@tangle-network/agent-runtime 0.289.2 → 0.291.0

package/dist/{supervisor-CDsr_sZD.js → supervisor-DpUCJtKC.js}

@@ -1,9 +1,9 @@
 import { c as RetainedInteractiveAdmissionError, d as RetainedRunDispatchBindingError, f as RuntimeRunStateError, i as ConfigError, l as RetainedInteractiveBindingError, m as ValidationError$1, r as BackendTransportError, t as AgentEvalError$1, u as RetainedRunAdmissionError } from "./errors-DodWX-cb.js";
-import { a as concreteProfileModel, c as profileModelExecutionSettings, d as agentHarness, l as profileProviderModel, o as enforceTokenLimits, s as profileBridgeWireModel, t as assertExecutableAgentProfile, u as resolveRouterRetryPolicy } from "./model-policy-CA5d1YUP.js";
+import { _ as agentHarness, a as concreteProfileModel, c as profileModelExecutionSettings, d as assertRouterAutoDeclaration, f as assertRouterAutoResponse, g as observedModelMatchesDeclared, h as observedModelHasSnapshot, l as profileProviderModel, m as mergeObservedModelIdentity, o as enforceTokenLimits, s as profileBridgeWireModel, t as assertExecutableAgentProfile, u as resolveRouterRetryPolicy } from "./model-policy-DydyWTQg.js";
 import { S as verifyWorkspaceSnapshotArtifacts, i as verifyAgentCandidateWorkspaceArchive } from "./workspace-archive-MhowMCmp.js";
 import { n as assertNoSymlinkDescendant, r as publishExclusiveDurableFile } from "./durable-file-DWQA4ooo.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
-import { AGENT_PROFILE_MATERIALIZATION_AXES, AgentEnvironmentCapabilitiesSchema, AgentExactRunControlRefSchema, AgentInteractiveSessionControlClaimAcknowledgementSchema, AgentInteractiveSessionControlClaimSchema, AgentInteractiveSessionPromptAcknowledgementSchema, AgentInteractiveSessionRefSchema, AgentInteractiveSessionStartSchema, AgentInteractiveSessionStatusSchema, AgentInteractiveSessionStopAcknowledgementSchema, AgentNativeContextContinuationResultSchema, AgentRunCancellationAcknowledgementSchema, AgentRunCancellationRequestSchema, AgentTurnInputSchema, AgentTurnResultSchema, CanonicalStreamEventSchema, ContextTransferRequestSchema, InteractionAcknowledgementSchema, InteractionResponseCommandSchema, NativeContextBoundaryProofSchema, NativeContextContinuationRequestSchema, REASONING_EFFORTS, RuntimeEventEnvelopeSchema, TerminalReplayWindowSchema, TerminalSessionRefSchema, WorkspaceRequestSchema, agentCandidateWorkspaceSnapshotEvidenceSchema, agentInteractiveSessionControlClaimAcknowledgementMatchesRequest, agentInteractiveSessionControlClaimMatchesRef, agentInteractiveSessionPromptAcknowledgementMatchesCommand, agentInteractiveSessionRefMatchesStart, agentInteractiveSessionRunRef, agentInteractiveSessionStatusMatchesRef, agentInteractiveSessionStopAcknowledgementMatchesCommand, agentNativeContextContinuationResultMatchesRequest, agentProfileSchema, agentRunCancellationAcknowledgementMatchesRequest, agentRunCancellationRequestDigest, canonicalAgentProfileDigest, canonicalCandidateDigest, canonicalWorkspaceCwd, exactAgentInteractiveSessionStart, harnessSystemPromptIntents, harnessTypeSchema, nativeContextContinuationTurnDigest, nativeReasoningControl, profileMaterializationAxes, profileMaterializationAxes as profileMaterializationAxes$1, renderInputPartsAsText, sha256DigestSchema, workspaceCheckpointRequestDigest, workspaceCheckpointResultMatchesRequest, workspaceCleanupAcknowledgementMatches, workspaceCleanupRequestDigest, workspaceCwdPathForBase } from "@tangle-network/agent-interface";
+import { AGENT_PROFILE_MATERIALIZATION_AXES, AgentEnvironmentCapabilitiesSchema, AgentExactRunControlRefSchema, AgentInteractiveSessionControlClaimAcknowledgementSchema, AgentInteractiveSessionControlClaimSchema, AgentInteractiveSessionPromptAcknowledgementSchema, AgentInteractiveSessionRefSchema, AgentInteractiveSessionStatusSchema, AgentInteractiveSessionStopAcknowledgementSchema, AgentNativeContextContinuationResultSchema, AgentRunCancellationAcknowledgementSchema, AgentRunCancellationRequestSchema, AgentTurnInputSchema, AgentTurnResultSchema, CanonicalStreamEventSchema, ContextTransferRequestSchema, InteractionAcknowledgementSchema, InteractionResponseCommandSchema, NativeContextBoundaryProofSchema, NativeContextContinuationRequestSchema, REASONING_EFFORTS, RuntimeEventEnvelopeSchema, TerminalReplayWindowSchema, TerminalSessionRefSchema, agentCandidateWorkspaceSnapshotEvidenceSchema, agentInteractiveSessionControlClaimAcknowledgementMatchesRequest, agentInteractiveSessionControlClaimMatchesRef, agentInteractiveSessionPromptAcknowledgementMatchesCommand, agentInteractiveSessionRefMatchesStart, agentInteractiveSessionRunRef, agentInteractiveSessionStatusMatchesRef, agentInteractiveSessionStopAcknowledgementMatchesCommand, agentNativeContextContinuationResultMatchesRequest, agentProfileSchema, agentRunCancellationAcknowledgementMatchesRequest, agentRunCancellationRequestDigest, canonicalAgentProfileDigest, canonicalCandidateDigest, canonicalWorkspaceCwd, exactAgentInteractiveSessionStart, harnessTypeSchema, nativeContextContinuationTurnDigest, nativeReasoningControl, profileMaterializationAxes, profileMaterializationAxes as profileMaterializationAxes$1, renderInputPartsAsText, sha256DigestSchema, workspaceCheckpointRequestDigest, workspaceCheckpointResultMatchesRequest, workspaceCleanupAcknowledgementMatches, workspaceCleanupRequestDigest } from "@tangle-network/agent-interface";
 import { estimateCost, isModelPriced, isToolSpan, toolSpansToTraceAnalysisStore } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -16,6 +16,7 @@ import { homedir, hostname, tmpdir } from "node:os";
 import { stripVTControlCharacters } from "node:util";
 import { ATTR, deriveHexId, isW3CSpanId, isW3CTraceId } from "@tangle-network/agent-trace-contract";
 import { REDACTION_VERSION as REDACTION_VERSION$1, redact } from "@tangle-network/agent-eval/traces";
+import { z } from "zod";
 import { SDKError, generateIdempotencyKey, withRetry } from "@tangle-network/agent-core";
 import { collectAgentFinalMessageText, collectAgentResponseText } from "@tangle-network/sandbox";
 import { request } from "node:http";
@@ -5308,7 +5309,7 @@ function createOtelExporter(config) {
 				body: JSON.stringify(body),
 				signal: AbortSignal.timeout(timeoutMs)
 			});
-			const text = await response.text();
+			const text = await response.text().catch(() => "");
 			if (!response.ok) {
 				const detail = text ? `: ${text.slice(0, 200)}` : "";
 				drop(batch.length, `HTTP ${response.status} from ${url}${detail}`);
@@ -5323,7 +5324,6 @@ function createOtelExporter(config) {
 	}
 	/** The single sender: it drains the queue batch by batch until the queue is empty. */
 	function drain() {
-		if (sending === void 0 && queue.length === 0) return Promise.resolve();
 		sending ??= (async () => {
 			try {
 				while (queue.length > 0) {
@@ -8579,7 +8579,10 @@ function describeLeakedReservation(leak) {
 const outcomeSchema = AgentTurnResultSchema.pick({
 	success: true,
 	error: true
-}).extend({ errorCode: AgentTurnResultSchema.shape.error }).strict();
+}).extend({
+	errorCode: AgentTurnResultSchema.shape.error,
+	statusCode: z.number().int().min(400).max(599).optional()
+}).strict();
 /** Read only the executor envelope; application output and grades are not execution status. */
 function executorFailure(result) {
 	if (result.outcome === void 0) return void 0;
@@ -8587,7 +8590,8 @@ function executorFailure(result) {
 	if (outcome.success) return void 0;
 	return {
 		error: outcome.error ?? "Agent execution failed",
-		...outcome.errorCode === void 0 ? {} : { errorCode: outcome.errorCode }
+		...outcome.errorCode === void 0 ? {} : { errorCode: outcome.errorCode },
+		...outcome.statusCode === void 0 ? {} : { statusCode: outcome.statusCode }
 	};
 }
 /** The failure text alone, for callers that record a settlement reason. */
@@ -10272,11 +10276,12 @@ function unavailableSignalInText(text) {
 /**
 * The code or status that marks a failed turn outcome as an upstream capacity refusal, or
 * `undefined`. The outcome's own `errorCode` decides first; the failure text is read only when no
-* code decided, because a harness CLI reports the router's refusal as text.
+* code or numeric status decided, because a harness CLI can report the router's refusal as text.
 */
 function unavailableSignalOfFailure(failure) {
 	const code = failure.errorCode?.toLowerCase();
 	if (code !== void 0 && UNAVAILABLE_CODES.has(code)) return code;
+	if (failure.statusCode !== void 0) return UNAVAILABLE_STATUSES.has(failure.statusCode) ? `http-${failure.statusCode}` : void 0;
 	return unavailableSignalInText(failure.error);
 }
 const DEFAULT_UNAVAILABLE_PAUSE_MS = 15e3;
@@ -10426,75 +10431,6 @@ function providerAsSandboxClient(provider, options = {}) {
 		});
 	} };
 }
-/**
-* The idle timeout this adapter sends when nothing else names one: 1,800 seconds.
-*
-* Sandbox substitutes no value of its own: an omitted field falls back to the platform's global
-* idle timeout, documented as 30 minutes unless an operator changed it, and Runtime sent none. Idle
-* means inactivity to Sandbox, which suspends the sandbox (the container stops; the workspace is
-* kept) rather than deleting it. The SDK does not define inactivity further. A request in flight
-* counts as activity: a Discovery Lab seat created with `idleTimeoutSeconds: 1800` ran one request
-* to 2,252 seconds, ended by a per-request cap, not by idling (fleet-launch-2026-08-22).
-*
-* The value restates the documented default, so it can tighten a longer operator setting but never
-* loosen the default. It is 3.8 times the longest gap between frames recorded across a healthy
-* fleet run (469 seconds, same report), and a supervised provider child is observed through an open
-* stream for its whole turn. It is a backstop for a process that dies holding an environment; the
-* settlement barrier releases retained environments itself (`Executor.releaseRetained`). It does
-* nothing on a driver with a create/delete-only lifecycle, which the SDK says skips suspension.
-*/
-const DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS = 1800;
-function sandboxIdleTimeoutSeconds(value) {
-	if (value === void 0) return DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS;
-	if (!Number.isSafeInteger(value) || value <= 0) throw new ValidationError(`sandboxClientAsProvider: idleTimeoutSeconds must be a positive whole number of seconds, got ${String(value)}`);
-	return value;
-}
-/**
-* Adapt a `SandboxClient` into the shared `AgentEnvironmentProvider` contract.
