@tangle-network/agent-runtime 0.188.1 → 0.190.0

package/dist/{prepare-BpIGs5Tc.js → prepare-B5fJ7mLS.js}

@@ -1,12 +1,12 @@
-import { x as contentAddress } from "./spawn-journal-CxRa-NJ2.js";
+import { x as contentAddress } from "./spawn-journal-B9eTmVAn.js";
 import { i as redactProtectedValue, n as createProtectedRecordRedactor, r as redactProtectedReason, t as assertNoProtectedBytes } from "./protected-redaction--F3v1oo8.js";
 import { agentCandidateArtifactRefSchema, agentCandidateBenchmarkResultEvidenceSchema, agentCandidateBenchmarkSuiteSchema, agentCandidateBenchmarkTaskSchema, agentCandidateBundleSchema, agentCandidateContainerSchema, agentCandidateExecutionLimitsSchema, agentCandidateExecutionPlanEvidenceSchema, agentCandidateExecutionPlanMaterialSchema, agentCandidateMaterializationReceiptSchema, agentCandidateModelAccessNetworkSchema, agentCandidateModelSettlementEvidenceSchema, agentCandidateProfileActivationSchema, agentCandidateProfilePlanEvidenceSchema, agentCandidateProfileSchema, agentCandidateResolvedModelSchema, agentCandidateRunCellSchema, agentCandidateRunReceiptSchema, agentCandidateTaskOutcomeEvidenceSchema, agentCandidateTaskOutcomeSpecSchema, agentCandidateTerminationSchema, agentCandidateWorkspaceManifestMaterialSchema, agentCandidateWorkspaceSnapshotEvidenceSchema, agentProfileDiffSchema, agentProfileSchema, applyAgentProfileDiff, sha256DigestSchema } from "@tangle-network/agent-interface";
 import { REDACTION_VERSION, canonicalJson, isLlmSpan } from "@tangle-network/agent-eval";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
-import { applyAgentCandidateWorkspacePlan, isMaterializerHarness, materializeCandidateProfile } from "@tangle-network/agent-profile-materialize";
-import { lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rm, stat } from "node:fs/promises";
 import { constants } from "node:fs";
+import { lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rm, stat } from "node:fs/promises";
+import { dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
+import { applyAgentCandidateWorkspacePlan, isMaterializerHarness, materializeCandidateProfile, resolvePiRuntimePaths } from "@tangle-network/agent-profile-materialize";
 import { spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { hashKnowledgeBase } from "@tangle-network/agent-knowledge";
@@ -64,6 +64,240 @@ function deepFreezeCandidate(value, seen = /* @__PURE__ */ new Set()) {
 	return Object.freeze(value);
 }
 //#endregion
+//#region src/candidate-execution/artifacts.ts
+function artifactCacheKey(artifact) {
+	return `${artifact.sha256}:${artifact.byteLength}`;
+}
+async function readVerifiedArtifact(artifact, port) {
+	const bytes = "content" in artifact ? Buffer.from(artifact.content, "base64") : await port.read(artifact);
+	verifyBytes(bytes, artifact.sha256, artifact.byteLength, "candidate artifact");
+	return Uint8Array.from(bytes);
+}
+function verifyBytes(bytes, digest, byteLength, label) {
+	if (bytes.byteLength !== byteLength) throw new Error(`${label} byte length ${bytes.byteLength} does not match ${byteLength}`);
+	const actual = sha256Bytes(bytes);
+	if (actual !== digest) throw new Error(`${label} digest ${actual} does not match ${digest}`);
+}
+async function verifyWorkspaceSnapshotArtifacts(snapshot, port) {
+	const [manifest, archive] = await Promise.all([readVerifiedArtifact(snapshot.manifest, port), readVerifiedArtifact(snapshot.archive, port)]);
+	const canonicalManifest = canonicalCandidateBytes(snapshot.material);
+	if (!Buffer.from(manifest).equals(Buffer.from(canonicalManifest))) throw new Error("workspace manifest artifact is not the exact canonical manifest material");
+	if (sha256Bytes(canonicalManifest) !== snapshot.digest) throw new Error("workspace snapshot digest does not match its canonical manifest material");
+	return {
+		manifest,
+		archive
+	};
+}
+/**
+* Refuse a materialized workspace whose files, modes, or bytes are not the signed manifest.
+*
+* The scan streams, so the size of the largest file does not decide whether the check can run, and
+* the refusal names the one mismatch a caller can produce on its own: a capture and a verify that
+* disagree about `portableTree`.
+*/
+async function verifyMaterializedWorkspace(root, expected, options = {}) {
+	assertWorkspaceManifest(await scanMaterializedWorkspaceManifest(root, options), expected);
+}
+/**
+* The canonical manifest of one materialized workspace, read without holding any file.
+*
+* Every file is digested by streaming, so the size of the largest file does not decide whether the
+* workspace can be described. `FileHandle.readFile` refuses anything above 2 GiB with
+* `ERR_FS_FILE_TOO_LARGE`, which made a workspace holding one such artifact impossible to verify
+* against a manifest it already matched. The digest is sha-256 over the same bytes either way, so
+* a manifest a buffered read produced is reproduced exactly.
+*/
+async function scanMaterializedWorkspaceManifest(root, options = {}) {
+	return workspaceManifestFromEntries(await walkWorkspace(root, options, false));
+}
+async function captureMaterializedWorkspace(root, options = {}) {
+	const entries = await walkWorkspace(root, options, true);
+	return {
+		manifest: workspaceManifestFromEntries(entries),
+		files: entries.map((entry) => ({
+			path: entry.path,
+			mode: entry.mode,
+			bytes: Uint8Array.from(capturedBytes(entry))
+		}))
+	};
+}
+/** Capture exact verified regular-file bytes for fresh isolated materialization. */
+async function readMaterializedWorkspaceFiles(root, expected, options = {}) {
+	const observed = await captureMaterializedWorkspace(root, options);
+	assertWorkspaceManifest(observed.manifest, expected);
+	return observed.files.map((file) => Object.freeze({
+		path: file.path,
+		mode: file.mode,
+		bytes: Uint8Array.from(file.bytes)
+	}));
+}
+/**
+* Build the canonical manifest for files a caller already holds — the shape a remote executor
+* returns. Pass `portableTree` to record Git's two file modes instead of exact permission bits, and
+* pass the same flag to every verify that reads the result.
