@algosuite/vo-mcp 0.2.0-beta.34 → 0.2.0-beta.36

package/dist/runner-cli.js

@@ -2582,11 +2582,6 @@ var init_control_plane_auth_stub = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/control-plane-client.mjs
-var control_plane_client_exports = {};
-__export(control_plane_client_exports, {
-  ClaimAuthorityChangedError: () => ClaimAuthorityChangedError,
-  createControlPlaneClient: () => createControlPlaneClient
-});
 async function resolveBearer(env2) {
   const adminToken = env2.VO_CONTROL_PLANE_ADMIN_TOKEN;
   if (adminToken) return adminToken;
@@ -2619,11 +2614,11 @@ function createControlPlaneClient({
   const resolvedBaseUrl = baseUrl ?? env2.VO_CONTROL_PLANE_URL ?? "";
   if (!resolvedBaseUrl) throw new Error("VO_CONTROL_PLANE_URL is required for the code-runner daemon");
   const root = resolvedBaseUrl.replace(/\/+$/, "");
-  async function req(method, path23, body, { timeoutMs } = {}) {
+  async function req(method, path22, body, { timeoutMs } = {}) {
     const bearer = await resolveBearer(env2);
     const controller = timeoutMs ? new AbortController() : null;
     let timeoutId;
-    const request = Promise.resolve(fetchImpl(`${root}${path23}`, {
+    const request = Promise.resolve(fetchImpl(`${root}${path22}`, {
       method,
       headers: {
         "content-type": "application/json",
@@ -2636,7 +2631,7 @@ function createControlPlaneClient({
     const timeout = new Promise((_, reject) => {
       timeoutId = setTimeout(() => {
         controller.abort();
-        reject(new Error(`control-plane ${path23} timed out after ${timeoutMs}ms`));
+        reject(new Error(`control-plane ${path22} timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
     try {
@@ -2645,7 +2640,7 @@ function createControlPlaneClient({
       clearTimeout(timeoutId);
     }
   }
-  const taskReq = (method, path23, body, options = {}) => req(method, path23, body, { timeoutMs: taskRequestTimeoutMs, ...options });
+  const taskReq = (method, path22, body, options = {}) => req(method, path22, body, { timeoutMs: taskRequestTimeoutMs, ...options });
   return {
     ...makeAutonomousDispatchAdmissionClient(
       req,
@@ -2768,8 +2763,8 @@ function createControlPlaneClient({
       return listAllPrOpenedTasks(taskReq);
     },
     async downloadTaskAttachment(taskId, attachmentId) {
-      const path23 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
-      const res = await taskReq("GET", path23);
+      const path22 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
+      const res = await taskReq("GET", path22);
       if (res.status === 401) cachedFirebaseToken = null;
       if (!res.ok) throw new Error(`attachment download failed: HTTP ${res.status}`);
       return Buffer.from(await res.arrayBuffer());
@@ -5981,14 +5976,14 @@ function parsePorcelainZ(out) {
   for (let i = 0; i < tokens.length; i += 1) {
     const token2 = tokens[i];
     if (!token2) continue;
-    const path23 = token2.slice(3);
-    if (path23) files.push(path23);
+    const path22 = token2.slice(3);
+    if (path22) files.push(path22);
     if (token2[0] === "R" || token2[0] === "C") i += 1;
   }
   return files;
 }
-function isAgentScratch(path23) {
-  const normalized = String(path23 || "");
+function isAgentScratch(path22) {
+  const normalized = String(path22 || "");
   return SCRATCH_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 var SCRATCH_PATTERNS;
@@ -6055,6 +6050,15 @@ var init_publish = __esm({
   }
 });
 
+// ../../scripts/virtual-office/test-gen/marker.mjs
+var TEST_GEN_MARKER;
+var init_marker = __esm({
+  "../../scripts/virtual-office/test-gen/marker.mjs"() {
+    "use strict";
+    TEST_GEN_MARKER = "[VO-TEST-GEN]";
+  }
+});
+
 // ../../scripts/virtual-office/test-gen/auto-tier.mjs
 function lower(s) {
   return typeof s === "string" ? s.toLowerCase() : "";
@@ -6128,146 +6132,6 @@ var init_auto_tier = __esm({
   }
 });
 
-// ../../scripts/virtual-office/test-gen/dispatch.mjs
-import { spawnSync as spawnSync10 } from "node:child_process";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
-import path14 from "node:path";
-function buildGenerationPrompt({ contract = {}, tier }) {
-  const label = tierLabel(tier);
-  const target = contract.callable ? `the \`${contract.callable}\` callable` : contract.route ? `the \`${contract.route}\` route` : contract.feature_name || "the feature";
-  return [
-    `Write a ${label} test for ${target} in product "${contract.product || "unknown"}".`,
-    contract.source_file ? `Source: ${contract.source_file}.` : "",
-    contract.expected_behavior ? `Expected behavior: ${contract.expected_behavior}.` : "",
-    "",
-    `TIER REQUIREMENT \u2014 ${TIER_GUIDANCE[tier] || TIER_GUIDANCE[2]}`,
-    "",
-    "Follow the AlgoSuite test-honesty standard: NO fake-green (no bare toBeTruthy, no broad",
-    "try/catch that swallows failures, no treating INVALID_ARGUMENT / empty / null / SKIP as a",
-    "pass). Use a real fixture (smoke@algosuite.ai) and real data shapes.",
-    "",
-    "After writing the test, it will be GATED server-side: deterministic ratchets, then",
-    "multi-model consensus that it proves the behavior with VERIFIED-CORRECT expected values.",
-    "A test that does not pass BOTH gates will NOT ship \u2014 so make the assertions real and the",
-    "expected values known-correct. Leave the test file UNCOMMITTED; the runner opens the PR."
