@tangle-network/agent-runtime 0.93.0 → 0.93.1

package/dist/candidate-execution/index.js

@@ -4,7 +4,7 @@ import {
   createProtectedAgentCandidateModelPort,
   disposePreparedAgentCandidateExecution,
   recoverExpiredAgentCandidateExecution
-} from "../chunk-3VU2OWOY.js";
+} from "../chunk-XDSWWUKE.js";
 import {
   CANDIDATE_TRACE_ENV,
   CANDIDATE_TRACE_TAGS,
@@ -15,7 +15,7 @@ import {
   prepareAgentCandidateExecution,
   sealAgentCandidateBundle,
   verifyAgentCandidateBundle
-} from "../chunk-26WCEARH.js";
+} from "../chunk-OX3QRJOA.js";
 import "../chunk-3D2RHC4K.js";
 import "../chunk-3MDZX7YU.js";
 import "../chunk-DGUM43GV.js";

package/dist/{chunk-26WCEARH.js → chunk-OX3QRJOA.js}

@@ -4028,6 +4028,255 @@ import {
   applyAgentCandidateWorkspacePlan,
   materializeCandidateProfile
 } from "@tangle-network/agent-profile-materialize";
+
+// src/candidate-execution/profile.ts
+import { agentCandidateProfileSchema, agentProfileSchema } from "@tangle-network/agent-interface";
+var CANDIDATE_PROFILE_DIRECT_FIELDS = [
+  "name",
+  "description",
+  "version",
+  "tags",
+  "prompt",
+  "harness",
+  "permissions",
+  "tools",
+  "confidential"
+];
+function freezeGenericAgentCandidateProfile(input) {
+  const profile = parseExactAgentProfile(input, "profile");
+  if (profile.connections !== void 0) unsupportedProfileField("connections");
+  if (profile.metadata !== void 0) unsupportedProfileField("metadata");
+  if (profile.extensions !== void 0) unsupportedProfileField("extensions");
+  if (profile.model?.metadata !== void 0) unsupportedProfileField("model.metadata");
+  const candidate = {};
+  copyDirectProfileFields(candidate, profile);
+  if (profile.model) {
+    const { metadata: _metadata, ...model } = profile.model;
+    candidate.model = model;
+  }
+  if (profile.mcp) candidate.mcp = freezeMcpServers(profile.mcp);
+  if (profile.subagents) {
+    candidate.subagents = Object.fromEntries(
+      Object.entries(profile.subagents).map(([name, subagent]) => {
+        if (subagent.metadata !== void 0) unsupportedProfileField(`subagents.${name}.metadata`);
+        const { metadata: _metadata, ...value } = subagent;
+        return [name, value];
+      })
+    );
+  }
+  if (profile.resources) candidate.resources = freezeResources(profile.resources);
+  if (profile.hooks && Object.values(profile.hooks).some((commands) => commands.length > 0)) {
+    throw new Error(
+      "generic AgentProfile hooks cannot be safely tokenized; use a candidate-profile source with executable/args"
+    );
+  }
+  if (profile.hooks) candidate.hooks = profile.hooks;
+  if (profile.modes) {
+    candidate.modes = Object.fromEntries(
+      Object.entries(profile.modes).map(([name, mode]) => {
+        if (mode.metadata !== void 0) unsupportedProfileField(`modes.${name}.metadata`);
+        const { metadata: _metadata, ...value } = mode;
+        return [name, value];
+      })
+    );
+  }
+  const parsed = parseExactCandidateProfile(candidate);
+  assertCandidateProfileBinding(profile, parsed);
+  return parsed;
+}
+function assertCandidateProfileBinding(measuredInput, bundled) {
+  const measured = parseExactAgentProfile(measuredInput, "proposal candidate profile");
+  if (measured.connections || measured.metadata || measured.extensions) {
+    throw new Error("proposal candidate profile contains fields unsupported by sealed candidates");
+  }
+  const normalized = candidateProfileAsAgentProfile(bundled);
+  if (canonicalCandidateDigest(measured) !== canonicalCandidateDigest(normalized)) {
+    throw new Error("proposal candidateProfile does not match candidateBundle.profile");
+  }
+}
+function parseExactAgentProfile(input, label) {
+  const parsed = agentProfileSchema.parse(input);
+  assertCanonicalParse(input, parsed, label);
+  return parsed;
+}
+function parseExactCandidateProfile(input) {
+  const parsed = agentCandidateProfileSchema.parse(input);
+  assertCanonicalParse(input, parsed, "candidate profile");
+  return parsed;
+}
+function assertCandidateProfileExecutionSupport(profile) {
+  const fields = ["tools", "permissions", "modes", "confidential"];
+  const unsupported = fields.filter((field) => hasEntries(profile[field]));
+  if (unsupported.length > 0) {
