@tangle-network/agent-runtime 0.196.0 → 0.198.1

package/dist/{runtime-DqRieJ6e.js → runtime-BrTBBSfC.js}

@@ -1,37 +1,395 @@
-import { E as detachedFrozen } from "./materialization-Cy0oM8tb.js";
+import { $r as executableAgentProfileSnapshot, $t as defaultSelectWinner, Bt as insideCursorNamespace, Cn as randomSuffix, K as rollingDispatch, Mr as parseCommittedJsonLines, Nr as prepareJsonlAppend, Pr as writeAllBytes, Rt as InMemoryResultBlobStore, Tn as stringifySafe, Xt as contentAddress, _n as chargedTokens, _t as createPushTraceSource, a as createSupervisor, an as assertBoxlessPromptOptions, b as settledToIteration, bn as hasCompleteCacheBreakdown, cn as runBrainLoop, ei as executableAgentSpecSnapshot, f as withDriverExecutor, gn as addSpend, jr as isNoEntError, kn as zeroSpend, ln as canonicalObservedModelParts, lt as createWorktreeCliExecutor, nn as createSandboxLineage, on as readPromptOptions, ot as createExecutor, qt as isTraceAnalysisStore, rn as probeSandboxCapabilities, sn as routerBrain, st as createExecutorRegistry, ti as detachedFrozen, tn as runAgentRounds, vn as cloneSpend, wn as sleep, xn as isAbortError, zt as InMemorySpawnJournal } from "./redact-CVyxp2AU.js";
 import { m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
-import "./stream-agent-turn-Dt5mZpc3.js";
-import { f as sha256Bytes, i as redactProtectedValue, o as canonicalCandidateDigest$1, r as redactProtectedReason, u as immutableCandidateValue } from "./protected-redaction-wGo44k2K.js";
+import { C as observe, O as strategyAuthorMethod, T as profileChatClient, b as sample, v as refine, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-D__lmWXe.js";
 import { l as notifySandboxEventObserver } from "./sandbox-events-DbC2WKKS.js";
-import { a as executableAgentProfileSnapshot, i as writeAllBytes, n as parseCommittedJsonLines, o as executableAgentSpecSnapshot, r as prepareJsonlAppend, t as isNoEntError } from "./jsonl-file-BEpaEYjT.js";
 import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, t as assertExecutableAgentProfile } from "./model-policy-DKDyr-fc.js";
-import { C as settledToIteration, Ht as InMemorySpawnJournal, Vt as InMemoryResultBlobStore, Wt as insideCursorNamespace, Y as rollingDispatch, Zt as isTraceAnalysisStore, a as createSupervisor, an as runAgentRounds, bt as createPushTraceSource, dn as routerBrain, en as contentAddress, fn as runBrainLoop, ft as createWorktreeCliExecutor, h as withDriverExecutor, ln as assertBoxlessPromptOptions, lt as createExecutor, on as createSandboxLineage, pn as canonicalObservedModelParts, rn as defaultSelectWinner, sn as probeSandboxCapabilities, un as readPromptOptions, ut as createExecutorRegistry } from "./redact-Cbl2O-4N.js";
-import { E as zeroSpend, _ as randomSuffix, b as sleep, l as chargedTokens, m as isAbortError, p as hasCompleteCacheBreakdown, s as addSpend, u as cloneSpend, x as stringifySafe } from "./environment-provider-1fKZh2zl.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
-import { C as observe, O as strategyAuthorMethod, T as profileChatClient, b as sample, v as refine, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-DPbZWgEm.js";
-import { b as mapExecutorResult, n as supervise, y as gateOnDeliverable } from "./supervise-D9aNi8_f.js";
-import "./coordination-driver-zkCrfEbS.js";
+import { f as sha256Bytes, i as redactProtectedValue, o as canonicalCandidateDigest$1, r as redactProtectedReason, u as immutableCandidateValue } from "./protected-redaction-wGo44k2K.js";
+import { b as mapExecutorResult, n as supervise, y as gateOnDeliverable } from "./supervise-KSe4JEcg.js";
+import "./coordination-driver-Cf638-6q.js";
 import "./run-layout-B8I_LXN-.js";
-import "./provision-supervisor-CpMMShE_.js";
