@tangle-network/agent-runtime 0.259.0 → 0.261.0

package/dist/{runtime-DKiucqGX.js → runtime-BbQmK7qe.js}

@@ -1,16 +1,16 @@
-import { $r as readCommittedJsonLines, Cn as runBrainLoop, Dt as isTraceAnalysisStore, Gi as sleep, Hi as isAbortError, Ki as stringifySafe, Li as addSpend, Mn as createPushTraceSource, Ni as notifySandboxEventObserver, Qr as prepareJsonlAppend, Ri as chargedTokens, Sn as routerBrain, T as settledToIteration, Vi as hasCompleteCacheBreakdown, Wi as randomSuffix, Zi as zeroSpend, _n as createSandboxLineage, aa as armDeadlineTimer, bi as executableAgentSpecSnapshot, bn as assertBoxlessPromptOptions, bt as insideCursorNamespace, ei as writeAllBytes, er as contentAddress, ft as createWorktreeCliExecutor, g as withDriverExecutor, gn as runAgentRounds, it as rollingDispatch, lt as createExecutor, mn as defaultSelectWinner, n as createSupervisor, ut as createExecutorRegistry, vn as probeSandboxCapabilities, vt as InMemoryResultBlobStore, wn as canonicalObservedModelParts, xi as detachedFrozen, xn as readPromptOptions, yi as executableAgentProfileSnapshot, yt as InMemorySpawnJournal, zi as cloneSpend } from "./supervisor-CJyzUjc7.js";
+import { $i as zeroSpend, Bi as chargedTokens, Ci as detachedFrozen, Cn as routerBrain, E as settledToIteration, Fi as notifySandboxEventObserver, Ji as stringifySafe, Ki as randomSuffix, Nn as createPushTraceSource, Ot as isTraceAnalysisStore, Si as executableAgentSpecSnapshot, Sn as readPromptOptions, Tn as canonicalObservedModelParts, Ui as hasCompleteCacheBreakdown, Vi as cloneSpend, Wi as isAbortError, _n as runAgentRounds, at as rollingDispatch, bt as InMemorySpawnJournal, dt as createExecutorRegistry, ei as prepareJsonlAppend, g as withDriverExecutor, hn as defaultSelectWinner, n as createSupervisor, ni as writeAllBytes, pt as createWorktreeCliExecutor, qi as sleep, sa as armDeadlineTimer, ti as readCommittedJsonLines, tr as contentAddress, ut as createExecutor, vn as createSandboxLineage, wn as runBrainLoop, xi as executableAgentProfileSnapshot, xn as assertBoxlessPromptOptions, xt as insideCursorNamespace, yn as probeSandboxCapabilities, yt as InMemoryResultBlobStore, zi as addSpend } from "./supervisor-yavsoQQo.js";
 import { m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
-import { E as profileChatClient, S as ObservationError, T as renderReport, b as sample, k as strategyAuthorMethod, v as refine, w as observe, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-BIBxgW64.js";
+import { E as profileChatClient, S as ObservationError, T as renderReport, b as sample, k as strategyAuthorMethod, v as refine, w as observe, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-Dby60zHe.js";
 import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, t as assertExecutableAgentProfile } from "./model-policy-BbSCSak0.js";
-import { E as immutableCandidateValue, O as sha256Bytes, S as canonicalCandidateDigest$1 } from "./workspace-archive-DQGFwvM6.js";
+import { C as canonicalCandidateDigest$1, D as immutableCandidateValue, k as sha256Bytes$1, m as captureMaterializedWorkspace } from "./workspace-archive-C9lgf77y.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
 import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction--F3v1oo8.js";
-import { b as gateOnDeliverable, r as supervise, x as mapExecutorResult } from "./supervise-DsQjhLN-.js";
-import "./coordination-driver-BmtrkNPu.js";
+import { S as mapExecutorResult, r as supervise, x as gateOnDeliverable } from "./supervise-1QzYAyS2.js";
+import "./coordination-driver-LmDxHvAO.js";
 import "./run-layout-vwd4SwX_.js";
-import "./provision-supervisor-B9tf4soF.js";
-import "./delegate-DJgmZZKH.js";
-import "./graph-BKRvWzHx.js";
+import "./provision-supervisor-By5oGk3t.js";
+import "./delegate-rkhJf5w7.js";
+import "./graph-Bn3wSH8-.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
@@ -2447,30 +2447,31 @@ const contains = (parent, child) => {
 	return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !path.startsWith(sep);
 };
 /**
-* Run untrusted checks inside Linux Bubblewrap. Never falls back to host execution.
-* Requires /usr/bin/bwrap and permission to create Linux namespaces.
+* Run an untrusted check in Linux Bubblewrap, or in its own Sandbox box when `box` is set.
+* Never falls back to host execution.
