@karma42/agent 0.1.0-beta.3 → 0.1.0-beta.4

package/runtime/runner.mjs

@@ -1,591 +0,0 @@
-#!/usr/bin/env node
-// Keeps one locally operated coding agent in a project without spending model usage on waiting. It
-// runs a model turn, then asks the server every 20 seconds (POST /v2/wait) whether the agent
-// has events it has not acknowledged, runs a turn when it has, and so on. Needs Node 22 or newer
-// and a signed-in Claude Code 2.1.259+ or Codex CLI 0.160.0+.
-//
-//   node runner.mjs <service url> <agent name> <repository folder>
-//
-// The service URL is the project's, ending in /p/<project id>. The agent's token is kept in
-// ~/.agent-projects/<project id>/<agent name>/token (mode 600); the runner asks for it on the
-// first start. Claude uses only the kit settings. Codex retains native policy,
-// uses workspace-write with automatic review unless PILOT_PERMISSION_MODE=bypassPermissions, and
-// disables personal MCPs/plugins/hooks/apps for this invocation. Provider authentication remains local. Optional environment settings:
-//   PILOT_TAKEOVER               explicit v2 takeover of another run (0)
-//   PILOT_HOME                   where the runner keeps its files   (~/.agent-projects/<project id>)
-//   PILOT_POLL_SECONDS           how often to ask the server for news (20)
-//   PILOT_TURN_SECONDS           the longest model turn; 0 unlimited (0)
-//   PILOT_TURN_BUDGET_USD        the most a turn may spend; 0 unlimited (0)
-//   PILOT_MAX_TURNS_PER_HOUR     turns in any hour; 0 means no limit (0)
-//   PILOT_WORK_INTERVAL_MINUTES  quiet-work turns; 0 turns them off (0)
-//   PILOT_PROVIDER               explicit local client             (claude)
-//   PILOT_CODEX                  the codex command                  (codex)
-//   PILOT_MODEL                  model override; default resolved by the client
-//   PILOT_PERMISSION_MODE        Claude Code's permission mode      (acceptEdits);
-//                                bypassPermissions also runs Codex without its sandbox and approval review
-//   PILOT_ALLOWED_TOOLS          Claude Code's allowed tools, replacing the kit default (CLAUDE_ALLOWED_TOOLS in providers.mjs:
-//                                named git subcommands with origin only, gh issue/pr, gh label list, npm test/run/ci,
-//                                plain npm install, node --check/--test)
-//   PILOT_CLAUDE                 the claude command                 (claude)
-//   PILOT_PASS_ENV               extra variable names for the model client, comma-separated (none);
-//                                it otherwise receives only PATH, HOME, locale/system and provider sign-in
-import { KIT_FILES, appliedRelease, fetchRuntime, hash, installRelease, pruneReleases } from './runtime.mjs';
-import { CLAUDE_ALLOWED_TOOLS, createProvider } from './providers.mjs';
-import { ControlV2, DeferredMcp } from './control-v2.mjs';
-import { spawn, spawnSync } from 'node:child_process';
-import { createHash, randomUUID } from 'node:crypto';
-import {
-  appendFileSync, chmodSync, existsSync, linkSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync,
-} from 'node:fs';
-import { homedir } from 'node:os';
-import { join, resolve } from 'node:path';
-import { createInterface } from 'node:readline/promises';
-import { setTimeout as sleep } from 'node:timers/promises';
-
-const USAGE = 'Usage: node runner.mjs <service url> <agent name> <repository folder>';
-const FAILURES_BEFORE_STOP = 3;
-const HOUR_MS = 3_600_000;
-let PROMPT_FILE = join(import.meta.dirname, 'AGENT_PROMPT_V2.md');
-const SETTINGS_FILE = join(import.meta.dirname, 'claude-settings.json');
-
-const [serviceUrl, agentName, repoDirArg] = process.argv.slice(2);
-if (!serviceUrl || !agentName || !repoDirArg) {
-  console.error(USAGE);
-  process.exit(2);
-}
-if (!/^[\w-]{1,64}$/.test(agentName)) {
-  console.error('The agent name may have letters, digits, hyphens and underscores only.');
-  process.exit(2);
-}
-const serviceBase = new URL(serviceUrl);
-const projectPath = /^\/p\/([a-f0-9]{64})\/?$/.exec(serviceBase.pathname);
-if (serviceBase.username || serviceBase.password || serviceBase.search || serviceBase.hash || !projectPath
-  || !(serviceBase.protocol === 'https:' || serviceBase.protocol === 'http:' && ['localhost', '127.0.0.1'].includes(serviceBase.hostname))) throw new Error('Use the project service URL from its connection instructions.');
-const projectId = projectPath[1];
-const url = serviceUrl.replace(/\/+$/, '');
-const repoDir = resolve(repoDirArg);
-if (!existsSync(repoDir) || !statSync(repoDir).isDirectory()) {
-  console.error(`The repository folder ${repoDir} does not exist.`);
-  process.exit(2);
-}
-
