@gh-symphony/cli 0.4.6 → 0.4.9

package/dist/chunk-77H5ED5L.js

@@ -0,0 +1,1991 @@
+#!/usr/bin/env node
+
+// ../core/src/workflow/lifecycle.ts
+var DEFAULT_WORKFLOW_LIFECYCLE = {
+  stateFieldName: "Status",
+  activeStates: ["Todo", "In Progress"],
+  terminalStates: ["Done"],
+  blockerCheckStates: [],
+  planningStates: []
+};
+function isStateActive(state, lifecycle) {
+  return matchesWorkflowState(state, lifecycle.activeStates);
+}
+function isStateTerminal(state, lifecycle) {
+  return matchesWorkflowState(state, lifecycle.terminalStates);
+}
+function matchesWorkflowState(state, candidates) {
+  const normalizedState = normalizeWorkflowState(state);
+  return candidates.some(
+    (candidate) => normalizeWorkflowState(candidate) === normalizedState
+  );
+}
+function normalizeWorkflowState(state) {
+  return state.trim().toLowerCase();
+}
+
+// ../core/src/workflow/config.ts
+var DEFAULT_CODEX_COMMAND = "codex app-server";
+var DEFAULT_CLAUDE_COMMAND = "claude";
+var DEFAULT_AGENT_COMMAND = DEFAULT_CODEX_COMMAND;
+var DEFAULT_LINEAR_GRAPHQL_URL = "https://api.linear.app/graphql";
+var DEFAULT_HOOK_TIMEOUT_MS = 6e4;
+var DEFAULT_POLL_INTERVAL_MS = 3e4;
+var DEFAULT_MAX_RETRY_BACKOFF_MS = 3e5;
+var DEFAULT_MAX_DELAY_MS = DEFAULT_MAX_RETRY_BACKOFF_MS;
+var DEFAULT_BASE_DELAY_MS = 1e4;
+var DEFAULT_MAX_TURNS = 20;
+var DEFAULT_MAX_FAILURE_RETRIES = 10;
+var DEFAULT_READ_TIMEOUT_MS = 5e3;
+var DEFAULT_TURN_TIMEOUT_MS = 36e5;
+var DEFAULT_STALL_TIMEOUT_MS = 3e5;
+var DEFAULT_MAX_CONCURRENT_AGENTS = 10;
+var DEFAULT_WORKFLOW_HOOKS = {
+  afterCreate: null,
+  beforeRun: null,
+  afterRun: null,
+  beforeRemove: null,
+  timeoutMs: DEFAULT_HOOK_TIMEOUT_MS
+};
+var DEFAULT_WORKFLOW_TRACKER = {
+  kind: null,
+  endpoint: null,
+  apiKey: null,
+  projectSlug: null,
+  pickupLabels: {
+    include: [],
+    exclude: []
+  },
+  activeStates: DEFAULT_WORKFLOW_LIFECYCLE.activeStates,
+  terminalStates: DEFAULT_WORKFLOW_LIFECYCLE.terminalStates,
+  projectId: null,
+  stateFieldName: DEFAULT_WORKFLOW_LIFECYCLE.stateFieldName,
+  priority: null,
+  priorityFieldName: null,
+  blockerCheckStates: DEFAULT_WORKFLOW_LIFECYCLE.blockerCheckStates,
+  planningStates: DEFAULT_WORKFLOW_LIFECYCLE.planningStates
+};
+var DEFAULT_WORKFLOW_WORKSPACE = {
+  root: null
+};
+var DEFAULT_WORKFLOW_AGENT = {
+  maxConcurrentAgents: DEFAULT_MAX_CONCURRENT_AGENTS,
+  maxRetryBackoffMs: DEFAULT_MAX_RETRY_BACKOFF_MS,
+  maxConcurrentAgentsByState: {},
+  maxFailureRetries: DEFAULT_MAX_FAILURE_RETRIES,
+  maxTurns: DEFAULT_MAX_TURNS,
+  retryBaseDelayMs: DEFAULT_BASE_DELAY_MS
+};
+var DEFAULT_WORKFLOW_CODEX = {
+  command: DEFAULT_CODEX_COMMAND,
+  approvalPolicy: null,
+  threadSandbox: null,
+  turnSandboxPolicy: null,
+  turnTimeoutMs: DEFAULT_TURN_TIMEOUT_MS,
+  readTimeoutMs: DEFAULT_READ_TIMEOUT_MS,
+  stallTimeoutMs: DEFAULT_STALL_TIMEOUT_MS
+};
+var DEFAULT_WORKFLOW_DEFINITION = {
+  promptTemplate: "",
+  continuationGuidance: null,
+  tracker: DEFAULT_WORKFLOW_TRACKER,
+  polling: {
+    intervalMs: DEFAULT_POLL_INTERVAL_MS
+  },
+  workspace: DEFAULT_WORKFLOW_WORKSPACE,
+  hooks: DEFAULT_WORKFLOW_HOOKS,
+  agent: DEFAULT_WORKFLOW_AGENT,
+  runtime: null,
+  codex: DEFAULT_WORKFLOW_CODEX,
+  lifecycle: DEFAULT_WORKFLOW_LIFECYCLE,
+  format: "default",
+  githubProjectId: null,
+  agentCommand: DEFAULT_CODEX_COMMAND,
+  hookPath: null,
+  maxConcurrentByState: {}
+};
+function resolveWorkflowRuntimeCommand(workflow) {
+  if (!workflow.runtime) {
+    return workflow.codex.command;
+  }
+  if (workflow.runtime.args.length === 0) {
+    return workflow.runtime.command;
+  }
+  return [workflow.runtime.command, ...workflow.runtime.args].join(" ");
+}
+function resolveWorkflowRuntimeTimeouts(workflow) {
+  return workflow.runtime?.timeouts ?? workflow.codex;
+}
+
+// ../core/src/workflow/parser.ts
+function parseWorkflowMarkdown(markdown, env = process.env, options = {}) {
+  const compatibilityMode = options.compatibilityMode ?? "strict";
+  const frontMatterMatch = markdown.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
+  if (!frontMatterMatch) {
+    if (compatibilityMode === "legacy") {
+      return parseLegacyWorkflowMarkdown(markdown);
+    }
+    throw new Error("WORKFLOW.md must use YAML front matter.");
+  }
+  const [, rawFrontMatter, rawPromptTemplate = ""] = frontMatterMatch;
+  const frontMatter = parseFrontMatter(rawFrontMatter);
+  const promptTemplate = rawPromptTemplate.trim();
+  const tracker = readRequiredObject(frontMatter, "tracker");
+  const polling = readObject(frontMatter, "polling");
+  const workspace = readObject(frontMatter, "workspace");
+  const hooks = readObject(frontMatter, "hooks");
+  const agent = readObject(frontMatter, "agent");
+  const runtimeNode = readOptionalRuntimeObject(frontMatter);
+  const hasRuntime = runtimeNode !== null;
+  const codex = hasRuntime ? readObject(frontMatter, "codex") : readRequiredObject(frontMatter, "codex");
+  const trackerKind = readRequiredString(tracker, "kind", env);
+  validateTrackerConfig(tracker, trackerKind, env);
+  const activeStates = readStringList(tracker, "active_states") ?? DEFAULT_WORKFLOW_TRACKER.activeStates;
+  const terminalStates = readStringList(tracker, "terminal_states") ?? DEFAULT_WORKFLOW_TRACKER.terminalStates;
+  const blockerCheckStates = readStringList(tracker, "blocker_check_states") ?? DEFAULT_WORKFLOW_TRACKER.blockerCheckStates;
+  const planningStates = readStringList(tracker, "planning_states") ?? blockerCheckStates;
+  const maxConcurrentAgentsByState = readNumberMap(
+    agent,
+    "max_concurrent_agents_by_state"
+  );
+  const runtime = hasRuntime ? parseRuntimeConfig(runtimeNode, env) : null;
+  const codexConfig = {
+    command: readOptionalString(codex, "command", env) ?? DEFAULT_AGENT_COMMAND,
+    approvalPolicy: readOptionalString(codex, "approval_policy", env),
+    threadSandbox: readOptionalString(codex, "thread_sandbox", env),
+    turnSandboxPolicy: readOptionalString(codex, "turn_sandbox_policy", env),
+    turnTimeoutMs: readOptionalIntegerLike(codex, "turn_timeout_ms") ?? DEFAULT_TURN_TIMEOUT_MS,
+    readTimeoutMs: readOptionalIntegerLike(codex, "read_timeout_ms") ?? DEFAULT_READ_TIMEOUT_MS,
+    stallTimeoutMs: readOptionalIntegerLike(codex, "stall_timeout_ms") ?? DEFAULT_STALL_TIMEOUT_MS
+  };
+  const agentCommand = resolveWorkflowRuntimeCommand({
+    runtime,
+    codex: codexConfig
+  });
+  const parsed = {
+    promptTemplate,
+    continuationGuidance: readOptionalWorkflowString(
+      frontMatter,
+      "continuationGuidance",
+      "continuation_guidance",
+      env
+    ),
+    tracker: {
+      kind: trackerKind,
+      endpoint: readOptionalString(tracker, "endpoint", env) ?? (trackerKind === "linear" ? DEFAULT_LINEAR_GRAPHQL_URL : null),
+      apiKey: readOptionalString(tracker, "api_key", env),
+      projectSlug: readOptionalString(tracker, "project_slug", env),
+      pickupLabels: readPickupLabelsConfig(tracker),
+      activeStates,
+      terminalStates,
+      projectId: readOptionalString(tracker, "project_id", env),
+      stateFieldName: readOptionalString(tracker, "state_field", env) ?? DEFAULT_WORKFLOW_TRACKER.stateFieldName,
+      priority: readPriorityConfig(tracker, env),
+      priorityFieldName: readOptionalString(tracker, "priority_field", env),
+      blockerCheckStates,