+    throw new Error(
+      `candidate execution cannot prove in-session effects for non-empty AgentProfile fields: ${unsupported.join(", ")}`
+    );
+  }
+}
+function candidateProfileAsAgentProfile(candidate) {
+  const output = {};
+  copyDirectProfileFields(output, candidate);
+  if (candidate.model) output.model = { ...candidate.model };
+  if (candidate.mcp) {
+    output.mcp = Object.fromEntries(
+      Object.entries(candidate.mcp).map(([name, server]) => [
+        name,
+        {
+          ...server,
+          ...server.args ? { args: server.args.map(publicValue) } : {},
+          ...server.env ? { env: mapPublicValues(server.env) } : {}
+        }
+      ])
+    );
+  }
+  if (candidate.subagents) output.subagents = cloneRecord(candidate.subagents);
+  if (candidate.modes) output.modes = cloneRecord(candidate.modes);
+  if (candidate.hooks) {
+    output.hooks = Object.fromEntries(
+      Object.entries(candidate.hooks).map(([event, hooks]) => [
+        event,
+        hooks.map(({ executable, args, env, ...hook }) => ({
+          ...hook,
+          command: [executable, ...(args ?? []).map(publicValue)].map(shellQuote).join(" "),
+          ...env ? { env: mapPublicValues(env) } : {}
+        }))
+      ])
+    );
+  }
+  if (candidate.resources) {
+    if (candidate.resources.failOnError !== true) {
+      throw new Error("proposal candidate profile contains fields unsupported by sealed candidates");
+    }
+    output.resources = {
+      failOnError: true,
+      ...candidate.resources.files ? {
+        files: candidate.resources.files.map((file) => ({
+          ...file,
+          resource: publicResource(file.resource)
+        }))
+      } : {},
+      ...candidate.resources.tools ? { tools: candidate.resources.tools.map(publicResource) } : {},
+      ...candidate.resources.skills ? { skills: candidate.resources.skills.map(publicResource) } : {},
+      ...candidate.resources.agents ? { agents: candidate.resources.agents.map(publicResource) } : {},
+      ...candidate.resources.commands ? { commands: candidate.resources.commands.map(publicResource) } : {},
+      ...candidate.resources.instructions !== void 0 ? {
+        instructions: typeof candidate.resources.instructions === "string" ? candidate.resources.instructions : publicResource(candidate.resources.instructions)
+      } : {}
+    };
+  }
+  return output;
+}
+function freezeMcpServers(servers) {
+  return Object.fromEntries(
+    Object.entries(servers).map(([name, server]) => {
+      if (server.transport !== void 0 && server.transport !== "stdio") {
+        unsupportedProfileField(`mcp.${name}.transport=${server.transport}`);
+      }
+      if (server.url !== void 0) unsupportedProfileField(`mcp.${name}.url`);
+      if (server.headers !== void 0) unsupportedProfileField(`mcp.${name}.headers`);
+      if (server.metadata !== void 0) unsupportedProfileField(`mcp.${name}.metadata`);
+      return [
+        name,
+        {
+          ...server.transport ? { transport: server.transport } : {},
+          ...server.command ? { command: server.command } : {},
+          ...server.args ? { args: server.args.map(candidatePublicValue) } : {},
+          ...server.env ? { env: mapCandidatePublicValues(server.env) } : {},
+          ...server.cwd ? { cwd: server.cwd } : {},
+          ...server.enabled === void 0 ? {} : { enabled: server.enabled }
+        }
+      ];
+    })
+  );
+}
+function freezeResources(resources) {
+  if (resources.failOnError !== true) {
+    throw new Error("candidate profile resources require failOnError: true");
+  }
+  return {
+    failOnError: true,
+    ...resources.files ? {
+      files: resources.files.map((file) => ({
+        ...file,
+        resource: freezeResource(file.resource)
+      }))
+    } : {},
+    ...resources.tools ? { tools: resources.tools.map(freezeResource) } : {},
+    ...resources.skills ? { skills: resources.skills.map(freezeResource) } : {},
+    ...resources.agents ? { agents: resources.agents.map(freezeResource) } : {},
+    ...resources.commands ? { commands: resources.commands.map(freezeResource) } : {},
+    ...resources.instructions === void 0 ? {} : {
