@algosuite/vo-mcp 0.2.0-beta.7 → 0.2.0-beta.8

package/dist/runner-supervisor.js

@@ -0,0 +1,777 @@
+import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/runner/control-plane-auth-stub.mjs
+var control_plane_auth_stub_exports = {};
+__export(control_plane_auth_stub_exports, {
+  getFirebaseAuth: () => getFirebaseAuth
+});
+async function getFirebaseAuth() {
+  throw new Error(
+    "vo-mcp runner: no control-plane credential. Run `vo-mcp login` first \u2014 the runner authenticates with your stored vo_credential (or set VO_CONTROL_PLANE_ADMIN_TOKEN)."
+  );
+}
+var init_control_plane_auth_stub = __esm({
+  "src/runner/control-plane-auth-stub.mjs"() {
+  }
+});
+
+// src/runner-supervisor.mjs
+import { spawn } from "node:child_process";
+import { createRequire as createRequire2 } from "node:module";
+import { fileURLToPath } from "node:url";
+import { dirname as dirname2, join as join2 } from "node:path";
+
+// ../../scripts/virtual-office/code-runner/control-plane-client.mjs
+var cachedFirebaseToken = null;
+async function resolveBearer(env) {
+  const adminToken = env.VO_CONTROL_PLANE_ADMIN_TOKEN;
+  if (adminToken) return adminToken;
+  if (cachedFirebaseToken) return cachedFirebaseToken;
+  const { getFirebaseAuth: getFirebaseAuth2 } = await Promise.resolve().then(() => (init_control_plane_auth_stub(), control_plane_auth_stub_exports));
+  const auth = await getFirebaseAuth2({ env });
+  if (!auth || !auth.idToken) {
+    throw new Error(
+      "no control-plane credential: set VO_CONTROL_PLANE_ADMIN_TOKEN, or SMOKE_EMAIL/SMOKE_PASSWORD/SMOKE_API_KEY"
+    );
+  }
+  cachedFirebaseToken = auth.idToken;
+  return cachedFirebaseToken;
+}
+function createControlPlaneClient({
+  baseUrl = process.env.VO_CONTROL_PLANE_URL || "",
+  env = process.env,
+  fetchImpl = fetch
+} = {}) {
+  if (!baseUrl) {
+    throw new Error("VO_CONTROL_PLANE_URL is required for the code-runner daemon");
+  }
+  const root = baseUrl.replace(/\/+$/, "");
+  async function req(method, path, body) {
+    const bearer = await resolveBearer(env);
+    return fetchImpl(`${root}${path}`, {
+      method,
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${bearer}`
+      },
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+  }
+  return {
+    /**
+     * Claim the next pending task. Returns the task or null (empty queue).
+     * `repos` (optional `owner/name` list) and `operatorIds` (optional
+     * `operator_id` list) scope the claim so this daemon only picks up tasks it
+     * serves — the control-plane filters by both (logical AND), so another
+     * operator's task never lands on (or bills) this machine.
+     */
+    async claim(runnerId2, repos, operatorIds, session = {}) {
+      const body = { runner_id: runnerId2 };
+      if (Array.isArray(repos) && repos.length > 0) body.repos = repos;
+      if (Array.isArray(operatorIds) && operatorIds.length > 0) body.operator_ids = operatorIds;
+      if (session.runnerInstanceId) body.runner_instance_id = session.runnerInstanceId;
+      if (session.runnerInstanceId && session.reconcileStale) body.reconcile_stale = true;
+      const res = await req("POST", "/api/v1/code-task/claim", body);
+      if (res.status === 401) {
+        cachedFirebaseToken = null;
+        throw new Error("claim unauthorized (401)");
+      }
+      if (!res.ok) throw new Error(`claim failed: HTTP ${res.status}`);
+      const json = await res.json();
+      return json && json.task ? json.task : null;
+    },
+    /**
+     * Enqueue a new code-task (used by the PR watcher to auto-dispatch a CI fix).
