@tangle-network/agent-runtime 0.325.0 → 0.325.3

package/dist/{workspace-streams-CcoARX4v.js → sandbox-profile-compat-Dq7ujONv.js}

@@ -1825,7 +1825,7 @@ function parseRepositoryMetadata(bytes, limits) {
 	} catch (error) {
 		throw new Error("candidate workspace archive repository metadata is invalid", { cause: error });
 	}
-	if (!isRecord(value) || !["bundle,headCommit,headTree,kind", "bundle,headCommit,headTree,kind,workingTree"].includes(Object.keys(value).sort().join(",")) || value.kind !== archiveKind || typeof value.headCommit !== "string" || typeof value.headTree !== "string" || !isRecord(value.bundle) || Object.keys(value.bundle).sort().join(",") !== "byteLength,sha256" || typeof value.bundle.sha256 !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) || !Number.isSafeInteger(value.bundle.byteLength) || value.bundle.byteLength <= 0 || value.bundle.byteLength > limits.maxRepositoryBundleBytes) throw new Error("candidate workspace archive repository is invalid");
+	if (!isRecord$1(value) || !["bundle,headCommit,headTree,kind", "bundle,headCommit,headTree,kind,workingTree"].includes(Object.keys(value).sort().join(",")) || value.kind !== archiveKind || typeof value.headCommit !== "string" || typeof value.headTree !== "string" || !isRecord$1(value.bundle) || Object.keys(value.bundle).sort().join(",") !== "byteLength,sha256" || typeof value.bundle.sha256 !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) || !Number.isSafeInteger(value.bundle.byteLength) || value.bundle.byteLength <= 0 || value.bundle.byteLength > limits.maxRepositoryBundleBytes) throw new Error("candidate workspace archive repository is invalid");
 	if (!Buffer.from(canonicalCandidateBytes$1(value)).equals(Buffer.from(bytes))) throw new Error("candidate workspace archive repository metadata is not canonical");
 	assertGitObjectId(value.headCommit, "repository HEAD");
 	assertGitObjectId(value.headTree, "repository HEAD tree");
@@ -1833,7 +1833,7 @@ function parseRepositoryMetadata(bytes, limits) {
 	let workingTree;
 	if ("workingTree" in value) {
 		const working = value.workingTree;
-		if (!isRecord(working) || Object.keys(working).join(",") !== "indexManifest" || !isRecord(working.indexManifest) || Object.keys(working.indexManifest).sort().join(",") !== "byteLength,sha256" || typeof working.indexManifest.sha256 !== "string" || !/^sha256:[a-f0-9]{64}$/.test(working.indexManifest.sha256) || !Number.isSafeInteger(working.indexManifest.byteLength) || working.indexManifest.byteLength < 0 || working.indexManifest.byteLength > limits.maxArchiveBytes) throw new Error("candidate workspace archive repository index is invalid");
+		if (!isRecord$1(working) || Object.keys(working).join(",") !== "indexManifest" || !isRecord$1(working.indexManifest) || Object.keys(working.indexManifest).sort().join(",") !== "byteLength,sha256" || typeof working.indexManifest.sha256 !== "string" || !/^sha256:[a-f0-9]{64}$/.test(working.indexManifest.sha256) || !Number.isSafeInteger(working.indexManifest.byteLength) || working.indexManifest.byteLength < 0 || working.indexManifest.byteLength > limits.maxArchiveBytes) throw new Error("candidate workspace archive repository index is invalid");
 		workingTree = { indexManifest: {
 			sha256: working.indexManifest.sha256,
 			byteLength: working.indexManifest.byteLength
@@ -2058,7 +2058,7 @@ function normalizeWorkspaceFiles(input, limits) {
 	const files = [];
 	for (let index = 0; index < fileCount; index++) {
 		const inputFile = input[index];
-		if (!isRecord(inputFile) || Object.keys(inputFile).sort().join(",") !== "bytes,mode,path") throw new Error(`candidate workspace file ${index} is invalid`);