+      instructions: typeof resources.instructions === "string" ? resources.instructions : freezeResource(resources.instructions)
+    }
+  };
+}
+function freezeResource(resource) {
+  if (resource.kind === "github") {
+    throw new Error(
+      "generic GitHub profile resources do not carry byte identity; use a candidate-profile source with a pinned commit, digest, and byte length"
+    );
+  }
+  const bytes = Buffer.from(resource.content, "utf8");
+  return {
+    ...resource,
+    sha256: embeddedCandidateArtifact(bytes).sha256,
+    byteLength: bytes.byteLength
+  };
+}
+function copyDirectProfileFields(target, source) {
+  for (const key of CANDIDATE_PROFILE_DIRECT_FIELDS) {
+    if (source[key] !== void 0) target[key] = source[key];
+  }
+}
+function assertCanonicalParse(input, parsed, label) {
+  if (!Buffer.from(canonicalCandidateBytes(input)).equals(canonicalCandidateBytes(parsed))) {
+    throw new Error(`${label} contains unsupported or non-canonical fields`);
+  }
+}
+function publicResource(resource) {
+  if (resource.kind === "inline") {
+    return { kind: "inline", name: resource.name, content: resource.content };
+  }
+  return {
+    kind: "github",
+    repository: `${resource.repository.owner}/${resource.repository.repo}`,
+    path: resource.path,
+    ref: resource.commit,
+    ...resource.name ? { name: resource.name } : {}
+  };
+}
+function candidatePublicValue(value) {
+  return { kind: "public", value };
+}
+function mapCandidatePublicValues(values) {
+  return Object.fromEntries(
+    Object.entries(values).map(([name, value]) => [name, candidatePublicValue(value)])
+  );
+}
+function publicValue(value) {
+  return value.value;
+}
+function mapPublicValues(values) {
+  return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, publicValue(value)]));
+}
+function cloneRecord(values) {
+  return Object.fromEntries(
+    Object.entries(values).map(([key, value]) => [key, { ...value }])
+  );
+}
+function hasEntries(value) {
+  return value !== void 0 && value !== null && typeof value === "object" ? Object.keys(value).length > 0 : false;
+}
+function shellQuote(value) {
+  return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function unsupportedProfileField(path) {
+  throw new Error(
+    `generic AgentProfile field ${path} is not representable in a sealed candidate profile`
+  );
+}
+
+// src/candidate-execution/prepare.ts
 var MATERIALIZER_HARNESSES = /* @__PURE__ */ new Set([
   "claude-code",
   "claude",
@@ -4049,6 +4298,7 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
   const verifiedState = getVerifiedCandidateState(candidate);
   assertSameVerificationPorts(verifiedState.ports, ports);
   const bundle = candidate.bundle;
+  assertCandidateProfileExecutionSupport(bundle.profile);
   const harness = materializerHarness(bundle.execution.harness);
   assertTaskInput(task, bundle.execution.instructionDelivery);
   const resultTimeoutMs = candidateResultTimeout(options.resultTimeoutMs, task.limits.timeoutMs);
@@ -4753,241 +5003,6 @@ function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
-// src/candidate-execution/profile.ts
-import { agentCandidateProfileSchema, agentProfileSchema } from "@tangle-network/agent-interface";
-var CANDIDATE_PROFILE_DIRECT_FIELDS = [
-  "name",
-  "description",
-  "version",
-  "tags",
-  "prompt",
-  "harness",
-  "permissions",
-  "tools",
-  "confidential"
-];
-function freezeGenericAgentCandidateProfile(input) {
-  const profile = parseExactAgentProfile(input, "profile");
-  if (profile.connections !== void 0) unsupportedProfileField("connections");
-  if (profile.metadata !== void 0) unsupportedProfileField("metadata");
-  if (profile.extensions !== void 0) unsupportedProfileField("extensions");
-  if (profile.model?.metadata !== void 0) unsupportedProfileField("model.metadata");
-  const candidate = {};
-  copyDirectProfileFields(candidate, profile);
-  if (profile.model) {
-    const { metadata: _metadata, ...model } = profile.model;
-    candidate.model = model;
-  }
-  if (profile.mcp) candidate.mcp = freezeMcpServers(profile.mcp);
-  if (profile.subagents) {
-    candidate.subagents = Object.fromEntries(
-      Object.entries(profile.subagents).map(([name, subagent]) => {
-        if (subagent.metadata !== void 0) unsupportedProfileField(`subagents.${name}.metadata`);
