@tangle-network/agent-runtime 0.294.0 → 0.295.0

package/dist/{runtime-B_OdIcAW.js → runtime-CXKCdGTg.js}

@@ -1,16 +1,16 @@
-import { Ai as writeAllBytes, Da as zeroSpend, Dn as runBrainLoop, Dt as rollingDispatch, En as routerBrain, Fa as armDeadlineTimer, Fn as createPushTraceSource, Ft as createWorktreeCliExecutor, G as settledToIteration, Gn as assertContentAddress, Hn as InMemoryResultBlobStore, Kn as encodeResultBlob, M as withDriverExecutor, Mt as createExecutor, Nt as createExecutorRegistry, O as verdictFromJudgeScore, Oi as prepareJsonlAppend, Or as contentAddress, Qi as detachedSnapshot, Sa as stringifySafe, Tn as readPromptOptions, Un as InMemorySpawnJournal, Wn as SpawnEventIndex, Xi as executableAgentSpecSnapshot, Yi as executableAgentProfileSnapshot, Zi as detachedFrozen, _ as CheckUnavailableError, _a as hasCompleteCacheBreakdown, ba as randomSuffix, bn as probeSandboxCapabilities, er as isTraceAnalysisStore, gn as defaultSelectWinner, ha as cloneSpend, ki as readCommittedJsonLines, la as notifySandboxEventObserver, ma as chargedTokens, pa as addSpend, qn as insideCursorNamespace, r as createSupervisor, va as isAbortError, vn as runAgentRounds, wn as assertBoxlessPromptOptions, xa as sleep, yn as createSandboxLineage } from "./supervisor-B-UbeBqD.js";
+import { Ai as writeAllBytes, Da as zeroSpend, Dn as runBrainLoop, Dt as rollingDispatch, En as routerBrain, Fa as armDeadlineTimer, Fn as createPushTraceSource, Ft as createWorktreeCliExecutor, G as settledToIteration, Gn as assertContentAddress, Hn as InMemoryResultBlobStore, Kn as encodeResultBlob, M as withDriverExecutor, Mt as createExecutor, Nt as createExecutorRegistry, O as verdictFromJudgeScore, Oi as prepareJsonlAppend, Or as contentAddress, Qi as detachedSnapshot, Sa as stringifySafe, Tn as readPromptOptions, Un as InMemorySpawnJournal, Wn as SpawnEventIndex, Xi as executableAgentSpecSnapshot, Yi as executableAgentProfileSnapshot, Zi as detachedFrozen, _ as CheckUnavailableError, _a as hasCompleteCacheBreakdown, ba as randomSuffix, bn as probeSandboxCapabilities, er as isTraceAnalysisStore, gn as defaultSelectWinner, ha as cloneSpend, ki as readCommittedJsonLines, la as notifySandboxEventObserver, ma as chargedTokens, pa as addSpend, qn as insideCursorNamespace, r as createSupervisor, va as isAbortError, vn as runAgentRounds, wn as assertBoxlessPromptOptions, xa as sleep, yn as createSandboxLineage } from "./supervisor-Da7iAPSw.js";
 import { i as ConfigError, m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
-import { Q as sample, X as refine, Z as runAgentic, c as reconcileInterruptedSearchCalls, ct as strategyAuthorMethod, et as ObservationError, it as profileChatClient, nt as observe, o as dedicatedLane, r as runtimeShipDecision, rt as renderReport, u as searchExecutor } from "./search-method-3EtnGKdL.js";
+import { Q as sample, X as refine, Z as runAgentic, c as reconcileInterruptedSearchCalls, ct as strategyAuthorMethod, et as ObservationError, it as profileChatClient, nt as observe, o as dedicatedLane, r as runtimeShipDecision, rt as renderReport, u as searchExecutor } from "./search-method-B0VM-hHV.js";
 import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, p as canonicalObservedModelParts, t as assertExecutableAgentProfile } from "./model-policy-DydyWTQg.js";
-import { A as sha256Bytes$1, O as immutableCandidateValue, f as WorkspaceScanLimitError, h as captureMaterializedWorkspace, w as canonicalCandidateDigest$1 } from "./workspace-archive-MhowMCmp.js";
+import { D as canonicalCandidateDigest$1, N as sha256Bytes$1, h as WorkspaceScanLimitError, j as immutableCandidateValue, v as captureMaterializedWorkspace } from "./workspace-streams-D4TMTrJV.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
 import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction-DylCC_ot.js";
-import { S as foldCoordinationRecords, y as createInMemoryRunContext } from "./coordination-driver-BpEJv7GR.js";
-import { C as gateOnDeliverable, r as supervise, w as mapExecutorResult } from "./supervise-Cu0yOTkc.js";