-const settings = {
-  home: process.env.PILOT_HOME ?? join(homedir(), '.agent-projects', projectId),
-  pollSeconds: numberSetting('PILOT_POLL_SECONDS', 20, 1),
-  turnSeconds: numberSetting('PILOT_TURN_SECONDS', 0),
-  turnBudgetUsd: numberSetting('PILOT_TURN_BUDGET_USD', 0),
-  maxTurnsPerHour: numberSetting('PILOT_MAX_TURNS_PER_HOUR', 0),
-  workIntervalMinutes: numberSetting('PILOT_WORK_INTERVAL_MINUTES', 0),
-  model: process.env.PILOT_MODEL,
-  permissionMode: process.env.PILOT_PERMISSION_MODE ?? 'acceptEdits',
-  allowedTools: process.env.PILOT_ALLOWED_TOOLS ?? CLAUDE_ALLOWED_TOOLS,
-  claude: process.env.PILOT_CLAUDE ?? 'claude',
-  passEnv: process.env.PILOT_PASS_ENV ?? '',
-  codex: process.env.PILOT_CODEX ?? 'codex',
-  provider: process.env.PILOT_PROVIDER ?? 'claude', repoDir,
-};
-const provider = createProvider(settings.provider, settings);
-const stateDir = join(settings.home, agentName);
-const serviceIdentity = join(stateDir, 'service.json');
-if (existsSync(serviceIdentity) && JSON.parse(readFileSync(serviceIdentity, 'utf8')).service !== url) throw new Error('This local connection belongs to another project service.');
-const files = {
-  token: join(stateDir, 'token'),
-  mcpConfig: join(stateDir, 'mcp.json'),
-  session: join(stateDir, provider.id === 'claude' ? 'session' : 'codex-session'),
-  log: join(stateDir, 'runner.log'),
-  lock: join(stateDir, 'lock'),
-  budget: join(stateDir, 'turn-starts.json'),
-  sends: join(stateDir, 'deferred-sends.json'),
-};
-const prompts = {
-  start: 'Read get_project and the applicable project instructions. If started and not paused, begin useful work toward the actual project goal now. Choose how to investigate, contribute or collaborate according to that guidance; an empty inbox does not mean there is no work. Reconcile prior local/GitHub state and recovery checkpoints before repeating external actions. Handle and acknowledge delivered items; preserve useful unfinished intent or concrete blockers before finishing.',
-  events: 'Read get_project and your directed inbox with get_updates. Handle relevant requests according to the project instructions, choosing useful work or collaboration when appropriate. Reconcile uncertain prior actions. Acknowledge only handled items and preserve any responsibility that needs later work before finishing.',
-  work: 'Read get_project, reconcile relevant local/GitHub state and your recovery checkpoints. Continue useful runnable work according to project instructions, or investigate a new contribution when appropriate. Avoid duplicating prior actions. If blocked, report the concrete blocker and finish without polling inside the model turn. Handle and acknowledge relevant updates.',
-};
-
-// Thrown to stop the runner with a message for the person.
-class Stop extends Error {}
-
-let child = null;          // the running claude process, if any
-let stopping = false;
-const lockId = `${process.pid} ${randomUUID()}`;  // what this runner writes in the lock
-let ownsLock = false;      // only the runner that wrote the lock removes it
-let repeatedFailures = false;  // the stop was the three-failure stop; other local faults report no reason
-let control = null;
-let deferredMcp = null;
-let bridgeConnection = null;
-let sendDeferred = false;
-let lastTurnOutcome = 'failed';
-let continueWork = false;
-let usageSequence = 0;
-let updateRequested = false;
-const installedKitHash = hash(JSON.stringify(KIT_FILES.map(name => [name, hash(readFileSync(join(import.meta.dirname, name), 'utf8'))])));
-const initialRuntime = process.env.PILOT_RUNTIME_FILE ? JSON.parse(readFileSync(process.env.PILOT_RUNTIME_FILE, 'utf8')) : undefined;
-if (initialRuntime && initialRuntime.kitHash !== installedKitHash) throw new Error('Installed runtime does not match its release metadata.');
-let lastTurnUsage;
-const turnStarts = [];     // when the turns of the last hour started
-
-function numberSetting(name, fallback, min = 0) {
-  const raw = process.env[name];
-  if (raw === undefined || raw === '') return fallback;
-  const value = Number(raw);
-  if (!Number.isFinite(value) || value < min) {
-    console.error(`${name} must be a number of at least ${min}, not ${raw}.`);
-    process.exit(2);
-  }
-  return value;
-}
-
-function log(message) {
-  const line = `${new Date().toISOString()} ${message}`;
-  console.info(line);
-  appendFileSync(files.log, `${line}\n`);
-}
-
-// One runner per agent: a second one would run two model processes on the same events. The lock
-// holds the runner's pid and a random id. It is written to a file of its own first and then linked
-// into place, which fails if a lock exists, so no runner ever reads a half-written lock.
