@tangle-network/agent-runtime 0.337.1 → 0.338.0

package/dist/{runtime-qFLOq1R9.js → runtime-D37zRSs7.js}

@@ -1,456 +1,94 @@
 import { o as writeAtomicDurableFile } from "./durable-file-B_eJr6Mb.js";
-import { D as settledToIteration, Di as executableAgentProfileSnapshot, Dn as readPromptOptions, En as assertBoxlessPromptOptions, Oi as executableAgentSpecSnapshot, On as routerBrain, Qn as runAbortable, Sn as createSandboxLineage, Y as coordinationProfileToolPrefix, Yi as notifySandboxEventObserver, ct as mapExecutorResult, en as CheckUnavailableError, f as withDriverExecutor, gt as createWorktreeCliExecutor, ha as detachedSnapshot, ia as insideCursorNamespace, kn as runBrainLoop, ma as detachedFrozen, mt as createExecutorRegistry, na as InMemoryResultBlobStore, ot as rollingDispatch, pa as contentAddress, pt as createExecutor, r as createSupervisor, ra as InMemorySpawnJournal, st as gateOnDeliverable, ua as isTraceAnalysisStore, un as verdictFromJudgeScore, xn as runAgentRounds, yn as defaultSelectWinner } from "./supervisor-C27ne4yv.js";
+import { Et as readPromptOptions, Gi as executableAgentSpecSnapshot, H as rollingDispatch, Ht as routerBrain, L as settledToIteration, Ma as notifySandboxEventObserver, Nt as defaultSelectWinner, Ot as createSandboxLineage, P as coordinationProfileToolPrefix, Tt as assertBoxlessPromptOptions, Wi as executableAgentProfileSnapshot, Wr as runAbortable, _r as verdictFromJudgeScore, _t as createExecutorRegistry, bt as createExecutor, ca as contentAddress, dn as createWorktreeCliExecutor, gr as mapExecutorResult, gt as insideCursorNamespace, hr as gateOnDeliverable, ka as createSandboxTurnEventCollector, mr as CheckUnavailableError, mt as InMemorySpawnJournal, n as createSupervisor, oa as detachedFrozen, p as withDriverExecutor, pt as InMemoryResultBlobStore, sa as detachedSnapshot, v as isTraceAnalysisStore, wt as runAgentRounds } from "./supervisor-CPG1I9UN.js";
 import { i as ConfigError, m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
-import { B as runAgentic, G as observe, K as renderReport, U as ObservationError, V as sample, X as strategyAuthorMethod, a as reconcileInterruptedSearchCalls, c as searchExecutor, q as profileChatClient, r as dedicatedLane, x as runtimeShipDecision, z as refine } from "./search-executor-CGxvizHh.js";
-import { $ as isAsyncIterable, Ct as armDeadlineTimer, F as canonicalCandidateDigest$1, G as chargedTokens, K as cloneSpend, M as markPutStreamVerified, Q as isAbortError, U as addSpend, V as sha256Bytes$1, X as fnv1a32Hex, Y as errorMessage, Z as hasCompleteCacheBreakdown, at as sleep, dt as zeroSpend, et as mapWithConcurrency, nt as randomSuffix, ot as stringifySafe, w as captureMaterializedWorkspace, x as WorkspaceScanLimitError, z as immutableCandidateValue } from "./sandbox-profile-compat-QTkLe1Z6.js";
-import { a as readCommittedJsonLines, i as readCommittedJsonFile, n as isNoEntError, o as upsertCommittedJsonLine, s as withJsonlFileLock, t as appendCommittedJsonLine } from "./jsonl-file-DBv31uPi.js";
+import { A as observe, D as sample, E as runAgentic, M as profileChatClient, O as ObservationError, T as refine, j as renderReport, v as loadAuthoredStrategy, x as strategyAuthorContract, y as requestStrategySource } from "./structural-rollout-DAvIE8mw.js";
+import { $ as hasCompleteCacheBreakdown, F as canonicalCandidateDigest$1, G as addSpend, J as cloneSpend, M as markPutStreamVerified, Q as fnv1a32Hex, Tt as armDeadlineTimer, V as sha256Bytes$1, Z as errorMessage, ct as stringifySafe, et as isAbortError, it as randomSuffix, nt as mapWithConcurrency, pt as zeroSpend, q as chargedTokens, st as sleep, tt as isAsyncIterable, w as captureMaterializedWorkspace, x as WorkspaceScanLimitError, z as immutableCandidateValue } from "./sandbox-profile-compat-xSoVtdWw.js";
 import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, p as canonicalObservedModelParts, t as assertExecutableAgentProfile, v as harnessRunsAgent } from "./model-policy-CyCUwHed.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
+import { a as readCommittedJsonLines, i as readCommittedJsonFile, n as isNoEntError, o as upsertCommittedJsonLine, s as withJsonlFileLock, t as appendCommittedJsonLine } from "./jsonl-file-DBv31uPi.js";
+import { S as foldCoordinationRecords, y as createInMemoryRunContext } from "./driver-control-acknowledgers-T2a1Ouay.js";
+import { B as runBrainLoop, t as supervise } from "./supervise-WuPAwfPh.js";
+import { a as reconcileInterruptedSearchCalls, c as searchExecutor, r as dedicatedLane, x as runtimeShipDecision } from "./search-executor-DmgUm5p7.js";
 import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction-DFCeo4vg.js";
-import { D as foldCoordinationRecords, w as createInMemoryRunContext } from "./coordination-driver-Dg9a6qsm.js";
-import { r as supervise } from "./supervise-H4BTN6uA.js";
-import { a as graphRunsFor, d as recordGraphRun, i as graphRegistry, l as lookupGraph, p as taskShapeDigest, r as graphFromStored, t as digestOfGraph } from "./graph-registry-DAI6KNXB.js";
-import "./run-layout-Cu8H7aeh.js";
-import "./provision-supervisor-72YFf-i_.js";
-import "./delegate-aC14Cww3.js";
-import "./graph-Cfx711ES.js";
+import "./run-cancellation-BoW5Sg9Y.js";
+import { a as graphRunsFor, d as recordGraphRun, i as graphRegistry, l as lookupGraph, p as taskShapeDigest, r as graphFromStored, t as digestOfGraph } from "./graph-registry-By0tUj4S.js";
+import "./provision-supervisor-0jMufp4h.js";
+import "./delegate-Se1YZKMb.js";
+import "./graph-CY0wH838.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, sha256Bytes, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
+import { collectAgentResponseText } from "@tangle-network/sandbox";
 import { redact } from "@tangle-network/agent-eval/traces";
 import { z } from "zod";
 import { createHash, createHmac, randomUUID } from "node:crypto";
-import { appendFileSync, chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { appendFileSync, chmodSync, constants, copyFileSync, lstatSync, mkdirSync, mkdtempSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { chmod, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
 import { isDeepStrictEqual, promisify } from "node:util";
+import { tmpdir } from "node:os";
 import { Readable } from "node:stream";
-import { collectAgentResponseText } from "@tangle-network/sandbox";
 import { SearchRecorder, asha, beam, createRunCostLedger, estimateNode, fsCampaignStorage, openSearchLedger, renderSearchSummary, runProfileMatrix, runSearch, searchClaimReserveUsd, searchModelIdentity, surfaceDiff } from "@tangle-network/agent-eval/campaign";
 import { defineEvaluationClaim, summarizeEvaluationUnits } from "@tangle-network/agent-eval/experiment";
 import { createInterface } from "node:readline";
 import { Worker } from "node:worker_threads";
-import { pathToFileURL } from "node:url";
 import { gzipSync } from "node:zlib";
 import { stuckLoopView, toolWasteView } from "@tangle-network/agent-eval/pipelines";
-//#region src/runtime/tangle-sandbox-exact-process-provider.ts
-const exactProcessProviderMarker = "agent-runtime.exact-process-provider";
-const exactProcessEgressMarker = "agent-runtime.exact-process-egress";
+//#region src/runtime/http-mcp-client.ts
 /**
-* Adapt Tangle Sandbox's managed control runtime to Runtime's exact-process provider.
+* `connectHttpMcp` — the remote (streamable HTTP) MCP client, sibling of
+* `connectStdioMcp`. Same connection contract (`tools`, `callTool`, `close`),
+* same error semantics (a JSON-RPC error / `isError` result is the agent's
+* `ERROR: …` outcome; a transport fault or timeout throws), no child process —
+* which is the point: this is the MCP path for environments that cannot spawn
+* stdio servers (Workers, browser-context agents, locked-down sandboxes) and
+* for servers that only exist as endpoints (a remote Hindsight, a hosted MCP).
