@algosuite/vo-mcp 0.2.0-beta.18 → 0.2.0-beta.19

package/dist/runner-cli.js

@@ -2142,11 +2142,11 @@ function createControlPlaneClient({
     throw new Error("VO_CONTROL_PLANE_URL is required for the code-runner daemon");
   }
   const root = resolvedBaseUrl.replace(/\/+$/, "");
-  async function req(method, path18, body, { timeoutMs } = {}) {
+  async function req(method, path16, body, { timeoutMs } = {}) {
     const bearer = await resolveBearer(env2);
     const controller = timeoutMs ? new AbortController() : null;
     let timeoutId;
-    const request = Promise.resolve(fetchImpl(`${root}${path18}`, {
+    const request = Promise.resolve(fetchImpl(`${root}${path16}`, {
       method,
       headers: {
         "content-type": "application/json",
@@ -2159,7 +2159,7 @@ function createControlPlaneClient({
     const timeout = new Promise((_, reject) => {
       timeoutId = setTimeout(() => {
         controller.abort();
-        reject(new Error(`control-plane ${path18} timed out after ${timeoutMs}ms`));
+        reject(new Error(`control-plane ${path16} timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
     try {
@@ -2278,8 +2278,8 @@ function createControlPlaneClient({
       return json ? json.task : null;
     },
     async downloadTaskAttachment(taskId, attachmentId) {
-      const path18 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
-      const res = await req("GET", path18);
+      const path16 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
+      const res = await req("GET", path16);
       if (res.status === 401) cachedFirebaseToken = null;
       if (!res.ok) throw new Error(`attachment download failed: HTTP ${res.status}`);
       return Buffer.from(await res.arrayBuffer());
@@ -3089,17 +3089,26 @@ function selectOrphanKills({ instances = [], liveProcesses = /* @__PURE__ */ new
   }
   return { kills, pruneDirs };
 }
-function listProcessCreationTimes({ platform = process.platform, spawn: spawn5 = spawnSync5 } = {}) {
+function windowsSystemRoot(env2 = process.env) {
+  return env2.SystemRoot || env2.WINDIR || "C:\\Windows";
+}
+function windowsPowershellExe(env2 = process.env) {
+  return path10.join(windowsSystemRoot(env2), "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+}
+function listProcessCreationTimes({ platform = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env, warn = console.warn } = {}) {
   const map = /* @__PURE__ */ new Map();
   if (platform === "win32") {
     const ps = "Get-CimInstance Win32_Process | ForEach-Object { '{0} {1}' -f $_.ProcessId, (([DateTimeOffset]$_.CreationDate.ToUniversalTime()).ToUnixTimeMilliseconds()) }";
-    const result2 = spawn5("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], {
+    const result2 = spawn5(windowsPowershellExe(env2), ["-NoProfile", "-NonInteractive", "-Command", ps], {
       windowsHide: true,
       encoding: "utf8",
       timeout: 2e4,
       maxBuffer: 32 * 1024 * 1024
     });
-    if (result2.error || result2.status !== 0 || typeof result2.stdout !== "string") return map;
+    if (result2.error || result2.status !== 0 || typeof result2.stdout !== "string") {
+      warn(`[orphan-reaper] process enumeration failed (${result2.error ? result2.error.message : `powershell exit ${result2.status}`}); reaping nothing this cycle`);
+      return map;
+    }
     for (const line of result2.stdout.split(/\r?\n/)) {
       const m = line.trim().match(/^(\d+)\s+(-?\d+)$/);
       if (m) map.set(Number(m[1]), { creationMs: Number(m[2]) });
@@ -3107,7 +3116,10 @@ function listProcessCreationTimes({ platform = process.platform, spawn: spawn5 =
     return map;
   }
   const result = spawn5("ps", ["-eo", "pid=,lstart="], { encoding: "utf8", timeout: 2e4, maxBuffer: 32 * 1024 * 1024 });
-  if (result.error || result.status !== 0 || typeof result.stdout !== "string") return map;
+  if (result.error || result.status !== 0 || typeof result.stdout !== "string") {
+    warn(`[orphan-reaper] process enumeration failed (${result.error ? result.error.message : `ps exit ${result.status}`}); reaping nothing this cycle`);
+    return map;
+  }
   for (const line of result.stdout.split(/\r?\n/)) {
     const parsed = parsePosixPsLine(line);
     if (parsed) map.set(parsed.pid, { creationMs: parsed.creationMs });
@@ -3123,10 +3135,11 @@ function parsePosixPsLine(line) {
   if (!Number.isInteger(pid) || pid <= 0 || !Number.isFinite(when)) return null;
   return { pid, creationMs: when };
 }
-function killProcessTree(pid, { platform = process.platform, spawn: spawn5 = spawnSync5 } = {}) {
+function killProcessTree(pid, { platform = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env } = {}) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   if (platform === "win32") {
-    const r = spawn5("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore", timeout: 15e3 });
+    const taskkill = path10.join(windowsSystemRoot(env2), "System32", "taskkill.exe");
+    const r = spawn5(taskkill, ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore", timeout: 15e3 });
     return !r.error && r.status === 0;
   }
   try {
@@ -3660,7 +3673,7 @@ function resolveCodexBinary({
   return "codex";
 }
 function buildCodexArgs({ model, effort } = {}) {
-  const args = ["exec", "--json", "-c", 'approval_policy="never"', "--sandbox", "workspace-write"];
+  const args = ["exec", "--json", "-c", 'approval_policy="never"', "--sandbox", "workspace-write", "--skip-git-repo-check"];
   if (model) {
     args.push("--model", String(model));
   }
@@ -3729,11 +3742,25 @@ var init_codex_runner = __esm({
       parseEvent(line) {
         return parseCodexEvent(line);
       }
-      getSpawnOptions({ bin } = {}) {
-        const effectiveBin = String(bin || this.binary || "");
+      /**
+       * SECURITY: never `shell: true` — same RCE class as cursor-runner. The old
+       * `shell: win32 && !/\.exe$/` fell back to shell mode whenever
+       * resolveCodexBinary() could not find one of its hardcoded absolute paths and
+       * returned the bare string 'codex'. Node's shell mode joins argv into
+       * `cmd /d /s /c` with windowsVerbatimArguments, and buildCodexArgs() puts the
+       * control-plane-controlled `model` into argv, so a payload of
+       * `{ agent: 'codex', model: 'gpt-5 & <cmd>' }` executed arbitrary code —
+       * including on hosts where codex is NOT installed, because cmd runs the first
+       * command, it fails, and `&` runs the rest anyway.
