@iowarp/clio-coder 0.4.9 → 0.5.0

package/dist/chunk-A6DULIMH.js

@@ -1,986 +0,0 @@
-import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
-import {
-  shellQuote
-} from "./chunk-SD7SHNDW.js";
-import {
-  WORKER_BULK_FRAME_MAX_BYTES,
-  WORKER_EVENT_QUEUE_MAX_FRAMES,
-  WORKER_PROTOCOL_VERSION,
-  WORKER_STDIN_FRAME_MAX_BYTES,
-  WORKER_STDIN_QUEUE_MAX_BYTES,
-  canonicalJson,
-  endpointIdentityHash,
-  isControlLine,
-  isReceiptBearingFrame,
-  parseBulkFrame,
-  parseControlFrame,
-  toolSignatureOf
-} from "./chunk-VQD7NH7Z.js";
-import {
-  enableClioCompileCache,
-  workerCompileCacheEnvironment
-} from "./chunk-CKK25WN3.js";
-import {
-  AI_AGENT_NAME,
-  withClioAgentEnvironment
-} from "./chunk-ZTNFYMIO.js";
-import {
-  atomicWrite
-} from "./chunk-3RDHGNU7.js";
-import {
-  clioStateDir
-} from "./chunk-CTTI7G3T.js";
-import {
-  readClioVersion,
-  resolvePackageRoot
-} from "./chunk-E3LEPLQ2.js";
-import {
-  init_esm_shims
-} from "./chunk-ECBHH7LU.js";
-
-// src/domains/dispatch/fleet-preflight.ts
-init_esm_shims();
-import { execFile } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { join as join2 } from "node:path";
-import { performance as performance2 } from "node:perf_hooks";
-
-// src/domains/dispatch/route-facts.ts
-init_esm_shims();
-var ROUTE_FACT_FRESHNESS_MS = 15 * 60 * 1e3;
-function isFresh(probedAt, now, freshnessMs) {
-  const at = Date.parse(probedAt);
-  if (!Number.isFinite(at)) return false;
-  return at <= now && now - at <= freshnessMs;
-}
-function evaluateRouteFacts(facts, resources, requirement, options) {
-  const now = options?.now ?? Date.now();
-  const freshnessMs = options?.freshnessMs ?? ROUTE_FACT_FRESHNESS_MS;
-  const unknowns = [];
-  const fact = facts.find((entry) => entry.nodeId === requirement.nodeId && entry.targetId === requirement.targetId);
-  if (!fact) {
-    const unknowns2 = ["reachable", "runtimeCompatible", "modelAvailable"];
-    if (requirement.mode === "shadow") return { ok: true, unknowns: unknowns2 };
-    return {
-      ok: false,
-      reason: `no probe fact for target '${requirement.targetId}' on node '${requirement.nodeId}'; run 'clio-coder doctor --fix'`,
-      unknowns: unknowns2
-    };
-  }
-  const fresh = isFresh(fact.probedAt, now, freshnessMs);
-  if (fact.endpointIdentityHash !== requirement.endpointIdentityHash) {
-    return {
-      ok: false,
-      reason: `node '${requirement.nodeId}' endpoint identity for target '${requirement.targetId}' does not match settings`,
-      unknowns
-    };
-  }
-  const checks = [
-    ["reachable", requirement.requireReachable, fact.reachable],
-    ["runtimeCompatible", requirement.requireRuntimeCompatible, fact.runtimeCompatible],
-    ["modelAvailable", requirement.requireModelAvailable, fact.modelAvailable]
-  ];
-  for (const [name, required, state] of checks) {
-    if (state === "unknown") unknowns.push(name);
-    if (!required) continue;
-    if (state === "false") {
-      return {
-        ok: false,
-        reason: `node '${requirement.nodeId}' proved ${name}=false for target '${requirement.targetId}'`,
-        unknowns
-      };
-    }
-    if (state === "unknown" && requirement.mode === "active") {
-      return {
-        ok: false,
-        reason: `node '${requirement.nodeId}' has no ${name} evidence for target '${requirement.targetId}'`,
-        unknowns
-      };
-    }
-    if (!fresh && requirement.mode === "active") {
-      return {
-        ok: false,
-        reason: `node '${requirement.nodeId}' ${name} evidence for target '${requirement.targetId}' is stale (probed ${fact.probedAt})`,
-        unknowns
-      };
-    }
-  }
-  if (requirement.requireModelAvailable && requirement.wireModelId !== null && fact.wireModelId !== null && fact.wireModelId !== requirement.wireModelId) {
-    return {
-      ok: false,
-      reason: `node '${requirement.nodeId}' model evidence names '${fact.wireModelId}', not '${requirement.wireModelId}'`,
-      unknowns
-    };
-  }
-  const resource = resources.find((entry) => entry.nodeId === requirement.nodeId);
-  const resourceChecks = [
-    ["gpuCount", requirement.requireGpuCount, resource?.gpuCount],
-    ["vramBytes", requirement.requireVramBytes, resource?.vramBytes]
-  ];
-  for (const [name, required, observed] of resourceChecks) {
-    if (observed === null || observed === void 0) {
-      if (required !== null) unknowns.push(name);
-      if (required !== null && requirement.mode === "active") {
-        return {
-          ok: false,
-          reason: `node '${requirement.nodeId}' reports unknown ${name}; a declared fit requirement cannot be satisfied by unknown`,
-          unknowns
-        };
-      }
-      continue;
-    }
-    if (required !== null && observed < required) {
-      return {
-        ok: false,
