@tangle-network/agent-runtime 0.279.0 → 0.281.0

package/dist/{structural-rollout-D-0X6lsU.js → shared-box-CZFdugL1.js}

@@ -1,11 +1,13 @@
-import { At as createExecutor, Ba as promptOptionsFromAgentTurnInput, Bt as InMemoryResultBlobStore, Dt as captureReusableExecutorConfig, Ia as armDeadlineTimer, Ji as unknownExecutionBindingReceipt, Ki as runtimeOwnedPendingExecutorMaterialization, Li as knownExecutionBindingReceipt, M as withDriverExecutor, Pa as awaitAbortable, Pi as authoredProfileDigest, Ri as knownMaterializationReceipt, Ui as runtimeOwnedExecutorExecutionBinding, Va as providerMessageText, Vt as InMemorySpawnJournal, Wi as runtimeOwnedExecutorMaterialization, Xi as executableAgentProfileSnapshot, Yi as unknownMaterializationReceipt, Zn as observedModelMatchesDeclared, aa as createSandboxUsageLedger, ca as mapSandboxEvent, ea as projectSandboxOutcome, ia as createSandboxToolPartState, jt as createExecutorRegistry, la as mapSandboxToolEvent, r as createSupervisor, ra as canonicalStreamEventFromSandboxEvent, sa as isSandboxTerminalEvent, ta as readSandboxOutcome, za as promptFromAgentTurnInput } from "./supervisor-DtlPj9me.js";
+import { Ba as promptOptionsFromAgentTurnInput, Ht as InMemorySpawnJournal, Ia as armDeadlineTimer, Ji as unknownExecutionBindingReceipt, Ki as runtimeOwnedPendingExecutorMaterialization, Li as knownExecutionBindingReceipt, M as withDriverExecutor, Mt as createExecutorRegistry, Ot as captureReusableExecutorConfig, Pa as awaitAbortable, Pi as authoredProfileDigest, Qn as observedModelMatchesDeclared, Ri as knownMaterializationReceipt, Sa as sleep, Ui as runtimeOwnedExecutorExecutionBinding, Va as providerMessageText, Vt as InMemoryResultBlobStore, Wi as runtimeOwnedExecutorMaterialization, Xi as executableAgentProfileSnapshot, Yi as unknownMaterializationReceipt, aa as createSandboxUsageLedger, ar as sandboxClientAsProvider, ca as mapSandboxEvent, ea as projectSandboxOutcome, er as LEAF_CONTINUATION_TASK, ia as createSandboxToolPartState, jt as createExecutor, la as mapSandboxToolEvent, oi as harnessInvocation, or as unavailablePauseMs, r as createSupervisor, ra as canonicalStreamEventFromSandboxEvent, sa as isSandboxTerminalEvent, sr as unavailableSignalOfFailure, ta as readSandboxOutcome, za as promptFromAgentTurnInput } from "./supervisor-UXgaPisu.js";
 import { m as ValidationError, p as SessionMismatchError, r as BackendTransportError } from "./errors-DodWX-cb.js";
-import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, s as profileBridgeWireModel, t as assertExecutableAgentProfile } from "./model-policy-BbSCSak0.js";
+import { a as concreteProfileModel, c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, s as profileBridgeWireModel, t as assertExecutableAgentProfile } from "./model-policy-BbSCSak0.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, renderInputPartsAsText } from "@tangle-network/agent-interface";
 import { costForTokenPricing, makeProposalFinding, scoreKnowledgeReadiness } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
-import { randomBytes } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
+import { materializeProfile } from "@tangle-network/agent-profile-materialize";
 import { assertProposalFindings } from "@tangle-network/agent-eval/analyst";
+import { harnessSystemPromptIntents as harnessSystemPromptIntents$1 } from "@tangle-network/agent-interface/harness-capabilities";
 //#region src/sessions.ts
 /**
 *
@@ -1218,7 +1220,7 @@ function profileOptimizerModelCall(args) {
 		} catch (error) {
 			return {
 				succeeded: false,
-				error: errorMessage(error),
+				error: errorMessage$1(error),
 				receipt: unknownOptimizerReceipt(binding.model),
 				execution: {
 					kind: "agent-runtime-profile-model-call",
@@ -1227,7 +1229,7 @@ function profileOptimizerModelCall(args) {
 					callId: request.callId,
 					endpointFormat: request.endpointFormat ?? null,
 					executed: false,
-					error: errorMessage(error)
+					error: errorMessage$1(error)
 				}
 			};
 		}
@@ -1250,7 +1252,7 @@ function profileOptimizerModelCall(args) {
 				execution
 			};
 		} catch (error) {
-			const message = `profile optimizer receipt normalization failed after execution: ${errorMessage(error)}`;
+			const message = `profile optimizer receipt normalization failed after execution: ${errorMessage$1(error)}`;
 			return {
 				succeeded: false,
 				error: message,
@@ -1514,7 +1516,7 @@ function optimizerTokenCount(value, label) {
 	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`profile optimizer ${label} must be a non-negative integer`);
 	return value;
 }
-function errorMessage(error) {
+function errorMessage$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
@@ -2868,6 +2870,954 @@ function structuralRollout(config = {}) {
 	});
 }
 //#endregion
-export { collectAgentTurn as A, defaultAnalystInstruction as C, profileOptimizerModelCall as D, profileChatClient as E, InMemoryRuntimeSessionStore as F, newRuntimeSession as I, nowIso as L, createIterableBackend as M, createSandboxPromptBackend as N, optimizerMethod as O, normalizeBackendStreamEvent as P, startOrResumeRuntimeSession as R, ObservationError as S, renderReport as T, depthStrategy as _, defaultStructuralRolloutPolicy as a, sample as b, officialChecksFromMeta as c, selectBestIndex as d, structuralRollout as f, defineStrategy as g, breadthStrategy as h, defaultExtractCandidate as i, streamAgentTurn as j, strategyAuthorMethod as k, resolveEntrySymbol as l, adaptiveRefine as m, compareCheckOutcomes as n, filterAuthoredAsserts as o, visibleCheckScore as p, composeCheckSources as r, modelAuthoredChecks as s, canDisplace as t, sandboxCheckRunner as u, refine as v, observe as w, sampleThenRefine as x, runAgentic as y, touchSession as z };
+//#region src/runtime/shared-box.ts
+/**
+* Shared-box placement: many harness workers in one Sandbox box, each as its own process.
