@algosuite/vo-mcp 0.2.0-beta.33 → 0.2.0-beta.35

package/dist/runner-cli.js

@@ -2582,11 +2582,6 @@ var init_control_plane_auth_stub = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/control-plane-client.mjs
-var control_plane_client_exports = {};
-__export(control_plane_client_exports, {
-  ClaimAuthorityChangedError: () => ClaimAuthorityChangedError,
-  createControlPlaneClient: () => createControlPlaneClient
-});
 async function resolveBearer(env2) {
   const adminToken = env2.VO_CONTROL_PLANE_ADMIN_TOKEN;
   if (adminToken) return adminToken;
@@ -2619,11 +2614,11 @@ function createControlPlaneClient({
   const resolvedBaseUrl = baseUrl ?? env2.VO_CONTROL_PLANE_URL ?? "";
   if (!resolvedBaseUrl) throw new Error("VO_CONTROL_PLANE_URL is required for the code-runner daemon");
   const root = resolvedBaseUrl.replace(/\/+$/, "");
-  async function req(method, path23, body, { timeoutMs } = {}) {
+  async function req(method, path22, body, { timeoutMs } = {}) {
     const bearer = await resolveBearer(env2);
     const controller = timeoutMs ? new AbortController() : null;
     let timeoutId;
-    const request = Promise.resolve(fetchImpl(`${root}${path23}`, {
+    const request = Promise.resolve(fetchImpl(`${root}${path22}`, {
       method,
       headers: {
         "content-type": "application/json",
@@ -2636,7 +2631,7 @@ function createControlPlaneClient({
     const timeout = new Promise((_, reject) => {
       timeoutId = setTimeout(() => {
         controller.abort();
-        reject(new Error(`control-plane ${path23} timed out after ${timeoutMs}ms`));
+        reject(new Error(`control-plane ${path22} timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
     try {
@@ -2645,7 +2640,7 @@ function createControlPlaneClient({
       clearTimeout(timeoutId);
     }
   }
-  const taskReq = (method, path23, body, options = {}) => req(method, path23, body, { timeoutMs: taskRequestTimeoutMs, ...options });
+  const taskReq = (method, path22, body, options = {}) => req(method, path22, body, { timeoutMs: taskRequestTimeoutMs, ...options });
   return {
     ...makeAutonomousDispatchAdmissionClient(
       req,
@@ -2768,8 +2763,8 @@ function createControlPlaneClient({
       return listAllPrOpenedTasks(taskReq);
     },
     async downloadTaskAttachment(taskId, attachmentId) {
-      const path23 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
-      const res = await taskReq("GET", path23);
+      const path22 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
+      const res = await taskReq("GET", path22);
       if (res.status === 401) cachedFirebaseToken = null;
       if (!res.ok) throw new Error(`attachment download failed: HTTP ${res.status}`);
       return Buffer.from(await res.arrayBuffer());
@@ -5981,14 +5976,14 @@ function parsePorcelainZ(out) {
   for (let i = 0; i < tokens.length; i += 1) {
     const token2 = tokens[i];
     if (!token2) continue;
-    const path23 = token2.slice(3);
-    if (path23) files.push(path23);
+    const path22 = token2.slice(3);
+    if (path22) files.push(path22);
     if (token2[0] === "R" || token2[0] === "C") i += 1;
   }
   return files;
 }
-function isAgentScratch(path23) {
-  const normalized = String(path23 || "");
+function isAgentScratch(path22) {
+  const normalized = String(path22 || "");
   return SCRATCH_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 var SCRATCH_PATTERNS;
@@ -6055,6 +6050,15 @@ var init_publish = __esm({
   }
 });
 
+// ../../scripts/virtual-office/test-gen/marker.mjs
+var TEST_GEN_MARKER;
+var init_marker = __esm({
+  "../../scripts/virtual-office/test-gen/marker.mjs"() {
+    "use strict";
+    TEST_GEN_MARKER = "[VO-TEST-GEN]";
+  }
+});
+
 // ../../scripts/virtual-office/test-gen/auto-tier.mjs
 function lower(s) {
   return typeof s === "string" ? s.toLowerCase() : "";
@@ -6128,146 +6132,6 @@ var init_auto_tier = __esm({
   }
 });
 
-// ../../scripts/virtual-office/test-gen/dispatch.mjs
-import { spawnSync as spawnSync10 } from "node:child_process";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
-import path14 from "node:path";
-function buildGenerationPrompt({ contract = {}, tier }) {
-  const label = tierLabel(tier);
-  const target = contract.callable ? `the \`${contract.callable}\` callable` : contract.route ? `the \`${contract.route}\` route` : contract.feature_name || "the feature";
-  return [
-    `Write a ${label} test for ${target} in product "${contract.product || "unknown"}".`,
-    contract.source_file ? `Source: ${contract.source_file}.` : "",
-    contract.expected_behavior ? `Expected behavior: ${contract.expected_behavior}.` : "",
-    "",
-    `TIER REQUIREMENT \u2014 ${TIER_GUIDANCE[tier] || TIER_GUIDANCE[2]}`,
-    "",
-    "Follow the AlgoSuite test-honesty standard: NO fake-green (no bare toBeTruthy, no broad",
-    "try/catch that swallows failures, no treating INVALID_ARGUMENT / empty / null / SKIP as a",
-    "pass). Use a real fixture (smoke@algosuite.ai) and real data shapes.",
-    "",
-    "After writing the test, it will be GATED server-side: deterministic ratchets, then",
-    "multi-model consensus that it proves the behavior with VERIFIED-CORRECT expected values.",
-    "A test that does not pass BOTH gates will NOT ship \u2014 so make the assertions real and the",
-    "expected values known-correct. Leave the test file UNCOMMITTED; the runner opens the PR."
