@tangle-network/agent-runtime 0.190.0 → 0.192.0

package/dist/{supervisor-CqJW4qap.js → redact-h5zAxyNV.js}

@@ -6,7 +6,7 @@ import { _ as throwIfAborted, a as cloneTokenUsage, b as zeroSpend, d as randomS
 import { _ as parseCodexUsageRecord, c as mapSandboxToolEvent, d as sandboxProgressEvents, h as parseCanonicalTransportEvent, i as createSandboxUsageLedger, l as notifySandboxEventObserver, m as extractTransportEventIdentity, r as createSandboxToolPartState, t as assertSandboxServedModel, u as sandboxEventServedBackend } from "./sandbox-events-DWeQRWxg.js";
 import { n as executableAgentSpecSnapshot, r as projectSandboxOutcome, t as executableAgentProfileSnapshot } from "./executable-spec-DxuiDFAU.js";
 import { a as concreteProfileModel, c as profileModelExecutionSettings, d as agentHarness, l as profileProviderModel, o as enforceTokenLimits, s as profileBridgeWireModel, t as assertExecutableAgentProfile, u as resolveRouterRetryPolicy } from "./model-policy-Wf2MxXJ9.js";
-import { c as linkAbort, i as resolveAgentEnvironmentProvider, l as runAbortable, n as providerAsExecutor, r as providerAsSandboxClient, s as abortError$1 } from "./environment-provider-DcelIawX.js";
+import { c as linkAbort, i as resolveAgentEnvironmentProvider, l as runAbortable, n as providerAsExecutor, r as providerAsSandboxClient, s as abortError$1 } from "./environment-provider-DEwsolvi.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
 import { n as assertNoSymlinkDescendant, r as publishExclusiveDurableFile } from "./durable-file-D24y9zg7.js";
 import { AGENT_PROFILE_MATERIALIZATION_AXES, AgentEnvironmentCapabilitiesSchema, AgentExactRunControlRefSchema, AgentInteractiveSessionControlClaimAcknowledgementSchema, AgentInteractiveSessionControlClaimSchema, AgentInteractiveSessionPromptAcknowledgementSchema, AgentInteractiveSessionRefSchema, AgentInteractiveSessionStatusSchema, AgentInteractiveSessionStopAcknowledgementSchema, AgentNativeContextContinuationResultSchema, AgentTurnInputSchema, AgentTurnResultSchema, ContextTransferRequestSchema, InteractionAcknowledgementSchema, InteractionResponseCommandSchema, NativeContextBoundaryProofSchema, NativeContextContinuationRequestSchema, REASONING_EFFORTS, RuntimeEventEnvelopeSchema, TerminalReplayWindowSchema, TerminalSessionRefSchema, agentInteractiveSessionControlClaimAcknowledgementMatchesRequest, agentInteractiveSessionControlClaimMatchesRef, agentInteractiveSessionPromptAcknowledgementMatchesCommand, agentInteractiveSessionRefMatchesStart, agentInteractiveSessionRunRef, agentInteractiveSessionStatusMatchesRef, agentInteractiveSessionStopAcknowledgementMatchesCommand, agentNativeContextContinuationResultMatchesRequest, agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, exactAgentInteractiveSessionStart, harnessTypeSchema, nativeContextContinuationTurnDigest, nativeReasoningControl, profileMaterializationAxes, profileMaterializationAxes as profileMaterializationAxes$1, renderInputPartsAsText, sha256DigestSchema } from "@tangle-network/agent-interface";
@@ -3723,12 +3723,15 @@ function naturalNumber(value) {
 //#endregion
 //#region src/runtime/model-identity.ts
 const SNAPSHOT_TOKEN = /^[A-Za-z0-9._-]+$/u;
+const datedIsoSuffix = /^(.*)-(\d{4})-(\d{2})-(\d{2})$/u;
+const datedCompactSuffix = /^(.*)-(\d{4})(\d{2})(\d{2})$/u;
+const datedMonthSuffix = /^(.*)-(\d{4})-(\d{2})$/u;
