@algosuite/vo-mcp 0.2.0-beta.72 → 0.2.0-beta.73

package/dist/runner-supervisor.js

@@ -32,7 +32,7 @@ var init_control_plane_auth_stub = __esm({
 // src/runner-supervisor.mjs
 import { spawn } from "node:child_process";
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { createRequire } from "node:module";
+import { createRequire as createRequire2 } from "node:module";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { dirname as dirname4, join as join5 } from "node:path";
 
@@ -61,6 +61,60 @@ async function fetchInstallationToken({ req, required = false, readOnly = false,
   }
 }
 
+// ../../scripts/virtual-office/code-runner/claude-credential-choice.mjs
+var CLAUDE_CREDENTIAL_SOURCE = Object.freeze({
+  /** PREFER_LOGIN set (and not overridden): any API key is ignored. */
+  PREFER_LOGIN: "prefer_login",
+  /** An explicit ANTHROPIC_API_KEY in the environment — the manual override. */
+  ENV_KEY: "env_key",
+  /** No key anywhere; the spawn falls through to the login session. */
+  NO_KEY: "no_key",
+  /** A stored key, used because the operator explicitly opted out of tier 1. */
+  KEYCHAIN_PREFER_KEY: "keychain_prefer_key",
+  /** A stored key exists but a proven live subscription outranks it. */
+  SUBSCRIPTION_WINS: "subscription_wins",
+  /** A stored key, used because no live subscription was proven. */
+  KEYCHAIN: "keychain"
+});
+
+// ../../scripts/virtual-office/code-runner/anthropic-key-store.mjs
+import { createRequire } from "node:module";
+import { spawnSync as spawnSync2 } from "node:child_process";
+
+// ../../scripts/virtual-office/code-runner/windows-claude-launch.mjs
+import { existsSync, realpathSync } from "node:fs";
+import { win32 as path } from "node:path";
+import { spawnSync } from "node:child_process";
+
+// ../../scripts/virtual-office/code-runner/anthropic-key-store.mjs
+var require2 = createRequire(import.meta.url);
+var AUTH_SOURCE_DESCRIPTION = Object.freeze({
+  [CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN]: "claude auth login (VO_RUNNER_PREFER_LOGIN set \u2014 any API key ignored)",
+  [CLAUDE_CREDENTIAL_SOURCE.ENV_KEY]: "ANTHROPIC_API_KEY from environment",
+  [CLAUDE_CREDENTIAL_SOURCE.NO_KEY]: "claude auth login session (no API key set)",
+  [CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN_PREFER_KEY]: "ANTHROPIC_API_KEY from OS keychain (VO_RUNNER_PREFER_KEY set \u2014 subscription ignored)",
+  [CLAUDE_CREDENTIAL_SOURCE.SUBSCRIPTION_WINS]: "claude auth login session (subscription beats the stored keychain key)",
+  [CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN]: "ANTHROPIC_API_KEY from OS keychain"
+});
+
+// ../../scripts/virtual-office/code-runner/agent-auth-attestation.mjs
+var AGENT_AUTH_SOURCE = Object.freeze({
+  /** A flat-cost linked account (`claude auth login`). No per-token vendor bill. */
+  LOGIN: "login",
+  /** A metered per-token credential the vendor bills. */
+  API_KEY: "api_key"
+});
+var AGENT_AUTH_SOURCES = Object.freeze([
+  AGENT_AUTH_SOURCE.LOGIN,
+  AGENT_AUTH_SOURCE.API_KEY
+]);
+var API_BILLING_ENV_NAMES = Object.freeze([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_API_KEY"
+]);
+var API_BILLING_ENV_NAME_SET = new Set(API_BILLING_ENV_NAMES);
+
 // ../../scripts/virtual-office/code-runner/control-plane-heartbeat-body.mjs
 function buildRunnerHeartbeatBody({
   runnerId: runnerId2,
@@ -86,6 +140,8 @@ function buildRunnerHeartbeatBody({
   accountUsage,
   availableLocalModels,
   supportedTaskKinds,
+  hostHealth,
+  agentAuthSource,
   prepared_job_shadow: preparedJobShadow
 } = {}) {
   const body = { runner_id: runnerId2, ...preparedJobShadow ? { prepared_job_shadow: preparedJobShadow } : {} };
