@tangle-network/agent-runtime 0.283.0 → 0.284.0

package/dist/{runtime-CM3KCe9V.js → runtime-lin_kRwN.js}

@@ -1,16 +1,16 @@
-import { $i as detachedSnapshot, $t as isTraceAnalysisStore, Ai as readCommittedJsonLines, Ca as stringifySafe, Et as rollingDispatch, Gn as probeSandboxCapabilities, Gt as encodeResultBlob, Ht as InMemorySpawnJournal, Ia as armDeadlineTimer, Jn as readPromptOptions, Kt as insideCursorNamespace, M as withDriverExecutor, Mt as createExecutorRegistry, O as verdictFromJudgeScore, Oa as zeroSpend, Pt as createWorktreeCliExecutor, Qi as detachedFrozen, Sa as sleep, Un as runAgentRounds, Ut as SpawnEventIndex, Vn as defaultSelectWinner, Vt as InMemoryResultBlobStore, W as settledToIteration, Wn as createSandboxLineage, Wt as assertContentAddress, Xi as executableAgentProfileSnapshot, Xn as runBrainLoop, Yn as routerBrain, Zi as executableAgentSpecSnapshot, Zn as canonicalObservedModelParts, _ as CheckUnavailableError, cr as createPushTraceSource, ga as cloneSpend, ha as chargedTokens, ji as writeAllBytes, jt as createExecutor, ki as prepareJsonlAppend, kr as contentAddress, ma as addSpend, qn as assertBoxlessPromptOptions, r as createSupervisor, ua as notifySandboxEventObserver, va as hasCompleteCacheBreakdown, xa as randomSuffix, ya as isAbortError } from "./supervisor-YAc4U8HQ.js";
+import { $i as executableAgentSpecSnapshot, $n as canonicalObservedModelParts, $t as isTraceAnalysisStore, Aa as zeroSpend, Ca as randomSuffix, Et as rollingDispatch, Gn as probeSandboxCapabilities, Gt as encodeResultBlob, Ht as InMemorySpawnJournal, Kt as insideCursorNamespace, M as withDriverExecutor, Mi as readCommittedJsonLines, Mt as createExecutorRegistry, Ni as writeAllBytes, O as verdictFromJudgeScore, Pt as createWorktreeCliExecutor, Qi as executableAgentProfileSnapshot, Qn as runBrainLoop, Ra as armDeadlineTimer, Ta as stringifySafe, Un as runAgentRounds, Ut as SpawnEventIndex, Vn as defaultSelectWinner, Vt as InMemoryResultBlobStore, W as settledToIteration, Wn as createSandboxLineage, Wt as assertContentAddress, Xn as readPromptOptions, Yn as assertBoxlessPromptOptions, Zn as routerBrain, _ as CheckUnavailableError, _a as chargedTokens, ba as hasCompleteCacheBreakdown, ea as detachedFrozen, fa as notifySandboxEventObserver, ga as addSpend, ji as prepareJsonlAppend, jr as contentAddress, jt as createExecutor, r as createSupervisor, ta as detachedSnapshot, ur as createPushTraceSource, va as cloneSpend, wa as sleep, xa as isAbortError } from "./supervisor-D4NnNHZd.js";
 import { i as ConfigError, m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
-import { Q as sample, X as refine, Z as runAgentic, c as reconcileInterruptedSearchCalls, ct as strategyAuthorMethod, et as ObservationError, it as profileChatClient, nt as observe, o as dedicatedLane, r as runtimeShipDecision, rt as renderReport, u as searchExecutor } from "./search-method-Dlor0kKQ.js";
+import { Q as sample, X as refine, Z as runAgentic, c as reconcileInterruptedSearchCalls, ct as strategyAuthorMethod, et as ObservationError, it as profileChatClient, nt as observe, o as dedicatedLane, r as runtimeShipDecision, rt as renderReport, u as searchExecutor } from "./search-method-Hjmqa4B8.js";
 import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, t as assertExecutableAgentProfile } from "./model-policy-BbSCSak0.js";
 import { A as sha256Bytes$1, O as immutableCandidateValue, f as WorkspaceScanLimitError, h as captureMaterializedWorkspace, w as canonicalCandidateDigest$1 } from "./workspace-archive-MhowMCmp.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