+     * Server derives operator/tenant from the daemon's authenticated principal.
+     * Returns the created task, or throws on a non-2xx response.
+     */
+    async enqueueCodeTask({ repo, prompt, max_budget_usd, max_turns }) {
+      const body = { repo, prompt };
+      if (typeof max_budget_usd === "number") body.max_budget_usd = max_budget_usd;
+      if (typeof max_turns === "number") body.max_turns = max_turns;
+      const res = await req("POST", "/api/v1/code-task", body);
+      if (res.status === 401) {
+        cachedFirebaseToken = null;
+        throw new Error("enqueue unauthorized (401)");
+      }
+      if (!res.ok) throw new Error(`enqueue failed: HTTP ${res.status}`);
+      const json = await res.json();
+      return json && json.task ? json.task : null;
+    },
+    /**
+     * Resume a failed/cancelled/max-turn partial code-task. The PR watcher uses
+     * this after the runner opens a partial draft PR and CI is no longer pending.
+     */
+    async resumeCodeTask(taskId) {
+      const res = await req("POST", `/api/v1/code-task/${encodeURIComponent(taskId)}/resume`, {});
+      if (res.status === 401) {
+        cachedFirebaseToken = null;
+        throw new Error("resume unauthorized (401)");
+      }
+      if (!res.ok) throw new Error(`resume failed: HTTP ${res.status}`);
+      const json = await res.json();
+      return json && json.task ? json.task : null;
+    },
+    /**
+     * Send a CI-green PR through the production verify-before-act merge route.
+     * The server inspects the current diff, applies deterministic blockers, runs
+     * consensus, records a receipt, and direct-merges only the inspected SHA.
+     */
+    async mergeVerifiedPr(prNumber, automationContext) {
+      const res = await req("POST", "/api/v1/admin/pr/merge", { prNumber, automationContext });
+      if (res.status === 401) {
+        cachedFirebaseToken = null;
+        throw new Error("gated merge unauthorized (401)");
+      }
+      const json = await res.json().catch(() => ({}));
+      if (res.ok && json?.ok === true) {
+        const result = json?.result && typeof json.result === "object" ? json.result : {};
+        const status = result.merged === true || result.status === "merged" ? "merged" : result.status === "auto-merge-enabled" || String(result.action || "").includes("auto-merge") ? "queued" : "accepted";
+        return {
+          status,
+          detail: typeof result.detail === "string" ? result.detail : null,
+          actionReceiptId: typeof json.action_receipt_id === "string" ? json.action_receipt_id : null
+        };
+      }
+      if (res.status === 503 && json?.error === "verify_unavailable") {
+        return { status: "retry", reason: json.reason || "verification unavailable" };
+      }
+      return {
+        status: "blocked",
+        reason: json?.reason || json?.message || json?.error || `HTTP ${res.status}`,
+        actionReceiptId: typeof json?.action_receipt_id === "string" ? json.action_receipt_id : null
+      };
+    },
+    /**
+     * Append progress / set terminal status. Returns
+     *   { task }            — applied
+     *   { terminal: true }  — task already terminal (operator cancelled): STOP
+     */
+    async postProgress(taskId, patch) {
+      const res = await req("PATCH", `/api/v1/code-task/${taskId}/progress`, patch);
+      if (res.status === 409) return { terminal: true };
+      if (res.status === 404) return { terminal: true, missing: true };
+      if (!res.ok) throw new Error(`progress failed: HTTP ${res.status}`);
+      const json = await res.json();
+      return { task: json && json.task };
+    },
+    /** Read the current task (cancel detection). Null on 404. */
+    async getTask(taskId) {
+      const res = await req("GET", `/api/v1/code-task/${taskId}`);
+      if (res.status === 404) return null;
+      if (!res.ok) throw new Error(`getTask failed: HTTP ${res.status}`);
+      const json = await res.json();
+      return json ? json.task : null;
+    },
+    /** Fetch bounded, prompt-ready VO knowledge snippets for this task. */
+    async getTaskKnowledgeContext(taskId, { query } = {}) {
+      const body = {};
+      if (typeof query === "string" && query.trim()) body.query = query;
+      const res = await req("POST", `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`, body);
+      if (res.status === 401) {
+        cachedFirebaseToken = null;
+        throw new Error("knowledge-context unauthorized (401)");
+      }
+      if (res.status === 404) return null;
+      if (!res.ok) throw new Error(`knowledge-context failed: HTTP ${res.status}`);
+      return res.json();
+    },
+    /**
+     * Report this machine's rolling-7-day Claude Code token usage (the real
+     * weekly-capacity gauge) PLUS the operator's real Claude weekly % (when
+     * available). The daemon authenticates as admin, so the target `operatorId`
+     * is named explicitly. Best-effort; throws on a non-2xx so the caller can
+     * log + move on.
