@tangle-network/agent-runtime 0.349.0 → 0.352.1

package/dist/{sandbox-profile-compat-DtuJWFrM.js → sandbox-profile-compat-CXjozdWL.js}

@@ -1,10 +1,10 @@
-import { m as ValidationError } from "./errors-DodWX-cb.js";
-import { runTaskQueue } from "./task-queue.js";
+import { m as ValidationError } from "./errors-AzSuGI23.js";
+import { p as mapWithConcurrency } from "./util-ebWMWzY0.js";
 import { agentCandidateArtifactRefSchema, canonicalCandidateBytes as canonicalCandidateBytes$1 } from "@tangle-network/agent-interface";
 import { isRecord } from "@tangle-network/agent-core";
 import { createHash, randomUUID } from "node:crypto";
 import { constants } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
+import { dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import { spawn } from "node:child_process";
 import { lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
@@ -12,629 +12,36 @@ import { Readable } from "node:stream";
 import { isAnyArrayBuffer, isSharedArrayBuffer } from "node:util/types";
 import { extract, pack } from "tar-stream";
 import { pipeline } from "node:stream/promises";
-//#region src/runtime/supervise/deadline.ts
-const MAX_TIMER_DELAY_MS = 2147483647;
-const DEFAULT_SUCCESSFUL_SHUTDOWN_MS = 5e3;
-/** The abort reason a child's own deadline carries. */
-const CHILD_DEADLINE_REASON = "child deadline exceeded";
-/** The abort reason the root's budget deadline cascades to every node. */
-const ROOT_DEADLINE_REASON = "root budget deadline exceeded";
-/** The check-in a child receives at its own time box. */
-const DEADLINE_CHECK_IN_MESSAGE = "Check-in: your time box has ended. This is not a stop. Finish the step you are on and start nothing new. Record your current state and every result you have not recorded yet, then call submit_result with what you have now; if the work is not done, mark it incomplete and name what remains. Your lead decides whether to continue you or hand the work on. You keep running while you make progress.";
-/** The idle bound a check-in policy sets, or undefined when time boxes are hard kills. */
-function checkInIdleMs(policy) {
-	if (policy === false) return void 0;
-	const idleMs = policy?.idleMs ?? 18e5;
-	if (!Number.isSafeInteger(idleMs) || idleMs <= 0) throw new ValidationError("deadlineCheckIn.idleMs must be a positive safe integer of milliseconds");
-	return idleMs;
-}
-/**
-* How long an abort waits for a manager whose result was already accepted to end the turn that
-* submitted it. Acceptance asks the turn's harness to stop; what remains is the turn's final
-* session copy (a bounded native capture), metering its usage and committing its result. Its
-* workspace capture is not part of it: the manager's owner runs that after the result.
-*/
-const ACCEPTED_RESULT_GRACE_MS = 5 * 6e4;
-/** Whether an abort reason is a deadline: the child's own or the root budget's. */
-function isDeadlineAbortReason(reason) {
-	return reason === "child deadline exceeded" || reason === "root budget deadline exceeded";
-}
-const TEARDOWN_ACKNOWLEDGEMENT_MS = 250;
-/** Arm a finite wall-clock deadline in safe chunks. Resource deadlines unref by default;
-* a standalone wait opts into keeping the process alive until it settles or is cancelled. */
-function armDeadlineTimer(delayMs, onDeadline, keepAlive = false) {
-	const deadlineAtMs = Date.now() + Math.max(0, delayMs);
-	if (!Number.isFinite(delayMs) || !Number.isSafeInteger(Math.ceil(deadlineAtMs))) throw new ValidationError("timer delay must produce a finite safe deadline");
-	let cleared = false;
-	let timer;
-	const arm = () => {
-		if (cleared) return;
-		const remainingMs = Math.max(0, deadlineAtMs - Date.now());
-		timer = setTimeout(() => {
-			if (cleared) return;
-			if (Date.now() >= deadlineAtMs) onDeadline();
-			else arm();
-		}, Math.min(remainingMs, MAX_TIMER_DELAY_MS));
-		if (!keepAlive && typeof timer.unref === "function") timer.unref();
-	};
-	arm();
-	return () => {
-		cleared = true;
-		if (timer !== void 0) clearTimeout(timer);
-	};
-}
-/**
-* Resolve a spawned child's duration into one absolute cutoff. An omitted child deadline inherits
-* the parent cutoff; an explicit child duration may shorten, but never extend, that cutoff.
-*/
-function boundedChildDeadlineAt(parentDeadlineAtMs, childDeadlineMs, nowMs) {
-	const parent = parentDeadlineAtMs > 0 ? parentDeadlineAtMs : void 0;
-	const child = childDeadlineMs === void 0 ? void 0 : nowMs + childDeadlineMs;
-	if (parent === void 0) return child;
-	if (child === void 0) return parent;
-	return Math.min(parent, child);
-}
-/** Invoke teardown once and bound how long the runtime waits for its acknowledgement. A hard
-* execution deadline always wins; without one, numeric grace gets a short acknowledgement
-* allowance and a brutal kill gets only that allowance. Explicit `infinity` remains unbounded
-* only when no execution deadline exists. The losing promise stays observed. `ask` issues the
-* request; a scope passes its per-child single-flight asker (see `singleFlightTeardown`). */
-async function teardownExecutor(executor, grace, deadlineAtMs, now, ask = (requested) => Promise.resolve(executor.teardown(requested))) {
-	const work = Promise.resolve(ask(grace));
-	const requestedWaitMs = grace === "infinity" ? void 0 : grace === "brutalKill" ? executor.teardownTimeoutMs ?? TEARDOWN_ACKNOWLEDGEMENT_MS : grace + TEARDOWN_ACKNOWLEDGEMENT_MS;
-	const deadlineWaitMs = deadlineAtMs === void 0 ? void 0 : Math.max(0, deadlineAtMs - now()) + TEARDOWN_ACKNOWLEDGEMENT_MS;
-	const waitMs = requestedWaitMs === void 0 ? deadlineWaitMs : deadlineWaitMs === void 0 ? requestedWaitMs : Math.min(requestedWaitMs, deadlineWaitMs);
-	let receipt;
-	if (waitMs === void 0) receipt = await work;
-	else if (waitMs <= 0) {
-		work.catch(() => void 0);
-		throw new ValidationError("executor teardown did not acknowledge before its deadline");
-	} else {
-		let clearTimer;
-		const timedOut = new Promise((_resolve, reject) => {
-			clearTimer = armDeadlineTimer(waitMs, () => reject(new ValidationError(`executor teardown did not acknowledge within ${waitMs}ms`)), true);
-		});
-		try {
-			receipt = await Promise.race([work, timedOut]);
-		} finally {
-			clearTimer?.();
-		}
-	}
-	if (!receipt.destroyed) throw new ValidationError(`executor teardown reported destroyed=false${receipt.detail ? `: ${receipt.detail}` : ""}`);
-}
-/**
-* The optional teardown surfaces a wrapping executor forwards, so wrapping never changes how a
-* child is released: the acknowledgement window a remote teardown needs, the release of a
-* retained execution at root settlement, and the environments an unconfirmed teardown names for
-* a sweeper. A wrapper that dropped `releaseRetained` left every retained child it wrapped
-* running after settlement. Each surface is present only when the inner executor implements it.