+*
+* Bubblewrap requires /usr/bin/bwrap and permission to create Linux namespaces.
 * Only trusted system toolchains, private proc/dev/tmp, and the writable copy are mounted.
 * The canonical input path remains the working directory; copy writes are discarded.
 * Limits bound command time and captured output, not copy size or memory consumption.
 * Callers must keep the input and trusted toolchains stable while preparing the check.
+*
+* A box check creates one fresh box with no owner secrets and blocked egress, delivers the
+* tree's regular files verified by sha256, runs the command there, and deletes the box.
 */
 async function runIsolatedCheck(options) {
+	if (options.box) return runInBox(options, options.box);
 	let scratch;
 	let result;
 	try {
 		if (process.platform !== "linux") throw new Error("Linux Bubblewrap namespaces are required");
-		const timeoutMs = options.timeoutMs ?? 3e4;
-		const maxOutputBytes = options.maxOutputBytes ?? 1048576;
-		if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647 || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1) throw new Error("Invalid execution limits");
-		if (!options.command.length || !options.command[0]) throw new Error("A command is required");
+		const { timeoutMs, maxOutputBytes } = checkLimits(options);
 		if (options.signal?.aborted) return {
 			succeeded: false,
 			reason: "cancelled",
 			diagnostic: "Check cancelled"
 		};
-		const workspace = await realpath(options.workspaceRoot);
-		const tree = await realpath(options.tree);
-		if (!contains(workspace, tree) || !(await stat(tree)).isDirectory()) throw new Error("Tree must be a directory inside the workspace");
+		const { workspace, tree } = await protectedTree(options);
 		const binds = [];
 		for (const path of toolchains) {
 			let actual;
@@ -2548,6 +2549,203 @@ async function runIsolatedCheck(options) {
 	}
 	return result;
 }
+function checkLimits(options) {
+	const timeoutMs = options.timeoutMs ?? 3e4;
+	const maxOutputBytes = options.maxOutputBytes ?? 1048576;
+	if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647 || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1) throw new Error("Invalid execution limits");
+	if (!options.command.length || !options.command[0]) throw new Error("A command is required");
+	return {
+		timeoutMs,
+		maxOutputBytes
+	};
+}
+async function protectedTree(options) {
+	const workspace = await realpath(options.workspaceRoot);
+	const tree = await realpath(options.tree);
+	if (!contains(workspace, tree) || !(await stat(tree)).isDirectory()) throw new Error("Tree must be a directory inside the workspace");
+	return {
+		workspace,
+		tree
+	};
+}
+/** Box-workspace-relative directory that receives the tree and is the command's cwd. */
+const BOX_TREE = "tree";
+/** Bound on provisioning, delivery, and deletion; the box expires even if this process dies. */
+const BOX_SETUP_SECONDS = 900;
+/** The box's own process timeout is a backstop behind this module's deadline. */
+const BOX_PROCESS_BACKSTOP_MS = 3e4;
+/** Concurrent file deliveries into one check box. */
+const BOX_UPLOADS = 4;
+/** The box's process supervisor prefixes this to stderr when it cannot start the executable. */
+const BOX_EXEC_FAILURE = "process-supervisor: exec failed";
+async function runInBox(options, placement) {
+	let box;
+	let evidence;
+	let result;
+	try {
+		const { timeoutMs, maxOutputBytes } = checkLimits(options);
+		if (options.signal?.aborted) return {
+			succeeded: false,
+			reason: "cancelled",
+			diagnostic: "Check cancelled"
+		};
+		const { tree } = await protectedTree(options);
+		const captured = await captureMaterializedWorkspace(tree);
+		if (placement.builderAccounts.length === 0 || placement.builderAccounts.some((id) => !id)) throw new Error("builderAccounts must name the account of every key the judged run holds");
+		const account = (await placement.client.getIdentity()).customerId;
+		if (!account) throw new Error("Sandbox returned no account for the check key");
+		if (placement.builderAccounts.includes(account)) throw new Error(`Check account ${account} is an account the judged run holds a key to, so the run can reach the check box`);
+		options.signal?.throwIfAborted();
+		box = await placement.client.createIsolated({