+*/
+function candidateWorkspaceManifest(files, options = {}) {
+	return workspaceManifestFromEntries(files.map((file) => ({
+		path: file.path,
+		mode: options.portableTree === true ? portableFileMode(file.mode) : file.mode,
+		sha256: sha256Bytes(file.bytes),
+		byteLength: file.bytes.byteLength
+	})));
+}
+function workspaceManifestFromEntries(entries) {
+	return {
+		kind: "agent-candidate-workspace-manifest",
+		files: entries.map((entry) => ({
+			path: entry.path,
+			mode: entry.mode,
+			sha256: entry.sha256,
+			byteLength: entry.byteLength
+		})).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)
+	};
+}
+/** Git records exactly two file modes, and a portable-tree scan records the same two. */
+function portableFileMode(mode) {
+	return (mode & 73) !== 0 ? 493 : 420;
+}
+function capturedBytes(entry) {
+	if (!entry.bytes) throw new Error(`workspace file was digested without its bytes: ${entry.path}`);
+	return entry.bytes;
+}
+function assertWorkspaceManifest(observed, expected) {
+	if (Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) return;
+	if (Buffer.from(canonicalCandidateBytes(withPortableModes(observed))).equals(canonicalCandidateBytes(withPortableModes(expected)))) throw new Error("materialized workspace files do not match the signed manifest: only the file modes differ, so the capture and this verify disagree about portableTree");
+	throw new Error("materialized workspace files, modes, or bytes do not match the signed manifest");
+}
+function withPortableModes(material) {
+	return {
+		...material,
+		files: material.files.map((file) => ({
+			...file,
+			mode: portableFileMode(file.mode)
+		}))
+	};
+}
+async function verifyMaterializedProfileWorkspace(root, expected, fileRoot = "workspace") {
+	const observedProfile = (await scanMaterializedWorkspaceManifest(root)).files.map(({ path, mode, sha256 }) => ({
+		relPath: path,
+		mode,
+		contentSha256: sha256
+	}));
+	const expectedFiles = expected.files.filter((file) => (file.root ?? "workspace") === fileRoot).map(({ root: _root, ...file }) => file);
+	if (!Buffer.from(canonicalCandidateBytes(observedProfile)).equals(canonicalCandidateBytes(expectedFiles))) throw new Error(`profile ${fileRoot} staging files, modes, or bytes do not match the signed profile plan`);
+}
+async function walkWorkspace(root, options, keepBytes) {
+	const ignoredProtectedRootEntries = new Set(options.ignoredProtectedRootEntries ?? []);
+	const limits = options.limits;
+	const requestedRoot = resolve(root);
+	const rootStats = await lstat(requestedRoot);
+	if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) throw new Error("workspace root must be a real directory");
+	const absoluteRoot = await realpath(requestedRoot);
+	const resolvedStats = await lstat(absoluteRoot);
+	if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) throw new Error("workspace root must resolve to a real directory");
+	const scanned = [];
+	let totalBytes = 0;
+	async function visit(directory) {
+		const entries = await readdir(directory, { withFileTypes: true });
+		entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+		for (const entry of entries) {
+			if (directory === absoluteRoot && ignoredProtectedRootEntries.has(entry.name)) continue;
+			const absolute = resolve(directory, entry.name);
+			const relPath = relative(absoluteRoot, absolute).split(sep).join("/");
+			if (!relPath || relPath.startsWith("../") || relPath.includes("/../")) throw new Error(`workspace entry escapes root: ${relPath}`);
+			const stats = await lstat(absolute);
+			if (stats.isSymbolicLink()) throw new Error(await symlinkRefusal(absolute, relPath, absoluteRoot));
+			if (stats.isDirectory()) {
+				await visit(absolute);
+				continue;
+			}
+			if (!stats.isFile()) throw new Error(`workspace contains a non-regular entry: ${relPath}`);
+			if (limits && scanned.length >= limits.maxFiles) throw new Error("workspace exceeds maxFiles");
+			const descriptor = await open(absolute, constants.O_RDONLY | (typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0));
+			try {
+				const openedStats = await descriptor.stat();
+				if (!openedStats.isFile()) throw new Error(`workspace contains a non-regular entry: ${relPath}`);
+				if (openedStats.nlink !== 1) throw new Error(`workspace contains a hard-linked file: ${relPath}`);
+				const mode = options.portableTree === true ? portableFileMode(openedStats.mode) : openedStats.mode & 511;
+				if (limits && openedStats.size > limits.maxFileBytes) throw new Error(`workspace file exceeds maxFileBytes: ${relPath}`);
+				const remainingBytes = limits ? limits.maxTotalFileBytes - totalBytes : void 0;
+				if (remainingBytes !== void 0 && openedStats.size > remainingBytes) throw new Error("workspace exceeds maxTotalFileBytes");
+				const read = await readWorkspaceFile(descriptor, limits ? Math.min(limits.maxFileBytes, remainingBytes ?? limits.maxFileBytes) : void 0, keepBytes, relPath);
+				totalBytes += read.byteLength;
+				scanned.push({
+					path: relPath,
+					mode,
+					sha256: read.sha256,
+					byteLength: read.byteLength,
+					...read.bytes === void 0 ? {} : { bytes: read.bytes }
+				});
+			} finally {
+				await descriptor.close();
+			}
+		}
+	}
+	await visit(absoluteRoot);
+	return scanned;
+}
+/**
+* Why one symbolic link is refused, in the terms that separate a portable link from a link that
+* reaches outside the tree.