-*/
-function teardownSurfaces(inner) {
-	return {
-		...inner.teardownTimeoutMs === void 0 ? {} : { teardownTimeoutMs: inner.teardownTimeoutMs },
-		...inner.releaseRetained === void 0 ? {} : { releaseRetained: (signal) => inner.releaseRetained(signal) },
-		...inner.heldEnvironments === void 0 ? {} : { heldEnvironments: () => inner.heldEnvironments() },
-		...inner.heldForContinuation === void 0 ? {} : { heldForContinuation: () => inner.heldForContinuation() }
-	};
-}
-/**
-* An asker that sends an executor at most one teardown at a time. While a request is still
-* running, every later ask returns that same request instead of sending another beside it.
-*
-* A settlement's own teardown has a short acknowledgement window, and a request that misses it
-* keeps running. Without this, the first settlement retry sent a second teardown next to the
-* first. An executor that does not deduplicate internally, such as one that re-issues its
-* cancels, then ran two teardowns at once. `onRequest` runs once for each request actually sent.
-*/
-function singleFlightTeardown(executor, onRequest) {
-	let inFlight;
-	return (grace) => {
-		if (inFlight !== void 0) return inFlight;
-		onRequest();
-		let request;
-		try {
-			request = Promise.resolve(executor.teardown(grace));
-		} catch (error) {
-			request = Promise.reject(error);
-		}
-		inFlight = request;
-		const settle = () => {
-			if (inFlight === request) inFlight = void 0;
-		};
-		request.then(settle, settle);
-		return request;
-	};
-}
-//#endregion
-//#region src/runtime/supervise/resources.ts
-/** Validate caller-owned names and units without assigning domain meaning to them. */
-function assertResources(resources, kind, label) {
-	if (resources === void 0) return;
-	if (resources === null || typeof resources !== "object" || Array.isArray(resources)) throw new Error(`${label} must be a resource map`);
-	for (const [name, resource] of Object.entries(resources)) {
-		if (!name.trim() || !resource || typeof resource !== "object" || typeof resource.unit !== "string" || !resource.unit.trim()) throw new Error(`${label}: resource names and units must be non-empty strings`);
-		const value = kind === "limit" ? "limit" in resource ? resource.limit : void 0 : "amount" in resource ? resource.amount : void 0;
-		if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${label}.${name}.${kind} must be a non-negative safe integer`);
-		if (kind === "amount" && (!("known" in resource) || typeof resource.known !== "boolean")) throw new Error(`${label}.${name}.known must be a boolean`);
-	}
-}
-/** Missing contributors are not usage claims; enforced omissions are marked before aggregation.
-* Overflow retains a safe lower bound and marks it unknown, preserving readable component receipts. */
-function addResourceSpend(...maps) {
-	const totals = /* @__PURE__ */ new Map();
-	for (const resources of maps) {
-		assertResources(resources, "amount", "resource spend");
-		for (const [name, resource] of Object.entries(resources ?? {})) {
-			const prior = totals.get(name);
-			if (prior && prior.unit !== resource.unit) throw new Error(`resource ${name}: unit mismatch`);
-			const amount = (prior?.amount ?? 0) + resource.amount;
-			totals.set(name, {
-				unit: resource.unit,
-				amount: Math.min(amount, Number.MAX_SAFE_INTEGER),
-				known: (prior?.known ?? true) && resource.known && Number.isSafeInteger(amount)
-			});
+// src/agent/native-system-prompt.ts
+/** Native replace and append controls shared by local and sealed candidate execution. */
+function nativeSystemPrompt(harness, prompt, systemPath = ".tangle/system-prompt.md") {
+	const files = [];
+	const flags = [];
+	for (const intent of ["systemPrompt", "appendSystemPrompt"]) {
+		const text = prompt?.[intent];
+		if (text === void 0) continue;
+		if (typeof text !== "string" || intent === "appendSystemPrompt" && !text.trim()) throw new Error(`profile.prompt.${intent} must be ${intent === "systemPrompt" ? "a string" : "non-empty text"}`);
+		const append = intent === "appendSystemPrompt";
+		const path = append ? posix.join(posix.dirname(systemPath), "append-system-prompt.md") : systemPath;
+		if (harness === "codex" && append) {
+			flags.push("-c", `developer_instructions=${JSON.stringify(text)}`);
+			continue;
 		}
-	}
-	return totals.size ? { resources: Object.fromEntries(totals) } : {};
-}
-/** A terminal omission under an enforced ceiling is unknown, never measured zero. */
-function withBudgetResources(spend, budget, notStarted = false) {
-	const resources = new Map(Object.entries(addResourceSpend(spend.resources).resources ?? {}));
-	for (const [name, limit] of Object.entries(budget.resources ?? {})) {
-		const observed = resources.get(name);
-		if (observed && observed.unit !== limit.unit) throw new Error(`resource ${name}: unit mismatch`);
-		if (!observed) resources.set(name, {
-			unit: limit.unit,
-			amount: 0,
-			known: notStarted
-		});
-	}
-	return resources.size ? {
-		...spend,
-		resources: Object.fromEntries(resources)
-	} : spend;
-}
-/** Stream increments and a terminal total describe the same work; never sum them twice. */
-function resourceTelemetry(streamed, terminal) {
-	const resources = new Map(Object.entries(addResourceSpend(terminal.resources).resources ?? {}));
-	for (const [name, value] of Object.entries(streamed.resources ?? {})) {
-		const other = resources.get(name);
-		if (other && other.unit !== value.unit) throw new Error(`resource ${name}: unit mismatch`);
-		resources.set(name, {
-			...value,
-			amount: Math.max(value.amount, other?.amount ?? 0),
-			known: value.known && (other?.known ?? true) && (other === void 0 || other.amount === value.amount)
-		});
-	}
-	return addResourceSpend(Object.fromEntries(resources));
-}
-//#endregion
-//#region src/runtime/util.ts
-/**
-* Best-effort sandbox delete. Skips instances without a `delete` (test fakes);
-* swallows errors (the platform reaps on expiry). Returns `false` when delete
-* threw, `true` otherwise, so callers can surface a leak if they choose.