+       *
+       * With shell:false a `.cmd`/`.ps1` shim no longer resolves and the spawn fails
+       * closed with ENOENT, matching resolveWindowsClaudeExecutable()'s policy.
+       */
+      getSpawnOptions() {
         return {
-          shell: process.platform === "win32" && !/\.exe$/i.test(effectiveBin),
-          windowsHide: true
+          shell: false,
+          windowsHide: true,
+          windowsVerbatimArguments: false
         };
       }
       /**
@@ -3867,10 +3894,26 @@ var init_cursor_runner = __esm({
       parseEvent(line) {
         return parseCursorEvent(line);
       }
+      /**
+       * SECURITY: never `shell: true`. Node's shell mode on Windows joins argv and
+       * hands it to `cmd /d /s /c` with windowsVerbatimArguments, so every cmd
+       * metacharacter (& | > ^) in an argument is interpreted by the shell. This
+       * runner puts two control-plane-controlled strings into argv — `task.model`
+       * and the composed prompt (buildCursorArgs) — so shell mode turned a task
+       * payload into arbitrary host code execution. It fired even without
+       * cursor-agent installed: cmd runs the first command, it fails, and `&` runs
+       * the rest anyway. With shell:false argv goes straight to CreateProcess and
+       * metacharacters are inert.
+       *
+       * Consequence on Windows: a `.cmd`/`.ps1` shim no longer resolves, so the
+       * runner fails closed with ENOENT rather than executing through a shell —
+       * the same policy resolveWindowsClaudeExecutable() enforces for Claude.
+       */
       getSpawnOptions() {
         return {
-          shell: process.platform === "win32",
-          windowsHide: true
+          shell: false,
+          windowsHide: true,
+          windowsVerbatimArguments: false
         };
       }
       /**
@@ -3885,7 +3928,7 @@ var init_cursor_runner = __esm({
       async checkAuth() {
         try {
           const { status, error } = spawnSync7("cursor-agent", ["--version"], {
-            shell: process.platform === "win32",
+            shell: false,
             windowsHide: true,
             timeout: 3e3,
             stdio: "ignore"
@@ -3942,11 +3985,13 @@ var init_meta_runner = __esm({
       parseEvent(line) {
         return parseCodexEvent(line);
       }
-      getSpawnOptions({ bin } = {}) {
-        const effectiveBin = String(bin || this.binary || "");
+      // SECURITY: never shell — see no-shell-spawn.test.mjs. Inert today (buildArgs
+      // throws) but this goes hot the moment the transport is enabled.
+      getSpawnOptions() {
         return {
-          shell: process.platform === "win32" && !/\.exe$/i.test(effectiveBin),
-          windowsHide: true
+          shell: false,
+          windowsHide: true,
+          windowsVerbatimArguments: false
         };
       }
       applyAuthEnv(env2 = process.env) {
@@ -3995,11 +4040,13 @@ var init_openai_compatible_runner = __esm({
       parseEvent(line) {
         return parseCodexEvent(line);
       }
-      getSpawnOptions({ bin } = {}) {
-        const effectiveBin = String(bin || this.binary || "");
+      // SECURITY: never shell — see no-shell-spawn.test.mjs. Inert today (buildArgs
+      // throws) but this goes hot the moment the transport is enabled.