-* The provider declares the public SDK contract before it creates an environment.
-* Each environment exposes interactive methods only when its deployment declares every required capability.
-* @experimental */
-function sandboxClientAsProvider(client, options = {}) {
-	const providerName = options.name ?? "tangle-sandbox";
-	const idleTimeoutSeconds = sandboxIdleTimeoutSeconds(options.idleTimeoutSeconds);
-	const providerCapabilities = async () => {
-		const resolved = await (options.capabilities ? typeof options.capabilities === "function" ? options.capabilities() : options.capabilities : defaultTangleSandboxCapabilities({
-			namedProfiles: options.resolveProfile !== void 0,
-			rediscover: hasGet(client)
-		}));
-		if (hasGet(client)) return resolved;
-		const { interactiveAgent: _interactiveAgent, ...withoutInteractive } = resolved;
-		return withoutInteractive;
-	};
-	return {
-		name: providerName,
-		capabilities: providerCapabilities,
-		...options.validateProfile ? { validateProfile: options.validateProfile } : {},
-		async create(input) {
-			const custom = options.mapCreateInput?.(input);
-			const createOptions = custom === void 0 ? await sandboxOptionsFromCreateInput(input, options.defaultBackend ?? "opencode", options.resolveProfile, providerName, idleTimeoutSeconds) : {
-				...custom,
-				idleTimeoutSeconds: custom.idleTimeoutSeconds ?? idleTimeoutSeconds
-			};
-			const capabilities = await providerCapabilities();
-			return sandboxInstanceAsEnvironment(await client.create(createOptions, input.signal === void 0 ? void 0 : { signal: input.signal }), providerName, client, capabilities, idleTimeoutSeconds);
-		},
-		...hasGet(client) ? { async get(id) {
-			const capabilities = await providerCapabilities();
-			const box = await client.get(id);
-			return box ? sandboxInstanceAsEnvironment(box, providerName, client, capabilities, idleTimeoutSeconds) : null;
-		} } : {},
-		...hasList(client) ? { async list(query) {
-			return (await client.list(query?.providerOptions)).map((box) => ({
-				id: String(box.id),
-				provider: providerName,
-				name: typeof box.name === "string" ? box.name : void 0,
-				status: statusFromUnknown(readBoxStatus(box)),
-				metadata: readBoxMetadata(box)
-			}));
-		} } : {}
-	};
-}
 /** Only a verified, single-session capture may supply a scalar session identity. */
 function capturedSessionIdentity(provenance, coverageComplete, executionId, providerSessionId) {
 	const unknown = {
@@ -11178,7 +11114,8 @@ async function* streamProviderExecutor(args) {
 			...result.outcome?.status === "failed" ? { outcome: {
 				success: false,
 				...result.outcome.error ? { error: result.outcome.error } : {},
-				...result.outcome.errorCode ? { errorCode: result.outcome.errorCode } : {}
+				...result.outcome.errorCode ? { errorCode: result.outcome.errorCode } : {},
+				...failureStatusCode(result.outcome) === void 0 ? {} : { statusCode: failureStatusCode(result.outcome) }
 			} } : {},
 			outRef: contentRef(`provider:${args.provider.name}`, settledResult),
 			out: settledResult,
@@ -11187,7 +11124,8 @@ async function* streamProviderExecutor(args) {
 		};
 		const refusal = args.mayContinue && source.retained && result.outcome?.status === "failed" ? unavailableSignalOfFailure({
 			error: result.outcome.error ?? "",
-			...result.outcome.errorCode ? { errorCode: result.outcome.errorCode } : {}
+			...result.outcome.errorCode ? { errorCode: result.outcome.errorCode } : {},
+			...failureStatusCode(result.outcome) === void 0 ? {} : { statusCode: failureStatusCode(result.outcome) }
 		}) : void 0;
 		if (refusal !== void 0) unavailable = {
 			signal: refusal,
@@ -11568,52 +11506,6 @@ function createInputFromSandboxOptions(options) {
 		providerOptions: { sandboxCreateOptions: options ?? {} }
 	};
 }
-async function sandboxOptionsFromCreateInput(input, defaultBackend, resolveProfile, providerName = "tangle-sandbox", idleTimeoutSeconds = DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS) {
-	if (input.runtimeAttachments !== void 0) throw new ValidationError("Tangle Sandbox runtimeAttachments require an explicit mapCreateInput mapper; the maintained Sandbox SDK create contract does not transport them");
-	const backendType = input.backend ?? defaultBackend;
-	const workspace = WorkspaceRequestSchema.parse(input.workspace ?? {});
-	const environment = sandboxEnvironmentFromWorkspace(workspace);
-	const cwd = workspaceCwdPathForBase(workspace.cwd, "repository", providerName);
-	const providerOptions = input.providerOptions?.sandboxCreateOptions;
-	const base = providerOptions && typeof providerOptions === "object" ? { ...providerOptions } : {};
-	assertSandboxSecretNames(input.secrets);
-	assertSandboxSecretNames(base.secrets);
-	const profile = await sandboxProfileFromReference(input.profile, resolveProfile);
-	const { profile: _baseProfile, ...baseBackend } = base.backend ?? {};
-	return {
-		...base,
-		idleTimeoutSeconds: base.idleTimeoutSeconds ?? idleTimeoutSeconds,
-		...environment ? { environment } : {},
-		...workspace.repoUrl ? { git: {
-			url: workspace.repoUrl,
-			ref: workspace.gitRef
-		} } : {},
-		...cwd === void 0 ? {} : { cwd },
-		...input.resources ? { resources: input.resources } : {},
-		...input.env ? { env: input.env } : {},
-		...Array.isArray(input.secrets) ? { secrets: input.secrets } : {},
-		...input.metadata ? { metadata: input.metadata } : {},
-		...input.name ? { name: input.name } : {},
-		...input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {},
-		backend: {
-			...baseBackend,
-			type: backendType,
-			profile
-		}
-	};
-}
-function assertSandboxSecretNames(secrets) {
-	if (secrets !== void 0 && secrets !== "all" && (!Array.isArray(secrets) || secrets.some((secret) => typeof secret !== "string" || secret.trim().length === 0))) throw new ValidationError("Tangle Sandbox secret names must be non-empty strings; secret values are unsupported");
-}
-function sandboxEnvironmentFromWorkspace(workspace) {
-	if (workspace.environment !== void 0 && workspace.image !== void 0 && workspace.environment !== workspace.image) throw new ValidationError("Tangle Sandbox accepts one environment value; workspace.environment and workspace.image must match");
-	return workspace.environment ?? workspace.image;
-}
-async function sandboxProfileFromReference(profile, resolveProfile) {
-	if (typeof profile !== "string") return profile;
-	if (!resolveProfile) throw new ValidationError(`Tangle Sandbox requires an inline AgentProfile; named profile "${profile}" needs SandboxClientProviderOptions.resolveProfile`);
-	return resolveProfile(profile);
-}
 function environmentAsSandboxInstance(environment, options) {
 	let providerSessionId = null;
 	let controlRef;
@@ -11785,147 +11677,6 @@ function environmentAsSandboxInstance(environment, options) {
 		}
 	};
 }
-async function sandboxInstanceAsEnvironment(box, providerName, client, providerCapabilities, idleTimeoutSeconds) {
-	const capabilities = await sandboxEnvironmentCapabilities(box, providerCapabilities);
-	const interactiveAgent = capabilities.interactiveAgent;
-	return {
-		id: String(box.id),
-		provider: providerName,
-		capabilities,
-		...typeof box.name === "string" ? { name: box.name } : {},
-		...readBoxMetadata(box) ? { metadata: readBoxMetadata(box) } : {},
-		async status() {
-			await maybeRefresh(box);
-			return statusFromUnknown(readBoxStatus(box));
-		},
-		async *stream(input) {
-			for await (const event of box.streamPrompt(promptFromAgentTurnInput(input), promptOptionsFromAgentTurnInput(input))) yield environmentEventFromSandboxEvent(event);
-		},
-		...hasDispatchPrompt(box) ? { async dispatch(input) {
-			return sessionRefFromSandboxDispatch(await box.dispatchPrompt(promptFromAgentTurnInput(input), promptOptionsFromAgentTurnInput(input)), providerName);
-		} } : {},
-		...hasSession(box) ? {
-			session(id, sessionOptions) {
-				return sandboxSessionAsAgentSession(box.session(id), sessionOptions?.controlRef);
-			},
-			async respondToInteraction(command, options) {
-				return (await box.session(command.binding.sessionId).respondToInteraction(command, options)).acknowledgement;
-			}
-		} : {},
-		...interactiveAgent ? {
-			async startInteractive(request, options) {
-				const exactRequest = AgentInteractiveSessionStartSchema.parse(request);
-				assertSandboxInteractiveBinding(exactRequest.run, box, providerName);
-				const result = await box.session(exactRequest.run.sessionId).interactive().start(exactRequest, options);
-				if (result.state !== "running") throw new ValidationError("sandbox interactive process settled before attachment");
-				const ref = detachedSnapshot(AgentInteractiveSessionRefSchema.parse(result.ref), "sandbox interactive start reference");
-				if (!agentInteractiveSessionRefMatchesStart(exactRequest, ref)) throw new ValidationError("sandbox interactive start returned a different exact process");
-				return ref;
-			},
-			interactive(ref) {
-				const exactRef = detachedSnapshot(AgentInteractiveSessionRefSchema.parse(ref), "sandbox interactive reference");
-				assertSandboxInteractiveBinding(exactRef.run, box, providerName);
-				const session = box.session(exactRef.run.sessionId).interactive({ ref: exactRef });
-				const controlledSessions = /* @__PURE__ */ new Map();
-				const controlledSession = (control) => {
-					const key = canonicalCandidateDigest(control);
-					const existing = controlledSessions.get(key);
-					if (existing) return existing;
-					const created = box.session(exactRef.run.sessionId).interactive({
-						ref: exactRef,
-						control
-					});
-					controlledSessions.set(key, created);
-					return created;
-				};
-				return {
-					ref: exactRef,
-					claimControl: (request, options) => session.claimControl(request, options),
-					async status(options) {
-						const status = await session.status(options);
-						if (status === null) throw new ValidationError(`sandbox interactive session "${exactRef.run.sessionId}" is unavailable`);
-						return status;
-					},
-					attach: (request, options) => {
-						const controlled = controlledSession(request.control);
-						if (typeof controlled.attachAgentTerminal !== "function") return Promise.reject(new ValidationError("sandbox interactive session does not expose the exact terminal adapter"));
-						return controlled.attachAgentTerminal(request, options);
-					},
-					sendPrompt: (command, options) => controlledSession(command.control).sendPrompt(command, options),
-					stop: (command, options) => controlledSession(command.control).stop(command, options)
-				};
-			}
-		} : {},
-		...hasRead(box) ? { read: box.read.bind(box) } : {},
-		...hasWrite(box) ? { write: box.write.bind(box) } : {},
-		...hasExec(box) ? { async exec(command, options) {
-			return execResultFromSandboxExecResult(await box.exec(command, options));
-		} } : {},
-		async checkpoint(options) {
-			return {
-				id: (await box.snapshot({ ...options?.name ? { tags: [options.name] } : {} })).snapshotId,
-				provider: providerName,
-				...options?.metadata ? { metadata: options.metadata } : {}
-			};
