@tangle-network/agent-runtime 0.317.0 → 0.318.0

package/dist/{runtime-B9BOFyEp.js → runtime-UG5tV_yf.js}

@@ -1,16 +1,16 @@
-import { $i as executableAgentSpecSnapshot, Bn as InMemoryResultBlobStore, Cn as readPromptOptions, Hn as insideCursorNamespace, It as createWorktreeCliExecutor, Jn as readCommittedJsonLines, Mr as contentAddress, Nt as createExecutor, Ot as verdictFromJudgeScore, Pt as createExecutorRegistry, Qi as executableAgentProfileSnapshot, Qn as isTraceAnalysisStore, Sn as assertBoxlessPromptOptions, Tn as runBrainLoop, Vn as InMemorySpawnJournal, Yn as writeAllBytes, _n as runAgentRounds, ea as detachedFrozen, fa as notifySandboxEventObserver, hn as defaultSelectWinner, ht as mapExecutorResult, j as settledToIteration, mt as gateOnDeliverable, pt as rollingDispatch, qn as prepareJsonlAppend, r as createSupervisor, ta as detachedSnapshot, v as withDriverExecutor, vn as createSandboxLineage, vt as CheckUnavailableError, wn as routerBrain } from "./supervisor-CbFyf48U.js";
+import { Bn as InMemoryResultBlobStore, Cn as readPromptOptions, Hn as insideCursorNamespace, It as createWorktreeCliExecutor, Jn as readCommittedJsonLines, Mr as contentAddress, Nt as createExecutor, Ot as verdictFromJudgeScore, Pt as createExecutorRegistry, Qn as isTraceAnalysisStore, Sn as assertBoxlessPromptOptions, Tn as runBrainLoop, Vn as InMemorySpawnJournal, Yn as writeAllBytes, _n as runAgentRounds, ha as notifySandboxEventObserver, hn as defaultSelectWinner, ht as mapExecutorResult, ia as detachedSnapshot, j as settledToIteration, mt as gateOnDeliverable, na as executableAgentSpecSnapshot, pt as rollingDispatch, qn as prepareJsonlAppend, r as createSupervisor, ra as detachedFrozen, ta as executableAgentProfileSnapshot, v as withDriverExecutor, vn as createSandboxLineage, vt as CheckUnavailableError, wn as routerBrain } from "./supervisor-BXEL_Fxe.js";
 import { i as ConfigError, m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
-import { B as runAgentic, G as observe, K as renderReport, U as ObservationError, V as sample, X as strategyAuthorMethod, a as reconcileInterruptedSearchCalls, c as searchExecutor, q as profileChatClient, r as dedicatedLane, x as runtimeShipDecision, z as refine } from "./search-executor-B5ZVFsDV.js";
+import { B as runAgentic, G as observe, K as renderReport, U as ObservationError, V as sample, X as strategyAuthorMethod, a as reconcileInterruptedSearchCalls, c as searchExecutor, q as profileChatClient, r as dedicatedLane, x as runtimeShipDecision, z as refine } from "./search-executor-DMX6tCY4.js";
 import { $ as randomSuffix, B as addSpend, H as chargedTokens, I as immutableCandidateValue, J as hasCompleteCacheBreakdown, K as errorMessage, M as canonicalCandidateDigest$1, R as sha256Bytes$1, U as cloneSpend, X as isAsyncIterable, Y as isAbortError, bt as armDeadlineTimer, ct as zeroSpend, k as markPutStreamVerified, nt as sleep, q as fnv1a32Hex, rt as stringifySafe, v as WorkspaceScanLimitError, x as captureMaterializedWorkspace } from "./workspace-streams-DkijayqX.js";
-import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, p as canonicalObservedModelParts, t as assertExecutableAgentProfile } from "./model-policy-DhvyZ8-O.js";
+import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, p as canonicalObservedModelParts, t as assertExecutableAgentProfile } from "./model-policy-B-rOb8Nj.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
 import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction-DylCC_ot.js";
-import { C as createInMemoryRunContext, E as foldCoordinationRecords } from "./coordination-driver-DGhN8GO9.js";
-import { r as supervise } from "./supervise-CU6AuxWY.js";
+import { C as createInMemoryRunContext, E as foldCoordinationRecords } from "./coordination-driver-DK3pI_HB.js";
+import { r as supervise } from "./supervise-C41ywfFd.js";
 import "./run-layout-DSCWdbX2.js";
-import "./provision-supervisor-BQLLrUtn.js";
-import "./delegate-B5pmSbQa.js";
-import "./graph-G0j1ysqe.js";
+import "./provision-supervisor-CunKnayY.js";
+import "./delegate-Co9vJIgE.js";
+import "./graph-DYBCYZjg.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, sha256Bytes, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
@@ -29,7 +29,6 @@ import { defineEvaluationClaim, summarizeEvaluationUnits } from "@tangle-network
 import { createInterface } from "node:readline";
 import { pathToFileURL } from "node:url";
 import { gzipSync } from "node:zlib";
-import { createContext, runInContext } from "node:vm";
 import { stuckLoopView, toolWasteView } from "@tangle-network/agent-eval/pipelines";
 //#region src/runtime/tangle-sandbox-exact-process-provider.ts
 const exactProcessProviderMarker = "agent-runtime.exact-process-provider";
@@ -393,6 +392,165 @@ async function afterAbortCheck(signal, operation) {
 	return result;
 }
 //#endregion
+//#region src/runtime/http-mcp-client.ts
+/**
+* `connectHttpMcp` — the remote (streamable HTTP) MCP client, sibling of
+* `connectStdioMcp`. Same connection contract (`tools`, `callTool`, `close`),
+* same error semantics (a JSON-RPC error / `isError` result is the agent's
+* `ERROR: …` outcome; a transport fault or timeout throws), no child process —
+* which is the point: this is the MCP path for environments that cannot spawn
+* stdio servers (Workers, browser-context agents, locked-down sandboxes) and
+* for servers that only exist as endpoints (a remote Hindsight, a hosted MCP).