+		if (!isRecord$1(inputFile) || Object.keys(inputFile).sort().join(",") !== "bytes,mode,path") throw new Error(`candidate workspace file ${index} is invalid`);
 		const descriptors = Object.getOwnPropertyDescriptors(inputFile);
 		if (!("value" in (descriptors.path ?? {})) || !("value" in (descriptors.mode ?? {})) || !("value" in (descriptors.bytes ?? {}))) throw new Error(`candidate workspace file ${index} must use fixed values`);
 		const path = safeArchivePath(descriptors.path?.value, limits.maxPathBytes);
@@ -2140,7 +2140,7 @@ function hasControlCharacter(value) {
 	}
 	return false;
 }
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function requireTypedArrayGetter(name) {
@@ -2489,6 +2489,40 @@ function asError(error) {
 	return error instanceof Error ? error : new Error(String(error));
 }
 //#endregion
-export { promptCacheTokenClasses as $, markPutStreamVerified as A, verifyCanonicalCandidateDocument as B, readMaterializedWorkspaceFiles as C, checkInIdleMs as Ct, verifyMaterializedProfileWorkspace as D, teardownSurfaces as Dt, verifyBytes as E, teardownExecutor as Et, deepFreezeCandidate as F, cloneTokenUsage as G, addTokenUsage as H, embeddedCandidateArtifact as I, fnv1a32Hex as J, deleteBoxSafe as K, immutableCandidateValue as L, canonicalCandidateBytes$1 as M, canonicalCandidateDigest$1 as N, verifyMaterializedWorkspace as O, canonicalCandidateDocument as P, mapWithConcurrency as Q, omitTopLevelDigest as R, captureMaterializedWorkspace as S, boundedChildDeadlineAt as St, scanMaterializedWorkspaceManifest as T, singleFlightTeardown as Tt, chargedTokens as U, addSpend as V, cloneSpend as W, isAbortError as X, hasCompleteCacheBreakdown as Y, isAsyncIterable as Z, assertExactObjectKeys as _, DEADLINE_CHECK_IN_MESSAGE as _t, verifyAgentCandidateWorkspaceArtifacts as a, throwAbort as at, artifactCacheKey as b, ROOT_DEADLINE_REASON as bt, captureAgentCandidateWorkspaceFiles as c, withTimeout as ct, workspaceLimits as d, addResourceSpend as dt, randomSuffix as et, persistCandidateOutputArtifact as f, assertResources as ft, verifyTaskOutcomePatch as g, CHILD_DEADLINE_REASON as gt, verifyTaskCheckout as h, ACCEPTED_RESULT_GRACE_MS as ht, readAgentCandidateWorkspaceArtifactFiles as i, stringifySafe as it, verifiedArtifactChunks as j, verifyWorkspaceSnapshotArtifacts as k, createAgentCandidateWorkspacePort as l, zeroSpend as lt, verifyCandidateCode as m, withBudgetResources as mt, captureAgentCandidateWorkspaceTreeToArtifacts as n, roundBoxMinutes as nt, verifyAgentCandidateWorkspaceTree as o, throwIfAborted as ot, readCandidateGitHubResource as p, resourceTelemetry as pt, errorMessage as q, materializeAgentCandidateWorkspaceFromArtifacts as r, sleep as rt, captureAgentCandidateWorkspace as s, unmeteredSpend as st, captureAgentCandidateWorkspaceToArtifacts as t, randomUuid as tt, verifyAgentCandidateWorkspaceArchive as u, zeroTokenUsage as ut, isWellFormedUnicode as v, DEFAULT_CHECK_IN_IDLE_MS as vt, readVerifiedArtifact as w, isDeadlineAbortReason as wt, candidateWorkspaceManifest as x, armDeadlineTimer as xt, WorkspaceScanLimitError as y, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as yt, sha256Bytes$1 as z };
+//#region src/runtime/sandbox-profile-compat.ts
+/**
+* Interface 5.3 admits proxy secrets and private config values, but the current Sandbox SDK
+* carries Interface 4.0. Refuse these fields before either candidate conversion or a direct
+* Sandbox create can silently lose them. Remove this guard when Sandbox carries the fields.
