@claude-flow/cli 3.32.1 → 3.32.3

package/dist/src/services/daemon-autostart.js

@@ -1,102 +0,0 @@
-/**
- * Self-running daemon (auto-start).
- *
- * The self-optimizing loop's workers (distillation, backup, and the future
- * evolve worker) are inert unless the daemon runs — but it required a manual
- * `ruflo daemon start`. This ensures a daemon is running on CLI use, SAFELY:
- *
- *   - single-instance: only starts when no live daemon holds the pidfile, and
- *     the spawned `daemon start` independently enforces single-instance via its
- *     own lock + checkExistingDaemon() — so a race spawns at most one survivor,
- *   - bounded lifetime: the daemon self-terminates on TTL/idle (12h default,
- *     RUFLO_DAEMON_TTL_SECS) — auto-start never means "runs forever",
- *   - opt-out: RUFLO_DAEMON_AUTOSTART=0|false|no disables it entirely, OR a
- *     project-local `daemon.autostart: false` in claude-flow.config.json —
- *     the file-based opt-out exists because the env var only reaches a
- *     process that inherited it. A non-interactive shell (cron, CI, many
- *     tool-invoked shells — bash skips ~/.bashrc entirely for these; see
- *     its own `case $- in *i*) ;; *) return;; esac` guard) never re-sources
- *     a shell rc file per invocation, so `export RUFLO_DAEMON_AUTOSTART=0`
- *     in one such shell does NOT persist to the next one. A project config
- *     field has no such gap — it's read fresh from disk every time,
- *     independent of which shell (or whether any shell at all) launched
- *     the command,
- *   - cheap: a pidfile read + a signal-0 liveness check on the fast path,
- *   - best-effort + silent: never blocks or fails a command.
- *
- * Reuses `daemon start` verbatim (all its lock/TTL/worker machinery) — this
- * module only decides WHETHER to spawn, never reimplements the daemon.
- */
-import * as fs from 'fs';
-import * as path from 'path';
-import { spawn } from 'child_process';
-/** True if a live daemon already holds the project's pidfile. */
-export function isDaemonAlive(projectRoot) {
-    const pidFile = path.join(projectRoot, '.claude-flow', 'daemon.pid');
-    try {
-        if (!fs.existsSync(pidFile))
-            return false;
-        const pid = parseInt(fs.readFileSync(pidFile, 'utf-8').trim(), 10);
-        if (Number.isNaN(pid) || pid === process.pid)
-            return false;
-        process.kill(pid, 0); // signal 0 = existence check
-        return true;
-    }
-    catch {
-        // Dead process → stale pidfile. Clean it so `daemon start` proceeds cleanly.
-        try {
-            fs.unlinkSync(pidFile);
-        }
-        catch { /* ignore */ }
-        return false;
-    }
-}
-/** Project-local opt-out: `{ "daemon": { "autostart": false } }` in claude-flow.config.json. */
-function autostartDisabledByProjectConfig(projectRoot) {
-    try {
-        const raw = fs.readFileSync(path.join(projectRoot, 'claude-flow.config.json'), 'utf-8');
-        const cfg = JSON.parse(raw);
-        return cfg?.daemon?.autostart === false;
-    }
-    catch {
-        return false; // absent/malformed config = not disabled
-    }
-}
-function autostartDisabled(projectRoot) {
-    if (/^(0|false|no|off)$/i.test(process.env.RUFLO_DAEMON_AUTOSTART ?? ''))
-        return true;
-    return autostartDisabledByProjectConfig(projectRoot);
-}
-const defaultSpawn = (projectRoot) => {
-    const cliBin = process.argv[1]; // the running bin/cli.js
-    const child = spawn(process.execPath, [cliBin, 'daemon', 'start', '--quiet'], {
-        cwd: projectRoot,
-        detached: true,
-        stdio: 'ignore',
-        env: { ...process.env },
-    });
-    child.unref();
-};
-/**
- * Ensure a daemon is running for `projectRoot`. No-op when disabled or when one
- * is already alive. Best-effort; never throws.