-        const { metadata: _metadata, ...value } = subagent;
-        return [name, value];
-      })
-    );
-  }
-  if (profile.resources) candidate.resources = freezeResources(profile.resources);
-  if (profile.hooks && Object.values(profile.hooks).some((commands) => commands.length > 0)) {
-    throw new Error(
-      "generic AgentProfile hooks cannot be safely tokenized; use a candidate-profile source with executable/args"
-    );
-  }
-  if (profile.hooks) candidate.hooks = profile.hooks;
-  if (profile.modes) {
-    candidate.modes = Object.fromEntries(
-      Object.entries(profile.modes).map(([name, mode]) => {
-        if (mode.metadata !== void 0) unsupportedProfileField(`modes.${name}.metadata`);
-        const { metadata: _metadata, ...value } = mode;
-        return [name, value];
-      })
-    );
-  }
-  const parsed = parseExactCandidateProfile(candidate);
-  assertCandidateProfileBinding(profile, parsed);
-  return parsed;
-}
-function assertCandidateProfileBinding(measuredInput, bundled) {
-  const measured = parseExactAgentProfile(measuredInput, "proposal candidate profile");
-  if (measured.connections || measured.metadata || measured.extensions) {
-    throw new Error("proposal candidate profile contains fields unsupported by sealed candidates");
-  }
-  const normalized = candidateProfileAsAgentProfile(bundled);
-  if (canonicalCandidateDigest(measured) !== canonicalCandidateDigest(normalized)) {
-    throw new Error("proposal candidateProfile does not match candidateBundle.profile");
-  }
-}
-function parseExactAgentProfile(input, label) {
-  const parsed = agentProfileSchema.parse(input);
-  assertCanonicalParse(input, parsed, label);
-  return parsed;
-}
-function parseExactCandidateProfile(input) {
-  const parsed = agentCandidateProfileSchema.parse(input);
-  assertCanonicalParse(input, parsed, "candidate profile");
-  return parsed;
-}
-function candidateProfileAsAgentProfile(candidate) {
-  const output = {};
-  copyDirectProfileFields(output, candidate);
-  if (candidate.model) output.model = { ...candidate.model };
-  if (candidate.mcp) {
-    output.mcp = Object.fromEntries(
-      Object.entries(candidate.mcp).map(([name, server]) => [
-        name,
-        {
-          ...server,
-          ...server.args ? { args: server.args.map(publicValue) } : {},
-          ...server.env ? { env: mapPublicValues(server.env) } : {}
-        }
-      ])
-    );
-  }
-  if (candidate.subagents) output.subagents = cloneRecord(candidate.subagents);
-  if (candidate.modes) output.modes = cloneRecord(candidate.modes);
-  if (candidate.hooks) {
-    output.hooks = Object.fromEntries(
-      Object.entries(candidate.hooks).map(([event, hooks]) => [
-        event,
-        hooks.map(({ executable, args, env, ...hook }) => ({
-          ...hook,
-          command: [executable, ...(args ?? []).map(publicValue)].map(shellQuote).join(" "),
-          ...env ? { env: mapPublicValues(env) } : {}
-        }))
-      ])
-    );
-  }
-  if (candidate.resources) {
-    if (candidate.resources.failOnError !== true) {
-      throw new Error("proposal candidate profile contains fields unsupported by sealed candidates");
-    }
-    output.resources = {
-      failOnError: true,
-      ...candidate.resources.files ? {
-        files: candidate.resources.files.map((file) => ({
-          ...file,
-          resource: publicResource(file.resource)
-        }))
-      } : {},
-      ...candidate.resources.tools ? { tools: candidate.resources.tools.map(publicResource) } : {},
-      ...candidate.resources.skills ? { skills: candidate.resources.skills.map(publicResource) } : {},
-      ...candidate.resources.agents ? { agents: candidate.resources.agents.map(publicResource) } : {},
-      ...candidate.resources.commands ? { commands: candidate.resources.commands.map(publicResource) } : {},
-      ...candidate.resources.instructions !== void 0 ? {
-        instructions: typeof candidate.resources.instructions === "string" ? candidate.resources.instructions : publicResource(candidate.resources.instructions)
-      } : {}
-    };
-  }
-  return output;
-}
-function freezeMcpServers(servers) {
-  return Object.fromEntries(