+import { S as foldCoordinationRecords, y as createInMemoryRunContext } from "./coordination-driver-Do3g6Qif.js";
+import { C as gateOnDeliverable, r as supervise, w as mapExecutorResult } from "./supervise-BwfqpTVR.js";
 import "./run-layout-DSCWdbX2.js";
-import "./provision-supervisor-CIwZLCGR.js";
-import "./delegate-DEP51NR7.js";
-import "./graph-oFWfYVpn.js";
+import "./provision-supervisor-B_3hmSz6.js";
+import "./delegate-CCaU8M4O.js";
+import "./graph-dNmpMnzl.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, sha256Bytes, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
@@ -22,6 +22,7 @@ import { chmod, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, r
 import { tmpdir } from "node:os";
 import { isDeepStrictEqual, promisify } from "node:util";
 import { redact } from "@tangle-network/agent-eval/traces";
+import { Readable } from "node:stream";
 import { collectAgentResponseText } from "@tangle-network/sandbox";
 import { SearchRecorder, asha, beam, createRunCostLedger, estimateNode, fsCampaignStorage, openSearchLedger, renderSearchSummary, runProfileMatrix, runSearch, searchClaimReserveUsd, searchModelIdentity, surfaceDiff } from "@tangle-network/agent-eval/campaign";
 import { defineEvaluationClaim, summarizeEvaluationUnits } from "@tangle-network/agent-eval/experiment";
@@ -5129,17 +5130,53 @@ function createPrivateCasArtifactPort(root, namespace, options = {}) {
 				});
 				continue;
 			}
-			const bytes = await readLocal(object.path);
-			if (bytes === void 0) continue;
-			if (sha256(bytes) !== digest) {
-				pending.push({
-					digest,
-					error: "local object failed digest verification; it stays on the host"
-				});
-				continue;
-			}
 			try {
-				await storeDurably(digest, bytes, signal);
+				if (durable.putStream && durable.getStream) {
+					const ref = {
+						locator: {
+							kind: "private-cas",
+							namespace,
+							digest
+						},
+						sha256: digest,
+						byteLength: object.size
+					};
+					let failure;
+					for (let attempt = 1; attempt <= DURABLE_ATTEMPTS; attempt++) {
+						signal?.throwIfAborted();
+						const chunks = readObject(object.path, ref, signal);
+						try {
+							await durable.putStream({
+								namespace,
+								digest,
+								byteLength: object.size,
+								chunks,
+								signal
+							});
+							await writeReceipt(digest, object.size);
+							failure = void 0;
+							break;
+						} catch (error) {
+							failure = error;
+							if (signal?.aborted) throw error;
+							if (attempt < DURABLE_ATTEMPTS) await new Promise((settle) => setTimeout(settle, 1e3 * 4 ** (attempt - 1)));
+						} finally {
+							await chunks.return(void 0);
+						}
+					}
+					if (failure !== void 0) throw failure;
+				} else {
+					const bytes = await readLocal(object.path);
+					if (bytes === void 0) continue;
+					if (sha256(bytes) !== digest) {
+						pending.push({
+							digest,
+							error: "local object failed digest verification; it stays on the host"
+						});
+						continue;
+					}
+					await storeDurably(digest, bytes, signal);
+				}
 				durableHex.add(object.hex);
 				uploaded++;
 			} catch (error) {
@@ -5189,7 +5226,119 @@ function createPrivateCasArtifactPort(root, namespace, options = {}) {
 		if (sha256(bytes) !== ref.sha256 || bytes.byteLength !== ref.byteLength) throw new Error("private CAS object failed digest or length verification");
 		return bytes;
 	};
+	async function* readStream(ref, options = {}) {
+		const { signal } = options;
+		signal?.throwIfAborted();
+		if (ref.locator.kind !== "private-cas" || ref.locator.namespace !== namespace || ref.locator.digest !== ref.sha256) throw new Error("private CAS locator does not match its digest and namespace");
+		const path = destination(ref.sha256);
+		try {
+			await checkDirectories(join(store, hexOf(ref.sha256).slice(0, 2)), false);
+			yield* readObject(path, ref, signal);
+			return;
+		} catch (error) {
+			if (!missing(error)) throw error;
+		}
