@kody-ade/kody-engine 0.4.108 → 0.4.110

package/dist/bin/kody.js

@@ -469,16 +469,16 @@ var init_issue = __esm({
 });
 
 // src/prompt.ts
-import * as fs19 from "fs";
+import * as fs20 from "fs";
 import * as path18 from "path";
 function loadProjectConventions(projectDir) {
   const out = [];
   for (const rel of CONVENTION_FILES) {
     const abs = path18.join(projectDir, rel);
-    if (!fs19.existsSync(abs)) continue;
+    if (!fs20.existsSync(abs)) continue;
     let content;
     try {
-      content = fs19.readFileSync(abs, "utf-8");
+      content = fs20.readFileSync(abs, "utf-8");
     } catch {
       continue;
     }
@@ -626,20 +626,20 @@ var loadMemoryContext_exports = {};
 __export(loadMemoryContext_exports, {
   loadMemoryContext: () => loadMemoryContext
 });
-import * as fs34 from "fs";
+import * as fs35 from "fs";
 import * as path33 from "path";
 function collectPages(memoryAbs) {
   const out = [];
   walkMd(memoryAbs, (file) => {
     let stat;
     try {
-      stat = fs34.statSync(file);
+      stat = fs35.statSync(file);
     } catch {
       return;
     }
     let raw;
     try {
-      raw = fs34.readFileSync(file, "utf-8");
+      raw = fs35.readFileSync(file, "utf-8");
     } catch {
       return;
     }
@@ -715,7 +715,7 @@ function walkMd(root, visit) {
     const dir = stack.pop();
     let names;
     try {
-      names = fs34.readdirSync(dir);
+      names = fs35.readdirSync(dir);
     } catch {
       continue;
     }
@@ -724,7 +724,7 @@ function walkMd(root, visit) {
       const full = path33.join(dir, name);
       let stat;
       try {
-        stat = fs34.statSync(full);
+        stat = fs35.statSync(full);
       } catch {
         continue;
       }
@@ -748,7 +748,7 @@ var init_loadMemoryContext = __esm({
     loadMemoryContext = async (ctx) => {
       if (typeof ctx.data.memoryContext === "string") return;
       const memoryAbs = path33.join(ctx.cwd, MEMORY_DIR_RELATIVE);
-      if (!fs34.existsSync(memoryAbs)) {
+      if (!fs35.existsSync(memoryAbs)) {
         ctx.data.memoryContext = "";
         return;
       }
@@ -880,7 +880,7 @@ var init_loadPriorArt = __esm({
 // package.json
 var package_default = {
   name: "@kody-ade/kody-engine",
-  version: "0.4.108",
+  version: "0.4.110",
   description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   license: "MIT",
   type: "module",
@@ -935,7 +935,7 @@ var package_default = {
 
 // src/chat-cli.ts
 import { execFileSync as execFileSync32 } from "child_process";
-import * as fs40 from "fs";
+import * as fs41 from "fs";
 import * as path38 from "path";
 
 // src/chat/events.ts
@@ -2386,7 +2386,7 @@ async function emit2(sink, type, sessionId, suffix, payload) {
 
 // src/kody-cli.ts
 import { execFileSync as execFileSync31 } from "child_process";
-import * as fs39 from "fs";
+import * as fs40 from "fs";
 import * as path37 from "path";
 
 // src/dispatch.ts
@@ -2708,8 +2708,8 @@ function coerceBare(spec, value) {
 init_issue();
 
 // src/executor.ts
-import { execFileSync as execFileSync30, spawn as spawn6 } from "child_process";
-import * as fs38 from "fs";
+import { execFileSync as execFileSync30, spawn as spawn8 } from "child_process";
+import * as fs39 from "fs";
 import * as path36 from "path";
 
 // src/discipline.ts
@@ -4461,10 +4461,10 @@ async function handleChatTurn(req, res, chatId, opts) {
       litellmUrl: opts.litellmUrl,
       sink
     }).catch((err) => {
-      const errMsg2 = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`[brain-serve] chat turn failed: ${errMsg2}
+      const errMsg3 = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[brain-serve] chat turn failed: ${errMsg3}
 `);
-      endTurnIfUnterminated(opts.cwd, chatId, errMsg2);
+      endTurnIfUnterminated(opts.cwd, chatId, errMsg3);
     }).finally(() => {
       endTurnIfUnterminated(
         opts.cwd,
@@ -4581,6 +4581,657 @@ var brainServe = async (ctx) => {
   });
 };
 