-*/
-async function deleteBoxSafe(box) {
-	if (!box || typeof box.delete !== "function") return true;
-	try {
-		await box.delete();
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** Short base36 id for trace correlation. Not cryptographic, not collision-free. */
-function randomSuffix(len = 8) {
-	return Math.random().toString(36).slice(2, 2 + len);
-}
-/** Collision-resistant id for sandbox naming (find-by-name recovery must be unique). */
-function randomUuid() {
-	return crypto.randomUUID();
-}
-/** Construct an AbortError carrying the abort reason's message. Downstream code pattern-matches on `err.name`. */
-function abortError(reason) {
-	const err = new Error(reason instanceof Error ? reason.message : reason === void 0 ? "aborted" : String(reason));
-	err.name = "AbortError";
-	return err;
-}
-/** Throw an AbortError. */
-function throwAbort() {
-	throw abortError();
-}
-/** Throw if the signal is already aborted; otherwise no-op. */
-function throwIfAborted(signal) {
-	if (signal?.aborted) throw abortError();
-}
-/** True for any error whose `name` is `AbortError` (the cross-kernel abort contract). */
-function isAbortError(err) {
-	return err instanceof Error && err.name === "AbortError";
-}
-/**
-* Sleep that resolves early on abort and always clears its timer so it never
-* keeps the event loop alive. Resolves (does not reject) on abort — callers
-* re-check the signal explicitly after the sleep.
-*/
-function sleep(ms, signal, keepAlive = true) {
-	if (signal?.aborted) return Promise.resolve();
-	return new Promise((resolve) => {
-		const done = () => {
-			clearTimer();
-			signal?.removeEventListener("abort", done);
-			resolve();
-		};
-		const clearTimer = armDeadlineTimer(ms, done, keepAlive);
-		signal?.addEventListener("abort", done, { once: true });
-	});
-}
-/**
-* Race a promise against a timeout. Resolves with the value if it settles in
-* time, otherwise resolves with `undefined`. Always clears the timer.
-*/
-function withTimeout(promise, ms) {
-	return new Promise((resolve) => {
-		const clearTimer = armDeadlineTimer(ms, () => resolve(void 0), true);
-		promise.then((value) => {
-			clearTimer();
-			resolve(value);
-		}, () => {
-			clearTimer();
-			resolve(void 0);
+		const flag = harness === "claude-code" ? append ? "--append-system-prompt-file" : "--system-prompt-file" : harness === "pi" || harness === "prime" ? append ? "--append-system-prompt" : "--system-prompt" : harness === "codex" ? "-c" : void 0;
+		if (!flag) throw new Error(`${harness} has no native ${intent} launch projection`);
+		files.push({
+			relPath: append ? ".tangle/append-system-prompt.md" : ".tangle/system-prompt.md",
+			content: text,
+			source: "generated"
 		});
-	});
-}
-/**
-* `JSON.stringify` with a `String()` fallback on throw (cyclic / non-JSON).
-* Strings pass through unstringified so a preview of a string output is the
-* string itself, not a quoted re-encoding.
-*/
-function stringifySafe(value, opts = {}) {
-	let s;
-	try {
-		if (typeof value === "string") s = value;
-		else s = (opts.pretty ? JSON.stringify(value, null, 2) : JSON.stringify(value)) ?? String(value);
-	} catch {
-		s = String(value);
+		flags.push(flag, harness === "codex" ? `model_instructions_file=${JSON.stringify(path)}` : path);
 	}
-	if (opts.max !== void 0 && s.length > opts.max) return `${s.slice(0, opts.max)}…`;
-	return s;
-}
-/** A fresh zero token-usage accumulator. */
-function zeroTokenUsage() {
 	return {
-		input: 0,
-		output: 0
+		files,
+		flags
 	};
 }
-/**
-* Sum the catalog-priced part of a dollar total across spends, as a field to spread.
-*
-* Returns nothing when no input carried one. A fold of pure provider receipts must not gain a
-* `usdEstimated: 0`, which would read as "this runtime checked and priced none" on a path that
-* never prices at all.
-*/
-function usdEstimatedOf(...spends) {
-	let total = 0;
-	let priced = false;
-	for (const spend of spends) {
-		if (spend.usdEstimated === void 0) continue;
-		priced = true;
-		total += spend.usdEstimated;
-	}
-	return priced ? { usdEstimated: total } : {};
-}
-/** A conserved spend with every channel at zero and no completeness claim on it. */
-function zeroSpend() {
-	return {
-		iterations: 0,
-		tokens: zeroTokenUsage(),
-		usd: 0,
-		ms: 0
-	};
-}
-/**
-* The spend of work that HAPPENED and reported no usage receipt.