+     *
+     * `tokens` = { input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens }.
+     * Optional: `claudeWeeklyPct` (number) + `claudeWeeklyResetsAt` (ISO string | null).
+     */
+    async postWeeklyTokens({ operatorId, runnerId: runnerId2, tokens, claudeWeeklyPct, claudeWeeklyResetsAt }) {
+      const body = {
+        operator_id: operatorId,
+        runner_id: runnerId2,
+        input_tokens: tokens.input_tokens,
+        output_tokens: tokens.output_tokens,
+        cache_creation_tokens: tokens.cache_creation_tokens,
+        cache_read_tokens: tokens.cache_read_tokens
+      };
+      if (typeof claudeWeeklyPct === "number") {
+        body.claude_weekly_pct = claudeWeeklyPct;
+      }
+      if (claudeWeeklyResetsAt !== void 0) {
+        body.claude_weekly_resets_at = claudeWeeklyResetsAt;
+      }
+      const res = await req("POST", "/api/v1/weekly-tokens", body);
+      if (res.status === 401) {
+        cachedFirebaseToken = null;
+        throw new Error("weekly-tokens unauthorized (401)");
+      }
+      if (!res.ok) throw new Error(`weekly-tokens failed: HTTP ${res.status}`);
+      return true;
+    },
+    /**
+     * Send a liveness heartbeat (M2). The control-plane upserts it under the
+     * authenticated operator so the web shows a TRUE "runner online" signal.
+     * Best-effort caller; throws on 401/non-ok so the daemon can log + retry.
+     */
+    async postHeartbeat({ runnerId: runnerId2, operatorId, uptimeSec, activeTasks, version, servedRepos, servedOperators, availableAgents, accountUsage }) {
+      const body = { runner_id: runnerId2 };
+      if (operatorId) body.operator_id = operatorId;
+      if (typeof uptimeSec === "number") body.uptime_sec = uptimeSec;
+      if (typeof activeTasks === "number") body.active_tasks = activeTasks;
+      if (version) body.version = version;
+      if (Array.isArray(servedRepos) && servedRepos.length > 0) body.served_repos = servedRepos;
+      if (Array.isArray(servedOperators) && servedOperators.length > 0) {
+        body.served_operator_ids = servedOperators;
+      }
+      if (Array.isArray(availableAgents) && availableAgents.length > 0) {
+        body.available_agents = availableAgents;
+      }
+      if (Array.isArray(accountUsage) && accountUsage.length > 0) {
+        body.account_usage = accountUsage;
+      }
+      const res = await req("POST", "/api/v1/runner/heartbeat", body);
+      if (res.status === 401) {
+        cachedFirebaseToken = null;
+        throw new Error("heartbeat unauthorized (401)");
+      }
+      if (!res.ok) throw new Error(`heartbeat failed: HTTP ${res.status}`);
+      return true;
+    },
+    /** Poll one authenticated runner's durable Mission Control action queue. */
+    async pollRunnerControl({ runnerId: runnerId2, operatorId }) {
+      const body = { runner_id: runnerId2 };
+      if (operatorId) body.operator_id = operatorId;
+      const res = await req("POST", "/api/v1/runner/control/poll", body);
+      if (res.status === 401) {