+*
+* The default provider placement gives every worker its own Sandbox box. A box costs a create
+* call, a sidecar, an egress proxy, a preview link and a memory reservation sized for the box,
+* while one opencode worker uses about half a gigabyte. This module packs workers into a small
+* pool of boxes instead. Each worker runs `opencode run` as a separate process with its own
+* working directory and its own HOME, so each worker has its own harness session, its own
+* materialized profile and its own transcript files.
+*
+* Why processes and not sidecar sessions: the sidecar serves every session in one box from one
+* workspace and writes each session's profile into the same files. Measured 2026-09-24 on
+* sandbox-ff52a989e7c9: eight concurrent sessions with different instructions, and seven of eight
+* answered with another session's instructions. A process with its own directory, its own HOME and
+* `OPENCODE_DISABLE_PROJECT_CONFIG` reads only its own configuration: sixteen of sixteen concurrent
+* workers answered with their own instructions and wrote only into their own directory.
+*
+* The boundary is cooperative, not a security boundary. Every worker runs as the same Linux user,
+* so a worker can read a co-tenant's files through its shell. A profile that writes a repository,
+* runs untrusted code, holds a credential of its own, or must stay blind to its siblings keeps a
+* dedicated box: {@link SharedBoxPlacement.refusal} names the profile features this placement
+* cannot carry, and Runtime then uses the dedicated provider.
+*
+* A worker whose model provider refuses a turn for capacity keeps its process's session and
+* directory, pauses by the driver's rule, and continues the same opencode session, the way a
+* dedicated leaf does (`ProviderExecutorOptions.unavailablePause`). Measured 2026-09-24: 15 of 23
+* down children of play anomaly-referee-v3d ended on `provider_quota_exhausted`, and opencode
+* itself gives up on a refused model after about 70 seconds of its own retries.
+*
+* The workers of one box share the box's router key. Each worker names itself to the router with
+* the `x-tangle-client` header, which the router stores as `clientName` on every usage row, so a
+* keeper can price one worker from the key's per-client rows (`tangle-admin router-spend --key
+* <box key>`). A request without the header stays charged to the box.
+*
+* `workersPerBox` is the one structural cap, and it protects the box. A Tangle box has a fixed
+* 512-task pids limit. An idle box uses about 118 tasks and one opencode worker about 34, so
+* twelve workers reach the limit. At that limit the sidecar's own process spawn fails with EAGAIN
+* and the sidecar restarts, which ends every worker in the box (measured on the same box: 28
+* workers crashed the sidecar twice; 16 workers crashed it once).
+*/
+/**
+* The most workers one default box carries at once.
+*
+* It keeps a worker count that the 512-task pids limit of a Tangle box can hold with headroom
+* for the sidecar's own processes and the workers' tool shells: 118 idle tasks plus 8 workers at
+* about 34 tasks each is 390. Memory is not the binding limit: 8 workers used about 4 GB in a
+* 16 GB box. Raise it only for a box whose pids limit was raised with it.
+*/
+const DEFAULT_SHARED_BOX_WORKERS = 8;
+/** The box shape the default placement creates: memory for 8 workers at about 0.5 GB each plus
+*  the sidecar, and 4 cores, because the workers wait on the model most of the time. */
+const DEFAULT_SHARED_BOX_RESOURCES = Object.freeze({
+	cpuCores: 4,
+	memoryMB: 8192
+});
+const DEFAULT_WORKER_ROOT = "/home/agent/workers";
+const HARNESS = "opencode";
+const SHARED_PROVIDER_NAME = "tangle-shared-box";
+const DEFAULT_EXEC_TIMEOUT_MS = 12e4;
+/** The request header the router records as a usage row's `clientName`. */
+const ROUTER_CLIENT_HEADER = "x-tangle-client";
+/**
+* The router client name of the worker that runs supervised node `nodeId`.
+*
+* The node id is already in the spawn journal, so a keeper joins a router row to a node without
+* a new record: the row whose `clientName` is `agent-runtime-node/<nodeId>` is that node's spend.
+*/
+function sharedWorkerClientName(nodeId) {
+	if (!/^[!-~]+$/u.test(nodeId)) throw new ValidationError("sharedWorkerClientName: a node id must be visible ASCII");
+	return `agent-runtime-node/${nodeId}`;
+}
+/**
+* Attempts for one Sandbox API call that failed on the way to the box.
+*
+* Every call re-verifies the API key with the platform, and a burst of workers makes that check
+* time out: 8 of 64 workers failed with `502 platform_unavailable` (reason `platform_timeout`) in
+* one burst on 2026-09-24, and 3 more lost their transcript enumeration the same way. The check
+* refuses the request before it reaches the box, so repeating it is safe; five attempts over about
+* fifteen seconds rode out every such failure measured.
+*/
+const TRANSIENT_ATTEMPTS = 5;
+const TRANSIENT_BASE_DELAY_MS = 1e3;
+/** A failure that a repeated request can change: the platform, the gateway or the network. */
+function isTransientSandboxFailure(error) {
+	if (error === null || typeof error !== "object") return false;
+	const record = error;
+	if (typeof record.status === "number" && [
+		408,
+		425,
+		429,
+		500,
+		502,
+		503,
+		504
+	].includes(record.status)) return true;
+	const text = `${String(record.code ?? "")} ${String(record.name ?? "")} ${String(record.message ?? "")}`;
+	return /platform_unavailable|platform_timeout|platform_unreachable|fetch failed|ECONNRESET|ETIMEDOUT|EAI_AGAIN|socket hang up|UND_ERR|bad gateway|gateway timeout/iu.test(text);
+}
+async function transientRetry(operation, options = {}) {
+	const delayMs = options.delayMs ?? TRANSIENT_BASE_DELAY_MS;
+	for (let attempt = 1;; attempt += 1) try {
+		return await operation(attempt);
+	} catch (error) {
+		if (attempt >= TRANSIENT_ATTEMPTS || !isTransientSandboxFailure(error)) throw error;
+		options.signal?.throwIfAborted();
+		await sleep(delayMs * 2 ** (attempt - 1), options.signal);
+	}
+}
+/**
+* Why a shared box cannot carry `profile`, or `undefined` when it can.