- */
-export function ensureDaemonRunning(projectRoot, opts = {}) {
-    try {
-        if (autostartDisabled(projectRoot))
-            return { started: false, reason: 'disabled (RUFLO_DAEMON_AUTOSTART=0 or project config)' };
-        // Only in an initialized project (avoid scaffolding a daemon in a random dir).
-        if (!fs.existsSync(path.join(projectRoot, '.claude-flow')) && !fs.existsSync(path.join(projectRoot, '.claude'))) {
-            return { started: false, reason: 'not a ruflo project' };
-        }
-        const alive = (opts.isAlive ?? isDaemonAlive)(projectRoot);
-        if (alive)
-            return { started: false, reason: 'already running' };
-        (opts.spawnFn ?? defaultSpawn)(projectRoot);
-        return { started: true };
-    }
-    catch (e) {
-        return { started: false, reason: `error: ${e?.message ?? e}` };
-    }
-}
-//# sourceMappingURL=daemon-autostart.js.map

package/dist/src/services/distill-oracle.d.ts

@@ -1,190 +0,0 @@
-/**
- * distill-oracle.ts — Tiered `resolved` oracle for distill / weight-EFT SFT data.
- *
- * THE PROBLEM: weight-EFT's SFT data wants a gold `resolved: boolean` per
- * trajectory. Ruflo has no SWE-bench oracle, so today `resolved` is
- * structural-confidence — a proxy that risks distilling plausible-but-wrong
- * completions. This module replaces that single proxy with a TIERED labeler,
- * where every label carries HONEST PROVENANCE (ADR-169 reporting integrity — a
- * proxy is never presented as ground truth).
- *
- * ── TIERS (tried in order, per trajectory) ──────────────────────────────────
- *   TIER 1 — MECHANICAL ORACLE  (provenance `oracle:test-exec`, real ground truth)
- *     When a trajectory carries a test spec (SWE-bench FAIL_TO_PASS shape) or
- *     maps to a metaharness/darwin bench-suite case, EXECUTE the real eval and
- *     set resolved = tests-pass. This needs Docker/compute, so it runs on a
- *     REMOTE host over SSH (host parameterized via `remote` / env
- *     RUFLO_DISTILL_REMOTE — never hard-coded). DRY-RUN by default: it prints
- *     the ssh/darwin-bench/eval commands + a preflight plan and does NOT touch
- *     the network; only `execute: true` runs the real eval (with a wrapped,
- *     non-fatal preflight probe first).
- *
- *   TIER 2 — FABLE JUDGE  (provenance `judge:fable`, smarter proxy)
- *     For trajectories with no mechanical spec, judge via the cost-disciplined
- *     headless Fable harness (fable-harness.ts). Opt-in and OFF by default;
- *     spends nothing unless `fableJudge: true` AND a `maxBudgetUsd` cap is set.
- *
- *   TIER 3 — STRUCTURAL PROXY  (provenance `proxy:structural`, weakest)
- *     The existing output-verifier structural confidence. Always available,
- *     $0, no external calls. Explicitly the weakest signal, clearly labeled.
- *
- * DEFAULT (no opts): dry-run oracle preflight + structural-proxy fallback.
- * ZERO spend, no SSH exec, no Fable call. Everything degrades gracefully
- * (ADR-150) — a missing remote or a failed probe is reported, never fatal.