-*
-* Not the same value as {@link zeroSpend} even though both carry `{0,0}` tokens and `$0`. A bare
-* zero asserts a MEASUREMENT — "this ran and cost nothing" — and every consumer downstream reads it
-* that way: the pool keeps reporting `readout().tokensKnown === true`, the journal totals stay
-* clean, the OTEL span records a priced zero, and a caller's token-denominated ceiling can never
-* fire no matter how much the work really burned. A ceiling that cannot fire is worse than no
-* ceiling, because it reads as protection.
-*
-* `tokensKnown` is the marker the substrate already threads end to end for exactly this case
-* (`budget.ts`, `otel-spans.ts`, `spawn-journal.ts`, `supervisor.ts`): the work is recorded, the
-* zero is labelled a floor rather than a total, and every rollup that touches it reports its
-* balance as a ceiling rather than a measurement. Use this — never a bare zero — whenever a runtime
-* cannot see what its worker spent.
-*
-* The same rule applies to dollars. A dollar-capped run must refuse an executor whose billed spend
-* is unknowable; `budgetExempt` does not authorize Runtime to relabel unknown spend as a measured
-* zero. Callers that require dollar accounting must use a backend with a trusted billing receipt.
-*/
-function unmeteredSpend(ms) {
-	return {
-		iterations: 0,
-		tokens: zeroTokenUsage(),
-		tokensKnown: false,
-		usd: 0,
-		usdKnown: false,
-		ms
-	};
-}
-/** Copy a conserved spend without dropping a completeness marker or the catalog-priced part. */
-function cloneSpend(spend) {
-	return {
-		...addResourceSpend(spend.resources),
-		iterations: spend.iterations,
-		tokens: cloneTokenUsage(spend.tokens),
-		...spend.tokensKnown === false ? { tokensKnown: false } : {},
-		usd: spend.usd,
-		...spend.usdKnown === false ? { usdKnown: false } : {},
-		...spend.usdEstimated !== void 0 ? { usdEstimated: spend.usdEstimated } : {},
-		ms: spend.ms,
-		...boxMinutesOf(spend),
-		...spend.tokensProvenance === void 0 ? {} : { tokensProvenance: spend.tokensProvenance }
-	};
-}
-/**
-* Sum two conserved spends per channel. Tokens and dollars never fold into each other, an
-* incomplete input keeps the sum incomplete on that channel, and the catalog-priced part of the
-* dollar total is summed separately so `usd - usdEstimated` still names what a provider billed.
-*/
-function addSpend(a, b) {
-	const tokens = cloneTokenUsage(a.tokens);
-	addTokenUsage(tokens, b.tokens);
-	return {
-		...addResourceSpend(a.resources, b.resources),
-		iterations: a.iterations + b.iterations,
-		tokens,
-		...a.tokensKnown === false || b.tokensKnown === false ? { tokensKnown: false } : {},
-		usd: a.usd + b.usd,
-		...a.usdKnown === false || b.usdKnown === false ? { usdKnown: false } : {},
-		...usdEstimatedOf(a, b),
-		ms: a.ms + b.ms,
-		...boxMinutesOf(a, b),
-		...tokensProvenanceOf(a, b)
-	};
-}
-/**
-* Fold the token-provenance channel across spends, as a field to spread.
-*
-* Returns nothing when no contributor stated one, because ABSENT already means "the executor's own
-* live stream", which is what every path reported before a harness store was readable. A
-* contributor that stated one and a contributor that did not therefore disagree, and the sum is
-* `'mixed'` — the honest answer for a tree whose spend came from two kinds of receipt.
-*/
-function tokensProvenanceOf(...spends) {
-	let folded;
-	let sawStated = false;
-	for (const spend of spends) {
-		const stated = spend.tokensProvenance ?? "stream-receipt";
-		if (spend.tokensProvenance !== void 0) sawStated = true;
-		folded = folded === void 0 || folded === stated ? stated : "mixed";
-	}
-	return !sawStated || folded === void 0 || folded === "stream-receipt" ? {} : { tokensProvenance: folded };
-}
-/**
-* Fold the platform box-time channel across spends, as a field to spread.
-*
-* Returns nothing when no input carried the channel, so a fold over router or cli-bridge work —
-* which runs no box at all — never gains a `boxMinutesProvenance: 'uncaptured'` that would claim
-* a box ran and went unmetered.
-*
-* Three rules, one per field:
-*  - `boxMinutes` sums the numbers that are present, and stays ABSENT when none is. A missing
-*    measurement never enters the sum as a zero.
-*  - `boxMinutesKnown` is sticky-false, like `tokensKnown`: one contributor that could not state
-*    its box time makes the whole sum a floor.
-*  - `boxMinutesProvenance` degrades. `'observed'` survives only when every contributor that
-*    carried a number was observed; one derived number makes the sum `'estimated'`; no number at
-*    all is `'uncaptured'`.
-*/
-function boxMinutesOf(...spends) {
-	const present = spends.filter((spend) => spend.boxMinutesProvenance !== void 0);
-	if (present.length === 0) return {};
-	let minutes = 0;
-	let sawNumber = false;
-	let known = true;
-	let observedOnly = true;
-	for (const spend of present) {
-		if (typeof spend.boxMinutes === "number" && Number.isFinite(spend.boxMinutes)) {
-			minutes += spend.boxMinutes;
-			sawNumber = true;
-			if (spend.boxMinutesProvenance !== "observed") observedOnly = false;
-		}
-		if (spend.boxMinutesKnown !== true) known = false;
-	}
-	return {
-		...sawNumber ? { boxMinutes: roundBoxMinutes(minutes) } : {},
-		boxMinutesKnown: known,
-		boxMinutesProvenance: sawNumber ? observedOnly ? "observed" : "estimated" : "uncaptured"
-	};
-}
-/**
-* Box minutes at four decimals — a tenth of a second.