-		},
-		async fork(checkpoint, options) {
-			return sandboxInstanceAsEnvironment(await client.create({
-				fromSnapshot: checkpoint.id,
-				fromSandboxId: String(box.id),
-				idleTimeoutSeconds,
-				...options?.name ? { name: options.name } : {},
-				...options?.metadata ? { metadata: options.metadata } : {}
-			}), providerName, client, providerCapabilities, idleTimeoutSeconds);
-		},
-		async placement() {
-			return placementInfoFromLoopPlacement(client.describePlacement?.(box), box);
-		},
-		async refresh() {
-			await maybeRefresh(box);
-		},
-		async destroy() {
-			await destroyBox(box);
-		}
-	};
-}
-function sandboxSessionAsAgentSession(session, expectedControlRef) {
-	const controlRef = resolveSessionControlRef(session.controlRef, expectedControlRef, { allowExpectedWhenActualAbsent: true });
-	return {
-		id: session.id,
-		...controlRef === void 0 ? {} : { controlRef },
-		async status() {
-			const status = await session.status();
-			if (!status) return null;
-			assertSandboxStatusBinding(status, controlRef);
-			return sessionStatusFromUnknown(status.status);
-		},
-		async *events(options) {
-			const executionId = scopedExecutionId(controlRef, options?.executionId);
-			for await (const event of session.events({
-				...options?.since === void 0 ? {} : { since: options.since },
-				...executionId === void 0 ? {} : { executionId },
-				...options?.signal === void 0 ? {} : { signal: options.signal }
-			})) yield environmentEventFromSandboxEvent(event);
-		},
-		async result(options) {
-			return agentTurnResultFromPromptResult(await awaitAbortable$1(Promise.resolve().then(() => session.result({ ...controlRef?.executionId === void 0 ? {} : { executionId: controlRef.executionId } })), options?.signal));
-		},
-		async prompt(input) {
-			return agentTurnResultFromPromptResult(await session.prompt(promptFromAgentTurnInput(input), promptOptionsFromAgentTurnInput(input)));
-		},
-		...session.respondToInteraction ? { async respondToInteraction(command, options) {
-			assertInteractionCommandScope(command, controlRef);
-			return (await session.respondToInteraction(command, options)).acknowledgement;
-		} } : {},
-		...session.cancelRun ? { async cancelRun(request, options) {
-			assertCancellationScope(request, controlRef);
-			return session.cancelRun(request, options);
-		} } : {},
-		cancel() {
-			return session.interrupt(controlRef?.executionId === void 0 ? void 0 : { executionId: controlRef.executionId }).then(() => void 0);
-		}
-	};
-}
 function sandboxSessionFromAgentSession(session, expectedControlRef) {
 	if (!session) throw new ValidationError("providerAsSandboxClient: session is unavailable");
 	const controlRef = resolveSessionControlRef(session.controlRef, expectedControlRef);
@@ -11999,20 +11750,6 @@ function promptResultFromAgentTurnResult(result) {
 		} : {}
 	};
 }
-function environmentEventFromSandboxEvent(event) {
-	const data = event.data && typeof event.data === "object" ? event.data : {};
-	const normalized = canonicalStreamEventFromSandboxEvent(event);
-	const usage = tokenUsageFromData(data);
-	const receipt = tokenUsageReceipt(tokenUsageRecord(data));
-	return {
-		type: String(event.type),
-		data,
-		...event.id ? { id: event.id } : {},
-		...normalized ? { normalized } : {},
-		...usage && receipt.complete ? { usage } : {},
-		providerEvent: event
-	};
-}
 function sandboxEventFromEnvironmentEvent(event) {
 	const normalized = event.normalized;
 	const type = normalized?.type ?? event.type;
@@ -12074,12 +11811,14 @@ function providerFailureEvent(event, sandboxEvent) {
 	if (!failedStatus && !failedTerminal) return void 0;
 	const detail = failureDetail(sandboxEvent.data) ?? failureDetail(outcome) ?? failureDetail(result) ?? (normalized?.type === "status" ? normalized.detail : void 0);
 	const errorCode = failureCode(sandboxEvent.data) ?? failureCode(outcome) ?? failureCode(result);
+	const statusCode = failureStatusCode(sandboxEvent.data) ?? failureStatusCode(outcome) ?? failureStatusCode(result);
 	return {
 		type: "result",
 		data: {
 			status: "failed",
 			...detail ? { error: detail } : {},
-			...errorCode ? { errorCode } : {}
+			...errorCode ? { errorCode } : {},
+			...statusCode === void 0 ? {} : { statusCode }
 		}
 	};
 }
@@ -12168,6 +11907,11 @@ function failureDetail(value) {
 	if (typeof value.message === "string") return value.message;
 	return typeof value.detail === "string" ? value.detail : void 0;
 }
+/** Preserve the Sandbox outcome's numeric HTTP metadata across the provider adapter. */
+function failureStatusCode(value) {
+	const statusCode = recordValue(value)?.statusCode;
+	return typeof statusCode === "number" && Number.isInteger(statusCode) && statusCode >= 400 && statusCode <= 599 ? statusCode : void 0;
+}
 function failureCode(value) {
 	if (!value) return void 0;
 	const error = recordValue(value.error);
@@ -12239,17 +11983,6 @@ function resolveSessionControlRef(actual, expected, options = {}) {
 	if (!sameControlCoordinates(actualExact.data, expectedExact)) throw new ValidationError("provider session returned a different exact run control reference");
 	return actualExact.data;
 }
-function assertSandboxStatusBinding(status, controlRef) {
-	if (!status || typeof status !== "object" || controlRef === void 0) return;
-	const record = status;
-	if (record.runControlRef !== void 0) {
-		if (!sameControlCoordinates(AgentExactRunControlRefSchema.parse(record.runControlRef), controlRef)) throw new ValidationError("sandbox status returned a different exact run control reference");
-	}
-	for (const key of ["activeExecutionId", "latestExecutionId"]) {
-		const executionId = record[key];
-		if (executionId !== void 0 && executionId !== controlRef.executionId) throw new ValidationError("sandbox status returned a different execution");
-	}
-}
 function assertInteractionCommandScope(command, controlRef) {
 	if (controlRef === void 0) return;
 	if (command.binding.runId !== controlRef.runId || command.binding.environmentId !== controlRef.environmentId || command.binding.sessionId !== controlRef.sessionId || command.binding.executionId !== controlRef.executionId) throw new ValidationError("interaction response targeted a different execution");
@@ -12387,50 +12120,6 @@ function isUsageType(type) {
 function isNestedUsageType(type) {
 	return isSandboxTerminalEvent(type) && sandboxTerminalUsageField(type) === "usage";
 }
-function tokenUsageFromData(data) {
-	const usageRecord = tokenUsageRecord(data);
-	const inputTokens = inputTokensFromUsage(usageRecord);
-	const outputTokens = outputTokensFromUsage(usageRecord);
-	const totalTokens = finiteNumber(usageRecord.totalTokens);
-	const cacheReadInputTokens = finiteNumber(usageRecord.cacheReadInputTokens);
-	const cacheCreationInputTokens = finiteNumber(usageRecord.cacheCreationInputTokens);
-	const reasoningTokens = finiteNumber(usageRecord.reasoningTokens);
-	const cost = finiteNumber(usageRecord.cost) ?? finiteNumber(usageRecord.costUsd) ?? finiteNumber(usageRecord.totalCostUsd) ?? finiteNumber(data.costUsd) ?? finiteNumber(data.totalCostUsd);
-	if (inputTokens === void 0 && outputTokens === void 0 && totalTokens === void 0 && cacheReadInputTokens === void 0 && cacheCreationInputTokens === void 0 && reasoningTokens === void 0 && cost === void 0) return void 0;
-	return {
-		inputTokens: inputTokens ?? 0,
-		outputTokens: outputTokens ?? 0,
-		...totalTokens !== void 0 ? { totalTokens } : {},
-		...cacheReadInputTokens !== void 0 ? { cacheReadInputTokens } : {},
-		...cacheCreationInputTokens !== void 0 ? { cacheCreationInputTokens } : {},
-		...reasoningTokens !== void 0 ? { reasoningTokens } : {},
-		...cost !== void 0 ? { cost } : {}
-	};
-}
-function tokenUsageRecord(data) {
-	return recordValue(data.usage) ?? recordValue(data.tokenUsage) ?? data;
-}
-function inputTokensFromUsage(value) {
-	const usage = recordValue(value);
-	if (!usage) return void 0;
-	return finiteNumber(usage.inputTokens) ?? finiteNumber(usage.tokensIn) ?? finiteNumber(usage.prompt_tokens);
-}
-function outputTokensFromUsage(value) {
-	const usage = recordValue(value);
-	if (!usage) return void 0;
-	return finiteNumber(usage.outputTokens) ?? finiteNumber(usage.tokensOut) ?? finiteNumber(usage.completion_tokens);
-}
-function tokenUsageReceipt(value) {
-	const usage = recordValue(value);
-	const hasInput = inputTokensFromUsage(usage) !== void 0;
-	const hasOutput = outputTokensFromUsage(usage) !== void 0;
-	return {
-		hasInput,
-		hasOutput,
-		hasTokens: hasInput || hasOutput || finiteNumber(usage?.totalTokens) !== void 0 || finiteNumber(usage?.cacheReadInputTokens) !== void 0 || finiteNumber(usage?.cacheCreationInputTokens) !== void 0 || finiteNumber(usage?.reasoningTokens) !== void 0,
-		complete: hasInput && hasOutput
-	};
-}
 function mergeTokenUsage(left, right) {
 	if (!left) return right;
 	if (!right) return left;
@@ -12444,21 +12133,9 @@ function mergeTokenUsage(left, right) {
 		...left.cost !== void 0 || right.cost !== void 0 ? { cost: (left.cost ?? 0) + (right.cost ?? 0) } : {}
 	};
 }
-function finiteNumber(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
 function stringValue(value) {
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-function agentTurnResultFromPromptResult(result) {
-	const record = result;
-	return {
-		text: typeof record.response === "string" ? record.response : typeof record.text === "string" ? record.text : typeof record.finalText === "string" ? record.finalText : "",
-		success: typeof record.success === "boolean" ? record.success : true,
-		...typeof record.error === "string" ? { error: record.error } : {},
-		usage: tokenUsageFromData(record)
-	};
-}
 function sandboxDispatchResultFromSessionRef(session) {
 	const controlRef = session.controlRef === void 0 ? void 0 : AgentExactRunControlRefSchema.parse(session.controlRef);
 	const metadataExecutionId = optionalDispatchIdentity(session.metadata?.executionId, "executionId");
@@ -12479,50 +12156,11 @@ function sandboxDispatchResultFromSessionRef(session) {
 		}
 	};
 }
-function sessionRefFromSandboxDispatch(dispatched, providerName) {
-	const record = dispatched && typeof dispatched === "object" ? dispatched : void 0;
-	const id = record?.sessionId ?? record?.id;
-	if (typeof id !== "string" || id.length === 0) throw new ValidationError("sandboxClientAsProvider: dispatch returned no session id");
-	if (!record) throw new ValidationError("sandboxClientAsProvider: dispatch returned no session record");
-	const executionId = optionalDispatchIdentity(record.executionId, "executionId");
-	const controlRef = record.runControlRef === void 0 ? void 0 : AgentExactRunControlRefSchema.parse(record.runControlRef);
-	if (controlRef !== void 0) {
-		if (controlRef.sessionId !== id || controlRef.provider !== providerName) throw new ValidationError("sandbox dispatch returned a control reference for another session");
-		if (executionId !== void 0 && controlRef.executionId !== executionId) throw new ValidationError("sandbox dispatch returned conflicting execution identities");
-	}
