@tangle-network/agent-runtime 3.0.16 → 3.0.18

package/dist/{supervise-BpvUVtSI.js → supervise-BHxxCvbk.js}

@@ -2,11 +2,11 @@ import { $n as persistHarnessTranscript, Ai as spendFromUsageTotals, At as begin
 import { f as RuntimeRunStateError, i as ConfigError, m as ValidationError } from "./errors-AzSuGI23.js";
 import { $ as isAsyncIterable, Dt as teardownExecutor, G as chargedTokens, Ot as teardownSurfaces, St as armDeadlineTimer, Tt as isDeadlineAbortReason, U as addSpend, Y as errorMessage, at as sleep, bt as DEFAULT_SUCCESSFUL_SHUTDOWN_MS, dt as zeroSpend, gt as withBudgetResources, ht as resourceTelemetry, lt as unmeteredSpend, pt as addResourceSpend, tt as promptCacheTokenClasses, ut as withTimeout } from "./workspace-streams-8ALHaZzx.js";
 import { d as detachedSnapshot, h as errorHttpStatus, m as errMessage } from "./jsonl-file-BBP9Dz9w.js";
-import { B as createRouterTranscript, C as createExecutor, Ct as checkVerdictOf, Dt as bridgeAdmissionRefusal, F as codeModeArguments, I as codeModeModelOutput, It as bridgeRuntimeAttachmentsKey, Jt as fullProfileMaterialization, Kt as controlProfileMaterialization, L as createCodeModeTools, Lt as bridgeStopSignalKey, Ot as bridgeModelRouteRefusal, Qt as renderUnsupported, S as captureReusableExecutorConfig, St as bestComposite, U as resolveAgentEnvironmentProvider, V as routerBrain, Wt as assertProfileMaterialization, X as createInbox, Xt as promptControlProfileMaterialization, Y as INBOX_RECEIPT_KEY, Yt as profileMaterializationAxes$1, Zt as promptModelProfileMaterialization, a as assertRunParking, bt as CONTINUATIONS_DIR, c as sleepScopeWait, ct as HarnessTurnFailedError, d as runFinalizer, dt as classifyDriverFailure, en as sandboxProfileMaterialization, et as PEER_MAIL_WIRE_KEY, f as runTree, ft as summarizeDriverAttempts, g as isDriverSpec, gt as gateFactoryOnDeliverable, h as driverExecutorFactory, ht as CheckUnavailableError, i as RunParkedError, l as withRunParking, lt as abandonablePending, m as driverChild, mt as upstreamUnavailableSignal, n as createSupervisor, nn as worktreeCliProfileMaterialization, o as bindScopeParkingDrain, p as createRootHandle, pt as undispatchedCredentialExit, qt as defineProfileMaterializationContract, rt as isPeerMailEnvelope, st as DriverAttemptsExhaustedError, tn as unsupportedProfileDimensions, u as bestDelivered, ut as causedByPartialFailure, w as snapshotExecutorConfig, wt as createContinuationKeeper, x as bindReusableExecutorExecutionId, xt as admitContinuationPolicy, z as toolResultText } from "./supervisor-XWLIHK-U.js";
+import { B as createRouterTranscript, C as createExecutor, Ct as checkVerdictOf, Dt as bridgeAdmissionRefusal, F as codeModeArguments, I as codeModeModelOutput, It as bridgeRuntimeAttachmentsKey, Jt as fullProfileMaterialization, Kt as controlProfileMaterialization, L as createCodeModeTools, Lt as bridgeStopSignalKey, Ot as bridgeModelRouteRefusal, Qt as renderUnsupported, S as captureReusableExecutorConfig, St as bestComposite, U as resolveAgentEnvironmentProvider, V as routerBrain, Wt as assertProfileMaterialization, X as createInbox, Xt as promptControlProfileMaterialization, Y as INBOX_RECEIPT_KEY, Yt as profileMaterializationAxes$1, Zt as promptModelProfileMaterialization, a as assertRunParking, bt as CONTINUATIONS_DIR, c as sleepScopeWait, ct as HarnessTurnFailedError, d as runFinalizer, dt as classifyDriverFailure, en as sandboxProfileMaterialization, et as PEER_MAIL_WIRE_KEY, f as runTree, ft as summarizeDriverAttempts, g as isDriverSpec, gt as gateFactoryOnDeliverable, h as driverExecutorFactory, ht as CheckUnavailableError, i as RunParkedError, l as withRunParking, lt as abandonablePending, m as driverChild, mt as upstreamUnavailableSignal, n as createSupervisor, nn as worktreeCliProfileMaterialization, o as bindScopeParkingDrain, p as createRootHandle, pt as undispatchedCredentialExit, qt as defineProfileMaterializationContract, rt as isPeerMailEnvelope, st as DriverAttemptsExhaustedError, tn as unsupportedProfileDimensions, u as bestDelivered, ut as causedByPartialFailure, w as snapshotExecutorConfig, wt as createContinuationKeeper, x as bindReusableExecutorExecutionId, xt as admitContinuationPolicy, z as toolResultText } from "./supervisor-BFoJnigz.js";