@@ -123,6 +179,8 @@ function buildRunnerHeartbeatBody({
   if (Array.isArray(supportedTaskKinds) && supportedTaskKinds.length > 0) {
     body.supported_task_kinds = supportedTaskKinds;
   }
+  if (hostHealth && typeof hostHealth === "object") body.host_health = hostHealth;
+  if (AGENT_AUTH_SOURCES.includes(agentAuthSource)) body.agent_auth_source = agentAuthSource;
   return body;
 }
 
@@ -381,13 +439,13 @@ async function getTaskKnowledgeContextRequest(req, taskId, { query, knowledgeReq
   const canonicalQuery = canonicalizeKnowledgeContextQuery(query);
   if (canonicalQuery.trim()) body.query = canonicalQuery;
   if (typeof knowledgeRequestId === "string" && knowledgeRequestId) body.knowledge_request_id = knowledgeRequestId;
-  const path2 = `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`;
+  const path3 = `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`;
   const timeoutMs = Math.max(Number(taskRequestTimeoutMs) || 0, MIN_KNOWLEDGE_CONTEXT_TIMEOUT_MS);
   for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt += 1) {
     let res;
     let cause;
     try {
-      res = await req("POST", path2, body, { timeoutMs });
+      res = await req("POST", path3, body, { timeoutMs });
     } catch (err) {
       cause = err;
     }
@@ -456,10 +514,10 @@ async function getPreparedJobRequest(req, taskId, options = {}, invalidateToken
   if (typeof taskId !== "string" || taskId.length === 0) {
     return { ok: false, reason: "missing_task_id", status: 0, ...envMeta };
   }
-  const path2 = `/api/v1/code-task/${encodeURIComponent(taskId)}/prepared-job?${query}`;
+  const path3 = `/api/v1/code-task/${encodeURIComponent(taskId)}/prepared-job?${query}`;
   let res;
   try {
-    res = await req("GET", path2, void 0, { timeoutMs });
+    res = await req("GET", path3, void 0, { timeoutMs });
   } catch (err) {
     return { ok: false, reason: `transport: ${err?.message || String(err)}`, status: 0, ...envMeta };
   }
@@ -535,11 +593,11 @@ function createControlPlaneClient({
   if (!resolvedBaseUrl) throw new Error("VO_CONTROL_PLANE_URL is required for the code-runner daemon");
   const root = resolvedBaseUrl.replace(/\/+$/, "");
   const claimOccurrences = /* @__PURE__ */ new Map();
-  async function req(method, path2, body, { timeoutMs } = {}) {
+  async function req(method, path3, body, { timeoutMs } = {}) {
     const bearer = await resolveBearer(env);
     const controller = timeoutMs ? new AbortController() : null;
     let timeoutId;
-    const request = Promise.resolve(fetchImpl(`${root}${path2}`, {
+    const request = Promise.resolve(fetchImpl(`${root}${path3}`, {
       method,
       headers: {
         "content-type": "application/json",
@@ -552,7 +610,7 @@ function createControlPlaneClient({
     const timeout = new Promise((_, reject) => {
       timeoutId = setTimeout(() => {
         controller.abort();
-        reject(new Error(`control-plane ${path2} timed out after ${timeoutMs}ms`));
+        reject(new Error(`control-plane ${path3} timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
     try {
@@ -561,7 +619,7 @@ function createControlPlaneClient({
       clearTimeout(timeoutId);
     }
   }
-  const taskReq = (method, path2, body, options = {}) => req(method, path2, body, { timeoutMs: taskRequestTimeoutMs, ...options });
+  const taskReq = (method, path3, body, options = {}) => req(method, path3, body, { timeoutMs: taskRequestTimeoutMs, ...options });
   const claimGate = makeClaimGateNotice({ log: (m) => console.warn(`[code-runner ${(/* @__PURE__ */ new Date()).toISOString()}] ${m}`) });