+*
+* Transport: MCP "streamable HTTP" (protocol 2025-03-26 / 2025-06-18). Every
+* request is a POST with `Accept: application/json, text/event-stream`; the
+* server may answer either shape, so both are parsed. A server-assigned
+* `Mcp-Session-Id` response header is captured and replayed on every later
+* request (and the DELETE on close) — stateful servers refuse without it,
+* stateless ones simply never send it.
+*
+* Auth headers can be protected values: they are sent to the server but never
+* allowed back out — error messages and tool results are redacted against the
+* exact protected values, mirroring `connectStdioMcp`'s protectedEnv handling.
+*/
+const HTTP_MCP_PROTOCOL_VERSION = "2025-06-18";
+/** A remote MCP endpoint refused the connection before the handshake completed. */
+var McpConnectFault = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+		this.name = "McpConnectFault";
+	}
+};
+const SSE_DATA_LINE = /^data:\s?(.*)$/s;
+function parseSseBody(body, wantId) {
+	for (const chunk of body.split(/\r?\n\r?\n/)) for (const line of chunk.split(/\r?\n/)) {
+		const match = SSE_DATA_LINE.exec(line);
+		if (!match) continue;
+		try {
+			const parsed = JSON.parse(match[1] ?? "");
+			if (parsed.id === wantId) return parsed;
+		} catch {}
+	}
+}
+function redactValuesFrom(text, values) {
+	let out = text;
+	for (const value of values) if (value.length > 0) out = out.split(value).join("[redacted]");
+	return out;
+}
+/** Connect to a remote MCP endpoint: initialize, list tools, return the live connection. */
+async function connectHttpMcp(spec) {
+	let endpoint;
+	try {
+		endpoint = new URL(spec.url);
+	} catch {
+		throw new ValidationError(`connectHttpMcp: invalid MCP endpoint URL: ${spec.url}`);
+	}
+	if (endpoint.protocol !== "https:" && endpoint.hostname !== "localhost" && endpoint.hostname !== "127.0.0.1") throw new ValidationError(`connectHttpMcp: refusing non-HTTPS MCP endpoint ${endpoint.origin} (localhost excepted) — a bearer or api key on plain HTTP would cross the network in the clear`);
+	const fetchImpl = spec.fetchImpl ?? fetch;
+	const timeoutMs = spec.timeoutMs ?? 3e4;
+	const protectedValues = Object.values(spec.protectedHeaders ?? {});
+	const redact = (text) => redactValuesFrom(text, protectedValues);
+	let sessionId;
+	let nextId = 1;
+	let closed = false;
+	const post = async (path, body, method = "POST") => fetchImpl(`${endpoint.origin}${endpoint.pathname}${endpoint.search}${path}`, {
+		method,
+		headers: {
+			accept: "application/json, text/event-stream",
+			...body !== void 0 ? { "content-type": "application/json" } : {},
+			...sessionId !== void 0 ? { "mcp-session-id": sessionId } : {},
+			...body !== void 0 ? { "x-request-id": String(nextId) } : {},
+			...spec.headers ?? {},
+			...spec.protectedHeaders ?? {}
+		},
+		...body !== void 0 ? { body: JSON.stringify(body) } : {}
+	});
+	const request = async (method, params) => {
+		if (closed) throw new Error("HTTP MCP connection closed");
+		const id = nextId++;
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), timeoutMs);
+		try {
+			const res = await post("", {
+				jsonrpc: "2.0",
+				id,
+				method,
+				params
+			}, "POST");
+			const sessionHeader = res.headers.get("mcp-session-id");
+			if (sessionHeader) sessionId = sessionHeader;
+			if (!res.ok) {
+				const text = redact((await res.text()).slice(0, 500));
+				throw new McpConnectFault(`HTTP MCP ${method} failed (${res.status} ${res.statusText}): ${text}`, res.status);
+			}
+			if ((res.headers.get("content-type") ?? "").includes("text/event-stream")) {
+				const parsed = parseSseBody(await res.text(), id);
+				if (!parsed) throw new Error(`HTTP MCP ${method}: SSE response carried no JSON-RPC message for request ${id}`);
+				return parsed;
+			}
+			return JSON.parse(await res.text());
+		} catch (error) {
+			if (error instanceof McpConnectFault) throw error;
+			const reason = error instanceof Error ? error.message : String(error);