 /** Match equivalent bare and provider-qualified spellings without discarding observed identity. */
 function observedModelMatchesDeclared(observed, declared) {
 	const observedIdentity = modelIdentityParts(observed);
 	const declaredIdentity = modelIdentityParts(declared);
 	if (!observedIdentity || !declaredIdentity) return false;
-	if (declaredIdentity.snapshot !== void 0 && observedIdentity.snapshot !== declaredIdentity.snapshot) return false;
+	if (declaredIdentity.snapshot !== void 0 && (observedIdentity.snapshot !== declaredIdentity.snapshot || observedIdentity.snapshotKind !== declaredIdentity.snapshotKind)) return false;
 	return equivalentModelBase(observedIdentity.base, declaredIdentity.base);
 }
 /** Merge two observations of one served model while retaining a snapshot-bearing raw identity. */
@@ -3737,15 +3740,21 @@ function mergeObservedModelIdentity(current, next) {
 	const nextIdentity = modelIdentityParts(next);
 	if (!currentIdentity || !nextIdentity) return void 0;
 	if (!equivalentModelBase(currentIdentity.base, nextIdentity.base)) return void 0;
-	if (currentIdentity.snapshot !== void 0 && nextIdentity.snapshot !== void 0 && currentIdentity.snapshot !== nextIdentity.snapshot) return;
+	if (currentIdentity.snapshot !== void 0 && nextIdentity.snapshot !== void 0 && (currentIdentity.snapshot !== nextIdentity.snapshot || currentIdentity.snapshotKind !== nextIdentity.snapshotKind)) return;
 	return currentIdentity.snapshot === void 0 && nextIdentity.snapshot !== void 0 ? next : current;
 }
-/** Canonicalize a served model for cross-route identity comparisons. */
-function canonicalObservedModel(model) {
+/** Return the canonical model and its validated snapshot kind for runtime evidence reduction. */
+function canonicalObservedModelParts(model) {
 	const identity = modelIdentityParts(model);
 	if (!identity) return void 0;
 	const base = identity.base.slice(identity.base.lastIndexOf("/") + 1);
-	return identity.snapshot === void 0 ? base : `${base}@${identity.snapshot}`;
+	const canonical = identity.snapshot === void 0 ? base : identity.snapshotKind === "date" ? `${base}-${identity.snapshot}` : `${base}@${identity.snapshot}`;
+	return {
+		base,
+		...identity.snapshot !== void 0 ? { snapshot: identity.snapshot } : {},
+		...identity.snapshotKind !== void 0 ? { snapshotKind: identity.snapshotKind } : {},
+		canonical
+	};
 }
 /** Return whether an observed identity includes a provider snapshot. */
 function observedModelHasSnapshot(model) {
@@ -3754,21 +3763,100 @@ function observedModelHasSnapshot(model) {
 function modelIdentityParts(model) {
 	if (model.length === 0) return null;
 	const at = model.lastIndexOf("@");
-	if (at < 0) return modelLeaf(model).length === 0 ? null : { base: model };
+	if (at < 0) {
+		const dated = datedModelIdentity(model);
+		if (dated !== void 0) return dated;
+		return modelLeaf(model).length === 0 ? null : { base: model };
+	}
 	const base = model.slice(0, at);
 	const snapshot = model.slice(at + 1);
 	if (base.length === 0 || modelLeaf(base).length === 0 || !SNAPSHOT_TOKEN.test(snapshot)) return null;
 	return {
 		base,
-		snapshot
+		snapshot,
+		snapshotKind: "opaque"
 	};
 }
 function equivalentModelBase(observed, declared) {
-	return modelLeaf(observed) === modelLeaf(declared);
+	const observedPath = modelBaseParts(observed);
+	const declaredPath = modelBaseParts(declared);
+	if (!samePath(observedPath.path, declaredPath.path)) return false;
