@tangle-network/agent-runtime 0.289.1 → 0.290.1

package/dist/{supervisor-CSLiRg5R.js → supervisor-CQFcQhlo.js}

@@ -3,7 +3,7 @@ import { a as concreteProfileModel, c as profileModelExecutionSettings, d as age
 import { S as verifyWorkspaceSnapshotArtifacts, i as verifyAgentCandidateWorkspaceArchive } from "./workspace-archive-MhowMCmp.js";
 import { n as assertNoSymlinkDescendant, r as publishExclusiveDurableFile } from "./durable-file-DWQA4ooo.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
-import { AGENT_PROFILE_MATERIALIZATION_AXES, AgentEnvironmentCapabilitiesSchema, AgentExactRunControlRefSchema, AgentInteractiveSessionControlClaimAcknowledgementSchema, AgentInteractiveSessionControlClaimSchema, AgentInteractiveSessionPromptAcknowledgementSchema, AgentInteractiveSessionRefSchema, AgentInteractiveSessionStartSchema, AgentInteractiveSessionStatusSchema, AgentInteractiveSessionStopAcknowledgementSchema, AgentNativeContextContinuationResultSchema, AgentRunCancellationAcknowledgementSchema, AgentRunCancellationRequestSchema, AgentTurnInputSchema, AgentTurnResultSchema, CanonicalStreamEventSchema, ContextTransferRequestSchema, InteractionAcknowledgementSchema, InteractionResponseCommandSchema, NativeContextBoundaryProofSchema, NativeContextContinuationRequestSchema, REASONING_EFFORTS, RuntimeEventEnvelopeSchema, TerminalReplayWindowSchema, TerminalSessionRefSchema, WorkspaceRequestSchema, agentCandidateWorkspaceSnapshotEvidenceSchema, agentInteractiveSessionControlClaimAcknowledgementMatchesRequest, agentInteractiveSessionControlClaimMatchesRef, agentInteractiveSessionPromptAcknowledgementMatchesCommand, agentInteractiveSessionRefMatchesStart, agentInteractiveSessionRunRef, agentInteractiveSessionStatusMatchesRef, agentInteractiveSessionStopAcknowledgementMatchesCommand, agentNativeContextContinuationResultMatchesRequest, agentProfileSchema, agentRunCancellationAcknowledgementMatchesRequest, agentRunCancellationRequestDigest, canonicalAgentProfileDigest, canonicalCandidateDigest, canonicalWorkspaceCwd, exactAgentInteractiveSessionStart, harnessSystemPromptIntents, harnessTypeSchema, nativeContextContinuationTurnDigest, nativeReasoningControl, profileMaterializationAxes, profileMaterializationAxes as profileMaterializationAxes$1, renderInputPartsAsText, sha256DigestSchema, workspaceCheckpointRequestDigest, workspaceCheckpointResultMatchesRequest, workspaceCleanupAcknowledgementMatches, workspaceCleanupRequestDigest, workspaceCwdPathForBase } from "@tangle-network/agent-interface";
+import { AGENT_PROFILE_MATERIALIZATION_AXES, AgentEnvironmentCapabilitiesSchema, AgentExactRunControlRefSchema, AgentInteractiveSessionControlClaimAcknowledgementSchema, AgentInteractiveSessionControlClaimSchema, AgentInteractiveSessionPromptAcknowledgementSchema, AgentInteractiveSessionRefSchema, AgentInteractiveSessionStatusSchema, AgentInteractiveSessionStopAcknowledgementSchema, AgentNativeContextContinuationResultSchema, AgentRunCancellationAcknowledgementSchema, AgentRunCancellationRequestSchema, AgentTurnInputSchema, AgentTurnResultSchema, CanonicalStreamEventSchema, ContextTransferRequestSchema, InteractionAcknowledgementSchema, InteractionResponseCommandSchema, NativeContextBoundaryProofSchema, NativeContextContinuationRequestSchema, REASONING_EFFORTS, RuntimeEventEnvelopeSchema, TerminalReplayWindowSchema, TerminalSessionRefSchema, agentCandidateWorkspaceSnapshotEvidenceSchema, agentInteractiveSessionControlClaimAcknowledgementMatchesRequest, agentInteractiveSessionControlClaimMatchesRef, agentInteractiveSessionPromptAcknowledgementMatchesCommand, agentInteractiveSessionRefMatchesStart, agentInteractiveSessionRunRef, agentInteractiveSessionStatusMatchesRef, agentInteractiveSessionStopAcknowledgementMatchesCommand, agentNativeContextContinuationResultMatchesRequest, agentProfileSchema, agentRunCancellationAcknowledgementMatchesRequest, agentRunCancellationRequestDigest, canonicalAgentProfileDigest, canonicalCandidateDigest, canonicalWorkspaceCwd, exactAgentInteractiveSessionStart, harnessTypeSchema, nativeContextContinuationTurnDigest, nativeReasoningControl, profileMaterializationAxes, profileMaterializationAxes as profileMaterializationAxes$1, renderInputPartsAsText, sha256DigestSchema, workspaceCheckpointRequestDigest, workspaceCheckpointResultMatchesRequest, workspaceCleanupAcknowledgementMatches, workspaceCleanupRequestDigest } from "@tangle-network/agent-interface";
 import { estimateCost, isModelPriced, isToolSpan, toolSpansToTraceAnalysisStore } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -16,6 +16,7 @@ import { homedir, hostname, tmpdir } from "node:os";
 import { stripVTControlCharacters } from "node:util";
 import { ATTR, deriveHexId, isW3CSpanId, isW3CTraceId } from "@tangle-network/agent-trace-contract";
 import { REDACTION_VERSION as REDACTION_VERSION$1, redact } from "@tangle-network/agent-eval/traces";
+import { z } from "zod";
 import { SDKError, generateIdempotencyKey, withRetry } from "@tangle-network/agent-core";
 import { collectAgentFinalMessageText, collectAgentResponseText } from "@tangle-network/sandbox";
 import { request } from "node:http";
@@ -8578,7 +8579,10 @@ function describeLeakedReservation(leak) {
 const outcomeSchema = AgentTurnResultSchema.pick({
 	success: true,
 	error: true
-}).extend({ errorCode: AgentTurnResultSchema.shape.error }).strict();
+}).extend({
+	errorCode: AgentTurnResultSchema.shape.error,
+	statusCode: z.number().int().min(400).max(599).optional()
+}).strict();
 /** Read only the executor envelope; application output and grades are not execution status. */
 function executorFailure(result) {
 	if (result.outcome === void 0) return void 0;
@@ -8586,7 +8590,8 @@ function executorFailure(result) {
 	if (outcome.success) return void 0;
 	return {
 		error: outcome.error ?? "Agent execution failed",
-		...outcome.errorCode === void 0 ? {} : { errorCode: outcome.errorCode }
+		...outcome.errorCode === void 0 ? {} : { errorCode: outcome.errorCode },
+		...outcome.statusCode === void 0 ? {} : { statusCode: outcome.statusCode }
 	};
 }
 /** The failure text alone, for callers that record a settlement reason. */
@@ -10271,11 +10276,12 @@ function unavailableSignalInText(text) {
 /**
 * The code or status that marks a failed turn outcome as an upstream capacity refusal, or
 * `undefined`. The outcome's own `errorCode` decides first; the failure text is read only when no
-* code decided, because a harness CLI reports the router's refusal as text.
+* code or numeric status decided, because a harness CLI can report the router's refusal as text.
 */
 function unavailableSignalOfFailure(failure) {
 	const code = failure.errorCode?.toLowerCase();
 	if (code !== void 0 && UNAVAILABLE_CODES.has(code)) return code;
+	if (failure.statusCode !== void 0) return UNAVAILABLE_STATUSES.has(failure.statusCode) ? `http-${failure.statusCode}` : void 0;
 	return unavailableSignalInText(failure.error);
 }
 const DEFAULT_UNAVAILABLE_PAUSE_MS = 15e3;
@@ -10425,75 +10431,6 @@ function providerAsSandboxClient(provider, options = {}) {
 		});
 	} };
 }
-/**
-* The idle timeout this adapter sends when nothing else names one: 1,800 seconds.
-*
-* Sandbox substitutes no value of its own: an omitted field falls back to the platform's global
-* idle timeout, documented as 30 minutes unless an operator changed it, and Runtime sent none. Idle
-* means inactivity to Sandbox, which suspends the sandbox (the container stops; the workspace is
-* kept) rather than deleting it. The SDK does not define inactivity further. A request in flight
-* counts as activity: a Discovery Lab seat created with `idleTimeoutSeconds: 1800` ran one request
-* to 2,252 seconds, ended by a per-request cap, not by idling (fleet-launch-2026-08-22).
