@tangle-network/agent-runtime 0.221.0 → 0.222.1

package/dist/{supervise-CBYdifF2.js → supervise-l9fd1ZaI.js}

@@ -1,9 +1,9 @@
-import { $ as bindReusableExecutorExecutionId, Br as fullProfileMaterialization, C as scopeOwnerExecutorNodeContext, Ci as detachedSnapshot, Dt as spendFromUsageEvents, F as scopeRetainedOwnerResult, Fn as withTimeout, Gn as RunCancellationReason, Hr as promptControlProfileMaterialization, In as zeroSpend, Jn as runAbortable, Jt as bridgeAdmissionRefusal, Ln as addResourceSpend, Lr as assertProfileMaterialization, Lt as createInbox, M as prepareScopeRetainedOwnerTask, N as scopeRetainedOwnerContext, Ot as WORKER_TRACE_PROPAGATION, P as scopeRetainedOwnerPriorSpend, Pn as unmeteredSpend, Q as teardownExecutor, Rn as resourceTelemetry, Rr as controlProfileMaterialization, S as restoreScopeOwnerAcceptedExecution, Sn as addSpend, Tt as assertValidBudget, Un as registerRetainedExecutorPreparation, Ur as promptModelProfileMaterialization, Vr as profileMaterializationAxes$1, Wn as retainedExecutorSeamKey, Yr as unsupportedProfileDimensions, Yt as bridgeModelRouteRefusal, Z as DEFAULT_SUCCESSFUL_SHUTDOWN_MS, Zr as worktreeCliProfileMaterialization, _i as runtimeOwnedScopeOwnerRuntime, at as snapshotExecutorConfig, b as meterRuntimeOwnedProviderAttempt, bn as resolveAgentEnvironmentProvider, d as runDriverWithRetry, di as recordRuntimeOwnedDriveHarnessProviderEvidence, en as bridgeRuntimeAttachmentsKey, et as captureReusableExecutorConfig, f as driverChild, fi as runtimeOwnedDriveHarnessProviderEvidence, fn as routerBrain, fr as createOtelExporter, g as beginScopeOwnerAttempt, gi as runtimeOwnedPendingExecutorMaterialization, hi as runtimeOwnedExecutorProviderEvidence, hr as generateSpanId, j as consumeScopeRetainedOwnerResult, m as isDriverSpec, mi as runtimeOwnedExecutorMaterialization, n as createSupervisor, o as runFinalizer, oi as inheritRuntimeOwnedExecutorAttestation, p as driverExecutorFactory, pi as runtimeOwnedExecutorExecutionBinding, qr as renderUnsupported, r as bestDelivered, ri as attestRuntimeOwnedScopeOwner, rt as createExecutor, s as runTree, t as createRootHandle, tn as bridgeStopSignalKey, u as defaultUnmetContractSteer, ui as providerAttemptEvidence, v as deriveNodeExecutionIdentity, wt as contentAddress, x as recordScopeOwnerMaterialization, y as meterRuntimeOwnedAccounting, yr as toOtelAttributes, zn as withBudgetResources, zr as defineProfileMaterializationContract } from "./supervisor-C0xW7oTl.js";
+import { $ as bindReusableExecutorExecutionId, $r as runtimeOwnedExecutorMaterialization, An as RunCancellationReason, At as spendFromUsageTotals, Bi as withBudgetResources, Bt as createInbox, C as scopeOwnerExecutorNodeContext, Ci as addSpend, Cn as resolveAgentEnvironmentProvider, Cr as controlProfileMaterialization, Dr as promptControlProfileMaterialization, Dt as meterUsageEvent, Er as profileMaterializationAxes$1, F as scopeRetainedOwnerResult, Fi as unmeteredSpend, Gr as inheritRuntimeOwnedExecutorAttestation, Hr as attestRuntimeOwnedScopeOwner, Ii as withTimeout, Ir as worktreeCliProfileMaterialization, Li as zeroSpend, M as prepareScopeRetainedOwnerTask, Mr as renderUnsupported, N as scopeRetainedOwnerContext, Nn as runAbortable, On as registerRetainedExecutorPreparation, Or as promptModelProfileMaterialization, Ot as newUsageTotals, P as scopeRetainedOwnerPriorSpend, Pr as unsupportedProfileDimensions, Q as teardownExecutor, Qr as runtimeOwnedExecutorExecutionBinding, Qt as bridgeModelRouteRefusal, Ri as addResourceSpend, S as restoreScopeOwnerAcceptedExecution, Sr as assertProfileMaterialization, Tr as fullProfileMaterialization, Tt as assertValidBudget, Xr as recordRuntimeOwnedDriveHarnessProviderEvidence, Yr as providerAttemptEvidence, Z as DEFAULT_SUCCESSFUL_SHUTDOWN_MS, Zn as createOtelExporter, Zr as runtimeOwnedDriveHarnessProviderEvidence, Zt as bridgeAdmissionRefusal, at as snapshotExecutorConfig, b as meterRuntimeOwnedProviderAttempt, ci as