+        cachedFirebaseToken = null;
+        throw new Error("runner control poll unauthorized (401)");
+      }
+      if (!res.ok) throw new Error(`runner control poll failed: HTTP ${res.status}`);
+      const json = await res.json();
+      const action = json?.action;
+      return action && typeof action.action_id === "string" && action.action_id ? { ...action, actionId: action.action_id } : null;
+    },
+    /** Acknowledge a maintenance action after the host has restarted the child. */
+    async completeRunnerControl(actionId, { runnerId: runnerId2, operatorId, status, detail }) {
+      const body = { runner_id: runnerId2, status };
+      if (operatorId) body.operator_id = operatorId;
+      if (detail) body.detail = detail;
+      const res = await req("POST", `/api/v1/runner/control/${encodeURIComponent(actionId)}/complete`, body);
+      if (res.status === 401) {
+        cachedFirebaseToken = null;
+        throw new Error("runner control completion unauthorized (401)");
+      }
+      if (!res.ok) throw new Error(`runner control completion failed: HTTP ${res.status}`);
+      const json = await res.json();
+      return json?.action || null;
+    },
+    /**
+     * Mint a short-lived (~1h), repo-scoped GitHub App installation token for
+     * THIS runner's operator (M3). The control-plane keys the mint on the
+     * authenticated operator (ctx.operator_id), so the token covers only that
+     * operator's installation.
+     *
+     * Returns { token, expiresAt } on success. In legacy/admin mode it returns
+     * null on a miss so the caller may use ambient `gh`. In scoped-operator mode
+     * callers pass `{ required: true }`, which fails closed instead of letting a
+     * missing/mis-scoped installation fall through to the runner machine's `gh`.
+     *
+     * The minted token is only usable for push + PR if the GitHub App grants
+     * BOTH `Contents: write` (git push) AND `Pull requests: write` (gh pr
+     * create) — see docs/vo/github-app-setup-2026-06-18.md. A token missing
+     * either scope fails at push (→ ambient fallback) or at `gh pr create`.
+     */
+    async getInstallationToken({ required = false } = {}) {
+      const fail = (reason) => {
+        if (required) throw new Error(`installation-token required: ${reason}`);
+        return null;
+      };
+      try {
+        const res = await req("POST", "/api/v1/github/installation-token", {});
+        if (!res.ok) return fail(`HTTP ${res.status}`);
+        const json = await res.json();
+        if (!json || !json.token) return fail("missing token");
+        return { token: json.token, expiresAt: json.expires_at || null };
+      } catch (err) {
+        if (required) throw err;
+        return null;
+      }
+    },
+    /**
+     * Read the operator's dispatch-mode config (Fast→Ultracode effort setting).
+     * Returns the mode string ('fast'|'standard'|'deep'|'ultra'|'ultracode'),
+     * defaulting to 'standard' on any error. Never throws — best-effort.