-	if (record.alreadyExisted !== void 0 && typeof record.alreadyExisted !== "boolean") throw new ValidationError("sandbox dispatch returned an invalid alreadyExisted flag");
-	if (record.dispatched !== void 0 && typeof record.dispatched !== "boolean") throw new ValidationError("sandbox dispatch returned an invalid dispatched flag");
-	if (record.status !== void 0 && !isSandboxSessionStatus(record.status)) throw new ValidationError("sandbox dispatch returned an invalid session status");
-	return {
-		id,
-		provider: providerName,
-		...controlRef === void 0 ? {} : { controlRef },
-		metadata: {
-			...record.status ? { status: record.status } : {},
-			...executionId === void 0 ? {} : { executionId },
-			...record.alreadyExisted !== void 0 ? { alreadyExisted: record.alreadyExisted } : {},
-			...record.dispatched !== void 0 ? { dispatched: record.dispatched } : {}
-		}
-	};
-}
 function optionalDispatchIdentity(value, label) {
 	if (value === void 0) return void 0;
 	if (typeof value !== "string" || value.length === 0) throw new ValidationError(`sandbox dispatch returned an invalid ${label}`);
 	return value;
 }
-function isSandboxSessionStatus(value) {
-	return value === "queued" || value === "running" || value === "completed" || value === "failed" || value === "cancelled";
-}
-function execResultFromSandboxExecResult(result) {
-	const record = result;
-	const exitCode = finiteNumber(record.exitCode) ?? finiteNumber(record.code);
-	if (exitCode === void 0) throw new ValidationError("sandboxClientAsProvider: exec returned no exit code");
-	return {
-		exitCode,
-		stdout: typeof record.stdout === "string" ? record.stdout : "",
-		stderr: typeof record.stderr === "string" ? record.stderr : ""
-	};
-}
 function statusFromUnknown(status) {
 	if (status === "pending" || status === "provisioning" || status === "running") return status;
 	if (status === "stopped" || status === "failed" || status === "expired") return status;
@@ -12534,133 +12172,6 @@ function sessionStatusFromUnknown(status) {
 	if (status === "completed" || status === "cancelled") return status;
 	return statusFromUnknown(status);
 }
-function readBoxStatus(box) {
-	return box.status;
-}
-function readBoxMetadata(box) {
-	const metadata = box.metadata;
-	return metadata && typeof metadata === "object" ? metadata : void 0;
-}
-async function maybeRefresh(box) {
-	const refresh = box.refresh;
-	if (typeof refresh === "function") await refresh.call(box);
-}
-async function destroyBox(box) {
-	const deleteBox = box.delete;
-	if (typeof deleteBox === "function") await deleteBox.call(box);
-}
-function placementInfoFromLoopPlacement(placement, box) {
-	if (!placement) return {
-		kind: "sandbox",
-		sandboxId: String(box.id)
-	};
-	return {
-		kind: placement.kind === "fleet" ? "fleet" : placement.kind === "in-process" ? "local" : "sandbox",
-		...placement.sandboxId ? { sandboxId: placement.sandboxId } : { sandboxId: String(box.id) },
-		...placement.fleetId ? { fleetId: placement.fleetId } : {},
-		...placement.machineId ? { machineId: placement.machineId } : {}
-	};
-}
-const completeInteractiveAgentCapabilities = {
-	start: true,
-	control: true,
-	status: true,
-	attach: true,
-	reattach: true,
-	sendPrompt: true,
-	input: true,
-	resize: true,
-	stop: true
-};
-async function sandboxEnvironmentCapabilities(box, providerCapabilities) {
-	const { interactiveAgent: providerInteractive, ...baseCapabilities } = providerCapabilities;
-	if (!hasCompleteInteractiveAgentCapabilities(providerInteractive)) return baseCapabilities;
-	let deployed;
-	try {
-		deployed = await box.capabilities();
-	} catch {
-		return baseCapabilities;
-	}
-	if (!hasCompleteInteractiveAgentCapabilities(deployed?.interactiveAgent)) return baseCapabilities;
-	if (!hasExactInteractiveTerminalAdapter(box)) return baseCapabilities;
-	return {
-		...baseCapabilities,
-		interactiveAgent: { ...completeInteractiveAgentCapabilities }
-	};
-}
-function hasExactInteractiveTerminalAdapter(box) {
-	if (!hasSession(box)) return false;
-	try {
-		const session = box.session("__runtime-capability-probe__");
-		const interactive = session.interactive;
-		if (typeof interactive !== "function") return false;
-		return typeof interactive.call(session).attachAgentTerminal === "function";
-	} catch {
-		return false;
-	}
-}
-function hasCompleteInteractiveAgentCapabilities(value) {
-	return value?.start === true && value.control === true && value.status === true && value.attach === true && value.reattach === true && value.sendPrompt === true && value.input === true && value.resize === true && value.stop === true;
-}
-function assertSandboxInteractiveBinding(run, box, providerName) {
-	if (run.provider !== providerName || run.environmentId !== String(box.id)) throw new ValidationError("sandbox interactive request targets another environment");
-}
-function defaultTangleSandboxCapabilities(options) {
-	return {
-		profile: {
-			namedProfiles: options.namedProfiles,
-			systemPrompt: { ...harnessSystemPromptIntents(void 0) },
-			instructions: true,
-			tools: true,
-			permissions: true,
-			mcp: true,
-			subagents: true,
-			resources: {
-				files: true,
-				instructions: true,
-				tools: true,
-				skills: true,
-				agents: true,
-				commands: true
-			},
-			hooks: true,
-			modes: true,
-			runtimeUpdate: true,
-			validation: true
-		},
-		streaming: {
-			live: true,
-			replay: true,
-			detach: true,
-			turnIdempotency: true
-		},
-		sessions: {
-			continue: true,
-			list: true,
-			messages: true
-		},
-		workspace: {
-			read: true,
-			write: true,
-			exec: true,
-			git: true,
-			upload: true,
-			download: true,
-			cwdBases: {
-				repository: true,
-				host: false
-			}
-		},
-		branching: {
-			checkpoint: false,
-			fork: false
-		},
-		...options.rediscover ? { interactiveAgent: { ...completeInteractiveAgentCapabilities } } : {},
-		placement: true,
-		usage: true,
-		confidential: false
-	};
-}
 function contentRef(prefix, value) {
 	let str;
 	try {
@@ -12675,164 +12186,6 @@ function contentRef(prefix, value) {
 	}
 	return `${prefix}:${(hash >>> 0).toString(16).padStart(8, "0")}`;
 }
-function hasGet(client) {
-	return typeof client.get === "function";
-}
-function hasList(client) {
-	return typeof client.list === "function";
-}
-function hasDispatchPrompt(box) {
-	return typeof box.dispatchPrompt === "function";
-}
-function hasSession(box) {
-	return typeof box.session === "function";
-}
-function hasRead(box) {
-	return typeof box.read === "function";
-}
-function hasWrite(box) {
-	return typeof box.write === "function";
-}
-function hasExec(box) {
-	return typeof box.exec === "function";
-}
-//#endregion
-//#region src/runtime/model-identity.ts
-const SNAPSHOT_TOKEN = /^[A-Za-z0-9._-]+$/u;
-const datedIsoSuffix = /^(.*)-(\d{4})-(\d{2})-(\d{2})$/u;
-const datedCompactSuffix = /^(.*)-(\d{4})(\d{2})(\d{2})$/u;
-const datedMonthSuffix = /^(.*)-(\d{4})-(\d{2})$/u;
-/** Match equivalent bare and provider-qualified spellings without discarding observed identity. */
-function observedModelMatchesDeclared(observed, declared) {
-	const observedIdentity = modelIdentityParts(observed);
-	const declaredIdentity = modelIdentityParts(declared);
-	if (!observedIdentity || !declaredIdentity) return false;
-	if (declaredIdentity.snapshot !== void 0 && (observedIdentity.snapshot !== declaredIdentity.snapshot || observedIdentity.snapshotKind !== declaredIdentity.snapshotKind)) return false;
-	return equivalentModelBase(observedIdentity.base, declaredIdentity.base);
-}
-/** Merge two observations of one served model while retaining a snapshot-bearing raw identity. */
-function mergeObservedModelIdentity(current, next) {
-	const currentIdentity = modelIdentityParts(current);
-	const nextIdentity = modelIdentityParts(next);
-	if (!currentIdentity || !nextIdentity) return void 0;
-	if (!equivalentModelBase(currentIdentity.base, nextIdentity.base)) return void 0;
-	if (currentIdentity.snapshot !== void 0 && nextIdentity.snapshot !== void 0 && (currentIdentity.snapshot !== nextIdentity.snapshot || currentIdentity.snapshotKind !== nextIdentity.snapshotKind)) return;
-	return currentIdentity.snapshot === void 0 && nextIdentity.snapshot !== void 0 ? next : current;
-}
-/** Return the canonical model and its validated snapshot kind for runtime evidence reduction. */
-function canonicalObservedModelParts(model) {
-	const identity = modelIdentityParts(model);
-	if (!identity) return void 0;
-	const base = identity.base.slice(identity.base.lastIndexOf("/") + 1);
-	const canonical = identity.snapshot === void 0 ? base : identity.snapshotKind === "date" ? `${base}-${identity.snapshot}` : `${base}@${identity.snapshot}`;
-	return {
-		base,
-		...identity.snapshot !== void 0 ? { snapshot: identity.snapshot } : {},
-		...identity.snapshotKind !== void 0 ? { snapshotKind: identity.snapshotKind } : {},
-		canonical
-	};
-}
-/** Return whether an observed identity includes a provider snapshot. */
-function observedModelHasSnapshot(model) {
-	return modelIdentityParts(model)?.snapshot !== void 0;
-}
-function modelIdentityParts(model) {
-	if (model.length === 0) return null;
-	const at = model.lastIndexOf("@");
-	if (at < 0) {
-		const dated = datedModelIdentity(model);
-		if (dated !== void 0) return dated;
-		return modelLeaf(model).length === 0 ? null : { base: model };
-	}
-	const base = model.slice(0, at);
-	const snapshot = model.slice(at + 1);
-	if (base.length === 0 || modelLeaf(base).length === 0 || !SNAPSHOT_TOKEN.test(snapshot)) return null;
-	return {
-		base,
-		snapshot,
-		snapshotKind: "opaque"
-	};
-}
-function equivalentModelBase(observed, declared) {
-	const observedPath = modelBaseParts(observed);
-	const declaredPath = modelBaseParts(declared);
-	if (!samePath(observedPath.path, declaredPath.path)) return false;
-	if (observedPath.provider === void 0 || declaredPath.provider === void 0 || observedPath.provider === declaredPath.provider) return true;
-	if (observedPath.provider === "tangle-router" || declaredPath.provider === "tangle-router") {
-		const router = observedPath.provider === "tangle-router" ? observedPath : declaredPath;
-		const upstream = observedPath.provider === "tangle-router" ? declaredPath : observedPath;
-		if (upstream.provider === void 0) return false;
-		return samePath(router.path, upstream.path) || router.path[0] === upstream.provider && samePath(router.path.slice(1), upstream.path);
-	}
-	return false;
-}
-function modelBaseParts(model) {
-	const segments = model.split("/");
-	const normalized = segments.length > 1 && isHarnessPrefix(segments[0]) ? segments.slice(1) : segments;
-	if (normalized.length === 1) return {
-		provider: void 0,
-		path: normalized
-	};
-	return {
-		provider: normalized[0],
-		path: normalized.slice(1)
-	};
-}
-function isHarnessPrefix(segment) {
-	return segment !== void 0 && harnessTypeSchema.safeParse(segment).success;
-}
-function samePath(left, right) {
-	return left.length === right.length && left.every((segment, index) => segment === right[index]);
-}
-function modelLeaf(model) {
-	return model.slice(model.lastIndexOf("/") + 1);
-}
-/**
-* Parse the provider's documented dated snapshot forms.