+	if (observedPath.provider === void 0 || declaredPath.provider === void 0 || observedPath.provider === declaredPath.provider) return true;
+	if (observedPath.provider === "tangle-router" || declaredPath.provider === "tangle-router") {
+		const router = observedPath.provider === "tangle-router" ? observedPath : declaredPath;
+		const upstream = observedPath.provider === "tangle-router" ? declaredPath : observedPath;
+		if (upstream.provider === void 0) return false;
+		return samePath(router.path, upstream.path) || router.path[0] === upstream.provider && samePath(router.path.slice(1), upstream.path);
+	}
+	return false;
+}
+function modelBaseParts(model) {
+	const segments = model.split("/");
+	const normalized = segments.length > 1 && isHarnessPrefix(segments[0]) ? segments.slice(1) : segments;
+	if (normalized.length === 1) return {
+		provider: void 0,
+		path: normalized
+	};
+	return {
+		provider: normalized[0],
+		path: normalized.slice(1)
+	};
+}
+function isHarnessPrefix(segment) {
+	return segment !== void 0 && harnessTypeSchema.safeParse(segment).success;
+}
+function samePath(left, right) {
+	return left.length === right.length && left.every((segment, index) => segment === right[index]);
 }
 function modelLeaf(model) {
 	return model.slice(model.lastIndexOf("/") + 1);
 }
+/**
+* Parse the provider's documented dated snapshot forms.
+*
+* `undefined` means that the model has no dated shape and must be treated as a normal base.
+* `null` means that it has a dated shape but the date is invalid, so identity matching fails.
+*/
+function datedModelIdentity(model) {
+	const iso = datedIsoSuffix.exec(model);
+	if (iso) {
+		const [, base, yearText, monthText, dayText] = iso;
+		return buildDatedIdentity(base, `${yearText}-${monthText}-${dayText}`, isValidCalendarDate(yearText, monthText, dayText));
+	}
+	const compact = datedCompactSuffix.exec(model);
+	if (compact) {
+		const [, base, yearText, monthText, dayText] = compact;
+		return buildDatedIdentity(base, `${yearText}-${monthText}-${dayText}`, isValidCalendarDate(yearText, monthText, dayText));
+	}
+	const month = datedMonthSuffix.exec(model);
+	if (month) {
+		const [, base, yearText, monthText] = month;
+		return buildDatedIdentity(base, `${yearText}-${monthText}`, isValidCalendarMonth(yearText, monthText));
+	}
+}
+function buildDatedIdentity(base, snapshot, valid) {
+	if (base === void 0 || base.length === 0 || base.endsWith("/")) return void 0;
+	return valid ? {
+		base,
+		snapshot,
+		snapshotKind: "date"
+	} : null;
+}
+function isValidCalendarDate(yearText, monthText, dayText) {
+	if (yearText === void 0 || monthText === void 0 || dayText === void 0) return false;
+	const year = Number(yearText);
+	const month = Number(monthText);
+	const day = Number(dayText);
+	if (year < 2e3 || year > 2099 || month < 1 || month > 12 || day < 1 || day > 31) return false;
+	const date = new Date(Date.UTC(year, month - 1, day));
+	return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
+}
+function isValidCalendarMonth(yearText, monthText) {
+	if (yearText === void 0 || monthText === void 0) return false;
+	const year = Number(yearText);
+	const month = Number(monthText);
+	return year >= 2e3 && year <= 2099 && month >= 1 && month <= 12;
+}
 //#endregion
 //#region src/runtime/tool-loop.ts
 /**
@@ -11343,7 +11431,7 @@ async function teardownExecutor(executor, grace, deadlineAtMs, now) {