+*
+* A shared box carries a profile whose whole behavior reaches an opencode process through its own
+* working directory, its own configuration and the box's own model credential. Everything else
+* keeps a dedicated box: another harness, a model the box credential cannot reach, a replaced
+* system prompt, MCP servers, connections, hooks, subagents, extensions, tool grants, and any
+* resource the materializer does not lower into the worker's directory.
+*/
+function sharedBoxRefusal(profile) {
+	if (profile.harness !== HARNESS) return `harness ${String(profile.harness)} is not ${HARNESS}`;
+	if (concreteProfileModel(profile) === void 0) return "profile names no concrete model";
+	if (profile.model?.provider === void 0) return "profile names no model provider";
+	if (profile.model?.reasoningEffort !== void 0) {
+		if (tryInvocation(profile) === void 0) return "model.reasoningEffort has no opencode variant";
+	}
+	if (profile.prompt?.systemPrompt !== void 0) return "prompt.systemPrompt replaces a system prompt";
+	for (const field of [
+		"mcp",
+		"connections",
+		"hooks",
+		"subagents",
+		"extensions",
+		"confidential",
+		"modes"
+	]) if (profile[field] !== void 0) return `profile declares ${field}`;
+	if (profile.tools !== void 0 && Object.keys(profile.tools).length > 0) return "profile grants tools";
+	const resources = profile.resources;
+	if (resources !== void 0) {
+		for (const field of [
+			"skills",
+			"agents",
+			"commands",
+			"tools"
+		]) if (resources[field] !== void 0) return `profile declares resources.${field}`;
+		for (const file of resources.files ?? []) if (file.resource.kind !== "inline") return `resource file ${file.path} is not inline`;
+		if (resources.instructions !== void 0 && typeof resources.instructions !== "string" && resources.instructions.kind !== "inline") return "resources.instructions is not inline";
+	}
+	let plan;
+	try {
+		plan = materializeProfile(profile, HARNESS);
+	} catch (error) {
+		return `opencode materialization failed: ${error instanceof Error ? error.message : String(error)}`;
+	}
+	if (plan.unsupported.length > 0) return `opencode cannot carry ${plan.unsupported.map((row) => row.dimension).join(", ")}`;
+	if (Object.keys(plan.env).length > 0 || plan.flags.length > 0) return "profile needs launch environment or flags";
+	for (const file of plan.files) {
+		if (file.root === "agent") return `profile writes ${file.relPath} into the harness home`;
+		if ((file.secretSlots?.length ?? 0) > 0) return `profile file ${file.relPath} carries a secret`;
+		if (isUnsafeRelativePath(file.relPath)) return `profile file ${file.relPath} leaves its directory`;
+	}
+}
+function tryInvocation(profile) {
+	try {
+		return harnessInvocation(HARNESS, invocationProfile(profile), "probe").args;
+	} catch {
+		return;
+	}
+}
+/**
+* The profile the invocation table reads. The prompt reaches opencode through its configuration
+* and the model through the provider this placement declares, so only the reasoning effort is
+* left for the table to lower into `--variant`.
+*/
+function invocationProfile(profile) {
+	const { prompt: _prompt, model, ...rest } = profile;
+	return {
+		...rest,
+		...model?.reasoningEffort === void 0 ? {} : { model: { reasoningEffort: model.reasoningEffort } }
+	};
+}
+function isUnsafeRelativePath(path) {
+	return path.length === 0 || path.startsWith("/") || path.split("/").some((segment) => segment === ".." || segment === "");
+}
+/**
+* Place accepted workers as processes in a pool of shared Sandbox boxes.
+*
+* The pool fills a box before it creates the next one and deletes a box when its last worker
+* releases it. Runtime reaches this placement through `createExecutor({ backend: 'provider',
+* shared })`: a profile that {@link SharedBoxPlacement.refusal} accepts runs here, and every other
+* profile keeps the dedicated provider.