-*
-* Fine enough that a box alive for two seconds reports `0.0333` instead of a zero that would read
-* as a measured free box, and coarse enough that summing floats does not print
-* `1.5000000000000002`.
-*/
-function roundBoxMinutes(minutes) {
-	return Number(minutes.toFixed(4));
-}
-/** Copy a token subtotal without dropping optional provider cache telemetry. */
-function cloneTokenUsage(usage) {
-	const cacheBreakdownUnknown = usage.cacheBreakdownKnown === false || usage.input > 0 && !hasClassifiedCacheBreakdown(usage);
-	return {
-		input: usage.input,
-		output: usage.output,
-		...usage.tokensKnown === false ? { tokensKnown: false } : {},
-		...usage.freshInput !== void 0 ? { freshInput: usage.freshInput } : {},
-		...usage.cacheRead !== void 0 ? { cacheRead: usage.cacheRead } : {},
-		...usage.cacheWrite !== void 0 ? { cacheWrite: usage.cacheWrite } : {},
-		...cacheBreakdownUnknown ? { cacheBreakdownKnown: false } : {}
-	};
-}
-/** True only when every positive prompt token has a consistent cache classification. */
-function hasCompleteCacheBreakdown(usage) {
-	if (usage.cacheBreakdownKnown === false) return false;
-	return hasClassifiedCacheBreakdown(usage);
-}
-function hasClassifiedCacheBreakdown(usage) {
-	if (usage.input === 0) return true;
-	if (usage.freshInput === void 0 || usage.cacheRead === void 0 || usage.cacheWrite === void 0) return false;
-	return usage.freshInput + usage.cacheRead + usage.cacheWrite === usage.input;
-}
-/**
-* The token charge for one observation: every token counted ONCE, at the moment it first enters
-* the context — `input − cacheRead + output`.
-*
-* `input` is a rolled-up prompt total that re-counts a cached prefix on every turn that reads it,
-* so charging `input` makes a 100K prefix read 40 times cost 4.1M for content authored once. A
-* cache read is content that was already charged when it was written, so it is the one class the
-* charge subtracts. Under a complete split the result is exactly `freshInput + cacheWrite`. No
-* price weight is involved: this counts work, and money is a separate channel.
-*
-* The subtraction form is what makes the charge ADDITIVE. `input` and `cacheRead` both accumulate
-* through `addTokenUsage`, so the charge on an aggregate equals the sum of the charges on the
-* records that built it — including an aggregate that mixes classified and unclassified turns,
-* where the unclassified remainder is charged in full and only the reported cache reads are
-* credited. A form that read `freshInput + cacheWrite` directly loses that: one unclassified turn
-* would drop the whole aggregate to `input + output` and over-charge every classified turn with it.
-*
-* The one arithmetic guarantee: a set of classes that does not FIT inside the prompt total it
-* partitions credits nothing, so the charge is never below `output` and a class that overflows its
-* own total buys no tokens. It is not a guarantee against a provider that reports a cache read it
-* never served — that provider can under-report `input` just as easily, and the token channel is an
-* accounting unit, not a trust boundary. Prompt tokens the provider left unclassified are charged
-* in full, so a spend with no readable split charges an upper bound on newly-presented work rather
-* than a measurement, and every caller that enforces a ceiling must report the difference
-* (`BudgetPool` does it through `readout().cacheBreakdownKnown`).
-*/
-function chargedTokens(usage) {
-	return usage.input - creditedCacheRead(usage) + usage.output;
-}
-/** `cacheRead` if the reported classes fit inside `input`, else nothing. */
-function creditedCacheRead(usage) {
-	const { cacheRead } = usage;
-	if (cacheRead === void 0) return 0;
-	return classifiedTotal(usage, cacheRead) > usage.input ? 0 : cacheRead;
-}
-function classifiedTotal(usage, cacheRead) {
-	return (usage.freshInput ?? 0) + cacheRead + (usage.cacheWrite ?? 0);
-}
-/**
-* Translate one provider prompt-cache report into the prompt token classes `addTokenUsage` folds
-* and `chargedTokens` credits.
-*
-* The input is the open `promptCache` record an `llm_call` carries, keyed by the `PromptCacheUsage`
-* vocabulary (`readTokens`, `writeTokens`). Providers report that vocabulary unevenly, and the
-* three outcomes are different facts that must not collapse into one another:
-*
-*  - **Nothing reported** — no classes and no marker. The caller's own unknown handling decides,
-*    because a provider that says nothing about caching has not said the split is unknowable.
-*  - **Read and write both reported, and fitting inside `input`** — a complete partition, so
-*    `freshInput` is the remainder and the split is known.
-*  - **One counter reported, or classes that overflow `input`** — the counters that ARE measured
-*    pass through and `cacheBreakdownKnown` is false. A read with no write counter (OpenAI reports
-*    no write) still credits the read it measured, while declaring the rest unclassified so the
-*    charge stays a declared upper bound. An overflowing claim buys nothing: it cannot be a
-*    partition of a total it exceeds.
-*
-* A counter the provider did not report stays absent. A zero would claim the provider measured no
-* cache, which is a different fact from a provider that did not report.
-*/
-function promptCacheTokenClasses(input, promptCache) {
-	if (promptCache === void 0) return {};
-	const read = tokenCount(promptCache.readTokens);
-	const write = tokenCount(promptCache.writeTokens);
-	if (read === void 0 && write === void 0) return {};
-	if (input === void 0 || (read ?? 0) + (write ?? 0) > input) return { cacheBreakdownKnown: false };
-	if (read !== void 0 && write !== void 0) return {
-		freshInput: input - read - write,
-		cacheRead: read,
-		cacheWrite: write
-	};
-	return {
-		...read !== void 0 ? { cacheRead: read } : {},
-		...write !== void 0 ? { cacheWrite: write } : {},
-		cacheBreakdownKnown: false
-	};
-}
-function tokenCount(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
-}
-/**
-* Add the observed subtotal into `acc`; token and cache incompleteness are sticky.