+// src/scripts/runnerServe.ts
+import { spawn as spawn3 } from "child_process";
+import { createServer as createServer2 } from "http";
+import * as fs19 from "fs";
+var DEFAULT_PORT2 = 8080;
+var DEFAULT_WORKDIR = "/workspace/repo";
+function getApiKey2() {
+  const key = (process.env.RUNNER_API_KEY ?? "").trim();
+  if (!key) {
+    throw new Error(
+      "RUNNER_API_KEY env var is required \u2014 set it on the pooled machine before boot."
+    );
+  }
+  return key;
+}
+function authOk2(req, expected) {
+  const xApiKey = req.headers["x-api-key"]?.trim();
+  if (xApiKey && xApiKey === expected) return true;
+  const auth = req.headers["authorization"]?.trim();
+  if (auth && auth.toLowerCase().startsWith("bearer ")) {
+    return auth.slice(7).trim() === expected;
+  }
+  return false;
+}
+function readJsonBody2(req) {
+  return new Promise((resolve4, reject) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf-8");
+      if (!raw.trim()) {
+        resolve4({});
+        return;
+      }
+      try {
+        resolve4(JSON.parse(raw));
+      } catch (err) {
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+function sendJson2(res, status, body) {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function parseJob(body) {
+  if (typeof body !== "object" || body === null) return { error: "body must be an object" };
+  const b = body;
+  const jobId = typeof b.jobId === "string" ? b.jobId.trim() : "";
+  if (!jobId) return { error: "jobId required" };
+  const repo = typeof b.repo === "string" ? b.repo.trim() : "";
+  if (!/^[^/\s]+\/[^/\s]+$/.test(repo)) return { error: "repo must be 'owner/name'" };
+  const issueNumber = Number(b.issueNumber);
+  if (!Number.isInteger(issueNumber) || issueNumber <= 0) {
+    return { error: "issueNumber (positive integer) required" };
+  }
+  const githubToken = typeof b.githubToken === "string" ? b.githubToken.trim() : "";
+  if (!githubToken) return { error: "githubToken required" };
+  const job = { jobId, repo, issueNumber, githubToken };
+  if (typeof b.ref === "string" && b.ref.trim()) job.ref = b.ref.trim();
+  if (typeof b.model === "string" && b.model.trim()) job.model = b.model.trim();
+  if (typeof b.sessionId === "string" && b.sessionId.trim()) job.sessionId = b.sessionId.trim();
+  if (typeof b.dashboardUrl === "string" && b.dashboardUrl.trim()) job.dashboardUrl = b.dashboardUrl.trim();
+  if (b.allSecrets && (typeof b.allSecrets === "object" || typeof b.allSecrets === "string")) {
+    job.allSecrets = b.allSecrets;
+  }
+  return { job };
+}
+async function defaultRunJob(job) {
+  const workdir = process.env.RUNNER_WORKDIR ?? DEFAULT_WORKDIR;
+  const branch = job.ref ?? "main";
+  const authUrl = `https://x-access-token:${job.githubToken}@github.com/${job.repo}.git`;
+  fs19.rmSync(workdir, { recursive: true, force: true });
+  fs19.mkdirSync(workdir, { recursive: true });
+  const allSecrets = typeof job.allSecrets === "string" ? job.allSecrets : JSON.stringify(job.allSecrets ?? {});
+  const childEnv = {
+    ...process.env,
+    REPO: job.repo,
+    REF: branch,
+    GITHUB_TOKEN: job.githubToken,
+    ISSUE_NUMBER: String(job.issueNumber),
+    ALL_SECRETS: allSecrets,
+    SESSION_ID: job.sessionId ?? "",
+    DASHBOARD_URL: job.dashboardUrl ?? "",
+    MODEL: job.model ?? ""
+  };
+  const run = (cmd, args, cwd) => new Promise((resolve4) => {
+    const child = spawn3(cmd, args, { stdio: "inherit", env: childEnv, cwd });
+    child.on("exit", (code) => resolve4(code ?? 0));
+    child.on("error", (err) => {
+      process.stderr.write(`[runner-serve] ${cmd} failed: ${err.message}
+`);
+      resolve4(1);
+    });
+  });
+  process.stdout.write(`[runner-serve] job ${job.jobId}: cloning ${job.repo}@${branch}
+`);
+  const cloneCode = await run("git", [
+    "clone",
+    "--depth=1",
+    "--single-branch",
+    "--branch",
+    branch,
+    authUrl,
+    workdir
+  ]);
+  if (cloneCode !== 0) {
+    process.stderr.write(`[runner-serve] job ${job.jobId}: clone failed (${cloneCode})
+`);
+    process.exit(cloneCode);
+    return;
+  }
+  process.stdout.write(`[runner-serve] job ${job.jobId}: running issue #${job.issueNumber}
+`);
+  const runCode = await run("kody", ["run", "--issue", String(job.issueNumber)], workdir);
+  process.stdout.write(`[runner-serve] job ${job.jobId}: finished (exit ${runCode})
+`);
+  process.exit(runCode);
+}
+function buildServer2(opts) {
+  const runJob = opts.runJob ?? defaultRunJob;
+  let busy = false;
+  return createServer2(async (req, res) => {
+    if (!req.method || !req.url) {
+      sendJson2(res, 400, { error: "bad request" });
+      return;
+    }
+    const url = new URL(req.url, "http://localhost");
+    if (req.method === "GET" && url.pathname === "/healthz") {
+      sendJson2(res, 200, { ok: true, busy });
+      return;
+    }
+    if (!authOk2(req, opts.apiKey)) {
+      sendJson2(res, 401, { error: "unauthorized" });
+      return;
+    }
+    if (req.method === "POST" && url.pathname === "/run") {
+      if (busy) {
+        sendJson2(res, 409, { error: "runner busy" });
+        return;
+      }
+      let body;
+      try {
+        body = await readJsonBody2(req);
+      } catch {
+        sendJson2(res, 400, { error: "invalid JSON body" });
+        return;
+      }
+      const parsed = parseJob(body);
+      if ("error" in parsed) {
+        sendJson2(res, 400, { error: parsed.error });
+        return;
+      }
+      busy = true;
+      sendJson2(res, 202, { ok: true, jobId: parsed.job.jobId, started: true });
+      void runJob(parsed.job).catch((err) => {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[runner-serve] job ${parsed.job.jobId} crashed: ${msg}
+`);
+        process.exit(1);
+      });
+      return;
+    }
+    sendJson2(res, 404, { error: "not found" });
+  });
+}
+var runnerServe = async (ctx) => {
+  ctx.skipAgent = true;
+  const apiKey = getApiKey2();
+  const port = Number(process.env.PORT ?? DEFAULT_PORT2);
+  const server = buildServer2({ apiKey });
+  await new Promise((resolve4) => {
+    server.listen(port, "0.0.0.0", () => {
+      process.stdout.write(`[runner-serve] listening on 0.0.0.0:${port} (idle, awaiting job)
+`);
+      resolve4();
+    });
+  });
+  const shutdown = (signal) => {
+    process.stdout.write(`[runner-serve] ${signal} \u2014 shutting down
+`);
+    server.close(() => process.exit(0));
+  };
+  process.once("SIGINT", () => shutdown("SIGINT"));
+  process.once("SIGTERM", () => shutdown("SIGTERM"));
+  await new Promise(() => {
+  });
+};
+
+// src/scripts/poolServe.ts
+import { spawn as spawn4 } from "child_process";
+import { createServer as createServer3 } from "http";
+
+// src/pool/fly.ts
+var FLY_API_BASE = "https://api.machines.dev/v1";
+var POOL_METADATA_KEY = "kody_pool";
+var POOL_METADATA_VALUE = "1";
+var FlyClient = class {
+  constructor(opts) {
+    this.opts = opts;
+    if (!opts.token?.trim()) throw new Error("FlyClient: token required");
+    if (!opts.app?.trim()) throw new Error("FlyClient: app required");
+  }
+  opts;
+  get fetch() {
+    return this.opts.fetchImpl ?? fetch;
+  }
+  async call(path39, init = {}) {
+    const res = await this.fetch(`${FLY_API_BASE}${path39}`, {
+      method: init.method ?? "GET",
+      headers: {
+        Authorization: `Bearer ${this.opts.token}`,
+        "Content-Type": "application/json"
+      },
+      body: init.body !== void 0 ? JSON.stringify(init.body) : void 0
+    });
+    if (res.status === 404 && init.allow404) return null;
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`Fly API ${res.status} on ${path39}: ${text.slice(0, 200) || res.statusText}`);
+    }
+    if (res.status === 204) return null;
+    const raw = await res.text();
+    if (!raw.trim()) return null;
+    return JSON.parse(raw);
+  }
+  /** Create + start a pooled machine in serve mode. */
+  async createPooled(input) {
+    const body = {
+      region: input.region,
+      config: {
+        image: input.image,
+        guest: input.guest,
+        auto_destroy: true,
+        restart: { policy: "no" },
+        init: { entrypoint: ["/usr/local/bin/entrypoint-serve.sh"] },
+        metadata: { [POOL_METADATA_KEY]: POOL_METADATA_VALUE },
+        env: {
+          RUNNER_API_KEY: input.runnerApiKey,
+          KODY_LITELLM_URL: input.litellmUrl,
+          PORT: String(input.port ?? 8080)
+        }
+      }
+    };
+    const m = await this.call(`/apps/${enc(this.opts.app)}/machines`, { method: "POST", body });
+    if (!m?.id) throw new Error("Fly API: createPooled returned no machine id");
+    return m;
+  }
+  async get(id) {
+    return this.call(`/apps/${enc(this.opts.app)}/machines/${enc(id)}`, { allow404: true });
+  }
+  /** List the app's pooled (kody_pool) machines, excluding destroyed/destroying. */
+  async listPooled() {
+    const all = await this.call(`/apps/${enc(this.opts.app)}/machines`, { allow404: true }) ?? [];
+    return all.filter(
+      (m) => m.config?.metadata?.[POOL_METADATA_KEY] === POOL_METADATA_VALUE && m.state !== "destroyed" && m.state !== "destroying"
+    );
+  }
+  /** Suspend (freeze) a machine — wakes in ~1s from the snapshot. */
+  async suspend(id) {
+    await this.call(`/apps/${enc(this.opts.app)}/machines/${enc(id)}/suspend`, { method: "POST", allow404: true });
+  }
+  /** Start (wake) a suspended/stopped machine. */
+  async start(id) {
+    await this.call(`/apps/${enc(this.opts.app)}/machines/${enc(id)}/start`, { method: "POST", allow404: true });
+  }
+  async destroy(id) {
+    await this.call(`/apps/${enc(this.opts.app)}/machines/${enc(id)}?force=true`, { method: "DELETE", allow404: true });
+  }
+  /**
+   * Wait for `GET <baseUrl>/healthz` to return 200, polling until timeout.
+   * baseUrl is the machine's private 6PN address (http://[ip]:port).
+   */
+  async waitHealthy(baseUrl, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 12e4;
+    const intervalMs = opts.intervalMs ?? 1e3;
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      try {
+        const res = await this.fetch(`${baseUrl}/healthz`, { signal: AbortSignal.timeout(4e3) });
+        if (res.ok) return true;
+      } catch {
+      }
+      await sleep2(intervalMs);
+    }
+    return false;
+  }
+};
+function enc(s) {
+  return encodeURIComponent(s);
+}
+function sleep2(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// src/pool/manager.ts
+var PoolManager = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.postRun = deps.postRun ?? defaultPostRun;
+    this.log = deps.log ?? (() => {
+    });
+  }
+  deps;
+  free = [];
+  booting = 0;
+  claimsInFlight = 0;
+  refilling = false;
+  postRun;
+  log;
+  status() {
+    return {
+      min: this.deps.config.min,
+      free: this.free.length,
+      booting: this.booting,
+      claimsInFlight: this.claimsInFlight,
+      total: this.free.length + this.booting + this.claimsInFlight
+    };
+  }
+  /**
+   * Adopt existing pooled machines on owner (re)start: suspended ones become
+   * free; anything else is left to finish/auto-destroy. Then refill to `min`.
+   */
+  async reconcile() {
+    const machines = await this.deps.fly.listPooled();
+    this.free = [];
+    for (const m of machines) {
+      if ((m.state === "suspended" || m.state === "suspending") && m.private_ip) {
+        this.free.push({ id: m.id, privateIp: m.private_ip });
+      }
+    }
+    this.log(`reconcile: adopted ${this.free.length} suspended machine(s)`);
+    await this.refill();
+  }
+  /**
+   * Claim a warm machine for a job. Returns ok:false (caller falls back to
+   * create-fresh) when the pool is empty or the woken machine fails to take
+   * the job. The pick is synchronous — the atomic step.
+   */
+  async claim(job) {
+    const machine = this.free.shift();
+    if (!machine) {
+      this.log("claim: pool empty");
+      void this.refill();
+      return { ok: false, reason: "pool empty" };
+    }
+    this.claimsInFlight++;
+    try {
+      await this.deps.fly.start(machine.id);
+      const base = this.baseUrl(machine);
+      const healthy = await this.deps.fly.waitHealthy(base, { timeoutMs: this.deps.config.healthTimeoutMs });
+      if (!healthy) {
+        this.log(`claim: machine ${machine.id} unhealthy after wake \u2014 destroying`);
+        await this.safeDestroy(machine.id);
+        return { ok: false, reason: "woken machine unhealthy" };
+      }
+      const accepted = await this.postRun(machine, job, this.deps.config);
+      if (!accepted) {
+        this.log(`claim: machine ${machine.id} rejected job \u2014 destroying`);
+        await this.safeDestroy(machine.id);
+        return { ok: false, reason: "machine rejected job" };
+      }
+      this.log(`claim: machine ${machine.id} took job ${job.jobId}`);
+      return { ok: true, machineId: machine.id };
+    } catch (err) {
+      this.log(`claim: error on ${machine.id}: ${errMsg2(err)} \u2014 destroying`);
+      await this.safeDestroy(machine.id);
+      return { ok: false, reason: errMsg2(err) };
+    } finally {
+      this.claimsInFlight--;
+      void this.refill();
+    }
+  }
+  /** Top up free machines to `min`. Serialized so it never overshoots. */
+  async refill() {
+    if (this.refilling) return;
+    this.refilling = true;
+    try {
+      while (this.free.length + this.booting < this.deps.config.min) {
+        this.booting++;
+        try {
+          await this.bootOne();
+        } catch (err) {
+          this.log(`refill: boot failed: ${errMsg2(err)}`);
+          this.booting--;
+          break;
+        }
+        this.booting--;
+      }
+    } finally {
+      this.refilling = false;
+    }
+  }
+  async bootOne() {
+    const cfg = this.deps.config;
+    const m = await this.deps.fly.createPooled({
+      image: cfg.image,
+      region: cfg.region,
+      guest: cfg.guest,
+      runnerApiKey: cfg.runnerApiKey,
+      litellmUrl: cfg.litellmUrl,
+      port: cfg.port
+    });
+    if (!m.private_ip) {
+      const refreshed = await this.deps.fly.get(m.id);
+      if (refreshed?.private_ip) m.private_ip = refreshed.private_ip;
+    }
+    if (!m.private_ip) {
+      await this.safeDestroy(m.id);
+      throw new Error(`machine ${m.id} has no private_ip`);
+    }
+    const free = { id: m.id, privateIp: m.private_ip };
+    const healthy = await this.deps.fly.waitHealthy(this.baseUrl(free), { timeoutMs: cfg.healthTimeoutMs });
+    if (!healthy) {
+      await this.safeDestroy(m.id);
+      throw new Error(`machine ${m.id} never became healthy`);
+    }
+    await this.deps.fly.suspend(m.id);
+    this.free.push(free);
+    this.log(`refill: machine ${m.id} booted, frozen, ready (free=${this.free.length})`);
+  }
+  baseUrl(m) {
+    return `http://[${m.privateIp}]:${this.deps.config.port}`;
+  }
+  async safeDestroy(id) {
+    try {
+      await this.deps.fly.destroy(id);
+    } catch (err) {
+      this.log(`destroy ${id} failed: ${errMsg2(err)}`);
+    }
+  }
+};
+async function defaultPostRun(m, job, cfg) {
+  const res = await fetch(`http://[${m.privateIp}]:${cfg.port}/run`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "x-api-key": cfg.runnerApiKey
+    },
+    body: JSON.stringify(job),
+    signal: AbortSignal.timeout(15e3)
+  });
+  return res.status === 202;
+}
+function errMsg2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/pool/keys.ts
+import { hkdfSync } from "crypto";
+var POOL_API_KEY_INFO = "kody-pool-api:v1";
+var RUNNER_API_KEY_INFO = "kody-runner-api:v1";
+function masterKeyBytes(raw) {
+  const v = raw.trim();
+  if (!v) throw new Error("KODY_MASTER_KEY is empty");
+  if (/^[0-9a-fA-F]+$/.test(v) && v.length === 64) {
+    return Buffer.from(v, "hex");
+  }
+  return Buffer.from(v.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+}
+function deriveKey(master, info, length = 32) {
+  return Buffer.from(hkdfSync("sha256", master, Buffer.alloc(0), info, length)).toString("hex");
+}
+function derivePoolApiKey(master) {
+  return deriveKey(master, POOL_API_KEY_INFO);
+}
+function deriveRunnerApiKey(master) {
+  return deriveKey(master, RUNNER_API_KEY_INFO);
+}
+function bearerOk(headerAuth, xApiKey, expected) {
+  const x = (xApiKey ?? "").trim();
+  if (x && timingEqual(x, expected)) return true;
+  const a = (headerAuth ?? "").trim();
+  if (a.toLowerCase().startsWith("bearer ")) {
+    return timingEqual(a.slice(7).trim(), expected);
+  }
+  return false;
+}
+function timingEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+
+// src/scripts/poolServe.ts
+var PERF_GUEST = {
+  low: { cpu_kind: "shared", cpus: 2, memory_mb: 2048 },
+  medium: { cpu_kind: "performance", cpus: 1, memory_mb: 2048 },
+  high: { cpu_kind: "performance", cpus: 2, memory_mb: 4096 }
+};
+function envInt(name, dflt) {
+  const v = Number(process.env[name]);
+  return Number.isFinite(v) && v > 0 ? v : dflt;
+}
+function log(msg) {
+  process.stdout.write(`[pool-serve] ${msg}
+`);
+}
+function sendJson3(res, status, body) {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function readJsonBody3(req) {
+  return new Promise((resolve4, reject) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf-8");
+      if (!raw.trim()) return resolve4({});
+      try {
+        resolve4(JSON.parse(raw));
+      } catch (err) {
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+function parsePoolJob(body) {
+  if (typeof body !== "object" || body === null) return { error: "body must be an object" };
+  const b = body;
+  const jobId = typeof b.jobId === "string" ? b.jobId.trim() : "";
+  if (!jobId) return { error: "jobId required" };
+  const repo = typeof b.repo === "string" ? b.repo.trim() : "";
+  if (!/^[^/\s]+\/[^/\s]+$/.test(repo)) return { error: "repo must be 'owner/name'" };
+  const issueNumber = Number(b.issueNumber);
+  if (!Number.isInteger(issueNumber) || issueNumber <= 0) return { error: "issueNumber required" };
+  const githubToken = typeof b.githubToken === "string" ? b.githubToken.trim() : "";
+  if (!githubToken) return { error: "githubToken required" };
+  const job = { jobId, repo, issueNumber, githubToken };
+  if (typeof b.ref === "string" && b.ref.trim()) job.ref = b.ref.trim();
+  if (typeof b.model === "string" && b.model.trim()) job.model = b.model.trim();
+  if (typeof b.sessionId === "string" && b.sessionId.trim()) job.sessionId = b.sessionId.trim();
+  if (typeof b.dashboardUrl === "string" && b.dashboardUrl.trim()) job.dashboardUrl = b.dashboardUrl.trim();
+  if (b.allSecrets && typeof b.allSecrets === "object") job.allSecrets = b.allSecrets;
+  return { job };
+}
+function superviseLitellm() {
+  if (process.env.POOL_DISABLE_LITELLM === "1") return null;
+  const port = String(envInt("LITELLM_PORT", 4e3));
+  const config = process.env.LITELLM_CONFIG ?? "/app/config.yaml";
+  let restarts = 0;
+  const start = () => {
+    log(`starting litellm child (port ${port})`);
+    const child = spawn4("litellm", ["--config", config, "--port", port, "--host", "0.0.0.0"], {
+      stdio: "inherit"
+    });
+    child.on("exit", (code) => {
+      restarts++;
+      if (restarts > 50) {
+        process.stderr.write("[pool-serve] litellm restarted too many times \u2014 giving up\n");
+        return;
+      }
+      log(`litellm exited (${code}) \u2014 restarting in 2s`);
+      setTimeout(start, 2e3);
+    });
+    child.on("error", (err) => process.stderr.write(`[pool-serve] litellm spawn error: ${err.message}
+`));
+    return child;
+  };
+  return start();
+}
+var poolServe = async (ctx) => {
+  ctx.skipAgent = true;
+  const masterRaw = process.env.KODY_MASTER_KEY?.trim();
+  if (!masterRaw) throw new Error("KODY_MASTER_KEY required for pool-serve");
+  const flyToken = process.env.FLY_API_TOKEN?.trim();
+  if (!flyToken) throw new Error("FLY_API_TOKEN required for pool-serve");
+  const master = masterKeyBytes(masterRaw);
+  const poolApiKey = derivePoolApiKey(master);
+  const runnerApiKey = deriveRunnerApiKey(master);
+  const app = process.env.FLY_APP_NAME ?? "kody-runner";
+  const region = process.env.FLY_REGION ?? "fra";
+  const perf = process.env.POOL_PERF ?? "medium";
+  const guest = PERF_GUEST[perf] ?? PERF_GUEST.medium;
+  const litellmUrl = process.env.KODY_LITELLM_URL ?? "http://kody-litellm.internal:4000";
+  const min = envInt("POOL_MIN", 2);
+  const runnerPort = envInt("RUNNER_PORT", 8080);
+  const apiPort = envInt("POOL_API_PORT", 4100);
+  const healthTimeoutMs = envInt("POOL_HEALTH_TIMEOUT_MS", 12e4);
+  const litellm = superviseLitellm();
+  const fly = new FlyClient({ token: flyToken, app });
+  const manager = new PoolManager({
+    fly,
+    config: { min, image: process.env.FLY_RUNNER_IMAGE ?? "registry.fly.io/kody-runner:latest", region, guest, runnerApiKey, litellmUrl, port: runnerPort, healthTimeoutMs },
+    log
+  });
+  manager.reconcile().catch((err) => log(`reconcile failed: ${err instanceof Error ? err.message : String(err)}`));
+  const refillMs = envInt("POOL_REFILL_INTERVAL_MS", 6e4);
+  const tick = setInterval(() => {
+    manager.refill().catch((err) => log(`refill tick failed: ${err instanceof Error ? err.message : String(err)}`));
+  }, refillMs);
+  const server = createServer3(async (req, res) => {
+    try {
+      if (!req.method || !req.url) return sendJson3(res, 400, { error: "bad request" });
+      const url = new URL(req.url, "http://localhost");
+      if (req.method === "GET" && url.pathname === "/healthz") {
+        return sendJson3(res, 200, { ok: true, litellm: litellm ? "supervised" : "off", pool: manager.status() });
+      }
+      const authed = bearerOk(
+        req.headers["authorization"],
+        req.headers["x-api-key"],
+        poolApiKey
+      );
+      if (!authed) return sendJson3(res, 401, { error: "unauthorized" });
+      if (req.method === "GET" && url.pathname === "/pool/status") {
+        return sendJson3(res, 200, manager.status());
+      }
+      if (req.method === "POST" && url.pathname === "/pool/claim") {
+        let body;
+        try {
+          body = await readJsonBody3(req);
+        } catch {
+          return sendJson3(res, 400, { error: "invalid JSON body" });
+        }
+        const parsed = parsePoolJob(body);
+        if ("error" in parsed) return sendJson3(res, 400, { error: parsed.error });
+        const result = await manager.claim(parsed.job);
+        if (result.ok) return sendJson3(res, 200, { ok: true, machineId: result.machineId });
+        return sendJson3(res, 503, { ok: false, reason: result.reason ?? "pool unavailable" });
+      }
+      return sendJson3(res, 404, { error: "not found" });
+    } catch (err) {
+      process.stderr.write(`[pool-serve] handler error: ${err instanceof Error ? err.message : String(err)}
+`);
+      try {
+        sendJson3(res, 500, { error: "internal error" });
+      } catch {
+      }
+    }
+  });
+  await new Promise((resolve4) => {
+    server.listen(apiPort, "0.0.0.0", () => {
+      log(`listening on 0.0.0.0:${apiPort} (min=${min}, app=${app}, region=${region})`);
+      resolve4();
+    });
+  });
+  const shutdown = (signal) => {
+    log(`${signal} \u2014 shutting down`);
+    clearInterval(tick);
+    server.close(() => process.exit(0));
+  };
+  process.once("SIGINT", () => shutdown("SIGINT"));
+  process.once("SIGTERM", () => shutdown("SIGTERM"));
+  await new Promise(() => {
+  });
+};
+
 // src/coverage.ts
 import { execFileSync as execFileSync9 } from "child_process";
 function patternToRegex(pattern) {
@@ -4727,7 +5378,7 @@ function defaultLabelMap() {
 }
 