-*
-* `undefined` means that the model has no dated shape and must be treated as a normal base.
-* `null` means that it has a dated shape but the date is invalid, so identity matching fails.
-*/
-function datedModelIdentity(model) {
-	const iso = datedIsoSuffix.exec(model);
-	if (iso) {
-		const [, base, yearText, monthText, dayText] = iso;
-		return buildDatedIdentity(base, `${yearText}-${monthText}-${dayText}`, isValidCalendarDate(yearText, monthText, dayText));
-	}
-	const compact = datedCompactSuffix.exec(model);
-	if (compact) {
-		const [, base, yearText, monthText, dayText] = compact;
-		return buildDatedIdentity(base, `${yearText}-${monthText}-${dayText}`, isValidCalendarDate(yearText, monthText, dayText));
-	}
-	const month = datedMonthSuffix.exec(model);
-	if (month) {
-		const [, base, yearText, monthText] = month;
-		return buildDatedIdentity(base, `${yearText}-${monthText}`, isValidCalendarMonth(yearText, monthText));
-	}
-}
-function buildDatedIdentity(base, snapshot, valid) {
-	if (base === void 0 || base.length === 0 || base.endsWith("/")) return void 0;
-	return valid ? {
-		base,
-		snapshot,
-		snapshotKind: "date"
-	} : null;
-}
-function isValidCalendarDate(yearText, monthText, dayText) {
-	if (yearText === void 0 || monthText === void 0 || dayText === void 0) return false;
-	const year = Number(yearText);
-	const month = Number(monthText);
-	const day = Number(dayText);
-	if (year < 2e3 || year > 2099 || month < 1 || month > 12 || day < 1 || day > 31) return false;
-	const date = new Date(Date.UTC(year, month - 1, day));
-	return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
-}
-function isValidCalendarMonth(yearText, monthText) {
-	if (yearText === void 0 || monthText === void 0) return false;
-	const year = Number(yearText);
-	const month = Number(monthText);
-	return year >= 2e3 && year <= 2099 && month >= 1 && month <= 12;
-}
 //#endregion
 //#region src/runtime/tool-loop.ts
 /**
@@ -13098,7 +12451,7 @@ async function routerChatWithTools(cfg, messages, tools, opts) {
 	let transportAttempts = 1;
 	const headers = routerRequestHeaders(cfg, opts);
 	const complete = cfg.complete;
-	const data = complete ? await (async () => {
+	const raw = complete ? await (async () => {
 		const result = await retryRouterOperation(retry, opts?.signal, (signal) => complete(structuredClone(body), {
 			headers,
 			signal
@@ -13110,10 +12463,11 @@ async function routerChatWithTools(cfg, messages, tools, opts) {
 			method: "POST",
 			headers,
 			body: JSON.stringify(body)
-		}, opts?.signal, retry);
+		}, opts?.signal, retry, opts?.onResponse);
 		transportAttempts = result.attempts;
 		return routerResponseJson(result.response, result.attempts);
 	})();
+	const data = raw;
 	const msg = data.choices?.[0]?.message;
 	if (!msg) throw new ValidationError$1("router completion: no choices[0].message");
 	const toolCalls = (msg?.tool_calls ?? []).map((tc, i) => ({
@@ -13123,6 +12477,7 @@ async function routerChatWithTools(cfg, messages, tools, opts) {
 	}));
 	const { usage, resources, costUsd, costProvenance, billedCostUsd, cache } = meterTurn(data.usage, cfg.model, transportAttempts);
 	return {
+		response: raw,
 		content: msg?.content ?? null,
 		toolCalls,
 		transportAttempts,
@@ -13349,12 +12704,64 @@ function routerRequestHeaders(cfg, opts) {
 function reportedModel(value) {
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-async function fetchRouterResponse(url, init, callerSignal, retry) {
+async function fetchRouterResponse(url, init, callerSignal, retry, onResponse) {
+	let attempt = 0;
 	const result = await retryRouterOperation(retry, callerSignal, async (signal) => {
-		const candidate = await fetch(url, {
-			...init,
-			signal
-		});
+		attempt += 1;
+		const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+		let candidate;
+		try {
+			candidate = await fetch(url, {
+				...init,
+				signal
+			});
+		} catch (error) {
+			await observeRouterResponse(onResponse, {
+				endpoint: url,
+				callId: new Headers(init.headers).get("idempotency-key") ?? "",
+				attempt,
+				startedAt,
+				endedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				status: null,
+				headers: {},
+				body: null,
+				error: {
+					name: error instanceof Error ? error.name : "Error",
+					message: error instanceof Error ? error.message : String(error)
+				}
+			}, signal);
+			throw error;
+		}
+		if (onResponse) {
+			const headers = Object.fromEntries([...candidate.headers].filter(([name]) => ![
+				"authorization",
+				"proxy-authorization",
+				"set-cookie",
+				"cookie"
+			].includes(name.toLowerCase())));
+			let body = null;
+			let bodyError;
+			try {
+				body = await candidate.clone().text();
+			} catch (error) {
+				bodyError = error;
+			}
+			await observeRouterResponse(onResponse, {
+				endpoint: url,
+				callId: new Headers(init.headers).get("idempotency-key") ?? "",
+				attempt,
+				startedAt,
+				endedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				status: candidate.status,
+				headers,
+				body,
+				...bodyError === void 0 ? {} : { error: {
+					name: bodyError instanceof Error ? bodyError.name : "Error",
+					message: bodyError instanceof Error ? bodyError.message : String(bodyError)
+				} }
+			}, signal);
+			if (bodyError !== void 0) throw bodyError;
+		}
 		if (candidate.ok) return candidate;
 		const text = await candidate.text().catch(() => "<failed to read response body>");
 		throw new SDKError(`router ${candidate.status}: ${text.slice(0, 200)}`, {
@@ -13369,6 +12776,28 @@ async function fetchRouterResponse(url, init, callerSignal, retry) {
 		attempts: result.attempts
 	};
 }
+/** Evidence failure cannot authorize a second inference, even after the request deadline. */
+async function observeRouterResponse(observer, receipt, signal) {
+	if (!observer) return;
+	let onAbort;
+	try {
+		const aborted = new Promise((_resolve, reject) => {
+			onAbort = () => reject(signal.reason ?? /* @__PURE__ */ new Error("Response observation aborted"));
+			if (signal.aborted) onAbort();
+			else signal.addEventListener("abort", onAbort, { once: true });
+		});
+		await Promise.race([Promise.resolve().then(() => observer(receipt)), aborted]);
+	} catch (error) {
+		throw new SDKError("Router response observation failed", {
+			code: "UNKNOWN",
+			retryable: false,
+			cause: error instanceof Error ? error : new Error(String(error)),
+			context: { phase: "response_observation" }
+		});
+	} finally {
+		if (onAbort) signal.removeEventListener("abort", onAbort);
+	}
+}
 async function retryRouterOperation(retry, callerSignal, operation) {
 	let attempts = 0;
 	try {
@@ -13379,6 +12808,7 @@ async function retryRouterOperation(retry, callerSignal, operation) {
 				try {
 					return await operation(attemptSignal.signal);
 				} catch (error) {
+					if (error instanceof SDKError && error.context?.phase === "response_observation") throw error;
 					if (callerSignal?.aborted) throw callerSignal.reason ?? error;
 					if (attemptSignal.signal.aborted) throw new SDKError(`router request timeout after ${retry.requestTimeoutMs}ms`, {
 						code: "TIMEOUT",
@@ -18623,6 +18053,7 @@ const ROUTER_TRANSCRIPT_HARNESS = "router";
 const TURN_CONTENT_BYTES = 256 * 1024;
 function createRouterTranscript() {
 	const kept = [];
+	const records = [];
 	const seen = /* @__PURE__ */ new WeakSet();
 	let turnStart = 0;
 	let replyEchoPending = false;
@@ -18637,10 +18068,17 @@ function createRouterTranscript() {
 				if (message.role === "assistant") continue;
 			}
 			kept.push(message);
+			records.push(message);
 		}
 	};
 	return {
 		observe,
+		response(receipt) {
+			records.push({
+				type: "provider.response",
+				...receipt
+			});
+		},
 		reply(reply) {
 			const message = {
 				role: "assistant",
@@ -18655,6 +18093,7 @@ function createRouterTranscript() {
 				})) } : {}
 			};
 			kept.push(message);
+			records.push(message);
 			replyEchoPending = true;
 			const added = kept.slice(turnStart).map(forTurnEvent);
 			turnStart = kept.length;
@@ -18663,7 +18102,7 @@ function createRouterTranscript() {
 		capture() {
 			if (live !== void 0) observe(live);
 			if (kept.length === 0) return harnessTranscriptUnavailable("execution-never-started");
-			return harnessTranscriptFromLines(ROUTER_TRANSCRIPT_HARNESS, "conversation", kept.map((message) => JSON.stringify(message)));
+			return harnessTranscriptFromLines(ROUTER_TRANSCRIPT_HARNESS, "conversation", records.map((record) => JSON.stringify(record)));
 		}
 	};
 }
@@ -19501,6 +18940,7 @@ const routerToolsInlineExecutor = (spec, ctx) => {
 		routerKey: seam.routerKey,
 		tools: seam.tools
 	}, { multiTurn: true });
+	if (model === "tangle/auto") assertRouterAutoDeclaration(profileExecution.extraBody?.auto, profileExecution.stream);
 	const enabledToolNames = new Set(seam.tools.map((tool) => tool.function.name));
 	const maxTurns = profileExecution.maxTurns ?? 0;
 	const requestIdentity = routerRequestIdentity(ctx);
@@ -19529,6 +18969,7 @@ const routerToolsInlineExecutor = (spec, ctx) => {
 			let resources;
 			let transportAttempts = 0;
 			let observedModel;
+			const providerResponses = [];
 			let reasoningTokens = 0;
 			let reasoningKnown = true;
 			const promptCache = {};
@@ -19565,6 +19006,11 @@ const routerToolsInlineExecutor = (spec, ctx) => {
 						}, messages, seam.tools, {
 							...profileExecution.temperature !== void 0 ? { temperature: profileExecution.temperature } : {},