-  ].filter((l) => l !== "").join("\n");
-}
-function planTestGenDispatch({ contract = {} }) {
-  const { tier, rationale } = classifyTier(contract);
-  return {
-    contract,
-    tier,
-    tier_label: tierLabel(tier),
-    tier_rationale: rationale,
-    generation_prompt: buildGenerationPrompt({ contract, tier })
-  };
-}
-function buildTestGenTaskPrompt(dispatch = {}) {
-  const contractJson = JSON.stringify(dispatch.contract ?? {});
-  return `${TEST_GEN_MARKER} ${contractJson}
-
-${dispatch.generation_prompt ?? ""}`;
-}
-function pickNextTarget({ gaps = [] }) {
-  if (!Array.isArray(gaps) || gaps.length === 0) return null;
-  const ranked = [...gaps].sort((a, b) => {
-    const al = LEGAL.has(String(a.product)) ? 0 : 1;
-    const bl = LEGAL.has(String(b.product)) ? 0 : 1;
-    return al - bl;
-  });
-  return ranked[0];
-}
-function resolveRepo(argv, env2) {
-  const repoArg = argv.indexOf("--repo");
-  if (repoArg >= 0 && argv[repoArg + 1]) return argv[repoArg + 1];
-  if (env2.VO_TEST_GEN_REPO) return env2.VO_TEST_GEN_REPO;
-  const remote = spawnSync10("git", ["remote", "get-url", "origin"], { encoding: "utf8" });
-  if (remote.status === 0) {
-    const m = String(remote.stdout).trim().match(/[:/]([^/]+\/[^/]+?)(?:\.git)?$/);
-    if (m) return m[1];
-  }
-  return null;
-}
-async function main(argv = process.argv.slice(2)) {
-  const countArg = argv.indexOf("--count");
-  const count3 = countArg >= 0 ? Math.max(1, Number(argv[countArg + 1]) || 1) : 1;
-  const enqueue = argv.includes("--enqueue");
-  const here = path14.dirname(fileURLToPath3(import.meta.url));
-  const scan = spawnSync10("node", [path14.join(here, "coverage-scan.mjs"), "--limit", String(count3 * 8)], {
-    encoding: "utf8",
-    maxBuffer: 64 * 1024 * 1024
-  });
-  if (scan.status !== 0) {
-    console.error(`[dispatch] coverage-scan failed: ${scan.stderr || scan.stdout}`);
-    process.exit(1);
-  }
-  let gaps = [];
-  try {
-    gaps = JSON.parse(scan.stdout).gaps || [];
-  } catch (err) {
-    console.error(`[dispatch] could not parse scan output: ${err.message}`);
-    process.exit(1);
-  }
-  const dispatches = [];
-  const seen = /* @__PURE__ */ new Set();
-  let pool = gaps;
-  while (dispatches.length < count3 && pool.length > 0) {
-    const target = pickNextTarget({ gaps: pool });
-    if (!target) break;
-    const key = `${target.product}:${target.callable}`;
-    if (!seen.has(key)) {
-      seen.add(key);
-      dispatches.push(planTestGenDispatch({ contract: target }));
-    }
-    pool = pool.filter((g) => `${g.product}:${g.callable}` !== key);
-  }
-  if (!enqueue) {
-    console.log(JSON.stringify({ requested: count3, emitted: dispatches.length, dispatches }, null, 2));
-    return;
-  }
-  const repo = resolveRepo(argv, process.env);
-  if (!repo) {
-    console.error("[dispatch] --enqueue needs a repo: pass --repo owner/name or set VO_TEST_GEN_REPO (could not derive from git origin)");
-    process.exit(1);
-  }
-  const { createControlPlaneClient: createControlPlaneClient2 } = await Promise.resolve().then(() => (init_control_plane_client(), control_plane_client_exports));
-  const client = createControlPlaneClient2({ env: process.env });
-  const enqueued = [];
-  for (const d of dispatches) {
-    const task = await client.enqueueCodeTask({
-      repo,
-      prompt: buildTestGenTaskPrompt(d),
-      max_turns: 40
-    });
-    const taskId = task && task.code_task_id ? task.code_task_id : "(unknown)";
-    enqueued.push({ task_id: taskId, product: d.contract.product, callable: d.contract.callable, tier: d.tier_label });
-    console.error(`[dispatch] enqueued ${d.tier_label} test-gen for ${d.contract.product}:${d.contract.callable} \u2192 task ${taskId}`);
-  }
-  console.log(JSON.stringify({ requested: count3, enqueued: enqueued.length, repo, tasks: enqueued }, null, 2));
-}
-var TEST_GEN_MARKER, TIER_GUIDANCE, LEGAL, invokedDirectly;
-var init_dispatch = __esm({
-  "../../scripts/virtual-office/test-gen/dispatch.mjs"() {
-    "use strict";
-    init_auto_tier();
-    TEST_GEN_MARKER = "[VO-TEST-GEN]";
-    TIER_GUIDANCE = {
-      1: "Surface/navigation smoke: assert the surface renders and the key controls are present. No backend effect needed.",
-      2: "E2E with VERIFIED RESULTS: drive the real user/callable workflow, then READ BACK the produced artifact and assert KNOWN-CORRECT expected values (not just a 200 / truthiness).",
-      3: "Real-time monitor / sentinel: drive the workflow AND verify the state transitions + safety rails (no money moved / graded / admin action without the guard). Assert the post-conditions, not just the response.",
-      4: "Source-grounded governed-fact: assert expected values that are GROUNDED in the cited authoritative source (the contract's authoritative_source_url). The fixture and the expected number/string must trace to that source."
