@bjoernrochel/sevro 1.0.0 → 1.1.0

package/examples/templates/repository-skill/extension-data.ts

@@ -46,7 +46,7 @@ export const resolved = {
 
 export async function prepare() {
   const relativePath = ".agents/skills/startup-guide/SKILL.md";
-  const body = await readFile(join(import.meta.dir, relativePath));
+  const body = await readFile(join(import.meta.dirname, relativePath));
   return {
     artifacts: [
       {

package/examples/templates/repository-skill/extension.ts

@@ -1,4 +1,5 @@
 import { description, prepare, resolved } from "./extension-data";
+import { readFileSync } from "node:fs";
 
 function record(value: unknown): Record<string, unknown> {
   if (!value || typeof value !== "object" || Array.isArray(value))
@@ -6,7 +7,7 @@ function record(value: unknown): Record<string, unknown> {
   return value as Record<string, unknown>;
 }
 
-const request = record(JSON.parse(await Bun.stdin.text()) as unknown);
+const request = record(JSON.parse(readFileSync(0, "utf8")) as unknown);
 async function result() {
   switch (request.method) {
     case "describe":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bjoernrochel/sevro",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "A standalone evaluation runner for agentic coding capabilities",
   "type": "module",
@@ -29,10 +29,11 @@
     "docs/specs/",
     "examples/",
     "schemas/",
-    "src/"
+    "src/",
+    "dist/"
   ],
   "bin": {
-    "sevro": "./src/cli.ts"
+    "sevro": "./dist/src/cli.js"
   },
   "scripts": {
     "check:typescript": "bun scripts/check-typescript.ts",
@@ -49,14 +50,18 @@
     "test:docs-examples": "bun scripts/verify-doc-examples.ts",
     "guide:sync": "bun scripts/sync-guide.ts",
     "eval:guide": "bun scripts/eval-guide.ts",
-    "release:prepare": "bun scripts/prepare-release.ts",
+    "release:prepare": "bun run build && bun scripts/prepare-release.ts",
     "typecheck": "tsc --noEmit",
-    "format:check": "prettier --check README.md CONTRIBUTING.md AGENTS.md CLAUDE.md 'docs/**/*.md' '.agents/**/*.md' '.agents/**/*.json' '.claude/**/*.md' 'scripts/**/*.md' 'scripts/**/*.json' 'examples/**/*.json' 'examples/**/*.ts' 'schemas/*.json' 'src/**/*.ts' 'scripts/**/*.ts' 'scripts/**/*.cjs' 'tests/**/*.ts' eslint.config.mjs package.json tsconfig.json '.github/workflows/*.yml'"
+    "format:check": "prettier --check README.md CONTRIBUTING.md AGENTS.md CLAUDE.md 'docs/**/*.md' '.agents/**/*.md' '.agents/**/*.json' '.claude/**/*.md' 'scripts/**/*.md' 'scripts/**/*.json' 'examples/**/*.json' 'examples/**/*.ts' 'schemas/*.json' 'src/**/*.ts' 'scripts/**/*.ts' 'scripts/**/*.cjs' 'tests/**/*.ts' eslint.config.mjs package.json tsconfig.json '.github/workflows/*.yml'",
+    "build": "bun scripts/build.ts",
+    "prepack": "bun run build",
+    "test:runtime-node": "bun scripts/verify-node-runtime.ts"
   },
   "dependencies": {
     "ajv": "8.20.0",
     "smol-toml": "1.8.0",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "yaml": "2.9.1"
   },
   "devDependencies": {
     "@babel/core": "8.0.6",
@@ -80,5 +85,8 @@
     "prettier": "3.9.9",
     "shell-quote": "1.12.0",
     "typescript-eslint": "8.71.1"
+  },
+  "engines": {
+    "node": ">=24.13.0"
   }
 }

package/src/cli/demo.ts

@@ -1,3 +1,4 @@
+import { examplePath } from "../runner-paths";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -38,9 +39,9 @@ export async function demoCommand(argv: string[]): Promise<void> {
       "run",
       ...(json ? ["--json"] : []),
       "--case-file",
-      join(import.meta.dir, "..", "..", "examples", "basic", "graded.json"),
+      examplePath("basic", "graded.json"),
       "--adapter-module",
-      join(import.meta.dir, "..", "..", "examples", "basic", "host.ts"),
+      examplePath("basic", "host.ts"),
       "--project-root",
       projectRoot,
       "--results-root",

package/src/cli/help.ts

@@ -1,12 +1,13 @@
 import { RUN_OPTIONS, optionsWith, type RunOptionName } from "./run-options";
-import { version } from "../../package.json";
+import packageJson from "../../package.json" with { type: "json" };
+const { version } = packageJson;
 
 const TOP_LEVEL_HELP = `Usage: sevro <command> [options]
 