 // src/scripts/commitAndPush.ts
-import * as fs20 from "fs";
+import * as fs21 from "fs";
 import * as path19 from "path";
 init_events();
 var DEFAULT_COMMIT_MESSAGE = "chore: kody changes";
@@ -4743,9 +5394,9 @@ var commitAndPush2 = async (ctx, profile) => {
   }
   const idempotencyEnabled = process.env.KODY_COMMIT_IDEMPOTENCY !== "0";
   const sentinel = idempotencyEnabled ? sentinelPathForStage(ctx.cwd, profile.name) : null;
-  if (sentinel && fs20.existsSync(sentinel)) {
+  if (sentinel && fs21.existsSync(sentinel)) {
     try {
-      const replay = JSON.parse(fs20.readFileSync(sentinel, "utf-8"));
+      const replay = JSON.parse(fs21.readFileSync(sentinel, "utf-8"));
       ctx.data.commitResult = replay.commitResult ?? { committed: false, pushed: false };
       if (Array.isArray(replay.changedFiles)) ctx.data.changedFiles = replay.changedFiles;
       if (typeof replay.hasCommitsAhead === "boolean") ctx.data.hasCommitsAhead = replay.hasCommitsAhead;
@@ -4798,8 +5449,8 @@ var commitAndPush2 = async (ctx, profile) => {
   const result = ctx.data.commitResult;
   if (sentinel && result?.committed) {
     try {
-      fs20.mkdirSync(path19.dirname(sentinel), { recursive: true });
-      fs20.writeFileSync(
+      fs21.mkdirSync(path19.dirname(sentinel), { recursive: true });
+      fs21.writeFileSync(
         sentinel,
         JSON.stringify(
           {
@@ -4869,7 +5520,7 @@ function describeCommitMessage(goal) {
 }
 