-import { t as assertAuthoredCode } from "./authored-code-URmkdgjv.js";
-import "./delegate-D7sonS78.js";
-import "./graph-BuS-NxXD.js";
+import "./provision-supervisor-C97q5NN_.js";
+import "./delegate-Bez07Dlh.js";
+import "./graph-DBk3Unto.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
+import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
 import { createHash, randomUUID } from "node:crypto";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { appendFileSync, chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { mkdir, readFile, realpath, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { heldoutSignificance, runProfileMatrix } from "@tangle-network/agent-eval/campaign";
-import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { mkdir, readFile, realpath, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
+import { isDeepStrictEqual } from "node:util";
 import { collectAgentResponseText } from "@tangle-network/sandbox";
+import { heldoutSignificance, runProfileMatrix } from "@tangle-network/agent-eval/campaign";
 import { createInterface } from "node:readline";
 import { pathToFileURL } from "node:url";
 import { gzipSync } from "node:zlib";
 import { createContext, runInContext } from "node:vm";
 import { stuckLoopView, toolWasteView } from "@tangle-network/agent-eval/pipelines";
+//#region src/runtime/tangle-sandbox-exact-process-provider.ts
+const exactProcessProviderMarker = "agent-runtime.exact-process-provider";
+const exactProcessEgressMarker = "agent-runtime.exact-process-egress";
+/**
+* Adapt Tangle Sandbox's managed control runtime to Runtime's exact-process provider.
+*
+* The adapter deliberately exposes no ordinary agent environment: an exact experiment
+* must start a fresh Sandbox with no managed agent and launch its declared argv directly.
+*/
+function createTangleSandboxExactProcessProvider(client, options = {}) {
+	const name = options.name ?? "tangle-sandbox-exact-process";
+	if (!name.trim()) throw new Error("Tangle Sandbox exact-process provider name must not be empty");
+	return {
+		name,
+		exactProcess: {
+			async create(input) {
+				throwIfAborted(input.signal);
+				assertNoProviderOptions(input.providerOptions);
+				const egressPolicy = sandboxEgressPolicy(input.egress);
+				const metadata = exactMetadata(input.metadata, name, egressPolicy);
+				const sandbox = await client.create({
+					environment: requiredText(input.image, "exact-process image"),
+					agent: false,
+					bare: false,
+					ephemeral: true,
+					egressPolicy,
+					resources: sandboxResources(input),
+					maxLifetimeSeconds: sandboxLifetimeSeconds(input.maxLifetimeMs),
+					metadata,
+					idempotencyKey: requiredText(input.idempotencyKey, "exact-process idempotency key")
+				}, {
+					...input.provisionTimeoutMs === void 0 ? {} : { timeoutMs: positiveInteger(input.provisionTimeoutMs, "provision timeout") },
+					...input.signal === void 0 ? {} : { signal: input.signal }
+				});
+				try {
+					throwIfAborted(input.signal);
+					assertExactSandboxMetadata(sandbox, metadata);
+					await assertExactSandboxEgress(sandbox, egressPolicy);
+				} catch (error) {
+					await discardInvalidSandbox(sandbox, error);
+				}
+				return sandboxAsExactProcessEnvironment(sandbox, name);
+			},
+			async get(id) {
+				const sandbox = await client.get(id);
+				if (!sandbox || !isExactSandbox(sandbox, name)) return null;
+				await assertExactSandboxEgress(sandbox, egressFromMetadata(sandbox.metadata));
+				return sandboxAsExactProcessEnvironment(sandbox, name);
+			},
+			async list(query) {
+				assertNoProviderOptions(query?.providerOptions);
+				const sandboxes = await client.list();
+				return Promise.all(sandboxes.filter((sandbox) => isExactSandbox(sandbox, name)).filter((sandbox) => metadataMatches(sandbox.metadata, query?.metadata)).map(async (sandbox) => {