+			throw new Error(redact(`HTTP MCP ${method} transport failed: ${reason}`));
+		} finally {
+			clearTimeout(timer);
+		}
+	};
+	`${endpoint.origin}${endpoint.pathname}${timeoutMs}`;
+	try {
+		const init = await request("initialize", {
+			protocolVersion: HTTP_MCP_PROTOCOL_VERSION,
+			capabilities: {},
+			clientInfo: {
+				name: "agent-runtime-http-mcp",
+				version: "0"
+			}
+		});
+		if (init.error) throw new McpConnectFault(redact(`initialize errored: ${JSON.stringify(init.error)}`), void 0);
+		await post("", {
+			jsonrpc: "2.0",
+			method: "notifications/initialized"
+		}, "POST").catch(() => void 0);
+		const list = await request("tools/list", void 0);
+		if (list.error) throw new Error(redact(`tools/list errored: ${JSON.stringify(list.error)}`));
+		const rawTools = list.result?.tools;
+		if (!Array.isArray(rawTools)) throw new Error("tools/list result has no tools array");
+		const tools = JSON.parse(redact(JSON.stringify(rawTools)));
+		const callTool = async (name, args) => {
+			const res = await request("tools/call", {
+				name,
+				arguments: args
+			});
+			if (res.error) return `ERROR: ${redact(JSON.stringify(res.error)).slice(0, 300)}`;
+			const result = res.result;
+			const chunks = result?.content?.map((c) => c.text ?? "");
+			const joined = chunks?.join("\n") ?? JSON.stringify(result ?? null);
+			const collapsed = chunks?.join("");
+			let text = joined;
+			if (collapsed !== void 0) {
+				const collapsedRedacted = redact(collapsed);
+				if (collapsedRedacted !== collapsed) text = collapsedRedacted;
+			}
+			return redact(result?.isError ? `ERROR: ${text}` : text);
+		};
+		const close = async () => {
+			if (closed) return;
+			closed = true;
+			await post("", void 0, "DELETE").catch(() => void 0);
+		};
+		return {
+			tools,
+			callTool,
+			close
+		};
+	} catch (error) {
+		throw error instanceof Error ? error : new Error(String(error));
+	}
+}
+//#endregion
 //#region src/runtime/key-provider.ts
 /** The env-backed provider: reads the (dotenvx-loaded) process env. Empty /
 *  whitespace-only values count as absent — fail loud, not with a blank key. */
@@ -793,6 +951,34 @@ async function connectStdioMcp(spec) {
 * child and expose its tools under `<server>__<tool>` names. The default policy
 * refuses local processes. A profile with no MCP surface returns zero tools.
 */
+/** Resolve a remote server's `url` + `headers` profile config values into the
+*  plain strings + protected headers an HTTP connection needs. Same fail-closed
+*  contract as `resolveMcpServerLaunch`: no KeyProvider for a declared secret, or
+*  a missing key, aborts the materialization naming the KEY only. */
+async function resolveRemoteMcpHeaders(server, keys, label) {
+	if (typeof server.url !== "string" || server.url.trim().length === 0) throw new ValidationError(`${label}: a remote (http/sse) server requires url`);
+	const headers = {};
+	const protectedHeaders = {};
+	for (const [name, value] of Object.entries(server.headers ?? {})) if (value.kind === "public") headers[name] = value.value ?? "";
+	else {
+		if (!keys) throw new ValidationError(`${label}: header ${name} is a secret-ref but no KeyProvider was supplied — refusing to connect a remote server with unresolvable auth`);
+		const secret = await keys.get(value.key ?? "");
+		if (secret === void 0) throw new ValidationError(`${label}: the KeyProvider holds no value for '${value.key}' (wanted for header ${name}) — provision the key or drop the header`);
+		protectedHeaders[name] = value.format === "bearer" ? `Bearer ${secret}` : secret;
+	}
+	return {
+		url: server.url,
+		...Object.keys(headers).length > 0 ? { headers } : {},
+		...Object.keys(protectedHeaders).length > 0 ? { protectedHeaders } : {}
+	};
+}
+/**
+* Spawn every enabled stdio server in `profile.mcp` and expose their tools as
+* `<server>__<tool>` behind one route and close facade.
+*
+* Fails closed: a declared server that cannot boot throws, so a profile is never
+* scored as if it had no MCP surface.
