@tangle-network/agent-runtime 0.92.0 → 0.93.0

package/dist/{chunk-A62TP7SK.js → chunk-26WCEARH.js}

@@ -2,39 +2,8 @@ import {
   contentAddress
 } from "./chunk-3D2RHC4K.js";
 
-// src/candidate-execution/types.ts
-var verifiedCandidateBrand = /* @__PURE__ */ Symbol("verifiedAgentCandidate");
-var preparedCandidateBrand = /* @__PURE__ */ Symbol("preparedAgentCandidate");
-var verifiedTaskOutcomeBrand = /* @__PURE__ */ Symbol("verifiedTaskOutcome");
-var CANDIDATE_TRACE_TAGS = {
-  executionId: "tangle.candidate.execution_id",
-  bundleDigest: "tangle.candidate.bundle_digest",
-  executionPlanDigest: "tangle.candidate.execution_plan_digest",
-  materializationReceiptDigest: "tangle.candidate.materialization_receipt_digest"
-};
-var CANDIDATE_TRACE_ENV = {
-  executionId: "TANGLE_CANDIDATE_EXECUTION_ID",
-  bundleDigest: "TANGLE_CANDIDATE_BUNDLE_DIGEST",
-  executionPlanDigest: "TANGLE_CANDIDATE_EXECUTION_PLAN_DIGEST",
-  materializationReceiptDigest: "TANGLE_CANDIDATE_MATERIALIZATION_RECEIPT_DIGEST",
-  traceRunId: "TANGLE_TRACE_RUN_ID"
-};
-
-// src/candidate-execution/claim.ts
-import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto";
-import { readFile } from "fs/promises";
-import {
-  agentCandidateResolvedModelSchema
-} from "@tangle-network/agent-interface";
-
-// src/candidate-execution/claim-file-formats.ts
-var CLAIM_FORMAT_VERSION = 7;
-var PENDING_FORMAT_VERSION = 1;
-var TERMINAL_FORMAT_VERSION = 3;
-var PHASE_FORMAT_VERSION = 1;
-
-// src/candidate-execution/claim-terminal.ts
-import { agentCandidateArtifactRefSchema } from "@tangle-network/agent-interface";
+// src/candidate-execution/bundle.ts
+import { agentCandidateBundleSchema } from "@tangle-network/agent-interface";
 
 // src/candidate-execution/digest.ts
 import { createHash } from "crypto";
@@ -92,6 +61,51 @@ function deepFreezeCandidate(value, seen = /* @__PURE__ */ new Set()) {
   return Object.freeze(value);
 }
 
+// src/candidate-execution/bundle.ts
+function sealAgentCandidateBundle(input) {
+  const digest = canonicalCandidateDigest(input);
+  const parsed = agentCandidateBundleSchema.parse({ ...input, digest });
+  const parsedDigest = canonicalCandidateDigest(omitTopLevelDigest(parsed));
+  if (parsedDigest !== digest) {
+    throw new Error("candidate bundle changed while validating its canonical wire shape");
+  }
+  return immutableCandidateValue(parsed);
+}
+
+// src/candidate-execution/types.ts
+var verifiedCandidateBrand = /* @__PURE__ */ Symbol("verifiedAgentCandidate");
+var preparedCandidateBrand = /* @__PURE__ */ Symbol("preparedAgentCandidate");
+var verifiedTaskOutcomeBrand = /* @__PURE__ */ Symbol("verifiedTaskOutcome");
+var CANDIDATE_TRACE_TAGS = {
+  executionId: "tangle.candidate.execution_id",
+  bundleDigest: "tangle.candidate.bundle_digest",
+  executionPlanDigest: "tangle.candidate.execution_plan_digest",
+  materializationReceiptDigest: "tangle.candidate.materialization_receipt_digest"
+};
+var CANDIDATE_TRACE_ENV = {
+  executionId: "TANGLE_CANDIDATE_EXECUTION_ID",
+  bundleDigest: "TANGLE_CANDIDATE_BUNDLE_DIGEST",
+  executionPlanDigest: "TANGLE_CANDIDATE_EXECUTION_PLAN_DIGEST",
+  materializationReceiptDigest: "TANGLE_CANDIDATE_MATERIALIZATION_RECEIPT_DIGEST",
+  traceRunId: "TANGLE_TRACE_RUN_ID"
+};
+
+// src/candidate-execution/claim.ts
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto";
+import { readFile } from "fs/promises";
+import {
+  agentCandidateResolvedModelSchema
+} from "@tangle-network/agent-interface";
+
+// src/candidate-execution/claim-file-formats.ts
+var CLAIM_FORMAT_VERSION = 7;
+var PENDING_FORMAT_VERSION = 1;
+var TERMINAL_FORMAT_VERSION = 3;
+var PHASE_FORMAT_VERSION = 1;
+
+// src/candidate-execution/claim-terminal.ts