+     */
+    async getDispatchMode() {
+      try {
+        const res = await req("GET", "/api/v1/dispatch-mode-config");
+        if (!res.ok) return "standard";
+        const json = await res.json();
+        return json?.dispatchMode || "standard";
+      } catch {
+        return "standard";
+      }
+    }
+  };
+}
+
+// ../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs
+import { spawnSync } from "node:child_process";
+var DEFAULT_RUNNER_PACKAGE = "@algosuite/vo-mcp@beta";
+var PACKAGE_SPEC_RE = /^@algosuite\/vo-mcp@(beta|latest|\d+(?:\.\d+){0,2}(?:-[\w.-]+)?)$/u;
+function buildMaintenanceCommand(kind, { platform = process.platform, packageSpec = DEFAULT_RUNNER_PACKAGE } = {}) {
+  if (!["update", "reinstall"].includes(kind)) return null;
+  if (!PACKAGE_SPEC_RE.test(packageSpec)) throw new Error("unsafe runner package spec");
+  const command = platform === "win32" ? "npm.cmd" : "npm";
+  const args = ["install", "-g", packageSpec];
+  if (kind === "reinstall") args.push("--force");
+  return { command, args };
+}
+function runHostMaintenance(kind, {
+  platform = process.platform,
+  packageSpec = DEFAULT_RUNNER_PACKAGE,
+  env = process.env,
+  spawn: spawn2 = spawnSync,
+  log = () => {
+  }
+} = {}) {
+  if (kind === "reconnect") return { ok: true, status: 0, command: null, args: [] };
+  const command = buildMaintenanceCommand(kind, { platform, packageSpec });
+  if (!command) return { ok: false, status: 2, command: null, args: [] };
+  log(`runner maintenance: ${command.command} ${command.args.join(" ")}`);
+  const result = spawn2(command.command, command.args, { stdio: "inherit", env, shell: false });
+  const status = typeof result.status === "number" ? result.status : 1;
+  return { ok: status === 0, status, command: command.command, args: command.args };
+}
+
+// src/cloud/credential-store.ts
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  chmodSync,
+  rmSync
+} from "node:fs";
+
+// src/cloud/keychain.ts
+import { createRequire } from "node:module";
+var SERVICE = "vo-mcp";
+var ACCOUNT = "refresh-credential";
+var cached;
+function loadKeyring() {
+  if (cached !== void 0) return cached;
+  try {
+    const req = createRequire(import.meta.url);
+    const mod = req("@napi-rs/keyring");
+    cached = mod && typeof mod.Entry === "function" ? mod : null;
+  } catch {
+    cached = null;
+  }
+  return cached;
+}
+function keychainAvailable() {
+  return loadKeyring() !== null;
+}
+function keychainGet() {
+  const k = loadKeyring();
+  if (!k) return null;
+  try {
+    return new k.Entry(SERVICE, ACCOUNT).getPassword();
+  } catch {
+    return null;
+  }
+}
+function keychainSet(secret) {
+  const k = loadKeyring();
+  if (!k) return false;
+  try {
+    new k.Entry(SERVICE, ACCOUNT).setPassword(secret);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function keychainDelete() {
+  const k = loadKeyring();
+  if (!k) return false;
+  try {
+    return new k.Entry(SERVICE, ACCOUNT).deletePassword();
+  } catch {
+    return false;
+  }
+}
+
+// src/cloud/credential-store.ts
+var realKeychain = {
+  available: keychainAvailable,
+  get: keychainGet,
+  set: keychainSet,
+  delete: keychainDelete
+};
+function credentialPath(env = process.env) {
+  const override = env["VO_MCP_CREDENTIALS_PATH"]?.trim();
+  if (override) return override;
+  return join(homedir(), ".config", "vo-mcp", "credentials.json");
+}
+function keychainEnabled(env, keychain) {
+  const disabled = (env["VO_MCP_DISABLE_KEYCHAIN"] ?? "").trim().toLowerCase();
+  if (disabled === "1" || disabled === "true" || disabled === "yes") return false;
+  return keychain.available();
+}
+function deserialize(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const refresh = typeof parsed.refresh_token === "string" ? parsed.refresh_token.trim() : "";
+    const apiKey = typeof parsed.api_key === "string" ? parsed.api_key.trim() : "";
+    const voCred = typeof parsed.vo_credential === "string" ? parsed.vo_credential.trim() : "";
+    if (!voCred && (!refresh || !apiKey)) return null;
+    return {
+      ...refresh ? { refresh_token: refresh } : {},
+      ...apiKey ? { api_key: apiKey } : {},
+      ...voCred ? { vo_credential: voCred } : {},
+      ...typeof parsed.vo_credential_expires_at === "string" ? { vo_credential_expires_at: parsed.vo_credential_expires_at } : {},