 			if (timer !== void 0) clearTimeout(timer);
 		}
 	}
-	if (!receipt.destroyed) throw new ValidationError("executor teardown reported destroyed=false");
+	if (!receipt.destroyed) throw new ValidationError(`executor teardown reported destroyed=false${receipt.detail ? `: ${receipt.detail}` : ""}`);
 }
 //#endregion
 //#region src/runtime/supervise/dispatch.ts
@@ -16146,6 +16234,85 @@ function isNonEmptySpend(s) {
 	return s.iterations > 0 || s.tokens.input > 0 || s.tokens.output > 0 || s.usd > 0 || s.ms > 0 || s.tokensKnown === false || s.usdKnown === false;
 }
 //#endregion
-export { bridgeModelRouteRefusal as $, createPropagatingTraceEmitter as $t, readWorkerInteractiveBinding as A, parseCodexTokenUsage as An, peerMailVerbNames as At, retainedCreateMaterial as B, promptOnlyProfileMaterialization as Bn, createSandboxLineage as Bt, timerAt as C, captureWorktreeDiff as Cn, AUTHORITY_MARKERS as Ct, readWorkerInteractiveAdmissions as D, LOCAL_HARNESSES as Dn, createPeerMailbox as Dt, interactiveAdmissionSeamKey as E, DEFAULT_LOCAL_HARNESS as En, claimsAuthority as Et, startRetainedInteractiveRun as F, defineProfileMaterializationContract as Fn, TERMINAL_DECISIONS as Ft, rollingDispatch as G, unsupportedProfileDimensions as Gn, routerBrain as Gt, effectiveConcurrency as H, renderProfileMaterializationIssues as Hn, acquireSandbox as Ht, reconnectRetainedRun as I, fullProfileMaterialization as In, createSandboxForSpec as It, assertValidBudget as J, observedModelMatchesDeclared as Jt, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as K, validateProfileMaterialization as Kn, runBrainLoop as Kt, recoverRetainedRun as L, profileMaterializationAxes$1 as Ln, defaultSelectWinner as Lt, workerInteractiveBindingsDir as M, AGENT_PROFILE_MATERIALIZATION_AXES as Mn, isTerminalNodeStatus as Mt, reconnectRetainedInteractiveRun as N, assertProfileMaterialization as Nn, createInPlaceCliExecutor as Nt, workerInteractiveAdmissionFile as O, harnessSupportsReasoningEffort as On, isPeerMailEnvelope as Ot, recoverRetainedInteractiveRun as P, controlProfileMaterialization as Pn, taskToPrompt as Pt, bridgeAdmissionRead as Q, readCodexRolloutSession as Qt, startRetainedRun as R, promptControlProfileMaterialization as Rn, isTerminalDecision as Rt, pollFor as S, runWorktreeHarness as Sn, createInbox as St, waitUntil as T, removeWorktree as Tn, PEER_MAIL_WIRE_KEY as Tt, freeSlots as U, renderUnsupported as Un, assertBoxlessPromptOptions as Ut, destroyInteractiveEnvironment as V, promptResourceProfileMaterialization as Vn, probeSandboxCapabilities as Vt, queueOf as W, sandboxActProfileMaterialization as Wn, readPromptOptions as Wt, spendFromUsageEvents as X, createCodexRolloutStoreReader as Xt, createBudgetPool as Y, addHarnessUsage as Yt, bindReusableExecutorExecutionId as Z, harnessUsageIsEmpty as Zt, recordScopeOwnerMaterialization as _, createRuntimeStreamEventCollector as _n, decodeToolPart as _t, uncertainSpawnBudgets as a, buildLoopSpanNodes as an, createExecutor as at, createWaitProbes as b, sanitizeRuntimeStreamEvent as bn, createActivityLog as bt, pickBestDelivered as c, createOtelExporter as cn, createWorktreeCliExecutor as ct, driverChild as d, generateSpanId as dn, workerTraceEnv as dt, mergeTraceEnv as en, bridgeRuntimeAttachmentsKey as et, withDriverExecutor as f, loopEventToOtelSpan as fn, workerTraceHeaders as ft, meterRuntimeOwnedProviderAttempt as