-        reason: `node '${requirement.nodeId}' ${name} ${observed} is below the declared requirement ${required}`,
-        unknowns
-      };
-    }
-  }
-  return { ok: true, unknowns };
-}
-
-// src/domains/dispatch/transport.ts
-init_esm_shims();
-import { spawn as spawn2 } from "node:child_process";
-
-// src/domains/dispatch/worker-spawn.ts
-init_esm_shims();
-import { spawn } from "node:child_process";
-import { join } from "node:path";
-import { performance } from "node:perf_hooks";
-
-// src/domains/dispatch/worker-protocol.ts
-init_esm_shims();
-import { createHash } from "node:crypto";
-function computeSettingsFingerprint(settings) {
-  return createHash("sha256").update(`clio-coder.settings:${canonicalJson(settings)}`, "utf8").digest("hex");
-}
-function verifyWorkerAttestation(attestation, approved) {
-  if (attestation.protocolVersion !== WORKER_PROTOCOL_VERSION) {
-    return {
-      ok: false,
-      reason: `worker protocol mismatch: approved ${WORKER_PROTOCOL_VERSION}, worker announced ${attestation.protocolVersion}`
-    };
-  }
-  const fields = [
-    ["WorkerSpec version", approved.specVersion, attestation.specVersion],
-    ["settings fingerprint", approved.settingsFingerprint, attestation.settingsFingerprint],
-    ["WorkerSpec digest", approved.specDigest, attestation.specDigest],
-    ["runtime", approved.runtimeId, attestation.runtimeId],
-    ["target", approved.targetId, attestation.targetId],
-    ["endpoint identity", approved.endpointIdentityHash, attestation.endpointIdentityHash],
-    ["wire model", approved.wireModelId, attestation.wireModelId],
-    ["tool surface", approved.toolSignature, attestation.toolSignature]
-  ];
-  for (const [label, expected, announced] of fields) {
-    if (!Object.is(expected, announced)) {
-      return {
-        ok: false,
-        reason: `${label} drift: dispatched ${String(expected)}, worker announced ${String(announced)}`
-      };
-    }
-  }
-  return { ok: true };
-}
-function approvedIdentityForSpec(spec) {
-  return {
-    specVersion: spec.specVersion,
-    settingsFingerprint: spec.settingsFingerprint,
-    specDigest: workerSpecDigestOf(spec),
-    runtimeId: spec.runtimeId,
-    targetId: spec.target.id,
-    endpointIdentityHash: endpointIdentityHash(spec.target.url),
-    wireModelId: spec.wireModelId,
-    // The spec carries the final runtime-narrowed admission surface. The
-    // worker fingerprints its independently resolved registry intersection,
-    // so a missing, added, or differently filtered tool fails admission.
-    toolSignature: toolSignatureOf(spec.allowedTools)
-  };
-}
-function workerSpecDigestOf(spec) {
-  return createHash("sha256").update(`clio-coder.workerSpec:${canonicalJson(spec)}`, "utf8").digest("hex");
-}
-function resourceOrNull(value) {
-  return value.known ? value.value : null;
-}
-function receiptAttestationFields(attestation) {
-  if (attestation === null) return {};
-  return {
-    attestation: {
-      protocolVersion: attestation.protocolVersion,
-      host: attestation.host,
-      pid: attestation.pid,
-      processGroupId: attestation.processGroupId,
-      settingsFingerprint: attestation.settingsFingerprint,
-      specDigest: attestation.specDigest,
-      targetId: attestation.targetId,
-      endpointIdentityHash: attestation.endpointIdentityHash,
-      wireModelId: attestation.wireModelId,
-      runtimeId: attestation.runtimeId,
-      toolSignature: attestation.toolSignature,
-      resources: {
-        labels: [...attestation.resources.labels],
-        cpuCount: resourceOrNull(attestation.resources.cpuCount),
-        totalMemoryBytes: resourceOrNull(attestation.resources.totalMemoryBytes),
-        gpuCount: resourceOrNull(attestation.resources.gpuCount),
-        vramBytes: resourceOrNull(attestation.resources.vramBytes)
-      }
-    }
-  };
-}
-var WorkerChannelFailure = class extends Error {
-  failureClass = "node-channel";
-  operation;
-  constructor(operation, detail) {
-    super(`worker control channel failure during ${operation}: ${detail}`);
-    this.name = "WorkerChannelFailure";
-    this.operation = operation;
-  }
-};
-function createBoundedEventQueue(maxFrames = WORKER_EVENT_QUEUE_MAX_FRAMES) {
-  const items = [];
-  let droppedDisplayFrames = 0;
-  let peakDepth = 0;
-  function dropOneDisplayFrame() {
-    for (let index = 0; index < items.length; index += 1) {
-      if (!isReceiptBearingFrame(items[index])) {
-        items.splice(index, 1);
-        droppedDisplayFrames += 1;
-        return true;
-      }
-    }
-    return false;
-  }
-  return {
-    push(value) {
-      if (items.length >= maxFrames && !dropOneDisplayFrame()) {
-        if (isReceiptBearingFrame(value)) {
-          items.push(value);
-          peakDepth = Math.max(peakDepth, items.length);
-          return true;
-        }
-        droppedDisplayFrames += 1;
-        return false;
-      }