+*
+* Every link is refused, in both mode policies. `AgentCandidateWorkspaceManifestMaterial` has no
+* representation for one — `mode`, `sha256` and `byteLength` describe a regular file — so a link
+* recorded as a file would let two different trees share one digest. The reason says which kind of
+* link it was, so a caller can tell a link it can rewrite from one it cannot.
+*/
+async function symlinkRefusal(absolute, relPath, absoluteRoot) {
+	const target = await readlink(absolute);
+	if (isAbsolute(target)) return `workspace contains an absolute symlink: ${relPath} -> ${target}`;
+	if (!isWithin(absoluteRoot, resolve(dirname(absolute), target))) return `workspace contains a symlink that escapes its tree: ${relPath} -> ${target}`;
+	let physical;
+	try {
+		physical = await realpath(absolute);
+	} catch {
+		return `workspace contains an unresolved symlink: ${relPath} -> ${target}`;
+	}
+	if (!isWithin(absoluteRoot, physical)) return `workspace contains a symlink that resolves outside its tree: ${relPath} -> ${target}`;
+	return `workspace contains a symlink: ${relPath} -> ${target}`;
+}
+function isWithin(root, path) {
+	return path === root || path.startsWith(`${root}${sep}`);
+}
+/**
+* Read one open regular file into its digest, keeping the bytes only when the caller needs them.
+*
+* The content reaches the hash in 1 MiB chunks and is never held whole for a digest-only walk, so
+* the size of the largest file does not decide whether a workspace can be described.
+* `FileHandle.readFile` refuses anything above 2 GiB with `ERR_FS_FILE_TOO_LARGE`. Hashing the
+* chunks in order equals hashing the whole buffer, so a manifest a buffered read produced is
+* reproduced byte for byte.
+*/
+async function readWorkspaceFile(descriptor, maxBytes, keepBytes, path) {
+	const hash = createHash("sha256");
+	const buffer = Buffer.allocUnsafe(1024 * 1024);
+	const chunks = [];
+	let total = 0;
+	while (true) {
+		const { bytesRead } = await descriptor.read(buffer, 0, buffer.byteLength, null);
+		if (bytesRead === 0) break;
+		total += bytesRead;
+		if (maxBytes !== void 0 && total > maxBytes) throw new Error(`workspace file exceeds its capture limit: ${path}`);
+		const chunk = buffer.subarray(0, bytesRead);
+		hash.update(chunk);
+		if (keepBytes) chunks.push(Buffer.from(chunk));
+	}
+	const sha256 = `sha256:${hash.digest("hex")}`;
+	return keepBytes ? {
+		sha256,
+		byteLength: total,
+		bytes: Buffer.concat(chunks, total)
+	} : {
+		sha256,
+		byteLength: total
+	};
+}
+//#endregion
 //#region src/candidate-execution/system-prompt.ts
 const SYSTEM_PROMPT_FILE = ".tangle/system-prompt.md";
 const APPEND_SYSTEM_PROMPT_FILE = ".tangle/append-system-prompt.md";
@@ -215,6 +449,8 @@ function candidateMaterializerHarness(harness) {
 }
 /** Runtime applies the materializer's launch flags to the candidate process. */
 const CANDIDATE_PROFILE_MATERIALIZER_BINDS = ["systemPrompt"];
+const PI_CANDIDATE_AGENT_DIR_ENV = "PI_CODING_AGENT_DIR";
+const PI_CANDIDATE_SESSION_DIR_ENV = "PI_CODING_AGENT_SESSION_DIR";
 /** Derive the exact native profile plan used by preparation and later evidence checks. */
 function materializeAgentCandidateProfilePlan(options) {
 	const root = options.workspace === "task" ? options.workspaces.taskRoot : options.workspaces.candidateRoot;
@@ -224,15 +460,22 @@ function materializeAgentCandidateProfilePlan(options) {
 		resolvedResources: options.resolvedResources
 	}), options.launch, posix.join(root, ".tangle/system-prompt.md"), options.profile.prompt?.systemPrompt, options.profile.prompt?.appendSystemPrompt);
 }
+/** Resolve the private Pi roots needed by an agent-root profile plan. */
+function candidateProfileAgentPaths(plan, runtimeHome) {
+	if (!plan.files.some((file) => file.root === "agent")) return void 0;
+	if (plan.harness !== "pi") throw new Error(`candidate profile agent-root files are unsupported for ${plan.harness}`);
+	if (runtimeHome === void 0) throw new Error("candidate profile agent-root files require executionRoots.profileRoot");
+	return resolvePiRuntimePaths(runtimeHome);
+}
 /** Bind exact native profile text to the canonical plan captured during preparation. */
 function createAgentCandidateProfileActivation(plan, profilePlan) {
-	const sourceByPath = new Map(plan.files.map((file) => [file.relPath, file]));
-	if (sourceByPath.size !== plan.files.length) throw new Error("candidate profile activation contains duplicate native file paths");
+	const sourceByIdentity = new Map(plan.files.map((file) => [profileFileIdentity$1(file.root, file.relPath), file]));
+	if (sourceByIdentity.size !== plan.files.length) throw new Error("candidate profile activation contains duplicate rooted native file paths");
 	const files = profilePlan.material.files.map((expected) => {
-		const source = sourceByPath.get(expected.relPath);
-		if (!source) throw new Error(`candidate profile activation is missing ${expected.relPath}`);
+		const source = sourceByIdentity.get(profileFileIdentity$1(expected.root, expected.relPath));
+		if (!source) throw new Error(`candidate profile activation is missing ${profileFileLabel(expected.root, expected.relPath)}`);
 		const mode = source.mode ?? 420;
-		if (!Number.isSafeInteger(mode) || mode < 0 || mode > 511) throw new Error(`candidate profile activation has invalid mode for ${expected.relPath}`);
+		if (!Number.isSafeInteger(mode) || mode < 0 || mode > 511) throw new Error(`candidate profile activation has invalid mode for ${profileFileLabel(expected.root, expected.relPath)}`);
 		return {
 			path: expected.relPath,
 			mode,
@@ -246,6 +489,12 @@ function createAgentCandidateProfileActivation(plan, profilePlan) {
 		files
 	}).value, profilePlan.digest);
 }
+function profileFileIdentity$1(root, relPath) {