-*
-* The value restates the documented default, so it can tighten a longer operator setting but never
-* loosen the default. It is 3.8 times the longest gap between frames recorded across a healthy
-* fleet run (469 seconds, same report), and a supervised provider child is observed through an open
-* stream for its whole turn. It is a backstop for a process that dies holding an environment; the
-* settlement barrier releases retained environments itself (`Executor.releaseRetained`). It does
-* nothing on a driver with a create/delete-only lifecycle, which the SDK says skips suspension.
-*/
-const DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS = 1800;
-function sandboxIdleTimeoutSeconds(value) {
-	if (value === void 0) return DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS;
-	if (!Number.isSafeInteger(value) || value <= 0) throw new ValidationError(`sandboxClientAsProvider: idleTimeoutSeconds must be a positive whole number of seconds, got ${String(value)}`);
-	return value;
-}
-/**
-* Adapt a `SandboxClient` into the shared `AgentEnvironmentProvider` contract.
-* The provider declares the public SDK contract before it creates an environment.
-* Each environment exposes interactive methods only when its deployment declares every required capability.
-* @experimental */
-function sandboxClientAsProvider(client, options = {}) {
-	const providerName = options.name ?? "tangle-sandbox";
-	const idleTimeoutSeconds = sandboxIdleTimeoutSeconds(options.idleTimeoutSeconds);
-	const providerCapabilities = async () => {
-		const resolved = await (options.capabilities ? typeof options.capabilities === "function" ? options.capabilities() : options.capabilities : defaultTangleSandboxCapabilities({
-			namedProfiles: options.resolveProfile !== void 0,
-			rediscover: hasGet(client)
-		}));
-		if (hasGet(client)) return resolved;
-		const { interactiveAgent: _interactiveAgent, ...withoutInteractive } = resolved;
-		return withoutInteractive;
-	};
-	return {
-		name: providerName,
-		capabilities: providerCapabilities,
-		...options.validateProfile ? { validateProfile: options.validateProfile } : {},
-		async create(input) {
-			const custom = options.mapCreateInput?.(input);
-			const createOptions = custom === void 0 ? await sandboxOptionsFromCreateInput(input, options.defaultBackend ?? "opencode", options.resolveProfile, providerName, idleTimeoutSeconds) : {
-				...custom,
-				idleTimeoutSeconds: custom.idleTimeoutSeconds ?? idleTimeoutSeconds
-			};
-			const capabilities = await providerCapabilities();
-			return sandboxInstanceAsEnvironment(await client.create(createOptions, input.signal === void 0 ? void 0 : { signal: input.signal }), providerName, client, capabilities, idleTimeoutSeconds);
-		},
-		...hasGet(client) ? { async get(id) {
-			const capabilities = await providerCapabilities();
-			const box = await client.get(id);
-			return box ? sandboxInstanceAsEnvironment(box, providerName, client, capabilities, idleTimeoutSeconds) : null;
-		} } : {},
-		...hasList(client) ? { async list(query) {
-			return (await client.list(query?.providerOptions)).map((box) => ({
-				id: String(box.id),
-				provider: providerName,
-				name: typeof box.name === "string" ? box.name : void 0,
-				status: statusFromUnknown(readBoxStatus(box)),
-				metadata: readBoxMetadata(box)
-			}));
-		} } : {}
-	};
-}
 /** Only a verified, single-session capture may supply a scalar session identity. */
 function capturedSessionIdentity(provenance, coverageComplete, executionId, providerSessionId) {
 	const unknown = {
@@ -11177,7 +11114,8 @@ async function* streamProviderExecutor(args) {
 			...result.outcome?.status === "failed" ? { outcome: {
 				success: false,
 				...result.outcome.error ? { error: result.outcome.error } : {},
-				...result.outcome.errorCode ? { errorCode: result.outcome.errorCode } : {}
+				...result.outcome.errorCode ? { errorCode: result.outcome.errorCode } : {},
+				...failureStatusCode(result.outcome) === void 0 ? {} : { statusCode: failureStatusCode(result.outcome) }
 			} } : {},
 			outRef: contentRef(`provider:${args.provider.name}`, settledResult),
 			out: settledResult,
@@ -11186,7 +11124,8 @@ async function* streamProviderExecutor(args) {
 		};
 		const refusal = args.mayContinue && source.retained && result.outcome?.status === "failed" ? unavailableSignalOfFailure({
 			error: result.outcome.error ?? "",
-			...result.outcome.errorCode ? { errorCode: result.outcome.errorCode } : {}
+			...result.outcome.errorCode ? { errorCode: result.outcome.errorCode } : {},
+			...failureStatusCode(result.outcome) === void 0 ? {} : { statusCode: failureStatusCode(result.outcome) }
 		}) : void 0;
 		if (refusal !== void 0) unavailable = {
 			signal: refusal,
@@ -11567,52 +11506,6 @@ function createInputFromSandboxOptions(options) {
 		providerOptions: { sandboxCreateOptions: options ?? {} }
 	};
 }
-async function sandboxOptionsFromCreateInput(input, defaultBackend, resolveProfile, providerName = "tangle-sandbox", idleTimeoutSeconds = DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS) {
-	if (input.runtimeAttachments !== void 0) throw new ValidationError("Tangle Sandbox runtimeAttachments require an explicit mapCreateInput mapper; the maintained Sandbox SDK create contract does not transport them");
-	const backendType = input.backend ?? defaultBackend;
-	const workspace = WorkspaceRequestSchema.parse(input.workspace ?? {});
-	const environment = sandboxEnvironmentFromWorkspace(workspace);
-	const cwd = workspaceCwdPathForBase(workspace.cwd, "repository", providerName);
-	const providerOptions = input.providerOptions?.sandboxCreateOptions;
-	const base = providerOptions && typeof providerOptions === "object" ? { ...providerOptions } : {};
-	assertSandboxSecretNames(input.secrets);
-	assertSandboxSecretNames(base.secrets);
-	const profile = await sandboxProfileFromReference(input.profile, resolveProfile);
-	const { profile: _baseProfile, ...baseBackend } = base.backend ?? {};
-	return {
-		...base,
-		idleTimeoutSeconds: base.idleTimeoutSeconds ?? idleTimeoutSeconds,
-		...environment ? { environment } : {},
-		...workspace.repoUrl ? { git: {
-			url: workspace.repoUrl,
-			ref: workspace.gitRef
-		} } : {},
-		...cwd === void 0 ? {} : { cwd },
-		...input.resources ? { resources: input.resources } : {},
-		...input.env ? { env: input.env } : {},
-		...Array.isArray(input.secrets) ? { secrets: input.secrets } : {},
-		...input.metadata ? { metadata: input.metadata } : {},
-		...input.name ? { name: input.name } : {},
-		...input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {},
-		backend: {
-			...baseBackend,
-			type: backendType,
-			profile
-		}
-	};
-}
-function assertSandboxSecretNames(secrets) {
-	if (secrets !== void 0 && secrets !== "all" && (!Array.isArray(secrets) || secrets.some((secret) => typeof secret !== "string" || secret.trim().length === 0))) throw new ValidationError("Tangle Sandbox secret names must be non-empty strings; secret values are unsupported");
-}
-function sandboxEnvironmentFromWorkspace(workspace) {
-	if (workspace.environment !== void 0 && workspace.image !== void 0 && workspace.environment !== workspace.image) throw new ValidationError("Tangle Sandbox accepts one environment value; workspace.environment and workspace.image must match");
-	return workspace.environment ?? workspace.image;
-}
-async function sandboxProfileFromReference(profile, resolveProfile) {
-	if (typeof profile !== "string") return profile;
-	if (!resolveProfile) throw new ValidationError(`Tangle Sandbox requires an inline AgentProfile; named profile "${profile}" needs SandboxClientProviderOptions.resolveProfile`);
-	return resolveProfile(profile);
-}
 function environmentAsSandboxInstance(environment, options) {
