@kynver-app/runtime 0.1.102 → 0.1.105

package/dist/server/orchestration.js

@@ -0,0 +1,444 @@
+// src/orchestration-providers/claude-oauth-binding.ts
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+
+// src/orchestration-providers/oauth-binding-utils.ts
+import { createHash } from "node:crypto";
+import { statSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+function fingerprintAuthStore(filePath) {
+  try {
+    const st = statSync(filePath);
+    const material = `${filePath}|${st.size}|${st.mtimeMs}`;
+    return createHash("sha256").update(material).digest("hex").slice(0, 16);
+  } catch {
+    return void 0;
+  }
+}
+function envKeyFingerprint(envKey) {
+  return createHash("sha256").update(`env:${envKey}`).digest("hex").slice(0, 16);
+}
+function resolveCliBin(defaultBin, envKeys) {
+  for (const key of envKeys) {
+    const value = process.env[key]?.trim();
+    if (value) return value;
+  }
+  return defaultBin;
+}
+function probeCliCommand(bin, args, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 8e3;
+  try {
+    const result = spawnSync(bin, args, {
+      encoding: "utf8",
+      timeout: timeoutMs,
+      env: { ...process.env, CI: "1", NO_COLOR: "1" }
+    });
+    if (result.status === 0) {
+      return { ok: true, note: options.okNote ?? `${bin} ${args.join(" ")}: ok` };
+    }
+    const stderr = (result.stderr || result.stdout || "").trim();
+    const prefix = options.failPrefix ?? `${bin} ${args.join(" ")} failed`;
+    return {
+      ok: false,
+      note: stderr ? `${prefix}: ${stderr.slice(0, 200)}` : prefix
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      note: err instanceof Error ? err.message : `${bin} probe failed`
+    };
+  }
+}
+function probeCliExitCodeOnly(bin, args, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 8e3;
+  try {
+    const result = spawnSync(bin, args, {
+      stdio: "ignore",
+      timeout: timeoutMs,
+      env: { ...process.env, CI: "1", NO_COLOR: "1" }
+    });
+    if (result.status === 0) {
+      return { ok: true, note: options.okNote ?? `${bin} authenticated` };
+    }
+    return { ok: false, note: options.failNote ?? `${bin} not authenticated` };
+  } catch (err) {
+    return {
+      ok: false,
+      note: err instanceof Error ? err.message : `${bin} auth probe failed`
+    };
+  }
+}
+
+// src/orchestration-providers/claude-oauth-binding.ts
+var DEFAULT_CLAUDE_BIN = "claude";
+function claudeAuthStoreCandidates() {
+  const home = homedir();
+  return [path.join(home, ".claude", ".credentials.json")];
+}
+function probeClaudeOAuthBinding(nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  const bin = resolveCliBin(DEFAULT_CLAUDE_BIN, ["KYNVER_CLAUDE_BIN", "CLAUDE_BIN"]);
+  if (process.env.ANTHROPIC_API_KEY?.trim()) {
+    return {
+      providerId: "claude",
+      ready: true,
+      authSource: "api_key_env",
+      sessionFingerprint: envKeyFingerprint("ANTHROPIC_API_KEY"),
+      checkedAt: nowIso,
+      note: "ANTHROPIC_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"
+    };
+  }
+  const cli = probeCliCommand(bin, ["--version"], {
+    okNote: `${bin} CLI available`,
+    failPrefix: `${bin} CLI not available`
+  });
+  const authPath = claudeAuthStoreCandidates().find((p) => existsSync(p));
+  const login = probeCliExitCodeOnly(bin, ["auth", "status"], {
+    okNote: "claude auth status: authenticated",
+    failNote: "claude auth status: not authenticated"
+  });
+  const ready = cli.ok && (login.ok || Boolean(authPath));
+  return {
+    providerId: "claude",
+    ready,
+    authSource: "oauth_local",
+    sessionFingerprint: authPath ? fingerprintAuthStore(authPath) : void 0,
+    checkedAt: nowIso,
+    note: ready ? "Local Claude Code OAuth session bound on runner" : [cli.note, login.note, authPath ? void 0 : "no ~/.claude/.credentials.json"].filter(Boolean).join("; ")
+  };
+}
+
+// src/orchestration-providers/codex-oauth-binding.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path2 from "node:path";
+var DEFAULT_CODEX_BIN = "codex";
+function authStoreCandidates() {
+  const home = homedir2();
+  return [
+    path2.join(home, ".codex", "auth.json"),
+    path2.join(home, ".config", "codex", "auth.json")
+  ];
+}
+function probeCodexOAuthBinding(nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  const bin = resolveCliBin(DEFAULT_CODEX_BIN, ["KYNVER_CODEX_BIN", "CODEX_BIN"]);
+  if (process.env.CODEX_API_KEY?.trim()) {
+    return {
+      providerId: "codex",
+      ready: true,
+      authSource: "api_key_env",
+      sessionFingerprint: envKeyFingerprint("CODEX_API_KEY"),
+      checkedAt: nowIso,
+      note: "CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"
+    };
+  }
+  const authPath = authStoreCandidates().find((p) => existsSync2(p));
+  const login = probeCliCommand(bin, ["login", "status"], {
+    okNote: "codex login status: authenticated",
+    failPrefix: "codex login status"
+  });
+  const ready = Boolean(authPath) && login.ok;
+  return {
+    providerId: "codex",
+    ready,
+    authSource: "oauth_local",
+    sessionFingerprint: authPath ? fingerprintAuthStore(authPath) : void 0,
+    checkedAt: nowIso,
+    note: ready ? "Local Codex OAuth session bound on runner" : [login.note, authPath ? void 0 : "no ~/.codex/auth.json"].filter(Boolean).join("; ")
+  };
+}
+
+// src/orchestration-providers/hermes-openai-codex-binding.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import path3 from "node:path";
+function hermesAuthStorePath() {
+  const configured = process.env.HERMES_HOME?.trim();
+  const home = configured ? path3.resolve(configured) : path3.join(homedir3(), ".hermes");
+  return path3.join(home, "auth.json");
+}
+function probeHermesOpenAiCodexBinding(nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  const bin = resolveCliBin("hermes", ["KYNVER_HERMES_BIN", "HERMES_BIN"]);
+  const cli = probeCliCommand(bin, ["--version"], {
+    okNote: `${bin} CLI available`,
+    failPrefix: `${bin} CLI not available`
+  });
+  const authPath = hermesAuthStorePath();
+  const authStorePresent = existsSync3(authPath);
+  const auth = probeCliExitCodeOnly(bin, ["auth", "status", "openai-codex"], {
+    okNote: "hermes openai-codex: logged in",
+    failNote: "hermes openai-codex: not logged in"
+  });
+  const ready = cli.ok && auth.ok;
+  const authSource = ready ? "subscription_hermes" : "none";
+  return {
+    path: "hermes_openai_codex",
+    ready,
+    authSource,
+    sessionFingerprint: authStorePresent ? fingerprintAuthStore(authPath) : void 0,
+    checkedAt: nowIso,
+    note: ready ? "Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)" : [cli.note, auth.note, authStorePresent ? void 0 : "no ~/.hermes/auth.json"].filter(Boolean).join("; ")
+  };
+}
+
+// src/orchestration-providers/codex-orchestration-adapter.ts