+					await assertExactSandboxEgress(sandbox, egressFromMetadata(sandbox.metadata));
+					return sandboxAsExactProcessEnvironment(sandbox, name);
+				}));
+			}
+		},
+		capabilities: exactProcessOnlyCapabilities,
+		async create() {
+			throw new Error(`agent environment provider "${name}" supports exactProcess.create() only`);
+		}
+	};
+}
+function sandboxAsExactProcessEnvironment(sandbox, provider) {
+	return {
+		id: requiredText(sandbox.id, "Sandbox id"),
+		provider,
+		...sandbox.metadata ? { metadata: sandbox.metadata } : {},
+		process: {
+			async list() {
+				return (await sandbox.process.list()).map((status) => exactProcessStatus(status));
+			},
+			async get(pid) {
+				const process = await sandbox.process.get(pid);
+				return process ? sandboxProcessAsExactProcess(process) : null;
+			},
+			async spawn(input, options) {
+				return sandboxProcessAsExactProcess(await afterAbortCheck(options?.signal, () => sandbox.process.spawnExact(input.executable, [...input.args], {
+					cwd: input.cwd,
+					env: { ...input.env },
+					inheritEnv: false,
+					...input.stdin === void 0 ? {} : { stdin: input.stdin },
+					timeoutMs: input.timeoutMs
+				})));
+			}
+		},
+		async writeFile(path, bytes, options) {
+			if (sandbox.fs.supportsWriteMode !== true) throw new Error("Tangle Sandbox does not declare exact file-mode support");
+			await afterAbortCheck(options.signal, () => sandbox.fs.write(path, Buffer.from(bytes).toString("base64"), {
+				encoding: "base64",
+				mode: fileMode(options.mode)
+			}));
+		},
+		async readFile(path, options) {
+			const maxBytes = nonnegativeInteger(options.maxBytes, "exact-process file read maximum");
+			const initialSize = nonnegativeInteger((await afterAbortCheck(options.signal, () => sandbox.fs.stat(path))).size, `Tangle Sandbox file size for "${path}"`);
+			if (initialSize > maxBytes) throw new Error(`Tangle Sandbox file "${path}" exceeds the ${maxBytes}-byte exact read maximum`);
+			const result = await afterAbortCheck(options.signal, () => sandbox.fs.readBatch([path], { encoding: "base64" }));
+			const failure = result.errors.find((entry) => entry.path === path);
+			if (failure) throw new Error(`Tangle Sandbox failed to read "${path}": ${failure.error}`);
+			const files = result.files.filter((entry) => entry.path === path);
+			if (files.length !== 1) throw new Error(`Tangle Sandbox returned ${files.length} files for exact read "${path}"`);
+			const file = files[0];
+			if (file.encoding !== "base64") throw new Error(`Tangle Sandbox returned non-binary content for exact read "${path}"`);
+			const size = nonnegativeInteger(file.size, `Tangle Sandbox file size for "${path}"`);
+			if (size !== initialSize) throw new Error(`Tangle Sandbox file "${path}" changed during exact read`);
+			if (size > maxBytes) throw new Error(`Tangle Sandbox file "${path}" exceeds the ${maxBytes}-byte exact read maximum`);
+			const bytes = Buffer.from(file.content, "base64");
+			if (bytes.byteLength !== size || bytes.toString("base64") !== file.content) throw new Error(`Tangle Sandbox returned an invalid binary payload for exact read "${path}"`);
+			return Uint8Array.from(bytes);
+		},
+		async destroy() {
+			await sandbox.delete();
+		}
+	};
+}
+function sandboxProcessAsExactProcess(process) {
+	const pid = positiveInteger(process.pid, "Tangle Sandbox process pid");
+	return {
+		pid,
+		async status() {
+			return exactProcessStatus(await process.status(), pid);
+		},
+		async wait() {
+			const waitExitCode = await process.wait();
+			if (!Number.isSafeInteger(waitExitCode)) throw new Error("Tangle Sandbox process wait returned an invalid exit code");