 Examples:
   sevro demo
   sevro init --template response --directory ./my-evaluation
-  sevro run --case-file /absolute/case.json --adapter-module /absolute/adapter.ts \\
+  sevro run --case-file /absolute/case.json --adapter-module /absolute/adapter.js \\
     --project-root /absolute/project --results-root /absolute/results \\
     --condition passive --trials 1 --threshold 1
   sevro run --help
@@ -28,7 +29,7 @@ Options:
 const RUN_HELP = `Usage: sevro run [options]
 
 Examples:
-  sevro run --case-file /absolute/case.json --adapter-module /absolute/adapter.ts \\
+  sevro run --case-file /absolute/case.json --adapter-module /absolute/adapter.js \\
     --project-root /absolute/project --results-root /absolute/results \\
     --condition passive --trials 1 --threshold 1
   Add --dry to prepare without calling the candidate or graders.

package/src/cli/init-settings.ts

@@ -1,4 +1,5 @@
 import { join } from "node:path";
+import { runtimeModule } from "../runner-paths";
 
 export function templateSettings(template: string) {
   if (template === "repository-skill")
@@ -9,22 +10,22 @@ export function templateSettings(template: string) {
         "extension.ts",
         "extension-data.ts",
         ".agents/skills/startup-guide/SKILL.md",
-      ],
+      ].map(runtimeModule),
       "case-id": "repository-skill",
       host: "codex",
     };
   return {
     "case-file": "case.json",
-    "adapter-module": "adapter.ts",
+    "adapter-module": runtimeModule("adapter.ts"),
     "project-root": ".",
     ...(template === "coding" ? { "shell-isolation": true } : {}),
   };
 }
 
 export function templateCommand(destination: string) {
-  return [process.execPath, join(destination, "extension.ts")];
+  return [process.execPath, join(destination, runtimeModule("extension.ts"))];
 }
 
 export function nativeReadme() {
-  return `# Repository skill evaluation\n\nThis template mounts the actual startup-guide skill and requires Codex's explicit invocation evidence plus assertions for the start command and port. Missing evidence remains not_assessed.\n\nPrerequisites: Bun, Git, Codex on PATH, supported native isolation (sandbox-exec on macOS or bubblewrap/socat on Linux), and a readable Codex authentication file. Choose the exact model and effort explicitly. Do not store credentials in run.json.\n\n\`\`\`sh\nsevro run --run-manifest-file run.json --model YOUR_MODEL --effort YOUR_EFFORT --codex-auth-file /absolute/auth.json --dry\nsevro run --run-manifest-file run.json --model YOUR_MODEL --effort YOUR_EFFORT --codex-auth-file /absolute/auth.json\nsevro report --latest\n\`\`\`\n\nDry preparation checks mounts and declarations without calling the model. No authenticated model execution or skill dispatch is established by dry preparation. Live execution may incur provider charges. To create a negative control, change the expected port in extension-data.ts to 9000 while leaving the fixture at 3000; rerun and inspect the failed port assertion. Model compliance and measurements are unknown until actually executed.\n\nEdit the copied skill and assertions, prepare again, then rerun the same model/effort/condition. Keep private .sevro evidence out of Git. command.json uses the initializer's absolute Bun and extension paths; regenerate it after moving this project.\n`;
+  return `# Repository skill evaluation\n\nThis template mounts the actual startup-guide skill and requires Codex's explicit invocation evidence plus assertions for the start command and port. Missing evidence remains not_assessed.\n\nPrerequisites: Node.js 24.13.0 or newer, or Bun 1.3.13, plus Git, Codex on PATH, supported native isolation (sandbox-exec on macOS or bubblewrap/socat on Linux), and a readable Codex authentication file. Choose the exact model and effort explicitly. Do not store credentials in run.json.\n\n\`\`\`sh\nsevro run --run-manifest-file run.json --model YOUR_MODEL --effort YOUR_EFFORT --codex-auth-file /absolute/auth.json --dry\nsevro run --run-manifest-file run.json --model YOUR_MODEL --effort YOUR_EFFORT --codex-auth-file /absolute/auth.json\nsevro report --latest\n\`\`\`\n\nDry preparation checks mounts and declarations without calling the model. No authenticated model execution or skill dispatch is established by dry preparation. Live execution may incur provider charges. To create a negative control, change the expected port in the extension data file to 9000 while leaving the fixture at 3000; rerun and inspect the failed port assertion. Model compliance and measurements are unknown until actually executed.\n\nEdit the copied skill and assertions, prepare again, then rerun the same model/effort/condition. Keep private .sevro evidence out of Git. command.json uses the initializer's absolute selected runtime and extension paths; regenerate it after moving this project.\n`;
 }