- *
- * @module services/distill-oracle
- */
-import { type VerifyTaskKind } from '../ruvector/output-verifier.js';
-import { FableHarness, type ReflectItem, type ReflectResult } from './fable-harness.js';
-export type ResolvedProvenance = 'oracle:test-exec' | 'judge:fable' | 'proxy:structural';
-/** SWE-bench-shaped / bench-suite-mapped test spec that Tier 1 can execute. */
-export interface TestSpec {
-    /** SWE-bench FAIL_TO_PASS tests — must go red→green for `resolved`. */
-    failToPass?: string[];
-    /** SWE-bench PASS_TO_PASS tests — must stay green (no regressions). */
-    passToPass?: string[];
-    /** Repo identifier (for the remote checkout). */
-    repo?: string;
-    /** Base commit the patch applies onto. */
-    baseCommit?: string;
-    /** Candidate patch/diff to apply before evaluating. */
-    patch?: string;
-    /** An explicit eval command that returns 0 iff the task is resolved. */
-    evalCommand?: string;
-    /** metaharness/darwin bench-suite this case belongs to. */
-    benchSuite?: string;
-    /** Case id within the bench suite. */
-    benchCase?: string;
-    /** Working directory on the remote host (default derived). */
-    workdir?: string;
-}
-/**
- * Minimal trajectory contract. Extra fields are preserved verbatim on output
- * (the labeler spreads `...trajectory`). `task`/`output` feed the fable judge
- * and structural proxy; `testSpec` (when present) unlocks Tier 1.
- */
-export interface Trajectory {
-    id: string;
-    task?: string;
-    output?: string;
-    testSpec?: TestSpec;
-    /** Hint for the structural verifier's task-kind detection. */
-    taskKind?: VerifyTaskKind;
-    [key: string]: unknown;
-}
-export interface LabelOptions {
-    /** SSH host for Tier-1 execution. Falls back to env RUFLO_DISTILL_REMOTE. Never hard-coded. */
-    remote?: string;
-    /** Run the REAL Tier-1 eval over SSH. Default false → dry-run preflight only. */
-    execute?: boolean;
-    /** Enable the Tier-2 Fable judge. Default false. Requires maxBudgetUsd to spend. */
-    fableJudge?: boolean;
-    /** Hard budget cap (USD) for the Fable tier. No cap ⇒ no Fable spend. */
-    maxBudgetUsd?: number;
-    /** Items per Fable call (default 20 — see FABLE_COST_MODEL). */
-    fableBatchSize?: number;
-    /** Structural verifier: min score to call a trajectory resolved (default: strict — confident only). */
-    minStructuralConfidence?: number;
-    /** Injected Tier-1 runner (tests). Defaults to a real SSH command runner. */
-    runner?: OracleRunner;
-    /** Injected Tier-2 harness (tests). Defaults to a real FableHarness. */
-    harness?: FableHarness;
-}
-/** A trajectory with its resolved label + honest provenance. */
-export type LabeledTrajectory<T extends Trajectory = Trajectory> = T & {
-    resolved: boolean;
-    resolvedBy: ResolvedProvenance;
-    resolvedConfidence?: number;
-    resolvedReason?: string;
-    /** Present for trajectories that had a mechanical spec — the Tier-1 plan/outcome. */
-    oraclePreflight?: OraclePreflight;
-};
-export type OracleKind = 'ssh-darwin-bench' | 'ssh-swebench-eval' | 'ssh-eval' | 'local-eval';
-/** The concrete command plan for executing a trajectory's eval on the remote. */
-export interface OraclePlan {
-    kind: OracleKind;
-    /** Resolved remote host, or null when none is configured. */
-    remote: string | null;
-    /** Preflight probe commands (reachability, docker/darwin presence). */
-    probeCommands: string[];
-    /** The eval commands whose success ⇒ resolved. */
-    evalCommands: string[];
-    /** Human note describing how the resolved boolean is derived. */
-    parseHint: string;
-}
-/** Preflight/dry-run record attached to labeled trajectories that had a spec. */
-export interface OraclePreflight {
-    /** True when nothing was executed (default path). */
-    dryRun: boolean;
-    plan: OraclePlan;
-    /** Probe outcome when executed (execute:true); absent in dry-run. */
-    probe?: {
-        ok: boolean;
-        reason: string;
-    };
-    /** Why Tier 1 did not produce the final label (e.g. dry-run, no remote, probe failed). */
-    fellThroughBecause?: string;
-}
-/** Outcome of a real Tier-1 eval. */
-export interface OracleOutcome {
-    resolved: boolean;
-    reason: string;
-}
-/** Result of a shelled command. */
-export interface CommandResult {
-    stdout: string;
-    stderr: string;
-    code: number | null;
-}
-/** Injectable command executor (tests mock this instead of touching SSH). */
-export type CommandExec = (cmd: string, args: string[], opts: {
-    timeoutMs: number;
-}) => Promise<CommandResult>;
-/** Tier-1 runner contract: probe the remote, then run the eval. */
-export interface OracleRunner {
-    preflight(plan: OraclePlan): Promise<{
-        ok: boolean;
-        reason: string;
-    }>;
-    runEval(plan: OraclePlan, spec: TestSpec): Promise<OracleOutcome>;
-}
-/**
- * Label each trajectory with `resolved` + honest provenance, trying the tiers
- * in order per trajectory. See the module header for tier semantics and the
- * zero-spend default guarantee.