+      planningStates
+    },
+    polling: {
+      intervalMs: readOptionalIntegerLike(polling, "interval_ms") ?? DEFAULT_POLL_INTERVAL_MS
+    },
+    workspace: {
+      root: readOptionalString(workspace, "root", env)
+    },
+    hooks: {
+      afterCreate: readOptionalString(hooks, "after_create", env),
+      beforeRun: readOptionalString(hooks, "before_run", env),
+      afterRun: readOptionalString(hooks, "after_run", env),
+      beforeRemove: readOptionalString(hooks, "before_remove", env),
+      timeoutMs: readOptionalIntegerLike(hooks, "timeout_ms") ?? DEFAULT_HOOK_TIMEOUT_MS
+    },
+    agent: {
+      maxConcurrentAgents: readOptionalIntegerLike(agent, "max_concurrent_agents") ?? DEFAULT_MAX_CONCURRENT_AGENTS,
+      maxRetryBackoffMs: readOptionalIntegerLike(agent, "max_retry_backoff_ms") ?? DEFAULT_MAX_RETRY_BACKOFF_MS,
+      maxConcurrentAgentsByState,
+      maxFailureRetries: readOptionalIntegerLike(agent, "max_failure_retries") ?? DEFAULT_MAX_FAILURE_RETRIES,
+      maxTurns: readOptionalIntegerLike(agent, "max_turns") ?? DEFAULT_MAX_TURNS,
+      retryBaseDelayMs: readOptionalIntegerLike(agent, "retry_base_delay_ms") ?? DEFAULT_BASE_DELAY_MS
+    },
+    runtime,
+    codex: codexConfig,
+    lifecycle: {
+      stateFieldName: readOptionalString(tracker, "state_field", env) ?? DEFAULT_WORKFLOW_TRACKER.stateFieldName,
+      activeStates,
+      terminalStates,
+      blockerCheckStates,
+      planningStates
+    },
+    format: "front-matter",
+    githubProjectId: readOptionalString(tracker, "project_id", env),
+    agentCommand,
+    hookPath: readOptionalString(hooks, "after_create", env),
+    maxConcurrentByState: maxConcurrentAgentsByState
+  };
+  return parsed;
+}
+function validateTrackerConfig(tracker, trackerKind, env) {
+  if (trackerKind !== "linear") {
+    return;
+  }
+  for (const key of ["project_id", "projectId", "teamId", "team_id"]) {
+    if (key in tracker) {
+      throw new Error(
+        `Workflow front matter field "tracker.${key}" is not supported for tracker.kind "linear"; use "tracker.project_slug".`
+      );
+    }
+  }
+  const projectSlug = readOptionalString(tracker, "project_slug", env);
+  if (!projectSlug || projectSlug.trim().length === 0) {
+    throw new Error(
+      'Workflow front matter field "tracker.project_slug" is required for tracker.kind "linear".'
+    );
+  }
+  if ("endpoint" in tracker) {
+    const endpoint = readOptionalString(tracker, "endpoint", env);
+    if (!endpoint || endpoint.trim().length === 0) {
+      throw new Error(
+        'Workflow front matter field "tracker.endpoint" must be a non-empty string when provided for tracker.kind "linear".'
+      );
+    }
+  }
+}
+function readPickupLabelsConfig(tracker) {
+  const value = tracker.pickup_labels ?? tracker.pickupLabels;
+  if (value === void 0 || value === null) {
+    return DEFAULT_WORKFLOW_TRACKER.pickupLabels;
+  }
+  if (Array.isArray(value) || typeof value !== "object") {
+    throw new Error(
+      'Workflow front matter field "tracker.pickup_labels" must be an object when provided.'
+    );
+  }
+  const input = value;
+  return {
+    include: readStringList(input, "include") ?? [],
+    exclude: readStringList(input, "exclude") ?? []
+  };
+}
+function readPriorityConfig(tracker, env) {
+  if (tracker.priority === void 0 || tracker.priority === null) {
+    return null;
+  }
+  const priority = readObject(tracker, "priority", "tracker.priority");
+  const source = readRequiredString(priority, "source", env);
+  const keys = new Set(Object.keys(priority));
+  if (source === "project-field") {
+    rejectPriorityKeys(keys, ["source", "field", "values"], source);
+    const field = readRequiredString(priority, "field", env);
+    const values = readNumberMap(priority, "values", "tracker.priority.values");
+    if (Object.keys(values).length === 0) {
+      throw new Error(
+        'Workflow front matter field "tracker.priority.values" must be a non-empty object for tracker.priority.source "project-field".'
+      );
+    }
+    return { source, field, values };
+  }
+  if (source === "labels") {
+    rejectPriorityKeys(keys, ["source", "labels"], source);
+    const labels = readNumberMap(priority, "labels", "tracker.priority.labels");
+    if (Object.keys(labels).length === 0) {
+      throw new Error(
+        'Workflow front matter field "tracker.priority.labels" must be a non-empty object for tracker.priority.source "labels".'
+      );
+    }
+    return { source, labels };
+  }
+  if (source === "disabled") {
+    rejectPriorityKeys(keys, ["source"], source);
+    return { source };
+  }
+  throw new Error(
+    `Unsupported workflow tracker.priority.source "${source}". Supported values: project-field, labels, disabled.`
+  );
+}
+function rejectPriorityKeys(keys, allowedKeys, source) {
+  const allowed = new Set(allowedKeys);
+  for (const key of keys) {
+    if (!allowed.has(key)) {
+      throw new Error(
+        `Workflow front matter field "tracker.priority.${key}" is not supported for tracker.priority.source "${source}".`
+      );
+    }
+  }
+}
+function parseLegacyWorkflowMarkdown(markdown) {
+  const promptGuidelines = matchOptionalSection(markdown, "Prompt Guidelines") ?? "";
+  return {
+    ...DEFAULT_WORKFLOW_DEFINITION,
+    promptTemplate: promptGuidelines,
+    format: "legacy-sectioned"
+  };
+}
+function parseFrontMatter(frontMatter) {
+  const lines = frontMatter.replace(/\r\n/g, "\n").split("\n");
+  const [value] = parseBlock(lines, 0, 0);
+  if (!value || Array.isArray(value) || typeof value !== "object") {
+    throw new Error("Workflow front matter must be a YAML object.");
+  }
+  return value;
+}
+function parseBlock(lines, startIndex, indent) {
+  let index = startIndex;
+  let collectionType = null;
+  const arrayValues = [];
+  const objectValues = {};
+  while (index < lines.length) {
+    const line = lines[index] ?? "";
+    if (!line.trim()) {
+      index += 1;
+      continue;
+    }
+    if (line.trim().startsWith("#")) {
+      index += 1;
+      continue;
+    }
+    const lineIndent = countIndent(line);
+    if (lineIndent < indent) {
+      break;
+    }
+    if (lineIndent > indent) {
+      throw new Error(
+        `Invalid workflow front matter indentation near "${line.trim()}".`
+      );
+    }
+    const trimmed = line.trim();
+    if (trimmed.startsWith("- ")) {
+      if (collectionType === "object") {
+        throw new Error(
+          "Cannot mix array and object values in workflow front matter."
+        );
+      }
+      collectionType = "array";
+      const itemText = stripYamlInlineComment(trimmed.slice(2)).trim();
+      if (itemText === "|" || itemText === "|-") {
+        const [multiline, nextIndex3] = parseMultilineScalar(
+          lines,
+          index + 1,
+          indent + 2
+        );
+        arrayValues.push(multiline);
+        index = nextIndex3;
+        continue;
+      }
+      if (itemText) {
+        arrayValues.push(parseScalar(itemText));
+        index += 1;
+        continue;
+      }
+      const [child2, nextIndex2] = parseBlock(lines, index + 1, indent + 2);
+      arrayValues.push(child2);
+      index = nextIndex2;
+      continue;
+    }
+    if (collectionType === "array") {
+      throw new Error(
+        "Cannot mix object and array values in workflow front matter."