+function resolveCodexOrchestrationAdapter(nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  const cliBinding = probeCodexOAuthBinding(nowIso);
+  if (cliBinding.ready) {
+    return { ...cliBinding, path: "codex_cli" };
+  }
+  const hermes = probeHermesOpenAiCodexBinding(nowIso);
+  if (hermes.ready) {
+    return {
+      providerId: "codex",
+      ready: true,
+      authSource: hermes.authSource,
+      sessionFingerprint: hermes.sessionFingerprint,
+      checkedAt: hermes.checkedAt,
+      note: hermes.note,
+      path: "hermes_openai_codex",
+      hermesOpenAiCodex: hermes
+    };
+  }
+  return {
+    providerId: "codex",
+    ready: false,
+    authSource: "none",
+    checkedAt: nowIso,
+    path: "none",
+    hermesOpenAiCodex: hermes,
+    note: [cliBinding.note, hermes.note].filter(Boolean).join("; ") || "Codex CLI and Hermes openai-codex unavailable"
+  };
+}
+
+// src/orchestration-providers/cursor-oauth-binding.ts
+import { existsSync as existsSync4 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import path4 from "node:path";
+var DEFAULT_AGENT_BIN = "agent";
+function cursorAuthStoreCandidates() {
+  const home = homedir4();
+  return [path4.join(home, ".config", "cursor", "auth.json")];
+}
+function probeCursorOAuthBinding(nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  const bin = resolveCliBin(DEFAULT_AGENT_BIN, [
+    "KYNVER_CURSOR_AGENT_BIN",
+    "CURSOR_AGENT_BIN"
+  ]);
+  if (process.env.CURSOR_API_KEY?.trim()) {
+    return {
+      providerId: "cursor",
+      ready: true,
+      authSource: "api_key_env",
+      sessionFingerprint: envKeyFingerprint("CURSOR_API_KEY"),
+      checkedAt: nowIso,
+      note: "CURSOR_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"
+    };
+  }
+  const cli = probeCliCommand(bin, ["-v"], {
+    okNote: `${bin} CLI available`,
+    failPrefix: `${bin} CLI not available`
+  });
+  const authPath = cursorAuthStoreCandidates().find((p) => existsSync4(p));
+  const ready = Boolean(authPath) && cli.ok;
+  return {
+    providerId: "cursor",
+    ready,
+    authSource: "oauth_local",
+    sessionFingerprint: authPath ? fingerprintAuthStore(authPath) : void 0,
+    checkedAt: nowIso,
+    note: ready ? "Local Cursor/Composer OAuth session bound on runner" : [cli.note, authPath ? void 0 : "no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")
+  };
+}
+
+// src/orchestration-providers/hermes-cli-adapter.ts
+import { existsSync as existsSync5, readFileSync } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import path5 from "node:path";
+var PROFILE_ENV_KEYS = [
+  "OPENAI_API_KEY",
+  "ANTHROPIC_API_KEY",
+  "KYNVER_API_KEY",
+  "KYNVER_BASE_URL"
+];
+function hermesProfileEnvPath() {
+  const configured = process.env.HERMES_HOME?.trim();
+  const home = configured ? path5.resolve(configured) : path5.join(homedir5(), ".hermes");
+  return path5.join(home, ".env");
+}
+function profileEnvKeyPresence(envPath) {
+  try {
+    const text = readFileSync(envPath, "utf8");
+    const present = [];
+    for (const key of PROFILE_ENV_KEYS) {
+      const re = new RegExp(`^${key}=`, "m");
+      if (re.test(text)) present.push(key);
+    }
+    return present;
+  } catch {
+    return [];
+  }
+}
+function probeHermesCliAdapter(nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  const bin = resolveCliBin("hermes", ["KYNVER_HERMES_BIN", "HERMES_BIN"]);
+  const cli = probeCliCommand(bin, ["--version"], {
+    okNote: `${bin} CLI available`,
+    failPrefix: `${bin} CLI not available`
+  });
+  const profilePath = hermesProfileEnvPath();
+  const profileBound = existsSync5(profilePath);
+  const envKeys = profileBound ? profileEnvKeyPresence(profilePath) : [];
+  const hasApiKeys = envKeys.some((k) => k.endsWith("_API_KEY"));
+  const authSource = hasApiKeys ? "api_key_env" : profileBound ? "oauth_local" : "none";
+  const ready = cli.ok && profileBound;
+  return {
+    adapterId: "hermes",
+    cliAvailable: cli.ok,
+    profileBound,
+    authSource,
+    sessionFingerprint: profileBound ? fingerprintAuthStore(profilePath) : void 0,
+    checkedAt: nowIso,
+    note: ready ? `Hermes profile bound (${envKeys.length ? `keys: ${envKeys.join(", ")}` : "no API keys detected"})` : [cli.note, profileBound ? void 0 : "no ~/.hermes/.env"].filter(Boolean).join("; ")
+  };
+}
+
+// src/orchestration-providers/inventory.ts
+function buildOrchestrationProviderInventory(options = {}) {
+  const generatedAt = options.nowIso?.() ?? (/* @__PURE__ */ new Date()).toISOString();
+  const codexAdapter = resolveCodexOrchestrationAdapter(generatedAt);
+  const bindings = {
+    codex: codexAdapter,
+    cursor: probeCursorOAuthBinding(generatedAt),
+    claude: probeClaudeOAuthBinding(generatedAt)
+  };
+  const readyCount = Object.values(bindings).filter((b) => b.ready).length;
+  return {
+    generatedAt,
+    bindings,
+    cloudApiCredits: {
+      anthropicApiKey: Boolean(process.env.ANTHROPIC_API_KEY?.trim()),
+      openaiApiKey: Boolean(process.env.OPENAI_API_KEY?.trim()),
+      codexApiKey: Boolean(process.env.CODEX_API_KEY?.trim())
+    },
+    hermes: probeHermesCliAdapter(generatedAt),
+    hermesOpenAiCodex: probeHermesOpenAiCodexBinding(generatedAt),
+    codexAdapterPath: codexAdapter.path,
+    readyCount
+  };
+}
+
+// src/orchestration-providers/capabilities.ts
+var CAPABILITIES = {
+  codex: {
+    id: "codex",
+    displayName: "Codex (BYO OAuth / Hermes openai-codex)",
+    costTier: "low",
+    authSources: ["oauth_local", "api_key_env", "subscription_hermes"],
+    supportsLowRiskOrchestration: true,
+    supportsPrivilegedPlatformActions: false
+  },
+  cursor: {
+    id: "cursor",
+    displayName: "Cursor / Composer",
+    costTier: "medium",
+    authSources: ["oauth_local", "api_key_env"],
+    supportsLowRiskOrchestration: true,
+    supportsPrivilegedPlatformActions: true
+  },
+  claude: {
+    id: "claude",
+    displayName: "Claude Code",
+    costTier: "high",
+    authSources: ["oauth_local"],
+    supportsLowRiskOrchestration: true,
+    supportsPrivilegedPlatformActions: true
+  }
+};
+function listOrchestrationProviderCapabilities() {
+  return Object.values(CAPABILITIES);
+}
+
+// src/orchestration-enforcement/types.ts
+var ORCHESTRATION_POLICY_MODES = ["off", "observe", "enforce"];
+
+// src/orchestration-enforcement/config.ts
+function normalizeMode(raw) {
+  const value = (raw ?? "off").trim().toLowerCase();
+  if (ORCHESTRATION_POLICY_MODES.includes(value)) {
+    return value;
+  }
+  return "off";
+}
+function resolveOrchestrationPolicyMode(env = process.env) {
+  return normalizeMode(env.KYNVER_ORCHESTRATION_POLICY_MODE);
+}
+function isOrchestrationEnforceTasksEnabled(env = process.env) {
+  const raw = env.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();