+			environment: placement.environment,
+			agent: false,
+			bare: false,
+			ephemeral: true,
+			egressPolicy: { mode: "blocked" },
+			...placement.resources ? { resources: placement.resources } : {},
+			maxLifetimeSeconds: Math.ceil(timeoutMs / 1e3) + BOX_SETUP_SECONDS,
+			idempotencyKey: `agent-runtime-check-${randomUUID()}`
+		}, options.signal ? { signal: options.signal } : void 0);
+		const receipt = box.createReceipt();
+		if (receipt?.outcome !== "created" || receipt.ownerContext !== "isolated" || !Array.isArray(receipt.injectedSecrets) || receipt.injectedSecrets.length !== 0) throw new Error("Sandbox did not confirm a fresh box with no owner secrets");
+		const egress = (await box.egress.get()).policy;
+		if (egress.mode !== "blocked") throw new Error(`Check box egress is ${egress.mode}, not blocked`);
+		await box.fs.mkdir(BOX_TREE, { recursive: true });
+		const digests = new Map(captured.manifest.files.map((entry) => [entry.path, entry.sha256]));
+		const target = box;
+		const pending = [...captured.files];
+		const deliver = async () => {
+			try {
+				for (let file = pending.shift(); file; file = pending.shift()) {
+					options.signal?.throwIfAborted();
+					const received = await target.fs.uploadData(`${BOX_TREE}/${file.path}`, file.bytes, { mode: file.mode });
+					if (`sha256:${received.hash.replace(/^sha256:/, "").toLowerCase()}` !== digests.get(file.path) || received.size !== file.bytes.byteLength) throw new Error(`Check box received different bytes for ${file.path}`);
+				}
+			} catch (error) {
+				pending.length = 0;
+				throw error;
+			}
+		};
+		await Promise.all(Array.from({ length: BOX_UPLOADS }, deliver));
+		evidence = {
+			sandboxId: box.id,
+			account,
+			input: captured.manifest,
+			inputDigest: canonicalCandidateDigest(captured.manifest)
+		};
+		result = await executeInBox(box, options.command, timeoutMs, maxOutputBytes, options.signal);
+	} catch (error) {
+		result = {
+			succeeded: false,
+			reason: options.signal?.aborted ? "cancelled" : "refused",
+			diagnostic: String(error)
+		};
+	}
+	if (box) try {
+		await box.delete();
+	} catch (error) {
+		const cleanupDiagnostic = `Check box ${box.id} was not deleted: ${String(error)}`;
+		result = result.succeeded ? {
+			succeeded: false,
+			reason: "cleanup-failed",
+			diagnostic: cleanupDiagnostic,
+			stdout: result.value.stdout,
+			stderr: result.value.stderr,
+			exitCode: 0
+		} : {
+			...result,
+			cleanupDiagnostic
+		};
+	}
+	return evidence ? {
+		...result,
+		box: evidence
+	} : result;
+}
+async function executeInBox(box, command, timeoutMs, limit, signal) {
+	const [executable, ...args] = command;
+	const child = await box.process.spawnExact(executable, args, {
+		cwd: BOX_TREE,
+		env: {
+			PATH: "/usr/bin:/bin",
+			HOME: "/tmp",
+			LANG: "C"
+		},
+		inheritEnv: false,
+		timeoutMs: timeoutMs + BOX_PROCESS_BACKSTOP_MS
+	});
+	const stdout = [];
+	const stderr = [];
+	let bytes = 0;
+	let failure;
+	let stopping;
+	const stop = (reason) => {
+		failure ??= reason;
+		stopping ??= child.kill("SIGKILL", { tree: true }).catch(() => void 0);
+	};
+	const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
+	const cancel = () => stop("cancelled");
+	signal?.addEventListener("abort", cancel, { once: true });
+	if (signal?.aborted) cancel();
+	const capture = async (stream, target) => {
+		for await (const text of stream) {
+			const chunk = Buffer.from(text);
+			const remaining = Math.max(0, limit - bytes);
+			bytes += chunk.length;
+			if (remaining) target.push(chunk.subarray(0, remaining));
+			if (bytes > limit) stop("output-limit");
+		}
+	};
+	let exitCode;
+	let exitSignal;
+	try {
+		await Promise.all([capture(child.stdout(), stdout), capture(child.stderr(), stderr)]);
+		exitCode = await child.wait();
+		exitSignal = (await child.status()).exitSignal;
+	} finally {
+		clearTimer();
+		signal?.removeEventListener("abort", cancel);
+		await stopping;
+	}
+	const out = Buffer.concat(stdout).toString();
+	const err = Buffer.concat(stderr).toString();
+	const evidence = {
+		stdout: out,
+		stderr: err,
+		exitCode: exitSignal ? null : exitCode
+	};
+	if (failure) return {
+		succeeded: false,
+		reason: failure,
+		diagnostic: err || failure,
+		...evidence
+	};
+	if (exitCode === 127 && err.startsWith(BOX_EXEC_FAILURE)) return {