+		if (!durable?.getStream) throw new Error(`private CAS object is not on this host; streaming durable reads are unavailable: ${ref.sha256}`);
+		const chunks = await durable.getStream({
+			namespace,
+			digest: ref.sha256,
+			signal
+		});
+		if (!chunks) throw new Error(`private CAS object is neither on this host nor in ${durable.location}: ${ref.sha256}`);
+		yield* checkedChunks(chunks, ref, signal);
+	}
+	async function* readObject(path, ref, signal) {
+		signal?.throwIfAborted();
+		const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+		try {
+			const stats = await file.stat();
+			if (!stats.isFile() || stats.size !== ref.byteLength) throw new Error("private CAS object failed digest or length verification");
+			yield* checkedChunks(file.createReadStream({
+				autoClose: false,
+				highWaterMark: 64 * 1024
+			}), ref, signal);
+		} finally {
+			await file.close();
+		}
+	}
+	async function* checkedChunks(chunks, ref, signal) {
+		const hash = createHash("sha256");
+		let byteLength = 0;
+		for await (const chunk of chunks) {
+			signal?.throwIfAborted();
+			if (!(chunk instanceof Uint8Array)) throw new Error("private CAS emitted a non-byte chunk");
+			byteLength += chunk.byteLength;
+			if (byteLength > ref.byteLength) throw new Error("private CAS object failed digest or length verification");
+			hash.update(chunk);
+			yield chunk;
+		}
+		signal?.throwIfAborted();
+		if (`sha256:${hash.digest("hex")}` !== ref.sha256 || byteLength !== ref.byteLength) throw new Error("private CAS object failed digest or length verification");
+	}
+	async function putStream(input) {
+		const { signal } = input;
+		signal?.throwIfAborted();
+		await checkDirectories(store, true);
+		const temporary = join(store, `.${randomUUID()}.tmp`);
+		try {
+			const file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+			const hash = createHash("sha256");
+			let byteLength = 0;
+			try {
+				for await (const chunk of input.chunks) {
+					signal?.throwIfAborted();
+					if (!(chunk instanceof Uint8Array)) throw new Error("private CAS received a non-byte chunk");
+					hash.update(chunk);
+					byteLength += chunk.byteLength;
+					if (!Number.isSafeInteger(byteLength)) throw new Error("private CAS object is too large");
+					await file.writeFile(chunk);
+				}
+				signal?.throwIfAborted();
+				await file.sync();
+			} finally {
+				await file.close();
+			}
+			const sha = hash.digest("hex");
+			const digest = `sha256:${sha}`;
+			const ref = {
+				locator: {
+					kind: "private-cas",
+					namespace,
+					digest
+				},
+				sha256: digest,
+				byteLength
+			};
+			for await (const _chunk of readObject(temporary, ref, signal));
+			const path = destination(digest);
+			const directory = join(store, sha.slice(0, 2));
+			await checkDirectories(directory, true);
+			signal?.throwIfAborted();
+			try {
+				await link(temporary, path);
+			} catch (error) {
+				if (error.code !== "EEXIST") throw error;
+				for await (const _chunk of readStream(ref, { signal }));
+			}
+			const dir = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+			try {
+				await dir.sync();
+			} finally {
+				await dir.close();
+			}
+			if (durable !== void 0) await offload(signal);
+			return ref;
+		} finally {
+			await unlink(temporary).catch((error) => {
+				if (error.code !== "ENOENT") throw error;
+			});
+		}
+	}
 	const port = {
+		...durable === void 0 || durable.putStream && durable.getStream ? {
+			putStream,
+			readStream
+		} : {},
 		async put({ bytes, signal }) {
 			signal?.throwIfAborted();
 			const digest = sha256(bytes);
@@ -5505,7 +5654,7 @@ function createS3PrivateCasStore(options) {
 		if (!match) throw new Error("S3 private CAS digest must be sha256:<64 lowercase hex>");
 		return `${prefix}${namespace}/sha256/${match[1]}`;
 	};
-	const request = async (method, objectKey, { body, payloadHash = EMPTY_PAYLOAD, headers = {}, signal } = {}) => {
+	const request = async (method, objectKey, { body, byteLength, payloadHash = EMPTY_PAYLOAD, headers = {}, signal } = {}) => {