 							signal: turnController.signal,
+							onResponse: async (receipt) => {
+								providerResponses.push(receipt);
+								transcript.response(receipt);
+								await seam.onProviderResponse?.(structuredClone(receipt));
+							},
 							...profileExecution.toolChoice ? { toolChoice: profileExecution.toolChoice } : {},
 							...profileExecution.tokenLimits.applied,
 							...profileExecution.seed !== void 0 ? { seed: profileExecution.seed } : {},
@@ -19602,7 +19048,12 @@ const routerToolsInlineExecutor = (spec, ctx) => {
 					}]))).resources;
 					transportAttempts += res.transportAttempts;
 					if (res.model !== void 0) recordRuntimeOwnedProviderModel(executor, res.model);
-					assertObservedRouterModel(res.model, model, "routerToolsInlineExecutor");
+					if (model === "tangle/auto") {
+						assertRouterAutoResponse(profileExecution.extraBody?.auto, res.response, res.model);
+						tokensKnown = false;
+						reasoningKnown = false;
+						usdKnown = false;
+					} else assertObservedRouterModel(res.model, model, "routerToolsInlineExecutor");
 					if (res.model !== void 0) observedModel = res.model;
 					mergePromptCache(promptCache, res.cache);
 					if (res.usage) {
@@ -19724,6 +19175,7 @@ const routerToolsInlineExecutor = (spec, ctx) => {
 				turns,
 				toolCalls: executedToolCalls,
 				transportAttempts,
+				providerResponses,
 				...estimatedUsd !== void 0 ? { estimatedCostUsd: estimatedUsd } : {},
 				...Object.keys(promptCache).length > 0 ? { promptCache } : {},
 				...reasoningKnown && turns > 0 ? { reasoningTokens } : {}
@@ -20552,12 +20004,13 @@ const cliInPlaceExecutor = (spec, ctx) => {
 function snapshotExecutorConfig(config) {
 	switch (config.backend) {
 		case "router-tools": {
-			const { complete, executeToolCall, onMessages, onToolStep, ...decisionData } = config;
+			const { complete, executeToolCall, onMessages, onToolStep, onProviderResponse, ...decisionData } = config;
 			const snapshot = detachedSnapshot(decisionData, "createExecutor router-tools config");
 			return Object.freeze({
 				...snapshot,
 				...complete === void 0 ? {} : { complete },
 				executeToolCall,
+				...onProviderResponse === void 0 ? {} : { onProviderResponse },
 				...onMessages === void 0 ? {} : { onMessages },
 				...onToolStep === void 0 ? {} : { onToolStep }
 			});
@@ -23260,21 +22713,22 @@ async function ownerWorkspaceRetentionFailures(events, nodeId, blobs) {
 		if (event.kind === "execution-input") {
 			flush();
 			current = {
+				executionId: `${nodeId}:input:${event.seq}`,
 				environmentIds: /* @__PURE__ */ new Set(),
-				executionByEnvironment: /* @__PURE__ */ new Map()
+				controlByEnvironment: /* @__PURE__ */ new Map()
 			};
 		} else if (event.kind === "execution-admitted" && event.admission.phase === "environment") {
 			if (current?.result !== void 0) flush();
 			current ??= {
 				environmentIds: /* @__PURE__ */ new Set(),
-				executionByEnvironment: /* @__PURE__ */ new Map()
+				controlByEnvironment: /* @__PURE__ */ new Map()
 			};
 			current.environmentIds.add(event.admission.environmentId);
-			current.executionByEnvironment.set(event.admission.environmentId, event.admission.executionId);
-		} else if (event.kind === "execution-result") {
+		} else if (event.kind === "execution-admitted" && event.admission.phase === "dispatched") current?.controlByEnvironment.set(event.admission.controlRef.environmentId, event.admission.controlRef);
+		else if (event.kind === "execution-result") {
 			current ??= {
 				environmentIds: /* @__PURE__ */ new Set(),
-				executionByEnvironment: /* @__PURE__ */ new Map()
+				controlByEnvironment: /* @__PURE__ */ new Map()
 			};
 			current.result = event;
 		}
@@ -23301,20 +22755,21 @@ async function ownerWorkspaceRetentionFailures(events, nodeId, blobs) {
 		}
 		const snapshot = output !== null && typeof output === "object" ? output.workspaceSnapshot : void 0;
 		const environmentId = [...attempt.environmentIds][0];
-		const executionId = attempt.executionByEnvironment.get(environmentId);
-		if (!hasDurableWorkspaceCapture(output, snapshot, environmentId, executionId)) failures.add(environmentId);
+		const controlRef = attempt.controlByEnvironment.get(environmentId);
+		if (!hasDurableWorkspaceCapture(output, snapshot, environmentId, attempt.executionId, controlRef)) failures.add(environmentId);
 	}
 	return failures;
 }
 /** A stored result authorizes cleanup only for the exact source and complete capture. */
-function hasDurableWorkspaceCapture(output, snapshot, environmentId, executionId) {
+function hasDurableWorkspaceCapture(output, snapshot, environmentId, executionId, controlRef) {
 	const parsed = agentCandidateWorkspaceSnapshotEvidenceSchema.safeParse(snapshot);
 	if (!parsed.success || !("locator" in parsed.data.manifest) || !("locator" in parsed.data.archive)) return false;
 	if (output === null || typeof output !== "object") return false;
 	const capture = output.workspaceCapture;
 	if (capture === null || typeof capture !== "object") return false;
 	const receipt = capture;
-	if (receipt.environmentId !== environmentId || receipt.executionId !== executionId || receipt.coverageComplete !== true) return false;
+	const capturedControl = AgentExactRunControlRefSchema.safeParse(receipt.controlRef);
+	if (executionId === void 0 || controlRef === void 0 || !capturedControl.success || !sameControlCoordinates(capturedControl.data, controlRef) || receipt.environmentId !== environmentId || receipt.executionId !== executionId || receipt.coverageComplete !== true) return false;
 	const linked = agentCandidateWorkspaceSnapshotEvidenceSchema.safeParse(receipt.snapshot);
 	return linked.success && linked.data.digest === parsed.data.digest && JSON.stringify(linked.data.manifest) === JSON.stringify(parsed.data.manifest) && JSON.stringify(linked.data.archive) === JSON.stringify(parsed.data.archive);
 }
@@ -26506,7 +25961,7 @@ function isInfraError(err) {
 * journal so the executor can run its `act` inside a nested scope. `act` fails loud if
 * called directly — a driver child runs THROUGH its nested-scope executor, never as a root.
 */
-function driverChild(profile, driver, journal, execution, acceptedSubmission, recoverExecutor) {
+function driverChild(profile, driver, journal, execution, acceptedSubmission, recoverExecutor, unassessedOutput) {
 	const name = profile.name ?? driver.name;
 	const traceSource = driver.traceSource;
 	const progress = driver.progress;
@@ -26519,6 +25974,7 @@ function driverChild(profile, driver, journal, execution, acceptedSubmission, re
 		driver,
 		journal,
 		...acceptedSubmission ? { acceptedSubmission } : {},
+		...unassessedOutput ? { unassessedOutput } : {},
 		...recoverExecutor ? { recoverExecutor } : {},
 		...traceSource ? { traceSource } : {},
 		...progress ? { progress } : {},
@@ -26642,7 +26098,8 @@ const driverExecutorFactory = (rawSpec, ctx) => {
 					reported: childWork,
 					reservation: addSpend(childWork, totalMetered)
 				};
-				const verdict = deriveDeliveryVerdict(events.filter((event) => event.kind === "settled"), out, spec.acceptedSubmission?.() === true);
+				const acceptedSubmission = spec.acceptedSubmission?.() === true;
+				const verdict = !acceptedSubmission && spec.unassessedOutput?.() === true ? void 0 : deriveDeliveryVerdict(events.filter((event) => event.kind === "settled"), out, acceptedSubmission);
 				artifact = {
 					outRef: `${driverRuntime}:${nestedRoot}`,
 					out: out === void 0 ? null : out,
@@ -27456,11 +26913,18 @@ const DETERMINISTIC_BRIDGE_CODES = /* @__PURE__ */ new Set([
 var HarnessTurnFailedError = class extends Error {
 	runtime;
 	errorCode;
+	statusCode;
+	/** The shared HTTP error reader also uses this status for persisted diagnostics. */
+	status;
 	constructor(runtime, failure) {
 		super(`${runtime} harness turn ended with a failed outcome` + (failure.errorCode === void 0 ? "" : ` (${failure.errorCode})`) + `: ${failure.error}`);
 		this.name = "HarnessTurnFailedError";
 		this.runtime = runtime;
 		if (failure.errorCode !== void 0) this.errorCode = failure.errorCode;
+		if (failure.statusCode !== void 0) {
+			this.statusCode = failure.statusCode;
+			this.status = failure.statusCode;
+		}
 	}
 };
 /**
@@ -27477,7 +26941,8 @@ function upstreamUnavailableSignal(error) {
 	if (error instanceof CheckUnavailableError) return "check-unavailable";
 	if (error instanceof HarnessTurnFailedError) return unavailableSignalOfFailure({
 		error: error.message,
-		...error.errorCode === void 0 ? {} : { errorCode: error.errorCode }
+		...error.errorCode === void 0 ? {} : { errorCode: error.errorCode },
+		...error.statusCode === void 0 ? {} : { statusCode: error.statusCode }
 	});
 	if (error instanceof BackendTransportError) {
 		const code = error.upstreamCode?.toLowerCase();
@@ -27509,7 +26974,8 @@ function classifyDriverFailure(error, signal) {
 	if (error instanceof Error && errorProperty(error, "name") === "AbortError") return "terminal";
 	if (error instanceof HarnessTurnFailedError) {
 		if (error.errorCode !== void 0 && DETERMINISTIC_BRIDGE_CODES.has(error.errorCode)) return "terminal";
-		return isUpstreamUnavailable(error) ? "unavailable" : "transient";
+		if (isUpstreamUnavailable(error)) return "unavailable";
+		return foreignHttpStatusVerdict(error) ?? "transient";
 	}
 	if (error instanceof BackendTransportError) {