+*/
+function sharedBoxPlacement(options) {
+	const workersPerBox = options.workersPerBox ?? 8;
+	if (!Number.isSafeInteger(workersPerBox) || workersPerBox < 1) throw new ValidationError("sharedBoxPlacement: workersPerBox must be a positive integer");
+	const workerRoot = options.workerRoot ?? DEFAULT_WORKER_ROOT;
+	if (!workerRoot.startsWith("/") || isUnsafeRelativePath(workerRoot.slice(1))) throw new ValidationError("sharedBoxPlacement: workerRoot must be an absolute, normalized path");
+	const boxOptions = {
+		resources: { ...DEFAULT_SHARED_BOX_RESOURCES },
+		...options.box ?? {}
+	};
+	if (boxOptions.backend !== void 0) throw new ValidationError("sharedBoxPlacement: box.backend is owned by Runtime");
+	const identity = {
+		id: "shared-box",
+		digest: canonicalCandidateDigest({
+			kind: "shared-box-placement.v1",
+			harness: HARNESS,
+			workersPerBox,
+			workerRoot,
+			box: publicBoxOptions(boxOptions)
+		})
+	};
+	const retryDelayMs = options.retryDelayMs ?? TRANSIENT_BASE_DELAY_MS;
+	const pool = createBoxPool(options.client, boxOptions, workersPerBox, retryDelayMs);
+	const providerFor = (worker = {}) => {
+		const clientName = worker.nodeId === void 0 ? void 0 : sharedWorkerClientName(worker.nodeId);
+		return sandboxClientAsProvider({ async create(createOptions) {
+			const profile = workerProfile(createOptions);
+			const refusal = sharedBoxRefusal(profile);
+			if (refusal !== void 0) throw new ValidationError(`sharedBoxPlacement: ${refusal}`);
+			assertWorkerCreateOptions(createOptions);
+			const lease = await pool.acquire();
+			try {
+				return await createWorker(lease, workerRoot, profile, {
+					retryDelayMs,
+					clientName,
+					unavailablePause: options.unavailablePause ?? {}
+				});
+			} catch (error) {
+				await lease.release();
+				throw error;
+			}
+		} }, {
+			name: SHARED_PROVIDER_NAME,
+			capabilities: sharedBoxCapabilities()
+		});
+	};
+	return {
+		providerFor,
+		identity,
+		refusal: sharedBoxRefusal,
+		stats: () => pool.stats(),
+		close: () => pool.close()
+	};
+}
+function publicBoxOptions(box) {
+	const { env, secrets, ...rest } = box;
+	return {
+		...rest,
+		...env === void 0 ? {} : { environmentVariableNames: Object.keys(env).sort() },
+		...secrets === void 0 ? {} : { secrets }
+	};
+}
+function sharedBoxCapabilities() {
+	return {
+		profile: {
+			namedProfiles: false,
+			systemPrompt: {
+				...harnessSystemPromptIntents$1(HARNESS),
+				replace: false
+			},
+			instructions: true,
+			tools: false,
+			permissions: true,
+			mcp: false,
+			subagents: false,
+			resources: {
+				files: true,
+				instructions: true
+			},
+			runtimeUpdate: false,
+			validation: false
+		},
+		streaming: {
+			live: true,
+			replay: false,
+			detach: false,
+			turnIdempotency: false
+		},
+		sessions: {
+			continue: false,
+			list: false,
+			messages: false
+		},
+		workspace: {
+			read: true,
+			write: true,
+			exec: true,
+			git: false,
+			upload: false,
+			download: false
+		},
+		branching: {
+			checkpoint: false,
+			fork: false
+		},
+		placement: true,
+		usage: true,
+		confidential: false
+	};
+}
+function workerProfile(createOptions) {
+	const raw = (createOptions?.backend)?.profile;
+	const parsed = agentProfileSchema.safeParse(raw);
+	if (!parsed.success) throw new ValidationError("sharedBoxPlacement: an exact AgentProfile is required at create");
+	return parsed.data;
+}
+/**
+* A worker create carries only what a slot in a shared box can honor. Box-level settings belong
+* to the placement's own box options, and a per-worker request for them is refused rather than
+* dropped: a worker that asked for an environment variable, a repository or its own resources
+* would otherwise run without them and report nothing.
+*/
+function assertWorkerCreateOptions(createOptions) {
+	const options = createOptions ?? {};
+	for (const key of [
+		"git",
+		"fromSnapshot",
+		"fromSandboxId",
+		"environment",
+		"cwd",
+		"resources"
+	]) if (options[key] !== void 0) throw new ValidationError(`sharedBoxPlacement: a shared worker cannot set ${key}`);
+	const env = options.env;
+	if (env !== void 0 && Object.keys(env).length > 0) throw new ValidationError("sharedBoxPlacement: a shared worker cannot set env");
+	const secrets = options.secrets;
+	if (Array.isArray(secrets) && secrets.length > 0) throw new ValidationError("sharedBoxPlacement: a shared worker cannot request secrets");
+	const backend = options.backend;
+	if (backend?.runtimeAttachments !== void 0) throw new ValidationError("sharedBoxPlacement: a shared worker cannot carry runtime attachments");
+	if (backend?.type !== void 0 && backend.type !== HARNESS) throw new ValidationError(`sharedBoxPlacement: backend ${String(backend.type)} is not ${HARNESS}`);
+}
+function createBoxPool(client, boxOptions, workersPerBox, retryDelayMs) {
+	const poolId = randomUUID();
+	const boxes = [];
+	const history = [];
+	let seq = 0;
+	let placed = 0;
+	let peak = 0;
+	let closing = false;
+	const retire = async (entry) => {
+		if (entry.retired) return void 0;
+		entry.retired = true;
+		const index = boxes.indexOf(entry);
+		if (index >= 0) boxes.splice(index, 1);
+		let handle;
+		try {
+			handle = await entry.ready;
+		} catch {
+			return;
+		}
+		try {
+			await transientRetry(() => handle.delete(), { delayMs: retryDelayMs });
+			entry.deleted = true;
+			return {
+				boxId: handle.id,
+				deleted: true
+			};
+		} catch (error) {
+			return {
+				boxId: handle.id,
+				deleted: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	};
+	return {
+		async acquire() {
+			if (closing) throw new ValidationError("sharedBoxPlacement: the placement is closed");
+			let entry = boxes.find((candidate) => !candidate.retired && candidate.workers < workersPerBox);
+			if (entry === void 0) {
+				const boxSeq = seq++;
+				const request = {
+					...boxOptions,
+					name: boxOptions.name ?? `shared-box-${poolId.slice(0, 8)}-${boxSeq}`,