+*/
 async function materializeLocalMcp(profile, opts = {}) {
 	const security = validateAgentProfileSecurity(profile, opts.profileSecurityPolicy);
 	if (!security.ok) throw new ValidationError(`materializeLocalMcp: profile host execution refused: ${security.issues.filter((issue) => issue.level === "error").map((issue) => issue.message).join("; ")}`);
@@ -807,7 +993,35 @@ async function materializeLocalMcp(profile, opts = {}) {
 		for (const [key, server] of Object.entries(profile.mcp ?? {})) {
 			if (server.enabled === false) continue;
 			const transport = server.transport ?? "stdio";
-			if (transport !== "stdio") throw new ValidationError(`materializeLocalMcp: profile.mcp['${key}'] has transport '${transport}' — the same-host client only spawns stdio servers; a remote (http/sse) server needs an http MCP client (not yet built here) or the sandbox backend. Failing loud: scoring this profile without its declared server would fake the with/without ablation`);
+			if (transport === "http" || transport === "sse") {
+				const { url, headers, protectedHeaders } = await resolveRemoteMcpHeaders(server, opts.keys, `materializeLocalMcp: profile.mcp['${key}']`);
+				const conn = await connectHttpMcp({
+					url,
+					...headers !== void 0 ? { headers } : {},
+					...protectedHeaders !== void 0 ? { protectedHeaders } : {},
+					...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
+				});
+				connections.push(conn);
+				const prefix = key.replace(/[^a-zA-Z0-9_-]/g, "_");
+				for (const t of conn.tools) {
+					const name = `${prefix}__${t.name.replace(/[^a-zA-Z0-9_-]/g, "_")}`;
+					if (routes.has(name)) throw new ValidationError(`materializeLocalMcp: namespaced tool '${name}' collides across servers — rename the profile.mcp keys`);
+					routes.set(name, {
+						conn,
+						tool: t.name
+					});
+					tools.push({
+						type: "function",
+						function: {
+							name,
+							description: (t.description ?? "").slice(0, 1e3),
+							parameters: sanitizeMcpToolSchema(t.inputSchema)
+						}
+					});
+				}
+				continue;
+			}
+			if (transport !== "stdio") throw new ValidationError(`materializeLocalMcp: profile.mcp['${key}'] has unsupported transport '${transport}'`);
 			if (!server.command || server.command.trim().length === 0) throw new ValidationError(`materializeLocalMcp: profile.mcp['${key}'] declares a stdio server with no command`);
 			const launch = await resolveMcpServerLaunch(server, opts.keys, `materializeLocalMcp: profile.mcp['${key}']`);
 			const conn = await connectStdioMcp({
@@ -2745,6 +2959,8 @@ function localSandboxClient(opts) {
 				const r = await runBrainLoop({
 					chat,
 					tools: mcp.tools,
+					...opts.codeMode ? { codeMode: opts.codeMode } : {},
+					...popts?.signal ? { signal: popts.signal } : {},
 					execute: (name, args) => mcp.call(name, args),
 					initialMessages: [...system ? [{
 						role: "system",
@@ -2760,7 +2976,7 @@ function localSandboxClient(opts) {
 					type: "llm_call",
 					data: {
 						model,
-						tools: mcp.tools.map((t) => t.function.name),
+						tools: r.modelToolNames ?? mcp.tools.map((t) => t.function.name),
 						...r.tokensKnown === false ? { tokensKnown: false } : {
 							tokensIn: r.usage.input,
 							tokensOut: r.usage.output
@@ -5953,9 +6169,8 @@ function hashText(value) {
 /**
 * The ONE lint over model-authored source.
 *
-* Two features have a model write code the runtime then runs: `authorStrategy` (an authored
-* optimization strategy, since 0.60) and code mode's `execute` (a program over the coordination
-* verbs). Both need the same refusals; this module is the single copy both import.
+* Authored optimization strategies use this static contract lint. General Runtime code-mode
+* scripts execute in the isolated QuickJS/WASM engine instead of relying on source lint.
 *
 * A LINT, NOT A SANDBOX — it reads text and cannot constrain what running code does, and trivial
 * concatenation defeats any token match. Its only job is refusing the obvious escapes so a typo or
@@ -6901,278 +7116,6 @@ function chatWorkerSeam(opts) {
 	};
 }
 //#endregion
-//#region src/runtime/supervise/code-mode.ts
-/**
-* Code mode — the pattern Cloudflare ("Code Mode") and Anthropic ("code execution with MCP")
-* define, over this runtime's coordination verbs: generate a typed API from the tools' schemas,
-* expose exactly two tools (`search`, `execute`), and run model-written code whose only intended
-* capability is the API bindings. One model turn where the tool-calling loop pays one round trip
-* per call; intermediates live in the program, not the context window.
-*
-* WHAT THIS RUNTIME OWNS AND THE SOURCES' CENTRAL PROPERTY — read this before choosing a runner.
-* The sources isolate execution in a REAL boundary: Cloudflare runs the code in a V8 isolate with
-* a separate heap; Anthropic runs it out of process. That is not a detail — it is the whole reason
-* "let the model write code" is safe. This runtime does NOT ship an isolate, so `execute`'s
-* execution boundary is a SEAM you must fill: `codeModeSupervisorTools(runner)` REQUIRES a
-* `CodeModeRunner`, and there is no default. For untrusted model output, supply a jailed runner
-* (a sub-sandbox, a worker isolate). {@link unsafeInProcessRunner} is provided for TRUSTED output
-* only — your own eval harness, an offline test, a model you control — and is named for what it is:
-* `node:vm` shares the host realm, so host code is reachable from inside it and it is not a
-* security boundary. Choosing it for a hostile model is remote code execution, by construction.