g, createRuntimeEventCollector as gn, createPushTraceSource as gt, meterRuntimeOwnedAccounting as h, toOtelAttributes as hn, createSteerableSandboxSession as ht, sumMeasuredSpendFromEvents as i, buildLoopOtelSpans as in, cliWorktreeExecutor as it, workerInteractiveBindingFile as j, CodexExecutionDiagnosticError as jn, isLiveNodeStatus as jt, attachWorker as k, localHarnessExecutable as kn, peerMailTools as kt, runFinalizer as l, exportEvalRuns as ln, WORKER_TRACE_PROPAGATION as lt, deriveNodeExecutionIdentity as m, padTraceId as mn, DEFAULT_SANDBOX_STEERING_MAX_TURNS as mt, createSupervisor as n, traceContextToEnv as nn, captureReusableExecutorConfig as nt, bestDelivered as o, buildRuntimeEventOtelSpans as on, createExecutorRegistry as ot, createScope as p, padSpanId as pn, workerTraceSeamKey as pt, teardownExecutor as q, worktreeCliProfileMaterialization as qn, canonicalObservedModel as qt, maxSeqOf as r, INTELLIGENCE_WIRE_VERSION as rn, cliInPlaceExecutor as rt, collectDelivered as s, createOpenInferenceFileExporter as sn, snapshotExecutorConfig as st, createRootHandle as t, readTraceContextFromEnv as tn, bridgeStopSignalKey as tt, runTree as u, flatOtelSpan as un, readWorkerTraceContext as ut, scopeOwnerExecutorNodeContext as v, sanitizeAgentRuntimeEvent as vn, sandboxSessionTraceSource as vt, validateWaitSpec as w, createWorktree as wn, DEFAULT_PEER_MAIL_LIMITS as wt, isWaitOutcome as x, runSettledCommand as xn, readWorkerProgress as xt, settledToIteration as y, sanitizeKnowledgeReadinessReport as yn, DEFAULT_STALL_AFTER_MS as yt, startRetainedRunInEnvironment as z, promptModelProfileMaterialization as zn, runAgentRounds as zt };
+//#region src/redact.ts
+const redactedMarker = "[redacted]";
+/** Secret-bearing key names: when an object key matches, its value is fully
+*  replaced regardless of the value's own content. Lowercased compare. */
+const secretKeyPattern = /(api[-_]?key|secret|token|password|passwd|authorization|auth|private[-_]?key|credential|access[-_]?key|client[-_]?secret|session[-_]?(id|token)|cookie|bearer)/i;
+/** In-value secret/PII patterns scrubbed from any string, regardless of key. */
+const valuePatterns = [
+	/\bBearer\s+[A-Za-z0-9._\-+/=]{8,}/gi,
+	/\b(?:sk|pk|rk|ak)[-_][A-Za-z0-9_-]{12,}/g,
+	/\bgh[pousr]_[A-Za-z0-9]{20,}/g,
+	/\bAKIA[0-9A-Z]{16}\b/g,
+	/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+	/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g
+];
+/** Secret assignments embedded inside an otherwise opaque string, including
+* serialized JSON and log-style `key=value` text. */
+const secretAssignmentPattern = /((?:"|')?(?:api[-_]?key|secret|token|password|passwd|authorization|auth|private[-_]?key|credential|access[-_]?key|client[-_]?secret|session[-_]?(?:id|token)|cookie|bearer)(?:"|')?\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;}]+)/gi;
+/** Scrub a single string of in-value secret/PII patterns. */
+function scrubString(input) {
+	let out = input;
+	for (const pattern of valuePatterns) out = out.replace(pattern, redactedMarker);
+	return out.replace(secretAssignmentPattern, `$1${redactedMarker}`);
+}
+/**
+* The built-in redactor. Walks objects and arrays; replaces values under
+* secret-bearing keys wholesale; scrubs in-value patterns from every string.
+* Cycle-safe (a seen-set short-circuits self-referential payloads to
+* `'[circular]'`), depth-bounded, and total — never throws on customer input.