+			const status = exactProcessStatus(await process.status(), pid);
+			if (status.running || !status.termination) throw new Error("Tangle Sandbox process wait returned before terminal status");
+			if (status.termination.kind === "exit" && status.termination.exitCode !== waitExitCode) throw new Error("Tangle Sandbox process wait and status disagree on exit code");
+			return status.termination;
+		},
+		async kill() {
+			await process.kill("SIGKILL", { tree: true });
+		},
+		async *stdout() {
+			yield* process.stdout();
+		},
+		async *stderr() {
+			yield* process.stderr();
+		}
+	};
+}
+function exactProcessStatus(status, expectedPid) {
+	const pid = positiveInteger(status.pid, "Tangle Sandbox process pid");
+	if (expectedPid !== void 0 && pid !== expectedPid) throw new Error("Tangle Sandbox process status changed process identity");
+	if (typeof status.running !== "boolean") throw new Error("Tangle Sandbox process status is missing running state");
+	if (!Number.isSafeInteger(status.exitCode)) throw new Error("Tangle Sandbox process status is missing an integer exit code");
+	const exitSignal = optionalText(status.exitSignal, "Tangle Sandbox process exit signal");
+	if (status.running) {
+		if (status.exitCode !== -1) throw new Error("Tangle Sandbox running process must report exit code -1");
+		if (exitSignal) throw new Error("Tangle Sandbox running process must not report an exit signal");
+		return {
+			pid,
+			running: true,
+			exitCode: -1
+		};
+	}
+	const termination = exitSignal ? {
+		kind: "signal",
+		signal: exitSignal
+	} : status.exitCode >= 0 ? {
+		kind: "exit",
+		exitCode: status.exitCode
+	} : void 0;
+	if (!termination) throw new Error("Tangle Sandbox stopped process has no terminal reason");
+	return {
+		pid,
+		running: false,
+		exitCode: status.exitCode,
+		...exitSignal ? { exitSignal } : {},
+		termination
+	};
+}
+function exactMetadata(metadata, provider, egressPolicy) {
+	for (const marker of [exactProcessProviderMarker, exactProcessEgressMarker]) if (Object.hasOwn(metadata, marker)) throw new Error(`exact-process metadata must not set "${marker}"`);
+	return {
+		...metadata,
+		[exactProcessProviderMarker]: provider,
+		[exactProcessEgressMarker]: serializeEgressPolicy(egressPolicy)
+	};
+}
+function isExactSandbox(sandbox, provider) {
+	return sandbox.metadata?.[exactProcessProviderMarker] === provider;
+}
+function metadataMatches(metadata, expected) {
+	return expected === void 0 || Object.entries(expected).every(([key, value]) => isDeepStrictEqual(metadata?.[key], value));
+}
+function assertExactSandboxMetadata(sandbox, expected) {
+	if (!metadataMatches(sandbox.metadata, expected)) throw new Error("Tangle Sandbox did not persist exact-process metadata");
+}
+function egressFromMetadata(metadata) {
+	const encoded = metadata?.[exactProcessEgressMarker];
+	if (typeof encoded !== "string") throw new Error("Tangle Sandbox exact-process environment is missing egress metadata");
+	try {
+		const parsed = JSON.parse(encoded);
+		if (!parsed || typeof parsed !== "object") throw new Error("expected egress object");
+		const policy = parsed;
+		if (policy.mode === "blocked" && policy.allowDomains === void 0) return { mode: "blocked" };
+		if (policy.mode === "strict" && policy.includeImplicitDomains === false && Array.isArray(policy.allowDomains) && policy.allowDomains.every((domain) => typeof domain === "string")) {
+			const allowDomains = sortedDomains(policy.allowDomains);
+			if (new Set(allowDomains).size === allowDomains.length) return {
+				mode: "strict",
+				allowDomains,
+				includeImplicitDomains: false
+			};
+		}
+	} catch {
+		throw new Error("Tangle Sandbox exact-process environment has invalid egress metadata");
+	}