-      items.push(value);
-      peakDepth = Math.max(peakDepth, items.length);
-      return true;
-    },
-    shift() {
-      return items.shift();
-    },
-    get size() {
-      return items.length;
-    },
-    stats() {
-      return { droppedDisplayFrames, peakDepth };
-    }
-  };
-}
-
-// src/domains/dispatch/worker-spawn.ts
-var DEFAULT_SHUTDOWN_GRACE_MS = 500;
-var DEFAULT_ATTESTATION_GRACE_MS = 2e3;
-var STDERR_TAIL_BYTES = 4096;
-function signalProcessGroup(child, signal) {
-  const pid = child.pid;
-  if (pid !== void 0 && pid !== null) {
-    try {
-      process.kill(-pid, signal);
-      return;
-    } catch {
-    }
-  }
-  try {
-    child.kill(signal);
-  } catch {
-  }
-}
-function spawnWorkerProcess(command, args, spec, opts) {
-  const shutdownGraceMs = opts?.shutdownGraceMs ?? DEFAULT_SHUTDOWN_GRACE_MS;
-  const attestationGraceMs = opts?.attestationGraceMs ?? DEFAULT_ATTESTATION_GRACE_MS;
-  const now = opts?.now ?? Date.now;
-  const monotonicNow = opts?.monotonicNow ?? (() => performance.now());
-  const approved = opts?.approvedIdentity ?? approvedIdentityForSpec(spec);
-  const child = spawn(command, [...args], {
-    stdio: ["pipe", "pipe", "pipe"],
-    cwd: opts?.cwd,
-    env: withClioAgentEnvironment(opts?.env ?? process.env),
-    // The worker leads its own process group so abort escalation covers the
-    // descendants a runtime spawned, not only the immediate child.
-    detached: true
-  });
-  const pid = child.pid ?? null;
-  const heartbeatWallAnchor = now();
-  const heartbeatMonotonicAnchor = monotonicNow();
-  const heartbeatAt = {
-    current: heartbeatWallAnchor,
-    monotonic: heartbeatMonotonicAnchor
-  };
-  const stampHeartbeat = () => {
-    const stamp = monotonicNow();
-    heartbeatAt.monotonic = stamp;
-    heartbeatAt.current = heartbeatWallAnchor + (stamp - heartbeatMonotonicAnchor);
-  };
-  const queue = createBoundedEventQueue();
-  const waiters = [];
-  let finished = false;
-  let malformedStdoutLines = 0;
-  let stderrTail = Buffer.alloc(0);
-  let channelFailure = null;
-  let attestation = null;
-  function appendStderr(chunk) {
-    const next = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-    if (next.length === 0) return;
-    const combined = Buffer.concat([stderrTail, next]);
-    stderrTail = combined.length > STDERR_TAIL_BYTES ? combined.subarray(combined.length - STDERR_TAIL_BYTES) : combined;
-  }
-  function diagnostics() {
-    const stderrText = stderrTail.toString("utf8").trim();
-    const dropped = queue.stats().droppedDisplayFrames + preAnnounce.stats().droppedDisplayFrames;
-    return {
-      ...stderrText.length > 0 ? { stderrTail: stderrText } : {},
-      ...malformedStdoutLines > 0 ? { malformedStdoutLines } : {},
-      ...dropped > 0 ? { droppedDisplayFrames: dropped } : {},
-      ...channelFailure !== null ? { channelFailure: channelFailure.operation } : {}
-    };
-  }
-  function push(value) {
-    stampHeartbeat();
-    const w = waiters.shift();
-    if (w) {
-      w({ value, done: false });
-      return;
-    }
-    queue.push(value);
-  }
-  function end() {
-    if (finished) return;
-    finished = true;
-    while (waiters.length > 0) {
-      const w = waiters.shift();
-      if (w) w({ value: void 0, done: true });
-    }
-  }
-  let sawSpawnError = false;
-  let announceAccepted = false;
-  let announceFailed = false;
-  function failAttestation(message) {
-    if (announceFailed) return;
-    announceFailed = true;
-    appendStderr(`[worker] ${message}
-`);
-    signalProcessGroup(child, "SIGKILL");
-  }
-  child.once("error", (err) => {
-    sawSpawnError = true;
-    push({
-      type: "spawn_error",
-      error: err instanceof Error ? err.message : String(err)
-    });
-    signalProcessGroup(child, "SIGKILL");
-  });
-  if (pid !== null && child.stdin) {
-    child.stdin.on("error", (err) => {
-      channelFailure = new WorkerChannelFailure("spec", err instanceof Error ? err.message : String(err));
-      appendStderr(`[worker] ${channelFailure.message}
-`);
-    });
-    child.stdin.write(`${JSON.stringify(spec)}
-`);
-  }
-  function createLineReader(maxBytes, onLine, onOversize) {
-    let buffer = "";
-    let discarding = false;
-    return (chunk) => {
-      buffer += chunk.toString("utf8");
-      let idx = buffer.indexOf("\n");
-      while (idx >= 0) {
-        const line = buffer.slice(0, idx);
-        buffer = buffer.slice(idx + 1);
-        if (discarding) {
-          discarding = false;
-          onOversize();
-        } else if (Buffer.byteLength(line, "utf8") > maxBytes) {
-          onOversize();
-        } else {
-          onLine(line);
-        }
-        idx = buffer.indexOf("\n");
-      }
-      if (Buffer.byteLength(buffer, "utf8") > maxBytes) {
-        buffer = "";
-        discarding = true;
-      }
-    };
-  }