+      getSpawnOptions() {
         return {
-          shell: process.platform === "win32" && !/\.exe$/i.test(effectiveBin),
-          windowsHide: true
+          shell: false,
+          windowsHide: true,
+          windowsVerbatimArguments: false
         };
       }
       /** Fill the BYO key env var from the OS keychain when not already set. */
@@ -4244,6 +4291,16 @@ var init_rate_limit_resume = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/secure-random.mjs
+import { randomInt } from "node:crypto";
+var secureUnitRandom;
+var init_secure_random = __esm({
+  "../../scripts/virtual-office/code-runner/secure-random.mjs"() {
+    "use strict";
+    secureUnitRandom = () => randomInt(0, 2 ** 32) / 2 ** 32;
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/git-resilience.mjs
 function isTransientGitError(err) {
   if (!err) return false;
@@ -4255,7 +4312,7 @@ function isTransientGitError(err) {
   }
   return TRANSIENT_RE.test(msg);
 }
-function computeGitBackoffMs(attempt, { baseMs = 5e3, capMs = 3e4, rng = Math.random } = {}) {
+function computeGitBackoffMs(attempt, { baseMs = 5e3, capMs = 3e4, rng = secureUnitRandom } = {}) {
   const exp = Math.min(capMs, baseMs * Math.pow(2, Math.max(0, attempt)));
   return Math.floor(exp / 2 + rng() * (exp / 2));
 }
@@ -4263,6 +4320,7 @@ var TRANSIENT_CODES, TRANSIENT_RE;
 var init_git_resilience = __esm({
   "../../scripts/virtual-office/code-runner/git-resilience.mjs"() {
     "use strict";
+    init_secure_random();
     TRANSIENT_CODES = /* @__PURE__ */ new Set([
       "ETIMEDOUT",
       "ECONNRESET",
@@ -4289,10 +4347,39 @@ var init_auto_merge = __esm({
 
 // ../../scripts/virtual-office/code-runner/pr-overlap-gate.mjs
 import { spawnSync as spawnSync8 } from "node:child_process";
-import path11 from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import { fileURLToPath } from "node:url";
+function stripCredentials(env2 = process.env) {
+  const safe = { ...env2 };
+  for (const key of CREDENTIAL_ENV_KEYS) delete safe[key];
+  return safe;
+}
+function resolveOverlapScript({
+  worktreeDir,
+  trustedPath = TRUSTED_OVERLAP_SCRIPT,
+  existsFn = existsSync5,
+  joinFn = (dir) => `${dir}/scripts/ci/check-local-pr-overlap.mjs`
+} = {}) {
+  if (existsFn(trustedPath)) return { scriptPath: trustedPath, trusted: true };
+  return { scriptPath: joinFn(worktreeDir), trusted: false };
+}
+var TRUSTED_OVERLAP_SCRIPT, CREDENTIAL_ENV_KEYS;
 var init_pr_overlap_gate = __esm({
   "../../scripts/virtual-office/code-runner/pr-overlap-gate.mjs"() {
     "use strict";
+    TRUSTED_OVERLAP_SCRIPT = fileURLToPath(
+      new URL("../../ci/check-local-pr-overlap.mjs", import.meta.url)
+    );
+    CREDENTIAL_ENV_KEYS = Object.freeze([
+      "GH_TOKEN",
+      "GITHUB_TOKEN",
+      "VO_CONTROL_PLANE_ADMIN_TOKEN",
+      "VO_CONTROL_PLANE_TOKEN",
+      "GITHUB_APP_PRIVATE_KEY",
+      "ANTHROPIC_API_KEY",
+      "OPENAI_API_KEY",
+      "CURSOR_API_KEY"
+    ]);
   }
 });
 
@@ -4336,14 +4423,14 @@ function parsePorcelainZ(out) {
   for (let i = 0; i < tokens.length; i += 1) {
     const tok = tokens[i];
     if (!tok) continue;
-    const path18 = tok.slice(3);
-    if (path18) files.push(path18);
+    const path16 = tok.slice(3);
+    if (path16) files.push(path16);
     if (tok[0] === "R" || tok[0] === "C") i += 1;
   }
   return files;
 }
-function isAgentScratch(path18) {
-  const p = String(path18 || "");
+function isAgentScratch(path16) {
+  const p = String(path16 || "");
   return SCRATCH_PATTERNS.some((re) => re.test(p));
 }
 function isMaxTurnsResult(summary) {
@@ -4550,7 +4637,6 @@ var init_partial_pr_continuation = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/publish-async.mjs
-import path12 from "node:path";
 function compactTitle(value, max = 100) {
   return String(value || "").replace(/\s+/g, " ").trim().slice(0, max) || "code-task";
 }
@@ -4560,7 +4646,7 @@ function gitRetryLog(op) {
     console.error(`[publish] transient ${op} failure (attempt ${attempt}): ${why} \u2014 retrying in ${Math.round(delayMs / 1e3)}s`);
   };
 }
-async function retryTransientAsync(fn, { attempts = 3, baseMs = 5e3, capMs = 3e4, rng = Math.random, onRetry } = {}) {
+async function retryTransientAsync(fn, { attempts = 3, baseMs = 5e3, capMs = 3e4, rng = secureUnitRandom, onRetry } = {}) {
   let lastErr;
   for (let i = 0; i < attempts; i += 1) {
     try {
@@ -4591,8 +4677,12 @@ async function resolveOrCreateBranchAsync(worktreeDir, branchPrefix, runCommand
   }
   return branch;
 }
-async function runLocalPrOverlapGateAsync(worktreeDir, files, { branch = "", env: env2 = process.env, excludePrNumber = null } = {}) {
-  const scriptPath = path12.join(worktreeDir, "scripts", "ci", "check-local-pr-overlap.mjs");
+async function runLocalPrOverlapGateAsync(worktreeDir, files, { branch = "", env: env2 = process.env, excludePrNumber = null, log: log3 = (m) => console.warn(`[pr-overlap-gate] ${m}`) } = {}) {
+  const { scriptPath, trusted } = resolveOverlapScript({ worktreeDir });
+  const childEnv = trusted ? env2 : stripCredentials(env2);
+  if (!trusted) {
+    log3(`WARNING: trusted overlap script not found; running worktree copy ${scriptPath} with credentials stripped.`);
+  }
   try {
     const output = await runProcess2("node", [
       scriptPath,
@@ -4601,7 +4691,7 @@ async function runLocalPrOverlapGateAsync(worktreeDir, files, { branch = "", env
       ...excludePrNumber ? ["--exclude-pr", String(excludePrNumber)] : []
     ], {
       cwd: worktreeDir,
-      env: env2,
+      env: childEnv,
       input: JSON.stringify([...new Set((files || []).map((file) => String(file || "").trim()).filter(Boolean))]),
       timeout: 12e4
     });
@@ -4883,6 +4973,8 @@ var init_publish_async = __esm({
     init_auto_merge();
     init_git_resilience();
     init_process_runner2();
+    init_secure_random();
+    init_pr_overlap_gate();
     init_existing_pr_publication();
     init_partial_pr_continuation();
     sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
@@ -4899,7 +4991,7 @@ function defaultRunCommand2(cmd, args, cwd, opts = {}) {
 function buildResumeLocalBranchName(remoteBranch, {
   now = () => /* @__PURE__ */ new Date(),
   pid = process.pid,
-  random = Math.random
+  random = secureUnitRandom
 } = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const unique = `${pid}-${random().toString(36).slice(2, 8)}`;
@@ -4991,13 +5083,14 @@ var init_resume_branch = __esm({
     "use strict";
     init_publish();
     init_process_runner2();
+    init_secure_random();
   }
 });
 
 // ../../scripts/virtual-office/code-runner/skill-catalog.mjs
 import { readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "node:fs";
 import { dirname as dirname3, join as join3 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function parseFrontmatterNameDescription(raw) {
   const text = String(raw).replace(/\r\n/g, "\n");
   if (!text.startsWith("---\n")) return null;
@@ -5016,7 +5109,7 @@ function parseFrontmatterNameDescription(raw) {
   return name && description ? { name, description } : null;
 }
 function resolveDefaultRepoRoot() {
-  const starts = [dirname3(fileURLToPath(import.meta.url)), process.cwd()];
+  const starts = [dirname3(fileURLToPath2(import.meta.url)), process.cwd()];
   for (const start of starts) {
     let dir = start;
     for (let i = 0; i < 8; i += 1) {
@@ -5271,7 +5364,7 @@ var init_task_prompt = __esm({
 import { createHash as createHash3, randomUUID } from "node:crypto";
 import { chmod, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import os2 from "node:os";
-import path13 from "node:path";
+import path11 from "node:path";
 function safeTaskToken(taskId) {
   return String(taskId || "task").replace(/[^0-9A-Za-z_-]/gu, "_").slice(0, 48) || "task";
 }
@@ -5281,25 +5374,25 @@ function sanitizeTaskAttachmentName(name, index = 0) {
   return `${String(index + 1).padStart(2, "0")}-${normalized}`;
 }
 function assertGeneratedDirectory(directory, tempRoot) {
-  const resolvedDirectory = path13.resolve(directory);
-  const resolvedRoot = path13.resolve(tempRoot);
-  if (path13.dirname(resolvedDirectory) !== resolvedRoot || !path13.basename(resolvedDirectory).startsWith(DIRECTORY_PREFIX)) {
+  const resolvedDirectory = path11.resolve(directory);
+  const resolvedRoot = path11.resolve(tempRoot);
+  if (path11.dirname(resolvedDirectory) !== resolvedRoot || !path11.basename(resolvedDirectory).startsWith(DIRECTORY_PREFIX)) {
     throw new Error("refusing to clean an unverified task-attachment directory");
   }
   return resolvedDirectory;
 }
 async function createAttachmentDirectory(taskId, tempRoot) {
-  const root = path13.resolve(tempRoot);
+  const root = path11.resolve(tempRoot);
   await mkdir(root, { recursive: true });
-  const directory = await mkdtemp(path13.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
-  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID(), directory: path13.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
-  await writeFile(path13.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
+  const directory = await mkdtemp(path11.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
+  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID(), directory: path11.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
+  await writeFile(path11.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
   return { directory, marker, tempRoot: root };
 }
 async function cleanupGeneratedDirectory(state) {
   if (!state || state.cleaned) return;
   const directory = assertGeneratedDirectory(state.directory, state.tempRoot);
-  const marker = await readFile(path13.join(directory, MARKER_FILE), "utf8").catch(() => "");
+  const marker = await readFile(path11.join(directory, MARKER_FILE), "utf8").catch(() => "");
   if (marker !== state.marker) throw new Error("refusing to clean a task-attachment directory without its exact marker");
   await rm(directory, { recursive: true, force: true });
   state.cleaned = true;
@@ -5318,7 +5411,7 @@ async function sweepStaleTaskAttachmentDirectories({
   now = Date.now(),
   maxAgeMs = DEFAULT_STALE_AGE_MS
 } = {}) {
-  const root = path13.resolve(tempRoot);
+  const root = path11.resolve(tempRoot);
   if (!Number.isFinite(maxAgeMs) || maxAgeMs <= 0) throw new Error("stale attachment age must be positive");
   const entries = await readdir(root, { withFileTypes: true }).catch((error) => {
     if (error?.code === "ENOENT") return [];
@@ -5327,8 +5420,8 @@ async function sweepStaleTaskAttachmentDirectories({
   let removed = 0;
   for (const entry of entries) {
     if (!entry.isDirectory() || !entry.name.startsWith(DIRECTORY_PREFIX)) continue;
-    const directory = assertGeneratedDirectory(path13.join(root, entry.name), root);
-    const markerRaw = await readFile(path13.join(directory, MARKER_FILE), "utf8").catch(() => "");
+    const directory = assertGeneratedDirectory(path11.join(root, entry.name), root);
+    const markerRaw = await readFile(path11.join(directory, MARKER_FILE), "utf8").catch(() => "");
     const marker = parseOwnedMarker(markerRaw, entry.name);
     if (!marker) continue;
     const directoryStat = await stat(directory);
@@ -5371,10 +5464,10 @@ async function materializeTaskAttachments(client, task, { tempRoot = os2.tmpdir(
       const sha256 = createHash3("sha256").update(content).digest("hex");
       if (sha256 !== ref.sha256) throw new Error(`attachment ${ref.attachment_id} sha256 mismatch`);
       const name = sanitizeTaskAttachmentName(ref.name, index);
-      const filePath = path13.join(state.directory, name);
+      const filePath = path11.join(state.directory, name);
       await writeFile(filePath, content, { flag: "wx", mode: 384 });
       await chmod(filePath, 384);
-      files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256, path: path13.resolve(filePath) });
+      files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256, path: path11.resolve(filePath) });