-  ].filter((l) => l !== "").join("\n");
-}
-function planTestGenDispatch({ contract = {} }) {
-  const { tier, rationale } = classifyTier(contract);
-  return {
-    contract,
-    tier,
-    tier_label: tierLabel(tier),
-    tier_rationale: rationale,
-    generation_prompt: buildGenerationPrompt({ contract, tier })
-  };
-}
-function buildTestGenTaskPrompt(dispatch = {}) {
-  const contractJson = JSON.stringify(dispatch.contract ?? {});
-  return `${TEST_GEN_MARKER} ${contractJson}
-
-${dispatch.generation_prompt ?? ""}`;
-}
-function pickNextTarget({ gaps = [] }) {
-  if (!Array.isArray(gaps) || gaps.length === 0) return null;
-  const ranked = [...gaps].sort((a, b) => {
-    const al = LEGAL.has(String(a.product)) ? 0 : 1;
-    const bl = LEGAL.has(String(b.product)) ? 0 : 1;
-    return al - bl;
-  });
-  return ranked[0];
-}
-function resolveRepo(argv, env2) {
-  const repoArg = argv.indexOf("--repo");
-  if (repoArg >= 0 && argv[repoArg + 1]) return argv[repoArg + 1];
-  if (env2.VO_TEST_GEN_REPO) return env2.VO_TEST_GEN_REPO;
-  const remote = spawnSync10("git", ["remote", "get-url", "origin"], { encoding: "utf8" });
-  if (remote.status === 0) {
-    const m = String(remote.stdout).trim().match(/[:/]([^/]+\/[^/]+?)(?:\.git)?$/);
-    if (m) return m[1];
-  }
-  return null;
-}
-async function main(argv = process.argv.slice(2)) {
-  const countArg = argv.indexOf("--count");
-  const count3 = countArg >= 0 ? Math.max(1, Number(argv[countArg + 1]) || 1) : 1;
-  const enqueue = argv.includes("--enqueue");
-  const here = path14.dirname(fileURLToPath3(import.meta.url));
-  const scan = spawnSync10("node", [path14.join(here, "coverage-scan.mjs"), "--limit", String(count3 * 8)], {
-    encoding: "utf8",
-    maxBuffer: 64 * 1024 * 1024
-  });
-  if (scan.status !== 0) {
-    console.error(`[dispatch] coverage-scan failed: ${scan.stderr || scan.stdout}`);
-    process.exit(1);
-  }
-  let gaps = [];
-  try {
-    gaps = JSON.parse(scan.stdout).gaps || [];
-  } catch (err) {
-    console.error(`[dispatch] could not parse scan output: ${err.message}`);
-    process.exit(1);
-  }
-  const dispatches = [];
-  const seen = /* @__PURE__ */ new Set();
-  let pool = gaps;
-  while (dispatches.length < count3 && pool.length > 0) {
-    const target = pickNextTarget({ gaps: pool });
-    if (!target) break;
-    const key = `${target.product}:${target.callable}`;
-    if (!seen.has(key)) {
-      seen.add(key);
-      dispatches.push(planTestGenDispatch({ contract: target }));
-    }
-    pool = pool.filter((g) => `${g.product}:${g.callable}` !== key);
-  }
-  if (!enqueue) {
-    console.log(JSON.stringify({ requested: count3, emitted: dispatches.length, dispatches }, null, 2));
-    return;
-  }
-  const repo = resolveRepo(argv, process.env);
-  if (!repo) {
-    console.error("[dispatch] --enqueue needs a repo: pass --repo owner/name or set VO_TEST_GEN_REPO (could not derive from git origin)");
-    process.exit(1);
-  }
-  const { createControlPlaneClient: createControlPlaneClient2 } = await Promise.resolve().then(() => (init_control_plane_client(), control_plane_client_exports));
-  const client = createControlPlaneClient2({ env: process.env });
-  const enqueued = [];
-  for (const d of dispatches) {
-    const task = await client.enqueueCodeTask({
-      repo,
-      prompt: buildTestGenTaskPrompt(d),
-      max_turns: 40
-    });
-    const taskId = task && task.code_task_id ? task.code_task_id : "(unknown)";
-    enqueued.push({ task_id: taskId, product: d.contract.product, callable: d.contract.callable, tier: d.tier_label });
-    console.error(`[dispatch] enqueued ${d.tier_label} test-gen for ${d.contract.product}:${d.contract.callable} \u2192 task ${taskId}`);
-  }
-  console.log(JSON.stringify({ requested: count3, enqueued: enqueued.length, repo, tasks: enqueued }, null, 2));
-}
-var TEST_GEN_MARKER, TIER_GUIDANCE, LEGAL, invokedDirectly;
-var init_dispatch = __esm({
-  "../../scripts/virtual-office/test-gen/dispatch.mjs"() {
-    "use strict";
-    init_auto_tier();
-    TEST_GEN_MARKER = "[VO-TEST-GEN]";
-    TIER_GUIDANCE = {
-      1: "Surface/navigation smoke: assert the surface renders and the key controls are present. No backend effect needed.",
-      2: "E2E with VERIFIED RESULTS: drive the real user/callable workflow, then READ BACK the produced artifact and assert KNOWN-CORRECT expected values (not just a 200 / truthiness).",
-      3: "Real-time monitor / sentinel: drive the workflow AND verify the state transitions + safety rails (no money moved / graded / admin action without the guard). Assert the post-conditions, not just the response.",
-      4: "Source-grounded governed-fact: assert expected values that are GROUNDED in the cited authoritative source (the contract's authoritative_source_url). The fixture and the expected number/string must trace to that source."