-*
-* A delta whose classes do not FIT inside its own `input` contributes its prompt total and NO
-* classes. Folding them in would hide the overflow: the accumulator's larger `input` can absorb a
-* class total that overflowed the one delta that reported it, and `chargedTokens` would then credit
-* at the aggregate a cache read it refuses at the record. That is the one way the charge could come
-* out below the sum of the charges on the records that built it.
-*/
-function addTokenUsage(acc, delta) {
-	acc.input += delta.input ?? 0;
-	acc.output += delta.output ?? 0;
-	if (delta.tokensKnown === false) acc.tokensKnown = false;
-	const input = delta.input ?? 0;
-	const fits = classifiedTotal(delta, delta.cacheRead ?? 0) <= input;
-	if (fits) {
-		if (delta.freshInput !== void 0) acc.freshInput = (acc.freshInput ?? 0) + delta.freshInput;
-		if (delta.cacheRead !== void 0) acc.cacheRead = (acc.cacheRead ?? 0) + delta.cacheRead;
-		if (delta.cacheWrite !== void 0) acc.cacheWrite = (acc.cacheWrite ?? 0) + delta.cacheWrite;
-	}
-	const classified = fits && delta.freshInput !== void 0 && delta.cacheRead !== void 0 && delta.cacheWrite !== void 0 && delta.freshInput + delta.cacheRead + delta.cacheWrite === input;
-	if (delta.cacheBreakdownKnown === false || input > 0 && !classified) acc.cacheBreakdownKnown = false;
-}
-/**
-* Map `items` through `fn` with at most `limit` calls in flight at once,
-* preserving input order in the result. On the first `fn` rejection no NEW
-* items are picked up; already-in-flight calls are awaited, then the first
-* error is rethrown. `limit` is clamped to ≥ 1.
-*
-* Used where a burst of provisioning (e.g. forking N child boxes) must respect
-* the loop's concurrency bound instead of firing all N at once.
-*/
-async function mapWithConcurrency(items, limit, fn) {
-	const results = new Array(items.length);
-	let next = 0;
-	for await (const settled of runTaskQueue({
-		concurrency: Math.max(1, Math.min(Math.floor(limit), items.length)),
-		take: () => {
-			const index = next++;
-			return index < items.length ? {
-				id: String(index),
-				value: index
-			} : void 0;
-		},
-		execute: ({ value: index }) => fn(items[index], index)
-	})) {
-		if (settled.status === "rejected") throw settled.reason;
-		results[settled.task.value] = settled.value;
-	}
-	return results;
-}
-/** The message of a thrown value: an `Error`'s own message, anything else stringified. */
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-/** True for an object whose `Symbol.asyncIterator` is callable, so `for await` can consume it. */
-function isAsyncIterable(value) {
-	return value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function";
-}
-/** 32-bit FNV-1a over a string's UTF-16 code units, as eight lowercase hex digits. */
-function fnv1a32Hex(text) {
-	let h = 2166136261;
-	for (let i = 0; i < text.length; i += 1) {
-		h ^= text.charCodeAt(i);
-		h = Math.imul(h, 16777619);
-	}
-	return (h >>> 0).toString(16).padStart(8, "0");
-}
-//#endregion
-//#region src/path-control-characters.ts
+// src/path-control-characters.ts
 /** Whether a serialized field contains an ASCII control or delete character. */
 function hasControlCharacter(value) {
 	for (let index = 0; index < value.length; index++) {
@@ -643,8 +50,7 @@ function hasControlCharacter(value) {
 	}
 	return false;
 }
-//#endregion
-//#region src/candidate-execution/digest.ts
+// src/candidate-execution/digest.ts
 /** Use native hashing for workspace archives. */
 function sha256Bytes$1(bytes) {
 	return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
@@ -693,8 +99,7 @@ function deepFreezeCandidate(value, seen = /* @__PURE__ */ new Set()) {
 	for (const child of Object.values(value)) deepFreezeCandidate(child, seen);
 	return Object.freeze(value);
 }
-//#endregion
-//#region src/candidate-execution/artifacts.ts
+// src/candidate-execution/artifacts.ts
 function artifactCacheKey(artifact) {
 	return `${artifact.sha256}:${artifact.byteLength}`;
 }
@@ -926,7 +331,7 @@ function isWithin(root, path) {
 */
 async function readWorkspaceFile(descriptor, maxBytes, keepBytes, path, signal) {
 	const hash = createHash("sha256");
-	const buffer = Buffer.allocUnsafe(1024 * 1024);
+	const buffer = Buffer.allocUnsafe(1048576);
 	const chunks = [];
 	let total = 0;
 	while (true) {
@@ -949,8 +354,7 @@ async function readWorkspaceFile(descriptor, maxBytes, keepBytes, path, signal)
 		byteLength: total
 	};
 }
-//#endregion
-//#region src/candidate-execution/exact-object.ts
+// src/candidate-execution/exact-object.ts
 /** Reject unknown fields while requiring every declared non-optional field. */
 function assertExactObjectKeys(value, required, label, optional = []) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
@@ -975,8 +379,7 @@ function isWellFormedUnicode(value) {
 	}
 	return true;
 }
-//#endregion
-//#region src/candidate-execution/output-artifacts.ts
+// src/candidate-execution/output-artifacts.ts
 /** Persist evaluator evidence, read it back, and bind the returned locator to the exact bytes. */
 async function persistCandidateOutputArtifact(port, input) {
 	input.signal?.throwIfAborted();
@@ -995,8 +398,7 @@ async function persistCandidateOutputArtifact(port, input) {
 	verifyBytes(stored, expectedDigest, bytes.byteLength, "persisted candidate output");
 	return immutableCandidateValue(ref);
 }