-    };
-    LEGAL = /* @__PURE__ */ new Set(["algotax", "algolaw", "algoteach", "algolegal"]);
-    invokedDirectly = process.argv[1] && fileURLToPath3(import.meta.url) === path14.resolve(process.argv[1]);
-    if (invokedDirectly) {
-      main().catch((err) => {
-        console.error(`[dispatch] ${err.message}`);
-        process.exit(1);
-      });
-    }
-  }
-});
-
 // ../../scripts/virtual-office/test-gen/executor.mjs
 function consensusQuestion(tier) {
   const tierAsk = tier >= 4 ? " For this governed-fact (Tier 4) test, the expected values MUST be grounded in the cited authoritative source." : tier >= 3 ? " For this safety-critical (Tier 3) test, it must verify state transitions and the safety rails, not just a 200." : "";
@@ -6374,7 +6238,7 @@ var init_executor = __esm({
 
 // ../../scripts/virtual-office/code-runner/test-gen-gate.mjs
 import fs7 from "node:fs";
-import path15 from "node:path";
+import path14 from "node:path";
 async function postFailed(client, id, message, result) {
   try {
     await client.postProgress(id, {
@@ -6410,7 +6274,7 @@ async function gateTestGenTaskOrFail({ client, id, task, files, worktreeDir, env
   }
   let testSource = "";
   try {
-    testSource = fs7.readFileSync(path15.join(worktreeDir, testFile), "utf8");
+    testSource = fs7.readFileSync(path14.join(worktreeDir, testFile), "utf8");
   } catch (err) {
     await postFailed(client, id, `could not read generated test ${testFile}: ${err.message}`, "gate_test_unreadable");
     return true;
@@ -6451,7 +6315,7 @@ var TEST_FILE_RE;
 var init_test_gen_gate = __esm({
   "../../scripts/virtual-office/code-runner/test-gen-gate.mjs"() {
     "use strict";
-    init_dispatch();
+    init_marker();
     init_executor();
     TEST_FILE_RE = /\.(test|spec)\.(ts|tsx|mjs|js)$/;
   }
@@ -6460,7 +6324,7 @@ var init_test_gen_gate = __esm({
 // ../../scripts/virtual-office/code-runner/completion-gate.mjs
 import { execFile } from "node:child_process";
 import fs8 from "node:fs";
-import path16 from "node:path";
+import path15 from "node:path";
 function resolveCompletionGate(task) {
   const raw = task?.completion_gate;
   if (raw === void 0 || raw === null) return null;
@@ -6498,14 +6362,14 @@ function workspaceFingerprint(worktreeDir, execFileImpl = execFile) {
 }
 function readState(worktreeDir) {
   try {
-    return JSON.parse(fs8.readFileSync(path16.join(worktreeDir, COMPLETION_GATE_STATE_FILE), "utf8"));
+    return JSON.parse(fs8.readFileSync(path15.join(worktreeDir, COMPLETION_GATE_STATE_FILE), "utf8"));
   } catch {
     return null;
   }
 }
 function writeState(worktreeDir, state) {
   try {
-    fs8.writeFileSync(path16.join(worktreeDir, COMPLETION_GATE_STATE_FILE), `${JSON.stringify(state)}
+    fs8.writeFileSync(path15.join(worktreeDir, COMPLETION_GATE_STATE_FILE), `${JSON.stringify(state)}
 `, "utf8");
   } catch {
   }
@@ -7083,7 +6947,7 @@ var init_publish_async = __esm({
 // ../../scripts/virtual-office/code-runner/skill-catalog.mjs
 import { readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "node:fs";
 import { dirname as dirname3, join as join4 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function parseFrontmatterNameDescription(raw) {
   const text = String(raw).replace(/\r\n/g, "\n");
   if (!text.startsWith("---\n")) return null;
@@ -7102,7 +6966,7 @@ function parseFrontmatterNameDescription(raw) {
   return name && description ? { name, description } : null;
 }
 function resolveDefaultRepoRoot() {
-  const starts = [dirname3(fileURLToPath4(import.meta.url)), process.cwd()];
+  const starts = [dirname3(fileURLToPath3(import.meta.url)), process.cwd()];
   for (const start of starts) {
     let dir = start;
     for (let i = 0; i < 8; i += 1) {
@@ -7358,7 +7222,7 @@ var init_task_prompt = __esm({
 import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
 import { chmod, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import os2 from "node:os";
-import path17 from "node:path";
+import path16 from "node:path";
 function safeTaskToken(taskId) {
   return String(taskId || "task").replace(/[^0-9A-Za-z_-]/gu, "_").slice(0, 48) || "task";
 }
@@ -7368,25 +7232,25 @@ function sanitizeTaskAttachmentName(name, index = 0) {
   return `${String(index + 1).padStart(2, "0")}-${normalized}`;
 }
 function assertGeneratedDirectory(directory, tempRoot) {
-  const resolvedDirectory = path17.resolve(directory);
-  const resolvedRoot = path17.resolve(tempRoot);
-  if (path17.dirname(resolvedDirectory) !== resolvedRoot || !path17.basename(resolvedDirectory).startsWith(DIRECTORY_PREFIX)) {