+	throw new Error("Tangle Sandbox exact-process environment has invalid egress metadata");
+}
+async function assertExactSandboxEgress(sandbox, expected) {
+	const actual = (await sandbox.egress.get()).policy;
+	if (actual.mode !== expected.mode) throw new Error(`Tangle Sandbox egress mismatch: expected ${expected.mode}, received ${actual.mode}`);
+	if (expected.mode === "blocked") {
+		const allowDomains = actual.allowDomains;
+		if (actual.mode === "blocked" && (allowDomains === void 0 || Array.isArray(allowDomains) && allowDomains.length === 0)) return;
+		throw new Error("Tangle Sandbox blocked egress retained an allowlist");
+	}
+	if (actual.mode !== "strict") throw new Error("Tangle Sandbox did not return strict egress policy");
+	const expectedDomains = sortedDomains(expected.allowDomains);
+	if (!isDeepStrictEqual(sortedDomains(actual.allowDomains ?? []), expectedDomains)) throw new Error("Tangle Sandbox strict egress differs from the exact allowlist");
+	if (actual.includeImplicitDomains !== false) throw new Error("Tangle Sandbox strict egress retained implicit domains");
+}
+function sandboxEgressPolicy(input) {
+	if (input.mode === "blocked") return { mode: "blocked" };
+	const allowDomains = input.allowDomains.map((domain) => requiredText(domain, "strict egress domain"));
+	if (new Set(allowDomains).size !== allowDomains.length) throw new Error("strict egress domains must not contain duplicates");
+	return {
+		mode: "strict",
+		allowDomains,
+		includeImplicitDomains: false
+	};
+}
+function serializeEgressPolicy(policy) {
+	return JSON.stringify(policy.mode === "blocked" ? { mode: "blocked" } : {
+		mode: "strict",
+		allowDomains: sortedDomains(policy.allowDomains),
+		includeImplicitDomains: false
+	});
+}
+function sandboxResources(input) {
+	const cpuCores = positiveNumber(input.resources.cpu, "exact-process cpu");
+	const memoryMB = positiveInteger(input.resources.memoryMb, "exact-process memory");
+	const diskMb = positiveInteger(input.resources.diskMb, "exact-process disk");
+	if (diskMb % 1024 !== 0) throw new Error("Tangle Sandbox exact-process disk must be a whole GiB");
+	return {
+		cpuCores,
+		memoryMB,
+		diskGB: diskMb / 1024
+	};
+}
+function sandboxLifetimeSeconds(maxLifetimeMs) {
+	const milliseconds = positiveInteger(maxLifetimeMs, "exact-process maximum lifetime");
+	if (milliseconds % 1e3 !== 0) throw new Error("Tangle Sandbox exact-process maximum lifetime must be a whole number of seconds");
+	return milliseconds / 1e3;
+}
+function fileMode(value) {
+	const mode = nonnegativeInteger(value, "exact-process file mode");
+	if (mode > 4095) throw new Error("exact-process file mode exceeds POSIX mode bits");
+	return mode;
+}
+function assertNoProviderOptions(providerOptions) {
+	if (providerOptions && Object.keys(providerOptions).length > 0) throw new Error("Tangle Sandbox exact-process provider does not accept providerOptions");
+}
+function exactProcessOnlyCapabilities() {
+	return {
+		profile: {
+			namedProfiles: false,
+			systemPrompt: {
+				replace: false,
+				append: false
+			},
+			instructions: false,
+			tools: false,
+			permissions: false,
+			mcp: false,
+			subagents: false,
+			resources: {
+				files: false,
+				instructions: false,
+				tools: false,
+				skills: false,
+				agents: false,
+				commands: false
+			},
+			hooks: false,
+			modes: false,
+			runtimeUpdate: false,
+			validation: false
+		},
+		streaming: {
+			live: false,
+			replay: false,
+			detach: false,
+			turnIdempotency: false
+		},
+		sessions: {
+			continue: false,
+			list: false,
+			messages: false
+		},
+		workspace: {
+			read: false,
+			write: false,
+			exec: false,
+			git: false,
+			upload: false,
+			download: false
+		},
+		branching: {
+			checkpoint: false,
+			fork: false
+		},