 *
-* The adapter deliberately exposes no ordinary agent environment: an exact experiment
-* must start a fresh Sandbox with no managed agent and launch its declared argv directly.
+* Transport: MCP "streamable HTTP" (protocol 2025-03-26 / 2025-06-18). Every
+* request is a POST with `Accept: application/json, text/event-stream`; the
+* server may answer either shape, so both are parsed. A server-assigned
+* `Mcp-Session-Id` response header is captured and replayed on every later
+* request (and the DELETE on close) — stateful servers refuse without it,
+* stateless ones simply never send it.
+*
+* Auth headers can be protected values: they are sent to the server but never
+* allowed back out — error messages and tool results are redacted against the
+* exact protected values, mirroring `connectStdioMcp`'s protectedEnv handling.
 */
-function createTangleSandboxExactProcessProvider(client, options = {}) {
-	const name = options.name ?? "tangle-sandbox-exact-process";
-	if (!name.trim()) throw new Error("Tangle Sandbox exact-process provider name must not be empty");
-	return {
-		name,
-		exactProcess: {
-			async create(input) {
-				throwIfAborted(input.signal);
-				assertNoProviderOptions(input.providerOptions);
-				const egressPolicy = sandboxEgressPolicy(input.egress);
-				const metadata = exactMetadata(input.metadata, name, egressPolicy);
-				const sandbox = await client.create({
-					environment: requiredText(input.image, "exact-process image"),
-					agent: false,
-					bare: false,
-					ephemeral: true,
-					egressPolicy,
-					resources: sandboxResources(input),
-					maxLifetimeSeconds: sandboxLifetimeSeconds(input.maxLifetimeMs),
-					metadata,
-					idempotencyKey: requiredText(input.idempotencyKey, "exact-process idempotency key")
-				}, {
-					...input.provisionTimeoutMs === void 0 ? {} : { timeoutMs: positiveInteger$1(input.provisionTimeoutMs, "provision timeout") },
-					...input.signal === void 0 ? {} : { signal: input.signal }
-				});
-				try {
-					throwIfAborted(input.signal);
-					assertExactSandboxMetadata(sandbox, metadata);
-					await assertExactSandboxEgress(sandbox, egressPolicy);
-				} catch (error) {
-					await discardInvalidSandbox(sandbox, error);
-				}
-				return sandboxAsExactProcessEnvironment(sandbox, name);
-			},
-			async get(id) {
-				const sandbox = await client.get(id);
-				if (!sandbox || !isExactSandbox(sandbox, name)) return null;
-				await assertExactSandboxEgress(sandbox, egressFromMetadata(sandbox.metadata));
-				return sandboxAsExactProcessEnvironment(sandbox, name);
-			},
-			async list(query) {
-				assertNoProviderOptions(query?.providerOptions);
-				const sandboxes = await client.list();
-				return Promise.all(sandboxes.filter((sandbox) => isExactSandbox(sandbox, name)).filter((sandbox) => metadataMatches(sandbox.metadata, query?.metadata)).map(async (sandbox) => {
-					await assertExactSandboxEgress(sandbox, egressFromMetadata(sandbox.metadata));
-					return sandboxAsExactProcessEnvironment(sandbox, name);
-				}));
-			}
-		},
-		capabilities: exactProcessOnlyCapabilities,
-		async create() {
-			throw new Error(`agent environment provider "${name}" supports exactProcess.create() only`);
-		}
-	};
-}
-function sandboxAsExactProcessEnvironment(sandbox, provider) {
-	return {
-		id: requiredText(sandbox.id, "Sandbox id"),
-		provider,
-		...sandbox.metadata ? { metadata: sandbox.metadata } : {},
-		process: {
-			async list() {
-				return (await sandbox.process.list()).map((status) => exactProcessStatus(status));
-			},
-			async get(pid) {
-				const process = await sandbox.process.get(pid);
-				return process ? sandboxProcessAsExactProcess(process) : null;
-			},
-			async spawn(input, options) {
-				return sandboxProcessAsExactProcess(await afterAbortCheck(options?.signal, () => sandbox.process.spawnExact(input.executable, [...input.args], {
-					cwd: input.cwd,
-					env: { ...input.env },
-					inheritEnv: false,
-					...input.stdin === void 0 ? {} : { stdin: input.stdin },
-					timeoutMs: input.timeoutMs
-				})));
-			}
-		},
-		async writeFile(path, bytes, options) {
-			if (sandbox.fs.supportsWriteMode !== true) throw new Error("Tangle Sandbox does not declare exact file-mode support");
-			await afterAbortCheck(options.signal, () => sandbox.fs.write(path, Buffer.from(bytes).toString("base64"), {
-				encoding: "base64",
-				mode: fileMode(options.mode)
-			}));
-		},
-		async readFile(path, options) {
-			const maxBytes = nonnegativeInteger(options.maxBytes, "exact-process file read maximum");
-			const initialSize = nonnegativeInteger((await afterAbortCheck(options.signal, () => sandbox.fs.stat(path))).size, `Tangle Sandbox file size for "${path}"`);
-			if (initialSize > maxBytes) throw new Error(`Tangle Sandbox file "${path}" exceeds the ${maxBytes}-byte exact read maximum`);
-			const result = await afterAbortCheck(options.signal, () => sandbox.fs.readBatch([path], { encoding: "base64" }));
-			const failure = result.errors.find((entry) => entry.path === path);
-			if (failure) throw new Error(`Tangle Sandbox failed to read "${path}": ${failure.error}`);
-			const files = result.files.filter((entry) => entry.path === path);
-			if (files.length !== 1) throw new Error(`Tangle Sandbox returned ${files.length} files for exact read "${path}"`);
-			const file = files[0];
-			if (file.encoding !== "base64") throw new Error(`Tangle Sandbox returned non-binary content for exact read "${path}"`);
-			const size = nonnegativeInteger(file.size, `Tangle Sandbox file size for "${path}"`);
-			if (size !== initialSize) throw new Error(`Tangle Sandbox file "${path}" changed during exact read`);
-			if (size > maxBytes) throw new Error(`Tangle Sandbox file "${path}" exceeds the ${maxBytes}-byte exact read maximum`);
-			const bytes = Buffer.from(file.content, "base64");
-			if (bytes.byteLength !== size || bytes.toString("base64") !== file.content) throw new Error(`Tangle Sandbox returned an invalid binary payload for exact read "${path}"`);
-			return Uint8Array.from(bytes);
-		},
-		async destroy() {
-			await sandbox.delete();
-		}
-	};
-}
-function sandboxProcessAsExactProcess(process) {
-	const pid = positiveInteger$1(process.pid, "Tangle Sandbox process pid");
-	return {
-		pid,
-		async status() {
-			return exactProcessStatus(await process.status(), pid);
-		},
-		async wait() {
-			const waitExitCode = await process.wait();
-			if (!Number.isSafeInteger(waitExitCode)) throw new Error("Tangle Sandbox process wait returned an invalid exit code");
-			const status = exactProcessStatus(await process.status(), pid);
-			if (status.running || !status.termination) throw new Error("Tangle Sandbox process wait returned before terminal status");
-			if (status.termination.kind === "exit" && status.termination.exitCode !== waitExitCode) throw new Error("Tangle Sandbox process wait and status disagree on exit code");
-			return status.termination;
-		},
-		async kill() {
-			await process.kill("SIGKILL", { tree: true });
-		},
-		async *stdout() {
-			yield* process.stdout();
-		},
-		async *stderr() {
-			yield* process.stderr();
-		}
-	};
-}
-function exactProcessStatus(status, expectedPid) {
-	const pid = positiveInteger$1(status.pid, "Tangle Sandbox process pid");
-	if (expectedPid !== void 0 && pid !== expectedPid) throw new Error("Tangle Sandbox process status changed process identity");
-	if (typeof status.running !== "boolean") throw new Error("Tangle Sandbox process status is missing running state");
-	if (!Number.isSafeInteger(status.exitCode)) throw new Error("Tangle Sandbox process status is missing an integer exit code");
-	const exitSignal = optionalText(status.exitSignal, "Tangle Sandbox process exit signal");
-	if (status.running) {
-		if (status.exitCode !== -1) throw new Error("Tangle Sandbox running process must report exit code -1");
-		if (exitSignal) throw new Error("Tangle Sandbox running process must not report an exit signal");
-		return {
-			pid,
-			running: true,
-			exitCode: -1
-		};
+const HTTP_MCP_PROTOCOL_VERSION = "2025-06-18";
+/** A remote MCP endpoint refused the connection before the handshake completed. */
+var McpConnectFault = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+		this.name = "McpConnectFault";
+	}
+};
+const SSE_DATA_LINE = /^data:\s?(.*)$/s;
+function parseSseBody(body, wantId) {
+	for (const chunk of body.split(/\r?\n\r?\n/)) for (const line of chunk.split(/\r?\n/)) {
+		const match = SSE_DATA_LINE.exec(line);