+import { agentCandidateArtifactRefSchema } from "@tangle-network/agent-interface";
+
 // src/candidate-execution/exact-object.ts
 function assertExactObjectKeys(value, required, label, optional = []) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -3898,10 +3912,10 @@ var CandidateExecutionDeadlineError = class extends Error {
 };
 
 // src/candidate-execution/verify.ts
-import { agentCandidateBundleSchema } from "@tangle-network/agent-interface";
+import { agentCandidateBundleSchema as agentCandidateBundleSchema2 } from "@tangle-network/agent-interface";
 var verifiedCandidateState = /* @__PURE__ */ new WeakMap();
 async function verifyAgentCandidateBundle(input, ports) {
-  const parsed = agentCandidateBundleSchema.parse(input);
+  const parsed = agentCandidateBundleSchema2.parse(input);
   const withoutDigest = omitTopLevelDigest(parsed);
   const actualDigest = canonicalCandidateDigest(withoutDigest);
   if (actualDigest !== parsed.digest) {
@@ -4739,16 +4753,257 @@ function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// src/candidate-execution/profile.ts
+import { agentCandidateProfileSchema, agentProfileSchema } from "@tangle-network/agent-interface";
+var CANDIDATE_PROFILE_DIRECT_FIELDS = [
+  "name",
+  "description",
+  "version",
+  "tags",
+  "prompt",
+  "harness",
+  "permissions",
+  "tools",
+  "confidential"
+];
+function freezeGenericAgentCandidateProfile(input) {
+  const profile = parseExactAgentProfile(input, "profile");
+  if (profile.connections !== void 0) unsupportedProfileField("connections");
+  if (profile.metadata !== void 0) unsupportedProfileField("metadata");
+  if (profile.extensions !== void 0) unsupportedProfileField("extensions");
+  if (profile.model?.metadata !== void 0) unsupportedProfileField("model.metadata");
+  const candidate = {};
+  copyDirectProfileFields(candidate, profile);
+  if (profile.model) {
+    const { metadata: _metadata, ...model } = profile.model;
+    candidate.model = model;
+  }
+  if (profile.mcp) candidate.mcp = freezeMcpServers(profile.mcp);
+  if (profile.subagents) {
+    candidate.subagents = Object.fromEntries(
+      Object.entries(profile.subagents).map(([name, subagent]) => {
+        if (subagent.metadata !== void 0) unsupportedProfileField(`subagents.${name}.metadata`);
+        const { metadata: _metadata, ...value } = subagent;
+        return [name, value];
+      })
+    );
+  }
+  if (profile.resources) candidate.resources = freezeResources(profile.resources);
+  if (profile.hooks && Object.values(profile.hooks).some((commands) => commands.length > 0)) {
+    throw new Error(
+      "generic AgentProfile hooks cannot be safely tokenized; use a candidate-profile source with executable/args"
+    );
+  }
+  if (profile.hooks) candidate.hooks = profile.hooks;
+  if (profile.modes) {
+    candidate.modes = Object.fromEntries(
+      Object.entries(profile.modes).map(([name, mode]) => {
+        if (mode.metadata !== void 0) unsupportedProfileField(`modes.${name}.metadata`);
+        const { metadata: _metadata, ...value } = mode;
+        return [name, value];
+      })
+    );
+  }
+  const parsed = parseExactCandidateProfile(candidate);
+  assertCandidateProfileBinding(profile, parsed);
+  return parsed;
+}
+function assertCandidateProfileBinding(measuredInput, bundled) {
+  const measured = parseExactAgentProfile(measuredInput, "proposal candidate profile");
+  if (measured.connections || measured.metadata || measured.extensions) {
+    throw new Error("proposal candidate profile contains fields unsupported by sealed candidates");
+  }
+  const normalized = candidateProfileAsAgentProfile(bundled);
+  if (canonicalCandidateDigest(measured) !== canonicalCandidateDigest(normalized)) {