+		placement: false,
+		usage: false,
+		confidential: false,
+		exactProcess: { egress: ["blocked", "strict"] }
+	};
+}
+async function discardInvalidSandbox(sandbox, cause) {
+	try {
+		await sandbox.delete();
+	} catch (destroyError) {
+		throw new AggregateError([cause, destroyError], "Tangle Sandbox exact-process creation failed and cleanup failed");
+	}
+	throw cause;
+}
+function sortedDomains(domains) {
+	return [...domains].sort((left, right) => left.localeCompare(right));
+}
+function requiredText(value, label) {
+	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} must be a non-empty string`);
+	return value;
+}
+function optionalText(value, label) {
+	if (value === void 0) return void 0;
+	return requiredText(value, label);
+}
+function positiveNumber(value, label) {
+	if (!Number.isFinite(value) || value <= 0) throw new Error(`${label} must be positive`);
+	return value;
+}
+function positiveInteger(value, label) {
+	if (!Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
+	return value;
+}
+function nonnegativeInteger(value, label) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative integer`);
+	return value;
+}
+function throwIfAborted(signal) {
+	signal?.throwIfAborted();
+}
+async function afterAbortCheck(signal, operation) {
+	throwIfAborted(signal);
+	const result = await operation();
+	throwIfAborted(signal);
+	return result;
+}
+//#endregion
 //#region src/runtime/key-provider.ts
 /** The env-backed provider: reads the (dotenvx-loaded) process env. Empty /
 *  whitespace-only values count as absent — fail loud, not with a blank key. */
@@ -1259,9 +1617,9 @@ function loopDispatch(opts) {
 *
 * It is deliberately for NON-box executors only — a real sandbox harness already
 * IS a `SandboxClient` (boxes, sessions, fs, fork are real there). Here each
-* `streamPrompt` runs the executor once and emits the terminal
-* `{type:'result', data:{finalText, tokenUsage, costUsd}}` event that
-* `answerOutput`/the kernel's cost ledger already parse — no sessions, no fs,
+* `streamPrompt` runs the executor once and emits its result plus the canonical
+* `done` event. The result carries output and usage; `done` confirms execution settled.
+* There are no sessions, no fs,
 * no fork (those degrade gracefully via the optional `SandboxClient` methods).
 */
 function isAsyncIterable$1(v) {
@@ -1354,6 +1712,10 @@ function inlineSandboxClient(factory, defaults = {}) {
 							...out?.promptCache ? { promptCache: out.promptCache } : {}
 						}
 					};
+					yield {
+						type: "done",
+						data: { outcome: { type: "completed" } }
+					};
 				} finally {
 					callerSignal?.removeEventListener("abort", onAbort);
 					await exec.teardown("brutalKill").catch(() => {});
@@ -1859,7 +2221,12 @@ async function harvestCorpus(opts) {
 		runsObserved: 0,
 		findings: 0,
 		learned: 0,
-		failures: []
+		failures: [],
+		usage: {
+			input: 0,
+			output: 0,
+			known: true
+		}
 	};
 	const iterator = Symbol.asyncIterator in Object(opts.runs) ? opts.runs[Symbol.asyncIterator]() : (async function* () {
 		yield* opts.runs;
@@ -1890,7 +2257,11 @@ async function harvestCorpus(opts) {
 				report.runsObserved += 1;
 				report.findings += obs.findings.length;
 				report.learned += obs.learned.length;
+				report.usage.input += obs.usage.input;
+				report.usage.output += obs.usage.output;
+				report.usage.known &&= obs.usage.known;
 			} catch (e) {
+				report.usage.known = false;
 				report.failures.push({
 					runId: input.runId ?? `run-${consumed}`,
 					error: e instanceof Error ? e.message.slice(0, 300) : String(e)
@@ -4032,6 +4403,39 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
+//#region src/runtime/authored-code.ts
+/**
+* The ONE lint over model-authored source.