+*/
+function defaultRedactor(value) {
+	return walk(value, /* @__PURE__ */ new WeakSet(), 0);
+}
+const maxDepth = 32;
+function walk(value, seen, depth) {
+	if (depth > maxDepth) return "[truncated]";
+	if (typeof value === "string") return scrubString(value);
+	if (value === null || typeof value !== "object") return value;
+	if (seen.has(value)) return "[circular]";
+	seen.add(value);
+	if (Array.isArray(value)) return value.map((item) => walk(item, seen, depth + 1));
+	const out = {};
+	for (const [key, v] of Object.entries(value)) {
+		if (secretKeyPattern.test(key)) {
+			out[key] = redactedMarker;
+			continue;
+		}
+		out[key] = walk(v, seen, depth + 1);
+	}
+	return out;
+}
+/** Stable identity input for saved work that depends on built-in redaction behavior. */
+function defaultRedactorIdentityMaterial() {
+	const patternIdentity = (pattern) => ({
+		source: pattern.source,
+		flags: pattern.flags
+	});
+	return {
+		marker: redactedMarker,
+		secretKeyPattern: patternIdentity(secretKeyPattern),
+		valuePatterns: valuePatterns.map(patternIdentity),
+		secretAssignmentPattern: patternIdentity(secretAssignmentPattern),
+		maxDepth,
+		scrubString: Function.prototype.toString.call(scrubString),
+		walk: Function.prototype.toString.call(walk),
+		defaultRedactor: Function.prototype.toString.call(defaultRedactor)
+	};
+}
+/**
+* Resolve the redactor a client uses. A caller-supplied hook handles
+* domain-specific values first, then the built-in scrubber still removes
+* common credentials and email addresses. Returning `false` is the explicit
+* opt-out for already-reviewed public values.
+*/
+function resolveRedactor(redact) {
+	if (redact === false) return (value) => value;
+	if (!redact) return defaultRedactor;
+	return (value) => defaultRedactor(redact(value));
+}
+//#endregion
+export { spendFromUsageEvents as $, createCodexRolloutStoreReader as $t, readWorkerInteractiveAdmissions as A, LOCAL_HARNESSES as An, createPeerMailbox as At, recoverRetainedRun as B, profileMaterializationAxes$1 as Bn, defaultSelectWinner as Bt, createWaitProbes as C, sanitizeRuntimeStreamEvent as Cn, createActivityLog as Ct, validateWaitSpec as D, createWorktree as Dn, DEFAULT_PEER_MAIL_LIMITS as Dt, timerAt as E, captureWorktreeDiff as En, AUTHORITY_MARKERS as Et, workerInteractiveBindingsDir as F, AGENT_PROFILE_MATERIALIZATION_AXES as Fn, isTerminalNodeStatus as Ft, effectiveConcurrency as G, renderProfileMaterializationIssues as Gn, acquireSandbox as Gt, startRetainedRunInEnvironment as H, promptModelProfileMaterialization as Hn, runAgentRounds as Ht, reconnectRetainedInteractiveRun as I, assertProfileMaterialization as In, createInPlaceCliExecutor as It, rollingDispatch as J, unsupportedProfileDimensions as Jn, routerBrain as Jt, freeSlots as K, renderUnsupported as Kn, assertBoxlessPromptOptions as Kt, recoverRetainedInteractiveRun as L, controlProfileMaterialization as Ln, taskToPrompt as Lt, attachWorker as M, localHarnessExecutable as Mn, peerMailTools as Mt, readWorkerInteractiveBinding as N, parseCodexTokenUsage as Nn, peerMailVerbNames as Nt, waitUntil as O, removeWorktree as On, PEER_MAIL_WIRE_KEY as Ot, workerInteractiveBindingFile as P, CodexExecutionDiagnosticError as Pn, isLiveNodeStatus