     }
     return { directory: state.directory, files, manifestMarkdown: buildManifest(files), cleanup: () => cleanupGeneratedDirectory(state) };
   } catch (error) {
@@ -5438,9 +5531,9 @@ async function readSpool(spoolDir = SPOOL_DIR) {
   }
   return out;
 }
-async function readCloudMap(path18) {
+async function readCloudMap(path16) {
   try {
-    return JSON.parse(await readFile2(path18, "utf8"));
+    return JSON.parse(await readFile2(path16, "utf8"));
   } catch {
     return {};
   }
@@ -5583,13 +5676,13 @@ var init_rate_limit_resume_scheduler_core = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/rate-limit-resume-scheduler.mjs
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync4 } from "node:fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "node:fs";
 import { dirname as dirname4, join as join5, resolve } from "node:path";
 function log(msg) {
   console.log(`[rate-limit-scheduler ${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
 }
 function readQueue(queuePath) {
-  if (!existsSync5(queuePath)) return [];
+  if (!existsSync6(queuePath)) return [];
   const content = readFileSync4(queuePath, "utf-8");
   const lines = content.split("\n").filter((l) => l.trim());
   const entries = [];
@@ -5612,7 +5705,7 @@ function attemptsStorePath() {
 }
 function readAttemptsStore() {
   const p = attemptsStorePath();
-  if (!existsSync5(p)) return {};
+  if (!existsSync6(p)) return {};
   try {
     const parsed = JSON.parse(readFileSync4(p, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
@@ -6008,7 +6101,7 @@ var init_agent_availability = __esm({
 import { spawn as spawn4 } from "node:child_process";
 import fs6 from "node:fs";
 import os3 from "node:os";
-import path14 from "node:path";
+import path12 from "node:path";
 function readClaudeUsage({ homeDir = os3.homedir(), read: rawRead = readJson } = {}) {
   const read = (p) => {
     try {
@@ -6017,7 +6110,7 @@ function readClaudeUsage({ homeDir = os3.homedir(), read: rawRead = readJson } =
       return null;
     }
   };
-  const status = read(path14.join(homeDir, ".claude", "claude-usage.json"));
+  const status = read(path12.join(homeDir, ".claude", "claude-usage.json"));
   if (status && (status.seven_day || status.five_hour)) {
     const entry = {
       agent: "claude",
@@ -6026,7 +6119,7 @@ function readClaudeUsage({ homeDir = os3.homedir(), read: rawRead = readJson } =
     };
     if (entry.seven_day_used_pct !== null || entry.five_hour_used_pct !== null) return entry;
   }
-  const weekly = read(path14.join(homeDir, ".claude", "claude-weekly-usage.json"));
+  const weekly = read(path12.join(homeDir, ".claude", "claude-weekly-usage.json"));
   if (weekly) {
     const entry = {
       agent: "claude",
@@ -6764,9 +6857,9 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end();
       return;
     }
-    const path18 = String(req.url || "").split("?")[0];
+    const path16 = String(req.url || "").split("?")[0];
     res.setHeader("content-type", "application/json");
-    if (req.method === "GET" && path18 === "/status") {
+    if (req.method === "GET" && path16 === "/status") {
       let status;
       try {
         status = getStatus();
@@ -6777,7 +6870,7 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end(JSON.stringify({ ok: true, ...status }));
       return;
     }
-    if (req.method === "POST" && path18 === "/stop") {
+    if (req.method === "POST" && path16 === "/stop") {
       if (!isControlOriginAllowed(req.headers.origin, allowedOrigin) || !req.headers["x-vo-control"]) {
         res.statusCode = 403;
         res.end(JSON.stringify({ ok: false, error: "forbidden" }));
@@ -6936,8 +7029,8 @@ var init_effort_mode_config = __esm({
 
 // ../../scripts/virtual-office/model-registry.mjs
 import fs7 from "node:fs";
-import path15 from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import path13 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function uniqueModels(models = []) {
   return [...new Set(models.map((model) => String(model || "").trim()).filter(Boolean))];
 }
@@ -7059,7 +7152,7 @@ function readCache(cacheFile = DEFAULT_CACHE_FILE, nowMs = Date.now(), ttlMs = D
   }
 }
 function writeCache(cacheFile = DEFAULT_CACHE_FILE, payload) {
-  fs7.mkdirSync(path15.dirname(cacheFile), { recursive: true });
+  fs7.mkdirSync(path13.dirname(cacheFile), { recursive: true });
   fs7.writeFileSync(cacheFile, JSON.stringify(payload, null, 2));
 }
 async function fetchRegistryCatalog({
@@ -7117,10 +7210,10 @@ var __dirname, ROOT, DEFAULT_CACHE_DIR, DEFAULT_CACHE_FILE, DEFAULT_TTL_MS3, ANT
 var init_model_registry = __esm({
   "../../scripts/virtual-office/model-registry.mjs"() {
     "use strict";
-    __dirname = path15.dirname(fileURLToPath2(import.meta.url));
-    ROOT = path15.resolve(__dirname, "..", "..");
-    DEFAULT_CACHE_DIR = path15.join(ROOT, ".virtual-office-cache", "model-registry");
-    DEFAULT_CACHE_FILE = path15.join(DEFAULT_CACHE_DIR, "catalog.json");
+    __dirname = path13.dirname(fileURLToPath3(import.meta.url));
+    ROOT = path13.resolve(__dirname, "..", "..");
+    DEFAULT_CACHE_DIR = path13.join(ROOT, ".virtual-office-cache", "model-registry");
+    DEFAULT_CACHE_FILE = path13.join(DEFAULT_CACHE_DIR, "catalog.json");
     DEFAULT_TTL_MS3 = 60 * 60 * 1e3;
     ANTHROPIC_API_VERSION = "2023-06-01";
     FAMILY_DEFINITIONS = {
@@ -7321,10 +7414,18 @@ var init_model_router = __esm({
       }
     };
     AGENT_MODEL_COMPATIBILITY = {
-      claude: (model) => /^claude-/i.test(String(model || "")),
-      codex: (model) => /^(?:gpt-|o\d|codex)/i.test(String(model || "")),
-      cursor: () => true,
-      meta: (model) => /^muse-spark-/i.test(String(model || ""))
+      // SECURITY: these are ANCHORED AT BOTH ENDS on purpose. The old patterns were
+      // prefix-only, so `gpt-5 & <cmd>` and `claude-3 & <cmd>` passed the gate with
+      // the payload still attached and landed in the agent's argv.