- */
-export declare function labelResolved<T extends Trajectory>(trajectories: T[], opts?: LabelOptions): Promise<Array<LabeledTrajectory<T>>>;
-/**
- * Reflective failure analysis (GEPA/evolve mutation input). Thin, cost-
- * disciplined pass-through to the Fable harness. Opt-in: returns [] unless a
- * harness with a budget cap is provided/configured.
- */
-export declare function reflectFailures(items: ReflectItem[], opts?: {
-    maxBudgetUsd?: number;
-    fableBatchSize?: number;
-    harness?: FableHarness;
-}): Promise<ReflectResult[]>;
-/** A trajectory can be mechanically evaluated iff it carries an actionable spec. */
-export declare function hasMechanicalSpec(t: Trajectory): boolean;
-/** Resolve the remote host from opts → env, never a hard-coded host. */
-export declare function resolveRemote(remote?: string): string | null;
-/**
- * Build the concrete command plan for a spec. Pure — constructs command strings
- * only; executes nothing. `remote` is always substituted from the parameter,
- * never hard-coded.
- */
-export declare function buildOraclePlan(spec: TestSpec, remote: string | null): OraclePlan;
-/**
- * Default command executor: shells out, piping any heredoc/stdin via argv only
- * (commands are self-contained strings run through `sh -c`). Never invoked on
- * the default (dry-run) path.
- */
-export declare const defaultCommandExec: CommandExec;
-/**
- * Build a real SSH-backed oracle runner. `exec` is injectable so tests assert
- * command construction without ever touching a network. Each plan command is
- * run via `sh -c <command-string>` so the fully-rendered ssh line executes as-is.
- */
-export declare function createSshOracleRunner(exec?: CommandExec, timeoutMs?: number): OracleRunner;
-export default labelResolved;
-//# sourceMappingURL=distill-oracle.d.ts.map

package/dist/src/services/distill-oracle.js

@@ -1,349 +0,0 @@
-/**
- * distill-oracle.ts — Tiered `resolved` oracle for distill / weight-EFT SFT data.
- *
- * THE PROBLEM: weight-EFT's SFT data wants a gold `resolved: boolean` per
- * trajectory. Ruflo has no SWE-bench oracle, so today `resolved` is
- * structural-confidence — a proxy that risks distilling plausible-but-wrong
- * completions. This module replaces that single proxy with a TIERED labeler,
- * where every label carries HONEST PROVENANCE (ADR-169 reporting integrity — a
- * proxy is never presented as ground truth).