+  if (!raw) return resolveOrchestrationPolicyMode(env) === "enforce";
+  return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
+}
+
+// src/orchestration-enforcement/idempotency.ts
+import { createHash as createHash2 } from "node:crypto";
+function trimOrNull(value) {
+  if (value == null) return null;
+  const t = value.trim();
+  return t.length ? t : null;
+}
+function buildForegroundHarnessIdempotencyKey(input) {
+  const session = trimOrNull(input.sessionId) ?? "anonymous";
+  const title = trimOrNull(input.title) ?? trimOrNull(input.action) ?? "foreground";
+  const digest = createHash2("sha256").update(
+    [
+      trimOrNull(input.planId) ?? "",
+      trimOrNull(input.parentTaskId) ?? "",
+      title.toLowerCase()
+    ].join("|")
+  ).digest("hex").slice(0, 16);
+  return `hermes-foreground:${session}:${digest}`;
+}
+
+// src/orchestration-enforcement/evaluator.ts
+function decisionForMode(mode, enforceEnabled) {
+  if (mode === "enforce" && enforceEnabled) return "enforce_harness_task";
+  if (mode === "observe") return "observe_bypass";
+  return "allow_local";
+}
+function evaluateOrchestrationPolicy(input, env = process.env) {
+  const mode = resolveOrchestrationPolicyMode(env);
+  const enforceEnabled = isOrchestrationEnforceTasksEnabled(env);
+  const decision = decisionForMode(mode, enforceEnabled);
+  const idempotencyKey = decision === "enforce_harness_task" ? buildForegroundHarnessIdempotencyKey({
+    sessionId: input.sessionId,
+    planId: input.planId,
+    parentTaskId: input.parentTaskId,
+    title: input.title,
+    action: input.action
+  }) : null;
+  let reason;
+  if (mode === "off") {
+    reason = "Orchestration policy off \u2014 local foreground path allowed.";
+  } else if (decision === "observe_bypass") {
+    reason = `Observe mode: ${input.action} bypass logged; local fallback preserved.`;
+  } else if (decision === "enforce_harness_task") {
+    reason = `Enforce mode: ${input.action} must create linked harness AgentTask (${idempotencyKey}).`;
+  } else {
+    reason = "Local foreground path allowed.";
+  }
+  return {
+    mode,
+    decision,
+    idempotencyKey,
+    bypassLogged: decision === "observe_bypass",
+    reason
+  };
+}
+export {
+  buildForegroundHarnessIdempotencyKey,
+  buildOrchestrationProviderInventory,
+  evaluateOrchestrationPolicy,
+  isOrchestrationEnforceTasksEnabled,
+  listOrchestrationProviderCapabilities,
+  resolveOrchestrationPolicyMode
+};
+//# sourceMappingURL=orchestration.js.map

package/dist/server/orchestration.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/orchestration-providers/claude-oauth-binding.ts", "../../src/orchestration-providers/oauth-binding-utils.ts", "../../src/orchestration-providers/codex-oauth-binding.ts", "../../src/orchestration-providers/hermes-openai-codex-binding.ts", "../../src/orchestration-providers/codex-orchestration-adapter.ts", "../../src/orchestration-providers/cursor-oauth-binding.ts", "../../src/orchestration-providers/hermes-cli-adapter.ts", "../../src/orchestration-providers/inventory.ts", "../../src/orchestration-providers/capabilities.ts", "../../src/orchestration-enforcement/types.ts", "../../src/orchestration-enforcement/config.ts", "../../src/orchestration-enforcement/idempotency.ts", "../../src/orchestration-enforcement/evaluator.ts"],
+  "sourcesContent": ["import { existsSync } from \"node:fs\";\r\nimport { homedir } from \"node:os\";\r\nimport path from \"node:path\";\r\nimport type { OrchestrationProviderBindingStatus } from \"./types.js\";\r\nimport {\r\n  envKeyFingerprint,\r\n  fingerprintAuthStore,\r\n  probeCliCommand,\r\n  probeCliExitCodeOnly,\r\n  resolveCliBin,\r\n} from \"./oauth-binding-utils.js\";\r\n\r\nconst DEFAULT_CLAUDE_BIN = \"claude\";\r\n\r\nfunction claudeAuthStoreCandidates(): string[] {\r\n  const home = homedir();\r\n  return [path.join(home, \".claude\", \".credentials.json\")];\r\n}\r\n\r\n/**\r\n * Probe Claude Code OAuth on the local runner. Never reads or returns raw OAuth tokens.\r\n * ANTHROPIC_API_KEY is reported separately as api_key_env (cloud credits path).\r\n */\r\nexport function probeClaudeOAuthBinding(\r\n  nowIso: string = new Date().toISOString(),\r\n): OrchestrationProviderBindingStatus {\r\n  const bin = resolveCliBin(DEFAULT_CLAUDE_BIN, [\"KYNVER_CLAUDE_BIN\", \"CLAUDE_BIN\"]);\r\n\r\n  if (process.env.ANTHROPIC_API_KEY?.trim()) {\r\n    return {\r\n      providerId: \"claude\",\r\n      ready: true,\r\n      authSource: \"api_key_env\",\r\n      sessionFingerprint: envKeyFingerprint(\"ANTHROPIC_API_KEY\"),\r\n      checkedAt: nowIso,\r\n      note: \"ANTHROPIC_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)\",\r\n    };\r\n  }\r\n\r\n  const cli = probeCliCommand(bin, [\"--version\"], {\r\n    okNote: `${bin} CLI available`,\r\n    failPrefix: `${bin} CLI not available`,\r\n  });\r\n  const authPath = claudeAuthStoreCandidates().find((p) => existsSync(p));\r\n  const login = probeCliExitCodeOnly(bin, [\"auth\", \"status\"], {\r\n    okNote: \"claude auth status: authenticated\",\r\n    failNote: \"claude auth status: not authenticated\",\r\n  });\r\n  const ready = cli.ok && (login.ok || Boolean(authPath));\r\n\r\n  return {\r\n    providerId: \"claude\",\r\n    ready,\r\n    authSource: \"oauth_local\",\r\n    sessionFingerprint: authPath ? fingerprintAuthStore(authPath) : undefined,\r\n    checkedAt: nowIso,\r\n    note: ready\r\n      ? \"Local Claude Code OAuth session bound on runner\"\r\n      : [cli.note, login.note, authPath ? undefined : \"no ~/.claude/.credentials.json\"]\r\n          .filter(Boolean)\r\n          .join(\"; \"),\r\n  };\r\n}\r\n", "import { createHash } from \"node:crypto\";\r\nimport { statSync } from \"node:fs\";\r\nimport { spawnSync } from \"node:child_process\";\r\n\r\n/** Fingerprint from file metadata only \u2014 never reads token payload. */\r\nexport function fingerprintAuthStore(filePath: string): string | undefined {\r\n  try {\r\n    const st = statSync(filePath);\r\n    const material = `${filePath}|${st.size}|${st.mtimeMs}`;\r\n    return createHash(\"sha256\").update(material).digest(\"hex\").slice(0, 16);\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\nexport function envKeyFingerprint(envKey: string): string {\r\n  return createHash(\"sha256\").update(`env:${envKey}`).digest(\"hex\").slice(0, 16);\r\n}\r\n\r\nexport function resolveCliBin(\r\n  defaultBin: string,\r\n  envKeys: string[],\r\n): string {\r\n  for (const key of envKeys) {\r\n    const value = process.env[key]?.trim();\r\n    if (value) return value;\r\n  }\r\n  return defaultBin;\r\n}\r\n\r\nexport function probeCliCommand(\r\n  bin: string,\r\n  args: string[],\r\n  options: {\r\n    timeoutMs?: number;\r\n    okNote?: string;\r\n    failPrefix?: string;\r\n  } = {},\r\n): { ok: boolean; note?: string } {\r\n  const timeoutMs = options.timeoutMs ?? 