+	return `${root ?? "workspace"}\0${relPath}`;
+}
+function profileFileLabel(root, relPath) {
+	return root === "agent" ? `agent:${relPath}` : relPath;
+}
 /** Parse and check every native file hash plus both canonical document digests. */
 function parseAgentCandidateProfileActivation(input, expectedProfilePlanDigest) {
 	const activation = agentCandidateProfileActivationSchema.parse(input);
@@ -885,225 +1134,35 @@ function candidateTerminalWindowMs(cleanupTimeoutMs) {
 	return windowMs;
 }
 //#endregion
-//#region src/candidate-execution/artifacts.ts
-function artifactCacheKey(artifact) {
-	return `${artifact.sha256}:${artifact.byteLength}`;
-}
-async function readVerifiedArtifact(artifact, port) {
-	const bytes = "content" in artifact ? Buffer.from(artifact.content, "base64") : await port.read(artifact);
-	verifyBytes(bytes, artifact.sha256, artifact.byteLength, "candidate artifact");
-	return Uint8Array.from(bytes);
-}
-function verifyBytes(bytes, digest, byteLength, label) {
-	if (bytes.byteLength !== byteLength) throw new Error(`${label} byte length ${bytes.byteLength} does not match ${byteLength}`);
-	const actual = sha256Bytes(bytes);
-	if (actual !== digest) throw new Error(`${label} digest ${actual} does not match ${digest}`);
-}
-async function verifyWorkspaceSnapshotArtifacts(snapshot, port) {
-	const [manifest, archive] = await Promise.all([readVerifiedArtifact(snapshot.manifest, port), readVerifiedArtifact(snapshot.archive, port)]);
-	const canonicalManifest = canonicalCandidateBytes(snapshot.material);
-	if (!Buffer.from(manifest).equals(Buffer.from(canonicalManifest))) throw new Error("workspace manifest artifact is not the exact canonical manifest material");
-	if (sha256Bytes(canonicalManifest) !== snapshot.digest) throw new Error("workspace snapshot digest does not match its canonical manifest material");
-	return {
-		manifest,
-		archive
-	};
-}
-async function verifyMaterializedWorkspace(root, expected, options = {}) {
-	assertWorkspaceManifest(await scanMaterializedWorkspaceManifest(root, options), expected);
-}
-/**
-* The canonical manifest of one materialized workspace, read without holding any file.
-*
-* Every file is digested by streaming, so the size of the largest file does not decide whether the
-* workspace can be described. `FileHandle.readFile` refuses anything above 2 GiB with
-* `ERR_FS_FILE_TOO_LARGE`, which made a workspace holding one such artifact impossible to verify
-* against a manifest it already matched. The digest is sha-256 over the same bytes either way, so
-* a manifest a buffered read produced is reproduced exactly.
-*/
-async function scanMaterializedWorkspaceManifest(root, options = {}) {
-	return workspaceManifestFromEntries(await walkWorkspace(root, options, false));
-}
-async function captureMaterializedWorkspace(root, options = {}) {
-	const entries = await walkWorkspace(root, options, true);
-	return {
-		manifest: workspaceManifestFromEntries(entries),
-		files: entries.map((entry) => ({
-			path: entry.path,
-			mode: entry.mode,
-			bytes: Uint8Array.from(capturedBytes(entry))
-		}))
-	};
-}
-/** Capture exact verified regular-file bytes for fresh isolated materialization. */
-async function readMaterializedWorkspaceFiles(root, expected, options = {}) {
-	const observed = await captureMaterializedWorkspace(root, options);
-	assertWorkspaceManifest(observed.manifest, expected);
-	return observed.files.map((file) => Object.freeze({
-		path: file.path,
-		mode: file.mode,
-		bytes: Uint8Array.from(file.bytes)
-	}));
-}
-function candidateWorkspaceManifest(files, options = {}) {
-	return workspaceManifestFromEntries(files.map((file) => ({
-		path: file.path,
-		mode: options.portableTree === true ? portableFileMode(file.mode) : file.mode,
-		sha256: sha256Bytes(file.bytes),
-		byteLength: file.bytes.byteLength
-	})));
-}
-function workspaceManifestFromEntries(entries) {
-	return {
-		kind: "agent-candidate-workspace-manifest",
-		files: entries.map((entry) => ({
-			path: entry.path,
-			mode: entry.mode,
-			sha256: entry.sha256,
-			byteLength: entry.byteLength
-		})).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)
-	};
-}
-/** Git records exactly two file modes, and a portable-tree scan records the same two. */
-function portableFileMode(mode) {
-	return (mode & 73) !== 0 ? 493 : 420;
-}
-function capturedBytes(entry) {
-	if (!entry.bytes) throw new Error(`workspace file was digested without its bytes: ${entry.path}`);
-	return entry.bytes;
-}
-function assertWorkspaceManifest(observed, expected) {
-	if (Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) return;
-	if (Buffer.from(canonicalCandidateBytes(withPortableModes(observed))).equals(canonicalCandidateBytes(withPortableModes(expected)))) throw new Error("materialized workspace files do not match the signed manifest: only the file modes differ, so the capture and this verify disagree about portableTree");
-	throw new Error("materialized workspace files, modes, or bytes do not match the signed manifest");
-}
-function withPortableModes(material) {
-	return {
-		...material,
-		files: material.files.map((file) => ({
-			...file,
-			mode: portableFileMode(file.mode)
-		}))
-	};
-}
-async function verifyMaterializedProfileWorkspace(root, expected) {
-	const observedProfile = (await scanMaterializedWorkspaceManifest(root)).files.map(({ path, mode, sha256 }) => ({
-		relPath: path,
-		mode,
-		contentSha256: sha256
-	}));
-	if (!Buffer.from(canonicalCandidateBytes(observedProfile)).equals(canonicalCandidateBytes(expected.files))) throw new Error("profile staging files, modes, or bytes do not match the signed profile plan");
-}
-async function walkWorkspace(root, options, keepBytes) {
-	const ignoredProtectedRootEntries = new Set(options.ignoredProtectedRootEntries ?? []);