-    };
-    LEGAL = /* @__PURE__ */ new Set(["algotax", "algolaw", "algoteach", "algolegal"]);
-    invokedDirectly = process.argv[1] && fileURLToPath3(import.meta.url) === path14.resolve(process.argv[1]);
-    if (invokedDirectly) {
-      main().catch((err) => {
-        console.error(`[dispatch] ${err.message}`);
-        process.exit(1);
-      });
-    }
-  }
-});
-
 // ../../scripts/virtual-office/test-gen/executor.mjs
 function consensusQuestion(tier) {
   const tierAsk = tier >= 4 ? " For this governed-fact (Tier 4) test, the expected values MUST be grounded in the cited authoritative source." : tier >= 3 ? " For this safety-critical (Tier 3) test, it must verify state transitions and the safety rails, not just a 200." : "";
@@ -6374,7 +6238,7 @@ var init_executor = __esm({
 
 // ../../scripts/virtual-office/code-runner/test-gen-gate.mjs
 import fs7 from "node:fs";
-import path15 from "node:path";
+import path14 from "node:path";
 async function postFailed(client, id, message, result) {
   try {
     await client.postProgress(id, {
@@ -6410,7 +6274,7 @@ async function gateTestGenTaskOrFail({ client, id, task, files, worktreeDir, env
   }
   let testSource = "";
   try {
-    testSource = fs7.readFileSync(path15.join(worktreeDir, testFile), "utf8");
+    testSource = fs7.readFileSync(path14.join(worktreeDir, testFile), "utf8");
   } catch (err) {
     await postFailed(client, id, `could not read generated test ${testFile}: ${err.message}`, "gate_test_unreadable");
     return true;
@@ -6451,7 +6315,7 @@ var TEST_FILE_RE;
 var init_test_gen_gate = __esm({
   "../../scripts/virtual-office/code-runner/test-gen-gate.mjs"() {
     "use strict";
-    init_dispatch();
+    init_marker();
     init_executor();
     TEST_FILE_RE = /\.(test|spec)\.(ts|tsx|mjs|js)$/;
   }
@@ -6460,7 +6324,7 @@ var init_test_gen_gate = __esm({
 // ../../scripts/virtual-office/code-runner/completion-gate.mjs
 import { execFile } from "node:child_process";
 import fs8 from "node:fs";
-import path16 from "node:path";
+import path15 from "node:path";
 function resolveCompletionGate(task) {
   const raw = task?.completion_gate;
   if (raw === void 0 || raw === null) return null;
@@ -6498,14 +6362,14 @@ function workspaceFingerprint(worktreeDir, execFileImpl = execFile) {
 }
 function readState(worktreeDir) {
   try {
-    return JSON.parse(fs8.readFileSync(path16.join(worktreeDir, COMPLETION_GATE_STATE_FILE), "utf8"));
+    return JSON.parse(fs8.readFileSync(path15.join(worktreeDir, COMPLETION_GATE_STATE_FILE), "utf8"));
   } catch {
     return null;
   }
 }
 function writeState(worktreeDir, state) {
   try {
-    fs8.writeFileSync(path16.join(worktreeDir, COMPLETION_GATE_STATE_FILE), `${JSON.stringify(state)}
+    fs8.writeFileSync(path15.join(worktreeDir, COMPLETION_GATE_STATE_FILE), `${JSON.stringify(state)}
 `, "utf8");
   } catch {
   }
@@ -7083,7 +6947,7 @@ var init_publish_async = __esm({
 // ../../scripts/virtual-office/code-runner/skill-catalog.mjs
 import { readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "node:fs";
 import { dirname as dirname3, join as join4 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function parseFrontmatterNameDescription(raw) {
   const text = String(raw).replace(/\r\n/g, "\n");
   if (!text.startsWith("---\n")) return null;
@@ -7102,7 +6966,7 @@ function parseFrontmatterNameDescription(raw) {
   return name && description ? { name, description } : null;
 }
 function resolveDefaultRepoRoot() {
-  const starts = [dirname3(fileURLToPath4(import.meta.url)), process.cwd()];
+  const starts = [dirname3(fileURLToPath3(import.meta.url)), process.cwd()];
   for (const start of starts) {
     let dir = start;
     for (let i = 0; i < 8; i += 1) {
@@ -7358,7 +7222,7 @@ var init_task_prompt = __esm({
 import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
 import { chmod, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import os2 from "node:os";
-import path17 from "node:path";
+import path16 from "node:path";
 function safeTaskToken(taskId) {
   return String(taskId || "task").replace(/[^0-9A-Za-z_-]/gu, "_").slice(0, 48) || "task";
 }
@@ -7368,25 +7232,25 @@ function sanitizeTaskAttachmentName(name, index = 0) {
   return `${String(index + 1).padStart(2, "0")}-${normalized}`;
 }
 function assertGeneratedDirectory(directory, tempRoot) {
-  const resolvedDirectory = path17.resolve(directory);
-  const resolvedRoot = path17.resolve(tempRoot);
-  if (path17.dirname(resolvedDirectory) !== resolvedRoot || !path17.basename(resolvedDirectory).startsWith(DIRECTORY_PREFIX)) {
+  const resolvedDirectory = path16.resolve(directory);
+  const resolvedRoot = path16.resolve(tempRoot);
+  if (path16.dirname(resolvedDirectory) !== resolvedRoot || !path16.basename(resolvedDirectory).startsWith(DIRECTORY_PREFIX)) {
     throw new Error("refusing to clean an unverified task-attachment directory");
   }
   return resolvedDirectory;
 }
 async function createAttachmentDirectory(taskId, tempRoot) {
-  const root = path17.resolve(tempRoot);
+  const root = path16.resolve(tempRoot);
   await mkdir(root, { recursive: true });
-  const directory = await mkdtemp(path17.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
-  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID2(), directory: path17.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
-  await writeFile(path17.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
+  const directory = await mkdtemp(path16.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