- *
- * ── TIERS (tried in order, per trajectory) ──────────────────────────────────
- *   TIER 1 — MECHANICAL ORACLE  (provenance `oracle:test-exec`, real ground truth)
- *     When a trajectory carries a test spec (SWE-bench FAIL_TO_PASS shape) or
- *     maps to a metaharness/darwin bench-suite case, EXECUTE the real eval and
- *     set resolved = tests-pass. This needs Docker/compute, so it runs on a
- *     REMOTE host over SSH (host parameterized via `remote` / env
- *     RUFLO_DISTILL_REMOTE — never hard-coded). DRY-RUN by default: it prints
- *     the ssh/darwin-bench/eval commands + a preflight plan and does NOT touch
- *     the network; only `execute: true` runs the real eval (with a wrapped,
- *     non-fatal preflight probe first).
- *
- *   TIER 2 — FABLE JUDGE  (provenance `judge:fable`, smarter proxy)
- *     For trajectories with no mechanical spec, judge via the cost-disciplined
- *     headless Fable harness (fable-harness.ts). Opt-in and OFF by default;
- *     spends nothing unless `fableJudge: true` AND a `maxBudgetUsd` cap is set.
- *
- *   TIER 3 — STRUCTURAL PROXY  (provenance `proxy:structural`, weakest)
- *     The existing output-verifier structural confidence. Always available,
- *     $0, no external calls. Explicitly the weakest signal, clearly labeled.
- *
- * DEFAULT (no opts): dry-run oracle preflight + structural-proxy fallback.
- * ZERO spend, no SSH exec, no Fable call. Everything degrades gracefully
- * (ADR-150) — a missing remote or a failed probe is reported, never fatal.
- *
- * @module services/distill-oracle
- */
-import { spawn } from 'child_process';
-import { verifyAndEscalate } from '../ruvector/output-verifier.js';
-import { FableHarness, } from './fable-harness.js';
-// ── Public API ───────────────────────────────────────────────────────────
-/**
- * Label each trajectory with `resolved` + honest provenance, trying the tiers
- * in order per trajectory. See the module header for tier semantics and the
- * zero-spend default guarantee.
- */
-export async function labelResolved(trajectories, opts = {}) {
-    const results = new Array(trajectories.length);
-    const preflights = new Map();
-    const remote = resolveRemote(opts.remote);
-    const fableActive = Boolean(opts.fableJudge) && Number(opts.maxBudgetUsd) > 0;
-    // ── Tier 1: mechanical oracle (real exec only under execute:true) ──────────
-    const fableQueue = [];
-    for (let i = 0; i < trajectories.length; i++) {
-        const t = trajectories[i];
-        if (hasMechanicalSpec(t)) {
-            const plan = buildOraclePlan(t.testSpec, remote);
-            if (opts.execute) {
-                const runner = opts.runner ?? createSshOracleRunner();
-                // Wrapped probe: a failure is REPORTED, not thrown.
-                const probe = await safeProbe(runner, plan);
-                if (probe.ok) {
-                    const outcome = await safeRunEval(runner, plan, t.testSpec);
-                    results[i] = {
-                        ...t,
-                        resolved: outcome.resolved,
-                        resolvedBy: 'oracle:test-exec',
-                        resolvedConfidence: 1,
-                        resolvedReason: outcome.reason,
-                        oraclePreflight: { dryRun: false, plan, probe },
-                    };
-                    continue;
-                }
-                // Probe failed → report and fall through to next tier.
-                preflights.set(i, {
-                    dryRun: false,
-                    plan,
-                    probe,
-                    fellThroughBecause: `preflight failed: ${probe.reason}`,
-                });
-            }
-            else {
-                // DRY-RUN: emit the plan/commands, touch nothing, fall through.