 		const path = `/${[options.bucket, ...objectKey.split("/")].map(encode).join("/")}`;
 		const url = new URL(path, endpoint);
 		const amzDate = (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/gu, "");
@@ -5533,7 +5682,7 @@ function createS3PrivateCasStore(options) {
 			hex(canonical)
 		].join("\n")).digest("hex");
 		const { host: _host, ...sent } = signed;
-		const deadline = AbortSignal.timeout(timeoutMs + Math.ceil((body?.byteLength ?? 0) / (1024 * 1024)) * 1e3);
+		const deadline = AbortSignal.timeout(timeoutMs + Math.ceil((byteLength ?? (body instanceof Uint8Array ? body.byteLength : 0)) / (1024 * 1024)) * 1e3);
 		return await send(url, {
 			method,
 			headers: {
@@ -5541,11 +5690,23 @@ function createS3PrivateCasStore(options) {
 				authorization: `AWS4-HMAC-SHA256 Credential=${options.accessKeyId}/${scope}, SignedHeaders=${names.join(";")}, Signature=${signature}`
 			},
 			...body === void 0 ? {} : { body },
+			...body instanceof ReadableStream ? { duplex: "half" } : {},
 			signal: signal === void 0 ? deadline : AbortSignal.any([signal, deadline])
 		});
 	};
 	const refusal = async (response, action) => {
-		const detail = (await response.text().catch(() => "")).replace(/\s+/gu, " ").slice(0, 300);
+		const reader = response.body?.getReader();
+		let detail = "";
+		try {
+			while (reader && detail.length < 300) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				detail += new TextDecoder().decode(value.subarray(0, 300));
+			}
+		} catch {} finally {
+			await reader?.cancel().catch(() => void 0);
+		}
+		detail = detail.replace(/\s+/gu, " ").slice(0, 300);
 		return /* @__PURE__ */ new Error(`S3 private CAS ${action} returned ${response.status}${detail ? `: ${detail}` : ""}`);
 	};
 	/** Whether the bucket holds this exact object; refuses a same-key object of other bytes. */
@@ -5560,6 +5721,63 @@ function createS3PrivateCasStore(options) {
 	};
 	return {
 		location: `s3://${options.bucket}/${prefix}`,
+		async putStream({ namespace, digest, byteLength, chunks, signal }) {
+			const objectKey = key(namespace, digest);
+			if (await holds(objectKey, digest, byteLength, signal)) return;
+			async function* checked() {
+				const hash = createHash("sha256");
+				let total = 0;
+				for await (const chunk of chunks) {
+					signal?.throwIfAborted();
+					total += chunk.byteLength;
+					if (total > byteLength) throw new Error("S3 private CAS stream exceeds its declared length");
+					hash.update(chunk);
+					yield chunk;
+				}
+				if (total !== byteLength || `sha256:${hash.digest("hex")}` !== digest) throw new Error("S3 private CAS stream failed digest or length verification");
+			}
+			const body = Readable.from(checked());
+			try {
+				const response = await request("PUT", objectKey, {
+					body: Readable.toWeb(body),
+					byteLength,
+					payloadHash: DIGEST.exec(digest)[1],
+					headers: {
+						"content-type": CONTENT_TYPE,
+						"content-length": String(byteLength),
+						[METADATA_DIGEST]: digest
+					},
+					...signal === void 0 ? {} : { signal }
+				});
+				if (!response.ok) throw await refusal(response, "PUT");
+				await response.body?.cancel().catch(() => void 0);
+				if (!await holds(objectKey, digest, byteLength, signal)) throw new Error(`S3 private CAS object ${objectKey} is absent after its write`);
+			} finally {
+				body.destroy();
+			}
+		},
+		async getStream({ namespace, digest, signal }) {
+			const response = await request("GET", key(namespace, digest), signal === void 0 ? {} : { signal });
+			if (response.status === 404) {
+				await response.body?.cancel().catch(() => void 0);
+				return;
+			}
+			if (!response.ok) throw await refusal(response, "GET");
+			if (!response.body) throw new Error("S3 private CAS GET returned no body");
+			return (async function* () {
+				const reader = response.body.getReader();
+				try {
+					while (true) {
+						signal?.throwIfAborted();
+						const { done, value } = await reader.read();
+						if (done) break;
+						yield value;
+					}