 import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction-DylCC_ot.js";
-import { S as foldCoordinationRecords, y as createInMemoryRunContext } from "./coordination-driver-BmkANXc5.js";
-import { C as gateOnDeliverable, r as supervise, w as mapExecutorResult } from "./supervise-DL_Hj1uk.js";
+import { S as foldCoordinationRecords, y as createInMemoryRunContext } from "./coordination-driver-BJzVI1oV.js";
+import { C as gateOnDeliverable, r as supervise, w as mapExecutorResult } from "./supervise-C71s4_OJ.js";
 import "./run-layout-vwd4SwX_.js";
-import "./provision-supervisor-BNUmrHwC.js";
-import "./delegate-BfHKdHzV.js";
-import "./graph-XmlRTlaI.js";
+import "./provision-supervisor-CqRp0Rzo.js";
+import "./delegate-CfoEXPam.js";
+import "./graph-RCV6ri8A.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, sha256Bytes, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
@@ -18,7 +18,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { appendFileSync, chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { chmod, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "node:fs/promises";
+import { chmod, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { isDeepStrictEqual, promisify } from "node:util";
 import { redact } from "@tangle-network/agent-eval/traces";
@@ -4959,6 +4959,98 @@ function requireSpend(rolled, id, root) {
 	return spend;
 }
 //#endregion
+//#region src/runtime/private-cas.ts
+const DIGEST = /^sha256:([0-9a-f]{64})$/u;
+const SAFE_NAMESPACE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/u;
+async function realDirectory(path) {
+	const entry = await lstat(path);
+	if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error(`private CAS directory is not a real directory: ${path}`);
+}
+async function checkDirectories(path, create) {
+	const parts = resolve(path).split(sep);
+	let current = sep;
+	for (const part of parts) {
+		if (!part) continue;
+		current = join(current, part);
+		if (create) try {
+			await mkdir(current, { mode: 448 });
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+		}
+		await realDirectory(current);
+	}
+}
+/** Private host-local content-addressed storage scoped to one recorded run identity. */
+function createPrivateCasArtifactPort(root, namespace) {
+	if (!isAbsolute(root)) throw new Error("private CAS root must be absolute");
+	if (!SAFE_NAMESPACE.test(namespace) || namespace === "." || namespace === "..") throw new Error("private CAS namespace must be one safe identifier");
+	const store = join(resolve(root), "sha256");
+	const destination = (digest) => {
+		const match = DIGEST.exec(digest);
+		if (!match) throw new Error("private CAS digest must be sha256:<64 lowercase hex>");
+		return join(store, match[1].slice(0, 2), match[1]);
+	};
+	const port = {
+		async put({ bytes, signal }) {
+			signal?.throwIfAborted();
+			const sha = createHash("sha256").update(bytes).digest("hex");
+			const digest = `sha256:${sha}`;
+			const path = destination(digest);
+			const directory = join(store, sha.slice(0, 2));
+			await checkDirectories(directory, true);
+			const temporary = join(directory, `.${sha}.${randomUUID()}.tmp`);
+			const file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+			try {
+				await file.writeFile(bytes);
+				await file.sync();
+			} finally {
+				await file.close();
+			}
+			try {
+				signal?.throwIfAborted();
+				try {
+					await link(temporary, path);
+				} catch (error) {
+					if (error.code !== "EEXIST") throw error;