+  const resolvedDirectory = path16.resolve(directory);
+  const resolvedRoot = path16.resolve(tempRoot);
+  if (path16.dirname(resolvedDirectory) !== resolvedRoot || !path16.basename(resolvedDirectory).startsWith(DIRECTORY_PREFIX)) {
     throw new Error("refusing to clean an unverified task-attachment directory");
   }
   return resolvedDirectory;
 }
 async function createAttachmentDirectory(taskId, tempRoot) {
-  const root = path17.resolve(tempRoot);
+  const root = path16.resolve(tempRoot);
   await mkdir(root, { recursive: true });
-  const directory = await mkdtemp(path17.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
-  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID2(), directory: path17.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
-  await writeFile(path17.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
+  const directory = await mkdtemp(path16.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
+  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID2(), directory: path16.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
+  await writeFile(path16.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
   return { directory, marker, tempRoot: root };
 }
 async function cleanupGeneratedDirectory(state) {
   if (!state || state.cleaned) return;
   const directory = assertGeneratedDirectory(state.directory, state.tempRoot);
-  const marker = await readFile(path17.join(directory, MARKER_FILE), "utf8").catch(() => "");
+  const marker = await readFile(path16.join(directory, MARKER_FILE), "utf8").catch(() => "");
   if (marker !== state.marker) throw new Error("refusing to clean a task-attachment directory without its exact marker");
   await rm(directory, { recursive: true, force: true });
   state.cleaned = true;
@@ -7405,7 +7269,7 @@ async function sweepStaleTaskAttachmentDirectories({
   now = Date.now(),
   maxAgeMs = DEFAULT_STALE_AGE_MS
 } = {}) {
-  const root = path17.resolve(tempRoot);
+  const root = path16.resolve(tempRoot);
   if (!Number.isFinite(maxAgeMs) || maxAgeMs <= 0) throw new Error("stale attachment age must be positive");
   const entries = await readdir(root, { withFileTypes: true }).catch((error) => {
     if (error?.code === "ENOENT") return [];
@@ -7414,8 +7278,8 @@ async function sweepStaleTaskAttachmentDirectories({
   let removed = 0;
   for (const entry of entries) {
     if (!entry.isDirectory() || !entry.name.startsWith(DIRECTORY_PREFIX)) continue;
-    const directory = assertGeneratedDirectory(path17.join(root, entry.name), root);
-    const markerRaw = await readFile(path17.join(directory, MARKER_FILE), "utf8").catch(() => "");
+    const directory = assertGeneratedDirectory(path16.join(root, entry.name), root);
+    const markerRaw = await readFile(path16.join(directory, MARKER_FILE), "utf8").catch(() => "");
     const marker = parseOwnedMarker(markerRaw, entry.name);
     if (!marker) continue;
     const directoryStat = await stat(directory);
@@ -7458,10 +7322,10 @@ async function materializeTaskAttachments(client, task, { tempRoot = os2.tmpdir(
       const sha256 = createHash3("sha256").update(content).digest("hex");
       if (sha256 !== ref.sha256) throw new Error(`attachment ${ref.attachment_id} sha256 mismatch`);
       const name = sanitizeTaskAttachmentName(ref.name, index);
-      const filePath = path17.join(state.directory, name);
+      const filePath = path16.join(state.directory, name);
       await writeFile(filePath, content, { flag: "wx", mode: 384 });
       await chmod(filePath, 384);
-      files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256, path: path17.resolve(filePath) });
+      files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256, path: path16.resolve(filePath) });
     }
     return { directory: state.directory, files, manifestMarkdown: buildManifest(files), cleanup: () => cleanupGeneratedDirectory(state) };
   } catch (error) {
@@ -7525,9 +7389,9 @@ async function readSpool(spoolDir = SPOOL_DIR) {
   }
   return out;
 }
-async function readCloudMap(path23) {
+async function readCloudMap(path22) {
   try {
-    return JSON.parse(await readFile2(path23, "utf8"));
+    return JSON.parse(await readFile2(path22, "utf8"));
   } catch {
     return {};
   }
@@ -7817,6 +7681,10 @@ function makeLoopTicks({
     applyRemoteConfig: () => false,
     heartbeatFields: () => ({})
   },
+  // Host version awareness: reads `update_status` off the heartbeat ACK and logs
+  // ONE line per drift change (daemon-update-status.mjs). No-op default keeps
+  // old callers working; absent update_status reads as unknown, never current.