+      claude: (model) => /^claude-[A-Za-z0-9._:@\[\]-]{0,79}$/i.test(String(model || "")),
+      codex: (model) => /^(?:gpt-|o\d|codex)[A-Za-z0-9._:@\[\]-]{0,79}$/i.test(String(model || "")),
+      // Defense in depth: `task.model` is control-plane-controlled and lands in the
+      // cursor-agent argv. `() => true` accepted ANY string, including cmd
+      // metacharacters — which was the second half of the shell:true RCE in
+      // cursor-runner. Restrict to the shape a model id actually has so a payload
+      // like `x & powershell -enc ...` is rejected before it reaches a spawn.
+      cursor: (model) => /^[A-Za-z0-9][A-Za-z0-9._:@\[\]-]{0,79}$/.test(String(model || "")),
+      meta: (model) => /^muse-spark-[A-Za-z0-9._:@\[\]-]{0,79}$/i.test(String(model || ""))
     };
   }
 });
@@ -7724,9 +7825,9 @@ function operatorTierToRung(tier, difficulty, thresholds) {
   if (tier === "best" && difficulty >= thresholds.rungBounds.R5) return "R5";
   return base;
 }
-function readCodexModelsCache({ path: path18 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync5 } = {}) {
+function readCodexModelsCache({ path: path16 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync5 } = {}) {
   try {
-    const parsed = JSON.parse(read(path18, "utf8"));
+    const parsed = JSON.parse(read(path16, "utf8"));
     return Array.isArray(parsed?.models) ? parsed : null;
   } catch {
     return null;
@@ -7909,14 +8010,14 @@ var init_role_cost_shadow = __esm({
 import { readFileSync as readFileSync6, appendFileSync as appendFileSync2, mkdirSync as mkdirSync5 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as join8, dirname as dirname5 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 function getAutoRouterMode(env2 = process.env) {
   const raw = String(env2.VO_CODE_RUNNER_AUTO_ROUTER || "").trim().toLowerCase();
   return MODES.has(raw) ? raw : "off";
 }
 function loadThresholds() {
   if (!cachedThresholds) {
-    const here = dirname5(fileURLToPath3(import.meta.url));
+    const here = dirname5(fileURLToPath4(import.meta.url));
     cachedThresholds = JSON.parse(readFileSync6(join8(here, "thresholds.json"), "utf8"));
   }
   return cachedThresholds;
@@ -7983,15 +8084,15 @@ function formatDecisionReason(decision, maxLen = 480) {
   const s = `[${decision.routerVersion}] ${decision.taskClass} d=${decision.difficulty} c=${decision.confidence} \u2192 ${decision.rung}/${decision.tier}${decision.effort ? ` effort=${decision.effort}` : ""} turns=${decision.maxTurns} $${decision.maxBudgetUsd}${decision.flags.length ? ` [${decision.flags.join(",")}]` : ""} :: ${decision.reasons.join("; ")}`;
   return s.length > maxLen ? `${s.slice(0, maxLen - 1)}\u2026` : s;
 }
-function appendDecisionFallback(decision, { path: path18 = DECISION_FALLBACK_PATH, append = appendFileSync2, mkdir: mkdir3 = mkdirSync5, task, thresholds, roleCostInputs } = {}) {
+function appendDecisionFallback(decision, { path: path16 = DECISION_FALLBACK_PATH, append = appendFileSync2, mkdir: mkdir3 = mkdirSync5, task, thresholds, roleCostInputs } = {}) {
   try {
-    mkdir3(dirname5(path18), { recursive: true });
-    append(path18, `${JSON.stringify(decision)}
+    mkdir3(dirname5(path16), { recursive: true });
+    append(path16, `${JSON.stringify(decision)}
 `, "utf8");
     if (isRouterDecision(decision)) {
       try {
         const records = buildShadowRecords({ decision, task, thresholds: thresholds || loadThresholds(), roleCostInputs });
-        for (const record of records) append(path18, `${JSON.stringify(record)}
+        for (const record of records) append(path16, `${JSON.stringify(record)}
 `, "utf8");
       } catch {
       }
@@ -8148,7 +8249,7 @@ function makeReconnectBackoff({
   jitter = 0.2,
   log: log3 = () => {
   },
-  random = Math.random
+  random = secureUnitRandom
 } = {}) {
   let consecutiveFailures = 0;
   return {
@@ -8208,6 +8309,7 @@ function installProcessSafetyNet({ log: log3 = () => {
 var init_reconnect_backoff = __esm({
   "../../scripts/virtual-office/code-runner/reconnect-backoff.mjs"() {
     "use strict";
+    init_secure_random();
   }
 });
 
@@ -8322,7 +8424,7 @@ var init_agent_process_env = __esm({
 // ../../scripts/virtual-office/code-runner/isolation-audit.mjs
 import fs8 from "node:fs";
 import fsp9 from "node:fs/promises";
-import path16 from "node:path";
+import path14 from "node:path";
 async function defaultRun(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, timeout: 6e4, ...options });
 }
@@ -8335,7 +8437,7 @@ async function canonicalRootForWorktree(worktreeDir, run) {
     "--path-format=absolute",
     "--git-common-dir"
   ])).trim();
-  const root = path16.dirname(commonDir);