-                preflights.set(i, {
-                    dryRun: true,
-                    plan,
-                    fellThroughBecause: remote
-                        ? 'dry-run (pass execute:true to run the real eval over SSH)'
-                        : 'dry-run and no remote configured (set remote / RUFLO_DISTILL_REMOTE)',
-                });
-            }
-        }
-        // ── Route to Tier 2 (batched later) or Tier 3 now ──
-        if (fableActive) {
-            fableQueue.push({ index: i, item: toJudgeItem(t) });
-        }
-        else {
-            results[i] = await proxyLabel(t, opts, preflights.get(i));
-        }
-    }
-    // ── Tier 2: batched Fable judge for queued items ──────────────────────────
-    if (fableActive && fableQueue.length > 0) {
-        const harness = opts.harness ??
-            new FableHarness({ maxBudgetUsd: opts.maxBudgetUsd, batchSize: opts.fableBatchSize });
-        let verdicts = [];
-        try {
-            verdicts = await harness.judgeBatch(fableQueue.map((q) => q.item));
-        }
-        catch {
-            verdicts = []; // graceful: any harness failure ⇒ proxy fallback for all
-        }
-        const byId = new Map(verdicts.map((v) => [v.id, v]));
-        for (const { index, item } of fableQueue) {
-            const v = byId.get(item.id);
-            const t = trajectories[index];
-            if (v) {
-                results[index] = {
-                    ...t,
-                    resolved: v.resolved,
-                    resolvedBy: 'judge:fable',
-                    resolvedConfidence: v.confidence,
-                    resolvedReason: v.reason,
-                    ...(preflights.has(index) ? { oraclePreflight: preflights.get(index) } : {}),
-                };
-            }
-            else {
-                // Model omitted this id / budget exhausted → Tier-3 proxy fallback.
-                results[index] = await proxyLabel(t, opts, preflights.get(index));
-            }
-        }
-    }
-    // ── Safety net: nothing should be undefined, but fall back to proxy if so ──
-    for (let i = 0; i < results.length; i++) {
-        if (results[i] === undefined) {
-            results[i] = await proxyLabel(trajectories[i], opts, preflights.get(i));
-        }
-    }
-    return results;
-}
-/**
- * Reflective failure analysis (GEPA/evolve mutation input). Thin, cost-
- * disciplined pass-through to the Fable harness. Opt-in: returns [] unless a
- * harness with a budget cap is provided/configured.
- */
-export async function reflectFailures(items, opts = {}) {
-    const harness = opts.harness ??
-        new FableHarness({ maxBudgetUsd: opts.maxBudgetUsd, batchSize: opts.fableBatchSize });
-    if (!harness.isEnabled())
-        return [];
-    return harness.reflectFailures(items);
-}
-// ── Tier-3 structural proxy ──────────────────────────────────────────────
-async function proxyLabel(t, opts, preflight) {
-    const verdict = await verifyAndEscalate({
-        task: t.task ?? '',
-        output: t.output ?? '',
-        taskKind: t.taskKind,
-    });
-    const threshold = opts.minStructuralConfidence;
-    const resolved = typeof threshold === 'number' ? verdict.score >= threshold : verdict.confident;
-    return {
-        ...t,
-        resolved,
-        resolvedBy: 'proxy:structural',
-        resolvedConfidence: verdict.score,
-        resolvedReason: verdict.confident
-            ? 'structural signals confident'
-            : `structural signals weak: ${verdict.reasons.slice(0, 3).join('; ')}`,
-        ...(preflight ? { oraclePreflight: preflight } : {}),
-    };
-}
-// ── Tier-1 planning ──────────────────────────────────────────────────────
-/** A trajectory can be mechanically evaluated iff it carries an actionable spec. */
-export function hasMechanicalSpec(t) {
-    const s = t.testSpec;
-    if (!s)
-        return false;
-    return Boolean((s.failToPass && s.failToPass.length > 0) ||
-        s.evalCommand ||
-        s.benchSuite ||
-        s.benchCase);
-}
-/** Resolve the remote host from opts → env, never a hard-coded host. */
-export function resolveRemote(remote) {
-    const r = (remote ?? process.env.RUFLO_DISTILL_REMOTE ?? '').trim();
-    return r.length > 0 ? r : null;
-}
-/**
- * Build the concrete command plan for a spec. Pure — constructs command strings
- * only; executes nothing. `remote` is always substituted from the parameter,
- * never hard-coded.