 // src/scripts/composePrompt.ts
-import * as fs21 from "fs";
+import * as fs22 from "fs";
 import * as path21 from "path";
 var MUSTACHE = /\{\{\s*([a-zA-Z0-9_.-]+)\s*\}\}/g;
 var composePrompt = async (ctx, profile) => {
@@ -4882,7 +5533,7 @@ var composePrompt = async (ctx, profile) => {
   ].filter(Boolean);
   let templatePath = "";
   for (const c of candidates) {
-    if (fs21.existsSync(c)) {
+    if (fs22.existsSync(c)) {
       templatePath = c;
       break;
     }
@@ -4890,7 +5541,7 @@ var composePrompt = async (ctx, profile) => {
   if (!templatePath) {
     throw new Error(`profile at ${profile.dir}: no prompt template found (tried ${candidates.join(", ")})`);
   }
-  const template = fs21.readFileSync(templatePath, "utf-8");
+  const template = fs22.readFileSync(templatePath, "utf-8");
   const tokens = {
     ...stringifyAll(ctx.args, "args."),
     ...stringifyAll(ctx.data, ""),
@@ -4969,7 +5620,7 @@ function formatToolsUsage(profile) {
 // src/scripts/createQaGoal.ts
 init_issue();
 import { execFileSync as execFileSync11 } from "child_process";
-import * as fs22 from "fs";
+import * as fs23 from "fs";
 import * as path22 from "path";
 
 // src/scripts/postReviewResult.ts
@@ -5224,7 +5875,7 @@ function createOrUpdateManifestIssue(number, manifest, cwd) {
 }
 function writeStateFile(cwd, goalId, lastDispatchedIssue) {
   const dir = path22.join(cwd, ".kody", "goals", goalId);
-  fs22.mkdirSync(dir, { recursive: true });
+  fs23.mkdirSync(dir, { recursive: true });
   const state = {
     version: 1,
     state: "active",
@@ -5233,7 +5884,7 @@ function writeStateFile(cwd, goalId, lastDispatchedIssue) {
     ...typeof lastDispatchedIssue === "number" ? { lastDispatchedIssue } : {}
   };
   const filePath = path22.join(dir, "state.json");
-  fs22.writeFileSync(filePath, `${JSON.stringify(state, null, 2)}
+  fs23.writeFileSync(filePath, `${JSON.stringify(state, null, 2)}
 `);
   return filePath;
 }
@@ -5742,7 +6393,7 @@ function filterGoalTaskPrs(prs, taskIssueNumbers) {
 
 // src/scripts/diagMcp.ts
 import { execFileSync as execFileSync12 } from "child_process";
-import * as fs23 from "fs";
+import * as fs24 from "fs";
 import * as os4 from "os";
 import * as path23 from "path";
 var diagMcp = async (_ctx) => {
@@ -5750,7 +6401,7 @@ var diagMcp = async (_ctx) => {
   const cacheDir = path23.join(home, ".cache", "ms-playwright");
   let entries = [];
   try {
-    entries = fs23.readdirSync(cacheDir);
+    entries = fs24.readdirSync(cacheDir);
   } catch {
   }
   const hasChromium = entries.some((e) => e.startsWith("chromium"));
@@ -5776,17 +6427,17 @@ var diagMcp = async (_ctx) => {
 };
 