-  const preAnnounce = createBoundedEventQueue();
-  let attestationGraceTimer = null;
-  function releaseHeldFrames() {
-    if (attestationGraceTimer !== null) {
-      clearTimeout(attestationGraceTimer);
-      attestationGraceTimer = null;
-    }
-    while (preAnnounce.size > 0) push(preAnnounce.shift());
-  }
-  function startAttestationGrace() {
-    if (attestationGraceTimer !== null || announceAccepted || announceFailed) return;
-    attestationGraceTimer = setTimeout(() => {
-      attestationGraceTimer = null;
-      if (announceAccepted || announceFailed) return;
-      failAttestation("Missing worker attestation: the peer produced output without announcing its route identity");
-    }, attestationGraceMs);
-    attestationGraceTimer.unref?.();
-  }
-  function handleBulkLine(line) {
-    const trimmed = line.trim();
-    if (trimmed.length === 0) return;
-    const frame = parseBulkFrame(trimmed);
-    if (!frame.ok) {
-      malformedStdoutLines += 1;
-      return;
-    }
-    if (announceFailed) return;
-    if (!announceAccepted) {
-      preAnnounce.push(frame.value);
-      startAttestationGrace();
-      return;
-    }
-    push(frame.value);
-  }
-  function handleControlLine(line) {
-    const frame = parseControlFrame(line);
-    if (!frame.ok) {
-      appendStderr(`[worker] rejected control frame: ${frame.reason}
-`);
-      if (!announceAccepted) failAttestation(`Invalid worker attestation: ${frame.reason}`);
-      return;
-    }
-    stampHeartbeat();
-    if (frame.value.kind === "announce") {
-      if (announceAccepted || announceFailed) return;
-      const verdict = verifyWorkerAttestation(frame.value.attestation, approved);
-      if (!verdict.ok) {
-        failAttestation(`Worker attestation rejected: ${verdict.reason}`);
-        return;
-      }
-      announceAccepted = true;
-      attestation = frame.value.attestation;
-      opts?.onAnnounce?.(frame.value.attestation);
-      releaseHeldFrames();
-      return;
-    }
-    if (frame.value.kind === "ledger_post") {
-      if (!announceAccepted) {
-        appendStderr("[worker] dropped a ledger post that arrived before attestation was accepted\n");
-        return;
-      }
-      opts?.onLedgerPost?.(frame.value.body);
-      return;
-    }
-    opts?.onControl?.({ kind: frame.value.kind });
-  }
-  if (child.stdout) {
-    child.stdout.on(
-      "data",
-      createLineReader(WORKER_BULK_FRAME_MAX_BYTES, handleBulkLine, () => {
-        malformedStdoutLines += 1;
-        appendStderr(`[worker] dropped a bulk frame over the ${WORKER_BULK_FRAME_MAX_BYTES} byte lane limit
-`);
-      })
-    );
-  }
-  if (child.stderr) {
-    child.stderr.on(
-      "data",
-      createLineReader(
-        WORKER_BULK_FRAME_MAX_BYTES,
-        (line) => {
-          if (isControlLine(line)) {
-            handleControlLine(line);
-            return;
-          }
-          appendStderr(`${line}
-`);
-        },
-        () => appendStderr("[worker] dropped an oversized stderr line\n")
-      )
-    );
-  }
-  const events = {
-    next() {
-      if (queue.size > 0) {
-        return Promise.resolve({ value: queue.shift(), done: false });
-      }
-      if (finished) return Promise.resolve({ value: void 0, done: true });
-      return new Promise((resolve) => {
-        waiters.push(resolve);
-      });
-    },
-    return() {
-      end();
-      return Promise.resolve({ value: void 0, done: true });
-    },
-    [Symbol.asyncIterator]() {
-      return this;
-    }
-  };
-  let settled = false;
-  let abortStarted = false;
-  let killTimer = null;
-  let pendingClose = null;
-  function hasOwnedProcesses() {
-    if (pid === null) return false;
-    if (process.platform !== "win32") {
-      try {
-        process.kill(-pid, 0);
-        return true;
-      } catch (error) {
-        if (error.code === "EPERM") return true;
-      }
-    }
-    return isAlive();
-  }
-  const promise = new Promise((resolve) => {
-    child.on("close", (code, signal) => {
-      const finish = () => {
-        if (settled) return;
-        settled = true;
-        try {
-          child.stdin?.end();
-        } catch {
-        }
-        end();
-        if (sawSpawnError) {
-          resolve({ exitCode: null, signal: null, ...diagnostics() });
-          return;
-        }
-        if (!announceAccepted && !announceFailed) {
-          announceFailed = true;
-          appendStderr("[worker] Missing worker attestation: peer exited before announcing its route identity\n");
-        }
-        if (announceFailed) {
-          resolve({ exitCode: code !== null && code !== 0 ? code : 1, signal: signal ?? null, ...diagnostics() });
-          return;
-        }
-        resolve({ exitCode: code ?? 0, signal: signal ?? null, ...diagnostics() });
-      };
-      if (killTimer !== null && hasOwnedProcesses()) {