-function acquireLock() {
-  const draft = `${files.lock}.${process.pid}`;
-  writeFileSync(draft, lockId);
-  try {
-    for (;;) {
-      try {
-        linkSync(draft, files.lock);
-        ownsLock = true;
-        return;
-      } catch (error) {
-        if (error.code !== 'EEXIST') throw error;
-      }
-      const held = readLock();
-      if (held === null) continue;  // the other runner just stopped
-      const pid = Number(held.split(' ')[0]);
-      if (pid && isRunner(pid)) {
-        throw new Stop(`Another runner for ${agentName} is already running (process ${pid}). Run only one per agent. `
-          + `If you are sure none is running, delete ${files.lock} and start again.`);
-      }
-      removeStaleLock(held);
-    }
-  } finally {
-    rmSync(draft, { force: true });
-  }
-}
-
-function readLock() {
-  try {
-    return readFileSync(files.lock, 'utf8');
-  } catch (error) {
-    if (error.code === 'ENOENT') return null;
-    throw error;
-  }
-}
-
-// Removes a lock left by a runner that did not stop cleanly. Two runners can find the same stale
-// lock; the second could then remove the lock the first has just taken. So the lock is moved aside
-// first and checked: if it is no longer the stale one, it goes back.
-function removeStaleLock(stale) {
-  const aside = `${files.lock}.stale.${process.pid}`;
-  try {
-    renameSync(files.lock, aside);
-  } catch (error) {
-    if (error.code === 'ENOENT') return;
-    throw error;
-  }
-  try {
-    if (readFileSync(aside, 'utf8') !== stale) linkSync(aside, files.lock);
-  } catch (error) {
-    if (error.code !== 'EEXIST') throw error;
-  } finally {
-    rmSync(aside, { force: true });
-  }
-}
-
-// Whether the process is alive and is a runner. A pid in an old lock may since have been given to
-// some other process, after a reboot for example.
-function isRunner(pid) {
-  try {
-    process.kill(pid, 0);
-  } catch (error) {
-    if (error.code !== 'EPERM') return false;
-  }
-  const ps = spawnSync('ps', ['-o', 'command=', '-p', String(pid)], { encoding: 'utf8' });
-  if (ps.error) return true;  // no ps to ask: assume it is a runner
-  return ps.stdout.includes('runner.mjs');
-}
-
-async function loadToken() {
-  if (existsSync(files.token)) return readFileSync(files.token, 'utf8').trim();
-  if (!process.stdin.isTTY) {
-    throw new Stop(`There is no token in ${files.token}. Start the runner in a terminal once to enter it.`);
-  }
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  const token = (await rl.question(`Paste the token for agent ${agentName} and press Enter: `)).trim();
-  rl.close();
-  if (!/^[\w-]{20,}$/.test(token)) throw new Stop('That does not look like a token. Nothing was saved.');
-  writeFileSync(files.token, `${token}\n`, { mode: 0o600 });
-  log(`Token saved in ${files.token}.`);
-  return token;
-}
-
-// Claude Code reads the connection from this file. Only this agent's owner can read it.
-function writeMcpConfig(connection) {
-  writeFileSync(files.mcpConfig, `${JSON.stringify({ mcpServers: { pilot: connection } })}\n`, { mode: 0o600 });
-  chmodSync(files.mcpConfig, 0o600);
-}
-
-function checkProvider() {
-  const probe = provider.preflight();
-  log(`${probe.label}; local provider ${provider.id}; repository folder ${repoDir}; agent ${agentName} at ${url}.`);
-}
-
-// Separate client-owned sessions, bound to this checkout and instruction/tool revision.
-function loadSession() {
-  try {
-    return JSON.parse(readFileSync(files.session, 'utf8'));
-  } catch {
-    return null;
-  }
-}
-
-function saveSession(session) {
-  writeFileSync(files.session, `${JSON.stringify(session)}\n`, { mode: 0o600 });
-}
-
-// One model invocation in the repository folder. Returns 'done' when the client reported success,
-// 'bounded' when the turn reached its time or budget limit, and 'failed' otherwise.