8_000;\r\n  try {\r\n    const result = spawnSync(bin, args, {\r\n      encoding: \"utf8\",\r\n      timeout: timeoutMs,\r\n      env: { ...process.env, CI: \"1\", NO_COLOR: \"1\" },\r\n    });\r\n    if (result.status === 0) {\r\n      return { ok: true, note: options.okNote ?? `${bin} ${args.join(\" \")}: ok` };\r\n    }\r\n    const stderr = (result.stderr || result.stdout || \"\").trim();\r\n    const prefix = options.failPrefix ?? `${bin} ${args.join(\" \")} failed`;\r\n    return {\r\n      ok: false,\r\n      note: stderr ? `${prefix}: ${stderr.slice(0, 200)}` : prefix,\r\n    };\r\n  } catch (err) {\r\n    return {\r\n      ok: false,\r\n      note: err instanceof Error ? err.message : `${bin} probe failed`,\r\n    };\r\n  }\r\n}\r\n\r\n/** Exit-code-only probe \u2014 stdout/stderr are discarded to avoid leaking auth payloads. */\r\nexport function probeCliExitCodeOnly(\r\n  bin: string,\r\n  args: string[],\r\n  options: { timeoutMs?: number; okNote?: string; failNote?: string } = {},\r\n): { ok: boolean; note?: string } {\r\n  const timeoutMs = options.timeoutMs ?? 8_000;\r\n  try {\r\n    const result = spawnSync(bin, args, {\r\n      stdio: \"ignore\",\r\n      timeout: timeoutMs,\r\n      env: { ...process.env, CI: \"1\", NO_COLOR: \"1\" },\r\n    });\r\n    if (result.status === 0) {\r\n      return { ok: true, note: options.okNote ?? `${bin} authenticated` };\r\n    }\r\n    return { ok: false, note: options.failNote ?? `${bin} not authenticated` };\r\n  } catch (err) {\r\n    return {\r\n      ok: false,\r\n      note: err instanceof Error ? err.message : `${bin} auth probe failed`,\r\n    };\r\n  }\r\n}\r\n", "import { existsSync } from \"node:fs\";\r\nimport { homedir } from \"node:os\";\r\nimport path from \"node:path\";\r\nimport type { OrchestrationProviderBindingStatus } from \"./types.js\";\r\nimport {\r\n  envKeyFingerprint,\r\n  fingerprintAuthStore,\r\n  probeCliCommand,\r\n  resolveCliBin,\r\n} from \"./oauth-binding-utils.js\";\r\n\r\nconst DEFAULT_CODEX_BIN = \"codex\";\r\n\r\nfunction authStoreCandidates(): string[] {\r\n  const home = homedir();\r\n  return [\r\n    path.join(home, \".codex\", \"auth.json\"),\r\n    path.join(home, \".config\", \"codex\", \"auth.json\"),\r\n  ];\r\n}\r\n\r\n/**\r\n * Probe BYO Codex OAuth on the local runner. Never reads or returns raw OAuth tokens.\r\n */\r\nexport function probeCodexOAuthBinding(\r\n  nowIso: string = new Date().toISOString(),\r\n): OrchestrationProviderBindingStatus {\r\n  const bin = resolveCliBin(DEFAULT_CODEX_BIN, [\"KYNVER_CODEX_BIN\", \"CODEX_BIN\"]);\r\n\r\n  if (process.env.CODEX_API_KEY?.trim()) {\r\n    return {\r\n      providerId: \"codex\",\r\n      ready: true,\r\n      authSource: \"api_key_env\",\r\n      sessionFingerprint: envKeyFingerprint(\"CODEX_API_KEY\"),\r\n      checkedAt: nowIso,\r\n      note: \"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)\",\r\n    };\r\n  }\r\n\r\n  const authPath = authStoreCandidates().find((p) => existsSync(p));\r\n  const login = probeCliCommand(bin, [\"login\", \"status\"], {\r\n    okNote: \"codex login status: authenticated\",\r\n    failPrefix: \"codex login status\",\r\n  });\r\n  const ready = Boolean(authPath) && login.ok;\r\n\r\n  return {\r\n    providerId: \"codex\",\r\n    ready,\r\n    authSource: \"oauth_local\",\r\n    sessionFingerprint: authPath ? fingerprintAuthStore(authPath) : undefined,\r\n    checkedAt: nowIso,\r\n    note: ready\r\n      ? \"Local Codex OAuth session bound on runner\"\r\n      : [login.note, authPath ? undefined : \"no ~/.codex/auth.json\"].filter(Boolean).join(\"; \"),\r\n  };\r\n}\r\n", "import { existsSync } from \"node:fs\";\r\nimport { homedir } from \"node:os\";\r\nimport path from \"node:path\";\r\nimport type { OrchestrationAuthSource } from \"./types.js\";\r\nimport {\r\n  fingerprintAuthStore,\r\n  probeCliCommand,\r\n  probeCliExitCodeOnly,\r\n  resolveCliBin,\r\n} from \"./oauth-binding-utils.js\";\r\n\r\nexport type HermesOpenAiCodexPath = \"hermes_openai_codex\";\r\n\r\nexport interface HermesOpenAiCodexBindingStatus {\r\n  path: HermesOpenAiCodexPath;\r\n  ready: boolean;\r\n  authSource: OrchestrationAuthSource;\r\n  sessionFingerprint?: string;\r\n  checkedAt: string;\r\n  note?: string;\r\n}\r\n\r\nfunction hermesAuthStorePath(): string {\r\n  const configured = process.env.HERMES_HOME?.trim();\r\n  const home = configured ? path.resolve(configured) : path.join(homedir(), \".hermes\");\r\n  return path.join(home, \"auth.json\");\r\n}\r\n\r\n/**\r\n * Probe Hermes-managed OpenAI Codex subscription (ChatGPT backend-api/codex).\r\n * Uses exit-code-only `hermes auth status` \u2014 never reads auth.json token payloads.\r\n */\r\nexport function probeHermesOpenAiCodexBinding(\r\n  nowIso: string = new Date().toISOString(),\r\n): HermesOpenAiCodexBindingStatus {\r\n  const bin = resolveCliBin(\"hermes\", [\"KYNVER_HERMES_BIN\", \"HERMES_BIN\"]);\r\n  const cli = probeCliCommand(bin, [\"--version\"], {\r\n    okNote: `${bin} CLI available`,\r\n    failPrefix: `${bin} CLI not available`,\r\n  });\r\n  const authPath = hermesAuthStorePath();\r\n  const authStorePresent = existsSync(authPath);\r\n  const auth = probeCliExitCodeOnly(bin, [\"auth\", \"status\", \"openai-codex\"], {\r\n    okNote: \"hermes openai-codex: logged in\",\r\n    failNote: \"hermes openai-codex: not logged in\",\r\n  });\r\n  const ready = cli.ok && auth.ok;\r\n  const authSource: OrchestrationAuthSource = ready ? \"subscription_hermes\" : \"none\";\r\n\r\n  return {\r\n    path: \"hermes_openai_codex\",\r\n    ready,\r\n    authSource,\r\n    sessionFingerprint: authStorePresent ? fingerprintAuthStore(authPath) : undefined,\r\n    checkedAt: nowIso,\r\n    note: ready\r\n      ? \"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)\"\r\n      : [cli.note, auth.note, authStorePresent ? undefined : \"no ~/.hermes/auth.json\"]\r\n          .filter(Boolean)\r\n          .join(\"; \"),\r\n  };\r\n}\r\n", "import { probeCodexOAuthBinding } from \"./codex-oauth-binding.js\";\r\nimport {\r\n  probeHermesOpenAiCodexBinding,\r\n  type HermesOpenAiCodexBindingStatus,\r\n} from \"./hermes-openai-codex-binding.js\";\r\nimport type { OrchestrationProviderBindingStatus } from \"./types.js\";\r\n\r\n/** How low-cost Codex orchestration authenticates on this host. */\r\nexport type CodexOrchestrationPath = \"codex_cli\" | \"hermes_openai_codex\" | \"none\";\r\n\r\nexport interface CodexOrchestrationAdapterStatus extends OrchestrationProviderBindingStatus {\r\n  path: CodexOrchestrationPath;\r\n  hermesOpenAiCodex?: HermesOpenAiCodexBindingStatus;\r\n}\r\n\r\n/**\r\n * Resolve the best local Codex/OpenAI orchestration path: standalone `codex` CLI first,\r\n * then Hermes-managed `openai-codex` subscription when the CLI is absent or unbound.