 // src/scripts/discoverQaContext.ts
-import * as fs25 from "fs";
+import * as fs26 from "fs";
 import * as path25 from "path";
 
 // src/scripts/frameworkDetectors.ts
-import * as fs24 from "fs";
+import * as fs25 from "fs";
 import * as path24 from "path";
 function detectFrameworks(cwd) {
   const out = [];
   let deps = {};
   try {
-    const pkg = JSON.parse(fs24.readFileSync(path24.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs25.readFileSync(path24.join(cwd, "package.json"), "utf-8"));
     deps = { ...pkg.dependencies, ...pkg.devDependencies };
   } catch {
     return out;
@@ -5823,7 +6474,7 @@ function detectFrameworks(cwd) {
 }
 function findFile(cwd, candidates) {
   for (const c of candidates) {
-    if (fs24.existsSync(path24.join(cwd, c))) return c;
+    if (fs25.existsSync(path24.join(cwd, c))) return c;
   }
   return null;
 }
@@ -5837,17 +6488,17 @@ function discoverPayloadCollections(cwd) {
   const out = [];
   for (const dir of COLLECTION_DIRS) {
     const full = path24.join(cwd, dir);
-    if (!fs24.existsSync(full)) continue;
+    if (!fs25.existsSync(full)) continue;
     let files;
     try {
-      files = fs24.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs25.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const file of files) {
       try {
         const filePath = path24.join(full, file);
-        const content = fs24.readFileSync(filePath, "utf-8").slice(0, 1e4);
+        const content = fs25.readFileSync(filePath, "utf-8").slice(0, 1e4);
         const slugMatch = content.match(/slug:\s*['"]([a-z0-9-]+)['"]/);
         if (!slugMatch) continue;
         const slug = slugMatch[1];
@@ -5876,10 +6527,10 @@ function discoverAdminComponents(cwd, collections) {
   const out = [];
   for (const dir of ADMIN_COMPONENT_DIRS) {
     const full = path24.join(cwd, dir);
-    if (!fs24.existsSync(full)) continue;
+    if (!fs25.existsSync(full)) continue;
     let entries;
     try {
-      entries = fs24.readdirSync(full, { withFileTypes: true });
+      entries = fs25.readdirSync(full, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -5889,7 +6540,7 @@ function discoverAdminComponents(cwd, collections) {
       let filePath;
       if (entry.isDirectory()) {
         const indexFile = ["index.tsx", "index.ts", "index.jsx", "index.js"].find(
-          (f) => fs24.existsSync(path24.join(entryPath, f))
+          (f) => fs25.existsSync(path24.join(entryPath, f))
         );
         if (!indexFile) continue;
         name = entry.name;
@@ -5904,7 +6555,7 @@ function discoverAdminComponents(cwd, collections) {
       if (collections) {
         for (const col of collections) {
           try {
-            const colContent = fs24.readFileSync(path24.join(cwd, col.filePath), "utf-8");
+            const colContent = fs25.readFileSync(path24.join(cwd, col.filePath), "utf-8");
             if (colContent.includes(name)) {
               usedInCollection = col.slug;
               break;
@@ -5924,7 +6575,7 @@ function scanApiRoutes(cwd) {
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
     const apiDir = path24.join(cwd, appDir, "api");
-    if (!fs24.existsSync(apiDir)) continue;
+    if (!fs25.existsSync(apiDir)) continue;
     walkApiRoutes(apiDir, "/api", cwd, out);
     break;
   }
@@ -5933,14 +6584,14 @@ function scanApiRoutes(cwd) {
 function walkApiRoutes(dir, prefix, cwd, out) {
   let entries;
   try {
-    entries = fs24.readdirSync(dir, { withFileTypes: true });
+    entries = fs25.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
   const routeFile = entries.find((e) => e.isFile() && /^route\.(ts|js|tsx|jsx)$/.test(e.name));
   if (routeFile) {
     try {
-      const content = fs24.readFileSync(path24.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
+      const content = fs25.readFileSync(path24.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
       const methods = HTTP_METHODS.filter(
         (m) => new RegExp(`export\\s+(?:async\\s+)?function\\s+${m}\\b`).test(content)
       );
@@ -5988,9 +6639,9 @@ function scanEnvVars(cwd) {
   const candidates = [".env.example", ".env.local.example", ".env.template"];
   for (const envFile of candidates) {
     const envPath = path24.join(cwd, envFile);
-    if (!fs24.existsSync(envPath)) continue;
+    if (!fs25.existsSync(envPath)) continue;
     try {
-      const content = fs24.readFileSync(envPath, "utf-8");
+      const content = fs25.readFileSync(envPath, "utf-8");
       const vars = [];
       for (const line of content.split("\n")) {
         const trimmed = line.trim();
@@ -6038,9 +6689,9 @@ function runQaDiscovery(cwd) {
 }
 function detectDevServer(cwd, out) {
   try {
-    const pkg = JSON.parse(fs25.readFileSync(path25.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs26.readFileSync(path25.join(cwd, "package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-    const pm = fs25.existsSync(path25.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs25.existsSync(path25.join(cwd, "yarn.lock")) ? "yarn" : fs25.existsSync(path25.join(cwd, "bun.lockb")) ? "bun" : "npm";
+    const pm = fs26.existsSync(path25.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs26.existsSync(path25.join(cwd, "yarn.lock")) ? "yarn" : fs26.existsSync(path25.join(cwd, "bun.lockb")) ? "bun" : "npm";
     if (pkg.scripts?.dev) out.devCommand = `${pm} dev`;
     if (allDeps.next || allDeps.nuxt) out.devPort = 3e3;
     else if (allDeps.vite) out.devPort = 5173;
@@ -6051,7 +6702,7 @@ function scanFrontendRoutes(cwd, out) {
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
     const full = path25.join(cwd, appDir);
-    if (!fs25.existsSync(full)) continue;
+    if (!fs26.existsSync(full)) continue;
     walkFrontendRoutes(full, "", out);
     break;
   }
@@ -6059,7 +6710,7 @@ function scanFrontendRoutes(cwd, out) {
 function walkFrontendRoutes(dir, prefix, out) {
   let entries;
   try {
-    entries = fs25.readdirSync(dir, { withFileTypes: true });
+    entries = fs26.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -6101,23 +6752,23 @@ function detectAuthFiles(cwd, out) {
     "src/app/api/oauth"
   ];
   for (const c of candidates) {
-    if (fs25.existsSync(path25.join(cwd, c))) out.authFiles.push(c);
+    if (fs26.existsSync(path25.join(cwd, c))) out.authFiles.push(c);
   }
 }
 function detectRoles(cwd, out) {
   const rolePaths = ["src/types", "src/lib", "src/utils", "src/constants", "src/access", "src/collections"];
   for (const rp of rolePaths) {
     const dir = path25.join(cwd, rp);
-    if (!fs25.existsSync(dir)) continue;
+    if (!fs26.existsSync(dir)) continue;
     let files;
     try {
-      files = fs25.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs26.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const f of files) {
       try {
-        const content = fs25.readFileSync(path25.join(dir, f), "utf-8").slice(0, 5e3);
+        const content = fs26.readFileSync(path25.join(dir, f), "utf-8").slice(0, 5e3);
         const roleMatches = content.match(/(?:role|Role|ROLE)\s*[=:]\s*['"](\w+)['"]/g);
         if (roleMatches) {
           for (const m of roleMatches) {
@@ -6363,7 +7014,7 @@ function failedAction3(reason) {
 }
 
 // src/scripts/dispatchJobFileTicks.ts
-import * as fs27 from "fs";
+import * as fs28 from "fs";
 import * as path27 from "path";
 
 // src/scripts/jobFrontmatter.ts
@@ -6625,7 +7276,7 @@ var ContentsApiBackend = class {
 };
 