 import { _ as agentHarness, a as concreteProfileModel, c as profileModelExecutionSettings, l as profileProviderModel, n as assertModelAllowed, o as enforceTokenLimits, r as assertProfileModelsAllowed, s as profileBridgeWireModel, t as assertExecutableAgentProfile, v as harnessRunsAgent } from "./model-policy-C-RGAUW4.js";
 import { t as composeRuntimeHooks } from "./runtime-hooks-CsW2pfFk.js";
 import { _ as workerAssignmentNamespace, c as writeRunCancellation, d as coordinationEventId, f as externalExecutionId, g as supervisionRunNamespace, h as rootCoordinationOwner, i as readRunCancellation, l as canonicalExecution, m as freezeDetachedProfile, p as freezeDetached, r as readRunCancelRequest, s as watchRunCancellation, t as applyRunCancellation, u as childCoordinationOwner } from "./run-cancellation-pmPWcMy0.js";
-import { c as createSteerAcknowledger, d as coordinationVerbNames, f as createFileRunContext, l as budgetOverspendText, m as withRunContext, n as createCoordinationToolsForManager, p as createInMemoryRunContext, s as createCancelAcknowledger, t as createCoordinationTools, u as normalizeAnalyzeOnSettle } from "./coordination-manager-CFfarnFh.js";
+import { c as createSteerAcknowledger, d as coordinationVerbNames, f as createFileRunContext, l as budgetOverspendText, m as withRunContext, n as createCoordinationToolsForManager, p as createInMemoryRunContext, s as createCancelAcknowledger, t as createCoordinationTools, u as normalizeAnalyzeOnSettle } from "./coordination-manager-BRJ-3FYo.js";
 import { o as safeJsonText } from "./coordination-map-routing-BllzcZov.js";
 import { n as createStdioToolServer, t as PROTOCOL_VERSION } from "./tool-server-CZWd_Opp.js";
 import { a as graphRegistry, c as loadGraph } from "./graph-registry-D6y6zffC.js";
@@ -3536,7 +3536,7 @@ function createCoordinationCredentials(input) {
 	} : void 0;
 	const randomToken = () => Buffer.from(randomBytes(32).toString("base64url"));
 	let readerToken = randomToken(), controllerToken = randomToken(), audience = "";
-	let current, staged;
+	let current, staged, prior;
 	let allowLegacy = true;
 	const revoked = /* @__PURE__ */ new Map();
 	const grants = createHash("sha256").update(JSON.stringify([...input.toolNames].sort())).digest("hex");
@@ -3566,11 +3566,12 @@ function createCoordinationCredentials(input) {
 			headers: Object.freeze({ Authorization: `Bearer ${text}` })
 		};
 	}
-	const commit = (next) => {
-		if (current) {
-			revoked.set(current.token.toString(), current.expiresAt);
+	const commit = (next, renewal = false) => {
+		if (current && !renewal) {
+			for (const value of [current, prior]) if (value) revoked.set(value.token.toString(), value.expiresAt);
 			allowLegacy = false;
 		}
+		prior = renewal ? current : void 0;
 		current = next;
 		staged = void 0;
 	};
@@ -3586,7 +3587,7 @@ function createCoordinationCredentials(input) {
 		staged = next;
 		try {
 			await install(next.headers);
-			commit(next);
+			commit(next, true);
 		} catch (error) {
 			staged = void 0;
 			revoked.set(next.token.toString(), next.expiresAt);
@@ -3596,8 +3597,12 @@ function createCoordinationCredentials(input) {
 	const matches = (supplied, expected) => supplied.length === expected.length && timingSafeEqual(supplied, expected);
 	const valid = (supplied) => {
 		if (revoked.has(supplied.toString())) return false;
-		if (!signingKeys || !allowLegacy) return [current, staged].some((value) => value !== void 0 && Date.now() < value.expiresAt && matches(supplied, value.token));
-		if (supplied.length > 8192) return false;
+		for (const value of [
+			current,
+			staged,
+			prior
+		]) if (value && Date.now() < value.expiresAt && matches(supplied, value.token)) return true;
+		if (!signingKeys || !allowLegacy || supplied.length > 8192) return false;
 		try {
 			const parts = supplied.toString().split(".");
 			if (parts.length !== 2) return false;
@@ -3606,7 +3611,9 @@ function createCoordinationCredentials(input) {
 			const expected = createHmac("sha256", signingKeys.keys[claims.key]).update(payload).digest();
 			const signature = Buffer.from(parts[1], "base64url");
 			const expiry = claims.expires ?? (allowLegacy && auth?.ttlMs === void 0 ? current?.expiresAt : void 0);