\r\n */\r\nexport function resolveCodexOrchestrationAdapter(\r\n  nowIso: string = new Date().toISOString(),\r\n): CodexOrchestrationAdapterStatus {\r\n  const cliBinding = probeCodexOAuthBinding(nowIso);\r\n  if (cliBinding.ready) {\r\n    return { ...cliBinding, path: \"codex_cli\" };\r\n  }\r\n\r\n  const hermes = probeHermesOpenAiCodexBinding(nowIso);\r\n  if (hermes.ready) {\r\n    return {\r\n      providerId: \"codex\",\r\n      ready: true,\r\n      authSource: hermes.authSource,\r\n      sessionFingerprint: hermes.sessionFingerprint,\r\n      checkedAt: hermes.checkedAt,\r\n      note: hermes.note,\r\n      path: \"hermes_openai_codex\",\r\n      hermesOpenAiCodex: hermes,\r\n    };\r\n  }\r\n\r\n  return {\r\n    providerId: \"codex\",\r\n    ready: false,\r\n    authSource: \"none\",\r\n    checkedAt: nowIso,\r\n    path: \"none\",\r\n    hermesOpenAiCodex: hermes,\r\n    note: [cliBinding.note, hermes.note].filter(Boolean).join(\"; \") || \"Codex CLI and Hermes openai-codex unavailable\",\r\n  };\r\n}\r\n", "import { existsSync } from \"node:fs\";\r\nimport { homedir } from \"node:os\";\r\nimport path from \"node:path\";\r\nimport type { OrchestrationProviderBindingStatus } from \"./types.js\";\r\nimport {\r\n  envKeyFingerprint,\r\n  fingerprintAuthStore,\r\n  probeCliCommand,\r\n  resolveCliBin,\r\n} from \"./oauth-binding-utils.js\";\r\n\r\nconst DEFAULT_AGENT_BIN = \"agent\";\r\n\r\nfunction cursorAuthStoreCandidates(): string[] {\r\n  const home = homedir();\r\n  return [path.join(home, \".config\", \"cursor\", \"auth.json\")];\r\n}\r\n\r\n/**\r\n * Probe Cursor/Composer OAuth on the local runner. Never reads or returns raw OAuth tokens.\r\n */\r\nexport function probeCursorOAuthBinding(\r\n  nowIso: string = new Date().toISOString(),\r\n): OrchestrationProviderBindingStatus {\r\n  const bin = resolveCliBin(DEFAULT_AGENT_BIN, [\r\n    \"KYNVER_CURSOR_AGENT_BIN\",\r\n    \"CURSOR_AGENT_BIN\",\r\n  ]);\r\n\r\n  if (process.env.CURSOR_API_KEY?.trim()) {\r\n    return {\r\n      providerId: \"cursor\",\r\n      ready: true,\r\n      authSource: \"api_key_env\",\r\n      sessionFingerprint: envKeyFingerprint(\"CURSOR_API_KEY\"),\r\n      checkedAt: nowIso,\r\n      note: \"CURSOR_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)\",\r\n    };\r\n  }\r\n\r\n  const cli = probeCliCommand(bin, [\"-v\"], {\r\n    okNote: `${bin} CLI available`,\r\n    failPrefix: `${bin} CLI not available`,\r\n  });\r\n  const authPath = cursorAuthStoreCandidates().find((p) => existsSync(p));\r\n  const ready = Boolean(authPath) && cli.ok;\r\n\r\n  return {\r\n    providerId: \"cursor\",\r\n    ready,\r\n    authSource: \"oauth_local\",\r\n    sessionFingerprint: authPath ? fingerprintAuthStore(authPath) : undefined,\r\n    checkedAt: nowIso,\r\n    note: ready\r\n      ? \"Local Cursor/Composer OAuth session bound on runner\"\r\n      : [cli.note, authPath ? undefined : \"no ~/.config/cursor/auth.json\"].filter(Boolean).join(\"; \"),\r\n  };\r\n}\r\n", "import { existsSync, readFileSync } from \"node:fs\";\r\nimport { homedir } from \"node:os\";\r\nimport path from \"node:path\";\r\nimport type { OrchestrationAuthSource } from \"./types.js\";\r\nimport {\r\n  fingerprintAuthStore,\r\n  probeCliCommand,\r\n  resolveCliBin,\r\n} from \"./oauth-binding-utils.js\";\r\n\r\nexport interface HermesCliAdapterStatus {\r\n  adapterId: \"hermes\";\r\n  cliAvailable: boolean;\r\n  profileBound: boolean;\r\n  authSource: OrchestrationAuthSource;\r\n  sessionFingerprint?: string;\r\n  checkedAt: string;\r\n  note?: string;\r\n}\r\n\r\nconst PROFILE_ENV_KEYS = [\r\n  \"OPENAI_API_KEY\",\r\n  \"ANTHROPIC_API_KEY\",\r\n  \"KYNVER_API_KEY\",\r\n  \"KYNVER_BASE_URL\",\r\n] as const;\r\n\r\nfunction hermesProfileEnvPath(): string {\r\n  const configured = process.env.HERMES_HOME?.trim();\r\n  const home = configured ? path.resolve(configured) : path.join(homedir(), \".hermes\");\r\n  return path.join(home, \".env\");\r\n}\r\n\r\n/** Presence-only scan \u2014 records key names configured, never values. */\r\nfunction profileEnvKeyPresence(envPath: string): string[] {\r\n  try {\r\n    const text = readFileSync(envPath, \"utf8\");\r\n    const present: string[] = [];\r\n    for (const key of PROFILE_ENV_KEYS) {\r\n      const re = new RegExp(`^${key}=`, \"m\");\r\n      if (re.test(text)) present.push(key);\r\n    }\r\n    return present;\r\n  } catch {\r\n    return [];\r\n  }\r\n}\r\n\r\n/**\r\n * Best-effort Hermes Forge CLI adapter probe. Cloud/API keys in ~/.hermes/.env are\r\n * reported as api_key_env \u2014 distinct from harness worker BYO OAuth inventory.\r\n */\r\nexport function probeHermesCliAdapter(\r\n  nowIso: string = new Date().toISOString(),\r\n): HermesCliAdapterStatus {\r\n  const bin = resolveCliBin(\"hermes\", [\"KYNVER_HERMES_BIN\", \"HERMES_BIN\"]);\r\n  const cli = probeCliCommand(bin, [\"--version\"], {\r\n    okNote: `${bin} CLI available`,\r\n    failPrefix: `${bin} CLI not available`,\r\n  });\r\n  const profilePath = hermesProfileEnvPath();\r\n  const profileBound = existsSync(profilePath);\r\n  const envKeys = profileBound ? profileEnvKeyPresence(profilePath) : [];\r\n  const hasApiKeys = envKeys.some((k) => k.endsWith(\"_API_KEY\"));\r\n  const authSource: OrchestrationAuthSource = hasApiKeys ? \"api_key_env\" : profileBound ? \"oauth_local\" : \"none\";\r\n  const ready = cli.ok && profileBound;\r\n\r\n  return {\r\n    adapterId: \"hermes\",\r\n    cliAvailable: cli.ok,\r\n    profileBound,\r\n    authSource,\r\n    sessionFingerprint: profileBound ? fingerprintAuthStore(profilePath) : undefined,\r\n    checkedAt: nowIso,\r\n    note: ready\r\n      ? `Hermes profile bound (${envKeys.length ? `keys: ${envKeys.join(\", \")}` : \"no API keys detected\"})`\r\n      : [cli.note, profileBound ? undefined : \"no ~/.hermes/.env\"].filter(Boolean).join(\"; \"),\r\n  };\r\n}\r\n", "import { probeClaudeOAuthBinding } from \"./claude-oauth-binding.js\";\r\nimport { probeCodexOAuthBinding } from \"./codex-oauth-binding.js\";\r\nimport {\r\n  resolveCodexOrchestrationAdapter,\r\n  type CodexOrchestrationPath,\r\n} from \"./codex-orchestration-adapter.js\";\r\nimport { probeCursorOAuthBinding } from \"./cursor-oauth-binding.js\";\r\nimport { probeHermesCliAdapter, type HermesCliAdapterStatus } from \"./hermes-cli-adapter.js\";\r\nimport {\r\n  probeHermesOpenAiCodexBinding,\r\n  type HermesOpenAiCodexBindingStatus,\r\n} from \"./hermes-openai-codex-binding.js\";\r\nimport type { OrchestrationProviderBindingStatus, OrchestrationProviderId } from \"./types.js\";\r\n\r\nexport interface OrchestrationCloudApiCredits {\r\n  /** ANTHROPIC_API_KEY configured on host (cloud billing \u2014 not BYO OAuth). */\r\n  anthropicApiKey: boolean;\r\n  /** OPENAI_API_KEY configured on host (cloud billing \u2014 distinct from Codex OAuth). */\r\n  openaiApiKey: boolean;\r\n  /** CODEX_API_KEY configured on host (OpenAI Codex cloud path). */\r\n  codexApiKey: boolean;\r\n}\r\n\r\nexport interface OrchestrationProviderInventory {\r\n  generatedAt: string;\r\n  bindings: Record<OrchestrationProviderId, OrchestrationProviderBindingStatus>;\r\n  /** API-key cloud paths \u2014 separate from local OAuth CLI sessions. */\r\n  cloudApiCredits: OrchestrationCloudApiCredits;\r\n  hermes: HermesCliAdapterStatus;\r\n  hermesOpenAiCodex: HermesOpenAiCodexBindingStatus;\r\n  codexAdapterPath: CodexOrchestrationPath;\r\n  readyCount: number;\r\n}\r\n\r\nexport interface BuildOrchestrationProviderInventoryOptions {\r\n  nowIso?: () => string;\r\n}\r\n\r\n/**\r\n * Probe all harness orchestration CLI providers on this host.