+      );
+    }
+    collectionType = "object";
+    const separatorIndex = findMappingSeparator(trimmed);
+    if (separatorIndex < 0) {
+      throw new Error(`Invalid workflow front matter line "${trimmed}".`);
+    }
+    const rawKey = trimmed.slice(0, separatorIndex).trim();
+    const parsedKey = parseScalar(rawKey);
+    if (typeof parsedKey !== "string") {
+      throw new Error(`Invalid workflow front matter key "${rawKey}".`);
+    }
+    const key = parsedKey;
+    const remainder = stripYamlInlineComment(
+      trimmed.slice(separatorIndex + 1)
+    ).trim();
+    if (remainder === "|" || remainder === "|-") {
+      const [multiline, nextIndex2] = parseMultilineScalar(
+        lines,
+        index + 1,
+        indent + 2
+      );
+      objectValues[key] = multiline;
+      index = nextIndex2;
+      continue;
+    }
+    if (remainder) {
+      objectValues[key] = parseScalar(remainder);
+      index += 1;
+      continue;
+    }
+    const [child, nextIndex] = parseBlock(lines, index + 1, indent + 2);
+    objectValues[key] = child;
+    index = nextIndex;
+  }
+  return [collectionType === "array" ? arrayValues : objectValues, index];
+}
+function parseMultilineScalar(lines, startIndex, indent) {
+  let index = startIndex;
+  const collected = [];
+  while (index < lines.length) {
+    const line = lines[index] ?? "";
+    if (!line.trim()) {
+      collected.push("");
+      index += 1;
+      continue;
+    }
+    const lineIndent = countIndent(line);
+    if (lineIndent < indent) {
+      break;
+    }
+    collected.push(line.slice(indent));
+    index += 1;
+  }
+  return [collected.join("\n").trimEnd(), index];
+}
+function countIndent(line) {
+  return line.match(/^ */)?.[0].length ?? 0;
+}
+function findMappingSeparator(value) {
+  let quote = null;
+  for (let index = 0; index < value.length; index += 1) {
+    const char = value[index];
+    if (quote) {
+      if (char === "\\") {
+        index += 1;
+        continue;
+      }
+      if (char === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+    if (char === ":") {
+      return index;
+    }
+  }
+  return -1;
+}
+function parseScalar(value) {
+  value = stripYamlInlineComment(value).trim();
+  if (value === "null") return null;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  if (value.startsWith("[") && value.endsWith("]")) {
+    return parseInlineArray(value);
+  }
+  if (/^-?\d+$/.test(value)) return Number.parseInt(value, 10);
+  if (value.startsWith('"') && value.endsWith('"')) {
+    try {
+      const parsed = JSON.parse(value);
+      if (typeof parsed === "string") {
+        return parsed;
+      }
+    } catch {
+      throw new Error(
+        `Invalid quoted workflow front matter scalar "${value}".`
+      );
+    }
+  }
+  if (value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1).replace(/''/g, "'");
+  }
+  return value;
+}
+function stripYamlInlineComment(value) {
+  let quote = null;
+  for (let index = 0; index < value.length; index += 1) {
+    const char = value[index];
+    if (quote) {
+      if (quote === '"' && char === "\\") {
+        index += 1;
+        continue;
+      }
+      if (char === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+    if (char === "#" && (index === 0 || /\s/.test(value[index - 1] ?? ""))) {
+      return value.slice(0, index).trimEnd();
+    }
+  }
+  return value;
+}
+function parseInlineArray(value) {
+  const inner = value.slice(1, -1).trim();
+  if (!inner) {
+    return [];
+  }
+  return splitInlineArrayEntries(inner).map((entry) => parseScalar(entry));
+}
+function splitInlineArrayEntries(inner) {
+  const entries = [];
+  let current = "";
+  let quote = null;
+  for (const char of inner) {
+    if (quote) {
+      current += char;
+      if (char === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      current += char;
+      continue;
+    }
+    if (char === ",") {
+      pushInlineArrayEntry(entries, current, "middle");
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  if (quote) {
+    throw new Error(
+      "Workflow front matter inline array has an unterminated string."
+    );
+  }
+  pushInlineArrayEntry(entries, current, "end");
+  return entries;
+}
+function pushInlineArrayEntry(entries, entry, position) {
+  const trimmed = entry.trim();
+  if (!trimmed) {
+    const reason = position === "end" ? "has a trailing comma" : "contains an empty item";
+    throw new Error(`Workflow front matter inline array ${reason}.`);
+  }
+  entries.push(trimmed);
+}
+function parseRuntimeConfig(runtime, env) {
+  const kind = readRuntimeKind(runtime, env);
+  const isolation = readObject(runtime, "isolation", "runtime.isolation");
+  const auth = readObject(runtime, "auth", "runtime.auth");
+  const timeouts = readObject(runtime, "timeouts", "runtime.timeouts");
+  const configuredCommand = readOptionalString(runtime, "command", env);
+  const command = configuredCommand ?? defaultRuntimeCommand(kind);
+  if (!command) {
+    throw new Error(
+      'Workflow front matter field "runtime.command" is required for runtime.kind "custom".'
+    );
+  }
+  return {
+    kind,
+    command,
+    args: readRuntimeArgs(runtime),
+    isolation: {
+      bare: readOptionalBoolean(isolation, "bare", "runtime.isolation.bare") ?? false,
+      strictMcpConfig: readOptionalBoolean(
+        isolation,
+        "strict_mcp_config",
+        "runtime.isolation.strict_mcp_config"
+      ) ?? false
+    },
+    auth: {
+      env: readOptionalString(auth, "env", env)
+    },
+    timeouts: {
+      turnTimeoutMs: readOptionalIntegerLike(timeouts, "turn_timeout_ms") ?? DEFAULT_TURN_TIMEOUT_MS,
+      readTimeoutMs: readOptionalIntegerLike(timeouts, "read_timeout_ms") ?? DEFAULT_READ_TIMEOUT_MS,
+      stallTimeoutMs: readOptionalIntegerLike(timeouts, "stall_timeout_ms") ?? DEFAULT_STALL_TIMEOUT_MS
+    }
+  };
+}
+function readRuntimeKind(runtime, env) {
+  const kind = readRequiredString(runtime, "kind", env);
+  if (kind === "codex-app-server" || kind === "claude-print" || kind === "custom") {
+    return kind;
+  }
+  throw new Error(
+    `Unsupported workflow runtime kind "${kind}". Supported values: codex-app-server, claude-print, custom.`
+  );
+}
+function defaultRuntimeCommand(kind) {
+  if (kind === "claude-print") {
+    return DEFAULT_CLAUDE_COMMAND;
+  }
+  if (kind === "codex-app-server") {
+    return DEFAULT_AGENT_COMMAND;
+  }
+  return null;
+}
+function readObject(input, key, path = key) {
+  const value = input[key];
+  if (value === void 0 || value === null) {
+    return {};
+  }
+  if (typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`Workflow front matter field "${path}" must be an object.`);
+  }
+  return value;
+}
+function readOptionalRuntimeObject(input) {
+  if (input.runtime === void 0 || input.runtime === null) {
+    return null;
+  }
+  return readObject(input, "runtime");
+}
+function readRequiredObject(input, key) {
+  if (!(key in input)) {
+    throw new Error(`Workflow front matter field "${key}" is required.`);
+  }
+  return readObject(input, key);
+}
+function readOptionalString(input, key, env) {
+  const value = input[key];
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  if (typeof value !== "string") {
+    throw new Error(`Workflow front matter field "${key}" must be a string.`);
+  }
+  return resolveEnvironmentValue(value, env);
+}
+function readOptionalWorkflowString(input, primaryKey, fallbackKey, env) {
+  return readOptionalString(input, primaryKey, env) ?? readOptionalString(input, fallbackKey, env);
+}
+function readRequiredString(input, key, env) {
+  const value = readOptionalString(input, key, env);
+  if (!value) {
+    throw new Error(`Workflow front matter field "${key}" is required.`);
+  }
+  return value;
+}
+function readStringList(input, key) {
+  const value = input[key];
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value === "string") {
+    return value.split(",").map((entry) => entry.trim()).filter(Boolean);
+  }
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    throw new Error(
+      `Workflow front matter field "${key}" must be an array of strings or comma-separated string.`
+    );
+  }
+  return value;
+}
+function readRuntimeArgs(input) {
+  const value = input.args;
+  if (value === void 0 || value === null) {
+    return [];
+  }
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    throw new Error(
+      'Workflow front matter field "runtime.args" must be an array of strings.'