+*
+* Two features have a model write code the runtime then runs: `authorStrategy` (an authored
+* optimization strategy, since 0.60) and code mode's `execute` (a program over the coordination
+* verbs). Both need the same refusals; this module is the single copy both import.
+*
+* A LINT, NOT A SANDBOX — it reads text and cannot constrain what running code does, and trivial
+* concatenation defeats any token match. Its only job is refusing the obvious escapes so a typo or
+* a lazy model does not run; it is never the security boundary. Isolation, where required, is the
+* execution boundary's job (a jailed runner, a sandboxed loader), never this check's.
+*/
+/** Refuse the obvious escapes in authored source. See the module doc for what this is NOT. */
+function assertAuthoredCode(code, options = {}) {
+	const context = options.context ?? "authored code";
+	const allowed = options.allowedImports ?? [];
+	for (const line of code.split("\n")) {
+		if (!/^\s*import\s/.test(line)) continue;
+		if (!allowed.some((specifier) => line.includes(`'${specifier}'`) || line.includes(`"${specifier}"`))) throw new ValidationError(`${context} rejected: foreign import — ${line.trim().slice(0, 120)}${allowed.length === 0 ? " (no import is allowed here)" : ` (allowed: ${allowed.join(", ")})`}`);
+	}
+	for (const [pattern, what] of [
+		[/\brequire\s*\(/, "require()"],
+		[/\bimport\s*\(/, "dynamic import()"],
+		[/\beval\s*\(/, "eval()"],
+		[/new\s+Function\s*\(/, "new Function()"],
+		[/\bprocess\s*[.[]/, "process access"],
+		[/\bglobalThis\s*[.[]/, "globalThis access"],
+		[/\bfetch\s*\(/, "network access"],
+		[/child_process|node:fs|node:net|node:http|worker_threads/, "node builtin access"]
+	]) if (pattern.test(code)) throw new ValidationError(`${context} rejected: ${what}`);
+}
+//#endregion
 //#region src/runtime/strategy-author.ts
 /**
 * authorStrategy — the agent-authored layer as a package primitive (software-3.0): an
@@ -6434,6 +6838,6 @@ function tail(s) {
 	return s.slice(-400);
 }
 //#endregion
-export { InMemoryCorpus as $, chatWorkerSeam as A, renderLeaderboardSvg as At, SandboxRunAbortError as B, mcpSecretEnvMetadataKey as Bt, withUntrackedArtifacts as C, deterministicCompletion as Ct, codeModeSupervisorTools as D, pairwiseSignificance as Dt, runCoderChecks as E, leaderboard as Et, selectChampion as F, connectStdioMcp as Ft, equalKOnCost as G, printBenchmarkReport as H, resolveSecretEnv as Ht, assertStrategyContract as I, materializeLocalMcp as It, runPersonified as J, trajectoryReport as K, authorStrategy as L, createMcpEnvironment as Lt, discriminatingMeans as M, auditIntent as Mt, pickChampion as N, defaultAuditorInstruction as Nt, unsafeInProcessRunner as O, renderLeaderboardHtml as Ot, runStrategyEvolution as P, McpSpawnFault as Pt, FileCorpus as Q, strategyAuthorContract as R, sanitizeMcpToolSchema as Rt, copyUntrackedIntoClone as S, completionAuthorizes as St, patchDelivered as T, stopSentinel as Tt, runBenchmark as U, secretEnvOfMcpServer as Ut, openSandboxRun as V, resolveMcpServerLaunch as Vt, promotionGate as W, createShapeRegistry as X, builtinShapes as Y, registerShape as Z, NOTE_MAX_CHARS as _, localSandboxClient as _t, localShell as a, pipeline as at, composeWorkerEvidence as b, loopDispatch as bt, createVerifierEnvironment as c, widen as ct, harvestSurfaceDiffs as d, createScopeAnalyst as dt, renderCorpusToInstructions as et, analystsFromRegistry as f, registryScopeAnalyst