-//#endregion
-//#region src/candidate-execution/workspace-archive.ts
+// src/candidate-execution/workspace-archive.ts
 const archiveKind = "agent-candidate-workspace-archive";
 const workspaceEntryPrefix = "workspace/";
 const repositoryMetadataEntry = "metadata/repository.json";
@@ -1005,13 +407,13 @@ const repositoryIndexEntry = "metadata/repository.index.json";
 const repositoryIndexPrefix = "index/";
 const fixedTarTime = /* @__PURE__ */ new Date(0);
 const defaultLimits = Object.freeze({
-	maxArchiveBytes: 512 * 1024 * 1024,
-	maxEmbeddedArtifactBytes: 1024 * 1024,
+	maxArchiveBytes: 536870912,
+	maxEmbeddedArtifactBytes: 1048576,
 	maxFiles: 5e4,
-	maxFileBytes: 128 * 1024 * 1024,
-	maxTotalFileBytes: 256 * 1024 * 1024,
+	maxFileBytes: 134217728,
+	maxTotalFileBytes: 268435456,
 	maxPathBytes: 4096,
-	maxRepositoryBundleBytes: 128 * 1024 * 1024
+	maxRepositoryBundleBytes: 134217728
 });
 /** Capture detached files returned by a remote executor into the standard archive. */
 async function captureAgentCandidateWorkspaceFiles(input, options = {}) {
@@ -1414,8 +816,7 @@ function workspaceTarHeader(name, mode, size) {
 		gname: ""
 	};
 }
-//#endregion
-//#region src/candidate-execution/artifact-streams.ts
+// src/candidate-execution/artifact-streams.ts
 /** Verify the complete stream, including its final digest, before accepting its consumer's result. */
 async function* verifiedArtifactChunks(artifact, port, signal) {
 	signal?.throwIfAborted();
@@ -1482,8 +883,7 @@ async function persistCandidateOutputArtifactStream(port, input) {
 		await chunks.return(void 0);
 	}
 }
-//#endregion
-//#region src/candidate-execution/git-materialize.ts
+// src/candidate-execution/git-materialize.ts
 async function verifyCandidateCode(code, repositories, patchBytes) {
 	if (code.kind === "disabled") return void 0;
 	const repositoryRoot = await verifiedRepositoryRoot(code.repository, repositories);
@@ -1617,7 +1017,8 @@ async function verifiedRepositoryRoot(repository, repositories) {
 	])).stdout.toString("utf8").trim();
 	const actual = parseGitHubRemote(origin);
 	if (!actual || actual.owner !== repository.owner || actual.repo !== repository.repo) throw new Error(`local repository origin ${origin || "<missing>"} does not match github.com/${repository.owner}/${repository.repo}`);
-	await assertNoGitIndirection(repositoryRoot, resolve((await runCandidateGit(repositoryRoot, ["rev-parse", "--absolute-git-dir"])).stdout.toString("utf8").trim()), "candidate repository");
+	const gitDirText = (await runCandidateGit(repositoryRoot, ["rev-parse", "--absolute-git-dir"])).stdout.toString("utf8").trim();
+	await assertNoGitIndirection(repositoryRoot, resolve(gitDirText), "candidate repository");
 	return repositoryRoot;
 }
 async function assertNoGitIndirection(repositoryRoot, gitDir, label) {
@@ -1811,8 +1212,7 @@ async function runCandidateGit(repositoryRoot, args, input, extraEnv = {}, optio
 function isNoEntry(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-//#endregion
-//#region src/candidate-execution/workspace-archive-local.ts
+// src/candidate-execution/workspace-archive-local.ts
 /** Capture one exact regular-file workspace for immutable candidate execution. */
 async function captureAgentCandidateWorkspace(rootInput, options = {}) {
 	const root = resolve(rootInput);
@@ -1872,7 +1272,8 @@ async function captureRepository(requestedRoot, limits, workingTree) {
 	const root = await realpath(requestedRoot);
 	const resolvedStats = await lstat(root);
 	if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) throw new Error("candidate repository root must resolve to a real directory");
-	if (await realpath(resolve((await runCandidateGit(root, ["rev-parse", "--show-toplevel"])).stdout.toString("utf8").trim())) !== root) throw new Error("candidate repository capture must start at the Git worktree root");
+	const topLevel = (await runCandidateGit(root, ["rev-parse", "--show-toplevel"])).stdout.toString("utf8").trim();
+	if (await realpath(resolve(topLevel)) !== root) throw new Error("candidate repository capture must start at the Git worktree root");
 	const gitDir = resolve((await runCandidateGit(root, ["rev-parse", "--absolute-git-dir"])).stdout.toString("utf8").trim());
 	if (await realpath(gitDir) !== gitDir || gitDir.includes(":")) throw new Error("candidate repository Git object store has an unsupported path");
 	await assertNoGitIndirection(root, gitDir, "candidate repository");
@@ -2054,7 +1455,8 @@ async function prepareEmptyDestination(destination, options = {}) {
 		throw error;
 	}
 	if (!stats.isDirectory() || stats.isSymbolicLink()) throw new Error("candidate workspace destination must be a real directory");
-	const resolvedStats = await lstat(await realpath(destination));
+	const resolvedDestination = await realpath(destination);
+	const resolvedStats = await lstat(resolvedDestination);
 	if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) throw new Error("candidate workspace destination must resolve to a real directory");
 	if ((await readdir(destination)).length > 0) throw new Error("candidate workspace destination must be empty");
 }
@@ -2164,8 +1566,7 @@ function workspacePath(root, relativePath) {
 	if (!path.startsWith(`${root}${sep}`)) throw new Error(`candidate workspace archive path escapes its destination: ${relativePath}`);
 	return path;
 }
-//#endregion