as Pt, createBudgetPool as Q, addHarnessUsage as Qt, startRetainedInteractiveRun as R, defineProfileMaterializationContract as Rn, TERMINAL_DECISIONS as Rt, settledToIteration as S, sanitizeKnowledgeReadinessReport as Sn, DEFAULT_STALL_AFTER_MS as St, pollFor as T, runWorktreeHarness as Tn, createInbox as Tt, retainedCreateMaterial as U, promptOnlyProfileMaterialization as Un, createSandboxLineage as Ut, startRetainedRun as V, promptControlProfileMaterialization as Vn, isTerminalDecision as Vt, destroyInteractiveEnvironment as W, promptResourceProfileMaterialization as Wn, probeSandboxCapabilities as Wt, teardownExecutor as X, worktreeCliProfileMaterialization as Xn, canonicalObservedModelParts as Xt, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as Y, validateProfileMaterialization as Yn, runBrainLoop as Yt, assertValidBudget as Z, observedModelMatchesDeclared as Zt, deriveNodeExecutionIdentity as _, padTraceId as _n, DEFAULT_SANDBOX_STEERING_MAX_TURNS as _t, createSupervisor as a, traceContextToEnv as an, captureReusableExecutorConfig as at, recordScopeOwnerMaterialization as b, createRuntimeStreamEventCollector as bn, decodeToolPart as bt, uncertainSpawnBudgets as c, buildLoopSpanNodes as cn, createExecutor as ct, pickBestDelivered as d, createOtelExporter as dn, createWorktreeCliExecutor as dt, harnessUsageIsEmpty as en, bindReusableExecutorExecutionId as et, runFinalizer as f, exportEvalRuns as fn, WORKER_TRACE_PROPAGATION as ft, createScope as g, padSpanId as gn, workerTraceSeamKey as gt, withDriverExecutor as h, loopEventToOtelSpan as hn, workerTraceHeaders as ht, createRootHandle as i, readTraceContextFromEnv as in, bridgeStopSignalKey as it, workerInteractiveAdmissionFile as j, harnessSupportsReasoningEffort as jn, isPeerMailEnvelope as jt, interactiveAdmissionSeamKey as k, DEFAULT_LOCAL_HARNESS as kn, claimsAuthority as kt, bestDelivered as l, buildRuntimeEventOtelSpans as ln, createExecutorRegistry as lt, driverChild as m, generateSpanId as mn, workerTraceEnv as mt, defaultRedactorIdentityMaterial as n, createPropagatingTraceEmitter as nn, bridgeModelRouteRefusal as nt, maxSeqOf as o, INTELLIGENCE_WIRE_VERSION as on, cliInPlaceExecutor as ot, runTree as p, flatOtelSpan as pn, readWorkerTraceContext as pt, queueOf as q, sandboxActProfileMaterialization as qn, readPromptOptions as qt, resolveRedactor as r, mergeTraceEnv as rn, bridgeRuntimeAttachmentsKey as rt, sumMeasuredSpendFromEvents as s, buildLoopOtelSpans as sn, cliWorktreeExecutor as st, defaultRedactor as t, readCodexRolloutSession as tn, bridgeAdmissionRead as tt, collectDelivered as u, createOpenInferenceFileExporter as un, snapshotExecutorConfig as ut, meterRuntimeOwnedAccounting as v, toOtelAttributes as vn, createSteerableSandboxSession as vt, isWaitOutcome as w, runSettledCommand as wn, readWorkerProgress as wt, scopeOwnerExecutorNodeContext as x, sanitizeAgentRuntimeEvent as xn, sandboxSessionTraceSource as xt, meterRuntimeOwnedProviderAttempt as y, createRuntimeEventCollector as yn, createPushTraceSource as yt, reconnectRetainedRun as z, fullProfileMaterialization as zn, createSandboxForSpec as zt };
 
-//# sourceMappingURL=supervisor-CqJW4qap.js.map
+//# sourceMappingURL=redact-h5zAxyNV.js.map