-*
-* WHAT IS GENUINELY THIS RUNTIME'S CONTRIBUTION, and survives audit: every call the program makes
-* crosses the IDENTICAL kernel path an MCP verb crosses. Bindings dispatch through `context.verbs`
-* → the live coordination descriptor's own handler → authorization, the conserved pool, the
-* journal ("there is no second spawn path"). The model authors a workflow as code at runtime and
-* the kernel still meters and records every edge of it — a dynamic workflow system, not a bypass.
-* Verb RESULTS are detached (JSON round-trip) before they re-enter the program, so in-code calls
-* cannot mutate live coordination state the MCP transport would have copied.
-*
-* WHAT STAYS THE MODEL'S: `submit_result`, `stop`, `ask_parent` are never in the API — a program
-* that could settle the run would be a second brain. `search` names them and says why. Code does
-* the mechanics; the model keeps the judgment, the same split the sources draw.
-*
-* THE GRANT CANNOT DRIFT FROM THE DOCS: `search` renders from `context.coordinationTools()`, the
-* same descriptor objects the verbs are served from — never prose written beside them.
-*/
-/** The coordination verbs callable in code, and the `context.verbs` member each maps to. */
-const CODE_CALLABLE_VERBS = {
-	spawn_worker: "spawnAgent",
-	await_settlement: "awaitSettlement",
-	steer_agent: "steerAgent",
-	observe_agent: "observeAgent",
-	list_questions: "listQuestions",
-	answer_question: "answerQuestion",
-	run_analyst: "runAnalyst",
-	read_journal: "readJournal",
-	define_analyst: "defineAnalyst"
-};
-/** A program that spawns may join what it spawned. Not an MCP tool: a manager waits by ending its
-*  turn, and only code inside one call needs to wait in place. */
-const AWAIT_SETTLEMENT_FACE = Object.freeze({
-	name: "await_settlement",
-	description: "Wait until at least one of the named workers has settled; returns { settled: [ids] }. Read each output with observe_agent. Takes nothing from your inbox, so you still hear of each settlement when you are woken.",
-	inputSchema: {
-		type: "object",
-		properties: { workerIds: {
-			type: "array",
-			items: { type: "string" }
-		} },
-		required: ["workerIds"]
-	}
-});
-/** The manager's own lifecycle verbs — never callable from code; `search` names them and why. */
-const LIFECYCLE_VERBS = [
-	"submit_result",
-	"stop",
-	"ask_parent"
-];
-/** Render a JSON Schema as TypeScript type text. Bounded and structural: enough for tool input
-*  schemas (objects, enums, arrays, unions); anything unrecognized renders `unknown`, never a
-*  guess. Module-level (not root) export: consumed by `renderCodeModeApi` and its tests only. */
-function renderJsonSchemaType(schema, depth = 0) {
-	if (depth > 6 || typeof schema !== "object" || schema === null) return "unknown";
-	const node = schema;
-	if (node.const !== void 0) return JSON.stringify(node.const);
-	if (Array.isArray(node.enum)) return node.enum.map((value) => JSON.stringify(value)).join(" | ");
-	const variants = node.anyOf ?? node.oneOf;
-	if (Array.isArray(variants)) return variants.map((variant) => renderJsonSchemaType(variant, depth + 1)).join(" | ");
-	const type = Array.isArray(node.type) ? node.type : [node.type];
-	if (type.includes("object") || node.type === void 0 && node.properties !== void 0) {
-		const properties = node.properties ?? {};
-		const required = new Set(Array.isArray(node.required) ? node.required : []);
-		const fields = Object.entries(properties).map(([name, property]) => {
-			const doc = describeSchema(property);
-			const optional = required.has(name) ? "" : "?";
-			return `${doc}${JSON.stringify(name).slice(1, -1)}${optional}: ${renderJsonSchemaType(property, depth + 1)}`;
-		});
-		if (fields.length === 0) return "Record<string, unknown>";
-		const indent = "  ".repeat(depth + 1);
-		return `{\n${fields.map((field) => `${indent}${field}`).join("\n")}\n${"  ".repeat(depth)}}`;
-	}
-	if (type.includes("array")) return `Array<${renderJsonSchemaType(node.items, depth + 1)}>`;
-	const primitives = type.map((entry) => entry === "integer" ? "number" : typeof entry === "string" ? entry : void 0).filter((entry) => entry === "string" || entry === "number" || entry === "boolean" || entry === "null");
-	return primitives.length > 0 ? primitives.join(" | ") : "unknown";
-}
-function describeSchema(schema) {
-	const description = typeof schema === "object" && schema !== null ? schema.description : void 0;
-	if (typeof description !== "string" || description.length === 0) return "";
-	const first = description.split("\n")[0] ?? "";
-	return `/** ${first.length > 140 ? `${first.slice(0, 140)}…` : first} */ `;
-}
-/** Render the callable API from tool faces — `declare function` per tool, doc from its own
-*  description. This is the text `search` answers; generated, never hand-written. Module-level
-*  export for tests. */
-function renderCodeModeApi(tools, query) {
-	const needle = query?.trim().toLowerCase();
-	const blocks = tools.filter((tool) => !needle || tool.name.toLowerCase().includes(needle) || (tool.description ?? "").toLowerCase().includes(needle)).map((tool) => {
-		const doc = (tool.description ?? "").split("\n")[0] ?? "";
-		const args = tool.inputSchema === void 0 ? "unknown" : renderJsonSchemaType(tool.inputSchema);
-		return `/** ${doc} */\ndeclare function ${tool.name}(args: ${args}): Promise<unknown>`;
-	});
-	const header = [
-		"// Call these as `api.<name>(args)` from code passed to `execute`.",
-		"// Results are the same JSON the tools return. Intermediates stay in your program;",
-		"// return only what the next decision needs.",
-		`// NOT callable from code: ${LIFECYCLE_VERBS.join(", ")} — those are your own tools,`,
-		"// because a program that could settle the run would be a second brain."