-async function runTurn(kind) {
-  const promptHash = createHash('sha256').update(readFileSync(PROMPT_FILE)).update(control?.runtime?.mcpRevision ?? '').digest('hex');
-  let session = loadSession();
-  if (session && session.promptHash !== promptHash) {
-    log('AGENT_PROMPT_V2.md changed since the saved session began, so this turn starts a new session.');
-    session = null;
-  }
-  if (session?.repoDir && session.repoDir !== repoDir) throw new Stop('The saved model session belongs to another repository folder.');
-  const resuming = provider.canResume(session);
-  if (!resuming) {
-    session = provider.newSession(promptHash, repoDir);
-    saveSession(session);
-  }
-  const sendNotices = deferredMcp.journal.notices();
-  const sendContext = sendNotices.length ? `\nRunner deferred-send results (already processed; do not republish): ${JSON.stringify(sendNotices)}.` : '';
-  const invocation = provider.invocation({ prompt: prompts[kind] + sendContext, instructionsFile: PROMPT_FILE,
-    settingsFile: SETTINGS_FILE, mcpConfig: files.mcpConfig, bridge: bridgeConnection, session, resuming, repoDir,
-    clientVersion: `kit-${installedKitHash.slice(0, 12)}` });
-  log(`Turn (${kind}) starting${resuming ? ', continuing the saved session' : ' in a new session'}. ${settings.turnSeconds > 0 ? `The limit is ${settings.turnSeconds} s.` : 'No time or spending limit is configured.'}`);
-
-  lastTurnOutcome = 'failed';
-  continueWork = false;
-  const startedAt = Date.now();
-  sendDeferred = false;
-  // If this process dies mid-invocation, a restart must not attribute the interrupted gap
-  // to its next turn. Keep this invocation's prior baseline only in memory.
-  saveSession({ ...session, costUsd: null, tokenTotals: null });
-  deferredMcp.beginContext();
-  const run = await runModel(invocation, id => saveSession({ ...session, id, tokenTotals: null, costUsd: null }));
-  const context = { instructionBytes: Buffer.byteLength(readFileSync(PROMPT_FILE)),
-    turnPromptBytes: Buffer.byteLength(prompts[kind] + sendContext), ...deferredMcp.endContext() };
-  const seconds = Math.round((Date.now() - startedAt) / 1000);
-  const { report, init } = run;
-  if (resuming && !sendDeferred && provider.missingSession(run.stderr)) {
-    // Nothing ran, so nothing was spent: the turn that was to create the session ended first.
-    rmSync(files.session, { force: true });
-    log('Claude Code does not have the saved session, so the turn starts again in a new one.');
-    return runTurn(kind);
-  }
-  const bridgeCalls = context.tools.reduce((n, t) => n + t.calls, 0);
-  const measured = provider.usage(report, init);
-  lastTurnUsage = { sequence: ++usageSequence, seconds, ...measured, context,
-    toolCalls: run.toolCalls > 0 || !bridgeCalls ? run.toolCalls : bridgeCalls,
-    toolScope: run.truncated || !report || report.is_error ? 'partial' : run.toolCalls > 0 || !bridgeCalls ? 'provider-stream' : 'mcp-bridge' };
-  const usage = describeUsage(report, lastTurnUsage);
-  saveSession({ ...session, id: run.sessionId ?? session.id, provider: provider.id, repoDir,
-    tokenTotals: run.tokenTotals ?? null, costUsd: null });
-  log(`Coordination context: ${context.instructionBytes} instruction bytes, ${context.turnPromptBytes} turn-prompt bytes; `
-    + `${context.catalogRequests} catalog responses / ${context.catalogBytes} bytes; `
-    + `${context.tools.reduce((n, t) => n + t.calls, 0)} tool responses / ${context.tools.reduce((n, t) => n + t.responseTextBytes, 0)} text bytes. Provider context occupancy unknown.`);
-
-  if (sendDeferred) {
-    log(`Turn (${kind}) ended for a deferred send; retry waits outside the model${usage}.`);
-    return 'send_deferred';
-  }
-  if (run.timedOut) {
-    log(`Turn (${kind}) stopped at the time limit after ${seconds} s${usage}.`);
-    lastTurnOutcome = 'timed_out';
-    return 'bounded';
-  }
-  if (report?.subtype === 'error_max_budget_usd') {
-    log(`Turn (${kind}) stopped at its $${settings.turnBudgetUsd} budget after ${seconds} s${usage}.`);
-    lastTurnOutcome = 'budget_cap';
-    return 'bounded';
-  }
-  if (run.code !== 0 || !report || report.is_error) {
-    const detail = report?.errors?.length ? report.errors.map(String).join(' | ')
-      : report?.result ?? run.stderr.split('\n').filter((line) => line.trim()).slice(-2).join(' | ');
-    const login = provider.loginHint(`${detail} ${run.stderr}`);
-    log(`Turn (${kind}) failed after ${seconds} s (exit ${run.code ?? run.signal}${report?.subtype ? `, ${report.subtype}` : ''})${usage}. ${detail}${login}`.trim());
-    return 'failed';
-  }
-  continueWork = /(?:^|\n)WORK_NEXT: runnable\s*$/.test(report.result ?? '');
-  lastTurnOutcome = 'succeeded';
-  if (sendNotices.length) deferredMcp.journal.acknowledge(sendNotices);
-  log(`Turn (${kind}) done in ${seconds} s${usage}.`);
-  return 'done';
-}
-
-// Unknown provider counters remain unknown; no step count or price is reported.