+		succeeded: false,
+		reason: "refused",
+		diagnostic: err,
+		...evidence
+	};
+	if (exitSignal) return {
+		succeeded: false,
+		reason: "failed",
+		diagnostic: err || `Check killed by ${exitSignal}`,
+		...evidence
+	};
+	if (exitCode !== 0) return {
+		succeeded: false,
+		reason: "failed",
+		diagnostic: err || out || `Check exited ${exitCode}`,
+		...evidence
+	};
+	return {
+		succeeded: true,
+		value: {
+			stdout: out,
+			stderr: err
+		}
+	};
+}
 function execute(args, timeoutMs, limit, signal) {
 	return new Promise((done) => {
 		const child = spawn("/usr/bin/bwrap", [
@@ -5134,7 +5332,7 @@ async function runStrategyEvolution(cfg) {
 		if (c.error) continue;
 		if (!c.file || !c.sourceSha256) throw new Error(`evolution resume: missing source identity for '${c.name}'`);
 		const bytes = readFileSync(c.file);
-		if (sha256Bytes(bytes) !== c.sourceSha256) throw new Error(`evolution resume: authored source changed for '${c.name}' (${c.file})`);
+		if (sha256Bytes$1(bytes) !== c.sourceSha256) throw new Error(`evolution resume: authored source changed for '${c.name}' (${c.file})`);
 		const sourceUrl = pathToFileURL(c.file);
 		sourceUrl.searchParams.set("sha256", c.sourceSha256);
 		const mod = await import(sourceUrl.href);
@@ -5188,7 +5386,7 @@ async function runStrategyEvolution(cfg) {
 				candidates.push({
 					name: unique,
 					file: authored.file,
-					sourceSha256: sha256Bytes(Buffer.from(authored.code)),
+					sourceSha256: sha256Bytes$1(Buffer.from(authored.code)),
 					gzipBits: gzipSync(Buffer.from(authored.code)).length * 8,
 					codeChars: authored.code.length
 				});
@@ -7168,4 +7366,4 @@ function tail(s) {
 //#endregion
 export { InMemoryCorpus as $, chatWorkerSeam as A, pairwiseSignificance as At, SandboxRunAbortError as B, createMcpEnvironment as Bt, withUntrackedArtifacts as C, loopDispatch as Ct, codeModeSupervisorTools as D, sentinelCompletion as Dt, runCoderChecks as E, deterministicCompletion as Et, selectChampion as F, auditIntent as Ft, equalKOnCost as G, resolveSecretEnv as Gt, printBenchmarkReport as H, envKeyProvider as Ht, assertStrategyContract as I, defaultAuditorInstruction as It, runPersonified as J, trajectoryReport as K, secretEnvOfMcpServer as Kt, authorStrategy as L, McpSpawnFault as Lt, discriminatingMeans as M, renderLeaderboardMarkdown as Mt, pickChampion as N, renderLeaderboardSvg as Nt, unsafeInProcessRunner as O, stopSentinel as Ot, runStrategyEvolution as P, renderPairwiseMarkdown as Pt, FileCorpus as Q, strategyAuthorContract as R, connectStdioMcp as Rt, copyUntrackedIntoClone as S, loopCampaignDispatch as St, patchDelivered as T, completionAuthorizes as Tt, runBenchmark as U, mcpSecretEnvMetadataKey as Ut, openSandboxRun as V, sanitizeMcpToolSchema as Vt, promotionGate as W, resolveMcpServerLaunch as Wt, createShapeRegistry as X, builtinShapes as Y, registerShape as Z, NOTE_MAX_CHARS as _, harvestCorpus as _t, localShell as a, pipeline as at, composeWorkerEvidence as b, localSandboxClient as bt, createVerifierEnvironment as c, widen as ct, harvestSurfaceDiffs as d, createScopeAnalyst as dt, renderCorpusToInstructions as et, analystsFromRegistry as f, registryScopeAnalyst as ft, EVIDENCE_MAX_CHARS as g, HarvestError as gt, worktreeFanout as h, inProcessSandboxClient as ht, jjWorkspace as i, panel as it, createChatSessionStore as j, renderLeaderboardHtml as jt, chatTransportExecutor as k, leaderboard as kt, boxSurfaceReader as l, assertTraceDerivedFindings as lt, superviseSurface as m, runIsolatedCheck as mt, makeFinding$1 as n, flatWidenGate as nt, runInWorkspace as o, selectValidWinner as ot, failuresAnalyst as p, observationFromRegistry as pt, definePersona as q, createTangleSandboxExactProcessProvider as qt, gitWorkspace as r, loopUntil as rt, createWaterfallCollector as s, verify as st, computeFindingId$1 as t, fanout as tt, fsSurfaceReader as u, buildSteerContext as ut, VERIFY_TAIL_CHARS as v, defineLeaderboard as vt, analyzeTrace as w, superviseDispatch as wt, settledWorkerOut as x, inlineSandboxClient as xt, closingWorkerNote as y, resolveSandboxClient as yt, strategyAuthorSystemPrompt as z, materializeLocalMcp as zt };
 
-//# sourceMappingURL=runtime-DKiucqGX.js.map
+//# sourceMappingURL=runtime-BbQmK7qe.js.map