-	].join("\n");
-	if (blocks.length === 0) return `${header}\n\n// No API member matches ${JSON.stringify(query ?? "")}. Call search with no query for the full API.`;
-	return `${header}\n\n${blocks.join("\n\n")}`;
-}
-/**
-* An in-process runner for TRUSTED model output ONLY. NOT a security boundary.
-*
-* It runs the program in a `node:vm` context whose globals are the bindings (`api`) and a
-* capturing `console`, with code generation disabled and inherited properties stripped. Those are
-* capability discipline, not containment: `node:vm` shares the host realm, and a host function's
-* `.constructor` is the host `Function`, so code that WANTS out can get out
-* (`api.<binding>.constructor('return process')()`). Use this for your own eval harness, offline
-* tests, or a model you trust; for untrusted output supply a jailed `CodeModeRunner` instead.
-*/
-function unsafeInProcessRunner() {
-	return { async run({ code, bindings, signal }) {
-		const logs = [];
-		const capture = (level) => (...args) => {
-			const line = args.map((value) => typeof value === "string" ? value : safeJson(value)).join(" ");
-			if (logs.length < 200) logs.push(level === "log" ? line : `[${level}] ${line}`);
-		};
-		const target = Object.create(null);
-		for (const [name, fn] of Object.entries(bindings)) target[name] = fn;
-		const sandbox = Object.create(null);
-		sandbox.api = new Proxy(Object.freeze(target), { get(owned, member) {
-			if (typeof member !== "string") return void 0;
-			if (Object.hasOwn(owned, member)) return owned[member];
-			throw new ValidationError(LIFECYCLE_VERBS.includes(member) ? `code mode: api.${member} is not callable from code — it is the manager's own lifecycle verb; return from your program and call it as a tool` : `code mode: api.${member} is not in the granted API — call search to see what is`);
-		} });
-		sandbox.console = Object.freeze({
-			log: capture("log"),
-			warn: capture("warn"),
-			error: capture("error")
-		});
-		const context = createContext(sandbox, { codeGeneration: {
-			strings: false,
-			wasm: false
-		} });
-		const program = runInContext(`(async () => {\n${code}\n})()`, context);
-		const aborted = new Promise((_resolve, reject) => {
-			if (signal.aborted) reject(abortReason(signal));
-			else signal.addEventListener("abort", () => reject(abortReason(signal)), { once: true });
-		});
-		return {
-			result: await Promise.race([program, aborted]) ?? null,
-			logs
-		};
-	} };
-}
-function abortReason(signal) {
-	const reason = signal.reason;
-	return reason instanceof Error ? reason : new ValidationError("code mode: program aborted");
-}
-function safeJson(value) {
-	try {
-		return JSON.stringify(value) ?? String(value);
-	} catch {
-		return String(value);
-	}
-}
-/** Detach a verb result before it re-enters the program — the deep copy the MCP transport makes,
-*  so in-code calls cannot mutate live coordination state. Matches the MCP path exactly (both
-*  JSON round-trip); a non-serializable result degrades to a marker rather than leaking a live
-*  reference. */
-function detach(value) {
-	if (value === void 0) return void 0;
-	try {
-		return JSON.parse(JSON.stringify(value));
-	} catch {
-		return { nonSerializable: true };
-	}
-}
-/**
-* Put a supervisor in code mode: its product tool surface becomes exactly `search` and `execute`.
-*
-* `runner` is REQUIRED and has no default — this runtime ships no isolate, so the execution
-* boundary is the caller's explicit choice (see the module doc). Use {@link unsafeInProcessRunner}
-* for trusted output; a jailed runner for untrusted models.
-*
-* Pass the result as `SuperviseOptions.resolveSupervisorTools` (which `runGraph` forwards to its
-* root supervisor). The graph engine's `supervisorKind` does not accept it yet, so a graph
-* supervisor node cannot be put in code mode through node config today.