+		if (!match) continue;
+		try {
+			const parsed = JSON.parse(match[1] ?? "");
+			if (parsed.id === wantId) return parsed;
+		} catch {}
 	}
-	const termination = exitSignal ? {
-		kind: "signal",
-		signal: exitSignal
-	} : status.exitCode >= 0 ? {
-		kind: "exit",
-		exitCode: status.exitCode
-	} : void 0;
-	if (!termination) throw new Error("Tangle Sandbox stopped process has no terminal reason");
-	return {
-		pid,
-		running: false,
-		exitCode: status.exitCode,
-		...exitSignal ? { exitSignal } : {},
-		termination
-	};
-}
-function exactMetadata(metadata, provider, egressPolicy) {
-	for (const marker of [exactProcessProviderMarker, exactProcessEgressMarker]) if (Object.hasOwn(metadata, marker)) throw new Error(`exact-process metadata must not set "${marker}"`);
-	return {
-		...metadata,
-		[exactProcessProviderMarker]: provider,
-		[exactProcessEgressMarker]: serializeEgressPolicy(egressPolicy)
-	};
-}
-function isExactSandbox(sandbox, provider) {
-	return sandbox.metadata?.[exactProcessProviderMarker] === provider;
-}
-function metadataMatches(metadata, expected) {
-	return expected === void 0 || Object.entries(expected).every(([key, value]) => isDeepStrictEqual(metadata?.[key], value));
 }
-function assertExactSandboxMetadata(sandbox, expected) {
-	if (!metadataMatches(sandbox.metadata, expected)) throw new Error("Tangle Sandbox did not persist exact-process metadata");
+function redactValuesFrom(text, values) {
+	let out = text;
+	for (const value of values) if (value.length > 0) out = out.split(value).join("[redacted]");
+	return out;
 }
-function egressFromMetadata(metadata) {
-	const encoded = metadata?.[exactProcessEgressMarker];
-	if (typeof encoded !== "string") throw new Error("Tangle Sandbox exact-process environment is missing egress metadata");
+/** Connect to a remote MCP endpoint: initialize, list tools, return the live connection. */
+async function connectHttpMcp(spec) {
+	let endpoint;
 	try {
-		const parsed = JSON.parse(encoded);
-		if (!parsed || typeof parsed !== "object") throw new Error("expected egress object");
-		const policy = parsed;
-		if (policy.mode === "blocked" && policy.allowDomains === void 0) return { mode: "blocked" };
-		if (policy.mode === "strict" && policy.includeImplicitDomains === false && Array.isArray(policy.allowDomains) && policy.allowDomains.every((domain) => typeof domain === "string")) {
-			const allowDomains = sortedDomains(policy.allowDomains);
-			if (new Set(allowDomains).size === allowDomains.length) return {
-				mode: "strict",
-				allowDomains,
-				includeImplicitDomains: false
-			};
-		}
+		endpoint = new URL(spec.url);
 	} catch {
-		throw new Error("Tangle Sandbox exact-process environment has invalid egress metadata");
-	}
-	throw new Error("Tangle Sandbox exact-process environment has invalid egress metadata");
-}
-async function assertExactSandboxEgress(sandbox, expected) {
-	const actual = (await sandbox.egress.get()).policy;
-	if (actual.mode !== expected.mode) throw new Error(`Tangle Sandbox egress mismatch: expected ${expected.mode}, received ${actual.mode}`);
-	if (expected.mode === "blocked") {
-		const allowDomains = actual.allowDomains;
-		if (actual.mode === "blocked" && (allowDomains === void 0 || Array.isArray(allowDomains) && allowDomains.length === 0)) return;
-		throw new Error("Tangle Sandbox blocked egress retained an allowlist");
-	}
-	if (actual.mode !== "strict") throw new Error("Tangle Sandbox did not return strict egress policy");
-	const expectedDomains = sortedDomains(expected.allowDomains);
-	if (!isDeepStrictEqual(sortedDomains(actual.allowDomains ?? []), expectedDomains)) throw new Error("Tangle Sandbox strict egress differs from the exact allowlist");
-	if (actual.includeImplicitDomains !== false) throw new Error("Tangle Sandbox strict egress retained implicit domains");
-}
-function sandboxEgressPolicy(input) {
-	if (input.mode === "blocked") return { mode: "blocked" };
-	const allowDomains = input.allowDomains.map((domain) => requiredText(domain, "strict egress domain"));
-	if (new Set(allowDomains).size !== allowDomains.length) throw new Error("strict egress domains must not contain duplicates");
-	return {
-		mode: "strict",
-		allowDomains,
-		includeImplicitDomains: false
-	};
-}
-function serializeEgressPolicy(policy) {
-	return JSON.stringify(policy.mode === "blocked" ? { mode: "blocked" } : {
-		mode: "strict",
-		allowDomains: sortedDomains(policy.allowDomains),
-		includeImplicitDomains: false
-	});
-}
-function sandboxResources(input) {
-	const cpuCores = positiveNumber(input.resources.cpu, "exact-process cpu");
-	const memoryMB = positiveInteger$1(input.resources.memoryMb, "exact-process memory");
-	const diskMb = positiveInteger$1(input.resources.diskMb, "exact-process disk");
-	if (diskMb % 1024 !== 0) throw new Error("Tangle Sandbox exact-process disk must be a whole GiB");
-	return {
-		cpuCores,
-		memoryMB,
-		diskGB: diskMb / 1024
-	};
-}
-function sandboxLifetimeSeconds(maxLifetimeMs) {
-	const milliseconds = positiveInteger$1(maxLifetimeMs, "exact-process maximum lifetime");
-	if (milliseconds % 1e3 !== 0) throw new Error("Tangle Sandbox exact-process maximum lifetime must be a whole number of seconds");
-	return milliseconds / 1e3;
-}
-function fileMode(value) {
-	const mode = nonnegativeInteger(value, "exact-process file mode");
-	if (mode > 4095) throw new Error("exact-process file mode exceeds POSIX mode bits");
-	return mode;
-}
-function assertNoProviderOptions(providerOptions) {
-	if (providerOptions && Object.keys(providerOptions).length > 0) throw new Error("Tangle Sandbox exact-process provider does not accept providerOptions");
-}
-function exactProcessOnlyCapabilities() {
-	return {
-		profile: {
-			namedProfiles: false,
-			systemPrompt: {
-				replace: false,
-				append: false
-			},
-			instructions: false,
-			tools: false,
-			permissions: false,
-			mcp: false,
-			subagents: false,
-			resources: {
-				files: false,
-				instructions: false,
-				tools: false,
-				skills: false,
-				agents: false,
-				commands: false
-			},
-			hooks: false,
-			modes: false,
-			runtimeUpdate: false,
-			validation: false
-		},
-		streaming: {
-			live: false,
-			replay: false,
-			detach: false,
-			turnIdempotency: false
-		},
-		sessions: {
-			continue: false,
-			list: false,
-			messages: false
-		},
-		workspace: {
-			read: false,
-			write: false,
-			exec: false,
-			git: false,
-			upload: false,
-			download: false
-		},
-		branching: {
-			checkpoint: false,
-			fork: false
-		},
-		placement: false,
-		usage: false,
-		confidential: false,
-		exactProcess: { egress: ["blocked", "strict"] }
-	};
-}
-async function discardInvalidSandbox(sandbox, cause) {
-	try {
-		await sandbox.delete();
-	} catch (destroyError) {
-		throw new AggregateError([cause, destroyError], "Tangle Sandbox exact-process creation failed and cleanup failed");
-	}
-	throw cause;
-}
-function sortedDomains(domains) {
-	return [...domains].sort((left, right) => left.localeCompare(right));
-}
-function requiredText(value, label) {
-	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} must be a non-empty string`);
-	return value;
-}
-function optionalText(value, label) {
-	if (value === void 0) return void 0;
-	return requiredText(value, label);
-}
-function positiveNumber(value, label) {
-	if (!Number.isFinite(value) || value <= 0) throw new Error(`${label} must be positive`);
-	return value;
-}
-function positiveInteger$1(value, label) {
-	if (!Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
-	return value;
-}
-function nonnegativeInteger(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative integer`);
-	return value;
-}
-function throwIfAborted(signal) {
-	signal?.throwIfAborted();
-}
-async function afterAbortCheck(signal, operation) {
-	throwIfAborted(signal);
-	const result = await operation();
-	throwIfAborted(signal);
-	return result;
-}
-//#endregion
-//#region src/runtime/http-mcp-client.ts
-/**
-* `connectHttpMcp` — the remote (streamable HTTP) MCP client, sibling of
-* `connectStdioMcp`. Same connection contract (`tools`, `callTool`, `close`),
-* same error semantics (a JSON-RPC error / `isError` result is the agent's
-* `ERROR: …` outcome; a transport fault or timeout throws), no child process —
-* which is the point: this is the MCP path for environments that cannot spawn
-* stdio servers (Workers, browser-context agents, locked-down sandboxes) and
-* for servers that only exist as endpoints (a remote Hindsight, a hosted MCP).