+      ...typeof parsed.email === "string" ? { email: parsed.email } : {},
+      ...typeof parsed.stored_at === "string" ? { stored_at: parsed.stored_at } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function readFromFile(env) {
+  try {
+    const p = credentialPath(env);
+    if (!existsSync(p)) return null;
+    return deserialize(readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function readStoredCredential(env = process.env, keychain = realKeychain) {
+  if (keychainEnabled(env, keychain)) {
+    const raw = keychain.get();
+    const fromKeychain = raw ? deserialize(raw) : null;
+    if (fromKeychain) return fromKeychain;
+  }
+  return readFromFile(env);
+}
+
+// src/runner/supervisor-child-env.mjs
+import { hostname as systemHostname } from "node:os";
+
+// src/runner-readiness.mjs
+function failed({ paired = false, operatorId = null, tenantId = null, githubReady = null, error, message }) {
+  return { ok: false, paired, operatorId, tenantId, githubReady, error, message };
+}
+async function responseBody(response) {
+  try {
+    const value = await response.json();
+    return value && typeof value === "object" ? value : {};
+  } catch {
+    return {};
+  }
+}
+function serverMessage(body, fallback) {
+  return typeof body.message === "string" && body.message.trim() ? body.message.trim() : fallback;
+}
+async function fetchWithTimeout(fetchImpl, url, init, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetchImpl(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function probeRunnerReadiness({
+  controlPlaneUrl,
+  token,
+  fetchImpl = fetch,
+  requireGithub = false,
+  timeoutMs = 1e4
+}) {
+  const base = controlPlaneUrl.replace(/\/+$/u, "");
+  const headers = { authorization: `Bearer ${token}` };
+  let identityResponse;
+  try {
+    identityResponse = await fetchWithTimeout(
+      fetchImpl,
+      `${base}/api/v1/auth/me`,
+      { headers },
+      timeoutMs
+    );
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return failed({
+      error: "control_plane_unreachable",
+      message: `Virtual Office could not be reached: ${detail}`
+    });
+  }
+  const identity = await responseBody(identityResponse);
+  if (!identityResponse.ok) {
+    return failed({
+      error: "credential_rejected",
+      message: "The saved pairing is expired or revoked. Pair this computer again."
+    });
+  }
+  if (identity.provisioned !== true || identity.role !== "operator" || typeof identity.operator_id !== "string" || !identity.operator_id.trim() || typeof identity.tenant_id !== "string" || !identity.tenant_id.trim()) {
+    return failed({
+      error: "operator_identity_missing",
+      message: "The pairing credential is valid but has no operator identity. Pair this computer again."
+    });
+  }
+  const operatorId = identity.operator_id.trim();
+  const tenantId = identity.tenant_id.trim();
+  if (!requireGithub) {
+    return {
+      ok: true,
+      paired: true,
+      operatorId,
+      tenantId,
+      githubReady: null,
+      error: null,
+      message: "Paired to Virtual Office."
+    };
+  }
+  let githubResponse;
+  try {
+    githubResponse = await fetchWithTimeout(
+      fetchImpl,
+      `${base}/api/v1/github/installation-token`,
+      {
+        method: "POST",
+        headers: { ...headers, "content-type": "application/json" },
+        body: "{}"
+      },
+      timeoutMs
+    );
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return failed({
+      paired: true,
+      operatorId,
+      tenantId,
+      githubReady: false,
+      error: "github_preflight_unreachable",
+      message: `GitHub publication readiness could not be checked: ${detail}`
+    });
+  }
+  const github = await responseBody(githubResponse);
+  if (!githubResponse.ok || typeof github.token !== "string" || !github.token) {
+    const error = typeof github.error === "string" && github.error ? github.error : "github_not_ready";
+    return failed({
+      paired: true,
+      operatorId,
+      tenantId,
+      githubReady: false,
+      error,
+      message: serverMessage(github, `GitHub publication preflight failed (HTTP ${githubResponse.status}).`)
+    });
+  }
+  return {
+    ok: true,
+    paired: true,
+    operatorId,
+    tenantId,
+    githubReady: true,
+    error: null,
+    message: "Paired and ready to publish through the Algosuite GitHub App."