+				}
+				const dir = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+				try {
+					await dir.sync();
+				} finally {
+					await dir.close();
+				}
+			} finally {
+				await unlink(temporary).catch(() => void 0);
+			}
+			const ref = {
+				locator: {
+					kind: "private-cas",
+					namespace,
+					digest
+				},
+				sha256: digest,
+				byteLength: bytes.byteLength
+			};
+			await port.read(ref);
+			return ref;
+		},
+		async read(ref) {
+			if (ref.locator.kind !== "private-cas" || ref.locator.namespace !== namespace || ref.locator.digest !== ref.sha256) throw new Error("private CAS locator does not match its digest and namespace");
+			const path = destination(ref.sha256);
+			await checkDirectories(join(store, DIGEST.exec(ref.sha256)[1].slice(0, 2)), false);
+			const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+			try {
+				const bytes = await file.readFile();
+				if (`sha256:${createHash("sha256").update(bytes).digest("hex")}` !== ref.sha256 || bytes.byteLength !== ref.byteLength) throw new Error("private CAS object failed digest or length verification");
+				return bytes;
+			} finally {
+				await file.close();
+			}
+		}
+	};
+	return port;
+}
+//#endregion
 //#region src/runtime/run-benchmark.ts
 /**
 * runBenchmark — the packaged optimization suite. Define a domain by implementing an
@@ -8305,6 +8397,6 @@ function tail(s) {
 	return s.slice(-400);
 }
 //#endregion
-export { renderCorpusToInstructions as $, resolveMcpServerLaunch as $t, unsafeInProcessRunner as A, completionAuthorizes as At, SandboxRunAbortError as B, auditIntent as Bt, withUntrackedArtifacts as C, assertDeclaredCheck as Ct, patchDelivered as D, declaredCheckJudge as Dt, createSqlRunContext as E, declaredCheckDigest as Et, strategyTournament as F, pairwiseSignificance as Ft, trajectoryReport as G, SqlSpawnJournal as Gt, printBenchmarkReport as H, SqlRunOwnershipError as Ht, assertStrategyContract as I, renderLeaderboardHtml as It, builtinShapes as J, materializeLocalMcp as Jt, definePersona as K, McpSpawnFault as Kt, authorStrategy as L, renderLeaderboardMarkdown as Lt, chatWorkerSeam as M, sentinelCompletion as Mt, createChatSessionStore as N, stopSentinel as Nt, runCoderChecks as O, readDeclaredCheck as Ot, runStrategyEvolution as P, leaderboard as Pt, InMemoryCorpus as Q, mcpSecretEnvMetadataKey as Qt, strategyAuthorContract as R, renderLeaderboardSvg as Rt, copyUntrackedIntoClone as S, superviseDispatch as St, createFencedSqlRunContext as T, declaredCheckDeliverable as Tt, runBenchmark as U, openSqlRunStore as Ut, openSandboxRun as V, defaultAuditorInstruction as Vt, equalKOnCost as W, SqlResultBlobStore as Wt, registerShape as X, sanitizeMcpToolSchema as Xt, createShapeRegistry as Y, createMcpEnvironment as Yt, FileCorpus as Z, envKeyProvider as Zt, NOTE_MAX_CHARS as _, resolveSandboxClient as _t, localShell as a, selectValidWinner as at, composeWorkerEvidence as b, loopCampaignDispatch as bt, createVerifierEnvironment as c, assertTraceDerivedFindings as ct, harvestSurfaceDiffs as d, registryScopeAnalyst as dt, resolveSecretEnv as en, fanout as et, analystsFromRegistry as f, observationFromRegistry as ft, EVIDENCE_MAX_CHARS as g, defineLeaderboard as gt, worktreeFanout as h, harvestCorpus as ht, jjWorkspace as i, pipeline as it, chatTransportExecutor as j, deterministicCompletion as jt, codeModeSupervisorTools as k, runIsolatedCheck as kt, boxSurfaceReader as l, buildSteerContext as lt, superviseSurface as m, HarvestError as mt, makeFinding$1 