+  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID2(), directory: path16.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
+  await writeFile(path16.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
   return { directory, marker, tempRoot: root };
 }
 async function cleanupGeneratedDirectory(state) {
   if (!state || state.cleaned) return;
   const directory = assertGeneratedDirectory(state.directory, state.tempRoot);
-  const marker = await readFile(path17.join(directory, MARKER_FILE), "utf8").catch(() => "");
+  const marker = await readFile(path16.join(directory, MARKER_FILE), "utf8").catch(() => "");
   if (marker !== state.marker) throw new Error("refusing to clean a task-attachment directory without its exact marker");
   await rm(directory, { recursive: true, force: true });
   state.cleaned = true;
@@ -7405,7 +7269,7 @@ async function sweepStaleTaskAttachmentDirectories({
   now = Date.now(),
   maxAgeMs = DEFAULT_STALE_AGE_MS
 } = {}) {
-  const root = path17.resolve(tempRoot);
+  const root = path16.resolve(tempRoot);
   if (!Number.isFinite(maxAgeMs) || maxAgeMs <= 0) throw new Error("stale attachment age must be positive");
   const entries = await readdir(root, { withFileTypes: true }).catch((error) => {
     if (error?.code === "ENOENT") return [];
@@ -7414,8 +7278,8 @@ async function sweepStaleTaskAttachmentDirectories({
   let removed = 0;
   for (const entry of entries) {
     if (!entry.isDirectory() || !entry.name.startsWith(DIRECTORY_PREFIX)) continue;
-    const directory = assertGeneratedDirectory(path17.join(root, entry.name), root);
-    const markerRaw = await readFile(path17.join(directory, MARKER_FILE), "utf8").catch(() => "");
+    const directory = assertGeneratedDirectory(path16.join(root, entry.name), root);
+    const markerRaw = await readFile(path16.join(directory, MARKER_FILE), "utf8").catch(() => "");
     const marker = parseOwnedMarker(markerRaw, entry.name);
     if (!marker) continue;
     const directoryStat = await stat(directory);
@@ -7458,10 +7322,10 @@ async function materializeTaskAttachments(client, task, { tempRoot = os2.tmpdir(
       const sha256 = createHash3("sha256").update(content).digest("hex");
       if (sha256 !== ref.sha256) throw new Error(`attachment ${ref.attachment_id} sha256 mismatch`);
       const name = sanitizeTaskAttachmentName(ref.name, index);
-      const filePath = path17.join(state.directory, name);
+      const filePath = path16.join(state.directory, name);
       await writeFile(filePath, content, { flag: "wx", mode: 384 });
       await chmod(filePath, 384);
-      files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256, path: path17.resolve(filePath) });
+      files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256, path: path16.resolve(filePath) });
     }
     return { directory: state.directory, files, manifestMarkdown: buildManifest(files), cleanup: () => cleanupGeneratedDirectory(state) };
   } catch (error) {
@@ -7525,9 +7389,9 @@ async function readSpool(spoolDir = SPOOL_DIR) {
   }
   return out;
 }
-async function readCloudMap(path23) {
+async function readCloudMap(path22) {
   try {
-    return JSON.parse(await readFile2(path23, "utf8"));
+    return JSON.parse(await readFile2(path22, "utf8"));
   } catch {
     return {};
   }
@@ -8051,7 +7915,7 @@ var init_runner_capacity = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/agent-auth-probe-process.mjs
-import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 async function probeAgentInChild(agent, timeoutMs) {
   const stdout = await runProcess2(process.execPath, [probeCli, agent], {
     timeout: timeoutMs,
@@ -8064,7 +7928,7 @@ var init_agent_auth_probe_process = __esm({
   "../../scripts/virtual-office/code-runner/agent-auth-probe-process.mjs"() {
     "use strict";
     init_process_runner2();
-    probeCli = fileURLToPath5(new URL("./agent-auth-probe-cli.mjs", import.meta.url));
+    probeCli = fileURLToPath4(new URL("./agent-auth-probe-cli.mjs", import.meta.url));
   }
 });
 
@@ -8365,7 +8229,7 @@ var init_shared = __esm({
 // ../../scripts/virtual-office/code-runner/account-usage/claude.mjs
 import fs10 from "node:fs";
 import os3 from "node:os";
-import path18 from "node:path";
+import path17 from "node:path";
 function fileCaptureTime(filePath, explicit, statFn) {
   if (typeof explicit === "string" && explicit) return explicit;
   try {
@@ -8379,7 +8243,7 @@ function usageBaseUrl(env2 = process.env) {
   return String(raw).replace(/\/+$/, "");
 }
 function readOAuthToken({ homeDir = os3.homedir(), read = readJson, now = Date.now() } = {}) {
-  const creds = read(path18.join(homeDir, ".claude", ".credentials.json"));
+  const creds = read(path17.join(homeDir, ".claude", ".credentials.json"));
   const oauth = creds && typeof creds === "object" ? creds.claudeAiOauth : null;
   if (!oauth || typeof oauth !== "object") return null;
   const token2 = typeof oauth.accessToken === "string" ? oauth.accessToken.trim() : "";
@@ -8389,7 +8253,7 @@ function readOAuthToken({ homeDir = os3.homedir(), read = readJson, now = Date.n
   return token2;
 }
 function readAccountId({ homeDir = os3.homedir(), read = readJson } = {}) {
-  const cfg = read(path18.join(homeDir, ".claude.json"));
+  const cfg = read(path17.join(homeDir, ".claude.json"));
   const account = cfg && typeof cfg === "object" ? cfg.oauthAccount : null;
   return account && typeof account.accountUuid === "string" ? account.accountUuid : null;
 }
@@ -8499,7 +8363,7 @@ function readClaudeFileUsage({
     if (age === null || age > MAX_FILE_AGE_MS) return null;
     return row;
   };