 	let providerSessionId = null;
 	let controlRef;
@@ -11784,147 +11677,6 @@ function environmentAsSandboxInstance(environment, options) {
 		}
 	};
 }
-async function sandboxInstanceAsEnvironment(box, providerName, client, providerCapabilities, idleTimeoutSeconds) {
-	const capabilities = await sandboxEnvironmentCapabilities(box, providerCapabilities);
-	const interactiveAgent = capabilities.interactiveAgent;
-	return {
-		id: String(box.id),
-		provider: providerName,
-		capabilities,
-		...typeof box.name === "string" ? { name: box.name } : {},
-		...readBoxMetadata(box) ? { metadata: readBoxMetadata(box) } : {},
-		async status() {
-			await maybeRefresh(box);
-			return statusFromUnknown(readBoxStatus(box));
-		},
-		async *stream(input) {
-			for await (const event of box.streamPrompt(promptFromAgentTurnInput(input), promptOptionsFromAgentTurnInput(input))) yield environmentEventFromSandboxEvent(event);
-		},
-		...hasDispatchPrompt(box) ? { async dispatch(input) {
-			return sessionRefFromSandboxDispatch(await box.dispatchPrompt(promptFromAgentTurnInput(input), promptOptionsFromAgentTurnInput(input)), providerName);
-		} } : {},
-		...hasSession(box) ? {
-			session(id, sessionOptions) {
-				return sandboxSessionAsAgentSession(box.session(id), sessionOptions?.controlRef);
-			},
-			async respondToInteraction(command, options) {
-				return (await box.session(command.binding.sessionId).respondToInteraction(command, options)).acknowledgement;
-			}
-		} : {},
-		...interactiveAgent ? {
-			async startInteractive(request, options) {
-				const exactRequest = AgentInteractiveSessionStartSchema.parse(request);
-				assertSandboxInteractiveBinding(exactRequest.run, box, providerName);
-				const result = await box.session(exactRequest.run.sessionId).interactive().start(exactRequest, options);
-				if (result.state !== "running") throw new ValidationError("sandbox interactive process settled before attachment");
-				const ref = detachedSnapshot(AgentInteractiveSessionRefSchema.parse(result.ref), "sandbox interactive start reference");
-				if (!agentInteractiveSessionRefMatchesStart(exactRequest, ref)) throw new ValidationError("sandbox interactive start returned a different exact process");
-				return ref;
-			},
-			interactive(ref) {
-				const exactRef = detachedSnapshot(AgentInteractiveSessionRefSchema.parse(ref), "sandbox interactive reference");
-				assertSandboxInteractiveBinding(exactRef.run, box, providerName);
-				const session = box.session(exactRef.run.sessionId).interactive({ ref: exactRef });
-				const controlledSessions = /* @__PURE__ */ new Map();
-				const controlledSession = (control) => {
-					const key = canonicalCandidateDigest(control);
-					const existing = controlledSessions.get(key);
-					if (existing) return existing;
-					const created = box.session(exactRef.run.sessionId).interactive({
-						ref: exactRef,
-						control
-					});
-					controlledSessions.set(key, created);
-					return created;
-				};
-				return {
-					ref: exactRef,
-					claimControl: (request, options) => session.claimControl(request, options),
-					async status(options) {
-						const status = await session.status(options);
-						if (status === null) throw new ValidationError(`sandbox interactive session "${exactRef.run.sessionId}" is unavailable`);
-						return status;
-					},
-					attach: (request, options) => {
-						const controlled = controlledSession(request.control);
-						if (typeof controlled.attachAgentTerminal !== "function") return Promise.reject(new ValidationError("sandbox interactive session does not expose the exact terminal adapter"));
-						return controlled.attachAgentTerminal(request, options);
-					},
-					sendPrompt: (command, options) => controlledSession(command.control).sendPrompt(command, options),
-					stop: (command, options) => controlledSession(command.control).stop(command, options)
-				};
-			}
-		} : {},
-		...hasRead(box) ? { read: box.read.bind(box) } : {},
-		...hasWrite(box) ? { write: box.write.bind(box) } : {},
-		...hasExec(box) ? { async exec(command, options) {
-			return execResultFromSandboxExecResult(await box.exec(command, options));
-		} } : {},
-		async checkpoint(options) {
-			return {
-				id: (await box.snapshot({ ...options?.name ? { tags: [options.name] } : {} })).snapshotId,
-				provider: providerName,
-				...options?.metadata ? { metadata: options.metadata } : {}
-			};
-		},
-		async fork(checkpoint, options) {
-			return sandboxInstanceAsEnvironment(await client.create({
-				fromSnapshot: checkpoint.id,
-				fromSandboxId: String(box.id),
-				idleTimeoutSeconds,
-				...options?.name ? { name: options.name } : {},
-				...options?.metadata ? { metadata: options.metadata } : {}
-			}), providerName, client, providerCapabilities, idleTimeoutSeconds);
-		},
-		async placement() {
-			return placementInfoFromLoopPlacement(client.describePlacement?.(box), box);
-		},
-		async refresh() {
-			await maybeRefresh(box);
-		},
-		async destroy() {
-			await destroyBox(box);
-		}
-	};
-}
-function sandboxSessionAsAgentSession(session, expectedControlRef) {
-	const controlRef = resolveSessionControlRef(session.controlRef, expectedControlRef, { allowExpectedWhenActualAbsent: true });
-	return {
-		id: session.id,
-		...controlRef === void 0 ? {} : { controlRef },
-		async status() {
-			const status = await session.status();
-			if (!status) return null;
-			assertSandboxStatusBinding(status, controlRef);
-			return sessionStatusFromUnknown(status.status);
-		},
-		async *events(options) {
-			const executionId = scopedExecutionId(controlRef, options?.executionId);
-			for await (const event of session.events({
-				...options?.since === void 0 ? {} : { since: options.since },
-				...executionId === void 0 ? {} : { executionId },
-				...options?.signal === void 0 ? {} : { signal: options.signal }
-			})) yield environmentEventFromSandboxEvent(event);
-		},
-		async result(options) {
-			return agentTurnResultFromPromptResult(await awaitAbortable$1(Promise.resolve().then(() => session.result({ ...controlRef?.executionId === void 0 ? {} : { executionId: controlRef.executionId } })), options?.signal));
-		},
-		async prompt(input) {
-			return agentTurnResultFromPromptResult(await session.prompt(promptFromAgentTurnInput(input), promptOptionsFromAgentTurnInput(input)));
-		},
-		...session.respondToInteraction ? { async respondToInteraction(command, options) {
-			assertInteractionCommandScope(command, controlRef);
-			return (await session.respondToInteraction(command, options)).acknowledgement;
-		} } : {},
-		...session.cancelRun ? { async cancelRun(request, options) {
-			assertCancellationScope(request, controlRef);
-			return session.cancelRun(request, options);
-		} } : {},
-		cancel() {
-			return session.interrupt(controlRef?.executionId === void 0 ? void 0 : { executionId: controlRef.executionId }).then(() => void 0);
-		}
-	};
-}
 function sandboxSessionFromAgentSession(session, expectedControlRef) {
 	if (!session) throw new ValidationError("providerAsSandboxClient: session is unavailable");
 	const controlRef = resolveSessionControlRef(session.controlRef, expectedControlRef);
@@ -11998,20 +11750,6 @@ function promptResultFromAgentTurnResult(result) {
 		} : {}
 	};
 }
-function environmentEventFromSandboxEvent(event) {
-	const data = event.data && typeof event.data === "object" ? event.data : {};
-	const normalized = canonicalStreamEventFromSandboxEvent(event);
-	const usage = tokenUsageFromData(data);
-	const receipt = tokenUsageReceipt(tokenUsageRecord(data));
-	return {
-		type: String(event.type),
-		data,
-		...event.id ? { id: event.id } : {},
-		...normalized ? { normalized } : {},
-		...usage && receipt.complete ? { usage } : {},