 // src/scripts/jobState/localFileBackend.ts
-import * as fs26 from "fs";
+import * as fs27 from "fs";
 import * as path26 from "path";
 var LocalFileBackend = class {
   name = "local-file";
@@ -6656,7 +7307,7 @@ var LocalFileBackend = class {
 `);
       return;
     }
-    fs26.mkdirSync(this.absDir, { recursive: true });
+    fs27.mkdirSync(this.absDir, { recursive: true });
     const prefix = this.cacheKeyPrefix();
     const probeKey = `${prefix}probe-${Date.now()}`;
     try {
@@ -6685,7 +7336,7 @@ var LocalFileBackend = class {
 `);
       return;
     }
-    if (!fs26.existsSync(this.absDir)) {
+    if (!fs27.existsSync(this.absDir)) {
       return;
     }
     const key = `${this.cacheKeyPrefix()}${process.env.GITHUB_RUN_ID ?? "norunid"}-${Date.now()}`;
@@ -6702,10 +7353,10 @@ var LocalFileBackend = class {
   load(slug) {
     const relPath = stateFilePath(this.jobsDir, slug);
     const absPath = path26.join(this.cwd, relPath);
-    if (!fs26.existsSync(absPath)) {
+    if (!fs27.existsSync(absPath)) {
       return { path: relPath, handle: null, state: initialStateEnvelope("seed"), created: true };
     }
-    const raw = fs26.readFileSync(absPath, "utf-8");
+    const raw = fs27.readFileSync(absPath, "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -6723,9 +7374,9 @@ var LocalFileBackend = class {
       return false;
     }
     const absPath = path26.join(this.cwd, loaded.path);
-    fs26.mkdirSync(path26.dirname(absPath), { recursive: true });
+    fs27.mkdirSync(path26.dirname(absPath), { recursive: true });
     const body = JSON.stringify(next, null, 2) + "\n";
-    fs26.writeFileSync(absPath, body, "utf-8");
+    fs27.writeFileSync(absPath, body, "utf-8");
     return true;
   }
   cacheKeyPrefix() {
@@ -6916,17 +7567,17 @@ function formatAgo(ms) {
 }
 function readJobFrontmatter(cwd, jobsDir, slug) {
   try {
-    const raw = fs27.readFileSync(path27.join(cwd, jobsDir, `${slug}.md`), "utf-8");
+    const raw = fs28.readFileSync(path27.join(cwd, jobsDir, `${slug}.md`), "utf-8");
     return splitFrontmatter2(raw).frontmatter;
   } catch {
     return {};
   }
 }
 function listJobSlugs(absDir) {
-  if (!fs27.existsSync(absDir)) return [];
+  if (!fs28.existsSync(absDir)) return [];
   let entries;
   try {
-    entries = fs27.readdirSync(absDir, { withFileTypes: true });
+    entries = fs28.readdirSync(absDir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -7679,7 +8330,7 @@ function ensureFeatureBranch(issueNumber, title, defaultBranch2, cwd, baseBranch
 
 // src/gha.ts
 import { execFileSync as execFileSync17 } from "child_process";
-import * as fs28 from "fs";
+import * as fs29 from "fs";
 function getRunUrl() {
   const server = process.env.GITHUB_SERVER_URL;
   const repo = process.env.GITHUB_REPOSITORY;
@@ -7690,10 +8341,10 @@ function getRunUrl() {
 function reactToTriggerComment(cwd) {
   if (process.env.GITHUB_EVENT_NAME !== "issue_comment") return;
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventPath || !fs28.existsSync(eventPath)) return;
+  if (!eventPath || !fs29.existsSync(eventPath)) return;
   let event = null;
   try {
-    event = JSON.parse(fs28.readFileSync(eventPath, "utf-8"));
+    event = JSON.parse(fs29.readFileSync(eventPath, "utf-8"));
   } catch {
     return;
   }
@@ -7986,22 +8637,22 @@ var handleAbandonedGoal = async (ctx) => {
 
 // src/scripts/initFlow.ts
 import { execFileSync as execFileSync19 } from "child_process";
-import * as fs30 from "fs";
+import * as fs31 from "fs";
 import * as path29 from "path";
 
 // src/scripts/loadQaGuide.ts
-import * as fs29 from "fs";
+import * as fs30 from "fs";
 import * as path28 from "path";
 var QA_GUIDE_REL_PATH = ".kody/qa-guide.md";
 var loadQaGuide = async (ctx) => {
   const full = path28.join(ctx.cwd, QA_GUIDE_REL_PATH);
-  if (!fs29.existsSync(full)) {
+  if (!fs30.existsSync(full)) {
     ctx.data.qaGuide = "";
     ctx.data.qaGuidePath = "";
     return;
   }
   try {
-    ctx.data.qaGuide = fs29.readFileSync(full, "utf-8");
+    ctx.data.qaGuide = fs30.readFileSync(full, "utf-8");
     ctx.data.qaGuidePath = QA_GUIDE_REL_PATH;
   } catch {
     ctx.data.qaGuide = "";
@@ -8011,9 +8662,9 @@ var loadQaGuide = async (ctx) => {
 
 // src/scripts/initFlow.ts
 function detectPackageManager(cwd) {
-  if (fs30.existsSync(path29.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs30.existsSync(path29.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs30.existsSync(path29.join(cwd, "bun.lockb"))) return "bun";
+  if (fs31.existsSync(path29.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs31.existsSync(path29.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs31.existsSync(path29.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function qualityCommandsFor(pm) {
@@ -8136,47 +8787,47 @@ function performInit(cwd, force) {
   const ownerRepo = detectOwnerRepo(cwd);
   const defaultBranch2 = defaultBranchFromGit(cwd);
   const configPath = path29.join(cwd, "kody.config.json");
-  if (fs30.existsSync(configPath) && !force) {
+  if (fs31.existsSync(configPath) && !force) {
     skipped.push("kody.config.json");
   } else {
     const cfg = makeConfig(pm, ownerRepo, defaultBranch2);
-    fs30.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
+    fs31.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
 `);
     wrote.push("kody.config.json");
   }
   const workflowDir = path29.join(cwd, ".github", "workflows");
   const workflowPath = path29.join(workflowDir, "kody.yml");
-  if (fs30.existsSync(workflowPath) && !force) {
+  if (fs31.existsSync(workflowPath) && !force) {
     skipped.push(".github/workflows/kody.yml");
   } else {
-    fs30.mkdirSync(workflowDir, { recursive: true });
-    fs30.writeFileSync(workflowPath, WORKFLOW_TEMPLATE);
+    fs31.mkdirSync(workflowDir, { recursive: true });
+    fs31.writeFileSync(workflowPath, WORKFLOW_TEMPLATE);
     wrote.push(".github/workflows/kody.yml");
   }
-  const hasUi = fs30.existsSync(path29.join(cwd, "src/app")) || fs30.existsSync(path29.join(cwd, "app")) || fs30.existsSync(path29.join(cwd, "pages"));
+  const hasUi = fs31.existsSync(path29.join(cwd, "src/app")) || fs31.existsSync(path29.join(cwd, "app")) || fs31.existsSync(path29.join(cwd, "pages"));
   if (hasUi) {
     const qaGuidePath = path29.join(cwd, QA_GUIDE_REL_PATH);
-    if (fs30.existsSync(qaGuidePath) && !force) {
+    if (fs31.existsSync(qaGuidePath) && !force) {
       skipped.push(QA_GUIDE_REL_PATH);
     } else {
-      fs30.mkdirSync(path29.dirname(qaGuidePath), { recursive: true });
+      fs31.mkdirSync(path29.dirname(qaGuidePath), { recursive: true });
       const discovery = runQaDiscovery(cwd);
-      fs30.writeFileSync(qaGuidePath, generateQaGuideTemplate(discovery));
+      fs31.writeFileSync(qaGuidePath, generateQaGuideTemplate(discovery));
       wrote.push(QA_GUIDE_REL_PATH);
     }
   }
   const builtinJobs = listBuiltinJobs();
   if (builtinJobs.length > 0) {
     const jobsDir = path29.join(cwd, ".kody", "jobs");
-    fs30.mkdirSync(jobsDir, { recursive: true });
+    fs31.mkdirSync(jobsDir, { recursive: true });
     for (const job of builtinJobs) {
       const rel = path29.join(".kody", "jobs", `${job.slug}.md`);
       const target = path29.join(cwd, rel);
-      if (fs30.existsSync(target) && !force) {
+      if (fs31.existsSync(target) && !force) {
         skipped.push(rel);
         continue;
       }
-      fs30.writeFileSync(target, fs30.readFileSync(job.filePath, "utf-8"));
+      fs31.writeFileSync(target, fs31.readFileSync(job.filePath, "utf-8"));
       wrote.push(rel);
     }
   }
@@ -8189,11 +8840,11 @@ function performInit(cwd, force) {
     }
     if (profile.kind !== "scheduled" || !profile.schedule) continue;
     const target = path29.join(workflowDir, `kody-${exe.name}.yml`);
-    if (fs30.existsSync(target) && !force) {
+    if (fs31.existsSync(target) && !force) {
       skipped.push(`.github/workflows/kody-${exe.name}.yml`);
       continue;
     }
-    fs30.writeFileSync(target, renderScheduledWorkflow(exe.name, profile.schedule));
+    fs31.writeFileSync(target, renderScheduledWorkflow(exe.name, profile.schedule));
     wrote.push(`.github/workflows/kody-${exe.name}.yml`);
   }
   let labels;
@@ -8271,7 +8922,7 @@ init_loadConventions();
 init_loadCoverageRules();
 