   return {
     getClaimGate: () => claimGate.current(),
@@ -590,6 +648,7 @@ function createControlPlaneClient({
       }
       if (session.runnerInstanceId && session.reconcileStale) body.reconcile_stale = true;
       if (session.defaultAgent) body.default_agent = session.defaultAgent;
+      if (AGENT_AUTH_SOURCES.includes(session.agentAuthSource)) body.agent_auth_source = session.agentAuthSource;
       if (Array.isArray(session.availableAgents)) {
         body.available_agents = session.availableAgents.filter((entry) => entry?.installed === true && entry?.authenticated === true).map((entry) => entry.agent);
       }
@@ -732,8 +791,8 @@ function createControlPlaneClient({
       return listAllPrOpenedTasks(taskReq);
     },
     async downloadTaskAttachment(taskId, attachmentId) {
-      const path2 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
-      const res = await taskReq("GET", path2);
+      const path3 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
+      const res = await taskReq("GET", path3);
       if (res.status === 401) cachedFirebaseToken = null;
       if (!res.ok) throw new Error(`attachment download failed: HTTP ${res.status}`);
       return Buffer.from(await res.arrayBuffer());
@@ -864,8 +923,8 @@ function createControlPlaneClient({
 }
 
 // ../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs
-import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
 import { win32 } from "node:path";
 var DEFAULT_RUNNER_PACKAGE = "@algosuite/vo-mcp@beta";
 var PACKAGE_SPEC_RE = /^@algosuite\/vo-mcp@(beta|latest|\d+(?:\.\d+){0,2}(?:-[\w.-]+)?)$/u;
@@ -892,7 +951,7 @@ function isNpmCliPath(value) {
 function resolveNpmCli({
   env = process.env,
   execPath = process.execPath,
-  fileExists = existsSync
+  fileExists = existsSync2
 } = {}) {
   const candidates = [];
   if (isNpmCliPath(env.npm_execpath)) candidates.push(env.npm_execpath);
@@ -918,7 +977,7 @@ function buildMaintenanceCommand(kind, {
   packageSpec = DEFAULT_RUNNER_PACKAGE,
   env = process.env,
   execPath = process.execPath,
-  fileExists = existsSync
+  fileExists = existsSync2
 } = {}) {
   if (!["update", "reinstall"].includes(kind)) return null;
   if (!PACKAGE_SPEC_RE.test(packageSpec)) throw new Error("unsafe runner package spec");
@@ -934,8 +993,8 @@ function runHostMaintenance(kind, {
   packageSpec = DEFAULT_RUNNER_PACKAGE,
   env = process.env,
   execPath = process.execPath,
-  fileExists = existsSync,
-  spawn: spawn2 = spawnSync,
+  fileExists = existsSync2,
+  spawn: spawn2 = spawnSync3,
   log = () => {
   }
 } = {}) {
@@ -973,7 +1032,7 @@ function runHostMaintenance(kind, {
 // src/runner/bundled-runtime-updater.mjs
 import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
 import {
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync2,
   readFileSync as readFileSync4,
@@ -983,7 +1042,7 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { basename, isAbsolute as isAbsolute3, join as join3, relative as relative3, resolve as resolve4, sep as sep2 } from "node:path";
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 
 // ../../scripts/virtual-office/runner-bootstrap/runtime-authorization.mjs
 import { createHash as createHash2 } from "node:crypto";
@@ -995,7 +1054,7 @@ import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import {
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   lstatSync,
   readFileSync,
   readdirSync
@@ -1118,10 +1177,10 @@ function validateLock(lock, authorization) {
   }
   return { actual, expected };
 }
-function checkPathKind(path2, expectedKind, fsOps, label) {