-        pendingClose = finish;
-        return;
-      }
-      if (killTimer !== null) clearTimeout(killTimer);
-      killTimer = null;
-      finish();
-    });
-  });
-  function isAlive() {
-    return child.exitCode === null && child.signalCode === null;
-  }
-  let queuedStdinBytes = 0;
-  function failChannel(operation, detail) {
-    channelFailure = new WorkerChannelFailure(operation, detail);
-    appendStderr(`[worker] ${channelFailure.message}
-`);
-    return false;
-  }
-  const send = (value) => {
-    const frameType = typeof value === "object" && value !== null ? value.type : void 0;
-    const operation = frameType === "permission_decision" ? "permission_decision" : frameType === "ledger_delta" ? "ledger_delta" : "steer";
-    if (!isAlive()) return failChannel(operation, "worker has exited");
-    const stdin = child.stdin;
-    if (!stdin || stdin.destroyed || !stdin.writable) return failChannel(operation, "worker stdin is not writable");
-    const line = `${JSON.stringify(value)}
-`;
-    const bytes = Buffer.byteLength(line, "utf8");
-    if (bytes > WORKER_STDIN_FRAME_MAX_BYTES) {
-      return failChannel(operation, `frame of ${bytes} bytes exceeds the ${WORKER_STDIN_FRAME_MAX_BYTES} byte limit`);
-    }
-    if (queuedStdinBytes + bytes > WORKER_STDIN_QUEUE_MAX_BYTES) {
-      return failChannel(
-        operation,
-        `stdin queue is full (${queuedStdinBytes} of ${WORKER_STDIN_QUEUE_MAX_BYTES} bytes pending)`
-      );
-    }
-    try {
-      queuedStdinBytes += bytes;
-      stdin.write(line, (error) => {
-        queuedStdinBytes -= bytes;
-        if (error) failChannel(operation, error.message);
-      });
-      return true;
-    } catch (error) {
-      queuedStdinBytes -= bytes;
-      return failChannel(operation, error instanceof Error ? error.message : String(error));
-    }
-  };
-  const abort = () => {
-    if (settled || abortStarted || !hasOwnedProcesses()) return;
-    abortStarted = true;
-    try {
-      child.stdin?.end();
-    } catch {
-    }
-    signalProcessGroup(child, "SIGTERM");
-    killTimer = setTimeout(() => {
-      killTimer = null;
-      if (hasOwnedProcesses()) {
-        signalProcessGroup(child, "SIGKILL");
-        try {
-          opts?.onForcedKill?.();
-        } catch {
-        }
-      }
-      const finish = pendingClose;
-      pendingClose = null;
-      finish?.();
-    }, shutdownGraceMs);
-  };
-  return {
-    pid,
-    processCommand: JSON.stringify([command, ...args]),
-    promise,
-    events,
-    abort,
-    heartbeatAt,
-    send,
-    lastChannelFailure: () => channelFailure,
-    attestation: () => attestation
-  };
-}
-function spawnNativeWorker(spec, opts) {
-  const workerEntry = opts?.workerEntryPath ?? join(resolvePackageRoot(), "dist/worker/entry.js");
-  const { workerEntryPath: _entryPath, ...processOptions } = opts ?? {};
-  return spawnWorkerProcess(process.execPath, ["--disable-warning=ExperimentalWarning", workerEntry], spec, {
-    ...processOptions,
-    env: withCompileCacheEnvironment(opts?.env ?? process.env)
-  });
-}
-function withCompileCacheEnvironment(env) {
-  return workerCompileCacheEnvironment(env, enableClioCompileCache());
-}
-
-// src/domains/dispatch/transport.ts
-var LOCAL_NODE_ID = "local";
-function localNodeIdentity() {
-  return { id: LOCAL_NODE_ID, kind: "local" };
-}
-var DEFAULT_SSH_CONNECT_TIMEOUT_SEC = 10;
-var DEFAULT_REMOTE_CLIO_ENTRY = "clio-coder worker";
-function remoteEnvAssignments(node) {
-  const labels = (node.labels ?? []).map((label) => label.trim()).filter((label) => label.length > 0);
-  const labelAssignment = labels.length > 0 ? ` CLIO_CODER_WORKER_LABELS=${shellQuote(labels.join(","))}` : "";
-  return `AI_AGENT=${AI_AGENT_NAME} CLIO_CODER_WORKER_PGID=$$${labelAssignment}`;
-}
-function resolveSshTargetLifecycle(residency, targetLifecycle) {
-  if (targetLifecycle === "user-managed" || residency !== "manage") return "user-managed";
-  return "clio-coder-managed";
-}
-function workerSpecForSshNode(node, spec) {
-  return {
-    ...spec,
-    target: {
-      ...spec.target,
-      lifecycle: resolveSshTargetLifecycle(node.residency, spec.target.lifecycle)
-    }
-  };
-}
-function buildRemoteWorkerCommand(node, cwd) {
-  const entry = node.clioCoderEntry !== void 0 && node.clioCoderEntry.trim().length > 0 ? node.clioCoderEntry.trim() : DEFAULT_REMOTE_CLIO_ENTRY;
-  return `cd ${shellQuote(cwd)} && exec env ${remoteEnvAssignments(node)} ${entry}`;
-}
-function buildSshArgs(node, remoteCommand) {
-  const connectTimeout = node.connectTimeoutSec ?? DEFAULT_SSH_CONNECT_TIMEOUT_SEC;
-  const args = [
-    "-o",
-    "BatchMode=yes",
-    "-o",
-    `ConnectTimeout=${connectTimeout}`,
-    // The channel is a byte pipe, never a terminal: a pty would translate
-    // newlines and inject control sequences into the NDJSON stream.