-	const limits = options.limits;
-	const requestedRoot = resolve(root);
-	const rootStats = await lstat(requestedRoot);
-	if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) throw new Error("workspace root must be a real directory");
-	const absoluteRoot = await realpath(requestedRoot);
-	const resolvedStats = await lstat(absoluteRoot);
-	if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) throw new Error("workspace root must resolve to a real directory");
-	const scanned = [];
-	let totalBytes = 0;
-	async function visit(directory) {
-		const entries = await readdir(directory, { withFileTypes: true });
-		entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
-		for (const entry of entries) {
-			if (directory === absoluteRoot && ignoredProtectedRootEntries.has(entry.name)) continue;
-			const absolute = resolve(directory, entry.name);
-			const relPath = relative(absoluteRoot, absolute).split(sep).join("/");
-			if (!relPath || relPath.startsWith("../") || relPath.includes("/../")) throw new Error(`workspace entry escapes root: ${relPath}`);
-			const stats = await lstat(absolute);
-			if (stats.isSymbolicLink()) throw new Error(await symlinkRefusal(absolute, relPath, absoluteRoot));
-			if (stats.isDirectory()) {
-				await visit(absolute);
-				continue;
-			}
-			if (!stats.isFile()) throw new Error(`workspace contains a non-regular entry: ${relPath}`);
-			if (limits && scanned.length >= limits.maxFiles) throw new Error("workspace exceeds maxFiles");
-			const descriptor = await open(absolute, constants.O_RDONLY | (typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0));
-			try {
-				const openedStats = await descriptor.stat();
-				if (!openedStats.isFile()) throw new Error(`workspace contains a non-regular entry: ${relPath}`);
-				if (openedStats.nlink !== 1) throw new Error(`workspace contains a hard-linked file: ${relPath}`);
-				const mode = options.portableTree === true ? portableFileMode(openedStats.mode) : openedStats.mode & 511;
-				if (limits && openedStats.size > limits.maxFileBytes) throw new Error(`workspace file exceeds maxFileBytes: ${relPath}`);
-				const remainingBytes = limits ? limits.maxTotalFileBytes - totalBytes : void 0;
-				if (remainingBytes !== void 0 && openedStats.size > remainingBytes) throw new Error("workspace exceeds maxTotalFileBytes");
-				const read = await readWorkspaceFile(descriptor, limits ? Math.min(limits.maxFileBytes, remainingBytes ?? limits.maxFileBytes) : void 0, keepBytes, relPath);
-				totalBytes += read.byteLength;
-				scanned.push({
-					path: relPath,
-					mode,
-					sha256: read.sha256,
-					byteLength: read.byteLength,
-					...read.bytes === void 0 ? {} : { bytes: read.bytes }
-				});
-			} finally {
-				await descriptor.close();
-			}
+//#region src/candidate-execution/execution-roots.ts
+/** Validate the canonical identity and isolation boundary for execution roots. */
+function assertAgentCandidateExecutionRoots(roots) {
+	const entries = [
+		["task", roots.taskRoot],
+		["candidate", roots.candidateRoot],
+		["profile", roots.profileRoot]
+	];
+	for (const [name, root] of entries) {
+		if (root === void 0) continue;
+		if (!posix.isAbsolute(root) || posix.normalize(root) !== root) throw new Error(`execution ${name} root must be a canonical absolute path`);
+	}
+	for (let left = 0; left < entries.length; left++) {
+		const entry = entries[left];
+		if (!entry) continue;
+		const [leftName, leftRoot] = entry;
+		if (leftRoot === void 0) continue;
+		for (let right = left + 1; right < entries.length; right++) {
+			const rightEntry = entries[right];
+			if (!rightEntry) continue;
+			const [rightName, rightRoot] = rightEntry;
+			if (rightRoot !== void 0 && executionPathsOverlap(leftRoot, rightRoot)) throw new Error(`execution ${leftName} and ${rightName} roots must be distinct and non-overlapping`);
 		}
 	}
-	await visit(absoluteRoot);
-	return scanned;
 }
-/**
-* Why one symbolic link is refused, in the terms that separate a portable link from a link that
-* reaches outside the tree.
-*
-* Every link is refused, in both mode policies. `AgentCandidateWorkspaceManifestMaterial` has no
-* representation for one — `mode`, `sha256` and `byteLength` describe a regular file — so a link
-* recorded as a file would let two different trees share one digest. The reason says which kind of
-* link it was, so a caller can tell a link it can rewrite from one it cannot.
-*/
-async function symlinkRefusal(absolute, relPath, absoluteRoot) {
-	const target = await readlink(absolute);
-	if (isAbsolute(target)) return `workspace contains an absolute symlink: ${relPath} -> ${target}`;
-	if (!isWithin(absoluteRoot, resolve(dirname(absolute), target))) return `workspace contains a symlink that escapes its tree: ${relPath} -> ${target}`;
-	let physical;
-	try {
-		physical = await realpath(absolute);
-	} catch {
-		return `workspace contains an unresolved symlink: ${relPath} -> ${target}`;
-	}
-	if (!isWithin(absoluteRoot, physical)) return `workspace contains a symlink that resolves outside its tree: ${relPath} -> ${target}`;
-	return `workspace contains a symlink: ${relPath} -> ${target}`;
-}
-function isWithin(root, path) {
-	return path === root || path.startsWith(`${root}${sep}`);
-}
-/**
-* Read one open regular file into its digest, keeping the bytes only when the caller needs them.
-*
-* The content reaches the hash in 1 MiB chunks and is never held whole for a digest-only walk, so
-* the size of the largest file does not decide whether a workspace can be described.
-* `FileHandle.readFile` refuses anything above 2 GiB with `ERR_FS_FILE_TOO_LARGE`. Hashing the
-* chunks in order equals hashing the whole buffer, so a manifest a buffered read produced is
-* reproduced byte for byte.