package/src/cli/init.ts

@@ -1,3 +1,4 @@
+import { examplePath, sourceRuntime } from "../runner-paths";
 import { cp, mkdir, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { parseArgs } from "node:util";
@@ -49,19 +50,19 @@ function starterReadme(template: string) {
       : "an exact response assertion";
   const prerequisites =
     template === "coding"
-      ? "Bun and sandbox-exec on macOS, or bubblewrap/socat on Linux"
-      : "Bun";
-  return `# ${template} evaluation\n\nThis deterministic adapter exercises ${assertion}, without model credentials. Prerequisites: ${prerequisites}.\n\n\`\`\`sh\nsevro run --run-manifest-file run.json --dry\nsevro run --run-manifest-file run.json\nsevro report --latest\nSEVRO_TEMPLATE_FAIL=1 sevro run --run-manifest-file run.json\n\`\`\`\n\nThe negative control must report task=failed and exit 1. Dry preparation is not an assessment.\nEdit case.json and adapter.ts, prepare, then run again. Keep private .sevro evidence out of Git.\nFor a native model, replace the adapter route explicitly with --host, --model and --effort; Codex also requires --codex-auth-file. No model execution or native skill dispatch is established by this adapter.\n`;
+      ? "Node.js 24.13.0 or newer, or Bun 1.3.13, plus sandbox-exec on macOS or bubblewrap/socat on Linux"
+      : "Node.js 24.13.0 or newer, or Bun 1.3.13";
+  return `# ${template} evaluation\n\nThis deterministic adapter exercises ${assertion}, without model credentials. Prerequisites: ${prerequisites}.\n\n\`\`\`sh\nsevro run --run-manifest-file run.json --dry\nsevro run --run-manifest-file run.json\nsevro report --latest\nSEVRO_TEMPLATE_FAIL=1 sevro run --run-manifest-file run.json\n\`\`\`\n\nThe negative control must report task=failed and exit 1. Dry preparation is not an assessment.\nEdit case.json and ${sourceRuntime ? "adapter.ts" : "adapter.js"}, prepare, then run again. Keep private .sevro evidence out of Git.\nFor a native model, replace the adapter route explicitly with --host, --model and --effort; Codex also requires --codex-auth-file. No model execution or native skill dispatch is established by this adapter.\n`;
 }
 
 async function initialize(template: string, destination: string) {
   await reserveDirectory(destination);
   try {
-    await cp(
-      join(import.meta.dir, "..", "..", "examples", "templates", template),
-      destination,
-      { recursive: true, errorOnExist: true, force: false },
-    );
+    await cp(examplePath("templates", template), destination, {
+      recursive: true,
+      errorOnExist: true,
+      force: false,
+    });
     await writeFile(
       join(destination, "run.json"),
       JSON.stringify(

package/src/cli/invocation.ts

@@ -1,3 +1,4 @@
+import { which } from "../executable";
 import { join, resolve } from "node:path";
 import { validQualifiedId } from "../value-guards";
 import { canonicalRuntimeRoot } from "../runtime/paths";
@@ -523,7 +524,7 @@ function resolveNativeBinaries(values: Values): void {
 }
 
 function nativeBinary(host: "codex" | "claude"): string {
-  const binary = Bun.which(host);
+  const binary = which(host);
   if (!binary)
     throw new InvocationError(
       `selected ${host} executable was not found on PATH; install ${host} or supply --${host}-bin <path>`,