-    "-T"
-  ];
-  if (node.port !== void 0) args.push("-p", String(node.port));
-  if (node.identityFile !== void 0 && node.identityFile.length > 0) args.push("-i", node.identityFile);
-  if (node.user !== void 0 && node.user.length > 0) args.push("-l", node.user);
-  args.push(node.host, "--", remoteCommand);
-  return args;
-}
-function createSshWorkerTransport(node, opts) {
-  const sshBinary = opts?.sshBinary ?? "ssh";
-  const identity = { id: node.id, kind: "ssh", host: node.host };
-  return {
-    kind: "ssh",
-    node: identity,
-    spawn(spec, spawnOpts) {
-      const cwd = spawnOpts?.cwd ?? process.cwd();
-      const remote = { pid: null, processGroupId: null };
-      const killRemote = () => {
-        const group = remote.processGroupId;
-        const command = group !== null ? `kill -TERM -${group} 2>/dev/null || kill -TERM ${remote.pid ?? group} 2>/dev/null || true` : remote.pid !== null ? `kill -TERM ${remote.pid} 2>/dev/null || true` : null;
-        if (command === null) return;
-        try {
-          const fallback = spawn2(sshBinary, buildSshArgs(node, command), {
-            stdio: "ignore",
-            detached: true
-          });
-          fallback.unref();
-        } catch {
-        }
-      };
-      const { cwd: _consumedCwd, onAnnounce, onForcedKill, ...forwarded } = spawnOpts ?? {};
-      return spawnWorkerProcess(
-        sshBinary,
-        buildSshArgs(node, buildRemoteWorkerCommand(node, cwd)),
-        workerSpecForSshNode(node, spec),
-        {
-          ...opts?.shutdownGraceMs !== void 0 ? { shutdownGraceMs: opts.shutdownGraceMs } : {},
-          ...forwarded,
-          env: process.env,
-          onAnnounce: (attestation) => {
-            remote.pid = attestation.pid;
-            remote.processGroupId = attestation.processGroupId;
-            onAnnounce?.(attestation);
-          },
-          onForcedKill: () => {
-            killRemote();
-            onForcedKill?.();
-          }
-        }
-      );
-    }
-  };
-}
-
-// src/domains/dispatch/fleet-preflight.ts
-function storePath() {
-  return join2(clioStateDir(), "fleet-preflight.json");
-}
-function readFleetPreflightRecords() {
-  const path = storePath();
-  if (!existsSync(path)) return [];
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
-    if (parsed?.version !== 2 || !Array.isArray(parsed.records)) return [];
-    return parsed.records;
-  } catch {
-    return [];
-  }
-}
-function recordFleetPreflight(records) {
-  const merged = /* @__PURE__ */ new Map();
-  for (const record of [...readFleetPreflightRecords(), ...records]) {
-    merged.set(`${record.nodeId}\0${record.projectRoot}`, record);
-  }
-  const file = { version: 2, records: [...merged.values()] };
-  atomicWrite(storePath(), JSON.stringify(file, null, 2));
-}
-function fleetPreflightVerdict(node, projectRoot, records = readFleetPreflightRecords()) {
-  const record = records.find((entry) => entry.nodeId === node.id && entry.projectRoot === projectRoot);
-  if (!record) {
-    return {
-      ok: false,
-      reason: `node '${node.id}' has not passed the fleet preflight for ${projectRoot}; run 'clio-coder doctor --fix'`
-    };
-  }
-  if (record.host !== node.host) {
-    return {
-      ok: false,
-      reason: `node '${node.id}' preflight was recorded for host '${record.host}' but the node now points at '${node.host}'; run 'clio-coder doctor --fix'`
-    };
-  }
-  if (record.localVersion !== readClioVersion()) {
-    return {
-      ok: false,
-      reason: `node '${node.id}' preflight predates a local clio-coder upgrade (${record.localVersion} -> ${readClioVersion()}); run 'clio-coder doctor --fix'`
-    };
-  }
-  if (!record.ok) {
-    return {
-      ok: false,
-      reason: `node '${node.id}' failed its last fleet preflight: ${record.detail ?? "see clio-coder doctor"}`
-    };
-  }
-  return { ok: true, reason: null };
-}
-function routeFactVerdict(requirement, records = readFleetPreflightRecords(), options) {
-  const targets = [];
-  const resources = [];
-  for (const record of records) {