-*/
-async function readWorkspaceFile(descriptor, maxBytes, keepBytes, path) {
-	const hash = createHash("sha256");
-	const buffer = Buffer.allocUnsafe(1024 * 1024);
-	const chunks = [];
-	let total = 0;
-	while (true) {
-		const { bytesRead } = await descriptor.read(buffer, 0, buffer.byteLength, null);
-		if (bytesRead === 0) break;
-		total += bytesRead;
-		if (maxBytes !== void 0 && total > maxBytes) throw new Error(`workspace file exceeds its capture limit: ${path}`);
-		const chunk = buffer.subarray(0, bytesRead);
-		hash.update(chunk);
-		if (keepBytes) chunks.push(Buffer.from(chunk));
-	}
-	const sha256 = `sha256:${hash.digest("hex")}`;
-	return keepBytes ? {
-		sha256,
-		byteLength: total,
-		bytes: Buffer.concat(chunks, total)
-	} : {
-		sha256,
-		byteLength: total
-	};
+function executionPathsOverlap(left, right) {
+	const a = posix.normalize(left);
+	const b = posix.normalize(right);
+	return a === b || b.startsWith(a === "/" ? "/" : `${a}/`) || a.startsWith(b === "/" ? "/" : `${b}/`);
 }
 //#endregion
 //#region src/candidate-execution/git-materialize.ts
@@ -1618,6 +1677,7 @@ function detachPreparedCandidateState(input) {
 	});
 }
 function assertPrivateCandidateIntegrity(state) {
+	assertAgentCandidateExecutionRoots(state.roots.execution);
 	if (canonicalCandidateDigest$1(omitTopLevelDigest(state.bundle)) !== state.bundle.digest) throw new Error("prepared candidate bundle no longer matches its digest");
 	assertPlanEvidence(state.profilePlan.value, state.profilePlan.bytes, "profile plan");
 	parseAgentCandidateProfileActivation(state.profileActivation, state.profilePlan.value.digest);
@@ -1694,6 +1754,7 @@ function profileFileView(source) {
 	return Object.freeze({
 		path: source.path,
 		mode: source.mode,
+		...source.root === "agent" ? { root: "agent" } : {},
 		get bytes() {
 			return Uint8Array.from(bytes);
 		}
@@ -1721,7 +1782,7 @@ function assertExecutorInputs(state) {
 	for (let index = 0; index < expectedFiles.length; index++) {
 		const expected = expectedFiles[index];
 		const actual = state.executorInputs.profileFiles[index];
-		if (!expected || !actual || actual.path !== expected.relPath || actual.mode !== expected.mode || sha256Bytes(actual.bytes) !== expected.contentSha256) throw new Error("prepared profile executor files do not match the signed profile plan");
+		if (!expected || !actual || actual.path !== expected.relPath || (actual.root ?? "workspace") !== (expected.root ?? "workspace") || actual.mode !== expected.mode || sha256Bytes(actual.bytes) !== expected.contentSha256) throw new Error("prepared profile executor files do not match the signed profile plan");
 	}
 }
 function assertPreparedKnowledge(state) {
@@ -4050,11 +4111,25 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
 		harness: bundle.execution.harness,
 		launch: bundle.execution.launch,
 		workspace: bundle.execution.cwd.workspace,
-		workspaces: task.executionRoots,
+		workspaces: {
+			taskRoot: task.executionRoots.taskRoot,
+			...task.executionRoots.candidateRoot ? { candidateRoot: task.executionRoots.candidateRoot } : {}
+		},
 		resolvedResources: verifiedResourceTextByDigest(candidate)
 	});
-	const profileApplication = applyAgentCandidateWorkspacePlan(profileWorkspacePlan, task.stagingRoots.profileRoot, bundle.execution.cwd.workspace);
-	await verifyMaterializedProfileWorkspace(task.stagingRoots.profileRoot, profileApplication.profileActivation.profilePlan.material);
+	const profileAgentPaths = candidateProfileAgentPaths(profileWorkspacePlan, task.executionRoots.profileRoot);
+	const profileAgentStagingRoot = profileWorkspacePlan.files.some((file) => file.root === "agent") ? await mkdtemp(join(tmpdir(), "tangle-candidate-profile-agent-")) : void 0;
+	let profileApplication;
+	try {
+		profileApplication = applyAgentCandidateWorkspacePlan(profileWorkspacePlan, task.stagingRoots.profileRoot, bundle.execution.cwd.workspace, profileAgentStagingRoot ? { agentDir: profileAgentStagingRoot } : void 0);
+		await verifyMaterializedProfileWorkspace(task.stagingRoots.profileRoot, profileApplication.profileActivation.profilePlan.material);
+		if (profileAgentStagingRoot) await verifyMaterializedProfileWorkspace(profileAgentStagingRoot, profileApplication.profileActivation.profilePlan.material, "agent");
+	} finally {
+		if (profileAgentStagingRoot) await rm(profileAgentStagingRoot, {
+			recursive: true,
+			force: true
+		});
+	}
 	const profilePlanBytes = await readVerifiedArtifact(profileApplication.profileActivation.profilePlan.artifact, ports.artifacts);
 	if (!Buffer.from(profilePlanBytes).equals(Buffer.from(canonicalCandidateBytes(profileApplication.profileActivation.profilePlan.material)))) throw new Error("profile materializer did not capture exact canonical plan bytes");
 	const profileActivation = profileApplication.profileActivation;
@@ -4079,7 +4154,16 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
 		const knowledge = await prepareAgentCandidateKnowledge(candidate, ports, task.runCell.arm);
 		const knowledgePaths = knowledge ? candidateKnowledgeExecutionPaths(task.executionRoots.taskRoot, knowledge.retrievalConfig !== void 0) : void 0;
 		const baseLaunch = buildLaunch(candidate, task, profileApplication.flags);