-			return signature.toString("base64url") === parts[1] && matches(signature, expected) && claims.run === run && claims.actor === actor && claims.audience === audience && claims.grants === grants && Number.isSafeInteger(expiry) && expiry > Date.now() && (input.lifetimeExpiresAt === void 0 || expiry <= input.lifetimeExpiresAt);
+			const ours = signature.toString("base64url") === parts[1] && matches(signature, expected) && claims.run === run && claims.actor === actor && claims.audience === audience && claims.grants === grants && Number.isSafeInteger(expiry);
+			if (ours && expiry <= Date.now()) input.onExpiredBearer?.();
+			return ours && expiry > Date.now() && (input.lifetimeExpiresAt === void 0 || expiry <= input.lifetimeExpiresAt);
 		} catch {
 			return false;
 		}
@@ -4415,6 +4422,12 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 	} });
 	if ((opts.authentication || opts.onAudit) && (!identity.runId.trim() || !identity.actorId.trim())) throw new ConfigError("authenticated coordination requires a trusted run and actor identity");
 	const state = openCoordinationListenerState();
+	const stopUnreachable = (reason) => {
+		state.closed = true;
+		try {
+			opts.onStop?.(reason);
+		} catch {}
+	};
 	const credentials = createCoordinationCredentials({
 		authentication: opts.authentication,
 		identity,
@@ -4422,7 +4435,8 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 		scopeSignal: opts.scope.signal,
 		lifetimeSignal: lifetime,
 		lifetimeExpiresAt: opts.scope.rootDeadlineAtMs,
-		isClosed: () => state.closed
+		isClosed: () => state.closed,
+		onExpiredBearer: () => stopUnreachable("coordination credential expired in its holder: no renewal reached it")
 	});
 	const ctx = {
 		opts,
@@ -4499,12 +4513,7 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 		const renew = () => {
 			if (!active || state.closed || opts.scope.signal.aborted || lifetime?.aborted) return;
 			pending = credentials.replace(install);
-			pending.then(schedule, () => {
-				state.closed = true;
-				try {
-					opts.onStop?.("coordination credential renewal failed");
-				} catch {}
-			});
+			pending.then(schedule, () => stopUnreachable("coordination credential renewal failed"));
 		};
 		refreshBoundCredential = () => {
 			cancelTimer?.();
@@ -6119,7 +6128,8 @@ async function readCheckAtTurnEnd(loop, attempt) {
 function reportManagerLoop(loop) {
 	loop.reported = true;
 	const { mcp, controls, state } = loop.session;
-	const stopReason = controls.stopReason() ?? state.progressStopReason;
+	const stopped = state.stopController.signal.reason;
+	const stopReason = controls.stopReason() ?? state.progressStopReason ?? (typeof stopped === "string" ? stopped : void 0);
 	const closedBy = mcp.submittedResult() ? "result-accepted" : mcp.isStopped() ? "stop" : state.progressStopReason !== void 0 ? "stop-rule" : void 0;
 	const blocked = controls.blocked();
 	loop.config.deps.onDriverLoopSettled?.({
@@ -9479,4 +9489,4 @@ function superviseWithContext(profile, task, opts, brain) {
 }
 export { analyzesFindingsReportPrompt as A, anyOf as B, flowRootProfile as C, defaultEdgeTraversalCap as D, validateFlowGraph as E, formatPromptHandle as F, bestSoFar as G, plateau as H, kernelPromptRegistry as I, createSupervisorSpanRecorder as J, plateauLength as K, naiveContinuationPrompt as L, delegatesWorkerBriefPrompt as M, dumbContinuationFailPrompt as N, graphRootProfile as O, dumbContinuationPassPrompt as P, promptHandle as R, createFlowRun as S, routeFlowOf as T, anytimeReport as U, noProgressFor as V, areaUnderCurve as W, coordinationControlToolNames as _, superviseRootProfile as a, createGraphOverlay as b, retryPreSpawnRefusals as c, supervisorAgent as d, supervisorAgentWithTestBrain as f, serveCoordinationMcp as g, composeReentryTask as h, profileGuidanceComposer as i, createPromptRegistry as j, validateGraphTopology as k, withWorkerSpawnRetry as l, UNPROVEN_CONTINUITY as m, superviseFleetCapabilities as n, isPreSpawnExecutorFailure as o, runToolSpans as p, renderAnytimeTable as q, superviseWithTestBrain as r, resolveWorkerSpawnRetry as s, supervise as t, workerFromBackend as u, driverAgent as v, journaledGateDecider as w, GraphRouteError as x, runBrainLoop as y, allWorkersStalled as z };
 
-//# sourceMappingURL=supervise-BpvUVtSI.js.map
+//# sourceMappingURL=supervise-BHxxCvbk.js.map