+  const root = path14.dirname(commonDir);
   return samePath2(root, worktreeDir) ? null : root;
 }
 async function snapshot(root, run) {
@@ -8377,21 +8479,21 @@ async function changedPaths(root, run) {
 }
 async function quarantineCanonicalWrites({ baseline, worktreeDir, taskId, run, now }) {
   const paths = await changedPaths(baseline.root, run);
-  const quarantineDir = path16.join(
-    path16.dirname(worktreeDir),
+  const quarantineDir = path14.join(
+    path14.dirname(worktreeDir),
     ".canonical-recovery",
     `${String(taskId || "unknown").replace(/[^a-z0-9-]/gi, "-")}-${now().toISOString().replace(/[:.]/g, "-")}`
   );
   await fsp9.mkdir(quarantineDir, { recursive: true });
   const patch = await git2(run, baseline.root, ["diff", "--binary", "HEAD"], { raw: true });
-  await fsp9.writeFile(path16.join(quarantineDir, "tracked.patch"), patch, "utf8");
+  await fsp9.writeFile(path14.join(quarantineDir, "tracked.patch"), patch, "utf8");
   for (const relative of paths.untracked) {
-    const source = path16.join(baseline.root, relative);
-    const target = path16.join(quarantineDir, "untracked", relative);
-    await fsp9.mkdir(path16.dirname(target), { recursive: true });
+    const source = path14.join(baseline.root, relative);
+    const target = path14.join(quarantineDir, "untracked", relative);
+    await fsp9.mkdir(path14.dirname(target), { recursive: true });
     await fsp9.copyFile(source, target);
   }
-  await fsp9.writeFile(path16.join(quarantineDir, "manifest.json"), `${JSON.stringify({
+  await fsp9.writeFile(path14.join(quarantineDir, "manifest.json"), `${JSON.stringify({
     taskId,
     canonicalRoot: baseline.root,
     canonicalHead: baseline.head,
@@ -8413,8 +8515,8 @@ async function restoreExactCanonicalPaths(baseline, evidence, run) {
     ]);
   }
   for (const relative of evidence.untracked) {
-    const target = path16.resolve(baseline.root, relative);
-    const prefix = `${path16.resolve(baseline.root)}${path16.sep}`;
+    const target = path14.resolve(baseline.root, relative);
+    const prefix = `${path14.resolve(baseline.root)}${path14.sep}`;
     if (!target.startsWith(prefix) || !fs8.existsSync(target)) continue;
     await fsp9.rm(target, { force: true });
   }
@@ -8451,7 +8553,7 @@ var init_isolation_audit = __esm({
     init_process_runner2();
     splitZ2 = (value) => String(value || "").split("\0").map((item) => item.trim()).filter(Boolean);
     samePath2 = (left, right) => {
-      const [a, b] = [left, right].map((value) => path16.resolve(value));
+      const [a, b] = [left, right].map((value) => path14.resolve(value));
       return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
     };
   }
@@ -8460,7 +8562,7 @@ var init_isolation_audit = __esm({
 // ../../scripts/virtual-office/code-runner/recovery-ledger.mjs
 import fs9 from "node:fs";
 import fsp10 from "node:fs/promises";
-import path17 from "node:path";
+import path15 from "node:path";
 function recoveryTaskId(prompt) {
   const match = String(prompt || "").match(/VO_RECOVERY_FROM_CODE_TASK:\s*([0-9a-f-]{36})/i);
   return match ? match[1].toLowerCase() : null;
@@ -8474,10 +8576,10 @@ function cloneLeaf(repo) {
 function recoveryLedgerCandidates(repo, clonesRoot2) {
   const leaf = cloneLeaf(repo);
   if (!leaf || !clonesRoot2) return [];
-  const canonical = path17.join(clonesRoot2, leaf);
+  const canonical = path15.join(clonesRoot2, leaf);
   return [
-    path17.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
-    path17.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
+    path15.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
+    path15.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
   ];
 }
 async function readLedger(file, readFile4) {
@@ -8599,6 +8701,9 @@ var init_recovery_ledger = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/no-changes-terminal-status.mjs
+function defaultRunCommand3(cmd, args, cwd, opts = {}) {
+  return runProcess2(cmd, args, { cwd, ...opts });
+}
 function explicitTaskOutcome(summary) {
   const matches = [...String(summary || "").matchAll(/ALGOSUITE_TASK_OUTCOME\s*:\s*(NO_CHANGES|BLOCKED|FAILED)\b/gi)];
   return matches.at(-1)?.[1]?.toUpperCase() || "";
@@ -8636,16 +8741,78 @@ function decideNoChangesTerminalStatus({ partial, run = {}, maxTurns } = {}) {
       result: "inconclusive_max_turns"
     };
   }
+  const cause = String(run.summary || "").trim();
   return {
     status: "failed",
-    message: "agent made no file changes",
-    result: "no_changes"
+    message: cause ? `agent made no file changes \u2014 ${cause.slice(0, 200)}` : "agent made no file changes",