+  updateStatusTracker = { applyHeartbeatResponse: () => false },
   // Cached agent-availability provider (agent-availability.mjs); returns null
   // until the first probe completes — the heartbeat simply omits the field.
   getAgentAvailability = () => null,
@@ -7857,6 +7725,7 @@ function makeLoopTicks({
         request.then((response) => {
           capacityController.applyCapacity(response?.capacity, nextPayload.operatorId);
           localModelController.applyRemoteConfig(response?.local_model, nextPayload.operatorId);
+          updateStatusTracker.applyHeartbeatResponse(response);
         }).catch((e) => log2(`heartbeat failed: ${e.message}`)).finally(() => {
           for (const done of waiters) done();
           if (state.pending) {
@@ -8046,7 +7915,7 @@ var init_runner_capacity = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/agent-auth-probe-process.mjs
-import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 async function probeAgentInChild(agent, timeoutMs) {
   const stdout = await runProcess2(process.execPath, [probeCli, agent], {
     timeout: timeoutMs,
@@ -8059,7 +7928,7 @@ var init_agent_auth_probe_process = __esm({
   "../../scripts/virtual-office/code-runner/agent-auth-probe-process.mjs"() {
     "use strict";
     init_process_runner2();
-    probeCli = fileURLToPath5(new URL("./agent-auth-probe-cli.mjs", import.meta.url));
+    probeCli = fileURLToPath4(new URL("./agent-auth-probe-cli.mjs", import.meta.url));
   }
 });
 
@@ -8360,7 +8229,7 @@ var init_shared = __esm({
 // ../../scripts/virtual-office/code-runner/account-usage/claude.mjs
 import fs10 from "node:fs";
 import os3 from "node:os";
-import path18 from "node:path";
+import path17 from "node:path";
 function fileCaptureTime(filePath, explicit, statFn) {
   if (typeof explicit === "string" && explicit) return explicit;
   try {
@@ -8374,7 +8243,7 @@ function usageBaseUrl(env2 = process.env) {
   return String(raw).replace(/\/+$/, "");
 }
 function readOAuthToken({ homeDir = os3.homedir(), read = readJson, now = Date.now() } = {}) {
-  const creds = read(path18.join(homeDir, ".claude", ".credentials.json"));
+  const creds = read(path17.join(homeDir, ".claude", ".credentials.json"));
   const oauth = creds && typeof creds === "object" ? creds.claudeAiOauth : null;
   if (!oauth || typeof oauth !== "object") return null;
   const token2 = typeof oauth.accessToken === "string" ? oauth.accessToken.trim() : "";
@@ -8384,7 +8253,7 @@ function readOAuthToken({ homeDir = os3.homedir(), read = readJson, now = Date.n
   return token2;
 }
 function readAccountId({ homeDir = os3.homedir(), read = readJson } = {}) {
-  const cfg = read(path18.join(homeDir, ".claude.json"));
+  const cfg = read(path17.join(homeDir, ".claude.json"));
   const account = cfg && typeof cfg === "object" ? cfg.oauthAccount : null;
   return account && typeof account.accountUuid === "string" ? account.accountUuid : null;
 }
@@ -8494,7 +8363,7 @@ function readClaudeFileUsage({
     if (age === null || age > MAX_FILE_AGE_MS) return null;
     return row;
   };
-  const statusPath = path18.join(homeDir, ".claude", "claude-usage.json");
+  const statusPath = path17.join(homeDir, ".claude", "claude-usage.json");
   const status = read(statusPath);
   if (status && (status.seven_day || status.five_hour)) {
     const row = fresh(makeUsageRow({
@@ -8509,7 +8378,7 @@ function readClaudeFileUsage({
     }));
     if (row) return row;
   }
-  const weeklyPath = path18.join(homeDir, ".claude", "claude-weekly-usage.json");
+  const weeklyPath = path17.join(homeDir, ".claude", "claude-weekly-usage.json");
   const weekly = read(weeklyPath);
   if (weekly) {
     const row = fresh(makeUsageRow({
@@ -9785,9 +9654,9 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end();
       return;
     }
-    const path23 = String(req.url || "").split("?")[0];
+    const path22 = String(req.url || "").split("?")[0];
     res.setHeader("content-type", "application/json");
-    if (req.method === "GET" && path23 === "/status") {
+    if (req.method === "GET" && path22 === "/status") {
       let status;
       try {
         status = getStatus();
@@ -9798,7 +9667,7 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end(JSON.stringify({ ok: true, ...status }));
       return;
     }
-    if (req.method === "POST" && path23 === "/stop") {
+    if (req.method === "POST" && path22 === "/stop") {
       if (!isControlOriginAllowed(req.headers.origin, allowedOrigin) || !req.headers["x-vo-control"]) {
         res.statusCode = 403;
         res.end(JSON.stringify({ ok: false, error: "forbidden" }));
@@ -9859,7 +9728,7 @@ function startControlServer({ port, getStatus, requestStop, allowedOrigin, log:
   return server;
 }
 function startDaemonControl({ cfg, runnerInstanceId, requestStop, getActiveCount, isRunning, startedAt, log: log2 = () => {
-}, onDuplicate = null }) {
+}, onDuplicate = null, getUpdateStatus = () => null }) {
   if (!cfg.controlEnabled) return null;
   return startControlServer({
     port: cfg.controlPort,
@@ -9876,7 +9745,9 @@ function startDaemonControl({ cfg, runnerInstanceId, requestStop, getActiveCount
       watchEnabled: cfg.watchEnabled,
       activeTasks: getActiveCount(),
       startedAt: new Date(startedAt).toISOString(),
-      uptimeSec: Math.round((Date.now() - startedAt) / 1e3)
+      uptimeSec: Math.round((Date.now() - startedAt) / 1e3),
+      // Host version awareness — the app + `runner --status` read drift from here.