as n, createTangleSandboxExactProcessProvider as nn, loopUntil as nt, runInWorkspace as o, verify as ot, failuresAnalyst as p, inProcessSandboxClient as pt, runPersonified as q, connectStdioMcp as qt, gitWorkspace as r, panel as rt, createWaterfallCollector as s, widen as st, computeFindingId$1 as t, secretEnvOfMcpServer as tn, flatWidenGate as tt, fsSurfaceReader as u, createScopeAnalyst as ut, VERIFY_TAIL_CHARS as v, localSandboxClient as vt, analyzeTrace as w, checkProgramDigest as wt, settledWorkerOut as x, loopDispatch as xt, closingWorkerNote as y, inlineSandboxClient as yt, strategyAuthorSystemPrompt as z, renderPairwiseMarkdown as zt };
+export { InMemoryCorpus as $, mcpSecretEnvMetadataKey as $t, unsafeInProcessRunner as A, runIsolatedCheck as At, SandboxRunAbortError as B, renderPairwiseMarkdown as Bt, withUntrackedArtifacts as C, superviseDispatch as Ct, patchDelivered as D, declaredCheckDigest as Dt, createSqlRunContext as E, declaredCheckDeliverable as Et, strategyTournament as F, leaderboard as Ft, equalKOnCost as G, SqlResultBlobStore as Gt, printBenchmarkReport as H, defaultAuditorInstruction as Ht, assertStrategyContract as I, pairwiseSignificance as It, runPersonified as J, connectStdioMcp as Jt, trajectoryReport as K, SqlSpawnJournal as Kt, authorStrategy as L, renderLeaderboardHtml as Lt, chatWorkerSeam as M, deterministicCompletion as Mt, createChatSessionStore as N, sentinelCompletion as Nt, runCoderChecks as O, declaredCheckJudge as Ot, runStrategyEvolution as P, stopSentinel as Pt, FileCorpus as Q, envKeyProvider as Qt, strategyAuthorContract as R, renderLeaderboardMarkdown as Rt, copyUntrackedIntoClone as S, loopDispatch as St, createFencedSqlRunContext as T, checkProgramDigest as Tt, runBenchmark as U, SqlRunOwnershipError as Ut, openSandboxRun as V, auditIntent as Vt, createPrivateCasArtifactPort as W, openSqlRunStore as Wt, createShapeRegistry as X, createMcpEnvironment as Xt, builtinShapes as Y, materializeLocalMcp as Yt, registerShape as Z, sanitizeMcpToolSchema as Zt, NOTE_MAX_CHARS as _, defineLeaderboard as _t, localShell as a, pipeline as at, composeWorkerEvidence as b, inlineSandboxClient as bt, createVerifierEnvironment as c, widen as ct, harvestSurfaceDiffs as d, createScopeAnalyst as dt, resolveMcpServerLaunch as en, renderCorpusToInstructions as et, analystsFromRegistry as f, registryScopeAnalyst as ft, EVIDENCE_MAX_CHARS as g, harvestCorpus as gt, worktreeFanout as h, HarvestError as ht, jjWorkspace as i, panel as it, chatTransportExecutor as j, completionAuthorizes as jt, codeModeSupervisorTools as k, readDeclaredCheck as kt, boxSurfaceReader as l, assertTraceDerivedFindings as lt, superviseSurface as m, inProcessSandboxClient as mt, makeFinding$1 as n, secretEnvOfMcpServer as nn, flatWidenGate as nt, runInWorkspace as o, selectValidWinner as ot, failuresAnalyst as p, observationFromRegistry as pt, definePersona as q, McpSpawnFault as qt, gitWorkspace as r, createTangleSandboxExactProcessProvider as rn, loopUntil as rt, createWaterfallCollector as s, verify as st, computeFindingId$1 as t, resolveSecretEnv as tn, fanout as tt, fsSurfaceReader as u, buildSteerContext as ut, VERIFY_TAIL_CHARS as v, resolveSandboxClient as vt, analyzeTrace as w, assertDeclaredCheck as wt, settledWorkerOut as x, loopCampaignDispatch as xt, closingWorkerNote as y, localSandboxClient as yt, strategyAuthorSystemPrompt as z, renderLeaderboardSvg as zt };
 
-//# sourceMappingURL=runtime-CM3KCe9V.js.map
+//# sourceMappingURL=runtime-lin_kRwN.js.map