 		if (error.upstreamCode !== void 0 && DETERMINISTIC_BRIDGE_CODES.has(error.upstreamCode)) return "terminal";
@@ -28921,6 +28387,6 @@ function isNonEmptySpend(s) {
 	return s.iterations > 0 || s.tokens.input > 0 || s.tokens.output > 0 || s.usd > 0 || s.ms > 0 || s.tokensKnown === false || s.usdKnown === false || Object.values(s.resources ?? {}).some((resource) => resource.amount > 0 || !resource.known);
 }
 //#endregion
-export { waitUntil as $, executableAgentProfileSnapshot as $i, materializeTreeView as $n, sanitizeAgentRuntimeEvent as $r, claimsAuthority as $t, driverExecutorFactory as A, withTimeout as Aa, worktreeCliProfileMaterialization as Ai, DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS as An, persistHarnessTranscript as Ar, cliInPlaceExecutor as At, recordScopeOwnerDriverAttempt as B, teardownExecutor as Ba, knownExecutionBindingReceipt as Bi, decodeToolPart as Bn, buildLoopOtelSpans as Br, WORKER_TRACE_PROPAGATION as Bt, createContinuationKeeper as C, promptCacheTokenClasses as Ca, promptOnlyProfileMaterialization as Ci, captureBeforeDestroy as Cn, environmentGone as Cr, recoverRetainedInteractiveRun as Ct, passedItems as D, throwAbort as Da, sandboxActProfileMaterialization as Di, runBrainLoop as Dn, runAbortable as Dr, rollingDispatch as Dt, failedItems as E, stringifySafe as Ea, renderUnsupported as Ei, routerBrain as En, linkAbort as Er, queueOf as Et, beginScopeOwnerAttempt as F, decodeHarnessUsage as Fa, attestRuntimeOwnedPendingExecutor as Fi, resolveAgentEnvironmentProvider as Fn, readTraceContextFromEnv as Fr, createWorktreeCliExecutor as Ft, settledToIteration as G, runtimeOwnedDriveHarnessProviderEvidence as Gi, FileSpawnJournal as Gn, flatOtelSpan as Gr, taskToPrompt as Gt, recordScopeOwnerPause as H, promptFromAgentTurnInput as Ha, newExecutionAttemptId as Hi, registerRetainedExecutorPreparation as Hn, buildRuntimeEventOtelSpans as Hr, workerTraceEnv as Ht, createScope as I, abortError$2 as Ia, attestRuntimeOwnedScopeOwner as Ii, sandboxClientAsProvider as In, traceContextToEnv as Ir, DEFAULT_SANDBOX_STEERING_MAX_TURNS as It, createWaitProbes as J, runtimeOwnedExecutorProviderEvidence as Ji, SpawnEventIndex as Jn, padSpanId as Jr, readWorkerProgress as Jt, createWorkerSlots as K, runtimeOwnedExecutorExecutionBinding as Ki, InMemoryResultBlobStore as Kn, generateSpanId as Kr, DEFAULT_STALL_AFTER_MS as Kt, deriveNodeExecutionIdentity as L, awaitAbortable$1 as La, authoredProfileDigest as Li, unavailablePauseMs as Ln, defaultRedactor as Lr, createSteerableSandboxSession as Lt, withDriverExecutor as M, addResourceSpend as Ma, prepareJsonlAppend as Mi, createAgentEnvironmentProviderRegistry as Mn, contentAddress as Mr, createExecutor as Mt, SUBTREE_RESULT_LIMIT as N, resourceTelemetry as Na, readCommittedJsonLines as Ni, providerAsExecutor as Nn, createPropagatingTraceEmitter as Nr, createExecutorRegistry as Nt, verdictFromJudgeScore as O, throwIfAborted as Oa, unsupportedProfileDimensions as Oi, canonicalObservedModelParts as On, captureHarnessTranscript as Or, bindReusableExecutorExecutionId as Ot, assertRecursiveReservationPolicy as P, withBudgetResources as Pa, writeAllBytes as Pi, providerAsSandboxClient as Pn, mergeTraceEnv as Pr, snapshotExecutorConfig as Pt, validateWaitSpec as Q, unknownMaterializationReceipt as Qi, loadSpawnForest as Qn, createRuntimeStreamEventCollector as Qr, PEER_MAIL_WIRE_KEY as Qt, meterRuntimeOwnedAccounting as R, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as Ra, finalizeRuntimeOwnedPendingExecutor as Ri, unavailableSignalOfFailure as Rn, defaultRedactorIdentityMaterial as Rr, createRouterTranscript as Rt, composeContinuationNote as S, isAbortError$2 as Sa, promptModelProfileMaterialization as Si, SandboxEvidenceRetentionError as Sn, destroyInteractiveEnvironment as Sr, reconnectRetainedInteractiveRun as St, expandQuestions as T, sleep as Ta, renderProfileMaterializationIssues as Ti, readPromptOptions as Tn, abortError as Tr, freeSlots as Tt, restoreScopeOwnerAcceptedExecution as U, promptOptionsFromAgentTurnInput as Ua, providerAttemptEvidence as Ui, retainedExecutorSeamKey as Un, createOpenInferenceFileExporter as Ur, workerTraceHeaders as Ut, recordScopeOwnerMaterialization as V, teardownSurfaces as Va, knownMaterializationReceipt as Vi, sandboxSessionTraceSource as Vn, buildLoopSpanNodes as Vr, readWorkerTraceContext as Vt, scopeOwnerExecutorNodeContext as W, providerMessageText as Wa, recordRuntimeOwnedDriveHarnessProviderEvidence as Wi, FileResultBlobStore as Wn, createOtelExporter as Wr, workerTraceSeamKey as Wt, pollFor as X, runtimeOwnedScopeOwnerRuntime as Xi, encodeResultBlob as Xn, toOtelAttributes as Xr, AUTHORITY_MARKERS as Xt, isWaitOutcome as Y, runtimeOwnedPendingExecutorMaterialization as Yi, assertContentAddress as Yn, padTraceId as Yr, createInbox as Yt, timerAt as Z, unknownExecutionBindingReceipt as Zi, insideCursorNamespace as Zn, createRuntimeEventCollector as Zr, DEFAULT_PEER_MAIL_LIMITS as Zt, CheckUnavailableError as _, addSpend as _a, controlProfileMaterialization as _i, isTerminalDecision as _n, reconnectRetainedRun as _r, workerInteractiveAdmissionFile as _t, collectDelivered as a, assertSandboxServedModel as aa, createWorktree as ai, isTerminalNodeStatus as an, parseWorkerToolTraceArtifact as ar, reconcileScopeRetainedOwnerEnvironment as at, bestComposite as b, deleteBoxSafe as ba, profileMaterializationAxes$1 as bi, probeSandboxCapabilities as bn, startRetainedRunInEnvironment as br, workerInteractiveBindingFile as bt, runTree as c, createSandboxUsageLedger as ca, LOCAL_HARNESSES as ci, addHarnessUsage as cn, BudgetReconcileFault as cr, scopeRetainedOwnerResourceReader as ct, classifyDriverFailure as d, mapSandboxEvent as da, localHarnessExecutable as di, readCodexRolloutSession as dn, createBudgetPool as dr, SPAWN_RESOURCE_PATH_MAX_BYTES as dt, executableAgentSpecSnapshot as ea, sanitizeKnowledgeReadinessReport as ei, createPeerMailbox as en, pendingWaits as er, bindScopeRetainedOwnerEnvironmentId as et, runDriverWithRetry as f, mapSandboxToolEvent as fa, parseCodexTokenUsage as fi, bridgeRuntimeAttachmentsKey as fn, meterUsageEvent as fr, environmentReader as ft, CONTINUATION_FACTS as g, sumSandboxUsage as ga, assertProfileMaterialization as gi, defaultSelectWinner as gn, errMessage as gr, readWorkerInteractiveAdmissions as gt, CONTINUATIONS_DIR as h, sandboxProgressEvents as ha, AGENT_PROFILE_MATERIALIZATION_AXES as hi, createSandboxForSpec as hn, spendFromUsageTotals as hr, interactiveAdmissionSeamKey as ht, bestDelivered as i, readSandboxOutcome as ia, captureWorktreeDiff as ii, isLiveNodeStatus as in, isTraceAnalysisStore as ir, prepareScopeRetainedOwnerTask as it, isDriverSpec as j, zeroSpend as ja, isNoEntError as ji, LEAF_CONTINUATION_TASK as jn, readHarnessTranscript as jr, cliWorktreeExecutor as jt, driverChild as k, unmeteredSpend as ka, validateProfileMaterialization as ki, observedModelMatchesDeclared as kn, harnessTranscriptArtifact as kr, captureReusableExecutorConfig as kt, DriverAttemptsExhaustedError as l, extractLlmCallEvent as la, harnessInvocation as li, createCodexRolloutStoreReader as ln, ReservationWaitRefused as lr, scopeRetainedOwnerRestorePoint as lt, upstreamUnavailableSignal as m, sandboxEventServedBackend as ma, terminateProcessTreeAndConfirm as mi, TERMINAL_DECISIONS as mn, spendFromUsageEvents as mr, resolveSpawnResourcePaths as mt, createRootHandle as n, detachedSnapshot as na, runSettledCommand as ni, peerMailTools as nn, WORKER_TOOL_TRACE_SCHEMA_VERSION as nr, consumeScopeRetainedOwnerResult as nt, pickBestDelivered as o, canonicalStreamEventFromSandboxEvent as oa, removeWorktree as oi, bridgeAdmissionRefusal as on, workerTraceAnalysisStore as or, scopeRetainedOwnerContext as ot, summarizeDriverAttempts as p, notifySandboxEventObserver as pa, CodexExecutionDiagnosticError as pi, bridgeStopSignalKey as pn, newUsageTotals as pr, hostDirectoryReader as pt, openSlotGroup as q, runtimeOwnedExecutorMaterialization as qi, InMemorySpawnJournal as qn, loopEventToOtelSpan as qr, createActivityLog as qt, createSupervisor as r, projectSandboxOutcome as ra, runWorktreeHarness as ri, peerMailVerbNames as rn, captureWorkerTraceEvidence as rr, noteScopeRetainedOwnerCoordination as rt, runFinalizer as s, createSandboxToolPartState as sa, DEFAULT_LOCAL_HARNESS as si, bridgeModelRouteRefusal as sn, executorFailure as sr, scopeRetainedOwnerPriorSpend as st, DEFAULT_MAX_DEPTH as t, detachedFrozen as ta, sanitizeRuntimeStreamEvent as ti, isPeerMailEnvelope as tn, replaySpawnTree as tr, bindScopeRetainedOwnerProvider as tt, HarnessTurnFailedError as u, isSandboxTerminalEvent as ua, harnessSupportsReasoningEffort as ui, harnessUsageIsEmpty as un, assertValidBudget as ur, scopeRetainedOwnerResult as ut, admitContinuationPolicy as v, chargedTokens as va, defineProfileMaterializationContract as vi, runAgentRounds as vn, recoverRetainedRun as vr, attachWorker as vt, distillFindings as w, randomSuffix as wa, promptResourceProfileMaterialization as wi, assertBoxlessPromptOptions as wn, RunCancellationReason as wr, startRetainedInteractiveRun as wt, checkVerdictOf as x, hasCompleteCacheBreakdown as xa, promptControlProfileMaterialization as xi, acquireSandbox as xn, retainedCreateMaterial as xr, workerInteractiveBindingsDir as xt, admitFinding as y, cloneSpend as ya, fullProfileMaterialization as yi, createSandboxLineage as yn, startRetainedRun as yr, readWorkerInteractiveBinding as yt, meterRuntimeOwnedProviderAttempt as z, armDeadlineTimer as za, inheritRuntimeOwnedExecutorAttestation as zi, createPushTraceSource as zn, resolveRedactor as zr, createInPlaceCliExecutor as zt };