-  const statusPath = path18.join(homeDir, ".claude", "claude-usage.json");
+  const statusPath = path17.join(homeDir, ".claude", "claude-usage.json");
   const status = read(statusPath);
   if (status && (status.seven_day || status.five_hour)) {
     const row = fresh(makeUsageRow({
@@ -8514,7 +8378,7 @@ function readClaudeFileUsage({
     }));
     if (row) return row;
   }
-  const weeklyPath = path18.join(homeDir, ".claude", "claude-weekly-usage.json");
+  const weeklyPath = path17.join(homeDir, ".claude", "claude-weekly-usage.json");
   const weekly = read(weeklyPath);
   if (weekly) {
     const row = fresh(makeUsageRow({
@@ -9790,9 +9654,9 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end();
       return;
     }
-    const path23 = String(req.url || "").split("?")[0];
+    const path22 = String(req.url || "").split("?")[0];
     res.setHeader("content-type", "application/json");
-    if (req.method === "GET" && path23 === "/status") {
+    if (req.method === "GET" && path22 === "/status") {
       let status;
       try {
         status = getStatus();
@@ -9803,7 +9667,7 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end(JSON.stringify({ ok: true, ...status }));
       return;
     }
-    if (req.method === "POST" && path23 === "/stop") {
+    if (req.method === "POST" && path22 === "/stop") {
       if (!isControlOriginAllowed(req.headers.origin, allowedOrigin) || !req.headers["x-vo-control"]) {
         res.statusCode = 403;
         res.end(JSON.stringify({ ok: false, error: "forbidden" }));
@@ -9901,6 +9765,19 @@ function resolveEffortMode(mode) {
   const normalized = String(mode || "").trim().toLowerCase();
   return EFFORT_MODE_CONFIG[normalized] || EFFORT_MODE_CONFIG[DEFAULT_MODE];
 }
+function resolveDefaultBudgetUsd(env2 = {}) {
+  const raw = env2?.[DEFAULT_BUDGET_USD_ENV];
+  if (raw === void 0 || raw === null) return null;
+  const parsed = Number(String(raw).trim());
+  if (!Number.isFinite(parsed) || parsed <= 0) return null;
+  return parsed;
+}
+function resolveDispatchBudgetUsd({ taskBudgetUsd, env: env2 = {} } = {}) {
+  if (typeof taskBudgetUsd === "number" && Number.isFinite(taskBudgetUsd)) {
+    return taskBudgetUsd;
+  }
+  return resolveDefaultBudgetUsd(env2);
+}
 function composeEffortPrompt(basePrompt, effortConfig) {
   const parts = [];
   if (effortConfig.thinkingDirective) {
@@ -9916,15 +9793,16 @@ ${effortConfig.multiAgentInstruction}
   parts.push(String(basePrompt || "").trim());
   return parts.join("\n");
 }
-var RED_TEAM_DIRECTIVE, EFFORT_MODE_CONFIG, DEFAULT_MODE;
+var RED_TEAM_DIRECTIVE, DEFAULT_BUDGET_USD_ENV, EFFORT_MODE_CONFIG, DEFAULT_MODE;
 var init_effort_mode_config = __esm({
   "../../scripts/virtual-office/code-runner/effort-mode-config.mjs"() {
     "use strict";
     RED_TEAM_DIRECTIVE = "Before declaring done, red-team your own work: name the top ways it could be wrong \u2014 especially code that is correct but silently not wired into production callers \u2014 give the failure scenario for each, and state the evidence that rules it out.";
+    DEFAULT_BUDGET_USD_ENV = "VO_CODE_RUNNER_DEFAULT_BUDGET_USD";
     EFFORT_MODE_CONFIG = {
       fast: {
         tier: "cheap",
-        maxBudgetUsd: 1,
+        maxBudgetUsd: null,
         permissionMode: "acceptEdits",
         maxTurns: 80,
         thinkingDirective: RED_TEAM_DIRECTIVE,
@@ -9932,7 +9810,7 @@ var init_effort_mode_config = __esm({
       },
       standard: {
         tier: "mid",
-        maxBudgetUsd: 3,
+        maxBudgetUsd: null,
         permissionMode: "acceptEdits",
         maxTurns: 200,
         thinkingDirective: RED_TEAM_DIRECTIVE,
@@ -9940,7 +9818,7 @@ var init_effort_mode_config = __esm({
       },
       deep: {
         tier: "best",
-        maxBudgetUsd: 10,
+        maxBudgetUsd: null,
         permissionMode: "acceptEdits",
         maxTurns: 300,
         thinkingDirective: `Think step-by-step. Verify assumptions against source code. Check edge cases. ${RED_TEAM_DIRECTIVE}`,
@@ -9948,7 +9826,7 @@ var init_effort_mode_config = __esm({
       },
       ultra: {
         tier: "best",
-        maxBudgetUsd: 25,
+        maxBudgetUsd: null,
         permissionMode: "acceptEdits",
         maxTurns: 500,
         thinkingDirective: `Think step-by-step. Exhaustively verify every assumption against source code and documentation. ${RED_TEAM_DIRECTIVE}`,
@@ -9956,7 +9834,7 @@ var init_effort_mode_config = __esm({
       },
       ultracode: {
         tier: "best",
-        maxBudgetUsd: 50,
+        maxBudgetUsd: null,
         permissionMode: "acceptEdits",
         maxTurns: 800,
         thinkingDirective: `Think step-by-step. Exhaustively verify every assumption against source code and documentation. Build worked examples to validate correctness. ${RED_TEAM_DIRECTIVE}`,
@@ -9971,22 +9849,22 @@ var init_effort_mode_config = __esm({
 import { randomUUID as randomUUID5 } from "node:crypto";
 import fs11 from "node:fs";
 import os4 from "node:os";
-import path19 from "node:path";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import path18 from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 function userCacheRoot() {
   try {
     const home = os4.homedir();
-    if (home) return path19.join(home, ".claude");
+    if (home) return path18.join(home, ".claude");
   } catch {
   }
-  return path19.join(os4.tmpdir(), `vo-model-registry-${randomUUID5()}`);
+  return path18.join(os4.tmpdir(), `vo-model-registry-${randomUUID5()}`);
 }
 function resolveCacheBaseDir(env2 = process.env, moduleDir = __dirname) {