-  if (!fsOps.exists(path2)) throw new Error(`staged runtime ${label} missing`);
-  const stats = fsOps.lstat(path2);
-  if (isReparseStat(stats) || fsOps.isReparsePoint(path2, stats)) {
+function checkPathKind(path3, expectedKind, fsOps, label) {
+  if (!fsOps.exists(path3)) throw new Error(`staged runtime ${label} missing`);
+  const stats = fsOps.lstat(path3);
+  if (isReparseStat(stats) || fsOps.isReparsePoint(path3, stats)) {
     throw new Error(`staged runtime ${label} is a reparse point`);
   }
   if (expectedKind === "directory" && !stats.isDirectory()) {
@@ -1139,30 +1198,30 @@ function verifyInstalledPackages(payloadRoot, packageRecords, platform, fsOps) {
   const omitted = [];
   let installed = 0;
   for (const [key, entry] of Object.entries(packageRecords)) {
-    const path2 = resolve(payloadRoot, key);
-    assertContained(payloadRoot, path2, "package path");
+    const path3 = resolve(payloadRoot, key);
+    assertContained(payloadRoot, path3, "package path");
     const shouldOmit = isOmittedOptionalPackage(entry, platform);
     if (shouldOmit) {
       omitted.push(key);
-      if (fsOps.exists(path2)) throw new Error(`staged runtime optional package should be omitted: ${key}`);
+      if (fsOps.exists(path3)) throw new Error(`staged runtime optional package should be omitted: ${key}`);
       continue;
     }
-    checkPathKind(path2, "directory", fsOps, `installed package ${key}`);
+    checkPathKind(path3, "directory", fsOps, `installed package ${key}`);
     installed += 1;
   }
   return { installed, omitted: omitted.sort() };
 }
-function treeRecord(kind, path2, stats, fileHash = "") {
-  if (kind === "d") return `d	${path2}\r
+function treeRecord(kind, path3, stats, fileHash = "") {
+  if (kind === "d") return `d	${path3}\r
 `;
-  return `f	${path2}	${stats.size}	${fileHash}\r
+  return `f	${path3}	${stats.size}	${fileHash}\r
 `;
 }
 function computeInstalledTree(nodeModulesRoot, fsOps = {}) {
   const ops = {
-    exists: existsSync2,
+    exists: existsSync3,
     lstat: lstatSync,
-    readdir: (path2) => readdirSync(path2, { withFileTypes: true }),
+    readdir: (path3) => readdirSync(path3, { withFileTypes: true }),
     readFile: readFileSync,
     isReparsePoint: () => false,
     listReparsePoints: listWindowsReparsePoints,
@@ -1232,7 +1291,7 @@ function compareStagedRuntime({
     throw new Error("staged runtime paths do not identify one canonical payload");
   }
   const ops = {
-    exists: existsSync2,
+    exists: existsSync3,
     lstat: lstatSync,
     readFile: readFileSync,
     isReparsePoint: () => false,
@@ -1406,14 +1465,14 @@ if (process.argv[1] && resolve2(process.argv[1]) === fileURLToPath(import.meta.u
 import { createHash as createHash3, randomUUID } from "node:crypto";
 import {
   closeSync,
-  existsSync as existsSync3,
+  existsSync as existsSync4,
   fsyncSync,
   lstatSync as lstatSync2,
   mkdirSync,
   openSync,
   readFileSync as readFileSync3,
   readdirSync as readdirSync2,
-  realpathSync,
+  realpathSync as realpathSync2,
   renameSync,
   rmSync,
   writeFileSync
@@ -1517,7 +1576,7 @@ function atomicWriteJson(file, value) {
 }
 function readActivation(runtimeRoot) {
   const file = join2(runtimeRoot, "current.json");
-  if (!existsSync3(file)) return null;
+  if (!existsSync4(file)) return null;
   try {
     const value = JSON.parse(readFileSync3(file, "utf8"));
     return value?.schema_version === 1 ? value : null;
@@ -1563,7 +1622,7 @@ function validateSlot(runtimeRoot, active) {
     if (lstatSync2(paths.entry).isSymbolicLink() || lstatSync2(paths.supervisor).isSymbolicLink() || lstatSync2(paths.credentialHelper).isSymbolicLink()) {