package/src/cli/preparation.ts

@@ -1,4 +1,4 @@
-import { join } from "node:path";
+import { runnerRoot } from "../runner-paths";
 import { fileURLToPath } from "node:url";
 import { configurationRoot } from "../hosts/codex-configuration";
 import {
@@ -134,7 +134,7 @@ async function invocationProtectedRuntimeRoots(
   invocation: Invocation,
 ): Promise<string[]> {
   const protectedRoots = [
-    join(import.meta.dir, "..", ".."),
+    runnerRoot,
     invocation.projectRoot,
     invocation.configRoot,
     invocation.resultsRoot,

package/src/cli.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env bun
+#!/usr/bin/env node
 import { main } from "./cli/command";
 import { reportCommand } from "./report";
 import { informationCommand } from "./cli/help";

package/src/executable.ts

@@ -0,0 +1,19 @@
+import { accessSync, constants, statSync } from "node:fs";
+import { delimiter, resolve } from "node:path";
+
+export function which(name: string, path?: string): string | null {
+  for (const directory of executablePath(path).split(delimiter)) {
+    const candidate = resolve(directory, name);
+    try {
+      accessSync(candidate, constants.X_OK);
+      if (statSync(candidate).isFile()) return candidate;
+    } catch {
+      /* Continue searching the declared executable path. */
+    }
+  }
+  return null;
+}
+
+function executablePath(path: string | undefined): string {
+  return path ?? process.env.PATH ?? "";
+}

package/src/extension-client.ts

@@ -1,3 +1,4 @@
+import { spawn, type Subprocess } from "./runtime-process";
 import { randomUUID } from "node:crypto";
 import validExchange from "./generated/extension.cjs";
 import { isRecord, isStringArray } from "./value-guards";
@@ -71,9 +72,9 @@ function extensionPayload(request: ExtensionRequest): Uint8Array {
 function spawnExtension(
   command: string[],
   options: ExchangeOptions,
-): Bun.Subprocess {
+): Subprocess {
   try {
-    return Bun.spawn(command, {
+    return spawn(command, {
       cwd: options.cwd,
       stdin: "pipe",
       stdout: "pipe",
@@ -87,22 +88,15 @@ function spawnExtension(
   }
 }
 
-function extensionWriter(proc: Bun.Subprocess) {
+function extensionWriter(proc: Subprocess) {
   const stdin = proc.stdin;
   if (!stdin || typeof stdin === "number")
     throw new ExtensionProtocolError("extension pipes are unavailable");
   return stdin;
 }
 
-function extensionReaders(proc: Bun.Subprocess) {
+function extensionReaders(proc: Subprocess) {
   const { stdout, stderr } = proc;
-  if (
-    !stdout ||
-    typeof stdout === "number" ||
-    !stderr ||
-    typeof stderr === "number"
-  )
-    throw new ExtensionProtocolError("extension pipes are unavailable");
   return { stdout, stderr };
 }
 
@@ -169,7 +163,7 @@ function assertSuccessfulResponse(
 class ExtensionExchange {
   private readonly deadline: ProcessDeadline;
   constructor(
-    private readonly proc: Bun.Subprocess,
+    private readonly proc: Subprocess,
     options: ExchangeOptions,
     timeoutMs: number,
   ) {

package/src/fixtures/setup.ts

@@ -1,3 +1,4 @@
+import { spawn, type Subprocess } from "../runtime-process";
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { delimiter, isAbsolute, join } from "node:path";
@@ -155,7 +156,7 @@ function executionEnvironment(
 }
 
 class FixtureSetupExecution {
-  private proc: Bun.Subprocess | undefined;
+  private proc: Subprocess | undefined;
   private readonly deadline: ProcessDeadline;
   constructor(
     private readonly setup: FixtureSetup,
@@ -175,7 +176,7 @@ class FixtureSetupExecution {
   }
 
   async run(): Promise<void> {
-    this.proc = Bun.spawn(this.setup.command, {
+    this.proc = spawn(this.setup.command, {
       cwd: this.options.workspace,
       env: executionEnvironment(this.setup, this.options, this.home),
       detached: process.platform !== "win32",

package/src/git.ts

@@ -1,3 +1,4 @@
+import { spawn } from "./runtime-process";
 import {
   captureBoundedBytes,
   terminateOwnedProcessGroup,
@@ -69,7 +70,7 @@ async function gitOutput(
 