\r\n * Never reads or returns raw OAuth tokens or API key values.\r\n */\r\nexport function buildOrchestrationProviderInventory(\r\n  options: BuildOrchestrationProviderInventoryOptions = {},\r\n): OrchestrationProviderInventory {\r\n  const generatedAt = options.nowIso?.() ?? new Date().toISOString();\r\n  const codexAdapter = resolveCodexOrchestrationAdapter(generatedAt);\r\n  const bindings = {\r\n    codex: codexAdapter,\r\n    cursor: probeCursorOAuthBinding(generatedAt),\r\n    claude: probeClaudeOAuthBinding(generatedAt),\r\n  } satisfies Record<OrchestrationProviderId, OrchestrationProviderBindingStatus>;\r\n\r\n  const readyCount = Object.values(bindings).filter((b) => b.ready).length;\r\n\r\n  return {\r\n    generatedAt,\r\n    bindings,\r\n    cloudApiCredits: {\r\n      anthropicApiKey: Boolean(process.env.ANTHROPIC_API_KEY?.trim()),\r\n      openaiApiKey: Boolean(process.env.OPENAI_API_KEY?.trim()),\r\n      codexApiKey: Boolean(process.env.CODEX_API_KEY?.trim()),\r\n    },\r\n    hermes: probeHermesCliAdapter(generatedAt),\r\n    hermesOpenAiCodex: probeHermesOpenAiCodexBinding(generatedAt),\r\n    codexAdapterPath: codexAdapter.path,\r\n    readyCount,\r\n  };\r\n}\r\n\r\nexport function probeOrchestrationProviderBinding(\r\n  providerId: OrchestrationProviderId,\r\n  nowIso?: string,\r\n): OrchestrationProviderBindingStatus {\r\n  switch (providerId) {\r\n    case \"codex\":\r\n      return resolveCodexOrchestrationAdapter(nowIso);\r\n    case \"cursor\":\r\n      return probeCursorOAuthBinding(nowIso);\r\n    case \"claude\":\r\n      return probeClaudeOAuthBinding(nowIso);\r\n  }\r\n}\r\n", "import type { OrchestrationProviderCapability, OrchestrationProviderId } from \"./types.js\";\r\n\r\nconst CAPABILITIES: Record<OrchestrationProviderId, OrchestrationProviderCapability> = {\r\n  codex: {\r\n    id: \"codex\",\r\n    displayName: \"Codex (BYO OAuth / Hermes openai-codex)\",\r\n    costTier: \"low\",\r\n    authSources: [\"oauth_local\", \"api_key_env\", \"subscription_hermes\"],\r\n    supportsLowRiskOrchestration: true,\r\n    supportsPrivilegedPlatformActions: false,\r\n  },\r\n  cursor: {\r\n    id: \"cursor\",\r\n    displayName: \"Cursor / Composer\",\r\n    costTier: \"medium\",\r\n    authSources: [\"oauth_local\", \"api_key_env\"],\r\n    supportsLowRiskOrchestration: true,\r\n    supportsPrivilegedPlatformActions: true,\r\n  },\r\n  claude: {\r\n    id: \"claude\",\r\n    displayName: \"Claude Code\",\r\n    costTier: \"high\",\r\n    authSources: [\"oauth_local\"],\r\n    supportsLowRiskOrchestration: true,\r\n    supportsPrivilegedPlatformActions: true,\r\n  },\r\n};\r\n\r\nexport function getOrchestrationProviderCapability(\r\n  id: OrchestrationProviderId,\r\n): OrchestrationProviderCapability {\r\n  return CAPABILITIES[id];\r\n}\r\n\r\nexport function listOrchestrationProviderCapabilities(): OrchestrationProviderCapability[] {\r\n  return Object.values(CAPABILITIES);\r\n}\r\n", "/** Kynver-first foreground orchestration policy \u2014 observe before enforce. */\r\n\r\nexport const ORCHESTRATION_POLICY_MODES = [\"off\", \"observe\", \"enforce\"] as const;\r\nexport type OrchestrationPolicyMode = (typeof ORCHESTRATION_POLICY_MODES)[number];\r\n\r\nexport const ORCHESTRATION_ACTION_KINDS = [\r\n  \"foreground_harness_spawn\",\r\n  \"shell_platform_dispatch\",\r\n] as const;\r\nexport type OrchestrationActionKind = (typeof ORCHESTRATION_ACTION_KINDS)[number];\r\n\r\nexport const ORCHESTRATION_POLICY_DECISIONS = [\r\n  \"allow_local\",\r\n  \"observe_bypass\",\r\n  \"enforce_harness_task\",\r\n] as const;\r\nexport type OrchestrationPolicyDecision = (typeof ORCHESTRATION_POLICY_DECISIONS)[number];\r\n\r\nexport interface OrchestrationPolicyEvaluateInput {\r\n  action: OrchestrationActionKind;\r\n  toolName?: string | null;\r\n  sessionId?: string | null;\r\n  planId?: string | null;\r\n  parentTaskId?: string | null;\r\n  title?: string | null;\r\n  description?: string | null;\r\n}\r\n\r\nexport interface OrchestrationPolicyEvaluateResult {\r\n  mode: OrchestrationPolicyMode;\r\n  decision: OrchestrationPolicyDecision;\r\n  /** Stable idempotency key when enforce would create a linked harness task. */\r\n  idempotencyKey: string | null;\r\n  bypassLogged: boolean;\r\n  reason: string;\r\n}\r\n", "import type { OrchestrationPolicyMode } from \"./types.js\";\r\nimport { ORCHESTRATION_POLICY_MODES } from \"./types.js\";\r\n\r\nfunction normalizeMode(raw: string | undefined): OrchestrationPolicyMode {\r\n  const value = (raw ?? \"off\").trim().toLowerCase();\r\n  if ((ORCHESTRATION_POLICY_MODES as readonly string[]).includes(value)) {\r\n    return value as OrchestrationPolicyMode;\r\n  }\r\n  return \"off\";\r\n}\r\n\r\n/** Resolve orchestration policy mode from env (default off \u2014 local fallback preserved). */\r\nexport function resolveOrchestrationPolicyMode(\r\n  env: NodeJS.ProcessEnv = process.env,\r\n): OrchestrationPolicyMode {\r\n  return normalizeMode(env.KYNVER_ORCHESTRATION_POLICY_MODE);\r\n}\r\n\r\n/** Feature gate for enforce-mode linked AgentTask creation (default false until explicitly on). */\r\nexport function isOrchestrationEnforceTasksEnabled(\r\n  env: NodeJS.ProcessEnv = process.env,\r\n): boolean {\r\n  const raw = env.