-*
-* Transport: MCP "streamable HTTP" (protocol 2025-03-26 / 2025-06-18). Every
-* request is a POST with `Accept: application/json, text/event-stream`; the
-* server may answer either shape, so both are parsed. A server-assigned
-* `Mcp-Session-Id` response header is captured and replayed on every later
-* request (and the DELETE on close) — stateful servers refuse without it,
-* stateless ones simply never send it.
-*
-* Auth headers can be protected values: they are sent to the server but never
-* allowed back out — error messages and tool results are redacted against the
-* exact protected values, mirroring `connectStdioMcp`'s protectedEnv handling.
-*/
-const HTTP_MCP_PROTOCOL_VERSION = "2025-06-18";
-/** A remote MCP endpoint refused the connection before the handshake completed. */
-var McpConnectFault = class extends Error {
-	status;
-	constructor(message, status) {
-		super(message);
-		this.status = status;
-		this.name = "McpConnectFault";
-	}
-};
-const SSE_DATA_LINE = /^data:\s?(.*)$/s;
-function parseSseBody(body, wantId) {
-	for (const chunk of body.split(/\r?\n\r?\n/)) for (const line of chunk.split(/\r?\n/)) {
-		const match = SSE_DATA_LINE.exec(line);
-		if (!match) continue;
-		try {
-			const parsed = JSON.parse(match[1] ?? "");
-			if (parsed.id === wantId) return parsed;
-		} catch {}
-	}
-}
-function redactValuesFrom(text, values) {
-	let out = text;
-	for (const value of values) if (value.length > 0) out = out.split(value).join("[redacted]");
-	return out;
-}
-/** Connect to a remote MCP endpoint: initialize, list tools, return the live connection. */
-async function connectHttpMcp(spec) {
-	let endpoint;
-	try {
-		endpoint = new URL(spec.url);
-	} catch {
-		throw new ValidationError(`connectHttpMcp: invalid MCP endpoint URL: ${spec.url}`);
+		throw new ValidationError(`connectHttpMcp: invalid MCP endpoint URL: ${spec.url}`);
 	}
 	if (endpoint.protocol !== "https:" && endpoint.hostname !== "localhost" && endpoint.hostname !== "127.0.0.1") throw new ValidationError(`connectHttpMcp: refusing non-HTTPS MCP endpoint ${endpoint.origin} (localhost excepted) — a bearer or api key on plain HTTP would cross the network in the clear`);
 	const fetchImpl = spec.fetchImpl ?? fetch;
@@ -6209,7 +5847,7 @@ async function openSandboxRun(client, options, deliverable) {
 		...error !== void 0 ? { error: errorMessage(error) } : {}
 	});
 	async function settle(box, events, turnIndex, turnKind) {
-		const collector = createTurnEventCollector();
+		const collector = createSandboxTurnEventCollector();
 		const outcomeTracker = createAgentRunOutcomeTracker();
 		try {
 			for await (const ev of events) {
@@ -6397,258 +6035,6 @@ function hashText(value) {
 	}
 	return (hash >>> 0).toString(16).padStart(8, "0");
 }
-/**
-* Collect one turn's events, keeping only the newest snapshot of each streamed text or
-* reasoning part.
-*
-* opencode sends `message.part.updated` once per token, and every frame carries the part's
-* whole cumulative text, so keeping every frame holds O(L²) bytes per turn: two concurrent
-* audit workflows took the platform API from 459 MB to an OOM at 1.95 GB in 11 minutes.
-* A snapshot (a frame whose part carries `text`) whose text extends the previous snapshot
-* of the same part replaces it and moves to the newest position, which is the rule the
-* Sandbox SDK's text collectors already apply, so the collected text is unchanged. The kept
-* frame drops its `delta`, because its text already holds every earlier increment and a
-* reader that joins `delta ?? part.text` across frames would otherwise read only the last
-* one. Delta-only frames and every other event are kept as they arrived.
-*/
-function createTurnEventCollector() {
-	const slots = [];
-	const snapshots = /* @__PURE__ */ new Map();
-	return {
-		push(event) {
-			const snapshot = partSnapshot(event);
-			if (!snapshot) {
-				slots.push(event);
-				return;
-			}
-			const previous = snapshots.get(snapshot.key);
-			const extends_ = previous !== void 0 && snapshot.text.startsWith(previous.text);
-			if (extends_) slots[previous.at] = void 0;
-			snapshots.set(snapshot.key, {
-				at: slots.length,
-				text: snapshot.text
-			});
-			slots.push(extends_ ? withoutDelta(event) : event);
-		},
-		events() {
-			return slots.filter((event) => event !== void 0);
-		}
-	};
-}
-function partSnapshot(event) {
-	if (event?.type !== "message.part.updated") return void 0;
-	const data = asRecord$1(event.data);
-	const part = asRecord$1(data?.part) ?? asRecord$1(asRecord$1(data?.properties)?.part);
-	if (!part || typeof part.id !== "string") return void 0;
-	if (part.type !== "text" && part.type !== "reasoning" && part.type !== "thinking") return void 0;
-	const text = typeof part.text === "string" ? part.text : typeof part.content === "string" ? part.content : void 0;
-	return text === void 0 ? void 0 : {
-		key: `${part.type}:${part.id}`,
-		text
-	};
-}
-function withoutDelta(event) {
-	const data = asRecord$1(event.data);
-	if (!data || !("delta" in data)) return event;
-	const { delta: _delta, ...rest } = data;
-	return {
-		...event,
-		data: rest
-	};
-}
-function asRecord$1(value) {
-	return value !== null && typeof value === "object" ? value : void 0;
-}
-//#endregion
-//#region src/runtime/authored-code.ts
-/**
-* The ONE lint over model-authored source.
-*
-* Authored optimization strategies use this static contract lint. General Runtime code-mode
-* scripts execute in the isolated QuickJS/WASM engine instead of relying on source lint.
-*
-* A LINT, NOT A SANDBOX — it reads text and cannot constrain what running code does, and trivial
-* concatenation defeats any token match. Its only job is refusing the obvious escapes so a typo or
-* a lazy model does not run; it is never the security boundary. Isolation, where required, is the
-* execution boundary's job (a jailed runner, a sandboxed loader), never this check's.
-*/
-/** Refuse the obvious escapes in authored source. See the module doc for what this is NOT. */
-function assertAuthoredCode(code, options = {}) {
-	const context = options.context ?? "authored code";
-	const allowed = options.allowedImports ?? [];
-	for (const line of code.split("\n")) {
-		if (!/^\s*import\s/.test(line)) continue;
-		if (!allowed.some((specifier) => line.includes(`'${specifier}'`) || line.includes(`"${specifier}"`))) throw new ValidationError(`${context} rejected: foreign import — ${line.trim().slice(0, 120)}${allowed.length === 0 ? " (no import is allowed here)" : ` (allowed: ${allowed.join(", ")})`}`);
-	}
-	for (const [pattern, what] of [
-		[/\brequire\s*\(/, "require()"],
-		[/\bimport\s*\(/, "dynamic import()"],
-		[/\beval\s*\(/, "eval()"],
-		[/new\s+Function\s*\(/, "new Function()"],
-		[/\bprocess\s*[.[]/, "process access"],
-		[/\bglobalThis\s*[.[]/, "globalThis access"],
-		[/\bfetch\s*\(/, "network access"],
-		[/child_process|node:fs|node:net|node:http|worker_threads/, "node builtin access"]
-	]) if (pattern.test(code)) throw new ValidationError(`${context} rejected: ${what}`);
-}
-//#endregion
-//#region src/runtime/strategy-author.ts
-/**
-* authorStrategy — the agent-authored layer as a package primitive (software-3.0): an
-* LLM reads a benchmark's per-task LOSSES + the defineStrategy contract and writes a NEW
-* optimization strategy as code; the caller gates it like any human-built candidate
-* (runBenchmark + a frozen holdout).
-*
-* Brokered shot()/critique() calls spend through the Supervisor's conserved pool.
-* Source validation checks obvious forbidden operations; it is not an execution sandbox.