 /** Capture both bounded streams; binary patches remain bytes through stdin. */
 export async function runGit(options: GitOptions): Promise<Buffer> {
-  const proc = Bun.spawn(gitArguments(options.args), {
+  const proc = spawn(gitArguments(options.args), {
     cwd: options.cwd,
     stdin: options.input ?? "ignore",
     stdout: "pipe",

package/src/graders/git-head.ts

@@ -1,3 +1,4 @@
+import { spawn, type Subprocess } from "../runtime-process";
 import { isRecord } from "../value-guards";
 import { lstat } from "node:fs/promises";
 import { join } from "node:path";
@@ -60,7 +61,7 @@ async function validateGitMetadata(workspace: string): Promise<void> {
 class GitHeadExecution {
   private readonly deadline: ProcessDeadline;
   constructor(
-    private readonly proc: Bun.Subprocess<"ignore", "pipe", "ignore">,
+    private readonly proc: Subprocess,
     signal: AbortSignal | undefined,
   ) {
     this.deadline = new ProcessDeadline({
@@ -106,7 +107,7 @@ async function git(
 ): Promise<{ code: number; output: string }> {
   if (signal?.aborted) throw new Error("Git HEAD check cancelled");
   await validateGitMetadata(workspace);
-  const proc = Bun.spawn(gitArguments(args), {
+  const proc = spawn(gitArguments(args), {
     cwd: workspace,
     stdin: "ignore",
     stdout: "pipe",

package/src/graders/shell.ts

@@ -1,3 +1,4 @@
+import { spawn, type Subprocess } from "../runtime-process";
 import { runtimeLocalHttpEnabled, runtimeSeedSources } from "../runtime/config";
 import {
   candidateArtifactEnvironment,
@@ -350,7 +351,7 @@ async function requireShellRuntimeCache(
 }
 function shellStdout(
   check: PreparedShellCheck,
-  output: Bun.Subprocess["stdout"],
+  output: Subprocess["stdout"],
 ): ReadableStream<Uint8Array> | null {
   if (!check.captureStdout) return null;
   if (!(output instanceof ReadableStream))
@@ -358,7 +359,7 @@ function shellStdout(
   return output;
 }
 class ShellExecution {
-  private proc?: Bun.Subprocess;
+  private proc?: Subprocess;
   private readonly deadline: ProcessDeadline;
   constructor(
     private check: PreparedShellCheck,
@@ -396,7 +397,7 @@ class ShellExecution {
     }
   }
   private spawn() {
-    this.proc = Bun.spawn(this.isolation.argv, {
+    this.proc = spawn(this.isolation.argv, {
       cwd: this.options.workspace,
       env: shellEnvironment(this.options, this.runtime),
       detached: true,

package/src/hosts/claude-keychain.ts

@@ -1,3 +1,4 @@
+import { spawn } from "../runtime-process";
 import { existsSync } from "node:fs";
 import {
   MAX_CREDENTIAL_BYTES,
@@ -38,7 +39,7 @@ async function findItem(
   account: string,
 ): Promise<Buffer | undefined> {
   requireSecurity();
-  const proc = Bun.spawn(
+  const proc = spawn(
     [SECURITY, "find-generic-password", "-a", account, "-s", service, "-w"],
     { stdout: "pipe", stderr: "ignore" },
   );
@@ -94,7 +95,7 @@ async function updateItem(
 ): Promise<void> {
   requireSecurity();
   const { command, stdin } = updateCommand(service, account, bytes);
-  const proc = Bun.spawn(command, {
+  const proc = spawn(command, {
     stdin: stdin ?? "ignore",
     stdout: "ignore",
     stderr: "ignore",

package/src/hosts/claude-login-refresh.ts

@@ -1,3 +1,4 @@
+import { spawn } from "../runtime-process";
 import {
   mkdir,
   mkdtemp,
@@ -64,7 +65,7 @@ async function requireRefreshCapableClaude(binary: string): Promise<void> {
 }
 
 async function claudeVersion(binary: string): Promise<number[] | undefined> {
-  const proc = Bun.spawn([binary, "--version"], {
+  const proc = spawn([binary, "--version"], {
     stdin: "ignore",
     stdout: "pipe",
     stderr: "ignore",
@@ -137,7 +138,7 @@ async function runHelper(
   binary: string,
   env: Record<string, string>,
 ): Promise<number> {
-  const proc = Bun.spawn([binary, "auth", "login"], {
+  const proc = spawn([binary, "auth", "login"], {
     env,
     cwd: env.HOME,
     stdin: "ignore",

package/src/hosts/claude-refresh-lock.ts

@@ -1,3 +1,4 @@
+import { setTimeout as sleep } from "node:timers/promises";
 import { mkdir, rmdir, stat, utimes } from "node:fs/promises";
 import { join } from "node:path";
 