+*/
+function assertSandboxProfileCompatibility(profile, context = "candidate profile") {
+	if (!isRecord(profile)) return;
+	if (profile.proxySecrets !== void 0) refuseSandboxProfileField("proxySecrets", context);
+	if (isRecord(profile.mcp)) for (const [name, server] of Object.entries(profile.mcp)) {
+		if (!isRecord(server)) continue;
+		refuseNonPublicConfigValues(server.args, `mcp.${name}.args`, context);
+		refuseNonPublicConfigValues(server.env, `mcp.${name}.env`, context);
+	}
+	if (isRecord(profile.hooks)) for (const [event, hooks] of Object.entries(profile.hooks)) {
+		if (!Array.isArray(hooks)) continue;
+		for (const [index, hook] of hooks.entries()) {
+			if (!isRecord(hook)) continue;
+			refuseNonPublicConfigValues(hook.args, `hooks.${event}[${index}].args`, context);
+			refuseNonPublicConfigValues(hook.env, `hooks.${event}[${index}].env`, context);
+		}
+	}
+}
+function refuseNonPublicConfigValues(values, path, context) {
+	const entries = Array.isArray(values) ? values.map((value, index) => [`${path}[${index}]`, value]) : isRecord(values) ? Object.entries(values).map(([name, value]) => [`${path}.${name}`, value]) : [];
+	for (const [field, value] of entries) if (isRecord(value) && value.kind !== "public") refuseSandboxProfileField(`${field} (${String(value.kind)})`, context);
+}
+function refuseSandboxProfileField(field, context = "candidate profile") {
+	throw new ValidationError(`${context} field ${field} is refused: Sandbox's Interface 4.0.0 cannot carry it yet, and Runtime does not drop it`);
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//#endregion
+export { isAsyncIterable as $, verifyMaterializedWorkspace as A, omitTopLevelDigest as B, candidateWorkspaceManifest as C, armDeadlineTimer as Ct, scanMaterializedWorkspaceManifest as D, singleFlightTeardown as Dt, readVerifiedArtifact as E, isDeadlineAbortReason as Et, canonicalCandidateDigest$1 as F, chargedTokens as G, verifyCanonicalCandidateDocument as H, canonicalCandidateDocument as I, deleteBoxSafe as J, cloneSpend as K, deepFreezeCandidate as L, markPutStreamVerified as M, verifiedArtifactChunks as N, verifyBytes as O, teardownExecutor as Ot, canonicalCandidateBytes$1 as P, isAbortError as Q, embeddedCandidateArtifact as R, artifactCacheKey as S, ROOT_DEADLINE_REASON as St, readMaterializedWorkspaceFiles as T, checkInIdleMs as Tt, addSpend as U, sha256Bytes$1 as V, addTokenUsage as W, fnv1a32Hex as X, errorMessage as Y, hasCompleteCacheBreakdown as Z, verifyTaskCheckout as _, ACCEPTED_RESULT_GRACE_MS as _t, materializeAgentCandidateWorkspaceFromArtifacts as a, sleep as at, isWellFormedUnicode as b, DEFAULT_CHECK_IN_IDLE_MS as bt, verifyAgentCandidateWorkspaceTree as c, throwIfAborted as ct, createAgentCandidateWorkspacePort as d, zeroSpend as dt, mapWithConcurrency as et, verifyAgentCandidateWorkspaceArchive as f, zeroTokenUsage as ft, verifyCandidateCode as g, withBudgetResources as gt, readCandidateGitHubResource as h, resourceTelemetry as ht, captureAgentCandidateWorkspaceTreeToArtifacts as i, roundBoxMinutes as it, verifyWorkspaceSnapshotArtifacts as j, verifyMaterializedProfileWorkspace as k, teardownSurfaces as kt, captureAgentCandidateWorkspace as l, unmeteredSpend as lt, persistCandidateOutputArtifact as m, assertResources as mt, refuseSandboxProfileField as n, randomSuffix as nt, readAgentCandidateWorkspaceArtifactFiles as o, stringifySafe as ot, workspaceLimits as p, addResourceSpend as pt, cloneTokenUsage as q, captureAgentCandidateWorkspaceToArtifacts as r, randomUuid as rt, verifyAgentCandidateWorkspaceArtifacts as s, throwAbort as st, assertSandboxProfileCompatibility as t, promptCacheTokenClasses as tt, captureAgentCandidateWorkspaceFiles as u, withTimeout as ut, verifyTaskOutcomePatch as v, CHILD_DEADLINE_REASON as vt, captureMaterializedWorkspace as w, boundedChildDeadlineAt as wt, WorkspaceScanLimitError as x, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as xt, assertExactObjectKeys as y, DEADLINE_CHECK_IN_MESSAGE as yt, immutableCandidateValue as z };
 
-//# sourceMappingURL=workspace-streams-CcoARX4v.js.map
+//# sourceMappingURL=sandbox-profile-compat-Dq7ujONv.js.map