+    throw new Error("proposal candidateProfile does not match candidateBundle.profile");
+  }
+}
+function parseExactAgentProfile(input, label) {
+  const parsed = agentProfileSchema.parse(input);
+  assertCanonicalParse(input, parsed, label);
+  return parsed;
+}
+function parseExactCandidateProfile(input) {
+  const parsed = agentCandidateProfileSchema.parse(input);
+  assertCanonicalParse(input, parsed, "candidate profile");
+  return parsed;
+}
+function candidateProfileAsAgentProfile(candidate) {
+  const output = {};
+  copyDirectProfileFields(output, candidate);
+  if (candidate.model) output.model = { ...candidate.model };
+  if (candidate.mcp) {
+    output.mcp = Object.fromEntries(
+      Object.entries(candidate.mcp).map(([name, server]) => [
+        name,
+        {
+          ...server,
+          ...server.args ? { args: server.args.map(publicValue) } : {},
+          ...server.env ? { env: mapPublicValues(server.env) } : {}
+        }
+      ])
+    );
+  }
+  if (candidate.subagents) output.subagents = cloneRecord(candidate.subagents);
+  if (candidate.modes) output.modes = cloneRecord(candidate.modes);
+  if (candidate.hooks) {
+    output.hooks = Object.fromEntries(
+      Object.entries(candidate.hooks).map(([event, hooks]) => [
+        event,
+        hooks.map(({ executable, args, env, ...hook }) => ({
+          ...hook,
+          command: [executable, ...(args ?? []).map(publicValue)].map(shellQuote).join(" "),
+          ...env ? { env: mapPublicValues(env) } : {}
+        }))
+      ])
+    );
+  }
+  if (candidate.resources) {
+    if (candidate.resources.failOnError !== true) {
+      throw new Error("proposal candidate profile contains fields unsupported by sealed candidates");
+    }
+    output.resources = {
+      failOnError: true,
+      ...candidate.resources.files ? {
+        files: candidate.resources.files.map((file) => ({
+          ...file,
+          resource: publicResource(file.resource)
+        }))
+      } : {},
+      ...candidate.resources.tools ? { tools: candidate.resources.tools.map(publicResource) } : {},
+      ...candidate.resources.skills ? { skills: candidate.resources.skills.map(publicResource) } : {},
+      ...candidate.resources.agents ? { agents: candidate.resources.agents.map(publicResource) } : {},
+      ...candidate.resources.commands ? { commands: candidate.resources.commands.map(publicResource) } : {},
+      ...candidate.resources.instructions !== void 0 ? {
+        instructions: typeof candidate.resources.instructions === "string" ? candidate.resources.instructions : publicResource(candidate.resources.instructions)
+      } : {}
+    };
+  }
+  return output;
+}
+function freezeMcpServers(servers) {
+  return Object.fromEntries(
+    Object.entries(servers).map(([name, server]) => {
+      if (server.transport !== void 0 && server.transport !== "stdio") {
+        unsupportedProfileField(`mcp.${name}.transport=${server.transport}`);
+      }
+      if (server.url !== void 0) unsupportedProfileField(`mcp.${name}.url`);
+      if (server.headers !== void 0) unsupportedProfileField(`mcp.${name}.headers`);
+      if (server.metadata !== void 0) unsupportedProfileField(`mcp.${name}.metadata`);
+      return [
+        name,
+        {
+          ...server.transport ? { transport: server.transport } : {},
+          ...server.command ? { command: server.command } : {},
+          ...server.args ? { args: server.args.map(candidatePublicValue) } : {},
+          ...server.env ? { env: mapCandidatePublicValues(server.env) } : {},
+          ...server.cwd ? { cwd: server.cwd } : {},
+          ...server.enabled === void 0 ? {} : { enabled: server.enabled }
+        }
+      ];
+    })
+  );
+}
+function freezeResources(resources) {