+    result: (cause || "no_changes").slice(0, RESULT_LIMIT)
   };
 }
+async function closeSupersededSourceOnNoChanges({
+  task,
+  run,
+  worktreeDir,
+  githubToken,
+  log: log3 = () => {
+  },
+  runCommand = defaultRunCommand3
+} = {}) {
+  const prNumber = supersededSourcePrNumber(task?.prompt);
+  if (!Number.isInteger(prNumber) || prNumber <= 0) return false;
+  const env2 = githubToken ? installationTokenEnv(githubToken) : void 0;
+  try {
+    const raw = await runCommand("gh", ["pr", "view", String(prNumber), "--json", "state"], worktreeDir, { env: env2, timeout: 6e4 });
+    if (JSON.parse(raw || "{}")?.state !== "OPEN") return false;
+    const evidence = String(run?.summary || "verified: no re-implementation needed").replace(/\s+/g, " ").slice(0, 600);
+    await runCommand(
+      "gh",
+      ["pr", "close", String(prNumber), "--comment", `Closing: AlgoHQ repair verified this PR's intent is already satisfied on current main \u2014 no re-implementation needed. Evidence: ${evidence}`],
+      worktreeDir,
+      { env: env2, timeout: 6e4 }
+    );
+    log3(`no-changes: closed superseded source PR #${prNumber} (intent already on main)`);
+    return true;
+  } catch (err) {
+    log3(`no-changes: close of superseded source PR #${prNumber} failed (left open): ${String(err?.message || err).slice(0, 200)}`);
+    return false;
+  }
+}
+async function finalizeNoChangesOutcome({
+  client,
+  id,
+  task,
+  partial,
+  run = {},
+  maxTurns,
+  worktreeDir,
+  githubToken,
+  safeProgress: safeProgress2,
+  log: log3 = () => {
+  },
+  runCommand = defaultRunCommand3
+} = {}) {
+  const numOrUndef2 = (x) => typeof x === "number" ? x : void 0;
+  const terminal = decideNoChangesTerminalStatus({ partial, run, maxTurns });
+  await safeProgress2(client, id, {
+    ...terminal,
+    cost_usd: numOrUndef2(run.costUsd),
+    num_turns: numOrUndef2(run.numTurns)
+  });
+  if (terminal.status === "no_changes_needed") {
+    log3(`task ${id}: agent completed successfully with no changes (already fixed)`);
+    await closeSupersededSourceOnNoChanges({ task, run, worktreeDir, githubToken, log: log3, runCommand });
+  } else if (!partial) {
+    log3(`task ${id}: agent reported a blocker with no changes; preserving failure honestly`);
+  }
+  return terminal;
+}
 var RESULT_LIMIT;
 var init_no_changes_terminal_status = __esm({
   "../../scripts/virtual-office/code-runner/no-changes-terminal-status.mjs"() {
     "use strict";
+    init_process_runner2();
+    init_publish();
+    init_superseded_pr_source();
     RESULT_LIMIT = 2e3;
   }
 });
@@ -8657,7 +8824,7 @@ __export(code_runner_daemon_exports, {
 });
 import os4 from "node:os";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 function log2(msg) {
   console.log(`[code-runner ${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
 }
@@ -8801,14 +8968,18 @@ async function processOneTask(client, task, cfg) {
       log2(`task ${id}: dropped ${scratch.length} scratch file(s): ${scratch.join(", ")}`);
     }
     if (files.length === 0) {
-      const terminal = decideNoChangesTerminalStatus({ partial, run, maxTurns: effectiveMaxTurns });
-      await safeProgress(client, id, {
-        ...terminal,
-        cost_usd: numOrUndef(run.costUsd),
-        num_turns: numOrUndef(run.numTurns)
+      await finalizeNoChangesOutcome({
+        client,
+        id,
+        task,
+        partial,
+        run,
+        maxTurns: effectiveMaxTurns,
+        worktreeDir: wt.worktreeDir,
+        githubToken,
+        safeProgress,
+        log: log2
       });
-      if (terminal.status === "no_changes_needed") log2(`task ${id}: agent completed successfully with no changes (already fixed)`);
-      else if (!partial) log2(`task ${id}: agent reported a blocker with no changes; preserving failure honestly`);
       return;
     }
     const fresh = await client.getTask(id).catch(() => null);
@@ -9015,7 +9186,7 @@ var init_code_runner_daemon = __esm({
     sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
     numOrUndef = (x) => typeof x === "number" ? x : void 0;
     safeProgress = makeSafeProgress(log2);
-    invokedDirectly = process.argv[1] && fileURLToPath4(import.meta.url) === process.argv[1] && // Bundle-safe: self-start only when THIS file is the real entry (not inlined into vo-mcp's runner-cli.js ⇒ double-claim).
+    invokedDirectly = process.argv[1] && fileURLToPath5(import.meta.url) === process.argv[1] && // Bundle-safe: self-start only when THIS file is the real entry (not inlined into vo-mcp's runner-cli.js ⇒ double-claim).
     import.meta.url.endsWith("code-runner-daemon.mjs");
     if (invokedDirectly) {
       const once2 = process.argv.includes("--once");