-function describeUsage(report, usage) {
-  const parts = [`model ${usage.model ?? 'unknown'}`];
-  const u = usage.tokens; const value = v => v === null || v === undefined ? 'unknown' : v;
-  parts.push(u ? `tokens ${value(u.input)} in, ${value(u.output)} out, ${value(u.cacheRead)} cache read, ${value(u.cacheWrite)} cache write` : 'tokens unknown');
-  parts.push(`${usage.toolCalls} observed tool calls (${usage.toolScope})`);
-  if (report?.permission_denials?.length) parts.push(`${report.permission_denials.length} denied tool calls`);
-  return `; ${parts.join('; ')}`;
-}
-
-// Runs a turn unless the hour's turns are used up; then it first waits until one is an hour old.
-async function turn(kind) {
-  const prune = () => {
-    while (turnStarts.length && Date.now() - turnStarts[0] >= HOUR_MS) turnStarts.shift();
-  };
-  prune();
-  if (settings.maxTurnsPerHour > 0 && turnStarts.length >= settings.maxTurnsPerHour) {
-    const wait = turnStarts[0] + HOUR_MS - Date.now();
-    log(`${turnStarts.length} turns in the last hour, the most allowed (PILOT_MAX_TURNS_PER_HOUR). The next turn waits ${Math.ceil(wait / 60_000)} min.`);
-    await control.setPhase('backoff');
-    await controlledDelay(wait);
-    prune();
-  }
-  if (stopping) return 'deferred';
-  if (control.fatal) throw control.fatal;
-  if (!control.news || !control.news.project.started || control.news.project.paused) return 'deferred';
-  await control.setPhase('turn');
-  if (stopping || !control.news || !control.news.project.started || control.news.project.paused) return 'deferred';
-  turnStarts.push(Date.now());
-  writeFileSync(`${files.budget}.tmp`, JSON.stringify(turnStarts), { mode: 0o600 });
-  renameSync(`${files.budget}.tmp`, files.budget);
-  const outcome = await runTurn(kind);
-  await control.setPhase('idle', { kind, outcome: lastTurnOutcome, ended_at: Date.now(), usage: lastTurnUsage });
-  return outcome;
-}
-
-// Both local clients use the same contact, deadline and cancellation lifecycle.
-function runModel(invocation, onSession) {
-  return new Promise(resolvePromise => {
-    const process_ = spawn(invocation.command, invocation.args, { cwd: repoDir,
-      env: provider.environment(invocation.env), stdio: [invocation.rpc ? 'pipe' : 'ignore', 'pipe', 'pipe'] });
-    child = process_;
-    const stream = provider.collector({ rpc: invocation.rpc, log, session: onSession,
-      action: tool => { if (control) control.activity = { tool, at: Date.now() }; } });
-    if (invocation.rpc) {
-      process_.stdin.on('error', () => {});
-      stream.attach(process_); process_.pilotInterrupt = () => stream.interrupt();
-    }
-    let stderr = '', finished = false, timedOut = false;
-    const timers = [];
-    if (settings.turnSeconds > 0) timers.push(setTimeout(() => {
-      timedOut = true; interruptChild(process_);
-      timers.push(setTimeout(() => process_.kill('SIGTERM'), 30_000));
-      timers.push(setTimeout(() => process_.kill('SIGKILL'), 40_000));
-    }, settings.turnSeconds * 1000));
-    const done = (code, signal) => {
-      if (finished) return; finished = true; stream.end(); stream.cleanup?.();
-      for (const timer of timers) clearTimeout(timer); child = null;
-      resolvePromise({ code: invocation.rpc && stream.closed && stream.report ? 0 : code, signal, stderr, timedOut,
-        report: stream.report, init: stream.init, sessionId: stream.sessionId, tokenTotals: stream.tokenTotals,
-        toolCalls: stream.toolCalls, truncated: stream.truncated });
-    };
-    process_.stdout.setEncoding('utf8'); process_.stderr.setEncoding('utf8');
-    process_.stdout.on('data', chunk => stream.feed(chunk));
-    process_.stderr.on('data', chunk => { stderr = (stderr + chunk).slice(-64 * 1024); });
-    process_.on('error', error => { stderr += error.message; done(null, null); });
-    process_.on('close', done);
-  });
-}
-function interruptChild(process_) { if (process_.pilotInterrupt) process_.pilotInterrupt(); else process_.kill('SIGINT'); }
-
-async function main() {
-  mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-  acquireLock();
-  pruneReleases(stateDir, import.meta.dirname, import.meta.dirname);
-  checkProvider();
-  const token = await loadToken();
-  try {
-    const saved = JSON.parse(readFileSync(files.budget, 'utf8'));