+      updateStatus: getUpdateStatus()
     }),
     log: log2
   });
@@ -9964,22 +9835,22 @@ var init_effort_mode_config = __esm({
 import { randomUUID as randomUUID5 } from "node:crypto";
 import fs11 from "node:fs";
 import os4 from "node:os";
-import path19 from "node:path";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import path18 from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 function userCacheRoot() {
   try {
     const home = os4.homedir();
-    if (home) return path19.join(home, ".claude");
+    if (home) return path18.join(home, ".claude");
   } catch {
   }
-  return path19.join(os4.tmpdir(), `vo-model-registry-${randomUUID5()}`);
+  return path18.join(os4.tmpdir(), `vo-model-registry-${randomUUID5()}`);
 }
 function resolveCacheBaseDir(env2 = process.env, moduleDir = __dirname) {
   if (env2.VO_MODEL_REGISTRY_CACHE_DIR) return env2.VO_MODEL_REGISTRY_CACHE_DIR;
   if (env2.VO_RUNNER_RUNTIME_ROOT) return env2.VO_RUNNER_RUNTIME_ROOT;
-  const segments = moduleDir.split(path19.sep);
+  const segments = moduleDir.split(path18.sep);
   const isRepoCheckout = segments.at(-1) === "virtual-office" && segments.at(-2) === "scripts";
-  return isRepoCheckout ? path19.resolve(moduleDir, "..", "..") : userCacheRoot();
+  return isRepoCheckout ? path18.resolve(moduleDir, "..", "..") : userCacheRoot();
 }
 function uniqueModels(models = []) {
   return [...new Set(models.map((model) => String(model || "").trim()).filter(Boolean))];
@@ -10102,7 +9973,7 @@ function readCache(cacheFile = DEFAULT_CACHE_FILE, nowMs = Date.now(), ttlMs = D
   }
 }
 function writeCache(cacheFile = DEFAULT_CACHE_FILE, payload) {
-  fs11.mkdirSync(path19.dirname(cacheFile), { recursive: true });
+  fs11.mkdirSync(path18.dirname(cacheFile), { recursive: true });
   fs11.writeFileSync(cacheFile, JSON.stringify(payload, null, 2));
 }
 async function fetchRegistryCatalog({
@@ -10160,13 +10031,13 @@ var __dirname, DEFAULT_CACHE_DIR, DEFAULT_CACHE_FILE, DEFAULT_TTL_MS3, ANTHROPIC
 var init_model_registry = __esm({
   "../../scripts/virtual-office/model-registry.mjs"() {
     "use strict";
-    __dirname = path19.dirname(fileURLToPath6(import.meta.url));
-    DEFAULT_CACHE_DIR = path19.join(
+    __dirname = path18.dirname(fileURLToPath5(import.meta.url));
+    DEFAULT_CACHE_DIR = path18.join(
       resolveCacheBaseDir(),
       ".virtual-office-cache",
       "model-registry"
     );
-    DEFAULT_CACHE_FILE = path19.join(DEFAULT_CACHE_DIR, "catalog.json");
+    DEFAULT_CACHE_FILE = path18.join(DEFAULT_CACHE_DIR, "catalog.json");
     DEFAULT_TTL_MS3 = 60 * 60 * 1e3;
     ANTHROPIC_API_VERSION = "2023-06-01";
     FAMILY_DEFINITIONS = {
@@ -10800,9 +10671,9 @@ function operatorTierToRung(tier, difficulty, thresholds) {
   if (tier === "best" && difficulty >= thresholds.rungBounds.R5) return "R5";
   return base;
 }
-function readCodexModelsCache({ path: path23 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync4 } = {}) {
+function readCodexModelsCache({ path: path22 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync4 } = {}) {
   try {
-    const parsed = JSON.parse(read(path23, "utf8"));
+    const parsed = JSON.parse(read(path22, "utf8"));
     return Array.isArray(parsed?.models) ? parsed : null;
   } catch {
     return null;
@@ -10985,14 +10856,14 @@ var init_role_cost_shadow = __esm({
 import { readFileSync as readFileSync5, appendFileSync, mkdirSync as mkdirSync4 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { join as join9, dirname as dirname6 } from "node:path";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
 function getAutoRouterMode(env2 = process.env) {
   const raw = String(env2.VO_CODE_RUNNER_AUTO_ROUTER || "").trim().toLowerCase();
   return MODES.has(raw) ? raw : "off";
 }
 function loadThresholds() {
   if (!cachedThresholds) {
-    const here = dirname6(fileURLToPath7(import.meta.url));
+    const here = dirname6(fileURLToPath6(import.meta.url));
     cachedThresholds = JSON.parse(readFileSync5(join9(here, "thresholds.json"), "utf8"));
   }
   return cachedThresholds;
@@ -11059,15 +10930,15 @@ function formatDecisionReason(decision, maxLen = 480) {
   const s = `[${decision.routerVersion}] ${decision.taskClass} d=${decision.difficulty} c=${decision.confidence} \u2192 ${decision.rung}/${decision.tier}${decision.effort ? ` effort=${decision.effort}` : ""} turns=${decision.maxTurns} $${decision.maxBudgetUsd}${decision.flags.length ? ` [${decision.flags.join(",")}]` : ""} :: ${decision.reasons.join("; ")}`;
   return s.length > maxLen ? `${s.slice(0, maxLen - 1)}\u2026` : s;
 }
-function appendDecisionFallback(decision, { path: path23 = DECISION_FALLBACK_PATH, append = appendFileSync, mkdir: mkdir4 = mkdirSync4, task, thresholds, roleCostInputs } = {}) {