-*/
-function codeModeSupervisorTools(runner, options = {}) {
-	if (runner === void 0 || typeof runner.run !== "function") throw new ValidationError("codeModeSupervisorTools: a CodeModeRunner is required (no default) — pass unsafeInProcessRunner() for trusted output, or a jailed runner for untrusted models");
-	const timeoutMs = options.timeoutMs ?? null;
-	if (timeoutMs !== null && (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0)) throw new ValidationError("codeModeSupervisorTools: timeoutMs must be a positive safe integer or null");
-	const faces = (context) => {
-		const granted = context.coordinationTools().filter((tool) => CODE_CALLABLE_VERBS[tool.name] !== void 0);
-		return granted.some((tool) => tool.name === "spawn_worker") ? [...granted, AWAIT_SETTLEMENT_FACE] : granted;
-	};
-	return () => [{
-		name: "search",
-		description: "Search the callable API. Returns TypeScript declarations for the operations your code may call, generated from the live grant. Optional `query` filters by name or description; omit it for the full API.",
-		inputSchema: {
-			type: "object",
-			properties: { query: {
-				type: "string",
-				description: "Substring filter over names and descriptions."
-			} }
-		},
-		handler: async (raw, context) => {
-			const query = typeof raw === "object" && raw !== null ? raw.query : void 0;
-			return renderCodeModeApi(faces(context), typeof query === "string" ? query : void 0);
-		}
-	}, {
-		name: "execute",
-		description: "Run JavaScript against the API from `search`. Write the BODY of an async function: call `api.<name>(args)` (await each call), use loops and Promise.all for fan-out, keep intermediates in variables, `return` only what the next decision needs. `console.log` lines come back beside the result. No imports, no network, no filesystem — the API is the intended capability.",
-		inputSchema: {
-			type: "object",
-			properties: { code: {
-				type: "string",
-				description: "The async function body to run."
-			} },
-			required: ["code"]
-		},
-		handler: async (raw, context) => {
-			const code = typeof raw === "object" && raw !== null ? raw.code : void 0;
-			if (typeof code !== "string" || code.trim().length === 0) throw new ValidationError("code mode: execute needs { code: string }");
-			assertAuthoredCode(code, { context: `code mode (${context.nodeId})` });
-			const execution = new AbortController();
-			let timedOut = false;
-			const onScopeAbort = () => execution.abort(abortReason(context.signal));
-			const clearTimer = timeoutMs === null ? void 0 : armDeadlineTimer(timeoutMs, () => {
-				if (!execution.signal.aborted) {
-					timedOut = true;
-					execution.abort(new ValidationError(`code mode: program timed out after ${timeoutMs}ms`));
-				}
-			}, true);
-			if (context.signal.aborted) execution.abort(abortReason(context.signal));
-			else context.signal.addEventListener("abort", onScopeAbort, { once: true });
-			const bindings = {};
-			for (const face of faces(context)) {
-				const member = CODE_CALLABLE_VERBS[face.name];
-				if (member === void 0) continue;
-				bindings[face.name] = async (args) => {
-					if (execution.signal.aborted) {
-						if (!timedOut) throw abortReason(execution.signal);
-						throw new ValidationError(`code mode: the execute deadline passed; api.${face.name} is refused so no work outlives the call`);
-					}
-					return detach(await context.verbs[member](args));
-				};
-			}
-			try {
-				return await runner.run({
-					code,
-					bindings,
-					signal: execution.signal
-				});
-			} finally {
-				clearTimer?.();
-				context.signal.removeEventListener("abort", onScopeAbort);
-			}
-		}
-	}];
-}
-//#endregion
 //#region src/runtime/supervise/patch-checks.ts
 const DEFAULT_MAX_DIFF_LINES = 400;
 /**
@@ -8587,6 +8530,6 @@ function tail(s) {
 	return s.slice(-400);
 }
 //#endregion
-export { renderCorpusToInstructions as $, chatWorkerSeam as A, completionAuthorizes as At, createS3PrivateCasStore as B, SqlRunOwnershipError as Bt, analyzeTrace as C, assertDeclaredCheck as Ct, codeModeSupervisorTools as D, declaredCheckJudge as Dt, runCoderChecks as E, declaredCheckDigest as Et, authorStrategy as F, pairwiseSignificance as Ft, trajectoryReport as G, createMcpEnvironment as Gt, runBenchmark as H, McpSpawnFault as Ht, strategyAuthorContract as I, renderLeaderboardHtml as It, builtinShapes as J, mcpSecretEnvMetadataKey as Jt, definePersona as K, sanitizeMcpToolSchema as Kt, strategyAuthorSystemPrompt as L, renderLeaderboardMarkdown as Lt, runStrategyEvolution as M, sentinelCompletion as Mt, strategyTournament as