@@ -38,7 +39,7 @@ async function acquireLock(lock: string, deadline: number): Promise<void> {
       throw new Error(
         "Timed out waiting for another process to refresh the Claude login",
       );
-    await Bun.sleep(RETRY_MS);
+    await sleep(RETRY_MS);
   }
 }
 

package/src/hosts/isolation-roots.ts

@@ -1,7 +1,8 @@
+import { runnerRoot } from "../runner-paths";
 import { isMissingFile } from "../fixtures/tools";
 import { realpath } from "node:fs/promises";
 import { homedir, userInfo } from "node:os";
-import { isAbsolute, resolve } from "node:path";
+import { isAbsolute } from "node:path";
 import { protectedWorktrees } from "./protected-worktrees";
 import { nativeStateParent } from "../native-transcript-state";
 import { workspaceStateParent } from "../fixtures/workspace-state";
@@ -23,7 +24,7 @@ async function protectedRootCandidates(options: ProtectedRootsOptions) {
   const candidates = [
     await nativeStateParent(),
     await workspaceStateParent(),
-    resolve(import.meta.dir, "../.."),
+    runnerRoot,
     options.projectRoot,
     options.resultsRoot,
     homedir(),

package/src/hosts/process-lifecycle.ts

@@ -1,3 +1,4 @@
+import { spawn, type Subprocess } from "../runtime-process";
 import { validHostTimeout } from "./native-request";
 import { ProcessDeadline } from "../process-lifecycle";
 import {
@@ -24,7 +25,7 @@ class HostProcessInterruption extends Error {
 
 /** Race completion against the host deadline and cancellation, then release listeners. */
 async function awaitHostProcess<T>(
-  proc: Bun.Subprocess,
+  proc: Subprocess,
   completed: Promise<T>,
   options: HostProcessOptions,
 ): Promise<T> {
@@ -123,10 +124,7 @@ export interface HostProcessOptions {
   phase?: Phase;
 }
 
-async function writeHostInput(
-  proc: Bun.Subprocess,
-  input?: string,
-): Promise<void> {
+async function writeHostInput(proc: Subprocess, input?: string): Promise<void> {
   if (input === undefined) return;
   if (!proc.stdin || typeof proc.stdin === "number")
     throw new Error("Codex input pipe unavailable");
@@ -139,7 +137,7 @@ function spawnHostProcess(
   capture: HostProcessDiagnostics,
 ) {
   try {
-    return Bun.spawn(options.argv, {
+    return spawn(options.argv, {
       cwd: options.cwd,
       env: options.env,
       detached: process.platform !== "win32",

package/src/hosts/protected-worktrees.ts

@@ -1,3 +1,4 @@
+import { spawnSync } from "../runtime-process";
 import { isMissingFile } from "../fixtures/tools";
 import { lstat, readdir, realpath, stat } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -58,7 +59,7 @@ export async function protectedWorktrees(root: string): Promise<string[]> {
 }
 
 function listWorktreePaths(repository: string): string[] {
-  const result = Bun.spawnSync(
+  const result = spawnSync(
     ["git", "-C", repository, "worktree", "list", "--porcelain", "-z"],
     {
       env: {

package/src/hosts/skill-hook-handler.ts

@@ -322,7 +322,7 @@ function validReceiptIdentity(receipt: SkillHookReceipt): boolean {
 async function boundedInput(): Promise<unknown> {
   const chunks: Uint8Array[] = [];
   let bytes = 0;
-  for await (const chunk of Bun.stdin.stream()) {
+  for await (const chunk of process.stdin as AsyncIterable<Uint8Array>) {
     bytes += chunk.byteLength;
     if (bytes > MAX_INPUT_BYTES) throw new Error("skill hook input too large");
     chunks.push(chunk);