+function appendDecisionFallback(decision, { path: path22 = DECISION_FALLBACK_PATH, append = appendFileSync, mkdir: mkdir4 = mkdirSync4, task, thresholds, roleCostInputs } = {}) {
   try {
-    mkdir4(dirname6(path23), { recursive: true });
-    append(path23, `${JSON.stringify(decision)}
+    mkdir4(dirname6(path22), { recursive: true });
+    append(path22, `${JSON.stringify(decision)}
 `, "utf8");
     if (isRouterDecision(decision)) {
       try {
         const records = buildShadowRecords({ decision, task, thresholds: thresholds || loadThresholds(), roleCostInputs });
-        for (const record of records) append(path23, `${JSON.stringify(record)}
+        for (const record of records) append(path22, `${JSON.stringify(record)}
 `, "utf8");
       } catch {
       }
@@ -12060,7 +11931,7 @@ var init_inference_task_runner = __esm({
 // ../../scripts/virtual-office/code-runner/isolation-audit.mjs
 import fs12 from "node:fs";
 import fsp11 from "node:fs/promises";
-import path20 from "node:path";
+import path19 from "node:path";
 async function defaultRun(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, timeout: 6e4, ...options });
 }
@@ -12073,7 +11944,7 @@ async function canonicalRootForWorktree(worktreeDir, run) {
     "--path-format=absolute",
     "--git-common-dir"
   ])).trim();
-  const root = path20.dirname(commonDir);
+  const root = path19.dirname(commonDir);
   return samePath2(root, worktreeDir) ? null : root;
 }
 async function snapshot(root, run) {
@@ -12115,21 +11986,21 @@ async function changedPaths(root, run) {
 }
 async function quarantineCanonicalWrites({ baseline, worktreeDir, taskId, run, now }) {
   const paths = await changedPaths(baseline.root, run);
-  const quarantineDir = path20.join(
-    path20.dirname(worktreeDir),
+  const quarantineDir = path19.join(
+    path19.dirname(worktreeDir),
     ".canonical-recovery",
     `${String(taskId || "unknown").replace(/[^a-z0-9-]/gi, "-")}-${now().toISOString().replace(/[:.]/g, "-")}`
   );
   await fsp11.mkdir(quarantineDir, { recursive: true });
   const patch = await git2(run, baseline.root, ["diff", "--binary", "HEAD"], { raw: true });
-  await fsp11.writeFile(path20.join(quarantineDir, "tracked.patch"), patch, "utf8");
+  await fsp11.writeFile(path19.join(quarantineDir, "tracked.patch"), patch, "utf8");
   for (const relative of paths.untracked) {
-    const source = path20.join(baseline.root, relative);
-    const target = path20.join(quarantineDir, "untracked", relative);
-    await fsp11.mkdir(path20.dirname(target), { recursive: true });
+    const source = path19.join(baseline.root, relative);
+    const target = path19.join(quarantineDir, "untracked", relative);
+    await fsp11.mkdir(path19.dirname(target), { recursive: true });
     await fsp11.copyFile(source, target);
   }
-  await fsp11.writeFile(path20.join(quarantineDir, "manifest.json"), `${JSON.stringify({
+  await fsp11.writeFile(path19.join(quarantineDir, "manifest.json"), `${JSON.stringify({
     taskId,
     canonicalRoot: baseline.root,
     canonicalHead: baseline.head,
@@ -12151,8 +12022,8 @@ async function restoreExactCanonicalPaths(baseline, evidence, run) {
     ]);
   }
   for (const relative of evidence.untracked) {
-    const target = path20.resolve(baseline.root, relative);
-    const prefix = `${path20.resolve(baseline.root)}${path20.sep}`;
+    const target = path19.resolve(baseline.root, relative);
+    const prefix = `${path19.resolve(baseline.root)}${path19.sep}`;
     if (!target.startsWith(prefix) || !fs12.existsSync(target)) continue;
     await fsp11.rm(target, { force: true });
   }
@@ -12189,7 +12060,7 @@ var init_isolation_audit = __esm({
     init_process_runner2();
     splitZ2 = (value) => String(value || "").split("\0").map((item) => item.trim()).filter(Boolean);
     samePath2 = (left, right) => {
-      const [a, b] = [left, right].map((value) => path20.resolve(value));
+      const [a, b] = [left, right].map((value) => path19.resolve(value));
       return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
     };
   }
@@ -12549,7 +12420,7 @@ var init_publication_outcome = __esm({
 
 // ../../scripts/virtual-office/code-runner/committed-scratch-cleanup.mjs
 import fsp12 from "node:fs/promises";
-import path21 from "node:path";
+import path20 from "node:path";
 function defaultRun2(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, ...options });
 }
@@ -12557,13 +12428,13 @@ async function resolveSafeScratchTarget(worktreeDir, file) {
   if (!isAgentScratch(file)) {
     throw new Error(`refusing to remove non-scratch publication path: ${file}`);
   }
-  const root = path21.resolve(worktreeDir);
-  const target = path21.resolve(root, file);