-* Code that uses other execution paths can access state or spend outside that pool.
-* Callers must provide isolation when authored code requires an enforced boundary.
-*
-* The authored module is written to `outDir` and dynamically imported — run under a
-* TS-capable loader (tsx) since models often emit type annotations.
-*/
-/** The compressed consumable a skill carries: everything an author needs to emit a loop. */
-const strategyAuthorContract = `
-You author an OPTIMIZATION STRATEGY for an agentic loop system. A strategy decides how to
-spend a compute budget to beat a task's deployable check. You compose exactly two steps:
-
-  shot(spec?: { handle?, messages?, steer?, profile?, tools? }): Promise<ShotResult | null>
-    Runs ONE worker attempt (a bounded tool loop) over an artifact.
-    - omit handle  => the shot opens its OWN fresh artifact and closes it after (a sample).
-    - pass handle  => the shot CONTINUES that artifact (state accumulates across shots).
-    - messages     => the carried conversation (pass the previous ShotResult.messages to continue).
-    - steer        => a corrective instruction injected before the shot.
-    - profile      => a complete AgentProfile — give THIS shot its own instructions,
-      model, skills, tools, hooks, and subagents. Include name, harness, and
-      model: { provider, default }; put standing instructions in prompt.systemPrompt.
-      For example: { ...opts.workerProfile, name: 'researcher',
-        prompt: { ...opts.workerProfile.prompt,
-          systemPrompt: 'Inspect the evidence before proposing a change.' } }.
-      Choose an available model from the current execution setup. Omit profile to use
-      the worker's exact profile. Every shot spends from the same conserved budget.
-    - tools        => string[] — restrict THIS shot to a subset of the task's tools by
-      name (focus an explore shot on read-only tools, an execute shot on write tools).
-      Restriction-only; unknown names make the shot fail. ALWAYS select from
-      await listTools(handle) — never hardcode. Omitted => the shot sees every tool.
-    ShotResult = { messages, score (0..1 on the task's check), passes, total, completions, toolErrors }
-    Returns null if the attempt failed infra-wise.
-
-  critique(messages): Promise<string | null>
-    A firewalled trace-analyst reads the attempt's trajectory and returns ONE corrective
-    instruction (or null when it judges the work complete). Costs ~1 completion.
-
-  consult(messages, instruction): Promise<string | null>
-    The RAW analyst channel: the same firewalled critic answers YOUR instruction over the
-    trajectory verbatim (no reformatting) — use it when you need a specific reply format
-    (a decision, a prediction). Costs ~1 completion.
-
-  surface.open(task) / surface.close(handle)
-    Open a persistent artifact you manage yourself (remember to close in a finally).
-    close is idempotent — closing an already-closed handle is a safe no-op.
-
-  listTools(handle): Promise<Array<{ name, description? }>>
-    The tools THIS task actually offers. TOOL SETS VARY PER TASK — if you restrict a
-    shot with \`tools\`, you MUST pick names from await listTools(handle); hardcoding
-    names from an example kills your shots on every task whose tools differ.
-
-Rules:
-- ALWAYS await every shot/critique/surface call — a floating promise that rejects
-  crashes the whole benchmark run.
-- Stay within ~budget total shots; every shot/critique spends from a conserved pool.
-- For a FRESH attempt OMIT \`messages\` entirely (never pass \`[]\` — an empty array is a
-  fresh conversation too, but be explicit). To CONTINUE, pass the previous
-  ShotResult.messages unchanged.
-- Return { score, resolved, completions, progression, shots } — score = the BEST checkpoint
-  you reached (keep-best, never final-state), progression = score after each shot.
-- The module must be EXACTLY this shape (no other imports, no commentary outside code):
-
-import { defineStrategy } from '@tangle-network/agent-runtime/kernel'
-export default defineStrategy('your-strategy-name', async ({ surface, task, opts, budget, shot, critique, listTools }) => {
-  // your composition (listTools comes from the destructured context — it is NOT a global)
-})
-`;
-/** Standing behavior callers put in the strategy-author AgentProfile. */
-const strategyAuthorSystemPrompt = "You are a senior researcher authoring optimization strategies for agent loops: you read per-task losses like experimental data, form a mechanism-level hypothesis, and author the one composition that tests it. Output exactly one fenced ```ts code block and nothing else.";
-/** Static CONTRACT lint over an authored strategy module — the module-boundary
-*  enforcement of the harness's two measurement invariants:
-*    - author blindness: the only import allowed is the kernel surface. A body that could
-*      reach the filesystem, network, or process could read or mutate verifier/artifact
-*      state outside the brokered shots, and the harness-verified score would stop
-*      meaning "what the shots achieved".
-*    - conserved dose: no out-of-band compute (fetch/require/eval) — every unit a
-*      strategy spends is metered by the Supervisor's pool, which is what makes
-*      equal-budget comparisons between strategies valid.
-*  A lint, not a sandbox: its job is keeping the benchmark numbers interpretable. */
-function assertStrategyContract(code) {
-	assertAuthoredCode(code, { allowedImports: ["@tangle-network/agent-runtime/kernel"] });
-}
-/** Ask the author for a strategy module. A failed call throws; a reply without a fenced
-*  module is `code: null`. With `fallbackProfile`, the fallback gets one attempt when the
-*  primary call fails or its reply carries no module. */
-async function requestStrategySource(opts) {
-	const turns = [];
-	const attempt = async (profile) => {
-		const res = await profileChatClient({
-			profile,
-			executor: opts.executor,
-			context: "strategy author"
-		}).chat({ messages: [{
-			role: "user",
-			content: `${opts.contract ?? strategyAuthorContract}\n\nBASELINE RESULTS on the "${opts.environmentName}" environment (budget=${opts.budget}) — the per-task losses are your gradient:\n${opts.lossesJson}\n\nAuthor ONE new strategy that you expect to beat the baselines on THIS environment at the same budget.\n${strategyAuthorMethod}\n\nOutput only the module code block.`
-		}] }, { ...opts.signal ? { signal: opts.signal } : {} });
-		turns.push({
-			content: res.content,
-			model: res.model,
-			inputTokens: res.usage.promptTokens,
-			outputTokens: res.usage.completionTokens,
-			tokensKnown: res.usage.captured !== false,
-			costUsd: res.costUsd
-		});
-		return res.content.match(/```(?:ts|typescript)?\s*\n([\s\S]*?)```/)?.[1] ?? null;
-	};
-	try {
-		const code = await attempt(opts.profile);
-		if (code !== null || !opts.fallbackProfile) return {
-			code,
-			turns
-		};
-	} catch (primaryError) {
-		if (!opts.fallbackProfile) throw primaryError;
-	}
-	return {
-		code: await attempt(opts.fallbackProfile),
-		turns
-	};
-}
-/** Lint an authored module, write it under `outDir` at a name its content fixes, and import
-*  its default Strategy. The same source always loads from the same file. Throws when the
-*  module breaks the contract or exports no Strategy. */
-async function loadAuthoredStrategy(code, outDir) {
-	assertStrategyContract(code);
-	const file = join(outDir, `strategy-${sha256Bytes$1(Buffer.from(code, "utf8")).slice(7)}.mts`);
-	if (!existsSync(file)) {
-		mkdirSync(outDir, { recursive: true });
-		const partial = `${file}.${process.pid}.tmp`;
-		writeFileSync(partial, code);
-		renameSync(partial, file);
-	}
-	const mod = await import(pathToFileURL(file).href);
-	if (!mod.default || typeof mod.default.driver !== "function" || !mod.default.name) throw new Error(`authorStrategy: ${file} does not export a default Strategy`);
-	return {
-		strategy: mod.default,
-		file
-	};
-}
-/** Author + load a strategy from losses. Throws when the author emits no loadable module;