-//#region src/candidate-execution/workspace-streams.ts
+// src/candidate-execution/workspace-streams.ts
 /**
 * Files a tree capture stores at once; each waits on a durable-store round trip of its own and on
 * four fsyncs. On drew-gtr-pro, with three 180 ms store requests per file, 64 at once
@@ -2443,7 +1844,7 @@ async function* workspaceFileChunks(root, expected, signal) {
 		let byteLength = 0;
 		for await (const chunk of file.createReadStream({
 			autoClose: false,
-			highWaterMark: 64 * 1024
+			highWaterMark: 65536
 		})) {
 			signal?.throwIfAborted();
 			byteLength += chunk.byteLength;
@@ -2496,8 +1897,7 @@ async function* oneChunk(bytes) {
 function asError(error) {
 	return error instanceof Error ? error : new Error(String(error));
 }
-//#endregion
-//#region src/runtime/sandbox-profile-compat.ts
+// src/runtime/sandbox-profile-compat.ts
 /**
 * Interface 5.3 admits proxy secrets and private config values, but the current Sandbox SDK
 * carries Interface 4.0. Refuse these fields before either candidate conversion or a direct
@@ -2527,7 +1927,6 @@ function refuseNonPublicConfigValues(values, path, context) {
 function refuseSandboxProfileField(field, context = "candidate profile") {
 	throw new ValidationError(`${context} field ${field} is refused: Sandbox's Interface 4.0.0 cannot carry it yet, and Runtime does not drop it`);
 }
-//#endregion
-export { isAbortError as $, verifyMaterializedProfileWorkspace as A, sha256Bytes$1 as B, WorkspaceScanLimitError as C, armDeadlineTimer as Ct, readMaterializedWorkspaceFiles as D, singleFlightTeardown as Dt, captureMaterializedWorkspace as E, isDeadlineAbortReason as Et, canonicalCandidateDocument as F, addTokenUsage as G, hasControlCharacter as H, deepFreezeCandidate as I, cloneTokenUsage as J, chargedTokens as K, embeddedCandidateArtifact as L, verifyWorkspaceSnapshotArtifacts as M, canonicalCandidateBytes$1 as N, readVerifiedArtifact as O, teardownExecutor as Ot, canonicalCandidateDigest$1 as P, hasCompleteCacheBreakdown as Q, immutableCandidateValue as R, isWellFormedUnicode as S, ROOT_DEADLINE_REASON as St, candidateWorkspaceManifest as T, checkInIdleMs as Tt, abortError as U, verifyCanonicalCandidateDocument as V, addSpend as W, errorMessage as X, deleteBoxSafe as Y, fnv1a32Hex as Z, captureAgentCandidateWorkspaceFiles as _, withBudgetResources as _t, materializeAgentCandidateWorkspaceFromArtifacts as a, roundBoxMinutes as at, persistCandidateOutputArtifact as b, DEADLINE_CHECK_IN_MESSAGE as bt, verifyAgentCandidateWorkspaceTree as c, throwAbort as ct, readCandidateGitHubResource as d, withTimeout as dt, isAsyncIterable as et, verifyCandidateCode as f, zeroSpend as ft, verifiedArtifactChunks as g, resourceTelemetry as gt, markPutStreamVerified as h, assertResources as ht, captureAgentCandidateWorkspaceTreeToArtifacts as i, randomUuid as it, verifyMaterializedWorkspace as j, verifyBytes as k, teardownSurfaces as kt, captureAgentCandidateWorkspace as l, throwIfAborted as lt, verifyTaskOutcomePatch as m, addResourceSpend as mt, refuseSandboxProfileField as n, promptCacheTokenClasses as nt, readAgentCandidateWorkspaceArtifactFiles as o, sleep as ot, verifyTaskCheckout as p, zeroTokenUsage as pt, cloneSpend as q, captureAgentCandidateWorkspaceToArtifacts as r, randomSuffix as rt, verifyAgentCandidateWorkspaceArtifacts as s, stringifySafe as st, assertSandboxProfileCompatibility as t, mapWithConcurrency as tt, createAgentCandidateWorkspacePort as u, unmeteredSpend as ut, verifyAgentCandidateWorkspaceArchive as v, ACCEPTED_RESULT_GRACE_MS as vt, artifactCacheKey as w, boundedChildDeadlineAt as wt, assertExactObjectKeys as x, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as xt, workspaceLimits as y, CHILD_DEADLINE_REASON as yt, omitTopLevelDigest as z };
+export { verifyMaterializedProfileWorkspace as A, sha256Bytes$1 as B, WorkspaceScanLimitError as C, readMaterializedWorkspaceFiles as D, captureMaterializedWorkspace as E, canonicalCandidateDocument as F, hasControlCharacter as H, deepFreezeCandidate as I, embeddedCandidateArtifact as L, verifyWorkspaceSnapshotArtifacts as M, canonicalCandidateBytes$1 as N, readVerifiedArtifact as O, canonicalCandidateDigest$1 as P, immutableCandidateValue as R, isWellFormedUnicode as S, candidateWorkspaceManifest as T, nativeSystemPrompt as U, verifyCanonicalCandidateDocument as V, captureAgentCandidateWorkspaceFiles as _, materializeAgentCandidateWorkspaceFromArtifacts as a, persistCandidateOutputArtifact as b, verifyAgentCandidateWorkspaceTree as c, readCandidateGitHubResource as d, verifyCandidateCode as f, verifiedArtifactChunks as g, markPutStreamVerified as h, captureAgentCandidateWorkspaceTreeToArtifacts as i, verifyMaterializedWorkspace as j, verifyBytes as k, captureAgentCandidateWorkspace as l, verifyTaskOutcomePatch as m, refuseSandboxProfileField as n, readAgentCandidateWorkspaceArtifactFiles as o, verifyTaskCheckout as p, captureAgentCandidateWorkspaceToArtifacts as r, verifyAgentCandidateWorkspaceArtifacts as s, assertSandboxProfileCompatibility as t, createAgentCandidateWorkspacePort as u, verifyAgentCandidateWorkspaceArchive as v, artifactCacheKey as w, assertExactObjectKeys as x, workspaceLimits as y, omitTopLevelDigest as z };
 
-//# sourceMappingURL=sandbox-profile-compat-DtuJWFrM.js.map
+//# sourceMappingURL=sandbox-profile-compat-CXjozdWL.js.map