-    targets.push(...record.targets);
-    if (record.resources !== null) resources.push(record.resources);
-  }
-  return evaluateRouteFacts(targets, resources, requirement, options);
-}
-var PREFLIGHT_MARKER = "clio-coder-preflight/1";
-var LEGACY_PREFLIGHT_MARKER = "clio-preflight/1";
-var DEFAULT_PREFLIGHT_TIMEOUT_MS = 2e4;
-function buildPreflightScript(node, projectRoot, targets = []) {
-  const entry = node.clioCoderEntry !== void 0 && node.clioCoderEntry.trim().length > 0 ? node.clioCoderEntry.trim() : "clio-coder worker";
-  const cliBase = entry.endsWith(" worker") ? entry.slice(0, -" worker".length) : null;
-  const versionProbe = cliBase !== null ? `v=$(${cliBase} --version 2>/dev/null | head -n 1); if [ -n "$v" ]; then echo "clioCoder=$v"; else echo clioCoder=missing; fi` : `echo clioCoder=custom-entry`;
-  const lines = [
-    `echo ${shellQuote(PREFLIGHT_MARKER)}`,
-    `if cd ${shellQuote(projectRoot)} 2>/dev/null; then echo cwd=ok; else echo cwd=missing; fi`,
-    versionProbe,
-    `d="\${XDG_STATE_HOME:-$HOME/.local/state}/clio-coder"; if mkdir -p "$d" 2>/dev/null && [ -w "$d" ]; then echo state=ok; else echo state=fail; fi`,
-    // Resource observation runs on the node. A node without nvidia-smi reports
-    // unknown; it never reports zero GPUs, which a fit requirement would read
-    // as a proven absence rather than an absence of evidence.
-    `echo "cpu=$(nproc 2>/dev/null || echo unknown)"`,
-    `echo "memkb=$(awk '/MemTotal/{print $2}' /proc/meminfo 2>/dev/null || echo unknown)"`,
-    `g=$(nvidia-smi --query-gpu=memory.total --format=csv,noheader,nounits 2>/dev/null); if [ -n "$g" ]; then echo "gpu=$(echo "$g" | wc -l)"; echo "vrammb=$(echo "$g" | paste -sd+ - | bc 2>/dev/null || echo unknown)"; else echo gpu=unknown; echo vrammb=unknown; fi`
-  ];
-  for (const target of targets) {
-    if (target.url === void 0 || target.url.trim().length === 0) {
-      lines.push(`echo ${shellQuote(`target=${target.id}:noendpoint`)}`);
-      continue;
-    }
-    const modelsUrl = `${target.url.replace(/\/+$/u, "")}/v1/models`;
-    lines.push(
-      `b=$(curl -sS -m 5 -o /dev/null -w '%{http_code}' ${shellQuote(modelsUrl)} 2>/dev/null || echo 000); m=$(curl -sS -m 5 ${shellQuote(modelsUrl)} 2>/dev/null || echo ""); echo ${shellQuote(`target=${target.id}:`)}"$b"; ` + (target.wireModelId !== void 0 ? `case "$m" in *${shellQuote(target.wireModelId).slice(1, -1)}*) echo ${shellQuote(`model=${target.id}:true`)};; *) echo ${shellQuote(`model=${target.id}:false`)};; esac` : `echo ${shellQuote(`model=${target.id}:unknown`)}`)
-    );
-  }
-  return lines.join("; ");
-}
-function parseSemver(text) {
-  const match = text.match(/(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/);
-  return match?.[1] ?? null;
-}
-function parseUnknownableNumber(lines, prefix, scale = 1) {
-  const line = lines.find((entry) => entry.startsWith(prefix));
-  if (line === void 0) return null;
-  const raw = line.slice(prefix.length).trim();
-  const value = Number.parseInt(raw, 10);
-  return Number.isFinite(value) && value >= 0 ? value * scale : null;
-}
-function parseTargetFacts(lines, targets, probedAt, probeDurationMs) {
-  return targets.map((target) => {
-    const statusLine = lines.find((entry) => entry.startsWith(`target=${target.id}:`));
-    const status = statusLine?.slice(`target=${target.id}:`.length).trim() ?? "";
-    const code = Number.parseInt(status, 10);
-    const reachable = status === "" ? "unknown" : status === "noendpoint" ? "unknown" : Number.isFinite(code) && code >= 200 && code < 500 ? "true" : "false";
-    const modelLine = lines.find((entry) => entry.startsWith(`model=${target.id}:`));
-    const modelValue = modelLine?.slice(`model=${target.id}:`.length).trim();
-    const modelAvailable = modelValue === "true" ? "true" : modelValue === "false" ? "false" : "unknown";
-    return {
-      nodeId: "",
-      targetId: target.id,
-      reachable,
-      // The runtime the target names is registered in this same release on
-      // every node, and the version check already proved release parity.