- */
-export function buildOraclePlan(spec, remote) {
-    const host = remote; // may be null; commands render `<remote>` placeholder then
-    const r = host ?? '<remote>';
-    const sshLocal = host ? `ssh ${host} ` : `ssh <remote> `;
-    const workdir = spec.workdir ?? (spec.repo ? `~/ruflo-distill/${sanitize(spec.repo)}` : '~/ruflo-distill/work');
-    // Preflight probes — reachability + the tools Tier-1 needs on the remote.
-    const probeCommands = [
-        `ssh -o BatchMode=yes -o ConnectTimeout=8 ${r} 'echo ok'`,
-        `${sshLocal}'command -v docker >/dev/null 2>&1 && echo docker-present || echo docker-missing'`,
-        `${sshLocal}'command -v darwin >/dev/null 2>&1 || npx --yes @metaharness/darwin --version'`,
-    ];
-    let kind;
-    const evalCommands = [];
-    let parseHint;
-    if (spec.benchSuite || spec.benchCase) {
-        kind = 'ssh-darwin-bench';
-        const suite = spec.benchSuite ? `--suite ${shq(spec.benchSuite)}` : '';
-        const kase = spec.benchCase ? `--case ${shq(spec.benchCase)}` : '';
-        evalCommands.push(`${sshLocal}'cd ${workdir} && npx --yes @metaharness/darwin bench run ${suite} ${kase} --json'`.replace(/\s+/g, ' ').trim());
-        parseHint = 'resolved = darwin bench run reports the case scored PASS (exit 0, json.passed=true)';
-    }
-    else if (spec.evalCommand) {
-        kind = 'ssh-eval';
-        evalCommands.push(`${sshLocal}'cd ${workdir} && ${spec.evalCommand}'`);
-        parseHint = 'resolved = evalCommand exits 0';
-    }
-    else {
-        kind = 'ssh-swebench-eval';
-        if (spec.patch) {
-            evalCommands.push(`${sshLocal}'cd ${workdir} && git apply - <<"PATCH"\n${spec.patch}\nPATCH'`);
-        }
-        const f2p = (spec.failToPass ?? []).map(shq).join(' ');
-        const p2p = (spec.passToPass ?? []).map(shq).join(' ');
-        evalCommands.push(`${sshLocal}'cd ${workdir} && npx --yes @metaharness/darwin swebench-eval` +
-            `${spec.repo ? ` --repo ${shq(spec.repo)}` : ''}` +
-            `${spec.baseCommit ? ` --base ${shq(spec.baseCommit)}` : ''}` +
-            `${f2p ? ` --fail-to-pass ${f2p}` : ''}` +
-            `${p2p ? ` --pass-to-pass ${p2p}` : ''} --json'`);
-        parseHint = 'resolved = all FAIL_TO_PASS now pass AND all PASS_TO_PASS still pass';
-    }
-    return { kind, remote: host, probeCommands, evalCommands, parseHint };
-}
-// ── Default SSH runner (real exec; injectable for tests) ─────────────────────
-/**
- * Default command executor: shells out, piping any heredoc/stdin via argv only
- * (commands are self-contained strings run through `sh -c`). Never invoked on
- * the default (dry-run) path.