-		const publicEnv = mergePublicEnvironment(bundle.execution.env ?? {}, profileApplication.env, bundle.execution.instructionDelivery.kind === "utf8-file" ? { [bundle.execution.instructionDelivery.env]: {
+		const publicEnv = mergePublicEnvironment(bundle.execution.env ?? {}, profileApplication.env, profileAgentPaths ? {
+			[PI_CANDIDATE_AGENT_DIR_ENV]: {
+				kind: "public",
+				value: profileAgentPaths.agentDir
+			},
+			[PI_CANDIDATE_SESSION_DIR_ENV]: {
+				kind: "public",
+				value: profileAgentPaths.sessionDir
+			}
+		} : {}, bundle.execution.instructionDelivery.kind === "utf8-file" ? { [bundle.execution.instructionDelivery.env]: {
 			kind: "public",
 			value: bundle.execution.instructionDelivery.path
 		} } : {}, knowledgePaths ? {
@@ -4311,15 +4395,14 @@ function assertTaskInput(task, delivery) {
 		if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(benchmarkTask.repository.baseTree)) throw new Error("task repository base tree is not a full Git object id");
 		if (benchmarkTask.repository.baseCommit.length !== benchmarkTask.repository.baseTree.length) throw new Error("task repository Git object formats disagree");
 	}
+	assertAgentCandidateExecutionRoots(task.executionRoots);
 	for (const [name, root] of [
-		["execution task root", task.executionRoots.taskRoot],
-		["execution candidate root", task.executionRoots.candidateRoot],
 		["staging task root", task.stagingRoots.taskRoot],
 		["staging candidate root", task.stagingRoots.candidateRoot],
 		["staging profile root", task.stagingRoots.profileRoot]
 	]) {
 		if (root === void 0) continue;
-		if (!(name.startsWith("execution") ? posix.isAbsolute(root) && posix.normalize(root) === root : isAbsolute(root) && resolve(root) === root)) throw new Error(`${name} must be a canonical absolute path`);
+		if (!(isAbsolute(root) && resolve(root) === root)) throw new Error(`${name} must be a canonical absolute path`);
 	}
 	if (!Number.isInteger(runCell.attempt) || !Number.isInteger(benchmarkTask.attempt.maxAttempts) || runCell.attempt < 1 || runCell.attempt > benchmarkTask.attempt.maxAttempts || benchmarkTask.attempt.retryPolicy === "none" && benchmarkTask.attempt.maxAttempts !== 1) throw new Error("task attempt policy is invalid");
 	const limits = benchmarkTask.limits;
@@ -4339,14 +4422,13 @@ function assertTaskInput(task, delivery) {
 		});
 	}
 	if (delivery.kind === "utf8-file") {
-		if (executionPathsOverlap(task.executionRoots.taskRoot, delivery.path) || task.executionRoots.candidateRoot !== void 0 && executionPathsOverlap(task.executionRoots.candidateRoot, delivery.path)) throw new Error("task instruction file must remain outside execution workspaces");
+		if ([
+			task.executionRoots.taskRoot,
+			task.executionRoots.candidateRoot,
+			task.executionRoots.profileRoot
+		].some((root) => root !== void 0 && executionPathsOverlap(root, delivery.path))) throw new Error("task instruction file must remain outside execution workspaces");
 	}
 }
-function executionPathsOverlap(left, right) {
-	const a = posix.normalize(left);
-	const b = posix.normalize(right);
-	return a === b || b.startsWith(a === "/" ? "/" : `${a}/`) || a.startsWith(b === "/" ? "/" : `${b}/`);
-}
 function assertDisjointHostStagingRoots(task) {
 	const roots = [
 		task.stagingRoots.taskRoot,
@@ -4519,12 +4601,16 @@ function candidateEntrypointReceipt(candidate) {
 	};
 }
 function absoluteExecutionCwd(cwd, roots) {
-	const root = cwd.workspace === "task" ? roots.taskRoot : roots.candidateRoot;
-	if (!root) throw new Error("candidate cwd is missing its execution workspace root");
+	const root = workspaceExecutionRoot(cwd.workspace, roots);
 	const absolute = cwd.path === "." ? root : posix.join(root, cwd.path);
 	if (absolute !== root && !absolute.startsWith(`${root}/`)) throw new Error("candidate cwd escapes its execution workspace");
 	return absolute;
 }
+function workspaceExecutionRoot(workspace, roots) {
+	const root = workspace === "task" ? roots.taskRoot : roots.candidateRoot;
+	if (!root) throw new Error(`candidate ${workspace} workspace root is missing`);
+	return root;
+}
 function validateProtectedModelReservation(reservation, expectedLimits, preparationId, expiresAtMs) {
 	if (!/^sha256:[a-f0-9]{64}$/.test(reservation.digest)) throw new Error("protected model reservation has an invalid identity digest");
 	if (reservation.preparationId !== preparationId || reservation.expiresAtMs !== expiresAtMs) throw new Error("protected model reservation is not scoped to this preparation");
@@ -4549,24 +4635,28 @@ function modelLimits(limits) {
 	};
 }
 function exactProfileExecutorFiles(sourceFiles, expectedFiles) {
-	const byPath = new Map(sourceFiles.map((file) => [file.relPath, file]));
-	if (byPath.size !== sourceFiles.length || sourceFiles.length !== expectedFiles.length) throw new Error("profile source files do not match the signed profile plan");
+	const byIdentity = new Map(sourceFiles.map((file) => [profileFileIdentity(file.root, file.relPath), file]));
+	if (byIdentity.size !== sourceFiles.length || sourceFiles.length !== expectedFiles.length) throw new Error("profile source files do not match the signed profile plan");
 	return expectedFiles.map((expected) => {
-		const source = byPath.get(expected.relPath);
+		const source = byIdentity.get(profileFileIdentity(expected.root, expected.relPath));