+					idempotencyKey: `shared-box-${poolId}-${boxSeq}`,
+					backend: {
+						type: HARNESS,
+						profile: {
+							name: "shared-box",
+							harness: HARNESS
+						}
+					}
+				};
+				const requestedAt = Date.now();
+				const created = {
+					seq: boxSeq,
+					ready: transientRetry(() => client.create(request), { delayMs: retryDelayMs }).then((box) => box),
+					workers: 0,
+					served: 0,
+					retired: false,
+					deleted: false
+				};
+				created.ready.then((box) => {
+					created.id = box.id;
+					created.createMs = Date.now() - requestedAt;
+				}, () => {
+					const index = boxes.indexOf(created);
+					if (index >= 0) boxes.splice(index, 1);
+					created.retired = true;
+				});
+				boxes.push(created);
+				history.push(created);
+				entry = created;
+			}
+			const leased = entry;
+			leased.workers += 1;
+			leased.served += 1;
+			placed += 1;
+			peak = Math.max(peak, leased.workers);
+			let box;
+			try {
+				box = await leased.ready;
+			} catch (error) {
+				leased.workers -= 1;
+				throw error;
+			}
+			let released = false;
+			return {
+				box,
+				async release() {
+					if (released) return;
+					released = true;
+					leased.workers -= 1;
+					if (leased.workers === 0 && !closing) await retire(leased);
+				}
+			};
+		},
+		stats() {
+			return {
+				boxesCreated: history.length,
+				boxesLive: history.filter((entry) => !entry.retired).length,
+				workersPlaced: placed,
+				workersLive: history.reduce((sum, entry) => sum + entry.workers, 0),
+				peakWorkersPerBox: peak,
+				boxes: history.filter((entry) => entry.id !== void 0).map((entry) => ({
+					id: entry.id,
+					workersServed: entry.served,
+					deleted: entry.deleted,
+					createMs: entry.createMs ?? 0
+				}))
+			};
+		},
+		async close() {
+			closing = true;
+			return (await Promise.all(history.map((entry) => retire(entry)))).filter((receipt) => receipt !== void 0);
+		}
+	};
+}
+/** The environment one worker's processes see: its own directory, HOME and XDG roots. */
+function workerEnv(paths) {
+	return [
+		"OPENCODE_DISABLE_PROJECT_CONFIG=1",
+		`OPENCODE_CONFIG_DIR=${paths.dir}/.opencode`,
+		`PWD=${paths.dir}`,
+		`HOME=${paths.home}`,
+		`XDG_DATA_HOME=${paths.home}/.local/share`,
+		`XDG_CONFIG_HOME=${paths.home}/.config`,
+		`XDG_STATE_HOME=${paths.home}/.local/state`,
+		`XDG_CACHE_HOME=${paths.cache}`
+	];
+}
+async function createWorker(lease, root, createProfile, placement) {
+	const { clientName, unavailablePause } = placement;
+	const box = resilientBox(lease.box, placement.retryDelayMs);
+	const workerId = `w-${randomUUID()}`;
+	const paths = {
+		dir: `${root}/${workerId}`,
+		home: `${root}/${workerId}/.home`,
+		cache: `${root}/.cache`
+	};
+	const made = await box.exec(`mkdir -p '${paths.home}' '${paths.cache}'`, { timeoutMs: DEFAULT_EXEC_TIMEOUT_MS });
+	if ((made.exitCode ?? 1) !== 0) throw new Error(`sharedBoxPlacement: could not create ${paths.dir}: ${made.stderr ?? ""}`);
+	const env = workerEnv(paths);
+	let running;
+	let turnActive = false;
+	let released = false;
+	const started = /* @__PURE__ */ new Set();
+	const run = async (args, timeoutMs, extraEnv) => {
+		const process = await box.spawnInDirectory("/usr/bin/env", [...env, ...args], {
+			cwd: paths.dir,
+			...extraEnv === void 0 ? {} : { env: extraEnv },
+			timeoutMs
+		}, started);
+		started.add(process.pid);
+		return process;
+	};
+	const collect = async (process) => {
+		const [stdout, stderr, exitCode] = await Promise.all([
+			drain(box.output(process, "stdout")),
+			drain(box.output(process, "stderr")),
+			box.wait(process)
+		]);
+		return {
+			exitCode,
+			stdout,
+			stderr
+		};
+	};
+	const resolvePath = (path) => {
+		if (path.startsWith("/")) return path;
+		if (isUnsafeRelativePath(path)) throw new ValidationError(`sharedBoxPlacement: path ${path} leaves the worker directory`);
+		return `${paths.dir}/${path}`;
+	};
+	/**
+	* One turn: one or more opencode runs of the same session. The first runs `message`; a later run
+	* continues the session after the model provider refused a run for capacity.
+	*/
+	async function* turn(message, turnProfile, options) {
+		const signal = options?.signal;
+		const timeoutMs = options?.timeoutMs ?? 0;
+		const turnDeadline = timeoutMs > 0 ? Date.now() + timeoutMs : void 0;
+		let sessionId;
+		const subagents = /* @__PURE__ */ new Set();
+		let refusalsInARow = 0;
+		let prompt = message;
+		for (let invocation = 1;; invocation += 1) {
+			const launch = await materializeWorker(box, paths, turnProfile, prompt, options?.backend?.model, clientName, sessionId);
+			signal?.throwIfAborted();
+			const remainingMs = turnDeadline === void 0 ? 0 : Math.max(1, turnDeadline - Date.now());
+			const process = await run(launch.args, remainingMs, { OPENCODE_CONFIG_CONTENT: launch.config });
+			running = process;
+			const onAbort = () => {
+				process.kill("SIGKILL", { tree: true }).catch(() => void 0);
+			};
+			signal?.addEventListener("abort", onAbort, { once: true });
+			const stderr = drain(box.output(process, "stderr"));
+			const lines = lineReader();
+			const parsed = createOpencodeEventParser(launch.model);
+			let exitCode;
+			let errorText;
+			try {
+				for await (const chunk of box.output(process, "stdout")) for (const line of lines.push(chunk)) yield* parsed.line(line);
+				for (const line of lines.end()) yield* parsed.line(line);
+				exitCode = await box.wait(process);
+				errorText = (await stderr).slice(-4e3);
+			} finally {
+				signal?.removeEventListener("abort", onAbort);
+				running = void 0;
+			}
+			sessionId = parsed.sessionId() ?? sessionId;
+			for (const child of parsed.subagentSessionIds()) subagents.add(child);
+			const failure = parsed.failure(exitCode, errorText);
+			const refusal = failure === void 0 || unavailablePause === false || signal?.aborted ? void 0 : unavailableSignalOfFailure({ error: failure });
+			refusalsInARow = parsed.madeProgress() ? 1 : refusalsInARow + 1;