+export { waitUntil as $, projectSandboxOutcome as $i, captureWorkerTraceEvidence as $n, runWorktreeHarness as $r, claimsAuthority as $t, driverExecutorFactory as A, withBudgetResources as Aa, writeAllBytes as Ai, providerAsExecutor as An, mergeTraceEnv as Ar, cliInPlaceExecutor as At, recordScopeOwnerDriverAttempt as B, providerMessageText as Ba, recordRuntimeOwnedDriveHarnessProviderEvidence as Bi, FileResultBlobStore as Bn, createOtelExporter as Br, WORKER_TRACE_PROPAGATION as Bt, createContinuationKeeper as C, throwAbort as Ca, sandboxActProfileMaterialization as Ci, captureBeforeDestroy as Cn, runAbortable as Cr, recoverRetainedInteractiveRun as Ct, passedItems as D, zeroSpend as Da, isNoEntError as Di, runBrainLoop as Dn, readHarnessTranscript as Dr, rollingDispatch as Dt, failedItems as E, withTimeout as Ea, worktreeCliProfileMaterialization as Ei, routerBrain as En, persistHarnessTranscript as Er, queueOf as Et, beginScopeOwnerAttempt as F, armDeadlineTimer as Fa, inheritRuntimeOwnedExecutorAttestation as Fi, createPushTraceSource as Fn, resolveRedactor as Fr, createWorktreeCliExecutor as Ft, settledToIteration as G, runtimeOwnedPendingExecutorMaterialization as Gi, assertContentAddress as Gn, padTraceId as Gr, taskToPrompt as Gt, recordScopeOwnerPause as H, runtimeOwnedExecutorExecutionBinding as Hi, InMemoryResultBlobStore as Hn, generateSpanId as Hr, workerTraceEnv as Ht, createScope as I, teardownExecutor as Ia, knownExecutionBindingReceipt as Ii, decodeToolPart as In, buildLoopOtelSpans as Ir, DEFAULT_SANDBOX_STEERING_MAX_TURNS as It, createWaitProbes as J, unknownMaterializationReceipt as Ji, loadSpawnForest as Jn, createRuntimeStreamEventCollector as Jr, readWorkerProgress as Jt, createWorkerSlots as K, runtimeOwnedScopeOwnerRuntime as Ki, encodeResultBlob as Kn, toOtelAttributes as Kr, DEFAULT_STALL_AFTER_MS as Kt, deriveNodeExecutionIdentity as L, teardownSurfaces as La, knownMaterializationReceipt as Li, sandboxSessionTraceSource as Ln, buildLoopSpanNodes as Lr, createSteerableSandboxSession as Lt, withDriverExecutor as M, abortError$2 as Ma, attestRuntimeOwnedScopeOwner as Mi, resolveAgentEnvironmentProvider as Mn, traceContextToEnv as Mr, createExecutor as Mt, SUBTREE_RESULT_LIMIT as N, awaitAbortable$1 as Na, authoredProfileDigest as Ni, unavailablePauseMs as Nn, defaultRedactor as Nr, createExecutorRegistry as Nt, verdictFromJudgeScore as O, addResourceSpend as Oa, prepareJsonlAppend as Oi, LEAF_CONTINUATION_TASK as On, contentAddress as Or, bindReusableExecutorExecutionId as Ot, assertRecursiveReservationPolicy as P, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as Pa, finalizeRuntimeOwnedPendingExecutor as Pi, unavailableSignalOfFailure as Pn, defaultRedactorIdentityMaterial as Pr, snapshotExecutorConfig as Pt, validateWaitSpec as Q, detachedSnapshot as Qi, WORKER_TOOL_TRACE_SCHEMA_VERSION as Qn, runSettledCommand as Qr, PEER_MAIL_WIRE_KEY as Qt, meterRuntimeOwnedAccounting as R, promptFromAgentTurnInput as Ra, newExecutionAttemptId as Ri, registerRetainedExecutorPreparation as Rn, buildRuntimeEventOtelSpans as Rr, createRouterTranscript as Rt, composeContinuationNote as S, stringifySafe as Sa, renderUnsupported as Si, SandboxEvidenceRetentionError as Sn, linkAbort as Sr, reconnectRetainedInteractiveRun as St, expandQuestions as T, unmeteredSpend as Ta, validateProfileMaterialization as Ti, readPromptOptions as Tn, harnessTranscriptArtifact as Tr, freeSlots as Tt, restoreScopeOwnerAcceptedExecution as U, runtimeOwnedExecutorMaterialization as Ui, InMemorySpawnJournal as Un, loopEventToOtelSpan as Ur, workerTraceHeaders as Ut, recordScopeOwnerMaterialization as V, runtimeOwnedDriveHarnessProviderEvidence as Vi, FileSpawnJournal as Vn, flatOtelSpan as Vr, readWorkerTraceContext as Vt, scopeOwnerExecutorNodeContext as W, runtimeOwnedExecutorProviderEvidence as Wi, SpawnEventIndex as Wn, padSpanId as Wr, workerTraceSeamKey as Wt, pollFor as X, executableAgentSpecSnapshot as Xi, pendingWaits as Xn, sanitizeKnowledgeReadinessReport as Xr, AUTHORITY_MARKERS as Xt, isWaitOutcome as Y, executableAgentProfileSnapshot as Yi, materializeTreeView as Yn, sanitizeAgentRuntimeEvent as Yr, createInbox as Yt, timerAt as Z, detachedFrozen as Zi, replaySpawnTree as Zn, sanitizeRuntimeStreamEvent as Zr, DEFAULT_PEER_MAIL_LIMITS as Zt, CheckUnavailableError as _, hasCompleteCacheBreakdown as _a, promptControlProfileMaterialization as _i, isTerminalDecision as _n, retainedCreateMaterial as _r, workerInteractiveAdmissionFile as _t, collectDelivered as a, extractLlmCallEvent as aa, harnessInvocation as ai, isTerminalNodeStatus as an, ReservationWaitRefused as ar, reconcileScopeRetainedOwnerEnvironment as at, bestComposite as b, randomSuffix as ba, promptResourceProfileMaterialization as bi, probeSandboxCapabilities as bn, RunCancellationReason as br, workerInteractiveBindingFile as bt, runTree as c, mapSandboxToolEvent as ca, parseCodexTokenUsage as ci, addHarnessUsage as cn, meterUsageEvent as cr, scopeRetainedOwnerResourceReader as ct, classifyDriverFailure as d, sandboxProgressEvents as da, AGENT_PROFILE_MATERIALIZATION_AXES as di, readCodexRolloutSession as dn, spendFromUsageTotals as dr, SPAWN_RESOURCE_PATH_MAX_BYTES as dt, readSandboxOutcome as ea, captureWorktreeDiff as ei, createPeerMailbox as en, isTraceAnalysisStore as er, bindScopeRetainedOwnerEnvironmentId as et, runDriverWithRetry as f, sumSandboxUsage as fa, assertProfileMaterialization as fi, bridgeRuntimeAttachmentsKey as fn, errMessage as fr, environmentReader as ft, CONTINUATION_FACTS as g, deleteBoxSafe as ga, profileMaterializationAxes$1 as gi, defaultSelectWinner as gn, startRetainedRunInEnvironment as gr, readWorkerInteractiveAdmissions as gt, CONTINUATIONS_DIR as h, cloneSpend as ha, fullProfileMaterialization as hi, createSandboxForSpec as hn, startRetainedRun as hr, interactiveAdmissionSeamKey as ht, bestDelivered as i, createSandboxUsageLedger as ia, LOCAL_HARNESSES as ii, isLiveNodeStatus as in, BudgetReconcileFault as ir, prepareScopeRetainedOwnerTask as it, isDriverSpec as j, decodeHarnessUsage as ja, attestRuntimeOwnedPendingExecutor as ji, providerAsSandboxClient as jn, readTraceContextFromEnv as jr, cliWorktreeExecutor as jt, driverChild as k, resourceTelemetry as ka, readCommittedJsonLines as ki, createAgentEnvironmentProviderRegistry as kn, createPropagatingTraceEmitter as kr, captureReusableExecutorConfig as kt, DriverAttemptsExhaustedError as l, notifySandboxEventObserver as la, CodexExecutionDiagnosticError as li, createCodexRolloutStoreReader as ln, newUsageTotals as lr, scopeRetainedOwnerRestorePoint as lt, upstreamUnavailableSignal as m, chargedTokens as ma, defineProfileMaterializationContract as mi, TERMINAL_DECISIONS as mn, recoverRetainedRun as mr, resolveSpawnResourcePaths as mt, createRootHandle as n, canonicalStreamEventFromSandboxEvent as na, removeWorktree as ni, peerMailTools as nn, workerTraceAnalysisStore as nr, consumeScopeRetainedOwnerResult as nt, pickBestDelivered as o, isSandboxTerminalEvent as oa, harnessSupportsReasoningEffort as oi, bridgeAdmissionRefusal as on, assertValidBudget as or, scopeRetainedOwnerContext as ot, summarizeDriverAttempts as p, addSpend as pa, controlProfileMaterialization as pi, bridgeStopSignalKey as pn, reconnectRetainedRun as pr, hostDirectoryReader as pt, openSlotGroup as q, unknownExecutionBindingReceipt as qi, insideCursorNamespace as qn, createRuntimeEventCollector as qr, createActivityLog as qt, createSupervisor as r, createSandboxToolPartState as ra, DEFAULT_LOCAL_HARNESS as ri, peerMailVerbNames as rn, executorFailure as rr, noteScopeRetainedOwnerCoordination as rt, runFinalizer as s, mapSandboxEvent as sa, localHarnessExecutable as si, bridgeModelRouteRefusal as sn, createBudgetPool as sr, scopeRetainedOwnerPriorSpend as st, DEFAULT_MAX_DEPTH as t, assertSandboxServedModel as ta, createWorktree as ti, isPeerMailEnvelope as tn, parseWorkerToolTraceArtifact as tr, bindScopeRetainedOwnerProvider as tt, HarnessTurnFailedError as u, sandboxEventServedBackend as ua, terminateProcessTreeAndConfirm as ui, harnessUsageIsEmpty as un, spendFromUsageEvents as ur, scopeRetainedOwnerResult as ut, admitContinuationPolicy as v, isAbortError$2 as va, promptModelProfileMaterialization as vi, runAgentRounds as vn, destroyInteractiveEnvironment as vr, attachWorker as vt, distillFindings as w, throwIfAborted as wa, unsupportedProfileDimensions as wi, assertBoxlessPromptOptions as wn, captureHarnessTranscript as wr, startRetainedInteractiveRun as wt, checkVerdictOf as x, sleep as xa, renderProfileMaterializationIssues as xi, acquireSandbox as xn, abortError as xr, workerInteractiveBindingsDir as xt, admitFinding as y, promptCacheTokenClasses as ya, promptOnlyProfileMaterialization as yi, createSandboxLineage as yn, environmentGone as yr, readWorkerInteractiveBinding as yt, meterRuntimeOwnedProviderAttempt as z, promptOptionsFromAgentTurnInput as za, providerAttemptEvidence as zi, retainedExecutorSeamKey as zn, createOpenInferenceFileExporter as zr, createInPlaceCliExecutor as zt };
 
-//# sourceMappingURL=supervisor-CDsr_sZD.js.map
+//# sourceMappingURL=supervisor-DpUCJtKC.js.map