-		providerEvent: event
-	};
-}
 function sandboxEventFromEnvironmentEvent(event) {
 	const normalized = event.normalized;
 	const type = normalized?.type ?? event.type;
@@ -12073,12 +11811,14 @@ function providerFailureEvent(event, sandboxEvent) {
 	if (!failedStatus && !failedTerminal) return void 0;
 	const detail = failureDetail(sandboxEvent.data) ?? failureDetail(outcome) ?? failureDetail(result) ?? (normalized?.type === "status" ? normalized.detail : void 0);
 	const errorCode = failureCode(sandboxEvent.data) ?? failureCode(outcome) ?? failureCode(result);
+	const statusCode = failureStatusCode(sandboxEvent.data) ?? failureStatusCode(outcome) ?? failureStatusCode(result);
 	return {
 		type: "result",
 		data: {
 			status: "failed",
 			...detail ? { error: detail } : {},
-			...errorCode ? { errorCode } : {}
+			...errorCode ? { errorCode } : {},
+			...statusCode === void 0 ? {} : { statusCode }
 		}
 	};
 }
@@ -12167,6 +11907,11 @@ function failureDetail(value) {
 	if (typeof value.message === "string") return value.message;
 	return typeof value.detail === "string" ? value.detail : void 0;
 }
+/** Preserve the Sandbox outcome's numeric HTTP metadata across the provider adapter. */
+function failureStatusCode(value) {
+	const statusCode = recordValue(value)?.statusCode;
+	return typeof statusCode === "number" && Number.isInteger(statusCode) && statusCode >= 400 && statusCode <= 599 ? statusCode : void 0;
+}
 function failureCode(value) {
 	if (!value) return void 0;
 	const error = recordValue(value.error);
@@ -12238,17 +11983,6 @@ function resolveSessionControlRef(actual, expected, options = {}) {
 	if (!sameControlCoordinates(actualExact.data, expectedExact)) throw new ValidationError("provider session returned a different exact run control reference");
 	return actualExact.data;
 }
-function assertSandboxStatusBinding(status, controlRef) {
-	if (!status || typeof status !== "object" || controlRef === void 0) return;
-	const record = status;
-	if (record.runControlRef !== void 0) {
-		if (!sameControlCoordinates(AgentExactRunControlRefSchema.parse(record.runControlRef), controlRef)) throw new ValidationError("sandbox status returned a different exact run control reference");
-	}
-	for (const key of ["activeExecutionId", "latestExecutionId"]) {
-		const executionId = record[key];
-		if (executionId !== void 0 && executionId !== controlRef.executionId) throw new ValidationError("sandbox status returned a different execution");
-	}
-}
 function assertInteractionCommandScope(command, controlRef) {
 	if (controlRef === void 0) return;
 	if (command.binding.runId !== controlRef.runId || command.binding.environmentId !== controlRef.environmentId || command.binding.sessionId !== controlRef.sessionId || command.binding.executionId !== controlRef.executionId) throw new ValidationError("interaction response targeted a different execution");
@@ -12386,50 +12120,6 @@ function isUsageType(type) {
 function isNestedUsageType(type) {
 	return isSandboxTerminalEvent(type) && sandboxTerminalUsageField(type) === "usage";
 }
-function tokenUsageFromData(data) {
-	const usageRecord = tokenUsageRecord(data);
-	const inputTokens = inputTokensFromUsage(usageRecord);
-	const outputTokens = outputTokensFromUsage(usageRecord);
-	const totalTokens = finiteNumber(usageRecord.totalTokens);
-	const cacheReadInputTokens = finiteNumber(usageRecord.cacheReadInputTokens);
-	const cacheCreationInputTokens = finiteNumber(usageRecord.cacheCreationInputTokens);
-	const reasoningTokens = finiteNumber(usageRecord.reasoningTokens);
-	const cost = finiteNumber(usageRecord.cost) ?? finiteNumber(usageRecord.costUsd) ?? finiteNumber(usageRecord.totalCostUsd) ?? finiteNumber(data.costUsd) ?? finiteNumber(data.totalCostUsd);
-	if (inputTokens === void 0 && outputTokens === void 0 && totalTokens === void 0 && cacheReadInputTokens === void 0 && cacheCreationInputTokens === void 0 && reasoningTokens === void 0 && cost === void 0) return void 0;
-	return {
-		inputTokens: inputTokens ?? 0,
-		outputTokens: outputTokens ?? 0,
-		...totalTokens !== void 0 ? { totalTokens } : {},
-		...cacheReadInputTokens !== void 0 ? { cacheReadInputTokens } : {},
-		...cacheCreationInputTokens !== void 0 ? { cacheCreationInputTokens } : {},
-		...reasoningTokens !== void 0 ? { reasoningTokens } : {},
-		...cost !== void 0 ? { cost } : {}
-	};
-}
-function tokenUsageRecord(data) {
-	return recordValue(data.usage) ?? recordValue(data.tokenUsage) ?? data;
-}
-function inputTokensFromUsage(value) {
-	const usage = recordValue(value);
-	if (!usage) return void 0;
-	return finiteNumber(usage.inputTokens) ?? finiteNumber(usage.tokensIn) ?? finiteNumber(usage.prompt_tokens);
-}
-function outputTokensFromUsage(value) {
-	const usage = recordValue(value);
-	if (!usage) return void 0;
-	return finiteNumber(usage.outputTokens) ?? finiteNumber(usage.tokensOut) ?? finiteNumber(usage.completion_tokens);
-}
-function tokenUsageReceipt(value) {
-	const usage = recordValue(value);
-	const hasInput = inputTokensFromUsage(usage) !== void 0;
-	const hasOutput = outputTokensFromUsage(usage) !== void 0;
-	return {
-		hasInput,
-		hasOutput,
-		hasTokens: hasInput || hasOutput || finiteNumber(usage?.totalTokens) !== void 0 || finiteNumber(usage?.cacheReadInputTokens) !== void 0 || finiteNumber(usage?.cacheCreationInputTokens) !== void 0 || finiteNumber(usage?.reasoningTokens) !== void 0,
-		complete: hasInput && hasOutput
-	};
-}
 function mergeTokenUsage(left, right) {
 	if (!left) return right;
 	if (!right) return left;
@@ -12443,21 +12133,9 @@ function mergeTokenUsage(left, right) {
 		...left.cost !== void 0 || right.cost !== void 0 ? { cost: (left.cost ?? 0) + (right.cost ?? 0) } : {}
 	};
 }
-function finiteNumber(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
 function stringValue(value) {
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-function agentTurnResultFromPromptResult(result) {
-	const record = result;
-	return {
-		text: typeof record.response === "string" ? record.response : typeof record.text === "string" ? record.text : typeof record.finalText === "string" ? record.finalText : "",
-		success: typeof record.success === "boolean" ? record.success : true,
-		...typeof record.error === "string" ? { error: record.error } : {},
-		usage: tokenUsageFromData(record)
-	};
-}
 function sandboxDispatchResultFromSessionRef(session) {
 	const controlRef = session.controlRef === void 0 ? void 0 : AgentExactRunControlRefSchema.parse(session.controlRef);
 	const metadataExecutionId = optionalDispatchIdentity(session.metadata?.executionId, "executionId");
@@ -12478,50 +12156,11 @@ function sandboxDispatchResultFromSessionRef(session) {
 		}
 	};
 }
-function sessionRefFromSandboxDispatch(dispatched, providerName) {
-	const record = dispatched && typeof dispatched === "object" ? dispatched : void 0;
-	const id = record?.sessionId ?? record?.id;
-	if (typeof id !== "string" || id.length === 0) throw new ValidationError("sandboxClientAsProvider: dispatch returned no session id");
-	if (!record) throw new ValidationError("sandboxClientAsProvider: dispatch returned no session record");
-	const executionId = optionalDispatchIdentity(record.executionId, "executionId");
-	const controlRef = record.runControlRef === void 0 ? void 0 : AgentExactRunControlRefSchema.parse(record.runControlRef);
-	if (controlRef !== void 0) {
-		if (controlRef.sessionId !== id || controlRef.provider !== providerName) throw new ValidationError("sandbox dispatch returned a control reference for another session");
-		if (executionId !== void 0 && controlRef.executionId !== executionId) throw new ValidationError("sandbox dispatch returned conflicting execution identities");
-	}