       return { ok: false, detail: "runtime entry cannot be a link" };
     }
-    if (!within(paths.slotRoot, realpathSync(paths.entry)) || !within(paths.slotRoot, realpathSync(paths.supervisor)) || !within(paths.slotRoot, realpathSync(paths.credentialHelper))) {
+    if (!within(paths.slotRoot, realpathSync2(paths.entry)) || !within(paths.slotRoot, realpathSync2(paths.supervisor)) || !within(paths.slotRoot, realpathSync2(paths.credentialHelper))) {
       return { ok: false, detail: "runtime entry escaped its slot" };
     }
     if (hashFileSha512(paths.entry) !== active.entry_sha512) return { ok: false, detail: "entry hash mismatch" };
@@ -1636,7 +1695,7 @@ function attestCurrentSupervisor({ runtimeRoot, selfPath: selfPath2, version })
   const validated = validateSlot(runtimeRoot, pointer.active);
   if (!validated.ok) return validated;
   try {
-    if (realpathSync(selfPath2) !== realpathSync(validated.paths.supervisor)) {
+    if (realpathSync2(selfPath2) !== realpathSync2(validated.paths.supervisor)) {
       return { ok: false, detail: "running supervisor is not the activated supervisor" };
     }
   } catch {
@@ -1749,7 +1808,7 @@ function buildMinimalMaintenanceEnv(env = process.env, runtimeRoot = "") {
   };
 }
 function defaultRun(command, args, options) {
-  return spawnSync2(command, args, {
+  return spawnSync4(command, args, {
     cwd: options.cwd,
     encoding: "utf8",
     env: options.env,
@@ -1874,7 +1933,7 @@ function installSlot({
   const suffix = force ? `${digest}-${randomUUID2().slice(0, 8)}` : digest;
   const slotId = `vo-mcp-${metadata.version}-${suffix}`;
   const finalPaths = slotPaths(runtimeRoot, slotId);
-  if (!force && existsSync4(finalPaths.slotRoot)) {
+  if (!force && existsSync5(finalPaths.slotRoot)) {
     const manifest = JSON.parse(readFileSync4(finalPaths.manifest, "utf8"));
     const active = buildActive(slotId, metadata, finalPaths);
     const validated = validateSlot(runtimeRoot, active);
@@ -1950,7 +2009,7 @@ function installSlot({
     const active = buildActive(slotId, metadata, stagedPaths);
     atomicWriteJson(join3(payload, "runtime-manifest.json"), { schema_version: 1, ...active });
     mkdirSync2(join3(runtimeRoot, "slots"), { recursive: true });
-    if (existsSync4(finalPaths.slotRoot)) throw new Error("immutable runtime slot already exists");
+    if (existsSync5(finalPaths.slotRoot)) throw new Error("immutable runtime slot already exists");
     renameSync2(payload, finalPaths.slotRoot);
     installedSlot = true;
     const validated = validateSlot(runtimeRoot, active);
@@ -1972,7 +2031,7 @@ function stageBundledRuntimeSlot(options) {
     platform = process.platform,
     execPath = process.execPath,
     env = process.env,
-    fileExists = existsSync4,
+    fileExists = existsSync5,
     run = defaultRun,
     force = false,
     runtimeAuthorization = null
@@ -2010,7 +2069,7 @@ function stageBundledRuntimeSlot(options) {
     ], runOptions), "npm pack");
     const record = Array.isArray(packed) ? packed[0] : packed;
     const tarball = join3(tarDir, basename(String(record?.filename || "")));
-    if (!existsSync4(tarball) || !basename(tarball).endsWith(".tgz")) throw new Error("npm pack returned no tarball");
+    if (!existsSync5(tarball) || !basename(tarball).endsWith(".tgz")) throw new Error("npm pack returned no tarball");
     if (lstatSync3(tarball).size > MAX_TARBALL_BYTES) throw new Error("runner package tarball exceeds size limit");
     if (record.integrity !== metadata.integrity || tarballIntegrity(tarball) !== metadata.integrity) {