detachedSnapshot, d as runDriverWithRetry, ei as runtimeOwnedExecutorProviderEvidence, er as generateSpanId, et as captureReusableExecutorConfig, f as driverChild, g as beginScopeOwnerAttempt, hn as routerBrain, in as bridgeStopSignalKey, ir as toOtelAttributes, j as consumeScopeRetainedOwnerResult, jt as WORKER_TRACE_PROPAGATION, kn as retainedExecutorSeamKey, m as isDriverSpec, n as createSupervisor, ni as runtimeOwnedScopeOwnerRuntime, o as runFinalizer, p as driverExecutorFactory, r as bestDelivered, rn as bridgeRuntimeAttachmentsKey, rt as createExecutor, s as runTree, t as createRootHandle, ti as runtimeOwnedPendingExecutorMaterialization, u as defaultUnmetContractSteer, v as deriveNodeExecutionIdentity, wr as defineProfileMaterializationContract, wt as contentAddress, x as recordScopeOwnerMaterialization, y as meterRuntimeOwnedAccounting, zi as resourceTelemetry } from "./supervisor-af7-tQrQ.js";
 import { i as ConfigError, m as ValidationError } from "./errors-DodWX-cb.js";
 import { a as concreteProfileModel, c as profileModelExecutionSettings, d as agentHarness, f as harnessRunsAgent, n as assertModelAllowed, o as enforceTokenLimits, r as assertProfileModelsAllowed, s as profileBridgeWireModel, t as assertExecutableAgentProfile } from "./model-policy-DKDyr-fc.js";
 import { t as composeRuntimeHooks } from "./runtime-hooks-tXpAarhW.js";
 import { t as createStdioToolServer } from "./tool-server-BJbCPhoW.js";
-import { D as coordinationVerbNames, O as createCoordinationTools, S as watchRunCancellation, c as createProgressTracker, d as progressStop, r as driverAgent, v as createFileRunContext, w as DEFAULT_AWAIT_EVENT_TIMEOUT_MS, x as applyRunCancellation, y as createInMemoryRunContext } from "./coordination-driver-imD3q4L5.js";
+import { D as coordinationVerbNames, O as createCoordinationTools, S as watchRunCancellation, c as createProgressTracker, d as progressStop, r as driverAgent, v as createFileRunContext, w as DEFAULT_AWAIT_EVENT_TIMEOUT_MS, x as applyRunCancellation, y as createInMemoryRunContext } from "./coordination-driver-BMFwV_aM.js";
 import { k as writeRunCancellation, o as readRunCancelRequest, s as readRunCancellation } from "./run-layout-hZREkcfu.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, canonicalCandidateJson, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -624,7 +624,10 @@ async function serveCoordinationMcp(opts) {
 		backgroundActions: nodeTools.background,
 		authorize: (req) => {
 			if (!paths.has(req.url ?? "")) return 404;
-			if (!audiences.has(req.headers.host ?? "")) return 403;
+			const address = req.socket.localAddress?.replace(/^::ffff:/, "");
+			const localAuthority = address?.includes(":") ? `[${address}]:${req.socket.localPort}` : `${address}:${req.socket.localPort}`;
+			const boundAuthority = audiences.size > 0 && (host === "0.0.0.0" || host === "::") && address !== void 0 && req.socket.localPort !== void 0 && req.headers.host === localAuthority;
+			if (!audiences.has(req.headers.host ?? "") && !boundAuthority) return 403;
 			if (closed) return 401;
 			if (!opts.authentication) return void 0;
 			const authorization = req.headers.authorization;
@@ -2279,11 +2282,12 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 		let started = false;
 		let terminalAccountingCaptured = false;
 		let pendingUsage = [];
+		const ownerUsage = newUsageTotals();
 		let observedOwnerSpend = zeroSpend();
 		let committedOwnerSpend = retainedOwner ? await scopeRetainedOwnerPriorSpend(scope) : zeroSpend();
-		const ownerDelta = (total) => ({
+		const ownerDelta = (total, committed = committedOwnerSpend) => ({
 			...addResourceSpend(total.resources === void 0 ? void 0 : Object.fromEntries(Object.entries(total.resources).map(([name, value]) => {
-				const prior = committedOwnerSpend.resources?.[name];
+				const prior = committed.resources?.[name];
 				if (prior && prior.unit !== value.unit) throw new ValidationError(`resource ${name}: unit mismatch`);