+			const pauseMs = refusal === void 0 || unavailablePause === false ? 0 : unavailablePauseMs(refusalsInARow, unavailablePause);
+			if (refusal === void 0 || turnDeadline !== void 0 && Date.now() + pauseMs >= turnDeadline) {
+				if (sessionId !== void 0) await exportSession(run, collect, paths, sessionId);
+				for (const child of subagents) if (child !== sessionId) await exportSession(run, collect, paths, child);
+				signal?.throwIfAborted();
+				yield* parsed.finish(exitCode, errorText, invocation);
+				return;
+			}
+			await sleep(pauseMs, signal);
+			signal?.throwIfAborted();
+			if (released) throw new ValidationError("sharedBoxPlacement: this worker was released");
+			prompt = sessionId === void 0 ? message : LEAF_CONTINUATION_TASK;
+		}
+	}
+	return {
+		id: `${box.id}/${workerId}`,
+		name: workerId,
+		status: "running",
+		metadata: {
+			sharedBoxId: box.id,
+			workerId,
+			workerDir: paths.dir
+		},
+		async *streamPrompt(message, options) {
+			if (released) throw new ValidationError("sharedBoxPlacement: this worker was released");
+			if (turnActive) throw new ValidationError("sharedBoxPlacement: a worker runs one turn at a time");
+			const turnProfile = options?.backend?.profile === void 0 ? createProfile : agentProfileSchema.parse(options.backend.profile);
+			if (canonicalAgentProfileDigest(turnProfile) !== canonicalAgentProfileDigest(createProfile) && sharedBoxRefusal(turnProfile) !== void 0) throw new ValidationError(`sharedBoxPlacement: ${sharedBoxRefusal(turnProfile)}`);
+			if (options?.backend?.type !== void 0 && options.backend.type !== HARNESS) throw new ValidationError(`sharedBoxPlacement: backend ${options.backend.type} is not ${HARNESS}`);
+			turnActive = true;
+			try {
+				yield* turn(message, turnProfile, options);
+			} finally {
+				turnActive = false;
+			}
+		},
+		async exec(command, options) {
+			const process = await run([
+				"/bin/sh",
+				"-c",
+				command
+			], options?.timeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS);
+			return await collect(process);
+		},
+		async read(path) {
+			return await box.fs.read(resolvePath(path));
+		},
+		async write(path, content) {
+			await box.fs.write(resolvePath(path), content);
+		},
+		async refresh() {},
+		async delete() {
+			if (released) return;
+			released = true;
+			try {
+				await running?.kill("SIGKILL", { tree: true });
+				await box.exec(`rm -rf '${paths.dir}'`, { timeoutMs: DEFAULT_EXEC_TIMEOUT_MS });
+			} finally {
+				await lease.release();
+			}
+		}
+	};
+}
+/**
+* The Sandbox calls one worker makes, each repeated on a transient failure.
+*
+* A launch is repeated only after the pool confirms the box did not start it: a failed request
+* may have reached the box before its answer was lost, so the repeat first looks for a process
+* in the worker's own directory that this worker did not start yet, and adopts it. A process log
+* that breaks mid-stream is read again from the start, because the box replays a process's
+* buffered output, and the part already delivered is skipped.
+*/
+function resilientBox(box, delayMs) {
+	const retry = (operation) => transientRetry(operation, { delayMs });
+	return {
+		id: box.id,
+		exec: (command, options) => retry(() => box.exec(command, options)),
+		fs: {
+			read: (path) => retry(() => box.fs.read(path)),
+			write: (path, content) => retry(() => box.fs.write(path, content))
+		},
+		async spawnInDirectory(executable, args, options, known) {
+			return await transientRetry(async (attempt) => {
+				if (attempt > 1) {
+					const launched = (await box.process.list()).find((entry) => entry.cwd === options.cwd && entry.command === executable && !known.has(entry.pid));
+					const adopted = launched === void 0 ? null : await box.process.get(launched.pid);
+					if (adopted !== null) return adopted;
+				}
+				return await box.process.spawnExact(executable, args, options);
+			}, { delayMs });
+		},
+		async wait(process) {
+			return await retry(async () => {
+				try {
+					return await process.wait();
+				} catch (error) {
+					if (!isTransientSandboxFailure(error)) throw error;
+					const again = await box.process.get(process.pid);
+					if (again === null) throw error;
+					return await again.wait();
+				}
+			});
+		},
+		async *output(process, stream) {
+			let delivered = 0;
+			let source = process;
+			for (let attempt = 1;; attempt += 1) {
+				let seen = 0;
+				try {
+					for await (const chunk of source[stream]()) {
+						const fresh = seen + chunk.length <= delivered ? "" : chunk.slice(Math.max(0, delivered - seen));
+						seen += chunk.length;
+						if (fresh.length > 0) {
+							delivered += fresh.length;
+							yield fresh;
+						}
+					}
+					return;
+				} catch (error) {
+					if (attempt >= TRANSIENT_ATTEMPTS || !isTransientSandboxFailure(error)) throw error;
+					await sleep(delayMs * 2 ** (attempt - 1));
+					source = await retry(() => box.process.get(process.pid)) ?? source;
+				}
+			}
+		},
+		delete: () => retry(() => box.delete())
+	};
+}
+async function drain(stream) {
+	let text = "";
+	for await (const chunk of stream) text += chunk;
+	return text;
+}
+function lineReader() {
+	let pending = "";
+	return {
+		push(chunk) {
+			pending += chunk;
+			const lines = pending.split("\n");
+			pending = lines.pop() ?? "";
+			return lines.filter((line) => line.trim().length > 0);
+		},
+		end() {
+			const rest = pending.trim();
+			pending = "";
+			return rest.length > 0 ? [rest] : [];
+		}
+	};
+}
+/**
+* Write the worker's materialized profile into its directory and build its launch.
+*
+* The files come from the same materializer the Sandbox sidecar uses, so a shared worker gets the
+* same instruction file, permissions and resource files a dedicated box would. The generated
+* `opencode.json` is passed as `OPENCODE_CONFIG_CONTENT` with its instruction paths made absolute,
+* because opencode resolves an instruction path in that variable against nothing.