       throw new Error("runner package sha512 integrity mismatch");
@@ -2048,23 +2107,23 @@ function stageAndActivateBundledUpdate(options) {
 }
 
 // ../../scripts/virtual-office/code-runner/legacy-orphan-sweep.mjs
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync6 } from "node:child_process";
 
 // ../../scripts/virtual-office/code-runner/orphan-agent-reaper.mjs
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import os from "node:os";
-import path from "node:path";
+import path2 from "node:path";
 function windowsSystemRoot(env = process.env) {
   return env.SystemRoot || env.WINDIR || "C:\\Windows";
 }
 function windowsPowershellExe(env = process.env) {
-  return path.join(windowsSystemRoot(env), "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  return path2.join(windowsSystemRoot(env), "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
 }
-function killProcessTree(pid, { platform = process.platform, spawn: spawn2 = spawnSync3, env = process.env } = {}) {
+function killProcessTree(pid, { platform = process.platform, spawn: spawn2 = spawnSync5, env = process.env } = {}) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   if (platform === "win32") {
-    const taskkill = path.join(windowsSystemRoot(env), "System32", "taskkill.exe");
+    const taskkill = path2.join(windowsSystemRoot(env), "System32", "taskkill.exe");
     const r = spawn2(taskkill, ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore", timeout: 15e3 });
     return !r.error && r.status === 0;
   }
@@ -2134,7 +2193,7 @@ function parsePosixSweepLine(line, nowMs) {
     commandLine: match[4]
   };
 }
-function listProcessesForSweep({ platform = process.platform, spawn: spawn2 = spawnSync4, nowMs = Date.now(), env = process.env, warn = console.warn } = {}) {
+function listProcessesForSweep({ platform = process.platform, spawn: spawn2 = spawnSync6, nowMs = Date.now(), env = process.env, warn = console.warn } = {}) {
   const rows = [];
   if (platform === "win32") {
     const ps = "Get-CimInstance Win32_Process | Where-Object { $_.CreationDate } | ForEach-Object { @{ p = $_.ProcessId; pp = $_.ParentProcessId; c = (([DateTimeOffset]$_.CreationDate.ToUniversalTime()).ToUnixTimeMilliseconds()); cl = [string]$_.CommandLine } | ConvertTo-Json -Compress }";
@@ -2941,18 +3000,18 @@ async function prepareSupervisorAuth({
 }
 
 // src/runner/supervisor-credential-reader.mjs
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync6 } from "node:fs";
+import { spawnSync as spawnSync7 } from "node:child_process";
+import { existsSync as existsSync7 } from "node:fs";
 import { dirname as dirname3, join as join4 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function defaultCredentialHelperPath(metaUrl = import.meta.url) {
   const moduleDir = dirname3(fileURLToPath2(metaUrl));
   const bundled = join4(moduleDir, "supervisor-credential-helper.js");
   const source = join4(moduleDir, "..", "supervisor-credential-helper.mjs");
-  return existsSync6(source) ? source : bundled;
+  return existsSync7(source) ? source : bundled;
 }
 function readStoredCredentialIsolated({
-  spawn: spawn2 = spawnSync5,
+  spawn: spawn2 = spawnSync7,
   execPath = process.execPath,
   helperPath = defaultCredentialHelperPath(),
   helperArgs = [],
@@ -3302,7 +3361,7 @@ var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 var runnerId = resolveSupervisorRunnerId(process.env);
 function packageVersion() {
   try {
-    return createRequire(import.meta.url)("../package.json").version || "unknown";
+    return createRequire2(import.meta.url)("../package.json").version || "unknown";
   } catch {
     return "unknown";
   }