-    if (!Array.isArray(saved) || saved.some((at) => !Number.isFinite(at))) throw new Error('invalid budget state');
-    turnStarts.push(...saved.filter((at) => Date.now() - at < HOUR_MS));
-  } catch (error) { if (error.code !== 'ENOENT') throw new Stop(`Cannot read the saved turn limit: ${error.message}`); }
-  log(`Settings: news every ${settings.pollSeconds} s; time ${settings.turnSeconds > 0 ? `${settings.turnSeconds} s` : 'unlimited'}; spending ${settings.turnBudgetUsd > 0 ? `$${settings.turnBudgetUsd}` : 'unlimited'}; ${settings.maxTurnsPerHour > 0 ? `at most ${settings.maxTurnsPerHour} an hour` : 'any number an hour'
-  }; quiet-work turns ${
-    settings.workIntervalMinutes > 0 ? `every ${settings.workIntervalMinutes} min` : 'off'}; provider ${provider.id}; ${provider.id === 'claude' ? `permission mode ${settings.permissionMode}; allowed tools ${settings.allowedTools === CLAUDE_ALLOWED_TOOLS ? 'kit default' : settings.allowedTools}; denied tools and hooks in ${SETTINGS_FILE}` : `${settings.permissionMode === 'bypassPermissions' ? 'full access by operator choice (PILOT_PERMISSION_MODE=bypassPermissions): no sandbox, no approval review, project tools approved' : 'workspace-write sandbox with automatic approval review'}; personal MCPs/plugins/hooks/apps disabled for this invocation`}; model client environment allowlisted${settings.passEnv.trim() ? ` plus ${settings.passEnv.trim()}` : ''}.`);
-  await runProject(token);
-}
-
-async function controlledDelay(ms) {
-  const end = Date.now() + ms;
-  while (!stopping && Date.now() < end) {
-    if (control.fatal) throw control.fatal;
-    await sleep(Math.min(1000, end - Date.now()));
-  }
-}
-
-async function runProject(token) {
-  control = new ControlV2(url, token, {
-    pollSeconds: settings.pollSeconds,
-    takeover: process.env.PILOT_TAKEOVER === '1', runtime: initialRuntime, log,
-    onFatal: error => {
-      if (error.code === 'runtime_update_required') updateRequested = true;
-      if (child) {
-        const process_ = child;
-        interruptChild(process_);
-        const timer = setTimeout(() => process_.kill('SIGKILL'), 5000);
-        process_.once('close', () => clearTimeout(timer));
-      }
-    },
-  });
-  await control.start();
-  deferredMcp = new DeferredMcp(control, files.sends, { log, onDeferred: () => {
-    if (child && !sendDeferred) {
-      sendDeferred = true;
-      const model = child; interruptChild(model);
-      const timer = setTimeout(() => model.kill('SIGKILL'), 5000);
-      model.once('close', () => clearTimeout(timer));
-    }
-  } });
-  bridgeConnection = await deferredMcp.listen();
-  writeMcpConfig(bridgeConnection);
-  log(`Protocol 2 run ${control.runId}; contact every ${control.pollSeconds} s, including during model work and waiting.`);
-  let first = true;
-  let failures = 0;
-  let handledWorkRevision = -1;
-  let lastTurnAt = Date.now();
-  while (!stopping) {
-    if (control.fatal) throw control.fatal;
-    if (deferredMcp.fault) throw new Stop('Deferred send journal could not be updated. Inspect it before restarting.');
-    const news = control.news;
-    if (!news) { await controlledDelay(1000); continue; }
-    if (!await adoptRuntime(token)) { await controlledDelay(control.pollSeconds * 1000); continue; }
-    if (!news.project.started || news.project.paused) {
-      if (control.phase !== 'paused') await control.setPhase('paused');
-      await controlledDelay(control.pollSeconds * 1000);
-      continue;
-    }
-    if (control.phase === 'paused') await control.setPhase('idle');
-    await deferredMcp.retryDue();
-    if (deferredMcp.journal.data.pending.length) {
-      if (control.phase !== 'backoff') await control.setPhase('backoff');
-      await controlledDelay(1000); continue;
-    }
-    const workDue = settings.workIntervalMinutes > 0 && Date.now() - lastTurnAt >= settings.workIntervalMinutes * 60_000;
-    const durableWork = news.work?.runnable === true && Number.isSafeInteger(news.work.revision)
-      && news.work.revision >= 0 && news.work.revision > handledWorkRevision;
-    if (first || news.pending > 0 || continueWork || durableWork || workDue || deferredMcp.journal.data.notices.length) {
-      // The initial turn already discovers the current card and acknowledges kickoff.