+    );
+  }
+  return value;
+}
+function readOptionalBoolean(input, key, path = key) {
+  const value = input[key];
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  if (typeof value !== "boolean") {
+    throw new Error(`Workflow front matter field "${path}" must be a boolean.`);
+  }
+  return value;
+}
+function readOptionalIntegerLike(input, key) {
+  const value = input[key];
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  if (typeof value === "number") {
+    return value;
+  }
+  if (typeof value === "string" && /^-?\d+$/.test(value)) {
+    return Number.parseInt(value, 10);
+  }
+  throw new Error(`Workflow front matter field "${key}" must be an integer.`);
+}
+function readNumberMap(input, key, path = key) {
+  const value = input[key];
+  if (value === void 0 || value === null) {
+    return {};
+  }
+  if (typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`Workflow front matter field "${path}" must be an object.`);
+  }
+  const result = {};
+  for (const [entryKey, entryValue] of Object.entries(value)) {
+    if (typeof entryValue === "number") {
+      result[entryKey] = entryValue;
+      continue;
+    }
+    if (typeof entryValue === "string" && /^-?\d+$/.test(entryValue)) {
+      result[entryKey] = Number.parseInt(entryValue, 10);
+      continue;
+    }
+    throw new Error(
+      `Workflow front matter field "${path}.${entryKey}" must be an integer.`
+    );
+  }
+  return result;
+}
+function resolveEnvironmentValue(value, env) {
+  const envTokenMatch = value.match(/^(?:env:)?([A-Z0-9_]+)$/);
+  if (value.startsWith("env:") && envTokenMatch) {
+    const resolved = env[envTokenMatch[1]];
+    if (!resolved) {
+      throw new Error(
+        `Workflow front matter requires environment variable ${envTokenMatch[1]}.`
+      );
+    }
+    return resolved;
+  }
+  const dollarEnvTokenMatch = value.match(/^\$([A-Z0-9_]+)$/);
+  if (dollarEnvTokenMatch) {
+    const resolved = env[dollarEnvTokenMatch[1]];
+    if (!resolved) {
+      throw new Error(
+        `Workflow front matter requires environment variable ${dollarEnvTokenMatch[1]}.`
+      );
+    }
+    return resolved;
+  }
+  return value.replace(/\$\{([A-Z0-9_]+)\}/g, (_, name) => {
+    const resolved = env[name];
+    if (!resolved) {
+      throw new Error(
+        `Workflow front matter requires environment variable ${name}.`
+      );
+    }
+    return resolved;
+  });
+}
+function matchOptionalSection(markdown, heading) {
+  const escapedHeading = heading.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pattern = new RegExp(
+    `## ${escapedHeading}\\n\\n([\\s\\S]*?)(?=\\n## |$)`
+  );
+  const match = markdown.match(pattern);
+  return match?.[1]?.trim() ?? null;
+}
+
+// ../core/src/workflow/render.ts
+import {
+  Liquid,
+  ParseError,
+  RenderError,
+  TokenizationError,
+  UndefinedVariableError
+} from "liquidjs";
+function buildPromptVariables(issue, options) {
+  const contentType = issue.metadata.contentType ?? "Issue";
+  const linkedPullRequests = Array.isArray(issue.metadata.linkedPullRequests) ? issue.metadata.linkedPullRequests.map(normalizePullRequestContext) : [];
+  const primaryPullRequest = contentType === "PullRequest" ? normalizePullRequestContext(
+    issue.metadata.pullRequest ?? linkedPullRequests[0] ?? buildPullRequestContextFromIssue(issue)
+  ) : linkedPullRequests[0] ?? null;
+  const pullRequestContext = buildPullRequestVariables({
+    contentType,
+    linkedPullRequests,
+    primaryPullRequest,
+    issueBranchName: issue.branchName
+  });
+  return {
+    issue: {
+      id: issue.id,
+      identifier: issue.identifier,
+      number: issue.number,
+      title: issue.title,
+      description: issue.description,
+      priority: issue.priority,
+      url: issue.url,
+      state: issue.state,
+      labels: issue.labels,
+      blocked_by: issue.blockedBy,
+      branch_name: issue.branchName,
+      content_type: contentType,
+      linked_pull_requests: linkedPullRequests,
+      primary_pull_request: primaryPullRequest,
+      has_linked_pr: linkedPullRequests.length > 0,
+      created_at: issue.createdAt,
+      updated_at: issue.updatedAt,
+      repository: `${issue.repository.owner}/${issue.repository.name}`
+    },
+    pull_request_context: pullRequestContext,
+    attempt: options.attempt
+  };
+}
+function normalizePullRequestContext(pullRequest) {
+  return {
+    ...pullRequest,
+    state: pullRequest.state ?? null,
+    projectState: pullRequest.projectState ?? null,
+    isDraft: pullRequest.isDraft ?? null,
+    merged: pullRequest.merged ?? null,
+    headRefName: pullRequest.headRefName ?? null,
+    baseRefName: pullRequest.baseRefName ?? null
+  };
+}
+function buildPullRequestVariables(options) {
+  const checkoutBranch = options.primaryPullRequest?.headRefName ?? (options.contentType === "PullRequest" ? options.issueBranchName : null);
+  const hasPrimaryPr = options.primaryPullRequest !== null;
+  return {
+    subject_type: options.contentType,
+    linked_pull_requests: options.linkedPullRequests,
+    primary_pull_request: options.primaryPullRequest,
+    has_linked_pr: options.linkedPullRequests.length > 0,
+    has_primary_pr: hasPrimaryPr,
+    checkout_branch: checkoutBranch,
+    // Policy flag for prompt templates: any primary PR means the worker must
+    // inspect review threads and checks before editing code.
+    review_first: hasPrimaryPr
+  };
+}
+function buildPullRequestContextFromIssue(issue) {
+  return {
+    id: issue.id,
+    number: issue.number,
+    identifier: issue.identifier,
+    url: issue.url,
+    state: null,
+    projectState: issue.state,
+    headRefName: issue.branchName,
+    repository: {
+      owner: issue.repository.owner,
+      name: issue.repository.name,
+      url: issue.repository.url ?? "",
+      cloneUrl: issue.repository.cloneUrl
+    }
+  };
+}
+var STRICT_LIQUID_ENGINE = new Liquid({
+  strictVariables: true,
+  strictFilters: true,
+  ownPropertyOnly: true
+});
+function renderPrompt(template, variables, options = {}) {
+  const strict = options.strict ?? true;
+  if (!strict) {
+    return renderLegacyPrompt(template, variables);
+  }
+  try {
+    return STRICT_LIQUID_ENGINE.parseAndRenderSync(template, variables);
+  } catch (error) {
+    throw normalizeTemplateError(error);
+  }
+}
+function normalizeTemplateError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (error instanceof UndefinedVariableError || error instanceof RenderError || error instanceof ParseError && message.startsWith("undefined filter:")) {
+    return new Error(`template_render_error: ${message}`, { cause: error });
+  }
+  if (error instanceof ParseError || error instanceof TokenizationError) {
+    return new Error(`template_parse_error: ${message}`, { cause: error });
+  }
+  return new Error(`template_render_error: ${message}`, { cause: error });
+}
+function flattenVariables(obj, prefix = "") {
+  const result = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(obj)) {
+    const fullKey = prefix ? `${prefix}.${key}` : key;
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+      for (const [nestedKey, nestedValue] of flattenVariables(
+        value,
+        fullKey
+      )) {
+        result.set(nestedKey, nestedValue);
+      }
+    } else {
+      result.set(fullKey, value);
+    }
+  }
+  return result;
+}
+function renderLegacyPrompt(template, variables) {
+  const flatVars = flattenVariables(variables);
+  return template.replace(
+    /\{\{([a-zA-Z_][a-zA-Z0-9_.]*)\}\}/g,
+    (match, key) => {
+      const value = flatVars.get(key);
+      if (value === void 0) {