-	if (record.alreadyExisted !== void 0 && typeof record.alreadyExisted !== "boolean") throw new ValidationError("sandbox dispatch returned an invalid alreadyExisted flag");
-	if (record.dispatched !== void 0 && typeof record.dispatched !== "boolean") throw new ValidationError("sandbox dispatch returned an invalid dispatched flag");
-	if (record.status !== void 0 && !isSandboxSessionStatus(record.status)) throw new ValidationError("sandbox dispatch returned an invalid session status");
-	return {
-		id,
-		provider: providerName,
-		...controlRef === void 0 ? {} : { controlRef },
-		metadata: {
-			...record.status ? { status: record.status } : {},
-			...executionId === void 0 ? {} : { executionId },
-			...record.alreadyExisted !== void 0 ? { alreadyExisted: record.alreadyExisted } : {},
-			...record.dispatched !== void 0 ? { dispatched: record.dispatched } : {}
-		}
-	};
-}
 function optionalDispatchIdentity(value, label) {
 	if (value === void 0) return void 0;
 	if (typeof value !== "string" || value.length === 0) throw new ValidationError(`sandbox dispatch returned an invalid ${label}`);
 	return value;
 }
-function isSandboxSessionStatus(value) {
-	return value === "queued" || value === "running" || value === "completed" || value === "failed" || value === "cancelled";
-}
-function execResultFromSandboxExecResult(result) {
-	const record = result;
-	const exitCode = finiteNumber(record.exitCode) ?? finiteNumber(record.code);
-	if (exitCode === void 0) throw new ValidationError("sandboxClientAsProvider: exec returned no exit code");
-	return {
-		exitCode,
-		stdout: typeof record.stdout === "string" ? record.stdout : "",
-		stderr: typeof record.stderr === "string" ? record.stderr : ""
-	};
-}
 function statusFromUnknown(status) {
 	if (status === "pending" || status === "provisioning" || status === "running") return status;
 	if (status === "stopped" || status === "failed" || status === "expired") return status;
@@ -12533,133 +12172,6 @@ function sessionStatusFromUnknown(status) {
 	if (status === "completed" || status === "cancelled") return status;
 	return statusFromUnknown(status);
 }
-function readBoxStatus(box) {
-	return box.status;
-}
-function readBoxMetadata(box) {
-	const metadata = box.metadata;
-	return metadata && typeof metadata === "object" ? metadata : void 0;
-}
-async function maybeRefresh(box) {
-	const refresh = box.refresh;
-	if (typeof refresh === "function") await refresh.call(box);
-}
-async function destroyBox(box) {
-	const deleteBox = box.delete;
-	if (typeof deleteBox === "function") await deleteBox.call(box);
-}
-function placementInfoFromLoopPlacement(placement, box) {
-	if (!placement) return {
-		kind: "sandbox",
-		sandboxId: String(box.id)
-	};
-	return {
-		kind: placement.kind === "fleet" ? "fleet" : placement.kind === "in-process" ? "local" : "sandbox",
-		...placement.sandboxId ? { sandboxId: placement.sandboxId } : { sandboxId: String(box.id) },
-		...placement.fleetId ? { fleetId: placement.fleetId } : {},
-		...placement.machineId ? { machineId: placement.machineId } : {}
-	};
-}
-const completeInteractiveAgentCapabilities = {
-	start: true,
-	control: true,
-	status: true,
-	attach: true,
-	reattach: true,
-	sendPrompt: true,
-	input: true,
-	resize: true,
-	stop: true
-};
-async function sandboxEnvironmentCapabilities(box, providerCapabilities) {
-	const { interactiveAgent: providerInteractive, ...baseCapabilities } = providerCapabilities;
-	if (!hasCompleteInteractiveAgentCapabilities(providerInteractive)) return baseCapabilities;
-	let deployed;
-	try {
-		deployed = await box.capabilities();
-	} catch {
-		return baseCapabilities;
-	}
-	if (!hasCompleteInteractiveAgentCapabilities(deployed?.interactiveAgent)) return baseCapabilities;
-	if (!hasExactInteractiveTerminalAdapter(box)) return baseCapabilities;
-	return {
-		...baseCapabilities,
-		interactiveAgent: { ...completeInteractiveAgentCapabilities }
-	};
-}
-function hasExactInteractiveTerminalAdapter(box) {
-	if (!hasSession(box)) return false;
-	try {
-		const session = box.session("__runtime-capability-probe__");
-		const interactive = session.interactive;
-		if (typeof interactive !== "function") return false;
-		return typeof interactive.call(session).attachAgentTerminal === "function";
-	} catch {
-		return false;
-	}
-}
-function hasCompleteInteractiveAgentCapabilities(value) {
-	return value?.start === true && value.control === true && value.status === true && value.attach === true && value.reattach === true && value.sendPrompt === true && value.input === true && value.resize === true && value.stop === true;
-}
-function assertSandboxInteractiveBinding(run, box, providerName) {
-	if (run.provider !== providerName || run.environmentId !== String(box.id)) throw new ValidationError("sandbox interactive request targets another environment");
-}
-function defaultTangleSandboxCapabilities(options) {
-	return {
-		profile: {
-			namedProfiles: options.namedProfiles,
-			systemPrompt: { ...harnessSystemPromptIntents(void 0) },
-			instructions: true,
-			tools: true,
-			permissions: true,
-			mcp: true,
-			subagents: true,
-			resources: {
-				files: true,
-				instructions: true,
-				tools: true,
-				skills: true,
-				agents: true,
-				commands: true
-			},
-			hooks: true,
-			modes: true,
-			runtimeUpdate: true,
-			validation: true
-		},
-		streaming: {
-			live: true,
-			replay: true,
-			detach: true,
-			turnIdempotency: true
-		},
-		sessions: {
-			continue: true,
-			list: true,
-			messages: true
-		},
-		workspace: {
-			read: true,
-			write: true,
-			exec: true,
-			git: true,
-			upload: true,
-			download: true,
-			cwdBases: {
-				repository: true,
-				host: false
-			}
-		},
-		branching: {
-			checkpoint: false,
-			fork: false
-		},
-		...options.rediscover ? { interactiveAgent: { ...completeInteractiveAgentCapabilities } } : {},
-		placement: true,
-		usage: true,
-		confidential: false
-	};
-}
 function contentRef(prefix, value) {
 	let str;
 	try {
@@ -12674,27 +12186,6 @@ function contentRef(prefix, value) {
 	}
 	return `${prefix}:${(hash >>> 0).toString(16).padStart(8, "0")}`;
 }
-function hasGet(client) {
-	return typeof client.get === "function";
-}
-function hasList(client) {
-	return typeof client.list === "function";
-}
-function hasDispatchPrompt(box) {
-	return typeof box.dispatchPrompt === "function";
-}
-function hasSession(box) {
-	return typeof box.session === "function";
-}
-function hasRead(box) {
-	return typeof box.read === "function";
-}
-function hasWrite(box) {
-	return typeof box.write === "function";
-}
-function hasExec(box) {
-	return typeof box.exec === "function";
-}
 //#endregion
 //#region src/runtime/model-identity.ts
 const SNAPSHOT_TOKEN = /^[A-Za-z0-9._-]+$/u;
@@ -23259,21 +22750,22 @@ async function ownerWorkspaceRetentionFailures(events, nodeId, blobs) {
 		if (event.kind === "execution-input") {
 			flush();
 			current = {
+				executionId: `${nodeId}:input:${event.seq}`,
 				environmentIds: /* @__PURE__ */ new Set(),
-				executionByEnvironment: /* @__PURE__ */ new Map()
+				controlByEnvironment: /* @__PURE__ */ new Map()
 			};
 		} else if (event.kind === "execution-admitted" && event.admission.phase === "environment") {
 			if (current?.result !== void 0) flush();
 			current ??= {
 				environmentIds: /* @__PURE__ */ new Set(),
-				executionByEnvironment: /* @__PURE__ */ new Map()
+				controlByEnvironment: /* @__PURE__ */ new Map()
 			};
 			current.environmentIds.add(event.admission.environmentId);
-			current.executionByEnvironment.set(event.admission.environmentId, event.admission.executionId);
-		} else if (event.kind === "execution-result") {
+		} else if (event.kind === "execution-admitted" && event.admission.phase === "dispatched") current?.controlByEnvironment.set(event.admission.controlRef.environmentId, event.admission.controlRef);