 // src/goal/state.ts
-import * as fs31 from "fs";
+import * as fs32 from "fs";
 import * as path30 from "path";
 var VALID_STATES = /* @__PURE__ */ new Set(["active", "abandoned", "closed", "awaiting-merge", "done"]);
 var GoalStateError = class extends Error {
@@ -8330,12 +8981,12 @@ function goalStatePath(cwd, goalId) {
 }
 function readGoalState(cwd, goalId) {
   const file = goalStatePath(cwd, goalId);
-  if (!fs31.existsSync(file)) {
+  if (!fs32.existsSync(file)) {
     throw new GoalStateError(file, "file not found");
   }
   let raw;
   try {
-    raw = JSON.parse(fs31.readFileSync(file, "utf-8"));
+    raw = JSON.parse(fs32.readFileSync(file, "utf-8"));
   } catch (err) {
     throw new GoalStateError(file, `invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -8343,8 +8994,8 @@ function readGoalState(cwd, goalId) {
 }
 function writeGoalState(cwd, goalId, state) {
   const file = goalStatePath(cwd, goalId);
-  fs31.mkdirSync(path30.dirname(file), { recursive: true });
-  fs31.writeFileSync(file, serializeGoalState(state), "utf-8");
+  fs32.mkdirSync(path30.dirname(file), { recursive: true });
+  fs32.writeFileSync(file, serializeGoalState(state), "utf-8");
 }
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
@@ -8441,7 +9092,7 @@ var loadIssueStateComment = async (ctx, _profile, args) => {
 };
 
 // src/scripts/loadJobFromFile.ts
-import * as fs32 from "fs";
+import * as fs33 from "fs";
 import * as path31 from "path";
 var loadJobFromFile = async (ctx, _profile, args) => {
   const jobsDir = String(args?.jobsDir ?? ".kody/jobs");
@@ -8452,22 +9103,22 @@ var loadJobFromFile = async (ctx, _profile, args) => {
     throw new Error(`loadJobFromFile: ctx.args.${slugArg} must be a non-empty slug`);
   }
   const absPath = path31.join(ctx.cwd, jobsDir, `${slug}.md`);
-  if (!fs32.existsSync(absPath)) {
+  if (!fs33.existsSync(absPath)) {
     throw new Error(`loadJobFromFile: job file not found: ${absPath}`);
   }
-  const raw = fs32.readFileSync(absPath, "utf-8");
+  const raw = fs33.readFileSync(absPath, "utf-8");
   const { title, body } = parseJobFile(raw, slug);
   const workerSlug = (splitFrontmatter2(raw).frontmatter.worker ?? "").trim();
   let workerTitle = "";
   let workerPersona = "";
   if (workerSlug) {
     const workerPath = path31.join(ctx.cwd, workersDir, `${workerSlug}.md`);
-    if (!fs32.existsSync(workerPath)) {
+    if (!fs33.existsSync(workerPath)) {
       throw new Error(
         `loadJobFromFile: job '${slug}' declares worker '${workerSlug}' but ${workerPath} does not exist`
       );
     }
-    const workerRaw = fs32.readFileSync(workerPath, "utf-8");
+    const workerRaw = fs33.readFileSync(workerPath, "utf-8");
     const parsed = parseJobFile(workerRaw, workerSlug);
     workerTitle = parsed.title;
     workerPersona = parsed.body;
@@ -8505,7 +9156,7 @@ function humanizeSlug(slug) {
 }
 
 // src/scripts/loadWorkerAdhoc.ts
-import * as fs33 from "fs";
+import * as fs34 from "fs";
 import * as path32 from "path";
 var loadWorkerAdhoc = async (ctx, _profile, args) => {
   const workersDir = String(args?.workersDir ?? ".kody/workers");
@@ -8514,10 +9165,10 @@ var loadWorkerAdhoc = async (ctx, _profile, args) => {
     throw new Error("loadWorkerAdhoc: ctx.args.worker must be a non-empty slug");
   }
   const workerPath = path32.join(ctx.cwd, workersDir, `${workerSlug}.md`);
-  if (!fs33.existsSync(workerPath)) {
+  if (!fs34.existsSync(workerPath)) {
     throw new Error(`loadWorkerAdhoc: worker persona not found: ${workerPath}`);
   }
-  const { title, body } = parsePersona(fs33.readFileSync(workerPath, "utf-8"), workerSlug);
+  const { title, body } = parsePersona(fs34.readFileSync(workerPath, "utf-8"), workerSlug);
   const message = resolveMessage(ctx.args.message);
   if (!message) {
     throw new Error(
@@ -8537,9 +9188,9 @@ function resolveMessage(messageArg) {
 }
 function readCommentBody() {
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventPath || !fs33.existsSync(eventPath)) return "";
+  if (!eventPath || !fs34.existsSync(eventPath)) return "";
   try {
-    const event = JSON.parse(fs33.readFileSync(eventPath, "utf-8"));
+    const event = JSON.parse(fs34.readFileSync(eventPath, "utf-8"));
     return String(event.comment?.body ?? "");
   } catch {
     return "";
@@ -8585,7 +9236,7 @@ init_loadPriorArt();
 init_events();
 
 // src/taskContext.ts
-import * as fs35 from "fs";
+import * as fs36 from "fs";
 import * as path34 from "path";
 var TASK_CONTEXT_SCHEMA_VERSION = 1;
 function buildTaskContext(args) {
@@ -8603,9 +9254,9 @@ function buildTaskContext(args) {
 function persistTaskContext(cwd, ctx) {
   try {
     const dir = path34.join(cwd, ".kody", "runs", ctx.runId);
-    fs35.mkdirSync(dir, { recursive: true });
+    fs36.mkdirSync(dir, { recursive: true });
     const file = path34.join(dir, "task-context.json");
-    fs35.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
+    fs36.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
 `);
     return file;
   } catch (err) {
@@ -9968,7 +10619,7 @@ function resolveBaseOverride(value) {
 
 // src/scripts/runTickScript.ts
 import { spawnSync } from "child_process";
-import * as fs36 from "fs";
+import * as fs37 from "fs";
 import * as path35 from "path";
 var runTickScript = async (ctx, _profile, args) => {
   ctx.skipAgent = true;
@@ -9982,12 +10633,12 @@ var runTickScript = async (ctx, _profile, args) => {
     return;
   }
   const jobPath = path35.join(ctx.cwd, jobsDir, `${slug}.md`);
-  if (!fs36.existsSync(jobPath)) {
+  if (!fs37.existsSync(jobPath)) {
     ctx.output.exitCode = 99;
     ctx.output.reason = `runTickScript: job file not found: ${jobPath}`;
     return;
   }
-  const raw = fs36.readFileSync(jobPath, "utf-8");
+  const raw = fs37.readFileSync(jobPath, "utf-8");
   const { frontmatter } = splitFrontmatter2(raw);
   const tickScript = frontmatter.tickScript;
   if (!tickScript) {
@@ -9996,7 +10647,7 @@ var runTickScript = async (ctx, _profile, args) => {
     return;
   }
   const scriptPath = path35.isAbsolute(tickScript) ? tickScript : path35.join(ctx.cwd, tickScript);
-  if (!fs36.existsSync(scriptPath)) {
+  if (!fs37.existsSync(scriptPath)) {
     ctx.output.exitCode = 99;
     ctx.output.reason = `runTickScript: tickScript not found: ${scriptPath}`;
     return;
@@ -10144,7 +10795,7 @@ function synthesizeAction(ctx) {
 }
 
 // src/scripts/serveFlow.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 function parseTarget(positional) {
   if (!Array.isArray(positional) || positional.length === 0) return "none";
   const first = String(positional[0]).toLowerCase();
@@ -10193,7 +10844,7 @@ var serveFlow = async (ctx) => {
     if (usesProxy) process.stdout.write(`  ANTHROPIC_BASE_URL=${url}
 `);
     const args = ["--dangerously-skip-permissions", "--model", model.model];
-    const child = spawn3("claude", args, { stdio: "inherit", env: editorEnv, cwd: ctx.cwd });
+    const child = spawn5("claude", args, { stdio: "inherit", env: editorEnv, cwd: ctx.cwd });
     const exitCode = await new Promise((resolve4) => {
       child.on("exit", (code) => resolve4(code ?? 0));
       child.on("error", (err) => {
@@ -10214,7 +10865,7 @@ var serveFlow = async (ctx) => {
     if (usesProxy) process.stdout.write(`  ANTHROPIC_BASE_URL=${url}
 `);
     try {
-      const code = spawn3("code", [ctx.cwd], { stdio: "inherit", env: editorEnv, detached: true });
+      const code = spawn5("code", [ctx.cwd], { stdio: "inherit", env: editorEnv, detached: true });
       code.on("error", (err) => {
         process.stderr.write(`[kody serve] failed to launch VS Code: ${err.message}
 `);
@@ -10469,7 +11120,7 @@ var verify = async (ctx) => {
 };
 