+        return match;
+      }
+      if (value === null) {
+        return "";
+      }
+      return String(value);
+    }
+  );
+}
+
+// ../core/src/observability/error-format.ts
+function hasVerboseFlag(argv) {
+  return argv.some((arg) => arg === "--verbose" || arg === "-v");
+}
+function formatErrorForTerminal(error, options = {}) {
+  if (!options.verbose) {
+    return `${error instanceof Error ? error.message : "Unknown error"}
+`;
+  }
+  const lines = [formatSingleError(error)];
+  const seenCauses = /* @__PURE__ */ new Set();
+  if (typeof error === "object" && error !== null) {
+    seenCauses.add(error);
+  }
+  let cause = resolveCause(error);
+  while (cause !== void 0) {
+    if (typeof cause === "object" && cause !== null) {
+      if (seenCauses.has(cause)) {
+        lines.push("Caused by: [Circular cause]");
+        break;
+      }
+      seenCauses.add(cause);
+    }
+    lines.push(`Caused by: ${formatSingleError(cause)}`);
+    cause = resolveCause(cause);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function formatSingleError(error) {
+  if (error instanceof Error) {
+    return error.stack ?? error.message;
+  }
+  return String(error);
+}
+function resolveCause(error) {
+  return error instanceof Error ? error.cause : void 0;
+}
+
+// ../core/src/contracts/status-surface.ts
+var WORKFLOW_EXECUTION_PHASES = [
+  "planning",
+  "human-review",
+  "implementation",
+  "awaiting-merge",
+  "completed"
+];
+function isWorkflowExecutionPhase(value) {
+  return typeof value === "string" && WORKFLOW_EXECUTION_PHASES.includes(value);
+}
+var SESSION_EXIT_CLASSIFICATIONS = [
+  "completed",
+  "budget-exceeded",
+  "convergence-detected",
+  "max-turns-reached",
+  "user-input-required",
+  "timeout",
+  "error",
+  "incomplete-turn-dirty-workspace"
+];
+function isSessionExitClassification(value) {
+  return typeof value === "string" && SESSION_EXIT_CLASSIFICATIONS.includes(value);
+}
+
+// ../core/src/contracts/run-attempt-phase.ts
+var RUN_ATTEMPT_PHASES = [
+  "preparing_workspace",
+  "building_prompt",
+  "launching_agent",
+  "initializing_session",
+  "streaming_turn",
+  "finishing",
+  "succeeded",
+  "failed",
+  "timed_out",
+  "stalled",
+  "canceled_by_reconciliation"
+];
+function isRunAttemptPhase(value) {
+  return typeof value === "string" && RUN_ATTEMPT_PHASES.includes(value);
+}
+
+// ../core/src/contracts/orchestrator-channel.ts
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isTokenUsage(value) {
+  if (!isRecord(value)) {
+    return false;
+  }
+  return typeof value.inputTokens === "number" && typeof value.outputTokens === "number" && typeof value.totalTokens === "number";
+}
+function isSessionInfo(value) {
+  if (!isRecord(value)) {
+    return false;
+  }
+  return (typeof value.threadId === "string" || value.threadId === null) && (typeof value.turnId === "string" || value.turnId === null) && typeof value.turnCount === "number" && (typeof value.sessionId === "string" || value.sessionId === null) && (!("exitClassification" in value) || value.exitClassification === void 0 || value.exitClassification === null || isSessionExitClassification(value.exitClassification));
+}
+function isNullableString(value) {
+  return typeof value === "string" || value === null;
+}
+function isTurnEventBase(value) {
+  return typeof value.startedAt === "string" && isNullableString(value.threadId) && isNullableString(value.turnId) && typeof value.turnCount === "number" && isNullableString(value.sessionId);
+}
+function isOrchestratorChannelEvent(value) {
+  if (!isRecord(value)) {
+    return false;
+  }
+  if (typeof value.issueId !== "string") {
+    return false;
+  }
+  if (value.type === "codex_update") {
+    if (typeof value.lastEventAt !== "string") {
+      return false;
+    }
+    if ("event" in value && value.event !== void 0 && typeof value.event !== "string") {
+      return false;
+    }
+    if ("tokenUsage" in value && value.tokenUsage !== void 0 && !isTokenUsage(value.tokenUsage)) {
+      return false;
+    }
+    if ("rateLimits" in value && value.rateLimits !== void 0 && !isRecord(value.rateLimits)) {
+      return false;
+    }
+    if ("sessionInfo" in value && value.sessionInfo !== void 0 && !isSessionInfo(value.sessionInfo)) {
+      return false;
+    }
+    if ("executionPhase" in value && value.executionPhase !== void 0 && value.executionPhase !== null && !isWorkflowExecutionPhase(value.executionPhase)) {
+      return false;
+    }
+    if ("runPhase" in value && value.runPhase !== void 0 && value.runPhase !== null && !isRunAttemptPhase(value.runPhase)) {
+      return false;
+    }
+    if ("lastError" in value && value.lastError !== void 0 && value.lastError !== null && typeof value.lastError !== "string") {
+      return false;
+    }
+    return true;
+  }
+  if (value.type === "heartbeat") {
+    if (value.lastEventAt !== null && typeof value.lastEventAt !== "string") {
+      return false;
+    }
+    if (!isTokenUsage(value.tokenUsage)) {
+      return false;
+    }
+    if (value.rateLimits !== null && !isRecord(value.rateLimits)) {
+      return false;
+    }
+    if (value.sessionInfo !== null && !isSessionInfo(value.sessionInfo)) {
+      return false;
+    }
+    if (value.executionPhase !== null && !isWorkflowExecutionPhase(value.executionPhase)) {
+      return false;
+    }
+    if (value.runPhase !== null && !isRunAttemptPhase(value.runPhase)) {
+      return false;
+    }
+    if (value.lastError !== null && typeof value.lastError !== "string") {
+      return false;
+    }
+    return true;
+  }
+  if (value.type === "turn_started") {
+    return isTurnEventBase(value);
+  }
+  if (value.type === "turn_completed") {
+    return isTurnEventBase(value) && typeof value.completedAt === "string" && typeof value.durationMs === "number" && isTokenUsage(value.tokenUsage);
+  }
+  if (value.type === "turn_failed") {
+    return isTurnEventBase(value) && typeof value.failedAt === "string" && typeof value.durationMs === "number" && isTokenUsage(value.tokenUsage) && isNullableString(value.error);
+  }
+  return false;
+}
+
+// ../core/src/workflow/loader.ts
+import { createHash } from "crypto";
+import { access, readFile, stat } from "fs/promises";
+import { constants } from "fs";
+var WorkflowConfigStore = class {
+  cache = /* @__PURE__ */ new Map();
+  async load(workflowPath, env = process.env) {
+    await access(workflowPath, constants.R_OK);
+    const fileStat = await stat(workflowPath);
+    const cached = this.cache.get(workflowPath);
+    const markdown = await readFile(workflowPath, "utf8");
+    const fingerprint = `${fileStat.mtimeMs}:${fileStat.size}:${createHash("sha256").update(markdown).digest("hex")}`;
+    if (cached && cached.fingerprint === fingerprint) {
+      return toWorkflowResolution(workflowPath, cached.workflow, {
+        isValid: true,
+        usedLastKnownGood: false,
+        validationError: null
+      });
+    }
+    try {
+      const workflow = parseWorkflowMarkdown(markdown, env);
+      this.cache.set(workflowPath, {
+        fingerprint,
+        workflow,
+        loadedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      return toWorkflowResolution(workflowPath, workflow, {
+        isValid: true,
+        usedLastKnownGood: false,
+        validationError: null
+      });
+    } catch (error) {
+      if (cached) {
+        return toWorkflowResolution(workflowPath, cached.workflow, {
+          isValid: false,
+          usedLastKnownGood: true,
+          validationError: error instanceof Error ? error.message : "Invalid workflow definition."