+		else if (event.kind === "execution-result") {
 			current ??= {
 				environmentIds: /* @__PURE__ */ new Set(),
-				executionByEnvironment: /* @__PURE__ */ new Map()
+				controlByEnvironment: /* @__PURE__ */ new Map()
 			};
 			current.result = event;
 		}
@@ -23300,20 +22792,21 @@ async function ownerWorkspaceRetentionFailures(events, nodeId, blobs) {
 		}
 		const snapshot = output !== null && typeof output === "object" ? output.workspaceSnapshot : void 0;
 		const environmentId = [...attempt.environmentIds][0];
-		const executionId = attempt.executionByEnvironment.get(environmentId);
-		if (!hasDurableWorkspaceCapture(output, snapshot, environmentId, executionId)) failures.add(environmentId);
+		const controlRef = attempt.controlByEnvironment.get(environmentId);
+		if (!hasDurableWorkspaceCapture(output, snapshot, environmentId, attempt.executionId, controlRef)) failures.add(environmentId);
 	}
 	return failures;
 }
 /** A stored result authorizes cleanup only for the exact source and complete capture. */
-function hasDurableWorkspaceCapture(output, snapshot, environmentId, executionId) {
+function hasDurableWorkspaceCapture(output, snapshot, environmentId, executionId, controlRef) {
 	const parsed = agentCandidateWorkspaceSnapshotEvidenceSchema.safeParse(snapshot);
 	if (!parsed.success || !("locator" in parsed.data.manifest) || !("locator" in parsed.data.archive)) return false;
 	if (output === null || typeof output !== "object") return false;
 	const capture = output.workspaceCapture;
 	if (capture === null || typeof capture !== "object") return false;
 	const receipt = capture;
-	if (receipt.environmentId !== environmentId || receipt.executionId !== executionId || receipt.coverageComplete !== true) return false;
+	const capturedControl = AgentExactRunControlRefSchema.safeParse(receipt.controlRef);
+	if (executionId === void 0 || controlRef === void 0 || !capturedControl.success || !sameControlCoordinates(capturedControl.data, controlRef) || receipt.environmentId !== environmentId || receipt.executionId !== executionId || receipt.coverageComplete !== true) return false;
 	const linked = agentCandidateWorkspaceSnapshotEvidenceSchema.safeParse(receipt.snapshot);
 	return linked.success && linked.data.digest === parsed.data.digest && JSON.stringify(linked.data.manifest) === JSON.stringify(parsed.data.manifest) && JSON.stringify(linked.data.archive) === JSON.stringify(parsed.data.archive);
 }
@@ -27455,11 +26948,18 @@ const DETERMINISTIC_BRIDGE_CODES = /* @__PURE__ */ new Set([
 var HarnessTurnFailedError = class extends Error {
 	runtime;
 	errorCode;
+	statusCode;
+	/** The shared HTTP error reader also uses this status for persisted diagnostics. */
+	status;
 	constructor(runtime, failure) {
 		super(`${runtime} harness turn ended with a failed outcome` + (failure.errorCode === void 0 ? "" : ` (${failure.errorCode})`) + `: ${failure.error}`);
 		this.name = "HarnessTurnFailedError";
 		this.runtime = runtime;
 		if (failure.errorCode !== void 0) this.errorCode = failure.errorCode;
+		if (failure.statusCode !== void 0) {
+			this.statusCode = failure.statusCode;
+			this.status = failure.statusCode;
+		}
 	}
 };
 /**
@@ -27476,7 +26976,8 @@ function upstreamUnavailableSignal(error) {
 	if (error instanceof CheckUnavailableError) return "check-unavailable";
 	if (error instanceof HarnessTurnFailedError) return unavailableSignalOfFailure({
 		error: error.message,
-		...error.errorCode === void 0 ? {} : { errorCode: error.errorCode }
+		...error.errorCode === void 0 ? {} : { errorCode: error.errorCode },
+		...error.statusCode === void 0 ? {} : { statusCode: error.statusCode }
 	});
 	if (error instanceof BackendTransportError) {
 		const code = error.upstreamCode?.toLowerCase();
@@ -27508,7 +27009,8 @@ function classifyDriverFailure(error, signal) {
 	if (error instanceof Error && errorProperty(error, "name") === "AbortError") return "terminal";
 	if (error instanceof HarnessTurnFailedError) {
 		if (error.errorCode !== void 0 && DETERMINISTIC_BRIDGE_CODES.has(error.errorCode)) return "terminal";
-		return isUpstreamUnavailable(error) ? "unavailable" : "transient";
+		if (isUpstreamUnavailable(error)) return "unavailable";
+		return foreignHttpStatusVerdict(error) ?? "transient";
 	}
 	if (error instanceof BackendTransportError) {
 		if (error.upstreamCode !== void 0 && DETERMINISTIC_BRIDGE_CODES.has(error.upstreamCode)) return "terminal";
@@ -28920,6 +28422,6 @@ function isNonEmptySpend(s) {
 	return s.iterations > 0 || s.tokens.input > 0 || s.tokens.output > 0 || s.usd > 0 || s.ms > 0 || s.tokensKnown === false || s.usdKnown === false || Object.values(s.resources ?? {}).some((resource) => resource.amount > 0 || !resource.known);
 }
 //#endregion
-export { waitUntil as $, executableAgentProfileSnapshot as $i, materializeTreeView as $n, sanitizeAgentRuntimeEvent as $r, claimsAuthority as $t, driverExecutorFactory as A, withTimeout as Aa, worktreeCliProfileMaterialization as Ai, DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS as An, persistHarnessTranscript as Ar, cliInPlaceExecutor as At, recordScopeOwnerDriverAttempt as B, teardownExecutor as Ba, knownExecutionBindingReceipt as Bi, decodeToolPart as Bn, buildLoopOtelSpans as Br, WORKER_TRACE_PROPAGATION as Bt, createContinuationKeeper as C, promptCacheTokenClasses as Ca, promptOnlyProfileMaterialization as Ci, captureBeforeDestroy as Cn, environmentGone as Cr, recoverRetainedInteractiveRun as Ct, passedItems as D, throwAbort as Da, sandboxActProfileMaterialization as Di, runBrainLoop as Dn, runAbortable as Dr, rollingDispatch as Dt, failedItems as E, stringifySafe as Ea, renderUnsupported as Ei, routerBrain as En, linkAbort as Er, queueOf as Et, beginScopeOwnerAttempt as F, decodeHarnessUsage as Fa, attestRuntimeOwnedPendingExecutor as Fi, resolveAgentEnvironmentProvider as Fn, readTraceContextFromEnv as Fr, createWorktreeCliExecutor as Ft, settledToIteration as G, runtimeOwnedDriveHarnessProviderEvidence as Gi, FileSpawnJournal as Gn, flatOtelSpan as Gr, taskToPrompt as Gt, recordScopeOwnerPause as H, promptFromAgentTurnInput as Ha, newExecutionAttemptId as Hi, registerRetainedExecutorPreparation as Hn, buildRuntimeEventOtelSpans as Hr, workerTraceEnv as Ht, createScope as I, abortError$2 as Ia, attestRuntimeOwnedScopeOwner as Ii, sandboxClientAsProvider as In, traceContextToEnv as Ir, DEFAULT_SANDBOX_STEERING_MAX_TURNS as It, createWaitProbes as J, runtimeOwnedExecutorProviderEvidence as Ji, SpawnEventIndex as Jn, padSpanId as Jr, readWorkerProgress as Jt, createWorkerSlots as K, runtimeOwnedExecutorExecutionBinding as Ki, InMemoryResultBlobStore as Kn, generateSpanId as Kr, DEFAULT_STALL_AFTER_MS as Kt, deriveNodeExecutionIdentity as L, awaitAbortable$1 as La, authoredProfileDigest as Li, unavailablePauseMs as Ln, defaultRedactor as Lr, createSteerableSandboxSession as Lt, withDriverExecutor as M, addResourceSpend as Ma, prepareJsonlAppend as Mi, createAgentEnvironmentProviderRegistry as Mn, contentAddress as Mr, createExecutor as Mt, SUBTREE_RESULT_LIMIT as N, resourceTelemetry as Na, readCommittedJsonLines as Ni, providerAsExecutor as Nn, createPropagatingTraceEmitter as Nr, createExecutorRegistry as Nt, verdictFromJudgeScore as O, throwIfAborted as Oa, unsupportedProfileDimensions as Oi, canonicalObservedModelParts as On, captureHarnessTranscript as Or, bindReusableExecutorExecutionId as Ot, assertRecursiveReservationPolicy as P, withBudgetResources as Pa, writeAllBytes as Pi, providerAsSandboxClient as Pn, mergeTraceEnv as Pr, snapshotExecutorConfig as Pt, validateWaitSpec as Q, unknownMaterializationReceipt as Qi, loadSpawnForest as Qn, createRuntimeStreamEventCollector as