- */
-export const defaultCommandExec = (cmd, args, opts) => new Promise((resolve) => {
-    let child;
-    try {
-        child = spawn(cmd, args, { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
-    }
-    catch (err) {
-        resolve({ stdout: '', stderr: err instanceof Error ? err.message : String(err), code: null });
-        return;
-    }
-    let stdout = '';
-    let stderr = '';
-    let done = false;
-    const finish = (r) => { if (!done) {
-        done = true;
-        clearTimeout(timer);
-        resolve(r);
-    } };
-    const timer = setTimeout(() => {
-        try {
-            child.kill('SIGTERM');
-        }
-        catch { /* dead */ }
-        finish({ stdout, stderr: stderr || `timed out after ${opts.timeoutMs}ms`, code: null });
-    }, opts.timeoutMs);
-    timer.unref?.();
-    child.stdout?.on('data', (d) => { stdout += d.toString(); });
-    child.stderr?.on('data', (d) => { stderr += d.toString(); });
-    child.on('error', (e) => finish({ stdout, stderr: e.message, code: null }));
-    child.on('close', (code) => finish({ stdout, stderr, code }));
-});
-/**
- * Build a real SSH-backed oracle runner. `exec` is injectable so tests assert
- * command construction without ever touching a network. Each plan command is
- * run via `sh -c <command-string>` so the fully-rendered ssh line executes as-is.
- */
-export function createSshOracleRunner(exec = defaultCommandExec, timeoutMs = 15 * 60 * 1000) {
-    const run = (command) => exec('sh', ['-c', command], { timeoutMs });
-    return {
-        async preflight(plan) {
-            if (!plan.remote)
-                return { ok: false, reason: 'no remote configured' };
-            for (const c of plan.probeCommands) {
-                const res = await run(c);
-                if (res.code !== 0) {
-                    return { ok: false, reason: `probe failed (${c.slice(0, 60)}…): ${(res.stderr || '').slice(0, 120)}` };
-                }
-            }
-            return { ok: true, reason: 'remote reachable; docker/darwin present' };
-        },
-        async runEval(plan) {
-            let lastReason = 'no eval commands';
-            for (const c of plan.evalCommands) {
-                const res = await run(c);
-                if (res.code !== 0) {
-                    return { resolved: false, reason: `eval failed (exit ${res.code}): ${(res.stderr || res.stdout || '').slice(0, 160)}` };
-                }
-                lastReason = interpretEvalStdout(res.stdout);
-                if (lastReason.startsWith('NOT_RESOLVED')) {
-                    return { resolved: false, reason: lastReason };
-                }
-            }
-            return { resolved: true, reason: `${plan.parseHint} — ${lastReason}` };
-        },
-    };
-}
-/** Interpret an eval command's JSON stdout for an explicit pass/fail signal. */
-function interpretEvalStdout(stdout) {
-    const trimmed = (stdout ?? '').trim();
-    const m = trimmed.match(/\{[\s\S]*\}/);
-    if (m) {
-        try {
-            const o = JSON.parse(m[0]);
-            if (o.passed === false || o.resolved === false)
-                return 'NOT_RESOLVED (json.passed=false)';
-            if (o.passed === true || o.resolved === true)
-                return 'json.passed=true';
-        }
-        catch { /* fall through to exit-code semantics */ }
-    }
-    return 'exit 0';
-}
-// ── small helpers ────────────────────────────────────────────────────────
-async function safeProbe(runner, plan) {
-    try {
-        return await runner.preflight(plan);
-    }
-    catch (err) {
-        return { ok: false, reason: `probe threw: ${err instanceof Error ? err.message : String(err)}` };
-    }
-}
-async function safeRunEval(runner, plan, spec) {
-    try {
-        return await runner.runEval(plan, spec);
-    }
-    catch (err) {
-        return { resolved: false, reason: `eval threw: ${err instanceof Error ? err.message : String(err)}` };
-    }
-}
-function toJudgeItem(t) {
-    return { id: t.id, task: t.task ?? '', output: t.output ?? '' };
-}
-function sanitize(s) {
-    return s.replace(/[^A-Za-z0-9._-]/g, '_');
-}
-/** Single-quote a token for safe interpolation into a shell command string. */
-function shq(s) {
-    return `'${String(s).replace(/'/g, `'\\''`)}'`;
-}
-export default labelResolved;
-//# sourceMappingURL=distill-oracle.js.map