void 0) return await descriptor.readFile();
+function isWithin(root, path) {
+	return path === root || path.startsWith(`${root}${sep}`);
+}
+/**
+* Read one open regular file into its digest, keeping the bytes only when the caller needs them.
+*
+* The content reaches the hash in 1 MiB chunks and is never held whole for a digest-only walk, so
+* the size of the largest file does not decide whether a workspace can be described.
+* `FileHandle.readFile` refuses anything above 2 GiB with `ERR_FS_FILE_TOO_LARGE`. Hashing the
+* chunks in order equals hashing the whole buffer, so a manifest a buffered read produced is
+* reproduced byte for byte.
+*/
+async function readWorkspaceFile(descriptor, maxBytes, keepBytes, path) {
+	const hash = createHash("sha256");
+	const buffer = Buffer.allocUnsafe(1024 * 1024);
 	const chunks = [];
 	let total = 0;
 	while (true) {
-		const remaining = maxBytes - total;
-		const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, remaining + 1));
-		const { bytesRead } = await descriptor.read(chunk, 0, chunk.byteLength, null);
+		const { bytesRead } = await descriptor.read(buffer, 0, buffer.byteLength, null);
 		if (bytesRead === 0) break;
 		total += bytesRead;
-		if (total > maxBytes) throw new Error(`workspace file exceeds its capture limit: ${path}`);
-		chunks.push(chunk.subarray(0, bytesRead));
+		if (maxBytes !== void 0 && total > maxBytes) throw new Error(`workspace file exceeds its capture limit: ${path}`);
+		const chunk = buffer.subarray(0, bytesRead);
+		hash.update(chunk);
+		if (keepBytes) chunks.push(Buffer.from(chunk));
 	}
-	return Buffer.concat(chunks, total);
+	const sha256 = `sha256:${hash.digest("hex")}`;
+	return keepBytes ? {
+		sha256,
+		byteLength: total,
+		bytes: Buffer.concat(chunks, total)
+	} : {
+		sha256,
+		byteLength: total
+	};
 }
 //#endregion
 //#region src/candidate-execution/git-materialize.ts
@@ -4486,4 +4569,4 @@ function errorMessage(error) {
 //#endregion
 export { parseAgentCandidateProfileActivation as $, verifyMaterializedWorkspace as A, rejectedStage as B, assertNoGitIndirection as C, captureMaterializedWorkspace as D, candidateWorkspaceManifest as E, assertTerminalAllowedInPhase as F, isWellFormedUnicode as G, sealTerminalDigest as H, assertTerminalMatchesClaim as I, assertCandidateProfileBinding as J, agentCandidateProfileAsAgentProfile as K, assertTerminalMatchesStaged as L, candidateCleanupTimeout as M, withinCandidateCleanupDeadline as N, readVerifiedArtifact as O, assertRecoveryMatchesStaged as P, omitUndefinedObjectFields as Q, recoveredTerminalRecord as R, CANDIDATE_TRACE_TAGS as S, runCandidateGit as T, terminalRecord as U, requireStagedTerminal as V, assertExactObjectKeys as W, freezeGenericAgentCandidateProfile as X, createAgentCandidateProfileActivation as Y, materializeAgentCandidateProfilePlan as Z, candidateExecutionClaim as _, persistCandidateOutputArtifact as a, canonicalCandidateDocument as at, consumePreparedCandidateExecution as b, CANDIDATE_KNOWLEDGE_ROOT_ENV as c, immutableCandidateValue as ct, verifiedResourceTextByDigest as d, verifyCanonicalCandidateDocument as dt, parseExactAgentProfile as et, verifyAgentCandidateBundle as f, candidateClaimFileInternals as g, InMemoryAgentCandidateExecutionClaimStore as h, persistCandidateModelSettlementEvidence as i, canonicalCandidateDigest$1 as it, candidateCleanupDeadline as j, verifyBytes as k, candidateKnowledgeExecutionPaths as l, omitTopLevelDigest as lt, usdToNanos as m, executePreparedAgentCandidate as n, parseExactCandidateProfile as nt, sealAgentCandidateExecutorStopAcknowledgement as o, deepFreezeCandidate as ot, sealAgentCandidateModelSettlement as p, applyExactAgentProfileDiff as q, RecoveryAgentCandidateTraceStore as r, canonicalCandidateBytes as rt, CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV as s, embeddedCandidateArtifact as st, prepareAgentCandidateExecution as t, parseExactAgentProfileDiff as tt, AGENT_CANDIDATE_EXECUTION_SUPPORT as u, sha256Bytes as ut, assertPreparedCandidateIntegrity as v, readCandidateGitTreeFiles as w, CANDIDATE_TRACE_ENV as x, beginPreparedCandidateDisposal as y, rejectedFinish as z };
 
-//# sourceMappingURL=prepare-Tip-2ZoZ.js.map
+//# sourceMappingURL=prepare-BpIGs5Tc.js.map