Qr, PEER_MAIL_WIRE_KEY as Qt, meterRuntimeOwnedAccounting as R, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as Ra, finalizeRuntimeOwnedPendingExecutor as Ri, unavailableSignalOfFailure as Rn, defaultRedactorIdentityMaterial as Rr, createRouterTranscript as Rt, composeContinuationNote as S, isAbortError$2 as Sa, promptModelProfileMaterialization as Si, SandboxEvidenceRetentionError as Sn, destroyInteractiveEnvironment as Sr, reconnectRetainedInteractiveRun as St, expandQuestions as T, sleep as Ta, renderProfileMaterializationIssues as Ti, readPromptOptions as Tn, abortError as Tr, freeSlots as Tt, restoreScopeOwnerAcceptedExecution as U, promptOptionsFromAgentTurnInput as Ua, providerAttemptEvidence as Ui, retainedExecutorSeamKey as Un, createOpenInferenceFileExporter as Ur, workerTraceHeaders as Ut, recordScopeOwnerMaterialization as V, teardownSurfaces as Va, knownMaterializationReceipt as Vi, sandboxSessionTraceSource as Vn, buildLoopSpanNodes as Vr, readWorkerTraceContext as Vt, scopeOwnerExecutorNodeContext as W, providerMessageText as Wa, recordRuntimeOwnedDriveHarnessProviderEvidence as Wi, FileResultBlobStore as Wn, createOtelExporter as Wr, workerTraceSeamKey as Wt, pollFor as X, runtimeOwnedScopeOwnerRuntime as Xi, encodeResultBlob as Xn, toOtelAttributes as Xr, AUTHORITY_MARKERS as Xt, isWaitOutcome as Y, runtimeOwnedPendingExecutorMaterialization as Yi, assertContentAddress as Yn, padTraceId as Yr, createInbox as Yt, timerAt as Z, unknownExecutionBindingReceipt as Zi, insideCursorNamespace as Zn, createRuntimeEventCollector as Zr, DEFAULT_PEER_MAIL_LIMITS as Zt, CheckUnavailableError as _, addSpend as _a, controlProfileMaterialization as _i, isTerminalDecision as _n, reconnectRetainedRun as _r, workerInteractiveAdmissionFile as _t, collectDelivered as a, assertSandboxServedModel as aa, createWorktree as ai, isTerminalNodeStatus as an, parseWorkerToolTraceArtifact as ar, reconcileScopeRetainedOwnerEnvironment as at, bestComposite as b, deleteBoxSafe as ba, profileMaterializationAxes$1 as bi, probeSandboxCapabilities as bn, startRetainedRunInEnvironment as br, workerInteractiveBindingFile as bt, runTree as c, createSandboxUsageLedger as ca, LOCAL_HARNESSES as ci, addHarnessUsage as cn, BudgetReconcileFault as cr, scopeRetainedOwnerResourceReader as ct, classifyDriverFailure as d, mapSandboxEvent as da, localHarnessExecutable as di, readCodexRolloutSession as dn, createBudgetPool as dr, SPAWN_RESOURCE_PATH_MAX_BYTES as dt, executableAgentSpecSnapshot as ea, sanitizeKnowledgeReadinessReport as ei, createPeerMailbox as en, pendingWaits as er, bindScopeRetainedOwnerEnvironmentId as et, runDriverWithRetry as f, mapSandboxToolEvent as fa, parseCodexTokenUsage as fi, bridgeRuntimeAttachmentsKey as fn, meterUsageEvent as fr, environmentReader as ft, CONTINUATION_FACTS as g, sumSandboxUsage as ga, assertProfileMaterialization as gi, defaultSelectWinner as gn, errMessage as gr, readWorkerInteractiveAdmissions as gt, CONTINUATIONS_DIR as h, sandboxProgressEvents as ha, AGENT_PROFILE_MATERIALIZATION_AXES as hi, createSandboxForSpec as hn, spendFromUsageTotals as hr, interactiveAdmissionSeamKey as ht, bestDelivered as i, readSandboxOutcome as ia, captureWorktreeDiff as ii, isLiveNodeStatus as in, isTraceAnalysisStore as ir, prepareScopeRetainedOwnerTask as it, isDriverSpec as j, zeroSpend as ja, isNoEntError as ji, LEAF_CONTINUATION_TASK as jn, readHarnessTranscript as jr, cliWorktreeExecutor as jt, driverChild as k, unmeteredSpend as ka, validateProfileMaterialization as ki, observedModelMatchesDeclared as kn, harnessTranscriptArtifact as kr, captureReusableExecutorConfig as kt, DriverAttemptsExhaustedError as l, extractLlmCallEvent as la, harnessInvocation as li, createCodexRolloutStoreReader as ln, ReservationWaitRefused as lr, scopeRetainedOwnerRestorePoint as lt, upstreamUnavailableSignal as m, sandboxEventServedBackend as ma, terminateProcessTreeAndConfirm as mi, TERMINAL_DECISIONS as mn, spendFromUsageEvents as mr, resolveSpawnResourcePaths as mt, createRootHandle as n, detachedSnapshot as na, runSettledCommand as ni, peerMailTools as nn, WORKER_TOOL_TRACE_SCHEMA_VERSION as nr, consumeScopeRetainedOwnerResult as nt, pickBestDelivered as o, canonicalStreamEventFromSandboxEvent as oa, removeWorktree as oi, bridgeAdmissionRefusal as on, workerTraceAnalysisStore as or, scopeRetainedOwnerContext as ot, summarizeDriverAttempts as p, notifySandboxEventObserver as pa, CodexExecutionDiagnosticError as pi, bridgeStopSignalKey as pn, newUsageTotals as pr, hostDirectoryReader as pt, openSlotGroup as q, runtimeOwnedExecutorMaterialization as qi, InMemorySpawnJournal as qn, loopEventToOtelSpan as qr, createActivityLog as qt, createSupervisor as r, projectSandboxOutcome as ra, runWorktreeHarness as ri, peerMailVerbNames as rn, captureWorkerTraceEvidence as rr, noteScopeRetainedOwnerCoordination as rt, runFinalizer as s, createSandboxToolPartState as sa, DEFAULT_LOCAL_HARNESS as si, bridgeModelRouteRefusal as sn, executorFailure as sr, scopeRetainedOwnerPriorSpend as st, DEFAULT_MAX_DEPTH as t, detachedFrozen as ta, sanitizeRuntimeStreamEvent as ti, isPeerMailEnvelope as tn, replaySpawnTree as tr, bindScopeRetainedOwnerProvider as tt, HarnessTurnFailedError as u, isSandboxTerminalEvent as ua, harnessSupportsReasoningEffort as ui, harnessUsageIsEmpty as un, assertValidBudget as ur, scopeRetainedOwnerResult as ut, admitContinuationPolicy as v, chargedTokens as va, defineProfileMaterializationContract as vi, runAgentRounds as vn, recoverRetainedRun as vr, attachWorker as vt, distillFindings as w, randomSuffix as wa, promptResourceProfileMaterialization as wi, assertBoxlessPromptOptions as wn, RunCancellationReason as wr, startRetainedInteractiveRun as wt, checkVerdictOf as x, hasCompleteCacheBreakdown as xa, promptControlProfileMaterialization as xi, acquireSandbox as xn, retainedCreateMaterial as xr, workerInteractiveBindingsDir as xt, admitFinding as y, cloneSpend as ya, fullProfileMaterialization as yi, createSandboxLineage as yn, startRetainedRun as yr, readWorkerInteractiveBinding as yt, meterRuntimeOwnedProviderAttempt as z, armDeadlineTimer as za, inheritRuntimeOwnedExecutorAttestation as zi, createPushTraceSource as zn, resolveRedactor as zr, createInPlaceCliExecutor as zt };
+export { waitUntil as $, detachedFrozen as $i, replaySpawnTree as $n, sanitizeRuntimeStreamEvent as $r, claimsAuthority as $t, driverExecutorFactory as A, addResourceSpend as Aa, prepareJsonlAppend as Ai, LEAF_CONTINUATION_TASK as An, contentAddress as Ar, cliInPlaceExecutor as At, recordScopeOwnerDriverAttempt as B, promptFromAgentTurnInput as Ba, newExecutionAttemptId as Bi, registerRetainedExecutorPreparation as Bn, buildRuntimeEventOtelSpans as Br, WORKER_TRACE_PROPAGATION as Bt, createContinuationKeeper as C, sleep as Ca, renderProfileMaterializationIssues as Ci, captureBeforeDestroy as Cn, abortError as Cr, recoverRetainedInteractiveRun as Ct, passedItems as D, unmeteredSpend as Da, validateProfileMaterialization as Di, runBrainLoop as Dn, harnessTranscriptArtifact as Dr, rollingDispatch as Dt, failedItems as E, throwIfAborted as Ea, unsupportedProfileDimensions as Ei, routerBrain as En, captureHarnessTranscript as Er, queueOf as Et, beginScopeOwnerAttempt as F, awaitAbortable$1 as Fa, authoredProfileDigest as Fi, unavailablePauseMs as Fn, defaultRedactor as Fr, createWorktreeCliExecutor as Ft, settledToIteration as G, runtimeOwnedExecutorMaterialization as Gi, InMemorySpawnJournal as Gn, loopEventToOtelSpan as Gr, taskToPrompt as Gt, recordScopeOwnerPause as H, providerMessageText as Ha, recordRuntimeOwnedDriveHarnessProviderEvidence as Hi, FileResultBlobStore as Hn, createOtelExporter as Hr, workerTraceEnv as Ht, createScope as I, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as Ia, finalizeRuntimeOwnedPendingExecutor as Ii, unavailableSignalOfFailure as In, defaultRedactorIdentityMaterial as Ir, DEFAULT_SANDBOX_STEERING_MAX_TURNS as It, createWaitProbes as J, runtimeOwnedScopeOwnerRuntime as Ji, encodeResultBlob as Jn, toOtelAttributes as Jr, readWorkerProgress as Jt, createWorkerSlots as K, runtimeOwnedExecutorProviderEvidence as Ki, SpawnEventIndex as Kn, padSpanId as Kr, DEFAULT_STALL_AFTER_MS as Kt, deriveNodeExecutionIdentity as L, armDeadlineTimer as La, inheritRuntimeOwnedExecutorAttestation as Li, createPushTraceSource as Ln, resolveRedactor as Lr, createSteerableSandboxSession as Lt, withDriverExecutor as M, withBudgetResources as Ma, writeAllBytes as Mi, providerAsExecutor as Mn, mergeTraceEnv as Mr, createExecutor as Mt, SUBTREE_RESULT_LIMIT as N, decodeHarnessUsage as Na, attestRuntimeOwnedPendingExecutor as Ni, providerAsSandboxClient as Nn, readTraceContextFromEnv as Nr, createExecutorRegistry as Nt, verdictFromJudgeScore as O, withTimeout as Oa, worktreeCliProfileMaterialization as Oi, canonicalObservedModelParts as On, persistHarnessTranscript as Or, bindReusableExecutorExecutionId as Ot, assertRecursiveReservationPolicy as P, abortError$2 as Pa, attestRuntimeOwnedScopeOwner as Pi, resolveAgentEnvironmentProvider as Pn, traceContextToEnv as Pr, snapshotExecutorConfig as Pt, validateWaitSpec as Q, executableAgentSpecSnapshot as Qi, pendingWaits as Qn, sanitizeKnowledgeReadinessReport as Qr, PEER_MAIL_WIRE_KEY as Qt, meterRuntimeOwnedAccounting as R, teardownExecutor as Ra, knownExecutionBindingReceipt as Ri, decodeToolPart as Rn, buildLoopOtelSpans as Rr, createRouterTranscript as Rt, composeContinuationNote as S, randomSuffix as Sa, promptResourceProfileMaterialization as Si, SandboxEvidenceRetentionError as Sn, RunCancellationReason as Sr, reconnectRetainedInteractiveRun as St, expandQuestions as T, throwAbort as Ta, sandboxActProfileMaterialization as Ti, readPromptOptions as Tn, runAbortable as Tr, freeSlots as Tt, restoreScopeOwnerAcceptedExecution as U, runtimeOwnedDriveHarnessProviderEvidence as Ui, FileSpawnJournal as Un, flatOtelSpan as Ur, workerTraceHeaders as Ut, recordScopeOwnerMaterialization as V, promptOptionsFromAgentTurnInput as Va, providerAttemptEvidence as Vi, retainedExecutorSeamKey as Vn, createOpenInferenceFileExporter as Vr, readWorkerTraceContext as Vt, scopeOwnerExecutorNodeContext as W, runtimeOwnedExecutorExecutionBinding as Wi, InMemoryResultBlobStore as Wn, generateSpanId as Wr, workerTraceSeamKey as Wt, pollFor as X, unknownMaterializationReceipt as Xi, loadSpawnForest as Xn, createRuntimeStreamEventCollector as Xr, AUTHORITY_MARKERS as Xt, isWaitOutcome as Y, unknownExecutionBindingReceipt as Yi, insideCursorNamespace as Yn, createRuntimeEventCollector as Yr, createInbox as Yt, timerAt as Z, executableAgentProfileSnapshot as Zi, materializeTreeView as Zn, sanitizeAgentRuntimeEvent as Zr, DEFAULT_PEER_MAIL_LIMITS as Zt, CheckUnavailableError as _, cloneSpend as _a, fullProfileMaterialization as _i, isTerminalDecision as _n, startRetainedRun as _r, workerInteractiveAdmissionFile as _t, collectDelivered as a, createSandboxToolPartState as aa, DEFAULT_LOCAL_HARNESS as ai, isTerminalNodeStatus as an, executorFailure as ar, reconcileScopeRetainedOwnerEnvironment as at, bestComposite as b, isAbortError$2 as ba, promptModelProfileMaterialization as bi, probeSandboxCapabilities as bn, destroyInteractiveEnvironment as br, workerInteractiveBindingFile as bt, runTree as c, isSandboxTerminalEvent as ca, harnessSupportsReasoningEffort as ci, addHarnessUsage as cn, assertValidBudget as cr, scopeRetainedOwnerResourceReader as ct, classifyDriverFailure as d, notifySandboxEventObserver as da, CodexExecutionDiagnosticError as di, readCodexRolloutSession as dn, newUsageTotals as dr, SPAWN_RESOURCE_PATH_MAX_BYTES as dt, detachedSnapshot as ea, runSettledCommand as ei, createPeerMailbox as en, WORKER_TOOL_TRACE_SCHEMA_VERSION as er, bindScopeRetainedOwnerEnvironmentId as et, runDriverWithRetry as f, sandboxEventServedBackend as fa, terminateProcessTreeAndConfirm as fi, bridgeRuntimeAttachmentsKey as fn, spendFromUsageEvents as fr, environmentReader as ft, CONTINUATION_FACTS as g, chargedTokens as ga, defineProfileMaterializationContract as gi, defaultSelectWinner as gn, recoverRetainedRun as gr, readWorkerInteractiveAdmissions as gt, CONTINUATIONS_DIR as h, addSpend as ha, controlProfileMaterialization as hi, createSandboxForSpec as hn, reconnectRetainedRun as hr, interactiveAdmissionSeamKey as ht, bestDelivered as i, canonicalStreamEventFromSandboxEvent as ia, removeWorktree as ii, isLiveNodeStatus as in, workerTraceAnalysisStore as ir, prepareScopeRetainedOwnerTask as it, isDriverSpec as j, resourceTelemetry as ja, readCommittedJsonLines as ji, createAgentEnvironmentProviderRegistry as jn, createPropagatingTraceEmitter as jr, cliWorktreeExecutor as jt, driverChild as k, zeroSpend as ka, isNoEntError as ki, observedModelMatchesDeclared as kn, readHarnessTranscript as kr, captureReusableExecutorConfig as kt, DriverAttemptsExhaustedError as l, mapSandboxEvent as la, localHarnessExecutable as li, createCodexRolloutStoreReader as ln, createBudgetPool as lr, scopeRetainedOwnerRestorePoint as lt, upstreamUnavailableSignal as m, sumSandboxUsage as ma, assertProfileMaterialization as mi, TERMINAL_DECISIONS as mn, errMessage as mr, resolveSpawnResourcePaths as mt, createRootHandle as n, readSandboxOutcome as na, captureWorktreeDiff as ni, peerMailTools as nn, isTraceAnalysisStore as nr, consumeScopeRetainedOwnerResult as nt, pickBestDelivered as o, createSandboxUsageLedger as oa, LOCAL_HARNESSES as oi, bridgeAdmissionRefusal as on, BudgetReconcileFault as or, scopeRetainedOwnerContext as ot, summarizeDriverAttempts as p, sandboxProgressEvents as pa, AGENT_PROFILE_MATERIALIZATION_AXES as pi, bridgeStopSignalKey as pn, spendFromUsageTotals as pr, hostDirectoryReader as pt, openSlotGroup as q, runtimeOwnedPendingExecutorMaterialization as qi, assertContentAddress as qn, padTraceId as qr, createActivityLog as qt, createSupervisor as r, assertSandboxServedModel as ra, createWorktree as ri, peerMailVerbNames as rn, parseWorkerToolTraceArtifact as rr, noteScopeRetainedOwnerCoordination as rt, runFinalizer as s, extractLlmCallEvent as sa, harnessInvocation as si, bridgeModelRouteRefusal as sn, ReservationWaitRefused as sr, scopeRetainedOwnerPriorSpend as st, DEFAULT_MAX_DEPTH as t, projectSandboxOutcome as ta, runWorktreeHarness as ti, isPeerMailEnvelope as tn, captureWorkerTraceEvidence as tr, bindScopeRetainedOwnerProvider as tt, HarnessTurnFailedError as u, mapSandboxToolEvent as ua, parseCodexTokenUsage as ui, harnessUsageIsEmpty as un, meterUsageEvent as ur, scopeRetainedOwnerResult as ut, admitContinuationPolicy as v, deleteBoxSafe as va, profileMaterializationAxes$1 as vi, runAgentRounds as vn, startRetainedRunInEnvironment as vr, attachWorker as vt, distillFindings as w, stringifySafe as wa, renderUnsupported as wi, assertBoxlessPromptOptions as wn, linkAbort as wr, startRetainedInteractiveRun as wt, checkVerdictOf as x, promptCacheTokenClasses as xa, promptOnlyProfileMaterialization as xi, acquireSandbox as xn, environmentGone as xr, workerInteractiveBindingsDir as xt, admitFinding as y, hasCompleteCacheBreakdown as ya, promptControlProfileMaterialization as yi, createSandboxLineage as yn, retainedCreateMaterial as yr, readWorkerInteractiveBinding as yt, meterRuntimeOwnedProviderAttempt as z, teardownSurfaces as za, knownMaterializationReceipt as zi, sandboxSessionTraceSource as zn, buildLoopSpanNodes as zr, createInPlaceCliExecutor as zt };
 
-//# sourceMappingURL=supervisor-CSLiRg5R.js.map
+//# sourceMappingURL=supervisor-CQFcQhlo.js.map