-      // Do not delay first contact with the model behind announcement jitter.
-      if (!first && !continueWork && !durableWork && news.project_only && !deferredMcp.journal.data.notices.length) {
-        await control.setPhase('backoff');
-        await controlledDelay(Math.random() * 120_000);
-      }
-      const kind = first ? 'start' : news.pending > 0 ? 'events' : 'work';
-      const outcome = await turn(kind);
-      if (outcome === 'deferred') { await controlledDelay(1000); continue; }
-      if (['done', 'bounded'].includes(outcome) && Number.isSafeInteger(news.work?.revision)) {
-        handledWorkRevision = Math.max(handledWorkRevision, news.work.revision);
-      }
-      first = false;
-      lastTurnAt = Date.now();
-      if (outcome === 'send_deferred') { failures = 0; await controlledDelay(1000); continue; }
-      // Wait for the monitor's next fresh observation rather than issuing an extra, rate-limited wait.
-      const prior = control.news;
-      while (!stopping && control.news === prior) await controlledDelay(1000);
-      const after = control.news;
-      if (outcome === 'failed' || (news.pending > 0 && after && after.acknowledged <= news.acknowledged)) failures++;
-      else failures = 0;
-      if (failures >= FAILURES_BEFORE_STOP) {
-        repeatedFailures = true;
-        throw new Stop('Three turns failed or left the inbox unacknowledged. Inspect runner.log before restarting.');
-      }
-      if (failures) {
-        await control.setPhase('backoff');
-        await controlledDelay(10_000 * 2 ** (failures - 1));
-        await control.setPhase('idle');
-      }
-    } else await controlledDelay(1000);
-  }
-}
-
-async function adoptRuntime(token) {
-  const selected = control.news?.runtime?.release;
-  if (!selected || selected.id === control.runtime?.id) return true;
-  if (selected.kitHash !== installedKitHash) {
-    updateRequested = true;
-    throw new Stop(`Runtime software update selected: ${control.news.runtime.reason}. ${process.env.PILOT_RUNTIME_MANAGED === '1' ? 'The foreground launcher will replace this runner.' : 'Start with the foreground launcher to adopt it automatically.'}`);
-  }
-  let latest;
-  try { latest = await fetchRuntime(url, token); } catch (error) {
-    if (error.fatal || /Unsupported|integrity|identity mismatch/.test(error.message)) throw error;
-    log(`Runtime update download failed; no new model invocation until it recovers (${error.message}).`);
-    return false;
-  }
-  const { release, reason } = latest;
-  if (!release) return true; // Selection was withdrawn before the boundary.
-  if (release.kitHash !== installedKitHash) {
-    updateRequested = true;
-    throw new Stop('Runtime software selection changed. The launcher must refresh the kit.');
-  }
-  const kit = installRelease(stateDir, release);
-  const oldRuntime = control.runtime;
-  control.runtime = appliedRelease(release);
-  try {
-    await control.setPhase('idle', undefined, true);
-  } catch (error) {
-    control.runtime = oldRuntime;
-    if (error.fatal) throw error;
-    log(`Runtime adoption report failed; retrying before starting work (${error.message}).`);
-    return false;
-  }
-  PROMPT_FILE = join(kit, 'AGENT_PROMPT_V2.md');
-  pruneReleases(stateDir, kit, import.meta.dirname);
-  log(`Adopted instructions ${release.instructionHash.slice(0, 12)}, MCP ${release.mcpRevision}, kit ${release.kitHash.slice(0, 12)}: ${reason}. A changed context begins with the next model invocation.`);
-  return true;
-}
-
-function shutDown(signal) {
-  if (stopping) return;
-  stopping = true;
-  log(`Stopping (${signal}).`);
-  if (child) {
-    interruptChild(child);
-    setTimeout(() => { child?.kill('SIGTERM'); finish(0); }, 15_000).unref();
-    child.on('close', () => finish(0));
-  } else {
-    finish(0);
-  }
-}
-
-let finishing;
-function finish(code) {
-  return finishing ??= (async () => {
-    if (deferredMcp) await deferredMcp.close();
-    if (control) await control.close(stopping ? 'operator' : updateRequested ? 'runtime_update' : repeatedFailures ? 'repeated_failures' : null);
-    if (ownsLock && readLock() === lockId) rmSync(files.lock, { force: true });
-    process.exit(code);
-  })();
-}
-
-process.on('SIGINT', () => shutDown('SIGINT'));
-process.on('SIGTERM', () => shutDown('SIGTERM'));
-process.on('SIGHUP', () => shutDown('SIGHUP'));  // the terminal was closed
-
-try {
-  await main();
-  await finish(0);
-} catch (error) {
-  if (error.code === 'runtime_update_required') updateRequested = true;
-  if (error instanceof Stop || error.fatal) {
-    const detail = `${error.code === 'unauthorized' ? 'Service credential refused. ' : ''}${error.message}`;
-    try { log(`Stopped: ${detail}`); } catch { console.error(`Stopped: ${detail}`); }
-    await finish(updateRequested ? 75 : 1);
-  }
-  try { log(`The runner crashed: ${error.stack ?? error}`); } catch { console.error(error); }
-  await finish(updateRequested ? 75 : 1);
-}

package/runtime/runtime.mjs

@@ -1,67 +0,0 @@
-// Trusted service releases are verified before adoption. Never accept arbitrary filenames/URLs.