+        });
+      }
+      throw error;
+    }
+  }
+};
+function createDefaultWorkflowResolution() {
+  return createInvalidWorkflowResolution(null, "missing_workflow_file");
+}
+function createInvalidWorkflowResolution(workflowPath, validationError) {
+  return toWorkflowResolution(workflowPath, DEFAULT_WORKFLOW_DEFINITION, {
+    isValid: false,
+    usedLastKnownGood: false,
+    validationError
+  });
+}
+function toWorkflowResolution(workflowPath, workflow, metadata) {
+  return {
+    workflowPath,
+    workflow,
+    lifecycle: workflow.lifecycle,
+    promptTemplate: workflow.promptTemplate,
+    agentCommand: workflow.agentCommand,
+    hookPath: workflow.hookPath ?? "",
+    isValid: metadata.isValid,
+    usedLastKnownGood: metadata.usedLastKnownGood,
+    validationError: metadata.validationError
+  };
+}
+
+// ../core/src/workflow/exit-classification.ts
+function classifySessionExit(params) {
+  if (params.userInputRequired) {
+    return "user-input-required";
+  }
+  if (params.budgetExceeded) {
+    return "budget-exceeded";
+  }
+  if (params.convergenceDetected) {
+    return "convergence-detected";
+  }
+  if (params.runPhase === "timed_out" || params.runPhase === "stalled") {
+    return "timeout";
+  }
+  if (params.maxTurnsReached) {
+    return "max-turns-reached";
+  }
+  if (params.runPhase === "succeeded") {
+    return "completed";
+  }
+  return "error";
+}
+
+// ../core/src/orchestration/retry-policy.ts
+function calculateRetryDelay(attempt, options = {}) {
+  const baseDelayMs = options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+  const maxDelayMs = options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+  const normalizedAttempt = Math.max(1, attempt);
+  const delay = baseDelayMs * 2 ** (normalizedAttempt - 1);
+  return Math.min(delay, maxDelayMs);
+}
+function scheduleRetryAt(now, attempt, options = {}) {
+  return new Date(now.getTime() + calculateRetryDelay(attempt, options));
+}
+
+// ../core/src/runtime/credentials.ts
+import { readFile as readFile2, writeFile } from "fs/promises";
+var TOKEN_REUSE_WINDOW_MS = 60 * 1e3;
+var CODEX_ENV_KEYS = [
+  "OPENAI_API_KEY",
+  "OPENAI_BASE_URL",
+  "OPENAI_ORG_ID",
+  "OPENAI_PROJECT"
+];
+var AgentRuntimeCredentialError = class extends Error {
+};
+function extractEnvForCodex(env) {
+  return pickRuntimeEnv(env, CODEX_ENV_KEYS);
+}
+function extractEnvForClaude(env, envKey = "ANTHROPIC_API_KEY") {
+  const apiKey = env[envKey];
+  if (!apiKey) {
+    throw new AgentRuntimeCredentialError(
+      `${envKey} is required in the credential broker response.`
+    );
+  }
+  return {
+    [envKey]: apiKey
+  };
+}
+function toAgentCredentialCacheEntry(brokerResponse, now = /* @__PURE__ */ new Date()) {
+  return {
+    env: brokerResponse.env,
+    expires_at: brokerResponse.expires_at,
+    cachedAt: now.toISOString()
+  };
+}
+function shouldReuseAgentCredentialCache(entry, now = /* @__PURE__ */ new Date()) {
+  if (Object.keys(entry.env).length === 0) {
+    return false;
+  }
+  if (!entry.expires_at) {
+    return true;
+  }
+  const expiresAt = Date.parse(entry.expires_at);
+  if (Number.isNaN(expiresAt)) {
+    return false;
+  }
+  return expiresAt - now.getTime() > TOKEN_REUSE_WINDOW_MS;
+}
+async function readAgentCredentialCache(path, readFileImpl = readFile2) {
+  try {
+    return normalizeAgentCredentialCacheEntry(
+      JSON.parse(await readFileImpl(path, "utf8"))
+    );
+  } catch {
+    return null;
+  }
+}
+async function writeAgentCredentialCache(path, brokerResponse, writeFileImpl = writeFile, now = /* @__PURE__ */ new Date()) {
+  const entry = toAgentCredentialCacheEntry(brokerResponse, now);
+  await writeFileImpl(path, JSON.stringify(entry), "utf8");
+  return entry;
+}
+function pickRuntimeEnv(env, keys) {
+  const resolved = {};
+  for (const key of keys) {
+    const value = env[key];
+    if (value) {
+      resolved[key] = value;
+    }
+  }
+  return resolved;
+}
+function normalizeAgentCredentialCacheEntry(payload) {
+  if (!isRecord2(payload)) {
+    return null;
+  }
+  if (!isRecord2(payload.env)) {
+    return null;
+  }
+  const env = Object.fromEntries(
+    Object.entries(payload.env).filter(
+      (entry) => typeof entry[1] === "string"
+    )
+  );
+  if (Object.keys(env).length === 0) {
+    return null;
+  }
+  return {
+    env,
+    expires_at: typeof payload.expires_at === "string" ? payload.expires_at : void 0,
+    cachedAt: typeof payload.cachedAt === "string" ? payload.cachedAt : (/* @__PURE__ */ new Date(0)).toISOString()
+  };
+}
+function isRecord2(value) {
+  return value !== null && typeof value === "object";
+}
+
+// ../core/src/runtime/events.ts
+var DEFAULT_AGENT_INPUT_REQUIRED_REASON = "turn_input_required: agent requires user input";
+function buildAgentInputRequiredReason(prompt) {
+  if (typeof prompt === "string") {
+    const trimmedPrompt = prompt.trim();
+    if (trimmedPrompt) {
+      return `turn_input_required: ${trimmedPrompt}`;
+    }
+  }
+  return DEFAULT_AGENT_INPUT_REQUIRED_REASON;
+}
+
+// ../core/src/workspace/env-file.ts
+import { existsSync, readFileSync } from "fs";
+function readEnvFile(path) {
+  if (!existsSync(path)) {
+    return {};
+  }
+  return readFileSync(path, "utf8").split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#") && line.includes("=")).reduce((result, line) => {
+    const separatorIndex = line.indexOf("=");
+    const key = line.slice(0, separatorIndex).trim();
+    const value = line.slice(separatorIndex + 1).trim();
+    if (key) {
+      result[key] = value;
+    }
+    return result;
+  }, {});
+}
+
+// ../core/src/workspace/safety.ts
+import { resolve } from "path";
+
+// ../core/src/workspace/identity.ts
+import { resolve as resolve2, join } from "path";
+import { createHash as createHash2 } from "crypto";
+var RESERVED_WORKSPACE_KEYS = /* @__PURE__ */ new Set([
+  "cache",
+  "issues.json",
+  "project.json",
+  "runs",
+  "status.json"
+]);
+function deriveWorkspaceKey(identifier) {
+  const sanitized = identifier.replace(/[^A-Za-z0-9._-]+/g, "_").replace(/^_+|_+$/g, "");
+  if (!sanitized || /^[.]+$/.test(sanitized)) {
+    return "issue";
+  }
+  return sanitized;
+}
+var deriveIssueWorkspaceKeyFromIdentifier = deriveWorkspaceKey;
+function deriveIssueWorkspaceKey(identityOrIdentifier, issueIdentifier) {
+  if (typeof identityOrIdentifier === "string") {
+    return deriveWorkspaceKey(identityOrIdentifier);
+  }
+  return deriveWorkspaceKey(
+    issueIdentifier ?? identityOrIdentifier.issueSubjectId
+  );
+}
+function deriveLegacyIssueWorkspaceKey(identity, projectId) {
+  const input = [projectId, identity.adapter, identity.issueSubjectId].filter((part) => typeof part === "string").join(":");
+  return createHash2("sha256").update(input).digest("hex").slice(0, 16);
+}
+function resolveIssueWorkspaceDirectory(runtimeRoot, workspaceKey) {
+  const normalizedRuntimeRoot = resolve2(runtimeRoot);
+  const candidate = resolve2(normalizedRuntimeRoot, workspaceKey);
+  if (!candidate.startsWith(`${normalizedRuntimeRoot}/`)) {
+    throw new Error(
+      "Issue workspace path escapes the configured runtime root."
+    );
+  }
+  if (isReservedWorkspaceKey(workspaceKey)) {
+    throw new Error("Issue workspace key is reserved by the runtime layout.");
+  }
+  return candidate;
+}
+function isReservedWorkspaceKey(workspaceKey) {
+  return workspaceKey.startsWith(".") || RESERVED_WORKSPACE_KEYS.has(workspaceKey);
+}
+
+// ../core/src/workspace/hooks.ts
+import { spawn } from "child_process";
+var DEFAULT_HOOK_TIMEOUT_MS2 = 6e4;
+async function executeHook(options) {
+  const { kind, command, cwd, env, timeoutMs } = options;
+  const start = Date.now();
+  const normalizedCommand = normalizeHookCommand(command);
+  return new Promise((resolveResult) => {
+    let timedOut = false;
+    let timer = null;
+    const child = spawn("bash", ["-lc", normalizedCommand], {
+      cwd,
+      env: { ...process.env, ...env },
+      stdio: "pipe"
+    });
+    const stderrChunks = [];
+    child.stderr?.on("data", (chunk) => {
+      stderrChunks.push(chunk);
+    });
+    if (timeoutMs > 0) {
+      timer = setTimeout(() => {
+        timedOut = true;
+        child.kill("SIGTERM");
+        setTimeout(() => {
+          try {
+            child.kill("SIGKILL");
+          } catch {
+          }
+        }, 5e3);
+      }, timeoutMs);
+    }
+    child.on("close", (code) => {
+      if (timer) {
+        clearTimeout(timer);
+      }