+  };
+}
+function pairedOperatorScope(readiness) {
+  return readiness?.ok === true && readiness?.paired === true && typeof readiness.operatorId === "string" && readiness.operatorId.trim() ? readiness.operatorId.trim() : null;
+}
+
+// src/runner/supervisor-child-env.mjs
+function resolveSupervisorRunnerId(env = {}, hostname = systemHostname) {
+  const explicit = String(env.VO_CODE_RUNNER_ID || "").trim();
+  return explicit || `vo-code-runner-${hostname()}`;
+}
+function buildSupervisorChildEnv({
+  baseEnv = {},
+  controlPlaneUrl,
+  explicitAdminToken = null,
+  pairedOperatorId = null
+} = {}) {
+  const childEnv = {
+    ...baseEnv,
+    VO_CONTROL_PLANE_URL: controlPlaneUrl
+  };
+  const adminToken = typeof explicitAdminToken === "string" ? explicitAdminToken.trim() : "";
+  const operatorId = typeof pairedOperatorId === "string" ? pairedOperatorId.trim() : "";
+  if (adminToken) childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN = adminToken;
+  else delete childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN;
+  if (operatorId) childEnv.VO_CODE_RUNNER_OPERATOR_IDS = operatorId;
+  return childEnv;
+}
+async function prepareSupervisorAuth({
+  baseEnv = {},
+  storedCredential = null,
+  controlPlaneUrl,
+  probeReadiness = probeRunnerReadiness
+} = {}) {
+  const explicitAdminToken = baseEnv.VO_CONTROL_PLANE_ADMIN_TOKEN?.trim();
+  const token = explicitAdminToken || storedCredential?.vo_credential;
+  if (!token) throw new Error("runner is not paired; run `vo-mcp pair` once on this host");
+  let operatorId = String(baseEnv.VO_CODE_RUNNER_OPERATOR_IDS || "").split(/[\s,]+/u).filter(Boolean)[0] || void 0;
+  if (!explicitAdminToken) {
+    const readiness = await probeReadiness({ controlPlaneUrl, token, requireGithub: true });
+    if (!readiness.ok) throw new Error(`runner readiness failed: ${readiness.message}`);
+    operatorId = pairedOperatorScope(readiness) || void 0;
+    if (!operatorId) throw new Error("runner readiness failed: paired operator scope is missing");
+  }
+  const childEnv = buildSupervisorChildEnv({
+    baseEnv,
+    controlPlaneUrl,
+    explicitAdminToken,
+    pairedOperatorId: explicitAdminToken ? null : operatorId
+  });
+  const clientEnv = {
+    ...baseEnv,
+    VO_CONTROL_PLANE_ADMIN_TOKEN: token,
+    VO_CONTROL_PLANE_URL: controlPlaneUrl,
+    ...operatorId ? { VO_CODE_RUNNER_OPERATOR_IDS: operatorId } : {}
+  };
+  return { childEnv, clientEnv, operatorId };
+}
+
+// src/runner-supervisor.mjs
+var DEFAULT_CONTROL_PLANE_URL = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
+var POLL_MS = 5e3;
+var CHILD_START_MS = 1500;
+var childEntry = join2(dirname2(fileURLToPath(import.meta.url)), "runner-cli.js");
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var runnerId = resolveSupervisorRunnerId(process.env);
+function packageVersion() {
+  try {
+    return createRequire2(import.meta.url)("../package.json").version || "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function spawnChild(childEnv) {
+  return spawn(process.execPath, [childEntry], {
+    env: childEnv,
+    stdio: "inherit",
+    windowsHide: true
+  });
+}
+async function localStatus() {
+  try {
+    const port = Number(process.env.VO_CODE_RUNNER_CONTROL_PORT || 7787);
+    const response = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(800) });
+    if (!response.ok) return null;
+    const body = await response.json();