-*  with `fallbackProfile` set, the fallback gets one attempt first. */
-async function authorStrategy(opts) {
-	const { code, turns } = await requestStrategySource(opts);
-	if (code === null) throw new Error(`authorStrategy: no code block in the author's reply: ${(turns.at(-1)?.content ?? "").slice(0, 300)}`);
-	return {
-		...await loadAuthoredStrategy(code, opts.outDir),
-		code
-	};
-}
 //#endregion
 //#region src/runtime/strategy-evolution.ts
 /**
@@ -6685,10 +6071,10 @@ const NO_MODULE = "the author reply carried no fenced ts module";
 /** Evolve a strategy on the search kernel and claim once on the sealed test split. */
 async function runStrategyEvolution(cfg) {
 	const root = cfg.root ?? refine;
-	const budget = positiveInteger("budget", cfg.budget ?? 3);
-	const concurrency = positiveInteger("concurrency", cfg.concurrency ?? 3);
+	const budget = positiveInteger$1("budget", cfg.budget ?? 3);
+	const concurrency = positiveInteger$1("concurrency", cfg.concurrency ?? 3);
 	const maxExpansions = nonNegativeInteger("maxExpansions", cfg.maxExpansions ?? 4);
-	const maxAttempts = positiveInteger("maxAttempts", cfg.maxAttempts ?? 3);
+	const maxAttempts = positiveInteger$1("maxAttempts", cfg.maxAttempts ?? 3);
 	const seed = nonNegativeInteger("seed", cfg.seed ?? 42);
 	const cellUsd = dollars("cellUsd", cfg.cellUsd) ?? 0;
 	const maxUsd = dollars("maxUsd", cfg.maxUsd);
@@ -7275,7 +6661,7 @@ function shareText(error) {
 function compare(left, right) {
 	return left < right ? -1 : left > right ? 1 : 0;
 }
-function positiveInteger(name, value) {
+function positiveInteger$1(name, value) {
 	if (!Number.isSafeInteger(value) || value < 1) throw new ConfigError(`evolution: ${name} must be a positive integer`);
 	return value;
 }
@@ -7539,7 +6925,7 @@ function graphDesignerExtraTools(env) {
 			})();
 			if (name === "designer_history") return (async () => {
 				const args = asRecord(raw ?? {}, "designer_history");
-				const { listGraphRuns } = await import("./graph-registry-DAI6KNXB.js").then((n) => n.o);
+				const { listGraphRuns } = await import("./graph-registry-By0tUj4S.js").then((n) => n.o);
 				const all = await listGraphRuns(registry);
 				return { runs: (args.taskShape === void 0 ? all : all.filter((row) => row.taskDigest === taskShapeDigest(asRecord(args.taskShape, "designer_history.taskShape")))).map(summarize) };
 			})();
@@ -7550,7 +6936,7 @@ function graphDesignerExtraTools(env) {
 				if (mode === "replay") {
 					const digest = args.graphDigest;
 					if (typeof digest !== "string" || digest.length === 0) throw new ValidationError("designer_run_graph: replay mode requires graphDigest from lookup");
-					const { loadGraph } = await import("./graph-registry-DAI6KNXB.js").then((n) => n.o);
+					const { loadGraph } = await import("./graph-registry-By0tUj4S.js").then((n) => n.o);
 					const stored = await loadGraph(registry, digest);
 					if (!stored) throw new ValidationError(`designer_run_graph: no stored graph ${digest.slice(0, 12)} — re-lookup`);
 					const graph = env.bindCheck(graphFromStored(stored, () => {
@@ -9174,6 +8560,368 @@ function fsSurfaceReader(root) {
 	};
 }
 //#endregion
+//#region src/runtime/tangle-sandbox-exact-process-provider.ts
+const exactProcessProviderMarker = "agent-runtime.exact-process-provider";
+const exactProcessEgressMarker = "agent-runtime.exact-process-egress";
+/**
+* Adapt Tangle Sandbox's managed control runtime to Runtime's exact-process provider.
+*
+* The adapter deliberately exposes no ordinary agent environment: an exact experiment
+* must start a fresh Sandbox with no managed agent and launch its declared argv directly.
+*/
+function createTangleSandboxExactProcessProvider(client, options = {}) {
+	const name = options.name ?? "tangle-sandbox-exact-process";
+	if (!name.trim()) throw new Error("Tangle Sandbox exact-process provider name must not be empty");
+	return {
+		name,
+		exactProcess: {
+			async create(input) {
+				throwIfAborted(input.signal);
+				assertNoProviderOptions(input.providerOptions);
+				const egressPolicy = sandboxEgressPolicy(input.egress);
+				const metadata = exactMetadata(input.metadata, name, egressPolicy);
+				const sandbox = await client.create({
+					environment: requiredText(input.image, "exact-process image"),
+					agent: false,
+					bare: false,
+					ephemeral: true,
+					egressPolicy,
+					resources: sandboxResources(input),
+					maxLifetimeSeconds: sandboxLifetimeSeconds(input.maxLifetimeMs),
+					metadata,
+					idempotencyKey: requiredText(input.idempotencyKey, "exact-process idempotency key")
+				}, {
+					...input.provisionTimeoutMs === void 0 ? {} : { timeoutMs: positiveInteger(input.provisionTimeoutMs, "provision timeout") },
+					...input.signal === void 0 ? {} : { signal: input.signal }
+				});
+				try {
+					throwIfAborted(input.signal);
+					assertExactSandboxMetadata(sandbox, metadata);
+					await assertExactSandboxEgress(sandbox, egressPolicy);
+				} catch (error) {
+					await discardInvalidSandbox(sandbox, error);
+				}
+				return sandboxAsExactProcessEnvironment(sandbox, name);
+			},
+			async get(id) {
+				const sandbox = await client.get(id);
+				if (!sandbox || !isExactSandbox(sandbox, name)) return null;
+				await assertExactSandboxEgress(sandbox, egressFromMetadata(sandbox.metadata));
+				return sandboxAsExactProcessEnvironment(sandbox, name);
+			},
+			async list(query) {
+				assertNoProviderOptions(query?.providerOptions);
+				const sandboxes = await client.list();
+				return Promise.all(sandboxes.filter((sandbox) => isExactSandbox(sandbox, name)).filter((sandbox) => metadataMatches(sandbox.metadata, query?.metadata)).map(async (sandbox) => {
+					await assertExactSandboxEgress(sandbox, egressFromMetadata(sandbox.metadata));
+					return sandboxAsExactProcessEnvironment(sandbox, name);
+				}));
+			}
+		},
+		capabilities: exactProcessOnlyCapabilities,
+		async create() {
+			throw new Error(`agent environment provider "${name}" supports exactProcess.create() only`);
+		}
+	};
+}
+function sandboxAsExactProcessEnvironment(sandbox, provider) {
+	return {
+		id: requiredText(sandbox.id, "Sandbox id"),
+		provider,
+		...sandbox.metadata ? { metadata: sandbox.metadata } : {},
+		process: {
+			async list() {
+				return (await sandbox.process.list()).map((status) => exactProcessStatus(status));
+			},
+			async get(pid) {
+				const process = await sandbox.process.get(pid);
+				return process ? sandboxProcessAsExactProcess(process) : null;
+			},
+			async spawn(input, options) {
+				return sandboxProcessAsExactProcess(await afterAbortCheck(options?.signal, () => sandbox.process.spawnExact(input.executable, [...input.args], {
+					cwd: input.cwd,
+					env: { ...input.env },
+					inheritEnv: false,
+					...input.stdin === void 0 ? {} : { stdin: input.stdin },
+					timeoutMs: input.timeoutMs
+				})));
+			}
+		},
+		async writeFile(path, bytes, options) {
+			if (sandbox.fs.supportsWriteMode !== true) throw new Error("Tangle Sandbox does not declare exact file-mode support");
+			await afterAbortCheck(options.signal, () => sandbox.fs.write(path, Buffer.from(bytes).toString("base64"), {
+				encoding: "base64",
+				mode: fileMode(options.mode)
+			}));
+		},
+		async readFile(path, options) {
+			const maxBytes = nonnegativeInteger(options.maxBytes, "exact-process file read maximum");
+			const initialSize = nonnegativeInteger((await afterAbortCheck(options.signal, () => sandbox.fs.stat(path))).size, `Tangle Sandbox file size for "${path}"`);
+			if (initialSize > maxBytes) throw new Error(`Tangle Sandbox file "${path}" exceeds the ${maxBytes}-byte exact read maximum`);
+			const result = await afterAbortCheck(options.signal, () => sandbox.fs.readBatch([path], { encoding: "base64" }));
+			const failure = result.errors.find((entry) => entry.path === path);
+			if (failure) throw new Error(`Tangle Sandbox failed to read "${path}": ${failure.error}`);
+			const files = result.files.filter((entry) => entry.path === path);
+			if (files.length !== 1) throw new Error(`Tangle Sandbox returned ${files.length} files for exact read "${path}"`);