-import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, readdirSync, statSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-export const KIT_FILES = ['runner.mjs', 'control-v2.mjs', 'runtime.mjs', 'claude-settings.json', 'providers.mjs'];
-export const hash = text => createHash('sha256').update(text).digest('hex');
-export const appliedRelease = release => ({ id: release.id, kitHash: release.kitHash, instructionHash: release.instructionHash, mcpRevision: release.mcpRevision });
-
-export function verifyRelease(release) {
-  if (!release || release.protocol !== 2 || release.launcherProtocol !== 2 || !/^[a-f0-9]{64}$/.test(release.id)
-    || !/^[\w.-]{1,100}$/.test(release.mcpRevision) || typeof release.instructions !== 'string'
-    || !release.instructions.trim() || Buffer.byteLength(release.instructions) > 64 * 1024
-    || !release.files || Object.keys(release.files).length !== KIT_FILES.length) throw new Error('Unsupported runtime release. Update the launcher manually.');
-  for (const name of KIT_FILES) {
-    const file = release.files[name];
-    if (!file || typeof file.content !== 'string' || !file.content || Buffer.byteLength(file.content) > 128 * 1024 || hash(file.content) !== file.sha256) throw new Error(`Runtime integrity check failed for ${name}.`);
-  }
-  if (hash(JSON.stringify(KIT_FILES.map(name => [name, release.files[name].sha256]))) !== release.kitHash
-    || hash(release.instructions) !== release.instructionHash
-    || hash(JSON.stringify([release.kitHash, release.instructionHash, release.mcpRevision])) !== release.id) throw new Error('Runtime release identity mismatch.');
-  return release;
-}
-
-export async function fetchRuntime(url, token) {
-  const response = await fetch(`${url}/v2/runtime`, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(30_000) });
-  const data = await response.json();
-  if (!response.ok) {
-    const error = new Error(`Runtime selection refused (${response.status}): ${data.message ?? 'unknown error'}`);
-    error.fatal = response.status >= 400 && response.status < 500 && response.status !== 429;
-    throw error;
-  }
-  if (data.release) verifyRelease(data.release);
-  return data;
-}
-
-export function installRelease(stateDir, release) {
-  verifyRelease(release);
-  const root = join(stateDir, 'runtime-releases');
-  mkdirSync(root, { recursive: true, mode: 0o700 });
-  const target = join(root, release.id);
-  const expected = { ...Object.fromEntries(KIT_FILES.map(name => [name, release.files[name].content])),
-    'AGENT_PROMPT_V2.md': release.instructions, 'applied.json': JSON.stringify(appliedRelease(release)) };
-  if (existsSync(target)) {
-    for (const [name, text] of Object.entries(expected)) {
-      if (readFileSync(join(target, name), 'utf8') !== text) throw new Error(`Cached runtime ${release.id} was modified; no files were overwritten.`);
-    }
-    return target;
-  }
-  const draft = `${target}.download-${process.pid}`;
-  mkdirSync(draft, { mode: 0o700 });
-  try {
-    for (const [name, text] of Object.entries(expected)) writeFileSync(join(draft, name), text, { mode: 0o600 });
-    renameSync(draft, target);
-  } finally { rmSync(draft, { recursive: true, force: true }); }
-  return target;
-}
-
-// Keep the adopted kit, executing kit and one previous cache for rollback. Other generated
-// release directories are disposable; session/token/checkout/usage files are never touched.
-export function pruneReleases(stateDir, current, executing) {
-  const root = join(stateDir, 'runtime-releases');
-  if (!existsSync(root)) return;
-  const entries = readdirSync(root).filter(id => /^[a-f0-9]{64}$/.test(id)).map(id => join(root, id))
-    .filter(path => statSync(path).isDirectory()).sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs);
-  const previous = entries.find(path => path !== current && path !== executing);
-  for (const path of entries) if (![current, executing, previous].includes(path)) rmSync(path, { recursive: true });
-}