as ft, EVIDENCE_MAX_CHARS as g, resolveSandboxClient as gt, worktreeFanout as h, defineLeaderboard as ht, jjWorkspace as i, panel as it, createChatSessionStore as j, renderPairwiseMarkdown as jt, chatTransportExecutor as k, renderLeaderboardMarkdown as kt, boxSurfaceReader as l, assertTraceDerivedFindings as lt, superviseSurface as m, harvestCorpus as mt, makeFinding$1 as n, flatWidenGate as nt, runInWorkspace as o, selectValidWinner as ot, failuresAnalyst as p, inProcessSandboxClient as pt, definePersona as q, gitWorkspace as r, loopUntil as rt, createWaterfallCollector as s, verify as st, computeFindingId$1 as t, fanout as tt, fsSurfaceReader as u, buildSteerContext as ut, VERIFY_TAIL_CHARS as v, inlineSandboxClient as vt, analyzeTrace as w, sentinelCompletion as wt, settledWorkerOut as x, superviseDispatch as xt, closingWorkerNote as y, loopCampaignDispatch as yt, strategyAuthorSystemPrompt as z, envKeyProvider as zt };
+export { InMemoryCorpus as $, chatWorkerSeam as A, renderLeaderboardSvg as At, SandboxRunAbortError as B, mcpSecretEnvMetadataKey as Bt, withUntrackedArtifacts as C, deterministicCompletion as Ct, codeModeSupervisorTools as D, pairwiseSignificance as Dt, runCoderChecks as E, leaderboard as Et, selectChampion as F, connectStdioMcp as Ft, equalKOnCost as G, printBenchmarkReport as H, resolveSecretEnv as Ht, assertStrategyContract as I, materializeLocalMcp as It, runPersonified as J, trajectoryReport as K, authorStrategy as L, createMcpEnvironment as Lt, discriminatingMeans as M, auditIntent as Mt, pickChampion as N, defaultAuditorInstruction as Nt, unsafeInProcessRunner as O, renderLeaderboardHtml as Ot, runStrategyEvolution as P, McpSpawnFault as Pt, FileCorpus as Q, strategyAuthorContract as R, sanitizeMcpToolSchema as Rt, copyUntrackedIntoClone as S, completionAuthorizes as St, patchDelivered as T, stopSentinel as Tt, runBenchmark as U, secretEnvOfMcpServer as Ut, openSandboxRun as V, resolveMcpServerLaunch as Vt, promotionGate as W, createTangleSandboxExactProcessProvider as Wt, createShapeRegistry as X, builtinShapes as Y, registerShape as Z, NOTE_MAX_CHARS as _, localSandboxClient as _t, localShell as a, pipeline as at, composeWorkerEvidence as b, loopDispatch as bt, createVerifierEnvironment as c, widen as ct, harvestSurfaceDiffs as d, createScopeAnalyst as dt, renderCorpusToInstructions as et, analystsFromRegistry as f, registryScopeAnalyst as ft, EVIDENCE_MAX_CHARS as g, resolveSandboxClient as gt, worktreeFanout as h, defineLeaderboard as ht, jjWorkspace as i, panel as it, createChatSessionStore as j, renderPairwiseMarkdown as jt, chatTransportExecutor as k, renderLeaderboardMarkdown as kt, boxSurfaceReader as l, assertTraceDerivedFindings as lt, superviseSurface as m, harvestCorpus as mt, makeFinding$1 as n, flatWidenGate as nt, runInWorkspace as o, selectValidWinner as ot, failuresAnalyst as p, inProcessSandboxClient as pt, definePersona as q, gitWorkspace as r, loopUntil as rt, createWaterfallCollector as s, verify as st, computeFindingId$1 as t, fanout as tt, fsSurfaceReader as u, buildSteerContext as ut, VERIFY_TAIL_CHARS as v, inlineSandboxClient as vt, analyzeTrace as w, sentinelCompletion as wt, settledWorkerOut as x, superviseDispatch as xt, closingWorkerNote as y, loopCampaignDispatch as yt, strategyAuthorSystemPrompt as z, envKeyProvider as zt };
 
-//# sourceMappingURL=runtime-DqRieJ6e.js.map
+//# sourceMappingURL=runtime-BrTBBSfC.js.map