+			const file = files[0];
+			if (file.encoding !== "base64") throw new Error(`Tangle Sandbox returned non-binary content for exact read "${path}"`);
+			const size = nonnegativeInteger(file.size, `Tangle Sandbox file size for "${path}"`);
+			if (size !== initialSize) throw new Error(`Tangle Sandbox file "${path}" changed during exact read`);
+			if (size > maxBytes) throw new Error(`Tangle Sandbox file "${path}" exceeds the ${maxBytes}-byte exact read maximum`);
+			const bytes = Buffer.from(file.content, "base64");
+			if (bytes.byteLength !== size || bytes.toString("base64") !== file.content) throw new Error(`Tangle Sandbox returned an invalid binary payload for exact read "${path}"`);
+			return Uint8Array.from(bytes);
+		},
+		async destroy() {
+			await sandbox.delete();
+		}
+	};
+}
+function sandboxProcessAsExactProcess(process) {
+	const pid = positiveInteger(process.pid, "Tangle Sandbox process pid");
+	return {
+		pid,
+		async status() {
+			return exactProcessStatus(await process.status(), pid);
+		},
+		async wait() {
+			const waitExitCode = await process.wait();
+			if (!Number.isSafeInteger(waitExitCode)) throw new Error("Tangle Sandbox process wait returned an invalid exit code");
+			const status = exactProcessStatus(await process.status(), pid);
+			if (status.running || !status.termination) throw new Error("Tangle Sandbox process wait returned before terminal status");
+			if (status.termination.kind === "exit" && status.termination.exitCode !== waitExitCode) throw new Error("Tangle Sandbox process wait and status disagree on exit code");
+			return status.termination;
+		},
+		async kill() {
+			await process.kill("SIGKILL", { tree: true });
+		},
+		async *stdout() {
+			yield* process.stdout();
+		},
+		async *stderr() {
+			yield* process.stderr();
+		}
+	};
+}
+function exactProcessStatus(status, expectedPid) {
+	const pid = positiveInteger(status.pid, "Tangle Sandbox process pid");
+	if (expectedPid !== void 0 && pid !== expectedPid) throw new Error("Tangle Sandbox process status changed process identity");
+	if (typeof status.running !== "boolean") throw new Error("Tangle Sandbox process status is missing running state");
+	if (!Number.isSafeInteger(status.exitCode)) throw new Error("Tangle Sandbox process status is missing an integer exit code");
+	const exitSignal = optionalText(status.exitSignal, "Tangle Sandbox process exit signal");
+	if (status.running) {
+		if (status.exitCode !== -1) throw new Error("Tangle Sandbox running process must report exit code -1");
+		if (exitSignal) throw new Error("Tangle Sandbox running process must not report an exit signal");
+		return {
+			pid,
+			running: true,
+			exitCode: -1
+		};
+	}
+	const termination = exitSignal ? {
+		kind: "signal",
+		signal: exitSignal
+	} : status.exitCode >= 0 ? {
+		kind: "exit",
+		exitCode: status.exitCode
+	} : void 0;
+	if (!termination) throw new Error("Tangle Sandbox stopped process has no terminal reason");
+	return {
+		pid,
+		running: false,
+		exitCode: status.exitCode,
+		...exitSignal ? { exitSignal } : {},
+		termination
+	};
+}
+function exactMetadata(metadata, provider, egressPolicy) {
+	for (const marker of [exactProcessProviderMarker, exactProcessEgressMarker]) if (Object.hasOwn(metadata, marker)) throw new Error(`exact-process metadata must not set "${marker}"`);
+	return {
+		...metadata,
+		[exactProcessProviderMarker]: provider,
+		[exactProcessEgressMarker]: serializeEgressPolicy(egressPolicy)
+	};
+}
+function isExactSandbox(sandbox, provider) {
+	return sandbox.metadata?.[exactProcessProviderMarker] === provider;
+}
+function metadataMatches(metadata, expected) {
+	return expected === void 0 || Object.entries(expected).every(([key, value]) => isDeepStrictEqual(metadata?.[key], value));
+}
+function assertExactSandboxMetadata(sandbox, expected) {
+	if (!metadataMatches(sandbox.metadata, expected)) throw new Error("Tangle Sandbox did not persist exact-process metadata");
+}
+function egressFromMetadata(metadata) {
+	const encoded = metadata?.[exactProcessEgressMarker];
+	if (typeof encoded !== "string") throw new Error("Tangle Sandbox exact-process environment is missing egress metadata");
+	try {
+		const parsed = JSON.parse(encoded);
+		if (!parsed || typeof parsed !== "object") throw new Error("expected egress object");
+		const policy = parsed;
+		if (policy.mode === "blocked" && policy.allowDomains === void 0) return { mode: "blocked" };
+		if (policy.mode === "strict" && policy.includeImplicitDomains === false && Array.isArray(policy.allowDomains) && policy.allowDomains.every((domain) => typeof domain === "string")) {
+			const allowDomains = sortedDomains(policy.allowDomains);
+			if (new Set(allowDomains).size === allowDomains.length) return {
+				mode: "strict",
+				allowDomains,
+				includeImplicitDomains: false
+			};
+		}
+	} catch {
+		throw new Error("Tangle Sandbox exact-process environment has invalid egress metadata");
+	}
+	throw new Error("Tangle Sandbox exact-process environment has invalid egress metadata");
+}
+async function assertExactSandboxEgress(sandbox, expected) {
+	const actual = (await sandbox.egress.get()).policy;
+	if (actual.mode !== expected.mode) throw new Error(`Tangle Sandbox egress mismatch: expected ${expected.mode}, received ${actual.mode}`);
+	if (expected.mode === "blocked") {
+		const allowDomains = actual.allowDomains;
+		if (actual.mode === "blocked" && (allowDomains === void 0 || Array.isArray(allowDomains) && allowDomains.length === 0)) return;
+		throw new Error("Tangle Sandbox blocked egress retained an allowlist");
+	}
+	if (actual.mode !== "strict") throw new Error("Tangle Sandbox did not return strict egress policy");
+	const expectedDomains = sortedDomains(expected.allowDomains);
+	if (!isDeepStrictEqual(sortedDomains(actual.allowDomains ?? []), expectedDomains)) throw new Error("Tangle Sandbox strict egress differs from the exact allowlist");
+	if (actual.includeImplicitDomains !== false) throw new Error("Tangle Sandbox strict egress retained implicit domains");
+}
+function sandboxEgressPolicy(input) {
+	if (input.mode === "blocked") return { mode: "blocked" };
+	const allowDomains = input.allowDomains.map((domain) => requiredText(domain, "strict egress domain"));
+	if (new Set(allowDomains).size !== allowDomains.length) throw new Error("strict egress domains must not contain duplicates");
+	return {
+		mode: "strict",
+		allowDomains,
+		includeImplicitDomains: false
+	};
+}
+function serializeEgressPolicy(policy) {
+	return JSON.stringify(policy.mode === "blocked" ? { mode: "blocked" } : {
+		mode: "strict",
+		allowDomains: sortedDomains(policy.allowDomains),
+		includeImplicitDomains: false
+	});
+}
+function sandboxResources(input) {
+	const cpuCores = positiveNumber(input.resources.cpu, "exact-process cpu");
+	const memoryMB = positiveInteger(input.resources.memoryMb, "exact-process memory");
+	const diskMb = positiveInteger(input.resources.diskMb, "exact-process disk");
+	if (diskMb % 1024 !== 0) throw new Error("Tangle Sandbox exact-process disk must be a whole GiB");
+	return {
+		cpuCores,
+		memoryMB,
+		diskGB: diskMb / 1024
+	};
+}
+function sandboxLifetimeSeconds(maxLifetimeMs) {
+	const milliseconds = positiveInteger(maxLifetimeMs, "exact-process maximum lifetime");
+	if (milliseconds % 1e3 !== 0) throw new Error("Tangle Sandbox exact-process maximum lifetime must be a whole number of seconds");
+	return milliseconds / 1e3;
+}
+function fileMode(value) {
+	const mode = nonnegativeInteger(value, "exact-process file mode");
+	if (mode > 4095) throw new Error("exact-process file mode exceeds POSIX mode bits");
+	return mode;
+}
+function assertNoProviderOptions(providerOptions) {
+	if (providerOptions && Object.keys(providerOptions).length > 0) throw new Error("Tangle Sandbox exact-process provider does not accept providerOptions");
+}
+function exactProcessOnlyCapabilities() {
+	return {
+		profile: {
+			namedProfiles: false,
+			systemPrompt: {
+				replace: false,
+				append: false
+			},
+			instructions: false,