-      runtimeCompatible: reachable === "true" ? "true" : "unknown",
-      modelAvailable,
-      // A worker observes only the models it loads itself, so residency is
-      // never inferred from an endpoint listing.
-      modelResident: "unknown",
-      endpointIdentityHash: endpointIdentityHash(target.url),
-      wireModelId: target.wireModelId ?? null,
-      probedAt,
-      probeDurationMs
-    };
-  });
-}
-function runSsh(sshBinary, args, timeoutMs) {
-  return new Promise((resolve) => {
-    execFile(sshBinary, [...args], { timeout: timeoutMs, encoding: "utf8" }, (error, stdout, stderr) => {
-      const code = error === null ? 0 : typeof error.code === "number" ? error.code : 255;
-      resolve({ code, stdout: stdout ?? "", stderr: stderr ?? "" });
-    });
-  });
-}
-async function runFleetNodePreflight(node, projectRoot, options) {
-  const sshBinary = options?.sshBinary ?? "ssh";
-  const timeoutMs = options?.timeoutMs ?? DEFAULT_PREFLIGHT_TIMEOUT_MS;
-  const localVersion = readClioVersion();
-  const checkedAt = (options?.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
-  const checks = {
-    reachable: false,
-    clioPresent: false,
-    versionMatch: false,
-    pathParity: false,
-    stateDirWritable: false
-  };
-  const targets = options?.targets ?? [];
-  const record = {
-    nodeId: node.id,
-    host: node.host,
-    projectRoot,
-    ok: false,
-    checkedAt,
-    localVersion,
-    remoteVersion: null,
-    detail: null,
-    checks,
-    targets: [],
-    resources: null
-  };
-  const script = buildPreflightScript(node, projectRoot, targets);
-  const probeStartedAt = performance2.now();
-  const result = await runSsh(sshBinary, buildSshArgs(node, script), timeoutMs);
-  const probeDurationMs = Math.round(performance2.now() - probeStartedAt);
-  if (!result.stdout.includes(PREFLIGHT_MARKER) && !result.stdout.includes(LEGACY_PREFLIGHT_MARKER)) {
-    const stderr = result.stderr.trim().split("\n").slice(-1)[0] ?? "";
-    record.detail = `unreachable (ssh exit ${result.code}${stderr.length > 0 ? `: ${stderr}` : ""})`;
-    return record;
-  }
-  checks.reachable = true;
-  const lines = result.stdout.split("\n").map((line) => line.trim());
-  record.targets = parseTargetFacts(lines, targets, checkedAt, probeDurationMs).map((fact) => ({
-    ...fact,
-    nodeId: node.id
-  }));
-  record.resources = {
-    nodeId: node.id,
-    labels: [...node.labels ?? []],
-    cpuCount: parseUnknownableNumber(lines, "cpu="),
-    totalMemoryBytes: parseUnknownableNumber(lines, "memkb=", 1024),
-    gpuCount: parseUnknownableNumber(lines, "gpu="),
-    vramBytes: parseUnknownableNumber(lines, "vrammb=", 1024 * 1024),
-    observedAt: checkedAt
-  };
-  checks.pathParity = lines.includes("cwd=ok");
-  checks.stateDirWritable = lines.includes("state=ok");
-  const clioCoderLine = lines.find((line) => line.startsWith("clioCoder="));
-  const legacyClioLine = lines.find((line) => line.startsWith("clio="));
-  const clioValue = clioCoderLine?.slice("clioCoder=".length) ?? legacyClioLine?.slice("clio=".length) ?? "missing";
-  if (clioValue === "custom-entry") {
-    checks.clioPresent = true;
-    checks.versionMatch = true;
-    record.remoteVersion = null;
-  } else if (clioValue !== "missing") {
-    checks.clioPresent = true;
-    record.remoteVersion = parseSemver(clioValue);
-    checks.versionMatch = record.remoteVersion !== null && record.remoteVersion === parseSemver(localVersion);
-  }
-  const failures = [];
-  if (!checks.pathParity)
-    failures.push(`project root ${projectRoot} missing on node (disjoint filesystems are unsupported)`);
-  if (!checks.clioPresent)
-    failures.push("clio-coder not found on remote PATH (set fleet.nodes[].clioCoderEntry or install clio-coder)");
-  else if (!checks.versionMatch) {
-    failures.push(
-      `clio-coder version mismatch (local ${parseSemver(localVersion) ?? localVersion}, remote ${record.remoteVersion ?? "unknown"})`
-    );
-  }
-  if (!checks.stateDirWritable) failures.push("remote clio-coder state dir is not writable");
-  record.ok = failures.length === 0;
-  record.detail = failures.length > 0 ? failures.join("; ") : null;
-  return record;
-}
-
-export {
-  computeSettingsFingerprint,
-  receiptAttestationFields,
-  spawnNativeWorker,
-  LOCAL_NODE_ID,
-  localNodeIdentity,
-  createSshWorkerTransport,
-  readFleetPreflightRecords,
-  recordFleetPreflight,
-  fleetPreflightVerdict,
-  routeFactVerdict,
-  runFleetNodePreflight
-};
-//# sourceMappingURL=chunk-A6DULIMH.js.map