+      const durationMs = Date.now() - start;
+      const stderr = Buffer.concat(stderrChunks).toString("utf8").trim();
+      if (timedOut) {
+        resolveResult({
+          kind,
+          outcome: "timeout",
+          exitCode: code,
+          durationMs,
+          error: `Hook "${kind}" timed out after ${timeoutMs}ms`
+        });
+        return;
+      }
+      if (code !== 0) {
+        resolveResult({
+          kind,
+          outcome: "failure",
+          exitCode: code,
+          durationMs,
+          error: stderr || `Hook "${kind}" exited with code ${code}`
+        });
+        return;
+      }
+      resolveResult({
+        kind,
+        outcome: "success",
+        exitCode: 0,
+        durationMs,
+        error: null
+      });
+    });
+    child.on("error", (err) => {
+      if (timer) {
+        clearTimeout(timer);
+      }
+      resolveResult({
+        kind,
+        outcome: "failure",
+        exitCode: null,
+        durationMs: Date.now() - start,
+        error: err.message
+      });
+    });
+  });
+}
+function buildHookEnv(context) {
+  const env = {
+    SYMPHONY_PROJECT_ID: context.projectId,
+    SYMPHONY_ISSUE_WORKSPACE_KEY: context.workspaceKey,
+    SYMPHONY_ISSUE_SUBJECT_ID: context.issueSubjectId,
+    SYMPHONY_ISSUE_IDENTIFIER: context.issueIdentifier,
+    SYMPHONY_WORKSPACE_PATH: context.workspacePath,
+    SYMPHONY_REPOSITORY_PATH: context.repositoryPath
+  };
+  if (context.runId) {
+    env.SYMPHONY_RUN_ID = context.runId;
+  }
+  if (context.state) {
+    env.SYMPHONY_ISSUE_STATE = context.state;
+  }
+  return env;
+}
+function resolveHookCommand(hooks, kind) {
+  switch (kind) {
+    case "after_create":
+      return hooks.afterCreate;
+    case "before_run":
+      return hooks.beforeRun;
+    case "after_run":
+      return hooks.afterRun;
+    case "before_remove":
+      return hooks.beforeRemove;
+  }
+}
+async function executeWorkspaceHook(options) {
+  const hookCommand = resolveHookCommand(options.hooks, options.kind);
+  if (!hookCommand) {
+    return {
+      kind: options.kind,
+      outcome: "skipped",
+      exitCode: null,
+      durationMs: 0,
+      error: null
+    };
+  }
+  return executeHook({
+    kind: options.kind,
+    command: hookCommand,
+    cwd: options.repositoryPath,
+    env: options.env,
+    timeoutMs: options.timeoutMs ?? DEFAULT_HOOK_TIMEOUT_MS2
+  });
+}
+function normalizeHookCommand(command) {
+  const trimmed = command.trim();
+  if (trimmed.includes("/") && !trimmed.startsWith("/") && !trimmed.startsWith("./") && !trimmed.startsWith("../") && !/\s/.test(trimmed)) {
+    return `bash ./${trimmed}`;
+  }
+  return command;
+}
+
+// ../core/src/observability/snapshot-builder.ts
+function buildProjectSnapshot(input) {
+  const {
+    project,
+    activeRuns,
+    allRuns,
+    summary,
+    lastTickAt,
+    lastError,
+    rateLimits
+  } = input;
+  const cumulativeTokenUsageByIssue = aggregateTokenUsageByIssue(
+    allRuns ?? activeRuns
+  );
+  return {
+    repository: project.repository,
+    tracker: {
+      adapter: project.tracker.adapter,
+      bindingId: project.tracker.bindingId,
+      settings: project.tracker.settings
+    },
+    lastTickAt,
+    health: lastError ? "degraded" : activeRuns.length > 0 ? "running" : "idle",
+    summary: {
+      dispatched: summary.dispatched,
+      suppressed: summary.suppressed,
+      recovered: summary.recovered,
+      activeRuns: activeRuns.length
+    },
+    activeRuns: activeRuns.map((run) => ({
+      runId: run.runId,
+      issueIdentifier: run.issueIdentifier,
+      issueState: run.issueState,
+      status: run.status,
+      retryKind: run.retryKind,
+      port: run.port,
+      runtimeSession: run.runtimeSession ?? null,
+      // New fields from live worker data
+      processId: run.processId ?? null,
+      turnCount: run.turnCount,
+      startedAt: run.startedAt ?? null,
+      lastEvent: run.lastEvent ?? null,
+      lastEventAt: run.lastEventAt ?? null,
+      executionPhase: run.executionPhase ?? null,
+      runPhase: run.runPhase ?? null,
+      tokenUsage: attachCumulativeTokenUsage(
+        run.tokenUsage,
+        cumulativeTokenUsageByIssue.get(run.issueId)
+      )
+    })),
+    retryQueue: activeRuns.filter((run) => run.status === "retrying" && run.retryKind).map((run) => ({
+      runId: run.runId,
+      issueIdentifier: run.issueIdentifier,
+      retryKind: run.retryKind ?? "failure",
+      nextRetryAt: run.nextRetryAt
+    })),
+    recovery: findLatestRecovery([...allRuns ?? [], ...activeRuns]),
+    lastError,
+    codexTotals: aggregateTokenUsage(allRuns ?? activeRuns, lastTickAt),
+    rateLimits: rateLimits ?? null
+  };
+}
+function findLatestRecovery(runs) {
+  return [...runs].filter((run) => isUnresolvedRecoveryRun(run, runs)).sort((left, right) => {
+    const leftTime = new Date(left.updatedAt).getTime();
+    const rightTime = new Date(right.updatedAt).getTime();
+    return rightTime - leftTime;
+  }).find((run) => run.recovery)?.recovery ?? null;
+}
+function isUnresolvedRecoveryRun(run, runs) {
+  if (!run.recovery) {
+    return false;
+  }
+  if (run.status === "suppressed" && runs.some(
+    (candidate) => candidate.runId !== run.runId && candidate.retryKind === "recovery" && candidate.recovery?.runId === run.recovery?.runId && new Date(candidate.updatedAt).getTime() > new Date(run.updatedAt).getTime() && candidate.status !== "running" && candidate.status !== "retrying"
+  )) {
+    return false;
+  }
+  return run.status === "suppressed" || run.retryKind === "recovery" && (run.status === "running" || run.status === "retrying");
+}
+function aggregateTokenUsageByIssue(runs) {
+  const totals = /* @__PURE__ */ new Map();
+  for (const run of runs) {
+    if (!run.tokenUsage) {
+      continue;
+    }
+    const current = totals.get(run.issueId) ?? {
+      inputTokens: 0,
+      outputTokens: 0,
+      totalTokens: 0
+    };
+    current.inputTokens += run.tokenUsage.inputTokens;
+    current.outputTokens += run.tokenUsage.outputTokens;
+    current.totalTokens += run.tokenUsage.totalTokens;
+    totals.set(run.issueId, current);
+  }
+  return totals;
+}
+function attachCumulativeTokenUsage(tokenUsage, cumulative) {
+  if (!tokenUsage) {
+    return void 0;
+  }
+  return {
+    ...tokenUsage,
+    cumulativeInputTokens: cumulative?.inputTokens ?? tokenUsage.inputTokens,
+    cumulativeOutputTokens: cumulative?.outputTokens ?? tokenUsage.outputTokens,
+    cumulativeTotalTokens: cumulative?.totalTokens ?? tokenUsage.totalTokens
+  };
+}
+function aggregateTokenUsage(runs, lastTickAt) {
+  let inputTokens = 0;
+  let outputTokens = 0;
+  let totalTokens = 0;
+  let earliestStart = null;
+  let latestEnd = null;
+  for (const run of runs) {
+    if (run.tokenUsage) {
+      inputTokens += run.tokenUsage.inputTokens;
+      outputTokens += run.tokenUsage.outputTokens;
+      totalTokens += run.tokenUsage.totalTokens;
+    }
+    if (run.startedAt) {
+      const start = new Date(run.startedAt).getTime();
+      if (earliestStart === null || start < earliestStart) {
+        earliestStart = start;
+      }
+    }
+    const end = run.completedAt ? new Date(run.completedAt).getTime() : new Date(lastTickAt).getTime();
+    if (latestEnd === null || end > latestEnd) {
+      latestEnd = end;
+    }
+  }
+  const secondsRunning = earliestStart !== null && latestEnd !== null ? Math.max(0, Math.round((latestEnd - earliestStart) / 1e3)) : 0;
+  return { inputTokens, outputTokens, totalTokens, secondsRunning };
+}
+
+// ../core/src/observability/fs-reader.ts
+import { readFile as readFile3, readdir } from "fs/promises";
+async function readJsonFile(path) {
+  try {
+    const raw = await readFile3(path, "utf8");
+    return JSON.parse(raw);
+  } catch (error) {
+    if (isFileMissing(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function safeReadDir(path) {
+  try {
+    return await readdir(path);
+  } catch (error) {
+    if (isFileMissing(error)) {
+      return [];
+    }
+    throw error;
+  }
+}
+function isFileMissing(error) {
+  return Boolean(
+    error && typeof error === "object" && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")
+  );
+}
+
+// ../core/src/observability/event-formatter.ts
+function formatEventMessage(event) {
+  switch (event.event) {
+    case "tracker.list":
+      return `Tracker list saw ${event.issue.identifier}`;
+    case "tracker.fetchByIds":
+      return `Tracker fetch refreshed ${event.issue.identifier}`;