+*/
+async function materializeWorker(box, paths, profile, task, turnModel, clientName, continueSession) {
+	const refusal = sharedBoxRefusal(profile);
+	if (refusal !== void 0) throw new ValidationError(`sharedBoxPlacement: ${refusal}`);
+	if (turnModel?.authFiles !== void 0 || turnModel?.authMode === "oauth") throw new ValidationError("sharedBoxPlacement: a shared worker cannot carry auth files");
+	const plan = materializeProfile(profile, HARNESS);
+	let generated = {};
+	for (const file of plan.files) {
+		if (file.relPath === "opencode.json" && file.source === "generated") {
+			generated = JSON.parse(file.content);
+			continue;
+		}
+		if (continueSession === void 0) await box.fs.write(`${paths.dir}/${file.relPath}`, file.content);
+	}
+	const instructions = Array.isArray(generated.instructions) ? generated.instructions.map((entry) => typeof entry === "string" && !entry.startsWith("/") ? `${paths.dir}/${entry}` : entry) : void 0;
+	const providerId = profile.model.provider;
+	const modelId = profileProviderModel(profile);
+	const apiKeyEnv = typeof turnModel?.apiKeyEnv === "string" ? turnModel.apiKeyEnv : "OPENCODE_MODEL_API_KEY";
+	const baseURL = typeof turnModel?.baseUrl === "string" ? turnModel.baseUrl : "{env:OPENCODE_MODEL_BASE_URL}";
+	const config = {
+		$schema: "https://opencode.ai/config.json",
+		...generated,
+		...instructions === void 0 ? {} : { instructions },
+		permission: {
+			external_directory: {
+				"*": "deny",
+				"/tmp/**": "allow"
+			},
+			...generated.permission ?? {}
+		},
+		provider: { [providerId]: {
+			npm: "@ai-sdk/openai-compatible",
+			name: providerId,
+			options: {
+				baseURL,
+				apiKey: `{env:${apiKeyEnv}}`,
+				...clientName === void 0 ? {} : { headers: { [ROUTER_CLIENT_HEADER]: clientName } }
+			},
+			models: { [modelId]: { name: modelId } }
+		} }
+	};
+	const invocation = harnessInvocation(HARNESS, invocationProfile(profile), task, { dangerouslySkipPermissions: true });
+	const model = `${providerId}/${modelId}`;
+	if (continueSession !== void 0 && !/^[A-Za-z0-9_-]+$/u.test(continueSession)) throw new ValidationError(`sharedBoxPlacement: session id ${continueSession} is not opencode's`);
+	return {
+		args: [
+			invocation.command,
+			...invocation.args,
+			...continueSession === void 0 ? [] : ["--session", continueSession],
+			"--format",
+			"json",
+			"-m",
+			model
+		],
+		config: JSON.stringify(config),
+		model
+	};
+}
+/**
+* Save the harness's own record of the session where the transcript capture reads it.
+*
+* Current opencode keeps sessions in a SQLite database, which the capture cannot carry as text.
+* `opencode export` writes the same session as JSON.
+*/
+async function exportSession(run, collect, paths, sessionId) {
+	if (!SESSION_ID.test(sessionId)) return;
+	await collect(await run([
+		"/bin/sh",
+		"-c",
+		"mkdir -p \"$(dirname \"$2\")\" && exec opencode export \"$1\" > \"$2\"",
+		"export-session",
+		sessionId,
+		`${paths.home}/.local/share/opencode/export/${sessionId}.json`
+	], DEFAULT_EXEC_TIMEOUT_MS));
+}
+const SESSION_ID = /^[A-Za-z0-9_-]+$/u;
+/** A subagent's session id in a `task` result (`<task id="ses_…">`) or failure (`task_id: ses_…`). */
+const TASK_SESSION = /(?:<task id="|task_id: )(ses_[A-Za-z0-9]+)/u;
+/**
+* The session a harness subagent ran in, named by its parent's `task` tool part.
+*
+* opencode starts each subagent in a child session and refuses a nested one unless the
+* configuration raises `subagent_depth` above 1, so under the default the parent's parts name
+* every subagent session. A running part carries the id in `state.metadata.sessionId`; a finished
+* one also carries it in its output, and a failed one in its error.
+*/
+function subagentSessionOf(part) {
+	if (part.type !== "tool" || part.tool !== "task") return void 0;
+	const state = part.state;
+	if (state === void 0 || state === null || typeof state !== "object") return void 0;
+	const { metadata, output, error } = state;
+	const named = metadata !== null && typeof metadata === "object" ? metadata.sessionId : void 0;
+	if (typeof named === "string" && SESSION_ID.test(named)) return named;
+	for (const text of [output, error]) {
+		const match = typeof text === "string" ? TASK_SESSION.exec(text) : null;
+		if (match !== null) return match[1];
+	}
+}
+/**
+* Translate opencode's JSON event lines into the Sandbox event wire the provider executor reads.
+*
+* Every part becomes `message.part.updated`, which is how the sidecar forwards opencode parts, so
+* the existing trace and progress readers decode them unchanged. Each `step-finish` part also
+* becomes one canonical `llm_call` receipt with its token counts. opencode reports no dollar
+* receipt for a custom provider, so every receipt says the cost is unknown and Runtime prices the
+* tokens as an estimate instead of a bill.