   if (env2.VO_MODEL_REGISTRY_CACHE_DIR) return env2.VO_MODEL_REGISTRY_CACHE_DIR;
   if (env2.VO_RUNNER_RUNTIME_ROOT) return env2.VO_RUNNER_RUNTIME_ROOT;
-  const segments = moduleDir.split(path19.sep);
+  const segments = moduleDir.split(path18.sep);
   const isRepoCheckout = segments.at(-1) === "virtual-office" && segments.at(-2) === "scripts";
-  return isRepoCheckout ? path19.resolve(moduleDir, "..", "..") : userCacheRoot();
+  return isRepoCheckout ? path18.resolve(moduleDir, "..", "..") : userCacheRoot();
 }
 function uniqueModels(models = []) {
   return [...new Set(models.map((model) => String(model || "").trim()).filter(Boolean))];
@@ -10109,7 +9987,7 @@ function readCache(cacheFile = DEFAULT_CACHE_FILE, nowMs = Date.now(), ttlMs = D
   }
 }
 function writeCache(cacheFile = DEFAULT_CACHE_FILE, payload) {
-  fs11.mkdirSync(path19.dirname(cacheFile), { recursive: true });
+  fs11.mkdirSync(path18.dirname(cacheFile), { recursive: true });
   fs11.writeFileSync(cacheFile, JSON.stringify(payload, null, 2));
 }
 async function fetchRegistryCatalog({
@@ -10167,13 +10045,13 @@ var __dirname, DEFAULT_CACHE_DIR, DEFAULT_CACHE_FILE, DEFAULT_TTL_MS3, ANTHROPIC
 var init_model_registry = __esm({
   "../../scripts/virtual-office/model-registry.mjs"() {
     "use strict";
-    __dirname = path19.dirname(fileURLToPath6(import.meta.url));
-    DEFAULT_CACHE_DIR = path19.join(
+    __dirname = path18.dirname(fileURLToPath5(import.meta.url));
+    DEFAULT_CACHE_DIR = path18.join(
       resolveCacheBaseDir(),
       ".virtual-office-cache",
       "model-registry"
     );
-    DEFAULT_CACHE_FILE = path19.join(DEFAULT_CACHE_DIR, "catalog.json");
+    DEFAULT_CACHE_FILE = path18.join(DEFAULT_CACHE_DIR, "catalog.json");
     DEFAULT_TTL_MS3 = 60 * 60 * 1e3;
     ANTHROPIC_API_VERSION = "2023-06-01";
     FAMILY_DEFINITIONS = {
@@ -10807,9 +10685,9 @@ function operatorTierToRung(tier, difficulty, thresholds) {
   if (tier === "best" && difficulty >= thresholds.rungBounds.R5) return "R5";
   return base;
 }
-function readCodexModelsCache({ path: path23 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync4 } = {}) {
+function readCodexModelsCache({ path: path22 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync4 } = {}) {
   try {
-    const parsed = JSON.parse(read(path23, "utf8"));
+    const parsed = JSON.parse(read(path22, "utf8"));
     return Array.isArray(parsed?.models) ? parsed : null;
   } catch {
     return null;
@@ -10992,14 +10870,14 @@ var init_role_cost_shadow = __esm({
 import { readFileSync as readFileSync5, appendFileSync, mkdirSync as mkdirSync4 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { join as join9, dirname as dirname6 } from "node:path";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
 function getAutoRouterMode(env2 = process.env) {
   const raw = String(env2.VO_CODE_RUNNER_AUTO_ROUTER || "").trim().toLowerCase();
   return MODES.has(raw) ? raw : "off";
 }
 function loadThresholds() {
   if (!cachedThresholds) {
-    const here = dirname6(fileURLToPath7(import.meta.url));
+    const here = dirname6(fileURLToPath6(import.meta.url));
     cachedThresholds = JSON.parse(readFileSync5(join9(here, "thresholds.json"), "utf8"));
   }
   return cachedThresholds;
@@ -11066,15 +10944,15 @@ function formatDecisionReason(decision, maxLen = 480) {
   const s = `[${decision.routerVersion}] ${decision.taskClass} d=${decision.difficulty} c=${decision.confidence} \u2192 ${decision.rung}/${decision.tier}${decision.effort ? ` effort=${decision.effort}` : ""} turns=${decision.maxTurns} $${decision.maxBudgetUsd}${decision.flags.length ? ` [${decision.flags.join(",")}]` : ""} :: ${decision.reasons.join("; ")}`;
   return s.length > maxLen ? `${s.slice(0, maxLen - 1)}\u2026` : s;
 }
-function appendDecisionFallback(decision, { path: path23 = DECISION_FALLBACK_PATH, append = appendFileSync, mkdir: mkdir4 = mkdirSync4, task, thresholds, roleCostInputs } = {}) {
+function appendDecisionFallback(decision, { path: path22 = DECISION_FALLBACK_PATH, append = appendFileSync, mkdir: mkdir4 = mkdirSync4, task, thresholds, roleCostInputs } = {}) {
   try {
-    mkdir4(dirname6(path23), { recursive: true });
-    append(path23, `${JSON.stringify(decision)}
+    mkdir4(dirname6(path22), { recursive: true });
+    append(path22, `${JSON.stringify(decision)}
 `, "utf8");
     if (isRouterDecision(decision)) {
       try {
         const records = buildShadowRecords({ decision, task, thresholds: thresholds || loadThresholds(), roleCostInputs });
-        for (const record of records) append(path23, `${JSON.stringify(record)}
+        for (const record of records) append(path22, `${JSON.stringify(record)}
 `, "utf8");
       } catch {
       }
@@ -11160,7 +11038,12 @@ async function resolveEffortDispatch({ client, task, agent = "claude", env: env2
     permissionMode: env2.VO_CODE_RUNNER_PERMISSION_MODE || effortConfig.permissionMode,
     maxTurns: typeof task.max_turns === "number" ? task.max_turns : applying ? decision.maxTurns : effortConfig.maxTurns,
     effort,
-    maxBudgetUsd: typeof task.max_budget_usd === "number" ? task.max_budget_usd : applying ? decision.maxBudgetUsd : effortConfig.maxBudgetUsd,
+    // Default dollar ceilings are OFF (2026-08-13). Only an EXPLICIT per-task
+    // budget — or the VO_CODE_RUNNER_DEFAULT_BUDGET_USD override a BYO-API-key
+    // operator sets — produces a `--max-budget-usd` flag. The router's dollar
+    // rung is a default too, so it is suppressed with the rest; the router
+    // still governs tier, effort, and maxTurns (the real runaway bound).