 // src/scripts/verifyReproFails.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 var TEST_TIMEOUT_MS = 10 * 60 * 1e3;
 var TAIL_CHARS2 = 8e3;
 var ANSI_RE2 = /\x1B\[[0-?]*[ -/]*[@-~]/g;
@@ -10538,7 +11189,7 @@ function stripAnsi2(s) {
 }
 function runCommand2(command, cwd) {
   return new Promise((resolve4) => {
-    const child = spawn4(command, {
+    const child = spawn6(command, {
       cwd,
       shell: true,
       env: { ...process.env, HUSKY: "0", SKIP_HOOKS: "1", CI: process.env.CI ?? "1" },
@@ -10691,17 +11342,17 @@ var waitForCi = async (ctx, _profile, _agentResult, args) => {
     return;
   }
   const fixCiAttempts = state?.core.attempts?.["fix-ci"] ?? 0;
-  await sleep2(initialWaitSeconds * 1e3);
+  await sleep3(initialWaitSeconds * 1e3);
   const deadline = Date.now() + timeoutMinutes * 6e4;
   let lastSummary = "";
   while (Date.now() < deadline) {
     const rows = fetchChecks(prNumber, ctx.cwd);
     if (rows === null) {
-      await sleep2(pollSeconds * 1e3);
+      await sleep3(pollSeconds * 1e3);
       continue;
     }
     if (rows.length === 0) {
-      await sleep2(pollSeconds * 1e3);
+      await sleep3(pollSeconds * 1e3);
       continue;
     }
     const summary = summarize(rows);
@@ -10744,7 +11395,7 @@ var waitForCi = async (ctx, _profile, _agentResult, args) => {
       tryPostPr7(prNumber, `\u2705 kody waitForCi: all ${rows.length} checks green on PR #${prNumber}`, ctx.cwd);
       return;
     }
-    await sleep2(pollSeconds * 1e3);
+    await sleep3(pollSeconds * 1e3);
   }
   ctx.data.action = mkAction("CI_TIMEOUT", {
     reason: `CI did not complete within ${timeoutMinutes} minutes`,
@@ -10796,12 +11447,12 @@ function tryPostPr7(prNumber, body, cwd) {
   } catch {
   }
 }
-function sleep2(ms) {
+function sleep3(ms) {
   return new Promise((res) => setTimeout(res, ms));
 }
 
 // src/scripts/warmupMcp.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 var PER_SERVER_TIMEOUT_MS = 6e4;
 var PER_REQUEST_TIMEOUT_MS = 2e4;
 var warmupMcp = async (_ctx, profile) => {
@@ -10823,7 +11474,7 @@ var warmupMcp = async (_ctx, profile) => {
   }
 };
 async function warmupOne(command, args, env) {
-  const child = spawn5(command, args, {
+  const child = spawn7(command, args, {
     stdio: ["pipe", "pipe", "pipe"],
     env: env ? { ...process.env, ...env } : process.env
   });
@@ -11012,7 +11663,7 @@ var writeJobStateFile = async (ctx, _profile, _agentResult, args) => {
 };
 
 // src/scripts/writeRunSummary.ts
-import * as fs37 from "fs";
+import * as fs38 from "fs";
 var writeRunSummary = async (ctx, profile) => {
   const summaryPath = process.env.GITHUB_STEP_SUMMARY;
   if (!summaryPath) return;
@@ -11034,7 +11685,7 @@ var writeRunSummary = async (ctx, profile) => {
   if (reason) lines.push(`- **Reason:** ${reason}`);
   lines.push("");
   try {
-    fs37.appendFileSync(summaryPath, `${lines.join("\n")}
+    fs38.appendFileSync(summaryPath, `${lines.join("\n")}
 `);
   } catch {
   }
@@ -11078,6 +11729,8 @@ var preflightScripts = {
   runTickScript,
   serveFlow,
   brainServe,
+  runnerServe,
+  poolServe,
   loadGoalState,
   handleAbandonedGoal,
   deriveGoalPhase,
@@ -11487,7 +12140,7 @@ function clearStampedLifecycleLabels(profile, ctx) {
 function getProfileInputsForChild(profileName, _cwd) {
   try {
     const profilePath = resolveProfilePath(profileName);
-    if (!fs38.existsSync(profilePath)) return null;
+    if (!fs39.existsSync(profilePath)) return null;
     return loadProfile(profilePath).inputs;
   } catch {
     return null;
@@ -11506,7 +12159,7 @@ function resolveProfilePath(profileName) {
     // fallback
   ];
   for (const c of candidates) {
-    if (fs38.existsSync(c)) return c;
+    if (fs39.existsSync(c)) return c;
   }
   return candidates[0];
 }
@@ -11607,7 +12260,7 @@ var SIGKILL_GRACE_MS = 5e3;
 async function runShellEntry(entry, ctx, profile) {
   const shellName = entry.shell;
   const shellPath = path36.join(profile.dir, shellName);
-  if (!fs38.existsSync(shellPath)) {
+  if (!fs39.existsSync(shellPath)) {
     ctx.skipAgent = true;
     ctx.output.exitCode = 99;
     ctx.output.reason = `shell script not found: ${shellName} (looked in ${profile.dir})`;
@@ -11623,7 +12276,7 @@ async function runShellEntry(entry, ctx, profile) {
     env[`KODY_CFG_${k}`] = v;
   }
   const timeoutMs = resolveShellTimeoutMs(entry);
-  const child = spawn6("bash", [shellPath, ...positional], {
+  const child = spawn8("bash", [shellPath, ...positional], {
     cwd: ctx.cwd,
     env,
     stdio: ["pipe", "pipe", "pipe"],
@@ -12086,9 +12739,9 @@ function resolveAuthToken(env = process.env) {
   return token;
 }
 function detectPackageManager2(cwd) {
-  if (fs39.existsSync(path37.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs39.existsSync(path37.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs39.existsSync(path37.join(cwd, "bun.lockb"))) return "bun";
+  if (fs40.existsSync(path37.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs40.existsSync(path37.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs40.existsSync(path37.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function shellOut(cmd, args, cwd, stream = true) {
@@ -12178,8 +12831,8 @@ function postFailureTail(issueNumber, cwd, reason) {
   const logPath = path37.join(cwd, ".kody", "last-run.jsonl");
   let tail = "";
   try {
-    if (fs39.existsSync(logPath)) {
-      const content = fs39.readFileSync(logPath, "utf-8");
+    if (fs40.existsSync(logPath)) {
+      const content = fs40.readFileSync(logPath, "utf-8");
       tail = content.slice(-3e3);
     }
   } catch {
@@ -12214,9 +12867,9 @@ async function runCi(argv) {
   const eventName = process.env.GITHUB_EVENT_NAME;
   const dispatchEventPath = process.env.GITHUB_EVENT_PATH;
   let manualWorkflowDispatch = false;
-  if (!args.issueNumber && !autoFallback && eventName === "workflow_dispatch" && dispatchEventPath && fs39.existsSync(dispatchEventPath)) {
+  if (!args.issueNumber && !autoFallback && eventName === "workflow_dispatch" && dispatchEventPath && fs40.existsSync(dispatchEventPath)) {
     try {
-      const evt = JSON.parse(fs39.readFileSync(dispatchEventPath, "utf-8"));
+      const evt = JSON.parse(fs40.readFileSync(dispatchEventPath, "utf-8"));
       const issueInput = parseInt(String(evt?.inputs?.issue_number ?? ""), 10);
       const sessionInput = String(evt?.inputs?.sessionId ?? "");
       manualWorkflowDispatch = !sessionInput && !(Number.isFinite(issueInput) && issueInput > 0);
@@ -12480,7 +13133,7 @@ function commitChatFiles(cwd, sessionId, verbose) {
   const safeSession = sessionId.replace(/[^a-zA-Z0-9._-]/g, "_");
   const tasksDir = path38.join(".kody", "tasks", safeSession);
   const candidatePaths = [sessionFile, eventsFile, tasksDir];
-  const paths = candidatePaths.filter((p) => fs40.existsSync(path38.join(cwd, p)));
+  const paths = candidatePaths.filter((p) => fs41.existsSync(path38.join(cwd, p)));
   if (paths.length === 0) return;
   const opts = { cwd, stdio: verbose ? "inherit" : "pipe" };
   try {
@@ -12576,7 +13229,7 @@ ${CHAT_HELP}`);
   const sink = buildSink(cwd, sessionId, args.dashboardUrl);
   const meta = readMeta(sessionFile);
   process.stdout.write(
-    `\u2192 kody:chat: session file=${sessionFile} exists=${fs40.existsSync(sessionFile)} meta=${meta ? meta.mode : "none"}
+    `\u2192 kody:chat: session file=${sessionFile} exists=${fs41.existsSync(sessionFile)} meta=${meta ? meta.mode : "none"}
 `
   );
   try {