+  if (resources.failOnError !== true) {
+    throw new Error("candidate profile resources require failOnError: true");
+  }
+  return {
+    failOnError: true,
+    ...resources.files ? {
+      files: resources.files.map((file) => ({
+        ...file,
+        resource: freezeResource(file.resource)
+      }))
+    } : {},
+    ...resources.tools ? { tools: resources.tools.map(freezeResource) } : {},
+    ...resources.skills ? { skills: resources.skills.map(freezeResource) } : {},
+    ...resources.agents ? { agents: resources.agents.map(freezeResource) } : {},
+    ...resources.commands ? { commands: resources.commands.map(freezeResource) } : {},
+    ...resources.instructions === void 0 ? {} : {
+      instructions: typeof resources.instructions === "string" ? resources.instructions : freezeResource(resources.instructions)
+    }
+  };
+}
+function freezeResource(resource) {
+  if (resource.kind === "github") {
+    throw new Error(
+      "generic GitHub profile resources do not carry byte identity; use a candidate-profile source with a pinned commit, digest, and byte length"
+    );
+  }
+  const bytes = Buffer.from(resource.content, "utf8");
+  return {
+    ...resource,
+    sha256: embeddedCandidateArtifact(bytes).sha256,
+    byteLength: bytes.byteLength
+  };
+}
+function copyDirectProfileFields(target, source) {
+  for (const key of CANDIDATE_PROFILE_DIRECT_FIELDS) {
+    if (source[key] !== void 0) target[key] = source[key];
+  }
+}
+function assertCanonicalParse(input, parsed, label) {
+  if (!Buffer.from(canonicalCandidateBytes(input)).equals(canonicalCandidateBytes(parsed))) {
+    throw new Error(`${label} contains unsupported or non-canonical fields`);
+  }
+}
+function publicResource(resource) {
+  if (resource.kind === "inline") {
+    return { kind: "inline", name: resource.name, content: resource.content };
+  }
+  return {
+    kind: "github",
+    repository: `${resource.repository.owner}/${resource.repository.repo}`,
+    path: resource.path,
+    ref: resource.commit,
+    ...resource.name ? { name: resource.name } : {}
+  };
+}
+function candidatePublicValue(value) {
+  return { kind: "public", value };
+}
+function mapCandidatePublicValues(values) {
+  return Object.fromEntries(
+    Object.entries(values).map(([name, value]) => [name, candidatePublicValue(value)])
+  );
+}
+function publicValue(value) {
+  return value.value;
+}
+function mapPublicValues(values) {
+  return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, publicValue(value)]));
+}
+function cloneRecord(values) {
+  return Object.fromEntries(
+    Object.entries(values).map(([key, value]) => [key, { ...value }])
+  );
+}
+function shellQuote(value) {
+  return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function unsupportedProfileField(path) {
+  throw new Error(
+    `generic AgentProfile field ${path} is not representable in a sealed candidate profile`
+  );
+}
+
 export {
-  CLAIM_FORMAT_VERSION,
-  PENDING_FORMAT_VERSION,
-  TERMINAL_FORMAT_VERSION,
-  PHASE_FORMAT_VERSION,
   canonicalCandidateBytes,
   canonicalCandidateDigest,
   immutableCandidateValue,
   canonicalCandidateDocument,
+  embeddedCandidateArtifact,
   omitTopLevelDigest,
+  sealAgentCandidateBundle,
+  freezeGenericAgentCandidateProfile,
+  assertCandidateProfileBinding,
+  parseExactAgentProfile,
+  parseExactCandidateProfile,
+  CLAIM_FORMAT_VERSION,
+  PENDING_FORMAT_VERSION,
+  TERMINAL_FORMAT_VERSION,
+  PHASE_FORMAT_VERSION,
   assertExactObjectKeys,
   terminalRecord,
   recoveredTerminalRecord,
@@ -4781,4 +5036,4 @@ export {
   verifyAgentCandidateBundle,
   prepareAgentCandidateExecution
 };
-//# sourceMappingURL=chunk-A62TP7SK.js.map
+//# sourceMappingURL=chunk-26WCEARH.js.map