 				return [name, {
 					...value,
@@ -2291,13 +2295,16 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 					known: value.known && (prior?.known ?? true)
 				}];
 			}))),
-			iterations: Math.max(0, total.iterations - committedOwnerSpend.iterations),
+			iterations: Math.max(0, total.iterations - committed.iterations),
 			tokens: {
-				input: Math.max(0, total.tokens.input - committedOwnerSpend.tokens.input),
-				output: Math.max(0, total.tokens.output - committedOwnerSpend.tokens.output)
+				input: Math.max(0, total.tokens.input - committed.tokens.input),
+				output: Math.max(0, total.tokens.output - committed.tokens.output),
+				...unmeteredOwnerCache(total.tokens, committed.tokens)
 			},
-			usd: Math.max(0, total.usd - committedOwnerSpend.usd),
-			ms: Math.max(0, total.ms - committedOwnerSpend.ms),
+			usd: Math.max(0, total.usd - committed.usd),
+			...total.usdEstimated === void 0 ? {} : { usdEstimated: Math.min(Math.max(0, total.usd - committed.usd), Math.max(0, total.usdEstimated - (committed.usdEstimated ?? 0))) },
+			...total.tokensProvenance === void 0 ? {} : { tokensProvenance: total.tokensProvenance },
+			ms: Math.max(0, total.ms - committed.ms),
 			...total.tokensKnown === false ? { tokensKnown: false } : {},
 			...total.usdKnown === false ? { usdKnown: false } : {}
 		});
@@ -2342,9 +2349,10 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 			}
 			const batch = pendingUsage;
 			pendingUsage = [];
-			const measured = spendFromUsageEvents(batch);
-			observedOwnerSpend = addSpend(observedOwnerSpend, measured);
-			const charge = retainedOwner ? ownerDelta(observedOwnerSpend) : measured;
+			for (const event of batch) meterUsageEvent(ownerUsage, event);
+			const measured = spendFromUsageTotals(ownerUsage);
+			const charge = ownerDelta(measured, retainedOwner ? committedOwnerSpend : observedOwnerSpend);
+			observedOwnerSpend = detachedSnapshot(measured, "metered owner spend");
 			await meterRuntimeOwnedProviderAttempt(scope, forceUnknown ? {
 				...charge,
 				tokensKnown: false,
@@ -3352,6 +3360,19 @@ function superviseInternal(profile, task, opts, testBrain) {
 	};
 	return start();
 }
+/** Historical unclassified input is already charged; replay cannot refund it with a class-only delta. */
+function unmeteredOwnerCache(total, committed) {
+	const cache = {
+		...total.freshInput === void 0 ? {} : { freshInput: Math.max(0, total.freshInput - (committed.freshInput ?? 0)) },
+		...total.cacheRead === void 0 ? {} : { cacheRead: Math.max(0, total.cacheRead - (committed.cacheRead ?? 0)) },
+		...total.cacheWrite === void 0 ? {} : { cacheWrite: Math.max(0, total.cacheWrite - (committed.cacheWrite ?? 0)) }
+	};
+	if ((cache.freshInput ?? 0) + (cache.cacheRead ?? 0) + (cache.cacheWrite ?? 0) > Math.max(0, total.input - committed.input)) return { cacheBreakdownKnown: false };
+	return {
+		...cache,
+		...total.cacheBreakdownKnown === false ? { cacheBreakdownKnown: false } : {}
+	};
+}
 function rootProviderModelEvidence(observations) {
 	const attempts = Object.freeze(observations.map((model) => Object.freeze({ observations: Object.freeze(model === void 0 ? [] : [model]) })));
 	const models = [...new Set(observations.filter((model) => model !== void 0))];
@@ -3373,4 +3394,4 @@ function rootProviderModelEvidenceFromExecution(evidence) {
 //#endregion
 export { mapExecutorResult as _, isPreSpawnExecutorFailure as a, withWorkerSpawnRetry as c, resolveSupervisorProfile as d, supervisorAgent as f, gateOnDeliverable as g, serveCoordinationMcp as h, workerFromBackend as i, assertCoordinationBinding as l, createSupervisorSpanRecorder as m, supervise as n, resolveWorkerSpawnRetry as o, supervisorAgentWithTestBrain as p, superviseWithTestBrain as r, retryPreSpawnRefusals as s, DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY as t, coordinationProfileToolPrefix as u };
 
-//# sourceMappingURL=supervise-CBYdifF2.js.map
+//# sourceMappingURL=supervise-l9fd1ZaI.js.map