N, stopSentinel as Nt, unsafeInProcessRunner as O, readDeclaredCheck as Ot, assertStrategyContract as P, leaderboard as Pt, InMemoryCorpus as Q, createTangleSandboxExactProcessProvider as Qt, SandboxRunAbortError as R, renderLeaderboardSvg as Rt, withUntrackedArtifacts as S, superviseDispatch as St, patchDelivered as T, declaredCheckDeliverable as Tt, createPrivateCasArtifactPort as U, connectStdioMcp as Ut, printBenchmarkReport as V, openSqlRunStore as Vt, equalKOnCost as W, materializeLocalMcp as Wt, registerShape as X, resolveSecretEnv as Xt, createShapeRegistry as Y, resolveMcpServerLaunch as Yt, FileCorpus as Z, secretEnvOfMcpServer as Zt, VERIFY_TAIL_CHARS as _, resolveSandboxClient as _t, localShell as a, selectValidWinner as at, settledWorkerOut as b, loopCampaignDispatch as bt, createVerifierEnvironment as c, assertTraceDerivedFindings as ct, harvestSurfaceDiffs as d, registryScopeAnalyst as dt, fanout as et, analystsFromRegistry as f, observationFromRegistry as ft, NOTE_MAX_CHARS as g, defineLeaderboard as gt, EVIDENCE_MAX_CHARS as h, harvestCorpus as ht, jjWorkspace as i, pipeline as it, createChatSessionStore as j, deterministicCompletion as jt, chatTransportExecutor as k, runIsolatedCheck as kt, boxSurfaceReader as l, buildSteerContext as lt, worktreeFanout as m, HarvestError as mt, makeFinding$1 as n, loopUntil as nt, runInWorkspace as o, verify as ot, failuresAnalyst as p, inProcessSandboxClient as pt, runPersonified as q, envKeyProvider as qt, gitWorkspace as r, panel as rt, createWaterfallCollector as s, widen as st, computeFindingId$1 as t, flatWidenGate as tt, fsSurfaceReader as u, createScopeAnalyst as ut, closingWorkerNote as v, localSandboxClient as vt, createFencedSqlRunContext as w, checkProgramDigest as wt, copyUntrackedIntoClone as x, loopDispatch as xt, composeWorkerEvidence as y, inlineSandboxClient as yt, openSandboxRun as z, renderPairwiseMarkdown as zt };
+export { flatWidenGate as $, runStrategyEvolution as A, sentinelCompletion as At, runBenchmark as B, McpSpawnFault as Bt, analyzeTrace as C, declaredCheckDeliverable as Ct, chatTransportExecutor as D, runIsolatedCheck as Dt, runCoderChecks as E, readDeclaredCheck as Et, strategyAuthorSystemPrompt as F, renderLeaderboardMarkdown as Ft, runPersonified as G, envKeyProvider as Gt, equalKOnCost as H, materializeLocalMcp as Ht, SandboxRunAbortError as I, renderLeaderboardSvg as It, registerShape as J, resolveSecretEnv as Jt, builtinShapes as K, mcpSecretEnvMetadataKey as Kt, openSandboxRun as L, renderPairwiseMarkdown as Lt, assertStrategyContract as M, leaderboard as Mt, authorStrategy as N, pairwiseSignificance as Nt, chatWorkerSeam as O, completionAuthorizes as Ot, strategyAuthorContract as P, renderLeaderboardHtml as Pt, fanout as Q, createS3PrivateCasStore as R, SqlRunOwnershipError as Rt, withUntrackedArtifacts as S, checkProgramDigest as St, patchDelivered as T, declaredCheckJudge as Tt, trajectoryReport as U, createMcpEnvironment as Ut, createPrivateCasArtifactPort as V, connectStdioMcp as Vt, definePersona as W, sanitizeMcpToolSchema as Wt, InMemoryCorpus as X, createTangleSandboxExactProcessProvider as Xt, FileCorpus as Y, secretEnvOfMcpServer as Yt, renderCorpusToInstructions as Z, VERIFY_TAIL_CHARS as _, inlineSandboxClient as _t, localShell as a, widen as at, settledWorkerOut as b, superviseDispatch as bt, createVerifierEnvironment as c, createScopeAnalyst as ct, harvestSurfaceDiffs as d, inProcessSandboxClient as dt, loopUntil as et, analystsFromRegistry as f, HarvestError as ft, NOTE_MAX_CHARS as g, localSandboxClient as gt, EVIDENCE_MAX_CHARS as h, resolveSandboxClient as ht, jjWorkspace as i, verify as it, strategyTournament as j, stopSentinel as jt, createChatSessionStore as k, deterministicCompletion as kt, boxSurfaceReader as l, registryScopeAnalyst as lt, worktreeFanout as m, defineLeaderboard as mt, makeFinding$1 as n, pipeline as nt, runInWorkspace as o, assertTraceDerivedFindings as ot, failuresAnalyst as p, harvestCorpus as pt, createShapeRegistry as q, resolveMcpServerLaunch as qt, gitWorkspace as r, selectValidWinner as rt, createWaterfallCollector as s, buildSteerContext as st, computeFindingId$1 as t, panel as tt, fsSurfaceReader as u, observationFromRegistry as ut, closingWorkerNote as v, loopCampaignDispatch as vt, createFencedSqlRunContext as w, declaredCheckDigest as wt, copyUntrackedIntoClone as x, assertDeclaredCheck as xt, composeWorkerEvidence as y, loopDispatch as yt, printBenchmarkReport as z, openSqlRunStore as zt };
 
-//# sourceMappingURL=runtime-B9BOFyEp.js.map
+//# sourceMappingURL=runtime-UG5tV_yf.js.map