+    maxBudgetUsd: resolveDispatchBudgetUsd({ taskBudgetUsd: task.max_budget_usd, env: env2 }),
     prompt: composeEffortPrompt(basePrompt, effortConfig),
     routerDecision: decision ? toPersistedRouterDecision(decision, model) : null
   };
@@ -12067,7 +11950,7 @@ var init_inference_task_runner = __esm({
 // ../../scripts/virtual-office/code-runner/isolation-audit.mjs
 import fs12 from "node:fs";
 import fsp11 from "node:fs/promises";
-import path20 from "node:path";
+import path19 from "node:path";
 async function defaultRun(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, timeout: 6e4, ...options });
 }
@@ -12080,7 +11963,7 @@ async function canonicalRootForWorktree(worktreeDir, run) {
     "--path-format=absolute",
     "--git-common-dir"
   ])).trim();
-  const root = path20.dirname(commonDir);
+  const root = path19.dirname(commonDir);
   return samePath2(root, worktreeDir) ? null : root;
 }
 async function snapshot(root, run) {
@@ -12122,21 +12005,21 @@ async function changedPaths(root, run) {
 }
 async function quarantineCanonicalWrites({ baseline, worktreeDir, taskId, run, now }) {
   const paths = await changedPaths(baseline.root, run);
-  const quarantineDir = path20.join(
-    path20.dirname(worktreeDir),
+  const quarantineDir = path19.join(
+    path19.dirname(worktreeDir),
     ".canonical-recovery",
     `${String(taskId || "unknown").replace(/[^a-z0-9-]/gi, "-")}-${now().toISOString().replace(/[:.]/g, "-")}`
   );
   await fsp11.mkdir(quarantineDir, { recursive: true });
   const patch = await git2(run, baseline.root, ["diff", "--binary", "HEAD"], { raw: true });
-  await fsp11.writeFile(path20.join(quarantineDir, "tracked.patch"), patch, "utf8");
+  await fsp11.writeFile(path19.join(quarantineDir, "tracked.patch"), patch, "utf8");
   for (const relative of paths.untracked) {
-    const source = path20.join(baseline.root, relative);
-    const target = path20.join(quarantineDir, "untracked", relative);
-    await fsp11.mkdir(path20.dirname(target), { recursive: true });
+    const source = path19.join(baseline.root, relative);
+    const target = path19.join(quarantineDir, "untracked", relative);
+    await fsp11.mkdir(path19.dirname(target), { recursive: true });
     await fsp11.copyFile(source, target);
   }
-  await fsp11.writeFile(path20.join(quarantineDir, "manifest.json"), `${JSON.stringify({
+  await fsp11.writeFile(path19.join(quarantineDir, "manifest.json"), `${JSON.stringify({
     taskId,
     canonicalRoot: baseline.root,
     canonicalHead: baseline.head,
@@ -12158,8 +12041,8 @@ async function restoreExactCanonicalPaths(baseline, evidence, run) {
     ]);
   }
   for (const relative of evidence.untracked) {
-    const target = path20.resolve(baseline.root, relative);
-    const prefix = `${path20.resolve(baseline.root)}${path20.sep}`;
+    const target = path19.resolve(baseline.root, relative);
+    const prefix = `${path19.resolve(baseline.root)}${path19.sep}`;
     if (!target.startsWith(prefix) || !fs12.existsSync(target)) continue;
     await fsp11.rm(target, { force: true });
   }
@@ -12196,7 +12079,7 @@ var init_isolation_audit = __esm({
     init_process_runner2();
     splitZ2 = (value) => String(value || "").split("\0").map((item) => item.trim()).filter(Boolean);
     samePath2 = (left, right) => {
-      const [a, b] = [left, right].map((value) => path20.resolve(value));
+      const [a, b] = [left, right].map((value) => path19.resolve(value));
       return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
     };
   }
@@ -12556,7 +12439,7 @@ var init_publication_outcome = __esm({
 
 // ../../scripts/virtual-office/code-runner/committed-scratch-cleanup.mjs
 import fsp12 from "node:fs/promises";
-import path21 from "node:path";
+import path20 from "node:path";
 function defaultRun2(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, ...options });
 }
@@ -12564,13 +12447,13 @@ async function resolveSafeScratchTarget(worktreeDir, file) {
   if (!isAgentScratch(file)) {
     throw new Error(`refusing to remove non-scratch publication path: ${file}`);
   }
-  const root = path21.resolve(worktreeDir);
-  const target = path21.resolve(root, file);
-  const relative = path21.relative(root, target);
-  if (!relative || relative.startsWith(`..${path21.sep}`) || path21.isAbsolute(relative)) {
+  const root = path20.resolve(worktreeDir);
+  const target = path20.resolve(root, file);
+  const relative = path20.relative(root, target);
+  if (!relative || relative.startsWith(`..${path20.sep}`) || path20.isAbsolute(relative)) {
     throw new Error(`refusing to remove publication scratch outside worktree: ${file}`);
   }
-  for (let cursor = target; cursor !== root; cursor = path21.dirname(cursor)) {
+  for (let cursor = target; cursor !== root; cursor = path20.dirname(cursor)) {
     try {
       if ((await fsp12.lstat(cursor)).isSymbolicLink()) {
         throw new Error(`refusing to follow symlink while removing publication scratch: ${file}`);
@@ -12692,7 +12575,7 @@ var init_publication_scope = __esm({
 // ../../scripts/virtual-office/code-runner/recovery-ledger.mjs
 import fs13 from "node:fs";