 		const mode = source?.mode ?? 420;
 		const bytes = Buffer.from(source?.content ?? "", "utf8");
 		if (!source || !Number.isInteger(mode) || mode < 0 || mode > 511 || mode !== expected.mode || sha256Bytes(bytes) !== expected.contentSha256) throw new Error("profile source files do not match the signed profile plan");
 		return {
 			path: expected.relPath,
 			mode,
+			...expected.root === "agent" ? { root: "agent" } : {},
 			bytes: Uint8Array.from(bytes)
 		};
 	});
 }
+function profileFileIdentity(root, relPath) {
+	return `${root ?? "workspace"}\0${relPath}`;
+}
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
-export { parseAgentCandidateProfileActivation as $, verifyMaterializedWorkspace as A, rejectedStage as B, assertNoGitIndirection as C, captureMaterializedWorkspace as D, candidateWorkspaceManifest as E, assertTerminalAllowedInPhase as F, isWellFormedUnicode as G, sealTerminalDigest as H, assertTerminalMatchesClaim as I, assertCandidateProfileBinding as J, agentCandidateProfileAsAgentProfile as K, assertTerminalMatchesStaged as L, candidateCleanupTimeout as M, withinCandidateCleanupDeadline as N, readVerifiedArtifact as O, assertRecoveryMatchesStaged as P, omitUndefinedObjectFields as Q, recoveredTerminalRecord as R, CANDIDATE_TRACE_TAGS as S, runCandidateGit as T, terminalRecord as U, requireStagedTerminal as V, assertExactObjectKeys as W, freezeGenericAgentCandidateProfile as X, createAgentCandidateProfileActivation as Y, materializeAgentCandidateProfilePlan as Z, candidateExecutionClaim as _, persistCandidateOutputArtifact as a, canonicalCandidateDocument as at, consumePreparedCandidateExecution as b, CANDIDATE_KNOWLEDGE_ROOT_ENV as c, immutableCandidateValue as ct, verifiedResourceTextByDigest as d, verifyCanonicalCandidateDocument as dt, parseExactAgentProfile as et, verifyAgentCandidateBundle as f, candidateClaimFileInternals as g, InMemoryAgentCandidateExecutionClaimStore as h, persistCandidateModelSettlementEvidence as i, canonicalCandidateDigest$1 as it, candidateCleanupDeadline as j, verifyBytes as k, candidateKnowledgeExecutionPaths as l, omitTopLevelDigest as lt, usdToNanos as m, executePreparedAgentCandidate as n, parseExactCandidateProfile as nt, sealAgentCandidateExecutorStopAcknowledgement as o, deepFreezeCandidate as ot, sealAgentCandidateModelSettlement as p, applyExactAgentProfileDiff as q, RecoveryAgentCandidateTraceStore as r, canonicalCandidateBytes as rt, CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV as s, embeddedCandidateArtifact as st, prepareAgentCandidateExecution as t, parseExactAgentProfileDiff as tt, AGENT_CANDIDATE_EXECUTION_SUPPORT as u, sha256Bytes as ut, assertPreparedCandidateIntegrity as v, readCandidateGitTreeFiles as w, CANDIDATE_TRACE_ENV as x, beginPreparedCandidateDisposal as y, rejectedFinish as z };
+export { parseExactAgentProfile as $, assertRecoveryMatchesStaged as A, assertExactObjectKeys as B, assertNoGitIndirection as C, candidateCleanupDeadline as D, assertAgentCandidateExecutionRoots as E, rejectedFinish as F, applyExactAgentProfileDiff as G, PI_CANDIDATE_AGENT_DIR_ENV as H, rejectedStage as I, createAgentCandidateProfileActivation as J, assertCandidateProfileBinding as K, requireStagedTerminal as L, assertTerminalMatchesClaim as M, assertTerminalMatchesStaged as N, candidateCleanupTimeout as O, recoveredTerminalRecord as P, parseAgentCandidateProfileActivation as Q, sealTerminalDigest as R, CANDIDATE_TRACE_TAGS as S, runCandidateGit as T, PI_CANDIDATE_SESSION_DIR_ENV as U, isWellFormedUnicode as V, agentCandidateProfileAsAgentProfile as W, materializeAgentCandidateProfilePlan as X, freezeGenericAgentCandidateProfile as Y, omitUndefinedObjectFields as Z, candidateExecutionClaim as _, persistCandidateOutputArtifact as a, scanMaterializedWorkspaceManifest as at, consumePreparedCandidateExecution as b, CANDIDATE_KNOWLEDGE_ROOT_ENV as c, canonicalCandidateBytes as ct, verifiedResourceTextByDigest as d, deepFreezeCandidate as dt, parseExactAgentProfileDiff as et, verifyAgentCandidateBundle as f, embeddedCandidateArtifact as ft, candidateClaimFileInternals as g, verifyCanonicalCandidateDocument as gt, InMemoryAgentCandidateExecutionClaimStore as h, sha256Bytes as ht, persistCandidateModelSettlementEvidence as i, readVerifiedArtifact as it, assertTerminalAllowedInPhase as j, withinCandidateCleanupDeadline as k, candidateKnowledgeExecutionPaths as l, canonicalCandidateDigest$1 as lt, usdToNanos as m, omitTopLevelDigest as mt, executePreparedAgentCandidate as n, candidateWorkspaceManifest as nt, sealAgentCandidateExecutorStopAcknowledgement as o, verifyBytes as ot, sealAgentCandidateModelSettlement as p, immutableCandidateValue as pt, candidateProfileAgentPaths as q, RecoveryAgentCandidateTraceStore as r, captureMaterializedWorkspace as rt, CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV as s, verifyMaterializedWorkspace as st, prepareAgentCandidateExecution as t, parseExactCandidateProfile as tt, AGENT_CANDIDATE_EXECUTION_SUPPORT as u, canonicalCandidateDocument as ut, assertPreparedCandidateIntegrity as v, readCandidateGitTreeFiles as w, CANDIDATE_TRACE_ENV as x, beginPreparedCandidateDisposal as y, terminalRecord as z };
 
-//# sourceMappingURL=prepare-BpIGs5Tc.js.map
+//# sourceMappingURL=prepare-B5fJ7mLS.js.map