+			tools: false,
+			permissions: false,
+			mcp: false,
+			subagents: false,
+			resources: {
+				files: false,
+				instructions: false,
+				tools: false,
+				skills: false,
+				agents: false,
+				commands: false
+			},
+			hooks: false,
+			modes: false,
+			runtimeUpdate: false,
+			validation: false
+		},
+		streaming: {
+			live: false,
+			replay: false,
+			detach: false,
+			turnIdempotency: false
+		},
+		sessions: {
+			continue: false,
+			list: false,
+			messages: false
+		},
+		workspace: {
+			read: false,
+			write: false,
+			exec: false,
+			git: false,
+			upload: false,
+			download: false
+		},
+		branching: {
+			checkpoint: false,
+			fork: false
+		},
+		placement: false,
+		usage: false,
+		confidential: false,
+		exactProcess: { egress: ["blocked", "strict"] }
+	};
+}
+async function discardInvalidSandbox(sandbox, cause) {
+	try {
+		await sandbox.delete();
+	} catch (destroyError) {
+		throw new AggregateError([cause, destroyError], "Tangle Sandbox exact-process creation failed and cleanup failed");
+	}
+	throw cause;
+}
+function sortedDomains(domains) {
+	return [...domains].sort((left, right) => left.localeCompare(right));
+}
+function requiredText(value, label) {
+	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} must be a non-empty string`);
+	return value;
+}
+function optionalText(value, label) {
+	if (value === void 0) return void 0;
+	return requiredText(value, label);
+}
+function positiveNumber(value, label) {
+	if (!Number.isFinite(value) || value <= 0) throw new Error(`${label} must be positive`);
+	return value;
+}
+function positiveInteger(value, label) {
+	if (!Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
+	return value;
+}
+function nonnegativeInteger(value, label) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative integer`);
+	return value;
+}
+function throwIfAborted(signal) {
+	signal?.throwIfAborted();
+}
+async function afterAbortCheck(signal, operation) {
+	throwIfAborted(signal);
+	const result = await operation();
+	throwIfAborted(signal);
+	return result;
+}
+//#endregion
 //#region src/runtime/verifier-environment.ts
 const submitTool = {
 	type: "function",
@@ -9588,6 +9336,6 @@ function tail(s) {
 	return s.slice(-400);
 }
 //#endregion
-export { runBenchmark as $, McpSpawnFault as $t, connectRemoteSupervisor as A, inlineSandboxClient as At, chatTransportExecutor as B, runIsolatedCheck as Bt, analyzeTrace as C, observationFromRegistry as Ct, compileSearchSpec as D, defineLeaderboard as Dt, assertSearchSpec as E, harvestCorpus as Et, profileRunsForName as F, checkProgramDigest as Ft, assertStrategyContract as G, leaderboard as Gt, createChatSessionStore as H, deterministicCompletion as Ht, recordProfileRun as I, declaredCheckDeliverable as It, strategyAuthorSystemPrompt as J, renderLeaderboardMarkdown as Jt, authorStrategy as K, pairwiseSignificance as Kt, patchDelivered as L, declaredCheckDigest as Lt, loadProfile as M, loopDispatch as Mt, pickBestProfile as N, superviseDispatch as Nt, searchPresets as O, resolveSandboxClient as Ot, profileRegistry as P, assertDeclaredCheck as Pt, printBenchmarkReport as Q, openSqlRunStore as Qt, runCoderChecks as R, declaredCheckJudge as Rt, withUntrackedArtifacts as S, registryScopeAnalyst as St, SEARCH_SPEC_CORRELATION_KEY as T, HarvestError as Tt, runStrategyEvolution as U, sentinelCompletion as Ut, chatWorkerSeam as V, completionAuthorizes as Vt, strategyTournament as W, stopSentinel as Wt, openSandboxRun as X, renderPairwiseMarkdown as Xt, SandboxRunAbortError as Y, renderLeaderboardSvg as Yt, createS3PrivateCasStore as Z, SqlRunOwnershipError as Zt, VERIFY_TAIL_CHARS as _, verify as _t, localShell as a, mcpSecretEnvMetadataKey as an, builtinShapes as at, settledWorkerOut as b, buildSteerContext as bt, createVerifierEnvironment as c, secretEnvOfMcpServer as cn, FileCorpus as ct, harvestSurfaceDiffs as d, fanout as dt, connectStdioMcp as en, createPrivateCasArtifactPort as et, analystsFromRegistry as f, flatWidenGate as ft, NOTE_MAX_CHARS as g, selectValidWinner as gt, EVIDENCE_MAX_CHARS as h, pipeline as ht, jjWorkspace as i, envKeyProvider as in, runPersonified as it, bestProfileFor as j, loopCampaignDispatch as jt, searchSpecDigest as k, localSandboxClient as kt, boxSurfaceReader as l, createTangleSandboxExactProcessProvider as ln, InMemoryCorpus as lt, worktreeFanout as m, panel as mt, makeFinding$1 as n, createMcpEnvironment as nn, trajectoryReport as nt, runInWorkspace as o, resolveMcpServerLaunch as on, createShapeRegistry as ot, failuresAnalyst as p, loopUntil as pt, strategyAuthorContract as q, renderLeaderboardHtml as qt, gitWorkspace as r, sanitizeMcpToolSchema as rn, definePersona as rt, createWaterfallCollector as s, resolveSecretEnv as sn, registerShape as st, computeFindingId$1 as t, materializeLocalMcp as tn, equalKOnCost as tt, fsSurfaceReader as u, renderCorpusToInstructions as ut, closingWorkerNote as v, widen as vt, createFencedSqlRunContext as w, inProcessSandboxClient as wt, copyUntrackedIntoClone as x, createScopeAnalyst as xt, composeWorkerEvidence as y, assertTraceDerivedFindings as yt, graphDesignerExtraTools as z, readDeclaredCheck as zt };
+export { trajectoryReport as $, createMcpEnvironment as $t, searchSpecDigest as A, superviseDispatch as At, graphDesignerExtraTools as B, sentinelCompletion as Bt, withUntrackedArtifacts as C, harvestCorpus as Ct, assertSearchSpec as D, inlineSandboxClient as Dt, SEARCH_SPEC_CORRELATION_KEY as E, localSandboxClient as Et, profileRegistry as F, declaredCheckJudge as Ft, strategyTournament as G, renderLeaderboardMarkdown as Gt, chatWorkerSeam as H, leaderboard as Ht, profileRunsForName as I, readDeclaredCheck as It, createS3PrivateCasStore as J, SqlRunOwnershipError as Jt, SandboxRunAbortError as K, renderLeaderboardSvg as Kt, recordProfileRun as L, runIsolatedCheck as Lt, bestProfileFor as M, checkProgramDigest as Mt, loadProfile as N, declaredCheckDeliverable as Nt, compileSearchSpec as O, loopCampaignDispatch as Ot, pickBestProfile as P, declaredCheckDigest as Pt, equalKOnCost as Q, materializeLocalMcp as Qt, patchDelivered as R, completionAuthorizes as Rt, copyUntrackedIntoClone as S, HarvestError as St, createFencedSqlRunContext as T, resolveSandboxClient as Tt, createChatSessionStore as U, pairwiseSignificance as Ut, chatTransportExecutor as V, stopSentinel as Vt, runStrategyEvolution as W, renderLeaderboardHtml as Wt, runBenchmark as X, McpSpawnFault as Xt, printBenchmarkReport as Y, openSqlRunStore as Yt, createPrivateCasArtifactPort as Z, connectStdioMcp as Zt, NOTE_MAX_CHARS as _, buildSteerContext as _t, localShell as a, secretEnvOfMcpServer as an, FileCorpus as at, composeWorkerEvidence as b, observationFromRegistry as bt, createVerifierEnvironment as c, fanout as ct, fsSurfaceReader as d, panel as dt, sanitizeMcpToolSchema as en, definePersona as et, harvestSurfaceDiffs as f, pipeline as ft, EVIDENCE_MAX_CHARS as g, assertTraceDerivedFindings as gt, worktreeFanout as h, widen as ht, jjWorkspace as i, resolveSecretEnv as in, registerShape as it, connectRemoteSupervisor as j, assertDeclaredCheck as jt, searchPresets as k, loopDispatch as kt, createTangleSandboxExactProcessProvider as l, flatWidenGate as lt, failuresAnalyst as m, verify as mt, makeFinding$1 as n, mcpSecretEnvMetadataKey as nn, builtinShapes as nt, runInWorkspace as o, InMemoryCorpus as ot, analystsFromRegistry as p, selectValidWinner as pt, openSandboxRun as q, renderPairwiseMarkdown as qt, gitWorkspace as r, resolveMcpServerLaunch as rn, createShapeRegistry as rt, createWaterfallCollector as s, renderCorpusToInstructions as st, computeFindingId$1 as t, envKeyProvider as tn, runPersonified as tt, boxSurfaceReader as u, loopUntil as ut, VERIFY_TAIL_CHARS as v, createScopeAnalyst as vt, analyzeTrace as w, defineLeaderboard as wt, settledWorkerOut as x, inProcessSandboxClient as xt, closingWorkerNote as y, registryScopeAnalyst as yt, runCoderChecks as z, deterministicCompletion as zt };
 
-//# sourceMappingURL=runtime-qFLOq1R9.js.map
+//# sourceMappingURL=runtime-D37zRSs7.js.map