 import fsp13 from "node:fs/promises";
-import path22 from "node:path";
+import path21 from "node:path";
 function recoveryTaskId(prompt) {
   const match = String(prompt || "").match(/VO_RECOVERY_FROM_CODE_TASK:\s*([0-9a-f-]{36})/i);
   return match ? match[1].toLowerCase() : null;
@@ -12706,10 +12589,10 @@ function cloneLeaf(repo) {
 function recoveryLedgerCandidates(repo, clonesRoot2) {
   const leaf = cloneLeaf(repo);
   if (!leaf || !clonesRoot2) return [];
-  const canonical = path22.join(clonesRoot2, leaf);
+  const canonical = path21.join(clonesRoot2, leaf);
   return [
-    path22.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
-    path22.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
+    path21.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
+    path21.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
   ];
 }
 async function readLedger(file, readFile5) {
@@ -13445,10 +13328,10 @@ var init_task_worktree_preparation = __esm({
 // ../../scripts/virtual-office/code-runner-daemon.mjs
 var code_runner_daemon_exports = {};
 __export(code_runner_daemon_exports, {
-  main: () => main2
+  main: () => main
 });
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 function log(msg) {
   console.log(`[code-runner ${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
 }
@@ -13488,7 +13371,7 @@ async function processOneTask(client, task, cfg, runnerInstanceId, swarmAdmissio
     const sandbox = resolveRunnerSandbox(process.env, sel.agent);
     await safeProgress(client, id, runnerStagePatch(
       "starting_agent",
-      `${cfg.runnerId} spawning ${sel.agent}:${model || "default"} (${tier}, effort ${dispatchMode}; ${sel.agent === "claude" ? `$${effectiveMaxBudgetUsd} hard API-equivalent cap` : "20m wall-clock cap"}${routerMode !== "off" && routerDecision ? `; auto-router ${routerMode}: ${routerDecision.rung}${routerDecision.effort ? ` effort=${routerDecision.effort}` : ""}` : ""})`,
+      `${cfg.runnerId} spawning ${sel.agent}:${model || "default"} (${tier}, effort ${dispatchMode}; ${sel.agent === "claude" ? typeof effectiveMaxBudgetUsd === "number" && effectiveMaxBudgetUsd > 0 ? `$${effectiveMaxBudgetUsd} hard API-equivalent cap` : `no dollar cap, ${effectiveMaxTurns}-turn ceiling` : "20m wall-clock cap"}${routerMode !== "off" && routerDecision ? `; auto-router ${routerMode}: ${routerDecision.rung}${routerDecision.effort ? ` effort=${routerDecision.effort}` : ""}` : ""})`,
       routerDecision ? { router_decision: routerDecision } : {}
     ));
     const cap = typeof attemptBudgetUsd === "number" ? attemptBudgetUsd : resolveCodeDispatchCapUsd();
@@ -13670,7 +13553,7 @@ Closes #${publicationTarget.supersedesPrNumber}` : "";
     }
   }
 }
-async function main2({ env: env2 = process.env, once: once2 = false } = {}) {
+async function main({ env: env2 = process.env, once: once2 = false } = {}) {
   const cfg = loadCodeRunnerConfig(env2, { log });
   await sweepStaleTaskAttachmentDirectories().catch((error) => log(`stale attachment cleanup failed: ${error.message}`));
   const runnerInstanceId = randomUUID7();
@@ -13816,7 +13699,7 @@ async function main2({ env: env2 = process.env, once: once2 = false } = {}) {
   if (controlServer) controlServer.close();
   log("stopped");
 }
-var RATE_LIMIT_RESUME_ENABLED, sleep2, safeProgress, invokedDirectly2;
+var RATE_LIMIT_RESUME_ENABLED, sleep2, safeProgress, invokedDirectly;
 var init_code_runner_daemon = __esm({
   "../../scripts/virtual-office/code-runner-daemon.mjs"() {
     "use strict";
@@ -13866,11 +13749,11 @@ var init_code_runner_daemon = __esm({
     RATE_LIMIT_RESUME_ENABLED = process.env.VO_RATE_LIMIT_RESUME !== "0";
     sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
     safeProgress = makeSafeProgress(log);
-    invokedDirectly2 = process.argv[1] && fileURLToPath8(import.meta.url) === process.argv[1] && // Bundle-safe: self-start only when THIS file is the real entry (not inlined into vo-mcp's runner-cli.js ⇒ double-claim).
+    invokedDirectly = process.argv[1] && fileURLToPath7(import.meta.url) === process.argv[1] && // Bundle-safe: self-start only when THIS file is the real entry (not inlined into vo-mcp's runner-cli.js ⇒ double-claim).
     import.meta.url.endsWith("code-runner-daemon.mjs");
-    if (invokedDirectly2) {
+    if (invokedDirectly) {
       const once2 = process.argv.includes("--once");
-      main2({ once: once2 }).catch((err) => {
+      main({ once: once2 }).catch((err) => {
         console.error("[code-runner] fatal:", err);
         process.exit(1);
       });
@@ -14237,8 +14120,8 @@ var env = {
   ...pairedOperatorId ? { VO_CODE_RUNNER_OPERATOR_IDS: pairedOperatorId } : {}
 };
 var once = process.argv.includes("--once");
-var { main: main3 } = await Promise.resolve().then(() => (init_code_runner_daemon(), code_runner_daemon_exports));
-main3({ env, once }).catch((err) => {
+var { main: main2 } = await Promise.resolve().then(() => (init_code_runner_daemon(), code_runner_daemon_exports));
+main2({ env, once }).catch((err) => {
   console.error("[vo-mcp runner] fatal:", err);
   process.exit(1);
 });