-    Object.entries(servers).map(([name, server]) => {
-      if (server.transport !== void 0 && server.transport !== "stdio") {
-        unsupportedProfileField(`mcp.${name}.transport=${server.transport}`);
-      }
-      if (server.url !== void 0) unsupportedProfileField(`mcp.${name}.url`);
-      if (server.headers !== void 0) unsupportedProfileField(`mcp.${name}.headers`);
-      if (server.metadata !== void 0) unsupportedProfileField(`mcp.${name}.metadata`);
-      return [
-        name,
-        {
-          ...server.transport ? { transport: server.transport } : {},
-          ...server.command ? { command: server.command } : {},
-          ...server.args ? { args: server.args.map(candidatePublicValue) } : {},
-          ...server.env ? { env: mapCandidatePublicValues(server.env) } : {},
-          ...server.cwd ? { cwd: server.cwd } : {},
-          ...server.enabled === void 0 ? {} : { enabled: server.enabled }
-        }
-      ];
-    })
-  );
-}
-function freezeResources(resources) {
-  if (resources.failOnError !== true) {
-    throw new Error("candidate profile resources require failOnError: true");
-  }
-  return {
-    failOnError: true,
-    ...resources.files ? {
-      files: resources.files.map((file) => ({
-        ...file,
-        resource: freezeResource(file.resource)
-      }))
-    } : {},
-    ...resources.tools ? { tools: resources.tools.map(freezeResource) } : {},
-    ...resources.skills ? { skills: resources.skills.map(freezeResource) } : {},
-    ...resources.agents ? { agents: resources.agents.map(freezeResource) } : {},
-    ...resources.commands ? { commands: resources.commands.map(freezeResource) } : {},
-    ...resources.instructions === void 0 ? {} : {
-      instructions: typeof resources.instructions === "string" ? resources.instructions : freezeResource(resources.instructions)
-    }
-  };
-}
-function freezeResource(resource) {
-  if (resource.kind === "github") {
-    throw new Error(
-      "generic GitHub profile resources do not carry byte identity; use a candidate-profile source with a pinned commit, digest, and byte length"
-    );
-  }
-  const bytes = Buffer.from(resource.content, "utf8");
-  return {
-    ...resource,
-    sha256: embeddedCandidateArtifact(bytes).sha256,
-    byteLength: bytes.byteLength
-  };
-}
-function copyDirectProfileFields(target, source) {
-  for (const key of CANDIDATE_PROFILE_DIRECT_FIELDS) {
-    if (source[key] !== void 0) target[key] = source[key];
-  }
-}
-function assertCanonicalParse(input, parsed, label) {
-  if (!Buffer.from(canonicalCandidateBytes(input)).equals(canonicalCandidateBytes(parsed))) {
-    throw new Error(`${label} contains unsupported or non-canonical fields`);
-  }
-}
-function publicResource(resource) {
-  if (resource.kind === "inline") {
-    return { kind: "inline", name: resource.name, content: resource.content };
-  }
-  return {
-    kind: "github",
-    repository: `${resource.repository.owner}/${resource.repository.repo}`,
-    path: resource.path,
-    ref: resource.commit,
-    ...resource.name ? { name: resource.name } : {}
-  };
-}
-function candidatePublicValue(value) {
-  return { kind: "public", value };
-}
-function mapCandidatePublicValues(values) {
-  return Object.fromEntries(
-    Object.entries(values).map(([name, value]) => [name, candidatePublicValue(value)])
-  );
-}
-function publicValue(value) {
-  return value.value;
-}
-function mapPublicValues(values) {
-  return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, publicValue(value)]));
-}
-function cloneRecord(values) {
-  return Object.fromEntries(
-    Object.entries(values).map(([key, value]) => [key, { ...value }])
-  );
-}
-function shellQuote(value) {
-  return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : `'${value.replaceAll("'", `'"'"'`)}'`;
-}
-function unsupportedProfileField(path) {
-  throw new Error(
-    `generic AgentProfile field ${path} is not representable in a sealed candidate profile`
-  );
-}
-
 export {
   canonicalCandidateBytes,
   canonicalCandidateDigest,
@@ -5036,4 +5051,4 @@ export {
   verifyAgentCandidateBundle,
   prepareAgentCandidateExecution
 };
-//# sourceMappingURL=chunk-26WCEARH.js.map
+//# sourceMappingURL=chunk-OX3QRJOA.js.map