+    case "run-dispatched":
+      return event.issueState ? `Dispatched from ${event.issueState}` : "Dispatched";
+    case "run-recovered":
+      return "Recovered existing run";
+    case "run-retried":
+      return `Retry ${event.attempt} scheduled (${event.retryKind})`;
+    case "run-failed":
+      return event.lastError;
+    case "run-suppressed":
+      return event.reason;
+    case "hook-executed":
+      return `${event.hook}: ${event.outcome}`;
+    case "hook-failed":
+      return event.error;
+    case "workspace-cleanup":
+      return event.error ? `${event.outcome}: ${event.error}` : event.outcome;
+    case "worker-error":
+      return event.error;
+    case "turn_started":
+      return `Turn ${event.turnCount} started`;
+    case "turn_completed":
+      return `Turn ${event.turnCount} completed in ${event.durationMs}ms`;
+    case "turn_failed":
+      return event.error ?? `Turn ${event.turnCount} failed`;
+    case "session_invalidated":
+      return event.reason;
+    default:
+      return null;
+  }
+}
+function parseRecentEvents(raw, limit, options) {
+  const lines = raw.split("\n");
+  if (options.allowPartialFirstLine) {
+    lines.shift();
+  }
+  const events = [];
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const line = lines[index]?.trim();
+    if (!line) {
+      continue;
+    }
+    const event = parseRunEventLine(line);
+    if (!event) {
+      continue;
+    }
+    events.push({
+      at: event.at,
+      event: event.event,
+      message: formatEventMessage(event)
+    });
+    if (events.length === limit) {
+      break;
+    }
+  }
+  return events.reverse();
+}
+function parseRunEventLine(line) {
+  try {
+    return JSON.parse(line);
+  } catch {
+    return null;
+  }
+}
+
+// ../core/src/observability/redaction.ts
+var REDACTED = "[REDACTED]";
+var SENSITIVE_KEY_SUBSTRINGS = [
+  "authorization",
+  "secret",
+  "apiKey",
+  "api-key",
+  "api_key"
+];
+function redactObservabilitySecrets(value) {
+  return redactObservabilitySecretsWithStats(value).value;
+}
+function redactObservabilitySecretsWithStats(value) {
+  const counts = createRedactionCounts();
+  const redacted = redactValue(value, counts, {
+    redactStringValues: false
+  });
+  return { value: redacted, redactions: summarizeRedactionCounts(counts) };
+}
+function redactObservabilityDiagnosticsWithStats(value) {
+  const counts = createRedactionCounts();
+  const redacted = redactValue(value, counts, {
+    redactStringValues: true
+  });
+  return { value: redacted, redactions: summarizeRedactionCounts(counts) };
+}
+function redactObservabilityTextWithStats(text) {
+  const counts = createRedactionCounts();
+  return {
+    value: redactTextValue(text, counts),
+    redactions: summarizeRedactionCounts(counts)
+  };
+}
+function redactValue(value, counts, options) {
+  if (Array.isArray(value)) {
+    return value.map((item) => redactValue(item, counts, options));
+  }
+  if (typeof value === "string" && options.redactStringValues) {
+    return redactTextValue(value, counts);
+  }
+  if (!isRecord3(value)) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, nested]) => {
+      const redactionClass = redactionClassForKey(key);
+      if (redactionClass) {
+        incrementRedaction(counts, redactionClass);
+        return [key, REDACTED];
+      }
+      return [key, redactValue(nested, counts, options)];
+    })
+  );
+}
+function redactionClassForKey(key) {
+  const normalizedKey = key.toLowerCase();
+  if (normalizedKey.includes("authorization")) {
+    return "authorization_header";
+  }
+  if (normalizedKey.includes("apikey") || normalizedKey.includes("api-key") || normalizedKey.includes("api_key")) {
+    return "api_key";
+  }
+  if (normalizedKey.includes("secret")) {
+    return "secret_key";
+  }
+  if (normalizedKey === "token" || normalizedKey.endsWith("token")) {
+    return "env_token";
+  }
+  if (SENSITIVE_KEY_SUBSTRINGS.some(
+    (pattern) => normalizedKey.includes(pattern.toLowerCase())
+  )) {
+    return "secret_key";
+  }
+  return null;
+}
+function isRecord3(value) {
+  return value != null && typeof value === "object";
+}
+function redactTextValue(text, counts) {
+  let redacted = replaceAndCount(
+    text,
+    /\b(Authorization\s*:\s*Bearer\s+)([^\s]+)/gi,
+    "authorization_header",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\b(X-API-Key\s*:\s*)([^\s]+)/gi,
+    "api_key",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /^([A-Z0-9_]*(?:TOKEN)\w*\s*=\s*)([^\s]+)/gim,
+    "env_token",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /^([A-Z0-9_]*(?:API_KEY)\w*\s*=\s*)([^\s]+)/gim,
+    "api_key",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /^([A-Z0-9_]*(?:SECRET)\w*\s*=\s*)([^\s]+)/gim,
+    "secret_key",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /((?:"token"|'token'|token)\s*:\s*)(?:"([^"]*)"|'([^']*)'|([^\s,}\]]+))/gi,
+    "env_token",
+    counts,
+    '$1"[REDACTED]"'
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /((?:"secret"|'secret'|secret)\s*:\s*)(?:"([^"]*)"|'([^']*)'|([^\s,}\]]+))/gi,
+    "secret_key",
+    counts,
+    '$1"[REDACTED]"'
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /((?:"apiKey"|'apiKey'|apiKey)\s*:\s*)(?:"([^"]*)"|'([^']*)'|([^\s,}\]]+))/g,
+    "api_key",
+    counts,
+    '$1"[REDACTED]"'
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\bghp_[A-Za-z0-9_]+/g,
+    "env_token",
+    counts,
+    "[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\blin_[A-Za-z0-9_]+/g,
+    "api_key",
+    counts,
+    "[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\bsk-[A-Za-z0-9_-]+/g,
+    "api_key",
+    counts,
+    "[REDACTED]"
+  );
+  return redacted;
+}
+function replaceAndCount(text, pattern, redactionClass, counts, replacement) {
+  return text.replace(pattern, (...args) => {
+    const matched = typeof args[0] === "string" ? args[0] : "";
+    if (matched.includes(REDACTED)) {
+      return matched;
+    }
+    incrementRedaction(counts, redactionClass);
+    return replacement.replace(/\$(\d+)/g, (_placeholder, index) => {
+      const group = args[Number.parseInt(index, 10)];
+      return typeof group === "string" ? group : "";
+    });
+  });
+}
+function createRedactionCounts() {
+  return /* @__PURE__ */ new Map();
+}
+function incrementRedaction(counts, redactionClass) {
+  counts.set(redactionClass, (counts.get(redactionClass) ?? 0) + 1);
+}
+function summarizeRedactionCounts(counts) {
+  return Array.from(counts.entries()).filter(([, count]) => count > 0).map(([redactionClass, count]) => ({ class: redactionClass, count })).sort((left, right) => left.class.localeCompare(right.class));
+}
+
+// ../core/src/observability/status-assembler.ts
+function isMatchingIssueRun(run, issueId, issueIdentifier) {
+  return Boolean(
+    run && (run.issueId === issueId || run.issueIdentifier === issueIdentifier)
+  );
+}
+function mapIssueOrchestrationStateToStatus(state) {
+  switch (state) {
+    case "claimed":
+      return "starting";
+    case "running":
+      return "running";
+    case "retry_queued":
+      return "retrying";
+    case "released":
+      return "released";
+    case "unclaimed":
+      return "pending";
+    default:
+      return state;
+  }
+}
+
+export {
+  isOrchestratorChannelEvent,
+  DEFAULT_WORKFLOW_LIFECYCLE,
+  isStateActive,
+  isStateTerminal,
+  matchesWorkflowState,
+  DEFAULT_LINEAR_GRAPHQL_URL,
+  DEFAULT_MAX_FAILURE_RETRIES,
+  resolveWorkflowRuntimeCommand,
+  resolveWorkflowRuntimeTimeouts,
+  parseWorkflowMarkdown,
+  WorkflowConfigStore,
+  createDefaultWorkflowResolution,
+  createInvalidWorkflowResolution,
+  buildPromptVariables,
+  renderPrompt,
+  classifySessionExit,
+  scheduleRetryAt,
+  extractEnvForCodex,
+  extractEnvForClaude,
+  shouldReuseAgentCredentialCache,
+  readAgentCredentialCache,
+  writeAgentCredentialCache,
+  DEFAULT_AGENT_INPUT_REQUIRED_REASON,
+  buildAgentInputRequiredReason,
+  readEnvFile,
+  deriveIssueWorkspaceKeyFromIdentifier,
+  deriveIssueWorkspaceKey,
+  deriveLegacyIssueWorkspaceKey,
+  resolveIssueWorkspaceDirectory,
+  buildHookEnv,
+  executeWorkspaceHook,
+  buildProjectSnapshot,
+  readJsonFile,
+  safeReadDir,
+  isFileMissing,
+  formatEventMessage,
+  parseRecentEvents,
+  redactObservabilitySecrets,
+  redactObservabilityDiagnosticsWithStats,
+  redactObservabilityTextWithStats,
+  isMatchingIssueRun,
+  mapIssueOrchestrationStateToStatus,
+  hasVerboseFlag,
+  formatErrorForTerminal
+};