+*/
+function createOpencodeEventParser(model) {
+	let sessionId;
+	let finalMessageId;
+	const textByMessage = /* @__PURE__ */ new Map();
+	const subagentSessions = /* @__PURE__ */ new Set();
+	const errors = [];
+	let malformed = 0;
+	let spentTokens = false;
+	const failureOf = (exitCode, stderr) => {
+		if (exitCode !== 0) {
+			const said = [...errors, stderr.trim().slice(-1e3)].filter((text) => text.length > 0);
+			return `opencode exited ${exitCode}${said.length > 0 ? `: ${said.join("; ")}` : ""}`;
+		}
+		return errors.length > 0 && finalMessageId === void 0 ? errors.join("; ") : void 0;
+	};
+	return {
+		sessionId: () => sessionId,
+		subagentSessionIds: () => [...subagentSessions],
+		/** Why this run failed, or `undefined` when it answered. */
+		failure: failureOf,
+		/** Whether this run spent any model tokens before it ended. */
+		madeProgress: () => spentTokens,
+		*line(raw) {
+			let event;
+			try {
+				event = JSON.parse(raw);
+			} catch {
+				malformed += 1;
+				return;
+			}
+			if (typeof event.sessionID === "string") sessionId ??= event.sessionID;
+			if (event.type === "error") {
+				const message = errorMessage(event.error);
+				errors.push(message);
+				yield {
+					type: "error",
+					data: { message }
+				};
+				return;
+			}
+			const part = event.part;
+			if (part === void 0 || part === null || typeof part !== "object") return;
+			const subagent = subagentSessionOf(part);
+			if (subagent !== void 0) subagentSessions.add(subagent);
+			yield {
+				type: "message.part.updated",
+				data: { part }
+			};
+			const messageId = typeof part.messageID === "string" ? part.messageID : void 0;
+			if (part.type === "text" && messageId !== void 0 && typeof part.text === "string") {
+				const texts = textByMessage.get(messageId) ?? [];
+				texts.push(part.text);
+				textByMessage.set(messageId, texts);
+			}
+			if (part.type === "step-finish") {
+				if (messageId !== void 0) finalMessageId = messageId;
+				const receipt = stepReceipt(part, model);
+				if (receipt !== void 0) {
+					const data = receipt.data;
+					if ((data?.tokensIn ?? 0) > 0 || (data?.tokensOut ?? 0) > 0) spentTokens = true;
+					yield receipt;
+				}
+			}
+		},
+		/** The turn's terminal frames, from its last run. `runs` counts the runs of the session. */
+		*finish(exitCode, stderr, runs = 1) {
+			const finalText = (finalMessageId === void 0 ? void 0 : textByMessage.get(finalMessageId)?.join("")) ?? "";
+			const failure = failureOf(exitCode, stderr);
+			const counted = {
+				...malformed > 0 ? { malformedLines: malformed } : {},
+				...runs > 1 ? { sessionRuns: runs } : {}
+			};
+			if (failure !== void 0) {
+				yield {
+					type: "result",
+					data: {
+						success: false,
+						status: "failed",
+						error: failure,
+						finalText,
+						...counted
+					}
+				};
+				yield {
+					type: "done",
+					data: { outcome: { type: "failed" } }
+				};
+				return;
+			}
+			yield {
+				type: "result",
+				data: {
+					success: true,
+					finalText,
+					...counted
+				}
+			};
+			yield {
+				type: "done",
+				data: { outcome: { type: "completed" } }
+			};
+		}
+	};
+}
+function stepReceipt(part, model) {
+	const tokens = part.tokens;
+	if (tokens === void 0 || tokens === null || typeof tokens !== "object") return void 0;
+	const count = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+	const cache = tokens.cache ?? {};
+	const input = count(tokens.input);
+	const output = count(tokens.output);
+	const reasoning = count(tokens.reasoning) ?? 0;
+	const cacheRead = count(cache.read) ?? 0;
+	const cacheWrite = count(cache.write) ?? 0;
+	const known = input !== void 0 && output !== void 0;
+	return {
+		type: "llm_call",
+		...typeof part.id === "string" ? { id: part.id } : {},
+		data: {
+			usageMode: "delta",
+			model,
+			...known ? {
+				tokensIn: input + cacheRead + cacheWrite,
+				tokensOut: output + reasoning,
+				...reasoning > 0 ? { reasoningTokens: reasoning } : {}
+			} : { tokensKnown: false },
+			costKnown: false
+		}
+	};
+}
+function errorMessage(error) {
+	if (typeof error === "string") return error;
+	if (error !== null && typeof error === "object") {
+		const record = error;
+		const data = record.data;
+		const text = typeof data?.message === "string" ? data.message : typeof record.message === "string" ? record.message : typeof record.name === "string" ? record.name : "opencode reported an error";
+		const status = data?.statusCode;
+		return typeof status === "number" && Number.isSafeInteger(status) ? `${text} (status code ${status})` : text;
+	}
+	return "opencode reported an error";
+}
+//#endregion
+export { defaultAnalystInstruction as A, createSandboxPromptBackend as B, defineStrategy as C, sample as D, runAgentic as E, optimizerMethod as F, startOrResumeRuntimeSession as G, InMemoryRuntimeSessionStore as H, strategyAuthorMethod as I, touchSession as K, collectAgentTurn as L, renderReport as M, profileChatClient as N, sampleThenRefine as O, profileOptimizerModelCall as P, streamAgentTurn as R, breadthStrategy as S, refine as T, newRuntimeSession as U, normalizeBackendStreamEvent as V, nowIso as W, sandboxCheckRunner as _, sharedBoxPlacement as a, visibleCheckScore as b, canDisplace as c, defaultExtractCandidate as d, defaultStructuralRolloutPolicy as f, resolveEntrySymbol as g, officialChecksFromMeta as h, isTransientSandboxFailure as i, observe as j, ObservationError as k, compareCheckOutcomes as l, modelAuthoredChecks as m, DEFAULT_SHARED_BOX_WORKERS as n, sharedBoxRefusal as o, filterAuthoredAsserts as p, ROUTER_CLIENT_HEADER as r, sharedWorkerClientName as s, DEFAULT_SHARED_BOX_RESOURCES as t, composeCheckSources as u, selectBestIndex as v, depthStrategy as w, adaptiveRefine as x, structuralRollout as y, createIterableBackend as z };
 
-//# sourceMappingURL=structural-rollout-D-0X6lsU.js.map
+//# sourceMappingURL=shared-box-CZFdugL1.js.map