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();\r\n  if (!raw) return resolveOrchestrationPolicyMode(env) === \"enforce\";\r\n  return raw === \"1\" || raw === \"true\" || raw === \"yes\" || raw === \"on\";\r\n}\r\n", "import { createHash } from \"node:crypto\";\r\n\r\nfunction trimOrNull(value: string | null | undefined): string | null {\r\n  if (value == null) return null;\r\n  const t = value.trim();\r\n  return t.length ? t : null;\r\n}\r\n\r\n/** Deterministic foreground harness task idempotency key for Hermes/Forge sessions. */\r\nexport function buildForegroundHarnessIdempotencyKey(input: {\r\n  sessionId?: string | null;\r\n  planId?: string | null;\r\n  parentTaskId?: string | null;\r\n  title?: string | null;\r\n  action?: string | null;\r\n}): string {\r\n  const session = trimOrNull(input.sessionId) ?? \"anonymous\";\r\n  const title = trimOrNull(input.title) ?? trimOrNull(input.action) ?? \"foreground\";\r\n  const digest = createHash(\"sha256\")\r\n    .update(\r\n      [\r\n        trimOrNull(input.planId) ?? \"\",\r\n        trimOrNull(input.parentTaskId) ?? \"\",\r\n        title.toLowerCase(),\r\n      ].join(\"|\"),\r\n    )\r\n    .digest(\"hex\")\r\n    .slice(0, 16);\r\n  return `hermes-foreground:${session}:${digest}`;\r\n}\r\n", "import {\r\n  isOrchestrationEnforceTasksEnabled,\r\n  resolveOrchestrationPolicyMode,\r\n} from \"./config.js\";\r\nimport { buildForegroundHarnessIdempotencyKey } from \"./idempotency.js\";\r\nimport type {\r\n  OrchestrationPolicyDecision,\r\n  OrchestrationPolicyEvaluateInput,\r\n  OrchestrationPolicyEvaluateResult,\r\n  OrchestrationPolicyMode,\r\n} from \"./types.js\";\r\n\r\nfunction decisionForMode(\r\n  mode: OrchestrationPolicyMode,\r\n  enforceEnabled: boolean,\r\n): OrchestrationPolicyDecision {\r\n  if (mode === \"enforce\" && enforceEnabled) return \"enforce_harness_task\";\r\n  if (mode === \"observe\") return \"observe_bypass\";\r\n  return \"allow_local\";\r\n}\r\n\r\n/**\r\n * Evaluate whether a foreground orchestration action should stay local, be\r\n * observed (logged bypass), or route through linked harness AgentTask creation.\r\n */\r\nexport function evaluateOrchestrationPolicy(\r\n  input: OrchestrationPolicyEvaluateInput,\r\n  env: NodeJS.ProcessEnv = process.env,\r\n): OrchestrationPolicyEvaluateResult {\r\n  const mode = resolveOrchestrationPolicyMode(env);\r\n  const enforceEnabled = isOrchestrationEnforceTasksEnabled(env);\r\n  const decision = decisionForMode(mode, enforceEnabled);\r\n  const idempotencyKey =\r\n    decision === \"enforce_harness_task\"\r\n      ? buildForegroundHarnessIdempotencyKey({\r\n          sessionId: input.sessionId,\r\n          planId: input.planId,\r\n          parentTaskId: input.parentTaskId,\r\n          title: input.title,\r\n          action: input.action,\r\n        })\r\n      : null;\r\n\r\n  let reason: string;\r\n  if (mode === \"off\") {\r\n    reason = \"Orchestration policy off \u2014 local foreground path allowed.\";\r\n  } else if (decision === \"observe_bypass\") {\r\n    reason = `Observe mode: ${input.action} bypass logged; local fallback preserved.`;\r\n  } else if (decision === \"enforce_harness_task\") {\r\n    reason = `Enforce mode: ${input.action} must create linked harness AgentTask (${idempotencyKey}).`;\r\n  } else {\r\n    reason = \"Local foreground path allowed.\";\r\n  }\r\n\r\n  return {\r\n    mode,\r\n    decision,\r\n    idempotencyKey,\r\n    bypassLogged: decision === \"observe_bypass\",\r\n    reason,\r\n  };\r\n}\r\n"],
+  "mappings": ";AAAA,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,OAAO,UAAU;;;ACFjB,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAGnB,SAAS,qBAAqB,UAAsC;AACzE,MAAI;AACF,UAAM,KAAK,SAAS,QAAQ;AAC5B,UAAM,WAAW,GAAG,QAAQ,IAAI,GAAG,IAAI,IAAI,GAAG,OAAO;AACrD,WAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,kBAAkB,QAAwB;AACxD,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,MAAM,EAAE,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC/E;AAEO,SAAS,cACd,YACA,SACQ;AACR,aAAW,OAAO,SAAS;AACzB,UAAM,QAAQ,QAAQ,IAAI,GAAG,GAAG,KAAK;AACrC,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO;AACT;AAEO,SAAS,gBACd,KACA,MACA,UAII,CAAC,GAC2B;AAChC,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI;AACF,UAAM,SAAS,UAAU,KAAK,MAAM;AAAA,MAClC,UAAU;AAAA,MACV,SAAS;AAAA,MACT,KAAK,EAAE,GAAG,QAAQ,KAAK,IAAI,KAAK,UAAU,IAAI;AAAA,IAChD,CAAC;AACD,QAAI,OAAO,WAAW,GAAG;AACvB,aAAO,EAAE,IAAI,MAAM,MAAM,QAAQ,UAAU,GAAG,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,OAAO;AAAA,IAC5E;AACA,UAAM,UAAU,OAAO,UAAU,OAAO,UAAU,IAAI,KAAK;AAC3D,UAAM,SAAS,QAAQ,cAAc,GAAG,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC;AAC7D,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM,SAAS,GAAG,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK;AAAA,IACxD;AAAA,EACF,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM,eAAe,QAAQ,IAAI,UAAU,GAAG,GAAG;AAAA,IACnD;AAAA,EACF;AACF;AAGO,SAAS,qBACd,KACA,MACA,UAAsE,CAAC,GACvC;AAChC,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI;AACF,UAAM,SAAS,UAAU,KAAK,MAAM;AAAA,MAClC,OAAO;AAAA,MACP,SAAS;AAAA,MACT,KAAK,EAAE,GAAG,QAAQ,KAAK,IAAI,KAAK,UAAU,IAAI;AAAA,IAChD,CAAC;AACD,QAAI,OAAO,WAAW,GAAG;AACvB,aAAO,EAAE,IAAI,MAAM,MAAM,QAAQ,UAAU,GAAG,GAAG,iBAAiB;AAAA,IACpE;AACA,WAAO,EAAE,IAAI,OAAO,MAAM,QAAQ,YAAY,GAAG,GAAG,qBAAqB;AAAA,EAC3E,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM,eAAe,QAAQ,IAAI,UAAU,GAAG,GAAG;AAAA,IACnD;AAAA,EACF;AACF;;;AD1EA,IAAM,qBAAqB;AAE3B,SAAS,4BAAsC;AAC7C,QAAM,OAAO,QAAQ;AACrB,SAAO,CAAC,KAAK,KAAK,MAAM,WAAW,mBAAmB,CAAC;AACzD;AAMO,SAAS,wBACd,UAAiB,oBAAI,KAAK,GAAE,YAAY,GACJ;AACpC,QAAM,MAAM,cAAc,oBAAoB,CAAC,qBAAqB,YAAY,CAAC;AAEjF,MAAI,QAAQ,IAAI,mBAAmB,KAAK,GAAG;AACzC,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,oBAAoB,kBAAkB,mBAAmB;AAAA,MACzD,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,MAAM,gBAAgB,KAAK,CAAC,WAAW,GAAG;AAAA,IAC9C,QAAQ,GAAG,GAAG;AAAA,IACd,YAAY,GAAG,GAAG;AAAA,EACpB,CAAC;AACD,QAAM,WAAW,0BAA0B,EAAE,KAAK,CAAC,MAAM,WAAW,CAAC,CAAC;AACtE,QAAM,QAAQ,qBAAqB,KAAK,CAAC,QAAQ,QAAQ,GAAG;AAAA,IAC1D,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,QAAQ,IAAI,OAAO,MAAM,MAAM,QAAQ,QAAQ;AAErD,SAAO;AAAA,IACL,YAAY;AAAA,IACZ;AAAA,IACA,YAAY;AAAA,IACZ,oBAAoB,WAAW,qBAAqB,QAAQ,IAAI;AAAA,IAChE,WAAW;AAAA,IACX,MAAM,QACF,oDACA,CAAC,IAAI,MAAM,MAAM,MAAM,WAAW,SAAY,gCAAgC,EAC3E,OAAO,OAAO,EACd,KAAK,IAAI;AAAA,EAClB;AACF;;;AE9DA,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,WAAAC,gBAAe;AACxB,OAAOC,WAAU;AASjB,IAAM,oBAAoB;AAE1B,SAAS,sBAAgC;AACvC,QAAM,OAAOC,SAAQ;AACrB,SAAO;AAAA,IACLC,MAAK,KAAK,MAAM,UAAU,WAAW;AAAA,IACrCA,MAAK,KAAK,MAAM,WAAW,SAAS,WAAW;AAAA,EACjD;AACF;AAKO,SAAS,uBACd,UAAiB,oBAAI,KAAK,GAAE,YAAY,GACJ;AACpC,QAAM,MAAM,cAAc,mBAAmB,CAAC,oBAAoB,WAAW,CAAC;AAE9E,MAAI,QAAQ,IAAI,eAAe,KAAK,GAAG;AACrC,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,oBAAoB,kBAAkB,eAAe;AAAA,MACrD,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,WAAW,oBAAoB,EAAE,KAAK,CAAC,MAAMC,YAAW,CAAC,CAAC;AAChE,QAAM,QAAQ,gBAAgB,KAAK,CAAC,SAAS,QAAQ,GAAG;AAAA,IACtD,QAAQ;AAAA,IACR,YAAY;AAAA,EACd,CAAC;AACD,QAAM,QAAQ,QAAQ,QAAQ,KAAK,MAAM;AAEzC,SAAO;AAAA,IACL,YAAY;AAAA,IACZ;AAAA,IACA,YAAY;AAAA,IACZ,oBAAoB,WAAW,qBAAqB,QAAQ,IAAI;AAAA,IAChE,WAAW;AAAA,IACX,MAAM,QACF,8CACA,CAAC,MAAM,MAAM,WAAW,SAAY,uBAAuB,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,EAC5F;AACF;;;ACzDA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,WAAAC,gBAAe;AACxB,OAAOC,WAAU;AAoBjB,SAAS,sBAA8B;AACrC,QAAM,aAAa,QAAQ,IAAI,aAAa,KAAK;AACjD,QAAM,OAAO,aAAaC,MAAK,QAAQ,UAAU,IAAIA,MAAK,KAAKC,SAAQ,GAAG,SAAS;AACnF,SAAOD,MAAK,KAAK,MAAM,WAAW;AACpC;AAMO,SAAS,8BACd,UAAiB,oBAAI,KAAK,GAAE,YAAY,GACR;AAChC,QAAM,MAAM,cAAc,UAAU,CAAC,qBAAqB,YAAY,CAAC;AACvE,QAAM,MAAM,gBAAgB,KAAK,CAAC,WAAW,GAAG;AAAA,IAC9C,QAAQ,GAAG,GAAG;AAAA,IACd,YAAY,GAAG,GAAG;AAAA,EACpB,CAAC;AACD,QAAM,WAAW,oBAAoB;AACrC,QAAM,mBAAmBE,YAAW,QAAQ;AAC5C,QAAM,OAAO,qBAAqB,KAAK,CAAC,QAAQ,UAAU,cAAc,GAAG;AAAA,IACzE,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,QAAQ,IAAI,MAAM,KAAK;AAC7B,QAAM,aAAsC,QAAQ,wBAAwB;AAE5E,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,oBAAoB,mBAAmB,qBAAqB,QAAQ,IAAI;AAAA,IACxE,WAAW;AAAA,IACX,MAAM,QACF,yEACA,CAAC,IAAI,MAAM,KAAK,MAAM,mBAAmB,SAAY,wBAAwB,EAC1E,OAAO,OAAO,EACd,KAAK,IAAI;AAAA,EAClB;AACF;;;AC1CO,SAAS,iCACd,UAAiB,oBAAI,KAAK,GAAE,YAAY,GACP;AACjC,QAAM,aAAa,uBAAuB,MAAM;AAChD,MAAI,WAAW,OAAO;AACpB,WAAO,EAAE,GAAG,YAAY,MAAM,YAAY;AAAA,EAC5C;AAEA,QAAM,SAAS,8BAA8B,MAAM;AACnD,MAAI,OAAO,OAAO;AAChB,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,OAAO;AAAA,MACP,YAAY,OAAO;AAAA,MACnB,oBAAoB,OAAO;AAAA,MAC3B,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO;AAAA,MACb,MAAM;AAAA,MACN,mBAAmB;AAAA,IACrB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,MAAM;AAAA,IACN,mBAAmB;AAAA,IACnB,MAAM,CAAC,WAAW,MAAM,OAAO,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,KAAK;AAAA,EACrE;AACF;;;AClDA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,WAAAC,gBAAe;AACxB,OAAOC,WAAU;AASjB,IAAM,oBAAoB;AAE1B,SAAS,4BAAsC;AAC7C,QAAM,OAAOC,SAAQ;AACrB,SAAO,CAACC,MAAK,KAAK,MAAM,WAAW,UAAU,WAAW,CAAC;AAC3D;AAKO,SAAS,wBACd,UAAiB,oBAAI,KAAK,GAAE,YAAY,GACJ;AACpC,QAAM,MAAM,cAAc,mBAAmB;AAAA,IAC3C;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,QAAQ,IAAI,gBAAgB,KAAK,GAAG;AACtC,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,oBAAoB,kBAAkB,gBAAgB;AAAA,MACtD,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,MAAM,gBAAgB,KAAK,CAAC,IAAI,GAAG;AAAA,IACvC,QAAQ,GAAG,GAAG;AAAA,IACd,YAAY,GAAG,GAAG;AAAA,EACpB,CAAC;AACD,QAAM,WAAW,0BAA0B,EAAE,KAAK,CAAC,MAAMC,YAAW,CAAC,CAAC;AACtE,QAAM,QAAQ,QAAQ,QAAQ,KAAK,IAAI;AAEvC,SAAO;AAAA,IACL,YAAY;AAAA,IACZ;AAAA,IACA,YAAY;AAAA,IACZ,oBAAoB,WAAW,qBAAqB,QAAQ,IAAI;AAAA,IAChE,WAAW;AAAA,IACX,MAAM,QACF,wDACA,CAAC,IAAI,MAAM,WAAW,SAAY,+BAA+B,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,EAClG;AACF;;;ACzDA,SAAS,cAAAC,aAAY,oBAAoB;AACzC,SAAS,WAAAC,gBAAe;AACxB,OAAOC,WAAU;AAkBjB,IAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,uBAA+B;AACtC,QAAM,aAAa,QAAQ,IAAI,aAAa,KAAK;AACjD,QAAM,OAAO,aAAaC,MAAK,QAAQ,UAAU,IAAIA,MAAK,KAAKC,SAAQ,GAAG,SAAS;AACnF,SAAOD,MAAK,KAAK,MAAM,MAAM;AAC/B;AAGA,SAAS,sBAAsB,SAA2B;AACxD,MAAI;AACF,UAAM,OAAO,aAAa,SAAS,MAAM;AACzC,UAAM,UAAoB,CAAC;AAC3B,eAAW,OAAO,kBAAkB;AAClC,YAAM,KAAK,IAAI,OAAO,IAAI,GAAG,KAAK,GAAG;AACrC,UAAI,GAAG,KAAK,IAAI,EAAG,SAAQ,KAAK,GAAG;AAAA,IACrC;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAMO,SAAS,sBACd,UAAiB,oBAAI,KAAK,GAAE,YAAY,GAChB;AACxB,QAAM,MAAM,cAAc,UAAU,CAAC,qBAAqB,YAAY,CAAC;AACvE,QAAM,MAAM,gBAAgB,KAAK,CAAC,WAAW,GAAG;AAAA,IAC9C,QAAQ,GAAG,GAAG;AAAA,IACd,YAAY,GAAG,GAAG;AAAA,EACpB,CAAC;AACD,QAAM,cAAc,qBAAqB;AACzC,QAAM,eAAeE,YAAW,WAAW;AAC3C,QAAM,UAAU,eAAe,sBAAsB,WAAW,IAAI,CAAC;AACrE,QAAM,aAAa,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC;AAC7D,QAAM,aAAsC,aAAa,gBAAgB,eAAe,gBAAgB;AACxG,QAAM,QAAQ,IAAI,MAAM;AAExB,SAAO;AAAA,IACL,WAAW;AAAA,IACX,cAAc,IAAI;AAAA,IAClB;AAAA,IACA;AAAA,IACA,oBAAoB,eAAe,qBAAqB,WAAW,IAAI;AAAA,IACvE,WAAW;AAAA,IACX,MAAM,QACF,yBAAyB,QAAQ,SAAS,SAAS,QAAQ,KAAK,IAAI,CAAC,KAAK,sBAAsB,MAChG,CAAC,IAAI,MAAM,eAAe,SAAY,mBAAmB,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,EAC1F;AACF;;;ACpCO,SAAS,oCACd,UAAsD,CAAC,GACvB;AAChC,QAAM,cAAc,QAAQ,SAAS,MAAK,oBAAI,KAAK,GAAE,YAAY;AACjE,QAAM,eAAe,iCAAiC,WAAW;AACjE,QAAM,WAAW;AAAA,IACf,OAAO;AAAA,IACP,QAAQ,wBAAwB,WAAW;AAAA,IAC3C,QAAQ,wBAAwB,WAAW;AAAA,EAC7C;AAEA,QAAM,aAAa,OAAO,OAAO,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE;AAElE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,iBAAiB;AAAA,MACf,iBAAiB,QAAQ,QAAQ,IAAI,mBAAmB,KAAK,CAAC;AAAA,MAC9D,cAAc,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,CAAC;AAAA,MACxD,aAAa,QAAQ,QAAQ,IAAI,eAAe,KAAK,CAAC;AAAA,IACxD;AAAA,IACA,QAAQ,sBAAsB,WAAW;AAAA,IACzC,mBAAmB,8BAA8B,WAAW;AAAA,IAC5D,kBAAkB,aAAa;AAAA,IAC/B;AAAA,EACF;AACF;;;AClEA,IAAM,eAAiF;AAAA,EACrF,OAAO;AAAA,IACL,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa,CAAC,eAAe,eAAe,qBAAqB;AAAA,IACjE,8BAA8B;AAAA,IAC9B,mCAAmC;AAAA,EACrC;AAAA,EACA,QAAQ;AAAA,IACN,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa,CAAC,eAAe,aAAa;AAAA,IAC1C,8BAA8B;AAAA,IAC9B,mCAAmC;AAAA,EACrC;AAAA,EACA,QAAQ;AAAA,IACN,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa,CAAC,aAAa;AAAA,IAC3B,8BAA8B;AAAA,IAC9B,mCAAmC;AAAA,EACrC;AACF;AAQO,SAAS,wCAA2E;AACzF,SAAO,OAAO,OAAO,YAAY;AACnC;;;ACnCO,IAAM,6BAA6B,CAAC,OAAO,WAAW,SAAS;;;ACCtE,SAAS,cAAc,KAAkD;AACvE,QAAM,SAAS,OAAO,OAAO,KAAK,EAAE,YAAY;AAChD,MAAK,2BAAiD,SAAS,KAAK,GAAG;AACrE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,+BACd,MAAyB,QAAQ,KACR;AACzB,SAAO,cAAc,IAAI,gCAAgC;AAC3D;AAGO,SAAS,mCACd,MAAyB,QAAQ,KACxB;AACT,QAAM,MAAM,IAAI,oCAAoC,KAAK,EAAE,YAAY;AACvE,MAAI,CAAC,IAAK,QAAO,+BAA+B,GAAG,MAAM;AACzD,SAAO,QAAQ,OAAO,QAAQ,UAAU,QAAQ,SAAS,QAAQ;AACnE;;;ACzBA,SAAS,cAAAC,mBAAkB;AAE3B,SAAS,WAAW,OAAiD;AACnE,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,IAAI,MAAM,KAAK;AACrB,SAAO,EAAE,SAAS,IAAI;AACxB;AAGO,SAAS,qCAAqC,OAM1C;AACT,QAAM,UAAU,WAAW,MAAM,SAAS,KAAK;AAC/C,QAAM,QAAQ,WAAW,MAAM,KAAK,KAAK,WAAW,MAAM,MAAM,KAAK;AACrE,QAAM,SAASA,YAAW,QAAQ,EAC/B;AAAA,IACC;AAAA,MACE,WAAW,MAAM,MAAM,KAAK;AAAA,MAC5B,WAAW,MAAM,YAAY,KAAK;AAAA,MAClC,MAAM,YAAY;AAAA,IACpB,EAAE,KAAK,GAAG;AAAA,EACZ,EACC,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE;AACd,SAAO,qBAAqB,OAAO,IAAI,MAAM;AAC/C;;;ACjBA,SAAS,gBACP,MACA,gBAC6B;AAC7B,MAAI,SAAS,aAAa,eAAgB,QAAO;AACjD,MAAI,SAAS,UAAW,QAAO;AAC/B,SAAO;AACT;AAMO,SAAS,4BACd,OACA,MAAyB,QAAQ,KACE;AACnC,QAAM,OAAO,+BAA+B,GAAG;AAC/C,QAAM,iBAAiB,mCAAmC,GAAG;AAC7D,QAAM,WAAW,gBAAgB,MAAM,cAAc;AACrD,QAAM,iBACJ,aAAa,yBACT,qCAAqC;AAAA,IACnC,WAAW,MAAM;AAAA,IACjB,QAAQ,MAAM;AAAA,IACd,cAAc,MAAM;AAAA,IACpB,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM;AAAA,EAChB,CAAC,IACD;AAEN,MAAI;AACJ,MAAI,SAAS,OAAO;AAClB,aAAS;AAAA,EACX,WAAW,aAAa,kBAAkB;AACxC,aAAS,iBAAiB,MAAM,MAAM;AAAA,EACxC,WAAW,aAAa,wBAAwB;AAC9C,aAAS,iBAAiB,MAAM,MAAM,0CAA0C,cAAc;AAAA,EAChG,OAAO;AACL,aAAS;AAAA,EACX;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,aAAa;AAAA,IAC3B;AAAA,EACF;AACF;",
+  "names": ["existsSync", "homedir", "path", "homedir", "path", "existsSync", "existsSync", "homedir", "path", "path", "homedir", "existsSync", "existsSync", "homedir", "path", "homedir", "path", "existsSync", "existsSync", "homedir", "path", "path", "homedir", "existsSync", "createHash"]
+}

package/dist/server/pr-evidence.d.ts

@@ -0,0 +1,2 @@
+export { evidenceFromGitHubVercelStatus, type VercelEvidenceResult, } from "../vercel/vercel-evidence.js";
+export type { GitHubCommitStatusRow } from "../vercel/vercel-github-status.js";