+    return body?.ok === true ? body : null;
+  } catch {
+    return null;
+  }
+}
+async function waitForLocalRunner(child) {
+  const deadline = Date.now() + 15e3;
+  while (Date.now() < deadline) {
+    if (child.exitCode !== null) return false;
+    if ((await localStatus())?.running === true) return true;
+    await sleep(500);
+  }
+  return false;
+}
+async function stopChild(child) {
+  if (!child || child.exitCode !== null) return;
+  child.kill(process.platform === "win32" ? void 0 : "SIGTERM");
+  await Promise.race([
+    new Promise((resolve) => child.once("exit", resolve)),
+    sleep(15e3)
+  ]);
+  if (child.exitCode === null) child.kill("SIGKILL");
+}
+async function main() {
+  const stored = readStoredCredential();
+  const controlPlaneUrl = process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL;
+  const { childEnv, clientEnv, operatorId } = await prepareSupervisorAuth({
+    baseEnv: process.env,
+    storedCredential: stored,
+    controlPlaneUrl
+  });
+  const client = createControlPlaneClient({ baseUrl: controlPlaneUrl, env: clientEnv });
+  let child = spawnChild(childEnv);
+  let stopping = false;
+  let handling = false;
+  const respawn = () => {
+    if (!stopping && !handling && (!child || child.exitCode !== null)) child = spawnChild(childEnv);
+  };
+  child.on("exit", () => setTimeout(respawn, 2e3));
+  const shutdown = async () => {
+    if (stopping) return;
+    stopping = true;
+    await stopChild(child);
+  };
+  process.on("SIGINT", () => {
+    void shutdown().finally(() => process.exit(0));
+  });
+  process.on("SIGTERM", () => {
+    void shutdown().finally(() => process.exit(0));
+  });
+  while (!stopping) {
+    try {
+      const action = await client.pollRunnerControl({ runnerId, ...operatorId ? { operatorId } : {} });
+      if (!action) {
+        await sleep(POLL_MS);
+        continue;
+      }
+      handling = true;
+      const beforeStop = await localStatus();
+      if (beforeStop && Number(beforeStop.activeTasks || 0) > 0) {
+        await client.completeRunnerControl(action.actionId, {
+          runnerId,
+          ...operatorId ? { operatorId } : {},
+          status: "failed",
+          detail: `deferred safely: ${beforeStop.activeTasks} active task(s); retry when the runner is idle`
+        });
+        handling = false;
+        continue;
+      }
+      await stopChild(child);
+      const result = runHostMaintenance(action.kind, {
+        env: clientEnv,
+        log: (message) => console.warn(`[vo-runner supervisor] ${message}`)
+      });
+      child = spawnChild(childEnv);
+      await sleep(CHILD_START_MS);
+      if (child.exitCode !== null || !await waitForLocalRunner(child)) result.ok = false;
+      await client.completeRunnerControl(action.actionId, {
+        runnerId,
+        ...operatorId ? { operatorId } : {},
+        status: result.ok ? "succeeded" : "failed",
+        detail: result.ok ? `runner ${packageVersion()} reconnected` : `maintenance exited ${result.status}`
+      });
+      handling = false;
+    } catch (error) {
+      console.error(`[vo-runner supervisor] ${error instanceof Error ? error.message : String(error)}`);
+      handling = false;
+      await sleep(POLL_MS);
+    }
+  }
+}
+main().catch((error) => {
+  console.error(`[vo-runner supervisor] fatal: ${error instanceof Error ? error.message : String(error)}`);
+  process.exitCode = 1;
+});
+//# sourceMappingURL=runner-supervisor.js.map