package/src/hosts/skill-hooks.ts

@@ -1,3 +1,4 @@
+import { existsSync } from "node:fs";
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { shellQuote as quote } from "../shell";
@@ -43,7 +44,14 @@ export async function prepareSkillTracking(options: {
     "-i",
     "PATH=/usr/bin:/bin",
     process.execPath,
-    fileURLToPath(new URL("./skill-hook-handler.ts", import.meta.url)),
+    fileURLToPath(
+      new URL(
+        import.meta.filename.endsWith(".ts")
+          ? "./skill-hook-handler.ts"
+          : "./skill-hook-handler.js",
+        import.meta.url,
+      ),
+    ),
     configurationPath,
   ]
     .map(quote)
@@ -140,7 +148,7 @@ function receiptLabels(value: Record<string, unknown>): boolean {
 async function receipts(tracking: SkillTracking) {
   const root = tracking.configuration.receipts;
   const result = { events: [] as SkillHookReceipt[], reasons: [] as string[] };
-  if (await Bun.file(join(root, "partial")).exists())
+  if (existsSync(join(root, "partial")))
     result.reasons.push("observer_failure");
   try {
     const path = join(root, "events.jsonl");

package/src/provenance.ts

@@ -1,10 +1,12 @@
+import { runnerRoot, sourceRuntime } from "./runner-paths";
+import { spawnSync } from "./runtime-process";
 import type { Stats } from "node:fs";
 import { lstat, readFile, readdir, readlink, realpath } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { insideRoot } from "./paths";
 import { pathToFileURL } from "node:url";
-import packageJson from "../package.json";
+import packageJson from "../package.json" with { type: "json" };
 import { hashJson, sha256 } from "./identity";
 import { insideRuntimeRoot } from "./runtime/paths";
 
@@ -49,9 +51,7 @@ class BuildSnapshot {
 }
 
 /** Digest the packaged runtime and public contract files in path order. */
-export async function packageBuildDigest(
-  root = join(import.meta.dir, ".."),
-): Promise<string> {
+export async function packageBuildDigest(root = runnerRoot): Promise<string> {
   const snapshot = new BuildSnapshot(await realpath(root));
   for (const path of [
     "package.json",
@@ -60,6 +60,7 @@ export async function packageBuildDigest(
     "examples",
     "schemas",
     "src",
+    ...(!sourceRuntime ? ["dist"] : []),
   ])
     await snapshot.collect(path);
   return hashJson({
@@ -138,7 +139,7 @@ export async function projectIdentityDigest(
 }
 
 function git(root: string, ...arguments_: string[]): Buffer {
-  const result = Bun.spawnSync(["git", "-C", root, ...arguments_], {
+  const result = spawnSync(["git", "-C", root, ...arguments_], {
     env: { PATH: process.env.PATH ?? "/usr/bin:/bin", LC_ALL: "C" },
     stdout: "pipe",
     stderr: "ignore",
@@ -308,7 +309,7 @@ export async function runnerProvenance(
   checkoutRoot?: string,
 ) {
   if (checkoutRoot) {
-    const actualRoot = await realpath(join(import.meta.dir, ".."));
+    const actualRoot = await realpath(runnerRoot);
     if ((await realpath(checkoutRoot)) !== actualRoot)
       throw new Error(
         "local Sevro checkout root does not match the running package",

package/src/results-lock.ts

@@ -1,4 +1,4 @@
-import { Database } from "bun:sqlite";
+import { openLockDatabase } from "./sqlite-lock";
 import { join } from "node:path";
 import { lstat } from "node:fs/promises";
 
@@ -28,10 +28,10 @@ export async function withResultsLock<T>(
 /** Hold a root lock while discovering and validating additional nested roots. */
 export async function acquireResultsLock(root: string): Promise<() => void> {
   await retainedFile(join(root, ".retention-lock.sqlite"));
-  const database = new Database(join(root, ".retention-lock.sqlite"));
+  const database = openLockDatabase(join(root, ".retention-lock.sqlite"));
   try {
-    database.run("PRAGMA busy_timeout = 5000");
-    database.run("BEGIN IMMEDIATE");
+    database.exec("PRAGMA busy_timeout = 5000");
+    database.exec("BEGIN IMMEDIATE");
     return () => {
       database.close();
     };