-  const relative = path21.relative(root, target);
-  if (!relative || relative.startsWith(`..${path21.sep}`) || path21.isAbsolute(relative)) {
+  const root = path20.resolve(worktreeDir);
+  const target = path20.resolve(root, file);
+  const relative = path20.relative(root, target);
+  if (!relative || relative.startsWith(`..${path20.sep}`) || path20.isAbsolute(relative)) {
     throw new Error(`refusing to remove publication scratch outside worktree: ${file}`);
   }
-  for (let cursor = target; cursor !== root; cursor = path21.dirname(cursor)) {
+  for (let cursor = target; cursor !== root; cursor = path20.dirname(cursor)) {
     try {
       if ((await fsp12.lstat(cursor)).isSymbolicLink()) {
         throw new Error(`refusing to follow symlink while removing publication scratch: ${file}`);
@@ -12685,7 +12556,7 @@ var init_publication_scope = __esm({
 // ../../scripts/virtual-office/code-runner/recovery-ledger.mjs
 import fs13 from "node:fs";
 import fsp13 from "node:fs/promises";
-import path22 from "node:path";
+import path21 from "node:path";
 function recoveryTaskId(prompt) {
   const match = String(prompt || "").match(/VO_RECOVERY_FROM_CODE_TASK:\s*([0-9a-f-]{36})/i);
   return match ? match[1].toLowerCase() : null;
@@ -12699,10 +12570,10 @@ function cloneLeaf(repo) {
 function recoveryLedgerCandidates(repo, clonesRoot2) {
   const leaf = cloneLeaf(repo);
   if (!leaf || !clonesRoot2) return [];
-  const canonical = path22.join(clonesRoot2, leaf);
+  const canonical = path21.join(clonesRoot2, leaf);
   return [
-    path22.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
-    path22.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
+    path21.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
+    path21.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
   ];
 }
 async function readLedger(file, readFile5) {
@@ -13438,10 +13309,10 @@ var init_task_worktree_preparation = __esm({
 // ../../scripts/virtual-office/code-runner-daemon.mjs
 var code_runner_daemon_exports = {};
 __export(code_runner_daemon_exports, {
-  main: () => main2
+  main: () => main
 });
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 function log(msg) {
   console.log(`[code-runner ${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
 }
@@ -13663,7 +13534,7 @@ Closes #${publicationTarget.supersedesPrNumber}` : "";
     }
   }
 }
-async function main2({ env: env2 = process.env, once: once2 = false } = {}) {
+async function main({ env: env2 = process.env, once: once2 = false } = {}) {
   const cfg = loadCodeRunnerConfig(env2, { log });
   await sweepStaleTaskAttachmentDirectories().catch((error) => log(`stale attachment cleanup failed: ${error.message}`));
   const runnerInstanceId = randomUUID7();
@@ -13809,7 +13680,7 @@ async function main2({ env: env2 = process.env, once: once2 = false } = {}) {
   if (controlServer) controlServer.close();
   log("stopped");
 }
-var RATE_LIMIT_RESUME_ENABLED, sleep2, safeProgress, invokedDirectly2;
+var RATE_LIMIT_RESUME_ENABLED, sleep2, safeProgress, invokedDirectly;
 var init_code_runner_daemon = __esm({
   "../../scripts/virtual-office/code-runner-daemon.mjs"() {
     "use strict";
@@ -13859,11 +13730,11 @@ var init_code_runner_daemon = __esm({
     RATE_LIMIT_RESUME_ENABLED = process.env.VO_RATE_LIMIT_RESUME !== "0";
     sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
     safeProgress = makeSafeProgress(log);
-    invokedDirectly2 = process.argv[1] && fileURLToPath8(import.meta.url) === process.argv[1] && // Bundle-safe: self-start only when THIS file is the real entry (not inlined into vo-mcp's runner-cli.js ⇒ double-claim).
+    invokedDirectly = process.argv[1] && fileURLToPath7(import.meta.url) === process.argv[1] && // Bundle-safe: self-start only when THIS file is the real entry (not inlined into vo-mcp's runner-cli.js ⇒ double-claim).
     import.meta.url.endsWith("code-runner-daemon.mjs");
-    if (invokedDirectly2) {
+    if (invokedDirectly) {
       const once2 = process.argv.includes("--once");
-      main2({ once: once2 }).catch((err) => {
+      main({ once: once2 }).catch((err) => {
         console.error("[code-runner] fatal:", err);
         process.exit(1);
       });
@@ -14230,8 +14101,8 @@ var env = {
   ...pairedOperatorId ? { VO_CODE_RUNNER_OPERATOR_IDS: pairedOperatorId } : {}
 };
 var once = process.argv.includes("--once");
-var { main: main3 } = await Promise.resolve().then(() => (init_code_runner_daemon(), code_runner_daemon_exports));
-main3({ env, once }).catch((err) => {
+var { main: main2 } = await Promise.resolve().then(() => (init_code_runner_daemon(), code_runner_daemon_exports));
+main2({ env, once }).catch((err) => {
   console.error("[vo-mcp runner] fatal:", err);
   process.exit(1);
 });