@tangle-network/agent-runtime 0.336.0 → 0.337.0

package/dist/{sandbox-profile-compat-D_ZOL80S.js → sandbox-profile-compat-BpxJTqU8.js}

@@ -879,6 +879,8 @@ async function verifyMaterializedProfileWorkspace(root, expected, fileRoot = "wo
 }
 async function walkWorkspace(root, options, keepBytes) {
 	const ignoredProtectedRootEntries = new Set(options.ignoredProtectedRootEntries ?? []);
+	const excluded = new Set(options.excludedPaths ?? []);
+	for (const path of excluded) if (!path || path.includes("\\") || path.includes("\0") || isAbsolute(path) || path.split("/").some((part) => !part || part === "." || part === "..")) throw new Error("workspace excluded path must be a safe relative path");
 	const limits = options.limits;
 	const selected = options.selectedPaths ? new Set(options.selectedPaths) : void 0;
 	const selectedDirectories = /* @__PURE__ */ new Set();
@@ -909,6 +911,7 @@ async function walkWorkspace(root, options, keepBytes) {
 			const absolute = resolve(directory, entry.name);
 			const relPath = relative(absoluteRoot, absolute).split(sep).join("/");
 			if (!relPath || relPath.startsWith("../") || relPath.includes("/../")) throw new Error(`workspace entry escapes root: ${relPath}`);
+			if (excluded.has(relPath)) continue;
 			if (selected && !selected.has(relPath) && !selectedDirectories.has(relPath)) continue;
 			const stats = await lstat(absolute);
 			if (stats.isSymbolicLink()) throw new Error(await symlinkRefusal(absolute, relPath, absoluteRoot));
@@ -2180,7 +2183,8 @@ async function captureAgentCandidateWorkspaceToArtifacts(rootInput, options) {
 	const limits = workspaceLimits(options.limits);
 	const material = await scanMaterializedWorkspaceManifest(rootInput, {
 		limits,
-		signal
+		signal,
+		excludedPaths: options.excludedPaths
 	});
 	validateManifest(material, limits);
 	const root = await realpath(resolve(rootInput));
@@ -2219,7 +2223,8 @@ async function captureAgentCandidateWorkspaceTreeToArtifacts(rootInput, options)
 	const limits = workspaceLimits(options.limits);
 	const material = await scanMaterializedWorkspaceManifest(rootInput, {
 		limits,
-		signal
+		signal,
+		excludedPaths: options.excludedPaths
 	});
 	validateManifest(material, limits);
 	const root = await realpath(resolve(rootInput));
@@ -2529,4 +2534,4 @@ function isRecord(value) {
 //#endregion
 export { isAsyncIterable as $, verifyMaterializedWorkspace as A, omitTopLevelDigest as B, candidateWorkspaceManifest as C, armDeadlineTimer as Ct, scanMaterializedWorkspaceManifest as D, singleFlightTeardown as Dt, readVerifiedArtifact as E, isDeadlineAbortReason as Et, canonicalCandidateDigest$1 as F, chargedTokens as G, verifyCanonicalCandidateDocument as H, canonicalCandidateDocument as I, deleteBoxSafe as J, cloneSpend as K, deepFreezeCandidate as L, markPutStreamVerified as M, verifiedArtifactChunks as N, verifyBytes as O, teardownExecutor as Ot, canonicalCandidateBytes$1 as P, isAbortError as Q, embeddedCandidateArtifact as R, artifactCacheKey as S, ROOT_DEADLINE_REASON as St, readMaterializedWorkspaceFiles as T, checkInIdleMs as Tt, addSpend as U, sha256Bytes$1 as V, addTokenUsage as W, fnv1a32Hex as X, errorMessage as Y, hasCompleteCacheBreakdown as Z, verifyTaskCheckout as _, ACCEPTED_RESULT_GRACE_MS as _t, materializeAgentCandidateWorkspaceFromArtifacts as a, sleep as at, isWellFormedUnicode as b, DEFAULT_CHECK_IN_IDLE_MS as bt, verifyAgentCandidateWorkspaceTree as c, throwIfAborted as ct, createAgentCandidateWorkspacePort as d, zeroSpend as dt, mapWithConcurrency as et, verifyAgentCandidateWorkspaceArchive as f, zeroTokenUsage as ft, verifyCandidateCode as g, withBudgetResources as gt, readCandidateGitHubResource as h, resourceTelemetry as ht, captureAgentCandidateWorkspaceTreeToArtifacts as i, roundBoxMinutes as it, verifyWorkspaceSnapshotArtifacts as j, verifyMaterializedProfileWorkspace as k, teardownSurfaces as kt, captureAgentCandidateWorkspace as l, unmeteredSpend as lt, persistCandidateOutputArtifact as m, assertResources as mt, refuseSandboxProfileField as n, randomSuffix as nt, readAgentCandidateWorkspaceArtifactFiles as o, stringifySafe as ot, workspaceLimits as p, addResourceSpend as pt, cloneTokenUsage as q, captureAgentCandidateWorkspaceToArtifacts as r, randomUuid as rt, verifyAgentCandidateWorkspaceArtifacts as s, throwAbort as st, assertSandboxProfileCompatibility as t, promptCacheTokenClasses as tt, captureAgentCandidateWorkspaceFiles as u, withTimeout as ut, verifyTaskOutcomePatch as v, CHILD_DEADLINE_REASON as vt, captureMaterializedWorkspace as w, boundedChildDeadlineAt as wt, WorkspaceScanLimitError as x, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as xt, assertExactObjectKeys as y, DEADLINE_CHECK_IN_MESSAGE as yt, immutableCandidateValue as z };
 
-//# sourceMappingURL=sandbox-profile-compat-D_ZOL80S.js.map
+//# sourceMappingURL=sandbox-profile-compat-BpxJTqU8.js.map