+				} finally {
+					await reader.cancel().catch(() => void 0);
+				}
+			})();
+		},
 		async put({ namespace, digest, bytes, signal }) {
 			const objectKey = key(namespace, digest);
 			if (await holds(objectKey, digest, bytes.byteLength, signal)) return;
@@ -5573,13 +5791,13 @@ function createS3PrivateCasStore(options) {
 				...signal === void 0 ? {} : { signal }
 			});
 			if (!response.ok) throw await refusal(response, "PUT");
-			await response.arrayBuffer().catch(() => void 0);
+			await response.body?.cancel().catch(() => void 0);
 			if (!await holds(objectKey, digest, bytes.byteLength, signal)) throw new Error(`S3 private CAS object ${objectKey} is absent after its write`);
 		},
 		async get({ namespace, digest, signal }) {
 			const response = await request("GET", key(namespace, digest), signal === void 0 ? {} : { signal });
 			if (response.status === 404) {
-				await response.arrayBuffer().catch(() => void 0);
+				await response.body?.cancel().catch(() => void 0);
 				return;
 			}
 			if (!response.ok) throw await refusal(response, "GET");
@@ -8722,4 +8940,4 @@ function tail(s) {
 //#endregion
 export { FileCorpus as $, envKeyProvider as $t, unsafeInProcessRunner as A, readDeclaredCheck as At, SandboxRunAbortError as B, renderLeaderboardSvg as Bt, withUntrackedArtifacts as C, loopDispatch as Ct, patchDelivered as D, declaredCheckDeliverable as Dt, createSqlRunContext as E, checkProgramDigest as Et, strategyTournament as F, stopSentinel as Ft, createPrivateCasArtifactPort as G, openSqlRunStore as Gt, createS3PrivateCasStore as H, auditIntent as Ht, assertStrategyContract as I, leaderboard as It, definePersona as J, McpSpawnFault as Jt, equalKOnCost as K, SqlResultBlobStore as Kt, authorStrategy as L, pairwiseSignificance as Lt, chatWorkerSeam as M, completionAuthorizes as Mt, createChatSessionStore as N, deterministicCompletion as Nt, runCoderChecks as O, declaredCheckDigest as Ot, runStrategyEvolution as P, sentinelCompletion as Pt, registerShape as Q, sanitizeMcpToolSchema as Qt, strategyAuthorContract as R, renderLeaderboardHtml as Rt, copyUntrackedIntoClone as S, loopCampaignDispatch as St, createFencedSqlRunContext as T, assertDeclaredCheck as Tt, printBenchmarkReport as U, defaultAuditorInstruction as Ut, openSandboxRun as V, renderPairwiseMarkdown as Vt, runBenchmark as W, SqlRunOwnershipError as Wt, builtinShapes as X, materializeLocalMcp as Xt, runPersonified as Y, connectStdioMcp as Yt, createShapeRegistry as Z, createMcpEnvironment as Zt, NOTE_MAX_CHARS as _, harvestCorpus as _t, localShell as a, panel as at, composeWorkerEvidence as b, localSandboxClient as bt, createVerifierEnvironment as c, verify as ct, harvestSurfaceDiffs as d, buildSteerContext as dt, mcpSecretEnvMetadataKey as en, InMemoryCorpus as et, analystsFromRegistry as f, createScopeAnalyst as ft, EVIDENCE_MAX_CHARS as g, HarvestError as gt, worktreeFanout as h, inProcessSandboxClient as ht, jjWorkspace as i, createTangleSandboxExactProcessProvider as in, loopUntil as it, chatTransportExecutor as j, runIsolatedCheck as jt, codeModeSupervisorTools as k, declaredCheckJudge as kt, boxSurfaceReader as l, widen as lt, superviseSurface as m, observationFromRegistry as mt, makeFinding$1 as n, resolveSecretEnv as nn, fanout as nt, runInWorkspace as o, pipeline as ot, failuresAnalyst as p, registryScopeAnalyst as pt, trajectoryReport as q, SqlSpawnJournal as qt, gitWorkspace as r, secretEnvOfMcpServer as rn, flatWidenGate as rt, createWaterfallCollector as s, selectValidWinner as st, computeFindingId$1 as t, resolveMcpServerLaunch as tn, renderCorpusToInstructions as tt, fsSurfaceReader as u, assertTraceDerivedFindings as ut, VERIFY_TAIL_CHARS as v, defineLeaderboard as vt, analyzeTrace as w, superviseDispatch as wt, settledWorkerOut as x, inlineSandboxClient as xt, closingWorkerNote as y, resolveSandboxClient as yt, strategyAuthorSystemPrompt as z, renderLeaderboardMarkdown as zt };
 
-//# sourceMappingURL=runtime-B_OdIcAW.js.map
+//# sourceMappingURL=runtime-CXKCdGTg.js.map